Commit 35e8c7ba authored by Roopa Prabhu's avatar Roopa Prabhu Committed by David S. Miller
Browse files

net: fib_rules: bring back rule_exists to match rule during add 



After commit f9d4b0c1 ("fib_rules: move common handling of newrule
delrule msgs into fib_nl2rule"), rule_exists got replaced by rule_find
for existing rule lookup in both the add and del paths. While this
is good for the delete path, it solves a few problems but opens up
a few invalid key matches in the add path.

$ip -4 rule add table main tos 10 fwmark 1
$ip -4 rule add table main tos 10
RTNETLINK answers: File exists

The problem here is rule_find does not check if the key masks in
the new and old rule are the same and hence ends up matching a more
secific rule. Rule key masks cannot be easily compared today without
an elaborate if-else block. Its best to introduce key masks for easier
and accurate rule comparison in the future. Until then, due to fear of
regressions this patch re-introduces older loose rule_exists during add.
Also fixes both rule_exists and rule_find to cover missing attributes.

Fixes: f9d4b0c1 ("fib_rules: move common handling of newrule delrule msgs into fib_nl2rule")
Signed-off-by: default avatarRoopa Prabhu <roopa@cumulusnetworks.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 3ffe64f1

net/core/fib_rules.c

+71 −1
Original line number Diff line number Diff line
@@ -444,6 +444,9 @@ static struct fib_rule *rule_find(struct fib_rules_ops *ops, 
		if (rule->ip_proto && r->ip_proto != rule->ip_proto)

			continue;



		if (rule->proto && r->proto != rule->proto)

			continue;



		if (fib_rule_port_range_set(&rule->sport_range) &&

		    !fib_rule_port_range_compare(&r->sport_range,

						 &rule->sport_range))
@@ -653,6 +656,73 @@ errout: 
	return err;

}



static int rule_exists(struct fib_rules_ops *ops, struct fib_rule_hdr *frh,

		       struct nlattr **tb, struct fib_rule *rule)

{

	struct fib_rule *r;



	list_for_each_entry(r, &ops->rules_list, list) {

		if (r->action != rule->action)

			continue;



		if (r->table != rule->table)

			continue;



		if (r->pref != rule->pref)

			continue;



		if (memcmp(r->iifname, rule->iifname, IFNAMSIZ))

			continue;



		if (memcmp(r->oifname, rule->oifname, IFNAMSIZ))

			continue;



		if (r->mark != rule->mark)

			continue;



		if (r->suppress_ifgroup != rule->suppress_ifgroup)

			continue;



		if (r->suppress_prefixlen != rule->suppress_prefixlen)

			continue;



		if (r->mark_mask != rule->mark_mask)

			continue;



		if (r->tun_id != rule->tun_id)

			continue;



		if (r->fr_net != rule->fr_net)

			continue;



		if (r->l3mdev != rule->l3mdev)

			continue;



		if (!uid_eq(r->uid_range.start, rule->uid_range.start) ||

		    !uid_eq(r->uid_range.end, rule->uid_range.end))

			continue;



		if (r->ip_proto != rule->ip_proto)

			continue;



		if (r->proto != rule->proto)

			continue;



		if (!fib_rule_port_range_compare(&r->sport_range,

						 &rule->sport_range))

			continue;



		if (!fib_rule_port_range_compare(&r->dport_range,

						 &rule->dport_range))

			continue;



		if (!ops->compare(r, frh, tb))

			continue;

		return 1;

	}

	return 0;

}



int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,

		   struct netlink_ext_ack *extack)

{
@@ -687,7 +757,7 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh, 
		goto errout;



	if ((nlh->nlmsg_flags & NLM_F_EXCL) &&

	    rule_find(ops, frh, tb, rule, user_priority)) {

	    rule_exists(ops, frh, tb, rule)) {

		err = -EEXIST;

		goto errout_free;

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE