Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 109015e3 authored by Lorenzo Colitti's avatar Lorenzo Colitti Committed by Amit Pundir
Browse files

net: core: add UID to flows, rules, and routes 



- Define a new FIB rule attributes, FRA_UID_RANGE, to describe a
  range of UIDs.
- Define a RTA_UID attribute for per-UID route lookups and dumps.
- Support passing these attributes to and from userspace via
  rtnetlink. The value INVALID_UID indicates no UID was
  specified.
- Add a UID field to the flow structures.

Bug: 16355602
Change-Id: Iea98e6fedd0fd4435a1f4efa3deb3629505619ab
Signed-off-by: default avatarLorenzo Colitti <lorenzo@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 356fb77c

include/net/fib_rules.h

+8 −1
Original line number Diff line number Diff line
@@ -8,6 +8,11 @@ 
#include <net/flow.h>

#include <net/rtnetlink.h>



struct fib_kuid_range {

	kuid_t start;

	kuid_t end;

};



struct fib_rule {

	struct list_head	list;

	int			iifindex;
@@ -28,6 +33,7 @@ struct fib_rule { 
	int			suppress_prefixlen;

	char			iifname[IFNAMSIZ];

	char			oifname[IFNAMSIZ];

	struct fib_kuid_range	uid_range;

	struct rcu_head		rcu;

};
@@ -88,7 +94,8 @@ struct fib_rules_ops { 
	[FRA_TABLE]     = { .type = NLA_U32 }, \

	[FRA_SUPPRESS_PREFIXLEN] = { .type = NLA_U32 }, \

	[FRA_SUPPRESS_IFGROUP] = { .type = NLA_U32 }, \

	[FRA_GOTO]	= { .type = NLA_U32 }

	[FRA_GOTO]	= { .type = NLA_U32 }, \

	[FRA_UID_RANGE]	= { .len = sizeof(struct fib_rule_uid_range) }



static inline void fib_rule_get(struct fib_rule *rule)

{

include/net/flow.h

+5 −0
Original line number Diff line number Diff line
@@ -10,6 +10,7 @@ 
#include <linux/socket.h>

#include <linux/in6.h>

#include <linux/atomic.h>

#include <linux/uidgid.h>



/*

 * ifindex generation is per-net namespace, and loopback is
@@ -30,6 +31,7 @@ struct flowi_common { 
#define FLOWI_FLAG_ANYSRC		0x01

#define FLOWI_FLAG_KNOWN_NH		0x02

	__u32	flowic_secid;

	kuid_t  flowic_uid;

};



union flowi_uli {
@@ -66,6 +68,7 @@ struct flowi4 { 
#define flowi4_proto		__fl_common.flowic_proto

#define flowi4_flags		__fl_common.flowic_flags

#define flowi4_secid		__fl_common.flowic_secid

#define flowi4_uid		__fl_common.flowic_uid



	/* (saddr,daddr) must be grouped, same order as in IP header */

	__be32			saddr;
@@ -122,6 +125,7 @@ struct flowi6 { 
#define flowi6_proto		__fl_common.flowic_proto

#define flowi6_flags		__fl_common.flowic_flags

#define flowi6_secid		__fl_common.flowic_secid

#define flowi6_uid		__fl_common.flowic_uid

	struct in6_addr		daddr;

	struct in6_addr		saddr;

	__be32			flowlabel;
@@ -165,6 +169,7 @@ struct flowi { 
#define flowi_proto	u.__fl_common.flowic_proto

#define flowi_flags	u.__fl_common.flowic_flags

#define flowi_secid	u.__fl_common.flowic_secid

#define flowi_uid	u.__fl_common.flowic_uid

} __attribute__((__aligned__(BITS_PER_LONG/8)));



static inline struct flowi *flowi4_to_flowi(struct flowi4 *fl4)

include/uapi/linux/fib_rules.h

+8 −0
Original line number Diff line number Diff line
@@ -29,6 +29,11 @@ struct fib_rule_hdr { 
	__u32		flags;

};



struct fib_rule_uid_range {

	__u32		start;

	__u32		end;

};



enum {

	FRA_UNSPEC,

	FRA_DST,	/* destination address */
@@ -49,6 +54,9 @@ enum { 
	FRA_TABLE,	/* Extended table id */

	FRA_FWMASK,	/* mask for netfilter mark */

	FRA_OIFNAME,

	FRA_PAD,

	FRA_L3MDEV,	/* iif or oif is l3mdev goto its table */

	FRA_UID_RANGE,	/* UID range */

	__FRA_MAX

};

include/uapi/linux/rtnetlink.h

+8 −0
Original line number Diff line number Diff line
@@ -297,6 +297,14 @@ enum rtattr_type_t { 
	RTA_TABLE,

	RTA_MARK,

	RTA_MFC_STATS,

	RTA_VIA,

	RTA_NEWDST,

	RTA_PREF,

	RTA_ENCAP_TYPE,

	RTA_ENCAP,

	RTA_EXPIRES,

	RTA_PAD,

	RTA_UID,

	__RTA_MAX

};

net/core/fib_rules.c

+72 −2
Original line number Diff line number Diff line
@@ -17,6 +17,11 @@ 
#include <net/sock.h>

#include <net/fib_rules.h>



static const struct fib_kuid_range fib_kuid_range_unset = {

	KUIDT_INIT(0),

	KUIDT_INIT(~0),

};



int fib_default_rule_add(struct fib_rules_ops *ops,

			 u32 pref, u32 table, u32 flags)

{
@@ -32,6 +37,7 @@ int fib_default_rule_add(struct fib_rules_ops *ops, 
	r->table = table;

	r->flags = flags;

	r->fr_net = hold_net(ops->fro_net);

	r->uid_range = fib_kuid_range_unset;



	r->suppress_prefixlen = -1;

	r->suppress_ifgroup = -1;
@@ -182,6 +188,34 @@ void fib_rules_unregister(struct fib_rules_ops *ops) 
}

EXPORT_SYMBOL_GPL(fib_rules_unregister);



static int uid_range_set(struct fib_kuid_range *range)

{

	return uid_valid(range->start) && uid_valid(range->end);

}



static struct fib_kuid_range nla_get_kuid_range(struct nlattr **tb)

{

	struct fib_rule_uid_range *in;

	struct fib_kuid_range out;



	in = (struct fib_rule_uid_range *)nla_data(tb[FRA_UID_RANGE]);



	out.start = make_kuid(current_user_ns(), in->start);

	out.end = make_kuid(current_user_ns(), in->end);



	return out;

}



static int nla_put_uid_range(struct sk_buff *skb, struct fib_kuid_range *range)

{

	struct fib_rule_uid_range out = {

		from_kuid_munged(current_user_ns(), range->start),

		from_kuid_munged(current_user_ns(), range->end)

	};



	return nla_put(skb, FRA_UID_RANGE, sizeof(out), &out);

}



static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops,

			  struct flowi *fl, int flags)

{
@@ -196,6 +230,10 @@ static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops, 
	if ((rule->mark ^ fl->flowi_mark) & rule->mark_mask)

		goto out;



	if (uid_lt(fl->flowi_uid, rule->uid_range.start) ||

	    uid_gt(fl->flowi_uid, rule->uid_range.end))

		goto out;



	ret = ops->match(rule, fl, flags);

out:

	return (rule->flags & FIB_RULE_INVERT) ? !ret : ret;
@@ -378,6 +416,21 @@ static int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh) 
	} else if (rule->action == FR_ACT_GOTO)

		goto errout_free;



	if (tb[FRA_UID_RANGE]) {

		if (current_user_ns() != net->user_ns) {

			err = -EPERM;

			goto errout_free;

		}



		rule->uid_range = nla_get_kuid_range(tb);



		if (!uid_range_set(&rule->uid_range) ||

		    !uid_lte(rule->uid_range.start, rule->uid_range.end))

			goto errout_free;

	} else {

		rule->uid_range = fib_kuid_range_unset;

	}



	err = ops->configure(rule, skb, frh, tb);

	if (err < 0)

		goto errout_free;
@@ -437,6 +490,7 @@ static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh) 
	struct fib_rules_ops *ops = NULL;

	struct fib_rule *rule, *tmp;

	struct nlattr *tb[FRA_MAX+1];

	struct fib_kuid_range range;

	int err = -EINVAL;



	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh)))
@@ -456,6 +510,14 @@ static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh) 
	if (err < 0)

		goto errout;



	if (tb[FRA_UID_RANGE]) {

		range = nla_get_kuid_range(tb);

		if (!uid_range_set(&range))

			goto errout;

	} else {

		range = fib_kuid_range_unset;

	}



	list_for_each_entry(rule, &ops->rules_list, list) {

		if (frh->action && (frh->action != rule->action))

			continue;
@@ -484,6 +546,11 @@ static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh) 
		    (rule->mark_mask != nla_get_u32(tb[FRA_FWMASK])))

			continue;



		if (uid_range_set(&range) &&

		    (!uid_eq(rule->uid_range.start, range.start) ||

		     !uid_eq(rule->uid_range.end, range.end)))

			continue;



		if (!ops->compare(rule, frh, tb))

			continue;
@@ -542,7 +609,8 @@ static inline size_t fib_rule_nlmsg_size(struct fib_rules_ops *ops, 
			 + nla_total_size(4) /* FRA_SUPPRESS_PREFIXLEN */

			 + nla_total_size(4) /* FRA_SUPPRESS_IFGROUP */

			 + nla_total_size(4) /* FRA_FWMARK */

			 + nla_total_size(4); /* FRA_FWMASK */

			 + nla_total_size(4) /* FRA_FWMASK */

			 + nla_total_size(sizeof(struct fib_kuid_range));



	if (ops->nlmsg_payload)

		payload += ops->nlmsg_payload(rule);
@@ -598,7 +666,9 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule, 
	    ((rule->mark_mask || rule->mark) &&

	     nla_put_u32(skb, FRA_FWMASK, rule->mark_mask)) ||

	    (rule->target &&

	     nla_put_u32(skb, FRA_GOTO, rule->target)))

	     nla_put_u32(skb, FRA_GOTO, rule->target)) ||

	    (uid_range_set(&rule->uid_range) &&

	     nla_put_uid_range(skb, &rule->uid_range)))

		goto nla_put_failure;



	if (rule->suppress_ifgroup != -1) {