2 * net/core/fib_rules.c Generic Routing Rules
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License as
6 * published by the Free Software Foundation, version 2.
8 * Authors: Thomas Graf <tgraf@suug.ch>
11 #include <linux/types.h>
12 #include <linux/kernel.h>
13 #include <linux/list.h>
14 #include <net/net_namespace.h>
16 #include <net/fib_rules.h>
18 int fib_default_rule_add(struct fib_rules_ops *ops,
19 u32 pref, u32 table, u32 flags)
23 r = kzalloc(ops->rule_size, GFP_KERNEL);
27 atomic_set(&r->refcnt, 1);
28 r->action = FR_ACT_TO_TBL;
32 r->fr_net = hold_net(ops->fro_net);
34 /* The lock is not required here, the list in unreacheable
35 * at the moment this function is called */
36 list_add_tail(&r->list, &ops->rules_list);
39 EXPORT_SYMBOL(fib_default_rule_add);
41 static void notify_rule_change(int event, struct fib_rule *rule,
42 struct fib_rules_ops *ops, struct nlmsghdr *nlh,
45 static struct fib_rules_ops *lookup_rules_ops(struct net *net, int family)
47 struct fib_rules_ops *ops;
50 list_for_each_entry_rcu(ops, &net->rules_ops, list) {
51 if (ops->family == family) {
52 if (!try_module_get(ops->owner))
63 static void rules_ops_put(struct fib_rules_ops *ops)
66 module_put(ops->owner);
69 static void flush_route_cache(struct fib_rules_ops *ops)
72 ops->flush_cache(ops);
75 static int __fib_rules_register(struct fib_rules_ops *ops)
78 struct fib_rules_ops *o;
83 if (ops->rule_size < sizeof(struct fib_rule))
86 if (ops->match == NULL || ops->configure == NULL ||
87 ops->compare == NULL || ops->fill == NULL ||
91 spin_lock(&net->rules_mod_lock);
92 list_for_each_entry(o, &net->rules_ops, list)
93 if (ops->family == o->family)
97 list_add_tail_rcu(&ops->list, &net->rules_ops);
100 spin_unlock(&net->rules_mod_lock);
105 struct fib_rules_ops *
106 fib_rules_register(struct fib_rules_ops *tmpl, struct net *net)
108 struct fib_rules_ops *ops;
111 ops = kmemdup(tmpl, sizeof (*ops), GFP_KERNEL);
113 return ERR_PTR(-ENOMEM);
115 INIT_LIST_HEAD(&ops->rules_list);
118 err = __fib_rules_register(ops);
127 EXPORT_SYMBOL_GPL(fib_rules_register);
129 void fib_rules_cleanup_ops(struct fib_rules_ops *ops)
131 struct fib_rule *rule, *tmp;
133 list_for_each_entry_safe(rule, tmp, &ops->rules_list, list) {
134 list_del_rcu(&rule->list);
138 EXPORT_SYMBOL_GPL(fib_rules_cleanup_ops);
140 static void fib_rules_put_rcu(struct rcu_head *head)
142 struct fib_rules_ops *ops = container_of(head, struct fib_rules_ops, rcu);
143 struct net *net = ops->fro_net;
149 void fib_rules_unregister(struct fib_rules_ops *ops)
151 struct net *net = ops->fro_net;
153 spin_lock(&net->rules_mod_lock);
154 list_del_rcu(&ops->list);
155 fib_rules_cleanup_ops(ops);
156 spin_unlock(&net->rules_mod_lock);
158 call_rcu(&ops->rcu, fib_rules_put_rcu);
161 EXPORT_SYMBOL_GPL(fib_rules_unregister);
163 static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops,
164 struct flowi *fl, int flags)
168 if (rule->iifindex && (rule->iifindex != fl->iif))
171 if (rule->oifindex && (rule->oifindex != fl->oif))
174 if ((rule->mark ^ fl->mark) & rule->mark_mask)
177 ret = ops->match(rule, fl, flags);
179 return (rule->flags & FIB_RULE_INVERT) ? !ret : ret;
182 int fib_rules_lookup(struct fib_rules_ops *ops, struct flowi *fl,
183 int flags, struct fib_lookup_arg *arg)
185 struct fib_rule *rule;
190 list_for_each_entry_rcu(rule, &ops->rules_list, list) {
192 if (!fib_rule_match(rule, ops, fl, flags))
195 if (rule->action == FR_ACT_GOTO) {
196 struct fib_rule *target;
198 target = rcu_dereference(rule->ctarget);
199 if (target == NULL) {
205 } else if (rule->action == FR_ACT_NOP)
208 err = ops->action(rule, fl, flags, arg);
210 if (err != -EAGAIN) {
224 EXPORT_SYMBOL_GPL(fib_rules_lookup);
226 static int validate_rulemsg(struct fib_rule_hdr *frh, struct nlattr **tb,
227 struct fib_rules_ops *ops)
232 if (tb[FRA_SRC] == NULL ||
233 frh->src_len > (ops->addr_size * 8) ||
234 nla_len(tb[FRA_SRC]) != ops->addr_size)
238 if (tb[FRA_DST] == NULL ||
239 frh->dst_len > (ops->addr_size * 8) ||
240 nla_len(tb[FRA_DST]) != ops->addr_size)
248 static int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
250 struct net *net = sock_net(skb->sk);
251 struct fib_rule_hdr *frh = nlmsg_data(nlh);
252 struct fib_rules_ops *ops = NULL;
253 struct fib_rule *rule, *r, *last = NULL;
254 struct nlattr *tb[FRA_MAX+1];
255 int err = -EINVAL, unresolved = 0;
257 if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh)))
260 ops = lookup_rules_ops(net, frh->family);
266 err = nlmsg_parse(nlh, sizeof(*frh), tb, FRA_MAX, ops->policy);
270 err = validate_rulemsg(frh, tb, ops);
274 rule = kzalloc(ops->rule_size, GFP_KERNEL);
279 rule->fr_net = hold_net(net);
281 if (tb[FRA_PRIORITY])
282 rule->pref = nla_get_u32(tb[FRA_PRIORITY]);
284 if (tb[FRA_IIFNAME]) {
285 struct net_device *dev;
288 nla_strlcpy(rule->iifname, tb[FRA_IIFNAME], IFNAMSIZ);
289 dev = __dev_get_by_name(net, rule->iifname);
291 rule->iifindex = dev->ifindex;
294 if (tb[FRA_OIFNAME]) {
295 struct net_device *dev;
298 nla_strlcpy(rule->oifname, tb[FRA_OIFNAME], IFNAMSIZ);
299 dev = __dev_get_by_name(net, rule->oifname);
301 rule->oifindex = dev->ifindex;
304 if (tb[FRA_FWMARK]) {
305 rule->mark = nla_get_u32(tb[FRA_FWMARK]);
307 /* compatibility: if the mark value is non-zero all bits
308 * are compared unless a mask is explicitly specified.
310 rule->mark_mask = 0xFFFFFFFF;
314 rule->mark_mask = nla_get_u32(tb[FRA_FWMASK]);
316 rule->action = frh->action;
317 rule->flags = frh->flags;
318 rule->table = frh_get_table(frh, tb);
320 if (!tb[FRA_PRIORITY] && ops->default_pref)
321 rule->pref = ops->default_pref(ops);
325 if (rule->action != FR_ACT_GOTO)
328 rule->target = nla_get_u32(tb[FRA_GOTO]);
329 /* Backward jumps are prohibited to avoid endless loops */
330 if (rule->target <= rule->pref)
333 list_for_each_entry(r, &ops->rules_list, list) {
334 if (r->pref == rule->target) {
340 if (rule->ctarget == NULL)
342 } else if (rule->action == FR_ACT_GOTO)
345 err = ops->configure(rule, skb, frh, tb);
349 list_for_each_entry(r, &ops->rules_list, list) {
350 if (r->pref > rule->pref)
357 if (ops->unresolved_rules) {
359 * There are unresolved goto rules in the list, check if
360 * any of them are pointing to this new rule.
362 list_for_each_entry(r, &ops->rules_list, list) {
363 if (r->action == FR_ACT_GOTO &&
364 r->target == rule->pref) {
365 BUG_ON(r->ctarget != NULL);
366 rcu_assign_pointer(r->ctarget, rule);
367 if (--ops->unresolved_rules == 0)
373 if (rule->action == FR_ACT_GOTO)
374 ops->nr_goto_rules++;
377 ops->unresolved_rules++;
380 list_add_rcu(&rule->list, &last->list);
382 list_add_rcu(&rule->list, &ops->rules_list);
384 notify_rule_change(RTM_NEWRULE, rule, ops, nlh, NETLINK_CB(skb).pid);
385 flush_route_cache(ops);
390 release_net(rule->fr_net);
397 static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
399 struct net *net = sock_net(skb->sk);
400 struct fib_rule_hdr *frh = nlmsg_data(nlh);
401 struct fib_rules_ops *ops = NULL;
402 struct fib_rule *rule, *tmp;
403 struct nlattr *tb[FRA_MAX+1];
406 if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh)))
409 ops = lookup_rules_ops(net, frh->family);
415 err = nlmsg_parse(nlh, sizeof(*frh), tb, FRA_MAX, ops->policy);
419 err = validate_rulemsg(frh, tb, ops);
423 list_for_each_entry(rule, &ops->rules_list, list) {
424 if (frh->action && (frh->action != rule->action))
427 if (frh->table && (frh_get_table(frh, tb) != rule->table))
430 if (tb[FRA_PRIORITY] &&
431 (rule->pref != nla_get_u32(tb[FRA_PRIORITY])))
434 if (tb[FRA_IIFNAME] &&
435 nla_strcmp(tb[FRA_IIFNAME], rule->iifname))
438 if (tb[FRA_OIFNAME] &&
439 nla_strcmp(tb[FRA_OIFNAME], rule->oifname))
442 if (tb[FRA_FWMARK] &&
443 (rule->mark != nla_get_u32(tb[FRA_FWMARK])))
446 if (tb[FRA_FWMASK] &&
447 (rule->mark_mask != nla_get_u32(tb[FRA_FWMASK])))
450 if (!ops->compare(rule, frh, tb))
453 if (rule->flags & FIB_RULE_PERMANENT) {
458 list_del_rcu(&rule->list);
460 if (rule->action == FR_ACT_GOTO)
461 ops->nr_goto_rules--;
464 * Check if this rule is a target to any of them. If so,
465 * disable them. As this operation is eventually very
466 * expensive, it is only performed if goto rules have
467 * actually been added.
469 if (ops->nr_goto_rules > 0) {
470 list_for_each_entry(tmp, &ops->rules_list, list) {
471 if (tmp->ctarget == rule) {
472 rcu_assign_pointer(tmp->ctarget, NULL);
473 ops->unresolved_rules++;
479 notify_rule_change(RTM_DELRULE, rule, ops, nlh,
480 NETLINK_CB(skb).pid);
482 flush_route_cache(ops);
493 static inline size_t fib_rule_nlmsg_size(struct fib_rules_ops *ops,
494 struct fib_rule *rule)
496 size_t payload = NLMSG_ALIGN(sizeof(struct fib_rule_hdr))
497 + nla_total_size(IFNAMSIZ) /* FRA_IIFNAME */
498 + nla_total_size(IFNAMSIZ) /* FRA_OIFNAME */
499 + nla_total_size(4) /* FRA_PRIORITY */
500 + nla_total_size(4) /* FRA_TABLE */
501 + nla_total_size(4) /* FRA_FWMARK */
502 + nla_total_size(4); /* FRA_FWMASK */
504 if (ops->nlmsg_payload)
505 payload += ops->nlmsg_payload(rule);
510 static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
511 u32 pid, u32 seq, int type, int flags,
512 struct fib_rules_ops *ops)
514 struct nlmsghdr *nlh;
515 struct fib_rule_hdr *frh;
517 nlh = nlmsg_put(skb, pid, seq, type, sizeof(*frh), flags);
521 frh = nlmsg_data(nlh);
522 frh->table = rule->table;
523 NLA_PUT_U32(skb, FRA_TABLE, rule->table);
526 frh->action = rule->action;
527 frh->flags = rule->flags;
529 if (rule->action == FR_ACT_GOTO && rule->ctarget == NULL)
530 frh->flags |= FIB_RULE_UNRESOLVED;
532 if (rule->iifname[0]) {
533 NLA_PUT_STRING(skb, FRA_IIFNAME, rule->iifname);
535 if (rule->iifindex == -1)
536 frh->flags |= FIB_RULE_IIF_DETACHED;
539 if (rule->oifname[0]) {
540 NLA_PUT_STRING(skb, FRA_OIFNAME, rule->oifname);
542 if (rule->oifindex == -1)
543 frh->flags |= FIB_RULE_OIF_DETACHED;
547 NLA_PUT_U32(skb, FRA_PRIORITY, rule->pref);
550 NLA_PUT_U32(skb, FRA_FWMARK, rule->mark);
552 if (rule->mark_mask || rule->mark)
553 NLA_PUT_U32(skb, FRA_FWMASK, rule->mark_mask);
556 NLA_PUT_U32(skb, FRA_GOTO, rule->target);
558 if (ops->fill(rule, skb, frh) < 0)
559 goto nla_put_failure;
561 return nlmsg_end(skb, nlh);
564 nlmsg_cancel(skb, nlh);
568 static int dump_rules(struct sk_buff *skb, struct netlink_callback *cb,
569 struct fib_rules_ops *ops)
572 struct fib_rule *rule;
574 list_for_each_entry(rule, &ops->rules_list, list) {
575 if (idx < cb->args[1])
578 if (fib_nl_fill_rule(skb, rule, NETLINK_CB(cb->skb).pid,
579 cb->nlh->nlmsg_seq, RTM_NEWRULE,
580 NLM_F_MULTI, ops) < 0)
591 static int fib_nl_dumprule(struct sk_buff *skb, struct netlink_callback *cb)
593 struct net *net = sock_net(skb->sk);
594 struct fib_rules_ops *ops;
597 family = rtnl_msg_family(cb->nlh);
598 if (family != AF_UNSPEC) {
599 /* Protocol specific dump request */
600 ops = lookup_rules_ops(net, family);
602 return -EAFNOSUPPORT;
604 return dump_rules(skb, cb, ops);
608 list_for_each_entry_rcu(ops, &net->rules_ops, list) {
609 if (idx < cb->args[0] || !try_module_get(ops->owner))
612 if (dump_rules(skb, cb, ops) < 0)
625 static void notify_rule_change(int event, struct fib_rule *rule,
626 struct fib_rules_ops *ops, struct nlmsghdr *nlh,
634 skb = nlmsg_new(fib_rule_nlmsg_size(ops, rule), GFP_KERNEL);
638 err = fib_nl_fill_rule(skb, rule, pid, nlh->nlmsg_seq, event, 0, ops);
640 /* -EMSGSIZE implies BUG in fib_rule_nlmsg_size() */
641 WARN_ON(err == -EMSGSIZE);
646 rtnl_notify(skb, net, pid, ops->nlgroup, nlh, GFP_KERNEL);
650 rtnl_set_sk_err(net, ops->nlgroup, err);
653 static void attach_rules(struct list_head *rules, struct net_device *dev)
655 struct fib_rule *rule;
657 list_for_each_entry(rule, rules, list) {
658 if (rule->iifindex == -1 &&
659 strcmp(dev->name, rule->iifname) == 0)
660 rule->iifindex = dev->ifindex;
661 if (rule->oifindex == -1 &&
662 strcmp(dev->name, rule->oifname) == 0)
663 rule->oifindex = dev->ifindex;
667 static void detach_rules(struct list_head *rules, struct net_device *dev)
669 struct fib_rule *rule;
671 list_for_each_entry(rule, rules, list) {
672 if (rule->iifindex == dev->ifindex)
674 if (rule->oifindex == dev->ifindex)
680 static int fib_rules_event(struct notifier_block *this, unsigned long event,
683 struct net_device *dev = ptr;
684 struct net *net = dev_net(dev);
685 struct fib_rules_ops *ops;
691 case NETDEV_REGISTER:
692 list_for_each_entry(ops, &net->rules_ops, list)
693 attach_rules(&ops->rules_list, dev);
696 case NETDEV_UNREGISTER:
697 list_for_each_entry(ops, &net->rules_ops, list)
698 detach_rules(&ops->rules_list, dev);
707 static struct notifier_block fib_rules_notifier = {
708 .notifier_call = fib_rules_event,
711 static int fib_rules_net_init(struct net *net)
713 INIT_LIST_HEAD(&net->rules_ops);
714 spin_lock_init(&net->rules_mod_lock);
718 static struct pernet_operations fib_rules_net_ops = {
719 .init = fib_rules_net_init,
722 static int __init fib_rules_init(void)
725 rtnl_register(PF_UNSPEC, RTM_NEWRULE, fib_nl_newrule, NULL);
726 rtnl_register(PF_UNSPEC, RTM_DELRULE, fib_nl_delrule, NULL);
727 rtnl_register(PF_UNSPEC, RTM_GETRULE, NULL, fib_nl_dumprule);
729 err = register_pernet_subsys(&fib_rules_net_ops);
733 err = register_netdevice_notifier(&fib_rules_notifier);
735 goto fail_unregister;
740 unregister_pernet_subsys(&fib_rules_net_ops);
742 rtnl_unregister(PF_UNSPEC, RTM_NEWRULE);
743 rtnl_unregister(PF_UNSPEC, RTM_DELRULE);
744 rtnl_unregister(PF_UNSPEC, RTM_GETRULE);
748 subsys_initcall(fib_rules_init);