netdev - [PATCH] net: vxlan: disallow removing to other namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 17 May 2019 19:42:23 -0700
From:   xiangxia.m.yue@...il.com
To:     davem@...emloft.net, netdev@...r.kernel.org
Cc:     Tonghao Zhang <xiangxia.m.yue@...il.com>
Subject: [PATCH] net: vxlan: disallow removing to other namespace

From: Tonghao Zhang <xiangxia.m.yue@...il.com>

Don't allow to remove the vxlan device to other namesapce,
because we maintain the data of vxlan net device on original
net-namespace.

    $ ip netns add ns100
    $ ip link add vxlan100 type vxlan dstport 4789 external
    $ ip link set dev vxlan100 netns ns100
    $ ip netns exec ns100 ip link add vxlan200 type vxlan dstport 4789 external
    $ ip netns exec ns100 ip link
    ...
    vxlan200: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    vxlan100: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000

And we should create it on new net-namespace, so disallow removing it.

Signed-off-by: Tonghao Zhang <xiangxia.m.yue@...il.com>
---
 drivers/net/vxlan.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 5994d54..63add28 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2998,6 +2998,7 @@ static void vxlan_setup(struct net_device *dev)
 	dev->needs_free_netdev = true;
 	SET_NETDEV_DEVTYPE(dev, &vxlan_type);
 
+	dev->features	|= NETIF_F_NETNS_LOCAL;
 	dev->features	|= NETIF_F_LLTX;
 	dev->features	|= NETIF_F_SG | NETIF_F_HW_CSUM;
 	dev->features   |= NETIF_F_RXCSUM;
-- 
1.8.3.1