[PATCH net-next v3 03/11] wireguard: netlink: enable strict genetlink validation

Asbjørn Sloth Tønnesen posted 11 patches 1 month, 1 week ago
There is a newer version of this series
[PATCH net-next v3 03/11] wireguard: netlink: enable strict genetlink validation
Posted by Asbjørn Sloth Tønnesen 1 month, 1 week ago
Wireguard is a modern enough genetlink family, that it doesn't
need resv_start_op. It already had policies in place when it was
first merged, it has also never used the reserved field, or other
things toggled by resv_start_op.

wireguard-tools have always used zero initialized memory, and
have never touched the reserved field, neither have any other
clients I have checked. Closed-source clients are much more
likely to use the embeddedable library from wireguard-tools,
than a DIY implementation using uninitialized memory.

Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.net>
---
 drivers/net/wireguard/netlink.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/net/wireguard/netlink.c b/drivers/net/wireguard/netlink.c
index db57a74d379b..682678d24a9f 100644
--- a/drivers/net/wireguard/netlink.c
+++ b/drivers/net/wireguard/netlink.c
@@ -633,7 +633,6 @@ static const struct genl_ops genl_ops[] = {
 static struct genl_family genl_family __ro_after_init = {
 	.ops = genl_ops,
 	.n_ops = ARRAY_SIZE(genl_ops),
-	.resv_start_op = WG_CMD_SET_DEVICE + 1,
 	.name = WG_GENL_NAME,
 	.version = WG_GENL_VERSION,
 	.maxattr = WGDEVICE_A_MAX,
-- 
2.51.0

Re: [PATCH net-next v3 03/11] wireguard: netlink: enable strict genetlink validation
Posted by Jason A. Donenfeld 1 month ago
Hi Asbjørn,

On Wed, Nov 5, 2025 at 7:32 PM Asbjørn Sloth Tønnesen <ast@fiberby.net> wrote:
>  static struct genl_family genl_family __ro_after_init = {
>         .ops = genl_ops,
>         .n_ops = ARRAY_SIZE(genl_ops),
> -       .resv_start_op = WG_CMD_SET_DEVICE + 1,
>         .name = WG_GENL_NAME,
>         .version = WG_GENL_VERSION,
>         .maxattr = WGDEVICE_A_MAX,

This patch is fine and standalone enough, that I merged it into my
wireguard.git devel branch:

https://git.kernel.org/pub/scm/linux/kernel/git/zx2c4/wireguard-linux.git/commit/?h=devel&id=fbd8c752a8e3d00341fa7754d6e45e60d6b45490

If you wind up rerolling the rest of these, you can do it against that branch.

Jason
Re: [PATCH net-next v3 03/11] wireguard: netlink: enable strict genetlink validation
Posted by Asbjørn Sloth Tønnesen 3 weeks, 1 day ago
On 11/18/25 5:10 PM, Jason A. Donenfeld wrote:
> On Wed, Nov 5, 2025 at 7:32 PM Asbjørn Sloth Tønnesen <ast@fiberby.net> wrote:
>>   static struct genl_family genl_family __ro_after_init = {
>>          .ops = genl_ops,
>>          .n_ops = ARRAY_SIZE(genl_ops),
>> -       .resv_start_op = WG_CMD_SET_DEVICE + 1,
>>          .name = WG_GENL_NAME,
>>          .version = WG_GENL_VERSION,
>>          .maxattr = WGDEVICE_A_MAX,
> 
> This patch is fine and standalone enough, that I merged it into my
> wireguard.git devel branch:
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/zx2c4/wireguard-linux.git/commit/?h=devel&id=fbd8c752a8e3d00341fa7754d6e45e60d6b45490
> 
> If you wind up rerolling the rest of these, you can do it against that branch.

If you update it, so it includes the 2 new net-next commits, then
I can send v4 based on your tree.

- [net-next,1/2] tools: ynl-gen: add function prefix argument
   https://git.kernel.org/netdev/net-next/c/17fa6ee35bd4
- [net-next,2/2] tools: ynl-gen: add regeneration comment
   https://git.kernel.org/netdev/net-next/c/68e83f347266

Thanks.
Re: [PATCH net-next v3 03/11] wireguard: netlink: enable strict genetlink validation
Posted by Jason A. Donenfeld 3 weeks, 1 day ago
On Wed, Nov 26, 2025 at 5:25 PM Asbjørn Sloth Tønnesen <ast@fiberby.net> wrote:
>
> On 11/18/25 5:10 PM, Jason A. Donenfeld wrote:
> > On Wed, Nov 5, 2025 at 7:32 PM Asbjørn Sloth Tønnesen <ast@fiberby.net> wrote:
> >>   static struct genl_family genl_family __ro_after_init = {
> >>          .ops = genl_ops,
> >>          .n_ops = ARRAY_SIZE(genl_ops),
> >> -       .resv_start_op = WG_CMD_SET_DEVICE + 1,
> >>          .name = WG_GENL_NAME,
> >>          .version = WG_GENL_VERSION,
> >>          .maxattr = WGDEVICE_A_MAX,
> >
> > This patch is fine and standalone enough, that I merged it into my
> > wireguard.git devel branch:
> >
> > https://git.kernel.org/pub/scm/linux/kernel/git/zx2c4/wireguard-linux.git/commit/?h=devel&id=fbd8c752a8e3d00341fa7754d6e45e60d6b45490
> >
> > If you wind up rerolling the rest of these, you can do it against that branch.
>
> If you update it, so it includes the 2 new net-next commits, then
> I can send v4 based on your tree.

Done.
Re: [PATCH net-next v3 03/11] wireguard: netlink: enable strict genetlink validation
Posted by Jason A. Donenfeld 1 month ago
On Wed, Nov 05, 2025 at 06:32:12PM +0000, Asbjørn Sloth Tønnesen wrote:
> Wireguard is a modern enough genetlink family, that it doesn't

WireGuard, capital G.