releases/4.19.29/netfilter-xt_tee-fix-wrong-interface-selection.patch

   1 From 1c742b9bdd199e302da488def5c4292d50b6aff8 Mon Sep 17 00:00:00 2001
   2 From: Taehee Yoo <ap420073@gmail.com>
   3 Date: Sun, 7 Oct 2018 00:09:18 +0900
   4 Subject: netfilter: xt_TEE: fix wrong interface selection
   5
   6 [ Upstream commit f24d2d4f9586985509320f90308723d3d0c4e47f ]
   7
   8 TEE netdevice notifier handler checks only interface name. however
   9 each netns can have same interface name. hence other netns's interface
  10 could be selected.
  11
  12 test commands:
  13    %ip netns add vm1
  14    %iptables -I INPUT -p icmp -j TEE --gateway 192.168.1.1 --oif enp2s0
  15    %ip link set enp2s0 netns vm1
  16
  17 Above rule is in the root netns. but that rule could get enp2s0
  18 ifindex of vm1 by notifier handler.
  19
  20 After this patch, TEE rule is added to the per-netns list.
  21
  22 Fixes: 9e2f6c5d78db ("netfilter: Rework xt_TEE netdevice notifier")
  23 Signed-off-by: Taehee Yoo <ap420073@gmail.com>
  24 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  25 Signed-off-by: Sasha Levin <sashal@kernel.org>
  26 ---
  27  net/netfilter/xt_TEE.c | 69 +++++++++++++++++++++++++++++++-----------
  28  1 file changed, 52 insertions(+), 17 deletions(-)
  29
  30 diff --git a/net/netfilter/xt_TEE.c b/net/netfilter/xt_TEE.c
  31 index 0d0d68c989df..673ad2099f97 100644
  32 --- a/net/netfilter/xt_TEE.c
  33 +++ b/net/netfilter/xt_TEE.c
  34 @@ -14,6 +14,8 @@
  35  #include <linux/skbuff.h>
  36  #include <linux/route.h>
  37  #include <linux/netfilter/x_tables.h>
  38 +#include <net/net_namespace.h>
  39 +#include <net/netns/generic.h>
  40  #include <net/route.h>
  41  #include <net/netfilter/ipv4/nf_dup_ipv4.h>
  42  #include <net/netfilter/ipv6/nf_dup_ipv6.h>
  43 @@ -25,8 +27,15 @@ struct xt_tee_priv {
  44         int                     oif;
  45  };
  46
  47 +static unsigned int tee_net_id __read_mostly;
  48  static const union nf_inet_addr tee_zero_address;
  49
  50 +struct tee_net {
  51 +       struct list_head priv_list;
  52 +       /* lock protects the priv_list */
  53 +       struct mutex lock;
  54 +};
  55 +
  56  static unsigned int
  57  tee_tg4(struct sk_buff *skb, const struct xt_action_param *par)
  58  {
  59 @@ -51,17 +60,16 @@ tee_tg6(struct sk_buff *skb, const struct xt_action_param *par)
  60  }
  61  #endif
  62
  63 -static DEFINE_MUTEX(priv_list_mutex);
  64 -static LIST_HEAD(priv_list);
  65 -
  66  static int tee_netdev_event(struct notifier_block *this, unsigned long event,
  67                             void *ptr)
  68  {
  69         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
  70 +       struct net *net = dev_net(dev);
  71 +       struct tee_net *tn = net_generic(net, tee_net_id);
  72         struct xt_tee_priv *priv;
  73
  74 -       mutex_lock(&priv_list_mutex);
  75 -       list_for_each_entry(priv, &priv_list, list) {
  76 +       mutex_lock(&tn->lock);
  77 +       list_for_each_entry(priv, &tn->priv_list, list) {
  78                 switch (event) {
  79                 case NETDEV_REGISTER:
  80                         if (!strcmp(dev->name, priv->tginfo->oif))
  81 @@ -79,13 +87,14 @@ static int tee_netdev_event(struct notifier_block *this, unsigned long event,
  82                         break;
  83                 }
  84         }
  85 -       mutex_unlock(&priv_list_mutex);
  86 +       mutex_unlock(&tn->lock);
  87
  88         return NOTIFY_DONE;
  89  }
  90
  91  static int tee_tg_check(const struct xt_tgchk_param *par)
  92  {
  93 +       struct tee_net *tn = net_generic(par->net, tee_net_id);
  94         struct xt_tee_tginfo *info = par->targinfo;
  95         struct xt_tee_priv *priv;
  96
  97 @@ -106,9 +115,9 @@ static int tee_tg_check(const struct xt_tgchk_param *par)
  98                 priv->oif     = -1;
  99                 info->priv    = priv;
 100
 101 -               mutex_lock(&priv_list_mutex);
 102 -               list_add(&priv->list, &priv_list);
 103 -               mutex_unlock(&priv_list_mutex);
 104 +               mutex_lock(&tn->lock);
 105 +               list_add(&priv->list, &tn->priv_list);
 106 +               mutex_unlock(&tn->lock);
 107         } else
 108                 info->priv = NULL;
 109
 110 @@ -118,12 +127,13 @@ static int tee_tg_check(const struct xt_tgchk_param *par)
 111
 112  static void tee_tg_destroy(const struct xt_tgdtor_param *par)
 113  {
 114 +       struct tee_net *tn = net_generic(par->net, tee_net_id);
 115         struct xt_tee_tginfo *info = par->targinfo;
 116
 117         if (info->priv) {
 118 -               mutex_lock(&priv_list_mutex);
 119 +               mutex_lock(&tn->lock);
 120                 list_del(&info->priv->list);
 121 -               mutex_unlock(&priv_list_mutex);
 122 +               mutex_unlock(&tn->lock);
 123                 kfree(info->priv);
 124         }
 125         static_key_slow_dec(&xt_tee_enabled);
 126 @@ -156,6 +166,21 @@ static struct xt_target tee_tg_reg[] __read_mostly = {
 127  #endif
 128  };
 129
 130 +static int __net_init tee_net_init(struct net *net)
 131 +{
 132 +       struct tee_net *tn = net_generic(net, tee_net_id);
 133 +
 134 +       INIT_LIST_HEAD(&tn->priv_list);
 135 +       mutex_init(&tn->lock);
 136 +       return 0;
 137 +}
 138 +
 139 +static struct pernet_operations tee_net_ops = {
 140 +       .init = tee_net_init,
 141 +       .id   = &tee_net_id,
 142 +       .size = sizeof(struct tee_net),
 143 +};
 144 +
 145  static struct notifier_block tee_netdev_notifier = {
 146         .notifier_call = tee_netdev_event,
 147  };
 148 @@ -164,22 +189,32 @@ static int __init tee_tg_init(void)
 149  {
 150         int ret;
 151
 152 -       ret = xt_register_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
 153 -       if (ret)
 154 +       ret = register_pernet_subsys(&tee_net_ops);
 155 +       if (ret < 0)
 156                 return ret;
 157 +
 158 +       ret = xt_register_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
 159 +       if (ret < 0)
 160 +               goto cleanup_subsys;
 161 +
 162         ret = register_netdevice_notifier(&tee_netdev_notifier);
 163 -       if (ret) {
 164 -               xt_unregister_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
 165 -               return ret;
 166 -       }
 167 +       if (ret < 0)
 168 +               goto unregister_targets;
 169
 170         return 0;
 171 +
 172 +unregister_targets:
 173 +       xt_unregister_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
 174 +cleanup_subsys:
 175 +       unregister_pernet_subsys(&tee_net_ops);
 176 +       return ret;
 177  }
 178
 179  static void __exit tee_tg_exit(void)
 180  {
 181         unregister_netdevice_notifier(&tee_netdev_notifier);
 182         xt_unregister_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
 183 +       unregister_pernet_subsys(&tee_net_ops);
 184  }
 185
 186  module_init(tee_tg_init);
 187 --
 188 2.19.1
 189