Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

lib: enforce vrf netns if setns() returns ok #1880

Merged
merged 2 commits into from
Mar 14, 2018
Merged

lib: enforce vrf netns if setns() returns ok #1880

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1c9d288
zebra: upon associating netns with vrf, prileges are raised
pguibert6WIND Mar 13, 2018
3bc3490
lib: privileges are granted to vty netns command
pguibert6WIND Mar 13, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 17 additions & 3 deletions lib/vrf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@
#include "memory.h"
#include "command.h"
#include "ns.h"
#include "privs.h"

/* default VRF ID value used when VRF backend is not NETNS */
#define VRF_DEFAULT_INTERNAL 0
Expand All @@ -52,6 +53,7 @@ struct vrf_id_head vrfs_by_id = RB_INITIALIZER(&vrfs_by_id);
struct vrf_name_head vrfs_by_name = RB_INITIALIZER(&vrfs_by_name);

static int vrf_backend;
static struct zebra_privs_t *vrf_daemon_privs;

/*
* Turn on/off debug code
Expand Down Expand Up @@ -690,14 +692,24 @@ DEFUN_NOSH (vrf_netns,
"Attach VRF to a Namespace\n"
"The file name in " NS_RUN_DIR ", or a full pathname\n")
{
int idx_name = 1;
int idx_name = 1, ret;
char *pathname = ns_netns_pathname(vty, argv[idx_name]->arg);

VTY_DECLVAR_CONTEXT(vrf, vrf);

if (!pathname)
return CMD_WARNING_CONFIG_FAILED;
return vrf_netns_handler_create(vty, vrf, pathname, NS_UNKNOWN);

if (vrf_daemon_privs &&
vrf_daemon_privs->change(ZPRIVS_RAISE))
zlog_err("%s: Can't raise privileges", __func__);

ret = vrf_netns_handler_create(vty, vrf, pathname, NS_UNKNOWN);

if (vrf_daemon_privs &&
vrf_daemon_privs->change(ZPRIVS_LOWER))
zlog_err("%s: Can't lower privileges", __func__);
return ret;
}

DEFUN (no_vrf_netns,
Expand Down Expand Up @@ -779,14 +791,16 @@ void vrf_install_commands(void)
install_element(ENABLE_NODE, &no_vrf_debug_cmd);
}

void vrf_cmd_init(int (*writefunc)(struct vty *vty))
void vrf_cmd_init(int (*writefunc)(struct vty *vty),
struct zebra_privs_t *daemon_privs)
{
install_element(CONFIG_NODE, &vrf_cmd);
install_element(CONFIG_NODE, &no_vrf_cmd);
install_node(&vrf_node, writefunc);
install_default(VRF_NODE);
if (vrf_is_backend_netns() && ns_have_netns()) {
/* Install NS commands. */
vrf_daemon_privs = daemon_privs;
install_element(VRF_NODE, &vrf_netns_cmd);
install_element(VRF_NODE, &no_vrf_netns_cmd);
}
Expand Down
3 changes: 2 additions & 1 deletion lib/vrf.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,7 +242,8 @@ extern int vrf_switchback_to_initial(void);

/* VRF vty command initialisation
*/
extern void vrf_cmd_init(int (*writefunc)(struct vty *vty));
extern void vrf_cmd_init(int (*writefunc)(struct vty *vty),
struct zebra_privs_t *daemon_priv);

/* VRF vty debugging
*/
Expand Down
2 changes: 1 addition & 1 deletion pimd/pim_instance.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,7 +214,7 @@ void pim_vrf_init(void)
{
vrf_init(pim_vrf_new, pim_vrf_enable, pim_vrf_disable, pim_vrf_delete);

vrf_cmd_init(pim_vrf_config_write);
vrf_cmd_init(pim_vrf_config_write, &pimd_privs);
}

void pim_vrf_terminate(void)
Expand Down
4 changes: 4 additions & 0 deletions zebra/zebra_netns_notify.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,11 @@ static void zebra_ns_notify_create_context_from_entry_name(const char *name)
zlog_warn("NS notify : failed to create VRF %s", name);
return;
}
if (zserv_privs.change(ZPRIVS_RAISE))
zlog_err("Can't raise privileges");
ret = vrf_netns_handler_create(NULL, vrf, netnspath, ns_id);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why do we sometimes need to raise priviledges to call this function and sometimes we do not?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

now, on every place where vrf_netns_handler_create() is called, we try to raise the privilege level.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is no reason to raise privileges sometimes and other times not.
this is why I make that patch.

if (zserv_privs.change(ZPRIVS_LOWER))
zlog_err("Can't lower privileges");
if (ret != CMD_SUCCESS) {
zlog_warn("NS notify : failed to create NS %s", netnspath);
return;
Expand Down
3 changes: 2 additions & 1 deletion zebra/zebra_vrf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@
#include "zebra/interface.h"
#include "zebra/zebra_mpls.h"
#include "zebra/zebra_vxlan.h"
#include "zebra/zebra_netns_notify.h"

extern struct zebra_t zebrad;

Expand Down Expand Up @@ -587,5 +588,5 @@ void zebra_vrf_init(void)
vrf_init(zebra_vrf_new, zebra_vrf_enable, zebra_vrf_disable,
zebra_vrf_delete);

vrf_cmd_init(vrf_config_write);
vrf_cmd_init(vrf_config_write, &zserv_privs);
}