2 * net/core/fib_rules.c Generic Routing Rules
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License as
6 * published by the Free Software Foundation, version 2.
8 * Authors: Thomas Graf <tgraf@suug.ch>
11 #include <linux/types.h>
12 #include <linux/kernel.h>
13 #include <linux/list.h>
14 #include <net/net_namespace.h>
16 #include <net/fib_rules.h>
18 int fib_default_rule_add(struct fib_rules_ops *ops,
19 u32 pref, u32 table, u32 flags)
23 r = kzalloc(ops->rule_size, GFP_KERNEL);
27 atomic_set(&r->refcnt, 1);
28 r->action = FR_ACT_TO_TBL;
33 /* The lock is not required here, the list in unreacheable
34 * at the moment this function is called */
35 list_add_tail(&r->list, &ops->rules_list);
38 EXPORT_SYMBOL(fib_default_rule_add);
40 static void notify_rule_change(int event, struct fib_rule *rule,
41 struct fib_rules_ops *ops, struct nlmsghdr *nlh,
44 static struct fib_rules_ops *lookup_rules_ops(struct net *net, int family)
46 struct fib_rules_ops *ops;
49 list_for_each_entry_rcu(ops, &net->rules_ops, list) {
50 if (ops->family == family) {
51 if (!try_module_get(ops->owner))
62 static void rules_ops_put(struct fib_rules_ops *ops)
65 module_put(ops->owner);
68 static void flush_route_cache(struct fib_rules_ops *ops)
74 int fib_rules_register(struct fib_rules_ops *ops)
77 struct fib_rules_ops *o;
82 if (ops->rule_size < sizeof(struct fib_rule))
85 if (ops->match == NULL || ops->configure == NULL ||
86 ops->compare == NULL || ops->fill == NULL ||
90 spin_lock(&net->rules_mod_lock);
91 list_for_each_entry(o, &net->rules_ops, list)
92 if (ops->family == o->family)
96 list_add_tail_rcu(&ops->list, &net->rules_ops);
99 spin_unlock(&net->rules_mod_lock);
104 EXPORT_SYMBOL_GPL(fib_rules_register);
106 void fib_rules_cleanup_ops(struct fib_rules_ops *ops)
108 struct fib_rule *rule, *tmp;
110 list_for_each_entry_safe(rule, tmp, &ops->rules_list, list) {
111 list_del_rcu(&rule->list);
115 EXPORT_SYMBOL_GPL(fib_rules_cleanup_ops);
117 void fib_rules_unregister(struct fib_rules_ops *ops)
119 struct net *net = ops->fro_net;
121 spin_lock(&net->rules_mod_lock);
122 list_del_rcu(&ops->list);
123 fib_rules_cleanup_ops(ops);
124 spin_unlock(&net->rules_mod_lock);
130 EXPORT_SYMBOL_GPL(fib_rules_unregister);
132 static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops,
133 struct flowi *fl, int flags)
137 if (rule->ifindex && (rule->ifindex != fl->iif))
140 if ((rule->mark ^ fl->mark) & rule->mark_mask)
143 ret = ops->match(rule, fl, flags);
145 return (rule->flags & FIB_RULE_INVERT) ? !ret : ret;
148 int fib_rules_lookup(struct fib_rules_ops *ops, struct flowi *fl,
149 int flags, struct fib_lookup_arg *arg)
151 struct fib_rule *rule;
156 list_for_each_entry_rcu(rule, &ops->rules_list, list) {
158 if (!fib_rule_match(rule, ops, fl, flags))
161 if (rule->action == FR_ACT_GOTO) {
162 struct fib_rule *target;
164 target = rcu_dereference(rule->ctarget);
165 if (target == NULL) {
171 } else if (rule->action == FR_ACT_NOP)
174 err = ops->action(rule, fl, flags, arg);
176 if (err != -EAGAIN) {
190 EXPORT_SYMBOL_GPL(fib_rules_lookup);
192 static int validate_rulemsg(struct fib_rule_hdr *frh, struct nlattr **tb,
193 struct fib_rules_ops *ops)
198 if (tb[FRA_SRC] == NULL ||
199 frh->src_len > (ops->addr_size * 8) ||
200 nla_len(tb[FRA_SRC]) != ops->addr_size)
204 if (tb[FRA_DST] == NULL ||
205 frh->dst_len > (ops->addr_size * 8) ||
206 nla_len(tb[FRA_DST]) != ops->addr_size)
214 static int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
216 struct net *net = skb->sk->sk_net;
217 struct fib_rule_hdr *frh = nlmsg_data(nlh);
218 struct fib_rules_ops *ops = NULL;
219 struct fib_rule *rule, *r, *last = NULL;
220 struct nlattr *tb[FRA_MAX+1];
221 int err = -EINVAL, unresolved = 0;
223 if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh)))
226 ops = lookup_rules_ops(net, frh->family);
232 err = nlmsg_parse(nlh, sizeof(*frh), tb, FRA_MAX, ops->policy);
236 err = validate_rulemsg(frh, tb, ops);
240 rule = kzalloc(ops->rule_size, GFP_KERNEL);
246 if (tb[FRA_PRIORITY])
247 rule->pref = nla_get_u32(tb[FRA_PRIORITY]);
249 if (tb[FRA_IFNAME]) {
250 struct net_device *dev;
253 nla_strlcpy(rule->ifname, tb[FRA_IFNAME], IFNAMSIZ);
254 dev = __dev_get_by_name(net, rule->ifname);
256 rule->ifindex = dev->ifindex;
259 if (tb[FRA_FWMARK]) {
260 rule->mark = nla_get_u32(tb[FRA_FWMARK]);
262 /* compatibility: if the mark value is non-zero all bits
263 * are compared unless a mask is explicitly specified.
265 rule->mark_mask = 0xFFFFFFFF;
269 rule->mark_mask = nla_get_u32(tb[FRA_FWMASK]);
271 rule->action = frh->action;
272 rule->flags = frh->flags;
273 rule->table = frh_get_table(frh, tb);
275 if (!rule->pref && ops->default_pref)
276 rule->pref = ops->default_pref(ops);
280 if (rule->action != FR_ACT_GOTO)
283 rule->target = nla_get_u32(tb[FRA_GOTO]);
284 /* Backward jumps are prohibited to avoid endless loops */
285 if (rule->target <= rule->pref)
288 list_for_each_entry(r, &ops->rules_list, list) {
289 if (r->pref == rule->target) {
295 if (rule->ctarget == NULL)
297 } else if (rule->action == FR_ACT_GOTO)
300 err = ops->configure(rule, skb, nlh, frh, tb);
304 list_for_each_entry(r, &ops->rules_list, list) {
305 if (r->pref > rule->pref)
312 if (ops->unresolved_rules) {
314 * There are unresolved goto rules in the list, check if
315 * any of them are pointing to this new rule.
317 list_for_each_entry(r, &ops->rules_list, list) {
318 if (r->action == FR_ACT_GOTO &&
319 r->target == rule->pref) {
320 BUG_ON(r->ctarget != NULL);
321 rcu_assign_pointer(r->ctarget, rule);
322 if (--ops->unresolved_rules == 0)
328 if (rule->action == FR_ACT_GOTO)
329 ops->nr_goto_rules++;
332 ops->unresolved_rules++;
335 list_add_rcu(&rule->list, &last->list);
337 list_add_rcu(&rule->list, &ops->rules_list);
339 notify_rule_change(RTM_NEWRULE, rule, ops, nlh, NETLINK_CB(skb).pid);
340 flush_route_cache(ops);
351 static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
353 struct net *net = skb->sk->sk_net;
354 struct fib_rule_hdr *frh = nlmsg_data(nlh);
355 struct fib_rules_ops *ops = NULL;
356 struct fib_rule *rule, *tmp;
357 struct nlattr *tb[FRA_MAX+1];
360 if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh)))
363 ops = lookup_rules_ops(net, frh->family);
369 err = nlmsg_parse(nlh, sizeof(*frh), tb, FRA_MAX, ops->policy);
373 err = validate_rulemsg(frh, tb, ops);
377 list_for_each_entry(rule, &ops->rules_list, list) {
378 if (frh->action && (frh->action != rule->action))
381 if (frh->table && (frh_get_table(frh, tb) != rule->table))
384 if (tb[FRA_PRIORITY] &&
385 (rule->pref != nla_get_u32(tb[FRA_PRIORITY])))
388 if (tb[FRA_IFNAME] &&
389 nla_strcmp(tb[FRA_IFNAME], rule->ifname))
392 if (tb[FRA_FWMARK] &&
393 (rule->mark != nla_get_u32(tb[FRA_FWMARK])))
396 if (tb[FRA_FWMASK] &&
397 (rule->mark_mask != nla_get_u32(tb[FRA_FWMASK])))
400 if (!ops->compare(rule, frh, tb))
403 if (rule->flags & FIB_RULE_PERMANENT) {
408 list_del_rcu(&rule->list);
410 if (rule->action == FR_ACT_GOTO)
411 ops->nr_goto_rules--;
414 * Check if this rule is a target to any of them. If so,
415 * disable them. As this operation is eventually very
416 * expensive, it is only performed if goto rules have
417 * actually been added.
419 if (ops->nr_goto_rules > 0) {
420 list_for_each_entry(tmp, &ops->rules_list, list) {
421 if (tmp->ctarget == rule) {
422 rcu_assign_pointer(tmp->ctarget, NULL);
423 ops->unresolved_rules++;
429 notify_rule_change(RTM_DELRULE, rule, ops, nlh,
430 NETLINK_CB(skb).pid);
432 flush_route_cache(ops);
443 static inline size_t fib_rule_nlmsg_size(struct fib_rules_ops *ops,
444 struct fib_rule *rule)
446 size_t payload = NLMSG_ALIGN(sizeof(struct fib_rule_hdr))
447 + nla_total_size(IFNAMSIZ) /* FRA_IFNAME */
448 + nla_total_size(4) /* FRA_PRIORITY */
449 + nla_total_size(4) /* FRA_TABLE */
450 + nla_total_size(4) /* FRA_FWMARK */
451 + nla_total_size(4); /* FRA_FWMASK */
453 if (ops->nlmsg_payload)
454 payload += ops->nlmsg_payload(rule);
459 static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
460 u32 pid, u32 seq, int type, int flags,
461 struct fib_rules_ops *ops)
463 struct nlmsghdr *nlh;
464 struct fib_rule_hdr *frh;
466 nlh = nlmsg_put(skb, pid, seq, type, sizeof(*frh), flags);
470 frh = nlmsg_data(nlh);
471 frh->table = rule->table;
472 NLA_PUT_U32(skb, FRA_TABLE, rule->table);
475 frh->action = rule->action;
476 frh->flags = rule->flags;
478 if (rule->action == FR_ACT_GOTO && rule->ctarget == NULL)
479 frh->flags |= FIB_RULE_UNRESOLVED;
481 if (rule->ifname[0]) {
482 NLA_PUT_STRING(skb, FRA_IFNAME, rule->ifname);
484 if (rule->ifindex == -1)
485 frh->flags |= FIB_RULE_DEV_DETACHED;
489 NLA_PUT_U32(skb, FRA_PRIORITY, rule->pref);
492 NLA_PUT_U32(skb, FRA_FWMARK, rule->mark);
494 if (rule->mark_mask || rule->mark)
495 NLA_PUT_U32(skb, FRA_FWMASK, rule->mark_mask);
498 NLA_PUT_U32(skb, FRA_GOTO, rule->target);
500 if (ops->fill(rule, skb, nlh, frh) < 0)
501 goto nla_put_failure;
503 return nlmsg_end(skb, nlh);
506 nlmsg_cancel(skb, nlh);
510 static int dump_rules(struct sk_buff *skb, struct netlink_callback *cb,
511 struct fib_rules_ops *ops)
514 struct fib_rule *rule;
516 list_for_each_entry(rule, &ops->rules_list, list) {
517 if (idx < cb->args[1])
520 if (fib_nl_fill_rule(skb, rule, NETLINK_CB(cb->skb).pid,
521 cb->nlh->nlmsg_seq, RTM_NEWRULE,
522 NLM_F_MULTI, ops) < 0)
533 static int fib_nl_dumprule(struct sk_buff *skb, struct netlink_callback *cb)
535 struct net *net = skb->sk->sk_net;
536 struct fib_rules_ops *ops;
539 family = rtnl_msg_family(cb->nlh);
540 if (family != AF_UNSPEC) {
541 /* Protocol specific dump request */
542 ops = lookup_rules_ops(net, family);
544 return -EAFNOSUPPORT;
546 return dump_rules(skb, cb, ops);
550 list_for_each_entry_rcu(ops, &net->rules_ops, list) {
551 if (idx < cb->args[0] || !try_module_get(ops->owner))
554 if (dump_rules(skb, cb, ops) < 0)
567 static void notify_rule_change(int event, struct fib_rule *rule,
568 struct fib_rules_ops *ops, struct nlmsghdr *nlh,
576 skb = nlmsg_new(fib_rule_nlmsg_size(ops, rule), GFP_KERNEL);
580 err = fib_nl_fill_rule(skb, rule, pid, nlh->nlmsg_seq, event, 0, ops);
582 /* -EMSGSIZE implies BUG in fib_rule_nlmsg_size() */
583 WARN_ON(err == -EMSGSIZE);
588 err = rtnl_notify(skb, net, pid, ops->nlgroup, nlh, GFP_KERNEL);
591 rtnl_set_sk_err(net, ops->nlgroup, err);
594 static void attach_rules(struct list_head *rules, struct net_device *dev)
596 struct fib_rule *rule;
598 list_for_each_entry(rule, rules, list) {
599 if (rule->ifindex == -1 &&
600 strcmp(dev->name, rule->ifname) == 0)
601 rule->ifindex = dev->ifindex;
605 static void detach_rules(struct list_head *rules, struct net_device *dev)
607 struct fib_rule *rule;
609 list_for_each_entry(rule, rules, list)
610 if (rule->ifindex == dev->ifindex)
615 static int fib_rules_event(struct notifier_block *this, unsigned long event,
618 struct net_device *dev = ptr;
619 struct net *net = dev->nd_net;
620 struct fib_rules_ops *ops;
626 case NETDEV_REGISTER:
627 list_for_each_entry(ops, &net->rules_ops, list)
628 attach_rules(&ops->rules_list, dev);
631 case NETDEV_UNREGISTER:
632 list_for_each_entry(ops, &net->rules_ops, list)
633 detach_rules(&ops->rules_list, dev);
642 static struct notifier_block fib_rules_notifier = {
643 .notifier_call = fib_rules_event,
646 static int fib_rules_net_init(struct net *net)
648 INIT_LIST_HEAD(&net->rules_ops);
649 spin_lock_init(&net->rules_mod_lock);
653 static struct pernet_operations fib_rules_net_ops = {
654 .init = fib_rules_net_init,
657 static int __init fib_rules_init(void)
660 rtnl_register(PF_UNSPEC, RTM_NEWRULE, fib_nl_newrule, NULL);
661 rtnl_register(PF_UNSPEC, RTM_DELRULE, fib_nl_delrule, NULL);
662 rtnl_register(PF_UNSPEC, RTM_GETRULE, NULL, fib_nl_dumprule);
664 err = register_netdevice_notifier(&fib_rules_notifier);
668 err = register_pernet_subsys(&fib_rules_net_ops);
670 goto fail_unregister;
674 unregister_netdevice_notifier(&fib_rules_notifier);
676 rtnl_unregister(PF_UNSPEC, RTM_NEWRULE);
677 rtnl_unregister(PF_UNSPEC, RTM_DELRULE);
678 rtnl_unregister(PF_UNSPEC, RTM_GETRULE);
682 subsys_initcall(fib_rules_init);