[PATCH RFC v2 net-next 22/25] net/ipv6: Plumb support for filtering route dumps

[David Ahern]

From: David Ahern <dsah...@gmail.com>

Implement kernel side filtering of routes by table id, egress device index,
protocol, and route type. Move the existing route flags check
for prefix only routes to the new filter.

Signed-off-by: David Ahern <dsah...@gmail.com>
---
 net/ipv6/ip6_fib.c | 13 +++++++++++++
 net/ipv6/route.c   | 36 +++++++++++++++++++++++++++---------
 2 files changed, 40 insertions(+), 9 deletions(-)

diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index e0362a21737f..15b9806270c1 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -613,12 +613,25 @@ static int inet6_dump_fib(struct sk_buff *skb, struct 
netlink_callback *cb)
        w->args = &arg;
 
        rcu_read_lock();
+
+       if (arg.filter.ifindex) {
+               arg.filter.dev = dev_get_by_index_rcu(net, arg.filter.ifindex);
+               if (!arg.filter.dev) {
+                       res = -ENODEV;
+                       goto out;
+               }
+       }
+
        for (h = s_h; h < FIB6_TABLE_HASHSZ; h++, s_e = 0) {
                e = 0;
                head = &net->ipv6.fib_table_hash[h];
                hlist_for_each_entry_rcu(tb, head, tb6_hlist) {
                        if (e < s_e)
                                goto next;
+                       if (arg.filter.table_id &&
+                           arg.filter.table_id != tb->tb6_id)
+                               goto next;
+
                        res = fib6_dump_table(tb, skb, cb);
                        if (res != 0)
                                goto out;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index d28f83e01593..99ba2313c380 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -4792,24 +4792,42 @@ static int rt6_fill_node(struct net *net, struct 
sk_buff *skb,
        return -EMSGSIZE;
 }
 
+static bool fib6_info_uses_dev(const struct fib6_info *f6i,
+                              const struct net_device *dev)
+{
+       if (f6i->fib6_nh.nh_dev == dev)
+               return true;
+
+       if (f6i->fib6_nsiblings) {
+               struct fib6_info *sibling, *next_sibling;
+
+               list_for_each_entry_safe(sibling, next_sibling,
+                                        &f6i->fib6_siblings, fib6_siblings) {
+                       if (sibling->fib6_nh.nh_dev == dev)
+                               return true;
+               }
+       }
+       return false;
+}
+
 int rt6_dump_route(struct fib6_info *rt, void *p_arg)
 {
        struct rt6_rtnl_dump_arg *arg = (struct rt6_rtnl_dump_arg *) p_arg;
+       struct fib_dump_filter *filter = &arg->filter;
        struct net *net = arg->net;
 
        if (rt == net->ipv6.fib6_null_entry)
                return 0;
 
-       if (nlmsg_len(arg->cb->nlh) >= sizeof(struct rtmsg)) {
-               struct rtmsg *rtm = nlmsg_data(arg->cb->nlh);
-
-               /* user wants prefix routes only */
-               if (rtm->rtm_flags & RTM_F_PREFIX &&
-                   !(rt->fib6_flags & RTF_PREFIX_RT)) {
-                       /* success since this is not a prefix route */
-                       return 1;
-               }
+       if ((filter->flags & RTM_F_PREFIX) &&
+           !(rt->fib6_flags & RTF_PREFIX_RT)) {
+               /* success since this is not a prefix route */
+               return 1;
        }
+       if ((filter->protocol && rt->fib6_protocol != filter->protocol) ||
+           (filter->rt_type && rt->fib6_type != filter->rt_type) ||
+           (filter->dev && !fib6_info_uses_dev(rt, filter->dev)))
+               return 1;
 
        return rt6_fill_node(net, arg->skb, rt, NULL, NULL, NULL, 0,
                             RTM_NEWROUTE, NETLINK_CB(arg->cb->skb).portid,
-- 
2.11.0