1940 Commits

Author SHA1 Message Date
Maximilian Wagner
6eeb9fe261 ip: eesp support part 1 2025-04-16 12:50:04 +02:00
Ido Schimmel
df6ec985f1 iprule: Add DSCP mask support
Add DSCP mask support, allowing users to specify a DSCP value with an
optional mask. Example:

 # ip rule add dscp 1 table 100
 # ip rule add dscp 0x02/0x3f table 200
 # ip rule add dscp AF42/0x3f table 300
 # ip rule add dscp 0x10/0x30 table 400

In non-JSON output, the DSCP mask is not printed in case of exact match
and the DSCP value is printed in hexadecimal format in case of inexact
match:

 $ ip rule show
 0:      from all lookup local
 32762:  from all lookup 400 dscp 0x10/0x30
 32763:  from all lookup 300 dscp AF42
 32764:  from all lookup 200 dscp 2
 32765:  from all lookup 100 dscp 1
 32766:  from all lookup main
 32767:  from all lookup default

Dump can be filtered by DSCP value and mask:

 $ ip rule show dscp 1
 32765:  from all lookup 100 dscp 1
 $ ip rule show dscp AF42
 32763:  from all lookup 300 dscp AF42
 $ ip rule show dscp 0x10/0x30
 32762:  from all lookup 400 dscp 0x10/0x30

In JSON output, the DSCP mask is printed as an hexadecimal string to be
consistent with other masks. The DSCP value is printed as an integer in
order not to break existing scripts:

 $ ip -j -p -N rule show dscp 0x10/0x30
 [ {
         "priority": 32762,
         "src": "all",
         "table": "400",
         "dscp": "16",
         "dscp_mask": "0x30"
     } ]

The mask attribute is only sent to the kernel in case of inexact match
so that iproute2 will continue working with kernels that do not support
the attribute.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: David Ahern <dsahern@kernel.org>
2025-02-28 15:48:13 +00:00
Ido Schimmel
8503b02d70 iprule: Add port mask support
Add port mask support, allowing users to specify a source or destination
port with an optional mask. Example:

 # ip rule add sport 80 table 100
 # ip rule add sport 90/0xffff table 200
 # ip rule add dport 1000-2000 table 300
 # ip rule add sport 0x123/0xfff table 400
 # ip rule add dport 0x4/0xff table 500
 # ip rule add dport 0x8/0xf table 600
 # ip rule del dport 0x8/0xf table 600

In non-JSON output, the mask is not printed in case of exact match:

 $ ip rule show
 0:      from all lookup local
 32761:  from all dport 0x4/0xff lookup 500
 32762:  from all sport 0x123/0xfff lookup 400
 32763:  from all dport 1000-2000 lookup 300
 32764:  from all sport 90 lookup 200
 32765:  from all sport 80 lookup 100
 32766:  from all lookup main
 32767:  from all lookup default

Dump can be filtered by port value and mask:

 $ ip rule show sport 80
 32765:  from all sport 80 lookup 100
 $ ip rule show sport 90
 32764:  from all sport 90 lookup 200
 $ ip rule show sport 0x123/0x0fff
 32762:  from all sport 0x123/0xfff lookup 400
 $ ip rule show dport 4/0xff
 32761:  from all dport 0x4/0xff lookup 500

In JSON output, the port mask is printed as an hexadecimal string to be
consistent with other masks. The port value is printed as an integer in
order not to break existing scripts:

 $ ip -j -p rule show sport 0x123/0xfff table 400
 [ {
         "priority": 32762,
         "src": "all",
         "sport": 291,
         "sport_mask": "0xfff",
         "table": "400"
     } ]

The mask attribute is only sent to the kernel in case of inexact match
so that iproute2 will continue working with kernels that do not support
the attribute.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: David Ahern <dsahern@kernel.org>
2025-02-28 15:48:07 +00:00
Ido Schimmel
c7aa222948 iprule: Allow specifying ports in hexadecimal notation
This will be useful when enabling port masks in the next patch.

Before:

 # ip rule add sport 0x1 table 100
 Invalid "sport"

After:

 # ip rule add sport 0x1 table 100
 $ ip rule show sport 0x1
 32765:  from all sport 1 lookup 100

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: David Ahern <dsahern@kernel.org>
2025-02-28 15:48:04 +00:00
Ido Schimmel
64680a2ec5 iprule: Move port parsing to a function
In preparation for adding port mask support, move port parsing to a
function.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: David Ahern <dsahern@kernel.org>
2025-02-28 15:48:00 +00:00
Jordan Rife
3eddcf2dfc ip: link: netkit: Support scrub options
Add "scrub" option to configure IFLA_NETKIT_SCRUB and
IFLA_NETKIT_PEER_SCRUB when setting up a link. Add "scrub" and
"peer scrub" to device details as well when printing.

$ sudo ./ip/ip link add jordan type netkit scrub default peer scrub none
$ ./ip/ip -details link show jordan
43: jordan@nk0: <BROADCAST,MULTICAST,NOARP,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff promiscuity 0 allmulti 0 minmtu 68 maxmtu 65535
    netkit mode l3 type primary policy forward peer policy forward scrub default peer scrub none numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 tso_max_size 524280 tso_max_segs 65535 gro_max_size 65536 gso_ipv4_max_size 65536 gro_ipv4_max_size 65536

v2->v3: Updated man page.
v1->v2: Added some spaces around "scrub SCRUB" in the help message.

Link: https://lore.kernel.org/netdev/20241004101335.117711-1-daniel@iogearbox.net/

Signed-off-by: Jordan Rife <jordan@jrife.io>
Signed-off-by: David Ahern <dsahern@kernel.org>
2025-02-26 17:18:25 +00:00
Anton Moryakov
46bbbaf114 ip: remove duplicate condition in ila_csum_name2mode in
Static analyzer reported:
expression is identical to previous conditio

Corrections explained:
The condition checking for "neutral-map-auto" was duplicated in the
ila_csum_name2mode function. This commit removes the redundant check
to improve code readability and maintainability.

Triggers found by static analyzer Svace.

Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
Signed-off-by: David Ahern <dsahern@kernel.org>
2025-02-19 15:46:50 +00:00
Anton Moryakov
55446264e6 ip: handle NULL return from localtime in strxf_time in
Static analyzer reported:
Pointer 'tp', returned from function 'localtime' at ipxfrm.c:352, may be NULL
and is dereferenced at ipxfrm.c:354 by calling function 'strftime'.

Corrections explained:
The function localtime() may return NULL if the provided time value is
invalid. This commit adds a check for NULL and handles the error case
by copying "invalid-time" into the output buffer.
Unlikely, but may return an error

Triggers found by static analyzer Svace.

Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
Signed-off-by: David Ahern <dsahern@kernel.org>
2025-02-19 15:46:15 +00:00
Anton Moryakov
84da3f37e2 ip: check return value of iproute_flush_cache() in irpoute.c
Static analyzer reported:
Return value of function 'iproute_flush_cache', called at iproute.c:1732,
is not checked. The return value is obtained from function 'open64' and possibly contains an error code.

Corrections explained:
The function iproute_flush_cache() may return an error code, which was
previously ignored. This could lead to unexpected behavior if the cache
flush fails. Added error handling to ensure the function fails gracefully
when iproute_flush_cache() returns an error.

Triggers found by static analyzer Svace.

Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
Signed-off-by: David Ahern <dsahern@kernel.org>
2025-02-19 15:45:50 +00:00
Stephen Hemminger
7240e0e40f Merge ssh://gitolite.kernel.org/pub/scm/network/iproute2/iproute2-next 2025-01-21 07:03:48 -08:00
Petr Machata
1db4f56878 ip: vxlan: Support IFLA_VXLAN_RESERVED_BITS
A new attribute, IFLA_VXLAN_RESERVED_BITS, was added in Linux kernel
commit 6c11379b104e ("vxlan: Add an attribute to make VXLAN header
validation configurable") (See the link below for the full patchset).

The payload is a 64-bit binary field that covers the VXLAN header. The set
bits indicate which bits in a VXLAN packet header should be allowed to
carry 1's. Support the new attribute through a CLI keyword "reserved_bits".

Link: https://patch.msgid.link/173378643250.273075.13832548579412179113.git-patchwork-notify@kernel.org
Signed-off-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: David Ahern <dsahern@kernel.org>
2025-01-20 16:27:51 +00:00
Yuyang Huang
fe4100df83 iproute2: add 'ip monitor acaddress' support
Enhanced the 'ip monitor' command to track changes in IPv6
anycast addresses. This update allows the command to listen for
events related to anycast address additions and deletions by
registering to the newly introduced RTNLGRP_IPV6_ACADDR netlink group.

This patch depends on the kernel patch that adds RTNLGRP_IPV6_ACADDR
being merged first.

Here is an example usage:

root@uml-x86-64:/# ip monitor acaddress
2: if2    inet6 any 2001:db8:7b:0:528e:a53a:9224:c9c5 scope global
       valid_lft forever preferred_lft forever
Deleted 2: if2    inet6 any 2001:db8:7b:0:528e:a53a:9224:c9c5 scope global
       valid_lft forever preferred_lft forever

Cc: Maciej Żenczykowski <maze@google.com>
Cc: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Yuyang Huang <yuyanghuang@google.com>
Signed-off-by: David Ahern <dsahern@kernel.org>
2025-01-20 00:20:56 +00:00
Ido Schimmel
0bd19d4645 iprule: Add flow label support
Add support for 'flowlabel' selector in ip-rule.

Rules can be added with or without a mask in which case exact match is
used:

 # ip -6 rule add flowlabel 0x12345 table 100
 # ip -6 rule add flowlabel 0x11/0xff table 200
 # ip -6 rule add flowlabel 0x54321 table 300
 # ip -6 rule del flowlabel 0x54321 table 300

Dump output:

 $ ip -6 rule show
 0:      from all lookup local
 32764:  from all lookup 200 flowlabel 0x11/0xff
 32765:  from all lookup 100 flowlabel 0x12345
 32766:  from all lookup main

Dump can be filtered by flow label value and mask:

 $ ip -6 rule show flowlabel 0x12345
 32765:  from all lookup 100 flowlabel 0x12345
 $ ip -6 rule show flowlabel 0x11/0xff
 32764:  from all lookup 200 flowlabel 0x11/0xff

JSON output:

 $ ip -6 -j -p rule show flowlabel 0x12345
 [ {
         "priority": 32765,
         "src": "all",
         "table": "100",
         "flowlabel": "0x12345",
         "flowlabel_mask": "0xfffff"
     } ]
 $ ip -6 -j -p rule show flowlabel 0x11/0xff
 [ {
         "priority": 32764,
         "src": "all",
         "table": "200",
         "flowlabel": "0x11",
         "flowlabel_mask": "0xff"
     } ]

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: David Ahern <dsahern@kernel.org>
2025-01-01 01:19:46 +00:00
Ido Schimmel
35ae138e2c ip: route: Add IPv6 flow label support
Allow specifying an IPv6 flow label when performing a route lookup.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: David Ahern <dsahern@kernel.org>
2025-01-01 01:19:43 +00:00
Yuyang Huang
19514606dc iproute2: add 'ip monitor maddress' support
Enhanced the 'ip monitor' command to track changes in IPv4 and IPv6
multicast addresses. This update allows the command to listen for
events related to multicast address additions and deletions by
registering to the newly introduced RTNLGRP_IPV4_MCADDR and
RTNLGRP_IPV6_MCADDR netlink groups.

This patch depends on the kernel patch that adds RTNLGRP_IPV4_MCADDR
and RTNLGRP_IPV6_MCADDR being merged first.

Here is an example usage:

root@uml-x86-64:/# ip monitor maddress
9: nettest123    inet6 mcast ff01::1 scope global
       valid_lft forever preferred_lft forever
9: nettest123    inet6 mcast ff02::1 scope global
       valid_lft forever preferred_lft forever
9: nettest123    inet mcast 224.0.0.1 scope global
       valid_lft forever preferred_lft forever
9: nettest123    inet6 mcast ff02::1:ff00:7b01 scope global
       valid_lft forever preferred_lft forever
Deleted 9: nettest123    inet mcast 224.0.0.1 scope global
       valid_lft forever preferred_lft forever
Deleted 9: nettest123    inet6 mcast ff02::1:ff00:7b01 scope global
       valid_lft forever preferred_lft forever
Deleted 9: nettest123    inet6 mcast ff02::1 scope global
       valid_lft forever preferred_lft forever

Cc: Maciej Żenczykowski <maze@google.com>
Cc: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Yuyang Huang <yuyanghuang@google.com>
Signed-off-by: David Ahern <dsahern@kernel.org>
2024-12-16 03:04:22 +00:00
Robert Marko
1f0f9deb55 ip: link: rmnet: add support for flag handling
Extend the current rmnet support to allow enabling or disabling
IFLA_RMNET_FLAGS via ip link as well as printing the current settings.

Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Signed-off-by: David Ahern <dsahern@kernel.org>
2024-12-16 03:01:13 +00:00
Stephen Hemminger
7e23da91fc ip: rearrange and prune header files
The recent report of issues with missing limits.h impacting musl
suggested looking at what files are and are not included in ip code.

The standard practice is to put standard headers first, then system,
then local headers. Used iwyu to get suggestions about missing
and extraneous headers.

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
2024-12-12 15:22:22 -08:00
Fabian Pfitzner
16aa4494d7 bridge: dump mcast querier state
Kernel support for dumping the multicast querier state was added in this
commit [1]. As some people might be interested to get this information
from userspace, this commit implements the necessary changes to show it
via

ip -d link show [dev]

The querier state shows the following information for IPv4 and IPv6
respectively:

1) The ip address of the current querier in the network. This could be
   ourselves or an external querier.
2) The port on which the querier was seen
3) Querier timeout in seconds

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c7fa1d9b1fb179375e889ff076a1566ecc997bfc

Signed-off-by: Fabian Pfitzner <f.pfitzner@pengutronix.de>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
2024-12-12 15:21:28 -08:00
Stephen Hemminger
83d642e3b1 Merge ssh://gitolite.kernel.org/pub/scm/network/iproute2/iproute2-next 2024-12-01 16:29:17 -08:00
Minhong He
0325d98f98 ip: fix memory leak in do_show()
Free the 'answer' obtained from 'rtnl_talk()'.

Fixes: 6887a0656d ("ip: netconf: fix overzealous error checking")

Signed-off-by: Minhong He <heminhong@kylinos.cn>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
2024-11-25 09:02:49 -08:00
Vincent Mailhol
3f2ab9d607 iplink_can: rename dbt into fd_dbt in can_parse_opt()
The CAN XL support will introduce another dbt variable. Rename the
current dbt variable into fd_dbt to avoid future confusion. When
introduced, the CAN XL variable will be named xl_dbt.

Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Signed-off-by: David Ahern <dsahern@kernel.org>
2024-11-18 16:51:18 +00:00
Vincent Mailhol
aac087a010 iplink_can: add struct can_tdc
Add the struct can_tdc to group the tdcv, tdco and tdvf variables
together. The structure is borrowed from linux/can/bittiming.h [1].

This refactor is a preparation for the introduction of CAN XL.

[1] https://elixir.bootlin.com/linux/v6.11/source/include/linux/can/bittiming.h#L78

Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Signed-off-by: David Ahern <dsahern@kernel.org>
2024-11-18 16:50:45 +00:00
Vincent Mailhol
68aaea8628 iplink_can: use invarg() instead of fprintf()
invarg() is specifically designed to print error messages when an
invalid argument is provided. Replace the generic fprintf() by
invarg() in can_parse_opt().

Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Signed-off-by: David Ahern <dsahern@kernel.org>
2024-11-18 16:50:31 +00:00
Vincent Mailhol
9b1f33d5a4 iplink_can: remove newline at the end of invarg()'s messages
invarg() already prints a new line by default. Adding an explicit "\n"
at the end of the message results in two lines being printed. Remove
all newlines at the end of the invarg() messages.

Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Signed-off-by: David Ahern <dsahern@kernel.org>
2024-11-18 16:50:20 +00:00
Vincent Mailhol
3bd5fb4d57 iplink_can: reduce the visibility of tdc in can_parse_opt()
tdc is only used in a single if block. Move its declaration to the top
of the compound statement where it is used.

Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Signed-off-by: David Ahern <dsahern@kernel.org>
2024-11-18 16:50:05 +00:00
Vincent Mailhol
df72757907 iplink_can: remove unused FILE *f parameter in three functions
FILE *f, the first parameter of below functions:

 * can_print_tdc_opt()
 * can_print_tdc_const_opt()
 * void can_print_ctrlmode_ext()

is unused. Remove it.

Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Signed-off-by: David Ahern <dsahern@kernel.org>
2024-11-18 16:49:28 +00:00
David Ahern
2d35b775a4 Merge remote-tracking branch 'main/main' into next
Signed-off-by: David Ahern <dsahern@kernel.org>
2024-10-25 16:53:41 +00:00
Yedaya Katsman
9953ebde0c ip: Add "down" filter for "ip addr/link show"
Currently there is an "up" option, which allows showing only devices
that are up and running. Add a corresponding "down" option.

Also change the usage and man pages accordingly.

Signed-off-by: Yedaya Katsman <yedaya.ka@gmail.com>
Signed-off-by: David Ahern <dsahern@kernel.org>
2024-10-25 16:50:35 +00:00
Xiao Liang
a597ab156b iplink: Fix link-netns id and link ifindex
When link-netns or link-netnsid is supplied, lookup link in that netns.
And if both netns and link-netns are given, IFLA_LINK_NETNSID should be
the nsid of link-netns from the view of target netns, not from current
one.

For example, when handling:

    # ip -n ns1 link add netns ns2 link-netns ns3 link eth1 eth1.100 type vlan id 100

should lookup eth1 in ns3 and IFLA_LINK_NETNSID is the id of ns3 from
ns2.

Signed-off-by: Xiao Liang <shaw.leon@gmail.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
2024-10-17 12:09:44 -07:00
Xiao Liang
18bbd74b34 ip: Move of set_netnsid_from_name() to namespace.c
Move set_netnsid_from_name() outside for reuse, like what's done for
netns_id_from_name().

Signed-off-by: Xiao Liang <shaw.leon@gmail.com>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
2024-10-17 12:08:08 -07:00
Jakub Kicinski
6887a0656d ip: netconf: fix overzealous error checking
The rtnetlink.sh kernel test started reporting errors after
iproute2 update. The error checking introduced by commit
under fixes is incorrect. rtnl_listen() always returns
an error, because the only way to break the loop is to
return an error from the handler, it seems.

Switch this code to using normal rtnl_talk(), instead of
the rtnl_listen() abuse. As far as I can tell the use of
rtnl_listen() was to make get and dump use common handling
but that's no longer the case, anyway.

Before:
  $ ip -6 netconf show dev lo
  inet6 lo forwarding off mc_forwarding off proxy_neigh off ignore_routes_with_linkdown off
  $ echo $?
  2

After:
  $ ./ip/ip -6 netconf show dev lo
inet6 lo forwarding off mc_forwarding off proxy_neigh off ignore_routes_with_linkdown off
  $ echo $?
  0

Fixes: 00e8a64dac ("ip: detect errors in netconf monitor mode")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
2024-10-11 10:35:58 -07:00
Ido Schimmel
75e760026c iprule: Add DSCP support
Add support for 'dscp' selector in ip-rule.

Rules can be added with a numeric DSCP value:

 # ip rule add dscp 1 table 100
 # ip rule add dscp 0x02 table 200

Or using symbolic names from /usr/share/iproute2/rt_dsfield or
/etc/iproute2/rt_dsfield:

 # ip rule add dscp AF42 table 300

Dump output:

 $ ip rule show
 0:      from all lookup local
 32763:  from all lookup 300 dscp AF42
 32764:  from all lookup 200 dscp 2
 32765:  from all lookup 100 dscp 1
 32766:  from all lookup main
 32767:  from all lookup default

Dump can be filtered by DSCP value:

 $ ip rule show dscp 1
 32765:  from all lookup 100 dscp 1

Or by a symbolic name:

 $ ip rule show dscp AF42
 32763:  from all lookup 300 dscp AF42

When the numeric option is specified, symbolic names will be translated
to numeric values:

 $ ip -N rule show
 0:      from all lookup 255
 32763:  from all lookup 300 dscp 36
 32764:  from all lookup 200 dscp 2
 32765:  from all lookup 100 dscp 1
 32766:  from all lookup 254
 32767:  from all lookup 253

The same applies to the JSON output in order to be consistent with
existing fields such as "tos" and "table":

 $ ip -j -p rule show dscp AF42
 [ {
         "priority": 32763,
         "src": "all",
         "table": "300",
         "dscp": "AF42"
     } ]

 $ ip -j -p -N rule show dscp AF42
 [ {
         "priority": 32763,
         "src": "all",
         "table": "300",
         "dscp": "36"
     } ]

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Daniel Machon <daniel.machon@microchip.com>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: David Ahern <dsahern@kernel.org>
2024-10-11 00:27:23 +00:00
Hangbin Liu
f305296e40 ip/ipmroute: use preferred_family to get prefix
The mroute family is reset to RTNL_FAMILY_IPMR or RTNL_FAMILY_IP6MR when
retrieving the multicast routing cache. However, the get_prefix() and
subsequently __get_addr_1() cannot identify these families. Using
preferred_family to obtain the prefix can resolve this issue.

Fixes: 98ce99273f ("mroute: fix up family handling")
Reported-by: Jianlin Shi <jishi@redhat.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
2024-10-10 09:52:49 -07:00
David Ahern
0fb4ef8bbb Merge remote-tracking branch 'main/main' into next
Fixed conflicts in lib/utils.c

Signed-off-by: David Ahern <dsahern@kernel.org>
2024-10-05 23:06:06 +00:00
David Lamparter
031922c8a3 lib: utils: move over print_num from ip/
`print_num()` was born in `ip/ipaddress.c` but considering it has
nothing to do with IP addresses it should really live in `lib/utils.c`.

(I've had reason to call it from bridge/* on some random hackery.)

Signed-off-by: David Lamparter <equinox@diac24.net>
Signed-off-by: David Ahern <dsahern@kernel.org>
2024-10-05 17:48:11 +00:00
Nicolas Dichtel
57daf8ff8c iplink: fix fd leak when playing with netns
The command 'ip link set foo netns mynetns' opens a file descriptor to fill
the netlink attribute IFLA_NET_NS_FD. This file descriptor is never closed.
When batch mode is used, the number of file descriptor may grow greatly and
reach the maximum file descriptor number that can be opened.

This fd can be closed only after the netlink answer. Moreover, a second
fd could be opened because some (struct link_util)->parse_opt() handlers
call iplink_parse().

Let's add a helper to manage these fds:
 - open_fds_add() stores a fd, up to 5 (arbitrary choice, it seems enough);
 - open_fds_close() closes all stored fds.

Fixes: 0dc34c7713 ("iproute2: Add processless network namespace support")
Reported-by: Alexandre Ferrieux <alexandre.ferrieux@orange.com>
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
2024-09-28 09:24:56 -07:00
Justin Iurman
42ba9a6fb8 ip: lwtunnel: tunsrc support
Add support for setting/getting the new "tunsrc" feature.

Signed-off-by: Justin Iurman <justin.iurman@uliege.be>
Signed-off-by: David Ahern <dsahern@kernel.org>
2024-09-09 15:19:36 +00:00
Petr Machata
1fa8811c50 ip: nexthop: Support 16-bit nexthop weights
Two interlinked changes related to the nexthop group management have been
recently merged in kernel commit e96f6fd30eec ("Merge branch
'net-nexthop-increase-weight-to-u16'").

- One of the reserved bytes in struct nexthop_grp was redefined to carry
  high-order bits of the nexthop weight, thus allowing 16-bit nexthop
  weights.

- NHA_OP_FLAGS started getting dumped on nexthop group dump to carry a
  flag, NHA_OP_FLAG_RESP_GRP_RESVD_0, that indicates that reserved fields
  in struct nexthop_grp are zeroed before dumping.

If NHA_OP_FLAG_RESP_GRP_RESVD_0 is given, it is safe to interpret the newly
named nexthop_grp.weight_high as high-order bits of nexthop weight.

Extend ipnexthop to support configuring nexthop weights of up to 65536, and
when dumping, to interpret nexthop_grp.weight_high if safe.

Signed-off-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: David Ahern <dsahern@kernel.org>
2024-08-19 01:06:46 +00:00
Nikolay Aleksandrov
354d8a3688 ip/netkit: print peer policy
Print also the peer policy, example:
$ ip -d l sh dev netkit0
...
 netkit mode l2 type primary policy blackhole peer policy forward
...

Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
Signed-off-by: David Ahern <dsahern@kernel.org>
2024-08-09 14:32:46 +00:00
Matthieu Baerts (NGI0)
b176b9f403 ip: mptcp: 'id 0' is only for 'del'
Adding an endpoint with 'id 0' is not allowed. In this case, the kernel
will ignore this 'id 0' and set another one.

Similarly, because there are no endpoints with this 'id 0', changing an
attribute for such endpoint will not be possible.

To avoid some confusions, it sounds better to clearly report an error
that the ID cannot be 0 in these cases.

Acked-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
2024-08-02 10:47:39 -07:00
Beniamino Galvani
554ea3649d ip: do not print stray prefixes in monitor mode
When running "ip monitor", accept_msg() first prints the prefix and
then calls the object-specific print function, which also does the
filtering. Therefore, it is possible that the prefix is printed even
for events that get ignored later. For example:

  ip link add dummy1 type dummy
  ip link set dummy1 up
  ip -ts monitor all dev dummy1 &
  ip link add dummy2 type dummy
  ip addr add dev dummy1 192.0.2.1/24

generates:

  [2024-07-12T22:11:26.338342] [LINK][2024-07-12T22:11:26.339846] [ADDR]314: dummy1    inet 192.0.2.1/24 scope global dummy1
       valid_lft forever preferred_lft forever

Fix this by printing the prefix only after the filtering. Now the
output for the commands above is:

 [2024-07-12T22:11:26.339846] [ADDR]314: dummy1    inet 192.0.2.1/24 scope global dummy1
       valid_lft forever preferred_lft forever

See also commit 7e0a889b54 ("bridge: Do not print stray prefixes in
monitor mode") which fixed the same problem in the bridge tool.

Signed-off-by: Beniamino Galvani <b.galvani@gmail.com>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
2024-07-17 16:48:25 -07:00
David Ahern
af9559b233 Merge remote-tracking branch 'main/main' into next
Signed-off-by: David Ahern <dsahern@kernel.org>
2024-07-08 22:36:13 +00:00
Tobias Waldekranz
60a95a8a2e ip: bridge: add support for mst_enabled
When enabled, the bridge's legacy per-VLAN STP facility is replaced
with the Multiple Spanning Tree Protocol (MSTP) compatible version.

Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Signed-off-by: David Ahern <dsahern@kernel.org>
2024-07-08 03:33:53 +00:00
Stephen Hemminger
0ea0699ea0 route: filter by interface on multipath routes
The ip route command would silently hide multipath routes when filter
by interface. The problem was it was not looking for interface when
filter multipath routes.

Example:
	ip link add name dummy1 up type dummy
	ip link add name dummy2 up type dummy
	ip address add 192.0.2.1/28 dev dummy1
	ip address add 192.0.2.17/28 dev dummy2
	ip route add 198.51.100.0/24 \
		nexthop via 192.0.2.2 dev dummy1 \
		nexthop via 192.0.2.18 dev dummy2

Before:
ip route show dev dummy1
192.0.2.0/28 proto kernel scope link src 192.0.2.1

After:
ip route show dev dummy1
192.0.2.0/28 proto kernel scope link src 192.0.2.1
198.51.100.0/24
	nexthop via 192.0.2.2 dev dummy1 weight 1
	nexthop via 192.0.2.18 dev dummy2 weight 1

Reported-by: "Muggeridge, Matt" <matt.muggeridge2@hpe.com>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
2024-07-04 17:44:55 -07:00
Christian Hopps
7f7726a7a4 xfrm: add SA direction attribute
Add support for new SA direction netlink attribute.

Co-developed-by: Antony Antony <antony.antony@secunet.com>
Co-developed-by: Christian Hopps <chopps@labn.net>
Signed-off-by: Christian Hopps <chopps@labn.net>
Signed-off-by: David Ahern <dsahern@kernel.org>
2024-06-04 22:53:26 +00:00
Yedaya Katsman
3cd62286ac rtmon: Align usage with ip help
Also update the man page accordingly, and add ip-monitor to see also

Signed-off-by: Yedaya Katsman <yedaya.ka@gmail.com>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
2024-05-13 22:23:55 -07:00
Stephen Hemminger
08cd3ce70a Merge git://git.kernel.org/pub/scm/network/iproute2/iproute2-next 2024-05-13 16:21:11 -07:00
Yedaya Katsman
c9eab8973c ip: Add missing options to route get help output
The "as", "to", "connected" and "notify" options were missing from the
help message in the route get section. Add them to usage help and man
page.

Note that there isn't an explanation for "as" or "notify" in the man
page.

Signed-off-by: Yedaya Katsman <yedaya.ka@gmail.com>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
2024-05-07 08:06:10 -07:00
David Ahern
977d51cfec Merge remote-tracking branch 'main/main' into next
Signed-off-by: David Ahern <dsahern@kernel.org>
2024-05-03 15:40:02 +00:00
Lukasz Majewski
c72323d2ef ip link: hsr: Add support for passing information about INTERLINK device
The HSR capable device can operate in two modes of operations -
Doubly Attached Node for HSR (DANH) and RedBOX (HSR-SAN).

The latter one allows connection of non-HSR aware device(s) to HSR
network.
This node is called SAN (Singly Attached Network) and is connected via
INTERLINK network device.

This patch adds support for passing information about the INTERLINK
device, so the Linux driver can properly setup it.

Signed-off-by: Lukasz Majewski <lukma@denx.de>
Signed-off-by: David Ahern <dsahern@kernel.org>
2024-05-03 15:19:30 +00:00