1 /* User-kernel network link */
3 /* See RFCs 791, 792, 1123 and 1812 */
5 /* The netlink device is actually a router. Tunnels are unnumbered
6 point-to-point lines (RFC1812 section 2.2.7); the router has a
7 single address (the 'router-id'). */
9 /* This is where we currently have the anti-spoofing paranoia - before
10 sending a packet to the kernel we check that the tunnel it came
11 over could reasonably have produced it. */
14 /* Points to note from RFC1812 (which may require changes in this
17 3.3.4 Maximum Transmission Unit - MTU
19 The MTU of each logical interface MUST be configurable within the
20 range of legal MTUs for the interface.
22 Many Link Layer protocols define a maximum frame size that may be
23 sent. In such cases, a router MUST NOT allow an MTU to be set which
24 would allow sending of frames larger than those allowed by the Link
25 Layer protocol. However, a router SHOULD be willing to receive a
26 packet as large as the maximum frame size even if that is larger than
29 4.2.1 A router SHOULD count datagrams discarded.
31 4.2.2.1 Source route options - we probably should implement processing
32 of source routes, even though mostly the security policy will prevent
35 5.3.13.4 Source Route Options
37 A router MUST implement support for source route options in forwarded
38 packets. A router MAY implement a configuration option that, when
39 enabled, causes all source-routed packets to be discarded. However,
40 such an option MUST NOT be enabled by default.
42 5.3.13.5 Record Route Option
44 Routers MUST support the Record Route option in forwarded packets.
46 A router MAY provide a configuration option that, if enabled, will
47 cause the router to ignore (i.e., pass through unchanged) Record
48 Route options in forwarded packets. If provided, such an option MUST
49 default to enabling the record-route. This option should not affect
50 the processing of Record Route options in datagrams received by the
51 router itself (in particular, Record Route options in ICMP echo
52 requests will still be processed according to Section [4.3.3.6]).
54 5.3.13.6 Timestamp Option
56 Routers MUST support the timestamp option in forwarded packets. A
57 timestamp value MUST follow the rules given [INTRO:2].
59 If the flags field = 3 (timestamp and prespecified address), the
60 router MUST add its timestamp if the next prespecified address
61 matches any of the router's IP addresses. It is not necessary that
62 the prespecified address be either the address of the interface on
63 which the packet arrived or the address of the interface over which
67 4.2.2.7 Fragmentation: RFC 791 Section 3.2
69 Fragmentation, as described in [INTERNET:1], MUST be supported by a
72 4.2.2.8 Reassembly: RFC 791 Section 3.2
74 As specified in the corresponding section of [INTRO:2], a router MUST
75 support reassembly of datagrams that it delivers to itself.
77 4.2.2.9 Time to Live: RFC 791 Section 3.2
79 Note in particular that a router MUST NOT check the TTL of a packet
80 except when forwarding it.
82 A router MUST NOT discard a datagram just because it was received
83 with TTL equal to zero or one; if it is to the router and otherwise
84 valid, the router MUST attempt to receive it.
86 On messages the router originates, the IP layer MUST provide a means
87 for the transport layer to set the TTL field of every datagram that
88 is sent. When a fixed TTL value is used, it MUST be configurable.
91 8.1 The Simple Network Management Protocol - SNMP
92 8.1.1 SNMP Protocol Elements
94 Routers MUST be manageable by SNMP [MGT:3]. The SNMP MUST operate
95 using UDP/IP as its transport and network protocols.
109 #define ICMP_TYPE_ECHO_REPLY 0
111 #define ICMP_TYPE_UNREACHABLE 3
112 #define ICMP_CODE_NET_UNREACHABLE 0
113 #define ICMP_CODE_PROTOCOL_UNREACHABLE 2
114 #define ICMP_CODE_FRAGMENTATION_REQUIRED 4
115 #define ICMP_CODE_NET_PROHIBITED 13
117 #define ICMP_TYPE_ECHO_REQUEST 8
119 #define ICMP_TYPE_TIME_EXCEEDED 11
120 #define ICMP_CODE_TTL_EXCEEDED 0
122 /* Generic IP checksum routine */
123 static inline uint16_t ip_csum(uint8_t *iph,int32_t count)
125 register uint32_t sum=0;
128 sum+=ntohs(*(uint16_t *)iph);
133 sum+=*(uint8_t *)iph;
135 sum=(sum&0xffff)+(sum>>16);
141 * This is a version of ip_compute_csum() optimized for IP headers,
142 * which always checksum on 4 octet boundaries.
144 * By Jorge Cwik <jorge@laser.satlink.net>, adapted for linux by
147 static inline uint16_t ip_fast_csum(uint8_t *iph, int32_t ihl) {
150 __asm__ __volatile__(
156 "adcl 12(%1), %0 ;\n"
157 "1: adcl 16(%1), %0 ;\n"
168 /* Since the input registers which are loaded with iph and ipl
169 are modified, we must also specify them as outputs, or gcc
170 will assume they contain their original values. */
171 : "=r" (sum), "=r" (iph), "=r" (ihl)
172 : "1" (iph), "2" (ihl)
177 static inline uint16_t ip_fast_csum(uint8_t *iph, int32_t ihl)
179 assert(ihl < INT_MAX/4);
180 return ip_csum(iph,ihl*4);
185 #if defined (WORDS_BIGENDIAN)
201 /* The options start here. */
224 static void netlink_packet_deliver(struct netlink *st,
225 struct netlink_client *client,
226 struct buffer_if *buf);
228 /* XXX RFC1812 4.3.2.5:
229 All other ICMP error messages (Destination Unreachable,
230 Redirect, Time Exceeded, and Parameter Problem) SHOULD have their
231 precedence value set to 6 (INTERNETWORK CONTROL) or 7 (NETWORK
232 CONTROL). The IP Precedence value for these error messages MAY be
235 static struct icmphdr *netlink_icmp_tmpl(struct netlink *st,
236 uint32_t dest,uint16_t len)
240 BUF_ALLOC(&st->icmp,"netlink_icmp_tmpl");
241 buffer_init(&st->icmp,calculate_max_start_pad());
242 h=buf_append(&st->icmp,sizeof(*h));
247 h->iph.tot_len=htons(len+(h->iph.ihl*4)+8);
250 h->iph.ttl=255; /* XXX should be configurable */
252 h->iph.saddr=htonl(st->secnet_address);
253 h->iph.daddr=htonl(dest);
255 h->iph.check=ip_fast_csum((uint8_t *)&h->iph,h->iph.ihl);
262 /* Fill in the ICMP checksum field correctly */
263 static void netlink_icmp_csum(struct icmphdr *h)
267 len=ntohs(h->iph.tot_len)-(4*h->iph.ihl);
269 h->check=ip_csum(&h->type,len);
273 * An ICMP error message MUST NOT be sent as the result of
276 * * an ICMP error message, or
278 * * a datagram destined to an IP broadcast or IP multicast
281 * * a datagram sent as a link-layer broadcast, or
283 * * a non-initial fragment, or
285 * * a datagram whose source address does not define a single
286 * host -- e.g., a zero address, a loopback address, a
287 * broadcast address, a multicast address, or a Class E
290 static bool_t netlink_icmp_may_reply(struct buffer_if *buf)
293 struct icmphdr *icmph;
296 if (buf->size < (int)sizeof(struct icmphdr)) return False;
297 iph=(struct iphdr *)buf->start;
298 icmph=(struct icmphdr *)buf->start;
299 if (iph->protocol==1) {
300 switch(icmph->type) {
301 case 3: /* Destination unreachable */
302 case 11: /* Time Exceeded */
303 case 12: /* Parameter Problem */
307 /* How do we spot broadcast destination addresses? */
308 if (ntohs(iph->frag_off)&0x1fff) return False; /* Non-initial fragment */
309 source=ntohl(iph->saddr);
310 if (source==0) return False;
311 if ((source&0xff000000)==0x7f000000) return False;
312 /* How do we spot broadcast source addresses? */
313 if ((source&0xf0000000)==0xe0000000) return False; /* Multicast */
314 if ((source&0xf0000000)==0xf0000000) return False; /* Class E */
318 /* How much of the original IP packet do we include in its ICMP
319 response? The header plus up to 64 bits. */
322 4.3.2.3 Original Message Header
324 Historically, every ICMP error message has included the Internet
325 header and at least the first 8 data bytes of the datagram that
326 triggered the error. This is no longer adequate, due to the use of
327 IP-in-IP tunneling and other technologies. Therefore, the ICMP
328 datagram SHOULD contain as much of the original datagram as possible
329 without the length of the ICMP datagram exceeding 576 bytes. The
330 returned IP header (and user data) MUST be identical to that which
331 was received, except that the router is not required to undo any
332 modifications to the IP header that are normally performed in
333 forwarding that were performed before the error was detected (e.g.,
334 decrementing the TTL, or updating options). Note that the
335 requirements of Section [4.3.3.5] supersede this requirement in some
336 cases (i.e., for a Parameter Problem message, if the problem is in a
337 modified field, the router must undo the modification). See Section
340 static uint16_t netlink_icmp_reply_len(struct buffer_if *buf)
342 if (buf->size < (int)sizeof(struct iphdr)) return 0;
343 struct iphdr *iph=(struct iphdr *)buf->start;
347 /* We include the first 8 bytes of the packet data, provided they exist */
349 plen=ntohs(iph->tot_len);
350 return (hlen>plen?plen:hlen);
353 /* client indicates where the packet we're constructing a response to
354 comes from. NULL indicates the host. */
355 static void netlink_icmp_simple(struct netlink *st, struct buffer_if *buf,
356 struct netlink_client *client,
357 uint8_t type, uint8_t code)
362 if (netlink_icmp_may_reply(buf)) {
363 struct iphdr *iph=(struct iphdr *)buf->start;
364 len=netlink_icmp_reply_len(buf);
365 h=netlink_icmp_tmpl(st,ntohl(iph->saddr),len);
366 h->type=type; h->code=code;
367 memcpy(buf_append(&st->icmp,len),buf->start,len);
368 netlink_icmp_csum(h);
369 netlink_packet_deliver(st,NULL,&st->icmp);
370 BUF_ASSERT_FREE(&st->icmp);
375 * RFC1122: 3.1.2.2 MUST silently discard any IP frame that fails the
377 * RFC1812: 4.2.2.5 MUST discard messages containing invalid checksums.
379 * Is the datagram acceptable?
381 * 1. Length at least the size of an ip header
383 * 3. Checksums correctly.
384 * 4. Doesn't have a bogus length
386 static bool_t netlink_check(struct netlink *st, struct buffer_if *buf,
387 char *errmsgbuf, int errmsgbuflen)
389 #define BAD(...) do{ \
390 snprintf(errmsgbuf,errmsgbuflen,__VA_ARGS__); \
394 if (buf->size < (int)sizeof(struct iphdr)) BAD("len %"PRIu32"",buf->size);
395 struct iphdr *iph=(struct iphdr *)buf->start;
398 if (iph->ihl < 5) BAD("ihl %u",iph->ihl);
399 if (iph->version != 4) BAD("version %u",iph->version);
400 if (buf->size < iph->ihl*4) BAD("size %"PRId32"<%u*4",buf->size,iph->ihl);
401 if (ip_fast_csum((uint8_t *)iph, iph->ihl)!=0) BAD("csum");
402 len=ntohs(iph->tot_len);
403 /* There should be no padding */
404 if (buf->size!=len) BAD("len %"PRId32"!=%"PRId32,buf->size,len);
405 if (len<(iph->ihl<<2)) BAD("len %"PRId32"<(%u<<2)",len,iph->ihl);
406 /* XXX check that there's no source route specified */
412 /* Deliver a packet _to_ client; used after we have decided
413 * what to do with it (and just to check that the client has
414 * actually registered a delivery function with us). */
415 static void netlink_client_deliver(struct netlink *st,
416 struct netlink_client *client,
417 uint32_t source, uint32_t dest,
418 struct buffer_if *buf)
420 if (!client->deliver) {
422 s=ipaddr_to_string(source);
423 d=ipaddr_to_string(dest);
424 Message(M_ERR,"%s: dropping %s->%s, client not registered\n",
430 client->deliver(client->dst, buf);
434 /* Deliver a packet. "client" is the _origin_ of the packet, not its
435 destination, and is NULL for packets from the host and packets
436 generated internally in secnet. */
437 static void netlink_packet_deliver(struct netlink *st,
438 struct netlink_client *client,
439 struct buffer_if *buf)
441 if (buf->size < (int)sizeof(struct iphdr)) {
442 Message(M_ERR,"%s: trying to deliver a too-short packet"
443 " from %s!\n",st->name, client?client->name:"(local)");
448 struct iphdr *iph=(struct iphdr *)buf->start;
449 uint32_t dest=ntohl(iph->daddr);
450 uint32_t source=ntohl(iph->saddr);
451 uint32_t best_quality;
452 bool_t allow_route=False;
453 bool_t found_allowed=False;
457 BUF_ASSERT_USED(buf);
459 if (dest==st->secnet_address) {
460 Message(M_ERR,"%s: trying to deliver a packet to myself!\n",st->name);
465 /* Packets from the host (client==NULL) may always be routed. Packets
466 from clients with the allow_route option will also be routed. */
467 if (!client || (client && (client->options & OPT_ALLOWROUTE)))
470 /* If !allow_route, we check the routing table anyway, and if
471 there's a suitable route with OPT_ALLOWROUTE set we use it. If
472 there's a suitable route, but none with OPT_ALLOWROUTE set then
473 we generate ICMP 'communication with destination network
474 administratively prohibited'. */
478 for (i=0; i<st->n_clients; i++) {
479 if (st->routes[i]->up &&
480 ipset_contains_addr(st->routes[i]->networks,dest)) {
481 /* It's an available route to the correct destination. But is
482 it better than the one we already have? */
484 /* If we have already found an allowed route then we don't
485 bother looking at routes we're not allowed to use. If
486 we don't yet have an allowed route we'll consider any. */
487 if (!allow_route && found_allowed) {
488 if (!(st->routes[i]->options&OPT_ALLOWROUTE)) continue;
491 if (st->routes[i]->link_quality>best_quality
492 || best_quality==0) {
493 best_quality=st->routes[i]->link_quality;
495 if (st->routes[i]->options&OPT_ALLOWROUTE)
497 /* If quality isn't perfect we may wish to
498 consider kicking the tunnel with a 0-length
499 packet to prompt it to perform a key setup.
500 Then it'll eventually decide it's up or
502 /* If quality is perfect and we're allowed to use the
503 route we don't need to search any more. */
504 if (best_quality>=MAXIMUM_LINK_QUALITY &&
505 (allow_route || found_allowed)) break;
509 if (best_match==-1) {
510 /* The packet's not going down a tunnel. It might (ought to)
512 if (ipset_contains_addr(st->networks,dest)) {
513 st->deliver_to_host(st->dst,buf);
515 BUF_ASSERT_FREE(buf);
518 s=ipaddr_to_string(source);
519 d=ipaddr_to_string(dest);
520 Message(M_DEBUG,"%s: don't know where to deliver packet "
521 "(s=%s, d=%s)\n", st->name, s, d);
523 netlink_icmp_simple(st,buf,client,ICMP_TYPE_UNREACHABLE,
524 ICMP_CODE_NET_UNREACHABLE);
529 !(st->routes[best_match]->options&OPT_ALLOWROUTE)) {
531 s=ipaddr_to_string(source);
532 d=ipaddr_to_string(dest);
533 /* We have a usable route but aren't allowed to use it.
534 Generate ICMP destination unreachable: communication
535 with destination network administratively prohibited */
536 Message(M_NOTICE,"%s: denied forwarding for packet (s=%s, d=%s)\n",
540 netlink_icmp_simple(st,buf,client,ICMP_TYPE_UNREACHABLE,
541 ICMP_CODE_NET_PROHIBITED);
544 if (best_quality>0) {
545 /* XXX Fragment if required */
546 netlink_client_deliver(st,st->routes[best_match],
548 BUF_ASSERT_FREE(buf);
550 /* Generate ICMP destination unreachable */
551 netlink_icmp_simple(st,buf,client,ICMP_TYPE_UNREACHABLE,
552 ICMP_CODE_NET_UNREACHABLE); /* client==NULL */
557 BUF_ASSERT_FREE(buf);
560 static void netlink_packet_forward(struct netlink *st,
561 struct netlink_client *client,
562 struct buffer_if *buf)
564 if (buf->size < (int)sizeof(struct iphdr)) return;
565 struct iphdr *iph=(struct iphdr *)buf->start;
567 BUF_ASSERT_USED(buf);
569 /* Packet has already been checked */
571 /* Generate ICMP time exceeded */
572 netlink_icmp_simple(st,buf,client,ICMP_TYPE_TIME_EXCEEDED,
573 ICMP_CODE_TTL_EXCEEDED);
579 iph->check=ip_fast_csum((uint8_t *)iph,iph->ihl);
581 netlink_packet_deliver(st,client,buf);
582 BUF_ASSERT_FREE(buf);
585 /* Deal with packets addressed explicitly to us */
586 static void netlink_packet_local(struct netlink *st,
587 struct netlink_client *client,
588 struct buffer_if *buf)
594 if (buf->size < (int)sizeof(struct icmphdr)) {
595 Message(M_WARNING,"%s: short packet addressed to secnet; "
596 "ignoring it\n",st->name);
600 h=(struct icmphdr *)buf->start;
602 if ((ntohs(h->iph.frag_off)&0xbfff)!=0) {
603 Message(M_WARNING,"%s: fragmented packet addressed to secnet; "
604 "ignoring it\n",st->name);
609 if (h->iph.protocol==1) {
611 if (h->type==ICMP_TYPE_ECHO_REQUEST && h->code==0) {
612 /* ICMP echo-request. Special case: we re-use the buffer
613 to construct the reply. */
614 h->type=ICMP_TYPE_ECHO_REPLY;
615 h->iph.daddr=h->iph.saddr;
616 h->iph.saddr=htonl(st->secnet_address);
619 h->iph.check=ip_fast_csum((uint8_t *)h,h->iph.ihl);
620 netlink_icmp_csum(h);
621 netlink_packet_deliver(st,NULL,buf);
624 Message(M_WARNING,"%s: unknown incoming ICMP\n",st->name);
626 /* Send ICMP protocol unreachable */
627 netlink_icmp_simple(st,buf,client,ICMP_TYPE_UNREACHABLE,
628 ICMP_CODE_PROTOCOL_UNREACHABLE);
636 /* If cid==NULL packet is from host, otherwise cid specifies which tunnel
638 static void netlink_incoming(struct netlink *st, struct netlink_client *client,
639 struct buffer_if *buf)
641 uint32_t source,dest;
644 const char *sourcedesc=client?client->name:"host";
646 BUF_ASSERT_USED(buf);
648 if (!netlink_check(st,buf,errmsgbuf,sizeof(errmsgbuf))) {
649 Message(M_WARNING,"%s: bad IP packet from %s: %s\n",
655 assert(buf->size >= (int)sizeof(struct icmphdr));
656 iph=(struct iphdr *)buf->start;
658 source=ntohl(iph->saddr);
659 dest=ntohl(iph->daddr);
661 /* Check source. If we don't like the source, there's no point
662 generating ICMP because we won't know how to get it to the
663 source of the packet. */
665 /* Check that the packet source is appropriate for the tunnel
667 if (!ipset_contains_addr(client->networks,source)) {
669 s=ipaddr_to_string(source);
670 d=ipaddr_to_string(dest);
671 Message(M_WARNING,"%s: packet from tunnel %s with bad "
672 "source address (s=%s,d=%s)\n",st->name,client->name,s,d);
678 /* Check that the packet originates in our configured local
679 network, and hasn't been forwarded from elsewhere or
680 generated with the wrong source address */
681 if (!ipset_contains_addr(st->networks,source)) {
683 s=ipaddr_to_string(source);
684 d=ipaddr_to_string(dest);
685 Message(M_WARNING,"%s: outgoing packet with bad source address "
686 "(s=%s,d=%s)\n",st->name,s,d);
693 /* If this is a point-to-point device we don't examine the
694 destination address at all; we blindly send it down our
695 one-and-only registered tunnel, or to the host, depending on
696 where it came from. It's up to external software to check
697 address validity and generate ICMP, etc. */
700 st->deliver_to_host(st->dst,buf);
702 netlink_client_deliver(st,st->clients,source,dest,buf);
704 BUF_ASSERT_FREE(buf);
708 /* st->secnet_address needs checking before matching destination
710 if (dest==st->secnet_address) {
711 netlink_packet_local(st,client,buf);
712 BUF_ASSERT_FREE(buf);
715 netlink_packet_forward(st,client,buf);
716 BUF_ASSERT_FREE(buf);
719 static void netlink_inst_incoming(void *sst, struct buffer_if *buf)
721 struct netlink_client *c=sst;
722 struct netlink *st=c->nst;
724 netlink_incoming(st,c,buf);
727 static void netlink_dev_incoming(void *sst, struct buffer_if *buf)
729 struct netlink *st=sst;
731 netlink_incoming(st,NULL,buf);
734 static void netlink_set_quality(void *sst, uint32_t quality)
736 struct netlink_client *c=sst;
737 struct netlink *st=c->nst;
739 c->link_quality=quality;
740 c->up=(c->link_quality==LINK_QUALITY_DOWN)?False:True;
741 if (c->options&OPT_SOFTROUTE) {
742 st->set_routes(st->dst,c);
746 static void netlink_output_subnets(struct netlink *st, uint32_t loglevel,
747 struct subnet_list *snets)
752 for (i=0; i<snets->entries; i++) {
753 net=subnet_to_string(snets->list[i]);
754 Message(loglevel,"%s ",net);
759 static void netlink_dump_routes(struct netlink *st, bool_t requested)
765 if (requested) c=M_WARNING;
767 net=ipaddr_to_string(st->secnet_address);
768 Message(c,"%s: point-to-point (remote end is %s); routes:\n",
771 netlink_output_subnets(st,c,st->clients->subnets);
774 Message(c,"%s: routing table:\n",st->name);
775 for (i=0; i<st->n_clients; i++) {
776 netlink_output_subnets(st,c,st->routes[i]->subnets);
777 Message(c,"-> tunnel %s (%s,mtu %d,%s routes,%s,"
778 "quality %d,use %d,pri %lu)\n",
780 st->routes[i]->up?"up":"down",
782 st->routes[i]->options&OPT_SOFTROUTE?"soft":"hard",
783 st->routes[i]->options&OPT_ALLOWROUTE?"free":"restricted",
784 st->routes[i]->link_quality,
785 st->routes[i]->outcount,
786 (unsigned long)st->routes[i]->priority);
788 net=ipaddr_to_string(st->secnet_address);
789 Message(c,"%s/32 -> netlink \"%s\" (use %d)\n",
790 net,st->name,st->localcount);
792 for (i=0; i<st->subnets->entries; i++) {
793 net=subnet_to_string(st->subnets->list[i]);
794 Message(c,"%s ",net);
798 Message(c,"-> host (use %d)\n",st->outcount);
802 /* ap is a pointer to a member of the routes array */
803 static int netlink_compare_client_priority(const void *ap, const void *bp)
805 const struct netlink_client *const*a=ap;
806 const struct netlink_client *const*b=bp;
808 if ((*a)->priority==(*b)->priority) return 0;
809 if ((*a)->priority<(*b)->priority) return 1;
813 static void netlink_phase_hook(void *sst, uint32_t new_phase)
815 struct netlink *st=sst;
816 struct netlink_client *c;
819 /* All the networks serviced by the various tunnels should now
820 * have been registered. We build a routing table by sorting the
821 * clients by priority. */
822 st->routes=safe_malloc_ary(sizeof(*st->routes),st->n_clients,
823 "netlink_phase_hook");
826 for (c=st->clients; c; c=c->next) {
830 /* Sort the table in descending order of priority */
831 qsort(st->routes,st->n_clients,sizeof(*st->routes),
832 netlink_compare_client_priority);
834 netlink_dump_routes(st,False);
837 static void netlink_signal_handler(void *sst, int signum)
839 struct netlink *st=sst;
840 Message(M_INFO,"%s: route dump requested by SIGUSR1\n",st->name);
841 netlink_dump_routes(st,True);
844 static void netlink_inst_set_mtu(void *sst, int32_t new_mtu)
846 struct netlink_client *c=sst;
851 static void netlink_inst_reg(void *sst, netlink_deliver_fn *deliver,
854 struct netlink_client *c=sst;
860 static struct flagstr netlink_option_table[]={
861 { "soft", OPT_SOFTROUTE },
862 { "allow-route", OPT_ALLOWROUTE },
865 /* This is the routine that gets called when the closure that's
866 returned by an invocation of a netlink device closure (eg. tun,
867 userv-ipif) is invoked. It's used to create routes and pass in
868 information about them; the closure it returns is used by site
870 static closure_t *netlink_inst_create(struct netlink *st,
871 struct cloc loc, dict_t *dict)
873 struct netlink_client *c;
875 struct ipset *networks;
876 uint32_t options,priority;
880 name=dict_read_string(dict, "name", True, st->name, loc);
882 l=dict_lookup(dict,"routes");
884 cfgfatal(loc,st->name,"required parameter \"routes\" not found\n");
885 networks=string_list_to_ipset(l,loc,st->name,"routes");
886 options=string_list_to_word(dict_lookup(dict,"options"),
887 netlink_option_table,st->name);
889 priority=dict_read_number(dict,"priority",False,st->name,loc,0);
890 mtu=dict_read_number(dict,"mtu",False,st->name,loc,0);
892 if ((options&OPT_SOFTROUTE) && !st->set_routes) {
893 cfgfatal(loc,st->name,"this netlink device does not support "
898 if (options&OPT_SOFTROUTE) {
899 /* XXX for now we assume that soft routes require root privilege;
900 this may not always be true. The device driver can tell us. */
901 require_root_privileges=True;
902 require_root_privileges_explanation="netlink: soft routes";
904 cfgfatal(loc,st->name,"point-to-point netlinks do not support "
910 /* Check that nets are a subset of st->remote_networks;
911 refuse to register if they are not. */
912 if (!ipset_is_subset(st->remote_networks,networks)) {
913 cfgfatal(loc,st->name,"routes are not allowed\n");
917 c=safe_malloc(sizeof(*c),"netlink_inst_create");
918 c->cl.description=name;
919 c->cl.type=CL_NETLINK;
921 c->cl.interface=&c->ops;
923 c->ops.reg=netlink_inst_reg;
924 c->ops.deliver=netlink_inst_incoming;
925 c->ops.set_quality=netlink_set_quality;
926 c->ops.set_mtu=netlink_inst_set_mtu;
929 c->networks=networks;
930 c->subnets=ipset_to_subnet_list(networks);
931 c->priority=priority;
935 c->link_quality=LINK_QUALITY_UNUSED;
936 c->mtu=mtu?mtu:st->mtu;
943 assert(st->n_clients < INT_MAX);
949 static list_t *netlink_inst_apply(closure_t *self, struct cloc loc,
950 dict_t *context, list_t *args)
952 struct netlink *st=self->interface;
958 item=list_elem(args,0);
959 if (!item || item->type!=t_dict) {
960 cfgfatal(loc,st->name,"must have a dictionary argument\n");
962 dict=item->data.dict;
964 cl=netlink_inst_create(st,loc,dict);
966 return new_closure(cl);
969 netlink_deliver_fn *netlink_init(struct netlink *st,
970 void *dst, struct cloc loc,
971 dict_t *dict, cstring_t description,
972 netlink_route_fn *set_routes,
973 netlink_deliver_fn *to_host)
979 st->cl.description=description;
981 st->cl.apply=netlink_inst_apply;
986 st->set_routes=set_routes;
987 st->deliver_to_host=to_host;
989 st->name=dict_read_string(dict,"name",False,description,loc);
990 if (!st->name) st->name=description;
991 l=dict_lookup(dict,"networks");
993 st->networks=string_list_to_ipset(l,loc,st->name,"networks");
997 st->networks=ipset_complement(empty);
1000 l=dict_lookup(dict,"remote-networks");
1002 st->remote_networks=string_list_to_ipset(l,loc,st->name,
1005 struct ipset *empty;
1007 st->remote_networks=ipset_complement(empty);
1011 sa=dict_find_item(dict,"secnet-address",False,"netlink",loc);
1012 ptpa=dict_find_item(dict,"ptp-address",False,"netlink",loc);
1014 cfgfatal(loc,st->name,"you may not specify secnet-address and "
1015 "ptp-address in the same netlink device\n");
1017 if (!(sa || ptpa)) {
1018 cfgfatal(loc,st->name,"you must specify secnet-address or "
1019 "ptp-address for this netlink device\n");
1022 st->secnet_address=string_item_to_ipaddr(sa,"netlink");
1025 st->secnet_address=string_item_to_ipaddr(ptpa,"netlink");
1028 /* To be strictly correct we could subtract secnet_address from
1029 networks here. It shouldn't make any practical difference,
1030 though, and will make the route dump look complicated... */
1031 st->subnets=ipset_to_subnet_list(st->networks);
1032 st->mtu=dict_read_number(dict, "mtu", False, "netlink", loc, DEFAULT_MTU);
1033 buffer_new(&st->icmp,ICMP_BUFSIZE);
1037 add_hook(PHASE_SETUP,netlink_phase_hook,st);
1038 request_signal_notification(SIGUSR1, netlink_signal_handler, st);
1040 /* If we're point-to-point then we return a CL_NETLINK directly,
1041 rather than a CL_NETLINK_OLD or pure closure (depending on
1042 compatibility). This CL_NETLINK is for our one and only
1043 client. Our cl.apply function is NULL. */
1046 cl=netlink_inst_create(st,loc,dict);
1049 return netlink_dev_incoming;
1052 /* No connection to the kernel at all... */
1058 static bool_t null_set_route(void *sst, struct netlink_client *routes)
1060 struct null *st=sst;
1062 if (routes->up!=routes->kup) {
1063 Message(M_INFO,"%s: setting routes for tunnel %s to state %s\n",
1064 st->nl.name,routes->name,
1065 routes->up?"up":"down");
1066 routes->kup=routes->up;
1072 static void null_deliver(void *sst, struct buffer_if *buf)
1077 static list_t *null_apply(closure_t *self, struct cloc loc, dict_t *context,
1084 st=safe_malloc(sizeof(*st),"null_apply");
1086 item=list_elem(args,0);
1087 if (!item || item->type!=t_dict)
1088 cfgfatal(loc,"null-netlink","parameter must be a dictionary\n");
1090 dict=item->data.dict;
1092 netlink_init(&st->nl,st,loc,dict,"null-netlink",null_set_route,
1095 return new_closure(&st->nl.cl);
1098 void netlink_module(dict_t *dict)
1100 add_closure(dict,"null-netlink",null_apply);