1// SPDX-License-Identifier: GPL-2.0-only
   2#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
   3
   4#include <linux/workqueue.h>
   5#include <linux/rtnetlink.h>
   6#include <linux/cache.h>
   7#include <linux/slab.h>
   8#include <linux/list.h>
   9#include <linux/delay.h>
  10#include <linux/sched.h>
  11#include <linux/idr.h>
  12#include <linux/rculist.h>
  13#include <linux/nsproxy.h>
  14#include <linux/fs.h>
  15#include <linux/proc_ns.h>
  16#include <linux/file.h>
  17#include <linux/export.h>
  18#include <linux/user_namespace.h>
  19#include <linux/net_namespace.h>
  20#include <linux/sched/task.h>
  21#include <linux/uidgid.h>
  22#include <linux/cookie.h>
  23
  24#include <net/sock.h>
  25#include <net/netlink.h>
  26#include <net/net_namespace.h>
  27#include <net/netns/generic.h>
  28
  29/*
  30 *	Our network namespace constructor/destructor lists
  31 */
  32
  33static LIST_HEAD(pernet_list);
  34static struct list_head *first_device = &pernet_list;
 
  35
  36LIST_HEAD(net_namespace_list);
  37EXPORT_SYMBOL_GPL(net_namespace_list);
  38
  39/* Protects net_namespace_list. Nests iside rtnl_lock() */
  40DECLARE_RWSEM(net_rwsem);
  41EXPORT_SYMBOL_GPL(net_rwsem);
  42
  43#ifdef CONFIG_KEYS
  44static struct key_tag init_net_key_domain = { .usage = REFCOUNT_INIT(1) };
  45#endif
  46
  47struct net init_net = {
  48	.ns.count	= REFCOUNT_INIT(1),
  49	.dev_base_head	= LIST_HEAD_INIT(init_net.dev_base_head),
  50#ifdef CONFIG_KEYS
  51	.key_domain	= &init_net_key_domain,
  52#endif
  53};
  54EXPORT_SYMBOL(init_net);
  55
  56static bool init_net_initialized;
  57/*
  58 * pernet_ops_rwsem: protects: pernet_list, net_generic_ids,
  59 * init_net_initialized and first_device pointer.
  60 * This is internal net namespace object. Please, don't use it
  61 * outside.
  62 */
  63DECLARE_RWSEM(pernet_ops_rwsem);
  64EXPORT_SYMBOL_GPL(pernet_ops_rwsem);
  65
  66#define MIN_PERNET_OPS_ID	\
  67	((sizeof(struct net_generic) + sizeof(void *) - 1) / sizeof(void *))
  68
  69#define INITIAL_NET_GEN_PTRS	13 /* +1 for len +2 for rcu_head */
  70
  71static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS;
  72
  73DEFINE_COOKIE(net_cookie);
  74
  75static struct net_generic *net_alloc_generic(void)
  76{
  77	struct net_generic *ng;
  78	unsigned int generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]);
  79
  80	ng = kzalloc(generic_size, GFP_KERNEL);
  81	if (ng)
  82		ng->s.len = max_gen_ptrs;
  83
  84	return ng;
  85}
  86
  87static int net_assign_generic(struct net *net, unsigned int id, void *data)
  88{
  89	struct net_generic *ng, *old_ng;
  90
  91	BUG_ON(id < MIN_PERNET_OPS_ID);
 
  92
  93	old_ng = rcu_dereference_protected(net->gen,
  94					   lockdep_is_held(&pernet_ops_rwsem));
  95	if (old_ng->s.len > id) {
  96		old_ng->ptr[id] = data;
  97		return 0;
  98	}
  99
 100	ng = net_alloc_generic();
 
 101	if (ng == NULL)
 102		return -ENOMEM;
 103
 104	/*
 105	 * Some synchronisation notes:
 106	 *
 107	 * The net_generic explores the net->gen array inside rcu
 108	 * read section. Besides once set the net->gen->ptr[x]
 109	 * pointer never changes (see rules in netns/generic.h).
 110	 *
 111	 * That said, we simply duplicate this array and schedule
 112	 * the old copy for kfree after a grace period.
 113	 */
 114
 115	memcpy(&ng->ptr[MIN_PERNET_OPS_ID], &old_ng->ptr[MIN_PERNET_OPS_ID],
 116	       (old_ng->s.len - MIN_PERNET_OPS_ID) * sizeof(void *));
 117	ng->ptr[id] = data;
 118
 119	rcu_assign_pointer(net->gen, ng);
 120	kfree_rcu(old_ng, s.rcu);
 
 
 121	return 0;
 122}
 123
 124static int ops_init(const struct pernet_operations *ops, struct net *net)
 125{
 126	int err = -ENOMEM;
 127	void *data = NULL;
 128
 129	if (ops->id && ops->size) {
 130		data = kzalloc(ops->size, GFP_KERNEL);
 131		if (!data)
 132			goto out;
 133
 134		err = net_assign_generic(net, *ops->id, data);
 135		if (err)
 136			goto cleanup;
 
 
 137	}
 138	err = 0;
 139	if (ops->init)
 140		err = ops->init(net);
 141	if (!err)
 142		return 0;
 143
 144cleanup:
 145	kfree(data);
 146
 147out:
 148	return err;
 149}
 150
 151static void ops_free(const struct pernet_operations *ops, struct net *net)
 152{
 153	if (ops->id && ops->size) {
 154		kfree(net_generic(net, *ops->id));
 155	}
 156}
 157
 158static void ops_pre_exit_list(const struct pernet_operations *ops,
 159			      struct list_head *net_exit_list)
 160{
 161	struct net *net;
 162
 163	if (ops->pre_exit) {
 164		list_for_each_entry(net, net_exit_list, exit_list)
 165			ops->pre_exit(net);
 166	}
 167}
 168
 169static void ops_exit_list(const struct pernet_operations *ops,
 170			  struct list_head *net_exit_list)
 171{
 172	struct net *net;
 173	if (ops->exit) {
 174		list_for_each_entry(net, net_exit_list, exit_list)
 175			ops->exit(net);
 176	}
 177	if (ops->exit_batch)
 178		ops->exit_batch(net_exit_list);
 179}
 180
 181static void ops_free_list(const struct pernet_operations *ops,
 182			  struct list_head *net_exit_list)
 183{
 184	struct net *net;
 185	if (ops->size && ops->id) {
 186		list_for_each_entry(net, net_exit_list, exit_list)
 187			ops_free(ops, net);
 188	}
 189}
 190
 191/* should be called with nsid_lock held */
 192static int alloc_netid(struct net *net, struct net *peer, int reqid)
 193{
 194	int min = 0, max = 0;
 195
 196	if (reqid >= 0) {
 197		min = reqid;
 198		max = reqid + 1;
 199	}
 200
 201	return idr_alloc(&net->netns_ids, peer, min, max, GFP_ATOMIC);
 202}
 203
 204/* This function is used by idr_for_each(). If net is equal to peer, the
 205 * function returns the id so that idr_for_each() stops. Because we cannot
 206 * returns the id 0 (idr_for_each() will not stop), we return the magic value
 207 * NET_ID_ZERO (-1) for it.
 208 */
 209#define NET_ID_ZERO -1
 210static int net_eq_idr(int id, void *net, void *peer)
 211{
 212	if (net_eq(net, peer))
 213		return id ? : NET_ID_ZERO;
 214	return 0;
 215}
 216
 217/* Must be called from RCU-critical section or with nsid_lock held */
 218static int __peernet2id(const struct net *net, struct net *peer)
 219{
 220	int id = idr_for_each(&net->netns_ids, net_eq_idr, peer);
 221
 222	/* Magic value for id 0. */
 223	if (id == NET_ID_ZERO)
 224		return 0;
 225	if (id > 0)
 226		return id;
 227
 228	return NETNSA_NSID_NOT_ASSIGNED;
 229}
 230
 231static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
 232			      struct nlmsghdr *nlh, gfp_t gfp);
 233/* This function returns the id of a peer netns. If no id is assigned, one will
 234 * be allocated and returned.
 235 */
 236int peernet2id_alloc(struct net *net, struct net *peer, gfp_t gfp)
 237{
 238	int id;
 239
 240	if (refcount_read(&net->ns.count) == 0)
 241		return NETNSA_NSID_NOT_ASSIGNED;
 242
 243	spin_lock_bh(&net->nsid_lock);
 244	id = __peernet2id(net, peer);
 245	if (id >= 0) {
 246		spin_unlock_bh(&net->nsid_lock);
 247		return id;
 248	}
 249
 250	/* When peer is obtained from RCU lists, we may race with
 251	 * its cleanup. Check whether it's alive, and this guarantees
 252	 * we never hash a peer back to net->netns_ids, after it has
 253	 * just been idr_remove()'d from there in cleanup_net().
 254	 */
 255	if (!maybe_get_net(peer)) {
 256		spin_unlock_bh(&net->nsid_lock);
 257		return NETNSA_NSID_NOT_ASSIGNED;
 258	}
 259
 260	id = alloc_netid(net, peer, -1);
 261	spin_unlock_bh(&net->nsid_lock);
 262
 263	put_net(peer);
 264	if (id < 0)
 265		return NETNSA_NSID_NOT_ASSIGNED;
 266
 267	rtnl_net_notifyid(net, RTM_NEWNSID, id, 0, NULL, gfp);
 268
 269	return id;
 270}
 271EXPORT_SYMBOL_GPL(peernet2id_alloc);
 272
 273/* This function returns, if assigned, the id of a peer netns. */
 274int peernet2id(const struct net *net, struct net *peer)
 275{
 276	int id;
 277
 278	rcu_read_lock();
 279	id = __peernet2id(net, peer);
 280	rcu_read_unlock();
 281
 282	return id;
 283}
 284EXPORT_SYMBOL(peernet2id);
 285
 286/* This function returns true is the peer netns has an id assigned into the
 287 * current netns.
 288 */
 289bool peernet_has_id(const struct net *net, struct net *peer)
 290{
 291	return peernet2id(net, peer) >= 0;
 292}
 293
 294struct net *get_net_ns_by_id(const struct net *net, int id)
 295{
 296	struct net *peer;
 297
 298	if (id < 0)
 299		return NULL;
 300
 301	rcu_read_lock();
 302	peer = idr_find(&net->netns_ids, id);
 303	if (peer)
 304		peer = maybe_get_net(peer);
 305	rcu_read_unlock();
 306
 307	return peer;
 308}
 309
 310/*
 311 * setup_net runs the initializers for the network namespace object.
 312 */
 313static __net_init int setup_net(struct net *net, struct user_namespace *user_ns)
 314{
 315	/* Must be called with pernet_ops_rwsem held */
 316	const struct pernet_operations *ops, *saved_ops;
 317	int error = 0;
 318	LIST_HEAD(net_exit_list);
 319
 320	refcount_set(&net->ns.count, 1);
 321	refcount_set(&net->passive, 1);
 322	get_random_bytes(&net->hash_mix, sizeof(u32));
 323	preempt_disable();
 324	net->net_cookie = gen_cookie_next(&net_cookie);
 325	preempt_enable();
 326	net->dev_base_seq = 1;
 327	net->user_ns = user_ns;
 328	idr_init(&net->netns_ids);
 329	spin_lock_init(&net->nsid_lock);
 330	mutex_init(&net->ipv4.ra_mutex);
 331
 332	list_for_each_entry(ops, &pernet_list, list) {
 333		error = ops_init(ops, net);
 334		if (error < 0)
 335			goto out_undo;
 336	}
 337	down_write(&net_rwsem);
 338	list_add_tail_rcu(&net->list, &net_namespace_list);
 339	up_write(&net_rwsem);
 340out:
 341	return error;
 342
 343out_undo:
 344	/* Walk through the list backwards calling the exit functions
 345	 * for the pernet modules whose init functions did not fail.
 346	 */
 347	list_add(&net->exit_list, &net_exit_list);
 348	saved_ops = ops;
 349	list_for_each_entry_continue_reverse(ops, &pernet_list, list)
 350		ops_pre_exit_list(ops, &net_exit_list);
 351
 352	synchronize_rcu();
 353
 354	ops = saved_ops;
 355	list_for_each_entry_continue_reverse(ops, &pernet_list, list)
 356		ops_exit_list(ops, &net_exit_list);
 357
 358	ops = saved_ops;
 359	list_for_each_entry_continue_reverse(ops, &pernet_list, list)
 360		ops_free_list(ops, &net_exit_list);
 361
 362	rcu_barrier();
 363	goto out;
 364}
 365
 366static int __net_init net_defaults_init_net(struct net *net)
 367{
 368	net->core.sysctl_somaxconn = SOMAXCONN;
 369	return 0;
 370}
 371
 372static struct pernet_operations net_defaults_ops = {
 373	.init = net_defaults_init_net,
 374};
 375
 376static __init int net_defaults_init(void)
 377{
 378	if (register_pernet_subsys(&net_defaults_ops))
 379		panic("Cannot initialize net default settings");
 380
 381	return 0;
 382}
 383
 384core_initcall(net_defaults_init);
 385
 386#ifdef CONFIG_NET_NS
 387static struct ucounts *inc_net_namespaces(struct user_namespace *ns)
 388{
 389	return inc_ucount(ns, current_euid(), UCOUNT_NET_NAMESPACES);
 390}
 391
 392static void dec_net_namespaces(struct ucounts *ucounts)
 393{
 394	dec_ucount(ucounts, UCOUNT_NET_NAMESPACES);
 395}
 396
 397static struct kmem_cache *net_cachep __ro_after_init;
 398static struct workqueue_struct *netns_wq;
 399
 400static struct net *net_alloc(void)
 401{
 402	struct net *net = NULL;
 403	struct net_generic *ng;
 404
 405	ng = net_alloc_generic();
 406	if (!ng)
 407		goto out;
 408
 409	net = kmem_cache_zalloc(net_cachep, GFP_KERNEL);
 410	if (!net)
 411		goto out_free;
 412
 413#ifdef CONFIG_KEYS
 414	net->key_domain = kzalloc(sizeof(struct key_tag), GFP_KERNEL);
 415	if (!net->key_domain)
 416		goto out_free_2;
 417	refcount_set(&net->key_domain->usage, 1);
 418#endif
 419
 420	rcu_assign_pointer(net->gen, ng);
 421out:
 422	return net;
 423
 424#ifdef CONFIG_KEYS
 425out_free_2:
 426	kmem_cache_free(net_cachep, net);
 427	net = NULL;
 428#endif
 429out_free:
 430	kfree(ng);
 431	goto out;
 432}
 433
 434static void net_free(struct net *net)
 435{
 436	kfree(rcu_access_pointer(net->gen));
 
 
 
 
 
 
 
 437	kmem_cache_free(net_cachep, net);
 438}
 439
 440void net_drop_ns(void *p)
 441{
 442	struct net *ns = p;
 443	if (ns && refcount_dec_and_test(&ns->passive))
 444		net_free(ns);
 445}
 446
 447struct net *copy_net_ns(unsigned long flags,
 448			struct user_namespace *user_ns, struct net *old_net)
 449{
 450	struct ucounts *ucounts;
 451	struct net *net;
 452	int rv;
 453
 454	if (!(flags & CLONE_NEWNET))
 455		return get_net(old_net);
 456
 457	ucounts = inc_net_namespaces(user_ns);
 458	if (!ucounts)
 459		return ERR_PTR(-ENOSPC);
 460
 461	net = net_alloc();
 462	if (!net) {
 463		rv = -ENOMEM;
 464		goto dec_ucounts;
 
 
 
 
 
 465	}
 466	refcount_set(&net->passive, 1);
 467	net->ucounts = ucounts;
 468	get_user_ns(user_ns);
 469
 470	rv = down_read_killable(&pernet_ops_rwsem);
 471	if (rv < 0)
 472		goto put_userns;
 473
 474	rv = setup_net(net, user_ns);
 475
 476	up_read(&pernet_ops_rwsem);
 477
 478	if (rv < 0) {
 479put_userns:
 480		key_remove_domain(net->key_domain);
 481		put_user_ns(user_ns);
 482		net_drop_ns(net);
 483dec_ucounts:
 484		dec_net_namespaces(ucounts);
 485		return ERR_PTR(rv);
 486	}
 487	return net;
 488}
 489
 490/**
 491 * net_ns_get_ownership - get sysfs ownership data for @net
 492 * @net: network namespace in question (can be NULL)
 493 * @uid: kernel user ID for sysfs objects
 494 * @gid: kernel group ID for sysfs objects
 495 *
 496 * Returns the uid/gid pair of root in the user namespace associated with the
 497 * given network namespace.
 498 */
 499void net_ns_get_ownership(const struct net *net, kuid_t *uid, kgid_t *gid)
 500{
 501	if (net) {
 502		kuid_t ns_root_uid = make_kuid(net->user_ns, 0);
 503		kgid_t ns_root_gid = make_kgid(net->user_ns, 0);
 504
 505		if (uid_valid(ns_root_uid))
 506			*uid = ns_root_uid;
 507
 508		if (gid_valid(ns_root_gid))
 509			*gid = ns_root_gid;
 510	} else {
 511		*uid = GLOBAL_ROOT_UID;
 512		*gid = GLOBAL_ROOT_GID;
 513	}
 514}
 515EXPORT_SYMBOL_GPL(net_ns_get_ownership);
 516
 517static void unhash_nsid(struct net *net, struct net *last)
 518{
 519	struct net *tmp;
 520	/* This function is only called from cleanup_net() work,
 521	 * and this work is the only process, that may delete
 522	 * a net from net_namespace_list. So, when the below
 523	 * is executing, the list may only grow. Thus, we do not
 524	 * use for_each_net_rcu() or net_rwsem.
 525	 */
 526	for_each_net(tmp) {
 527		int id;
 528
 529		spin_lock_bh(&tmp->nsid_lock);
 530		id = __peernet2id(tmp, net);
 531		if (id >= 0)
 532			idr_remove(&tmp->netns_ids, id);
 533		spin_unlock_bh(&tmp->nsid_lock);
 534		if (id >= 0)
 535			rtnl_net_notifyid(tmp, RTM_DELNSID, id, 0, NULL,
 536					  GFP_KERNEL);
 537		if (tmp == last)
 538			break;
 539	}
 540	spin_lock_bh(&net->nsid_lock);
 541	idr_destroy(&net->netns_ids);
 542	spin_unlock_bh(&net->nsid_lock);
 543}
 544
 545static LLIST_HEAD(cleanup_list);
 546
 547static void cleanup_net(struct work_struct *work)
 548{
 549	const struct pernet_operations *ops;
 550	struct net *net, *tmp, *last;
 551	struct llist_node *net_kill_list;
 552	LIST_HEAD(net_exit_list);
 553
 554	/* Atomically snapshot the list of namespaces to cleanup */
 555	net_kill_list = llist_del_all(&cleanup_list);
 
 
 556
 557	down_read(&pernet_ops_rwsem);
 558
 559	/* Don't let anyone else find us. */
 560	down_write(&net_rwsem);
 561	llist_for_each_entry(net, net_kill_list, cleanup_list)
 562		list_del_rcu(&net->list);
 563	/* Cache last net. After we unlock rtnl, no one new net
 564	 * added to net_namespace_list can assign nsid pointer
 565	 * to a net from net_kill_list (see peernet2id_alloc()).
 566	 * So, we skip them in unhash_nsid().
 567	 *
 568	 * Note, that unhash_nsid() does not delete nsid links
 569	 * between net_kill_list's nets, as they've already
 570	 * deleted from net_namespace_list. But, this would be
 571	 * useless anyway, as netns_ids are destroyed there.
 572	 */
 573	last = list_last_entry(&net_namespace_list, struct net, list);
 574	up_write(&net_rwsem);
 575
 576	llist_for_each_entry(net, net_kill_list, cleanup_list) {
 577		unhash_nsid(net, last);
 578		list_add_tail(&net->exit_list, &net_exit_list);
 579	}
 580
 581	/* Run all of the network namespace pre_exit methods */
 582	list_for_each_entry_reverse(ops, &pernet_list, list)
 583		ops_pre_exit_list(ops, &net_exit_list);
 584
 585	/*
 586	 * Another CPU might be rcu-iterating the list, wait for it.
 587	 * This needs to be before calling the exit() notifiers, so
 588	 * the rcu_barrier() below isn't sufficient alone.
 589	 * Also the pre_exit() and exit() methods need this barrier.
 590	 */
 591	synchronize_rcu();
 592
 593	/* Run all of the network namespace exit methods */
 594	list_for_each_entry_reverse(ops, &pernet_list, list)
 595		ops_exit_list(ops, &net_exit_list);
 596
 597	/* Free the net generic variables */
 598	list_for_each_entry_reverse(ops, &pernet_list, list)
 599		ops_free_list(ops, &net_exit_list);
 600
 601	up_read(&pernet_ops_rwsem);
 602
 603	/* Ensure there are no outstanding rcu callbacks using this
 604	 * network namespace.
 605	 */
 606	rcu_barrier();
 607
 608	/* Finally it is safe to free my network namespace structure */
 609	list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) {
 610		list_del_init(&net->exit_list);
 611		dec_net_namespaces(net->ucounts);
 612		key_remove_domain(net->key_domain);
 613		put_user_ns(net->user_ns);
 614		net_drop_ns(net);
 615	}
 616}
 617
 618/**
 619 * net_ns_barrier - wait until concurrent net_cleanup_work is done
 620 *
 621 * cleanup_net runs from work queue and will first remove namespaces
 622 * from the global list, then run net exit functions.
 623 *
 624 * Call this in module exit path to make sure that all netns
 625 * ->exit ops have been invoked before the function is removed.
 626 */
 627void net_ns_barrier(void)
 628{
 629	down_write(&pernet_ops_rwsem);
 630	up_write(&pernet_ops_rwsem);
 631}
 632EXPORT_SYMBOL(net_ns_barrier);
 633
 634static DECLARE_WORK(net_cleanup_work, cleanup_net);
 635
 636void __put_net(struct net *net)
 637{
 638	/* Cleanup the network namespace in process context */
 639	if (llist_add(&net->cleanup_list, &cleanup_list))
 640		queue_work(netns_wq, &net_cleanup_work);
 641}
 642EXPORT_SYMBOL_GPL(__put_net);
 643
 644/**
 645 * get_net_ns - increment the refcount of the network namespace
 646 * @ns: common namespace (net)
 647 *
 648 * Returns the net's common namespace.
 649 */
 650struct ns_common *get_net_ns(struct ns_common *ns)
 651{
 652	return &get_net(container_of(ns, struct net, ns))->ns;
 653}
 654EXPORT_SYMBOL_GPL(get_net_ns);
 655
 656struct net *get_net_ns_by_fd(int fd)
 657{
 
 658	struct file *file;
 659	struct ns_common *ns;
 660	struct net *net;
 661
 662	file = proc_ns_fget(fd);
 663	if (IS_ERR(file))
 664		return ERR_CAST(file);
 665
 666	ns = get_proc_ns(file_inode(file));
 667	if (ns->ops == &netns_operations)
 668		net = get_net(container_of(ns, struct net, ns));
 669	else
 670		net = ERR_PTR(-EINVAL);
 671
 672	fput(file);
 673	return net;
 674}
 675EXPORT_SYMBOL_GPL(get_net_ns_by_fd);
 
 
 
 
 
 
 
 
 
 
 
 
 676#endif
 677
 678struct net *get_net_ns_by_pid(pid_t pid)
 679{
 680	struct task_struct *tsk;
 681	struct net *net;
 682
 683	/* Lookup the network namespace */
 684	net = ERR_PTR(-ESRCH);
 685	rcu_read_lock();
 686	tsk = find_task_by_vpid(pid);
 687	if (tsk) {
 688		struct nsproxy *nsproxy;
 689		task_lock(tsk);
 690		nsproxy = tsk->nsproxy;
 691		if (nsproxy)
 692			net = get_net(nsproxy->net_ns);
 693		task_unlock(tsk);
 694	}
 695	rcu_read_unlock();
 696	return net;
 697}
 698EXPORT_SYMBOL_GPL(get_net_ns_by_pid);
 699
 700static __net_init int net_ns_net_init(struct net *net)
 701{
 702#ifdef CONFIG_NET_NS
 703	net->ns.ops = &netns_operations;
 704#endif
 705	return ns_alloc_inum(&net->ns);
 706}
 707
 708static __net_exit void net_ns_net_exit(struct net *net)
 709{
 710	ns_free_inum(&net->ns);
 711}
 712
 713static struct pernet_operations __net_initdata net_ns_ops = {
 714	.init = net_ns_net_init,
 715	.exit = net_ns_net_exit,
 716};
 717
 718static const struct nla_policy rtnl_net_policy[NETNSA_MAX + 1] = {
 719	[NETNSA_NONE]		= { .type = NLA_UNSPEC },
 720	[NETNSA_NSID]		= { .type = NLA_S32 },
 721	[NETNSA_PID]		= { .type = NLA_U32 },
 722	[NETNSA_FD]		= { .type = NLA_U32 },
 723	[NETNSA_TARGET_NSID]	= { .type = NLA_S32 },
 724};
 725
 726static int rtnl_net_newid(struct sk_buff *skb, struct nlmsghdr *nlh,
 727			  struct netlink_ext_ack *extack)
 728{
 729	struct net *net = sock_net(skb->sk);
 730	struct nlattr *tb[NETNSA_MAX + 1];
 731	struct nlattr *nla;
 732	struct net *peer;
 733	int nsid, err;
 734
 735	err = nlmsg_parse_deprecated(nlh, sizeof(struct rtgenmsg), tb,
 736				     NETNSA_MAX, rtnl_net_policy, extack);
 737	if (err < 0)
 738		return err;
 739	if (!tb[NETNSA_NSID]) {
 740		NL_SET_ERR_MSG(extack, "nsid is missing");
 741		return -EINVAL;
 742	}
 743	nsid = nla_get_s32(tb[NETNSA_NSID]);
 744
 745	if (tb[NETNSA_PID]) {
 746		peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID]));
 747		nla = tb[NETNSA_PID];
 748	} else if (tb[NETNSA_FD]) {
 749		peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD]));
 750		nla = tb[NETNSA_FD];
 751	} else {
 752		NL_SET_ERR_MSG(extack, "Peer netns reference is missing");
 753		return -EINVAL;
 754	}
 755	if (IS_ERR(peer)) {
 756		NL_SET_BAD_ATTR(extack, nla);
 757		NL_SET_ERR_MSG(extack, "Peer netns reference is invalid");
 758		return PTR_ERR(peer);
 759	}
 760
 761	spin_lock_bh(&net->nsid_lock);
 762	if (__peernet2id(net, peer) >= 0) {
 763		spin_unlock_bh(&net->nsid_lock);
 764		err = -EEXIST;
 765		NL_SET_BAD_ATTR(extack, nla);
 766		NL_SET_ERR_MSG(extack,
 767			       "Peer netns already has a nsid assigned");
 768		goto out;
 769	}
 770
 771	err = alloc_netid(net, peer, nsid);
 772	spin_unlock_bh(&net->nsid_lock);
 773	if (err >= 0) {
 774		rtnl_net_notifyid(net, RTM_NEWNSID, err, NETLINK_CB(skb).portid,
 775				  nlh, GFP_KERNEL);
 776		err = 0;
 777	} else if (err == -ENOSPC && nsid >= 0) {
 778		err = -EEXIST;
 779		NL_SET_BAD_ATTR(extack, tb[NETNSA_NSID]);
 780		NL_SET_ERR_MSG(extack, "The specified nsid is already used");
 781	}
 782out:
 783	put_net(peer);
 784	return err;
 785}
 786
 787static int rtnl_net_get_size(void)
 788{
 789	return NLMSG_ALIGN(sizeof(struct rtgenmsg))
 790	       + nla_total_size(sizeof(s32)) /* NETNSA_NSID */
 791	       + nla_total_size(sizeof(s32)) /* NETNSA_CURRENT_NSID */
 792	       ;
 793}
 794
 795struct net_fill_args {
 796	u32 portid;
 797	u32 seq;
 798	int flags;
 799	int cmd;
 800	int nsid;
 801	bool add_ref;
 802	int ref_nsid;
 803};
 804
 805static int rtnl_net_fill(struct sk_buff *skb, struct net_fill_args *args)
 806{
 807	struct nlmsghdr *nlh;
 808	struct rtgenmsg *rth;
 809
 810	nlh = nlmsg_put(skb, args->portid, args->seq, args->cmd, sizeof(*rth),
 811			args->flags);
 812	if (!nlh)
 813		return -EMSGSIZE;
 814
 815	rth = nlmsg_data(nlh);
 816	rth->rtgen_family = AF_UNSPEC;
 817
 818	if (nla_put_s32(skb, NETNSA_NSID, args->nsid))
 819		goto nla_put_failure;
 820
 821	if (args->add_ref &&
 822	    nla_put_s32(skb, NETNSA_CURRENT_NSID, args->ref_nsid))
 823		goto nla_put_failure;
 824
 825	nlmsg_end(skb, nlh);
 826	return 0;
 827
 828nla_put_failure:
 829	nlmsg_cancel(skb, nlh);
 830	return -EMSGSIZE;
 831}
 832
 833static int rtnl_net_valid_getid_req(struct sk_buff *skb,
 834				    const struct nlmsghdr *nlh,
 835				    struct nlattr **tb,
 836				    struct netlink_ext_ack *extack)
 837{
 838	int i, err;
 839
 840	if (!netlink_strict_get_check(skb))
 841		return nlmsg_parse_deprecated(nlh, sizeof(struct rtgenmsg),
 842					      tb, NETNSA_MAX, rtnl_net_policy,
 843					      extack);
 844
 845	err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct rtgenmsg), tb,
 846					    NETNSA_MAX, rtnl_net_policy,
 847					    extack);
 848	if (err)
 849		return err;
 850
 851	for (i = 0; i <= NETNSA_MAX; i++) {
 852		if (!tb[i])
 853			continue;
 854
 855		switch (i) {
 856		case NETNSA_PID:
 857		case NETNSA_FD:
 858		case NETNSA_NSID:
 859		case NETNSA_TARGET_NSID:
 860			break;
 861		default:
 862			NL_SET_ERR_MSG(extack, "Unsupported attribute in peer netns getid request");
 863			return -EINVAL;
 864		}
 865	}
 866
 867	return 0;
 868}
 869
 870static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh,
 871			  struct netlink_ext_ack *extack)
 872{
 873	struct net *net = sock_net(skb->sk);
 874	struct nlattr *tb[NETNSA_MAX + 1];
 875	struct net_fill_args fillargs = {
 876		.portid = NETLINK_CB(skb).portid,
 877		.seq = nlh->nlmsg_seq,
 878		.cmd = RTM_NEWNSID,
 879	};
 880	struct net *peer, *target = net;
 881	struct nlattr *nla;
 882	struct sk_buff *msg;
 883	int err;
 884
 885	err = rtnl_net_valid_getid_req(skb, nlh, tb, extack);
 886	if (err < 0)
 887		return err;
 888	if (tb[NETNSA_PID]) {
 889		peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID]));
 890		nla = tb[NETNSA_PID];
 891	} else if (tb[NETNSA_FD]) {
 892		peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD]));
 893		nla = tb[NETNSA_FD];
 894	} else if (tb[NETNSA_NSID]) {
 895		peer = get_net_ns_by_id(net, nla_get_s32(tb[NETNSA_NSID]));
 896		if (!peer)
 897			peer = ERR_PTR(-ENOENT);
 898		nla = tb[NETNSA_NSID];
 899	} else {
 900		NL_SET_ERR_MSG(extack, "Peer netns reference is missing");
 901		return -EINVAL;
 902	}
 903
 904	if (IS_ERR(peer)) {
 905		NL_SET_BAD_ATTR(extack, nla);
 906		NL_SET_ERR_MSG(extack, "Peer netns reference is invalid");
 907		return PTR_ERR(peer);
 908	}
 909
 910	if (tb[NETNSA_TARGET_NSID]) {
 911		int id = nla_get_s32(tb[NETNSA_TARGET_NSID]);
 912
 913		target = rtnl_get_net_ns_capable(NETLINK_CB(skb).sk, id);
 914		if (IS_ERR(target)) {
 915			NL_SET_BAD_ATTR(extack, tb[NETNSA_TARGET_NSID]);
 916			NL_SET_ERR_MSG(extack,
 917				       "Target netns reference is invalid");
 918			err = PTR_ERR(target);
 919			goto out;
 920		}
 921		fillargs.add_ref = true;
 922		fillargs.ref_nsid = peernet2id(net, peer);
 923	}
 924
 925	msg = nlmsg_new(rtnl_net_get_size(), GFP_KERNEL);
 926	if (!msg) {
 927		err = -ENOMEM;
 928		goto out;
 929	}
 930
 931	fillargs.nsid = peernet2id(target, peer);
 932	err = rtnl_net_fill(msg, &fillargs);
 933	if (err < 0)
 934		goto err_out;
 935
 936	err = rtnl_unicast(msg, net, NETLINK_CB(skb).portid);
 937	goto out;
 938
 939err_out:
 940	nlmsg_free(msg);
 941out:
 942	if (fillargs.add_ref)
 943		put_net(target);
 944	put_net(peer);
 945	return err;
 946}
 947
 948struct rtnl_net_dump_cb {
 949	struct net *tgt_net;
 950	struct net *ref_net;
 951	struct sk_buff *skb;
 952	struct net_fill_args fillargs;
 953	int idx;
 954	int s_idx;
 955};
 956
 957/* Runs in RCU-critical section. */
 958static int rtnl_net_dumpid_one(int id, void *peer, void *data)
 959{
 960	struct rtnl_net_dump_cb *net_cb = (struct rtnl_net_dump_cb *)data;
 961	int ret;
 962
 963	if (net_cb->idx < net_cb->s_idx)
 964		goto cont;
 965
 966	net_cb->fillargs.nsid = id;
 967	if (net_cb->fillargs.add_ref)
 968		net_cb->fillargs.ref_nsid = __peernet2id(net_cb->ref_net, peer);
 969	ret = rtnl_net_fill(net_cb->skb, &net_cb->fillargs);
 970	if (ret < 0)
 971		return ret;
 972
 973cont:
 974	net_cb->idx++;
 975	return 0;
 976}
 977
 978static int rtnl_valid_dump_net_req(const struct nlmsghdr *nlh, struct sock *sk,
 979				   struct rtnl_net_dump_cb *net_cb,
 980				   struct netlink_callback *cb)
 981{
 982	struct netlink_ext_ack *extack = cb->extack;
 983	struct nlattr *tb[NETNSA_MAX + 1];
 984	int err, i;
 985
 986	err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct rtgenmsg), tb,
 987					    NETNSA_MAX, rtnl_net_policy,
 988					    extack);
 989	if (err < 0)
 990		return err;
 991
 992	for (i = 0; i <= NETNSA_MAX; i++) {
 993		if (!tb[i])
 994			continue;
 995
 996		if (i == NETNSA_TARGET_NSID) {
 997			struct net *net;
 998
 999			net = rtnl_get_net_ns_capable(sk, nla_get_s32(tb[i]));
1000			if (IS_ERR(net)) {
1001				NL_SET_BAD_ATTR(extack, tb[i]);
1002				NL_SET_ERR_MSG(extack,
1003					       "Invalid target network namespace id");
1004				return PTR_ERR(net);
1005			}
1006			net_cb->fillargs.add_ref = true;
1007			net_cb->ref_net = net_cb->tgt_net;
1008			net_cb->tgt_net = net;
1009		} else {
1010			NL_SET_BAD_ATTR(extack, tb[i]);
1011			NL_SET_ERR_MSG(extack,
1012				       "Unsupported attribute in dump request");
1013			return -EINVAL;
1014		}
1015	}
1016
1017	return 0;
1018}
1019
1020static int rtnl_net_dumpid(struct sk_buff *skb, struct netlink_callback *cb)
1021{
1022	struct rtnl_net_dump_cb net_cb = {
1023		.tgt_net = sock_net(skb->sk),
1024		.skb = skb,
1025		.fillargs = {
1026			.portid = NETLINK_CB(cb->skb).portid,
1027			.seq = cb->nlh->nlmsg_seq,
1028			.flags = NLM_F_MULTI,
1029			.cmd = RTM_NEWNSID,
1030		},
1031		.idx = 0,
1032		.s_idx = cb->args[0],
1033	};
1034	int err = 0;
1035
1036	if (cb->strict_check) {
1037		err = rtnl_valid_dump_net_req(cb->nlh, skb->sk, &net_cb, cb);
1038		if (err < 0)
1039			goto end;
1040	}
1041
1042	rcu_read_lock();
1043	idr_for_each(&net_cb.tgt_net->netns_ids, rtnl_net_dumpid_one, &net_cb);
1044	rcu_read_unlock();
1045
1046	cb->args[0] = net_cb.idx;
1047end:
1048	if (net_cb.fillargs.add_ref)
1049		put_net(net_cb.tgt_net);
1050	return err < 0 ? err : skb->len;
1051}
1052
1053static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
1054			      struct nlmsghdr *nlh, gfp_t gfp)
1055{
1056	struct net_fill_args fillargs = {
1057		.portid = portid,
1058		.seq = nlh ? nlh->nlmsg_seq : 0,
1059		.cmd = cmd,
1060		.nsid = id,
1061	};
1062	struct sk_buff *msg;
1063	int err = -ENOMEM;
1064
1065	msg = nlmsg_new(rtnl_net_get_size(), gfp);
1066	if (!msg)
1067		goto out;
1068
1069	err = rtnl_net_fill(msg, &fillargs);
1070	if (err < 0)
1071		goto err_out;
1072
1073	rtnl_notify(msg, net, portid, RTNLGRP_NSID, nlh, gfp);
1074	return;
1075
1076err_out:
1077	nlmsg_free(msg);
1078out:
1079	rtnl_set_sk_err(net, RTNLGRP_NSID, err);
1080}
1081
1082static int __init net_ns_init(void)
1083{
1084	struct net_generic *ng;
1085
1086#ifdef CONFIG_NET_NS
1087	net_cachep = kmem_cache_create("net_namespace", sizeof(struct net),
1088					SMP_CACHE_BYTES,
1089					SLAB_PANIC|SLAB_ACCOUNT, NULL);
1090
1091	/* Create workqueue for cleanup */
1092	netns_wq = create_singlethread_workqueue("netns");
1093	if (!netns_wq)
1094		panic("Could not create netns workq");
1095#endif
1096
1097	ng = net_alloc_generic();
1098	if (!ng)
1099		panic("Could not allocate generic netns");
1100
1101	rcu_assign_pointer(init_net.gen, ng);
1102
1103	down_write(&pernet_ops_rwsem);
1104	if (setup_net(&init_net, &init_user_ns))
1105		panic("Could not setup the initial network namespace");
1106
1107	init_net_initialized = true;
1108	up_write(&pernet_ops_rwsem);
 
1109
1110	if (register_pernet_subsys(&net_ns_ops))
1111		panic("Could not register network namespace subsystems");
1112
1113	rtnl_register(PF_UNSPEC, RTM_NEWNSID, rtnl_net_newid, NULL,
1114		      RTNL_FLAG_DOIT_UNLOCKED);
1115	rtnl_register(PF_UNSPEC, RTM_GETNSID, rtnl_net_getid, rtnl_net_dumpid,
1116		      RTNL_FLAG_DOIT_UNLOCKED);
1117
1118	return 0;
1119}
1120
1121pure_initcall(net_ns_init);
1122
1123#ifdef CONFIG_NET_NS
1124static int __register_pernet_operations(struct list_head *list,
1125					struct pernet_operations *ops)
1126{
1127	struct net *net;
1128	int error;
1129	LIST_HEAD(net_exit_list);
1130
1131	list_add_tail(&ops->list, list);
1132	if (ops->init || (ops->id && ops->size)) {
1133		/* We held write locked pernet_ops_rwsem, and parallel
1134		 * setup_net() and cleanup_net() are not possible.
1135		 */
1136		for_each_net(net) {
1137			error = ops_init(ops, net);
1138			if (error)
1139				goto out_undo;
1140			list_add_tail(&net->exit_list, &net_exit_list);
1141		}
1142	}
1143	return 0;
1144
1145out_undo:
1146	/* If I have an error cleanup all namespaces I initialized */
1147	list_del(&ops->list);
1148	ops_pre_exit_list(ops, &net_exit_list);
1149	synchronize_rcu();
1150	ops_exit_list(ops, &net_exit_list);
1151	ops_free_list(ops, &net_exit_list);
1152	return error;
1153}
1154
1155static void __unregister_pernet_operations(struct pernet_operations *ops)
1156{
1157	struct net *net;
1158	LIST_HEAD(net_exit_list);
1159
1160	list_del(&ops->list);
1161	/* See comment in __register_pernet_operations() */
1162	for_each_net(net)
1163		list_add_tail(&net->exit_list, &net_exit_list);
1164	ops_pre_exit_list(ops, &net_exit_list);
1165	synchronize_rcu();
1166	ops_exit_list(ops, &net_exit_list);
1167	ops_free_list(ops, &net_exit_list);
1168}
1169
1170#else
1171
1172static int __register_pernet_operations(struct list_head *list,
1173					struct pernet_operations *ops)
1174{
1175	if (!init_net_initialized) {
1176		list_add_tail(&ops->list, list);
1177		return 0;
1178	}
1179
1180	return ops_init(ops, &init_net);
1181}
1182
1183static void __unregister_pernet_operations(struct pernet_operations *ops)
1184{
1185	if (!init_net_initialized) {
1186		list_del(&ops->list);
1187	} else {
1188		LIST_HEAD(net_exit_list);
1189		list_add(&init_net.exit_list, &net_exit_list);
1190		ops_pre_exit_list(ops, &net_exit_list);
1191		synchronize_rcu();
1192		ops_exit_list(ops, &net_exit_list);
1193		ops_free_list(ops, &net_exit_list);
1194	}
1195}
1196
1197#endif /* CONFIG_NET_NS */
1198
1199static DEFINE_IDA(net_generic_ids);
1200
1201static int register_pernet_operations(struct list_head *list,
1202				      struct pernet_operations *ops)
1203{
1204	int error;
1205
1206	if (ops->id) {
1207		error = ida_alloc_min(&net_generic_ids, MIN_PERNET_OPS_ID,
1208				GFP_KERNEL);
1209		if (error < 0)
 
 
 
 
1210			return error;
1211		*ops->id = error;
1212		max_gen_ptrs = max(max_gen_ptrs, *ops->id + 1);
1213	}
1214	error = __register_pernet_operations(list, ops);
1215	if (error) {
1216		rcu_barrier();
1217		if (ops->id)
1218			ida_free(&net_generic_ids, *ops->id);
1219	}
1220
1221	return error;
1222}
1223
1224static void unregister_pernet_operations(struct pernet_operations *ops)
1225{
 
1226	__unregister_pernet_operations(ops);
1227	rcu_barrier();
1228	if (ops->id)
1229		ida_free(&net_generic_ids, *ops->id);
1230}
1231
1232/**
1233 *      register_pernet_subsys - register a network namespace subsystem
1234 *	@ops:  pernet operations structure for the subsystem
1235 *
1236 *	Register a subsystem which has init and exit functions
1237 *	that are called when network namespaces are created and
1238 *	destroyed respectively.
1239 *
1240 *	When registered all network namespace init functions are
1241 *	called for every existing network namespace.  Allowing kernel
1242 *	modules to have a race free view of the set of network namespaces.
1243 *
1244 *	When a new network namespace is created all of the init
1245 *	methods are called in the order in which they were registered.
1246 *
1247 *	When a network namespace is destroyed all of the exit methods
1248 *	are called in the reverse of the order with which they were
1249 *	registered.
1250 */
1251int register_pernet_subsys(struct pernet_operations *ops)
1252{
1253	int error;
1254	down_write(&pernet_ops_rwsem);
1255	error =  register_pernet_operations(first_device, ops);
1256	up_write(&pernet_ops_rwsem);
1257	return error;
1258}
1259EXPORT_SYMBOL_GPL(register_pernet_subsys);
1260
1261/**
1262 *      unregister_pernet_subsys - unregister a network namespace subsystem
1263 *	@ops: pernet operations structure to manipulate
1264 *
1265 *	Remove the pernet operations structure from the list to be
1266 *	used when network namespaces are created or destroyed.  In
1267 *	addition run the exit method for all existing network
1268 *	namespaces.
1269 */
1270void unregister_pernet_subsys(struct pernet_operations *ops)
1271{
1272	down_write(&pernet_ops_rwsem);
1273	unregister_pernet_operations(ops);
1274	up_write(&pernet_ops_rwsem);
1275}
1276EXPORT_SYMBOL_GPL(unregister_pernet_subsys);
1277
1278/**
1279 *      register_pernet_device - register a network namespace device
1280 *	@ops:  pernet operations structure for the subsystem
1281 *
1282 *	Register a device which has init and exit functions
1283 *	that are called when network namespaces are created and
1284 *	destroyed respectively.
1285 *
1286 *	When registered all network namespace init functions are
1287 *	called for every existing network namespace.  Allowing kernel
1288 *	modules to have a race free view of the set of network namespaces.
1289 *
1290 *	When a new network namespace is created all of the init
1291 *	methods are called in the order in which they were registered.
1292 *
1293 *	When a network namespace is destroyed all of the exit methods
1294 *	are called in the reverse of the order with which they were
1295 *	registered.
1296 */
1297int register_pernet_device(struct pernet_operations *ops)
1298{
1299	int error;
1300	down_write(&pernet_ops_rwsem);
1301	error = register_pernet_operations(&pernet_list, ops);
1302	if (!error && (first_device == &pernet_list))
1303		first_device = &ops->list;
1304	up_write(&pernet_ops_rwsem);
1305	return error;
1306}
1307EXPORT_SYMBOL_GPL(register_pernet_device);
1308
1309/**
1310 *      unregister_pernet_device - unregister a network namespace netdevice
1311 *	@ops: pernet operations structure to manipulate
1312 *
1313 *	Remove the pernet operations structure from the list to be
1314 *	used when network namespaces are created or destroyed.  In
1315 *	addition run the exit method for all existing network
1316 *	namespaces.
1317 */
1318void unregister_pernet_device(struct pernet_operations *ops)
1319{
1320	down_write(&pernet_ops_rwsem);
1321	if (&ops->list == first_device)
1322		first_device = first_device->next;
1323	unregister_pernet_operations(ops);
1324	up_write(&pernet_ops_rwsem);
1325}
1326EXPORT_SYMBOL_GPL(unregister_pernet_device);
1327
1328#ifdef CONFIG_NET_NS
1329static struct ns_common *netns_get(struct task_struct *task)
1330{
1331	struct net *net = NULL;
1332	struct nsproxy *nsproxy;
1333
1334	task_lock(task);
1335	nsproxy = task->nsproxy;
1336	if (nsproxy)
1337		net = get_net(nsproxy->net_ns);
1338	task_unlock(task);
1339
1340	return net ? &net->ns : NULL;
1341}
1342
1343static inline struct net *to_net_ns(struct ns_common *ns)
1344{
1345	return container_of(ns, struct net, ns);
1346}
1347
1348static void netns_put(struct ns_common *ns)
1349{
1350	put_net(to_net_ns(ns));
1351}
1352
1353static int netns_install(struct nsset *nsset, struct ns_common *ns)
1354{
1355	struct nsproxy *nsproxy = nsset->nsproxy;
1356	struct net *net = to_net_ns(ns);
1357
1358	if (!ns_capable(net->user_ns, CAP_SYS_ADMIN) ||
1359	    !ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN))
1360		return -EPERM;
1361
1362	put_net(nsproxy->net_ns);
1363	nsproxy->net_ns = get_net(net);
1364	return 0;
1365}
1366
1367static struct user_namespace *netns_owner(struct ns_common *ns)
1368{
1369	return to_net_ns(ns)->user_ns;
1370}
1371
1372const struct proc_ns_operations netns_operations = {
1373	.name		= "net",
1374	.type		= CLONE_NEWNET,
1375	.get		= netns_get,
1376	.put		= netns_put,
1377	.install	= netns_install,
1378	.owner		= netns_owner,
1379};
1380#endif