summaryrefslogtreecommitdiff
path: root/ip
Commit message (Collapse)AuthorAgeFilesLines
* iproute_lwtunnel: fix possible use of NULL when malloc() failsStephen Hemminger2023-05-131-5/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | iproute_lwtunnel.c: In function ‘parse_srh’: iproute_lwtunnel.c:903:9: warning: use of possibly-NULL ‘srh’ where non-null expected [CWE-690] [-Wanalyzer-possible-null-argument] 903 | memset(srh, 0, srhlen); | ^~~~~~~~~~~~~~~~~~~~~~ ‘parse_srh’: events 1-2 | | 902 | srh = malloc(srhlen); | | ^~~~~~~~~~~~~~ | | | | | (1) this call could return NULL | 903 | memset(srh, 0, srhlen); | | ~~~~~~~~~~~~~~~~~~~~~~ | | | | | (2) argument 1 (‘srh’) from (1) could be NULL where non-null expected | In file included from iproute_lwtunnel.c:13: /usr/include/string.h:61:14: note: argument 1 of ‘memset’ must be non-null 61 | extern void *memset (void *__s, int __c, size_t __n) __THROW __nonnull ((1)); | ^~~~~~ iproute_lwtunnel.c: In function ‘parse_encap_seg6’: iproute_lwtunnel.c:980:9: warning: use of possibly-NULL ‘tuninfo’ where non-null expected [CWE-690] [-Wanalyzer-possible-null-argument] 980 | memset(tuninfo, 0, sizeof(*tuninfo) + srhlen); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ‘parse_encap_seg6’: events 1-2 | | 934 | static int parse_encap_seg6(struct rtattr *rta, size_t len, int *argcp, | | ^~~~~~~~~~~~~~~~ | | | | | (1) entry to ‘parse_encap_seg6’ |...... | 976 | srh = parse_srh(segbuf, hmac, encap); | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (2) calling ‘parse_srh’ from ‘parse_encap_seg6’ | +--> ‘parse_srh’: events 3-5 | | 882 | static struct ipv6_sr_hdr *parse_srh(char *segbuf, int hmac, bool encap) | | ^~~~~~~~~ | | | | | (3) entry to ‘parse_srh’ |...... | 922 | if (hmac) { | | ~ | | | | | (4) following ‘false’ branch (when ‘hmac == 0’)... |...... | 931 | return srh; | | ~~~ | | | | | (5) ...to here | <------+ | ‘parse_encap_seg6’: events 6-8 | | 976 | srh = parse_srh(segbuf, hmac, encap); | | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (6) returning to ‘parse_encap_seg6’ from ‘parse_srh’ |...... | 979 | tuninfo = malloc(sizeof(*tuninfo) + srhlen); | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (7) this call could return NULL | 980 | memset(tuninfo, 0, sizeof(*tuninfo) + srhlen); | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (8) argument 1 (‘tuninfo’) from (7) could be NULL where non-null expected | /usr/include/string.h:61:14: note: argument 1 of ‘memset’ must be non-null 61 | extern void *memset (void *__s, int __c, size_t __n) __THROW __nonnull ((1)); | ^~~~~~ iproute_lwtunnel.c: In function ‘parse_rpl_srh’: iproute_lwtunnel.c:1018:21: warning: dereference of possibly-NULL ‘srh’ [CWE-690] [-Wanalyzer-possible-null-dereference] 1018 | srh->hdrlen = (srhlen >> 3) - 1; | ~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~ ‘parse_rpl_srh’: events 1-2 | | 1016 | srh = calloc(1, srhlen); | | ^~~~~~~~~~~~~~~~~ | | | | | (1) this call could return NULL | 1017 | | 1018 | srh->hdrlen = (srhlen >> 3) - 1; | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (2) ‘srh’ could be NULL: unchecked value from (1) | Fixes: 00e76d4da37f ("iproute: add helper functions for SRH processing") Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
* ipmaddr: fix dereference of NULL on malloc() failureStephen Hemminger2023-05-131-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Found by -fanalyzer. This is a bug since beginning of initial versions of ip multicast support (pre git). ipmaddr.c: In function ‘read_dev_mcast’: ipmaddr.c:105:25: warning: dereference of possibly-NULL ‘ma’ [CWE-690] [-Wanalyzer-possible-null-dereference] 105 | memcpy(ma, &m, sizeof(m)); | ^~~~~~~~~~~~~~~~~~~~~~~~~ ‘do_multiaddr’: events 1-4 | | 354 | int do_multiaddr(int argc, char **argv) | | ^~~~~~~~~~~~ | | | | | (1) entry to ‘do_multiaddr’ | 355 | { | 356 | if (argc < 1) | | ~ | | | | | (2) following ‘true’ branch (when ‘argc <= 0’)... | 357 | return multiaddr_list(0, NULL); | | ~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (3) ...to here | | (4) calling ‘multiaddr_list’ from ‘do_multiaddr’ | +--> ‘multiaddr_list’: events 5-10 | | 255 | static int multiaddr_list(int argc, char **argv) | | ^~~~~~~~~~~~~~ | | | | | (5) entry to ‘multiaddr_list’ |...... | 262 | while (argc > 0) { | | ~~~~~~~~ | | | | | (6) following ‘false’ branch (when ‘argc <= 0’)... |...... | 275 | if (!filter.family || filter.family == AF_PACKET) | | ~ ~~~~~~~~~~~~~ | | | | | | | (7) ...to here | | (8) following ‘true’ branch... | 276 | read_dev_mcast(&list); | | ~~~~~~~~~~~~~~~~~~~~~ | | | | | (9) ...to here | | (10) calling ‘read_dev_mcast’ from ‘multiaddr_list’ | +--> ‘read_dev_mcast’: events 11-12 | | 82 | static void read_dev_mcast(struct ma_info **result_p) | | ^~~~~~~~~~~~~~ | | | | | (11) entry to ‘read_dev_mcast’ |...... | 87 | if (!fp) | | ~ | | | | | (12) following ‘false’ branch (when ‘fp’ is non-NULL)... | ‘read_dev_mcast’: event 13 | |cc1: | (13): ...to here | ‘read_dev_mcast’: events 14-17 | | 90 | while (fgets(buf, sizeof(buf), fp)) { | | ^~~~~ | | | | | (14) following ‘true’ branch... | 91 | char hexa[256]; | 92 | struct ma_info m = { .addr.family = AF_PACKET }; | | ~ | | | | | (15) ...to here |...... | 103 | struct ma_info *ma = malloc(sizeof(m)); | | ~~~~~~~~~~~~~~~~~ | | | | | (16) this call could return NULL | 104 | | 105 | memcpy(ma, &m, sizeof(m)); | | ~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (17) ‘ma’ could be NULL: unchecked value from (16) | ipmaddr.c: In function ‘read_igmp’: ipmaddr.c:152:17: warning: dereference of possibly-NULL ‘ma’ [CWE-690] [-Wanalyzer-possible-null-dereference] 152 | memcpy(ma, &m, sizeof(m)); | ^~~~~~~~~~~~~~~~~~~~~~~~~ ‘do_multiaddr’: events 1-4 | | 354 | int do_multiaddr(int argc, char **argv) | | ^~~~~~~~~~~~ | | | | | (1) entry to ‘do_multiaddr’ | 355 | { | 356 | if (argc < 1) | | ~ | | | | | (2) following ‘true’ branch (when ‘argc <= 0’)... | 357 | return multiaddr_list(0, NULL); | | ~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (3) ...to here | | (4) calling ‘multiaddr_list’ from ‘do_multiaddr’ | +--> ‘multiaddr_list’: events 5-10 | | 255 | static int multiaddr_list(int argc, char **argv) | | ^~~~~~~~~~~~~~ | | | | | (5) entry to ‘multiaddr_list’ |...... | 262 | while (argc > 0) { | | ~~~~~~~~ | | | | | (6) following ‘false’ branch (when ‘argc <= 0’)... |...... | 275 | if (!filter.family || filter.family == AF_PACKET) | | ~~~~~~~~~~~~~ | | | | | (7) ...to here | 276 | read_dev_mcast(&list); | 277 | if (!filter.family || filter.family == AF_INET) | | ~ | | | | | (8) following ‘true’ branch... | 278 | read_igmp(&list); | | ~~~~~~~~~~~~~~~~ | | | | | (9) ...to here | | (10) calling ‘read_igmp’ from ‘multiaddr_list’ | +--> ‘read_igmp’: events 11-14 | | 116 | static void read_igmp(struct ma_info **result_p) | | ^~~~~~~~~ | | | | | (11) entry to ‘read_igmp’ |...... | 126 | if (!fp) | | ~ | | | | | (12) following ‘false’ branch (when ‘fp’ is non-NULL)... | 127 | return; | 128 | if (!fgets(buf, sizeof(buf), fp)) { | | ~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | | | (13) ...to here | | (14) following ‘false’ branch... | ‘read_igmp’: event 15 | |cc1: | (15): ...to here | ‘read_igmp’: events 16-19 | | 133 | while (fgets(buf, sizeof(buf), fp)) { | | ^~~~~ | | | | | (16) following ‘true’ branch... |...... | 136 | if (buf[0] != '\t') { | | ~~~~~~ | | | | | (17) ...to here |...... | 151 | ma = malloc(sizeof(m)); | | ~~~~~~~~~~~~~~~~~ | | | | | (18) this call could return NULL | 152 | memcpy(ma, &m, sizeof(m)); | | ~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (19) ‘ma’ could be NULL: unchecked value from (18) | ipmaddr.c: In function ‘read_igmp6’: ipmaddr.c:181:25: warning: dereference of possibly-NULL ‘ma’ [CWE-690] [-Wanalyzer-possible-null-dereference] 181 | memcpy(ma, &m, sizeof(m)); | ^~~~~~~~~~~~~~~~~~~~~~~~~ ‘do_multiaddr’: events 1-4 | | 354 | int do_multiaddr(int argc, char **argv) | | ^~~~~~~~~~~~ | | | | | (1) entry to ‘do_multiaddr’ | 355 | { | 356 | if (argc < 1) | | ~ | | | | | (2) following ‘true’ branch (when ‘argc <= 0’)... | 357 | return multiaddr_list(0, NULL); | | ~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (3) ...to here | | (4) calling ‘multiaddr_list’ from ‘do_multiaddr’ | +--> ‘multiaddr_list’: events 5-10 | | 255 | static int multiaddr_list(int argc, char **argv) | | ^~~~~~~~~~~~~~ | | | | | (5) entry to ‘multiaddr_list’ |...... | 262 | while (argc > 0) { | | ~~~~~~~~ | | | | | (6) following ‘false’ branch (when ‘argc <= 0’)... |...... | 275 | if (!filter.family || filter.family == AF_PACKET) | | ~~~~~~~~~~~~~ | | | | | (7) ...to here |...... | 279 | if (!filter.family || filter.family == AF_INET6) | | ~ | | | | | (8) following ‘true’ branch... | 280 | read_igmp6(&list); | | ~~~~~~~~~~~~~~~~~ | | | | | (9) ...to here | | (10) calling ‘read_igmp6’ from ‘multiaddr_list’ | +--> ‘read_igmp6’: events 11-12 | | 159 | static void read_igmp6(struct ma_info **result_p) | | ^~~~~~~~~~ | | | | | (11) entry to ‘read_igmp6’ |...... | 164 | if (!fp) | | ~ | | | | | (12) following ‘false’ branch (when ‘fp’ is non-NULL)... | ‘read_igmp6’: event 13 | |cc1: | (13): ...to here | ‘read_igmp6’: events 14-17 | | 167 | while (fgets(buf, sizeof(buf), fp)) { | | ^~~~~ | | | | | (14) following ‘true’ branch... | 168 | char hexa[256]; | 169 | struct ma_info m = { .addr.family = AF_INET6 }; | | ~ | | | | | (15) ...to here |...... | 179 | struct ma_info *ma = malloc(sizeof(m)); | | ~~~~~~~~~~~~~~~~~ | | | | | (16) this call could return NULL | 180 | | 181 | memcpy(ma, &m, sizeof(m)); | | ~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (17) ‘ma’ could be NULL: unchecked value from (16) | Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
* iproute2: optimize code and fix some mem-leak riskzhaoshuang2023-05-119-0/+18
| | | | | | Signed-off-by: zhaoshuang <izhaoshuang@163.com> Reviewed-by: Pawel Chmielewski <pawel.chmielewski@intel.com> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
* ipnetns: fix fd leak with 'ip netns set'Nicolas Dichtel2023-05-111-10/+1
| | | | | | | | | | There is no reason to open this netns file. set_netnsid_from_name() uses netns_get_fd() for this purpose and uses the returned fd. Reported-by: Stephen Hemminger <stephen@networkplumber.org> Fixes: d182ee1307c7 ("ipnetns: allow to get and set netns ids") Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
* remove unnecessary checks for NULL before calling free()Stephen Hemminger2023-05-101-6/+3
| | | | | | | | | The function free() handles the case wher argument is NULL by doing nothing. So the extra checks are not needed. Found by modified version of kernel coccinelle script. Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
* bridge: link: Add support for neigh_vlan_suppress optionIdo Schimmel2023-04-251-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for the per-port neigh_vlan_suppress option. Example: # bridge link set dev swp1 neigh_vlan_suppress on # bridge -d -j -p link show dev swp1 [ { "ifindex": 62, "ifname": "swp1", "flags": [ "BROADCAST","NOARP","UP","LOWER_UP" ], "mtu": 1500, "master": "br0", "state": "forwarding", "priority": 32, "cost": 100, "hairpin": false, "guard": false, "root_block": false, "fastleave": false, "learning": true, "flood": true, "mcast_flood": true, "bcast_flood": true, "mcast_router": 1, "mcast_to_unicast": false, "neigh_suppress": false, "neigh_vlan_suppress": true, "vlan_tunnel": false, "isolated": false, "locked": false, "mab": false, "mcast_n_groups": 0, "mcast_max_groups": 0 } ] # bridge -d link show dev swp1 62: swp1: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 master br0 state forwarding priority 32 cost 100 hairpin off guard off root_block off fastleave off learning on flood on mcast_flood on bcast_flood on mcast_router 1 mcast_to_unicast off neigh_suppress off neigh_vlan_suppress on vlan_tunnel off isolated off locked off mab off mcast_n_groups 0 mcast_max_groups 0 # bridge link set dev swp1 neigh_vlan_suppress off # bridge -d -j -p link show dev swp1 [ { "ifindex": 62, "ifname": "swp1", "flags": [ "BROADCAST","NOARP","UP","LOWER_UP" ], "mtu": 1500, "master": "br0", "state": "forwarding", "priority": 32, "cost": 100, "hairpin": false, "guard": false, "root_block": false, "fastleave": false, "learning": true, "flood": true, "mcast_flood": true, "bcast_flood": true, "mcast_router": 1, "mcast_to_unicast": false, "neigh_suppress": false, "neigh_vlan_suppress": false, "vlan_tunnel": false, "isolated": false, "locked": false, "mab": false, "mcast_n_groups": 0, "mcast_max_groups": 0 } ] # bridge -d link show dev swp1 62: swp1: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 master br0 state forwarding priority 32 cost 100 hairpin off guard off root_block off fastleave off learning on flood on mcast_flood on bcast_flood on mcast_router 1 mcast_to_unicast off neigh_suppress off neigh_vlan_suppress off vlan_tunnel off isolated off locked off mab off mcast_n_groups 0 mcast_max_groups 0 Signed-off-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Signed-off-by: David Ahern <dsahern@kernel.org>
* Merge branch 'main' into nextDavid Ahern2023-04-225-17/+29
|\ | | | | | | Signed-off-by: David Ahern <dsahern@kernel.org>
| * iplink: fix help of 'netns' argNicolas Dichtel2023-04-211-2/+2
| | | | | | | | | | | | | | | | | | | | | | 'ip link set foo netns /proc/1/ns/net' is a valid command. Let's update the doc accordingly. Fixes: 0dc34c7713bb ("iproute2: Add processless network namespace support") Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Reviewed-by: Simon Horman <simon.horman@corigine.com> Reviewed-by: David Marchand <david.marchand@redhat.com> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
| * iplink: use the same token NETNSNAME everywhereNicolas Dichtel2023-04-211-2/+2
| | | | | | | | | | | | | | | | | | Use NETNSNAME everywhere to ensure consistency between man pages and help of the 'ip' command. Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Reviewed-by: Simon Horman <simon.horman@corigine.com> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
| * ip: bridge_slave: Fix help message indentationIdo Schimmel2023-04-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use tabs instead of spaces to be consistent with the rest of the options. Before: $ ip link help bridge_slave Usage: ... bridge_slave [ fdb_flush ] [...] [ vlan_tunnel {on | off} ] [ isolated {on | off} ] [ locked {on | off} ] [ mab {on | off} ] [ backup_port DEVICE ] [ nobackup_port ] After: $ ip link help bridge_slave Usage: ... bridge_slave [ fdb_flush ] [...] [ vlan_tunnel {on | off} ] [ isolated {on | off} ] [ locked {on | off} ] [ mab {on | off} ] [ backup_port DEVICE ] [ nobackup_port ] Fixes: 05f1164fe811 ("bridge: link: Add MAC Authentication Bypass (MAB) support") Signed-off-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: Simon Horman <simon.horman@corigine.com> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
| * whitespace cleanupStephen Hemminger2023-04-211-1/+1
| | | | | | | | | | | | Remove trailing blanks. Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
| * lwtunnel: use sizeof() on segbufStephen Hemminger2023-04-211-3/+3
| | | | | | | | | | | | | | Avoid assuming that segbuf is 1024 bytes. Use sizeof() in places where it is being updated. Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
| * lwtunnel: fix warning from strncpyStephen Hemminger2023-04-211-2/+1
| | | | | | | | | | | | | | | | The code for parsing segments in lwtunnel would trigger a warning about strncpy if address sanitizer was enabled. Simpler to just use strlcpy() like elsewhere. Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
| * iproute_lwtunnel: fix JSON outputStephen Hemminger2023-04-141-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The same tag "dst" was being used for both the route destination and the encap destination. This made it hard for JSON parsers. Change to put the per-encap information under a nested JSON object (similar to ip link type info). Original output [ { "dst": "192.168.11.0/24", "encap": "ip6", "id": 0, "src": "::", "dst": "fd00::c0a8:2dd", "hoplimit": 0, "tc": 0, "protocol": "5", "scope": "link", "flags": [ ] } ] Revised output [ { "dst": "192.168.11.0/24", "encap": { "encap_type": "ip6", "id": 0, "src": "::", "dst": "fd00::c0a8:2dd", "hoplimit": 0, "tc": 0 }, "protocol": "5", "scope": "link", "flags": [ ] } ] Reported-by: Lars Ekman <uablrek@gmail.com> Fixes: 663c3cb23103 ("iproute: implement JSON and color output") Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
| * iproute_tunnel: use uint16 for tunnel encap typeStephen Hemminger2023-04-141-4/+4
| | | | | | | | | | | | | | | | The tunnel encap type is passed as unsigned 16 bit value in/out of kernel. Keep it unsigned in the encode/decode logic. Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
| * iptunnel: detect protocol mismatch on tunnel changeStephen Hemminger2023-04-111-2/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If attempt is made to change an IPv6 tunnel by using IPv4 parameters, a stack overflow would happen and garbage request would be passed to kernel. Example: ip tunnel add gre1 mode ip6gre local 2001:db8::1 remote 2001:db8::2 ttl 255 ip tunnel change gre1 mode gre local 192.168.0.0 remote 192.168.0.1 ttl 255 The second command should fail because it attempting set IPv4 addresses on a GRE tunnel that is IPv6. Do best effort detection of this mismatch by giving a bigger buffer to get tunnel request, and checking that the IP header is IPv4. It is still possible but unlikely that byte would match in IPv6 tunnel paramater, but good enough to catch the obvious cases. Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1032642 Tested-by: Luca Boccassi <bluca@debian.org> Reported-by: Robin <imer@imer.cc> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
| * ip-xfrm: accept "allow" as action in ip xfrm policy setdefaultSabrina Dubroca2023-04-041-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The help text claims that setdefault takes ACTION values, ie block | allow. In reality, xfrm_str_to_policy takes block | accept. We could also fix that by changing the help text/manpage, but then it'd be frustrating to have multiple ACTION with similar values used in different subcommands. I'm not changing the output in xfrm_policy_to_str because some userspace somewhere probably depends on the "accept" value. Fixes: 76b30805f9f6 ("xfrm: enable to manage default policies") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
* | ip: Support IP address protocolPetr Machata2023-03-302-2/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | IPv4 and IPv6 addresses can be assigned a protocol value that indicates the provenance of the IP address. The attribute is modeled after ip route protocols, and essentially allows the administrator or userspace stack to tag addresses in some way that makes sense to the actor in question. Support for this feature was merged with commit 47f0bd503210 ("net: Add new protocol attribute to IP addresses"), for kernel 5.18. In this patch, add support for setting the protocol attribute at IP address addition, replacement, and listing requests. An example session with the feature in action: # ip address add dev d 192.0.2.1/28 proto 0xab # ip address show dev d 26: d: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether 06:29:74:fd:1f:eb brd ff:ff:ff:ff:ff:ff inet 192.0.2.1/28 scope global proto 0xab d valid_lft forever preferred_lft forever # ip address replace dev d 192.0.2.1/28 proto 0x11 # ip address show dev d 26: d: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether 06:29:74:fd:1f:eb brd ff:ff:ff:ff:ff:ff inet 192.0.2.1/28 scope global proto 0x11 d valid_lft forever preferred_lft forever A JSON dump. The protocol value is always provided as a string, even in numeric mode, to provide a consistent interface. # ip -j address show dev d | jq [ { "ifindex": 26, "ifname": "d", "flags": [ "BROADCAST", "NOARP" ], "mtu": 1500, "qdisc": "noop", "operstate": "DOWN", "group": "default", "txqlen": 1000, "link_type": "ether", "address": "06:29:74:fd:1f:eb", "broadcast": "ff:ff:ff:ff:ff:ff", "addr_info": [ { "family": "inet", "local": "192.0.2.1", "prefixlen": 28, "scope": "global", "protocol": "0x11", "label": "d", "valid_life_time": 4294967295, "preferred_life_time": 4294967295 } ] } ] Signed-off-by: Petr Machata <petrm@nvidia.com> Signed-off-by: David Ahern <dsahern@kernel.org>
* | macvlan: Add bclim parameterHerbert Xu2023-03-301-2/+24
|/ | | | | | | | | | | | | | This patch adds support for setting the broadcast queueing threshold on macvlan devices. This controls which multicast packets will be processed in a workqueue instead of inline. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> ip/iplink_macvlan.c | 26 ++++++++++++++++++++++++-- man/man8/ip-link.8.in | 18 ++++++++++++++++++ 3 files changed, 43 insertions(+), 2 deletions(-) Signed-off-by: David Ahern <dsahern@kernel.org>
* iplink: add gso and gro max_size attributes for ipv4Xin Long2023-02-182-2/+32
| | | | | | | | | | | | | | | | This patch adds two attributes gso/gro_ipv4_max_size in iplink for the user space support of the BIG TCP for IPv4: https://lore.kernel.org/netdev/de811bf3-e2d8-f727-72bc-c8a754a9d929@tessares.net/T/ Note that after this kernel patchset, "gso/gro_max_size" are used for IPv6 packets while "gso/gro_ipv4_max_size" are for IPv4 patckets. To not break these old applications using "gso/gro_ipv4_max_size" for IPv4 GSO packets, the new size will also be set on "gso/gro_ipv4_max_size" in kernel when "gso/gro_max_size" changes to a value <= 65536. Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: David Ahern <dsahern@kernel.org>
* ip: fix UB in strncpy (e.g. truncated ip route output)Sam James2023-02-171-2/+3
| | | | | | | | | | | | | | Fix overlapping buffers passed to strncpy which is UB. format_host_rta_r writes to the buffer passed to it, so hostname (derived from b1) & b1 partly overlap. This gets worse with sys-libs/glibc-2.37 where the ip route output can be truncated, but it was UB anyway and you can see it occurring w/ glibc-2.36. Bug: https://lore.kernel.org/netdev/0011AC38-4823-4D0A-8580-B108D08959C2@gentoo.org/T/#u Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=30112 Thanks-to: Doug Freed <dwfreed@mtu.edu> Signed-off-by: Sam James <sam@gentoo.org> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
* macsec: Fix Macsec packet number attribute printEmeel Hakim2023-01-251-4/+4
| | | | | | | | | | | | | Currently Macsec print routines uses a 32 bit print routine to print out the value of the packet number (PN) attribute, a miss use of the 32 bit print routine is causing a miss print of only the 32 least significant bit (LSB) of an extended packet number (XPN) which is a 64 bit attribute. Fixes: 6ce23b7c2d79 ("macsec: add Extended Packet Number support") Signed-off-by: Emeel Hakim <ehakim@nvidia.com> Reviewed-by: Simon Horman <simon.horman@corigine.com> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
* add space after keywordStephen Hemminger2023-01-161-1/+1
| | | | | | | | | | The style standard is to use space after keywords. Example: if (expr) verus if(expr) Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
* macsec: Fix Macsec replay protectionEmeel Hakim2023-01-151-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | Currently when configuring macsec with replay protection, replay protection and window gets a default value of -1, the above is leading to passing replay protection and replay window attributes to the kernel while replay is explicitly set to off, leading for an invalid argument error when configured with extended packet number (XPN). since the default window value which is 0xFFFFFFFF is passed to the kernel and while XPN is configured the above value is an invalid window value. Example: ip link add link eth2 macsec0 type macsec sci 1 cipher gcm-aes-xpn-128 replay off RTNETLINK answers: Invalid argument Fix by passing the window attribute to the kernel only if replay is on Fixes: b26fc590ce62 ("ip: add MACsec support") Signed-off-by: Emeel Hakim <ehakim@nvidia.com> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
* ip: use SPDXStephen Hemminger2023-01-1460-432/+67
| | | | | | | Use SPDX instead of boilerplate text for ip and related sub commands. Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
* mptcp: add new listener eventsMatthieu Baerts2023-01-101-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These new events have been added in kernel commit f8c9dfbd875b ("mptcp: add pm listener events") by Geliang Tang. Two new MPTCP Netlink event types for PM listening socket creation and closure have been recently added. They will be available in the future v6.2 kernel. They have been added because MPTCP for Linux, when not using the in-kernel PM, depends on the userspace PM to create extra listening sockets -- called "PM listeners" -- before announcing addresses and ports. With the existing MPTCP Netlink events, a userspace PM can create PM listeners at startup time, or in response to an incoming connection. Creating sockets in response to connections is not optimal: ADD_ADDRs can't be sent until the sockets are created and listen()ed, and if all connections are closed then it may not be clear to the userspace PM daemon that PM listener sockets should be cleaned up. Hence these new events: PM listening sockets can be managed based on application activity. Note that the maximum event string size has to be increased by 2 to be able to display LISTENER_CREATED without truncated it. Also, as pointed by Mat, this event doesn't have any "token" attribute so this attribute is now printed only if it is available. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/313 Cc: Geliang Tang <geliang.tang@suse.com> Acked-by: Mat Martineau <mathew.j.martineau@linux.intel.com> Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
* Merge branch 'main' into nextDavid Ahern2022-12-161-6/+16
|\ | | | | | | | | | | | | Conflicts: devlink/devlink.c Signed-off-by: David Ahern <dsahern@kernel.org>
| * ip: print mpls errors on stderrStephen Hemminger2022-12-121-1/+1
| | | | | | | | | | | | Error messages should go on stderr. Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
| * iplink: support JSON in MPLS outputStephen Hemminger2022-12-091-5/+14
| | | | | | | | | | | | | | | | The MPLS statistics did not support oneline or JSON in current code. Fixes: 837552b445f5 ("iplink: add support for afstats subcommand") Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
| * ip-link: man: Document existence of netns argument in add commandDaniel Xu2022-12-091-0/+1
| | | | | | | | | | | | | | | | ip-link-add supports netns argument just like ip-link-set. This commit documents the existence of netns in help text and man page. Signed-off-by: Daniel Xu <dxu@dxuuu.xyz> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
* | xfrm: add an interface to offload policyLeon Romanovsky2022-12-144-10/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Extend at "ip xfrm policy" to allow policy offload to specific device. The syntax and the code follow already established pattern from the state offload. The only difference between them is that direction was already mandatory argument in policy configuration commands, so don't need to add direction handling logic like it was done for the state offload. The syntax is as follows: $ ip xfrm policy .... offload packet dev <if-name> Signed-off-by: Leon Romanovsky <leonro@nvidia.com> Signed-off-by: David Ahern <dsahern@kernel.org>
* | xfrm: add packet offload mode to xfrm stateLeon Romanovsky2022-12-142-4/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow users to configure xfrm states with packet offload type. Packet offload mode: ip xfrm state offload packet dev <if-name> dir <in|out> Crypto offload mode: ip xfrm state offload crypto dev <if-name> dir <in|out> ip xfrm state offload dev <if-name> dir <in|out> The latter variant configures crypto offload mode and is needed to provide backward compatibility. Signed-off-by: Leon Romanovsky <leonro@nvidia.com> Signed-off-by: David Ahern <dsahern@kernel.org>
* | xfrm: prepare state offload logic to set modeLeon Romanovsky2022-12-141-16/+19
| | | | | | | | | | | | | | | | | | | | | | | | The offload in xfrm state requires to provide device and direction in order to activate it. However, in the help section, device and direction were displayed as an optional. As a preparation to addition of packet offload, let's fix the help section and refactor the code to be more clear. Signed-off-by: Leon Romanovsky <leonro@nvidia.com> Signed-off-by: David Ahern <dsahern@kernel.org>
* | Merge branch 'main' into nextDavid Ahern2022-12-027-31/+34
|\ \ | |/ | | | | Signed-off-by: David Ahern <dsahern@kernel.org>
| * ip: fix return value for rtnl_talk failuresHangbin Liu2022-11-285-9/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Since my last commit "rtnetlink: add new function rtnl_echo_talk()" we return the kernel rtnl exit code directly, which breaks some kernel selftest checking. As there are still a lot of tests checking -2 as the error return value, to keep backward compatibility, let's keep using -2 for all the rtnl return values. Reported-by: Ido Schimmel <idosch@idosch.org> Fixes: 6c09257f1bf6 ("rtnetlink: add new function rtnl_echo_talk()") Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> Tested-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
| * remove #if 0 codeStephen Hemminger2022-11-222-22/+1
| | | | | | | | | | | | | | Let's not keep unused code. The YAGNI means that this dead code doesn't work now, and if it did it would have to change. Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
* | ip neigh: Support --json on ip neigh getLeonard Crestez2022-12-021-0/+3
| | | | | | | | | | | | | | | | | | | | The ip neigh command supports --json for "list" but not for "get". Add json support for the "get" command so that it's possible to fetch information about specific neighbors without regular expressions. Fixes: aac7f725fa46 ("ipneigh: add color and json support") Signed-off-by: Leonard Crestez <cdleonard@gmail.com> Signed-off-by: David Ahern <dsahern@kernel.org>
* | Merge branch 'main' into nextDavid Ahern2022-11-132-4/+8
|\ \ | |/ | | | | | | | | | | Conflicts: include/uapi/linux/bpf.h Signed-off-by: David Ahern <dsahern@kernel.org>
| * ip-monitor: Do not error out when RTNLGRP_STATS is not availableBenjamin Poirier2022-10-261-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Following commit 4e8a9914c4d4 ("ip-monitor: Include stats events in default and "all" cases"), `ip monitor` fails to start on kernels which do not contain linux.git commit 5fd0b838efac ("net: rtnetlink: Add UAPI toggle for IFLA_OFFLOAD_XSTATS_L3_STATS") because the netlink group RTNLGRP_STATS doesn't exist: $ ip monitor Failed to add stats group to list When "stats" is not explicitly requested, ignore the error so that `ip monitor` and `ip monitor all` continue to work on older kernels. Note that the same change is not done for RTNLGRP_NEXTHOP because its value is 32 and group numbers <= 32 are always supported; see the comment above netlink_change_ngroups() in the kernel source. Therefore NETLINK_ADD_MEMBERSHIP 32 does not error out even on kernels which do not support RTNLGRP_NEXTHOP. v2: * Silently ignore a failure to implicitly add the stats group, instead of printing a warning. Reported-by: Stephen Hemminger <stephen@networkplumber.org> Fixes: 4e8a9914c4d4 ("ip-monitor: Include stats events in default and "all" cases") Signed-off-by: Benjamin Poirier <bpoirier@nvidia.com> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
| * iplink_can: add missing `]' of the bitrate, dbitrate and termination arraysVincent Mailhol2022-10-171-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The command "ip --details link show canX" misses the closing bracket `]' of the bitrate, the dbitrate and the termination arrays. The --json output is not impacted. Change the first argument of close_json_array() from PRINT_JSON to PRINT_ANY to fix the problem. The second argument was already set correctly. Fixes: 67f3c7a5cc0d ("iplink_can: use PRINT_ANY to factorize code and fix signedness") Reported-by: Marc Kleine-Budde <mkl@pengutronix.de> Acked-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
* | bridge: link: Add MAC Authentication Bypass (MAB) supportHans Schultz2022-11-071-0/+9
|/ | | | | | | | | Add MAB support in bridge(8) and ip(8), allowing these utilities to enable / disable MAB and display its current status. Signed-off-by: Hans Schultz <netdev@kapio-technology.com> Signed-off-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: David Ahern <dsahern@kernel.org>
* Merge remote-tracking branch 'main/main' into nextDavid Ahern2022-10-031-73/+42
|\ | | | | | | Signed-off-by: David Ahern <dsahern@kernel.org>
| * ip-monitor: Fix the selection of rtnl groups when listening for all object typesBenjamin Poirier2022-09-301-86/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, when using `ip monitor`, family-specific rtnl multicast groups (ex. RTNLGRP_IPV4_IFADDR) are used when specifying the '-family' option (or one of its short forms) and an object type is specified (ex. `ip -4 monitor addr`) but not when listening for changes to all object types (ex. `ip -4 monitor`). In that case, multicast groups for all families, regardless of the '-family' option, are used. Depending on the object type, this leads to ignoring the '-family' selection (MROUTE, ADDR, NETCONF), or printing stray prefix headers with no event (ROUTE, RULE). Rewrite the parameter parsing code so that per-family rtnl multicast groups are selected in all cases. The issue can be witnessed while running `ip -4 monitor label` at the same time as the following command: ip link add dummy0 address 02:00:00:00:00:01 up type dummy The output includes: [ROUTE][ROUTE][ADDR]9: dummy0 inet6 fe80::ff:fe00:1/64 scope link valid_lft forever preferred_lft forever Notice the stray "[ROUTE]" labels (related to filtered out ipv6 routes) and the ipv6 ADDR entry. Those do not appear if using `ip -4 monitor label route address`. Fixes: aba5acdfdb34 ("(Logical change 1.3)") Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Benjamin Poirier <bpoirier@nvidia.com> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
| * ip-monitor: Include stats events in default and "all" casesBenjamin Poirier2022-09-301-1/+13
| | | | | | | | | | | | | | | | | | | | | | It seems that stats were omitted from `ip monitor` and `ip monitor all`. Since all other event types are included, include stats as well. Use the same logic as for nexthops. Fixes: a05a27c07cbf ("ipmonitor: Add monitoring support for stats events") Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Benjamin Poirier <bpoirier@nvidia.com> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
| * ip-monitor: Do not listen for nexthops by default when specifying statsBenjamin Poirier2022-09-301-0/+1
| | | | | | | | | | | | | | | | | | | | `ip monitor stats` listens for changes to nexthops and stats. It should listen for stats only. Fixes: a05a27c07cbf ("ipmonitor: Add monitoring support for stats events") Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Benjamin Poirier <bpoirier@nvidia.com> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
* | ip: xfrm: support adding xfrm metadata as lwtunnel info in routesEyal Birger2022-10-032-2/+86
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Support for xfrm metadata as lwtunnel metadata was added in kernel commit 2c2493b9da91 ("xfrm: lwtunnel: add lwtunnel support for xfrm interfaces in collect_md mode") This commit adds the respective support in lwt routes. Example use (consider ipsec1 as an xfrm interface in "external" mode): ip route add 10.1.0.0/24 dev ipsec1 encap xfrm if_id 1 Or in the context of vrf, one can also specify the "link" property: ip route add 10.1.0.0/24 dev ipsec1 encap xfrm if_id 1 link_dev eth15 Signed-off-by: Eyal Birger <eyal.birger@gmail.com> Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: David Ahern <dsahern@kernel.org>
* | ip: xfrm: support "external" (`collect_md`) mode in xfrm interfacesEyal Birger2022-10-031-0/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Support for collect metadata mode was introduced in kernel commit abc340b38ba2 ("xfrm: interface: support collect metadata mode") This commit adds support for creating xfrm interfaces in this mode. Example use: ip link add ipsec1 type xfrm external Signed-off-by: Eyal Birger <eyal.birger@gmail.com> Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: David Ahern <dsahern@kernel.org>
* | iplink_bridge: Add no_linklocal_learn option supportIdo Schimmel2022-10-031-0/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Kernel commit 70e4272b4c81 ("net: bridge: add no_linklocal_learn bool option") added the no_linklocal_learn bridge option that can be set via sysfs or netlink. Add iproute2 support, allowing it to query and set the option via netlink. The option is useful, for example, in scenarios where we want the bridge to be able to refresh dynamic FDB entries that were added by user space and are pointing to locked bridge ports, but do not want the bridge to populate its FDB from EAPOL frames used for authentication. Example: $ ip -j -d link show dev br0 | jq ".[][\"linkinfo\"][\"info_data\"][\"no_linklocal_learn\"]" 0 $ cat /sys/class/net/br0/bridge/no_linklocal_learn 0 # ip link set dev br0 type bridge no_linklocal_learn 1 $ ip -j -d link show dev br0 | jq ".[][\"linkinfo\"][\"info_data\"][\"no_linklocal_learn\"]" 1 $ cat /sys/class/net/br0/bridge/no_linklocal_learn 1 # ip link set dev br0 type bridge no_linklocal_learn 0 $ ip -j -d link show dev br0 | jq ".[][\"linkinfo\"][\"info_data\"][\"no_linklocal_learn\"]" 0 $ cat /sys/class/net/br0/bridge/no_linklocal_learn 0 Signed-off-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: David Ahern <dsahern@kernel.org>
* | rtnetlink: add new function rtnl_echo_talk()Hangbin Liu2022-09-295-100/+11
| | | | | | | | | | | | | | | | | | | | Add a new function rtnl_echo_talk() that could be used when the sub-component supports NLM_F_ECHO flag. With this function we can remove the redundant code added by commit b264b4c6568c7 ("ip: add NLM_F_ECHO support"). Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> Signed-off-by: David Ahern <dsahern@kernel.org>
* | ip link: add sub-command to view and change DSA conduit interfaceVladimir Oltean2022-09-273-2/+70
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Support the "dsa" kind of rtnl_link_ops exported by the kernel, and export reads/writes to IFLA_DSA_MASTER. Examples: $ ip link set swp0 type dsa conduit eth1 $ ip -d link show dev swp0 (...) dsa conduit eth0 $ ip -d -j link show swp0 [ { "link": "eth1", "linkinfo": { "info_kind": "dsa", "info_data": { "conduit": "eth1" } }, } ] Note that by construction and as shown in the example, the IFLA_LINK reported by a DSA user port is identical to what is reported through IFLA_DSA_MASTER. However IFLA_LINK is not writable, and overloading its meaning to make it writable would clash with other users of IFLA_LINK (vlan etc) for which writing this property does not make sense. Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Signed-off-by: David Ahern <dsahern@kernel.org>
View Lorry Controller Status