[PATCH net v3] gtp: Require 'CAP_NET_ADMIN' when joining the gtp multicast group

[PATCH net v3] gtp: Require 'CAP_NET_ADMIN' when joining the gtp multicast group

[Anil Kaushik]

The gtp generic netlink family sends notifications on its "gtp"
multicast group when a PDP context is added or deleted, and for GTP-U
echo responses. They carry the same attributes as a GETPDP reply: the
MS and peer addresses, and the TEIDs, or the TID and the flow label.

GETPDP requires CAP_NET_ADMIN, but generic netlink lets any user join a
multicast group by default, so an unprivileged user in the network
namespace of the gtp device can read all of this. Found by code
inspection.

Fix by marking the group with GENL_MCAST_CAP_NET_ADMIN, like the psample
"packets" group, and with uns-admin-perm in the gtp netlink spec. Only
users with CAP_NET_ADMIN in the user namespace owning the network
namespace can then join it.

This is still weaker than the check on GETPDP, which needs
CAP_NET_ADMIN in the initial user namespace: in a network namespace
owned by another user namespace, its root can join the group, but not
use GETPDP. Genetlink has no multicast group flag for the initial user
namespace, and ioam6 pairs its ops and its group the same way. This fix
blocks the unprivileged users.

Tested by joining the group as root, as root without CAP_NET_ADMIN, and
as an unprivileged user:

Before:
  root: joined
  root without CAP_NET_ADMIN: joined
  nobody: joined

After:
  root: joined
  root without CAP_NET_ADMIN: EPERM
  nobody: EPERM

Fixes: 50aba46c234e ("gtp: add notification mechanism")
Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Anil Kaushik <anilkaushikwireless@gmail.com>
---

Notes:
    v3:
     - mark the group in the gtp netlink spec too (Paolo)
     - v2: https://lore.kernel.org/netdev/20261023073738.2436362-1-anilkaushikwireless@gmail.com/
    
    v2:
     - say that the group check is still weaker than the one on GETPDP
       (Sashiko)
     - say how it was found
     - v1: https://lore.kernel.org/netdev/20261021065750.2069795-1-anilkaushikwireless@gmail.com/

 Documentation/netlink/specs/gtp.yaml | 1 +
 drivers/net/gtp.c                    | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/Documentation/netlink/specs/gtp.yaml b/Documentation/netlink/specs/gtp.yaml
index 7871f5def054..b65e18ae5df2 100644
--- a/Documentation/netlink/specs/gtp.yaml
+++ b/Documentation/netlink/specs/gtp.yaml
@@ -194,3 +194,4 @@ mcast-groups:
   list:
     -
       name: gtp
+      flags: [uns-admin-perm]
diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 15b5d845fc3b..8b29c35d7cdb 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -118,7 +118,8 @@ enum gtp_multicast_groups {
 };
 
 static const struct genl_multicast_group gtp_genl_mcgrps[] = {
-	[GTP_GENL_MCGRP] = { .name = GTP_GENL_MCGRP_NAME },
+	[GTP_GENL_MCGRP] = { .name = GTP_GENL_MCGRP_NAME,
+			     .flags = GENL_MCAST_CAP_NET_ADMIN, },
 };
 
 static void pdp_context_delete(struct pdp_ctx *pctx);
-- 
2.25.1

Re: [PATCH net v3] gtp: Require 'CAP_NET_ADMIN' when joining the gtp multicast group

[netdev-bot+sashiko]

Thank you for your contribution! Sashiko AI review found 1 potential
issue(s) to consider.

Critical: 0 · High: 1 · Medium: 0 · Low: 0

If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).

- [High] An unprivileged local user can still receive gtp multicast
  notifications (PDP add/delete and echo responses) by joining the…

--

gtp: Require 'CAP_NET_ADMIN' when joining the gtp multicast group

This patch marks the gtp generic netlink multicast group with
GENL_MCAST_CAP_NET_ADMIN in drivers/net/gtp.c and with uns-admin-perm in
the gtp netlink spec. The goal is to stop unprivileged users from
receiving the PDP context add/delete and echo response notifications,
which carry the same data as a GETPDP reply.

[ ... ]

> diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
> index 86c8c88b702cf..1dd32e979cf59 100644
> --- a/drivers/net/gtp.c
> +++ b/drivers/net/gtp.c
> @@ -118,7 +118,8 @@ enum gtp_multicast_groups {
>  };
>  
>  static const struct genl_multicast_group gtp_genl_mcgrps[] = {
> -	[GTP_GENL_MCGRP] = { .name = GTP_GENL_MCGRP_NAME },
> +	[GTP_GENL_MCGRP] = { .name = GTP_GENL_MCGRP_NAME,
> +			     .flags = GENL_MCAST_CAP_NET_ADMIN, },
>  };

[Severity: High]
Can an unprivileged user still get these notifications by joining the
group ID before the gtp family is registered?

The flag is only checked in genl_bind(), and only when a registered
family owns the requested group. If no family owns it, the loop matches
nothing and ret stays 0:

net/netlink/genetlink.c:genl_bind() {
    ...
	int ret = 0;
    ...
	idr_for_each_entry(&genl_fam_idr, family, id) {
    ...
		i = group - family->mcgrp_offset;
		if (i < 0 || i >= family->n_mcgrps)
			continue;
    ...
	}

	up_read(&cb_lock);
	return ret;
}

The genl socket is NL_CFG_F_NONROOT_RECV. For NETLINK_ADD_MEMBERSHIP,
netlink_setsockopt() only checks the ID against nlk->ngroups. So an
unprivileged NETLINK_GENERIC socket can join any free ID that fits in
the current bitmap.

When gtp is loaded later, the call chain is
genl_register_family()->genl_validate_assign_mc_groups()->
genl_allocate_reserve_groups(), which gives gtp the first free ID. After
that, only __netlink_change_ngroups() runs to resize the table. Sockets
already subscribed to that ID are not cleared or rechecked.

do_one_broadcast() only looks at the socket's group bitmap and netns.
So the earlier subscriber would receive what gtp_tunnel_notify() and the
echo response path send through genlmsg_multicast_netns(...,
GTP_GENL_MCGRP, ...).

The same user can also trigger the module load. CTRL_CMD_GETFAMILY does
not need GENL_ADMIN_PERM. ctrl_getfamily() calls request_module() for
"net-pf-16-proto-16-family-gtp", and gtp.c declares
MODULE_ALIAS_GENL_FAMILY("gtp").

The commit message says:

    This fix blocks the unprivileged users.

That claim fails when gtp is built as a module and is not yet loaded
when the user subscribes.

Could this also be closed in the genetlink core? One option is for
genl_validate_assign_mc_groups() to clear existing members of newly
allocated IDs with __netlink_clear_multicast_users(). Another is for
genl_bind() to reject IDs that no family owns. Either change would go on
top of this patch, not replace it.

The same gap seems to affect other modular groups that use the
GENL_MCAST_CAP_* flags, such as the psample one.

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261027130623.3136658-1-anilkaushikwireless%40gmail.com

Re: [PATCH net v3] gtp: Require 'CAP_NET_ADMIN' when joining the gtp multicast group

[Anil Kaushik]

On Thu, Oct 29, 2026 at 9:38 AM <netdev-bot+sashiko@kernel.org> wrote:
>
> Thank you for your contribution! Sashiko AI review found 1 potential
> issue(s) to consider.
>
> Critical: 0 · High: 1 · Medium: 0 · Low: 0
>
> If you believe none of the issues are legitimate, please reply to each
> issue of Medium severity or higher and explain why the AI is wrong.
> If any of them are legitimate and you plan to respin, please let patchwork
> know by including "pw-bot: cr" as a separate line at the end of your reply
> (one such reply per series is enough).
>
> - [High] An unprivileged local user can still receive gtp multicast
>   notifications (PDP add/delete and echo responses) by joining the…
>
> --
>
> gtp: Require 'CAP_NET_ADMIN' when joining the gtp multicast group
>
> This patch marks the gtp generic netlink multicast group with
> GENL_MCAST_CAP_NET_ADMIN in drivers/net/gtp.c and with uns-admin-perm in
> the gtp netlink spec. The goal is to stop unprivileged users from
> receiving the PDP context add/delete and echo response notifications,
> which carry the same data as a GETPDP reply.
>

Yes, this works, but the gap is in the genetlink core, not in gtp.
genl_unregister_mc_groups() clears the members of the IDs it frees, but
nothing clears them when free IDs are given to a new family. So it hits
every modular group with a GENL_MCAST_CAP_* flag, psample and
drop_monitor too.

This patch is still needed, and it does not change. I will send a
separate fix to net that clears the members of the new IDs in
genl_validate_assign_mc_groups(), like the unregister path does.

> [ ... ]
>
> > diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
> > index 86c8c88b702cf..1dd32e979cf59 100644
> > --- a/drivers/net/gtp.c
> > +++ b/drivers/net/gtp.c
> > @@ -118,7 +118,8 @@ enum gtp_multicast_groups {
> >  };
> >
> >  static const struct genl_multicast_group gtp_genl_mcgrps[] = {
> > -     [GTP_GENL_MCGRP] = { .name = GTP_GENL_MCGRP_NAME },
> > +     [GTP_GENL_MCGRP] = { .name = GTP_GENL_MCGRP_NAME,
> > +                          .flags = GENL_MCAST_CAP_NET_ADMIN, },
> >  };
>
> [Severity: High]
> Can an unprivileged user still get these notifications by joining the
> group ID before the gtp family is registered?
>
> The flag is only checked in genl_bind(), and only when a registered
> family owns the requested group. If no family owns it, the loop matches
> nothing and ret stays 0:
>
> net/netlink/genetlink.c:genl_bind() {
>     ...
>         int ret = 0;
>     ...
>         idr_for_each_entry(&genl_fam_idr, family, id) {
>     ...
>                 i = group - family->mcgrp_offset;
>                 if (i < 0 || i >= family->n_mcgrps)
>                         continue;
>     ...
>         }
>
>         up_read(&cb_lock);
>         return ret;
> }
>
> The genl socket is NL_CFG_F_NONROOT_RECV. For NETLINK_ADD_MEMBERSHIP,
> netlink_setsockopt() only checks the ID against nlk->ngroups. So an
> unprivileged NETLINK_GENERIC socket can join any free ID that fits in
> the current bitmap.
>
> When gtp is loaded later, the call chain is
> genl_register_family()->genl_validate_assign_mc_groups()->
> genl_allocate_reserve_groups(), which gives gtp the first free ID. After
> that, only __netlink_change_ngroups() runs to resize the table. Sockets
> already subscribed to that ID are not cleared or rechecked.
>
> do_one_broadcast() only looks at the socket's group bitmap and netns.
> So the earlier subscriber would receive what gtp_tunnel_notify() and the
> echo response path send through genlmsg_multicast_netns(...,
> GTP_GENL_MCGRP, ...).
>
> The same user can also trigger the module load. CTRL_CMD_GETFAMILY does
> not need GENL_ADMIN_PERM. ctrl_getfamily() calls request_module() for
> "net-pf-16-proto-16-family-gtp", and gtp.c declares
> MODULE_ALIAS_GENL_FAMILY("gtp").
>
> The commit message says:
>
>     This fix blocks the unprivileged users.
>
> That claim fails when gtp is built as a module and is not yet loaded
> when the user subscribes.
>
> Could this also be closed in the genetlink core? One option is for
> genl_validate_assign_mc_groups() to clear existing members of newly
> allocated IDs with __netlink_clear_multicast_users(). Another is for
> genl_bind() to reject IDs that no family owns. Either change would go on
> top of this patch, not replace it.
>
> The same gap seems to affect other modular groups that use the
> GENL_MCAST_CAP_* flags, such as the psample one.
>
> --
> Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261027130623.3136658-1-anilkaushikwireless%40gmail.com

Re: [PATCH net v3] gtp: Require 'CAP_NET_ADMIN' when joining the gtp multicast group

[Anil Kaushik]

Adding Donald, I missed him on Cc. The patch also changes
Documentation/netlink/specs/gtp.yaml.

On Tue, Oct 27, 2026, Anil Kaushik wrote:
> ---
>  Documentation/netlink/specs/gtp.yaml | 1 +
>  drivers/net/gtp.c                    | 3 ++-

Re: [PATCH net v3] gtp: Require 'CAP_NET_ADMIN' when joining the gtp multicast group

[Simon Horman]

On Thu, Oct 29, 2026 at 09:49:35AM +0530, Anil Kaushik wrote:
> On Thu, Oct 29, 2026 at 9:38 AM <netdev-bot+sashiko@kernel.org> wrote:
> >
> > Thank you for your contribution! Sashiko AI review found 1 potential
> > issue(s) to consider.
> >
> > Critical: 0 · High: 1 · Medium: 0 · Low: 0
> >
> > If you believe none of the issues are legitimate, please reply to each
> > issue of Medium severity or higher and explain why the AI is wrong.
> > If any of them are legitimate and you plan to respin, please let patchwork
> > know by including "pw-bot: cr" as a separate line at the end of your reply
> > (one such reply per series is enough).
> >
> > - [High] An unprivileged local user can still receive gtp multicast
> >   notifications (PDP add/delete and echo responses) by joining the…
> >
> > --
> >
> > gtp: Require 'CAP_NET_ADMIN' when joining the gtp multicast group
> >
> > This patch marks the gtp generic netlink multicast group with
> > GENL_MCAST_CAP_NET_ADMIN in drivers/net/gtp.c and with uns-admin-perm in
> > the gtp netlink spec. The goal is to stop unprivileged users from
> > receiving the PDP context add/delete and echo response notifications,
> > which carry the same data as a GETPDP reply.
> >
> 
> Yes, this works, but the gap is in the genetlink core, not in gtp.
> genl_unregister_mc_groups() clears the members of the IDs it frees, but
> nothing clears them when free IDs are given to a new family. So it hits
> every modular group with a GENL_MCAST_CAP_* flag, psample and
> drop_monitor too.
> 
> This patch is still needed, and it does not change. I will send a
> separate fix to net that clears the members of the new IDs in
> genl_validate_assign_mc_groups(), like the unregister path does.

Thanks Anil,

One step at a time seems like a good approach to me.

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net v3] gtp: Require 'CAP_NET_ADMIN' when joining the gtp multicast group

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Tue, 27 Oct 2026 13:06:23 +0000 you wrote:
> The gtp generic netlink family sends notifications on its "gtp"
> multicast group when a PDP context is added or deleted, and for GTP-U
> echo responses. They carry the same attributes as a GETPDP reply: the
> MS and peer addresses, and the TEIDs, or the TID and the flow label.
> 
> GETPDP requires CAP_NET_ADMIN, but generic netlink lets any user join a
> multicast group by default, so an unprivileged user in the network
> namespace of the gtp device can read all of this. Found by code
> inspection.
> 
> [...]

Here is the summary with links:
  - [net,v3] gtp: Require 'CAP_NET_ADMIN' when joining the gtp multicast group
    https://git.kernel.org/netdev/net/c/db627e71b6da

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html