Release-v1.9.8

.github/workflows/build.yaml

@@ -17,18 +17,22 @@ jobs:
     runs-on: self-hosted
     env:
       PKG_CONFIG_PATH: /data/dpdk/dpdklib/lib64/pkgconfig
+      ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
     steps:
-    - uses: actions/checkout@v2
-    - name: make
+    - name: Checkout Code
+      uses: actions/checkout@v3
+    - name: build
       run: make -j
 
   build-all:
     runs-on: self-hosted
     env:
       PKG_CONFIG_PATH: /data/dpdk/dpdklib/lib64/pkgconfig
+      ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
     steps:
-    - uses: actions/checkout@v2
-    - name: config
+    - name: Checkout Code
+      uses: actions/checkout@v3
+    - name: Config
       run: sed -i 's/=n$/=y/' config.mk
-    - name: make
+    - name: build
       run: make -j

.github/workflows/run.yaml

@@ -17,11 +17,13 @@ jobs:
     runs-on: self-hosted
     env:
       PKG_CONFIG_PATH: /data/dpdk/dpdklib/lib64/pkgconfig
+      ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
     steps:
-    - uses: actions/checkout@v2
-    - name: make
+    - name: Checkout Code
+      uses: actions/checkout@v3
+    - name: Build
       run: make -j
-    - name: install
+    - name: Install
       run: make install
-    - name: run-dpvs
+    - name: Run DPVS
       run: sudo dpvsci $(pwd)/bin/dpvs

conf/dpvs.bond.conf.sample

@@ -17,6 +17,7 @@ global_defs {
     ! log_async_mode    off
     ! kni               on
     ! pdump             off
+    lldp                on
 }
 
 ! netif config

conf/dpvs.conf.items

@@ -19,6 +19,7 @@ global_defs {
     <init> log_async_pool_size  16383               <16383, 1023-unlimited>
     <init> pdump                off                 <off, on|off>
     <init> kni                  on                  <on, on|off>
+    lldp                        on                  <off, on|off>
 }
 
 ! netif config
@@ -193,6 +194,9 @@ ipv4_defs {
 ipv6_defs {
     disable                 off         <off, on/off>
     forwarding              off         <off, on/off>
+    addr_gen_mode           eui64       <eui64,none,stable-privacy,random>
+    stable_secret           ""          <128-bit hexadecimal string, used in stable-privacy mode >
+                                        <stable_secret can be produced by `uuidgen | sed 's/-//g'>
     route6 {
         <init> method       "hlist"     <"hlist"/"lpm">
         recycle_time        10          <10, 1-36000>

conf/dpvs.conf.sample

@@ -17,6 +17,7 @@ global_defs {
     ! log_async_mode    on
     ! kni               on
     ! pdump             off
+    lldp                on
 }
 
 ! netif config

conf/dpvs.conf.single-bond.sample

@@ -16,6 +16,7 @@ global_defs {
     ! log_file    /var/log/dpvs.log
     ! log_async_mode    on
     ! kni               on
+    lldp                on
 }
 
 ! netif config

conf/dpvs.conf.single-nic.sample

@@ -16,6 +16,7 @@ global_defs {
     ! log_file    /var/log/dpvs.log
     ! log_async_mode    on
     ! kni               on
+    lldp                on
 }
 
 ! netif config

doc/IPset.md

@@ -459,7 +459,7 @@ bin/dpip: invalid parameter
 The hash:ip,port,net set type uses a hash table to store IP address, port number and IP network address triples. Both IPv4 and IPv6 address are supported. The IP address of the IP and net should be of the same family. When adding/deleting entries, ranges are allowed but is transformed to specific host IP and port entries when stored into hash table for the "ip" and "port" segments. IPv4 supports both IP range and IP CIDR, while IPv6 supports IP CIDR only. Network address with zero prefix size is not supported, and is interpreted as host prefix size, i.e., 32 for IPv4 and 128 for IPv6. Option "nomatch" can be used to set exceptions to the set when add/deleting entries. If a test is matched against with a "nomatch" entry, then the result would end with false. The port number is interpreted together with a protocol. Supported protocols include TCP, UDP, ICMP, and ICMPv6, any other protocols are interpreted as unspec type with a protocol number of zero.
 
 ```bash
-# ./bin/dpip ipset create bar hash:ip,port,net
+# ./bin/dpip ipset -6 create bar hash:ip,port,net
 # ./bin/dpip ipset add bar 2001::1,8080-8082,2002::/64
 # ./bin/dpip ipset add bar 2001::1,8080-8082,2002::aaaa:bbbb:ccc0:0/108 nomatch
 # ./bin/dpip ipset -v list bar

include/conf/blklst.h

@@ -24,22 +24,22 @@
 
 #include "inet.h"
 #include "conf/sockopts.h"
+#include "conf/ipset.h"
 
 struct dp_vs_blklst_entry {
     union inet_addr addr;
 };
 
 typedef struct dp_vs_blklst_conf {
     /* identify service */
-    union inet_addr     blklst;
     union inet_addr     vaddr;
-    int                 af;
-    uint32_t            fwmark;
     uint16_t            vport;
     uint8_t             proto;
-    uint8_t             padding;
+    uint8_t             af;
 
-    /* for set */
+    /* subject and ipset are mutual exclusive */
+    union inet_addr     subject;
+    char                ipset[IPSET_MAXNAMELEN];
 } dpvs_blklst_t;
 
 struct dp_vs_blklst_conf_array {

include/conf/common.h

@@ -22,6 +22,7 @@
 #include <unistd.h>
 #include <ctype.h>
 #include <sys/types.h>
+#include <sys/socket.h>
 #include <linux/if_ether.h>
 
 typedef uint32_t sockoptid_t;
@@ -142,6 +143,7 @@ int linux_get_link_status(const char *ifname, int *if_flags, char *if_flags_str,
 int linux_set_if_mac(const char *ifname, const unsigned char mac[ETH_ALEN]);
 int linux_hw_mc_add(const char *ifname, const uint8_t hwma[ETH_ALEN]);
 int linux_hw_mc_del(const char *ifname, const uint8_t hwma[ETH_ALEN]);
+int linux_ifname2index(const char *ifname);
 
 /* read "n" bytes from a descriptor */
 ssize_t readn(int fd, void *vptr, size_t n);
@@ -166,4 +168,40 @@ static inline char *strlwr(char *str) {
     return str;
 }
 
+/* convert hexadecimal string to binary sequence, return the converted binary length
+ * note: buflen should be half in size of len at least */
+int hexstr2binary(const char *hexstr, size_t len, uint8_t *buf, size_t buflen);
+
+/* convert binary sequence to hexadecimal string, return the converted string length
+ * note: buflen should be twice in size of len at least */
+int binary2hexstr(const uint8_t *hex, size_t len, char *buf, size_t buflen);
+
+/* convert binary sequence to printable or hexadecimal string, return the converted string length
+ * note: buflen should be triple in size of len in the worst case */
+int binary2print(const uint8_t *hex, size_t len, char *buf, size_t buflen);
+
+/* get prefix from network mask */
+int mask2prefix(const struct sockaddr *addr);
+
+/* get host addresses and corresponding interfaces
+ *
+ * Loopback addresses, ipv6 link local addresses, and addresses on linked-down
+ * or not-running interface are ignored. If multiple addresses matched, return
+ * the address of the least prefix length.
+ *
+ * Params:
+ *   @ifname: preferred interface where to get host address, can be NULL
+ *   @result4: store ipv4 address found, can be NULL
+ *   @result6: store ipv6 address found, can be NULL
+ *   @ifname4: interface name of ipv4 address, can be NULL
+ *   @ifname6: interface name of ipv6 address, can be NULL
+ * Return:
+ *   1: only ipv4 address found
+ *   2: only ipv6 address found
+ *   3: both ipv4 and ipv6 address found
+ *   dpvs error code: error occurred
+ * */
+int get_host_addr(const char *ifname, struct sockaddr_storage *result4,
+        struct sockaddr_storage *result6, char *ifname4, char *ifname6);
+
 #endif /* __DPVS_COMMON_H__ */

include/conf/inet.h

@@ -89,6 +89,7 @@ static inline const char *inet_proto_name(uint8_t proto)
     const static char *proto_names[256] = {
         [IPPROTO_TCP]     = "TCP",
         [IPPROTO_UDP]     = "UDP",
+        [IPPROTO_SCTP]    = "SCTP",
         [IPPROTO_ICMP]    = "ICMP",
         [IPPROTO_ICMPV6]  = "ICMPV6",
     };

include/conf/inetaddr.h

@@ -34,6 +34,7 @@ enum {
 
 /* leverage IFA_F_XXX in linux/if_addr.h*/
 #define IFA_F_SAPOOL        0x10000 /* if address with sockaddr pool */
+#define IFA_F_LINKLOCAL     0x20000 /* ipv6 link-local address */
 
 /* ifa command flags */
 #define IFA_F_OPS_VERBOSE   0x0001
@@ -100,4 +101,17 @@ struct inet_addr_front {
 };
 #endif /* CONFIG_DPVS_AGENT */
 
+struct inet_maddr_entry {
+    char             ifname[IFNAMSIZ];
+    union inet_addr  maddr;
+    int              af;
+    uint32_t         flags;
+    uint32_t         refcnt;
+} __attribute__((__packed__));
+
+struct inet_maddr_array {
+    int                      nmaddr;
+    struct inet_maddr_entry  maddrs[0];
+} __attribute__((__packed__));
+
 #endif /* __DPVS_INETADDR_CONF_H__ */

include/conf/ipset.h

@@ -32,7 +32,7 @@
 #define IPSET_F_FORCE   0x0001
 
 enum ipset_op {
-    IPSET_OP_ADD,
+    IPSET_OP_ADD = 1,
     IPSET_OP_DEL,
     IPSET_OP_TEST,
     IPSET_OP_CREATE,
@@ -43,34 +43,36 @@ enum ipset_op {
 };
 
 struct ipset_option {
-    int family;
     union {
         struct {
-            bool comment;
-            int hashsize;
-            int maxelem;
-        } create;
+            int32_t hashsize;
+            uint32_t maxelem;
+            uint8_t comment;
+        } __attribute__((__packed__)) create;
         struct {
-            bool nomatch;
-        } add;
+            char padding[8];
+            uint8_t nomatch;
+        } __attribute__((__packed__)) add;
     };
-};
+    uint8_t family;
+} __attribute__((__packed__));
 
 struct ipset_param {
     char                        type[IPSET_MAXNAMELEN];
     char                        name[IPSET_MAXNAMELEN];
     char                        comment[IPSET_MAXCOMLEN];
-    int                         opcode;
-    struct ipset_option         option;
+    uint16_t                    opcode;
     uint16_t                    flag;
+    struct ipset_option         option;
 
     uint8_t                     proto;
     uint8_t                     cidr;
     struct inet_addr_range      range;   /* port in host byteorder */
-    uint8_t                     mac[6];
     char                        iface[IFNAMSIZ];
+    uint8_t                     mac[6];
 
     /* for type with 2 nets */
+    uint8_t                     padding;
     uint8_t                     cidr2;
     struct inet_addr_range      range2;
     //uint8_t                     mac[2];
@@ -83,43 +85,48 @@ struct ipset_member {
     uint8_t                     cidr;
     uint8_t                     proto;
     uint16_t                    port;
-    uint8_t                     mac[6];
     char                        iface[IFNAMSIZ];
-    bool                        nomatch;
+    uint8_t                     mac[6];
+    uint8_t                     nomatch;
 
     /* second net */
-    union inet_addr             addr2;
     uint8_t                     cidr2;
     uint16_t                    port2;
+    uint8_t                     padding[2];
+    union inet_addr             addr2;
 };
 
 struct ipset_info {
     char name[IPSET_MAXNAMELEN];
     char type[IPSET_MAXNAMELEN];
-    bool comment;
+    uint8_t comment;
+
+    uint8_t af;
+    uint8_t padding[2];
 
     union {
         struct ipset_bitmap_header {
-            struct inet_addr_range range;
             uint8_t cidr;
+            uint8_t padding[3];
+            struct inet_addr_range range;
         } bitmap;
         struct ipset_hash_header {
-            int hashsize;
-            int maxelem;
+            uint8_t padding[4]; // aligned for dpvs-agent
+            int32_t hashsize;
+            uint32_t maxelem;
         } hash;
     };
 
-    int af;
-    size_t size;
-    int entries;
-    int references;
+    uint32_t size;
+    uint32_t entries;
+    uint32_t references;
 
     void *members;
 };
 
 struct ipset_info_array {
-    int                   nipset;
-    struct ipset_info     infos[0];
+    uint32_t            nipset;
+    struct ipset_info   infos[0];
 } __attribute__((__packed__));
 
 #endif /* __DPVS_IPSET_CONF_H__ */

include/conf/lldp.h

@@ -0,0 +1,41 @@
+/*
+ * DPVS is a software load balancer (Virtual Server) based on DPDK.
+ *
+ * Copyright (C) 2021 iQIYI (www.iqiyi.com).
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+#ifndef __DPVS_LLDP_CONF_H__
+#define __DPVS_LLDP_CONF_H__
+
+#include <net/if.h>
+#include "conf/sockopts.h"
+
+#define LLDP_MESSAGE_LEN        4096
+
+#define DPVS_LLDP_NODE_LOCAL    0
+#define DPVS_LLDP_NODE_NEIGH    1
+#define DPVS_LLDP_NODE_MAX      2
+
+
+struct lldp_param {
+    uint16_t node;              /* DPVS_LLDP_NODE_xxx */
+    char ifname[IFNAMSIZ];
+};
+
+struct lldp_message {
+    struct lldp_param param;
+    char message[LLDP_MESSAGE_LEN];
+};
+
+#endif /* __DPVS_LLDP_CONF_H__ */

include/conf/match.h

@@ -93,6 +93,8 @@ static inline int parse_match(const char *pattern, uint8_t *proto,
             *proto = IPPROTO_TCP;
         } else if (strcmp(tok, "udp") == 0) {
             *proto = IPPROTO_UDP;
+        } else if (strcmp(tok, "sctp") == 0) {
+            *proto = IPPROTO_SCTP;
         } else if (strcmp(tok, "icmp") == 0) {
             *proto = IPPROTO_ICMP;
         } else if (strcmp(tok, "icmp6") == 0) {