netdev - Re: [PATCH net-next 5/6] netlink: add mask validation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <37c768d663f7f3158f1bfae6d7e1aa86e76e9880.camel@sipsolutions.net>
Date:   Mon, 05 Oct 2020 21:53:12 +0200
From:   Johannes Berg <johannes@...solutions.net>
To:     Jakub Kicinski <kuba@...nel.org>
Cc:     Michal Kubecek <mkubecek@...e.cz>, davem@...emloft.net,
        netdev@...r.kernel.org, kernel-team@...com, jiri@...nulli.us,
        andrew@...n.ch, dsahern@...il.com, pablo@...filter.org
Subject: Re: [PATCH net-next 5/6] netlink: add mask validation

On Mon, 2020-10-05 at 12:40 -0700, Jakub Kicinski wrote:

> > I would totally support doing that here in the general validation code,
> > but (again) don't really think NLMSGERR_ATTR_COOKIE is an appropriate
> > attribute for it.
> 
> Hm. Perhaps we can do a partial policy dump into the extack?

Hm. I like that idea.

If we have NLMSGERR_ATTR_OFFS we could accompany that with the sub-
policy for that particular attribute, something like

[NLMSGERR_ATTR_POLICY] = nested {
  [NL_POLICY_TYPE_ATTR_TYPE] = ...
  [NL_POLICY_TYPE_ATTR_MASK] = ...
}

which we could basically do by factoring out the inner portion of
netlink_policy_dump_write():

	attr = nla_nest_start(skb, state->attr_idx);
	if (!attr)
		goto nla_put_failure;
	...
	nla_nest_end(skb, attr);

from there into a separate function, give it the pt and the nested
attribute (what's "state->attr_idx" here) as arguments, and then we call
it with NLMSGERR_ATTR_POLICY from here, and with "state->attr_idx" from
netlink_policy_dump_write() :-)

Nice, easy & useful, maybe I'll code it up tomorrow.

> Either way, I don't feel like this series needs it.

Fair enough.

johannes