From patchwork Thu Jan 17 22:52:58 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jakub Kicinski X-Patchwork-Id: 1027031 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=netronome.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=netronome-com.20150623.gappssmtp.com header.i=@netronome-com.20150623.gappssmtp.com header.b="YEgM0KZq"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 43gfWC3Vhpz9sBZ for ; Fri, 18 Jan 2019 09:53:27 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726896AbfAQWx0 (ORCPT ); Thu, 17 Jan 2019 17:53:26 -0500 Received: from mail-pf1-f195.google.com ([209.85.210.195]:45228 "EHLO mail-pf1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726836AbfAQWxW (ORCPT ); Thu, 17 Jan 2019 17:53:22 -0500 Received: by mail-pf1-f195.google.com with SMTP id g62so5528695pfd.12 for ; Thu, 17 Jan 2019 14:53:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=netronome-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=l/WQB7O2V0Bmzn7csuUWZ9fFNsh0/GjHA07yHXCoqE8=; b=YEgM0KZqmqF9RjWaOR2c013EJQLfchK1vhuOztNy8/Hsw+jZXDRc0M55qNXhZBPV6k YscMpwLnbgpfVoF6h3kWkeqpqQazlVq4FNMK+W0QHBwMyJHAH89kImVSKfCw+kAcTs7j dTv7Lo+nv0qtnaMudKT/11/iezr8Vg9kpc29JTVf0K/OoobHgH17wiHbNzg2mVk0kEJ3 Pd5KkhijDOAXU1cPAbx2H3ZcQYFoS3ZnTYjG/fiuQ+KFuUv7PwVCO6zc0mIM1PSE+v2K ZJCi9E4/iWnOHGNktl2cbRZkp0w83g3ANRqJW1Y2b6pLEJjYgtoinTyZ16bM6U1T9gwM 619w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=l/WQB7O2V0Bmzn7csuUWZ9fFNsh0/GjHA07yHXCoqE8=; b=ZeukOIJwh86wyggblqQ6gwyww6K89Hc2q1yhPNDoPZPQy7T3N1JXFmrYOzo5LSOlZQ PBvP6v13RZqiTn5Y0J/6xPWriikjroM83JD79g6p0VWz4ctJSOwybFGGXMd0qjOOvEcD C+HmeAOUM57cJwheFL7gai+fn37fLYbcvD9484xUSb9Q945dLMubT7Fs/EmzlnJNrnh5 2UOUY58labUd4IvK5Fq0e5ZjWTOkCZmTCeZ82KMgxx+D/c62Kfk6as4Sp51y2gBVdtgj PC9JjQZhS/W7ESKNUkodrjJxy5afeibEzYiwlK/Nc7alHoPW9KY325NP4o9F+lBpqPOZ Th3g== X-Gm-Message-State: AJcUukdMaColqgQqX/YjIHYMWQBnucwFi5Zl8eKgiziOA5L7OjfEP0fn 6UXMNYLs0D2RBWuKG1oMg4O+xg== X-Google-Smtp-Source: ALg8bN6NudMDwlzfJWAbOkp55xOYCIfXfAdCvrKZg2ljyfCR646FqWT4hQsZm/N0Cn/mzgiDDkOjWw== X-Received: by 2002:a63:314d:: with SMTP id x74mr15127794pgx.10.1547765601525; Thu, 17 Jan 2019 14:53:21 -0800 (PST) Received: from jkicinski-Precision-T1700.netronome.com ([66.60.152.14]) by smtp.gmail.com with ESMTPSA id j9sm3436324pfi.86.2019.01.17.14.53.20 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 17 Jan 2019 14:53:21 -0800 (PST) From: Jakub Kicinski To: davem@davemloft.net, dsahern@gmail.com Cc: netdev@vger.kernel.org, oss-drivers@netronome.com, Jakub Kicinski Subject: [PATCH net-next 11/13] net: ipv6: route: perform strict checks also for doit handlers Date: Thu, 17 Jan 2019 14:52:58 -0800 Message-Id: <20190117225300.8006-12-jakub.kicinski@netronome.com> X-Mailer: git-send-email 2.19.2 In-Reply-To: <20190117225300.8006-1-jakub.kicinski@netronome.com> References: <20190117225300.8006-1-jakub.kicinski@netronome.com> MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Make RTM_GETROUTE's doit handler use strict checks when NETLINK_F_STRICT_CHK is set. Signed-off-by: Jakub Kicinski --- net/ipv6/route.c | 70 ++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 68 insertions(+), 2 deletions(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 964491cf3672..dc066fdf7e46 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -4812,6 +4812,73 @@ int rt6_dump_route(struct fib6_info *rt, void *p_arg) arg->cb->nlh->nlmsg_seq, flags); } +static int inet6_rtm_valid_getroute_req(struct sk_buff *skb, + const struct nlmsghdr *nlh, + struct nlattr **tb, + struct netlink_ext_ack *extack) +{ + struct rtmsg *rtm; + int i, err; + + if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*rtm))) { + NL_SET_ERR_MSG_MOD(extack, + "Invalid header for get route request"); + return -EINVAL; + } + + if (!netlink_strict_get_check(skb)) + return nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, + rtm_ipv6_policy, extack); + + rtm = nlmsg_data(nlh); + if ((rtm->rtm_src_len && rtm->rtm_src_len != 128) || + (rtm->rtm_dst_len && rtm->rtm_dst_len != 128) || + rtm->rtm_table || rtm->rtm_protocol || rtm->rtm_scope || + rtm->rtm_type) { + NL_SET_ERR_MSG_MOD(extack, "Invalid values in header for get route request"); + return -EINVAL; + } + if (rtm->rtm_flags & ~RTM_F_FIB_MATCH) { + NL_SET_ERR_MSG_MOD(extack, + "Invalid flags for get route request"); + return -EINVAL; + } + + err = nlmsg_parse_strict(nlh, sizeof(*rtm), tb, RTA_MAX, + rtm_ipv6_policy, extack); + if (err) + return err; + + if ((tb[RTA_SRC] && !rtm->rtm_src_len) || + (tb[RTA_DST] && !rtm->rtm_dst_len)) { + NL_SET_ERR_MSG_MOD(extack, "rtm_src_len and rtm_dst_len must be 128 for IPv6"); + return -EINVAL; + } + + for (i = 0; i <= RTA_MAX; i++) { + if (!tb[i]) + continue; + + switch (i) { + case RTA_SRC: + case RTA_DST: + case RTA_IIF: + case RTA_OIF: + case RTA_MARK: + case RTA_UID: + case RTA_SPORT: + case RTA_DPORT: + case RTA_IP_PROTO: + break; + default: + NL_SET_ERR_MSG_MOD(extack, "Unsupported attribute in get route request"); + return -EINVAL; + } + } + + return 0; +} + static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh, struct netlink_ext_ack *extack) { @@ -4826,8 +4893,7 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh, struct flowi6 fl6 = {}; bool fibmatch; - err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv6_policy, - extack); + err = inet6_rtm_valid_getroute_req(in_skb, nlh, tb, extack); if (err < 0) goto errout;