From nobody Thu Nov 5 07:29:38 2026 Authentication-Results: smtp.subspace.kernel.org; arc=pass header.oldest-pass=0 smtp.remote-ip=165.173.180.54 ARC-Seal: i=2; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=pass; t=1793176067; b=TMQawFSUXNPgnQI9M3FRllLIPL88UTUBnGvTfux4M7yAGXAwlH9FdAIu7UqtURgibIt+ XDsX2POdyC+TtBVJ25nd3nwld/9eiMZUV6FIlLj9hWaWPxCqGxkYbYObLkWF7jM4jbTkc ohjd1laQKd/xDOnZFmH7+RjrzH0HH2vOcuLkE9NOuU/Y9heiea6V/eTt+EUx7xwFmrvFL XVgq7IdCmCiQm0iTcCgjLuOBokD5AIDrSFZ8VoiLVu/8tE8oG91fP9a0LypkCJKWZLTsE b+Tqbcrg/i6OOU7PxmRrhJuC3rOUZ1h78RuIp6L8NoewCCxdBSeHYgkiLsXtaVHZ09A== ARC-Message-Signature: i=2; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793176067; h=DMARC-Filter:DKIM-Signature:Received:From:To:Cc:Subject:Date: Message-ID:X-Mailer:In-Reply-To:References:MIME-Version: Content-Transfer-Encoding:X-ZohoMailClient; bh=myM/NwutGCZOyeD1H4WToSGlYN7DqWtaA9tPjs0fpP0=; b=5HoWij46ig69XO/B0bdJFvdTw2s+AHkXrmNlnIIzeuTd/Y80veb4WXPrqD0pACQF1++Y 3aXbmS5nk5xqRmShXwrXFW47o5QvmHGQUDG0/vZYDByrp1zBrExXiUZTkhLsHG6XzvYmi ma15hi0qeC2nCrvb70/kFo9RpweYf/BMUPspzIfjhgMwSW/7VZEtNucpV1A59k1aMClKg 4q6IvIXkr3pcfserTHZ94xFeFU2mOCVedC32IDYaKs6jctlVXeOmUB6+40EpMlYv9MYOz smI7jvaprh6my74VMITJ+ulNHKBfyIzuEkTdLA+uIS4O4ltYFLdl3mghSP0WLGJKybw== ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass header.from=mpiricsoftware.com; spf=pass smtp.mailfrom=mpiricsoftware.com; arc=pass header.oldest-pass=0 smtp.remote-ip=165.173.180.54 Received: from sender6-of-o54.zoho.com (sender6-of-o54.zoho.com [165.173.180.54]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E6B34606A31D for ; Wed, 28 Oct 2026 08:27:46 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org E6B34606A31D Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mpiricsoftware.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mpiricsoftware.com ARC-Seal: i=1; a=rsa-sha256; t=1793176057; cv=none; d=zohomail.com; s=zohoarc; b=ExSEXI2BEp3D/p4wP7Oy3FrT8GVNHD2UPFhot8vC1ZRHnE79aRf4AXEYryVbY+6t9KGE/1d1hCEyK3H1+2mm43tt5Xy3MKdH2ViOG500gjLDPTe3CbUUonJy3yBJe0nzvwZkJPCRK/H6n8BmBCAq7KlBw347hlgrpxgtI3Wz/hE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793176057; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=myM/NwutGCZOyeD1H4WToSGlYN7DqWtaA9tPjs0fpP0=; b=KgC6mU7tCzVhs0xr3tQq6hU0UF735YlXnQAQF1VsEIIOAyP+QtGqaAe8PTCpU8R3HwfU3V5oXTni+G1GIXhKlu3/Vuu0IM/Q9XSW8/VdgGPPjc++f05rweV1v/FW/lH1cxRi1KlpENihMROzBTO/hoehjdYYVUqDdBX9KClRaaU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=mpiricsoftware.com; spf=pass smtp.mailfrom=kalpan.jani@mpiricsoftware.com; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1793176057; s=mpiric; d=mpiricsoftware.com; i=kalpan.jani@mpiricsoftware.com; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:In-Reply-To:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=myM/NwutGCZOyeD1H4WToSGlYN7DqWtaA9tPjs0fpP0=; b=m9h+e0jC7f+h7Cb6o43k/Xo0qb4nBhudcwHqzxSZdKR09/izEAZ4pElGUjMuQumr 0a5jibu2lemUn73Nl/E5L5Fpj6tbBVvn44isBNE9LNhLopMCJKDGFyPKvicgLNptG2t hah10mmOGTFECuTc9FrrY87lwMpq0PLHtlG3kqow= Received: by smtp.zohomail.com with SMTPS id 1793176054284430.2233145702239; Wed, 28 Oct 2026 01:27:34 -0700 (PDT) From: Kalpan Jani To: mptcp@lists.linux.dev Cc: matttbe@kernel.org, Kalpan Jani , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Neal Cardwell , Kuniyuki Iwashima , Mat Martineau , Geliang Tang , Marcelo Ricardo Leitner , Xin Long , Kees Cook , David Ahern , Willem de Bruijn , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-sctp@vger.kernel.org Subject: [RFC net-next v11 1/2] inet_diag: pass net_admin to get_info Date: Wed, 28 Oct 2026 13:57:00 +0530 Message-ID: <20261028082704.1609493-2-kalpan.jani@mpiricsoftware.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261028082704.1609493-1-kalpan.jani@mpiricsoftware.com> References: <1ec0c2b5-a0fa-44e8-9ae8-dca9b7f90ec6@kernel.org> <20261028082704.1609493-1-kalpan.jani@mpiricsoftware.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Content-Type: text/plain; charset="utf-8" Pass the request's CAP_NET_ADMIN status to idiag_get_info() so protocol-specific diagnostic handlers can restrict privileged information. Socket-destruction notifications have no individual requesting user, so the callback receives net_admin set to false for that path. Signed-off-by: Kalpan Jani --- include/linux/inet_diag.h | 3 ++- net/ipv4/inet_diag.c | 6 +++--- net/ipv4/raw_diag.c | 2 +- net/ipv4/tcp_diag.c | 2 +- net/ipv4/udp_diag.c | 2 +- net/mptcp/mptcp_diag.c | 2 +- net/sctp/diag.c | 6 +++--- 7 files changed, 12 insertions(+), 11 deletions(-) diff --git a/include/linux/inet_diag.h b/include/linux/inet_diag.h index 704fd415c2b49..8db96bfd3e67f 100644 --- a/include/linux/inet_diag.h +++ b/include/linux/inet_diag.h @@ -18,7 +18,8 @@ struct inet_diag_handler { =20 void (*idiag_get_info)(struct sock *sk, struct inet_diag_msg *r, - void *info); + void *info, + bool net_admin); =20 int (*idiag_get_aux)(struct sock *sk, bool net_admin, diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c index 34b77aa87d0a4..362161bf39fe3 100644 --- a/net/ipv4/inet_diag.c +++ b/net/ipv4/inet_diag.c @@ -276,7 +276,7 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_conn= ection_sock *icsk, } =20 if (!icsk) { - handler->idiag_get_info(sk, r, NULL); + handler->idiag_get_info(sk, r, NULL, net_admin); goto out; } =20 @@ -327,7 +327,7 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_conn= ection_sock *icsk, goto errout; } =20 - handler->idiag_get_info(sk, r, info); + handler->idiag_get_info(sk, r, info, net_admin); =20 if (ext & (1 << (INET_DIAG_INFO - 1)) && handler->idiag_get_aux) if (handler->idiag_get_aux(sk, net_admin, skb) < 0) @@ -1027,7 +1027,7 @@ int inet_diag_handler_get_info(struct sk_buff *skb, s= truct sock *sk) if (attr) info =3D nla_data(attr); =20 - handler->idiag_get_info(sk, r, info); + handler->idiag_get_info(sk, r, info, false); inet_diag_unlock_handler(handler); =20 nlmsg_end(skb, nlh); diff --git a/net/ipv4/raw_diag.c b/net/ipv4/raw_diag.c index 943e5998e0ad5..264912d0cb9fc 100644 --- a/net/ipv4/raw_diag.c +++ b/net/ipv4/raw_diag.c @@ -185,7 +185,7 @@ static void raw_diag_dump(struct sk_buff *skb, struct n= etlink_callback *cb, } =20 static void raw_diag_get_info(struct sock *sk, struct inet_diag_msg *r, - void *info) + void *info, bool net_admin) { r->idiag_rqueue =3D sk_rmem_alloc_get(sk); r->idiag_wqueue =3D sk_wmem_alloc_get(sk); diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c index ba1fdbe9807fd..cac32575282e3 100644 --- a/net/ipv4/tcp_diag.c +++ b/net/ipv4/tcp_diag.c @@ -19,7 +19,7 @@ #include =20 static void tcp_diag_get_info(struct sock *sk, struct inet_diag_msg *r, - void *_info) + void *_info, bool net_admin) { struct tcp_info *info =3D _info; =20 diff --git a/net/ipv4/udp_diag.c b/net/ipv4/udp_diag.c index f4b24e628cf8d..5a1fa627cbee8 100644 --- a/net/ipv4/udp_diag.c +++ b/net/ipv4/udp_diag.c @@ -142,7 +142,7 @@ static void udp_diag_dump(struct sk_buff *skb, struct n= etlink_callback *cb, } =20 static void udp_diag_get_info(struct sock *sk, struct inet_diag_msg *r, - void *info) + void *info, bool net_admin) { r->idiag_rqueue =3D udp_rqueue_get(sk); r->idiag_wqueue =3D sk_wmem_alloc_get(sk); diff --git a/net/mptcp/mptcp_diag.c b/net/mptcp/mptcp_diag.c index 136c2d05c0eeb..9ed7a6be1e628 100644 --- a/net/mptcp/mptcp_diag.c +++ b/net/mptcp/mptcp_diag.c @@ -190,7 +190,7 @@ static void mptcp_diag_dump(struct sk_buff *skb, struct= netlink_callback *cb, } =20 static void mptcp_diag_get_info(struct sock *sk, struct inet_diag_msg *r, - void *_info) + void *_info, bool net_admin) { struct mptcp_sock *msk =3D mptcp_sk(sk); struct mptcp_info *info =3D _info; diff --git a/net/sctp/diag.c b/net/sctp/diag.c index c2a0de2adf6fd..ab6c560fde053 100644 --- a/net/sctp/diag.c +++ b/net/sctp/diag.c @@ -20,7 +20,7 @@ #include =20 static void sctp_diag_get_info(struct sock *sk, struct inet_diag_msg *r, - void *info); + void *info, bool net_admin); =20 /* define some functions to make asoc/ep fill look clean */ static void inet_diag_msg_sctpasoc_fill(struct inet_diag_msg *r, @@ -200,7 +200,7 @@ static int inet_sctp_diag_fill(struct sock *sk, struct = sctp_association *asoc, } infox.sctpinfo =3D (struct sctp_info *)info; infox.asoc =3D asoc; - sctp_diag_get_info(sk, r, &infox); + sctp_diag_get_info(sk, r, &infox, net_admin); =20 addr_list =3D asoc ? &asoc->base.bind_addr.address_list : &ep->base.bind_addr.address_list; @@ -412,7 +412,7 @@ static int sctp_ep_dump(struct sctp_endpoint *ep, void = *p) =20 /* define the functions for sctp_diag_handler*/ static void sctp_diag_get_info(struct sock *sk, struct inet_diag_msg *r, - void *info) + void *info, bool net_admin) { struct sctp_infox *infox =3D (struct sctp_infox *)info; =20 --=20 2.43.0 From nobody Thu Nov 5 07:29:38 2026 Authentication-Results: smtp.subspace.kernel.org; arc=pass header.oldest-pass=0 smtp.remote-ip=165.173.182.54 ARC-Seal: i=2; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=pass; t=1793176086; b=UPNoGlWlBlKvj+btiiymZBAteNs4H1FyHcQPFspF9izXlYiKLpKLGjwJXp3Irf7/uPYw yZ8+8xjLO/wP+w4i7CwArQcz60ksYY+5YFwm7fTJ6gaUno9Wje9yJDkykzxqM5WgHeorl DpfHG1A7GpPQq8Xrl/UHNZB9vfrnK5VfIg0ZsJvPt0n7JRslluxS5C7dooddQXcXqlhNf rVcFzjt9Azjm6oR+IEP0uexD0SuEFdOW3ycM3KnCum04GxUzoEamsofq1UQ0T3MTQTPCl +n9x4qlylj5pr433ccD43lkSL2dVcgtk4mOwZorTfbASnD8Bg88O2N12ycDWKSHVfeg== ARC-Message-Signature: i=2; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793176086; h=DMARC-Filter:DKIM-Signature:Received:From:To:Cc:Subject:Date: Message-ID:X-Mailer:In-Reply-To:References:MIME-Version: Content-Transfer-Encoding:X-ZohoMailClient; bh=0bnX4zX60YCKha46Olc23P+m1jc7sXIyWg6WYH4xiMU=; b=AOVqfPSJH5PkxUmabihW1b8EJ/jYEGF9Io9rsObUBcVklXQRea6ox5g4kbJjzbPqDJQc VAMV/vvvgwq/XZDSeUEe6T6k5zOCmnwvuSjLMlUSosIpRHEsl6podaxkmIVfWhxsOJm+R BDABeInwTAgsziLTKupbmjjCKw5v9vOWTtYEOE62XGI/P7MSXfnbjRVJj8vEN1fITmFMB 64aRmdFlcRSSkPNhGaTyDYs09rURsCpYb4WPV6ow+9MY/mnZKHBiqjKovoIMpkvJR2Wb+ 5NQ+VbPLHx16iYGYJ8p6c7gftvlBfDA90oZH+moyTDbVGQW2ejhIFG0tvqOc1PipF4Q== ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass header.from=mpiricsoftware.com; spf=pass smtp.mailfrom=mpiricsoftware.com; arc=pass header.oldest-pass=0 smtp.remote-ip=165.173.182.54 Received: from sender5-of-o54.zoho.com (sender5-of-o54.zoho.com [165.173.182.54]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 42232606A325; Wed, 28 Oct 2026 08:28:06 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 42232606A325 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mpiricsoftware.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mpiricsoftware.com ARC-Seal: i=1; a=rsa-sha256; t=1793176061; cv=none; d=zohomail.com; s=zohoarc; b=K9KXXsIoeflA+v9Z3fkrILA9gvzbeazaV1aAIC13VANv8uX1m7Jwcp8S+CaobepRlZPuzkBwd+tfHCpd2DNe830PT3IdVAD8xx92vImUCikN52QfDeLPnq0/hAMqC19EqoeqGdlh1wnKi5nnIAL8DB3rdBId+xg41fWSpE4T3T4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793176061; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=0bnX4zX60YCKha46Olc23P+m1jc7sXIyWg6WYH4xiMU=; b=C7WGm5F4sxQnVOjvPXsf+e+7m44Qx7g16VKSoVtGhO+RUyJphK/jiQashg3THOor/sDhT+VElOHyVaXzXxqdPC27inxtw4OX6pl118DaGsJxzIwDDo3ujOEuDFeDON6jA/umb8XzCPIdfZFfbI82tIwLR8R0XXAjqPDEFSmEgLk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=mpiricsoftware.com; spf=pass smtp.mailfrom=kalpan.jani@mpiricsoftware.com; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1793176061; s=mpiric; d=mpiricsoftware.com; i=kalpan.jani@mpiricsoftware.com; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:In-Reply-To:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=0bnX4zX60YCKha46Olc23P+m1jc7sXIyWg6WYH4xiMU=; b=T+sbWaTE7xO5jaYbVPfVvlRYoaES3heyLxul6sxLS4/Rs8T3E2WVXw6rQL8kGA0J s5TgU+JuUTxqyTlT4Hrn40qKCHDQ0y3eY+hDDIh6yEDLVt4d5dmqoPA2r5N0XYJlpsU KIws2U4lhIhVtgBEErF1uJG1kxDwZhzPtNt+dT94= Received: by smtp.zohomail.com with SMTPS id 1793176059486104.36534309557874; Wed, 28 Oct 2026 01:27:39 -0700 (PDT) From: Kalpan Jani To: mptcp@lists.linux.dev Cc: matttbe@kernel.org, Kalpan Jani , Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [RFC net-next v11 2/2] mptcp: hide seq counters without net_admin Date: Wed, 28 Oct 2026 13:57:01 +0530 Message-ID: <20261028082704.1609493-3-kalpan.jani@mpiricsoftware.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261028082704.1609493-1-kalpan.jani@mpiricsoftware.com> References: <1ec0c2b5-a0fa-44e8-9ae8-dca9b7f90ec6@kernel.org> <20261028082704.1609493-1-kalpan.jani@mpiricsoftware.com> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Content-Type: text/plain; charset="utf-8" The MPTCP inet-diag response includes data sequence numbers that should not be exposed to users without CAP_NET_ADMIN. Clear mptcpi_write_seq, mptcpi_snd_una and mptcpi_rcv_nxt in diagnostic responses for unprivileged users. Apply this restriction in the inet-diag callback, leaving the MPTCP_INFO getsockopt path unchanged. Signed-off-by: Kalpan Jani --- net/mptcp/mptcp_diag.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/mptcp/mptcp_diag.c b/net/mptcp/mptcp_diag.c index 9ed7a6be1e628..970f849f4345c 100644 --- a/net/mptcp/mptcp_diag.c +++ b/net/mptcp/mptcp_diag.c @@ -215,6 +215,12 @@ static void mptcp_diag_get_info(struct sock *sk, struc= t inet_diag_msg *r, return; =20 mptcp_diag_fill_info(msk, info); + + if (!net_admin) { + info->mptcpi_write_seq =3D 0; + info->mptcpi_snd_una =3D 0; + info->mptcpi_rcv_nxt =3D 0; + } } =20 static const struct inet_diag_handler mptcp_diag_handler =3D { --=20 2.43.0