1 /* User-kernel network link */
3 /* See RFCs 791, 792, 1123 and 1812 */
5 /* The netlink device is actually a router. Tunnels are unnumbered
6 point-to-point lines (RFC1812 section 2.2.7); the router has a
7 single address (the 'router-id'). */
9 /* This is where we currently have the anti-spoofing paranoia - before
10 sending a packet to the kernel we check that the tunnel it came
11 over could reasonably have produced it. */
14 /* Points to note from RFC1812 (which may require changes in this
17 3.3.4 Maximum Transmission Unit - MTU
19 The MTU of each logical interface MUST be configurable within the
20 range of legal MTUs for the interface.
22 Many Link Layer protocols define a maximum frame size that may be
23 sent. In such cases, a router MUST NOT allow an MTU to be set which
24 would allow sending of frames larger than those allowed by the Link
25 Layer protocol. However, a router SHOULD be willing to receive a
26 packet as large as the maximum frame size even if that is larger than
29 4.2.1 A router SHOULD count datagrams discarded.
31 4.2.2.1 Source route options - we probably should implement processing
32 of source routes, even though mostly the security policy will prevent
35 5.3.13.4 Source Route Options
37 A router MUST implement support for source route options in forwarded
38 packets. A router MAY implement a configuration option that, when
39 enabled, causes all source-routed packets to be discarded. However,
40 such an option MUST NOT be enabled by default.
42 5.3.13.5 Record Route Option
44 Routers MUST support the Record Route option in forwarded packets.
46 A router MAY provide a configuration option that, if enabled, will
47 cause the router to ignore (i.e., pass through unchanged) Record
48 Route options in forwarded packets. If provided, such an option MUST
49 default to enabling the record-route. This option should not affect
50 the processing of Record Route options in datagrams received by the
51 router itself (in particular, Record Route options in ICMP echo
52 requests will still be processed according to Section [4.3.3.6]).
54 5.3.13.6 Timestamp Option
56 Routers MUST support the timestamp option in forwarded packets. A
57 timestamp value MUST follow the rules given [INTRO:2].
59 If the flags field = 3 (timestamp and prespecified address), the
60 router MUST add its timestamp if the next prespecified address
61 matches any of the router's IP addresses. It is not necessary that
62 the prespecified address be either the address of the interface on
63 which the packet arrived or the address of the interface over which
67 4.2.2.7 Fragmentation: RFC 791 Section 3.2
69 Fragmentation, as described in [INTERNET:1], MUST be supported by a
72 4.2.2.8 Reassembly: RFC 791 Section 3.2
74 As specified in the corresponding section of [INTRO:2], a router MUST
75 support reassembly of datagrams that it delivers to itself.
77 4.2.2.9 Time to Live: RFC 791 Section 3.2
79 Note in particular that a router MUST NOT check the TTL of a packet
80 except when forwarding it.
82 A router MUST NOT discard a datagram just because it was received
83 with TTL equal to zero or one; if it is to the router and otherwise
84 valid, the router MUST attempt to receive it.
86 On messages the router originates, the IP layer MUST provide a means
87 for the transport layer to set the TTL field of every datagram that
88 is sent. When a fixed TTL value is used, it MUST be configurable.
91 8.1 The Simple Network Management Protocol - SNMP
92 8.1.1 SNMP Protocol Elements
94 Routers MUST be manageable by SNMP [MGT:3]. The SNMP MUST operate
95 using UDP/IP as its transport and network protocols.
109 #define ICMP_TYPE_ECHO_REPLY 0
111 #define ICMP_TYPE_UNREACHABLE 3
112 #define ICMP_CODE_NET_UNREACHABLE 0
113 #define ICMP_CODE_PROTOCOL_UNREACHABLE 2
114 #define ICMP_CODE_FRAGMENTATION_REQUIRED 4
115 #define ICMP_CODE_NET_PROHIBITED 13
117 #define ICMP_TYPE_ECHO_REQUEST 8
119 #define ICMP_TYPE_TIME_EXCEEDED 11
120 #define ICMP_CODE_TTL_EXCEEDED 0
122 /* Generic IP checksum routine */
123 static inline uint16_t ip_csum(const uint8_t *iph,int32_t count)
125 register uint32_t sum=0;
128 sum+=ntohs(*(uint16_t *)iph);
133 sum+=*(uint8_t *)iph;
135 sum=(sum&0xffff)+(sum>>16);
141 * This is a version of ip_compute_csum() optimized for IP headers,
142 * which always checksum on 4 octet boundaries.
144 * By Jorge Cwik <jorge@laser.satlink.net>, adapted for linux by
147 static inline uint16_t ip_fast_csum(const uint8_t *iph, int32_t ihl) {
150 __asm__ __volatile__(
156 "adcl 12(%1), %0 ;\n"
157 "1: adcl 16(%1), %0 ;\n"
168 /* Since the input registers which are loaded with iph and ipl
169 are modified, we must also specify them as outputs, or gcc
170 will assume they contain their original values. */
171 : "=r" (sum), "=r" (iph), "=r" (ihl)
172 : "1" (iph), "2" (ihl)
177 static inline uint16_t ip_fast_csum(uint8_t *iph, int32_t ihl)
179 assert(ihl < INT_MAX/4);
180 return ip_csum(iph,ihl*4);
185 #if defined (WORDS_BIGENDIAN)
196 #define IPHDR_FRAG_OFF ((uint16_t)0x1fff)
197 #define IPHDR_FRAG_MORE ((uint16_t)0x2000)
198 #define IPHDR_FRAG_DONT ((uint16_t)0x4000)
199 /* reserved 0x8000 */
205 /* The options start here. */
213 union icmpinfofield {
228 static const union icmpinfofield icmp_noinfo;
230 static void netlink_packet_deliver(struct netlink *st,
231 struct netlink_client *client,
232 struct buffer_if *buf);
234 /* XXX RFC1812 4.3.2.5:
235 All other ICMP error messages (Destination Unreachable,
236 Redirect, Time Exceeded, and Parameter Problem) SHOULD have their
237 precedence value set to 6 (INTERNETWORK CONTROL) or 7 (NETWORK
238 CONTROL). The IP Precedence value for these error messages MAY be
241 static struct icmphdr *netlink_icmp_tmpl(struct netlink *st,
242 uint32_t dest,uint16_t len)
246 BUF_ALLOC(&st->icmp,"netlink_icmp_tmpl");
247 buffer_init(&st->icmp,calculate_max_start_pad());
248 h=buf_append(&st->icmp,sizeof(*h));
253 h->iph.tot_len=htons(len+(h->iph.ihl*4)+8);
256 h->iph.ttl=255; /* XXX should be configurable */
258 h->iph.saddr=htonl(st->secnet_address);
259 h->iph.daddr=htonl(dest);
261 h->iph.check=ip_fast_csum((uint8_t *)&h->iph,h->iph.ihl);
268 /* Fill in the ICMP checksum field correctly */
269 static void netlink_icmp_csum(struct icmphdr *h)
273 len=ntohs(h->iph.tot_len)-(4*h->iph.ihl);
275 h->check=ip_csum(&h->type,len);
279 * An ICMP error message MUST NOT be sent as the result of
282 * * an ICMP error message, or
284 * * a datagram destined to an IP broadcast or IP multicast
287 * * a datagram sent as a link-layer broadcast, or
289 * * a non-initial fragment, or
291 * * a datagram whose source address does not define a single
292 * host -- e.g., a zero address, a loopback address, a
293 * broadcast address, a multicast address, or a Class E
296 static bool_t netlink_icmp_may_reply(struct buffer_if *buf)
299 struct icmphdr *icmph;
302 if (buf->size < (int)sizeof(struct icmphdr)) return False;
303 iph=(struct iphdr *)buf->start;
304 icmph=(struct icmphdr *)buf->start;
305 if (iph->protocol==1) {
306 switch(icmph->type) {
307 /* Based on http://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml#icmp-parameters-types
308 * as retrieved Thu, 20 Mar 2014 00:16:44 +0000.
309 * Deprecated, reserved, unassigned and experimental
310 * options are treated as not safe to reply to.
312 case 0: /* Echo Reply */
314 case 13: /* Timestamp */
315 case 14: /* Timestamp Reply */
321 /* How do we spot broadcast destination addresses? */
322 if (ntohs(iph->frag)&IPHDR_FRAG_OFF) return False;
323 source=ntohl(iph->saddr);
324 if (source==0) return False;
325 if ((source&0xff000000)==0x7f000000) return False;
326 /* How do we spot broadcast source addresses? */
327 if ((source&0xf0000000)==0xe0000000) return False; /* Multicast */
328 if ((source&0xf0000000)==0xf0000000) return False; /* Class E */
332 /* How much of the original IP packet do we include in its ICMP
333 response? The header plus up to 64 bits. */
336 4.3.2.3 Original Message Header
338 Historically, every ICMP error message has included the Internet
339 header and at least the first 8 data bytes of the datagram that
340 triggered the error. This is no longer adequate, due to the use of
341 IP-in-IP tunneling and other technologies. Therefore, the ICMP
342 datagram SHOULD contain as much of the original datagram as possible
343 without the length of the ICMP datagram exceeding 576 bytes. The
344 returned IP header (and user data) MUST be identical to that which
345 was received, except that the router is not required to undo any
346 modifications to the IP header that are normally performed in
347 forwarding that were performed before the error was detected (e.g.,
348 decrementing the TTL, or updating options). Note that the
349 requirements of Section [4.3.3.5] supersede this requirement in some
350 cases (i.e., for a Parameter Problem message, if the problem is in a
351 modified field, the router must undo the modification). See Section
354 static uint16_t netlink_icmp_reply_len(struct buffer_if *buf)
356 if (buf->size < (int)sizeof(struct iphdr)) return 0;
357 struct iphdr *iph=(struct iphdr *)buf->start;
361 /* We include the first 8 bytes of the packet data, provided they exist */
363 plen=ntohs(iph->tot_len);
364 return (hlen>plen?plen:hlen);
367 /* client indicates where the packet we're constructing a response to
368 comes from. NULL indicates the host. */
369 static void netlink_icmp_simple(struct netlink *st, struct buffer_if *buf,
370 uint8_t type, uint8_t code,
371 union icmpinfofield info)
376 if (netlink_icmp_may_reply(buf)) {
377 struct iphdr *iph=(struct iphdr *)buf->start;
378 len=netlink_icmp_reply_len(buf);
379 h=netlink_icmp_tmpl(st,ntohl(iph->saddr),len);
380 h->type=type; h->code=code; h->d=info;
381 memcpy(buf_append(&st->icmp,len),buf->start,len);
382 netlink_icmp_csum(h);
383 netlink_packet_deliver(st,NULL,&st->icmp);
384 BUF_ASSERT_FREE(&st->icmp);
389 * RFC1122: 3.1.2.2 MUST silently discard any IP frame that fails the
391 * RFC1812: 4.2.2.5 MUST discard messages containing invalid checksums.
393 * Is the datagram acceptable?
395 * 1. Length at least the size of an ip header
397 * 3. Checksums correctly.
398 * 4. Doesn't have a bogus length
400 static bool_t netlink_check(struct netlink *st, struct buffer_if *buf,
401 char *errmsgbuf, int errmsgbuflen)
403 #define BAD(...) do{ \
404 snprintf(errmsgbuf,errmsgbuflen,__VA_ARGS__); \
408 if (buf->size < (int)sizeof(struct iphdr)) BAD("len %"PRIu32"",buf->size);
409 struct iphdr *iph=(struct iphdr *)buf->start;
412 if (iph->ihl < 5) BAD("ihl %u",iph->ihl);
413 if (iph->version != 4) BAD("version %u",iph->version);
414 if (buf->size < iph->ihl*4) BAD("size %"PRId32"<%u*4",buf->size,iph->ihl);
415 if (ip_fast_csum((uint8_t *)iph, iph->ihl)!=0) BAD("csum");
416 len=ntohs(iph->tot_len);
417 /* There should be no padding */
418 if (buf->size!=len) BAD("len %"PRId32"!=%"PRId32,buf->size,len);
419 if (len<(iph->ihl<<2)) BAD("len %"PRId32"<(%u<<2)",len,iph->ihl);
420 /* XXX check that there's no source route specified */
426 /* Deliver a packet _to_ client; used after we have decided
427 * what to do with it (and just to check that the client has
428 * actually registered a delivery function with us). */
429 static void netlink_client_deliver(struct netlink *st,
430 struct netlink_client *client,
431 uint32_t source, uint32_t dest,
432 struct buffer_if *buf)
434 if (!client->deliver) {
436 s=ipaddr_to_string(source);
437 d=ipaddr_to_string(dest);
438 Message(M_ERR,"%s: dropping %s->%s, client not registered\n",
444 client->deliver(client->dst, buf);
448 /* Deliver a packet to the host; used after we have decided that that
449 * is what to do with it. */
450 static void netlink_host_deliver(struct netlink *st,
451 uint32_t source, uint32_t dest,
452 struct buffer_if *buf)
454 st->deliver_to_host(st->dst,buf);
458 /* Deliver a packet. "client" is the _origin_ of the packet, not its
459 destination, and is NULL for packets from the host and packets
460 generated internally in secnet. */
461 static void netlink_packet_deliver(struct netlink *st,
462 struct netlink_client *client,
463 struct buffer_if *buf)
465 if (buf->size < (int)sizeof(struct iphdr)) {
466 Message(M_ERR,"%s: trying to deliver a too-short packet"
467 " from %s!\n",st->name, client?client->name:"(local)");
472 struct iphdr *iph=(struct iphdr *)buf->start;
473 uint32_t dest=ntohl(iph->daddr);
474 uint32_t source=ntohl(iph->saddr);
475 uint32_t best_quality;
476 bool_t allow_route=False;
477 bool_t found_allowed=False;
481 BUF_ASSERT_USED(buf);
483 if (dest==st->secnet_address) {
484 Message(M_ERR,"%s: trying to deliver a packet to myself!\n",st->name);
489 /* Packets from the host (client==NULL) may always be routed. Packets
490 from clients with the allow_route option will also be routed. */
491 if (!client || (client && (client->options & OPT_ALLOWROUTE)))
494 /* If !allow_route, we check the routing table anyway, and if
495 there's a suitable route with OPT_ALLOWROUTE set we use it. If
496 there's a suitable route, but none with OPT_ALLOWROUTE set then
497 we generate ICMP 'communication with destination network
498 administratively prohibited'. */
502 for (i=0; i<st->n_clients; i++) {
503 if (st->routes[i]->up &&
504 ipset_contains_addr(st->routes[i]->networks,dest)) {
505 /* It's an available route to the correct destination. But is
506 it better than the one we already have? */
508 /* If we have already found an allowed route then we don't
509 bother looking at routes we're not allowed to use. If
510 we don't yet have an allowed route we'll consider any. */
511 if (!allow_route && found_allowed) {
512 if (!(st->routes[i]->options&OPT_ALLOWROUTE)) continue;
515 if (st->routes[i]->link_quality>best_quality
516 || best_quality==0) {
517 best_quality=st->routes[i]->link_quality;
519 if (st->routes[i]->options&OPT_ALLOWROUTE)
521 /* If quality isn't perfect we may wish to
522 consider kicking the tunnel with a 0-length
523 packet to prompt it to perform a key setup.
524 Then it'll eventually decide it's up or
526 /* If quality is perfect and we're allowed to use the
527 route we don't need to search any more. */
528 if (best_quality>=MAXIMUM_LINK_QUALITY &&
529 (allow_route || found_allowed)) break;
533 if (best_match==-1) {
534 /* The packet's not going down a tunnel. It might (ought to)
536 if (ipset_contains_addr(st->networks,dest)) {
537 netlink_host_deliver(st,source,dest,buf);
538 BUF_ASSERT_FREE(buf);
541 s=ipaddr_to_string(source);
542 d=ipaddr_to_string(dest);
543 Message(M_DEBUG,"%s: don't know where to deliver packet "
544 "(s=%s, d=%s)\n", st->name, s, d);
546 netlink_icmp_simple(st,buf,ICMP_TYPE_UNREACHABLE,
547 ICMP_CODE_NET_UNREACHABLE, icmp_noinfo);
552 !(st->routes[best_match]->options&OPT_ALLOWROUTE)) {
554 s=ipaddr_to_string(source);
555 d=ipaddr_to_string(dest);
556 /* We have a usable route but aren't allowed to use it.
557 Generate ICMP destination unreachable: communication
558 with destination network administratively prohibited */
559 Message(M_NOTICE,"%s: denied forwarding for packet (s=%s, d=%s)\n",
563 netlink_icmp_simple(st,buf,ICMP_TYPE_UNREACHABLE,
564 ICMP_CODE_NET_PROHIBITED, icmp_noinfo);
567 if (best_quality>0) {
568 /* XXX Fragment if required */
569 netlink_client_deliver(st,st->routes[best_match],
571 BUF_ASSERT_FREE(buf);
573 /* Generate ICMP destination unreachable */
574 netlink_icmp_simple(st,buf,
575 ICMP_TYPE_UNREACHABLE,
576 ICMP_CODE_NET_UNREACHABLE,
582 BUF_ASSERT_FREE(buf);
585 static void netlink_packet_forward(struct netlink *st,
586 struct netlink_client *client,
587 struct buffer_if *buf)
589 if (buf->size < (int)sizeof(struct iphdr)) return;
590 struct iphdr *iph=(struct iphdr *)buf->start;
592 BUF_ASSERT_USED(buf);
594 /* Packet has already been checked */
596 /* Generate ICMP time exceeded */
597 netlink_icmp_simple(st,buf,ICMP_TYPE_TIME_EXCEEDED,
598 ICMP_CODE_TTL_EXCEEDED,icmp_noinfo);
604 iph->check=ip_fast_csum((uint8_t *)iph,iph->ihl);
606 netlink_packet_deliver(st,client,buf);
607 BUF_ASSERT_FREE(buf);
610 /* Deal with packets addressed explicitly to us */
611 static void netlink_packet_local(struct netlink *st,
612 struct netlink_client *client,
613 struct buffer_if *buf)
619 if (buf->size < (int)sizeof(struct icmphdr)) {
620 Message(M_WARNING,"%s: short packet addressed to secnet; "
621 "ignoring it\n",st->name);
625 h=(struct icmphdr *)buf->start;
627 if ((ntohs(h->iph.frag)&(IPHDR_FRAG_OFF|IPHDR_FRAG_MORE))!=0) {
628 Message(M_WARNING,"%s: fragmented packet addressed to secnet; "
629 "ignoring it\n",st->name);
634 if (h->iph.protocol==1) {
636 if (h->type==ICMP_TYPE_ECHO_REQUEST && h->code==0) {
637 /* ICMP echo-request. Special case: we re-use the buffer
638 to construct the reply. */
639 h->type=ICMP_TYPE_ECHO_REPLY;
640 h->iph.daddr=h->iph.saddr;
641 h->iph.saddr=htonl(st->secnet_address);
644 h->iph.check=ip_fast_csum((uint8_t *)h,h->iph.ihl);
645 netlink_icmp_csum(h);
646 netlink_packet_deliver(st,NULL,buf);
649 Message(M_WARNING,"%s: unknown incoming ICMP\n",st->name);
651 /* Send ICMP protocol unreachable */
652 netlink_icmp_simple(st,buf,ICMP_TYPE_UNREACHABLE,
653 ICMP_CODE_PROTOCOL_UNREACHABLE,icmp_noinfo);
661 /* If cid==NULL packet is from host, otherwise cid specifies which tunnel
663 static void netlink_incoming(struct netlink *st, struct netlink_client *client,
664 struct buffer_if *buf)
666 uint32_t source,dest;
669 const char *sourcedesc=client?client->name:"host";
671 BUF_ASSERT_USED(buf);
673 if (!netlink_check(st,buf,errmsgbuf,sizeof(errmsgbuf))) {
674 Message(M_WARNING,"%s: bad IP packet from %s: %s\n",
680 assert(buf->size >= (int)sizeof(struct icmphdr));
681 iph=(struct iphdr *)buf->start;
683 source=ntohl(iph->saddr);
684 dest=ntohl(iph->daddr);
686 /* Check source. If we don't like the source, there's no point
687 generating ICMP because we won't know how to get it to the
688 source of the packet. */
690 /* Check that the packet source is appropriate for the tunnel
692 if (!ipset_contains_addr(client->networks,source)) {
694 s=ipaddr_to_string(source);
695 d=ipaddr_to_string(dest);
696 Message(M_WARNING,"%s: packet from tunnel %s with bad "
697 "source address (s=%s,d=%s)\n",st->name,client->name,s,d);
703 /* Check that the packet originates in our configured local
704 network, and hasn't been forwarded from elsewhere or
705 generated with the wrong source address */
706 if (!ipset_contains_addr(st->networks,source)) {
708 s=ipaddr_to_string(source);
709 d=ipaddr_to_string(dest);
710 Message(M_WARNING,"%s: outgoing packet with bad source address "
711 "(s=%s,d=%s)\n",st->name,s,d);
718 /* If this is a point-to-point device we don't examine the
719 destination address at all; we blindly send it down our
720 one-and-only registered tunnel, or to the host, depending on
721 where it came from. It's up to external software to check
722 address validity and generate ICMP, etc. */
725 netlink_host_deliver(st,source,dest,buf);
727 netlink_client_deliver(st,st->clients,source,dest,buf);
729 BUF_ASSERT_FREE(buf);
733 /* st->secnet_address needs checking before matching destination
735 if (dest==st->secnet_address) {
736 netlink_packet_local(st,client,buf);
737 BUF_ASSERT_FREE(buf);
740 netlink_packet_forward(st,client,buf);
741 BUF_ASSERT_FREE(buf);
744 static void netlink_inst_incoming(void *sst, struct buffer_if *buf)
746 struct netlink_client *c=sst;
747 struct netlink *st=c->nst;
749 netlink_incoming(st,c,buf);
752 static void netlink_dev_incoming(void *sst, struct buffer_if *buf)
754 struct netlink *st=sst;
756 netlink_incoming(st,NULL,buf);
759 static void netlink_set_quality(void *sst, uint32_t quality)
761 struct netlink_client *c=sst;
762 struct netlink *st=c->nst;
764 c->link_quality=quality;
765 c->up=(c->link_quality==LINK_QUALITY_DOWN)?False:True;
766 if (c->options&OPT_SOFTROUTE) {
767 st->set_routes(st->dst,c);
771 static void netlink_output_subnets(struct netlink *st, uint32_t loglevel,
772 struct subnet_list *snets)
777 for (i=0; i<snets->entries; i++) {
778 net=subnet_to_string(snets->list[i]);
779 Message(loglevel,"%s ",net);
784 static void netlink_dump_routes(struct netlink *st, bool_t requested)
790 if (requested) c=M_WARNING;
792 net=ipaddr_to_string(st->secnet_address);
793 Message(c,"%s: point-to-point (remote end is %s); routes: ",
796 netlink_output_subnets(st,c,st->clients->subnets);
799 Message(c,"%s: routing table:\n",st->name);
800 for (i=0; i<st->n_clients; i++) {
801 netlink_output_subnets(st,c,st->routes[i]->subnets);
802 Message(c,"-> tunnel %s (%s,mtu %d,%s routes,%s,"
803 "quality %d,use %d,pri %lu)\n",
805 st->routes[i]->up?"up":"down",
807 st->routes[i]->options&OPT_SOFTROUTE?"soft":"hard",
808 st->routes[i]->options&OPT_ALLOWROUTE?"free":"restricted",
809 st->routes[i]->link_quality,
810 st->routes[i]->outcount,
811 (unsigned long)st->routes[i]->priority);
813 net=ipaddr_to_string(st->secnet_address);
814 Message(c,"%s/32 -> netlink \"%s\" (use %d)\n",
815 net,st->name,st->localcount);
817 for (i=0; i<st->subnets->entries; i++) {
818 net=subnet_to_string(st->subnets->list[i]);
819 Message(c,"%s ",net);
823 Message(c,"-> host (use %d)\n",st->outcount);
827 /* ap is a pointer to a member of the routes array */
828 static int netlink_compare_client_priority(const void *ap, const void *bp)
830 const struct netlink_client *const*a=ap;
831 const struct netlink_client *const*b=bp;
833 if ((*a)->priority==(*b)->priority) return 0;
834 if ((*a)->priority<(*b)->priority) return 1;
838 static void netlink_phase_hook(void *sst, uint32_t new_phase)
840 struct netlink *st=sst;
841 struct netlink_client *c;
844 /* All the networks serviced by the various tunnels should now
845 * have been registered. We build a routing table by sorting the
846 * clients by priority. */
847 st->routes=safe_malloc_ary(sizeof(*st->routes),st->n_clients,
848 "netlink_phase_hook");
851 for (c=st->clients; c; c=c->next) {
855 /* Sort the table in descending order of priority */
856 qsort(st->routes,st->n_clients,sizeof(*st->routes),
857 netlink_compare_client_priority);
859 netlink_dump_routes(st,False);
862 static void netlink_signal_handler(void *sst, int signum)
864 struct netlink *st=sst;
865 Message(M_INFO,"%s: route dump requested by SIGUSR1\n",st->name);
866 netlink_dump_routes(st,True);
869 static void netlink_inst_set_mtu(void *sst, int32_t new_mtu)
871 struct netlink_client *c=sst;
876 static void netlink_inst_reg(void *sst, netlink_deliver_fn *deliver,
879 struct netlink_client *c=sst;
885 static struct flagstr netlink_option_table[]={
886 { "soft", OPT_SOFTROUTE },
887 { "allow-route", OPT_ALLOWROUTE },
890 /* This is the routine that gets called when the closure that's
891 returned by an invocation of a netlink device closure (eg. tun,
892 userv-ipif) is invoked. It's used to create routes and pass in
893 information about them; the closure it returns is used by site
895 static closure_t *netlink_inst_create(struct netlink *st,
896 struct cloc loc, dict_t *dict)
898 struct netlink_client *c;
900 struct ipset *networks;
901 uint32_t options,priority;
905 name=dict_read_string(dict, "name", True, st->name, loc);
907 l=dict_lookup(dict,"routes");
909 cfgfatal(loc,st->name,"required parameter \"routes\" not found\n");
910 networks=string_list_to_ipset(l,loc,st->name,"routes");
911 options=string_list_to_word(dict_lookup(dict,"options"),
912 netlink_option_table,st->name);
914 priority=dict_read_number(dict,"priority",False,st->name,loc,0);
915 mtu=dict_read_number(dict,"mtu",False,st->name,loc,0);
917 if ((options&OPT_SOFTROUTE) && !st->set_routes) {
918 cfgfatal(loc,st->name,"this netlink device does not support "
923 if (options&OPT_SOFTROUTE) {
924 /* XXX for now we assume that soft routes require root privilege;
925 this may not always be true. The device driver can tell us. */
926 require_root_privileges=True;
927 require_root_privileges_explanation="netlink: soft routes";
929 cfgfatal(loc,st->name,"point-to-point netlinks do not support "
935 /* Check that nets are a subset of st->remote_networks;
936 refuse to register if they are not. */
937 if (!ipset_is_subset(st->remote_networks,networks)) {
938 cfgfatal(loc,st->name,"routes are not allowed\n");
942 c=safe_malloc(sizeof(*c),"netlink_inst_create");
943 c->cl.description=name;
944 c->cl.type=CL_NETLINK;
946 c->cl.interface=&c->ops;
948 c->ops.reg=netlink_inst_reg;
949 c->ops.deliver=netlink_inst_incoming;
950 c->ops.set_quality=netlink_set_quality;
951 c->ops.set_mtu=netlink_inst_set_mtu;
954 c->networks=networks;
955 c->subnets=ipset_to_subnet_list(networks);
956 c->priority=priority;
960 c->link_quality=LINK_QUALITY_UNUSED;
961 c->mtu=mtu?mtu:st->mtu;
968 assert(st->n_clients < INT_MAX);
974 static list_t *netlink_inst_apply(closure_t *self, struct cloc loc,
975 dict_t *context, list_t *args)
977 struct netlink *st=self->interface;
983 item=list_elem(args,0);
984 if (!item || item->type!=t_dict) {
985 cfgfatal(loc,st->name,"must have a dictionary argument\n");
987 dict=item->data.dict;
989 cl=netlink_inst_create(st,loc,dict);
991 return new_closure(cl);
994 netlink_deliver_fn *netlink_init(struct netlink *st,
995 void *dst, struct cloc loc,
996 dict_t *dict, cstring_t description,
997 netlink_route_fn *set_routes,
998 netlink_deliver_fn *to_host)
1004 st->cl.description=description;
1005 st->cl.type=CL_PURE;
1006 st->cl.apply=netlink_inst_apply;
1007 st->cl.interface=st;
1011 st->set_routes=set_routes;
1012 st->deliver_to_host=to_host;
1014 st->name=dict_read_string(dict,"name",False,description,loc);
1015 if (!st->name) st->name=description;
1016 l=dict_lookup(dict,"networks");
1018 st->networks=string_list_to_ipset(l,loc,st->name,"networks");
1020 struct ipset *empty;
1022 st->networks=ipset_complement(empty);
1025 l=dict_lookup(dict,"remote-networks");
1027 st->remote_networks=string_list_to_ipset(l,loc,st->name,
1030 struct ipset *empty;
1032 st->remote_networks=ipset_complement(empty);
1036 sa=dict_find_item(dict,"secnet-address",False,"netlink",loc);
1037 ptpa=dict_find_item(dict,"ptp-address",False,"netlink",loc);
1039 cfgfatal(loc,st->name,"you may not specify secnet-address and "
1040 "ptp-address in the same netlink device\n");
1042 if (!(sa || ptpa)) {
1043 cfgfatal(loc,st->name,"you must specify secnet-address or "
1044 "ptp-address for this netlink device\n");
1047 st->secnet_address=string_item_to_ipaddr(sa,"netlink");
1050 st->secnet_address=string_item_to_ipaddr(ptpa,"netlink");
1053 /* To be strictly correct we could subtract secnet_address from
1054 networks here. It shouldn't make any practical difference,
1055 though, and will make the route dump look complicated... */
1056 st->subnets=ipset_to_subnet_list(st->networks);
1057 st->mtu=dict_read_number(dict, "mtu", False, "netlink", loc, DEFAULT_MTU);
1058 buffer_new(&st->icmp,ICMP_BUFSIZE);
1062 add_hook(PHASE_SETUP,netlink_phase_hook,st);
1063 request_signal_notification(SIGUSR1, netlink_signal_handler, st);
1065 /* If we're point-to-point then we return a CL_NETLINK directly,
1066 rather than a CL_NETLINK_OLD or pure closure (depending on
1067 compatibility). This CL_NETLINK is for our one and only
1068 client. Our cl.apply function is NULL. */
1071 cl=netlink_inst_create(st,loc,dict);
1074 return netlink_dev_incoming;
1077 /* No connection to the kernel at all... */
1083 static bool_t null_set_route(void *sst, struct netlink_client *routes)
1085 struct null *st=sst;
1087 if (routes->up!=routes->kup) {
1088 Message(M_INFO,"%s: setting routes for tunnel %s to state %s\n",
1089 st->nl.name,routes->name,
1090 routes->up?"up":"down");
1091 routes->kup=routes->up;
1097 static void null_deliver(void *sst, struct buffer_if *buf)
1102 static list_t *null_apply(closure_t *self, struct cloc loc, dict_t *context,
1109 st=safe_malloc(sizeof(*st),"null_apply");
1111 item=list_elem(args,0);
1112 if (!item || item->type!=t_dict)
1113 cfgfatal(loc,"null-netlink","parameter must be a dictionary\n");
1115 dict=item->data.dict;
1117 netlink_init(&st->nl,st,loc,dict,"null-netlink",null_set_route,
1120 return new_closure(&st->nl.cl);
1123 void netlink_module(dict_t *dict)
1125 add_closure(dict,"null-netlink",null_apply);