xref: /linux/net/ipv4/fib_frontend.c (revision 18f65355e112dfc87d5e2e8a299119afd2e65e7e)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * INET		An implementation of the TCP/IP protocol suite for the LINUX
4  *		operating system.  INET is implemented using the  BSD Socket
5  *		interface as the means of communication with the user level.
6  *
7  *		IPv4 Forwarding Information Base: FIB frontend.
8  *
9  * Authors:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
10  */
11 
12 #include <linux/module.h>
13 #include <linux/uaccess.h>
14 #include <linux/bitops.h>
15 #include <linux/capability.h>
16 #include <linux/types.h>
17 #include <linux/kernel.h>
18 #include <linux/mm.h>
19 #include <linux/string.h>
20 #include <linux/socket.h>
21 #include <linux/sockios.h>
22 #include <linux/errno.h>
23 #include <linux/in.h>
24 #include <linux/inet.h>
25 #include <linux/inetdevice.h>
26 #include <linux/netdevice.h>
27 #include <linux/if_addr.h>
28 #include <linux/if_arp.h>
29 #include <linux/skbuff.h>
30 #include <linux/cache.h>
31 #include <linux/init.h>
32 #include <linux/list.h>
33 #include <linux/slab.h>
34 
35 #include <net/flow.h>
36 #include <net/inet_dscp.h>
37 #include <net/ip.h>
38 #include <net/protocol.h>
39 #include <net/route.h>
40 #include <net/tcp.h>
41 #include <net/sock.h>
42 #include <net/arp.h>
43 #include <net/ip_fib.h>
44 #include <net/nexthop.h>
45 #include <net/rtnetlink.h>
46 #include <net/xfrm.h>
47 #include <net/l3mdev.h>
48 #include <net/lwtunnel.h>
49 #include <trace/events/fib.h>
50 
51 #ifndef CONFIG_IP_MULTIPLE_TABLES
52 
53 static int __net_init fib4_rules_init(struct net *net)
54 {
55 	struct fib_table *local_table, *main_table;
56 
57 	main_table  = fib_trie_table(RT_TABLE_MAIN, NULL);
58 	if (!main_table)
59 		return -ENOMEM;
60 
61 	local_table = fib_trie_table(RT_TABLE_LOCAL, main_table);
62 	if (!local_table)
63 		goto fail;
64 
65 	hlist_add_head_rcu(&local_table->tb_hlist,
66 				&net->ipv4.fib_table_hash[TABLE_LOCAL_INDEX]);
67 	hlist_add_head_rcu(&main_table->tb_hlist,
68 				&net->ipv4.fib_table_hash[TABLE_MAIN_INDEX]);
69 	return 0;
70 
71 fail:
72 	fib_free_table(main_table);
73 	return -ENOMEM;
74 }
75 #else
76 
77 struct fib_table *fib_new_table(struct net *net, u32 id)
78 {
79 	struct fib_table *tb, *alias = NULL;
80 	unsigned int h;
81 
82 	if (id == 0)
83 		id = RT_TABLE_MAIN;
84 	tb = fib_get_table(net, id);
85 	if (tb)
86 		return tb;
87 
88 	if (id == RT_TABLE_LOCAL && !net->ipv4.fib_has_custom_rules)
89 		alias = fib_new_table(net, RT_TABLE_MAIN);
90 
91 	if (check_net(net))
92 		tb = fib_trie_table(id, alias);
93 	if (!tb)
94 		return NULL;
95 
96 	switch (id) {
97 	case RT_TABLE_MAIN:
98 		rcu_assign_pointer(net->ipv4.fib_main, tb);
99 		break;
100 	case RT_TABLE_DEFAULT:
101 		rcu_assign_pointer(net->ipv4.fib_default, tb);
102 		break;
103 	default:
104 		break;
105 	}
106 
107 	h = id & (FIB_TABLE_HASHSZ - 1);
108 	hlist_add_head_rcu(&tb->tb_hlist, &net->ipv4.fib_table_hash[h]);
109 	return tb;
110 }
111 EXPORT_SYMBOL_GPL(fib_new_table);
112 
113 /* caller must hold either rtnl or rcu read lock */
114 struct fib_table *fib_get_table(struct net *net, u32 id)
115 {
116 	struct fib_table *tb;
117 	struct hlist_head *head;
118 	unsigned int h;
119 
120 	if (id == 0)
121 		id = RT_TABLE_MAIN;
122 	h = id & (FIB_TABLE_HASHSZ - 1);
123 
124 	head = &net->ipv4.fib_table_hash[h];
125 	hlist_for_each_entry_rcu(tb, head, tb_hlist,
126 				 lockdep_rtnl_is_held()) {
127 		if (tb->tb_id == id)
128 			return tb;
129 	}
130 	return NULL;
131 }
132 #endif /* CONFIG_IP_MULTIPLE_TABLES */
133 
134 static void fib_replace_table(struct net *net, struct fib_table *old,
135 			      struct fib_table *new)
136 {
137 #ifdef CONFIG_IP_MULTIPLE_TABLES
138 	switch (new->tb_id) {
139 	case RT_TABLE_MAIN:
140 		rcu_assign_pointer(net->ipv4.fib_main, new);
141 		break;
142 	case RT_TABLE_DEFAULT:
143 		rcu_assign_pointer(net->ipv4.fib_default, new);
144 		break;
145 	default:
146 		break;
147 	}
148 
149 #endif
150 	/* replace the old table in the hlist */
151 	hlist_replace_rcu(&old->tb_hlist, &new->tb_hlist);
152 }
153 
154 int fib_unmerge(struct net *net)
155 {
156 	struct fib_table *old, *new, *main_table;
157 
158 	/* attempt to fetch local table if it has been allocated */
159 	old = fib_get_table(net, RT_TABLE_LOCAL);
160 	if (!old)
161 		return 0;
162 
163 	new = fib_trie_unmerge(old);
164 	if (!new)
165 		return -ENOMEM;
166 
167 	/* table is already unmerged */
168 	if (new == old)
169 		return 0;
170 
171 	/* replace merged table with clean table */
172 	fib_replace_table(net, old, new);
173 	fib_free_table(old);
174 
175 	/* attempt to fetch main table if it has been allocated */
176 	main_table = fib_get_table(net, RT_TABLE_MAIN);
177 	if (!main_table)
178 		return 0;
179 
180 	/* flush local entries from main table */
181 	fib_table_flush_external(main_table);
182 
183 	return 0;
184 }
185 
186 void fib_flush(struct net *net)
187 {
188 	int flushed = 0;
189 	unsigned int h;
190 
191 	for (h = 0; h < FIB_TABLE_HASHSZ; h++) {
192 		struct hlist_head *head = &net->ipv4.fib_table_hash[h];
193 		struct hlist_node *tmp;
194 		struct fib_table *tb;
195 
196 		hlist_for_each_entry_safe(tb, tmp, head, tb_hlist)
197 			flushed += fib_table_flush(net, tb, false);
198 	}
199 
200 	if (flushed)
201 		rt_cache_flush(net);
202 }
203 
204 /*
205  * Find address type as if only "dev" was present in the system. If
206  * on_dev is NULL then all interfaces are taken into consideration.
207  */
208 static inline unsigned int __inet_dev_addr_type(struct net *net,
209 						const struct net_device *dev,
210 						__be32 addr, u32 tb_id)
211 {
212 	struct flowi4		fl4 = { .daddr = addr };
213 	struct fib_result	res;
214 	unsigned int ret = RTN_BROADCAST;
215 	struct fib_table *table;
216 
217 	if (ipv4_is_zeronet(addr) || ipv4_is_lbcast(addr))
218 		return RTN_BROADCAST;
219 	if (ipv4_is_multicast(addr))
220 		return RTN_MULTICAST;
221 
222 	rcu_read_lock();
223 
224 	table = fib_get_table(net, tb_id);
225 	if (table) {
226 		ret = RTN_UNICAST;
227 		if (!fib_table_lookup(table, &fl4, &res, FIB_LOOKUP_NOREF)) {
228 			struct fib_nh_common *nhc = fib_info_nhc(res.fi, 0);
229 
230 			if (!dev || dev == nhc->nhc_dev)
231 				ret = res.type;
232 		}
233 	}
234 
235 	rcu_read_unlock();
236 	return ret;
237 }
238 
239 unsigned int inet_addr_type_table(struct net *net, __be32 addr, u32 tb_id)
240 {
241 	return __inet_dev_addr_type(net, NULL, addr, tb_id);
242 }
243 EXPORT_SYMBOL(inet_addr_type_table);
244 
245 unsigned int inet_addr_type(struct net *net, __be32 addr)
246 {
247 	return __inet_dev_addr_type(net, NULL, addr, RT_TABLE_LOCAL);
248 }
249 EXPORT_SYMBOL(inet_addr_type);
250 
251 unsigned int inet_dev_addr_type(struct net *net, const struct net_device *dev,
252 				__be32 addr)
253 {
254 	u32 rt_table = l3mdev_fib_table(dev) ? : RT_TABLE_LOCAL;
255 
256 	return __inet_dev_addr_type(net, dev, addr, rt_table);
257 }
258 EXPORT_SYMBOL(inet_dev_addr_type);
259 
260 /* inet_addr_type with dev == NULL but using the table from a dev
261  * if one is associated
262  */
263 unsigned int inet_addr_type_dev_table(struct net *net,
264 				      const struct net_device *dev,
265 				      __be32 addr)
266 {
267 	u32 rt_table = l3mdev_fib_table(dev) ? : RT_TABLE_LOCAL;
268 
269 	return __inet_dev_addr_type(net, NULL, addr, rt_table);
270 }
271 EXPORT_SYMBOL(inet_addr_type_dev_table);
272 
273 __be32 fib_compute_spec_dst(struct sk_buff *skb)
274 {
275 	struct net_device *dev = skb->dev;
276 	struct in_device *in_dev;
277 	struct fib_result res;
278 	struct rtable *rt;
279 	struct net *net;
280 	int scope;
281 
282 	rt = skb_rtable(skb);
283 	if ((rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST | RTCF_LOCAL)) ==
284 	    RTCF_LOCAL)
285 		return ip_hdr(skb)->daddr;
286 
287 	in_dev = __in_dev_get_rcu(dev);
288 
289 	net = dev_net(dev);
290 
291 	scope = RT_SCOPE_UNIVERSE;
292 	if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) {
293 		bool vmark = in_dev && IN_DEV_SRC_VMARK(in_dev);
294 		struct flowi4 fl4 = {
295 			.flowi4_iif = LOOPBACK_IFINDEX,
296 			.flowi4_l3mdev = l3mdev_master_ifindex_rcu(dev),
297 			.daddr = ip_hdr(skb)->saddr,
298 			.flowi4_dscp = ip4h_dscp(ip_hdr(skb)),
299 			.flowi4_scope = scope,
300 			.flowi4_mark = vmark ? skb->mark : 0,
301 		};
302 		if (!fib_lookup(net, &fl4, &res, 0))
303 			return fib_result_prefsrc(net, &res);
304 	} else {
305 		scope = RT_SCOPE_LINK;
306 	}
307 
308 	return inet_select_addr(dev, ip_hdr(skb)->saddr, scope);
309 }
310 
311 bool fib_info_nh_uses_dev(struct fib_info *fi, const struct net_device *dev)
312 {
313 	bool dev_match = false;
314 #ifdef CONFIG_IP_ROUTE_MULTIPATH
315 	if (unlikely(fi->nh)) {
316 		dev_match = nexthop_uses_dev(fi->nh, dev);
317 	} else {
318 		int ret;
319 
320 		for (ret = 0; ret < fib_info_num_path(fi); ret++) {
321 			const struct fib_nh_common *nhc = fib_info_nhc(fi, ret);
322 
323 			if (nhc_l3mdev_matches_dev(nhc, dev)) {
324 				dev_match = true;
325 				break;
326 			}
327 		}
328 	}
329 #else
330 	if (fib_info_nhc(fi, 0)->nhc_dev == dev)
331 		dev_match = true;
332 #endif
333 
334 	return dev_match;
335 }
336 EXPORT_SYMBOL_GPL(fib_info_nh_uses_dev);
337 
338 /* Given (packet source, input interface) and optional (dst, oif, tos):
339  * - (main) check, that source is valid i.e. not broadcast or our local
340  *   address.
341  * - figure out what "logical" interface this packet arrived
342  *   and calculate "specific destination" address.
343  * - check, that packet arrived from expected physical interface.
344  * called with rcu_read_lock()
345  */
346 static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
347 				 dscp_t dscp, int oif, struct net_device *dev,
348 				 int rpf, struct in_device *idev, u32 *itag)
349 {
350 	struct net *net = dev_net(dev);
351 	enum skb_drop_reason reason;
352 	struct flow_keys flkeys;
353 	int ret, no_addr;
354 	struct fib_result res;
355 	struct flowi4 fl4;
356 	bool dev_match;
357 
358 	fl4.flowi4_oif = 0;
359 	fl4.flowi4_l3mdev = l3mdev_master_ifindex_rcu(dev);
360 	fl4.flowi4_iif = oif ? : LOOPBACK_IFINDEX;
361 	fl4.daddr = src;
362 	fl4.saddr = dst;
363 	fl4.flowi4_dscp = dscp;
364 	fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
365 	fl4.flowi4_tun_key.tun_id = 0;
366 	fl4.flowi4_flags = 0;
367 	fl4.flowi4_uid = sock_net_uid(net, NULL);
368 	fl4.flowi4_multipath_hash = 0;
369 
370 	no_addr = idev->ifa_list == NULL;
371 
372 	fl4.flowi4_mark = IN_DEV_SRC_VMARK(idev) ? skb->mark : 0;
373 	if (!fib4_rules_early_flow_dissect(net, skb, &fl4, &flkeys)) {
374 		fl4.flowi4_proto = 0;
375 		fl4.fl4_sport = 0;
376 		fl4.fl4_dport = 0;
377 	} else {
378 		swap(fl4.fl4_sport, fl4.fl4_dport);
379 	}
380 
381 	if (fib_lookup(net, &fl4, &res, 0))
382 		goto last_resort;
383 	if (res.type != RTN_UNICAST) {
384 		if (res.type != RTN_LOCAL) {
385 			reason = SKB_DROP_REASON_IP_INVALID_SOURCE;
386 			goto e_inval;
387 		} else if (!IN_DEV_ACCEPT_LOCAL(idev)) {
388 			reason = SKB_DROP_REASON_IP_LOCAL_SOURCE;
389 			goto e_inval;
390 		}
391 	}
392 	fib_combine_itag(itag, &res);
393 
394 	dev_match = fib_info_nh_uses_dev(res.fi, dev);
395 	/* This is not common, loopback packets retain skb_dst so normally they
396 	 * would not even hit this slow path.
397 	 */
398 	dev_match = dev_match || (res.type == RTN_LOCAL &&
399 				  dev == net->loopback_dev);
400 	if (dev_match) {
401 		ret = FIB_RES_NHC(res)->nhc_scope >= RT_SCOPE_HOST;
402 		return ret;
403 	}
404 	if (no_addr)
405 		goto last_resort;
406 	if (rpf == 1)
407 		goto e_rpf;
408 	fl4.flowi4_oif = dev->ifindex;
409 
410 	ret = 0;
411 	if (fib_lookup(net, &fl4, &res, FIB_LOOKUP_IGNORE_LINKSTATE) == 0) {
412 		if (res.type == RTN_UNICAST)
413 			ret = FIB_RES_NHC(res)->nhc_scope >= RT_SCOPE_HOST;
414 	}
415 	return ret;
416 
417 last_resort:
418 	if (rpf)
419 		goto e_rpf;
420 	*itag = 0;
421 	return 0;
422 
423 e_inval:
424 	return -reason;
425 e_rpf:
426 	return -SKB_DROP_REASON_IP_RPFILTER;
427 }
428 
429 /* Ignore rp_filter for packets protected by IPsec. */
430 int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
431 			dscp_t dscp, int oif, struct net_device *dev,
432 			struct in_device *idev, u32 *itag)
433 {
434 	int r = secpath_exists(skb) ? 0 : IN_DEV_RPFILTER(idev);
435 	struct net *net = dev_net(dev);
436 
437 	if (!r && !fib_num_tclassid_users(net) &&
438 	    (dev->ifindex != oif || !IN_DEV_TX_REDIRECTS(idev))) {
439 		if (IN_DEV_ACCEPT_LOCAL(idev))
440 			goto ok;
441 		/* with custom local routes in place, checking local addresses
442 		 * only will be too optimistic, with custom rules, checking
443 		 * local addresses only can be too strict, e.g. due to vrf
444 		 */
445 		if (net->ipv4.fib_has_custom_local_routes ||
446 		    fib4_has_custom_rules(net))
447 			goto full_check;
448 		/* Within the same container, it is regarded as a martian source,
449 		 * and the same host but different containers are not.
450 		 */
451 		if (inet_lookup_ifaddr_rcu(net, src))
452 			return -SKB_DROP_REASON_IP_LOCAL_SOURCE;
453 
454 ok:
455 		*itag = 0;
456 		return 0;
457 	}
458 
459 full_check:
460 	return __fib_validate_source(skb, src, dst, dscp, oif, dev, r, idev,
461 				     itag);
462 }
463 
464 static inline __be32 sk_extract_addr(struct sockaddr *addr)
465 {
466 	return ((struct sockaddr_in *) addr)->sin_addr.s_addr;
467 }
468 
469 static int put_rtax(struct nlattr *mx, int len, int type, u32 value)
470 {
471 	struct nlattr *nla;
472 
473 	nla = (struct nlattr *) ((char *) mx + len);
474 	nla->nla_type = type;
475 	nla->nla_len = nla_attr_size(4);
476 	*(u32 *) nla_data(nla) = value;
477 
478 	return len + nla_total_size(4);
479 }
480 
481 static int rtentry_to_fib_config(struct net *net, int cmd, struct rtentry *rt,
482 				 struct fib_config *cfg)
483 {
484 	__be32 addr;
485 	int plen;
486 
487 	memset(cfg, 0, sizeof(*cfg));
488 	cfg->fc_nlinfo.nl_net = net;
489 
490 	if (rt->rt_dst.sa_family != AF_INET)
491 		return -EAFNOSUPPORT;
492 
493 	/*
494 	 * Check mask for validity:
495 	 * a) it must be contiguous.
496 	 * b) destination must have all host bits clear.
497 	 * c) if application forgot to set correct family (AF_INET),
498 	 *    reject request unless it is absolutely clear i.e.
499 	 *    both family and mask are zero.
500 	 */
501 	plen = 32;
502 	addr = sk_extract_addr(&rt->rt_dst);
503 	if (!(rt->rt_flags & RTF_HOST)) {
504 		__be32 mask = sk_extract_addr(&rt->rt_genmask);
505 
506 		if (rt->rt_genmask.sa_family != AF_INET) {
507 			if (mask || rt->rt_genmask.sa_family)
508 				return -EAFNOSUPPORT;
509 		}
510 
511 		if (bad_mask(mask, addr))
512 			return -EINVAL;
513 
514 		plen = inet_mask_len(mask);
515 	}
516 
517 	cfg->fc_dst_len = plen;
518 	cfg->fc_dst = addr;
519 
520 	if (cmd != SIOCDELRT) {
521 		cfg->fc_nlflags = NLM_F_CREATE;
522 		cfg->fc_protocol = RTPROT_BOOT;
523 	}
524 
525 	if (rt->rt_metric)
526 		cfg->fc_priority = rt->rt_metric - 1;
527 
528 	if (rt->rt_flags & RTF_REJECT) {
529 		cfg->fc_scope = RT_SCOPE_HOST;
530 		cfg->fc_type = RTN_UNREACHABLE;
531 		return 0;
532 	}
533 
534 	cfg->fc_scope = RT_SCOPE_NOWHERE;
535 	cfg->fc_type = RTN_UNICAST;
536 
537 	if (rt->rt_dev) {
538 		char *colon;
539 		struct net_device *dev;
540 		char devname[IFNAMSIZ];
541 
542 		if (copy_from_user(devname, rt->rt_dev, IFNAMSIZ-1))
543 			return -EFAULT;
544 
545 		devname[IFNAMSIZ-1] = 0;
546 		colon = strchr(devname, ':');
547 		if (colon)
548 			*colon = 0;
549 		dev = __dev_get_by_name(net, devname);
550 		if (!dev)
551 			return -ENODEV;
552 		cfg->fc_oif = dev->ifindex;
553 		cfg->fc_table = l3mdev_fib_table(dev);
554 		if (colon) {
555 			const struct in_ifaddr *ifa;
556 			struct in_device *in_dev;
557 
558 			in_dev = __in_dev_get_rtnl_net(dev);
559 			if (!in_dev)
560 				return -ENODEV;
561 
562 			*colon = ':';
563 
564 			in_dev_for_each_ifa_rtnl_net(net, ifa, in_dev) {
565 				if (strcmp(ifa->ifa_label, devname) == 0)
566 					break;
567 			}
568 
569 			if (!ifa)
570 				return -ENODEV;
571 			cfg->fc_prefsrc = ifa->ifa_local;
572 		}
573 	}
574 
575 	addr = sk_extract_addr(&rt->rt_gateway);
576 	if (rt->rt_gateway.sa_family == AF_INET && addr) {
577 		unsigned int addr_type;
578 
579 		cfg->fc_gw4 = addr;
580 		cfg->fc_gw_family = AF_INET;
581 		addr_type = inet_addr_type_table(net, addr, cfg->fc_table);
582 		if (rt->rt_flags & RTF_GATEWAY &&
583 		    addr_type == RTN_UNICAST)
584 			cfg->fc_scope = RT_SCOPE_UNIVERSE;
585 	}
586 
587 	if (!cfg->fc_table)
588 		cfg->fc_table = RT_TABLE_MAIN;
589 
590 	if (cmd == SIOCDELRT)
591 		return 0;
592 
593 	if (rt->rt_flags & RTF_GATEWAY && !cfg->fc_gw_family)
594 		return -EINVAL;
595 
596 	if (cfg->fc_scope == RT_SCOPE_NOWHERE)
597 		cfg->fc_scope = RT_SCOPE_LINK;
598 
599 	if (rt->rt_flags & (RTF_MTU | RTF_WINDOW | RTF_IRTT)) {
600 		struct nlattr *mx;
601 		int len = 0;
602 
603 		mx = kcalloc(3, nla_total_size(4), GFP_KERNEL);
604 		if (!mx)
605 			return -ENOMEM;
606 
607 		if (rt->rt_flags & RTF_MTU)
608 			len = put_rtax(mx, len, RTAX_ADVMSS, rt->rt_mtu - 40);
609 
610 		if (rt->rt_flags & RTF_WINDOW)
611 			len = put_rtax(mx, len, RTAX_WINDOW, rt->rt_window);
612 
613 		if (rt->rt_flags & RTF_IRTT)
614 			len = put_rtax(mx, len, RTAX_RTT, rt->rt_irtt << 3);
615 
616 		cfg->fc_mx = mx;
617 		cfg->fc_mx_len = len;
618 	}
619 
620 	return 0;
621 }
622 
623 /*
624  * Handle IP routing ioctl calls.
625  * These are used to manipulate the routing tables
626  */
627 int ip_rt_ioctl(struct net *net, unsigned int cmd, struct rtentry *rt)
628 {
629 	struct fib_config cfg;
630 	int err;
631 
632 	switch (cmd) {
633 	case SIOCADDRT:		/* Add a route */
634 	case SIOCDELRT:		/* Delete a route */
635 		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
636 			return -EPERM;
637 
638 		rtnl_net_lock(net);
639 		err = rtentry_to_fib_config(net, cmd, rt, &cfg);
640 		if (err == 0) {
641 			struct fib_table *tb;
642 
643 			if (cmd == SIOCDELRT) {
644 				tb = fib_get_table(net, cfg.fc_table);
645 				if (tb)
646 					err = fib_table_delete(net, tb, &cfg,
647 							       NULL);
648 				else
649 					err = -ESRCH;
650 			} else {
651 				tb = fib_new_table(net, cfg.fc_table);
652 				if (tb)
653 					err = fib_table_insert(net, tb,
654 							       &cfg, NULL);
655 				else
656 					err = -ENOBUFS;
657 			}
658 
659 			/* allocated by rtentry_to_fib_config() */
660 			kfree(cfg.fc_mx);
661 		}
662 		rtnl_net_unlock(net);
663 		return err;
664 	}
665 	return -EINVAL;
666 }
667 
668 const struct nla_policy rtm_ipv4_policy[RTA_MAX + 1] = {
669 	[RTA_UNSPEC]		= { .strict_start_type = RTA_DPORT + 1 },
670 	[RTA_DST]		= { .type = NLA_U32 },
671 	[RTA_SRC]		= { .type = NLA_U32 },
672 	[RTA_IIF]		= { .type = NLA_U32 },
673 	[RTA_OIF]		= { .type = NLA_U32 },
674 	[RTA_GATEWAY]		= { .type = NLA_U32 },
675 	[RTA_PRIORITY]		= { .type = NLA_U32 },
676 	[RTA_PREFSRC]		= { .type = NLA_U32 },
677 	[RTA_METRICS]		= { .type = NLA_NESTED },
678 	[RTA_MULTIPATH]		= { .len = sizeof(struct rtnexthop) },
679 	[RTA_FLOW]		= { .type = NLA_U32 },
680 	[RTA_ENCAP_TYPE]	= { .type = NLA_U16 },
681 	[RTA_ENCAP]		= { .type = NLA_NESTED },
682 	[RTA_UID]		= { .type = NLA_U32 },
683 	[RTA_MARK]		= { .type = NLA_U32 },
684 	[RTA_TABLE]		= { .type = NLA_U32 },
685 	[RTA_IP_PROTO]		= { .type = NLA_U8 },
686 	[RTA_SPORT]		= { .type = NLA_U16 },
687 	[RTA_DPORT]		= { .type = NLA_U16 },
688 	[RTA_NH_ID]		= { .type = NLA_U32 },
689 };
690 
691 int fib_gw_from_via(struct fib_config *cfg, struct nlattr *nla,
692 		    struct netlink_ext_ack *extack)
693 {
694 	struct rtvia *via;
695 	int alen;
696 
697 	if (nla_len(nla) < offsetof(struct rtvia, rtvia_addr)) {
698 		NL_SET_ERR_MSG(extack, "Invalid attribute length for RTA_VIA");
699 		return -EINVAL;
700 	}
701 
702 	via = nla_data(nla);
703 	alen = nla_len(nla) - offsetof(struct rtvia, rtvia_addr);
704 
705 	switch (via->rtvia_family) {
706 	case AF_INET:
707 		if (alen != sizeof(__be32)) {
708 			NL_SET_ERR_MSG(extack, "Invalid IPv4 address in RTA_VIA");
709 			return -EINVAL;
710 		}
711 		cfg->fc_gw_family = AF_INET;
712 		cfg->fc_gw4 = *((__be32 *)via->rtvia_addr);
713 		break;
714 	case AF_INET6:
715 #if IS_ENABLED(CONFIG_IPV6)
716 		if (alen != sizeof(struct in6_addr)) {
717 			NL_SET_ERR_MSG(extack, "Invalid IPv6 address in RTA_VIA");
718 			return -EINVAL;
719 		}
720 		cfg->fc_gw_family = AF_INET6;
721 		cfg->fc_gw6 = *((struct in6_addr *)via->rtvia_addr);
722 #else
723 		NL_SET_ERR_MSG(extack, "IPv6 support not enabled in kernel");
724 		return -EINVAL;
725 #endif
726 		break;
727 	default:
728 		NL_SET_ERR_MSG(extack, "Unsupported address family in RTA_VIA");
729 		return -EINVAL;
730 	}
731 
732 	return 0;
733 }
734 
735 static int rtm_to_fib_config(struct net *net, struct sk_buff *skb,
736 			     struct nlmsghdr *nlh, struct fib_config *cfg,
737 			     struct netlink_ext_ack *extack)
738 {
739 	bool has_gw = false, has_via = false;
740 	struct nlattr *attr;
741 	int err, remaining;
742 	struct rtmsg *rtm;
743 
744 	err = nlmsg_validate_deprecated(nlh, sizeof(*rtm), RTA_MAX,
745 					rtm_ipv4_policy, extack);
746 	if (err < 0)
747 		goto errout;
748 
749 	memset(cfg, 0, sizeof(*cfg));
750 
751 	rtm = nlmsg_data(nlh);
752 
753 	if (!inet_validate_dscp(rtm->rtm_tos)) {
754 		NL_SET_ERR_MSG(extack,
755 			       "Invalid dsfield (tos): ECN bits must be 0");
756 		err = -EINVAL;
757 		goto errout;
758 	}
759 	cfg->fc_dscp = inet_dsfield_to_dscp(rtm->rtm_tos);
760 
761 	cfg->fc_dst_len = rtm->rtm_dst_len;
762 	cfg->fc_table = rtm->rtm_table;
763 	cfg->fc_protocol = rtm->rtm_protocol;
764 	cfg->fc_scope = rtm->rtm_scope;
765 	cfg->fc_type = rtm->rtm_type;
766 	cfg->fc_flags = rtm->rtm_flags;
767 	cfg->fc_nlflags = nlh->nlmsg_flags;
768 
769 	cfg->fc_nlinfo.portid = NETLINK_CB(skb).portid;
770 	cfg->fc_nlinfo.nlh = nlh;
771 	cfg->fc_nlinfo.nl_net = net;
772 
773 	if (cfg->fc_type > RTN_MAX) {
774 		NL_SET_ERR_MSG(extack, "Invalid route type");
775 		err = -EINVAL;
776 		goto errout;
777 	}
778 
779 	nlmsg_for_each_attr(attr, nlh, sizeof(struct rtmsg), remaining) {
780 		switch (nla_type(attr)) {
781 		case RTA_DST:
782 			cfg->fc_dst = nla_get_be32(attr);
783 			break;
784 		case RTA_OIF:
785 			cfg->fc_oif = nla_get_u32(attr);
786 			break;
787 		case RTA_GATEWAY:
788 			has_gw = true;
789 			cfg->fc_gw4 = nla_get_be32(attr);
790 			if (cfg->fc_gw4)
791 				cfg->fc_gw_family = AF_INET;
792 			break;
793 		case RTA_VIA:
794 			has_via = true;
795 			err = fib_gw_from_via(cfg, attr, extack);
796 			if (err)
797 				goto errout;
798 			break;
799 		case RTA_PRIORITY:
800 			cfg->fc_priority = nla_get_u32(attr);
801 			break;
802 		case RTA_PREFSRC:
803 			cfg->fc_prefsrc = nla_get_be32(attr);
804 			break;
805 		case RTA_METRICS:
806 			cfg->fc_mx = nla_data(attr);
807 			cfg->fc_mx_len = nla_len(attr);
808 			break;
809 		case RTA_MULTIPATH:
810 			err = lwtunnel_valid_encap_type_attr(nla_data(attr),
811 							     nla_len(attr),
812 							     extack);
813 			if (err < 0)
814 				goto errout;
815 			cfg->fc_mp = nla_data(attr);
816 			cfg->fc_mp_len = nla_len(attr);
817 			break;
818 		case RTA_FLOW:
819 			cfg->fc_flow = nla_get_u32(attr);
820 			break;
821 		case RTA_TABLE:
822 			cfg->fc_table = nla_get_u32(attr);
823 			break;
824 		case RTA_ENCAP:
825 			cfg->fc_encap = attr;
826 			break;
827 		case RTA_ENCAP_TYPE:
828 			cfg->fc_encap_type = nla_get_u16(attr);
829 			err = lwtunnel_valid_encap_type(cfg->fc_encap_type,
830 							extack);
831 			if (err < 0)
832 				goto errout;
833 			break;
834 		case RTA_NH_ID:
835 			cfg->fc_nh_id = nla_get_u32(attr);
836 			break;
837 		}
838 	}
839 
840 	if (cfg->fc_dst_len > 32) {
841 		NL_SET_ERR_MSG(extack, "Invalid prefix length");
842 		err = -EINVAL;
843 		goto errout;
844 	}
845 
846 	if (cfg->fc_dst_len < 32 && (ntohl(cfg->fc_dst) << cfg->fc_dst_len)) {
847 		NL_SET_ERR_MSG(extack, "Invalid prefix for given prefix length");
848 		err = -EINVAL;
849 		goto errout;
850 	}
851 
852 	if (cfg->fc_nh_id) {
853 		if (cfg->fc_oif || cfg->fc_gw_family ||
854 		    cfg->fc_encap || cfg->fc_mp) {
855 			NL_SET_ERR_MSG(extack,
856 				       "Nexthop specification and nexthop id are mutually exclusive");
857 			err = -EINVAL;
858 			goto errout;
859 		}
860 	}
861 
862 	if (has_gw && has_via) {
863 		NL_SET_ERR_MSG(extack,
864 			       "Nexthop configuration can not contain both GATEWAY and VIA");
865 		err = -EINVAL;
866 		goto errout;
867 	}
868 
869 	if (!cfg->fc_table)
870 		cfg->fc_table = RT_TABLE_MAIN;
871 
872 	return 0;
873 errout:
874 	return err;
875 }
876 
877 static int inet_rtm_delroute(struct sk_buff *skb, struct nlmsghdr *nlh,
878 			     struct netlink_ext_ack *extack)
879 {
880 	struct net *net = sock_net(skb->sk);
881 	struct fib_config cfg;
882 	struct fib_table *tb;
883 	int err;
884 
885 	err = rtm_to_fib_config(net, skb, nlh, &cfg, extack);
886 	if (err < 0)
887 		goto errout;
888 
889 	rtnl_net_lock(net);
890 
891 	if (cfg.fc_nh_id && !nexthop_find_by_id(net, cfg.fc_nh_id)) {
892 		NL_SET_ERR_MSG(extack, "Nexthop id does not exist");
893 		err = -EINVAL;
894 		goto unlock;
895 	}
896 
897 	tb = fib_get_table(net, cfg.fc_table);
898 	if (!tb) {
899 		NL_SET_ERR_MSG(extack, "FIB table does not exist");
900 		err = -ESRCH;
901 		goto unlock;
902 	}
903 
904 	err = fib_table_delete(net, tb, &cfg, extack);
905 unlock:
906 	rtnl_net_unlock(net);
907 errout:
908 	return err;
909 }
910 
911 static int inet_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh,
912 			     struct netlink_ext_ack *extack)
913 {
914 	struct net *net = sock_net(skb->sk);
915 	struct fib_config cfg;
916 	struct fib_table *tb;
917 	int err;
918 
919 	err = rtm_to_fib_config(net, skb, nlh, &cfg, extack);
920 	if (err < 0)
921 		goto errout;
922 
923 	rtnl_net_lock(net);
924 
925 	tb = fib_new_table(net, cfg.fc_table);
926 	if (!tb) {
927 		err = -ENOBUFS;
928 		goto unlock;
929 	}
930 
931 	err = fib_table_insert(net, tb, &cfg, extack);
932 	if (!err && cfg.fc_type == RTN_LOCAL)
933 		net->ipv4.fib_has_custom_local_routes = true;
934 
935 unlock:
936 	rtnl_net_unlock(net);
937 errout:
938 	return err;
939 }
940 
941 int ip_valid_fib_dump_req(struct net *net, const struct nlmsghdr *nlh,
942 			  struct fib_dump_filter *filter,
943 			  struct netlink_callback *cb)
944 {
945 	struct netlink_ext_ack *extack = cb->extack;
946 	struct nlattr *tb[RTA_MAX + 1];
947 	struct rtmsg *rtm;
948 	int err, i;
949 
950 	rtm = nlmsg_payload(nlh, sizeof(*rtm));
951 	if (!rtm) {
952 		NL_SET_ERR_MSG(extack, "Invalid header for FIB dump request");
953 		return -EINVAL;
954 	}
955 
956 	if (rtm->rtm_dst_len || rtm->rtm_src_len  || rtm->rtm_tos   ||
957 	    rtm->rtm_scope) {
958 		NL_SET_ERR_MSG(extack, "Invalid values in header for FIB dump request");
959 		return -EINVAL;
960 	}
961 
962 	if (rtm->rtm_flags & ~(RTM_F_CLONED | RTM_F_PREFIX)) {
963 		NL_SET_ERR_MSG(extack, "Invalid flags for FIB dump request");
964 		return -EINVAL;
965 	}
966 	if (rtm->rtm_flags & RTM_F_CLONED)
967 		filter->dump_routes = false;
968 	else
969 		filter->dump_exceptions = false;
970 
971 	filter->flags    = rtm->rtm_flags;
972 	filter->protocol = rtm->rtm_protocol;
973 	filter->rt_type  = rtm->rtm_type;
974 	filter->table_id = rtm->rtm_table;
975 
976 	err = nlmsg_parse_deprecated_strict(nlh, sizeof(*rtm), tb, RTA_MAX,
977 					    rtm_ipv4_policy, extack);
978 	if (err < 0)
979 		return err;
980 
981 	for (i = 0; i <= RTA_MAX; ++i) {
982 		int ifindex;
983 
984 		if (!tb[i])
985 			continue;
986 
987 		switch (i) {
988 		case RTA_TABLE:
989 			filter->table_id = nla_get_u32(tb[i]);
990 			break;
991 		case RTA_OIF:
992 			ifindex = nla_get_u32(tb[i]);
993 
994 			filter->dev = dev_get_by_index_rcu(net, ifindex);
995 			if (!filter->dev)
996 				return -ENODEV;
997 			break;
998 		default:
999 			NL_SET_ERR_MSG(extack, "Unsupported attribute in dump request");
1000 			return -EINVAL;
1001 		}
1002 	}
1003 
1004 	if (filter->flags || filter->protocol || filter->rt_type ||
1005 	    filter->table_id || filter->dev) {
1006 		filter->filter_set = 1;
1007 		cb->answer_flags = NLM_F_DUMP_FILTERED;
1008 	}
1009 
1010 	return 0;
1011 }
1012 EXPORT_SYMBOL_GPL(ip_valid_fib_dump_req);
1013 
1014 static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
1015 {
1016 	const struct nlmsghdr *nlh = cb->nlh;
1017 	struct net *net = sock_net(skb->sk);
1018 	struct fib_dump_filter filter = {
1019 		.dump_routes = true,
1020 		.dump_exceptions = true,
1021 	};
1022 	unsigned int e = 0, s_e, h, s_h;
1023 	struct hlist_head *head;
1024 	int dumped = 0, err = 0;
1025 	struct fib_table *tb;
1026 
1027 	rcu_read_lock();
1028 	if (cb->strict_check) {
1029 		err = ip_valid_fib_dump_req(net, nlh, &filter, cb);
1030 		if (err < 0)
1031 			goto unlock;
1032 	} else if (nlmsg_len(nlh) >= sizeof(struct rtmsg)) {
1033 		struct rtmsg *rtm = nlmsg_data(nlh);
1034 
1035 		filter.flags = rtm->rtm_flags & (RTM_F_PREFIX | RTM_F_CLONED);
1036 	}
1037 
1038 	/* ipv4 does not use prefix flag */
1039 	if (filter.flags & RTM_F_PREFIX)
1040 		goto unlock;
1041 
1042 	if (filter.table_id) {
1043 		tb = fib_get_table(net, filter.table_id);
1044 		if (!tb) {
1045 			if (rtnl_msg_family(cb->nlh) != PF_INET)
1046 				goto unlock;
1047 
1048 			NL_SET_ERR_MSG(cb->extack, "ipv4: FIB table does not exist");
1049 			err = -ENOENT;
1050 			goto unlock;
1051 		}
1052 		err = fib_table_dump(tb, skb, cb, &filter);
1053 		goto unlock;
1054 	}
1055 
1056 	s_h = cb->args[0];
1057 	s_e = cb->args[1];
1058 
1059 	err = 0;
1060 	for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_e = 0) {
1061 		e = 0;
1062 		head = &net->ipv4.fib_table_hash[h];
1063 		hlist_for_each_entry_rcu(tb, head, tb_hlist) {
1064 			if (e < s_e)
1065 				goto next;
1066 			if (dumped)
1067 				memset(&cb->args[2], 0, sizeof(cb->args) -
1068 						 2 * sizeof(cb->args[0]));
1069 			err = fib_table_dump(tb, skb, cb, &filter);
1070 			if (err < 0)
1071 				goto out;
1072 			dumped = 1;
1073 next:
1074 			e++;
1075 		}
1076 	}
1077 out:
1078 
1079 	cb->args[1] = e;
1080 	cb->args[0] = h;
1081 
1082 unlock:
1083 	rcu_read_unlock();
1084 	return err;
1085 }
1086 
1087 /* Prepare and feed intra-kernel routing request.
1088  * Really, it should be netlink message, but :-( netlink
1089  * can be not configured, so that we feed it directly
1090  * to fib engine. It is legal, because all events occur
1091  * only when netlink is already locked.
1092  */
1093 static void fib_magic(int cmd, int type, __be32 dst, int dst_len,
1094 		      struct in_ifaddr *ifa, u32 rt_priority)
1095 {
1096 	struct net *net = dev_net(ifa->ifa_dev->dev);
1097 	u32 tb_id = l3mdev_fib_table(ifa->ifa_dev->dev);
1098 	struct fib_table *tb;
1099 	struct fib_config cfg = {
1100 		.fc_protocol = RTPROT_KERNEL,
1101 		.fc_type = type,
1102 		.fc_dst = dst,
1103 		.fc_dst_len = dst_len,
1104 		.fc_priority = rt_priority,
1105 		.fc_prefsrc = ifa->ifa_local,
1106 		.fc_oif = ifa->ifa_dev->dev->ifindex,
1107 		.fc_nlflags = NLM_F_CREATE | NLM_F_APPEND,
1108 		.fc_nlinfo = {
1109 			.nl_net = net,
1110 		},
1111 	};
1112 
1113 	if (!tb_id)
1114 		tb_id = (type == RTN_UNICAST) ? RT_TABLE_MAIN : RT_TABLE_LOCAL;
1115 
1116 	tb = fib_new_table(net, tb_id);
1117 	if (!tb)
1118 		return;
1119 
1120 	cfg.fc_table = tb->tb_id;
1121 
1122 	if (type != RTN_LOCAL)
1123 		cfg.fc_scope = RT_SCOPE_LINK;
1124 	else
1125 		cfg.fc_scope = RT_SCOPE_HOST;
1126 
1127 	if (cmd == RTM_NEWROUTE)
1128 		fib_table_insert(net, tb, &cfg, NULL);
1129 	else
1130 		fib_table_delete(net, tb, &cfg, NULL);
1131 }
1132 
1133 void fib_add_ifaddr(struct in_ifaddr *ifa)
1134 {
1135 	struct in_device *in_dev = ifa->ifa_dev;
1136 	struct net_device *dev = in_dev->dev;
1137 	struct in_ifaddr *prim = ifa;
1138 	__be32 mask = ifa->ifa_mask;
1139 	__be32 addr = ifa->ifa_local;
1140 	__be32 prefix = ifa->ifa_address & mask;
1141 
1142 	if (ifa->ifa_flags & IFA_F_SECONDARY) {
1143 		prim = inet_ifa_byprefix(in_dev, prefix, mask);
1144 		if (!prim) {
1145 			pr_warn("%s: bug: prim == NULL\n", __func__);
1146 			return;
1147 		}
1148 	}
1149 
1150 	fib_magic(RTM_NEWROUTE, RTN_LOCAL, addr, 32, prim, 0);
1151 
1152 	if (!(dev->flags & IFF_UP))
1153 		return;
1154 
1155 	/* Add broadcast address, if it is explicitly assigned. */
1156 	if (ifa->ifa_broadcast && ifa->ifa_broadcast != htonl(0xFFFFFFFF)) {
1157 		fib_magic(RTM_NEWROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32,
1158 			  prim, 0);
1159 		arp_invalidate(dev, ifa->ifa_broadcast, false);
1160 	}
1161 
1162 	if (!ipv4_is_zeronet(prefix) && !(ifa->ifa_flags & IFA_F_SECONDARY) &&
1163 	    (prefix != addr || ifa->ifa_prefixlen < 32)) {
1164 		if (!(ifa->ifa_flags & IFA_F_NOPREFIXROUTE))
1165 			fib_magic(RTM_NEWROUTE,
1166 				  dev->flags & IFF_LOOPBACK ? RTN_LOCAL : RTN_UNICAST,
1167 				  prefix, ifa->ifa_prefixlen, prim,
1168 				  ifa->ifa_rt_priority);
1169 
1170 		/* Add the network broadcast address, when it makes sense */
1171 		if (ifa->ifa_prefixlen < 31) {
1172 			fib_magic(RTM_NEWROUTE, RTN_BROADCAST, prefix | ~mask,
1173 				  32, prim, 0);
1174 			arp_invalidate(dev, prefix | ~mask, false);
1175 		}
1176 	}
1177 }
1178 
1179 void fib_modify_prefix_metric(struct in_ifaddr *ifa, u32 new_metric)
1180 {
1181 	__be32 prefix = ifa->ifa_address & ifa->ifa_mask;
1182 	struct in_device *in_dev = ifa->ifa_dev;
1183 	struct net_device *dev = in_dev->dev;
1184 
1185 	if (!(dev->flags & IFF_UP) ||
1186 	    ifa->ifa_flags & (IFA_F_SECONDARY | IFA_F_NOPREFIXROUTE) ||
1187 	    ipv4_is_zeronet(prefix) ||
1188 	    (prefix == ifa->ifa_local && ifa->ifa_prefixlen == 32))
1189 		return;
1190 
1191 	/* add the new */
1192 	fib_magic(RTM_NEWROUTE,
1193 		  dev->flags & IFF_LOOPBACK ? RTN_LOCAL : RTN_UNICAST,
1194 		  prefix, ifa->ifa_prefixlen, ifa, new_metric);
1195 
1196 	/* delete the old */
1197 	fib_magic(RTM_DELROUTE,
1198 		  dev->flags & IFF_LOOPBACK ? RTN_LOCAL : RTN_UNICAST,
1199 		  prefix, ifa->ifa_prefixlen, ifa, ifa->ifa_rt_priority);
1200 }
1201 
1202 /* Delete primary or secondary address.
1203  * Optionally, on secondary address promotion consider the addresses
1204  * from subnet iprim as deleted, even if they are in device list.
1205  * In this case the secondary ifa can be in device list.
1206  */
1207 void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim)
1208 {
1209 	struct in_device *in_dev = ifa->ifa_dev;
1210 	struct net_device *dev = in_dev->dev;
1211 	struct in_ifaddr *ifa1;
1212 	struct in_ifaddr *prim = ifa, *prim1 = NULL;
1213 	__be32 brd = ifa->ifa_address | ~ifa->ifa_mask;
1214 	__be32 any = ifa->ifa_address & ifa->ifa_mask;
1215 #define LOCAL_OK	1
1216 #define BRD_OK		2
1217 #define BRD0_OK		4
1218 #define BRD1_OK		8
1219 	unsigned int ok = 0;
1220 	int subnet = 0;		/* Primary network */
1221 	int gone = 1;		/* Address is missing */
1222 	int same_prefsrc = 0;	/* Another primary with same IP */
1223 
1224 	if (ifa->ifa_flags & IFA_F_SECONDARY) {
1225 		prim = inet_ifa_byprefix(in_dev, any, ifa->ifa_mask);
1226 		if (!prim) {
1227 			/* if the device has been deleted, we don't perform
1228 			 * address promotion
1229 			 */
1230 			if (!in_dev->dead)
1231 				pr_warn("%s: bug: prim == NULL\n", __func__);
1232 			return;
1233 		}
1234 		if (iprim && iprim != prim) {
1235 			pr_warn("%s: bug: iprim != prim\n", __func__);
1236 			return;
1237 		}
1238 	} else if (!ipv4_is_zeronet(any) &&
1239 		   (any != ifa->ifa_local || ifa->ifa_prefixlen < 32)) {
1240 		if (!(ifa->ifa_flags & IFA_F_NOPREFIXROUTE))
1241 			fib_magic(RTM_DELROUTE,
1242 				  dev->flags & IFF_LOOPBACK ? RTN_LOCAL : RTN_UNICAST,
1243 				  any, ifa->ifa_prefixlen, prim, 0);
1244 		subnet = 1;
1245 	}
1246 
1247 	if (in_dev->dead)
1248 		goto no_promotions;
1249 
1250 	/* Deletion is more complicated than add.
1251 	 * We should take care of not to delete too much :-)
1252 	 *
1253 	 * Scan address list to be sure that addresses are really gone.
1254 	 */
1255 	rcu_read_lock();
1256 	in_dev_for_each_ifa_rcu(ifa1, in_dev) {
1257 		if (ifa1 == ifa) {
1258 			/* promotion, keep the IP */
1259 			gone = 0;
1260 			continue;
1261 		}
1262 		/* Ignore IFAs from our subnet */
1263 		if (iprim && ifa1->ifa_mask == iprim->ifa_mask &&
1264 		    inet_ifa_match(ifa1->ifa_address, iprim))
1265 			continue;
1266 
1267 		/* Ignore ifa1 if it uses different primary IP (prefsrc) */
1268 		if (ifa1->ifa_flags & IFA_F_SECONDARY) {
1269 			/* Another address from our subnet? */
1270 			if (ifa1->ifa_mask == prim->ifa_mask &&
1271 			    inet_ifa_match(ifa1->ifa_address, prim))
1272 				prim1 = prim;
1273 			else {
1274 				/* We reached the secondaries, so
1275 				 * same_prefsrc should be determined.
1276 				 */
1277 				if (!same_prefsrc)
1278 					continue;
1279 				/* Search new prim1 if ifa1 is not
1280 				 * using the current prim1
1281 				 */
1282 				if (!prim1 ||
1283 				    ifa1->ifa_mask != prim1->ifa_mask ||
1284 				    !inet_ifa_match(ifa1->ifa_address, prim1))
1285 					prim1 = inet_ifa_byprefix(in_dev,
1286 							ifa1->ifa_address,
1287 							ifa1->ifa_mask);
1288 				if (!prim1)
1289 					continue;
1290 				if (prim1->ifa_local != prim->ifa_local)
1291 					continue;
1292 			}
1293 		} else {
1294 			if (prim->ifa_local != ifa1->ifa_local)
1295 				continue;
1296 			prim1 = ifa1;
1297 			if (prim != prim1)
1298 				same_prefsrc = 1;
1299 		}
1300 		if (ifa->ifa_local == ifa1->ifa_local)
1301 			ok |= LOCAL_OK;
1302 		if (ifa->ifa_broadcast == ifa1->ifa_broadcast)
1303 			ok |= BRD_OK;
1304 		if (brd == ifa1->ifa_broadcast)
1305 			ok |= BRD1_OK;
1306 		if (any == ifa1->ifa_broadcast)
1307 			ok |= BRD0_OK;
1308 		/* primary has network specific broadcasts */
1309 		if (prim1 == ifa1 && ifa1->ifa_prefixlen < 31) {
1310 			__be32 brd1 = ifa1->ifa_address | ~ifa1->ifa_mask;
1311 			__be32 any1 = ifa1->ifa_address & ifa1->ifa_mask;
1312 
1313 			if (!ipv4_is_zeronet(any1)) {
1314 				if (ifa->ifa_broadcast == brd1 ||
1315 				    ifa->ifa_broadcast == any1)
1316 					ok |= BRD_OK;
1317 				if (brd == brd1 || brd == any1)
1318 					ok |= BRD1_OK;
1319 				if (any == brd1 || any == any1)
1320 					ok |= BRD0_OK;
1321 			}
1322 		}
1323 	}
1324 	rcu_read_unlock();
1325 
1326 no_promotions:
1327 	if (!(ok & BRD_OK))
1328 		fib_magic(RTM_DELROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32,
1329 			  prim, 0);
1330 	if (subnet && ifa->ifa_prefixlen < 31) {
1331 		if (!(ok & BRD1_OK))
1332 			fib_magic(RTM_DELROUTE, RTN_BROADCAST, brd, 32,
1333 				  prim, 0);
1334 		if (!(ok & BRD0_OK))
1335 			fib_magic(RTM_DELROUTE, RTN_BROADCAST, any, 32,
1336 				  prim, 0);
1337 	}
1338 	if (!(ok & LOCAL_OK)) {
1339 		unsigned int addr_type;
1340 
1341 		fib_magic(RTM_DELROUTE, RTN_LOCAL, ifa->ifa_local, 32, prim, 0);
1342 
1343 		/* Check, that this local address finally disappeared. */
1344 		addr_type = inet_addr_type_dev_table(dev_net(dev), dev,
1345 						     ifa->ifa_local);
1346 		if (gone && addr_type != RTN_LOCAL) {
1347 			/* And the last, but not the least thing.
1348 			 * We must flush stray FIB entries.
1349 			 *
1350 			 * First of all, we scan fib_info list searching
1351 			 * for stray nexthop entries, then ignite fib_flush.
1352 			 */
1353 			if (fib_sync_down_addr(dev, ifa->ifa_local))
1354 				fib_flush(dev_net(dev));
1355 		}
1356 	}
1357 #undef LOCAL_OK
1358 #undef BRD_OK
1359 #undef BRD0_OK
1360 #undef BRD1_OK
1361 }
1362 
1363 static void nl_fib_lookup(struct net *net, struct fib_result_nl *frn)
1364 {
1365 
1366 	struct fib_result       res;
1367 	struct flowi4           fl4 = {
1368 		.flowi4_mark = frn->fl_mark,
1369 		.daddr = frn->fl_addr,
1370 		.flowi4_dscp = inet_dsfield_to_dscp(frn->fl_tos),
1371 		.flowi4_scope = frn->fl_scope,
1372 	};
1373 	struct fib_table *tb;
1374 
1375 	rcu_read_lock();
1376 
1377 	tb = fib_get_table(net, frn->tb_id_in);
1378 
1379 	frn->err = -ENOENT;
1380 	if (tb) {
1381 		local_bh_disable();
1382 
1383 		frn->tb_id = tb->tb_id;
1384 		frn->err = fib_table_lookup(tb, &fl4, &res, FIB_LOOKUP_NOREF);
1385 
1386 		if (!frn->err) {
1387 			frn->prefixlen = res.prefixlen;
1388 			frn->nh_sel = res.nh_sel;
1389 			frn->type = res.type;
1390 			frn->scope = res.scope;
1391 		}
1392 		local_bh_enable();
1393 	}
1394 
1395 	rcu_read_unlock();
1396 }
1397 
1398 static void nl_fib_input(struct sk_buff *skb)
1399 {
1400 	struct net *net;
1401 	struct fib_result_nl *frn;
1402 	struct nlmsghdr *nlh;
1403 	u32 portid;
1404 
1405 	net = sock_net(skb->sk);
1406 	nlh = nlmsg_hdr(skb);
1407 	if (skb->len < nlmsg_total_size(sizeof(*frn)) ||
1408 	    skb->len < nlh->nlmsg_len ||
1409 	    nlmsg_len(nlh) < sizeof(*frn))
1410 		return;
1411 
1412 	skb = netlink_skb_clone(skb, GFP_KERNEL);
1413 	if (!skb)
1414 		return;
1415 	nlh = nlmsg_hdr(skb);
1416 
1417 	frn = nlmsg_data(nlh);
1418 	nl_fib_lookup(net, frn);
1419 
1420 	portid = NETLINK_CB(skb).portid;      /* netlink portid */
1421 	NETLINK_CB(skb).portid = 0;        /* from kernel */
1422 	NETLINK_CB(skb).dst_group = 0;  /* unicast */
1423 	nlmsg_unicast(net->ipv4.fibnl, skb, portid);
1424 }
1425 
1426 static int __net_init nl_fib_lookup_init(struct net *net)
1427 {
1428 	struct sock *sk;
1429 	struct netlink_kernel_cfg cfg = {
1430 		.input	= nl_fib_input,
1431 	};
1432 
1433 	sk = netlink_kernel_create(net, NETLINK_FIB_LOOKUP, &cfg);
1434 	if (!sk)
1435 		return -EAFNOSUPPORT;
1436 	net->ipv4.fibnl = sk;
1437 	return 0;
1438 }
1439 
1440 static void nl_fib_lookup_exit(struct net *net)
1441 {
1442 	netlink_kernel_release(net->ipv4.fibnl);
1443 	net->ipv4.fibnl = NULL;
1444 }
1445 
1446 static void fib_disable_ip(struct net_device *dev, unsigned long event,
1447 			   bool force)
1448 {
1449 	if (fib_sync_down_dev(dev, event, force))
1450 		fib_flush(dev_net(dev));
1451 	else
1452 		rt_cache_flush(dev_net(dev));
1453 	arp_ifdown(dev);
1454 }
1455 
1456 static int fib_inetaddr_event(struct notifier_block *this, unsigned long event, void *ptr)
1457 {
1458 	struct in_ifaddr *ifa = ptr;
1459 	struct net_device *dev = ifa->ifa_dev->dev;
1460 	struct net *net = dev_net(dev);
1461 
1462 	switch (event) {
1463 	case NETDEV_UP:
1464 		fib_add_ifaddr(ifa);
1465 #ifdef CONFIG_IP_ROUTE_MULTIPATH
1466 		fib_sync_up(dev, RTNH_F_DEAD);
1467 #endif
1468 		atomic_inc(&net->ipv4.dev_addr_genid);
1469 		rt_cache_flush(net);
1470 		break;
1471 	case NETDEV_DOWN:
1472 		fib_del_ifaddr(ifa, NULL);
1473 		atomic_inc(&net->ipv4.dev_addr_genid);
1474 		if (!ifa->ifa_dev->ifa_list) {
1475 			/* Last address was deleted from this interface.
1476 			 * Disable IP.
1477 			 */
1478 			fib_disable_ip(dev, event, true);
1479 		} else {
1480 			rt_cache_flush(net);
1481 		}
1482 		break;
1483 	}
1484 	return NOTIFY_DONE;
1485 }
1486 
1487 static int fib_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1488 {
1489 	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1490 	struct netdev_notifier_changeupper_info *upper_info = ptr;
1491 	struct netdev_notifier_info_ext *info_ext = ptr;
1492 	struct in_device *in_dev;
1493 	struct net *net = dev_net(dev);
1494 	struct in_ifaddr *ifa;
1495 	unsigned int flags;
1496 
1497 	if (event == NETDEV_UNREGISTER) {
1498 		fib_disable_ip(dev, event, true);
1499 		rt_flush_dev(dev);
1500 		return NOTIFY_DONE;
1501 	}
1502 
1503 	in_dev = __in_dev_get_rtnl(dev);
1504 	if (!in_dev)
1505 		return NOTIFY_DONE;
1506 
1507 	switch (event) {
1508 	case NETDEV_UP:
1509 		in_dev_for_each_ifa_rtnl(ifa, in_dev) {
1510 			fib_add_ifaddr(ifa);
1511 		}
1512 #ifdef CONFIG_IP_ROUTE_MULTIPATH
1513 		fib_sync_up(dev, RTNH_F_DEAD);
1514 #endif
1515 		atomic_inc(&net->ipv4.dev_addr_genid);
1516 		rt_cache_flush(net);
1517 		break;
1518 	case NETDEV_DOWN:
1519 		fib_disable_ip(dev, event, false);
1520 		break;
1521 	case NETDEV_CHANGE:
1522 		flags = netif_get_flags(dev);
1523 		if (flags & (IFF_RUNNING | IFF_LOWER_UP))
1524 			fib_sync_up(dev, RTNH_F_LINKDOWN);
1525 		else
1526 			fib_sync_down_dev(dev, event, false);
1527 		rt_cache_flush(net);
1528 		break;
1529 	case NETDEV_CHANGEMTU:
1530 		fib_sync_mtu(dev, info_ext->ext.mtu);
1531 		rt_cache_flush(net);
1532 		break;
1533 	case NETDEV_CHANGEUPPER:
1534 		upper_info = ptr;
1535 		/* flush all routes if dev is linked to or unlinked from
1536 		 * an L3 master device (e.g., VRF)
1537 		 */
1538 		if (upper_info->upper_dev &&
1539 		    netif_is_l3_master(upper_info->upper_dev))
1540 			fib_disable_ip(dev, NETDEV_DOWN, true);
1541 		break;
1542 	}
1543 	return NOTIFY_DONE;
1544 }
1545 
1546 static struct notifier_block fib_inetaddr_notifier = {
1547 	.notifier_call = fib_inetaddr_event,
1548 };
1549 
1550 static struct notifier_block fib_netdev_notifier = {
1551 	.notifier_call = fib_netdev_event,
1552 };
1553 
1554 static int __net_init ip_fib_net_init(struct net *net)
1555 {
1556 	int err;
1557 	size_t size = sizeof(struct hlist_head) * FIB_TABLE_HASHSZ;
1558 
1559 	err = fib4_notifier_init(net);
1560 	if (err)
1561 		return err;
1562 
1563 #ifdef CONFIG_IP_ROUTE_MULTIPATH
1564 	/* Default to 3-tuple */
1565 	net->ipv4.sysctl_fib_multipath_hash_fields =
1566 		FIB_MULTIPATH_HASH_FIELD_DEFAULT_MASK;
1567 #endif
1568 
1569 	/* Avoid false sharing : Use at least a full cache line */
1570 	size = max_t(size_t, size, L1_CACHE_BYTES);
1571 
1572 	net->ipv4.fib_table_hash = kzalloc(size, GFP_KERNEL);
1573 	if (!net->ipv4.fib_table_hash) {
1574 		err = -ENOMEM;
1575 		goto err_table_hash_alloc;
1576 	}
1577 
1578 	err = fib4_rules_init(net);
1579 	if (err < 0)
1580 		goto err_rules_init;
1581 	return 0;
1582 
1583 err_rules_init:
1584 	kfree(net->ipv4.fib_table_hash);
1585 err_table_hash_alloc:
1586 	fib4_notifier_exit(net);
1587 	return err;
1588 }
1589 
1590 static void ip_fib_net_exit(struct net *net)
1591 {
1592 	int i;
1593 
1594 	ASSERT_RTNL_NET(net);
1595 #ifdef CONFIG_IP_MULTIPLE_TABLES
1596 	RCU_INIT_POINTER(net->ipv4.fib_main, NULL);
1597 	RCU_INIT_POINTER(net->ipv4.fib_default, NULL);
1598 #endif
1599 	/* Destroy the tables in reverse order to guarantee that the
1600 	 * local table, ID 255, is destroyed before the main table, ID
1601 	 * 254. This is necessary as the local table may contain
1602 	 * references to data contained in the main table.
1603 	 */
1604 	for (i = FIB_TABLE_HASHSZ - 1; i >= 0; i--) {
1605 		struct hlist_head *head = &net->ipv4.fib_table_hash[i];
1606 		struct hlist_node *tmp;
1607 		struct fib_table *tb;
1608 
1609 		hlist_for_each_entry_safe(tb, tmp, head, tb_hlist) {
1610 			hlist_del_rcu(&tb->tb_hlist);
1611 			fib_table_flush(net, tb, true);
1612 			fib_free_table(tb);
1613 		}
1614 	}
1615 
1616 #ifdef CONFIG_IP_MULTIPLE_TABLES
1617 	fib4_rules_exit(net);
1618 #endif
1619 }
1620 
1621 static int __net_init fib_net_init(struct net *net)
1622 {
1623 	int error;
1624 
1625 #ifdef CONFIG_IP_ROUTE_CLASSID
1626 	atomic_set(&net->ipv4.fib_num_tclassid_users, 0);
1627 #endif
1628 	error = ip_fib_net_init(net);
1629 	if (error < 0)
1630 		goto out;
1631 
1632 	error = fib4_semantics_init(net);
1633 	if (error)
1634 		goto out_semantics;
1635 
1636 	error = nl_fib_lookup_init(net);
1637 	if (error < 0)
1638 		goto out_nlfl;
1639 
1640 	error = fib_proc_init(net);
1641 	if (error < 0)
1642 		goto out_proc;
1643 out:
1644 	return error;
1645 
1646 out_proc:
1647 	nl_fib_lookup_exit(net);
1648 out_nlfl:
1649 	fib4_semantics_exit(net);
1650 out_semantics:
1651 	rtnl_net_lock(net);
1652 	ip_fib_net_exit(net);
1653 	rtnl_net_unlock(net);
1654 
1655 	kfree(net->ipv4.fib_table_hash);
1656 	fib4_notifier_exit(net);
1657 	goto out;
1658 }
1659 
1660 static void __net_exit fib_net_pre_exit(struct net *net)
1661 {
1662 	fib_proc_exit(net);
1663 	nl_fib_lookup_exit(net);
1664 }
1665 
1666 static void __net_exit fib_net_exit_rtnl(struct net *net,
1667 					 struct list_head *dev_kill_list)
1668 {
1669 	ip_fib_net_exit(net);
1670 }
1671 
1672 static void __net_exit fib_net_exit(struct net *net)
1673 {
1674 	kfree(net->ipv4.fib_table_hash);
1675 	fib4_notifier_exit(net);
1676 	fib4_semantics_exit(net);
1677 }
1678 
1679 static struct pernet_operations fib_net_ops = {
1680 	.init = fib_net_init,
1681 	.pre_exit = fib_net_pre_exit,
1682 	.exit_rtnl = fib_net_exit_rtnl,
1683 	.exit = fib_net_exit,
1684 };
1685 
1686 static const struct rtnl_msg_handler fib_rtnl_msg_handlers[] __initconst = {
1687 	{.protocol = PF_INET, .msgtype = RTM_NEWROUTE,
1688 	 .doit = inet_rtm_newroute, .flags = RTNL_FLAG_DOIT_PERNET},
1689 	{.protocol = PF_INET, .msgtype = RTM_DELROUTE,
1690 	 .doit = inet_rtm_delroute, .flags = RTNL_FLAG_DOIT_PERNET},
1691 	{.protocol = PF_INET, .msgtype = RTM_GETROUTE, .dumpit = inet_dump_fib,
1692 	 .flags = RTNL_FLAG_DUMP_UNLOCKED | RTNL_FLAG_DUMP_SPLIT_NLM_DONE},
1693 };
1694 
1695 void __init ip_fib_init(void)
1696 {
1697 	fib_trie_init();
1698 
1699 	register_pernet_subsys(&fib_net_ops);
1700 
1701 	register_netdevice_notifier(&fib_netdev_notifier);
1702 	register_inetaddr_notifier(&fib_inetaddr_notifier);
1703 
1704 	rtnl_register_many(fib_rtnl_msg_handlers);
1705 }
1706