From: David Ahern <dsah...@gmail.com>
There are many use cases where a user wants to influence what is
returned in a dump for some rtnetlink command: one is wanting data
for a different namespace than the one the request is received and
another is limiting the amount of data returned in the dump to a
specific set of interest to userspace, reducing the cpu overhead of
both kernel and userspace. Unfortunately, the kernel has historically
not been strict with checking for the proper header or checking the
values passed in the header. This lenient implementation has allowed
iproute2 and other packages to pass any struct or data in the dump
request as long as the family is the first byte. For example, ifinfomsg
struct is used by iproute2 for all generic dump requests - links,
addresses, routes and rules when it is really only valid for link
requests.
There is 1 is example where the kernel deals with the wrong struct: link
dumps after VF support was added. Older iproute2 was sending rtgenmsg as
the header instead of ifinfomsg so a patch was added to try and detect
old userspace vs new:
e5eca6d41f53 ("rtnetlink: fix userspace API breakage for iproute2 < v3.9.0")
The latest example is Christian's patch set wanting to return addresses for
a target namespace. It guesses the header struct is an ifaddrmsg and if it
guesses wrong a netlink warning is generated in the kernel log on every
address dump which is unacceptable.
Another example where the kernel is a bit lenient is route dumps: iproute2
can send either a request with either ifinfomsg or a rtmsg as the header
struct, yet the kernel always treats the header as an rtmsg (see
inet_dump_fib and rtm_flags check). The header inconsistency impacts the
ability to add kernel side filters for route dumps - a necessary feature
for scale setups with 100k+ routes.
How to resolve the problem of not breaking old userspace yet be able to
move forward with new features such as kernel side filtering which are
crucial for efficient operation at high scale?
This patch set addresses the problem by adding a new socket flag,
NETLINK_DUMP_STRICT_CHK, that userspace can use with setsockopt to
request strict checking of headers and attributes on dump requests and
hence unlock the ability to use kernel side filters as they are added.
Kernel side, the dump handlers are updated to verify the message contains
at least the expected header struct:
RTM_GETLINK: ifinfomsg
RTM_GETADDR: ifaddrmsg
RTM_GETMULTICAST: ifaddrmsg
RTM_GETANYCAST: ifaddrmsg
RTM_GETADDRLABEL: ifaddrlblmsg
RTM_GETROUTE: rtmsg
RTM_GETSTATS: if_stats_msg
RTM_GETNEIGH: ndmsg
RTM_GETNEIGHTBL: ndtmsg
RTM_GETNSID: rtnl_net_dumpid
RTM_GETRULE: fib_rule_hdr
RTM_GETNETCONF: netconfmsg
RTM_GETMDB: br_port_msg
And then every field in the header struct should be 0 with the exception
of the family. There are a few exceptions to this rule where the kernel
already influences the data returned by values in the struct. Next the
message should not contain attributes unless the kernel implements
filtering for it. Any unexpected data causes the dump to fail with EINVAL.
If the new flag is honored by the kernel and the dump contents adjusted
by any data passed in the request, the dump handler can set the
NLM_F_DUMP_FILTERED flag in the netlink message header.
For old userspace on new kernel there is no impact as all checks are
wrapped in a check on the new strict flag. For new userspace on old
kernel, the data in the headers and any appended attributes are
silently ignored though the setsockopt failing is the clue to userspace
the feature is not supported. New userspace on new kernel gets the
requested data dump.
This set applies on top of the "Extend dump filter to proxy neighbor dumps"
patch:
http://patchwork.ozlabs.org/patch/978583/
which was extracted from this set to keep the number of patches to
20 or less.
As an example of how this new strict parsing can be used for kernel side
filters on dump requests, route dump filtering patches can be found here:
https://github.com/dsahern/linux.git rtnl-dump-enhancements
those will be sent once this infrastructure is in.
iproute2 patches can be found here:
https://github.com/dsahern/iproute2 dump-enhancements
Changes since rfc-v2
- dropped the NLM_F_DUMP_FILTERED flag from target nsid dumps per
Jiri's objections
- changed the opt-in uapi from a netlink message flag to a socket
flag. setsockopt provides an api for userspace to definitively
know if the kernel supports strict checking on dumps.
- re-ordered patches to peel off the extack on dumps if needed to
keep this set size within limits
- misc cleanups in patches based on testing
David Ahern (20):
netlink: Pass extack to dump handlers
netlink: Add extack message to nlmsg_parse for invalid header length
net: Add extack to nlmsg_parse
net/ipv6: Refactor address dump to push inet6_fill_args to
in6_dump_addrs
netlink: Add new socket option to enable strict checking on dumps
net/ipv4: Update inet_dump_ifaddr for strict data checking
net/ipv6: Update inet6_dump_addr for strict data checking
rtnetlink: Update rtnl_dump_ifinfo for strict data checking
rtnetlink: Update rtnl_bridge_getlink for strict data checking
rtnetlink: Update rtnl_stats_dump for strict data checking
rtnetlink: Update inet6_dump_ifinfo for strict data checking
rtnetlink: Update ipmr_rtm_dumplink for strict data checking
rtnetlink: Update fib dumps for strict data checking
net/neighbor: Update neigh_dump_info for strict data checking
net/neighbor: Update neightbl_dump_info for strict data checking
net/namespace: Update rtnl_net_dumpid for strict data checking
net/fib_rules: Update fib_nl_dumprule for strict data checking
net/ipv6: Update ip6addrlbl_dump for strict data checking
net: Update netconf dump handlers for strict data checking
net/bridge: Update br_mdb_dump for strict data checking
include/linux/netlink.h | 3 +
include/net/ip_fib.h | 2 +
include/net/netlink.h | 4 +-
include/uapi/linux/netlink.h | 1 +
net/bridge/br_mdb.c | 29 +++++++
net/core/devlink.c | 2 +-
net/core/fib_rules.c | 36 ++++++++-
net/core/neighbour.c | 96 +++++++++++++++++++----
net/core/net_namespace.c | 8 ++
net/core/rtnetlink.c | 173 +++++++++++++++++++++++++++++++----------
net/ipv4/devinet.c | 82 +++++++++++++++----
net/ipv4/fib_frontend.c | 43 +++++++++-
net/ipv4/ipmr.c | 41 ++++++++++
net/ipv6/addrconf.c | 159 ++++++++++++++++++++++++++++---------
net/ipv6/addrlabel.c | 35 ++++++++-
net/ipv6/ip6_fib.c | 8 ++
net/ipv6/ip6mr.c | 9 +++
net/ipv6/route.c | 2 +-
net/mpls/af_mpls.c | 28 ++++++-
net/netfilter/ipvs/ip_vs_ctl.c | 2 +-
net/netlink/af_netlink.c | 33 +++++++-
net/netlink/af_netlink.h | 1 +
net/sched/act_api.c | 2 +-
net/sched/cls_api.c | 6 +-
net/sched/sch_api.c | 3 +-
net/xfrm/xfrm_user.c | 2 +-
26 files changed, 687 insertions(+), 123 deletions(-)
--
2.11.0
