[RFC net-next v11 2/2] mptcp: hide seq counters without net_admin

[Kalpan Jani <kalpan.jani@mpiricsoftware.com>]

The MPTCP inet-diag response includes data sequence numbers that
should not be exposed to users without CAP_NET_ADMIN.

Clear mptcpi_write_seq, mptcpi_snd_una and mptcpi_rcv_nxt in diagnostic
responses for unprivileged users. Apply this restriction in the
inet-diag callback, leaving the MPTCP_INFO getsockopt path unchanged.

Signed-off-by: Kalpan Jani <kalpan.jani@mpiricsoftware.com>
---
 net/mptcp/mptcp_diag.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/mptcp/mptcp_diag.c b/net/mptcp/mptcp_diag.c
index 9ed7a6be1e628..970f849f4345c 100644
--- a/net/mptcp/mptcp_diag.c
+++ b/net/mptcp/mptcp_diag.c
@@ -215,6 +215,12 @@ static void mptcp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
 		return;
 
 	mptcp_diag_fill_info(msk, info);
+
+	if (!net_admin) {
+		info->mptcpi_write_seq = 0;
+		info->mptcpi_snd_una = 0;
+		info->mptcpi_rcv_nxt = 0;
+	}
 }
 
 static const struct inet_diag_handler mptcp_diag_handler = {
-- 
2.43.0