mir/ovs
2
0
Fork 0
mirror of https://github.com/openvswitch/ovs synced 2025-08-30 22:05:19 +00:00
Code Issues Releases Wiki Activity

netdev-dpdk: Do not add vhost-user ports with '/' or '\' in name.

Browse Source 
This check prevents an obvious way for a vhost-user socket to escape the
intended directory.

There might be other ways to escape the directory (none comes to mind at
the moment), but this is a problem that should be properly solved by
mandatory access control.

A similar check is done for a bridge name, since that name is used as
part of a socket as well.

Signed-off-by: Daniele Di Proietto <diproiettod@vmware.com>
Acked-by: Flavio Leitner <fbl@sysclose.org>
This commit is contained in:
Daniele Di Proietto
2016-02-02 17:24:32 -08:00
parent 28f479c611
commit 1af27e8a4e
2 changed files with 16 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
lib/netdev-dpdk.c
View File

@@ -683,14 +683,26 @@ static int
netdev_dpdk_vhost_user_construct(struct netdev *netdev_)
{
struct netdev_dpdk *netdev = netdev_dpdk_cast(netdev_);
const char *name = netdev_->name;
int err;
/* 'name' is appended to 'vhost_sock_dir' and used to create a socket in
* the file system. '/' or '\' would traverse directories, so they're not
* acceptable in 'name'. */
if (strchr(name, '/') || strchr(name, '\\')) {
VLOG_ERR("\"%s\" is not a valid name for a vhost-user port. "
"A valid name must not include '/' or '\\'",
name);
return EINVAL;
}
ovs_mutex_lock(&dpdk_mutex);
/* Take the name of the vhost-user port and append it to the location where
* the socket is to be created, then register the socket.
*/
snprintf(netdev->vhost_id, sizeof(netdev->vhost_id), "%s/%s",
vhost_sock_dir, netdev_->name);
vhost_sock_dir, name);
err = rte_vhost_driver_register(netdev->vhost_id);
if (err) {
VLOG_ERR("vhost-user socket device setup failure for socket %s\n",
@@ -698,7 +710,7 @@ netdev_dpdk_vhost_user_construct(struct netdev *netdev_)
} else {
fatal_signal_add_file_to_unlink(netdev->vhost_id);
VLOG_INFO("Socket %s created for vhost-user port %s\n",
netdev->vhost_id, netdev_->name);
netdev->vhost_id, name);
err = vhost_construct_helper(netdev_);
}