Merge tag 'v3.10.90' into update

[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / core / fib_rules.c

diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index d5a9f8ead0d864305110f2ca6f1dc70fca5b84cd..1b10e3639a8fdc2bd9f86199abdaf0fb86e5051a 100644 (file)
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -31,6 +31,8 @@ int fib_default_rule_add(struct fib_rules_ops *ops,
        r->pref = pref;
        r->table = table;
        r->flags = flags;
+       r->uid_start = INVALID_UID;
+       r->uid_end = INVALID_UID;
        r->fr_net = hold_net(ops->fro_net);
 
        /* The lock is not required here, the list in unreacheable
@@ -179,6 +181,23 @@ void fib_rules_unregister(struct fib_rules_ops *ops)
 }
 EXPORT_SYMBOL_GPL(fib_rules_unregister);
 
+static inline kuid_t fib_nl_uid(struct nlattr *nla)
+{
+       return make_kuid(current_user_ns(), nla_get_u32(nla));
+}
+
+static int nla_put_uid(struct sk_buff *skb, int idx, kuid_t uid)
+{
+       return nla_put_u32(skb, idx, from_kuid_munged(current_user_ns(), uid));
+}
+
+static int fib_uid_range_match(struct flowi *fl, struct fib_rule *rule)
+{
+       return (!uid_valid(rule->uid_start) && !uid_valid(rule->uid_end)) ||
+              (uid_gte(fl->flowi_uid, rule->uid_start) &&
+               uid_lte(fl->flowi_uid, rule->uid_end));
+}
+
 static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops,
                          struct flowi *fl, int flags)
 {
@@ -193,6 +212,9 @@ static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops,
        if ((rule->mark ^ fl->flowi_mark) & rule->mark_mask)
                goto out;
 
+       if (!fib_uid_range_match(fl, rule))
+               goto out;
+
        ret = ops->match(rule, fl, flags);
 out:
        return (rule->flags & FIB_RULE_INVERT) ? !ret : ret;
@@ -363,6 +385,19 @@ static int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh)
        } else if (rule->action == FR_ACT_GOTO)
                goto errout_free;
 
+       /* UID start and end must either both be valid or both unspecified. */
+       rule->uid_start = rule->uid_end = INVALID_UID;
+       if (tb[FRA_UID_START] || tb[FRA_UID_END]) {
+               if (tb[FRA_UID_START] && tb[FRA_UID_END]) {
+                       rule->uid_start = fib_nl_uid(tb[FRA_UID_START]);
+                       rule->uid_end = fib_nl_uid(tb[FRA_UID_END]);
+               }
+               if (!uid_valid(rule->uid_start) ||
+                   !uid_valid(rule->uid_end) ||
+                   !uid_lte(rule->uid_start, rule->uid_end))
+               goto errout_free;
+       }
+
        err = ops->configure(rule, skb, frh, tb);
        if (err < 0)
                goto errout_free;
@@ -445,7 +480,8 @@ static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh)
                if (frh->action && (frh->action != rule->action))
                        continue;
 
-               if (frh->table && (frh_get_table(frh, tb) != rule->table))
+               if (frh_get_table(frh, tb) &&
+                   (frh_get_table(frh, tb) != rule->table))
                        continue;
 
                if (tb[FRA_PRIORITY] &&
@@ -468,6 +504,14 @@ static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh)
                    (rule->mark_mask != nla_get_u32(tb[FRA_FWMASK])))
                        continue;
 
+               if (tb[FRA_UID_START] &&
+                   !uid_eq(rule->uid_start, fib_nl_uid(tb[FRA_UID_START])))
+                       continue;
+
+               if (tb[FRA_UID_END] &&
+                   !uid_eq(rule->uid_end, fib_nl_uid(tb[FRA_UID_END])))
+                       continue;
+
                if (!ops->compare(rule, frh, tb))
                        continue;
 
@@ -524,7 +568,9 @@ static inline size_t fib_rule_nlmsg_size(struct fib_rules_ops *ops,
                         + nla_total_size(4) /* FRA_PRIORITY */
                         + nla_total_size(4) /* FRA_TABLE */
                         + nla_total_size(4) /* FRA_FWMARK */
-                        + nla_total_size(4); /* FRA_FWMASK */
+                        + nla_total_size(4) /* FRA_FWMASK */
+                        + nla_total_size(4) /* FRA_UID_START */
+                        + nla_total_size(4); /* FRA_UID_END */
 
        if (ops->nlmsg_payload)
                payload += ops->nlmsg_payload(rule);
@@ -578,7 +624,11 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
            ((rule->mark_mask || rule->mark) &&
             nla_put_u32(skb, FRA_FWMASK, rule->mark_mask)) ||
            (rule->target &&
-            nla_put_u32(skb, FRA_GOTO, rule->target)))
+            nla_put_u32(skb, FRA_GOTO, rule->target)) ||
+           (uid_valid(rule->uid_start) &&
+            nla_put_uid(skb, FRA_UID_START, rule->uid_start)) ||
+           (uid_valid(rule->uid_end) &&
+            nla_put_uid(skb, FRA_UID_END, rule->uid_end)))
                goto nla_put_failure;
        if (ops->fill(rule, skb, frh) < 0)
                goto nla_put_failure;
@@ -595,15 +645,17 @@ static int dump_rules(struct sk_buff *skb, struct netlink_callback *cb,
 {
        int idx = 0;
        struct fib_rule *rule;
+       int err = 0;
 
        rcu_read_lock();
        list_for_each_entry_rcu(rule, &ops->rules_list, list) {
                if (idx < cb->args[1])
                        goto skip;
 
-               if (fib_nl_fill_rule(skb, rule, NETLINK_CB(cb->skb).portid,
-                                    cb->nlh->nlmsg_seq, RTM_NEWRULE,
-                                    NLM_F_MULTI, ops) < 0)
+               err = fib_nl_fill_rule(skb, rule, NETLINK_CB(cb->skb).portid,
+                                      cb->nlh->nlmsg_seq, RTM_NEWRULE,
+                                      NLM_F_MULTI, ops);
+               if (err)
                        break;
 skip:
                idx++;
@@ -612,7 +664,7 @@ skip:
        cb->args[1] = idx;
        rules_ops_put(ops);
 
-       return skb->len;
+       return err;
 }
 
 static int fib_nl_dumprule(struct sk_buff *skb, struct netlink_callback *cb)
@@ -628,7 +680,9 @@ static int fib_nl_dumprule(struct sk_buff *skb, struct netlink_callback *cb)
                if (ops == NULL)
                        return -EAFNOSUPPORT;
 
-               return dump_rules(skb, cb, ops);
+               dump_rules(skb, cb, ops);
+
+               return skb->len;
        }
 
        rcu_read_lock();
@@ -719,6 +773,13 @@ static int fib_rules_event(struct notifier_block *this, unsigned long event,
                        attach_rules(&ops->rules_list, dev);
                break;
 
+       case NETDEV_CHANGENAME:
+               list_for_each_entry(ops, &net->rules_ops, list) {
+                       detach_rules(&ops->rules_list, dev);
+                       attach_rules(&ops->rules_list, dev);
+               }
+               break;
+
        case NETDEV_UNREGISTER:
                list_for_each_entry(ops, &net->rules_ops, list)
                        detach_rules(&ops->rules_list, dev);