#include "netlink.h"
#include "process.h"
+#define OPT_SOFTROUTE 1
+#define OPT_ALLOWROUTE 2
+
/* Generic IP checksum routine */
static inline uint16_t ip_csum(uint8_t *iph,uint32_t count)
{
static bool_t netlink_icmp_may_reply(struct buffer_if *buf)
{
struct iphdr *iph;
+ struct icmphdr *icmph;
uint32_t source;
iph=(struct iphdr *)buf->start;
- if (iph->protocol==1) return False; /* Overly-broad; we may reply to
- eg. icmp echo-request */
+ icmph=(struct icmphdr *)buf->start;
+ if (iph->protocol==1) {
+ switch(icmph->type) {
+ case 3: /* Destination unreachable */
+ case 11: /* Time Exceeded */
+ case 12: /* Parameter Problem */
+ return False;
+ }
+ }
/* How do we spot broadcast destination addresses? */
if (ntohs(iph->frag_off)&0x1fff) return False; /* Non-initial fragment */
source=ntohl(iph->saddr);
return True;
}
-/* Deliver a packet. "client" points to the _origin_ of the packet, not
- its destination. (May be used when sending ICMP response - avoid
- asymmetric routing.) */
+/* Deliver a packet. "client" is the _origin_ of the packet, not its
+destination. */
static void netlink_packet_deliver(struct netlink *st,
struct netlink_client *client,
struct buffer_if *buf)
uint32_t dest=ntohl(iph->daddr);
uint32_t source=ntohl(iph->saddr);
uint32_t best_quality;
+ bool_t allow_route=False;
+ bool_t found_allowed=False;
int best_match;
int i;
BUF_ASSERT_USED(buf);
if (dest==st->secnet_address) {
- Message(M_ERROR,"%s: trying to deliver a packet to myself!\n");
+ Message(M_ERR,"%s: trying to deliver a packet to myself!\n");
BUF_FREE(buf);
return;
}
- /* XXX we're going to need an extra value 'allow_route' for the
- source of the packet. It's always True for packets from the
- host. For packets from tunnels, we consult the client
- options. If !allow_route and the destination is a tunnel that
- also doesn't allow routing, we must reject the packet with an
- 'administratively prohibited' or something similar ICMP. */
- if (!client) {
- /* Origin of packet is host or secnet. Might be for a tunnel. */
- best_quality=0;
- best_match=-1;
- for (i=0; i<st->n_routes; i++) {
- if (st->routes[i].up && subnet_match(&st->routes[i].net,dest)) {
- if (st->routes[i].c->link_quality>best_quality
- || best_quality==0) {
- best_quality=st->routes[i].c->link_quality;
- best_match=i;
- /* If quality isn't perfect we may wish to
- consider kicking the tunnel with a 0-length
- packet to prompt it to perform a key setup.
- Then it'll eventually decide it's up or
- down. */
- /* If quality is perfect we don't need to search
- any more. */
- if (best_quality>=MAXIMUM_LINK_QUALITY) break;
- }
- }
- }
- if (best_match==-1) {
- /* Not going down a tunnel. Might be for the host.
- XXX think about this - only situation should be if we're
- sending ICMP. */
- if (source!=st->secnet_address) {
- Message(M_ERROR,"netlink_packet_deliver: outgoing packet "
- "from host that won't fit down any of our tunnels!\n");
- /* XXX I think this could also occur if a soft tunnel just
- went down, but still had packets queued in the kernel. */
- BUF_FREE(buf);
- } else {
- st->deliver_to_host(st->dst,NULL,buf);
- BUF_ASSERT_FREE(buf);
+ /* Packets from the host (client==NULL) will always be routed. Packets
+ from clients with the allow_route option will also be routed. */
+ if (!client || (client && (client->options & OPT_ALLOWROUTE)))
+ allow_route=True;
+
+ /* If !allow_route, we check the routing table anyway, and if
+ there's a suitable route with OPT_ALLOWROUTE set we use it. If
+ there's a suitable route, but none with OPT_ALLOWROUTE set then
+ we generate ICMP 'communication with destination network
+ administratively prohibited'. */
+
+ best_quality=0;
+ best_match=-1;
+ for (i=0; i<st->n_routes; i++) {
+ if (st->routes[i].up && subnet_match(&st->routes[i].net,dest)) {
+ /* It's an available route to the correct destination. But is
+ it better than the one we already have? */
+
+ /* If we have already found an allowed route then we don't
+ bother looking at routes we're not allowed to use. If
+ we don't yet have an allowed route we'll consider any. */
+ if (!allow_route && found_allowed) {
+ if (!(st->routes[i].c->options&OPT_ALLOWROUTE)) continue;
}
- } else {
- if (best_quality>0) {
- st->routes[best_match].c->deliver(
- st->routes[best_match].c->dst,
- st->routes[best_match].c, buf);
- BUF_ASSERT_FREE(buf);
- } else {
- /* Generate ICMP destination unreachable */
- netlink_icmp_simple(st,buf,client,3,0); /* client==NULL */
- BUF_FREE(buf);
+
+ if (st->routes[i].c->link_quality>best_quality
+ || best_quality==0) {
+ best_quality=st->routes[i].c->link_quality;
+ best_match=i;
+ if (st->routes[i].c->options&OPT_ALLOWROUTE)
+ found_allowed=True;
+ /* If quality isn't perfect we may wish to
+ consider kicking the tunnel with a 0-length
+ packet to prompt it to perform a key setup.
+ Then it'll eventually decide it's up or
+ down. */
+ /* If quality is perfect and we're allowed to use the
+ route we don't need to search any more. */
+ if (best_quality>=MAXIMUM_LINK_QUALITY &&
+ (allow_route || found_allowed)) break;
}
}
- } else { /* client is set */
- /* We know the origin is a tunnel - packet must be for the host */
- /* XXX THIS IS NOT NECESSARILY TRUE, AND NEEDS FIXING */
- /* THIS FUNCTION MUST JUST DELIVER THE PACKET: IT MUST ASSUME
- THE PACKET HAS ALREADY BEEN CHECKED */
+ }
+ if (best_match==-1) {
+ /* The packet's not going down a tunnel. It might (ought to)
+ be for the host. */
if (subnet_matches_list(&st->networks,dest)) {
- st->deliver_to_host(st->dst,NULL,buf);
+ st->deliver_to_host(st->dst,buf);
+ st->outcount++;
BUF_ASSERT_FREE(buf);
} else {
- Message(M_ERROR,"%s: packet from tunnel %s can't be delivered "
- "to the host\n",st->name,client->name);
+ string_t s,d;
+ s=ipaddr_to_string(source);
+ d=ipaddr_to_string(dest);
+ Message(M_ERR,"%s: don't know where to deliver packet "
+ "(s=%s, d=%s)\n", st->name, s, d);
+ free(s); free(d);
netlink_icmp_simple(st,buf,client,3,0);
BUF_FREE(buf);
}
+ } else {
+ if (!allow_route &&
+ !(st->routes[best_match].c->options&OPT_ALLOWROUTE)) {
+ string_t s,d;
+ s=ipaddr_to_string(source);
+ d=ipaddr_to_string(dest);
+ /* We have a usable route but aren't allowed to use it.
+ Generate ICMP destination unreachable: communication
+ with destination network administratively prohibited */
+ Message(M_NOTICE,"%s: denied forwarding for packet (s=%s, d=%s)\n",
+ st->name,s,d);
+ free(s); free(d);
+
+ netlink_icmp_simple(st,buf,client,3,9);
+ BUF_FREE(buf);
+ }
+ if (best_quality>0) {
+ st->routes[best_match].c->deliver(
+ st->routes[best_match].c->dst, buf);
+ st->routes[best_match].outcount++;
+ BUF_ASSERT_FREE(buf);
+ } else {
+ /* Generate ICMP destination unreachable */
+ netlink_icmp_simple(st,buf,client,3,0); /* client==NULL */
+ BUF_FREE(buf);
+ }
}
BUF_ASSERT_FREE(buf);
}
{
struct icmphdr *h;
+ st->localcount++;
+
h=(struct icmphdr *)buf->start;
if ((ntohs(h->iph.frag_off)&0xbfff)!=0) {
/* If cid==NULL packet is from host, otherwise cid specifies which tunnel
it came from. */
-static void netlink_incoming(void *sst, void *cid, struct buffer_if *buf)
+static void netlink_incoming(struct netlink *st, struct netlink_client *client,
+ struct buffer_if *buf)
{
- struct netlink *st=sst;
- struct netlink_client *client=cid;
uint32_t source,dest;
struct iphdr *iph;
if (client) {
/* Check that the packet source is appropriate for the tunnel
it came down */
- if (!subnet_matches_list(client->networks,source)) {
+ if (!subnet_matches_list(&client->networks,source)) {
string_t s,d;
s=ipaddr_to_string(source);
d=ipaddr_to_string(dest);
or to the host, depending on where it came from. */
if (st->ptp) {
if (client) {
- st->deliver_to_host(st->dst,NULL,buf);
+ st->deliver_to_host(st->dst,buf);
} else {
- st->clients->deliver(st->clients->dst,NULL,buf);
+ st->clients->deliver(st->clients->dst,buf);
}
BUF_ASSERT_FREE(buf);
return;
BUF_ASSERT_FREE(buf);
}
+static void netlink_inst_incoming(void *sst, struct buffer_if *buf)
+{
+ struct netlink_client *c=sst;
+ struct netlink *st=c->nst;
+
+ netlink_incoming(st,c,buf);
+}
+
+static void netlink_dev_incoming(void *sst, struct buffer_if *buf)
+{
+ struct netlink *st=sst;
+
+ netlink_incoming(st,NULL,buf);
+}
+
static void netlink_set_softlinks(struct netlink *st, struct netlink_client *c,
bool_t up, uint32_t quality)
{
}
}
-static void netlink_set_quality(void *sst, void *cid, uint32_t quality)
+static void netlink_set_quality(void *sst, uint32_t quality)
{
- struct netlink *st=sst;
- struct netlink_client *c=cid;
+ struct netlink_client *c=sst;
+ struct netlink *st=c->nst;
c->link_quality=quality;
if (c->link_quality==LINK_QUALITY_DOWN) {
}
}
-static void *netlink_regnets(void *sst, struct subnet_list *nets,
- netlink_deliver_fn *deliver, void *dst,
- uint32_t max_start_pad, uint32_t max_end_pad,
- uint32_t options, string_t client_name)
-{
- struct netlink *st=sst;
- struct netlink_client *c;
-
- Message(M_DEBUG_CONFIG,"netlink_regnets: request for %d networks, "
- "max_start_pad=%d, max_end_pad=%d\n",
- nets->entries,max_start_pad,max_end_pad);
-
- if ((options&NETLINK_OPTION_SOFTROUTE) && !st->set_route) {
- Message(M_ERROR,"%s: this netlink device does not support "
- "soft routes.\n");
- return NULL;
- }
-
- if (options&NETLINK_OPTION_SOFTROUTE) {
- /* XXX for now we assume that soft routes require root privilege;
- this may not always be true. The device driver can tell us. */
- require_root_privileges=True;
- require_root_privileges_explanation="netlink: soft routes";
- }
-
- /* Check that nets do not intersect st->exclude_remote_networks;
- refuse to register if they do. */
- if (subnet_lists_intersect(&st->exclude_remote_networks,nets)) {
- Message(M_ERROR,"%s: site %s specifies networks that "
- "intersect with the explicitly excluded remote networks\n",
- st->name,client_name);
- return NULL;
- }
-
- if (st->clients && st->ptp) {
- fatal("%s: only one site may use a point-to-point netlink device\n",
- st->name);
- return NULL;
- }
-
- c=safe_malloc(sizeof(*c),"netlink_regnets");
- c->networks=nets;
- c->deliver=deliver;
- c->dst=dst;
- c->name=client_name;
- c->options=options;
- c->link_quality=LINK_QUALITY_DOWN;
- c->next=st->clients;
- st->clients=c;
- if (max_start_pad > st->max_start_pad) st->max_start_pad=max_start_pad;
- if (max_end_pad > st->max_end_pad) st->max_end_pad=max_end_pad;
- st->n_routes+=nets->entries;
-
- return c;
-}
-
static void netlink_dump_routes(struct netlink *st, bool_t requested)
{
int i;
uint32_t c=M_INFO;
if (requested) c=M_WARNING;
- Message(c,"%s: routing table:\n",st->name);
- for (i=0; i<st->n_routes; i++) {
- net=subnet_to_string(&st->routes[i].net);
- Message(c,"%s -> tunnel %s (%s,%s route,%s,quality %d)\n",net,
- st->routes[i].c->name,
- st->routes[i].hard?"hard":"soft",
- st->routes[i].allow_route?"free":"restricted",
- st->routes[i].up?"up":"down",
- st->routes[i].quality);
+ if (st->ptp) {
+ net=ipaddr_to_string(st->secnet_address);
+ Message(c,"%s: point-to-point (remote end is %s); routes:\n",
+ st->name, net);
free(net);
- }
- Message(c,"%s/32 -> netlink \"%s\"\n",
- ipaddr_to_string(st->secnet_address),st->name);
- for (i=0; i<st->networks.entries; i++) {
- net=subnet_to_string(&st->networks.list[i]);
- Message(c,"%s -> host\n",net);
+ for (i=0; i<st->n_routes; i++) {
+ net=subnet_to_string(&st->routes[i].net);
+ Message(c,"%s ",net);
+ free(net);
+ }
+ Message(c,"\n");
+ } else {
+ Message(c,"%s: routing table:\n",st->name);
+ for (i=0; i<st->n_routes; i++) {
+ net=subnet_to_string(&st->routes[i].net);
+ Message(c,"%s -> tunnel %s (%s,%s route,%s,quality %d,use %d)\n",net,
+ st->routes[i].c->name,
+ st->routes[i].hard?"hard":"soft",
+ st->routes[i].allow_route?"free":"restricted",
+ st->routes[i].up?"up":"down",
+ st->routes[i].quality,
+ st->routes[i].outcount);
+ free(net);
+ }
+ net=ipaddr_to_string(st->secnet_address);
+ Message(c,"%s/32 -> netlink \"%s\" (use %d)\n",
+ net,st->name,st->localcount);
free(net);
+ for (i=0; i<st->networks.entries; i++) {
+ net=subnet_to_string(&st->networks.list[i]);
+ Message(c,"%s -> host (use %d)\n",net,st->outcount);
+ free(net);
+ }
}
}
struct netlink_client *c;
uint32_t i,j;
- if (!st->clients && st->ptp) {
- /* Point-to-point netlink devices must have precisely one
- client. If none has registered by now, complain. */
- fatal("%s: point-to-point netlink devices must have precisely "
- "one client. This one doesn't have any.\n",st->name);
- }
-
/* All the networks serviced by the various tunnels should now
* have been registered. We build a routing table by sorting the
* routes into most-specific-first order. */
/* Fill the table */
i=0;
for (c=st->clients; c; c=c->next) {
- for (j=0; j<c->networks->entries; j++) {
- st->routes[i].net=c->networks->list[j];
+ for (j=0; j<c->networks.entries; j++) {
+ st->routes[i].net=c->networks.list[j];
st->routes[i].c=c;
/* Hard routes are always up;
- soft routes default to down */
- st->routes[i].up=c->options&NETLINK_OPTION_SOFTROUTE?False:True;
+ soft routes default to down; routes with no 'deliver' function
+ default to down */
+ st->routes[i].up=c->deliver?
+ (c->options&OPT_SOFTROUTE?False:True):
+ False;
st->routes[i].kup=False;
- st->routes[i].hard=c->options&NETLINK_OPTION_SOFTROUTE?False:True;
- st->routes[i].allow_route=c->options&NETLINK_OPTION_ALLOW_ROUTE?
+ st->routes[i].hard=c->options&OPT_SOFTROUTE?False:True;
+ st->routes[i].allow_route=c->options&OPT_ALLOWROUTE?
True:False;
st->routes[i].quality=c->link_quality;
+ st->routes[i].outcount=0;
i++;
}
}
netlink_dump_routes(st,True);
}
+static void netlink_inst_reg(void *sst, netlink_deliver_fn *deliver,
+ void *dst, uint32_t max_start_pad,
+ uint32_t max_end_pad)
+{
+ struct netlink_client *c=sst;
+ struct netlink *st=c->nst;
+
+ if (max_start_pad > st->max_start_pad) st->max_start_pad=max_start_pad;
+ if (max_end_pad > st->max_end_pad) st->max_end_pad=max_end_pad;
+ c->deliver=deliver;
+ c->dst=dst;
+}
+
+static struct flagstr netlink_option_table[]={
+ { "soft", OPT_SOFTROUTE },
+ { "allow-route", OPT_ALLOWROUTE },
+ { NULL, 0}
+};
+/* This is the routine that gets called when the closure that's
+ returned by an invocation of a netlink device closure (eg. tun,
+ userv-ipif) is invoked. It's used to create routes and pass in
+ information about them; the closure it returns is used by site
+ code. */
+static closure_t *netlink_inst_create(struct netlink *st,
+ struct cloc loc, dict_t *dict)
+{
+ struct netlink_client *c;
+ string_t name;
+ struct subnet_list networks;
+ uint32_t options;
+
+ name=dict_read_string(dict, "name", True, st->name, loc);
+
+ dict_read_subnet_list(dict, "routes", True, st->name, loc,
+ &networks);
+ options=string_list_to_word(dict_lookup(dict,"options"),
+ netlink_option_table,st->name);
+
+ if ((options&OPT_SOFTROUTE) && !st->set_route) {
+ cfgfatal(loc,st->name,"this netlink device does not support "
+ "soft routes.\n");
+ return NULL;
+ }
+
+ if (options&OPT_SOFTROUTE) {
+ /* XXX for now we assume that soft routes require root privilege;
+ this may not always be true. The device driver can tell us. */
+ require_root_privileges=True;
+ require_root_privileges_explanation="netlink: soft routes";
+ if (st->ptp) {
+ cfgfatal(loc,st->name,"point-to-point netlinks do not support "
+ "soft routes.\n");
+ return NULL;
+ }
+ }
+
+ /* Check that nets do not intersect st->exclude_remote_networks;
+ refuse to register if they do. */
+ if (subnet_lists_intersect(&st->exclude_remote_networks,&networks)) {
+ cfgfatal(loc,st->name,"networks intersect with the explicitly "
+ "excluded remote networks\n");
+ return NULL;
+ }
+
+ c=safe_malloc(sizeof(*c),"netlink_inst_create");
+ c->cl.description=name;
+ c->cl.type=CL_NETLINK;
+ c->cl.apply=NULL;
+ c->cl.interface=&c->ops;
+ c->ops.st=c;
+ c->ops.reg=netlink_inst_reg;
+ c->ops.deliver=netlink_inst_incoming;
+ c->ops.set_quality=netlink_set_quality;
+ c->nst=st;
+
+ c->networks=networks;
+ c->deliver=NULL;
+ c->dst=NULL;
+ c->name=name;
+ c->options=options;
+ c->link_quality=LINK_QUALITY_DOWN;
+ c->next=st->clients;
+ st->clients=c;
+ st->n_routes+=networks.entries;
+
+ return &c->cl;
+}
+
+static list_t *netlink_inst_apply(closure_t *self, struct cloc loc,
+ dict_t *context, list_t *args)
+{
+ struct netlink *st=self->interface;
+
+ dict_t *dict;
+ item_t *item;
+ closure_t *cl;
+
+ Message(M_DEBUG_CONFIG,"netlink_inst_apply\n");
+
+ item=list_elem(args,0);
+ if (!item || item->type!=t_dict) {
+ cfgfatal(loc,st->name,"must have a dictionary argument\n");
+ }
+ dict=item->data.dict;
+
+ cl=netlink_inst_create(st,loc,dict);
+
+ return new_closure(cl);
+}
+
netlink_deliver_fn *netlink_init(struct netlink *st,
void *dst, struct cloc loc,
dict_t *dict, string_t description,
st->dst=dst;
st->cl.description=description;
- st->cl.type=CL_NETLINK;
- st->cl.apply=NULL;
- st->cl.interface=&st->ops;
- st->ops.st=st;
- st->ops.regnets=netlink_regnets;
- st->ops.deliver=netlink_incoming;
- st->ops.set_quality=netlink_set_quality;
+ st->cl.type=CL_PURE;
+ st->cl.apply=netlink_inst_apply;
+ st->cl.interface=st;
st->max_start_pad=0;
st->max_end_pad=0;
st->clients=NULL;
&st->networks);
dict_read_subnet_list(dict, "exclude-remote-networks", False, "netlink",
loc, &st->exclude_remote_networks);
- /* secnet-address does not have to be in local-networks;
- however, it should be advertised in the 'sites' file for the
- local site. */
sa=dict_find_item(dict,"secnet-address",False,"netlink",loc);
- ptpa=dict_find_item(dict,"ptp-address", False, "netlink", loc);
+ ptpa=dict_find_item(dict,"ptp-address",False,"netlink",loc);
if (sa && ptpa) {
cfgfatal(loc,st->name,"you may not specify secnet-address and "
"ptp-address in the same netlink device\n");
buffer_new(&st->icmp,ICMP_BUFSIZE);
st->n_routes=0;
st->routes=NULL;
+ st->outcount=0;
+ st->localcount=0;
add_hook(PHASE_SETUP,netlink_phase_hook,st);
request_signal_notification(SIGUSR1, netlink_signal_handler, st);
- return netlink_incoming;
+ /* If we're point-to-point then we return a CL_NETLINK directly,
+ rather than a CL_NETLINK_OLD or pure closure (depending on
+ compatibility). This CL_NETLINK is for our one and only
+ client. Our cl.apply function is NULL. */
+ if (st->ptp) {
+ closure_t *cl;
+ cl=netlink_inst_create(st,loc,dict);
+ st->cl=*cl;
+ }
+ return netlink_dev_incoming;
}
/* No connection to the kernel at all... */
return False;
}
-static void null_deliver(void *sst, void *cid, struct buffer_if *buf)
+static void null_deliver(void *sst, struct buffer_if *buf)
{
return;
}
~ian / secnet.git / blobdiff