2 * INET An implementation of the TCP/IP protocol suite for the LINUX
3 * operating system. INET is implemented using the BSD Socket
4 * interface as the means of communication with the user level.
6 * IPv4 Forwarding Information Base: policy rules.
8 * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
9 * Thomas Graf <tgraf@suug.ch>
11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License
13 * as published by the Free Software Foundation; either version
14 * 2 of the License, or (at your option) any later version.
17 * Rani Assaf : local_rule cannot be deleted
18 * Marc Boucher : routing by fwmark
21 #include <linux/types.h>
22 #include <linux/kernel.h>
23 #include <linux/netdevice.h>
24 #include <linux/netlink.h>
25 #include <linux/inetdevice.h>
26 #include <linux/init.h>
27 #include <linux/list.h>
28 #include <linux/rcupdate.h>
29 #include <linux/export.h>
31 #include <net/route.h>
33 #include <net/ip_fib.h>
34 #include <net/fib_rules.h>
37 struct fib_rule common
;
45 #ifdef CONFIG_IP_ROUTE_CLASSID
50 static bool fib4_rule_matchall(const struct fib_rule
*rule
)
52 struct fib4_rule
*r
= container_of(rule
, struct fib4_rule
, common
);
54 if (r
->dst_len
|| r
->src_len
|| r
->tos
)
56 return fib_rule_matchall(rule
);
59 bool fib4_rule_default(const struct fib_rule
*rule
)
61 if (!fib4_rule_matchall(rule
) || rule
->action
!= FR_ACT_TO_TBL
||
64 if (rule
->table
!= RT_TABLE_LOCAL
&& rule
->table
!= RT_TABLE_MAIN
&&
65 rule
->table
!= RT_TABLE_DEFAULT
)
69 EXPORT_SYMBOL_GPL(fib4_rule_default
);
71 int __fib_lookup(struct net
*net
, struct flowi4
*flp
,
72 struct fib_result
*res
, unsigned int flags
)
74 struct fib_lookup_arg arg
= {
80 /* update flow if oif or iif point to device enslaved to l3mdev */
81 l3mdev_update_flow(net
, flowi4_to_flowi(flp
));
83 err
= fib_rules_lookup(net
->ipv4
.rules_ops
, flowi4_to_flowi(flp
), 0, &arg
);
84 #ifdef CONFIG_IP_ROUTE_CLASSID
86 res
->tclassid
= ((struct fib4_rule
*)arg
.rule
)->tclassid
;
96 EXPORT_SYMBOL_GPL(__fib_lookup
);
98 static int fib4_rule_action(struct fib_rule
*rule
, struct flowi
*flp
,
99 int flags
, struct fib_lookup_arg
*arg
)
102 struct fib_table
*tbl
;
105 switch (rule
->action
) {
109 case FR_ACT_UNREACHABLE
:
112 case FR_ACT_PROHIBIT
:
115 case FR_ACT_BLACKHOLE
:
122 tb_id
= fib_rule_get_table(rule
, arg
);
123 tbl
= fib_get_table(rule
->fr_net
, tb_id
);
125 err
= fib_table_lookup(tbl
, &flp
->u
.ip4
,
126 (struct fib_result
*)arg
->result
,
133 static bool fib4_rule_suppress(struct fib_rule
*rule
, struct fib_lookup_arg
*arg
)
135 struct fib_result
*result
= (struct fib_result
*) arg
->result
;
136 struct net_device
*dev
= NULL
;
139 dev
= result
->fi
->fib_dev
;
141 /* do not accept result if the route does
142 * not meet the required prefix length
144 if (result
->prefixlen
<= rule
->suppress_prefixlen
)
147 /* do not accept result if the route uses a device
148 * belonging to a forbidden interface group
150 if (rule
->suppress_ifgroup
!= -1 && dev
&& dev
->group
== rule
->suppress_ifgroup
)
156 if (!(arg
->flags
& FIB_LOOKUP_NOREF
))
157 fib_info_put(result
->fi
);
161 static int fib4_rule_match(struct fib_rule
*rule
, struct flowi
*fl
, int flags
)
163 struct fib4_rule
*r
= (struct fib4_rule
*) rule
;
164 struct flowi4
*fl4
= &fl
->u
.ip4
;
165 __be32 daddr
= fl4
->daddr
;
166 __be32 saddr
= fl4
->saddr
;
168 if (((saddr
^ r
->src
) & r
->srcmask
) ||
169 ((daddr
^ r
->dst
) & r
->dstmask
))
172 if (r
->tos
&& (r
->tos
!= fl4
->flowi4_tos
))
178 static struct fib_table
*fib_empty_table(struct net
*net
)
182 for (id
= 1; id
<= RT_TABLE_MAX
; id
++)
183 if (!fib_get_table(net
, id
))
184 return fib_new_table(net
, id
);
188 static int call_fib_rule_notifier(struct notifier_block
*nb
, struct net
*net
,
189 enum fib_event_type event_type
,
190 struct fib_rule
*rule
)
192 struct fib_rule_notifier_info info
= {
196 return call_fib_notifier(nb
, net
, event_type
, &info
.info
);
199 static int call_fib_rule_notifiers(struct net
*net
,
200 enum fib_event_type event_type
,
201 struct fib_rule
*rule
)
203 struct fib_rule_notifier_info info
= {
207 return call_fib_notifiers(net
, event_type
, &info
.info
);
210 /* Called with rcu_read_lock() */
211 void fib_rules_notify(struct net
*net
, struct notifier_block
*nb
)
213 struct fib_rules_ops
*ops
= net
->ipv4
.rules_ops
;
214 struct fib_rule
*rule
;
216 list_for_each_entry_rcu(rule
, &ops
->rules_list
, list
)
217 call_fib_rule_notifier(nb
, net
, FIB_EVENT_RULE_ADD
, rule
);
220 static const struct nla_policy fib4_rule_policy
[FRA_MAX
+1] = {
222 [FRA_FLOW
] = { .type
= NLA_U32
},
225 static int fib4_rule_configure(struct fib_rule
*rule
, struct sk_buff
*skb
,
226 struct fib_rule_hdr
*frh
,
229 struct net
*net
= sock_net(skb
->sk
);
231 struct fib4_rule
*rule4
= (struct fib4_rule
*) rule
;
233 if (frh
->tos
& ~IPTOS_TOS_MASK
)
236 /* split local/main if they are not already split */
237 err
= fib_unmerge(net
);
241 if (rule
->table
== RT_TABLE_UNSPEC
&& !rule
->l3mdev
) {
242 if (rule
->action
== FR_ACT_TO_TBL
) {
243 struct fib_table
*table
;
245 table
= fib_empty_table(net
);
251 rule
->table
= table
->tb_id
;
256 rule4
->src
= nla_get_in_addr(tb
[FRA_SRC
]);
259 rule4
->dst
= nla_get_in_addr(tb
[FRA_DST
]);
261 #ifdef CONFIG_IP_ROUTE_CLASSID
263 rule4
->tclassid
= nla_get_u32(tb
[FRA_FLOW
]);
265 net
->ipv4
.fib_num_tclassid_users
++;
269 rule4
->src_len
= frh
->src_len
;
270 rule4
->srcmask
= inet_make_mask(rule4
->src_len
);
271 rule4
->dst_len
= frh
->dst_len
;
272 rule4
->dstmask
= inet_make_mask(rule4
->dst_len
);
273 rule4
->tos
= frh
->tos
;
275 net
->ipv4
.fib_has_custom_rules
= true;
276 call_fib_rule_notifiers(net
, FIB_EVENT_RULE_ADD
, rule
);
283 static int fib4_rule_delete(struct fib_rule
*rule
)
285 struct net
*net
= rule
->fr_net
;
288 /* split local/main if they are not already split */
289 err
= fib_unmerge(net
);
293 #ifdef CONFIG_IP_ROUTE_CLASSID
294 if (((struct fib4_rule
*)rule
)->tclassid
)
295 net
->ipv4
.fib_num_tclassid_users
--;
297 net
->ipv4
.fib_has_custom_rules
= true;
298 call_fib_rule_notifiers(net
, FIB_EVENT_RULE_DEL
, rule
);
303 static int fib4_rule_compare(struct fib_rule
*rule
, struct fib_rule_hdr
*frh
,
306 struct fib4_rule
*rule4
= (struct fib4_rule
*) rule
;
308 if (frh
->src_len
&& (rule4
->src_len
!= frh
->src_len
))
311 if (frh
->dst_len
&& (rule4
->dst_len
!= frh
->dst_len
))
314 if (frh
->tos
&& (rule4
->tos
!= frh
->tos
))
317 #ifdef CONFIG_IP_ROUTE_CLASSID
318 if (tb
[FRA_FLOW
] && (rule4
->tclassid
!= nla_get_u32(tb
[FRA_FLOW
])))
322 if (frh
->src_len
&& (rule4
->src
!= nla_get_in_addr(tb
[FRA_SRC
])))
325 if (frh
->dst_len
&& (rule4
->dst
!= nla_get_in_addr(tb
[FRA_DST
])))
331 static int fib4_rule_fill(struct fib_rule
*rule
, struct sk_buff
*skb
,
332 struct fib_rule_hdr
*frh
)
334 struct fib4_rule
*rule4
= (struct fib4_rule
*) rule
;
336 frh
->dst_len
= rule4
->dst_len
;
337 frh
->src_len
= rule4
->src_len
;
338 frh
->tos
= rule4
->tos
;
340 if ((rule4
->dst_len
&&
341 nla_put_in_addr(skb
, FRA_DST
, rule4
->dst
)) ||
343 nla_put_in_addr(skb
, FRA_SRC
, rule4
->src
)))
344 goto nla_put_failure
;
345 #ifdef CONFIG_IP_ROUTE_CLASSID
346 if (rule4
->tclassid
&&
347 nla_put_u32(skb
, FRA_FLOW
, rule4
->tclassid
))
348 goto nla_put_failure
;
356 static size_t fib4_rule_nlmsg_payload(struct fib_rule
*rule
)
358 return nla_total_size(4) /* dst */
359 + nla_total_size(4) /* src */
360 + nla_total_size(4); /* flow */
363 static void fib4_rule_flush_cache(struct fib_rules_ops
*ops
)
365 rt_cache_flush(ops
->fro_net
);
368 static const struct fib_rules_ops __net_initconst fib4_rules_ops_template
= {
370 .rule_size
= sizeof(struct fib4_rule
),
371 .addr_size
= sizeof(u32
),
372 .action
= fib4_rule_action
,
373 .suppress
= fib4_rule_suppress
,
374 .match
= fib4_rule_match
,
375 .configure
= fib4_rule_configure
,
376 .delete = fib4_rule_delete
,
377 .compare
= fib4_rule_compare
,
378 .fill
= fib4_rule_fill
,
379 .nlmsg_payload
= fib4_rule_nlmsg_payload
,
380 .flush_cache
= fib4_rule_flush_cache
,
381 .nlgroup
= RTNLGRP_IPV4_RULE
,
382 .policy
= fib4_rule_policy
,
383 .owner
= THIS_MODULE
,
386 static int fib_default_rules_init(struct fib_rules_ops
*ops
)
390 err
= fib_default_rule_add(ops
, 0, RT_TABLE_LOCAL
, 0);
393 err
= fib_default_rule_add(ops
, 0x7FFE, RT_TABLE_MAIN
, 0);
396 err
= fib_default_rule_add(ops
, 0x7FFF, RT_TABLE_DEFAULT
, 0);
402 int __net_init
fib4_rules_init(struct net
*net
)
405 struct fib_rules_ops
*ops
;
407 ops
= fib_rules_register(&fib4_rules_ops_template
, net
);
411 err
= fib_default_rules_init(ops
);
414 net
->ipv4
.rules_ops
= ops
;
415 net
->ipv4
.fib_has_custom_rules
= false;
419 /* also cleans all rules already added */
420 fib_rules_unregister(ops
);
424 void __net_exit
fib4_rules_exit(struct net
*net
)
426 fib_rules_unregister(net
->ipv4
.rules_ops
);