[2/6] netlink: make validation more configurable for future strictness

From: Johannes Berg <johannes.berg@intel.com>

From: Johannes Berg <johannes.berg@intel.com>

We currently have two levels of strict validation:

 1) liberal (default)
     - undefined (type >= max) & NLA_UNSPEC attributes accepted
     - attribute length >= expected accepted
     - garbage at end of message accepted
 2) strict (opt-in)
     - NLA_UNSPEC attributes accepted
     - attribute length >= expected accepted

Split out parsing strictness into five different options:
 * TRAILING     - check that there's no trailing data after parsing
                  attributes (in message or nested)
 * MAXTYPE      - reject attrs > max known type
 * UNSPEC       - reject attributes with NLA_UNSPEC policy entries
 * POLICY       - reject everything if no policy is given
 * STRICT_ATTRS - strictly validate attribute size

The default for future things should be *everything*.
The current *_strict() is a combination of TRAILING and MAXTYPE,
and is renamed to _deprecated_strict().
The current regular parsing has none of this, and is renamed to
*_parse_deprecated().

Additionally it allows us to selectively set one of the new flags
even on old policies. Notably, the UNSPEC flag could be useful in
this case, since it can be arranged (by filling in the policy) to
not be an incompatible userspace ABI change, but would then going
forward prevent forgetting attribute entries. Similar can apply
to the POLICY flag.

We end up with the following renames:
 * nla_parse           -> nla_parse_deprecated
 * nlmsg_parse         -> nlmsg_parse_deprecated
 * nlmsg_parse_strict  -> nlmsg_parse_deprecated_strict
 * nla_parse_nested    -> nla_parse_nested_deprecated
 * nla_validate_nested -> nla_validate_nested_deprecated

Using spatch, of course:
    @@
    expression TB, MAX, HEAD, LEN, POL, EXT;
    @@
    -nla_parse(TB, MAX, HEAD, LEN, POL, EXT)
    +nla_parse_deprecated(TB, MAX, HEAD, LEN, POL, EXT)

    @@
    expression NLH, HDRLEN, TB, MAX, POL, EXT;
    @@
    -nlmsg_parse(NLH, HDRLEN, TB, MAX, POL, EXT)
    +nlmsg_parse_deprecated(NLH, HDRLEN, TB, MAX, POL, EXT)

    @@
    expression NLH, HDRLEN, TB, MAX, POL, EXT;
    @@
    -nlmsg_parse_strict(NLH, HDRLEN, TB, MAX, POL, EXT)
    +nlmsg_parse_deprecated_strict(NLH, HDRLEN, TB, MAX, POL, EXT)

    @@
    expression TB, MAX, NLA, POL, EXT;
    @@
    -nla_parse_nested(TB, MAX, NLA, POL, EXT)
    +nla_parse_nested_deprecated(TB, MAX, NLA, POL, EXT)

    @@
    expression START, MAX, POL, EXT;
    @@
    -nla_validate_nested(START, MAX, POL, EXT)
    +nla_validate_nested_deprecated(START, MAX, POL, EXT)

    @@
    expression NLH, HDRLEN, MAX, POL, EXT;
    @@
    -nlmsg_validate(NLH, HDRLEN, MAX, POL, EXT)
    +nlmsg_validate_deprecated(NLH, HDRLEN, MAX, POL, EXT)

For this patch, don't actually add the strict, non-renamed versions
yet so that it breaks compile if I get it wrong.

Also, while at it, make nla_validate and nla_parse go down to a
common __nla_validate_parse() function to avoid code duplication.

Ultimately, this allows us to have very strict validation for every
new caller of nla_parse()/nlmsg_parse() etc as re-introduced in the
next patch, while existing things will continue to work as is.

In effect then, this adds fully strict validation for any new command.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
 crypto/crypto_user_base.c                     |   4 +-
 drivers/block/drbd/drbd_nla.c                 |   3 +-
 drivers/block/nbd.c                           |  12 +-
 drivers/infiniband/core/addr.c                |   4 +-
 drivers/infiniband/core/iwpm_util.c           |   8 +-
 drivers/infiniband/core/nldev.c               |  36 +--
 drivers/infiniband/core/sa_query.c            |   8 +-
 drivers/net/ieee802154/mac802154_hwsim.c      |  12 +-
 drivers/net/macsec.c                          |   8 +-
 drivers/net/team/team.c                       |   8 +-
 drivers/net/wireless/ath/ath10k/testmode.c    |   4 +-
 drivers/net/wireless/ath/ath6kl/testmode.c    |   4 +-
 drivers/net/wireless/ath/wcn36xx/testmode.c   |   4 +-
 drivers/net/wireless/ath/wil6210/cfg80211.c   |  24 +-
 .../net/wireless/intel/iwlwifi/mvm/mac80211.c |   4 +-
 drivers/net/wireless/mac80211_hwsim.c         |   8 +-
 .../net/wireless/marvell/mwifiex/cfg80211.c   |   4 +-
 drivers/net/wireless/ti/wlcore/testmode.c     |   4 +-
 drivers/net/wireless/ti/wlcore/vendor_cmd.c   |   8 +-
 include/net/genetlink.h                       |  16 +-
 include/net/netlink.h                         | 216 ++++++++++++++----
 kernel/taskstats.c                            |   5 +-
 lib/nlattr.c                                  | 174 +++++++-------
 net/8021q/vlan_netlink.c                      |   4 +-
 net/bridge/br_mdb.c                           |   4 +-
 net/bridge/br_netlink.c                       |   6 +-
 net/bridge/br_netlink_tunnel.c                |   4 +-
 net/can/gw.c                                  |   4 +-
 net/core/devlink.c                            |   7 +-
 net/core/fib_rules.c                          |   6 +-
 net/core/lwt_bpf.c                            |   7 +-
 net/core/neighbour.c                          |  25 +-
 net/core/net_namespace.c                      |  19 +-
 net/core/rtnetlink.c                          | 107 +++++----
 net/dcb/dcbnl.c                               |  90 +++++---
 net/decnet/dn_dev.c                           |   8 +-
 net/decnet/dn_fib.c                           |   8 +-
 net/decnet/dn_route.c                         |   4 +-
 net/ieee802154/nl802154.c                     |  46 ++--
 net/ipv4/devinet.c                            |  27 ++-
 net/ipv4/fib_frontend.c                       |   8 +-
 net/ipv4/ip_tunnel_core.c                     |   8 +-
 net/ipv4/ipmr.c                               |  12 +-
 net/ipv4/route.c                              |   8 +-
 net/ipv6/addrconf.c                           |  36 +--
 net/ipv6/addrlabel.c                          |  12 +-
 net/ipv6/ila/ila_lwt.c                        |   3 +-
 net/ipv6/route.c                              |  12 +-
 net/ipv6/seg6_iptunnel.c                      |   4 +-
 net/ipv6/seg6_local.c                         |   9 +-
 net/mpls/af_mpls.c                            |  26 ++-
 net/mpls/mpls_iptunnel.c                      |   4 +-
 net/ncsi/ncsi-netlink.c                       |   4 +-
 net/netfilter/ipset/ip_set_core.c             |  36 ++-
 net/netfilter/ipvs/ip_vs_ctl.c                |  13 +-
 net/netfilter/nf_conntrack_netlink.c          |  45 ++--
 net/netfilter/nf_conntrack_proto_dccp.c       |   4 +-
 net/netfilter/nf_conntrack_proto_sctp.c       |   4 +-
 net/netfilter/nf_conntrack_proto_tcp.c        |   4 +-
 net/netfilter/nf_nat_core.c                   |   7 +-
 net/netfilter/nf_tables_api.c                 |  48 ++--
 net/netfilter/nfnetlink.c                     |  15 +-
 net/netfilter/nfnetlink_acct.c                |   4 +-
 net/netfilter/nfnetlink_cthelper.c            |  22 +-
 net/netfilter/nfnetlink_cttimeout.c           |   7 +-
 net/netfilter/nfnetlink_queue.c               |   5 +-
 net/netfilter/nft_compat.c                    |   4 +-
 net/netfilter/nft_ct.c                        |   8 +-
 net/netfilter/nft_tunnel.c                    |  21 +-
 net/netlabel/netlabel_cipso_v4.c              |  36 +--
 net/netlink/genetlink.c                       |   5 +-
 net/nfc/netlink.c                             |  12 +-
 net/openvswitch/datapath.c                    |   4 +-
 net/openvswitch/flow_netlink.c                |   9 +-
 net/openvswitch/meter.c                       |   6 +-
 net/openvswitch/vport-vxlan.c                 |   4 +-
 net/phonet/pn_netlink.c                       |   8 +-
 net/qrtr/qrtr.c                               |   3 +-
 net/sched/act_api.c                           |  26 ++-
 net/sched/act_bpf.c                           |   3 +-
 net/sched/act_connmark.c                      |   4 +-
 net/sched/act_csum.c                          |   3 +-
 net/sched/act_gact.c                          |   3 +-
 net/sched/act_ife.c                           |   8 +-
 net/sched/act_ipt.c                           |   3 +-
 net/sched/act_mirred.c                        |   3 +-
 net/sched/act_nat.c                           |   3 +-
 net/sched/act_pedit.c                         |   8 +-
 net/sched/act_police.c                        |   3 +-
 net/sched/act_sample.c                        |   3 +-
 net/sched/act_simple.c                        |   3 +-
 net/sched/act_skbedit.c                       |   3 +-
 net/sched/act_skbmod.c                        |   3 +-
 net/sched/act_tunnel_key.c                    |  13 +-
 net/sched/act_vlan.c                          |   3 +-
 net/sched/cls_api.c                           |  20 +-
 net/sched/cls_basic.c                         |   4 +-
 net/sched/cls_bpf.c                           |   4 +-
 net/sched/cls_cgroup.c                        |   5 +-
 net/sched/cls_flow.c                          |   3 +-
 net/sched/cls_flower.c                        |  25 +-
 net/sched/cls_fw.c                            |   3 +-
 net/sched/cls_matchall.c                      |   4 +-
 net/sched/cls_route.c                         |   3 +-
 net/sched/cls_rsvp.h                          |   3 +-
 net/sched/cls_tcindex.c                       |   3 +-
 net/sched/cls_u32.c                           |   3 +-
 net/sched/em_ipt.c                            |   4 +-
 net/sched/em_meta.c                           |   3 +-
 net/sched/ematch.c                            |   3 +-
 net/sched/sch_api.c                           |  19 +-
 net/sched/sch_atm.c                           |   3 +-
 net/sched/sch_cake.c                          |   3 +-
 net/sched/sch_cbq.c                           |   6 +-
 net/sched/sch_cbs.c                           |   3 +-
 net/sched/sch_choke.c                         |   3 +-
 net/sched/sch_codel.c                         |   3 +-
 net/sched/sch_drr.c                           |   3 +-
 net/sched/sch_dsmark.c                        |   6 +-
 net/sched/sch_etf.c                           |   3 +-
 net/sched/sch_fq.c                            |   3 +-
 net/sched/sch_fq_codel.c                      |   4 +-
 net/sched/sch_gred.c                          |  17 +-
 net/sched/sch_hfsc.c                          |   3 +-
 net/sched/sch_hhf.c                           |   3 +-
 net/sched/sch_htb.c                           |   6 +-
 net/sched/sch_mqprio.c                        |   5 +-
 net/sched/sch_netem.c                         |   5 +-
 net/sched/sch_pie.c                           |   3 +-
 net/sched/sch_qfq.c                           |   4 +-
 net/sched/sch_red.c                           |   3 +-
 net/sched/sch_sfb.c                           |   3 +-
 net/sched/sch_taprio.c                        |  19 +-
 net/sched/sch_tbf.c                           |   3 +-
 net/tipc/bearer.c                             |  42 ++--
 net/tipc/link.c                               |   4 +-
 net/tipc/net.c                                |   6 +-
 net/tipc/netlink.c                            |   4 +-
 net/tipc/netlink_compat.c                     |  63 ++---
 net/tipc/node.c                               |  38 +--
 net/tipc/socket.c                             |   6 +-
 net/tipc/udp_media.c                          |  13 +-
 net/wireless/nl80211.c                        | 191 +++++++++-------
 net/wireless/pmsr.c                           |  18 +-
 net/xfrm/xfrm_user.c                          |  10 +-
 145 files changed, 1214 insertions(+), 933 deletions(-)

Message ID	20190404065408.5864-3-johannes@sipsolutions.net
State	Changes Requested
Delegated to:	David Miller
Headers	show Return-Path: <netdev-owner@vger.kernel.org> X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=<UNKNOWN>) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=sipsolutions.net Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 44ZYbF2RsVz9sRV for <patchwork-incoming-netdev@ozlabs.org>; Thu, 4 Apr 2019 17:54:33 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727266AbfDDGyc (ORCPT <rfc822;patchwork-incoming-netdev@ozlabs.org>); Thu, 4 Apr 2019 02:54:32 -0400 Received: from s3.sipsolutions.net ([144.76.43.62]:55732 "EHLO sipsolutions.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726031AbfDDGya (ORCPT <rfc822;netdev@vger.kernel.org>); Thu, 4 Apr 2019 02:54:30 -0400 Received: by sipsolutions.net with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92-RC5) (envelope-from <johannes@sipsolutions.net>) id 1hBwGN-0003Pn-BK; Thu, 04 Apr 2019 08:54:15 +0200 From: Johannes Berg <johannes@sipsolutions.net> To: linux-wireless@vger.kernel.org, netdev@vger.kernel.org Cc: Pablo Neira Ayuso <pablo@netfilter.org>, David Ahern <dsa@cumulusnetworks.com>, Johannes Berg <johannes.berg@intel.com> Subject: [PATCH 2/6] netlink: make validation more configurable for future strictness Date: Thu, 4 Apr 2019 08:54:04 +0200 Message-Id: <20190404065408.5864-3-johannes@sipsolutions.net> X-Mailer: git-send-email 2.17.2 In-Reply-To: <20190404065408.5864-1-johannes@sipsolutions.net> References: <20190404065408.5864-1-johannes@sipsolutions.net> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: <netdev.vger.kernel.org> X-Mailing-List: netdev@vger.kernel.org
Series	stricter netlink validation \| expand [0/6] stricter netlink validation [1/6] netlink: add NLA_MIN_LEN [2/6] netlink: make validation more configurable for future strictness [3/6] netlink: re-add parse/validate functions in strict mode [4/6] netlink: add strict parsing for future attributes [5/6] genetlink: optionally validate strictly/dumps [6/6] nl80211: tag policies with strict_start_type

[2/6] netlink: make validation more configurable for future strictness

Commit Message

Comments

Patch