[PATCH v2 1/4] neigh: no need to call lookup_neigh_parms in neigh_parms_alloc

[PATCH v2 1/4] neigh: no need to call lookup_neigh_parms in neigh_parms_alloc

[Gao feng]

neigh_table.parms always exist and is initialized,kmemdup
can use it to create new neigh_parms, actually lookup_neigh_parms
here will return neigh_table.parms too.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
---
 net/core/neighbour.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 5c56b21..62d9757 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1429,15 +1429,11 @@ static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
 				      struct neigh_table *tbl)
 {
-	struct neigh_parms *p, *ref;
+	struct neigh_parms *p;
 	struct net *net = dev_net(dev);
 	const struct net_device_ops *ops = dev->netdev_ops;
 
-	ref = lookup_neigh_parms(tbl, net, 0);
-	if (!ref)
-		return NULL;
-
-	p = kmemdup(ref, sizeof(*p), GFP_KERNEL);
+	p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
 	if (p) {
 		p->tbl		  = tbl;
 		atomic_set(&p->refcnt, 1);
-- 
1.8.1.4

[PATCH v2 2/4] neigh: only allow init_net to change the default neigh_parms

[Gao feng]

Though we don't export the /proc/sys/net/ipv[4,6]/neigh/default/
directory to the un-init_net, but we can still use cmd such as
"ip ntable change name arp_cache locktime 129" to change the locktime
of default neigh_parms.

This patch disallows the un-init_net to find out the neigh_table.parms.
So the un-init_net will failed to influence the init_net.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
---
 net/core/neighbour.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 62d9757..2ec1faf 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1419,7 +1419,7 @@ static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
 
 	for (p = &tbl->parms; p; p = p->next) {
 		if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
-		    (!p->dev && !ifindex))
+		    (!p->dev && !ifindex && net_eq(net, &init_net)))
 			return p;
 	}
 
-- 
1.8.1.4

[PATCH v2 3/4] neigh: disallow un-init_net to change thresh of neigh

[Gao feng]

thresh and interval are global resources,
only init net can change them.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
---
 net/core/neighbour.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 2ec1faf..5e0fe89 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2049,6 +2049,12 @@ static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh)
 		}
 	}
 
+	err = -ENOENT;
+	if ((tb[NDTA_THRESH1] || tb[NDTA_THRESH2] ||
+	     tb[NDTA_THRESH3] || tb[NDTA_GC_INTERVAL]) &&
+	    !net_eq(net, &init_net))
+		goto errout_tbl_lock;
+
 	if (tb[NDTA_THRESH1])
 		tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
 
-- 
1.8.1.4

[PATCH v2 4/4] neigh: don't leak default parms to uninitial netns

[Gao feng]

Only allow initial net namespace to get default parms
through netlink.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
---
 net/core/neighbour.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 5e0fe89..3bb6115 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2094,7 +2094,8 @@ static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
 		if (tidx < tbl_skip || (family && tbl->family != family))
 			continue;
 
-		if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
+		if (net_eq(net, &init_net) &&
+		    neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
 				       cb->nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
 				       NLM_F_MULTI) <= 0)
 			break;
-- 
1.8.1.4

Re: [PATCH v2 4/4] neigh: don't leak default parms to uninitial netns

[David Miller]

From: Gao feng <gaofeng@cn.fujitsu.com>
Date: Fri, 14 Jun 2013 10:06:47 +0800

> Only allow initial net namespace to get default parms
> through netlink.
> 
> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>

Disallowing changes to the default neigh parms is fine, but there is no
reason to forbid seeing what default neigh parms will be used in a given
network namespace just because it isn't &init_net.

I don't see why you want to restrict this at all.

I'm not applying these patches, sorry.

Re: [PATCH v2 4/4] neigh: don't leak default parms to uninitial netns

[Gao feng]

On 06/20/2013 09:05 AM, David Miller wrote:
> From: Gao feng <gaofeng@cn.fujitsu.com>
> Date: Fri, 14 Jun 2013 10:06:47 +0800
> 
>> Only allow initial net namespace to get default parms
>> through netlink.
>>
>> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
> 
> Disallowing changes to the default neigh parms is fine, but there is no
> reason to forbid seeing what default neigh parms will be used in a given
> network namespace just because it isn't &init_net.
> 

Yes, we can make sure un-init net namespace can't do harm to default neigh parms,
it's enough.

> I don't see why you want to restrict this at all.
> 
> I'm not applying these patches, sorry.

You can just drop this one, are there some problems with the other 3 patches?

Re: [PATCH v2 4/4] neigh: don't leak default parms to uninitial netns

[David Miller]

From: Gao feng <gaofeng@cn.fujitsu.com>
Date: Thu, 20 Jun 2013 09:18:48 +0800

> You can just drop this one, are there some problems with the other 3
> patches?

No, please resubmit them.