netdev - Re: [PATCH net-next 2/9] net/ipv4: Plumb support for filtering route dumps

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 11 Oct 2018 10:44:04 -0600
From:   David Ahern <dsahern@...il.com>
To:     Andrew Lunn <andrew@...n.ch>, David Ahern <dsahern@...nel.org>
Cc:     netdev@...r.kernel.org, davem@...emloft.net
Subject: Re: [PATCH net-next 2/9] net/ipv4: Plumb support for filtering route
 dumps

On 10/11/18 9:56 AM, Andrew Lunn wrote:
>> @@ -866,10 +866,13 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
>>  		hlist_for_each_entry_rcu(tb, head, tb_hlist) {
>>  			if (e < s_e)
>>  				goto next;
>> +			if (filter.table_id && filter.table_id != tb->tb_id)
>> +				goto next;
>> +
> 
> Hi David
> 
> Should there be a test here that filter->filter_set is set, before
> looking at filter.table_id.

filter_set is meant for places that would need to look at multiple flags.

But now that you point this out, if a table id is passed in I should do
a get on the table and not walk the hash list.


> 
>>  			if (dumped)
>>  				memset(&cb->args[2], 0, sizeof(cb->args) -
>>  						 2 * sizeof(cb->args[0]));
>> -			err = fib_table_dump(tb, skb, cb);
>> +			err = fib_table_dump(tb, skb, cb, &filter);
>>  			if (err < 0) {
>>  				if (likely(skb->len))
>>  					goto out;
>> diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
>> index 5bc0c89e81e4..237c9f72b265 100644
>> --- a/net/ipv4/fib_trie.c
>> +++ b/net/ipv4/fib_trie.c
>> @@ -2003,12 +2003,17 @@ void fib_free_table(struct fib_table *tb)
>>  }
>>  
>>  static int fn_trie_dump_leaf(struct key_vector *l, struct fib_table *tb,
>> -			     struct sk_buff *skb, struct netlink_callback *cb)
>> +			     struct sk_buff *skb, struct netlink_callback *cb,
>> +			     struct fib_dump_filter *filter)
>>  {
>> +	unsigned int flags = NLM_F_MULTI;
>>  	__be32 xkey = htonl(l->key);
>>  	struct fib_alias *fa;
>>  	int i, s_i;
>>  
>> +	if (filter->filter_set)
>> +		flags |= NLM_F_DUMP_FILTERED;
> 
> With the above code, it seems like table_id could be filtered without
> setting this flag to indicate some filters have been applied?

Right, I should handle that.