Commit cc3ec656 authored by David S. Miller's avatar David S. Miller

Merge branch 'net-nsid-interpretation'

Nicolas Dichtel says:

====================
Ease to interpret net-nsid

The goal of this series is to ease the interpretation of nsid received in
netlink messages from other netns (when the user uses
NETLINK_F_LISTEN_ALL_NSID).

After this series, with a patched iproute2:

$ ip netns add foo
$ ip netns add bar
$ touch /var/run/netns/init_net
$ mount --bind /proc/1/ns/net /var/run/netns/init_net
$ ip netns set init_net 11
$ ip netns set foo 12
$ ip netns set bar 13
$ ip netns
init_net (id: 11)
bar (id: 13)
foo (id: 12)
$ ip -n foo netns set init_net 21
$ ip -n foo netns set foo 22
$ ip -n foo netns set bar 23
$ ip -n foo netns
init_net (id: 21)
bar (id: 23)
foo (id: 22)
$ ip -n bar netns set init_net 31
$ ip -n bar netns set foo 32
$ ip -n bar netns set bar 33
$ ip -n bar netns
init_net (id: 31)
bar (id: 33)
foo (id: 32)
$ ip netns list-id target-nsid 12
nsid 21 current-nsid 11 (iproute2 netns name: init_net)
nsid 22 current-nsid 12 (iproute2 netns name: foo)
nsid 23 current-nsid 13 (iproute2 netns name: bar)
$ ip -n bar netns list-id target-nsid 32 nsid 31
nsid 21 current-nsid 31 (iproute2 netns name: init_net)

v3 -> v4:
  - patch 5/5: fix imbalance lock in error path

v2 -> v3:
  - patch 5/5: account NETNSA_CURRENT_NSID in rtnl_net_get_size()

v1 -> v2:
  - patch 1/5: remove net from struct rtnl_net_dump_cb
  - patch 2/5: new in this version
  - patch 3/5: use a bool to know if rtnl_get_net_ns_capable() was called
  - patch 5/5: use struct net_fill_args
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 3251a2ff 288f06a0
...@@ -16,6 +16,8 @@ enum { ...@@ -16,6 +16,8 @@ enum {
NETNSA_NSID, NETNSA_NSID,
NETNSA_PID, NETNSA_PID,
NETNSA_FD, NETNSA_FD,
NETNSA_TARGET_NSID,
NETNSA_CURRENT_NSID,
__NETNSA_MAX, __NETNSA_MAX,
}; };
......
...@@ -669,6 +669,7 @@ static const struct nla_policy rtnl_net_policy[NETNSA_MAX + 1] = { ...@@ -669,6 +669,7 @@ static const struct nla_policy rtnl_net_policy[NETNSA_MAX + 1] = {
[NETNSA_NSID] = { .type = NLA_S32 }, [NETNSA_NSID] = { .type = NLA_S32 },
[NETNSA_PID] = { .type = NLA_U32 }, [NETNSA_PID] = { .type = NLA_U32 },
[NETNSA_FD] = { .type = NLA_U32 }, [NETNSA_FD] = { .type = NLA_U32 },
[NETNSA_TARGET_NSID] = { .type = NLA_S32 },
}; };
static int rtnl_net_newid(struct sk_buff *skb, struct nlmsghdr *nlh, static int rtnl_net_newid(struct sk_buff *skb, struct nlmsghdr *nlh,
...@@ -735,23 +736,38 @@ static int rtnl_net_get_size(void) ...@@ -735,23 +736,38 @@ static int rtnl_net_get_size(void)
{ {
return NLMSG_ALIGN(sizeof(struct rtgenmsg)) return NLMSG_ALIGN(sizeof(struct rtgenmsg))
+ nla_total_size(sizeof(s32)) /* NETNSA_NSID */ + nla_total_size(sizeof(s32)) /* NETNSA_NSID */
+ nla_total_size(sizeof(s32)) /* NETNSA_CURRENT_NSID */
; ;
} }
static int rtnl_net_fill(struct sk_buff *skb, u32 portid, u32 seq, int flags, struct net_fill_args {
int cmd, struct net *net, int nsid) u32 portid;
u32 seq;
int flags;
int cmd;
int nsid;
bool add_ref;
int ref_nsid;
};
static int rtnl_net_fill(struct sk_buff *skb, struct net_fill_args *args)
{ {
struct nlmsghdr *nlh; struct nlmsghdr *nlh;
struct rtgenmsg *rth; struct rtgenmsg *rth;
nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rth), flags); nlh = nlmsg_put(skb, args->portid, args->seq, args->cmd, sizeof(*rth),
args->flags);
if (!nlh) if (!nlh)
return -EMSGSIZE; return -EMSGSIZE;
rth = nlmsg_data(nlh); rth = nlmsg_data(nlh);
rth->rtgen_family = AF_UNSPEC; rth->rtgen_family = AF_UNSPEC;
if (nla_put_s32(skb, NETNSA_NSID, nsid)) if (nla_put_s32(skb, NETNSA_NSID, args->nsid))
goto nla_put_failure;
if (args->add_ref &&
nla_put_s32(skb, NETNSA_CURRENT_NSID, args->ref_nsid))
goto nla_put_failure; goto nla_put_failure;
nlmsg_end(skb, nlh); nlmsg_end(skb, nlh);
...@@ -767,10 +783,15 @@ static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh, ...@@ -767,10 +783,15 @@ static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh,
{ {
struct net *net = sock_net(skb->sk); struct net *net = sock_net(skb->sk);
struct nlattr *tb[NETNSA_MAX + 1]; struct nlattr *tb[NETNSA_MAX + 1];
struct net_fill_args fillargs = {
.portid = NETLINK_CB(skb).portid,
.seq = nlh->nlmsg_seq,
.cmd = RTM_NEWNSID,
};
struct net *peer, *target = net;
struct nlattr *nla; struct nlattr *nla;
struct sk_buff *msg; struct sk_buff *msg;
struct net *peer; int err;
int err, id;
err = nlmsg_parse(nlh, sizeof(struct rtgenmsg), tb, NETNSA_MAX, err = nlmsg_parse(nlh, sizeof(struct rtgenmsg), tb, NETNSA_MAX,
rtnl_net_policy, extack); rtnl_net_policy, extack);
...@@ -782,6 +803,11 @@ static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh, ...@@ -782,6 +803,11 @@ static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh,
} else if (tb[NETNSA_FD]) { } else if (tb[NETNSA_FD]) {
peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD])); peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD]));
nla = tb[NETNSA_FD]; nla = tb[NETNSA_FD];
} else if (tb[NETNSA_NSID]) {
peer = get_net_ns_by_id(net, nla_get_u32(tb[NETNSA_NSID]));
if (!peer)
peer = ERR_PTR(-ENOENT);
nla = tb[NETNSA_NSID];
} else { } else {
NL_SET_ERR_MSG(extack, "Peer netns reference is missing"); NL_SET_ERR_MSG(extack, "Peer netns reference is missing");
return -EINVAL; return -EINVAL;
...@@ -793,15 +819,29 @@ static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh, ...@@ -793,15 +819,29 @@ static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh,
return PTR_ERR(peer); return PTR_ERR(peer);
} }
if (tb[NETNSA_TARGET_NSID]) {
int id = nla_get_s32(tb[NETNSA_TARGET_NSID]);
target = rtnl_get_net_ns_capable(NETLINK_CB(skb).sk, id);
if (IS_ERR(target)) {
NL_SET_BAD_ATTR(extack, tb[NETNSA_TARGET_NSID]);
NL_SET_ERR_MSG(extack,
"Target netns reference is invalid");
err = PTR_ERR(target);
goto out;
}
fillargs.add_ref = true;
fillargs.ref_nsid = peernet2id(net, peer);
}
msg = nlmsg_new(rtnl_net_get_size(), GFP_KERNEL); msg = nlmsg_new(rtnl_net_get_size(), GFP_KERNEL);
if (!msg) { if (!msg) {
err = -ENOMEM; err = -ENOMEM;
goto out; goto out;
} }
id = peernet2id(net, peer); fillargs.nsid = peernet2id(target, peer);
err = rtnl_net_fill(msg, NETLINK_CB(skb).portid, nlh->nlmsg_seq, 0, err = rtnl_net_fill(msg, &fillargs);
RTM_NEWNSID, net, id);
if (err < 0) if (err < 0)
goto err_out; goto err_out;
...@@ -811,14 +851,17 @@ static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh, ...@@ -811,14 +851,17 @@ static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh,
err_out: err_out:
nlmsg_free(msg); nlmsg_free(msg);
out: out:
if (fillargs.add_ref)
put_net(target);
put_net(peer); put_net(peer);
return err; return err;
} }
struct rtnl_net_dump_cb { struct rtnl_net_dump_cb {
struct net *net; struct net *tgt_net;
struct net *ref_net;
struct sk_buff *skb; struct sk_buff *skb;
struct netlink_callback *cb; struct net_fill_args fillargs;
int idx; int idx;
int s_idx; int s_idx;
}; };
...@@ -831,9 +874,10 @@ static int rtnl_net_dumpid_one(int id, void *peer, void *data) ...@@ -831,9 +874,10 @@ static int rtnl_net_dumpid_one(int id, void *peer, void *data)
if (net_cb->idx < net_cb->s_idx) if (net_cb->idx < net_cb->s_idx)
goto cont; goto cont;
ret = rtnl_net_fill(net_cb->skb, NETLINK_CB(net_cb->cb->skb).portid, net_cb->fillargs.nsid = id;
net_cb->cb->nlh->nlmsg_seq, NLM_F_MULTI, if (net_cb->fillargs.add_ref)
RTM_NEWNSID, net_cb->net, id); net_cb->fillargs.ref_nsid = __peernet2id(net_cb->ref_net, peer);
ret = rtnl_net_fill(net_cb->skb, &net_cb->fillargs);
if (ret < 0) if (ret < 0)
return ret; return ret;
...@@ -842,33 +886,96 @@ static int rtnl_net_dumpid_one(int id, void *peer, void *data) ...@@ -842,33 +886,96 @@ static int rtnl_net_dumpid_one(int id, void *peer, void *data)
return 0; return 0;
} }
static int rtnl_valid_dump_net_req(const struct nlmsghdr *nlh, struct sock *sk,
struct rtnl_net_dump_cb *net_cb,
struct netlink_callback *cb)
{
struct netlink_ext_ack *extack = cb->extack;
struct nlattr *tb[NETNSA_MAX + 1];
int err, i;
err = nlmsg_parse_strict(nlh, sizeof(struct rtgenmsg), tb, NETNSA_MAX,
rtnl_net_policy, extack);
if (err < 0)
return err;
for (i = 0; i <= NETNSA_MAX; i++) {
if (!tb[i])
continue;
if (i == NETNSA_TARGET_NSID) {
struct net *net;
net = rtnl_get_net_ns_capable(sk, nla_get_s32(tb[i]));
if (IS_ERR(net)) {
NL_SET_BAD_ATTR(extack, tb[i]);
NL_SET_ERR_MSG(extack,
"Invalid target network namespace id");
return PTR_ERR(net);
}
net_cb->fillargs.add_ref = true;
net_cb->ref_net = net_cb->tgt_net;
net_cb->tgt_net = net;
} else {
NL_SET_BAD_ATTR(extack, tb[i]);
NL_SET_ERR_MSG(extack,
"Unsupported attribute in dump request");
return -EINVAL;
}
}
return 0;
}
static int rtnl_net_dumpid(struct sk_buff *skb, struct netlink_callback *cb) static int rtnl_net_dumpid(struct sk_buff *skb, struct netlink_callback *cb)
{ {
struct net *net = sock_net(skb->sk);
struct rtnl_net_dump_cb net_cb = { struct rtnl_net_dump_cb net_cb = {
.net = net, .tgt_net = sock_net(skb->sk),
.skb = skb, .skb = skb,
.cb = cb, .fillargs = {
.portid = NETLINK_CB(cb->skb).portid,
.seq = cb->nlh->nlmsg_seq,
.flags = NLM_F_MULTI,
.cmd = RTM_NEWNSID,
},
.idx = 0, .idx = 0,
.s_idx = cb->args[0], .s_idx = cb->args[0],
}; };
int err = 0;
if (cb->strict_check && if (cb->strict_check) {
nlmsg_attrlen(cb->nlh, sizeof(struct rtgenmsg))) { err = rtnl_valid_dump_net_req(cb->nlh, skb->sk, &net_cb, cb);
NL_SET_ERR_MSG(cb->extack, "Unknown data in network namespace id dump request"); if (err < 0)
return -EINVAL; goto end;
} }
spin_lock_bh(&net->nsid_lock); spin_lock_bh(&net_cb.tgt_net->nsid_lock);
idr_for_each(&net->netns_ids, rtnl_net_dumpid_one, &net_cb); if (net_cb.fillargs.add_ref &&
spin_unlock_bh(&net->nsid_lock); !net_eq(net_cb.ref_net, net_cb.tgt_net) &&
!spin_trylock_bh(&net_cb.ref_net->nsid_lock)) {
spin_unlock_bh(&net_cb.tgt_net->nsid_lock);
err = -EAGAIN;
goto end;
}
idr_for_each(&net_cb.tgt_net->netns_ids, rtnl_net_dumpid_one, &net_cb);
if (net_cb.fillargs.add_ref &&
!net_eq(net_cb.ref_net, net_cb.tgt_net))
spin_unlock_bh(&net_cb.ref_net->nsid_lock);
spin_unlock_bh(&net_cb.tgt_net->nsid_lock);
cb->args[0] = net_cb.idx; cb->args[0] = net_cb.idx;
return skb->len; end:
if (net_cb.fillargs.add_ref)
put_net(net_cb.tgt_net);
return err < 0 ? err : skb->len;
} }
static void rtnl_net_notifyid(struct net *net, int cmd, int id) static void rtnl_net_notifyid(struct net *net, int cmd, int id)
{ {
struct net_fill_args fillargs = {
.cmd = cmd,
.nsid = id,
};
struct sk_buff *msg; struct sk_buff *msg;
int err = -ENOMEM; int err = -ENOMEM;
...@@ -876,7 +983,7 @@ static void rtnl_net_notifyid(struct net *net, int cmd, int id) ...@@ -876,7 +983,7 @@ static void rtnl_net_notifyid(struct net *net, int cmd, int id)
if (!msg) if (!msg)
goto out; goto out;
err = rtnl_net_fill(msg, 0, 0, 0, cmd, net, id); err = rtnl_net_fill(msg, &fillargs);
if (err < 0) if (err < 0)
goto err_out; goto err_out;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment