1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * INET An implementation of the TCP/IP protocol suite for the LINUX 4 * operating system. INET is implemented using the BSD Socket 5 * interface as the means of communication with the user level. 6 * 7 * IPv4 Forwarding Information Base: policy rules. 8 * 9 * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru> 10 * Thomas Graf <tgraf@suug.ch> 11 * 12 * Fixes: 13 * Rani Assaf : local_rule cannot be deleted 14 * Marc Boucher : routing by fwmark 15 */ 16 17 #include <linux/types.h> 18 #include <linux/kernel.h> 19 #include <linux/netdevice.h> 20 #include <linux/netlink.h> 21 #include <linux/inetdevice.h> 22 #include <linux/init.h> 23 #include <linux/list.h> 24 #include <linux/rcupdate.h> 25 #include <linux/export.h> 26 #include <net/ip.h> 27 #include <net/route.h> 28 #include <net/tcp.h> 29 #include <net/ip_fib.h> 30 #include <net/nexthop.h> 31 #include <net/fib_rules.h> 32 #include <linux/indirect_call_wrapper.h> 33 34 struct fib4_rule { 35 struct fib_rule common; 36 u8 dst_len; 37 u8 src_len; 38 u8 tos; 39 __be32 src; 40 __be32 srcmask; 41 __be32 dst; 42 __be32 dstmask; 43 #ifdef CONFIG_IP_ROUTE_CLASSID 44 u32 tclassid; 45 #endif 46 }; 47 48 static bool fib4_rule_matchall(const struct fib_rule *rule) 49 { 50 struct fib4_rule *r = container_of(rule, struct fib4_rule, common); 51 52 if (r->dst_len || r->src_len || r->tos) 53 return false; 54 return fib_rule_matchall(rule); 55 } 56 57 bool fib4_rule_default(const struct fib_rule *rule) 58 { 59 if (!fib4_rule_matchall(rule) || rule->action != FR_ACT_TO_TBL || 60 rule->l3mdev) 61 return false; 62 if (rule->table != RT_TABLE_LOCAL && rule->table != RT_TABLE_MAIN && 63 rule->table != RT_TABLE_DEFAULT) 64 return false; 65 return true; 66 } 67 EXPORT_SYMBOL_GPL(fib4_rule_default); 68 69 int fib4_rules_dump(struct net *net, struct notifier_block *nb, 70 struct netlink_ext_ack *extack) 71 { 72 return fib_rules_dump(net, nb, AF_INET, extack); 73 } 74 75 unsigned int fib4_rules_seq_read(struct net *net) 76 { 77 return fib_rules_seq_read(net, AF_INET); 78 } 79 80 int __fib_lookup(struct net *net, struct flowi4 *flp, 81 struct fib_result *res, unsigned int flags) 82 { 83 struct fib_lookup_arg arg = { 84 .result = res, 85 .flags = flags, 86 }; 87 int err; 88 89 /* update flow if oif or iif point to device enslaved to l3mdev */ 90 l3mdev_update_flow(net, flowi4_to_flowi(flp)); 91 92 err = fib_rules_lookup(net->ipv4.rules_ops, flowi4_to_flowi(flp), 0, &arg); 93 #ifdef CONFIG_IP_ROUTE_CLASSID 94 if (arg.rule) 95 res->tclassid = ((struct fib4_rule *)arg.rule)->tclassid; 96 else 97 res->tclassid = 0; 98 #endif 99 100 if (err == -ESRCH) 101 err = -ENETUNREACH; 102 103 return err; 104 } 105 EXPORT_SYMBOL_GPL(__fib_lookup); 106 107 INDIRECT_CALLABLE_SCOPE int fib4_rule_action(struct fib_rule *rule, 108 struct flowi *flp, int flags, 109 struct fib_lookup_arg *arg) 110 { 111 int err = -EAGAIN; 112 struct fib_table *tbl; 113 u32 tb_id; 114 115 switch (rule->action) { 116 case FR_ACT_TO_TBL: 117 break; 118 119 case FR_ACT_UNREACHABLE: 120 return -ENETUNREACH; 121 122 case FR_ACT_PROHIBIT: 123 return -EACCES; 124 125 case FR_ACT_BLACKHOLE: 126 default: 127 return -EINVAL; 128 } 129 130 rcu_read_lock(); 131 132 tb_id = fib_rule_get_table(rule, arg); 133 tbl = fib_get_table(rule->fr_net, tb_id); 134 if (tbl) 135 err = fib_table_lookup(tbl, &flp->u.ip4, 136 (struct fib_result *)arg->result, 137 arg->flags); 138 139 rcu_read_unlock(); 140 return err; 141 } 142 143 INDIRECT_CALLABLE_SCOPE bool fib4_rule_suppress(struct fib_rule *rule, 144 int flags, 145 struct fib_lookup_arg *arg) 146 { 147 struct fib_result *result = (struct fib_result *) arg->result; 148 struct net_device *dev = NULL; 149 150 if (result->fi) { 151 struct fib_nh_common *nhc = fib_info_nhc(result->fi, 0); 152 153 dev = nhc->nhc_dev; 154 } 155 156 /* do not accept result if the route does 157 * not meet the required prefix length 158 */ 159 if (result->prefixlen <= rule->suppress_prefixlen) 160 goto suppress_route; 161 162 /* do not accept result if the route uses a device 163 * belonging to a forbidden interface group 164 */ 165 if (rule->suppress_ifgroup != -1 && dev && dev->group == rule->suppress_ifgroup) 166 goto suppress_route; 167 168 return false; 169 170 suppress_route: 171 if (!(arg->flags & FIB_LOOKUP_NOREF)) 172 fib_info_put(result->fi); 173 return true; 174 } 175 176 INDIRECT_CALLABLE_SCOPE int fib4_rule_match(struct fib_rule *rule, 177 struct flowi *fl, int flags) 178 { 179 struct fib4_rule *r = (struct fib4_rule *) rule; 180 struct flowi4 *fl4 = &fl->u.ip4; 181 __be32 daddr = fl4->daddr; 182 __be32 saddr = fl4->saddr; 183 184 if (((saddr ^ r->src) & r->srcmask) || 185 ((daddr ^ r->dst) & r->dstmask)) 186 return 0; 187 188 if (r->tos && (r->tos != fl4->flowi4_tos)) 189 return 0; 190 191 if (rule->ip_proto && (rule->ip_proto != fl4->flowi4_proto)) 192 return 0; 193 194 if (fib_rule_port_range_set(&rule->sport_range) && 195 !fib_rule_port_inrange(&rule->sport_range, fl4->fl4_sport)) 196 return 0; 197 198 if (fib_rule_port_range_set(&rule->dport_range) && 199 !fib_rule_port_inrange(&rule->dport_range, fl4->fl4_dport)) 200 return 0; 201 202 return 1; 203 } 204 205 static struct fib_table *fib_empty_table(struct net *net) 206 { 207 u32 id = 1; 208 209 while (1) { 210 if (!fib_get_table(net, id)) 211 return fib_new_table(net, id); 212 213 if (id++ == RT_TABLE_MAX) 214 break; 215 } 216 return NULL; 217 } 218 219 static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb, 220 struct fib_rule_hdr *frh, 221 struct nlattr **tb, 222 struct netlink_ext_ack *extack) 223 { 224 struct net *net = sock_net(skb->sk); 225 int err = -EINVAL; 226 struct fib4_rule *rule4 = (struct fib4_rule *) rule; 227 228 if (frh->tos & ~IPTOS_TOS_MASK) { 229 NL_SET_ERR_MSG(extack, "Invalid tos"); 230 goto errout; 231 } 232 233 /* split local/main if they are not already split */ 234 err = fib_unmerge(net); 235 if (err) 236 goto errout; 237 238 if (rule->table == RT_TABLE_UNSPEC && !rule->l3mdev) { 239 if (rule->action == FR_ACT_TO_TBL) { 240 struct fib_table *table; 241 242 table = fib_empty_table(net); 243 if (!table) { 244 err = -ENOBUFS; 245 goto errout; 246 } 247 248 rule->table = table->tb_id; 249 } 250 } 251 252 if (frh->src_len) 253 rule4->src = nla_get_in_addr(tb[FRA_SRC]); 254 255 if (frh->dst_len) 256 rule4->dst = nla_get_in_addr(tb[FRA_DST]); 257 258 #ifdef CONFIG_IP_ROUTE_CLASSID 259 if (tb[FRA_FLOW]) { 260 rule4->tclassid = nla_get_u32(tb[FRA_FLOW]); 261 if (rule4->tclassid) 262 atomic_inc(&net->ipv4.fib_num_tclassid_users); 263 } 264 #endif 265 266 if (fib_rule_requires_fldissect(rule)) 267 net->ipv4.fib_rules_require_fldissect++; 268 269 rule4->src_len = frh->src_len; 270 rule4->srcmask = inet_make_mask(rule4->src_len); 271 rule4->dst_len = frh->dst_len; 272 rule4->dstmask = inet_make_mask(rule4->dst_len); 273 rule4->tos = frh->tos; 274 275 net->ipv4.fib_has_custom_rules = true; 276 277 err = 0; 278 errout: 279 return err; 280 } 281 282 static int fib4_rule_delete(struct fib_rule *rule) 283 { 284 struct net *net = rule->fr_net; 285 int err; 286 287 /* split local/main if they are not already split */ 288 err = fib_unmerge(net); 289 if (err) 290 goto errout; 291 292 #ifdef CONFIG_IP_ROUTE_CLASSID 293 if (((struct fib4_rule *)rule)->tclassid) 294 atomic_dec(&net->ipv4.fib_num_tclassid_users); 295 #endif 296 net->ipv4.fib_has_custom_rules = true; 297 298 if (net->ipv4.fib_rules_require_fldissect && 299 fib_rule_requires_fldissect(rule)) 300 net->ipv4.fib_rules_require_fldissect--; 301 errout: 302 return err; 303 } 304 305 static int fib4_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh, 306 struct nlattr **tb) 307 { 308 struct fib4_rule *rule4 = (struct fib4_rule *) rule; 309 310 if (frh->src_len && (rule4->src_len != frh->src_len)) 311 return 0; 312 313 if (frh->dst_len && (rule4->dst_len != frh->dst_len)) 314 return 0; 315 316 if (frh->tos && (rule4->tos != frh->tos)) 317 return 0; 318 319 #ifdef CONFIG_IP_ROUTE_CLASSID 320 if (tb[FRA_FLOW] && (rule4->tclassid != nla_get_u32(tb[FRA_FLOW]))) 321 return 0; 322 #endif 323 324 if (frh->src_len && (rule4->src != nla_get_in_addr(tb[FRA_SRC]))) 325 return 0; 326 327 if (frh->dst_len && (rule4->dst != nla_get_in_addr(tb[FRA_DST]))) 328 return 0; 329 330 return 1; 331 } 332 333 static int fib4_rule_fill(struct fib_rule *rule, struct sk_buff *skb, 334 struct fib_rule_hdr *frh) 335 { 336 struct fib4_rule *rule4 = (struct fib4_rule *) rule; 337 338 frh->dst_len = rule4->dst_len; 339 frh->src_len = rule4->src_len; 340 frh->tos = rule4->tos; 341 342 if ((rule4->dst_len && 343 nla_put_in_addr(skb, FRA_DST, rule4->dst)) || 344 (rule4->src_len && 345 nla_put_in_addr(skb, FRA_SRC, rule4->src))) 346 goto nla_put_failure; 347 #ifdef CONFIG_IP_ROUTE_CLASSID 348 if (rule4->tclassid && 349 nla_put_u32(skb, FRA_FLOW, rule4->tclassid)) 350 goto nla_put_failure; 351 #endif 352 return 0; 353 354 nla_put_failure: 355 return -ENOBUFS; 356 } 357 358 static size_t fib4_rule_nlmsg_payload(struct fib_rule *rule) 359 { 360 return nla_total_size(4) /* dst */ 361 + nla_total_size(4) /* src */ 362 + nla_total_size(4); /* flow */ 363 } 364 365 static void fib4_rule_flush_cache(struct fib_rules_ops *ops) 366 { 367 rt_cache_flush(ops->fro_net); 368 } 369 370 static const struct fib_rules_ops __net_initconst fib4_rules_ops_template = { 371 .family = AF_INET, 372 .rule_size = sizeof(struct fib4_rule), 373 .addr_size = sizeof(u32), 374 .action = fib4_rule_action, 375 .suppress = fib4_rule_suppress, 376 .match = fib4_rule_match, 377 .configure = fib4_rule_configure, 378 .delete = fib4_rule_delete, 379 .compare = fib4_rule_compare, 380 .fill = fib4_rule_fill, 381 .nlmsg_payload = fib4_rule_nlmsg_payload, 382 .flush_cache = fib4_rule_flush_cache, 383 .nlgroup = RTNLGRP_IPV4_RULE, 384 .owner = THIS_MODULE, 385 }; 386 387 static int fib_default_rules_init(struct fib_rules_ops *ops) 388 { 389 int err; 390 391 err = fib_default_rule_add(ops, 0, RT_TABLE_LOCAL, 0); 392 if (err < 0) 393 return err; 394 err = fib_default_rule_add(ops, 0x7FFE, RT_TABLE_MAIN, 0); 395 if (err < 0) 396 return err; 397 err = fib_default_rule_add(ops, 0x7FFF, RT_TABLE_DEFAULT, 0); 398 if (err < 0) 399 return err; 400 return 0; 401 } 402 403 int __net_init fib4_rules_init(struct net *net) 404 { 405 int err; 406 struct fib_rules_ops *ops; 407 408 ops = fib_rules_register(&fib4_rules_ops_template, net); 409 if (IS_ERR(ops)) 410 return PTR_ERR(ops); 411 412 err = fib_default_rules_init(ops); 413 if (err < 0) 414 goto fail; 415 net->ipv4.rules_ops = ops; 416 net->ipv4.fib_has_custom_rules = false; 417 net->ipv4.fib_rules_require_fldissect = 0; 418 return 0; 419 420 fail: 421 /* also cleans all rules already added */ 422 fib_rules_unregister(ops); 423 return err; 424 } 425 426 void __net_exit fib4_rules_exit(struct net *net) 427 { 428 fib_rules_unregister(net->ipv4.rules_ops); 429 } 430