1 /* 2 * net/core/fib_rules.c Generic Routing Rules 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU General Public License as 6 * published by the Free Software Foundation, version 2. 7 * 8 * Authors: Thomas Graf <tgraf@suug.ch> 9 */ 10 11 #include <linux/types.h> 12 #include <linux/kernel.h> 13 #include <linux/slab.h> 14 #include <linux/list.h> 15 #include <linux/module.h> 16 #include <net/net_namespace.h> 17 #include <net/sock.h> 18 #include <net/fib_rules.h> 19 #include <net/ip_tunnels.h> 20 21 static const struct fib_kuid_range fib_kuid_range_unset = { 22 KUIDT_INIT(0), 23 KUIDT_INIT(~0), 24 }; 25 26 bool fib_rule_matchall(const struct fib_rule *rule) 27 { 28 if (rule->iifindex || rule->oifindex || rule->mark || rule->tun_id || 29 rule->flags) 30 return false; 31 if (rule->suppress_ifgroup != -1 || rule->suppress_prefixlen != -1) 32 return false; 33 if (!uid_eq(rule->uid_range.start, fib_kuid_range_unset.start) || 34 !uid_eq(rule->uid_range.end, fib_kuid_range_unset.end)) 35 return false; 36 return true; 37 } 38 EXPORT_SYMBOL_GPL(fib_rule_matchall); 39 40 int fib_default_rule_add(struct fib_rules_ops *ops, 41 u32 pref, u32 table, u32 flags) 42 { 43 struct fib_rule *r; 44 45 r = kzalloc(ops->rule_size, GFP_KERNEL); 46 if (r == NULL) 47 return -ENOMEM; 48 49 refcount_set(&r->refcnt, 1); 50 r->action = FR_ACT_TO_TBL; 51 r->pref = pref; 52 r->table = table; 53 r->flags = flags; 54 r->fr_net = ops->fro_net; 55 r->uid_range = fib_kuid_range_unset; 56 57 r->suppress_prefixlen = -1; 58 r->suppress_ifgroup = -1; 59 60 /* The lock is not required here, the list in unreacheable 61 * at the moment this function is called */ 62 list_add_tail(&r->list, &ops->rules_list); 63 return 0; 64 } 65 EXPORT_SYMBOL(fib_default_rule_add); 66 67 static u32 fib_default_rule_pref(struct fib_rules_ops *ops) 68 { 69 struct list_head *pos; 70 struct fib_rule *rule; 71 72 if (!list_empty(&ops->rules_list)) { 73 pos = ops->rules_list.next; 74 if (pos->next != &ops->rules_list) { 75 rule = list_entry(pos->next, struct fib_rule, list); 76 if (rule->pref) 77 return rule->pref - 1; 78 } 79 } 80 81 return 0; 82 } 83 84 static void notify_rule_change(int event, struct fib_rule *rule, 85 struct fib_rules_ops *ops, struct nlmsghdr *nlh, 86 u32 pid); 87 88 static struct fib_rules_ops *lookup_rules_ops(struct net *net, int family) 89 { 90 struct fib_rules_ops *ops; 91 92 rcu_read_lock(); 93 list_for_each_entry_rcu(ops, &net->rules_ops, list) { 94 if (ops->family == family) { 95 if (!try_module_get(ops->owner)) 96 ops = NULL; 97 rcu_read_unlock(); 98 return ops; 99 } 100 } 101 rcu_read_unlock(); 102 103 return NULL; 104 } 105 106 static void rules_ops_put(struct fib_rules_ops *ops) 107 { 108 if (ops) 109 module_put(ops->owner); 110 } 111 112 static void flush_route_cache(struct fib_rules_ops *ops) 113 { 114 if (ops->flush_cache) 115 ops->flush_cache(ops); 116 } 117 118 static int __fib_rules_register(struct fib_rules_ops *ops) 119 { 120 int err = -EEXIST; 121 struct fib_rules_ops *o; 122 struct net *net; 123 124 net = ops->fro_net; 125 126 if (ops->rule_size < sizeof(struct fib_rule)) 127 return -EINVAL; 128 129 if (ops->match == NULL || ops->configure == NULL || 130 ops->compare == NULL || ops->fill == NULL || 131 ops->action == NULL) 132 return -EINVAL; 133 134 spin_lock(&net->rules_mod_lock); 135 list_for_each_entry(o, &net->rules_ops, list) 136 if (ops->family == o->family) 137 goto errout; 138 139 list_add_tail_rcu(&ops->list, &net->rules_ops); 140 err = 0; 141 errout: 142 spin_unlock(&net->rules_mod_lock); 143 144 return err; 145 } 146 147 struct fib_rules_ops * 148 fib_rules_register(const struct fib_rules_ops *tmpl, struct net *net) 149 { 150 struct fib_rules_ops *ops; 151 int err; 152 153 ops = kmemdup(tmpl, sizeof(*ops), GFP_KERNEL); 154 if (ops == NULL) 155 return ERR_PTR(-ENOMEM); 156 157 INIT_LIST_HEAD(&ops->rules_list); 158 ops->fro_net = net; 159 160 err = __fib_rules_register(ops); 161 if (err) { 162 kfree(ops); 163 ops = ERR_PTR(err); 164 } 165 166 return ops; 167 } 168 EXPORT_SYMBOL_GPL(fib_rules_register); 169 170 static void fib_rules_cleanup_ops(struct fib_rules_ops *ops) 171 { 172 struct fib_rule *rule, *tmp; 173 174 list_for_each_entry_safe(rule, tmp, &ops->rules_list, list) { 175 list_del_rcu(&rule->list); 176 if (ops->delete) 177 ops->delete(rule); 178 fib_rule_put(rule); 179 } 180 } 181 182 void fib_rules_unregister(struct fib_rules_ops *ops) 183 { 184 struct net *net = ops->fro_net; 185 186 spin_lock(&net->rules_mod_lock); 187 list_del_rcu(&ops->list); 188 spin_unlock(&net->rules_mod_lock); 189 190 fib_rules_cleanup_ops(ops); 191 kfree_rcu(ops, rcu); 192 } 193 EXPORT_SYMBOL_GPL(fib_rules_unregister); 194 195 static int uid_range_set(struct fib_kuid_range *range) 196 { 197 return uid_valid(range->start) && uid_valid(range->end); 198 } 199 200 static struct fib_kuid_range nla_get_kuid_range(struct nlattr **tb) 201 { 202 struct fib_rule_uid_range *in; 203 struct fib_kuid_range out; 204 205 in = (struct fib_rule_uid_range *)nla_data(tb[FRA_UID_RANGE]); 206 207 out.start = make_kuid(current_user_ns(), in->start); 208 out.end = make_kuid(current_user_ns(), in->end); 209 210 return out; 211 } 212 213 static int nla_put_uid_range(struct sk_buff *skb, struct fib_kuid_range *range) 214 { 215 struct fib_rule_uid_range out = { 216 from_kuid_munged(current_user_ns(), range->start), 217 from_kuid_munged(current_user_ns(), range->end) 218 }; 219 220 return nla_put(skb, FRA_UID_RANGE, sizeof(out), &out); 221 } 222 223 static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops, 224 struct flowi *fl, int flags, 225 struct fib_lookup_arg *arg) 226 { 227 int ret = 0; 228 229 if (rule->iifindex && (rule->iifindex != fl->flowi_iif)) 230 goto out; 231 232 if (rule->oifindex && (rule->oifindex != fl->flowi_oif)) 233 goto out; 234 235 if ((rule->mark ^ fl->flowi_mark) & rule->mark_mask) 236 goto out; 237 238 if (rule->tun_id && (rule->tun_id != fl->flowi_tun_key.tun_id)) 239 goto out; 240 241 if (rule->l3mdev && !l3mdev_fib_rule_match(rule->fr_net, fl, arg)) 242 goto out; 243 244 if (uid_lt(fl->flowi_uid, rule->uid_range.start) || 245 uid_gt(fl->flowi_uid, rule->uid_range.end)) 246 goto out; 247 248 ret = ops->match(rule, fl, flags); 249 out: 250 return (rule->flags & FIB_RULE_INVERT) ? !ret : ret; 251 } 252 253 int fib_rules_lookup(struct fib_rules_ops *ops, struct flowi *fl, 254 int flags, struct fib_lookup_arg *arg) 255 { 256 struct fib_rule *rule; 257 int err; 258 259 rcu_read_lock(); 260 261 list_for_each_entry_rcu(rule, &ops->rules_list, list) { 262 jumped: 263 if (!fib_rule_match(rule, ops, fl, flags, arg)) 264 continue; 265 266 if (rule->action == FR_ACT_GOTO) { 267 struct fib_rule *target; 268 269 target = rcu_dereference(rule->ctarget); 270 if (target == NULL) { 271 continue; 272 } else { 273 rule = target; 274 goto jumped; 275 } 276 } else if (rule->action == FR_ACT_NOP) 277 continue; 278 else 279 err = ops->action(rule, fl, flags, arg); 280 281 if (!err && ops->suppress && ops->suppress(rule, arg)) 282 continue; 283 284 if (err != -EAGAIN) { 285 if ((arg->flags & FIB_LOOKUP_NOREF) || 286 likely(refcount_inc_not_zero(&rule->refcnt))) { 287 arg->rule = rule; 288 goto out; 289 } 290 break; 291 } 292 } 293 294 err = -ESRCH; 295 out: 296 rcu_read_unlock(); 297 298 return err; 299 } 300 EXPORT_SYMBOL_GPL(fib_rules_lookup); 301 302 static int call_fib_rule_notifier(struct notifier_block *nb, struct net *net, 303 enum fib_event_type event_type, 304 struct fib_rule *rule, int family) 305 { 306 struct fib_rule_notifier_info info = { 307 .info.family = family, 308 .rule = rule, 309 }; 310 311 return call_fib_notifier(nb, net, event_type, &info.info); 312 } 313 314 static int call_fib_rule_notifiers(struct net *net, 315 enum fib_event_type event_type, 316 struct fib_rule *rule, 317 struct fib_rules_ops *ops, 318 struct netlink_ext_ack *extack) 319 { 320 struct fib_rule_notifier_info info = { 321 .info.family = ops->family, 322 .info.extack = extack, 323 .rule = rule, 324 }; 325 326 ops->fib_rules_seq++; 327 return call_fib_notifiers(net, event_type, &info.info); 328 } 329 330 /* Called with rcu_read_lock() */ 331 int fib_rules_dump(struct net *net, struct notifier_block *nb, int family) 332 { 333 struct fib_rules_ops *ops; 334 struct fib_rule *rule; 335 336 ops = lookup_rules_ops(net, family); 337 if (!ops) 338 return -EAFNOSUPPORT; 339 list_for_each_entry_rcu(rule, &ops->rules_list, list) 340 call_fib_rule_notifier(nb, net, FIB_EVENT_RULE_ADD, rule, 341 family); 342 rules_ops_put(ops); 343 344 return 0; 345 } 346 EXPORT_SYMBOL_GPL(fib_rules_dump); 347 348 unsigned int fib_rules_seq_read(struct net *net, int family) 349 { 350 unsigned int fib_rules_seq; 351 struct fib_rules_ops *ops; 352 353 ASSERT_RTNL(); 354 355 ops = lookup_rules_ops(net, family); 356 if (!ops) 357 return 0; 358 fib_rules_seq = ops->fib_rules_seq; 359 rules_ops_put(ops); 360 361 return fib_rules_seq; 362 } 363 EXPORT_SYMBOL_GPL(fib_rules_seq_read); 364 365 static int validate_rulemsg(struct fib_rule_hdr *frh, struct nlattr **tb, 366 struct fib_rules_ops *ops) 367 { 368 int err = -EINVAL; 369 370 if (frh->src_len) 371 if (tb[FRA_SRC] == NULL || 372 frh->src_len > (ops->addr_size * 8) || 373 nla_len(tb[FRA_SRC]) != ops->addr_size) 374 goto errout; 375 376 if (frh->dst_len) 377 if (tb[FRA_DST] == NULL || 378 frh->dst_len > (ops->addr_size * 8) || 379 nla_len(tb[FRA_DST]) != ops->addr_size) 380 goto errout; 381 382 err = 0; 383 errout: 384 return err; 385 } 386 387 static int rule_exists(struct fib_rules_ops *ops, struct fib_rule_hdr *frh, 388 struct nlattr **tb, struct fib_rule *rule) 389 { 390 struct fib_rule *r; 391 392 list_for_each_entry(r, &ops->rules_list, list) { 393 if (r->action != rule->action) 394 continue; 395 396 if (r->table != rule->table) 397 continue; 398 399 if (r->pref != rule->pref) 400 continue; 401 402 if (memcmp(r->iifname, rule->iifname, IFNAMSIZ)) 403 continue; 404 405 if (memcmp(r->oifname, rule->oifname, IFNAMSIZ)) 406 continue; 407 408 if (r->mark != rule->mark) 409 continue; 410 411 if (r->mark_mask != rule->mark_mask) 412 continue; 413 414 if (r->tun_id != rule->tun_id) 415 continue; 416 417 if (r->fr_net != rule->fr_net) 418 continue; 419 420 if (r->l3mdev != rule->l3mdev) 421 continue; 422 423 if (!uid_eq(r->uid_range.start, rule->uid_range.start) || 424 !uid_eq(r->uid_range.end, rule->uid_range.end)) 425 continue; 426 427 if (!ops->compare(r, frh, tb)) 428 continue; 429 return 1; 430 } 431 return 0; 432 } 433 434 int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh, 435 struct netlink_ext_ack *extack) 436 { 437 struct net *net = sock_net(skb->sk); 438 struct fib_rule_hdr *frh = nlmsg_data(nlh); 439 struct fib_rules_ops *ops = NULL; 440 struct fib_rule *rule, *r, *last = NULL; 441 struct nlattr *tb[FRA_MAX+1]; 442 int err = -EINVAL, unresolved = 0; 443 444 if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh))) 445 goto errout; 446 447 ops = lookup_rules_ops(net, frh->family); 448 if (ops == NULL) { 449 err = -EAFNOSUPPORT; 450 goto errout; 451 } 452 453 err = nlmsg_parse(nlh, sizeof(*frh), tb, FRA_MAX, ops->policy, extack); 454 if (err < 0) 455 goto errout; 456 457 err = validate_rulemsg(frh, tb, ops); 458 if (err < 0) 459 goto errout; 460 461 rule = kzalloc(ops->rule_size, GFP_KERNEL); 462 if (rule == NULL) { 463 err = -ENOMEM; 464 goto errout; 465 } 466 refcount_set(&rule->refcnt, 1); 467 rule->fr_net = net; 468 469 rule->pref = tb[FRA_PRIORITY] ? nla_get_u32(tb[FRA_PRIORITY]) 470 : fib_default_rule_pref(ops); 471 472 if (tb[FRA_IIFNAME]) { 473 struct net_device *dev; 474 475 rule->iifindex = -1; 476 nla_strlcpy(rule->iifname, tb[FRA_IIFNAME], IFNAMSIZ); 477 dev = __dev_get_by_name(net, rule->iifname); 478 if (dev) 479 rule->iifindex = dev->ifindex; 480 } 481 482 if (tb[FRA_OIFNAME]) { 483 struct net_device *dev; 484 485 rule->oifindex = -1; 486 nla_strlcpy(rule->oifname, tb[FRA_OIFNAME], IFNAMSIZ); 487 dev = __dev_get_by_name(net, rule->oifname); 488 if (dev) 489 rule->oifindex = dev->ifindex; 490 } 491 492 if (tb[FRA_FWMARK]) { 493 rule->mark = nla_get_u32(tb[FRA_FWMARK]); 494 if (rule->mark) 495 /* compatibility: if the mark value is non-zero all bits 496 * are compared unless a mask is explicitly specified. 497 */ 498 rule->mark_mask = 0xFFFFFFFF; 499 } 500 501 if (tb[FRA_FWMASK]) 502 rule->mark_mask = nla_get_u32(tb[FRA_FWMASK]); 503 504 if (tb[FRA_TUN_ID]) 505 rule->tun_id = nla_get_be64(tb[FRA_TUN_ID]); 506 507 err = -EINVAL; 508 if (tb[FRA_L3MDEV]) { 509 #ifdef CONFIG_NET_L3_MASTER_DEV 510 rule->l3mdev = nla_get_u8(tb[FRA_L3MDEV]); 511 if (rule->l3mdev != 1) 512 #endif 513 goto errout_free; 514 } 515 516 rule->action = frh->action; 517 rule->flags = frh->flags; 518 rule->table = frh_get_table(frh, tb); 519 if (tb[FRA_SUPPRESS_PREFIXLEN]) 520 rule->suppress_prefixlen = nla_get_u32(tb[FRA_SUPPRESS_PREFIXLEN]); 521 else 522 rule->suppress_prefixlen = -1; 523 524 if (tb[FRA_SUPPRESS_IFGROUP]) 525 rule->suppress_ifgroup = nla_get_u32(tb[FRA_SUPPRESS_IFGROUP]); 526 else 527 rule->suppress_ifgroup = -1; 528 529 if (tb[FRA_GOTO]) { 530 if (rule->action != FR_ACT_GOTO) 531 goto errout_free; 532 533 rule->target = nla_get_u32(tb[FRA_GOTO]); 534 /* Backward jumps are prohibited to avoid endless loops */ 535 if (rule->target <= rule->pref) 536 goto errout_free; 537 538 list_for_each_entry(r, &ops->rules_list, list) { 539 if (r->pref == rule->target) { 540 RCU_INIT_POINTER(rule->ctarget, r); 541 break; 542 } 543 } 544 545 if (rcu_dereference_protected(rule->ctarget, 1) == NULL) 546 unresolved = 1; 547 } else if (rule->action == FR_ACT_GOTO) 548 goto errout_free; 549 550 if (rule->l3mdev && rule->table) 551 goto errout_free; 552 553 if (tb[FRA_UID_RANGE]) { 554 if (current_user_ns() != net->user_ns) { 555 err = -EPERM; 556 goto errout_free; 557 } 558 559 rule->uid_range = nla_get_kuid_range(tb); 560 561 if (!uid_range_set(&rule->uid_range) || 562 !uid_lte(rule->uid_range.start, rule->uid_range.end)) 563 goto errout_free; 564 } else { 565 rule->uid_range = fib_kuid_range_unset; 566 } 567 568 if ((nlh->nlmsg_flags & NLM_F_EXCL) && 569 rule_exists(ops, frh, tb, rule)) { 570 err = -EEXIST; 571 goto errout_free; 572 } 573 574 err = ops->configure(rule, skb, frh, tb); 575 if (err < 0) 576 goto errout_free; 577 578 list_for_each_entry(r, &ops->rules_list, list) { 579 if (r->pref > rule->pref) 580 break; 581 last = r; 582 } 583 584 if (last) 585 list_add_rcu(&rule->list, &last->list); 586 else 587 list_add_rcu(&rule->list, &ops->rules_list); 588 589 if (ops->unresolved_rules) { 590 /* 591 * There are unresolved goto rules in the list, check if 592 * any of them are pointing to this new rule. 593 */ 594 list_for_each_entry(r, &ops->rules_list, list) { 595 if (r->action == FR_ACT_GOTO && 596 r->target == rule->pref && 597 rtnl_dereference(r->ctarget) == NULL) { 598 rcu_assign_pointer(r->ctarget, rule); 599 if (--ops->unresolved_rules == 0) 600 break; 601 } 602 } 603 } 604 605 if (rule->action == FR_ACT_GOTO) 606 ops->nr_goto_rules++; 607 608 if (unresolved) 609 ops->unresolved_rules++; 610 611 if (rule->tun_id) 612 ip_tunnel_need_metadata(); 613 614 call_fib_rule_notifiers(net, FIB_EVENT_RULE_ADD, rule, ops, extack); 615 notify_rule_change(RTM_NEWRULE, rule, ops, nlh, NETLINK_CB(skb).portid); 616 flush_route_cache(ops); 617 rules_ops_put(ops); 618 return 0; 619 620 errout_free: 621 kfree(rule); 622 errout: 623 rules_ops_put(ops); 624 return err; 625 } 626 EXPORT_SYMBOL_GPL(fib_nl_newrule); 627 628 int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr *nlh, 629 struct netlink_ext_ack *extack) 630 { 631 struct net *net = sock_net(skb->sk); 632 struct fib_rule_hdr *frh = nlmsg_data(nlh); 633 struct fib_rules_ops *ops = NULL; 634 struct fib_rule *rule, *r; 635 struct nlattr *tb[FRA_MAX+1]; 636 struct fib_kuid_range range; 637 int err = -EINVAL; 638 639 if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh))) 640 goto errout; 641 642 ops = lookup_rules_ops(net, frh->family); 643 if (ops == NULL) { 644 err = -EAFNOSUPPORT; 645 goto errout; 646 } 647 648 err = nlmsg_parse(nlh, sizeof(*frh), tb, FRA_MAX, ops->policy, extack); 649 if (err < 0) 650 goto errout; 651 652 err = validate_rulemsg(frh, tb, ops); 653 if (err < 0) 654 goto errout; 655 656 if (tb[FRA_UID_RANGE]) { 657 range = nla_get_kuid_range(tb); 658 if (!uid_range_set(&range)) { 659 err = -EINVAL; 660 goto errout; 661 } 662 } else { 663 range = fib_kuid_range_unset; 664 } 665 666 list_for_each_entry(rule, &ops->rules_list, list) { 667 if (frh->action && (frh->action != rule->action)) 668 continue; 669 670 if (frh_get_table(frh, tb) && 671 (frh_get_table(frh, tb) != rule->table)) 672 continue; 673 674 if (tb[FRA_PRIORITY] && 675 (rule->pref != nla_get_u32(tb[FRA_PRIORITY]))) 676 continue; 677 678 if (tb[FRA_IIFNAME] && 679 nla_strcmp(tb[FRA_IIFNAME], rule->iifname)) 680 continue; 681 682 if (tb[FRA_OIFNAME] && 683 nla_strcmp(tb[FRA_OIFNAME], rule->oifname)) 684 continue; 685 686 if (tb[FRA_FWMARK] && 687 (rule->mark != nla_get_u32(tb[FRA_FWMARK]))) 688 continue; 689 690 if (tb[FRA_FWMASK] && 691 (rule->mark_mask != nla_get_u32(tb[FRA_FWMASK]))) 692 continue; 693 694 if (tb[FRA_TUN_ID] && 695 (rule->tun_id != nla_get_be64(tb[FRA_TUN_ID]))) 696 continue; 697 698 if (tb[FRA_L3MDEV] && 699 (rule->l3mdev != nla_get_u8(tb[FRA_L3MDEV]))) 700 continue; 701 702 if (uid_range_set(&range) && 703 (!uid_eq(rule->uid_range.start, range.start) || 704 !uid_eq(rule->uid_range.end, range.end))) 705 continue; 706 707 if (!ops->compare(rule, frh, tb)) 708 continue; 709 710 if (rule->flags & FIB_RULE_PERMANENT) { 711 err = -EPERM; 712 goto errout; 713 } 714 715 if (ops->delete) { 716 err = ops->delete(rule); 717 if (err) 718 goto errout; 719 } 720 721 if (rule->tun_id) 722 ip_tunnel_unneed_metadata(); 723 724 list_del_rcu(&rule->list); 725 726 if (rule->action == FR_ACT_GOTO) { 727 ops->nr_goto_rules--; 728 if (rtnl_dereference(rule->ctarget) == NULL) 729 ops->unresolved_rules--; 730 } 731 732 /* 733 * Check if this rule is a target to any of them. If so, 734 * adjust to the next one with the same preference or 735 * disable them. As this operation is eventually very 736 * expensive, it is only performed if goto rules, except 737 * current if it is goto rule, have actually been added. 738 */ 739 if (ops->nr_goto_rules > 0) { 740 struct fib_rule *n; 741 742 n = list_next_entry(rule, list); 743 if (&n->list == &ops->rules_list || n->pref != rule->pref) 744 n = NULL; 745 list_for_each_entry(r, &ops->rules_list, list) { 746 if (rtnl_dereference(r->ctarget) != rule) 747 continue; 748 rcu_assign_pointer(r->ctarget, n); 749 if (!n) 750 ops->unresolved_rules++; 751 } 752 } 753 754 call_fib_rule_notifiers(net, FIB_EVENT_RULE_DEL, rule, ops, 755 NULL); 756 notify_rule_change(RTM_DELRULE, rule, ops, nlh, 757 NETLINK_CB(skb).portid); 758 fib_rule_put(rule); 759 flush_route_cache(ops); 760 rules_ops_put(ops); 761 return 0; 762 } 763 764 err = -ENOENT; 765 errout: 766 rules_ops_put(ops); 767 return err; 768 } 769 EXPORT_SYMBOL_GPL(fib_nl_delrule); 770 771 static inline size_t fib_rule_nlmsg_size(struct fib_rules_ops *ops, 772 struct fib_rule *rule) 773 { 774 size_t payload = NLMSG_ALIGN(sizeof(struct fib_rule_hdr)) 775 + nla_total_size(IFNAMSIZ) /* FRA_IIFNAME */ 776 + nla_total_size(IFNAMSIZ) /* FRA_OIFNAME */ 777 + nla_total_size(4) /* FRA_PRIORITY */ 778 + nla_total_size(4) /* FRA_TABLE */ 779 + nla_total_size(4) /* FRA_SUPPRESS_PREFIXLEN */ 780 + nla_total_size(4) /* FRA_SUPPRESS_IFGROUP */ 781 + nla_total_size(4) /* FRA_FWMARK */ 782 + nla_total_size(4) /* FRA_FWMASK */ 783 + nla_total_size_64bit(8) /* FRA_TUN_ID */ 784 + nla_total_size(sizeof(struct fib_kuid_range)); 785 786 if (ops->nlmsg_payload) 787 payload += ops->nlmsg_payload(rule); 788 789 return payload; 790 } 791 792 static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule, 793 u32 pid, u32 seq, int type, int flags, 794 struct fib_rules_ops *ops) 795 { 796 struct nlmsghdr *nlh; 797 struct fib_rule_hdr *frh; 798 799 nlh = nlmsg_put(skb, pid, seq, type, sizeof(*frh), flags); 800 if (nlh == NULL) 801 return -EMSGSIZE; 802 803 frh = nlmsg_data(nlh); 804 frh->family = ops->family; 805 frh->table = rule->table; 806 if (nla_put_u32(skb, FRA_TABLE, rule->table)) 807 goto nla_put_failure; 808 if (nla_put_u32(skb, FRA_SUPPRESS_PREFIXLEN, rule->suppress_prefixlen)) 809 goto nla_put_failure; 810 frh->res1 = 0; 811 frh->res2 = 0; 812 frh->action = rule->action; 813 frh->flags = rule->flags; 814 815 if (rule->action == FR_ACT_GOTO && 816 rcu_access_pointer(rule->ctarget) == NULL) 817 frh->flags |= FIB_RULE_UNRESOLVED; 818 819 if (rule->iifname[0]) { 820 if (nla_put_string(skb, FRA_IIFNAME, rule->iifname)) 821 goto nla_put_failure; 822 if (rule->iifindex == -1) 823 frh->flags |= FIB_RULE_IIF_DETACHED; 824 } 825 826 if (rule->oifname[0]) { 827 if (nla_put_string(skb, FRA_OIFNAME, rule->oifname)) 828 goto nla_put_failure; 829 if (rule->oifindex == -1) 830 frh->flags |= FIB_RULE_OIF_DETACHED; 831 } 832 833 if ((rule->pref && 834 nla_put_u32(skb, FRA_PRIORITY, rule->pref)) || 835 (rule->mark && 836 nla_put_u32(skb, FRA_FWMARK, rule->mark)) || 837 ((rule->mark_mask || rule->mark) && 838 nla_put_u32(skb, FRA_FWMASK, rule->mark_mask)) || 839 (rule->target && 840 nla_put_u32(skb, FRA_GOTO, rule->target)) || 841 (rule->tun_id && 842 nla_put_be64(skb, FRA_TUN_ID, rule->tun_id, FRA_PAD)) || 843 (rule->l3mdev && 844 nla_put_u8(skb, FRA_L3MDEV, rule->l3mdev)) || 845 (uid_range_set(&rule->uid_range) && 846 nla_put_uid_range(skb, &rule->uid_range))) 847 goto nla_put_failure; 848 849 if (rule->suppress_ifgroup != -1) { 850 if (nla_put_u32(skb, FRA_SUPPRESS_IFGROUP, rule->suppress_ifgroup)) 851 goto nla_put_failure; 852 } 853 854 if (ops->fill(rule, skb, frh) < 0) 855 goto nla_put_failure; 856 857 nlmsg_end(skb, nlh); 858 return 0; 859 860 nla_put_failure: 861 nlmsg_cancel(skb, nlh); 862 return -EMSGSIZE; 863 } 864 865 static int dump_rules(struct sk_buff *skb, struct netlink_callback *cb, 866 struct fib_rules_ops *ops) 867 { 868 int idx = 0; 869 struct fib_rule *rule; 870 int err = 0; 871 872 rcu_read_lock(); 873 list_for_each_entry_rcu(rule, &ops->rules_list, list) { 874 if (idx < cb->args[1]) 875 goto skip; 876 877 err = fib_nl_fill_rule(skb, rule, NETLINK_CB(cb->skb).portid, 878 cb->nlh->nlmsg_seq, RTM_NEWRULE, 879 NLM_F_MULTI, ops); 880 if (err) 881 break; 882 skip: 883 idx++; 884 } 885 rcu_read_unlock(); 886 cb->args[1] = idx; 887 rules_ops_put(ops); 888 889 return err; 890 } 891 892 static int fib_nl_dumprule(struct sk_buff *skb, struct netlink_callback *cb) 893 { 894 struct net *net = sock_net(skb->sk); 895 struct fib_rules_ops *ops; 896 int idx = 0, family; 897 898 family = rtnl_msg_family(cb->nlh); 899 if (family != AF_UNSPEC) { 900 /* Protocol specific dump request */ 901 ops = lookup_rules_ops(net, family); 902 if (ops == NULL) 903 return -EAFNOSUPPORT; 904 905 dump_rules(skb, cb, ops); 906 907 return skb->len; 908 } 909 910 rcu_read_lock(); 911 list_for_each_entry_rcu(ops, &net->rules_ops, list) { 912 if (idx < cb->args[0] || !try_module_get(ops->owner)) 913 goto skip; 914 915 if (dump_rules(skb, cb, ops) < 0) 916 break; 917 918 cb->args[1] = 0; 919 skip: 920 idx++; 921 } 922 rcu_read_unlock(); 923 cb->args[0] = idx; 924 925 return skb->len; 926 } 927 928 static void notify_rule_change(int event, struct fib_rule *rule, 929 struct fib_rules_ops *ops, struct nlmsghdr *nlh, 930 u32 pid) 931 { 932 struct net *net; 933 struct sk_buff *skb; 934 int err = -ENOBUFS; 935 936 net = ops->fro_net; 937 skb = nlmsg_new(fib_rule_nlmsg_size(ops, rule), GFP_KERNEL); 938 if (skb == NULL) 939 goto errout; 940 941 err = fib_nl_fill_rule(skb, rule, pid, nlh->nlmsg_seq, event, 0, ops); 942 if (err < 0) { 943 /* -EMSGSIZE implies BUG in fib_rule_nlmsg_size() */ 944 WARN_ON(err == -EMSGSIZE); 945 kfree_skb(skb); 946 goto errout; 947 } 948 949 rtnl_notify(skb, net, pid, ops->nlgroup, nlh, GFP_KERNEL); 950 return; 951 errout: 952 if (err < 0) 953 rtnl_set_sk_err(net, ops->nlgroup, err); 954 } 955 956 static void attach_rules(struct list_head *rules, struct net_device *dev) 957 { 958 struct fib_rule *rule; 959 960 list_for_each_entry(rule, rules, list) { 961 if (rule->iifindex == -1 && 962 strcmp(dev->name, rule->iifname) == 0) 963 rule->iifindex = dev->ifindex; 964 if (rule->oifindex == -1 && 965 strcmp(dev->name, rule->oifname) == 0) 966 rule->oifindex = dev->ifindex; 967 } 968 } 969 970 static void detach_rules(struct list_head *rules, struct net_device *dev) 971 { 972 struct fib_rule *rule; 973 974 list_for_each_entry(rule, rules, list) { 975 if (rule->iifindex == dev->ifindex) 976 rule->iifindex = -1; 977 if (rule->oifindex == dev->ifindex) 978 rule->oifindex = -1; 979 } 980 } 981 982 983 static int fib_rules_event(struct notifier_block *this, unsigned long event, 984 void *ptr) 985 { 986 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 987 struct net *net = dev_net(dev); 988 struct fib_rules_ops *ops; 989 990 ASSERT_RTNL(); 991 992 switch (event) { 993 case NETDEV_REGISTER: 994 list_for_each_entry(ops, &net->rules_ops, list) 995 attach_rules(&ops->rules_list, dev); 996 break; 997 998 case NETDEV_CHANGENAME: 999 list_for_each_entry(ops, &net->rules_ops, list) { 1000 detach_rules(&ops->rules_list, dev); 1001 attach_rules(&ops->rules_list, dev); 1002 } 1003 break; 1004 1005 case NETDEV_UNREGISTER: 1006 list_for_each_entry(ops, &net->rules_ops, list) 1007 detach_rules(&ops->rules_list, dev); 1008 break; 1009 } 1010 1011 return NOTIFY_DONE; 1012 } 1013 1014 static struct notifier_block fib_rules_notifier = { 1015 .notifier_call = fib_rules_event, 1016 }; 1017 1018 static int __net_init fib_rules_net_init(struct net *net) 1019 { 1020 INIT_LIST_HEAD(&net->rules_ops); 1021 spin_lock_init(&net->rules_mod_lock); 1022 return 0; 1023 } 1024 1025 static void __net_exit fib_rules_net_exit(struct net *net) 1026 { 1027 WARN_ON_ONCE(!list_empty(&net->rules_ops)); 1028 } 1029 1030 static struct pernet_operations fib_rules_net_ops = { 1031 .init = fib_rules_net_init, 1032 .exit = fib_rules_net_exit, 1033 }; 1034 1035 static int __init fib_rules_init(void) 1036 { 1037 int err; 1038 rtnl_register(PF_UNSPEC, RTM_NEWRULE, fib_nl_newrule, NULL, 0); 1039 rtnl_register(PF_UNSPEC, RTM_DELRULE, fib_nl_delrule, NULL, 0); 1040 rtnl_register(PF_UNSPEC, RTM_GETRULE, NULL, fib_nl_dumprule, 0); 1041 1042 err = register_pernet_subsys(&fib_rules_net_ops); 1043 if (err < 0) 1044 goto fail; 1045 1046 err = register_netdevice_notifier(&fib_rules_notifier); 1047 if (err < 0) 1048 goto fail_unregister; 1049 1050 return 0; 1051 1052 fail_unregister: 1053 unregister_pernet_subsys(&fib_rules_net_ops); 1054 fail: 1055 rtnl_unregister(PF_UNSPEC, RTM_NEWRULE); 1056 rtnl_unregister(PF_UNSPEC, RTM_DELRULE); 1057 rtnl_unregister(PF_UNSPEC, RTM_GETRULE); 1058 return err; 1059 } 1060 1061 subsys_initcall(fib_rules_init); 1062