netdev - Re: [PATCH net-next 1/4] net: rtnetlink: support for fdb get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20181214113722.1c8638c6@cakuba.netronome.com>
Date:   Fri, 14 Dec 2018 11:37:22 -0800
From:   Jakub Kicinski <jakub.kicinski@...ronome.com>
To:     Roopa Prabhu <roopa@...ulusnetworks.com>
Cc:     David Ahern <dsa@...ulusnetworks.com>,
        David Miller <davem@...emloft.net>,
        netdev <netdev@...r.kernel.org>,
        Nikolay Aleksandrov <nikolay@...ulusnetworks.com>,
        Stephen Hemminger <stephen@...workplumber.org>
Subject: Re: [PATCH net-next 1/4] net: rtnetlink: support for fdb get

On Fri, 14 Dec 2018 10:09:07 -0800, Roopa Prabhu wrote:
> On Fri, Dec 14, 2018 at 9:55 AM David Ahern <dsa@...ulusnetworks.com> wrote:
> > On 12/14/18 10:43 AM, Roopa Prabhu wrote:  
> > > diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
> > > index f8bdb8ad..fcea76b 100644
> > > --- a/net/core/rtnetlink.c
> > > +++ b/net/core/rtnetlink.c
> > > @@ -4021,6 +4021,111 @@ static int rtnl_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb)
> > >       return skb->len;
> > >  }
> > >
> > > +static int rtnl_fdb_get(struct sk_buff *in_skb, struct nlmsghdr *nlh,
> > > +                     struct netlink_ext_ack *extack)
> > > +{
> > > +     const struct net_device_ops *ops = NULL;
> > > +     struct net *net = sock_net(in_skb->sk);
> > > +     struct net_device *dev = NULL, *br_dev = NULL;
> > > +     struct nlattr *tb[NDA_MAX + 1];
> > > +     struct sk_buff *skb;
> > > +     struct ndmsg *ndm;
> > > +     int br_idx = 0;
> > > +     u8 *addr;
> > > +     u16 vid;
> > > +     int err;
> > > +
> > > +     err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL, extack);  
> >
> > New stuff should go in with strict checking, so nlmsg_parse_strict and a
> > check for any unsupported attributes (NDA) or ndm entries in the request.  
> 
> makes sense.

Oh, so we'd use the STRICT checking in doit for the first time?  I
better send that rename patch then..

> > Also, please add an nla_policy for easier NDA attributes ...  
> 
> yes agreed. NDA attrs have not had a policy.
> maybe an incremental patch ?, NDA_* attributes are used in bridge
> vxlan and neighbour code, need a common place to put the policy.
> (suggestions ?)

FWIW:

--->8-----

net: netlink: add helper to retrieve NETLINK_F_STRICT_CHK

Dumps can read state of the NETLINK_F_STRICT_CHK flag from
a field in the callback structure.  For non-dump GET requests
we need a way to access the state of that flag from a socket.

Signed-off-by: Jakub Kicinski <jakub.kicinski@...ronome.com>
---
 include/linux/netlink.h  | 1 +
 net/netlink/af_netlink.c | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 4da90a6ab536..36bf43816e1a 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -117,6 +117,7 @@ extern void __netlink_clear_multicast_users(struct sock *sk, unsigned int group)
 extern void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,
 			const struct netlink_ext_ack *extack);
 extern int netlink_has_listeners(struct sock *sk, unsigned int group);
+extern bool netlink_strict_get_check(struct sk_buff *skb);
 
 extern int netlink_unicast(struct sock *ssk, struct sk_buff *skb, __u32 portid, int nonblock);
 extern int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, __u32 portid,
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 3c023d6120f6..8fa35df94c07 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1371,6 +1371,14 @@ int netlink_has_listeners(struct sock *sk, unsigned int group)
 }
 EXPORT_SYMBOL_GPL(netlink_has_listeners);
 
+bool netlink_strict_get_check(struct sk_buff *skb)
+{
+	const struct netlink_sock *nlk = nlk_sk(NETLINK_CB(skb).sk);
+
+	return nlk->flags & NETLINK_F_STRICT_CHK;
+}
+EXPORT_SYMBOL_GPL(netlink_strict_get_check);
+
 static int netlink_broadcast_deliver(struct sock *sk, struct sk_buff *skb)
 {
 	struct netlink_sock *nlk = nlk_sk(sk);
-- 
2.19.2