1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * net/ipv6/fib6_rules.c IPv6 Routing Policy Rules 4 * 5 * Copyright (C)2003-2006 Helsinki University of Technology 6 * Copyright (C)2003-2006 USAGI/WIDE Project 7 * 8 * Authors 9 * Thomas Graf <tgraf@suug.ch> 10 * Ville Nuorvala <vnuorval@tcs.hut.fi> 11 */ 12 13 #include <linux/netdevice.h> 14 #include <linux/notifier.h> 15 #include <linux/export.h> 16 #include <linux/indirect_call_wrapper.h> 17 18 #include <net/fib_rules.h> 19 #include <net/inet_dscp.h> 20 #include <net/ipv6.h> 21 #include <net/addrconf.h> 22 #include <net/ip6_route.h> 23 #include <net/netlink.h> 24 25 struct fib6_rule { 26 struct fib_rule common; 27 struct rt6key src; 28 struct rt6key dst; 29 __be32 flowlabel; 30 __be32 flowlabel_mask; 31 dscp_t dscp; 32 dscp_t dscp_mask; 33 u8 dscp_full:1; /* DSCP or TOS selector */ 34 }; 35 36 static bool fib6_rule_matchall(const struct fib_rule *rule) 37 { 38 struct fib6_rule *r = container_of(rule, struct fib6_rule, common); 39 40 if (r->dst.plen || r->src.plen || r->dscp || r->flowlabel_mask) 41 return false; 42 return fib_rule_matchall(rule); 43 } 44 45 bool fib6_rule_default(const struct fib_rule *rule) 46 { 47 if (!fib6_rule_matchall(rule) || rule->action != FR_ACT_TO_TBL || 48 rule->l3mdev) 49 return false; 50 if (rule->table != RT6_TABLE_LOCAL && rule->table != RT6_TABLE_MAIN) 51 return false; 52 return true; 53 } 54 EXPORT_SYMBOL_GPL(fib6_rule_default); 55 56 int fib6_rules_dump(struct net *net, struct notifier_block *nb, 57 struct netlink_ext_ack *extack) 58 { 59 return fib_rules_dump(net, nb, AF_INET6, extack); 60 } 61 62 unsigned int fib6_rules_seq_read(const struct net *net) 63 { 64 return fib_rules_seq_read(net, AF_INET6); 65 } 66 67 /* called with rcu lock held; no reference taken on fib6_info */ 68 int fib6_lookup(struct net *net, int oif, struct flowi6 *fl6, 69 struct fib6_result *res, int flags) 70 { 71 int err; 72 73 if (net->ipv6.fib6_has_custom_rules) { 74 struct fib_lookup_arg arg = { 75 .lookup_ptr = fib6_table_lookup, 76 .lookup_data = &oif, 77 .result = res, 78 .flags = FIB_LOOKUP_NOREF, 79 }; 80 81 l3mdev_update_flow(net, flowi6_to_flowi(fl6)); 82 83 err = fib_rules_lookup(net->ipv6.fib6_rules_ops, 84 flowi6_to_flowi(fl6), flags, &arg); 85 } else { 86 err = fib6_table_lookup(net, net->ipv6.fib6_local_tbl, oif, 87 fl6, res, flags); 88 if (err || res->f6i == net->ipv6.fib6_null_entry) 89 err = fib6_table_lookup(net, net->ipv6.fib6_main_tbl, 90 oif, fl6, res, flags); 91 } 92 93 return err; 94 } 95 #if IS_MODULE(CONFIG_NFT_FIB_IPV6) 96 EXPORT_SYMBOL_GPL(fib6_lookup); 97 #endif 98 99 struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6, 100 const struct sk_buff *skb, 101 int flags, pol_lookup_t lookup) 102 { 103 if (net->ipv6.fib6_has_custom_rules) { 104 struct fib6_result res = {}; 105 struct fib_lookup_arg arg = { 106 .lookup_ptr = lookup, 107 .lookup_data = skb, 108 .result = &res, 109 .flags = FIB_LOOKUP_NOREF, 110 }; 111 112 /* update flow if oif or iif point to device enslaved to l3mdev */ 113 l3mdev_update_flow(net, flowi6_to_flowi(fl6)); 114 115 fib_rules_lookup(net->ipv6.fib6_rules_ops, 116 flowi6_to_flowi(fl6), flags, &arg); 117 118 if (res.rt6) 119 return &res.rt6->dst; 120 } else { 121 struct rt6_info *rt; 122 123 rt = pol_lookup_func(lookup, 124 net, net->ipv6.fib6_local_tbl, fl6, skb, flags); 125 if (rt != net->ipv6.ip6_null_entry && rt->dst.error != -EAGAIN) 126 return &rt->dst; 127 ip6_rt_put_flags(rt, flags); 128 rt = pol_lookup_func(lookup, 129 net, net->ipv6.fib6_main_tbl, fl6, skb, flags); 130 if (rt->dst.error != -EAGAIN) 131 return &rt->dst; 132 ip6_rt_put_flags(rt, flags); 133 } 134 135 if (!(flags & RT6_LOOKUP_F_DST_NOREF)) 136 dst_hold(&net->ipv6.ip6_null_entry->dst); 137 return &net->ipv6.ip6_null_entry->dst; 138 } 139 140 static int fib6_rule_saddr(struct net *net, struct fib_rule *rule, int flags, 141 struct flowi6 *flp6, const struct net_device *dev) 142 { 143 struct fib6_rule *r = (struct fib6_rule *)rule; 144 145 /* If we need to find a source address for this traffic, 146 * we check the result if it meets requirement of the rule. 147 */ 148 if ((rule->flags & FIB_RULE_FIND_SADDR) && 149 r->src.plen && !(flags & RT6_LOOKUP_F_HAS_SADDR)) { 150 struct in6_addr saddr; 151 152 if (ipv6_dev_get_saddr(net, dev, &flp6->daddr, 153 rt6_flags2srcprefs(flags), &saddr)) 154 return -EAGAIN; 155 156 if (!ipv6_prefix_equal(&saddr, &r->src.addr, r->src.plen)) 157 return -EAGAIN; 158 159 flp6->saddr = saddr; 160 } 161 162 return 0; 163 } 164 165 static int fib6_rule_action_alt(struct fib_rule *rule, struct flowi *flp, 166 int flags, struct fib_lookup_arg *arg) 167 { 168 struct fib6_result *res = arg->result; 169 struct flowi6 *flp6 = &flp->u.ip6; 170 struct net *net = rule->fr_net; 171 struct fib6_table *table; 172 int err, *oif; 173 u32 tb_id; 174 175 switch (rule->action) { 176 case FR_ACT_TO_TBL: 177 break; 178 case FR_ACT_UNREACHABLE: 179 return -ENETUNREACH; 180 case FR_ACT_PROHIBIT: 181 return -EACCES; 182 case FR_ACT_BLACKHOLE: 183 default: 184 return -EINVAL; 185 } 186 187 tb_id = fib_rule_get_table(rule, arg); 188 table = fib6_get_table(net, tb_id); 189 if (!table) 190 return -EAGAIN; 191 192 oif = (int *)arg->lookup_data; 193 err = fib6_table_lookup(net, table, *oif, flp6, res, flags); 194 if (!err && res->f6i != net->ipv6.fib6_null_entry) 195 err = fib6_rule_saddr(net, rule, flags, flp6, 196 res->nh->fib_nh_dev); 197 else 198 err = -EAGAIN; 199 200 return err; 201 } 202 203 static int __fib6_rule_action(struct fib_rule *rule, struct flowi *flp, 204 int flags, struct fib_lookup_arg *arg) 205 { 206 struct fib6_result *res = arg->result; 207 struct flowi6 *flp6 = &flp->u.ip6; 208 struct rt6_info *rt = NULL; 209 struct fib6_table *table; 210 struct net *net = rule->fr_net; 211 pol_lookup_t lookup = arg->lookup_ptr; 212 int err = 0; 213 u32 tb_id; 214 215 switch (rule->action) { 216 case FR_ACT_TO_TBL: 217 break; 218 case FR_ACT_UNREACHABLE: 219 err = -ENETUNREACH; 220 rt = net->ipv6.ip6_null_entry; 221 goto discard_pkt; 222 default: 223 case FR_ACT_BLACKHOLE: 224 err = -EINVAL; 225 rt = net->ipv6.ip6_blk_hole_entry; 226 goto discard_pkt; 227 case FR_ACT_PROHIBIT: 228 err = -EACCES; 229 rt = net->ipv6.ip6_prohibit_entry; 230 goto discard_pkt; 231 } 232 233 tb_id = fib_rule_get_table(rule, arg); 234 table = fib6_get_table(net, tb_id); 235 if (!table) { 236 err = -EAGAIN; 237 goto out; 238 } 239 240 rt = pol_lookup_func(lookup, 241 net, table, flp6, arg->lookup_data, flags); 242 if (rt != net->ipv6.ip6_null_entry) { 243 struct inet6_dev *idev = ip6_dst_idev(&rt->dst); 244 245 if (!idev) 246 goto again; 247 err = fib6_rule_saddr(net, rule, flags, flp6, 248 idev->dev); 249 250 if (err == -EAGAIN) 251 goto again; 252 253 err = rt->dst.error; 254 if (err != -EAGAIN) 255 goto out; 256 } 257 again: 258 ip6_rt_put_flags(rt, flags); 259 err = -EAGAIN; 260 rt = NULL; 261 goto out; 262 263 discard_pkt: 264 if (!(flags & RT6_LOOKUP_F_DST_NOREF)) 265 dst_hold(&rt->dst); 266 out: 267 res->rt6 = rt; 268 return err; 269 } 270 271 INDIRECT_CALLABLE_SCOPE int fib6_rule_action(struct fib_rule *rule, 272 struct flowi *flp, int flags, 273 struct fib_lookup_arg *arg) 274 { 275 if (arg->lookup_ptr == fib6_table_lookup) 276 return fib6_rule_action_alt(rule, flp, flags, arg); 277 278 return __fib6_rule_action(rule, flp, flags, arg); 279 } 280 281 INDIRECT_CALLABLE_SCOPE bool fib6_rule_suppress(struct fib_rule *rule, 282 int flags, 283 struct fib_lookup_arg *arg) 284 { 285 struct fib6_result *res = arg->result; 286 struct rt6_info *rt = res->rt6; 287 struct net_device *dev = NULL; 288 289 if (!rt) 290 return false; 291 292 if (rt->rt6i_idev) 293 dev = rt->rt6i_idev->dev; 294 295 /* do not accept result if the route does 296 * not meet the required prefix length 297 */ 298 if (rt->rt6i_dst.plen <= rule->suppress_prefixlen) 299 goto suppress_route; 300 301 /* do not accept result if the route uses a device 302 * belonging to a forbidden interface group 303 */ 304 if (rule->suppress_ifgroup != -1 && dev && dev->group == rule->suppress_ifgroup) 305 goto suppress_route; 306 307 return false; 308 309 suppress_route: 310 ip6_rt_put_flags(rt, flags); 311 res->rt6 = NULL; 312 return true; 313 } 314 315 INDIRECT_CALLABLE_SCOPE int fib6_rule_match(struct fib_rule *rule, 316 struct flowi *fl, int flags) 317 { 318 struct fib6_rule *r = (struct fib6_rule *) rule; 319 struct flowi6 *fl6 = &fl->u.ip6; 320 321 if (r->dst.plen && 322 !ipv6_prefix_equal(&fl6->daddr, &r->dst.addr, r->dst.plen)) 323 return 0; 324 325 /* 326 * If FIB_RULE_FIND_SADDR is set and we do not have a 327 * source address for the traffic, we defer check for 328 * source address. 329 */ 330 if (r->src.plen) { 331 if (flags & RT6_LOOKUP_F_HAS_SADDR) { 332 if (!ipv6_prefix_equal(&fl6->saddr, &r->src.addr, 333 r->src.plen)) 334 return 0; 335 } else if (!(r->common.flags & FIB_RULE_FIND_SADDR)) 336 return 0; 337 } 338 339 if ((r->dscp ^ ip6_dscp(fl6->flowlabel)) & r->dscp_mask) 340 return 0; 341 342 if ((r->flowlabel ^ flowi6_get_flowlabel(fl6)) & r->flowlabel_mask) 343 return 0; 344 345 if (rule->ip_proto && (rule->ip_proto != fl6->flowi6_proto)) 346 return 0; 347 348 if (!fib_rule_port_match(&rule->sport_range, rule->sport_mask, 349 fl6->fl6_sport)) 350 return 0; 351 352 if (!fib_rule_port_match(&rule->dport_range, rule->dport_mask, 353 fl6->fl6_dport)) 354 return 0; 355 356 return 1; 357 } 358 359 static int fib6_nl2rule_dscp(const struct nlattr *nla, struct fib6_rule *rule6, 360 struct netlink_ext_ack *extack) 361 { 362 if (rule6->dscp) { 363 NL_SET_ERR_MSG(extack, "Cannot specify both TOS and DSCP"); 364 return -EINVAL; 365 } 366 367 rule6->dscp = inet_dsfield_to_dscp(nla_get_u8(nla) << 2); 368 rule6->dscp_mask = inet_dsfield_to_dscp(INET_DSCP_MASK); 369 rule6->dscp_full = true; 370 371 return 0; 372 } 373 374 static int fib6_nl2rule_dscp_mask(const struct nlattr *nla, 375 struct fib6_rule *rule6, 376 struct netlink_ext_ack *extack) 377 { 378 dscp_t dscp_mask; 379 380 if (!rule6->dscp_full) { 381 NL_SET_ERR_MSG_ATTR(extack, nla, 382 "Cannot specify DSCP mask without DSCP value"); 383 return -EINVAL; 384 } 385 386 dscp_mask = inet_dsfield_to_dscp(nla_get_u8(nla) << 2); 387 if (rule6->dscp & ~dscp_mask) { 388 NL_SET_ERR_MSG_ATTR(extack, nla, "Invalid DSCP mask"); 389 return -EINVAL; 390 } 391 392 rule6->dscp_mask = dscp_mask; 393 394 return 0; 395 } 396 397 static int fib6_nl2rule_flowlabel(struct nlattr **tb, struct fib6_rule *rule6, 398 struct netlink_ext_ack *extack) 399 { 400 __be32 flowlabel, flowlabel_mask; 401 402 if (NL_REQ_ATTR_CHECK(extack, NULL, tb, FRA_FLOWLABEL) || 403 NL_REQ_ATTR_CHECK(extack, NULL, tb, FRA_FLOWLABEL_MASK)) 404 return -EINVAL; 405 406 flowlabel = nla_get_be32(tb[FRA_FLOWLABEL]); 407 flowlabel_mask = nla_get_be32(tb[FRA_FLOWLABEL_MASK]); 408 409 if (flowlabel_mask & ~IPV6_FLOWLABEL_MASK) { 410 NL_SET_ERR_MSG_ATTR(extack, tb[FRA_FLOWLABEL_MASK], 411 "Invalid flow label mask"); 412 return -EINVAL; 413 } 414 415 if (flowlabel & ~flowlabel_mask) { 416 NL_SET_ERR_MSG(extack, "Flow label and mask do not match"); 417 return -EINVAL; 418 } 419 420 rule6->flowlabel = flowlabel; 421 rule6->flowlabel_mask = flowlabel_mask; 422 423 return 0; 424 } 425 426 static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb, 427 struct fib_rule_hdr *frh, 428 struct nlattr **tb, 429 struct netlink_ext_ack *extack) 430 { 431 struct fib6_rule *rule6 = (struct fib6_rule *)rule; 432 struct net *net = rule->fr_net; 433 int err = -EINVAL; 434 435 if (!inet_validate_dscp(frh->tos)) { 436 NL_SET_ERR_MSG(extack, 437 "Invalid dsfield (tos): ECN bits must be 0"); 438 goto errout; 439 } 440 rule6->dscp = inet_dsfield_to_dscp(frh->tos); 441 rule6->dscp_mask = frh->tos ? inet_dsfield_to_dscp(INET_DSCP_MASK) : 0; 442 443 if (tb[FRA_DSCP] && fib6_nl2rule_dscp(tb[FRA_DSCP], rule6, extack) < 0) 444 goto errout; 445 446 if (tb[FRA_DSCP_MASK] && 447 fib6_nl2rule_dscp_mask(tb[FRA_DSCP_MASK], rule6, extack) < 0) 448 goto errout; 449 450 if ((tb[FRA_FLOWLABEL] || tb[FRA_FLOWLABEL_MASK]) && 451 fib6_nl2rule_flowlabel(tb, rule6, extack) < 0) 452 goto errout; 453 454 if (rule->action == FR_ACT_TO_TBL && !rule->l3mdev) { 455 if (rule->table == RT6_TABLE_UNSPEC) { 456 NL_SET_ERR_MSG(extack, "Invalid table"); 457 goto errout; 458 } 459 460 if (fib6_new_table(net, rule->table) == NULL) { 461 err = -ENOBUFS; 462 goto errout; 463 } 464 } 465 466 if (frh->src_len) 467 rule6->src.addr = nla_get_in6_addr(tb[FRA_SRC]); 468 469 if (frh->dst_len) 470 rule6->dst.addr = nla_get_in6_addr(tb[FRA_DST]); 471 472 rule6->src.plen = frh->src_len; 473 rule6->dst.plen = frh->dst_len; 474 475 if (fib_rule_requires_fldissect(rule)) 476 net->ipv6.fib6_rules_require_fldissect++; 477 478 net->ipv6.fib6_has_custom_rules = true; 479 err = 0; 480 errout: 481 return err; 482 } 483 484 static int fib6_rule_delete(struct fib_rule *rule) 485 { 486 struct net *net = rule->fr_net; 487 488 if (net->ipv6.fib6_rules_require_fldissect && 489 fib_rule_requires_fldissect(rule)) 490 net->ipv6.fib6_rules_require_fldissect--; 491 492 return 0; 493 } 494 495 static int fib6_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh, 496 struct nlattr **tb) 497 { 498 struct fib6_rule *rule6 = (struct fib6_rule *) rule; 499 500 if (frh->src_len && (rule6->src.plen != frh->src_len)) 501 return 0; 502 503 if (frh->dst_len && (rule6->dst.plen != frh->dst_len)) 504 return 0; 505 506 if (frh->tos && 507 (rule6->dscp_full || 508 inet_dscp_to_dsfield(rule6->dscp) != frh->tos)) 509 return 0; 510 511 if (tb[FRA_DSCP]) { 512 dscp_t dscp; 513 514 dscp = inet_dsfield_to_dscp(nla_get_u8(tb[FRA_DSCP]) << 2); 515 if (!rule6->dscp_full || rule6->dscp != dscp) 516 return 0; 517 } 518 519 if (tb[FRA_DSCP_MASK]) { 520 dscp_t dscp_mask; 521 522 dscp_mask = inet_dsfield_to_dscp(nla_get_u8(tb[FRA_DSCP_MASK]) << 2); 523 if (!rule6->dscp_full || rule6->dscp_mask != dscp_mask) 524 return 0; 525 } 526 527 if (tb[FRA_FLOWLABEL] && 528 nla_get_be32(tb[FRA_FLOWLABEL]) != rule6->flowlabel) 529 return 0; 530 531 if (tb[FRA_FLOWLABEL_MASK] && 532 nla_get_be32(tb[FRA_FLOWLABEL_MASK]) != rule6->flowlabel_mask) 533 return 0; 534 535 if (frh->src_len && 536 nla_memcmp(tb[FRA_SRC], &rule6->src.addr, sizeof(struct in6_addr))) 537 return 0; 538 539 if (frh->dst_len && 540 nla_memcmp(tb[FRA_DST], &rule6->dst.addr, sizeof(struct in6_addr))) 541 return 0; 542 543 return 1; 544 } 545 546 static int fib6_rule_fill(struct fib_rule *rule, struct sk_buff *skb, 547 struct fib_rule_hdr *frh) 548 { 549 struct fib6_rule *rule6 = (struct fib6_rule *) rule; 550 551 frh->dst_len = rule6->dst.plen; 552 frh->src_len = rule6->src.plen; 553 554 if (rule6->dscp_full) { 555 frh->tos = 0; 556 if (nla_put_u8(skb, FRA_DSCP, 557 inet_dscp_to_dsfield(rule6->dscp) >> 2) || 558 nla_put_u8(skb, FRA_DSCP_MASK, 559 inet_dscp_to_dsfield(rule6->dscp_mask) >> 2)) 560 goto nla_put_failure; 561 } else { 562 frh->tos = inet_dscp_to_dsfield(rule6->dscp); 563 } 564 565 if (rule6->flowlabel_mask && 566 (nla_put_be32(skb, FRA_FLOWLABEL, rule6->flowlabel) || 567 nla_put_be32(skb, FRA_FLOWLABEL_MASK, rule6->flowlabel_mask))) 568 goto nla_put_failure; 569 570 if ((rule6->dst.plen && 571 nla_put_in6_addr(skb, FRA_DST, &rule6->dst.addr)) || 572 (rule6->src.plen && 573 nla_put_in6_addr(skb, FRA_SRC, &rule6->src.addr))) 574 goto nla_put_failure; 575 return 0; 576 577 nla_put_failure: 578 return -ENOBUFS; 579 } 580 581 static size_t fib6_rule_nlmsg_payload(struct fib_rule *rule) 582 { 583 return nla_total_size(16) /* dst */ 584 + nla_total_size(16) /* src */ 585 + nla_total_size(1) /* dscp */ 586 + nla_total_size(1) /* dscp mask */ 587 + nla_total_size(4) /* flowlabel */ 588 + nla_total_size(4); /* flowlabel mask */ 589 } 590 591 static void fib6_rule_flush_cache(struct fib_rules_ops *ops) 592 { 593 rt_genid_bump_ipv6(ops->fro_net); 594 } 595 596 static const struct fib_rules_ops __net_initconst fib6_rules_ops_template = { 597 .family = AF_INET6, 598 .rule_size = sizeof(struct fib6_rule), 599 .addr_size = sizeof(struct in6_addr), 600 .action = fib6_rule_action, 601 .match = fib6_rule_match, 602 .suppress = fib6_rule_suppress, 603 .configure = fib6_rule_configure, 604 .delete = fib6_rule_delete, 605 .compare = fib6_rule_compare, 606 .fill = fib6_rule_fill, 607 .nlmsg_payload = fib6_rule_nlmsg_payload, 608 .flush_cache = fib6_rule_flush_cache, 609 .nlgroup = RTNLGRP_IPV6_RULE, 610 .owner = THIS_MODULE, 611 .fro_net = &init_net, 612 }; 613 614 static int __net_init fib6_rules_net_init(struct net *net) 615 { 616 struct fib_rules_ops *ops; 617 int err; 618 619 ops = fib_rules_register(&fib6_rules_ops_template, net); 620 if (IS_ERR(ops)) 621 return PTR_ERR(ops); 622 623 err = fib_default_rule_add(ops, 0, RT6_TABLE_LOCAL); 624 if (err) 625 goto out_fib6_rules_ops; 626 627 err = fib_default_rule_add(ops, 0x7FFE, RT6_TABLE_MAIN); 628 if (err) 629 goto out_fib6_rules_ops; 630 631 net->ipv6.fib6_rules_ops = ops; 632 net->ipv6.fib6_rules_require_fldissect = 0; 633 out: 634 return err; 635 636 out_fib6_rules_ops: 637 fib_rules_unregister(ops); 638 goto out; 639 } 640 641 static void __net_exit fib6_rules_net_exit_batch(struct list_head *net_list) 642 { 643 struct net *net; 644 645 rtnl_lock(); 646 list_for_each_entry(net, net_list, exit_list) { 647 fib_rules_unregister(net->ipv6.fib6_rules_ops); 648 cond_resched(); 649 } 650 rtnl_unlock(); 651 } 652 653 static struct pernet_operations fib6_rules_net_ops = { 654 .init = fib6_rules_net_init, 655 .exit_batch = fib6_rules_net_exit_batch, 656 }; 657 658 int __init fib6_rules_init(void) 659 { 660 return register_pernet_subsys(&fib6_rules_net_ops); 661 } 662 663 664 void fib6_rules_cleanup(void) 665 { 666 unregister_pernet_subsys(&fib6_rules_net_ops); 667 } 668