AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2024-12-15 12:46:51 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity
5b6c65f41c
linux_dsm_epyc7002/net/netlink
History
Kevin Cernekee 93c647643b netlink: Add netns check on taps 
Currently, a nlmon link inside a child namespace can observe systemwide
netlink activity.  Filter the traffic so that nlmon can only sniff
netlink messages from its own netns.

Test case:

    vpnns -- bash -c "ip link add nlmon0 type nlmon; \
                      ip link set nlmon0 up; \
                      tcpdump -i nlmon0 -q -w /tmp/nlmon.pcap -U" &
    sudo ip xfrm state add src 10.1.1.1 dst 10.1.1.2 proto esp \
        spi 0x1 mode transport \
        auth sha1 0x6162633132330000000000000000000000000000 \
        enc aes 0x00000000000000000000000000000000
    grep --binary abc123 /tmp/nlmon.pcap

Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-11 11:58:18 -05:00
..
af_netlink.c netlink: Add netns check on taps 2017-12-11 11:58:18 -05:00
af_netlink.h af_netlink: ensure that NLMSG_DONE never fails in dumps 2017-11-13 10:17:13 +09:00
diag.c netlink/diag: report flags for netlink sockets 2017-04-05 07:13:56 -07:00
genetlink.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Kconfig netlink: remove mmapped netlink support 2016-02-18 11:42:18 -05:00
Makefile netlink: Diag core and basic socket info dumping (v2) 2013-03-21 12:38:03 -04:00