SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #19716 from yuwata/sd-netlink-NETLINK_GET_STRICT_CHK

Browse Source 
sd-netlink: enable NETLINK_GET_STRICT_CHK socket option to filter out message on kernel
This commit is contained in:
Yu Watanabe
2021-05-25 22:38:59 +09:00
committed by GitHub
parent 850f0008bf 922a653090
commit 13eeefe1a8
8 changed files with 97 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libsystemd/sd-netlink/rtnl-message.c
-11
View File
@@ -265,9 +265,6 @@ int sd_rtnl_message_new_route(sd_netlink *rtnl, sd_netlink_message **ret,
rtm = NLMSG_DATA((*ret)->hdr);
rtm->rtm_family = rtm_family;
rtm->rtm_scope = RT_SCOPE_UNIVERSE;
rtm->rtm_type = RTN_UNICAST;
rtm->rtm_table = RT_TABLE_MAIN;
rtm->rtm_protocol = rtm_protocol;
return 0;
@@ -664,17 +661,10 @@ int sd_rtnl_message_new_addr(sd_netlink *rtnl, sd_netlink_message **ret,
if (r < 0)
return r;
if (nlmsg_type == RTM_GETADDR)
(*ret)->hdr->nlmsg_flags |= NLM_F_DUMP;
ifa = NLMSG_DATA((*ret)->hdr);
ifa->ifa_index = index;
ifa->ifa_family = family;
if (family == AF_INET)
ifa->ifa_prefixlen = 32;
else if (family == AF_INET6)
ifa->ifa_prefixlen = 128;
return 0;
}
@@ -865,7 +855,6 @@ int sd_rtnl_message_new_routing_policy_rule(sd_netlink *rtnl, sd_netlink_message
frh = NLMSG_DATA((*ret)->hdr);
frh->family = ifal_family;
frh->action = FR_ACT_TO_TBL;
return 0;
}
src/libsystemd/sd-netlink/sd-netlink.c
+5 -1
View File
@@ -125,10 +125,14 @@ int sd_netlink_open_fd(sd_netlink **ret, int fd) {
rtnl->fd = fd;
rtnl->protocol = protocol;
r = setsockopt_int(fd, SOL_NETLINK, NETLINK_EXT_ACK, 1);
r = setsockopt_int(fd, SOL_NETLINK, NETLINK_EXT_ACK, true);
if (r < 0)
log_debug_errno(r, "sd-netlink: Failed to enable NETLINK_EXT_ACK option, ignoring: %m");
r = setsockopt_int(fd, SOL_NETLINK, NETLINK_GET_STRICT_CHK, true);
if (r < 0)
log_debug_errno(r, "sd-netlink: Failed to enable NETLINK_GET_STRICT_CHK option, ignoring: %m");
r = socket_bind(rtnl);
if (r < 0) {
rtnl->fd = -1; /* on failure, the caller remains owner of the fd, hence don't close it here */
src/libsystemd/sd-netlink/test-netlink.c
+11 -44
View File
@@ -35,36 +35,23 @@ static void test_message_link_bridge(sd_netlink *rtnl) {
}
static void test_link_configure(sd_netlink *rtnl, int ifindex) {
_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *message = NULL;
const char *mac = "98:fe:94:3f:c6:18", *name = "test";
char buffer[ETHER_ADDR_TO_STRING_MAX];
uint32_t mtu = 1450, mtu_out;
_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *message = NULL, *reply = NULL;
uint32_t mtu_out;
const char *name_out;
struct ether_addr mac_out;
/* we'd really like to test NEWLINK, but let's not mess with the running kernel */
assert_se(sd_rtnl_message_new_link(rtnl, &message, RTM_GETLINK, ifindex) >= 0);
assert_se(sd_netlink_message_append_string(message, IFLA_IFNAME, name) >= 0);
assert_se(sd_netlink_message_append_ether_addr(message, IFLA_ADDRESS, ether_aton(mac)) >= 0);
assert_se(sd_netlink_message_append_u32(message, IFLA_MTU, mtu) >= 0);
assert_se(sd_netlink_call(rtnl, message, 0, NULL) == 1);
assert_se(sd_netlink_message_rewind(message, NULL) >= 0);
assert_se(sd_netlink_call(rtnl, message, 0, &reply) == 1);
assert_se(sd_netlink_message_read_string(message, IFLA_IFNAME, &name_out) >= 0);
assert_se(streq(name, name_out));
assert_se(sd_netlink_message_read_ether_addr(message, IFLA_ADDRESS, &mac_out) >= 0);
assert_se(streq(mac, ether_addr_to_string(&mac_out, buffer)));
assert_se(sd_netlink_message_read_u32(message, IFLA_MTU, &mtu_out) >= 0);
assert_se(mtu == mtu_out);
assert_se(sd_netlink_message_read_string(reply, IFLA_IFNAME, &name_out) >= 0);
assert_se(sd_netlink_message_read_ether_addr(reply, IFLA_ADDRESS, &mac_out) >= 0);
assert_se(sd_netlink_message_read_u32(reply, IFLA_MTU, &mtu_out) >= 0);
}
static void test_link_get(sd_netlink *rtnl, int ifindex) {
sd_netlink_message *m;
sd_netlink_message *r;
uint32_t mtu = 1500;
_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL, *r = NULL;
const char *str_data;
uint8_t u8_data;
uint32_t u32_data;
@@ -73,19 +60,7 @@ static void test_link_get(sd_netlink *rtnl, int ifindex) {
assert_se(sd_rtnl_message_new_link(rtnl, &m, RTM_GETLINK, ifindex) >= 0);
assert_se(m);
/* u8 test cases */
assert_se(sd_netlink_message_append_u8(m, IFLA_CARRIER, 0) >= 0);
assert_se(sd_netlink_message_append_u8(m, IFLA_OPERSTATE, 0) >= 0);
assert_se(sd_netlink_message_append_u8(m, IFLA_LINKMODE, 0) >= 0);
/* u32 test cases */
assert_se(sd_netlink_message_append_u32(m, IFLA_MTU, mtu) >= 0);
assert_se(sd_netlink_message_append_u32(m, IFLA_GROUP, 0) >= 0);
assert_se(sd_netlink_message_append_u32(m, IFLA_TXQLEN, 0) >= 0);
assert_se(sd_netlink_message_append_u32(m, IFLA_NUM_TX_QUEUES, 0) >= 0);
assert_se(sd_netlink_message_append_u32(m, IFLA_NUM_RX_QUEUES, 0) >= 0);
assert_se(sd_netlink_call(rtnl, m, -1, &r) == 1);
assert_se(sd_netlink_call(rtnl, m, 0, &r) == 1);
assert_se(sd_netlink_message_read_string(r, IFLA_IFNAME, &str_data) == 0);
@@ -100,31 +75,23 @@ static void test_link_get(sd_netlink *rtnl, int ifindex) {
assert_se(sd_netlink_message_read_u32(r, IFLA_NUM_RX_QUEUES, &u32_data) == 0);
assert_se(sd_netlink_message_read_ether_addr(r, IFLA_ADDRESS, &eth_data) == 0);
assert_se((m = sd_netlink_message_unref(m)) == NULL);
assert_se((r = sd_netlink_message_unref(r)) == NULL);
}
static void test_address_get(sd_netlink *rtnl, int ifindex) {
sd_netlink_message *m;
sd_netlink_message *r;
_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL, *r = NULL;
struct in_addr in_data;
struct ifa_cacheinfo cache;
const char *label;
assert_se(sd_rtnl_message_new_addr(rtnl, &m, RTM_GETADDR, ifindex, AF_INET) >= 0);
assert_se(m);
assert_se(sd_netlink_message_request_dump(m, true) >= 0);
assert_se(sd_netlink_call(rtnl, m, -1, &r) == 1);
assert_se(sd_netlink_message_read_in_addr(r, IFA_LOCAL, &in_data) == 0);
assert_se(sd_netlink_message_read_in_addr(r, IFA_ADDRESS, &in_data) == 0);
assert_se(sd_netlink_message_read_string(r, IFA_LABEL, &label) == 0);
assert_se(sd_netlink_message_read_cache_info(r, IFA_CACHEINFO, &cache) == 0);
assert_se((m = sd_netlink_message_unref(m)) == NULL);
assert_se((r = sd_netlink_message_unref(r)) == NULL);
}
static void test_route(sd_netlink *rtnl) {
@@ -479,7 +446,7 @@ static void test_get_addresses(sd_netlink *rtnl) {
sd_netlink_message *m;
assert_se(sd_rtnl_message_new_addr(rtnl, &req, RTM_GETADDR, 0, AF_UNSPEC) >= 0);
assert_se(sd_netlink_message_request_dump(req, true) >= 0);
assert_se(sd_netlink_call(rtnl, req, 0, &reply) >= 0);
for (m = reply; m; m = sd_netlink_message_next(m)) {
src/network/networkd-address.c
+9 -3
View File
@@ -755,7 +755,11 @@ static int link_enumerate_ipv6_tentative_addresses(Link *link) {
assert(link->manager);
assert(link->manager->rtnl);
r = sd_rtnl_message_new_addr(link->manager->rtnl, &req, RTM_GETADDR, 0, AF_INET6);
r = sd_rtnl_message_new_addr(link->manager->rtnl, &req, RTM_GETADDR, link->ifindex, AF_INET6);
if (r < 0)
return r;
r = sd_netlink_message_request_dump(req, true);
if (r < 0)
return r;
@@ -767,16 +771,18 @@ static int link_enumerate_ipv6_tentative_addresses(Link *link) {
unsigned char flags;
int ifindex;
/* NETLINK_GET_STRICT_CHK socket option is supported since kernel 4.20. To support
* older kernels, we need to check ifindex here. */
r = sd_rtnl_message_addr_get_ifindex(addr, &ifindex);
if (r < 0) {
log_link_warning_errno(link, r, "rtnl: invalid ifindex, ignoring: %m");
log_link_warning_errno(link, r, "rtnl: received address message without valid ifindex, ignoring: %m");
continue;
} else if (link->ifindex != ifindex)
continue;
r = sd_rtnl_message_addr_get_flags(addr, &flags);
if (r < 0) {
log_link_warning_errno(link, r, "rtnl: received address message with invalid flags, ignoring: %m");
log_link_warning_errno(link, r, "rtnl: received address message without valid flags, ignoring: %m");
continue;
} else if (!(flags & IFA_F_TENTATIVE))
continue;
src/network/networkd-route.c
+12 -14
View File
@@ -893,21 +893,19 @@ static int route_set_netlink_message(const Route *route, sd_netlink_message *req
if (r < 0)
return log_link_error_errno(link, r, "Could not set flags: %m");
if (route->table != RT_TABLE_MAIN) {
if (route->table < 256) {
r = sd_rtnl_message_route_set_table(req, route->table);
if (r < 0)
return log_link_error_errno(link, r, "Could not set route table: %m");
} else {
r = sd_rtnl_message_route_set_table(req, RT_TABLE_UNSPEC);
if (r < 0)
return log_link_error_errno(link, r, "Could not set route table: %m");
if (route->table < 256) {
r = sd_rtnl_message_route_set_table(req, route->table);
if (r < 0)
return log_link_error_errno(link, r, "Could not set route table: %m");
} else {
r = sd_rtnl_message_route_set_table(req, RT_TABLE_UNSPEC);
if (r < 0)
return log_link_error_errno(link, r, "Could not set route table: %m");
/* Table attribute to allow more than 256. */
r = sd_netlink_message_append_data(req, RTA_TABLE, &route->table, sizeof(route->table));
if (r < 0)
return log_link_error_errno(link, r, "Could not append RTA_TABLE attribute: %m");
}
/* Table attribute to allow more than 256. */
r = sd_netlink_message_append_data(req, RTA_TABLE, &route->table, sizeof(route->table));
if (r < 0)
return log_link_error_errno(link, r, "Could not append RTA_TABLE attribute: %m");
}
if (!route_type_is_reject(route) && route->nexthop_id == 0) {
src/network/networkd-routing-policy-rule.c
+3 -5
View File
@@ -508,11 +508,9 @@ static int routing_policy_rule_set_netlink_message(const RoutingPolicyRule *rule
return log_link_error_errno(link, r, "Could not append FRA_SUPPRESS_PREFIXLEN attribute: %m");
}
if (rule->type != FR_ACT_TO_TBL) {
r = sd_rtnl_message_routing_policy_rule_set_fib_type(m, rule->type);
if (r < 0)
return log_link_error_errno(link, r, "Could not append FIB rule type attribute: %m");
}
r = sd_rtnl_message_routing_policy_rule_set_fib_type(m, rule->type);
if (r < 0)
return log_link_error_errno(link, r, "Could not append FIB rule type attribute: %m");
return 0;
}
src/shared/local-addresses.c
+13 -1
View File
@@ -79,7 +79,11 @@ int local_addresses(
return r;
}
r = sd_rtnl_message_new_addr(rtnl, &req, RTM_GETADDR, 0, af);
r = sd_rtnl_message_new_addr(rtnl, &req, RTM_GETADDR, ifindex, af);
if (r < 0)
return r;
r = sd_netlink_message_request_dump(req, true);
if (r < 0)
return r;
@@ -224,6 +228,14 @@ int local_gateways(
if (r < 0)
return r;
r = sd_rtnl_message_route_set_type(req, RTN_UNICAST);
if (r < 0)
return r;
r = sd_rtnl_message_route_set_table(req, RT_TABLE_MAIN);
if (r < 0)
return r;
r = sd_netlink_message_request_dump(req, true);
if (r < 0)
return r;
src/test/test-local-addresses.c
+44 -12
View File
@@ -15,35 +15,67 @@ static void print_local_addresses(struct local_address *a, unsigned n) {
_cleanup_free_ char *b = NULL;
assert_se(in_addr_to_string(a[i].family, &a[i].address, &b) >= 0);
printf("%s if%i scope=%i metric=%u address=%s\n", af_to_name(a[i].family), a[i].ifindex, a[i].scope, a[i].metric, b);
log_debug("%s if%i scope=%i metric=%u address=%s", af_to_name(a[i].family), a[i].ifindex, a[i].scope, a[i].metric, b);
}
}
int main(int argc, char *argv[]) {
struct local_address *a;
int n;
struct local_address *a = NULL;
int n, n_ipv4, n_ipv6;
test_setup_logging(LOG_DEBUG);
a = NULL;
n = local_addresses(NULL, 0, AF_UNSPEC, &a);
n = local_addresses(NULL, 0, AF_INET, &a);
assert_se(n >= 0);
printf("Local Addresses:\n");
log_debug("/* Local Addresses(ifindex:0, AF_INET) */");
print_local_addresses(a, (unsigned) n);
a = mfree(a);
n_ipv4 = n;
n = local_addresses(NULL, 0, AF_INET6, &a);
assert_se(n >= 0);
log_debug("/* Local Addresses(ifindex:0, AF_INET6) */");
print_local_addresses(a, (unsigned) n);
a = mfree(a);
n_ipv6 = n;
n = local_addresses(NULL, 0, AF_UNSPEC, &a);
assert_se(n >= 0);
log_debug("/* Local Addresses(ifindex:0, AF_UNSPEC) */");
print_local_addresses(a, (unsigned) n);
a = mfree(a);
assert_se(n == n_ipv4 + n_ipv6);
n = local_addresses(NULL, 1, AF_INET, &a);
assert_se(n >= 0);
log_debug("/* Local Addresses(ifindex:1, AF_INET) */");
print_local_addresses(a, (unsigned) n);
a = mfree(a);
n_ipv4 = n;
n = local_addresses(NULL, 1, AF_INET6, &a);
assert_se(n >= 0);
log_debug("/* Local Addresses(ifindex:1, AF_INET6) */");
print_local_addresses(a, (unsigned) n);
a = mfree(a);
n_ipv6 = n;
n = local_addresses(NULL, 1, AF_UNSPEC, &a);
assert_se(n >= 0);
log_debug("/* Local Addresses(ifindex:1, AF_UNSPEC) */");
print_local_addresses(a, (unsigned) n);
a = mfree(a);
assert_se(n == n_ipv4 + n_ipv6);
n = local_gateways(NULL, 0, AF_UNSPEC, &a);
assert_se(n >= 0);
printf("Local Gateways:\n");
log_debug("/* Local Gateways */");
print_local_addresses(a, (unsigned) n);
free(a);
a = mfree(a);
n = local_outbounds(NULL, 0, AF_UNSPEC, &a);
assert_se(n >= 0);
printf("Local Outbounds:\n");
log_debug("/* Local Outbounds */");
print_local_addresses(a, (unsigned) n);
free(a);