Commit b854272b authored by Denis V. Lunev's avatar Denis V. Lunev Committed by David S. Miller
Browse files

[NET]: Modify all rtnetlink methods to only work in the initial namespace (v2) 



Before I can enable rtnetlink to work in all network namespaces I need
to be certain that something won't break.  So this patch deliberately
disables all of the rtnletlink methods in everything except the
initial network namespace.  After the methods have been audited this
extra check can be disabled.

Changes from v1:
- added IPv6 addrlabel protection

Signed-off-by: default avatarDenis V. Lunev <den@openvz.org>
Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent ad5d20a6

net/bridge/br_netlink.c

+9 −0
Original line number Diff line number Diff line
@@ -13,6 +13,7 @@ 
#include <linux/kernel.h>

#include <net/rtnetlink.h>

#include <net/net_namespace.h>

#include <net/sock.h>

#include "br_private.h"



static inline size_t br_nlmsg_size(void)
@@ -107,9 +108,13 @@ errout: 
 */

static int br_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)

{

	struct net *net = skb->sk->sk_net;

	struct net_device *dev;

	int idx;



	if (net != &init_net)

		return 0;



	idx = 0;

	for_each_netdev(&init_net, dev) {

		/* not a bridge port */
@@ -135,12 +140,16 @@ skip: 
 */

static int br_rtm_setlink(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)

{

	struct net *net = skb->sk->sk_net;

	struct ifinfomsg *ifm;

	struct nlattr *protinfo;

	struct net_device *dev;

	struct net_bridge_port *p;

	u8 new_state;



	if (net != &init_net)

		return -EINVAL;



	if (nlmsg_len(nlh) < sizeof(*ifm))

		return -EINVAL;

net/core/fib_rules.c

+11 −0
Original line number Diff line number Diff line
@@ -228,6 +228,9 @@ static int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg) 
	struct nlattr *tb[FRA_MAX+1];

	int err = -EINVAL, unresolved = 0;



	if (net != &init_net)

		return -EINVAL;



	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh)))

		goto errout;
@@ -358,12 +361,16 @@ errout: 


static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)

{

	struct net *net = skb->sk->sk_net;

	struct fib_rule_hdr *frh = nlmsg_data(nlh);

	struct fib_rules_ops *ops = NULL;

	struct fib_rule *rule, *tmp;

	struct nlattr *tb[FRA_MAX+1];

	int err = -EINVAL;



	if (net != &init_net)

		return -EINVAL;



	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh)))

		goto errout;
@@ -539,9 +546,13 @@ skip: 


static int fib_nl_dumprule(struct sk_buff *skb, struct netlink_callback *cb)

{

	struct net *net = skb->sk->sk_net;

	struct fib_rules_ops *ops;

	int idx = 0, family;



	if (net != &init_net)

		return -EINVAL;



	family = rtnl_msg_family(cb->nlh);

	if (family != AF_UNSPEC) {

		/* Protocol specific dump request */

net/core/neighbour.c

+18 −0
Original line number Diff line number Diff line
@@ -1449,6 +1449,9 @@ static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg) 
	struct net_device *dev = NULL;

	int err = -EINVAL;



	if (net != &init_net)

		return -EINVAL;



	if (nlmsg_len(nlh) < sizeof(*ndm))

		goto out;
@@ -1515,6 +1518,9 @@ static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg) 
	struct net_device *dev = NULL;

	int err;



	if (net != &init_net)

		return -EINVAL;



	err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL);

	if (err < 0)

		goto out;
@@ -1789,11 +1795,15 @@ static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = { 


static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)

{

	struct net *net = skb->sk->sk_net;

	struct neigh_table *tbl;

	struct ndtmsg *ndtmsg;

	struct nlattr *tb[NDTA_MAX+1];

	int err;



	if (net != &init_net)

		return -EINVAL;



	err = nlmsg_parse(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,

			  nl_neightbl_policy);

	if (err < 0)
@@ -1913,11 +1923,15 @@ errout: 


static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)

{

	struct net *net = skb->sk->sk_net;

	int family, tidx, nidx = 0;

	int tbl_skip = cb->args[0];

	int neigh_skip = cb->args[1];

	struct neigh_table *tbl;



	if (net != &init_net)

		return 0;



	family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;



	read_lock(&neigh_tbl_lock);
@@ -2042,9 +2056,13 @@ out: 


static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)

{

	struct net *net = skb->sk->sk_net;

	struct neigh_table *tbl;

	int t, family, s_t;



	if (net != &init_net)

		return 0;



	read_lock(&neigh_tbl_lock);

	family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;

	s_t = cb->args[0];

net/core/rtnetlink.c

+19 −0
Original line number Diff line number Diff line
@@ -703,6 +703,9 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb) 
	int s_idx = cb->args[0];

	struct net_device *dev;



	if (net != &init_net)

		return 0;



	idx = 0;

	for_each_netdev(net, dev) {

		if (idx < s_idx)
@@ -905,6 +908,9 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg) 
	struct nlattr *tb[IFLA_MAX+1];

	char ifname[IFNAMSIZ];



	if (net != &init_net)

		return -EINVAL;



	err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFLA_MAX, ifla_policy);

	if (err < 0)

		goto errout;
@@ -953,6 +959,9 @@ static int rtnl_dellink(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg) 
	struct nlattr *tb[IFLA_MAX+1];

	int err;



	if (net != &init_net)

		return -EINVAL;



	err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFLA_MAX, ifla_policy);

	if (err < 0)

		return err;
@@ -1034,6 +1043,9 @@ static int rtnl_newlink(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg) 
	struct nlattr *linkinfo[IFLA_INFO_MAX+1];

	int err;



	if (net != &init_net)

		return -EINVAL;



#ifdef CONFIG_KMOD

replay:

#endif
@@ -1160,6 +1172,9 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg) 
	struct sk_buff *nskb;

	int err;



	if (net != &init_net)

		return -EINVAL;



	err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFLA_MAX, ifla_policy);

	if (err < 0)

		return err;
@@ -1195,9 +1210,13 @@ errout: 


static int rtnl_dump_all(struct sk_buff *skb, struct netlink_callback *cb)

{

	struct net *net = skb->sk->sk_net;

	int idx;

	int s_idx = cb->family;



	if (net != &init_net)

		return 0;



	if (s_idx == 0)

		s_idx = 1;

	for (idx=1; idx<NPROTO; idx++) {

net/decnet/dn_dev.c

+13 −1
Original line number Diff line number Diff line
@@ -647,11 +647,15 @@ static const struct nla_policy dn_ifa_policy[IFA_MAX+1] = { 


static int dn_nl_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)

{

	struct net *net = skb->sk->sk_net;

	struct nlattr *tb[IFA_MAX+1];

	struct dn_dev *dn_db;

	struct ifaddrmsg *ifm;

	struct dn_ifaddr *ifa, **ifap;

	int err;

	int err = -EINVAL;



	if (net != &init_net)

		goto errout;



	err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, dn_ifa_policy);

	if (err < 0)
@@ -681,6 +685,7 @@ errout: 


static int dn_nl_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)

{

	struct net *net = skb->sk->sk_net;

	struct nlattr *tb[IFA_MAX+1];

	struct net_device *dev;

	struct dn_dev *dn_db;
@@ -688,6 +693,9 @@ static int dn_nl_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg) 
	struct dn_ifaddr *ifa;

	int err;



	if (net != &init_net)

		return -EINVAL;



	err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, dn_ifa_policy);

	if (err < 0)

		return err;
@@ -793,11 +801,15 @@ errout: 


static int dn_nl_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)

{

	struct net *net = skb->sk->sk_net;

	int idx, dn_idx = 0, skip_ndevs, skip_naddr;

	struct net_device *dev;

	struct dn_dev *dn_db;

	struct dn_ifaddr *ifa;



	if (net != &init_net)

		return 0;



	skip_ndevs = cb->args[0];

	skip_naddr = cb->args[1];

CRA Git | Maintained and supported by SUSTech CRA and CCSE