naccyde / rpms / iproute

Forked from rpms/iproute 10 months ago
Clone

Blame SOURCES/0014-netns-avoid-directory-traversal.patch

36cfb7
From 74061958f56a4626a3a146c72f16e43012e828f1 Mon Sep 17 00:00:00 2001
36cfb7
From: Phil Sutter <psutter@redhat.com>
36cfb7
Date: Thu, 14 Sep 2017 15:39:23 +0200
36cfb7
Subject: [PATCH] netns: avoid directory traversal
36cfb7
36cfb7
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1468529
36cfb7
Upstream Status: iproute2.git commit 79928fd0552b5
36cfb7
36cfb7
commit 79928fd0552b520aa36a22e71144d10a32f7e4fe
36cfb7
Author: Matteo Croce <mcroce@redhat.com>
36cfb7
Date:   Thu Jul 20 00:36:32 2017 +0200
36cfb7
36cfb7
    netns: avoid directory traversal
36cfb7
36cfb7
    ip netns keeps track of created namespaces with bind mounts named
36cfb7
    /var/run/netns/<namespace>. No input sanitization is done, allowing creation and
36cfb7
    deletion of files relatives to /var/run/netns or, if the path is non existent or
36cfb7
    invalid, allows to create "untracked" namespaces (invisible to the tool).
36cfb7
36cfb7
    This commit denies creation or deletion of namespaces with names contaning
36cfb7
    "/" or matching exactly "." or "..".
36cfb7
36cfb7
    Signed-off-by: Matteo Croce <mcroce@redhat.com>
36cfb7
---
36cfb7
 ip/ipnetns.c | 10 ++++++++++
36cfb7
 1 file changed, 10 insertions(+)
36cfb7
36cfb7
diff --git a/ip/ipnetns.c b/ip/ipnetns.c
e138d9
index 0b0378ab6560c..4254994442ccd 100644
36cfb7
--- a/ip/ipnetns.c
36cfb7
+++ b/ip/ipnetns.c
36cfb7
@@ -766,6 +766,11 @@ static int netns_monitor(int argc, char **argv)
36cfb7
 	return 0;
36cfb7
 }
36cfb7
 
36cfb7
+static int invalid_name(const char *name)
36cfb7
+{
36cfb7
+	return strchr(name, '/') || !strcmp(name, ".") || !strcmp(name, "..");
36cfb7
+}
36cfb7
+
36cfb7
 int do_netns(int argc, char **argv)
36cfb7
 {
36cfb7
 	netns_nsid_socket_init();
36cfb7
@@ -775,6 +780,11 @@ int do_netns(int argc, char **argv)
36cfb7
 		return netns_list(0, NULL);
36cfb7
 	}
36cfb7
 
36cfb7
+	if (argc > 1 && invalid_name(argv[1])) {
36cfb7
+		fprintf(stderr, "Invalid netns name \"%s\"\n", argv[1]);
36cfb7
+		exit(-1);
36cfb7
+	}
36cfb7
+
36cfb7
 	if ((matches(*argv, "list") == 0) || (matches(*argv, "show") == 0) ||
36cfb7
 	    (matches(*argv, "lst") == 0)) {
36cfb7
 		netns_map_init();
36cfb7
-- 
e138d9
2.21.0
36cfb7