| Message ID | 20190723104754.29324-2-ppandit@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | restrict bridge interface name to IFNAMSIZ | expand |
On Tue, Jul 23, 2019 at 04:17:52PM +0530, P J P wrote: > From: Prasad J Pandit <pjp@fedoraproject.org> > > The network interface name in Linux is defined to be of size > IFNAMSIZ(=16), including the terminating null('\0') byte. > The same is applied to interface names read from 'bridge.conf' > file to form ACL rules. If user supplied '--br=bridge' name > is not restricted to the same length, it could lead to ACL bypass > issue. Restrict interface name to IFNAMSIZ, including null byte. > > Reported-by: Riccardo Schirone <rschiron@redhat.com> > Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> > --- > qemu-bridge-helper.c | 11 +++++++++++ > 1 file changed, 11 insertions(+) > > Reviewed v3 > -> https://lists.nongnu.org/archive/html/qemu-devel/2019-07/msg00245.html Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
On Tue, Jul 23, 2019 at 04:17:52PM +0530, P J P wrote: > From: Prasad J Pandit <pjp@fedoraproject.org> > > The network interface name in Linux is defined to be of size > IFNAMSIZ(=16), including the terminating null('\0') byte. > The same is applied to interface names read from 'bridge.conf' > file to form ACL rules. If user supplied '--br=bridge' name > is not restricted to the same length, it could lead to ACL bypass > issue. Restrict interface name to IFNAMSIZ, including null byte. > > Reported-by: Riccardo Schirone <rschiron@redhat.com> > Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> > --- > qemu-bridge-helper.c | 11 +++++++++++ > 1 file changed, 11 insertions(+) Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Regards, Daniel
P J P <ppandit@redhat.com> 于2019年7月23日周二 下午6:50写道： > From: Prasad J Pandit <pjp@fedoraproject.org> > > The network interface name in Linux is defined to be of size > IFNAMSIZ(=16), including the terminating null('\0') byte. > The same is applied to interface names read from 'bridge.conf' > file to form ACL rules. If user supplied '--br=bridge' name > is not restricted to the same length, it could lead to ACL bypass > issue. Restrict interface name to IFNAMSIZ, including null byte. > > Reported-by: Riccardo Schirone <rschiron@redhat.com> > Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> > Reviewed-by: Li Qiang <liq3ea@gmail.com> > --- > qemu-bridge-helper.c | 11 +++++++++++ > 1 file changed, 11 insertions(+) > > Reviewed v3 > -> > https://lists.nongnu.org/archive/html/qemu-devel/2019-07/msg00245.html > > diff --git a/qemu-bridge-helper.c b/qemu-bridge-helper.c > index f9940deefd..e90c22f07d 100644 > --- a/qemu-bridge-helper.c > +++ b/qemu-bridge-helper.c > @@ -109,6 +109,13 @@ static int parse_acl_file(const char *filename, > ACLList *acl_list) > } > *argend = 0; > > + if (!g_str_equal(cmd, "include") && strlen(arg) >= IFNAMSIZ) { > + fprintf(stderr, "name `%s' too long: %zu\n", arg, > strlen(arg)); > + fclose(f); > + errno = EINVAL; > + return -1; > + } > + > if (strcmp(cmd, "deny") == 0) { > acl_rule = g_malloc(sizeof(*acl_rule)); > if (strcmp(arg, "all") == 0) { > @@ -259,6 +266,10 @@ int main(int argc, char **argv) > usage(); > return EXIT_FAILURE; > } > + if (strlen(bridge) >= IFNAMSIZ) { > + fprintf(stderr, "name `%s' too long: %zu\n", bridge, > strlen(bridge)); > + return EXIT_FAILURE; > + } > > /* parse default acl file */ > QSIMPLEQ_INIT(&acl_list); > -- > 2.21.0 > >
diff --git a/qemu-bridge-helper.c b/qemu-bridge-helper.c index f9940deefd..e90c22f07d 100644 --- a/qemu-bridge-helper.c +++ b/qemu-bridge-helper.c @@ -109,6 +109,13 @@ static int parse_acl_file(const char *filename, ACLList *acl_list) } *argend = 0; + if (!g_str_equal(cmd, "include") && strlen(arg) >= IFNAMSIZ) { + fprintf(stderr, "name `%s' too long: %zu\n", arg, strlen(arg)); + fclose(f); + errno = EINVAL; + return -1; + } + if (strcmp(cmd, "deny") == 0) { acl_rule = g_malloc(sizeof(*acl_rule)); if (strcmp(arg, "all") == 0) { @@ -259,6 +266,10 @@ int main(int argc, char **argv) usage(); return EXIT_FAILURE; } + if (strlen(bridge) >= IFNAMSIZ) { + fprintf(stderr, "name `%s' too long: %zu\n", bridge, strlen(bridge)); + return EXIT_FAILURE; + } /* parse default acl file */ QSIMPLEQ_INIT(&acl_list);