}
/* Deliver a packet. "client" is the _origin_ of the packet, not its
-destination. */
+ destination, and is NULL for packets from the host and packets
+ generated internally in secnet. */
static void netlink_packet_deliver(struct netlink *st,
struct netlink_client *client,
struct buffer_if *buf)
return;
}
- /* Packets from the host (client==NULL) will always be routed. Packets
+ /* Packets from the host (client==NULL) may always be routed. Packets
from clients with the allow_route option will also be routed. */
if (!client || (client && (client->options & OPT_ALLOWROUTE)))
allow_route=True;
best_quality=0;
best_match=-1;
- for (i=0; i<st->n_routes; i++) {
- if (st->routes[i].up && subnet_match(&st->routes[i].net,dest)) {
+ for (i=0; i<st->n_clients; i++) {
+ if (st->routes[i]->up &&
+ ipset_contains_addr(st->routes[i]->networks,dest)) {
/* It's an available route to the correct destination. But is
it better than the one we already have? */
bother looking at routes we're not allowed to use. If
we don't yet have an allowed route we'll consider any. */
if (!allow_route && found_allowed) {
- if (!(st->routes[i].c->options&OPT_ALLOWROUTE)) continue;
+ if (!(st->routes[i]->options&OPT_ALLOWROUTE)) continue;
}
- if (st->routes[i].c->link_quality>best_quality
+ if (st->routes[i]->link_quality>best_quality
|| best_quality==0) {
- best_quality=st->routes[i].c->link_quality;
+ best_quality=st->routes[i]->link_quality;
best_match=i;
- if (st->routes[i].c->options&OPT_ALLOWROUTE)
+ if (st->routes[i]->options&OPT_ALLOWROUTE)
found_allowed=True;
/* If quality isn't perfect we may wish to
consider kicking the tunnel with a 0-length
if (best_match==-1) {
/* The packet's not going down a tunnel. It might (ought to)
be for the host. */
- if (subnet_matches_list(&st->networks,dest)) {
+ if (ipset_contains_addr(st->networks,dest)) {
st->deliver_to_host(st->dst,buf);
st->outcount++;
BUF_ASSERT_FREE(buf);
}
} else {
if (!allow_route &&
- !(st->routes[best_match].c->options&OPT_ALLOWROUTE)) {
+ !(st->routes[best_match]->options&OPT_ALLOWROUTE)) {
string_t s,d;
s=ipaddr_to_string(source);
d=ipaddr_to_string(dest);
BUF_FREE(buf);
}
if (best_quality>0) {
- st->routes[best_match].c->deliver(
- st->routes[best_match].c->dst, buf);
- st->routes[best_match].outcount++;
+ /* XXX Fragment if required */
+ st->routes[best_match]->deliver(
+ st->routes[best_match]->dst, buf);
+ st->routes[best_match]->outcount++;
BUF_ASSERT_FREE(buf);
} else {
/* Generate ICMP destination unreachable */
source=ntohl(iph->saddr);
dest=ntohl(iph->daddr);
- /* Check source */
+ /* Check source. If we don't like the source, there's no point
+ generating ICMP because we won't know how to get it to the
+ source of the packet. */
if (client) {
/* Check that the packet source is appropriate for the tunnel
it came down */
- if (!subnet_matches_list(&client->networks,source)) {
+ if (!ipset_contains_addr(client->networks,source)) {
string_t s,d;
s=ipaddr_to_string(source);
d=ipaddr_to_string(dest);
/* Check that the packet originates in our configured local
network, and hasn't been forwarded from elsewhere or
generated with the wrong source address */
- if (!subnet_matches_list(&st->networks,source)) {
+ if (!ipset_contains_addr(st->networks,source)) {
string_t s,d;
s=ipaddr_to_string(source);
d=ipaddr_to_string(dest);
}
}
- /* If this is a point-to-point device we don't examine the packet at
- all; we blindly send it down our one-and-only registered tunnel,
- or to the host, depending on where it came from. */
+ /* If this is a point-to-point device we don't examine the
+ destination address at all; we blindly send it down our
+ one-and-only registered tunnel, or to the host, depending on
+ where it came from. It's up to external software to check
+ address validity and generate ICMP, etc. */
if (st->ptp) {
if (client) {
st->deliver_to_host(st->dst,buf);
return;
}
- /* (st->secnet_address needs checking before matching destination
- addresses) */
+ /* st->secnet_address needs checking before matching destination
+ addresses */
if (dest==st->secnet_address) {
netlink_packet_local(st,client,buf);
BUF_ASSERT_FREE(buf);
return;
}
- if (client) {
- /* Check for free routing */
- if (!subnet_matches_list(&st->networks,dest)) {
- string_t s,d;
- s=ipaddr_to_string(source);
- d=ipaddr_to_string(dest);
- Message(M_WARNING,"%s: incoming packet from tunnel %s "
- "with bad destination address "
- "(s=%s,d=%s)\n",st->name,client->name,s,d);
- free(s); free(d);
- BUF_FREE(buf);
- return;
- }
- }
netlink_packet_forward(st,client,buf);
BUF_ASSERT_FREE(buf);
}
netlink_incoming(st,NULL,buf);
}
-static void netlink_set_softlinks(struct netlink *st, struct netlink_client *c,
- bool_t up, uint32_t quality)
+static void netlink_set_quality(void *sst, uint32_t quality)
{
- uint32_t i;
+ struct netlink_client *c=sst;
+ struct netlink *st=c->nst;
- if (!st->routes) return; /* Table has not yet been created */
- for (i=0; i<st->n_routes; i++) {
- if (st->routes[i].c==c) {
- st->routes[i].quality=quality;
- if (!st->routes[i].hard) {
- st->routes[i].up=up;
- st->set_route(st->dst,&st->routes[i]);
- }
- }
+ c->link_quality=quality;
+ c->up=(c->link_quality==LINK_QUALITY_DOWN)?False:True;
+ if (c->options&OPT_SOFTROUTE) {
+ st->set_routes(st->dst,c);
}
}
-static void netlink_set_quality(void *sst, uint32_t quality)
+static void netlink_output_subnets(struct netlink *st, uint32_t loglevel,
+ struct subnet_list *snets)
{
- struct netlink_client *c=sst;
- struct netlink *st=c->nst;
+ uint32_t i;
+ string_t net;
- c->link_quality=quality;
- if (c->link_quality==LINK_QUALITY_DOWN) {
- netlink_set_softlinks(st,c,False,c->link_quality);
- } else {
- netlink_set_softlinks(st,c,True,c->link_quality);
+ for (i=0; i<snets->entries; i++) {
+ net=subnet_to_string(snets->list[i]);
+ Message(loglevel,"%s ",net);
+ free(net);
}
}
Message(c,"%s: point-to-point (remote end is %s); routes:\n",
st->name, net);
free(net);
- for (i=0; i<st->n_routes; i++) {
- net=subnet_to_string(&st->routes[i].net);
- Message(c,"%s ",net);
- free(net);
- }
+ netlink_output_subnets(st,c,st->clients->subnets);
Message(c,"\n");
} else {
Message(c,"%s: routing table:\n",st->name);
- for (i=0; i<st->n_routes; i++) {
- net=subnet_to_string(&st->routes[i].net);
- Message(c,"%s -> tunnel %s (%s,%s route,%s,quality %d,use %d)\n",net,
- st->routes[i].c->name,
- st->routes[i].hard?"hard":"soft",
- st->routes[i].allow_route?"free":"restricted",
- st->routes[i].up?"up":"down",
- st->routes[i].quality,
- st->routes[i].outcount);
- free(net);
+ for (i=0; i<st->n_clients; i++) {
+ netlink_output_subnets(st,c,st->routes[i]->subnets);
+ Message(c,"-> tunnel %s (%s,%s routes,%s,quality %d,use %d)\n",
+ st->routes[i]->name,
+ st->routes[i]->options&OPT_SOFTROUTE?"soft":"hard",
+ st->routes[i]->options&OPT_ALLOWROUTE?"free":"restricted",
+ st->routes[i]->up?"up":"down",
+ st->routes[i]->link_quality,
+ st->routes[i]->outcount);
}
net=ipaddr_to_string(st->secnet_address);
Message(c,"%s/32 -> netlink \"%s\" (use %d)\n",
net,st->name,st->localcount);
free(net);
- for (i=0; i<st->networks.entries; i++) {
- net=subnet_to_string(&st->networks.list[i]);
- Message(c,"%s -> host (use %d)\n",net,st->outcount);
+ for (i=0; i<st->subnets->entries; i++) {
+ net=subnet_to_string(st->subnets->list[i]);
+ Message(c,"%s ",net);
free(net);
}
+ if (i>0)
+ Message(c,"-> host (use %d)\n",st->outcount);
}
}
-static int netlink_compare_route_specificity(const void *ap, const void *bp)
+/* ap is a pointer to a member of the routes array */
+static int netlink_compare_client_priority(const void *ap, const void *bp)
{
- const struct netlink_route *a=ap;
- const struct netlink_route *b=bp;
+ const struct netlink_client *const*a=ap;
+ const struct netlink_client *const*b=bp;
- if (a->net.len==b->net.len) return 0;
- if (a->net.len<b->net.len) return 1;
+ if ((*a)->priority==(*b)->priority) return 0;
+ if ((*a)->priority<(*b)->priority) return 1;
return -1;
}
{
struct netlink *st=sst;
struct netlink_client *c;
- uint32_t i,j;
+ uint32_t i;
/* All the networks serviced by the various tunnels should now
* have been registered. We build a routing table by sorting the
- * routes into most-specific-first order. */
- st->routes=safe_malloc(st->n_routes*sizeof(*st->routes),
+ * clients by priority. */
+ st->routes=safe_malloc(st->n_clients*sizeof(*st->routes),
"netlink_phase_hook");
/* Fill the table */
i=0;
- for (c=st->clients; c; c=c->next) {
- for (j=0; j<c->networks.entries; j++) {
- st->routes[i].net=c->networks.list[j];
- st->routes[i].c=c;
- /* Hard routes are always up;
- soft routes default to down; routes with no 'deliver' function
- default to down */
- st->routes[i].up=c->deliver?
- (c->options&OPT_SOFTROUTE?False:True):
- False;
- st->routes[i].kup=False;
- st->routes[i].hard=c->options&OPT_SOFTROUTE?False:True;
- st->routes[i].allow_route=c->options&OPT_ALLOWROUTE?
- True:False;
- st->routes[i].quality=c->link_quality;
- st->routes[i].outcount=0;
- i++;
- }
- }
- /* ASSERT i==st->n_routes */
- if (i!=st->n_routes) {
- fatal("netlink: route count error: expected %d got %d\n",
- st->n_routes,i);
- }
- /* Sort the table in descending order of specificity */
- qsort(st->routes,st->n_routes,sizeof(*st->routes),
- netlink_compare_route_specificity);
+ for (c=st->clients; c; c=c->next)
+ st->routes[i++]=c;
+ /* Sort the table in descending order of priority */
+ qsort(st->routes,st->n_clients,sizeof(*st->routes),
+ netlink_compare_client_priority);
netlink_dump_routes(st,False);
}
netlink_dump_routes(st,True);
}
+static void netlink_inst_output_config(void *sst, struct buffer_if *buf)
+{
+/* struct netlink_client *c=sst; */
+/* struct netlink *st=c->nst; */
+
+ /* For now we don't output anything */
+ BUF_ASSERT_USED(buf);
+}
+
+static bool_t netlink_inst_check_config(void *sst, struct buffer_if *buf)
+{
+/* struct netlink_client *c=sst; */
+/* struct netlink *st=c->nst; */
+
+ BUF_ASSERT_USED(buf);
+ /* We need to eat all of the configuration information from the buffer
+ for backward compatibility. */
+ buf->size=0;
+ return True;
+}
+
+static void netlink_inst_set_mtu(void *sst, uint32_t new_mtu)
+{
+ struct netlink_client *c=sst;
+
+ c->mtu=new_mtu;
+}
+
static void netlink_inst_reg(void *sst, netlink_deliver_fn *deliver,
void *dst, uint32_t max_start_pad,
uint32_t max_end_pad)
{
struct netlink_client *c;
string_t name;
- struct subnet_list networks;
- uint32_t options;
+ struct ipset *networks;
+ uint32_t options,priority,mtu;
+ list_t *l;
name=dict_read_string(dict, "name", True, st->name, loc);
- dict_read_subnet_list(dict, "routes", True, st->name, loc,
- &networks);
+ l=dict_lookup(dict,"routes");
+ if (!l)
+ cfgfatal(loc,st->name,"required parameter \"routes\" not found\n");
+ networks=string_list_to_ipset(l,loc,st->name,"routes");
options=string_list_to_word(dict_lookup(dict,"options"),
netlink_option_table,st->name);
- if ((options&OPT_SOFTROUTE) && !st->set_route) {
+ priority=dict_read_number(dict,"priority",False,st->name,loc,0);
+ mtu=dict_read_number(dict,"mtu",False,st->name,loc,0);
+
+ if ((options&OPT_SOFTROUTE) && !st->set_routes) {
cfgfatal(loc,st->name,"this netlink device does not support "
"soft routes.\n");
return NULL;
}
}
- /* Check that nets do not intersect st->exclude_remote_networks;
- refuse to register if they do. */
- if (subnet_lists_intersect(&st->exclude_remote_networks,&networks)) {
- cfgfatal(loc,st->name,"networks intersect with the explicitly "
- "excluded remote networks\n");
+ /* Check that nets are a subset of st->remote_networks;
+ refuse to register if they are not. */
+ if (!ipset_is_subset(st->remote_networks,networks)) {
+ cfgfatal(loc,st->name,"routes are not allowed\n");
return NULL;
}
c->ops.reg=netlink_inst_reg;
c->ops.deliver=netlink_inst_incoming;
c->ops.set_quality=netlink_set_quality;
+ c->ops.output_config=netlink_inst_output_config;
+ c->ops.check_config=netlink_inst_check_config;
+ c->ops.set_mtu=netlink_inst_set_mtu;
c->nst=st;
c->networks=networks;
+ c->subnets=ipset_to_subnet_list(networks);
+ c->priority=priority;
c->deliver=NULL;
c->dst=NULL;
c->name=name;
- c->options=options;
c->link_quality=LINK_QUALITY_DOWN;
+ c->mtu=mtu?mtu:st->mtu;
+ c->options=options;
+ c->outcount=0;
+ c->up=False;
+ c->kup=False;
c->next=st->clients;
st->clients=c;
- st->n_routes+=networks.entries;
+ st->n_clients++;
return &c->cl;
}
item_t *item;
closure_t *cl;
- Message(M_DEBUG_CONFIG,"netlink_inst_apply\n");
-
item=list_elem(args,0);
if (!item || item->type!=t_dict) {
cfgfatal(loc,st->name,"must have a dictionary argument\n");
netlink_deliver_fn *netlink_init(struct netlink *st,
void *dst, struct cloc loc,
dict_t *dict, string_t description,
- netlink_route_fn *set_route,
+ netlink_route_fn *set_routes,
netlink_deliver_fn *to_host)
{
item_t *sa, *ptpa;
+ list_t *l;
st->dst=dst;
st->cl.description=description;
st->max_start_pad=0;
st->max_end_pad=0;
st->clients=NULL;
- st->set_route=set_route;
+ st->routes=NULL;
+ st->n_clients=0;
+ st->set_routes=set_routes;
st->deliver_to_host=to_host;
- st->name=dict_read_string(dict,"name",False,"netlink",loc);
+ st->name=dict_read_string(dict,"name",False,description,loc);
if (!st->name) st->name=description;
- dict_read_subnet_list(dict, "networks", True, "netlink", loc,
- &st->networks);
- dict_read_subnet_list(dict, "exclude-remote-networks", False, "netlink",
- loc, &st->exclude_remote_networks);
+ l=dict_lookup(dict,"networks");
+ if (l)
+ st->networks=string_list_to_ipset(l,loc,st->name,"networks");
+ else {
+ Message(M_WARNING,"%s: no local networks (parameter \"networks\") "
+ "defined\n",st->name);
+ st->networks=ipset_new();
+ }
+ l=dict_lookup(dict,"remote-networks");
+ if (l) {
+ st->remote_networks=string_list_to_ipset(l,loc,st->name,
+ "remote-networks");
+ } else {
+ struct ipset *empty;
+ empty=ipset_new();
+ st->remote_networks=ipset_complement(empty);
+ ipset_free(empty);
+ }
+
sa=dict_find_item(dict,"secnet-address",False,"netlink",loc);
ptpa=dict_find_item(dict,"ptp-address",False,"netlink",loc);
if (sa && ptpa) {
"ptp-address for this netlink device\n");
}
if (sa) {
- st->secnet_address=string_to_ipaddr(sa,"netlink");
+ st->secnet_address=string_item_to_ipaddr(sa,"netlink");
st->ptp=False;
} else {
- st->secnet_address=string_to_ipaddr(ptpa,"netlink");
+ st->secnet_address=string_item_to_ipaddr(ptpa,"netlink");
st->ptp=True;
}
+ /* To be strictly correct we could subtract secnet_address from
+ networks here. It shouldn't make any practical difference,
+ though, and will make the route dump look complicated... */
+ st->subnets=ipset_to_subnet_list(st->networks);
st->mtu=dict_read_number(dict, "mtu", False, "netlink", loc, DEFAULT_MTU);
buffer_new(&st->icmp,ICMP_BUFSIZE);
- st->n_routes=0;
- st->routes=NULL;
st->outcount=0;
st->localcount=0;
struct netlink nl;
};
-static bool_t null_set_route(void *sst, struct netlink_route *route)
+static bool_t null_set_route(void *sst, struct netlink_client *routes)
{
struct null *st=sst;
- string_t t;
-
- if (route->up!=route->kup) {
- t=subnet_to_string(&route->net);
- Message(M_INFO,"%s: setting route %s to state %s\n",st->nl.name,
- t, route->up?"up":"down");
- free(t);
- route->kup=route->up;
+
+ if (routes->up!=routes->kup) {
+ Message(M_INFO,"%s: setting routes for tunnel %s to state %s\n",
+ st->nl.name,routes->name,
+ routes->up?"up":"down");
+ routes->kup=routes->up;
return True;
}
return False;
~ian / secnet.git / blobdiff