1 /* 2 * net/core/fib_rules.c Generic Routing Rules 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU General Public License as 6 * published by the Free Software Foundation, version 2. 7 * 8 * Authors: Thomas Graf <tgraf@suug.ch> 9 */ 10 11 #include <linux/types.h> 12 #include <linux/kernel.h> 13 #include <linux/slab.h> 14 #include <linux/list.h> 15 #include <linux/module.h> 16 #include <net/net_namespace.h> 17 #include <net/sock.h> 18 #include <net/fib_rules.h> 19 #include <net/ip_tunnels.h> 20 21 static const struct fib_kuid_range fib_kuid_range_unset = { 22 KUIDT_INIT(0), 23 KUIDT_INIT(~0), 24 }; 25 26 bool fib_rule_matchall(const struct fib_rule *rule) 27 { 28 if (rule->iifindex || rule->oifindex || rule->mark || rule->tun_id || 29 rule->flags) 30 return false; 31 if (rule->suppress_ifgroup != -1 || rule->suppress_prefixlen != -1) 32 return false; 33 if (!uid_eq(rule->uid_range.start, fib_kuid_range_unset.start) || 34 !uid_eq(rule->uid_range.end, fib_kuid_range_unset.end)) 35 return false; 36 return true; 37 } 38 EXPORT_SYMBOL_GPL(fib_rule_matchall); 39 40 int fib_default_rule_add(struct fib_rules_ops *ops, 41 u32 pref, u32 table, u32 flags) 42 { 43 struct fib_rule *r; 44 45 r = kzalloc(ops->rule_size, GFP_KERNEL); 46 if (r == NULL) 47 return -ENOMEM; 48 49 refcount_set(&r->refcnt, 1); 50 r->action = FR_ACT_TO_TBL; 51 r->pref = pref; 52 r->table = table; 53 r->flags = flags; 54 r->fr_net = ops->fro_net; 55 r->uid_range = fib_kuid_range_unset; 56 57 r->suppress_prefixlen = -1; 58 r->suppress_ifgroup = -1; 59 60 /* The lock is not required here, the list in unreacheable 61 * at the moment this function is called */ 62 list_add_tail(&r->list, &ops->rules_list); 63 return 0; 64 } 65 EXPORT_SYMBOL(fib_default_rule_add); 66 67 static u32 fib_default_rule_pref(struct fib_rules_ops *ops) 68 { 69 struct list_head *pos; 70 struct fib_rule *rule; 71 72 if (!list_empty(&ops->rules_list)) { 73 pos = ops->rules_list.next; 74 if (pos->next != &ops->rules_list) { 75 rule = list_entry(pos->next, struct fib_rule, list); 76 if (rule->pref) 77 return rule->pref - 1; 78 } 79 } 80 81 return 0; 82 } 83 84 static void notify_rule_change(int event, struct fib_rule *rule, 85 struct fib_rules_ops *ops, struct nlmsghdr *nlh, 86 u32 pid); 87 88 static struct fib_rules_ops *lookup_rules_ops(struct net *net, int family) 89 { 90 struct fib_rules_ops *ops; 91 92 rcu_read_lock(); 93 list_for_each_entry_rcu(ops, &net->rules_ops, list) { 94 if (ops->family == family) { 95 if (!try_module_get(ops->owner)) 96 ops = NULL; 97 rcu_read_unlock(); 98 return ops; 99 } 100 } 101 rcu_read_unlock(); 102 103 return NULL; 104 } 105 106 static void rules_ops_put(struct fib_rules_ops *ops) 107 { 108 if (ops) 109 module_put(ops->owner); 110 } 111 112 static void flush_route_cache(struct fib_rules_ops *ops) 113 { 114 if (ops->flush_cache) 115 ops->flush_cache(ops); 116 } 117 118 static int __fib_rules_register(struct fib_rules_ops *ops) 119 { 120 int err = -EEXIST; 121 struct fib_rules_ops *o; 122 struct net *net; 123 124 net = ops->fro_net; 125 126 if (ops->rule_size < sizeof(struct fib_rule)) 127 return -EINVAL; 128 129 if (ops->match == NULL || ops->configure == NULL || 130 ops->compare == NULL || ops->fill == NULL || 131 ops->action == NULL) 132 return -EINVAL; 133 134 spin_lock(&net->rules_mod_lock); 135 list_for_each_entry(o, &net->rules_ops, list) 136 if (ops->family == o->family) 137 goto errout; 138 139 list_add_tail_rcu(&ops->list, &net->rules_ops); 140 err = 0; 141 errout: 142 spin_unlock(&net->rules_mod_lock); 143 144 return err; 145 } 146 147 struct fib_rules_ops * 148 fib_rules_register(const struct fib_rules_ops *tmpl, struct net *net) 149 { 150 struct fib_rules_ops *ops; 151 int err; 152 153 ops = kmemdup(tmpl, sizeof(*ops), GFP_KERNEL); 154 if (ops == NULL) 155 return ERR_PTR(-ENOMEM); 156 157 INIT_LIST_HEAD(&ops->rules_list); 158 ops->fro_net = net; 159 160 err = __fib_rules_register(ops); 161 if (err) { 162 kfree(ops); 163 ops = ERR_PTR(err); 164 } 165 166 return ops; 167 } 168 EXPORT_SYMBOL_GPL(fib_rules_register); 169 170 static void fib_rules_cleanup_ops(struct fib_rules_ops *ops) 171 { 172 struct fib_rule *rule, *tmp; 173 174 list_for_each_entry_safe(rule, tmp, &ops->rules_list, list) { 175 list_del_rcu(&rule->list); 176 if (ops->delete) 177 ops->delete(rule); 178 fib_rule_put(rule); 179 } 180 } 181 182 void fib_rules_unregister(struct fib_rules_ops *ops) 183 { 184 struct net *net = ops->fro_net; 185 186 spin_lock(&net->rules_mod_lock); 187 list_del_rcu(&ops->list); 188 spin_unlock(&net->rules_mod_lock); 189 190 fib_rules_cleanup_ops(ops); 191 kfree_rcu(ops, rcu); 192 } 193 EXPORT_SYMBOL_GPL(fib_rules_unregister); 194 195 static int uid_range_set(struct fib_kuid_range *range) 196 { 197 return uid_valid(range->start) && uid_valid(range->end); 198 } 199 200 static struct fib_kuid_range nla_get_kuid_range(struct nlattr **tb) 201 { 202 struct fib_rule_uid_range *in; 203 struct fib_kuid_range out; 204 205 in = (struct fib_rule_uid_range *)nla_data(tb[FRA_UID_RANGE]); 206 207 out.start = make_kuid(current_user_ns(), in->start); 208 out.end = make_kuid(current_user_ns(), in->end); 209 210 return out; 211 } 212 213 static int nla_put_uid_range(struct sk_buff *skb, struct fib_kuid_range *range) 214 { 215 struct fib_rule_uid_range out = { 216 from_kuid_munged(current_user_ns(), range->start), 217 from_kuid_munged(current_user_ns(), range->end) 218 }; 219 220 return nla_put(skb, FRA_UID_RANGE, sizeof(out), &out); 221 } 222 223 static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops, 224 struct flowi *fl, int flags, 225 struct fib_lookup_arg *arg) 226 { 227 int ret = 0; 228 229 if (rule->iifindex && (rule->iifindex != fl->flowi_iif)) 230 goto out; 231 232 if (rule->oifindex && (rule->oifindex != fl->flowi_oif)) 233 goto out; 234 235 if ((rule->mark ^ fl->flowi_mark) & rule->mark_mask) 236 goto out; 237 238 if (rule->tun_id && (rule->tun_id != fl->flowi_tun_key.tun_id)) 239 goto out; 240 241 if (rule->l3mdev && !l3mdev_fib_rule_match(rule->fr_net, fl, arg)) 242 goto out; 243 244 if (uid_lt(fl->flowi_uid, rule->uid_range.start) || 245 uid_gt(fl->flowi_uid, rule->uid_range.end)) 246 goto out; 247 248 ret = ops->match(rule, fl, flags); 249 out: 250 return (rule->flags & FIB_RULE_INVERT) ? !ret : ret; 251 } 252 253 int fib_rules_lookup(struct fib_rules_ops *ops, struct flowi *fl, 254 int flags, struct fib_lookup_arg *arg) 255 { 256 struct fib_rule *rule; 257 int err; 258 259 rcu_read_lock(); 260 261 list_for_each_entry_rcu(rule, &ops->rules_list, list) { 262 jumped: 263 if (!fib_rule_match(rule, ops, fl, flags, arg)) 264 continue; 265 266 if (rule->action == FR_ACT_GOTO) { 267 struct fib_rule *target; 268 269 target = rcu_dereference(rule->ctarget); 270 if (target == NULL) { 271 continue; 272 } else { 273 rule = target; 274 goto jumped; 275 } 276 } else if (rule->action == FR_ACT_NOP) 277 continue; 278 else 279 err = ops->action(rule, fl, flags, arg); 280 281 if (!err && ops->suppress && ops->suppress(rule, arg)) 282 continue; 283 284 if (err != -EAGAIN) { 285 if ((arg->flags & FIB_LOOKUP_NOREF) || 286 likely(refcount_inc_not_zero(&rule->refcnt))) { 287 arg->rule = rule; 288 goto out; 289 } 290 break; 291 } 292 } 293 294 err = -ESRCH; 295 out: 296 rcu_read_unlock(); 297 298 return err; 299 } 300 EXPORT_SYMBOL_GPL(fib_rules_lookup); 301 302 static int call_fib_rule_notifier(struct notifier_block *nb, struct net *net, 303 enum fib_event_type event_type, 304 struct fib_rule *rule, int family) 305 { 306 struct fib_rule_notifier_info info = { 307 .info.family = family, 308 .rule = rule, 309 }; 310 311 return call_fib_notifier(nb, net, event_type, &info.info); 312 } 313 314 static int call_fib_rule_notifiers(struct net *net, 315 enum fib_event_type event_type, 316 struct fib_rule *rule, 317 struct fib_rules_ops *ops) 318 { 319 struct fib_rule_notifier_info info = { 320 .info.family = ops->family, 321 .rule = rule, 322 }; 323 324 ops->fib_rules_seq++; 325 return call_fib_notifiers(net, event_type, &info.info); 326 } 327 328 /* Called with rcu_read_lock() */ 329 int fib_rules_dump(struct net *net, struct notifier_block *nb, int family) 330 { 331 struct fib_rules_ops *ops; 332 struct fib_rule *rule; 333 334 ops = lookup_rules_ops(net, family); 335 if (!ops) 336 return -EAFNOSUPPORT; 337 list_for_each_entry_rcu(rule, &ops->rules_list, list) 338 call_fib_rule_notifier(nb, net, FIB_EVENT_RULE_ADD, rule, 339 family); 340 rules_ops_put(ops); 341 342 return 0; 343 } 344 EXPORT_SYMBOL_GPL(fib_rules_dump); 345 346 unsigned int fib_rules_seq_read(struct net *net, int family) 347 { 348 unsigned int fib_rules_seq; 349 struct fib_rules_ops *ops; 350 351 ASSERT_RTNL(); 352 353 ops = lookup_rules_ops(net, family); 354 if (!ops) 355 return 0; 356 fib_rules_seq = ops->fib_rules_seq; 357 rules_ops_put(ops); 358 359 return fib_rules_seq; 360 } 361 EXPORT_SYMBOL_GPL(fib_rules_seq_read); 362 363 static int validate_rulemsg(struct fib_rule_hdr *frh, struct nlattr **tb, 364 struct fib_rules_ops *ops) 365 { 366 int err = -EINVAL; 367 368 if (frh->src_len) 369 if (tb[FRA_SRC] == NULL || 370 frh->src_len > (ops->addr_size * 8) || 371 nla_len(tb[FRA_SRC]) != ops->addr_size) 372 goto errout; 373 374 if (frh->dst_len) 375 if (tb[FRA_DST] == NULL || 376 frh->dst_len > (ops->addr_size * 8) || 377 nla_len(tb[FRA_DST]) != ops->addr_size) 378 goto errout; 379 380 err = 0; 381 errout: 382 return err; 383 } 384 385 static int rule_exists(struct fib_rules_ops *ops, struct fib_rule_hdr *frh, 386 struct nlattr **tb, struct fib_rule *rule) 387 { 388 struct fib_rule *r; 389 390 list_for_each_entry(r, &ops->rules_list, list) { 391 if (r->action != rule->action) 392 continue; 393 394 if (r->table != rule->table) 395 continue; 396 397 if (r->pref != rule->pref) 398 continue; 399 400 if (memcmp(r->iifname, rule->iifname, IFNAMSIZ)) 401 continue; 402 403 if (memcmp(r->oifname, rule->oifname, IFNAMSIZ)) 404 continue; 405 406 if (r->mark != rule->mark) 407 continue; 408 409 if (r->mark_mask != rule->mark_mask) 410 continue; 411 412 if (r->tun_id != rule->tun_id) 413 continue; 414 415 if (r->fr_net != rule->fr_net) 416 continue; 417 418 if (r->l3mdev != rule->l3mdev) 419 continue; 420 421 if (!uid_eq(r->uid_range.start, rule->uid_range.start) || 422 !uid_eq(r->uid_range.end, rule->uid_range.end)) 423 continue; 424 425 if (!ops->compare(r, frh, tb)) 426 continue; 427 return 1; 428 } 429 return 0; 430 } 431 432 int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh, 433 struct netlink_ext_ack *extack) 434 { 435 struct net *net = sock_net(skb->sk); 436 struct fib_rule_hdr *frh = nlmsg_data(nlh); 437 struct fib_rules_ops *ops = NULL; 438 struct fib_rule *rule, *r, *last = NULL; 439 struct nlattr *tb[FRA_MAX+1]; 440 int err = -EINVAL, unresolved = 0; 441 442 if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh))) 443 goto errout; 444 445 ops = lookup_rules_ops(net, frh->family); 446 if (ops == NULL) { 447 err = -EAFNOSUPPORT; 448 goto errout; 449 } 450 451 err = nlmsg_parse(nlh, sizeof(*frh), tb, FRA_MAX, ops->policy, extack); 452 if (err < 0) 453 goto errout; 454 455 err = validate_rulemsg(frh, tb, ops); 456 if (err < 0) 457 goto errout; 458 459 rule = kzalloc(ops->rule_size, GFP_KERNEL); 460 if (rule == NULL) { 461 err = -ENOMEM; 462 goto errout; 463 } 464 refcount_set(&rule->refcnt, 1); 465 rule->fr_net = net; 466 467 rule->pref = tb[FRA_PRIORITY] ? nla_get_u32(tb[FRA_PRIORITY]) 468 : fib_default_rule_pref(ops); 469 470 if (tb[FRA_IIFNAME]) { 471 struct net_device *dev; 472 473 rule->iifindex = -1; 474 nla_strlcpy(rule->iifname, tb[FRA_IIFNAME], IFNAMSIZ); 475 dev = __dev_get_by_name(net, rule->iifname); 476 if (dev) 477 rule->iifindex = dev->ifindex; 478 } 479 480 if (tb[FRA_OIFNAME]) { 481 struct net_device *dev; 482 483 rule->oifindex = -1; 484 nla_strlcpy(rule->oifname, tb[FRA_OIFNAME], IFNAMSIZ); 485 dev = __dev_get_by_name(net, rule->oifname); 486 if (dev) 487 rule->oifindex = dev->ifindex; 488 } 489 490 if (tb[FRA_FWMARK]) { 491 rule->mark = nla_get_u32(tb[FRA_FWMARK]); 492 if (rule->mark) 493 /* compatibility: if the mark value is non-zero all bits 494 * are compared unless a mask is explicitly specified. 495 */ 496 rule->mark_mask = 0xFFFFFFFF; 497 } 498 499 if (tb[FRA_FWMASK]) 500 rule->mark_mask = nla_get_u32(tb[FRA_FWMASK]); 501 502 if (tb[FRA_TUN_ID]) 503 rule->tun_id = nla_get_be64(tb[FRA_TUN_ID]); 504 505 err = -EINVAL; 506 if (tb[FRA_L3MDEV]) { 507 #ifdef CONFIG_NET_L3_MASTER_DEV 508 rule->l3mdev = nla_get_u8(tb[FRA_L3MDEV]); 509 if (rule->l3mdev != 1) 510 #endif 511 goto errout_free; 512 } 513 514 rule->action = frh->action; 515 rule->flags = frh->flags; 516 rule->table = frh_get_table(frh, tb); 517 if (tb[FRA_SUPPRESS_PREFIXLEN]) 518 rule->suppress_prefixlen = nla_get_u32(tb[FRA_SUPPRESS_PREFIXLEN]); 519 else 520 rule->suppress_prefixlen = -1; 521 522 if (tb[FRA_SUPPRESS_IFGROUP]) 523 rule->suppress_ifgroup = nla_get_u32(tb[FRA_SUPPRESS_IFGROUP]); 524 else 525 rule->suppress_ifgroup = -1; 526 527 if (tb[FRA_GOTO]) { 528 if (rule->action != FR_ACT_GOTO) 529 goto errout_free; 530 531 rule->target = nla_get_u32(tb[FRA_GOTO]); 532 /* Backward jumps are prohibited to avoid endless loops */ 533 if (rule->target <= rule->pref) 534 goto errout_free; 535 536 list_for_each_entry(r, &ops->rules_list, list) { 537 if (r->pref == rule->target) { 538 RCU_INIT_POINTER(rule->ctarget, r); 539 break; 540 } 541 } 542 543 if (rcu_dereference_protected(rule->ctarget, 1) == NULL) 544 unresolved = 1; 545 } else if (rule->action == FR_ACT_GOTO) 546 goto errout_free; 547 548 if (rule->l3mdev && rule->table) 549 goto errout_free; 550 551 if (tb[FRA_UID_RANGE]) { 552 if (current_user_ns() != net->user_ns) { 553 err = -EPERM; 554 goto errout_free; 555 } 556 557 rule->uid_range = nla_get_kuid_range(tb); 558 559 if (!uid_range_set(&rule->uid_range) || 560 !uid_lte(rule->uid_range.start, rule->uid_range.end)) 561 goto errout_free; 562 } else { 563 rule->uid_range = fib_kuid_range_unset; 564 } 565 566 if ((nlh->nlmsg_flags & NLM_F_EXCL) && 567 rule_exists(ops, frh, tb, rule)) { 568 err = -EEXIST; 569 goto errout_free; 570 } 571 572 err = ops->configure(rule, skb, frh, tb); 573 if (err < 0) 574 goto errout_free; 575 576 list_for_each_entry(r, &ops->rules_list, list) { 577 if (r->pref > rule->pref) 578 break; 579 last = r; 580 } 581 582 if (last) 583 list_add_rcu(&rule->list, &last->list); 584 else 585 list_add_rcu(&rule->list, &ops->rules_list); 586 587 if (ops->unresolved_rules) { 588 /* 589 * There are unresolved goto rules in the list, check if 590 * any of them are pointing to this new rule. 591 */ 592 list_for_each_entry(r, &ops->rules_list, list) { 593 if (r->action == FR_ACT_GOTO && 594 r->target == rule->pref && 595 rtnl_dereference(r->ctarget) == NULL) { 596 rcu_assign_pointer(r->ctarget, rule); 597 if (--ops->unresolved_rules == 0) 598 break; 599 } 600 } 601 } 602 603 if (rule->action == FR_ACT_GOTO) 604 ops->nr_goto_rules++; 605 606 if (unresolved) 607 ops->unresolved_rules++; 608 609 if (rule->tun_id) 610 ip_tunnel_need_metadata(); 611 612 call_fib_rule_notifiers(net, FIB_EVENT_RULE_ADD, rule, ops); 613 notify_rule_change(RTM_NEWRULE, rule, ops, nlh, NETLINK_CB(skb).portid); 614 flush_route_cache(ops); 615 rules_ops_put(ops); 616 return 0; 617 618 errout_free: 619 kfree(rule); 620 errout: 621 rules_ops_put(ops); 622 return err; 623 } 624 EXPORT_SYMBOL_GPL(fib_nl_newrule); 625 626 int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr *nlh, 627 struct netlink_ext_ack *extack) 628 { 629 struct net *net = sock_net(skb->sk); 630 struct fib_rule_hdr *frh = nlmsg_data(nlh); 631 struct fib_rules_ops *ops = NULL; 632 struct fib_rule *rule, *r; 633 struct nlattr *tb[FRA_MAX+1]; 634 struct fib_kuid_range range; 635 int err = -EINVAL; 636 637 if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh))) 638 goto errout; 639 640 ops = lookup_rules_ops(net, frh->family); 641 if (ops == NULL) { 642 err = -EAFNOSUPPORT; 643 goto errout; 644 } 645 646 err = nlmsg_parse(nlh, sizeof(*frh), tb, FRA_MAX, ops->policy, extack); 647 if (err < 0) 648 goto errout; 649 650 err = validate_rulemsg(frh, tb, ops); 651 if (err < 0) 652 goto errout; 653 654 if (tb[FRA_UID_RANGE]) { 655 range = nla_get_kuid_range(tb); 656 if (!uid_range_set(&range)) { 657 err = -EINVAL; 658 goto errout; 659 } 660 } else { 661 range = fib_kuid_range_unset; 662 } 663 664 list_for_each_entry(rule, &ops->rules_list, list) { 665 if (frh->action && (frh->action != rule->action)) 666 continue; 667 668 if (frh_get_table(frh, tb) && 669 (frh_get_table(frh, tb) != rule->table)) 670 continue; 671 672 if (tb[FRA_PRIORITY] && 673 (rule->pref != nla_get_u32(tb[FRA_PRIORITY]))) 674 continue; 675 676 if (tb[FRA_IIFNAME] && 677 nla_strcmp(tb[FRA_IIFNAME], rule->iifname)) 678 continue; 679 680 if (tb[FRA_OIFNAME] && 681 nla_strcmp(tb[FRA_OIFNAME], rule->oifname)) 682 continue; 683 684 if (tb[FRA_FWMARK] && 685 (rule->mark != nla_get_u32(tb[FRA_FWMARK]))) 686 continue; 687 688 if (tb[FRA_FWMASK] && 689 (rule->mark_mask != nla_get_u32(tb[FRA_FWMASK]))) 690 continue; 691 692 if (tb[FRA_TUN_ID] && 693 (rule->tun_id != nla_get_be64(tb[FRA_TUN_ID]))) 694 continue; 695 696 if (tb[FRA_L3MDEV] && 697 (rule->l3mdev != nla_get_u8(tb[FRA_L3MDEV]))) 698 continue; 699 700 if (uid_range_set(&range) && 701 (!uid_eq(rule->uid_range.start, range.start) || 702 !uid_eq(rule->uid_range.end, range.end))) 703 continue; 704 705 if (!ops->compare(rule, frh, tb)) 706 continue; 707 708 if (rule->flags & FIB_RULE_PERMANENT) { 709 err = -EPERM; 710 goto errout; 711 } 712 713 if (ops->delete) { 714 err = ops->delete(rule); 715 if (err) 716 goto errout; 717 } 718 719 if (rule->tun_id) 720 ip_tunnel_unneed_metadata(); 721 722 list_del_rcu(&rule->list); 723 724 if (rule->action == FR_ACT_GOTO) { 725 ops->nr_goto_rules--; 726 if (rtnl_dereference(rule->ctarget) == NULL) 727 ops->unresolved_rules--; 728 } 729 730 /* 731 * Check if this rule is a target to any of them. If so, 732 * adjust to the next one with the same preference or 733 * disable them. As this operation is eventually very 734 * expensive, it is only performed if goto rules, except 735 * current if it is goto rule, have actually been added. 736 */ 737 if (ops->nr_goto_rules > 0) { 738 struct fib_rule *n; 739 740 n = list_next_entry(rule, list); 741 if (&n->list == &ops->rules_list || n->pref != rule->pref) 742 n = NULL; 743 list_for_each_entry(r, &ops->rules_list, list) { 744 if (rtnl_dereference(r->ctarget) != rule) 745 continue; 746 rcu_assign_pointer(r->ctarget, n); 747 if (!n) 748 ops->unresolved_rules++; 749 } 750 } 751 752 call_fib_rule_notifiers(net, FIB_EVENT_RULE_DEL, rule, ops); 753 notify_rule_change(RTM_DELRULE, rule, ops, nlh, 754 NETLINK_CB(skb).portid); 755 fib_rule_put(rule); 756 flush_route_cache(ops); 757 rules_ops_put(ops); 758 return 0; 759 } 760 761 err = -ENOENT; 762 errout: 763 rules_ops_put(ops); 764 return err; 765 } 766 EXPORT_SYMBOL_GPL(fib_nl_delrule); 767 768 static inline size_t fib_rule_nlmsg_size(struct fib_rules_ops *ops, 769 struct fib_rule *rule) 770 { 771 size_t payload = NLMSG_ALIGN(sizeof(struct fib_rule_hdr)) 772 + nla_total_size(IFNAMSIZ) /* FRA_IIFNAME */ 773 + nla_total_size(IFNAMSIZ) /* FRA_OIFNAME */ 774 + nla_total_size(4) /* FRA_PRIORITY */ 775 + nla_total_size(4) /* FRA_TABLE */ 776 + nla_total_size(4) /* FRA_SUPPRESS_PREFIXLEN */ 777 + nla_total_size(4) /* FRA_SUPPRESS_IFGROUP */ 778 + nla_total_size(4) /* FRA_FWMARK */ 779 + nla_total_size(4) /* FRA_FWMASK */ 780 + nla_total_size_64bit(8) /* FRA_TUN_ID */ 781 + nla_total_size(sizeof(struct fib_kuid_range)); 782 783 if (ops->nlmsg_payload) 784 payload += ops->nlmsg_payload(rule); 785 786 return payload; 787 } 788 789 static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule, 790 u32 pid, u32 seq, int type, int flags, 791 struct fib_rules_ops *ops) 792 { 793 struct nlmsghdr *nlh; 794 struct fib_rule_hdr *frh; 795 796 nlh = nlmsg_put(skb, pid, seq, type, sizeof(*frh), flags); 797 if (nlh == NULL) 798 return -EMSGSIZE; 799 800 frh = nlmsg_data(nlh); 801 frh->family = ops->family; 802 frh->table = rule->table; 803 if (nla_put_u32(skb, FRA_TABLE, rule->table)) 804 goto nla_put_failure; 805 if (nla_put_u32(skb, FRA_SUPPRESS_PREFIXLEN, rule->suppress_prefixlen)) 806 goto nla_put_failure; 807 frh->res1 = 0; 808 frh->res2 = 0; 809 frh->action = rule->action; 810 frh->flags = rule->flags; 811 812 if (rule->action == FR_ACT_GOTO && 813 rcu_access_pointer(rule->ctarget) == NULL) 814 frh->flags |= FIB_RULE_UNRESOLVED; 815 816 if (rule->iifname[0]) { 817 if (nla_put_string(skb, FRA_IIFNAME, rule->iifname)) 818 goto nla_put_failure; 819 if (rule->iifindex == -1) 820 frh->flags |= FIB_RULE_IIF_DETACHED; 821 } 822 823 if (rule->oifname[0]) { 824 if (nla_put_string(skb, FRA_OIFNAME, rule->oifname)) 825 goto nla_put_failure; 826 if (rule->oifindex == -1) 827 frh->flags |= FIB_RULE_OIF_DETACHED; 828 } 829 830 if ((rule->pref && 831 nla_put_u32(skb, FRA_PRIORITY, rule->pref)) || 832 (rule->mark && 833 nla_put_u32(skb, FRA_FWMARK, rule->mark)) || 834 ((rule->mark_mask || rule->mark) && 835 nla_put_u32(skb, FRA_FWMASK, rule->mark_mask)) || 836 (rule->target && 837 nla_put_u32(skb, FRA_GOTO, rule->target)) || 838 (rule->tun_id && 839 nla_put_be64(skb, FRA_TUN_ID, rule->tun_id, FRA_PAD)) || 840 (rule->l3mdev && 841 nla_put_u8(skb, FRA_L3MDEV, rule->l3mdev)) || 842 (uid_range_set(&rule->uid_range) && 843 nla_put_uid_range(skb, &rule->uid_range))) 844 goto nla_put_failure; 845 846 if (rule->suppress_ifgroup != -1) { 847 if (nla_put_u32(skb, FRA_SUPPRESS_IFGROUP, rule->suppress_ifgroup)) 848 goto nla_put_failure; 849 } 850 851 if (ops->fill(rule, skb, frh) < 0) 852 goto nla_put_failure; 853 854 nlmsg_end(skb, nlh); 855 return 0; 856 857 nla_put_failure: 858 nlmsg_cancel(skb, nlh); 859 return -EMSGSIZE; 860 } 861 862 static int dump_rules(struct sk_buff *skb, struct netlink_callback *cb, 863 struct fib_rules_ops *ops) 864 { 865 int idx = 0; 866 struct fib_rule *rule; 867 int err = 0; 868 869 rcu_read_lock(); 870 list_for_each_entry_rcu(rule, &ops->rules_list, list) { 871 if (idx < cb->args[1]) 872 goto skip; 873 874 err = fib_nl_fill_rule(skb, rule, NETLINK_CB(cb->skb).portid, 875 cb->nlh->nlmsg_seq, RTM_NEWRULE, 876 NLM_F_MULTI, ops); 877 if (err) 878 break; 879 skip: 880 idx++; 881 } 882 rcu_read_unlock(); 883 cb->args[1] = idx; 884 rules_ops_put(ops); 885 886 return err; 887 } 888 889 static int fib_nl_dumprule(struct sk_buff *skb, struct netlink_callback *cb) 890 { 891 struct net *net = sock_net(skb->sk); 892 struct fib_rules_ops *ops; 893 int idx = 0, family; 894 895 family = rtnl_msg_family(cb->nlh); 896 if (family != AF_UNSPEC) { 897 /* Protocol specific dump request */ 898 ops = lookup_rules_ops(net, family); 899 if (ops == NULL) 900 return -EAFNOSUPPORT; 901 902 dump_rules(skb, cb, ops); 903 904 return skb->len; 905 } 906 907 rcu_read_lock(); 908 list_for_each_entry_rcu(ops, &net->rules_ops, list) { 909 if (idx < cb->args[0] || !try_module_get(ops->owner)) 910 goto skip; 911 912 if (dump_rules(skb, cb, ops) < 0) 913 break; 914 915 cb->args[1] = 0; 916 skip: 917 idx++; 918 } 919 rcu_read_unlock(); 920 cb->args[0] = idx; 921 922 return skb->len; 923 } 924 925 static void notify_rule_change(int event, struct fib_rule *rule, 926 struct fib_rules_ops *ops, struct nlmsghdr *nlh, 927 u32 pid) 928 { 929 struct net *net; 930 struct sk_buff *skb; 931 int err = -ENOBUFS; 932 933 net = ops->fro_net; 934 skb = nlmsg_new(fib_rule_nlmsg_size(ops, rule), GFP_KERNEL); 935 if (skb == NULL) 936 goto errout; 937 938 err = fib_nl_fill_rule(skb, rule, pid, nlh->nlmsg_seq, event, 0, ops); 939 if (err < 0) { 940 /* -EMSGSIZE implies BUG in fib_rule_nlmsg_size() */ 941 WARN_ON(err == -EMSGSIZE); 942 kfree_skb(skb); 943 goto errout; 944 } 945 946 rtnl_notify(skb, net, pid, ops->nlgroup, nlh, GFP_KERNEL); 947 return; 948 errout: 949 if (err < 0) 950 rtnl_set_sk_err(net, ops->nlgroup, err); 951 } 952 953 static void attach_rules(struct list_head *rules, struct net_device *dev) 954 { 955 struct fib_rule *rule; 956 957 list_for_each_entry(rule, rules, list) { 958 if (rule->iifindex == -1 && 959 strcmp(dev->name, rule->iifname) == 0) 960 rule->iifindex = dev->ifindex; 961 if (rule->oifindex == -1 && 962 strcmp(dev->name, rule->oifname) == 0) 963 rule->oifindex = dev->ifindex; 964 } 965 } 966 967 static void detach_rules(struct list_head *rules, struct net_device *dev) 968 { 969 struct fib_rule *rule; 970 971 list_for_each_entry(rule, rules, list) { 972 if (rule->iifindex == dev->ifindex) 973 rule->iifindex = -1; 974 if (rule->oifindex == dev->ifindex) 975 rule->oifindex = -1; 976 } 977 } 978 979 980 static int fib_rules_event(struct notifier_block *this, unsigned long event, 981 void *ptr) 982 { 983 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 984 struct net *net = dev_net(dev); 985 struct fib_rules_ops *ops; 986 987 ASSERT_RTNL(); 988 989 switch (event) { 990 case NETDEV_REGISTER: 991 list_for_each_entry(ops, &net->rules_ops, list) 992 attach_rules(&ops->rules_list, dev); 993 break; 994 995 case NETDEV_CHANGENAME: 996 list_for_each_entry(ops, &net->rules_ops, list) { 997 detach_rules(&ops->rules_list, dev); 998 attach_rules(&ops->rules_list, dev); 999 } 1000 break; 1001 1002 case NETDEV_UNREGISTER: 1003 list_for_each_entry(ops, &net->rules_ops, list) 1004 detach_rules(&ops->rules_list, dev); 1005 break; 1006 } 1007 1008 return NOTIFY_DONE; 1009 } 1010 1011 static struct notifier_block fib_rules_notifier = { 1012 .notifier_call = fib_rules_event, 1013 }; 1014 1015 static int __net_init fib_rules_net_init(struct net *net) 1016 { 1017 INIT_LIST_HEAD(&net->rules_ops); 1018 spin_lock_init(&net->rules_mod_lock); 1019 return 0; 1020 } 1021 1022 static struct pernet_operations fib_rules_net_ops = { 1023 .init = fib_rules_net_init, 1024 }; 1025 1026 static int __init fib_rules_init(void) 1027 { 1028 int err; 1029 rtnl_register(PF_UNSPEC, RTM_NEWRULE, fib_nl_newrule, NULL, 0); 1030 rtnl_register(PF_UNSPEC, RTM_DELRULE, fib_nl_delrule, NULL, 0); 1031 rtnl_register(PF_UNSPEC, RTM_GETRULE, NULL, fib_nl_dumprule, 0); 1032 1033 err = register_pernet_subsys(&fib_rules_net_ops); 1034 if (err < 0) 1035 goto fail; 1036 1037 err = register_netdevice_notifier(&fib_rules_notifier); 1038 if (err < 0) 1039 goto fail_unregister; 1040 1041 return 0; 1042 1043 fail_unregister: 1044 unregister_pernet_subsys(&fib_rules_net_ops); 1045 fail: 1046 rtnl_unregister(PF_UNSPEC, RTM_NEWRULE); 1047 rtnl_unregister(PF_UNSPEC, RTM_DELRULE); 1048 rtnl_unregister(PF_UNSPEC, RTM_GETRULE); 1049 return err; 1050 } 1051 1052 subsys_initcall(fib_rules_init); 1053