|
|
| version 1.1.1.3, 2016/11/01 09:56:12 | version 1.1.1.4, 2019/10/22 13:49:55 |
|---|---|
| Line 141 | Line 141 |
| static int IfaceAllocACL (struct acl_pool ***ap, int start, char * ifname, int number); | static int IfaceAllocACL (struct acl_pool ***ap, int start, char * ifname, int number); |
| static int IfaceFindACL (struct acl_pool *ap, char * ifname, int number); | static int IfaceFindACL (struct acl_pool *ap, char * ifname, int number); |
| static char * IfaceParseACL (char * src, IfaceState iface); | static char * IfaceParseACL (char * src, IfaceState iface); |
| static char * IfaceFixAclForDelete(char *r, char *buf, size_t len); | |
| #endif | #endif |
| static int IfaceSetName(Bund b, const char * ifname); | static int IfaceSetName(Bund b, const char * ifname); |
| Line 161 | Line 162 |
| IfaceSetCommand, NULL, 2, (void *) SET_ADDRS }, | IfaceSetCommand, NULL, 2, (void *) SET_ADDRS }, |
| { "route {dest}[/{width}]", "Add IP route", | { "route {dest}[/{width}]", "Add IP route", |
| IfaceSetCommand, NULL, 2, (void *) SET_ROUTE }, | IfaceSetCommand, NULL, 2, (void *) SET_ROUTE }, |
| { "mtu {size}", "Set max allowed interface MTU", | { "mtu {size} [override]", "Set max allowed or override interface MTU", |
| IfaceSetCommand, NULL, 2, (void *) SET_MTU }, | IfaceSetCommand, NULL, 2, (void *) SET_MTU }, |
| { "name [{name}]", "Set interface name", | { "name [{name}]", "Set interface name", |
| IfaceSetCommand, NULL, 2, (void *) SET_NAME }, | IfaceSetCommand, NULL, 2, (void *) SET_NAME }, |
| Line 288 IfaceInit(Bund b) | Line 289 IfaceInit(Bund b) |
| /* Default configuration */ | /* Default configuration */ |
| iface->mtu = NG_IFACE_MTU_DEFAULT; | iface->mtu = NG_IFACE_MTU_DEFAULT; |
| iface->max_mtu = NG_IFACE_MTU_DEFAULT; | iface->max_mtu = NG_IFACE_MTU_DEFAULT; |
| iface->mtu_override = 0; | |
| #ifdef SIOCSIFDESCR | #ifdef SIOCSIFDESCR |
| iface->ifdescr = NULL; | iface->ifdescr = NULL; |
| iface->conf.ifdescr = NULL; | iface->conf.ifdescr = NULL; |
| Line 602 IfaceUp(Bund b, int ready) | Line 604 IfaceUp(Bund b, int ready) |
| while (acls != NULL) { | while (acls != NULL) { |
| /* allow both %aX and `peer_addr` macros */ | /* allow both %aX and `peer_addr` macros */ |
| buf = IfaceParseACL(acls->rule, iface); | buf = IfaceParseACL(acls->rule, iface); |
| strcpy(acls->rule, buf); | acl = Mdup2(MB_IPFW, acls, sizeof(struct acl), sizeof(struct acl) + strlen(buf)); |
| strcpy(acl->rule, buf); | |
| Freee(buf); | Freee(buf); |
| acl = Mdup(MB_IPFW, acls, sizeof(struct acl) + strlen(acls->rule)); | |
| acl->next = iface->tables; | acl->next = iface->tables; |
| iface->tables = acl; | iface->tables = acl; |
| if (strncmp(acls->rule, "peer_addr", 9) == 0) { | if (strncmp(acl->rule, "peer_addr", 9) == 0) { |
| char hisaddr[20]; | char hisaddr[20]; |
| ExecCmd(LG_IFACE2, b->name, "%s table %d add %s", | ExecCmd(LG_IFACE2, b->name, "%s table %d add %s", |
| PATH_IPFW, acls->real_number, | PATH_IPFW, acl->real_number, |
| u_addrtoa(&iface->peer_addr, hisaddr, sizeof(hisaddr))); | u_addrtoa(&iface->peer_addr, hisaddr, sizeof(hisaddr))); |
| } else { | } else { |
| ExecCmd(LG_IFACE2, b->name, "%s table %d add %s", PATH_IPFW, acls->real_number, acls->rule); | ExecCmd(LG_IFACE2, b->name, "%s table %d add %s", PATH_IPFW, acl->real_number, acl->rule); |
| } | } |
| acls = acls->next; | acls = acls->next; |
| }; | }; |
| Line 697 IfaceDown(Bund b) | Line 699 IfaceDown(Bund b) |
| PATH_IPFW, acl->real_number, | PATH_IPFW, acl->real_number, |
| u_addrtoa(&iface->peer_addr, hisaddr, sizeof(hisaddr))); | u_addrtoa(&iface->peer_addr, hisaddr, sizeof(hisaddr))); |
| } else { | } else { |
| char buf[ACL_LEN]; | |
| ExecCmd(LG_IFACE2, b->name, "%s table %d delete %s", | ExecCmd(LG_IFACE2, b->name, "%s table %d delete %s", |
| PATH_IPFW, acl->real_number, acl->rule); | PATH_IPFW, acl->real_number, |
| IfaceFixAclForDelete(acl->rule, buf, sizeof(buf))); | |
| } | } |
| aclnext = acl->next; | aclnext = acl->next; |
| Freee(acl); | Freee(acl); |
| Line 946 IfaceParseACL (char * src, IfaceState iface) | Line 950 IfaceParseACL (char * src, IfaceState iface) |
| Freee(buf1); | Freee(buf1); |
| return(buf); | return(buf); |
| } | } |
| /* | |
| * IfaceFixAclForDelete() | |
| * | |
| * Removes values from ipfw 'table-key value [...]' expression r, if any. | |
| * Returns buf pointer for modified expression or original r pointer | |
| * if no modifications were performed when no values were found or | |
| * buf found too short. | |
| * | |
| * len is size of buf. Strings are zero-terminated. | |
| * r and buf must point to non-overlapping memory areas. | |
| */ | |
| static char* | |
| IfaceFixAclForDelete(char *r, char *buf, size_t len) | |
| { | |
| static const char sep[] = " \t"; | |
| char *limit, *s; | |
| int i, state = 0; | |
| /* | |
| * Possible state values: | |
| * | |
| * -1: skip value (otherwise copy); | |
| * 0: first iteration, do copy; | |
| * 1: not first iteration, do copy. | |
| */ | |
| s = buf; | |
| limit = buf + len; | |
| for (r += strspn(r, sep); /* Skip leading spaces. */ | |
| *r; /* Check for end of string. */ | |
| r += i, r += strspn(r, sep)) /* Advance and skip spaces again. */ | |
| { | |
| i = strcspn(r, sep); /* Find separator or end of string. */ | |
| if (state == 0 && r[i] == '\0') /* No separators in the rule? */ | |
| return r; | |
| if (state < 0) { /* Skip value. */ | |
| state = 1; | |
| continue; | |
| } | |
| if (limit - s < i + 1 + state) /* Check space. */ | |
| return r; | |
| if (state != 0) /* Insert separator. */ | |
| *s++ = ' '; | |
| memcpy(s, r, i); /* Copy IP address from the rule. */ | |
| s += i; | |
| state = -1; | |
| } | |
| *s = '\0'; | |
| return buf; | |
| } | |
| #endif /* USE_IPFW */ | #endif /* USE_IPFW */ |
| /* | /* |
| Line 1549 IfaceSetCommand(Context ctx, int ac, char *av[], void | Line 1607 IfaceSetCommand(Context ctx, int ac, char *av[], void |
| case SET_MTU: | case SET_MTU: |
| { | { |
| int max_mtu; | int max_mtu; |
| int override; | |
| /* Check */ | /* Check */ |
| if (ac != 1) | if (ac < 1 || ac > 2) |
| return(-1); | return(-1); |
| max_mtu = atoi(av[0]); | max_mtu = atoi(av[0]); |
| override = 0; | |
| if (ac == 2 && av[1][0]) { | |
| if (strcmp(av[1], "override") == 0) | |
| override = 1; | |
| else | |
| Error("Invalid keyword %s", av[1]); | |
| } | |
| if (max_mtu < IFACE_MIN_MTU || max_mtu > IFACE_MAX_MTU) | if (max_mtu < IFACE_MIN_MTU || max_mtu > IFACE_MAX_MTU) |
| Error("Invalid interface mtu %d", max_mtu); | if (!override || max_mtu != 0) |
| iface->max_mtu = max_mtu; | Error("Invalid interface mtu %d", max_mtu); |
| if (max_mtu != 0) | |
| iface->max_mtu = max_mtu; | |
| if (override) | |
| iface->mtu_override = max_mtu; | |
| } | } |
| break; | break; |
| Line 1686 IfaceStat(Context ctx, int ac, char *av[], void *arg) | Line 1759 IfaceStat(Context ctx, int ac, char *av[], void *arg) |
| Printf("\tGroup : %s\r\n", iface->conf.ifgroup); | Printf("\tGroup : %s\r\n", iface->conf.ifgroup); |
| #endif | #endif |
| Printf("\tMaximum MTU : %d bytes\r\n", iface->max_mtu); | Printf("\tMaximum MTU : %d bytes\r\n", iface->max_mtu); |
| Printf("\tMTU override : %d bytes\r\n", iface->mtu_override); | |
| Printf("\tIdle timeout : %d seconds\r\n", iface->idle_timeout); | Printf("\tIdle timeout : %d seconds\r\n", iface->idle_timeout); |
| Printf("\tSession timeout : %d seconds\r\n", iface->session_timeout); | Printf("\tSession timeout : %d seconds\r\n", iface->session_timeout); |
| if (!u_rangeempty(&iface->conf.self_addr)) { | if (!u_rangeempty(&iface->conf.self_addr)) { |
| Line 1816 IfaceSetMTU(Bund b, int mtu) | Line 1890 IfaceSetMTU(Bund b, int mtu) |
| return; | return; |
| } | } |
| if ((b->params.mtu > 0) && (mtu > b->params.mtu)) { | if (!iface->mtu_override && (b->params.mtu > 0) && (mtu > b->params.mtu)) { |
| mtu = b->params.mtu; | mtu = b->params.mtu; |
| Log(LG_IFACE2, ("[%s] IFACE: forcing MTU of auth backend: %d bytes", | Log(LG_IFACE2, ("[%s] IFACE: forcing MTU of auth backend: %d bytes", |
| b->name, mtu)); | b->name, mtu)); |
| } | } |
| /* Limit MTU to configured maximum */ | /* Limit MTU to configured maximum/override */ |
| if (mtu > iface->max_mtu) | if (iface->mtu_override) { |
| mtu = iface->mtu_override; | |
| Log(LG_IFACE2, ("[%s] IFACE: forcing MTU override: %d bytes", | |
| b->name, mtu)); | |
| } else if (mtu > iface->max_mtu) | |
| mtu = iface->max_mtu; | mtu = iface->max_mtu; |
| /* Set MTU on interface */ | /* Set MTU on interface */ |
| Line 3003 IfaceSetupMSS(Bund b, uint16_t maxMSS) | Line 3081 IfaceSetupMSS(Bund b, uint16_t maxMSS) |
| /* Send configure message. */ | /* Send configure message. */ |
| memset(&tcpmsscfg, 0, sizeof(tcpmsscfg)); | memset(&tcpmsscfg, 0, sizeof(tcpmsscfg)); |
| tcpmsscfg.maxMSS = maxMSS; | tcpmsscfg.maxMSS = maxMSS; |
| Log(LG_IFACE2, ("[%s] IFACE: Configuring ng_tcpmss %s %u", | |
| b->name, path, (unsigned)tcpmsscfg.maxMSS)); | |
| snprintf(tcpmsscfg.inHook, sizeof(tcpmsscfg.inHook), "in"); | snprintf(tcpmsscfg.inHook, sizeof(tcpmsscfg.inHook), "in"); |
| snprintf(tcpmsscfg.outHook, sizeof(tcpmsscfg.outHook), "out"); | snprintf(tcpmsscfg.outHook, sizeof(tcpmsscfg.outHook), "out"); |