faa9f8576c71e35b5a983e0e1a8c85b8cf63a239
[thirdparty/systemd.git] / src / network / networkd-routing-policy-rule.c
1 /* SPDX-License-Identifier: LGPL-2.1+ */
2
3 #include <net/if.h>
4 #include <linux/fib_rules.h>
5
6 #include "alloc-util.h"
7 #include "conf-parser.h"
8 #include "fileio.h"
9 #include "ip-protocol-list.h"
10 #include "networkd-routing-policy-rule.h"
11 #include "netlink-util.h"
12 #include "networkd-manager.h"
13 #include "parse-util.h"
14 #include "socket-util.h"
15 #include "string-util.h"
16 #include "strv.h"
17
18 int routing_policy_rule_new(RoutingPolicyRule **ret) {
19 RoutingPolicyRule *rule;
20
21 rule = new(RoutingPolicyRule, 1);
22 if (!rule)
23 return -ENOMEM;
24
25 *rule = (RoutingPolicyRule) {
26 .family = AF_INET,
27 .table = RT_TABLE_MAIN,
28 };
29
30 *ret = rule;
31 return 0;
32 }
33
34 void routing_policy_rule_free(RoutingPolicyRule *rule) {
35
36 if (!rule)
37 return;
38
39 if (rule->network) {
40 LIST_REMOVE(rules, rule->network->rules, rule);
41 assert(rule->network->n_rules > 0);
42 rule->network->n_rules--;
43
44 if (rule->section)
45 hashmap_remove(rule->network->rules_by_section, rule->section);
46 }
47
48 if (rule->manager) {
49 if (set_get(rule->manager->rules, rule) == rule)
50 set_remove(rule->manager->rules, rule);
51 if (set_get(rule->manager->rules_foreign, rule) == rule)
52 set_remove(rule->manager->rules_foreign, rule);
53 }
54
55 network_config_section_free(rule->section);
56 free(rule->iif);
57 free(rule->oif);
58 free(rule);
59 }
60
61 static void routing_policy_rule_hash_func(const RoutingPolicyRule *rule, struct siphash *state) {
62 assert(rule);
63
64 siphash24_compress(&rule->family, sizeof(rule->family), state);
65
66 switch (rule->family) {
67 case AF_INET:
68 case AF_INET6:
69
70 siphash24_compress(&rule->from, FAMILY_ADDRESS_SIZE(rule->family), state);
71 siphash24_compress(&rule->from_prefixlen, sizeof(rule->from_prefixlen), state);
72
73 siphash24_compress(&rule->to, FAMILY_ADDRESS_SIZE(rule->family), state);
74 siphash24_compress(&rule->to_prefixlen, sizeof(rule->to_prefixlen), state);
75
76 siphash24_compress(&rule->tos, sizeof(rule->tos), state);
77 siphash24_compress(&rule->fwmark, sizeof(rule->fwmark), state);
78 siphash24_compress(&rule->table, sizeof(rule->table), state);
79
80 siphash24_compress(&rule->protocol, sizeof(rule->protocol), state);
81 siphash24_compress(&rule->sport, sizeof(rule->sport), state);
82 siphash24_compress(&rule->dport, sizeof(rule->dport), state);
83
84 if (rule->iif)
85 siphash24_compress(rule->iif, strlen(rule->iif), state);
86
87 if (rule->oif)
88 siphash24_compress(rule->oif, strlen(rule->oif), state);
89
90 break;
91 default:
92 /* treat any other address family as AF_UNSPEC */
93 break;
94 }
95 }
96
97 static int routing_policy_rule_compare_func(const RoutingPolicyRule *a, const RoutingPolicyRule *b) {
98 int r;
99
100 r = CMP(a->family, b->family);
101 if (r != 0)
102 return r;
103
104 switch (a->family) {
105 case AF_INET:
106 case AF_INET6:
107 r = CMP(a->from_prefixlen, b->from_prefixlen);
108 if (r != 0)
109 return r;
110
111 r = CMP(a->to_prefixlen, b->to_prefixlen);
112 if (r != 0)
113 return r;
114
115 r = CMP(a->tos, b->tos);
116 if (r != 0)
117 return r;
118
119 r = CMP(a->fwmask, b->fwmask);
120 if (r != 0)
121 return r;
122
123 r = CMP(a->table, b->table);
124 if (r != 0)
125 return r;
126
127 r = strcmp_ptr(a->iif, b->iif);
128 if (!r)
129 return r;
130
131 r = strcmp_ptr(a->oif, b->oif);
132 if (!r)
133 return r;
134
135 r = CMP(a->protocol, b->protocol);
136 if (r != 0)
137 return r;
138
139 r = memcmp(&a->sport, &b->sport, sizeof(a->sport));
140 if (r != 0)
141 return r;
142
143 r = memcmp(&a->dport, &b->dport, sizeof(a->dport));
144 if (r != 0)
145 return r;
146
147 r = memcmp(&a->from, &b->from, FAMILY_ADDRESS_SIZE(a->family));
148 if (r != 0)
149 return r;
150
151 return memcmp(&a->to, &b->to, FAMILY_ADDRESS_SIZE(a->family));
152
153 default:
154 /* treat any other address family as AF_UNSPEC */
155 return 0;
156 }
157 }
158
159 DEFINE_PRIVATE_HASH_OPS(routing_policy_rule_hash_ops, RoutingPolicyRule, routing_policy_rule_hash_func, routing_policy_rule_compare_func);
160
161 int routing_policy_rule_get(Manager *m,
162 int family,
163 const union in_addr_union *from,
164 uint8_t from_prefixlen,
165 const union in_addr_union *to,
166 uint8_t to_prefixlen,
167 uint8_t tos,
168 uint32_t fwmark,
169 uint32_t table,
170 const char *iif,
171 const char *oif,
172 uint8_t protocol,
173 struct fib_rule_port_range *sport,
174 struct fib_rule_port_range *dport,
175 RoutingPolicyRule **ret) {
176
177 RoutingPolicyRule rule, *existing;
178
179 assert_return(m, -1);
180
181 rule = (RoutingPolicyRule) {
182 .family = family,
183 .from = *from,
184 .from_prefixlen = from_prefixlen,
185 .to = *to,
186 .to_prefixlen = to_prefixlen,
187 .tos = tos,
188 .fwmark = fwmark,
189 .table = table,
190 .iif = (char*) iif,
191 .oif = (char*) oif,
192 .protocol = protocol,
193 .sport = *sport,
194 .dport = *dport,
195 };
196
197 existing = set_get(m->rules, &rule);
198 if (existing) {
199 if (ret)
200 *ret = existing;
201 return 1;
202 }
203
204 existing = set_get(m->rules_foreign, &rule);
205 if (existing) {
206 if (ret)
207 *ret = existing;
208 return 0;
209 }
210
211 return -ENOENT;
212 }
213
214 int routing_policy_rule_make_local(Manager *m, RoutingPolicyRule *rule) {
215 int r;
216
217 assert(m);
218
219 if (set_contains(m->rules_foreign, rule)) {
220 set_remove(m->rules_foreign, rule);
221
222 r = set_ensure_allocated(&m->rules, &routing_policy_rule_hash_ops);
223 if (r < 0)
224 return r;
225
226 return set_put(m->rules, rule);
227 }
228
229 return -ENOENT;
230 }
231
232 static int routing_policy_rule_add_internal(Manager *m,
233 Set **rules,
234 int family,
235 const union in_addr_union *from,
236 uint8_t from_prefixlen,
237 const union in_addr_union *to,
238 uint8_t to_prefixlen,
239 uint8_t tos,
240 uint32_t fwmark,
241 uint32_t table,
242 const char *_iif,
243 const char *_oif,
244 uint8_t protocol,
245 const struct fib_rule_port_range *sport,
246 const struct fib_rule_port_range *dport,
247 RoutingPolicyRule **ret) {
248
249 _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *rule = NULL;
250 _cleanup_free_ char *iif = NULL, *oif = NULL;
251 int r;
252
253 assert_return(rules, -EINVAL);
254
255 if (_iif) {
256 iif = strdup(_iif);
257 if (!iif)
258 return -ENOMEM;
259 }
260
261 if (_oif) {
262 oif = strdup(_oif);
263 if (!oif)
264 return -ENOMEM;
265 }
266
267 r = routing_policy_rule_new(&rule);
268 if (r < 0)
269 return r;
270
271 rule->manager = m;
272 rule->family = family;
273 rule->from = *from;
274 rule->from_prefixlen = from_prefixlen;
275 rule->to = *to;
276 rule->to_prefixlen = to_prefixlen;
277 rule->tos = tos;
278 rule->fwmark = fwmark;
279 rule->table = table;
280 rule->iif = TAKE_PTR(iif);
281 rule->oif = TAKE_PTR(oif);
282 rule->protocol = protocol;
283 rule->sport = *sport;
284 rule->dport = *dport;
285
286 r = set_ensure_allocated(rules, &routing_policy_rule_hash_ops);
287 if (r < 0)
288 return r;
289
290 r = set_put(*rules, rule);
291 if (r < 0)
292 return r;
293
294 if (ret)
295 *ret = rule;
296
297 TAKE_PTR(rule);
298 return 0;
299 }
300
301 int routing_policy_rule_add(Manager *m,
302 int family,
303 const union in_addr_union *from,
304 uint8_t from_prefixlen,
305 const union in_addr_union *to,
306 uint8_t to_prefixlen,
307 uint8_t tos,
308 uint32_t fwmark,
309 uint32_t table,
310 const char *iif,
311 const char *oif,
312 uint8_t protocol,
313 const struct fib_rule_port_range *sport,
314 const struct fib_rule_port_range *dport,
315 RoutingPolicyRule **ret) {
316
317 return routing_policy_rule_add_internal(m, &m->rules, family, from, from_prefixlen, to, to_prefixlen, tos, fwmark, table, iif, oif, protocol, sport, dport, ret);
318 }
319
320 int routing_policy_rule_add_foreign(Manager *m,
321 int family,
322 const union in_addr_union *from,
323 uint8_t from_prefixlen,
324 const union in_addr_union *to,
325 uint8_t to_prefixlen,
326 uint8_t tos,
327 uint32_t fwmark,
328 uint32_t table,
329 const char *iif,
330 const char *oif,
331 uint8_t protocol,
332 const struct fib_rule_port_range *sport,
333 const struct fib_rule_port_range *dport,
334 RoutingPolicyRule **ret) {
335 return routing_policy_rule_add_internal(m, &m->rules_foreign, family, from, from_prefixlen, to, to_prefixlen, tos, fwmark, table, iif, oif, protocol, sport, dport, ret);
336 }
337
338 static int routing_policy_rule_remove_handler(sd_netlink *rtnl, sd_netlink_message *m, Link *link) {
339 int r;
340
341 assert(m);
342 assert(link);
343 assert(link->ifname);
344
345 link->routing_policy_rule_remove_messages--;
346
347 if (IN_SET(link->state, LINK_STATE_FAILED, LINK_STATE_LINGER))
348 return 1;
349
350 r = sd_netlink_message_get_errno(m);
351 if (r < 0)
352 log_link_warning_errno(link, r, "Could not drop routing policy rule: %m");
353
354 return 1;
355 }
356
357 int routing_policy_rule_remove(RoutingPolicyRule *routing_policy_rule, Link *link, link_netlink_message_handler_t callback) {
358 _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
359 int r;
360
361 assert(routing_policy_rule);
362 assert(link);
363 assert(link->manager);
364 assert(link->manager->rtnl);
365 assert(link->ifindex > 0);
366 assert(IN_SET(routing_policy_rule->family, AF_INET, AF_INET6));
367
368 r = sd_rtnl_message_new_routing_policy_rule(link->manager->rtnl, &m, RTM_DELRULE, routing_policy_rule->family);
369 if (r < 0)
370 return log_error_errno(r, "Could not allocate RTM_DELRULE message: %m");
371
372 if (in_addr_is_null(routing_policy_rule->family, &routing_policy_rule->from) == 0) {
373 r = netlink_message_append_in_addr_union(m, FRA_SRC, routing_policy_rule->family, &routing_policy_rule->from);
374 if (r < 0)
375 return log_error_errno(r, "Could not append FRA_SRC attribute: %m");
376
377 r = sd_rtnl_message_routing_policy_rule_set_rtm_src_prefixlen(m, routing_policy_rule->from_prefixlen);
378 if (r < 0)
379 return log_error_errno(r, "Could not set source prefix length: %m");
380 }
381
382 if (in_addr_is_null(routing_policy_rule->family, &routing_policy_rule->to) == 0) {
383 r = netlink_message_append_in_addr_union(m, FRA_DST, routing_policy_rule->family, &routing_policy_rule->to);
384 if (r < 0)
385 return log_error_errno(r, "Could not append FRA_DST attribute: %m");
386
387 r = sd_rtnl_message_routing_policy_rule_set_rtm_dst_prefixlen(m, routing_policy_rule->to_prefixlen);
388 if (r < 0)
389 return log_error_errno(r, "Could not set destination prefix length: %m");
390 }
391
392 r = netlink_call_async(link->manager->rtnl, NULL, m,
393 callback ?: routing_policy_rule_remove_handler,
394 link_netlink_destroy_callback, link);
395 if (r < 0)
396 return log_error_errno(r, "Could not send rtnetlink message: %m");
397
398 link_ref(link);
399
400 return 0;
401 }
402
403 static int routing_policy_rule_new_static(Network *network, const char *filename, unsigned section_line, RoutingPolicyRule **ret) {
404 _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *rule = NULL;
405 _cleanup_(network_config_section_freep) NetworkConfigSection *n = NULL;
406 int r;
407
408 assert(network);
409 assert(ret);
410 assert(!!filename == (section_line > 0));
411
412 if (filename) {
413 r = network_config_section_new(filename, section_line, &n);
414 if (r < 0)
415 return r;
416
417 rule = hashmap_get(network->rules_by_section, n);
418 if (rule) {
419 *ret = TAKE_PTR(rule);
420
421 return 0;
422 }
423 }
424
425 r = routing_policy_rule_new(&rule);
426 if (r < 0)
427 return r;
428
429 rule->network = network;
430 LIST_APPEND(rules, network->rules, rule);
431 network->n_rules++;
432
433 if (filename) {
434 rule->section = TAKE_PTR(n);
435
436 r = hashmap_ensure_allocated(&network->rules_by_section, &network_config_hash_ops);
437 if (r < 0)
438 return r;
439
440 r = hashmap_put(network->rules_by_section, rule->section, rule);
441 if (r < 0)
442 return r;
443 }
444
445 *ret = TAKE_PTR(rule);
446
447 return 0;
448 }
449
450 static int routing_policy_rule_handler(sd_netlink *rtnl, sd_netlink_message *m, Link *link) {
451 int r;
452
453 assert(rtnl);
454 assert(m);
455 assert(link);
456 assert(link->ifname);
457 assert(link->routing_policy_rule_messages > 0);
458
459 link->routing_policy_rule_messages--;
460
461 if (IN_SET(link->state, LINK_STATE_FAILED, LINK_STATE_LINGER))
462 return 1;
463
464 r = sd_netlink_message_get_errno(m);
465 if (r < 0 && r != -EEXIST)
466 log_link_warning_errno(link, r, "Could not add routing policy rule: %m");
467
468 if (link->routing_policy_rule_messages == 0) {
469 log_link_debug(link, "Routing policy rule configured");
470 link->routing_policy_rules_configured = true;
471 link_check_ready(link);
472 }
473
474 return 1;
475 }
476
477 int routing_policy_rule_configure(RoutingPolicyRule *rule, Link *link, link_netlink_message_handler_t callback) {
478 _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
479 int r;
480
481 assert(rule);
482 assert(link);
483 assert(link->ifindex > 0);
484 assert(link->manager);
485 assert(link->manager->rtnl);
486
487 r = sd_rtnl_message_new_routing_policy_rule(link->manager->rtnl, &m, RTM_NEWRULE, rule->family);
488 if (r < 0)
489 return log_error_errno(r, "Could not allocate RTM_NEWRULE message: %m");
490
491 if (in_addr_is_null(rule->family, &rule->from) == 0) {
492 r = netlink_message_append_in_addr_union(m, FRA_SRC, rule->family, &rule->from);
493 if (r < 0)
494 return log_error_errno(r, "Could not append FRA_SRC attribute: %m");
495
496 r = sd_rtnl_message_routing_policy_rule_set_rtm_src_prefixlen(m, rule->from_prefixlen);
497 if (r < 0)
498 return log_error_errno(r, "Could not set source prefix length: %m");
499 }
500
501 if (in_addr_is_null(rule->family, &rule->to) == 0) {
502 r = netlink_message_append_in_addr_union(m, FRA_DST, rule->family, &rule->to);
503 if (r < 0)
504 return log_error_errno(r, "Could not append FRA_DST attribute: %m");
505
506 r = sd_rtnl_message_routing_policy_rule_set_rtm_dst_prefixlen(m, rule->to_prefixlen);
507 if (r < 0)
508 return log_error_errno(r, "Could not set destination prefix length: %m");
509 }
510
511 r = sd_netlink_message_append_u32(m, FRA_PRIORITY, rule->priority);
512 if (r < 0)
513 return log_error_errno(r, "Could not append FRA_PRIORITY attribute: %m");
514
515 if (rule->tos > 0) {
516 r = sd_rtnl_message_routing_policy_rule_set_tos(m, rule->tos);
517 if (r < 0)
518 return log_error_errno(r, "Could not set ip rule tos: %m");
519 }
520
521 if (rule->table < 256) {
522 r = sd_rtnl_message_routing_policy_rule_set_table(m, rule->table);
523 if (r < 0)
524 return log_error_errno(r, "Could not set ip rule table: %m");
525 } else {
526 r = sd_rtnl_message_routing_policy_rule_set_table(m, RT_TABLE_UNSPEC);
527 if (r < 0)
528 return log_error_errno(r, "Could not set ip rule table: %m");
529
530 r = sd_netlink_message_append_u32(m, FRA_TABLE, rule->table);
531 if (r < 0)
532 return log_error_errno(r, "Could not append FRA_TABLE attribute: %m");
533 }
534
535 if (rule->fwmark > 0) {
536 r = sd_netlink_message_append_u32(m, FRA_FWMARK, rule->fwmark);
537 if (r < 0)
538 return log_error_errno(r, "Could not append FRA_FWMARK attribute: %m");
539 }
540
541 if (rule->fwmask > 0) {
542 r = sd_netlink_message_append_u32(m, FRA_FWMASK, rule->fwmask);
543 if (r < 0)
544 return log_error_errno(r, "Could not append FRA_FWMASK attribute: %m");
545 }
546
547 if (rule->iif) {
548 r = sd_netlink_message_append_string(m, FRA_IFNAME, rule->iif);
549 if (r < 0)
550 return log_error_errno(r, "Could not append FRA_IFNAME attribute: %m");
551 }
552
553 if (rule->oif) {
554 r = sd_netlink_message_append_string(m, FRA_OIFNAME, rule->oif);
555 if (r < 0)
556 return log_error_errno(r, "Could not append FRA_OIFNAME attribute: %m");
557 }
558
559 r = sd_netlink_message_append_u8(m, FRA_IP_PROTO, rule->protocol);
560 if (r < 0)
561 return log_error_errno(r, "Could not append FRA_IP_PROTO attribute: %m");
562
563 if (rule->sport.start != 0 || rule->sport.end != 0) {
564 r = sd_netlink_message_append_data(m, FRA_SPORT_RANGE, &rule->sport, sizeof(rule->sport));
565 if (r < 0)
566 return log_error_errno(r, "Could not append FRA_SPORT_RANGE attribute: %m");
567 }
568
569 if (rule->dport.start != 0 || rule->dport.end != 0) {
570 r = sd_netlink_message_append_data(m, FRA_DPORT_RANGE, &rule->dport, sizeof(rule->dport));
571 if (r < 0)
572 return log_error_errno(r, "Could not append FRA_DPORT_RANGE attribute: %m");
573 }
574
575 if (rule->invert_rule) {
576 r = sd_rtnl_message_routing_policy_rule_set_flags(m, FIB_RULE_INVERT);
577 if (r < 0)
578 return log_error_errno(r, "Could not append FIB_RULE_INVERT attribute: %m");
579 }
580
581 rule->link = link;
582
583 r = netlink_call_async(link->manager->rtnl, NULL, m,
584 callback ?: routing_policy_rule_handler,
585 link_netlink_destroy_callback, link);
586 if (r < 0)
587 return log_error_errno(r, "Could not send rtnetlink message: %m");
588
589 link_ref(link);
590
591 r = routing_policy_rule_add(link->manager, rule->family, &rule->from, rule->from_prefixlen, &rule->to,
592 rule->to_prefixlen, rule->tos, rule->fwmark, rule->table, rule->iif, rule->oif, rule->protocol, &rule->sport, &rule->dport, NULL);
593 if (r < 0)
594 return log_error_errno(r, "Could not add rule: %m");
595
596 return 0;
597 }
598
599 static int parse_fwmark_fwmask(const char *s, uint32_t *fwmark, uint32_t *fwmask) {
600 _cleanup_free_ char *f = NULL;
601 char *p;
602 int r;
603
604 assert(s);
605
606 f = strdup(s);
607 if (!f)
608 return -ENOMEM;
609
610 p = strchr(f, '/');
611 if (p)
612 *p++ = '\0';
613
614 r = safe_atou32(f, fwmark);
615 if (r < 0)
616 return log_error_errno(r, "Failed to parse RPDB rule firewall mark, ignoring: %s", f);
617
618 if (p) {
619 r = safe_atou32(p, fwmask);
620 if (r < 0)
621 return log_error_errno(r, "Failed to parse RPDB rule mask, ignoring: %s", f);
622 }
623
624 return 0;
625 }
626
627 int config_parse_routing_policy_rule_tos(
628 const char *unit,
629 const char *filename,
630 unsigned line,
631 const char *section,
632 unsigned section_line,
633 const char *lvalue,
634 int ltype,
635 const char *rvalue,
636 void *data,
637 void *userdata) {
638
639 _cleanup_(routing_policy_rule_free_or_set_invalidp) RoutingPolicyRule *n = NULL;
640 Network *network = userdata;
641 int r;
642
643 assert(filename);
644 assert(section);
645 assert(lvalue);
646 assert(rvalue);
647 assert(data);
648
649 r = routing_policy_rule_new_static(network, filename, section_line, &n);
650 if (r < 0)
651 return r;
652
653 r = safe_atou8(rvalue, &n->tos);
654 if (r < 0) {
655 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse RPDB rule tos, ignoring: %s", rvalue);
656 return 0;
657 }
658
659 n = NULL;
660
661 return 0;
662 }
663
664 int config_parse_routing_policy_rule_priority(
665 const char *unit,
666 const char *filename,
667 unsigned line,
668 const char *section,
669 unsigned section_line,
670 const char *lvalue,
671 int ltype,
672 const char *rvalue,
673 void *data,
674 void *userdata) {
675
676 _cleanup_(routing_policy_rule_free_or_set_invalidp) RoutingPolicyRule *n = NULL;
677 Network *network = userdata;
678 int r;
679
680 assert(filename);
681 assert(section);
682 assert(lvalue);
683 assert(rvalue);
684 assert(data);
685
686 r = routing_policy_rule_new_static(network, filename, section_line, &n);
687 if (r < 0)
688 return r;
689
690 r = safe_atou32(rvalue, &n->priority);
691 if (r < 0) {
692 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse RPDB rule priority, ignoring: %s", rvalue);
693 return 0;
694 }
695
696 n = NULL;
697
698 return 0;
699 }
700
701 int config_parse_routing_policy_rule_table(
702 const char *unit,
703 const char *filename,
704 unsigned line,
705 const char *section,
706 unsigned section_line,
707 const char *lvalue,
708 int ltype,
709 const char *rvalue,
710 void *data,
711 void *userdata) {
712
713 _cleanup_(routing_policy_rule_free_or_set_invalidp) RoutingPolicyRule *n = NULL;
714 Network *network = userdata;
715 int r;
716
717 assert(filename);
718 assert(section);
719 assert(lvalue);
720 assert(rvalue);
721 assert(data);
722
723 r = routing_policy_rule_new_static(network, filename, section_line, &n);
724 if (r < 0)
725 return r;
726
727 r = safe_atou32(rvalue, &n->table);
728 if (r < 0) {
729 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse RPDB rule table, ignoring: %s", rvalue);
730 return 0;
731 }
732
733 n = NULL;
734
735 return 0;
736 }
737
738 int config_parse_routing_policy_rule_fwmark_mask(
739 const char *unit,
740 const char *filename,
741 unsigned line,
742 const char *section,
743 unsigned section_line,
744 const char *lvalue,
745 int ltype,
746 const char *rvalue,
747 void *data,
748 void *userdata) {
749
750 _cleanup_(routing_policy_rule_free_or_set_invalidp) RoutingPolicyRule *n = NULL;
751 Network *network = userdata;
752 int r;
753
754 assert(filename);
755 assert(section);
756 assert(lvalue);
757 assert(rvalue);
758 assert(data);
759
760 r = routing_policy_rule_new_static(network, filename, section_line, &n);
761 if (r < 0)
762 return r;
763
764 r = parse_fwmark_fwmask(rvalue, &n->fwmark, &n->fwmask);
765 if (r < 0) {
766 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse RPDB rule firewall mark or mask, ignoring: %s", rvalue);
767 return 0;
768 }
769
770 n = NULL;
771
772 return 0;
773 }
774
775 int config_parse_routing_policy_rule_prefix(
776 const char *unit,
777 const char *filename,
778 unsigned line,
779 const char *section,
780 unsigned section_line,
781 const char *lvalue,
782 int ltype,
783 const char *rvalue,
784 void *data,
785 void *userdata) {
786
787 _cleanup_(routing_policy_rule_free_or_set_invalidp) RoutingPolicyRule *n = NULL;
788 Network *network = userdata;
789 union in_addr_union *buffer;
790 uint8_t *prefixlen;
791 int r;
792
793 assert(filename);
794 assert(section);
795 assert(lvalue);
796 assert(rvalue);
797 assert(data);
798
799 r = routing_policy_rule_new_static(network, filename, section_line, &n);
800 if (r < 0)
801 return r;
802
803 if (streq(lvalue, "To")) {
804 buffer = &n->to;
805 prefixlen = &n->to_prefixlen;
806 } else {
807 buffer = &n->from;
808 prefixlen = &n->from_prefixlen;
809 }
810
811 r = in_addr_prefix_from_string_auto(rvalue, &n->family, buffer, prefixlen);
812 if (r < 0) {
813 log_syntax(unit, LOG_ERR, filename, line, r, "RPDB rule prefix is invalid, ignoring assignment: %s", rvalue);
814 return 0;
815 }
816
817 n = NULL;
818
819 return 0;
820 }
821
822 int config_parse_routing_policy_rule_device(
823 const char *unit,
824 const char *filename,
825 unsigned line,
826 const char *section,
827 unsigned section_line,
828 const char *lvalue,
829 int ltype,
830 const char *rvalue,
831 void *data,
832 void *userdata) {
833
834 _cleanup_(routing_policy_rule_free_or_set_invalidp) RoutingPolicyRule *n = NULL;
835 Network *network = userdata;
836 int r;
837
838 assert(filename);
839 assert(section);
840 assert(lvalue);
841 assert(rvalue);
842 assert(data);
843
844 r = routing_policy_rule_new_static(network, filename, section_line, &n);
845 if (r < 0)
846 return r;
847
848 if (!ifname_valid(rvalue)) {
849 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse '%s' interface name, ignoring: %s", lvalue, rvalue);
850 return 0;
851 }
852
853 if (streq(lvalue, "IncomingInterface")) {
854 r = free_and_strdup(&n->iif, rvalue);
855 if (r < 0)
856 return log_oom();
857 } else {
858 r = free_and_strdup(&n->oif, rvalue);
859 if (r < 0)
860 return log_oom();
861 }
862
863 n = NULL;
864
865 return 0;
866 }
867
868 int config_parse_routing_policy_rule_port_range(
869 const char *unit,
870 const char *filename,
871 unsigned line,
872 const char *section,
873 unsigned section_line,
874 const char *lvalue,
875 int ltype,
876 const char *rvalue,
877 void *data,
878 void *userdata) {
879 _cleanup_(routing_policy_rule_free_or_set_invalidp) RoutingPolicyRule *n = NULL;
880 Network *network = userdata;
881 uint16_t low, high;
882 int r;
883
884 assert(filename);
885 assert(section);
886 assert(lvalue);
887 assert(rvalue);
888 assert(data);
889
890 r = routing_policy_rule_new_static(network, filename, section_line, &n);
891 if (r < 0)
892 return r;
893
894 r = parse_ip_port_range(rvalue, &low, &high);
895 if (r < 0) {
896 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse routing policy rule port range '%s'", rvalue);
897 return 0;
898 }
899
900 if (streq(lvalue, "SourcePort")) {
901 n->sport.start = low;
902 n->sport.end = high;
903 } else {
904 n->dport.start = low;
905 n->dport.end = high;
906 }
907
908 n = NULL;
909
910 return 0;
911 }
912
913 int config_parse_routing_policy_rule_ip_protocol(
914 const char *unit,
915 const char *filename,
916 unsigned line,
917 const char *section,
918 unsigned section_line,
919 const char *lvalue,
920 int ltype,
921 const char *rvalue,
922 void *data,
923 void *userdata) {
924
925 _cleanup_(routing_policy_rule_free_or_set_invalidp) RoutingPolicyRule *n = NULL;
926 Network *network = userdata;
927 int r;
928
929 assert(filename);
930 assert(section);
931 assert(lvalue);
932 assert(rvalue);
933 assert(data);
934
935 r = routing_policy_rule_new_static(network, filename, section_line, &n);
936 if (r < 0)
937 return r;
938
939 r = parse_ip_protocol(rvalue);
940 if (r < 0) {
941 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse IP protocol '%s' for routing policy rule, ignoring: %m", rvalue);
942 return 0;
943 }
944
945 n->protocol = r;
946
947 n = NULL;
948
949 return 0;
950 }
951
952 int config_parse_routing_policy_rule_invert(
953 const char *unit,
954 const char *filename,
955 unsigned line,
956 const char *section,
957 unsigned section_line,
958 const char *lvalue,
959 int ltype,
960 const char *rvalue,
961 void *data,
962 void *userdata) {
963
964 _cleanup_(routing_policy_rule_free_or_set_invalidp) RoutingPolicyRule *n = NULL;
965 Network *network = userdata;
966 int r;
967
968 assert(filename);
969 assert(section);
970 assert(lvalue);
971 assert(rvalue);
972 assert(data);
973
974 r = routing_policy_rule_new_static(network, filename, section_line, &n);
975 if (r < 0)
976 return r;
977
978 r = parse_boolean(rvalue);
979 if (r < 0) {
980 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse RPDB rule invert, ignoring: %s", rvalue);
981 return 0;
982 }
983
984 n->invert_rule = r;
985
986 n = NULL;
987
988 return 0;
989 }
990
991 static int routing_policy_rule_read_full_file(const char *state_file, char **ret) {
992 _cleanup_free_ char *s = NULL;
993 size_t size;
994 int r;
995
996 assert(state_file);
997
998 r = read_full_file(state_file, &s, &size);
999 if (r == -ENOENT)
1000 return -ENODATA;
1001 if (r < 0)
1002 return r;
1003 if (size <= 0)
1004 return -ENODATA;
1005
1006 *ret = TAKE_PTR(s);
1007
1008 return size;
1009 }
1010
1011 int routing_policy_serialize_rules(Set *rules, FILE *f) {
1012 RoutingPolicyRule *rule = NULL;
1013 Iterator i;
1014 int r;
1015
1016 assert(f);
1017
1018 SET_FOREACH(rule, rules, i) {
1019 _cleanup_free_ char *from_str = NULL, *to_str = NULL;
1020 bool space = false;
1021
1022 fputs("RULE=", f);
1023
1024 if (!in_addr_is_null(rule->family, &rule->from)) {
1025 r = in_addr_to_string(rule->family, &rule->from, &from_str);
1026 if (r < 0)
1027 return r;
1028
1029 fprintf(f, "from=%s/%hhu",
1030 from_str, rule->from_prefixlen);
1031 space = true;
1032 }
1033
1034 if (!in_addr_is_null(rule->family, &rule->to)) {
1035 r = in_addr_to_string(rule->family, &rule->to, &to_str);
1036 if (r < 0)
1037 return r;
1038
1039 fprintf(f, "%sto=%s/%hhu",
1040 space ? " " : "",
1041 to_str, rule->to_prefixlen);
1042 space = true;
1043 }
1044
1045 if (rule->tos != 0) {
1046 fprintf(f, "%stos=%hhu",
1047 space ? " " : "",
1048 rule->tos);
1049 space = true;
1050 }
1051
1052 if (rule->fwmark != 0) {
1053 fprintf(f, "%sfwmark=%"PRIu32"/%"PRIu32,
1054 space ? " " : "",
1055 rule->fwmark, rule->fwmask);
1056 space = true;
1057 }
1058
1059 if (rule->iif) {
1060 fprintf(f, "%siif=%s",
1061 space ? " " : "",
1062 rule->iif);
1063 space = true;
1064 }
1065
1066 if (rule->oif) {
1067 fprintf(f, "%soif=%s",
1068 space ? " " : "",
1069 rule->oif);
1070 space = true;
1071 }
1072
1073 if (rule->protocol != 0) {
1074 fprintf(f, "%sprotocol=%hhu",
1075 space ? " " : "",
1076 rule->protocol);
1077 space = true;
1078 }
1079
1080 if (rule->sport.start != 0 || rule->sport.end != 0) {
1081 fprintf(f, "%ssourcesport=%"PRIu16"-%"PRIu16,
1082 space ? " " : "",
1083 rule->sport.start, rule->sport.end);
1084 space = true;
1085 }
1086
1087 if (rule->dport.start != 0 || rule->dport.end != 0) {
1088 fprintf(f, "%sdestinationport=%"PRIu16"-%"PRIu16,
1089 space ? " " : "",
1090 rule->dport.start, rule->dport.end);
1091 space = true;
1092 }
1093
1094 fprintf(f, "%stable=%"PRIu32 "\n",
1095 space ? " " : "",
1096 rule->table);
1097 }
1098
1099 return 0;
1100 }
1101
1102 int routing_policy_load_rules(const char *state_file, Set **rules) {
1103 _cleanup_strv_free_ char **l = NULL;
1104 _cleanup_free_ char *data = NULL;
1105 uint16_t low = 0, high = 0;
1106 const char *p;
1107 char **i;
1108 int r;
1109
1110 assert(state_file);
1111 assert(rules);
1112
1113 r = routing_policy_rule_read_full_file(state_file, &data);
1114 if (r <= 0)
1115 return r;
1116
1117 l = strv_split_newlines(data);
1118 if (!l)
1119 return -ENOMEM;
1120
1121 r = set_ensure_allocated(rules, &routing_policy_rule_hash_ops);
1122 if (r < 0)
1123 return r;
1124
1125 STRV_FOREACH(i, l) {
1126 _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *rule = NULL;
1127
1128 p = startswith(*i, "RULE=");
1129 if (!p)
1130 continue;
1131
1132 r = routing_policy_rule_new(&rule);
1133 if (r < 0)
1134 return r;
1135
1136 for (;;) {
1137 _cleanup_free_ char *word = NULL, *a = NULL, *b = NULL;
1138
1139 r = extract_first_word(&p, &word, NULL, 0);
1140 if (r < 0)
1141 return r;
1142 if (r == 0)
1143 break;
1144
1145 r = split_pair(word, "=", &a, &b);
1146 if (r < 0)
1147 continue;
1148
1149 if (STR_IN_SET(a, "from", "to")) {
1150 union in_addr_union *buffer;
1151 uint8_t *prefixlen;
1152
1153 if (streq(a, "to")) {
1154 buffer = &rule->to;
1155 prefixlen = &rule->to_prefixlen;
1156 } else {
1157 buffer = &rule->from;
1158 prefixlen = &rule->from_prefixlen;
1159 }
1160
1161 r = in_addr_prefix_from_string_auto(b, &rule->family, buffer, prefixlen);
1162 if (r < 0) {
1163 log_error_errno(r, "RPDB rule prefix is invalid, ignoring assignment: %s", b);
1164 continue;
1165 }
1166
1167 } else if (streq(a, "tos")) {
1168 r = safe_atou8(b, &rule->tos);
1169 if (r < 0) {
1170 log_error_errno(r, "Failed to parse RPDB rule tos, ignoring: %s", b);
1171 continue;
1172 }
1173 } else if (streq(a, "table")) {
1174 r = safe_atou32(b, &rule->table);
1175 if (r < 0) {
1176 log_error_errno(r, "Failed to parse RPDB rule table, ignoring: %s", b);
1177 continue;
1178 }
1179 } else if (streq(a, "fwmark")) {
1180
1181 r = parse_fwmark_fwmask(b, &rule->fwmark, &rule->fwmask);
1182 if (r < 0) {
1183 log_error_errno(r, "Failed to parse RPDB rule firewall mark or mask, ignoring: %s", a);
1184 continue;
1185 }
1186 } else if (streq(a, "iif")) {
1187
1188 if (free_and_strdup(&rule->iif, b) < 0)
1189 return log_oom();
1190
1191 } else if (streq(a, "oif")) {
1192
1193 if (free_and_strdup(&rule->oif, b) < 0)
1194 return log_oom();
1195 } else if (streq(a, "protocol")) {
1196 r = safe_atou8(b, &rule->protocol);
1197 if (r < 0) {
1198 log_error_errno(r, "Failed to parse RPDB rule protocol, ignoring: %s", b);
1199 continue;
1200 }
1201 } else if (streq(a, "sourceport")) {
1202
1203 r = parse_ip_port_range(b, &low, &high);
1204 if (r < 0) {
1205 log_error_errno(r, "Invalid routing policy rule source port range, ignoring assignment:'%s'", b);
1206 continue;
1207 }
1208
1209 rule->sport.start = low;
1210 rule->sport.end = high;
1211
1212 } else if (streq(a, "destinationport")) {
1213
1214 r = parse_ip_port_range(b, &low, &high);
1215 if (r < 0) {
1216 log_error_errno(r, "Invalid routing policy rule destination port range, ignoring assignment:'%s'", b);
1217 continue;
1218 }
1219
1220 rule->dport.start = low;
1221 rule->dport.end = high;
1222 }
1223 }
1224
1225 r = set_put(*rules, rule);
1226 if (r < 0) {
1227 log_warning_errno(r, "Failed to add RPDB rule to saved DB, ignoring: %s", p);
1228 continue;
1229 }
1230
1231 rule = NULL;
1232 }
1233
1234 return 0;
1235 }
1236
1237 static bool manager_links_have_routing_policy_rule(Manager *m, RoutingPolicyRule *rule) {
1238 RoutingPolicyRule *link_rule;
1239 Iterator i;
1240 Link *link;
1241
1242 assert(m);
1243 assert(rule);
1244
1245 HASHMAP_FOREACH(link, m->links, i) {
1246 if (!link->network)
1247 continue;
1248
1249 LIST_FOREACH(rules, link_rule, link->network->rules)
1250 if (routing_policy_rule_compare_func(link_rule, rule) == 0)
1251 return true;
1252 }
1253
1254 return false;
1255 }
1256
1257 void routing_policy_rule_purge(Manager *m, Link *link) {
1258 RoutingPolicyRule *rule, *existing;
1259 Iterator i;
1260 int r;
1261
1262 assert(m);
1263 assert(link);
1264
1265 SET_FOREACH(rule, m->rules_saved, i) {
1266 existing = set_get(m->rules_foreign, rule);
1267 if (!existing)
1268 continue; /* Saved rule does not exist anymore. */
1269
1270 if (manager_links_have_routing_policy_rule(m, existing))
1271 continue; /* Existing links have the saved rule. */
1272
1273 /* Existing links do not have the saved rule. Let's drop the rule now, and re-configure it
1274 * later when it is requested. */
1275
1276 r = routing_policy_rule_remove(existing, link, NULL);
1277 if (r < 0) {
1278 log_warning_errno(r, "Could not remove routing policy rules: %m");
1279 continue;
1280 }
1281
1282 link->routing_policy_rule_remove_messages++;
1283
1284 assert_se(set_remove(m->rules_foreign, existing) == existing);
1285 routing_policy_rule_free(existing);
1286 }
1287 }