netdev - [PATCH v2] add prefixlength option to "ip rule"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20130801083256.GQ10550@zirkel.wertarbyte.de>
Date:	Thu, 1 Aug 2013 10:32:56 +0200
From:	Stefan Tomanek <stefan.tomanek@...tarbyte.de>
To:	netdev@...r.kernel.org
Subject: [PATCH v2] add prefixlength option to "ip rule"

When configuring a system with multiple network uplinks and default routes, it
is often convenient to reference the main routing table multiple times - but
omitting the default route. Using this modified "ip" utility and the
corresponding kernel patch, this can be achieved by using the following command
sequence:

$ ip route add table secuplink default via 10.42.23.1

$ ip rule add pref 100            table main prefixlength 1
$ ip rule add pref 150 fwmark 0xA table secuplink

With this setup, packets marked 0xA will be processed by the additional routing
table "secuplink", but only if no suitable route in the main routing table can
be found. By using a minimum prefixlength of 1, the default route (/0) of the
table "main" is hidden to packets processed by rule 100; packets traveling to
destinations via more specific routes are processed as usual.

Signed-off-by: Stefan Tomanek <stefan.tomanek@...tarbyte.de>
---
 include/linux/fib_rules.h |    2 +-
 ip/iprule.c               |   19 +++++++++++++++++--
 man/man8/ip-rule.8        |   12 ++++++++++++
 3 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/include/linux/fib_rules.h b/include/linux/fib_rules.h
index 51da65b..59cd31b 100644
--- a/include/linux/fib_rules.h
+++ b/include/linux/fib_rules.h
@@ -45,7 +45,7 @@ enum {
 	FRA_FLOW,	/* flow/class id */
 	FRA_UNUSED6,
 	FRA_UNUSED7,
-	FRA_UNUSED8,
+	FRA_TABLE_PREFIXLEN_MIN,
 	FRA_TABLE,	/* Extended table id */
 	FRA_FWMASK,	/* mask for netfilter mark */
 	FRA_OIFNAME,
diff --git a/ip/iprule.c b/ip/iprule.c
index a5fcd43..a789863 100644
--- a/ip/iprule.c
+++ b/ip/iprule.c
@@ -39,6 +39,8 @@ static void usage(void)
 	fprintf(stderr, "          [ prohibit | reject | unreachable ]\n");
 	fprintf(stderr, "          [ realms [SRCREALM/]DSTREALM ]\n");
 	fprintf(stderr, "          [ goto NUMBER ]\n");
+	fprintf(stderr, "          SUPPRESSOR\n");
+	fprintf(stderr, "SUPPRESSOR := [ prefixlength NUMBER ]\n");
 	fprintf(stderr, "TABLE_ID := [ local | main | default | NUMBER ]\n");
 	exit(-1);
 }
@@ -153,9 +155,15 @@ int print_rule(const struct sockaddr_nl *who, struct nlmsghdr *n, void *arg)
 	}
 
 	table = rtm_get_table(r, tb);
-	if (table)
+	if (table) {
 		fprintf(fp, "lookup %s ", rtnl_rttable_n2a(table, b1, sizeof(b1)));
-
+		if (tb[FRA_TABLE_PREFIXLEN_MIN]) {
+			__u8 pl = rta_getattr_u8(tb[FRA_TABLE_PREFIXLEN_MIN]);
+			if (pl) {
+				fprintf(fp, "prefixlength %u ", pl);
+			}
+		}
+	}
 	if (tb[FRA_FLOW]) {
 		__u32 to = rta_getattr_u32(tb[FRA_FLOW]);
 		__u32 from = to>>16;
@@ -310,6 +318,13 @@ static int iprule_modify(int cmd, int argc, char **argv)
 				addattr32(&req.n, sizeof(req), FRA_TABLE, tid);
 			}
 			table_ok = 1;
+		} else if (matches(*argv, "prefixlength") == 0 ||
+			   strcmp(*argv, "pl") == 0) {
+			__u8 pl;
+			NEXT_ARG();
+			if (get_u8(&pl, *argv, 0))
+				invarg("prefixlength value is invalid\n", *argv);
+			addattr8(&req.n, sizeof(req), FRA_TABLE_PREFIXLEN_MIN, pl);
 		} else if (strcmp(*argv, "dev") == 0 ||
 			   strcmp(*argv, "iif") == 0) {
 			NEXT_ARG();
diff --git a/man/man8/ip-rule.8 b/man/man8/ip-rule.8
index 36e46f1..ad48f6e 100644
--- a/man/man8/ip-rule.8
+++ b/man/man8/ip-rule.8
@@ -43,6 +43,12 @@ ip-rule \- routing policy database management
 .IR ADDRESS " ] [ "
 .BR prohibit " | " reject " | " unreachable " ] [ " realms
 .RI "[" SRCREALM "/]" DSTREALM " ]"
+.I  SUPPRESSOR
+
+.ti -8
+.IR SUPPRESSOR " := [ "
+.B  prefixlength
+.IR NUMBER " ]"
 
 .ti -8
 .IR TABLE_ID " := [ "
@@ -217,6 +223,12 @@ the routing table identifier to lookup if the rule selector matches.
 It is also possible to use lookup instead of table.
 
 .TP
+.BI prefixlength " NUMBER"
+only consider routes that have a minimum prefix length of NUMBER.
+Entries inside the referenced table with a lower prefix length
+will be ignored.
+
+.TP
 .BI realms " FROM/TO"
 Realms to select if the rule matched and the routing table lookup
 succeeded.  Realm
-- 
1.7.10.4
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html