^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0-or-later
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * INET An implementation of the TCP/IP protocol suite for the LINUX
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) * operating system. INET is implemented using the BSD Socket
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * interface as the means of communication with the user level.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) * IPv4 Forwarding Information Base: policy rules.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) * Thomas Graf <tgraf@suug.ch>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) * Fixes:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) * Rani Assaf : local_rule cannot be deleted
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) * Marc Boucher : routing by fwmark
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #include <linux/types.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) #include <linux/kernel.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) #include <linux/netdevice.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) #include <linux/netlink.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) #include <linux/inetdevice.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) #include <linux/init.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) #include <linux/list.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) #include <linux/rcupdate.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) #include <linux/export.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) #include <net/ip.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) #include <net/route.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) #include <net/tcp.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) #include <net/ip_fib.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) #include <net/nexthop.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) #include <net/fib_rules.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) #include <linux/indirect_call_wrapper.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) struct fib4_rule {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) struct fib_rule common;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) u8 dst_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) u8 src_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) u8 tos;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) __be32 src;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) __be32 srcmask;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) __be32 dst;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) __be32 dstmask;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) #ifdef CONFIG_IP_ROUTE_CLASSID
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) u32 tclassid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) static bool fib4_rule_matchall(const struct fib_rule *rule)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) struct fib4_rule *r = container_of(rule, struct fib4_rule, common);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) if (r->dst_len || r->src_len || r->tos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) return false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) return fib_rule_matchall(rule);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) bool fib4_rule_default(const struct fib_rule *rule)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) if (!fib4_rule_matchall(rule) || rule->action != FR_ACT_TO_TBL ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) rule->l3mdev)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) return false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) if (rule->table != RT_TABLE_LOCAL && rule->table != RT_TABLE_MAIN &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) rule->table != RT_TABLE_DEFAULT)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) return false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) return true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) EXPORT_SYMBOL_GPL(fib4_rule_default);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) int fib4_rules_dump(struct net *net, struct notifier_block *nb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) struct netlink_ext_ack *extack)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) return fib_rules_dump(net, nb, AF_INET, extack);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) unsigned int fib4_rules_seq_read(struct net *net)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) return fib_rules_seq_read(net, AF_INET);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) int __fib_lookup(struct net *net, struct flowi4 *flp,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) struct fib_result *res, unsigned int flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) struct fib_lookup_arg arg = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) .result = res,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) .flags = flags,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) /* update flow if oif or iif point to device enslaved to l3mdev */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) l3mdev_update_flow(net, flowi4_to_flowi(flp));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) err = fib_rules_lookup(net->ipv4.rules_ops, flowi4_to_flowi(flp), 0, &arg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) #ifdef CONFIG_IP_ROUTE_CLASSID
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) if (arg.rule)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) res->tclassid = ((struct fib4_rule *)arg.rule)->tclassid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) res->tclassid = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) if (err == -ESRCH)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) err = -ENETUNREACH;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) EXPORT_SYMBOL_GPL(__fib_lookup);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) INDIRECT_CALLABLE_SCOPE int fib4_rule_action(struct fib_rule *rule,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) struct flowi *flp, int flags,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) struct fib_lookup_arg *arg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) int err = -EAGAIN;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) struct fib_table *tbl;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) u32 tb_id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) switch (rule->action) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) case FR_ACT_TO_TBL:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) case FR_ACT_UNREACHABLE:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) return -ENETUNREACH;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) case FR_ACT_PROHIBIT:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) return -EACCES;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) case FR_ACT_BLACKHOLE:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) tb_id = fib_rule_get_table(rule, arg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) tbl = fib_get_table(rule->fr_net, tb_id);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) if (tbl)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) err = fib_table_lookup(tbl, &flp->u.ip4,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) (struct fib_result *)arg->result,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) arg->flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) INDIRECT_CALLABLE_SCOPE bool fib4_rule_suppress(struct fib_rule *rule,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) int flags,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) struct fib_lookup_arg *arg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) struct fib_result *result = (struct fib_result *) arg->result;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) struct net_device *dev = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) if (result->fi) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) struct fib_nh_common *nhc = fib_info_nhc(result->fi, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) dev = nhc->nhc_dev;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) /* do not accept result if the route does
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) * not meet the required prefix length
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) if (result->prefixlen <= rule->suppress_prefixlen)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) goto suppress_route;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) /* do not accept result if the route uses a device
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) * belonging to a forbidden interface group
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) if (rule->suppress_ifgroup != -1 && dev && dev->group == rule->suppress_ifgroup)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) goto suppress_route;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) return false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) suppress_route:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) if (!(arg->flags & FIB_LOOKUP_NOREF))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) fib_info_put(result->fi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) return true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) INDIRECT_CALLABLE_SCOPE int fib4_rule_match(struct fib_rule *rule,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) struct flowi *fl, int flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) struct fib4_rule *r = (struct fib4_rule *) rule;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) struct flowi4 *fl4 = &fl->u.ip4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) __be32 daddr = fl4->daddr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) __be32 saddr = fl4->saddr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) if (((saddr ^ r->src) & r->srcmask) ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) ((daddr ^ r->dst) & r->dstmask))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) if (r->tos && (r->tos != fl4->flowi4_tos))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) if (rule->ip_proto && (rule->ip_proto != fl4->flowi4_proto))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) if (fib_rule_port_range_set(&rule->sport_range) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) !fib_rule_port_inrange(&rule->sport_range, fl4->fl4_sport))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) if (fib_rule_port_range_set(&rule->dport_range) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) !fib_rule_port_inrange(&rule->dport_range, fl4->fl4_dport))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) return 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) static struct fib_table *fib_empty_table(struct net *net)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) u32 id = 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) while (1) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) if (!fib_get_table(net, id))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) return fib_new_table(net, id);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213) if (id++ == RT_TABLE_MAX)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) static const struct nla_policy fib4_rule_policy[FRA_MAX+1] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) FRA_GENERIC_POLICY,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221) [FRA_FLOW] = { .type = NLA_U32 },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225) struct fib_rule_hdr *frh,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226) struct nlattr **tb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227) struct netlink_ext_ack *extack)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229) struct net *net = sock_net(skb->sk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230) int err = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231) struct fib4_rule *rule4 = (struct fib4_rule *) rule;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233) if (frh->tos & ~IPTOS_TOS_MASK) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234) NL_SET_ERR_MSG(extack, "Invalid tos");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235) goto errout;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238) /* split local/main if they are not already split */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239) err = fib_unmerge(net);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241) goto errout;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243) if (rule->table == RT_TABLE_UNSPEC && !rule->l3mdev) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244) if (rule->action == FR_ACT_TO_TBL) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245) struct fib_table *table;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247) table = fib_empty_table(net);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248) if (!table) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249) err = -ENOBUFS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250) goto errout;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253) rule->table = table->tb_id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257) if (frh->src_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258) rule4->src = nla_get_in_addr(tb[FRA_SRC]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260) if (frh->dst_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261) rule4->dst = nla_get_in_addr(tb[FRA_DST]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263) #ifdef CONFIG_IP_ROUTE_CLASSID
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264) if (tb[FRA_FLOW]) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265) rule4->tclassid = nla_get_u32(tb[FRA_FLOW]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266) if (rule4->tclassid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) atomic_inc(&net->ipv4.fib_num_tclassid_users);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 269) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 270)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 271) if (fib_rule_requires_fldissect(rule))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 272) net->ipv4.fib_rules_require_fldissect++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 273)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 274) rule4->src_len = frh->src_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 275) rule4->srcmask = inet_make_mask(rule4->src_len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 276) rule4->dst_len = frh->dst_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 277) rule4->dstmask = inet_make_mask(rule4->dst_len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 278) rule4->tos = frh->tos;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 279)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 280) net->ipv4.fib_has_custom_rules = true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 281)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 282) err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 283) errout:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 284) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 285) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 286)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 287) static int fib4_rule_delete(struct fib_rule *rule)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 288) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 289) struct net *net = rule->fr_net;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 290) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 291)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 292) /* split local/main if they are not already split */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 293) err = fib_unmerge(net);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 294) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 295) goto errout;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 296)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 297) #ifdef CONFIG_IP_ROUTE_CLASSID
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 298) if (((struct fib4_rule *)rule)->tclassid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 299) atomic_dec(&net->ipv4.fib_num_tclassid_users);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 300) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 301) net->ipv4.fib_has_custom_rules = true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 302)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 303) if (net->ipv4.fib_rules_require_fldissect &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 304) fib_rule_requires_fldissect(rule))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 305) net->ipv4.fib_rules_require_fldissect--;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 306) errout:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 307) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 308) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 309)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 310) static int fib4_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 311) struct nlattr **tb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 312) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 313) struct fib4_rule *rule4 = (struct fib4_rule *) rule;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 314)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 315) if (frh->src_len && (rule4->src_len != frh->src_len))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 316) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 317)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 318) if (frh->dst_len && (rule4->dst_len != frh->dst_len))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 319) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 320)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 321) if (frh->tos && (rule4->tos != frh->tos))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 322) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 323)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 324) #ifdef CONFIG_IP_ROUTE_CLASSID
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 325) if (tb[FRA_FLOW] && (rule4->tclassid != nla_get_u32(tb[FRA_FLOW])))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 326) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 327) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 328)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 329) if (frh->src_len && (rule4->src != nla_get_in_addr(tb[FRA_SRC])))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 330) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 331)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 332) if (frh->dst_len && (rule4->dst != nla_get_in_addr(tb[FRA_DST])))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 333) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 334)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 335) return 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 336) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 337)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 338) static int fib4_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 339) struct fib_rule_hdr *frh)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 340) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 341) struct fib4_rule *rule4 = (struct fib4_rule *) rule;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 342)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 343) frh->dst_len = rule4->dst_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 344) frh->src_len = rule4->src_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 345) frh->tos = rule4->tos;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 346)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 347) if ((rule4->dst_len &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 348) nla_put_in_addr(skb, FRA_DST, rule4->dst)) ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 349) (rule4->src_len &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 350) nla_put_in_addr(skb, FRA_SRC, rule4->src)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 351) goto nla_put_failure;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 352) #ifdef CONFIG_IP_ROUTE_CLASSID
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 353) if (rule4->tclassid &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 354) nla_put_u32(skb, FRA_FLOW, rule4->tclassid))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 355) goto nla_put_failure;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 356) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 357) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 358)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 359) nla_put_failure:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 360) return -ENOBUFS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 361) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 362)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 363) static size_t fib4_rule_nlmsg_payload(struct fib_rule *rule)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 364) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 365) return nla_total_size(4) /* dst */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 366) + nla_total_size(4) /* src */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 367) + nla_total_size(4); /* flow */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 368) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 369)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 370) static void fib4_rule_flush_cache(struct fib_rules_ops *ops)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 371) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 372) rt_cache_flush(ops->fro_net);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 373) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 374)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 375) static const struct fib_rules_ops __net_initconst fib4_rules_ops_template = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 376) .family = AF_INET,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 377) .rule_size = sizeof(struct fib4_rule),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 378) .addr_size = sizeof(u32),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 379) .action = fib4_rule_action,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 380) .suppress = fib4_rule_suppress,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 381) .match = fib4_rule_match,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 382) .configure = fib4_rule_configure,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 383) .delete = fib4_rule_delete,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 384) .compare = fib4_rule_compare,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 385) .fill = fib4_rule_fill,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 386) .nlmsg_payload = fib4_rule_nlmsg_payload,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 387) .flush_cache = fib4_rule_flush_cache,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 388) .nlgroup = RTNLGRP_IPV4_RULE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 389) .policy = fib4_rule_policy,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 390) .owner = THIS_MODULE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 391) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 392)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 393) static int fib_default_rules_init(struct fib_rules_ops *ops)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 394) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 395) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 396)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 397) err = fib_default_rule_add(ops, 0, RT_TABLE_LOCAL, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 398) if (err < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 399) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 400) err = fib_default_rule_add(ops, 0x7FFE, RT_TABLE_MAIN, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 401) if (err < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 402) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 403) err = fib_default_rule_add(ops, 0x7FFF, RT_TABLE_DEFAULT, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 404) if (err < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 405) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 406) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 407) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 408)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 409) int __net_init fib4_rules_init(struct net *net)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 410) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 411) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 412) struct fib_rules_ops *ops;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 413)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 414) ops = fib_rules_register(&fib4_rules_ops_template, net);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 415) if (IS_ERR(ops))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 416) return PTR_ERR(ops);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 417)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 418) err = fib_default_rules_init(ops);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 419) if (err < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 420) goto fail;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 421) net->ipv4.rules_ops = ops;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 422) net->ipv4.fib_has_custom_rules = false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 423) net->ipv4.fib_rules_require_fldissect = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 424) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 425)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 426) fail:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 427) /* also cleans all rules already added */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 428) fib_rules_unregister(ops);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 429) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 430) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 431)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 432) void __net_exit fib4_rules_exit(struct net *net)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 433) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 434) fib_rules_unregister(net->ipv4.rules_ops);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 435) }
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags