1 // SPDX-License-Identifier: GPL-2.0-only
3 * net/ipv6/fib6_rules.c IPv6 Routing Policy Rules
5 * Copyright (C)2003-2006 Helsinki University of Technology
6 * Copyright (C)2003-2006 USAGI/WIDE Project
9 * Thomas Graf <tgraf@suug.ch>
10 * Ville Nuorvala <vnuorval@tcs.hut.fi>
13 #include <linux/netdevice.h>
14 #include <linux/notifier.h>
15 #include <linux/export.h>
17 #include <net/fib_rules.h>
19 #include <net/addrconf.h>
20 #include <net/ip6_route.h>
21 #include <net/netlink.h>
24 struct fib_rule common
;
30 static bool fib6_rule_matchall(const struct fib_rule
*rule
)
32 struct fib6_rule
*r
= container_of(rule
, struct fib6_rule
, common
);
34 if (r
->dst
.plen
|| r
->src
.plen
|| r
->tclass
)
36 return fib_rule_matchall(rule
);
39 bool fib6_rule_default(const struct fib_rule
*rule
)
41 if (!fib6_rule_matchall(rule
) || rule
->action
!= FR_ACT_TO_TBL
||
44 if (rule
->table
!= RT6_TABLE_LOCAL
&& rule
->table
!= RT6_TABLE_MAIN
)
48 EXPORT_SYMBOL_GPL(fib6_rule_default
);
50 int fib6_rules_dump(struct net
*net
, struct notifier_block
*nb
)
52 return fib_rules_dump(net
, nb
, AF_INET6
);
55 unsigned int fib6_rules_seq_read(struct net
*net
)
57 return fib_rules_seq_read(net
, AF_INET6
);
60 /* called with rcu lock held; no reference taken on fib6_info */
61 int fib6_lookup(struct net
*net
, int oif
, struct flowi6
*fl6
,
62 struct fib6_result
*res
, int flags
)
66 if (net
->ipv6
.fib6_has_custom_rules
) {
67 struct fib_lookup_arg arg
= {
68 .lookup_ptr
= fib6_table_lookup
,
71 .flags
= FIB_LOOKUP_NOREF
,
74 l3mdev_update_flow(net
, flowi6_to_flowi(fl6
));
76 err
= fib_rules_lookup(net
->ipv6
.fib6_rules_ops
,
77 flowi6_to_flowi(fl6
), flags
, &arg
);
79 err
= fib6_table_lookup(net
, net
->ipv6
.fib6_local_tbl
, oif
,
81 if (err
|| res
->f6i
== net
->ipv6
.fib6_null_entry
)
82 err
= fib6_table_lookup(net
, net
->ipv6
.fib6_main_tbl
,
83 oif
, fl6
, res
, flags
);
89 struct dst_entry
*fib6_rule_lookup(struct net
*net
, struct flowi6
*fl6
,
90 const struct sk_buff
*skb
,
91 int flags
, pol_lookup_t lookup
)
93 if (net
->ipv6
.fib6_has_custom_rules
) {
94 struct fib6_result res
= {};
95 struct fib_lookup_arg arg
= {
99 .flags
= FIB_LOOKUP_NOREF
,
102 /* update flow if oif or iif point to device enslaved to l3mdev */
103 l3mdev_update_flow(net
, flowi6_to_flowi(fl6
));
105 fib_rules_lookup(net
->ipv6
.fib6_rules_ops
,
106 flowi6_to_flowi(fl6
), flags
, &arg
);
109 return &res
.rt6
->dst
;
113 rt
= lookup(net
, net
->ipv6
.fib6_local_tbl
, fl6
, skb
, flags
);
114 if (rt
!= net
->ipv6
.ip6_null_entry
&& rt
->dst
.error
!= -EAGAIN
)
117 rt
= lookup(net
, net
->ipv6
.fib6_main_tbl
, fl6
, skb
, flags
);
118 if (rt
->dst
.error
!= -EAGAIN
)
123 dst_hold(&net
->ipv6
.ip6_null_entry
->dst
);
124 return &net
->ipv6
.ip6_null_entry
->dst
;
127 static int fib6_rule_saddr(struct net
*net
, struct fib_rule
*rule
, int flags
,
128 struct flowi6
*flp6
, const struct net_device
*dev
)
130 struct fib6_rule
*r
= (struct fib6_rule
*)rule
;
132 /* If we need to find a source address for this traffic,
133 * we check the result if it meets requirement of the rule.
135 if ((rule
->flags
& FIB_RULE_FIND_SADDR
) &&
136 r
->src
.plen
&& !(flags
& RT6_LOOKUP_F_HAS_SADDR
)) {
137 struct in6_addr saddr
;
139 if (ipv6_dev_get_saddr(net
, dev
, &flp6
->daddr
,
140 rt6_flags2srcprefs(flags
), &saddr
))
143 if (!ipv6_prefix_equal(&saddr
, &r
->src
.addr
, r
->src
.plen
))
152 static int fib6_rule_action_alt(struct fib_rule
*rule
, struct flowi
*flp
,
153 int flags
, struct fib_lookup_arg
*arg
)
155 struct fib6_result
*res
= arg
->result
;
156 struct flowi6
*flp6
= &flp
->u
.ip6
;
157 struct net
*net
= rule
->fr_net
;
158 struct fib6_table
*table
;
162 switch (rule
->action
) {
165 case FR_ACT_UNREACHABLE
:
167 case FR_ACT_PROHIBIT
:
169 case FR_ACT_BLACKHOLE
:
174 tb_id
= fib_rule_get_table(rule
, arg
);
175 table
= fib6_get_table(net
, tb_id
);
179 oif
= (int *)arg
->lookup_data
;
180 err
= fib6_table_lookup(net
, table
, *oif
, flp6
, res
, flags
);
181 if (!err
&& res
->f6i
!= net
->ipv6
.fib6_null_entry
)
182 err
= fib6_rule_saddr(net
, rule
, flags
, flp6
,
183 res
->nh
->fib_nh_dev
);
190 static int __fib6_rule_action(struct fib_rule
*rule
, struct flowi
*flp
,
191 int flags
, struct fib_lookup_arg
*arg
)
193 struct fib6_result
*res
= arg
->result
;
194 struct flowi6
*flp6
= &flp
->u
.ip6
;
195 struct rt6_info
*rt
= NULL
;
196 struct fib6_table
*table
;
197 struct net
*net
= rule
->fr_net
;
198 pol_lookup_t lookup
= arg
->lookup_ptr
;
202 switch (rule
->action
) {
205 case FR_ACT_UNREACHABLE
:
207 rt
= net
->ipv6
.ip6_null_entry
;
210 case FR_ACT_BLACKHOLE
:
212 rt
= net
->ipv6
.ip6_blk_hole_entry
;
214 case FR_ACT_PROHIBIT
:
216 rt
= net
->ipv6
.ip6_prohibit_entry
;
220 tb_id
= fib_rule_get_table(rule
, arg
);
221 table
= fib6_get_table(net
, tb_id
);
227 rt
= lookup(net
, table
, flp6
, arg
->lookup_data
, flags
);
228 if (rt
!= net
->ipv6
.ip6_null_entry
) {
229 err
= fib6_rule_saddr(net
, rule
, flags
, flp6
,
230 ip6_dst_idev(&rt
->dst
)->dev
);
252 static int fib6_rule_action(struct fib_rule
*rule
, struct flowi
*flp
,
253 int flags
, struct fib_lookup_arg
*arg
)
255 if (arg
->lookup_ptr
== fib6_table_lookup
)
256 return fib6_rule_action_alt(rule
, flp
, flags
, arg
);
258 return __fib6_rule_action(rule
, flp
, flags
, arg
);
261 static bool fib6_rule_suppress(struct fib_rule
*rule
, struct fib_lookup_arg
*arg
)
263 struct fib6_result
*res
= arg
->result
;
264 struct rt6_info
*rt
= res
->rt6
;
265 struct net_device
*dev
= NULL
;
271 dev
= rt
->rt6i_idev
->dev
;
273 /* do not accept result if the route does
274 * not meet the required prefix length
276 if (rt
->rt6i_dst
.plen
<= rule
->suppress_prefixlen
)
279 /* do not accept result if the route uses a device
280 * belonging to a forbidden interface group
282 if (rule
->suppress_ifgroup
!= -1 && dev
&& dev
->group
== rule
->suppress_ifgroup
)
292 static int fib6_rule_match(struct fib_rule
*rule
, struct flowi
*fl
, int flags
)
294 struct fib6_rule
*r
= (struct fib6_rule
*) rule
;
295 struct flowi6
*fl6
= &fl
->u
.ip6
;
298 !ipv6_prefix_equal(&fl6
->daddr
, &r
->dst
.addr
, r
->dst
.plen
))
302 * If FIB_RULE_FIND_SADDR is set and we do not have a
303 * source address for the traffic, we defer check for
307 if (flags
& RT6_LOOKUP_F_HAS_SADDR
) {
308 if (!ipv6_prefix_equal(&fl6
->saddr
, &r
->src
.addr
,
311 } else if (!(r
->common
.flags
& FIB_RULE_FIND_SADDR
))
315 if (r
->tclass
&& r
->tclass
!= ip6_tclass(fl6
->flowlabel
))
318 if (rule
->ip_proto
&& (rule
->ip_proto
!= fl6
->flowi6_proto
))
321 if (fib_rule_port_range_set(&rule
->sport_range
) &&
322 !fib_rule_port_inrange(&rule
->sport_range
, fl6
->fl6_sport
))
325 if (fib_rule_port_range_set(&rule
->dport_range
) &&
326 !fib_rule_port_inrange(&rule
->dport_range
, fl6
->fl6_dport
))
332 static const struct nla_policy fib6_rule_policy
[FRA_MAX
+1] = {
336 static int fib6_rule_configure(struct fib_rule
*rule
, struct sk_buff
*skb
,
337 struct fib_rule_hdr
*frh
,
339 struct netlink_ext_ack
*extack
)
342 struct net
*net
= sock_net(skb
->sk
);
343 struct fib6_rule
*rule6
= (struct fib6_rule
*) rule
;
345 if (rule
->action
== FR_ACT_TO_TBL
&& !rule
->l3mdev
) {
346 if (rule
->table
== RT6_TABLE_UNSPEC
) {
347 NL_SET_ERR_MSG(extack
, "Invalid table");
351 if (fib6_new_table(net
, rule
->table
) == NULL
) {
358 rule6
->src
.addr
= nla_get_in6_addr(tb
[FRA_SRC
]);
361 rule6
->dst
.addr
= nla_get_in6_addr(tb
[FRA_DST
]);
363 rule6
->src
.plen
= frh
->src_len
;
364 rule6
->dst
.plen
= frh
->dst_len
;
365 rule6
->tclass
= frh
->tos
;
367 if (fib_rule_requires_fldissect(rule
))
368 net
->ipv6
.fib6_rules_require_fldissect
++;
370 net
->ipv6
.fib6_has_custom_rules
= true;
376 static int fib6_rule_delete(struct fib_rule
*rule
)
378 struct net
*net
= rule
->fr_net
;
380 if (net
->ipv6
.fib6_rules_require_fldissect
&&
381 fib_rule_requires_fldissect(rule
))
382 net
->ipv6
.fib6_rules_require_fldissect
--;
387 static int fib6_rule_compare(struct fib_rule
*rule
, struct fib_rule_hdr
*frh
,
390 struct fib6_rule
*rule6
= (struct fib6_rule
*) rule
;
392 if (frh
->src_len
&& (rule6
->src
.plen
!= frh
->src_len
))
395 if (frh
->dst_len
&& (rule6
->dst
.plen
!= frh
->dst_len
))
398 if (frh
->tos
&& (rule6
->tclass
!= frh
->tos
))
402 nla_memcmp(tb
[FRA_SRC
], &rule6
->src
.addr
, sizeof(struct in6_addr
)))
406 nla_memcmp(tb
[FRA_DST
], &rule6
->dst
.addr
, sizeof(struct in6_addr
)))
412 static int fib6_rule_fill(struct fib_rule
*rule
, struct sk_buff
*skb
,
413 struct fib_rule_hdr
*frh
)
415 struct fib6_rule
*rule6
= (struct fib6_rule
*) rule
;
417 frh
->dst_len
= rule6
->dst
.plen
;
418 frh
->src_len
= rule6
->src
.plen
;
419 frh
->tos
= rule6
->tclass
;
421 if ((rule6
->dst
.plen
&&
422 nla_put_in6_addr(skb
, FRA_DST
, &rule6
->dst
.addr
)) ||
424 nla_put_in6_addr(skb
, FRA_SRC
, &rule6
->src
.addr
)))
425 goto nla_put_failure
;
432 static size_t fib6_rule_nlmsg_payload(struct fib_rule
*rule
)
434 return nla_total_size(16) /* dst */
435 + nla_total_size(16); /* src */
438 static const struct fib_rules_ops __net_initconst fib6_rules_ops_template
= {
440 .rule_size
= sizeof(struct fib6_rule
),
441 .addr_size
= sizeof(struct in6_addr
),
442 .action
= fib6_rule_action
,
443 .match
= fib6_rule_match
,
444 .suppress
= fib6_rule_suppress
,
445 .configure
= fib6_rule_configure
,
446 .delete = fib6_rule_delete
,
447 .compare
= fib6_rule_compare
,
448 .fill
= fib6_rule_fill
,
449 .nlmsg_payload
= fib6_rule_nlmsg_payload
,
450 .nlgroup
= RTNLGRP_IPV6_RULE
,
451 .policy
= fib6_rule_policy
,
452 .owner
= THIS_MODULE
,
453 .fro_net
= &init_net
,
456 static int __net_init
fib6_rules_net_init(struct net
*net
)
458 struct fib_rules_ops
*ops
;
461 ops
= fib_rules_register(&fib6_rules_ops_template
, net
);
465 err
= fib_default_rule_add(ops
, 0, RT6_TABLE_LOCAL
, 0);
467 goto out_fib6_rules_ops
;
469 err
= fib_default_rule_add(ops
, 0x7FFE, RT6_TABLE_MAIN
, 0);
471 goto out_fib6_rules_ops
;
473 net
->ipv6
.fib6_rules_ops
= ops
;
474 net
->ipv6
.fib6_rules_require_fldissect
= 0;
479 fib_rules_unregister(ops
);
483 static void __net_exit
fib6_rules_net_exit(struct net
*net
)
486 fib_rules_unregister(net
->ipv6
.fib6_rules_ops
);
490 static struct pernet_operations fib6_rules_net_ops
= {
491 .init
= fib6_rules_net_init
,
492 .exit
= fib6_rules_net_exit
,
495 int __init
fib6_rules_init(void)
497 return register_pernet_subsys(&fib6_rules_net_ops
);
501 void fib6_rules_cleanup(void)
503 unregister_pernet_subsys(&fib6_rules_net_ops
);