linux.git/net/netlink, branch v3.6-rc4

af_netlink: force credentials passing [CVE-2012-3520]

2012-08-21T21:53:01+00:00

Pablo Neira Ayuso discovered that avahi and
potentially NetworkManager accept spoofed Netlink messages because of a
kernel bug.  The kernel passes all-zero SCM_CREDENTIALS ancillary data
to the receiver if the sender did not provide such data, instead of not
including any such data at all or including the correct data from the
peer (as it is the case with AF_UNIX).

This bug was introduced in commit 16e572626961
(af_unix: dont send SCM_CREDENTIALS by default)

This patch forces passing credentials for netlink, as
before the regression.

Another fix would be to not add SCM_CREDENTIALS in
netlink messages if not provided by the sender, but it
might break some programs.

With help from Florian Weimer & Petr Matousek

This issue is designated as CVE-2012-3520

Signed-off-by: Eric Dumazet 
Cc: Petr Matousek 
Cc: Florian Weimer 
Cc: Pablo Neira Ayuso 
Signed-off-by: David S. Miller

genetlink: define lockdep_genl_is_held() when CONFIG_LOCKDEP

2012-07-24T07:01:30+00:00

lockdep_is_held() is defined when CONFIG_LOCKDEP, not CONFIG_PROVE_LOCKING.

Cc: "David S. Miller" 
Cc: Jesse Gross 
Signed-off-by: WANG Cong 
Signed-off-by: David S. Miller

net: Fix (nearly-)kernel-doc comments for various functions

2012-07-11T06:13:45+00:00

Fix incorrect start markers, wrapped summary lines, missing section
breaks, incorrect separators, and some name mismatches.

Signed-off-by: Ben Hutchings 
Signed-off-by: David S. Miller

netlink: add nlk->netlink_bind hook for module auto-loading

2012-06-29T23:46:06+00:00

This patch adds a hook in the binding path of netlink.

This is used by ctnetlink to allow module autoloading for the case
in which one user executes:

 conntrack -E

So far, this resulted in nfnetlink loaded, but not
nf_conntrack_netlink.

I have received in the past many complains on this behaviour.

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: David S. Miller

netlink: add netlink_kernel_cfg parameter to netlink_kernel_create

2012-06-29T23:46:02+00:00

This patch adds the following structure:

struct netlink_kernel_cfg {
        unsigned int    groups;
        void            (*input)(struct sk_buff *skb);
        struct mutex    *cb_mutex;
};

That can be passed to netlink_kernel_create to set optional configurations
for netlink kernel sockets.

I've populated this structure by looking for NULL and zero parameters at the
existing code. The remaining parameters that always need to be set are still
left in the original interface.

That includes optional parameters for the netlink socket creation. This allows
easy extensibility of this interface in the future.

This patch also adapts all callers to use this new interface.

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: David S. Miller

genetlink: Build a generic netlink family module alias

2012-05-30T02:33:56+00:00

Generic netlink searches for -type- formatted aliases when requesting a module to
fulfill a protocol request (i.e. net-pf-16-proto-16-type-, where x is a type
value).  However generic netlink protocols have no well defined type numbers,
they have string names.  Modify genl_ctrl_getfamily to request an alias in the
format net-pf-16-proto-16-family- instead, where x is a generic string, and
add a macro that builds on the previously added MODULE_ALIAS_NET_PF_PROTO_NAME
macro to allow modules to specifify those generic strings.

Note, l2tp previously hacked together an net-pf-16-proto-16-type-l2tp alias
using the MODULE_ALIAS macro, with these updates we can convert that to use the
PROTO_NAME macro.

Signed-off-by: Neil Horman 
CC: Eric Dumazet 
CC: James Chapman 
CC: David Miller 
Signed-off-by: David S. Miller

af_netlink: drop_monitor/dropwatch friendly

2012-04-24T04:35:14+00:00

Need to consume_skb() instead of kfree_skb() in netlink_dump() and
netlink_unicast_kernel() to avoid false dropwatch positives.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

af_netlink: cleanups

2012-04-24T04:35:14+00:00

netlink_destroy_callback() move to avoid forward reference

CodingStyle cleanups

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

netlink: dont drop packet but consume it

2012-04-19T18:23:55+00:00

When we need to clone skb, we dont drop a packet.
Call consume_skb() to not confuse dropwatch.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2012-04-10T18:30:45+00:00