net/ipv6/fib6_rules.c

0001 // SPDX-License-Identifier: GPL-2.0-only
0002 /*
0003  * net/ipv6/fib6_rules.c    IPv6 Routing Policy Rules
0004  *
0005  * Copyright (C)2003-2006 Helsinki University of Technology
0006  * Copyright (C)2003-2006 USAGI/WIDE Project
0007  *
0008  * Authors
0009  *  Thomas Graf     <tgraf@suug.ch>
0010  *  Ville Nuorvala      <vnuorval@tcs.hut.fi>
0011  */
0012
0013 #include <linux/netdevice.h>
0014 #include <linux/notifier.h>
0015 #include <linux/export.h>
0016 #include <linux/indirect_call_wrapper.h>
0017
0018 #include <net/fib_rules.h>
0019 #include <net/inet_dscp.h>
0020 #include <net/ipv6.h>
0021 #include <net/addrconf.h>
0022 #include <net/ip6_route.h>
0023 #include <net/netlink.h>
0024
0025 struct fib6_rule {
0026     struct fib_rule     common;
0027     struct rt6key       src;
0028     struct rt6key       dst;
0029     dscp_t          dscp;
0030 };
0031
0032 static bool fib6_rule_matchall(const struct fib_rule *rule)
0033 {
0034     struct fib6_rule *r = container_of(rule, struct fib6_rule, common);
0035
0036     if (r->dst.plen || r->src.plen || r->dscp)
0037         return false;
0038     return fib_rule_matchall(rule);
0039 }
0040
0041 bool fib6_rule_default(const struct fib_rule *rule)
0042 {
0043     if (!fib6_rule_matchall(rule) || rule->action != FR_ACT_TO_TBL ||
0044         rule->l3mdev)
0045         return false;
0046     if (rule->table != RT6_TABLE_LOCAL && rule->table != RT6_TABLE_MAIN)
0047         return false;
0048     return true;
0049 }
0050 EXPORT_SYMBOL_GPL(fib6_rule_default);
0051
0052 int fib6_rules_dump(struct net *net, struct notifier_block *nb,
0053             struct netlink_ext_ack *extack)
0054 {
0055     return fib_rules_dump(net, nb, AF_INET6, extack);
0056 }
0057
0058 unsigned int fib6_rules_seq_read(struct net *net)
0059 {
0060     return fib_rules_seq_read(net, AF_INET6);
0061 }
0062
0063 /* called with rcu lock held; no reference taken on fib6_info */
0064 int fib6_lookup(struct net *net, int oif, struct flowi6 *fl6,
0065         struct fib6_result *res, int flags)
0066 {
0067     int err;
0068
0069     if (net->ipv6.fib6_has_custom_rules) {
0070         struct fib_lookup_arg arg = {
0071             .lookup_ptr = fib6_table_lookup,
0072             .lookup_data = &oif,
0073             .result = res,
0074             .flags = FIB_LOOKUP_NOREF,
0075         };
0076
0077         l3mdev_update_flow(net, flowi6_to_flowi(fl6));
0078
0079         err = fib_rules_lookup(net->ipv6.fib6_rules_ops,
0080                        flowi6_to_flowi(fl6), flags, &arg);
0081     } else {
0082         err = fib6_table_lookup(net, net->ipv6.fib6_local_tbl, oif,
0083                     fl6, res, flags);
0084         if (err || res->f6i == net->ipv6.fib6_null_entry)
0085             err = fib6_table_lookup(net, net->ipv6.fib6_main_tbl,
0086                         oif, fl6, res, flags);
0087     }
0088
0089     return err;
0090 }
0091
0092 struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,
0093                    const struct sk_buff *skb,
0094                    int flags, pol_lookup_t lookup)
0095 {
0096     if (net->ipv6.fib6_has_custom_rules) {
0097         struct fib6_result res = {};
0098         struct fib_lookup_arg arg = {
0099             .lookup_ptr = lookup,
0100             .lookup_data = skb,
0101             .result = &res,
0102             .flags = FIB_LOOKUP_NOREF,
0103         };
0104
0105         /* update flow if oif or iif point to device enslaved to l3mdev */
0106         l3mdev_update_flow(net, flowi6_to_flowi(fl6));
0107
0108         fib_rules_lookup(net->ipv6.fib6_rules_ops,
0109                  flowi6_to_flowi(fl6), flags, &arg);
0110
0111         if (res.rt6)
0112             return &res.rt6->dst;
0113     } else {
0114         struct rt6_info *rt;
0115
0116         rt = pol_lookup_func(lookup,
0117                  net, net->ipv6.fib6_local_tbl, fl6, skb, flags);
0118         if (rt != net->ipv6.ip6_null_entry && rt->dst.error != -EAGAIN)
0119             return &rt->dst;
0120         ip6_rt_put_flags(rt, flags);
0121         rt = pol_lookup_func(lookup,
0122                  net, net->ipv6.fib6_main_tbl, fl6, skb, flags);
0123         if (rt->dst.error != -EAGAIN)
0124             return &rt->dst;
0125         ip6_rt_put_flags(rt, flags);
0126     }
0127
0128     if (!(flags & RT6_LOOKUP_F_DST_NOREF))
0129         dst_hold(&net->ipv6.ip6_null_entry->dst);
0130     return &net->ipv6.ip6_null_entry->dst;
0131 }
0132
0133 static int fib6_rule_saddr(struct net *net, struct fib_rule *rule, int flags,
0134                struct flowi6 *flp6, const struct net_device *dev)
0135 {
0136     struct fib6_rule *r = (struct fib6_rule *)rule;
0137
0138     /* If we need to find a source address for this traffic,
0139      * we check the result if it meets requirement of the rule.
0140      */
0141     if ((rule->flags & FIB_RULE_FIND_SADDR) &&
0142         r->src.plen && !(flags & RT6_LOOKUP_F_HAS_SADDR)) {
0143         struct in6_addr saddr;
0144
0145         if (ipv6_dev_get_saddr(net, dev, &flp6->daddr,
0146                        rt6_flags2srcprefs(flags), &saddr))
0147             return -EAGAIN;
0148
0149         if (!ipv6_prefix_equal(&saddr, &r->src.addr, r->src.plen))
0150             return -EAGAIN;
0151
0152         flp6->saddr = saddr;
0153     }
0154
0155     return 0;
0156 }
0157
0158 static int fib6_rule_action_alt(struct fib_rule *rule, struct flowi *flp,
0159                 int flags, struct fib_lookup_arg *arg)
0160 {
0161     struct fib6_result *res = arg->result;
0162     struct flowi6 *flp6 = &flp->u.ip6;
0163     struct net *net = rule->fr_net;
0164     struct fib6_table *table;
0165     int err, *oif;
0166     u32 tb_id;
0167
0168     switch (rule->action) {
0169     case FR_ACT_TO_TBL:
0170         break;
0171     case FR_ACT_UNREACHABLE:
0172         return -ENETUNREACH;
0173     case FR_ACT_PROHIBIT:
0174         return -EACCES;
0175     case FR_ACT_BLACKHOLE:
0176     default:
0177         return -EINVAL;
0178     }
0179
0180     tb_id = fib_rule_get_table(rule, arg);
0181     table = fib6_get_table(net, tb_id);
0182     if (!table)
0183         return -EAGAIN;
0184
0185     oif = (int *)arg->lookup_data;
0186     err = fib6_table_lookup(net, table, *oif, flp6, res, flags);
0187     if (!err && res->f6i != net->ipv6.fib6_null_entry)
0188         err = fib6_rule_saddr(net, rule, flags, flp6,
0189                       res->nh->fib_nh_dev);
0190     else
0191         err = -EAGAIN;
0192
0193     return err;
0194 }
0195
0196 static int __fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
0197                   int flags, struct fib_lookup_arg *arg)
0198 {
0199     struct fib6_result *res = arg->result;
0200     struct flowi6 *flp6 = &flp->u.ip6;
0201     struct rt6_info *rt = NULL;
0202     struct fib6_table *table;
0203     struct net *net = rule->fr_net;
0204     pol_lookup_t lookup = arg->lookup_ptr;
0205     int err = 0;
0206     u32 tb_id;
0207
0208     switch (rule->action) {
0209     case FR_ACT_TO_TBL:
0210         break;
0211     case FR_ACT_UNREACHABLE:
0212         err = -ENETUNREACH;
0213         rt = net->ipv6.ip6_null_entry;
0214         goto discard_pkt;
0215     default:
0216     case FR_ACT_BLACKHOLE:
0217         err = -EINVAL;
0218         rt = net->ipv6.ip6_blk_hole_entry;
0219         goto discard_pkt;
0220     case FR_ACT_PROHIBIT:
0221         err = -EACCES;
0222         rt = net->ipv6.ip6_prohibit_entry;
0223         goto discard_pkt;
0224     }
0225
0226     tb_id = fib_rule_get_table(rule, arg);
0227     table = fib6_get_table(net, tb_id);
0228     if (!table) {
0229         err = -EAGAIN;
0230         goto out;
0231     }
0232
0233     rt = pol_lookup_func(lookup,
0234                  net, table, flp6, arg->lookup_data, flags);
0235     if (rt != net->ipv6.ip6_null_entry) {
0236         err = fib6_rule_saddr(net, rule, flags, flp6,
0237                       ip6_dst_idev(&rt->dst)->dev);
0238
0239         if (err == -EAGAIN)
0240             goto again;
0241
0242         err = rt->dst.error;
0243         if (err != -EAGAIN)
0244             goto out;
0245     }
0246 again:
0247     ip6_rt_put_flags(rt, flags);
0248     err = -EAGAIN;
0249     rt = NULL;
0250     goto out;
0251
0252 discard_pkt:
0253     if (!(flags & RT6_LOOKUP_F_DST_NOREF))
0254         dst_hold(&rt->dst);
0255 out:
0256     res->rt6 = rt;
0257     return err;
0258 }
0259
0260 INDIRECT_CALLABLE_SCOPE int fib6_rule_action(struct fib_rule *rule,
0261                          struct flowi *flp, int flags,
0262                          struct fib_lookup_arg *arg)
0263 {
0264     if (arg->lookup_ptr == fib6_table_lookup)
0265         return fib6_rule_action_alt(rule, flp, flags, arg);
0266
0267     return __fib6_rule_action(rule, flp, flags, arg);
0268 }
0269
0270 INDIRECT_CALLABLE_SCOPE bool fib6_rule_suppress(struct fib_rule *rule,
0271                         int flags,
0272                         struct fib_lookup_arg *arg)
0273 {
0274     struct fib6_result *res = arg->result;
0275     struct rt6_info *rt = res->rt6;
0276     struct net_device *dev = NULL;
0277
0278     if (!rt)
0279         return false;
0280
0281     if (rt->rt6i_idev)
0282         dev = rt->rt6i_idev->dev;
0283
0284     /* do not accept result if the route does
0285      * not meet the required prefix length
0286      */
0287     if (rt->rt6i_dst.plen <= rule->suppress_prefixlen)
0288         goto suppress_route;
0289
0290     /* do not accept result if the route uses a device
0291      * belonging to a forbidden interface group
0292      */
0293     if (rule->suppress_ifgroup != -1 && dev && dev->group == rule->suppress_ifgroup)
0294         goto suppress_route;
0295
0296     return false;
0297
0298 suppress_route:
0299     ip6_rt_put_flags(rt, flags);
0300     return true;
0301 }
0302
0303 INDIRECT_CALLABLE_SCOPE int fib6_rule_match(struct fib_rule *rule,
0304                         struct flowi *fl, int flags)
0305 {
0306     struct fib6_rule *r = (struct fib6_rule *) rule;
0307     struct flowi6 *fl6 = &fl->u.ip6;
0308
0309     if (r->dst.plen &&
0310         !ipv6_prefix_equal(&fl6->daddr, &r->dst.addr, r->dst.plen))
0311         return 0;
0312
0313     /*
0314      * If FIB_RULE_FIND_SADDR is set and we do not have a
0315      * source address for the traffic, we defer check for
0316      * source address.
0317      */
0318     if (r->src.plen) {
0319         if (flags & RT6_LOOKUP_F_HAS_SADDR) {
0320             if (!ipv6_prefix_equal(&fl6->saddr, &r->src.addr,
0321                            r->src.plen))
0322                 return 0;
0323         } else if (!(r->common.flags & FIB_RULE_FIND_SADDR))
0324             return 0;
0325     }
0326
0327     if (r->dscp && r->dscp != ip6_dscp(fl6->flowlabel))
0328         return 0;
0329
0330     if (rule->ip_proto && (rule->ip_proto != fl6->flowi6_proto))
0331         return 0;
0332
0333     if (fib_rule_port_range_set(&rule->sport_range) &&
0334         !fib_rule_port_inrange(&rule->sport_range, fl6->fl6_sport))
0335         return 0;
0336
0337     if (fib_rule_port_range_set(&rule->dport_range) &&
0338         !fib_rule_port_inrange(&rule->dport_range, fl6->fl6_dport))
0339         return 0;
0340
0341     return 1;
0342 }
0343
0344 static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
0345                    struct fib_rule_hdr *frh,
0346                    struct nlattr **tb,
0347                    struct netlink_ext_ack *extack)
0348 {
0349     int err = -EINVAL;
0350     struct net *net = sock_net(skb->sk);
0351     struct fib6_rule *rule6 = (struct fib6_rule *) rule;
0352
0353     if (!inet_validate_dscp(frh->tos)) {
0354         NL_SET_ERR_MSG(extack,
0355                    "Invalid dsfield (tos): ECN bits must be 0");
0356         goto errout;
0357     }
0358     rule6->dscp = inet_dsfield_to_dscp(frh->tos);
0359
0360     if (rule->action == FR_ACT_TO_TBL && !rule->l3mdev) {
0361         if (rule->table == RT6_TABLE_UNSPEC) {
0362             NL_SET_ERR_MSG(extack, "Invalid table");
0363             goto errout;
0364         }
0365
0366         if (fib6_new_table(net, rule->table) == NULL) {
0367             err = -ENOBUFS;
0368             goto errout;
0369         }
0370     }
0371
0372     if (frh->src_len)
0373         rule6->src.addr = nla_get_in6_addr(tb[FRA_SRC]);
0374
0375     if (frh->dst_len)
0376         rule6->dst.addr = nla_get_in6_addr(tb[FRA_DST]);
0377
0378     rule6->src.plen = frh->src_len;
0379     rule6->dst.plen = frh->dst_len;
0380
0381     if (fib_rule_requires_fldissect(rule))
0382         net->ipv6.fib6_rules_require_fldissect++;
0383
0384     net->ipv6.fib6_has_custom_rules = true;
0385     err = 0;
0386 errout:
0387     return err;
0388 }
0389
0390 static int fib6_rule_delete(struct fib_rule *rule)
0391 {
0392     struct net *net = rule->fr_net;
0393
0394     if (net->ipv6.fib6_rules_require_fldissect &&
0395         fib_rule_requires_fldissect(rule))
0396         net->ipv6.fib6_rules_require_fldissect--;
0397
0398     return 0;
0399 }
0400
0401 static int fib6_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
0402                  struct nlattr **tb)
0403 {
0404     struct fib6_rule *rule6 = (struct fib6_rule *) rule;
0405
0406     if (frh->src_len && (rule6->src.plen != frh->src_len))
0407         return 0;
0408
0409     if (frh->dst_len && (rule6->dst.plen != frh->dst_len))
0410         return 0;
0411
0412     if (frh->tos && inet_dscp_to_dsfield(rule6->dscp) != frh->tos)
0413         return 0;
0414
0415     if (frh->src_len &&
0416         nla_memcmp(tb[FRA_SRC], &rule6->src.addr, sizeof(struct in6_addr)))
0417         return 0;
0418
0419     if (frh->dst_len &&
0420         nla_memcmp(tb[FRA_DST], &rule6->dst.addr, sizeof(struct in6_addr)))
0421         return 0;
0422
0423     return 1;
0424 }
0425
0426 static int fib6_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
0427               struct fib_rule_hdr *frh)
0428 {
0429     struct fib6_rule *rule6 = (struct fib6_rule *) rule;
0430
0431     frh->dst_len = rule6->dst.plen;
0432     frh->src_len = rule6->src.plen;
0433     frh->tos = inet_dscp_to_dsfield(rule6->dscp);
0434
0435     if ((rule6->dst.plen &&
0436          nla_put_in6_addr(skb, FRA_DST, &rule6->dst.addr)) ||
0437         (rule6->src.plen &&
0438          nla_put_in6_addr(skb, FRA_SRC, &rule6->src.addr)))
0439         goto nla_put_failure;
0440     return 0;
0441
0442 nla_put_failure:
0443     return -ENOBUFS;
0444 }
0445
0446 static size_t fib6_rule_nlmsg_payload(struct fib_rule *rule)
0447 {
0448     return nla_total_size(16) /* dst */
0449            + nla_total_size(16); /* src */
0450 }
0451
0452 static const struct fib_rules_ops __net_initconst fib6_rules_ops_template = {
0453     .family         = AF_INET6,
0454     .rule_size      = sizeof(struct fib6_rule),
0455     .addr_size      = sizeof(struct in6_addr),
0456     .action         = fib6_rule_action,
0457     .match          = fib6_rule_match,
0458     .suppress       = fib6_rule_suppress,
0459     .configure      = fib6_rule_configure,
0460     .delete         = fib6_rule_delete,
0461     .compare        = fib6_rule_compare,
0462     .fill           = fib6_rule_fill,
0463     .nlmsg_payload      = fib6_rule_nlmsg_payload,
0464     .nlgroup        = RTNLGRP_IPV6_RULE,
0465     .owner          = THIS_MODULE,
0466     .fro_net        = &init_net,
0467 };
0468
0469 static int __net_init fib6_rules_net_init(struct net *net)
0470 {
0471     struct fib_rules_ops *ops;
0472     int err;
0473
0474     ops = fib_rules_register(&fib6_rules_ops_template, net);
0475     if (IS_ERR(ops))
0476         return PTR_ERR(ops);
0477
0478     err = fib_default_rule_add(ops, 0, RT6_TABLE_LOCAL, 0);
0479     if (err)
0480         goto out_fib6_rules_ops;
0481
0482     err = fib_default_rule_add(ops, 0x7FFE, RT6_TABLE_MAIN, 0);
0483     if (err)
0484         goto out_fib6_rules_ops;
0485
0486     net->ipv6.fib6_rules_ops = ops;
0487     net->ipv6.fib6_rules_require_fldissect = 0;
0488 out:
0489     return err;
0490
0491 out_fib6_rules_ops:
0492     fib_rules_unregister(ops);
0493     goto out;
0494 }
0495
0496 static void __net_exit fib6_rules_net_exit_batch(struct list_head *net_list)
0497 {
0498     struct net *net;
0499
0500     rtnl_lock();
0501     list_for_each_entry(net, net_list, exit_list) {
0502         fib_rules_unregister(net->ipv6.fib6_rules_ops);
0503         cond_resched();
0504     }
0505     rtnl_unlock();
0506 }
0507
0508 static struct pernet_operations fib6_rules_net_ops = {
0509     .init = fib6_rules_net_init,
0510     .exit_batch = fib6_rules_net_exit_batch,
0511 };
0512
0513 int __init fib6_rules_init(void)
0514 {
0515     return register_pernet_subsys(&fib6_rules_net_ops);
0516 }
0517
0518
0519 void fib6_rules_cleanup(void)
0520 {
0521     unregister_pernet_subsys(&fib6_rules_net_ops);
0522 }