fib_rules.c revision 51314a17baabc710e5fb12975fe8983dedd5ac0d 
1/*
2 * INET		An implementation of the TCP/IP protocol suite for the LINUX
3 *		operating system.  INET is implemented using the  BSD Socket
4 *		interface as the means of communication with the user level.
5 *
6 *		IPv4 Forwarding Information Base: policy rules.
7 *
8 * Authors:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
9 * 		Thomas Graf <tgraf@suug.ch>
10 *
11 *		This program is free software; you can redistribute it and/or
12 *		modify it under the terms of the GNU General Public License
13 *		as published by the Free Software Foundation; either version
14 *		2 of the License, or (at your option) any later version.
15 *
16 * Fixes:
17 * 		Rani Assaf	:	local_rule cannot be deleted
18 *		Marc Boucher	:	routing by fwmark
19 */
20
21#include <linux/types.h>
22#include <linux/kernel.h>
23#include <linux/netdevice.h>
24#include <linux/netlink.h>
25#include <linux/inetdevice.h>
26#include <linux/init.h>
27#include <linux/list.h>
28#include <linux/rcupdate.h>
29#include <net/ip.h>
30#include <net/route.h>
31#include <net/tcp.h>
32#include <net/ip_fib.h>
33#include <net/fib_rules.h>
34
35struct fib4_rule
36{
37	struct fib_rule		common;
38	u8			dst_len;
39	u8			src_len;
40	u8			tos;
41	__be32			src;
42	__be32			srcmask;
43	__be32			dst;
44	__be32			dstmask;
45#ifdef CONFIG_NET_CLS_ROUTE
46	u32			tclassid;
47#endif
48};
49
50#ifdef CONFIG_NET_CLS_ROUTE
51u32 fib_rules_tclass(struct fib_result *res)
52{
53	return res->r ? ((struct fib4_rule *) res->r)->tclassid : 0;
54}
55#endif
56
57int fib_lookup(struct flowi *flp, struct fib_result *res)
58{
59	struct fib_lookup_arg arg = {
60		.result = res,
61	};
62	int err;
63
64	err = fib_rules_lookup(init_net.ipv4.rules_ops, flp, 0, &arg);
65	res->r = arg.rule;
66
67	return err;
68}
69
70static int fib4_rule_action(struct fib_rule *rule, struct flowi *flp,
71			    int flags, struct fib_lookup_arg *arg)
72{
73	int err = -EAGAIN;
74	struct fib_table *tbl;
75
76	switch (rule->action) {
77	case FR_ACT_TO_TBL:
78		break;
79
80	case FR_ACT_UNREACHABLE:
81		err = -ENETUNREACH;
82		goto errout;
83
84	case FR_ACT_PROHIBIT:
85		err = -EACCES;
86		goto errout;
87
88	case FR_ACT_BLACKHOLE:
89	default:
90		err = -EINVAL;
91		goto errout;
92	}
93
94	if ((tbl = fib_get_table(rule->fr_net, rule->table)) == NULL)
95		goto errout;
96
97	err = tbl->tb_lookup(tbl, flp, (struct fib_result *) arg->result);
98	if (err > 0)
99		err = -EAGAIN;
100errout:
101	return err;
102}
103
104
105void fib_select_default(const struct flowi *flp, struct fib_result *res)
106{
107	if (res->r && res->r->action == FR_ACT_TO_TBL &&
108	    FIB_RES_GW(*res) && FIB_RES_NH(*res).nh_scope == RT_SCOPE_LINK) {
109		struct fib_table *tb;
110		if ((tb = fib_get_table(&init_net, res->r->table)) != NULL)
111			tb->tb_select_default(tb, flp, res);
112	}
113}
114
115static int fib4_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
116{
117	struct fib4_rule *r = (struct fib4_rule *) rule;
118	__be32 daddr = fl->fl4_dst;
119	__be32 saddr = fl->fl4_src;
120
121	if (((saddr ^ r->src) & r->srcmask) ||
122	    ((daddr ^ r->dst) & r->dstmask))
123		return 0;
124
125	if (r->tos && (r->tos != fl->fl4_tos))
126		return 0;
127
128	return 1;
129}
130
131static struct fib_table *fib_empty_table(struct net *net)
132{
133	u32 id;
134
135	for (id = 1; id <= RT_TABLE_MAX; id++)
136		if (fib_get_table(net, id) == NULL)
137			return fib_new_table(net, id);
138	return NULL;
139}
140
141static const struct nla_policy fib4_rule_policy[FRA_MAX+1] = {
142	FRA_GENERIC_POLICY,
143	[FRA_FLOW]	= { .type = NLA_U32 },
144};
145
146static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
147			       struct nlmsghdr *nlh, struct fib_rule_hdr *frh,
148			       struct nlattr **tb)
149{
150	struct net *net = skb->sk->sk_net;
151	int err = -EINVAL;
152	struct fib4_rule *rule4 = (struct fib4_rule *) rule;
153
154	if (frh->tos & ~IPTOS_TOS_MASK)
155		goto errout;
156
157	if (rule->table == RT_TABLE_UNSPEC) {
158		if (rule->action == FR_ACT_TO_TBL) {
159			struct fib_table *table;
160
161			table = fib_empty_table(net);
162			if (table == NULL) {
163				err = -ENOBUFS;
164				goto errout;
165			}
166
167			rule->table = table->tb_id;
168		}
169	}
170
171	if (frh->src_len)
172		rule4->src = nla_get_be32(tb[FRA_SRC]);
173
174	if (frh->dst_len)
175		rule4->dst = nla_get_be32(tb[FRA_DST]);
176
177#ifdef CONFIG_NET_CLS_ROUTE
178	if (tb[FRA_FLOW])
179		rule4->tclassid = nla_get_u32(tb[FRA_FLOW]);
180#endif
181
182	rule4->src_len = frh->src_len;
183	rule4->srcmask = inet_make_mask(rule4->src_len);
184	rule4->dst_len = frh->dst_len;
185	rule4->dstmask = inet_make_mask(rule4->dst_len);
186	rule4->tos = frh->tos;
187
188	err = 0;
189errout:
190	return err;
191}
192
193static int fib4_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
194			     struct nlattr **tb)
195{
196	struct fib4_rule *rule4 = (struct fib4_rule *) rule;
197
198	if (frh->src_len && (rule4->src_len != frh->src_len))
199		return 0;
200
201	if (frh->dst_len && (rule4->dst_len != frh->dst_len))
202		return 0;
203
204	if (frh->tos && (rule4->tos != frh->tos))
205		return 0;
206
207#ifdef CONFIG_NET_CLS_ROUTE
208	if (tb[FRA_FLOW] && (rule4->tclassid != nla_get_u32(tb[FRA_FLOW])))
209		return 0;
210#endif
211
212	if (frh->src_len && (rule4->src != nla_get_be32(tb[FRA_SRC])))
213		return 0;
214
215	if (frh->dst_len && (rule4->dst != nla_get_be32(tb[FRA_DST])))
216		return 0;
217
218	return 1;
219}
220
221static int fib4_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
222			  struct nlmsghdr *nlh, struct fib_rule_hdr *frh)
223{
224	struct fib4_rule *rule4 = (struct fib4_rule *) rule;
225
226	frh->family = AF_INET;
227	frh->dst_len = rule4->dst_len;
228	frh->src_len = rule4->src_len;
229	frh->tos = rule4->tos;
230
231	if (rule4->dst_len)
232		NLA_PUT_BE32(skb, FRA_DST, rule4->dst);
233
234	if (rule4->src_len)
235		NLA_PUT_BE32(skb, FRA_SRC, rule4->src);
236
237#ifdef CONFIG_NET_CLS_ROUTE
238	if (rule4->tclassid)
239		NLA_PUT_U32(skb, FRA_FLOW, rule4->tclassid);
240#endif
241	return 0;
242
243nla_put_failure:
244	return -ENOBUFS;
245}
246
247static u32 fib4_rule_default_pref(struct fib_rules_ops *ops)
248{
249	struct list_head *pos;
250	struct fib_rule *rule;
251
252	if (!list_empty(&ops->rules_list)) {
253		pos = ops->rules_list.next;
254		if (pos->next != &ops->rules_list) {
255			rule = list_entry(pos->next, struct fib_rule, list);
256			if (rule->pref)
257				return rule->pref - 1;
258		}
259	}
260
261	return 0;
262}
263
264static size_t fib4_rule_nlmsg_payload(struct fib_rule *rule)
265{
266	return nla_total_size(4) /* dst */
267	       + nla_total_size(4) /* src */
268	       + nla_total_size(4); /* flow */
269}
270
271static void fib4_rule_flush_cache(void)
272{
273	rt_cache_flush(-1);
274}
275
276static struct fib_rules_ops fib4_rules_ops_template = {
277	.family		= AF_INET,
278	.rule_size	= sizeof(struct fib4_rule),
279	.addr_size	= sizeof(u32),
280	.action		= fib4_rule_action,
281	.match		= fib4_rule_match,
282	.configure	= fib4_rule_configure,
283	.compare	= fib4_rule_compare,
284	.fill		= fib4_rule_fill,
285	.default_pref	= fib4_rule_default_pref,
286	.nlmsg_payload	= fib4_rule_nlmsg_payload,
287	.flush_cache	= fib4_rule_flush_cache,
288	.nlgroup	= RTNLGRP_IPV4_RULE,
289	.policy		= fib4_rule_policy,
290	.owner		= THIS_MODULE,
291};
292
293static int fib_default_rules_init(struct fib_rules_ops *ops)
294{
295	int err;
296
297	err = fib_default_rule_add(ops, 0, RT_TABLE_LOCAL, FIB_RULE_PERMANENT);
298	if (err < 0)
299		return err;
300	err = fib_default_rule_add(ops, 0x7FFE, RT_TABLE_MAIN, 0);
301	if (err < 0)
302		return err;
303	err = fib_default_rule_add(ops, 0x7FFF, RT_TABLE_DEFAULT, 0);
304	if (err < 0)
305		return err;
306	return 0;
307}
308
309int __net_init fib4_rules_init(struct net *net)
310{
311	int err;
312	struct fib_rules_ops *ops;
313
314	ops = kmemdup(&fib4_rules_ops_template, sizeof(*ops), GFP_KERNEL);
315	if (ops == NULL)
316		return -ENOMEM;
317	INIT_LIST_HEAD(&ops->rules_list);
318	ops->fro_net = net;
319
320	fib_rules_register(ops);
321
322	err = fib_default_rules_init(ops);
323	if (err < 0)
324		goto fail;
325	net->ipv4.rules_ops = ops;
326	return 0;
327
328fail:
329	/* also cleans all rules already added */
330	fib_rules_unregister(ops);
331	kfree(ops);
332	return err;
333}
334
335void __net_exit fib4_rules_exit(struct net *net)
336{
337	fib_rules_unregister(net->ipv4.rules_ops);
338	kfree(net->ipv4.rules_ops);
339}
340