OPENNHRP-SCRIPT(8)

🎀 NAME 🎀

Okay so this page is all about opennhrp-script(8), bestie — it’s the NHRP peer configuration script, and opennhrp(8) is the one that invokes it. ✨

🌸 DESCRIPTION 🌸

This script can be used to establish a direct NBMA peer-to-peer connection after an NHRP Resolution Reply has been received, but right before injecting the peer address into the kernel neighbor table. The vibe? Maybe you wanna insert firewall rules allowing the traffic, and/or establish an IPsec connection (or some other secure communication channel). It’s also called when the cached peer information expires. 🫶

💫 OPERATION 💫

When opennhrp needs to invoke the peer configuration script, it defines a set of variables in the environment and then executes the script with exactly one argument. That argument is set to the name of the reason why the script has been invoked. The reasons currently defined are: interface-up, peer-register, peer-up, peer-down, nhs-up, nhs-down, route-up and route-down. No cap. 💅

🦋 INTERFACE-UP 🦋

The interface has just been discovered, or it changed state from down to up. This is literally the place to clean up old routes if needed. 🧹

🍓 PEER-REGISTER 🍓

A peer registration request has been received. The script is run before the internal peer cache is altered, and this allows the script to reject registration without deleting old peers. This could be used to check that the IPsec connection is up, or you might encode allowed protocol-addresses in the certificate and enforce that here. This hook is executed synchronously, so it should be fast — fr fr. ⚡

🔥 PEER-UP 🔥

A peer has been discovered — either by static configuration, dynamic client registration, or resolution reply arrival to initiate a shortcut. This hook is invoked right after the peer’s NBMA address is available. For all entries other than dynamic-map entries, the protocol address is available too. The information will not be injected into the kernel ARP cache until the script has returned zero.

🚨 If a non-zero return value is returned, the peer entry is marked as invalid and negative cached for a short period of time. So yeah, exit codes are kinda main character energy here.

💀 PEER-DOWN 💀

A peer connection is about to be cleared. This can happen for dynamic client registrations or cached information. Dynamic client registrations are torn down when the registration holding time expires (and no re-registration has occurred), or if it’s explicitly removed using a Purge Request. Cached entries are removed when the holding time expires (and there has been no traffic to trigger renewal of the peer address information), or when it is explicitly removed with a Purge Request. 🫠

🌈 NHS-UP 🌈

This is called for an NHS right after the first successful Registration Reply is received. This can be used to update application-level configuration about which servers to use. 💖

⭐ NHS-DOWN ⭐

Informs that the specified NHS is no longer available. Sad vibe, but necessary. 😭

👑 ROUTE-UP 👑

In reply to a resolution request, we have received a shortcut route with a destination off the NBMA subnetwork. The script should insert the appropriate entry into the kernel routing table. Slay. 🛣️

🧚 ROUTE-DOWN 🧚

The associated shortcut route information is no longer valid and should be removed from the kernel routing table. Cleanup era. 🧽

💜 ENVIRONMENT 💜

• NHRP_TYPE — for peer-up and peer-down reasons this can be static (configured information), dynamic-nhs (configured NHS with only NBMA address known), dynamic (client registered) or cached (resolved since we had packets going there).

The nhs-up and nhs-down reasons are called for static entries with register keyword and dynamic-nhs entries.

For peer-register this is always dynamic.

For route-up and route-down reasons this is always defined as route.

For interface-up reason this is irrelevant, but always defined as interface.

• NHRP_INTERFACE — the network interface this event is related to.
• NHRP_GRE_KEY — the GRE key assigned to the related network interface.
• NHRP_DESTADDR — destination protocol address. E.g. for NBMA GRE tunnels this is the IP address assigned to the tunnel interface being used.
• NHRP_DESTPREFIX — subnet prefix length for the destination protocol address.
• NHRP_DESTNBMA — defined only for peer-up and peer-down reasons. This contains the NBMA address of the destination. E.g. for NBMA GRE this contains the public IP of the peer.
• NHRP_DESTMTU — defined only for peer-up reasons. This contains the MTU for the NBMA address of the destination.
• NHRP_NEXTHOP — defined only for route-up and route-down reasons. This is the protocol address of the next hop to be used in routing.
• NHRP_PEER_DOWN_REASON — defined only for peer-down reason. This describes why the peer has been deleted. Currently it is one of expired, user-request or lower-down.

🫶 SEE ALSO 🫶

opennhrp(8)

💖 AUTHORS 💖

Timo Teras <timo.teras@iki.fi>

---

🌸 That’s the whole page, bestie — source/version: OpenNHRP Documentation, date: 20 May 2009, manual: OPENNHRP-SCRIPT(8). 🎀