Commit | Line | Data |
---|---|---|
a10e763b | 1 | // SPDX-License-Identifier: GPL-2.0-only |
14c0b97d TG |
2 | /* |
3 | * net/core/fib_rules.c Generic Routing Rules | |
4 | * | |
14c0b97d TG |
5 | * Authors: Thomas Graf <tgraf@suug.ch> |
6 | */ | |
7 | ||
14c0b97d TG |
8 | #include <linux/types.h> |
9 | #include <linux/kernel.h> | |
5a0e3ad6 | 10 | #include <linux/slab.h> |
14c0b97d | 11 | #include <linux/list.h> |
3a9a231d | 12 | #include <linux/module.h> |
e9dc8653 | 13 | #include <net/net_namespace.h> |
881d966b | 14 | #include <net/sock.h> |
14c0b97d | 15 | #include <net/fib_rules.h> |
e7030878 | 16 | #include <net/ip_tunnels.h> |
b9aaec8f | 17 | #include <linux/indirect_call_wrapper.h> |
14c0b97d | 18 | |
923f614c | 19 | #if defined(CONFIG_IPV6) && defined(CONFIG_IPV6_MULTIPLE_TABLES) |
8b66a6fd | 20 | #ifdef CONFIG_IP_MULTIPLE_TABLES |
41d707b7 BV |
21 | #define INDIRECT_CALL_MT(f, f2, f1, ...) \ |
22 | INDIRECT_CALL_INET(f, f2, f1, __VA_ARGS__) | |
23 | #else | |
8b66a6fd BV |
24 | #define INDIRECT_CALL_MT(f, f2, f1, ...) INDIRECT_CALL_1(f, f2, __VA_ARGS__) |
25 | #endif | |
80fbbb16 | 26 | #elif defined(CONFIG_IP_MULTIPLE_TABLES) |
41d707b7 | 27 | #define INDIRECT_CALL_MT(f, f2, f1, ...) INDIRECT_CALL_1(f, f1, __VA_ARGS__) |
8b66a6fd BV |
28 | #else |
29 | #define INDIRECT_CALL_MT(f, f2, f1, ...) f(__VA_ARGS__) | |
41d707b7 BV |
30 | #endif |
31 | ||
622ec2c9 LC |
32 | static const struct fib_kuid_range fib_kuid_range_unset = { |
33 | KUIDT_INIT(0), | |
34 | KUIDT_INIT(~0), | |
35 | }; | |
36 | ||
3c71006d IS |
37 | bool fib_rule_matchall(const struct fib_rule *rule) |
38 | { | |
39 | if (rule->iifindex || rule->oifindex || rule->mark || rule->tun_id || | |
40 | rule->flags) | |
41 | return false; | |
42 | if (rule->suppress_ifgroup != -1 || rule->suppress_prefixlen != -1) | |
43 | return false; | |
44 | if (!uid_eq(rule->uid_range.start, fib_kuid_range_unset.start) || | |
45 | !uid_eq(rule->uid_range.end, fib_kuid_range_unset.end)) | |
46 | return false; | |
bfff4862 RP |
47 | if (fib_rule_port_range_set(&rule->sport_range)) |
48 | return false; | |
49 | if (fib_rule_port_range_set(&rule->dport_range)) | |
50 | return false; | |
3c71006d IS |
51 | return true; |
52 | } | |
53 | EXPORT_SYMBOL_GPL(fib_rule_matchall); | |
54 | ||
2994c638 DL |
55 | int fib_default_rule_add(struct fib_rules_ops *ops, |
56 | u32 pref, u32 table, u32 flags) | |
57 | { | |
58 | struct fib_rule *r; | |
59 | ||
60 | r = kzalloc(ops->rule_size, GFP_KERNEL); | |
61 | if (r == NULL) | |
62 | return -ENOMEM; | |
63 | ||
717d1e99 | 64 | refcount_set(&r->refcnt, 1); |
2994c638 DL |
65 | r->action = FR_ACT_TO_TBL; |
66 | r->pref = pref; | |
67 | r->table = table; | |
68 | r->flags = flags; | |
cac56209 | 69 | r->proto = RTPROT_KERNEL; |
efd7ef1c | 70 | r->fr_net = ops->fro_net; |
622ec2c9 | 71 | r->uid_range = fib_kuid_range_unset; |
2994c638 | 72 | |
73f5698e ST |
73 | r->suppress_prefixlen = -1; |
74 | r->suppress_ifgroup = -1; | |
75 | ||
2994c638 DL |
76 | /* The lock is not required here, the list in unreacheable |
77 | * at the moment this function is called */ | |
78 | list_add_tail(&r->list, &ops->rules_list); | |
79 | return 0; | |
80 | } | |
81 | EXPORT_SYMBOL(fib_default_rule_add); | |
82 | ||
f53de1e9 | 83 | static u32 fib_default_rule_pref(struct fib_rules_ops *ops) |
d8a566be PM |
84 | { |
85 | struct list_head *pos; | |
86 | struct fib_rule *rule; | |
87 | ||
88 | if (!list_empty(&ops->rules_list)) { | |
89 | pos = ops->rules_list.next; | |
90 | if (pos->next != &ops->rules_list) { | |
91 | rule = list_entry(pos->next, struct fib_rule, list); | |
92 | if (rule->pref) | |
93 | return rule->pref - 1; | |
94 | } | |
95 | } | |
96 | ||
97 | return 0; | |
98 | } | |
d8a566be | 99 | |
9e3a5487 | 100 | static void notify_rule_change(int event, struct fib_rule *rule, |
c17084d2 TG |
101 | struct fib_rules_ops *ops, struct nlmsghdr *nlh, |
102 | u32 pid); | |
14c0b97d | 103 | |
5fd30ee7 | 104 | static struct fib_rules_ops *lookup_rules_ops(struct net *net, int family) |
14c0b97d TG |
105 | { |
106 | struct fib_rules_ops *ops; | |
107 | ||
108 | rcu_read_lock(); | |
5fd30ee7 | 109 | list_for_each_entry_rcu(ops, &net->rules_ops, list) { |
14c0b97d TG |
110 | if (ops->family == family) { |
111 | if (!try_module_get(ops->owner)) | |
112 | ops = NULL; | |
113 | rcu_read_unlock(); | |
114 | return ops; | |
115 | } | |
116 | } | |
117 | rcu_read_unlock(); | |
118 | ||
119 | return NULL; | |
120 | } | |
121 | ||
122 | static void rules_ops_put(struct fib_rules_ops *ops) | |
123 | { | |
124 | if (ops) | |
125 | module_put(ops->owner); | |
126 | } | |
127 | ||
73417f61 TG |
128 | static void flush_route_cache(struct fib_rules_ops *ops) |
129 | { | |
130 | if (ops->flush_cache) | |
ae299fc0 | 131 | ops->flush_cache(ops); |
73417f61 TG |
132 | } |
133 | ||
e9c5158a | 134 | static int __fib_rules_register(struct fib_rules_ops *ops) |
14c0b97d TG |
135 | { |
136 | int err = -EEXIST; | |
137 | struct fib_rules_ops *o; | |
9e3a5487 DL |
138 | struct net *net; |
139 | ||
140 | net = ops->fro_net; | |
14c0b97d TG |
141 | |
142 | if (ops->rule_size < sizeof(struct fib_rule)) | |
143 | return -EINVAL; | |
144 | ||
145 | if (ops->match == NULL || ops->configure == NULL || | |
146 | ops->compare == NULL || ops->fill == NULL || | |
147 | ops->action == NULL) | |
148 | return -EINVAL; | |
149 | ||
5fd30ee7 DL |
150 | spin_lock(&net->rules_mod_lock); |
151 | list_for_each_entry(o, &net->rules_ops, list) | |
14c0b97d TG |
152 | if (ops->family == o->family) |
153 | goto errout; | |
154 | ||
5fd30ee7 | 155 | list_add_tail_rcu(&ops->list, &net->rules_ops); |
14c0b97d TG |
156 | err = 0; |
157 | errout: | |
5fd30ee7 | 158 | spin_unlock(&net->rules_mod_lock); |
14c0b97d TG |
159 | |
160 | return err; | |
161 | } | |
162 | ||
e9c5158a | 163 | struct fib_rules_ops * |
3d0c9c4e | 164 | fib_rules_register(const struct fib_rules_ops *tmpl, struct net *net) |
e9c5158a EB |
165 | { |
166 | struct fib_rules_ops *ops; | |
167 | int err; | |
168 | ||
2fb3573d | 169 | ops = kmemdup(tmpl, sizeof(*ops), GFP_KERNEL); |
e9c5158a EB |
170 | if (ops == NULL) |
171 | return ERR_PTR(-ENOMEM); | |
172 | ||
173 | INIT_LIST_HEAD(&ops->rules_list); | |
174 | ops->fro_net = net; | |
175 | ||
176 | err = __fib_rules_register(ops); | |
177 | if (err) { | |
178 | kfree(ops); | |
179 | ops = ERR_PTR(err); | |
180 | } | |
181 | ||
182 | return ops; | |
183 | } | |
14c0b97d TG |
184 | EXPORT_SYMBOL_GPL(fib_rules_register); |
185 | ||
1df9916e | 186 | static void fib_rules_cleanup_ops(struct fib_rules_ops *ops) |
14c0b97d TG |
187 | { |
188 | struct fib_rule *rule, *tmp; | |
189 | ||
76c72d4f | 190 | list_for_each_entry_safe(rule, tmp, &ops->rules_list, list) { |
14c0b97d | 191 | list_del_rcu(&rule->list); |
7a9bc9b8 DM |
192 | if (ops->delete) |
193 | ops->delete(rule); | |
14c0b97d TG |
194 | fib_rule_put(rule); |
195 | } | |
196 | } | |
197 | ||
9e3a5487 | 198 | void fib_rules_unregister(struct fib_rules_ops *ops) |
14c0b97d | 199 | { |
9e3a5487 | 200 | struct net *net = ops->fro_net; |
14c0b97d | 201 | |
5fd30ee7 | 202 | spin_lock(&net->rules_mod_lock); |
72132c1b | 203 | list_del_rcu(&ops->list); |
5fd30ee7 | 204 | spin_unlock(&net->rules_mod_lock); |
14c0b97d | 205 | |
419df12f | 206 | fib_rules_cleanup_ops(ops); |
efd7ef1c | 207 | kfree_rcu(ops, rcu); |
14c0b97d | 208 | } |
14c0b97d TG |
209 | EXPORT_SYMBOL_GPL(fib_rules_unregister); |
210 | ||
622ec2c9 LC |
211 | static int uid_range_set(struct fib_kuid_range *range) |
212 | { | |
213 | return uid_valid(range->start) && uid_valid(range->end); | |
214 | } | |
215 | ||
216 | static struct fib_kuid_range nla_get_kuid_range(struct nlattr **tb) | |
217 | { | |
218 | struct fib_rule_uid_range *in; | |
219 | struct fib_kuid_range out; | |
220 | ||
221 | in = (struct fib_rule_uid_range *)nla_data(tb[FRA_UID_RANGE]); | |
222 | ||
223 | out.start = make_kuid(current_user_ns(), in->start); | |
224 | out.end = make_kuid(current_user_ns(), in->end); | |
225 | ||
226 | return out; | |
227 | } | |
228 | ||
229 | static int nla_put_uid_range(struct sk_buff *skb, struct fib_kuid_range *range) | |
230 | { | |
231 | struct fib_rule_uid_range out = { | |
232 | from_kuid_munged(current_user_ns(), range->start), | |
233 | from_kuid_munged(current_user_ns(), range->end) | |
234 | }; | |
235 | ||
236 | return nla_put(skb, FRA_UID_RANGE, sizeof(out), &out); | |
237 | } | |
238 | ||
bfff4862 RP |
239 | static int nla_get_port_range(struct nlattr *pattr, |
240 | struct fib_rule_port_range *port_range) | |
241 | { | |
242 | const struct fib_rule_port_range *pr = nla_data(pattr); | |
243 | ||
244 | if (!fib_rule_port_range_valid(pr)) | |
245 | return -EINVAL; | |
246 | ||
247 | port_range->start = pr->start; | |
248 | port_range->end = pr->end; | |
249 | ||
250 | return 0; | |
251 | } | |
252 | ||
253 | static int nla_put_port_range(struct sk_buff *skb, int attrtype, | |
254 | struct fib_rule_port_range *range) | |
255 | { | |
256 | return nla_put(skb, attrtype, sizeof(*range), range); | |
257 | } | |
258 | ||
3dfbcc41 | 259 | static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops, |
96c63fa7 DA |
260 | struct flowi *fl, int flags, |
261 | struct fib_lookup_arg *arg) | |
3dfbcc41 TG |
262 | { |
263 | int ret = 0; | |
264 | ||
1d28f42c | 265 | if (rule->iifindex && (rule->iifindex != fl->flowi_iif)) |
3dfbcc41 TG |
266 | goto out; |
267 | ||
1d28f42c | 268 | if (rule->oifindex && (rule->oifindex != fl->flowi_oif)) |
1b038a5e PM |
269 | goto out; |
270 | ||
1d28f42c | 271 | if ((rule->mark ^ fl->flowi_mark) & rule->mark_mask) |
3dfbcc41 TG |
272 | goto out; |
273 | ||
e7030878 TG |
274 | if (rule->tun_id && (rule->tun_id != fl->flowi_tun_key.tun_id)) |
275 | goto out; | |
276 | ||
96c63fa7 DA |
277 | if (rule->l3mdev && !l3mdev_fib_rule_match(rule->fr_net, fl, arg)) |
278 | goto out; | |
279 | ||
622ec2c9 LC |
280 | if (uid_lt(fl->flowi_uid, rule->uid_range.start) || |
281 | uid_gt(fl->flowi_uid, rule->uid_range.end)) | |
282 | goto out; | |
283 | ||
41d707b7 BV |
284 | ret = INDIRECT_CALL_MT(ops->match, |
285 | fib6_rule_match, | |
286 | fib4_rule_match, | |
287 | rule, fl, flags); | |
3dfbcc41 TG |
288 | out: |
289 | return (rule->flags & FIB_RULE_INVERT) ? !ret : ret; | |
290 | } | |
291 | ||
14c0b97d TG |
292 | int fib_rules_lookup(struct fib_rules_ops *ops, struct flowi *fl, |
293 | int flags, struct fib_lookup_arg *arg) | |
294 | { | |
295 | struct fib_rule *rule; | |
296 | int err; | |
297 | ||
298 | rcu_read_lock(); | |
299 | ||
76c72d4f | 300 | list_for_each_entry_rcu(rule, &ops->rules_list, list) { |
0947c9fe | 301 | jumped: |
96c63fa7 | 302 | if (!fib_rule_match(rule, ops, fl, flags, arg)) |
14c0b97d TG |
303 | continue; |
304 | ||
0947c9fe TG |
305 | if (rule->action == FR_ACT_GOTO) { |
306 | struct fib_rule *target; | |
307 | ||
308 | target = rcu_dereference(rule->ctarget); | |
309 | if (target == NULL) { | |
310 | continue; | |
311 | } else { | |
312 | rule = target; | |
313 | goto jumped; | |
314 | } | |
fa0b2d1d TG |
315 | } else if (rule->action == FR_ACT_NOP) |
316 | continue; | |
317 | else | |
41d707b7 BV |
318 | err = INDIRECT_CALL_MT(ops->action, |
319 | fib6_rule_action, | |
320 | fib4_rule_action, | |
321 | rule, fl, flags, arg); | |
322 | ||
323 | if (!err && ops->suppress && INDIRECT_CALL_MT(ops->suppress, | |
324 | fib6_rule_suppress, | |
325 | fib4_rule_suppress, | |
326 | rule, arg)) | |
7764a45a ST |
327 | continue; |
328 | ||
14c0b97d | 329 | if (err != -EAGAIN) { |
ebc0ffae | 330 | if ((arg->flags & FIB_LOOKUP_NOREF) || |
717d1e99 | 331 | likely(refcount_inc_not_zero(&rule->refcnt))) { |
7fa7cb71 ED |
332 | arg->rule = rule; |
333 | goto out; | |
334 | } | |
335 | break; | |
14c0b97d TG |
336 | } |
337 | } | |
338 | ||
83886b6b | 339 | err = -ESRCH; |
14c0b97d TG |
340 | out: |
341 | rcu_read_unlock(); | |
342 | ||
343 | return err; | |
344 | } | |
14c0b97d TG |
345 | EXPORT_SYMBOL_GPL(fib_rules_lookup); |
346 | ||
7c550daf | 347 | static int call_fib_rule_notifier(struct notifier_block *nb, |
1b2a4440 | 348 | enum fib_event_type event_type, |
b7a59557 JP |
349 | struct fib_rule *rule, int family, |
350 | struct netlink_ext_ack *extack) | |
1b2a4440 IS |
351 | { |
352 | struct fib_rule_notifier_info info = { | |
353 | .info.family = family, | |
b7a59557 | 354 | .info.extack = extack, |
1b2a4440 IS |
355 | .rule = rule, |
356 | }; | |
357 | ||
7c550daf | 358 | return call_fib_notifier(nb, event_type, &info.info); |
1b2a4440 IS |
359 | } |
360 | ||
361 | static int call_fib_rule_notifiers(struct net *net, | |
362 | enum fib_event_type event_type, | |
363 | struct fib_rule *rule, | |
6c31e5a9 DA |
364 | struct fib_rules_ops *ops, |
365 | struct netlink_ext_ack *extack) | |
1b2a4440 IS |
366 | { |
367 | struct fib_rule_notifier_info info = { | |
368 | .info.family = ops->family, | |
6c31e5a9 | 369 | .info.extack = extack, |
1b2a4440 IS |
370 | .rule = rule, |
371 | }; | |
372 | ||
373 | ops->fib_rules_seq++; | |
374 | return call_fib_notifiers(net, event_type, &info.info); | |
375 | } | |
376 | ||
377 | /* Called with rcu_read_lock() */ | |
b7a59557 JP |
378 | int fib_rules_dump(struct net *net, struct notifier_block *nb, int family, |
379 | struct netlink_ext_ack *extack) | |
1b2a4440 IS |
380 | { |
381 | struct fib_rules_ops *ops; | |
382 | struct fib_rule *rule; | |
55c894f7 | 383 | int err = 0; |
1b2a4440 IS |
384 | |
385 | ops = lookup_rules_ops(net, family); | |
386 | if (!ops) | |
387 | return -EAFNOSUPPORT; | |
55c894f7 JP |
388 | list_for_each_entry_rcu(rule, &ops->rules_list, list) { |
389 | err = call_fib_rule_notifier(nb, FIB_EVENT_RULE_ADD, | |
b7a59557 | 390 | rule, family, extack); |
55c894f7 JP |
391 | if (err) |
392 | break; | |
393 | } | |
1b2a4440 IS |
394 | rules_ops_put(ops); |
395 | ||
55c894f7 | 396 | return err; |
1b2a4440 IS |
397 | } |
398 | EXPORT_SYMBOL_GPL(fib_rules_dump); | |
399 | ||
400 | unsigned int fib_rules_seq_read(struct net *net, int family) | |
401 | { | |
402 | unsigned int fib_rules_seq; | |
403 | struct fib_rules_ops *ops; | |
404 | ||
405 | ASSERT_RTNL(); | |
406 | ||
407 | ops = lookup_rules_ops(net, family); | |
408 | if (!ops) | |
409 | return 0; | |
410 | fib_rules_seq = ops->fib_rules_seq; | |
411 | rules_ops_put(ops); | |
412 | ||
413 | return fib_rules_seq; | |
414 | } | |
415 | EXPORT_SYMBOL_GPL(fib_rules_seq_read); | |
416 | ||
f9d4b0c1 RP |
417 | static struct fib_rule *rule_find(struct fib_rules_ops *ops, |
418 | struct fib_rule_hdr *frh, | |
419 | struct nlattr **tb, | |
420 | struct fib_rule *rule, | |
421 | bool user_priority) | |
153380ec MB |
422 | { |
423 | struct fib_rule *r; | |
424 | ||
425 | list_for_each_entry(r, &ops->rules_list, list) { | |
f9d4b0c1 | 426 | if (rule->action && r->action != rule->action) |
153380ec MB |
427 | continue; |
428 | ||
f9d4b0c1 | 429 | if (rule->table && r->table != rule->table) |
153380ec MB |
430 | continue; |
431 | ||
f9d4b0c1 | 432 | if (user_priority && r->pref != rule->pref) |
153380ec MB |
433 | continue; |
434 | ||
f9d4b0c1 RP |
435 | if (rule->iifname[0] && |
436 | memcmp(r->iifname, rule->iifname, IFNAMSIZ)) | |
153380ec MB |
437 | continue; |
438 | ||
f9d4b0c1 RP |
439 | if (rule->oifname[0] && |
440 | memcmp(r->oifname, rule->oifname, IFNAMSIZ)) | |
153380ec MB |
441 | continue; |
442 | ||
f9d4b0c1 | 443 | if (rule->mark && r->mark != rule->mark) |
153380ec MB |
444 | continue; |
445 | ||
7c8f4e6d JD |
446 | if (rule->suppress_ifgroup != -1 && |
447 | r->suppress_ifgroup != rule->suppress_ifgroup) | |
448 | continue; | |
449 | ||
450 | if (rule->suppress_prefixlen != -1 && | |
451 | r->suppress_prefixlen != rule->suppress_prefixlen) | |
452 | continue; | |
453 | ||
f9d4b0c1 | 454 | if (rule->mark_mask && r->mark_mask != rule->mark_mask) |
153380ec MB |
455 | continue; |
456 | ||
f9d4b0c1 | 457 | if (rule->tun_id && r->tun_id != rule->tun_id) |
153380ec MB |
458 | continue; |
459 | ||
460 | if (r->fr_net != rule->fr_net) | |
461 | continue; | |
462 | ||
f9d4b0c1 | 463 | if (rule->l3mdev && r->l3mdev != rule->l3mdev) |
153380ec MB |
464 | continue; |
465 | ||
f9d4b0c1 RP |
466 | if (uid_range_set(&rule->uid_range) && |
467 | (!uid_eq(r->uid_range.start, rule->uid_range.start) || | |
468 | !uid_eq(r->uid_range.end, rule->uid_range.end))) | |
35b80733 LC |
469 | continue; |
470 | ||
f9d4b0c1 | 471 | if (rule->ip_proto && r->ip_proto != rule->ip_proto) |
bfff4862 RP |
472 | continue; |
473 | ||
35e8c7ba RP |
474 | if (rule->proto && r->proto != rule->proto) |
475 | continue; | |
476 | ||
f9d4b0c1 RP |
477 | if (fib_rule_port_range_set(&rule->sport_range) && |
478 | !fib_rule_port_range_compare(&r->sport_range, | |
bfff4862 RP |
479 | &rule->sport_range)) |
480 | continue; | |
481 | ||
f9d4b0c1 RP |
482 | if (fib_rule_port_range_set(&rule->dport_range) && |
483 | !fib_rule_port_range_compare(&r->dport_range, | |
bfff4862 RP |
484 | &rule->dport_range)) |
485 | continue; | |
486 | ||
153380ec MB |
487 | if (!ops->compare(r, frh, tb)) |
488 | continue; | |
f9d4b0c1 | 489 | return r; |
153380ec | 490 | } |
f9d4b0c1 RP |
491 | |
492 | return NULL; | |
153380ec MB |
493 | } |
494 | ||
c77bbc64 DA |
495 | #ifdef CONFIG_NET_L3_MASTER_DEV |
496 | static int fib_nl2rule_l3mdev(struct nlattr *nla, struct fib_rule *nlrule, | |
497 | struct netlink_ext_ack *extack) | |
498 | { | |
499 | nlrule->l3mdev = nla_get_u8(nla); | |
500 | if (nlrule->l3mdev != 1) { | |
501 | NL_SET_ERR_MSG(extack, "Invalid l3mdev attribute"); | |
502 | return -1; | |
503 | } | |
504 | ||
505 | return 0; | |
506 | } | |
507 | #else | |
508 | static int fib_nl2rule_l3mdev(struct nlattr *nla, struct fib_rule *nlrule, | |
509 | struct netlink_ext_ack *extack) | |
510 | { | |
511 | NL_SET_ERR_MSG(extack, "l3mdev support is not enabled in kernel"); | |
512 | return -1; | |
513 | } | |
514 | #endif | |
515 | ||
f9d4b0c1 RP |
516 | static int fib_nl2rule(struct sk_buff *skb, struct nlmsghdr *nlh, |
517 | struct netlink_ext_ack *extack, | |
518 | struct fib_rules_ops *ops, | |
519 | struct nlattr *tb[], | |
520 | struct fib_rule **rule, | |
521 | bool *user_priority) | |
14c0b97d | 522 | { |
3b1e0a65 | 523 | struct net *net = sock_net(skb->sk); |
14c0b97d | 524 | struct fib_rule_hdr *frh = nlmsg_data(nlh); |
f9d4b0c1 RP |
525 | struct fib_rule *nlrule = NULL; |
526 | int err = -EINVAL; | |
14c0b97d | 527 | |
f9d4b0c1 RP |
528 | if (frh->src_len) |
529 | if (!tb[FRA_SRC] || | |
530 | frh->src_len > (ops->addr_size * 8) || | |
b16fb418 RP |
531 | nla_len(tb[FRA_SRC]) != ops->addr_size) { |
532 | NL_SET_ERR_MSG(extack, "Invalid source address"); | |
f9d4b0c1 | 533 | goto errout; |
b16fb418 | 534 | } |
14c0b97d | 535 | |
f9d4b0c1 RP |
536 | if (frh->dst_len) |
537 | if (!tb[FRA_DST] || | |
538 | frh->dst_len > (ops->addr_size * 8) || | |
b16fb418 RP |
539 | nla_len(tb[FRA_DST]) != ops->addr_size) { |
540 | NL_SET_ERR_MSG(extack, "Invalid dst address"); | |
f9d4b0c1 | 541 | goto errout; |
b16fb418 | 542 | } |
e1701c68 | 543 | |
f9d4b0c1 RP |
544 | nlrule = kzalloc(ops->rule_size, GFP_KERNEL); |
545 | if (!nlrule) { | |
14c0b97d TG |
546 | err = -ENOMEM; |
547 | goto errout; | |
548 | } | |
f9d4b0c1 RP |
549 | refcount_set(&nlrule->refcnt, 1); |
550 | nlrule->fr_net = net; | |
14c0b97d | 551 | |
f9d4b0c1 RP |
552 | if (tb[FRA_PRIORITY]) { |
553 | nlrule->pref = nla_get_u32(tb[FRA_PRIORITY]); | |
554 | *user_priority = true; | |
555 | } else { | |
556 | nlrule->pref = fib_default_rule_pref(ops); | |
557 | } | |
14c0b97d | 558 | |
f9d4b0c1 | 559 | nlrule->proto = tb[FRA_PROTOCOL] ? |
1b71af60 DS |
560 | nla_get_u8(tb[FRA_PROTOCOL]) : RTPROT_UNSPEC; |
561 | ||
491deb24 | 562 | if (tb[FRA_IIFNAME]) { |
14c0b97d TG |
563 | struct net_device *dev; |
564 | ||
f9d4b0c1 RP |
565 | nlrule->iifindex = -1; |
566 | nla_strlcpy(nlrule->iifname, tb[FRA_IIFNAME], IFNAMSIZ); | |
567 | dev = __dev_get_by_name(net, nlrule->iifname); | |
14c0b97d | 568 | if (dev) |
f9d4b0c1 | 569 | nlrule->iifindex = dev->ifindex; |
14c0b97d TG |
570 | } |
571 | ||
1b038a5e PM |
572 | if (tb[FRA_OIFNAME]) { |
573 | struct net_device *dev; | |
574 | ||
f9d4b0c1 RP |
575 | nlrule->oifindex = -1; |
576 | nla_strlcpy(nlrule->oifname, tb[FRA_OIFNAME], IFNAMSIZ); | |
577 | dev = __dev_get_by_name(net, nlrule->oifname); | |
1b038a5e | 578 | if (dev) |
f9d4b0c1 | 579 | nlrule->oifindex = dev->ifindex; |
1b038a5e PM |
580 | } |
581 | ||
b8964ed9 | 582 | if (tb[FRA_FWMARK]) { |
f9d4b0c1 RP |
583 | nlrule->mark = nla_get_u32(tb[FRA_FWMARK]); |
584 | if (nlrule->mark) | |
b8964ed9 TG |
585 | /* compatibility: if the mark value is non-zero all bits |
586 | * are compared unless a mask is explicitly specified. | |
587 | */ | |
f9d4b0c1 | 588 | nlrule->mark_mask = 0xFFFFFFFF; |
b8964ed9 TG |
589 | } |
590 | ||
591 | if (tb[FRA_FWMASK]) | |
f9d4b0c1 | 592 | nlrule->mark_mask = nla_get_u32(tb[FRA_FWMASK]); |
b8964ed9 | 593 | |
e7030878 | 594 | if (tb[FRA_TUN_ID]) |
f9d4b0c1 | 595 | nlrule->tun_id = nla_get_be64(tb[FRA_TUN_ID]); |
e7030878 | 596 | |
adeb45cb | 597 | err = -EINVAL; |
c77bbc64 DA |
598 | if (tb[FRA_L3MDEV] && |
599 | fib_nl2rule_l3mdev(tb[FRA_L3MDEV], nlrule, extack) < 0) | |
600 | goto errout_free; | |
96c63fa7 | 601 | |
f9d4b0c1 RP |
602 | nlrule->action = frh->action; |
603 | nlrule->flags = frh->flags; | |
604 | nlrule->table = frh_get_table(frh, tb); | |
73f5698e | 605 | if (tb[FRA_SUPPRESS_PREFIXLEN]) |
f9d4b0c1 | 606 | nlrule->suppress_prefixlen = nla_get_u32(tb[FRA_SUPPRESS_PREFIXLEN]); |
73f5698e | 607 | else |
f9d4b0c1 | 608 | nlrule->suppress_prefixlen = -1; |
14c0b97d | 609 | |
6ef94cfa | 610 | if (tb[FRA_SUPPRESS_IFGROUP]) |
f9d4b0c1 | 611 | nlrule->suppress_ifgroup = nla_get_u32(tb[FRA_SUPPRESS_IFGROUP]); |
73f5698e | 612 | else |
f9d4b0c1 | 613 | nlrule->suppress_ifgroup = -1; |
6ef94cfa | 614 | |
0947c9fe | 615 | if (tb[FRA_GOTO]) { |
b16fb418 RP |
616 | if (nlrule->action != FR_ACT_GOTO) { |
617 | NL_SET_ERR_MSG(extack, "Unexpected goto"); | |
0947c9fe | 618 | goto errout_free; |
b16fb418 | 619 | } |
0947c9fe | 620 | |
f9d4b0c1 | 621 | nlrule->target = nla_get_u32(tb[FRA_GOTO]); |
0947c9fe | 622 | /* Backward jumps are prohibited to avoid endless loops */ |
b16fb418 RP |
623 | if (nlrule->target <= nlrule->pref) { |
624 | NL_SET_ERR_MSG(extack, "Backward goto not supported"); | |
0947c9fe | 625 | goto errout_free; |
b16fb418 | 626 | } |
f9d4b0c1 | 627 | } else if (nlrule->action == FR_ACT_GOTO) { |
b16fb418 | 628 | NL_SET_ERR_MSG(extack, "Missing goto target for action goto"); |
0947c9fe | 629 | goto errout_free; |
f9d4b0c1 | 630 | } |
0947c9fe | 631 | |
b16fb418 RP |
632 | if (nlrule->l3mdev && nlrule->table) { |
633 | NL_SET_ERR_MSG(extack, "l3mdev and table are mutually exclusive"); | |
96c63fa7 | 634 | goto errout_free; |
b16fb418 | 635 | } |
96c63fa7 | 636 | |
622ec2c9 LC |
637 | if (tb[FRA_UID_RANGE]) { |
638 | if (current_user_ns() != net->user_ns) { | |
639 | err = -EPERM; | |
b16fb418 | 640 | NL_SET_ERR_MSG(extack, "No permission to set uid"); |
622ec2c9 LC |
641 | goto errout_free; |
642 | } | |
643 | ||
f9d4b0c1 | 644 | nlrule->uid_range = nla_get_kuid_range(tb); |
622ec2c9 | 645 | |
f9d4b0c1 | 646 | if (!uid_range_set(&nlrule->uid_range) || |
b16fb418 RP |
647 | !uid_lte(nlrule->uid_range.start, nlrule->uid_range.end)) { |
648 | NL_SET_ERR_MSG(extack, "Invalid uid range"); | |
622ec2c9 | 649 | goto errout_free; |
b16fb418 | 650 | } |
622ec2c9 | 651 | } else { |
f9d4b0c1 | 652 | nlrule->uid_range = fib_kuid_range_unset; |
622ec2c9 LC |
653 | } |
654 | ||
bfff4862 | 655 | if (tb[FRA_IP_PROTO]) |
f9d4b0c1 | 656 | nlrule->ip_proto = nla_get_u8(tb[FRA_IP_PROTO]); |
bfff4862 RP |
657 | |
658 | if (tb[FRA_SPORT_RANGE]) { | |
659 | err = nla_get_port_range(tb[FRA_SPORT_RANGE], | |
f9d4b0c1 | 660 | &nlrule->sport_range); |
b16fb418 RP |
661 | if (err) { |
662 | NL_SET_ERR_MSG(extack, "Invalid sport range"); | |
bfff4862 | 663 | goto errout_free; |
b16fb418 | 664 | } |
bfff4862 RP |
665 | } |
666 | ||
667 | if (tb[FRA_DPORT_RANGE]) { | |
668 | err = nla_get_port_range(tb[FRA_DPORT_RANGE], | |
f9d4b0c1 | 669 | &nlrule->dport_range); |
b16fb418 RP |
670 | if (err) { |
671 | NL_SET_ERR_MSG(extack, "Invalid dport range"); | |
bfff4862 | 672 | goto errout_free; |
b16fb418 | 673 | } |
bfff4862 RP |
674 | } |
675 | ||
f9d4b0c1 RP |
676 | *rule = nlrule; |
677 | ||
678 | return 0; | |
679 | ||
680 | errout_free: | |
681 | kfree(nlrule); | |
682 | errout: | |
683 | return err; | |
684 | } | |
685 | ||
35e8c7ba RP |
686 | static int rule_exists(struct fib_rules_ops *ops, struct fib_rule_hdr *frh, |
687 | struct nlattr **tb, struct fib_rule *rule) | |
688 | { | |
689 | struct fib_rule *r; | |
690 | ||
691 | list_for_each_entry(r, &ops->rules_list, list) { | |
692 | if (r->action != rule->action) | |
693 | continue; | |
694 | ||
695 | if (r->table != rule->table) | |
696 | continue; | |
697 | ||
698 | if (r->pref != rule->pref) | |
699 | continue; | |
700 | ||
701 | if (memcmp(r->iifname, rule->iifname, IFNAMSIZ)) | |
702 | continue; | |
703 | ||
704 | if (memcmp(r->oifname, rule->oifname, IFNAMSIZ)) | |
705 | continue; | |
706 | ||
707 | if (r->mark != rule->mark) | |
708 | continue; | |
709 | ||
710 | if (r->suppress_ifgroup != rule->suppress_ifgroup) | |
711 | continue; | |
712 | ||
713 | if (r->suppress_prefixlen != rule->suppress_prefixlen) | |
714 | continue; | |
715 | ||
716 | if (r->mark_mask != rule->mark_mask) | |
717 | continue; | |
718 | ||
719 | if (r->tun_id != rule->tun_id) | |
720 | continue; | |
721 | ||
722 | if (r->fr_net != rule->fr_net) | |
723 | continue; | |
724 | ||
725 | if (r->l3mdev != rule->l3mdev) | |
726 | continue; | |
727 | ||
728 | if (!uid_eq(r->uid_range.start, rule->uid_range.start) || | |
729 | !uid_eq(r->uid_range.end, rule->uid_range.end)) | |
730 | continue; | |
731 | ||
732 | if (r->ip_proto != rule->ip_proto) | |
733 | continue; | |
734 | ||
735 | if (r->proto != rule->proto) | |
736 | continue; | |
737 | ||
738 | if (!fib_rule_port_range_compare(&r->sport_range, | |
739 | &rule->sport_range)) | |
740 | continue; | |
741 | ||
742 | if (!fib_rule_port_range_compare(&r->dport_range, | |
743 | &rule->dport_range)) | |
744 | continue; | |
745 | ||
746 | if (!ops->compare(r, frh, tb)) | |
747 | continue; | |
748 | return 1; | |
749 | } | |
750 | return 0; | |
751 | } | |
752 | ||
f9d4b0c1 RP |
753 | int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh, |
754 | struct netlink_ext_ack *extack) | |
755 | { | |
756 | struct net *net = sock_net(skb->sk); | |
757 | struct fib_rule_hdr *frh = nlmsg_data(nlh); | |
758 | struct fib_rules_ops *ops = NULL; | |
759 | struct fib_rule *rule = NULL, *r, *last = NULL; | |
760 | struct nlattr *tb[FRA_MAX + 1]; | |
761 | int err = -EINVAL, unresolved = 0; | |
762 | bool user_priority = false; | |
763 | ||
b16fb418 RP |
764 | if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh))) { |
765 | NL_SET_ERR_MSG(extack, "Invalid msg length"); | |
f9d4b0c1 | 766 | goto errout; |
b16fb418 | 767 | } |
f9d4b0c1 RP |
768 | |
769 | ops = lookup_rules_ops(net, frh->family); | |
770 | if (!ops) { | |
771 | err = -EAFNOSUPPORT; | |
b16fb418 | 772 | NL_SET_ERR_MSG(extack, "Rule family not supported"); |
f9d4b0c1 RP |
773 | goto errout; |
774 | } | |
775 | ||
8cb08174 JB |
776 | err = nlmsg_parse_deprecated(nlh, sizeof(*frh), tb, FRA_MAX, |
777 | ops->policy, extack); | |
b16fb418 RP |
778 | if (err < 0) { |
779 | NL_SET_ERR_MSG(extack, "Error parsing msg"); | |
f9d4b0c1 | 780 | goto errout; |
b16fb418 | 781 | } |
f9d4b0c1 RP |
782 | |
783 | err = fib_nl2rule(skb, nlh, extack, ops, tb, &rule, &user_priority); | |
784 | if (err) | |
785 | goto errout; | |
786 | ||
4970b42d HL |
787 | if ((nlh->nlmsg_flags & NLM_F_EXCL) && |
788 | rule_exists(ops, frh, tb, rule)) { | |
789 | err = -EEXIST; | |
153380ec MB |
790 | goto errout_free; |
791 | } | |
792 | ||
b16fb418 | 793 | err = ops->configure(rule, skb, frh, tb, extack); |
14c0b97d TG |
794 | if (err < 0) |
795 | goto errout_free; | |
796 | ||
9776d325 DA |
797 | err = call_fib_rule_notifiers(net, FIB_EVENT_RULE_ADD, rule, ops, |
798 | extack); | |
799 | if (err < 0) | |
800 | goto errout_free; | |
801 | ||
f9d4b0c1 RP |
802 | list_for_each_entry(r, &ops->rules_list, list) { |
803 | if (r->pref == rule->target) { | |
804 | RCU_INIT_POINTER(rule->ctarget, r); | |
805 | break; | |
806 | } | |
807 | } | |
808 | ||
809 | if (rcu_dereference_protected(rule->ctarget, 1) == NULL) | |
810 | unresolved = 1; | |
811 | ||
76c72d4f | 812 | list_for_each_entry(r, &ops->rules_list, list) { |
14c0b97d TG |
813 | if (r->pref > rule->pref) |
814 | break; | |
815 | last = r; | |
816 | } | |
817 | ||
ebb9fed2 ED |
818 | if (last) |
819 | list_add_rcu(&rule->list, &last->list); | |
820 | else | |
821 | list_add_rcu(&rule->list, &ops->rules_list); | |
822 | ||
0947c9fe TG |
823 | if (ops->unresolved_rules) { |
824 | /* | |
825 | * There are unresolved goto rules in the list, check if | |
826 | * any of them are pointing to this new rule. | |
827 | */ | |
76c72d4f | 828 | list_for_each_entry(r, &ops->rules_list, list) { |
0947c9fe | 829 | if (r->action == FR_ACT_GOTO && |
561dac2d G |
830 | r->target == rule->pref && |
831 | rtnl_dereference(r->ctarget) == NULL) { | |
0947c9fe TG |
832 | rcu_assign_pointer(r->ctarget, rule); |
833 | if (--ops->unresolved_rules == 0) | |
834 | break; | |
835 | } | |
836 | } | |
837 | } | |
838 | ||
839 | if (rule->action == FR_ACT_GOTO) | |
840 | ops->nr_goto_rules++; | |
841 | ||
842 | if (unresolved) | |
843 | ops->unresolved_rules++; | |
844 | ||
e7030878 TG |
845 | if (rule->tun_id) |
846 | ip_tunnel_need_metadata(); | |
847 | ||
15e47304 | 848 | notify_rule_change(RTM_NEWRULE, rule, ops, nlh, NETLINK_CB(skb).portid); |
73417f61 | 849 | flush_route_cache(ops); |
14c0b97d TG |
850 | rules_ops_put(ops); |
851 | return 0; | |
852 | ||
853 | errout_free: | |
854 | kfree(rule); | |
855 | errout: | |
856 | rules_ops_put(ops); | |
857 | return err; | |
858 | } | |
96c63fa7 | 859 | EXPORT_SYMBOL_GPL(fib_nl_newrule); |
14c0b97d | 860 | |
c21ef3e3 DA |
861 | int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr *nlh, |
862 | struct netlink_ext_ack *extack) | |
14c0b97d | 863 | { |
3b1e0a65 | 864 | struct net *net = sock_net(skb->sk); |
14c0b97d TG |
865 | struct fib_rule_hdr *frh = nlmsg_data(nlh); |
866 | struct fib_rules_ops *ops = NULL; | |
f9d4b0c1 | 867 | struct fib_rule *rule = NULL, *r, *nlrule = NULL; |
14c0b97d TG |
868 | struct nlattr *tb[FRA_MAX+1]; |
869 | int err = -EINVAL; | |
f9d4b0c1 | 870 | bool user_priority = false; |
14c0b97d | 871 | |
b16fb418 RP |
872 | if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh))) { |
873 | NL_SET_ERR_MSG(extack, "Invalid msg length"); | |
14c0b97d | 874 | goto errout; |
b16fb418 | 875 | } |
14c0b97d | 876 | |
5fd30ee7 | 877 | ops = lookup_rules_ops(net, frh->family); |
14c0b97d | 878 | if (ops == NULL) { |
2fe195cf | 879 | err = -EAFNOSUPPORT; |
b16fb418 | 880 | NL_SET_ERR_MSG(extack, "Rule family not supported"); |
14c0b97d TG |
881 | goto errout; |
882 | } | |
883 | ||
8cb08174 JB |
884 | err = nlmsg_parse_deprecated(nlh, sizeof(*frh), tb, FRA_MAX, |
885 | ops->policy, extack); | |
b16fb418 RP |
886 | if (err < 0) { |
887 | NL_SET_ERR_MSG(extack, "Error parsing msg"); | |
14c0b97d | 888 | goto errout; |
b16fb418 | 889 | } |
14c0b97d | 890 | |
f9d4b0c1 RP |
891 | err = fib_nl2rule(skb, nlh, extack, ops, tb, &nlrule, &user_priority); |
892 | if (err) | |
e1701c68 TG |
893 | goto errout; |
894 | ||
f9d4b0c1 RP |
895 | rule = rule_find(ops, frh, tb, nlrule, user_priority); |
896 | if (!rule) { | |
897 | err = -ENOENT; | |
898 | goto errout; | |
622ec2c9 LC |
899 | } |
900 | ||
f9d4b0c1 RP |
901 | if (rule->flags & FIB_RULE_PERMANENT) { |
902 | err = -EPERM; | |
903 | goto errout; | |
bfff4862 RP |
904 | } |
905 | ||
f9d4b0c1 RP |
906 | if (ops->delete) { |
907 | err = ops->delete(rule); | |
bfff4862 RP |
908 | if (err) |
909 | goto errout; | |
910 | } | |
911 | ||
f9d4b0c1 RP |
912 | if (rule->tun_id) |
913 | ip_tunnel_unneed_metadata(); | |
0ddcf43d | 914 | |
f9d4b0c1 | 915 | list_del_rcu(&rule->list); |
e7030878 | 916 | |
f9d4b0c1 RP |
917 | if (rule->action == FR_ACT_GOTO) { |
918 | ops->nr_goto_rules--; | |
919 | if (rtnl_dereference(rule->ctarget) == NULL) | |
920 | ops->unresolved_rules--; | |
921 | } | |
0947c9fe | 922 | |
f9d4b0c1 RP |
923 | /* |
924 | * Check if this rule is a target to any of them. If so, | |
925 | * adjust to the next one with the same preference or | |
926 | * disable them. As this operation is eventually very | |
927 | * expensive, it is only performed if goto rules, except | |
928 | * current if it is goto rule, have actually been added. | |
929 | */ | |
930 | if (ops->nr_goto_rules > 0) { | |
931 | struct fib_rule *n; | |
932 | ||
933 | n = list_next_entry(rule, list); | |
934 | if (&n->list == &ops->rules_list || n->pref != rule->pref) | |
935 | n = NULL; | |
936 | list_for_each_entry(r, &ops->rules_list, list) { | |
937 | if (rtnl_dereference(r->ctarget) != rule) | |
938 | continue; | |
939 | rcu_assign_pointer(r->ctarget, n); | |
940 | if (!n) | |
941 | ops->unresolved_rules++; | |
0947c9fe | 942 | } |
14c0b97d TG |
943 | } |
944 | ||
f9d4b0c1 RP |
945 | call_fib_rule_notifiers(net, FIB_EVENT_RULE_DEL, rule, ops, |
946 | NULL); | |
947 | notify_rule_change(RTM_DELRULE, rule, ops, nlh, | |
948 | NETLINK_CB(skb).portid); | |
949 | fib_rule_put(rule); | |
950 | flush_route_cache(ops); | |
951 | rules_ops_put(ops); | |
952 | kfree(nlrule); | |
953 | return 0; | |
954 | ||
14c0b97d | 955 | errout: |
778c4d5c | 956 | kfree(nlrule); |
14c0b97d TG |
957 | rules_ops_put(ops); |
958 | return err; | |
959 | } | |
96c63fa7 | 960 | EXPORT_SYMBOL_GPL(fib_nl_delrule); |
14c0b97d | 961 | |
339bf98f TG |
962 | static inline size_t fib_rule_nlmsg_size(struct fib_rules_ops *ops, |
963 | struct fib_rule *rule) | |
964 | { | |
965 | size_t payload = NLMSG_ALIGN(sizeof(struct fib_rule_hdr)) | |
491deb24 | 966 | + nla_total_size(IFNAMSIZ) /* FRA_IIFNAME */ |
1b038a5e | 967 | + nla_total_size(IFNAMSIZ) /* FRA_OIFNAME */ |
339bf98f TG |
968 | + nla_total_size(4) /* FRA_PRIORITY */ |
969 | + nla_total_size(4) /* FRA_TABLE */ | |
73f5698e | 970 | + nla_total_size(4) /* FRA_SUPPRESS_PREFIXLEN */ |
6ef94cfa | 971 | + nla_total_size(4) /* FRA_SUPPRESS_IFGROUP */ |
339bf98f | 972 | + nla_total_size(4) /* FRA_FWMARK */ |
e7030878 | 973 | + nla_total_size(4) /* FRA_FWMASK */ |
622ec2c9 | 974 | + nla_total_size_64bit(8) /* FRA_TUN_ID */ |
1b71af60 | 975 | + nla_total_size(sizeof(struct fib_kuid_range)) |
bfff4862 RP |
976 | + nla_total_size(1) /* FRA_PROTOCOL */ |
977 | + nla_total_size(1) /* FRA_IP_PROTO */ | |
978 | + nla_total_size(sizeof(struct fib_rule_port_range)) /* FRA_SPORT_RANGE */ | |
979 | + nla_total_size(sizeof(struct fib_rule_port_range)); /* FRA_DPORT_RANGE */ | |
339bf98f TG |
980 | |
981 | if (ops->nlmsg_payload) | |
982 | payload += ops->nlmsg_payload(rule); | |
983 | ||
984 | return payload; | |
985 | } | |
986 | ||
14c0b97d TG |
987 | static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule, |
988 | u32 pid, u32 seq, int type, int flags, | |
989 | struct fib_rules_ops *ops) | |
990 | { | |
991 | struct nlmsghdr *nlh; | |
992 | struct fib_rule_hdr *frh; | |
993 | ||
994 | nlh = nlmsg_put(skb, pid, seq, type, sizeof(*frh), flags); | |
995 | if (nlh == NULL) | |
26932566 | 996 | return -EMSGSIZE; |
14c0b97d TG |
997 | |
998 | frh = nlmsg_data(nlh); | |
28bb1726 | 999 | frh->family = ops->family; |
540e585a | 1000 | frh->table = rule->table < 256 ? rule->table : RT_TABLE_COMPAT; |
0e3cea7b DM |
1001 | if (nla_put_u32(skb, FRA_TABLE, rule->table)) |
1002 | goto nla_put_failure; | |
73f5698e | 1003 | if (nla_put_u32(skb, FRA_SUPPRESS_PREFIXLEN, rule->suppress_prefixlen)) |
7764a45a | 1004 | goto nla_put_failure; |
14c0b97d | 1005 | frh->res1 = 0; |
1b71af60 | 1006 | frh->res2 = 0; |
14c0b97d TG |
1007 | frh->action = rule->action; |
1008 | frh->flags = rule->flags; | |
1b71af60 DS |
1009 | |
1010 | if (nla_put_u8(skb, FRA_PROTOCOL, rule->proto)) | |
1011 | goto nla_put_failure; | |
14c0b97d | 1012 | |
7a2b03c5 | 1013 | if (rule->action == FR_ACT_GOTO && |
33d480ce | 1014 | rcu_access_pointer(rule->ctarget) == NULL) |
0947c9fe TG |
1015 | frh->flags |= FIB_RULE_UNRESOLVED; |
1016 | ||
491deb24 | 1017 | if (rule->iifname[0]) { |
0e3cea7b DM |
1018 | if (nla_put_string(skb, FRA_IIFNAME, rule->iifname)) |
1019 | goto nla_put_failure; | |
491deb24 PM |
1020 | if (rule->iifindex == -1) |
1021 | frh->flags |= FIB_RULE_IIF_DETACHED; | |
2b443683 TG |
1022 | } |
1023 | ||
1b038a5e | 1024 | if (rule->oifname[0]) { |
0e3cea7b DM |
1025 | if (nla_put_string(skb, FRA_OIFNAME, rule->oifname)) |
1026 | goto nla_put_failure; | |
1b038a5e PM |
1027 | if (rule->oifindex == -1) |
1028 | frh->flags |= FIB_RULE_OIF_DETACHED; | |
1029 | } | |
1030 | ||
0e3cea7b DM |
1031 | if ((rule->pref && |
1032 | nla_put_u32(skb, FRA_PRIORITY, rule->pref)) || | |
1033 | (rule->mark && | |
1034 | nla_put_u32(skb, FRA_FWMARK, rule->mark)) || | |
1035 | ((rule->mark_mask || rule->mark) && | |
1036 | nla_put_u32(skb, FRA_FWMASK, rule->mark_mask)) || | |
1037 | (rule->target && | |
e7030878 TG |
1038 | nla_put_u32(skb, FRA_GOTO, rule->target)) || |
1039 | (rule->tun_id && | |
96c63fa7 DA |
1040 | nla_put_be64(skb, FRA_TUN_ID, rule->tun_id, FRA_PAD)) || |
1041 | (rule->l3mdev && | |
622ec2c9 LC |
1042 | nla_put_u8(skb, FRA_L3MDEV, rule->l3mdev)) || |
1043 | (uid_range_set(&rule->uid_range) && | |
bfff4862 RP |
1044 | nla_put_uid_range(skb, &rule->uid_range)) || |
1045 | (fib_rule_port_range_set(&rule->sport_range) && | |
1046 | nla_put_port_range(skb, FRA_SPORT_RANGE, &rule->sport_range)) || | |
1047 | (fib_rule_port_range_set(&rule->dport_range) && | |
1048 | nla_put_port_range(skb, FRA_DPORT_RANGE, &rule->dport_range)) || | |
1049 | (rule->ip_proto && nla_put_u8(skb, FRA_IP_PROTO, rule->ip_proto))) | |
0e3cea7b | 1050 | goto nla_put_failure; |
6ef94cfa ST |
1051 | |
1052 | if (rule->suppress_ifgroup != -1) { | |
1053 | if (nla_put_u32(skb, FRA_SUPPRESS_IFGROUP, rule->suppress_ifgroup)) | |
1054 | goto nla_put_failure; | |
1055 | } | |
1056 | ||
04af8cf6 | 1057 | if (ops->fill(rule, skb, frh) < 0) |
14c0b97d TG |
1058 | goto nla_put_failure; |
1059 | ||
053c095a JB |
1060 | nlmsg_end(skb, nlh); |
1061 | return 0; | |
14c0b97d TG |
1062 | |
1063 | nla_put_failure: | |
26932566 PM |
1064 | nlmsg_cancel(skb, nlh); |
1065 | return -EMSGSIZE; | |
14c0b97d TG |
1066 | } |
1067 | ||
c454673d TG |
1068 | static int dump_rules(struct sk_buff *skb, struct netlink_callback *cb, |
1069 | struct fib_rules_ops *ops) | |
14c0b97d TG |
1070 | { |
1071 | int idx = 0; | |
1072 | struct fib_rule *rule; | |
41fc0143 | 1073 | int err = 0; |
14c0b97d | 1074 | |
e67f88dd ED |
1075 | rcu_read_lock(); |
1076 | list_for_each_entry_rcu(rule, &ops->rules_list, list) { | |
c454673d | 1077 | if (idx < cb->args[1]) |
14c0b97d TG |
1078 | goto skip; |
1079 | ||
41fc0143 WK |
1080 | err = fib_nl_fill_rule(skb, rule, NETLINK_CB(cb->skb).portid, |
1081 | cb->nlh->nlmsg_seq, RTM_NEWRULE, | |
1082 | NLM_F_MULTI, ops); | |
1083 | if (err) | |
14c0b97d TG |
1084 | break; |
1085 | skip: | |
1086 | idx++; | |
1087 | } | |
2907c35f | 1088 | rcu_read_unlock(); |
c454673d | 1089 | cb->args[1] = idx; |
14c0b97d TG |
1090 | rules_ops_put(ops); |
1091 | ||
41fc0143 | 1092 | return err; |
14c0b97d TG |
1093 | } |
1094 | ||
4a73e5e5 DA |
1095 | static int fib_valid_dumprule_req(const struct nlmsghdr *nlh, |
1096 | struct netlink_ext_ack *extack) | |
1097 | { | |
1098 | struct fib_rule_hdr *frh; | |
1099 | ||
1100 | if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh))) { | |
1101 | NL_SET_ERR_MSG(extack, "Invalid header for fib rule dump request"); | |
1102 | return -EINVAL; | |
1103 | } | |
1104 | ||
1105 | frh = nlmsg_data(nlh); | |
1106 | if (frh->dst_len || frh->src_len || frh->tos || frh->table || | |
1107 | frh->res1 || frh->res2 || frh->action || frh->flags) { | |
1108 | NL_SET_ERR_MSG(extack, | |
1109 | "Invalid values in header for fib rule dump request"); | |
1110 | return -EINVAL; | |
1111 | } | |
1112 | ||
1113 | if (nlmsg_attrlen(nlh, sizeof(*frh))) { | |
1114 | NL_SET_ERR_MSG(extack, "Invalid data after header in fib rule dump request"); | |
1115 | return -EINVAL; | |
1116 | } | |
1117 | ||
1118 | return 0; | |
1119 | } | |
1120 | ||
c454673d TG |
1121 | static int fib_nl_dumprule(struct sk_buff *skb, struct netlink_callback *cb) |
1122 | { | |
4a73e5e5 | 1123 | const struct nlmsghdr *nlh = cb->nlh; |
3b1e0a65 | 1124 | struct net *net = sock_net(skb->sk); |
c454673d TG |
1125 | struct fib_rules_ops *ops; |
1126 | int idx = 0, family; | |
1127 | ||
4a73e5e5 DA |
1128 | if (cb->strict_check) { |
1129 | int err = fib_valid_dumprule_req(nlh, cb->extack); | |
1130 | ||
1131 | if (err < 0) | |
1132 | return err; | |
1133 | } | |
1134 | ||
1135 | family = rtnl_msg_family(nlh); | |
c454673d TG |
1136 | if (family != AF_UNSPEC) { |
1137 | /* Protocol specific dump request */ | |
5fd30ee7 | 1138 | ops = lookup_rules_ops(net, family); |
c454673d TG |
1139 | if (ops == NULL) |
1140 | return -EAFNOSUPPORT; | |
1141 | ||
41fc0143 WK |
1142 | dump_rules(skb, cb, ops); |
1143 | ||
1144 | return skb->len; | |
c454673d TG |
1145 | } |
1146 | ||
1147 | rcu_read_lock(); | |
5fd30ee7 | 1148 | list_for_each_entry_rcu(ops, &net->rules_ops, list) { |
c454673d TG |
1149 | if (idx < cb->args[0] || !try_module_get(ops->owner)) |
1150 | goto skip; | |
1151 | ||
1152 | if (dump_rules(skb, cb, ops) < 0) | |
1153 | break; | |
1154 | ||
1155 | cb->args[1] = 0; | |
2fb3573d | 1156 | skip: |
c454673d TG |
1157 | idx++; |
1158 | } | |
1159 | rcu_read_unlock(); | |
1160 | cb->args[0] = idx; | |
1161 | ||
1162 | return skb->len; | |
1163 | } | |
14c0b97d | 1164 | |
9e3a5487 | 1165 | static void notify_rule_change(int event, struct fib_rule *rule, |
c17084d2 TG |
1166 | struct fib_rules_ops *ops, struct nlmsghdr *nlh, |
1167 | u32 pid) | |
14c0b97d | 1168 | { |
9e3a5487 | 1169 | struct net *net; |
c17084d2 TG |
1170 | struct sk_buff *skb; |
1171 | int err = -ENOBUFS; | |
14c0b97d | 1172 | |
9e3a5487 | 1173 | net = ops->fro_net; |
339bf98f | 1174 | skb = nlmsg_new(fib_rule_nlmsg_size(ops, rule), GFP_KERNEL); |
14c0b97d | 1175 | if (skb == NULL) |
c17084d2 TG |
1176 | goto errout; |
1177 | ||
1178 | err = fib_nl_fill_rule(skb, rule, pid, nlh->nlmsg_seq, event, 0, ops); | |
26932566 PM |
1179 | if (err < 0) { |
1180 | /* -EMSGSIZE implies BUG in fib_rule_nlmsg_size() */ | |
1181 | WARN_ON(err == -EMSGSIZE); | |
1182 | kfree_skb(skb); | |
1183 | goto errout; | |
1184 | } | |
9e3a5487 | 1185 | |
1ce85fe4 PNA |
1186 | rtnl_notify(skb, net, pid, ops->nlgroup, nlh, GFP_KERNEL); |
1187 | return; | |
c17084d2 TG |
1188 | errout: |
1189 | if (err < 0) | |
5fd30ee7 | 1190 | rtnl_set_sk_err(net, ops->nlgroup, err); |
14c0b97d TG |
1191 | } |
1192 | ||
1193 | static void attach_rules(struct list_head *rules, struct net_device *dev) | |
1194 | { | |
1195 | struct fib_rule *rule; | |
1196 | ||
1197 | list_for_each_entry(rule, rules, list) { | |
491deb24 PM |
1198 | if (rule->iifindex == -1 && |
1199 | strcmp(dev->name, rule->iifname) == 0) | |
1200 | rule->iifindex = dev->ifindex; | |
1b038a5e PM |
1201 | if (rule->oifindex == -1 && |
1202 | strcmp(dev->name, rule->oifname) == 0) | |
1203 | rule->oifindex = dev->ifindex; | |
14c0b97d TG |
1204 | } |
1205 | } | |
1206 | ||
1207 | static void detach_rules(struct list_head *rules, struct net_device *dev) | |
1208 | { | |
1209 | struct fib_rule *rule; | |
1210 | ||
1b038a5e | 1211 | list_for_each_entry(rule, rules, list) { |
491deb24 PM |
1212 | if (rule->iifindex == dev->ifindex) |
1213 | rule->iifindex = -1; | |
1b038a5e PM |
1214 | if (rule->oifindex == dev->ifindex) |
1215 | rule->oifindex = -1; | |
1216 | } | |
14c0b97d TG |
1217 | } |
1218 | ||
1219 | ||
1220 | static int fib_rules_event(struct notifier_block *this, unsigned long event, | |
351638e7 | 1221 | void *ptr) |
14c0b97d | 1222 | { |
351638e7 | 1223 | struct net_device *dev = netdev_notifier_info_to_dev(ptr); |
c346dca1 | 1224 | struct net *net = dev_net(dev); |
14c0b97d TG |
1225 | struct fib_rules_ops *ops; |
1226 | ||
748e2d93 | 1227 | ASSERT_RTNL(); |
14c0b97d TG |
1228 | |
1229 | switch (event) { | |
1230 | case NETDEV_REGISTER: | |
5fd30ee7 | 1231 | list_for_each_entry(ops, &net->rules_ops, list) |
76c72d4f | 1232 | attach_rules(&ops->rules_list, dev); |
14c0b97d TG |
1233 | break; |
1234 | ||
946c032e MŻ |
1235 | case NETDEV_CHANGENAME: |
1236 | list_for_each_entry(ops, &net->rules_ops, list) { | |
1237 | detach_rules(&ops->rules_list, dev); | |
1238 | attach_rules(&ops->rules_list, dev); | |
1239 | } | |
1240 | break; | |
1241 | ||
14c0b97d | 1242 | case NETDEV_UNREGISTER: |
5fd30ee7 | 1243 | list_for_each_entry(ops, &net->rules_ops, list) |
76c72d4f | 1244 | detach_rules(&ops->rules_list, dev); |
14c0b97d TG |
1245 | break; |
1246 | } | |
1247 | ||
14c0b97d TG |
1248 | return NOTIFY_DONE; |
1249 | } | |
1250 | ||
1251 | static struct notifier_block fib_rules_notifier = { | |
1252 | .notifier_call = fib_rules_event, | |
1253 | }; | |
1254 | ||
2c8c1e72 | 1255 | static int __net_init fib_rules_net_init(struct net *net) |
5fd30ee7 DL |
1256 | { |
1257 | INIT_LIST_HEAD(&net->rules_ops); | |
1258 | spin_lock_init(&net->rules_mod_lock); | |
1259 | return 0; | |
1260 | } | |
1261 | ||
ce2b7db3 VA |
1262 | static void __net_exit fib_rules_net_exit(struct net *net) |
1263 | { | |
1264 | WARN_ON_ONCE(!list_empty(&net->rules_ops)); | |
1265 | } | |
1266 | ||
5fd30ee7 DL |
1267 | static struct pernet_operations fib_rules_net_ops = { |
1268 | .init = fib_rules_net_init, | |
ce2b7db3 | 1269 | .exit = fib_rules_net_exit, |
5fd30ee7 DL |
1270 | }; |
1271 | ||
14c0b97d TG |
1272 | static int __init fib_rules_init(void) |
1273 | { | |
5fd30ee7 | 1274 | int err; |
b97bac64 FW |
1275 | rtnl_register(PF_UNSPEC, RTM_NEWRULE, fib_nl_newrule, NULL, 0); |
1276 | rtnl_register(PF_UNSPEC, RTM_DELRULE, fib_nl_delrule, NULL, 0); | |
1277 | rtnl_register(PF_UNSPEC, RTM_GETRULE, NULL, fib_nl_dumprule, 0); | |
9d9e6a58 | 1278 | |
5d6d4809 | 1279 | err = register_pernet_subsys(&fib_rules_net_ops); |
5fd30ee7 DL |
1280 | if (err < 0) |
1281 | goto fail; | |
1282 | ||
5d6d4809 | 1283 | err = register_netdevice_notifier(&fib_rules_notifier); |
5fd30ee7 DL |
1284 | if (err < 0) |
1285 | goto fail_unregister; | |
5d6d4809 | 1286 | |
5fd30ee7 DL |
1287 | return 0; |
1288 | ||
1289 | fail_unregister: | |
5d6d4809 | 1290 | unregister_pernet_subsys(&fib_rules_net_ops); |
5fd30ee7 DL |
1291 | fail: |
1292 | rtnl_unregister(PF_UNSPEC, RTM_NEWRULE); | |
1293 | rtnl_unregister(PF_UNSPEC, RTM_DELRULE); | |
1294 | rtnl_unregister(PF_UNSPEC, RTM_GETRULE); | |
1295 | return err; | |
14c0b97d TG |
1296 | } |
1297 | ||
1298 | subsys_initcall(fib_rules_init); |