iprule.c

   1 /*
   2  * netifd - network interface daemon
   3  * Copyright (C) 2012 Felix Fietkau <nbd@openwrt.org>
   4  * Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  * Copyright (C) 2018 Alexander Couzens <lynxis@fe80.eu>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2
   9  * as published by the Free Software Foundation
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  */
  16 #include <string.h>
  17 #include <stdlib.h>
  18 #include <stdio.h>
  19
  20 #include <arpa/inet.h>
  21
  22 #include "netifd.h"
  23 #include "device.h"
  24 #include "interface.h"
  25 #include "iprule.h"
  26 #include "proto.h"
  27 #include "ubus.h"
  28 #include "system.h"
  29
  30 struct vlist_tree iprules;
  31 static bool iprules_flushed = false;
  32 static unsigned int iprules_counter[2];
  33
  34 enum {
  35         RULE_INTERFACE_IN,
  36         RULE_INTERFACE_OUT,
  37         RULE_INVERT,
  38         RULE_SRC,
  39         RULE_DEST,
  40         RULE_PRIORITY,
  41         RULE_TOS,
  42         RULE_FWMARK,
  43         RULE_LOOKUP,
  44         RULE_ACTION,
  45         RULE_GOTO,
  46         RULE_SUP_PREFIXLEN,
  47         RULE_DISABLED,
  48         __RULE_MAX
  49 };
  50
  51 static const struct blobmsg_policy rule_attr[__RULE_MAX] = {
  52         [RULE_INTERFACE_IN] = { .name = "in", .type = BLOBMSG_TYPE_STRING },
  53         [RULE_INTERFACE_OUT] = { .name = "out", .type = BLOBMSG_TYPE_STRING },
  54         [RULE_INVERT] = { .name = "invert", .type = BLOBMSG_TYPE_BOOL },
  55         [RULE_SRC] = { .name = "src", .type = BLOBMSG_TYPE_STRING },
  56         [RULE_DEST] = { .name = "dest", .type = BLOBMSG_TYPE_STRING },
  57         [RULE_PRIORITY] = { .name = "priority", .type = BLOBMSG_TYPE_INT32 },
  58         [RULE_TOS] = { .name = "tos", .type = BLOBMSG_TYPE_INT32 },
  59         [RULE_FWMARK] = { .name = "mark", .type = BLOBMSG_TYPE_STRING },
  60         [RULE_LOOKUP] = { .name = "lookup", .type = BLOBMSG_TYPE_STRING },
  61         [RULE_SUP_PREFIXLEN] = { .name = "suppress_prefixlength", .type = BLOBMSG_TYPE_INT32 },
  62         [RULE_ACTION] = { .name = "action", .type = BLOBMSG_TYPE_STRING },
  63         [RULE_GOTO]   = { .name = "goto", .type = BLOBMSG_TYPE_INT32 },
  64         [RULE_DISABLED] = { .name = "disabled", .type = BLOBMSG_TYPE_BOOL },
  65 };
  66
  67 const struct uci_blob_param_list rule_attr_list = {
  68         .n_params = __RULE_MAX,
  69         .params = rule_attr,
  70 };
  71
  72 /* interface based rules are dynamic. */
  73 static bool
  74 rule_ready(struct iprule *rule)
  75 {
  76         if (rule->flags & IPRULE_OUT && !rule->out_dev[0])
  77                 return false;
  78
  79         if (rule->flags & IPRULE_IN && !rule->in_dev[0])
  80                 return false;
  81
  82         return true;
  83 }
  84
  85 static bool
  86 iprule_parse_mark(const char *mark, struct iprule *rule)
  87 {
  88         char *s, *e;
  89         unsigned int n;
  90
  91         if ((s = strchr(mark, '/')) != NULL)
  92                 *s++ = 0;
  93
  94         n = strtoul(mark, &e, 0);
  95
  96         if (e == mark || *e)
  97                 return false;
  98
  99         rule->fwmark = n;
 100         rule->flags |= IPRULE_FWMARK;
 101
 102         if (s) {
 103                 n = strtoul(s, &e, 0);
 104
 105                 if (e == s || *e)
 106                         return false;
 107
 108                 rule->fwmask = n;
 109                 rule->flags |= IPRULE_FWMASK;
 110         }
 111
 112         return true;
 113 }
 114
 115 /* called on interface changes of the incoming interface */
 116 static void
 117 rule_in_cb(struct interface_user *dep, struct interface *iface, enum interface_event ev)
 118 {
 119         struct iprule *rule = container_of(dep, struct iprule, in_iface_user);
 120
 121         switch (ev) {
 122         case IFEV_UP:
 123                 if (!iface->l3_dev.dev)
 124                         break;
 125
 126                 strcpy(rule->in_dev, iface->l3_dev.dev->ifname);
 127                 if (rule_ready(rule))
 128                         system_add_iprule(rule);
 129                 break;
 130         case IFEV_DOWN:
 131         case IFEV_UP_FAILED:
 132         case IFEV_FREE:
 133                 if (rule_ready(rule))
 134                         system_del_iprule(rule);
 135
 136                 rule->in_dev[0] = 0;
 137                 break;
 138         default:
 139                 break;
 140         }
 141 }
 142
 143 /* called on interface changes of the outgoing interface */
 144 static void
 145 rule_out_cb(struct interface_user *dep, struct interface *iface, enum interface_event ev)
 146 {
 147         struct iprule *rule = container_of(dep, struct iprule, out_iface_user);
 148
 149         switch (ev) {
 150         case IFEV_UP:
 151                 if (!iface->l3_dev.dev)
 152                         break;
 153
 154                 strcpy(rule->out_dev, iface->l3_dev.dev->ifname);
 155                 if (rule_ready(rule))
 156                         system_add_iprule(rule);
 157                 break;
 158         case IFEV_DOWN:
 159         case IFEV_UP_FAILED:
 160         case IFEV_FREE:
 161                 if (rule_ready(rule))
 162                         system_del_iprule(rule);
 163
 164                 rule->out_dev[0] = 0;
 165                 break;
 166         default:
 167                 break;
 168         }
 169 }
 170
 171 /* called on all interface events */
 172 static void
 173 generic_interface_cb(struct interface_user *dep,
 174                         struct interface *iface, enum interface_event ev)
 175 {
 176         struct iprule *rule;
 177
 178         if (ev != IFEV_CREATE)
 179                 return;
 180
 181         /* add new interfaces to rules */
 182         vlist_for_each_element(&iprules, rule, node) {
 183                 if (rule_ready(rule))
 184                         continue;
 185
 186                 if ((rule->flags & IPRULE_OUT) && !strcmp(rule->out_iface, iface->name))
 187                         interface_add_user(&rule->out_iface_user, iface);
 188
 189                 if ((rule->flags & IPRULE_IN) && !strcmp(rule->in_iface, iface->name))
 190                         interface_add_user(&rule->in_iface_user, iface);
 191         }
 192 }
 193
 194 struct interface_user generic_listener = {
 195         .cb = generic_interface_cb
 196 };
 197
 198 void
 199 iprule_add(struct blob_attr *attr, bool v6)
 200 {
 201         struct blob_attr *tb[__RULE_MAX], *cur;
 202         struct iprule *rule;
 203         char *iface_name;
 204         int af = v6 ? AF_INET6 : AF_INET;
 205
 206         blobmsg_parse(rule_attr, __RULE_MAX, tb, blobmsg_data(attr), blobmsg_data_len(attr));
 207
 208         if ((cur = tb[RULE_DISABLED]) != NULL && blobmsg_get_bool(cur))
 209                 return;
 210
 211         rule = calloc(1, sizeof(*rule));
 212         if (!rule)
 213                 return;
 214
 215         rule->flags = v6 ? IPRULE_INET6 : IPRULE_INET4;
 216         rule->order = iprules_counter[rule->flags]++;
 217
 218         if ((cur = tb[RULE_INVERT]) != NULL)
 219                 rule->invert = blobmsg_get_bool(cur);
 220
 221         if ((cur = tb[RULE_INTERFACE_IN]) != NULL) {
 222                 iface_name = calloc(1, strlen(blobmsg_data(cur)) + 1);
 223                 rule->in_iface = strcpy(iface_name, blobmsg_data(cur));
 224                 rule->in_iface_user.cb = &rule_in_cb;
 225                 rule->flags |= IPRULE_IN;
 226         }
 227
 228         if ((cur = tb[RULE_INTERFACE_OUT]) != NULL) {
 229                 iface_name = calloc(1, strlen(blobmsg_data(cur)) + 1);
 230                 rule->out_iface = strcpy(iface_name, blobmsg_data(cur));
 231                 rule->out_iface_user.cb = &rule_out_cb;
 232                 rule->flags |= IPRULE_OUT;
 233         }
 234
 235         if ((cur = tb[RULE_SRC]) != NULL) {
 236                 if (!parse_ip_and_netmask(af, blobmsg_data(cur), &rule->src_addr, &rule->src_mask)) {
 237                         DPRINTF("Failed to parse rule source: %s\n", (char *) blobmsg_data(cur));
 238                         goto error;
 239                 }
 240                 rule->flags |= IPRULE_SRC;
 241         }
 242
 243         if ((cur = tb[RULE_DEST]) != NULL) {
 244                 if (!parse_ip_and_netmask(af, blobmsg_data(cur), &rule->dest_addr, &rule->dest_mask)) {
 245                         DPRINTF("Failed to parse rule destination: %s\n", (char *) blobmsg_data(cur));
 246                         goto error;
 247                 }
 248                 rule->flags |= IPRULE_DEST;
 249         }
 250
 251         if ((cur = tb[RULE_PRIORITY]) != NULL) {
 252                 rule->priority = blobmsg_get_u32(cur);
 253                 rule->flags |= IPRULE_PRIORITY;
 254         }
 255
 256         if ((cur = tb[RULE_TOS]) != NULL) {
 257                 if ((rule->tos = blobmsg_get_u32(cur)) > 255) {
 258                         DPRINTF("Invalid TOS value: %u\n", blobmsg_get_u32(cur));
 259                         goto error;
 260                 }
 261                 rule->flags |= IPRULE_TOS;
 262         }
 263
 264         if ((cur = tb[RULE_FWMARK]) != NULL) {
 265                 if (!iprule_parse_mark(blobmsg_data(cur), rule)) {
 266                         DPRINTF("Failed to parse rule fwmark: %s\n", (char *) blobmsg_data(cur));
 267                         goto error;
 268                 }
 269                 /* flags set by iprule_parse_mark() */
 270         }
 271
 272         if ((cur = tb[RULE_LOOKUP]) != NULL) {
 273                 if (!system_resolve_rt_table(blobmsg_data(cur), &rule->lookup)) {
 274                         DPRINTF("Failed to parse rule lookup table: %s\n", (char *) blobmsg_data(cur));
 275                         goto error;
 276                 }
 277                 rule->flags |= IPRULE_LOOKUP;
 278         }
 279
 280         if ((cur = tb[RULE_SUP_PREFIXLEN]) != NULL) {
 281                 rule->sup_prefixlen = blobmsg_get_u32(cur);
 282                 rule->flags |= IPRULE_SUP_PREFIXLEN;
 283         }
 284
 285         if ((cur = tb[RULE_ACTION]) != NULL) {
 286                 if (!system_resolve_iprule_action(blobmsg_data(cur), &rule->action)) {
 287                         DPRINTF("Failed to parse rule action: %s\n", (char *) blobmsg_data(cur));
 288                         goto error;
 289                 }
 290                 rule->flags |= IPRULE_ACTION;
 291         }
 292
 293         if ((cur = tb[RULE_GOTO]) != NULL) {
 294                 rule->gotoid = blobmsg_get_u32(cur);
 295                 rule->flags |= IPRULE_GOTO;
 296         }
 297
 298         vlist_add(&iprules, &rule->node, rule);
 299         return;
 300
 301 error:
 302         free(rule);
 303 }
 304
 305 void
 306 iprule_update_start(void)
 307 {
 308         if (!iprules_flushed) {
 309                 system_flush_iprules();
 310                 iprules_flushed = true;
 311         }
 312
 313         iprules_counter[0] = 1;
 314         iprules_counter[1] = 1;
 315         vlist_update(&iprules);
 316 }
 317
 318 void
 319 iprule_update_complete(void)
 320 {
 321         vlist_flush(&iprules);
 322 }
 323
 324
 325 static int
 326 rule_cmp(const void *k1, const void *k2, void *ptr)
 327 {
 328         const struct iprule *r1 = k1, *r2 = k2;
 329         int ret;
 330
 331         /* First compare the interface names */
 332         if (r1->flags & IPRULE_IN || r2->flags & IPRULE_IN) {
 333                 char *str1 = r1->flags & IPRULE_IN ? r1->in_iface : "";
 334                 char *str2 = r2->flags & IPRULE_IN ? r2->in_iface : "";
 335
 336                 ret = strcmp(str1, str2);
 337                 if (ret)
 338                         return ret;
 339         }
 340
 341         if (r1->flags & IPRULE_OUT || r2->flags & IPRULE_OUT) {
 342                 char *str1 = r1->flags & IPRULE_OUT ? r1->out_iface : "";
 343                 char *str2 = r2->flags & IPRULE_OUT ? r2->out_iface : "";
 344
 345                 ret = strcmp(str1, str2);
 346                 if (ret)
 347                         return ret;
 348         }
 349
 350         /* Next compare everything after the flags field */
 351         return memcmp(k1 + offsetof(struct iprule, flags),
 352                       k2 + offsetof(struct iprule, flags),
 353                       sizeof(struct iprule) - offsetof(struct iprule, flags));
 354 }
 355
 356 static void deregister_interfaces(struct iprule *rule)
 357 {
 358         if (rule->flags & IPRULE_IN && rule->in_iface_user.iface)
 359                 interface_remove_user(&rule->in_iface_user);
 360
 361         if (rule->flags & IPRULE_OUT && rule->out_iface_user.iface)
 362                 interface_remove_user(&rule->out_iface_user);
 363 }
 364
 365 static void register_interfaces(struct iprule *rule)
 366 {
 367         struct interface *iface, *tmp;
 368
 369         if (rule->flags & IPRULE_IN) {
 370                 tmp = vlist_find(&interfaces, rule->in_iface, iface, node);
 371                 if (tmp)
 372                         interface_add_user(&rule->in_iface_user, tmp);
 373         }
 374         if (rule->flags & IPRULE_OUT) {
 375                 tmp = vlist_find(&interfaces, rule->out_iface, iface, node);
 376                 if (tmp)
 377                         interface_add_user(&rule->out_iface_user, tmp);
 378         }
 379 }
 380
 381 static void
 382 iprule_update_rule(struct vlist_tree *tree,
 383                         struct vlist_node *node_new, struct vlist_node *node_old)
 384 {
 385         struct iprule *rule_old, *rule_new;
 386
 387         rule_old = container_of(node_old, struct iprule, node);
 388         rule_new = container_of(node_new, struct iprule, node);
 389
 390         if (node_old) {
 391                 if (rule_ready(rule_old))
 392                         system_del_iprule(rule_old);
 393
 394                 if (rule_old->flags & (IPRULE_IN | IPRULE_OUT))
 395                         deregister_interfaces(rule_old);
 396
 397                 if (rule_old->in_iface)
 398                         free(rule_old->in_iface);
 399
 400                 if (rule_old->out_iface)
 401                         free(rule_old->out_iface);
 402
 403                 free(rule_old);
 404         }
 405
 406         if (node_new) {
 407                 /* interface based rules calls system_add_iprule over the event cb */
 408                 if (rule_new->flags & (IPRULE_IN | IPRULE_OUT)) {
 409                         register_interfaces(rule_new);
 410                 } else {
 411                         system_add_iprule(rule_new);
 412                 }
 413         }
 414 }
 415
 416 static void __init
 417 iprule_init_list(void)
 418 {
 419         vlist_init(&iprules, rule_cmp, iprule_update_rule);
 420         interface_add_user(&generic_listener, NULL);
 421 }