src/nspawn/nspawn-expose-ports.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include "sd-netlink.h"
   4
   5 #include "alloc-util.h"
   6 #include "fd-util.h"
   7 #include "firewall-util.h"
   8 #include "in-addr-util.h"
   9 #include "local-addresses.h"
  10 #include "netlink-util.h"
  11 #include "nspawn-expose-ports.h"
  12 #include "parse-util.h"
  13 #include "socket-util.h"
  14 #include "string-util.h"
  15 #include "util.h"
  16
  17 int expose_port_parse(ExposePort **l, const char *s) {
  18
  19         const char *split, *e;
  20         uint16_t container_port, host_port;
  21         int protocol;
  22         ExposePort *p;
  23         int r;
  24
  25         assert(l);
  26         assert(s);
  27
  28         if ((e = startswith(s, "tcp:")))
  29                 protocol = IPPROTO_TCP;
  30         else if ((e = startswith(s, "udp:")))
  31                 protocol = IPPROTO_UDP;
  32         else {
  33                 e = s;
  34                 protocol = IPPROTO_TCP;
  35         }
  36
  37         split = strchr(e, ':');
  38         if (split) {
  39                 char v[split - e + 1];
  40
  41                 memcpy(v, e, split - e);
  42                 v[split - e] = 0;
  43
  44                 r = parse_ip_port(v, &host_port);
  45                 if (r < 0)
  46                         return -EINVAL;
  47
  48                 r = parse_ip_port(split + 1, &container_port);
  49         } else {
  50                 r = parse_ip_port(e, &container_port);
  51                 host_port = container_port;
  52         }
  53
  54         if (r < 0)
  55                 return r;
  56
  57         LIST_FOREACH(ports, p, *l)
  58                 if (p->protocol == protocol && p->host_port == host_port)
  59                         return -EEXIST;
  60
  61         p = new(ExposePort, 1);
  62         if (!p)
  63                 return -ENOMEM;
  64
  65         *p = (ExposePort) {
  66                 .protocol = protocol,
  67                 .host_port = host_port,
  68                 .container_port = container_port,
  69         };
  70
  71         LIST_PREPEND(ports, *l, p);
  72
  73         return 0;
  74 }
  75
  76 void expose_port_free_all(ExposePort *p) {
  77
  78         while (p) {
  79                 ExposePort *q = p;
  80                 LIST_REMOVE(ports, p, q);
  81                 free(q);
  82         }
  83 }
  84
  85 int expose_port_flush(FirewallContext **fw_ctx, ExposePort* l, union in_addr_union *exposed) {
  86         ExposePort *p;
  87         int r, af = AF_INET;
  88
  89         assert(exposed);
  90
  91         if (!l)
  92                 return 0;
  93
  94         if (in_addr_is_null(af, exposed))
  95                 return 0;
  96
  97         log_debug("Lost IP address.");
  98
  99         LIST_FOREACH(ports, p, l) {
 100                 r = fw_add_local_dnat(fw_ctx,
 101                                       false,
 102                                       af,
 103                                       p->protocol,
 104                                       p->host_port,
 105                                       exposed,
 106                                       p->container_port,
 107                                       NULL);
 108                 if (r < 0)
 109                         log_warning_errno(r, "Failed to modify firewall: %m");
 110         }
 111
 112         *exposed = IN_ADDR_NULL;
 113         return 0;
 114 }
 115
 116 int expose_port_execute(sd_netlink *rtnl, FirewallContext **fw_ctx, ExposePort *l, union in_addr_union *exposed) {
 117         _cleanup_free_ struct local_address *addresses = NULL;
 118         union in_addr_union new_exposed;
 119         ExposePort *p;
 120         bool add;
 121         int af = AF_INET, r;
 122
 123         assert(exposed);
 124
 125         /* Invoked each time an address is added or removed inside the
 126          * container */
 127
 128         if (!l)
 129                 return 0;
 130
 131         r = local_addresses(rtnl, 0, af, &addresses);
 132         if (r < 0)
 133                 return log_error_errno(r, "Failed to enumerate local addresses: %m");
 134
 135         add = r > 0 &&
 136                 addresses[0].family == af &&
 137                 addresses[0].scope < RT_SCOPE_LINK;
 138
 139         if (!add)
 140                 return expose_port_flush(fw_ctx, l, exposed);
 141
 142         new_exposed = addresses[0].address;
 143         if (in_addr_equal(af, exposed, &new_exposed))
 144                 return 0;
 145
 146         if (DEBUG_LOGGING) {
 147                 _cleanup_free_ char *pretty = NULL;
 148                 in_addr_to_string(af, &new_exposed, &pretty);
 149                 log_debug("New container IP is %s.", strna(pretty));
 150         }
 151
 152         LIST_FOREACH(ports, p, l) {
 153
 154                 r = fw_add_local_dnat(fw_ctx,
 155                                       true,
 156                                       af,
 157                                       p->protocol,
 158                                       p->host_port,
 159                                       &new_exposed,
 160                                       p->container_port,
 161                                       in_addr_is_null(af, exposed) ? NULL : exposed);
 162                 if (r < 0)
 163                         log_warning_errno(r, "Failed to modify firewall: %m");
 164         }
 165
 166         *exposed = new_exposed;
 167         return 0;
 168 }
 169
 170 int expose_port_send_rtnl(int send_fd) {
 171         _cleanup_close_ int fd = -1;
 172         int r;
 173
 174         assert(send_fd >= 0);
 175
 176         fd = socket(PF_NETLINK, SOCK_RAW|SOCK_CLOEXEC|SOCK_NONBLOCK, NETLINK_ROUTE);
 177         if (fd < 0)
 178                 return log_error_errno(errno, "Failed to allocate container netlink: %m");
 179
 180         /* Store away the fd in the socket, so that it stays open as
 181          * long as we run the child */
 182         r = send_one_fd(send_fd, fd, 0);
 183         if (r < 0)
 184                 return log_error_errno(r, "Failed to send netlink fd: %m");
 185
 186         return 0;
 187 }
 188
 189 int expose_port_watch_rtnl(
 190                 sd_event *event,
 191                 int recv_fd,
 192                 sd_netlink_message_handler_t handler,
 193                 void *userdata,
 194                 sd_netlink **ret) {
 195         _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
 196         int fd, r;
 197
 198         assert(event);
 199         assert(recv_fd >= 0);
 200         assert(ret);
 201
 202         fd = receive_one_fd(recv_fd, 0);
 203         if (fd < 0)
 204                 return log_error_errno(fd, "Failed to recv netlink fd: %m");
 205
 206         r = sd_netlink_open_fd(&rtnl, fd);
 207         if (r < 0) {
 208                 safe_close(fd);
 209                 return log_error_errno(r, "Failed to create rtnl object: %m");
 210         }
 211
 212         r = sd_netlink_add_match(rtnl, NULL, RTM_NEWADDR, handler, NULL, userdata, "nspawn-NEWADDR");
 213         if (r < 0)
 214                 return log_error_errno(r, "Failed to subscribe to RTM_NEWADDR messages: %m");
 215
 216         r = sd_netlink_add_match(rtnl, NULL, RTM_DELADDR, handler, NULL, userdata, "nspawn-DELADDR");
 217         if (r < 0)
 218                 return log_error_errno(r, "Failed to subscribe to RTM_DELADDR messages: %m");
 219
 220         r = sd_netlink_attach_event(rtnl, event, 0);
 221         if (r < 0)
 222                 return log_error_errno(r, "Failed to add to event loop: %m");
 223
 224         *ret = TAKE_PTR(rtnl);
 225
 226         return 0;
 227 }