]> git.proxmox.com Git - mirror_iproute2.git/blob - ip/iprule.c
projects / mirror_iproute2.git / blob
? search:


0f8fc6d99136ef647c323c5e34f95f27dc1b2e1f
[mirror_iproute2.git] / ip / iprule.c
1 /*
2 * iprule.c "ip rule".
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version
7 * 2 of the License, or (at your option) any later version.
8 *
9 * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
10 *
11 */
12
13 #include <stdio.h>
14 #include <stdlib.h>
15 #include <unistd.h>
16 #include <fcntl.h>
17 #include <sys/socket.h>
18 #include <netinet/in.h>
19 #include <netinet/ip.h>
20 #include <arpa/inet.h>
21 #include <string.h>
22 #include <linux/if.h>
23 #include <linux/fib_rules.h>
24 #include <errno.h>
25
26 #include "rt_names.h"
27 #include "utils.h"
28 #include "ip_common.h"
29 #include "json_print.h"
30
31 enum list_action {
32 IPRULE_LIST,
33 IPRULE_FLUSH,
34 IPRULE_SAVE,
35 };
36
37 extern struct rtnl_handle rth;
38
39 static void usage(void) __attribute__((noreturn));
40
41 static void usage(void)
42 {
43 fprintf(stderr,
44 "Usage: ip rule { add | del } SELECTOR ACTION\n"
45 " ip rule { flush | save | restore }\n"
46 " ip rule [ list [ SELECTOR ]]\n"
47 "SELECTOR := [ not ] [ from PREFIX ] [ to PREFIX ] [ tos TOS ] [ fwmark FWMARK[/MASK] ]\n"
48 " [ iif STRING ] [ oif STRING ] [ pref NUMBER ] [ l3mdev ]\n"
49 " [ uidrange NUMBER-NUMBER ]\n"
50 " [ ipproto PROTOCOL ]\n"
51 " [ sport [ NUMBER | NUMBER-NUMBER ]\n"
52 " [ dport [ NUMBER | NUMBER-NUMBER ] ]\n"
53 "ACTION := [ table TABLE_ID ]\n"
54 " [ protocol PROTO ]\n"
55 " [ nat ADDRESS ]\n"
56 " [ realms [SRCREALM/]DSTREALM ]\n"
57 " [ goto NUMBER ]\n"
58 " SUPPRESSOR\n"
59 "SUPPRESSOR := [ suppress_prefixlength NUMBER ]\n"
60 " [ suppress_ifgroup DEVGROUP ]\n"
61 "TABLE_ID := [ local | main | default | NUMBER ]\n");
62 exit(-1);
63 }
64
65 static struct
66 {
67 int not;
68 int l3mdev;
69 int iifmask, oifmask, uidrange;
70 unsigned int tb;
71 unsigned int tos, tosmask;
72 unsigned int pref, prefmask;
73 unsigned int fwmark, fwmask;
74 char iif[IFNAMSIZ];
75 char oif[IFNAMSIZ];
76 struct fib_rule_uid_range range;
77 inet_prefix src;
78 inet_prefix dst;
79 int protocol;
80 int protocolmask;
81 } filter;
82
83 static inline int frh_get_table(struct fib_rule_hdr *frh, struct rtattr **tb)
84 {
85 __u32 table = frh->table;
86 if (tb[RTA_TABLE])
87 table = rta_getattr_u32(tb[RTA_TABLE]);
88 return table;
89 }
90
91 static bool filter_nlmsg(struct nlmsghdr *n, struct rtattr **tb, int host_len)
92 {
93 struct fib_rule_hdr *frh = NLMSG_DATA(n);
94 __u32 table;
95
96 if (preferred_family != AF_UNSPEC && frh->family != preferred_family)
97 return false;
98
99 if (filter.prefmask &&
100 filter.pref ^ (tb[FRA_PRIORITY] ? rta_getattr_u32(tb[FRA_PRIORITY]) : 0))
101 return false;
102 if (filter.not && !(frh->flags & FIB_RULE_INVERT))
103 return false;
104
105 if (filter.src.family) {
106 inet_prefix *f_src = &filter.src;
107
108 if (f_src->family != frh->family ||
109 f_src->bitlen > frh->src_len)
110 return false;
111
112 if (inet_addr_match_rta(f_src, tb[FRA_SRC]))
113 return false;
114 }
115
116 if (filter.dst.family) {
117 inet_prefix *f_dst = &filter.dst;
118
119 if (f_dst->family != frh->family ||
120 f_dst->bitlen > frh->dst_len)
121 return false;
122
123 if (inet_addr_match_rta(f_dst, tb[FRA_DST]))
124 return false;
125 }
126
127 if (filter.tosmask && filter.tos ^ frh->tos)
128 return false;
129
130 if (filter.fwmark) {
131 __u32 mark = 0;
132
133 if (tb[FRA_FWMARK])
134 mark = rta_getattr_u32(tb[FRA_FWMARK]);
135 if (filter.fwmark ^ mark)
136 return false;
137 }
138 if (filter.fwmask) {
139 __u32 mask = 0;
140
141 if (tb[FRA_FWMASK])
142 mask = rta_getattr_u32(tb[FRA_FWMASK]);
143 if (filter.fwmask ^ mask)
144 return false;
145 }
146
147 if (filter.iifmask) {
148 if (tb[FRA_IFNAME]) {
149 if (strcmp(filter.iif, rta_getattr_str(tb[FRA_IFNAME])) != 0)
150 return false;
151 } else {
152 return false;
153 }
154 }
155
156 if (filter.oifmask) {
157 if (tb[FRA_OIFNAME]) {
158 if (strcmp(filter.oif, rta_getattr_str(tb[FRA_OIFNAME])) != 0)
159 return false;
160 } else {
161 return false;
162 }
163 }
164
165 if (filter.l3mdev && !(tb[FRA_L3MDEV] && rta_getattr_u8(tb[FRA_L3MDEV])))
166 return false;
167
168 if (filter.uidrange) {
169 struct fib_rule_uid_range *r = RTA_DATA(tb[FRA_UID_RANGE]);
170
171 if (!tb[FRA_UID_RANGE] ||
172 r->start != filter.range.start ||
173 r->end != filter.range.end)
174 return false;
175 }
176
177 table = frh_get_table(frh, tb);
178 if (filter.tb > 0 && filter.tb ^ table)
179 return false;
180
181 return true;
182 }
183
184 int print_rule(struct nlmsghdr *n, void *arg)
185 {
186 FILE *fp = arg;
187 struct fib_rule_hdr *frh = NLMSG_DATA(n);
188 int len = n->nlmsg_len;
189 int host_len = -1;
190 __u32 table, prio = 0;
191 struct rtattr *tb[FRA_MAX+1];
192 SPRINT_BUF(b1);
193
194 if (n->nlmsg_type != RTM_NEWRULE && n->nlmsg_type != RTM_DELRULE)
195 return 0;
196
197 len -= NLMSG_LENGTH(sizeof(*frh));
198 if (len < 0)
199 return -1;
200
201 parse_rtattr(tb, FRA_MAX, RTM_RTA(frh), len);
202
203 host_len = af_bit_len(frh->family);
204
205 if (!filter_nlmsg(n, tb, host_len))
206 return 0;
207
208 open_json_object(NULL);
209 if (n->nlmsg_type == RTM_DELRULE)
210 print_bool(PRINT_ANY, "deleted", "Deleted ", true);
211
212 if (tb[FRA_PRIORITY])
213 prio = rta_getattr_u32(tb[FRA_PRIORITY]);
214
215 print_uint(PRINT_ANY, "priority", "%u:\t", prio);
216
217 if (frh->flags & FIB_RULE_INVERT)
218 print_null(PRINT_ANY, "not", "not ", NULL);
219
220 if (tb[FRA_SRC]) {
221 const char *src = rt_addr_n2a_rta(frh->family, tb[FRA_SRC]);
222
223 print_string(PRINT_FP, NULL, "from ", NULL);
224 print_color_string(PRINT_ANY, ifa_family_color(frh->family),
225 "src", "%s", src);
226 if (frh->src_len != host_len)
227 print_uint(PRINT_ANY, "srclen", "/%u ", frh->src_len);
228 else
229 print_string(PRINT_FP, NULL, " ", NULL);
230 } else if (frh->src_len) {
231 print_string(PRINT_ANY, "src", "from %s", "0");
232 print_uint(PRINT_ANY, "srclen", "/%u ", frh->src_len);
233 } else {
234 print_string(PRINT_ANY, "src", "from %s ", "all");
235 }
236
237 if (tb[FRA_DST]) {
238 const char *dst = rt_addr_n2a_rta(frh->family, tb[FRA_DST]);
239
240 print_string(PRINT_FP, NULL, "to ", NULL);
241 print_color_string(PRINT_ANY, ifa_family_color(frh->family),
242 "dst", "%s", dst);
243 if (frh->dst_len != host_len)
244 print_uint(PRINT_ANY, "dstlen", "/%u ", frh->dst_len);
245 else
246 print_string(PRINT_FP, NULL, " ", NULL);
247 } else if (frh->dst_len) {
248 print_string(PRINT_ANY, "dst", "to %s", "0");
249 print_uint(PRINT_ANY, "dstlen", "/%u ", frh->dst_len);
250 }
251
252 if (frh->tos) {
253 print_string(PRINT_ANY, "tos",
254 "tos %s ",
255 rtnl_dsfield_n2a(frh->tos, b1, sizeof(b1)));
256 }
257
258 if (tb[FRA_FWMARK] || tb[FRA_FWMASK]) {
259 __u32 mark = 0, mask = 0;
260
261 if (tb[FRA_FWMARK])
262 mark = rta_getattr_u32(tb[FRA_FWMARK]);
263
264 if (tb[FRA_FWMASK] &&
265 (mask = rta_getattr_u32(tb[FRA_FWMASK])) != 0xFFFFFFFF) {
266 print_0xhex(PRINT_ANY, "fwmark", "fwmark %#llx", mark);
267 print_0xhex(PRINT_ANY, "fwmask", "/%#llx ", mask);
268 } else {
269 print_0xhex(PRINT_ANY, "fwmark", "fwmark %#llx ", mark);
270 }
271 }
272
273 if (tb[FRA_IFNAME]) {
274 if (!is_json_context())
275 fprintf(fp, "iif ");
276 print_color_string(PRINT_ANY, COLOR_IFNAME,
277 "iif", "%s ",
278 rta_getattr_str(tb[FRA_IFNAME]));
279
280 if (frh->flags & FIB_RULE_IIF_DETACHED)
281 print_null(PRINT_ANY, "iif_detached", "[detached] ",
282 NULL);
283 }
284
285 if (tb[FRA_OIFNAME]) {
286 if (!is_json_context())
287 fprintf(fp, "oif ");
288
289 print_color_string(PRINT_ANY, COLOR_IFNAME, "oif", "%s ",
290 rta_getattr_str(tb[FRA_OIFNAME]));
291
292 if (frh->flags & FIB_RULE_OIF_DETACHED)
293 print_null(PRINT_ANY, "oif_detached", "[detached] ",
294 NULL);
295 }
296
297 if (tb[FRA_L3MDEV]) {
298 __u8 mdev = rta_getattr_u8(tb[FRA_L3MDEV]);
299
300 if (mdev)
301 print_null(PRINT_ANY, "l3mdev",
302 "lookup [l3mdev-table] ", NULL);
303 }
304
305 if (tb[FRA_UID_RANGE]) {
306 struct fib_rule_uid_range *r = RTA_DATA(tb[FRA_UID_RANGE]);
307
308 print_uint(PRINT_ANY, "uid_start", "uidrange %u", r->start);
309 print_uint(PRINT_ANY, "uid_end", "-%u ", r->end);
310 }
311
312 if (tb[FRA_IP_PROTO]) {
313 SPRINT_BUF(pbuf);
314 print_string(PRINT_ANY, "ipproto", "ipproto %s ",
315 inet_proto_n2a(rta_getattr_u8(tb[FRA_IP_PROTO]),
316 pbuf, sizeof(pbuf)));
317 }
318
319 if (tb[FRA_SPORT_RANGE]) {
320 struct fib_rule_port_range *r = RTA_DATA(tb[FRA_SPORT_RANGE]);
321
322 if (r->start == r->end) {
323 print_uint(PRINT_ANY, "sport", "sport %u ", r->start);
324 } else {
325 print_uint(PRINT_ANY, "sport_start", "sport %u",
326 r->start);
327 print_uint(PRINT_ANY, "sport_end", "-%u ", r->end);
328 }
329 }
330
331 if (tb[FRA_DPORT_RANGE]) {
332 struct fib_rule_port_range *r = RTA_DATA(tb[FRA_DPORT_RANGE]);
333
334 if (r->start == r->end) {
335 print_uint(PRINT_ANY, "dport", "dport %u ", r->start);
336 } else {
337 print_uint(PRINT_ANY, "dport_start", "dport %u",
338 r->start);
339 print_uint(PRINT_ANY, "dport_end", "-%u ", r->end);
340 }
341 }
342
343 table = frh_get_table(frh, tb);
344 if (table) {
345 print_string(PRINT_ANY, "table",
346 "lookup %s ",
347 rtnl_rttable_n2a(table, b1, sizeof(b1)));
348
349 if (tb[FRA_SUPPRESS_PREFIXLEN]) {
350 int pl = rta_getattr_u32(tb[FRA_SUPPRESS_PREFIXLEN]);
351
352 if (pl != -1)
353 print_int(PRINT_ANY, "suppress_prefixlen",
354 "suppress_prefixlength %d ", pl);
355 }
356
357 if (tb[FRA_SUPPRESS_IFGROUP]) {
358 int group = rta_getattr_u32(tb[FRA_SUPPRESS_IFGROUP]);
359
360 if (group != -1) {
361 const char *grname
362 = rtnl_group_n2a(group, b1, sizeof(b1));
363
364 print_string(PRINT_ANY, "suppress_ifgroup",
365 "suppress_ifgroup %s ", grname);
366 }
367 }
368 }
369
370 if (tb[FRA_FLOW]) {
371 __u32 to = rta_getattr_u32(tb[FRA_FLOW]);
372 __u32 from = to>>16;
373
374 to &= 0xFFFF;
375 if (from)
376 print_string(PRINT_ANY,
377 "flow_from", "realms %s/",
378 rtnl_rtrealm_n2a(from, b1, sizeof(b1)));
379
380 print_string(PRINT_ANY, "flow_to", "%s ",
381 rtnl_rtrealm_n2a(to, b1, sizeof(b1)));
382 }
383
384 if (frh->action == RTN_NAT) {
385 if (tb[RTA_GATEWAY]) {
386 const char *gateway;
387
388 gateway = format_host_rta(frh->family, tb[RTA_GATEWAY]);
389
390 print_string(PRINT_ANY, "nat_gateway",
391 "map-to %s ", gateway);
392 } else {
393 print_null(PRINT_ANY, "masquerade", "masquerade", NULL);
394 }
395 } else if (frh->action == FR_ACT_GOTO) {
396 if (tb[FRA_GOTO])
397 print_uint(PRINT_ANY, "goto", "goto %u",
398 rta_getattr_u32(tb[FRA_GOTO]));
399 else
400 print_string(PRINT_ANY, "goto", "goto %s", "none");
401
402 if (frh->flags & FIB_RULE_UNRESOLVED)
403 print_null(PRINT_ANY, "unresolved", "unresolved", NULL);
404 } else if (frh->action == FR_ACT_NOP) {
405 print_null(PRINT_ANY, "nop", "nop", NULL);
406 } else if (frh->action != FR_ACT_TO_TBL) {
407 print_string(PRINT_ANY, "to_tbl", "%s",
408 rtnl_rtntype_n2a(frh->action, b1, sizeof(b1)));
409 }
410
411 if (tb[FRA_PROTOCOL]) {
412 __u8 protocol = rta_getattr_u8(tb[FRA_PROTOCOL]);
413
414 if ((protocol && protocol != RTPROT_KERNEL) || show_details > 0) {
415 print_string(PRINT_ANY, "protocol", " proto %s ",
416 rtnl_rtprot_n2a(protocol, b1, sizeof(b1)));
417 }
418 }
419 print_string(PRINT_FP, NULL, "\n", "");
420 close_json_object();
421 fflush(fp);
422 return 0;
423 }
424
425 static __u32 rule_dump_magic = 0x71706986;
426
427 static int save_rule_prep(void)
428 {
429 int ret;
430
431 if (isatty(STDOUT_FILENO)) {
432 fprintf(stderr, "Not sending a binary stream to stdout\n");
433 return -1;
434 }
435
436 ret = write(STDOUT_FILENO, &rule_dump_magic, sizeof(rule_dump_magic));
437 if (ret != sizeof(rule_dump_magic)) {
438 fprintf(stderr, "Can't write magic to dump file\n");
439 return -1;
440 }
441
442 return 0;
443 }
444
445 static int save_rule(struct nlmsghdr *n, void *arg)
446 {
447 int ret;
448
449 ret = write(STDOUT_FILENO, n, n->nlmsg_len);
450 if ((ret > 0) && (ret != n->nlmsg_len)) {
451 fprintf(stderr, "Short write while saving nlmsg\n");
452 ret = -EIO;
453 }
454
455 return ret == n->nlmsg_len ? 0 : ret;
456 }
457
458 static int flush_rule(struct nlmsghdr *n, void *arg)
459 {
460 struct rtnl_handle rth2;
461 struct fib_rule_hdr *frh = NLMSG_DATA(n);
462 int len = n->nlmsg_len;
463 struct rtattr *tb[FRA_MAX+1];
464 int host_len = -1;
465
466 len -= NLMSG_LENGTH(sizeof(*frh));
467 if (len < 0)
468 return -1;
469
470 parse_rtattr(tb, FRA_MAX, RTM_RTA(frh), len);
471
472 host_len = af_bit_len(frh->family);
473 if (!filter_nlmsg(n, tb, host_len))
474 return 0;
475
476 if (tb[FRA_PROTOCOL]) {
477 __u8 protocol = rta_getattr_u8(tb[FRA_PROTOCOL]);
478
479 if ((filter.protocol ^ protocol) & filter.protocolmask)
480 return 0;
481 }
482
483 if (tb[FRA_PRIORITY]) {
484 n->nlmsg_type = RTM_DELRULE;
485 n->nlmsg_flags = NLM_F_REQUEST;
486
487 if (rtnl_open(&rth2, 0) < 0)
488 return -1;
489
490 if (rtnl_talk(&rth2, n, NULL) < 0)
491 return -2;
492
493 rtnl_close(&rth2);
494 }
495
496 return 0;
497 }
498
499 static int iprule_list_flush_or_save(int argc, char **argv, int action)
500 {
501 rtnl_filter_t filter_fn;
502 int af = preferred_family;
503
504 if (af == AF_UNSPEC)
505 af = AF_INET;
506
507 if (action == IPRULE_SAVE && argc > 0) {
508 fprintf(stderr, "\"ip rule save\" does not take any arguments.\n");
509 return -1;
510 }
511
512 switch (action) {
513 case IPRULE_SAVE:
514 if (save_rule_prep())
515 return -1;
516 filter_fn = save_rule;
517 break;
518 case IPRULE_FLUSH:
519 filter_fn = flush_rule;
520 break;
521 default:
522 filter_fn = print_rule;
523 }
524
525 memset(&filter, 0, sizeof(filter));
526
527 while (argc > 0) {
528 if (matches(*argv, "preference") == 0 ||
529 matches(*argv, "order") == 0 ||
530 matches(*argv, "priority") == 0) {
531 __u32 pref;
532
533 NEXT_ARG();
534 if (get_u32(&pref, *argv, 0))
535 invarg("preference value is invalid\n", *argv);
536 filter.pref = pref;
537 filter.prefmask = 1;
538 } else if (strcmp(*argv, "not") == 0) {
539 filter.not = 1;
540 } else if (strcmp(*argv, "tos") == 0) {
541 __u32 tos;
542
543 NEXT_ARG();
544 if (rtnl_dsfield_a2n(&tos, *argv))
545 invarg("TOS value is invalid\n", *argv);
546 filter.tos = tos;
547 filter.tosmask = 1;
548 } else if (strcmp(*argv, "fwmark") == 0) {
549 char *slash;
550 __u32 fwmark, fwmask;
551
552 NEXT_ARG();
553 slash = strchr(*argv, '/');
554 if (slash != NULL)
555 *slash = '\0';
556 if (get_u32(&fwmark, *argv, 0))
557 invarg("fwmark value is invalid\n", *argv);
558 filter.fwmark = fwmark;
559 if (slash) {
560 if (get_u32(&fwmask, slash+1, 0))
561 invarg("fwmask value is invalid\n",
562 slash+1);
563 filter.fwmask = fwmask;
564 }
565 } else if (strcmp(*argv, "dev") == 0 ||
566 strcmp(*argv, "iif") == 0) {
567 NEXT_ARG();
568 if (get_ifname(filter.iif, *argv))
569 invarg("\"iif\"/\"dev\" not a valid ifname", *argv);
570 filter.iifmask = 1;
571 } else if (strcmp(*argv, "oif") == 0) {
572 NEXT_ARG();
573 if (get_ifname(filter.oif, *argv))
574 invarg("\"oif\" not a valid ifname", *argv);
575 filter.oifmask = 1;
576 } else if (strcmp(*argv, "l3mdev") == 0) {
577 filter.l3mdev = 1;
578 } else if (strcmp(*argv, "uidrange") == 0) {
579 NEXT_ARG();
580 filter.uidrange = 1;
581 if (sscanf(*argv, "%u-%u",
582 &filter.range.start,
583 &filter.range.end) != 2)
584 invarg("invalid UID range\n", *argv);
585
586 } else if (matches(*argv, "lookup") == 0 ||
587 matches(*argv, "table") == 0) {
588 __u32 tid;
589
590 NEXT_ARG();
591 if (rtnl_rttable_a2n(&tid, *argv))
592 invarg("table id value is invalid\n", *argv);
593 filter.tb = tid;
594 } else if (matches(*argv, "from") == 0 ||
595 matches(*argv, "src") == 0) {
596 NEXT_ARG();
597 if (get_prefix(&filter.src, *argv, af))
598 invarg("from value is invalid\n", *argv);
599 } else if (matches(*argv, "protocol") == 0) {
600 __u32 prot;
601 NEXT_ARG();
602 filter.protocolmask = -1;
603 if (rtnl_rtprot_a2n(&prot, *argv)) {
604 if (strcmp(*argv, "all") != 0)
605 invarg("invalid \"protocol\"\n", *argv);
606 prot = 0;
607 filter.protocolmask = 0;
608 }
609 filter.protocol = prot;
610 } else{
611 if (matches(*argv, "dst") == 0 ||
612 matches(*argv, "to") == 0) {
613 NEXT_ARG();
614 }
615 if (get_prefix(&filter.dst, *argv, af))
616 invarg("to value is invalid\n", *argv);
617 }
618 argc--; argv++;
619 }
620
621 if (rtnl_ruledump_req(&rth, af) < 0) {
622 perror("Cannot send dump request");
623 return 1;
624 }
625
626 new_json_obj(json);
627 if (rtnl_dump_filter(&rth, filter_fn, stdout) < 0) {
628 fprintf(stderr, "Dump terminated\n");
629 return 1;
630 }
631 delete_json_obj();
632
633 return 0;
634 }
635
636 static int rule_dump_check_magic(void)
637 {
638 int ret;
639 __u32 magic = 0;
640
641 if (isatty(STDIN_FILENO)) {
642 fprintf(stderr, "Can't restore rule dump from a terminal\n");
643 return -1;
644 }
645
646 ret = fread(&magic, sizeof(magic), 1, stdin);
647 if (magic != rule_dump_magic) {
648 fprintf(stderr, "Magic mismatch (%d elems, %x magic)\n",
649 ret, magic);
650 return -1;
651 }
652
653 return 0;
654 }
655
656 static int restore_handler(struct rtnl_ctrl_data *ctrl,
657 struct nlmsghdr *n, void *arg)
658 {
659 int ret;
660
661 n->nlmsg_flags |= NLM_F_REQUEST | NLM_F_CREATE | NLM_F_ACK;
662
663 ll_init_map(&rth);
664
665 ret = rtnl_talk(&rth, n, NULL);
666 if ((ret < 0) && (errno == EEXIST))
667 ret = 0;
668
669 return ret;
670 }
671
672
673 static int iprule_restore(void)
674 {
675 if (rule_dump_check_magic())
676 exit(-1);
677
678 exit(rtnl_from_file(stdin, &restore_handler, NULL));
679 }
680
681 static int iprule_modify(int cmd, int argc, char **argv)
682 {
683 int l3mdev_rule = 0;
684 int table_ok = 0;
685 __u32 tid = 0;
686 struct {
687 struct nlmsghdr n;
688 struct fib_rule_hdr frh;
689 char buf[1024];
690 } req = {
691 .n.nlmsg_type = cmd,
692 .n.nlmsg_len = NLMSG_LENGTH(sizeof(struct fib_rule_hdr)),
693 .n.nlmsg_flags = NLM_F_REQUEST,
694 .frh.family = preferred_family,
695 .frh.action = FR_ACT_UNSPEC,
696 };
697
698 if (cmd == RTM_NEWRULE) {
699 if (argc == 0) {
700 fprintf(stderr,
701 "\"ip rule add\" requires arguments.\n");
702 return -1;
703 }
704 req.n.nlmsg_flags |= NLM_F_CREATE|NLM_F_EXCL;
705 req.frh.action = FR_ACT_TO_TBL;
706 }
707
708 if (cmd == RTM_DELRULE && argc == 0) {
709 fprintf(stderr, "\"ip rule del\" requires arguments.\n");
710 return -1;
711 }
712
713 while (argc > 0) {
714 if (strcmp(*argv, "not") == 0) {
715 req.frh.flags |= FIB_RULE_INVERT;
716 } else if (strcmp(*argv, "from") == 0) {
717 inet_prefix dst;
718
719 NEXT_ARG();
720 get_prefix(&dst, *argv, req.frh.family);
721 req.frh.src_len = dst.bitlen;
722 addattr_l(&req.n, sizeof(req), FRA_SRC,
723 &dst.data, dst.bytelen);
724 } else if (strcmp(*argv, "to") == 0) {
725 inet_prefix dst;
726
727 NEXT_ARG();
728 get_prefix(&dst, *argv, req.frh.family);
729 req.frh.dst_len = dst.bitlen;
730 addattr_l(&req.n, sizeof(req), FRA_DST,
731 &dst.data, dst.bytelen);
732 } else if (matches(*argv, "preference") == 0 ||
733 matches(*argv, "order") == 0 ||
734 matches(*argv, "priority") == 0) {
735 __u32 pref;
736
737 NEXT_ARG();
738 if (get_u32(&pref, *argv, 0))
739 invarg("preference value is invalid\n", *argv);
740 addattr32(&req.n, sizeof(req), FRA_PRIORITY, pref);
741 } else if (strcmp(*argv, "tos") == 0 ||
742 matches(*argv, "dsfield") == 0) {
743 __u32 tos;
744
745 NEXT_ARG();
746 if (rtnl_dsfield_a2n(&tos, *argv))
747 invarg("TOS value is invalid\n", *argv);
748 req.frh.tos = tos;
749 } else if (strcmp(*argv, "fwmark") == 0) {
750 char *slash;
751 __u32 fwmark, fwmask;
752
753 NEXT_ARG();
754
755 slash = strchr(*argv, '/');
756 if (slash != NULL)
757 *slash = '\0';
758 if (get_u32(&fwmark, *argv, 0))
759 invarg("fwmark value is invalid\n", *argv);
760 addattr32(&req.n, sizeof(req), FRA_FWMARK, fwmark);
761 if (slash) {
762 if (get_u32(&fwmask, slash+1, 0))
763 invarg("fwmask value is invalid\n",
764 slash+1);
765 addattr32(&req.n, sizeof(req),
766 FRA_FWMASK, fwmask);
767 }
768 } else if (matches(*argv, "realms") == 0) {
769 __u32 realm;
770
771 NEXT_ARG();
772 if (get_rt_realms_or_raw(&realm, *argv))
773 invarg("invalid realms\n", *argv);
774 addattr32(&req.n, sizeof(req), FRA_FLOW, realm);
775 } else if (matches(*argv, "protocol") == 0) {
776 __u32 proto;
777
778 NEXT_ARG();
779 if (rtnl_rtprot_a2n(&proto, *argv))
780 invarg("\"protocol\" value is invalid\n", *argv);
781 addattr8(&req.n, sizeof(req), FRA_PROTOCOL, proto);
782 } else if (matches(*argv, "table") == 0 ||
783 strcmp(*argv, "lookup") == 0) {
784 NEXT_ARG();
785 if (rtnl_rttable_a2n(&tid, *argv))
786 invarg("invalid table ID\n", *argv);
787 if (tid < 256)
788 req.frh.table = tid;
789 else {
790 req.frh.table = RT_TABLE_UNSPEC;
791 addattr32(&req.n, sizeof(req), FRA_TABLE, tid);
792 }
793 table_ok = 1;
794 } else if (matches(*argv, "suppress_prefixlength") == 0 ||
795 strcmp(*argv, "sup_pl") == 0) {
796 int pl;
797
798 NEXT_ARG();
799 if (get_s32(&pl, *argv, 0) || pl < 0)
800 invarg("suppress_prefixlength value is invalid\n",
801 *argv);
802 addattr32(&req.n, sizeof(req),
803 FRA_SUPPRESS_PREFIXLEN, pl);
804 } else if (matches(*argv, "suppress_ifgroup") == 0 ||
805 strcmp(*argv, "sup_group") == 0) {
806 NEXT_ARG();
807 int group;
808
809 if (rtnl_group_a2n(&group, *argv))
810 invarg("Invalid \"suppress_ifgroup\" value\n",
811 *argv);
812 addattr32(&req.n, sizeof(req),
813 FRA_SUPPRESS_IFGROUP, group);
814 } else if (strcmp(*argv, "dev") == 0 ||
815 strcmp(*argv, "iif") == 0) {
816 NEXT_ARG();
817 if (check_ifname(*argv))
818 invarg("\"iif\"/\"dev\" not a valid ifname", *argv);
819 addattr_l(&req.n, sizeof(req), FRA_IFNAME,
820 *argv, strlen(*argv)+1);
821 } else if (strcmp(*argv, "oif") == 0) {
822 NEXT_ARG();
823 if (check_ifname(*argv))
824 invarg("\"oif\" not a valid ifname", *argv);
825 addattr_l(&req.n, sizeof(req), FRA_OIFNAME,
826 *argv, strlen(*argv)+1);
827 } else if (strcmp(*argv, "l3mdev") == 0) {
828 addattr8(&req.n, sizeof(req), FRA_L3MDEV, 1);
829 table_ok = 1;
830 l3mdev_rule = 1;
831 } else if (strcmp(*argv, "uidrange") == 0) {
832 struct fib_rule_uid_range r;
833
834 NEXT_ARG();
835 if (sscanf(*argv, "%u-%u", &r.start, &r.end) != 2)
836 invarg("invalid UID range\n", *argv);
837 addattr_l(&req.n, sizeof(req), FRA_UID_RANGE, &r,
838 sizeof(r));
839 } else if (strcmp(*argv, "nat") == 0 ||
840 matches(*argv, "map-to") == 0) {
841 NEXT_ARG();
842 fprintf(stderr, "Warning: route NAT is deprecated\n");
843 addattr32(&req.n, sizeof(req), RTA_GATEWAY,
844 get_addr32(*argv));
845 req.frh.action = RTN_NAT;
846 } else if (strcmp(*argv, "ipproto") == 0) {
847 int ipproto;
848
849 NEXT_ARG();
850 ipproto = inet_proto_a2n(*argv);
851 if (ipproto < 0)
852 invarg("Invalid \"ipproto\" value\n",
853 *argv);
854 addattr8(&req.n, sizeof(req), FRA_IP_PROTO, ipproto);
855 } else if (strcmp(*argv, "sport") == 0) {
856 struct fib_rule_port_range r;
857 int ret = 0;
858
859 NEXT_ARG();
860 ret = sscanf(*argv, "%hu-%hu", &r.start, &r.end);
861 if (ret == 1)
862 r.end = r.start;
863 else if (ret != 2)
864 invarg("invalid port range\n", *argv);
865 addattr_l(&req.n, sizeof(req), FRA_SPORT_RANGE, &r,
866 sizeof(r));
867 } else if (strcmp(*argv, "dport") == 0) {
868 struct fib_rule_port_range r;
869 int ret = 0;
870
871 NEXT_ARG();
872 ret = sscanf(*argv, "%hu-%hu", &r.start, &r.end);
873 if (ret == 1)
874 r.end = r.start;
875 else if (ret != 2)
876 invarg("invalid dport range\n", *argv);
877 addattr_l(&req.n, sizeof(req), FRA_DPORT_RANGE, &r,
878 sizeof(r));
879 } else {
880 int type;
881
882 if (strcmp(*argv, "type") == 0)
883 NEXT_ARG();
884
885 if (matches(*argv, "help") == 0)
886 usage();
887 else if (matches(*argv, "goto") == 0) {
888 __u32 target;
889
890 type = FR_ACT_GOTO;
891 NEXT_ARG();
892 if (get_u32(&target, *argv, 0))
893 invarg("invalid target\n", *argv);
894 addattr32(&req.n, sizeof(req),
895 FRA_GOTO, target);
896 } else if (matches(*argv, "nop") == 0)
897 type = FR_ACT_NOP;
898 else if (rtnl_rtntype_a2n(&type, *argv))
899 invarg("Failed to parse rule type", *argv);
900 req.frh.action = type;
901 table_ok = 1;
902 }
903 argc--;
904 argv++;
905 }
906
907 if (l3mdev_rule && tid != 0) {
908 fprintf(stderr,
909 "table can not be specified for l3mdev rules\n");
910 return -EINVAL;
911 }
912
913 if (req.frh.family == AF_UNSPEC)
914 req.frh.family = AF_INET;
915
916 if (!table_ok && cmd == RTM_NEWRULE)
917 req.frh.table = RT_TABLE_MAIN;
918
919 if (rtnl_talk(&rth, &req.n, NULL) < 0)
920 return -2;
921
922 return 0;
923 }
924
925 int do_iprule(int argc, char **argv)
926 {
927 if (argc < 1) {
928 return iprule_list_flush_or_save(0, NULL, IPRULE_LIST);
929 } else if (matches(argv[0], "list") == 0 ||
930 matches(argv[0], "lst") == 0 ||
931 matches(argv[0], "show") == 0) {
932 return iprule_list_flush_or_save(argc-1, argv+1, IPRULE_LIST);
933 } else if (matches(argv[0], "save") == 0) {
934 return iprule_list_flush_or_save(argc-1, argv+1, IPRULE_SAVE);
935 } else if (matches(argv[0], "restore") == 0) {
936 return iprule_restore();
937 } else if (matches(argv[0], "add") == 0) {
938 return iprule_modify(RTM_NEWRULE, argc-1, argv+1);
939 } else if (matches(argv[0], "delete") == 0) {
940 return iprule_modify(RTM_DELRULE, argc-1, argv+1);
941 } else if (matches(argv[0], "flush") == 0) {
942 return iprule_list_flush_or_save(argc-1, argv+1, IPRULE_FLUSH);
943 } else if (matches(argv[0], "help") == 0)
944 usage();
945
946 fprintf(stderr,
947 "Command \"%s\" is unknown, try \"ip rule help\".\n", *argv);
948 exit(-1);
949 }
950
951 int do_multirule(int argc, char **argv)
952 {
953 switch (preferred_family) {
954 case AF_UNSPEC:
955 case AF_INET:
956 preferred_family = RTNL_FAMILY_IPMR;
957 break;
958 case AF_INET6:
959 preferred_family = RTNL_FAMILY_IP6MR;
960 break;
961 case RTNL_FAMILY_IPMR:
962 case RTNL_FAMILY_IP6MR:
963 break;
964 default:
965 fprintf(stderr,
966 "Multicast rules are only supported for IPv4/IPv6, was: %i\n",
967 preferred_family);
968 exit(-1);
969 }
970
971 return do_iprule(argc, argv);
972 }
Upstream mirror of iproute2