iprule.c

   1 /*
   2  * netifd - network interface daemon
   3  * Copyright (C) 2012 Felix Fietkau <nbd@openwrt.org>
   4  * Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  * Copyright (C) 2018 Alexander Couzens <lynxis@fe80.eu>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2
   9  * as published by the Free Software Foundation
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  */
  16 #include <string.h>
  17 #include <stdlib.h>
  18 #include <stdio.h>
  19
  20 #include <arpa/inet.h>
  21
  22 #include "netifd.h"
  23 #include "device.h"
  24 #include "interface.h"
  25 #include "iprule.h"
  26 #include "proto.h"
  27 #include "ubus.h"
  28 #include "system.h"
  29
  30 struct vlist_tree iprules;
  31 static bool iprules_flushed = false;
  32 static unsigned int iprules_counter[2];
  33
  34 enum {
  35         RULE_INTERFACE_IN,
  36         RULE_INTERFACE_OUT,
  37         RULE_INVERT,
  38         RULE_SRC,
  39         RULE_DEST,
  40         RULE_PRIORITY,
  41         RULE_TOS,
  42         RULE_FWMARK,
  43         RULE_LOOKUP,
  44         RULE_ACTION,
  45         RULE_GOTO,
  46         RULE_SUP_PREFIXLEN,
  47         __RULE_MAX
  48 };
  49
  50 static const struct blobmsg_policy rule_attr[__RULE_MAX] = {
  51         [RULE_INTERFACE_IN] = { .name = "in", .type = BLOBMSG_TYPE_STRING },
  52         [RULE_INTERFACE_OUT] = { .name = "out", .type = BLOBMSG_TYPE_STRING },
  53         [RULE_INVERT] = { .name = "invert", .type = BLOBMSG_TYPE_BOOL },
  54         [RULE_SRC] = { .name = "src", .type = BLOBMSG_TYPE_STRING },
  55         [RULE_DEST] = { .name = "dest", .type = BLOBMSG_TYPE_STRING },
  56         [RULE_PRIORITY] = { .name = "priority", .type = BLOBMSG_TYPE_INT32 },
  57         [RULE_TOS] = { .name = "tos", .type = BLOBMSG_TYPE_INT32 },
  58         [RULE_FWMARK] = { .name = "mark", .type = BLOBMSG_TYPE_STRING },
  59         [RULE_LOOKUP] = { .name = "lookup", .type = BLOBMSG_TYPE_STRING },
  60         [RULE_SUP_PREFIXLEN] = { .name = "suppress_prefixlength", .type = BLOBMSG_TYPE_INT32 },
  61         [RULE_ACTION] = { .name = "action", .type = BLOBMSG_TYPE_STRING },
  62         [RULE_GOTO]   = { .name = "goto", .type = BLOBMSG_TYPE_INT32 },
  63 };
  64
  65 const struct uci_blob_param_list rule_attr_list = {
  66         .n_params = __RULE_MAX,
  67         .params = rule_attr,
  68 };
  69
  70 /* interface based rules are dynamic. */
  71 static bool rule_ready(struct iprule *rule) {
  72         if (rule->flags & IPRULE_OUT && !rule->out_dev[0])
  73                 return false;
  74
  75         if (rule->flags & IPRULE_IN && !rule->in_dev[0])
  76                 return false;
  77
  78         return true;
  79 }
  80
  81 static bool
  82 iprule_parse_mark(const char *mark, struct iprule *rule)
  83 {
  84         char *s, *e;
  85         unsigned int n;
  86
  87         if ((s = strchr(mark, '/')) != NULL)
  88                 *s++ = 0;
  89
  90         n = strtoul(mark, &e, 0);
  91
  92         if (e == mark || *e)
  93                 return false;
  94
  95         rule->fwmark = n;
  96         rule->flags |= IPRULE_FWMARK;
  97
  98         if (s) {
  99                 n = strtoul(s, &e, 0);
 100
 101                 if (e == s || *e)
 102                         return false;
 103
 104                 rule->fwmask = n;
 105                 rule->flags |= IPRULE_FWMASK;
 106         }
 107
 108         return true;
 109 }
 110
 111 /* called on interface changes of the incoming interface */
 112 static void rule_in_cb(
 113                 struct interface_user *dep,
 114                 struct interface *iface,
 115                 enum interface_event ev)
 116 {
 117         struct iprule *rule = container_of(dep, struct iprule, in_iface_user);
 118
 119         switch (ev) {
 120         case IFEV_UP:
 121                 if (!iface->l3_dev.dev)
 122                         break;
 123                 memcpy(rule->in_dev, iface->l3_dev.dev->ifname, sizeof(rule->in_dev));
 124                 if (rule_ready(rule))
 125                         system_add_iprule(rule);
 126                 break;
 127         case IFEV_DOWN:
 128         case IFEV_UP_FAILED:
 129         case IFEV_FREE:
 130                 if (rule_ready(rule))
 131                         system_del_iprule(rule);
 132                 rule->in_dev[0] = 0;
 133                 break;
 134         default:
 135                 break;
 136         }
 137 }
 138
 139 /* called on interface changes of the outgoing interface */
 140 static void rule_out_cb(
 141                 struct interface_user *dep,
 142                 struct interface *iface,
 143                 enum interface_event ev)
 144 {
 145         struct iprule *rule = container_of(dep, struct iprule, out_iface_user);
 146
 147         switch (ev) {
 148         case IFEV_UP:
 149                 if (!iface->l3_dev.dev)
 150                         break;
 151                 memcpy(rule->out_dev, iface->l3_dev.dev->ifname, sizeof(rule->out_dev));
 152                 if (rule_ready(rule))
 153                         system_add_iprule(rule);
 154                 break;
 155         case IFEV_DOWN:
 156         case IFEV_UP_FAILED:
 157         case IFEV_FREE:
 158                 if (rule_ready(rule))
 159                         system_del_iprule(rule);
 160                 rule->out_dev[0] = 0;
 161                 break;
 162         default:
 163                 break;
 164         }
 165 }
 166
 167 /* called on all interface events */
 168 static void generic_interface_cb(
 169                 struct interface_user *dep,
 170                 struct interface *iface,
 171                 enum interface_event ev)
 172 {
 173         struct iprule *rule;
 174
 175         if (ev != IFEV_CREATE)
 176                 return;
 177
 178         /* add new interfaces to rules */
 179         vlist_for_each_element(&iprules, rule, node) {
 180                 if (rule_ready(rule))
 181                         continue;
 182
 183                 if (!strcmp(rule->out_iface, iface->name)) {
 184                         memcpy(rule->out_dev, iface->l3_dev.dev->ifname, sizeof(rule->out_dev));
 185                         interface_add_user(&rule->out_iface_user, iface);
 186                 }
 187
 188                 if (!strcmp(rule->in_iface, iface->name)) {
 189                         memcpy(rule->in_dev, iface->l3_dev.dev->ifname, sizeof(rule->in_dev));
 190                         interface_add_user(&rule->in_iface_user, iface);
 191                 }
 192         }
 193 }
 194
 195 struct interface_user generic_listener = {
 196         .cb = generic_interface_cb
 197 };
 198
 199 void
 200 iprule_add(struct blob_attr *attr, bool v6)
 201 {
 202         struct blob_attr *tb[__RULE_MAX], *cur;
 203         struct iprule *rule;
 204         char *iface_name;
 205         int af = v6 ? AF_INET6 : AF_INET;
 206
 207         blobmsg_parse(rule_attr, __RULE_MAX, tb, blobmsg_data(attr), blobmsg_data_len(attr));
 208
 209         rule = calloc(1, sizeof(*rule));
 210         if (!rule)
 211                 return;
 212
 213         rule->flags = v6 ? IPRULE_INET6 : IPRULE_INET4;
 214         rule->order = iprules_counter[rule->flags]++;
 215
 216         if ((cur = tb[RULE_INVERT]) != NULL)
 217                 rule->invert = blobmsg_get_bool(cur);
 218
 219         if ((cur = tb[RULE_INTERFACE_IN]) != NULL) {
 220                 iface_name = calloc(1, strlen(blobmsg_data(cur)) + 1);
 221                 rule->in_iface = strcpy(iface_name, blobmsg_data(cur));
 222                 rule->in_iface_user.cb = &rule_in_cb;
 223                 rule->flags |= IPRULE_IN;
 224         }
 225
 226         if ((cur = tb[RULE_INTERFACE_OUT]) != NULL) {
 227                 iface_name = calloc(1, strlen(blobmsg_data(cur)) + 1);
 228                 rule->out_iface = strcpy(iface_name, blobmsg_data(cur));
 229                 rule->out_iface_user.cb = &rule_out_cb;
 230                 rule->flags |= IPRULE_OUT;
 231         }
 232
 233         if ((cur = tb[RULE_SRC]) != NULL) {
 234                 if (!parse_ip_and_netmask(af, blobmsg_data(cur), &rule->src_addr, &rule->src_mask)) {
 235                         DPRINTF("Failed to parse rule source: %s\n", (char *) blobmsg_data(cur));
 236                         goto error;
 237                 }
 238                 rule->flags |= IPRULE_SRC;
 239         }
 240
 241         if ((cur = tb[RULE_DEST]) != NULL) {
 242                 if (!parse_ip_and_netmask(af, blobmsg_data(cur), &rule->dest_addr, &rule->dest_mask)) {
 243                         DPRINTF("Failed to parse rule destination: %s\n", (char *) blobmsg_data(cur));
 244                         goto error;
 245                 }
 246                 rule->flags |= IPRULE_DEST;
 247         }
 248
 249         if ((cur = tb[RULE_PRIORITY]) != NULL) {
 250                 rule->priority = blobmsg_get_u32(cur);
 251                 rule->flags |= IPRULE_PRIORITY;
 252         }
 253
 254         if ((cur = tb[RULE_TOS]) != NULL) {
 255                 if ((rule->tos = blobmsg_get_u32(cur)) > 255) {
 256                         DPRINTF("Invalid TOS value: %u\n", blobmsg_get_u32(cur));
 257                         goto error;
 258                 }
 259                 rule->flags |= IPRULE_TOS;
 260         }
 261
 262         if ((cur = tb[RULE_FWMARK]) != NULL) {
 263                 if (!iprule_parse_mark(blobmsg_data(cur), rule)) {
 264                         DPRINTF("Failed to parse rule fwmark: %s\n", (char *) blobmsg_data(cur));
 265                         goto error;
 266                 }
 267                 /* flags set by iprule_parse_mark() */
 268         }
 269
 270         if ((cur = tb[RULE_LOOKUP]) != NULL) {
 271                 if (!system_resolve_rt_table(blobmsg_data(cur), &rule->lookup)) {
 272                         DPRINTF("Failed to parse rule lookup table: %s\n", (char *) blobmsg_data(cur));
 273                         goto error;
 274                 }
 275                 rule->flags |= IPRULE_LOOKUP;
 276         }
 277
 278         if ((cur = tb[RULE_SUP_PREFIXLEN]) != NULL) {
 279                 rule->sup_prefixlen = blobmsg_get_u32(cur);
 280                 rule->flags |= IPRULE_SUP_PREFIXLEN;
 281         }
 282
 283         if ((cur = tb[RULE_ACTION]) != NULL) {
 284                 if (!system_resolve_iprule_action(blobmsg_data(cur), &rule->action)) {
 285                         DPRINTF("Failed to parse rule action: %s\n", (char *) blobmsg_data(cur));
 286                         goto error;
 287                 }
 288                 rule->flags |= IPRULE_ACTION;
 289         }
 290
 291         if ((cur = tb[RULE_GOTO]) != NULL) {
 292                 rule->gotoid = blobmsg_get_u32(cur);
 293                 rule->flags |= IPRULE_GOTO;
 294         }
 295
 296         vlist_add(&iprules, &rule->node, &rule->flags);
 297         return;
 298
 299 error:
 300         free(rule);
 301 }
 302
 303 void
 304 iprule_update_start(void)
 305 {
 306         if (!iprules_flushed) {
 307                 system_flush_iprules();
 308                 iprules_flushed = true;
 309         }
 310
 311         iprules_counter[0] = 1;
 312         iprules_counter[1] = 1;
 313         vlist_update(&iprules);
 314 }
 315
 316 void
 317 iprule_update_complete(void)
 318 {
 319         vlist_flush(&iprules);
 320 }
 321
 322
 323 static int
 324 rule_cmp(const void *k1, const void *k2, void *ptr)
 325 {
 326         return memcmp(k1, k2, sizeof(struct iprule)-offsetof(struct iprule, flags));
 327 }
 328
 329 static void deregister_interfaces(struct iprule *rule)
 330 {
 331         if (rule->flags & IPRULE_IN && rule->in_iface_user.iface)
 332                 interface_remove_user(&rule->in_iface_user);
 333
 334         if (rule->flags & IPRULE_OUT && rule->out_iface_user.iface)
 335                 interface_remove_user(&rule->out_iface_user);
 336 }
 337
 338 static void register_interfaces(struct iprule *rule)
 339 {
 340         struct interface *iface, *tmp;
 341
 342         if (rule->flags & IPRULE_IN) {
 343                 tmp = vlist_find(&interfaces, rule->in_iface, iface, node);
 344                 if (tmp)
 345                         interface_add_user(&rule->in_iface_user, tmp);
 346         }
 347         if (rule->flags & IPRULE_OUT) {
 348                 tmp = vlist_find(&interfaces, rule->out_iface, iface, node);
 349                 if (tmp)
 350                         interface_add_user(&rule->out_iface_user, tmp);
 351         }
 352 }
 353
 354 static void
 355 iprule_update_rule(struct vlist_tree *tree,
 356                         struct vlist_node *node_new, struct vlist_node *node_old)
 357 {
 358         struct iprule *rule_old, *rule_new;
 359
 360         rule_old = container_of(node_old, struct iprule, node);
 361         rule_new = container_of(node_new, struct iprule, node);
 362
 363         if (node_old) {
 364                 if (rule_ready(rule_old))
 365                         system_del_iprule(rule_old);
 366
 367                 if (rule_old->flags & (IPRULE_IN | IPRULE_OUT))
 368                         deregister_interfaces(rule_old);
 369
 370                 if (rule_old->in_iface)
 371                         free(rule_old->in_iface);
 372
 373                 if (rule_old->out_iface)
 374                         free(rule_old->out_iface);
 375
 376                 free(rule_old);
 377         }
 378
 379         if (node_new) {
 380                 /* interface based rules calls system_add_iprule over the event cb */
 381                 if (rule_new->flags & (IPRULE_IN | IPRULE_OUT)) {
 382                         register_interfaces(rule_new);
 383                 } else {
 384                         system_add_iprule(rule_new);
 385                 }
 386         }
 387 }
 388
 389 static void __init
 390 iprule_init_list(void)
 391 {
 392         vlist_init(&iprules, rule_cmp, iprule_update_rule);
 393         interface_add_user(&generic_listener, NULL);
 394 }