1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * net/ipv6/fib6_rules.c IPv6 Routing Policy Rules 4 * 5 * Copyright (C)2003-2006 Helsinki University of Technology 6 * Copyright (C)2003-2006 USAGI/WIDE Project 7 * 8 * Authors 9 * Thomas Graf <tgraf@suug.ch> 10 * Ville Nuorvala <vnuorval@tcs.hut.fi> 11 */ 12 13 #include <linux/netdevice.h> 14 #include <linux/notifier.h> 15 #include <linux/export.h> 16 #include <linux/indirect_call_wrapper.h> 17 18 #include <net/fib_rules.h> 19 #include <net/ipv6.h> 20 #include <net/addrconf.h> 21 #include <net/ip6_route.h> 22 #include <net/netlink.h> 23 24 struct fib6_rule { 25 struct fib_rule common; 26 struct rt6key src; 27 struct rt6key dst; 28 u8 tclass; 29 }; 30 31 static bool fib6_rule_matchall(const struct fib_rule *rule) 32 { 33 struct fib6_rule *r = container_of(rule, struct fib6_rule, common); 34 35 if (r->dst.plen || r->src.plen || r->tclass) 36 return false; 37 return fib_rule_matchall(rule); 38 } 39 40 bool fib6_rule_default(const struct fib_rule *rule) 41 { 42 if (!fib6_rule_matchall(rule) || rule->action != FR_ACT_TO_TBL || 43 rule->l3mdev) 44 return false; 45 if (rule->table != RT6_TABLE_LOCAL && rule->table != RT6_TABLE_MAIN) 46 return false; 47 return true; 48 } 49 EXPORT_SYMBOL_GPL(fib6_rule_default); 50 51 int fib6_rules_dump(struct net *net, struct notifier_block *nb, 52 struct netlink_ext_ack *extack) 53 { 54 return fib_rules_dump(net, nb, AF_INET6, extack); 55 } 56 57 unsigned int fib6_rules_seq_read(struct net *net) 58 { 59 return fib_rules_seq_read(net, AF_INET6); 60 } 61 62 /* called with rcu lock held; no reference taken on fib6_info */ 63 int fib6_lookup(struct net *net, int oif, struct flowi6 *fl6, 64 struct fib6_result *res, int flags) 65 { 66 int err; 67 68 if (net->ipv6.fib6_has_custom_rules) { 69 struct fib_lookup_arg arg = { 70 .lookup_ptr = fib6_table_lookup, 71 .lookup_data = &oif, 72 .result = res, 73 .flags = FIB_LOOKUP_NOREF, 74 }; 75 76 l3mdev_update_flow(net, flowi6_to_flowi(fl6)); 77 78 err = fib_rules_lookup(net->ipv6.fib6_rules_ops, 79 flowi6_to_flowi(fl6), flags, &arg); 80 } else { 81 err = fib6_table_lookup(net, net->ipv6.fib6_local_tbl, oif, 82 fl6, res, flags); 83 if (err || res->f6i == net->ipv6.fib6_null_entry) 84 err = fib6_table_lookup(net, net->ipv6.fib6_main_tbl, 85 oif, fl6, res, flags); 86 } 87 88 return err; 89 } 90 91 struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6, 92 const struct sk_buff *skb, 93 int flags, pol_lookup_t lookup) 94 { 95 if (net->ipv6.fib6_has_custom_rules) { 96 struct fib6_result res = {}; 97 struct fib_lookup_arg arg = { 98 .lookup_ptr = lookup, 99 .lookup_data = skb, 100 .result = &res, 101 .flags = FIB_LOOKUP_NOREF, 102 }; 103 104 /* update flow if oif or iif point to device enslaved to l3mdev */ 105 l3mdev_update_flow(net, flowi6_to_flowi(fl6)); 106 107 fib_rules_lookup(net->ipv6.fib6_rules_ops, 108 flowi6_to_flowi(fl6), flags, &arg); 109 110 if (res.rt6) 111 return &res.rt6->dst; 112 } else { 113 struct rt6_info *rt; 114 115 rt = pol_lookup_func(lookup, 116 net, net->ipv6.fib6_local_tbl, fl6, skb, flags); 117 if (rt != net->ipv6.ip6_null_entry && rt->dst.error != -EAGAIN) 118 return &rt->dst; 119 ip6_rt_put_flags(rt, flags); 120 rt = pol_lookup_func(lookup, 121 net, net->ipv6.fib6_main_tbl, fl6, skb, flags); 122 if (rt->dst.error != -EAGAIN) 123 return &rt->dst; 124 ip6_rt_put_flags(rt, flags); 125 } 126 127 if (!(flags & RT6_LOOKUP_F_DST_NOREF)) 128 dst_hold(&net->ipv6.ip6_null_entry->dst); 129 return &net->ipv6.ip6_null_entry->dst; 130 } 131 132 static int fib6_rule_saddr(struct net *net, struct fib_rule *rule, int flags, 133 struct flowi6 *flp6, const struct net_device *dev) 134 { 135 struct fib6_rule *r = (struct fib6_rule *)rule; 136 137 /* If we need to find a source address for this traffic, 138 * we check the result if it meets requirement of the rule. 139 */ 140 if ((rule->flags & FIB_RULE_FIND_SADDR) && 141 r->src.plen && !(flags & RT6_LOOKUP_F_HAS_SADDR)) { 142 struct in6_addr saddr; 143 144 if (ipv6_dev_get_saddr(net, dev, &flp6->daddr, 145 rt6_flags2srcprefs(flags), &saddr)) 146 return -EAGAIN; 147 148 if (!ipv6_prefix_equal(&saddr, &r->src.addr, r->src.plen)) 149 return -EAGAIN; 150 151 flp6->saddr = saddr; 152 } 153 154 return 0; 155 } 156 157 static int fib6_rule_action_alt(struct fib_rule *rule, struct flowi *flp, 158 int flags, struct fib_lookup_arg *arg) 159 { 160 struct fib6_result *res = arg->result; 161 struct flowi6 *flp6 = &flp->u.ip6; 162 struct net *net = rule->fr_net; 163 struct fib6_table *table; 164 int err, *oif; 165 u32 tb_id; 166 167 switch (rule->action) { 168 case FR_ACT_TO_TBL: 169 break; 170 case FR_ACT_UNREACHABLE: 171 return -ENETUNREACH; 172 case FR_ACT_PROHIBIT: 173 return -EACCES; 174 case FR_ACT_BLACKHOLE: 175 default: 176 return -EINVAL; 177 } 178 179 tb_id = fib_rule_get_table(rule, arg); 180 table = fib6_get_table(net, tb_id); 181 if (!table) 182 return -EAGAIN; 183 184 oif = (int *)arg->lookup_data; 185 err = fib6_table_lookup(net, table, *oif, flp6, res, flags); 186 if (!err && res->f6i != net->ipv6.fib6_null_entry) 187 err = fib6_rule_saddr(net, rule, flags, flp6, 188 res->nh->fib_nh_dev); 189 else 190 err = -EAGAIN; 191 192 return err; 193 } 194 195 static int __fib6_rule_action(struct fib_rule *rule, struct flowi *flp, 196 int flags, struct fib_lookup_arg *arg) 197 { 198 struct fib6_result *res = arg->result; 199 struct flowi6 *flp6 = &flp->u.ip6; 200 struct rt6_info *rt = NULL; 201 struct fib6_table *table; 202 struct net *net = rule->fr_net; 203 pol_lookup_t lookup = arg->lookup_ptr; 204 int err = 0; 205 u32 tb_id; 206 207 switch (rule->action) { 208 case FR_ACT_TO_TBL: 209 break; 210 case FR_ACT_UNREACHABLE: 211 err = -ENETUNREACH; 212 rt = net->ipv6.ip6_null_entry; 213 goto discard_pkt; 214 default: 215 case FR_ACT_BLACKHOLE: 216 err = -EINVAL; 217 rt = net->ipv6.ip6_blk_hole_entry; 218 goto discard_pkt; 219 case FR_ACT_PROHIBIT: 220 err = -EACCES; 221 rt = net->ipv6.ip6_prohibit_entry; 222 goto discard_pkt; 223 } 224 225 tb_id = fib_rule_get_table(rule, arg); 226 table = fib6_get_table(net, tb_id); 227 if (!table) { 228 err = -EAGAIN; 229 goto out; 230 } 231 232 rt = pol_lookup_func(lookup, 233 net, table, flp6, arg->lookup_data, flags); 234 if (rt != net->ipv6.ip6_null_entry) { 235 err = fib6_rule_saddr(net, rule, flags, flp6, 236 ip6_dst_idev(&rt->dst)->dev); 237 238 if (err == -EAGAIN) 239 goto again; 240 241 err = rt->dst.error; 242 if (err != -EAGAIN) 243 goto out; 244 } 245 again: 246 ip6_rt_put_flags(rt, flags); 247 err = -EAGAIN; 248 rt = NULL; 249 goto out; 250 251 discard_pkt: 252 if (!(flags & RT6_LOOKUP_F_DST_NOREF)) 253 dst_hold(&rt->dst); 254 out: 255 res->rt6 = rt; 256 return err; 257 } 258 259 INDIRECT_CALLABLE_SCOPE int fib6_rule_action(struct fib_rule *rule, 260 struct flowi *flp, int flags, 261 struct fib_lookup_arg *arg) 262 { 263 if (arg->lookup_ptr == fib6_table_lookup) 264 return fib6_rule_action_alt(rule, flp, flags, arg); 265 266 return __fib6_rule_action(rule, flp, flags, arg); 267 } 268 269 INDIRECT_CALLABLE_SCOPE bool fib6_rule_suppress(struct fib_rule *rule, 270 int flags, 271 struct fib_lookup_arg *arg) 272 { 273 struct fib6_result *res = arg->result; 274 struct rt6_info *rt = res->rt6; 275 struct net_device *dev = NULL; 276 277 if (!rt) 278 return false; 279 280 if (rt->rt6i_idev) 281 dev = rt->rt6i_idev->dev; 282 283 /* do not accept result if the route does 284 * not meet the required prefix length 285 */ 286 if (rt->rt6i_dst.plen <= rule->suppress_prefixlen) 287 goto suppress_route; 288 289 /* do not accept result if the route uses a device 290 * belonging to a forbidden interface group 291 */ 292 if (rule->suppress_ifgroup != -1 && dev && dev->group == rule->suppress_ifgroup) 293 goto suppress_route; 294 295 return false; 296 297 suppress_route: 298 ip6_rt_put_flags(rt, flags); 299 return true; 300 } 301 302 INDIRECT_CALLABLE_SCOPE int fib6_rule_match(struct fib_rule *rule, 303 struct flowi *fl, int flags) 304 { 305 struct fib6_rule *r = (struct fib6_rule *) rule; 306 struct flowi6 *fl6 = &fl->u.ip6; 307 308 if (r->dst.plen && 309 !ipv6_prefix_equal(&fl6->daddr, &r->dst.addr, r->dst.plen)) 310 return 0; 311 312 /* 313 * If FIB_RULE_FIND_SADDR is set and we do not have a 314 * source address for the traffic, we defer check for 315 * source address. 316 */ 317 if (r->src.plen) { 318 if (flags & RT6_LOOKUP_F_HAS_SADDR) { 319 if (!ipv6_prefix_equal(&fl6->saddr, &r->src.addr, 320 r->src.plen)) 321 return 0; 322 } else if (!(r->common.flags & FIB_RULE_FIND_SADDR)) 323 return 0; 324 } 325 326 if (r->tclass && r->tclass != ip6_tclass(fl6->flowlabel)) 327 return 0; 328 329 if (rule->ip_proto && (rule->ip_proto != fl6->flowi6_proto)) 330 return 0; 331 332 if (fib_rule_port_range_set(&rule->sport_range) && 333 !fib_rule_port_inrange(&rule->sport_range, fl6->fl6_sport)) 334 return 0; 335 336 if (fib_rule_port_range_set(&rule->dport_range) && 337 !fib_rule_port_inrange(&rule->dport_range, fl6->fl6_dport)) 338 return 0; 339 340 return 1; 341 } 342 343 static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb, 344 struct fib_rule_hdr *frh, 345 struct nlattr **tb, 346 struct netlink_ext_ack *extack) 347 { 348 int err = -EINVAL; 349 struct net *net = sock_net(skb->sk); 350 struct fib6_rule *rule6 = (struct fib6_rule *) rule; 351 352 if (rule->action == FR_ACT_TO_TBL && !rule->l3mdev) { 353 if (rule->table == RT6_TABLE_UNSPEC) { 354 NL_SET_ERR_MSG(extack, "Invalid table"); 355 goto errout; 356 } 357 358 if (fib6_new_table(net, rule->table) == NULL) { 359 err = -ENOBUFS; 360 goto errout; 361 } 362 } 363 364 if (frh->src_len) 365 rule6->src.addr = nla_get_in6_addr(tb[FRA_SRC]); 366 367 if (frh->dst_len) 368 rule6->dst.addr = nla_get_in6_addr(tb[FRA_DST]); 369 370 rule6->src.plen = frh->src_len; 371 rule6->dst.plen = frh->dst_len; 372 rule6->tclass = frh->tos; 373 374 if (fib_rule_requires_fldissect(rule)) 375 net->ipv6.fib6_rules_require_fldissect++; 376 377 net->ipv6.fib6_has_custom_rules = true; 378 err = 0; 379 errout: 380 return err; 381 } 382 383 static int fib6_rule_delete(struct fib_rule *rule) 384 { 385 struct net *net = rule->fr_net; 386 387 if (net->ipv6.fib6_rules_require_fldissect && 388 fib_rule_requires_fldissect(rule)) 389 net->ipv6.fib6_rules_require_fldissect--; 390 391 return 0; 392 } 393 394 static int fib6_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh, 395 struct nlattr **tb) 396 { 397 struct fib6_rule *rule6 = (struct fib6_rule *) rule; 398 399 if (frh->src_len && (rule6->src.plen != frh->src_len)) 400 return 0; 401 402 if (frh->dst_len && (rule6->dst.plen != frh->dst_len)) 403 return 0; 404 405 if (frh->tos && (rule6->tclass != frh->tos)) 406 return 0; 407 408 if (frh->src_len && 409 nla_memcmp(tb[FRA_SRC], &rule6->src.addr, sizeof(struct in6_addr))) 410 return 0; 411 412 if (frh->dst_len && 413 nla_memcmp(tb[FRA_DST], &rule6->dst.addr, sizeof(struct in6_addr))) 414 return 0; 415 416 return 1; 417 } 418 419 static int fib6_rule_fill(struct fib_rule *rule, struct sk_buff *skb, 420 struct fib_rule_hdr *frh) 421 { 422 struct fib6_rule *rule6 = (struct fib6_rule *) rule; 423 424 frh->dst_len = rule6->dst.plen; 425 frh->src_len = rule6->src.plen; 426 frh->tos = rule6->tclass; 427 428 if ((rule6->dst.plen && 429 nla_put_in6_addr(skb, FRA_DST, &rule6->dst.addr)) || 430 (rule6->src.plen && 431 nla_put_in6_addr(skb, FRA_SRC, &rule6->src.addr))) 432 goto nla_put_failure; 433 return 0; 434 435 nla_put_failure: 436 return -ENOBUFS; 437 } 438 439 static size_t fib6_rule_nlmsg_payload(struct fib_rule *rule) 440 { 441 return nla_total_size(16) /* dst */ 442 + nla_total_size(16); /* src */ 443 } 444 445 static const struct fib_rules_ops __net_initconst fib6_rules_ops_template = { 446 .family = AF_INET6, 447 .rule_size = sizeof(struct fib6_rule), 448 .addr_size = sizeof(struct in6_addr), 449 .action = fib6_rule_action, 450 .match = fib6_rule_match, 451 .suppress = fib6_rule_suppress, 452 .configure = fib6_rule_configure, 453 .delete = fib6_rule_delete, 454 .compare = fib6_rule_compare, 455 .fill = fib6_rule_fill, 456 .nlmsg_payload = fib6_rule_nlmsg_payload, 457 .nlgroup = RTNLGRP_IPV6_RULE, 458 .owner = THIS_MODULE, 459 .fro_net = &init_net, 460 }; 461 462 static int __net_init fib6_rules_net_init(struct net *net) 463 { 464 struct fib_rules_ops *ops; 465 int err; 466 467 ops = fib_rules_register(&fib6_rules_ops_template, net); 468 if (IS_ERR(ops)) 469 return PTR_ERR(ops); 470 471 err = fib_default_rule_add(ops, 0, RT6_TABLE_LOCAL, 0); 472 if (err) 473 goto out_fib6_rules_ops; 474 475 err = fib_default_rule_add(ops, 0x7FFE, RT6_TABLE_MAIN, 0); 476 if (err) 477 goto out_fib6_rules_ops; 478 479 net->ipv6.fib6_rules_ops = ops; 480 net->ipv6.fib6_rules_require_fldissect = 0; 481 out: 482 return err; 483 484 out_fib6_rules_ops: 485 fib_rules_unregister(ops); 486 goto out; 487 } 488 489 static void __net_exit fib6_rules_net_exit(struct net *net) 490 { 491 rtnl_lock(); 492 fib_rules_unregister(net->ipv6.fib6_rules_ops); 493 rtnl_unlock(); 494 } 495 496 static struct pernet_operations fib6_rules_net_ops = { 497 .init = fib6_rules_net_init, 498 .exit = fib6_rules_net_exit, 499 }; 500 501 int __init fib6_rules_init(void) 502 { 503 return register_pernet_subsys(&fib6_rules_net_ops); 504 } 505 506 507 void fib6_rules_cleanup(void) 508 { 509 unregister_pernet_subsys(&fib6_rules_net_ops); 510 } 511