Commit Graph

20 Commits

Author SHA1 Message Date
Martin Stein
3db7181104 nic_router: limit packets handled per signal
Make it configurable how many packets get handled at a max per signal to
prevent DoS attacks by clients.

Issue #2953
2018-10-29 09:36:21 +01:00
Martin Stein
b48c917984 nic_router: allow ld_verbose attribute
Issue #2953
2018-10-29 09:36:21 +01:00
Martin Stein
99b8e062d7 */config.xsd: fix session-policy declarations
Issue #2908
2018-08-28 16:48:47 +02:00
Martin Stein
d2a36c5958 base: define generic config XSD types globally
The new base/xsd/config.inc defines generic XSD types such as 'Boolean' or
'Session_label'. It can be included in config XSD files by using:

! <xs:include schemaLocation="file://${GENODE_CONFIG_INC}"/>

The string ${GENODE_CONFIG_INC} is replaced by the run tool with the
above mentionened file path.

Issue #2897
2018-08-28 16:48:47 +02:00
Martin Stein
2733d3fea5 nic_router: verbose_packet_drop attribute
The log messages covered by verbose_packet_drop were previously
configured by the verbose attribute. This isn't the case anymore. Now,
you can configure them as follows:

! <config verbose_packet_drop="no" ... >
!     <domain verbose_packet_drop="no" ... />
! <config/>

The new attribute determines whether to log each packet drop and the
rational behind it. The <config> value affects all domains without a
<domain> local value.

Issue #2857
2018-06-29 10:44:59 +02:00
Martin Stein
0b8520a208 nic_router: act as ICMP Echo server
The ICMP-Echo-server functionality of the router has the following
configuration attributes (default values shown):

! <config icmp_echo_server="yes">
!    <domain icmp_echo_server="yes" ... />
! </config>

The icmp_echo_server attribute configures whether the router answers ICMP Echo
requests that address the router. The <config> value affects all domains
without a <domain> local value.

Issue #2874
2018-06-29 10:44:58 +02:00
Martin Stein
49a3a0e0d0 nic_router: multiple uplinks
Introduce the uplink tag:

! <config>
!    <uplink label="wifi"  domain="uplink">
!    <uplink label="wired" domain="wired_bridge">
!    <uplink               domain="wired_bridge">
! <config/>

For each uplink tag, the NIC router requests a NIC session with the
corresponding label or an empty label if there is no label attribute.
These NIC sessions get attached to the domain that is set in their
uplink tag as soon as the domain appears. This means their lifetime is
not bound to the domain. Uplink NIC sessions can be safely moved from
one domain to another without being closed by reconfiguring the
corresponding domain attribute.

Attention: This may render previously valid NIC router configurations
useless. A domain named "uplink" doesn't automatically request a NIC
session anymore. To fix these configurations, just add

! <uplink domain="uplink"/>

or

! <uplink label="[LABEL]" domain="uplink"/>

as direct subtag of the <config> tag.

Issue #2840
2018-06-29 10:44:53 +02:00
Martin Stein
44d97986a2 nic_router: attribute report.config_triggers 2018-05-30 13:36:39 +02:00
Martin Stein
cea22866a8 config.xsd: adapt Boolean type to ascii_to(bool)
Harmonize the set of allowed values with the implementation of ascii_to for
bool.

Issue #2815
2018-05-30 13:36:35 +02:00
Martin Stein
ed69c11b01 nic_router: label attribute for uplink domain
The new attribute config.domain.label has effect only at the uplink
domain-tag. It determines which label the NIC router shall use when
requesting the NIC session for the uplink domain. If value of this
attribute changes at the uplink domain-tag, the NIC router closes and
re-requests the NIC session of the uplink with the new label.

Issue #2815
2018-05-30 13:36:34 +02:00
Martin Stein
7085640f05 nic_router: remove 'mac_first' attribute
Since the router MAC is allocated like the donwlink MACs it can't happen
anymore that these MACs clash, for instance due to nested routers. Thus,
the range of the MAC allocators of nested routers must not be exclusive
anymore which deprecates the 'mac_first' configuration attribute.

Issue #2795
2018-05-30 13:36:12 +02:00
Martin Stein
ce9a0cbc19 nic_router/config.xsd: add icmp_idle_timeout_sec 2018-04-10 11:20:45 +02:00
Martin Stein
168407a40a nic_router: config attribute 'mac_first'
The mac_first attribute tells the MAC-address allocator of the router
from which MAC address to start allocating. This is useful, for
instance, if you have nested nic_routers. In this case, identical
MAC-allocator settings have led to name clashes in the past, so, you
want to be able to configure them differently.

Issue #2732
2018-04-10 11:11:53 +02:00
Martin Stein
7b3343c2dc nic_router: NAPT for ICMP echo messages
This follows the guidelines in RFC 5508 to enable ICMP echo through a NAPT
channel of the NIC router. It serves also as blueprint for ICMP queries in
general (they are merely not enabled because we don't test them by now).

Issue #2732
2018-04-10 11:11:53 +02:00
Martin Stein
4bee38ea62 nic_router: DHCP server considers dns_server_from
The dns_server_from attribute of the dhcp-server tag has effect only if
the dns_server attribute of the same tag is not set. If this is the
case, the dns_server_from attribute states the domain from whose IP
config to take the DNS server address. This is useful, for instance, if
the stated domain receives the address of a local DNS server via DHCP.
Whenever the IP config of the stated domain becomes invalid, the DHCP
server switches to a mode where it drops all requests unanswered until
the IP config becomes valid again.

Issue #2730
2018-04-10 11:06:00 +02:00
Martin Stein
2a77976164 nic_router: add verbose_packets per domain
A domain logs its packets if one of the global 'verbose_packets' or its local
'verbose_packets' is switched on.

Ref #2670
2018-03-29 15:20:20 +02:00
Martin Stein
bd16f89617 nic_router: add verbose_packets attribute
This separates the decision wether to log the received and sent packets
from the 'verbose' attribute. This information is now only logged if
'verbose_packets' is switched on. If 'verbose' is switched on, only
routing decisions and optional hints are printed.

Ref #2670
2018-03-29 15:20:15 +02:00
Martin Stein
edf1f9d849 nic_router: report some useful information
The NIC router can now be configured to periodically send reports.
Configuration example (shows default values):

<config>
	<report interval_sec="5" bytes="yes" config="yes">
</config>

If the 'report' tag is not available, no reports are send.
The attributes of the 'report' tag:

'bytes'        : Boolean : Whether to report sent bytes and received bytes per
                           domain
'config'       : Boolean : Whether to report ipv4 interface and gateway per
                           domain
'interval_sec' : 1..3600 : Interval of sending reports in seconds

Issue #2614
2017-12-21 15:01:54 +01:00
Martin Stein
c3853494c8 nic_router: domain-state-verbose flag
When this flag is set in the config tag, the NIC router will print a
short information to the log for each general state change of a domain.
This includes currently the IP-configuration state and the number of
connected NIC sessions. This a useful addition as the normal verbose
flag's purpose is a very deep insight into almost every activity in the
router, which is cool for debugging sophisticated problems but normally
floods the log and therefore discards this option for, e.g., desktop
systems. In such systems, the new verbosity is pretty discreet but
already gives a good hint on why packets may get dropped by the router
although the routing rules are correct.

Issue #2534
2017-12-21 15:01:37 +01:00
Martin Stein
fc7999a62a nic_router: add config schema
Fix #2600
2017-12-21 15:01:37 +01:00