policy-routing.txt 4.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150
  1. Classes
  2. -------
  3. "Class" is a complete routing table in common sense.
  4. I.e. it is tree of nodes (destination prefix, tos, metric)
  5. with attached information: gateway, device etc.
  6. This tree is looked up as specified in RFC1812 5.2.4.3
  7. 1. Basic match
  8. 2. Longest match
  9. 3. Weak TOS.
  10. 4. Metric. (should not be in kernel space, but they are)
  11. 5. Additional pruning rules. (not in kernel space).
  12. We have two special type of nodes:
  13. REJECT - abort route lookup and return an error value.
  14. THROW - abort route lookup in this class.
  15. Currently the number of classes is limited to 255
  16. (0 is reserved for "not specified class")
  17. Three classes are builtin:
  18. RT_CLASS_LOCAL=255 - local interface addresses,
  19. broadcasts, nat addresses.
  20. RT_CLASS_MAIN=254 - all normal routes are put there
  21. by default.
  22. RT_CLASS_DEFAULT=253 - if ip_fib_model==1, then
  23. normal default routes are put there, if ip_fib_model==2
  24. all gateway routes are put there.
  25. Rules
  26. -----
  27. Rule is a record of (src prefix, src interface, tos, dst prefix)
  28. with attached information.
  29. Rule types:
  30. RTP_ROUTE - lookup in attached class
  31. RTP_NAT - lookup in attached class and if a match is found,
  32. translate packet source address.
  33. RTP_MASQUERADE - lookup in attached class and if a match is found,
  34. masquerade packet as sourced by us.
  35. RTP_DROP - silently drop the packet.
  36. RTP_REJECT - drop the packet and send ICMP NET UNREACHABLE.
  37. RTP_PROHIBIT - drop the packet and send ICMP COMM. ADM. PROHIBITED.
  38. Rule flags:
  39. RTRF_LOG - log route creations.
  40. RTRF_VALVE - One way route (used with masquerading)
  41. Default setup:
  42. root@amber:/pub/ip-routing # iproute -r
  43. Kernel routing policy rules
  44. Pref Source Destination TOS Iface Cl
  45. 0 default default 00 * 255
  46. 254 default default 00 * 254
  47. 255 default default 00 * 253
  48. Lookup algorithm
  49. ----------------
  50. We scan rules list, and if a rule is matched, apply it.
  51. If a route is found, return it.
  52. If it is not found or a THROW node was matched, continue
  53. to scan rules.
  54. Applications
  55. ------------
  56. 1. Just ignore classes. All the routes are put into MAIN class
  57. (and/or into DEFAULT class).
  58. HOWTO: iproute add PREFIX [ tos TOS ] [ gw GW ] [ dev DEV ]
  59. [ metric METRIC ] [ reject ] ... (look at iproute utility)
  60. or use route utility from current net-tools.
  61. 2. Opposite case. Just forget all that you know about routing
  62. tables. Every rule is supplied with its own gateway, device
  63. info. record. This approach is not appropriate for automated
  64. route maintenance, but it is ideal for manual configuration.
  65. HOWTO: iproute addrule [ from PREFIX ] [ to PREFIX ] [ tos TOS ]
  66. [ dev INPUTDEV] [ pref PREFERENCE ] route [ gw GATEWAY ]
  67. [ dev OUTDEV ] .....
  68. Warning: As of now the size of the routing table in this
  69. approach is limited to 256. If someone likes this model, I'll
  70. relax this limitation.
  71. 3. OSPF classes (see RFC1583, RFC1812 E.3.3)
  72. Very clean, stable and robust algorithm for OSPF routing
  73. domains. Unfortunately, it is not widely used in the Internet.
  74. Proposed setup:
  75. 255 local addresses
  76. 254 interface routes
  77. 253 ASE routes with external metric
  78. 252 ASE routes with internal metric
  79. 251 inter-area routes
  80. 250 intra-area routes for 1st area
  81. 249 intra-area routes for 2nd area
  82. etc.
  83. Rules:
  84. iproute addrule class 253
  85. iproute addrule class 252
  86. iproute addrule class 251
  87. iproute addrule to a-prefix-for-1st-area class 250
  88. iproute addrule to another-prefix-for-1st-area class 250
  89. ...
  90. iproute addrule to a-prefix-for-2nd-area class 249
  91. ...
  92. Area classes must be terminated with reject record.
  93. iproute add default reject class 250
  94. iproute add default reject class 249
  95. ...
  96. 4. The Variant Router Requirements Algorithm (RFC1812 E.3.2)
  97. Create 16 classes for different TOS values.
  98. It is a funny, but pretty useless algorithm.
  99. I listed it just to show the power of new routing code.
  100. 5. All the variety of combinations......
  101. GATED
  102. -----
  103. Gated does not understand classes, but it will work
  104. happily in MAIN+DEFAULT. All policy routes can be set
  105. and maintained manually.
  106. IMPORTANT NOTE
  107. --------------
  108. route.c has a compilation time switch CONFIG_IP_LOCAL_RT_POLICY.
  109. If it is set, locally originated packets are routed
  110. using all the policy list. This is not very convenient and
  111. pretty ambiguous when used with NAT and masquerading.
  112. I set it to FALSE by default.
  113. Alexey Kuznetov
  114. kuznet@ms2.inr.ac.ru