netdev - [PATCH iproute2 v1] ip netns: allow negative nsid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20180206183931.4893-1-christian.brauner@ubuntu.com>
Date:   Tue,  6 Feb 2018 19:39:31 +0100
From:   Christian Brauner <christian.brauner@...ntu.com>
To:     netdev@...r.kernel.org
Cc:     stephen@...workplumber.org,
        Christian Brauner <christian.brauner@...ntu.com>
Subject: [PATCH iproute2 v1] ip netns: allow negative nsid

If the kernel receives a negative nsid it will automatically assign the
next available nsid. In this case alloc_netid() will set min and max to
0 for ird_alloc(). And when max == 0 idr_alloc() will interpret this as
the maxium range, i.e. specific to nsids it will try to find an id in
the range [0,INT_MAX). This is intentionally supported in the kernel for
nsids. Commit acbe9118ce8086f765ffb0da15f80c7c01a8903a regressed ip
netns in that respect although previously the use-case was either
accidentally supported or opaquely supported such that it triggered the
original commit. From what I can gather it went as follows before:
atoi() was called with a string indicating a negative value which caused
it to return -1 which was passed to the kernel. Let's make it less
opaque by introducing the keyword "auto":

ip netns set <netns-name> auto

will cause nsid to be set to -1 and the kernel will select an available
nsid.

Signed-off-by: Christian Brauner <christian.brauner@...ntu.com>
---
ChangeLog v0->v1:
* introduce "auto" keyword for ip netns to automatically allocate an
  available nsid
---
 ip/ipnetns.c        | 5 ++++-
 man/man8/ip-netns.8 | 1 +
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/ip/ipnetns.c b/ip/ipnetns.c
index 059a4220..631794b8 100644
--- a/ip/ipnetns.c
+++ b/ip/ipnetns.c
@@ -718,7 +718,10 @@ static int netns_set(int argc, char **argv)
 		return -1;
 	}
 	name = argv[0];
-	if (get_unsigned(&nsid, argv[1], 0))
+	/* If a negative nsid is specified the kernel will select the nsid. */
+	if (strcmp(argv[1], "auto") == 0)
+		nsid = -1;
+	else if (get_unsigned(&nsid, argv[1], 0))
 		invarg("Invalid \"netnsid\" value\n", argv[1]);

 	snprintf(netns_path, sizeof(netns_path), "%s/%s", NETNS_RUN_DIR, name);
diff --git a/man/man8/ip-netns.8 b/man/man8/ip-netns.8
index c5310e24..d539f18b 100644
--- a/man/man8/ip-netns.8
+++ b/man/man8/ip-netns.8
@@ -137,6 +137,7 @@ $ ip netns del net0
 .sp
 This command assigns a id to a peer network namespace. This id is valid
 only in the current network namespace.
+If the keyword "auto" is specified an available nsid will be chosen.
 This id will be used by the kernel in some netlink messages. If no id is
 assigned when the kernel needs it, it will be automatically assigned by
 the kernel.
-- 
2.14.1