src/network/networkd-routing-policy-rule.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <net/if.h>
   4 #include <linux/fib_rules.h>
   5
   6 #include "alloc-util.h"
   7 #include "conf-parser.h"
   8 #include "fileio.h"
   9 #include "ip-protocol-list.h"
  10 #include "networkd-routing-policy-rule.h"
  11 #include "netlink-util.h"
  12 #include "networkd-manager.h"
  13 #include "parse-util.h"
  14 #include "socket-util.h"
  15 #include "string-util.h"
  16 #include "strv.h"
  17
  18 int routing_policy_rule_new(RoutingPolicyRule **ret) {
  19         RoutingPolicyRule *rule;
  20
  21         rule = new(RoutingPolicyRule, 1);
  22         if (!rule)
  23                 return -ENOMEM;
  24
  25         *rule = (RoutingPolicyRule) {
  26                 .family = AF_INET,
  27                 .table = RT_TABLE_MAIN,
  28         };
  29
  30         *ret = rule;
  31         return 0;
  32 }
  33
  34 void routing_policy_rule_free(RoutingPolicyRule *rule) {
  35
  36         if (!rule)
  37                 return;
  38
  39         if (rule->network) {
  40                 LIST_REMOVE(rules, rule->network->rules, rule);
  41                 assert(rule->network->n_rules > 0);
  42                 rule->network->n_rules--;
  43
  44                 if (rule->section)
  45                         hashmap_remove(rule->network->rules_by_section, rule->section);
  46         }
  47
  48         if (rule->manager) {
  49                 set_remove(rule->manager->rules, rule);
  50                 set_remove(rule->manager->rules_foreign, rule);
  51         }
  52
  53         network_config_section_free(rule->section);
  54         free(rule->iif);
  55         free(rule->oif);
  56         free(rule);
  57 }
  58
  59 static void routing_policy_rule_hash_func(const void *b, struct siphash *state) {
  60         const RoutingPolicyRule *rule = b;
  61
  62         assert(rule);
  63
  64         siphash24_compress(&rule->family, sizeof(rule->family), state);
  65
  66         switch (rule->family) {
  67         case AF_INET:
  68         case AF_INET6:
  69
  70                 siphash24_compress(&rule->from, FAMILY_ADDRESS_SIZE(rule->family), state);
  71                 siphash24_compress(&rule->from_prefixlen, sizeof(rule->from_prefixlen), state);
  72
  73                 siphash24_compress(&rule->to, FAMILY_ADDRESS_SIZE(rule->family), state);
  74                 siphash24_compress(&rule->to_prefixlen, sizeof(rule->to_prefixlen), state);
  75
  76                 siphash24_compress(&rule->tos, sizeof(rule->tos), state);
  77                 siphash24_compress(&rule->fwmark, sizeof(rule->fwmark), state);
  78                 siphash24_compress(&rule->table, sizeof(rule->table), state);
  79
  80                 siphash24_compress(&rule->protocol, sizeof(rule->protocol), state);
  81                 siphash24_compress(&rule->sport, sizeof(rule->sport), state);
  82                 siphash24_compress(&rule->dport, sizeof(rule->dport), state);
  83
  84                 if (rule->iif)
  85                         siphash24_compress(rule->iif, strlen(rule->iif), state);
  86
  87                 if (rule->oif)
  88                         siphash24_compress(rule->oif, strlen(rule->oif), state);
  89
  90                 break;
  91         default:
  92                 /* treat any other address family as AF_UNSPEC */
  93                 break;
  94         }
  95 }
  96
  97 static int routing_policy_rule_compare_func(const void *_a, const void *_b) {
  98         const RoutingPolicyRule *a = _a, *b = _b;
  99         int r;
 100
 101         r = CMP(a->family, b->family);
 102         if (r != 0)
 103                 return r;
 104
 105         switch (a->family) {
 106         case AF_INET:
 107         case AF_INET6:
 108                 r = CMP(a->from_prefixlen, b->from_prefixlen);
 109                 if (r != 0)
 110                         return r;
 111
 112                 r = CMP(a->to_prefixlen, b->to_prefixlen);
 113                 if (r != 0)
 114                         return r;
 115
 116                 r = CMP(a->tos, b->tos);
 117                 if (r != 0)
 118                         return r;
 119
 120                 r = CMP(a->fwmask, b->fwmask);
 121                 if (r != 0)
 122                         return r;
 123
 124                 r = CMP(a->table, b->table);
 125                 if (r != 0)
 126                         return r;
 127
 128                 r = strcmp_ptr(a->iif, b->iif);
 129                 if (!r)
 130                         return r;
 131
 132                 r = strcmp_ptr(a->oif, b->oif);
 133                 if (!r)
 134                         return r;
 135
 136                 r = CMP(a->protocol, b->protocol);
 137                 if (r != 0)
 138                         return r;
 139
 140                 r = memcmp(&a->sport, &b->sport, sizeof(a->sport));
 141                 if (r != 0)
 142                         return r;
 143
 144                 r = memcmp(&a->dport, &b->dport, sizeof(a->dport));
 145                 if (r != 0)
 146                         return r;
 147
 148                 r = memcmp(&a->from, &b->from, FAMILY_ADDRESS_SIZE(a->family));
 149                 if (r != 0)
 150                         return r;
 151
 152                 return memcmp(&a->to, &b->to, FAMILY_ADDRESS_SIZE(a->family));
 153
 154         default:
 155                 /* treat any other address family as AF_UNSPEC */
 156                 return 0;
 157         }
 158 }
 159
 160 const struct hash_ops routing_policy_rule_hash_ops = {
 161         .hash = routing_policy_rule_hash_func,
 162         .compare = routing_policy_rule_compare_func
 163 };
 164
 165 int routing_policy_rule_get(Manager *m,
 166                             int family,
 167                             const union in_addr_union *from,
 168                             uint8_t from_prefixlen,
 169                             const union in_addr_union *to,
 170                             uint8_t to_prefixlen,
 171                             uint8_t tos,
 172                             uint32_t fwmark,
 173                             uint32_t table,
 174                             const char *iif,
 175                             const char *oif,
 176                             uint8_t protocol,
 177                             struct fib_rule_port_range *sport,
 178                             struct fib_rule_port_range *dport,
 179                             RoutingPolicyRule **ret) {
 180
 181         RoutingPolicyRule rule, *existing;
 182
 183         assert_return(m, -1);
 184
 185         rule = (RoutingPolicyRule) {
 186                 .family = family,
 187                 .from = *from,
 188                 .from_prefixlen = from_prefixlen,
 189                 .to = *to,
 190                 .to_prefixlen = to_prefixlen,
 191                 .tos = tos,
 192                 .fwmark = fwmark,
 193                 .table = table,
 194                 .iif = (char*) iif,
 195                 .oif = (char*) oif,
 196                 .protocol = protocol,
 197                 .sport = *sport,
 198                 .dport = *dport,
 199         };
 200
 201         existing = set_get(m->rules, &rule);
 202         if (existing) {
 203                 if (ret)
 204                         *ret = existing;
 205                 return 1;
 206         }
 207
 208         existing = set_get(m->rules_foreign, &rule);
 209         if (existing) {
 210                 if (ret)
 211                         *ret = existing;
 212                 return 0;
 213         }
 214
 215         return -ENOENT;
 216 }
 217
 218 int routing_policy_rule_make_local(Manager *m, RoutingPolicyRule *rule) {
 219         int r;
 220
 221         assert(m);
 222
 223         if (set_contains(m->rules_foreign, rule)) {
 224                 set_remove(m->rules_foreign, rule);
 225
 226                 r = set_ensure_allocated(&m->rules, &routing_policy_rule_hash_ops);
 227                 if (r < 0)
 228                         return r;
 229
 230                 return set_put(m->rules, rule);
 231         }
 232
 233         return -ENOENT;
 234 }
 235
 236 static int routing_policy_rule_add_internal(Manager *m,
 237                                             Set **rules,
 238                                             int family,
 239                                             const union in_addr_union *from,
 240                                             uint8_t from_prefixlen,
 241                                             const union in_addr_union *to,
 242                                             uint8_t to_prefixlen,
 243                                             uint8_t tos,
 244                                             uint32_t fwmark,
 245                                             uint32_t table,
 246                                             const char *_iif,
 247                                             const char *_oif,
 248                                             uint8_t protocol,
 249                                             const struct fib_rule_port_range *sport,
 250                                             const struct fib_rule_port_range *dport,
 251                                             RoutingPolicyRule **ret) {
 252
 253         _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *rule = NULL;
 254         _cleanup_free_ char *iif = NULL, *oif = NULL;
 255         int r;
 256
 257         assert_return(rules, -EINVAL);
 258
 259         if (_iif) {
 260                 iif = strdup(_iif);
 261                 if (!iif)
 262                         return -ENOMEM;
 263         }
 264
 265         if (_oif) {
 266                 oif = strdup(_oif);
 267                 if (!oif)
 268                         return -ENOMEM;
 269         }
 270
 271         r = routing_policy_rule_new(&rule);
 272         if (r < 0)
 273                 return r;
 274
 275         rule->manager = m;
 276         rule->family = family;
 277         rule->from = *from;
 278         rule->from_prefixlen = from_prefixlen;
 279         rule->to = *to;
 280         rule->to_prefixlen = to_prefixlen;
 281         rule->tos = tos;
 282         rule->fwmark = fwmark;
 283         rule->table = table;
 284         rule->iif = iif;
 285         rule->oif = oif;
 286         rule->protocol = protocol;
 287         rule->sport = *sport;
 288         rule->dport = *dport;
 289
 290         r = set_ensure_allocated(rules, &routing_policy_rule_hash_ops);
 291         if (r < 0)
 292                 return r;
 293
 294         r = set_put(*rules, rule);
 295         if (r < 0)
 296                 return r;
 297
 298         if (ret)
 299                 *ret = rule;
 300
 301         rule = NULL;
 302         iif = oif = NULL;
 303
 304         return 0;
 305 }
 306
 307 int routing_policy_rule_add(Manager *m,
 308                             int family,
 309                             const union in_addr_union *from,
 310                             uint8_t from_prefixlen,
 311                             const union in_addr_union *to,
 312                             uint8_t to_prefixlen,
 313                             uint8_t tos,
 314                             uint32_t fwmark,
 315                             uint32_t table,
 316                             const char *iif,
 317                             const char *oif,
 318                             uint8_t protocol,
 319                             const struct fib_rule_port_range *sport,
 320                             const struct fib_rule_port_range *dport,
 321                             RoutingPolicyRule **ret) {
 322
 323         return routing_policy_rule_add_internal(m, &m->rules, family, from, from_prefixlen, to, to_prefixlen, tos, fwmark, table, iif, oif, protocol, sport, dport, ret);
 324 }
 325
 326 int routing_policy_rule_add_foreign(Manager *m,
 327                                     int family,
 328                                     const union in_addr_union *from,
 329                                     uint8_t from_prefixlen,
 330                                     const union in_addr_union *to,
 331                                     uint8_t to_prefixlen,
 332                                     uint8_t tos,
 333                                     uint32_t fwmark,
 334                                     uint32_t table,
 335                                     const char *iif,
 336                                     const char *oif,
 337                                     uint8_t protocol,
 338                                     const struct fib_rule_port_range *sport,
 339                                     const struct fib_rule_port_range *dport,
 340                                     RoutingPolicyRule **ret) {
 341         return routing_policy_rule_add_internal(m, &m->rules_foreign, family, from, from_prefixlen, to, to_prefixlen, tos, fwmark, table, iif, oif, protocol, sport, dport, ret);
 342 }
 343
 344 static int routing_policy_rule_remove_handler(sd_netlink *rtnl, sd_netlink_message *m, Link *link) {
 345         int r;
 346
 347         assert(m);
 348         assert(link);
 349         assert(link->ifname);
 350
 351         link->routing_policy_rule_remove_messages--;
 352
 353         if (IN_SET(link->state, LINK_STATE_FAILED, LINK_STATE_LINGER))
 354                 return 1;
 355
 356         r = sd_netlink_message_get_errno(m);
 357         if (r < 0)
 358                 log_link_warning_errno(link, r, "Could not drop routing policy rule: %m");
 359
 360         return 1;
 361 }
 362
 363 int routing_policy_rule_remove(RoutingPolicyRule *routing_policy_rule, Link *link, link_netlink_message_handler_t callback) {
 364         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 365         int r;
 366
 367         assert(routing_policy_rule);
 368         assert(link);
 369         assert(link->manager);
 370         assert(link->manager->rtnl);
 371         assert(link->ifindex > 0);
 372         assert(IN_SET(routing_policy_rule->family, AF_INET, AF_INET6));
 373
 374         r = sd_rtnl_message_new_routing_policy_rule(link->manager->rtnl, &m, RTM_DELRULE, routing_policy_rule->family);
 375         if (r < 0)
 376                 return log_error_errno(r, "Could not allocate RTM_DELRULE message: %m");
 377
 378         if (!in_addr_is_null(routing_policy_rule->family, &routing_policy_rule->from)) {
 379                 if (routing_policy_rule->family == AF_INET)
 380                         r = sd_netlink_message_append_in_addr(m, FRA_SRC, &routing_policy_rule->from.in);
 381                 else
 382                         r = sd_netlink_message_append_in6_addr(m, FRA_SRC, &routing_policy_rule->from.in6);
 383
 384                 if (r < 0)
 385                         return log_error_errno(r, "Could not append FRA_SRC attribute: %m");
 386
 387                 r = sd_rtnl_message_routing_policy_rule_set_rtm_src_prefixlen(m, routing_policy_rule->from_prefixlen);
 388                 if (r < 0)
 389                         return log_error_errno(r, "Could not set source prefix length: %m");
 390         }
 391
 392         if (!in_addr_is_null(routing_policy_rule->family, &routing_policy_rule->to)) {
 393                 if (routing_policy_rule->family == AF_INET)
 394                         r = sd_netlink_message_append_in_addr(m, FRA_DST, &routing_policy_rule->to.in);
 395                 else
 396                         r = sd_netlink_message_append_in6_addr(m, FRA_DST, &routing_policy_rule->to.in6);
 397
 398                 if (r < 0)
 399                         return log_error_errno(r, "Could not append FRA_DST attribute: %m");
 400
 401                 r = sd_rtnl_message_routing_policy_rule_set_rtm_dst_prefixlen(m, routing_policy_rule->to_prefixlen);
 402                 if (r < 0)
 403                         return log_error_errno(r, "Could not set destination prefix length: %m");
 404         }
 405
 406         r = netlink_call_async(link->manager->rtnl, NULL, m,
 407                                callback ?: routing_policy_rule_remove_handler,
 408                                link_netlink_destroy_callback, link);
 409         if (r < 0)
 410                 return log_error_errno(r, "Could not send rtnetlink message: %m");
 411
 412         link_ref(link);
 413
 414         return 0;
 415 }
 416
 417 static int routing_policy_rule_new_static(Network *network, const char *filename, unsigned section_line, RoutingPolicyRule **ret) {
 418         _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *rule = NULL;
 419         _cleanup_(network_config_section_freep) NetworkConfigSection *n = NULL;
 420         int r;
 421
 422         assert(network);
 423         assert(ret);
 424         assert(!!filename == (section_line > 0));
 425
 426         if (filename) {
 427                 r = network_config_section_new(filename, section_line, &n);
 428                 if (r < 0)
 429                         return r;
 430
 431                 rule = hashmap_get(network->rules_by_section, n);
 432                 if (rule) {
 433                         *ret = TAKE_PTR(rule);
 434
 435                         return 0;
 436                 }
 437         }
 438
 439         r = routing_policy_rule_new(&rule);
 440         if (r < 0)
 441                 return r;
 442
 443         rule->network = network;
 444         LIST_APPEND(rules, network->rules, rule);
 445         network->n_rules++;
 446
 447         if (filename) {
 448                 rule->section = TAKE_PTR(n);
 449
 450                 r = hashmap_ensure_allocated(&network->rules_by_section, &network_config_hash_ops);
 451                 if (r < 0)
 452                         return r;
 453
 454                 r = hashmap_put(network->rules_by_section, rule->section, rule);
 455                 if (r < 0)
 456                         return r;
 457         }
 458
 459         *ret = TAKE_PTR(rule);
 460
 461         return 0;
 462 }
 463
 464 static int routing_policy_rule_handler(sd_netlink *rtnl, sd_netlink_message *m, Link *link) {
 465         int r;
 466
 467         assert(rtnl);
 468         assert(m);
 469         assert(link);
 470         assert(link->ifname);
 471         assert(link->routing_policy_rule_messages > 0);
 472
 473         link->routing_policy_rule_messages--;
 474
 475         if (IN_SET(link->state, LINK_STATE_FAILED, LINK_STATE_LINGER))
 476                 return 1;
 477
 478         r = sd_netlink_message_get_errno(m);
 479         if (r < 0 && r != -EEXIST)
 480                 log_link_warning_errno(link, r, "Could not add routing policy rule: %m");
 481
 482         if (link->routing_policy_rule_messages == 0) {
 483                 log_link_debug(link, "Routing policy rule configured");
 484                 link->routing_policy_rules_configured = true;
 485                 link_check_ready(link);
 486         }
 487
 488         return 1;
 489 }
 490
 491 int routing_policy_rule_configure(RoutingPolicyRule *rule, Link *link, link_netlink_message_handler_t callback, bool update) {
 492         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
 493         int r;
 494
 495         assert(rule);
 496         assert(link);
 497         assert(link->ifindex > 0);
 498         assert(link->manager);
 499         assert(link->manager->rtnl);
 500
 501         r = sd_rtnl_message_new_routing_policy_rule(link->manager->rtnl, &m, RTM_NEWRULE, rule->family);
 502         if (r < 0)
 503                 return log_error_errno(r, "Could not allocate RTM_NEWRULE message: %m");
 504
 505         if (!in_addr_is_null(rule->family, &rule->from)) {
 506                 if (rule->family == AF_INET)
 507                         r = sd_netlink_message_append_in_addr(m, FRA_SRC, &rule->from.in);
 508                 else
 509                         r = sd_netlink_message_append_in6_addr(m, FRA_SRC, &rule->from.in6);
 510
 511                 if (r < 0)
 512                         return log_error_errno(r, "Could not append FRA_SRC attribute: %m");
 513
 514                 r = sd_rtnl_message_routing_policy_rule_set_rtm_src_prefixlen(m, rule->from_prefixlen);
 515                 if (r < 0)
 516                         return log_error_errno(r, "Could not set source prefix length: %m");
 517         }
 518
 519         if (!in_addr_is_null(rule->family, &rule->to)) {
 520                 if (rule->family == AF_INET)
 521                         r = sd_netlink_message_append_in_addr(m, FRA_DST, &rule->to.in);
 522                 else
 523                         r = sd_netlink_message_append_in6_addr(m, FRA_DST, &rule->to.in6);
 524
 525                 if (r < 0)
 526                         return log_error_errno(r, "Could not append FRA_DST attribute: %m");
 527
 528                 r = sd_rtnl_message_routing_policy_rule_set_rtm_dst_prefixlen(m, rule->to_prefixlen);
 529                 if (r < 0)
 530                         return log_error_errno(r, "Could not set destination prefix length: %m");
 531         }
 532
 533         r = sd_netlink_message_append_u32(m, FRA_PRIORITY, rule->priority);
 534         if (r < 0)
 535                 return log_error_errno(r, "Could not append FRA_PRIORITY attribute: %m");
 536
 537         if (rule->tos > 0) {
 538                 r = sd_rtnl_message_routing_policy_rule_set_tos(m, rule->tos);
 539                 if (r < 0)
 540                         return log_error_errno(r, "Could not set ip rule tos: %m");
 541         }
 542
 543         if (rule->table < 256) {
 544                 r = sd_rtnl_message_routing_policy_rule_set_table(m, rule->table);
 545                 if (r < 0)
 546                         return log_error_errno(r, "Could not set ip rule table: %m");
 547         } else {
 548                 r = sd_rtnl_message_routing_policy_rule_set_table(m, RT_TABLE_UNSPEC);
 549                 if (r < 0)
 550                         return log_error_errno(r, "Could not set ip rule table: %m");
 551
 552                 r = sd_netlink_message_append_u32(m, FRA_TABLE, rule->table);
 553                 if (r < 0)
 554                         return log_error_errno(r, "Could not append FRA_TABLE attribute: %m");
 555         }
 556
 557         if (rule->fwmark > 0) {
 558                 r = sd_netlink_message_append_u32(m, FRA_FWMARK, rule->fwmark);
 559                 if (r < 0)
 560                         return log_error_errno(r, "Could not append FRA_FWMARK attribute: %m");
 561         }
 562
 563         if (rule->fwmask > 0) {
 564                 r = sd_netlink_message_append_u32(m, FRA_FWMASK, rule->fwmask);
 565                 if (r < 0)
 566                         return log_error_errno(r, "Could not append FRA_FWMASK attribute: %m");
 567         }
 568
 569         if (rule->iif) {
 570                 r = sd_netlink_message_append_string(m, FRA_IFNAME, rule->iif);
 571                 if (r < 0)
 572                         return log_error_errno(r, "Could not append FRA_IFNAME attribute: %m");
 573         }
 574
 575         if (rule->oif) {
 576                 r = sd_netlink_message_append_string(m, FRA_OIFNAME, rule->oif);
 577                 if (r < 0)
 578                         return log_error_errno(r, "Could not append FRA_OIFNAME attribute: %m");
 579         }
 580
 581         r = sd_netlink_message_append_u8(m, FRA_IP_PROTO, rule->protocol);
 582         if (r < 0)
 583                 return log_error_errno(r, "Could not append FRA_IP_PROTO attribute: %m");
 584
 585         if (rule->sport.start != 0 || rule->sport.end != 0) {
 586                 r = sd_netlink_message_append_data(m, FRA_SPORT_RANGE, &rule->sport, sizeof(rule->sport));
 587                 if (r < 0)
 588                         return log_error_errno(r, "Could not append FRA_SPORT_RANGE attribute: %m");
 589         }
 590
 591         if (rule->dport.start != 0 || rule->dport.end != 0) {
 592                 r = sd_netlink_message_append_data(m, FRA_DPORT_RANGE, &rule->dport, sizeof(rule->dport));
 593                 if (r < 0)
 594                         return log_error_errno(r, "Could not append FRA_DPORT_RANGE attribute: %m");
 595         }
 596
 597         rule->link = link;
 598
 599         r = netlink_call_async(link->manager->rtnl, NULL, m,
 600                                callback ?: routing_policy_rule_handler,
 601                                link_netlink_destroy_callback, link);
 602         if (r < 0)
 603                 return log_error_errno(r, "Could not send rtnetlink message: %m");
 604
 605         link_ref(link);
 606
 607         r = routing_policy_rule_add(link->manager, rule->family, &rule->from, rule->from_prefixlen, &rule->to,
 608                                     rule->to_prefixlen, rule->tos, rule->fwmark, rule->table, rule->iif, rule->oif, rule->protocol, &rule->sport, &rule->dport, NULL);
 609         if (r < 0)
 610                 return log_error_errno(r, "Could not add rule: %m");
 611
 612         return 0;
 613 }
 614
 615 static int parse_fwmark_fwmask(const char *s, uint32_t *fwmark, uint32_t *fwmask) {
 616         _cleanup_free_ char *f = NULL;
 617         char *p;
 618         int r;
 619
 620         assert(s);
 621
 622         f = strdup(s);
 623         if (!f)
 624                 return -ENOMEM;
 625
 626         p = strchr(f, '/');
 627         if (p)
 628                 *p++ = '\0';
 629
 630         r = safe_atou32(f, fwmark);
 631         if (r < 0)
 632                 return log_error_errno(r, "Failed to parse RPDB rule firewall mark, ignoring: %s", f);
 633
 634         if (p) {
 635                 r = safe_atou32(p, fwmask);
 636                 if (r < 0)
 637                         return log_error_errno(r, "Failed to parse RPDB rule mask, ignoring: %s", f);
 638         }
 639
 640         return 0;
 641 }
 642
 643 int config_parse_routing_policy_rule_tos(
 644                 const char *unit,
 645                 const char *filename,
 646                 unsigned line,
 647                 const char *section,
 648                 unsigned section_line,
 649                 const char *lvalue,
 650                 int ltype,
 651                 const char *rvalue,
 652                 void *data,
 653                 void *userdata) {
 654
 655         _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *n = NULL;
 656         Network *network = userdata;
 657         int r;
 658
 659         assert(filename);
 660         assert(section);
 661         assert(lvalue);
 662         assert(rvalue);
 663         assert(data);
 664
 665         r = routing_policy_rule_new_static(network, filename, section_line, &n);
 666         if (r < 0)
 667                 return r;
 668
 669         r = safe_atou8(rvalue, &n->tos);
 670         if (r < 0) {
 671                 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse RPDB rule tos, ignoring: %s", rvalue);
 672                 return 0;
 673         }
 674
 675         n = NULL;
 676
 677         return 0;
 678 }
 679
 680 int config_parse_routing_policy_rule_priority(
 681                 const char *unit,
 682                 const char *filename,
 683                 unsigned line,
 684                 const char *section,
 685                 unsigned section_line,
 686                 const char *lvalue,
 687                 int ltype,
 688                 const char *rvalue,
 689                 void *data,
 690                 void *userdata) {
 691
 692         _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *n = NULL;
 693         Network *network = userdata;
 694         int r;
 695
 696         assert(filename);
 697         assert(section);
 698         assert(lvalue);
 699         assert(rvalue);
 700         assert(data);
 701
 702         r = routing_policy_rule_new_static(network, filename, section_line, &n);
 703         if (r < 0)
 704                 return r;
 705
 706         r = safe_atou32(rvalue, &n->priority);
 707         if (r < 0) {
 708                 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse RPDB rule priority, ignoring: %s", rvalue);
 709                 return 0;
 710         }
 711
 712         n = NULL;
 713
 714         return 0;
 715 }
 716
 717 int config_parse_routing_policy_rule_table(
 718                 const char *unit,
 719                 const char *filename,
 720                 unsigned line,
 721                 const char *section,
 722                 unsigned section_line,
 723                 const char *lvalue,
 724                 int ltype,
 725                 const char *rvalue,
 726                 void *data,
 727                 void *userdata) {
 728
 729         _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *n = NULL;
 730         Network *network = userdata;
 731         int r;
 732
 733         assert(filename);
 734         assert(section);
 735         assert(lvalue);
 736         assert(rvalue);
 737         assert(data);
 738
 739         r = routing_policy_rule_new_static(network, filename, section_line, &n);
 740         if (r < 0)
 741                 return r;
 742
 743         r = safe_atou32(rvalue, &n->table);
 744         if (r < 0) {
 745                 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse RPDB rule table, ignoring: %s", rvalue);
 746                 return 0;
 747         }
 748
 749         n = NULL;
 750
 751         return 0;
 752 }
 753
 754 int config_parse_routing_policy_rule_fwmark_mask(
 755                 const char *unit,
 756                 const char *filename,
 757                 unsigned line,
 758                 const char *section,
 759                 unsigned section_line,
 760                 const char *lvalue,
 761                 int ltype,
 762                 const char *rvalue,
 763                 void *data,
 764                 void *userdata) {
 765
 766         _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *n = NULL;
 767         Network *network = userdata;
 768         int r;
 769
 770         assert(filename);
 771         assert(section);
 772         assert(lvalue);
 773         assert(rvalue);
 774         assert(data);
 775
 776         r = routing_policy_rule_new_static(network, filename, section_line, &n);
 777         if (r < 0)
 778                 return r;
 779
 780         r = parse_fwmark_fwmask(rvalue, &n->fwmark, &n->fwmask);
 781         if (r < 0) {
 782                 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse RPDB rule firewall mark or mask, ignoring: %s", rvalue);
 783                 return 0;
 784         }
 785
 786         n = NULL;
 787
 788         return 0;
 789 }
 790
 791 int config_parse_routing_policy_rule_prefix(
 792                 const char *unit,
 793                 const char *filename,
 794                 unsigned line,
 795                 const char *section,
 796                 unsigned section_line,
 797                 const char *lvalue,
 798                 int ltype,
 799                 const char *rvalue,
 800                 void *data,
 801                 void *userdata) {
 802
 803         _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *n = NULL;
 804         Network *network = userdata;
 805         union in_addr_union *buffer;
 806         uint8_t *prefixlen;
 807         int r;
 808
 809         assert(filename);
 810         assert(section);
 811         assert(lvalue);
 812         assert(rvalue);
 813         assert(data);
 814
 815         r = routing_policy_rule_new_static(network, filename, section_line, &n);
 816         if (r < 0)
 817                 return r;
 818
 819         if (streq(lvalue, "To")) {
 820                 buffer = &n->to;
 821                 prefixlen = &n->to_prefixlen;
 822         } else {
 823                 buffer = &n->from;
 824                 prefixlen = &n->from_prefixlen;
 825         }
 826
 827         r = in_addr_prefix_from_string_auto(rvalue, &n->family, buffer, prefixlen);
 828         if (r < 0) {
 829                 log_syntax(unit, LOG_ERR, filename, line, r, "RPDB rule prefix is invalid, ignoring assignment: %s", rvalue);
 830                 return 0;
 831         }
 832
 833         n = NULL;
 834
 835         return 0;
 836 }
 837
 838 int config_parse_routing_policy_rule_device(
 839                 const char *unit,
 840                 const char *filename,
 841                 unsigned line,
 842                 const char *section,
 843                 unsigned section_line,
 844                 const char *lvalue,
 845                 int ltype,
 846                 const char *rvalue,
 847                 void *data,
 848                 void *userdata) {
 849
 850         _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *n = NULL;
 851         Network *network = userdata;
 852         int r;
 853
 854         assert(filename);
 855         assert(section);
 856         assert(lvalue);
 857         assert(rvalue);
 858         assert(data);
 859
 860         r = routing_policy_rule_new_static(network, filename, section_line, &n);
 861         if (r < 0)
 862                 return r;
 863
 864         if (!ifname_valid(rvalue)) {
 865                 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse '%s' interface name, ignoring: %s", lvalue, rvalue);
 866                 return 0;
 867         }
 868
 869         if (streq(lvalue, "IncomingInterface")) {
 870                 r = free_and_strdup(&n->iif, rvalue);
 871                 if (r < 0)
 872                         return log_oom();
 873         } else {
 874                 r = free_and_strdup(&n->oif, rvalue);
 875                 if (r < 0)
 876                         return log_oom();
 877         }
 878
 879         n = NULL;
 880
 881         return 0;
 882 }
 883
 884 int config_parse_routing_policy_rule_port_range(
 885                 const char *unit,
 886                 const char *filename,
 887                 unsigned line,
 888                 const char *section,
 889                 unsigned section_line,
 890                 const char *lvalue,
 891                 int ltype,
 892                 const char *rvalue,
 893                 void *data,
 894                 void *userdata) {
 895         _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *n = NULL;
 896         Network *network = userdata;
 897         uint16_t low, high;
 898         int r;
 899
 900         assert(filename);
 901         assert(section);
 902         assert(lvalue);
 903         assert(rvalue);
 904         assert(data);
 905
 906         r = routing_policy_rule_new_static(network, filename, section_line, &n);
 907         if (r < 0)
 908                 return r;
 909
 910         r = parse_ip_port_range(rvalue, &low, &high);
 911         if (r < 0) {
 912                 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse routing policy rule port range '%s'", rvalue);
 913                 return 0;
 914         }
 915
 916         if (streq(lvalue, "SourcePort")) {
 917                 n->sport.start = low;
 918                 n->sport.end = high;
 919         } else {
 920                 n->dport.start = low;
 921                 n->dport.end = high;
 922         }
 923
 924         n = NULL;
 925
 926         return 0;
 927 }
 928
 929 int config_parse_routing_policy_rule_ip_protocol(
 930                 const char *unit,
 931                 const char *filename,
 932                 unsigned line,
 933                 const char *section,
 934                 unsigned section_line,
 935                 const char *lvalue,
 936                 int ltype,
 937                 const char *rvalue,
 938                 void *data,
 939                 void *userdata) {
 940
 941         _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *n = NULL;
 942         Network *network = userdata;
 943         int r;
 944
 945         assert(filename);
 946         assert(section);
 947         assert(lvalue);
 948         assert(rvalue);
 949         assert(data);
 950
 951         r = routing_policy_rule_new_static(network, filename, section_line, &n);
 952         if (r < 0)
 953                 return r;
 954
 955         r = parse_ip_protocol(rvalue);
 956         if (r < 0) {
 957                 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse IP protocol '%s' for routing policy rule, ignoring: %m", rvalue);
 958                 return 0;
 959         }
 960
 961         n->protocol = r;
 962
 963         n = NULL;
 964
 965         return 0;
 966 }
 967
 968 static int routing_policy_rule_read_full_file(const char *state_file, char **ret) {
 969         _cleanup_free_ char *s = NULL;
 970         size_t size;
 971         int r;
 972
 973         assert(state_file);
 974
 975         r = read_full_file(state_file, &s, &size);
 976         if (r == -ENOENT)
 977                 return -ENODATA;
 978         if (r < 0)
 979                 return r;
 980         if (size <= 0)
 981                 return -ENODATA;
 982
 983         *ret = TAKE_PTR(s);
 984
 985         return size;
 986 }
 987
 988 int routing_policy_serialize_rules(Set *rules, FILE *f) {
 989         RoutingPolicyRule *rule = NULL;
 990         Iterator i;
 991         int r;
 992
 993         assert(f);
 994
 995         SET_FOREACH(rule, rules, i) {
 996                 _cleanup_free_ char *from_str = NULL, *to_str = NULL;
 997                 bool space = false;
 998
 999                 fputs("RULE=", f);
1000
1001                 if (!in_addr_is_null(rule->family, &rule->from)) {
1002                         r = in_addr_to_string(rule->family, &rule->from, &from_str);
1003                         if (r < 0)
1004                                 return r;
1005
1006                         fprintf(f, "from=%s/%hhu",
1007                                 from_str, rule->from_prefixlen);
1008                         space = true;
1009                 }
1010
1011                 if (!in_addr_is_null(rule->family, &rule->to)) {
1012                         r = in_addr_to_string(rule->family, &rule->to, &to_str);
1013                         if (r < 0)
1014                                 return r;
1015
1016                         fprintf(f, "%sto=%s/%hhu",
1017                                 space ? " " : "",
1018                                 to_str, rule->to_prefixlen);
1019                         space = true;
1020                 }
1021
1022                 if (rule->tos != 0) {
1023                         fprintf(f, "%stos=%hhu",
1024                                 space ? " " : "",
1025                                 rule->tos);
1026                         space = true;
1027                 }
1028
1029                 if (rule->fwmark != 0) {
1030                         fprintf(f, "%sfwmark=%"PRIu32"/%"PRIu32,
1031                                 space ? " " : "",
1032                                 rule->fwmark, rule->fwmask);
1033                         space = true;
1034                 }
1035
1036                 if (rule->iif) {
1037                         fprintf(f, "%siif=%s",
1038                                 space ? " " : "",
1039                                 rule->iif);
1040                         space = true;
1041                 }
1042
1043                 if (rule->oif) {
1044                         fprintf(f, "%soif=%s",
1045                                 space ? " " : "",
1046                                 rule->oif);
1047                         space = true;
1048                 }
1049
1050                 if (rule->protocol != 0) {
1051                         fprintf(f, "%sprotocol=%hhu",
1052                                 space ? " " : "",
1053                                 rule->protocol);
1054                         space = true;
1055                 }
1056
1057                 if (rule->sport.start != 0 || rule->sport.end != 0) {
1058                         fprintf(f, "%ssourcesport=%"PRIu16"-%"PRIu16,
1059                                 space ? " " : "",
1060                                 rule->sport.start, rule->sport.end);
1061                         space = true;
1062                 }
1063
1064                 if (rule->dport.start != 0 || rule->dport.end != 0) {
1065                         fprintf(f, "%sdestinationport=%"PRIu16"-%"PRIu16,
1066                                 space ? " " : "",
1067                                 rule->dport.start, rule->dport.end);
1068                         space = true;
1069                 }
1070
1071                 fprintf(f, "%stable=%"PRIu32 "\n",
1072                         space ? " " : "",
1073                         rule->table);
1074         }
1075
1076         return 0;
1077 }
1078
1079 int routing_policy_load_rules(const char *state_file, Set **rules) {
1080         _cleanup_strv_free_ char **l = NULL;
1081         _cleanup_free_ char *data = NULL;
1082         uint16_t low = 0, high = 0;
1083         const char *p;
1084         char **i;
1085         int r;
1086
1087         assert(state_file);
1088         assert(rules);
1089
1090         r = routing_policy_rule_read_full_file(state_file, &data);
1091         if (r <= 0)
1092                 return r;
1093
1094         l = strv_split_newlines(data);
1095         if (!l)
1096                 return -ENOMEM;
1097
1098         r = set_ensure_allocated(rules, &routing_policy_rule_hash_ops);
1099         if (r < 0)
1100                 return r;
1101
1102         STRV_FOREACH(i, l) {
1103                 _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *rule = NULL;
1104
1105                 p = startswith(*i, "RULE=");
1106                 if (!p)
1107                         continue;
1108
1109                 r = routing_policy_rule_new(&rule);
1110                 if (r < 0)
1111                         return r;
1112
1113                 for (;;) {
1114                         _cleanup_free_ char *word = NULL, *a = NULL, *b = NULL;
1115
1116                         r = extract_first_word(&p, &word, NULL, 0);
1117                         if (r < 0)
1118                                 return r;
1119                         if (r == 0)
1120                                 break;
1121
1122                         r = split_pair(word, "=", &a, &b);
1123                         if (r < 0)
1124                                 continue;
1125
1126                         if (STR_IN_SET(a, "from", "to")) {
1127                                 union in_addr_union *buffer;
1128                                 uint8_t *prefixlen;
1129
1130                                 if (streq(a, "to")) {
1131                                         buffer = &rule->to;
1132                                         prefixlen = &rule->to_prefixlen;
1133                                 } else {
1134                                         buffer = &rule->from;
1135                                         prefixlen = &rule->from_prefixlen;
1136                                 }
1137
1138                                 r = in_addr_prefix_from_string_auto(b, &rule->family, buffer, prefixlen);
1139                                 if (r < 0) {
1140                                         log_error_errno(r, "RPDB rule prefix is invalid, ignoring assignment: %s", b);
1141                                         continue;
1142                                 }
1143
1144                         } else if (streq(a, "tos")) {
1145                                 r = safe_atou8(b, &rule->tos);
1146                                 if (r < 0) {
1147                                         log_error_errno(r, "Failed to parse RPDB rule tos, ignoring: %s", b);
1148                                         continue;
1149                                 }
1150                         } else if (streq(a, "table")) {
1151                                 r = safe_atou32(b, &rule->table);
1152                                 if (r < 0) {
1153                                         log_error_errno(r, "Failed to parse RPDB rule table, ignoring: %s", b);
1154                                         continue;
1155                                 }
1156                         } else if (streq(a, "fwmark")) {
1157
1158                                 r = parse_fwmark_fwmask(b, &rule->fwmark, &rule->fwmask);
1159                                 if (r < 0) {
1160                                         log_error_errno(r, "Failed to parse RPDB rule firewall mark or mask, ignoring: %s", a);
1161                                         continue;
1162                                 }
1163                         } else if (streq(a, "iif")) {
1164
1165                                 if (free_and_strdup(&rule->iif, b) < 0)
1166                                         return log_oom();
1167
1168                         } else if (streq(a, "oif")) {
1169
1170                                 if (free_and_strdup(&rule->oif, b) < 0)
1171                                         return log_oom();
1172                         } else if (streq(a, "protocol")) {
1173                                 r = safe_atou8(b, &rule->protocol);
1174                                 if (r < 0) {
1175                                         log_error_errno(r, "Failed to parse RPDB rule protocol, ignoring: %s", b);
1176                                         continue;
1177                                 }
1178                         } else if (streq(a, "sourceport")) {
1179
1180                                 r = parse_ip_port_range(b, &low, &high);
1181                                 if (r < 0) {
1182                                         log_error_errno(r, "Invalid routing policy rule source port range, ignoring assignment:'%s'", b);
1183                                         continue;
1184                                 }
1185
1186                                 rule->sport.start = low;
1187                                 rule->sport.end = high;
1188
1189                         } else if (streq(a, "destinationport")) {
1190
1191                                 r = parse_ip_port_range(b, &low, &high);
1192                                 if (r < 0) {
1193                                         log_error_errno(r, "Invalid routing policy rule destination port range, ignoring assignment:'%s'", b);
1194                                         continue;
1195                                 }
1196
1197                                 rule->dport.start = low;
1198                                 rule->dport.end = high;
1199                         }
1200                 }
1201
1202                 r = set_put(*rules, rule);
1203                 if (r < 0) {
1204                         log_warning_errno(r, "Failed to add RPDB rule to saved DB, ignoring: %s", p);
1205                         continue;
1206                 }
1207
1208                 rule = NULL;
1209         }
1210
1211         return 0;
1212 }
1213
1214 void routing_policy_rule_purge(Manager *m, Link *link) {
1215         RoutingPolicyRule *rule, *existing;
1216         Iterator i;
1217         int r;
1218
1219         assert(m);
1220         assert(link);
1221
1222         SET_FOREACH(rule, m->rules_saved, i) {
1223                 existing = set_get(m->rules_foreign, rule);
1224                 if (existing) {
1225
1226                         r = routing_policy_rule_remove(rule, link, NULL);
1227                         if (r < 0) {
1228                                 log_warning_errno(r, "Could not remove routing policy rules: %m");
1229                                 continue;
1230                         }
1231
1232                         link->routing_policy_rule_remove_messages++;
1233                 }
1234         }
1235 }