Re: [PATCH net-next 5/6] netlink: add mask validation

2020-10-06 Thread Johannes Berg
On Tue, 2020-10-06 at 08:37 +0200, Johannes Berg wrote: > On Mon, 2020-10-05 at 15:21 -0700, Jakub Kicinski wrote: > > > > > Nice, easy & useful, maybe I'll code it up tomorrow. > > > > > > OK I thought about it a bit more and looked at the code, and it's not > > > actually possible to do easil

Re: [PATCH net-next 5/6] netlink: add mask validation

2020-10-05 Thread Johannes Berg
On Mon, 2020-10-05 at 15:21 -0700, Jakub Kicinski wrote: > > > Nice, easy & useful, maybe I'll code it up tomorrow. > > > > OK I thought about it a bit more and looked at the code, and it's not > > actually possible to do easily right now, because we can't actually > > point to the bad attribut

Re: [PATCH net-next 5/6] netlink: add mask validation

2020-10-05 Thread Jakub Kicinski
On Mon, 05 Oct 2020 22:12:25 +0200 Johannes Berg wrote: > On Mon, 2020-10-05 at 21:53 +0200, Johannes Berg wrote: > > Hm. I like that idea. > > > > If we have NLMSGERR_ATTR_OFFS we could accompany that with the sub- > > policy for that particular attribute, something like > > > > [NLMSGERR_ATTR_P

Re: [PATCH net-next 5/6] netlink: add mask validation

2020-10-05 Thread Johannes Berg
On Mon, 2020-10-05 at 21:53 +0200, Johannes Berg wrote: > On Mon, 2020-10-05 at 12:40 -0700, Jakub Kicinski wrote: > > > > I would totally support doing that here in the general validation code, > > > but (again) don't really think NLMSGERR_ATTR_COOKIE is an appropriate > > > attribute for it. > >

Re: [PATCH net-next 5/6] netlink: add mask validation

2020-10-05 Thread Johannes Berg
On Mon, 2020-10-05 at 12:40 -0700, Jakub Kicinski wrote: > > I would totally support doing that here in the general validation code, > > but (again) don't really think NLMSGERR_ATTR_COOKIE is an appropriate > > attribute for it. > > Hm. Perhaps we can do a partial policy dump into the extack? Hm

Re: [PATCH net-next 5/6] netlink: add mask validation

2020-10-05 Thread Michal Kubecek
On Mon, Oct 05, 2020 at 12:34:14PM -0700, Jakub Kicinski wrote: > On Mon, 05 Oct 2020 21:25:57 +0200 Johannes Berg wrote: > > On Mon, 2020-10-05 at 12:22 -0700, Jakub Kicinski wrote: > > > > > > > + if (value & ~(u64)pt->mask) { > > > > > + NL_SET_ERR_MSG_ATTR(extack, nla, "reserve

Re: [PATCH net-next 5/6] netlink: add mask validation

2020-10-05 Thread Jakub Kicinski
On Mon, 05 Oct 2020 21:31:13 +0200 Johannes Berg wrote: > On Mon, 2020-10-05 at 21:28 +0200, Michal Kubecek wrote: > > > > > + if (value & ~(u64)pt->mask) { > > > > + NL_SET_ERR_MSG_ATTR(extack, nla, "reserved bit set"); > > > > + return -EINVAL; > > > > > > Yo

Re: [PATCH net-next 5/6] netlink: add mask validation

2020-10-05 Thread Johannes Berg
On Mon, 2020-10-05 at 12:34 -0700, Jakub Kicinski wrote: > > > My thinking is that there are no known uses of the cookie, it'd only Ahh. I completely misinterpreted the word "uses" here - you meant, I think (now), "uses of the cookie in the way that it was done in ethtool before". I read over thi

Re: [PATCH net-next 5/6] netlink: add mask validation

2020-10-05 Thread Jakub Kicinski
On Mon, 05 Oct 2020 21:25:57 +0200 Johannes Berg wrote: > On Mon, 2020-10-05 at 12:22 -0700, Jakub Kicinski wrote: > > > > > + if (value & ~(u64)pt->mask) { > > > > + NL_SET_ERR_MSG_ATTR(extack, nla, "reserved bit set"); > > > > + return -EINVAL; > > > > > >

Re: [PATCH net-next 5/6] netlink: add mask validation

2020-10-05 Thread Johannes Berg
On Mon, 2020-10-05 at 21:28 +0200, Michal Kubecek wrote: > > > + if (value & ~(u64)pt->mask) { > > > + NL_SET_ERR_MSG_ATTR(extack, nla, "reserved bit set"); > > > + return -EINVAL; > > > > You had an export of the valid bits there in ethtool, using the cookie. > > Just pointing ou

Re: [PATCH net-next 5/6] netlink: add mask validation

2020-10-05 Thread Michal Kubecek
On Mon, Oct 05, 2020 at 09:05:23PM +0200, Johannes Berg wrote: > On Mon, 2020-10-05 at 08:57 -0700, Jakub Kicinski wrote: > > > +static int nla_validate_mask(const struct nla_policy *pt, > > +const struct nlattr *nla, > > +struct netlink_ext_ack *ext

Re: [PATCH net-next 5/6] netlink: add mask validation

2020-10-05 Thread Johannes Berg
On Mon, 2020-10-05 at 12:22 -0700, Jakub Kicinski wrote: > > > + if (value & ~(u64)pt->mask) { > > > + NL_SET_ERR_MSG_ATTR(extack, nla, "reserved bit set"); > > > + return -EINVAL; > > > > You had an export of the valid bits there in ethtool, using the cookie. > > Just pointing

Re: [PATCH net-next 5/6] netlink: add mask validation

2020-10-05 Thread Jakub Kicinski
On Mon, 05 Oct 2020 21:05:23 +0200 Johannes Berg wrote: > On Mon, 2020-10-05 at 08:57 -0700, Jakub Kicinski wrote: > > We don't have good validation policy for existing unsigned int attrs > > which serve as flags (for new ones we could use NLA_BITFIELD32). > > With increased use of policy dumping h

Re: [PATCH net-next 5/6] netlink: add mask validation

2020-10-05 Thread Johannes Berg
On Mon, 2020-10-05 at 08:57 -0700, Jakub Kicinski wrote: > We don't have good validation policy for existing unsigned int attrs > which serve as flags (for new ones we could use NLA_BITFIELD32). > With increased use of policy dumping having the validation be > expressed as part of the policy is im

[PATCH net-next 5/6] netlink: add mask validation

2020-10-05 Thread Jakub Kicinski
We don't have good validation policy for existing unsigned int attrs which serve as flags (for new ones we could use NLA_BITFIELD32). With increased use of policy dumping having the validation be expressed as part of the policy is important. Add validation policy in form of a mask of supported/vali