fib_rules.c 22.0 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12
/*
 * net/core/fib_rules.c		Generic Routing Rules
 *
 *	This program is free software; you can redistribute it and/or
 *	modify it under the terms of the GNU General Public License as
 *	published by the Free Software Foundation, version 2.
 *
 * Authors:	Thomas Graf <tgraf@suug.ch>
 */

#include <linux/types.h>
#include <linux/kernel.h>
13
#include <linux/slab.h>
14
#include <linux/list.h>
15
#include <linux/module.h>
16
#include <net/net_namespace.h>
17
#include <net/sock.h>
18
#include <net/fib_rules.h>
19
#include <net/ip_tunnels.h>
20

21 22 23 24 25
static const struct fib_kuid_range fib_kuid_range_unset = {
	KUIDT_INIT(0),
	KUIDT_INIT(~0),
};

26 27 28 29 30 31 32 33 34 35 36 37 38 39
bool fib_rule_matchall(const struct fib_rule *rule)
{
	if (rule->iifindex || rule->oifindex || rule->mark || rule->tun_id ||
	    rule->flags)
		return false;
	if (rule->suppress_ifgroup != -1 || rule->suppress_prefixlen != -1)
		return false;
	if (!uid_eq(rule->uid_range.start, fib_kuid_range_unset.start) ||
	    !uid_eq(rule->uid_range.end, fib_kuid_range_unset.end))
		return false;
	return true;
}
EXPORT_SYMBOL_GPL(fib_rule_matchall);

40 41 42 43 44 45 46 47 48 49 50 51 52 53
int fib_default_rule_add(struct fib_rules_ops *ops,
			 u32 pref, u32 table, u32 flags)
{
	struct fib_rule *r;

	r = kzalloc(ops->rule_size, GFP_KERNEL);
	if (r == NULL)
		return -ENOMEM;

	atomic_set(&r->refcnt, 1);
	r->action = FR_ACT_TO_TBL;
	r->pref = pref;
	r->table = table;
	r->flags = flags;
54
	r->fr_net = ops->fro_net;
55
	r->uid_range = fib_kuid_range_unset;
56

57 58 59
	r->suppress_prefixlen = -1;
	r->suppress_ifgroup = -1;

60 61 62 63 64 65 66
	/* The lock is not required here, the list in unreacheable
	 * at the moment this function is called */
	list_add_tail(&r->list, &ops->rules_list);
	return 0;
}
EXPORT_SYMBOL(fib_default_rule_add);

67
static u32 fib_default_rule_pref(struct fib_rules_ops *ops)
68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83
{
	struct list_head *pos;
	struct fib_rule *rule;

	if (!list_empty(&ops->rules_list)) {
		pos = ops->rules_list.next;
		if (pos->next != &ops->rules_list) {
			rule = list_entry(pos->next, struct fib_rule, list);
			if (rule->pref)
				return rule->pref - 1;
		}
	}

	return 0;
}

D
Denis V. Lunev 已提交
84
static void notify_rule_change(int event, struct fib_rule *rule,
85 86
			       struct fib_rules_ops *ops, struct nlmsghdr *nlh,
			       u32 pid);
87

88
static struct fib_rules_ops *lookup_rules_ops(struct net *net, int family)
89 90 91 92
{
	struct fib_rules_ops *ops;

	rcu_read_lock();
93
	list_for_each_entry_rcu(ops, &net->rules_ops, list) {
94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111
		if (ops->family == family) {
			if (!try_module_get(ops->owner))
				ops = NULL;
			rcu_read_unlock();
			return ops;
		}
	}
	rcu_read_unlock();

	return NULL;
}

static void rules_ops_put(struct fib_rules_ops *ops)
{
	if (ops)
		module_put(ops->owner);
}

112 113 114
static void flush_route_cache(struct fib_rules_ops *ops)
{
	if (ops->flush_cache)
115
		ops->flush_cache(ops);
116 117
}

118
static int __fib_rules_register(struct fib_rules_ops *ops)
119 120 121
{
	int err = -EEXIST;
	struct fib_rules_ops *o;
D
Denis V. Lunev 已提交
122 123 124
	struct net *net;

	net = ops->fro_net;
125 126 127 128 129 130 131 132 133

	if (ops->rule_size < sizeof(struct fib_rule))
		return -EINVAL;

	if (ops->match == NULL || ops->configure == NULL ||
	    ops->compare == NULL || ops->fill == NULL ||
	    ops->action == NULL)
		return -EINVAL;

134 135
	spin_lock(&net->rules_mod_lock);
	list_for_each_entry(o, &net->rules_ops, list)
136 137 138
		if (ops->family == o->family)
			goto errout;

139
	list_add_tail_rcu(&ops->list, &net->rules_ops);
140 141
	err = 0;
errout:
142
	spin_unlock(&net->rules_mod_lock);
143 144 145 146

	return err;
}

147
struct fib_rules_ops *
148
fib_rules_register(const struct fib_rules_ops *tmpl, struct net *net)
149 150 151 152
{
	struct fib_rules_ops *ops;
	int err;

153
	ops = kmemdup(tmpl, sizeof(*ops), GFP_KERNEL);
154 155 156 157 158 159 160 161 162 163 164 165 166 167
	if (ops == NULL)
		return ERR_PTR(-ENOMEM);

	INIT_LIST_HEAD(&ops->rules_list);
	ops->fro_net = net;

	err = __fib_rules_register(ops);
	if (err) {
		kfree(ops);
		ops = ERR_PTR(err);
	}

	return ops;
}
168 169
EXPORT_SYMBOL_GPL(fib_rules_register);

170
static void fib_rules_cleanup_ops(struct fib_rules_ops *ops)
171 172 173
{
	struct fib_rule *rule, *tmp;

174
	list_for_each_entry_safe(rule, tmp, &ops->rules_list, list) {
175
		list_del_rcu(&rule->list);
176 177
		if (ops->delete)
			ops->delete(rule);
178 179 180 181
		fib_rule_put(rule);
	}
}

D
Denis V. Lunev 已提交
182
void fib_rules_unregister(struct fib_rules_ops *ops)
183
{
D
Denis V. Lunev 已提交
184
	struct net *net = ops->fro_net;
185

186
	spin_lock(&net->rules_mod_lock);
187
	list_del_rcu(&ops->list);
188
	spin_unlock(&net->rules_mod_lock);
189

190
	fib_rules_cleanup_ops(ops);
191
	kfree_rcu(ops, rcu);
192 193 194
}
EXPORT_SYMBOL_GPL(fib_rules_unregister);

195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222
static int uid_range_set(struct fib_kuid_range *range)
{
	return uid_valid(range->start) && uid_valid(range->end);
}

static struct fib_kuid_range nla_get_kuid_range(struct nlattr **tb)
{
	struct fib_rule_uid_range *in;
	struct fib_kuid_range out;

	in = (struct fib_rule_uid_range *)nla_data(tb[FRA_UID_RANGE]);

	out.start = make_kuid(current_user_ns(), in->start);
	out.end = make_kuid(current_user_ns(), in->end);

	return out;
}

static int nla_put_uid_range(struct sk_buff *skb, struct fib_kuid_range *range)
{
	struct fib_rule_uid_range out = {
		from_kuid_munged(current_user_ns(), range->start),
		from_kuid_munged(current_user_ns(), range->end)
	};

	return nla_put(skb, FRA_UID_RANGE, sizeof(out), &out);
}

223
static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops,
D
David Ahern 已提交
224 225
			  struct flowi *fl, int flags,
			  struct fib_lookup_arg *arg)
226 227 228
{
	int ret = 0;

229
	if (rule->iifindex && (rule->iifindex != fl->flowi_iif))
230 231
		goto out;

232
	if (rule->oifindex && (rule->oifindex != fl->flowi_oif))
233 234
		goto out;

235
	if ((rule->mark ^ fl->flowi_mark) & rule->mark_mask)
236 237
		goto out;

238 239 240
	if (rule->tun_id && (rule->tun_id != fl->flowi_tun_key.tun_id))
		goto out;

D
David Ahern 已提交
241 242 243
	if (rule->l3mdev && !l3mdev_fib_rule_match(rule->fr_net, fl, arg))
		goto out;

244 245 246 247
	if (uid_lt(fl->flowi_uid, rule->uid_range.start) ||
	    uid_gt(fl->flowi_uid, rule->uid_range.end))
		goto out;

248 249 250 251 252
	ret = ops->match(rule, fl, flags);
out:
	return (rule->flags & FIB_RULE_INVERT) ? !ret : ret;
}

253 254 255 256 257 258 259 260
int fib_rules_lookup(struct fib_rules_ops *ops, struct flowi *fl,
		     int flags, struct fib_lookup_arg *arg)
{
	struct fib_rule *rule;
	int err;

	rcu_read_lock();

261
	list_for_each_entry_rcu(rule, &ops->rules_list, list) {
T
Thomas Graf 已提交
262
jumped:
D
David Ahern 已提交
263
		if (!fib_rule_match(rule, ops, fl, flags, arg))
264 265
			continue;

T
Thomas Graf 已提交
266 267 268 269 270 271 272 273 274 275
		if (rule->action == FR_ACT_GOTO) {
			struct fib_rule *target;

			target = rcu_dereference(rule->ctarget);
			if (target == NULL) {
				continue;
			} else {
				rule = target;
				goto jumped;
			}
276 277 278
		} else if (rule->action == FR_ACT_NOP)
			continue;
		else
T
Thomas Graf 已提交
279 280
			err = ops->action(rule, fl, flags, arg);

281 282 283
		if (!err && ops->suppress && ops->suppress(rule, arg))
			continue;

284
		if (err != -EAGAIN) {
E
Eric Dumazet 已提交
285 286
			if ((arg->flags & FIB_LOOKUP_NOREF) ||
			    likely(atomic_inc_not_zero(&rule->refcnt))) {
287 288 289 290
				arg->rule = rule;
				goto out;
			}
			break;
291 292 293
		}
	}

294
	err = -ESRCH;
295 296 297 298 299 300 301
out:
	rcu_read_unlock();

	return err;
}
EXPORT_SYMBOL_GPL(fib_rules_lookup);

302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323
static int validate_rulemsg(struct fib_rule_hdr *frh, struct nlattr **tb,
			    struct fib_rules_ops *ops)
{
	int err = -EINVAL;

	if (frh->src_len)
		if (tb[FRA_SRC] == NULL ||
		    frh->src_len > (ops->addr_size * 8) ||
		    nla_len(tb[FRA_SRC]) != ops->addr_size)
			goto errout;

	if (frh->dst_len)
		if (tb[FRA_DST] == NULL ||
		    frh->dst_len > (ops->addr_size * 8) ||
		    nla_len(tb[FRA_DST]) != ops->addr_size)
			goto errout;

	err = 0;
errout:
	return err;
}

324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359
static int rule_exists(struct fib_rules_ops *ops, struct fib_rule_hdr *frh,
		       struct nlattr **tb, struct fib_rule *rule)
{
	struct fib_rule *r;

	list_for_each_entry(r, &ops->rules_list, list) {
		if (r->action != rule->action)
			continue;

		if (r->table != rule->table)
			continue;

		if (r->pref != rule->pref)
			continue;

		if (memcmp(r->iifname, rule->iifname, IFNAMSIZ))
			continue;

		if (memcmp(r->oifname, rule->oifname, IFNAMSIZ))
			continue;

		if (r->mark != rule->mark)
			continue;

		if (r->mark_mask != rule->mark_mask)
			continue;

		if (r->tun_id != rule->tun_id)
			continue;

		if (r->fr_net != rule->fr_net)
			continue;

		if (r->l3mdev != rule->l3mdev)
			continue;

360 361 362 363
		if (!uid_eq(r->uid_range.start, rule->uid_range.start) ||
		    !uid_eq(r->uid_range.end, rule->uid_range.end))
			continue;

364 365 366 367 368 369 370
		if (!ops->compare(r, frh, tb))
			continue;
		return 1;
	}
	return 0;
}

371 372
int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,
		   struct netlink_ext_ack *extack)
373
{
374
	struct net *net = sock_net(skb->sk);
375 376 377 378
	struct fib_rule_hdr *frh = nlmsg_data(nlh);
	struct fib_rules_ops *ops = NULL;
	struct fib_rule *rule, *r, *last = NULL;
	struct nlattr *tb[FRA_MAX+1];
T
Thomas Graf 已提交
379
	int err = -EINVAL, unresolved = 0;
380 381 382 383

	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh)))
		goto errout;

384
	ops = lookup_rules_ops(net, frh->family);
385
	if (ops == NULL) {
386
		err = -EAFNOSUPPORT;
387 388 389
		goto errout;
	}

390
	err = nlmsg_parse(nlh, sizeof(*frh), tb, FRA_MAX, ops->policy, extack);
391 392 393
	if (err < 0)
		goto errout;

394 395 396 397
	err = validate_rulemsg(frh, tb, ops);
	if (err < 0)
		goto errout;

398 399 400 401 402
	rule = kzalloc(ops->rule_size, GFP_KERNEL);
	if (rule == NULL) {
		err = -ENOMEM;
		goto errout;
	}
403
	rule->fr_net = net;
404

405 406
	rule->pref = tb[FRA_PRIORITY] ? nla_get_u32(tb[FRA_PRIORITY])
	                              : fib_default_rule_pref(ops);
407

408
	if (tb[FRA_IIFNAME]) {
409 410
		struct net_device *dev;

411 412 413
		rule->iifindex = -1;
		nla_strlcpy(rule->iifname, tb[FRA_IIFNAME], IFNAMSIZ);
		dev = __dev_get_by_name(net, rule->iifname);
414
		if (dev)
415
			rule->iifindex = dev->ifindex;
416 417
	}

418 419 420 421 422 423 424 425 426 427
	if (tb[FRA_OIFNAME]) {
		struct net_device *dev;

		rule->oifindex = -1;
		nla_strlcpy(rule->oifname, tb[FRA_OIFNAME], IFNAMSIZ);
		dev = __dev_get_by_name(net, rule->oifname);
		if (dev)
			rule->oifindex = dev->ifindex;
	}

428 429 430 431 432 433 434 435 436 437 438 439
	if (tb[FRA_FWMARK]) {
		rule->mark = nla_get_u32(tb[FRA_FWMARK]);
		if (rule->mark)
			/* compatibility: if the mark value is non-zero all bits
			 * are compared unless a mask is explicitly specified.
			 */
			rule->mark_mask = 0xFFFFFFFF;
	}

	if (tb[FRA_FWMASK])
		rule->mark_mask = nla_get_u32(tb[FRA_FWMASK]);

440 441 442
	if (tb[FRA_TUN_ID])
		rule->tun_id = nla_get_be64(tb[FRA_TUN_ID]);

W
Wei Yongjun 已提交
443
	err = -EINVAL;
D
David Ahern 已提交
444 445 446 447 448 449 450 451
	if (tb[FRA_L3MDEV]) {
#ifdef CONFIG_NET_L3_MASTER_DEV
		rule->l3mdev = nla_get_u8(tb[FRA_L3MDEV]);
		if (rule->l3mdev != 1)
#endif
			goto errout_free;
	}

452 453
	rule->action = frh->action;
	rule->flags = frh->flags;
454
	rule->table = frh_get_table(frh, tb);
455 456 457 458
	if (tb[FRA_SUPPRESS_PREFIXLEN])
		rule->suppress_prefixlen = nla_get_u32(tb[FRA_SUPPRESS_PREFIXLEN]);
	else
		rule->suppress_prefixlen = -1;
459

460 461
	if (tb[FRA_SUPPRESS_IFGROUP])
		rule->suppress_ifgroup = nla_get_u32(tb[FRA_SUPPRESS_IFGROUP]);
462 463
	else
		rule->suppress_ifgroup = -1;
464

T
Thomas Graf 已提交
465 466 467 468 469 470 471 472 473
	if (tb[FRA_GOTO]) {
		if (rule->action != FR_ACT_GOTO)
			goto errout_free;

		rule->target = nla_get_u32(tb[FRA_GOTO]);
		/* Backward jumps are prohibited to avoid endless loops */
		if (rule->target <= rule->pref)
			goto errout_free;

474
		list_for_each_entry(r, &ops->rules_list, list) {
T
Thomas Graf 已提交
475
			if (r->pref == rule->target) {
E
Eric Dumazet 已提交
476
				RCU_INIT_POINTER(rule->ctarget, r);
T
Thomas Graf 已提交
477 478 479 480
				break;
			}
		}

E
Eric Dumazet 已提交
481
		if (rcu_dereference_protected(rule->ctarget, 1) == NULL)
T
Thomas Graf 已提交
482 483 484 485
			unresolved = 1;
	} else if (rule->action == FR_ACT_GOTO)
		goto errout_free;

D
David Ahern 已提交
486 487 488
	if (rule->l3mdev && rule->table)
		goto errout_free;

489 490 491 492 493 494 495 496 497 498 499 500 501 502 503
	if (tb[FRA_UID_RANGE]) {
		if (current_user_ns() != net->user_ns) {
			err = -EPERM;
			goto errout_free;
		}

		rule->uid_range = nla_get_kuid_range(tb);

		if (!uid_range_set(&rule->uid_range) ||
		    !uid_lte(rule->uid_range.start, rule->uid_range.end))
			goto errout_free;
	} else {
		rule->uid_range = fib_kuid_range_unset;
	}

504 505 506 507 508 509
	if ((nlh->nlmsg_flags & NLM_F_EXCL) &&
	    rule_exists(ops, frh, tb, rule)) {
		err = -EEXIST;
		goto errout_free;
	}

510
	err = ops->configure(rule, skb, frh, tb);
511 512 513
	if (err < 0)
		goto errout_free;

514
	list_for_each_entry(r, &ops->rules_list, list) {
515 516 517 518 519 520 521
		if (r->pref > rule->pref)
			break;
		last = r;
	}

	fib_rule_get(rule);

E
Eric Dumazet 已提交
522 523 524 525 526
	if (last)
		list_add_rcu(&rule->list, &last->list);
	else
		list_add_rcu(&rule->list, &ops->rules_list);

T
Thomas Graf 已提交
527 528 529 530 531
	if (ops->unresolved_rules) {
		/*
		 * There are unresolved goto rules in the list, check if
		 * any of them are pointing to this new rule.
		 */
532
		list_for_each_entry(r, &ops->rules_list, list) {
T
Thomas Graf 已提交
533
			if (r->action == FR_ACT_GOTO &&
534 535
			    r->target == rule->pref &&
			    rtnl_dereference(r->ctarget) == NULL) {
T
Thomas Graf 已提交
536 537 538 539 540 541 542 543 544 545 546 547 548
				rcu_assign_pointer(r->ctarget, rule);
				if (--ops->unresolved_rules == 0)
					break;
			}
		}
	}

	if (rule->action == FR_ACT_GOTO)
		ops->nr_goto_rules++;

	if (unresolved)
		ops->unresolved_rules++;

549 550 551
	if (rule->tun_id)
		ip_tunnel_need_metadata();

552
	notify_rule_change(RTM_NEWRULE, rule, ops, nlh, NETLINK_CB(skb).portid);
553
	flush_route_cache(ops);
554 555 556 557 558 559 560 561 562
	rules_ops_put(ops);
	return 0;

errout_free:
	kfree(rule);
errout:
	rules_ops_put(ops);
	return err;
}
D
David Ahern 已提交
563
EXPORT_SYMBOL_GPL(fib_nl_newrule);
564

565 566
int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr *nlh,
		   struct netlink_ext_ack *extack)
567
{
568
	struct net *net = sock_net(skb->sk);
569 570
	struct fib_rule_hdr *frh = nlmsg_data(nlh);
	struct fib_rules_ops *ops = NULL;
T
Thomas Graf 已提交
571
	struct fib_rule *rule, *tmp;
572
	struct nlattr *tb[FRA_MAX+1];
573
	struct fib_kuid_range range;
574 575 576 577 578
	int err = -EINVAL;

	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh)))
		goto errout;

579
	ops = lookup_rules_ops(net, frh->family);
580
	if (ops == NULL) {
581
		err = -EAFNOSUPPORT;
582 583 584
		goto errout;
	}

585
	err = nlmsg_parse(nlh, sizeof(*frh), tb, FRA_MAX, ops->policy, extack);
586 587 588
	if (err < 0)
		goto errout;

589 590 591 592
	err = validate_rulemsg(frh, tb, ops);
	if (err < 0)
		goto errout;

593 594
	if (tb[FRA_UID_RANGE]) {
		range = nla_get_kuid_range(tb);
W
Wei Yongjun 已提交
595 596
		if (!uid_range_set(&range)) {
			err = -EINVAL;
597
			goto errout;
W
Wei Yongjun 已提交
598
		}
599 600 601 602
	} else {
		range = fib_kuid_range_unset;
	}

603
	list_for_each_entry(rule, &ops->rules_list, list) {
604 605 606
		if (frh->action && (frh->action != rule->action))
			continue;

607 608
		if (frh_get_table(frh, tb) &&
		    (frh_get_table(frh, tb) != rule->table))
609 610 611 612 613 614
			continue;

		if (tb[FRA_PRIORITY] &&
		    (rule->pref != nla_get_u32(tb[FRA_PRIORITY])))
			continue;

615 616
		if (tb[FRA_IIFNAME] &&
		    nla_strcmp(tb[FRA_IIFNAME], rule->iifname))
617 618
			continue;

619 620 621 622
		if (tb[FRA_OIFNAME] &&
		    nla_strcmp(tb[FRA_OIFNAME], rule->oifname))
			continue;

623 624 625 626 627 628 629 630
		if (tb[FRA_FWMARK] &&
		    (rule->mark != nla_get_u32(tb[FRA_FWMARK])))
			continue;

		if (tb[FRA_FWMASK] &&
		    (rule->mark_mask != nla_get_u32(tb[FRA_FWMASK])))
			continue;

631 632 633 634
		if (tb[FRA_TUN_ID] &&
		    (rule->tun_id != nla_get_be64(tb[FRA_TUN_ID])))
			continue;

D
David Ahern 已提交
635 636 637 638
		if (tb[FRA_L3MDEV] &&
		    (rule->l3mdev != nla_get_u8(tb[FRA_L3MDEV])))
			continue;

639 640 641 642 643
		if (uid_range_set(&range) &&
		    (!uid_eq(rule->uid_range.start, range.start) ||
		     !uid_eq(rule->uid_range.end, range.end)))
			continue;

644 645 646 647 648 649 650 651
		if (!ops->compare(rule, frh, tb))
			continue;

		if (rule->flags & FIB_RULE_PERMANENT) {
			err = -EPERM;
			goto errout;
		}

652 653 654 655 656 657
		if (ops->delete) {
			err = ops->delete(rule);
			if (err)
				goto errout;
		}

658 659 660
		if (rule->tun_id)
			ip_tunnel_unneed_metadata();

661
		list_del_rcu(&rule->list);
T
Thomas Graf 已提交
662

663
		if (rule->action == FR_ACT_GOTO) {
T
Thomas Graf 已提交
664
			ops->nr_goto_rules--;
665 666 667
			if (rtnl_dereference(rule->ctarget) == NULL)
				ops->unresolved_rules--;
		}
T
Thomas Graf 已提交
668 669 670 671 672 673 674 675

		/*
		 * Check if this rule is a target to any of them. If so,
		 * disable them. As this operation is eventually very
		 * expensive, it is only performed if goto rules have
		 * actually been added.
		 */
		if (ops->nr_goto_rules > 0) {
676
			list_for_each_entry(tmp, &ops->rules_list, list) {
E
Eric Dumazet 已提交
677
				if (rtnl_dereference(tmp->ctarget) == rule) {
678
					RCU_INIT_POINTER(tmp->ctarget, NULL);
T
Thomas Graf 已提交
679 680 681 682 683
					ops->unresolved_rules++;
				}
			}
		}

D
Denis V. Lunev 已提交
684
		notify_rule_change(RTM_DELRULE, rule, ops, nlh,
685
				   NETLINK_CB(skb).portid);
686
		fib_rule_put(rule);
687
		flush_route_cache(ops);
688 689 690 691 692 693 694 695 696
		rules_ops_put(ops);
		return 0;
	}

	err = -ENOENT;
errout:
	rules_ops_put(ops);
	return err;
}
D
David Ahern 已提交
697
EXPORT_SYMBOL_GPL(fib_nl_delrule);
698

699 700 701 702
static inline size_t fib_rule_nlmsg_size(struct fib_rules_ops *ops,
					 struct fib_rule *rule)
{
	size_t payload = NLMSG_ALIGN(sizeof(struct fib_rule_hdr))
703
			 + nla_total_size(IFNAMSIZ) /* FRA_IIFNAME */
704
			 + nla_total_size(IFNAMSIZ) /* FRA_OIFNAME */
705 706
			 + nla_total_size(4) /* FRA_PRIORITY */
			 + nla_total_size(4) /* FRA_TABLE */
707
			 + nla_total_size(4) /* FRA_SUPPRESS_PREFIXLEN */
708
			 + nla_total_size(4) /* FRA_SUPPRESS_IFGROUP */
709
			 + nla_total_size(4) /* FRA_FWMARK */
710
			 + nla_total_size(4) /* FRA_FWMASK */
711 712
			 + nla_total_size_64bit(8) /* FRA_TUN_ID */
			 + nla_total_size(sizeof(struct fib_kuid_range));
713 714 715 716 717 718 719

	if (ops->nlmsg_payload)
		payload += ops->nlmsg_payload(rule);

	return payload;
}

720 721 722 723 724 725 726 727 728
static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
			    u32 pid, u32 seq, int type, int flags,
			    struct fib_rules_ops *ops)
{
	struct nlmsghdr *nlh;
	struct fib_rule_hdr *frh;

	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*frh), flags);
	if (nlh == NULL)
729
		return -EMSGSIZE;
730 731

	frh = nlmsg_data(nlh);
732
	frh->family = ops->family;
733
	frh->table = rule->table;
734 735
	if (nla_put_u32(skb, FRA_TABLE, rule->table))
		goto nla_put_failure;
736
	if (nla_put_u32(skb, FRA_SUPPRESS_PREFIXLEN, rule->suppress_prefixlen))
737
		goto nla_put_failure;
738 739 740 741 742
	frh->res1 = 0;
	frh->res2 = 0;
	frh->action = rule->action;
	frh->flags = rule->flags;

E
Eric Dumazet 已提交
743
	if (rule->action == FR_ACT_GOTO &&
744
	    rcu_access_pointer(rule->ctarget) == NULL)
T
Thomas Graf 已提交
745 746
		frh->flags |= FIB_RULE_UNRESOLVED;

747
	if (rule->iifname[0]) {
748 749
		if (nla_put_string(skb, FRA_IIFNAME, rule->iifname))
			goto nla_put_failure;
750 751
		if (rule->iifindex == -1)
			frh->flags |= FIB_RULE_IIF_DETACHED;
752 753
	}

754
	if (rule->oifname[0]) {
755 756
		if (nla_put_string(skb, FRA_OIFNAME, rule->oifname))
			goto nla_put_failure;
757 758 759 760
		if (rule->oifindex == -1)
			frh->flags |= FIB_RULE_OIF_DETACHED;
	}

761 762 763 764 765 766 767
	if ((rule->pref &&
	     nla_put_u32(skb, FRA_PRIORITY, rule->pref)) ||
	    (rule->mark &&
	     nla_put_u32(skb, FRA_FWMARK, rule->mark)) ||
	    ((rule->mark_mask || rule->mark) &&
	     nla_put_u32(skb, FRA_FWMASK, rule->mark_mask)) ||
	    (rule->target &&
768 769
	     nla_put_u32(skb, FRA_GOTO, rule->target)) ||
	    (rule->tun_id &&
D
David Ahern 已提交
770 771
	     nla_put_be64(skb, FRA_TUN_ID, rule->tun_id, FRA_PAD)) ||
	    (rule->l3mdev &&
772 773 774
	     nla_put_u8(skb, FRA_L3MDEV, rule->l3mdev)) ||
	    (uid_range_set(&rule->uid_range) &&
	     nla_put_uid_range(skb, &rule->uid_range)))
775
		goto nla_put_failure;
776 777 778 779 780 781

	if (rule->suppress_ifgroup != -1) {
		if (nla_put_u32(skb, FRA_SUPPRESS_IFGROUP, rule->suppress_ifgroup))
			goto nla_put_failure;
	}

782
	if (ops->fill(rule, skb, frh) < 0)
783 784
		goto nla_put_failure;

785 786
	nlmsg_end(skb, nlh);
	return 0;
787 788

nla_put_failure:
789 790
	nlmsg_cancel(skb, nlh);
	return -EMSGSIZE;
791 792
}

T
Thomas Graf 已提交
793 794
static int dump_rules(struct sk_buff *skb, struct netlink_callback *cb,
		      struct fib_rules_ops *ops)
795 796 797
{
	int idx = 0;
	struct fib_rule *rule;
798
	int err = 0;
799

800 801
	rcu_read_lock();
	list_for_each_entry_rcu(rule, &ops->rules_list, list) {
T
Thomas Graf 已提交
802
		if (idx < cb->args[1])
803 804
			goto skip;

805 806 807 808
		err = fib_nl_fill_rule(skb, rule, NETLINK_CB(cb->skb).portid,
				       cb->nlh->nlmsg_seq, RTM_NEWRULE,
				       NLM_F_MULTI, ops);
		if (err)
809 810 811 812
			break;
skip:
		idx++;
	}
813
	rcu_read_unlock();
T
Thomas Graf 已提交
814
	cb->args[1] = idx;
815 816
	rules_ops_put(ops);

817
	return err;
818 819
}

T
Thomas Graf 已提交
820 821
static int fib_nl_dumprule(struct sk_buff *skb, struct netlink_callback *cb)
{
822
	struct net *net = sock_net(skb->sk);
T
Thomas Graf 已提交
823 824 825 826 827 828
	struct fib_rules_ops *ops;
	int idx = 0, family;

	family = rtnl_msg_family(cb->nlh);
	if (family != AF_UNSPEC) {
		/* Protocol specific dump request */
829
		ops = lookup_rules_ops(net, family);
T
Thomas Graf 已提交
830 831 832
		if (ops == NULL)
			return -EAFNOSUPPORT;

833 834 835
		dump_rules(skb, cb, ops);

		return skb->len;
T
Thomas Graf 已提交
836 837 838
	}

	rcu_read_lock();
839
	list_for_each_entry_rcu(ops, &net->rules_ops, list) {
T
Thomas Graf 已提交
840 841 842 843 844 845 846
		if (idx < cb->args[0] || !try_module_get(ops->owner))
			goto skip;

		if (dump_rules(skb, cb, ops) < 0)
			break;

		cb->args[1] = 0;
847
skip:
T
Thomas Graf 已提交
848 849 850 851 852 853 854
		idx++;
	}
	rcu_read_unlock();
	cb->args[0] = idx;

	return skb->len;
}
855

D
Denis V. Lunev 已提交
856
static void notify_rule_change(int event, struct fib_rule *rule,
857 858
			       struct fib_rules_ops *ops, struct nlmsghdr *nlh,
			       u32 pid)
859
{
D
Denis V. Lunev 已提交
860
	struct net *net;
861 862
	struct sk_buff *skb;
	int err = -ENOBUFS;
863

D
Denis V. Lunev 已提交
864
	net = ops->fro_net;
865
	skb = nlmsg_new(fib_rule_nlmsg_size(ops, rule), GFP_KERNEL);
866
	if (skb == NULL)
867 868 869
		goto errout;

	err = fib_nl_fill_rule(skb, rule, pid, nlh->nlmsg_seq, event, 0, ops);
870 871 872 873 874 875
	if (err < 0) {
		/* -EMSGSIZE implies BUG in fib_rule_nlmsg_size() */
		WARN_ON(err == -EMSGSIZE);
		kfree_skb(skb);
		goto errout;
	}
D
Denis V. Lunev 已提交
876

877 878
	rtnl_notify(skb, net, pid, ops->nlgroup, nlh, GFP_KERNEL);
	return;
879 880
errout:
	if (err < 0)
881
		rtnl_set_sk_err(net, ops->nlgroup, err);
882 883 884 885 886 887 888
}

static void attach_rules(struct list_head *rules, struct net_device *dev)
{
	struct fib_rule *rule;

	list_for_each_entry(rule, rules, list) {
889 890 891
		if (rule->iifindex == -1 &&
		    strcmp(dev->name, rule->iifname) == 0)
			rule->iifindex = dev->ifindex;
892 893 894
		if (rule->oifindex == -1 &&
		    strcmp(dev->name, rule->oifname) == 0)
			rule->oifindex = dev->ifindex;
895 896 897 898 899 900 901
	}
}

static void detach_rules(struct list_head *rules, struct net_device *dev)
{
	struct fib_rule *rule;

902
	list_for_each_entry(rule, rules, list) {
903 904
		if (rule->iifindex == dev->ifindex)
			rule->iifindex = -1;
905 906 907
		if (rule->oifindex == dev->ifindex)
			rule->oifindex = -1;
	}
908 909 910 911
}


static int fib_rules_event(struct notifier_block *this, unsigned long event,
912
			   void *ptr)
913
{
914
	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
915
	struct net *net = dev_net(dev);
916 917
	struct fib_rules_ops *ops;

918
	ASSERT_RTNL();
919 920 921

	switch (event) {
	case NETDEV_REGISTER:
922
		list_for_each_entry(ops, &net->rules_ops, list)
923
			attach_rules(&ops->rules_list, dev);
924 925
		break;

926 927 928 929 930 931 932
	case NETDEV_CHANGENAME:
		list_for_each_entry(ops, &net->rules_ops, list) {
			detach_rules(&ops->rules_list, dev);
			attach_rules(&ops->rules_list, dev);
		}
		break;

933
	case NETDEV_UNREGISTER:
934
		list_for_each_entry(ops, &net->rules_ops, list)
935
			detach_rules(&ops->rules_list, dev);
936 937 938 939 940 941 942 943 944 945
		break;
	}

	return NOTIFY_DONE;
}

static struct notifier_block fib_rules_notifier = {
	.notifier_call = fib_rules_event,
};

946
static int __net_init fib_rules_net_init(struct net *net)
947 948 949 950 951 952 953 954 955 956
{
	INIT_LIST_HEAD(&net->rules_ops);
	spin_lock_init(&net->rules_mod_lock);
	return 0;
}

static struct pernet_operations fib_rules_net_ops = {
	.init = fib_rules_net_init,
};

957 958
static int __init fib_rules_init(void)
{
959
	int err;
960 961 962
	rtnl_register(PF_UNSPEC, RTM_NEWRULE, fib_nl_newrule, NULL, NULL);
	rtnl_register(PF_UNSPEC, RTM_DELRULE, fib_nl_delrule, NULL, NULL);
	rtnl_register(PF_UNSPEC, RTM_GETRULE, NULL, fib_nl_dumprule, NULL);
963

E
Eric W. Biederman 已提交
964
	err = register_pernet_subsys(&fib_rules_net_ops);
965 966 967
	if (err < 0)
		goto fail;

E
Eric W. Biederman 已提交
968
	err = register_netdevice_notifier(&fib_rules_notifier);
969 970
	if (err < 0)
		goto fail_unregister;
E
Eric W. Biederman 已提交
971

972 973 974
	return 0;

fail_unregister:
E
Eric W. Biederman 已提交
975
	unregister_pernet_subsys(&fib_rules_net_ops);
976 977 978 979 980
fail:
	rtnl_unregister(PF_UNSPEC, RTM_NEWRULE);
	rtnl_unregister(PF_UNSPEC, RTM_DELRULE);
	rtnl_unregister(PF_UNSPEC, RTM_GETRULE);
	return err;
981 982 983
}

subsys_initcall(fib_rules_init);