ip/iprule.c

   1 /*
   2  * iprule.c             "ip rule".
   3  *
   4  *              This program is free software; you can redistribute it and/or
   5  *              modify it under the terms of the GNU General Public License
   6  *              as published by the Free Software Foundation; either version
   7  *              2 of the License, or (at your option) any later version.
   8  *
   9  * Authors:     Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
  10  *
  11  */
  12
  13 #include <stdio.h>
  14 #include <stdlib.h>
  15 #include <unistd.h>
  16 #include <syslog.h>
  17 #include <fcntl.h>
  18 #include <sys/socket.h>
  19 #include <netinet/in.h>
  20 #include <netinet/ip.h>
  21 #include <arpa/inet.h>
  22 #include <string.h>
  23 #include <linux/fib_rules.h>
  24 #include <errno.h>
  25
  26 #include "rt_names.h"
  27 #include "utils.h"
  28 #include "ip_common.h"
  29
  30 extern struct rtnl_handle rth;
  31
  32 static void usage(void) __attribute__((noreturn));
  33
  34 static void usage(void)
  35 {
  36         fprintf(stderr, "Usage: ip rule { add | del } SELECTOR ACTION\n");
  37         fprintf(stderr, "       ip rule { flush | save | restore }\n");
  38         fprintf(stderr, "       ip rule [ list ]\n");
  39         fprintf(stderr, "SELECTOR := [ not ] [ from PREFIX ] [ to PREFIX ] [ tos TOS ] [ fwmark FWMARK[/MASK] ]\n");
  40         fprintf(stderr, "            [ iif STRING ] [ oif STRING ] [ pref NUMBER ]\n");
  41         fprintf(stderr, "ACTION := [ table TABLE_ID ]\n");
  42         fprintf(stderr, "          [ nat ADDRESS ]\n");
  43         fprintf(stderr, "          [ realms [SRCREALM/]DSTREALM ]\n");
  44         fprintf(stderr, "          [ goto NUMBER ]\n");
  45         fprintf(stderr, "          SUPPRESSOR\n");
  46         fprintf(stderr, "SUPPRESSOR := [ suppress_prefixlength NUMBER ]\n");
  47         fprintf(stderr, "              [ suppress_ifgroup DEVGROUP ]\n");
  48         fprintf(stderr, "TABLE_ID := [ local | main | default | NUMBER ]\n");
  49         exit(-1);
  50 }
  51
  52 int print_rule(const struct sockaddr_nl *who, struct nlmsghdr *n, void *arg)
  53 {
  54         FILE *fp = (FILE *)arg;
  55         struct rtmsg *r = NLMSG_DATA(n);
  56         int len = n->nlmsg_len;
  57         int host_len = -1;
  58         __u32 table;
  59         struct rtattr *tb[FRA_MAX+1];
  60         SPRINT_BUF(b1);
  61
  62         if (n->nlmsg_type != RTM_NEWRULE && n->nlmsg_type != RTM_DELRULE)
  63                 return 0;
  64
  65         len -= NLMSG_LENGTH(sizeof(*r));
  66         if (len < 0)
  67                 return -1;
  68
  69         parse_rtattr(tb, FRA_MAX, RTM_RTA(r), len);
  70
  71         host_len = af_bit_len(r->rtm_family);
  72
  73         if (n->nlmsg_type == RTM_DELRULE)
  74                 fprintf(fp, "Deleted ");
  75
  76         if (tb[FRA_PRIORITY])
  77                 fprintf(fp, "%u:\t", *(unsigned *)RTA_DATA(tb[FRA_PRIORITY]));
  78         else
  79                 fprintf(fp, "0:\t");
  80
  81         if (r->rtm_flags & FIB_RULE_INVERT)
  82                 fprintf(fp, "not ");
  83
  84         if (tb[FRA_SRC]) {
  85                 if (r->rtm_src_len != host_len) {
  86                         fprintf(fp, "from %s/%u ",
  87                                 rt_addr_n2a_rta(r->rtm_family, tb[FRA_SRC]),
  88                                 r->rtm_src_len);
  89                 } else {
  90                         fprintf(fp, "from %s ",
  91                                 format_host_rta(r->rtm_family, tb[FRA_SRC]));
  92                 }
  93         } else if (r->rtm_src_len) {
  94                 fprintf(fp, "from 0/%d ", r->rtm_src_len);
  95         } else {
  96                 fprintf(fp, "from all ");
  97         }
  98
  99         if (tb[FRA_DST]) {
 100                 if (r->rtm_dst_len != host_len) {
 101                         fprintf(fp, "to %s/%u ",
 102                                 rt_addr_n2a_rta(r->rtm_family, tb[FRA_DST]),
 103                                 r->rtm_dst_len);
 104                 } else {
 105                         fprintf(fp, "to %s ",
 106                                 format_host_rta(r->rtm_family, tb[FRA_DST]));
 107                 }
 108         } else if (r->rtm_dst_len) {
 109                 fprintf(fp, "to 0/%d ", r->rtm_dst_len);
 110         }
 111
 112         if (r->rtm_tos) {
 113                 SPRINT_BUF(b1);
 114                 fprintf(fp, "tos %s ", rtnl_dsfield_n2a(r->rtm_tos, b1, sizeof(b1)));
 115         }
 116
 117         if (tb[FRA_FWMARK] || tb[FRA_FWMASK]) {
 118                 __u32 mark = 0, mask = 0;
 119
 120                 if (tb[FRA_FWMARK])
 121                         mark = rta_getattr_u32(tb[FRA_FWMARK]);
 122
 123                 if (tb[FRA_FWMASK] &&
 124                     (mask = rta_getattr_u32(tb[FRA_FWMASK])) != 0xFFFFFFFF)
 125                         fprintf(fp, "fwmark 0x%x/0x%x ", mark, mask);
 126                 else
 127                         fprintf(fp, "fwmark 0x%x ", mark);
 128         }
 129
 130         if (tb[FRA_IFNAME]) {
 131                 fprintf(fp, "iif %s ", rta_getattr_str(tb[FRA_IFNAME]));
 132                 if (r->rtm_flags & FIB_RULE_IIF_DETACHED)
 133                         fprintf(fp, "[detached] ");
 134         }
 135
 136         if (tb[FRA_OIFNAME]) {
 137                 fprintf(fp, "oif %s ", rta_getattr_str(tb[FRA_OIFNAME]));
 138                 if (r->rtm_flags & FIB_RULE_OIF_DETACHED)
 139                         fprintf(fp, "[detached] ");
 140         }
 141
 142         table = rtm_get_table(r, tb);
 143         if (table) {
 144                 fprintf(fp, "lookup %s ", rtnl_rttable_n2a(table, b1, sizeof(b1)));
 145
 146                 if (tb[FRA_SUPPRESS_PREFIXLEN]) {
 147                         int pl = rta_getattr_u32(tb[FRA_SUPPRESS_PREFIXLEN]);
 148
 149                         if (pl != -1) {
 150                                 fprintf(fp, "suppress_prefixlength %d ", pl);
 151                         }
 152                 }
 153                 if (tb[FRA_SUPPRESS_IFGROUP]) {
 154                         int group = rta_getattr_u32(tb[FRA_SUPPRESS_IFGROUP]);
 155
 156                         if (group != -1) {
 157                                 SPRINT_BUF(b1);
 158                                 fprintf(fp, "suppress_ifgroup %s ", rtnl_group_n2a(group, b1, sizeof(b1)));
 159                         }
 160                 }
 161         }
 162
 163         if (tb[FRA_FLOW]) {
 164                 __u32 to = rta_getattr_u32(tb[FRA_FLOW]);
 165                 __u32 from = to>>16;
 166
 167                 to &= 0xFFFF;
 168                 if (from) {
 169                         fprintf(fp, "realms %s/",
 170                                 rtnl_rtrealm_n2a(from, b1, sizeof(b1)));
 171                 }
 172                 fprintf(fp, "%s ",
 173                         rtnl_rtrealm_n2a(to, b1, sizeof(b1)));
 174         }
 175
 176         if (r->rtm_type == RTN_NAT) {
 177                 if (tb[RTA_GATEWAY]) {
 178                         fprintf(fp, "map-to %s ",
 179                                 format_host_rta(r->rtm_family,
 180                                                 tb[RTA_GATEWAY]));
 181                 } else
 182                         fprintf(fp, "masquerade");
 183         } else if (r->rtm_type == FR_ACT_GOTO) {
 184                 fprintf(fp, "goto ");
 185                 if (tb[FRA_GOTO])
 186                         fprintf(fp, "%u", rta_getattr_u32(tb[FRA_GOTO]));
 187                 else
 188                         fprintf(fp, "none");
 189                 if (r->rtm_flags & FIB_RULE_UNRESOLVED)
 190                         fprintf(fp, " [unresolved]");
 191         } else if (r->rtm_type == FR_ACT_NOP)
 192                 fprintf(fp, "nop");
 193         else if (r->rtm_type != RTN_UNICAST)
 194                 fprintf(fp, "%s", rtnl_rtntype_n2a(r->rtm_type, b1, sizeof(b1)));
 195
 196         fprintf(fp, "\n");
 197         fflush(fp);
 198         return 0;
 199 }
 200
 201 static __u32 rule_dump_magic = 0x71706986;
 202
 203 static int save_rule_prep(void)
 204 {
 205         int ret;
 206
 207         if (isatty(STDOUT_FILENO)) {
 208                 fprintf(stderr, "Not sending a binary stream to stdout\n");
 209                 return -1;
 210         }
 211
 212         ret = write(STDOUT_FILENO, &rule_dump_magic, sizeof(rule_dump_magic));
 213         if (ret != sizeof(rule_dump_magic)) {
 214                 fprintf(stderr, "Can't write magic to dump file\n");
 215                 return -1;
 216         }
 217
 218         return 0;
 219 }
 220
 221 static int save_rule(const struct sockaddr_nl *who, struct nlmsghdr *n, void *arg)
 222 {
 223         int ret;
 224
 225         ret = write(STDOUT_FILENO, n, n->nlmsg_len);
 226         if ((ret > 0) && (ret != n->nlmsg_len)) {
 227                 fprintf(stderr, "Short write while saving nlmsg\n");
 228                 ret = -EIO;
 229         }
 230
 231         return ret == n->nlmsg_len ? 0 : ret;
 232 }
 233
 234 static int iprule_list_or_save(int argc, char **argv, int save)
 235 {
 236         rtnl_filter_t filter = print_rule;
 237         int af = preferred_family;
 238
 239         if (af == AF_UNSPEC)
 240                 af = AF_INET;
 241
 242         if (argc > 0) {
 243                 fprintf(stderr, "\"ip rule %s\" does not take any arguments.\n",
 244                                 save ? "save" : "show");
 245                 return -1;
 246         }
 247
 248         if (save) {
 249                 if (save_rule_prep())
 250                         return -1;
 251                 filter = save_rule;
 252         }
 253
 254         if (rtnl_wilddump_request(&rth, af, RTM_GETRULE) < 0) {
 255                 perror("Cannot send dump request");
 256                 return 1;
 257         }
 258
 259         if (rtnl_dump_filter(&rth, filter, stdout) < 0) {
 260                 fprintf(stderr, "Dump terminated\n");
 261                 return 1;
 262         }
 263
 264         return 0;
 265 }
 266
 267 static int rule_dump_check_magic(void)
 268 {
 269         int ret;
 270         __u32 magic = 0;
 271
 272         if (isatty(STDIN_FILENO)) {
 273                 fprintf(stderr, "Can't restore rule dump from a terminal\n");
 274                 return -1;
 275         }
 276
 277         ret = fread(&magic, sizeof(magic), 1, stdin);
 278         if (magic != rule_dump_magic) {
 279                 fprintf(stderr, "Magic mismatch (%d elems, %x magic)\n", ret, magic);
 280                 return -1;
 281         }
 282
 283         return 0;
 284 }
 285
 286 static int restore_handler(const struct sockaddr_nl *nl,
 287                            struct rtnl_ctrl_data *ctrl,
 288                            struct nlmsghdr *n, void *arg)
 289 {
 290         int ret;
 291
 292         n->nlmsg_flags |= NLM_F_REQUEST | NLM_F_CREATE | NLM_F_ACK;
 293
 294         ll_init_map(&rth);
 295
 296         ret = rtnl_talk(&rth, n, n, sizeof(*n));
 297         if ((ret < 0) && (errno == EEXIST))
 298                 ret = 0;
 299
 300         return ret;
 301 }
 302
 303
 304 static int iprule_restore(void)
 305 {
 306         if (rule_dump_check_magic())
 307                 exit(-1);
 308
 309         exit(rtnl_from_file(stdin, &restore_handler, NULL));
 310 }
 311
 312 static int iprule_modify(int cmd, int argc, char **argv)
 313 {
 314         int table_ok = 0;
 315         struct {
 316                 struct nlmsghdr n;
 317                 struct rtmsg            r;
 318                 char                    buf[1024];
 319         } req = {
 320                 .n.nlmsg_type = cmd,
 321                 .n.nlmsg_len = NLMSG_LENGTH(sizeof(struct rtmsg)),
 322                 .n.nlmsg_flags = NLM_F_REQUEST,
 323                 .r.rtm_family = preferred_family,
 324                 .r.rtm_protocol = RTPROT_BOOT,
 325                 .r.rtm_scope = RT_SCOPE_UNIVERSE,
 326                 .r.rtm_type = RTN_UNSPEC,
 327         };
 328
 329         if (cmd == RTM_NEWRULE) {
 330                 req.n.nlmsg_flags |= NLM_F_CREATE|NLM_F_EXCL;
 331                 req.r.rtm_type = RTN_UNICAST;
 332         }
 333
 334         while (argc > 0) {
 335                 if (strcmp(*argv, "not") == 0) {
 336                         req.r.rtm_flags |= FIB_RULE_INVERT;
 337                 } else if (strcmp(*argv, "from") == 0) {
 338                         inet_prefix dst;
 339
 340                         NEXT_ARG();
 341                         get_prefix(&dst, *argv, req.r.rtm_family);
 342                         req.r.rtm_src_len = dst.bitlen;
 343                         addattr_l(&req.n, sizeof(req), FRA_SRC, &dst.data, dst.bytelen);
 344                 } else if (strcmp(*argv, "to") == 0) {
 345                         inet_prefix dst;
 346
 347                         NEXT_ARG();
 348                         get_prefix(&dst, *argv, req.r.rtm_family);
 349                         req.r.rtm_dst_len = dst.bitlen;
 350                         addattr_l(&req.n, sizeof(req), FRA_DST, &dst.data, dst.bytelen);
 351                 } else if (matches(*argv, "preference") == 0 ||
 352                            matches(*argv, "order") == 0 ||
 353                            matches(*argv, "priority") == 0) {
 354                         __u32 pref;
 355
 356                         NEXT_ARG();
 357                         if (get_u32(&pref, *argv, 0))
 358                                 invarg("preference value is invalid\n", *argv);
 359                         addattr32(&req.n, sizeof(req), FRA_PRIORITY, pref);
 360                 } else if (strcmp(*argv, "tos") == 0 ||
 361                            matches(*argv, "dsfield") == 0) {
 362                         __u32 tos;
 363
 364                         NEXT_ARG();
 365                         if (rtnl_dsfield_a2n(&tos, *argv))
 366                                 invarg("TOS value is invalid\n", *argv);
 367                         req.r.rtm_tos = tos;
 368                 } else if (strcmp(*argv, "fwmark") == 0) {
 369                         char *slash;
 370                         __u32 fwmark, fwmask;
 371
 372                         NEXT_ARG();
 373                         if ((slash = strchr(*argv, '/')) != NULL)
 374                                 *slash = '\0';
 375                         if (get_u32(&fwmark, *argv, 0))
 376                                 invarg("fwmark value is invalid\n", *argv);
 377                         addattr32(&req.n, sizeof(req), FRA_FWMARK, fwmark);
 378                         if (slash) {
 379                                 if (get_u32(&fwmask, slash+1, 0))
 380                                         invarg("fwmask value is invalid\n", slash+1);
 381                                 addattr32(&req.n, sizeof(req), FRA_FWMASK, fwmask);
 382                         }
 383                 } else if (matches(*argv, "realms") == 0) {
 384                         __u32 realm;
 385
 386                         NEXT_ARG();
 387                         if (get_rt_realms_or_raw(&realm, *argv))
 388                                 invarg("invalid realms\n", *argv);
 389                         addattr32(&req.n, sizeof(req), FRA_FLOW, realm);
 390                 } else if (matches(*argv, "table") == 0 ||
 391                            strcmp(*argv, "lookup") == 0) {
 392                         __u32 tid;
 393
 394                         NEXT_ARG();
 395                         if (rtnl_rttable_a2n(&tid, *argv))
 396                                 invarg("invalid table ID\n", *argv);
 397                         if (tid < 256)
 398                                 req.r.rtm_table = tid;
 399                         else {
 400                                 req.r.rtm_table = RT_TABLE_UNSPEC;
 401                                 addattr32(&req.n, sizeof(req), FRA_TABLE, tid);
 402                         }
 403                         table_ok = 1;
 404                 } else if (matches(*argv, "suppress_prefixlength") == 0 ||
 405                            strcmp(*argv, "sup_pl") == 0) {
 406                         int pl;
 407
 408                         NEXT_ARG();
 409                         if (get_s32(&pl, *argv, 0) || pl < 0)
 410                                 invarg("suppress_prefixlength value is invalid\n", *argv);
 411                         addattr32(&req.n, sizeof(req), FRA_SUPPRESS_PREFIXLEN, pl);
 412                 } else if (matches(*argv, "suppress_ifgroup") == 0 ||
 413                            strcmp(*argv, "sup_group") == 0) {
 414                         NEXT_ARG();
 415                         int group;
 416
 417                         if (rtnl_group_a2n(&group, *argv))
 418                                 invarg("Invalid \"suppress_ifgroup\" value\n", *argv);
 419                         addattr32(&req.n, sizeof(req), FRA_SUPPRESS_IFGROUP, group);
 420                 } else if (strcmp(*argv, "dev") == 0 ||
 421                            strcmp(*argv, "iif") == 0) {
 422                         NEXT_ARG();
 423                         addattr_l(&req.n, sizeof(req), FRA_IFNAME, *argv, strlen(*argv)+1);
 424                 } else if (strcmp(*argv, "oif") == 0) {
 425                         NEXT_ARG();
 426                         addattr_l(&req.n, sizeof(req), FRA_OIFNAME, *argv, strlen(*argv)+1);
 427                 } else if (strcmp(*argv, "nat") == 0 ||
 428                            matches(*argv, "map-to") == 0) {
 429                         NEXT_ARG();
 430                         fprintf(stderr, "Warning: route NAT is deprecated\n");
 431                         addattr32(&req.n, sizeof(req), RTA_GATEWAY, get_addr32(*argv));
 432                         req.r.rtm_type = RTN_NAT;
 433                 } else {
 434                         int type;
 435
 436                         if (strcmp(*argv, "type") == 0) {
 437                                 NEXT_ARG();
 438                         }
 439                         if (matches(*argv, "help") == 0)
 440                                 usage();
 441                         else if (matches(*argv, "goto") == 0) {
 442                                 __u32 target;
 443
 444                                 type = FR_ACT_GOTO;
 445                                 NEXT_ARG();
 446                                 if (get_u32(&target, *argv, 0))
 447                                         invarg("invalid target\n", *argv);
 448                                 addattr32(&req.n, sizeof(req), FRA_GOTO, target);
 449                         } else if (matches(*argv, "nop") == 0)
 450                                 type = FR_ACT_NOP;
 451                         else if (rtnl_rtntype_a2n(&type, *argv))
 452                                 invarg("Failed to parse rule type", *argv);
 453                         req.r.rtm_type = type;
 454                         table_ok = 1;
 455                 }
 456                 argc--;
 457                 argv++;
 458         }
 459
 460         if (req.r.rtm_family == AF_UNSPEC)
 461                 req.r.rtm_family = AF_INET;
 462
 463         if (!table_ok && cmd == RTM_NEWRULE)
 464                 req.r.rtm_table = RT_TABLE_MAIN;
 465
 466         if (rtnl_talk(&rth, &req.n, NULL, 0) < 0)
 467                 return -2;
 468
 469         return 0;
 470 }
 471
 472
 473 static int flush_rule(const struct sockaddr_nl *who, struct nlmsghdr *n, void *arg)
 474 {
 475         struct rtnl_handle rth2;
 476         struct rtmsg *r = NLMSG_DATA(n);
 477         int len = n->nlmsg_len;
 478         struct rtattr *tb[FRA_MAX+1];
 479
 480         len -= NLMSG_LENGTH(sizeof(*r));
 481         if (len < 0)
 482                 return -1;
 483
 484         parse_rtattr(tb, FRA_MAX, RTM_RTA(r), len);
 485
 486         if (tb[FRA_PRIORITY]) {
 487                 n->nlmsg_type = RTM_DELRULE;
 488                 n->nlmsg_flags = NLM_F_REQUEST;
 489
 490                 if (rtnl_open(&rth2, 0) < 0)
 491                         return -1;
 492
 493                 if (rtnl_talk(&rth2, n, NULL, 0) < 0)
 494                         return -2;
 495
 496                 rtnl_close(&rth2);
 497         }
 498
 499         return 0;
 500 }
 501
 502 static int iprule_flush(int argc, char **argv)
 503 {
 504         int af = preferred_family;
 505
 506         if (af == AF_UNSPEC)
 507                 af = AF_INET;
 508
 509         if (argc > 0) {
 510                 fprintf(stderr, "\"ip rule flush\" does not allow arguments\n");
 511                 return -1;
 512         }
 513
 514         if (rtnl_wilddump_request(&rth, af, RTM_GETRULE) < 0) {
 515                 perror("Cannot send dump request");
 516                 return 1;
 517         }
 518
 519         if (rtnl_dump_filter(&rth, flush_rule, NULL) < 0) {
 520                 fprintf(stderr, "Flush terminated\n");
 521                 return 1;
 522         }
 523
 524         return 0;
 525 }
 526
 527 int do_iprule(int argc, char **argv)
 528 {
 529         if (argc < 1) {
 530                 return iprule_list_or_save(0, NULL, 0);
 531         } else if (matches(argv[0], "list") == 0 ||
 532                    matches(argv[0], "lst") == 0 ||
 533                    matches(argv[0], "show") == 0) {
 534                 return iprule_list_or_save(argc-1, argv+1, 0);
 535         } else if (matches(argv[0], "save") == 0) {
 536                 return iprule_list_or_save(argc-1, argv+1, 1);
 537         } else if (matches(argv[0], "restore") == 0) {
 538                 return iprule_restore();
 539         } else if (matches(argv[0], "add") == 0) {
 540                 return iprule_modify(RTM_NEWRULE, argc-1, argv+1);
 541         } else if (matches(argv[0], "delete") == 0) {
 542                 return iprule_modify(RTM_DELRULE, argc-1, argv+1);
 543         } else if (matches(argv[0], "flush") == 0) {
 544                 return iprule_flush(argc-1, argv+1);
 545         } else if (matches(argv[0], "help") == 0)
 546                 usage();
 547
 548         fprintf(stderr, "Command \"%s\" is unknown, try \"ip rule help\".\n", *argv);
 549         exit(-1);
 550 }
 551
 552 int do_multirule(int argc, char **argv)
 553 {
 554         switch (preferred_family) {
 555         case AF_UNSPEC:
 556         case AF_INET:
 557                 preferred_family = RTNL_FAMILY_IPMR;
 558                 break;
 559         case AF_INET6:
 560                 preferred_family = RTNL_FAMILY_IP6MR;
 561                 break;
 562         case RTNL_FAMILY_IPMR:
 563         case RTNL_FAMILY_IP6MR:
 564                 break;
 565         default:
 566                 fprintf(stderr, "Multicast rules are only supported for IPv4/IPv6, was: %i\n",
 567                         preferred_family);
 568                 exit(-1);
 569         }
 570
 571         return do_iprule(argc, argv);
 572 }