]> git.proxmox.com Git - mirror_iproute2.git/blob - ip/iprule.c
Merge branch 'master' into net-next
[mirror_iproute2.git] / ip / iprule.c
1 /*
2 * iprule.c "ip rule".
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version
7 * 2 of the License, or (at your option) any later version.
8 *
9 * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
10 *
11 */
12
13 #include <stdio.h>
14 #include <stdlib.h>
15 #include <unistd.h>
16 #include <syslog.h>
17 #include <fcntl.h>
18 #include <sys/socket.h>
19 #include <netinet/in.h>
20 #include <netinet/ip.h>
21 #include <arpa/inet.h>
22 #include <string.h>
23 #include <linux/fib_rules.h>
24 #include <errno.h>
25
26 #include "rt_names.h"
27 #include "utils.h"
28 #include "ip_common.h"
29
30 extern struct rtnl_handle rth;
31
32 static void usage(void) __attribute__((noreturn));
33
34 static void usage(void)
35 {
36 fprintf(stderr, "Usage: ip rule { add | del } SELECTOR ACTION\n");
37 fprintf(stderr, " ip rule { flush | save | restore }\n");
38 fprintf(stderr, " ip rule [ list ]\n");
39 fprintf(stderr, "SELECTOR := [ not ] [ from PREFIX ] [ to PREFIX ] [ tos TOS ] [ fwmark FWMARK[/MASK] ]\n");
40 fprintf(stderr, " [ iif STRING ] [ oif STRING ] [ pref NUMBER ]\n");
41 fprintf(stderr, "ACTION := [ table TABLE_ID ]\n");
42 fprintf(stderr, " [ nat ADDRESS ]\n");
43 fprintf(stderr, " [ realms [SRCREALM/]DSTREALM ]\n");
44 fprintf(stderr, " [ goto NUMBER ]\n");
45 fprintf(stderr, " SUPPRESSOR\n");
46 fprintf(stderr, "SUPPRESSOR := [ suppress_prefixlength NUMBER ]\n");
47 fprintf(stderr, " [ suppress_ifgroup DEVGROUP ]\n");
48 fprintf(stderr, "TABLE_ID := [ local | main | default | NUMBER ]\n");
49 exit(-1);
50 }
51
52 int print_rule(const struct sockaddr_nl *who, struct nlmsghdr *n, void *arg)
53 {
54 FILE *fp = (FILE*)arg;
55 struct rtmsg *r = NLMSG_DATA(n);
56 int len = n->nlmsg_len;
57 int host_len = -1;
58 __u32 table;
59 struct rtattr * tb[FRA_MAX+1];
60 char abuf[256];
61 SPRINT_BUF(b1);
62
63 if (n->nlmsg_type != RTM_NEWRULE && n->nlmsg_type != RTM_DELRULE)
64 return 0;
65
66 len -= NLMSG_LENGTH(sizeof(*r));
67 if (len < 0)
68 return -1;
69
70 parse_rtattr(tb, FRA_MAX, RTM_RTA(r), len);
71
72 host_len = af_bit_len(r->rtm_family);
73
74 if (n->nlmsg_type == RTM_DELRULE)
75 fprintf(fp, "Deleted ");
76
77 if (tb[FRA_PRIORITY])
78 fprintf(fp, "%u:\t", *(unsigned*)RTA_DATA(tb[FRA_PRIORITY]));
79 else
80 fprintf(fp, "0:\t");
81
82 if (r->rtm_flags & FIB_RULE_INVERT)
83 fprintf(fp, "not ");
84
85 if (tb[FRA_SRC]) {
86 if (r->rtm_src_len != host_len) {
87 fprintf(fp, "from %s/%u ", rt_addr_n2a(r->rtm_family,
88 RTA_PAYLOAD(tb[FRA_SRC]),
89 RTA_DATA(tb[FRA_SRC]),
90 abuf, sizeof(abuf)),
91 r->rtm_src_len
92 );
93 } else {
94 fprintf(fp, "from %s ", format_host(r->rtm_family,
95 RTA_PAYLOAD(tb[FRA_SRC]),
96 RTA_DATA(tb[FRA_SRC]),
97 abuf, sizeof(abuf))
98 );
99 }
100 } else if (r->rtm_src_len) {
101 fprintf(fp, "from 0/%d ", r->rtm_src_len);
102 } else {
103 fprintf(fp, "from all ");
104 }
105
106 if (tb[FRA_DST]) {
107 if (r->rtm_dst_len != host_len) {
108 fprintf(fp, "to %s/%u ", rt_addr_n2a(r->rtm_family,
109 RTA_PAYLOAD(tb[FRA_DST]),
110 RTA_DATA(tb[FRA_DST]),
111 abuf, sizeof(abuf)),
112 r->rtm_dst_len
113 );
114 } else {
115 fprintf(fp, "to %s ", format_host(r->rtm_family,
116 RTA_PAYLOAD(tb[FRA_DST]),
117 RTA_DATA(tb[FRA_DST]),
118 abuf, sizeof(abuf)));
119 }
120 } else if (r->rtm_dst_len) {
121 fprintf(fp, "to 0/%d ", r->rtm_dst_len);
122 }
123
124 if (r->rtm_tos) {
125 SPRINT_BUF(b1);
126 fprintf(fp, "tos %s ", rtnl_dsfield_n2a(r->rtm_tos, b1, sizeof(b1)));
127 }
128
129 if (tb[FRA_FWMARK] || tb[FRA_FWMASK]) {
130 __u32 mark = 0, mask = 0;
131
132 if (tb[FRA_FWMARK])
133 mark = rta_getattr_u32(tb[FRA_FWMARK]);
134
135 if (tb[FRA_FWMASK] &&
136 (mask = rta_getattr_u32(tb[FRA_FWMASK])) != 0xFFFFFFFF)
137 fprintf(fp, "fwmark 0x%x/0x%x ", mark, mask);
138 else
139 fprintf(fp, "fwmark 0x%x ", mark);
140 }
141
142 if (tb[FRA_IFNAME]) {
143 fprintf(fp, "iif %s ", rta_getattr_str(tb[FRA_IFNAME]));
144 if (r->rtm_flags & FIB_RULE_IIF_DETACHED)
145 fprintf(fp, "[detached] ");
146 }
147
148 if (tb[FRA_OIFNAME]) {
149 fprintf(fp, "oif %s ", rta_getattr_str(tb[FRA_OIFNAME]));
150 if (r->rtm_flags & FIB_RULE_OIF_DETACHED)
151 fprintf(fp, "[detached] ");
152 }
153
154 table = rtm_get_table(r, tb);
155 if (table) {
156 fprintf(fp, "lookup %s ", rtnl_rttable_n2a(table, b1, sizeof(b1)));
157
158 if (tb[FRA_SUPPRESS_PREFIXLEN]) {
159 int pl = rta_getattr_u32(tb[FRA_SUPPRESS_PREFIXLEN]);
160 if (pl != -1) {
161 fprintf(fp, "suppress_prefixlength %d ", pl);
162 }
163 }
164 if (tb[FRA_SUPPRESS_IFGROUP]) {
165 int group = rta_getattr_u32(tb[FRA_SUPPRESS_IFGROUP]);
166 if (group != -1) {
167 SPRINT_BUF(b1);
168 fprintf(fp, "suppress_ifgroup %s ", rtnl_group_n2a(group, b1, sizeof(b1)));
169 }
170 }
171 }
172
173 if (tb[FRA_FLOW]) {
174 __u32 to = rta_getattr_u32(tb[FRA_FLOW]);
175 __u32 from = to>>16;
176 to &= 0xFFFF;
177 if (from) {
178 fprintf(fp, "realms %s/",
179 rtnl_rtrealm_n2a(from, b1, sizeof(b1)));
180 }
181 fprintf(fp, "%s ",
182 rtnl_rtrealm_n2a(to, b1, sizeof(b1)));
183 }
184
185 if (r->rtm_type == RTN_NAT) {
186 if (tb[RTA_GATEWAY]) {
187 fprintf(fp, "map-to %s ",
188 format_host(r->rtm_family,
189 RTA_PAYLOAD(tb[RTA_GATEWAY]),
190 RTA_DATA(tb[RTA_GATEWAY]),
191 abuf, sizeof(abuf)));
192 } else
193 fprintf(fp, "masquerade");
194 } else if (r->rtm_type == FR_ACT_GOTO) {
195 fprintf(fp, "goto ");
196 if (tb[FRA_GOTO])
197 fprintf(fp, "%u", rta_getattr_u32(tb[FRA_GOTO]));
198 else
199 fprintf(fp, "none");
200 if (r->rtm_flags & FIB_RULE_UNRESOLVED)
201 fprintf(fp, " [unresolved]");
202 } else if (r->rtm_type == FR_ACT_NOP)
203 fprintf(fp, "nop");
204 else if (r->rtm_type != RTN_UNICAST)
205 fprintf(fp, "%s", rtnl_rtntype_n2a(r->rtm_type, b1, sizeof(b1)));
206
207 fprintf(fp, "\n");
208 fflush(fp);
209 return 0;
210 }
211
212 static __u32 rule_dump_magic = 0x71706986;
213
214 static int save_rule_prep(void)
215 {
216 int ret;
217
218 if (isatty(STDOUT_FILENO)) {
219 fprintf(stderr, "Not sending a binary stream to stdout\n");
220 return -1;
221 }
222
223 ret = write(STDOUT_FILENO, &rule_dump_magic, sizeof(rule_dump_magic));
224 if (ret != sizeof(rule_dump_magic)) {
225 fprintf(stderr, "Can't write magic to dump file\n");
226 return -1;
227 }
228
229 return 0;
230 }
231
232 static int save_rule(const struct sockaddr_nl *who, struct nlmsghdr *n, void *arg)
233 {
234 int ret;
235
236 ret = write(STDOUT_FILENO, n, n->nlmsg_len);
237 if ((ret > 0) && (ret != n->nlmsg_len)) {
238 fprintf(stderr, "Short write while saving nlmsg\n");
239 ret = -EIO;
240 }
241
242 return ret == n->nlmsg_len ? 0 : ret;
243 }
244
245 static int iprule_list_or_save(int argc, char **argv, int save)
246 {
247 rtnl_filter_t filter = print_rule;
248 int af = preferred_family;
249
250 if (af == AF_UNSPEC)
251 af = AF_INET;
252
253 if (argc > 0) {
254 fprintf(stderr, "\"ip rule %s\" does not take any arguments.\n",
255 save ? "save" : "show");
256 return -1;
257 }
258
259 if (save) {
260 if (save_rule_prep())
261 return -1;
262 filter = save_rule;
263 }
264
265 if (rtnl_wilddump_request(&rth, af, RTM_GETRULE) < 0) {
266 perror("Cannot send dump request");
267 return 1;
268 }
269
270 if (rtnl_dump_filter(&rth, filter, stdout) < 0) {
271 fprintf(stderr, "Dump terminated\n");
272 return 1;
273 }
274
275 return 0;
276 }
277
278 static int rule_dump_check_magic(void)
279 {
280 int ret;
281 __u32 magic = 0;
282
283 if (isatty(STDIN_FILENO)) {
284 fprintf(stderr, "Can't restore rule dump from a terminal\n");
285 return -1;
286 }
287
288 ret = fread(&magic, sizeof(magic), 1, stdin);
289 if (magic != rule_dump_magic) {
290 fprintf(stderr, "Magic mismatch (%d elems, %x magic)\n", ret, magic);
291 return -1;
292 }
293
294 return 0;
295 }
296
297 static int restore_handler(const struct sockaddr_nl *nl,
298 struct rtnl_ctrl_data *ctrl,
299 struct nlmsghdr *n, void *arg)
300 {
301 int ret;
302
303 n->nlmsg_flags |= NLM_F_REQUEST | NLM_F_CREATE | NLM_F_ACK;
304
305 ll_init_map(&rth);
306
307 ret = rtnl_talk(&rth, n, n, sizeof(*n));
308 if ((ret < 0) && (errno == EEXIST))
309 ret = 0;
310
311 return ret;
312 }
313
314
315 static int iprule_restore(void)
316 {
317 if (rule_dump_check_magic())
318 exit(-1);
319
320 exit(rtnl_from_file(stdin, &restore_handler, NULL));
321 }
322
323 static int iprule_modify(int cmd, int argc, char **argv)
324 {
325 int table_ok = 0;
326 struct {
327 struct nlmsghdr n;
328 struct rtmsg r;
329 char buf[1024];
330 } req;
331
332 memset(&req, 0, sizeof(req));
333
334 req.n.nlmsg_type = cmd;
335 req.n.nlmsg_len = NLMSG_LENGTH(sizeof(struct rtmsg));
336 req.n.nlmsg_flags = NLM_F_REQUEST;
337 req.r.rtm_family = preferred_family;
338 req.r.rtm_protocol = RTPROT_BOOT;
339 req.r.rtm_scope = RT_SCOPE_UNIVERSE;
340 req.r.rtm_table = 0;
341 req.r.rtm_type = RTN_UNSPEC;
342 req.r.rtm_flags = 0;
343
344 if (cmd == RTM_NEWRULE) {
345 req.n.nlmsg_flags |= NLM_F_CREATE|NLM_F_EXCL;
346 req.r.rtm_type = RTN_UNICAST;
347 }
348
349 while (argc > 0) {
350 if (strcmp(*argv, "not") == 0) {
351 req.r.rtm_flags |= FIB_RULE_INVERT;
352 } else if (strcmp(*argv, "from") == 0) {
353 inet_prefix dst;
354 NEXT_ARG();
355 get_prefix(&dst, *argv, req.r.rtm_family);
356 req.r.rtm_src_len = dst.bitlen;
357 addattr_l(&req.n, sizeof(req), FRA_SRC, &dst.data, dst.bytelen);
358 } else if (strcmp(*argv, "to") == 0) {
359 inet_prefix dst;
360 NEXT_ARG();
361 get_prefix(&dst, *argv, req.r.rtm_family);
362 req.r.rtm_dst_len = dst.bitlen;
363 addattr_l(&req.n, sizeof(req), FRA_DST, &dst.data, dst.bytelen);
364 } else if (matches(*argv, "preference") == 0 ||
365 matches(*argv, "order") == 0 ||
366 matches(*argv, "priority") == 0) {
367 __u32 pref;
368 NEXT_ARG();
369 if (get_u32(&pref, *argv, 0))
370 invarg("preference value is invalid\n", *argv);
371 addattr32(&req.n, sizeof(req), FRA_PRIORITY, pref);
372 } else if (strcmp(*argv, "tos") == 0 ||
373 matches(*argv, "dsfield") == 0) {
374 __u32 tos;
375 NEXT_ARG();
376 if (rtnl_dsfield_a2n(&tos, *argv))
377 invarg("TOS value is invalid\n", *argv);
378 req.r.rtm_tos = tos;
379 } else if (strcmp(*argv, "fwmark") == 0) {
380 char *slash;
381 __u32 fwmark, fwmask;
382 NEXT_ARG();
383 if ((slash = strchr(*argv, '/')) != NULL)
384 *slash = '\0';
385 if (get_u32(&fwmark, *argv, 0))
386 invarg("fwmark value is invalid\n", *argv);
387 addattr32(&req.n, sizeof(req), FRA_FWMARK, fwmark);
388 if (slash) {
389 if (get_u32(&fwmask, slash+1, 0))
390 invarg("fwmask value is invalid\n", slash+1);
391 addattr32(&req.n, sizeof(req), FRA_FWMASK, fwmask);
392 }
393 } else if (matches(*argv, "realms") == 0) {
394 __u32 realm;
395 NEXT_ARG();
396 if (get_rt_realms_or_raw(&realm, *argv))
397 invarg("invalid realms\n", *argv);
398 addattr32(&req.n, sizeof(req), FRA_FLOW, realm);
399 } else if (matches(*argv, "table") == 0 ||
400 strcmp(*argv, "lookup") == 0) {
401 __u32 tid;
402 NEXT_ARG();
403 if (rtnl_rttable_a2n(&tid, *argv))
404 invarg("invalid table ID\n", *argv);
405 if (tid < 256)
406 req.r.rtm_table = tid;
407 else {
408 req.r.rtm_table = RT_TABLE_UNSPEC;
409 addattr32(&req.n, sizeof(req), FRA_TABLE, tid);
410 }
411 table_ok = 1;
412 } else if (matches(*argv, "suppress_prefixlength") == 0 ||
413 strcmp(*argv, "sup_pl") == 0) {
414 int pl;
415 NEXT_ARG();
416 if (get_s32(&pl, *argv, 0) || pl < 0)
417 invarg("suppress_prefixlength value is invalid\n", *argv);
418 addattr32(&req.n, sizeof(req), FRA_SUPPRESS_PREFIXLEN, pl);
419 } else if (matches(*argv, "suppress_ifgroup") == 0 ||
420 strcmp(*argv, "sup_group") == 0) {
421 NEXT_ARG();
422 int group;
423 if (rtnl_group_a2n(&group, *argv))
424 invarg("Invalid \"suppress_ifgroup\" value\n", *argv);
425 addattr32(&req.n, sizeof(req), FRA_SUPPRESS_IFGROUP, group);
426 } else if (strcmp(*argv, "dev") == 0 ||
427 strcmp(*argv, "iif") == 0) {
428 NEXT_ARG();
429 addattr_l(&req.n, sizeof(req), FRA_IFNAME, *argv, strlen(*argv)+1);
430 } else if (strcmp(*argv, "oif") == 0) {
431 NEXT_ARG();
432 addattr_l(&req.n, sizeof(req), FRA_OIFNAME, *argv, strlen(*argv)+1);
433 } else if (strcmp(*argv, "nat") == 0 ||
434 matches(*argv, "map-to") == 0) {
435 NEXT_ARG();
436 fprintf(stderr, "Warning: route NAT is deprecated\n");
437 addattr32(&req.n, sizeof(req), RTA_GATEWAY, get_addr32(*argv));
438 req.r.rtm_type = RTN_NAT;
439 } else {
440 int type;
441
442 if (strcmp(*argv, "type") == 0) {
443 NEXT_ARG();
444 }
445 if (matches(*argv, "help") == 0)
446 usage();
447 else if (matches(*argv, "goto") == 0) {
448 __u32 target;
449 type = FR_ACT_GOTO;
450 NEXT_ARG();
451 if (get_u32(&target, *argv, 0))
452 invarg("invalid target\n", *argv);
453 addattr32(&req.n, sizeof(req), FRA_GOTO, target);
454 } else if (matches(*argv, "nop") == 0)
455 type = FR_ACT_NOP;
456 else if (rtnl_rtntype_a2n(&type, *argv))
457 invarg("Failed to parse rule type", *argv);
458 req.r.rtm_type = type;
459 table_ok = 1;
460 }
461 argc--;
462 argv++;
463 }
464
465 if (req.r.rtm_family == AF_UNSPEC)
466 req.r.rtm_family = AF_INET;
467
468 if (!table_ok && cmd == RTM_NEWRULE)
469 req.r.rtm_table = RT_TABLE_MAIN;
470
471 if (rtnl_talk(&rth, &req.n, NULL, 0) < 0)
472 return -2;
473
474 return 0;
475 }
476
477
478 static int flush_rule(const struct sockaddr_nl *who, struct nlmsghdr *n, void *arg)
479 {
480 struct rtnl_handle rth2;
481 struct rtmsg *r = NLMSG_DATA(n);
482 int len = n->nlmsg_len;
483 struct rtattr * tb[FRA_MAX+1];
484
485 len -= NLMSG_LENGTH(sizeof(*r));
486 if (len < 0)
487 return -1;
488
489 parse_rtattr(tb, FRA_MAX, RTM_RTA(r), len);
490
491 if (tb[FRA_PRIORITY]) {
492 n->nlmsg_type = RTM_DELRULE;
493 n->nlmsg_flags = NLM_F_REQUEST;
494
495 if (rtnl_open(&rth2, 0) < 0)
496 return -1;
497
498 if (rtnl_talk(&rth2, n, NULL, 0) < 0)
499 return -2;
500
501 rtnl_close(&rth2);
502 }
503
504 return 0;
505 }
506
507 static int iprule_flush(int argc, char **argv)
508 {
509 int af = preferred_family;
510
511 if (af == AF_UNSPEC)
512 af = AF_INET;
513
514 if (argc > 0) {
515 fprintf(stderr, "\"ip rule flush\" does not allow arguments\n");
516 return -1;
517 }
518
519 if (rtnl_wilddump_request(&rth, af, RTM_GETRULE) < 0) {
520 perror("Cannot send dump request");
521 return 1;
522 }
523
524 if (rtnl_dump_filter(&rth, flush_rule, NULL) < 0) {
525 fprintf(stderr, "Flush terminated\n");
526 return 1;
527 }
528
529 return 0;
530 }
531
532 int do_iprule(int argc, char **argv)
533 {
534 if (argc < 1) {
535 return iprule_list_or_save(0, NULL, 0);
536 } else if (matches(argv[0], "list") == 0 ||
537 matches(argv[0], "lst") == 0 ||
538 matches(argv[0], "show") == 0) {
539 return iprule_list_or_save(argc-1, argv+1, 0);
540 } else if (matches(argv[0], "save") == 0) {
541 return iprule_list_or_save(argc-1, argv+1, 1);
542 } else if (matches(argv[0], "restore") == 0) {
543 return iprule_restore();
544 } else if (matches(argv[0], "add") == 0) {
545 return iprule_modify(RTM_NEWRULE, argc-1, argv+1);
546 } else if (matches(argv[0], "delete") == 0) {
547 return iprule_modify(RTM_DELRULE, argc-1, argv+1);
548 } else if (matches(argv[0], "flush") == 0) {
549 return iprule_flush(argc-1, argv+1);
550 } else if (matches(argv[0], "help") == 0)
551 usage();
552
553 fprintf(stderr, "Command \"%s\" is unknown, try \"ip rule help\".\n", *argv);
554 exit(-1);
555 }
556
557 int do_multirule(int argc, char **argv)
558 {
559 switch (preferred_family) {
560 case AF_UNSPEC:
561 case AF_INET:
562 preferred_family = RTNL_FAMILY_IPMR;
563 break;
564 case AF_INET6:
565 preferred_family = RTNL_FAMILY_IP6MR;
566 break;
567 case RTNL_FAMILY_IPMR:
568 case RTNL_FAMILY_IP6MR:
569 break;
570 default:
571 fprintf(stderr, "Multicast rules are only supported for IPv4/IPv6, was: %i\n",
572 preferred_family);
573 exit(-1);
574 }
575
576 return do_iprule(argc, argv);
577 }