renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-05 03:44:03 +08:00
Code

rtnetlink: require unique netns identifier

Browse Source 
Since we've added support for IFLA_IF_NETNSID for RTM_{DEL,GET,SET,NEW}LINK
it is possible for userspace to send us requests with three different
properties to identify a target network namespace. This affects at least
RTM_{NEW,SET}LINK. Each of them could potentially refer to a different
network namespace which is confusing. For legacy reasons the kernel will
pick the IFLA_NET_NS_PID property first and then look for the
IFLA_NET_NS_FD property but there is no reason to extend this type of
behavior to network namespace ids. The regression potential is quite
minimal since the rtnetlink requests in question either won't allow
IFLA_IF_NETNSID requests before 4.16 is out (RTM_{NEW,SET}LINK) or don't
support IFLA_NET_NS_{PID,FD} (RTM_{DEL,GET}LINK) in the first place.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Acked-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Christian Brauner 2018-02-07 13:53:20 +01:00 committed by David S. Miller
parent 762c330d67
commit 4ff66cae7f
1 changed files with 48 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
net/core/rtnetlink.c
View File

@ -1951,6 +1951,38 @@ static struct net *rtnl_link_get_net_capable(const struct sk_buff *skb,
return net; return net;
} }
/* Verify that rtnetlink requests do not pass additional properties
* potentially referring to different network namespaces.
*/
static int rtnl_ensure_unique_netns(struct nlattr *tb[],
struct netlink_ext_ack *extack,
bool netns_id_only)
{
if (netns_id_only) {
if (!tb[IFLA_NET_NS_PID] && !tb[IFLA_NET_NS_FD])
return 0;
NL_SET_ERR_MSG(extack, "specified netns attribute not supported");
return -EOPNOTSUPP;
}
if (tb[IFLA_IF_NETNSID] && (tb[IFLA_NET_NS_PID] || tb[IFLA_NET_NS_FD]))
goto invalid_attr;
if (tb[IFLA_NET_NS_PID] && (tb[IFLA_IF_NETNSID] || tb[IFLA_NET_NS_FD]))
goto invalid_attr;
if (tb[IFLA_NET_NS_FD] && (tb[IFLA_IF_NETNSID] || tb[IFLA_NET_NS_PID]))
goto invalid_attr;
return 0;
invalid_attr:
NL_SET_ERR_MSG(extack, "multiple netns identifying attributes specified");
return -EINVAL;
}
static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[]) static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[])
{ {
if (dev) { if (dev) {
@ -2553,6 +2585,10 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh,
if (err < 0) if (err < 0)
goto errout; goto errout;
err = rtnl_ensure_unique_netns(tb, extack, false);
if (err < 0)
goto errout;
if (tb[IFLA_IFNAME]) if (tb[IFLA_IFNAME])
nla_strlcpy(ifname, tb[IFLA_IFNAME], IFNAMSIZ); nla_strlcpy(ifname, tb[IFLA_IFNAME], IFNAMSIZ);
else else
@ -2649,6 +2685,10 @@ static int rtnl_dellink(struct sk_buff *skb, struct nlmsghdr *nlh,
if (err < 0) if (err < 0)
return err; return err;
err = rtnl_ensure_unique_netns(tb, extack, true);
if (err < 0)
return err;
if (tb[IFLA_IFNAME]) if (tb[IFLA_IFNAME])
nla_strlcpy(ifname, tb[IFLA_IFNAME], IFNAMSIZ); nla_strlcpy(ifname, tb[IFLA_IFNAME], IFNAMSIZ);
@ -2802,6 +2842,10 @@ replay:
if (err < 0) if (err < 0)
return err; return err;
err = rtnl_ensure_unique_netns(tb, extack, false);
if (err < 0)
return err;
if (tb[IFLA_IFNAME]) if (tb[IFLA_IFNAME])
nla_strlcpy(ifname, tb[IFLA_IFNAME], IFNAMSIZ); nla_strlcpy(ifname, tb[IFLA_IFNAME], IFNAMSIZ);
else else
@ -3045,6 +3089,10 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr *nlh,
if (err < 0) if (err < 0)
return err; return err;
err = rtnl_ensure_unique_netns(tb, extack, true);
if (err < 0)
return err;
if (tb[IFLA_IF_NETNSID]) { if (tb[IFLA_IF_NETNSID]) {
netnsid = nla_get_s32(tb[IFLA_IF_NETNSID]); netnsid = nla_get_s32(tb[IFLA_IF_NETNSID]);
tgt_net = get_target_net(NETLINK_CB(skb).sk, netnsid); tgt_net = get_target_net(NETLINK_CB(skb).sk, netnsid);