1 /* 2 * net/core/fib_rules.c Generic Routing Rules 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU General Public License as 6 * published by the Free Software Foundation, version 2. 7 * 8 * Authors: Thomas Graf <tgraf@suug.ch> 9 */ 10 11 #include <linux/types.h> 12 #include <linux/kernel.h> 13 #include <linux/list.h> 14 #include <net/fib_rules.h> 15 16 static LIST_HEAD(rules_ops); 17 static DEFINE_SPINLOCK(rules_mod_lock); 18 19 static void notify_rule_change(int event, struct fib_rule *rule, 20 struct fib_rules_ops *ops, struct nlmsghdr *nlh, 21 u32 pid); 22 23 static struct fib_rules_ops *lookup_rules_ops(int family) 24 { 25 struct fib_rules_ops *ops; 26 27 rcu_read_lock(); 28 list_for_each_entry_rcu(ops, &rules_ops, list) { 29 if (ops->family == family) { 30 if (!try_module_get(ops->owner)) 31 ops = NULL; 32 rcu_read_unlock(); 33 return ops; 34 } 35 } 36 rcu_read_unlock(); 37 38 return NULL; 39 } 40 41 static void rules_ops_put(struct fib_rules_ops *ops) 42 { 43 if (ops) 44 module_put(ops->owner); 45 } 46 47 int fib_rules_register(struct fib_rules_ops *ops) 48 { 49 int err = -EEXIST; 50 struct fib_rules_ops *o; 51 52 if (ops->rule_size < sizeof(struct fib_rule)) 53 return -EINVAL; 54 55 if (ops->match == NULL || ops->configure == NULL || 56 ops->compare == NULL || ops->fill == NULL || 57 ops->action == NULL) 58 return -EINVAL; 59 60 spin_lock(&rules_mod_lock); 61 list_for_each_entry(o, &rules_ops, list) 62 if (ops->family == o->family) 63 goto errout; 64 65 list_add_tail_rcu(&ops->list, &rules_ops); 66 err = 0; 67 errout: 68 spin_unlock(&rules_mod_lock); 69 70 return err; 71 } 72 73 EXPORT_SYMBOL_GPL(fib_rules_register); 74 75 static void cleanup_ops(struct fib_rules_ops *ops) 76 { 77 struct fib_rule *rule, *tmp; 78 79 list_for_each_entry_safe(rule, tmp, ops->rules_list, list) { 80 list_del_rcu(&rule->list); 81 fib_rule_put(rule); 82 } 83 } 84 85 int fib_rules_unregister(struct fib_rules_ops *ops) 86 { 87 int err = 0; 88 struct fib_rules_ops *o; 89 90 spin_lock(&rules_mod_lock); 91 list_for_each_entry(o, &rules_ops, list) { 92 if (o == ops) { 93 list_del_rcu(&o->list); 94 cleanup_ops(ops); 95 goto out; 96 } 97 } 98 99 err = -ENOENT; 100 out: 101 spin_unlock(&rules_mod_lock); 102 103 synchronize_rcu(); 104 105 return err; 106 } 107 108 EXPORT_SYMBOL_GPL(fib_rules_unregister); 109 110 static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops, 111 struct flowi *fl, int flags) 112 { 113 int ret = 0; 114 115 if (rule->ifindex && (rule->ifindex != fl->iif)) 116 goto out; 117 118 if ((rule->mark ^ fl->mark) & rule->mark_mask) 119 goto out; 120 121 ret = ops->match(rule, fl, flags); 122 out: 123 return (rule->flags & FIB_RULE_INVERT) ? !ret : ret; 124 } 125 126 int fib_rules_lookup(struct fib_rules_ops *ops, struct flowi *fl, 127 int flags, struct fib_lookup_arg *arg) 128 { 129 struct fib_rule *rule; 130 int err; 131 132 rcu_read_lock(); 133 134 list_for_each_entry_rcu(rule, ops->rules_list, list) { 135 if (!fib_rule_match(rule, ops, fl, flags)) 136 continue; 137 138 err = ops->action(rule, fl, flags, arg); 139 if (err != -EAGAIN) { 140 fib_rule_get(rule); 141 arg->rule = rule; 142 goto out; 143 } 144 } 145 146 err = -ESRCH; 147 out: 148 rcu_read_unlock(); 149 150 return err; 151 } 152 153 EXPORT_SYMBOL_GPL(fib_rules_lookup); 154 155 static int validate_rulemsg(struct fib_rule_hdr *frh, struct nlattr **tb, 156 struct fib_rules_ops *ops) 157 { 158 int err = -EINVAL; 159 160 if (frh->src_len) 161 if (tb[FRA_SRC] == NULL || 162 frh->src_len > (ops->addr_size * 8) || 163 nla_len(tb[FRA_SRC]) != ops->addr_size) 164 goto errout; 165 166 if (frh->dst_len) 167 if (tb[FRA_DST] == NULL || 168 frh->dst_len > (ops->addr_size * 8) || 169 nla_len(tb[FRA_DST]) != ops->addr_size) 170 goto errout; 171 172 err = 0; 173 errout: 174 return err; 175 } 176 177 int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg) 178 { 179 struct fib_rule_hdr *frh = nlmsg_data(nlh); 180 struct fib_rules_ops *ops = NULL; 181 struct fib_rule *rule, *r, *last = NULL; 182 struct nlattr *tb[FRA_MAX+1]; 183 int err = -EINVAL; 184 185 if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh))) 186 goto errout; 187 188 ops = lookup_rules_ops(frh->family); 189 if (ops == NULL) { 190 err = EAFNOSUPPORT; 191 goto errout; 192 } 193 194 err = nlmsg_parse(nlh, sizeof(*frh), tb, FRA_MAX, ops->policy); 195 if (err < 0) 196 goto errout; 197 198 err = validate_rulemsg(frh, tb, ops); 199 if (err < 0) 200 goto errout; 201 202 rule = kzalloc(ops->rule_size, GFP_KERNEL); 203 if (rule == NULL) { 204 err = -ENOMEM; 205 goto errout; 206 } 207 208 if (tb[FRA_PRIORITY]) 209 rule->pref = nla_get_u32(tb[FRA_PRIORITY]); 210 211 if (tb[FRA_IFNAME]) { 212 struct net_device *dev; 213 214 rule->ifindex = -1; 215 nla_strlcpy(rule->ifname, tb[FRA_IFNAME], IFNAMSIZ); 216 dev = __dev_get_by_name(rule->ifname); 217 if (dev) 218 rule->ifindex = dev->ifindex; 219 } 220 221 if (tb[FRA_FWMARK]) { 222 rule->mark = nla_get_u32(tb[FRA_FWMARK]); 223 if (rule->mark) 224 /* compatibility: if the mark value is non-zero all bits 225 * are compared unless a mask is explicitly specified. 226 */ 227 rule->mark_mask = 0xFFFFFFFF; 228 } 229 230 if (tb[FRA_FWMASK]) 231 rule->mark_mask = nla_get_u32(tb[FRA_FWMASK]); 232 233 rule->action = frh->action; 234 rule->flags = frh->flags; 235 rule->table = frh_get_table(frh, tb); 236 237 if (!rule->pref && ops->default_pref) 238 rule->pref = ops->default_pref(); 239 240 err = ops->configure(rule, skb, nlh, frh, tb); 241 if (err < 0) 242 goto errout_free; 243 244 list_for_each_entry(r, ops->rules_list, list) { 245 if (r->pref > rule->pref) 246 break; 247 last = r; 248 } 249 250 fib_rule_get(rule); 251 252 if (last) 253 list_add_rcu(&rule->list, &last->list); 254 else 255 list_add_rcu(&rule->list, ops->rules_list); 256 257 notify_rule_change(RTM_NEWRULE, rule, ops, nlh, NETLINK_CB(skb).pid); 258 rules_ops_put(ops); 259 return 0; 260 261 errout_free: 262 kfree(rule); 263 errout: 264 rules_ops_put(ops); 265 return err; 266 } 267 268 int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg) 269 { 270 struct fib_rule_hdr *frh = nlmsg_data(nlh); 271 struct fib_rules_ops *ops = NULL; 272 struct fib_rule *rule; 273 struct nlattr *tb[FRA_MAX+1]; 274 int err = -EINVAL; 275 276 if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh))) 277 goto errout; 278 279 ops = lookup_rules_ops(frh->family); 280 if (ops == NULL) { 281 err = EAFNOSUPPORT; 282 goto errout; 283 } 284 285 err = nlmsg_parse(nlh, sizeof(*frh), tb, FRA_MAX, ops->policy); 286 if (err < 0) 287 goto errout; 288 289 err = validate_rulemsg(frh, tb, ops); 290 if (err < 0) 291 goto errout; 292 293 list_for_each_entry(rule, ops->rules_list, list) { 294 if (frh->action && (frh->action != rule->action)) 295 continue; 296 297 if (frh->table && (frh_get_table(frh, tb) != rule->table)) 298 continue; 299 300 if (tb[FRA_PRIORITY] && 301 (rule->pref != nla_get_u32(tb[FRA_PRIORITY]))) 302 continue; 303 304 if (tb[FRA_IFNAME] && 305 nla_strcmp(tb[FRA_IFNAME], rule->ifname)) 306 continue; 307 308 if (tb[FRA_FWMARK] && 309 (rule->mark != nla_get_u32(tb[FRA_FWMARK]))) 310 continue; 311 312 if (tb[FRA_FWMASK] && 313 (rule->mark_mask != nla_get_u32(tb[FRA_FWMASK]))) 314 continue; 315 316 if (!ops->compare(rule, frh, tb)) 317 continue; 318 319 if (rule->flags & FIB_RULE_PERMANENT) { 320 err = -EPERM; 321 goto errout; 322 } 323 324 list_del_rcu(&rule->list); 325 synchronize_rcu(); 326 notify_rule_change(RTM_DELRULE, rule, ops, nlh, 327 NETLINK_CB(skb).pid); 328 fib_rule_put(rule); 329 rules_ops_put(ops); 330 return 0; 331 } 332 333 err = -ENOENT; 334 errout: 335 rules_ops_put(ops); 336 return err; 337 } 338 339 static inline size_t fib_rule_nlmsg_size(struct fib_rules_ops *ops, 340 struct fib_rule *rule) 341 { 342 size_t payload = NLMSG_ALIGN(sizeof(struct fib_rule_hdr)) 343 + nla_total_size(IFNAMSIZ) /* FRA_IFNAME */ 344 + nla_total_size(4) /* FRA_PRIORITY */ 345 + nla_total_size(4) /* FRA_TABLE */ 346 + nla_total_size(4) /* FRA_FWMARK */ 347 + nla_total_size(4); /* FRA_FWMASK */ 348 349 if (ops->nlmsg_payload) 350 payload += ops->nlmsg_payload(rule); 351 352 return payload; 353 } 354 355 static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule, 356 u32 pid, u32 seq, int type, int flags, 357 struct fib_rules_ops *ops) 358 { 359 struct nlmsghdr *nlh; 360 struct fib_rule_hdr *frh; 361 362 nlh = nlmsg_put(skb, pid, seq, type, sizeof(*frh), flags); 363 if (nlh == NULL) 364 return -EMSGSIZE; 365 366 frh = nlmsg_data(nlh); 367 frh->table = rule->table; 368 NLA_PUT_U32(skb, FRA_TABLE, rule->table); 369 frh->res1 = 0; 370 frh->res2 = 0; 371 frh->action = rule->action; 372 frh->flags = rule->flags; 373 374 if (rule->ifname[0]) 375 NLA_PUT_STRING(skb, FRA_IFNAME, rule->ifname); 376 377 if (rule->pref) 378 NLA_PUT_U32(skb, FRA_PRIORITY, rule->pref); 379 380 if (rule->mark) 381 NLA_PUT_U32(skb, FRA_FWMARK, rule->mark); 382 383 if (rule->mark_mask || rule->mark) 384 NLA_PUT_U32(skb, FRA_FWMASK, rule->mark_mask); 385 386 if (ops->fill(rule, skb, nlh, frh) < 0) 387 goto nla_put_failure; 388 389 return nlmsg_end(skb, nlh); 390 391 nla_put_failure: 392 nlmsg_cancel(skb, nlh); 393 return -EMSGSIZE; 394 } 395 396 int fib_rules_dump(struct sk_buff *skb, struct netlink_callback *cb, int family) 397 { 398 int idx = 0; 399 struct fib_rule *rule; 400 struct fib_rules_ops *ops; 401 402 ops = lookup_rules_ops(family); 403 if (ops == NULL) 404 return -EAFNOSUPPORT; 405 406 rcu_read_lock(); 407 list_for_each_entry_rcu(rule, ops->rules_list, list) { 408 if (idx < cb->args[0]) 409 goto skip; 410 411 if (fib_nl_fill_rule(skb, rule, NETLINK_CB(cb->skb).pid, 412 cb->nlh->nlmsg_seq, RTM_NEWRULE, 413 NLM_F_MULTI, ops) < 0) 414 break; 415 skip: 416 idx++; 417 } 418 rcu_read_unlock(); 419 cb->args[0] = idx; 420 rules_ops_put(ops); 421 422 return skb->len; 423 } 424 425 EXPORT_SYMBOL_GPL(fib_rules_dump); 426 427 static void notify_rule_change(int event, struct fib_rule *rule, 428 struct fib_rules_ops *ops, struct nlmsghdr *nlh, 429 u32 pid) 430 { 431 struct sk_buff *skb; 432 int err = -ENOBUFS; 433 434 skb = nlmsg_new(fib_rule_nlmsg_size(ops, rule), GFP_KERNEL); 435 if (skb == NULL) 436 goto errout; 437 438 err = fib_nl_fill_rule(skb, rule, pid, nlh->nlmsg_seq, event, 0, ops); 439 if (err < 0) { 440 /* -EMSGSIZE implies BUG in fib_rule_nlmsg_size() */ 441 WARN_ON(err == -EMSGSIZE); 442 kfree_skb(skb); 443 goto errout; 444 } 445 err = rtnl_notify(skb, pid, ops->nlgroup, nlh, GFP_KERNEL); 446 errout: 447 if (err < 0) 448 rtnl_set_sk_err(ops->nlgroup, err); 449 } 450 451 static void attach_rules(struct list_head *rules, struct net_device *dev) 452 { 453 struct fib_rule *rule; 454 455 list_for_each_entry(rule, rules, list) { 456 if (rule->ifindex == -1 && 457 strcmp(dev->name, rule->ifname) == 0) 458 rule->ifindex = dev->ifindex; 459 } 460 } 461 462 static void detach_rules(struct list_head *rules, struct net_device *dev) 463 { 464 struct fib_rule *rule; 465 466 list_for_each_entry(rule, rules, list) 467 if (rule->ifindex == dev->ifindex) 468 rule->ifindex = -1; 469 } 470 471 472 static int fib_rules_event(struct notifier_block *this, unsigned long event, 473 void *ptr) 474 { 475 struct net_device *dev = ptr; 476 struct fib_rules_ops *ops; 477 478 ASSERT_RTNL(); 479 rcu_read_lock(); 480 481 switch (event) { 482 case NETDEV_REGISTER: 483 list_for_each_entry(ops, &rules_ops, list) 484 attach_rules(ops->rules_list, dev); 485 break; 486 487 case NETDEV_UNREGISTER: 488 list_for_each_entry(ops, &rules_ops, list) 489 detach_rules(ops->rules_list, dev); 490 break; 491 } 492 493 rcu_read_unlock(); 494 495 return NOTIFY_DONE; 496 } 497 498 static struct notifier_block fib_rules_notifier = { 499 .notifier_call = fib_rules_event, 500 }; 501 502 static int __init fib_rules_init(void) 503 { 504 return register_netdevice_notifier(&fib_rules_notifier); 505 } 506 507 subsys_initcall(fib_rules_init); 508