1 // SPDX-License-Identifier: GPL-2.0-only 2 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 3 4 #include <linux/workqueue.h> 5 #include <linux/rtnetlink.h> 6 #include <linux/cache.h> 7 #include <linux/slab.h> 8 #include <linux/list.h> 9 #include <linux/delay.h> 10 #include <linux/sched.h> 11 #include <linux/idr.h> 12 #include <linux/rculist.h> 13 #include <linux/nsproxy.h> 14 #include <linux/fs.h> 15 #include <linux/proc_ns.h> 16 #include <linux/file.h> 17 #include <linux/export.h> 18 #include <linux/user_namespace.h> 19 #include <linux/net_namespace.h> 20 #include <linux/sched/task.h> 21 #include <linux/uidgid.h> 22 #include <linux/cookie.h> 23 24 #include <net/sock.h> 25 #include <net/netlink.h> 26 #include <net/net_namespace.h> 27 #include <net/netns/generic.h> 28 29 /* 30 * Our network namespace constructor/destructor lists 31 */ 32 33 static LIST_HEAD(pernet_list); 34 static struct list_head *first_device = &pernet_list; 35 36 LIST_HEAD(net_namespace_list); 37 EXPORT_SYMBOL_GPL(net_namespace_list); 38 39 /* Protects net_namespace_list. Nests iside rtnl_lock() */ 40 DECLARE_RWSEM(net_rwsem); 41 EXPORT_SYMBOL_GPL(net_rwsem); 42 43 #ifdef CONFIG_KEYS 44 static struct key_tag init_net_key_domain = { .usage = REFCOUNT_INIT(1) }; 45 #endif 46 47 struct net init_net = { 48 .ns.count = REFCOUNT_INIT(1), 49 .dev_base_head = LIST_HEAD_INIT(init_net.dev_base_head), 50 #ifdef CONFIG_KEYS 51 .key_domain = &init_net_key_domain, 52 #endif 53 }; 54 EXPORT_SYMBOL(init_net); 55 56 static bool init_net_initialized; 57 /* 58 * pernet_ops_rwsem: protects: pernet_list, net_generic_ids, 59 * init_net_initialized and first_device pointer. 60 * This is internal net namespace object. Please, don't use it 61 * outside. 62 */ 63 DECLARE_RWSEM(pernet_ops_rwsem); 64 EXPORT_SYMBOL_GPL(pernet_ops_rwsem); 65 66 #define MIN_PERNET_OPS_ID \ 67 ((sizeof(struct net_generic) + sizeof(void *) - 1) / sizeof(void *)) 68 69 #define INITIAL_NET_GEN_PTRS 13 /* +1 for len +2 for rcu_head */ 70 71 static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS; 72 73 DEFINE_COOKIE(net_cookie); 74 75 static struct net_generic *net_alloc_generic(void) 76 { 77 struct net_generic *ng; 78 unsigned int generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]); 79 80 ng = kzalloc(generic_size, GFP_KERNEL); 81 if (ng) 82 ng->s.len = max_gen_ptrs; 83 84 return ng; 85 } 86 87 static int net_assign_generic(struct net *net, unsigned int id, void *data) 88 { 89 struct net_generic *ng, *old_ng; 90 91 BUG_ON(id < MIN_PERNET_OPS_ID); 92 93 old_ng = rcu_dereference_protected(net->gen, 94 lockdep_is_held(&pernet_ops_rwsem)); 95 if (old_ng->s.len > id) { 96 old_ng->ptr[id] = data; 97 return 0; 98 } 99 100 ng = net_alloc_generic(); 101 if (!ng) 102 return -ENOMEM; 103 104 /* 105 * Some synchronisation notes: 106 * 107 * The net_generic explores the net->gen array inside rcu 108 * read section. Besides once set the net->gen->ptr[x] 109 * pointer never changes (see rules in netns/generic.h). 110 * 111 * That said, we simply duplicate this array and schedule 112 * the old copy for kfree after a grace period. 113 */ 114 115 memcpy(&ng->ptr[MIN_PERNET_OPS_ID], &old_ng->ptr[MIN_PERNET_OPS_ID], 116 (old_ng->s.len - MIN_PERNET_OPS_ID) * sizeof(void *)); 117 ng->ptr[id] = data; 118 119 rcu_assign_pointer(net->gen, ng); 120 kfree_rcu(old_ng, s.rcu); 121 return 0; 122 } 123 124 static int ops_init(const struct pernet_operations *ops, struct net *net) 125 { 126 int err = -ENOMEM; 127 void *data = NULL; 128 129 if (ops->id && ops->size) { 130 data = kzalloc(ops->size, GFP_KERNEL); 131 if (!data) 132 goto out; 133 134 err = net_assign_generic(net, *ops->id, data); 135 if (err) 136 goto cleanup; 137 } 138 err = 0; 139 if (ops->init) 140 err = ops->init(net); 141 if (!err) 142 return 0; 143 144 cleanup: 145 kfree(data); 146 147 out: 148 return err; 149 } 150 151 static void ops_pre_exit_list(const struct pernet_operations *ops, 152 struct list_head *net_exit_list) 153 { 154 struct net *net; 155 156 if (ops->pre_exit) { 157 list_for_each_entry(net, net_exit_list, exit_list) 158 ops->pre_exit(net); 159 } 160 } 161 162 static void ops_exit_list(const struct pernet_operations *ops, 163 struct list_head *net_exit_list) 164 { 165 struct net *net; 166 if (ops->exit) { 167 list_for_each_entry(net, net_exit_list, exit_list) { 168 ops->exit(net); 169 cond_resched(); 170 } 171 } 172 if (ops->exit_batch) 173 ops->exit_batch(net_exit_list); 174 } 175 176 static void ops_free_list(const struct pernet_operations *ops, 177 struct list_head *net_exit_list) 178 { 179 struct net *net; 180 if (ops->size && ops->id) { 181 list_for_each_entry(net, net_exit_list, exit_list) 182 kfree(net_generic(net, *ops->id)); 183 } 184 } 185 186 /* should be called with nsid_lock held */ 187 static int alloc_netid(struct net *net, struct net *peer, int reqid) 188 { 189 int min = 0, max = 0; 190 191 if (reqid >= 0) { 192 min = reqid; 193 max = reqid + 1; 194 } 195 196 return idr_alloc(&net->netns_ids, peer, min, max, GFP_ATOMIC); 197 } 198 199 /* This function is used by idr_for_each(). If net is equal to peer, the 200 * function returns the id so that idr_for_each() stops. Because we cannot 201 * returns the id 0 (idr_for_each() will not stop), we return the magic value 202 * NET_ID_ZERO (-1) for it. 203 */ 204 #define NET_ID_ZERO -1 205 static int net_eq_idr(int id, void *net, void *peer) 206 { 207 if (net_eq(net, peer)) 208 return id ? : NET_ID_ZERO; 209 return 0; 210 } 211 212 /* Must be called from RCU-critical section or with nsid_lock held */ 213 static int __peernet2id(const struct net *net, struct net *peer) 214 { 215 int id = idr_for_each(&net->netns_ids, net_eq_idr, peer); 216 217 /* Magic value for id 0. */ 218 if (id == NET_ID_ZERO) 219 return 0; 220 if (id > 0) 221 return id; 222 223 return NETNSA_NSID_NOT_ASSIGNED; 224 } 225 226 static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid, 227 struct nlmsghdr *nlh, gfp_t gfp); 228 /* This function returns the id of a peer netns. If no id is assigned, one will 229 * be allocated and returned. 230 */ 231 int peernet2id_alloc(struct net *net, struct net *peer, gfp_t gfp) 232 { 233 int id; 234 235 if (refcount_read(&net->ns.count) == 0) 236 return NETNSA_NSID_NOT_ASSIGNED; 237 238 spin_lock_bh(&net->nsid_lock); 239 id = __peernet2id(net, peer); 240 if (id >= 0) { 241 spin_unlock_bh(&net->nsid_lock); 242 return id; 243 } 244 245 /* When peer is obtained from RCU lists, we may race with 246 * its cleanup. Check whether it's alive, and this guarantees 247 * we never hash a peer back to net->netns_ids, after it has 248 * just been idr_remove()'d from there in cleanup_net(). 249 */ 250 if (!maybe_get_net(peer)) { 251 spin_unlock_bh(&net->nsid_lock); 252 return NETNSA_NSID_NOT_ASSIGNED; 253 } 254 255 id = alloc_netid(net, peer, -1); 256 spin_unlock_bh(&net->nsid_lock); 257 258 put_net(peer); 259 if (id < 0) 260 return NETNSA_NSID_NOT_ASSIGNED; 261 262 rtnl_net_notifyid(net, RTM_NEWNSID, id, 0, NULL, gfp); 263 264 return id; 265 } 266 EXPORT_SYMBOL_GPL(peernet2id_alloc); 267 268 /* This function returns, if assigned, the id of a peer netns. */ 269 int peernet2id(const struct net *net, struct net *peer) 270 { 271 int id; 272 273 rcu_read_lock(); 274 id = __peernet2id(net, peer); 275 rcu_read_unlock(); 276 277 return id; 278 } 279 EXPORT_SYMBOL(peernet2id); 280 281 /* This function returns true is the peer netns has an id assigned into the 282 * current netns. 283 */ 284 bool peernet_has_id(const struct net *net, struct net *peer) 285 { 286 return peernet2id(net, peer) >= 0; 287 } 288 289 struct net *get_net_ns_by_id(const struct net *net, int id) 290 { 291 struct net *peer; 292 293 if (id < 0) 294 return NULL; 295 296 rcu_read_lock(); 297 peer = idr_find(&net->netns_ids, id); 298 if (peer) 299 peer = maybe_get_net(peer); 300 rcu_read_unlock(); 301 302 return peer; 303 } 304 305 /* 306 * setup_net runs the initializers for the network namespace object. 307 */ 308 static __net_init int setup_net(struct net *net, struct user_namespace *user_ns) 309 { 310 /* Must be called with pernet_ops_rwsem held */ 311 const struct pernet_operations *ops, *saved_ops; 312 int error = 0; 313 LIST_HEAD(net_exit_list); 314 315 refcount_set(&net->ns.count, 1); 316 refcount_set(&net->passive, 1); 317 get_random_bytes(&net->hash_mix, sizeof(u32)); 318 preempt_disable(); 319 net->net_cookie = gen_cookie_next(&net_cookie); 320 preempt_enable(); 321 net->dev_base_seq = 1; 322 net->user_ns = user_ns; 323 idr_init(&net->netns_ids); 324 spin_lock_init(&net->nsid_lock); 325 mutex_init(&net->ipv4.ra_mutex); 326 327 list_for_each_entry(ops, &pernet_list, list) { 328 error = ops_init(ops, net); 329 if (error < 0) 330 goto out_undo; 331 } 332 down_write(&net_rwsem); 333 list_add_tail_rcu(&net->list, &net_namespace_list); 334 up_write(&net_rwsem); 335 out: 336 return error; 337 338 out_undo: 339 /* Walk through the list backwards calling the exit functions 340 * for the pernet modules whose init functions did not fail. 341 */ 342 list_add(&net->exit_list, &net_exit_list); 343 saved_ops = ops; 344 list_for_each_entry_continue_reverse(ops, &pernet_list, list) 345 ops_pre_exit_list(ops, &net_exit_list); 346 347 synchronize_rcu(); 348 349 ops = saved_ops; 350 list_for_each_entry_continue_reverse(ops, &pernet_list, list) 351 ops_exit_list(ops, &net_exit_list); 352 353 ops = saved_ops; 354 list_for_each_entry_continue_reverse(ops, &pernet_list, list) 355 ops_free_list(ops, &net_exit_list); 356 357 rcu_barrier(); 358 goto out; 359 } 360 361 static int __net_init net_defaults_init_net(struct net *net) 362 { 363 net->core.sysctl_somaxconn = SOMAXCONN; 364 return 0; 365 } 366 367 static struct pernet_operations net_defaults_ops = { 368 .init = net_defaults_init_net, 369 }; 370 371 static __init int net_defaults_init(void) 372 { 373 if (register_pernet_subsys(&net_defaults_ops)) 374 panic("Cannot initialize net default settings"); 375 376 return 0; 377 } 378 379 core_initcall(net_defaults_init); 380 381 #ifdef CONFIG_NET_NS 382 static struct ucounts *inc_net_namespaces(struct user_namespace *ns) 383 { 384 return inc_ucount(ns, current_euid(), UCOUNT_NET_NAMESPACES); 385 } 386 387 static void dec_net_namespaces(struct ucounts *ucounts) 388 { 389 dec_ucount(ucounts, UCOUNT_NET_NAMESPACES); 390 } 391 392 static struct kmem_cache *net_cachep __ro_after_init; 393 static struct workqueue_struct *netns_wq; 394 395 static struct net *net_alloc(void) 396 { 397 struct net *net = NULL; 398 struct net_generic *ng; 399 400 ng = net_alloc_generic(); 401 if (!ng) 402 goto out; 403 404 net = kmem_cache_zalloc(net_cachep, GFP_KERNEL); 405 if (!net) 406 goto out_free; 407 408 #ifdef CONFIG_KEYS 409 net->key_domain = kzalloc(sizeof(struct key_tag), GFP_KERNEL); 410 if (!net->key_domain) 411 goto out_free_2; 412 refcount_set(&net->key_domain->usage, 1); 413 #endif 414 415 rcu_assign_pointer(net->gen, ng); 416 out: 417 return net; 418 419 #ifdef CONFIG_KEYS 420 out_free_2: 421 kmem_cache_free(net_cachep, net); 422 net = NULL; 423 #endif 424 out_free: 425 kfree(ng); 426 goto out; 427 } 428 429 static void net_free(struct net *net) 430 { 431 if (refcount_dec_and_test(&net->passive)) { 432 kfree(rcu_access_pointer(net->gen)); 433 kmem_cache_free(net_cachep, net); 434 } 435 } 436 437 void net_drop_ns(void *p) 438 { 439 struct net *net = (struct net *)p; 440 441 if (net) 442 net_free(net); 443 } 444 445 struct net *copy_net_ns(unsigned long flags, 446 struct user_namespace *user_ns, struct net *old_net) 447 { 448 struct ucounts *ucounts; 449 struct net *net; 450 int rv; 451 452 if (!(flags & CLONE_NEWNET)) 453 return get_net(old_net); 454 455 ucounts = inc_net_namespaces(user_ns); 456 if (!ucounts) 457 return ERR_PTR(-ENOSPC); 458 459 net = net_alloc(); 460 if (!net) { 461 rv = -ENOMEM; 462 goto dec_ucounts; 463 } 464 refcount_set(&net->passive, 1); 465 net->ucounts = ucounts; 466 get_user_ns(user_ns); 467 468 rv = down_read_killable(&pernet_ops_rwsem); 469 if (rv < 0) 470 goto put_userns; 471 472 rv = setup_net(net, user_ns); 473 474 up_read(&pernet_ops_rwsem); 475 476 if (rv < 0) { 477 put_userns: 478 #ifdef CONFIG_KEYS 479 key_remove_domain(net->key_domain); 480 #endif 481 put_user_ns(user_ns); 482 net_free(net); 483 dec_ucounts: 484 dec_net_namespaces(ucounts); 485 return ERR_PTR(rv); 486 } 487 return net; 488 } 489 490 /** 491 * net_ns_get_ownership - get sysfs ownership data for @net 492 * @net: network namespace in question (can be NULL) 493 * @uid: kernel user ID for sysfs objects 494 * @gid: kernel group ID for sysfs objects 495 * 496 * Returns the uid/gid pair of root in the user namespace associated with the 497 * given network namespace. 498 */ 499 void net_ns_get_ownership(const struct net *net, kuid_t *uid, kgid_t *gid) 500 { 501 if (net) { 502 kuid_t ns_root_uid = make_kuid(net->user_ns, 0); 503 kgid_t ns_root_gid = make_kgid(net->user_ns, 0); 504 505 if (uid_valid(ns_root_uid)) 506 *uid = ns_root_uid; 507 508 if (gid_valid(ns_root_gid)) 509 *gid = ns_root_gid; 510 } else { 511 *uid = GLOBAL_ROOT_UID; 512 *gid = GLOBAL_ROOT_GID; 513 } 514 } 515 EXPORT_SYMBOL_GPL(net_ns_get_ownership); 516 517 static void unhash_nsid(struct net *net, struct net *last) 518 { 519 struct net *tmp; 520 /* This function is only called from cleanup_net() work, 521 * and this work is the only process, that may delete 522 * a net from net_namespace_list. So, when the below 523 * is executing, the list may only grow. Thus, we do not 524 * use for_each_net_rcu() or net_rwsem. 525 */ 526 for_each_net(tmp) { 527 int id; 528 529 spin_lock_bh(&tmp->nsid_lock); 530 id = __peernet2id(tmp, net); 531 if (id >= 0) 532 idr_remove(&tmp->netns_ids, id); 533 spin_unlock_bh(&tmp->nsid_lock); 534 if (id >= 0) 535 rtnl_net_notifyid(tmp, RTM_DELNSID, id, 0, NULL, 536 GFP_KERNEL); 537 if (tmp == last) 538 break; 539 } 540 spin_lock_bh(&net->nsid_lock); 541 idr_destroy(&net->netns_ids); 542 spin_unlock_bh(&net->nsid_lock); 543 } 544 545 static LLIST_HEAD(cleanup_list); 546 547 static void cleanup_net(struct work_struct *work) 548 { 549 const struct pernet_operations *ops; 550 struct net *net, *tmp, *last; 551 struct llist_node *net_kill_list; 552 LIST_HEAD(net_exit_list); 553 554 /* Atomically snapshot the list of namespaces to cleanup */ 555 net_kill_list = llist_del_all(&cleanup_list); 556 557 down_read(&pernet_ops_rwsem); 558 559 /* Don't let anyone else find us. */ 560 down_write(&net_rwsem); 561 llist_for_each_entry(net, net_kill_list, cleanup_list) 562 list_del_rcu(&net->list); 563 /* Cache last net. After we unlock rtnl, no one new net 564 * added to net_namespace_list can assign nsid pointer 565 * to a net from net_kill_list (see peernet2id_alloc()). 566 * So, we skip them in unhash_nsid(). 567 * 568 * Note, that unhash_nsid() does not delete nsid links 569 * between net_kill_list's nets, as they've already 570 * deleted from net_namespace_list. But, this would be 571 * useless anyway, as netns_ids are destroyed there. 572 */ 573 last = list_last_entry(&net_namespace_list, struct net, list); 574 up_write(&net_rwsem); 575 576 llist_for_each_entry(net, net_kill_list, cleanup_list) { 577 unhash_nsid(net, last); 578 list_add_tail(&net->exit_list, &net_exit_list); 579 } 580 581 /* Run all of the network namespace pre_exit methods */ 582 list_for_each_entry_reverse(ops, &pernet_list, list) 583 ops_pre_exit_list(ops, &net_exit_list); 584 585 /* 586 * Another CPU might be rcu-iterating the list, wait for it. 587 * This needs to be before calling the exit() notifiers, so 588 * the rcu_barrier() below isn't sufficient alone. 589 * Also the pre_exit() and exit() methods need this barrier. 590 */ 591 synchronize_rcu(); 592 593 /* Run all of the network namespace exit methods */ 594 list_for_each_entry_reverse(ops, &pernet_list, list) 595 ops_exit_list(ops, &net_exit_list); 596 597 /* Free the net generic variables */ 598 list_for_each_entry_reverse(ops, &pernet_list, list) 599 ops_free_list(ops, &net_exit_list); 600 601 up_read(&pernet_ops_rwsem); 602 603 /* Ensure there are no outstanding rcu callbacks using this 604 * network namespace. 605 */ 606 rcu_barrier(); 607 608 /* Finally it is safe to free my network namespace structure */ 609 list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) { 610 list_del_init(&net->exit_list); 611 dec_net_namespaces(net->ucounts); 612 #ifdef CONFIG_KEYS 613 key_remove_domain(net->key_domain); 614 #endif 615 put_user_ns(net->user_ns); 616 net_free(net); 617 } 618 } 619 620 /** 621 * net_ns_barrier - wait until concurrent net_cleanup_work is done 622 * 623 * cleanup_net runs from work queue and will first remove namespaces 624 * from the global list, then run net exit functions. 625 * 626 * Call this in module exit path to make sure that all netns 627 * ->exit ops have been invoked before the function is removed. 628 */ 629 void net_ns_barrier(void) 630 { 631 down_write(&pernet_ops_rwsem); 632 up_write(&pernet_ops_rwsem); 633 } 634 EXPORT_SYMBOL(net_ns_barrier); 635 636 static DECLARE_WORK(net_cleanup_work, cleanup_net); 637 638 void __put_net(struct net *net) 639 { 640 /* Cleanup the network namespace in process context */ 641 if (llist_add(&net->cleanup_list, &cleanup_list)) 642 queue_work(netns_wq, &net_cleanup_work); 643 } 644 EXPORT_SYMBOL_GPL(__put_net); 645 646 /** 647 * get_net_ns - increment the refcount of the network namespace 648 * @ns: common namespace (net) 649 * 650 * Returns the net's common namespace. 651 */ 652 struct ns_common *get_net_ns(struct ns_common *ns) 653 { 654 return &get_net(container_of(ns, struct net, ns))->ns; 655 } 656 EXPORT_SYMBOL_GPL(get_net_ns); 657 658 struct net *get_net_ns_by_fd(int fd) 659 { 660 struct file *file; 661 struct ns_common *ns; 662 struct net *net; 663 664 file = proc_ns_fget(fd); 665 if (IS_ERR(file)) 666 return ERR_CAST(file); 667 668 ns = get_proc_ns(file_inode(file)); 669 if (ns->ops == &netns_operations) 670 net = get_net(container_of(ns, struct net, ns)); 671 else 672 net = ERR_PTR(-EINVAL); 673 674 fput(file); 675 return net; 676 } 677 EXPORT_SYMBOL_GPL(get_net_ns_by_fd); 678 #endif 679 680 struct net *get_net_ns_by_pid(pid_t pid) 681 { 682 struct task_struct *tsk; 683 struct net *net; 684 685 /* Lookup the network namespace */ 686 net = ERR_PTR(-ESRCH); 687 rcu_read_lock(); 688 tsk = find_task_by_vpid(pid); 689 if (tsk) { 690 struct nsproxy *nsproxy; 691 task_lock(tsk); 692 nsproxy = tsk->nsproxy; 693 if (nsproxy) 694 net = get_net(nsproxy->net_ns); 695 task_unlock(tsk); 696 } 697 rcu_read_unlock(); 698 return net; 699 } 700 EXPORT_SYMBOL_GPL(get_net_ns_by_pid); 701 702 static __net_init int net_ns_net_init(struct net *net) 703 { 704 #ifdef CONFIG_NET_NS 705 net->ns.ops = &netns_operations; 706 #endif 707 return ns_alloc_inum(&net->ns); 708 } 709 710 static __net_exit void net_ns_net_exit(struct net *net) 711 { 712 ns_free_inum(&net->ns); 713 } 714 715 static struct pernet_operations __net_initdata net_ns_ops = { 716 .init = net_ns_net_init, 717 .exit = net_ns_net_exit, 718 }; 719 720 static const struct nla_policy rtnl_net_policy[NETNSA_MAX + 1] = { 721 [NETNSA_NONE] = { .type = NLA_UNSPEC }, 722 [NETNSA_NSID] = { .type = NLA_S32 }, 723 [NETNSA_PID] = { .type = NLA_U32 }, 724 [NETNSA_FD] = { .type = NLA_U32 }, 725 [NETNSA_TARGET_NSID] = { .type = NLA_S32 }, 726 }; 727 728 static int rtnl_net_newid(struct sk_buff *skb, struct nlmsghdr *nlh, 729 struct netlink_ext_ack *extack) 730 { 731 struct net *net = sock_net(skb->sk); 732 struct nlattr *tb[NETNSA_MAX + 1]; 733 struct nlattr *nla; 734 struct net *peer; 735 int nsid, err; 736 737 err = nlmsg_parse_deprecated(nlh, sizeof(struct rtgenmsg), tb, 738 NETNSA_MAX, rtnl_net_policy, extack); 739 if (err < 0) 740 return err; 741 if (!tb[NETNSA_NSID]) { 742 NL_SET_ERR_MSG(extack, "nsid is missing"); 743 return -EINVAL; 744 } 745 nsid = nla_get_s32(tb[NETNSA_NSID]); 746 747 if (tb[NETNSA_PID]) { 748 peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID])); 749 nla = tb[NETNSA_PID]; 750 } else if (tb[NETNSA_FD]) { 751 peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD])); 752 nla = tb[NETNSA_FD]; 753 } else { 754 NL_SET_ERR_MSG(extack, "Peer netns reference is missing"); 755 return -EINVAL; 756 } 757 if (IS_ERR(peer)) { 758 NL_SET_BAD_ATTR(extack, nla); 759 NL_SET_ERR_MSG(extack, "Peer netns reference is invalid"); 760 return PTR_ERR(peer); 761 } 762 763 spin_lock_bh(&net->nsid_lock); 764 if (__peernet2id(net, peer) >= 0) { 765 spin_unlock_bh(&net->nsid_lock); 766 err = -EEXIST; 767 NL_SET_BAD_ATTR(extack, nla); 768 NL_SET_ERR_MSG(extack, 769 "Peer netns already has a nsid assigned"); 770 goto out; 771 } 772 773 err = alloc_netid(net, peer, nsid); 774 spin_unlock_bh(&net->nsid_lock); 775 if (err >= 0) { 776 rtnl_net_notifyid(net, RTM_NEWNSID, err, NETLINK_CB(skb).portid, 777 nlh, GFP_KERNEL); 778 err = 0; 779 } else if (err == -ENOSPC && nsid >= 0) { 780 err = -EEXIST; 781 NL_SET_BAD_ATTR(extack, tb[NETNSA_NSID]); 782 NL_SET_ERR_MSG(extack, "The specified nsid is already used"); 783 } 784 out: 785 put_net(peer); 786 return err; 787 } 788 789 static int rtnl_net_get_size(void) 790 { 791 return NLMSG_ALIGN(sizeof(struct rtgenmsg)) 792 + nla_total_size(sizeof(s32)) /* NETNSA_NSID */ 793 + nla_total_size(sizeof(s32)) /* NETNSA_CURRENT_NSID */ 794 ; 795 } 796 797 struct net_fill_args { 798 u32 portid; 799 u32 seq; 800 int flags; 801 int cmd; 802 int nsid; 803 bool add_ref; 804 int ref_nsid; 805 }; 806 807 static int rtnl_net_fill(struct sk_buff *skb, struct net_fill_args *args) 808 { 809 struct nlmsghdr *nlh; 810 struct rtgenmsg *rth; 811 812 nlh = nlmsg_put(skb, args->portid, args->seq, args->cmd, sizeof(*rth), 813 args->flags); 814 if (!nlh) 815 return -EMSGSIZE; 816 817 rth = nlmsg_data(nlh); 818 rth->rtgen_family = AF_UNSPEC; 819 820 if (nla_put_s32(skb, NETNSA_NSID, args->nsid)) 821 goto nla_put_failure; 822 823 if (args->add_ref && 824 nla_put_s32(skb, NETNSA_CURRENT_NSID, args->ref_nsid)) 825 goto nla_put_failure; 826 827 nlmsg_end(skb, nlh); 828 return 0; 829 830 nla_put_failure: 831 nlmsg_cancel(skb, nlh); 832 return -EMSGSIZE; 833 } 834 835 static int rtnl_net_valid_getid_req(struct sk_buff *skb, 836 const struct nlmsghdr *nlh, 837 struct nlattr **tb, 838 struct netlink_ext_ack *extack) 839 { 840 int i, err; 841 842 if (!netlink_strict_get_check(skb)) 843 return nlmsg_parse_deprecated(nlh, sizeof(struct rtgenmsg), 844 tb, NETNSA_MAX, rtnl_net_policy, 845 extack); 846 847 err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct rtgenmsg), tb, 848 NETNSA_MAX, rtnl_net_policy, 849 extack); 850 if (err) 851 return err; 852 853 for (i = 0; i <= NETNSA_MAX; i++) { 854 if (!tb[i]) 855 continue; 856 857 switch (i) { 858 case NETNSA_PID: 859 case NETNSA_FD: 860 case NETNSA_NSID: 861 case NETNSA_TARGET_NSID: 862 break; 863 default: 864 NL_SET_ERR_MSG(extack, "Unsupported attribute in peer netns getid request"); 865 return -EINVAL; 866 } 867 } 868 869 return 0; 870 } 871 872 static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh, 873 struct netlink_ext_ack *extack) 874 { 875 struct net *net = sock_net(skb->sk); 876 struct nlattr *tb[NETNSA_MAX + 1]; 877 struct net_fill_args fillargs = { 878 .portid = NETLINK_CB(skb).portid, 879 .seq = nlh->nlmsg_seq, 880 .cmd = RTM_NEWNSID, 881 }; 882 struct net *peer, *target = net; 883 struct nlattr *nla; 884 struct sk_buff *msg; 885 int err; 886 887 err = rtnl_net_valid_getid_req(skb, nlh, tb, extack); 888 if (err < 0) 889 return err; 890 if (tb[NETNSA_PID]) { 891 peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID])); 892 nla = tb[NETNSA_PID]; 893 } else if (tb[NETNSA_FD]) { 894 peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD])); 895 nla = tb[NETNSA_FD]; 896 } else if (tb[NETNSA_NSID]) { 897 peer = get_net_ns_by_id(net, nla_get_s32(tb[NETNSA_NSID])); 898 if (!peer) 899 peer = ERR_PTR(-ENOENT); 900 nla = tb[NETNSA_NSID]; 901 } else { 902 NL_SET_ERR_MSG(extack, "Peer netns reference is missing"); 903 return -EINVAL; 904 } 905 906 if (IS_ERR(peer)) { 907 NL_SET_BAD_ATTR(extack, nla); 908 NL_SET_ERR_MSG(extack, "Peer netns reference is invalid"); 909 return PTR_ERR(peer); 910 } 911 912 if (tb[NETNSA_TARGET_NSID]) { 913 int id = nla_get_s32(tb[NETNSA_TARGET_NSID]); 914 915 target = rtnl_get_net_ns_capable(NETLINK_CB(skb).sk, id); 916 if (IS_ERR(target)) { 917 NL_SET_BAD_ATTR(extack, tb[NETNSA_TARGET_NSID]); 918 NL_SET_ERR_MSG(extack, 919 "Target netns reference is invalid"); 920 err = PTR_ERR(target); 921 goto out; 922 } 923 fillargs.add_ref = true; 924 fillargs.ref_nsid = peernet2id(net, peer); 925 } 926 927 msg = nlmsg_new(rtnl_net_get_size(), GFP_KERNEL); 928 if (!msg) { 929 err = -ENOMEM; 930 goto out; 931 } 932 933 fillargs.nsid = peernet2id(target, peer); 934 err = rtnl_net_fill(msg, &fillargs); 935 if (err < 0) 936 goto err_out; 937 938 err = rtnl_unicast(msg, net, NETLINK_CB(skb).portid); 939 goto out; 940 941 err_out: 942 nlmsg_free(msg); 943 out: 944 if (fillargs.add_ref) 945 put_net(target); 946 put_net(peer); 947 return err; 948 } 949 950 struct rtnl_net_dump_cb { 951 struct net *tgt_net; 952 struct net *ref_net; 953 struct sk_buff *skb; 954 struct net_fill_args fillargs; 955 int idx; 956 int s_idx; 957 }; 958 959 /* Runs in RCU-critical section. */ 960 static int rtnl_net_dumpid_one(int id, void *peer, void *data) 961 { 962 struct rtnl_net_dump_cb *net_cb = (struct rtnl_net_dump_cb *)data; 963 int ret; 964 965 if (net_cb->idx < net_cb->s_idx) 966 goto cont; 967 968 net_cb->fillargs.nsid = id; 969 if (net_cb->fillargs.add_ref) 970 net_cb->fillargs.ref_nsid = __peernet2id(net_cb->ref_net, peer); 971 ret = rtnl_net_fill(net_cb->skb, &net_cb->fillargs); 972 if (ret < 0) 973 return ret; 974 975 cont: 976 net_cb->idx++; 977 return 0; 978 } 979 980 static int rtnl_valid_dump_net_req(const struct nlmsghdr *nlh, struct sock *sk, 981 struct rtnl_net_dump_cb *net_cb, 982 struct netlink_callback *cb) 983 { 984 struct netlink_ext_ack *extack = cb->extack; 985 struct nlattr *tb[NETNSA_MAX + 1]; 986 int err, i; 987 988 err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct rtgenmsg), tb, 989 NETNSA_MAX, rtnl_net_policy, 990 extack); 991 if (err < 0) 992 return err; 993 994 for (i = 0; i <= NETNSA_MAX; i++) { 995 if (!tb[i]) 996 continue; 997 998 if (i == NETNSA_TARGET_NSID) { 999 struct net *net; 1000 1001 net = rtnl_get_net_ns_capable(sk, nla_get_s32(tb[i])); 1002 if (IS_ERR(net)) { 1003 NL_SET_BAD_ATTR(extack, tb[i]); 1004 NL_SET_ERR_MSG(extack, 1005 "Invalid target network namespace id"); 1006 return PTR_ERR(net); 1007 } 1008 net_cb->fillargs.add_ref = true; 1009 net_cb->ref_net = net_cb->tgt_net; 1010 net_cb->tgt_net = net; 1011 } else { 1012 NL_SET_BAD_ATTR(extack, tb[i]); 1013 NL_SET_ERR_MSG(extack, 1014 "Unsupported attribute in dump request"); 1015 return -EINVAL; 1016 } 1017 } 1018 1019 return 0; 1020 } 1021 1022 static int rtnl_net_dumpid(struct sk_buff *skb, struct netlink_callback *cb) 1023 { 1024 struct rtnl_net_dump_cb net_cb = { 1025 .tgt_net = sock_net(skb->sk), 1026 .skb = skb, 1027 .fillargs = { 1028 .portid = NETLINK_CB(cb->skb).portid, 1029 .seq = cb->nlh->nlmsg_seq, 1030 .flags = NLM_F_MULTI, 1031 .cmd = RTM_NEWNSID, 1032 }, 1033 .idx = 0, 1034 .s_idx = cb->args[0], 1035 }; 1036 int err = 0; 1037 1038 if (cb->strict_check) { 1039 err = rtnl_valid_dump_net_req(cb->nlh, skb->sk, &net_cb, cb); 1040 if (err < 0) 1041 goto end; 1042 } 1043 1044 rcu_read_lock(); 1045 idr_for_each(&net_cb.tgt_net->netns_ids, rtnl_net_dumpid_one, &net_cb); 1046 rcu_read_unlock(); 1047 1048 cb->args[0] = net_cb.idx; 1049 end: 1050 if (net_cb.fillargs.add_ref) 1051 put_net(net_cb.tgt_net); 1052 return err < 0 ? err : skb->len; 1053 } 1054 1055 static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid, 1056 struct nlmsghdr *nlh, gfp_t gfp) 1057 { 1058 struct net_fill_args fillargs = { 1059 .portid = portid, 1060 .seq = nlh ? nlh->nlmsg_seq : 0, 1061 .cmd = cmd, 1062 .nsid = id, 1063 }; 1064 struct sk_buff *msg; 1065 int err = -ENOMEM; 1066 1067 msg = nlmsg_new(rtnl_net_get_size(), gfp); 1068 if (!msg) 1069 goto out; 1070 1071 err = rtnl_net_fill(msg, &fillargs); 1072 if (err < 0) 1073 goto err_out; 1074 1075 rtnl_notify(msg, net, portid, RTNLGRP_NSID, nlh, gfp); 1076 return; 1077 1078 err_out: 1079 nlmsg_free(msg); 1080 out: 1081 rtnl_set_sk_err(net, RTNLGRP_NSID, err); 1082 } 1083 1084 static int __init net_ns_init(void) 1085 { 1086 struct net_generic *ng; 1087 1088 #ifdef CONFIG_NET_NS 1089 net_cachep = kmem_cache_create("net_namespace", sizeof(struct net), 1090 SMP_CACHE_BYTES, 1091 SLAB_PANIC|SLAB_ACCOUNT, NULL); 1092 1093 /* Create workqueue for cleanup */ 1094 netns_wq = create_singlethread_workqueue("netns"); 1095 if (!netns_wq) 1096 panic("Could not create netns workq"); 1097 #endif 1098 1099 ng = net_alloc_generic(); 1100 if (!ng) 1101 panic("Could not allocate generic netns"); 1102 1103 rcu_assign_pointer(init_net.gen, ng); 1104 1105 down_write(&pernet_ops_rwsem); 1106 if (setup_net(&init_net, &init_user_ns)) 1107 panic("Could not setup the initial network namespace"); 1108 1109 init_net_initialized = true; 1110 up_write(&pernet_ops_rwsem); 1111 1112 if (register_pernet_subsys(&net_ns_ops)) 1113 panic("Could not register network namespace subsystems"); 1114 1115 rtnl_register(PF_UNSPEC, RTM_NEWNSID, rtnl_net_newid, NULL, 1116 RTNL_FLAG_DOIT_UNLOCKED); 1117 rtnl_register(PF_UNSPEC, RTM_GETNSID, rtnl_net_getid, rtnl_net_dumpid, 1118 RTNL_FLAG_DOIT_UNLOCKED); 1119 1120 return 0; 1121 } 1122 1123 pure_initcall(net_ns_init); 1124 1125 static void free_exit_list(struct pernet_operations *ops, struct list_head *net_exit_list) 1126 { 1127 ops_pre_exit_list(ops, net_exit_list); 1128 synchronize_rcu(); 1129 ops_exit_list(ops, net_exit_list); 1130 ops_free_list(ops, net_exit_list); 1131 } 1132 1133 #ifdef CONFIG_NET_NS 1134 static int __register_pernet_operations(struct list_head *list, 1135 struct pernet_operations *ops) 1136 { 1137 struct net *net; 1138 int error; 1139 LIST_HEAD(net_exit_list); 1140 1141 list_add_tail(&ops->list, list); 1142 if (ops->init || (ops->id && ops->size)) { 1143 /* We held write locked pernet_ops_rwsem, and parallel 1144 * setup_net() and cleanup_net() are not possible. 1145 */ 1146 for_each_net(net) { 1147 error = ops_init(ops, net); 1148 if (error) 1149 goto out_undo; 1150 list_add_tail(&net->exit_list, &net_exit_list); 1151 } 1152 } 1153 return 0; 1154 1155 out_undo: 1156 /* If I have an error cleanup all namespaces I initialized */ 1157 list_del(&ops->list); 1158 free_exit_list(ops, &net_exit_list); 1159 return error; 1160 } 1161 1162 static void __unregister_pernet_operations(struct pernet_operations *ops) 1163 { 1164 struct net *net; 1165 LIST_HEAD(net_exit_list); 1166 1167 list_del(&ops->list); 1168 /* See comment in __register_pernet_operations() */ 1169 for_each_net(net) 1170 list_add_tail(&net->exit_list, &net_exit_list); 1171 1172 free_exit_list(ops, &net_exit_list); 1173 } 1174 1175 #else 1176 1177 static int __register_pernet_operations(struct list_head *list, 1178 struct pernet_operations *ops) 1179 { 1180 if (!init_net_initialized) { 1181 list_add_tail(&ops->list, list); 1182 return 0; 1183 } 1184 1185 return ops_init(ops, &init_net); 1186 } 1187 1188 static void __unregister_pernet_operations(struct pernet_operations *ops) 1189 { 1190 if (!init_net_initialized) { 1191 list_del(&ops->list); 1192 } else { 1193 LIST_HEAD(net_exit_list); 1194 list_add(&init_net.exit_list, &net_exit_list); 1195 free_exit_list(ops, &net_exit_list); 1196 } 1197 } 1198 1199 #endif /* CONFIG_NET_NS */ 1200 1201 static DEFINE_IDA(net_generic_ids); 1202 1203 static int register_pernet_operations(struct list_head *list, 1204 struct pernet_operations *ops) 1205 { 1206 int error; 1207 1208 if (ops->id) { 1209 error = ida_alloc_min(&net_generic_ids, MIN_PERNET_OPS_ID, 1210 GFP_KERNEL); 1211 if (error < 0) 1212 return error; 1213 *ops->id = error; 1214 max_gen_ptrs = max(max_gen_ptrs, *ops->id + 1); 1215 } 1216 error = __register_pernet_operations(list, ops); 1217 if (error) { 1218 rcu_barrier(); 1219 if (ops->id) 1220 ida_free(&net_generic_ids, *ops->id); 1221 } 1222 1223 return error; 1224 } 1225 1226 static void unregister_pernet_operations(struct pernet_operations *ops) 1227 { 1228 __unregister_pernet_operations(ops); 1229 rcu_barrier(); 1230 if (ops->id) 1231 ida_free(&net_generic_ids, *ops->id); 1232 } 1233 1234 /** 1235 * register_pernet_subsys - register a network namespace subsystem 1236 * @ops: pernet operations structure for the subsystem 1237 * 1238 * Register a subsystem which has init and exit functions 1239 * that are called when network namespaces are created and 1240 * destroyed respectively. 1241 * 1242 * When registered all network namespace init functions are 1243 * called for every existing network namespace. Allowing kernel 1244 * modules to have a race free view of the set of network namespaces. 1245 * 1246 * When a new network namespace is created all of the init 1247 * methods are called in the order in which they were registered. 1248 * 1249 * When a network namespace is destroyed all of the exit methods 1250 * are called in the reverse of the order with which they were 1251 * registered. 1252 */ 1253 int register_pernet_subsys(struct pernet_operations *ops) 1254 { 1255 int error; 1256 down_write(&pernet_ops_rwsem); 1257 error = register_pernet_operations(first_device, ops); 1258 up_write(&pernet_ops_rwsem); 1259 return error; 1260 } 1261 EXPORT_SYMBOL_GPL(register_pernet_subsys); 1262 1263 /** 1264 * unregister_pernet_subsys - unregister a network namespace subsystem 1265 * @ops: pernet operations structure to manipulate 1266 * 1267 * Remove the pernet operations structure from the list to be 1268 * used when network namespaces are created or destroyed. In 1269 * addition run the exit method for all existing network 1270 * namespaces. 1271 */ 1272 void unregister_pernet_subsys(struct pernet_operations *ops) 1273 { 1274 down_write(&pernet_ops_rwsem); 1275 unregister_pernet_operations(ops); 1276 up_write(&pernet_ops_rwsem); 1277 } 1278 EXPORT_SYMBOL_GPL(unregister_pernet_subsys); 1279 1280 /** 1281 * register_pernet_device - register a network namespace device 1282 * @ops: pernet operations structure for the subsystem 1283 * 1284 * Register a device which has init and exit functions 1285 * that are called when network namespaces are created and 1286 * destroyed respectively. 1287 * 1288 * When registered all network namespace init functions are 1289 * called for every existing network namespace. Allowing kernel 1290 * modules to have a race free view of the set of network namespaces. 1291 * 1292 * When a new network namespace is created all of the init 1293 * methods are called in the order in which they were registered. 1294 * 1295 * When a network namespace is destroyed all of the exit methods 1296 * are called in the reverse of the order with which they were 1297 * registered. 1298 */ 1299 int register_pernet_device(struct pernet_operations *ops) 1300 { 1301 int error; 1302 down_write(&pernet_ops_rwsem); 1303 error = register_pernet_operations(&pernet_list, ops); 1304 if (!error && (first_device == &pernet_list)) 1305 first_device = &ops->list; 1306 up_write(&pernet_ops_rwsem); 1307 return error; 1308 } 1309 EXPORT_SYMBOL_GPL(register_pernet_device); 1310 1311 /** 1312 * unregister_pernet_device - unregister a network namespace netdevice 1313 * @ops: pernet operations structure to manipulate 1314 * 1315 * Remove the pernet operations structure from the list to be 1316 * used when network namespaces are created or destroyed. In 1317 * addition run the exit method for all existing network 1318 * namespaces. 1319 */ 1320 void unregister_pernet_device(struct pernet_operations *ops) 1321 { 1322 down_write(&pernet_ops_rwsem); 1323 if (&ops->list == first_device) 1324 first_device = first_device->next; 1325 unregister_pernet_operations(ops); 1326 up_write(&pernet_ops_rwsem); 1327 } 1328 EXPORT_SYMBOL_GPL(unregister_pernet_device); 1329 1330 #ifdef CONFIG_NET_NS 1331 static struct ns_common *netns_get(struct task_struct *task) 1332 { 1333 struct net *net = NULL; 1334 struct nsproxy *nsproxy; 1335 1336 task_lock(task); 1337 nsproxy = task->nsproxy; 1338 if (nsproxy) 1339 net = get_net(nsproxy->net_ns); 1340 task_unlock(task); 1341 1342 return net ? &net->ns : NULL; 1343 } 1344 1345 static inline struct net *to_net_ns(struct ns_common *ns) 1346 { 1347 return container_of(ns, struct net, ns); 1348 } 1349 1350 static void netns_put(struct ns_common *ns) 1351 { 1352 put_net(to_net_ns(ns)); 1353 } 1354 1355 static int netns_install(struct nsset *nsset, struct ns_common *ns) 1356 { 1357 struct nsproxy *nsproxy = nsset->nsproxy; 1358 struct net *net = to_net_ns(ns); 1359 1360 if (!ns_capable(net->user_ns, CAP_SYS_ADMIN) || 1361 !ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN)) 1362 return -EPERM; 1363 1364 put_net(nsproxy->net_ns); 1365 nsproxy->net_ns = get_net(net); 1366 return 0; 1367 } 1368 1369 static struct user_namespace *netns_owner(struct ns_common *ns) 1370 { 1371 return to_net_ns(ns)->user_ns; 1372 } 1373 1374 const struct proc_ns_operations netns_operations = { 1375 .name = "net", 1376 .type = CLONE_NEWNET, 1377 .get = netns_get, 1378 .put = netns_put, 1379 .install = netns_install, 1380 .owner = netns_owner, 1381 }; 1382 #endif 1383