Commit 35e8c7ba authored by Roopa Prabhu's avatar Roopa Prabhu Committed by David S. Miller

net: fib_rules: bring back rule_exists to match rule during add

After commit f9d4b0c1 ("fib_rules: move common handling of newrule
delrule msgs into fib_nl2rule"), rule_exists got replaced by rule_find
for existing rule lookup in both the add and del paths. While this
is good for the delete path, it solves a few problems but opens up
a few invalid key matches in the add path.

$ip -4 rule add table main tos 10 fwmark 1
$ip -4 rule add table main tos 10
RTNETLINK answers: File exists

The problem here is rule_find does not check if the key masks in
the new and old rule are the same and hence ends up matching a more
secific rule. Rule key masks cannot be easily compared today without
an elaborate if-else block. Its best to introduce key masks for easier
and accurate rule comparison in the future. Until then, due to fear of
regressions this patch re-introduces older loose rule_exists during add.
Also fixes both rule_exists and rule_find to cover missing attributes.

Fixes: f9d4b0c1 ("fib_rules: move common handling of newrule delrule msgs into fib_nl2rule")
Signed-off-by: default avatarRoopa Prabhu <roopa@cumulusnetworks.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 3ffe64f1
......@@ -444,6 +444,9 @@ static struct fib_rule *rule_find(struct fib_rules_ops *ops,
if (rule->ip_proto && r->ip_proto != rule->ip_proto)
continue;
if (rule->proto && r->proto != rule->proto)
continue;
if (fib_rule_port_range_set(&rule->sport_range) &&
!fib_rule_port_range_compare(&r->sport_range,
&rule->sport_range))
......@@ -653,6 +656,73 @@ static int fib_nl2rule(struct sk_buff *skb, struct nlmsghdr *nlh,
return err;
}
static int rule_exists(struct fib_rules_ops *ops, struct fib_rule_hdr *frh,
struct nlattr **tb, struct fib_rule *rule)
{
struct fib_rule *r;
list_for_each_entry(r, &ops->rules_list, list) {
if (r->action != rule->action)
continue;
if (r->table != rule->table)
continue;
if (r->pref != rule->pref)
continue;
if (memcmp(r->iifname, rule->iifname, IFNAMSIZ))
continue;
if (memcmp(r->oifname, rule->oifname, IFNAMSIZ))
continue;
if (r->mark != rule->mark)
continue;
if (r->suppress_ifgroup != rule->suppress_ifgroup)
continue;
if (r->suppress_prefixlen != rule->suppress_prefixlen)
continue;
if (r->mark_mask != rule->mark_mask)
continue;
if (r->tun_id != rule->tun_id)
continue;
if (r->fr_net != rule->fr_net)
continue;
if (r->l3mdev != rule->l3mdev)
continue;
if (!uid_eq(r->uid_range.start, rule->uid_range.start) ||
!uid_eq(r->uid_range.end, rule->uid_range.end))
continue;
if (r->ip_proto != rule->ip_proto)
continue;
if (r->proto != rule->proto)
continue;
if (!fib_rule_port_range_compare(&r->sport_range,
&rule->sport_range))
continue;
if (!fib_rule_port_range_compare(&r->dport_range,
&rule->dport_range))
continue;
if (!ops->compare(r, frh, tb))
continue;
return 1;
}
return 0;
}
int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,
struct netlink_ext_ack *extack)
{
......@@ -687,7 +757,7 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,
goto errout;
if ((nlh->nlmsg_flags & NLM_F_EXCL) &&
rule_find(ops, frh, tb, rule, user_priority)) {
rule_exists(ops, frh, tb, rule)) {
err = -EEXIST;
goto errout_free;
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment