1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * INET An implementation of the TCP/IP protocol suite for the LINUX 4 * operating system. INET is implemented using the BSD Socket 5 * interface as the means of communication with the user level. 6 * 7 * IPv4 Forwarding Information Base: policy rules. 8 * 9 * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru> 10 * Thomas Graf <tgraf@suug.ch> 11 * 12 * Fixes: 13 * Rani Assaf : local_rule cannot be deleted 14 * Marc Boucher : routing by fwmark 15 */ 16 17 #include <linux/types.h> 18 #include <linux/kernel.h> 19 #include <linux/netdevice.h> 20 #include <linux/netlink.h> 21 #include <linux/inetdevice.h> 22 #include <linux/init.h> 23 #include <linux/list.h> 24 #include <linux/rcupdate.h> 25 #include <linux/export.h> 26 #include <net/flow.h> 27 #include <net/inet_dscp.h> 28 #include <net/ip.h> 29 #include <net/route.h> 30 #include <net/tcp.h> 31 #include <net/ip_fib.h> 32 #include <net/nexthop.h> 33 #include <net/fib_rules.h> 34 #include <linux/indirect_call_wrapper.h> 35 36 struct fib4_rule { 37 struct fib_rule common; 38 u8 dst_len; 39 u8 src_len; 40 dscp_t dscp; 41 dscp_t dscp_mask; 42 u8 dscp_full:1; /* DSCP or TOS selector */ 43 __be32 src; 44 __be32 srcmask; 45 __be32 dst; 46 __be32 dstmask; 47 #ifdef CONFIG_IP_ROUTE_CLASSID 48 u32 tclassid; 49 #endif 50 }; 51 52 static bool fib4_rule_matchall(const struct fib_rule *rule) 53 { 54 struct fib4_rule *r = container_of(rule, struct fib4_rule, common); 55 56 if (r->dst_len || r->src_len || r->dscp) 57 return false; 58 return fib_rule_matchall(rule); 59 } 60 61 bool fib4_rule_default(const struct fib_rule *rule) 62 { 63 if (!fib4_rule_matchall(rule) || rule->action != FR_ACT_TO_TBL || 64 rule->l3mdev) 65 return false; 66 if (rule->table != RT_TABLE_LOCAL && rule->table != RT_TABLE_MAIN && 67 rule->table != RT_TABLE_DEFAULT) 68 return false; 69 return true; 70 } 71 EXPORT_SYMBOL_GPL(fib4_rule_default); 72 73 int fib4_rules_dump(struct net *net, struct notifier_block *nb, 74 struct netlink_ext_ack *extack) 75 { 76 return fib_rules_dump(net, nb, AF_INET, extack); 77 } 78 79 unsigned int fib4_rules_seq_read(const struct net *net) 80 { 81 return fib_rules_seq_read(net, AF_INET); 82 } 83 84 int __fib_lookup(struct net *net, struct flowi4 *flp, 85 struct fib_result *res, unsigned int flags) 86 { 87 struct fib_lookup_arg arg = { 88 .result = res, 89 .flags = flags, 90 }; 91 int err; 92 93 /* update flow if oif or iif point to device enslaved to l3mdev */ 94 l3mdev_update_flow(net, flowi4_to_flowi(flp)); 95 96 err = fib_rules_lookup(net->ipv4.rules_ops, flowi4_to_flowi(flp), 0, &arg); 97 #ifdef CONFIG_IP_ROUTE_CLASSID 98 if (arg.rule) 99 res->tclassid = ((struct fib4_rule *)arg.rule)->tclassid; 100 else 101 res->tclassid = 0; 102 #endif 103 104 if (err == -ESRCH) 105 err = -ENETUNREACH; 106 107 return err; 108 } 109 EXPORT_SYMBOL_GPL(__fib_lookup); 110 111 INDIRECT_CALLABLE_SCOPE int fib4_rule_action(struct fib_rule *rule, 112 struct flowi *flp, int flags, 113 struct fib_lookup_arg *arg) 114 { 115 int err = -EAGAIN; 116 struct fib_table *tbl; 117 u32 tb_id; 118 119 switch (rule->action) { 120 case FR_ACT_TO_TBL: 121 break; 122 123 case FR_ACT_UNREACHABLE: 124 return -ENETUNREACH; 125 126 case FR_ACT_PROHIBIT: 127 return -EACCES; 128 129 case FR_ACT_BLACKHOLE: 130 default: 131 return -EINVAL; 132 } 133 134 rcu_read_lock(); 135 136 tb_id = fib_rule_get_table(rule, arg); 137 tbl = fib_get_table(rule->fr_net, tb_id); 138 if (tbl) 139 err = fib_table_lookup(tbl, &flp->u.ip4, 140 (struct fib_result *)arg->result, 141 arg->flags); 142 143 rcu_read_unlock(); 144 return err; 145 } 146 147 INDIRECT_CALLABLE_SCOPE bool fib4_rule_suppress(struct fib_rule *rule, 148 int flags, 149 struct fib_lookup_arg *arg) 150 { 151 struct fib_result *result = arg->result; 152 struct net_device *dev = NULL; 153 154 if (result->fi) { 155 struct fib_nh_common *nhc = fib_info_nhc(result->fi, 0); 156 157 dev = nhc->nhc_dev; 158 } 159 160 /* do not accept result if the route does 161 * not meet the required prefix length 162 */ 163 if (result->prefixlen <= rule->suppress_prefixlen) 164 goto suppress_route; 165 166 /* do not accept result if the route uses a device 167 * belonging to a forbidden interface group 168 */ 169 if (rule->suppress_ifgroup != -1 && dev && dev->group == rule->suppress_ifgroup) 170 goto suppress_route; 171 172 return false; 173 174 suppress_route: 175 if (!(arg->flags & FIB_LOOKUP_NOREF)) 176 fib_info_put(result->fi); 177 return true; 178 } 179 180 INDIRECT_CALLABLE_SCOPE int fib4_rule_match(struct fib_rule *rule, 181 struct flowi *fl, int flags) 182 { 183 struct fib4_rule *r = (struct fib4_rule *) rule; 184 struct flowi4 *fl4 = &fl->u.ip4; 185 __be32 daddr = fl4->daddr; 186 __be32 saddr = fl4->saddr; 187 188 if (((saddr ^ r->src) & r->srcmask) || 189 ((daddr ^ r->dst) & r->dstmask)) 190 return 0; 191 192 /* When DSCP selector is used we need to match on the entire DSCP field 193 * in the flow information structure. When TOS selector is used we need 194 * to mask the upper three DSCP bits prior to matching to maintain 195 * legacy behavior. 196 */ 197 if (r->dscp_full && (r->dscp ^ fl4->flowi4_dscp) & r->dscp_mask) 198 return 0; 199 else if (!r->dscp_full && r->dscp && 200 !fib_dscp_masked_match(r->dscp, fl4)) 201 return 0; 202 203 if (rule->ip_proto && (rule->ip_proto != fl4->flowi4_proto)) 204 return 0; 205 206 if (!fib_rule_port_match(&rule->sport_range, rule->sport_mask, 207 fl4->fl4_sport)) 208 return 0; 209 210 if (!fib_rule_port_match(&rule->dport_range, rule->dport_mask, 211 fl4->fl4_dport)) 212 return 0; 213 214 return 1; 215 } 216 217 #define FIB_MAX_AUTO_TABLE_ID 4096 218 219 static struct fib_table *fib_empty_table(struct net *net) 220 { 221 u32 id = 1; 222 223 while (1) { 224 if (!fib_get_table(net, id)) 225 return fib_new_table(net, id); 226 227 if (id++ == FIB_MAX_AUTO_TABLE_ID) 228 break; 229 } 230 return NULL; 231 } 232 233 static int fib4_nl2rule_dscp(const struct nlattr *nla, struct fib4_rule *rule4, 234 struct netlink_ext_ack *extack) 235 { 236 if (rule4->dscp) { 237 NL_SET_ERR_MSG(extack, "Cannot specify both TOS and DSCP"); 238 return -EINVAL; 239 } 240 241 rule4->dscp = inet_dsfield_to_dscp(nla_get_u8(nla) << 2); 242 rule4->dscp_mask = inet_dsfield_to_dscp(INET_DSCP_MASK); 243 rule4->dscp_full = true; 244 245 return 0; 246 } 247 248 static int fib4_nl2rule_dscp_mask(const struct nlattr *nla, 249 struct fib4_rule *rule4, 250 struct netlink_ext_ack *extack) 251 { 252 dscp_t dscp_mask; 253 254 if (!rule4->dscp_full) { 255 NL_SET_ERR_MSG_ATTR(extack, nla, 256 "Cannot specify DSCP mask without DSCP value"); 257 return -EINVAL; 258 } 259 260 dscp_mask = inet_dsfield_to_dscp(nla_get_u8(nla) << 2); 261 if (rule4->dscp & ~dscp_mask) { 262 NL_SET_ERR_MSG_ATTR(extack, nla, "Invalid DSCP mask"); 263 return -EINVAL; 264 } 265 266 rule4->dscp_mask = dscp_mask; 267 268 return 0; 269 } 270 271 static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb, 272 struct fib_rule_hdr *frh, 273 struct nlattr **tb, 274 struct netlink_ext_ack *extack) 275 { 276 struct fib4_rule *rule4 = (struct fib4_rule *)rule; 277 struct net *net = rule->fr_net; 278 int err = -EINVAL; 279 280 if (tb[FRA_FLOWLABEL] || tb[FRA_FLOWLABEL_MASK]) { 281 NL_SET_ERR_MSG(extack, 282 "Flow label cannot be specified for IPv4 FIB rules"); 283 goto errout; 284 } 285 286 if (!inet_validate_dscp(frh->tos)) { 287 NL_SET_ERR_MSG(extack, 288 "Invalid dsfield (tos): ECN bits must be 0"); 289 goto errout; 290 } 291 /* IPv4 currently doesn't handle high order DSCP bits correctly */ 292 if (frh->tos & ~IPTOS_TOS_MASK) { 293 NL_SET_ERR_MSG(extack, "Invalid tos"); 294 goto errout; 295 } 296 rule4->dscp = inet_dsfield_to_dscp(frh->tos); 297 298 if (tb[FRA_DSCP] && 299 fib4_nl2rule_dscp(tb[FRA_DSCP], rule4, extack) < 0) 300 goto errout; 301 302 if (tb[FRA_DSCP_MASK] && 303 fib4_nl2rule_dscp_mask(tb[FRA_DSCP_MASK], rule4, extack) < 0) 304 goto errout; 305 306 if (!net->ipv4.fib_has_custom_rules) { 307 /* split local/main if they are not already split */ 308 err = fib_unmerge(net); 309 if (err) 310 goto errout; 311 } 312 313 if (rule->table == RT_TABLE_UNSPEC && !rule->l3mdev) { 314 if (rule->action == FR_ACT_TO_TBL) { 315 struct fib_table *table; 316 317 table = fib_empty_table(net); 318 if (!table) { 319 err = -ENOBUFS; 320 goto errout; 321 } 322 323 rule->table = table->tb_id; 324 } 325 } 326 327 if (frh->src_len) 328 rule4->src = nla_get_in_addr(tb[FRA_SRC]); 329 330 if (frh->dst_len) 331 rule4->dst = nla_get_in_addr(tb[FRA_DST]); 332 333 #ifdef CONFIG_IP_ROUTE_CLASSID 334 if (tb[FRA_FLOW]) { 335 rule4->tclassid = nla_get_u32(tb[FRA_FLOW]); 336 if (rule4->tclassid) 337 atomic_inc(&net->ipv4.fib_num_tclassid_users); 338 } 339 #endif 340 341 if (fib_rule_requires_fldissect(rule)) 342 net->ipv4.fib_rules_require_fldissect++; 343 344 rule4->src_len = frh->src_len; 345 rule4->srcmask = inet_make_mask(rule4->src_len); 346 rule4->dst_len = frh->dst_len; 347 rule4->dstmask = inet_make_mask(rule4->dst_len); 348 349 net->ipv4.fib_has_custom_rules = true; 350 351 err = 0; 352 errout: 353 return err; 354 } 355 356 static void fib4_rule_delete(struct fib_rule *rule) 357 { 358 struct net *net = rule->fr_net; 359 360 #ifdef CONFIG_IP_ROUTE_CLASSID 361 if (((struct fib4_rule *)rule)->tclassid) 362 atomic_dec(&net->ipv4.fib_num_tclassid_users); 363 #endif 364 365 if (net->ipv4.fib_rules_require_fldissect && 366 fib_rule_requires_fldissect(rule)) 367 net->ipv4.fib_rules_require_fldissect--; 368 } 369 370 static int fib4_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh, 371 struct nlattr **tb) 372 { 373 struct fib4_rule *rule4 = (struct fib4_rule *) rule; 374 375 if (frh->src_len && (rule4->src_len != frh->src_len)) 376 return 0; 377 378 if (frh->dst_len && (rule4->dst_len != frh->dst_len)) 379 return 0; 380 381 if (frh->tos && 382 (rule4->dscp_full || 383 inet_dscp_to_dsfield(rule4->dscp) != frh->tos)) 384 return 0; 385 386 if (tb[FRA_DSCP]) { 387 dscp_t dscp; 388 389 dscp = inet_dsfield_to_dscp(nla_get_u8(tb[FRA_DSCP]) << 2); 390 if (!rule4->dscp_full || rule4->dscp != dscp) 391 return 0; 392 } 393 394 if (tb[FRA_DSCP_MASK]) { 395 dscp_t dscp_mask; 396 397 dscp_mask = inet_dsfield_to_dscp(nla_get_u8(tb[FRA_DSCP_MASK]) << 2); 398 if (!rule4->dscp_full || rule4->dscp_mask != dscp_mask) 399 return 0; 400 } 401 402 #ifdef CONFIG_IP_ROUTE_CLASSID 403 if (tb[FRA_FLOW] && (rule4->tclassid != nla_get_u32(tb[FRA_FLOW]))) 404 return 0; 405 #endif 406 407 if (frh->src_len && (rule4->src != nla_get_in_addr(tb[FRA_SRC]))) 408 return 0; 409 410 if (frh->dst_len && (rule4->dst != nla_get_in_addr(tb[FRA_DST]))) 411 return 0; 412 413 return 1; 414 } 415 416 static int fib4_rule_fill(struct fib_rule *rule, struct sk_buff *skb, 417 struct fib_rule_hdr *frh) 418 { 419 struct fib4_rule *rule4 = (struct fib4_rule *) rule; 420 421 frh->dst_len = rule4->dst_len; 422 frh->src_len = rule4->src_len; 423 424 if (rule4->dscp_full) { 425 frh->tos = 0; 426 if (nla_put_u8(skb, FRA_DSCP, 427 inet_dscp_to_dsfield(rule4->dscp) >> 2) || 428 nla_put_u8(skb, FRA_DSCP_MASK, 429 inet_dscp_to_dsfield(rule4->dscp_mask) >> 2)) 430 goto nla_put_failure; 431 } else { 432 frh->tos = inet_dscp_to_dsfield(rule4->dscp); 433 } 434 435 if ((rule4->dst_len && 436 nla_put_in_addr(skb, FRA_DST, rule4->dst)) || 437 (rule4->src_len && 438 nla_put_in_addr(skb, FRA_SRC, rule4->src))) 439 goto nla_put_failure; 440 #ifdef CONFIG_IP_ROUTE_CLASSID 441 if (rule4->tclassid && 442 nla_put_u32(skb, FRA_FLOW, rule4->tclassid)) 443 goto nla_put_failure; 444 #endif 445 return 0; 446 447 nla_put_failure: 448 return -ENOBUFS; 449 } 450 451 static size_t fib4_rule_nlmsg_payload(struct fib_rule *rule) 452 { 453 return nla_total_size(4) /* dst */ 454 + nla_total_size(4) /* src */ 455 + nla_total_size(4) /* flow */ 456 + nla_total_size(1) /* dscp */ 457 + nla_total_size(1); /* dscp mask */ 458 } 459 460 static void fib4_rule_flush_cache(struct fib_rules_ops *ops) 461 { 462 rt_cache_flush(ops->fro_net); 463 } 464 465 static bool fib4_rule_need_rtnl(struct net *net) 466 { 467 return !net->ipv4.fib_has_custom_rules; 468 } 469 470 static const struct fib_rules_ops __net_initconst fib4_rules_ops_template = { 471 .family = AF_INET, 472 .rule_size = sizeof(struct fib4_rule), 473 .addr_size = sizeof(u32), 474 .action = fib4_rule_action, 475 .suppress = fib4_rule_suppress, 476 .match = fib4_rule_match, 477 .configure = fib4_rule_configure, 478 .delete = fib4_rule_delete, 479 .compare = fib4_rule_compare, 480 .fill = fib4_rule_fill, 481 .nlmsg_payload = fib4_rule_nlmsg_payload, 482 .flush_cache = fib4_rule_flush_cache, 483 .need_rtnl = fib4_rule_need_rtnl, 484 .nlgroup = RTNLGRP_IPV4_RULE, 485 .owner = THIS_MODULE, 486 }; 487 488 static int fib_default_rules_init(struct fib_rules_ops *ops) 489 { 490 int err; 491 492 err = fib_default_rule_add(ops, 0, RT_TABLE_LOCAL); 493 if (err < 0) 494 return err; 495 err = fib_default_rule_add(ops, 0x7FFE, RT_TABLE_MAIN); 496 if (err < 0) 497 return err; 498 err = fib_default_rule_add(ops, 0x7FFF, RT_TABLE_DEFAULT); 499 if (err < 0) 500 return err; 501 return 0; 502 } 503 504 int __net_init fib4_rules_init(struct net *net) 505 { 506 int err; 507 struct fib_rules_ops *ops; 508 509 ops = fib_rules_register(&fib4_rules_ops_template, net); 510 if (IS_ERR(ops)) 511 return PTR_ERR(ops); 512 513 err = fib_default_rules_init(ops); 514 if (err < 0) 515 goto fail; 516 net->ipv4.rules_ops = ops; 517 net->ipv4.fib_has_custom_rules = false; 518 net->ipv4.fib_rules_require_fldissect = 0; 519 return 0; 520 521 fail: 522 /* also cleans all rules already added */ 523 fib_rules_unregister(ops); 524 return err; 525 } 526 527 void __net_exit fib4_rules_exit(struct net *net) 528 { 529 fib_rules_unregister(net->ipv4.rules_ops); 530 } 531