1 /* 2 * net/core/fib_rules.c Generic Routing Rules 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU General Public License as 6 * published by the Free Software Foundation, version 2. 7 * 8 * Authors: Thomas Graf <tgraf@suug.ch> 9 */ 10 11 #include <linux/types.h> 12 #include <linux/kernel.h> 13 #include <linux/slab.h> 14 #include <linux/list.h> 15 #include <linux/module.h> 16 #include <net/net_namespace.h> 17 #include <net/sock.h> 18 #include <net/fib_rules.h> 19 #include <net/ip_tunnels.h> 20 21 static const struct fib_kuid_range fib_kuid_range_unset = { 22 KUIDT_INIT(0), 23 KUIDT_INIT(~0), 24 }; 25 26 bool fib_rule_matchall(const struct fib_rule *rule) 27 { 28 if (rule->iifindex || rule->oifindex || rule->mark || rule->tun_id || 29 rule->flags) 30 return false; 31 if (rule->suppress_ifgroup != -1 || rule->suppress_prefixlen != -1) 32 return false; 33 if (!uid_eq(rule->uid_range.start, fib_kuid_range_unset.start) || 34 !uid_eq(rule->uid_range.end, fib_kuid_range_unset.end)) 35 return false; 36 return true; 37 } 38 EXPORT_SYMBOL_GPL(fib_rule_matchall); 39 40 int fib_default_rule_add(struct fib_rules_ops *ops, 41 u32 pref, u32 table, u32 flags) 42 { 43 struct fib_rule *r; 44 45 r = kzalloc(ops->rule_size, GFP_KERNEL); 46 if (r == NULL) 47 return -ENOMEM; 48 49 atomic_set(&r->refcnt, 1); 50 r->action = FR_ACT_TO_TBL; 51 r->pref = pref; 52 r->table = table; 53 r->flags = flags; 54 r->fr_net = ops->fro_net; 55 r->uid_range = fib_kuid_range_unset; 56 57 r->suppress_prefixlen = -1; 58 r->suppress_ifgroup = -1; 59 60 /* The lock is not required here, the list in unreacheable 61 * at the moment this function is called */ 62 list_add_tail(&r->list, &ops->rules_list); 63 return 0; 64 } 65 EXPORT_SYMBOL(fib_default_rule_add); 66 67 static u32 fib_default_rule_pref(struct fib_rules_ops *ops) 68 { 69 struct list_head *pos; 70 struct fib_rule *rule; 71 72 if (!list_empty(&ops->rules_list)) { 73 pos = ops->rules_list.next; 74 if (pos->next != &ops->rules_list) { 75 rule = list_entry(pos->next, struct fib_rule, list); 76 if (rule->pref) 77 return rule->pref - 1; 78 } 79 } 80 81 return 0; 82 } 83 84 static void notify_rule_change(int event, struct fib_rule *rule, 85 struct fib_rules_ops *ops, struct nlmsghdr *nlh, 86 u32 pid); 87 88 static struct fib_rules_ops *lookup_rules_ops(struct net *net, int family) 89 { 90 struct fib_rules_ops *ops; 91 92 rcu_read_lock(); 93 list_for_each_entry_rcu(ops, &net->rules_ops, list) { 94 if (ops->family == family) { 95 if (!try_module_get(ops->owner)) 96 ops = NULL; 97 rcu_read_unlock(); 98 return ops; 99 } 100 } 101 rcu_read_unlock(); 102 103 return NULL; 104 } 105 106 static void rules_ops_put(struct fib_rules_ops *ops) 107 { 108 if (ops) 109 module_put(ops->owner); 110 } 111 112 static void flush_route_cache(struct fib_rules_ops *ops) 113 { 114 if (ops->flush_cache) 115 ops->flush_cache(ops); 116 } 117 118 static int __fib_rules_register(struct fib_rules_ops *ops) 119 { 120 int err = -EEXIST; 121 struct fib_rules_ops *o; 122 struct net *net; 123 124 net = ops->fro_net; 125 126 if (ops->rule_size < sizeof(struct fib_rule)) 127 return -EINVAL; 128 129 if (ops->match == NULL || ops->configure == NULL || 130 ops->compare == NULL || ops->fill == NULL || 131 ops->action == NULL) 132 return -EINVAL; 133 134 spin_lock(&net->rules_mod_lock); 135 list_for_each_entry(o, &net->rules_ops, list) 136 if (ops->family == o->family) 137 goto errout; 138 139 list_add_tail_rcu(&ops->list, &net->rules_ops); 140 err = 0; 141 errout: 142 spin_unlock(&net->rules_mod_lock); 143 144 return err; 145 } 146 147 struct fib_rules_ops * 148 fib_rules_register(const struct fib_rules_ops *tmpl, struct net *net) 149 { 150 struct fib_rules_ops *ops; 151 int err; 152 153 ops = kmemdup(tmpl, sizeof(*ops), GFP_KERNEL); 154 if (ops == NULL) 155 return ERR_PTR(-ENOMEM); 156 157 INIT_LIST_HEAD(&ops->rules_list); 158 ops->fro_net = net; 159 160 err = __fib_rules_register(ops); 161 if (err) { 162 kfree(ops); 163 ops = ERR_PTR(err); 164 } 165 166 return ops; 167 } 168 EXPORT_SYMBOL_GPL(fib_rules_register); 169 170 static void fib_rules_cleanup_ops(struct fib_rules_ops *ops) 171 { 172 struct fib_rule *rule, *tmp; 173 174 list_for_each_entry_safe(rule, tmp, &ops->rules_list, list) { 175 list_del_rcu(&rule->list); 176 if (ops->delete) 177 ops->delete(rule); 178 fib_rule_put(rule); 179 } 180 } 181 182 void fib_rules_unregister(struct fib_rules_ops *ops) 183 { 184 struct net *net = ops->fro_net; 185 186 spin_lock(&net->rules_mod_lock); 187 list_del_rcu(&ops->list); 188 spin_unlock(&net->rules_mod_lock); 189 190 fib_rules_cleanup_ops(ops); 191 kfree_rcu(ops, rcu); 192 } 193 EXPORT_SYMBOL_GPL(fib_rules_unregister); 194 195 static int uid_range_set(struct fib_kuid_range *range) 196 { 197 return uid_valid(range->start) && uid_valid(range->end); 198 } 199 200 static struct fib_kuid_range nla_get_kuid_range(struct nlattr **tb) 201 { 202 struct fib_rule_uid_range *in; 203 struct fib_kuid_range out; 204 205 in = (struct fib_rule_uid_range *)nla_data(tb[FRA_UID_RANGE]); 206 207 out.start = make_kuid(current_user_ns(), in->start); 208 out.end = make_kuid(current_user_ns(), in->end); 209 210 return out; 211 } 212 213 static int nla_put_uid_range(struct sk_buff *skb, struct fib_kuid_range *range) 214 { 215 struct fib_rule_uid_range out = { 216 from_kuid_munged(current_user_ns(), range->start), 217 from_kuid_munged(current_user_ns(), range->end) 218 }; 219 220 return nla_put(skb, FRA_UID_RANGE, sizeof(out), &out); 221 } 222 223 static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops, 224 struct flowi *fl, int flags, 225 struct fib_lookup_arg *arg) 226 { 227 int ret = 0; 228 229 if (rule->iifindex && (rule->iifindex != fl->flowi_iif)) 230 goto out; 231 232 if (rule->oifindex && (rule->oifindex != fl->flowi_oif)) 233 goto out; 234 235 if ((rule->mark ^ fl->flowi_mark) & rule->mark_mask) 236 goto out; 237 238 if (rule->tun_id && (rule->tun_id != fl->flowi_tun_key.tun_id)) 239 goto out; 240 241 if (rule->l3mdev && !l3mdev_fib_rule_match(rule->fr_net, fl, arg)) 242 goto out; 243 244 if (uid_lt(fl->flowi_uid, rule->uid_range.start) || 245 uid_gt(fl->flowi_uid, rule->uid_range.end)) 246 goto out; 247 248 ret = ops->match(rule, fl, flags); 249 out: 250 return (rule->flags & FIB_RULE_INVERT) ? !ret : ret; 251 } 252 253 int fib_rules_lookup(struct fib_rules_ops *ops, struct flowi *fl, 254 int flags, struct fib_lookup_arg *arg) 255 { 256 struct fib_rule *rule; 257 int err; 258 259 rcu_read_lock(); 260 261 list_for_each_entry_rcu(rule, &ops->rules_list, list) { 262 jumped: 263 if (!fib_rule_match(rule, ops, fl, flags, arg)) 264 continue; 265 266 if (rule->action == FR_ACT_GOTO) { 267 struct fib_rule *target; 268 269 target = rcu_dereference(rule->ctarget); 270 if (target == NULL) { 271 continue; 272 } else { 273 rule = target; 274 goto jumped; 275 } 276 } else if (rule->action == FR_ACT_NOP) 277 continue; 278 else 279 err = ops->action(rule, fl, flags, arg); 280 281 if (!err && ops->suppress && ops->suppress(rule, arg)) 282 continue; 283 284 if (err != -EAGAIN) { 285 if ((arg->flags & FIB_LOOKUP_NOREF) || 286 likely(atomic_inc_not_zero(&rule->refcnt))) { 287 arg->rule = rule; 288 goto out; 289 } 290 break; 291 } 292 } 293 294 err = -ESRCH; 295 out: 296 rcu_read_unlock(); 297 298 return err; 299 } 300 EXPORT_SYMBOL_GPL(fib_rules_lookup); 301 302 static int validate_rulemsg(struct fib_rule_hdr *frh, struct nlattr **tb, 303 struct fib_rules_ops *ops) 304 { 305 int err = -EINVAL; 306 307 if (frh->src_len) 308 if (tb[FRA_SRC] == NULL || 309 frh->src_len > (ops->addr_size * 8) || 310 nla_len(tb[FRA_SRC]) != ops->addr_size) 311 goto errout; 312 313 if (frh->dst_len) 314 if (tb[FRA_DST] == NULL || 315 frh->dst_len > (ops->addr_size * 8) || 316 nla_len(tb[FRA_DST]) != ops->addr_size) 317 goto errout; 318 319 err = 0; 320 errout: 321 return err; 322 } 323 324 static int rule_exists(struct fib_rules_ops *ops, struct fib_rule_hdr *frh, 325 struct nlattr **tb, struct fib_rule *rule) 326 { 327 struct fib_rule *r; 328 329 list_for_each_entry(r, &ops->rules_list, list) { 330 if (r->action != rule->action) 331 continue; 332 333 if (r->table != rule->table) 334 continue; 335 336 if (r->pref != rule->pref) 337 continue; 338 339 if (memcmp(r->iifname, rule->iifname, IFNAMSIZ)) 340 continue; 341 342 if (memcmp(r->oifname, rule->oifname, IFNAMSIZ)) 343 continue; 344 345 if (r->mark != rule->mark) 346 continue; 347 348 if (r->mark_mask != rule->mark_mask) 349 continue; 350 351 if (r->tun_id != rule->tun_id) 352 continue; 353 354 if (r->fr_net != rule->fr_net) 355 continue; 356 357 if (r->l3mdev != rule->l3mdev) 358 continue; 359 360 if (!uid_eq(r->uid_range.start, rule->uid_range.start) || 361 !uid_eq(r->uid_range.end, rule->uid_range.end)) 362 continue; 363 364 if (!ops->compare(r, frh, tb)) 365 continue; 366 return 1; 367 } 368 return 0; 369 } 370 371 int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh, 372 struct netlink_ext_ack *extack) 373 { 374 struct net *net = sock_net(skb->sk); 375 struct fib_rule_hdr *frh = nlmsg_data(nlh); 376 struct fib_rules_ops *ops = NULL; 377 struct fib_rule *rule, *r, *last = NULL; 378 struct nlattr *tb[FRA_MAX+1]; 379 int err = -EINVAL, unresolved = 0; 380 381 if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh))) 382 goto errout; 383 384 ops = lookup_rules_ops(net, frh->family); 385 if (ops == NULL) { 386 err = -EAFNOSUPPORT; 387 goto errout; 388 } 389 390 err = nlmsg_parse(nlh, sizeof(*frh), tb, FRA_MAX, ops->policy, extack); 391 if (err < 0) 392 goto errout; 393 394 err = validate_rulemsg(frh, tb, ops); 395 if (err < 0) 396 goto errout; 397 398 rule = kzalloc(ops->rule_size, GFP_KERNEL); 399 if (rule == NULL) { 400 err = -ENOMEM; 401 goto errout; 402 } 403 rule->fr_net = net; 404 405 rule->pref = tb[FRA_PRIORITY] ? nla_get_u32(tb[FRA_PRIORITY]) 406 : fib_default_rule_pref(ops); 407 408 if (tb[FRA_IIFNAME]) { 409 struct net_device *dev; 410 411 rule->iifindex = -1; 412 nla_strlcpy(rule->iifname, tb[FRA_IIFNAME], IFNAMSIZ); 413 dev = __dev_get_by_name(net, rule->iifname); 414 if (dev) 415 rule->iifindex = dev->ifindex; 416 } 417 418 if (tb[FRA_OIFNAME]) { 419 struct net_device *dev; 420 421 rule->oifindex = -1; 422 nla_strlcpy(rule->oifname, tb[FRA_OIFNAME], IFNAMSIZ); 423 dev = __dev_get_by_name(net, rule->oifname); 424 if (dev) 425 rule->oifindex = dev->ifindex; 426 } 427 428 if (tb[FRA_FWMARK]) { 429 rule->mark = nla_get_u32(tb[FRA_FWMARK]); 430 if (rule->mark) 431 /* compatibility: if the mark value is non-zero all bits 432 * are compared unless a mask is explicitly specified. 433 */ 434 rule->mark_mask = 0xFFFFFFFF; 435 } 436 437 if (tb[FRA_FWMASK]) 438 rule->mark_mask = nla_get_u32(tb[FRA_FWMASK]); 439 440 if (tb[FRA_TUN_ID]) 441 rule->tun_id = nla_get_be64(tb[FRA_TUN_ID]); 442 443 err = -EINVAL; 444 if (tb[FRA_L3MDEV]) { 445 #ifdef CONFIG_NET_L3_MASTER_DEV 446 rule->l3mdev = nla_get_u8(tb[FRA_L3MDEV]); 447 if (rule->l3mdev != 1) 448 #endif 449 goto errout_free; 450 } 451 452 rule->action = frh->action; 453 rule->flags = frh->flags; 454 rule->table = frh_get_table(frh, tb); 455 if (tb[FRA_SUPPRESS_PREFIXLEN]) 456 rule->suppress_prefixlen = nla_get_u32(tb[FRA_SUPPRESS_PREFIXLEN]); 457 else 458 rule->suppress_prefixlen = -1; 459 460 if (tb[FRA_SUPPRESS_IFGROUP]) 461 rule->suppress_ifgroup = nla_get_u32(tb[FRA_SUPPRESS_IFGROUP]); 462 else 463 rule->suppress_ifgroup = -1; 464 465 if (tb[FRA_GOTO]) { 466 if (rule->action != FR_ACT_GOTO) 467 goto errout_free; 468 469 rule->target = nla_get_u32(tb[FRA_GOTO]); 470 /* Backward jumps are prohibited to avoid endless loops */ 471 if (rule->target <= rule->pref) 472 goto errout_free; 473 474 list_for_each_entry(r, &ops->rules_list, list) { 475 if (r->pref == rule->target) { 476 RCU_INIT_POINTER(rule->ctarget, r); 477 break; 478 } 479 } 480 481 if (rcu_dereference_protected(rule->ctarget, 1) == NULL) 482 unresolved = 1; 483 } else if (rule->action == FR_ACT_GOTO) 484 goto errout_free; 485 486 if (rule->l3mdev && rule->table) 487 goto errout_free; 488 489 if (tb[FRA_UID_RANGE]) { 490 if (current_user_ns() != net->user_ns) { 491 err = -EPERM; 492 goto errout_free; 493 } 494 495 rule->uid_range = nla_get_kuid_range(tb); 496 497 if (!uid_range_set(&rule->uid_range) || 498 !uid_lte(rule->uid_range.start, rule->uid_range.end)) 499 goto errout_free; 500 } else { 501 rule->uid_range = fib_kuid_range_unset; 502 } 503 504 if ((nlh->nlmsg_flags & NLM_F_EXCL) && 505 rule_exists(ops, frh, tb, rule)) { 506 err = -EEXIST; 507 goto errout_free; 508 } 509 510 err = ops->configure(rule, skb, frh, tb); 511 if (err < 0) 512 goto errout_free; 513 514 list_for_each_entry(r, &ops->rules_list, list) { 515 if (r->pref > rule->pref) 516 break; 517 last = r; 518 } 519 520 fib_rule_get(rule); 521 522 if (last) 523 list_add_rcu(&rule->list, &last->list); 524 else 525 list_add_rcu(&rule->list, &ops->rules_list); 526 527 if (ops->unresolved_rules) { 528 /* 529 * There are unresolved goto rules in the list, check if 530 * any of them are pointing to this new rule. 531 */ 532 list_for_each_entry(r, &ops->rules_list, list) { 533 if (r->action == FR_ACT_GOTO && 534 r->target == rule->pref && 535 rtnl_dereference(r->ctarget) == NULL) { 536 rcu_assign_pointer(r->ctarget, rule); 537 if (--ops->unresolved_rules == 0) 538 break; 539 } 540 } 541 } 542 543 if (rule->action == FR_ACT_GOTO) 544 ops->nr_goto_rules++; 545 546 if (unresolved) 547 ops->unresolved_rules++; 548 549 if (rule->tun_id) 550 ip_tunnel_need_metadata(); 551 552 notify_rule_change(RTM_NEWRULE, rule, ops, nlh, NETLINK_CB(skb).portid); 553 flush_route_cache(ops); 554 rules_ops_put(ops); 555 return 0; 556 557 errout_free: 558 kfree(rule); 559 errout: 560 rules_ops_put(ops); 561 return err; 562 } 563 EXPORT_SYMBOL_GPL(fib_nl_newrule); 564 565 int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr *nlh, 566 struct netlink_ext_ack *extack) 567 { 568 struct net *net = sock_net(skb->sk); 569 struct fib_rule_hdr *frh = nlmsg_data(nlh); 570 struct fib_rules_ops *ops = NULL; 571 struct fib_rule *rule, *tmp; 572 struct nlattr *tb[FRA_MAX+1]; 573 struct fib_kuid_range range; 574 int err = -EINVAL; 575 576 if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh))) 577 goto errout; 578 579 ops = lookup_rules_ops(net, frh->family); 580 if (ops == NULL) { 581 err = -EAFNOSUPPORT; 582 goto errout; 583 } 584 585 err = nlmsg_parse(nlh, sizeof(*frh), tb, FRA_MAX, ops->policy, extack); 586 if (err < 0) 587 goto errout; 588 589 err = validate_rulemsg(frh, tb, ops); 590 if (err < 0) 591 goto errout; 592 593 if (tb[FRA_UID_RANGE]) { 594 range = nla_get_kuid_range(tb); 595 if (!uid_range_set(&range)) { 596 err = -EINVAL; 597 goto errout; 598 } 599 } else { 600 range = fib_kuid_range_unset; 601 } 602 603 list_for_each_entry(rule, &ops->rules_list, list) { 604 if (frh->action && (frh->action != rule->action)) 605 continue; 606 607 if (frh_get_table(frh, tb) && 608 (frh_get_table(frh, tb) != rule->table)) 609 continue; 610 611 if (tb[FRA_PRIORITY] && 612 (rule->pref != nla_get_u32(tb[FRA_PRIORITY]))) 613 continue; 614 615 if (tb[FRA_IIFNAME] && 616 nla_strcmp(tb[FRA_IIFNAME], rule->iifname)) 617 continue; 618 619 if (tb[FRA_OIFNAME] && 620 nla_strcmp(tb[FRA_OIFNAME], rule->oifname)) 621 continue; 622 623 if (tb[FRA_FWMARK] && 624 (rule->mark != nla_get_u32(tb[FRA_FWMARK]))) 625 continue; 626 627 if (tb[FRA_FWMASK] && 628 (rule->mark_mask != nla_get_u32(tb[FRA_FWMASK]))) 629 continue; 630 631 if (tb[FRA_TUN_ID] && 632 (rule->tun_id != nla_get_be64(tb[FRA_TUN_ID]))) 633 continue; 634 635 if (tb[FRA_L3MDEV] && 636 (rule->l3mdev != nla_get_u8(tb[FRA_L3MDEV]))) 637 continue; 638 639 if (uid_range_set(&range) && 640 (!uid_eq(rule->uid_range.start, range.start) || 641 !uid_eq(rule->uid_range.end, range.end))) 642 continue; 643 644 if (!ops->compare(rule, frh, tb)) 645 continue; 646 647 if (rule->flags & FIB_RULE_PERMANENT) { 648 err = -EPERM; 649 goto errout; 650 } 651 652 if (ops->delete) { 653 err = ops->delete(rule); 654 if (err) 655 goto errout; 656 } 657 658 if (rule->tun_id) 659 ip_tunnel_unneed_metadata(); 660 661 list_del_rcu(&rule->list); 662 663 if (rule->action == FR_ACT_GOTO) { 664 ops->nr_goto_rules--; 665 if (rtnl_dereference(rule->ctarget) == NULL) 666 ops->unresolved_rules--; 667 } 668 669 /* 670 * Check if this rule is a target to any of them. If so, 671 * disable them. As this operation is eventually very 672 * expensive, it is only performed if goto rules have 673 * actually been added. 674 */ 675 if (ops->nr_goto_rules > 0) { 676 list_for_each_entry(tmp, &ops->rules_list, list) { 677 if (rtnl_dereference(tmp->ctarget) == rule) { 678 RCU_INIT_POINTER(tmp->ctarget, NULL); 679 ops->unresolved_rules++; 680 } 681 } 682 } 683 684 notify_rule_change(RTM_DELRULE, rule, ops, nlh, 685 NETLINK_CB(skb).portid); 686 fib_rule_put(rule); 687 flush_route_cache(ops); 688 rules_ops_put(ops); 689 return 0; 690 } 691 692 err = -ENOENT; 693 errout: 694 rules_ops_put(ops); 695 return err; 696 } 697 EXPORT_SYMBOL_GPL(fib_nl_delrule); 698 699 static inline size_t fib_rule_nlmsg_size(struct fib_rules_ops *ops, 700 struct fib_rule *rule) 701 { 702 size_t payload = NLMSG_ALIGN(sizeof(struct fib_rule_hdr)) 703 + nla_total_size(IFNAMSIZ) /* FRA_IIFNAME */ 704 + nla_total_size(IFNAMSIZ) /* FRA_OIFNAME */ 705 + nla_total_size(4) /* FRA_PRIORITY */ 706 + nla_total_size(4) /* FRA_TABLE */ 707 + nla_total_size(4) /* FRA_SUPPRESS_PREFIXLEN */ 708 + nla_total_size(4) /* FRA_SUPPRESS_IFGROUP */ 709 + nla_total_size(4) /* FRA_FWMARK */ 710 + nla_total_size(4) /* FRA_FWMASK */ 711 + nla_total_size_64bit(8) /* FRA_TUN_ID */ 712 + nla_total_size(sizeof(struct fib_kuid_range)); 713 714 if (ops->nlmsg_payload) 715 payload += ops->nlmsg_payload(rule); 716 717 return payload; 718 } 719 720 static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule, 721 u32 pid, u32 seq, int type, int flags, 722 struct fib_rules_ops *ops) 723 { 724 struct nlmsghdr *nlh; 725 struct fib_rule_hdr *frh; 726 727 nlh = nlmsg_put(skb, pid, seq, type, sizeof(*frh), flags); 728 if (nlh == NULL) 729 return -EMSGSIZE; 730 731 frh = nlmsg_data(nlh); 732 frh->family = ops->family; 733 frh->table = rule->table; 734 if (nla_put_u32(skb, FRA_TABLE, rule->table)) 735 goto nla_put_failure; 736 if (nla_put_u32(skb, FRA_SUPPRESS_PREFIXLEN, rule->suppress_prefixlen)) 737 goto nla_put_failure; 738 frh->res1 = 0; 739 frh->res2 = 0; 740 frh->action = rule->action; 741 frh->flags = rule->flags; 742 743 if (rule->action == FR_ACT_GOTO && 744 rcu_access_pointer(rule->ctarget) == NULL) 745 frh->flags |= FIB_RULE_UNRESOLVED; 746 747 if (rule->iifname[0]) { 748 if (nla_put_string(skb, FRA_IIFNAME, rule->iifname)) 749 goto nla_put_failure; 750 if (rule->iifindex == -1) 751 frh->flags |= FIB_RULE_IIF_DETACHED; 752 } 753 754 if (rule->oifname[0]) { 755 if (nla_put_string(skb, FRA_OIFNAME, rule->oifname)) 756 goto nla_put_failure; 757 if (rule->oifindex == -1) 758 frh->flags |= FIB_RULE_OIF_DETACHED; 759 } 760 761 if ((rule->pref && 762 nla_put_u32(skb, FRA_PRIORITY, rule->pref)) || 763 (rule->mark && 764 nla_put_u32(skb, FRA_FWMARK, rule->mark)) || 765 ((rule->mark_mask || rule->mark) && 766 nla_put_u32(skb, FRA_FWMASK, rule->mark_mask)) || 767 (rule->target && 768 nla_put_u32(skb, FRA_GOTO, rule->target)) || 769 (rule->tun_id && 770 nla_put_be64(skb, FRA_TUN_ID, rule->tun_id, FRA_PAD)) || 771 (rule->l3mdev && 772 nla_put_u8(skb, FRA_L3MDEV, rule->l3mdev)) || 773 (uid_range_set(&rule->uid_range) && 774 nla_put_uid_range(skb, &rule->uid_range))) 775 goto nla_put_failure; 776 777 if (rule->suppress_ifgroup != -1) { 778 if (nla_put_u32(skb, FRA_SUPPRESS_IFGROUP, rule->suppress_ifgroup)) 779 goto nla_put_failure; 780 } 781 782 if (ops->fill(rule, skb, frh) < 0) 783 goto nla_put_failure; 784 785 nlmsg_end(skb, nlh); 786 return 0; 787 788 nla_put_failure: 789 nlmsg_cancel(skb, nlh); 790 return -EMSGSIZE; 791 } 792 793 static int dump_rules(struct sk_buff *skb, struct netlink_callback *cb, 794 struct fib_rules_ops *ops) 795 { 796 int idx = 0; 797 struct fib_rule *rule; 798 int err = 0; 799 800 rcu_read_lock(); 801 list_for_each_entry_rcu(rule, &ops->rules_list, list) { 802 if (idx < cb->args[1]) 803 goto skip; 804 805 err = fib_nl_fill_rule(skb, rule, NETLINK_CB(cb->skb).portid, 806 cb->nlh->nlmsg_seq, RTM_NEWRULE, 807 NLM_F_MULTI, ops); 808 if (err) 809 break; 810 skip: 811 idx++; 812 } 813 rcu_read_unlock(); 814 cb->args[1] = idx; 815 rules_ops_put(ops); 816 817 return err; 818 } 819 820 static int fib_nl_dumprule(struct sk_buff *skb, struct netlink_callback *cb) 821 { 822 struct net *net = sock_net(skb->sk); 823 struct fib_rules_ops *ops; 824 int idx = 0, family; 825 826 family = rtnl_msg_family(cb->nlh); 827 if (family != AF_UNSPEC) { 828 /* Protocol specific dump request */ 829 ops = lookup_rules_ops(net, family); 830 if (ops == NULL) 831 return -EAFNOSUPPORT; 832 833 dump_rules(skb, cb, ops); 834 835 return skb->len; 836 } 837 838 rcu_read_lock(); 839 list_for_each_entry_rcu(ops, &net->rules_ops, list) { 840 if (idx < cb->args[0] || !try_module_get(ops->owner)) 841 goto skip; 842 843 if (dump_rules(skb, cb, ops) < 0) 844 break; 845 846 cb->args[1] = 0; 847 skip: 848 idx++; 849 } 850 rcu_read_unlock(); 851 cb->args[0] = idx; 852 853 return skb->len; 854 } 855 856 static void notify_rule_change(int event, struct fib_rule *rule, 857 struct fib_rules_ops *ops, struct nlmsghdr *nlh, 858 u32 pid) 859 { 860 struct net *net; 861 struct sk_buff *skb; 862 int err = -ENOBUFS; 863 864 net = ops->fro_net; 865 skb = nlmsg_new(fib_rule_nlmsg_size(ops, rule), GFP_KERNEL); 866 if (skb == NULL) 867 goto errout; 868 869 err = fib_nl_fill_rule(skb, rule, pid, nlh->nlmsg_seq, event, 0, ops); 870 if (err < 0) { 871 /* -EMSGSIZE implies BUG in fib_rule_nlmsg_size() */ 872 WARN_ON(err == -EMSGSIZE); 873 kfree_skb(skb); 874 goto errout; 875 } 876 877 rtnl_notify(skb, net, pid, ops->nlgroup, nlh, GFP_KERNEL); 878 return; 879 errout: 880 if (err < 0) 881 rtnl_set_sk_err(net, ops->nlgroup, err); 882 } 883 884 static void attach_rules(struct list_head *rules, struct net_device *dev) 885 { 886 struct fib_rule *rule; 887 888 list_for_each_entry(rule, rules, list) { 889 if (rule->iifindex == -1 && 890 strcmp(dev->name, rule->iifname) == 0) 891 rule->iifindex = dev->ifindex; 892 if (rule->oifindex == -1 && 893 strcmp(dev->name, rule->oifname) == 0) 894 rule->oifindex = dev->ifindex; 895 } 896 } 897 898 static void detach_rules(struct list_head *rules, struct net_device *dev) 899 { 900 struct fib_rule *rule; 901 902 list_for_each_entry(rule, rules, list) { 903 if (rule->iifindex == dev->ifindex) 904 rule->iifindex = -1; 905 if (rule->oifindex == dev->ifindex) 906 rule->oifindex = -1; 907 } 908 } 909 910 911 static int fib_rules_event(struct notifier_block *this, unsigned long event, 912 void *ptr) 913 { 914 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 915 struct net *net = dev_net(dev); 916 struct fib_rules_ops *ops; 917 918 ASSERT_RTNL(); 919 920 switch (event) { 921 case NETDEV_REGISTER: 922 list_for_each_entry(ops, &net->rules_ops, list) 923 attach_rules(&ops->rules_list, dev); 924 break; 925 926 case NETDEV_CHANGENAME: 927 list_for_each_entry(ops, &net->rules_ops, list) { 928 detach_rules(&ops->rules_list, dev); 929 attach_rules(&ops->rules_list, dev); 930 } 931 break; 932 933 case NETDEV_UNREGISTER: 934 list_for_each_entry(ops, &net->rules_ops, list) 935 detach_rules(&ops->rules_list, dev); 936 break; 937 } 938 939 return NOTIFY_DONE; 940 } 941 942 static struct notifier_block fib_rules_notifier = { 943 .notifier_call = fib_rules_event, 944 }; 945 946 static int __net_init fib_rules_net_init(struct net *net) 947 { 948 INIT_LIST_HEAD(&net->rules_ops); 949 spin_lock_init(&net->rules_mod_lock); 950 return 0; 951 } 952 953 static struct pernet_operations fib_rules_net_ops = { 954 .init = fib_rules_net_init, 955 }; 956 957 static int __init fib_rules_init(void) 958 { 959 int err; 960 rtnl_register(PF_UNSPEC, RTM_NEWRULE, fib_nl_newrule, NULL, NULL); 961 rtnl_register(PF_UNSPEC, RTM_DELRULE, fib_nl_delrule, NULL, NULL); 962 rtnl_register(PF_UNSPEC, RTM_GETRULE, NULL, fib_nl_dumprule, NULL); 963 964 err = register_pernet_subsys(&fib_rules_net_ops); 965 if (err < 0) 966 goto fail; 967 968 err = register_netdevice_notifier(&fib_rules_notifier); 969 if (err < 0) 970 goto fail_unregister; 971 972 return 0; 973 974 fail_unregister: 975 unregister_pernet_subsys(&fib_rules_net_ops); 976 fail: 977 rtnl_unregister(PF_UNSPEC, RTM_NEWRULE); 978 rtnl_unregister(PF_UNSPEC, RTM_DELRULE); 979 rtnl_unregister(PF_UNSPEC, RTM_GETRULE); 980 return err; 981 } 982 983 subsys_initcall(fib_rules_init); 984