1 /* 2 * netifd - network interface daemon 3 * Copyright (C) 2012 Felix Fietkau <nbd@openwrt.org> 4 * Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org> 5 * Copyright (C) 2018 Alexander Couzens <lynxis@fe80.eu> 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 9 * as published by the Free Software Foundation 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 */ 16 #include <string.h> 17 #include <stdlib.h> 18 #include <stdio.h> 19 20 #include <arpa/inet.h> 21 22 #include "netifd.h" 23 #include "device.h" 24 #include "interface.h" 25 #include "iprule.h" 26 #include "proto.h" 27 #include "ubus.h" 28 #include "system.h" 29 30 struct vlist_tree iprules; 31 static bool iprules_flushed = false; 32 static unsigned int iprules_counter[2]; 33 34 enum { 35 RULE_INTERFACE_IN, 36 RULE_INTERFACE_OUT, 37 RULE_INVERT, 38 RULE_SRC, 39 RULE_DEST, 40 RULE_PRIORITY, 41 RULE_TOS, 42 RULE_FWMARK, 43 RULE_LOOKUP, 44 RULE_ACTION, 45 RULE_GOTO, 46 RULE_SUP_PREFIXLEN, 47 RULE_UIDRANGE, 48 RULE_IPPROTO, 49 RULE_SPORT, 50 RULE_DPORT, 51 RULE_DISABLED, 52 __RULE_MAX 53 }; 54 55 static const struct blobmsg_policy rule_attr[__RULE_MAX] = { 56 [RULE_INTERFACE_IN] = { .name = "in", .type = BLOBMSG_TYPE_STRING }, 57 [RULE_INTERFACE_OUT] = { .name = "out", .type = BLOBMSG_TYPE_STRING }, 58 [RULE_INVERT] = { .name = "invert", .type = BLOBMSG_TYPE_BOOL }, 59 [RULE_SRC] = { .name = "src", .type = BLOBMSG_TYPE_STRING }, 60 [RULE_DEST] = { .name = "dest", .type = BLOBMSG_TYPE_STRING }, 61 [RULE_PRIORITY] = { .name = "priority", .type = BLOBMSG_TYPE_INT32 }, 62 [RULE_TOS] = { .name = "tos", .type = BLOBMSG_TYPE_INT32 }, 63 [RULE_FWMARK] = { .name = "mark", .type = BLOBMSG_TYPE_STRING }, 64 [RULE_LOOKUP] = { .name = "lookup", .type = BLOBMSG_TYPE_STRING }, 65 [RULE_SUP_PREFIXLEN] = { .name = "suppress_prefixlength", .type = BLOBMSG_TYPE_INT32 }, 66 [RULE_UIDRANGE] = { .name = "uidrange", .type = BLOBMSG_TYPE_STRING }, 67 [RULE_ACTION] = { .name = "action", .type = BLOBMSG_TYPE_STRING }, 68 [RULE_GOTO] = { .name = "goto", .type = BLOBMSG_TYPE_INT32 }, 69 [RULE_IPPROTO] = { .name = "ipproto", .type = BLOBMSG_TYPE_STRING }, 70 [RULE_SPORT] = { .name = "sport", .type = BLOBMSG_TYPE_STRING }, 71 [RULE_DPORT] = { .name = "dport", .type = BLOBMSG_TYPE_STRING }, 72 [RULE_DISABLED] = { .name = "disabled", .type = BLOBMSG_TYPE_BOOL }, 73 }; 74 75 const struct uci_blob_param_list rule_attr_list = { 76 .n_params = __RULE_MAX, 77 .params = rule_attr, 78 }; 79 80 /* interface based rules are dynamic. */ 81 static bool 82 rule_ready(struct iprule *rule) 83 { 84 if (rule->flags & IPRULE_OUT && !rule->out_dev[0]) 85 return false; 86 87 if (rule->flags & IPRULE_IN && !rule->in_dev[0]) 88 return false; 89 90 return true; 91 } 92 93 static bool 94 iprule_parse_mark(const char *mark, struct iprule *rule) 95 { 96 char *s, *e; 97 unsigned int n; 98 99 if ((s = strchr(mark, '/')) != NULL) 100 *s++ = 0; 101 102 n = strtoul(mark, &e, 0); 103 104 if (e == mark || *e) 105 return false; 106 107 rule->fwmark = n; 108 rule->flags |= IPRULE_FWMARK; 109 110 if (s) { 111 n = strtoul(s, &e, 0); 112 113 if (e == s || *e) 114 return false; 115 116 rule->fwmask = n; 117 rule->flags |= IPRULE_FWMASK; 118 } 119 120 return true; 121 } 122 123 /* called on interface changes of the incoming interface */ 124 static void 125 rule_in_cb(struct interface_user *dep, struct interface *iface, enum interface_event ev) 126 { 127 struct iprule *rule = container_of(dep, struct iprule, in_iface_user); 128 129 switch (ev) { 130 case IFEV_UP: 131 if (!iface->l3_dev.dev) 132 break; 133 134 strcpy(rule->in_dev, iface->l3_dev.dev->ifname); 135 if (rule_ready(rule)) 136 system_add_iprule(rule); 137 break; 138 case IFEV_DOWN: 139 case IFEV_UP_FAILED: 140 case IFEV_FREE: 141 if (rule_ready(rule)) 142 system_del_iprule(rule); 143 144 rule->in_dev[0] = 0; 145 break; 146 default: 147 break; 148 } 149 } 150 151 /* called on interface changes of the outgoing interface */ 152 static void 153 rule_out_cb(struct interface_user *dep, struct interface *iface, enum interface_event ev) 154 { 155 struct iprule *rule = container_of(dep, struct iprule, out_iface_user); 156 157 switch (ev) { 158 case IFEV_UP: 159 if (!iface->l3_dev.dev) 160 break; 161 162 strcpy(rule->out_dev, iface->l3_dev.dev->ifname); 163 if (rule_ready(rule)) 164 system_add_iprule(rule); 165 break; 166 case IFEV_DOWN: 167 case IFEV_UP_FAILED: 168 case IFEV_FREE: 169 if (rule_ready(rule)) 170 system_del_iprule(rule); 171 172 rule->out_dev[0] = 0; 173 break; 174 default: 175 break; 176 } 177 } 178 179 /* called on all interface events */ 180 static void 181 generic_interface_cb(struct interface_user *dep, 182 struct interface *iface, enum interface_event ev) 183 { 184 struct iprule *rule; 185 186 if (ev != IFEV_CREATE) 187 return; 188 189 /* add new interfaces to rules */ 190 vlist_for_each_element(&iprules, rule, node) { 191 if (rule_ready(rule)) 192 continue; 193 194 if ((rule->flags & IPRULE_OUT) && !strcmp(rule->out_iface, iface->name)) 195 interface_add_user(&rule->out_iface_user, iface); 196 197 if ((rule->flags & IPRULE_IN) && !strcmp(rule->in_iface, iface->name)) 198 interface_add_user(&rule->in_iface_user, iface); 199 } 200 } 201 202 struct interface_user generic_listener = { 203 .cb = generic_interface_cb 204 }; 205 206 void 207 iprule_add(struct blob_attr *attr, bool v6) 208 { 209 struct blob_attr *tb[__RULE_MAX], *cur; 210 struct iprule *rule; 211 char *iface_name; 212 int af = v6 ? AF_INET6 : AF_INET; 213 214 blobmsg_parse_attr(rule_attr, __RULE_MAX, tb, attr); 215 216 if ((cur = tb[RULE_DISABLED]) != NULL && blobmsg_get_bool(cur)) 217 return; 218 219 rule = calloc(1, sizeof(*rule)); 220 if (!rule) 221 return; 222 223 rule->flags = v6 ? IPRULE_INET6 : IPRULE_INET4; 224 rule->order = iprules_counter[rule->flags]++; 225 226 if ((cur = tb[RULE_INVERT]) != NULL) 227 rule->invert = blobmsg_get_bool(cur); 228 229 if ((cur = tb[RULE_INTERFACE_IN]) != NULL) { 230 iface_name = calloc(1, strlen(blobmsg_data(cur)) + 1); 231 rule->in_iface = strcpy(iface_name, blobmsg_data(cur)); 232 rule->in_iface_user.cb = &rule_in_cb; 233 rule->flags |= IPRULE_IN; 234 } 235 236 if ((cur = tb[RULE_INTERFACE_OUT]) != NULL) { 237 iface_name = calloc(1, strlen(blobmsg_data(cur)) + 1); 238 rule->out_iface = strcpy(iface_name, blobmsg_data(cur)); 239 rule->out_iface_user.cb = &rule_out_cb; 240 rule->flags |= IPRULE_OUT; 241 } 242 243 if ((cur = tb[RULE_SRC]) != NULL) { 244 rule->src_mask = (af == AF_INET6) ? 128 : 32; 245 if (!parse_ip_and_netmask(af, blobmsg_data(cur), &rule->src_addr, &rule->src_mask)) { 246 D(INTERFACE, "Failed to parse rule source: %s", (char *) blobmsg_data(cur)); 247 goto error; 248 } 249 rule->flags |= IPRULE_SRC; 250 } 251 252 if ((cur = tb[RULE_DEST]) != NULL) { 253 rule->dest_mask = (af == AF_INET6) ? 128 : 32; 254 if (!parse_ip_and_netmask(af, blobmsg_data(cur), &rule->dest_addr, &rule->dest_mask)) { 255 D(INTERFACE, "Failed to parse rule destination: %s", (char *) blobmsg_data(cur)); 256 goto error; 257 } 258 rule->flags |= IPRULE_DEST; 259 } 260 261 if ((cur = tb[RULE_PRIORITY]) != NULL) { 262 rule->priority = blobmsg_get_u32(cur); 263 rule->flags |= IPRULE_PRIORITY; 264 } 265 266 if ((cur = tb[RULE_TOS]) != NULL) { 267 if ((rule->tos = blobmsg_get_u32(cur)) > 255) { 268 D(INTERFACE, "Invalid TOS value: %u", blobmsg_get_u32(cur)); 269 goto error; 270 } 271 rule->flags |= IPRULE_TOS; 272 } 273 274 if ((cur = tb[RULE_FWMARK]) != NULL) { 275 if (!iprule_parse_mark(blobmsg_data(cur), rule)) { 276 D(INTERFACE, "Failed to parse rule fwmark: %s", (char *) blobmsg_data(cur)); 277 goto error; 278 } 279 /* flags set by iprule_parse_mark() */ 280 } 281 282 if ((cur = tb[RULE_LOOKUP]) != NULL) { 283 if (!system_resolve_rt_table(blobmsg_data(cur), &rule->lookup)) { 284 D(INTERFACE, "Failed to parse rule lookup table: %s", (char *) blobmsg_data(cur)); 285 goto error; 286 } 287 rule->flags |= IPRULE_LOOKUP; 288 } 289 290 if ((cur = tb[RULE_SUP_PREFIXLEN]) != NULL) { 291 rule->sup_prefixlen = blobmsg_get_u32(cur); 292 rule->flags |= IPRULE_SUP_PREFIXLEN; 293 } 294 295 if ((cur = tb[RULE_UIDRANGE]) != NULL) { 296 int ret = sscanf(blobmsg_get_string(cur), "%u-%u", &rule->uidrange_start, &rule->uidrange_end); 297 298 if (ret == 1) 299 rule->uidrange_end = rule->uidrange_start; 300 else if (ret != 2) { 301 D(INTERFACE, "Failed to parse UID range: %s", (char *) blobmsg_data(cur)); 302 goto error; 303 } 304 rule->flags |= IPRULE_UIDRANGE; 305 } 306 307 if ((cur = tb[RULE_ACTION]) != NULL) { 308 if (!system_resolve_iprule_action(blobmsg_data(cur), &rule->action)) { 309 D(INTERFACE, "Failed to parse rule action: %s", (char *) blobmsg_data(cur)); 310 goto error; 311 } 312 rule->flags |= IPRULE_ACTION; 313 } 314 315 if ((cur = tb[RULE_GOTO]) != NULL) { 316 rule->gotoid = blobmsg_get_u32(cur); 317 rule->flags |= IPRULE_GOTO; 318 } 319 320 if ((cur = tb[RULE_IPPROTO]) != NULL) { 321 if (!system_resolve_iprule_ipproto(blobmsg_data(cur), &rule->ipproto)) { 322 D(INTERFACE, "Failed to parse rule ip protocol: %s", (char *) blobmsg_data(cur)); 323 goto error; 324 } 325 rule->flags |= IPRULE_IPPROTO; 326 } 327 328 if ((cur = tb[RULE_SPORT]) != NULL) { 329 int ret = sscanf(blobmsg_get_string(cur), "%u-%u", &rule->sport_start, &rule->sport_end); 330 331 if (ret == 1) 332 rule->sport_end = rule->sport_start; 333 else if (ret != 2) { 334 D(INTERFACE, "Failed to parse sport range: %s", (char *) blobmsg_data(cur)); 335 goto error; 336 } 337 rule->flags |= IPRULE_SPORT; 338 } 339 340 if ((cur = tb[RULE_DPORT]) != NULL) { 341 int ret = sscanf(blobmsg_get_string(cur), "%u-%u", &rule->dport_start, &rule->dport_end); 342 343 if (ret == 1) 344 rule->dport_end = rule->dport_start; 345 else if (ret != 2) { 346 D(INTERFACE, "Failed to parse dport range: %s", (char *) blobmsg_data(cur)); 347 goto error; 348 } 349 rule->flags |= IPRULE_DPORT; 350 } 351 352 vlist_add(&iprules, &rule->node, rule); 353 return; 354 355 error: 356 free(rule); 357 } 358 359 void 360 iprule_update_start(void) 361 { 362 if (!iprules_flushed) { 363 system_flush_iprules(); 364 iprules_flushed = true; 365 } 366 367 iprules_counter[0] = 1; 368 iprules_counter[1] = 1; 369 vlist_update(&iprules); 370 } 371 372 void 373 iprule_update_complete(void) 374 { 375 vlist_flush(&iprules); 376 } 377 378 379 static int 380 rule_cmp(const void *k1, const void *k2, void *ptr) 381 { 382 const struct iprule *r1 = k1, *r2 = k2; 383 int ret; 384 385 /* First compare the interface names */ 386 if (r1->flags & IPRULE_IN || r2->flags & IPRULE_IN) { 387 char *str1 = r1->flags & IPRULE_IN ? r1->in_iface : ""; 388 char *str2 = r2->flags & IPRULE_IN ? r2->in_iface : ""; 389 390 ret = strcmp(str1, str2); 391 if (ret) 392 return ret; 393 } 394 395 if (r1->flags & IPRULE_OUT || r2->flags & IPRULE_OUT) { 396 char *str1 = r1->flags & IPRULE_OUT ? r1->out_iface : ""; 397 char *str2 = r2->flags & IPRULE_OUT ? r2->out_iface : ""; 398 399 ret = strcmp(str1, str2); 400 if (ret) 401 return ret; 402 } 403 404 /* Next compare everything after the flags field */ 405 return memcmp(k1 + offsetof(struct iprule, flags), 406 k2 + offsetof(struct iprule, flags), 407 sizeof(struct iprule) - offsetof(struct iprule, flags)); 408 } 409 410 static void deregister_interfaces(struct iprule *rule) 411 { 412 if (rule->flags & IPRULE_IN && rule->in_iface_user.iface) 413 interface_remove_user(&rule->in_iface_user); 414 415 if (rule->flags & IPRULE_OUT && rule->out_iface_user.iface) 416 interface_remove_user(&rule->out_iface_user); 417 } 418 419 static void register_interfaces(struct iprule *rule) 420 { 421 struct interface *iface, *tmp; 422 423 if (rule->flags & IPRULE_IN) { 424 tmp = vlist_find(&interfaces, rule->in_iface, iface, node); 425 if (tmp) 426 interface_add_user(&rule->in_iface_user, tmp); 427 } 428 if (rule->flags & IPRULE_OUT) { 429 tmp = vlist_find(&interfaces, rule->out_iface, iface, node); 430 if (tmp) 431 interface_add_user(&rule->out_iface_user, tmp); 432 } 433 } 434 435 static void 436 iprule_update_rule(struct vlist_tree *tree, 437 struct vlist_node *node_new, struct vlist_node *node_old) 438 { 439 struct iprule *rule_old, *rule_new; 440 441 rule_old = container_of(node_old, struct iprule, node); 442 rule_new = container_of(node_new, struct iprule, node); 443 444 /* 445 * An unchanged rule with an unchanged kernel priority can be kept 446 * installed; interface-bound rules are managed through interface 447 * events and keep the delete/re-add cycle 448 */ 449 if (node_new && node_old && 450 !(rule_new->flags & (IPRULE_IN | IPRULE_OUT)) && 451 rule_old->installed && 452 ((rule_new->flags & IPRULE_PRIORITY) || 453 rule_new->order == rule_old->order)) { 454 rule_new->installed = true; 455 free(rule_old); 456 return; 457 } 458 459 if (node_old) { 460 if (rule_ready(rule_old)) 461 system_del_iprule(rule_old); 462 463 if (rule_old->flags & (IPRULE_IN | IPRULE_OUT)) 464 deregister_interfaces(rule_old); 465 466 if (rule_old->in_iface) 467 free(rule_old->in_iface); 468 469 if (rule_old->out_iface) 470 free(rule_old->out_iface); 471 472 free(rule_old); 473 } 474 475 if (node_new) { 476 /* interface based rules calls system_add_iprule over the event cb */ 477 if (rule_new->flags & (IPRULE_IN | IPRULE_OUT)) { 478 register_interfaces(rule_new); 479 } else { 480 rule_new->installed = !system_add_iprule(rule_new); 481 } 482 } 483 } 484 485 static void __init 486 iprule_init_list(void) 487 { 488 vlist_init(&iprules, rule_cmp, iprule_update_rule); 489 interface_add_user(&generic_listener, NULL); 490 } 491
This page was automatically generated by LXR 0.3.1. • OpenWrt