iprule.c revision 85eae222d252546435bb5638b15d46ccfc9df32a 
1/*
2 * iprule.c		"ip rule".
3 *
4 *		This program is free software; you can redistribute it and/or
5 *		modify it under the terms of the GNU General Public License
6 *		as published by the Free Software Foundation; either version
7 *		2 of the License, or (at your option) any later version.
8 *
9 * Authors:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
10 *
11 */
12
13#include <stdio.h>
14#include <stdlib.h>
15#include <unistd.h>
16#include <syslog.h>
17#include <fcntl.h>
18#include <sys/socket.h>
19#include <netinet/in.h>
20#include <netinet/ip.h>
21#include <arpa/inet.h>
22#include <string.h>
23#include <linux/fib_rules.h>
24
25#include "rt_names.h"
26#include "utils.h"
27#include "ip_common.h"
28
29extern struct rtnl_handle rth;
30
31static void usage(void) __attribute__((noreturn));
32
33static void usage(void)
34{
35	fprintf(stderr, "Usage: ip rule [ list | add | del | flush ] SELECTOR ACTION\n");
36	fprintf(stderr, "SELECTOR := [ not ] [ from PREFIX ] [ to PREFIX ] [ tos TOS ] [ fwmark FWMARK[/MASK] ]\n");
37	fprintf(stderr, "            [ iif STRING ] [ oif STRING ] [ pref NUMBER ]\n");
38	fprintf(stderr, "ACTION := [ table TABLE_ID ]\n");
39	fprintf(stderr, "          [ prohibit | reject | unreachable ]\n");
40	fprintf(stderr, "          [ realms [SRCREALM/]DSTREALM ]\n");
41	fprintf(stderr, "          [ goto NUMBER ]\n");
42	fprintf(stderr, "TABLE_ID := [ local | main | default | NUMBER ]\n");
43	exit(-1);
44}
45
46int print_rule(const struct sockaddr_nl *who, struct nlmsghdr *n, void *arg)
47{
48	FILE *fp = (FILE*)arg;
49	struct rtmsg *r = NLMSG_DATA(n);
50	int len = n->nlmsg_len;
51	int host_len = -1;
52	__u32 table;
53	struct rtattr * tb[FRA_MAX+1];
54	char abuf[256];
55	SPRINT_BUF(b1);
56
57	if (n->nlmsg_type != RTM_NEWRULE && n->nlmsg_type != RTM_DELRULE)
58		return 0;
59
60	len -= NLMSG_LENGTH(sizeof(*r));
61	if (len < 0)
62		return -1;
63
64	parse_rtattr(tb, FRA_MAX, RTM_RTA(r), len);
65
66	if (r->rtm_family == AF_INET)
67		host_len = 32;
68	else if (r->rtm_family == AF_INET6)
69		host_len = 128;
70	else if (r->rtm_family == AF_DECnet)
71		host_len = 16;
72	else if (r->rtm_family == AF_IPX)
73		host_len = 80;
74
75	if (n->nlmsg_type == RTM_DELRULE)
76		fprintf(fp, "Deleted ");
77
78	if (tb[FRA_PRIORITY])
79		fprintf(fp, "%u:\t", *(unsigned*)RTA_DATA(tb[FRA_PRIORITY]));
80	else
81		fprintf(fp, "0:\t");
82
83	if (r->rtm_flags & FIB_RULE_INVERT)
84		fprintf(fp, "not ");
85
86	if (tb[FRA_SRC]) {
87		if (r->rtm_src_len != host_len) {
88			fprintf(fp, "from %s/%u ", rt_addr_n2a(r->rtm_family,
89							 RTA_PAYLOAD(tb[FRA_SRC]),
90							 RTA_DATA(tb[FRA_SRC]),
91							 abuf, sizeof(abuf)),
92				r->rtm_src_len
93				);
94		} else {
95			fprintf(fp, "from %s ", format_host(r->rtm_family,
96						       RTA_PAYLOAD(tb[FRA_SRC]),
97						       RTA_DATA(tb[FRA_SRC]),
98						       abuf, sizeof(abuf))
99				);
100		}
101	} else if (r->rtm_src_len) {
102		fprintf(fp, "from 0/%d ", r->rtm_src_len);
103	} else {
104		fprintf(fp, "from all ");
105	}
106
107	if (tb[FRA_DST]) {
108		if (r->rtm_dst_len != host_len) {
109			fprintf(fp, "to %s/%u ", rt_addr_n2a(r->rtm_family,
110							 RTA_PAYLOAD(tb[FRA_DST]),
111							 RTA_DATA(tb[FRA_DST]),
112							 abuf, sizeof(abuf)),
113				r->rtm_dst_len
114				);
115		} else {
116			fprintf(fp, "to %s ", format_host(r->rtm_family,
117						       RTA_PAYLOAD(tb[FRA_DST]),
118						       RTA_DATA(tb[FRA_DST]),
119						       abuf, sizeof(abuf)));
120		}
121	} else if (r->rtm_dst_len) {
122		fprintf(fp, "to 0/%d ", r->rtm_dst_len);
123	}
124
125	if (r->rtm_tos) {
126		SPRINT_BUF(b1);
127		fprintf(fp, "tos %s ", rtnl_dsfield_n2a(r->rtm_tos, b1, sizeof(b1)));
128	}
129
130 	if (tb[FRA_FWMARK] || tb[FRA_FWMASK]) {
131		__u32 mark = 0, mask = 0;
132
133		if (tb[FRA_FWMARK])
134			mark = *(__u32*)RTA_DATA(tb[FRA_FWMARK]);
135
136		if (tb[FRA_FWMASK] &&
137		    (mask = *(__u32*)RTA_DATA(tb[FRA_FWMASK])) != 0xFFFFFFFF)
138			fprintf(fp, "fwmark 0x%x/0x%x ", mark, mask);
139		else
140			fprintf(fp, "fwmark 0x%x ", mark);
141	}
142
143	if (tb[FRA_IFNAME]) {
144		fprintf(fp, "iif %s ", (char*)RTA_DATA(tb[FRA_IFNAME]));
145		if (r->rtm_flags & FIB_RULE_IIF_DETACHED)
146			fprintf(fp, "[detached] ");
147	}
148
149	if (tb[FRA_OIFNAME]) {
150		fprintf(fp, "oif %s ", (char*)RTA_DATA(tb[FRA_OIFNAME]));
151		if (r->rtm_flags & FIB_RULE_OIF_DETACHED)
152			fprintf(fp, "[detached] ");
153	}
154
155	table = rtm_get_table(r, tb);
156	if (table)
157		fprintf(fp, "lookup %s ", rtnl_rttable_n2a(table, b1, sizeof(b1)));
158
159	if (tb[FRA_FLOW]) {
160		__u32 to = *(__u32*)RTA_DATA(tb[FRA_FLOW]);
161		__u32 from = to>>16;
162		to &= 0xFFFF;
163		if (from) {
164			fprintf(fp, "realms %s/",
165				rtnl_rtrealm_n2a(from, b1, sizeof(b1)));
166		}
167		fprintf(fp, "%s ",
168			rtnl_rtrealm_n2a(to, b1, sizeof(b1)));
169	}
170
171	if (r->rtm_type == RTN_NAT) {
172		if (tb[RTA_GATEWAY]) {
173			fprintf(fp, "map-to %s ",
174				format_host(r->rtm_family,
175					    RTA_PAYLOAD(tb[RTA_GATEWAY]),
176					    RTA_DATA(tb[RTA_GATEWAY]),
177					    abuf, sizeof(abuf)));
178		} else
179			fprintf(fp, "masquerade");
180	} else if (r->rtm_type == FR_ACT_GOTO) {
181		fprintf(fp, "goto ");
182		if (tb[FRA_GOTO])
183			fprintf(fp, "%u", *(__u32 *) RTA_DATA(tb[FRA_GOTO]));
184		else
185			fprintf(fp, "none");
186		if (r->rtm_flags & FIB_RULE_UNRESOLVED)
187			fprintf(fp, " [unresolved]");
188	} else if (r->rtm_type == FR_ACT_NOP)
189		fprintf(fp, "nop");
190	else if (r->rtm_type != RTN_UNICAST)
191		fprintf(fp, "%s", rtnl_rtntype_n2a(r->rtm_type, b1, sizeof(b1)));
192
193	fprintf(fp, "\n");
194	fflush(fp);
195	return 0;
196}
197
198static int iprule_list(int argc, char **argv)
199{
200	int af = preferred_family;
201
202	if (af == AF_UNSPEC)
203		af = AF_INET;
204
205	if (argc > 0) {
206		fprintf(stderr, "\"ip rule show\" does not take any arguments.\n");
207		return -1;
208	}
209
210	if (rtnl_wilddump_request(&rth, af, RTM_GETRULE) < 0) {
211		perror("Cannot send dump request");
212		return 1;
213	}
214
215	if (rtnl_dump_filter(&rth, print_rule, stdout, NULL, NULL) < 0) {
216		fprintf(stderr, "Dump terminated\n");
217		return 1;
218	}
219
220	return 0;
221}
222
223
224static int iprule_modify(int cmd, int argc, char **argv)
225{
226	int table_ok = 0;
227	struct {
228		struct nlmsghdr 	n;
229		struct rtmsg 		r;
230		char   			buf[1024];
231	} req;
232
233	memset(&req, 0, sizeof(req));
234
235	req.n.nlmsg_type = cmd;
236	req.n.nlmsg_len = NLMSG_LENGTH(sizeof(struct rtmsg));
237	req.n.nlmsg_flags = NLM_F_REQUEST;
238	req.r.rtm_family = preferred_family;
239	req.r.rtm_protocol = RTPROT_BOOT;
240	req.r.rtm_scope = RT_SCOPE_UNIVERSE;
241	req.r.rtm_table = 0;
242	req.r.rtm_type = RTN_UNSPEC;
243	req.r.rtm_flags = 0;
244
245	if (cmd == RTM_NEWRULE) {
246		req.n.nlmsg_flags |= NLM_F_CREATE|NLM_F_EXCL;
247		req.r.rtm_type = RTN_UNICAST;
248	}
249
250	while (argc > 0) {
251		if (strcmp(*argv, "not") == 0) {
252			req.r.rtm_flags |= FIB_RULE_INVERT;
253		} else if (strcmp(*argv, "from") == 0) {
254			inet_prefix dst;
255			NEXT_ARG();
256			get_prefix(&dst, *argv, req.r.rtm_family);
257			req.r.rtm_src_len = dst.bitlen;
258			addattr_l(&req.n, sizeof(req), FRA_SRC, &dst.data, dst.bytelen);
259		} else if (strcmp(*argv, "to") == 0) {
260			inet_prefix dst;
261			NEXT_ARG();
262			get_prefix(&dst, *argv, req.r.rtm_family);
263			req.r.rtm_dst_len = dst.bitlen;
264			addattr_l(&req.n, sizeof(req), FRA_DST, &dst.data, dst.bytelen);
265		} else if (matches(*argv, "preference") == 0 ||
266			   matches(*argv, "order") == 0 ||
267			   matches(*argv, "priority") == 0) {
268			__u32 pref;
269			NEXT_ARG();
270			if (get_u32(&pref, *argv, 0))
271				invarg("preference value is invalid\n", *argv);
272			addattr32(&req.n, sizeof(req), FRA_PRIORITY, pref);
273		} else if (strcmp(*argv, "tos") == 0) {
274			__u32 tos;
275			NEXT_ARG();
276			if (rtnl_dsfield_a2n(&tos, *argv))
277				invarg("TOS value is invalid\n", *argv);
278			req.r.rtm_tos = tos;
279		} else if (strcmp(*argv, "fwmark") == 0) {
280			char *slash;
281			__u32 fwmark, fwmask;
282			NEXT_ARG();
283			if ((slash = strchr(*argv, '/')) != NULL)
284				*slash = '\0';
285			if (get_u32(&fwmark, *argv, 0))
286				invarg("fwmark value is invalid\n", *argv);
287			addattr32(&req.n, sizeof(req), FRA_FWMARK, fwmark);
288			if (slash) {
289				if (get_u32(&fwmask, slash+1, 0))
290					invarg("fwmask value is invalid\n", slash+1);
291				addattr32(&req.n, sizeof(req), FRA_FWMASK, fwmask);
292			}
293		} else if (matches(*argv, "realms") == 0) {
294			__u32 realm;
295			NEXT_ARG();
296			if (get_rt_realms(&realm, *argv))
297				invarg("invalid realms\n", *argv);
298			addattr32(&req.n, sizeof(req), FRA_FLOW, realm);
299		} else if (matches(*argv, "table") == 0 ||
300			   strcmp(*argv, "lookup") == 0) {
301			__u32 tid;
302			NEXT_ARG();
303			if (rtnl_rttable_a2n(&tid, *argv))
304				invarg("invalid table ID\n", *argv);
305			if (tid < 256)
306				req.r.rtm_table = tid;
307			else {
308				req.r.rtm_table = RT_TABLE_UNSPEC;
309				addattr32(&req.n, sizeof(req), FRA_TABLE, tid);
310			}
311			table_ok = 1;
312		} else if (strcmp(*argv, "dev") == 0 ||
313			   strcmp(*argv, "iif") == 0) {
314			NEXT_ARG();
315			addattr_l(&req.n, sizeof(req), FRA_IFNAME, *argv, strlen(*argv)+1);
316		} else if (strcmp(*argv, "oif") == 0) {
317			NEXT_ARG();
318			addattr_l(&req.n, sizeof(req), FRA_OIFNAME, *argv, strlen(*argv)+1);
319		} else if (strcmp(*argv, "nat") == 0 ||
320			   matches(*argv, "map-to") == 0) {
321			NEXT_ARG();
322			fprintf(stderr, "Warning: route NAT is deprecated\n");
323			addattr32(&req.n, sizeof(req), RTA_GATEWAY, get_addr32(*argv));
324			req.r.rtm_type = RTN_NAT;
325		} else {
326			int type;
327
328			if (strcmp(*argv, "type") == 0) {
329				NEXT_ARG();
330			}
331			if (matches(*argv, "help") == 0)
332				usage();
333			else if (matches(*argv, "goto") == 0) {
334				__u32 target;
335				type = FR_ACT_GOTO;
336				NEXT_ARG();
337				if (get_u32(&target, *argv, 0))
338					invarg("invalid target\n", *argv);
339				addattr32(&req.n, sizeof(req), FRA_GOTO, target);
340			} else if (matches(*argv, "nop") == 0)
341				type = FR_ACT_NOP;
342			else if (rtnl_rtntype_a2n(&type, *argv))
343				invarg("Failed to parse rule type", *argv);
344			req.r.rtm_type = type;
345			table_ok = 1;
346		}
347		argc--;
348		argv++;
349	}
350
351	if (req.r.rtm_family == AF_UNSPEC)
352		req.r.rtm_family = AF_INET;
353
354	if (!table_ok && cmd == RTM_NEWRULE)
355		req.r.rtm_table = RT_TABLE_MAIN;
356
357	if (rtnl_talk(&rth, &req.n, 0, 0, NULL, NULL, NULL) < 0)
358		return 2;
359
360	return 0;
361}
362
363
364static int flush_rule(const struct sockaddr_nl *who, struct nlmsghdr *n, void *arg)
365{
366	struct rtnl_handle rth2;
367	struct rtmsg *r = NLMSG_DATA(n);
368	int len = n->nlmsg_len;
369	struct rtattr * tb[FRA_MAX+1];
370
371	len -= NLMSG_LENGTH(sizeof(*r));
372	if (len < 0)
373		return -1;
374
375	parse_rtattr(tb, FRA_MAX, RTM_RTA(r), len);
376
377	if (tb[FRA_PRIORITY]) {
378		n->nlmsg_type = RTM_DELRULE;
379		n->nlmsg_flags = NLM_F_REQUEST;
380
381		if (rtnl_open(&rth2, 0) < 0)
382			return -1;
383
384		if (rtnl_talk(&rth2, n, 0, 0, NULL, NULL, NULL) < 0)
385			return -2;
386
387		rtnl_close(&rth2);
388	}
389
390	return 0;
391}
392
393static int iprule_flush(int argc, char **argv)
394{
395	int af = preferred_family;
396
397	if (af == AF_UNSPEC)
398		af = AF_INET;
399
400	if (argc > 0) {
401		fprintf(stderr, "\"ip rule flush\" does not allow arguments\n");
402		return -1;
403	}
404
405	if (rtnl_wilddump_request(&rth, af, RTM_GETRULE) < 0) {
406		perror("Cannot send dump request");
407		return 1;
408	}
409
410	if (rtnl_dump_filter(&rth, flush_rule, NULL, NULL, NULL) < 0) {
411		fprintf(stderr, "Flush terminated\n");
412		return 1;
413	}
414
415	return 0;
416}
417
418int do_iprule(int argc, char **argv)
419{
420	if (argc < 1) {
421		return iprule_list(0, NULL);
422	} else if (matches(argv[0], "list") == 0 ||
423		   matches(argv[0], "lst") == 0 ||
424		   matches(argv[0], "show") == 0) {
425		return iprule_list(argc-1, argv+1);
426	} else if (matches(argv[0], "add") == 0) {
427		return iprule_modify(RTM_NEWRULE, argc-1, argv+1);
428	} else if (matches(argv[0], "delete") == 0) {
429		return iprule_modify(RTM_DELRULE, argc-1, argv+1);
430	} else if (matches(argv[0], "flush") == 0) {
431		return iprule_flush(argc-1, argv+1);
432	} else if (matches(argv[0], "help") == 0)
433		usage();
434
435	fprintf(stderr, "Command \"%s\" is unknown, try \"ip rule help\".\n", *argv);
436	exit(-1);
437}
438
439