xref: /linux/net/ipv4/fib_rules.c (revision 26b0d14106954ae46d2f4f7eec3481828a210f7d)
1 /*
2  * INET		An implementation of the TCP/IP protocol suite for the LINUX
3  *		operating system.  INET is implemented using the  BSD Socket
4  *		interface as the means of communication with the user level.
5  *
6  *		IPv4 Forwarding Information Base: policy rules.
7  *
8  * Authors:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
9  *		Thomas Graf <tgraf@suug.ch>
10  *
11  *		This program is free software; you can redistribute it and/or
12  *		modify it under the terms of the GNU General Public License
13  *		as published by the Free Software Foundation; either version
14  *		2 of the License, or (at your option) any later version.
15  *
16  * Fixes:
17  *		Rani Assaf	:	local_rule cannot be deleted
18  *		Marc Boucher	:	routing by fwmark
19  */
20 
21 #include <linux/types.h>
22 #include <linux/kernel.h>
23 #include <linux/netdevice.h>
24 #include <linux/netlink.h>
25 #include <linux/inetdevice.h>
26 #include <linux/init.h>
27 #include <linux/list.h>
28 #include <linux/rcupdate.h>
29 #include <linux/export.h>
30 #include <net/ip.h>
31 #include <net/route.h>
32 #include <net/tcp.h>
33 #include <net/ip_fib.h>
34 #include <net/fib_rules.h>
35 
36 struct fib4_rule {
37 	struct fib_rule		common;
38 	u8			dst_len;
39 	u8			src_len;
40 	u8			tos;
41 	__be32			src;
42 	__be32			srcmask;
43 	__be32			dst;
44 	__be32			dstmask;
45 #ifdef CONFIG_IP_ROUTE_CLASSID
46 	u32			tclassid;
47 #endif
48 };
49 
50 #ifdef CONFIG_IP_ROUTE_CLASSID
51 u32 fib_rules_tclass(const struct fib_result *res)
52 {
53 	return res->r ? ((struct fib4_rule *) res->r)->tclassid : 0;
54 }
55 #endif
56 
57 int fib_lookup(struct net *net, struct flowi4 *flp, struct fib_result *res)
58 {
59 	struct fib_lookup_arg arg = {
60 		.result = res,
61 		.flags = FIB_LOOKUP_NOREF,
62 	};
63 	int err;
64 
65 	err = fib_rules_lookup(net->ipv4.rules_ops, flowi4_to_flowi(flp), 0, &arg);
66 	res->r = arg.rule;
67 
68 	return err;
69 }
70 EXPORT_SYMBOL_GPL(fib_lookup);
71 
72 static int fib4_rule_action(struct fib_rule *rule, struct flowi *flp,
73 			    int flags, struct fib_lookup_arg *arg)
74 {
75 	int err = -EAGAIN;
76 	struct fib_table *tbl;
77 
78 	switch (rule->action) {
79 	case FR_ACT_TO_TBL:
80 		break;
81 
82 	case FR_ACT_UNREACHABLE:
83 		err = -ENETUNREACH;
84 		goto errout;
85 
86 	case FR_ACT_PROHIBIT:
87 		err = -EACCES;
88 		goto errout;
89 
90 	case FR_ACT_BLACKHOLE:
91 	default:
92 		err = -EINVAL;
93 		goto errout;
94 	}
95 
96 	tbl = fib_get_table(rule->fr_net, rule->table);
97 	if (!tbl)
98 		goto errout;
99 
100 	err = fib_table_lookup(tbl, &flp->u.ip4, (struct fib_result *) arg->result, arg->flags);
101 	if (err > 0)
102 		err = -EAGAIN;
103 errout:
104 	return err;
105 }
106 
107 
108 static int fib4_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
109 {
110 	struct fib4_rule *r = (struct fib4_rule *) rule;
111 	struct flowi4 *fl4 = &fl->u.ip4;
112 	__be32 daddr = fl4->daddr;
113 	__be32 saddr = fl4->saddr;
114 
115 	if (((saddr ^ r->src) & r->srcmask) ||
116 	    ((daddr ^ r->dst) & r->dstmask))
117 		return 0;
118 
119 	if (r->tos && (r->tos != fl4->flowi4_tos))
120 		return 0;
121 
122 	return 1;
123 }
124 
125 static struct fib_table *fib_empty_table(struct net *net)
126 {
127 	u32 id;
128 
129 	for (id = 1; id <= RT_TABLE_MAX; id++)
130 		if (fib_get_table(net, id) == NULL)
131 			return fib_new_table(net, id);
132 	return NULL;
133 }
134 
135 static const struct nla_policy fib4_rule_policy[FRA_MAX+1] = {
136 	FRA_GENERIC_POLICY,
137 	[FRA_FLOW]	= { .type = NLA_U32 },
138 };
139 
140 static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
141 			       struct fib_rule_hdr *frh,
142 			       struct nlattr **tb)
143 {
144 	struct net *net = sock_net(skb->sk);
145 	int err = -EINVAL;
146 	struct fib4_rule *rule4 = (struct fib4_rule *) rule;
147 
148 	if (frh->tos & ~IPTOS_TOS_MASK)
149 		goto errout;
150 
151 	if (rule->table == RT_TABLE_UNSPEC) {
152 		if (rule->action == FR_ACT_TO_TBL) {
153 			struct fib_table *table;
154 
155 			table = fib_empty_table(net);
156 			if (table == NULL) {
157 				err = -ENOBUFS;
158 				goto errout;
159 			}
160 
161 			rule->table = table->tb_id;
162 		}
163 	}
164 
165 	if (frh->src_len)
166 		rule4->src = nla_get_be32(tb[FRA_SRC]);
167 
168 	if (frh->dst_len)
169 		rule4->dst = nla_get_be32(tb[FRA_DST]);
170 
171 #ifdef CONFIG_IP_ROUTE_CLASSID
172 	if (tb[FRA_FLOW])
173 		rule4->tclassid = nla_get_u32(tb[FRA_FLOW]);
174 #endif
175 
176 	rule4->src_len = frh->src_len;
177 	rule4->srcmask = inet_make_mask(rule4->src_len);
178 	rule4->dst_len = frh->dst_len;
179 	rule4->dstmask = inet_make_mask(rule4->dst_len);
180 	rule4->tos = frh->tos;
181 
182 	err = 0;
183 errout:
184 	return err;
185 }
186 
187 static int fib4_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
188 			     struct nlattr **tb)
189 {
190 	struct fib4_rule *rule4 = (struct fib4_rule *) rule;
191 
192 	if (frh->src_len && (rule4->src_len != frh->src_len))
193 		return 0;
194 
195 	if (frh->dst_len && (rule4->dst_len != frh->dst_len))
196 		return 0;
197 
198 	if (frh->tos && (rule4->tos != frh->tos))
199 		return 0;
200 
201 #ifdef CONFIG_IP_ROUTE_CLASSID
202 	if (tb[FRA_FLOW] && (rule4->tclassid != nla_get_u32(tb[FRA_FLOW])))
203 		return 0;
204 #endif
205 
206 	if (frh->src_len && (rule4->src != nla_get_be32(tb[FRA_SRC])))
207 		return 0;
208 
209 	if (frh->dst_len && (rule4->dst != nla_get_be32(tb[FRA_DST])))
210 		return 0;
211 
212 	return 1;
213 }
214 
215 static int fib4_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
216 			  struct fib_rule_hdr *frh)
217 {
218 	struct fib4_rule *rule4 = (struct fib4_rule *) rule;
219 
220 	frh->dst_len = rule4->dst_len;
221 	frh->src_len = rule4->src_len;
222 	frh->tos = rule4->tos;
223 
224 	if ((rule4->dst_len &&
225 	     nla_put_be32(skb, FRA_DST, rule4->dst)) ||
226 	    (rule4->src_len &&
227 	     nla_put_be32(skb, FRA_SRC, rule4->src)))
228 		goto nla_put_failure;
229 #ifdef CONFIG_IP_ROUTE_CLASSID
230 	if (rule4->tclassid &&
231 	    nla_put_u32(skb, FRA_FLOW, rule4->tclassid))
232 		goto nla_put_failure;
233 #endif
234 	return 0;
235 
236 nla_put_failure:
237 	return -ENOBUFS;
238 }
239 
240 static size_t fib4_rule_nlmsg_payload(struct fib_rule *rule)
241 {
242 	return nla_total_size(4) /* dst */
243 	       + nla_total_size(4) /* src */
244 	       + nla_total_size(4); /* flow */
245 }
246 
247 static void fib4_rule_flush_cache(struct fib_rules_ops *ops)
248 {
249 	rt_cache_flush(ops->fro_net, -1);
250 }
251 
252 static const struct fib_rules_ops __net_initdata fib4_rules_ops_template = {
253 	.family		= AF_INET,
254 	.rule_size	= sizeof(struct fib4_rule),
255 	.addr_size	= sizeof(u32),
256 	.action		= fib4_rule_action,
257 	.match		= fib4_rule_match,
258 	.configure	= fib4_rule_configure,
259 	.compare	= fib4_rule_compare,
260 	.fill		= fib4_rule_fill,
261 	.default_pref	= fib_default_rule_pref,
262 	.nlmsg_payload	= fib4_rule_nlmsg_payload,
263 	.flush_cache	= fib4_rule_flush_cache,
264 	.nlgroup	= RTNLGRP_IPV4_RULE,
265 	.policy		= fib4_rule_policy,
266 	.owner		= THIS_MODULE,
267 };
268 
269 static int fib_default_rules_init(struct fib_rules_ops *ops)
270 {
271 	int err;
272 
273 	err = fib_default_rule_add(ops, 0, RT_TABLE_LOCAL, 0);
274 	if (err < 0)
275 		return err;
276 	err = fib_default_rule_add(ops, 0x7FFE, RT_TABLE_MAIN, 0);
277 	if (err < 0)
278 		return err;
279 	err = fib_default_rule_add(ops, 0x7FFF, RT_TABLE_DEFAULT, 0);
280 	if (err < 0)
281 		return err;
282 	return 0;
283 }
284 
285 int __net_init fib4_rules_init(struct net *net)
286 {
287 	int err;
288 	struct fib_rules_ops *ops;
289 
290 	ops = fib_rules_register(&fib4_rules_ops_template, net);
291 	if (IS_ERR(ops))
292 		return PTR_ERR(ops);
293 
294 	err = fib_default_rules_init(ops);
295 	if (err < 0)
296 		goto fail;
297 	net->ipv4.rules_ops = ops;
298 	return 0;
299 
300 fail:
301 	/* also cleans all rules already added */
302 	fib_rules_unregister(ops);
303 	return err;
304 }
305 
306 void __net_exit fib4_rules_exit(struct net *net)
307 {
308 	fib_rules_unregister(net->ipv4.rules_ops);
309 }
310