1
2#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
3
4#include <linux/workqueue.h>
5#include <linux/rtnetlink.h>
6#include <linux/cache.h>
7#include <linux/slab.h>
8#include <linux/list.h>
9#include <linux/delay.h>
10#include <linux/sched.h>
11#include <linux/idr.h>
12#include <linux/rculist.h>
13#include <linux/nsproxy.h>
14#include <linux/fs.h>
15#include <linux/proc_ns.h>
16#include <linux/file.h>
17#include <linux/export.h>
18#include <linux/user_namespace.h>
19#include <linux/net_namespace.h>
20#include <linux/sched/task.h>
21#include <linux/uidgid.h>
22
23#include <net/sock.h>
24#include <net/netlink.h>
25#include <net/net_namespace.h>
26#include <net/netns/generic.h>
27
28
29
30
31
32static LIST_HEAD(pernet_list);
33static struct list_head *first_device = &pernet_list;
34
35LIST_HEAD(net_namespace_list);
36EXPORT_SYMBOL_GPL(net_namespace_list);
37
38
39DECLARE_RWSEM(net_rwsem);
40EXPORT_SYMBOL_GPL(net_rwsem);
41
42#ifdef CONFIG_KEYS
43static struct key_tag init_net_key_domain = { .usage = REFCOUNT_INIT(1) };
44#endif
45
46struct net init_net = {
47 .count = REFCOUNT_INIT(1),
48 .dev_base_head = LIST_HEAD_INIT(init_net.dev_base_head),
49#ifdef CONFIG_KEYS
50 .key_domain = &init_net_key_domain,
51#endif
52};
53EXPORT_SYMBOL(init_net);
54
55static bool init_net_initialized;
56
57
58
59
60
61
62DECLARE_RWSEM(pernet_ops_rwsem);
63EXPORT_SYMBOL_GPL(pernet_ops_rwsem);
64
65#define MIN_PERNET_OPS_ID \
66 ((sizeof(struct net_generic) + sizeof(void *) - 1) / sizeof(void *))
67
68#define INITIAL_NET_GEN_PTRS 13
69
70static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS;
71
72static struct net_generic *net_alloc_generic(void)
73{
74 struct net_generic *ng;
75 unsigned int generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]);
76
77 ng = kzalloc(generic_size, GFP_KERNEL);
78 if (ng)
79 ng->s.len = max_gen_ptrs;
80
81 return ng;
82}
83
84static int net_assign_generic(struct net *net, unsigned int id, void *data)
85{
86 struct net_generic *ng, *old_ng;
87
88 BUG_ON(id < MIN_PERNET_OPS_ID);
89
90 old_ng = rcu_dereference_protected(net->gen,
91 lockdep_is_held(&pernet_ops_rwsem));
92 if (old_ng->s.len > id) {
93 old_ng->ptr[id] = data;
94 return 0;
95 }
96
97 ng = net_alloc_generic();
98 if (ng == NULL)
99 return -ENOMEM;
100
101
102
103
104
105
106
107
108
109
110
111
112 memcpy(&ng->ptr[MIN_PERNET_OPS_ID], &old_ng->ptr[MIN_PERNET_OPS_ID],
113 (old_ng->s.len - MIN_PERNET_OPS_ID) * sizeof(void *));
114 ng->ptr[id] = data;
115
116 rcu_assign_pointer(net->gen, ng);
117 kfree_rcu(old_ng, s.rcu);
118 return 0;
119}
120
121static int ops_init(const struct pernet_operations *ops, struct net *net)
122{
123 int err = -ENOMEM;
124 void *data = NULL;
125
126 if (ops->id && ops->size) {
127 data = kzalloc(ops->size, GFP_KERNEL);
128 if (!data)
129 goto out;
130
131 err = net_assign_generic(net, *ops->id, data);
132 if (err)
133 goto cleanup;
134 }
135 err = 0;
136 if (ops->init)
137 err = ops->init(net);
138 if (!err)
139 return 0;
140
141cleanup:
142 kfree(data);
143
144out:
145 return err;
146}
147
148static void ops_free(const struct pernet_operations *ops, struct net *net)
149{
150 if (ops->id && ops->size) {
151 kfree(net_generic(net, *ops->id));
152 }
153}
154
155static void ops_pre_exit_list(const struct pernet_operations *ops,
156 struct list_head *net_exit_list)
157{
158 struct net *net;
159
160 if (ops->pre_exit) {
161 list_for_each_entry(net, net_exit_list, exit_list)
162 ops->pre_exit(net);
163 }
164}
165
166static void ops_exit_list(const struct pernet_operations *ops,
167 struct list_head *net_exit_list)
168{
169 struct net *net;
170 if (ops->exit) {
171 list_for_each_entry(net, net_exit_list, exit_list)
172 ops->exit(net);
173 }
174 if (ops->exit_batch)
175 ops->exit_batch(net_exit_list);
176}
177
178static void ops_free_list(const struct pernet_operations *ops,
179 struct list_head *net_exit_list)
180{
181 struct net *net;
182 if (ops->size && ops->id) {
183 list_for_each_entry(net, net_exit_list, exit_list)
184 ops_free(ops, net);
185 }
186}
187
188
189static int alloc_netid(struct net *net, struct net *peer, int reqid)
190{
191 int min = 0, max = 0;
192
193 if (reqid >= 0) {
194 min = reqid;
195 max = reqid + 1;
196 }
197
198 return idr_alloc(&net->netns_ids, peer, min, max, GFP_ATOMIC);
199}
200
201
202
203
204
205
206#define NET_ID_ZERO -1
207static int net_eq_idr(int id, void *net, void *peer)
208{
209 if (net_eq(net, peer))
210 return id ? : NET_ID_ZERO;
211 return 0;
212}
213
214
215
216
217
218static int __peernet2id_alloc(struct net *net, struct net *peer, bool *alloc)
219{
220 int id = idr_for_each(&net->netns_ids, net_eq_idr, peer);
221 bool alloc_it = *alloc;
222
223 *alloc = false;
224
225
226 if (id == NET_ID_ZERO)
227 return 0;
228 if (id > 0)
229 return id;
230
231 if (alloc_it) {
232 id = alloc_netid(net, peer, -1);
233 *alloc = true;
234 return id >= 0 ? id : NETNSA_NSID_NOT_ASSIGNED;
235 }
236
237 return NETNSA_NSID_NOT_ASSIGNED;
238}
239
240
241static int __peernet2id(struct net *net, struct net *peer)
242{
243 bool no = false;
244
245 return __peernet2id_alloc(net, peer, &no);
246}
247
248static void rtnl_net_notifyid(struct net *net, int cmd, int id);
249
250
251
252int peernet2id_alloc(struct net *net, struct net *peer)
253{
254 bool alloc = false, alive = false;
255 int id;
256
257 if (refcount_read(&net->count) == 0)
258 return NETNSA_NSID_NOT_ASSIGNED;
259 spin_lock_bh(&net->nsid_lock);
260
261
262
263
264
265
266 if (maybe_get_net(peer))
267 alive = alloc = true;
268 id = __peernet2id_alloc(net, peer, &alloc);
269 spin_unlock_bh(&net->nsid_lock);
270 if (alloc && id >= 0)
271 rtnl_net_notifyid(net, RTM_NEWNSID, id);
272 if (alive)
273 put_net(peer);
274 return id;
275}
276EXPORT_SYMBOL_GPL(peernet2id_alloc);
277
278
279int peernet2id(struct net *net, struct net *peer)
280{
281 int id;
282
283 spin_lock_bh(&net->nsid_lock);
284 id = __peernet2id(net, peer);
285 spin_unlock_bh(&net->nsid_lock);
286 return id;
287}
288EXPORT_SYMBOL(peernet2id);
289
290
291
292
293bool peernet_has_id(struct net *net, struct net *peer)
294{
295 return peernet2id(net, peer) >= 0;
296}
297
298struct net *get_net_ns_by_id(struct net *net, int id)
299{
300 struct net *peer;
301
302 if (id < 0)
303 return NULL;
304
305 rcu_read_lock();
306 peer = idr_find(&net->netns_ids, id);
307 if (peer)
308 peer = maybe_get_net(peer);
309 rcu_read_unlock();
310
311 return peer;
312}
313
314
315
316
317static __net_init int setup_net(struct net *net, struct user_namespace *user_ns)
318{
319
320 const struct pernet_operations *ops, *saved_ops;
321 int error = 0;
322 LIST_HEAD(net_exit_list);
323
324 refcount_set(&net->count, 1);
325 refcount_set(&net->passive, 1);
326 get_random_bytes(&net->hash_mix, sizeof(u32));
327 net->dev_base_seq = 1;
328 net->user_ns = user_ns;
329 idr_init(&net->netns_ids);
330 spin_lock_init(&net->nsid_lock);
331 mutex_init(&net->ipv4.ra_mutex);
332
333 list_for_each_entry(ops, &pernet_list, list) {
334 error = ops_init(ops, net);
335 if (error < 0)
336 goto out_undo;
337 }
338 down_write(&net_rwsem);
339 list_add_tail_rcu(&net->list, &net_namespace_list);
340 up_write(&net_rwsem);
341out:
342 return error;
343
344out_undo:
345
346
347
348 list_add(&net->exit_list, &net_exit_list);
349 saved_ops = ops;
350 list_for_each_entry_continue_reverse(ops, &pernet_list, list)
351 ops_pre_exit_list(ops, &net_exit_list);
352
353 synchronize_rcu();
354
355 ops = saved_ops;
356 list_for_each_entry_continue_reverse(ops, &pernet_list, list)
357 ops_exit_list(ops, &net_exit_list);
358
359 ops = saved_ops;
360 list_for_each_entry_continue_reverse(ops, &pernet_list, list)
361 ops_free_list(ops, &net_exit_list);
362
363 rcu_barrier();
364 goto out;
365}
366
367static int __net_init net_defaults_init_net(struct net *net)
368{
369 net->core.sysctl_somaxconn = SOMAXCONN;
370 return 0;
371}
372
373static struct pernet_operations net_defaults_ops = {
374 .init = net_defaults_init_net,
375};
376
377static __init int net_defaults_init(void)
378{
379 if (register_pernet_subsys(&net_defaults_ops))
380 panic("Cannot initialize net default settings");
381
382 return 0;
383}
384
385core_initcall(net_defaults_init);
386
387#ifdef CONFIG_NET_NS
388static struct ucounts *inc_net_namespaces(struct user_namespace *ns)
389{
390 return inc_ucount(ns, current_euid(), UCOUNT_NET_NAMESPACES);
391}
392
393static void dec_net_namespaces(struct ucounts *ucounts)
394{
395 dec_ucount(ucounts, UCOUNT_NET_NAMESPACES);
396}
397
398static struct kmem_cache *net_cachep __ro_after_init;
399static struct workqueue_struct *netns_wq;
400
401static struct net *net_alloc(void)
402{
403 struct net *net = NULL;
404 struct net_generic *ng;
405
406 ng = net_alloc_generic();
407 if (!ng)
408 goto out;
409
410 net = kmem_cache_zalloc(net_cachep, GFP_KERNEL);
411 if (!net)
412 goto out_free;
413
414#ifdef CONFIG_KEYS
415 net->key_domain = kzalloc(sizeof(struct key_tag), GFP_KERNEL);
416 if (!net->key_domain)
417 goto out_free_2;
418 refcount_set(&net->key_domain->usage, 1);
419#endif
420
421 rcu_assign_pointer(net->gen, ng);
422out:
423 return net;
424
425#ifdef CONFIG_KEYS
426out_free_2:
427 kmem_cache_free(net_cachep, net);
428 net = NULL;
429#endif
430out_free:
431 kfree(ng);
432 goto out;
433}
434
435static void net_free(struct net *net)
436{
437 kfree(rcu_access_pointer(net->gen));
438 kmem_cache_free(net_cachep, net);
439}
440
441void net_drop_ns(void *p)
442{
443 struct net *ns = p;
444 if (ns && refcount_dec_and_test(&ns->passive))
445 net_free(ns);
446}
447
448struct net *copy_net_ns(unsigned long flags,
449 struct user_namespace *user_ns, struct net *old_net)
450{
451 struct ucounts *ucounts;
452 struct net *net;
453 int rv;
454
455 if (!(flags & CLONE_NEWNET))
456 return get_net(old_net);
457
458 ucounts = inc_net_namespaces(user_ns);
459 if (!ucounts)
460 return ERR_PTR(-ENOSPC);
461
462 net = net_alloc();
463 if (!net) {
464 rv = -ENOMEM;
465 goto dec_ucounts;
466 }
467 refcount_set(&net->passive, 1);
468 net->ucounts = ucounts;
469 get_user_ns(user_ns);
470
471 rv = down_read_killable(&pernet_ops_rwsem);
472 if (rv < 0)
473 goto put_userns;
474
475 rv = setup_net(net, user_ns);
476
477 up_read(&pernet_ops_rwsem);
478
479 if (rv < 0) {
480put_userns:
481 put_user_ns(user_ns);
482 net_drop_ns(net);
483dec_ucounts:
484 dec_net_namespaces(ucounts);
485 return ERR_PTR(rv);
486 }
487 return net;
488}
489
490
491
492
493
494
495
496
497
498
499void net_ns_get_ownership(const struct net *net, kuid_t *uid, kgid_t *gid)
500{
501 if (net) {
502 kuid_t ns_root_uid = make_kuid(net->user_ns, 0);
503 kgid_t ns_root_gid = make_kgid(net->user_ns, 0);
504
505 if (uid_valid(ns_root_uid))
506 *uid = ns_root_uid;
507
508 if (gid_valid(ns_root_gid))
509 *gid = ns_root_gid;
510 } else {
511 *uid = GLOBAL_ROOT_UID;
512 *gid = GLOBAL_ROOT_GID;
513 }
514}
515EXPORT_SYMBOL_GPL(net_ns_get_ownership);
516
517static void unhash_nsid(struct net *net, struct net *last)
518{
519 struct net *tmp;
520
521
522
523
524
525
526 for_each_net(tmp) {
527 int id;
528
529 spin_lock_bh(&tmp->nsid_lock);
530 id = __peernet2id(tmp, net);
531 if (id >= 0)
532 idr_remove(&tmp->netns_ids, id);
533 spin_unlock_bh(&tmp->nsid_lock);
534 if (id >= 0)
535 rtnl_net_notifyid(tmp, RTM_DELNSID, id);
536 if (tmp == last)
537 break;
538 }
539 spin_lock_bh(&net->nsid_lock);
540 idr_destroy(&net->netns_ids);
541 spin_unlock_bh(&net->nsid_lock);
542}
543
544static LLIST_HEAD(cleanup_list);
545
546static void cleanup_net(struct work_struct *work)
547{
548 const struct pernet_operations *ops;
549 struct net *net, *tmp, *last;
550 struct llist_node *net_kill_list;
551 LIST_HEAD(net_exit_list);
552
553
554 net_kill_list = llist_del_all(&cleanup_list);
555
556 down_read(&pernet_ops_rwsem);
557
558
559 down_write(&net_rwsem);
560 llist_for_each_entry(net, net_kill_list, cleanup_list)
561 list_del_rcu(&net->list);
562
563
564
565
566
567
568
569
570
571
572 last = list_last_entry(&net_namespace_list, struct net, list);
573 up_write(&net_rwsem);
574
575 llist_for_each_entry(net, net_kill_list, cleanup_list) {
576 unhash_nsid(net, last);
577 list_add_tail(&net->exit_list, &net_exit_list);
578 }
579
580
581 list_for_each_entry_reverse(ops, &pernet_list, list)
582 ops_pre_exit_list(ops, &net_exit_list);
583
584
585
586
587
588
589
590 synchronize_rcu();
591
592
593 list_for_each_entry_reverse(ops, &pernet_list, list)
594 ops_exit_list(ops, &net_exit_list);
595
596
597 list_for_each_entry_reverse(ops, &pernet_list, list)
598 ops_free_list(ops, &net_exit_list);
599
600 up_read(&pernet_ops_rwsem);
601
602
603
604
605 rcu_barrier();
606
607
608 list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) {
609 list_del_init(&net->exit_list);
610 dec_net_namespaces(net->ucounts);
611 key_remove_domain(net->key_domain);
612 put_user_ns(net->user_ns);
613 net_drop_ns(net);
614 }
615}
616
617
618
619
620
621
622
623
624
625
626void net_ns_barrier(void)
627{
628 down_write(&pernet_ops_rwsem);
629 up_write(&pernet_ops_rwsem);
630}
631EXPORT_SYMBOL(net_ns_barrier);
632
633static DECLARE_WORK(net_cleanup_work, cleanup_net);
634
635void __put_net(struct net *net)
636{
637
638 if (llist_add(&net->cleanup_list, &cleanup_list))
639 queue_work(netns_wq, &net_cleanup_work);
640}
641EXPORT_SYMBOL_GPL(__put_net);
642
643struct net *get_net_ns_by_fd(int fd)
644{
645 struct file *file;
646 struct ns_common *ns;
647 struct net *net;
648
649 file = proc_ns_fget(fd);
650 if (IS_ERR(file))
651 return ERR_CAST(file);
652
653 ns = get_proc_ns(file_inode(file));
654 if (ns->ops == &netns_operations)
655 net = get_net(container_of(ns, struct net, ns));
656 else
657 net = ERR_PTR(-EINVAL);
658
659 fput(file);
660 return net;
661}
662
663#else
664struct net *get_net_ns_by_fd(int fd)
665{
666 return ERR_PTR(-EINVAL);
667}
668#endif
669EXPORT_SYMBOL_GPL(get_net_ns_by_fd);
670
671struct net *get_net_ns_by_pid(pid_t pid)
672{
673 struct task_struct *tsk;
674 struct net *net;
675
676
677 net = ERR_PTR(-ESRCH);
678 rcu_read_lock();
679 tsk = find_task_by_vpid(pid);
680 if (tsk) {
681 struct nsproxy *nsproxy;
682 task_lock(tsk);
683 nsproxy = tsk->nsproxy;
684 if (nsproxy)
685 net = get_net(nsproxy->net_ns);
686 task_unlock(tsk);
687 }
688 rcu_read_unlock();
689 return net;
690}
691EXPORT_SYMBOL_GPL(get_net_ns_by_pid);
692
693static __net_init int net_ns_net_init(struct net *net)
694{
695#ifdef CONFIG_NET_NS
696 net->ns.ops = &netns_operations;
697#endif
698 return ns_alloc_inum(&net->ns);
699}
700
701static __net_exit void net_ns_net_exit(struct net *net)
702{
703 ns_free_inum(&net->ns);
704}
705
706static struct pernet_operations __net_initdata net_ns_ops = {
707 .init = net_ns_net_init,
708 .exit = net_ns_net_exit,
709};
710
711static const struct nla_policy rtnl_net_policy[NETNSA_MAX + 1] = {
712 [NETNSA_NONE] = { .type = NLA_UNSPEC },
713 [NETNSA_NSID] = { .type = NLA_S32 },
714 [NETNSA_PID] = { .type = NLA_U32 },
715 [NETNSA_FD] = { .type = NLA_U32 },
716 [NETNSA_TARGET_NSID] = { .type = NLA_S32 },
717};
718
719static int rtnl_net_newid(struct sk_buff *skb, struct nlmsghdr *nlh,
720 struct netlink_ext_ack *extack)
721{
722 struct net *net = sock_net(skb->sk);
723 struct nlattr *tb[NETNSA_MAX + 1];
724 struct nlattr *nla;
725 struct net *peer;
726 int nsid, err;
727
728 err = nlmsg_parse_deprecated(nlh, sizeof(struct rtgenmsg), tb,
729 NETNSA_MAX, rtnl_net_policy, extack);
730 if (err < 0)
731 return err;
732 if (!tb[NETNSA_NSID]) {
733 NL_SET_ERR_MSG(extack, "nsid is missing");
734 return -EINVAL;
735 }
736 nsid = nla_get_s32(tb[NETNSA_NSID]);
737
738 if (tb[NETNSA_PID]) {
739 peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID]));
740 nla = tb[NETNSA_PID];
741 } else if (tb[NETNSA_FD]) {
742 peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD]));
743 nla = tb[NETNSA_FD];
744 } else {
745 NL_SET_ERR_MSG(extack, "Peer netns reference is missing");
746 return -EINVAL;
747 }
748 if (IS_ERR(peer)) {
749 NL_SET_BAD_ATTR(extack, nla);
750 NL_SET_ERR_MSG(extack, "Peer netns reference is invalid");
751 return PTR_ERR(peer);
752 }
753
754 spin_lock_bh(&net->nsid_lock);
755 if (__peernet2id(net, peer) >= 0) {
756 spin_unlock_bh(&net->nsid_lock);
757 err = -EEXIST;
758 NL_SET_BAD_ATTR(extack, nla);
759 NL_SET_ERR_MSG(extack,
760 "Peer netns already has a nsid assigned");
761 goto out;
762 }
763
764 err = alloc_netid(net, peer, nsid);
765 spin_unlock_bh(&net->nsid_lock);
766 if (err >= 0) {
767 rtnl_net_notifyid(net, RTM_NEWNSID, err);
768 err = 0;
769 } else if (err == -ENOSPC && nsid >= 0) {
770 err = -EEXIST;
771 NL_SET_BAD_ATTR(extack, tb[NETNSA_NSID]);
772 NL_SET_ERR_MSG(extack, "The specified nsid is already used");
773 }
774out:
775 put_net(peer);
776 return err;
777}
778
779static int rtnl_net_get_size(void)
780{
781 return NLMSG_ALIGN(sizeof(struct rtgenmsg))
782 + nla_total_size(sizeof(s32))
783 + nla_total_size(sizeof(s32))
784 ;
785}
786
787struct net_fill_args {
788 u32 portid;
789 u32 seq;
790 int flags;
791 int cmd;
792 int nsid;
793 bool add_ref;
794 int ref_nsid;
795};
796
797static int rtnl_net_fill(struct sk_buff *skb, struct net_fill_args *args)
798{
799 struct nlmsghdr *nlh;
800 struct rtgenmsg *rth;
801
802 nlh = nlmsg_put(skb, args->portid, args->seq, args->cmd, sizeof(*rth),
803 args->flags);
804 if (!nlh)
805 return -EMSGSIZE;
806
807 rth = nlmsg_data(nlh);
808 rth->rtgen_family = AF_UNSPEC;
809
810 if (nla_put_s32(skb, NETNSA_NSID, args->nsid))
811 goto nla_put_failure;
812
813 if (args->add_ref &&
814 nla_put_s32(skb, NETNSA_CURRENT_NSID, args->ref_nsid))
815 goto nla_put_failure;
816
817 nlmsg_end(skb, nlh);
818 return 0;
819
820nla_put_failure:
821 nlmsg_cancel(skb, nlh);
822 return -EMSGSIZE;
823}
824
825static int rtnl_net_valid_getid_req(struct sk_buff *skb,
826 const struct nlmsghdr *nlh,
827 struct nlattr **tb,
828 struct netlink_ext_ack *extack)
829{
830 int i, err;
831
832 if (!netlink_strict_get_check(skb))
833 return nlmsg_parse_deprecated(nlh, sizeof(struct rtgenmsg),
834 tb, NETNSA_MAX, rtnl_net_policy,
835 extack);
836
837 err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct rtgenmsg), tb,
838 NETNSA_MAX, rtnl_net_policy,
839 extack);
840 if (err)
841 return err;
842
843 for (i = 0; i <= NETNSA_MAX; i++) {
844 if (!tb[i])
845 continue;
846
847 switch (i) {
848 case NETNSA_PID:
849 case NETNSA_FD:
850 case NETNSA_NSID:
851 case NETNSA_TARGET_NSID:
852 break;
853 default:
854 NL_SET_ERR_MSG(extack, "Unsupported attribute in peer netns getid request");
855 return -EINVAL;
856 }
857 }
858
859 return 0;
860}
861
862static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh,
863 struct netlink_ext_ack *extack)
864{
865 struct net *net = sock_net(skb->sk);
866 struct nlattr *tb[NETNSA_MAX + 1];
867 struct net_fill_args fillargs = {
868 .portid = NETLINK_CB(skb).portid,
869 .seq = nlh->nlmsg_seq,
870 .cmd = RTM_NEWNSID,
871 };
872 struct net *peer, *target = net;
873 struct nlattr *nla;
874 struct sk_buff *msg;
875 int err;
876
877 err = rtnl_net_valid_getid_req(skb, nlh, tb, extack);
878 if (err < 0)
879 return err;
880 if (tb[NETNSA_PID]) {
881 peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID]));
882 nla = tb[NETNSA_PID];
883 } else if (tb[NETNSA_FD]) {
884 peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD]));
885 nla = tb[NETNSA_FD];
886 } else if (tb[NETNSA_NSID]) {
887 peer = get_net_ns_by_id(net, nla_get_s32(tb[NETNSA_NSID]));
888 if (!peer)
889 peer = ERR_PTR(-ENOENT);
890 nla = tb[NETNSA_NSID];
891 } else {
892 NL_SET_ERR_MSG(extack, "Peer netns reference is missing");
893 return -EINVAL;
894 }
895
896 if (IS_ERR(peer)) {
897 NL_SET_BAD_ATTR(extack, nla);
898 NL_SET_ERR_MSG(extack, "Peer netns reference is invalid");
899 return PTR_ERR(peer);
900 }
901
902 if (tb[NETNSA_TARGET_NSID]) {
903 int id = nla_get_s32(tb[NETNSA_TARGET_NSID]);
904
905 target = rtnl_get_net_ns_capable(NETLINK_CB(skb).sk, id);
906 if (IS_ERR(target)) {
907 NL_SET_BAD_ATTR(extack, tb[NETNSA_TARGET_NSID]);
908 NL_SET_ERR_MSG(extack,
909 "Target netns reference is invalid");
910 err = PTR_ERR(target);
911 goto out;
912 }
913 fillargs.add_ref = true;
914 fillargs.ref_nsid = peernet2id(net, peer);
915 }
916
917 msg = nlmsg_new(rtnl_net_get_size(), GFP_KERNEL);
918 if (!msg) {
919 err = -ENOMEM;
920 goto out;
921 }
922
923 fillargs.nsid = peernet2id(target, peer);
924 err = rtnl_net_fill(msg, &fillargs);
925 if (err < 0)
926 goto err_out;
927
928 err = rtnl_unicast(msg, net, NETLINK_CB(skb).portid);
929 goto out;
930
931err_out:
932 nlmsg_free(msg);
933out:
934 if (fillargs.add_ref)
935 put_net(target);
936 put_net(peer);
937 return err;
938}
939
940struct rtnl_net_dump_cb {
941 struct net *tgt_net;
942 struct net *ref_net;
943 struct sk_buff *skb;
944 struct net_fill_args fillargs;
945 int idx;
946 int s_idx;
947};
948
949static int rtnl_net_dumpid_one(int id, void *peer, void *data)
950{
951 struct rtnl_net_dump_cb *net_cb = (struct rtnl_net_dump_cb *)data;
952 int ret;
953
954 if (net_cb->idx < net_cb->s_idx)
955 goto cont;
956
957 net_cb->fillargs.nsid = id;
958 if (net_cb->fillargs.add_ref)
959 net_cb->fillargs.ref_nsid = __peernet2id(net_cb->ref_net, peer);
960 ret = rtnl_net_fill(net_cb->skb, &net_cb->fillargs);
961 if (ret < 0)
962 return ret;
963
964cont:
965 net_cb->idx++;
966 return 0;
967}
968
969static int rtnl_valid_dump_net_req(const struct nlmsghdr *nlh, struct sock *sk,
970 struct rtnl_net_dump_cb *net_cb,
971 struct netlink_callback *cb)
972{
973 struct netlink_ext_ack *extack = cb->extack;
974 struct nlattr *tb[NETNSA_MAX + 1];
975 int err, i;
976
977 err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct rtgenmsg), tb,
978 NETNSA_MAX, rtnl_net_policy,
979 extack);
980 if (err < 0)
981 return err;
982
983 for (i = 0; i <= NETNSA_MAX; i++) {
984 if (!tb[i])
985 continue;
986
987 if (i == NETNSA_TARGET_NSID) {
988 struct net *net;
989
990 net = rtnl_get_net_ns_capable(sk, nla_get_s32(tb[i]));
991 if (IS_ERR(net)) {
992 NL_SET_BAD_ATTR(extack, tb[i]);
993 NL_SET_ERR_MSG(extack,
994 "Invalid target network namespace id");
995 return PTR_ERR(net);
996 }
997 net_cb->fillargs.add_ref = true;
998 net_cb->ref_net = net_cb->tgt_net;
999 net_cb->tgt_net = net;
1000 } else {
1001 NL_SET_BAD_ATTR(extack, tb[i]);
1002 NL_SET_ERR_MSG(extack,
1003 "Unsupported attribute in dump request");
1004 return -EINVAL;
1005 }
1006 }
1007
1008 return 0;
1009}
1010
1011static int rtnl_net_dumpid(struct sk_buff *skb, struct netlink_callback *cb)
1012{
1013 struct rtnl_net_dump_cb net_cb = {
1014 .tgt_net = sock_net(skb->sk),
1015 .skb = skb,
1016 .fillargs = {
1017 .portid = NETLINK_CB(cb->skb).portid,
1018 .seq = cb->nlh->nlmsg_seq,
1019 .flags = NLM_F_MULTI,
1020 .cmd = RTM_NEWNSID,
1021 },
1022 .idx = 0,
1023 .s_idx = cb->args[0],
1024 };
1025 int err = 0;
1026
1027 if (cb->strict_check) {
1028 err = rtnl_valid_dump_net_req(cb->nlh, skb->sk, &net_cb, cb);
1029 if (err < 0)
1030 goto end;
1031 }
1032
1033 spin_lock_bh(&net_cb.tgt_net->nsid_lock);
1034 if (net_cb.fillargs.add_ref &&
1035 !net_eq(net_cb.ref_net, net_cb.tgt_net) &&
1036 !spin_trylock_bh(&net_cb.ref_net->nsid_lock)) {
1037 spin_unlock_bh(&net_cb.tgt_net->nsid_lock);
1038 err = -EAGAIN;
1039 goto end;
1040 }
1041 idr_for_each(&net_cb.tgt_net->netns_ids, rtnl_net_dumpid_one, &net_cb);
1042 if (net_cb.fillargs.add_ref &&
1043 !net_eq(net_cb.ref_net, net_cb.tgt_net))
1044 spin_unlock_bh(&net_cb.ref_net->nsid_lock);
1045 spin_unlock_bh(&net_cb.tgt_net->nsid_lock);
1046
1047 cb->args[0] = net_cb.idx;
1048end:
1049 if (net_cb.fillargs.add_ref)
1050 put_net(net_cb.tgt_net);
1051 return err < 0 ? err : skb->len;
1052}
1053
1054static void rtnl_net_notifyid(struct net *net, int cmd, int id)
1055{
1056 struct net_fill_args fillargs = {
1057 .cmd = cmd,
1058 .nsid = id,
1059 };
1060 struct sk_buff *msg;
1061 int err = -ENOMEM;
1062
1063 msg = nlmsg_new(rtnl_net_get_size(), GFP_KERNEL);
1064 if (!msg)
1065 goto out;
1066
1067 err = rtnl_net_fill(msg, &fillargs);
1068 if (err < 0)
1069 goto err_out;
1070
1071 rtnl_notify(msg, net, 0, RTNLGRP_NSID, NULL, 0);
1072 return;
1073
1074err_out:
1075 nlmsg_free(msg);
1076out:
1077 rtnl_set_sk_err(net, RTNLGRP_NSID, err);
1078}
1079
1080static int __init net_ns_init(void)
1081{
1082 struct net_generic *ng;
1083
1084#ifdef CONFIG_NET_NS
1085 net_cachep = kmem_cache_create("net_namespace", sizeof(struct net),
1086 SMP_CACHE_BYTES,
1087 SLAB_PANIC|SLAB_ACCOUNT, NULL);
1088
1089
1090 netns_wq = create_singlethread_workqueue("netns");
1091 if (!netns_wq)
1092 panic("Could not create netns workq");
1093#endif
1094
1095 ng = net_alloc_generic();
1096 if (!ng)
1097 panic("Could not allocate generic netns");
1098
1099 rcu_assign_pointer(init_net.gen, ng);
1100
1101 down_write(&pernet_ops_rwsem);
1102 if (setup_net(&init_net, &init_user_ns))
1103 panic("Could not setup the initial network namespace");
1104
1105 init_net_initialized = true;
1106 up_write(&pernet_ops_rwsem);
1107
1108 if (register_pernet_subsys(&net_ns_ops))
1109 panic("Could not register network namespace subsystems");
1110
1111 rtnl_register(PF_UNSPEC, RTM_NEWNSID, rtnl_net_newid, NULL,
1112 RTNL_FLAG_DOIT_UNLOCKED);
1113 rtnl_register(PF_UNSPEC, RTM_GETNSID, rtnl_net_getid, rtnl_net_dumpid,
1114 RTNL_FLAG_DOIT_UNLOCKED);
1115
1116 return 0;
1117}
1118
1119pure_initcall(net_ns_init);
1120
1121#ifdef CONFIG_NET_NS
1122static int __register_pernet_operations(struct list_head *list,
1123 struct pernet_operations *ops)
1124{
1125 struct net *net;
1126 int error;
1127 LIST_HEAD(net_exit_list);
1128
1129 list_add_tail(&ops->list, list);
1130 if (ops->init || (ops->id && ops->size)) {
1131
1132
1133
1134 for_each_net(net) {
1135 error = ops_init(ops, net);
1136 if (error)
1137 goto out_undo;
1138 list_add_tail(&net->exit_list, &net_exit_list);
1139 }
1140 }
1141 return 0;
1142
1143out_undo:
1144
1145 list_del(&ops->list);
1146 ops_pre_exit_list(ops, &net_exit_list);
1147 synchronize_rcu();
1148 ops_exit_list(ops, &net_exit_list);
1149 ops_free_list(ops, &net_exit_list);
1150 return error;
1151}
1152
1153static void __unregister_pernet_operations(struct pernet_operations *ops)
1154{
1155 struct net *net;
1156 LIST_HEAD(net_exit_list);
1157
1158 list_del(&ops->list);
1159
1160 for_each_net(net)
1161 list_add_tail(&net->exit_list, &net_exit_list);
1162 ops_pre_exit_list(ops, &net_exit_list);
1163 synchronize_rcu();
1164 ops_exit_list(ops, &net_exit_list);
1165 ops_free_list(ops, &net_exit_list);
1166}
1167
1168#else
1169
1170static int __register_pernet_operations(struct list_head *list,
1171 struct pernet_operations *ops)
1172{
1173 if (!init_net_initialized) {
1174 list_add_tail(&ops->list, list);
1175 return 0;
1176 }
1177
1178 return ops_init(ops, &init_net);
1179}
1180
1181static void __unregister_pernet_operations(struct pernet_operations *ops)
1182{
1183 if (!init_net_initialized) {
1184 list_del(&ops->list);
1185 } else {
1186 LIST_HEAD(net_exit_list);
1187 list_add(&init_net.exit_list, &net_exit_list);
1188 ops_pre_exit_list(ops, &net_exit_list);
1189 synchronize_rcu();
1190 ops_exit_list(ops, &net_exit_list);
1191 ops_free_list(ops, &net_exit_list);
1192 }
1193}
1194
1195#endif
1196
1197static DEFINE_IDA(net_generic_ids);
1198
1199static int register_pernet_operations(struct list_head *list,
1200 struct pernet_operations *ops)
1201{
1202 int error;
1203
1204 if (ops->id) {
1205 error = ida_alloc_min(&net_generic_ids, MIN_PERNET_OPS_ID,
1206 GFP_KERNEL);
1207 if (error < 0)
1208 return error;
1209 *ops->id = error;
1210 max_gen_ptrs = max(max_gen_ptrs, *ops->id + 1);
1211 }
1212 error = __register_pernet_operations(list, ops);
1213 if (error) {
1214 rcu_barrier();
1215 if (ops->id)
1216 ida_free(&net_generic_ids, *ops->id);
1217 }
1218
1219 return error;
1220}
1221
1222static void unregister_pernet_operations(struct pernet_operations *ops)
1223{
1224 __unregister_pernet_operations(ops);
1225 rcu_barrier();
1226 if (ops->id)
1227 ida_free(&net_generic_ids, *ops->id);
1228}
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249int register_pernet_subsys(struct pernet_operations *ops)
1250{
1251 int error;
1252 down_write(&pernet_ops_rwsem);
1253 error = register_pernet_operations(first_device, ops);
1254 up_write(&pernet_ops_rwsem);
1255 return error;
1256}
1257EXPORT_SYMBOL_GPL(register_pernet_subsys);
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268void unregister_pernet_subsys(struct pernet_operations *ops)
1269{
1270 down_write(&pernet_ops_rwsem);
1271 unregister_pernet_operations(ops);
1272 up_write(&pernet_ops_rwsem);
1273}
1274EXPORT_SYMBOL_GPL(unregister_pernet_subsys);
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295int register_pernet_device(struct pernet_operations *ops)
1296{
1297 int error;
1298 down_write(&pernet_ops_rwsem);
1299 error = register_pernet_operations(&pernet_list, ops);
1300 if (!error && (first_device == &pernet_list))
1301 first_device = &ops->list;
1302 up_write(&pernet_ops_rwsem);
1303 return error;
1304}
1305EXPORT_SYMBOL_GPL(register_pernet_device);
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316void unregister_pernet_device(struct pernet_operations *ops)
1317{
1318 down_write(&pernet_ops_rwsem);
1319 if (&ops->list == first_device)
1320 first_device = first_device->next;
1321 unregister_pernet_operations(ops);
1322 up_write(&pernet_ops_rwsem);
1323}
1324EXPORT_SYMBOL_GPL(unregister_pernet_device);
1325
1326#ifdef CONFIG_NET_NS
1327static struct ns_common *netns_get(struct task_struct *task)
1328{
1329 struct net *net = NULL;
1330 struct nsproxy *nsproxy;
1331
1332 task_lock(task);
1333 nsproxy = task->nsproxy;
1334 if (nsproxy)
1335 net = get_net(nsproxy->net_ns);
1336 task_unlock(task);
1337
1338 return net ? &net->ns : NULL;
1339}
1340
1341static inline struct net *to_net_ns(struct ns_common *ns)
1342{
1343 return container_of(ns, struct net, ns);
1344}
1345
1346static void netns_put(struct ns_common *ns)
1347{
1348 put_net(to_net_ns(ns));
1349}
1350
1351static int netns_install(struct nsproxy *nsproxy, struct ns_common *ns)
1352{
1353 struct net *net = to_net_ns(ns);
1354
1355 if (!ns_capable(net->user_ns, CAP_SYS_ADMIN) ||
1356 !ns_capable(current_user_ns(), CAP_SYS_ADMIN))
1357 return -EPERM;
1358
1359 put_net(nsproxy->net_ns);
1360 nsproxy->net_ns = get_net(net);
1361 return 0;
1362}
1363
1364static struct user_namespace *netns_owner(struct ns_common *ns)
1365{
1366 return to_net_ns(ns)->user_ns;
1367}
1368
1369const struct proc_ns_operations netns_operations = {
1370 .name = "net",
1371 .type = CLONE_NEWNET,
1372 .get = netns_get,
1373 .put = netns_put,
1374 .install = netns_install,
1375 .owner = netns_owner,
1376};
1377#endif
1378