netdev - [PATCH v1 net 0/4] net: Support STP on bridge in non-root netns.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Fri, 14 Jul 2023 19:13:34 -0700
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: "David S. Miller" <davem@...emloft.net>, Eric Dumazet
	<edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni
	<pabeni@...hat.com>, Roopa Prabhu <roopa@...dia.com>, Nikolay Aleksandrov
	<razor@...ckwall.org>
CC: "Eric W. Biederman" <ebiederm@...ssion.com>, Harry Coin
	<hcoin@...etfountain.com>, Kuniyuki Iwashima <kuniyu@...zon.com>, "Kuniyuki
 Iwashima" <kuni1840@...il.com>, <netdev@...r.kernel.org>
Subject: [PATCH v1 net 0/4] net: Support STP on bridge in non-root netns.

Currently, STP does not work in non-root netns as llc_rcv() drops
packets from non-root netns.

This series fixes it by making some protocol handlers netns-aware,
which are called from llc_rcv() as follows:

  llc_rcv()
  |
  |- sap->rcv_func : registered by llc_sap_open()
  |
  |  * functions : regsitered by register_8022_client()
  |    -> No in-kernel user call register_8022_client()
  |
  |  * snap_rcv()
  |    |
  |    `- proto->rcvfunc() : registered by register_snap_client()
  |
  |       * aarp_rcv()  : drop packets from non-root netns
  |       * atalk_rcv() : drop packets from non-root netns
  |
  |  * stp_pdu_rcv()
  |    |
  |    `- garp_protos[]->rcv() : registered by stp_proto_register()
  |
  |       * garp_pdu_rcv() : netns-aware
  |       * br_stp_rcv()   : netns-aware
  |
  |- llc_type_handlers[llc_pdu_type(skb) - 1]
  |
  |  * llc_sap_handler()  : NOT netns-aware (Patch 1)
  |  * llc_conn_handler() : NOT netns-aware (Patch 2)
  |
  `- llc_station_handler

     * llc_station_rcv() : netns-aware

Patch 1 & 2 convert not-netns-aware functions and Patch 3 remove the
netns restriction in llc_rcv().

Note this series does not namespacify AF_LLC so that these patches
can be backported to stable tree (at least to 4.14.y) without conflicts.

Another series that adds netns support for AF_LLC will be targeted
to net-next later.

Kuniyuki Iwashima (4):
  llc: Check netns in llc_dgram_match().
  llc: Check netns in llc_estab_match() and llc_listener_match().
  llc: Don't drop packet from non-root netns.
  Revert "bridge: Add extack warning when enabling STP in netns."

 include/net/llc_conn.h |  2 +-
 net/bridge/br_stp_if.c |  3 ---
 net/llc/af_llc.c       |  2 +-
 net/llc/llc_conn.c     | 47 +++++++++++++++++++++++++-----------------
 net/llc/llc_if.c       |  2 +-
 net/llc/llc_input.c    |  3 ---
 net/llc/llc_sap.c      | 17 ++++++++-------
 7 files changed, 41 insertions(+), 35 deletions(-)

-- 
2.30.2