X-Git-Url: http://git.archive.openwrt.org/?p=project%2Fnetifd.git;a=blobdiff_plain;f=interface-ip.c;h=26a28654bcecac86a839e69a17c09c3b2588965b;hp=b96d98c75784a5b7a8bf3fd82dee5d7a9f8bc3bd;hb=29521f9a232f039318fd8525c410b3127836626f;hpb=49c8ab4ed307e4de016e92d3ffc84cd0ab50d56c

diff --git a/interface-ip.c b/interface-ip.c
index b96d98c..26a2865 100644
--- a/interface-ip.c
+++ b/interface-ip.c
@@ -99,7 +99,7 @@ match_if_addr(union if_addr *a1, union if_addr *a2, int mask)
 
 static int set_ip_source_policy(bool add, bool v6, unsigned int priority,
 		const union if_addr *addr, uint8_t mask, unsigned int table,
-		struct interface *in_iface, const char *action)
+		struct interface *in_iface, const char *action, bool src)
 {
 	struct iprule rule = {
 		.flags = IPRULE_PRIORITY,
@@ -107,9 +107,15 @@ static int set_ip_source_policy(bool add, bool v6, unsigned int priority,
 	};
 
 	if (addr) {
-		rule.flags |= IPRULE_SRC;
-		rule.src_addr = *addr;
-		rule.src_mask = mask;
+		if (src) {
+			rule.flags |= IPRULE_SRC;
+			rule.src_addr = *addr;
+			rule.src_mask = mask;
+		} else {
+			rule.flags |= IPRULE_DEST;
+			rule.dest_addr = *addr;
+			rule.dest_mask = mask;
+		}
 	}
 
 	if (table) {
@@ -360,7 +366,7 @@ interface_ip_add_route(struct interface *iface, struct blob_attr *attr, bool v6)
 		const char *mask = strtok_r(NULL, "/", &saveptr);
 
 		if (!addr || inet_pton(af, addr, &route->source) < 1) {
-			DPRINTF("Failed to parse route source: %s\n", addr);
+			DPRINTF("Failed to parse route source: %s\n", addr ? addr : "NULL");
 			goto error;
 		}
 
@@ -482,6 +488,19 @@ interface_handle_subnet_route(struct interface *iface, struct device_addr *addr,
 }
 
 static void
+interface_add_addr_rules(struct device_addr *addr, bool enabled)
+{
+	bool v6 = (addr->flags & DEVADDR_FAMILY) == DEVADDR_INET6;
+
+	set_ip_source_policy(enabled, v6, IPRULE_PRIORITY_ADDR, &addr->addr,
+			     (v6) ? 128 : 32, addr->policy_table, NULL, NULL,
+			     true);
+	set_ip_source_policy(enabled, v6, IPRULE_PRIORITY_ADDR_MASK,
+			     &addr->addr, addr->mask, addr->policy_table, NULL,
+			     NULL, false);
+}
+
+static void
 interface_update_proto_addr(struct vlist_tree *tree,
 			    struct vlist_node *node_new,
 			    struct vlist_node *node_old)
@@ -541,16 +560,12 @@ interface_update_proto_addr(struct vlist_tree *tree,
 
 	if (node_old) {
 		if (a_old->enabled && !keep) {
-			if ((a_old->flags & DEVADDR_FAMILY) == DEVADDR_INET6)
-				v6 = true;
-
 			//This is needed for source routing to work correctly. If a device
 			//has two connections to a network using the same subnet, adding
 			//only the network-rule will cause packets to be routed through the
 			//first matching network (source IP matches both masks).
 			if (a_old->policy_table)
-				set_ip_source_policy(false, v6, IPRULE_PRIORITY_ADDR, &a_old->addr,
-						(v6) ? 128 : 32, a_old->policy_table, NULL, NULL);
+				interface_add_addr_rules(a_old, false);
 
 			if (!(a_old->flags & DEVADDR_EXTERNAL)) {
 				interface_handle_subnet_route(iface, a_old, false);
@@ -580,8 +595,7 @@ interface_update_proto_addr(struct vlist_tree *tree,
 
 			if (!keep) {
 				if (a_new->policy_table)
-					set_ip_source_policy(true, v6, IPRULE_PRIORITY_ADDR, &a_new->addr,
-							(v6) ? 128 : 32, a_new->policy_table, NULL, NULL);
+					interface_add_addr_rules(a_new, true);
 			}
 		}
 	}
@@ -762,10 +776,10 @@ interface_set_prefix_address(struct device_prefix_assignment *assignment,
 		if (prefix->iface) {
 			if (prefix->iface->ip6table)
 				set_ip_source_policy(false, true, IPRULE_PRIORITY_NW, &addr.addr,
-						addr.mask, prefix->iface->ip6table, iface, NULL);
+						addr.mask, prefix->iface->ip6table, iface, NULL, true);
 
 			set_ip_source_policy(false, true, IPRULE_PRIORITY_REJECT, &addr.addr,
-							addr.mask, 0, iface, "unreachable");
+							addr.mask, 0, iface, "unreachable", true);
 		}
 
 		system_del_route(l3_downlink, &route);
@@ -777,11 +791,11 @@ interface_set_prefix_address(struct device_prefix_assignment *assignment,
 
 		if (prefix->iface && !assignment->enabled) {
 			set_ip_source_policy(true, true, IPRULE_PRIORITY_REJECT, &addr.addr,
-					addr.mask, 0, iface, "unreachable");
+					addr.mask, 0, iface, "unreachable", true);
 
 			if (prefix->iface->ip6table)
 				set_ip_source_policy(true, true, IPRULE_PRIORITY_NW, &addr.addr,
-						addr.mask, prefix->iface->ip6table, iface, NULL);
+						addr.mask, prefix->iface->ip6table, iface, NULL, true);
 		}
 
 		route.metric = iface->metric;
@@ -843,6 +857,9 @@ static void interface_update_prefix_assignments(struct device_prefix *prefix, bo
 
 	// End-of-assignment sentinel
 	c = malloc(sizeof(*c) + 1);
+	if (!c)
+		return;
+
 	c->assigned = 1 << (64 - prefix->length);
 	c->length = 64;
 	c->name[0] = 0;
@@ -853,12 +870,14 @@ static void interface_update_prefix_assignments(struct device_prefix *prefix, bo
 	if (prefix->excl_length > 0) {
 		const char name[] = "!excluded";
 		c = malloc(sizeof(*c) + sizeof(name));
-		c->assigned = ntohl(prefix->excl_addr.s6_addr32[1]) &
-				((1 << (64 - prefix->length)) - 1);
-		c->length = prefix->excl_length;
-		c->addr = in6addr_any;
-		memcpy(c->name, name, sizeof(name));
-		list_add(&c->head, &prefix->assignments);
+		if (c) {
+			c->assigned = ntohl(prefix->excl_addr.s6_addr32[1]) &
+					((1 << (64 - prefix->length)) - 1);
+			c->length = prefix->excl_length;
+			c->addr = in6addr_any;
+			memcpy(c->name, name, sizeof(name));
+			list_add(&c->head, &prefix->assignments);
+		}
 	}
 
 	bool assigned_any = false;
@@ -886,6 +905,9 @@ static void interface_update_prefix_assignments(struct device_prefix *prefix, bo
 
 		size_t namelen = strlen(iface->name) + 1;
 		c = malloc(sizeof(*c) + namelen);
+		if (!c)
+			continue;
+
 		c->length = iface->assignment_length;
 		c->assigned = iface->assignment_hint;
 		c->addr = in6addr_any;
@@ -1019,6 +1041,9 @@ interface_ip_add_device_prefix(struct interface *iface, struct in6_addr *addr,
 		pclass = (iface) ? iface->name : "local";
 
 	struct device_prefix *prefix = calloc(1, sizeof(*prefix) + strlen(pclass) + 1);
+	if (!prefix)
+		return NULL;
+
 	prefix->length = length;
 	prefix->addr = *addr;
 	prefix->preferred_until = preferred_until;
@@ -1239,6 +1264,9 @@ void interface_ip_set_enabled(struct interface_ip_settings *ip, bool enabled)
 	vlist_for_each_element(&ip->addr, addr, node) {
 		bool v6 = ((addr->flags & DEVADDR_FAMILY) == DEVADDR_INET6) ? true : false;
 
+		if (addr->flags & DEVADDR_EXTERNAL)
+			continue;
+
 		if (addr->enabled == enabled)
 			continue;
 
@@ -1250,15 +1278,13 @@ void interface_ip_set_enabled(struct interface_ip_settings *ip, bool enabled)
 				interface_handle_subnet_route(iface, addr, true);
 
 			if (addr->policy_table)
-				set_ip_source_policy(true, v6, IPRULE_PRIORITY_ADDR, &addr->addr,
-						(v6) ? 128 : 32, addr->policy_table, NULL, NULL);
+				interface_add_addr_rules(addr, true);
 		} else {
 			interface_handle_subnet_route(iface, addr, false);
 			system_del_address(dev, addr);
 
 			if (addr->policy_table)
-				set_ip_source_policy(false, v6, IPRULE_PRIORITY_ADDR, &addr->addr,
-						(v6) ? 128 : 32, addr->policy_table, NULL, NULL);
+				interface_add_addr_rules(addr, false);
 		}
 		addr->enabled = enabled;
 	}
@@ -1266,6 +1292,9 @@ void interface_ip_set_enabled(struct interface_ip_settings *ip, bool enabled)
 	vlist_for_each_element(&ip->route, route, node) {
 		bool _enabled = enabled;
 
+		if (route->flags & DEVADDR_EXTERNAL)
+			continue;
+
 		if (!enable_route(ip, route))
 			_enabled = false;
 
@@ -1295,7 +1324,7 @@ void interface_ip_set_enabled(struct interface_ip_settings *ip, bool enabled)
 		set_ip_lo_policy(enabled, false, ip->iface);
 
 		set_ip_source_policy(enabled, true, IPRULE_PRIORITY_REJECT + ip->iface->l3_dev.dev->ifindex,
-			NULL, 0, 0, ip->iface, "failed_policy");
+			NULL, 0, 0, ip->iface, "failed_policy", true);
 		ip->iface->policy_rules_set = enabled;
 	}
 }