1 /* SPDX-License-Identifier: GPL-2.0 */
2 /*
3 * Operations on the network namespace
4 */
5 #ifndef __NET_NET_NAMESPACE_H
6 #define __NET_NET_NAMESPACE_H
7
8 #include <linux/atomic.h>
9 #include <linux/refcount.h>
10 #include <linux/workqueue.h>
11 #include <linux/list.h>
12 #include <linux/sysctl.h>
13 #include <linux/uidgid.h>
14
15 #include <net/flow.h>
16 #include <net/netns/core.h>
17 #include <net/netns/mib.h>
18 #include <net/netns/unix.h>
19 #include <net/netns/packet.h>
20 #include <net/netns/ipv4.h>
21 #include <net/netns/ipv6.h>
22 #include <net/netns/nexthop.h>
23 #include <net/netns/ieee802154_6lowpan.h>
24 #include <net/netns/sctp.h>
25 #include <net/netns/netfilter.h>
26 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
27 #include <net/netns/conntrack.h>
28 #endif
29 #if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
30 #include <net/netns/flow_table.h>
31 #endif
32 #include <net/netns/nftables.h>
33 #include <net/netns/xfrm.h>
34 #include <net/netns/mpls.h>
35 #include <net/netns/can.h>
36 #include <net/netns/xdp.h>
37 #include <net/netns/smc.h>
38 #include <net/netns/bpf.h>
39 #include <net/netns/mctp.h>
40 #include <net/net_trackers.h>
41 #include <linux/ns_common.h>
42 #include <linux/idr.h>
43 #include <linux/skbuff.h>
44 #include <linux/notifier.h>
45 #include <linux/xarray.h>
46
47 struct user_namespace;
48 struct proc_dir_entry;
49 struct net_device;
50 struct sock;
51 struct ctl_table_header;
52 struct net_generic;
53 struct uevent_sock;
54 struct netns_ipvs;
55 struct bpf_prog;
56
57
58 #define NETDEV_HASHBITS 8
59 #define NETDEV_HASHENTRIES (1 << NETDEV_HASHBITS)
60
61 struct net {
62 /* First cache line can be often dirtied.
63 * Do not place here read-mostly fields.
64 */
65 refcount_t passive; /* To decide when the network
66 * namespace should be freed.
67 */
68 spinlock_t rules_mod_lock;
69
70 unsigned int dev_base_seq; /* protected by rtnl_mutex */
71 u32 ifindex;
72
73 spinlock_t nsid_lock;
74 atomic_t fnhe_genid;
75
76 struct list_head list; /* list of network namespaces */
77 struct list_head exit_list; /* To linked to call pernet exit
78 * methods on dead net (
79 * pernet_ops_rwsem read locked),
80 * or to unregister pernet ops
81 * (pernet_ops_rwsem write locked).
82 */
83 struct llist_node defer_free_list;
84 struct llist_node cleanup_list; /* namespaces on death row */
85
86 #ifdef CONFIG_KEYS
87 struct key_tag *key_domain; /* Key domain of operation tag */
88 #endif
89 struct user_namespace *user_ns; /* Owning user namespace */
90 struct ucounts *ucounts;
91 struct idr netns_ids;
92
93 struct ns_common ns;
94 struct ref_tracker_dir refcnt_tracker;
95 struct ref_tracker_dir notrefcnt_tracker; /* tracker for objects not
96 * refcounted against netns
97 */
98 struct list_head dev_base_head;
99 struct proc_dir_entry *proc_net;
100 struct proc_dir_entry *proc_net_stat;
101
102 #ifdef CONFIG_SYSCTL
103 struct ctl_table_set sysctls;
104 #endif
105
106 struct sock *rtnl; /* rtnetlink socket */
107 struct sock *genl_sock;
108
109 struct uevent_sock *uevent_sock; /* uevent socket */
110
111 struct hlist_head *dev_name_head;
112 struct hlist_head *dev_index_head;
113 struct xarray dev_by_index;
114 struct raw_notifier_head netdev_chain;
115
116 /* Note that @hash_mix can be read millions times per second,
117 * it is critical that it is on a read_mostly cache line.
118 */
119 u32 hash_mix;
120
121 struct net_device *loopback_dev; /* The loopback */
122
123 /* core fib_rules */
124 struct list_head rules_ops;
125
126 struct netns_core core;
127 struct netns_mib mib;
128 struct netns_packet packet;
129 #if IS_ENABLED(CONFIG_UNIX)
130 struct netns_unix unx;
131 #endif
132 struct netns_nexthop nexthop;
133 struct netns_ipv4 ipv4;
134 #if IS_ENABLED(CONFIG_IPV6)
135 struct netns_ipv6 ipv6;
136 #endif
137 #if IS_ENABLED(CONFIG_IEEE802154_6LOWPAN)
138 struct netns_ieee802154_lowpan ieee802154_lowpan;
139 #endif
140 #if defined(CONFIG_IP_SCTP) || defined(CONFIG_IP_SCTP_MODULE)
141 struct netns_sctp sctp;
142 #endif
143 #ifdef CONFIG_NETFILTER
144 struct netns_nf nf;
145 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
146 struct netns_ct ct;
147 #endif
148 #if defined(CONFIG_NF_TABLES) || defined(CONFIG_NF_TABLES_MODULE)
149 struct netns_nftables nft;
150 #endif
151 #if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
152 struct netns_ft ft;
153 #endif
154 #endif
155 #ifdef CONFIG_WEXT_CORE
156 struct sk_buff_head wext_nlevents;
157 #endif
158 struct net_generic __rcu *gen;
159
160 /* Used to store attached BPF programs */
161 struct netns_bpf bpf;
162
163 /* Note : following structs are cache line aligned */
164 #ifdef CONFIG_XFRM
165 struct netns_xfrm xfrm;
166 #endif
167
168 u64 net_cookie; /* written once */
169
170 #if IS_ENABLED(CONFIG_IP_VS)
171 struct netns_ipvs *ipvs;
172 #endif
173 #if IS_ENABLED(CONFIG_MPLS)
174 struct netns_mpls mpls;
175 #endif
176 #if IS_ENABLED(CONFIG_CAN)
177 struct netns_can can;
178 #endif
179 #ifdef CONFIG_XDP_SOCKETS
180 struct netns_xdp xdp;
181 #endif
182 #if IS_ENABLED(CONFIG_MCTP)
183 struct netns_mctp mctp;
184 #endif
185 #if IS_ENABLED(CONFIG_CRYPTO_USER)
186 struct sock *crypto_nlsk;
187 #endif
188 struct sock *diag_nlsk;
189 #if IS_ENABLED(CONFIG_SMC)
190 struct netns_smc smc;
191 #endif
192 #ifdef CONFIG_DEBUG_NET_SMALL_RTNL
193 /* Move to a better place when the config guard is removed. */
194 struct mutex rtnl_mutex;
195 #endif
196 } __randomize_layout;
197
198 #include <linux/seq_file_net.h>
199
200 /* Init's network namespace */
201 extern struct net init_net;
202
203 #ifdef CONFIG_NET_NS
204 struct net *copy_net_ns(unsigned long flags, struct user_namespace *user_ns,
205 struct net *old_net);
206
207 void net_ns_get_ownership(const struct net *net, kuid_t *uid, kgid_t *gid);
208
209 void net_ns_barrier(void);
210
211 struct ns_common *get_net_ns(struct ns_common *ns);
212 struct net *get_net_ns_by_fd(int fd);
213 extern struct task_struct *cleanup_net_task;
214
215 #else /* CONFIG_NET_NS */
216 #include <linux/sched.h>
217 #include <linux/nsproxy.h>
copy_net_ns(unsigned long flags,struct user_namespace * user_ns,struct net * old_net)218 static inline struct net *copy_net_ns(unsigned long flags,
219 struct user_namespace *user_ns, struct net *old_net)
220 {
221 if (flags & CLONE_NEWNET)
222 return ERR_PTR(-EINVAL);
223 return old_net;
224 }
225
net_ns_get_ownership(const struct net * net,kuid_t * uid,kgid_t * gid)226 static inline void net_ns_get_ownership(const struct net *net,
227 kuid_t *uid, kgid_t *gid)
228 {
229 *uid = GLOBAL_ROOT_UID;
230 *gid = GLOBAL_ROOT_GID;
231 }
232
net_ns_barrier(void)233 static inline void net_ns_barrier(void) {}
234
get_net_ns(struct ns_common * ns)235 static inline struct ns_common *get_net_ns(struct ns_common *ns)
236 {
237 return ERR_PTR(-EINVAL);
238 }
239
get_net_ns_by_fd(int fd)240 static inline struct net *get_net_ns_by_fd(int fd)
241 {
242 return ERR_PTR(-EINVAL);
243 }
244 #endif /* CONFIG_NET_NS */
245
246
247 extern struct list_head net_namespace_list;
248
249 struct net *get_net_ns_by_pid(pid_t pid);
250
251 #ifdef CONFIG_SYSCTL
252 void ipx_register_sysctl(void);
253 void ipx_unregister_sysctl(void);
254 #else
255 #define ipx_register_sysctl()
256 #define ipx_unregister_sysctl()
257 #endif
258
259 #ifdef CONFIG_NET_NS
260 void __put_net(struct net *net);
261
262 /* Try using get_net_track() instead */
get_net(struct net * net)263 static inline struct net *get_net(struct net *net)
264 {
265 refcount_inc(&net->ns.count);
266 return net;
267 }
268
maybe_get_net(struct net * net)269 static inline struct net *maybe_get_net(struct net *net)
270 {
271 /* Used when we know struct net exists but we
272 * aren't guaranteed a previous reference count
273 * exists. If the reference count is zero this
274 * function fails and returns NULL.
275 */
276 if (!refcount_inc_not_zero(&net->ns.count))
277 net = NULL;
278 return net;
279 }
280
281 /* Try using put_net_track() instead */
put_net(struct net * net)282 static inline void put_net(struct net *net)
283 {
284 if (refcount_dec_and_test(&net->ns.count))
285 __put_net(net);
286 }
287
288 static inline
net_eq(const struct net * net1,const struct net * net2)289 int net_eq(const struct net *net1, const struct net *net2)
290 {
291 return net1 == net2;
292 }
293
check_net(const struct net * net)294 static inline int check_net(const struct net *net)
295 {
296 return refcount_read(&net->ns.count) != 0;
297 }
298
299 void net_drop_ns(void *);
300 void net_passive_dec(struct net *net);
301
302 #else
303
get_net(struct net * net)304 static inline struct net *get_net(struct net *net)
305 {
306 return net;
307 }
308
put_net(struct net * net)309 static inline void put_net(struct net *net)
310 {
311 }
312
maybe_get_net(struct net * net)313 static inline struct net *maybe_get_net(struct net *net)
314 {
315 return net;
316 }
317
318 static inline
net_eq(const struct net * net1,const struct net * net2)319 int net_eq(const struct net *net1, const struct net *net2)
320 {
321 return 1;
322 }
323
check_net(const struct net * net)324 static inline int check_net(const struct net *net)
325 {
326 return 1;
327 }
328
329 #define net_drop_ns NULL
330
net_passive_dec(struct net * net)331 static inline void net_passive_dec(struct net *net)
332 {
333 refcount_dec(&net->passive);
334 }
335 #endif
336
net_passive_inc(struct net * net)337 static inline void net_passive_inc(struct net *net)
338 {
339 refcount_inc(&net->passive);
340 }
341
342 /* Returns true if the netns initialization is completed successfully */
net_initialized(const struct net * net)343 static inline bool net_initialized(const struct net *net)
344 {
345 return READ_ONCE(net->list.next);
346 }
347
__netns_tracker_alloc(struct net * net,netns_tracker * tracker,bool refcounted,gfp_t gfp)348 static inline void __netns_tracker_alloc(struct net *net,
349 netns_tracker *tracker,
350 bool refcounted,
351 gfp_t gfp)
352 {
353 #ifdef CONFIG_NET_NS_REFCNT_TRACKER
354 ref_tracker_alloc(refcounted ? &net->refcnt_tracker :
355 &net->notrefcnt_tracker,
356 tracker, gfp);
357 #endif
358 }
359
netns_tracker_alloc(struct net * net,netns_tracker * tracker,gfp_t gfp)360 static inline void netns_tracker_alloc(struct net *net, netns_tracker *tracker,
361 gfp_t gfp)
362 {
363 __netns_tracker_alloc(net, tracker, true, gfp);
364 }
365
__netns_tracker_free(struct net * net,netns_tracker * tracker,bool refcounted)366 static inline void __netns_tracker_free(struct net *net,
367 netns_tracker *tracker,
368 bool refcounted)
369 {
370 #ifdef CONFIG_NET_NS_REFCNT_TRACKER
371 ref_tracker_free(refcounted ? &net->refcnt_tracker :
372 &net->notrefcnt_tracker, tracker);
373 #endif
374 }
375
get_net_track(struct net * net,netns_tracker * tracker,gfp_t gfp)376 static inline struct net *get_net_track(struct net *net,
377 netns_tracker *tracker, gfp_t gfp)
378 {
379 get_net(net);
380 netns_tracker_alloc(net, tracker, gfp);
381 return net;
382 }
383
put_net_track(struct net * net,netns_tracker * tracker)384 static inline void put_net_track(struct net *net, netns_tracker *tracker)
385 {
386 __netns_tracker_free(net, tracker, true);
387 put_net(net);
388 }
389
390 typedef struct {
391 #ifdef CONFIG_NET_NS
392 struct net __rcu *net;
393 #endif
394 } possible_net_t;
395
write_pnet(possible_net_t * pnet,struct net * net)396 static inline void write_pnet(possible_net_t *pnet, struct net *net)
397 {
398 #ifdef CONFIG_NET_NS
399 rcu_assign_pointer(pnet->net, net);
400 #endif
401 }
402
read_pnet(const possible_net_t * pnet)403 static inline struct net *read_pnet(const possible_net_t *pnet)
404 {
405 #ifdef CONFIG_NET_NS
406 return rcu_dereference_protected(pnet->net, true);
407 #else
408 return &init_net;
409 #endif
410 }
411
read_pnet_rcu(const possible_net_t * pnet)412 static inline struct net *read_pnet_rcu(const possible_net_t *pnet)
413 {
414 #ifdef CONFIG_NET_NS
415 return rcu_dereference(pnet->net);
416 #else
417 return &init_net;
418 #endif
419 }
420
421 /* Protected by net_rwsem */
422 #define for_each_net(VAR) \
423 list_for_each_entry(VAR, &net_namespace_list, list)
424 #define for_each_net_continue_reverse(VAR) \
425 list_for_each_entry_continue_reverse(VAR, &net_namespace_list, list)
426 #define for_each_net_rcu(VAR) \
427 list_for_each_entry_rcu(VAR, &net_namespace_list, list)
428
429 #ifdef CONFIG_NET_NS
430 #define __net_init
431 #define __net_exit
432 #define __net_initdata
433 #define __net_initconst
434 #else
435 #define __net_init __init
436 #define __net_exit __ref
437 #define __net_initdata __initdata
438 #define __net_initconst __initconst
439 #endif
440
441 int peernet2id_alloc(struct net *net, struct net *peer, gfp_t gfp);
442 int peernet2id(const struct net *net, struct net *peer);
443 bool peernet_has_id(const struct net *net, struct net *peer);
444 struct net *get_net_ns_by_id(const struct net *net, int id);
445
446 struct pernet_operations {
447 struct list_head list;
448 /*
449 * Below methods are called without any exclusive locks.
450 * More than one net may be constructed and destructed
451 * in parallel on several cpus. Every pernet_operations
452 * have to keep in mind all other pernet_operations and
453 * to introduce a locking, if they share common resources.
454 *
455 * The only time they are called with exclusive lock is
456 * from register_pernet_subsys(), unregister_pernet_subsys()
457 * register_pernet_device() and unregister_pernet_device().
458 *
459 * Exit methods using blocking RCU primitives, such as
460 * synchronize_rcu(), should be implemented via exit_batch.
461 * Then, destruction of a group of net requires single
462 * synchronize_rcu() related to these pernet_operations,
463 * instead of separate synchronize_rcu() for every net.
464 * Please, avoid synchronize_rcu() at all, where it's possible.
465 *
466 * Note that a combination of pre_exit() and exit() can
467 * be used, since a synchronize_rcu() is guaranteed between
468 * the calls.
469 */
470 int (*init)(struct net *net);
471 void (*pre_exit)(struct net *net);
472 void (*exit)(struct net *net);
473 void (*exit_batch)(struct list_head *net_exit_list);
474 /* Following method is called with RTNL held. */
475 void (*exit_batch_rtnl)(struct list_head *net_exit_list,
476 struct list_head *dev_kill_list);
477 unsigned int * const id;
478 const size_t size;
479 };
480
481 /*
482 * Use these carefully. If you implement a network device and it
483 * needs per network namespace operations use device pernet operations,
484 * otherwise use pernet subsys operations.
485 *
486 * Network interfaces need to be removed from a dying netns _before_
487 * subsys notifiers can be called, as most of the network code cleanup
488 * (which is done from subsys notifiers) runs with the assumption that
489 * dev_remove_pack has been called so no new packets will arrive during
490 * and after the cleanup functions have been called. dev_remove_pack
491 * is not per namespace so instead the guarantee of no more packets
492 * arriving in a network namespace is provided by ensuring that all
493 * network devices and all sockets have left the network namespace
494 * before the cleanup methods are called.
495 *
496 * For the longest time the ipv4 icmp code was registered as a pernet
497 * device which caused kernel oops, and panics during network
498 * namespace cleanup. So please don't get this wrong.
499 */
500 int register_pernet_subsys(struct pernet_operations *);
501 void unregister_pernet_subsys(struct pernet_operations *);
502 int register_pernet_device(struct pernet_operations *);
503 void unregister_pernet_device(struct pernet_operations *);
504
505 struct ctl_table;
506
507 #define register_net_sysctl(net, path, table) \
508 register_net_sysctl_sz(net, path, table, ARRAY_SIZE(table))
509 #ifdef CONFIG_SYSCTL
510 int net_sysctl_init(void);
511 struct ctl_table_header *register_net_sysctl_sz(struct net *net, const char *path,
512 struct ctl_table *table, size_t table_size);
513 void unregister_net_sysctl_table(struct ctl_table_header *header);
514 #else
net_sysctl_init(void)515 static inline int net_sysctl_init(void) { return 0; }
register_net_sysctl_sz(struct net * net,const char * path,struct ctl_table * table,size_t table_size)516 static inline struct ctl_table_header *register_net_sysctl_sz(struct net *net,
517 const char *path, struct ctl_table *table, size_t table_size)
518 {
519 return NULL;
520 }
unregister_net_sysctl_table(struct ctl_table_header * header)521 static inline void unregister_net_sysctl_table(struct ctl_table_header *header)
522 {
523 }
524 #endif
525
rt_genid_ipv4(const struct net * net)526 static inline int rt_genid_ipv4(const struct net *net)
527 {
528 return atomic_read(&net->ipv4.rt_genid);
529 }
530
531 #if IS_ENABLED(CONFIG_IPV6)
rt_genid_ipv6(const struct net * net)532 static inline int rt_genid_ipv6(const struct net *net)
533 {
534 return atomic_read(&net->ipv6.fib6_sernum);
535 }
536 #endif
537
rt_genid_bump_ipv4(struct net * net)538 static inline void rt_genid_bump_ipv4(struct net *net)
539 {
540 atomic_inc(&net->ipv4.rt_genid);
541 }
542
543 extern void (*__fib6_flush_trees)(struct net *net);
rt_genid_bump_ipv6(struct net * net)544 static inline void rt_genid_bump_ipv6(struct net *net)
545 {
546 if (__fib6_flush_trees)
547 __fib6_flush_trees(net);
548 }
549
550 #if IS_ENABLED(CONFIG_IEEE802154_6LOWPAN)
551 static inline struct netns_ieee802154_lowpan *
net_ieee802154_lowpan(struct net * net)552 net_ieee802154_lowpan(struct net *net)
553 {
554 return &net->ieee802154_lowpan;
555 }
556 #endif
557
558 /* For callers who don't really care about whether it's IPv4 or IPv6 */
rt_genid_bump_all(struct net * net)559 static inline void rt_genid_bump_all(struct net *net)
560 {
561 rt_genid_bump_ipv4(net);
562 rt_genid_bump_ipv6(net);
563 }
564
fnhe_genid(const struct net * net)565 static inline int fnhe_genid(const struct net *net)
566 {
567 return atomic_read(&net->fnhe_genid);
568 }
569
fnhe_genid_bump(struct net * net)570 static inline void fnhe_genid_bump(struct net *net)
571 {
572 atomic_inc(&net->fnhe_genid);
573 }
574
575 #ifdef CONFIG_NET
576 void net_ns_init(void);
577 #else
net_ns_init(void)578 static inline void net_ns_init(void) {}
579 #endif
580
581 #endif /* __NET_NET_NAMESPACE_H */
582