[mirror_ubuntu-jammy-kernel.git] / net / ipv6 / fib6_rules.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * net/ipv6/fib6_rules.c	IPv6 Routing Policy Rules
 *
 * Copyright (C)2003-2006 Helsinki University of Technology
 * Copyright (C)2003-2006 USAGI/WIDE Project
 *
 * Authors
 *	Thomas Graf		<tgraf@suug.ch>
 *	Ville Nuorvala		<vnuorval@tcs.hut.fi>
 */

#include <linux/netdevice.h>
#include <linux/notifier.h>
#include <linux/export.h>
#include <linux/indirect_call_wrapper.h>

#include <net/fib_rules.h>
#include <net/ipv6.h>
#include <net/addrconf.h>
#include <net/ip6_route.h>
#include <net/netlink.h>

struct fib6_rule {
	struct fib_rule		common;
	struct rt6key		src;
	struct rt6key		dst;
	u8			tclass;
};

static bool fib6_rule_matchall(const struct fib_rule *rule)
{
	struct fib6_rule *r = container_of(rule, struct fib6_rule, common);

	if (r->dst.plen || r->src.plen || r->tclass)
		return false;
	return fib_rule_matchall(rule);
}

bool fib6_rule_default(const struct fib_rule *rule)
{
	if (!fib6_rule_matchall(rule) || rule->action != FR_ACT_TO_TBL ||
	    rule->l3mdev)
		return false;
	if (rule->table != RT6_TABLE_LOCAL && rule->table != RT6_TABLE_MAIN)
		return false;
	return true;
}
EXPORT_SYMBOL_GPL(fib6_rule_default);

int fib6_rules_dump(struct net *net, struct notifier_block *nb,
		    struct netlink_ext_ack *extack)
{
	return fib_rules_dump(net, nb, AF_INET6, extack);
}

unsigned int fib6_rules_seq_read(struct net *net)
{
	return fib_rules_seq_read(net, AF_INET6);
}

/* called with rcu lock held; no reference taken on fib6_info */
int fib6_lookup(struct net *net, int oif, struct flowi6 *fl6,
		struct fib6_result *res, int flags)
{
	int err;

	if (net->ipv6.fib6_has_custom_rules) {
		struct fib_lookup_arg arg = {
			.lookup_ptr = fib6_table_lookup,
			.lookup_data = &oif,
			.result = res,
			.flags = FIB_LOOKUP_NOREF,
		};

		l3mdev_update_flow(net, flowi6_to_flowi(fl6));

		err = fib_rules_lookup(net->ipv6.fib6_rules_ops,
				       flowi6_to_flowi(fl6), flags, &arg);
	} else {
		err = fib6_table_lookup(net, net->ipv6.fib6_local_tbl, oif,
					fl6, res, flags);
		if (err || res->f6i == net->ipv6.fib6_null_entry)
			err = fib6_table_lookup(net, net->ipv6.fib6_main_tbl,
						oif, fl6, res, flags);
	}

	return err;
}

struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,
				   const struct sk_buff *skb,
				   int flags, pol_lookup_t lookup)
{
	if (net->ipv6.fib6_has_custom_rules) {
		struct fib6_result res = {};
		struct fib_lookup_arg arg = {
			.lookup_ptr = lookup,
			.lookup_data = skb,
			.result = &res,
			.flags = FIB_LOOKUP_NOREF,
		};

		/* update flow if oif or iif point to device enslaved to l3mdev */
		l3mdev_update_flow(net, flowi6_to_flowi(fl6));

		fib_rules_lookup(net->ipv6.fib6_rules_ops,
				 flowi6_to_flowi(fl6), flags, &arg);

		if (res.rt6)
			return &res.rt6->dst;
	} else {
		struct rt6_info *rt;

		rt = pol_lookup_func(lookup,
			     net, net->ipv6.fib6_local_tbl, fl6, skb, flags);
		if (rt != net->ipv6.ip6_null_entry && rt->dst.error != -EAGAIN)
			return &rt->dst;
		ip6_rt_put_flags(rt, flags);
		rt = pol_lookup_func(lookup,
			     net, net->ipv6.fib6_main_tbl, fl6, skb, flags);
		if (rt->dst.error != -EAGAIN)
			return &rt->dst;
		ip6_rt_put_flags(rt, flags);
	}

	if (!(flags & RT6_LOOKUP_F_DST_NOREF))
		dst_hold(&net->ipv6.ip6_null_entry->dst);
	return &net->ipv6.ip6_null_entry->dst;
}

static int fib6_rule_saddr(struct net *net, struct fib_rule *rule, int flags,
			   struct flowi6 *flp6, const struct net_device *dev)
{
	struct fib6_rule *r = (struct fib6_rule *)rule;

	/* If we need to find a source address for this traffic,
	 * we check the result if it meets requirement of the rule.
	 */
	if ((rule->flags & FIB_RULE_FIND_SADDR) &&
	    r->src.plen && !(flags & RT6_LOOKUP_F_HAS_SADDR)) {
		struct in6_addr saddr;

		if (ipv6_dev_get_saddr(net, dev, &flp6->daddr,
				       rt6_flags2srcprefs(flags), &saddr))
			return -EAGAIN;

		if (!ipv6_prefix_equal(&saddr, &r->src.addr, r->src.plen))
			return -EAGAIN;

		flp6->saddr = saddr;
	}

	return 0;
}

static int fib6_rule_action_alt(struct fib_rule *rule, struct flowi *flp,
				int flags, struct fib_lookup_arg *arg)
{
	struct fib6_result *res = arg->result;
	struct flowi6 *flp6 = &flp->u.ip6;
	struct net *net = rule->fr_net;
	struct fib6_table *table;
	int err, *oif;
	u32 tb_id;

	switch (rule->action) {
	case FR_ACT_TO_TBL:
		break;
	case FR_ACT_UNREACHABLE:
		return -ENETUNREACH;
	case FR_ACT_PROHIBIT:
		return -EACCES;
	case FR_ACT_BLACKHOLE:
	default:
		return -EINVAL;
	}

	tb_id = fib_rule_get_table(rule, arg);
	table = fib6_get_table(net, tb_id);
	if (!table)
		return -EAGAIN;

	oif = (int *)arg->lookup_data;
	err = fib6_table_lookup(net, table, *oif, flp6, res, flags);
	if (!err && res->f6i != net->ipv6.fib6_null_entry)
		err = fib6_rule_saddr(net, rule, flags, flp6,
				      res->nh->fib_nh_dev);
	else
		err = -EAGAIN;

	return err;
}

static int __fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
			      int flags, struct fib_lookup_arg *arg)
{
	struct fib6_result *res = arg->result;
	struct flowi6 *flp6 = &flp->u.ip6;
	struct rt6_info *rt = NULL;
	struct fib6_table *table;
	struct net *net = rule->fr_net;
	pol_lookup_t lookup = arg->lookup_ptr;
	int err = 0;
	u32 tb_id;

	switch (rule->action) {
	case FR_ACT_TO_TBL:
		break;
	case FR_ACT_UNREACHABLE:
		err = -ENETUNREACH;
		rt = net->ipv6.ip6_null_entry;
		goto discard_pkt;
	default:
	case FR_ACT_BLACKHOLE:
		err = -EINVAL;
		rt = net->ipv6.ip6_blk_hole_entry;
		goto discard_pkt;
	case FR_ACT_PROHIBIT:
		err = -EACCES;
		rt = net->ipv6.ip6_prohibit_entry;
		goto discard_pkt;
	}

	tb_id = fib_rule_get_table(rule, arg);
	table = fib6_get_table(net, tb_id);
	if (!table) {
		err = -EAGAIN;
		goto out;
	}

	rt = pol_lookup_func(lookup,
			     net, table, flp6, arg->lookup_data, flags);
	if (rt != net->ipv6.ip6_null_entry) {
		err = fib6_rule_saddr(net, rule, flags, flp6,
				      ip6_dst_idev(&rt->dst)->dev);

		if (err == -EAGAIN)
			goto again;

		err = rt->dst.error;
		if (err != -EAGAIN)
			goto out;
	}
again:
	ip6_rt_put_flags(rt, flags);
	err = -EAGAIN;
	rt = NULL;
	goto out;

discard_pkt:
	if (!(flags & RT6_LOOKUP_F_DST_NOREF))
		dst_hold(&rt->dst);
out:
	res->rt6 = rt;
	return err;
}

INDIRECT_CALLABLE_SCOPE int fib6_rule_action(struct fib_rule *rule,
					     struct flowi *flp, int flags,
					     struct fib_lookup_arg *arg)
{
	if (arg->lookup_ptr == fib6_table_lookup)
		return fib6_rule_action_alt(rule, flp, flags, arg);

	return __fib6_rule_action(rule, flp, flags, arg);
}

INDIRECT_CALLABLE_SCOPE bool fib6_rule_suppress(struct fib_rule *rule,
						int flags,
						struct fib_lookup_arg *arg)
{
	struct fib6_result *res = arg->result;
	struct rt6_info *rt = res->rt6;
	struct net_device *dev = NULL;

	if (!rt)
		return false;

	if (rt->rt6i_idev)
		dev = rt->rt6i_idev->dev;

	/* do not accept result if the route does
	 * not meet the required prefix length
	 */
	if (rt->rt6i_dst.plen <= rule->suppress_prefixlen)
		goto suppress_route;

	/* do not accept result if the route uses a device
	 * belonging to a forbidden interface group
	 */
	if (rule->suppress_ifgroup != -1 && dev && dev->group == rule->suppress_ifgroup)
		goto suppress_route;

	return false;

suppress_route:
	ip6_rt_put_flags(rt, flags);
	return true;
}

INDIRECT_CALLABLE_SCOPE int fib6_rule_match(struct fib_rule *rule,
					    struct flowi *fl, int flags)
{
	struct fib6_rule *r = (struct fib6_rule *) rule;
	struct flowi6 *fl6 = &fl->u.ip6;

	if (r->dst.plen &&
	    !ipv6_prefix_equal(&fl6->daddr, &r->dst.addr, r->dst.plen))
		return 0;

	/*
	 * If FIB_RULE_FIND_SADDR is set and we do not have a
	 * source address for the traffic, we defer check for
	 * source address.
	 */
	if (r->src.plen) {
		if (flags & RT6_LOOKUP_F_HAS_SADDR) {
			if (!ipv6_prefix_equal(&fl6->saddr, &r->src.addr,
					       r->src.plen))
				return 0;
		} else if (!(r->common.flags & FIB_RULE_FIND_SADDR))
			return 0;
	}

	if (r->tclass && r->tclass != ip6_tclass(fl6->flowlabel))
		return 0;

	if (rule->ip_proto && (rule->ip_proto != fl6->flowi6_proto))
		return 0;

	if (fib_rule_port_range_set(&rule->sport_range) &&
	    !fib_rule_port_inrange(&rule->sport_range, fl6->fl6_sport))
		return 0;

	if (fib_rule_port_range_set(&rule->dport_range) &&
	    !fib_rule_port_inrange(&rule->dport_range, fl6->fl6_dport))
		return 0;

	return 1;
}

static const struct nla_policy fib6_rule_policy[FRA_MAX+1] = {
	FRA_GENERIC_POLICY,
};

static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
			       struct fib_rule_hdr *frh,
			       struct nlattr **tb,
			       struct netlink_ext_ack *extack)
{
	int err = -EINVAL;
	struct net *net = sock_net(skb->sk);
	struct fib6_rule *rule6 = (struct fib6_rule *) rule;

	if (rule->action == FR_ACT_TO_TBL && !rule->l3mdev) {
		if (rule->table == RT6_TABLE_UNSPEC) {
			NL_SET_ERR_MSG(extack, "Invalid table");
			goto errout;
		}

		if (fib6_new_table(net, rule->table) == NULL) {
			err = -ENOBUFS;
			goto errout;
		}
	}

	if (frh->src_len)
		rule6->src.addr = nla_get_in6_addr(tb[FRA_SRC]);

	if (frh->dst_len)
		rule6->dst.addr = nla_get_in6_addr(tb[FRA_DST]);

	rule6->src.plen = frh->src_len;
	rule6->dst.plen = frh->dst_len;
	rule6->tclass = frh->tos;

	if (fib_rule_requires_fldissect(rule))
		net->ipv6.fib6_rules_require_fldissect++;

	net->ipv6.fib6_has_custom_rules = true;
	err = 0;
errout:
	return err;
}

static int fib6_rule_delete(struct fib_rule *rule)
{
	struct net *net = rule->fr_net;

	if (net->ipv6.fib6_rules_require_fldissect &&
	    fib_rule_requires_fldissect(rule))
		net->ipv6.fib6_rules_require_fldissect--;

	return 0;
}

static int fib6_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
			     struct nlattr **tb)
{
	struct fib6_rule *rule6 = (struct fib6_rule *) rule;

	if (frh->src_len && (rule6->src.plen != frh->src_len))
		return 0;

	if (frh->dst_len && (rule6->dst.plen != frh->dst_len))
		return 0;

	if (frh->tos && (rule6->tclass != frh->tos))
		return 0;

	if (frh->src_len &&
	    nla_memcmp(tb[FRA_SRC], &rule6->src.addr, sizeof(struct in6_addr)))
		return 0;

	if (frh->dst_len &&
	    nla_memcmp(tb[FRA_DST], &rule6->dst.addr, sizeof(struct in6_addr)))
		return 0;

	return 1;
}

static int fib6_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
			  struct fib_rule_hdr *frh)
{
	struct fib6_rule *rule6 = (struct fib6_rule *) rule;

	frh->dst_len = rule6->dst.plen;
	frh->src_len = rule6->src.plen;
	frh->tos = rule6->tclass;

	if ((rule6->dst.plen &&
	     nla_put_in6_addr(skb, FRA_DST, &rule6->dst.addr)) ||
	    (rule6->src.plen &&
	     nla_put_in6_addr(skb, FRA_SRC, &rule6->src.addr)))
		goto nla_put_failure;
	return 0;

nla_put_failure:
	return -ENOBUFS;
}

static size_t fib6_rule_nlmsg_payload(struct fib_rule *rule)
{
	return nla_total_size(16) /* dst */
	       + nla_total_size(16); /* src */
}

static const struct fib_rules_ops __net_initconst fib6_rules_ops_template = {
	.family			= AF_INET6,
	.rule_size		= sizeof(struct fib6_rule),
	.addr_size		= sizeof(struct in6_addr),
	.action			= fib6_rule_action,
	.match			= fib6_rule_match,
	.suppress		= fib6_rule_suppress,
	.configure		= fib6_rule_configure,
	.delete			= fib6_rule_delete,
	.compare		= fib6_rule_compare,
	.fill			= fib6_rule_fill,
	.nlmsg_payload		= fib6_rule_nlmsg_payload,
	.nlgroup		= RTNLGRP_IPV6_RULE,
	.policy			= fib6_rule_policy,
	.owner			= THIS_MODULE,
	.fro_net		= &init_net,
};

static int __net_init fib6_rules_net_init(struct net *net)
{
	struct fib_rules_ops *ops;
	int err;

	ops = fib_rules_register(&fib6_rules_ops_template, net);
	if (IS_ERR(ops))
		return PTR_ERR(ops);

	err = fib_default_rule_add(ops, 0, RT6_TABLE_LOCAL, 0);
	if (err)
		goto out_fib6_rules_ops;

	err = fib_default_rule_add(ops, 0x7FFE, RT6_TABLE_MAIN, 0);
	if (err)
		goto out_fib6_rules_ops;

	net->ipv6.fib6_rules_ops = ops;
	net->ipv6.fib6_rules_require_fldissect = 0;
out:
	return err;

out_fib6_rules_ops:
	fib_rules_unregister(ops);
	goto out;
}

static void __net_exit fib6_rules_net_exit(struct net *net)
{
	rtnl_lock();
	fib_rules_unregister(net->ipv6.fib6_rules_ops);
	rtnl_unlock();
}

static struct pernet_operations fib6_rules_net_ops = {
	.init = fib6_rules_net_init,
	.exit = fib6_rules_net_exit,
};

int __init fib6_rules_init(void)
{
	return register_pernet_subsys(&fib6_rules_net_ops);
}


void fib6_rules_cleanup(void)
{
	unregister_pernet_subsys(&fib6_rules_net_ops);
}
Commit	Line	Data
a10e763b	1	// SPDX-License-Identifier: GPL-2.0-only
101367c2 TG	2	/*
	3	* net/ipv6/fib6_rules.c IPv6 Routing Policy Rules
	4	*
	5	* Copyright (C)2003-2006 Helsinki University of Technology
	6	* Copyright (C)2003-2006 USAGI/WIDE Project
	7	*
101367c2 TG	8	* Authors
	9	* Thomas Graf <tgraf@suug.ch>
	10	* Ville Nuorvala <vnuorval@tcs.hut.fi>
	11	*/
	12
101367c2	13	#include <linux/netdevice.h>
dcb18f76	14	#include <linux/notifier.h>
bc3b2d7f	15	#include <linux/export.h>
b9aaec8f	16	#include <linux/indirect_call_wrapper.h>
101367c2 TG	17
	18	#include <net/fib_rules.h>
	19	#include <net/ipv6.h>
29f6af77	20	#include <net/addrconf.h>
101367c2 TG	21	#include <net/ip6_route.h>
	22	#include <net/netlink.h>
	23
911c8541	24	struct fib6_rule {
101367c2 TG	25	struct fib_rule common;
	26	struct rt6key src;
	27	struct rt6key dst;
	28	u8 tclass;
	29	};
	30
e3ea9731 IS	31	static bool fib6_rule_matchall(const struct fib_rule *rule)
	32	{
	33	struct fib6_rule *r = container_of(rule, struct fib6_rule, common);
	34
	35	if (r->dst.plen \|\| r->src.plen \|\| r->tclass)
	36	return false;
	37	return fib_rule_matchall(rule);
	38	}
	39
	40	bool fib6_rule_default(const struct fib_rule *rule)
	41	{
	42	if (!fib6_rule_matchall(rule) \|\| rule->action != FR_ACT_TO_TBL \|\|
	43	rule->l3mdev)
	44	return false;
	45	if (rule->table != RT6_TABLE_LOCAL && rule->table != RT6_TABLE_MAIN)
	46	return false;
	47	return true;
	48	}
	49	EXPORT_SYMBOL_GPL(fib6_rule_default);
	50
b7a59557 JP	51	int fib6_rules_dump(struct net net, struct notifier_block nb,
b7a59557 JP	52	struct netlink_ext_ack *extack)
dcb18f76	53	{
b7a59557	54	return fib_rules_dump(net, nb, AF_INET6, extack);
dcb18f76 IS	55	}
	56
	57	unsigned int fib6_rules_seq_read(struct net *net)
	58	{
	59	return fib_rules_seq_read(net, AF_INET6);
	60	}
	61
138118ec	62	/* called with rcu lock held; no reference taken on fib6_info */
effda4dd DA	63	int fib6_lookup(struct net net, int oif, struct flowi6 fl6,
effda4dd DA	64	struct fib6_result *res, int flags)
138118ec	65	{
138118ec DA	66	int err;
	67
	68	if (net->ipv6.fib6_has_custom_rules) {
	69	struct fib_lookup_arg arg = {
	70	.lookup_ptr = fib6_table_lookup,
	71	.lookup_data = &oif,
effda4dd	72	.result = res,
138118ec DA	73	.flags = FIB_LOOKUP_NOREF,
	74	};
	75
	76	l3mdev_update_flow(net, flowi6_to_flowi(fl6));
	77
	78	err = fib_rules_lookup(net->ipv6.fib6_rules_ops,
	79	flowi6_to_flowi(fl6), flags, &arg);
138118ec	80	} else {
effda4dd DA	81	err = fib6_table_lookup(net, net->ipv6.fib6_local_tbl, oif,
	82	fl6, res, flags);
	83	if (err \|\| res->f6i == net->ipv6.fib6_null_entry)
	84	err = fib6_table_lookup(net, net->ipv6.fib6_main_tbl,
	85	oif, fl6, res, flags);
138118ec DA	86	}
138118ec DA	87
effda4dd	88	return err;
138118ec DA	89	}
138118ec DA	90
4c9483b2	91	struct dst_entry fib6_rule_lookup(struct net net, struct flowi6 *fl6,
b75cc8f9	92	const struct sk_buff *skb,
58f09b78	93	int flags, pol_lookup_t lookup)
101367c2	94	{
feca7d8c	95	if (net->ipv6.fib6_has_custom_rules) {
a65120ba	96	struct fib6_result res = {};
feca7d8c VB	97	struct fib_lookup_arg arg = {
feca7d8c VB	98	.lookup_ptr = lookup,
b75cc8f9	99	.lookup_data = skb,
a65120ba	100	.result = &res,
feca7d8c VB	101	.flags = FIB_LOOKUP_NOREF,
	102	};
	103
	104	/* update flow if oif or iif point to device enslaved to l3mdev */
	105	l3mdev_update_flow(net, flowi6_to_flowi(fl6));
	106
	107	fib_rules_lookup(net->ipv6.fib6_rules_ops,
	108	flowi6_to_flowi(fl6), flags, &arg);
	109
a65120ba DA	110	if (res.rt6)
a65120ba DA	111	return &res.rt6->dst;
feca7d8c VB	112	} else {
	113	struct rt6_info *rt;
	114
55cced4f BV	115	rt = pol_lookup_func(lookup,
55cced4f BV	116	net, net->ipv6.fib6_local_tbl, fl6, skb, flags);
feca7d8c VB	117	if (rt != net->ipv6.ip6_null_entry && rt->dst.error != -EAGAIN)
feca7d8c VB	118	return &rt->dst;
d64a1f57	119	ip6_rt_put_flags(rt, flags);
55cced4f BV	120	rt = pol_lookup_func(lookup,
55cced4f BV	121	net, net->ipv6.fib6_main_tbl, fl6, skb, flags);
feca7d8c VB	122	if (rt->dst.error != -EAGAIN)
feca7d8c VB	123	return &rt->dst;
d64a1f57	124	ip6_rt_put_flags(rt, flags);
feca7d8c	125	}
b1429553	126
d64a1f57 WW	127	if (!(flags & RT6_LOOKUP_F_DST_NOREF))
d64a1f57 WW	128	dst_hold(&net->ipv6.ip6_null_entry->dst);
07f61557	129	return &net->ipv6.ip6_null_entry->dst;
101367c2 TG	130	}
101367c2 TG	131
cc065a9e DA	132	static int fib6_rule_saddr(struct net net, struct fib_rule rule, int flags,
	133	struct flowi6 flp6, const struct net_device dev)
	134	{
	135	struct fib6_rule r = (struct fib6_rule )rule;
	136
	137	/* If we need to find a source address for this traffic,
	138	* we check the result if it meets requirement of the rule.
	139	*/
	140	if ((rule->flags & FIB_RULE_FIND_SADDR) &&
	141	r->src.plen && !(flags & RT6_LOOKUP_F_HAS_SADDR)) {
	142	struct in6_addr saddr;
	143
	144	if (ipv6_dev_get_saddr(net, dev, &flp6->daddr,
	145	rt6_flags2srcprefs(flags), &saddr))
	146	return -EAGAIN;
	147
	148	if (!ipv6_prefix_equal(&saddr, &r->src.addr, r->src.plen))
	149	return -EAGAIN;
	150
	151	flp6->saddr = saddr;
	152	}
	153
	154	return 0;
	155	}
	156
138118ec DA	157	static int fib6_rule_action_alt(struct fib_rule rule, struct flowi flp,
	158	int flags, struct fib_lookup_arg *arg)
	159	{
effda4dd	160	struct fib6_result *res = arg->result;
138118ec DA	161	struct flowi6 *flp6 = &flp->u.ip6;
	162	struct net *net = rule->fr_net;
	163	struct fib6_table *table;
b2f97f7d	164	int err, *oif;
138118ec DA	165	u32 tb_id;
	166
	167	switch (rule->action) {
	168	case FR_ACT_TO_TBL:
	169	break;
	170	case FR_ACT_UNREACHABLE:
	171	return -ENETUNREACH;
	172	case FR_ACT_PROHIBIT:
	173	return -EACCES;
	174	case FR_ACT_BLACKHOLE:
	175	default:
	176	return -EINVAL;
	177	}
	178
	179	tb_id = fib_rule_get_table(rule, arg);
	180	table = fib6_get_table(net, tb_id);
	181	if (!table)
	182	return -EAGAIN;
	183
	184	oif = (int *)arg->lookup_data;
effda4dd DA	185	err = fib6_table_lookup(net, table, *oif, flp6, res, flags);
effda4dd DA	186	if (!err && res->f6i != net->ipv6.fib6_null_entry)
138118ec	187	err = fib6_rule_saddr(net, rule, flags, flp6,
effda4dd	188	res->nh->fib_nh_dev);
b2f97f7d DA	189	else
b2f97f7d DA	190	err = -EAGAIN;
138118ec DA	191
	192	return err;
	193	}
	194
	195	static int __fib6_rule_action(struct fib_rule rule, struct flowi flp,
	196	int flags, struct fib_lookup_arg *arg)
101367c2	197	{
a65120ba	198	struct fib6_result *res = arg->result;
4c9483b2	199	struct flowi6 *flp6 = &flp->u.ip6;
101367c2 TG	200	struct rt6_info *rt = NULL;
101367c2 TG	201	struct fib6_table *table;
8ed67789	202	struct net *net = rule->fr_net;
101367c2	203	pol_lookup_t lookup = arg->lookup_ptr;
46b3a421	204	int err = 0;
96c63fa7	205	u32 tb_id;
101367c2 TG	206
	207	switch (rule->action) {
	208	case FR_ACT_TO_TBL:
	209	break;
	210	case FR_ACT_UNREACHABLE:
46b3a421	211	err = -ENETUNREACH;
8ed67789	212	rt = net->ipv6.ip6_null_entry;
101367c2 TG	213	goto discard_pkt;
	214	default:
	215	case FR_ACT_BLACKHOLE:
46b3a421	216	err = -EINVAL;
8ed67789	217	rt = net->ipv6.ip6_blk_hole_entry;
101367c2 TG	218	goto discard_pkt;
101367c2 TG	219	case FR_ACT_PROHIBIT:
46b3a421	220	err = -EACCES;
8ed67789	221	rt = net->ipv6.ip6_prohibit_entry;
101367c2 TG	222	goto discard_pkt;
	223	}
	224
96c63fa7 DA	225	tb_id = fib_rule_get_table(rule, arg);
96c63fa7 DA	226	table = fib6_get_table(net, tb_id);
46b3a421 HFS	227	if (!table) {
	228	err = -EAGAIN;
	229	goto out;
	230	}
101367c2	231
55cced4f BV	232	rt = pol_lookup_func(lookup,
55cced4f BV	233	net, table, flp6, arg->lookup_data, flags);
8ed67789	234	if (rt != net->ipv6.ip6_null_entry) {
cc065a9e DA	235	err = fib6_rule_saddr(net, rule, flags, flp6,
	236	ip6_dst_idev(&rt->dst)->dev);
	237
	238	if (err == -EAGAIN)
	239	goto again;
	240
73ba57bf	241	err = rt->dst.error;
07f61557 SP	242	if (err != -EAGAIN)
07f61557 SP	243	goto out;
29f6af77 YH	244	}
29f6af77 YH	245	again:
d64a1f57	246	ip6_rt_put_flags(rt, flags);
46b3a421	247	err = -EAGAIN;
3226f688 PM	248	rt = NULL;
	249	goto out;
	250
101367c2	251	discard_pkt:
d64a1f57 WW	252	if (!(flags & RT6_LOOKUP_F_DST_NOREF))
d64a1f57 WW	253	dst_hold(&rt->dst);
101367c2	254	out:
a65120ba	255	res->rt6 = rt;
46b3a421	256	return err;
101367c2 TG	257	}
101367c2 TG	258
b9aaec8f BV	259	INDIRECT_CALLABLE_SCOPE int fib6_rule_action(struct fib_rule *rule,
	260	struct flowi *flp, int flags,
	261	struct fib_lookup_arg *arg)
138118ec DA	262	{
	263	if (arg->lookup_ptr == fib6_table_lookup)
	264	return fib6_rule_action_alt(rule, flp, flags, arg);
	265
	266	return __fib6_rule_action(rule, flp, flags, arg);
	267	}
	268
b9aaec8f	269	INDIRECT_CALLABLE_SCOPE bool fib6_rule_suppress(struct fib_rule *rule,
b3427aa9	270	int flags,
b9aaec8f	271	struct fib_lookup_arg *arg)
7764a45a	272	{
a65120ba DA	273	struct fib6_result *res = arg->result;
a65120ba DA	274	struct rt6_info *rt = res->rt6;
673498b8 ST	275	struct net_device *dev = NULL;
673498b8 ST	276
a65120ba DA	277	if (!rt)
	278	return false;
	279
673498b8 ST	280	if (rt->rt6i_idev)
	281	dev = rt->rt6i_idev->dev;
	282
7764a45a ST	283	/* do not accept result if the route does
	284	* not meet the required prefix length
	285	*/
73f5698e	286	if (rt->rt6i_dst.plen <= rule->suppress_prefixlen)
6ef94cfa ST	287	goto suppress_route;
	288
	289	/* do not accept result if the route uses a device
	290	* belonging to a forbidden interface group
	291	*/
	292	if (rule->suppress_ifgroup != -1 && dev && dev->group == rule->suppress_ifgroup)
	293	goto suppress_route;
	294
	295	return false;
	296
	297	suppress_route:
b3427aa9	298	ip6_rt_put_flags(rt, flags);
04f0888d	299	return true;
7764a45a	300	}
101367c2	301
b9aaec8f BV	302	INDIRECT_CALLABLE_SCOPE int fib6_rule_match(struct fib_rule *rule,
b9aaec8f BV	303	struct flowi *fl, int flags)
101367c2 TG	304	{
101367c2 TG	305	struct fib6_rule r = (struct fib6_rule ) rule;
4c9483b2	306	struct flowi6 *fl6 = &fl->u.ip6;
101367c2	307
adaa70bb	308	if (r->dst.plen &&
4c9483b2	309	!ipv6_prefix_equal(&fl6->daddr, &r->dst.addr, r->dst.plen))
101367c2 TG	310	return 0;
101367c2 TG	311
29f6af77 YH	312	/*
	313	* If FIB_RULE_FIND_SADDR is set and we do not have a
	314	* source address for the traffic, we defer check for
	315	* source address.
	316	*/
adaa70bb	317	if (r->src.plen) {
29f6af77	318	if (flags & RT6_LOOKUP_F_HAS_SADDR) {
4c9483b2	319	if (!ipv6_prefix_equal(&fl6->saddr, &r->src.addr,
29f6af77 YH	320	r->src.plen))
	321	return 0;
	322	} else if (!(r->common.flags & FIB_RULE_FIND_SADDR))
adaa70bb TG	323	return 0;
adaa70bb TG	324	}
101367c2	325
d76ed22b	326	if (r->tclass && r->tclass != ip6_tclass(fl6->flowlabel))
2cc67cc7 YH	327	return 0;
2cc67cc7 YH	328
bb0ad198 RP	329	if (rule->ip_proto && (rule->ip_proto != fl6->flowi6_proto))
	330	return 0;
	331
	332	if (fib_rule_port_range_set(&rule->sport_range) &&
	333	!fib_rule_port_inrange(&rule->sport_range, fl6->fl6_sport))
	334	return 0;
	335
	336	if (fib_rule_port_range_set(&rule->dport_range) &&
	337	!fib_rule_port_inrange(&rule->dport_range, fl6->fl6_dport))
	338	return 0;
	339
101367c2 TG	340	return 1;
	341	}
	342
ef7c79ed	343	static const struct nla_policy fib6_rule_policy[FRA_MAX+1] = {
1f6c9557	344	FRA_GENERIC_POLICY,
101367c2 TG	345	};
	346
	347	static int fib6_rule_configure(struct fib_rule rule, struct sk_buff skb,
8b3521ee	348	struct fib_rule_hdr *frh,
b16fb418 RP	349	struct nlattr **tb,
b16fb418 RP	350	struct netlink_ext_ack *extack)
101367c2 TG	351	{
101367c2 TG	352	int err = -EINVAL;
3b1e0a65	353	struct net *net = sock_net(skb->sk);
101367c2 TG	354	struct fib6_rule rule6 = (struct fib6_rule ) rule;
101367c2 TG	355
96c63fa7	356	if (rule->action == FR_ACT_TO_TBL && !rule->l3mdev) {
b16fb418 RP	357	if (rule->table == RT6_TABLE_UNSPEC) {
b16fb418 RP	358	NL_SET_ERR_MSG(extack, "Invalid table");
101367c2	359	goto errout;
b16fb418	360	}
101367c2	361
dcabb819	362	if (fib6_new_table(net, rule->table) == NULL) {
101367c2 TG	363	err = -ENOBUFS;
	364	goto errout;
	365	}
	366	}
	367
e1701c68	368	if (frh->src_len)
67b61f6c	369	rule6->src.addr = nla_get_in6_addr(tb[FRA_SRC]);
101367c2	370
e1701c68	371	if (frh->dst_len)
67b61f6c	372	rule6->dst.addr = nla_get_in6_addr(tb[FRA_DST]);
101367c2 TG	373
	374	rule6->src.plen = frh->src_len;
	375	rule6->dst.plen = frh->dst_len;
	376	rule6->tclass = frh->tos;
	377
5e5d6fed RP	378	if (fib_rule_requires_fldissect(rule))
	379	net->ipv6.fib6_rules_require_fldissect++;
	380
feca7d8c	381	net->ipv6.fib6_has_custom_rules = true;
101367c2 TG	382	err = 0;
	383	errout:
	384	return err;
	385	}
	386
5e5d6fed RP	387	static int fib6_rule_delete(struct fib_rule *rule)
	388	{
	389	struct net *net = rule->fr_net;
	390
	391	if (net->ipv6.fib6_rules_require_fldissect &&
	392	fib_rule_requires_fldissect(rule))
	393	net->ipv6.fib6_rules_require_fldissect--;
	394
	395	return 0;
	396	}
	397
101367c2 TG	398	static int fib6_rule_compare(struct fib_rule rule, struct fib_rule_hdr frh,
	399	struct nlattr **tb)
	400	{
	401	struct fib6_rule rule6 = (struct fib6_rule ) rule;
	402
	403	if (frh->src_len && (rule6->src.plen != frh->src_len))
	404	return 0;
	405
	406	if (frh->dst_len && (rule6->dst.plen != frh->dst_len))
	407	return 0;
	408
	409	if (frh->tos && (rule6->tclass != frh->tos))
	410	return 0;
	411
e1701c68	412	if (frh->src_len &&
101367c2 TG	413	nla_memcmp(tb[FRA_SRC], &rule6->src.addr, sizeof(struct in6_addr)))
	414	return 0;
	415
e1701c68	416	if (frh->dst_len &&
101367c2 TG	417	nla_memcmp(tb[FRA_DST], &rule6->dst.addr, sizeof(struct in6_addr)))
	418	return 0;
	419
	420	return 1;
	421	}
	422
	423	static int fib6_rule_fill(struct fib_rule rule, struct sk_buff skb,
04af8cf6	424	struct fib_rule_hdr *frh)
101367c2 TG	425	{
	426	struct fib6_rule rule6 = (struct fib6_rule ) rule;
	427
101367c2 TG	428	frh->dst_len = rule6->dst.plen;
	429	frh->src_len = rule6->src.plen;
	430	frh->tos = rule6->tclass;
	431
c78679e8	432	if ((rule6->dst.plen &&
930345ea	433	nla_put_in6_addr(skb, FRA_DST, &rule6->dst.addr)) \|\|
c78679e8	434	(rule6->src.plen &&
930345ea	435	nla_put_in6_addr(skb, FRA_SRC, &rule6->src.addr)))
c78679e8	436	goto nla_put_failure;
101367c2 TG	437	return 0;
	438
	439	nla_put_failure:
	440	return -ENOBUFS;
	441	}
	442
339bf98f TG	443	static size_t fib6_rule_nlmsg_payload(struct fib_rule *rule)
	444	{
	445	return nla_total_size(16) /* dst */
	446	+ nla_total_size(16); /* src */
	447	}
	448
04a6f82c	449	static const struct fib_rules_ops __net_initconst fib6_rules_ops_template = {
25239cee	450	.family = AF_INET6,
101367c2	451	.rule_size = sizeof(struct fib6_rule),
e1701c68	452	.addr_size = sizeof(struct in6_addr),
101367c2 TG	453	.action = fib6_rule_action,
101367c2 TG	454	.match = fib6_rule_match,
7764a45a	455	.suppress = fib6_rule_suppress,
101367c2	456	.configure = fib6_rule_configure,
5e5d6fed	457	.delete = fib6_rule_delete,
101367c2 TG	458	.compare = fib6_rule_compare,
101367c2 TG	459	.fill = fib6_rule_fill,
339bf98f	460	.nlmsg_payload = fib6_rule_nlmsg_payload,
101367c2 TG	461	.nlgroup = RTNLGRP_IPV6_RULE,
101367c2 TG	462	.policy = fib6_rule_policy,
101367c2	463	.owner = THIS_MODULE,
03592383	464	.fro_net = &init_net,
101367c2 TG	465	};
101367c2 TG	466
2c8c1e72	467	static int __net_init fib6_rules_net_init(struct net *net)
101367c2	468	{
e9c5158a	469	struct fib_rules_ops *ops;
b5ec0705	470	int err;
2994c638	471
e9c5158a EB	472	ops = fib_rules_register(&fib6_rules_ops_template, net);
	473	if (IS_ERR(ops))
	474	return PTR_ERR(ops);
eb5564b8	475
85b99092	476	err = fib_default_rule_add(ops, 0, RT6_TABLE_LOCAL, 0);
dcabb819 DL	477	if (err)
dcabb819 DL	478	goto out_fib6_rules_ops;
9eb87f3f	479
85b99092	480	err = fib_default_rule_add(ops, 0x7FFE, RT6_TABLE_MAIN, 0);
dcabb819	481	if (err)
e9c5158a	482	goto out_fib6_rules_ops;
9eb87f3f	483
85b99092	484	net->ipv6.fib6_rules_ops = ops;
5e5d6fed	485	net->ipv6.fib6_rules_require_fldissect = 0;
9eb87f3f	486	out:
dcabb819	487	return err;
9eb87f3f	488
dcabb819	489	out_fib6_rules_ops:
e9c5158a	490	fib_rules_unregister(ops);
9eb87f3f	491	goto out;
101367c2 TG	492	}
101367c2 TG	493
2c8c1e72	494	static void __net_exit fib6_rules_net_exit(struct net *net)
dcabb819	495	{
419df12f	496	rtnl_lock();
dcabb819	497	fib_rules_unregister(net->ipv6.fib6_rules_ops);
419df12f	498	rtnl_unlock();
dcabb819 DL	499	}
	500
	501	static struct pernet_operations fib6_rules_net_ops = {
	502	.init = fib6_rules_net_init,
	503	.exit = fib6_rules_net_exit,
	504	};
	505
	506	int __init fib6_rules_init(void)
	507	{
	508	return register_pernet_subsys(&fib6_rules_net_ops);
	509	}
	510
	511
101367c2 TG	512	void fib6_rules_cleanup(void)
101367c2 TG	513	{
ff4e1fb0	514	unregister_pernet_subsys(&fib6_rules_net_ops);
101367c2	515	}