* [PATCH -resend 1/6] mISDN: Add support for group membership check
@ 2013-05-22 12:59 Jiri Slaby
2013-05-22 12:59 ` [PATCH -resend 2/6] ehea: add alias entry for portN properties Jiri Slaby
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Jiri Slaby @ 2013-05-22 12:59 UTC (permalink / raw)
To: jirislaby
Cc: akpm, linux-kernel, Jeff Mahoney, Patrick Koppen, Jiri Slaby,
Karsten Keil, netdev, David S. Miller
From: Jeff Mahoney <jeffm@suse.com>
This patch adds a module parameter to allow a group access to the
mISDN devices. Otherwise, unpriviledged users on systems with ISDN
hardware have the ability to dial out, potentially causing expensive
bills.
Based on a different implementation by Patrick Koppen <isdn4linux@koppen.de>
Acked-by: Jeff Mahoney <jeffm@suse.com>
Cc: Patrick Koppen <isdn4linux@koppen.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Karsten Keil <isdn@linux-pingi.de>
Cc: netdev@vger.kernel.org
Cc: "David S. Miller" <davem@davemloft.net>
---
drivers/isdn/mISDN/core.c | 3 +++
drivers/isdn/mISDN/core.h | 1 +
drivers/isdn/mISDN/socket.c | 8 ++++++++
3 files changed, 12 insertions(+)
diff --git a/drivers/isdn/mISDN/core.c b/drivers/isdn/mISDN/core.c
index da30c5c..a7050c3 100644
--- a/drivers/isdn/mISDN/core.c
+++ b/drivers/isdn/mISDN/core.c
@@ -21,10 +21,13 @@
#include "core.h"
static u_int debug;
+u_int misdn_permitted_gid;
MODULE_AUTHOR("Karsten Keil");
MODULE_LICENSE("GPL");
module_param(debug, uint, S_IRUGO | S_IWUSR);
+module_param_named(gid, misdn_permitted_gid, uint, 0);
+MODULE_PARM_DESC(gid, "Unix group for accessing misdn socket (default 0)");
static u64 device_ids;
#define MAX_DEVICE_ID 63
diff --git a/drivers/isdn/mISDN/core.h b/drivers/isdn/mISDN/core.h
index 52695bb..6ea673f 100644
--- a/drivers/isdn/mISDN/core.h
+++ b/drivers/isdn/mISDN/core.h
@@ -17,6 +17,7 @@
extern struct mISDNdevice *get_mdevice(u_int);
extern int get_mdevice_count(void);
+extern u_int misdn_permitted_gid;
/* stack status flag */
#define mISDN_STACK_ACTION_MASK 0x0000ffff
diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
index e47dcb9..71f4986 100644
--- a/drivers/isdn/mISDN/socket.c
+++ b/drivers/isdn/mISDN/socket.c
@@ -612,6 +612,10 @@ data_sock_create(struct net *net, struct socket *sock, int protocol)
{
struct sock *sk;
+ if(!capable(CAP_SYS_ADMIN) && (misdn_permitted_gid != current_gid())
+ && (!in_group_p(misdn_permitted_gid)))
+ return -EPERM;
+
if (sock->type != SOCK_DGRAM)
return -ESOCKTNOSUPPORT;
@@ -694,6 +698,10 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
case IMSETDEVNAME:
{
struct mISDN_devrename dn;
+ if(!capable(CAP_SYS_ADMIN)
+ && (misdn_permitted_gid != current_gid())
+ && (!in_group_p(misdn_permitted_gid)))
+ return -EPERM;
if (copy_from_user(&dn, (void __user *)arg,
sizeof(dn))) {
err = -EFAULT;
--
1.8.2.3
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH -resend 2/6] ehea: add alias entry for portN properties 2013-05-22 12:59 [PATCH -resend 1/6] mISDN: Add support for group membership check Jiri Slaby @ 2013-05-22 12:59 ` Jiri Slaby 2013-05-22 12:59 ` [PATCH -resend 4/6] netfilter: Implement RFC 1123 for FTP conntrack Jiri Slaby 2013-05-22 19:04 ` [PATCH -resend 1/6] mISDN: Add support for group membership check Sergei Shtylyov 2 siblings, 0 replies; 6+ messages in thread From: Jiri Slaby @ 2013-05-22 12:59 UTC (permalink / raw) To: jirislaby Cc: akpm, linux-kernel, Olaf Hering, Jeff Mahoney, Jiri Slaby, Thadeu Lima de Souza Cascardo, netdev, David S. Miller From: Olaf Hering <ohering@suse.com> Use separate table for alias entries in the ehea module, otherwise the probe() function will operate on the separate ports instead of the lhea-"root" entry of the device-tree References: https://bugzilla.novell.com/show_bug.cgi?id=435215 Signed-off-by: Jeff Mahoney <jeffm@suse.com> Signed-off-by: Olaf Hering <ohering@suse.com> Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com> Cc: netdev@vger.kernel.org Cc: "David S. Miller" <davem@davemloft.net> --- drivers/net/ethernet/ibm/ehea/ehea_main.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c index 90ea0b1..1114418 100644 --- a/drivers/net/ethernet/ibm/ehea/ehea_main.c +++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c @@ -103,6 +103,19 @@ static int ehea_probe_adapter(struct platform_device *dev, static int ehea_remove(struct platform_device *dev); +static struct of_device_id ehea_module_device_table[] = { + { + .name = "lhea", + .compatible = "IBM,lhea", + }, + { + .type = "network", + .compatible = "IBM,lhea-ethernet", + }, + {}, +}; +MODULE_DEVICE_TABLE(of, ehea_module_device_table); + static struct of_device_id ehea_device_table[] = { { .name = "lhea", @@ -110,7 +123,6 @@ static struct of_device_id ehea_device_table[] = { }, {}, }; -MODULE_DEVICE_TABLE(of, ehea_device_table); static struct of_platform_driver ehea_driver = { .driver = { -- 1.8.2.3 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH -resend 4/6] netfilter: Implement RFC 1123 for FTP conntrack 2013-05-22 12:59 [PATCH -resend 1/6] mISDN: Add support for group membership check Jiri Slaby 2013-05-22 12:59 ` [PATCH -resend 2/6] ehea: add alias entry for portN properties Jiri Slaby @ 2013-05-22 12:59 ` Jiri Slaby 2013-05-27 12:20 ` Pablo Neira Ayuso 2013-05-22 19:04 ` [PATCH -resend 1/6] mISDN: Add support for group membership check Sergei Shtylyov 2 siblings, 1 reply; 6+ messages in thread From: Jiri Slaby @ 2013-05-22 12:59 UTC (permalink / raw) To: jirislaby Cc: akpm, linux-kernel, Jeff Mahoney, Jiri Slaby, Pablo Neira Ayuso, Patrick McHardy, David S. Miller, netfilter-devel, netfilter, coreteam, netdev From: Jeff Mahoney <jeffm@suse.com> The FTP conntrack code currently only accepts the following format for the 227 response for PASV: 227 Entering Passive Mode (148,100,81,40,31,161). It doesn't accept the following format from an obscure server: 227 Data transfer will passively listen to 67,218,99,134,50,144 From RFC 1123: The format of the 227 reply to a PASV command is not well standardized. In particular, an FTP client cannot assume that the parentheses shown on page 40 of RFC-959 will be present (and in fact, Figure 3 on page 43 omits them). Therefore, a User-FTP program that interprets the PASV reply must scan the reply for the first digit of the host and port numbers. This patch adds support for the RFC 1123 clarification by: - Allowing a search filter to specify NUL as the terminator so that try_number will return successfully if the array of numbers has been filled when an unexpected character is encountered. - Using space as the separator for the 227 reply and then scanning for the first digit of the number sequence. The number sequence is parsed out using the existing try_rfc959 but with a NUL terminator. References: https://bugzilla.novell.com/show_bug.cgi?id=466279 References: http://bugzilla.netfilter.org/show_bug.cgi?id=574 Reported-by: Mark Post <mpost@novell.com> Signed-off-by: Jeff Mahoney <jeffm@suse.com> Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: Pablo Neira Ayuso <pablo@netfilter.org> Cc: Patrick McHardy <kaber@trash.net> Cc: "David S. Miller" <davem@davemloft.net> Cc: netfilter-devel@vger.kernel.org Cc: netfilter@vger.kernel.org Cc: coreteam@netfilter.org Cc: netdev@vger.kernel.org --- net/netfilter/nf_conntrack_ftp.c | 73 +++++++++++++++++++++++++++++----------- 1 file changed, 54 insertions(+), 19 deletions(-) diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c index 6b21707..b8a0924 100644 --- a/net/netfilter/nf_conntrack_ftp.c +++ b/net/netfilter/nf_conntrack_ftp.c @@ -55,10 +55,14 @@ unsigned int (*nf_nat_ftp_hook)(struct sk_buff *skb, struct nf_conntrack_expect *exp); EXPORT_SYMBOL_GPL(nf_nat_ftp_hook); -static int try_rfc959(const char *, size_t, struct nf_conntrack_man *, char); -static int try_eprt(const char *, size_t, struct nf_conntrack_man *, char); +static int try_rfc959(const char *, size_t, struct nf_conntrack_man *, + char, unsigned int *); +static int try_rfc1123(const char *, size_t, struct nf_conntrack_man *, + char, unsigned int *); +static int try_eprt(const char *, size_t, struct nf_conntrack_man *, + char, unsigned int *); static int try_epsv_response(const char *, size_t, struct nf_conntrack_man *, - char); + char, unsigned int *); static struct ftp_search { const char *pattern; @@ -66,7 +70,7 @@ static struct ftp_search { char skip; char term; enum nf_ct_ftp_type ftptype; - int (*getnum)(const char *, size_t, struct nf_conntrack_man *, char); + int (*getnum)(const char *, size_t, struct nf_conntrack_man *, char, unsigned int *); } search[IP_CT_DIR_MAX][2] = { [IP_CT_DIR_ORIGINAL] = { { @@ -90,10 +94,8 @@ static struct ftp_search { { .pattern = "227 ", .plen = sizeof("227 ") - 1, - .skip = '(', - .term = ')', .ftptype = NF_CT_FTP_PASV, - .getnum = try_rfc959, + .getnum = try_rfc1123, }, { .pattern = "229 ", @@ -132,8 +134,9 @@ static int try_number(const char *data, size_t dlen, u_int32_t array[], i++; else { /* Unexpected character; true if it's the - terminator and we're finished. */ - if (*data == term && i == array_size - 1) + terminator (or we don't care about one) + and we're finished. */ + if ((*data == term || !term) && i == array_size - 1) return len; pr_debug("Char %u (got %u nums) `%u' unexpected\n", @@ -148,7 +151,8 @@ static int try_number(const char *data, size_t dlen, u_int32_t array[], /* Returns 0, or length of numbers: 192,168,1,1,5,6 */ static int try_rfc959(const char *data, size_t dlen, - struct nf_conntrack_man *cmd, char term) + struct nf_conntrack_man *cmd, char term, + unsigned int *offset) { int length; u_int32_t array[6]; @@ -163,6 +167,33 @@ static int try_rfc959(const char *data, size_t dlen, return length; } +/* + * From RFC 1123: + * The format of the 227 reply to a PASV command is not + * well standardized. In particular, an FTP client cannot + * assume that the parentheses shown on page 40 of RFC-959 + * will be present (and in fact, Figure 3 on page 43 omits + * them). Therefore, a User-FTP program that interprets + * the PASV reply must scan the reply for the first digit + * of the host and port numbers. + */ +static int try_rfc1123(const char *data, size_t dlen, + struct nf_conntrack_man *cmd, char term, + unsigned int *offset) +{ + int i; + for (i = 0; i < dlen; i++) + if (isdigit(data[i])) + break; + + if (i == dlen) + return 0; + + *offset += i; + + return try_rfc959(data + i, dlen - i, cmd, 0, offset); +} + /* Grab port: number up to delimiter */ static int get_port(const char *data, int start, size_t dlen, char delim, __be16 *port) @@ -191,7 +222,7 @@ static int get_port(const char *data, int start, size_t dlen, char delim, /* Returns 0, or length of numbers: |1|132.235.1.2|6275| or |2|3ffe::1|6275| */ static int try_eprt(const char *data, size_t dlen, struct nf_conntrack_man *cmd, - char term) + char term, unsigned int *offset) { char delim; int length; @@ -239,7 +270,8 @@ static int try_eprt(const char *data, size_t dlen, struct nf_conntrack_man *cmd, /* Returns 0, or length of numbers: |||6446| */ static int try_epsv_response(const char *data, size_t dlen, - struct nf_conntrack_man *cmd, char term) + struct nf_conntrack_man *cmd, char term, + unsigned int *offset) { char delim; @@ -261,9 +293,10 @@ static int find_pattern(const char *data, size_t dlen, unsigned int *numlen, struct nf_conntrack_man *cmd, int (*getnum)(const char *, size_t, - struct nf_conntrack_man *, char)) + struct nf_conntrack_man *, char, + unsigned int *)) { - size_t i; + size_t i = plen; pr_debug("find_pattern `%s': dlen = %Zu\n", pattern, dlen); if (dlen == 0) @@ -293,16 +326,18 @@ static int find_pattern(const char *data, size_t dlen, pr_debug("Pattern matches!\n"); /* Now we've found the constant string, try to skip to the 'skip' character */ - for (i = plen; data[i] != skip; i++) - if (i == dlen - 1) return -1; + if (skip) { + for (i = plen; data[i] != skip; i++) + if (i == dlen - 1) return -1; - /* Skip over the last character */ - i++; + /* Skip over the last character */ + i++; + } pr_debug("Skipped up to `%c'!\n", skip); *numoff = i; - *numlen = getnum(data + i, dlen - i, cmd, term); + *numlen = getnum(data + i, dlen - i, cmd, term, numoff); if (!*numlen) return -1; -- 1.8.2.3 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH -resend 4/6] netfilter: Implement RFC 1123 for FTP conntrack 2013-05-22 12:59 ` [PATCH -resend 4/6] netfilter: Implement RFC 1123 for FTP conntrack Jiri Slaby @ 2013-05-27 12:20 ` Pablo Neira Ayuso 0 siblings, 0 replies; 6+ messages in thread From: Pablo Neira Ayuso @ 2013-05-27 12:20 UTC (permalink / raw) To: Jiri Slaby Cc: jirislaby, akpm, linux-kernel, Jeff Mahoney, Patrick McHardy, David S. Miller, netfilter-devel, netfilter, coreteam, netdev On Wed, May 22, 2013 at 02:59:10PM +0200, Jiri Slaby wrote: > From: Jeff Mahoney <jeffm@suse.com> > > The FTP conntrack code currently only accepts the following format for > the 227 response for PASV: > 227 Entering Passive Mode (148,100,81,40,31,161). > > It doesn't accept the following format from an obscure server: > 227 Data transfer will passively listen to 67,218,99,134,50,144 > > From RFC 1123: > The format of the 227 reply to a PASV command is not > well standardized. In particular, an FTP client cannot > assume that the parentheses shown on page 40 of RFC-959 > will be present (and in fact, Figure 3 on page 43 omits > them). Therefore, a User-FTP program that interprets > the PASV reply must scan the reply for the first digit > of the host and port numbers. Applied, thanks. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH -resend 1/6] mISDN: Add support for group membership check 2013-05-22 12:59 [PATCH -resend 1/6] mISDN: Add support for group membership check Jiri Slaby 2013-05-22 12:59 ` [PATCH -resend 2/6] ehea: add alias entry for portN properties Jiri Slaby 2013-05-22 12:59 ` [PATCH -resend 4/6] netfilter: Implement RFC 1123 for FTP conntrack Jiri Slaby @ 2013-05-22 19:04 ` Sergei Shtylyov 2013-05-22 19:42 ` [PATCH v2 " Jiri Slaby 2 siblings, 1 reply; 6+ messages in thread From: Sergei Shtylyov @ 2013-05-22 19:04 UTC (permalink / raw) To: Jiri Slaby Cc: jirislaby, akpm, linux-kernel, Jeff Mahoney, Patrick Koppen, Karsten Keil, netdev, David S. Miller Hello. On 22-05-2013 16:59, Jiri Slaby wrote: > From: Jeff Mahoney <jeffm@suse.com> > This patch adds a module parameter to allow a group access to the > mISDN devices. Otherwise, unpriviledged users on systems with ISDN > hardware have the ability to dial out, potentially causing expensive > bills. > Based on a different implementation by Patrick Koppen <isdn4linux@koppen.de> > Acked-by: Jeff Mahoney <jeffm@suse.com> > Cc: Patrick Koppen <isdn4linux@koppen.de> > Signed-off-by: Jiri Slaby <jslaby@suse.cz> > Cc: Karsten Keil <isdn@linux-pingi.de> > Cc: netdev@vger.kernel.org > Cc: "David S. Miller" <davem@davemloft.net> > --- > drivers/isdn/mISDN/core.c | 3 +++ > drivers/isdn/mISDN/core.h | 1 + > drivers/isdn/mISDN/socket.c | 8 ++++++++ > 3 files changed, 12 insertions(+) [...] > diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c > index e47dcb9..71f4986 100644 > --- a/drivers/isdn/mISDN/socket.c > +++ b/drivers/isdn/mISDN/socket.c > @@ -612,6 +612,10 @@ data_sock_create(struct net *net, struct socket *sock, int protocol) > { > struct sock *sk; > > + if(!capable(CAP_SYS_ADMIN) && (misdn_permitted_gid != current_gid()) Did you run this thru scripts/checkpatch.pl? There should be space after *if*. Also, () around != are not neccessary... > @@ -694,6 +698,10 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) > case IMSETDEVNAME: > { > struct mISDN_devrename dn; > + if(!capable(CAP_SYS_ADMIN) Again, need space after *if*. > + && (misdn_permitted_gid != current_gid()) Better leave && on a previous line and align the line under !. () again are not necessary. > + && (!in_group_p(misdn_permitted_gid))) () around !x are simply not needed -- ! operator has very high priority. WBR, Sergei ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2 -resend 1/6] mISDN: Add support for group membership check 2013-05-22 19:04 ` [PATCH -resend 1/6] mISDN: Add support for group membership check Sergei Shtylyov @ 2013-05-22 19:42 ` Jiri Slaby 0 siblings, 0 replies; 6+ messages in thread From: Jiri Slaby @ 2013-05-22 19:42 UTC (permalink / raw) To: jirislaby Cc: linux-kernel, Jeff Mahoney, Patrick Koppen, Jiri Slaby, Karsten Keil, netdev, David S. Miller, Sergei Shtylyov From: Jeff Mahoney <jeffm@suse.com> This patch adds a module parameter to allow a group access to the mISDN devices. Otherwise, unpriviledged users on systems with ISDN hardware have the ability to dial out, potentially causing expensive bills. Based on a different implementation by Patrick Koppen <isdn4linux@koppen.de>. [v2] - convert to the new UID/GID API - fix whitespace issues (per Sergei) Acked-by: Jeff Mahoney <jeffm@suse.com> Cc: Patrick Koppen <isdn4linux@koppen.de> Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: Karsten Keil <isdn@linux-pingi.de> Cc: netdev@vger.kernel.org Cc: "David S. Miller" <davem@davemloft.net> Cc: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> --- drivers/isdn/mISDN/core.c | 6 ++++++ drivers/isdn/mISDN/core.h | 1 + drivers/isdn/mISDN/socket.c | 9 +++++++++ 3 files changed, 16 insertions(+) diff --git a/drivers/isdn/mISDN/core.c b/drivers/isdn/mISDN/core.c index da30c5c..174aa3f 100644 --- a/drivers/isdn/mISDN/core.c +++ b/drivers/isdn/mISDN/core.c @@ -21,10 +21,14 @@ #include "core.h" static u_int debug; +static u_int gid; +kgid_t misdn_permitted_gid; MODULE_AUTHOR("Karsten Keil"); MODULE_LICENSE("GPL"); module_param(debug, uint, S_IRUGO | S_IWUSR); +module_param(gid, uint, 0); +MODULE_PARM_DESC(gid, "Unix group for accessing misdn socket (default 0)"); static u64 device_ids; #define MAX_DEVICE_ID 63 @@ -372,6 +376,8 @@ mISDNInit(void) { int err; + misdn_permitted_gid = make_kgid(current_user_ns(), gid); + printk(KERN_INFO "Modular ISDN core version %d.%d.%d\n", MISDN_MAJOR_VERSION, MISDN_MINOR_VERSION, MISDN_RELEASE); mISDN_init_clock(&debug); diff --git a/drivers/isdn/mISDN/core.h b/drivers/isdn/mISDN/core.h index 52695bb..5f509bf 100644 --- a/drivers/isdn/mISDN/core.h +++ b/drivers/isdn/mISDN/core.h @@ -17,6 +17,7 @@ extern struct mISDNdevice *get_mdevice(u_int); extern int get_mdevice_count(void); +extern kgid_t misdn_permitted_gid; /* stack status flag */ #define mISDN_STACK_ACTION_MASK 0x0000ffff diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c index e47dcb9..8dcef36 100644 --- a/drivers/isdn/mISDN/socket.c +++ b/drivers/isdn/mISDN/socket.c @@ -612,6 +612,11 @@ data_sock_create(struct net *net, struct socket *sock, int protocol) { struct sock *sk; + if (!capable(CAP_SYS_ADMIN) && + !gid_eq(misdn_permitted_gid, current_gid()) && + !in_group_p(misdn_permitted_gid)) + return -EPERM; + if (sock->type != SOCK_DGRAM) return -ESOCKTNOSUPPORT; @@ -694,6 +699,10 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) case IMSETDEVNAME: { struct mISDN_devrename dn; + if (!capable(CAP_SYS_ADMIN) && + !gid_eq(misdn_permitted_gid, current_gid()) && + !in_group_p(misdn_permitted_gid)) + return -EPERM; if (copy_from_user(&dn, (void __user *)arg, sizeof(dn))) { err = -EFAULT; -- 1.8.2.3 ^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2013-05-27 12:20 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2013-05-22 12:59 [PATCH -resend 1/6] mISDN: Add support for group membership check Jiri Slaby 2013-05-22 12:59 ` [PATCH -resend 2/6] ehea: add alias entry for portN properties Jiri Slaby 2013-05-22 12:59 ` [PATCH -resend 4/6] netfilter: Implement RFC 1123 for FTP conntrack Jiri Slaby 2013-05-27 12:20 ` Pablo Neira Ayuso 2013-05-22 19:04 ` [PATCH -resend 1/6] mISDN: Add support for group membership check Sergei Shtylyov 2013-05-22 19:42 ` [PATCH v2 " Jiri Slaby
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).