1/*
2 * iprule.c		"ip rule".
3 *
4 *		This program is free software; you can redistribute it and/or
5 *		modify it under the terms of the GNU General Public License
6 *		as published by the Free Software Foundation; either version
7 *		2 of the License, or (at your option) any later version.
8 *
9 * Authors:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
10 *
11 */
12
13#include <stdio.h>
14#include <stdlib.h>
15#include <unistd.h>
16#include <syslog.h>
17#include <fcntl.h>
18#include <sys/socket.h>
19#include <netinet/in.h>
20#include <netinet/ip.h>
21#include <arpa/inet.h>
22#include <string.h>
23#include <linux/fib_rules.h>
24
25#include "rt_names.h"
26#include "utils.h"
27#include "ip_common.h"
28
29extern struct rtnl_handle rth;
30
31static void usage(void) __attribute__((noreturn));
32
33static void usage(void)
34{
35	fprintf(stderr, "Usage: ip rule [ list | add | del | flush ] SELECTOR ACTION\n");
36	fprintf(stderr, "SELECTOR := [ not ] [ from PREFIX ] [ to PREFIX ] [ tos TOS ] [ fwmark FWMARK[/MASK] ]\n");
37	fprintf(stderr, "            [ iif STRING ] [ oif STRING ] [ pref NUMBER ]\n");
38	fprintf(stderr, "ACTION := [ table TABLE_ID ]\n");
39	fprintf(stderr, "          [ prohibit | reject | unreachable ]\n");
40	fprintf(stderr, "          [ realms [SRCREALM/]DSTREALM ]\n");
41	fprintf(stderr, "          [ goto NUMBER ]\n");
42	fprintf(stderr, "TABLE_ID := [ local | main | default | NUMBER ]\n");
43	exit(-1);
44}
45
46int print_rule(const struct sockaddr_nl *who, struct nlmsghdr *n, void *arg)
47{
48	FILE *fp = (FILE*)arg;
49	struct rtmsg *r = NLMSG_DATA(n);
50	int len = n->nlmsg_len;
51	int host_len = -1;
52	__u32 table;
53	struct rtattr * tb[FRA_MAX+1];
54	char abuf[256];
55	SPRINT_BUF(b1);
56
57	if (n->nlmsg_type != RTM_NEWRULE && n->nlmsg_type != RTM_DELRULE)
58		return 0;
59
60	len -= NLMSG_LENGTH(sizeof(*r));
61	if (len < 0)
62		return -1;
63
64	parse_rtattr(tb, FRA_MAX, RTM_RTA(r), len);
65
66	if (r->rtm_family == AF_INET)
67		host_len = 32;
68	else if (r->rtm_family == AF_INET6)
69		host_len = 128;
70	else if (r->rtm_family == AF_DECnet)
71		host_len = 16;
72	else if (r->rtm_family == AF_IPX)
73		host_len = 80;
74
75	if (n->nlmsg_type == RTM_DELRULE)
76		fprintf(fp, "Deleted ");
77
78	if (tb[FRA_PRIORITY])
79		fprintf(fp, "%u:\t", *(unsigned*)RTA_DATA(tb[FRA_PRIORITY]));
80	else
81		fprintf(fp, "0:\t");
82
83	if (r->rtm_flags & FIB_RULE_INVERT)
84		fprintf(fp, "not ");
85
86	if (tb[FRA_SRC]) {
87		if (r->rtm_src_len != host_len) {
88			fprintf(fp, "from %s/%u ", rt_addr_n2a(r->rtm_family,
89							 RTA_PAYLOAD(tb[FRA_SRC]),
90							 RTA_DATA(tb[FRA_SRC]),
91							 abuf, sizeof(abuf)),
92				r->rtm_src_len
93				);
94		} else {
95			fprintf(fp, "from %s ", format_host(r->rtm_family,
96						       RTA_PAYLOAD(tb[FRA_SRC]),
97						       RTA_DATA(tb[FRA_SRC]),
98						       abuf, sizeof(abuf))
99				);
100		}
101	} else if (r->rtm_src_len) {
102		fprintf(fp, "from 0/%d ", r->rtm_src_len);
103	} else {
104		fprintf(fp, "from all ");
105	}
106
107	if (tb[FRA_DST]) {
108		if (r->rtm_dst_len != host_len) {
109			fprintf(fp, "to %s/%u ", rt_addr_n2a(r->rtm_family,
110							 RTA_PAYLOAD(tb[FRA_DST]),
111							 RTA_DATA(tb[FRA_DST]),
112							 abuf, sizeof(abuf)),
113				r->rtm_dst_len
114				);
115		} else {
116			fprintf(fp, "to %s ", format_host(r->rtm_family,
117						       RTA_PAYLOAD(tb[FRA_DST]),
118						       RTA_DATA(tb[FRA_DST]),
119						       abuf, sizeof(abuf)));
120		}
121	} else if (r->rtm_dst_len) {
122		fprintf(fp, "to 0/%d ", r->rtm_dst_len);
123	}
124
125	if (r->rtm_tos) {
126		SPRINT_BUF(b1);
127		fprintf(fp, "tos %s ", rtnl_dsfield_n2a(r->rtm_tos, b1, sizeof(b1)));
128	}
129
130 	if (tb[FRA_FWMARK] || tb[FRA_FWMASK]) {
131		__u32 mark = 0, mask = 0;
132
133		if (tb[FRA_FWMARK])
134			mark = *(__u32*)RTA_DATA(tb[FRA_FWMARK]);
135
136		if (tb[FRA_FWMASK] &&
137		    (mask = *(__u32*)RTA_DATA(tb[FRA_FWMASK])) != 0xFFFFFFFF)
138			fprintf(fp, "fwmark 0x%x/0x%x ", mark, mask);
139		else
140			fprintf(fp, "fwmark 0x%x ", mark);
141	}
142
143	if (tb[FRA_IFNAME]) {
144		fprintf(fp, "iif %s ", (char*)RTA_DATA(tb[FRA_IFNAME]));
145		if (r->rtm_flags & FIB_RULE_IIF_DETACHED)
146			fprintf(fp, "[detached] ");
147	}
148
149	if (tb[FRA_OIFNAME]) {
150		fprintf(fp, "oif %s ", (char*)RTA_DATA(tb[FRA_OIFNAME]));
151		if (r->rtm_flags & FIB_RULE_OIF_DETACHED)
152			fprintf(fp, "[detached] ");
153	}
154
155	table = rtm_get_table(r, tb);
156	if (table)
157		fprintf(fp, "lookup %s ", rtnl_rttable_n2a(table, b1, sizeof(b1)));
158
159	if (tb[FRA_FLOW]) {
160		__u32 to = *(__u32*)RTA_DATA(tb[FRA_FLOW]);
161		__u32 from = to>>16;
162		to &= 0xFFFF;
163		if (from) {
164			fprintf(fp, "realms %s/",
165				rtnl_rtrealm_n2a(from, b1, sizeof(b1)));
166		}
167		fprintf(fp, "%s ",
168			rtnl_rtrealm_n2a(to, b1, sizeof(b1)));
169	}
170
171	if (r->rtm_type == RTN_NAT) {
172		if (tb[RTA_GATEWAY]) {
173			fprintf(fp, "map-to %s ",
174				format_host(r->rtm_family,
175					    RTA_PAYLOAD(tb[RTA_GATEWAY]),
176					    RTA_DATA(tb[RTA_GATEWAY]),
177					    abuf, sizeof(abuf)));
178		} else
179			fprintf(fp, "masquerade");
180	} else if (r->rtm_type == FR_ACT_GOTO) {
181		fprintf(fp, "goto ");
182		if (tb[FRA_GOTO])
183			fprintf(fp, "%u", *(__u32 *) RTA_DATA(tb[FRA_GOTO]));
184		else
185			fprintf(fp, "none");
186		if (r->rtm_flags & FIB_RULE_UNRESOLVED)
187			fprintf(fp, " [unresolved]");
188	} else if (r->rtm_type == FR_ACT_NOP)
189		fprintf(fp, "nop");
190	else if (r->rtm_type != RTN_UNICAST)
191		fprintf(fp, "%s", rtnl_rtntype_n2a(r->rtm_type, b1, sizeof(b1)));
192
193	fprintf(fp, "\n");
194	fflush(fp);
195	return 0;
196}
197
198static int iprule_list(int argc, char **argv)
199{
200	int af = preferred_family;
201
202	if (af == AF_UNSPEC)
203		af = AF_INET;
204
205	if (argc > 0) {
206		fprintf(stderr, "\"ip rule show\" does not take any arguments.\n");
207		return -1;
208	}
209
210	if (rtnl_wilddump_request(&rth, af, RTM_GETRULE) < 0) {
211		perror("Cannot send dump request");
212		return 1;
213	}
214
215	if (rtnl_dump_filter(&rth, print_rule, stdout, NULL, NULL) < 0) {
216		fprintf(stderr, "Dump terminated\n");
217		return 1;
218	}
219
220	return 0;
221}
222
223
224static int iprule_modify(int cmd, int argc, char **argv)
225{
226	int table_ok = 0;
227	struct {
228		struct nlmsghdr 	n;
229		struct rtmsg 		r;
230		char   			buf[1024];
231	} req;
232
233	memset(&req, 0, sizeof(req));
234
235	req.n.nlmsg_type = cmd;
236	req.n.nlmsg_len = NLMSG_LENGTH(sizeof(struct rtmsg));
237	req.n.nlmsg_flags = NLM_F_REQUEST;
238	req.r.rtm_family = preferred_family;
239	req.r.rtm_protocol = RTPROT_BOOT;
240	req.r.rtm_scope = RT_SCOPE_UNIVERSE;
241	req.r.rtm_table = 0;
242	req.r.rtm_type = RTN_UNSPEC;
243	req.r.rtm_flags = 0;
244
245	if (cmd == RTM_NEWRULE) {
246		req.n.nlmsg_flags |= NLM_F_CREATE|NLM_F_EXCL;
247		req.r.rtm_type = RTN_UNICAST;
248	}
249
250	while (argc > 0) {
251		if (strcmp(*argv, "not") == 0) {
252			req.r.rtm_flags |= FIB_RULE_INVERT;
253		} else if (strcmp(*argv, "from") == 0) {
254			inet_prefix dst;
255			NEXT_ARG();
256			get_prefix(&dst, *argv, req.r.rtm_family);
257			req.r.rtm_src_len = dst.bitlen;
258			addattr_l(&req.n, sizeof(req), FRA_SRC, &dst.data, dst.bytelen);
259		} else if (strcmp(*argv, "to") == 0) {
260			inet_prefix dst;
261			NEXT_ARG();
262			get_prefix(&dst, *argv, req.r.rtm_family);
263			req.r.rtm_dst_len = dst.bitlen;
264			addattr_l(&req.n, sizeof(req), FRA_DST, &dst.data, dst.bytelen);
265		} else if (matches(*argv, "preference") == 0 ||
266			   matches(*argv, "order") == 0 ||
267			   matches(*argv, "priority") == 0) {
268			__u32 pref;
269			NEXT_ARG();
270			if (get_u32(&pref, *argv, 0))
271				invarg("preference value is invalid\n", *argv);
272			addattr32(&req.n, sizeof(req), FRA_PRIORITY, pref);
273		} else if (strcmp(*argv, "tos") == 0 ||
274			   matches(*argv, "dsfield") == 0) {
275			__u32 tos;
276			NEXT_ARG();
277			if (rtnl_dsfield_a2n(&tos, *argv))
278				invarg("TOS value is invalid\n", *argv);
279			req.r.rtm_tos = tos;
280		} else if (strcmp(*argv, "fwmark") == 0) {
281			char *slash;
282			__u32 fwmark, fwmask;
283			NEXT_ARG();
284			if ((slash = strchr(*argv, '/')) != NULL)
285				*slash = '\0';
286			if (get_u32(&fwmark, *argv, 0))
287				invarg("fwmark value is invalid\n", *argv);
288			addattr32(&req.n, sizeof(req), FRA_FWMARK, fwmark);
289			if (slash) {
290				if (get_u32(&fwmask, slash+1, 0))
291					invarg("fwmask value is invalid\n", slash+1);
292				addattr32(&req.n, sizeof(req), FRA_FWMASK, fwmask);
293			}
294		} else if (matches(*argv, "realms") == 0) {
295			__u32 realm;
296			NEXT_ARG();
297			if (get_rt_realms(&realm, *argv))
298				invarg("invalid realms\n", *argv);
299			addattr32(&req.n, sizeof(req), FRA_FLOW, realm);
300		} else if (matches(*argv, "table") == 0 ||
301			   strcmp(*argv, "lookup") == 0) {
302			__u32 tid;
303			NEXT_ARG();
304			if (rtnl_rttable_a2n(&tid, *argv))
305				invarg("invalid table ID\n", *argv);
306			if (tid < 256)
307				req.r.rtm_table = tid;
308			else {
309				req.r.rtm_table = RT_TABLE_UNSPEC;
310				addattr32(&req.n, sizeof(req), FRA_TABLE, tid);
311			}
312			table_ok = 1;
313		} else if (strcmp(*argv, "dev") == 0 ||
314			   strcmp(*argv, "iif") == 0) {
315			NEXT_ARG();
316			addattr_l(&req.n, sizeof(req), FRA_IFNAME, *argv, strlen(*argv)+1);
317		} else if (strcmp(*argv, "oif") == 0) {
318			NEXT_ARG();
319			addattr_l(&req.n, sizeof(req), FRA_OIFNAME, *argv, strlen(*argv)+1);
320		} else if (strcmp(*argv, "nat") == 0 ||
321			   matches(*argv, "map-to") == 0) {
322			NEXT_ARG();
323			fprintf(stderr, "Warning: route NAT is deprecated\n");
324			addattr32(&req.n, sizeof(req), RTA_GATEWAY, get_addr32(*argv));
325			req.r.rtm_type = RTN_NAT;
326		} else {
327			int type;
328
329			if (strcmp(*argv, "type") == 0) {
330				NEXT_ARG();
331			}
332			if (matches(*argv, "help") == 0)
333				usage();
334			else if (matches(*argv, "goto") == 0) {
335				__u32 target;
336				type = FR_ACT_GOTO;
337				NEXT_ARG();
338				if (get_u32(&target, *argv, 0))
339					invarg("invalid target\n", *argv);
340				addattr32(&req.n, sizeof(req), FRA_GOTO, target);
341			} else if (matches(*argv, "nop") == 0)
342				type = FR_ACT_NOP;
343			else if (rtnl_rtntype_a2n(&type, *argv))
344				invarg("Failed to parse rule type", *argv);
345			req.r.rtm_type = type;
346			table_ok = 1;
347		}
348		argc--;
349		argv++;
350	}
351
352	if (req.r.rtm_family == AF_UNSPEC)
353		req.r.rtm_family = AF_INET;
354
355	if (!table_ok && cmd == RTM_NEWRULE)
356		req.r.rtm_table = RT_TABLE_MAIN;
357
358	if (rtnl_talk(&rth, &req.n, 0, 0, NULL, NULL, NULL) < 0)
359		return 2;
360
361	return 0;
362}
363
364
365static int flush_rule(const struct sockaddr_nl *who, struct nlmsghdr *n, void *arg)
366{
367	struct rtnl_handle rth2;
368	struct rtmsg *r = NLMSG_DATA(n);
369	int len = n->nlmsg_len;
370	struct rtattr * tb[FRA_MAX+1];
371
372	len -= NLMSG_LENGTH(sizeof(*r));
373	if (len < 0)
374		return -1;
375
376	parse_rtattr(tb, FRA_MAX, RTM_RTA(r), len);
377
378	if (tb[FRA_PRIORITY]) {
379		n->nlmsg_type = RTM_DELRULE;
380		n->nlmsg_flags = NLM_F_REQUEST;
381
382		if (rtnl_open(&rth2, 0) < 0)
383			return -1;
384
385		if (rtnl_talk(&rth2, n, 0, 0, NULL, NULL, NULL) < 0)
386			return -2;
387
388		rtnl_close(&rth2);
389	}
390
391	return 0;
392}
393
394static int iprule_flush(int argc, char **argv)
395{
396	int af = preferred_family;
397
398	if (af == AF_UNSPEC)
399		af = AF_INET;
400
401	if (argc > 0) {
402		fprintf(stderr, "\"ip rule flush\" does not allow arguments\n");
403		return -1;
404	}
405
406	if (rtnl_wilddump_request(&rth, af, RTM_GETRULE) < 0) {
407		perror("Cannot send dump request");
408		return 1;
409	}
410
411	if (rtnl_dump_filter(&rth, flush_rule, NULL, NULL, NULL) < 0) {
412		fprintf(stderr, "Flush terminated\n");
413		return 1;
414	}
415
416	return 0;
417}
418
419int do_iprule(int argc, char **argv)
420{
421	if (argc < 1) {
422		return iprule_list(0, NULL);
423	} else if (matches(argv[0], "list") == 0 ||
424		   matches(argv[0], "lst") == 0 ||
425		   matches(argv[0], "show") == 0) {
426		return iprule_list(argc-1, argv+1);
427	} else if (matches(argv[0], "add") == 0) {
428		return iprule_modify(RTM_NEWRULE, argc-1, argv+1);
429	} else if (matches(argv[0], "delete") == 0) {
430		return iprule_modify(RTM_DELRULE, argc-1, argv+1);
431	} else if (matches(argv[0], "flush") == 0) {
432		return iprule_flush(argc-1, argv+1);
433	} else if (matches(argv[0], "help") == 0)
434		usage();
435
436	fprintf(stderr, "Command \"%s\" is unknown, try \"ip rule help\".\n", *argv);
437	exit(-1);
438}
439
440int do_multirule(int argc, char **argv)
441{
442	switch (preferred_family) {
443	case AF_UNSPEC:
444	case AF_INET:
445		preferred_family = RTNL_FAMILY_IPMR;
446		break;
447	case AF_INET6:
448		preferred_family = RTNL_FAMILY_IP6MR;
449		break;
450	case RTNL_FAMILY_IPMR:
451	case RTNL_FAMILY_IP6MR:
452		break;
453	default:
454		fprintf(stderr, "Multicast rules are only supported for IPv4/IPv6, was: %i\n",
455			preferred_family);
456		exit(-1);
457	}
458
459	return do_iprule(argc, argv);
460}
461