diff mbox

[net-next,v3] sock_diag: notify packet socket creation/deletion

Message ID 1368800738-4364-1-git-send-email-nicolas.dichtel@6wind.com
State Deferred, archived
Delegated to: David Miller
Headers show

Commit Message

Nicolas Dichtel May 17, 2013, 2:25 p.m. UTC 
With this patch, a netlink message is sent each time a packet socket is created
or deleted.
The framework is generic, so it's easy to add the notification for other kind of
sockets.

Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
---

This patch was sent the first time in a serie of 5 patches, but was not
included with the last version of this serie. Hence, I resend it as v3,
after a rebase on net-next.

I'm not sure if this patch was acceptable or not (from a security point of
view). Note that BPF filters and uid are not put in the messsage, because
user_ns is unknown.

v3: rebase it on net-next
    export the symbol __sock_diag_notify (af_packet can be compiled as a
    module)

v2: add sock_diag_notify_del() to avoid confusion of the meaning of the second
    arg of __sock_diag_notify()

 include/linux/sock_diag.h      |  4 ++++
 include/uapi/linux/sock_diag.h | 13 ++++++++++++-
 net/core/sock_diag.c           | 42 ++++++++++++++++++++++++++++++++++++++++++
 net/packet/af_packet.c         |  4 ++++
 net/packet/diag.c              | 30 +++++++++++++++++++++++++-----
 5 files changed, 87 insertions(+), 6 deletions(-)

Comments

David Miller May 20, 2013, 6:29 a.m. UTC | #1 
From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Date: Fri, 17 May 2013 16:25:38 +0200

> With this patch, a netlink message is sent each time a packet socket
> is created or deleted.  The framework is generic, so it's easy to
> add the notification for other kind of sockets.
>
> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>

Just curious what you want to use this for.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Nicolas Dichtel May 21, 2013, 3:14 p.m. UTC | #2 
Le 20/05/2013 08:29, David Miller a écrit :
> From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
> Date: Fri, 17 May 2013 16:25:38 +0200
>
>> With this patch, a netlink message is sent each time a packet socket
>> is created or deleted.  The framework is generic, so it's easy to
>> add the notification for other kind of sockets.
>>
>> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
>
> Just curious what you want to use this for.
Some HW (custom FPGA, ASICs, NPUs) are able to offload packet captures, so it is 
required to notify them.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller May 21, 2013, 6:43 p.m. UTC | #3 
From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Date: Tue, 21 May 2013 17:14:50 +0200

> Le 20/05/2013 08:29, David Miller a écrit :
>> From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
>> Date: Fri, 17 May 2013 16:25:38 +0200
>>
>>> With this patch, a netlink message is sent each time a packet socket
>>> is created or deleted.  The framework is generic, so it's easy to
>>> add the notification for other kind of sockets.
>>>
>>> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
>>
>> Just curious what you want to use this for.
> Some HW (custom FPGA, ASICs, NPUs) are able to offload packet
> captures, so it is required to notify them.

I don't even want to hear about this until you have patches ready
to submit to fully support such a facility.

I'm not applying this patch, sorry.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Nicolas Dichtel May 22, 2013, 11:49 a.m. UTC | #4 
Le 21/05/2013 20:43, David Miller a écrit :
> From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
> Date: Tue, 21 May 2013 17:14:50 +0200
>
>> Le 20/05/2013 08:29, David Miller a écrit :
>>> From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
>>> Date: Fri, 17 May 2013 16:25:38 +0200
>>>
>>>> With this patch, a netlink message is sent each time a packet socket
>>>> is created or deleted.  The framework is generic, so it's easy to
>>>> add the notification for other kind of sockets.
>>>>
>>>> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
>>>
>>> Just curious what you want to use this for.
>> Some HW (custom FPGA, ASICs, NPUs) are able to offload packet
>> captures, so it is required to notify them.
>
> I don't even want to hear about this until you have patches ready
> to submit to fully support such a facility.
Not sure to understand what you're expecting. In our case, configuration is done 
by a daemon, hence there is no other kernel patch to support this.

Note that this patch is still a complete feature, it allows to monitor AF_PACKET 
socket.
With a patched iproute2:

$ ss -ap0e -M
     Netid  State      Recv-Q Send-Q 
        Local Address:Port 
  Peer Address:Port
     p_dgr  UNCONN     0      0 
                    *:* 
              *        users:(("tcpdump",8630,3)) ino=29477 uid=0 sk=f53fbc00
del p_dgr  UNCONN     0      0 
                   *:* 
             *        users:(("tcpdump",8630,3)) ino=29477 uid=0 sk=f53fbc00

Will you accept the patch if I integrate the example in the commit log?
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h
index 54f91d3..86cd4f4 100644
--- a/include/linux/sock_diag.h
+++ b/include/linux/sock_diag.h
@@ -11,6 +11,7 @@  struct sock;
 struct sock_diag_handler {
 	__u8 family;
 	int (*dump)(struct sk_buff *skb, struct nlmsghdr *nlh);
+	int (*notify)(struct sk_buff *skb, struct sock *sk, bool create);
 };
 
 int sock_diag_register(const struct sock_diag_handler *h);
@@ -25,5 +26,8 @@  void sock_diag_save_cookie(void *sk, __u32 *cookie);
 int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attr);
 int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk,
 			     struct sk_buff *skb, int attrtype);
+int __sock_diag_notify(struct sock *sk, bool create);
+#define sock_diag_notify(sk)		__sock_diag_notify(sk, true)
+#define sock_diag_notify_del(sk)	__sock_diag_notify(sk, false)
 
 #endif
diff --git a/include/uapi/linux/sock_diag.h b/include/uapi/linux/sock_diag.h
index b00e29e..9e9ffa0 100644
--- a/include/uapi/linux/sock_diag.h
+++ b/include/uapi/linux/sock_diag.h
@@ -3,7 +3,18 @@ 
 
 #include <linux/types.h>
 
-#define SOCK_DIAG_BY_FAMILY 20
+#define SOCK_DIAG_BY_FAMILY	20
+#define SOCK_DIAG_BY_FAMILY_DEL	21
+
+/* SOCK_DIAG multicast groups */
+enum nldiag_groups {
+	NLDIAGGRP_NONE,
+#define NLDIAGGRP_NONE		NLDIAGGRP_NONE
+	NLDIAGGRP_NOTIFY,
+#define NLDIAGGRP_NOTIFY	NLDIAGGRP_NOTIFY
+	__NLDIAGGRP_MAX
+};
+#define NLDIAGGRP_MAX	(__NLDIAGGRP_MAX - 1)
 
 struct sock_diag_req {
 	__u8	sdiag_family;
diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
index d5bef0b0..7cc81a8 100644
--- a/net/core/sock_diag.c
+++ b/net/core/sock_diag.c
@@ -192,6 +192,48 @@  static void sock_diag_rcv(struct sk_buff *skb)
 	mutex_unlock(&sock_diag_mutex);
 }
 
+int __sock_diag_notify(struct sock *sk, bool create)
+{
+	const struct sock_diag_handler *hndl;
+	int err;
+
+	if (sock_diag_handlers[sk->sk_family] == NULL)
+		request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
+				NETLINK_SOCK_DIAG, sk->sk_family);
+
+	mutex_lock(&sock_diag_table_mutex);
+	hndl = sock_diag_handlers[sk->sk_family];
+	if (hndl == NULL)
+		err = -ENOENT;
+	else if (hndl->notify == NULL)
+		err = -ENOSYS;
+	else {
+		struct net *net = sock_net(sk);
+		struct sock *nlsk = net->diag_nlsk;
+		struct sk_buff *skb;
+
+		skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+		if (skb == NULL) {
+			err = -ENOBUFS;
+			goto out;
+		}
+
+		err = hndl->notify(skb, sk, create);
+		if (err) {
+			nlmsg_free(skb);
+			goto out;
+		}
+
+		err = nlmsg_notify(nlsk, skb, 0, NLDIAGGRP_NOTIFY, 0,
+				   GFP_KERNEL);
+	}
+out:
+	mutex_unlock(&sock_diag_table_mutex);
+
+	return err;
+}
+EXPORT_SYMBOL(__sock_diag_notify);
+
 static int __net_init diag_net_init(struct net *net)
 {
 	struct netlink_kernel_cfg cfg = {
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 8ec1bca..4940a85 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -88,6 +88,7 @@ 
 #include <linux/virtio_net.h>
 #include <linux/errqueue.h>
 #include <linux/net_tstamp.h>
+#include <linux/sock_diag.h>
 
 #ifdef CONFIG_INET
 #include <net/inet_common.h>
@@ -2415,6 +2416,8 @@  static int packet_release(struct socket *sock)
 	if (!sk)
 		return 0;
 
+	sock_diag_notify_del(sk);
+
 	net = sock_net(sk);
 	po = pkt_sk(sk);
 
@@ -2633,6 +2636,7 @@  static int packet_create(struct net *net, struct socket *sock, int protocol,
 	sock_prot_inuse_add(net, &packet_proto, 1);
 	preempt_enable();
 
+	sock_diag_notify(sk);
 	return 0;
 out:
 	return err;
diff --git a/net/packet/diag.c b/net/packet/diag.c
index a9584a2..74671db 100644
--- a/net/packet/diag.c
+++ b/net/packet/diag.c
@@ -128,13 +128,13 @@  static int pdiag_put_fanout(struct packet_sock *po, struct sk_buff *nlskb)
 static int sk_diag_fill(struct sock *sk, struct sk_buff *skb,
 			struct packet_diag_req *req,
 			struct user_namespace *user_ns,
-			u32 portid, u32 seq, u32 flags, int sk_ino)
+			u32 portid, u32 seq, u32 flags, int sk_ino, int cmd)
 {
 	struct nlmsghdr *nlh;
 	struct packet_diag_msg *rp;
 	struct packet_sock *po = pkt_sk(sk);
 
-	nlh = nlmsg_put(skb, portid, seq, SOCK_DIAG_BY_FAMILY, sizeof(*rp), flags);
+	nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rp), flags);
 	if (!nlh)
 		return -EMSGSIZE;
 
@@ -149,7 +149,7 @@  static int sk_diag_fill(struct sock *sk, struct sk_buff *skb,
 			pdiag_put_info(po, skb))
 		goto out_nlmsg_trim;
 
-	if ((req->pdiag_show & PACKET_SHOW_INFO) &&
+	if ((req->pdiag_show & PACKET_SHOW_INFO) && user_ns &&
 	    nla_put_u32(skb, PACKET_DIAG_UID,
 			from_kuid_munged(user_ns, sock_i_uid(sk))))
 		goto out_nlmsg_trim;
@@ -170,7 +170,7 @@  static int sk_diag_fill(struct sock *sk, struct sk_buff *skb,
 	    sock_diag_put_meminfo(sk, skb, PACKET_DIAG_MEMINFO))
 		goto out_nlmsg_trim;
 
-	if ((req->pdiag_show & PACKET_SHOW_FILTER) &&
+	if ((req->pdiag_show & PACKET_SHOW_FILTER) && user_ns &&
 	    sock_diag_put_filterinfo(user_ns, sk, skb, PACKET_DIAG_FILTER))
 		goto out_nlmsg_trim;
 
@@ -202,7 +202,7 @@  static int packet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
 				 sk_user_ns(NETLINK_CB(cb->skb).sk),
 				 NETLINK_CB(cb->skb).portid,
 				 cb->nlh->nlmsg_seq, NLM_F_MULTI,
-				 sock_i_ino(sk)) < 0)
+				 sock_i_ino(sk), SOCK_DIAG_BY_FAMILY) < 0)
 			goto done;
 next:
 		num++;
@@ -237,9 +237,29 @@  static int packet_diag_handler_dump(struct sk_buff *skb, struct nlmsghdr *h)
 		return -EOPNOTSUPP;
 }
 
+static int packet_diag_handler_notify(struct sk_buff *skb, struct sock *sk,
+				      bool create)
+{
+	struct packet_diag_req req;
+	int err, cmd;
+
+	memset(&req, 0, sizeof(struct packet_diag_req));
+	if (create) {
+		req.pdiag_show |= PACKET_SHOW_INFO | PACKET_SHOW_MCLIST;
+		req.pdiag_show |= PACKET_SHOW_RING_CFG | PACKET_SHOW_FANOUT;
+		req.pdiag_show |= PACKET_SHOW_MEMINFO | PACKET_SHOW_FILTER;
+		cmd = SOCK_DIAG_BY_FAMILY;
+	} else
+		cmd = SOCK_DIAG_BY_FAMILY_DEL;
+
+	err = sk_diag_fill(sk, skb, &req, NULL, 0, 0, 0, sock_i_ino(sk), cmd);
+	return err > 0 ? 0 : err;
+}
+
 static const struct sock_diag_handler packet_diag_handler = {
 	.family = AF_PACKET,
 	.dump = packet_diag_handler_dump,
+	.notify = packet_diag_handler_notify,
 };
 
 static int __init packet_diag_init(void)