Patchwork [v2,4/4] neigh: don't leak default parms to uninitial netns

login
register
mail settings
Submitter Gao feng
Date June 14, 2013, 2:06 a.m.
Message ID <1371175607-1405-4-git-send-email-gaofeng@cn.fujitsu.com>
Download mbox | patch
Permalink /patch/251205/
State Changes Requested
Delegated to: David Miller
Headers show

Comments

Gao feng - June 14, 2013, 2:06 a.m.
Only allow initial net namespace to get default parms
through netlink.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
---
 net/core/neighbour.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
David Miller - June 20, 2013, 1:05 a.m.
From: Gao feng <gaofeng@cn.fujitsu.com>
Date: Fri, 14 Jun 2013 10:06:47 +0800

> Only allow initial net namespace to get default parms
> through netlink.
> 
> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>

Disallowing changes to the default neigh parms is fine, but there is no
reason to forbid seeing what default neigh parms will be used in a given
network namespace just because it isn't &init_net.

I don't see why you want to restrict this at all.

I'm not applying these patches, sorry.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Gao feng - June 20, 2013, 1:18 a.m.
On 06/20/2013 09:05 AM, David Miller wrote:
> From: Gao feng <gaofeng@cn.fujitsu.com>
> Date: Fri, 14 Jun 2013 10:06:47 +0800
> 
>> Only allow initial net namespace to get default parms
>> through netlink.
>>
>> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
> 
> Disallowing changes to the default neigh parms is fine, but there is no
> reason to forbid seeing what default neigh parms will be used in a given
> network namespace just because it isn't &init_net.
> 

Yes, we can make sure un-init net namespace can't do harm to default neigh parms,
it's enough.

> I don't see why you want to restrict this at all.
> 
> I'm not applying these patches, sorry.

You can just drop this one, are there some problems with the other 3 patches?
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller - June 20, 2013, 1:29 a.m.
From: Gao feng <gaofeng@cn.fujitsu.com>
Date: Thu, 20 Jun 2013 09:18:48 +0800

> You can just drop this one, are there some problems with the other 3
> patches?

No, please resubmit them.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 5e0fe89..3bb6115 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2094,7 +2094,8 @@  static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
 		if (tidx < tbl_skip || (family && tbl->family != family))
 			continue;
 
-		if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
+		if (net_eq(net, &init_net) &&
+		    neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
 				       cb->nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
 				       NLM_F_MULTI) <= 0)
 			break;