To use filtering at the connector & cn_proc layers, we need to enable
filtering in the netlink layer. This reverses the patch which removed
netlink filtering.
Signed-off-by: Anjali Kulkarni <[email protected]>
---
include/linux/netlink.h | 5 +++++
net/netlink/af_netlink.c | 27 +++++++++++++++++++++++++--
2 files changed, 30 insertions(+), 2 deletions(-)
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 19c0791ed9d5..d73cfe5b6bc2 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -227,6 +227,11 @@ bool netlink_strict_get_check(struct sk_buff *skb);
int netlink_unicast(struct sock *ssk, struct sk_buff *skb, __u32 portid, int nonblock);
int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, __u32 portid,
__u32 group, gfp_t allocation);
+int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb,
+ __u32 portid, __u32 group, gfp_t allocation,
+ int (*filter)(struct sock *dsk,
+ struct sk_buff *skb, void *data),
+ void *filter_data);
int netlink_set_err(struct sock *ssk, __u32 portid, __u32 group, int code);
int netlink_register_notifier(struct notifier_block *nb);
int netlink_unregister_notifier(struct notifier_block *nb);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 3a1e0fd5bf14..e75e5156e4ac 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1432,6 +1432,8 @@ struct netlink_broadcast_data {
int delivered;
gfp_t allocation;
struct sk_buff *skb, *skb2;
+ int (*tx_filter)(struct sock *dsk, struct sk_buff *skb, void *data);
+ void *tx_data;
};
static void do_one_broadcast(struct sock *sk,
@@ -1485,6 +1487,13 @@ static void do_one_broadcast(struct sock *sk,
p->delivery_failure = 1;
goto out;
}
+
+ if (p->tx_filter && p->tx_filter(sk, p->skb2, p->tx_data)) {
+ kfree_skb(p->skb2);
+ p->skb2 = NULL;
+ goto out;
+ }
+
if (sk_filter(sk, p->skb2)) {
kfree_skb(p->skb2);
p->skb2 = NULL;
@@ -1507,8 +1516,12 @@ static void do_one_broadcast(struct sock *sk,
sock_put(sk);
}
-int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 portid,
- u32 group, gfp_t allocation)
+int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb,
+ u32 portid,
+ u32 group, gfp_t allocation,
+ int (*filter)(struct sock *dsk,
+ struct sk_buff *skb, void *data),
+ void *filter_data)
{
struct net *net = sock_net(ssk);
struct netlink_broadcast_data info;
@@ -1527,6 +1540,8 @@ int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 portid,
info.allocation = allocation;
info.skb = skb;
info.skb2 = NULL;
+ info.tx_filter = filter;
+ info.tx_data = filter_data;
/* While we sleep in clone, do not allow to change socket list */
@@ -1552,6 +1567,14 @@ int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 portid,
}
return -ESRCH;
}
+EXPORT_SYMBOL(netlink_broadcast_filtered);
+
+int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 portid,
+ u32 group, gfp_t allocation)
+{
+ return netlink_broadcast_filtered(ssk, skb, portid, group, allocation,
+ NULL, NULL);
+}
EXPORT_SYMBOL(netlink_broadcast);
struct netlink_set_err_data {
--
2.41.0
* Anjali Kulkarni <[email protected]> [230614 19:41]:
> To use filtering at the connector & cn_proc layers, we need to enable
> filtering in the netlink layer. This reverses the patch which removed
> netlink filtering.
>
> Signed-off-by: Anjali Kulkarni <[email protected]>
Reviewed-by: Liam R. Howlett <[email protected]>
> ---
> include/linux/netlink.h | 5 +++++
> net/netlink/af_netlink.c | 27 +++++++++++++++++++++++++--
> 2 files changed, 30 insertions(+), 2 deletions(-)
>
> diff --git a/include/linux/netlink.h b/include/linux/netlink.h
> index 19c0791ed9d5..d73cfe5b6bc2 100644
> --- a/include/linux/netlink.h
> +++ b/include/linux/netlink.h
> @@ -227,6 +227,11 @@ bool netlink_strict_get_check(struct sk_buff *skb);
> int netlink_unicast(struct sock *ssk, struct sk_buff *skb, __u32 portid, int nonblock);
> int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, __u32 portid,
> __u32 group, gfp_t allocation);
> +int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb,
> + __u32 portid, __u32 group, gfp_t allocation,
> + int (*filter)(struct sock *dsk,
> + struct sk_buff *skb, void *data),
> + void *filter_data);
> int netlink_set_err(struct sock *ssk, __u32 portid, __u32 group, int code);
> int netlink_register_notifier(struct notifier_block *nb);
> int netlink_unregister_notifier(struct notifier_block *nb);
> diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
> index 3a1e0fd5bf14..e75e5156e4ac 100644
> --- a/net/netlink/af_netlink.c
> +++ b/net/netlink/af_netlink.c
> @@ -1432,6 +1432,8 @@ struct netlink_broadcast_data {
> int delivered;
> gfp_t allocation;
> struct sk_buff *skb, *skb2;
> + int (*tx_filter)(struct sock *dsk, struct sk_buff *skb, void *data);
> + void *tx_data;
> };
>
> static void do_one_broadcast(struct sock *sk,
> @@ -1485,6 +1487,13 @@ static void do_one_broadcast(struct sock *sk,
> p->delivery_failure = 1;
> goto out;
> }
> +
> + if (p->tx_filter && p->tx_filter(sk, p->skb2, p->tx_data)) {
> + kfree_skb(p->skb2);
> + p->skb2 = NULL;
> + goto out;
> + }
> +
> if (sk_filter(sk, p->skb2)) {
> kfree_skb(p->skb2);
> p->skb2 = NULL;
> @@ -1507,8 +1516,12 @@ static void do_one_broadcast(struct sock *sk,
> sock_put(sk);
> }
>
> -int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 portid,
> - u32 group, gfp_t allocation)
> +int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb,
> + u32 portid,
> + u32 group, gfp_t allocation,
> + int (*filter)(struct sock *dsk,
> + struct sk_buff *skb, void *data),
> + void *filter_data)
> {
> struct net *net = sock_net(ssk);
> struct netlink_broadcast_data info;
> @@ -1527,6 +1540,8 @@ int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 portid,
> info.allocation = allocation;
> info.skb = skb;
> info.skb2 = NULL;
> + info.tx_filter = filter;
> + info.tx_data = filter_data;
>
> /* While we sleep in clone, do not allow to change socket list */
>
> @@ -1552,6 +1567,14 @@ int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 portid,
> }
> return -ESRCH;
> }
> +EXPORT_SYMBOL(netlink_broadcast_filtered);
> +
> +int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 portid,
> + u32 group, gfp_t allocation)
> +{
> + return netlink_broadcast_filtered(ssk, skb, portid, group, allocation,
> + NULL, NULL);
> +}
> EXPORT_SYMBOL(netlink_broadcast);
>
> struct netlink_set_err_data {
> --
> 2.41.0
>