src/network/networkd-routing-policy-rule.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <net/if.h>
   4 #include <linux/fib_rules.h>
   5
   6 #include "alloc-util.h"
   7 #include "conf-parser.h"
   8 #include "fileio.h"
   9 #include "networkd-routing-policy-rule.h"
  10 #include "netlink-util.h"
  11 #include "networkd-manager.h"
  12 #include "parse-util.h"
  13 #include "socket-util.h"
  14 #include "string-util.h"
  15
  16 int routing_policy_rule_new(RoutingPolicyRule **ret) {
  17         RoutingPolicyRule *rule;
  18
  19         rule = new0(RoutingPolicyRule, 1);
  20         if (!rule)
  21                 return -ENOMEM;
  22
  23         rule->family = AF_INET;
  24         rule->table = RT_TABLE_MAIN;
  25
  26         *ret = rule;
  27         return 0;
  28 }
  29
  30 void routing_policy_rule_free(RoutingPolicyRule *rule) {
  31
  32         if (!rule)
  33                 return;
  34
  35         if (rule->network) {
  36                 LIST_REMOVE(rules, rule->network->rules, rule);
  37                 assert(rule->network->n_rules > 0);
  38                 rule->network->n_rules--;
  39
  40                 if (rule->section) {
  41                         hashmap_remove(rule->network->rules_by_section, rule->section);
  42                         network_config_section_free(rule->section);
  43                 }
  44
  45         }
  46
  47         if (rule->manager) {
  48                 set_remove(rule->manager->rules, rule);
  49                 set_remove(rule->manager->rules_foreign, rule);
  50         }
  51
  52         free(rule->iif);
  53         free(rule->oif);
  54         free(rule);
  55 }
  56
  57 static void routing_policy_rule_hash_func(const void *b, struct siphash *state) {
  58         const RoutingPolicyRule *rule = b;
  59
  60         assert(rule);
  61
  62         siphash24_compress(&rule->family, sizeof(rule->family), state);
  63
  64         switch (rule->family) {
  65         case AF_INET:
  66         case AF_INET6:
  67
  68                 siphash24_compress(&rule->from, FAMILY_ADDRESS_SIZE(rule->family), state);
  69                 siphash24_compress(&rule->from_prefixlen, sizeof(rule->from_prefixlen), state);
  70
  71                 siphash24_compress(&rule->to, FAMILY_ADDRESS_SIZE(rule->family), state);
  72                 siphash24_compress(&rule->to_prefixlen, sizeof(rule->to_prefixlen), state);
  73
  74                 siphash24_compress(&rule->tos, sizeof(rule->tos), state);
  75                 siphash24_compress(&rule->fwmark, sizeof(rule->fwmark), state);
  76                 siphash24_compress(&rule->table, sizeof(rule->table), state);
  77
  78                 if (rule->iif)
  79                         siphash24_compress(&rule->iif, strlen(rule->iif), state);
  80
  81                 if (rule->oif)
  82                         siphash24_compress(&rule->oif, strlen(rule->oif), state);
  83
  84                 break;
  85         default:
  86                 /* treat any other address family as AF_UNSPEC */
  87                 break;
  88         }
  89 }
  90
  91 static int routing_policy_rule_compare_func(const void *_a, const void *_b) {
  92         const RoutingPolicyRule *a = _a, *b = _b;
  93         int r;
  94
  95         r = CMP(a->family, b->family);
  96         if (r != 0)
  97                 return r;
  98
  99         switch (a->family) {
 100         case AF_INET:
 101         case AF_INET6:
 102                 r = CMP(a->from_prefixlen, b->from_prefixlen);
 103                 if (r != 0)
 104                         return r;
 105
 106                 r = CMP(a->to_prefixlen, b->to_prefixlen);
 107                 if (r != 0)
 108                         return r;
 109
 110                 r = CMP(a->tos, b->tos);
 111                 if (r != 0)
 112                         return r;
 113
 114                 r = CMP(a->fwmask, b->fwmask);
 115                 if (r != 0)
 116                         return r;
 117
 118                 r = CMP(a->table, b->table);
 119                 if (r != 0)
 120                         return r;
 121
 122                 r = strcmp_ptr(a->iif, b->iif);
 123                 if (!r)
 124                         return r;
 125
 126                 r = strcmp_ptr(a->oif, b->oif);
 127                 if (!r)
 128                         return r;
 129
 130                 r = memcmp(&a->from, &b->from, FAMILY_ADDRESS_SIZE(a->family));
 131                 if (r != 0)
 132                         return r;
 133
 134                 return memcmp(&a->to, &b->to, FAMILY_ADDRESS_SIZE(a->family));
 135
 136         default:
 137                 /* treat any other address family as AF_UNSPEC */
 138                 return 0;
 139         }
 140 }
 141
 142 const struct hash_ops routing_policy_rule_hash_ops = {
 143         .hash = routing_policy_rule_hash_func,
 144         .compare = routing_policy_rule_compare_func
 145 };
 146
 147 int routing_policy_rule_get(Manager *m,
 148                             int family,
 149                             const union in_addr_union *from,
 150                             uint8_t from_prefixlen,
 151                             const union in_addr_union *to,
 152                             uint8_t to_prefixlen,
 153                             uint8_t tos,
 154                             uint32_t fwmark,
 155                             uint32_t table,
 156                             char *iif,
 157                             char *oif,
 158                             RoutingPolicyRule **ret) {
 159
 160         RoutingPolicyRule rule, *existing;
 161
 162         assert_return(m, -1);
 163
 164         rule = (RoutingPolicyRule) {
 165                 .family = family,
 166                 .from = *from,
 167                 .from_prefixlen = from_prefixlen,
 168                 .to = *to,
 169                 .to_prefixlen = to_prefixlen,
 170                 .tos = tos,
 171                 .fwmark = fwmark,
 172                 .table = table,
 173                 .iif = iif,
 174                 .oif = oif
 175         };
 176
 177         if (m->rules) {
 178                 existing = set_get(m->rules, &rule);
 179                 if (existing) {
 180                         if (ret)
 181                                 *ret = existing;
 182                         return 1;
 183                 }
 184         }
 185
 186         if (m->rules_foreign) {
 187                 existing = set_get(m->rules_foreign, &rule);
 188                 if (existing) {
 189                         if (ret)
 190                                 *ret = existing;
 191                         return 1;
 192                 }
 193         }
 194
 195         return -ENOENT;
 196 }
 197
 198 int routing_policy_rule_make_local(Manager *m, RoutingPolicyRule *rule) {
 199         int r;
 200
 201         assert(m);
 202
 203         if (set_contains(m->rules_foreign, rule)) {
 204                 set_remove(m->rules_foreign, rule);
 205
 206                 r = set_ensure_allocated(&m->rules, &routing_policy_rule_hash_ops);
 207                 if (r < 0)
 208                         return r;
 209
 210                 return set_put(m->rules, rule);
 211         }
 212
 213         return -ENOENT;
 214 }
 215
 216 static int routing_policy_rule_add_internal(Manager *m,
 217                                             Set **rules,
 218                                             int family,
 219                                             const union in_addr_union *from,
 220                                             uint8_t from_prefixlen,
 221                                             const union in_addr_union *to,
 222                                             uint8_t to_prefixlen,
 223                                             uint8_t tos,
 224                                             uint32_t fwmark,
 225                                             uint32_t table,
 226                                             char *iif,
 227                                             char *oif,
 228                                             RoutingPolicyRule **ret) {
 229
 230         _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *rule = NULL;
 231         int r;
 232
 233         assert_return(rules, -EINVAL);
 234
 235         r = routing_policy_rule_new(&rule);
 236         if (r < 0)
 237                 return r;
 238
 239         rule->manager = m;
 240         rule->family = family;
 241         rule->from = *from;
 242         rule->from_prefixlen = from_prefixlen;
 243         rule->to = *to;
 244         rule->to_prefixlen = to_prefixlen;
 245         rule->tos = tos;
 246         rule->fwmark = fwmark;
 247         rule->table = table;
 248         rule->iif = iif;
 249         rule->oif = oif;
 250
 251         r = set_ensure_allocated(rules, &routing_policy_rule_hash_ops);
 252         if (r < 0)
 253                 return r;
 254
 255         r = set_put(*rules, rule);
 256         if (r < 0)
 257                 return r;
 258
 259         if (ret)
 260                 *ret = rule;
 261
 262         rule = NULL;
 263
 264         return 0;
 265 }
 266
 267 int routing_policy_rule_add(Manager *m,
 268                             int family,
 269                             const union in_addr_union *from,
 270                             uint8_t from_prefixlen,
 271                             const union in_addr_union *to,
 272                             uint8_t to_prefixlen,
 273                             uint8_t tos,
 274                             uint32_t fwmark,
 275                             uint32_t table,
 276                             char *iif,
 277                             char *oif,
 278                             RoutingPolicyRule **ret) {
 279
 280         return routing_policy_rule_add_internal(m, &m->rules, family, from, from_prefixlen, to, to_prefixlen, tos, fwmark, table, iif, oif, ret);
 281 }
 282
 283 int routing_policy_rule_add_foreign(Manager *m,
 284                                     int family,
 285                                     const union in_addr_union *from,
 286                                     uint8_t from_prefixlen,
 287                                     const union in_addr_union *to,
 288                                     uint8_t to_prefixlen,
 289                                     uint8_t tos,
 290                                     uint32_t fwmark,
 291                                     uint32_t table,
 292                                     char *iif,
 293                                     char *oif,
 294                                     RoutingPolicyRule **ret) {
 295         return routing_policy_rule_add_internal(m, &m->rules_foreign, family, from, from_prefixlen, to, to_prefixlen, tos, fwmark, table, iif, oif, ret);
 296 }
 297
 298 static int routing_policy_rule_remove_handler(sd_netlink *rtnl, sd_netlink_message *m, void *userdata) {
 299         _cleanup_(link_unrefp) Link *link = userdata;
 300         int r;
 301
 302         assert(m);
 303         assert(link);
 304         assert(link->ifname);
 305
 306         link->routing_policy_rule_remove_messages--;
 307
 308         if (IN_SET(link->state, LINK_STATE_FAILED, LINK_STATE_LINGER))
 309                 return 1;
 310
 311         r = sd_netlink_message_get_errno(m);
 312         if (r < 0)
 313                 log_link_warning_errno(link, r, "Could not drop routing policy rule: %m");
 314
 315         return 1;
 316 }
 317
 318 int routing_policy_rule_remove(RoutingPolicyRule *routing_policy_rule, Link *link, sd_netlink_message_handler_t callback) {
 319         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 320         int r;
 321
 322         assert(routing_policy_rule);
 323         assert(link);
 324         assert(link->manager);
 325         assert(link->manager->rtnl);
 326         assert(link->ifindex > 0);
 327         assert(IN_SET(routing_policy_rule->family, AF_INET, AF_INET6));
 328
 329         r = sd_rtnl_message_new_routing_policy_rule(link->manager->rtnl, &m, RTM_DELRULE, routing_policy_rule->family);
 330         if (r < 0)
 331                 return log_error_errno(r, "Could not allocate RTM_DELRULE message: %m");
 332
 333         if (!in_addr_is_null(routing_policy_rule->family, &routing_policy_rule->from)) {
 334                 if (routing_policy_rule->family == AF_INET)
 335                         r = sd_netlink_message_append_in_addr(m, FRA_SRC, &routing_policy_rule->from.in);
 336                 else
 337                         r = sd_netlink_message_append_in6_addr(m, FRA_SRC, &routing_policy_rule->from.in6);
 338
 339                 if (r < 0)
 340                         return log_error_errno(r, "Could not append FRA_SRC attribute: %m");
 341
 342                 r = sd_rtnl_message_routing_policy_rule_set_rtm_src_prefixlen(m, routing_policy_rule->from_prefixlen);
 343                 if (r < 0)
 344                         return log_error_errno(r, "Could not set source prefix length: %m");
 345         }
 346
 347         if (!in_addr_is_null(routing_policy_rule->family, &routing_policy_rule->to)) {
 348                 if (routing_policy_rule->family == AF_INET)
 349                         r = sd_netlink_message_append_in_addr(m, FRA_DST, &routing_policy_rule->to.in);
 350                 else
 351                         r = sd_netlink_message_append_in6_addr(m, FRA_DST, &routing_policy_rule->to.in6);
 352
 353                 if (r < 0)
 354                         return log_error_errno(r, "Could not append FRA_DST attribute: %m");
 355
 356                 r = sd_rtnl_message_routing_policy_rule_set_rtm_dst_prefixlen(m, routing_policy_rule->to_prefixlen);
 357                 if (r < 0)
 358                         return log_error_errno(r, "Could not set destination prefix length: %m");
 359         }
 360
 361         r = sd_netlink_call_async(link->manager->rtnl, m, callback, link, 0, NULL);
 362         if (r < 0)
 363                 return log_error_errno(r, "Could not send rtnetlink message: %m");
 364
 365         link_ref(link);
 366
 367         return 0;
 368 }
 369
 370 static int routing_policy_rule_new_static(Network *network, const char *filename, unsigned section_line, RoutingPolicyRule **ret) {
 371         _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *rule = NULL;
 372         _cleanup_(network_config_section_freep) NetworkConfigSection *n = NULL;
 373         int r;
 374
 375         assert(network);
 376         assert(ret);
 377         assert(!!filename == (section_line > 0));
 378
 379         r = network_config_section_new(filename, section_line, &n);
 380         if (r < 0)
 381                 return r;
 382
 383         rule = hashmap_get(network->rules_by_section, n);
 384         if (rule) {
 385                 *ret = TAKE_PTR(rule);
 386
 387                 return 0;
 388         }
 389
 390         r = routing_policy_rule_new(&rule);
 391         if (r < 0)
 392                 return r;
 393
 394         rule->section = n;
 395         rule->network = network;
 396         n = NULL;
 397
 398         r = hashmap_put(network->rules_by_section, rule->section, rule);
 399         if (r < 0)
 400                 return r;
 401
 402         LIST_APPEND(rules, network->rules, rule);
 403         network->n_rules++;
 404
 405         *ret = TAKE_PTR(rule);
 406
 407         return 0;
 408 }
 409
 410 int link_routing_policy_rule_handler(sd_netlink *rtnl, sd_netlink_message *m, void *userdata) {
 411         _cleanup_(link_unrefp) Link *link = userdata;
 412         int r;
 413
 414         assert(rtnl);
 415         assert(m);
 416         assert(link);
 417         assert(link->ifname);
 418         assert(link->routing_policy_rule_messages > 0);
 419
 420         link->routing_policy_rule_messages--;
 421
 422         if (IN_SET(link->state, LINK_STATE_FAILED, LINK_STATE_LINGER))
 423                 return 1;
 424
 425         r = sd_netlink_message_get_errno(m);
 426         if (r < 0 && r != -EEXIST)
 427                 log_link_warning_errno(link, r, "Could not add routing policy rule: %m");
 428
 429         if (link->routing_policy_rule_messages == 0) {
 430                 log_link_debug(link, "Routing policy rule configured");
 431                 link->routing_policy_rules_configured = true;
 432                 link_check_ready(link);
 433         }
 434
 435         return 1;
 436 }
 437
 438 int routing_policy_rule_configure(RoutingPolicyRule *rule, Link *link, sd_netlink_message_handler_t callback, bool update) {
 439         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 440         int r;
 441
 442         assert(rule);
 443         assert(link);
 444         assert(link->ifindex > 0);
 445         assert(link->manager);
 446         assert(link->manager->rtnl);
 447
 448         r = sd_rtnl_message_new_routing_policy_rule(link->manager->rtnl, &m, RTM_NEWRULE, rule->family);
 449         if (r < 0)
 450                 return log_error_errno(r, "Could not allocate RTM_NEWRULE message: %m");
 451
 452         if (!in_addr_is_null(rule->family, &rule->from)) {
 453                 if (rule->family == AF_INET)
 454                         r = sd_netlink_message_append_in_addr(m, FRA_SRC, &rule->from.in);
 455                 else
 456                         r = sd_netlink_message_append_in6_addr(m, FRA_SRC, &rule->from.in6);
 457
 458                 if (r < 0)
 459                         return log_error_errno(r, "Could not append FRA_SRC attribute: %m");
 460
 461                 r = sd_rtnl_message_routing_policy_rule_set_rtm_src_prefixlen(m, rule->from_prefixlen);
 462                 if (r < 0)
 463                         return log_error_errno(r, "Could not set source prefix length: %m");
 464         }
 465
 466         if (!in_addr_is_null(rule->family, &rule->to)) {
 467                 if (rule->family == AF_INET)
 468                         r = sd_netlink_message_append_in_addr(m, FRA_DST, &rule->to.in);
 469                 else
 470                         r = sd_netlink_message_append_in6_addr(m, FRA_DST, &rule->to.in6);
 471
 472                 if (r < 0)
 473                         return log_error_errno(r, "Could not append FRA_DST attribute: %m");
 474
 475                 r = sd_rtnl_message_routing_policy_rule_set_rtm_dst_prefixlen(m, rule->to_prefixlen);
 476                 if (r < 0)
 477                         return log_error_errno(r, "Could not set destination prefix length: %m");
 478         }
 479
 480         r = sd_netlink_message_append_u32(m, FRA_PRIORITY, rule->priority);
 481         if (r < 0)
 482                 return log_error_errno(r, "Could not append FRA_PRIORITY attribute: %m");
 483
 484         if (rule->tos > 0) {
 485                 r = sd_rtnl_message_routing_policy_rule_set_tos(m, rule->tos);
 486                 if (r < 0)
 487                         return log_error_errno(r, "Could not set ip rule tos: %m");
 488         }
 489
 490         if (rule->table < 256) {
 491                 r = sd_rtnl_message_routing_policy_rule_set_table(m, rule->table);
 492                 if (r < 0)
 493                         return log_error_errno(r, "Could not set ip rule table: %m");
 494         } else {
 495                 r = sd_rtnl_message_routing_policy_rule_set_table(m, RT_TABLE_UNSPEC);
 496                 if (r < 0)
 497                         return log_error_errno(r, "Could not set ip rule table: %m");
 498
 499                 r = sd_netlink_message_append_u32(m, FRA_TABLE, rule->table);
 500                 if (r < 0)
 501                         return log_error_errno(r, "Could not append FRA_TABLE attribute: %m");
 502         }
 503
 504         if (rule->fwmark > 0) {
 505                 r = sd_netlink_message_append_u32(m, FRA_FWMARK, rule->fwmark);
 506                 if (r < 0)
 507                         return log_error_errno(r, "Could not append FRA_FWMARK attribute: %m");
 508         }
 509
 510         if (rule->fwmask > 0) {
 511                 r = sd_netlink_message_append_u32(m, FRA_FWMASK, rule->fwmask);
 512                 if (r < 0)
 513                         return log_error_errno(r, "Could not append FRA_FWMASK attribute: %m");
 514         }
 515
 516         if (rule->iif) {
 517                 r = sd_netlink_message_append_string(m, FRA_IFNAME, rule->iif);
 518                 if (r < 0)
 519                         return log_error_errno(r, "Could not append FRA_IFNAME attribute: %m");
 520         }
 521
 522         if (rule->oif) {
 523                 r = sd_netlink_message_append_string(m, FRA_OIFNAME, rule->oif);
 524                 if (r < 0)
 525                         return log_error_errno(r, "Could not append FRA_OIFNAME attribute: %m");
 526         }
 527
 528         rule->link = link;
 529
 530         r = sd_netlink_call_async(link->manager->rtnl, m, callback, link, 0, NULL);
 531         if (r < 0)
 532                 return log_error_errno(r, "Could not send rtnetlink message: %m");
 533
 534         link_ref(link);
 535
 536         r = routing_policy_rule_add(link->manager, rule->family, &rule->from, rule->from_prefixlen, &rule->to,
 537                                     rule->to_prefixlen, rule->tos, rule->fwmark, rule->table, rule->iif, rule->oif, NULL);
 538         if (r < 0)
 539                 return log_error_errno(r, "Could not add rule : %m");
 540
 541         return 0;
 542 }
 543
 544 static int parse_fwmark_fwmask(const char *s, uint32_t *fwmark, uint32_t *fwmask) {
 545         _cleanup_free_ char *f = NULL;
 546         char *p;
 547         int r;
 548
 549         assert(s);
 550
 551         f = strdup(s);
 552         if (!f)
 553                 return -ENOMEM;
 554
 555         p = strchr(f, '/');
 556         if (p)
 557                 *p++ = '\0';
 558
 559         r = safe_atou32(f, fwmark);
 560         if (r < 0)
 561                 return log_error_errno(r, "Failed to parse RPDB rule firewall mark, ignoring: %s", f);
 562
 563         if (p) {
 564                 r = safe_atou32(p, fwmask);
 565                 if (r < 0)
 566                         return log_error_errno(r, "Failed to parse RPDB rule mask, ignoring: %s", f);
 567         }
 568
 569         return 0;
 570 }
 571
 572 int config_parse_routing_policy_rule_tos(
 573                 const char *unit,
 574                 const char *filename,
 575                 unsigned line,
 576                 const char *section,
 577                 unsigned section_line,
 578                 const char *lvalue,
 579                 int ltype,
 580                 const char *rvalue,
 581                 void *data,
 582                 void *userdata) {
 583
 584         _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *n = NULL;
 585         Network *network = userdata;
 586         int r;
 587
 588         assert(filename);
 589         assert(section);
 590         assert(lvalue);
 591         assert(rvalue);
 592         assert(data);
 593
 594         r = routing_policy_rule_new_static(network, filename, section_line, &n);
 595         if (r < 0)
 596                 return r;
 597
 598         r = safe_atou8(rvalue, &n->tos);
 599         if (r < 0) {
 600                 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse RPDB rule tos, ignoring: %s", rvalue);
 601                 return 0;
 602         }
 603
 604         n = NULL;
 605
 606         return 0;
 607 }
 608
 609 int config_parse_routing_policy_rule_priority(
 610                 const char *unit,
 611                 const char *filename,
 612                 unsigned line,
 613                 const char *section,
 614                 unsigned section_line,
 615                 const char *lvalue,
 616                 int ltype,
 617                 const char *rvalue,
 618                 void *data,
 619                 void *userdata) {
 620
 621         _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *n = NULL;
 622         Network *network = userdata;
 623         int r;
 624
 625         assert(filename);
 626         assert(section);
 627         assert(lvalue);
 628         assert(rvalue);
 629         assert(data);
 630
 631         r = routing_policy_rule_new_static(network, filename, section_line, &n);
 632         if (r < 0)
 633                 return r;
 634
 635         r = safe_atou32(rvalue, &n->priority);
 636         if (r < 0) {
 637                 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse RPDB rule priority, ignoring: %s", rvalue);
 638                 return 0;
 639         }
 640
 641         n = NULL;
 642
 643         return 0;
 644 }
 645
 646 int config_parse_routing_policy_rule_table(
 647                 const char *unit,
 648                 const char *filename,
 649                 unsigned line,
 650                 const char *section,
 651                 unsigned section_line,
 652                 const char *lvalue,
 653                 int ltype,
 654                 const char *rvalue,
 655                 void *data,
 656                 void *userdata) {
 657
 658         _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *n = NULL;
 659         Network *network = userdata;
 660         int r;
 661
 662         assert(filename);
 663         assert(section);
 664         assert(lvalue);
 665         assert(rvalue);
 666         assert(data);
 667
 668         r = routing_policy_rule_new_static(network, filename, section_line, &n);
 669         if (r < 0)
 670                 return r;
 671
 672         r = safe_atou32(rvalue, &n->table);
 673         if (r < 0) {
 674                 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse RPDB rule table, ignoring: %s", rvalue);
 675                 return 0;
 676         }
 677
 678         n = NULL;
 679
 680         return 0;
 681 }
 682
 683 int config_parse_routing_policy_rule_fwmark_mask(
 684                 const char *unit,
 685                 const char *filename,
 686                 unsigned line,
 687                 const char *section,
 688                 unsigned section_line,
 689                 const char *lvalue,
 690                 int ltype,
 691                 const char *rvalue,
 692                 void *data,
 693                 void *userdata) {
 694
 695         _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *n = NULL;
 696         Network *network = userdata;
 697         int r;
 698
 699         assert(filename);
 700         assert(section);
 701         assert(lvalue);
 702         assert(rvalue);
 703         assert(data);
 704
 705         r = routing_policy_rule_new_static(network, filename, section_line, &n);
 706         if (r < 0)
 707                 return r;
 708
 709         r = parse_fwmark_fwmask(rvalue, &n->fwmark, &n->fwmask);
 710         if (r < 0) {
 711                 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse RPDB rule firewall mark or mask, ignoring: %s", rvalue);
 712                 return 0;
 713         }
 714
 715         n = NULL;
 716
 717         return 0;
 718 }
 719
 720 int config_parse_routing_policy_rule_prefix(
 721                 const char *unit,
 722                 const char *filename,
 723                 unsigned line,
 724                 const char *section,
 725                 unsigned section_line,
 726                 const char *lvalue,
 727                 int ltype,
 728                 const char *rvalue,
 729                 void *data,
 730                 void *userdata) {
 731
 732         _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *n = NULL;
 733         Network *network = userdata;
 734         union in_addr_union buffer;
 735         uint8_t prefixlen;
 736         int r;
 737
 738         assert(filename);
 739         assert(section);
 740         assert(lvalue);
 741         assert(rvalue);
 742         assert(data);
 743
 744         r = routing_policy_rule_new_static(network, filename, section_line, &n);
 745         if (r < 0)
 746                 return r;
 747
 748         r = in_addr_prefix_from_string(rvalue, AF_INET, &buffer, &prefixlen);
 749         if (r < 0) {
 750                 r = in_addr_prefix_from_string(rvalue, AF_INET6, &buffer, &prefixlen);
 751                 if (r < 0) {
 752                         log_syntax(unit, LOG_ERR, filename, line, r, "RPDB rule prefix is invalid, ignoring assignment: %s", rvalue);
 753                         return 0;
 754                 }
 755
 756                 n->family = AF_INET6;
 757         } else
 758                 n->family = AF_INET;
 759
 760         if (streq(lvalue, "To")) {
 761                 n->to = buffer;
 762                 n->to_prefixlen = prefixlen;
 763         } else {
 764                 n->from = buffer;
 765                 n->from_prefixlen = prefixlen;
 766         }
 767
 768         n = NULL;
 769
 770         return 0;
 771 }
 772
 773 int config_parse_routing_policy_rule_device(
 774                 const char *unit,
 775                 const char *filename,
 776                 unsigned line,
 777                 const char *section,
 778                 unsigned section_line,
 779                 const char *lvalue,
 780                 int ltype,
 781                 const char *rvalue,
 782                 void *data,
 783                 void *userdata) {
 784
 785         _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *n = NULL;
 786         Network *network = userdata;
 787         int r;
 788
 789         assert(filename);
 790         assert(section);
 791         assert(lvalue);
 792         assert(rvalue);
 793         assert(data);
 794
 795         r = routing_policy_rule_new_static(network, filename, section_line, &n);
 796         if (r < 0)
 797                 return r;
 798
 799         if (!ifname_valid(rvalue)) {
 800                 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse '%s' interface name, ignoring: %s", lvalue, rvalue);
 801                 return 0;
 802         }
 803
 804         if (streq(lvalue, "IncomingInterface")) {
 805                 r = free_and_strdup(&n->iif, rvalue);
 806                 if (r < 0)
 807                         return log_oom();
 808         } else {
 809                 r = free_and_strdup(&n->oif, rvalue);
 810                 if (r < 0)
 811                         return log_oom();
 812         }
 813
 814         n = NULL;
 815
 816         return 0;
 817 }
 818
 819 static int routing_policy_rule_read_full_file(const char *state_file, char **ret) {
 820         _cleanup_free_ char *s = NULL;
 821         size_t size;
 822         int r;
 823
 824         assert(state_file);
 825
 826         r = read_full_file(state_file, &s, &size);
 827         if (r == -ENOENT)
 828                 return -ENODATA;
 829         if (r < 0)
 830                 return r;
 831         if (size <= 0)
 832                 return -ENODATA;
 833
 834         *ret = TAKE_PTR(s);
 835
 836         return size;
 837 }
 838
 839 int routing_policy_serialize_rules(Set *rules, FILE *f) {
 840         RoutingPolicyRule *rule = NULL;
 841         Iterator i;
 842         int r;
 843
 844         assert(f);
 845
 846         SET_FOREACH(rule, rules, i) {
 847                 _cleanup_free_ char *from_str = NULL, *to_str = NULL;
 848                 bool space = false;
 849
 850                 fputs("RULE=", f);
 851
 852                 if (!in_addr_is_null(rule->family, &rule->from)) {
 853                         r = in_addr_to_string(rule->family, &rule->from, &from_str);
 854                         if (r < 0)
 855                                 return r;
 856
 857                         fprintf(f, "from=%s/%hhu",
 858                                 from_str, rule->from_prefixlen);
 859                         space = true;
 860                 }
 861
 862                 if (!in_addr_is_null(rule->family, &rule->to)) {
 863                         r = in_addr_to_string(rule->family, &rule->to, &to_str);
 864                         if (r < 0)
 865                                 return r;
 866
 867                         fprintf(f, "%sto=%s/%hhu",
 868                                 space ? " " : "",
 869                                 to_str, rule->to_prefixlen);
 870                         space = true;
 871                 }
 872
 873                 if (rule->tos != 0) {
 874                         fprintf(f, "%stos=%hhu",
 875                                 space ? " " : "",
 876                                 rule->tos);
 877                         space = true;
 878                 }
 879
 880                 if (rule->fwmark != 0) {
 881                         fprintf(f, "%sfwmark=%"PRIu32"/%"PRIu32,
 882                                 space ? " " : "",
 883                                 rule->fwmark, rule->fwmask);
 884                         space = true;
 885                 }
 886
 887                 if (rule->iif) {
 888                         fprintf(f, "%siif=%s",
 889                                 space ? " " : "",
 890                                 rule->iif);
 891                         space = true;
 892                 }
 893
 894                 if (rule->oif) {
 895                         fprintf(f, "%soif=%s",
 896                                 space ? " " : "",
 897                                 rule->oif);
 898                         space = true;
 899                 }
 900
 901                 fprintf(f, "%stable=%"PRIu32 "\n",
 902                         space ? " " : "",
 903                         rule->table);
 904         }
 905
 906         return 0;
 907 }
 908
 909 int routing_policy_load_rules(const char *state_file, Set **rules) {
 910         _cleanup_strv_free_ char **l = NULL;
 911         _cleanup_free_ char *data = NULL;
 912         const char *p;
 913         char **i;
 914         int r;
 915
 916         assert(state_file);
 917         assert(rules);
 918
 919         r = routing_policy_rule_read_full_file(state_file, &data);
 920         if (r <= 0)
 921                 return r;
 922
 923         l = strv_split_newlines(data);
 924         if (!l)
 925                 return -ENOMEM;
 926
 927         r = set_ensure_allocated(rules, &routing_policy_rule_hash_ops);
 928         if (r < 0)
 929                 return r;
 930
 931         STRV_FOREACH(i, l) {
 932                 _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *rule = NULL;
 933
 934                 p = startswith(*i, "RULE=");
 935                 if (!p)
 936                         continue;
 937
 938                 r = routing_policy_rule_new(&rule);
 939                 if (r < 0)
 940                         return r;
 941
 942                 for (;;) {
 943                         _cleanup_free_ char *word = NULL, *a = NULL, *b = NULL;
 944                         union in_addr_union buffer;
 945                         uint8_t prefixlen;
 946
 947                         r = extract_first_word(&p, &word, NULL, 0);
 948                         if (r < 0)
 949                                 return r;
 950                         if (r == 0)
 951                                 break;
 952
 953                         r = split_pair(word, "=", &a, &b);
 954                         if (r < 0)
 955                                 continue;
 956
 957                         if (STR_IN_SET(a, "from", "to")) {
 958
 959                                 r = in_addr_prefix_from_string(b, AF_INET, &buffer, &prefixlen);
 960                                 if (r < 0) {
 961                                         r = in_addr_prefix_from_string(b, AF_INET6, &buffer, &prefixlen);
 962                                         if (r < 0) {
 963                                                 log_error_errno(r, "RPDB rule prefix is invalid, ignoring assignment: %s", b);
 964                                                 continue;
 965                                         }
 966
 967                                         rule->family = AF_INET6;
 968                                 } else
 969                                         rule->family = AF_INET;
 970
 971                                 if (streq(a, "to")) {
 972                                         rule->to = buffer;
 973                                         rule->to_prefixlen = prefixlen;
 974                                 } else {
 975                                         rule->from = buffer;
 976                                         rule->from_prefixlen = prefixlen;
 977                                 }
 978                         } else if (streq(a, "tos")) {
 979                                 r = safe_atou8(b, &rule->tos);
 980                                 if (r < 0) {
 981                                         log_error_errno(r, "Failed to parse RPDB rule tos, ignoring: %s", b);
 982                                         continue;
 983                                 }
 984                         } else if (streq(a, "table")) {
 985                                 r = safe_atou32(b, &rule->table);
 986                                 if (r < 0) {
 987                                         log_error_errno(r, "Failed to parse RPDB rule table, ignoring: %s", b);
 988                                         continue;
 989                                 }
 990                         } else if (streq(a, "fwmark")) {
 991
 992                                 r = parse_fwmark_fwmask(b, &rule->fwmark, &rule->fwmask);
 993                                 if (r < 0) {
 994                                         log_error_errno(r, "Failed to parse RPDB rule firewall mark or mask, ignoring: %s", a);
 995                                         continue;
 996                                 }
 997                         } else if (streq(a, "iif")) {
 998
 999                                 if (free_and_strdup(&rule->iif, b) < 0)
1000                                         return log_oom();
1001
1002                         } else if (streq(a, "oif")) {
1003
1004                                 if (free_and_strdup(&rule->oif, b) < 0)
1005                                         return log_oom();
1006                         }
1007                 }
1008
1009                 r = set_put(*rules, rule);
1010                 if (r < 0) {
1011                         log_warning_errno(r, "Failed to add RPDB rule to saved DB, ignoring: %s", p);
1012                         continue;
1013                 }
1014
1015                 rule = NULL;
1016         }
1017
1018         return 0;
1019 }
1020
1021 void routing_policy_rule_purge(Manager *m, Link *link) {
1022         RoutingPolicyRule *rule, *existing;
1023         Iterator i;
1024         int r;
1025
1026         assert(m);
1027         assert(link);
1028
1029         SET_FOREACH(rule, m->rules_saved, i) {
1030                 existing = set_get(m->rules_foreign, rule);
1031                 if (existing) {
1032
1033                         r = routing_policy_rule_remove(rule, link, routing_policy_rule_remove_handler);
1034                         if (r < 0) {
1035                                 log_warning_errno(r, "Could not remove routing policy rules: %m");
1036                                 continue;
1037                         }
1038
1039                         link->routing_policy_rule_remove_messages++;
1040                 }
1041         }
1042 }