[Devel] [PATCH VZ7 3/3] netlink: allow messages with family PF_BRIDGE type RTM_xxxNEIGH in CT

[Andrew Vagin]

On Thu, Oct 27, 2016 at 06:50:17PM +0300, Pavel Tikhomirov wrote:
> While reproducing the problem mentioned in patch 1 I found that
> we need it to be able to configure vxlan fdb
> 
> https://jira.sw.ru/browse/PSBM-53629
> Signed-off-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
> ---
>  include/linux/ve.h   |  4 ++--
>  kernel/ve/ve.c       | 11 ++++++++++-
>  net/core/rtnetlink.c |  4 ++--
>  net/socket.c         |  2 +-
>  4 files changed, 15 insertions(+), 6 deletions(-)
> 
> diff --git a/include/linux/ve.h b/include/linux/ve.h
> index ad40726..edff7e4 100644
> --- a/include/linux/ve.h
> +++ b/include/linux/ve.h
> @@ -160,7 +160,7 @@ extern struct kobject * kobject_create_and_add_ve(const char *name,
>  
>  extern struct kmapset_set ve_sysfs_perms;
>  
> -extern int vz_security_family_check(struct net *net, int family);
> +extern int vz_security_family_check(struct net *net, int family, int type);
>  extern int vz_security_protocol_check(struct net *net, int protocol);
>  
>  extern struct task_struct *kthread_create_on_node_ve(struct ve_struct *ve,
> @@ -247,7 +247,7 @@ static inline void ve_mount_nr_dec(void)
>  
>  #define ve_uevent_seqnum uevent_seqnum
>  
> -static inline int vz_security_family_check(struct net *net, int family) { return 0; }
> +static inline int vz_security_family_check(struct net *net, int family, int type) { return 0; }
>  static inline int vz_security_protocol_check(struct net *net, int protocol) { return 0; }
>  
>  #define ve_utsname	system_utsname
> diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
> index 8afff3d..df42759 100644
> --- a/kernel/ve/ve.c
> +++ b/kernel/ve/ve.c
> @@ -41,6 +41,7 @@
>  #include <uapi/linux/vzcalluser.h>
>  #include <linux/venet.h>
>  #include <linux/vziptable_defs.h>
> +#include <net/rtnetlink.h>
>  
>  static struct kmem_cache *ve_cachep;
>  
> @@ -180,7 +181,7 @@ EXPORT_SYMBOL(get_ve_by_id);
>  EXPORT_SYMBOL(ve_list_lock);
>  EXPORT_SYMBOL(ve_list_head);
>  
> -int vz_security_family_check(struct net *net, int family)
> +int vz_security_family_check(struct net *net, int family, int type)

Do you know why we need vz_security_family_check() in rhel7?

>  {
>  	if (ve_is_super(net->owner_ve))
>  		return 0;
> @@ -195,6 +196,14 @@ int vz_security_family_check(struct net *net, int family)
>  	case PF_PPPOX:
>  	case PF_KEY:
>  		return 0;
> +	case PF_BRIDGE:
> +		if (type)
> +			switch (type) {
> +				case RTM_NEWNEIGH:
> +				case RTM_DELNEIGH:
> +				case RTM_GETNEIGH:
> +					return 0;
> +			}
>  	default:
>  		return -EAFNOSUPPORT;
>  	}
> diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
> index 8e72446..1ba3a9d 100644
> --- a/net/core/rtnetlink.c
> +++ b/net/core/rtnetlink.c
> @@ -2325,7 +2325,7 @@ static int rtnl_dump_all(struct sk_buff *skb, struct netlink_callback *cb)
>  		if (rtnl_msg_handlers[idx] == NULL ||
>  		    rtnl_msg_handlers[idx][type].dumpit == NULL)
>  			continue;
> -		if (vz_security_family_check(net, idx))
> +		if (vz_security_family_check(net, idx, cb->nlh->nlmsg_type))
>  			continue;
>  		if (idx > s_idx) {
>  			memset(&cb->args[0], 0, sizeof(cb->args));
> @@ -3040,7 +3040,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
>  		return 0;
>  
>  	family = ((struct rtgenmsg *)nlmsg_data(nlh))->rtgen_family;
> -	if (vz_security_family_check(net, family))
> +	if (vz_security_family_check(net, family, nlh->nlmsg_type))
>  		return -EAFNOSUPPORT;
>  
>  	sz_idx = type>>2;
> diff --git a/net/socket.c b/net/socket.c
> index 7ec5de5..bb96466 100644
> --- a/net/socket.c
> +++ b/net/socket.c
> @@ -1264,7 +1264,7 @@ int __sock_create(struct net *net, int family, int type, int protocol,
>  	}
>  
>  	/* VZ compatibility layer */
> -	err = vz_security_family_check(net, family);
> +	err = vz_security_family_check(net, family, 0);
>  	if (err < 0)
>  		return err;
>  
> -- 
> 2.7.4
>