Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Maoyi Xie ed267f783c l2tp: send netlink notifications in the tunnel's net namespace ... l2tp_tunnel_notify() and l2tp_session_notify() use genlmsg_multicast_allns(), which delivers to listeners in every network namespace. l2tp is per-namespace, and a tunnel records the namespace it belongs to in tunnel->l2tp_net. Each event concerns one namespace, yet every namespace is told about it. A tunnel event carries the tunnel and peer tunnel ids, plus the socket's addresses with both ports for a UDP tunnel. A session event carries the session and peer session ids, the interface name, plus the L2TP cookies where those are set. A listener needs no privilege for any of this, because l2tp_multicast_group[] carries no flags and genl_bind() asks for no capability. The fix is to send to the tunnel's namespace with genlmsg_multicast_netns(). Commit 134e63756d ("genetlink: make netns aware") added both helpers and drew the line between them. The netns variant is for an object that lives in a namespace. I found this by auditing the tree's six genlmsg_multicast_allns() call sites for objects that live in a network namespace. Only the two l2tp ones do. I reproduced it on net at dd057113ac, in a virtual machine, with no real hardware involved. A process in the initial namespace, running as an ordinary user with an empty capability set, receives the create and delete events of a tunnel. The tunnel was set up inside an unprivileged user and network namespace. tools/testing/selftests/net/l2tp.sh passes before and after. On a container host, any local user and every other tenant can read a tenant's tunnel parameters. Cc: stable+noautosel@kernel.org # high regression risk Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260809094252.2107242-1-maoyixie.tju@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		History 2026-08-13 17:33:31 -07:00
..
Kconfig	ipv6: convert CONFIG_IPV6 to built-in only and clean up Kconfigs	2026-03-29 11:21:22 -07:00
l2tp_core.c	net: Use helpers to get/set UDP len tree-wide	2026-07-22 13:47:02 +02:00
l2tp_core.h	l2tp: improve tunnel/session refcount helpers	2024-08-11 04:38:50 +01:00
l2tp_debugfs.c	l2tp: fix tunnel and session refcount leak on seq_file release	2026-08-13 11:49:31 +02:00
l2tp_eth.c	net: l2tp_eth: Replace deprecated strcpy with strscpy in l2tp_eth_create	2026-02-24 13:38:33 +01:00
l2tp_ip.c	net: remove addr_len argument of recvmsg() handlers	2026-03-02 18:17:17 -08:00
l2tp_ip6.c	net: remove addr_len argument of recvmsg() handlers	2026-03-02 18:17:17 -08:00
l2tp_netlink.c	l2tp: send netlink notifications in the tunnel's net namespace	2026-08-13 17:33:31 -07:00
l2tp_ppp.c	l2tp: fix tunnel and session refcount leak on seq_file release	2026-08-13 11:49:31 +02:00
Makefile	l2tp: add tracepoint infrastructure to core	2020-08-22 12:44:37 -07:00
trace.h	l2tp: add tracepoint definitions in trace.h	2020-08-22 12:44:37 -07:00