fib_rules.c

  1// SPDX-License-Identifier: GPL-2.0-or-later
  2/*
  3 * INET		An implementation of the TCP/IP protocol suite for the LINUX
  4 *		operating system.  INET is implemented using the  BSD Socket
  5 *		interface as the means of communication with the user level.
  6 *
  7 *		IPv4 Forwarding Information Base: policy rules.
  8 *
  9 * Authors:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
 10 *		Thomas Graf <tgraf@suug.ch>
 11 *
 12 * Fixes:
 13 *		Rani Assaf	:	local_rule cannot be deleted
 14 *		Marc Boucher	:	routing by fwmark
 15 */
 16
 17#include <linux/types.h>
 18#include <linux/kernel.h>
 19#include <linux/netdevice.h>
 20#include <linux/netlink.h>
 21#include <linux/inetdevice.h>
 22#include <linux/init.h>
 23#include <linux/list.h>
 24#include <linux/rcupdate.h>
 25#include <linux/export.h>
 26#include <net/flow.h>
 27#include <net/inet_dscp.h>
 28#include <net/ip.h>
 29#include <net/route.h>
 30#include <net/tcp.h>
 31#include <net/ip_fib.h>
 32#include <net/nexthop.h>
 33#include <net/fib_rules.h>
 34#include <linux/indirect_call_wrapper.h>
 35
 36struct fib4_rule {
 37	struct fib_rule		common;
 38	u8			dst_len;
 39	u8			src_len;
 40	dscp_t			dscp;
 41	dscp_t			dscp_mask;
 42	u8			dscp_full:1;	/* DSCP or TOS selector */
 43	__be32			src;
 44	__be32			srcmask;
 45	__be32			dst;
 46	__be32			dstmask;
 47#ifdef CONFIG_IP_ROUTE_CLASSID
 48	u32			tclassid;
 49#endif
 50};
 51
 52static bool fib4_rule_matchall(const struct fib_rule *rule)
 53{
 54	struct fib4_rule *r = container_of(rule, struct fib4_rule, common);
 55
 56	if (r->dst_len || r->src_len || r->dscp)
 57		return false;
 58	return fib_rule_matchall(rule);
 59}
 60
 61bool fib4_rule_default(const struct fib_rule *rule)
 62{
 63	if (!fib4_rule_matchall(rule) || rule->action != FR_ACT_TO_TBL ||
 64	    rule->l3mdev)
 65		return false;
 66	if (rule->table != RT_TABLE_LOCAL && rule->table != RT_TABLE_MAIN &&
 67	    rule->table != RT_TABLE_DEFAULT)
 68		return false;
 69	return true;
 70}
 71EXPORT_SYMBOL_GPL(fib4_rule_default);
 72
 73int fib4_rules_dump(struct net *net, struct notifier_block *nb,
 74		    struct netlink_ext_ack *extack)
 75{
 76	return fib_rules_dump(net, nb, AF_INET, extack);
 77}
 78
 79unsigned int fib4_rules_seq_read(const struct net *net)
 80{
 81	return fib_rules_seq_read(net, AF_INET);
 82}
 83
 84int __fib_lookup(struct net *net, struct flowi4 *flp,
 85		 struct fib_result *res, unsigned int flags)
 86{
 87	struct fib_lookup_arg arg = {
 88		.result = res,
 89		.flags = flags,
 90	};
 91	int err;
 92
 93	/* update flow if oif or iif point to device enslaved to l3mdev */
 94	l3mdev_update_flow(net, flowi4_to_flowi(flp));
 95
 96	err = fib_rules_lookup(net->ipv4.rules_ops, flowi4_to_flowi(flp), 0, &arg);
 97#ifdef CONFIG_IP_ROUTE_CLASSID
 98	if (arg.rule)
 99		res->tclassid = ((struct fib4_rule *)arg.rule)->tclassid;
100	else
101		res->tclassid = 0;
102#endif
103
104	if (err == -ESRCH)
105		err = -ENETUNREACH;
106
107	return err;
108}
109EXPORT_SYMBOL_GPL(__fib_lookup);
110
111INDIRECT_CALLABLE_SCOPE int fib4_rule_action(struct fib_rule *rule,
112					     struct flowi *flp, int flags,
113					     struct fib_lookup_arg *arg)
114{
115	int err = -EAGAIN;
116	struct fib_table *tbl;
117	u32 tb_id;
118
119	switch (rule->action) {
120	case FR_ACT_TO_TBL:
121		break;
122
123	case FR_ACT_UNREACHABLE:
124		return -ENETUNREACH;
125
126	case FR_ACT_PROHIBIT:
127		return -EACCES;
128
129	case FR_ACT_BLACKHOLE:
130	default:
131		return -EINVAL;
132	}
133
134	rcu_read_lock();
135
136	tb_id = fib_rule_get_table(rule, arg);
137	tbl = fib_get_table(rule->fr_net, tb_id);
138	if (tbl)
139		err = fib_table_lookup(tbl, &flp->u.ip4,
140				       (struct fib_result *)arg->result,
141				       arg->flags);
142
143	rcu_read_unlock();
144	return err;
145}
146
147INDIRECT_CALLABLE_SCOPE bool fib4_rule_suppress(struct fib_rule *rule,
148						int flags,
149						struct fib_lookup_arg *arg)
150{
151	struct fib_result *result = arg->result;
152	struct net_device *dev = NULL;
153
154	if (result->fi) {
155		struct fib_nh_common *nhc = fib_info_nhc(result->fi, 0);
156
157		dev = nhc->nhc_dev;
158	}
159
160	/* do not accept result if the route does
161	 * not meet the required prefix length
162	 */
163	if (result->prefixlen <= rule->suppress_prefixlen)
164		goto suppress_route;
165
166	/* do not accept result if the route uses a device
167	 * belonging to a forbidden interface group
168	 */
169	if (rule->suppress_ifgroup != -1 && dev && dev->group == rule->suppress_ifgroup)
170		goto suppress_route;
171
172	return false;
173
174suppress_route:
175	if (!(arg->flags & FIB_LOOKUP_NOREF))
176		fib_info_put(result->fi);
177	return true;
178}
179
180INDIRECT_CALLABLE_SCOPE int fib4_rule_match(struct fib_rule *rule,
181					    struct flowi *fl, int flags)
182{
183	struct fib4_rule *r = (struct fib4_rule *) rule;
184	struct flowi4 *fl4 = &fl->u.ip4;
185	__be32 daddr = fl4->daddr;
186	__be32 saddr = fl4->saddr;
187
188	if (((saddr ^ r->src) & r->srcmask) ||
189	    ((daddr ^ r->dst) & r->dstmask))
190		return 0;
191
192	/* When DSCP selector is used we need to match on the entire DSCP field
193	 * in the flow information structure. When TOS selector is used we need
194	 * to mask the upper three DSCP bits prior to matching to maintain
195	 * legacy behavior.
196	 */
197	if (r->dscp_full && (r->dscp ^ fl4->flowi4_dscp) & r->dscp_mask)
198		return 0;
199	else if (!r->dscp_full && r->dscp &&
200		 !fib_dscp_masked_match(r->dscp, fl4))
201		return 0;
202
203	if (rule->ip_proto && (rule->ip_proto != fl4->flowi4_proto))
204		return 0;
205
206	if (!fib_rule_port_match(&rule->sport_range, rule->sport_mask,
207				 fl4->fl4_sport))
208		return 0;
209
210	if (!fib_rule_port_match(&rule->dport_range, rule->dport_mask,
211				 fl4->fl4_dport))
212		return 0;
213
214	return 1;
215}
216
217static struct fib_table *fib_empty_table(struct net *net)
218{
219	u32 id = 1;
220
221	while (1) {
222		if (!fib_get_table(net, id))
223			return fib_new_table(net, id);
224
225		if (id++ == RT_TABLE_MAX)
226			break;
227	}
228	return NULL;
229}
230
231static int fib4_nl2rule_dscp(const struct nlattr *nla, struct fib4_rule *rule4,
232			     struct netlink_ext_ack *extack)
233{
234	if (rule4->dscp) {
235		NL_SET_ERR_MSG(extack, "Cannot specify both TOS and DSCP");
236		return -EINVAL;
237	}
238
239	rule4->dscp = inet_dsfield_to_dscp(nla_get_u8(nla) << 2);
240	rule4->dscp_mask = inet_dsfield_to_dscp(INET_DSCP_MASK);
241	rule4->dscp_full = true;
242
243	return 0;
244}
245
246static int fib4_nl2rule_dscp_mask(const struct nlattr *nla,
247				  struct fib4_rule *rule4,
248				  struct netlink_ext_ack *extack)
249{
250	dscp_t dscp_mask;
251
252	if (!rule4->dscp_full) {
253		NL_SET_ERR_MSG_ATTR(extack, nla,
254				    "Cannot specify DSCP mask without DSCP value");
255		return -EINVAL;
256	}
257
258	dscp_mask = inet_dsfield_to_dscp(nla_get_u8(nla) << 2);
259	if (rule4->dscp & ~dscp_mask) {
260		NL_SET_ERR_MSG_ATTR(extack, nla, "Invalid DSCP mask");
261		return -EINVAL;
262	}
263
264	rule4->dscp_mask = dscp_mask;
265
266	return 0;
267}
268
269static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
270			       struct fib_rule_hdr *frh,
271			       struct nlattr **tb,
272			       struct netlink_ext_ack *extack)
273{
274	struct fib4_rule *rule4 = (struct fib4_rule *)rule;
275	struct net *net = rule->fr_net;
276	int err = -EINVAL;
277
278	if (tb[FRA_FLOWLABEL] || tb[FRA_FLOWLABEL_MASK]) {
279		NL_SET_ERR_MSG(extack,
280			       "Flow label cannot be specified for IPv4 FIB rules");
281		goto errout;
282	}
283
284	if (!inet_validate_dscp(frh->tos)) {
285		NL_SET_ERR_MSG(extack,
286			       "Invalid dsfield (tos): ECN bits must be 0");
287		goto errout;
288	}
289	/* IPv4 currently doesn't handle high order DSCP bits correctly */
290	if (frh->tos & ~IPTOS_TOS_MASK) {
291		NL_SET_ERR_MSG(extack, "Invalid tos");
292		goto errout;
293	}
294	rule4->dscp = inet_dsfield_to_dscp(frh->tos);
295
296	if (tb[FRA_DSCP] &&
297	    fib4_nl2rule_dscp(tb[FRA_DSCP], rule4, extack) < 0)
298		goto errout;
299
300	if (tb[FRA_DSCP_MASK] &&
301	    fib4_nl2rule_dscp_mask(tb[FRA_DSCP_MASK], rule4, extack) < 0)
302		goto errout;
303
304	/* split local/main if they are not already split */
305	err = fib_unmerge(net);
306	if (err)
307		goto errout;
308
309	if (rule->table == RT_TABLE_UNSPEC && !rule->l3mdev) {
310		if (rule->action == FR_ACT_TO_TBL) {
311			struct fib_table *table;
312
313			table = fib_empty_table(net);
314			if (!table) {
315				err = -ENOBUFS;
316				goto errout;
317			}
318
319			rule->table = table->tb_id;
320		}
321	}
322
323	if (frh->src_len)
324		rule4->src = nla_get_in_addr(tb[FRA_SRC]);
325
326	if (frh->dst_len)
327		rule4->dst = nla_get_in_addr(tb[FRA_DST]);
328
329#ifdef CONFIG_IP_ROUTE_CLASSID
330	if (tb[FRA_FLOW]) {
331		rule4->tclassid = nla_get_u32(tb[FRA_FLOW]);
332		if (rule4->tclassid)
333			atomic_inc(&net->ipv4.fib_num_tclassid_users);
334	}
335#endif
336
337	if (fib_rule_requires_fldissect(rule))
338		net->ipv4.fib_rules_require_fldissect++;
339
340	rule4->src_len = frh->src_len;
341	rule4->srcmask = inet_make_mask(rule4->src_len);
342	rule4->dst_len = frh->dst_len;
343	rule4->dstmask = inet_make_mask(rule4->dst_len);
344
345	net->ipv4.fib_has_custom_rules = true;
346
347	err = 0;
348errout:
349	return err;
350}
351
352static int fib4_rule_delete(struct fib_rule *rule)
353{
354	struct net *net = rule->fr_net;
355	int err;
356
357	/* split local/main if they are not already split */
358	err = fib_unmerge(net);
359	if (err)
360		goto errout;
361
362#ifdef CONFIG_IP_ROUTE_CLASSID
363	if (((struct fib4_rule *)rule)->tclassid)
364		atomic_dec(&net->ipv4.fib_num_tclassid_users);
365#endif
366	net->ipv4.fib_has_custom_rules = true;
367
368	if (net->ipv4.fib_rules_require_fldissect &&
369	    fib_rule_requires_fldissect(rule))
370		net->ipv4.fib_rules_require_fldissect--;
371errout:
372	return err;
373}
374
375static int fib4_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
376			     struct nlattr **tb)
377{
378	struct fib4_rule *rule4 = (struct fib4_rule *) rule;
379
380	if (frh->src_len && (rule4->src_len != frh->src_len))
381		return 0;
382
383	if (frh->dst_len && (rule4->dst_len != frh->dst_len))
384		return 0;
385
386	if (frh->tos &&
387	    (rule4->dscp_full ||
388	     inet_dscp_to_dsfield(rule4->dscp) != frh->tos))
389		return 0;
390
391	if (tb[FRA_DSCP]) {
392		dscp_t dscp;
393
394		dscp = inet_dsfield_to_dscp(nla_get_u8(tb[FRA_DSCP]) << 2);
395		if (!rule4->dscp_full || rule4->dscp != dscp)
396			return 0;
397	}
398
399	if (tb[FRA_DSCP_MASK]) {
400		dscp_t dscp_mask;
401
402		dscp_mask = inet_dsfield_to_dscp(nla_get_u8(tb[FRA_DSCP_MASK]) << 2);
403		if (!rule4->dscp_full || rule4->dscp_mask != dscp_mask)
404			return 0;
405	}
406
407#ifdef CONFIG_IP_ROUTE_CLASSID
408	if (tb[FRA_FLOW] && (rule4->tclassid != nla_get_u32(tb[FRA_FLOW])))
409		return 0;
410#endif
411
412	if (frh->src_len && (rule4->src != nla_get_in_addr(tb[FRA_SRC])))
413		return 0;
414
415	if (frh->dst_len && (rule4->dst != nla_get_in_addr(tb[FRA_DST])))
416		return 0;
417
418	return 1;
419}
420
421static int fib4_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
422			  struct fib_rule_hdr *frh)
423{
424	struct fib4_rule *rule4 = (struct fib4_rule *) rule;
425
426	frh->dst_len = rule4->dst_len;
427	frh->src_len = rule4->src_len;
428
429	if (rule4->dscp_full) {
430		frh->tos = 0;
431		if (nla_put_u8(skb, FRA_DSCP,
432			       inet_dscp_to_dsfield(rule4->dscp) >> 2) ||
433		    nla_put_u8(skb, FRA_DSCP_MASK,
434			       inet_dscp_to_dsfield(rule4->dscp_mask) >> 2))
435			goto nla_put_failure;
436	} else {
437		frh->tos = inet_dscp_to_dsfield(rule4->dscp);
438	}
439
440	if ((rule4->dst_len &&
441	     nla_put_in_addr(skb, FRA_DST, rule4->dst)) ||
442	    (rule4->src_len &&
443	     nla_put_in_addr(skb, FRA_SRC, rule4->src)))
444		goto nla_put_failure;
445#ifdef CONFIG_IP_ROUTE_CLASSID
446	if (rule4->tclassid &&
447	    nla_put_u32(skb, FRA_FLOW, rule4->tclassid))
448		goto nla_put_failure;
449#endif
450	return 0;
451
452nla_put_failure:
453	return -ENOBUFS;
454}
455
456static size_t fib4_rule_nlmsg_payload(struct fib_rule *rule)
457{
458	return nla_total_size(4) /* dst */
459	       + nla_total_size(4) /* src */
460	       + nla_total_size(4) /* flow */
461	       + nla_total_size(1) /* dscp */
462	       + nla_total_size(1); /* dscp mask */
463}
464
465static void fib4_rule_flush_cache(struct fib_rules_ops *ops)
466{
467	rt_cache_flush(ops->fro_net);
468}
469
470static const struct fib_rules_ops __net_initconst fib4_rules_ops_template = {
471	.family		= AF_INET,
472	.rule_size	= sizeof(struct fib4_rule),
473	.addr_size	= sizeof(u32),
474	.action		= fib4_rule_action,
475	.suppress	= fib4_rule_suppress,
476	.match		= fib4_rule_match,
477	.configure	= fib4_rule_configure,
478	.delete		= fib4_rule_delete,
479	.compare	= fib4_rule_compare,
480	.fill		= fib4_rule_fill,
481	.nlmsg_payload	= fib4_rule_nlmsg_payload,
482	.flush_cache	= fib4_rule_flush_cache,
483	.nlgroup	= RTNLGRP_IPV4_RULE,
484	.owner		= THIS_MODULE,
485};
486
487static int fib_default_rules_init(struct fib_rules_ops *ops)
488{
489	int err;
490
491	err = fib_default_rule_add(ops, 0, RT_TABLE_LOCAL);
492	if (err < 0)
493		return err;
494	err = fib_default_rule_add(ops, 0x7FFE, RT_TABLE_MAIN);
495	if (err < 0)
496		return err;
497	err = fib_default_rule_add(ops, 0x7FFF, RT_TABLE_DEFAULT);
498	if (err < 0)
499		return err;
500	return 0;
501}
502
503int __net_init fib4_rules_init(struct net *net)
504{
505	int err;
506	struct fib_rules_ops *ops;
507
508	ops = fib_rules_register(&fib4_rules_ops_template, net);
509	if (IS_ERR(ops))
510		return PTR_ERR(ops);
511
512	err = fib_default_rules_init(ops);
513	if (err < 0)
514		goto fail;
515	net->ipv4.rules_ops = ops;
516	net->ipv4.fib_has_custom_rules = false;
517	net->ipv4.fib_rules_require_fldissect = 0;
518	return 0;
519
520fail:
521	/* also cleans all rules already added */
522	fib_rules_unregister(ops);
523	return err;
524}
525
526void __net_exit fib4_rules_exit(struct net *net)
527{
528	fib_rules_unregister(net->ipv4.rules_ops);
529}