Attachment 680487 Details for Bug 848017 – [PATCH] cgdcbxd: add filtering support for netlink sockets

[patch] [PATCH] cgdcbxd: add filtering support for netlink sockets

-cgdcbxd-add-filtering-support-for-netlink-sockets.patch (text/plain), 2.73 KB, created by Neil Horman on 2013-01-17 20:29:14 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Neil Horman

Created: 2013-01-17 20:29:14 UTC

Size: 2.73 KB

patch

obsolete

>From 5e5e8f7959782f4d1541858b9f2ecd1caaed7582 Mon Sep 17 00:00:00 2001
>From: Neil Horman <nhorman@tuxdriver.com>
>Date: Thu, 17 Jan 2013 15:23:10 -0500
>Subject: [PATCH] cgdcbxd: add filtering support for netlink sockets
>
>To avoid allowing cgdcbxd to be spoofed into accepting netlink messages from
>user processes that have misconstructed headers indicating they're from the
>kernel, switch to using the new libmnl filtering interface that allows us to
>drop all frames originating from user space processes.
>
>Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
>---
> cgdcbxd.c | 15 +++++++++------
> 1 file changed, 9 insertions(+), 6 deletions(-)
>
>diff --git a/cgdcbxd.c b/cgdcbxd.c
>index 17f0206..8c930b8 100644
>--- a/cgdcbxd.c
>+++ b/cgdcbxd.c
>@@ -48,6 +48,9 @@
> #define NET_PRIO "net_prio"
> #define IFPRIOMAP "net_prio.ifpriomap"
> 
>+#define mnl_recvfrom_filter(nl, buf, sz) \
>+	mnl_socket_recvfrom_filter((nl), (buf), (sz), mnl_recvfrom_filter_user)
>+
> struct cgdcbx_virt {
> 	char *ifname;
> 	int ifindex;
>@@ -466,13 +469,13 @@ static void cgdcbx_populate_virtual_devs(void)
> 		return;
> 	}
> 
>-	ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
>+	ret = mnl_recvfrom_filter(nl, buf, sizeof(buf));
> 	while (ret > 0) {
> 		ret = mnl_cb_run(buf, ret, 0, portid,
> 				 cgdcbx_link_cb, NULL);
> 		if (ret <= MNL_CB_STOP)
> 			break;
>-		ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
>+		ret = mnl_recvfrom_filter(nl, buf, sizeof(buf));
> 	}
> 
> 	mnl_socket_close(nl);
>@@ -898,7 +901,7 @@ static void cgdcbx_init_tables(struct mnl_socket *nl)
> 			goto index_failure;
> 		}
> 
>-		ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
>+		ret = mnl_recvfrom_filter(nl, buf, sizeof(buf));
> 		if (ret > 0)
> 			mnl_cb_run(buf, ret, 0, portid,
> 				   cgdcbx_getdcbx_reply, &mode);
>@@ -927,7 +930,7 @@ static void cgdcbx_init_tables(struct mnl_socket *nl)
> 			goto index_failure;
> 		}
> 
>-		ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
>+		ret = mnl_recvfrom_filter(nl, buf, sizeof(buf));
> 		if (ret > 0)
> 			mnl_cb_run(buf, ret, 0, portid, cgdcbx_dcb_cb, NULL);
> index_failure:
>@@ -1098,7 +1101,7 @@ int main(int argc, char *argv[])
> 			goto err;
> 		} else if (errno != EINTR && FD_ISSET(nlfd_dcb, &fds)) {
> 			sigprocmask(SIG_BLOCK, &sigset, NULL);
>-			ret = mnl_socket_recvfrom(nl_dcb, buf, sizeof(buf));
>+			ret = mnl_recvfrom_filter(nl_dcb, buf, sizeof(buf));
> 			ret = mnl_cb_run(buf, ret, 0, 0, cgdcbx_dcb_cb, NULL);
> 			sigprocmask(SIG_UNBLOCK, &sigset, NULL);
> 		} else if (errno != EINTR && FD_ISSET(nlfd_rt, &fds)) {
>@@ -1106,7 +1109,7 @@ int main(int argc, char *argv[])
> 							.virt = NULL,
> 							.nlmsg_type = 0};
> 
>-			ret = mnl_socket_recvfrom(nl_rt, buf, sizeof(buf));
>+			ret = mnl_recvfrom_filter(nl_rt, buf, sizeof(buf));
> 			ret = mnl_cb_run(buf, ret, 0, 0,
> 					 cgdcbx_link_cb, &data);
> 
>-- 
>1.7.11.7
>

Actions: View | Diff

Attachments on bug 848017: 680487