OpenVZ Forum: Devel » [PATCH 00/16] core network namespace support

Home » Mailing lists » Devel » [PATCH 00/16] core network namespace support

Show: Today's Messages :: Show Polls :: Message Navigator
E-mail to friend

[PATCH 10/16] net: Make packet reception network namespace safe [message #19976 is a reply to message #19975]

Sat, 08 September 2007 21:25

ebiederm
Messages: 1354
Registered: February 2006

Senior Member

This patch modifies every packet receive function
registered with dev_add_pack() to drop packets if they
are not from the initial network namespace.

This should ensure that the various network stacks do
not receive packets in a anything but the initial network
namespace until the code has been converted and is ready
for them.

Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
---
 drivers/block/aoe/aoenet.c      |    4 ++++
 drivers/net/bonding/bond_3ad.c  |    4 ++++
 drivers/net/bonding/bond_alb.c  |    3 +++
 drivers/net/bonding/bond_main.c |    3 +++
 drivers/net/hamradio/bpqether.c |    3 +++
 drivers/net/pppoe.c             |    6 ++++++
 drivers/net/wan/hdlc.c          |    7 +++++++
 drivers/net/wan/lapbether.c     |    3 +++
 drivers/net/wan/syncppp.c       |    6 ++++++
 net/8021q/vlan_dev.c            |    5 +++++
 net/appletalk/aarp.c            |    3 +++
 net/appletalk/ddp.c             |    6 ++++++
 net/ax25/ax25_in.c              |    5 +++++
 net/bridge/br_stp_bpdu.c        |    4 ++++
 net/decnet/dn_route.c           |    3 +++
 net/econet/af_econet.c          |    3 +++
 net/ipv4/arp.c                  |    3 +++
 net/ipv4/ip_input.c             |    3 +++
 net/ipv4/ipconfig.c             |    6 ++++++
 net/ipv6/ip6_input.c            |    5 +++++
 net/ipx/af_ipx.c                |    3 +++
 net/irda/irlap_frame.c          |    3 +++
 net/llc/llc_input.c             |    4 ++++
 net/packet/af_packet.c          |    9 +++++++++
 net/tipc/eth_media.c            |    6 ++++++
 net/x25/x25_dev.c               |    3 +++
 26 files changed, 113 insertions(+), 0 deletions(-)

diff --git a/drivers/block/aoe/aoenet.c b/drivers/block/aoe/aoenet.c
index f9ddfda..4dc0fb7 100644
--- a/drivers/block/aoe/aoenet.c
+++ b/drivers/block/aoe/aoenet.c
@@ -8,6 +8,7 @@
 #include <linux/blkdev.h>
 #include <linux/netdevice.h>
 #include <linux/moduleparam.h>
+#include <net/net_namespace.h>
 #include <asm/unaligned.h>
 #include "aoe.h"
 
@@ -114,6 +115,9 @@ aoenet_rcv(struct sk_buff *skb, struct net_device *ifp, struct packet_type *pt,
 	struct aoe_hdr *h;
 	u32 n;
 
+	if (ifp->nd_net != &init_net)
+		goto exit;
+
 	skb = skb_share_check(skb, GFP_ATOMIC);
 	if (skb == NULL)
 		return 0;
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index f829e4a..94bd739 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -29,6 +29,7 @@
 #include <linux/ethtool.h>
 #include <linux/if_bonding.h>
 #include <linux/pkt_sched.h>
+#include <net/net_namespace.h>
 #include "bonding.h"
 #include "bond_3ad.h"
 
@@ -2448,6 +2449,9 @@ int bond_3ad_lacpdu_recv(struct sk_buff *skb, struct net_device *dev, struct pac
 	struct slave *slave = NULL;
 	int ret = NET_RX_DROP;
 
+	if (dev->nd_net != &init_net)
+		goto out;
+
 	if (!(dev->flags & IFF_MASTER))
 		goto out;
 
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 92c3b6f..419a9f8 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -345,6 +345,9 @@ static int rlb_arp_recv(struct sk_buff *skb, struct net_device *bond_dev, struct
 	struct arp_pkt *arp = (struct arp_pkt *)skb->data;
 	int res = NET_RX_DROP;
 
+	if (bond_dev->nd_net != &init_net)
+		goto out;
+
 	if (!(bond_dev->flags & IFF_MASTER))
 		goto out;
 
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 5de648f..e4e5fdc 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2458,6 +2458,9 @@ static int bond_arp_rcv(struct sk_buff *skb, struct net_device *dev, struct pack
 	unsigned char *arp_ptr;
 	u32 sip, tip;
 
+	if (dev->nd_net != &init_net)
+		goto out;
+
 	if (!(dev->priv_flags & IFF_BONDING) || !(dev->flags & IFF_MASTER))
 		goto out;
 
diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c
index 1699d42..85fb8e7 100644
--- a/drivers/net/hamradio/bpqether.c
+++ b/drivers/net/hamradio/bpqether.c
@@ -173,6 +173,9 @@ static int bpq_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_ty
 	struct ethhdr *eth;
 	struct bpqdev *bpq;
 
+	if (dev->nd_net != &init_net)
+		goto drop;
+
 	if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
 		return NET_RX_DROP;
 
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index f8bf5fc..a29ea22 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -386,6 +386,9 @@ static int pppoe_rcv(struct sk_buff *skb,
 	struct pppoe_hdr *ph;
 	struct pppox_sock *po;
 
+	if (dev->nd_net != &init_net)
+		goto drop;
+
 	if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
 		goto drop;
 
@@ -418,6 +421,9 @@ static int pppoe_disc_rcv(struct sk_buff *skb,
 	struct pppoe_hdr *ph;
 	struct pppox_sock *po;
 
+	if (dev->nd_net != &init_net)
+		goto abort;
+
 	if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
 		goto abort;
 
diff --git a/drivers/net/wan/hdlc.c b/drivers/net/wan/hdlc.c
index 65ad2e2..3b57350 100644
--- a/drivers/net/wan/hdlc.c
+++ b/drivers/net/wan/hdlc.c
@@ -36,6 +36,7 @@
 #include <linux/rtnetlink.h>
 #include <linux/notifier.h>
 #include <linux/hdlc.h>
+#include <net/net_namespace.h>
 
 
 static const char* version = "HDLC support module revision 1.21";
@@ -66,6 +67,12 @@ static int hdlc_rcv(struct sk_buff *skb, struct net_device *dev,
 		    struct packet_type *p, struct net_device *orig_dev)
 {
 	struct hdlc_device_desc *desc = dev_to_desc(dev);
+
+	if (dev->nd_net != &init_net) {
+		kfree_skb(skb);
+		return 0;
+	}
+
 	if (desc->netif_rx)
 		return desc->netif_rx(skb);
 
diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index 6c302e9..ca8b3c3 100644
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c
@@ -91,6 +91,9 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
 	int len, err;
 	struct lapbethdev *lapbeth;
 
+	if (dev->nd_net != &init_net)
+		goto drop;
+
 	if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
 		return NET_RX_DROP;
 
diff --git a/drivers/net/wan/syncppp.c b/drivers/net/wan/syncppp.c
index 67fc67c..5c71af6 100644
--- a/drivers/net/wan/syncppp.c
+++ b/drivers/net/wan/syncppp.c
@@ -51,6 +51,7 @@
 #include <linux/spinlock.h>
 #include <linux/rcupdate.h>
 
+#include <net/net_namespace.h>
 #include <net/syncppp.h>
 
 #include <asm/byteorder.h>
@@ -1445,6 +1446,11 @@ static void sppp_print_bytes (u_char *p, u16 len)
 
 static int sppp_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *p, struct net_device *orig_dev)
 {
+	if (dev->nd_net != &init_net) {
+		kfree_skb(skb);
+		return 0;
+	}
+
 	if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
 		return NET_RX_DROP;
 	sppp_input(dev,skb);
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 328759c..6644e8f 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -122,6 +122,11 @@ int vlan_skb_recv(struct sk_buff *skb, struct net_device *dev,
 	unsigned short vlan_TCI;
 	__be16 proto;
 
+	if (dev->nd_net != &init_net) {
+		kfree_skb(skb);
+		return -1;
+	}
+
 	if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
 		return -1;
 
diff --git a/net/appletalk/aarp.c b/net/appletalk/aarp.c
index 80b5414..9267f48 100644
--- a/net/appletalk/aarp.c
+++ b/net/appletalk/aarp.c
@@ -713,6 +713,9 @@ static int aarp_rcv(struct sk_buff *skb, struct net_device *dev,
 	struct atalk_addr sa, *ma, da;
 	struct atalk_iface *ifa;
 
+	if (dev->nd_net != &init_net)
+		goto out0;
+
 	/* We only do Ethernet SNAP AARP. */
 	if (dev->type != ARPHRD_ETHER)
 		goto out0;
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index fd1d52f..c1f1367 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1403,6 +1403,9 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
 	int origlen;
 	__u16 len_hops;
 
+	if (dev->nd_net != &init_net)
+		goto freeit;
+
 	/* Don't mangle buffer if shared */
 	if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
 		goto out;
@@ -1488,6 +1491,9 @@ freeit:
 static int ltalk_rcv(struct sk_buff *skb, struct net_device *dev,
 		     struct packet_type *pt, struct net_device *orig_dev)
 {
+	if (dev->nd_net != &init_net)
+		goto freeit;
+
 	/* Expand any short form frames */
 	if (skb_mac_header(skb)[2] == 1) {
 		struct ddpehdr *ddp;
diff --git a/net/ax25/ax25_in.c b/net/ax25/ax25_in.c
index 0ddaff0..3b7d172 100644
--- a/net/ax25/ax25_in.c
+++ b/net/ax25/ax25_in.c
@@ -451,6 +451,11 @@ int ax25_kiss_rcv(struct sk_buff *skb, struct net_device *dev,
 	skb->sk = NULL;		/* Initially we don't know who it's for */
 	skb->destructor = NULL;	/* Who initializes this, dammit?! */
 
+	if (dev->nd_net != &init_net) {
+		kfree_skb(skb);
+		return 0;
+	}
+
 	if ((*skb->data & 0x0F) != 0) {
 		kfree_skb(skb);	/* Not a KISS data frame */
 		return 0;
diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index 14f0c88..0edbd2a 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -17,6 +17,7 @@
 #include <linux/netfilter_bridge.h>
 #include <linux/etherdevice.h>
 #include <linux/llc.h>
+#include <net/net_namespace.h>
 #include <net/llc.h>
 #include <net/llc_pdu.h>
 #include <asm/unaligned.h>
@@ -141,6 +142,9 @@ int br_stp_rcv(struct sk_buff *skb, struct net_device *dev,
 	struct net_bridge *br;
 	const unsigned char *buf;
 
+	if (dev->nd_net != &init_net)
+		goto err;
+
 	if (!p)
 		goto err;
 
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 4cfea95..580e786 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -584,6 +584,9 @@ int dn_route_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type
 	struct dn_dev *dn = (struct dn_dev *)dev->dn_ptr;
 	unsigned char pa

...

[ Show the rest of the message ]

Report message to a moderator

[Message index]

		[PATCH 00/16] core network namespace support By: ebiederm on Sat, 08 September 2007 21:07
		[PATCH 01/16] appletalk: In notifier handlers convert the void pointer to a netdevice By: ebiederm on Sat, 08 September 2007 21:09
		[PATCH 02/16] net: Don't implement dev_ifname32 inline By: ebiederm on Sat, 08 September 2007 21:13
		[PATCH 03/16] net: Basic network namespace infrastructure. By: ebiederm on Sat, 08 September 2007 21:15
		[PATCH 04/16] net: Add a network namespace parameter to tasks By: ebiederm on Sat, 08 September 2007 21:17
		[PATCH 05/16] net: Add a network namespace tag to struct net_device By: ebiederm on Sat, 08 September 2007 21:18
		[PATCH 07/16] net: Make /proc/net per network namespace By: ebiederm on Sat, 08 September 2007 21:20
		[PATCH 08/16] net: Make socket creation namespace safe. By: ebiederm on Sat, 08 September 2007 21:23
		[PATCH 09/16] net: Initialize the network namespace of network devices. By: ebiederm on Sat, 08 September 2007 21:24
		[PATCH 10/16] net: Make packet reception network namespace safe By: ebiederm on Sat, 08 September 2007 21:25
		[PATCH 11/16] net: Make device event notification network namespace safe By: ebiederm on Sat, 08 September 2007 21:27
		[PATCH 12/16] net: Support multiple network namespaces with netlink By: ebiederm on Sat, 08 September 2007 21:28
		[PATCH 13/16] net: Make the device list and device lookups per namespace. By: ebiederm on Sat, 08 September 2007 21:35
		[PATCH 14/16] net: Factor out __dev_alloc_name from dev_alloc_name By: ebiederm on Sat, 08 September 2007 21:36
		[PATCH 15/16] net: Implement network device movement between namespaces By: ebiederm on Sat, 08 September 2007 21:38
		[PATCH 16/16] net: netlink support for moving devices between network namespaces. By: ebiederm on Sat, 08 September 2007 21:43
		[PATCH 17/16] net: Disable netfilter sockopts when not in the initial network namespace By: ebiederm on Sat, 08 September 2007 21:47
		Re: [PATCH 17/16] net: Disable netfilter sockopts when not in the initial network namespace By: ebiederm on Mon, 10 September 2007 15:27
		Re: [PATCH 17/16] net: Disable netfilter sockopts when not in the initial network namespace By: Pavel Emelianov on Mon, 10 September 2007 13:50
		Re: [PATCH 17/16] net: Disable netfilter sockopts when not in the initial network namespace By: davem on Wed, 12 September 2007 11:59
		Re: [PATCH 17/16] net: Disable netfilter sockopts when not in the initial network namespace By: davem on Wed, 12 September 2007 12:03
		Re: [PATCH 17/16] net: Disable netfilter sockopts when not in the initial network namespace By: ebiederm on Wed, 12 September 2007 12:16
		Re: [PATCH 16/16] net: netlink support for moving devices between network namespaces. By: ebiederm on Mon, 10 September 2007 19:30
		Re: [PATCH 16/16] net: netlink support for moving devices between network namespaces. By: serue on Tue, 11 September 2007 00:54
		Re: [PATCH 16/16] net: netlink support for moving devices between network namespaces. By: serue on Mon, 10 September 2007 19:07
		Re: [PATCH 16/16] net: netlink support for moving devices between network namespaces. By: davem on Wed, 12 September 2007 11:57
		Re: [PATCH 15/16] net: Implement network device movement between namespaces By: davem on Wed, 12 September 2007 11:54
		Re: [PATCH 14/16] net: Factor out __dev_alloc_name from dev_alloc_name By: davem on Wed, 12 September 2007 11:49
		Re: [PATCH 13/16] net: Make the device list and device lookups per namespace. By: davem on Wed, 12 September 2007 11:39
		Re: [PATCH 12/16] net: Support multiple network namespaces with netlink By: ebiederm on Mon, 10 September 2007 15:24
		Re: [PATCH 12/16] net: Support multiple network namespaces with netlink By: Pavel Emelianov on Mon, 10 September 2007 13:46
		Re: [PATCH 12/16] net: Support multiple network namespaces with netlink By: davem on Wed, 12 September 2007 11:06
		Re: [PATCH 11/16] net: Make device event notification network namespace safe By: davem on Wed, 12 September 2007 11:02
		Re: [PATCH 10/16] net: Make packet reception network namespace safe By: davem on Wed, 12 September 2007 11:00
		Re: [PATCH 09/16] net: Initialize the network namespace of network devices. By: davem on Wed, 12 September 2007 10:58
		Re: [PATCH 08/16] net: Make socket creation namespace safe. By: davem on Wed, 12 September 2007 10:04
		Re: [PATCH 07/16] net: Make /proc/net per network namespace By: davem on Wed, 12 September 2007 10:02
		Re: [PATCH 07/16] net: Make /proc/net per network namespace By: Daniel Lezcano on Wed, 12 September 2007 12:12
		Re: [PATCH 07/16] net: Make /proc/net per network namespace By: davem on Wed, 12 September 2007 12:19
		[PATCH 06/16] net: Add a network namespace parameter to struct sock By: ebiederm on Sat, 08 September 2007 21:21
		Re: [PATCH 06/16] net: Add a network namespace parameter to struct sock By: davem on Wed, 12 September 2007 09:58
		Re: [PATCH 06/16] net: Add a network namespace parameter to struct sock By: den on Thu, 20 September 2007 12:55
		Re: [PATCH 06/16] net: Add a network namespace parameter to struct sock By: Daniel Lezcano on Thu, 20 September 2007 13:20
		Re: [PATCH 06/16] net: Add a network namespace parameter to struct sock By: den on Fri, 21 September 2007 05:04
		Re: [PATCH 06/16] net: Add a network namespace parameter to struct sock By: ebiederm on Fri, 21 September 2007 05:58
		Re: [PATCH 06/16] net: Add a network namespace parameter to struct sock By: Daniel Lezcano on Fri, 21 September 2007 07:30
		Re: [PATCH 05/16] net: Add a network namespace tag to struct net_device By: davem on Wed, 12 September 2007 09:57
		Re: [PATCH 04/16] net: Add a network namespace parameter to tasks By: davem on Wed, 12 September 2007 09:55
		Re: [PATCH 03/16] net: Basic network namespace infrastructure. By: paulmck on Sun, 09 September 2007 00:33
		Re: [PATCH 03/16] net: Basic network namespace infrastructure. By: ebiederm on Sun, 09 September 2007 10:04
		Re: [PATCH 03/16] net: Basic network namespace infrastructure. By: paulmck on Sun, 09 September 2007 16:45
		Re: [PATCH 03/16] net: Basic network namespace infrastructure. By: ebiederm on Mon, 10 September 2007 06:32
		Re: [PATCH 03/16] net: Basic network namespace infrastructure. By: ebiederm on Sun, 09 September 2007 10:18
		Re: [PATCH 03/16] net: Basic network namespace infrastructure. By: Eric Dumazet on Sun, 09 September 2007 08:44
		Re: [PATCH 03/16] net: Basic network namespace infrastructure. By: ebiederm on Mon, 10 September 2007 06:40
		Re: [PATCH 03/16] net: Basic network namespace infrastructure. By: ebiederm on Mon, 10 September 2007 15:53
		Re: [PATCH 03/16] net: Basic network namespace infrastructure. By: Krishna Kumar2 on Mon, 10 September 2007 05:46
		Re: [PATCH 03/16] net: Basic network namespace infrastructure. By: Pavel Emelianov on Mon, 10 September 2007 13:16
		Re: [PATCH 03/16] net: Basic network namespace infrastructure. By: davem on Wed, 12 September 2007 09:52
		Re: [PATCH 02/16] net: Don't implement dev_ifname32 inline By: davem on Wed, 12 September 2007 09:39
		Re: [PATCH 01/16] appletalk: In notifier handlers convert the void pointer to a netdevice By: davem on Wed, 12 September 2007 09:27

Previous Topic:	[PATCH] Consolidate sleeping routines in file locking code
Next Topic:	NET namespace locking seems broken to me

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

] [

]

Current Time: Sat Aug 23 15:53:12 GMT 2025

Total time taken to generate the page: 0.06757 seconds