1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * INET An implementation of the TCP/IP protocol suite for the LINUX
4 * operating system. INET is implemented using the BSD Socket
5 * interface as the means of communication with the user level.
6 *
7 * IPv4 Forwarding Information Base: FIB frontend.
8 *
9 * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
10 */
11
12 #include <linux/module.h>
13 #include <linux/uaccess.h>
14 #include <linux/bitops.h>
15 #include <linux/capability.h>
16 #include <linux/types.h>
17 #include <linux/kernel.h>
18 #include <linux/mm.h>
19 #include <linux/string.h>
20 #include <linux/socket.h>
21 #include <linux/sockios.h>
22 #include <linux/errno.h>
23 #include <linux/in.h>
24 #include <linux/inet.h>
25 #include <linux/inetdevice.h>
26 #include <linux/netdevice.h>
27 #include <linux/if_addr.h>
28 #include <linux/if_arp.h>
29 #include <linux/skbuff.h>
30 #include <linux/cache.h>
31 #include <linux/init.h>
32 #include <linux/list.h>
33 #include <linux/slab.h>
34
35 #include <net/flow.h>
36 #include <net/inet_dscp.h>
37 #include <net/ip.h>
38 #include <net/protocol.h>
39 #include <net/route.h>
40 #include <net/tcp.h>
41 #include <net/sock.h>
42 #include <net/arp.h>
43 #include <net/ip_fib.h>
44 #include <net/nexthop.h>
45 #include <net/rtnetlink.h>
46 #include <net/xfrm.h>
47 #include <net/l3mdev.h>
48 #include <net/lwtunnel.h>
49 #include <trace/events/fib.h>
50
51 #ifndef CONFIG_IP_MULTIPLE_TABLES
52
fib4_rules_init(struct net * net)53 static int __net_init fib4_rules_init(struct net *net)
54 {
55 struct fib_table *local_table, *main_table;
56
57 main_table = fib_trie_table(RT_TABLE_MAIN, NULL);
58 if (!main_table)
59 return -ENOMEM;
60
61 local_table = fib_trie_table(RT_TABLE_LOCAL, main_table);
62 if (!local_table)
63 goto fail;
64
65 hlist_add_head_rcu(&local_table->tb_hlist,
66 &net->ipv4.fib_table_hash[TABLE_LOCAL_INDEX]);
67 hlist_add_head_rcu(&main_table->tb_hlist,
68 &net->ipv4.fib_table_hash[TABLE_MAIN_INDEX]);
69 return 0;
70
71 fail:
72 fib_free_table(main_table);
73 return -ENOMEM;
74 }
75 #else
76
fib_new_table(struct net * net,u32 id)77 struct fib_table *fib_new_table(struct net *net, u32 id)
78 {
79 struct fib_table *tb, *new_tb, *alias = NULL;
80 unsigned int h;
81
82 if (id == 0)
83 id = RT_TABLE_MAIN;
84 tb = fib_get_table(net, id);
85 if (tb)
86 return tb;
87
88 if (!check_net(net))
89 return NULL;
90
91 if (id == RT_TABLE_LOCAL && !net->ipv4.fib_has_custom_rules)
92 alias = fib_new_table(net, RT_TABLE_MAIN);
93
94 new_tb = fib_trie_table(id, alias);
95 if (!new_tb)
96 return NULL;
97
98 spin_lock(&net->ipv4.fib_table_hash_lock);
99
100 tb = fib_get_table(net, id);
101 if (tb) {
102 spin_unlock(&net->ipv4.fib_table_hash_lock);
103 fib_free_table(new_tb);
104 return tb;
105 }
106
107 tb = new_tb;
108
109 switch (id) {
110 case RT_TABLE_MAIN:
111 rcu_assign_pointer(net->ipv4.fib_main, tb);
112 break;
113 case RT_TABLE_DEFAULT:
114 rcu_assign_pointer(net->ipv4.fib_default, tb);
115 break;
116 default:
117 break;
118 }
119
120 h = id & (FIB_TABLE_HASHSZ - 1);
121 hlist_add_head_rcu(&tb->tb_hlist, &net->ipv4.fib_table_hash[h]);
122
123 spin_unlock(&net->ipv4.fib_table_hash_lock);
124
125 return tb;
126 }
127 EXPORT_SYMBOL_GPL(fib_new_table);
128
fib_get_table(struct net * net,u32 id)129 struct fib_table *fib_get_table(struct net *net, u32 id)
130 {
131 struct fib_table *tb = NULL;
132 struct hlist_head *head;
133 unsigned int h;
134
135 if (id == 0)
136 id = RT_TABLE_MAIN;
137 h = id & (FIB_TABLE_HASHSZ - 1);
138 head = &net->ipv4.fib_table_hash[h];
139
140 /* fib_table is not destroyed until ip_fib_net_exit()
141 * except for the merged main/local table.
142 * fib_unmerge() is called under RTNL, so other readers
143 * under RTNL (e.g. fib_flush(), fib_info_notify_update())
144 * can safely traverse the list with rcu_dereference_raw().
145 */
146 hlist_for_each_entry_rcu(tb, head, tb_hlist, true)
147 if (tb->tb_id == id)
148 break;
149
150 return tb;
151 }
152 #endif /* CONFIG_IP_MULTIPLE_TABLES */
153
fib_replace_table(struct net * net,struct fib_table * old,struct fib_table * new)154 static void fib_replace_table(struct net *net, struct fib_table *old,
155 struct fib_table *new)
156 {
157 #ifdef CONFIG_IP_MULTIPLE_TABLES
158 switch (new->tb_id) {
159 case RT_TABLE_MAIN:
160 rcu_assign_pointer(net->ipv4.fib_main, new);
161 break;
162 case RT_TABLE_DEFAULT:
163 rcu_assign_pointer(net->ipv4.fib_default, new);
164 break;
165 default:
166 break;
167 }
168
169 #endif
170 /* replace the old table in the hlist */
171 hlist_replace_rcu(&old->tb_hlist, &new->tb_hlist);
172 }
173
fib_unmerge(struct net * net)174 int fib_unmerge(struct net *net)
175 {
176 struct fib_table *old, *new, *main_table;
177
178 /* attempt to fetch local table if it has been allocated */
179 old = fib_get_table(net, RT_TABLE_LOCAL);
180 if (!old)
181 return 0;
182
183 new = fib_trie_unmerge(old);
184 if (!new)
185 return -ENOMEM;
186
187 /* table is already unmerged */
188 if (new == old)
189 return 0;
190
191 /* replace merged table with clean table */
192 fib_replace_table(net, old, new);
193 fib_free_table(old);
194
195 /* attempt to fetch main table if it has been allocated */
196 main_table = fib_get_table(net, RT_TABLE_MAIN);
197 if (!main_table)
198 return 0;
199
200 /* flush local entries from main table */
201 fib_table_flush_external(main_table);
202
203 return 0;
204 }
205
fib_flush(struct net * net)206 void fib_flush(struct net *net)
207 {
208 int flushed = 0;
209 unsigned int h;
210
211 for (h = 0; h < FIB_TABLE_HASHSZ; h++) {
212 struct hlist_head *head = &net->ipv4.fib_table_hash[h];
213 struct fib_table *tb;
214
215 hlist_for_each_entry_rcu(tb, head, tb_hlist, true)
216 flushed += fib_table_flush(net, tb, false);
217 }
218
219 if (flushed)
220 rt_cache_flush(net);
221 }
222
223 /*
224 * Find address type as if only "dev" was present in the system. If
225 * on_dev is NULL then all interfaces are taken into consideration.
226 */
__inet_dev_addr_type(struct net * net,const struct net_device * dev,__be32 addr,u32 tb_id)227 static inline unsigned int __inet_dev_addr_type(struct net *net,
228 const struct net_device *dev,
229 __be32 addr, u32 tb_id)
230 {
231 struct flowi4 fl4 = { .daddr = addr };
232 struct fib_result res;
233 unsigned int ret = RTN_BROADCAST;
234 struct fib_table *table;
235
236 if (ipv4_is_zeronet(addr) || ipv4_is_lbcast(addr))
237 return RTN_BROADCAST;
238 if (ipv4_is_multicast(addr))
239 return RTN_MULTICAST;
240
241 rcu_read_lock();
242
243 table = fib_get_table(net, tb_id);
244 if (table) {
245 ret = RTN_UNICAST;
246 if (!fib_table_lookup(table, &fl4, &res, FIB_LOOKUP_NOREF)) {
247 struct fib_nh_common *nhc = fib_info_nhc(res.fi, 0);
248
249 if (!dev || dev == nhc->nhc_dev)
250 ret = res.type;
251 }
252 }
253
254 rcu_read_unlock();
255 return ret;
256 }
257
inet_addr_type_table(struct net * net,__be32 addr,u32 tb_id)258 unsigned int inet_addr_type_table(struct net *net, __be32 addr, u32 tb_id)
259 {
260 return __inet_dev_addr_type(net, NULL, addr, tb_id);
261 }
262 EXPORT_SYMBOL(inet_addr_type_table);
263
inet_addr_type(struct net * net,__be32 addr)264 unsigned int inet_addr_type(struct net *net, __be32 addr)
265 {
266 return __inet_dev_addr_type(net, NULL, addr, RT_TABLE_LOCAL);
267 }
268 EXPORT_SYMBOL(inet_addr_type);
269
inet_dev_addr_type(struct net * net,const struct net_device * dev,__be32 addr)270 unsigned int inet_dev_addr_type(struct net *net, const struct net_device *dev,
271 __be32 addr)
272 {
273 u32 rt_table = l3mdev_fib_table(dev) ? : RT_TABLE_LOCAL;
274
275 return __inet_dev_addr_type(net, dev, addr, rt_table);
276 }
277 EXPORT_SYMBOL(inet_dev_addr_type);
278
279 /* inet_addr_type with dev == NULL but using the table from a dev
280 * if one is associated
281 */
inet_addr_type_dev_table(struct net * net,const struct net_device * dev,__be32 addr)282 unsigned int inet_addr_type_dev_table(struct net *net,
283 const struct net_device *dev,
284 __be32 addr)
285 {
286 u32 rt_table = l3mdev_fib_table(dev) ? : RT_TABLE_LOCAL;
287
288 return __inet_dev_addr_type(net, NULL, addr, rt_table);
289 }
290 EXPORT_SYMBOL(inet_addr_type_dev_table);
291
fib_compute_spec_dst(struct sk_buff * skb)292 __be32 fib_compute_spec_dst(struct sk_buff *skb)
293 {
294 struct net_device *dev = skb->dev;
295 struct in_device *in_dev;
296 struct fib_result res;
297 struct rtable *rt;
298 struct net *net;
299 int scope;
300
301 rt = skb_rtable(skb);
302 if ((rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST | RTCF_LOCAL)) ==
303 RTCF_LOCAL)
304 return ip_hdr(skb)->daddr;
305
306 in_dev = __in_dev_get_rcu(dev);
307
308 net = dev_net(dev);
309
310 scope = RT_SCOPE_UNIVERSE;
311 if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) {
312 bool vmark = in_dev && IN_DEV_SRC_VMARK(in_dev);
313 struct flowi4 fl4 = {
314 .flowi4_iif = LOOPBACK_IFINDEX,
315 .flowi4_l3mdev = l3mdev_master_ifindex_rcu(dev),
316 .daddr = ip_hdr(skb)->saddr,
317 .flowi4_dscp = ip4h_dscp(ip_hdr(skb)),
318 .flowi4_scope = scope,
319 .flowi4_mark = vmark ? skb->mark : 0,
320 };
321 if (!fib_lookup(net, &fl4, &res, 0))
322 return fib_result_prefsrc(net, &res);
323 } else {
324 scope = RT_SCOPE_LINK;
325 }
326
327 return inet_select_addr(dev, ip_hdr(skb)->saddr, scope);
328 }
329
fib_info_nh_uses_dev(struct fib_info * fi,const struct net_device * dev)330 bool fib_info_nh_uses_dev(struct fib_info *fi, const struct net_device *dev)
331 {
332 bool dev_match = false;
333 #ifdef CONFIG_IP_ROUTE_MULTIPATH
334 if (unlikely(fi->nh)) {
335 dev_match = nexthop_uses_dev(fi->nh, dev);
336 } else {
337 int ret;
338
339 for (ret = 0; ret < fib_info_num_path(fi); ret++) {
340 const struct fib_nh_common *nhc = fib_info_nhc(fi, ret);
341
342 if (nhc_l3mdev_matches_dev(nhc, dev)) {
343 dev_match = true;
344 break;
345 }
346 }
347 }
348 #else
349 if (fib_info_nhc(fi, 0)->nhc_dev == dev)
350 dev_match = true;
351 #endif
352
353 return dev_match;
354 }
355 EXPORT_SYMBOL_GPL(fib_info_nh_uses_dev);
356
357 /* Given (packet source, input interface) and optional (dst, oif, tos):
358 * - (main) check, that source is valid i.e. not broadcast or our local
359 * address.
360 * - figure out what "logical" interface this packet arrived
361 * and calculate "specific destination" address.
362 * - check, that packet arrived from expected physical interface.
363 * called with rcu_read_lock()
364 */
__fib_validate_source(struct sk_buff * skb,__be32 src,__be32 dst,dscp_t dscp,int oif,struct net_device * dev,int rpf,struct in_device * idev,u32 * itag)365 static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
366 dscp_t dscp, int oif, struct net_device *dev,
367 int rpf, struct in_device *idev, u32 *itag)
368 {
369 struct net *net = dev_net(dev);
370 enum skb_drop_reason reason;
371 struct flow_keys flkeys;
372 int ret, no_addr;
373 struct fib_result res;
374 struct flowi4 fl4;
375 bool dev_match;
376
377 fl4.flowi4_oif = 0;
378 fl4.flowi4_l3mdev = l3mdev_master_ifindex_rcu(dev);
379 fl4.flowi4_iif = oif ? : LOOPBACK_IFINDEX;
380 fl4.daddr = src;
381 fl4.saddr = dst;
382 fl4.flowi4_dscp = dscp;
383 fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
384 fl4.flowi4_tun_key.tun_id = 0;
385 fl4.flowi4_flags = 0;
386 fl4.flowi4_uid = sock_net_uid(net, NULL);
387 fl4.flowi4_multipath_hash = 0;
388
389 no_addr = idev->ifa_list == NULL;
390
391 fl4.flowi4_mark = IN_DEV_SRC_VMARK(idev) ? skb->mark : 0;
392 if (!fib4_rules_early_flow_dissect(net, skb, &fl4, &flkeys)) {
393 fl4.flowi4_proto = 0;
394 fl4.fl4_sport = 0;
395 fl4.fl4_dport = 0;
396 } else {
397 swap(fl4.fl4_sport, fl4.fl4_dport);
398 }
399
400 if (fib_lookup(net, &fl4, &res, 0))
401 goto last_resort;
402 if (res.type != RTN_UNICAST) {
403 if (res.type != RTN_LOCAL) {
404 reason = SKB_DROP_REASON_IP_INVALID_SOURCE;
405 goto e_inval;
406 } else if (!IN_DEV_ACCEPT_LOCAL(idev)) {
407 reason = SKB_DROP_REASON_IP_LOCAL_SOURCE;
408 goto e_inval;
409 }
410 }
411 fib_combine_itag(itag, &res);
412
413 dev_match = fib_info_nh_uses_dev(res.fi, dev);
414 /* This is not common, loopback packets retain skb_dst so normally they
415 * would not even hit this slow path.
416 */
417 dev_match = dev_match || (res.type == RTN_LOCAL &&
418 dev == net->loopback_dev);
419 if (dev_match) {
420 ret = FIB_RES_NHC(res)->nhc_scope >= RT_SCOPE_HOST;
421 return ret;
422 }
423 if (no_addr)
424 goto last_resort;
425 if (rpf == 1)
426 goto e_rpf;
427 fl4.flowi4_oif = dev->ifindex;
428
429 ret = 0;
430 if (fib_lookup(net, &fl4, &res, FIB_LOOKUP_IGNORE_LINKSTATE) == 0) {
431 if (res.type == RTN_UNICAST)
432 ret = FIB_RES_NHC(res)->nhc_scope >= RT_SCOPE_HOST;
433 }
434 return ret;
435
436 last_resort:
437 if (rpf)
438 goto e_rpf;
439 *itag = 0;
440 return 0;
441
442 e_inval:
443 return -reason;
444 e_rpf:
445 return -SKB_DROP_REASON_IP_RPFILTER;
446 }
447
448 /* Ignore rp_filter for packets protected by IPsec. */
fib_validate_source(struct sk_buff * skb,__be32 src,__be32 dst,dscp_t dscp,int oif,struct net_device * dev,struct in_device * idev,u32 * itag)449 int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
450 dscp_t dscp, int oif, struct net_device *dev,
451 struct in_device *idev, u32 *itag)
452 {
453 int r = secpath_exists(skb) ? 0 : IN_DEV_RPFILTER(idev);
454 struct net *net = dev_net(dev);
455
456 if (!r && !fib_num_tclassid_users(net) &&
457 (dev->ifindex != oif || !IN_DEV_TX_REDIRECTS(idev))) {
458 if (IN_DEV_ACCEPT_LOCAL(idev))
459 goto ok;
460 /* with custom local routes in place, checking local addresses
461 * only will be too optimistic, with custom rules, checking
462 * local addresses only can be too strict, e.g. due to vrf
463 */
464 if (net->ipv4.fib_has_custom_local_routes ||
465 fib4_has_custom_rules(net))
466 goto full_check;
467 /* Within the same container, it is regarded as a martian source,
468 * and the same host but different containers are not.
469 */
470 if (inet_lookup_ifaddr_rcu(net, src))
471 return -SKB_DROP_REASON_IP_LOCAL_SOURCE;
472
473 ok:
474 *itag = 0;
475 return 0;
476 }
477
478 full_check:
479 return __fib_validate_source(skb, src, dst, dscp, oif, dev, r, idev,
480 itag);
481 }
482
sk_extract_addr(struct sockaddr * addr)483 static inline __be32 sk_extract_addr(struct sockaddr *addr)
484 {
485 return ((struct sockaddr_in *) addr)->sin_addr.s_addr;
486 }
487
put_rtax(struct nlattr * mx,int len,int type,u32 value)488 static int put_rtax(struct nlattr *mx, int len, int type, u32 value)
489 {
490 struct nlattr *nla;
491
492 nla = (struct nlattr *) ((char *) mx + len);
493 nla->nla_type = type;
494 nla->nla_len = nla_attr_size(4);
495 *(u32 *) nla_data(nla) = value;
496
497 return len + nla_total_size(4);
498 }
499
rtentry_to_fib_config(struct net * net,int cmd,struct rtentry * rt,struct fib_config * cfg)500 static int rtentry_to_fib_config(struct net *net, int cmd, struct rtentry *rt,
501 struct fib_config *cfg)
502 {
503 __be32 addr;
504 int plen;
505
506 memset(cfg, 0, sizeof(*cfg));
507 cfg->fc_nlinfo.nl_net = net;
508
509 if (rt->rt_dst.sa_family != AF_INET)
510 return -EAFNOSUPPORT;
511
512 /*
513 * Check mask for validity:
514 * a) it must be contiguous.
515 * b) destination must have all host bits clear.
516 * c) if application forgot to set correct family (AF_INET),
517 * reject request unless it is absolutely clear i.e.
518 * both family and mask are zero.
519 */
520 plen = 32;
521 addr = sk_extract_addr(&rt->rt_dst);
522 if (!(rt->rt_flags & RTF_HOST)) {
523 __be32 mask = sk_extract_addr(&rt->rt_genmask);
524
525 if (rt->rt_genmask.sa_family != AF_INET) {
526 if (mask || rt->rt_genmask.sa_family)
527 return -EAFNOSUPPORT;
528 }
529
530 if (bad_mask(mask, addr))
531 return -EINVAL;
532
533 plen = inet_mask_len(mask);
534 }
535
536 cfg->fc_dst_len = plen;
537 cfg->fc_dst = addr;
538
539 if (cmd != SIOCDELRT) {
540 cfg->fc_nlflags = NLM_F_CREATE;
541 cfg->fc_protocol = RTPROT_BOOT;
542 }
543
544 if (rt->rt_metric)
545 cfg->fc_priority = rt->rt_metric - 1;
546
547 if (rt->rt_flags & RTF_REJECT) {
548 cfg->fc_scope = RT_SCOPE_HOST;
549 cfg->fc_type = RTN_UNREACHABLE;
550 return 0;
551 }
552
553 cfg->fc_scope = RT_SCOPE_NOWHERE;
554 cfg->fc_type = RTN_UNICAST;
555
556 if (rt->rt_dev) {
557 char *colon;
558 struct net_device *dev;
559 char devname[IFNAMSIZ];
560
561 if (copy_from_user(devname, rt->rt_dev, IFNAMSIZ-1))
562 return -EFAULT;
563
564 devname[IFNAMSIZ-1] = 0;
565 colon = strchr(devname, ':');
566 if (colon)
567 *colon = 0;
568 dev = __dev_get_by_name(net, devname);
569 if (!dev)
570 return -ENODEV;
571 cfg->fc_oif = dev->ifindex;
572 cfg->fc_table = l3mdev_fib_table(dev);
573 if (colon) {
574 const struct in_ifaddr *ifa;
575 struct in_device *in_dev;
576
577 in_dev = __in_dev_get_rtnl_net(dev);
578 if (!in_dev)
579 return -ENODEV;
580
581 *colon = ':';
582
583 in_dev_for_each_ifa_rtnl_net(net, ifa, in_dev) {
584 if (strcmp(ifa->ifa_label, devname) == 0)
585 break;
586 }
587
588 if (!ifa)
589 return -ENODEV;
590 cfg->fc_prefsrc = ifa->ifa_local;
591 }
592 }
593
594 addr = sk_extract_addr(&rt->rt_gateway);
595 if (rt->rt_gateway.sa_family == AF_INET && addr) {
596 unsigned int addr_type;
597
598 cfg->fc_gw4 = addr;
599 cfg->fc_gw_family = AF_INET;
600 addr_type = inet_addr_type_table(net, addr, cfg->fc_table);
601 if (rt->rt_flags & RTF_GATEWAY &&
602 addr_type == RTN_UNICAST)
603 cfg->fc_scope = RT_SCOPE_UNIVERSE;
604 }
605
606 if (!cfg->fc_table)
607 cfg->fc_table = RT_TABLE_MAIN;
608
609 if (cmd == SIOCDELRT)
610 return 0;
611
612 if (rt->rt_flags & RTF_GATEWAY && !cfg->fc_gw_family)
613 return -EINVAL;
614
615 if (cfg->fc_scope == RT_SCOPE_NOWHERE)
616 cfg->fc_scope = RT_SCOPE_LINK;
617
618 if (rt->rt_flags & (RTF_MTU | RTF_WINDOW | RTF_IRTT)) {
619 struct nlattr *mx;
620 int len = 0;
621
622 mx = kcalloc(3, nla_total_size(4), GFP_KERNEL);
623 if (!mx)
624 return -ENOMEM;
625
626 if (rt->rt_flags & RTF_MTU)
627 len = put_rtax(mx, len, RTAX_ADVMSS, rt->rt_mtu - 40);
628
629 if (rt->rt_flags & RTF_WINDOW)
630 len = put_rtax(mx, len, RTAX_WINDOW, rt->rt_window);
631
632 if (rt->rt_flags & RTF_IRTT)
633 len = put_rtax(mx, len, RTAX_RTT, rt->rt_irtt << 3);
634
635 cfg->fc_mx = mx;
636 cfg->fc_mx_len = len;
637 }
638
639 return 0;
640 }
641
642 /*
643 * Handle IP routing ioctl calls.
644 * These are used to manipulate the routing tables
645 */
ip_rt_ioctl(struct net * net,unsigned int cmd,struct rtentry * rt)646 int ip_rt_ioctl(struct net *net, unsigned int cmd, struct rtentry *rt)
647 {
648 struct fib_config cfg;
649 int err;
650
651 switch (cmd) {
652 case SIOCADDRT: /* Add a route */
653 case SIOCDELRT: /* Delete a route */
654 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
655 return -EPERM;
656
657 rtnl_net_lock(net);
658 err = rtentry_to_fib_config(net, cmd, rt, &cfg);
659 if (err == 0) {
660 struct fib_table *tb;
661
662 if (cmd == SIOCDELRT) {
663 tb = fib_get_table(net, cfg.fc_table);
664 if (tb)
665 err = fib_table_delete(net, tb, &cfg,
666 NULL);
667 else
668 err = -ESRCH;
669 } else {
670 tb = fib_new_table(net, cfg.fc_table);
671 if (tb)
672 err = fib_table_insert(net, tb,
673 &cfg, NULL);
674 else
675 err = -ENOBUFS;
676 }
677
678 /* allocated by rtentry_to_fib_config() */
679 kfree(cfg.fc_mx);
680 }
681 rtnl_net_unlock(net);
682 return err;
683 }
684 return -EINVAL;
685 }
686
687 const struct nla_policy rtm_ipv4_policy[RTA_MAX + 1] = {
688 [RTA_UNSPEC] = { .strict_start_type = RTA_DPORT + 1 },
689 [RTA_DST] = { .type = NLA_U32 },
690 [RTA_SRC] = { .type = NLA_U32 },
691 [RTA_IIF] = { .type = NLA_U32 },
692 [RTA_OIF] = { .type = NLA_U32 },
693 [RTA_GATEWAY] = { .type = NLA_U32 },
694 [RTA_PRIORITY] = { .type = NLA_U32 },
695 [RTA_PREFSRC] = { .type = NLA_U32 },
696 [RTA_METRICS] = { .type = NLA_NESTED },
697 [RTA_MULTIPATH] = { .len = sizeof(struct rtnexthop) },
698 [RTA_FLOW] = { .type = NLA_U32 },
699 [RTA_ENCAP_TYPE] = { .type = NLA_U16 },
700 [RTA_ENCAP] = { .type = NLA_NESTED },
701 [RTA_UID] = { .type = NLA_U32 },
702 [RTA_MARK] = { .type = NLA_U32 },
703 [RTA_TABLE] = { .type = NLA_U32 },
704 [RTA_IP_PROTO] = { .type = NLA_U8 },
705 [RTA_SPORT] = { .type = NLA_U16 },
706 [RTA_DPORT] = { .type = NLA_U16 },
707 [RTA_NH_ID] = { .type = NLA_U32 },
708 };
709
fib_gw_from_via(struct fib_config * cfg,struct nlattr * nla,struct netlink_ext_ack * extack)710 int fib_gw_from_via(struct fib_config *cfg, struct nlattr *nla,
711 struct netlink_ext_ack *extack)
712 {
713 struct rtvia *via;
714 int alen;
715
716 if (nla_len(nla) < offsetof(struct rtvia, rtvia_addr)) {
717 NL_SET_ERR_MSG(extack, "Invalid attribute length for RTA_VIA");
718 return -EINVAL;
719 }
720
721 via = nla_data(nla);
722 alen = nla_len(nla) - offsetof(struct rtvia, rtvia_addr);
723
724 switch (via->rtvia_family) {
725 case AF_INET:
726 if (alen != sizeof(__be32)) {
727 NL_SET_ERR_MSG(extack, "Invalid IPv4 address in RTA_VIA");
728 return -EINVAL;
729 }
730 cfg->fc_gw_family = AF_INET;
731 cfg->fc_gw4 = *((__be32 *)via->rtvia_addr);
732 break;
733 case AF_INET6:
734 #if IS_ENABLED(CONFIG_IPV6)
735 if (alen != sizeof(struct in6_addr)) {
736 NL_SET_ERR_MSG(extack, "Invalid IPv6 address in RTA_VIA");
737 return -EINVAL;
738 }
739 cfg->fc_gw_family = AF_INET6;
740 cfg->fc_gw6 = *((struct in6_addr *)via->rtvia_addr);
741 #else
742 NL_SET_ERR_MSG(extack, "IPv6 support not enabled in kernel");
743 return -EINVAL;
744 #endif
745 break;
746 default:
747 NL_SET_ERR_MSG(extack, "Unsupported address family in RTA_VIA");
748 return -EINVAL;
749 }
750
751 return 0;
752 }
753
rtm_to_fib_config(struct net * net,struct sk_buff * skb,struct nlmsghdr * nlh,struct fib_config * cfg,struct netlink_ext_ack * extack)754 static int rtm_to_fib_config(struct net *net, struct sk_buff *skb,
755 struct nlmsghdr *nlh, struct fib_config *cfg,
756 struct netlink_ext_ack *extack)
757 {
758 bool has_gw = false, has_via = false;
759 struct nlattr *attr;
760 int err, remaining;
761 struct rtmsg *rtm;
762
763 err = nlmsg_validate_deprecated(nlh, sizeof(*rtm), RTA_MAX,
764 rtm_ipv4_policy, extack);
765 if (err < 0)
766 goto errout;
767
768 memset(cfg, 0, sizeof(*cfg));
769
770 rtm = nlmsg_data(nlh);
771
772 if (!inet_validate_dscp(rtm->rtm_tos)) {
773 NL_SET_ERR_MSG(extack,
774 "Invalid dsfield (tos): ECN bits must be 0");
775 err = -EINVAL;
776 goto errout;
777 }
778 cfg->fc_dscp = inet_dsfield_to_dscp(rtm->rtm_tos);
779
780 cfg->fc_dst_len = rtm->rtm_dst_len;
781 cfg->fc_table = rtm->rtm_table;
782 cfg->fc_protocol = rtm->rtm_protocol;
783 cfg->fc_scope = rtm->rtm_scope;
784 cfg->fc_type = rtm->rtm_type;
785 cfg->fc_flags = rtm->rtm_flags;
786 cfg->fc_nlflags = nlh->nlmsg_flags;
787
788 cfg->fc_nlinfo.portid = NETLINK_CB(skb).portid;
789 cfg->fc_nlinfo.nlh = nlh;
790 cfg->fc_nlinfo.nl_net = net;
791
792 if (cfg->fc_type > RTN_MAX) {
793 NL_SET_ERR_MSG(extack, "Invalid route type");
794 err = -EINVAL;
795 goto errout;
796 }
797
798 nlmsg_for_each_attr(attr, nlh, sizeof(struct rtmsg), remaining) {
799 switch (nla_type(attr)) {
800 case RTA_DST:
801 cfg->fc_dst = nla_get_be32(attr);
802 break;
803 case RTA_OIF:
804 cfg->fc_oif = nla_get_u32(attr);
805 break;
806 case RTA_GATEWAY:
807 has_gw = true;
808 cfg->fc_gw4 = nla_get_be32(attr);
809 if (cfg->fc_gw4)
810 cfg->fc_gw_family = AF_INET;
811 break;
812 case RTA_VIA:
813 has_via = true;
814 err = fib_gw_from_via(cfg, attr, extack);
815 if (err)
816 goto errout;
817 break;
818 case RTA_PRIORITY:
819 cfg->fc_priority = nla_get_u32(attr);
820 break;
821 case RTA_PREFSRC:
822 cfg->fc_prefsrc = nla_get_be32(attr);
823 break;
824 case RTA_METRICS:
825 cfg->fc_mx = nla_data(attr);
826 cfg->fc_mx_len = nla_len(attr);
827 break;
828 case RTA_MULTIPATH:
829 err = lwtunnel_valid_encap_type_attr(nla_data(attr),
830 nla_len(attr),
831 extack);
832 if (err < 0)
833 goto errout;
834 cfg->fc_mp = nla_data(attr);
835 cfg->fc_mp_len = nla_len(attr);
836 break;
837 case RTA_FLOW:
838 cfg->fc_flow = nla_get_u32(attr);
839 break;
840 case RTA_TABLE:
841 cfg->fc_table = nla_get_u32(attr);
842 break;
843 case RTA_ENCAP:
844 cfg->fc_encap = attr;
845 break;
846 case RTA_ENCAP_TYPE:
847 cfg->fc_encap_type = nla_get_u16(attr);
848 err = lwtunnel_valid_encap_type(cfg->fc_encap_type,
849 extack);
850 if (err < 0)
851 goto errout;
852 break;
853 case RTA_NH_ID:
854 cfg->fc_nh_id = nla_get_u32(attr);
855 break;
856 }
857 }
858
859 if (cfg->fc_dst_len > 32) {
860 NL_SET_ERR_MSG(extack, "Invalid prefix length");
861 err = -EINVAL;
862 goto errout;
863 }
864
865 if (cfg->fc_dst_len < 32 && (ntohl(cfg->fc_dst) << cfg->fc_dst_len)) {
866 NL_SET_ERR_MSG(extack, "Invalid prefix for given prefix length");
867 err = -EINVAL;
868 goto errout;
869 }
870
871 if (cfg->fc_nh_id) {
872 if (cfg->fc_oif || cfg->fc_gw_family ||
873 cfg->fc_encap || cfg->fc_mp) {
874 NL_SET_ERR_MSG(extack,
875 "Nexthop specification and nexthop id are mutually exclusive");
876 err = -EINVAL;
877 goto errout;
878 }
879 }
880
881 if (has_gw && has_via) {
882 NL_SET_ERR_MSG(extack,
883 "Nexthop configuration can not contain both GATEWAY and VIA");
884 err = -EINVAL;
885 goto errout;
886 }
887
888 if (!cfg->fc_table)
889 cfg->fc_table = RT_TABLE_MAIN;
890
891 return 0;
892 errout:
893 return err;
894 }
895
inet_rtm_delroute(struct sk_buff * skb,struct nlmsghdr * nlh,struct netlink_ext_ack * extack)896 static int inet_rtm_delroute(struct sk_buff *skb, struct nlmsghdr *nlh,
897 struct netlink_ext_ack *extack)
898 {
899 struct net *net = sock_net(skb->sk);
900 struct fib_config cfg;
901 struct fib_table *tb;
902 int err;
903
904 err = rtm_to_fib_config(net, skb, nlh, &cfg, extack);
905 if (err < 0)
906 goto errout;
907
908 rtnl_net_lock(net);
909
910 if (cfg.fc_nh_id && !nexthop_find_by_id(net, cfg.fc_nh_id)) {
911 NL_SET_ERR_MSG(extack, "Nexthop id does not exist");
912 err = -EINVAL;
913 goto unlock;
914 }
915
916 tb = fib_get_table(net, cfg.fc_table);
917 if (!tb) {
918 NL_SET_ERR_MSG(extack, "FIB table does not exist");
919 err = -ESRCH;
920 goto unlock;
921 }
922
923 err = fib_table_delete(net, tb, &cfg, extack);
924 unlock:
925 rtnl_net_unlock(net);
926 errout:
927 return err;
928 }
929
inet_rtm_newroute(struct sk_buff * skb,struct nlmsghdr * nlh,struct netlink_ext_ack * extack)930 static int inet_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh,
931 struct netlink_ext_ack *extack)
932 {
933 struct net *net = sock_net(skb->sk);
934 struct fib_config cfg;
935 struct fib_table *tb;
936 int err;
937
938 err = rtm_to_fib_config(net, skb, nlh, &cfg, extack);
939 if (err < 0)
940 goto errout;
941
942 rtnl_net_lock(net);
943
944 tb = fib_new_table(net, cfg.fc_table);
945 if (!tb) {
946 err = -ENOBUFS;
947 goto unlock;
948 }
949
950 err = fib_table_insert(net, tb, &cfg, extack);
951 if (!err && cfg.fc_type == RTN_LOCAL)
952 net->ipv4.fib_has_custom_local_routes = true;
953
954 unlock:
955 rtnl_net_unlock(net);
956 errout:
957 return err;
958 }
959
ip_valid_fib_dump_req(struct net * net,const struct nlmsghdr * nlh,struct fib_dump_filter * filter,struct netlink_callback * cb)960 int ip_valid_fib_dump_req(struct net *net, const struct nlmsghdr *nlh,
961 struct fib_dump_filter *filter,
962 struct netlink_callback *cb)
963 {
964 struct netlink_ext_ack *extack = cb->extack;
965 struct nlattr *tb[RTA_MAX + 1];
966 struct rtmsg *rtm;
967 int err, i;
968
969 rtm = nlmsg_payload(nlh, sizeof(*rtm));
970 if (!rtm) {
971 NL_SET_ERR_MSG(extack, "Invalid header for FIB dump request");
972 return -EINVAL;
973 }
974
975 if (rtm->rtm_dst_len || rtm->rtm_src_len || rtm->rtm_tos ||
976 rtm->rtm_scope) {
977 NL_SET_ERR_MSG(extack, "Invalid values in header for FIB dump request");
978 return -EINVAL;
979 }
980
981 if (rtm->rtm_flags & ~(RTM_F_CLONED | RTM_F_PREFIX)) {
982 NL_SET_ERR_MSG(extack, "Invalid flags for FIB dump request");
983 return -EINVAL;
984 }
985 if (rtm->rtm_flags & RTM_F_CLONED)
986 filter->dump_routes = false;
987 else
988 filter->dump_exceptions = false;
989
990 filter->flags = rtm->rtm_flags;
991 filter->protocol = rtm->rtm_protocol;
992 filter->rt_type = rtm->rtm_type;
993 filter->table_id = rtm->rtm_table;
994
995 err = nlmsg_parse_deprecated_strict(nlh, sizeof(*rtm), tb, RTA_MAX,
996 rtm_ipv4_policy, extack);
997 if (err < 0)
998 return err;
999
1000 for (i = 0; i <= RTA_MAX; ++i) {
1001 int ifindex;
1002
1003 if (!tb[i])
1004 continue;
1005
1006 switch (i) {
1007 case RTA_TABLE:
1008 filter->table_id = nla_get_u32(tb[i]);
1009 break;
1010 case RTA_OIF:
1011 ifindex = nla_get_u32(tb[i]);
1012
1013 filter->dev = dev_get_by_index_rcu(net, ifindex);
1014 if (!filter->dev)
1015 return -ENODEV;
1016 break;
1017 default:
1018 NL_SET_ERR_MSG(extack, "Unsupported attribute in dump request");
1019 return -EINVAL;
1020 }
1021 }
1022
1023 if (filter->flags || filter->protocol || filter->rt_type ||
1024 filter->table_id || filter->dev) {
1025 filter->filter_set = 1;
1026 cb->answer_flags = NLM_F_DUMP_FILTERED;
1027 }
1028
1029 return 0;
1030 }
1031 EXPORT_SYMBOL_GPL(ip_valid_fib_dump_req);
1032
inet_dump_fib(struct sk_buff * skb,struct netlink_callback * cb)1033 static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
1034 {
1035 const struct nlmsghdr *nlh = cb->nlh;
1036 struct net *net = sock_net(skb->sk);
1037 struct fib_dump_filter filter = {
1038 .dump_routes = true,
1039 .dump_exceptions = true,
1040 };
1041 struct hlist_head *head;
1042 int dumped = 0, err = 0;
1043 struct fib_table *tb;
1044 unsigned int h, s_h;
1045 u32 s_id;
1046
1047 rcu_read_lock();
1048 if (cb->strict_check) {
1049 err = ip_valid_fib_dump_req(net, nlh, &filter, cb);
1050 if (err < 0)
1051 goto unlock;
1052 } else if (nlmsg_len(nlh) >= sizeof(struct rtmsg)) {
1053 struct rtmsg *rtm = nlmsg_data(nlh);
1054
1055 filter.flags = rtm->rtm_flags & (RTM_F_PREFIX | RTM_F_CLONED);
1056 }
1057
1058 /* ipv4 does not use prefix flag */
1059 if (filter.flags & RTM_F_PREFIX)
1060 goto unlock;
1061
1062 if (filter.table_id) {
1063 tb = fib_get_table(net, filter.table_id);
1064 if (!tb) {
1065 if (rtnl_msg_family(cb->nlh) != PF_INET)
1066 goto unlock;
1067
1068 NL_SET_ERR_MSG(cb->extack, "ipv4: FIB table does not exist");
1069 err = -ENOENT;
1070 goto unlock;
1071 }
1072 err = fib_table_dump(tb, skb, cb, &filter);
1073 goto unlock;
1074 }
1075
1076 s_h = cb->args[0];
1077 s_id = cb->args[1];
1078
1079 err = 0;
1080 for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_id = 0) {
1081 head = &net->ipv4.fib_table_hash[h];
1082 hlist_for_each_entry_rcu(tb, head, tb_hlist) {
1083 if (s_id && tb->tb_id != s_id)
1084 continue;
1085
1086 s_id = 0;
1087 if (dumped)
1088 memset(&cb->args[2], 0, sizeof(cb->args) -
1089 2 * sizeof(cb->args[0]));
1090 cb->args[1] = tb->tb_id;
1091 err = fib_table_dump(tb, skb, cb, &filter);
1092 if (err < 0)
1093 goto out;
1094 dumped = 1;
1095 }
1096 }
1097 out:
1098
1099 cb->args[0] = h;
1100
1101 unlock:
1102 rcu_read_unlock();
1103 return err;
1104 }
1105
1106 /* Prepare and feed intra-kernel routing request.
1107 * Really, it should be netlink message, but :-( netlink
1108 * can be not configured, so that we feed it directly
1109 * to fib engine. It is legal, because all events occur
1110 * only when netlink is already locked.
1111 */
fib_magic(int cmd,int type,__be32 dst,int dst_len,struct in_ifaddr * ifa,u32 rt_priority)1112 static void fib_magic(int cmd, int type, __be32 dst, int dst_len,
1113 struct in_ifaddr *ifa, u32 rt_priority)
1114 {
1115 struct net *net = dev_net(ifa->ifa_dev->dev);
1116 u32 tb_id = l3mdev_fib_table(ifa->ifa_dev->dev);
1117 struct fib_table *tb;
1118 struct fib_config cfg = {
1119 .fc_protocol = RTPROT_KERNEL,
1120 .fc_type = type,
1121 .fc_dst = dst,
1122 .fc_dst_len = dst_len,
1123 .fc_priority = rt_priority,
1124 .fc_prefsrc = ifa->ifa_local,
1125 .fc_oif = ifa->ifa_dev->dev->ifindex,
1126 .fc_nlflags = NLM_F_CREATE | NLM_F_APPEND,
1127 .fc_nlinfo = {
1128 .nl_net = net,
1129 },
1130 };
1131
1132 if (!tb_id)
1133 tb_id = (type == RTN_UNICAST) ? RT_TABLE_MAIN : RT_TABLE_LOCAL;
1134
1135 tb = fib_new_table(net, tb_id);
1136 if (!tb)
1137 return;
1138
1139 cfg.fc_table = tb->tb_id;
1140
1141 if (type != RTN_LOCAL)
1142 cfg.fc_scope = RT_SCOPE_LINK;
1143 else
1144 cfg.fc_scope = RT_SCOPE_HOST;
1145
1146 if (cmd == RTM_NEWROUTE)
1147 fib_table_insert(net, tb, &cfg, NULL);
1148 else
1149 fib_table_delete(net, tb, &cfg, NULL);
1150 }
1151
fib_add_ifaddr(struct in_ifaddr * ifa)1152 void fib_add_ifaddr(struct in_ifaddr *ifa)
1153 {
1154 struct in_device *in_dev = ifa->ifa_dev;
1155 struct net_device *dev = in_dev->dev;
1156 struct in_ifaddr *prim = ifa;
1157 __be32 mask = ifa->ifa_mask;
1158 __be32 addr = ifa->ifa_local;
1159 __be32 prefix = ifa->ifa_address & mask;
1160
1161 if (ifa->ifa_flags & IFA_F_SECONDARY) {
1162 prim = inet_ifa_byprefix(in_dev, prefix, mask);
1163 if (!prim) {
1164 pr_warn("%s: bug: prim == NULL\n", __func__);
1165 return;
1166 }
1167 }
1168
1169 fib_magic(RTM_NEWROUTE, RTN_LOCAL, addr, 32, prim, 0);
1170
1171 if (!(dev->flags & IFF_UP))
1172 return;
1173
1174 /* Add broadcast address, if it is explicitly assigned. */
1175 if (ifa->ifa_broadcast && ifa->ifa_broadcast != htonl(0xFFFFFFFF)) {
1176 fib_magic(RTM_NEWROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32,
1177 prim, 0);
1178 arp_invalidate(dev, ifa->ifa_broadcast, false);
1179 }
1180
1181 if (!ipv4_is_zeronet(prefix) && !(ifa->ifa_flags & IFA_F_SECONDARY) &&
1182 (prefix != addr || ifa->ifa_prefixlen < 32)) {
1183 if (!(ifa->ifa_flags & IFA_F_NOPREFIXROUTE))
1184 fib_magic(RTM_NEWROUTE,
1185 dev->flags & IFF_LOOPBACK ? RTN_LOCAL : RTN_UNICAST,
1186 prefix, ifa->ifa_prefixlen, prim,
1187 ifa->ifa_rt_priority);
1188
1189 /* Add the network broadcast address, when it makes sense */
1190 if (ifa->ifa_prefixlen < 31) {
1191 fib_magic(RTM_NEWROUTE, RTN_BROADCAST, prefix | ~mask,
1192 32, prim, 0);
1193 arp_invalidate(dev, prefix | ~mask, false);
1194 }
1195 }
1196 }
1197
fib_modify_prefix_metric(struct in_ifaddr * ifa,u32 new_metric)1198 void fib_modify_prefix_metric(struct in_ifaddr *ifa, u32 new_metric)
1199 {
1200 __be32 prefix = ifa->ifa_address & ifa->ifa_mask;
1201 struct in_device *in_dev = ifa->ifa_dev;
1202 struct net_device *dev = in_dev->dev;
1203
1204 if (!(dev->flags & IFF_UP) ||
1205 ifa->ifa_flags & (IFA_F_SECONDARY | IFA_F_NOPREFIXROUTE) ||
1206 ipv4_is_zeronet(prefix) ||
1207 (prefix == ifa->ifa_local && ifa->ifa_prefixlen == 32))
1208 return;
1209
1210 /* add the new */
1211 fib_magic(RTM_NEWROUTE,
1212 dev->flags & IFF_LOOPBACK ? RTN_LOCAL : RTN_UNICAST,
1213 prefix, ifa->ifa_prefixlen, ifa, new_metric);
1214
1215 /* delete the old */
1216 fib_magic(RTM_DELROUTE,
1217 dev->flags & IFF_LOOPBACK ? RTN_LOCAL : RTN_UNICAST,
1218 prefix, ifa->ifa_prefixlen, ifa, ifa->ifa_rt_priority);
1219 }
1220
1221 /* Delete primary or secondary address.
1222 * Optionally, on secondary address promotion consider the addresses
1223 * from subnet iprim as deleted, even if they are in device list.
1224 * In this case the secondary ifa can be in device list.
1225 */
fib_del_ifaddr(struct in_ifaddr * ifa,struct in_ifaddr * iprim)1226 void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim)
1227 {
1228 struct in_device *in_dev = ifa->ifa_dev;
1229 struct net_device *dev = in_dev->dev;
1230 struct in_ifaddr *ifa1;
1231 struct in_ifaddr *prim = ifa, *prim1 = NULL;
1232 __be32 brd = ifa->ifa_address | ~ifa->ifa_mask;
1233 __be32 any = ifa->ifa_address & ifa->ifa_mask;
1234 #define LOCAL_OK 1
1235 #define BRD_OK 2
1236 #define BRD0_OK 4
1237 #define BRD1_OK 8
1238 unsigned int ok = 0;
1239 int subnet = 0; /* Primary network */
1240 int gone = 1; /* Address is missing */
1241 int same_prefsrc = 0; /* Another primary with same IP */
1242
1243 if (ifa->ifa_flags & IFA_F_SECONDARY) {
1244 prim = inet_ifa_byprefix(in_dev, any, ifa->ifa_mask);
1245 if (!prim) {
1246 /* if the device has been deleted, we don't perform
1247 * address promotion
1248 */
1249 if (!in_dev->dead)
1250 pr_warn("%s: bug: prim == NULL\n", __func__);
1251 return;
1252 }
1253 if (iprim && iprim != prim) {
1254 pr_warn("%s: bug: iprim != prim\n", __func__);
1255 return;
1256 }
1257 } else if (!ipv4_is_zeronet(any) &&
1258 (any != ifa->ifa_local || ifa->ifa_prefixlen < 32)) {
1259 if (!(ifa->ifa_flags & IFA_F_NOPREFIXROUTE))
1260 fib_magic(RTM_DELROUTE,
1261 dev->flags & IFF_LOOPBACK ? RTN_LOCAL : RTN_UNICAST,
1262 any, ifa->ifa_prefixlen, prim, 0);
1263 subnet = 1;
1264 }
1265
1266 if (in_dev->dead)
1267 goto no_promotions;
1268
1269 /* Deletion is more complicated than add.
1270 * We should take care of not to delete too much :-)
1271 *
1272 * Scan address list to be sure that addresses are really gone.
1273 */
1274 rcu_read_lock();
1275 in_dev_for_each_ifa_rcu(ifa1, in_dev) {
1276 if (ifa1 == ifa) {
1277 /* promotion, keep the IP */
1278 gone = 0;
1279 continue;
1280 }
1281 /* Ignore IFAs from our subnet */
1282 if (iprim && ifa1->ifa_mask == iprim->ifa_mask &&
1283 inet_ifa_match(ifa1->ifa_address, iprim))
1284 continue;
1285
1286 /* Ignore ifa1 if it uses different primary IP (prefsrc) */
1287 if (ifa1->ifa_flags & IFA_F_SECONDARY) {
1288 /* Another address from our subnet? */
1289 if (ifa1->ifa_mask == prim->ifa_mask &&
1290 inet_ifa_match(ifa1->ifa_address, prim))
1291 prim1 = prim;
1292 else {
1293 /* We reached the secondaries, so
1294 * same_prefsrc should be determined.
1295 */
1296 if (!same_prefsrc)
1297 continue;
1298 /* Search new prim1 if ifa1 is not
1299 * using the current prim1
1300 */
1301 if (!prim1 ||
1302 ifa1->ifa_mask != prim1->ifa_mask ||
1303 !inet_ifa_match(ifa1->ifa_address, prim1))
1304 prim1 = inet_ifa_byprefix(in_dev,
1305 ifa1->ifa_address,
1306 ifa1->ifa_mask);
1307 if (!prim1)
1308 continue;
1309 if (prim1->ifa_local != prim->ifa_local)
1310 continue;
1311 }
1312 } else {
1313 if (prim->ifa_local != ifa1->ifa_local)
1314 continue;
1315 prim1 = ifa1;
1316 if (prim != prim1)
1317 same_prefsrc = 1;
1318 }
1319 if (ifa->ifa_local == ifa1->ifa_local)
1320 ok |= LOCAL_OK;
1321 if (ifa->ifa_broadcast == ifa1->ifa_broadcast)
1322 ok |= BRD_OK;
1323 if (brd == ifa1->ifa_broadcast)
1324 ok |= BRD1_OK;
1325 if (any == ifa1->ifa_broadcast)
1326 ok |= BRD0_OK;
1327 /* primary has network specific broadcasts */
1328 if (prim1 == ifa1 && ifa1->ifa_prefixlen < 31) {
1329 __be32 brd1 = ifa1->ifa_address | ~ifa1->ifa_mask;
1330 __be32 any1 = ifa1->ifa_address & ifa1->ifa_mask;
1331
1332 if (!ipv4_is_zeronet(any1)) {
1333 if (ifa->ifa_broadcast == brd1 ||
1334 ifa->ifa_broadcast == any1)
1335 ok |= BRD_OK;
1336 if (brd == brd1 || brd == any1)
1337 ok |= BRD1_OK;
1338 if (any == brd1 || any == any1)
1339 ok |= BRD0_OK;
1340 }
1341 }
1342 }
1343 rcu_read_unlock();
1344
1345 no_promotions:
1346 if (!(ok & BRD_OK))
1347 fib_magic(RTM_DELROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32,
1348 prim, 0);
1349 if (subnet && ifa->ifa_prefixlen < 31) {
1350 if (!(ok & BRD1_OK))
1351 fib_magic(RTM_DELROUTE, RTN_BROADCAST, brd, 32,
1352 prim, 0);
1353 if (!(ok & BRD0_OK))
1354 fib_magic(RTM_DELROUTE, RTN_BROADCAST, any, 32,
1355 prim, 0);
1356 }
1357 if (!(ok & LOCAL_OK)) {
1358 unsigned int addr_type;
1359
1360 fib_magic(RTM_DELROUTE, RTN_LOCAL, ifa->ifa_local, 32, prim, 0);
1361
1362 /* Check, that this local address finally disappeared. */
1363 addr_type = inet_addr_type_dev_table(dev_net(dev), dev,
1364 ifa->ifa_local);
1365 if (gone && addr_type != RTN_LOCAL) {
1366 /* And the last, but not the least thing.
1367 * We must flush stray FIB entries.
1368 *
1369 * First of all, we scan fib_info list searching
1370 * for stray nexthop entries, then ignite fib_flush.
1371 */
1372 if (fib_sync_down_addr(dev, ifa->ifa_local))
1373 fib_flush(dev_net(dev));
1374 }
1375 }
1376 #undef LOCAL_OK
1377 #undef BRD_OK
1378 #undef BRD0_OK
1379 #undef BRD1_OK
1380 }
1381
nl_fib_lookup(struct net * net,struct fib_result_nl * frn)1382 static void nl_fib_lookup(struct net *net, struct fib_result_nl *frn)
1383 {
1384
1385 struct fib_result res;
1386 struct flowi4 fl4 = {
1387 .flowi4_mark = frn->fl_mark,
1388 .daddr = frn->fl_addr,
1389 .flowi4_dscp = inet_dsfield_to_dscp(frn->fl_tos),
1390 .flowi4_scope = frn->fl_scope,
1391 };
1392 struct fib_table *tb;
1393
1394 rcu_read_lock();
1395
1396 tb = fib_get_table(net, frn->tb_id_in);
1397
1398 frn->err = -ENOENT;
1399 if (tb) {
1400 local_bh_disable();
1401
1402 frn->tb_id = tb->tb_id;
1403 frn->err = fib_table_lookup(tb, &fl4, &res, FIB_LOOKUP_NOREF);
1404
1405 if (!frn->err) {
1406 frn->prefixlen = res.prefixlen;
1407 frn->nh_sel = res.nh_sel;
1408 frn->type = res.type;
1409 frn->scope = res.scope;
1410 }
1411 local_bh_enable();
1412 }
1413
1414 rcu_read_unlock();
1415 }
1416
nl_fib_input(struct sk_buff * skb)1417 static void nl_fib_input(struct sk_buff *skb)
1418 {
1419 struct net *net;
1420 struct fib_result_nl *frn;
1421 struct nlmsghdr *nlh;
1422 u32 portid;
1423
1424 net = sock_net(skb->sk);
1425 nlh = nlmsg_hdr(skb);
1426 if (skb->len < nlmsg_total_size(sizeof(*frn)) ||
1427 skb->len < nlh->nlmsg_len ||
1428 nlmsg_len(nlh) < sizeof(*frn))
1429 return;
1430
1431 skb = netlink_skb_clone(skb, GFP_KERNEL);
1432 if (!skb)
1433 return;
1434 nlh = nlmsg_hdr(skb);
1435
1436 frn = nlmsg_data(nlh);
1437 nl_fib_lookup(net, frn);
1438
1439 portid = NETLINK_CB(skb).portid; /* netlink portid */
1440 NETLINK_CB(skb).portid = 0; /* from kernel */
1441 NETLINK_CB(skb).dst_group = 0; /* unicast */
1442 nlmsg_unicast(net->ipv4.fibnl, skb, portid);
1443 }
1444
nl_fib_lookup_init(struct net * net)1445 static int __net_init nl_fib_lookup_init(struct net *net)
1446 {
1447 struct sock *sk;
1448 struct netlink_kernel_cfg cfg = {
1449 .input = nl_fib_input,
1450 };
1451
1452 sk = netlink_kernel_create(net, NETLINK_FIB_LOOKUP, &cfg);
1453 if (!sk)
1454 return -EAFNOSUPPORT;
1455 net->ipv4.fibnl = sk;
1456 return 0;
1457 }
1458
nl_fib_lookup_exit(struct net * net)1459 static void nl_fib_lookup_exit(struct net *net)
1460 {
1461 netlink_kernel_release(net->ipv4.fibnl);
1462 net->ipv4.fibnl = NULL;
1463 }
1464
fib_disable_ip(struct net_device * dev,unsigned long event,bool force)1465 static void fib_disable_ip(struct net_device *dev, unsigned long event,
1466 bool force)
1467 {
1468 if (fib_sync_down_dev(dev, event, force))
1469 fib_flush(dev_net(dev));
1470 else
1471 rt_cache_flush(dev_net(dev));
1472 arp_ifdown(dev);
1473 }
1474
fib_inetaddr_event(struct notifier_block * this,unsigned long event,void * ptr)1475 static int fib_inetaddr_event(struct notifier_block *this, unsigned long event, void *ptr)
1476 {
1477 struct in_ifaddr *ifa = ptr;
1478 struct net_device *dev = ifa->ifa_dev->dev;
1479 struct net *net = dev_net(dev);
1480
1481 switch (event) {
1482 case NETDEV_UP:
1483 fib_add_ifaddr(ifa);
1484 #ifdef CONFIG_IP_ROUTE_MULTIPATH
1485 fib_sync_up(dev, RTNH_F_DEAD);
1486 #endif
1487 atomic_inc(&net->ipv4.dev_addr_genid);
1488 rt_cache_flush(net);
1489 break;
1490 case NETDEV_DOWN:
1491 fib_del_ifaddr(ifa, NULL);
1492 atomic_inc(&net->ipv4.dev_addr_genid);
1493 if (!ifa->ifa_dev->ifa_list) {
1494 /* Last address was deleted from this interface.
1495 * Disable IP.
1496 */
1497 fib_disable_ip(dev, event, true);
1498 } else {
1499 rt_cache_flush(net);
1500 }
1501 break;
1502 }
1503 return NOTIFY_DONE;
1504 }
1505
fib_netdev_event(struct notifier_block * this,unsigned long event,void * ptr)1506 static int fib_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1507 {
1508 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1509 struct netdev_notifier_changeupper_info *upper_info = ptr;
1510 struct netdev_notifier_info_ext *info_ext = ptr;
1511 struct in_device *in_dev;
1512 struct net *net = dev_net(dev);
1513 struct in_ifaddr *ifa;
1514 unsigned int flags;
1515
1516 if (event == NETDEV_UNREGISTER) {
1517 fib_disable_ip(dev, event, true);
1518 rt_flush_dev(dev);
1519 return NOTIFY_DONE;
1520 }
1521
1522 in_dev = __in_dev_get_rtnl(dev);
1523 if (!in_dev)
1524 return NOTIFY_DONE;
1525
1526 switch (event) {
1527 case NETDEV_UP:
1528 in_dev_for_each_ifa_rtnl(ifa, in_dev) {
1529 fib_add_ifaddr(ifa);
1530 }
1531 #ifdef CONFIG_IP_ROUTE_MULTIPATH
1532 fib_sync_up(dev, RTNH_F_DEAD);
1533 #endif
1534 atomic_inc(&net->ipv4.dev_addr_genid);
1535 rt_cache_flush(net);
1536 break;
1537 case NETDEV_DOWN:
1538 fib_disable_ip(dev, event, false);
1539 break;
1540 case NETDEV_CHANGE:
1541 flags = netif_get_flags(dev);
1542 if (flags & (IFF_RUNNING | IFF_LOWER_UP))
1543 fib_sync_up(dev, RTNH_F_LINKDOWN);
1544 else
1545 fib_sync_down_dev(dev, event, false);
1546 rt_cache_flush(net);
1547 break;
1548 case NETDEV_CHANGEMTU:
1549 fib_sync_mtu(dev, info_ext->ext.mtu);
1550 rt_cache_flush(net);
1551 break;
1552 case NETDEV_CHANGEUPPER:
1553 upper_info = ptr;
1554 /* flush all routes if dev is linked to or unlinked from
1555 * an L3 master device (e.g., VRF)
1556 */
1557 if (upper_info->upper_dev &&
1558 netif_is_l3_master(upper_info->upper_dev))
1559 fib_disable_ip(dev, NETDEV_DOWN, true);
1560 break;
1561 }
1562 return NOTIFY_DONE;
1563 }
1564
1565 static struct notifier_block fib_inetaddr_notifier = {
1566 .notifier_call = fib_inetaddr_event,
1567 };
1568
1569 static struct notifier_block fib_netdev_notifier = {
1570 .notifier_call = fib_netdev_event,
1571 };
1572
ip_fib_net_init(struct net * net)1573 static int __net_init ip_fib_net_init(struct net *net)
1574 {
1575 int err;
1576 size_t size = sizeof(struct hlist_head) * FIB_TABLE_HASHSZ;
1577
1578 err = fib4_notifier_init(net);
1579 if (err)
1580 return err;
1581
1582 #ifdef CONFIG_IP_ROUTE_MULTIPATH
1583 /* Default to 3-tuple */
1584 net->ipv4.sysctl_fib_multipath_hash_fields =
1585 FIB_MULTIPATH_HASH_FIELD_DEFAULT_MASK;
1586 #endif
1587
1588 #ifdef CONFIG_IP_MULTIPLE_TABLES
1589 spin_lock_init(&net->ipv4.fib_table_hash_lock);
1590 #endif
1591
1592 /* Avoid false sharing : Use at least a full cache line */
1593 size = max_t(size_t, size, L1_CACHE_BYTES);
1594
1595 net->ipv4.fib_table_hash = kzalloc(size, GFP_KERNEL);
1596 if (!net->ipv4.fib_table_hash) {
1597 err = -ENOMEM;
1598 goto err_table_hash_alloc;
1599 }
1600
1601 err = fib4_rules_init(net);
1602 if (err < 0)
1603 goto err_rules_init;
1604 return 0;
1605
1606 err_rules_init:
1607 kfree(net->ipv4.fib_table_hash);
1608 err_table_hash_alloc:
1609 fib4_notifier_exit(net);
1610 return err;
1611 }
1612
ip_fib_net_exit(struct net * net)1613 static void ip_fib_net_exit(struct net *net)
1614 {
1615 int i;
1616
1617 ASSERT_RTNL_NET(net);
1618 #ifdef CONFIG_IP_MULTIPLE_TABLES
1619 RCU_INIT_POINTER(net->ipv4.fib_main, NULL);
1620 RCU_INIT_POINTER(net->ipv4.fib_default, NULL);
1621 #endif
1622 /* Destroy the tables in reverse order to guarantee that the
1623 * local table, ID 255, is destroyed before the main table, ID
1624 * 254. This is necessary as the local table may contain
1625 * references to data contained in the main table.
1626 */
1627 for (i = FIB_TABLE_HASHSZ - 1; i >= 0; i--) {
1628 struct hlist_head *head = &net->ipv4.fib_table_hash[i];
1629 struct hlist_node *tmp;
1630 struct fib_table *tb;
1631
1632 hlist_for_each_entry_safe(tb, tmp, head, tb_hlist) {
1633 hlist_del_rcu(&tb->tb_hlist);
1634 fib_table_flush(net, tb, true);
1635 fib_free_table(tb);
1636 }
1637 }
1638 }
1639
fib_net_init(struct net * net)1640 static int __net_init fib_net_init(struct net *net)
1641 {
1642 int error;
1643
1644 #ifdef CONFIG_IP_ROUTE_CLASSID
1645 atomic_set(&net->ipv4.fib_num_tclassid_users, 0);
1646 #endif
1647 error = ip_fib_net_init(net);
1648 if (error < 0)
1649 goto out;
1650
1651 error = fib4_semantics_init(net);
1652 if (error)
1653 goto out_semantics;
1654
1655 error = nl_fib_lookup_init(net);
1656 if (error < 0)
1657 goto out_nlfl;
1658
1659 error = fib_proc_init(net);
1660 if (error < 0)
1661 goto out_proc;
1662 out:
1663 return error;
1664
1665 out_proc:
1666 nl_fib_lookup_exit(net);
1667 out_nlfl:
1668 fib4_semantics_exit(net);
1669 out_semantics:
1670 rtnl_net_lock(net);
1671 ip_fib_net_exit(net);
1672 rtnl_net_unlock(net);
1673
1674 #ifdef CONFIG_IP_MULTIPLE_TABLES
1675 fib4_rules_exit(net);
1676 #endif
1677 kfree(net->ipv4.fib_table_hash);
1678 fib4_notifier_exit(net);
1679 goto out;
1680 }
1681
fib_net_pre_exit(struct net * net)1682 static void __net_exit fib_net_pre_exit(struct net *net)
1683 {
1684 fib_proc_exit(net);
1685 nl_fib_lookup_exit(net);
1686 }
1687
fib_net_exit_rtnl(struct net * net,struct list_head * dev_kill_list)1688 static void __net_exit fib_net_exit_rtnl(struct net *net,
1689 struct list_head *dev_kill_list)
1690 {
1691 ip_fib_net_exit(net);
1692 }
1693
fib_net_exit(struct net * net)1694 static void __net_exit fib_net_exit(struct net *net)
1695 {
1696 #ifdef CONFIG_IP_MULTIPLE_TABLES
1697 fib4_rules_exit(net);
1698 #endif
1699 kfree(net->ipv4.fib_table_hash);
1700 fib4_notifier_exit(net);
1701 fib4_semantics_exit(net);
1702 }
1703
1704 static struct pernet_operations fib_net_ops = {
1705 .init = fib_net_init,
1706 .pre_exit = fib_net_pre_exit,
1707 .exit_rtnl = fib_net_exit_rtnl,
1708 .exit = fib_net_exit,
1709 };
1710
1711 static const struct rtnl_msg_handler fib_rtnl_msg_handlers[] __initconst = {
1712 {.protocol = PF_INET, .msgtype = RTM_NEWROUTE,
1713 .doit = inet_rtm_newroute, .flags = RTNL_FLAG_DOIT_PERNET},
1714 {.protocol = PF_INET, .msgtype = RTM_DELROUTE,
1715 .doit = inet_rtm_delroute, .flags = RTNL_FLAG_DOIT_PERNET},
1716 {.protocol = PF_INET, .msgtype = RTM_GETROUTE, .dumpit = inet_dump_fib,
1717 .flags = RTNL_FLAG_DUMP_UNLOCKED | RTNL_FLAG_DUMP_SPLIT_NLM_DONE},
1718 };
1719
ip_fib_init(void)1720 void __init ip_fib_init(void)
1721 {
1722 fib_trie_init();
1723
1724 register_pernet_subsys(&fib_net_ops);
1725
1726 register_netdevice_notifier(&fib_netdev_notifier);
1727 register_inetaddr_notifier(&fib_inetaddr_notifier);
1728
1729 rtnl_register_many(fib_rtnl_msg_handlers);
1730 }
1731