1/*
2 * iprule.c		"ip rule".
3 *
4 *		This program is free software; you can redistribute it and/or
5 *		modify it under the terms of the GNU General Public License
6 *		as published by the Free Software Foundation; either version
7 *		2 of the License, or (at your option) any later version.
8 *
9 * Authors:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
10 *
11 */
12
13#include <stdio.h>
14#include <stdlib.h>
15#include <unistd.h>
16#include <syslog.h>
17#include <fcntl.h>
18#include <sys/socket.h>
19#include <netinet/in.h>
20#include <netinet/ip.h>
21#include <arpa/inet.h>
22#include <string.h>
23#include <linux/fib_rules.h>
24
25#include "rt_names.h"
26#include "utils.h"
27#include "ip_common.h"
28
29extern struct rtnl_handle rth;
30
31static void usage(void) __attribute__((noreturn));
32
33static void usage(void)
34{
35	fprintf(stderr, "Usage: ip rule [ list | add | del | flush ] SELECTOR ACTION\n");
36	fprintf(stderr, "SELECTOR := [ not ] [ from PREFIX ] [ to PREFIX ] [ tos TOS ] [ fwmark FWMARK[/MASK] ]\n");
37	fprintf(stderr, "            [ iif STRING ] [ oif STRING ] [ pref NUMBER ] [ uidrange UID1-UID2 ]\n");
38	fprintf(stderr, "ACTION := [ table TABLE_ID ]\n");
39	fprintf(stderr, "          [ prohibit | reject | unreachable ]\n");
40	fprintf(stderr, "          [ realms [SRCREALM/]DSTREALM ]\n");
41	fprintf(stderr, "          [ goto NUMBER ]\n");
42	fprintf(stderr, "TABLE_ID := [ local | main | default | NUMBER ]\n");
43	exit(-1);
44}
45
46int print_rule(const struct sockaddr_nl *who, struct nlmsghdr *n, void *arg)
47{
48	FILE *fp = (FILE*)arg;
49	struct rtmsg *r = NLMSG_DATA(n);
50	int len = n->nlmsg_len;
51	int host_len = -1;
52	__u32 table, uid_start, uid_end;
53	struct rtattr * tb[FRA_MAX+1];
54	char abuf[256];
55	SPRINT_BUF(b1);
56
57	if (n->nlmsg_type != RTM_NEWRULE && n->nlmsg_type != RTM_DELRULE)
58		return 0;
59
60	len -= NLMSG_LENGTH(sizeof(*r));
61	if (len < 0)
62		return -1;
63
64	parse_rtattr(tb, FRA_MAX, RTM_RTA(r), len);
65
66	if (r->rtm_family == AF_INET)
67		host_len = 32;
68	else if (r->rtm_family == AF_INET6)
69		host_len = 128;
70	else if (r->rtm_family == AF_DECnet)
71		host_len = 16;
72	else if (r->rtm_family == AF_IPX)
73		host_len = 80;
74
75	if (n->nlmsg_type == RTM_DELRULE)
76		fprintf(fp, "Deleted ");
77
78	if (tb[FRA_PRIORITY])
79		fprintf(fp, "%u:\t", *(unsigned*)RTA_DATA(tb[FRA_PRIORITY]));
80	else
81		fprintf(fp, "0:\t");
82
83	if (r->rtm_flags & FIB_RULE_INVERT)
84		fprintf(fp, "not ");
85
86	if (tb[FRA_SRC]) {
87		if (r->rtm_src_len != host_len) {
88			fprintf(fp, "from %s/%u ", rt_addr_n2a(r->rtm_family,
89							 RTA_PAYLOAD(tb[FRA_SRC]),
90							 RTA_DATA(tb[FRA_SRC]),
91							 abuf, sizeof(abuf)),
92				r->rtm_src_len
93				);
94		} else {
95			fprintf(fp, "from %s ", format_host(r->rtm_family,
96						       RTA_PAYLOAD(tb[FRA_SRC]),
97						       RTA_DATA(tb[FRA_SRC]),
98						       abuf, sizeof(abuf))
99				);
100		}
101	} else if (r->rtm_src_len) {
102		fprintf(fp, "from 0/%d ", r->rtm_src_len);
103	} else {
104		fprintf(fp, "from all ");
105	}
106
107	if (tb[FRA_DST]) {
108		if (r->rtm_dst_len != host_len) {
109			fprintf(fp, "to %s/%u ", rt_addr_n2a(r->rtm_family,
110							 RTA_PAYLOAD(tb[FRA_DST]),
111							 RTA_DATA(tb[FRA_DST]),
112							 abuf, sizeof(abuf)),
113				r->rtm_dst_len
114				);
115		} else {
116			fprintf(fp, "to %s ", format_host(r->rtm_family,
117						       RTA_PAYLOAD(tb[FRA_DST]),
118						       RTA_DATA(tb[FRA_DST]),
119						       abuf, sizeof(abuf)));
120		}
121	} else if (r->rtm_dst_len) {
122		fprintf(fp, "to 0/%d ", r->rtm_dst_len);
123	}
124
125	if (r->rtm_tos) {
126		SPRINT_BUF(b1);
127		fprintf(fp, "tos %s ", rtnl_dsfield_n2a(r->rtm_tos, b1, sizeof(b1)));
128	}
129
130 	if (tb[FRA_FWMARK] || tb[FRA_FWMASK]) {
131		__u32 mark = 0, mask = 0;
132
133		if (tb[FRA_FWMARK])
134			mark = rta_getattr_u32(tb[FRA_FWMARK]);
135
136		if (tb[FRA_FWMASK] &&
137		    (mask = rta_getattr_u32(tb[FRA_FWMASK])) != 0xFFFFFFFF)
138			fprintf(fp, "fwmark 0x%x/0x%x ", mark, mask);
139		else
140			fprintf(fp, "fwmark 0x%x ", mark);
141	}
142
143	if (tb[FRA_IFNAME]) {
144		fprintf(fp, "iif %s ", rta_getattr_str(tb[FRA_IFNAME]));
145		if (r->rtm_flags & FIB_RULE_IIF_DETACHED)
146			fprintf(fp, "[detached] ");
147	}
148
149	if (tb[FRA_OIFNAME]) {
150		fprintf(fp, "oif %s ", rta_getattr_str(tb[FRA_OIFNAME]));
151		if (r->rtm_flags & FIB_RULE_OIF_DETACHED)
152			fprintf(fp, "[detached] ");
153	}
154
155	if (tb[FRA_UID_START] || tb[FRA_UID_END]) {
156		fprintf(fp, "uidrange ");
157		if (tb[FRA_UID_START])
158			fprintf(fp, "%u", rta_getattr_u32(tb[FRA_UID_START]));
159		else
160			fprintf(fp, "???");
161
162		if (tb[FRA_UID_END])
163			fprintf(fp, "-%u ", rta_getattr_u32(tb[FRA_UID_END]));
164		else
165			fprintf(fp, "-??? ");
166	}
167
168	table = rtm_get_table(r, tb);
169	if (table)
170		fprintf(fp, "lookup %s ", rtnl_rttable_n2a(table, b1, sizeof(b1)));
171
172	if (tb[FRA_FLOW]) {
173		__u32 to = rta_getattr_u32(tb[FRA_FLOW]);
174		__u32 from = to>>16;
175		to &= 0xFFFF;
176		if (from) {
177			fprintf(fp, "realms %s/",
178				rtnl_rtrealm_n2a(from, b1, sizeof(b1)));
179		}
180		fprintf(fp, "%s ",
181			rtnl_rtrealm_n2a(to, b1, sizeof(b1)));
182	}
183
184	if (r->rtm_type == RTN_NAT) {
185		if (tb[RTA_GATEWAY]) {
186			fprintf(fp, "map-to %s ",
187				format_host(r->rtm_family,
188					    RTA_PAYLOAD(tb[RTA_GATEWAY]),
189					    RTA_DATA(tb[RTA_GATEWAY]),
190					    abuf, sizeof(abuf)));
191		} else
192			fprintf(fp, "masquerade");
193	} else if (r->rtm_type == FR_ACT_GOTO) {
194		fprintf(fp, "goto ");
195		if (tb[FRA_GOTO])
196			fprintf(fp, "%u", rta_getattr_u32(tb[FRA_GOTO]));
197		else
198			fprintf(fp, "none");
199		if (r->rtm_flags & FIB_RULE_UNRESOLVED)
200			fprintf(fp, " [unresolved]");
201	} else if (r->rtm_type == FR_ACT_NOP)
202		fprintf(fp, "nop");
203	else if (r->rtm_type != RTN_UNICAST)
204		fprintf(fp, "%s", rtnl_rtntype_n2a(r->rtm_type, b1, sizeof(b1)));
205
206	fprintf(fp, "\n");
207	fflush(fp);
208	return 0;
209}
210
211static int iprule_list(int argc, char **argv)
212{
213	int af = preferred_family;
214
215	if (af == AF_UNSPEC)
216		af = AF_INET;
217
218	if (argc > 0) {
219		fprintf(stderr, "\"ip rule show\" does not take any arguments.\n");
220		return -1;
221	}
222
223	if (rtnl_wilddump_request(&rth, af, RTM_GETRULE) < 0) {
224		perror("Cannot send dump request");
225		return 1;
226	}
227
228	if (rtnl_dump_filter(&rth, print_rule, stdout) < 0) {
229		fprintf(stderr, "Dump terminated\n");
230		return 1;
231	}
232
233	return 0;
234}
235
236
237static int iprule_modify(int cmd, int argc, char **argv)
238{
239	int table_ok = 0;
240	struct {
241		struct nlmsghdr 	n;
242		struct rtmsg 		r;
243		char   			buf[1024];
244	} req;
245
246	memset(&req, 0, sizeof(req));
247
248	req.n.nlmsg_type = cmd;
249	req.n.nlmsg_len = NLMSG_LENGTH(sizeof(struct rtmsg));
250	req.n.nlmsg_flags = NLM_F_REQUEST;
251	req.r.rtm_family = preferred_family;
252	req.r.rtm_protocol = RTPROT_BOOT;
253	req.r.rtm_scope = RT_SCOPE_UNIVERSE;
254	req.r.rtm_table = 0;
255	req.r.rtm_type = RTN_UNSPEC;
256	req.r.rtm_flags = 0;
257
258	if (cmd == RTM_NEWRULE) {
259		req.n.nlmsg_flags |= NLM_F_CREATE|NLM_F_EXCL;
260		req.r.rtm_type = RTN_UNICAST;
261	}
262
263	while (argc > 0) {
264		if (strcmp(*argv, "not") == 0) {
265			req.r.rtm_flags |= FIB_RULE_INVERT;
266		} else if (strcmp(*argv, "from") == 0) {
267			inet_prefix dst;
268			NEXT_ARG();
269			get_prefix(&dst, *argv, req.r.rtm_family);
270			req.r.rtm_src_len = dst.bitlen;
271			addattr_l(&req.n, sizeof(req), FRA_SRC, &dst.data, dst.bytelen);
272		} else if (strcmp(*argv, "to") == 0) {
273			inet_prefix dst;
274			NEXT_ARG();
275			get_prefix(&dst, *argv, req.r.rtm_family);
276			req.r.rtm_dst_len = dst.bitlen;
277			addattr_l(&req.n, sizeof(req), FRA_DST, &dst.data, dst.bytelen);
278		} else if (matches(*argv, "preference") == 0 ||
279			   matches(*argv, "order") == 0 ||
280			   matches(*argv, "priority") == 0) {
281			__u32 pref;
282			NEXT_ARG();
283			if (get_u32(&pref, *argv, 0))
284				invarg("preference value is invalid\n", *argv);
285			addattr32(&req.n, sizeof(req), FRA_PRIORITY, pref);
286		} else if (strcmp(*argv, "tos") == 0 ||
287			   matches(*argv, "dsfield") == 0) {
288			__u32 tos;
289			NEXT_ARG();
290			if (rtnl_dsfield_a2n(&tos, *argv))
291				invarg("TOS value is invalid\n", *argv);
292			req.r.rtm_tos = tos;
293		} else if (strcmp(*argv, "fwmark") == 0) {
294			char *slash;
295			__u32 fwmark, fwmask;
296			NEXT_ARG();
297			if ((slash = strchr(*argv, '/')) != NULL)
298				*slash = '\0';
299			if (get_u32(&fwmark, *argv, 0))
300				invarg("fwmark value is invalid\n", *argv);
301			addattr32(&req.n, sizeof(req), FRA_FWMARK, fwmark);
302			if (slash) {
303				if (get_u32(&fwmask, slash+1, 0))
304					invarg("fwmask value is invalid\n", slash+1);
305				addattr32(&req.n, sizeof(req), FRA_FWMASK, fwmask);
306			}
307		} else if (matches(*argv, "realms") == 0) {
308			__u32 realm;
309			NEXT_ARG();
310			if (get_rt_realms(&realm, *argv))
311				invarg("invalid realms\n", *argv);
312			addattr32(&req.n, sizeof(req), FRA_FLOW, realm);
313		} else if (matches(*argv, "table") == 0 ||
314			   strcmp(*argv, "lookup") == 0) {
315			__u32 tid;
316			NEXT_ARG();
317			if (rtnl_rttable_a2n(&tid, *argv))
318				invarg("invalid table ID\n", *argv);
319			if (tid < 256)
320				req.r.rtm_table = tid;
321			else {
322				req.r.rtm_table = RT_TABLE_UNSPEC;
323				addattr32(&req.n, sizeof(req), FRA_TABLE, tid);
324			}
325			table_ok = 1;
326		} else if (strcmp(*argv, "dev") == 0 ||
327			   strcmp(*argv, "iif") == 0) {
328			NEXT_ARG();
329			addattr_l(&req.n, sizeof(req), FRA_IFNAME, *argv, strlen(*argv)+1);
330		} else if (strcmp(*argv, "oif") == 0) {
331			NEXT_ARG();
332			addattr_l(&req.n, sizeof(req), FRA_OIFNAME, *argv, strlen(*argv)+1);
333		} else if (strcmp(*argv, "nat") == 0 ||
334			   matches(*argv, "map-to") == 0) {
335			NEXT_ARG();
336			fprintf(stderr, "Warning: route NAT is deprecated\n");
337			addattr32(&req.n, sizeof(req), RTA_GATEWAY, get_addr32(*argv));
338			req.r.rtm_type = RTN_NAT;
339		} else if (strcmp(*argv, "uidrange") == 0) {
340			__u32 uid_start, uid_end;
341			NEXT_ARG();
342			if (sscanf(*argv, "%u-%u", &uid_start, &uid_end) != 2)
343				invarg("UID range is invalid\n", *argv);
344			addattr32(&req.n, sizeof(req), FRA_UID_START, uid_start);
345			addattr32(&req.n, sizeof(req), FRA_UID_END, uid_end);
346		} else {
347			int type;
348
349			if (strcmp(*argv, "type") == 0) {
350				NEXT_ARG();
351			}
352			if (matches(*argv, "help") == 0)
353				usage();
354			else if (matches(*argv, "goto") == 0) {
355				__u32 target;
356				type = FR_ACT_GOTO;
357				NEXT_ARG();
358				if (get_u32(&target, *argv, 0))
359					invarg("invalid target\n", *argv);
360				addattr32(&req.n, sizeof(req), FRA_GOTO, target);
361			} else if (matches(*argv, "nop") == 0)
362				type = FR_ACT_NOP;
363			else if (rtnl_rtntype_a2n(&type, *argv))
364				invarg("Failed to parse rule type", *argv);
365			req.r.rtm_type = type;
366			table_ok = 1;
367		}
368		argc--;
369		argv++;
370	}
371
372	if (req.r.rtm_family == AF_UNSPEC)
373		req.r.rtm_family = AF_INET;
374
375	if (!table_ok && cmd == RTM_NEWRULE)
376		req.r.rtm_table = RT_TABLE_MAIN;
377
378	if (rtnl_talk(&rth, &req.n, 0, 0, NULL) < 0)
379		return 2;
380
381	return 0;
382}
383
384
385static int flush_rule(const struct sockaddr_nl *who, struct nlmsghdr *n, void *arg)
386{
387	struct rtnl_handle rth2;
388	struct rtmsg *r = NLMSG_DATA(n);
389	int len = n->nlmsg_len;
390	struct rtattr * tb[FRA_MAX+1];
391
392	len -= NLMSG_LENGTH(sizeof(*r));
393	if (len < 0)
394		return -1;
395
396	parse_rtattr(tb, FRA_MAX, RTM_RTA(r), len);
397
398	if (tb[FRA_PRIORITY]) {
399		n->nlmsg_type = RTM_DELRULE;
400		n->nlmsg_flags = NLM_F_REQUEST;
401
402		if (rtnl_open(&rth2, 0) < 0)
403			return -1;
404
405		if (rtnl_talk(&rth2, n, 0, 0, NULL) < 0)
406			return -2;
407
408		rtnl_close(&rth2);
409	}
410
411	return 0;
412}
413
414static int iprule_flush(int argc, char **argv)
415{
416	int af = preferred_family;
417
418	if (af == AF_UNSPEC)
419		af = AF_INET;
420
421	if (argc > 0) {
422		fprintf(stderr, "\"ip rule flush\" does not allow arguments\n");
423		return -1;
424	}
425
426	if (rtnl_wilddump_request(&rth, af, RTM_GETRULE) < 0) {
427		perror("Cannot send dump request");
428		return 1;
429	}
430
431	if (rtnl_dump_filter(&rth, flush_rule, NULL) < 0) {
432		fprintf(stderr, "Flush terminated\n");
433		return 1;
434	}
435
436	return 0;
437}
438
439int do_iprule(int argc, char **argv)
440{
441	if (argc < 1) {
442		return iprule_list(0, NULL);
443	} else if (matches(argv[0], "list") == 0 ||
444		   matches(argv[0], "lst") == 0 ||
445		   matches(argv[0], "show") == 0) {
446		return iprule_list(argc-1, argv+1);
447	} else if (matches(argv[0], "add") == 0) {
448		return iprule_modify(RTM_NEWRULE, argc-1, argv+1);
449	} else if (matches(argv[0], "delete") == 0) {
450		return iprule_modify(RTM_DELRULE, argc-1, argv+1);
451	} else if (matches(argv[0], "flush") == 0) {
452		return iprule_flush(argc-1, argv+1);
453	} else if (matches(argv[0], "help") == 0)
454		usage();
455
456	fprintf(stderr, "Command \"%s\" is unknown, try \"ip rule help\".\n", *argv);
457	exit(-1);
458}
459
460int do_multirule(int argc, char **argv)
461{
462	switch (preferred_family) {
463	case AF_UNSPEC:
464	case AF_INET:
465		preferred_family = RTNL_FAMILY_IPMR;
466		break;
467	case AF_INET6:
468		preferred_family = RTNL_FAMILY_IP6MR;
469		break;
470	case RTNL_FAMILY_IPMR:
471	case RTNL_FAMILY_IP6MR:
472		break;
473	default:
474		fprintf(stderr, "Multicast rules are only supported for IPv4/IPv6, was: %i\n",
475			preferred_family);
476		exit(-1);
477	}
478
479	return do_iprule(argc, argv);
480}
481