fib_rules: fix suppressor names and default values
This change brings the suppressor attribute names into line; it also changes the data types to provide a more consistent interface. While -1 indicates that the suppressor is not enabled, values >= 0 for suppress_prefixlen or suppress_ifgroup reject routing decisions violating the constraint. This changes the previously presented behaviour of suppress_prefixlen, where a prefix length _less_ than the attribute value was rejected. After this change, a prefix length less than *or* equal to the value is considered a violation of the rule constraint. It also changes the default values for default and newly added rules (disabling any suppression for those). Signed-off-by: Stefan Tomanek <stefan.tomanek@wertarbyte.de> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
0c0667a854
commit
73f5698e77
|
@ -19,7 +19,7 @@ struct fib_rule {
|
||||||
u32 flags;
|
u32 flags;
|
||||||
u32 table;
|
u32 table;
|
||||||
int suppress_ifgroup;
|
int suppress_ifgroup;
|
||||||
u8 table_prefixlen_min;
|
int suppress_prefixlen;
|
||||||
u8 action;
|
u8 action;
|
||||||
u32 target;
|
u32 target;
|
||||||
struct fib_rule __rcu *ctarget;
|
struct fib_rule __rcu *ctarget;
|
||||||
|
@ -84,7 +84,7 @@ struct fib_rules_ops {
|
||||||
[FRA_FWMARK] = { .type = NLA_U32 }, \
|
[FRA_FWMARK] = { .type = NLA_U32 }, \
|
||||||
[FRA_FWMASK] = { .type = NLA_U32 }, \
|
[FRA_FWMASK] = { .type = NLA_U32 }, \
|
||||||
[FRA_TABLE] = { .type = NLA_U32 }, \
|
[FRA_TABLE] = { .type = NLA_U32 }, \
|
||||||
[FRA_TABLE_PREFIXLEN_MIN] = { .type = NLA_U8 }, \
|
[FRA_SUPPRESS_PREFIXLEN] = { .type = NLA_U32 }, \
|
||||||
[FRA_SUPPRESS_IFGROUP] = { .type = NLA_U32 }, \
|
[FRA_SUPPRESS_IFGROUP] = { .type = NLA_U32 }, \
|
||||||
[FRA_GOTO] = { .type = NLA_U32 }
|
[FRA_GOTO] = { .type = NLA_U32 }
|
||||||
|
|
||||||
|
|
|
@ -45,7 +45,7 @@ enum {
|
||||||
FRA_FLOW, /* flow/class id */
|
FRA_FLOW, /* flow/class id */
|
||||||
FRA_UNUSED6,
|
FRA_UNUSED6,
|
||||||
FRA_SUPPRESS_IFGROUP,
|
FRA_SUPPRESS_IFGROUP,
|
||||||
FRA_TABLE_PREFIXLEN_MIN,
|
FRA_SUPPRESS_PREFIXLEN,
|
||||||
FRA_TABLE, /* Extended table id */
|
FRA_TABLE, /* Extended table id */
|
||||||
FRA_FWMASK, /* mask for netfilter mark */
|
FRA_FWMASK, /* mask for netfilter mark */
|
||||||
FRA_OIFNAME,
|
FRA_OIFNAME,
|
||||||
|
|
|
@ -33,6 +33,9 @@ int fib_default_rule_add(struct fib_rules_ops *ops,
|
||||||
r->flags = flags;
|
r->flags = flags;
|
||||||
r->fr_net = hold_net(ops->fro_net);
|
r->fr_net = hold_net(ops->fro_net);
|
||||||
|
|
||||||
|
r->suppress_prefixlen = -1;
|
||||||
|
r->suppress_ifgroup = -1;
|
||||||
|
|
||||||
/* The lock is not required here, the list in unreacheable
|
/* The lock is not required here, the list in unreacheable
|
||||||
* at the moment this function is called */
|
* at the moment this function is called */
|
||||||
list_add_tail(&r->list, &ops->rules_list);
|
list_add_tail(&r->list, &ops->rules_list);
|
||||||
|
@ -340,11 +343,15 @@ static int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh)
|
||||||
rule->action = frh->action;
|
rule->action = frh->action;
|
||||||
rule->flags = frh->flags;
|
rule->flags = frh->flags;
|
||||||
rule->table = frh_get_table(frh, tb);
|
rule->table = frh_get_table(frh, tb);
|
||||||
if (tb[FRA_TABLE_PREFIXLEN_MIN])
|
if (tb[FRA_SUPPRESS_PREFIXLEN])
|
||||||
rule->table_prefixlen_min = nla_get_u8(tb[FRA_TABLE_PREFIXLEN_MIN]);
|
rule->suppress_prefixlen = nla_get_u32(tb[FRA_SUPPRESS_PREFIXLEN]);
|
||||||
|
else
|
||||||
|
rule->suppress_prefixlen = -1;
|
||||||
|
|
||||||
if (tb[FRA_SUPPRESS_IFGROUP])
|
if (tb[FRA_SUPPRESS_IFGROUP])
|
||||||
rule->suppress_ifgroup = nla_get_u32(tb[FRA_SUPPRESS_IFGROUP]);
|
rule->suppress_ifgroup = nla_get_u32(tb[FRA_SUPPRESS_IFGROUP]);
|
||||||
|
else
|
||||||
|
rule->suppress_ifgroup = -1;
|
||||||
|
|
||||||
if (!tb[FRA_PRIORITY] && ops->default_pref)
|
if (!tb[FRA_PRIORITY] && ops->default_pref)
|
||||||
rule->pref = ops->default_pref(ops);
|
rule->pref = ops->default_pref(ops);
|
||||||
|
@ -531,7 +538,7 @@ static inline size_t fib_rule_nlmsg_size(struct fib_rules_ops *ops,
|
||||||
+ nla_total_size(IFNAMSIZ) /* FRA_OIFNAME */
|
+ nla_total_size(IFNAMSIZ) /* FRA_OIFNAME */
|
||||||
+ nla_total_size(4) /* FRA_PRIORITY */
|
+ nla_total_size(4) /* FRA_PRIORITY */
|
||||||
+ nla_total_size(4) /* FRA_TABLE */
|
+ nla_total_size(4) /* FRA_TABLE */
|
||||||
+ nla_total_size(1) /* FRA_TABLE_PREFIXLEN_MIN */
|
+ nla_total_size(4) /* FRA_SUPPRESS_PREFIXLEN */
|
||||||
+ nla_total_size(4) /* FRA_SUPPRESS_IFGROUP */
|
+ nla_total_size(4) /* FRA_SUPPRESS_IFGROUP */
|
||||||
+ nla_total_size(4) /* FRA_FWMARK */
|
+ nla_total_size(4) /* FRA_FWMARK */
|
||||||
+ nla_total_size(4); /* FRA_FWMASK */
|
+ nla_total_size(4); /* FRA_FWMASK */
|
||||||
|
@ -558,7 +565,7 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
|
||||||
frh->table = rule->table;
|
frh->table = rule->table;
|
||||||
if (nla_put_u32(skb, FRA_TABLE, rule->table))
|
if (nla_put_u32(skb, FRA_TABLE, rule->table))
|
||||||
goto nla_put_failure;
|
goto nla_put_failure;
|
||||||
if (nla_put_u8(skb, FRA_TABLE_PREFIXLEN_MIN, rule->table_prefixlen_min))
|
if (nla_put_u32(skb, FRA_SUPPRESS_PREFIXLEN, rule->suppress_prefixlen))
|
||||||
goto nla_put_failure;
|
goto nla_put_failure;
|
||||||
frh->res1 = 0;
|
frh->res1 = 0;
|
||||||
frh->res2 = 0;
|
frh->res2 = 0;
|
||||||
|
|
|
@ -109,7 +109,7 @@ static bool fib4_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg
|
||||||
/* do not accept result if the route does
|
/* do not accept result if the route does
|
||||||
* not meet the required prefix length
|
* not meet the required prefix length
|
||||||
*/
|
*/
|
||||||
if (result->prefixlen < rule->table_prefixlen_min)
|
if (result->prefixlen <= rule->suppress_prefixlen)
|
||||||
goto suppress_route;
|
goto suppress_route;
|
||||||
|
|
||||||
/* do not accept result if the route uses a device
|
/* do not accept result if the route uses a device
|
||||||
|
|
|
@ -126,7 +126,7 @@ static bool fib6_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg
|
||||||
/* do not accept result if the route does
|
/* do not accept result if the route does
|
||||||
* not meet the required prefix length
|
* not meet the required prefix length
|
||||||
*/
|
*/
|
||||||
if (rt->rt6i_dst.plen < rule->table_prefixlen_min)
|
if (rt->rt6i_dst.plen <= rule->suppress_prefixlen)
|
||||||
goto suppress_route;
|
goto suppress_route;
|
||||||
|
|
||||||
/* do not accept result if the route uses a device
|
/* do not accept result if the route uses a device
|
||||||
|
|
Loading…
Reference in a new issue