1 // SPDX-License-Identifier: GPL-2.0-only 2 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 3 4 #include <linux/workqueue.h> 5 #include <linux/rtnetlink.h> 6 #include <linux/cache.h> 7 #include <linux/slab.h> 8 #include <linux/list.h> 9 #include <linux/delay.h> 10 #include <linux/sched.h> 11 #include <linux/idr.h> 12 #include <linux/rculist.h> 13 #include <linux/nsproxy.h> 14 #include <linux/fs.h> 15 #include <linux/proc_ns.h> 16 #include <linux/file.h> 17 #include <linux/export.h> 18 #include <linux/user_namespace.h> 19 #include <linux/net_namespace.h> 20 #include <linux/sched/task.h> 21 #include <linux/uidgid.h> 22 #include <linux/cookie.h> 23 24 #include <net/sock.h> 25 #include <net/netlink.h> 26 #include <net/net_namespace.h> 27 #include <net/netns/generic.h> 28 29 /* 30 * Our network namespace constructor/destructor lists 31 */ 32 33 static LIST_HEAD(pernet_list); 34 static struct list_head *first_device = &pernet_list; 35 36 LIST_HEAD(net_namespace_list); 37 EXPORT_SYMBOL_GPL(net_namespace_list); 38 39 /* Protects net_namespace_list. Nests iside rtnl_lock() */ 40 DECLARE_RWSEM(net_rwsem); 41 EXPORT_SYMBOL_GPL(net_rwsem); 42 43 #ifdef CONFIG_KEYS 44 static struct key_tag init_net_key_domain = { .usage = REFCOUNT_INIT(1) }; 45 #endif 46 47 struct net init_net = { 48 .count = REFCOUNT_INIT(1), 49 .dev_base_head = LIST_HEAD_INIT(init_net.dev_base_head), 50 #ifdef CONFIG_KEYS 51 .key_domain = &init_net_key_domain, 52 #endif 53 }; 54 EXPORT_SYMBOL(init_net); 55 56 static bool init_net_initialized; 57 /* 58 * pernet_ops_rwsem: protects: pernet_list, net_generic_ids, 59 * init_net_initialized and first_device pointer. 60 * This is internal net namespace object. Please, don't use it 61 * outside. 62 */ 63 DECLARE_RWSEM(pernet_ops_rwsem); 64 EXPORT_SYMBOL_GPL(pernet_ops_rwsem); 65 66 #define MIN_PERNET_OPS_ID \ 67 ((sizeof(struct net_generic) + sizeof(void *) - 1) / sizeof(void *)) 68 69 #define INITIAL_NET_GEN_PTRS 13 /* +1 for len +2 for rcu_head */ 70 71 static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS; 72 73 DEFINE_COOKIE(net_cookie); 74 75 u64 __net_gen_cookie(struct net *net) 76 { 77 while (1) { 78 u64 res = atomic64_read(&net->net_cookie); 79 80 if (res) 81 return res; 82 res = gen_cookie_next(&net_cookie); 83 atomic64_cmpxchg(&net->net_cookie, 0, res); 84 } 85 } 86 87 static struct net_generic *net_alloc_generic(void) 88 { 89 struct net_generic *ng; 90 unsigned int generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]); 91 92 ng = kzalloc(generic_size, GFP_KERNEL); 93 if (ng) 94 ng->s.len = max_gen_ptrs; 95 96 return ng; 97 } 98 99 static int net_assign_generic(struct net *net, unsigned int id, void *data) 100 { 101 struct net_generic *ng, *old_ng; 102 103 BUG_ON(id < MIN_PERNET_OPS_ID); 104 105 old_ng = rcu_dereference_protected(net->gen, 106 lockdep_is_held(&pernet_ops_rwsem)); 107 if (old_ng->s.len > id) { 108 old_ng->ptr[id] = data; 109 return 0; 110 } 111 112 ng = net_alloc_generic(); 113 if (ng == NULL) 114 return -ENOMEM; 115 116 /* 117 * Some synchronisation notes: 118 * 119 * The net_generic explores the net->gen array inside rcu 120 * read section. Besides once set the net->gen->ptr[x] 121 * pointer never changes (see rules in netns/generic.h). 122 * 123 * That said, we simply duplicate this array and schedule 124 * the old copy for kfree after a grace period. 125 */ 126 127 memcpy(&ng->ptr[MIN_PERNET_OPS_ID], &old_ng->ptr[MIN_PERNET_OPS_ID], 128 (old_ng->s.len - MIN_PERNET_OPS_ID) * sizeof(void *)); 129 ng->ptr[id] = data; 130 131 rcu_assign_pointer(net->gen, ng); 132 kfree_rcu(old_ng, s.rcu); 133 return 0; 134 } 135 136 static int ops_init(const struct pernet_operations *ops, struct net *net) 137 { 138 int err = -ENOMEM; 139 void *data = NULL; 140 141 if (ops->id && ops->size) { 142 data = kzalloc(ops->size, GFP_KERNEL); 143 if (!data) 144 goto out; 145 146 err = net_assign_generic(net, *ops->id, data); 147 if (err) 148 goto cleanup; 149 } 150 err = 0; 151 if (ops->init) 152 err = ops->init(net); 153 if (!err) 154 return 0; 155 156 cleanup: 157 kfree(data); 158 159 out: 160 return err; 161 } 162 163 static void ops_free(const struct pernet_operations *ops, struct net *net) 164 { 165 if (ops->id && ops->size) { 166 kfree(net_generic(net, *ops->id)); 167 } 168 } 169 170 static void ops_pre_exit_list(const struct pernet_operations *ops, 171 struct list_head *net_exit_list) 172 { 173 struct net *net; 174 175 if (ops->pre_exit) { 176 list_for_each_entry(net, net_exit_list, exit_list) 177 ops->pre_exit(net); 178 } 179 } 180 181 static void ops_exit_list(const struct pernet_operations *ops, 182 struct list_head *net_exit_list) 183 { 184 struct net *net; 185 if (ops->exit) { 186 list_for_each_entry(net, net_exit_list, exit_list) 187 ops->exit(net); 188 } 189 if (ops->exit_batch) 190 ops->exit_batch(net_exit_list); 191 } 192 193 static void ops_free_list(const struct pernet_operations *ops, 194 struct list_head *net_exit_list) 195 { 196 struct net *net; 197 if (ops->size && ops->id) { 198 list_for_each_entry(net, net_exit_list, exit_list) 199 ops_free(ops, net); 200 } 201 } 202 203 /* should be called with nsid_lock held */ 204 static int alloc_netid(struct net *net, struct net *peer, int reqid) 205 { 206 int min = 0, max = 0; 207 208 if (reqid >= 0) { 209 min = reqid; 210 max = reqid + 1; 211 } 212 213 return idr_alloc(&net->netns_ids, peer, min, max, GFP_ATOMIC); 214 } 215 216 /* This function is used by idr_for_each(). If net is equal to peer, the 217 * function returns the id so that idr_for_each() stops. Because we cannot 218 * returns the id 0 (idr_for_each() will not stop), we return the magic value 219 * NET_ID_ZERO (-1) for it. 220 */ 221 #define NET_ID_ZERO -1 222 static int net_eq_idr(int id, void *net, void *peer) 223 { 224 if (net_eq(net, peer)) 225 return id ? : NET_ID_ZERO; 226 return 0; 227 } 228 229 /* Must be called from RCU-critical section or with nsid_lock held */ 230 static int __peernet2id(const struct net *net, struct net *peer) 231 { 232 int id = idr_for_each(&net->netns_ids, net_eq_idr, peer); 233 234 /* Magic value for id 0. */ 235 if (id == NET_ID_ZERO) 236 return 0; 237 if (id > 0) 238 return id; 239 240 return NETNSA_NSID_NOT_ASSIGNED; 241 } 242 243 static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid, 244 struct nlmsghdr *nlh, gfp_t gfp); 245 /* This function returns the id of a peer netns. If no id is assigned, one will 246 * be allocated and returned. 247 */ 248 int peernet2id_alloc(struct net *net, struct net *peer, gfp_t gfp) 249 { 250 int id; 251 252 if (refcount_read(&net->count) == 0) 253 return NETNSA_NSID_NOT_ASSIGNED; 254 255 spin_lock_bh(&net->nsid_lock); 256 id = __peernet2id(net, peer); 257 if (id >= 0) { 258 spin_unlock_bh(&net->nsid_lock); 259 return id; 260 } 261 262 /* When peer is obtained from RCU lists, we may race with 263 * its cleanup. Check whether it's alive, and this guarantees 264 * we never hash a peer back to net->netns_ids, after it has 265 * just been idr_remove()'d from there in cleanup_net(). 266 */ 267 if (!maybe_get_net(peer)) { 268 spin_unlock_bh(&net->nsid_lock); 269 return NETNSA_NSID_NOT_ASSIGNED; 270 } 271 272 id = alloc_netid(net, peer, -1); 273 spin_unlock_bh(&net->nsid_lock); 274 275 put_net(peer); 276 if (id < 0) 277 return NETNSA_NSID_NOT_ASSIGNED; 278 279 rtnl_net_notifyid(net, RTM_NEWNSID, id, 0, NULL, gfp); 280 281 return id; 282 } 283 EXPORT_SYMBOL_GPL(peernet2id_alloc); 284 285 /* This function returns, if assigned, the id of a peer netns. */ 286 int peernet2id(const struct net *net, struct net *peer) 287 { 288 int id; 289 290 rcu_read_lock(); 291 id = __peernet2id(net, peer); 292 rcu_read_unlock(); 293 294 return id; 295 } 296 EXPORT_SYMBOL(peernet2id); 297 298 /* This function returns true is the peer netns has an id assigned into the 299 * current netns. 300 */ 301 bool peernet_has_id(const struct net *net, struct net *peer) 302 { 303 return peernet2id(net, peer) >= 0; 304 } 305 306 struct net *get_net_ns_by_id(const struct net *net, int id) 307 { 308 struct net *peer; 309 310 if (id < 0) 311 return NULL; 312 313 rcu_read_lock(); 314 peer = idr_find(&net->netns_ids, id); 315 if (peer) 316 peer = maybe_get_net(peer); 317 rcu_read_unlock(); 318 319 return peer; 320 } 321 322 /* 323 * setup_net runs the initializers for the network namespace object. 324 */ 325 static __net_init int setup_net(struct net *net, struct user_namespace *user_ns) 326 { 327 /* Must be called with pernet_ops_rwsem held */ 328 const struct pernet_operations *ops, *saved_ops; 329 int error = 0; 330 LIST_HEAD(net_exit_list); 331 332 refcount_set(&net->count, 1); 333 refcount_set(&net->passive, 1); 334 get_random_bytes(&net->hash_mix, sizeof(u32)); 335 net->dev_base_seq = 1; 336 net->user_ns = user_ns; 337 idr_init(&net->netns_ids); 338 spin_lock_init(&net->nsid_lock); 339 mutex_init(&net->ipv4.ra_mutex); 340 341 list_for_each_entry(ops, &pernet_list, list) { 342 error = ops_init(ops, net); 343 if (error < 0) 344 goto out_undo; 345 } 346 down_write(&net_rwsem); 347 list_add_tail_rcu(&net->list, &net_namespace_list); 348 up_write(&net_rwsem); 349 out: 350 return error; 351 352 out_undo: 353 /* Walk through the list backwards calling the exit functions 354 * for the pernet modules whose init functions did not fail. 355 */ 356 list_add(&net->exit_list, &net_exit_list); 357 saved_ops = ops; 358 list_for_each_entry_continue_reverse(ops, &pernet_list, list) 359 ops_pre_exit_list(ops, &net_exit_list); 360 361 synchronize_rcu(); 362 363 ops = saved_ops; 364 list_for_each_entry_continue_reverse(ops, &pernet_list, list) 365 ops_exit_list(ops, &net_exit_list); 366 367 ops = saved_ops; 368 list_for_each_entry_continue_reverse(ops, &pernet_list, list) 369 ops_free_list(ops, &net_exit_list); 370 371 rcu_barrier(); 372 goto out; 373 } 374 375 static int __net_init net_defaults_init_net(struct net *net) 376 { 377 net->core.sysctl_somaxconn = SOMAXCONN; 378 return 0; 379 } 380 381 static struct pernet_operations net_defaults_ops = { 382 .init = net_defaults_init_net, 383 }; 384 385 static __init int net_defaults_init(void) 386 { 387 if (register_pernet_subsys(&net_defaults_ops)) 388 panic("Cannot initialize net default settings"); 389 390 return 0; 391 } 392 393 core_initcall(net_defaults_init); 394 395 #ifdef CONFIG_NET_NS 396 static struct ucounts *inc_net_namespaces(struct user_namespace *ns) 397 { 398 return inc_ucount(ns, current_euid(), UCOUNT_NET_NAMESPACES); 399 } 400 401 static void dec_net_namespaces(struct ucounts *ucounts) 402 { 403 dec_ucount(ucounts, UCOUNT_NET_NAMESPACES); 404 } 405 406 static struct kmem_cache *net_cachep __ro_after_init; 407 static struct workqueue_struct *netns_wq; 408 409 static struct net *net_alloc(void) 410 { 411 struct net *net = NULL; 412 struct net_generic *ng; 413 414 ng = net_alloc_generic(); 415 if (!ng) 416 goto out; 417 418 net = kmem_cache_zalloc(net_cachep, GFP_KERNEL); 419 if (!net) 420 goto out_free; 421 422 #ifdef CONFIG_KEYS 423 net->key_domain = kzalloc(sizeof(struct key_tag), GFP_KERNEL); 424 if (!net->key_domain) 425 goto out_free_2; 426 refcount_set(&net->key_domain->usage, 1); 427 #endif 428 429 rcu_assign_pointer(net->gen, ng); 430 out: 431 return net; 432 433 #ifdef CONFIG_KEYS 434 out_free_2: 435 kmem_cache_free(net_cachep, net); 436 net = NULL; 437 #endif 438 out_free: 439 kfree(ng); 440 goto out; 441 } 442 443 static void net_free(struct net *net) 444 { 445 kfree(rcu_access_pointer(net->gen)); 446 kmem_cache_free(net_cachep, net); 447 } 448 449 void net_drop_ns(void *p) 450 { 451 struct net *ns = p; 452 if (ns && refcount_dec_and_test(&ns->passive)) 453 net_free(ns); 454 } 455 456 struct net *copy_net_ns(unsigned long flags, 457 struct user_namespace *user_ns, struct net *old_net) 458 { 459 struct ucounts *ucounts; 460 struct net *net; 461 int rv; 462 463 if (!(flags & CLONE_NEWNET)) 464 return get_net(old_net); 465 466 ucounts = inc_net_namespaces(user_ns); 467 if (!ucounts) 468 return ERR_PTR(-ENOSPC); 469 470 net = net_alloc(); 471 if (!net) { 472 rv = -ENOMEM; 473 goto dec_ucounts; 474 } 475 refcount_set(&net->passive, 1); 476 net->ucounts = ucounts; 477 get_user_ns(user_ns); 478 479 rv = down_read_killable(&pernet_ops_rwsem); 480 if (rv < 0) 481 goto put_userns; 482 483 rv = setup_net(net, user_ns); 484 485 up_read(&pernet_ops_rwsem); 486 487 if (rv < 0) { 488 put_userns: 489 key_remove_domain(net->key_domain); 490 put_user_ns(user_ns); 491 net_drop_ns(net); 492 dec_ucounts: 493 dec_net_namespaces(ucounts); 494 return ERR_PTR(rv); 495 } 496 return net; 497 } 498 499 /** 500 * net_ns_get_ownership - get sysfs ownership data for @net 501 * @net: network namespace in question (can be NULL) 502 * @uid: kernel user ID for sysfs objects 503 * @gid: kernel group ID for sysfs objects 504 * 505 * Returns the uid/gid pair of root in the user namespace associated with the 506 * given network namespace. 507 */ 508 void net_ns_get_ownership(const struct net *net, kuid_t *uid, kgid_t *gid) 509 { 510 if (net) { 511 kuid_t ns_root_uid = make_kuid(net->user_ns, 0); 512 kgid_t ns_root_gid = make_kgid(net->user_ns, 0); 513 514 if (uid_valid(ns_root_uid)) 515 *uid = ns_root_uid; 516 517 if (gid_valid(ns_root_gid)) 518 *gid = ns_root_gid; 519 } else { 520 *uid = GLOBAL_ROOT_UID; 521 *gid = GLOBAL_ROOT_GID; 522 } 523 } 524 EXPORT_SYMBOL_GPL(net_ns_get_ownership); 525 526 static void unhash_nsid(struct net *net, struct net *last) 527 { 528 struct net *tmp; 529 /* This function is only called from cleanup_net() work, 530 * and this work is the only process, that may delete 531 * a net from net_namespace_list. So, when the below 532 * is executing, the list may only grow. Thus, we do not 533 * use for_each_net_rcu() or net_rwsem. 534 */ 535 for_each_net(tmp) { 536 int id; 537 538 spin_lock_bh(&tmp->nsid_lock); 539 id = __peernet2id(tmp, net); 540 if (id >= 0) 541 idr_remove(&tmp->netns_ids, id); 542 spin_unlock_bh(&tmp->nsid_lock); 543 if (id >= 0) 544 rtnl_net_notifyid(tmp, RTM_DELNSID, id, 0, NULL, 545 GFP_KERNEL); 546 if (tmp == last) 547 break; 548 } 549 spin_lock_bh(&net->nsid_lock); 550 idr_destroy(&net->netns_ids); 551 spin_unlock_bh(&net->nsid_lock); 552 } 553 554 static LLIST_HEAD(cleanup_list); 555 556 static void cleanup_net(struct work_struct *work) 557 { 558 const struct pernet_operations *ops; 559 struct net *net, *tmp, *last; 560 struct llist_node *net_kill_list; 561 LIST_HEAD(net_exit_list); 562 563 /* Atomically snapshot the list of namespaces to cleanup */ 564 net_kill_list = llist_del_all(&cleanup_list); 565 566 down_read(&pernet_ops_rwsem); 567 568 /* Don't let anyone else find us. */ 569 down_write(&net_rwsem); 570 llist_for_each_entry(net, net_kill_list, cleanup_list) 571 list_del_rcu(&net->list); 572 /* Cache last net. After we unlock rtnl, no one new net 573 * added to net_namespace_list can assign nsid pointer 574 * to a net from net_kill_list (see peernet2id_alloc()). 575 * So, we skip them in unhash_nsid(). 576 * 577 * Note, that unhash_nsid() does not delete nsid links 578 * between net_kill_list's nets, as they've already 579 * deleted from net_namespace_list. But, this would be 580 * useless anyway, as netns_ids are destroyed there. 581 */ 582 last = list_last_entry(&net_namespace_list, struct net, list); 583 up_write(&net_rwsem); 584 585 llist_for_each_entry(net, net_kill_list, cleanup_list) { 586 unhash_nsid(net, last); 587 list_add_tail(&net->exit_list, &net_exit_list); 588 } 589 590 /* Run all of the network namespace pre_exit methods */ 591 list_for_each_entry_reverse(ops, &pernet_list, list) 592 ops_pre_exit_list(ops, &net_exit_list); 593 594 /* 595 * Another CPU might be rcu-iterating the list, wait for it. 596 * This needs to be before calling the exit() notifiers, so 597 * the rcu_barrier() below isn't sufficient alone. 598 * Also the pre_exit() and exit() methods need this barrier. 599 */ 600 synchronize_rcu(); 601 602 /* Run all of the network namespace exit methods */ 603 list_for_each_entry_reverse(ops, &pernet_list, list) 604 ops_exit_list(ops, &net_exit_list); 605 606 /* Free the net generic variables */ 607 list_for_each_entry_reverse(ops, &pernet_list, list) 608 ops_free_list(ops, &net_exit_list); 609 610 up_read(&pernet_ops_rwsem); 611 612 /* Ensure there are no outstanding rcu callbacks using this 613 * network namespace. 614 */ 615 rcu_barrier(); 616 617 /* Finally it is safe to free my network namespace structure */ 618 list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) { 619 list_del_init(&net->exit_list); 620 dec_net_namespaces(net->ucounts); 621 key_remove_domain(net->key_domain); 622 put_user_ns(net->user_ns); 623 net_drop_ns(net); 624 } 625 } 626 627 /** 628 * net_ns_barrier - wait until concurrent net_cleanup_work is done 629 * 630 * cleanup_net runs from work queue and will first remove namespaces 631 * from the global list, then run net exit functions. 632 * 633 * Call this in module exit path to make sure that all netns 634 * ->exit ops have been invoked before the function is removed. 635 */ 636 void net_ns_barrier(void) 637 { 638 down_write(&pernet_ops_rwsem); 639 up_write(&pernet_ops_rwsem); 640 } 641 EXPORT_SYMBOL(net_ns_barrier); 642 643 static DECLARE_WORK(net_cleanup_work, cleanup_net); 644 645 void __put_net(struct net *net) 646 { 647 /* Cleanup the network namespace in process context */ 648 if (llist_add(&net->cleanup_list, &cleanup_list)) 649 queue_work(netns_wq, &net_cleanup_work); 650 } 651 EXPORT_SYMBOL_GPL(__put_net); 652 653 /** 654 * get_net_ns - increment the refcount of the network namespace 655 * @ns: common namespace (net) 656 * 657 * Returns the net's common namespace. 658 */ 659 struct ns_common *get_net_ns(struct ns_common *ns) 660 { 661 return &get_net(container_of(ns, struct net, ns))->ns; 662 } 663 EXPORT_SYMBOL_GPL(get_net_ns); 664 665 struct net *get_net_ns_by_fd(int fd) 666 { 667 struct file *file; 668 struct ns_common *ns; 669 struct net *net; 670 671 file = proc_ns_fget(fd); 672 if (IS_ERR(file)) 673 return ERR_CAST(file); 674 675 ns = get_proc_ns(file_inode(file)); 676 if (ns->ops == &netns_operations) 677 net = get_net(container_of(ns, struct net, ns)); 678 else 679 net = ERR_PTR(-EINVAL); 680 681 fput(file); 682 return net; 683 } 684 685 #else 686 struct net *get_net_ns_by_fd(int fd) 687 { 688 return ERR_PTR(-EINVAL); 689 } 690 #endif 691 EXPORT_SYMBOL_GPL(get_net_ns_by_fd); 692 693 struct net *get_net_ns_by_pid(pid_t pid) 694 { 695 struct task_struct *tsk; 696 struct net *net; 697 698 /* Lookup the network namespace */ 699 net = ERR_PTR(-ESRCH); 700 rcu_read_lock(); 701 tsk = find_task_by_vpid(pid); 702 if (tsk) { 703 struct nsproxy *nsproxy; 704 task_lock(tsk); 705 nsproxy = tsk->nsproxy; 706 if (nsproxy) 707 net = get_net(nsproxy->net_ns); 708 task_unlock(tsk); 709 } 710 rcu_read_unlock(); 711 return net; 712 } 713 EXPORT_SYMBOL_GPL(get_net_ns_by_pid); 714 715 static __net_init int net_ns_net_init(struct net *net) 716 { 717 #ifdef CONFIG_NET_NS 718 net->ns.ops = &netns_operations; 719 #endif 720 return ns_alloc_inum(&net->ns); 721 } 722 723 static __net_exit void net_ns_net_exit(struct net *net) 724 { 725 ns_free_inum(&net->ns); 726 } 727 728 static struct pernet_operations __net_initdata net_ns_ops = { 729 .init = net_ns_net_init, 730 .exit = net_ns_net_exit, 731 }; 732 733 static const struct nla_policy rtnl_net_policy[NETNSA_MAX + 1] = { 734 [NETNSA_NONE] = { .type = NLA_UNSPEC }, 735 [NETNSA_NSID] = { .type = NLA_S32 }, 736 [NETNSA_PID] = { .type = NLA_U32 }, 737 [NETNSA_FD] = { .type = NLA_U32 }, 738 [NETNSA_TARGET_NSID] = { .type = NLA_S32 }, 739 }; 740 741 static int rtnl_net_newid(struct sk_buff *skb, struct nlmsghdr *nlh, 742 struct netlink_ext_ack *extack) 743 { 744 struct net *net = sock_net(skb->sk); 745 struct nlattr *tb[NETNSA_MAX + 1]; 746 struct nlattr *nla; 747 struct net *peer; 748 int nsid, err; 749 750 err = nlmsg_parse_deprecated(nlh, sizeof(struct rtgenmsg), tb, 751 NETNSA_MAX, rtnl_net_policy, extack); 752 if (err < 0) 753 return err; 754 if (!tb[NETNSA_NSID]) { 755 NL_SET_ERR_MSG(extack, "nsid is missing"); 756 return -EINVAL; 757 } 758 nsid = nla_get_s32(tb[NETNSA_NSID]); 759 760 if (tb[NETNSA_PID]) { 761 peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID])); 762 nla = tb[NETNSA_PID]; 763 } else if (tb[NETNSA_FD]) { 764 peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD])); 765 nla = tb[NETNSA_FD]; 766 } else { 767 NL_SET_ERR_MSG(extack, "Peer netns reference is missing"); 768 return -EINVAL; 769 } 770 if (IS_ERR(peer)) { 771 NL_SET_BAD_ATTR(extack, nla); 772 NL_SET_ERR_MSG(extack, "Peer netns reference is invalid"); 773 return PTR_ERR(peer); 774 } 775 776 spin_lock_bh(&net->nsid_lock); 777 if (__peernet2id(net, peer) >= 0) { 778 spin_unlock_bh(&net->nsid_lock); 779 err = -EEXIST; 780 NL_SET_BAD_ATTR(extack, nla); 781 NL_SET_ERR_MSG(extack, 782 "Peer netns already has a nsid assigned"); 783 goto out; 784 } 785 786 err = alloc_netid(net, peer, nsid); 787 spin_unlock_bh(&net->nsid_lock); 788 if (err >= 0) { 789 rtnl_net_notifyid(net, RTM_NEWNSID, err, NETLINK_CB(skb).portid, 790 nlh, GFP_KERNEL); 791 err = 0; 792 } else if (err == -ENOSPC && nsid >= 0) { 793 err = -EEXIST; 794 NL_SET_BAD_ATTR(extack, tb[NETNSA_NSID]); 795 NL_SET_ERR_MSG(extack, "The specified nsid is already used"); 796 } 797 out: 798 put_net(peer); 799 return err; 800 } 801 802 static int rtnl_net_get_size(void) 803 { 804 return NLMSG_ALIGN(sizeof(struct rtgenmsg)) 805 + nla_total_size(sizeof(s32)) /* NETNSA_NSID */ 806 + nla_total_size(sizeof(s32)) /* NETNSA_CURRENT_NSID */ 807 ; 808 } 809 810 struct net_fill_args { 811 u32 portid; 812 u32 seq; 813 int flags; 814 int cmd; 815 int nsid; 816 bool add_ref; 817 int ref_nsid; 818 }; 819 820 static int rtnl_net_fill(struct sk_buff *skb, struct net_fill_args *args) 821 { 822 struct nlmsghdr *nlh; 823 struct rtgenmsg *rth; 824 825 nlh = nlmsg_put(skb, args->portid, args->seq, args->cmd, sizeof(*rth), 826 args->flags); 827 if (!nlh) 828 return -EMSGSIZE; 829 830 rth = nlmsg_data(nlh); 831 rth->rtgen_family = AF_UNSPEC; 832 833 if (nla_put_s32(skb, NETNSA_NSID, args->nsid)) 834 goto nla_put_failure; 835 836 if (args->add_ref && 837 nla_put_s32(skb, NETNSA_CURRENT_NSID, args->ref_nsid)) 838 goto nla_put_failure; 839 840 nlmsg_end(skb, nlh); 841 return 0; 842 843 nla_put_failure: 844 nlmsg_cancel(skb, nlh); 845 return -EMSGSIZE; 846 } 847 848 static int rtnl_net_valid_getid_req(struct sk_buff *skb, 849 const struct nlmsghdr *nlh, 850 struct nlattr **tb, 851 struct netlink_ext_ack *extack) 852 { 853 int i, err; 854 855 if (!netlink_strict_get_check(skb)) 856 return nlmsg_parse_deprecated(nlh, sizeof(struct rtgenmsg), 857 tb, NETNSA_MAX, rtnl_net_policy, 858 extack); 859 860 err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct rtgenmsg), tb, 861 NETNSA_MAX, rtnl_net_policy, 862 extack); 863 if (err) 864 return err; 865 866 for (i = 0; i <= NETNSA_MAX; i++) { 867 if (!tb[i]) 868 continue; 869 870 switch (i) { 871 case NETNSA_PID: 872 case NETNSA_FD: 873 case NETNSA_NSID: 874 case NETNSA_TARGET_NSID: 875 break; 876 default: 877 NL_SET_ERR_MSG(extack, "Unsupported attribute in peer netns getid request"); 878 return -EINVAL; 879 } 880 } 881 882 return 0; 883 } 884 885 static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh, 886 struct netlink_ext_ack *extack) 887 { 888 struct net *net = sock_net(skb->sk); 889 struct nlattr *tb[NETNSA_MAX + 1]; 890 struct net_fill_args fillargs = { 891 .portid = NETLINK_CB(skb).portid, 892 .seq = nlh->nlmsg_seq, 893 .cmd = RTM_NEWNSID, 894 }; 895 struct net *peer, *target = net; 896 struct nlattr *nla; 897 struct sk_buff *msg; 898 int err; 899 900 err = rtnl_net_valid_getid_req(skb, nlh, tb, extack); 901 if (err < 0) 902 return err; 903 if (tb[NETNSA_PID]) { 904 peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID])); 905 nla = tb[NETNSA_PID]; 906 } else if (tb[NETNSA_FD]) { 907 peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD])); 908 nla = tb[NETNSA_FD]; 909 } else if (tb[NETNSA_NSID]) { 910 peer = get_net_ns_by_id(net, nla_get_s32(tb[NETNSA_NSID])); 911 if (!peer) 912 peer = ERR_PTR(-ENOENT); 913 nla = tb[NETNSA_NSID]; 914 } else { 915 NL_SET_ERR_MSG(extack, "Peer netns reference is missing"); 916 return -EINVAL; 917 } 918 919 if (IS_ERR(peer)) { 920 NL_SET_BAD_ATTR(extack, nla); 921 NL_SET_ERR_MSG(extack, "Peer netns reference is invalid"); 922 return PTR_ERR(peer); 923 } 924 925 if (tb[NETNSA_TARGET_NSID]) { 926 int id = nla_get_s32(tb[NETNSA_TARGET_NSID]); 927 928 target = rtnl_get_net_ns_capable(NETLINK_CB(skb).sk, id); 929 if (IS_ERR(target)) { 930 NL_SET_BAD_ATTR(extack, tb[NETNSA_TARGET_NSID]); 931 NL_SET_ERR_MSG(extack, 932 "Target netns reference is invalid"); 933 err = PTR_ERR(target); 934 goto out; 935 } 936 fillargs.add_ref = true; 937 fillargs.ref_nsid = peernet2id(net, peer); 938 } 939 940 msg = nlmsg_new(rtnl_net_get_size(), GFP_KERNEL); 941 if (!msg) { 942 err = -ENOMEM; 943 goto out; 944 } 945 946 fillargs.nsid = peernet2id(target, peer); 947 err = rtnl_net_fill(msg, &fillargs); 948 if (err < 0) 949 goto err_out; 950 951 err = rtnl_unicast(msg, net, NETLINK_CB(skb).portid); 952 goto out; 953 954 err_out: 955 nlmsg_free(msg); 956 out: 957 if (fillargs.add_ref) 958 put_net(target); 959 put_net(peer); 960 return err; 961 } 962 963 struct rtnl_net_dump_cb { 964 struct net *tgt_net; 965 struct net *ref_net; 966 struct sk_buff *skb; 967 struct net_fill_args fillargs; 968 int idx; 969 int s_idx; 970 }; 971 972 /* Runs in RCU-critical section. */ 973 static int rtnl_net_dumpid_one(int id, void *peer, void *data) 974 { 975 struct rtnl_net_dump_cb *net_cb = (struct rtnl_net_dump_cb *)data; 976 int ret; 977 978 if (net_cb->idx < net_cb->s_idx) 979 goto cont; 980 981 net_cb->fillargs.nsid = id; 982 if (net_cb->fillargs.add_ref) 983 net_cb->fillargs.ref_nsid = __peernet2id(net_cb->ref_net, peer); 984 ret = rtnl_net_fill(net_cb->skb, &net_cb->fillargs); 985 if (ret < 0) 986 return ret; 987 988 cont: 989 net_cb->idx++; 990 return 0; 991 } 992 993 static int rtnl_valid_dump_net_req(const struct nlmsghdr *nlh, struct sock *sk, 994 struct rtnl_net_dump_cb *net_cb, 995 struct netlink_callback *cb) 996 { 997 struct netlink_ext_ack *extack = cb->extack; 998 struct nlattr *tb[NETNSA_MAX + 1]; 999 int err, i; 1000 1001 err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct rtgenmsg), tb, 1002 NETNSA_MAX, rtnl_net_policy, 1003 extack); 1004 if (err < 0) 1005 return err; 1006 1007 for (i = 0; i <= NETNSA_MAX; i++) { 1008 if (!tb[i]) 1009 continue; 1010 1011 if (i == NETNSA_TARGET_NSID) { 1012 struct net *net; 1013 1014 net = rtnl_get_net_ns_capable(sk, nla_get_s32(tb[i])); 1015 if (IS_ERR(net)) { 1016 NL_SET_BAD_ATTR(extack, tb[i]); 1017 NL_SET_ERR_MSG(extack, 1018 "Invalid target network namespace id"); 1019 return PTR_ERR(net); 1020 } 1021 net_cb->fillargs.add_ref = true; 1022 net_cb->ref_net = net_cb->tgt_net; 1023 net_cb->tgt_net = net; 1024 } else { 1025 NL_SET_BAD_ATTR(extack, tb[i]); 1026 NL_SET_ERR_MSG(extack, 1027 "Unsupported attribute in dump request"); 1028 return -EINVAL; 1029 } 1030 } 1031 1032 return 0; 1033 } 1034 1035 static int rtnl_net_dumpid(struct sk_buff *skb, struct netlink_callback *cb) 1036 { 1037 struct rtnl_net_dump_cb net_cb = { 1038 .tgt_net = sock_net(skb->sk), 1039 .skb = skb, 1040 .fillargs = { 1041 .portid = NETLINK_CB(cb->skb).portid, 1042 .seq = cb->nlh->nlmsg_seq, 1043 .flags = NLM_F_MULTI, 1044 .cmd = RTM_NEWNSID, 1045 }, 1046 .idx = 0, 1047 .s_idx = cb->args[0], 1048 }; 1049 int err = 0; 1050 1051 if (cb->strict_check) { 1052 err = rtnl_valid_dump_net_req(cb->nlh, skb->sk, &net_cb, cb); 1053 if (err < 0) 1054 goto end; 1055 } 1056 1057 rcu_read_lock(); 1058 idr_for_each(&net_cb.tgt_net->netns_ids, rtnl_net_dumpid_one, &net_cb); 1059 rcu_read_unlock(); 1060 1061 cb->args[0] = net_cb.idx; 1062 end: 1063 if (net_cb.fillargs.add_ref) 1064 put_net(net_cb.tgt_net); 1065 return err < 0 ? err : skb->len; 1066 } 1067 1068 static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid, 1069 struct nlmsghdr *nlh, gfp_t gfp) 1070 { 1071 struct net_fill_args fillargs = { 1072 .portid = portid, 1073 .seq = nlh ? nlh->nlmsg_seq : 0, 1074 .cmd = cmd, 1075 .nsid = id, 1076 }; 1077 struct sk_buff *msg; 1078 int err = -ENOMEM; 1079 1080 msg = nlmsg_new(rtnl_net_get_size(), gfp); 1081 if (!msg) 1082 goto out; 1083 1084 err = rtnl_net_fill(msg, &fillargs); 1085 if (err < 0) 1086 goto err_out; 1087 1088 rtnl_notify(msg, net, portid, RTNLGRP_NSID, nlh, gfp); 1089 return; 1090 1091 err_out: 1092 nlmsg_free(msg); 1093 out: 1094 rtnl_set_sk_err(net, RTNLGRP_NSID, err); 1095 } 1096 1097 static int __init net_ns_init(void) 1098 { 1099 struct net_generic *ng; 1100 1101 #ifdef CONFIG_NET_NS 1102 net_cachep = kmem_cache_create("net_namespace", sizeof(struct net), 1103 SMP_CACHE_BYTES, 1104 SLAB_PANIC|SLAB_ACCOUNT, NULL); 1105 1106 /* Create workqueue for cleanup */ 1107 netns_wq = create_singlethread_workqueue("netns"); 1108 if (!netns_wq) 1109 panic("Could not create netns workq"); 1110 #endif 1111 1112 ng = net_alloc_generic(); 1113 if (!ng) 1114 panic("Could not allocate generic netns"); 1115 1116 rcu_assign_pointer(init_net.gen, ng); 1117 1118 preempt_disable(); 1119 __net_gen_cookie(&init_net); 1120 preempt_enable(); 1121 1122 down_write(&pernet_ops_rwsem); 1123 if (setup_net(&init_net, &init_user_ns)) 1124 panic("Could not setup the initial network namespace"); 1125 1126 init_net_initialized = true; 1127 up_write(&pernet_ops_rwsem); 1128 1129 if (register_pernet_subsys(&net_ns_ops)) 1130 panic("Could not register network namespace subsystems"); 1131 1132 rtnl_register(PF_UNSPEC, RTM_NEWNSID, rtnl_net_newid, NULL, 1133 RTNL_FLAG_DOIT_UNLOCKED); 1134 rtnl_register(PF_UNSPEC, RTM_GETNSID, rtnl_net_getid, rtnl_net_dumpid, 1135 RTNL_FLAG_DOIT_UNLOCKED); 1136 1137 return 0; 1138 } 1139 1140 pure_initcall(net_ns_init); 1141 1142 #ifdef CONFIG_NET_NS 1143 static int __register_pernet_operations(struct list_head *list, 1144 struct pernet_operations *ops) 1145 { 1146 struct net *net; 1147 int error; 1148 LIST_HEAD(net_exit_list); 1149 1150 list_add_tail(&ops->list, list); 1151 if (ops->init || (ops->id && ops->size)) { 1152 /* We held write locked pernet_ops_rwsem, and parallel 1153 * setup_net() and cleanup_net() are not possible. 1154 */ 1155 for_each_net(net) { 1156 error = ops_init(ops, net); 1157 if (error) 1158 goto out_undo; 1159 list_add_tail(&net->exit_list, &net_exit_list); 1160 } 1161 } 1162 return 0; 1163 1164 out_undo: 1165 /* If I have an error cleanup all namespaces I initialized */ 1166 list_del(&ops->list); 1167 ops_pre_exit_list(ops, &net_exit_list); 1168 synchronize_rcu(); 1169 ops_exit_list(ops, &net_exit_list); 1170 ops_free_list(ops, &net_exit_list); 1171 return error; 1172 } 1173 1174 static void __unregister_pernet_operations(struct pernet_operations *ops) 1175 { 1176 struct net *net; 1177 LIST_HEAD(net_exit_list); 1178 1179 list_del(&ops->list); 1180 /* See comment in __register_pernet_operations() */ 1181 for_each_net(net) 1182 list_add_tail(&net->exit_list, &net_exit_list); 1183 ops_pre_exit_list(ops, &net_exit_list); 1184 synchronize_rcu(); 1185 ops_exit_list(ops, &net_exit_list); 1186 ops_free_list(ops, &net_exit_list); 1187 } 1188 1189 #else 1190 1191 static int __register_pernet_operations(struct list_head *list, 1192 struct pernet_operations *ops) 1193 { 1194 if (!init_net_initialized) { 1195 list_add_tail(&ops->list, list); 1196 return 0; 1197 } 1198 1199 return ops_init(ops, &init_net); 1200 } 1201 1202 static void __unregister_pernet_operations(struct pernet_operations *ops) 1203 { 1204 if (!init_net_initialized) { 1205 list_del(&ops->list); 1206 } else { 1207 LIST_HEAD(net_exit_list); 1208 list_add(&init_net.exit_list, &net_exit_list); 1209 ops_pre_exit_list(ops, &net_exit_list); 1210 synchronize_rcu(); 1211 ops_exit_list(ops, &net_exit_list); 1212 ops_free_list(ops, &net_exit_list); 1213 } 1214 } 1215 1216 #endif /* CONFIG_NET_NS */ 1217 1218 static DEFINE_IDA(net_generic_ids); 1219 1220 static int register_pernet_operations(struct list_head *list, 1221 struct pernet_operations *ops) 1222 { 1223 int error; 1224 1225 if (ops->id) { 1226 error = ida_alloc_min(&net_generic_ids, MIN_PERNET_OPS_ID, 1227 GFP_KERNEL); 1228 if (error < 0) 1229 return error; 1230 *ops->id = error; 1231 max_gen_ptrs = max(max_gen_ptrs, *ops->id + 1); 1232 } 1233 error = __register_pernet_operations(list, ops); 1234 if (error) { 1235 rcu_barrier(); 1236 if (ops->id) 1237 ida_free(&net_generic_ids, *ops->id); 1238 } 1239 1240 return error; 1241 } 1242 1243 static void unregister_pernet_operations(struct pernet_operations *ops) 1244 { 1245 __unregister_pernet_operations(ops); 1246 rcu_barrier(); 1247 if (ops->id) 1248 ida_free(&net_generic_ids, *ops->id); 1249 } 1250 1251 /** 1252 * register_pernet_subsys - register a network namespace subsystem 1253 * @ops: pernet operations structure for the subsystem 1254 * 1255 * Register a subsystem which has init and exit functions 1256 * that are called when network namespaces are created and 1257 * destroyed respectively. 1258 * 1259 * When registered all network namespace init functions are 1260 * called for every existing network namespace. Allowing kernel 1261 * modules to have a race free view of the set of network namespaces. 1262 * 1263 * When a new network namespace is created all of the init 1264 * methods are called in the order in which they were registered. 1265 * 1266 * When a network namespace is destroyed all of the exit methods 1267 * are called in the reverse of the order with which they were 1268 * registered. 1269 */ 1270 int register_pernet_subsys(struct pernet_operations *ops) 1271 { 1272 int error; 1273 down_write(&pernet_ops_rwsem); 1274 error = register_pernet_operations(first_device, ops); 1275 up_write(&pernet_ops_rwsem); 1276 return error; 1277 } 1278 EXPORT_SYMBOL_GPL(register_pernet_subsys); 1279 1280 /** 1281 * unregister_pernet_subsys - unregister a network namespace subsystem 1282 * @ops: pernet operations structure to manipulate 1283 * 1284 * Remove the pernet operations structure from the list to be 1285 * used when network namespaces are created or destroyed. In 1286 * addition run the exit method for all existing network 1287 * namespaces. 1288 */ 1289 void unregister_pernet_subsys(struct pernet_operations *ops) 1290 { 1291 down_write(&pernet_ops_rwsem); 1292 unregister_pernet_operations(ops); 1293 up_write(&pernet_ops_rwsem); 1294 } 1295 EXPORT_SYMBOL_GPL(unregister_pernet_subsys); 1296 1297 /** 1298 * register_pernet_device - register a network namespace device 1299 * @ops: pernet operations structure for the subsystem 1300 * 1301 * Register a device which has init and exit functions 1302 * that are called when network namespaces are created and 1303 * destroyed respectively. 1304 * 1305 * When registered all network namespace init functions are 1306 * called for every existing network namespace. Allowing kernel 1307 * modules to have a race free view of the set of network namespaces. 1308 * 1309 * When a new network namespace is created all of the init 1310 * methods are called in the order in which they were registered. 1311 * 1312 * When a network namespace is destroyed all of the exit methods 1313 * are called in the reverse of the order with which they were 1314 * registered. 1315 */ 1316 int register_pernet_device(struct pernet_operations *ops) 1317 { 1318 int error; 1319 down_write(&pernet_ops_rwsem); 1320 error = register_pernet_operations(&pernet_list, ops); 1321 if (!error && (first_device == &pernet_list)) 1322 first_device = &ops->list; 1323 up_write(&pernet_ops_rwsem); 1324 return error; 1325 } 1326 EXPORT_SYMBOL_GPL(register_pernet_device); 1327 1328 /** 1329 * unregister_pernet_device - unregister a network namespace netdevice 1330 * @ops: pernet operations structure to manipulate 1331 * 1332 * Remove the pernet operations structure from the list to be 1333 * used when network namespaces are created or destroyed. In 1334 * addition run the exit method for all existing network 1335 * namespaces. 1336 */ 1337 void unregister_pernet_device(struct pernet_operations *ops) 1338 { 1339 down_write(&pernet_ops_rwsem); 1340 if (&ops->list == first_device) 1341 first_device = first_device->next; 1342 unregister_pernet_operations(ops); 1343 up_write(&pernet_ops_rwsem); 1344 } 1345 EXPORT_SYMBOL_GPL(unregister_pernet_device); 1346 1347 #ifdef CONFIG_NET_NS 1348 static struct ns_common *netns_get(struct task_struct *task) 1349 { 1350 struct net *net = NULL; 1351 struct nsproxy *nsproxy; 1352 1353 task_lock(task); 1354 nsproxy = task->nsproxy; 1355 if (nsproxy) 1356 net = get_net(nsproxy->net_ns); 1357 task_unlock(task); 1358 1359 return net ? &net->ns : NULL; 1360 } 1361 1362 static inline struct net *to_net_ns(struct ns_common *ns) 1363 { 1364 return container_of(ns, struct net, ns); 1365 } 1366 1367 static void netns_put(struct ns_common *ns) 1368 { 1369 put_net(to_net_ns(ns)); 1370 } 1371 1372 static int netns_install(struct nsset *nsset, struct ns_common *ns) 1373 { 1374 struct nsproxy *nsproxy = nsset->nsproxy; 1375 struct net *net = to_net_ns(ns); 1376 1377 if (!ns_capable(net->user_ns, CAP_SYS_ADMIN) || 1378 !ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN)) 1379 return -EPERM; 1380 1381 put_net(nsproxy->net_ns); 1382 nsproxy->net_ns = get_net(net); 1383 return 0; 1384 } 1385 1386 static struct user_namespace *netns_owner(struct ns_common *ns) 1387 { 1388 return to_net_ns(ns)->user_ns; 1389 } 1390 1391 const struct proc_ns_operations netns_operations = { 1392 .name = "net", 1393 .type = CLONE_NEWNET, 1394 .get = netns_get, 1395 .put = netns_put, 1396 .install = netns_install, 1397 .owner = netns_owner, 1398 }; 1399 #endif 1400