[Devel,v2] netfilter: check per-ve netfilter status on actual operation

Submitted by Stanislav Kinsburskiy on July 21, 2017, 12:06 p.m.

Details

Message ID 20170721120622.30556.74415.stgit@localhost.localdomain
State New
Series "netfilter: rework iptables containerization"
Headers show

Commit Message

Stanislav Kinsburskiy July 21, 2017, 12:06 p.m.
v2:
1) Return ENOPROTOOPT instead of ENOENT from ip_setsockopt

Signed-off-by: Stanislav Kinsburskiy <skinsbursky@virtuozzo.com>
---
 net/ipv4/ip_sockglue.c |    7 +++++++
 1 file changed, 7 insertions(+)

Patch hide | download patch | download mbox

diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index bcca7f3..8b22763 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -1119,6 +1119,10 @@  int ip_setsockopt(struct sock *sk, int level,
 			optname != IP_IPSEC_POLICY &&
 			optname != IP_XFRM_POLICY &&
 			!ip_mroute_opt(optname)) {
+
+		if (!ve_ipt_permitted(net, VE_IP_FILTER))
+			return -ENOPROTOOPT;
+
 		lock_sock(sk);
 		err = nf_setsockopt(sk, PF_INET, optname, optval, optlen);
 		release_sock(sk);
@@ -1424,6 +1428,9 @@  int ip_getsockopt(struct sock *sk, int level,
 		if (get_user(len, optlen))
 			return -EFAULT;
 
+		if (!ve_ipt_permitted(net, VE_IP_FILTER))
+			return -ENOENT;
+
 		lock_sock(sk);
 		err = nf_getsockopt(sk, PF_INET, optname, optval,
 				&len);

Comments

Andrey Ryabinin July 21, 2017, 12:41 p.m.
On 07/21/2017 03:06 PM, Stanislav Kinsburskiy wrote:
> v2:
> 1) Return ENOPROTOOPT instead of ENOENT from ip_setsockopt
> 
> Signed-off-by: Stanislav Kinsburskiy <skinsbursky@virtuozzo.com>
> ---
>  net/ipv4/ip_sockglue.c |    7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
> index bcca7f3..8b22763 100644
> --- a/net/ipv4/ip_sockglue.c
> +++ b/net/ipv4/ip_sockglue.c
> @@ -1119,6 +1119,10 @@ int ip_setsockopt(struct sock *sk, int level,
>  			optname != IP_IPSEC_POLICY &&
>  			optname != IP_XFRM_POLICY &&
>  			!ip_mroute_opt(optname)) {
> +
> +		if (!ve_ipt_permitted(net, VE_IP_FILTER))
> +			return -ENOPROTOOPT;
> +
>  		lock_sock(sk);
>  		err = nf_setsockopt(sk, PF_INET, optname, optval, optlen);
>  		release_sock(sk);
> @@ -1424,6 +1428,9 @@ int ip_getsockopt(struct sock *sk, int level,
>  		if (get_user(len, optlen))
>  			return -EFAULT;
>  
> +		if (!ve_ipt_permitted(net, VE_IP_FILTER))
> +			return -ENOENT;

And the same err here ?

> +
>  		lock_sock(sk);
>  		err = nf_getsockopt(sk, PF_INET, optname, optval,
>  				&len);
>
Stanislav Kinsburskiy July 21, 2017, 1:29 p.m.
21.07.2017 15:41, Andrey Ryabinin пишет:
> 
> 
> On 07/21/2017 03:06 PM, Stanislav Kinsburskiy wrote:
>> v2:
>> 1) Return ENOPROTOOPT instead of ENOENT from ip_setsockopt
>>
>> Signed-off-by: Stanislav Kinsburskiy <skinsbursky@virtuozzo.com>
>> ---
>>  net/ipv4/ip_sockglue.c |    7 +++++++
>>  1 file changed, 7 insertions(+)
>>
>> diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
>> index bcca7f3..8b22763 100644
>> --- a/net/ipv4/ip_sockglue.c
>> +++ b/net/ipv4/ip_sockglue.c
>> @@ -1119,6 +1119,10 @@ int ip_setsockopt(struct sock *sk, int level,
>>  			optname != IP_IPSEC_POLICY &&
>>  			optname != IP_XFRM_POLICY &&
>>  			!ip_mroute_opt(optname)) {
>> +
>> +		if (!ve_ipt_permitted(net, VE_IP_FILTER))
>> +			return -ENOPROTOOPT;
>> +
>>  		lock_sock(sk);
>>  		err = nf_setsockopt(sk, PF_INET, optname, optval, optlen);
>>  		release_sock(sk);
>> @@ -1424,6 +1428,9 @@ int ip_getsockopt(struct sock *sk, int level,
>>  		if (get_user(len, optlen))
>>  			return -EFAULT;
>>  
>> +		if (!ve_ipt_permitted(net, VE_IP_FILTER))
>> +			return -ENOENT;
> 
> And the same err here ?
> 

Not sure about this. 
With current netfilter "disablement" ENOENT is returned:

4425  getsockopt(3, SOL_IP, 0x40 /* IP_??? */, 0x7ffee5fcd1e0, 0x7ffee5fcd1d4) = -1 ENOENT (No such file or directory)

So, this error ion the patch tries to mimic old behavior.


>> +
>>  		lock_sock(sk);
>>  		err = nf_getsockopt(sk, PF_INET, optname, optval,
>>  				&len);
>>
Andrey Ryabinin July 21, 2017, 1:32 p.m.
On 07/21/2017 04:29 PM, Stanislav Kinsburskiy wrote:

>>> @@ -1424,6 +1428,9 @@ int ip_getsockopt(struct sock *sk, int level,
>>>  		if (get_user(len, optlen))
>>>  			return -EFAULT;
>>>  
>>> +		if (!ve_ipt_permitted(net, VE_IP_FILTER))
>>> +			return -ENOENT;
>>
>> And the same err here ?
>>
> 
> Not sure about this. 
> With current netfilter "disablement" ENOENT is returned:
> 
> 4425  getsockopt(3, SOL_IP, 0x40 /* IP_??? */, 0x7ffee5fcd1e0, 0x7ffee5fcd1d4) = -1 ENOENT (No such file or directory)
> 
> So, this error ion the patch tries to mimic old behavior.
> 

Ok