1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * INET An implementation of the TCP/IP protocol suite for the LINUX
4 * operating system. INET is implemented using the BSD Socket
5 * interface as the means of communication with the user level.
7 * IPv4 Forwarding Information Base: policy rules.
9 * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
10 * Thomas Graf <tgraf@suug.ch>
13 * Rani Assaf : local_rule cannot be deleted
14 * Marc Boucher : routing by fwmark
17 #include <linux/types.h>
18 #include <linux/kernel.h>
19 #include <linux/netdevice.h>
20 #include <linux/netlink.h>
21 #include <linux/inetdevice.h>
22 #include <linux/init.h>
23 #include <linux/list.h>
24 #include <linux/rcupdate.h>
25 #include <linux/export.h>
27 #include <net/route.h>
29 #include <net/ip_fib.h>
30 #include <net/nexthop.h>
31 #include <net/fib_rules.h>
34 struct fib_rule common
;
42 #ifdef CONFIG_IP_ROUTE_CLASSID
47 static bool fib4_rule_matchall(const struct fib_rule
*rule
)
49 struct fib4_rule
*r
= container_of(rule
, struct fib4_rule
, common
);
51 if (r
->dst_len
|| r
->src_len
|| r
->tos
)
53 return fib_rule_matchall(rule
);
56 bool fib4_rule_default(const struct fib_rule
*rule
)
58 if (!fib4_rule_matchall(rule
) || rule
->action
!= FR_ACT_TO_TBL
||
61 if (rule
->table
!= RT_TABLE_LOCAL
&& rule
->table
!= RT_TABLE_MAIN
&&
62 rule
->table
!= RT_TABLE_DEFAULT
)
66 EXPORT_SYMBOL_GPL(fib4_rule_default
);
68 int fib4_rules_dump(struct net
*net
, struct notifier_block
*nb
)
70 return fib_rules_dump(net
, nb
, AF_INET
);
73 unsigned int fib4_rules_seq_read(struct net
*net
)
75 return fib_rules_seq_read(net
, AF_INET
);
78 int __fib_lookup(struct net
*net
, struct flowi4
*flp
,
79 struct fib_result
*res
, unsigned int flags
)
81 struct fib_lookup_arg arg
= {
87 /* update flow if oif or iif point to device enslaved to l3mdev */
88 l3mdev_update_flow(net
, flowi4_to_flowi(flp
));
90 err
= fib_rules_lookup(net
->ipv4
.rules_ops
, flowi4_to_flowi(flp
), 0, &arg
);
91 #ifdef CONFIG_IP_ROUTE_CLASSID
93 res
->tclassid
= ((struct fib4_rule
*)arg
.rule
)->tclassid
;
103 EXPORT_SYMBOL_GPL(__fib_lookup
);
105 static int fib4_rule_action(struct fib_rule
*rule
, struct flowi
*flp
,
106 int flags
, struct fib_lookup_arg
*arg
)
109 struct fib_table
*tbl
;
112 switch (rule
->action
) {
116 case FR_ACT_UNREACHABLE
:
119 case FR_ACT_PROHIBIT
:
122 case FR_ACT_BLACKHOLE
:
129 tb_id
= fib_rule_get_table(rule
, arg
);
130 tbl
= fib_get_table(rule
->fr_net
, tb_id
);
132 err
= fib_table_lookup(tbl
, &flp
->u
.ip4
,
133 (struct fib_result
*)arg
->result
,
140 static bool fib4_rule_suppress(struct fib_rule
*rule
, struct fib_lookup_arg
*arg
)
142 struct fib_result
*result
= (struct fib_result
*) arg
->result
;
143 struct net_device
*dev
= NULL
;
146 struct fib_nh_common
*nhc
= fib_info_nhc(result
->fi
, 0);
151 /* do not accept result if the route does
152 * not meet the required prefix length
154 if (result
->prefixlen
<= rule
->suppress_prefixlen
)
157 /* do not accept result if the route uses a device
158 * belonging to a forbidden interface group
160 if (rule
->suppress_ifgroup
!= -1 && dev
&& dev
->group
== rule
->suppress_ifgroup
)
166 if (!(arg
->flags
& FIB_LOOKUP_NOREF
))
167 fib_info_put(result
->fi
);
171 static int fib4_rule_match(struct fib_rule
*rule
, struct flowi
*fl
, int flags
)
173 struct fib4_rule
*r
= (struct fib4_rule
*) rule
;
174 struct flowi4
*fl4
= &fl
->u
.ip4
;
175 __be32 daddr
= fl4
->daddr
;
176 __be32 saddr
= fl4
->saddr
;
178 if (((saddr
^ r
->src
) & r
->srcmask
) ||
179 ((daddr
^ r
->dst
) & r
->dstmask
))
182 if (r
->tos
&& (r
->tos
!= fl4
->flowi4_tos
))
185 if (rule
->ip_proto
&& (rule
->ip_proto
!= fl4
->flowi4_proto
))
188 if (fib_rule_port_range_set(&rule
->sport_range
) &&
189 !fib_rule_port_inrange(&rule
->sport_range
, fl4
->fl4_sport
))
192 if (fib_rule_port_range_set(&rule
->dport_range
) &&
193 !fib_rule_port_inrange(&rule
->dport_range
, fl4
->fl4_dport
))
199 static struct fib_table
*fib_empty_table(struct net
*net
)
204 if (!fib_get_table(net
, id
))
205 return fib_new_table(net
, id
);
207 if (id
++ == RT_TABLE_MAX
)
213 static const struct nla_policy fib4_rule_policy
[FRA_MAX
+1] = {
215 [FRA_FLOW
] = { .type
= NLA_U32
},
218 static int fib4_rule_configure(struct fib_rule
*rule
, struct sk_buff
*skb
,
219 struct fib_rule_hdr
*frh
,
221 struct netlink_ext_ack
*extack
)
223 struct net
*net
= sock_net(skb
->sk
);
225 struct fib4_rule
*rule4
= (struct fib4_rule
*) rule
;
227 if (frh
->tos
& ~IPTOS_TOS_MASK
) {
228 NL_SET_ERR_MSG(extack
, "Invalid tos");
232 /* split local/main if they are not already split */
233 err
= fib_unmerge(net
);
237 if (rule
->table
== RT_TABLE_UNSPEC
&& !rule
->l3mdev
) {
238 if (rule
->action
== FR_ACT_TO_TBL
) {
239 struct fib_table
*table
;
241 table
= fib_empty_table(net
);
247 rule
->table
= table
->tb_id
;
252 rule4
->src
= nla_get_in_addr(tb
[FRA_SRC
]);
255 rule4
->dst
= nla_get_in_addr(tb
[FRA_DST
]);
257 #ifdef CONFIG_IP_ROUTE_CLASSID
259 rule4
->tclassid
= nla_get_u32(tb
[FRA_FLOW
]);
261 net
->ipv4
.fib_num_tclassid_users
++;
265 if (fib_rule_requires_fldissect(rule
))
266 net
->ipv4
.fib_rules_require_fldissect
++;
268 rule4
->src_len
= frh
->src_len
;
269 rule4
->srcmask
= inet_make_mask(rule4
->src_len
);
270 rule4
->dst_len
= frh
->dst_len
;
271 rule4
->dstmask
= inet_make_mask(rule4
->dst_len
);
272 rule4
->tos
= frh
->tos
;
274 net
->ipv4
.fib_has_custom_rules
= true;
281 static int fib4_rule_delete(struct fib_rule
*rule
)
283 struct net
*net
= rule
->fr_net
;
286 /* split local/main if they are not already split */
287 err
= fib_unmerge(net
);
291 #ifdef CONFIG_IP_ROUTE_CLASSID
292 if (((struct fib4_rule
*)rule
)->tclassid
)
293 net
->ipv4
.fib_num_tclassid_users
--;
295 net
->ipv4
.fib_has_custom_rules
= true;
297 if (net
->ipv4
.fib_rules_require_fldissect
&&
298 fib_rule_requires_fldissect(rule
))
299 net
->ipv4
.fib_rules_require_fldissect
--;
304 static int fib4_rule_compare(struct fib_rule
*rule
, struct fib_rule_hdr
*frh
,
307 struct fib4_rule
*rule4
= (struct fib4_rule
*) rule
;
309 if (frh
->src_len
&& (rule4
->src_len
!= frh
->src_len
))
312 if (frh
->dst_len
&& (rule4
->dst_len
!= frh
->dst_len
))
315 if (frh
->tos
&& (rule4
->tos
!= frh
->tos
))
318 #ifdef CONFIG_IP_ROUTE_CLASSID
319 if (tb
[FRA_FLOW
] && (rule4
->tclassid
!= nla_get_u32(tb
[FRA_FLOW
])))
323 if (frh
->src_len
&& (rule4
->src
!= nla_get_in_addr(tb
[FRA_SRC
])))
326 if (frh
->dst_len
&& (rule4
->dst
!= nla_get_in_addr(tb
[FRA_DST
])))
332 static int fib4_rule_fill(struct fib_rule
*rule
, struct sk_buff
*skb
,
333 struct fib_rule_hdr
*frh
)
335 struct fib4_rule
*rule4
= (struct fib4_rule
*) rule
;
337 frh
->dst_len
= rule4
->dst_len
;
338 frh
->src_len
= rule4
->src_len
;
339 frh
->tos
= rule4
->tos
;
341 if ((rule4
->dst_len
&&
342 nla_put_in_addr(skb
, FRA_DST
, rule4
->dst
)) ||
344 nla_put_in_addr(skb
, FRA_SRC
, rule4
->src
)))
345 goto nla_put_failure
;
346 #ifdef CONFIG_IP_ROUTE_CLASSID
347 if (rule4
->tclassid
&&
348 nla_put_u32(skb
, FRA_FLOW
, rule4
->tclassid
))
349 goto nla_put_failure
;
357 static size_t fib4_rule_nlmsg_payload(struct fib_rule
*rule
)
359 return nla_total_size(4) /* dst */
360 + nla_total_size(4) /* src */
361 + nla_total_size(4); /* flow */
364 static void fib4_rule_flush_cache(struct fib_rules_ops
*ops
)
366 rt_cache_flush(ops
->fro_net
);
369 static const struct fib_rules_ops __net_initconst fib4_rules_ops_template
= {
371 .rule_size
= sizeof(struct fib4_rule
),
372 .addr_size
= sizeof(u32
),
373 .action
= fib4_rule_action
,
374 .suppress
= fib4_rule_suppress
,
375 .match
= fib4_rule_match
,
376 .configure
= fib4_rule_configure
,
377 .delete = fib4_rule_delete
,
378 .compare
= fib4_rule_compare
,
379 .fill
= fib4_rule_fill
,
380 .nlmsg_payload
= fib4_rule_nlmsg_payload
,
381 .flush_cache
= fib4_rule_flush_cache
,
382 .nlgroup
= RTNLGRP_IPV4_RULE
,
383 .policy
= fib4_rule_policy
,
384 .owner
= THIS_MODULE
,
387 static int fib_default_rules_init(struct fib_rules_ops
*ops
)
391 err
= fib_default_rule_add(ops
, 0, RT_TABLE_LOCAL
, 0);
394 err
= fib_default_rule_add(ops
, 0x7FFE, RT_TABLE_MAIN
, 0);
397 err
= fib_default_rule_add(ops
, 0x7FFF, RT_TABLE_DEFAULT
, 0);
403 int __net_init
fib4_rules_init(struct net
*net
)
406 struct fib_rules_ops
*ops
;
408 ops
= fib_rules_register(&fib4_rules_ops_template
, net
);
412 err
= fib_default_rules_init(ops
);
415 net
->ipv4
.rules_ops
= ops
;
416 net
->ipv4
.fib_has_custom_rules
= false;
417 net
->ipv4
.fib_rules_require_fldissect
= 0;
421 /* also cleans all rules already added */
422 fib_rules_unregister(ops
);
426 void __net_exit
fib4_rules_exit(struct net
*net
)
428 fib_rules_unregister(net
->ipv4
.rules_ops
);