nagai/kernel
3
0
Fork 0
forked from mirrors/linux
Code Pull requests Activity

net/ipv4: ping_group_range: allow GID from 2147483648 to 4294967294

Browse source 
With this commit, all the GIDs ("0 4294967294") can be written to the
"net.ipv4.ping_group_range" sysctl.

Note that 4294967295 (0xffffffff) is an invalid GID (see gid_valid() in
include/linux/uidgid.h), and an attempt to register this number will cause
-EINVAL.

Prior to this commit, only up to GID 2147483647 could be covered.
Documentation/networking/ip-sysctl.rst had "0 4294967295" as an example
value, but this example was wrong and causing -EINVAL.

Fixes: c319b4d76b ("net: ipv4: add IPPROTO_ICMP socket kind")
Co-developed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Akihiro Suda 2023-06-01 12:13:05 +09:00 committed by David S. Miller
parent 5a59a58ec2
commit e209fee411
3 changed files with 7 additions and 11 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

4
Documentation/networking/ip-sysctl.rst
View file

@ -1352,8 +1352,8 @@ ping_group_range - 2 INTEGERS
Restrict ICMP_PROTO datagram sockets to users in the group range. Restrict ICMP_PROTO datagram sockets to users in the group range.
The default is "1 0", meaning, that nobody (not even root) may The default is "1 0", meaning, that nobody (not even root) may
create ping sockets. Setting it to "100 100" would grant permissions create ping sockets. Setting it to "100 100" would grant permissions
to the single group. "0 4294967295" would enable it for the world, "100 to the single group. "0 4294967294" would enable it for the world, "100
4294967295" would enable it for the users, but not daemons. 4294967294" would enable it for the users, but not daemons.
tcp_early_demux - BOOLEAN tcp_early_demux - BOOLEAN
Enable early demux for established TCP sockets. Enable early demux for established TCP sockets.

6
include/net/ping.h
View file

@ -16,11 +16,7 @@
#define PING_HTABLE_SIZE 64 #define PING_HTABLE_SIZE 64
#define PING_HTABLE_MASK (PING_HTABLE_SIZE-1) #define PING_HTABLE_MASK (PING_HTABLE_SIZE-1)
/* #define GID_T_MAX (((gid_t)~0U) - 1)
* gid_t is either uint or ushort. We want to pass it to
* proc_dointvec_minmax(), so it must not be larger than MAX_INT
*/
#define GID_T_MAX (((gid_t)~0U) >> 1)
/* Compatibility glue so we can support IPv6 when it's compiled as a module */ /* Compatibility glue so we can support IPv6 when it's compiled as a module */
struct pingv6_ops { struct pingv6_ops {

8
net/ipv4/sysctl_net_ipv4.c
View file

@ -34,8 +34,8 @@ static int ip_ttl_min = 1;
static int ip_ttl_max = 255; static int ip_ttl_max = 255;
static int tcp_syn_retries_min = 1; static int tcp_syn_retries_min = 1;
static int tcp_syn_retries_max = MAX_TCP_SYNCNT; static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
static int ip_ping_group_range_min[] = { 0, 0 }; static unsigned long ip_ping_group_range_min[] = { 0, 0 };
static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX }; static unsigned long ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
static u32 u32_max_div_HZ = UINT_MAX / HZ; static u32 u32_max_div_HZ = UINT_MAX / HZ;
static int one_day_secs = 24 * 3600; static int one_day_secs = 24 * 3600;
static u32 fib_multipath_hash_fields_all_mask __maybe_unused = static u32 fib_multipath_hash_fields_all_mask __maybe_unused =
@ -165,7 +165,7 @@ static int ipv4_ping_group_range(struct ctl_table *table, int write,
{ {
struct user_namespace *user_ns = current_user_ns(); struct user_namespace *user_ns = current_user_ns();
int ret; int ret;
gid_t urange[2]; unsigned long urange[2];
kgid_t low, high; kgid_t low, high;
struct ctl_table tmp = { struct ctl_table tmp = {
.data = &urange, .data = &urange,
@ -178,7 +178,7 @@ static int ipv4_ping_group_range(struct ctl_table *table, int write,
inet_get_ping_group_range_table(table, &low, &high); inet_get_ping_group_range_table(table, &low, &high);
urange[0] = from_kgid_munged(user_ns, low); urange[0] = from_kgid_munged(user_ns, low);
urange[1] = from_kgid_munged(user_ns, high); urange[1] = from_kgid_munged(user_ns, high);
ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); ret = proc_doulongvec_minmax(&tmp, write, buffer, lenp, ppos);
if (write && ret == 0) { if (write && ret == 0) {
low = make_kgid(user_ns, urange[0]); low = make_kgid(user_ns, urange[0]);