mirror of
https://github.com/torvalds/linux.git
synced 2025-04-06 00:16:18 +00:00
0d7336f8f0
When introduced in commit 61723b393292 ("tcp: ulp: add functions to dump
ulp-specific information"), the whole ULP diag info has been exported
only if the requester had CAP_NET_ADMIN.
It looks like not everything is sensitive, and some info can be exported
to all users in order to ease the debugging from the userspace side
without requiring additional capabilities. Each layer should then decide
what can be exposed to everybody. The 'net_admin' boolean is then passed
to the different layers.
On kTLS side, it looks like there is nothing sensitive there: version,
cipher type, tx/rx user config type, plus some flags. So, only some
metadata about the configuration, no cryptographic info like keys, etc.
Then, everything can be exported to all users.
On MPTCP side, that's different. The MPTCP-related sequence numbers per
subflow should certainly not be exposed to everybody. For example, the
DSS mapping and ssn_offset would give all users on the system access to
narrow ranges of values for the subflow TCP sequence numbers and
MPTCP-level DSNs, and then ease packet injection. The TCP diag interface
doesn't expose the TCP sequence numbers for TCP sockets, so best to do
the same here. The rest -- token, IDs, flags -- can be exported to
everybody.
Acked-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20250306-net-next-tcp-ulp-diag-net-admin-v1-2-06afdd860fc9@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
121 lines
3.3 KiB
C
121 lines
3.3 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/* MPTCP socket monitoring support
|
|
*
|
|
* Copyright (c) 2019 Red Hat
|
|
*
|
|
* Author: Davide Caratti <dcaratti@redhat.com>
|
|
*/
|
|
|
|
#include <linux/kernel.h>
|
|
#include <linux/net.h>
|
|
#include <linux/inet_diag.h>
|
|
#include <net/netlink.h>
|
|
#include "protocol.h"
|
|
|
|
static int subflow_get_info(struct sock *sk, struct sk_buff *skb, bool net_admin)
|
|
{
|
|
struct mptcp_subflow_context *sf;
|
|
struct nlattr *start;
|
|
u32 flags = 0;
|
|
bool slow;
|
|
int err;
|
|
|
|
if (inet_sk_state_load(sk) == TCP_LISTEN)
|
|
return 0;
|
|
|
|
start = nla_nest_start_noflag(skb, INET_ULP_INFO_MPTCP);
|
|
if (!start)
|
|
return -EMSGSIZE;
|
|
|
|
slow = lock_sock_fast(sk);
|
|
rcu_read_lock();
|
|
sf = rcu_dereference(inet_csk(sk)->icsk_ulp_data);
|
|
if (!sf) {
|
|
err = 0;
|
|
goto nla_failure;
|
|
}
|
|
|
|
if (sf->mp_capable)
|
|
flags |= MPTCP_SUBFLOW_FLAG_MCAP_REM;
|
|
if (sf->request_mptcp)
|
|
flags |= MPTCP_SUBFLOW_FLAG_MCAP_LOC;
|
|
if (sf->mp_join)
|
|
flags |= MPTCP_SUBFLOW_FLAG_JOIN_REM;
|
|
if (sf->request_join)
|
|
flags |= MPTCP_SUBFLOW_FLAG_JOIN_LOC;
|
|
if (sf->backup)
|
|
flags |= MPTCP_SUBFLOW_FLAG_BKUP_REM;
|
|
if (sf->request_bkup)
|
|
flags |= MPTCP_SUBFLOW_FLAG_BKUP_LOC;
|
|
if (READ_ONCE(sf->fully_established))
|
|
flags |= MPTCP_SUBFLOW_FLAG_FULLY_ESTABLISHED;
|
|
if (sf->conn_finished)
|
|
flags |= MPTCP_SUBFLOW_FLAG_CONNECTED;
|
|
if (sf->map_valid)
|
|
flags |= MPTCP_SUBFLOW_FLAG_MAPVALID;
|
|
|
|
if (nla_put_u32(skb, MPTCP_SUBFLOW_ATTR_TOKEN_REM, sf->remote_token) ||
|
|
nla_put_u32(skb, MPTCP_SUBFLOW_ATTR_TOKEN_LOC, sf->token) ||
|
|
nla_put_u32(skb, MPTCP_SUBFLOW_ATTR_FLAGS, flags) ||
|
|
nla_put_u8(skb, MPTCP_SUBFLOW_ATTR_ID_REM, sf->remote_id) ||
|
|
nla_put_u8(skb, MPTCP_SUBFLOW_ATTR_ID_LOC, subflow_get_local_id(sf))) {
|
|
err = -EMSGSIZE;
|
|
goto nla_failure;
|
|
}
|
|
|
|
/* Only export seq related counters to user with CAP_NET_ADMIN */
|
|
if (net_admin &&
|
|
(nla_put_u32(skb, MPTCP_SUBFLOW_ATTR_RELWRITE_SEQ,
|
|
sf->rel_write_seq) ||
|
|
nla_put_u64_64bit(skb, MPTCP_SUBFLOW_ATTR_MAP_SEQ, sf->map_seq,
|
|
MPTCP_SUBFLOW_ATTR_PAD) ||
|
|
nla_put_u32(skb, MPTCP_SUBFLOW_ATTR_MAP_SFSEQ,
|
|
sf->map_subflow_seq) ||
|
|
nla_put_u32(skb, MPTCP_SUBFLOW_ATTR_SSN_OFFSET, sf->ssn_offset) ||
|
|
nla_put_u16(skb, MPTCP_SUBFLOW_ATTR_MAP_DATALEN,
|
|
sf->map_data_len))) {
|
|
err = -EMSGSIZE;
|
|
goto nla_failure;
|
|
}
|
|
|
|
rcu_read_unlock();
|
|
unlock_sock_fast(sk, slow);
|
|
nla_nest_end(skb, start);
|
|
return 0;
|
|
|
|
nla_failure:
|
|
rcu_read_unlock();
|
|
unlock_sock_fast(sk, slow);
|
|
nla_nest_cancel(skb, start);
|
|
return err;
|
|
}
|
|
|
|
static size_t subflow_get_info_size(const struct sock *sk, bool net_admin)
|
|
{
|
|
size_t size = 0;
|
|
|
|
size += nla_total_size(0) + /* INET_ULP_INFO_MPTCP */
|
|
nla_total_size(4) + /* MPTCP_SUBFLOW_ATTR_TOKEN_REM */
|
|
nla_total_size(4) + /* MPTCP_SUBFLOW_ATTR_TOKEN_LOC */
|
|
nla_total_size(4) + /* MPTCP_SUBFLOW_ATTR_FLAGS */
|
|
nla_total_size(1) + /* MPTCP_SUBFLOW_ATTR_ID_REM */
|
|
nla_total_size(1) + /* MPTCP_SUBFLOW_ATTR_ID_LOC */
|
|
0;
|
|
|
|
if (net_admin)
|
|
size += nla_total_size(4) + /* MPTCP_SUBFLOW_ATTR_RELWRITE_SEQ */
|
|
nla_total_size_64bit(8) + /* MPTCP_SUBFLOW_ATTR_MAP_SEQ */
|
|
nla_total_size(4) + /* MPTCP_SUBFLOW_ATTR_MAP_SFSEQ */
|
|
nla_total_size(4) + /* MPTCP_SUBFLOW_ATTR_SSN_OFFSET */
|
|
nla_total_size(2) + /* MPTCP_SUBFLOW_ATTR_MAP_DATALEN */
|
|
0;
|
|
|
|
return size;
|
|
}
|
|
|
|
void mptcp_diag_subflow_init(struct tcp_ulp_ops *ops)
|
|
{
|
|
ops->get_info = subflow_get_info;
|
|
ops->get_info_size = subflow_get_info_size;
|
|
}
|