summaryrefslogtreecommitdiff
path: root/system-linux.c
Commit message (Collapse)AuthorAgeFilesLines
* netifd: Explicitly zero initialize variablesHauke Mehrtens2023-02-191-1/+1
| | | | | | | The -pedantic option was complaining about the old initialization and prefers if it is explicitly initialized to zero. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* netifd: Fix multiple -Wsign-compare warningsHauke Mehrtens2023-02-191-9/+12
| | | | | | | | | | | | | | | | | | This fixes warnings like this: warning: comparison of integer expressions of different signedness: 'int' and 'long unsigned int' [-Wsign-compare] Mostly this was an int compared to a size_t returned by ARRAY_SIZE(). The easiest fix is to count on the size_t type. The ifindex is sometimes an unsigned int and sometimes a signed int in the kernel interfaces. I think it normally fits into an unsigned 16 bit value, so this should be fine. Do the one comparison where the compiler complains as a long. Casting the result of sizeof() to int should be safe. These values are never out of range of int. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* system: move netdev types to system-linux.c where they are usedFelix Fietkau2022-12-291-0/+69
| | | | | | Fixes compile error on non-linux systems (used for testing) Signed-off-by: Felix Fietkau <nbd@nbd.name>
* wireless: add support for disabling multicast-to-unicast per virtual interfaceFelix Fietkau2022-12-191-2/+4
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* treewide: correctly apply IFNAMSIZ limitJo-Philipp Wich2022-11-171-1/+1
| | | | | | | | | | | | | | | | The `IFNAMSIZ` macro defines the required buffer size to hold a Linux interface name including the terminating zero byte while netifd currently uses an `IFNAMSIZ + 1` limit for interface name buffers. This causes netifd to use overlong names (16 instead of 15 bytes) in netlink communication with the kernel, leading to netlink failure replies due to policy violations. Fix this issue by applying the correct length, that is `IFNAMSIZ` directly, to the corresponding buffers. Ref: https://github.com/openwrt/openwrt/issues/11259 Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* system-linux: expose hw-tc-offload ethtool feature in device status dumpJo-Philipp Wich2022-02-041-0/+116
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* system-linux: add wrapper function for creating link config messagesFelix Fietkau2022-02-011-34/+32
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* system-linux: delete bridge devices using netlinkFelix Fietkau2022-02-011-19/+19
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* system-linux: create bridge devices using netlinkFelix Fietkau2022-02-011-157/+63
| | | | | | | The legacy ioctl + sysfs configuration is deprecated, and the netlink code is smaller and easier to read Signed-off-by: Felix Fietkau <nbd@nbd.name>
* iprule: add support for uidrangeMatthew Hagan2022-01-221-0/+9
| | | | | | | | Allow for per-user routing policies via the uidrange iprule option. Option allows for a single UID or range of UIDs. Signed-off-by: Matthew Hagan <mnhagan88@gmail.com> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* netifd: add devtype to ubus callFlorian Eckert2022-01-121-0/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | Every network device has a type but there is no standard interface here. The type can be determined either from the file '/sys/class/net/<device>/uevent' or, if no information is found there, from the file '/sys/class/net/<device>/type'. This new function first checks whether there is a DEVTYPE=<type> string in the 'uevent' file and uses it. If it does not find this information, the 'type' is used as a fallback and mapped the number to a character sequence. This new 'devtype' information can be found in the network.device ubus call. Command: ubus call network.device status Output: { "eth0": { "devtype": "ethernet", Signed-off-by: Florian Eckert <fe@dev.tdt.de> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> [commit rewording]
* system-linux: fix deletion of ip tunnels (FS#4058)Hans Dedecker2021-10-301-42/+17
| | | | | | | | The deletion of IP tunnels via the ioctl interface is broken; instead of fixing the ioctl interface switch to the netlink based interface to delete IP tunnel devices as this simplifies and unifies the code Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* device: add support for configuring bonding devicesFelix Fietkau2021-09-031-0/+97
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Supported options: - ports: member devices - policy: bonding policy supported values: - balance-rr - active-backup - balance-xor - broadcast - 802.3ad - balance-tlb - balance-alb - xmit_hash_policy: slave selection tx hash policy supported values: - layer2 - layer2+3 - layer3+4 - encap2+3 - encap3+4 - all_ports_active: allow receiving on inactive ports - min_links: minimum number of active links - ad_actor_system: LACPDU exchange MAC address - ad_actor_sys_prio: LACPDU priority value - ad_select: 802.3ad aggregation logic supported values: - stable - bandwidth - count - lacp_rate: 802.3ad LACPDU packet rate supported values: - slow (every 30 seconds) - fast (every second) - packets_per_port: number of packets before switching ports (balance-rr mode). - lp_interval: number of seconds between sent learning packets - dynamic_lb: distribute traffic according to port load - resend_igmp: number if IGMP membership updates after failover event - num_peer_notif: number of tx unsolicited ARP/NA after failover event - primary: name of the primary port - primary_reselect: primary port reselection policy supported values: - always - better - failure - failover_mac: MAC address selection policy supported values: - none - active - follow - monitor_mode: select ARP or MII link monitor: supported values: - arp - mii - monitor_interval: link monitor update interval (msec) - arp_target: ARP monitor target IP address (list) - arp_all_targets: all targets must be reachable to consider the link valid - arp_validate: ARP validation policy supported values: - none - active - backup - all - filter - filter_active - filter_backup - use_carrier: use carrier status instead of MII ioctl result - updelay: delay before enabling port after MII link up event (msec) - downdelay: delay before disabling port after MII link down event (msec) Signed-off-by: Felix Fietkau <nbd@nbd.name>
* wireless: improve reliability of proxyarp supportFelix Fietkau2021-09-011-2/+9
| | | | | | | | instead of relying on hostapd to manipulate bridge attributes (which can race against netifd adding/removing of member ports), set the proxyarp related attributes in netifd directly when bringing up the member port Signed-off-by: Felix Fietkau <nbd@nbd.name>
* system-linux: remove copy&paste from /proc and /sys path namesFelix Fietkau2021-09-011-140/+149
| | | | | | | Preparation for making the /proc and /sys path configurable for configuring containers Signed-off-by: Felix Fietkau <nbd@nbd.name>
* wireless: always enable bpdu filter for AP interfaces and VLANsFelix Fietkau2021-08-271-0/+8
| | | | | | | | | | Regular AP/VLAN interfaces using 3-address modes should transmit any STP packets, since devices behind them can not be part of any working bridge topology. Enable a feature that drops any incoming or outgoing STP packets. This does not apply to WDS AP VLAN or client mode interfaces, since they could act as a proper bridge link Signed-off-by: Felix Fietkau <nbd@nbd.name>
* bridge: tune default stp parametersFelix Fietkau2021-08-241-10/+6
| | | | | | | | | | The default forwarding delay 2 is broken and makes STP non-functional by default. The kernel's default of 15 is rather long. This commit changes makes the timer settings more aggressive than the kernel's default while still being consistent and allowing proper convergence for a network diameter up to 4 Signed-off-by: Felix Fietkau <nbd@nbd.name>
* bridge: add support for an external STP daemonFelix Fietkau2021-08-241-3/+5
| | | | | | | | netifd notifies the stp daemon through the network.device object and sends STP related configuration parameters. The daemon can also trigger a STP restart in order to close the race on init Signed-off-by: Felix Fietkau <nbd@nbd.name>
* device: add support for configuring device link speed/duplexFelix Fietkau2021-08-021-0/+52
| | | | | | | The 'speed' option can be set to the speed in Mbps The 'duplex' option can be 1 or 0 for full or half duplex Signed-off-by: Felix Fietkau <nbd@nbd.name>
* device: extend device settings flags to 64 bitFelix Fietkau2021-07-291-1/+1
| | | | | | The previous 32 bit limit is almost used up Signed-off-by: Felix Fietkau <nbd@nbd.name>
* bridge: check bridge port vlan membership on link-up eventsFelix Fietkau2021-07-231-0/+191
| | | | | | | | When changing to a dfs channel, hostapd can bring down wlan interfaces and reset their bridge membership. If that happens, the port loses its vlan membership settings and needs to be reconfigured by netifd. Signed-off-by: Felix Fietkau <nbd@nbd.name>
* device: move hotplug handling logic from system-linux.c to device.cFelix Fietkau2021-06-191-34/+6
| | | | | | Preparation for dealing with wifi per-station devices Signed-off-by: Felix Fietkau <nbd@nbd.name>
* system-linux: add device options used by wpadDaniel Golle2021-03-311-0/+91
| | | | | | | | | | | | | Add device options used by wpad in preparation of running hostapd and wpa_supplicant non-root (and hence those options will need to be taken care of by netifd as sysctl is root-only): * drop_v4_unicast_in_l2_multicast * drop_v6_unicast_in_l2_multicast * drop_gratuitous_arp * drop_unsolicited_na * arp_accept Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* system-linux: reorder sysctl functionsDaniel Golle2021-03-311-5/+5
| | | | | | | Move system_set_sendredirects up to the other non-bridge-related sysctl functions. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* netifd: add segment routing supportNick Hainke2020-12-131-0/+25
| | | | | | | | | | | | | | | | | | seg6_enabled - Bool Accept or drop SR-enabled IPv6 packets on this interface. More Information: https://www.kernel.org/doc/html/latest/networking/seg6-sysctl.html Now you can set as interface option option ip6segmentrouting '1' It is not enough to turn on "seg6_enabled" on the interface. Further, we have to enable "/all/seg6_enabled". This means that a working config is "interface + all". Signed-off-by: Nick Hainke <vincent@systemli.org> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> [style fixes]
* config: parse default mac address from board.jsonFelix Fietkau2020-11-301-2/+2
| | | | | | | | | | | | | Example: { "network-device": { "eth0": { "macaddr": "bc:a5:11:16:76:d7" } } } Signed-off-by: Felix Fietkau <nbd@nbd.name>
* system-linux: move device settings handling to device.cFelix Fietkau2020-11-301-8/+1
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* system-linux: simplify mask check in system_if_apply_settingsFelix Fietkau2020-11-301-16/+18
| | | | | | Mask flags against apply_mask only once instead of once per field Signed-off-by: Felix Fietkau <nbd@nbd.name>
* system-linux: add retry for adding member devices to a bridgeFelix Fietkau2020-11-231-2/+11
| | | | | | | | | | When netifd tries to add bridge members brought up by hostapd asynchronously (e.g. after an autochannel run), the first try often fails with EBUSY or EAGAIN, since it's racing against hostapd's own setup. Add retry logic, which includes checking if the device was added to the bridge in the meantime to deal with this issue Signed-off-by: Felix Fietkau <nbd@nbd.name>
* system-linux: implement full device present state management for ↵Felix Fietkau2020-11-231-4/+1
| | | | | | | | | | force-external devices We need to detect when devices are present, because they can be created asynchronously by hostapd after they have already been added by the wifi setup script Signed-off-by: Felix Fietkau <nbd@nbd.name>
* system-linux: only overwrite dev->present state on check_state for simple ↵Felix Fietkau2020-11-131-2/+4
| | | | | | | | | | | devices After settting config_pending for vlan devices, a check_state call from device_init_pending was leading to the vlan device present state being overwritten because the linux device didn't exist yet, even though the vlan code had already indicated its present state based on the lower dev. Signed-off-by: Felix Fietkau <nbd@nbd.name>
* system-linux: initialize ifreq struct before using itAlin Nastac2020-10-101-0/+2
| | | | Signed-off-by: Alin Nastac <alin.nastac@gmail.com>
* netifd: vxlan: add aging and maxaddress optionsJohannes Kimmel2020-09-121-0/+10
| | | | | | | For both options the values can just be passed to the kernel. All unsigned values are accepted, thus no range checking required. Signed-off-by: Johannes Kimmel <fff@bareminimum.eu>
* netifd: vxlan: add most missing boolean optionsJohannes Kimmel2020-09-121-3/+13
| | | | | | | | | | | | | | | | | | | | | | adds the folloing missing options: - learning - rsc - proxy - l2miss - l3miss - gbp See ip-link(3) for their meaning. still missing: - external - gpe I'm not sure how to handle them at the moment. It's unclear to me what IFLA_VXLAN_* value corresponds to the 'external' option and according to the manpage, gpe depends on it. Signed-off-by: Johannes Kimmel <fff@bareminimum.eu>
* netifd: vxlan: refactor mapping of boolean attrsJohannes Kimmel2020-09-121-10/+14
| | | | | | | | Add a small function to handle boolean options and make use of it to handle: - rxcsum - txcsum Signed-off-by: Johannes Kimmel <fff@bareminimum.eu>
* netifd: vxlan: handle srcport rangeJohannes Kimmel2020-09-121-0/+26
| | | | | | | | | | | | | | | | | | | | | | | | This adds adds the ability to set the source port range for vxlan interfaces. By default vxlans will use a random port within the ephermal range as source ports for packets. This is done to aid scaleability within a datacenter. But with these defaults it's impossible to punch through NATs or traverese most stateful firewalls easily. One solution is to fix the srcport to the same as dstport. If only srcportmin is specified, then srcportmax is set in a way that outgoing packets will only use srcportmin. If a range is to be specified, srcportmin and srcportmax have to be specified. srcportmax is exclusive. If only srcportmax is specified, the value is ignored and defaults are used. Signed-off-by: Johannes Kimmel <fff@bareminimum.eu>
* bridge: add support for adding vlans to a bridgeJohn Crispin2020-07-181-0/+47
| | | | | | | Add a rtnl helper for adding vlans to a bridge interface. Signed-off-by: John Crispin <john@phrozen.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
* bridge: add support for turning on vlan_filteringJohn Crispin2020-07-181-0/+6
| | | | | | | | If we want a bridge to be vlan aware we need to be able to turn on filtering. Signed-off-by: John Crispin <john@phrozen.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
* system-linux: improve handling of device renameKristian Evensen2020-06-061-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After an interface has been renamed on a "fast" device (for example x86_64), the interface is sometimes not handled correctly by netifd. Looking in the logs, I see the following messages when renaming fails: Wed Mar 11 08:52:44 2020 kern.info kernel: [68383.522038] igb 0000:03:00.0 nlw_1: renamed from eth2 Wed Mar 11 08:52:44 2020 daemon.err netifd[2739]: __device_add_user(710): Add user for device 'nlw_1', refcount=2 Wed Mar 11 08:52:44 2020 daemon.err netifd[2739]: device_claim(413): Claim Network device nlw_1, new active count: 2 Wed Mar 11 08:52:44 2020 daemon.err netifd[2739]: device_claim(432): claim Network device nlw_1 failed: -1 Instrumenting netifd further reveals that there is a race between the hotplug "@move" event and ioctl(SIOCGIFINDEX). When the above error happens, the ioctl-call fails with ENODEV. Looking closer at the kernel code, it seems the hotplug-event is triggered before the renaming is completed. The easiest way to trigger the race, is if an interface name with the old name is not handled by netifd and an interface with the new name is. If only the old name is handled, or both names, I was not able to provoke the race. When the renaming is complete, a NEWLINK-message is generated. This patch modifies the logic surrounding renaming, so that we wait for the NEWLINK-message before marking an interface as present. The changes made are: * We only handle move-events for interfaces we know, and we return after device has been set as not present. * When we receive a NEWLINK message for an interface managed by netifd, we call device_set_present. device_set_present is guarded by the same checks as the add hotplug-event. After these changes, renaming works properly on both "fast" and "slow" devices. Removing a device is also handled correctly. Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* vlandev: support setting ingress/egress QoS mappingsPau Espin Pedrol2020-05-211-1/+24
| | | | | | | | | | | | | | | | | It allows setting mappings for instance this way: """ config device option name 'vlan41' option type '8021q' option vid '41' option ifname 'eth1' list ingress_qos_mapping '1:2' list ingress_qos_mapping '2:5' list egress_qos_mapping '0:3' """ Signed-off-by: Pau Espin Pedrol <pespin.shar@gmail.com> Tested-by: Pedro <pedrowrt@cas.cat>
* interface, system: clean up netns functionalityDaniel Golle2020-04-141-9/+7
| | | | | | | | | Use struct device pointer as parameter instead of bare ifname allows for some simplication and again removing system_ifname_resolve() function introduced in commit d93126d. Fixes: d93126d ("interface: allow renaming interface when moving to jail netns") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* interface: allow renaming interface when moving to jail netnsDaniel Golle2020-04-141-5/+12
| | | | | | | | | | Introduce jail_ifname option to define the name of a Linux network interface when moved into a jail's network namespace. This is useful for containers which expect the network interface to have a specific name (eg. 'host0' in case of systemd). While at it, clean-up and fix bugs in jail interface up/down routines. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* system-linux: fix PATH_MAX undeclared compilation errorAlin Nastac2020-03-271-0/+1
| | | | | | Issue was introduced in commit 1321c1bd8fe921986c4eb39c3783ddd827b79543. Signed-off-by: Alin Nastac <alin.nastac@gmail.com>
* system-linux: fix compilation with musl 1.2.0Rosen Penev2020-03-261-1/+1
| | | | | | Switched to the plain function instead of the now gone syscall. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* add basic support for jail network namespacesDaniel Golle2020-01-181-0/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Prepare netifd for handling procd service jails having their own network namespace. Intefaces having the jail attribute will only be brought inside the jail's network namespace by procd calling the newly introduced ubus method 'netns_updown'. Currently proto 'static' is supported and configuration changes are not yet being handled (ie. you'll have to restart the jailed service for changes to take effect). Example /etc/config/network snippet: config device 'veth0' option type 'veth' option name 'vhost0' option peer_name 'virt0' config interface 'virt' option type 'bridge' list ifname 'vhost0' option proto 'static' option ipaddr '10.0.0.1' option netmask '255.255.255.0' config interface 'virt0' option ifname 'virt0' option proto 'static' option ipaddr '10.0.0.2' option netmask '255.255.255.0' option gateway '10.0.0.1' option dns '10.0.0.1' option jail 'transmission' Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* system-linux: fix resource leakHans Dedecker2019-08-051-4/+5
| | | | | | | Fix cb leak in case invalid type is specified in system_if_clear_entries Detected by Coverity in CID1431183 Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* system-linux: Coverity fixesHans Dedecker2019-07-221-8/+26
| | | | | | Fixes CID 1220430, 1432226, 1432807 and 1433508 Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* netifd: fix xfrm interface deletion and standardize netlink callAndré Valentin2019-06-141-2/+3
| | | | | | | -xfrm interfaces were deleted before -use standard parameters for xfrm interface created Signed-off-by: André Valentin <avalentin@marcant.net>
* system-linux: remove superfluous dev checkHans Dedecker2019-06-131-3/+0
| | | | | | | | | No need to check if dev is NULL as device is always set when system_neigh is called Fixes issue reported by Coverity in CID 1445818 Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* netifd: add xfrm tunnel interface supportAndré Valentin2019-06-081-0/+61
| | | | | | | This adds support for xfrm interfaces. These interfaces can be used since linux 4.19 for IPsec traffic, like VTI interface. XFRM interfaces are less complicated compared to VTI because they need no IP tunnel endpoints.
View Lorry Controller Status