1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * net/ipv6/fib6_rules.c IPv6 Routing Policy Rules 4 * 5 * Copyright (C)2003-2006 Helsinki University of Technology 6 * Copyright (C)2003-2006 USAGI/WIDE Project 7 * 8 * Authors 9 * Thomas Graf <tgraf@suug.ch> 10 * Ville Nuorvala <vnuorval@tcs.hut.fi> 11 */ 12 13 #include <linux/netdevice.h> 14 #include <linux/notifier.h> 15 #include <linux/export.h> 16 #include <linux/indirect_call_wrapper.h> 17 18 #include <net/fib_rules.h> 19 #include <net/ipv6.h> 20 #include <net/addrconf.h> 21 #include <net/ip6_route.h> 22 #include <net/netlink.h> 23 24 struct fib6_rule { 25 struct fib_rule common; 26 struct rt6key src; 27 struct rt6key dst; 28 u8 tclass; 29 }; 30 31 static bool fib6_rule_matchall(const struct fib_rule *rule) 32 { 33 struct fib6_rule *r = container_of(rule, struct fib6_rule, common); 34 35 if (r->dst.plen || r->src.plen || r->tclass) 36 return false; 37 return fib_rule_matchall(rule); 38 } 39 40 bool fib6_rule_default(const struct fib_rule *rule) 41 { 42 if (!fib6_rule_matchall(rule) || rule->action != FR_ACT_TO_TBL || 43 rule->l3mdev) 44 return false; 45 if (rule->table != RT6_TABLE_LOCAL && rule->table != RT6_TABLE_MAIN) 46 return false; 47 return true; 48 } 49 EXPORT_SYMBOL_GPL(fib6_rule_default); 50 51 int fib6_rules_dump(struct net *net, struct notifier_block *nb, 52 struct netlink_ext_ack *extack) 53 { 54 return fib_rules_dump(net, nb, AF_INET6, extack); 55 } 56 57 unsigned int fib6_rules_seq_read(struct net *net) 58 { 59 return fib_rules_seq_read(net, AF_INET6); 60 } 61 62 /* called with rcu lock held; no reference taken on fib6_info */ 63 int fib6_lookup(struct net *net, int oif, struct flowi6 *fl6, 64 struct fib6_result *res, int flags) 65 { 66 int err; 67 68 if (net->ipv6.fib6_has_custom_rules) { 69 struct fib_lookup_arg arg = { 70 .lookup_ptr = fib6_table_lookup, 71 .lookup_data = &oif, 72 .result = res, 73 .flags = FIB_LOOKUP_NOREF, 74 }; 75 76 l3mdev_update_flow(net, flowi6_to_flowi(fl6)); 77 78 err = fib_rules_lookup(net->ipv6.fib6_rules_ops, 79 flowi6_to_flowi(fl6), flags, &arg); 80 } else { 81 err = fib6_table_lookup(net, net->ipv6.fib6_local_tbl, oif, 82 fl6, res, flags); 83 if (err || res->f6i == net->ipv6.fib6_null_entry) 84 err = fib6_table_lookup(net, net->ipv6.fib6_main_tbl, 85 oif, fl6, res, flags); 86 } 87 88 return err; 89 } 90 91 struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6, 92 const struct sk_buff *skb, 93 int flags, pol_lookup_t lookup) 94 { 95 if (net->ipv6.fib6_has_custom_rules) { 96 struct fib6_result res = {}; 97 struct fib_lookup_arg arg = { 98 .lookup_ptr = lookup, 99 .lookup_data = skb, 100 .result = &res, 101 .flags = FIB_LOOKUP_NOREF, 102 }; 103 104 /* update flow if oif or iif point to device enslaved to l3mdev */ 105 l3mdev_update_flow(net, flowi6_to_flowi(fl6)); 106 107 fib_rules_lookup(net->ipv6.fib6_rules_ops, 108 flowi6_to_flowi(fl6), flags, &arg); 109 110 if (res.rt6) 111 return &res.rt6->dst; 112 } else { 113 struct rt6_info *rt; 114 115 rt = pol_lookup_func(lookup, 116 net, net->ipv6.fib6_local_tbl, fl6, skb, flags); 117 if (rt != net->ipv6.ip6_null_entry && rt->dst.error != -EAGAIN) 118 return &rt->dst; 119 ip6_rt_put_flags(rt, flags); 120 rt = pol_lookup_func(lookup, 121 net, net->ipv6.fib6_main_tbl, fl6, skb, flags); 122 if (rt->dst.error != -EAGAIN) 123 return &rt->dst; 124 ip6_rt_put_flags(rt, flags); 125 } 126 127 if (!(flags & RT6_LOOKUP_F_DST_NOREF)) 128 dst_hold(&net->ipv6.ip6_null_entry->dst); 129 return &net->ipv6.ip6_null_entry->dst; 130 } 131 132 static int fib6_rule_saddr(struct net *net, struct fib_rule *rule, int flags, 133 struct flowi6 *flp6, const struct net_device *dev) 134 { 135 struct fib6_rule *r = (struct fib6_rule *)rule; 136 137 /* If we need to find a source address for this traffic, 138 * we check the result if it meets requirement of the rule. 139 */ 140 if ((rule->flags & FIB_RULE_FIND_SADDR) && 141 r->src.plen && !(flags & RT6_LOOKUP_F_HAS_SADDR)) { 142 struct in6_addr saddr; 143 144 if (ipv6_dev_get_saddr(net, dev, &flp6->daddr, 145 rt6_flags2srcprefs(flags), &saddr)) 146 return -EAGAIN; 147 148 if (!ipv6_prefix_equal(&saddr, &r->src.addr, r->src.plen)) 149 return -EAGAIN; 150 151 flp6->saddr = saddr; 152 } 153 154 return 0; 155 } 156 157 static int fib6_rule_action_alt(struct fib_rule *rule, struct flowi *flp, 158 int flags, struct fib_lookup_arg *arg) 159 { 160 struct fib6_result *res = arg->result; 161 struct flowi6 *flp6 = &flp->u.ip6; 162 struct net *net = rule->fr_net; 163 struct fib6_table *table; 164 int err, *oif; 165 u32 tb_id; 166 167 switch (rule->action) { 168 case FR_ACT_TO_TBL: 169 break; 170 case FR_ACT_UNREACHABLE: 171 return -ENETUNREACH; 172 case FR_ACT_PROHIBIT: 173 return -EACCES; 174 case FR_ACT_BLACKHOLE: 175 default: 176 return -EINVAL; 177 } 178 179 tb_id = fib_rule_get_table(rule, arg); 180 table = fib6_get_table(net, tb_id); 181 if (!table) 182 return -EAGAIN; 183 184 oif = (int *)arg->lookup_data; 185 err = fib6_table_lookup(net, table, *oif, flp6, res, flags); 186 if (!err && res->f6i != net->ipv6.fib6_null_entry) 187 err = fib6_rule_saddr(net, rule, flags, flp6, 188 res->nh->fib_nh_dev); 189 else 190 err = -EAGAIN; 191 192 return err; 193 } 194 195 static int __fib6_rule_action(struct fib_rule *rule, struct flowi *flp, 196 int flags, struct fib_lookup_arg *arg) 197 { 198 struct fib6_result *res = arg->result; 199 struct flowi6 *flp6 = &flp->u.ip6; 200 struct rt6_info *rt = NULL; 201 struct fib6_table *table; 202 struct net *net = rule->fr_net; 203 pol_lookup_t lookup = arg->lookup_ptr; 204 int err = 0; 205 u32 tb_id; 206 207 switch (rule->action) { 208 case FR_ACT_TO_TBL: 209 break; 210 case FR_ACT_UNREACHABLE: 211 err = -ENETUNREACH; 212 rt = net->ipv6.ip6_null_entry; 213 goto discard_pkt; 214 default: 215 case FR_ACT_BLACKHOLE: 216 err = -EINVAL; 217 rt = net->ipv6.ip6_blk_hole_entry; 218 goto discard_pkt; 219 case FR_ACT_PROHIBIT: 220 err = -EACCES; 221 rt = net->ipv6.ip6_prohibit_entry; 222 goto discard_pkt; 223 } 224 225 tb_id = fib_rule_get_table(rule, arg); 226 table = fib6_get_table(net, tb_id); 227 if (!table) { 228 err = -EAGAIN; 229 goto out; 230 } 231 232 rt = pol_lookup_func(lookup, 233 net, table, flp6, arg->lookup_data, flags); 234 if (rt != net->ipv6.ip6_null_entry) { 235 err = fib6_rule_saddr(net, rule, flags, flp6, 236 ip6_dst_idev(&rt->dst)->dev); 237 238 if (err == -EAGAIN) 239 goto again; 240 241 err = rt->dst.error; 242 if (err != -EAGAIN) 243 goto out; 244 } 245 again: 246 ip6_rt_put_flags(rt, flags); 247 err = -EAGAIN; 248 rt = NULL; 249 goto out; 250 251 discard_pkt: 252 if (!(flags & RT6_LOOKUP_F_DST_NOREF)) 253 dst_hold(&rt->dst); 254 out: 255 res->rt6 = rt; 256 return err; 257 } 258 259 INDIRECT_CALLABLE_SCOPE int fib6_rule_action(struct fib_rule *rule, 260 struct flowi *flp, int flags, 261 struct fib_lookup_arg *arg) 262 { 263 if (arg->lookup_ptr == fib6_table_lookup) 264 return fib6_rule_action_alt(rule, flp, flags, arg); 265 266 return __fib6_rule_action(rule, flp, flags, arg); 267 } 268 269 INDIRECT_CALLABLE_SCOPE bool fib6_rule_suppress(struct fib_rule *rule, 270 struct fib_lookup_arg *arg) 271 { 272 struct fib6_result *res = arg->result; 273 struct rt6_info *rt = res->rt6; 274 struct net_device *dev = NULL; 275 276 if (!rt) 277 return false; 278 279 if (rt->rt6i_idev) 280 dev = rt->rt6i_idev->dev; 281 282 /* do not accept result if the route does 283 * not meet the required prefix length 284 */ 285 if (rt->rt6i_dst.plen <= rule->suppress_prefixlen) 286 goto suppress_route; 287 288 /* do not accept result if the route uses a device 289 * belonging to a forbidden interface group 290 */ 291 if (rule->suppress_ifgroup != -1 && dev && dev->group == rule->suppress_ifgroup) 292 goto suppress_route; 293 294 return false; 295 296 suppress_route: 297 if (!(arg->flags & FIB_LOOKUP_NOREF)) 298 ip6_rt_put(rt); 299 return true; 300 } 301 302 INDIRECT_CALLABLE_SCOPE int fib6_rule_match(struct fib_rule *rule, 303 struct flowi *fl, int flags) 304 { 305 struct fib6_rule *r = (struct fib6_rule *) rule; 306 struct flowi6 *fl6 = &fl->u.ip6; 307 308 if (r->dst.plen && 309 !ipv6_prefix_equal(&fl6->daddr, &r->dst.addr, r->dst.plen)) 310 return 0; 311 312 /* 313 * If FIB_RULE_FIND_SADDR is set and we do not have a 314 * source address for the traffic, we defer check for 315 * source address. 316 */ 317 if (r->src.plen) { 318 if (flags & RT6_LOOKUP_F_HAS_SADDR) { 319 if (!ipv6_prefix_equal(&fl6->saddr, &r->src.addr, 320 r->src.plen)) 321 return 0; 322 } else if (!(r->common.flags & FIB_RULE_FIND_SADDR)) 323 return 0; 324 } 325 326 if (r->tclass && r->tclass != ip6_tclass(fl6->flowlabel)) 327 return 0; 328 329 if (rule->ip_proto && (rule->ip_proto != fl6->flowi6_proto)) 330 return 0; 331 332 if (fib_rule_port_range_set(&rule->sport_range) && 333 !fib_rule_port_inrange(&rule->sport_range, fl6->fl6_sport)) 334 return 0; 335 336 if (fib_rule_port_range_set(&rule->dport_range) && 337 !fib_rule_port_inrange(&rule->dport_range, fl6->fl6_dport)) 338 return 0; 339 340 return 1; 341 } 342 343 static const struct nla_policy fib6_rule_policy[FRA_MAX+1] = { 344 FRA_GENERIC_POLICY, 345 }; 346 347 static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb, 348 struct fib_rule_hdr *frh, 349 struct nlattr **tb, 350 struct netlink_ext_ack *extack) 351 { 352 int err = -EINVAL; 353 struct net *net = sock_net(skb->sk); 354 struct fib6_rule *rule6 = (struct fib6_rule *) rule; 355 356 if (rule->action == FR_ACT_TO_TBL && !rule->l3mdev) { 357 if (rule->table == RT6_TABLE_UNSPEC) { 358 NL_SET_ERR_MSG(extack, "Invalid table"); 359 goto errout; 360 } 361 362 if (fib6_new_table(net, rule->table) == NULL) { 363 err = -ENOBUFS; 364 goto errout; 365 } 366 } 367 368 if (frh->src_len) 369 rule6->src.addr = nla_get_in6_addr(tb[FRA_SRC]); 370 371 if (frh->dst_len) 372 rule6->dst.addr = nla_get_in6_addr(tb[FRA_DST]); 373 374 rule6->src.plen = frh->src_len; 375 rule6->dst.plen = frh->dst_len; 376 rule6->tclass = frh->tos; 377 378 if (fib_rule_requires_fldissect(rule)) 379 net->ipv6.fib6_rules_require_fldissect++; 380 381 net->ipv6.fib6_has_custom_rules = true; 382 err = 0; 383 errout: 384 return err; 385 } 386 387 static int fib6_rule_delete(struct fib_rule *rule) 388 { 389 struct net *net = rule->fr_net; 390 391 if (net->ipv6.fib6_rules_require_fldissect && 392 fib_rule_requires_fldissect(rule)) 393 net->ipv6.fib6_rules_require_fldissect--; 394 395 return 0; 396 } 397 398 static int fib6_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh, 399 struct nlattr **tb) 400 { 401 struct fib6_rule *rule6 = (struct fib6_rule *) rule; 402 403 if (frh->src_len && (rule6->src.plen != frh->src_len)) 404 return 0; 405 406 if (frh->dst_len && (rule6->dst.plen != frh->dst_len)) 407 return 0; 408 409 if (frh->tos && (rule6->tclass != frh->tos)) 410 return 0; 411 412 if (frh->src_len && 413 nla_memcmp(tb[FRA_SRC], &rule6->src.addr, sizeof(struct in6_addr))) 414 return 0; 415 416 if (frh->dst_len && 417 nla_memcmp(tb[FRA_DST], &rule6->dst.addr, sizeof(struct in6_addr))) 418 return 0; 419 420 return 1; 421 } 422 423 static int fib6_rule_fill(struct fib_rule *rule, struct sk_buff *skb, 424 struct fib_rule_hdr *frh) 425 { 426 struct fib6_rule *rule6 = (struct fib6_rule *) rule; 427 428 frh->dst_len = rule6->dst.plen; 429 frh->src_len = rule6->src.plen; 430 frh->tos = rule6->tclass; 431 432 if ((rule6->dst.plen && 433 nla_put_in6_addr(skb, FRA_DST, &rule6->dst.addr)) || 434 (rule6->src.plen && 435 nla_put_in6_addr(skb, FRA_SRC, &rule6->src.addr))) 436 goto nla_put_failure; 437 return 0; 438 439 nla_put_failure: 440 return -ENOBUFS; 441 } 442 443 static size_t fib6_rule_nlmsg_payload(struct fib_rule *rule) 444 { 445 return nla_total_size(16) /* dst */ 446 + nla_total_size(16); /* src */ 447 } 448 449 static const struct fib_rules_ops __net_initconst fib6_rules_ops_template = { 450 .family = AF_INET6, 451 .rule_size = sizeof(struct fib6_rule), 452 .addr_size = sizeof(struct in6_addr), 453 .action = fib6_rule_action, 454 .match = fib6_rule_match, 455 .suppress = fib6_rule_suppress, 456 .configure = fib6_rule_configure, 457 .delete = fib6_rule_delete, 458 .compare = fib6_rule_compare, 459 .fill = fib6_rule_fill, 460 .nlmsg_payload = fib6_rule_nlmsg_payload, 461 .nlgroup = RTNLGRP_IPV6_RULE, 462 .policy = fib6_rule_policy, 463 .owner = THIS_MODULE, 464 .fro_net = &init_net, 465 }; 466 467 static int __net_init fib6_rules_net_init(struct net *net) 468 { 469 struct fib_rules_ops *ops; 470 int err; 471 472 ops = fib_rules_register(&fib6_rules_ops_template, net); 473 if (IS_ERR(ops)) 474 return PTR_ERR(ops); 475 476 err = fib_default_rule_add(ops, 0, RT6_TABLE_LOCAL, 0); 477 if (err) 478 goto out_fib6_rules_ops; 479 480 err = fib_default_rule_add(ops, 0x7FFE, RT6_TABLE_MAIN, 0); 481 if (err) 482 goto out_fib6_rules_ops; 483 484 net->ipv6.fib6_rules_ops = ops; 485 net->ipv6.fib6_rules_require_fldissect = 0; 486 out: 487 return err; 488 489 out_fib6_rules_ops: 490 fib_rules_unregister(ops); 491 goto out; 492 } 493 494 static void __net_exit fib6_rules_net_exit(struct net *net) 495 { 496 rtnl_lock(); 497 fib_rules_unregister(net->ipv6.fib6_rules_ops); 498 rtnl_unlock(); 499 } 500 501 static struct pernet_operations fib6_rules_net_ops = { 502 .init = fib6_rules_net_init, 503 .exit = fib6_rules_net_exit, 504 }; 505 506 int __init fib6_rules_init(void) 507 { 508 return register_pernet_subsys(&fib6_rules_net_ops); 509 } 510 511 512 void fib6_rules_cleanup(void) 513 { 514 unregister_pernet_subsys(&fib6_rules_net_ops); 515 } 516