iprule.c

   1 /*
   2  * netifd - network interface daemon
   3  * Copyright (C) 2012 Felix Fietkau <nbd@openwrt.org>
   4  * Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  * Copyright (C) 2018 Alexander Couzens <lynxis@fe80.eu>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2
   9  * as published by the Free Software Foundation
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  */
  16 #include <string.h>
  17 #include <stdlib.h>
  18 #include <stdio.h>
  19
  20 #include <arpa/inet.h>
  21
  22 #include "netifd.h"
  23 #include "device.h"
  24 #include "interface.h"
  25 #include "iprule.h"
  26 #include "proto.h"
  27 #include "ubus.h"
  28 #include "system.h"
  29
  30 struct vlist_tree iprules;
  31 static bool iprules_flushed = false;
  32 static unsigned int iprules_counter[2];
  33
  34 enum {
  35         RULE_INTERFACE_IN,
  36         RULE_INTERFACE_OUT,
  37         RULE_INVERT,
  38         RULE_SRC,
  39         RULE_DEST,
  40         RULE_PRIORITY,
  41         RULE_TOS,
  42         RULE_FWMARK,
  43         RULE_LOOKUP,
  44         RULE_ACTION,
  45         RULE_GOTO,
  46         RULE_SUP_PREFIXLEN,
  47         RULE_UIDRANGE,
  48         RULE_DISABLED,
  49         __RULE_MAX
  50 };
  51
  52 static const struct blobmsg_policy rule_attr[__RULE_MAX] = {
  53         [RULE_INTERFACE_IN] = { .name = "in", .type = BLOBMSG_TYPE_STRING },
  54         [RULE_INTERFACE_OUT] = { .name = "out", .type = BLOBMSG_TYPE_STRING },
  55         [RULE_INVERT] = { .name = "invert", .type = BLOBMSG_TYPE_BOOL },
  56         [RULE_SRC] = { .name = "src", .type = BLOBMSG_TYPE_STRING },
  57         [RULE_DEST] = { .name = "dest", .type = BLOBMSG_TYPE_STRING },
  58         [RULE_PRIORITY] = { .name = "priority", .type = BLOBMSG_TYPE_INT32 },
  59         [RULE_TOS] = { .name = "tos", .type = BLOBMSG_TYPE_INT32 },
  60         [RULE_FWMARK] = { .name = "mark", .type = BLOBMSG_TYPE_STRING },
  61         [RULE_LOOKUP] = { .name = "lookup", .type = BLOBMSG_TYPE_STRING },
  62         [RULE_SUP_PREFIXLEN] = { .name = "suppress_prefixlength", .type = BLOBMSG_TYPE_INT32 },
  63         [RULE_UIDRANGE] = { .name = "uidrange", .type = BLOBMSG_TYPE_STRING },
  64         [RULE_ACTION] = { .name = "action", .type = BLOBMSG_TYPE_STRING },
  65         [RULE_GOTO]   = { .name = "goto", .type = BLOBMSG_TYPE_INT32 },
  66         [RULE_DISABLED] = { .name = "disabled", .type = BLOBMSG_TYPE_BOOL },
  67 };
  68
  69 const struct uci_blob_param_list rule_attr_list = {
  70         .n_params = __RULE_MAX,
  71         .params = rule_attr,
  72 };
  73
  74 /* interface based rules are dynamic. */
  75 static bool
  76 rule_ready(struct iprule *rule)
  77 {
  78         if (rule->flags & IPRULE_OUT && !rule->out_dev[0])
  79                 return false;
  80
  81         if (rule->flags & IPRULE_IN && !rule->in_dev[0])
  82                 return false;
  83
  84         return true;
  85 }
  86
  87 static bool
  88 iprule_parse_mark(const char *mark, struct iprule *rule)
  89 {
  90         char *s, *e;
  91         unsigned int n;
  92
  93         if ((s = strchr(mark, '/')) != NULL)
  94                 *s++ = 0;
  95
  96         n = strtoul(mark, &e, 0);
  97
  98         if (e == mark || *e)
  99                 return false;
 100
 101         rule->fwmark = n;
 102         rule->flags |= IPRULE_FWMARK;
 103
 104         if (s) {
 105                 n = strtoul(s, &e, 0);
 106
 107                 if (e == s || *e)
 108                         return false;
 109
 110                 rule->fwmask = n;
 111                 rule->flags |= IPRULE_FWMASK;
 112         }
 113
 114         return true;
 115 }
 116
 117 /* called on interface changes of the incoming interface */
 118 static void
 119 rule_in_cb(struct interface_user *dep, struct interface *iface, enum interface_event ev)
 120 {
 121         struct iprule *rule = container_of(dep, struct iprule, in_iface_user);
 122
 123         switch (ev) {
 124         case IFEV_UP:
 125                 if (!iface->l3_dev.dev)
 126                         break;
 127
 128                 strcpy(rule->in_dev, iface->l3_dev.dev->ifname);
 129                 if (rule_ready(rule))
 130                         system_add_iprule(rule);
 131                 break;
 132         case IFEV_DOWN:
 133         case IFEV_UP_FAILED:
 134         case IFEV_FREE:
 135                 if (rule_ready(rule))
 136                         system_del_iprule(rule);
 137
 138                 rule->in_dev[0] = 0;
 139                 break;
 140         default:
 141                 break;
 142         }
 143 }
 144
 145 /* called on interface changes of the outgoing interface */
 146 static void
 147 rule_out_cb(struct interface_user *dep, struct interface *iface, enum interface_event ev)
 148 {
 149         struct iprule *rule = container_of(dep, struct iprule, out_iface_user);
 150
 151         switch (ev) {
 152         case IFEV_UP:
 153                 if (!iface->l3_dev.dev)
 154                         break;
 155
 156                 strcpy(rule->out_dev, iface->l3_dev.dev->ifname);
 157                 if (rule_ready(rule))
 158                         system_add_iprule(rule);
 159                 break;
 160         case IFEV_DOWN:
 161         case IFEV_UP_FAILED:
 162         case IFEV_FREE:
 163                 if (rule_ready(rule))
 164                         system_del_iprule(rule);
 165
 166                 rule->out_dev[0] = 0;
 167                 break;
 168         default:
 169                 break;
 170         }
 171 }
 172
 173 /* called on all interface events */
 174 static void
 175 generic_interface_cb(struct interface_user *dep,
 176                         struct interface *iface, enum interface_event ev)
 177 {
 178         struct iprule *rule;
 179
 180         if (ev != IFEV_CREATE)
 181                 return;
 182
 183         /* add new interfaces to rules */
 184         vlist_for_each_element(&iprules, rule, node) {
 185                 if (rule_ready(rule))
 186                         continue;
 187
 188                 if ((rule->flags & IPRULE_OUT) && !strcmp(rule->out_iface, iface->name))
 189                         interface_add_user(&rule->out_iface_user, iface);
 190
 191                 if ((rule->flags & IPRULE_IN) && !strcmp(rule->in_iface, iface->name))
 192                         interface_add_user(&rule->in_iface_user, iface);
 193         }
 194 }
 195
 196 struct interface_user generic_listener = {
 197         .cb = generic_interface_cb
 198 };
 199
 200 void
 201 iprule_add(struct blob_attr *attr, bool v6)
 202 {
 203         struct blob_attr *tb[__RULE_MAX], *cur;
 204         struct iprule *rule;
 205         char *iface_name;
 206         int af = v6 ? AF_INET6 : AF_INET;
 207
 208         blobmsg_parse(rule_attr, __RULE_MAX, tb, blobmsg_data(attr), blobmsg_data_len(attr));
 209
 210         if ((cur = tb[RULE_DISABLED]) != NULL && blobmsg_get_bool(cur))
 211                 return;
 212
 213         rule = calloc(1, sizeof(*rule));
 214         if (!rule)
 215                 return;
 216
 217         rule->flags = v6 ? IPRULE_INET6 : IPRULE_INET4;
 218         rule->order = iprules_counter[rule->flags]++;
 219
 220         if ((cur = tb[RULE_INVERT]) != NULL)
 221                 rule->invert = blobmsg_get_bool(cur);
 222
 223         if ((cur = tb[RULE_INTERFACE_IN]) != NULL) {
 224                 iface_name = calloc(1, strlen(blobmsg_data(cur)) + 1);
 225                 rule->in_iface = strcpy(iface_name, blobmsg_data(cur));
 226                 rule->in_iface_user.cb = &rule_in_cb;
 227                 rule->flags |= IPRULE_IN;
 228         }
 229
 230         if ((cur = tb[RULE_INTERFACE_OUT]) != NULL) {
 231                 iface_name = calloc(1, strlen(blobmsg_data(cur)) + 1);
 232                 rule->out_iface = strcpy(iface_name, blobmsg_data(cur));
 233                 rule->out_iface_user.cb = &rule_out_cb;
 234                 rule->flags |= IPRULE_OUT;
 235         }
 236
 237         if ((cur = tb[RULE_SRC]) != NULL) {
 238                 if (!parse_ip_and_netmask(af, blobmsg_data(cur), &rule->src_addr, &rule->src_mask)) {
 239                         D(INTERFACE, "Failed to parse rule source: %s", (char *) blobmsg_data(cur));
 240                         goto error;
 241                 }
 242                 rule->flags |= IPRULE_SRC;
 243         }
 244
 245         if ((cur = tb[RULE_DEST]) != NULL) {
 246                 if (!parse_ip_and_netmask(af, blobmsg_data(cur), &rule->dest_addr, &rule->dest_mask)) {
 247                         D(INTERFACE, "Failed to parse rule destination: %s", (char *) blobmsg_data(cur));
 248                         goto error;
 249                 }
 250                 rule->flags |= IPRULE_DEST;
 251         }
 252
 253         if ((cur = tb[RULE_PRIORITY]) != NULL) {
 254                 rule->priority = blobmsg_get_u32(cur);
 255                 rule->flags |= IPRULE_PRIORITY;
 256         }
 257
 258         if ((cur = tb[RULE_TOS]) != NULL) {
 259                 if ((rule->tos = blobmsg_get_u32(cur)) > 255) {
 260                         D(INTERFACE, "Invalid TOS value: %u", blobmsg_get_u32(cur));
 261                         goto error;
 262                 }
 263                 rule->flags |= IPRULE_TOS;
 264         }
 265
 266         if ((cur = tb[RULE_FWMARK]) != NULL) {
 267                 if (!iprule_parse_mark(blobmsg_data(cur), rule)) {
 268                         D(INTERFACE, "Failed to parse rule fwmark: %s", (char *) blobmsg_data(cur));
 269                         goto error;
 270                 }
 271                 /* flags set by iprule_parse_mark() */
 272         }
 273
 274         if ((cur = tb[RULE_LOOKUP]) != NULL) {
 275                 if (!system_resolve_rt_table(blobmsg_data(cur), &rule->lookup)) {
 276                         D(INTERFACE, "Failed to parse rule lookup table: %s", (char *) blobmsg_data(cur));
 277                         goto error;
 278                 }
 279                 rule->flags |= IPRULE_LOOKUP;
 280         }
 281
 282         if ((cur = tb[RULE_SUP_PREFIXLEN]) != NULL) {
 283                 rule->sup_prefixlen = blobmsg_get_u32(cur);
 284                 rule->flags |= IPRULE_SUP_PREFIXLEN;
 285         }
 286
 287         if ((cur = tb[RULE_UIDRANGE]) != NULL) {
 288                 int ret = sscanf(blobmsg_get_string(cur), "%u-%u", &rule->uidrange_start, &rule->uidrange_end);
 289
 290                 if (ret == 1)
 291                         rule->uidrange_end = rule->uidrange_start;
 292                 else if (ret != 2) {
 293                         D(INTERFACE, "Failed to parse UID range: %s", (char *) blobmsg_data(cur));
 294                         goto error;
 295                 }
 296                 rule->flags |= IPRULE_UIDRANGE;
 297         }
 298
 299         if ((cur = tb[RULE_ACTION]) != NULL) {
 300                 if (!system_resolve_iprule_action(blobmsg_data(cur), &rule->action)) {
 301                         D(INTERFACE, "Failed to parse rule action: %s", (char *) blobmsg_data(cur));
 302                         goto error;
 303                 }
 304                 rule->flags |= IPRULE_ACTION;
 305         }
 306
 307         if ((cur = tb[RULE_GOTO]) != NULL) {
 308                 rule->gotoid = blobmsg_get_u32(cur);
 309                 rule->flags |= IPRULE_GOTO;
 310         }
 311
 312         vlist_add(&iprules, &rule->node, rule);
 313         return;
 314
 315 error:
 316         free(rule);
 317 }
 318
 319 void
 320 iprule_update_start(void)
 321 {
 322         if (!iprules_flushed) {
 323                 system_flush_iprules();
 324                 iprules_flushed = true;
 325         }
 326
 327         iprules_counter[0] = 1;
 328         iprules_counter[1] = 1;
 329         vlist_update(&iprules);
 330 }
 331
 332 void
 333 iprule_update_complete(void)
 334 {
 335         vlist_flush(&iprules);
 336 }
 337
 338
 339 static int
 340 rule_cmp(const void *k1, const void *k2, void *ptr)
 341 {
 342         const struct iprule *r1 = k1, *r2 = k2;
 343         int ret;
 344
 345         /* First compare the interface names */
 346         if (r1->flags & IPRULE_IN || r2->flags & IPRULE_IN) {
 347                 char *str1 = r1->flags & IPRULE_IN ? r1->in_iface : "";
 348                 char *str2 = r2->flags & IPRULE_IN ? r2->in_iface : "";
 349
 350                 ret = strcmp(str1, str2);
 351                 if (ret)
 352                         return ret;
 353         }
 354
 355         if (r1->flags & IPRULE_OUT || r2->flags & IPRULE_OUT) {
 356                 char *str1 = r1->flags & IPRULE_OUT ? r1->out_iface : "";
 357                 char *str2 = r2->flags & IPRULE_OUT ? r2->out_iface : "";
 358
 359                 ret = strcmp(str1, str2);
 360                 if (ret)
 361                         return ret;
 362         }
 363
 364         /* Next compare everything after the flags field */
 365         return memcmp(k1 + offsetof(struct iprule, flags),
 366                       k2 + offsetof(struct iprule, flags),
 367                       sizeof(struct iprule) - offsetof(struct iprule, flags));
 368 }
 369
 370 static void deregister_interfaces(struct iprule *rule)
 371 {
 372         if (rule->flags & IPRULE_IN && rule->in_iface_user.iface)
 373                 interface_remove_user(&rule->in_iface_user);
 374
 375         if (rule->flags & IPRULE_OUT && rule->out_iface_user.iface)
 376                 interface_remove_user(&rule->out_iface_user);
 377 }
 378
 379 static void register_interfaces(struct iprule *rule)
 380 {
 381         struct interface *iface, *tmp;
 382
 383         if (rule->flags & IPRULE_IN) {
 384                 tmp = vlist_find(&interfaces, rule->in_iface, iface, node);
 385                 if (tmp)
 386                         interface_add_user(&rule->in_iface_user, tmp);
 387         }
 388         if (rule->flags & IPRULE_OUT) {
 389                 tmp = vlist_find(&interfaces, rule->out_iface, iface, node);
 390                 if (tmp)
 391                         interface_add_user(&rule->out_iface_user, tmp);
 392         }
 393 }
 394
 395 static void
 396 iprule_update_rule(struct vlist_tree *tree,
 397                         struct vlist_node *node_new, struct vlist_node *node_old)
 398 {
 399         struct iprule *rule_old, *rule_new;
 400
 401         rule_old = container_of(node_old, struct iprule, node);
 402         rule_new = container_of(node_new, struct iprule, node);
 403
 404         if (node_old) {
 405                 if (rule_ready(rule_old))
 406                         system_del_iprule(rule_old);
 407
 408                 if (rule_old->flags & (IPRULE_IN | IPRULE_OUT))
 409                         deregister_interfaces(rule_old);
 410
 411                 if (rule_old->in_iface)
 412                         free(rule_old->in_iface);
 413
 414                 if (rule_old->out_iface)
 415                         free(rule_old->out_iface);
 416
 417                 free(rule_old);
 418         }
 419
 420         if (node_new) {
 421                 /* interface based rules calls system_add_iprule over the event cb */
 422                 if (rule_new->flags & (IPRULE_IN | IPRULE_OUT)) {
 423                         register_interfaces(rule_new);
 424                 } else {
 425                         system_add_iprule(rule_new);
 426                 }
 427         }
 428 }
 429
 430 static void __init
 431 iprule_init_list(void)
 432 {
 433         vlist_init(&iprules, rule_cmp, iprule_update_rule);
 434         interface_add_user(&generic_listener, NULL);
 435 }