dhcpv4: rework assignment lookup
[project/odhcpd.git] / src / ndp.c
1 /**
2  * Copyright (C) 2012-2013 Steven Barth <steven@midlink.org>
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License v2 as published by
6  * the Free Software Foundation.
7  *
8  * This program is distributed in the hope that it will be useful,
9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
11  * GNU General Public License for more details.
12  *
13  */
14
15 #include <stdio.h>
16 #include <stdlib.h>
17 #include <signal.h>
18 #include <errno.h>
19
20 #include <fcntl.h>
21 #include <unistd.h>
22 #include <arpa/inet.h>
23 #include <sys/socket.h>
24 #include <net/ethernet.h>
25 #include <netinet/ip6.h>
26 #include <netinet/icmp6.h>
27 #include <netpacket/packet.h>
28
29 #include <linux/rtnetlink.h>
30 #include <linux/filter.h>
31
32 #include <netlink/msg.h>
33 #include <netlink/socket.h>
34 #include <netlink/attr.h>
35
36 #include "dhcpv6.h"
37 #include "odhcpd.h"
38
39 struct event_socket {
40         struct odhcpd_event ev;
41         struct nl_sock *sock;
42         int sock_bufsize;
43 };
44
45 static void handle_solicit(void *addr, void *data, size_t len,
46                 struct interface *iface, void *dest);
47 static void handle_rtnl_event(struct odhcpd_event *ev);
48 static int cb_rtnl_valid(struct nl_msg *msg, void *arg);
49 static void catch_rtnl_err(struct odhcpd_event *e, int error);
50
51 static int ping_socket = -1;
52 static struct event_socket rtnl_event = {
53         .ev = {
54                 .uloop = {.fd = - 1, },
55                 .handle_dgram = NULL,
56                 .handle_error = catch_rtnl_err,
57                 .recv_msgs = handle_rtnl_event,
58         },
59         .sock = NULL,
60         .sock_bufsize = 133120,
61 };
62
63 // Filter ICMPv6 messages of type neighbor soliciation
64 static struct sock_filter bpf[] = {
65         BPF_STMT(BPF_LD | BPF_B | BPF_ABS, offsetof(struct ip6_hdr, ip6_nxt)),
66         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, IPPROTO_ICMPV6, 0, 3),
67         BPF_STMT(BPF_LD | BPF_B | BPF_ABS, sizeof(struct ip6_hdr) +
68                         offsetof(struct icmp6_hdr, icmp6_type)),
69         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ND_NEIGHBOR_SOLICIT, 0, 1),
70         BPF_STMT(BPF_RET | BPF_K, 0xffffffff),
71         BPF_STMT(BPF_RET | BPF_K, 0),
72 };
73 static const struct sock_fprog bpf_prog = {sizeof(bpf) / sizeof(*bpf), bpf};
74
75
76 // Initialize NDP-proxy
77 int init_ndp(void)
78 {
79         int val = 2;
80
81         rtnl_event.sock = odhcpd_create_nl_socket(NETLINK_ROUTE);
82         if (!rtnl_event.sock)
83                 goto err;
84
85         rtnl_event.ev.uloop.fd = nl_socket_get_fd(rtnl_event.sock);
86
87         if (nl_socket_set_buffer_size(rtnl_event.sock, rtnl_event.sock_bufsize, 0))
88                 goto err;
89
90         nl_socket_disable_seq_check(rtnl_event.sock);
91
92         nl_socket_modify_cb(rtnl_event.sock, NL_CB_VALID, NL_CB_CUSTOM,
93                         cb_rtnl_valid, NULL);
94
95         // Receive IPv4 address, IPv6 address, IPv6 routes and neighbor events
96         if (nl_socket_add_memberships(rtnl_event.sock, RTNLGRP_IPV4_IFADDR,
97                                 RTNLGRP_IPV6_IFADDR, RTNLGRP_IPV6_ROUTE,
98                                 RTNLGRP_NEIGH, RTNLGRP_LINK, 0))
99                 goto err;
100
101         odhcpd_register(&rtnl_event.ev);
102
103         // Open ICMPv6 socket
104         ping_socket = socket(AF_INET6, SOCK_RAW | SOCK_CLOEXEC, IPPROTO_ICMPV6);
105         if (ping_socket < 0) {
106                 syslog(LOG_ERR, "Unable to open raw socket: %s", strerror(errno));
107                         return -1;
108         }
109
110         setsockopt(ping_socket, IPPROTO_RAW, IPV6_CHECKSUM, &val, sizeof(val));
111
112         // This is required by RFC 4861
113         val = 255;
114         setsockopt(ping_socket, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, &val, sizeof(val));
115         setsockopt(ping_socket, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &val, sizeof(val));
116
117         // Filter all packages, we only want to send
118         struct icmp6_filter filt;
119         ICMP6_FILTER_SETBLOCKALL(&filt);
120         setsockopt(ping_socket, IPPROTO_ICMPV6, ICMP6_FILTER, &filt, sizeof(filt));
121
122         return 0;
123
124 err:
125         if (rtnl_event.sock) {
126                 nl_socket_free(rtnl_event.sock);
127                 rtnl_event.sock = NULL;
128                 rtnl_event.ev.uloop.fd = -1;
129         }
130
131         return -1;
132 }
133
134 static void dump_neigh_table(const bool proxy)
135 {
136         struct nl_msg *msg;
137         struct ndmsg ndm = {
138                 .ndm_family = AF_INET6,
139                 .ndm_flags = proxy ? NTF_PROXY : 0,
140         };
141
142         msg = nlmsg_alloc_simple(RTM_GETNEIGH, NLM_F_REQUEST | NLM_F_DUMP);
143         if (!msg)
144                 return;
145
146         nlmsg_append(msg, &ndm, sizeof(ndm), 0);
147
148         nl_send_auto_complete(rtnl_event.sock, msg);
149
150         nlmsg_free(msg);
151 }
152
153 static void dump_addr_table(bool v6)
154 {
155         struct nl_msg *msg;
156         struct ifaddrmsg ifa = {
157                 .ifa_family = v6 ? AF_INET6 : AF_INET,
158         };
159
160         msg = nlmsg_alloc_simple(RTM_GETADDR, NLM_F_REQUEST | NLM_F_DUMP);
161         if (!msg)
162                 return;
163
164         nlmsg_append(msg, &ifa, sizeof(ifa), 0);
165
166         nl_send_auto_complete(rtnl_event.sock, msg);
167
168         nlmsg_free(msg);
169 }
170
171 int setup_ndp_interface(struct interface *iface, bool enable)
172 {
173         int ret = 0, procfd;
174         bool dump_neigh = false;
175         char procbuf[64];
176
177         snprintf(procbuf, sizeof(procbuf), "/proc/sys/net/ipv6/conf/%s/proxy_ndp", iface->ifname);
178         procfd = open(procbuf, O_WRONLY);
179
180         if (procfd < 0) {
181                 ret = -1;
182                 goto out;
183         }
184
185         if (iface->ndp_event.uloop.fd > 0) {
186                 uloop_fd_delete(&iface->ndp_event.uloop);
187                 close(iface->ndp_event.uloop.fd);
188                 iface->ndp_event.uloop.fd = -1;
189
190                 if (!enable || iface->ndp != MODE_RELAY)
191                         if (write(procfd, "0\n", 2) < 0) {}
192
193                 dump_neigh = true;
194         }
195
196         if (enable && iface->ndp == MODE_RELAY) {
197                 if (write(procfd, "1\n", 2) < 0) {}
198
199                 int sock = socket(AF_PACKET, SOCK_DGRAM | SOCK_CLOEXEC, htons(ETH_P_IPV6));
200                 if (sock < 0) {
201                         syslog(LOG_ERR, "Unable to open packet socket: %s",
202                                         strerror(errno));
203                         ret = -1;
204                         goto out;
205                 }
206
207 #ifdef PACKET_RECV_TYPE
208                 int pktt = 1 << PACKET_MULTICAST;
209                 setsockopt(sock, SOL_PACKET, PACKET_RECV_TYPE, &pktt, sizeof(pktt));
210 #endif
211
212                 if (setsockopt(sock, SOL_SOCKET, SO_ATTACH_FILTER,
213                                 &bpf_prog, sizeof(bpf_prog))) {
214                         syslog(LOG_ERR, "Failed to set BPF: %s", strerror(errno));
215                         ret = -1;
216                         goto out;
217                 }
218
219                 struct sockaddr_ll ll = {
220                         .sll_family = AF_PACKET,
221                         .sll_ifindex = iface->ifindex,
222                         .sll_protocol = htons(ETH_P_IPV6),
223                         .sll_hatype = 0,
224                         .sll_pkttype = 0,
225                         .sll_halen = 0,
226                         .sll_addr = {0},
227                 };
228                 bind(sock, (struct sockaddr*)&ll, sizeof(ll));
229
230                 struct packet_mreq mreq = {iface->ifindex, PACKET_MR_ALLMULTI, ETH_ALEN, {0}};
231                 setsockopt(sock, SOL_PACKET, PACKET_ADD_MEMBERSHIP, &mreq, sizeof(mreq));
232
233                 iface->ndp_event.uloop.fd = sock;
234                 iface->ndp_event.handle_dgram = handle_solicit;
235                 odhcpd_register(&iface->ndp_event);
236
237                 // If we already were enabled dump is unnecessary, if not do dump
238                 if (!dump_neigh)
239                         dump_neigh_table(false);
240                 else
241                         dump_neigh = false;
242         }
243
244         if (dump_neigh)
245                 dump_neigh_table(true);
246
247 out:
248         if (procfd >= 0)
249                 close(procfd);
250
251         return ret;
252 }
253
254
255 // Send an ICMP-ECHO. This is less for actually pinging but for the
256 // neighbor cache to be kept up-to-date.
257 static void ping6(struct in6_addr *addr,
258                 const struct interface *iface)
259 {
260         struct sockaddr_in6 dest = { .sin6_family = AF_INET6, .sin6_addr = *addr, .sin6_scope_id = iface->ifindex, };
261         struct icmp6_hdr echo = { .icmp6_type = ICMP6_ECHO_REQUEST };
262         struct iovec iov = { .iov_base = &echo, .iov_len = sizeof(echo) };
263         char ipbuf[INET6_ADDRSTRLEN];
264
265         inet_ntop(AF_INET6, addr, ipbuf, sizeof(ipbuf));
266         syslog(LOG_NOTICE, "Pinging for %s%%%s", ipbuf, iface->ifname);
267
268         odhcpd_setup_route(addr, 128, iface, NULL, 128, true);
269         odhcpd_send(ping_socket, &dest, &iov, 1, iface);
270         odhcpd_setup_route(addr, 128, iface, NULL, 128, false);
271 }
272
273 // Handle solicitations
274 static void handle_solicit(void *addr, void *data, size_t len,
275                 struct interface *iface, _unused void *dest)
276 {
277         struct ip6_hdr *ip6 = data;
278         struct nd_neighbor_solicit *req = (struct nd_neighbor_solicit*)&ip6[1];
279         struct sockaddr_ll *ll = addr;
280         char ipbuf[INET6_ADDRSTRLEN];
281         uint8_t mac[6];
282
283         // Solicitation is for duplicate address detection
284         bool ns_is_dad = IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src);
285
286         // Don't process solicit messages on non relay interfaces
287         // Don't forward any non-DAD solicitation for external ifaces
288         // TODO: check if we should even forward DADs for them
289         if (iface->ndp != MODE_RELAY || (iface->external && !ns_is_dad))
290                 return;
291
292         if (len < sizeof(*ip6) + sizeof(*req))
293                 return; // Invalid reqicitation
294
295         if (IN6_IS_ADDR_LINKLOCAL(&req->nd_ns_target) ||
296                         IN6_IS_ADDR_LOOPBACK(&req->nd_ns_target) ||
297                         IN6_IS_ADDR_MULTICAST(&req->nd_ns_target))
298                 return; // Invalid target
299
300         inet_ntop(AF_INET6, &req->nd_ns_target, ipbuf, sizeof(ipbuf));
301         syslog(LOG_DEBUG, "Got a NS for %s%%%s", ipbuf, iface->ifname);
302
303         odhcpd_get_mac(iface, mac);
304         if (!memcmp(ll->sll_addr, mac, sizeof(mac)))
305                 return; // Looped back
306
307         struct interface *c;
308         list_for_each_entry(c, &interfaces, head)
309                 if (iface != c && c->ndp == MODE_RELAY &&
310                                 (ns_is_dad || !c->external))
311                         ping6(&req->nd_ns_target, c);
312 }
313
314 // Use rtnetlink to modify kernel routes
315 static void setup_route(struct in6_addr *addr, struct interface *iface, bool add)
316 {
317         char ipbuf[INET6_ADDRSTRLEN];
318
319         inet_ntop(AF_INET6, addr, ipbuf, sizeof(ipbuf));
320         syslog(LOG_NOTICE, "%s about %s%%%s",
321                         (add) ? "Learned" : "Forgot", ipbuf, iface->ifname);
322
323         if (iface->learn_routes)
324                 odhcpd_setup_route(addr, 128, iface, NULL, 1024, add);
325 }
326
327 // Check address update
328 static void check_addr_updates(struct interface *iface)
329 {
330         struct odhcpd_ipaddr *addr = NULL;
331         ssize_t len = odhcpd_get_interface_addresses(iface->ifindex, false, &addr);
332
333         if (len < 0)
334                 return;
335
336         bool change = len != (ssize_t)iface->addr4_len;
337         for (ssize_t i = 0; !change && i < len; ++i)
338                 if (addr[i].addr.in.s_addr != iface->addr4[i].addr.in.s_addr)
339                         change = true;
340
341         free(iface->addr4);
342         iface->addr4 = addr;
343         iface->addr4_len = len;
344
345         if (change)
346                 dhcpv4_addr_update(iface);
347 }
348
349 // Check v6 address update
350 static void check_addr6_updates(struct interface *iface)
351 {
352         struct odhcpd_ipaddr *addr = NULL;
353         ssize_t len = odhcpd_get_interface_addresses(iface->ifindex, true, &addr);
354
355         if (len < 0)
356                 return;
357
358         bool change = len != (ssize_t)iface->ia_addr_len;
359         for (ssize_t i = 0; !change && i < len; ++i)
360                 if (!IN6_ARE_ADDR_EQUAL(&addr[i].addr.in6, &iface->ia_addr[i].addr.in6) ||
361                                 (addr[i].preferred > 0) != (iface->ia_addr[i].preferred > 0) ||
362                                 addr[i].valid < iface->ia_addr[i].valid ||
363                                 addr[i].preferred < iface->ia_addr[i].preferred)
364                         change = true;
365
366         if (change)
367                 dhcpv6_ia_preupdate(iface);
368
369         free(iface->ia_addr);
370         iface->ia_addr = addr;
371         iface->ia_addr_len = len;
372
373         if (change) {
374                 dhcpv6_ia_postupdate(iface);
375                 syslog(LOG_INFO, "Raising SIGUSR1 due to address change on %s", iface->ifname);
376                 raise(SIGUSR1);
377         }
378 }
379
380 static void setup_addr_for_relaying(struct in6_addr *addr, struct interface *iface, bool add)
381 {
382         struct interface *c;
383         char ipbuf[INET6_ADDRSTRLEN];
384
385         inet_ntop(AF_INET6, addr, ipbuf, sizeof(ipbuf));
386
387         list_for_each_entry(c, &interfaces, head) {
388                 if (iface == c || (c->ndp != MODE_RELAY && !add))
389                         continue;
390
391                 bool neigh_add = (c->ndp == MODE_RELAY ? add : false);
392
393                 if (odhcpd_setup_proxy_neigh(addr, c, neigh_add))
394                         syslog(LOG_DEBUG, "Failed to %s proxy neighbour entry %s%%%s",
395                                 neigh_add ? "add" : "delete", ipbuf, c->ifname);
396                 else
397                         syslog(LOG_DEBUG, "%s proxy neighbour entry %s%%%s",
398                                 neigh_add ? "Added" : "Deleted", ipbuf, c->ifname);
399         }
400 }
401
402 static void handle_rtnl_event(struct odhcpd_event *e)
403 {
404         struct event_socket *ev_sock = container_of(e, struct event_socket, ev);
405
406         nl_recvmsgs_default(ev_sock->sock);
407 }
408
409
410 // Handler for neighbor cache entries from the kernel. This is our source
411 // to learn and unlearn hosts on interfaces.
412 static int cb_rtnl_valid(struct nl_msg *msg, _unused void *arg)
413 {
414         struct nlmsghdr *hdr = nlmsg_hdr(msg);
415         struct in6_addr *addr6 = NULL;
416         struct interface *iface = NULL;
417         bool add = false;
418         char ipbuf[INET6_ADDRSTRLEN];
419
420         switch (hdr->nlmsg_type) {
421         case RTM_NEWLINK: {
422                 struct ifinfomsg *ifi = nlmsg_data(hdr);
423                 struct nlattr *nla[__IFLA_MAX];
424
425                 if (!nlmsg_valid_hdr(hdr, sizeof(*ifi)) ||
426                                 ifi->ifi_family != AF_UNSPEC)
427                         return NL_SKIP;
428
429                 nlmsg_parse(hdr, sizeof(struct ifinfomsg), nla, __IFLA_MAX - 1, NULL);
430                 if (!nla[IFLA_IFNAME])
431                         return NL_SKIP;
432
433                 struct interface *iface = odhcpd_get_interface_by_name(nla_data(nla[IFLA_IFNAME]));
434                 if (!iface)
435                         return NL_SKIP;
436
437                 if (iface->ifindex != ifi->ifi_index) {
438                         iface->ifindex = ifi->ifi_index;
439                         check_addr_updates(iface);
440                 }
441                 break;
442         }
443
444         case RTM_NEWROUTE:
445         case RTM_DELROUTE: {
446                 struct rtmsg *rtm = nlmsg_data(hdr);
447
448                 if (!nlmsg_valid_hdr(hdr, sizeof(*rtm)) ||
449                                 rtm->rtm_family != AF_INET6)
450                         return NL_SKIP;
451
452                 if (rtm->rtm_dst_len == 0) {
453                         syslog(LOG_INFO, "Raising SIGUSR1 due to default route change");
454                         raise(SIGUSR1);
455                 }
456                 break;
457         }
458
459         case RTM_NEWADDR:
460                 add = true;
461                 /* fall through */
462         case RTM_DELADDR: {
463                 struct ifaddrmsg *ifa = nlmsg_data(hdr);
464                 struct nlattr *nla[__IFA_MAX];
465
466                 if (!nlmsg_valid_hdr(hdr, sizeof(*ifa)) ||
467                                 (ifa->ifa_family != AF_INET6 &&
468                                  ifa->ifa_family != AF_INET))
469                         return NL_SKIP;
470
471                 iface = odhcpd_get_interface_by_index(ifa->ifa_index);
472                 if (!iface)
473                         return NL_SKIP;
474
475                 nlmsg_parse(hdr, sizeof(*ifa), nla, __IFA_MAX - 1, NULL);
476
477                 if (ifa->ifa_family == AF_INET6) {
478                         if (!nla[IFA_ADDRESS])
479                                 return NL_SKIP;
480
481                         addr6 = nla_data(nla[IFA_ADDRESS]);
482                         if (!addr6 || IN6_IS_ADDR_LINKLOCAL(addr6) ||
483                                         IN6_IS_ADDR_MULTICAST(addr6))
484                                 return NL_SKIP;
485
486                         inet_ntop(AF_INET6, addr6, ipbuf, sizeof(ipbuf));
487                         syslog(LOG_DEBUG, "Netlink %s %s%%%s", add ? "newaddr" : "deladdr",
488                                 ipbuf, iface->ifname);
489
490                         check_addr6_updates(iface);
491
492                         if (iface->ndp != MODE_RELAY)
493                                 break;
494
495                         /* handle the relay logic below */
496                         setup_addr_for_relaying(addr6, iface, add);
497
498                         if (!add)
499                                 dump_neigh_table(false);
500                 } else {
501                         if (!nla[IFA_LOCAL])
502                                 return NL_SKIP;
503
504                         struct in_addr *addr = nla_data(nla[IFA_ADDRESS]);
505
506                         inet_ntop(AF_INET, addr, ipbuf, sizeof(ipbuf));
507                         syslog(LOG_DEBUG, "Netlink %s %s%%%s", add ? "newaddr" : "deladdr",
508                                 ipbuf, iface->ifname);
509
510                         check_addr_updates(iface);
511                 }
512                 break;
513         }
514
515         case RTM_NEWNEIGH:
516                 add = true;
517                 /* fall through */
518         case RTM_DELNEIGH: {
519                 struct ndmsg *ndm = nlmsg_data(hdr);
520                 struct nlattr *nla[__NDA_MAX];
521
522                 if (!nlmsg_valid_hdr(hdr, sizeof(*ndm)) ||
523                                 ndm->ndm_family != AF_INET6)
524                         return NL_SKIP;
525
526                 iface = odhcpd_get_interface_by_index(ndm->ndm_ifindex);
527                 if (!iface || iface->ndp != MODE_RELAY)
528                         return (iface ? NL_OK : NL_SKIP);
529
530                 nlmsg_parse(hdr, sizeof(*ndm), nla, __NDA_MAX - 1, NULL);
531                 if (!nla[NDA_DST])
532                         return NL_SKIP;
533
534                 addr6 = nla_data(nla[NDA_DST]);
535                 if (!addr6 || IN6_IS_ADDR_LINKLOCAL(addr6) ||
536                                 IN6_IS_ADDR_MULTICAST(addr6))
537                         return NL_SKIP;
538
539                 inet_ntop(AF_INET6, addr6, ipbuf, sizeof(ipbuf));
540                 syslog(LOG_DEBUG, "Netlink %s %s%%%s", true ? "newneigh" : "delneigh",
541                         ipbuf, iface->ifname);
542
543                 if (ndm->ndm_flags & NTF_PROXY) {
544                         /* Dump and flush proxy entries */
545                         if (hdr->nlmsg_type == RTM_NEWNEIGH) {
546                                 odhcpd_setup_proxy_neigh(addr6, iface, false);
547                                 setup_route(addr6, iface, false);
548                                 dump_neigh_table(false);
549                         }
550
551                         return NL_OK;
552                 }
553
554                 if (add && !(ndm->ndm_state &
555                                 (NUD_REACHABLE | NUD_STALE | NUD_DELAY | NUD_PROBE |
556                                  NUD_PERMANENT | NUD_NOARP)))
557                         return NL_OK;
558
559                 setup_addr_for_relaying(addr6, iface, add);
560                 setup_route(addr6, iface, add);
561
562                 if (!add)
563                         dump_neigh_table(false);
564                 break;
565         }
566
567         default:
568                 return NL_SKIP;
569         }
570
571         return NL_OK;
572 }
573
574 static void catch_rtnl_err(struct odhcpd_event *e, int error)
575 {
576         struct event_socket *ev_sock = container_of(e, struct event_socket, ev);
577
578         if (error != ENOBUFS)
579                 goto err;
580
581         /* Double netlink event buffer size */
582         ev_sock->sock_bufsize *= 2;
583
584         if (nl_socket_set_buffer_size(ev_sock->sock, ev_sock->sock_bufsize, 0))
585                 goto err;
586
587         dump_addr_table(true);
588         return;
589
590 err:
591         odhcpd_deregister(e);
592 }