evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Revert "net: core: Support UID-based routing."

Browse source 
This reverts commit fd2cf795f3.

Bug: 16355602
Change-Id: I1ec2d1eb3d53f4186b60c6ca5d6a20fcca46d442
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
This commit is contained in:
Amit Pundir 2017-01-02 14:05:24 +05:30
parent 3048a60ec7
commit 823e9056c3
29 changed files with 26 additions and 127 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
include/net/fib_rules.h
View file

@ -29,8 +29,6 @@ struct fib_rule {
int suppress_prefixlen; int suppress_prefixlen;
char iifname[IFNAMSIZ]; char iifname[IFNAMSIZ];
char oifname[IFNAMSIZ]; char oifname[IFNAMSIZ];
kuid_t uid_start;
kuid_t uid_end;
struct rcu_head rcu; struct rcu_head rcu;
}; };
@ -89,9 +87,6 @@ struct fib_rules_ops {
[FRA_FWMARK] = { .type = NLA_U32 }, \ [FRA_FWMARK] = { .type = NLA_U32 }, \
[FRA_FWMASK] = { .type = NLA_U32 }, \ [FRA_FWMASK] = { .type = NLA_U32 }, \
[FRA_TABLE] = { .type = NLA_U32 }, \ [FRA_TABLE] = { .type = NLA_U32 }, \
[FRA_GOTO] = { .type = NLA_U32 }, \
[FRA_UID_START] = { .type = NLA_U32 }, \
[FRA_UID_END] = { .type = NLA_U32 }, \
[FRA_SUPPRESS_PREFIXLEN] = { .type = NLA_U32 }, \ [FRA_SUPPRESS_PREFIXLEN] = { .type = NLA_U32 }, \
[FRA_SUPPRESS_IFGROUP] = { .type = NLA_U32 }, \ [FRA_SUPPRESS_IFGROUP] = { .type = NLA_U32 }, \
[FRA_GOTO] = { .type = NLA_U32 } [FRA_GOTO] = { .type = NLA_U32 }

9
include/net/flow.h
View file

@ -11,7 +11,6 @@
#include <linux/in6.h> #include <linux/in6.h>
#include <linux/atomic.h> #include <linux/atomic.h>
#include <net/flow_dissector.h> #include <net/flow_dissector.h>
#include <linux/uidgid.h>
/* /*
* ifindex generation is per-net namespace, and loopback is * ifindex generation is per-net namespace, and loopback is
@ -39,7 +38,6 @@ struct flowi_common {
#define FLOWI_FLAG_SKIP_NH_OIF 0x08 #define FLOWI_FLAG_SKIP_NH_OIF 0x08
__u32 flowic_secid; __u32 flowic_secid;
struct flowi_tunnel flowic_tun_key; struct flowi_tunnel flowic_tun_key;
kuid_t flowic_uid;
}; };
union flowi_uli { union flowi_uli {
@ -77,7 +75,6 @@ struct flowi4 {
#define flowi4_flags __fl_common.flowic_flags #define flowi4_flags __fl_common.flowic_flags
#define flowi4_secid __fl_common.flowic_secid #define flowi4_secid __fl_common.flowic_secid
#define flowi4_tun_key __fl_common.flowic_tun_key #define flowi4_tun_key __fl_common.flowic_tun_key
#define flowi4_uid __fl_common.flowic_uid
/* (saddr,daddr) must be grouped, same order as in IP header */ /* (saddr,daddr) must be grouped, same order as in IP header */
__be32 saddr; __be32 saddr;
@ -97,8 +94,7 @@ static inline void flowi4_init_output(struct flowi4 *fl4, int oif,
__u32 mark, __u8 tos, __u8 scope, __u32 mark, __u8 tos, __u8 scope,
__u8 proto, __u8 flags, __u8 proto, __u8 flags,
__be32 daddr, __be32 saddr, __be32 daddr, __be32 saddr,
__be16 dport, __be16 sport, __be16 dport, __be16 sport)
kuid_t uid)
{ {
fl4->flowi4_oif = oif; fl4->flowi4_oif = oif;
fl4->flowi4_iif = LOOPBACK_IFINDEX; fl4->flowi4_iif = LOOPBACK_IFINDEX;
@ -109,7 +105,6 @@ static inline void flowi4_init_output(struct flowi4 *fl4, int oif,
fl4->flowi4_flags = flags; fl4->flowi4_flags = flags;
fl4->flowi4_secid = 0; fl4->flowi4_secid = 0;
fl4->flowi4_tun_key.tun_id = 0; fl4->flowi4_tun_key.tun_id = 0;
fl4->flowi4_uid = uid;
fl4->daddr = daddr; fl4->daddr = daddr;
fl4->saddr = saddr; fl4->saddr = saddr;
fl4->fl4_dport = dport; fl4->fl4_dport = dport;
@ -138,7 +133,6 @@ struct flowi6 {
#define flowi6_flags __fl_common.flowic_flags #define flowi6_flags __fl_common.flowic_flags
#define flowi6_secid __fl_common.flowic_secid #define flowi6_secid __fl_common.flowic_secid
#define flowi6_tun_key __fl_common.flowic_tun_key #define flowi6_tun_key __fl_common.flowic_tun_key
#define flowi6_uid __fl_common.flowic_uid
struct in6_addr daddr; struct in6_addr daddr;
struct in6_addr saddr; struct in6_addr saddr;
__be32 flowlabel; __be32 flowlabel;
@ -183,7 +177,6 @@ struct flowi {
#define flowi_flags u.__fl_common.flowic_flags #define flowi_flags u.__fl_common.flowic_flags
#define flowi_secid u.__fl_common.flowic_secid #define flowi_secid u.__fl_common.flowic_secid
#define flowi_tun_key u.__fl_common.flowic_tun_key #define flowi_tun_key u.__fl_common.flowic_tun_key
#define flowi_uid u.__fl_common.flowic_uid
} __attribute__((__aligned__(BITS_PER_LONG/8))); } __attribute__((__aligned__(BITS_PER_LONG/8)));
static inline struct flowi *flowi4_to_flowi(struct flowi4 *fl4) static inline struct flowi *flowi4_to_flowi(struct flowi4 *fl4)

1
include/net/ip.h
View file

@ -170,7 +170,6 @@ struct ip_reply_arg {
/* -1 if not needed */ /* -1 if not needed */
int bound_dev_if; int bound_dev_if;
u8 tos; u8 tos;
kuid_t uid;
}; };
#define IP_REPLY_ARG_NOSRCCHECK 1 #define IP_REPLY_ARG_NOSRCCHECK 1

2
include/net/ip6_route.h
View file

@ -116,7 +116,7 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
const struct in6_addr *gwaddr); const struct in6_addr *gwaddr);
void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu, int oif, void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu, int oif,
u32 mark, kuid_t uid); u32 mark);
void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, __be32 mtu); void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, __be32 mtu);
void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark); void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark);
void ip6_redirect_no_header(struct sk_buff *skb, struct net *net, int oif, void ip6_redirect_no_header(struct sk_buff *skb, struct net *net, int oif,

5
include/net/route.h
View file

@ -154,7 +154,7 @@ static inline struct rtable *ip_route_output_ports(struct net *net, struct flowi
flowi4_init_output(fl4, oif, sk ? sk->sk_mark : 0, tos, flowi4_init_output(fl4, oif, sk ? sk->sk_mark : 0, tos,
RT_SCOPE_UNIVERSE, proto, RT_SCOPE_UNIVERSE, proto,
sk ? inet_sk_flowi_flags(sk) : 0, sk ? inet_sk_flowi_flags(sk) : 0,
daddr, saddr, dport, sport, sock_i_uid(sk)); daddr, saddr, dport, sport);
if (sk) if (sk)
security_sk_classify_flow(sk, flowi4_to_flowi(fl4)); security_sk_classify_flow(sk, flowi4_to_flowi(fl4));
return ip_route_output_flow(net, fl4, sk); return ip_route_output_flow(net, fl4, sk);
@ -267,8 +267,7 @@ static inline void ip_route_connect_init(struct flowi4 *fl4, __be32 dst, __be32
flow_flags |= FLOWI_FLAG_ANYSRC; flow_flags |= FLOWI_FLAG_ANYSRC;
flowi4_init_output(fl4, oif, sk->sk_mark, tos, RT_SCOPE_UNIVERSE, flowi4_init_output(fl4, oif, sk->sk_mark, tos, RT_SCOPE_UNIVERSE,
protocol, flow_flags, dst, src, dport, sport, protocol, flow_flags, dst, src, dport, sport);
sock_i_uid(sk));
} }
static inline struct rtable *ip_route_connect(struct flowi4 *fl4, static inline struct rtable *ip_route_connect(struct flowi4 *fl4,

2
include/uapi/linux/fib_rules.h
View file

@ -49,8 +49,6 @@ enum {
FRA_TABLE, /* Extended table id */ FRA_TABLE, /* Extended table id */
FRA_FWMASK, /* mask for netfilter mark */ FRA_FWMASK, /* mask for netfilter mark */
FRA_OIFNAME, FRA_OIFNAME,
FRA_UID_START, /* UID range */
FRA_UID_END,
__FRA_MAX __FRA_MAX
}; };

1
include/uapi/linux/rtnetlink.h
View file

@ -311,7 +311,6 @@ enum rtattr_type_t {
RTA_PREF, RTA_PREF,
RTA_ENCAP_TYPE, RTA_ENCAP_TYPE,
RTA_ENCAP, RTA_ENCAP,
RTA_UID,
__RTA_MAX __RTA_MAX
}; };

53
net/core/fib_rules.c
View file

@ -33,8 +33,6 @@ int fib_default_rule_add(struct fib_rules_ops *ops,
r->table = table; r->table = table;
r->flags = flags; r->flags = flags;
r->fr_net = ops->fro_net; r->fr_net = ops->fro_net;
r->uid_start = INVALID_UID;
r->uid_end = INVALID_UID;
r->suppress_prefixlen = -1; r->suppress_prefixlen = -1;
r->suppress_ifgroup = -1; r->suppress_ifgroup = -1;
@ -174,23 +172,6 @@ void fib_rules_unregister(struct fib_rules_ops *ops)
} }
EXPORT_SYMBOL_GPL(fib_rules_unregister); EXPORT_SYMBOL_GPL(fib_rules_unregister);
static inline kuid_t fib_nl_uid(struct nlattr *nla)
{
return make_kuid(current_user_ns(), nla_get_u32(nla));
}
static int nla_put_uid(struct sk_buff *skb, int idx, kuid_t uid)
{
return nla_put_u32(skb, idx, from_kuid_munged(current_user_ns(), uid));
}
static int fib_uid_range_match(struct flowi *fl, struct fib_rule *rule)
{
return (!uid_valid(rule->uid_start) && !uid_valid(rule->uid_end)) ||
(uid_gte(fl->flowi_uid, rule->uid_start) &&
uid_lte(fl->flowi_uid, rule->uid_end));
}
static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops, static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops,
struct flowi *fl, int flags) struct flowi *fl, int flags)
{ {
@ -208,9 +189,6 @@ static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops,
if (rule->tun_id && (rule->tun_id != fl->flowi_tun_key.tun_id)) if (rule->tun_id && (rule->tun_id != fl->flowi_tun_key.tun_id))
goto out; goto out;
if (!fib_uid_range_match(fl, rule))
goto out;
ret = ops->match(rule, fl, flags); ret = ops->match(rule, fl, flags);
out: out:
return (rule->flags & FIB_RULE_INVERT) ? !ret : ret; return (rule->flags & FIB_RULE_INVERT) ? !ret : ret;
@ -393,19 +371,6 @@ static int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh)
} else if (rule->action == FR_ACT_GOTO) } else if (rule->action == FR_ACT_GOTO)
goto errout_free; goto errout_free;
/* UID start and end must either both be valid or both unspecified. */
rule->uid_start = rule->uid_end = INVALID_UID;
if (tb[FRA_UID_START] || tb[FRA_UID_END]) {
if (tb[FRA_UID_START] && tb[FRA_UID_END]) {
rule->uid_start = fib_nl_uid(tb[FRA_UID_START]);
rule->uid_end = fib_nl_uid(tb[FRA_UID_END]);
}
if (!uid_valid(rule->uid_start) ||
!uid_valid(rule->uid_end) ||
!uid_lte(rule->uid_start, rule->uid_end))
goto errout_free;
}
err = ops->configure(rule, skb, frh, tb); err = ops->configure(rule, skb, frh, tb);
if (err < 0) if (err < 0)
goto errout_free; goto errout_free;
@ -518,14 +483,6 @@ static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh)
(rule->tun_id != nla_get_be64(tb[FRA_TUN_ID]))) (rule->tun_id != nla_get_be64(tb[FRA_TUN_ID])))
continue; continue;
if (tb[FRA_UID_START] &&
!uid_eq(rule->uid_start, fib_nl_uid(tb[FRA_UID_START])))
continue;
if (tb[FRA_UID_END] &&
!uid_eq(rule->uid_end, fib_nl_uid(tb[FRA_UID_END])))
continue;
if (!ops->compare(rule, frh, tb)) if (!ops->compare(rule, frh, tb))
continue; continue;
@ -592,9 +549,7 @@ static inline size_t fib_rule_nlmsg_size(struct fib_rules_ops *ops,
+ nla_total_size(4) /* FRA_SUPPRESS_IFGROUP */ + nla_total_size(4) /* FRA_SUPPRESS_IFGROUP */
+ nla_total_size(4) /* FRA_FWMARK */ + nla_total_size(4) /* FRA_FWMARK */
+ nla_total_size(4) /* FRA_FWMASK */ + nla_total_size(4) /* FRA_FWMASK */
+ nla_total_size(8) /* FRA_TUN_ID */ + nla_total_size(8); /* FRA_TUN_ID */
+ nla_total_size(4) /* FRA_UID_START */
+ nla_total_size(4); /* FRA_UID_END */
if (ops->nlmsg_payload) if (ops->nlmsg_payload)
payload += ops->nlmsg_payload(rule); payload += ops->nlmsg_payload(rule);
@ -652,11 +607,7 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
(rule->target && (rule->target &&
nla_put_u32(skb, FRA_GOTO, rule->target)) || nla_put_u32(skb, FRA_GOTO, rule->target)) ||
(rule->tun_id && (rule->tun_id &&
nla_put_be64(skb, FRA_TUN_ID, rule->tun_id)) || nla_put_be64(skb, FRA_TUN_ID, rule->tun_id)))
(uid_valid(rule->uid_start) &&
nla_put_uid(skb, FRA_UID_START, rule->uid_start)) ||
(uid_valid(rule->uid_end) &&
nla_put_uid(skb, FRA_UID_END, rule->uid_end)))
goto nla_put_failure; goto nla_put_failure;
if (rule->suppress_ifgroup != -1) { if (rule->suppress_ifgroup != -1) {

1
net/ipv4/fib_frontend.c
View file

@ -627,7 +627,6 @@ const struct nla_policy rtm_ipv4_policy[RTA_MAX + 1] = {
[RTA_FLOW] = { .type = NLA_U32 }, [RTA_FLOW] = { .type = NLA_U32 },
[RTA_ENCAP_TYPE] = { .type = NLA_U16 }, [RTA_ENCAP_TYPE] = { .type = NLA_U16 },
[RTA_ENCAP] = { .type = NLA_NESTED }, [RTA_ENCAP] = { .type = NLA_NESTED },
[RTA_UID] = { .type = NLA_U32 },
}; };
static int rtm_to_fib_config(struct net *net, struct sk_buff *skb, static int rtm_to_fib_config(struct net *net, struct sk_buff *skb,

4
net/ipv4/inet_connection_sock.c
View file

@ -420,7 +420,7 @@ struct dst_entry *inet_csk_route_req(const struct sock *sk,
sk->sk_protocol, inet_sk_flowi_flags(sk), sk->sk_protocol, inet_sk_flowi_flags(sk),
(opt && opt->opt.srr) ? opt->opt.faddr : ireq->ir_rmt_addr, (opt && opt->opt.srr) ? opt->opt.faddr : ireq->ir_rmt_addr,
ireq->ir_loc_addr, ireq->ir_rmt_port, ireq->ir_loc_addr, ireq->ir_rmt_port,
htons(ireq->ir_num), sock_i_uid(sk)); htons(ireq->ir_num));
security_req_classify_flow(req, flowi4_to_flowi(fl4)); security_req_classify_flow(req, flowi4_to_flowi(fl4));
rt = ip_route_output_flow(net, fl4, sk); rt = ip_route_output_flow(net, fl4, sk);
if (IS_ERR(rt)) if (IS_ERR(rt))
@ -457,7 +457,7 @@ struct dst_entry *inet_csk_route_child_sock(const struct sock *sk,
sk->sk_protocol, inet_sk_flowi_flags(sk), sk->sk_protocol, inet_sk_flowi_flags(sk),
(opt && opt->opt.srr) ? opt->opt.faddr : ireq->ir_rmt_addr, (opt && opt->opt.srr) ? opt->opt.faddr : ireq->ir_rmt_addr,
ireq->ir_loc_addr, ireq->ir_rmt_port, ireq->ir_loc_addr, ireq->ir_rmt_port,
htons(ireq->ir_num), sock_i_uid(sk)); htons(ireq->ir_num));
security_req_classify_flow(req, flowi4_to_flowi(fl4)); security_req_classify_flow(req, flowi4_to_flowi(fl4));
rt = ip_route_output_flow(net, fl4, sk); rt = ip_route_output_flow(net, fl4, sk);
if (IS_ERR(rt)) if (IS_ERR(rt))

3
net/ipv4/ip_output.c
View file

@ -1580,8 +1580,7 @@ void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb,
RT_SCOPE_UNIVERSE, ip_hdr(skb)->protocol, RT_SCOPE_UNIVERSE, ip_hdr(skb)->protocol,
ip_reply_arg_flowi_flags(arg), ip_reply_arg_flowi_flags(arg),
daddr, saddr, daddr, saddr,
tcp_hdr(skb)->source, tcp_hdr(skb)->dest, tcp_hdr(skb)->source, tcp_hdr(skb)->dest);
arg->uid);
security_skb_classify_flow(skb, flowi4_to_flowi(&fl4)); security_skb_classify_flow(skb, flowi4_to_flowi(&fl4));
rt = ip_route_output_key(net, &fl4); rt = ip_route_output_key(net, &fl4);
if (IS_ERR(rt)) if (IS_ERR(rt))

3
net/ipv4/ping.c
View file

@ -795,8 +795,7 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos, flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos,
RT_SCOPE_UNIVERSE, sk->sk_protocol, RT_SCOPE_UNIVERSE, sk->sk_protocol,
inet_sk_flowi_flags(sk), faddr, saddr, 0, 0, inet_sk_flowi_flags(sk), faddr, saddr, 0, 0);
sock_i_uid(sk));
security_sk_classify_flow(sk, flowi4_to_flowi(&fl4)); security_sk_classify_flow(sk, flowi4_to_flowi(&fl4));
rt = ip_route_output_flow(net, &fl4, sk); rt = ip_route_output_flow(net, &fl4, sk);

3
net/ipv4/raw.c
View file

@ -601,8 +601,7 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol, inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
inet_sk_flowi_flags(sk) | inet_sk_flowi_flags(sk) |
(inet->hdrincl ? FLOWI_FLAG_KNOWN_NH : 0), (inet->hdrincl ? FLOWI_FLAG_KNOWN_NH : 0),
daddr, saddr, 0, 0, daddr, saddr, 0, 0);
sock_i_uid(sk));
if (!saddr && ipc.oif) { if (!saddr && ipc.oif) {
err = l3mdev_get_saddr(net, ipc.oif, &fl4); err = l3mdev_get_saddr(net, ipc.oif, &fl4);

25
net/ipv4/route.c
View file

@ -501,7 +501,7 @@ void __ip_select_ident(struct net *net, struct iphdr *iph, int segs)
} }
EXPORT_SYMBOL(__ip_select_ident); EXPORT_SYMBOL(__ip_select_ident);
static void __build_flow_key(struct flowi4 *fl4, struct sock *sk, static void __build_flow_key(struct flowi4 *fl4, const struct sock *sk,
const struct iphdr *iph, const struct iphdr *iph,
int oif, u8 tos, int oif, u8 tos,
u8 prot, u32 mark, int flow_flags) u8 prot, u32 mark, int flow_flags)
@ -517,12 +517,11 @@ static void __build_flow_key(struct flowi4 *fl4, struct sock *sk,
flowi4_init_output(fl4, oif, mark, tos, flowi4_init_output(fl4, oif, mark, tos,
RT_SCOPE_UNIVERSE, prot, RT_SCOPE_UNIVERSE, prot,
flow_flags, flow_flags,
iph->daddr, iph->saddr, 0, 0, iph->daddr, iph->saddr, 0, 0);
sock_i_uid(sk));
} }
static void build_skb_flow_key(struct flowi4 *fl4, const struct sk_buff *skb, static void build_skb_flow_key(struct flowi4 *fl4, const struct sk_buff *skb,
struct sock *sk) const struct sock *sk)
{ {
const struct iphdr *iph = ip_hdr(skb); const struct iphdr *iph = ip_hdr(skb);
int oif = skb->dev->ifindex; int oif = skb->dev->ifindex;
@ -533,7 +532,7 @@ static void build_skb_flow_key(struct flowi4 *fl4, const struct sk_buff *skb,
__build_flow_key(fl4, sk, iph, oif, tos, prot, mark, 0); __build_flow_key(fl4, sk, iph, oif, tos, prot, mark, 0);
} }
static void build_sk_flow_key(struct flowi4 *fl4, struct sock *sk) static void build_sk_flow_key(struct flowi4 *fl4, const struct sock *sk)
{ {
const struct inet_sock *inet = inet_sk(sk); const struct inet_sock *inet = inet_sk(sk);
const struct ip_options_rcu *inet_opt; const struct ip_options_rcu *inet_opt;
@ -547,12 +546,11 @@ static void build_sk_flow_key(struct flowi4 *fl4, struct sock *sk)
RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE, RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol, inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
inet_sk_flowi_flags(sk), inet_sk_flowi_flags(sk),
daddr, inet->inet_saddr, 0, 0, daddr, inet->inet_saddr, 0, 0);
sock_i_uid(sk));
rcu_read_unlock(); rcu_read_unlock();
} }
static void ip_rt_build_flow_key(struct flowi4 *fl4, struct sock *sk, static void ip_rt_build_flow_key(struct flowi4 *fl4, const struct sock *sk,
const struct sk_buff *skb) const struct sk_buff *skb)
{ {
if (skb) if (skb)
@ -2488,11 +2486,6 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src, u32 table_id,
nla_put_u32(skb, RTA_MARK, fl4->flowi4_mark)) nla_put_u32(skb, RTA_MARK, fl4->flowi4_mark))
goto nla_put_failure; goto nla_put_failure;
if (!uid_eq(fl4->flowi4_uid, INVALID_UID) &&
nla_put_u32(skb, RTA_UID,
from_kuid_munged(current_user_ns(), fl4->flowi4_uid)))
goto nla_put_failure;
error = rt->dst.error; error = rt->dst.error;
if (rt_is_input_route(rt)) { if (rt_is_input_route(rt)) {
@ -2545,7 +2538,6 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh)
int mark; int mark;
struct sk_buff *skb; struct sk_buff *skb;
u32 table_id = RT_TABLE_MAIN; u32 table_id = RT_TABLE_MAIN;
kuid_t uid;
err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv4_policy); err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv4_policy);
if (err < 0) if (err < 0)
@ -2573,10 +2565,6 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh)
dst = tb[RTA_DST] ? nla_get_in_addr(tb[RTA_DST]) : 0; dst = tb[RTA_DST] ? nla_get_in_addr(tb[RTA_DST]) : 0;
iif = tb[RTA_IIF] ? nla_get_u32(tb[RTA_IIF]) : 0; iif = tb[RTA_IIF] ? nla_get_u32(tb[RTA_IIF]) : 0;
mark = tb[RTA_MARK] ? nla_get_u32(tb[RTA_MARK]) : 0; mark = tb[RTA_MARK] ? nla_get_u32(tb[RTA_MARK]) : 0;
if (tb[RTA_UID])
uid = make_kuid(current_user_ns(), nla_get_u32(tb[RTA_UID]));
else
uid = (iif ? INVALID_UID : current_uid());
memset(&fl4, 0, sizeof(fl4)); memset(&fl4, 0, sizeof(fl4));
fl4.daddr = dst; fl4.daddr = dst;
@ -2584,7 +2572,6 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh)
fl4.flowi4_tos = rtm->rtm_tos; fl4.flowi4_tos = rtm->rtm_tos;
fl4.flowi4_oif = tb[RTA_OIF] ? nla_get_u32(tb[RTA_OIF]) : 0; fl4.flowi4_oif = tb[RTA_OIF] ? nla_get_u32(tb[RTA_OIF]) : 0;
fl4.flowi4_mark = mark; fl4.flowi4_mark = mark;
fl4.flowi4_uid = uid;
if (netif_index_is_l3_master(net, fl4.flowi4_oif)) if (netif_index_is_l3_master(net, fl4.flowi4_oif))
fl4.flowi4_flags = FLOWI_FLAG_L3MDEV_SRC | FLOWI_FLAG_SKIP_NH_OIF; fl4.flowi4_flags = FLOWI_FLAG_L3MDEV_SRC | FLOWI_FLAG_SKIP_NH_OIF;

5
net/ipv4/syncookies.c
View file

@ -374,9 +374,8 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
flowi4_init_output(&fl4, sk->sk_bound_dev_if, ireq->ir_mark, flowi4_init_output(&fl4, sk->sk_bound_dev_if, ireq->ir_mark,
RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE, IPPROTO_TCP, RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE, IPPROTO_TCP,
inet_sk_flowi_flags(sk), inet_sk_flowi_flags(sk),
(opt && opt->srr) ? opt->faddr : ireq->ir_rmt_addr, opt->srr ? opt->faddr : ireq->ir_rmt_addr,
ireq->ir_loc_addr, th->source, th->dest, ireq->ir_loc_addr, th->source, th->dest);
sock_i_uid(sk));
security_req_classify_flow(req, flowi4_to_flowi(&fl4)); security_req_classify_flow(req, flowi4_to_flowi(&fl4));
rt = ip_route_output_key(sock_net(sk), &fl4); rt = ip_route_output_key(sock_net(sk), &fl4);
if (IS_ERR(rt)) { if (IS_ERR(rt)) {

3
net/ipv4/udp.c
View file

@ -1025,8 +1025,7 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
flowi4_init_output(fl4, ipc.oif, sk->sk_mark, tos, flowi4_init_output(fl4, ipc.oif, sk->sk_mark, tos,
RT_SCOPE_UNIVERSE, sk->sk_protocol, RT_SCOPE_UNIVERSE, sk->sk_protocol,
flow_flags, flow_flags,
faddr, saddr, dport, inet->inet_sport, faddr, saddr, dport, inet->inet_sport);
sock_i_uid(sk));
if (!saddr && ipc.oif) { if (!saddr && ipc.oif) {
err = l3mdev_get_saddr(net, ipc.oif, fl4); err = l3mdev_get_saddr(net, ipc.oif, fl4);

1
net/ipv6/af_inet6.c
View file

@ -678,7 +678,6 @@ int inet6_sk_rebuild_header(struct sock *sk)
fl6.flowi6_mark = sk->sk_mark; fl6.flowi6_mark = sk->sk_mark;
fl6.fl6_dport = inet->inet_dport; fl6.fl6_dport = inet->inet_dport;
fl6.fl6_sport = inet->inet_sport; fl6.fl6_sport = inet->inet_sport;
fl6.flowi6_uid = sock_i_uid(sk);
security_sk_classify_flow(sk, flowi6_to_flowi(&fl6)); security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
rcu_read_lock(); rcu_read_lock();

2
net/ipv6/ah6.c
View file

@ -664,7 +664,7 @@ static int ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
if (type == NDISC_REDIRECT) if (type == NDISC_REDIRECT)
ip6_redirect(skb, net, skb->dev->ifindex, 0); ip6_redirect(skb, net, skb->dev->ifindex, 0);
else else
ip6_update_pmtu(skb, net, info, 0, 0, INVALID_UID); ip6_update_pmtu(skb, net, info, 0, 0);
xfrm_state_put(x); xfrm_state_put(x);
return 0; return 0;

1
net/ipv6/datagram.c
View file

@ -161,7 +161,6 @@ ipv4_connected:
fl6.flowi6_mark = sk->sk_mark; fl6.flowi6_mark = sk->sk_mark;
fl6.fl6_dport = inet->inet_dport; fl6.fl6_dport = inet->inet_dport;
fl6.fl6_sport = inet->inet_sport; fl6.fl6_sport = inet->inet_sport;
fl6.flowi6_uid = sock_i_uid(sk);
if (!fl6.flowi6_oif) if (!fl6.flowi6_oif)
fl6.flowi6_oif = np->sticky_pktinfo.ipi6_ifindex; fl6.flowi6_oif = np->sticky_pktinfo.ipi6_ifindex;

2
net/ipv6/esp6.c
View file

@ -476,7 +476,7 @@ static int esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
if (type == NDISC_REDIRECT) if (type == NDISC_REDIRECT)
ip6_redirect(skb, net, skb->dev->ifindex, 0); ip6_redirect(skb, net, skb->dev->ifindex, 0);
else else
ip6_update_pmtu(skb, net, info, 0, 0, INVALID_UID); ip6_update_pmtu(skb, net, info, 0, 0);
xfrm_state_put(x); xfrm_state_put(x);
return 0; return 0;

2
net/ipv6/icmp.c
View file

@ -92,7 +92,7 @@ static void icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
struct net *net = dev_net(skb->dev); struct net *net = dev_net(skb->dev);
if (type == ICMPV6_PKT_TOOBIG) if (type == ICMPV6_PKT_TOOBIG)
ip6_update_pmtu(skb, net, info, 0, 0, INVALID_UID); ip6_update_pmtu(skb, net, info, 0, 0);
else if (type == NDISC_REDIRECT) else if (type == NDISC_REDIRECT)
ip6_redirect(skb, net, skb->dev->ifindex, 0); ip6_redirect(skb, net, skb->dev->ifindex, 0);

2
net/ipv6/inet6_connection_sock.c
View file

@ -86,7 +86,6 @@ struct dst_entry *inet6_csk_route_req(const struct sock *sk,
fl6->flowi6_mark = ireq->ir_mark; fl6->flowi6_mark = ireq->ir_mark;
fl6->fl6_dport = ireq->ir_rmt_port; fl6->fl6_dport = ireq->ir_rmt_port;
fl6->fl6_sport = htons(ireq->ir_num); fl6->fl6_sport = htons(ireq->ir_num);
fl6->flowi6_uid = sock_i_uid(sk);
security_req_classify_flow(req, flowi6_to_flowi(fl6)); security_req_classify_flow(req, flowi6_to_flowi(fl6));
dst = ip6_dst_lookup_flow(sk, fl6, final_p); dst = ip6_dst_lookup_flow(sk, fl6, final_p);
@ -135,7 +134,6 @@ static struct dst_entry *inet6_csk_route_socket(struct sock *sk,
fl6->flowi6_mark = sk->sk_mark; fl6->flowi6_mark = sk->sk_mark;
fl6->fl6_sport = inet->inet_sport; fl6->fl6_sport = inet->inet_sport;
fl6->fl6_dport = inet->inet_dport; fl6->fl6_dport = inet->inet_dport;
fl6->flowi6_uid = sock_i_uid(sk);
security_sk_classify_flow(sk, flowi6_to_flowi(fl6)); security_sk_classify_flow(sk, flowi6_to_flowi(fl6));
rcu_read_lock(); rcu_read_lock();

2
net/ipv6/ipcomp6.c
View file

@ -76,7 +76,7 @@ static int ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
if (type == NDISC_REDIRECT) if (type == NDISC_REDIRECT)
ip6_redirect(skb, net, skb->dev->ifindex, 0); ip6_redirect(skb, net, skb->dev->ifindex, 0);
else else
ip6_update_pmtu(skb, net, info, 0, 0, INVALID_UID); ip6_update_pmtu(skb, net, info, 0, 0);
xfrm_state_put(x); xfrm_state_put(x);
return 0; return 0;

1
net/ipv6/ping.c
View file

@ -141,7 +141,6 @@ int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
fl6.daddr = *daddr; fl6.daddr = *daddr;
fl6.flowi6_oif = oif; fl6.flowi6_oif = oif;
fl6.flowi6_mark = sk->sk_mark; fl6.flowi6_mark = sk->sk_mark;
fl6.flowi6_uid = sock_i_uid(sk);
fl6.fl6_icmp_type = user_icmph.icmp6_type; fl6.fl6_icmp_type = user_icmph.icmp6_type;
fl6.fl6_icmp_code = user_icmph.icmp6_code; fl6.fl6_icmp_code = user_icmph.icmp6_code;
security_sk_classify_flow(sk, flowi6_to_flowi(&fl6)); security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));

1
net/ipv6/raw.c
View file

@ -768,7 +768,6 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
memset(&fl6, 0, sizeof(fl6)); memset(&fl6, 0, sizeof(fl6));
fl6.flowi6_mark = sk->sk_mark; fl6.flowi6_mark = sk->sk_mark;
fl6.flowi6_uid = sock_i_uid(sk);
if (sin6) { if (sin6) {
if (addr_len < SIN6_LEN_RFC2133) if (addr_len < SIN6_LEN_RFC2133)

11
net/ipv6/route.c
View file

@ -1382,7 +1382,7 @@ static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
} }
void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu, void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu,
int oif, u32 mark, kuid_t uid) int oif, u32 mark)
{ {
const struct ipv6hdr *iph = (struct ipv6hdr *) skb->data; const struct ipv6hdr *iph = (struct ipv6hdr *) skb->data;
struct dst_entry *dst; struct dst_entry *dst;
@ -1394,7 +1394,6 @@ void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu,
fl6.daddr = iph->daddr; fl6.daddr = iph->daddr;
fl6.saddr = iph->saddr; fl6.saddr = iph->saddr;
fl6.flowlabel = ip6_flowinfo(iph); fl6.flowlabel = ip6_flowinfo(iph);
fl6.flowi6_uid = uid;
dst = ip6_route_output(net, NULL, &fl6); dst = ip6_route_output(net, NULL, &fl6);
if (!dst->error) if (!dst->error)
@ -1406,7 +1405,7 @@ EXPORT_SYMBOL_GPL(ip6_update_pmtu);
void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, __be32 mtu) void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, __be32 mtu)
{ {
ip6_update_pmtu(skb, sock_net(sk), mtu, ip6_update_pmtu(skb, sock_net(sk), mtu,
sk->sk_bound_dev_if, sk->sk_mark, sock_i_uid(sk)); sk->sk_bound_dev_if, sk->sk_mark);
} }
EXPORT_SYMBOL_GPL(ip6_sk_update_pmtu); EXPORT_SYMBOL_GPL(ip6_sk_update_pmtu);
@ -2687,7 +2686,6 @@ static const struct nla_policy rtm_ipv6_policy[RTA_MAX+1] = {
[RTA_PREF] = { .type = NLA_U8 }, [RTA_PREF] = { .type = NLA_U8 },
[RTA_ENCAP_TYPE] = { .type = NLA_U16 }, [RTA_ENCAP_TYPE] = { .type = NLA_U16 },
[RTA_ENCAP] = { .type = NLA_NESTED }, [RTA_ENCAP] = { .type = NLA_NESTED },
[RTA_UID] = { .type = NLA_U32 },
}; };
static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh, static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
@ -3251,11 +3249,6 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh)
if (tb[RTA_MARK]) if (tb[RTA_MARK])
fl6.flowi6_mark = nla_get_u32(tb[RTA_MARK]); fl6.flowi6_mark = nla_get_u32(tb[RTA_MARK]);
if (tb[RTA_UID])
fl6.flowi6_uid = make_kuid(current_user_ns(),
nla_get_u32(tb[RTA_UID]));
else
fl6.flowi6_uid = iif ? INVALID_UID : current_uid();
if (iif) { if (iif) {
struct net_device *dev; struct net_device *dev;
int flags = 0; int flags = 0;

1
net/ipv6/syncookies.c
View file

@ -228,7 +228,6 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
fl6.flowi6_mark = ireq->ir_mark; fl6.flowi6_mark = ireq->ir_mark;
fl6.fl6_dport = ireq->ir_rmt_port; fl6.fl6_dport = ireq->ir_rmt_port;
fl6.fl6_sport = inet_sk(sk)->inet_sport; fl6.fl6_sport = inet_sk(sk)->inet_sport;
fl6.flowi6_uid = sock_i_uid(sk);
security_req_classify_flow(req, flowi6_to_flowi(&fl6)); security_req_classify_flow(req, flowi6_to_flowi(&fl6));
dst = ip6_dst_lookup_flow(sk, &fl6, final_p); dst = ip6_dst_lookup_flow(sk, &fl6, final_p);

1
net/ipv6/tcp_ipv6.c
View file

@ -234,7 +234,6 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
fl6.flowi6_mark = sk->sk_mark; fl6.flowi6_mark = sk->sk_mark;
fl6.fl6_dport = usin->sin6_port; fl6.fl6_dport = usin->sin6_port;
fl6.fl6_sport = inet->inet_sport; fl6.fl6_sport = inet->inet_sport;
fl6.flowi6_uid = sock_i_uid(sk);
opt = rcu_dereference_protected(np->opt, sock_owned_by_user(sk)); opt = rcu_dereference_protected(np->opt, sock_owned_by_user(sk));
final_p = fl6_update_dst(&fl6, opt, &final); final_p = fl6_update_dst(&fl6, opt, &final);

1
net/ipv6/udp.c
View file

@ -1244,7 +1244,6 @@ do_udp_sendmsg:
fl6.flowi6_oif = np->sticky_pktinfo.ipi6_ifindex; fl6.flowi6_oif = np->sticky_pktinfo.ipi6_ifindex;
fl6.flowi6_mark = sk->sk_mark; fl6.flowi6_mark = sk->sk_mark;
fl6.flowi6_uid = sock_i_uid(sk);
if (msg->msg_controllen) { if (msg->msg_controllen) {
opt = &opt_space; opt = &opt_space;