[PATCH iproute2 3/5] netlink: connect sockets to the kernel

[Stephen Hemminger <stephen@networkplumber.org>]

The netlink sockets were bound but not connected, so any process with
CAP_NET_ADMIN over the namespace can queue unicast datagrams to them.
Even though they are discarded, a steady stream fills the receive queue
and keeps a dump from ever completing.

Connect the socket to the kernel (port id 0) after bind, so the kernel
refuses unicast from other senders. Multicast is still delivered and
is filtered on receive.

Reported-by: Anthropic OSS scanner (ANT-2026-WUWQ5598)
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
 lib/libnetlink.c | 8 ++++++++
 lib/mnl_utils.c  | 6 ++++++
 2 files changed, 14 insertions(+)

diff --git a/lib/libnetlink.c b/lib/libnetlink.c
index b923ba02..6432d537 100644
--- a/lib/libnetlink.c
+++ b/lib/libnetlink.c
@@ -192,6 +192,7 @@ void rtnl_close(struct rtnl_handle *rth)
 int rtnl_open_byproto(struct rtnl_handle *rth, unsigned int subscriptions,
 		      int protocol)
 {
+	const struct sockaddr_nl kernel_addr = { .nl_family = AF_NETLINK };
 	socklen_t addr_len;
 	int sndbuf = 32768;
 	int one = 1;
@@ -230,6 +231,13 @@ int rtnl_open_byproto(struct rtnl_handle *rth, unsigned int subscriptions,
 		perror("Cannot bind netlink socket");
 		goto err;
 	}
+
+	/* Refuse unicast from other processes, only the kernel may send */
+	if (connect(rth->fd, (struct sockaddr *)&kernel_addr,
+		    sizeof(kernel_addr)) < 0) {
+		perror("Cannot connect netlink socket");
+		goto err;
+	}
 	addr_len = sizeof(rth->local);
 	if (getsockname(rth->fd, (struct sockaddr *)&rth->local,
 			&addr_len) < 0) {
diff --git a/lib/mnl_utils.c b/lib/mnl_utils.c
index 8ddf2b90..c49afed7 100644
--- a/lib/mnl_utils.c
+++ b/lib/mnl_utils.c
@@ -15,6 +15,7 @@
 
 struct mnl_socket *mnlu_socket_open(int bus)
 {
+	const struct sockaddr_nl kernel_addr = { .nl_family = AF_NETLINK };
 	struct mnl_socket *nl;
 	int one = 1;
 
@@ -28,6 +29,11 @@ struct mnl_socket *mnlu_socket_open(int bus)
 	if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0)
 		goto err_bind;
 
+	/* Refuse unicast from other processes, only the kernel may send */
+	if (connect(mnl_socket_get_fd(nl), (struct sockaddr *)&kernel_addr,
+		    sizeof(kernel_addr)) < 0)
+		goto err_bind;
+
 	return nl;
 
 err_bind:
-- 
2.53.0