[thirdparty/systemd.git] / src / shared / local-addresses.c

/* SPDX-License-Identifier: LGPL-2.1-or-later */

#include <net/if_arp.h>

#include "sd-netlink.h"

#include "alloc-util.h"
#include "fd-util.h"
#include "local-addresses.h"
#include "macro.h"
#include "netlink-util.h"
#include "sort-util.h"

static int address_compare(const struct local_address *a, const struct local_address *b) {
        int r;

        /* Order lowest scope first, IPv4 before IPv6, lowest interface index first */

        if (a->family == AF_INET && b->family == AF_INET6)
                return -1;
        if (a->family == AF_INET6 && b->family == AF_INET)
                return 1;

        r = CMP(a->scope, b->scope);
        if (r != 0)
                return r;

        r = CMP(a->metric, b->metric);
        if (r != 0)
                return r;

        r = CMP(a->ifindex, b->ifindex);
        if (r != 0)
                return r;

        return memcmp(&a->address, &b->address, FAMILY_ADDRESS_SIZE(a->family));
}

static void suppress_duplicates(struct local_address *list, size_t *n_list) {
        size_t old_size, new_size;

        /* Removes duplicate entries, assumes the list of addresses is already sorted. Updates in-place. */

        if (*n_list < 2) /* list with less than two entries can't have duplicates */
                return;

        old_size = *n_list;
        new_size = 1;

        for (size_t i = 1; i < old_size; i++) {

                if (address_compare(list + i, list + new_size - 1) == 0)
                        continue;

                list[new_size++] = list[i];
        }

        *n_list = new_size;
}

int local_addresses(
                sd_netlink *context,
                int ifindex,
                int af,
                struct local_address **ret) {

        _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *req = NULL, *reply = NULL;
        _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
        _cleanup_free_ struct local_address *list = NULL;
        size_t n_list = 0;
        sd_netlink_message *m;
        int r;

        if (context)
                rtnl = sd_netlink_ref(context);
        else {
                r = sd_netlink_open(&rtnl);
                if (r < 0)
                        return r;
        }

        r = sd_rtnl_message_new_addr(rtnl, &req, RTM_GETADDR, ifindex, af);
        if (r < 0)
                return r;

        r = sd_netlink_message_request_dump(req, true);
        if (r < 0)
                return r;

        r = sd_netlink_call(rtnl, req, 0, &reply);
        if (r < 0)
                return r;

        for (m = reply; m; m = sd_netlink_message_next(m)) {
                struct local_address *a;
                unsigned char flags;
                uint16_t type;
                int ifi, family;

                r = sd_netlink_message_get_errno(m);
                if (r < 0)
                        return r;

                r = sd_netlink_message_get_type(m, &type);
                if (r < 0)
                        return r;
                if (type != RTM_NEWADDR)
                        continue;

                r = sd_rtnl_message_addr_get_ifindex(m, &ifi);
                if (r < 0)
                        return r;
                if (ifindex > 0 && ifi != ifindex)
                        continue;

                r = sd_rtnl_message_addr_get_family(m, &family);
                if (r < 0)
                        return r;
                if (af != AF_UNSPEC && af != family)
                        continue;

                r = sd_rtnl_message_addr_get_flags(m, &flags);
                if (r < 0)
                        return r;
                if (flags & IFA_F_DEPRECATED)
                        continue;

                if (!GREEDY_REALLOC0(list, n_list+1))
                        return -ENOMEM;

                a = list + n_list;

                r = sd_rtnl_message_addr_get_scope(m, &a->scope);
                if (r < 0)
                        return r;

                if (ifindex == 0 && IN_SET(a->scope, RT_SCOPE_HOST, RT_SCOPE_NOWHERE))
                        continue;

                switch (family) {

                case AF_INET:
                        r = sd_netlink_message_read_in_addr(m, IFA_LOCAL, &a->address.in);
                        if (r < 0) {
                                r = sd_netlink_message_read_in_addr(m, IFA_ADDRESS, &a->address.in);
                                if (r < 0)
                                        continue;
                        }
                        break;

                case AF_INET6:
                        r = sd_netlink_message_read_in6_addr(m, IFA_LOCAL, &a->address.in6);
                        if (r < 0) {
                                r = sd_netlink_message_read_in6_addr(m, IFA_ADDRESS, &a->address.in6);
                                if (r < 0)
                                        continue;
                        }
                        break;

                default:
                        continue;
                }

                a->ifindex = ifi;
                a->family = family;

                n_list++;
        };

        if (ret) {
                typesafe_qsort(list, n_list, address_compare);
                suppress_duplicates(list, &n_list);
                *ret = TAKE_PTR(list);
        }

        return (int) n_list;
}

static int add_local_gateway(
                struct local_address **list,
                size_t *n_list,
                int af,
                int ifindex,
                uint32_t metric,
                const RouteVia *via) {

        assert(list);
        assert(n_list);
        assert(via);

        if (af != AF_UNSPEC && af != via->family)
                return 0;

        if (!GREEDY_REALLOC(*list, *n_list + 1))
                return -ENOMEM;

        (*list)[(*n_list)++] = (struct local_address) {
                .ifindex = ifindex,
                .metric = metric,
                .family = via->family,
                .address = via->address,
        };

        return 0;
}

int local_gateways(
                sd_netlink *context,
                int ifindex,
                int af,
                struct local_address **ret) {

        _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *req = NULL, *reply = NULL;
        _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
        _cleanup_free_ struct local_address *list = NULL;
        size_t n_list = 0;
        int r;

        if (context)
                rtnl = sd_netlink_ref(context);
        else {
                r = sd_netlink_open(&rtnl);
                if (r < 0)
                        return r;
        }

        r = sd_rtnl_message_new_route(rtnl, &req, RTM_GETROUTE, af, RTPROT_UNSPEC);
        if (r < 0)
                return r;

        r = sd_rtnl_message_route_set_type(req, RTN_UNICAST);
        if (r < 0)
                return r;

        r = sd_rtnl_message_route_set_table(req, RT_TABLE_MAIN);
        if (r < 0)
                return r;

        r = sd_netlink_message_request_dump(req, true);
        if (r < 0)
                return r;

        r = sd_netlink_call(rtnl, req, 0, &reply);
        if (r < 0)
                return r;

        for (sd_netlink_message *m = reply; m; m = sd_netlink_message_next(m)) {
                _cleanup_ordered_set_free_free_ OrderedSet *multipath_routes = NULL;
                _cleanup_free_ void *rta_multipath = NULL;
                union in_addr_union gateway;
                uint16_t type;
                unsigned char dst_len, src_len, table;
                uint32_t ifi = 0, metric = 0;
                size_t rta_len;
                int family;
                RouteVia via;

                r = sd_netlink_message_get_errno(m);
                if (r < 0)
                        return r;

                r = sd_netlink_message_get_type(m, &type);
                if (r < 0)
                        return r;
                if (type != RTM_NEWROUTE)
                        continue;

                /* We only care for default routes */
                r = sd_rtnl_message_route_get_dst_prefixlen(m, &dst_len);
                if (r < 0)
                        return r;
                if (dst_len != 0)
                        continue;

                r = sd_rtnl_message_route_get_src_prefixlen(m, &src_len);
                if (r < 0)
                        return r;
                if (src_len != 0)
                        continue;

                r = sd_rtnl_message_route_get_table(m, &table);
                if (r < 0)
                        return r;
                if (table != RT_TABLE_MAIN)
                        continue;

                r = sd_netlink_message_read_u32(m, RTA_PRIORITY, &metric);
                if (r < 0 && r != -ENODATA)
                        return r;

                r = sd_rtnl_message_route_get_family(m, &family);
                if (r < 0)
                        return r;
                if (!IN_SET(family, AF_INET, AF_INET6))
                        continue;

                r = sd_netlink_message_read_u32(m, RTA_OIF, &ifi);
                if (r < 0 && r != -ENODATA)
                        return r;
                if (r >= 0) {
                        if (ifi <= 0)
                                return -EINVAL;
                        if (ifindex > 0 && (int) ifi != ifindex)
                                continue;

                        r = netlink_message_read_in_addr_union(m, RTA_GATEWAY, family, &gateway);
                        if (r < 0 && r != -ENODATA)
                                return r;
                        if (r >= 0) {
                                via.family = family;
                                via.address = gateway;
                                r = add_local_gateway(&list, &n_list, af, ifi, metric, &via);
                                if (r < 0)
                                        return r;

                                continue;
                        }

                        if (family != AF_INET)
                                continue;

                        r = sd_netlink_message_read(m, RTA_VIA, sizeof(via), &via);
                        if (r < 0 && r != -ENODATA)
                                return r;
                        if (r >= 0) {
                                r = add_local_gateway(&list, &n_list, af, ifi, metric, &via);
                                if (r < 0)
                                        return r;

                                continue;
                        }
                }

                r = sd_netlink_message_read_data(m, RTA_MULTIPATH, &rta_len, &rta_multipath);
                if (r < 0 && r != -ENODATA)
                        return r;
                if (r >= 0) {
                        MultipathRoute *mr;

                        r = rtattr_read_nexthop(rta_multipath, rta_len, family, &multipath_routes);
                        if (r < 0)
                                return r;

                        ORDERED_SET_FOREACH(mr, multipath_routes) {
                                if (ifindex > 0 && mr->ifindex != ifindex)
                                        continue;

                                r = add_local_gateway(&list, &n_list, af, ifi, metric, &mr->gateway);
                                if (r < 0)
                                        return r;
                        }
                }
        }

        if (ret) {
                typesafe_qsort(list, n_list, address_compare);
                suppress_duplicates(list, &n_list);
                *ret = TAKE_PTR(list);
        }

        return (int) n_list;
}

int local_outbounds(
                sd_netlink *context,
                int ifindex,
                int af,
                struct local_address **ret) {

        _cleanup_free_ struct local_address *list = NULL, *gateways = NULL;
        size_t n_list = 0;
        int r, n_gateways;

        /* Determines our default outbound addresses, i.e. the "primary" local addresses we use to talk to IP
         * addresses behind the default routes. This is still an address of the local host (i.e. this doesn't
         * resolve NAT or so), but it's the set of addresses the local IP stack most likely uses to talk to
         * other hosts.
         *
         * This works by connect()ing a SOCK_DGRAM socket to the local gateways, and then reading the IP
         * address off the socket that was chosen for the routing decision. */

        n_gateways = local_gateways(context, ifindex, af, &gateways);
        if (n_gateways < 0)
                return n_gateways;
        if (n_gateways == 0) {
                /* No gateways? Then we have no outbound addresses either. */
                if (ret)
                        *ret = NULL;

                return 0;
        }

        for (int i = 0; i < n_gateways; i++) {
                _cleanup_close_ int fd = -1;
                union sockaddr_union sa;
                socklen_t salen;

                fd = socket(gateways[i].family, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
                if (fd < 0)
                        return -errno;

                switch (gateways[i].family) {

                case AF_INET:
                        sa.in = (struct sockaddr_in) {
                                .sin_family = AF_INET,
                                .sin_addr = gateways[i].address.in,
                                .sin_port = htobe16(53), /* doesn't really matter which port we pick —
                                                          * we just care about the routing decision */
                        };

                        break;

                case AF_INET6:
                        sa.in6 = (struct sockaddr_in6) {
                                .sin6_family = AF_INET6,
                                .sin6_addr = gateways[i].address.in6,
                                .sin6_port = htobe16(53),
                                .sin6_scope_id = gateways[i].ifindex,
                        };

                        break;

                default:
                        assert_not_reached("Unexpected protocol");
                }

                /* So ideally we'd just use IP_UNICAST_IF here to pass the ifindex info to the kernel before
                 * connect()ing, sot that it influences the routing decision. However, on current kernels
                 * IP_UNICAST_IF doesn't actually influence the routing decision for UDP — which I think
                 * should probably just be considered a bug. Once that bug is fixed this is the best API to
                 * use, since it is the most lightweight. */
                r = socket_set_unicast_if(fd, gateways[i].family, gateways[i].ifindex);
                if (r < 0)
                        log_debug_errno(r, "Failed to set unicast interface index %i, ignoring: %m", gateways[i].ifindex);

                /* We'll also use SO_BINDTOINDEX. This requires CAP_NET_RAW on old kernels, hence there's a
                 * good chance this fails. Since 5.7 this restriction was dropped and the first
                 * SO_BINDTOINDEX on a socket may be done without privileges. This one has the benefit of
                 * really influencing the routing decision, i.e. this one definitely works for us — as long
                 * as we have the privileges for it. */
                r = socket_bind_to_ifindex(fd, gateways[i].ifindex);
                if (r < 0)
                        log_debug_errno(r, "Failed to bind socket to interface %i, ignoring: %m", gateways[i].ifindex);

                /* Let's now connect() to the UDP socket, forcing the kernel to make a routing decision and
                 * auto-bind the socket. We ignore failures on this, since that failure might happen for a
                 * multitude of reasons (policy/firewall issues, who knows?) and some of them might be
                 * *after* the routing decision and the auto-binding already took place. If so we can still
                 * make use of the binding and return it. Hence, let's not unnecessarily fail early here: we
                 * can still easily detect if the auto-binding worked or not, by comparing the bound IP
                 * address with zero — which we do below. */
                if (connect(fd, &sa.sa, SOCKADDR_LEN(sa)) < 0)
                        log_debug_errno(errno, "Failed to connect SOCK_DGRAM socket to gateway, ignoring: %m");

                /* Let's now read the socket address of the socket. A routing decision should have been
                 * made. Let's verify that and use the data. */
                salen = SOCKADDR_LEN(sa);
                if (getsockname(fd, &sa.sa, &salen) < 0)
                        return -errno;
                assert(sa.sa.sa_family == gateways[i].family);
                assert(salen == SOCKADDR_LEN(sa));

                switch (gateways[i].family) {

                case AF_INET:
                        if (in4_addr_is_null(&sa.in.sin_addr)) /* Auto-binding didn't work. :-( */
                                continue;

                        if (!GREEDY_REALLOC(list, n_list+1))
                                return -ENOMEM;

                        list[n_list++] = (struct local_address) {
                                .family = gateways[i].family,
                                .ifindex = gateways[i].ifindex,
                                .address.in = sa.in.sin_addr,
                        };

                        break;

                case AF_INET6:
                        if (in6_addr_is_null(&sa.in6.sin6_addr))
                                continue;

                        if (!GREEDY_REALLOC(list, n_list+1))
                                return -ENOMEM;

                        list[n_list++] = (struct local_address) {
                                .family = gateways[i].family,
                                .ifindex = gateways[i].ifindex,
                                .address.in6 = sa.in6.sin6_addr,
                        };
                        break;

                default:
                        assert_not_reached("Unexpected protocol");
                }
        }

        if (ret) {
                typesafe_qsort(list, n_list, address_compare);
                suppress_duplicates(list, &n_list);
                *ret = TAKE_PTR(list);
        }

        return (int) n_list;
}
Commit	Line	Data
db9ecf05	1	/* SPDX-License-Identifier: LGPL-2.1-or-later */
8041b5ba	2
54e6f97b LP	3	#include <net/if_arp.h>
54e6f97b LP	4
1c4baffc	5	#include "sd-netlink.h"
b5efdb8a LP	6
b5efdb8a LP	7	#include "alloc-util.h"
54e6f97b	8	#include "fd-util.h"
e80af1bd	9	#include "local-addresses.h"
cf0fbc49 TA	10	#include "macro.h"
cf0fbc49 TA	11	#include "netlink-util.h"
760877e9	12	#include "sort-util.h"
8041b5ba	13
93bab288 YW	14	static int address_compare(const struct local_address a, const struct local_address b) {
93bab288 YW	15	int r;
5502f0d9 LP	16
	17	/* Order lowest scope first, IPv4 before IPv6, lowest interface index first */
	18
e9140aff LP	19	if (a->family == AF_INET && b->family == AF_INET6)
	20	return -1;
	21	if (a->family == AF_INET6 && b->family == AF_INET)
	22	return 1;
	23
93bab288 YW	24	r = CMP(a->scope, b->scope);
	25	if (r != 0)
	26	return r;
5502f0d9	27
93bab288 YW	28	r = CMP(a->metric, b->metric);
	29	if (r != 0)
	30	return r;
5502f0d9	31
93bab288 YW	32	r = CMP(a->ifindex, b->ifindex);
	33	if (r != 0)
	34	return r;
5502f0d9	35
00d75e57	36	return memcmp(&a->address, &b->address, FAMILY_ADDRESS_SIZE(a->family));
5502f0d9 LP	37	}
5502f0d9 LP	38
54e6f97b LP	39	static void suppress_duplicates(struct local_address list, size_t n_list) {
	40	size_t old_size, new_size;
	41
	42	/* Removes duplicate entries, assumes the list of addresses is already sorted. Updates in-place. */
	43
	44	if (n_list < 2) / list with less than two entries can't have duplicates */
	45	return;
	46
	47	old_size = *n_list;
	48	new_size = 1;
	49
	50	for (size_t i = 1; i < old_size; i++) {
	51
	52	if (address_compare(list + i, list + new_size - 1) == 0)
	53	continue;
	54
	55	list[new_size++] = list[i];
	56	}
	57
	58	*n_list = new_size;
	59	}
	60
	61	int local_addresses(
	62	sd_netlink *context,
	63	int ifindex,
	64	int af,
	65	struct local_address **ret) {
	66
4afd3348 LP	67	_cleanup_(sd_netlink_message_unrefp) sd_netlink_message req = NULL, reply = NULL;
4afd3348 LP	68	_cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
e80af1bd	69	_cleanup_free_ struct local_address *list = NULL;
319a4f4b	70	size_t n_list = 0;
1c4baffc	71	sd_netlink_message *m;
d1ca51b1	72	int r;
d73c3269	73
ee8c4568	74	if (context)
1c4baffc	75	rtnl = sd_netlink_ref(context);
ee8c4568	76	else {
1c4baffc	77	r = sd_netlink_open(&rtnl);
ee8c4568 LP	78	if (r < 0)
	79	return r;
	80	}
8041b5ba	81
6a28b78f	82	r = sd_rtnl_message_new_addr(rtnl, &req, RTM_GETADDR, ifindex, af);
d1ca51b1 TG	83	if (r < 0)
d1ca51b1 TG	84	return r;
8041b5ba	85
f318f643 YW	86	r = sd_netlink_message_request_dump(req, true);
	87	if (r < 0)
	88	return r;
	89
1c4baffc	90	r = sd_netlink_call(rtnl, req, 0, &reply);
d1ca51b1 TG	91	if (r < 0)
d1ca51b1 TG	92	return r;
d1ca51b1	93
1c4baffc	94	for (m = reply; m; m = sd_netlink_message_next(m)) {
e80af1bd	95	struct local_address *a;
d1ca51b1	96	unsigned char flags;
5502f0d9	97	uint16_t type;
1d050e1e	98	int ifi, family;
d1ca51b1	99
1c4baffc	100	r = sd_netlink_message_get_errno(m);
d1ca51b1 TG	101	if (r < 0)
	102	return r;
	103
1c4baffc	104	r = sd_netlink_message_get_type(m, &type);
d1ca51b1 TG	105	if (r < 0)
d1ca51b1 TG	106	return r;
d1ca51b1	107	if (type != RTM_NEWADDR)
8041b5ba LP	108	continue;
8041b5ba LP	109
ee8c4568 LP	110	r = sd_rtnl_message_addr_get_ifindex(m, &ifi);
	111	if (r < 0)
	112	return r;
1d050e1e LP	113	if (ifindex > 0 && ifi != ifindex)
1d050e1e LP	114	continue;
ee8c4568	115
1d050e1e LP	116	r = sd_rtnl_message_addr_get_family(m, &family);
	117	if (r < 0)
	118	return r;
	119	if (af != AF_UNSPEC && af != family)
ee8c4568 LP	120	continue;
ee8c4568 LP	121
5502f0d9	122	r = sd_rtnl_message_addr_get_flags(m, &flags);
d1ca51b1 TG	123	if (r < 0)
d1ca51b1 TG	124	return r;
5502f0d9	125	if (flags & IFA_F_DEPRECATED)
d73c3269	126	continue;
8041b5ba	127
319a4f4b	128	if (!GREEDY_REALLOC0(list, n_list+1))
5502f0d9 LP	129	return -ENOMEM;
	130
	131	a = list + n_list;
	132
	133	r = sd_rtnl_message_addr_get_scope(m, &a->scope);
d1ca51b1 TG	134	if (r < 0)
d1ca51b1 TG	135	return r;
8041b5ba	136
945c2931	137	if (ifindex == 0 && IN_SET(a->scope, RT_SCOPE_HOST, RT_SCOPE_NOWHERE))
d73c3269	138	continue;
8041b5ba	139
1d050e1e	140	switch (family) {
5502f0d9	141
d1ca51b1	142	case AF_INET:
1c4baffc	143	r = sd_netlink_message_read_in_addr(m, IFA_LOCAL, &a->address.in);
d1ca51b1	144	if (r < 0) {
1c4baffc	145	r = sd_netlink_message_read_in_addr(m, IFA_ADDRESS, &a->address.in);
d1ca51b1 TG	146	if (r < 0)
	147	continue;
	148	}
	149	break;
5502f0d9	150
d1ca51b1	151	case AF_INET6:
1c4baffc	152	r = sd_netlink_message_read_in6_addr(m, IFA_LOCAL, &a->address.in6);
d1ca51b1	153	if (r < 0) {
1c4baffc	154	r = sd_netlink_message_read_in6_addr(m, IFA_ADDRESS, &a->address.in6);
d1ca51b1 TG	155	if (r < 0)
	156	continue;
	157	}
	158	break;
5502f0d9	159
d1ca51b1	160	default:
d73c3269	161	continue;
d73c3269	162	}
8041b5ba	163
ee8c4568	164	a->ifindex = ifi;
1d050e1e	165	a->family = family;
8041b5ba	166
d1ca51b1	167	n_list++;
5502f0d9	168	};
8041b5ba	169
c3a8c6aa LP	170	if (ret) {
c3a8c6aa LP	171	typesafe_qsort(list, n_list, address_compare);
54e6f97b	172	suppress_duplicates(list, &n_list);
c3a8c6aa LP	173	*ret = TAKE_PTR(list);
c3a8c6aa LP	174	}
e9140aff LP	175
	176	return (int) n_list;
	177	}
	178
bff94a84 YW	179	static int add_local_gateway(
	180	struct local_address **list,
	181	size_t *n_list,
bff94a84 YW	182	int af,
	183	int ifindex,
	184	uint32_t metric,
	185	const RouteVia *via) {
	186
	187	assert(list);
	188	assert(n_list);
bff94a84 YW	189	assert(via);
	190
	191	if (af != AF_UNSPEC && af != via->family)
	192	return 0;
	193
319a4f4b	194	if (!GREEDY_REALLOC(list, n_list + 1))
bff94a84 YW	195	return -ENOMEM;
	196
	197	(list)[(n_list)++] = (struct local_address) {
	198	.ifindex = ifindex,
	199	.metric = metric,
	200	.family = via->family,
	201	.address = via->address,
	202	};
	203
	204	return 0;
	205	}
	206
54e6f97b LP	207	int local_gateways(
	208	sd_netlink *context,
	209	int ifindex,
	210	int af,
	211	struct local_address **ret) {
	212
4afd3348 LP	213	_cleanup_(sd_netlink_message_unrefp) sd_netlink_message req = NULL, reply = NULL;
4afd3348 LP	214	_cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
e9140aff	215	_cleanup_free_ struct local_address *list = NULL;
319a4f4b	216	size_t n_list = 0;
e9140aff LP	217	int r;
e9140aff LP	218
e9140aff	219	if (context)
1c4baffc	220	rtnl = sd_netlink_ref(context);
e9140aff	221	else {
1c4baffc	222	r = sd_netlink_open(&rtnl);
e9140aff LP	223	if (r < 0)
	224	return r;
	225	}
	226
1d050e1e	227	r = sd_rtnl_message_new_route(rtnl, &req, RTM_GETROUTE, af, RTPROT_UNSPEC);
e9140aff LP	228	if (r < 0)
	229	return r;
	230
3e0eeb8e YW	231	r = sd_rtnl_message_route_set_type(req, RTN_UNICAST);
	232	if (r < 0)
	233	return r;
	234
	235	r = sd_rtnl_message_route_set_table(req, RT_TABLE_MAIN);
	236	if (r < 0)
	237	return r;
	238
1c4baffc	239	r = sd_netlink_message_request_dump(req, true);
e9140aff LP	240	if (r < 0)
	241	return r;
	242
1c4baffc	243	r = sd_netlink_call(rtnl, req, 0, &reply);
e9140aff LP	244	if (r < 0)
	245	return r;
	246
bff94a84 YW	247	for (sd_netlink_message *m = reply; m; m = sd_netlink_message_next(m)) {
	248	_cleanup_ordered_set_free_free_ OrderedSet *multipath_routes = NULL;
	249	_cleanup_free_ void *rta_multipath = NULL;
	250	union in_addr_union gateway;
e9140aff	251	uint16_t type;
d1b014df	252	unsigned char dst_len, src_len, table;
d2f4a948	253	uint32_t ifi = 0, metric = 0;
bff94a84	254	size_t rta_len;
1d050e1e	255	int family;
bff94a84	256	RouteVia via;
e9140aff	257
1c4baffc	258	r = sd_netlink_message_get_errno(m);
e9140aff LP	259	if (r < 0)
	260	return r;
	261
1c4baffc	262	r = sd_netlink_message_get_type(m, &type);
e9140aff LP	263	if (r < 0)
e9140aff LP	264	return r;
e9140aff LP	265	if (type != RTM_NEWROUTE)
	266	continue;
	267
a98433c0	268	/* We only care for default routes */
584d0d2a	269	r = sd_rtnl_message_route_get_dst_prefixlen(m, &dst_len);
e9140aff LP	270	if (r < 0)
e9140aff LP	271	return r;
e9140aff LP	272	if (dst_len != 0)
	273	continue;
	274
584d0d2a	275	r = sd_rtnl_message_route_get_src_prefixlen(m, &src_len);
a98433c0 LP	276	if (r < 0)
	277	return r;
	278	if (src_len != 0)
	279	continue;
	280
d1b014df LP	281	r = sd_rtnl_message_route_get_table(m, &table);
	282	if (r < 0)
	283	return r;
	284	if (table != RT_TABLE_MAIN)
	285	continue;
	286
bff94a84 YW	287	r = sd_netlink_message_read_u32(m, RTA_PRIORITY, &metric);
bff94a84 YW	288	if (r < 0 && r != -ENODATA)
e9140aff	289	return r;
e9140aff	290
1d050e1e LP	291	r = sd_rtnl_message_route_get_family(m, &family);
	292	if (r < 0)
	293	return r;
bff94a84	294	if (!IN_SET(family, AF_INET, AF_INET6))
1d050e1e LP	295	continue;
1d050e1e LP	296
bff94a84 YW	297	r = sd_netlink_message_read_u32(m, RTA_OIF, &ifi);
	298	if (r < 0 && r != -ENODATA)
	299	return r;
	300	if (r >= 0) {
	301	if (ifi <= 0)
	302	return -EINVAL;
	303	if (ifindex > 0 && (int) ifi != ifindex)
	304	continue;
e9140aff	305
bff94a84 YW	306	r = netlink_message_read_in_addr_union(m, RTA_GATEWAY, family, &gateway);
	307	if (r < 0 && r != -ENODATA)
	308	return r;
	309	if (r >= 0) {
	310	via.family = family;
	311	via.address = gateway;
319a4f4b	312	r = add_local_gateway(&list, &n_list, af, ifi, metric, &via);
bff94a84 YW	313	if (r < 0)
bff94a84 YW	314	return r;
e9140aff	315
e9140aff	316	continue;
bff94a84	317	}
e9140aff	318
bff94a84	319	if (family != AF_INET)
e9140aff LP	320	continue;
e9140aff LP	321
bff94a84 YW	322	r = sd_netlink_message_read(m, RTA_VIA, sizeof(via), &via);
	323	if (r < 0 && r != -ENODATA)
	324	return r;
	325	if (r >= 0) {
319a4f4b	326	r = add_local_gateway(&list, &n_list, af, ifi, metric, &via);
bff94a84 YW	327	if (r < 0)
	328	return r;
	329
	330	continue;
	331	}
e9140aff LP	332	}
e9140aff LP	333
bff94a84 YW	334	r = sd_netlink_message_read_data(m, RTA_MULTIPATH, &rta_len, &rta_multipath);
	335	if (r < 0 && r != -ENODATA)
	336	return r;
	337	if (r >= 0) {
	338	MultipathRoute *mr;
e9140aff	339
bff94a84 YW	340	r = rtattr_read_nexthop(rta_multipath, rta_len, family, &multipath_routes);
	341	if (r < 0)
	342	return r;
e9140aff	343
bff94a84 YW	344	ORDERED_SET_FOREACH(mr, multipath_routes) {
	345	if (ifindex > 0 && mr->ifindex != ifindex)
	346	continue;
	347
319a4f4b	348	r = add_local_gateway(&list, &n_list, af, ifi, metric, &mr->gateway);
bff94a84 YW	349	if (r < 0)
	350	return r;
	351	}
	352	}
e9140aff LP	353	}
e9140aff LP	354
c3a8c6aa LP	355	if (ret) {
c3a8c6aa LP	356	typesafe_qsort(list, n_list, address_compare);
54e6f97b LP	357	suppress_duplicates(list, &n_list);
	358	*ret = TAKE_PTR(list);
	359	}
	360
	361	return (int) n_list;
	362	}
	363
	364	int local_outbounds(
	365	sd_netlink *context,
	366	int ifindex,
	367	int af,
	368	struct local_address **ret) {
	369
	370	_cleanup_free_ struct local_address list = NULL, gateways = NULL;
319a4f4b	371	size_t n_list = 0;
54e6f97b LP	372	int r, n_gateways;
	373
	374	/* Determines our default outbound addresses, i.e. the "primary" local addresses we use to talk to IP
	375	* addresses behind the default routes. This is still an address of the local host (i.e. this doesn't
	376	* resolve NAT or so), but it's the set of addresses the local IP stack most likely uses to talk to
	377	* other hosts.
	378	*
	379	* This works by connect()ing a SOCK_DGRAM socket to the local gateways, and then reading the IP
	380	* address off the socket that was chosen for the routing decision. */
	381
	382	n_gateways = local_gateways(context, ifindex, af, &gateways);
	383	if (n_gateways < 0)
	384	return n_gateways;
	385	if (n_gateways == 0) {
	386	/* No gateways? Then we have no outbound addresses either. */
	387	if (ret)
	388	*ret = NULL;
	389
	390	return 0;
	391	}
	392
	393	for (int i = 0; i < n_gateways; i++) {
	394	_cleanup_close_ int fd = -1;
	395	union sockaddr_union sa;
	396	socklen_t salen;
	397
	398	fd = socket(gateways[i].family, SOCK_DGRAM\|SOCK_CLOEXEC\|SOCK_NONBLOCK, 0);
	399	if (fd < 0)
	400	return -errno;
	401
	402	switch (gateways[i].family) {
	403
	404	case AF_INET:
	405	sa.in = (struct sockaddr_in) {
	406	.sin_family = AF_INET,
	407	.sin_addr = gateways[i].address.in,
098d42b6 YW	408	.sin_port = htobe16(53), /* doesn't really matter which port we pick —
098d42b6 YW	409	* we just care about the routing decision */
54e6f97b LP	410	};
	411
	412	break;
	413
	414	case AF_INET6:
	415	sa.in6 = (struct sockaddr_in6) {
	416	.sin6_family = AF_INET6,
	417	.sin6_addr = gateways[i].address.in6,
	418	.sin6_port = htobe16(53),
	419	.sin6_scope_id = gateways[i].ifindex,
	420	};
	421
	422	break;
	423
	424	default:
	425	assert_not_reached("Unexpected protocol");
	426	}
	427
	428	/* So ideally we'd just use IP_UNICAST_IF here to pass the ifindex info to the kernel before
	429	* connect()ing, sot that it influences the routing decision. However, on current kernels
	430	* IP_UNICAST_IF doesn't actually influence the routing decision for UDP — which I think
	431	* should probably just be considered a bug. Once that bug is fixed this is the best API to
	432	* use, since it is the most lightweight. */
	433	r = socket_set_unicast_if(fd, gateways[i].family, gateways[i].ifindex);
	434	if (r < 0)
	435	log_debug_errno(r, "Failed to set unicast interface index %i, ignoring: %m", gateways[i].ifindex);
	436
	437	/* We'll also use SO_BINDTOINDEX. This requires CAP_NET_RAW on old kernels, hence there's a
	438	* good chance this fails. Since 5.7 this restriction was dropped and the first
	439	* SO_BINDTOINDEX on a socket may be done without privileges. This one has the benefit of
	440	* really influencing the routing decision, i.e. this one definitely works for us — as long
098d42b6	441	* as we have the privileges for it. */
54e6f97b LP	442	r = socket_bind_to_ifindex(fd, gateways[i].ifindex);
	443	if (r < 0)
	444	log_debug_errno(r, "Failed to bind socket to interface %i, ignoring: %m", gateways[i].ifindex);
	445
	446	/* Let's now connect() to the UDP socket, forcing the kernel to make a routing decision and
	447	* auto-bind the socket. We ignore failures on this, since that failure might happen for a
	448	* multitude of reasons (policy/firewall issues, who knows?) and some of them might be
	449	* after the routing decision and the auto-binding already took place. If so we can still
	450	* make use of the binding and return it. Hence, let's not unnecessarily fail early here: we
	451	* can still easily detect if the auto-binding worked or not, by comparing the bound IP
098d42b6	452	* address with zero — which we do below. */
54e6f97b LP	453	if (connect(fd, &sa.sa, SOCKADDR_LEN(sa)) < 0)
	454	log_debug_errno(errno, "Failed to connect SOCK_DGRAM socket to gateway, ignoring: %m");
	455
	456	/* Let's now read the socket address of the socket. A routing decision should have been
	457	* made. Let's verify that and use the data. */
	458	salen = SOCKADDR_LEN(sa);
	459	if (getsockname(fd, &sa.sa, &salen) < 0)
	460	return -errno;
	461	assert(sa.sa.sa_family == gateways[i].family);
	462	assert(salen == SOCKADDR_LEN(sa));
	463
	464	switch (gateways[i].family) {
	465
	466	case AF_INET:
	467	if (in4_addr_is_null(&sa.in.sin_addr)) /* Auto-binding didn't work. :-( */
	468	continue;
	469
319a4f4b	470	if (!GREEDY_REALLOC(list, n_list+1))
54e6f97b LP	471	return -ENOMEM;
	472
	473	list[n_list++] = (struct local_address) {
	474	.family = gateways[i].family,
	475	.ifindex = gateways[i].ifindex,
	476	.address.in = sa.in.sin_addr,
	477	};
	478
	479	break;
	480
	481	case AF_INET6:
	482	if (in6_addr_is_null(&sa.in6.sin6_addr))
	483	continue;
	484
319a4f4b	485	if (!GREEDY_REALLOC(list, n_list+1))
54e6f97b LP	486	return -ENOMEM;
	487
	488	list[n_list++] = (struct local_address) {
	489	.family = gateways[i].family,
	490	.ifindex = gateways[i].ifindex,
	491	.address.in6 = sa.in6.sin6_addr,
	492	};
	493	break;
	494
	495	default:
	496	assert_not_reached("Unexpected protocol");
	497	}
	498	}
	499
	500	if (ret) {
	501	typesafe_qsort(list, n_list, address_compare);
	502	suppress_duplicates(list, &n_list);
c3a8c6aa LP	503	*ret = TAKE_PTR(list);
c3a8c6aa LP	504	}
d73c3269	505
e80af1bd	506	return (int) n_list;
8041b5ba	507	}