X-Git-Url: http://git.ipfire.org/?p=thirdparty%2Fsystemd.git;a=blobdiff_plain;f=src%2Fnetwork%2Fnetworkd-routing-policy-rule.c;h=be7f2f225bb9b50fa3259eccfcf93020ee16ad81;hp=1b2222cada6dca371d7b2b888e77815d0518b2b3;hb=7ef7e5509b637e660e89ba8a938930ec01de6e54;hpb=401faa3533280b05fee972e0c64885caf4b31e4c diff --git a/src/network/networkd-routing-policy-rule.c b/src/network/networkd-routing-policy-rule.c index 1b2222cada6..be7f2f225bb 100644 --- a/src/network/networkd-routing-policy-rule.c +++ b/src/network/networkd-routing-policy-rule.c @@ -6,11 +6,11 @@ #include "alloc-util.h" #include "conf-parser.h" #include "fileio.h" +#include "ip-protocol-list.h" #include "networkd-routing-policy-rule.h" #include "netlink-util.h" #include "networkd-manager.h" #include "parse-util.h" -#include "socket-protocol-list.h" #include "socket-util.h" #include "string-util.h" #include "strv.h" @@ -46,8 +46,10 @@ void routing_policy_rule_free(RoutingPolicyRule *rule) { } if (rule->manager) { - set_remove(rule->manager->rules, rule); - set_remove(rule->manager->rules_foreign, rule); + if (set_get(rule->manager->rules, rule) == rule) + set_remove(rule->manager->rules, rule); + if (set_get(rule->manager->rules_foreign, rule) == rule) + set_remove(rule->manager->rules_foreign, rule); } network_config_section_free(rule->section); @@ -56,9 +58,7 @@ void routing_policy_rule_free(RoutingPolicyRule *rule) { free(rule); } -static void routing_policy_rule_hash_func(const void *b, struct siphash *state) { - const RoutingPolicyRule *rule = b; - +static void routing_policy_rule_hash_func(const RoutingPolicyRule *rule, struct siphash *state) { assert(rule); siphash24_compress(&rule->family, sizeof(rule->family), state); @@ -94,8 +94,7 @@ static void routing_policy_rule_hash_func(const void *b, struct siphash *state) } } -static int routing_policy_rule_compare_func(const void *_a, const void *_b) { - const RoutingPolicyRule *a = _a, *b = _b; +static int routing_policy_rule_compare_func(const RoutingPolicyRule *a, const RoutingPolicyRule *b) { int r; r = CMP(a->family, b->family); @@ -157,10 +156,7 @@ static int routing_policy_rule_compare_func(const void *_a, const void *_b) { } } -const struct hash_ops routing_policy_rule_hash_ops = { - .hash = routing_policy_rule_hash_func, - .compare = routing_policy_rule_compare_func -}; +DEFINE_PRIVATE_HASH_OPS(routing_policy_rule_hash_ops, RoutingPolicyRule, routing_policy_rule_hash_func, routing_policy_rule_compare_func); int routing_policy_rule_get(Manager *m, int family, @@ -281,8 +277,8 @@ static int routing_policy_rule_add_internal(Manager *m, rule->tos = tos; rule->fwmark = fwmark; rule->table = table; - rule->iif = iif; - rule->oif = oif; + rule->iif = TAKE_PTR(iif); + rule->oif = TAKE_PTR(oif); rule->protocol = protocol; rule->sport = *sport; rule->dport = *dport; @@ -298,9 +294,7 @@ static int routing_policy_rule_add_internal(Manager *m, if (ret) *ret = rule; - rule = NULL; - iif = oif = NULL; - + TAKE_PTR(rule); return 0; } @@ -341,8 +335,7 @@ int routing_policy_rule_add_foreign(Manager *m, return routing_policy_rule_add_internal(m, &m->rules_foreign, family, from, from_prefixlen, to, to_prefixlen, tos, fwmark, table, iif, oif, protocol, sport, dport, ret); } -static int routing_policy_rule_remove_handler(sd_netlink *rtnl, sd_netlink_message *m, void *userdata) { - Link *link = userdata; +static int routing_policy_rule_remove_handler(sd_netlink *rtnl, sd_netlink_message *m, Link *link) { int r; assert(m); @@ -361,7 +354,7 @@ static int routing_policy_rule_remove_handler(sd_netlink *rtnl, sd_netlink_messa return 1; } -int routing_policy_rule_remove(RoutingPolicyRule *routing_policy_rule, Link *link, sd_netlink_message_handler_t callback) { +int routing_policy_rule_remove(RoutingPolicyRule *routing_policy_rule, Link *link, link_netlink_message_handler_t callback) { _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL; int r; @@ -376,12 +369,8 @@ int routing_policy_rule_remove(RoutingPolicyRule *routing_policy_rule, Link *lin if (r < 0) return log_error_errno(r, "Could not allocate RTM_DELRULE message: %m"); - if (!in_addr_is_null(routing_policy_rule->family, &routing_policy_rule->from)) { - if (routing_policy_rule->family == AF_INET) - r = sd_netlink_message_append_in_addr(m, FRA_SRC, &routing_policy_rule->from.in); - else - r = sd_netlink_message_append_in6_addr(m, FRA_SRC, &routing_policy_rule->from.in6); - + if (in_addr_is_null(routing_policy_rule->family, &routing_policy_rule->from) == 0) { + r = netlink_message_append_in_addr_union(m, FRA_SRC, routing_policy_rule->family, &routing_policy_rule->from); if (r < 0) return log_error_errno(r, "Could not append FRA_SRC attribute: %m"); @@ -390,12 +379,8 @@ int routing_policy_rule_remove(RoutingPolicyRule *routing_policy_rule, Link *lin return log_error_errno(r, "Could not set source prefix length: %m"); } - if (!in_addr_is_null(routing_policy_rule->family, &routing_policy_rule->to)) { - if (routing_policy_rule->family == AF_INET) - r = sd_netlink_message_append_in_addr(m, FRA_DST, &routing_policy_rule->to.in); - else - r = sd_netlink_message_append_in6_addr(m, FRA_DST, &routing_policy_rule->to.in6); - + if (in_addr_is_null(routing_policy_rule->family, &routing_policy_rule->to) == 0) { + r = netlink_message_append_in_addr_union(m, FRA_DST, routing_policy_rule->family, &routing_policy_rule->to); if (r < 0) return log_error_errno(r, "Could not append FRA_DST attribute: %m"); @@ -404,8 +389,9 @@ int routing_policy_rule_remove(RoutingPolicyRule *routing_policy_rule, Link *lin return log_error_errno(r, "Could not set destination prefix length: %m"); } - r = sd_netlink_call_async(link->manager->rtnl, NULL, m, callback, - link_netlink_destroy_callback, link, 0, __func__); + r = netlink_call_async(link->manager->rtnl, NULL, m, + callback ?: routing_policy_rule_remove_handler, + link_netlink_destroy_callback, link); if (r < 0) return log_error_errno(r, "Could not send rtnetlink message: %m"); @@ -461,8 +447,7 @@ static int routing_policy_rule_new_static(Network *network, const char *filename return 0; } -int link_routing_policy_rule_handler(sd_netlink *rtnl, sd_netlink_message *m, void *userdata) { - Link *link = userdata; +static int routing_policy_rule_handler(sd_netlink *rtnl, sd_netlink_message *m, Link *link) { int r; assert(rtnl); @@ -489,7 +474,7 @@ int link_routing_policy_rule_handler(sd_netlink *rtnl, sd_netlink_message *m, vo return 1; } -int routing_policy_rule_configure(RoutingPolicyRule *rule, Link *link, sd_netlink_message_handler_t callback, bool update) { +int routing_policy_rule_configure(RoutingPolicyRule *rule, Link *link, link_netlink_message_handler_t callback) { _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL; int r; @@ -499,16 +484,17 @@ int routing_policy_rule_configure(RoutingPolicyRule *rule, Link *link, sd_netlin assert(link->manager); assert(link->manager->rtnl); + if (rule->family == AF_INET6 && manager_sysctl_ipv6_enabled(link->manager) == 0) { + log_link_warning(link, "An IPv6 routing policy rule is requested, but IPv6 is disabled by sysctl, ignoring."); + return 0; + } + r = sd_rtnl_message_new_routing_policy_rule(link->manager->rtnl, &m, RTM_NEWRULE, rule->family); if (r < 0) return log_error_errno(r, "Could not allocate RTM_NEWRULE message: %m"); - if (!in_addr_is_null(rule->family, &rule->from)) { - if (rule->family == AF_INET) - r = sd_netlink_message_append_in_addr(m, FRA_SRC, &rule->from.in); - else - r = sd_netlink_message_append_in6_addr(m, FRA_SRC, &rule->from.in6); - + if (in_addr_is_null(rule->family, &rule->from) == 0) { + r = netlink_message_append_in_addr_union(m, FRA_SRC, rule->family, &rule->from); if (r < 0) return log_error_errno(r, "Could not append FRA_SRC attribute: %m"); @@ -517,12 +503,8 @@ int routing_policy_rule_configure(RoutingPolicyRule *rule, Link *link, sd_netlin return log_error_errno(r, "Could not set source prefix length: %m"); } - if (!in_addr_is_null(rule->family, &rule->to)) { - if (rule->family == AF_INET) - r = sd_netlink_message_append_in_addr(m, FRA_DST, &rule->to.in); - else - r = sd_netlink_message_append_in6_addr(m, FRA_DST, &rule->to.in6); - + if (in_addr_is_null(rule->family, &rule->to) == 0) { + r = netlink_message_append_in_addr_union(m, FRA_DST, rule->family, &rule->to); if (r < 0) return log_error_errno(r, "Could not append FRA_DST attribute: %m"); @@ -595,10 +577,17 @@ int routing_policy_rule_configure(RoutingPolicyRule *rule, Link *link, sd_netlin return log_error_errno(r, "Could not append FRA_DPORT_RANGE attribute: %m"); } + if (rule->invert_rule) { + r = sd_rtnl_message_routing_policy_rule_set_flags(m, FIB_RULE_INVERT); + if (r < 0) + return log_error_errno(r, "Could not append FIB_RULE_INVERT attribute: %m"); + } + rule->link = link; - r = sd_netlink_call_async(link->manager->rtnl, NULL, m, callback, - link_netlink_destroy_callback, link, 0, __func__); + r = netlink_call_async(link->manager->rtnl, NULL, m, + callback ?: routing_policy_rule_handler, + link_netlink_destroy_callback, link); if (r < 0) return log_error_errno(r, "Could not send rtnetlink message: %m"); @@ -609,7 +598,7 @@ int routing_policy_rule_configure(RoutingPolicyRule *rule, Link *link, sd_netlin if (r < 0) return log_error_errno(r, "Could not add rule: %m"); - return 0; + return 1; } static int parse_fwmark_fwmask(const char *s, uint32_t *fwmark, uint32_t *fwmask) { @@ -652,7 +641,7 @@ int config_parse_routing_policy_rule_tos( void *data, void *userdata) { - _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *n = NULL; + _cleanup_(routing_policy_rule_free_or_set_invalidp) RoutingPolicyRule *n = NULL; Network *network = userdata; int r; @@ -689,7 +678,7 @@ int config_parse_routing_policy_rule_priority( void *data, void *userdata) { - _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *n = NULL; + _cleanup_(routing_policy_rule_free_or_set_invalidp) RoutingPolicyRule *n = NULL; Network *network = userdata; int r; @@ -726,7 +715,7 @@ int config_parse_routing_policy_rule_table( void *data, void *userdata) { - _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *n = NULL; + _cleanup_(routing_policy_rule_free_or_set_invalidp) RoutingPolicyRule *n = NULL; Network *network = userdata; int r; @@ -763,7 +752,7 @@ int config_parse_routing_policy_rule_fwmark_mask( void *data, void *userdata) { - _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *n = NULL; + _cleanup_(routing_policy_rule_free_or_set_invalidp) RoutingPolicyRule *n = NULL; Network *network = userdata; int r; @@ -800,10 +789,10 @@ int config_parse_routing_policy_rule_prefix( void *data, void *userdata) { - _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *n = NULL; + _cleanup_(routing_policy_rule_free_or_set_invalidp) RoutingPolicyRule *n = NULL; Network *network = userdata; - union in_addr_union buffer; - uint8_t prefixlen; + union in_addr_union *buffer; + uint8_t *prefixlen; int r; assert(filename); @@ -816,24 +805,18 @@ int config_parse_routing_policy_rule_prefix( if (r < 0) return r; - r = in_addr_prefix_from_string(rvalue, AF_INET, &buffer, &prefixlen); - if (r < 0) { - r = in_addr_prefix_from_string(rvalue, AF_INET6, &buffer, &prefixlen); - if (r < 0) { - log_syntax(unit, LOG_ERR, filename, line, r, "RPDB rule prefix is invalid, ignoring assignment: %s", rvalue); - return 0; - } - - n->family = AF_INET6; - } else - n->family = AF_INET; - if (streq(lvalue, "To")) { - n->to = buffer; - n->to_prefixlen = prefixlen; + buffer = &n->to; + prefixlen = &n->to_prefixlen; } else { - n->from = buffer; - n->from_prefixlen = prefixlen; + buffer = &n->from; + prefixlen = &n->from_prefixlen; + } + + r = in_addr_prefix_from_string_auto(rvalue, &n->family, buffer, prefixlen); + if (r < 0) { + log_syntax(unit, LOG_ERR, filename, line, r, "RPDB rule prefix is invalid, ignoring assignment: %s", rvalue); + return 0; } n = NULL; @@ -853,7 +836,7 @@ int config_parse_routing_policy_rule_device( void *data, void *userdata) { - _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *n = NULL; + _cleanup_(routing_policy_rule_free_or_set_invalidp) RoutingPolicyRule *n = NULL; Network *network = userdata; int r; @@ -898,7 +881,7 @@ int config_parse_routing_policy_rule_port_range( const char *rvalue, void *data, void *userdata) { - _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *n = NULL; + _cleanup_(routing_policy_rule_free_or_set_invalidp) RoutingPolicyRule *n = NULL; Network *network = userdata; uint16_t low, high; int r; @@ -932,7 +915,7 @@ int config_parse_routing_policy_rule_port_range( return 0; } -int config_parse_routing_policy_rule_protocol( +int config_parse_routing_policy_rule_ip_protocol( const char *unit, const char *filename, unsigned line, @@ -944,7 +927,7 @@ int config_parse_routing_policy_rule_protocol( void *data, void *userdata) { - _cleanup_(routing_policy_rule_freep) RoutingPolicyRule *n = NULL; + _cleanup_(routing_policy_rule_free_or_set_invalidp) RoutingPolicyRule *n = NULL; Network *network = userdata; int r; @@ -958,18 +941,52 @@ int config_parse_routing_policy_rule_protocol( if (r < 0) return r; - r = socket_protocol_from_name(rvalue); + r = parse_ip_protocol(rvalue); if (r < 0) { - log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse routing policy rule protocol, ignoring: %s", rvalue); + log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse IP protocol '%s' for routing policy rule, ignoring: %m", rvalue); return 0; } - if (!IN_SET(r, IPPROTO_TCP, IPPROTO_UDP, IPPROTO_SCTP)) { - log_syntax(unit, LOG_ERR, filename, line, 0, "Invalid protocol '%s'. Protocol should be tcp/udp/sctp, ignoring", rvalue); + n->protocol = r; + + n = NULL; + + return 0; +} + +int config_parse_routing_policy_rule_invert( + const char *unit, + const char *filename, + unsigned line, + const char *section, + unsigned section_line, + const char *lvalue, + int ltype, + const char *rvalue, + void *data, + void *userdata) { + + _cleanup_(routing_policy_rule_free_or_set_invalidp) RoutingPolicyRule *n = NULL; + Network *network = userdata; + int r; + + assert(filename); + assert(section); + assert(lvalue); + assert(rvalue); + assert(data); + + r = routing_policy_rule_new_static(network, filename, section_line, &n); + if (r < 0) + return r; + + r = parse_boolean(rvalue); + if (r < 0) { + log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse RPDB rule invert, ignoring: %s", rvalue); return 0; } - n->protocol = r; + n->invert_rule = r; n = NULL; @@ -1066,14 +1083,14 @@ int routing_policy_serialize_rules(Set *rules, FILE *f) { } if (rule->sport.start != 0 || rule->sport.end != 0) { - fprintf(f, "%ssourcesport=%hhu-%hhu", + fprintf(f, "%ssourcesport=%"PRIu16"-%"PRIu16, space ? " " : "", rule->sport.start, rule->sport.end); space = true; } if (rule->dport.start != 0 || rule->dport.end != 0) { - fprintf(f, "%sdestinationport=%hhu-%hhu", + fprintf(f, "%sdestinationport=%"PRIu16"-%"PRIu16, space ? " " : "", rule->dport.start, rule->dport.end); space = true; @@ -1123,8 +1140,6 @@ int routing_policy_load_rules(const char *state_file, Set **rules) { for (;;) { _cleanup_free_ char *word = NULL, *a = NULL, *b = NULL; - union in_addr_union buffer; - uint8_t prefixlen; r = extract_first_word(&p, &word, NULL, 0); if (r < 0) @@ -1137,26 +1152,23 @@ int routing_policy_load_rules(const char *state_file, Set **rules) { continue; if (STR_IN_SET(a, "from", "to")) { - - r = in_addr_prefix_from_string(b, AF_INET, &buffer, &prefixlen); - if (r < 0) { - r = in_addr_prefix_from_string(b, AF_INET6, &buffer, &prefixlen); - if (r < 0) { - log_error_errno(r, "RPDB rule prefix is invalid, ignoring assignment: %s", b); - continue; - } - - rule->family = AF_INET6; - } else - rule->family = AF_INET; + union in_addr_union *buffer; + uint8_t *prefixlen; if (streq(a, "to")) { - rule->to = buffer; - rule->to_prefixlen = prefixlen; + buffer = &rule->to; + prefixlen = &rule->to_prefixlen; } else { - rule->from = buffer; - rule->from_prefixlen = prefixlen; + buffer = &rule->from; + prefixlen = &rule->from_prefixlen; } + + r = in_addr_prefix_from_string_auto(b, &rule->family, buffer, prefixlen); + if (r < 0) { + log_error_errno(r, "RPDB rule prefix is invalid, ignoring assignment: %s", b); + continue; + } + } else if (streq(a, "tos")) { r = safe_atou8(b, &rule->tos); if (r < 0) { @@ -1227,6 +1239,26 @@ int routing_policy_load_rules(const char *state_file, Set **rules) { return 0; } +static bool manager_links_have_routing_policy_rule(Manager *m, RoutingPolicyRule *rule) { + RoutingPolicyRule *link_rule; + Iterator i; + Link *link; + + assert(m); + assert(rule); + + HASHMAP_FOREACH(link, m->links, i) { + if (!link->network) + continue; + + LIST_FOREACH(rules, link_rule, link->network->rules) + if (routing_policy_rule_compare_func(link_rule, rule) == 0) + return true; + } + + return false; +} + void routing_policy_rule_purge(Manager *m, Link *link) { RoutingPolicyRule *rule, *existing; Iterator i; @@ -1237,15 +1269,24 @@ void routing_policy_rule_purge(Manager *m, Link *link) { SET_FOREACH(rule, m->rules_saved, i) { existing = set_get(m->rules_foreign, rule); - if (existing) { + if (!existing) + continue; /* Saved rule does not exist anymore. */ - r = routing_policy_rule_remove(rule, link, routing_policy_rule_remove_handler); - if (r < 0) { - log_warning_errno(r, "Could not remove routing policy rules: %m"); - continue; - } + if (manager_links_have_routing_policy_rule(m, existing)) + continue; /* Existing links have the saved rule. */ - link->routing_policy_rule_remove_messages++; + /* Existing links do not have the saved rule. Let's drop the rule now, and re-configure it + * later when it is requested. */ + + r = routing_policy_rule_remove(existing, link, NULL); + if (r < 0) { + log_warning_errno(r, "Could not remove routing policy rules: %m"); + continue; } + + link->routing_policy_rule_remove_messages++; + + assert_se(set_remove(m->rules_foreign, existing) == existing); + routing_policy_rule_free(existing); } }