projects/linux·blob master · refs

658 lines · 15.8 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * net/ipv6/fib6_rules.c IPv6 Routing Policy Rules
4 *
5 * Copyright (C)2003-2006 Helsinki University of Technology
6 * Copyright (C)2003-2006 USAGI/WIDE Project
7 *
8 * Authors
9 * Thomas Graf <[email protected]>
10 * Ville Nuorvala <[email protected]>
11 */
12
13#include <linux/netdevice.h>
14#include <linux/notifier.h>
15#include <linux/export.h>
16#include <linux/indirect_call_wrapper.h>
17
18#include <net/fib_rules.h>
19#include <net/inet_dscp.h>
20#include <net/ipv6.h>
21#include <net/addrconf.h>
22#include <net/ip6_route.h>
23#include <net/netlink.h>
24
25struct fib6_rule {
26 struct fib_rule common;
27 struct rt6key src;
28 struct rt6key dst;
29 __be32 flowlabel;
30 __be32 flowlabel_mask;
31 dscp_t dscp;
32 dscp_t dscp_mask;
33 u8 dscp_full:1; /* DSCP or TOS selector */
34};
35
36static bool fib6_rule_matchall(const struct fib_rule *rule)
37{
38 struct fib6_rule *r = container_of(rule, struct fib6_rule, common);
39
40 if (r->dst.plen || r->src.plen || r->dscp || r->flowlabel_mask)
41 return false;
42 return fib_rule_matchall(rule);
43}
44
45bool fib6_rule_default(const struct fib_rule *rule)
46{
47 if (!fib6_rule_matchall(rule) || rule->action != FR_ACT_TO_TBL ||
48 rule->l3mdev)
49 return false;
50 if (rule->table != RT6_TABLE_LOCAL && rule->table != RT6_TABLE_MAIN)
51 return false;
52 return true;
53}
54EXPORT_SYMBOL_GPL(fib6_rule_default);
55
56int fib6_rules_dump(struct net *net, struct notifier_block *nb,
57 struct netlink_ext_ack *extack)
58{
59 return fib_rules_dump(net, nb, AF_INET6, extack);
60}
61
62unsigned int fib6_rules_seq_read(const struct net *net)
63{
64 return fib_rules_seq_read(net, AF_INET6);
65}
66
67/* called with rcu lock held; no reference taken on fib6_info */
68int fib6_lookup(struct net *net, int oif, struct flowi6 *fl6,
69 struct fib6_result *res, int flags)
70{
71 int err;
72
73 if (net->ipv6.fib6_has_custom_rules) {
74 struct fib_lookup_arg arg = {
75 .lookup_ptr = fib6_table_lookup,
76 .lookup_data = &oif,
77 .result = res,
78 .flags = FIB_LOOKUP_NOREF,
79 };
80
81 l3mdev_update_flow(net, flowi6_to_flowi(fl6));
82
83 err = fib_rules_lookup(net->ipv6.fib6_rules_ops,
84 flowi6_to_flowi(fl6), flags, &arg);
85 } else {
86 err = fib6_table_lookup(net, net->ipv6.fib6_local_tbl, oif,
87 fl6, res, flags);
88 if (err || res->f6i == net->ipv6.fib6_null_entry)
89 err = fib6_table_lookup(net, net->ipv6.fib6_main_tbl,
90 oif, fl6, res, flags);
91 }
92
93 return err;
94}
95#if IS_MODULE(CONFIG_NFT_FIB_IPV6)
96EXPORT_SYMBOL_GPL(fib6_lookup);
97#endif
98
99struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,
100 const struct sk_buff *skb,
101 int flags, pol_lookup_t lookup)
102{
103 if (net->ipv6.fib6_has_custom_rules) {
104 struct fib6_result res = {};
105 struct fib_lookup_arg arg = {
106 .lookup_ptr = lookup,
107 .lookup_data = skb,
108 .result = &res,
109 .flags = FIB_LOOKUP_NOREF,
110 };
111
112 /* update flow if oif or iif point to device enslaved to l3mdev */
113 l3mdev_update_flow(net, flowi6_to_flowi(fl6));
114
115 fib_rules_lookup(net->ipv6.fib6_rules_ops,
116 flowi6_to_flowi(fl6), flags, &arg);
117
118 if (res.rt6)
119 return &res.rt6->dst;
120 } else {
121 struct rt6_info *rt;
122
123 rt = pol_lookup_func(lookup,
124 net, net->ipv6.fib6_local_tbl, fl6, skb, flags);
125 if (rt != net->ipv6.ip6_null_entry && rt->dst.error != -EAGAIN)
126 return &rt->dst;
127 ip6_rt_put_flags(rt, flags);
128 rt = pol_lookup_func(lookup,
129 net, net->ipv6.fib6_main_tbl, fl6, skb, flags);
130 if (rt->dst.error != -EAGAIN)
131 return &rt->dst;
132 ip6_rt_put_flags(rt, flags);
133 }
134
135 if (!(flags & RT6_LOOKUP_F_DST_NOREF))
136 dst_hold(&net->ipv6.ip6_null_entry->dst);
137 return &net->ipv6.ip6_null_entry->dst;
138}
139
140static int fib6_rule_saddr(struct net *net, struct fib_rule *rule, int flags,
141 struct flowi6 *flp6, const struct net_device *dev)
142{
143 struct fib6_rule *r = (struct fib6_rule *)rule;
144
145 /* If we need to find a source address for this traffic,
146 * we check the result if it meets requirement of the rule.
147 */
148 if ((rule->flags & FIB_RULE_FIND_SADDR) &&
149 r->src.plen && !(flags & RT6_LOOKUP_F_HAS_SADDR)) {
150 struct in6_addr saddr;
151
152 if (ipv6_dev_get_saddr(net, dev, &flp6->daddr,
153 rt6_flags2srcprefs(flags), &saddr))
154 return -EAGAIN;
155
156 if (!ipv6_prefix_equal(&saddr, &r->src.addr, r->src.plen))
157 return -EAGAIN;
158
159 flp6->saddr = saddr;
160 }
161
162 return 0;
163}
164
165static int fib6_rule_action_alt(struct fib_rule *rule, struct flowi *flp,
166 int flags, struct fib_lookup_arg *arg)
167{
168 struct fib6_result *res = arg->result;
169 struct flowi6 *flp6 = &flp->u.ip6;
170 struct net *net = rule->fr_net;
171 struct fib6_table *table;
172 int err, *oif;
173 u32 tb_id;
174
175 switch (rule->action) {
176 case FR_ACT_TO_TBL:
177 break;
178 case FR_ACT_UNREACHABLE:
179 return -ENETUNREACH;
180 case FR_ACT_PROHIBIT:
181 return -EACCES;
182 case FR_ACT_BLACKHOLE:
183 default:
184 return -EINVAL;
185 }
186
187 tb_id = fib_rule_get_table(rule, arg);
188 table = fib6_get_table(net, tb_id);
189 if (!table)
190 return -EAGAIN;
191
192 oif = (int *)arg->lookup_data;
193 err = fib6_table_lookup(net, table, *oif, flp6, res, flags);
194 if (!err && res->f6i != net->ipv6.fib6_null_entry)
195 err = fib6_rule_saddr(net, rule, flags, flp6,
196 res->nh->fib_nh_dev);
197 else
198 err = -EAGAIN;
199
200 return err;
201}
202
203static int __fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
204 int flags, struct fib_lookup_arg *arg)
205{
206 struct fib6_result *res = arg->result;
207 struct flowi6 *flp6 = &flp->u.ip6;
208 struct rt6_info *rt = NULL;
209 struct fib6_table *table;
210 struct net *net = rule->fr_net;
211 pol_lookup_t lookup = arg->lookup_ptr;
212 int err = 0;
213 u32 tb_id;
214
215 switch (rule->action) {
216 case FR_ACT_TO_TBL:
217 break;
218 case FR_ACT_UNREACHABLE:
219 err = -ENETUNREACH;
220 rt = net->ipv6.ip6_null_entry;
221 goto discard_pkt;
222 default:
223 case FR_ACT_BLACKHOLE:
224 err = -EINVAL;
225 rt = net->ipv6.ip6_blk_hole_entry;
226 goto discard_pkt;
227 case FR_ACT_PROHIBIT:
228 err = -EACCES;
229 rt = net->ipv6.ip6_prohibit_entry;
230 goto discard_pkt;
231 }
232
233 tb_id = fib_rule_get_table(rule, arg);
234 table = fib6_get_table(net, tb_id);
235 if (!table) {
236 err = -EAGAIN;
237 goto out;
238 }
239
240 rt = pol_lookup_func(lookup,
241 net, table, flp6, arg->lookup_data, flags);
242 if (rt != net->ipv6.ip6_null_entry) {
243 struct inet6_dev *idev = ip6_dst_idev(&rt->dst);
244
245 if (!idev)
246 goto again;
247 err = fib6_rule_saddr(net, rule, flags, flp6,
248 idev->dev);
249
250 if (err == -EAGAIN)
251 goto again;
252
253 err = rt->dst.error;
254 if (err != -EAGAIN)
255 goto out;
256 }
257again:
258 ip6_rt_put_flags(rt, flags);
259 err = -EAGAIN;
260 rt = NULL;
261 goto out;
262
263discard_pkt:
264 if (!(flags & RT6_LOOKUP_F_DST_NOREF))
265 dst_hold(&rt->dst);
266out:
267 res->rt6 = rt;
268 return err;
269}
270
271INDIRECT_CALLABLE_SCOPE int fib6_rule_action(struct fib_rule *rule,
272 struct flowi *flp, int flags,
273 struct fib_lookup_arg *arg)
274{
275 if (arg->lookup_ptr == fib6_table_lookup)
276 return fib6_rule_action_alt(rule, flp, flags, arg);
277
278 return __fib6_rule_action(rule, flp, flags, arg);
279}
280
281INDIRECT_CALLABLE_SCOPE bool fib6_rule_suppress(struct fib_rule *rule,
282 int flags,
283 struct fib_lookup_arg *arg)
284{
285 struct fib6_result *res = arg->result;
286 struct rt6_info *rt = res->rt6;
287 struct net_device *dev = NULL;
288
289 if (!rt)
290 return false;
291
292 if (rt->rt6i_idev)
293 dev = rt->rt6i_idev->dev;
294
295 /* do not accept result if the route does
296 * not meet the required prefix length
297 */
298 if (rt->rt6i_dst.plen <= rule->suppress_prefixlen)
299 goto suppress_route;
300
301 /* do not accept result if the route uses a device
302 * belonging to a forbidden interface group
303 */
304 if (rule->suppress_ifgroup != -1 && dev && dev->group == rule->suppress_ifgroup)
305 goto suppress_route;
306
307 return false;
308
309suppress_route:
310 ip6_rt_put_flags(rt, flags);
311 res->rt6 = NULL;
312 return true;
313}
314
315INDIRECT_CALLABLE_SCOPE int fib6_rule_match(struct fib_rule *rule,
316 struct flowi *fl, int flags)
317{
318 struct fib6_rule *r = (struct fib6_rule *) rule;
319 struct flowi6 *fl6 = &fl->u.ip6;
320
321 if (r->dst.plen &&
322 !ipv6_prefix_equal(&fl6->daddr, &r->dst.addr, r->dst.plen))
323 return 0;
324
325 /*
326 * If FIB_RULE_FIND_SADDR is set and we do not have a
327 * source address for the traffic, we defer check for
328 * source address.
329 */
330 if (r->src.plen) {
331 if (flags & RT6_LOOKUP_F_HAS_SADDR) {
332 if (!ipv6_prefix_equal(&fl6->saddr, &r->src.addr,
333 r->src.plen))
334 return 0;
335 } else if (!(r->common.flags & FIB_RULE_FIND_SADDR))
336 return 0;
337 }
338
339 if ((r->dscp ^ ip6_dscp(fl6->flowlabel)) & r->dscp_mask)
340 return 0;
341
342 if ((r->flowlabel ^ flowi6_get_flowlabel(fl6)) & r->flowlabel_mask)
343 return 0;
344
345 if (rule->ip_proto && (rule->ip_proto != fl6->flowi6_proto))
346 return 0;
347
348 if (!fib_rule_port_match(&rule->sport_range, rule->sport_mask,
349 fl6->fl6_sport))
350 return 0;
351
352 if (!fib_rule_port_match(&rule->dport_range, rule->dport_mask,
353 fl6->fl6_dport))
354 return 0;
355
356 return 1;
357}
358
359static int fib6_nl2rule_dscp(const struct nlattr *nla, struct fib6_rule *rule6,
360 struct netlink_ext_ack *extack)
361{
362 if (rule6->dscp) {
363 NL_SET_ERR_MSG(extack, "Cannot specify both TOS and DSCP");
364 return -EINVAL;
365 }
366
367 rule6->dscp = inet_dsfield_to_dscp(nla_get_u8(nla) << 2);
368 rule6->dscp_mask = inet_dsfield_to_dscp(INET_DSCP_MASK);
369 rule6->dscp_full = true;
370
371 return 0;
372}
373
374static int fib6_nl2rule_dscp_mask(const struct nlattr *nla,
375 struct fib6_rule *rule6,
376 struct netlink_ext_ack *extack)
377{
378 dscp_t dscp_mask;
379
380 if (!rule6->dscp_full) {
381 NL_SET_ERR_MSG_ATTR(extack, nla,
382 "Cannot specify DSCP mask without DSCP value");
383 return -EINVAL;
384 }
385
386 dscp_mask = inet_dsfield_to_dscp(nla_get_u8(nla) << 2);
387 if (rule6->dscp & ~dscp_mask) {
388 NL_SET_ERR_MSG_ATTR(extack, nla, "Invalid DSCP mask");
389 return -EINVAL;
390 }
391
392 rule6->dscp_mask = dscp_mask;
393
394 return 0;
395}
396
397static int fib6_nl2rule_flowlabel(struct nlattr **tb, struct fib6_rule *rule6,
398 struct netlink_ext_ack *extack)
399{
400 __be32 flowlabel, flowlabel_mask;
401
402 if (NL_REQ_ATTR_CHECK(extack, NULL, tb, FRA_FLOWLABEL) ||
403 NL_REQ_ATTR_CHECK(extack, NULL, tb, FRA_FLOWLABEL_MASK))
404 return -EINVAL;
405
406 flowlabel = nla_get_be32(tb[FRA_FLOWLABEL]);
407 flowlabel_mask = nla_get_be32(tb[FRA_FLOWLABEL_MASK]);
408
409 if (flowlabel_mask & ~IPV6_FLOWLABEL_MASK) {
410 NL_SET_ERR_MSG_ATTR(extack, tb[FRA_FLOWLABEL_MASK],
411 "Invalid flow label mask");
412 return -EINVAL;
413 }
414
415 if (flowlabel & ~flowlabel_mask) {
416 NL_SET_ERR_MSG(extack, "Flow label and mask do not match");
417 return -EINVAL;
418 }
419
420 rule6->flowlabel = flowlabel;
421 rule6->flowlabel_mask = flowlabel_mask;
422
423 return 0;
424}
425
426static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
427 struct fib_rule_hdr *frh,
428 struct nlattr **tb,
429 struct netlink_ext_ack *extack)
430{
431 struct fib6_rule *rule6 = (struct fib6_rule *)rule;
432 struct net *net = rule->fr_net;
433 int err = -EINVAL;
434
435 if (!inet_validate_dscp(frh->tos)) {
436 NL_SET_ERR_MSG(extack,
437 "Invalid dsfield (tos): ECN bits must be 0");
438 goto errout;
439 }
440 rule6->dscp = inet_dsfield_to_dscp(frh->tos);
441 rule6->dscp_mask = frh->tos ? inet_dsfield_to_dscp(INET_DSCP_MASK) : 0;
442
443 if (tb[FRA_DSCP] && fib6_nl2rule_dscp(tb[FRA_DSCP], rule6, extack) < 0)
444 goto errout;
445
446 if (tb[FRA_DSCP_MASK] &&
447 fib6_nl2rule_dscp_mask(tb[FRA_DSCP_MASK], rule6, extack) < 0)
448 goto errout;
449
450 if ((tb[FRA_FLOWLABEL] || tb[FRA_FLOWLABEL_MASK]) &&
451 fib6_nl2rule_flowlabel(tb, rule6, extack) < 0)
452 goto errout;
453
454 if (rule->action == FR_ACT_TO_TBL && !rule->l3mdev) {
455 if (rule->table == RT6_TABLE_UNSPEC) {
456 NL_SET_ERR_MSG(extack, "Invalid table");
457 goto errout;
458 }
459
460 if (fib6_new_table(net, rule->table) == NULL) {
461 err = -ENOBUFS;
462 goto errout;
463 }
464 }
465
466 if (frh->src_len)
467 rule6->src.addr = nla_get_in6_addr(tb[FRA_SRC]);
468
469 if (frh->dst_len)
470 rule6->dst.addr = nla_get_in6_addr(tb[FRA_DST]);
471
472 rule6->src.plen = frh->src_len;
473 rule6->dst.plen = frh->dst_len;
474
475 if (fib_rule_requires_fldissect(rule))
476 net->ipv6.fib6_rules_require_fldissect++;
477
478 net->ipv6.fib6_has_custom_rules = true;
479 err = 0;
480errout:
481 return err;
482}
483
484static void fib6_rule_delete(struct fib_rule *rule)
485{
486 struct net *net = rule->fr_net;
487
488 if (net->ipv6.fib6_rules_require_fldissect &&
489 fib_rule_requires_fldissect(rule))
490 net->ipv6.fib6_rules_require_fldissect--;
491}
492
493static int fib6_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
494 struct nlattr **tb)
495{
496 struct fib6_rule *rule6 = (struct fib6_rule *) rule;
497
498 if (frh->src_len && (rule6->src.plen != frh->src_len))
499 return 0;
500
501 if (frh->dst_len && (rule6->dst.plen != frh->dst_len))
502 return 0;
503
504 if (frh->tos &&
505 (rule6->dscp_full ||
506 inet_dscp_to_dsfield(rule6->dscp) != frh->tos))
507 return 0;
508
509 if (tb[FRA_DSCP]) {
510 dscp_t dscp;
511
512 dscp = inet_dsfield_to_dscp(nla_get_u8(tb[FRA_DSCP]) << 2);
513 if (!rule6->dscp_full || rule6->dscp != dscp)
514 return 0;
515 }
516
517 if (tb[FRA_DSCP_MASK]) {
518 dscp_t dscp_mask;
519
520 dscp_mask = inet_dsfield_to_dscp(nla_get_u8(tb[FRA_DSCP_MASK]) << 2);
521 if (!rule6->dscp_full || rule6->dscp_mask != dscp_mask)
522 return 0;
523 }
524
525 if (tb[FRA_FLOWLABEL] &&
526 nla_get_be32(tb[FRA_FLOWLABEL]) != rule6->flowlabel)
527 return 0;
528
529 if (tb[FRA_FLOWLABEL_MASK] &&
530 nla_get_be32(tb[FRA_FLOWLABEL_MASK]) != rule6->flowlabel_mask)
531 return 0;
532
533 if (frh->src_len &&
534 nla_memcmp(tb[FRA_SRC], &rule6->src.addr, sizeof(struct in6_addr)))
535 return 0;
536
537 if (frh->dst_len &&
538 nla_memcmp(tb[FRA_DST], &rule6->dst.addr, sizeof(struct in6_addr)))
539 return 0;
540
541 return 1;
542}
543
544static int fib6_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
545 struct fib_rule_hdr *frh)
546{
547 struct fib6_rule *rule6 = (struct fib6_rule *) rule;
548
549 frh->dst_len = rule6->dst.plen;
550 frh->src_len = rule6->src.plen;
551
552 if (rule6->dscp_full) {
553 frh->tos = 0;
554 if (nla_put_u8(skb, FRA_DSCP,
555 inet_dscp_to_dsfield(rule6->dscp) >> 2) ||
556 nla_put_u8(skb, FRA_DSCP_MASK,
557 inet_dscp_to_dsfield(rule6->dscp_mask) >> 2))
558 goto nla_put_failure;
559 } else {
560 frh->tos = inet_dscp_to_dsfield(rule6->dscp);
561 }
562
563 if (rule6->flowlabel_mask &&
564 (nla_put_be32(skb, FRA_FLOWLABEL, rule6->flowlabel) ||
565 nla_put_be32(skb, FRA_FLOWLABEL_MASK, rule6->flowlabel_mask)))
566 goto nla_put_failure;
567
568 if ((rule6->dst.plen &&
569 nla_put_in6_addr(skb, FRA_DST, &rule6->dst.addr)) ||
570 (rule6->src.plen &&
571 nla_put_in6_addr(skb, FRA_SRC, &rule6->src.addr)))
572 goto nla_put_failure;
573 return 0;
574
575nla_put_failure:
576 return -ENOBUFS;
577}
578
579static size_t fib6_rule_nlmsg_payload(struct fib_rule *rule)
580{
581 return nla_total_size(16) /* dst */
582 + nla_total_size(16) /* src */
583 + nla_total_size(1) /* dscp */
584 + nla_total_size(1) /* dscp mask */
585 + nla_total_size(4) /* flowlabel */
586 + nla_total_size(4); /* flowlabel mask */
587}
588
589static void fib6_rule_flush_cache(struct fib_rules_ops *ops)
590{
591 rt_genid_bump_ipv6(ops->fro_net);
592}
593
594static const struct fib_rules_ops __net_initconst fib6_rules_ops_template = {
595 .family = AF_INET6,
596 .rule_size = sizeof(struct fib6_rule),
597 .addr_size = sizeof(struct in6_addr),
598 .action = fib6_rule_action,
599 .match = fib6_rule_match,
600 .suppress = fib6_rule_suppress,
601 .configure = fib6_rule_configure,
602 .delete = fib6_rule_delete,
603 .compare = fib6_rule_compare,
604 .fill = fib6_rule_fill,
605 .nlmsg_payload = fib6_rule_nlmsg_payload,
606 .flush_cache = fib6_rule_flush_cache,
607 .nlgroup = RTNLGRP_IPV6_RULE,
608 .owner = THIS_MODULE,
609 .fro_net = &init_net,
610};
611
612static int __net_init fib6_rules_net_init(struct net *net)
613{
614 struct fib_rules_ops *ops;
615 int err;
616
617 ops = fib_rules_register(&fib6_rules_ops_template, net);
618 if (IS_ERR(ops))
619 return PTR_ERR(ops);
620
621 err = fib_default_rule_add(ops, 0, RT6_TABLE_LOCAL);
622 if (err)
623 goto out_fib6_rules_ops;
624
625 err = fib_default_rule_add(ops, 0x7FFE, RT6_TABLE_MAIN);
626 if (err)
627 goto out_fib6_rules_ops;
628
629 net->ipv6.fib6_rules_ops = ops;
630 net->ipv6.fib6_rules_require_fldissect = 0;
631out:
632 return err;
633
634out_fib6_rules_ops:
635 fib_rules_unregister(ops);
636 goto out;
637}
638
639static void __net_exit fib6_rules_net_exit(struct net *net)
640{
641 fib_rules_unregister(net->ipv6.fib6_rules_ops);
642}
643
644static struct pernet_operations fib6_rules_net_ops = {
645 .init = fib6_rules_net_init,
646 .exit = fib6_rules_net_exit,
647};
648
649int __init fib6_rules_init(void)
650{
651 return register_pernet_subsys(&fib6_rules_net_ops);
652}
653
654
655void fib6_rules_cleanup(void)
656{
657 unregister_pernet_subsys(&fib6_rules_net_ops);
658}