net: fib_rules: bring back rule_exists to match rule during add

After commit f9d4b0c1e969 ("fib_rules: move common handling of newrule
delrule msgs into fib_nl2rule"), rule_exists got replaced by rule_find
for existing rule lookup in both the add and del paths. While this
is good for the delete path, it solves a few problems but opens up
a few invalid key matches in the add path.

$ip -4 rule add table main tos 10 fwmark 1
$ip -4 rule add table main tos 10
RTNETLINK answers: File exists

The problem here is rule_find does not check if the key masks in
the new and old rule are the same and hence ends up matching a more
secific rule. Rule key masks cannot be easily compared today without
an elaborate if-else block. Its best to introduce key masks for easier
and accurate rule comparison in the future. Until then, due to fear of
regressions this patch re-introduces older loose rule_exists during add.
Also fixes both rule_exists and rule_find to cover missing attributes.

Fixes: f9d4b0c1e969 ("fib_rules: move common handling of newrule delrule msgs into fib_nl2rule")
Signed-off-by: Roopa Prabhu <roopa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 71 insertions, 1 deletions

diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index bc8425d81022..f64aa13811ea 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -444,6 +444,9 @@ static struct fib_rule *rule_find(struct fib_rules_ops *ops,
                 if (rule->ip_proto && r->ip_proto != rule->ip_proto)
                         continue;
 
+                if (rule->proto && r->proto != rule->proto)
+                        continue;
+
                 if (fib_rule_port_range_set(&rule->sport_range) &&
                     !fib_rule_port_range_compare(&r->sport_range,
                                                  &rule->sport_range))
@@ -653,6 +656,73 @@ errout:
         return err;
 }
 
+static int rule_exists(struct fib_rules_ops *ops, struct fib_rule_hdr *frh,
+                       struct nlattr **tb, struct fib_rule *rule)
+{
+        struct fib_rule *r;
+
+        list_for_each_entry(r, &ops->rules_list, list) {
+                if (r->action != rule->action)
+                        continue;
+
+                if (r->table != rule->table)
+                        continue;
+
+                if (r->pref != rule->pref)
+                        continue;
+
+                if (memcmp(r->iifname, rule->iifname, IFNAMSIZ))
+                        continue;
+
+                if (memcmp(r->oifname, rule->oifname, IFNAMSIZ))
+                        continue;
+
+                if (r->mark != rule->mark)
+                        continue;
+
+                if (r->suppress_ifgroup != rule->suppress_ifgroup)
+                        continue;
+
+                if (r->suppress_prefixlen != rule->suppress_prefixlen)
+                        continue;
+
+                if (r->mark_mask != rule->mark_mask)
+                        continue;
+
+                if (r->tun_id != rule->tun_id)
+                        continue;
+
+                if (r->fr_net != rule->fr_net)
+                        continue;
+
+                if (r->l3mdev != rule->l3mdev)
+                        continue;
+
+                if (!uid_eq(r->uid_range.start, rule->uid_range.start) ||
+                    !uid_eq(r->uid_range.end, rule->uid_range.end))
+                        continue;
+
+                if (r->ip_proto != rule->ip_proto)
+                        continue;
+
+                if (r->proto != rule->proto)
+                        continue;
+
+                if (!fib_rule_port_range_compare(&r->sport_range,
+                                                 &rule->sport_range))
+                        continue;
+
+                if (!fib_rule_port_range_compare(&r->dport_range,
+                                                 &rule->dport_range))
+                        continue;
+
+                if (!ops->compare(r, frh, tb))
+                        continue;
+                return 1;
+        }
+        return 0;
+}
+
 int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,
                    struct netlink_ext_ack *extack)
 {
@@ -687,7 +757,7 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,
                 goto errout;
 
         if ((nlh->nlmsg_flags & NLM_F_EXCL) &&
-            rule_find(ops, frh, tb, rule, user_priority)) {
+            rule_exists(ops, frh, tb, rule)) {
                 err = -EEXIST;
                 goto errout_free;
         }