1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * INET An implementation of the TCP/IP protocol suite for the LINUX 4 * operating system. INET is implemented using the BSD Socket 5 * interface as the means of communication with the user level. 6 * 7 * IPv4 Forwarding Information Base: FIB frontend. 8 * 9 * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru> 10 */ 11 12 #include <linux/module.h> 13 #include <linux/uaccess.h> 14 #include <linux/bitops.h> 15 #include <linux/capability.h> 16 #include <linux/types.h> 17 #include <linux/kernel.h> 18 #include <linux/mm.h> 19 #include <linux/string.h> 20 #include <linux/socket.h> 21 #include <linux/sockios.h> 22 #include <linux/errno.h> 23 #include <linux/in.h> 24 #include <linux/inet.h> 25 #include <linux/inetdevice.h> 26 #include <linux/netdevice.h> 27 #include <linux/if_addr.h> 28 #include <linux/if_arp.h> 29 #include <linux/skbuff.h> 30 #include <linux/cache.h> 31 #include <linux/init.h> 32 #include <linux/list.h> 33 #include <linux/slab.h> 34 35 #include <net/flow.h> 36 #include <net/inet_dscp.h> 37 #include <net/ip.h> 38 #include <net/protocol.h> 39 #include <net/route.h> 40 #include <net/tcp.h> 41 #include <net/sock.h> 42 #include <net/arp.h> 43 #include <net/ip_fib.h> 44 #include <net/nexthop.h> 45 #include <net/rtnetlink.h> 46 #include <net/xfrm.h> 47 #include <net/l3mdev.h> 48 #include <net/lwtunnel.h> 49 #include <trace/events/fib.h> 50 51 #ifndef CONFIG_IP_MULTIPLE_TABLES 52 53 static int __net_init fib4_rules_init(struct net *net) 54 { 55 struct fib_table *local_table, *main_table; 56 57 main_table = fib_trie_table(RT_TABLE_MAIN, NULL); 58 if (!main_table) 59 return -ENOMEM; 60 61 local_table = fib_trie_table(RT_TABLE_LOCAL, main_table); 62 if (!local_table) 63 goto fail; 64 65 hlist_add_head_rcu(&local_table->tb_hlist, 66 &net->ipv4.fib_table_hash[TABLE_LOCAL_INDEX]); 67 hlist_add_head_rcu(&main_table->tb_hlist, 68 &net->ipv4.fib_table_hash[TABLE_MAIN_INDEX]); 69 return 0; 70 71 fail: 72 fib_free_table(main_table); 73 return -ENOMEM; 74 } 75 #else 76 77 struct fib_table *fib_new_table(struct net *net, u32 id) 78 { 79 struct fib_table *tb, *new_tb, *alias = NULL; 80 unsigned int h; 81 82 if (id == 0) 83 id = RT_TABLE_MAIN; 84 tb = fib_get_table(net, id); 85 if (tb) 86 return tb; 87 88 if (!check_net(net)) 89 return NULL; 90 91 if (id == RT_TABLE_LOCAL && !net->ipv4.fib_has_custom_rules) 92 alias = fib_new_table(net, RT_TABLE_MAIN); 93 94 new_tb = fib_trie_table(id, alias); 95 if (!new_tb) 96 return NULL; 97 98 spin_lock(&net->ipv4.fib_table_hash_lock); 99 100 tb = fib_get_table(net, id); 101 if (tb) { 102 spin_unlock(&net->ipv4.fib_table_hash_lock); 103 fib_free_table(new_tb); 104 return tb; 105 } 106 107 tb = new_tb; 108 109 switch (id) { 110 case RT_TABLE_MAIN: 111 rcu_assign_pointer(net->ipv4.fib_main, tb); 112 break; 113 case RT_TABLE_DEFAULT: 114 rcu_assign_pointer(net->ipv4.fib_default, tb); 115 break; 116 default: 117 break; 118 } 119 120 h = id & (FIB_TABLE_HASHSZ - 1); 121 hlist_add_head_rcu(&tb->tb_hlist, &net->ipv4.fib_table_hash[h]); 122 123 spin_unlock(&net->ipv4.fib_table_hash_lock); 124 125 return tb; 126 } 127 EXPORT_SYMBOL_GPL(fib_new_table); 128 129 struct fib_table *fib_get_table(struct net *net, u32 id) 130 { 131 struct fib_table *tb = NULL; 132 struct hlist_head *head; 133 unsigned int h; 134 135 if (id == 0) 136 id = RT_TABLE_MAIN; 137 h = id & (FIB_TABLE_HASHSZ - 1); 138 head = &net->ipv4.fib_table_hash[h]; 139 140 /* fib_table is not destroyed until ip_fib_net_exit() 141 * except for the merged main/local table. 142 * fib_unmerge() is called under RTNL, so other readers 143 * under RTNL (e.g. fib_flush(), fib_info_notify_update()) 144 * can safely traverse the list with rcu_dereference_raw(). 145 */ 146 hlist_for_each_entry_rcu(tb, head, tb_hlist, true) 147 if (tb->tb_id == id) 148 break; 149 150 return tb; 151 } 152 #endif /* CONFIG_IP_MULTIPLE_TABLES */ 153 154 static void fib_replace_table(struct net *net, struct fib_table *old, 155 struct fib_table *new) 156 { 157 #ifdef CONFIG_IP_MULTIPLE_TABLES 158 switch (new->tb_id) { 159 case RT_TABLE_MAIN: 160 rcu_assign_pointer(net->ipv4.fib_main, new); 161 break; 162 case RT_TABLE_DEFAULT: 163 rcu_assign_pointer(net->ipv4.fib_default, new); 164 break; 165 default: 166 break; 167 } 168 169 #endif 170 /* replace the old table in the hlist */ 171 hlist_replace_rcu(&old->tb_hlist, &new->tb_hlist); 172 } 173 174 int fib_unmerge(struct net *net) 175 { 176 struct fib_table *old, *new, *main_table; 177 178 /* attempt to fetch local table if it has been allocated */ 179 old = fib_get_table(net, RT_TABLE_LOCAL); 180 if (!old) 181 return 0; 182 183 new = fib_trie_unmerge(old); 184 if (!new) 185 return -ENOMEM; 186 187 /* table is already unmerged */ 188 if (new == old) 189 return 0; 190 191 /* replace merged table with clean table */ 192 fib_replace_table(net, old, new); 193 fib_free_table(old); 194 195 /* attempt to fetch main table if it has been allocated */ 196 main_table = fib_get_table(net, RT_TABLE_MAIN); 197 if (!main_table) 198 return 0; 199 200 /* flush local entries from main table */ 201 fib_table_flush_external(main_table); 202 203 return 0; 204 } 205 206 void fib_flush(struct net *net) 207 { 208 int flushed = 0; 209 unsigned int h; 210 211 for (h = 0; h < FIB_TABLE_HASHSZ; h++) { 212 struct hlist_head *head = &net->ipv4.fib_table_hash[h]; 213 struct fib_table *tb; 214 215 hlist_for_each_entry_rcu(tb, head, tb_hlist, true) 216 flushed += fib_table_flush(net, tb, false); 217 } 218 219 if (flushed) 220 rt_cache_flush(net); 221 } 222 223 /* 224 * Find address type as if only "dev" was present in the system. If 225 * on_dev is NULL then all interfaces are taken into consideration. 226 */ 227 static inline unsigned int __inet_dev_addr_type(struct net *net, 228 const struct net_device *dev, 229 __be32 addr, u32 tb_id) 230 { 231 struct flowi4 fl4 = { .daddr = addr }; 232 struct fib_result res; 233 unsigned int ret = RTN_BROADCAST; 234 struct fib_table *table; 235 236 if (ipv4_is_zeronet(addr) || ipv4_is_lbcast(addr)) 237 return RTN_BROADCAST; 238 if (ipv4_is_multicast(addr)) 239 return RTN_MULTICAST; 240 241 rcu_read_lock(); 242 243 table = fib_get_table(net, tb_id); 244 if (table) { 245 ret = RTN_UNICAST; 246 if (!fib_table_lookup(table, &fl4, &res, FIB_LOOKUP_NOREF)) { 247 struct fib_nh_common *nhc = fib_info_nhc(res.fi, 0); 248 249 if (!dev || dev == nhc->nhc_dev) 250 ret = res.type; 251 } 252 } 253 254 rcu_read_unlock(); 255 return ret; 256 } 257 258 unsigned int inet_addr_type_table(struct net *net, __be32 addr, u32 tb_id) 259 { 260 return __inet_dev_addr_type(net, NULL, addr, tb_id); 261 } 262 EXPORT_SYMBOL(inet_addr_type_table); 263 264 unsigned int inet_addr_type(struct net *net, __be32 addr) 265 { 266 return __inet_dev_addr_type(net, NULL, addr, RT_TABLE_LOCAL); 267 } 268 EXPORT_SYMBOL(inet_addr_type); 269 270 unsigned int inet_dev_addr_type(struct net *net, const struct net_device *dev, 271 __be32 addr) 272 { 273 u32 rt_table = l3mdev_fib_table(dev) ? : RT_TABLE_LOCAL; 274 275 return __inet_dev_addr_type(net, dev, addr, rt_table); 276 } 277 EXPORT_SYMBOL(inet_dev_addr_type); 278 279 /* inet_addr_type with dev == NULL but using the table from a dev 280 * if one is associated 281 */ 282 unsigned int inet_addr_type_dev_table(struct net *net, 283 const struct net_device *dev, 284 __be32 addr) 285 { 286 u32 rt_table = l3mdev_fib_table(dev) ? : RT_TABLE_LOCAL; 287 288 return __inet_dev_addr_type(net, NULL, addr, rt_table); 289 } 290 EXPORT_SYMBOL(inet_addr_type_dev_table); 291 292 __be32 fib_compute_spec_dst(struct sk_buff *skb) 293 { 294 struct net_device *dev = skb->dev; 295 struct in_device *in_dev; 296 struct fib_result res; 297 struct rtable *rt; 298 struct net *net; 299 int scope; 300 301 rt = skb_rtable(skb); 302 if ((rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST | RTCF_LOCAL)) == 303 RTCF_LOCAL) 304 return ip_hdr(skb)->daddr; 305 306 in_dev = __in_dev_get_rcu(dev); 307 308 net = dev_net(dev); 309 310 scope = RT_SCOPE_UNIVERSE; 311 if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) { 312 bool vmark = in_dev && IN_DEV_SRC_VMARK(in_dev); 313 struct flowi4 fl4 = { 314 .flowi4_iif = LOOPBACK_IFINDEX, 315 .flowi4_l3mdev = l3mdev_master_ifindex_rcu(dev), 316 .daddr = ip_hdr(skb)->saddr, 317 .flowi4_dscp = ip4h_dscp(ip_hdr(skb)), 318 .flowi4_scope = scope, 319 .flowi4_mark = vmark ? skb->mark : 0, 320 }; 321 if (!fib_lookup(net, &fl4, &res, 0)) 322 return fib_result_prefsrc(net, &res); 323 } else { 324 scope = RT_SCOPE_LINK; 325 } 326 327 return inet_select_addr(dev, ip_hdr(skb)->saddr, scope); 328 } 329 330 bool fib_info_nh_uses_dev(struct fib_info *fi, const struct net_device *dev) 331 { 332 bool dev_match = false; 333 #ifdef CONFIG_IP_ROUTE_MULTIPATH 334 if (unlikely(fi->nh)) { 335 dev_match = nexthop_uses_dev(fi->nh, dev); 336 } else { 337 int ret; 338 339 for (ret = 0; ret < fib_info_num_path(fi); ret++) { 340 const struct fib_nh_common *nhc = fib_info_nhc(fi, ret); 341 342 if (nhc_l3mdev_matches_dev(nhc, dev)) { 343 dev_match = true; 344 break; 345 } 346 } 347 } 348 #else 349 if (fib_info_nhc(fi, 0)->nhc_dev == dev) 350 dev_match = true; 351 #endif 352 353 return dev_match; 354 } 355 EXPORT_SYMBOL_GPL(fib_info_nh_uses_dev); 356 357 /* Given (packet source, input interface) and optional (dst, oif, tos): 358 * - (main) check, that source is valid i.e. not broadcast or our local 359 * address. 360 * - figure out what "logical" interface this packet arrived 361 * and calculate "specific destination" address. 362 * - check, that packet arrived from expected physical interface. 363 * called with rcu_read_lock() 364 */ 365 static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, 366 dscp_t dscp, int oif, struct net_device *dev, 367 int rpf, struct in_device *idev, u32 *itag) 368 { 369 struct net *net = dev_net(dev); 370 enum skb_drop_reason reason; 371 struct flow_keys flkeys; 372 int ret, no_addr; 373 struct fib_result res; 374 struct flowi4 fl4; 375 bool dev_match; 376 377 fl4.flowi4_oif = 0; 378 fl4.flowi4_l3mdev = l3mdev_master_ifindex_rcu(dev); 379 fl4.flowi4_iif = oif ? : LOOPBACK_IFINDEX; 380 fl4.daddr = src; 381 fl4.saddr = dst; 382 fl4.flowi4_dscp = dscp; 383 fl4.flowi4_scope = RT_SCOPE_UNIVERSE; 384 fl4.flowi4_tun_key.tun_id = 0; 385 fl4.flowi4_flags = 0; 386 fl4.flowi4_uid = sock_net_uid(net, NULL); 387 fl4.flowi4_multipath_hash = 0; 388 389 no_addr = idev->ifa_list == NULL; 390 391 fl4.flowi4_mark = IN_DEV_SRC_VMARK(idev) ? skb->mark : 0; 392 if (!fib4_rules_early_flow_dissect(net, skb, &fl4, &flkeys)) { 393 fl4.flowi4_proto = 0; 394 fl4.fl4_sport = 0; 395 fl4.fl4_dport = 0; 396 } else { 397 swap(fl4.fl4_sport, fl4.fl4_dport); 398 } 399 400 if (fib_lookup(net, &fl4, &res, 0)) 401 goto last_resort; 402 if (res.type != RTN_UNICAST) { 403 if (res.type != RTN_LOCAL) { 404 reason = SKB_DROP_REASON_IP_INVALID_SOURCE; 405 goto e_inval; 406 } else if (!IN_DEV_ACCEPT_LOCAL(idev)) { 407 reason = SKB_DROP_REASON_IP_LOCAL_SOURCE; 408 goto e_inval; 409 } 410 } 411 fib_combine_itag(itag, &res); 412 413 dev_match = fib_info_nh_uses_dev(res.fi, dev); 414 /* This is not common, loopback packets retain skb_dst so normally they 415 * would not even hit this slow path. 416 */ 417 dev_match = dev_match || (res.type == RTN_LOCAL && 418 dev == net->loopback_dev); 419 if (dev_match) { 420 ret = FIB_RES_NHC(res)->nhc_scope >= RT_SCOPE_HOST; 421 return ret; 422 } 423 if (no_addr) 424 goto last_resort; 425 if (rpf == 1) 426 goto e_rpf; 427 fl4.flowi4_oif = dev->ifindex; 428 429 ret = 0; 430 if (fib_lookup(net, &fl4, &res, FIB_LOOKUP_IGNORE_LINKSTATE) == 0) { 431 if (res.type == RTN_UNICAST) 432 ret = FIB_RES_NHC(res)->nhc_scope >= RT_SCOPE_HOST; 433 } 434 return ret; 435 436 last_resort: 437 if (rpf) 438 goto e_rpf; 439 *itag = 0; 440 return 0; 441 442 e_inval: 443 return -reason; 444 e_rpf: 445 return -SKB_DROP_REASON_IP_RPFILTER; 446 } 447 448 /* Ignore rp_filter for packets protected by IPsec. */ 449 int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, 450 dscp_t dscp, int oif, struct net_device *dev, 451 struct in_device *idev, u32 *itag) 452 { 453 int r = secpath_exists(skb) ? 0 : IN_DEV_RPFILTER(idev); 454 struct net *net = dev_net(dev); 455 456 if (!r && !fib_num_tclassid_users(net) && 457 (dev->ifindex != oif || !IN_DEV_TX_REDIRECTS(idev))) { 458 if (IN_DEV_ACCEPT_LOCAL(idev)) 459 goto ok; 460 /* with custom local routes in place, checking local addresses 461 * only will be too optimistic, with custom rules, checking 462 * local addresses only can be too strict, e.g. due to vrf 463 */ 464 if (net->ipv4.fib_has_custom_local_routes || 465 fib4_has_custom_rules(net)) 466 goto full_check; 467 /* Within the same container, it is regarded as a martian source, 468 * and the same host but different containers are not. 469 */ 470 if (inet_lookup_ifaddr_rcu(net, src)) 471 return -SKB_DROP_REASON_IP_LOCAL_SOURCE; 472 473 ok: 474 *itag = 0; 475 return 0; 476 } 477 478 full_check: 479 return __fib_validate_source(skb, src, dst, dscp, oif, dev, r, idev, 480 itag); 481 } 482 483 static inline __be32 sk_extract_addr(struct sockaddr *addr) 484 { 485 return ((struct sockaddr_in *) addr)->sin_addr.s_addr; 486 } 487 488 static int put_rtax(struct nlattr *mx, int len, int type, u32 value) 489 { 490 struct nlattr *nla; 491 492 nla = (struct nlattr *) ((char *) mx + len); 493 nla->nla_type = type; 494 nla->nla_len = nla_attr_size(4); 495 *(u32 *) nla_data(nla) = value; 496 497 return len + nla_total_size(4); 498 } 499 500 static int rtentry_to_fib_config(struct net *net, int cmd, struct rtentry *rt, 501 struct fib_config *cfg) 502 { 503 __be32 addr; 504 int plen; 505 506 memset(cfg, 0, sizeof(*cfg)); 507 cfg->fc_nlinfo.nl_net = net; 508 509 if (rt->rt_dst.sa_family != AF_INET) 510 return -EAFNOSUPPORT; 511 512 /* 513 * Check mask for validity: 514 * a) it must be contiguous. 515 * b) destination must have all host bits clear. 516 * c) if application forgot to set correct family (AF_INET), 517 * reject request unless it is absolutely clear i.e. 518 * both family and mask are zero. 519 */ 520 plen = 32; 521 addr = sk_extract_addr(&rt->rt_dst); 522 if (!(rt->rt_flags & RTF_HOST)) { 523 __be32 mask = sk_extract_addr(&rt->rt_genmask); 524 525 if (rt->rt_genmask.sa_family != AF_INET) { 526 if (mask || rt->rt_genmask.sa_family) 527 return -EAFNOSUPPORT; 528 } 529 530 if (bad_mask(mask, addr)) 531 return -EINVAL; 532 533 plen = inet_mask_len(mask); 534 } 535 536 cfg->fc_dst_len = plen; 537 cfg->fc_dst = addr; 538 539 if (cmd != SIOCDELRT) { 540 cfg->fc_nlflags = NLM_F_CREATE; 541 cfg->fc_protocol = RTPROT_BOOT; 542 } 543 544 if (rt->rt_metric) 545 cfg->fc_priority = rt->rt_metric - 1; 546 547 if (rt->rt_flags & RTF_REJECT) { 548 cfg->fc_scope = RT_SCOPE_HOST; 549 cfg->fc_type = RTN_UNREACHABLE; 550 return 0; 551 } 552 553 cfg->fc_scope = RT_SCOPE_NOWHERE; 554 cfg->fc_type = RTN_UNICAST; 555 556 if (rt->rt_dev) { 557 char *colon; 558 struct net_device *dev; 559 char devname[IFNAMSIZ]; 560 561 if (copy_from_user(devname, rt->rt_dev, IFNAMSIZ-1)) 562 return -EFAULT; 563 564 devname[IFNAMSIZ-1] = 0; 565 colon = strchr(devname, ':'); 566 if (colon) 567 *colon = 0; 568 dev = __dev_get_by_name(net, devname); 569 if (!dev) 570 return -ENODEV; 571 cfg->fc_oif = dev->ifindex; 572 cfg->fc_table = l3mdev_fib_table(dev); 573 if (colon) { 574 const struct in_ifaddr *ifa; 575 struct in_device *in_dev; 576 577 in_dev = __in_dev_get_rtnl_net(dev); 578 if (!in_dev) 579 return -ENODEV; 580 581 *colon = ':'; 582 583 in_dev_for_each_ifa_rtnl_net(net, ifa, in_dev) { 584 if (strcmp(ifa->ifa_label, devname) == 0) 585 break; 586 } 587 588 if (!ifa) 589 return -ENODEV; 590 cfg->fc_prefsrc = ifa->ifa_local; 591 } 592 } 593 594 addr = sk_extract_addr(&rt->rt_gateway); 595 if (rt->rt_gateway.sa_family == AF_INET && addr) { 596 unsigned int addr_type; 597 598 cfg->fc_gw4 = addr; 599 cfg->fc_gw_family = AF_INET; 600 addr_type = inet_addr_type_table(net, addr, cfg->fc_table); 601 if (rt->rt_flags & RTF_GATEWAY && 602 addr_type == RTN_UNICAST) 603 cfg->fc_scope = RT_SCOPE_UNIVERSE; 604 } 605 606 if (!cfg->fc_table) 607 cfg->fc_table = RT_TABLE_MAIN; 608 609 if (cmd == SIOCDELRT) 610 return 0; 611 612 if (rt->rt_flags & RTF_GATEWAY && !cfg->fc_gw_family) 613 return -EINVAL; 614 615 if (cfg->fc_scope == RT_SCOPE_NOWHERE) 616 cfg->fc_scope = RT_SCOPE_LINK; 617 618 if (rt->rt_flags & (RTF_MTU | RTF_WINDOW | RTF_IRTT)) { 619 struct nlattr *mx; 620 int len = 0; 621 622 mx = kcalloc(3, nla_total_size(4), GFP_KERNEL); 623 if (!mx) 624 return -ENOMEM; 625 626 if (rt->rt_flags & RTF_MTU) 627 len = put_rtax(mx, len, RTAX_ADVMSS, rt->rt_mtu - 40); 628 629 if (rt->rt_flags & RTF_WINDOW) 630 len = put_rtax(mx, len, RTAX_WINDOW, rt->rt_window); 631 632 if (rt->rt_flags & RTF_IRTT) 633 len = put_rtax(mx, len, RTAX_RTT, rt->rt_irtt << 3); 634 635 cfg->fc_mx = mx; 636 cfg->fc_mx_len = len; 637 } 638 639 return 0; 640 } 641 642 /* 643 * Handle IP routing ioctl calls. 644 * These are used to manipulate the routing tables 645 */ 646 int ip_rt_ioctl(struct net *net, unsigned int cmd, struct rtentry *rt) 647 { 648 struct fib_config cfg; 649 int err; 650 651 switch (cmd) { 652 case SIOCADDRT: /* Add a route */ 653 case SIOCDELRT: /* Delete a route */ 654 if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) 655 return -EPERM; 656 657 rtnl_net_lock(net); 658 err = rtentry_to_fib_config(net, cmd, rt, &cfg); 659 if (err == 0) { 660 struct fib_table *tb; 661 662 if (cmd == SIOCDELRT) { 663 tb = fib_get_table(net, cfg.fc_table); 664 if (tb) 665 err = fib_table_delete(net, tb, &cfg, 666 NULL); 667 else 668 err = -ESRCH; 669 } else { 670 tb = fib_new_table(net, cfg.fc_table); 671 if (tb) 672 err = fib_table_insert(net, tb, 673 &cfg, NULL); 674 else 675 err = -ENOBUFS; 676 } 677 678 /* allocated by rtentry_to_fib_config() */ 679 kfree(cfg.fc_mx); 680 } 681 rtnl_net_unlock(net); 682 return err; 683 } 684 return -EINVAL; 685 } 686 687 const struct nla_policy rtm_ipv4_policy[RTA_MAX + 1] = { 688 [RTA_UNSPEC] = { .strict_start_type = RTA_DPORT + 1 }, 689 [RTA_DST] = { .type = NLA_U32 }, 690 [RTA_SRC] = { .type = NLA_U32 }, 691 [RTA_IIF] = { .type = NLA_U32 }, 692 [RTA_OIF] = { .type = NLA_U32 }, 693 [RTA_GATEWAY] = { .type = NLA_U32 }, 694 [RTA_PRIORITY] = { .type = NLA_U32 }, 695 [RTA_PREFSRC] = { .type = NLA_U32 }, 696 [RTA_METRICS] = { .type = NLA_NESTED }, 697 [RTA_MULTIPATH] = { .len = sizeof(struct rtnexthop) }, 698 [RTA_FLOW] = { .type = NLA_U32 }, 699 [RTA_ENCAP_TYPE] = { .type = NLA_U16 }, 700 [RTA_ENCAP] = { .type = NLA_NESTED }, 701 [RTA_UID] = { .type = NLA_U32 }, 702 [RTA_MARK] = { .type = NLA_U32 }, 703 [RTA_TABLE] = { .type = NLA_U32 }, 704 [RTA_IP_PROTO] = { .type = NLA_U8 }, 705 [RTA_SPORT] = { .type = NLA_U16 }, 706 [RTA_DPORT] = { .type = NLA_U16 }, 707 [RTA_NH_ID] = { .type = NLA_U32 }, 708 }; 709 710 int fib_gw_from_via(struct fib_config *cfg, struct nlattr *nla, 711 struct netlink_ext_ack *extack) 712 { 713 struct rtvia *via; 714 int alen; 715 716 if (nla_len(nla) < offsetof(struct rtvia, rtvia_addr)) { 717 NL_SET_ERR_MSG(extack, "Invalid attribute length for RTA_VIA"); 718 return -EINVAL; 719 } 720 721 via = nla_data(nla); 722 alen = nla_len(nla) - offsetof(struct rtvia, rtvia_addr); 723 724 switch (via->rtvia_family) { 725 case AF_INET: 726 if (alen != sizeof(__be32)) { 727 NL_SET_ERR_MSG(extack, "Invalid IPv4 address in RTA_VIA"); 728 return -EINVAL; 729 } 730 cfg->fc_gw_family = AF_INET; 731 cfg->fc_gw4 = *((__be32 *)via->rtvia_addr); 732 break; 733 case AF_INET6: 734 #if IS_ENABLED(CONFIG_IPV6) 735 if (alen != sizeof(struct in6_addr)) { 736 NL_SET_ERR_MSG(extack, "Invalid IPv6 address in RTA_VIA"); 737 return -EINVAL; 738 } 739 cfg->fc_gw_family = AF_INET6; 740 cfg->fc_gw6 = *((struct in6_addr *)via->rtvia_addr); 741 #else 742 NL_SET_ERR_MSG(extack, "IPv6 support not enabled in kernel"); 743 return -EINVAL; 744 #endif 745 break; 746 default: 747 NL_SET_ERR_MSG(extack, "Unsupported address family in RTA_VIA"); 748 return -EINVAL; 749 } 750 751 return 0; 752 } 753 754 static int rtm_to_fib_config(struct net *net, struct sk_buff *skb, 755 struct nlmsghdr *nlh, struct fib_config *cfg, 756 struct netlink_ext_ack *extack) 757 { 758 bool has_gw = false, has_via = false; 759 struct nlattr *attr; 760 int err, remaining; 761 struct rtmsg *rtm; 762 763 err = nlmsg_validate_deprecated(nlh, sizeof(*rtm), RTA_MAX, 764 rtm_ipv4_policy, extack); 765 if (err < 0) 766 goto errout; 767 768 memset(cfg, 0, sizeof(*cfg)); 769 770 rtm = nlmsg_data(nlh); 771 772 if (!inet_validate_dscp(rtm->rtm_tos)) { 773 NL_SET_ERR_MSG(extack, 774 "Invalid dsfield (tos): ECN bits must be 0"); 775 err = -EINVAL; 776 goto errout; 777 } 778 cfg->fc_dscp = inet_dsfield_to_dscp(rtm->rtm_tos); 779 780 cfg->fc_dst_len = rtm->rtm_dst_len; 781 cfg->fc_table = rtm->rtm_table; 782 cfg->fc_protocol = rtm->rtm_protocol; 783 cfg->fc_scope = rtm->rtm_scope; 784 cfg->fc_type = rtm->rtm_type; 785 cfg->fc_flags = rtm->rtm_flags; 786 cfg->fc_nlflags = nlh->nlmsg_flags; 787 788 cfg->fc_nlinfo.portid = NETLINK_CB(skb).portid; 789 cfg->fc_nlinfo.nlh = nlh; 790 cfg->fc_nlinfo.nl_net = net; 791 792 if (cfg->fc_type > RTN_MAX) { 793 NL_SET_ERR_MSG(extack, "Invalid route type"); 794 err = -EINVAL; 795 goto errout; 796 } 797 798 nlmsg_for_each_attr(attr, nlh, sizeof(struct rtmsg), remaining) { 799 switch (nla_type(attr)) { 800 case RTA_DST: 801 cfg->fc_dst = nla_get_be32(attr); 802 break; 803 case RTA_OIF: 804 cfg->fc_oif = nla_get_u32(attr); 805 break; 806 case RTA_GATEWAY: 807 has_gw = true; 808 cfg->fc_gw4 = nla_get_be32(attr); 809 if (cfg->fc_gw4) 810 cfg->fc_gw_family = AF_INET; 811 break; 812 case RTA_VIA: 813 has_via = true; 814 err = fib_gw_from_via(cfg, attr, extack); 815 if (err) 816 goto errout; 817 break; 818 case RTA_PRIORITY: 819 cfg->fc_priority = nla_get_u32(attr); 820 break; 821 case RTA_PREFSRC: 822 cfg->fc_prefsrc = nla_get_be32(attr); 823 break; 824 case RTA_METRICS: 825 cfg->fc_mx = nla_data(attr); 826 cfg->fc_mx_len = nla_len(attr); 827 break; 828 case RTA_MULTIPATH: 829 err = lwtunnel_valid_encap_type_attr(nla_data(attr), 830 nla_len(attr), 831 extack); 832 if (err < 0) 833 goto errout; 834 cfg->fc_mp = nla_data(attr); 835 cfg->fc_mp_len = nla_len(attr); 836 break; 837 case RTA_FLOW: 838 cfg->fc_flow = nla_get_u32(attr); 839 break; 840 case RTA_TABLE: 841 cfg->fc_table = nla_get_u32(attr); 842 break; 843 case RTA_ENCAP: 844 cfg->fc_encap = attr; 845 break; 846 case RTA_ENCAP_TYPE: 847 cfg->fc_encap_type = nla_get_u16(attr); 848 err = lwtunnel_valid_encap_type(cfg->fc_encap_type, 849 extack); 850 if (err < 0) 851 goto errout; 852 break; 853 case RTA_NH_ID: 854 cfg->fc_nh_id = nla_get_u32(attr); 855 break; 856 } 857 } 858 859 if (cfg->fc_dst_len > 32) { 860 NL_SET_ERR_MSG(extack, "Invalid prefix length"); 861 err = -EINVAL; 862 goto errout; 863 } 864 865 if (cfg->fc_dst_len < 32 && (ntohl(cfg->fc_dst) << cfg->fc_dst_len)) { 866 NL_SET_ERR_MSG(extack, "Invalid prefix for given prefix length"); 867 err = -EINVAL; 868 goto errout; 869 } 870 871 if (cfg->fc_nh_id) { 872 if (cfg->fc_oif || cfg->fc_gw_family || 873 cfg->fc_encap || cfg->fc_mp) { 874 NL_SET_ERR_MSG(extack, 875 "Nexthop specification and nexthop id are mutually exclusive"); 876 err = -EINVAL; 877 goto errout; 878 } 879 } 880 881 if (has_gw && has_via) { 882 NL_SET_ERR_MSG(extack, 883 "Nexthop configuration can not contain both GATEWAY and VIA"); 884 err = -EINVAL; 885 goto errout; 886 } 887 888 if (!cfg->fc_table) 889 cfg->fc_table = RT_TABLE_MAIN; 890 891 return 0; 892 errout: 893 return err; 894 } 895 896 static int inet_rtm_delroute(struct sk_buff *skb, struct nlmsghdr *nlh, 897 struct netlink_ext_ack *extack) 898 { 899 struct net *net = sock_net(skb->sk); 900 struct fib_config cfg; 901 struct fib_table *tb; 902 int err; 903 904 err = rtm_to_fib_config(net, skb, nlh, &cfg, extack); 905 if (err < 0) 906 goto errout; 907 908 rtnl_net_lock(net); 909 910 if (cfg.fc_nh_id && !nexthop_find_by_id(net, cfg.fc_nh_id)) { 911 NL_SET_ERR_MSG(extack, "Nexthop id does not exist"); 912 err = -EINVAL; 913 goto unlock; 914 } 915 916 tb = fib_get_table(net, cfg.fc_table); 917 if (!tb) { 918 NL_SET_ERR_MSG(extack, "FIB table does not exist"); 919 err = -ESRCH; 920 goto unlock; 921 } 922 923 err = fib_table_delete(net, tb, &cfg, extack); 924 unlock: 925 rtnl_net_unlock(net); 926 errout: 927 return err; 928 } 929 930 static int inet_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh, 931 struct netlink_ext_ack *extack) 932 { 933 struct net *net = sock_net(skb->sk); 934 struct fib_config cfg; 935 struct fib_table *tb; 936 int err; 937 938 err = rtm_to_fib_config(net, skb, nlh, &cfg, extack); 939 if (err < 0) 940 goto errout; 941 942 rtnl_net_lock(net); 943 944 tb = fib_new_table(net, cfg.fc_table); 945 if (!tb) { 946 err = -ENOBUFS; 947 goto unlock; 948 } 949 950 err = fib_table_insert(net, tb, &cfg, extack); 951 if (!err && cfg.fc_type == RTN_LOCAL) 952 net->ipv4.fib_has_custom_local_routes = true; 953 954 unlock: 955 rtnl_net_unlock(net); 956 errout: 957 return err; 958 } 959 960 int ip_valid_fib_dump_req(struct net *net, const struct nlmsghdr *nlh, 961 struct fib_dump_filter *filter, 962 struct netlink_callback *cb) 963 { 964 struct netlink_ext_ack *extack = cb->extack; 965 struct nlattr *tb[RTA_MAX + 1]; 966 struct rtmsg *rtm; 967 int err, i; 968 969 rtm = nlmsg_payload(nlh, sizeof(*rtm)); 970 if (!rtm) { 971 NL_SET_ERR_MSG(extack, "Invalid header for FIB dump request"); 972 return -EINVAL; 973 } 974 975 if (rtm->rtm_dst_len || rtm->rtm_src_len || rtm->rtm_tos || 976 rtm->rtm_scope) { 977 NL_SET_ERR_MSG(extack, "Invalid values in header for FIB dump request"); 978 return -EINVAL; 979 } 980 981 if (rtm->rtm_flags & ~(RTM_F_CLONED | RTM_F_PREFIX)) { 982 NL_SET_ERR_MSG(extack, "Invalid flags for FIB dump request"); 983 return -EINVAL; 984 } 985 if (rtm->rtm_flags & RTM_F_CLONED) 986 filter->dump_routes = false; 987 else 988 filter->dump_exceptions = false; 989 990 filter->flags = rtm->rtm_flags; 991 filter->protocol = rtm->rtm_protocol; 992 filter->rt_type = rtm->rtm_type; 993 filter->table_id = rtm->rtm_table; 994 995 err = nlmsg_parse_deprecated_strict(nlh, sizeof(*rtm), tb, RTA_MAX, 996 rtm_ipv4_policy, extack); 997 if (err < 0) 998 return err; 999 1000 for (i = 0; i <= RTA_MAX; ++i) { 1001 int ifindex; 1002 1003 if (!tb[i]) 1004 continue; 1005 1006 switch (i) { 1007 case RTA_TABLE: 1008 filter->table_id = nla_get_u32(tb[i]); 1009 break; 1010 case RTA_OIF: 1011 ifindex = nla_get_u32(tb[i]); 1012 1013 filter->dev = dev_get_by_index_rcu(net, ifindex); 1014 if (!filter->dev) 1015 return -ENODEV; 1016 break; 1017 default: 1018 NL_SET_ERR_MSG(extack, "Unsupported attribute in dump request"); 1019 return -EINVAL; 1020 } 1021 } 1022 1023 if (filter->flags || filter->protocol || filter->rt_type || 1024 filter->table_id || filter->dev) { 1025 filter->filter_set = 1; 1026 cb->answer_flags = NLM_F_DUMP_FILTERED; 1027 } 1028 1029 return 0; 1030 } 1031 EXPORT_SYMBOL_GPL(ip_valid_fib_dump_req); 1032 1033 static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb) 1034 { 1035 const struct nlmsghdr *nlh = cb->nlh; 1036 struct net *net = sock_net(skb->sk); 1037 struct fib_dump_filter filter = { 1038 .dump_routes = true, 1039 .dump_exceptions = true, 1040 }; 1041 struct hlist_head *head; 1042 int dumped = 0, err = 0; 1043 struct fib_table *tb; 1044 unsigned int h, s_h; 1045 u32 s_id; 1046 1047 rcu_read_lock(); 1048 if (cb->strict_check) { 1049 err = ip_valid_fib_dump_req(net, nlh, &filter, cb); 1050 if (err < 0) 1051 goto unlock; 1052 } else if (nlmsg_len(nlh) >= sizeof(struct rtmsg)) { 1053 struct rtmsg *rtm = nlmsg_data(nlh); 1054 1055 filter.flags = rtm->rtm_flags & (RTM_F_PREFIX | RTM_F_CLONED); 1056 } 1057 1058 /* ipv4 does not use prefix flag */ 1059 if (filter.flags & RTM_F_PREFIX) 1060 goto unlock; 1061 1062 if (filter.table_id) { 1063 tb = fib_get_table(net, filter.table_id); 1064 if (!tb) { 1065 if (rtnl_msg_family(cb->nlh) != PF_INET) 1066 goto unlock; 1067 1068 NL_SET_ERR_MSG(cb->extack, "ipv4: FIB table does not exist"); 1069 err = -ENOENT; 1070 goto unlock; 1071 } 1072 err = fib_table_dump(tb, skb, cb, &filter); 1073 goto unlock; 1074 } 1075 1076 s_h = cb->args[0]; 1077 s_id = cb->args[1]; 1078 1079 err = 0; 1080 for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_id = 0) { 1081 head = &net->ipv4.fib_table_hash[h]; 1082 hlist_for_each_entry_rcu(tb, head, tb_hlist) { 1083 if (s_id && tb->tb_id != s_id) 1084 continue; 1085 1086 s_id = 0; 1087 if (dumped) 1088 memset(&cb->args[2], 0, sizeof(cb->args) - 1089 2 * sizeof(cb->args[0])); 1090 cb->args[1] = tb->tb_id; 1091 err = fib_table_dump(tb, skb, cb, &filter); 1092 if (err < 0) 1093 goto out; 1094 dumped = 1; 1095 } 1096 } 1097 out: 1098 1099 cb->args[0] = h; 1100 1101 unlock: 1102 rcu_read_unlock(); 1103 return err; 1104 } 1105 1106 /* Prepare and feed intra-kernel routing request. 1107 * Really, it should be netlink message, but :-( netlink 1108 * can be not configured, so that we feed it directly 1109 * to fib engine. It is legal, because all events occur 1110 * only when netlink is already locked. 1111 */ 1112 static void fib_magic(int cmd, int type, __be32 dst, int dst_len, 1113 struct in_ifaddr *ifa, u32 rt_priority) 1114 { 1115 struct net *net = dev_net(ifa->ifa_dev->dev); 1116 u32 tb_id = l3mdev_fib_table(ifa->ifa_dev->dev); 1117 struct fib_table *tb; 1118 struct fib_config cfg = { 1119 .fc_protocol = RTPROT_KERNEL, 1120 .fc_type = type, 1121 .fc_dst = dst, 1122 .fc_dst_len = dst_len, 1123 .fc_priority = rt_priority, 1124 .fc_prefsrc = ifa->ifa_local, 1125 .fc_oif = ifa->ifa_dev->dev->ifindex, 1126 .fc_nlflags = NLM_F_CREATE | NLM_F_APPEND, 1127 .fc_nlinfo = { 1128 .nl_net = net, 1129 }, 1130 }; 1131 1132 if (!tb_id) 1133 tb_id = (type == RTN_UNICAST) ? RT_TABLE_MAIN : RT_TABLE_LOCAL; 1134 1135 tb = fib_new_table(net, tb_id); 1136 if (!tb) 1137 return; 1138 1139 cfg.fc_table = tb->tb_id; 1140 1141 if (type != RTN_LOCAL) 1142 cfg.fc_scope = RT_SCOPE_LINK; 1143 else 1144 cfg.fc_scope = RT_SCOPE_HOST; 1145 1146 if (cmd == RTM_NEWROUTE) 1147 fib_table_insert(net, tb, &cfg, NULL); 1148 else 1149 fib_table_delete(net, tb, &cfg, NULL); 1150 } 1151 1152 void fib_add_ifaddr(struct in_ifaddr *ifa) 1153 { 1154 struct in_device *in_dev = ifa->ifa_dev; 1155 struct net_device *dev = in_dev->dev; 1156 struct in_ifaddr *prim = ifa; 1157 __be32 mask = ifa->ifa_mask; 1158 __be32 addr = ifa->ifa_local; 1159 __be32 prefix = ifa->ifa_address & mask; 1160 1161 if (ifa->ifa_flags & IFA_F_SECONDARY) { 1162 prim = inet_ifa_byprefix(in_dev, prefix, mask); 1163 if (!prim) { 1164 pr_warn("%s: bug: prim == NULL\n", __func__); 1165 return; 1166 } 1167 } 1168 1169 fib_magic(RTM_NEWROUTE, RTN_LOCAL, addr, 32, prim, 0); 1170 1171 if (!(dev->flags & IFF_UP)) 1172 return; 1173 1174 /* Add broadcast address, if it is explicitly assigned. */ 1175 if (ifa->ifa_broadcast && ifa->ifa_broadcast != htonl(0xFFFFFFFF)) { 1176 fib_magic(RTM_NEWROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, 1177 prim, 0); 1178 arp_invalidate(dev, ifa->ifa_broadcast, false); 1179 } 1180 1181 if (!ipv4_is_zeronet(prefix) && !(ifa->ifa_flags & IFA_F_SECONDARY) && 1182 (prefix != addr || ifa->ifa_prefixlen < 32)) { 1183 if (!(ifa->ifa_flags & IFA_F_NOPREFIXROUTE)) 1184 fib_magic(RTM_NEWROUTE, 1185 dev->flags & IFF_LOOPBACK ? RTN_LOCAL : RTN_UNICAST, 1186 prefix, ifa->ifa_prefixlen, prim, 1187 ifa->ifa_rt_priority); 1188 1189 /* Add the network broadcast address, when it makes sense */ 1190 if (ifa->ifa_prefixlen < 31) { 1191 fib_magic(RTM_NEWROUTE, RTN_BROADCAST, prefix | ~mask, 1192 32, prim, 0); 1193 arp_invalidate(dev, prefix | ~mask, false); 1194 } 1195 } 1196 } 1197 1198 void fib_modify_prefix_metric(struct in_ifaddr *ifa, u32 new_metric) 1199 { 1200 __be32 prefix = ifa->ifa_address & ifa->ifa_mask; 1201 struct in_device *in_dev = ifa->ifa_dev; 1202 struct net_device *dev = in_dev->dev; 1203 1204 if (!(dev->flags & IFF_UP) || 1205 ifa->ifa_flags & (IFA_F_SECONDARY | IFA_F_NOPREFIXROUTE) || 1206 ipv4_is_zeronet(prefix) || 1207 (prefix == ifa->ifa_local && ifa->ifa_prefixlen == 32)) 1208 return; 1209 1210 /* add the new */ 1211 fib_magic(RTM_NEWROUTE, 1212 dev->flags & IFF_LOOPBACK ? RTN_LOCAL : RTN_UNICAST, 1213 prefix, ifa->ifa_prefixlen, ifa, new_metric); 1214 1215 /* delete the old */ 1216 fib_magic(RTM_DELROUTE, 1217 dev->flags & IFF_LOOPBACK ? RTN_LOCAL : RTN_UNICAST, 1218 prefix, ifa->ifa_prefixlen, ifa, ifa->ifa_rt_priority); 1219 } 1220 1221 /* Delete primary or secondary address. 1222 * Optionally, on secondary address promotion consider the addresses 1223 * from subnet iprim as deleted, even if they are in device list. 1224 * In this case the secondary ifa can be in device list. 1225 */ 1226 void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim) 1227 { 1228 struct in_device *in_dev = ifa->ifa_dev; 1229 struct net_device *dev = in_dev->dev; 1230 struct in_ifaddr *ifa1; 1231 struct in_ifaddr *prim = ifa, *prim1 = NULL; 1232 __be32 brd = ifa->ifa_address | ~ifa->ifa_mask; 1233 __be32 any = ifa->ifa_address & ifa->ifa_mask; 1234 #define LOCAL_OK 1 1235 #define BRD_OK 2 1236 #define BRD0_OK 4 1237 #define BRD1_OK 8 1238 unsigned int ok = 0; 1239 int subnet = 0; /* Primary network */ 1240 int gone = 1; /* Address is missing */ 1241 int same_prefsrc = 0; /* Another primary with same IP */ 1242 1243 if (ifa->ifa_flags & IFA_F_SECONDARY) { 1244 prim = inet_ifa_byprefix(in_dev, any, ifa->ifa_mask); 1245 if (!prim) { 1246 /* if the device has been deleted, we don't perform 1247 * address promotion 1248 */ 1249 if (!in_dev->dead) 1250 pr_warn("%s: bug: prim == NULL\n", __func__); 1251 return; 1252 } 1253 if (iprim && iprim != prim) { 1254 pr_warn("%s: bug: iprim != prim\n", __func__); 1255 return; 1256 } 1257 } else if (!ipv4_is_zeronet(any) && 1258 (any != ifa->ifa_local || ifa->ifa_prefixlen < 32)) { 1259 if (!(ifa->ifa_flags & IFA_F_NOPREFIXROUTE)) 1260 fib_magic(RTM_DELROUTE, 1261 dev->flags & IFF_LOOPBACK ? RTN_LOCAL : RTN_UNICAST, 1262 any, ifa->ifa_prefixlen, prim, 0); 1263 subnet = 1; 1264 } 1265 1266 if (in_dev->dead) 1267 goto no_promotions; 1268 1269 /* Deletion is more complicated than add. 1270 * We should take care of not to delete too much :-) 1271 * 1272 * Scan address list to be sure that addresses are really gone. 1273 */ 1274 rcu_read_lock(); 1275 in_dev_for_each_ifa_rcu(ifa1, in_dev) { 1276 if (ifa1 == ifa) { 1277 /* promotion, keep the IP */ 1278 gone = 0; 1279 continue; 1280 } 1281 /* Ignore IFAs from our subnet */ 1282 if (iprim && ifa1->ifa_mask == iprim->ifa_mask && 1283 inet_ifa_match(ifa1->ifa_address, iprim)) 1284 continue; 1285 1286 /* Ignore ifa1 if it uses different primary IP (prefsrc) */ 1287 if (ifa1->ifa_flags & IFA_F_SECONDARY) { 1288 /* Another address from our subnet? */ 1289 if (ifa1->ifa_mask == prim->ifa_mask && 1290 inet_ifa_match(ifa1->ifa_address, prim)) 1291 prim1 = prim; 1292 else { 1293 /* We reached the secondaries, so 1294 * same_prefsrc should be determined. 1295 */ 1296 if (!same_prefsrc) 1297 continue; 1298 /* Search new prim1 if ifa1 is not 1299 * using the current prim1 1300 */ 1301 if (!prim1 || 1302 ifa1->ifa_mask != prim1->ifa_mask || 1303 !inet_ifa_match(ifa1->ifa_address, prim1)) 1304 prim1 = inet_ifa_byprefix(in_dev, 1305 ifa1->ifa_address, 1306 ifa1->ifa_mask); 1307 if (!prim1) 1308 continue; 1309 if (prim1->ifa_local != prim->ifa_local) 1310 continue; 1311 } 1312 } else { 1313 if (prim->ifa_local != ifa1->ifa_local) 1314 continue; 1315 prim1 = ifa1; 1316 if (prim != prim1) 1317 same_prefsrc = 1; 1318 } 1319 if (ifa->ifa_local == ifa1->ifa_local) 1320 ok |= LOCAL_OK; 1321 if (ifa->ifa_broadcast == ifa1->ifa_broadcast) 1322 ok |= BRD_OK; 1323 if (brd == ifa1->ifa_broadcast) 1324 ok |= BRD1_OK; 1325 if (any == ifa1->ifa_broadcast) 1326 ok |= BRD0_OK; 1327 /* primary has network specific broadcasts */ 1328 if (prim1 == ifa1 && ifa1->ifa_prefixlen < 31) { 1329 __be32 brd1 = ifa1->ifa_address | ~ifa1->ifa_mask; 1330 __be32 any1 = ifa1->ifa_address & ifa1->ifa_mask; 1331 1332 if (!ipv4_is_zeronet(any1)) { 1333 if (ifa->ifa_broadcast == brd1 || 1334 ifa->ifa_broadcast == any1) 1335 ok |= BRD_OK; 1336 if (brd == brd1 || brd == any1) 1337 ok |= BRD1_OK; 1338 if (any == brd1 || any == any1) 1339 ok |= BRD0_OK; 1340 } 1341 } 1342 } 1343 rcu_read_unlock(); 1344 1345 no_promotions: 1346 if (!(ok & BRD_OK)) 1347 fib_magic(RTM_DELROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, 1348 prim, 0); 1349 if (subnet && ifa->ifa_prefixlen < 31) { 1350 if (!(ok & BRD1_OK)) 1351 fib_magic(RTM_DELROUTE, RTN_BROADCAST, brd, 32, 1352 prim, 0); 1353 if (!(ok & BRD0_OK)) 1354 fib_magic(RTM_DELROUTE, RTN_BROADCAST, any, 32, 1355 prim, 0); 1356 } 1357 if (!(ok & LOCAL_OK)) { 1358 unsigned int addr_type; 1359 1360 fib_magic(RTM_DELROUTE, RTN_LOCAL, ifa->ifa_local, 32, prim, 0); 1361 1362 /* Check, that this local address finally disappeared. */ 1363 addr_type = inet_addr_type_dev_table(dev_net(dev), dev, 1364 ifa->ifa_local); 1365 if (gone && addr_type != RTN_LOCAL) { 1366 /* And the last, but not the least thing. 1367 * We must flush stray FIB entries. 1368 * 1369 * First of all, we scan fib_info list searching 1370 * for stray nexthop entries, then ignite fib_flush. 1371 */ 1372 if (fib_sync_down_addr(dev, ifa->ifa_local)) 1373 fib_flush(dev_net(dev)); 1374 } 1375 } 1376 #undef LOCAL_OK 1377 #undef BRD_OK 1378 #undef BRD0_OK 1379 #undef BRD1_OK 1380 } 1381 1382 static void nl_fib_lookup(struct net *net, struct fib_result_nl *frn) 1383 { 1384 1385 struct fib_result res; 1386 struct flowi4 fl4 = { 1387 .flowi4_mark = frn->fl_mark, 1388 .daddr = frn->fl_addr, 1389 .flowi4_dscp = inet_dsfield_to_dscp(frn->fl_tos), 1390 .flowi4_scope = frn->fl_scope, 1391 }; 1392 struct fib_table *tb; 1393 1394 rcu_read_lock(); 1395 1396 tb = fib_get_table(net, frn->tb_id_in); 1397 1398 frn->err = -ENOENT; 1399 if (tb) { 1400 local_bh_disable(); 1401 1402 frn->tb_id = tb->tb_id; 1403 frn->err = fib_table_lookup(tb, &fl4, &res, FIB_LOOKUP_NOREF); 1404 1405 if (!frn->err) { 1406 frn->prefixlen = res.prefixlen; 1407 frn->nh_sel = res.nh_sel; 1408 frn->type = res.type; 1409 frn->scope = res.scope; 1410 } 1411 local_bh_enable(); 1412 } 1413 1414 rcu_read_unlock(); 1415 } 1416 1417 static void nl_fib_input(struct sk_buff *skb) 1418 { 1419 struct net *net; 1420 struct fib_result_nl *frn; 1421 struct nlmsghdr *nlh; 1422 u32 portid; 1423 1424 net = sock_net(skb->sk); 1425 nlh = nlmsg_hdr(skb); 1426 if (skb->len < nlmsg_total_size(sizeof(*frn)) || 1427 skb->len < nlh->nlmsg_len || 1428 nlmsg_len(nlh) < sizeof(*frn)) 1429 return; 1430 1431 skb = netlink_skb_clone(skb, GFP_KERNEL); 1432 if (!skb) 1433 return; 1434 nlh = nlmsg_hdr(skb); 1435 1436 frn = nlmsg_data(nlh); 1437 nl_fib_lookup(net, frn); 1438 1439 portid = NETLINK_CB(skb).portid; /* netlink portid */ 1440 NETLINK_CB(skb).portid = 0; /* from kernel */ 1441 NETLINK_CB(skb).dst_group = 0; /* unicast */ 1442 nlmsg_unicast(net->ipv4.fibnl, skb, portid); 1443 } 1444 1445 static int __net_init nl_fib_lookup_init(struct net *net) 1446 { 1447 struct sock *sk; 1448 struct netlink_kernel_cfg cfg = { 1449 .input = nl_fib_input, 1450 }; 1451 1452 sk = netlink_kernel_create(net, NETLINK_FIB_LOOKUP, &cfg); 1453 if (!sk) 1454 return -EAFNOSUPPORT; 1455 net->ipv4.fibnl = sk; 1456 return 0; 1457 } 1458 1459 static void nl_fib_lookup_exit(struct net *net) 1460 { 1461 netlink_kernel_release(net->ipv4.fibnl); 1462 net->ipv4.fibnl = NULL; 1463 } 1464 1465 static void fib_disable_ip(struct net_device *dev, unsigned long event, 1466 bool force) 1467 { 1468 if (fib_sync_down_dev(dev, event, force)) 1469 fib_flush(dev_net(dev)); 1470 else 1471 rt_cache_flush(dev_net(dev)); 1472 arp_ifdown(dev); 1473 } 1474 1475 static int fib_inetaddr_event(struct notifier_block *this, unsigned long event, void *ptr) 1476 { 1477 struct in_ifaddr *ifa = ptr; 1478 struct net_device *dev = ifa->ifa_dev->dev; 1479 struct net *net = dev_net(dev); 1480 1481 switch (event) { 1482 case NETDEV_UP: 1483 fib_add_ifaddr(ifa); 1484 #ifdef CONFIG_IP_ROUTE_MULTIPATH 1485 fib_sync_up(dev, RTNH_F_DEAD); 1486 #endif 1487 atomic_inc(&net->ipv4.dev_addr_genid); 1488 rt_cache_flush(net); 1489 break; 1490 case NETDEV_DOWN: 1491 fib_del_ifaddr(ifa, NULL); 1492 atomic_inc(&net->ipv4.dev_addr_genid); 1493 if (!ifa->ifa_dev->ifa_list) { 1494 /* Last address was deleted from this interface. 1495 * Disable IP. 1496 */ 1497 fib_disable_ip(dev, event, true); 1498 } else { 1499 rt_cache_flush(net); 1500 } 1501 break; 1502 } 1503 return NOTIFY_DONE; 1504 } 1505 1506 static int fib_netdev_event(struct notifier_block *this, unsigned long event, void *ptr) 1507 { 1508 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 1509 struct netdev_notifier_changeupper_info *upper_info = ptr; 1510 struct netdev_notifier_info_ext *info_ext = ptr; 1511 struct in_device *in_dev; 1512 struct net *net = dev_net(dev); 1513 struct in_ifaddr *ifa; 1514 unsigned int flags; 1515 1516 if (event == NETDEV_UNREGISTER) { 1517 fib_disable_ip(dev, event, true); 1518 rt_flush_dev(dev); 1519 return NOTIFY_DONE; 1520 } 1521 1522 in_dev = __in_dev_get_rtnl(dev); 1523 if (!in_dev) 1524 return NOTIFY_DONE; 1525 1526 switch (event) { 1527 case NETDEV_UP: 1528 in_dev_for_each_ifa_rtnl(ifa, in_dev) { 1529 fib_add_ifaddr(ifa); 1530 } 1531 #ifdef CONFIG_IP_ROUTE_MULTIPATH 1532 fib_sync_up(dev, RTNH_F_DEAD); 1533 #endif 1534 atomic_inc(&net->ipv4.dev_addr_genid); 1535 rt_cache_flush(net); 1536 break; 1537 case NETDEV_DOWN: 1538 fib_disable_ip(dev, event, false); 1539 break; 1540 case NETDEV_CHANGE: 1541 flags = netif_get_flags(dev); 1542 if (flags & (IFF_RUNNING | IFF_LOWER_UP)) 1543 fib_sync_up(dev, RTNH_F_LINKDOWN); 1544 else 1545 fib_sync_down_dev(dev, event, false); 1546 rt_cache_flush(net); 1547 break; 1548 case NETDEV_CHANGEMTU: 1549 fib_sync_mtu(dev, info_ext->ext.mtu); 1550 rt_cache_flush(net); 1551 break; 1552 case NETDEV_CHANGEUPPER: 1553 upper_info = ptr; 1554 /* flush all routes if dev is linked to or unlinked from 1555 * an L3 master device (e.g., VRF) 1556 */ 1557 if (upper_info->upper_dev && 1558 netif_is_l3_master(upper_info->upper_dev)) 1559 fib_disable_ip(dev, NETDEV_DOWN, true); 1560 break; 1561 } 1562 return NOTIFY_DONE; 1563 } 1564 1565 static struct notifier_block fib_inetaddr_notifier = { 1566 .notifier_call = fib_inetaddr_event, 1567 }; 1568 1569 static struct notifier_block fib_netdev_notifier = { 1570 .notifier_call = fib_netdev_event, 1571 }; 1572 1573 static int __net_init ip_fib_net_init(struct net *net) 1574 { 1575 int err; 1576 size_t size = sizeof(struct hlist_head) * FIB_TABLE_HASHSZ; 1577 1578 err = fib4_notifier_init(net); 1579 if (err) 1580 return err; 1581 1582 #ifdef CONFIG_IP_ROUTE_MULTIPATH 1583 /* Default to 3-tuple */ 1584 net->ipv4.sysctl_fib_multipath_hash_fields = 1585 FIB_MULTIPATH_HASH_FIELD_DEFAULT_MASK; 1586 #endif 1587 1588 #ifdef CONFIG_IP_MULTIPLE_TABLES 1589 spin_lock_init(&net->ipv4.fib_table_hash_lock); 1590 #endif 1591 1592 /* Avoid false sharing : Use at least a full cache line */ 1593 size = max_t(size_t, size, L1_CACHE_BYTES); 1594 1595 net->ipv4.fib_table_hash = kzalloc(size, GFP_KERNEL); 1596 if (!net->ipv4.fib_table_hash) { 1597 err = -ENOMEM; 1598 goto err_table_hash_alloc; 1599 } 1600 1601 err = fib4_rules_init(net); 1602 if (err < 0) 1603 goto err_rules_init; 1604 return 0; 1605 1606 err_rules_init: 1607 kfree(net->ipv4.fib_table_hash); 1608 err_table_hash_alloc: 1609 fib4_notifier_exit(net); 1610 return err; 1611 } 1612 1613 static void ip_fib_net_exit(struct net *net) 1614 { 1615 int i; 1616 1617 ASSERT_RTNL_NET(net); 1618 #ifdef CONFIG_IP_MULTIPLE_TABLES 1619 RCU_INIT_POINTER(net->ipv4.fib_main, NULL); 1620 RCU_INIT_POINTER(net->ipv4.fib_default, NULL); 1621 #endif 1622 /* Destroy the tables in reverse order to guarantee that the 1623 * local table, ID 255, is destroyed before the main table, ID 1624 * 254. This is necessary as the local table may contain 1625 * references to data contained in the main table. 1626 */ 1627 for (i = FIB_TABLE_HASHSZ - 1; i >= 0; i--) { 1628 struct hlist_head *head = &net->ipv4.fib_table_hash[i]; 1629 struct hlist_node *tmp; 1630 struct fib_table *tb; 1631 1632 hlist_for_each_entry_safe(tb, tmp, head, tb_hlist) { 1633 hlist_del_rcu(&tb->tb_hlist); 1634 fib_table_flush(net, tb, true); 1635 fib_free_table(tb); 1636 } 1637 } 1638 } 1639 1640 static int __net_init fib_net_init(struct net *net) 1641 { 1642 int error; 1643 1644 #ifdef CONFIG_IP_ROUTE_CLASSID 1645 atomic_set(&net->ipv4.fib_num_tclassid_users, 0); 1646 #endif 1647 error = ip_fib_net_init(net); 1648 if (error < 0) 1649 goto out; 1650 1651 error = fib4_semantics_init(net); 1652 if (error) 1653 goto out_semantics; 1654 1655 error = nl_fib_lookup_init(net); 1656 if (error < 0) 1657 goto out_nlfl; 1658 1659 error = fib_proc_init(net); 1660 if (error < 0) 1661 goto out_proc; 1662 out: 1663 return error; 1664 1665 out_proc: 1666 nl_fib_lookup_exit(net); 1667 out_nlfl: 1668 fib4_semantics_exit(net); 1669 out_semantics: 1670 rtnl_net_lock(net); 1671 ip_fib_net_exit(net); 1672 rtnl_net_unlock(net); 1673 1674 #ifdef CONFIG_IP_MULTIPLE_TABLES 1675 fib4_rules_exit(net); 1676 #endif 1677 kfree(net->ipv4.fib_table_hash); 1678 fib4_notifier_exit(net); 1679 goto out; 1680 } 1681 1682 static void __net_exit fib_net_pre_exit(struct net *net) 1683 { 1684 fib_proc_exit(net); 1685 nl_fib_lookup_exit(net); 1686 } 1687 1688 static void __net_exit fib_net_exit_rtnl(struct net *net, 1689 struct list_head *dev_kill_list) 1690 { 1691 ip_fib_net_exit(net); 1692 } 1693 1694 static void __net_exit fib_net_exit(struct net *net) 1695 { 1696 #ifdef CONFIG_IP_MULTIPLE_TABLES 1697 fib4_rules_exit(net); 1698 #endif 1699 kfree(net->ipv4.fib_table_hash); 1700 fib4_notifier_exit(net); 1701 fib4_semantics_exit(net); 1702 } 1703 1704 static struct pernet_operations fib_net_ops = { 1705 .init = fib_net_init, 1706 .pre_exit = fib_net_pre_exit, 1707 .exit_rtnl = fib_net_exit_rtnl, 1708 .exit = fib_net_exit, 1709 }; 1710 1711 static const struct rtnl_msg_handler fib_rtnl_msg_handlers[] __initconst = { 1712 {.protocol = PF_INET, .msgtype = RTM_NEWROUTE, 1713 .doit = inet_rtm_newroute, .flags = RTNL_FLAG_DOIT_PERNET}, 1714 {.protocol = PF_INET, .msgtype = RTM_DELROUTE, 1715 .doit = inet_rtm_delroute, .flags = RTNL_FLAG_DOIT_PERNET}, 1716 {.protocol = PF_INET, .msgtype = RTM_GETROUTE, .dumpit = inet_dump_fib, 1717 .flags = RTNL_FLAG_DUMP_UNLOCKED | RTNL_FLAG_DUMP_SPLIT_NLM_DONE}, 1718 }; 1719 1720 void __init ip_fib_init(void) 1721 { 1722 fib_trie_init(); 1723 1724 register_pernet_subsys(&fib_net_ops); 1725 1726 register_netdevice_notifier(&fib_netdev_notifier); 1727 register_inetaddr_notifier(&fib_inetaddr_notifier); 1728 1729 rtnl_register_many(fib_rtnl_msg_handlers); 1730 } 1731