netns.GetFromName rejects names that resolve outside /run/netns

internal/netns/netns.go

@@ -40,9 +40,20 @@ type Handle = vishnetns.NsHandle
 
 // GetFromName opens the namespace of that name under /run/netns.
 func GetFromName(name string) (Handle, error) {
+	if err := validateName(name); err != nil {
+		return -1, err
+	}
 	return vishnetns.GetFromName(name)
 }
 
+// validateName rejects names that would resolve outside /run/netns.
+func validateName(name string) error {
+	if name == "" || name == "." || name == ".." || strings.ContainsAny(name, "/\x00") {
+		return fmt.Errorf("invalid network namespace name %q: %w", name, os.ErrInvalid)
+	}
+	return nil
+}
+
 // CreateNamed creates a named netns and returns its handle, restoring the
 // caller's current netns before returning.
 //
@@ -86,8 +97,8 @@ func CreateNamed(name string) (Handle, error) {
 // it if it is a symlink. A name that is already gone is not an error, and the
 // namespace itself survives for as long as something holds it open.
 func RemoveNamed(name string) error {
-	if name == "" || name == "." || name == ".." || strings.ContainsAny(name, "/\x00") {
-		return fmt.Errorf("invalid network namespace name %q: %w", name, os.ErrInvalid)
+	if err := validateName(name); err != nil {
+		return err
 	}
 	path := filepath.Join("/run/netns", name)
 	if err := unix.Unmount(path, unix.MNT_DETACH|unix.UMOUNT_NOFOLLOW); err != nil && !errors.Is(err, unix.ENOENT) && !errors.Is(err, unix.EINVAL) {

internal/netns/netns_linux_test.go

@@ -40,6 +40,13 @@ func TestNamedNetNSRejectsInvalidNames(t *testing.T) {
 			if !errors.Is(err, os.ErrInvalid) {
 				t.Fatalf("CreateNamed(%q): got %v, want invalid name", name, err)
 			}
+			handle, err = GetFromName(name)
+			if err == nil {
+				handle.Close()
+			}
+			if !errors.Is(err, os.ErrInvalid) {
+				t.Fatalf("GetFromName(%q): got %v, want invalid name", name, err)
+			}
 		})
 	}
 }