fib_rules.c 23.9 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12
/*
 * net/core/fib_rules.c		Generic Routing Rules
 *
 *	This program is free software; you can redistribute it and/or
 *	modify it under the terms of the GNU General Public License as
 *	published by the Free Software Foundation, version 2.
 *
 * Authors:	Thomas Graf <tgraf@suug.ch>
 */

#include <linux/types.h>
#include <linux/kernel.h>
13
#include <linux/slab.h>
14
#include <linux/list.h>
15
#include <linux/module.h>
16
#include <net/net_namespace.h>
17
#include <net/sock.h>
18
#include <net/fib_rules.h>
19
#include <net/ip_tunnels.h>
20

21 22 23 24 25
static const struct fib_kuid_range fib_kuid_range_unset = {
	KUIDT_INIT(0),
	KUIDT_INIT(~0),
};

26 27 28 29 30 31 32 33 34 35 36 37 38 39
bool fib_rule_matchall(const struct fib_rule *rule)
{
	if (rule->iifindex || rule->oifindex || rule->mark || rule->tun_id ||
	    rule->flags)
		return false;
	if (rule->suppress_ifgroup != -1 || rule->suppress_prefixlen != -1)
		return false;
	if (!uid_eq(rule->uid_range.start, fib_kuid_range_unset.start) ||
	    !uid_eq(rule->uid_range.end, fib_kuid_range_unset.end))
		return false;
	return true;
}
EXPORT_SYMBOL_GPL(fib_rule_matchall);

40 41 42 43 44 45 46 47 48
int fib_default_rule_add(struct fib_rules_ops *ops,
			 u32 pref, u32 table, u32 flags)
{
	struct fib_rule *r;

	r = kzalloc(ops->rule_size, GFP_KERNEL);
	if (r == NULL)
		return -ENOMEM;

49
	refcount_set(&r->refcnt, 1);
50 51 52 53
	r->action = FR_ACT_TO_TBL;
	r->pref = pref;
	r->table = table;
	r->flags = flags;
54
	r->fr_net = ops->fro_net;
55
	r->uid_range = fib_kuid_range_unset;
56

57 58 59
	r->suppress_prefixlen = -1;
	r->suppress_ifgroup = -1;

60 61 62 63 64 65 66
	/* The lock is not required here, the list in unreacheable
	 * at the moment this function is called */
	list_add_tail(&r->list, &ops->rules_list);
	return 0;
}
EXPORT_SYMBOL(fib_default_rule_add);

67
static u32 fib_default_rule_pref(struct fib_rules_ops *ops)
68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83
{
	struct list_head *pos;
	struct fib_rule *rule;

	if (!list_empty(&ops->rules_list)) {
		pos = ops->rules_list.next;
		if (pos->next != &ops->rules_list) {
			rule = list_entry(pos->next, struct fib_rule, list);
			if (rule->pref)
				return rule->pref - 1;
		}
	}

	return 0;
}

D
Denis V. Lunev 已提交
84
static void notify_rule_change(int event, struct fib_rule *rule,
85 86
			       struct fib_rules_ops *ops, struct nlmsghdr *nlh,
			       u32 pid);
87

88
static struct fib_rules_ops *lookup_rules_ops(struct net *net, int family)
89 90 91 92
{
	struct fib_rules_ops *ops;

	rcu_read_lock();
93
	list_for_each_entry_rcu(ops, &net->rules_ops, list) {
94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111
		if (ops->family == family) {
			if (!try_module_get(ops->owner))
				ops = NULL;
			rcu_read_unlock();
			return ops;
		}
	}
	rcu_read_unlock();

	return NULL;
}

static void rules_ops_put(struct fib_rules_ops *ops)
{
	if (ops)
		module_put(ops->owner);
}

112 113 114
static void flush_route_cache(struct fib_rules_ops *ops)
{
	if (ops->flush_cache)
115
		ops->flush_cache(ops);
116 117
}

118
static int __fib_rules_register(struct fib_rules_ops *ops)
119 120 121
{
	int err = -EEXIST;
	struct fib_rules_ops *o;
D
Denis V. Lunev 已提交
122 123 124
	struct net *net;

	net = ops->fro_net;
125 126 127 128 129 130 131 132 133

	if (ops->rule_size < sizeof(struct fib_rule))
		return -EINVAL;

	if (ops->match == NULL || ops->configure == NULL ||
	    ops->compare == NULL || ops->fill == NULL ||
	    ops->action == NULL)
		return -EINVAL;

134 135
	spin_lock(&net->rules_mod_lock);
	list_for_each_entry(o, &net->rules_ops, list)
136 137 138
		if (ops->family == o->family)
			goto errout;

139
	list_add_tail_rcu(&ops->list, &net->rules_ops);
140 141
	err = 0;
errout:
142
	spin_unlock(&net->rules_mod_lock);
143 144 145 146

	return err;
}

147
struct fib_rules_ops *
148
fib_rules_register(const struct fib_rules_ops *tmpl, struct net *net)
149 150 151 152
{
	struct fib_rules_ops *ops;
	int err;

153
	ops = kmemdup(tmpl, sizeof(*ops), GFP_KERNEL);
154 155 156 157 158 159 160 161 162 163 164 165 166 167
	if (ops == NULL)
		return ERR_PTR(-ENOMEM);

	INIT_LIST_HEAD(&ops->rules_list);
	ops->fro_net = net;

	err = __fib_rules_register(ops);
	if (err) {
		kfree(ops);
		ops = ERR_PTR(err);
	}

	return ops;
}
168 169
EXPORT_SYMBOL_GPL(fib_rules_register);

170
static void fib_rules_cleanup_ops(struct fib_rules_ops *ops)
171 172 173
{
	struct fib_rule *rule, *tmp;

174
	list_for_each_entry_safe(rule, tmp, &ops->rules_list, list) {
175
		list_del_rcu(&rule->list);
176 177
		if (ops->delete)
			ops->delete(rule);
178 179 180 181
		fib_rule_put(rule);
	}
}

D
Denis V. Lunev 已提交
182
void fib_rules_unregister(struct fib_rules_ops *ops)
183
{
D
Denis V. Lunev 已提交
184
	struct net *net = ops->fro_net;
185

186
	spin_lock(&net->rules_mod_lock);
187
	list_del_rcu(&ops->list);
188
	spin_unlock(&net->rules_mod_lock);
189

190
	fib_rules_cleanup_ops(ops);
191
	kfree_rcu(ops, rcu);
192 193 194
}
EXPORT_SYMBOL_GPL(fib_rules_unregister);

195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222
static int uid_range_set(struct fib_kuid_range *range)
{
	return uid_valid(range->start) && uid_valid(range->end);
}

static struct fib_kuid_range nla_get_kuid_range(struct nlattr **tb)
{
	struct fib_rule_uid_range *in;
	struct fib_kuid_range out;

	in = (struct fib_rule_uid_range *)nla_data(tb[FRA_UID_RANGE]);

	out.start = make_kuid(current_user_ns(), in->start);
	out.end = make_kuid(current_user_ns(), in->end);

	return out;
}

static int nla_put_uid_range(struct sk_buff *skb, struct fib_kuid_range *range)
{
	struct fib_rule_uid_range out = {
		from_kuid_munged(current_user_ns(), range->start),
		from_kuid_munged(current_user_ns(), range->end)
	};

	return nla_put(skb, FRA_UID_RANGE, sizeof(out), &out);
}

223
static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops,
D
David Ahern 已提交
224 225
			  struct flowi *fl, int flags,
			  struct fib_lookup_arg *arg)
226 227 228
{
	int ret = 0;

229
	if (rule->iifindex && (rule->iifindex != fl->flowi_iif))
230 231
		goto out;

232
	if (rule->oifindex && (rule->oifindex != fl->flowi_oif))
233 234
		goto out;

235
	if ((rule->mark ^ fl->flowi_mark) & rule->mark_mask)
236 237
		goto out;

238 239 240
	if (rule->tun_id && (rule->tun_id != fl->flowi_tun_key.tun_id))
		goto out;

D
David Ahern 已提交
241 242 243
	if (rule->l3mdev && !l3mdev_fib_rule_match(rule->fr_net, fl, arg))
		goto out;

244 245 246 247
	if (uid_lt(fl->flowi_uid, rule->uid_range.start) ||
	    uid_gt(fl->flowi_uid, rule->uid_range.end))
		goto out;

248 249 250 251 252
	ret = ops->match(rule, fl, flags);
out:
	return (rule->flags & FIB_RULE_INVERT) ? !ret : ret;
}

253 254 255 256 257 258 259 260
int fib_rules_lookup(struct fib_rules_ops *ops, struct flowi *fl,
		     int flags, struct fib_lookup_arg *arg)
{
	struct fib_rule *rule;
	int err;

	rcu_read_lock();

261
	list_for_each_entry_rcu(rule, &ops->rules_list, list) {
T
Thomas Graf 已提交
262
jumped:
D
David Ahern 已提交
263
		if (!fib_rule_match(rule, ops, fl, flags, arg))
264 265
			continue;

T
Thomas Graf 已提交
266 267 268 269 270 271 272 273 274 275
		if (rule->action == FR_ACT_GOTO) {
			struct fib_rule *target;

			target = rcu_dereference(rule->ctarget);
			if (target == NULL) {
				continue;
			} else {
				rule = target;
				goto jumped;
			}
276 277 278
		} else if (rule->action == FR_ACT_NOP)
			continue;
		else
T
Thomas Graf 已提交
279 280
			err = ops->action(rule, fl, flags, arg);

281 282 283
		if (!err && ops->suppress && ops->suppress(rule, arg))
			continue;

284
		if (err != -EAGAIN) {
E
Eric Dumazet 已提交
285
			if ((arg->flags & FIB_LOOKUP_NOREF) ||
286
			    likely(refcount_inc_not_zero(&rule->refcnt))) {
287 288 289 290
				arg->rule = rule;
				goto out;
			}
			break;
291 292 293
		}
	}

294
	err = -ESRCH;
295 296 297 298 299 300 301
out:
	rcu_read_unlock();

	return err;
}
EXPORT_SYMBOL_GPL(fib_rules_lookup);

302 303 304 305 306 307 308 309 310 311 312 313 314 315 316
static int call_fib_rule_notifier(struct notifier_block *nb, struct net *net,
				  enum fib_event_type event_type,
				  struct fib_rule *rule, int family)
{
	struct fib_rule_notifier_info info = {
		.info.family = family,
		.rule = rule,
	};

	return call_fib_notifier(nb, net, event_type, &info.info);
}

static int call_fib_rule_notifiers(struct net *net,
				   enum fib_event_type event_type,
				   struct fib_rule *rule,
D
David Ahern 已提交
317 318
				   struct fib_rules_ops *ops,
				   struct netlink_ext_ack *extack)
319 320 321
{
	struct fib_rule_notifier_info info = {
		.info.family = ops->family,
D
David Ahern 已提交
322
		.info.extack = extack,
323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364
		.rule = rule,
	};

	ops->fib_rules_seq++;
	return call_fib_notifiers(net, event_type, &info.info);
}

/* Called with rcu_read_lock() */
int fib_rules_dump(struct net *net, struct notifier_block *nb, int family)
{
	struct fib_rules_ops *ops;
	struct fib_rule *rule;

	ops = lookup_rules_ops(net, family);
	if (!ops)
		return -EAFNOSUPPORT;
	list_for_each_entry_rcu(rule, &ops->rules_list, list)
		call_fib_rule_notifier(nb, net, FIB_EVENT_RULE_ADD, rule,
				       family);
	rules_ops_put(ops);

	return 0;
}
EXPORT_SYMBOL_GPL(fib_rules_dump);

unsigned int fib_rules_seq_read(struct net *net, int family)
{
	unsigned int fib_rules_seq;
	struct fib_rules_ops *ops;

	ASSERT_RTNL();

	ops = lookup_rules_ops(net, family);
	if (!ops)
		return 0;
	fib_rules_seq = ops->fib_rules_seq;
	rules_ops_put(ops);

	return fib_rules_seq;
}
EXPORT_SYMBOL_GPL(fib_rules_seq_read);

365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386
static int validate_rulemsg(struct fib_rule_hdr *frh, struct nlattr **tb,
			    struct fib_rules_ops *ops)
{
	int err = -EINVAL;

	if (frh->src_len)
		if (tb[FRA_SRC] == NULL ||
		    frh->src_len > (ops->addr_size * 8) ||
		    nla_len(tb[FRA_SRC]) != ops->addr_size)
			goto errout;

	if (frh->dst_len)
		if (tb[FRA_DST] == NULL ||
		    frh->dst_len > (ops->addr_size * 8) ||
		    nla_len(tb[FRA_DST]) != ops->addr_size)
			goto errout;

	err = 0;
errout:
	return err;
}

387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422
static int rule_exists(struct fib_rules_ops *ops, struct fib_rule_hdr *frh,
		       struct nlattr **tb, struct fib_rule *rule)
{
	struct fib_rule *r;

	list_for_each_entry(r, &ops->rules_list, list) {
		if (r->action != rule->action)
			continue;

		if (r->table != rule->table)
			continue;

		if (r->pref != rule->pref)
			continue;

		if (memcmp(r->iifname, rule->iifname, IFNAMSIZ))
			continue;

		if (memcmp(r->oifname, rule->oifname, IFNAMSIZ))
			continue;

		if (r->mark != rule->mark)
			continue;

		if (r->mark_mask != rule->mark_mask)
			continue;

		if (r->tun_id != rule->tun_id)
			continue;

		if (r->fr_net != rule->fr_net)
			continue;

		if (r->l3mdev != rule->l3mdev)
			continue;

423 424 425 426
		if (!uid_eq(r->uid_range.start, rule->uid_range.start) ||
		    !uid_eq(r->uid_range.end, rule->uid_range.end))
			continue;

427 428 429 430 431 432 433
		if (!ops->compare(r, frh, tb))
			continue;
		return 1;
	}
	return 0;
}

434 435
int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,
		   struct netlink_ext_ack *extack)
436
{
437
	struct net *net = sock_net(skb->sk);
438 439 440 441
	struct fib_rule_hdr *frh = nlmsg_data(nlh);
	struct fib_rules_ops *ops = NULL;
	struct fib_rule *rule, *r, *last = NULL;
	struct nlattr *tb[FRA_MAX+1];
T
Thomas Graf 已提交
442
	int err = -EINVAL, unresolved = 0;
443 444 445 446

	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh)))
		goto errout;

447
	ops = lookup_rules_ops(net, frh->family);
448
	if (ops == NULL) {
449
		err = -EAFNOSUPPORT;
450 451 452
		goto errout;
	}

453
	err = nlmsg_parse(nlh, sizeof(*frh), tb, FRA_MAX, ops->policy, extack);
454 455 456
	if (err < 0)
		goto errout;

457 458 459 460
	err = validate_rulemsg(frh, tb, ops);
	if (err < 0)
		goto errout;

461 462 463 464 465
	rule = kzalloc(ops->rule_size, GFP_KERNEL);
	if (rule == NULL) {
		err = -ENOMEM;
		goto errout;
	}
466
	refcount_set(&rule->refcnt, 1);
467
	rule->fr_net = net;
468

469 470
	rule->pref = tb[FRA_PRIORITY] ? nla_get_u32(tb[FRA_PRIORITY])
	                              : fib_default_rule_pref(ops);
471

472
	if (tb[FRA_IIFNAME]) {
473 474
		struct net_device *dev;

475 476 477
		rule->iifindex = -1;
		nla_strlcpy(rule->iifname, tb[FRA_IIFNAME], IFNAMSIZ);
		dev = __dev_get_by_name(net, rule->iifname);
478
		if (dev)
479
			rule->iifindex = dev->ifindex;
480 481
	}

482 483 484 485 486 487 488 489 490 491
	if (tb[FRA_OIFNAME]) {
		struct net_device *dev;

		rule->oifindex = -1;
		nla_strlcpy(rule->oifname, tb[FRA_OIFNAME], IFNAMSIZ);
		dev = __dev_get_by_name(net, rule->oifname);
		if (dev)
			rule->oifindex = dev->ifindex;
	}

492 493 494 495 496 497 498 499 500 501 502 503
	if (tb[FRA_FWMARK]) {
		rule->mark = nla_get_u32(tb[FRA_FWMARK]);
		if (rule->mark)
			/* compatibility: if the mark value is non-zero all bits
			 * are compared unless a mask is explicitly specified.
			 */
			rule->mark_mask = 0xFFFFFFFF;
	}

	if (tb[FRA_FWMASK])
		rule->mark_mask = nla_get_u32(tb[FRA_FWMASK]);

504 505 506
	if (tb[FRA_TUN_ID])
		rule->tun_id = nla_get_be64(tb[FRA_TUN_ID]);

W
Wei Yongjun 已提交
507
	err = -EINVAL;
D
David Ahern 已提交
508 509 510 511 512 513 514 515
	if (tb[FRA_L3MDEV]) {
#ifdef CONFIG_NET_L3_MASTER_DEV
		rule->l3mdev = nla_get_u8(tb[FRA_L3MDEV]);
		if (rule->l3mdev != 1)
#endif
			goto errout_free;
	}

516 517
	rule->action = frh->action;
	rule->flags = frh->flags;
518
	rule->table = frh_get_table(frh, tb);
519 520 521 522
	if (tb[FRA_SUPPRESS_PREFIXLEN])
		rule->suppress_prefixlen = nla_get_u32(tb[FRA_SUPPRESS_PREFIXLEN]);
	else
		rule->suppress_prefixlen = -1;
523

524 525
	if (tb[FRA_SUPPRESS_IFGROUP])
		rule->suppress_ifgroup = nla_get_u32(tb[FRA_SUPPRESS_IFGROUP]);
526 527
	else
		rule->suppress_ifgroup = -1;
528

T
Thomas Graf 已提交
529 530 531 532 533 534 535 536 537
	if (tb[FRA_GOTO]) {
		if (rule->action != FR_ACT_GOTO)
			goto errout_free;

		rule->target = nla_get_u32(tb[FRA_GOTO]);
		/* Backward jumps are prohibited to avoid endless loops */
		if (rule->target <= rule->pref)
			goto errout_free;

538
		list_for_each_entry(r, &ops->rules_list, list) {
T
Thomas Graf 已提交
539
			if (r->pref == rule->target) {
E
Eric Dumazet 已提交
540
				RCU_INIT_POINTER(rule->ctarget, r);
T
Thomas Graf 已提交
541 542 543 544
				break;
			}
		}

E
Eric Dumazet 已提交
545
		if (rcu_dereference_protected(rule->ctarget, 1) == NULL)
T
Thomas Graf 已提交
546 547 548 549
			unresolved = 1;
	} else if (rule->action == FR_ACT_GOTO)
		goto errout_free;

D
David Ahern 已提交
550 551 552
	if (rule->l3mdev && rule->table)
		goto errout_free;

553 554 555 556 557 558 559 560 561 562 563 564 565 566 567
	if (tb[FRA_UID_RANGE]) {
		if (current_user_ns() != net->user_ns) {
			err = -EPERM;
			goto errout_free;
		}

		rule->uid_range = nla_get_kuid_range(tb);

		if (!uid_range_set(&rule->uid_range) ||
		    !uid_lte(rule->uid_range.start, rule->uid_range.end))
			goto errout_free;
	} else {
		rule->uid_range = fib_kuid_range_unset;
	}

568 569 570 571 572 573
	if ((nlh->nlmsg_flags & NLM_F_EXCL) &&
	    rule_exists(ops, frh, tb, rule)) {
		err = -EEXIST;
		goto errout_free;
	}

574
	err = ops->configure(rule, skb, frh, tb);
575 576 577
	if (err < 0)
		goto errout_free;

578
	list_for_each_entry(r, &ops->rules_list, list) {
579 580 581 582 583
		if (r->pref > rule->pref)
			break;
		last = r;
	}

E
Eric Dumazet 已提交
584 585 586 587 588
	if (last)
		list_add_rcu(&rule->list, &last->list);
	else
		list_add_rcu(&rule->list, &ops->rules_list);

T
Thomas Graf 已提交
589 590 591 592 593
	if (ops->unresolved_rules) {
		/*
		 * There are unresolved goto rules in the list, check if
		 * any of them are pointing to this new rule.
		 */
594
		list_for_each_entry(r, &ops->rules_list, list) {
T
Thomas Graf 已提交
595
			if (r->action == FR_ACT_GOTO &&
596 597
			    r->target == rule->pref &&
			    rtnl_dereference(r->ctarget) == NULL) {
T
Thomas Graf 已提交
598 599 600 601 602 603 604 605 606 607 608 609 610
				rcu_assign_pointer(r->ctarget, rule);
				if (--ops->unresolved_rules == 0)
					break;
			}
		}
	}

	if (rule->action == FR_ACT_GOTO)
		ops->nr_goto_rules++;

	if (unresolved)
		ops->unresolved_rules++;

611 612 613
	if (rule->tun_id)
		ip_tunnel_need_metadata();

D
David Ahern 已提交
614
	call_fib_rule_notifiers(net, FIB_EVENT_RULE_ADD, rule, ops, extack);
615
	notify_rule_change(RTM_NEWRULE, rule, ops, nlh, NETLINK_CB(skb).portid);
616
	flush_route_cache(ops);
617 618 619 620 621 622 623 624 625
	rules_ops_put(ops);
	return 0;

errout_free:
	kfree(rule);
errout:
	rules_ops_put(ops);
	return err;
}
D
David Ahern 已提交
626
EXPORT_SYMBOL_GPL(fib_nl_newrule);
627

628 629
int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr *nlh,
		   struct netlink_ext_ack *extack)
630
{
631
	struct net *net = sock_net(skb->sk);
632 633
	struct fib_rule_hdr *frh = nlmsg_data(nlh);
	struct fib_rules_ops *ops = NULL;
634
	struct fib_rule *rule, *r;
635
	struct nlattr *tb[FRA_MAX+1];
636
	struct fib_kuid_range range;
637 638 639 640 641
	int err = -EINVAL;

	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh)))
		goto errout;

642
	ops = lookup_rules_ops(net, frh->family);
643
	if (ops == NULL) {
644
		err = -EAFNOSUPPORT;
645 646 647
		goto errout;
	}

648
	err = nlmsg_parse(nlh, sizeof(*frh), tb, FRA_MAX, ops->policy, extack);
649 650 651
	if (err < 0)
		goto errout;

652 653 654 655
	err = validate_rulemsg(frh, tb, ops);
	if (err < 0)
		goto errout;

656 657
	if (tb[FRA_UID_RANGE]) {
		range = nla_get_kuid_range(tb);
W
Wei Yongjun 已提交
658 659
		if (!uid_range_set(&range)) {
			err = -EINVAL;
660
			goto errout;
W
Wei Yongjun 已提交
661
		}
662 663 664 665
	} else {
		range = fib_kuid_range_unset;
	}

666
	list_for_each_entry(rule, &ops->rules_list, list) {
667 668 669
		if (frh->action && (frh->action != rule->action))
			continue;

670 671
		if (frh_get_table(frh, tb) &&
		    (frh_get_table(frh, tb) != rule->table))
672 673 674 675 676 677
			continue;

		if (tb[FRA_PRIORITY] &&
		    (rule->pref != nla_get_u32(tb[FRA_PRIORITY])))
			continue;

678 679
		if (tb[FRA_IIFNAME] &&
		    nla_strcmp(tb[FRA_IIFNAME], rule->iifname))
680 681
			continue;

682 683 684 685
		if (tb[FRA_OIFNAME] &&
		    nla_strcmp(tb[FRA_OIFNAME], rule->oifname))
			continue;

686 687 688 689 690 691 692 693
		if (tb[FRA_FWMARK] &&
		    (rule->mark != nla_get_u32(tb[FRA_FWMARK])))
			continue;

		if (tb[FRA_FWMASK] &&
		    (rule->mark_mask != nla_get_u32(tb[FRA_FWMASK])))
			continue;

694 695 696 697
		if (tb[FRA_TUN_ID] &&
		    (rule->tun_id != nla_get_be64(tb[FRA_TUN_ID])))
			continue;

D
David Ahern 已提交
698 699 700 701
		if (tb[FRA_L3MDEV] &&
		    (rule->l3mdev != nla_get_u8(tb[FRA_L3MDEV])))
			continue;

702 703 704 705 706
		if (uid_range_set(&range) &&
		    (!uid_eq(rule->uid_range.start, range.start) ||
		     !uid_eq(rule->uid_range.end, range.end)))
			continue;

707 708 709 710 711 712 713 714
		if (!ops->compare(rule, frh, tb))
			continue;

		if (rule->flags & FIB_RULE_PERMANENT) {
			err = -EPERM;
			goto errout;
		}

715 716 717 718 719 720
		if (ops->delete) {
			err = ops->delete(rule);
			if (err)
				goto errout;
		}

721 722 723
		if (rule->tun_id)
			ip_tunnel_unneed_metadata();

724
		list_del_rcu(&rule->list);
T
Thomas Graf 已提交
725

726
		if (rule->action == FR_ACT_GOTO) {
T
Thomas Graf 已提交
727
			ops->nr_goto_rules--;
728 729 730
			if (rtnl_dereference(rule->ctarget) == NULL)
				ops->unresolved_rules--;
		}
T
Thomas Graf 已提交
731 732 733

		/*
		 * Check if this rule is a target to any of them. If so,
734
		 * adjust to the next one with the same preference or
T
Thomas Graf 已提交
735
		 * disable them. As this operation is eventually very
736 737
		 * expensive, it is only performed if goto rules, except
		 * current if it is goto rule, have actually been added.
T
Thomas Graf 已提交
738 739
		 */
		if (ops->nr_goto_rules > 0) {
740 741 742 743 744 745 746 747 748 749
			struct fib_rule *n;

			n = list_next_entry(rule, list);
			if (&n->list == &ops->rules_list || n->pref != rule->pref)
				n = NULL;
			list_for_each_entry(r, &ops->rules_list, list) {
				if (rtnl_dereference(r->ctarget) != rule)
					continue;
				rcu_assign_pointer(r->ctarget, n);
				if (!n)
T
Thomas Graf 已提交
750 751 752 753
					ops->unresolved_rules++;
			}
		}

D
David Ahern 已提交
754 755
		call_fib_rule_notifiers(net, FIB_EVENT_RULE_DEL, rule, ops,
					NULL);
D
Denis V. Lunev 已提交
756
		notify_rule_change(RTM_DELRULE, rule, ops, nlh,
757
				   NETLINK_CB(skb).portid);
758
		fib_rule_put(rule);
759
		flush_route_cache(ops);
760 761 762 763 764 765 766 767 768
		rules_ops_put(ops);
		return 0;
	}

	err = -ENOENT;
errout:
	rules_ops_put(ops);
	return err;
}
D
David Ahern 已提交
769
EXPORT_SYMBOL_GPL(fib_nl_delrule);
770

771 772 773 774
static inline size_t fib_rule_nlmsg_size(struct fib_rules_ops *ops,
					 struct fib_rule *rule)
{
	size_t payload = NLMSG_ALIGN(sizeof(struct fib_rule_hdr))
775
			 + nla_total_size(IFNAMSIZ) /* FRA_IIFNAME */
776
			 + nla_total_size(IFNAMSIZ) /* FRA_OIFNAME */
777 778
			 + nla_total_size(4) /* FRA_PRIORITY */
			 + nla_total_size(4) /* FRA_TABLE */
779
			 + nla_total_size(4) /* FRA_SUPPRESS_PREFIXLEN */
780
			 + nla_total_size(4) /* FRA_SUPPRESS_IFGROUP */
781
			 + nla_total_size(4) /* FRA_FWMARK */
782
			 + nla_total_size(4) /* FRA_FWMASK */
783 784
			 + nla_total_size_64bit(8) /* FRA_TUN_ID */
			 + nla_total_size(sizeof(struct fib_kuid_range));
785 786 787 788 789 790 791

	if (ops->nlmsg_payload)
		payload += ops->nlmsg_payload(rule);

	return payload;
}

792 793 794 795 796 797 798 799 800
static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
			    u32 pid, u32 seq, int type, int flags,
			    struct fib_rules_ops *ops)
{
	struct nlmsghdr *nlh;
	struct fib_rule_hdr *frh;

	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*frh), flags);
	if (nlh == NULL)
801
		return -EMSGSIZE;
802 803

	frh = nlmsg_data(nlh);
804
	frh->family = ops->family;
805
	frh->table = rule->table;
806 807
	if (nla_put_u32(skb, FRA_TABLE, rule->table))
		goto nla_put_failure;
808
	if (nla_put_u32(skb, FRA_SUPPRESS_PREFIXLEN, rule->suppress_prefixlen))
809
		goto nla_put_failure;
810 811 812 813 814
	frh->res1 = 0;
	frh->res2 = 0;
	frh->action = rule->action;
	frh->flags = rule->flags;

E
Eric Dumazet 已提交
815
	if (rule->action == FR_ACT_GOTO &&
816
	    rcu_access_pointer(rule->ctarget) == NULL)
T
Thomas Graf 已提交
817 818
		frh->flags |= FIB_RULE_UNRESOLVED;

819
	if (rule->iifname[0]) {
820 821
		if (nla_put_string(skb, FRA_IIFNAME, rule->iifname))
			goto nla_put_failure;
822 823
		if (rule->iifindex == -1)
			frh->flags |= FIB_RULE_IIF_DETACHED;
824 825
	}

826
	if (rule->oifname[0]) {
827 828
		if (nla_put_string(skb, FRA_OIFNAME, rule->oifname))
			goto nla_put_failure;
829 830 831 832
		if (rule->oifindex == -1)
			frh->flags |= FIB_RULE_OIF_DETACHED;
	}

833 834 835 836 837 838 839
	if ((rule->pref &&
	     nla_put_u32(skb, FRA_PRIORITY, rule->pref)) ||
	    (rule->mark &&
	     nla_put_u32(skb, FRA_FWMARK, rule->mark)) ||
	    ((rule->mark_mask || rule->mark) &&
	     nla_put_u32(skb, FRA_FWMASK, rule->mark_mask)) ||
	    (rule->target &&
840 841
	     nla_put_u32(skb, FRA_GOTO, rule->target)) ||
	    (rule->tun_id &&
D
David Ahern 已提交
842 843
	     nla_put_be64(skb, FRA_TUN_ID, rule->tun_id, FRA_PAD)) ||
	    (rule->l3mdev &&
844 845 846
	     nla_put_u8(skb, FRA_L3MDEV, rule->l3mdev)) ||
	    (uid_range_set(&rule->uid_range) &&
	     nla_put_uid_range(skb, &rule->uid_range)))
847
		goto nla_put_failure;
848 849 850 851 852 853

	if (rule->suppress_ifgroup != -1) {
		if (nla_put_u32(skb, FRA_SUPPRESS_IFGROUP, rule->suppress_ifgroup))
			goto nla_put_failure;
	}

854
	if (ops->fill(rule, skb, frh) < 0)
855 856
		goto nla_put_failure;

857 858
	nlmsg_end(skb, nlh);
	return 0;
859 860

nla_put_failure:
861 862
	nlmsg_cancel(skb, nlh);
	return -EMSGSIZE;
863 864
}

T
Thomas Graf 已提交
865 866
static int dump_rules(struct sk_buff *skb, struct netlink_callback *cb,
		      struct fib_rules_ops *ops)
867 868 869
{
	int idx = 0;
	struct fib_rule *rule;
870
	int err = 0;
871

872 873
	rcu_read_lock();
	list_for_each_entry_rcu(rule, &ops->rules_list, list) {
T
Thomas Graf 已提交
874
		if (idx < cb->args[1])
875 876
			goto skip;

877 878 879 880
		err = fib_nl_fill_rule(skb, rule, NETLINK_CB(cb->skb).portid,
				       cb->nlh->nlmsg_seq, RTM_NEWRULE,
				       NLM_F_MULTI, ops);
		if (err)
881 882 883 884
			break;
skip:
		idx++;
	}
885
	rcu_read_unlock();
T
Thomas Graf 已提交
886
	cb->args[1] = idx;
887 888
	rules_ops_put(ops);

889
	return err;
890 891
}

T
Thomas Graf 已提交
892 893
static int fib_nl_dumprule(struct sk_buff *skb, struct netlink_callback *cb)
{
894
	struct net *net = sock_net(skb->sk);
T
Thomas Graf 已提交
895 896 897 898 899 900
	struct fib_rules_ops *ops;
	int idx = 0, family;

	family = rtnl_msg_family(cb->nlh);
	if (family != AF_UNSPEC) {
		/* Protocol specific dump request */
901
		ops = lookup_rules_ops(net, family);
T
Thomas Graf 已提交
902 903 904
		if (ops == NULL)
			return -EAFNOSUPPORT;

905 906 907
		dump_rules(skb, cb, ops);

		return skb->len;
T
Thomas Graf 已提交
908 909 910
	}

	rcu_read_lock();
911
	list_for_each_entry_rcu(ops, &net->rules_ops, list) {
T
Thomas Graf 已提交
912 913 914 915 916 917 918
		if (idx < cb->args[0] || !try_module_get(ops->owner))
			goto skip;

		if (dump_rules(skb, cb, ops) < 0)
			break;

		cb->args[1] = 0;
919
skip:
T
Thomas Graf 已提交
920 921 922 923 924 925 926
		idx++;
	}
	rcu_read_unlock();
	cb->args[0] = idx;

	return skb->len;
}
927

D
Denis V. Lunev 已提交
928
static void notify_rule_change(int event, struct fib_rule *rule,
929 930
			       struct fib_rules_ops *ops, struct nlmsghdr *nlh,
			       u32 pid)
931
{
D
Denis V. Lunev 已提交
932
	struct net *net;
933 934
	struct sk_buff *skb;
	int err = -ENOBUFS;
935

D
Denis V. Lunev 已提交
936
	net = ops->fro_net;
937
	skb = nlmsg_new(fib_rule_nlmsg_size(ops, rule), GFP_KERNEL);
938
	if (skb == NULL)
939 940 941
		goto errout;

	err = fib_nl_fill_rule(skb, rule, pid, nlh->nlmsg_seq, event, 0, ops);
942 943 944 945 946 947
	if (err < 0) {
		/* -EMSGSIZE implies BUG in fib_rule_nlmsg_size() */
		WARN_ON(err == -EMSGSIZE);
		kfree_skb(skb);
		goto errout;
	}
D
Denis V. Lunev 已提交
948

949 950
	rtnl_notify(skb, net, pid, ops->nlgroup, nlh, GFP_KERNEL);
	return;
951 952
errout:
	if (err < 0)
953
		rtnl_set_sk_err(net, ops->nlgroup, err);
954 955 956 957 958 959 960
}

static void attach_rules(struct list_head *rules, struct net_device *dev)
{
	struct fib_rule *rule;

	list_for_each_entry(rule, rules, list) {
961 962 963
		if (rule->iifindex == -1 &&
		    strcmp(dev->name, rule->iifname) == 0)
			rule->iifindex = dev->ifindex;
964 965 966
		if (rule->oifindex == -1 &&
		    strcmp(dev->name, rule->oifname) == 0)
			rule->oifindex = dev->ifindex;
967 968 969 970 971 972 973
	}
}

static void detach_rules(struct list_head *rules, struct net_device *dev)
{
	struct fib_rule *rule;

974
	list_for_each_entry(rule, rules, list) {
975 976
		if (rule->iifindex == dev->ifindex)
			rule->iifindex = -1;
977 978 979
		if (rule->oifindex == dev->ifindex)
			rule->oifindex = -1;
	}
980 981 982 983
}


static int fib_rules_event(struct notifier_block *this, unsigned long event,
984
			   void *ptr)
985
{
986
	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
987
	struct net *net = dev_net(dev);
988 989
	struct fib_rules_ops *ops;

990
	ASSERT_RTNL();
991 992 993

	switch (event) {
	case NETDEV_REGISTER:
994
		list_for_each_entry(ops, &net->rules_ops, list)
995
			attach_rules(&ops->rules_list, dev);
996 997
		break;

998 999 1000 1001 1002 1003 1004
	case NETDEV_CHANGENAME:
		list_for_each_entry(ops, &net->rules_ops, list) {
			detach_rules(&ops->rules_list, dev);
			attach_rules(&ops->rules_list, dev);
		}
		break;

1005
	case NETDEV_UNREGISTER:
1006
		list_for_each_entry(ops, &net->rules_ops, list)
1007
			detach_rules(&ops->rules_list, dev);
1008 1009 1010 1011 1012 1013 1014 1015 1016 1017
		break;
	}

	return NOTIFY_DONE;
}

static struct notifier_block fib_rules_notifier = {
	.notifier_call = fib_rules_event,
};

1018
static int __net_init fib_rules_net_init(struct net *net)
1019 1020 1021 1022 1023 1024
{
	INIT_LIST_HEAD(&net->rules_ops);
	spin_lock_init(&net->rules_mod_lock);
	return 0;
}

1025 1026 1027 1028 1029
static void __net_exit fib_rules_net_exit(struct net *net)
{
	WARN_ON_ONCE(!list_empty(&net->rules_ops));
}

1030 1031
static struct pernet_operations fib_rules_net_ops = {
	.init = fib_rules_net_init,
1032
	.exit = fib_rules_net_exit,
1033
	.async = true,
1034 1035
};

1036 1037
static int __init fib_rules_init(void)
{
1038
	int err;
1039 1040 1041
	rtnl_register(PF_UNSPEC, RTM_NEWRULE, fib_nl_newrule, NULL, 0);
	rtnl_register(PF_UNSPEC, RTM_DELRULE, fib_nl_delrule, NULL, 0);
	rtnl_register(PF_UNSPEC, RTM_GETRULE, NULL, fib_nl_dumprule, 0);
1042

E
Eric W. Biederman 已提交
1043
	err = register_pernet_subsys(&fib_rules_net_ops);
1044 1045 1046
	if (err < 0)
		goto fail;

E
Eric W. Biederman 已提交
1047
	err = register_netdevice_notifier(&fib_rules_notifier);
1048 1049
	if (err < 0)
		goto fail_unregister;
E
Eric W. Biederman 已提交
1050

1051 1052 1053
	return 0;

fail_unregister:
E
Eric W. Biederman 已提交
1054
	unregister_pernet_subsys(&fib_rules_net_ops);
1055 1056 1057 1058 1059
fail:
	rtnl_unregister(PF_UNSPEC, RTM_NEWRULE);
	rtnl_unregister(PF_UNSPEC, RTM_DELRULE);
	rtnl_unregister(PF_UNSPEC, RTM_GETRULE);
	return err;
1060 1061 1062
}

subsys_initcall(fib_rules_init);