[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <a7h5ug23xvcayh66nm2373nxotd73xbr36kabpjky273wudb7i@mmduvu4bqzqa>
Date: Wed, 21 May 2025 16:11:14 -0700
From: Jordan Rife <jordan@...fe.io>
To: "Jason A. Donenfeld" <Jason@...c4.com>
Cc: wireguard@...ts.zx2c4.com, netdev@...r.kernel.org,
Jakub Kicinski <kuba@...nel.org>, Daniel Borkmann <daniel@...earbox.net>
Subject: Re: [RESEND PATCH v3 net-next] wireguard: allowedips: Add
WGALLOWEDIP_F_REMOVE_ME flag
On Wed, May 21, 2025 at 12:00:00AM +0200, Jason A. Donenfeld wrote:
> On Tue, May 20, 2025 at 11:47:56PM +0200, Jason A. Donenfeld wrote:
> > Hi Jakub, Jordan,
> >
> > On Sat, May 17, 2025 at 12:29:52PM -0700, Jordan Rife wrote:
> > > * Use NLA_POLICY_MASK for WGALLOWEDIP_A_FLAGS validation (Jakub).
> > [...]
> > > + [WGALLOWEDIP_A_FLAGS] = NLA_POLICY_MASK(NLA_U32, __WGALLOWEDIP_F_ALL),
> >
> > I wonder... Can we update, in a separate patch, these to also use
> > NLA_POLICY_MASK?
> >
> > ...
> > [WGDEVICE_A_FLAGS] = { .type = NLA_U32 },
> > ...
> > [WGPEER_A_FLAGS] = { .type = NLA_U32 },
> > ...
> >
> > Some consistency would be nice.
>
> Perhaps I'll commit something like this?
>
> From 22b6d15ad2a2e38bc80ebf65694106ff554b572f Mon Sep 17 00:00:00 2001
> From: "Jason A. Donenfeld" <Jason@...c4.com>
> Date: Tue, 20 May 2025 23:56:18 +0200
> Subject: [PATCH] wireguard: netlink: use NLA_POLICY_MASK where possible
>
> Rather than manually validating flags against the various __ALL_*
> constants, put this in the netlink policy description and have the upper
> layer machinery check it for us.
>
> Signed-off-by: Jason A. Donenfeld <Jason@...c4.com>
> ---
> drivers/net/wireguard/netlink.c | 10 ++--------
> 1 file changed, 2 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/net/wireguard/netlink.c b/drivers/net/wireguard/netlink.c
> index f7055180ba4a..b82266da949a 100644
> --- a/drivers/net/wireguard/netlink.c
> +++ b/drivers/net/wireguard/netlink.c
> @@ -24,7 +24,7 @@ static const struct nla_policy device_policy[WGDEVICE_A_MAX + 1] = {
> [WGDEVICE_A_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ - 1 },
> [WGDEVICE_A_PRIVATE_KEY] = NLA_POLICY_EXACT_LEN(NOISE_PUBLIC_KEY_LEN),
> [WGDEVICE_A_PUBLIC_KEY] = NLA_POLICY_EXACT_LEN(NOISE_PUBLIC_KEY_LEN),
> - [WGDEVICE_A_FLAGS] = { .type = NLA_U32 },
> + [WGDEVICE_A_FLAGS] = { .type = NLA_POLICY_MASK(NLA_U32, __WGDEVICE_F_ALL) },
> [WGDEVICE_A_LISTEN_PORT] = { .type = NLA_U16 },
> [WGDEVICE_A_FWMARK] = { .type = NLA_U32 },
> [WGDEVICE_A_PEERS] = { .type = NLA_NESTED }
> @@ -33,7 +33,7 @@ static const struct nla_policy device_policy[WGDEVICE_A_MAX + 1] = {
> static const struct nla_policy peer_policy[WGPEER_A_MAX + 1] = {
> [WGPEER_A_PUBLIC_KEY] = NLA_POLICY_EXACT_LEN(NOISE_PUBLIC_KEY_LEN),
> [WGPEER_A_PRESHARED_KEY] = NLA_POLICY_EXACT_LEN(NOISE_SYMMETRIC_KEY_LEN),
> - [WGPEER_A_FLAGS] = { .type = NLA_U32 },
> + [WGPEER_A_FLAGS] = { .type = NLA_POLICY_MASK(NLA_U32, __WGPEER_F_ALL) },
> [WGPEER_A_ENDPOINT] = NLA_POLICY_MIN_LEN(sizeof(struct sockaddr)),
> [WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL] = { .type = NLA_U16 },
> [WGPEER_A_LAST_HANDSHAKE_TIME] = NLA_POLICY_EXACT_LEN(sizeof(struct __kernel_timespec)),
> @@ -373,9 +373,6 @@ static int set_peer(struct wg_device *wg, struct nlattr **attrs)
>
> if (attrs[WGPEER_A_FLAGS])
> flags = nla_get_u32(attrs[WGPEER_A_FLAGS]);
> - ret = -EOPNOTSUPP;
> - if (flags & ~__WGPEER_F_ALL)
> - goto out;
>
> ret = -EPFNOSUPPORT;
> if (attrs[WGPEER_A_PROTOCOL_VERSION]) {
> @@ -506,9 +503,6 @@ static int wg_set_device(struct sk_buff *skb, struct genl_info *info)
>
> if (info->attrs[WGDEVICE_A_FLAGS])
> flags = nla_get_u32(info->attrs[WGDEVICE_A_FLAGS]);
> - ret = -EOPNOTSUPP;
> - if (flags & ~__WGDEVICE_F_ALL)
> - goto out;
>
> if (info->attrs[WGDEVICE_A_LISTEN_PORT] || info->attrs[WGDEVICE_A_FWMARK]) {
> struct net *net;
> --
> 2.48.1
This changes the error code returned in userspace in these cases from
EOPNOTSUPP to EINVAL I think, but if there's nothing relying on that
behavior then it seems like a nice cleanup to me.
Jordan
Powered by blists - more mailing lists