* Retrieving the network namespace of a socket
@ 2021-10-20 9:57 Sargun Dhillon
2021-10-20 14:03 ` Sergey Ryazanov
0 siblings, 1 reply; 6+ messages in thread
From: Sargun Dhillon @ 2021-10-20 9:57 UTC (permalink / raw)
To: LKML, netdev, Christian Brauner
I'm working on a problem where I need to determine which network namespace a
given socket is in. I can currently bruteforce this by using INET_DIAG, and
enumerating namespaces and working backwards.
I was wondering if anyone had any suggestions on where to add this capability,
or suggestions how on how it might look? It appears like using network namespace
IDs is the thing to do -- I'm unsure of whether this API fits better into
ioctl_ns, getsockopt, netlink, or even somewhere in proc. I'm curious what
people think. I think that the "easiest" way would be to drop it into fdinfo
in proc.
Alternatively, I may have overlooked an existing API.
-Thanks,
Sargun
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Retrieving the network namespace of a socket
2021-10-20 9:57 Retrieving the network namespace of a socket Sargun Dhillon
@ 2021-10-20 14:03 ` Sergey Ryazanov
2021-10-20 16:34 ` Sargun Dhillon
0 siblings, 1 reply; 6+ messages in thread
From: Sergey Ryazanov @ 2021-10-20 14:03 UTC (permalink / raw)
To: Sargun Dhillon; +Cc: LKML, netdev, Christian Brauner
Hello Sargun,
On Wed, Oct 20, 2021 at 12:57 PM Sargun Dhillon <sargun@sargun.me> wrote:
> I'm working on a problem where I need to determine which network namespace a
> given socket is in. I can currently bruteforce this by using INET_DIAG, and
> enumerating namespaces and working backwards.
Namespace is not a per-socket, but a per-process attribute. So each
socket of a process belongs to the same namespace.
Could you elaborate what kind of problem you are trying to solve?
Maybe there is a more simple solution. for it.
--
Sergey
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Retrieving the network namespace of a socket
2021-10-20 14:03 ` Sergey Ryazanov
@ 2021-10-20 16:34 ` Sargun Dhillon
2021-10-20 19:24 ` Sargun Dhillon
2021-10-20 20:02 ` Sergey Ryazanov
0 siblings, 2 replies; 6+ messages in thread
From: Sargun Dhillon @ 2021-10-20 16:34 UTC (permalink / raw)
To: Sergey Ryazanov; +Cc: LKML, netdev, Christian Brauner
On Wed, Oct 20, 2021 at 05:03:56PM +0300, Sergey Ryazanov wrote:
> Hello Sargun,
>
> On Wed, Oct 20, 2021 at 12:57 PM Sargun Dhillon <sargun@sargun.me> wrote:
> > I'm working on a problem where I need to determine which network namespace a
> > given socket is in. I can currently bruteforce this by using INET_DIAG, and
> > enumerating namespaces and working backwards.
>
> Namespace is not a per-socket, but a per-process attribute. So each
> socket of a process belongs to the same namespace.
>
> Could you elaborate what kind of problem you are trying to solve?
> Maybe there is a more simple solution. for it.
>
> --
> Sergey
That's not entirely true. See the folowing code:
int main() {
int fd1, fd2;
fd1 = socket(AF_INET, SOCK_STREAM, 0);
assert(fd1 >= 0);
assert(unshare(CLONE_NEWNET) == 0);
fd2 = socket(AF_INET, SOCK_STREAM, 0);
assert(fd2 >= 0);
}
fd1 and fd2 have different sock_net.
The context for this is:
https://linuxplumbersconf.org/event/11/contributions/932/
We need to figure out, for a given socket, if it has reachability to a given IP.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Retrieving the network namespace of a socket
2021-10-20 16:34 ` Sargun Dhillon
@ 2021-10-20 19:24 ` Sargun Dhillon
2021-10-21 9:20 ` Christian Brauner
2021-10-20 20:02 ` Sergey Ryazanov
1 sibling, 1 reply; 6+ messages in thread
From: Sargun Dhillon @ 2021-10-20 19:24 UTC (permalink / raw)
To: Sergey Ryazanov; +Cc: LKML, netdev, Christian Brauner
On Wed, Oct 20, 2021 at 04:34:18PM +0000, Sargun Dhillon wrote:
> On Wed, Oct 20, 2021 at 05:03:56PM +0300, Sergey Ryazanov wrote:
> > Hello Sargun,
> >
> > On Wed, Oct 20, 2021 at 12:57 PM Sargun Dhillon <sargun@sargun.me> wrote:
> > > I'm working on a problem where I need to determine which network namespace a
> > > given socket is in. I can currently bruteforce this by using INET_DIAG, and
> > > enumerating namespaces and working backwards.
> >
> > Namespace is not a per-socket, but a per-process attribute. So each
> > socket of a process belongs to the same namespace.
> >
> > Could you elaborate what kind of problem you are trying to solve?
> > Maybe there is a more simple solution. for it.
> >
> > --
> > Sergey
>
> That's not entirely true. See the folowing code:
>
> int main() {
> int fd1, fd2;
> fd1 = socket(AF_INET, SOCK_STREAM, 0);
> assert(fd1 >= 0);
> assert(unshare(CLONE_NEWNET) == 0);
> fd2 = socket(AF_INET, SOCK_STREAM, 0);
> assert(fd2 >= 0);
> }
>
> fd1 and fd2 have different sock_net.
>
> The context for this is:
> https://linuxplumbersconf.org/event/11/contributions/932/
>
> We need to figure out, for a given socket, if it has reachability to a given IP.
So, I was lazy / misread documentation. It turns out SIOCGSKNS does exactly
what I need.
Nonetheless, it's a little weird and awkward that it is exists. I was wondering
if this functionality made sense as part of kcmp. I wrote up a quick patch
to see if anyone was interested:
diff --git a/include/uapi/linux/kcmp.h b/include/uapi/linux/kcmp.h
index ef1305010925..d6b9c3923d20 100644
--- a/include/uapi/linux/kcmp.h
+++ b/include/uapi/linux/kcmp.h
@@ -14,6 +14,7 @@ enum kcmp_type {
KCMP_IO,
KCMP_SYSVSEM,
KCMP_EPOLL_TFD,
+ KCMP_NETNS,
KCMP_TYPES,
};
diff --git a/kernel/kcmp.c b/kernel/kcmp.c
index 5353edfad8e1..8fadae4b588f 100644
--- a/kernel/kcmp.c
+++ b/kernel/kcmp.c
@@ -18,6 +18,8 @@
#include <linux/file.h>
#include <asm/unistd.h>
+#include <net/net_namespace.h>
+#include <net/sock.h>
/*
* We don't expose the real in-memory order of objects for security reasons.
@@ -132,6 +134,58 @@ static int kcmp_epoll_target(struct task_struct *task1,
}
#endif
+#ifdef CONFIG_NET
+static int __kcmp_netns_target(struct task_struct *task1,
+ struct task_struct *task2,
+ struct file *filp1,
+ struct file *filp2)
+{
+ struct socket *sock1, *sock2;
+ struct net *net1, *net2;
+
+ sock1 = sock_from_file(filp1);
+ sock2 = sock_from_file(filp1);
+ if (!sock1 || !sock2)
+ return -ENOTSOCK;
+
+ net1 = sock_net(sock1->sk);
+ net2 = sock_net(sock2->sk);
+
+ return kcmp_ptr(net1, net2, KCMP_NETNS);
+}
+
+static int kcmp_netns_target(struct task_struct *task1,
+ struct task_struct *task2,
+ unsigned long idx1,
+ unsigned long idx2)
+{
+ struct file *filp1, *filp2;
+
+ int ret = -EBADF;
+
+ filp1 = fget_task(task1, idx1);
+ if (filp1) {
+ filp2 = fget_task(task2, idx2);
+ if (filp2) {
+ ret = __kcmp_netns_target(task1, task2, filp1, filp2);
+ fput(filp2);
+ }
+
+ fput(filp1);
+ }
+
+ return ret;
+}
+#else
+static int kcmp_netns_target(struct task_struct *task1,
+ struct task_struct *task2,
+ unsigned long idx1,
+ unsigned long idx2)
+{
+ return -EOPNOTSUPP;
+}
+#endif
+
SYSCALL_DEFINE5(kcmp, pid_t, pid1, pid_t, pid2, int, type,
unsigned long, idx1, unsigned long, idx2)
{
@@ -206,6 +260,9 @@ SYSCALL_DEFINE5(kcmp, pid_t, pid1, pid_t, pid2, int, type,
case KCMP_EPOLL_TFD:
ret = kcmp_epoll_target(task1, task2, idx1, (void *)idx2);
break;
+ case KCMP_NETNS:
+ ret = kcmp_netns_target(task1, task2, idx1, idx2);
+ break;
default:
ret = -EINVAL;
break;
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: Retrieving the network namespace of a socket
2021-10-20 16:34 ` Sargun Dhillon
2021-10-20 19:24 ` Sargun Dhillon
@ 2021-10-20 20:02 ` Sergey Ryazanov
1 sibling, 0 replies; 6+ messages in thread
From: Sergey Ryazanov @ 2021-10-20 20:02 UTC (permalink / raw)
To: Sargun Dhillon; +Cc: LKML, netdev, Christian Brauner
On Wed, Oct 20, 2021 at 7:34 PM Sargun Dhillon <sargun@sargun.me> wrote:
> On Wed, Oct 20, 2021 at 05:03:56PM +0300, Sergey Ryazanov wrote:
>> On Wed, Oct 20, 2021 at 12:57 PM Sargun Dhillon <sargun@sargun.me> wrote:
>>> I'm working on a problem where I need to determine which network namespace a
>>> given socket is in. I can currently bruteforce this by using INET_DIAG, and
>>> enumerating namespaces and working backwards.
>>
>> Namespace is not a per-socket, but a per-process attribute. So each
>> socket of a process belongs to the same namespace.
>>
> > Could you elaborate what kind of problem you are trying to solve?
>> Maybe there is a more simple solution. for it.
>
> That's not entirely true. See the folowing code:
>
> int main() {
> int fd1, fd2;
> fd1 = socket(AF_INET, SOCK_STREAM, 0);
> assert(fd1 >= 0);
> assert(unshare(CLONE_NEWNET) == 0);
> fd2 = socket(AF_INET, SOCK_STREAM, 0);
> assert(fd2 >= 0);
> }
>
> fd1 and fd2 have different sock_net.
Ouch, I totally missed this case. Thank you for reminding me.
--
Sergey
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Retrieving the network namespace of a socket
2021-10-20 19:24 ` Sargun Dhillon
@ 2021-10-21 9:20 ` Christian Brauner
0 siblings, 0 replies; 6+ messages in thread
From: Christian Brauner @ 2021-10-21 9:20 UTC (permalink / raw)
To: Sargun Dhillon; +Cc: Sergey Ryazanov, LKML, netdev
On Wed, Oct 20, 2021 at 07:24:57PM +0000, Sargun Dhillon wrote:
> On Wed, Oct 20, 2021 at 04:34:18PM +0000, Sargun Dhillon wrote:
> > On Wed, Oct 20, 2021 at 05:03:56PM +0300, Sergey Ryazanov wrote:
> > > Hello Sargun,
> > >
> > > On Wed, Oct 20, 2021 at 12:57 PM Sargun Dhillon <sargun@sargun.me> wrote:
> > > > I'm working on a problem where I need to determine which network namespace a
> > > > given socket is in. I can currently bruteforce this by using INET_DIAG, and
> > > > enumerating namespaces and working backwards.
> > >
> > > Namespace is not a per-socket, but a per-process attribute. So each
> > > socket of a process belongs to the same namespace.
> > >
> > > Could you elaborate what kind of problem you are trying to solve?
> > > Maybe there is a more simple solution. for it.
> > >
> > > --
> > > Sergey
> >
> > That's not entirely true. See the folowing code:
> >
> > int main() {
> > int fd1, fd2;
> > fd1 = socket(AF_INET, SOCK_STREAM, 0);
> > assert(fd1 >= 0);
> > assert(unshare(CLONE_NEWNET) == 0);
> > fd2 = socket(AF_INET, SOCK_STREAM, 0);
> > assert(fd2 >= 0);
> > }
> >
> > fd1 and fd2 have different sock_net.
> >
> > The context for this is:
> > https://linuxplumbersconf.org/event/11/contributions/932/
> >
> > We need to figure out, for a given socket, if it has reachability to a given IP.
>
> So, I was lazy / misread documentation. It turns out SIOCGSKNS does exactly
> what I need.
I was about to reply with this. :) It's heavily used in CRIU and we use
it in LXC/LXD as well.
>
> Nonetheless, it's a little weird and awkward that it is exists. I was wondering
> if this functionality made sense as part of kcmp. I wrote up a quick patch
> to see if anyone was interested:
Per se I don't see a reason why this shouldn't exist as an extension to
kcmp(). It seems useful.
>
> diff --git a/include/uapi/linux/kcmp.h b/include/uapi/linux/kcmp.h
> index ef1305010925..d6b9c3923d20 100644
> --- a/include/uapi/linux/kcmp.h
> +++ b/include/uapi/linux/kcmp.h
> @@ -14,6 +14,7 @@ enum kcmp_type {
> KCMP_IO,
> KCMP_SYSVSEM,
> KCMP_EPOLL_TFD,
> + KCMP_NETNS,
>
> KCMP_TYPES,
> };
> diff --git a/kernel/kcmp.c b/kernel/kcmp.c
> index 5353edfad8e1..8fadae4b588f 100644
> --- a/kernel/kcmp.c
> +++ b/kernel/kcmp.c
> @@ -18,6 +18,8 @@
> #include <linux/file.h>
>
> #include <asm/unistd.h>
> +#include <net/net_namespace.h>
> +#include <net/sock.h>
>
> /*
> * We don't expose the real in-memory order of objects for security reasons.
> @@ -132,6 +134,58 @@ static int kcmp_epoll_target(struct task_struct *task1,
> }
> #endif
>
> +#ifdef CONFIG_NET
> +static int __kcmp_netns_target(struct task_struct *task1,
> + struct task_struct *task2,
> + struct file *filp1,
> + struct file *filp2)
> +{
> + struct socket *sock1, *sock2;
> + struct net *net1, *net2;
> +
> + sock1 = sock_from_file(filp1);
> + sock2 = sock_from_file(filp1);
> + if (!sock1 || !sock2)
> + return -ENOTSOCK;
> +
> + net1 = sock_net(sock1->sk);
> + net2 = sock_net(sock2->sk);
> +
> + return kcmp_ptr(net1, net2, KCMP_NETNS);
> +}
> +
> +static int kcmp_netns_target(struct task_struct *task1,
> + struct task_struct *task2,
> + unsigned long idx1,
> + unsigned long idx2)
> +{
> + struct file *filp1, *filp2;
> +
> + int ret = -EBADF;
> +
> + filp1 = fget_task(task1, idx1);
> + if (filp1) {
> + filp2 = fget_task(task2, idx2);
> + if (filp2) {
> + ret = __kcmp_netns_target(task1, task2, filp1, filp2);
> + fput(filp2);
> + }
> +
> + fput(filp1);
> + }
> +
> + return ret;
> +}
> +#else
> +static int kcmp_netns_target(struct task_struct *task1,
> + struct task_struct *task2,
> + unsigned long idx1,
> + unsigned long idx2)
> +{
> + return -EOPNOTSUPP;
> +}
> +#endif
> +
> SYSCALL_DEFINE5(kcmp, pid_t, pid1, pid_t, pid2, int, type,
> unsigned long, idx1, unsigned long, idx2)
> {
> @@ -206,6 +260,9 @@ SYSCALL_DEFINE5(kcmp, pid_t, pid1, pid_t, pid2, int, type,
> case KCMP_EPOLL_TFD:
> ret = kcmp_epoll_target(task1, task2, idx1, (void *)idx2);
> break;
> + case KCMP_NETNS:
> + ret = kcmp_netns_target(task1, task2, idx1, idx2);
> + break;
> default:
> ret = -EINVAL;
> break;
>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-10-21 9:20 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-20 9:57 Retrieving the network namespace of a socket Sargun Dhillon
2021-10-20 14:03 ` Sergey Ryazanov
2021-10-20 16:34 ` Sargun Dhillon
2021-10-20 19:24 ` Sargun Dhillon
2021-10-21 9:20 ` Christian Brauner
2021-10-20 20:02 ` Sergey Ryazanov
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.