11da177e4SLinus Torvalds /* 21da177e4SLinus Torvalds * INET An implementation of the TCP/IP protocol suite for the LINUX 31da177e4SLinus Torvalds * operating system. INET is implemented using the BSD Socket 41da177e4SLinus Torvalds * interface as the means of communication with the user level. 51da177e4SLinus Torvalds * 61da177e4SLinus Torvalds * IPv4 Forwarding Information Base: policy rules. 71da177e4SLinus Torvalds * 81da177e4SLinus Torvalds * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru> 9e1ef4bf2SThomas Graf * Thomas Graf <tgraf@suug.ch> 101da177e4SLinus Torvalds * 111da177e4SLinus Torvalds * This program is free software; you can redistribute it and/or 121da177e4SLinus Torvalds * modify it under the terms of the GNU General Public License 131da177e4SLinus Torvalds * as published by the Free Software Foundation; either version 141da177e4SLinus Torvalds * 2 of the License, or (at your option) any later version. 151da177e4SLinus Torvalds * 161da177e4SLinus Torvalds * Fixes: 171da177e4SLinus Torvalds * Rani Assaf : local_rule cannot be deleted 181da177e4SLinus Torvalds * Marc Boucher : routing by fwmark 191da177e4SLinus Torvalds */ 201da177e4SLinus Torvalds 211da177e4SLinus Torvalds #include <linux/types.h> 221da177e4SLinus Torvalds #include <linux/kernel.h> 231da177e4SLinus Torvalds #include <linux/netdevice.h> 241da177e4SLinus Torvalds #include <linux/netlink.h> 25e1ef4bf2SThomas Graf #include <linux/inetdevice.h> 261da177e4SLinus Torvalds #include <linux/init.h> 277b204afdSRobert Olsson #include <linux/list.h> 287b204afdSRobert Olsson #include <linux/rcupdate.h> 29bc3b2d7fSPaul Gortmaker #include <linux/export.h> 301da177e4SLinus Torvalds #include <net/ip.h> 311da177e4SLinus Torvalds #include <net/route.h> 321da177e4SLinus Torvalds #include <net/tcp.h> 331da177e4SLinus Torvalds #include <net/ip_fib.h> 34e1ef4bf2SThomas Graf #include <net/fib_rules.h> 351da177e4SLinus Torvalds 366a31d2a9SEric Dumazet struct fib4_rule { 37e1ef4bf2SThomas Graf struct fib_rule common; 38e1ef4bf2SThomas Graf u8 dst_len; 39e1ef4bf2SThomas Graf u8 src_len; 40e1ef4bf2SThomas Graf u8 tos; 4181f7bf6cSAl Viro __be32 src; 4281f7bf6cSAl Viro __be32 srcmask; 4381f7bf6cSAl Viro __be32 dst; 4481f7bf6cSAl Viro __be32 dstmask; 45c7066f70SPatrick McHardy #ifdef CONFIG_IP_ROUTE_CLASSID 46e1ef4bf2SThomas Graf u32 tclassid; 471da177e4SLinus Torvalds #endif 481da177e4SLinus Torvalds }; 491da177e4SLinus Torvalds 500eeb075fSAndy Gospodarek int __fib_lookup(struct net *net, struct flowi4 *flp, 510eeb075fSAndy Gospodarek struct fib_result *res, unsigned int flags) 52e1ef4bf2SThomas Graf { 53e1ef4bf2SThomas Graf struct fib_lookup_arg arg = { 54e1ef4bf2SThomas Graf .result = res, 550eeb075fSAndy Gospodarek .flags = flags, 56e1ef4bf2SThomas Graf }; 57e1ef4bf2SThomas Graf int err; 58e1ef4bf2SThomas Graf 5922bd5b9bSDavid S. Miller err = fib_rules_lookup(net->ipv4.rules_ops, flowi4_to_flowi(flp), 0, &arg); 6085b91b03SDavid S. Miller #ifdef CONFIG_IP_ROUTE_CLASSID 6185b91b03SDavid S. Miller if (arg.rule) 6285b91b03SDavid S. Miller res->tclassid = ((struct fib4_rule *)arg.rule)->tclassid; 6385b91b03SDavid S. Miller else 6485b91b03SDavid S. Miller res->tclassid = 0; 6585b91b03SDavid S. Miller #endif 6649dd18baSPanu Matilainen 6749dd18baSPanu Matilainen if (err == -ESRCH) 6849dd18baSPanu Matilainen err = -ENETUNREACH; 6949dd18baSPanu Matilainen 701da177e4SLinus Torvalds return err; 711da177e4SLinus Torvalds } 72f4530fa5SDavid S. Miller EXPORT_SYMBOL_GPL(__fib_lookup); 731da177e4SLinus Torvalds 748ce11e6aSAdrian Bunk static int fib4_rule_action(struct fib_rule *rule, struct flowi *flp, 758ce11e6aSAdrian Bunk int flags, struct fib_lookup_arg *arg) 76e1ef4bf2SThomas Graf { 77e1ef4bf2SThomas Graf int err = -EAGAIN; 78e1ef4bf2SThomas Graf struct fib_table *tbl; 79*96c63fa7SDavid Ahern u32 tb_id; 80e1ef4bf2SThomas Graf 81e1ef4bf2SThomas Graf switch (rule->action) { 82e1ef4bf2SThomas Graf case FR_ACT_TO_TBL: 83e1ef4bf2SThomas Graf break; 84e1ef4bf2SThomas Graf 85e1ef4bf2SThomas Graf case FR_ACT_UNREACHABLE: 86345e9b54SAlexander Duyck return -ENETUNREACH; 87e1ef4bf2SThomas Graf 88e1ef4bf2SThomas Graf case FR_ACT_PROHIBIT: 89345e9b54SAlexander Duyck return -EACCES; 90e1ef4bf2SThomas Graf 91e1ef4bf2SThomas Graf case FR_ACT_BLACKHOLE: 92e1ef4bf2SThomas Graf default: 93345e9b54SAlexander Duyck return -EINVAL; 94e1ef4bf2SThomas Graf } 95e1ef4bf2SThomas Graf 96345e9b54SAlexander Duyck rcu_read_lock(); 97e1ef4bf2SThomas Graf 98*96c63fa7SDavid Ahern tb_id = fib_rule_get_table(rule, arg); 99*96c63fa7SDavid Ahern tbl = fib_get_table(rule->fr_net, tb_id); 100345e9b54SAlexander Duyck if (tbl) 101345e9b54SAlexander Duyck err = fib_table_lookup(tbl, &flp->u.ip4, 102345e9b54SAlexander Duyck (struct fib_result *)arg->result, 103345e9b54SAlexander Duyck arg->flags); 104345e9b54SAlexander Duyck 105345e9b54SAlexander Duyck rcu_read_unlock(); 106e1ef4bf2SThomas Graf return err; 107e1ef4bf2SThomas Graf } 108e1ef4bf2SThomas Graf 1097764a45aSStefan Tomanek static bool fib4_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg) 1107764a45aSStefan Tomanek { 1116ef94cfaSStefan Tomanek struct fib_result *result = (struct fib_result *) arg->result; 112673498b8SStefan Tomanek struct net_device *dev = NULL; 113673498b8SStefan Tomanek 114673498b8SStefan Tomanek if (result->fi) 115673498b8SStefan Tomanek dev = result->fi->fib_dev; 1166ef94cfaSStefan Tomanek 1177764a45aSStefan Tomanek /* do not accept result if the route does 1187764a45aSStefan Tomanek * not meet the required prefix length 1197764a45aSStefan Tomanek */ 12073f5698eSStefan Tomanek if (result->prefixlen <= rule->suppress_prefixlen) 1216ef94cfaSStefan Tomanek goto suppress_route; 1226ef94cfaSStefan Tomanek 1236ef94cfaSStefan Tomanek /* do not accept result if the route uses a device 1246ef94cfaSStefan Tomanek * belonging to a forbidden interface group 1256ef94cfaSStefan Tomanek */ 1266ef94cfaSStefan Tomanek if (rule->suppress_ifgroup != -1 && dev && dev->group == rule->suppress_ifgroup) 1276ef94cfaSStefan Tomanek goto suppress_route; 1286ef94cfaSStefan Tomanek 1296ef94cfaSStefan Tomanek return false; 1306ef94cfaSStefan Tomanek 1316ef94cfaSStefan Tomanek suppress_route: 1327764a45aSStefan Tomanek if (!(arg->flags & FIB_LOOKUP_NOREF)) 1337764a45aSStefan Tomanek fib_info_put(result->fi); 1347764a45aSStefan Tomanek return true; 1357764a45aSStefan Tomanek } 136e1ef4bf2SThomas Graf 137e1ef4bf2SThomas Graf static int fib4_rule_match(struct fib_rule *rule, struct flowi *fl, int flags) 138e1ef4bf2SThomas Graf { 139e1ef4bf2SThomas Graf struct fib4_rule *r = (struct fib4_rule *) rule; 1409ade2286SDavid S. Miller struct flowi4 *fl4 = &fl->u.ip4; 1419ade2286SDavid S. Miller __be32 daddr = fl4->daddr; 1429ade2286SDavid S. Miller __be32 saddr = fl4->saddr; 143e1ef4bf2SThomas Graf 144e1ef4bf2SThomas Graf if (((saddr ^ r->src) & r->srcmask) || 145e1ef4bf2SThomas Graf ((daddr ^ r->dst) & r->dstmask)) 146e1ef4bf2SThomas Graf return 0; 147e1ef4bf2SThomas Graf 1489ade2286SDavid S. Miller if (r->tos && (r->tos != fl4->flowi4_tos)) 149e1ef4bf2SThomas Graf return 0; 150e1ef4bf2SThomas Graf 151e1ef4bf2SThomas Graf return 1; 152e1ef4bf2SThomas Graf } 1531da177e4SLinus Torvalds 1548ad4942cSDenis V. Lunev static struct fib_table *fib_empty_table(struct net *net) 1551da177e4SLinus Torvalds { 1562dfe55b4SPatrick McHardy u32 id; 1571da177e4SLinus Torvalds 1581da177e4SLinus Torvalds for (id = 1; id <= RT_TABLE_MAX; id++) 15951456b29SIan Morris if (!fib_get_table(net, id)) 1608ad4942cSDenis V. Lunev return fib_new_table(net, id); 1611da177e4SLinus Torvalds return NULL; 1621da177e4SLinus Torvalds } 1631da177e4SLinus Torvalds 164ef7c79edSPatrick McHardy static const struct nla_policy fib4_rule_policy[FRA_MAX+1] = { 1651f6c9557SThomas Graf FRA_GENERIC_POLICY, 166e1ef4bf2SThomas Graf [FRA_FLOW] = { .type = NLA_U32 }, 1671da177e4SLinus Torvalds }; 1681da177e4SLinus Torvalds 169e1ef4bf2SThomas Graf static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb, 1708b3521eeSRami Rosen struct fib_rule_hdr *frh, 171e1ef4bf2SThomas Graf struct nlattr **tb) 1721da177e4SLinus Torvalds { 1733b1e0a65SYOSHIFUJI Hideaki struct net *net = sock_net(skb->sk); 174e1ef4bf2SThomas Graf int err = -EINVAL; 175e1ef4bf2SThomas Graf struct fib4_rule *rule4 = (struct fib4_rule *) rule; 1761da177e4SLinus Torvalds 177e1701c68SThomas Graf if (frh->tos & ~IPTOS_TOS_MASK) 178e1ef4bf2SThomas Graf goto errout; 179e1ef4bf2SThomas Graf 1800ddcf43dSAlexander Duyck /* split local/main if they are not already split */ 1810ddcf43dSAlexander Duyck err = fib_unmerge(net); 1820ddcf43dSAlexander Duyck if (err) 1830ddcf43dSAlexander Duyck goto errout; 1840ddcf43dSAlexander Duyck 185*96c63fa7SDavid Ahern if (rule->table == RT_TABLE_UNSPEC && !rule->l3mdev) { 186e1ef4bf2SThomas Graf if (rule->action == FR_ACT_TO_TBL) { 187e1ef4bf2SThomas Graf struct fib_table *table; 188e1ef4bf2SThomas Graf 189e4e4971cSDenis V. Lunev table = fib_empty_table(net); 19051456b29SIan Morris if (!table) { 191e1ef4bf2SThomas Graf err = -ENOBUFS; 192e1ef4bf2SThomas Graf goto errout; 193e1ef4bf2SThomas Graf } 194e1ef4bf2SThomas Graf 195e1ef4bf2SThomas Graf rule->table = table->tb_id; 196e1ef4bf2SThomas Graf } 197e1ef4bf2SThomas Graf } 198e1ef4bf2SThomas Graf 199e1701c68SThomas Graf if (frh->src_len) 20067b61f6cSJiri Benc rule4->src = nla_get_in_addr(tb[FRA_SRC]); 201e1ef4bf2SThomas Graf 202e1701c68SThomas Graf if (frh->dst_len) 20367b61f6cSJiri Benc rule4->dst = nla_get_in_addr(tb[FRA_DST]); 204e1ef4bf2SThomas Graf 205c7066f70SPatrick McHardy #ifdef CONFIG_IP_ROUTE_CLASSID 2067a9bc9b8SDavid S. Miller if (tb[FRA_FLOW]) { 207e1ef4bf2SThomas Graf rule4->tclassid = nla_get_u32(tb[FRA_FLOW]); 2087a9bc9b8SDavid S. Miller if (rule4->tclassid) 209f4530fa5SDavid S. Miller net->ipv4.fib_num_tclassid_users++; 2107a9bc9b8SDavid S. Miller } 2111da177e4SLinus Torvalds #endif 2121da177e4SLinus Torvalds 213e1ef4bf2SThomas Graf rule4->src_len = frh->src_len; 214e1ef4bf2SThomas Graf rule4->srcmask = inet_make_mask(rule4->src_len); 215e1ef4bf2SThomas Graf rule4->dst_len = frh->dst_len; 216e1ef4bf2SThomas Graf rule4->dstmask = inet_make_mask(rule4->dst_len); 217e1ef4bf2SThomas Graf rule4->tos = frh->tos; 218e1ef4bf2SThomas Graf 219f4530fa5SDavid S. Miller net->ipv4.fib_has_custom_rules = true; 220104616e7SScott Feldman fib_flush_external(rule->fr_net); 221104616e7SScott Feldman 222e1ef4bf2SThomas Graf err = 0; 223e1ef4bf2SThomas Graf errout: 224e1ef4bf2SThomas Graf return err; 2251da177e4SLinus Torvalds } 2261da177e4SLinus Torvalds 2270ddcf43dSAlexander Duyck static int fib4_rule_delete(struct fib_rule *rule) 2287a9bc9b8SDavid S. Miller { 229f4530fa5SDavid S. Miller struct net *net = rule->fr_net; 2300ddcf43dSAlexander Duyck int err; 2317a9bc9b8SDavid S. Miller 2320ddcf43dSAlexander Duyck /* split local/main if they are not already split */ 2330ddcf43dSAlexander Duyck err = fib_unmerge(net); 2340ddcf43dSAlexander Duyck if (err) 2350ddcf43dSAlexander Duyck goto errout; 2360ddcf43dSAlexander Duyck 2370ddcf43dSAlexander Duyck #ifdef CONFIG_IP_ROUTE_CLASSID 2380ddcf43dSAlexander Duyck if (((struct fib4_rule *)rule)->tclassid) 239f4530fa5SDavid S. Miller net->ipv4.fib_num_tclassid_users--; 2407a9bc9b8SDavid S. Miller #endif 241f4530fa5SDavid S. Miller net->ipv4.fib_has_custom_rules = true; 242104616e7SScott Feldman fib_flush_external(rule->fr_net); 2430ddcf43dSAlexander Duyck errout: 2440ddcf43dSAlexander Duyck return err; 2457a9bc9b8SDavid S. Miller } 2467a9bc9b8SDavid S. Miller 247e1ef4bf2SThomas Graf static int fib4_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh, 248e1ef4bf2SThomas Graf struct nlattr **tb) 249a5cdc030SPatrick McHardy { 250e1ef4bf2SThomas Graf struct fib4_rule *rule4 = (struct fib4_rule *) rule; 251a5cdc030SPatrick McHardy 252e1ef4bf2SThomas Graf if (frh->src_len && (rule4->src_len != frh->src_len)) 253e1ef4bf2SThomas Graf return 0; 254e1ef4bf2SThomas Graf 255e1ef4bf2SThomas Graf if (frh->dst_len && (rule4->dst_len != frh->dst_len)) 256e1ef4bf2SThomas Graf return 0; 257e1ef4bf2SThomas Graf 258e1ef4bf2SThomas Graf if (frh->tos && (rule4->tos != frh->tos)) 259e1ef4bf2SThomas Graf return 0; 260e1ef4bf2SThomas Graf 261c7066f70SPatrick McHardy #ifdef CONFIG_IP_ROUTE_CLASSID 262e1ef4bf2SThomas Graf if (tb[FRA_FLOW] && (rule4->tclassid != nla_get_u32(tb[FRA_FLOW]))) 263e1ef4bf2SThomas Graf return 0; 264e1ef4bf2SThomas Graf #endif 265e1ef4bf2SThomas Graf 26667b61f6cSJiri Benc if (frh->src_len && (rule4->src != nla_get_in_addr(tb[FRA_SRC]))) 267e1ef4bf2SThomas Graf return 0; 268e1ef4bf2SThomas Graf 26967b61f6cSJiri Benc if (frh->dst_len && (rule4->dst != nla_get_in_addr(tb[FRA_DST]))) 270e1ef4bf2SThomas Graf return 0; 271e1ef4bf2SThomas Graf 272e1ef4bf2SThomas Graf return 1; 273a5cdc030SPatrick McHardy } 274a5cdc030SPatrick McHardy 275e1ef4bf2SThomas Graf static int fib4_rule_fill(struct fib_rule *rule, struct sk_buff *skb, 27604af8cf6SRami Rosen struct fib_rule_hdr *frh) 2771da177e4SLinus Torvalds { 278e1ef4bf2SThomas Graf struct fib4_rule *rule4 = (struct fib4_rule *) rule; 2791da177e4SLinus Torvalds 280e1ef4bf2SThomas Graf frh->dst_len = rule4->dst_len; 281e1ef4bf2SThomas Graf frh->src_len = rule4->src_len; 282e1ef4bf2SThomas Graf frh->tos = rule4->tos; 2831da177e4SLinus Torvalds 284f3756b79SDavid S. Miller if ((rule4->dst_len && 285930345eaSJiri Benc nla_put_in_addr(skb, FRA_DST, rule4->dst)) || 286f3756b79SDavid S. Miller (rule4->src_len && 287930345eaSJiri Benc nla_put_in_addr(skb, FRA_SRC, rule4->src))) 288f3756b79SDavid S. Miller goto nla_put_failure; 289c7066f70SPatrick McHardy #ifdef CONFIG_IP_ROUTE_CLASSID 290f3756b79SDavid S. Miller if (rule4->tclassid && 291f3756b79SDavid S. Miller nla_put_u32(skb, FRA_FLOW, rule4->tclassid)) 292f3756b79SDavid S. Miller goto nla_put_failure; 293e1ef4bf2SThomas Graf #endif 294e1ef4bf2SThomas Graf return 0; 295e1ef4bf2SThomas Graf 296e1ef4bf2SThomas Graf nla_put_failure: 297e1ef4bf2SThomas Graf return -ENOBUFS; 2981da177e4SLinus Torvalds } 2991da177e4SLinus Torvalds 300339bf98fSThomas Graf static size_t fib4_rule_nlmsg_payload(struct fib_rule *rule) 301339bf98fSThomas Graf { 302339bf98fSThomas Graf return nla_total_size(4) /* dst */ 303339bf98fSThomas Graf + nla_total_size(4) /* src */ 304339bf98fSThomas Graf + nla_total_size(4); /* flow */ 305339bf98fSThomas Graf } 306339bf98fSThomas Graf 307ae299fc0SDenis V. Lunev static void fib4_rule_flush_cache(struct fib_rules_ops *ops) 30873417f61SThomas Graf { 309bafa6d9dSNicolas Dichtel rt_cache_flush(ops->fro_net); 31073417f61SThomas Graf } 31173417f61SThomas Graf 31204a6f82cSAndi Kleen static const struct fib_rules_ops __net_initconst fib4_rules_ops_template = { 31325239ceeSPatrick McHardy .family = AF_INET, 314e1ef4bf2SThomas Graf .rule_size = sizeof(struct fib4_rule), 315e1701c68SThomas Graf .addr_size = sizeof(u32), 316e1ef4bf2SThomas Graf .action = fib4_rule_action, 3177764a45aSStefan Tomanek .suppress = fib4_rule_suppress, 318e1ef4bf2SThomas Graf .match = fib4_rule_match, 319e1ef4bf2SThomas Graf .configure = fib4_rule_configure, 3207a9bc9b8SDavid S. Miller .delete = fib4_rule_delete, 321e1ef4bf2SThomas Graf .compare = fib4_rule_compare, 322e1ef4bf2SThomas Graf .fill = fib4_rule_fill, 323339bf98fSThomas Graf .nlmsg_payload = fib4_rule_nlmsg_payload, 32473417f61SThomas Graf .flush_cache = fib4_rule_flush_cache, 325e1ef4bf2SThomas Graf .nlgroup = RTNLGRP_IPV4_RULE, 326e1ef4bf2SThomas Graf .policy = fib4_rule_policy, 327e1ef4bf2SThomas Graf .owner = THIS_MODULE, 328e1ef4bf2SThomas Graf }; 329e1ef4bf2SThomas Graf 330e4e4971cSDenis V. Lunev static int fib_default_rules_init(struct fib_rules_ops *ops) 3312994c638SDenis V. Lunev { 3322994c638SDenis V. Lunev int err; 3332994c638SDenis V. Lunev 3345adef180SPatrick McHardy err = fib_default_rule_add(ops, 0, RT_TABLE_LOCAL, 0); 3352994c638SDenis V. Lunev if (err < 0) 3362994c638SDenis V. Lunev return err; 337e4e4971cSDenis V. Lunev err = fib_default_rule_add(ops, 0x7FFE, RT_TABLE_MAIN, 0); 3382994c638SDenis V. Lunev if (err < 0) 3392994c638SDenis V. Lunev return err; 340e4e4971cSDenis V. Lunev err = fib_default_rule_add(ops, 0x7FFF, RT_TABLE_DEFAULT, 0); 3412994c638SDenis V. Lunev if (err < 0) 3422994c638SDenis V. Lunev return err; 3432994c638SDenis V. Lunev return 0; 3442994c638SDenis V. Lunev } 3452994c638SDenis V. Lunev 3467b1a74fdSDenis V. Lunev int __net_init fib4_rules_init(struct net *net) 347e1ef4bf2SThomas Graf { 348dbb50165SDenis V. Lunev int err; 349e4e4971cSDenis V. Lunev struct fib_rules_ops *ops; 350dbb50165SDenis V. Lunev 351e9c5158aSEric W. Biederman ops = fib_rules_register(&fib4_rules_ops_template, net); 352e9c5158aSEric W. Biederman if (IS_ERR(ops)) 353e9c5158aSEric W. Biederman return PTR_ERR(ops); 354e4e4971cSDenis V. Lunev 355e4e4971cSDenis V. Lunev err = fib_default_rules_init(ops); 356dbb50165SDenis V. Lunev if (err < 0) 357dbb50165SDenis V. Lunev goto fail; 358e4e4971cSDenis V. Lunev net->ipv4.rules_ops = ops; 359f4530fa5SDavid S. Miller net->ipv4.fib_has_custom_rules = false; 360dbb50165SDenis V. Lunev return 0; 361dbb50165SDenis V. Lunev 362dbb50165SDenis V. Lunev fail: 363dbb50165SDenis V. Lunev /* also cleans all rules already added */ 3649e3a5487SDenis V. Lunev fib_rules_unregister(ops); 365dbb50165SDenis V. Lunev return err; 366e1ef4bf2SThomas Graf } 3677b1a74fdSDenis V. Lunev 3687b1a74fdSDenis V. Lunev void __net_exit fib4_rules_exit(struct net *net) 3697b1a74fdSDenis V. Lunev { 3709e3a5487SDenis V. Lunev fib_rules_unregister(net->ipv4.rules_ops); 3717b1a74fdSDenis V. Lunev } 372