12874c5fdSThomas Gleixner // SPDX-License-Identifier: GPL-2.0-or-later
21da177e4SLinus Torvalds /*
31da177e4SLinus Torvalds * INET An implementation of the TCP/IP protocol suite for the LINUX
41da177e4SLinus Torvalds * operating system. INET is implemented using the BSD Socket
51da177e4SLinus Torvalds * interface as the means of communication with the user level.
61da177e4SLinus Torvalds *
71da177e4SLinus Torvalds * IPv4 Forwarding Information Base: policy rules.
81da177e4SLinus Torvalds *
91da177e4SLinus Torvalds * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
10e1ef4bf2SThomas Graf * Thomas Graf <tgraf@suug.ch>
111da177e4SLinus Torvalds *
121da177e4SLinus Torvalds * Fixes:
131da177e4SLinus Torvalds * Rani Assaf : local_rule cannot be deleted
141da177e4SLinus Torvalds * Marc Boucher : routing by fwmark
151da177e4SLinus Torvalds */
161da177e4SLinus Torvalds
171da177e4SLinus Torvalds #include <linux/types.h>
181da177e4SLinus Torvalds #include <linux/kernel.h>
191da177e4SLinus Torvalds #include <linux/netdevice.h>
201da177e4SLinus Torvalds #include <linux/netlink.h>
21e1ef4bf2SThomas Graf #include <linux/inetdevice.h>
221da177e4SLinus Torvalds #include <linux/init.h>
237b204afdSRobert Olsson #include <linux/list.h>
247b204afdSRobert Olsson #include <linux/rcupdate.h>
25bc3b2d7fSPaul Gortmaker #include <linux/export.h>
26563f8e97SGuillaume Nault #include <net/inet_dscp.h>
271da177e4SLinus Torvalds #include <net/ip.h>
281da177e4SLinus Torvalds #include <net/route.h>
291da177e4SLinus Torvalds #include <net/tcp.h>
301da177e4SLinus Torvalds #include <net/ip_fib.h>
315481d73fSDavid Ahern #include <net/nexthop.h>
32e1ef4bf2SThomas Graf #include <net/fib_rules.h>
33b9aaec8fSBrian Vazquez #include <linux/indirect_call_wrapper.h>
341da177e4SLinus Torvalds
356a31d2a9SEric Dumazet struct fib4_rule {
36e1ef4bf2SThomas Graf struct fib_rule common;
37e1ef4bf2SThomas Graf u8 dst_len;
38e1ef4bf2SThomas Graf u8 src_len;
39563f8e97SGuillaume Nault dscp_t dscp;
40*b9455fefSIdo Schimmel u8 dscp_full:1; /* DSCP or TOS selector */
4181f7bf6cSAl Viro __be32 src;
4281f7bf6cSAl Viro __be32 srcmask;
4381f7bf6cSAl Viro __be32 dst;
4481f7bf6cSAl Viro __be32 dstmask;
45c7066f70SPatrick McHardy #ifdef CONFIG_IP_ROUTE_CLASSID
46e1ef4bf2SThomas Graf u32 tclassid;
471da177e4SLinus Torvalds #endif
481da177e4SLinus Torvalds };
491da177e4SLinus Torvalds
fib4_rule_matchall(const struct fib_rule * rule)503c71006dSIdo Schimmel static bool fib4_rule_matchall(const struct fib_rule *rule)
513c71006dSIdo Schimmel {
523c71006dSIdo Schimmel struct fib4_rule *r = container_of(rule, struct fib4_rule, common);
533c71006dSIdo Schimmel
54563f8e97SGuillaume Nault if (r->dst_len || r->src_len || r->dscp)
553c71006dSIdo Schimmel return false;
563c71006dSIdo Schimmel return fib_rule_matchall(rule);
573c71006dSIdo Schimmel }
583c71006dSIdo Schimmel
fib4_rule_default(const struct fib_rule * rule)593c71006dSIdo Schimmel bool fib4_rule_default(const struct fib_rule *rule)
603c71006dSIdo Schimmel {
613c71006dSIdo Schimmel if (!fib4_rule_matchall(rule) || rule->action != FR_ACT_TO_TBL ||
623c71006dSIdo Schimmel rule->l3mdev)
633c71006dSIdo Schimmel return false;
643c71006dSIdo Schimmel if (rule->table != RT_TABLE_LOCAL && rule->table != RT_TABLE_MAIN &&
653c71006dSIdo Schimmel rule->table != RT_TABLE_DEFAULT)
663c71006dSIdo Schimmel return false;
673c71006dSIdo Schimmel return true;
683c71006dSIdo Schimmel }
693c71006dSIdo Schimmel EXPORT_SYMBOL_GPL(fib4_rule_default);
703c71006dSIdo Schimmel
fib4_rules_dump(struct net * net,struct notifier_block * nb,struct netlink_ext_ack * extack)71b7a59557SJiri Pirko int fib4_rules_dump(struct net *net, struct notifier_block *nb,
72b7a59557SJiri Pirko struct netlink_ext_ack *extack)
731b2a4440SIdo Schimmel {
74b7a59557SJiri Pirko return fib_rules_dump(net, nb, AF_INET, extack);
751b2a4440SIdo Schimmel }
761b2a4440SIdo Schimmel
fib4_rules_seq_read(struct net * net)771b2a4440SIdo Schimmel unsigned int fib4_rules_seq_read(struct net *net)
781b2a4440SIdo Schimmel {
791b2a4440SIdo Schimmel return fib_rules_seq_read(net, AF_INET);
801b2a4440SIdo Schimmel }
811b2a4440SIdo Schimmel
__fib_lookup(struct net * net,struct flowi4 * flp,struct fib_result * res,unsigned int flags)820eeb075fSAndy Gospodarek int __fib_lookup(struct net *net, struct flowi4 *flp,
830eeb075fSAndy Gospodarek struct fib_result *res, unsigned int flags)
84e1ef4bf2SThomas Graf {
85e1ef4bf2SThomas Graf struct fib_lookup_arg arg = {
86e1ef4bf2SThomas Graf .result = res,
870eeb075fSAndy Gospodarek .flags = flags,
88e1ef4bf2SThomas Graf };
89e1ef4bf2SThomas Graf int err;
90e1ef4bf2SThomas Graf
919ee0034bSDavid Ahern /* update flow if oif or iif point to device enslaved to l3mdev */
929ee0034bSDavid Ahern l3mdev_update_flow(net, flowi4_to_flowi(flp));
939ee0034bSDavid Ahern
9422bd5b9bSDavid S. Miller err = fib_rules_lookup(net->ipv4.rules_ops, flowi4_to_flowi(flp), 0, &arg);
9585b91b03SDavid S. Miller #ifdef CONFIG_IP_ROUTE_CLASSID
9685b91b03SDavid S. Miller if (arg.rule)
9785b91b03SDavid S. Miller res->tclassid = ((struct fib4_rule *)arg.rule)->tclassid;
9885b91b03SDavid S. Miller else
9985b91b03SDavid S. Miller res->tclassid = 0;
10085b91b03SDavid S. Miller #endif
10149dd18baSPanu Matilainen
10249dd18baSPanu Matilainen if (err == -ESRCH)
10349dd18baSPanu Matilainen err = -ENETUNREACH;
10449dd18baSPanu Matilainen
1051da177e4SLinus Torvalds return err;
1061da177e4SLinus Torvalds }
107f4530fa5SDavid S. Miller EXPORT_SYMBOL_GPL(__fib_lookup);
1081da177e4SLinus Torvalds
fib4_rule_action(struct fib_rule * rule,struct flowi * flp,int flags,struct fib_lookup_arg * arg)109b9aaec8fSBrian Vazquez INDIRECT_CALLABLE_SCOPE int fib4_rule_action(struct fib_rule *rule,
110b9aaec8fSBrian Vazquez struct flowi *flp, int flags,
111b9aaec8fSBrian Vazquez struct fib_lookup_arg *arg)
112e1ef4bf2SThomas Graf {
113e1ef4bf2SThomas Graf int err = -EAGAIN;
114e1ef4bf2SThomas Graf struct fib_table *tbl;
11596c63fa7SDavid Ahern u32 tb_id;
116e1ef4bf2SThomas Graf
117e1ef4bf2SThomas Graf switch (rule->action) {
118e1ef4bf2SThomas Graf case FR_ACT_TO_TBL:
119e1ef4bf2SThomas Graf break;
120e1ef4bf2SThomas Graf
121e1ef4bf2SThomas Graf case FR_ACT_UNREACHABLE:
122345e9b54SAlexander Duyck return -ENETUNREACH;
123e1ef4bf2SThomas Graf
124e1ef4bf2SThomas Graf case FR_ACT_PROHIBIT:
125345e9b54SAlexander Duyck return -EACCES;
126e1ef4bf2SThomas Graf
127e1ef4bf2SThomas Graf case FR_ACT_BLACKHOLE:
128e1ef4bf2SThomas Graf default:
129345e9b54SAlexander Duyck return -EINVAL;
130e1ef4bf2SThomas Graf }
131e1ef4bf2SThomas Graf
132345e9b54SAlexander Duyck rcu_read_lock();
133e1ef4bf2SThomas Graf
13496c63fa7SDavid Ahern tb_id = fib_rule_get_table(rule, arg);
13596c63fa7SDavid Ahern tbl = fib_get_table(rule->fr_net, tb_id);
136345e9b54SAlexander Duyck if (tbl)
137345e9b54SAlexander Duyck err = fib_table_lookup(tbl, &flp->u.ip4,
138345e9b54SAlexander Duyck (struct fib_result *)arg->result,
139345e9b54SAlexander Duyck arg->flags);
140345e9b54SAlexander Duyck
141345e9b54SAlexander Duyck rcu_read_unlock();
142e1ef4bf2SThomas Graf return err;
143e1ef4bf2SThomas Graf }
144e1ef4bf2SThomas Graf
fib4_rule_suppress(struct fib_rule * rule,int flags,struct fib_lookup_arg * arg)145b9aaec8fSBrian Vazquez INDIRECT_CALLABLE_SCOPE bool fib4_rule_suppress(struct fib_rule *rule,
146cdef4852Smsizanoen1 int flags,
147b9aaec8fSBrian Vazquez struct fib_lookup_arg *arg)
1487764a45aSStefan Tomanek {
1492e47eeceSYu Zhe struct fib_result *result = arg->result;
150673498b8SStefan Tomanek struct net_device *dev = NULL;
151673498b8SStefan Tomanek
1525481d73fSDavid Ahern if (result->fi) {
153dcb1ecb5SDavid Ahern struct fib_nh_common *nhc = fib_info_nhc(result->fi, 0);
1545481d73fSDavid Ahern
155dcb1ecb5SDavid Ahern dev = nhc->nhc_dev;
1565481d73fSDavid Ahern }
1576ef94cfaSStefan Tomanek
1587764a45aSStefan Tomanek /* do not accept result if the route does
1597764a45aSStefan Tomanek * not meet the required prefix length
1607764a45aSStefan Tomanek */
16173f5698eSStefan Tomanek if (result->prefixlen <= rule->suppress_prefixlen)
1626ef94cfaSStefan Tomanek goto suppress_route;
1636ef94cfaSStefan Tomanek
1646ef94cfaSStefan Tomanek /* do not accept result if the route uses a device
1656ef94cfaSStefan Tomanek * belonging to a forbidden interface group
1666ef94cfaSStefan Tomanek */
1676ef94cfaSStefan Tomanek if (rule->suppress_ifgroup != -1 && dev && dev->group == rule->suppress_ifgroup)
1686ef94cfaSStefan Tomanek goto suppress_route;
1696ef94cfaSStefan Tomanek
1706ef94cfaSStefan Tomanek return false;
1716ef94cfaSStefan Tomanek
1726ef94cfaSStefan Tomanek suppress_route:
1737764a45aSStefan Tomanek if (!(arg->flags & FIB_LOOKUP_NOREF))
1747764a45aSStefan Tomanek fib_info_put(result->fi);
1757764a45aSStefan Tomanek return true;
1767764a45aSStefan Tomanek }
177e1ef4bf2SThomas Graf
fib4_rule_match(struct fib_rule * rule,struct flowi * fl,int flags)178b9aaec8fSBrian Vazquez INDIRECT_CALLABLE_SCOPE int fib4_rule_match(struct fib_rule *rule,
179b9aaec8fSBrian Vazquez struct flowi *fl, int flags)
180e1ef4bf2SThomas Graf {
181e1ef4bf2SThomas Graf struct fib4_rule *r = (struct fib4_rule *) rule;
1829ade2286SDavid S. Miller struct flowi4 *fl4 = &fl->u.ip4;
1839ade2286SDavid S. Miller __be32 daddr = fl4->daddr;
1849ade2286SDavid S. Miller __be32 saddr = fl4->saddr;
185e1ef4bf2SThomas Graf
186e1ef4bf2SThomas Graf if (((saddr ^ r->src) & r->srcmask) ||
187e1ef4bf2SThomas Graf ((daddr ^ r->dst) & r->dstmask))
188e1ef4bf2SThomas Graf return 0;
189e1ef4bf2SThomas Graf
190*b9455fefSIdo Schimmel /* When DSCP selector is used we need to match on the entire DSCP field
191*b9455fefSIdo Schimmel * in the flow information structure. When TOS selector is used we need
192*b9455fefSIdo Schimmel * to mask the upper three DSCP bits prior to matching to maintain
193*b9455fefSIdo Schimmel * legacy behavior.
194*b9455fefSIdo Schimmel */
195*b9455fefSIdo Schimmel if (r->dscp_full && r->dscp != inet_dsfield_to_dscp(fl4->flowi4_tos))
196*b9455fefSIdo Schimmel return 0;
197*b9455fefSIdo Schimmel else if (!r->dscp_full && r->dscp &&
198*b9455fefSIdo Schimmel !fib_dscp_masked_match(r->dscp, fl4))
199e1ef4bf2SThomas Graf return 0;
200e1ef4bf2SThomas Graf
2014a2d73a4SRoopa Prabhu if (rule->ip_proto && (rule->ip_proto != fl4->flowi4_proto))
2024a2d73a4SRoopa Prabhu return 0;
2034a2d73a4SRoopa Prabhu
2044a2d73a4SRoopa Prabhu if (fib_rule_port_range_set(&rule->sport_range) &&
2054a2d73a4SRoopa Prabhu !fib_rule_port_inrange(&rule->sport_range, fl4->fl4_sport))
2064a2d73a4SRoopa Prabhu return 0;
2074a2d73a4SRoopa Prabhu
2084a2d73a4SRoopa Prabhu if (fib_rule_port_range_set(&rule->dport_range) &&
2094a2d73a4SRoopa Prabhu !fib_rule_port_inrange(&rule->dport_range, fl4->fl4_dport))
2104a2d73a4SRoopa Prabhu return 0;
2114a2d73a4SRoopa Prabhu
212e1ef4bf2SThomas Graf return 1;
213e1ef4bf2SThomas Graf }
2141da177e4SLinus Torvalds
fib_empty_table(struct net * net)2158ad4942cSDenis V. Lunev static struct fib_table *fib_empty_table(struct net *net)
2161da177e4SLinus Torvalds {
21758075ff5SYueHaibing u32 id = 1;
2181da177e4SLinus Torvalds
21958075ff5SYueHaibing while (1) {
22051456b29SIan Morris if (!fib_get_table(net, id))
2218ad4942cSDenis V. Lunev return fib_new_table(net, id);
22258075ff5SYueHaibing
22358075ff5SYueHaibing if (id++ == RT_TABLE_MAX)
22458075ff5SYueHaibing break;
22558075ff5SYueHaibing }
2261da177e4SLinus Torvalds return NULL;
2271da177e4SLinus Torvalds }
2281da177e4SLinus Torvalds
fib4_nl2rule_dscp(const struct nlattr * nla,struct fib4_rule * rule4,struct netlink_ext_ack * extack)229*b9455fefSIdo Schimmel static int fib4_nl2rule_dscp(const struct nlattr *nla, struct fib4_rule *rule4,
230*b9455fefSIdo Schimmel struct netlink_ext_ack *extack)
231*b9455fefSIdo Schimmel {
232*b9455fefSIdo Schimmel if (rule4->dscp) {
233*b9455fefSIdo Schimmel NL_SET_ERR_MSG(extack, "Cannot specify both TOS and DSCP");
234*b9455fefSIdo Schimmel return -EINVAL;
235*b9455fefSIdo Schimmel }
236*b9455fefSIdo Schimmel
237*b9455fefSIdo Schimmel rule4->dscp = inet_dsfield_to_dscp(nla_get_u8(nla) << 2);
238*b9455fefSIdo Schimmel rule4->dscp_full = true;
239*b9455fefSIdo Schimmel
240*b9455fefSIdo Schimmel return 0;
241*b9455fefSIdo Schimmel }
242*b9455fefSIdo Schimmel
fib4_rule_configure(struct fib_rule * rule,struct sk_buff * skb,struct fib_rule_hdr * frh,struct nlattr ** tb,struct netlink_ext_ack * extack)243e1ef4bf2SThomas Graf static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
2448b3521eeSRami Rosen struct fib_rule_hdr *frh,
245b16fb418SRoopa Prabhu struct nlattr **tb,
246b16fb418SRoopa Prabhu struct netlink_ext_ack *extack)
2471da177e4SLinus Torvalds {
2483b1e0a65SYOSHIFUJI Hideaki struct net *net = sock_net(skb->sk);
249e1ef4bf2SThomas Graf int err = -EINVAL;
250e1ef4bf2SThomas Graf struct fib4_rule *rule4 = (struct fib4_rule *) rule;
2511da177e4SLinus Torvalds
252563f8e97SGuillaume Nault if (!inet_validate_dscp(frh->tos)) {
253563f8e97SGuillaume Nault NL_SET_ERR_MSG(extack,
254563f8e97SGuillaume Nault "Invalid dsfield (tos): ECN bits must be 0");
255e1ef4bf2SThomas Graf goto errout;
256b16fb418SRoopa Prabhu }
257dc513a40SGuillaume Nault /* IPv4 currently doesn't handle high order DSCP bits correctly */
258dc513a40SGuillaume Nault if (frh->tos & ~IPTOS_TOS_MASK) {
259dc513a40SGuillaume Nault NL_SET_ERR_MSG(extack, "Invalid tos");
260dc513a40SGuillaume Nault goto errout;
261dc513a40SGuillaume Nault }
262563f8e97SGuillaume Nault rule4->dscp = inet_dsfield_to_dscp(frh->tos);
263e1ef4bf2SThomas Graf
264*b9455fefSIdo Schimmel if (tb[FRA_DSCP] &&
265*b9455fefSIdo Schimmel fib4_nl2rule_dscp(tb[FRA_DSCP], rule4, extack) < 0)
266*b9455fefSIdo Schimmel goto errout;
267*b9455fefSIdo Schimmel
2680ddcf43dSAlexander Duyck /* split local/main if they are not already split */
2690ddcf43dSAlexander Duyck err = fib_unmerge(net);
2700ddcf43dSAlexander Duyck if (err)
2710ddcf43dSAlexander Duyck goto errout;
2720ddcf43dSAlexander Duyck
27396c63fa7SDavid Ahern if (rule->table == RT_TABLE_UNSPEC && !rule->l3mdev) {
274e1ef4bf2SThomas Graf if (rule->action == FR_ACT_TO_TBL) {
275e1ef4bf2SThomas Graf struct fib_table *table;
276e1ef4bf2SThomas Graf
277e4e4971cSDenis V. Lunev table = fib_empty_table(net);
27851456b29SIan Morris if (!table) {
279e1ef4bf2SThomas Graf err = -ENOBUFS;
280e1ef4bf2SThomas Graf goto errout;
281e1ef4bf2SThomas Graf }
282e1ef4bf2SThomas Graf
283e1ef4bf2SThomas Graf rule->table = table->tb_id;
284e1ef4bf2SThomas Graf }
285e1ef4bf2SThomas Graf }
286e1ef4bf2SThomas Graf
287e1701c68SThomas Graf if (frh->src_len)
28867b61f6cSJiri Benc rule4->src = nla_get_in_addr(tb[FRA_SRC]);
289e1ef4bf2SThomas Graf
290e1701c68SThomas Graf if (frh->dst_len)
29167b61f6cSJiri Benc rule4->dst = nla_get_in_addr(tb[FRA_DST]);
292e1ef4bf2SThomas Graf
293c7066f70SPatrick McHardy #ifdef CONFIG_IP_ROUTE_CLASSID
2947a9bc9b8SDavid S. Miller if (tb[FRA_FLOW]) {
295e1ef4bf2SThomas Graf rule4->tclassid = nla_get_u32(tb[FRA_FLOW]);
2967a9bc9b8SDavid S. Miller if (rule4->tclassid)
297213f5f8fSEric Dumazet atomic_inc(&net->ipv4.fib_num_tclassid_users);
2987a9bc9b8SDavid S. Miller }
2991da177e4SLinus Torvalds #endif
3001da177e4SLinus Torvalds
301e37b1e97SRoopa Prabhu if (fib_rule_requires_fldissect(rule))
302e37b1e97SRoopa Prabhu net->ipv4.fib_rules_require_fldissect++;
303e37b1e97SRoopa Prabhu
304e1ef4bf2SThomas Graf rule4->src_len = frh->src_len;
305e1ef4bf2SThomas Graf rule4->srcmask = inet_make_mask(rule4->src_len);
306e1ef4bf2SThomas Graf rule4->dst_len = frh->dst_len;
307e1ef4bf2SThomas Graf rule4->dstmask = inet_make_mask(rule4->dst_len);
308e1ef4bf2SThomas Graf
309f4530fa5SDavid S. Miller net->ipv4.fib_has_custom_rules = true;
310104616e7SScott Feldman
311e1ef4bf2SThomas Graf err = 0;
312e1ef4bf2SThomas Graf errout:
313e1ef4bf2SThomas Graf return err;
3141da177e4SLinus Torvalds }
3151da177e4SLinus Torvalds
fib4_rule_delete(struct fib_rule * rule)3160ddcf43dSAlexander Duyck static int fib4_rule_delete(struct fib_rule *rule)
3177a9bc9b8SDavid S. Miller {
318f4530fa5SDavid S. Miller struct net *net = rule->fr_net;
3190ddcf43dSAlexander Duyck int err;
3207a9bc9b8SDavid S. Miller
3210ddcf43dSAlexander Duyck /* split local/main if they are not already split */
3220ddcf43dSAlexander Duyck err = fib_unmerge(net);
3230ddcf43dSAlexander Duyck if (err)
3240ddcf43dSAlexander Duyck goto errout;
3250ddcf43dSAlexander Duyck
3260ddcf43dSAlexander Duyck #ifdef CONFIG_IP_ROUTE_CLASSID
3270ddcf43dSAlexander Duyck if (((struct fib4_rule *)rule)->tclassid)
328213f5f8fSEric Dumazet atomic_dec(&net->ipv4.fib_num_tclassid_users);
3297a9bc9b8SDavid S. Miller #endif
330f4530fa5SDavid S. Miller net->ipv4.fib_has_custom_rules = true;
331e37b1e97SRoopa Prabhu
332e37b1e97SRoopa Prabhu if (net->ipv4.fib_rules_require_fldissect &&
333e37b1e97SRoopa Prabhu fib_rule_requires_fldissect(rule))
334e37b1e97SRoopa Prabhu net->ipv4.fib_rules_require_fldissect--;
3350ddcf43dSAlexander Duyck errout:
3360ddcf43dSAlexander Duyck return err;
3377a9bc9b8SDavid S. Miller }
3387a9bc9b8SDavid S. Miller
fib4_rule_compare(struct fib_rule * rule,struct fib_rule_hdr * frh,struct nlattr ** tb)339e1ef4bf2SThomas Graf static int fib4_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
340e1ef4bf2SThomas Graf struct nlattr **tb)
341a5cdc030SPatrick McHardy {
342e1ef4bf2SThomas Graf struct fib4_rule *rule4 = (struct fib4_rule *) rule;
343a5cdc030SPatrick McHardy
344e1ef4bf2SThomas Graf if (frh->src_len && (rule4->src_len != frh->src_len))
345e1ef4bf2SThomas Graf return 0;
346e1ef4bf2SThomas Graf
347e1ef4bf2SThomas Graf if (frh->dst_len && (rule4->dst_len != frh->dst_len))
348e1ef4bf2SThomas Graf return 0;
349e1ef4bf2SThomas Graf
350*b9455fefSIdo Schimmel if (frh->tos &&
351*b9455fefSIdo Schimmel (rule4->dscp_full ||
352*b9455fefSIdo Schimmel inet_dscp_to_dsfield(rule4->dscp) != frh->tos))
353e1ef4bf2SThomas Graf return 0;
354e1ef4bf2SThomas Graf
355*b9455fefSIdo Schimmel if (tb[FRA_DSCP]) {
356*b9455fefSIdo Schimmel dscp_t dscp;
357*b9455fefSIdo Schimmel
358*b9455fefSIdo Schimmel dscp = inet_dsfield_to_dscp(nla_get_u8(tb[FRA_DSCP]) << 2);
359*b9455fefSIdo Schimmel if (!rule4->dscp_full || rule4->dscp != dscp)
360*b9455fefSIdo Schimmel return 0;
361*b9455fefSIdo Schimmel }
362*b9455fefSIdo Schimmel
363c7066f70SPatrick McHardy #ifdef CONFIG_IP_ROUTE_CLASSID
364e1ef4bf2SThomas Graf if (tb[FRA_FLOW] && (rule4->tclassid != nla_get_u32(tb[FRA_FLOW])))
365e1ef4bf2SThomas Graf return 0;
366e1ef4bf2SThomas Graf #endif
367e1ef4bf2SThomas Graf
36867b61f6cSJiri Benc if (frh->src_len && (rule4->src != nla_get_in_addr(tb[FRA_SRC])))
369e1ef4bf2SThomas Graf return 0;
370e1ef4bf2SThomas Graf
37167b61f6cSJiri Benc if (frh->dst_len && (rule4->dst != nla_get_in_addr(tb[FRA_DST])))
372e1ef4bf2SThomas Graf return 0;
373e1ef4bf2SThomas Graf
374e1ef4bf2SThomas Graf return 1;
375a5cdc030SPatrick McHardy }
376a5cdc030SPatrick McHardy
fib4_rule_fill(struct fib_rule * rule,struct sk_buff * skb,struct fib_rule_hdr * frh)377e1ef4bf2SThomas Graf static int fib4_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
37804af8cf6SRami Rosen struct fib_rule_hdr *frh)
3791da177e4SLinus Torvalds {
380e1ef4bf2SThomas Graf struct fib4_rule *rule4 = (struct fib4_rule *) rule;
3811da177e4SLinus Torvalds
382e1ef4bf2SThomas Graf frh->dst_len = rule4->dst_len;
383e1ef4bf2SThomas Graf frh->src_len = rule4->src_len;
384*b9455fefSIdo Schimmel
385*b9455fefSIdo Schimmel if (rule4->dscp_full) {
386*b9455fefSIdo Schimmel frh->tos = 0;
387*b9455fefSIdo Schimmel if (nla_put_u8(skb, FRA_DSCP,
388*b9455fefSIdo Schimmel inet_dscp_to_dsfield(rule4->dscp) >> 2))
389*b9455fefSIdo Schimmel goto nla_put_failure;
390*b9455fefSIdo Schimmel } else {
391563f8e97SGuillaume Nault frh->tos = inet_dscp_to_dsfield(rule4->dscp);
392*b9455fefSIdo Schimmel }
3931da177e4SLinus Torvalds
394f3756b79SDavid S. Miller if ((rule4->dst_len &&
395930345eaSJiri Benc nla_put_in_addr(skb, FRA_DST, rule4->dst)) ||
396f3756b79SDavid S. Miller (rule4->src_len &&
397930345eaSJiri Benc nla_put_in_addr(skb, FRA_SRC, rule4->src)))
398f3756b79SDavid S. Miller goto nla_put_failure;
399c7066f70SPatrick McHardy #ifdef CONFIG_IP_ROUTE_CLASSID
400f3756b79SDavid S. Miller if (rule4->tclassid &&
401f3756b79SDavid S. Miller nla_put_u32(skb, FRA_FLOW, rule4->tclassid))
402f3756b79SDavid S. Miller goto nla_put_failure;
403e1ef4bf2SThomas Graf #endif
404e1ef4bf2SThomas Graf return 0;
405e1ef4bf2SThomas Graf
406e1ef4bf2SThomas Graf nla_put_failure:
407e1ef4bf2SThomas Graf return -ENOBUFS;
4081da177e4SLinus Torvalds }
4091da177e4SLinus Torvalds
fib4_rule_nlmsg_payload(struct fib_rule * rule)410339bf98fSThomas Graf static size_t fib4_rule_nlmsg_payload(struct fib_rule *rule)
411339bf98fSThomas Graf {
412339bf98fSThomas Graf return nla_total_size(4) /* dst */
413339bf98fSThomas Graf + nla_total_size(4) /* src */
414*b9455fefSIdo Schimmel + nla_total_size(4) /* flow */
415*b9455fefSIdo Schimmel + nla_total_size(1); /* dscp */
416339bf98fSThomas Graf }
417339bf98fSThomas Graf
fib4_rule_flush_cache(struct fib_rules_ops * ops)418ae299fc0SDenis V. Lunev static void fib4_rule_flush_cache(struct fib_rules_ops *ops)
41973417f61SThomas Graf {
420bafa6d9dSNicolas Dichtel rt_cache_flush(ops->fro_net);
42173417f61SThomas Graf }
42273417f61SThomas Graf
42304a6f82cSAndi Kleen static const struct fib_rules_ops __net_initconst fib4_rules_ops_template = {
42425239ceeSPatrick McHardy .family = AF_INET,
425e1ef4bf2SThomas Graf .rule_size = sizeof(struct fib4_rule),
426e1701c68SThomas Graf .addr_size = sizeof(u32),
427e1ef4bf2SThomas Graf .action = fib4_rule_action,
4287764a45aSStefan Tomanek .suppress = fib4_rule_suppress,
429e1ef4bf2SThomas Graf .match = fib4_rule_match,
430e1ef4bf2SThomas Graf .configure = fib4_rule_configure,
4317a9bc9b8SDavid S. Miller .delete = fib4_rule_delete,
432e1ef4bf2SThomas Graf .compare = fib4_rule_compare,
433e1ef4bf2SThomas Graf .fill = fib4_rule_fill,
434339bf98fSThomas Graf .nlmsg_payload = fib4_rule_nlmsg_payload,
43573417f61SThomas Graf .flush_cache = fib4_rule_flush_cache,
436e1ef4bf2SThomas Graf .nlgroup = RTNLGRP_IPV4_RULE,
437e1ef4bf2SThomas Graf .owner = THIS_MODULE,
438e1ef4bf2SThomas Graf };
439e1ef4bf2SThomas Graf
fib_default_rules_init(struct fib_rules_ops * ops)440e4e4971cSDenis V. Lunev static int fib_default_rules_init(struct fib_rules_ops *ops)
4412994c638SDenis V. Lunev {
4422994c638SDenis V. Lunev int err;
4432994c638SDenis V. Lunev
444b4c1d4d9SZhengchao Shao err = fib_default_rule_add(ops, 0, RT_TABLE_LOCAL);
4452994c638SDenis V. Lunev if (err < 0)
4462994c638SDenis V. Lunev return err;
447b4c1d4d9SZhengchao Shao err = fib_default_rule_add(ops, 0x7FFE, RT_TABLE_MAIN);
4482994c638SDenis V. Lunev if (err < 0)
4492994c638SDenis V. Lunev return err;
450b4c1d4d9SZhengchao Shao err = fib_default_rule_add(ops, 0x7FFF, RT_TABLE_DEFAULT);
4512994c638SDenis V. Lunev if (err < 0)
4522994c638SDenis V. Lunev return err;
4532994c638SDenis V. Lunev return 0;
4542994c638SDenis V. Lunev }
4552994c638SDenis V. Lunev
fib4_rules_init(struct net * net)4567b1a74fdSDenis V. Lunev int __net_init fib4_rules_init(struct net *net)
457e1ef4bf2SThomas Graf {
458dbb50165SDenis V. Lunev int err;
459e4e4971cSDenis V. Lunev struct fib_rules_ops *ops;
460dbb50165SDenis V. Lunev
461e9c5158aSEric W. Biederman ops = fib_rules_register(&fib4_rules_ops_template, net);
462e9c5158aSEric W. Biederman if (IS_ERR(ops))
463e9c5158aSEric W. Biederman return PTR_ERR(ops);
464e4e4971cSDenis V. Lunev
465e4e4971cSDenis V. Lunev err = fib_default_rules_init(ops);
466dbb50165SDenis V. Lunev if (err < 0)
467dbb50165SDenis V. Lunev goto fail;
468e4e4971cSDenis V. Lunev net->ipv4.rules_ops = ops;
469f4530fa5SDavid S. Miller net->ipv4.fib_has_custom_rules = false;
470e37b1e97SRoopa Prabhu net->ipv4.fib_rules_require_fldissect = 0;
471dbb50165SDenis V. Lunev return 0;
472dbb50165SDenis V. Lunev
473dbb50165SDenis V. Lunev fail:
474dbb50165SDenis V. Lunev /* also cleans all rules already added */
4759e3a5487SDenis V. Lunev fib_rules_unregister(ops);
476dbb50165SDenis V. Lunev return err;
477e1ef4bf2SThomas Graf }
4787b1a74fdSDenis V. Lunev
fib4_rules_exit(struct net * net)4797b1a74fdSDenis V. Lunev void __net_exit fib4_rules_exit(struct net *net)
4807b1a74fdSDenis V. Lunev {
4819e3a5487SDenis V. Lunev fib_rules_unregister(net->ipv4.rules_ops);
4827b1a74fdSDenis V. Lunev }
483