• source navigation  • diff markup  • identifier search  • freetext search  • 

Sources/netifd/iprule.c

  1 /*
  2  * netifd - network interface daemon
  3  * Copyright (C) 2012 Felix Fietkau <nbd@openwrt.org>
  4  * Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
  5  * Copyright (C) 2018 Alexander Couzens <lynxis@fe80.eu>
  6  *
  7  * This program is free software; you can redistribute it and/or modify
  8  * it under the terms of the GNU General Public License version 2
  9  * as published by the Free Software Foundation
 10  *
 11  * This program is distributed in the hope that it will be useful,
 12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 14  * GNU General Public License for more details.
 15  */
 16 #include <string.h>
 17 #include <stdlib.h>
 18 #include <stdio.h>
 19 
 20 #include <arpa/inet.h>
 21 
 22 #include "netifd.h"
 23 #include "device.h"
 24 #include "interface.h"
 25 #include "iprule.h"
 26 #include "proto.h"
 27 #include "ubus.h"
 28 #include "system.h"
 29 
 30 struct vlist_tree iprules;
 31 static bool iprules_flushed = false;
 32 static unsigned int iprules_counter[2];
 33 
 34 enum {
 35         RULE_INTERFACE_IN,
 36         RULE_INTERFACE_OUT,
 37         RULE_INVERT,
 38         RULE_SRC,
 39         RULE_DEST,
 40         RULE_PRIORITY,
 41         RULE_TOS,
 42         RULE_FWMARK,
 43         RULE_LOOKUP,
 44         RULE_ACTION,
 45         RULE_GOTO,
 46         RULE_SUP_PREFIXLEN,
 47         RULE_UIDRANGE,
 48         RULE_DISABLED,
 49         __RULE_MAX
 50 };
 51 
 52 static const struct blobmsg_policy rule_attr[__RULE_MAX] = {
 53         [RULE_INTERFACE_IN] = { .name = "in", .type = BLOBMSG_TYPE_STRING },
 54         [RULE_INTERFACE_OUT] = { .name = "out", .type = BLOBMSG_TYPE_STRING },
 55         [RULE_INVERT] = { .name = "invert", .type = BLOBMSG_TYPE_BOOL },
 56         [RULE_SRC] = { .name = "src", .type = BLOBMSG_TYPE_STRING },
 57         [RULE_DEST] = { .name = "dest", .type = BLOBMSG_TYPE_STRING },
 58         [RULE_PRIORITY] = { .name = "priority", .type = BLOBMSG_TYPE_INT32 },
 59         [RULE_TOS] = { .name = "tos", .type = BLOBMSG_TYPE_INT32 },
 60         [RULE_FWMARK] = { .name = "mark", .type = BLOBMSG_TYPE_STRING },
 61         [RULE_LOOKUP] = { .name = "lookup", .type = BLOBMSG_TYPE_STRING },
 62         [RULE_SUP_PREFIXLEN] = { .name = "suppress_prefixlength", .type = BLOBMSG_TYPE_INT32 },
 63         [RULE_UIDRANGE] = { .name = "uidrange", .type = BLOBMSG_TYPE_STRING },
 64         [RULE_ACTION] = { .name = "action", .type = BLOBMSG_TYPE_STRING },
 65         [RULE_GOTO]   = { .name = "goto", .type = BLOBMSG_TYPE_INT32 },
 66         [RULE_DISABLED] = { .name = "disabled", .type = BLOBMSG_TYPE_BOOL },
 67 };
 68 
 69 const struct uci_blob_param_list rule_attr_list = {
 70         .n_params = __RULE_MAX,
 71         .params = rule_attr,
 72 };
 73 
 74 /* interface based rules are dynamic. */
 75 static bool
 76 rule_ready(struct iprule *rule)
 77 {
 78         if (rule->flags & IPRULE_OUT && !rule->out_dev[0])
 79                 return false;
 80 
 81         if (rule->flags & IPRULE_IN && !rule->in_dev[0])
 82                 return false;
 83 
 84         return true;
 85 }
 86 
 87 static bool
 88 iprule_parse_mark(const char *mark, struct iprule *rule)
 89 {
 90         char *s, *e;
 91         unsigned int n;
 92 
 93         if ((s = strchr(mark, '/')) != NULL)
 94                 *s++ = 0;
 95 
 96         n = strtoul(mark, &e, 0);
 97 
 98         if (e == mark || *e)
 99                 return false;
100 
101         rule->fwmark = n;
102         rule->flags |= IPRULE_FWMARK;
103 
104         if (s) {
105                 n = strtoul(s, &e, 0);
106 
107                 if (e == s || *e)
108                         return false;
109 
110                 rule->fwmask = n;
111                 rule->flags |= IPRULE_FWMASK;
112         }
113 
114         return true;
115 }
116 
117 /* called on interface changes of the incoming interface */
118 static void
119 rule_in_cb(struct interface_user *dep, struct interface *iface, enum interface_event ev)
120 {
121         struct iprule *rule = container_of(dep, struct iprule, in_iface_user);
122 
123         switch (ev) {
124         case IFEV_UP:
125                 if (!iface->l3_dev.dev)
126                         break;
127 
128                 strcpy(rule->in_dev, iface->l3_dev.dev->ifname);
129                 if (rule_ready(rule))
130                         system_add_iprule(rule);
131                 break;
132         case IFEV_DOWN:
133         case IFEV_UP_FAILED:
134         case IFEV_FREE:
135                 if (rule_ready(rule))
136                         system_del_iprule(rule);
137 
138                 rule->in_dev[0] = 0;
139                 break;
140         default:
141                 break;
142         }
143 }
144 
145 /* called on interface changes of the outgoing interface */
146 static void
147 rule_out_cb(struct interface_user *dep, struct interface *iface, enum interface_event ev)
148 {
149         struct iprule *rule = container_of(dep, struct iprule, out_iface_user);
150 
151         switch (ev) {
152         case IFEV_UP:
153                 if (!iface->l3_dev.dev)
154                         break;
155 
156                 strcpy(rule->out_dev, iface->l3_dev.dev->ifname);
157                 if (rule_ready(rule))
158                         system_add_iprule(rule);
159                 break;
160         case IFEV_DOWN:
161         case IFEV_UP_FAILED:
162         case IFEV_FREE:
163                 if (rule_ready(rule))
164                         system_del_iprule(rule);
165 
166                 rule->out_dev[0] = 0;
167                 break;
168         default:
169                 break;
170         }
171 }
172 
173 /* called on all interface events */
174 static void
175 generic_interface_cb(struct interface_user *dep,
176                         struct interface *iface, enum interface_event ev)
177 {
178         struct iprule *rule;
179 
180         if (ev != IFEV_CREATE)
181                 return;
182 
183         /* add new interfaces to rules */
184         vlist_for_each_element(&iprules, rule, node) {
185                 if (rule_ready(rule))
186                         continue;
187 
188                 if ((rule->flags & IPRULE_OUT) && !strcmp(rule->out_iface, iface->name))
189                         interface_add_user(&rule->out_iface_user, iface);
190 
191                 if ((rule->flags & IPRULE_IN) && !strcmp(rule->in_iface, iface->name))
192                         interface_add_user(&rule->in_iface_user, iface);
193         }
194 }
195 
196 struct interface_user generic_listener = {
197         .cb = generic_interface_cb
198 };
199 
200 void
201 iprule_add(struct blob_attr *attr, bool v6)
202 {
203         struct blob_attr *tb[__RULE_MAX], *cur;
204         struct iprule *rule;
205         char *iface_name;
206         int af = v6 ? AF_INET6 : AF_INET;
207 
208         blobmsg_parse(rule_attr, __RULE_MAX, tb, blobmsg_data(attr), blobmsg_data_len(attr));
209 
210         if ((cur = tb[RULE_DISABLED]) != NULL && blobmsg_get_bool(cur))
211                 return;
212 
213         rule = calloc(1, sizeof(*rule));
214         if (!rule)
215                 return;
216 
217         rule->flags = v6 ? IPRULE_INET6 : IPRULE_INET4;
218         rule->order = iprules_counter[rule->flags]++;
219 
220         if ((cur = tb[RULE_INVERT]) != NULL)
221                 rule->invert = blobmsg_get_bool(cur);
222 
223         if ((cur = tb[RULE_INTERFACE_IN]) != NULL) {
224                 iface_name = calloc(1, strlen(blobmsg_data(cur)) + 1);
225                 rule->in_iface = strcpy(iface_name, blobmsg_data(cur));
226                 rule->in_iface_user.cb = &rule_in_cb;
227                 rule->flags |= IPRULE_IN;
228         }
229 
230         if ((cur = tb[RULE_INTERFACE_OUT]) != NULL) {
231                 iface_name = calloc(1, strlen(blobmsg_data(cur)) + 1);
232                 rule->out_iface = strcpy(iface_name, blobmsg_data(cur));
233                 rule->out_iface_user.cb = &rule_out_cb;
234                 rule->flags |= IPRULE_OUT;
235         }
236 
237         if ((cur = tb[RULE_SRC]) != NULL) {
238                 if (!parse_ip_and_netmask(af, blobmsg_data(cur), &rule->src_addr, &rule->src_mask)) {
239                         DPRINTF("Failed to parse rule source: %s\n", (char *) blobmsg_data(cur));
240                         goto error;
241                 }
242                 rule->flags |= IPRULE_SRC;
243         }
244 
245         if ((cur = tb[RULE_DEST]) != NULL) {
246                 if (!parse_ip_and_netmask(af, blobmsg_data(cur), &rule->dest_addr, &rule->dest_mask)) {
247                         DPRINTF("Failed to parse rule destination: %s\n", (char *) blobmsg_data(cur));
248                         goto error;
249                 }
250                 rule->flags |= IPRULE_DEST;
251         }
252 
253         if ((cur = tb[RULE_PRIORITY]) != NULL) {
254                 rule->priority = blobmsg_get_u32(cur);
255                 rule->flags |= IPRULE_PRIORITY;
256         }
257 
258         if ((cur = tb[RULE_TOS]) != NULL) {
259                 if ((rule->tos = blobmsg_get_u32(cur)) > 255) {
260                         DPRINTF("Invalid TOS value: %u\n", blobmsg_get_u32(cur));
261                         goto error;
262                 }
263                 rule->flags |= IPRULE_TOS;
264         }
265 
266         if ((cur = tb[RULE_FWMARK]) != NULL) {
267                 if (!iprule_parse_mark(blobmsg_data(cur), rule)) {
268                         DPRINTF("Failed to parse rule fwmark: %s\n", (char *) blobmsg_data(cur));
269                         goto error;
270                 }
271                 /* flags set by iprule_parse_mark() */
272         }
273 
274         if ((cur = tb[RULE_LOOKUP]) != NULL) {
275                 if (!system_resolve_rt_table(blobmsg_data(cur), &rule->lookup)) {
276                         DPRINTF("Failed to parse rule lookup table: %s\n", (char *) blobmsg_data(cur));
277                         goto error;
278                 }
279                 rule->flags |= IPRULE_LOOKUP;
280         }
281 
282         if ((cur = tb[RULE_SUP_PREFIXLEN]) != NULL) {
283                 rule->sup_prefixlen = blobmsg_get_u32(cur);
284                 rule->flags |= IPRULE_SUP_PREFIXLEN;
285         }
286 
287         if ((cur = tb[RULE_UIDRANGE]) != NULL) {
288                 int ret = sscanf(blobmsg_get_string(cur), "%u-%u", &rule->uidrange_start, &rule->uidrange_end);
289 
290                 if (ret == 1)
291                         rule->uidrange_end = rule->uidrange_start;
292                 else if (ret != 2) {
293                         DPRINTF("Failed to parse UID range: %s\n", (char *) blobmsg_data(cur));
294                         goto error;
295                 }
296                 rule->flags |= IPRULE_UIDRANGE;
297         }
298 
299         if ((cur = tb[RULE_ACTION]) != NULL) {
300                 if (!system_resolve_iprule_action(blobmsg_data(cur), &rule->action)) {
301                         DPRINTF("Failed to parse rule action: %s\n", (char *) blobmsg_data(cur));
302                         goto error;
303                 }
304                 rule->flags |= IPRULE_ACTION;
305         }
306 
307         if ((cur = tb[RULE_GOTO]) != NULL) {
308                 rule->gotoid = blobmsg_get_u32(cur);
309                 rule->flags |= IPRULE_GOTO;
310         }
311 
312         vlist_add(&iprules, &rule->node, rule);
313         return;
314 
315 error:
316         free(rule);
317 }
318 
319 void
320 iprule_update_start(void)
321 {
322         if (!iprules_flushed) {
323                 system_flush_iprules();
324                 iprules_flushed = true;
325         }
326 
327         iprules_counter[0] = 1;
328         iprules_counter[1] = 1;
329         vlist_update(&iprules);
330 }
331 
332 void
333 iprule_update_complete(void)
334 {
335         vlist_flush(&iprules);
336 }
337 
338 
339 static int
340 rule_cmp(const void *k1, const void *k2, void *ptr)
341 {
342         const struct iprule *r1 = k1, *r2 = k2;
343         int ret;
344 
345         /* First compare the interface names */
346         if (r1->flags & IPRULE_IN || r2->flags & IPRULE_IN) {
347                 char *str1 = r1->flags & IPRULE_IN ? r1->in_iface : "";
348                 char *str2 = r2->flags & IPRULE_IN ? r2->in_iface : "";
349 
350                 ret = strcmp(str1, str2);
351                 if (ret)
352                         return ret;
353         }
354 
355         if (r1->flags & IPRULE_OUT || r2->flags & IPRULE_OUT) {
356                 char *str1 = r1->flags & IPRULE_OUT ? r1->out_iface : "";
357                 char *str2 = r2->flags & IPRULE_OUT ? r2->out_iface : "";
358 
359                 ret = strcmp(str1, str2);
360                 if (ret)
361                         return ret;
362         }
363 
364         /* Next compare everything after the flags field */
365         return memcmp(k1 + offsetof(struct iprule, flags),
366                       k2 + offsetof(struct iprule, flags),
367                       sizeof(struct iprule) - offsetof(struct iprule, flags));
368 }
369 
370 static void deregister_interfaces(struct iprule *rule)
371 {
372         if (rule->flags & IPRULE_IN && rule->in_iface_user.iface)
373                 interface_remove_user(&rule->in_iface_user);
374 
375         if (rule->flags & IPRULE_OUT && rule->out_iface_user.iface)
376                 interface_remove_user(&rule->out_iface_user);
377 }
378 
379 static void register_interfaces(struct iprule *rule)
380 {
381         struct interface *iface, *tmp;
382 
383         if (rule->flags & IPRULE_IN) {
384                 tmp = vlist_find(&interfaces, rule->in_iface, iface, node);
385                 if (tmp)
386                         interface_add_user(&rule->in_iface_user, tmp);
387         }
388         if (rule->flags & IPRULE_OUT) {
389                 tmp = vlist_find(&interfaces, rule->out_iface, iface, node);
390                 if (tmp)
391                         interface_add_user(&rule->out_iface_user, tmp);
392         }
393 }
394 
395 static void
396 iprule_update_rule(struct vlist_tree *tree,
397                         struct vlist_node *node_new, struct vlist_node *node_old)
398 {
399         struct iprule *rule_old, *rule_new;
400 
401         rule_old = container_of(node_old, struct iprule, node);
402         rule_new = container_of(node_new, struct iprule, node);
403 
404         if (node_old) {
405                 if (rule_ready(rule_old))
406                         system_del_iprule(rule_old);
407 
408                 if (rule_old->flags & (IPRULE_IN | IPRULE_OUT))
409                         deregister_interfaces(rule_old);
410 
411                 if (rule_old->in_iface)
412                         free(rule_old->in_iface);
413 
414                 if (rule_old->out_iface)
415                         free(rule_old->out_iface);
416 
417                 free(rule_old);
418         }
419 
420         if (node_new) {
421                 /* interface based rules calls system_add_iprule over the event cb */
422                 if (rule_new->flags & (IPRULE_IN | IPRULE_OUT)) {
423                         register_interfaces(rule_new);
424                 } else {
425                         system_add_iprule(rule_new);
426                 }
427         }
428 }
429 
430 static void __init
431 iprule_init_list(void)
432 {
433         vlist_init(&iprules, rule_cmp, iprule_update_rule);
434         interface_add_user(&generic_listener, NULL);
435 }
436 

This page was automatically generated by LXR 0.3.1.  •  OpenWrt