From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.2 required=3.0 tests=FROM_EXCESS_BASE64, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E3603C4321A for ; Fri, 28 Jun 2019 13:31:50 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id BAAFA208E3 for ; Fri, 28 Jun 2019 13:31:50 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org BAAFA208E3 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Received: from localhost ([::1]:59936 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1hgqyj-00068V-B7 for qemu-devel@archiver.kernel.org; Fri, 28 Jun 2019 09:31:49 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:43596) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1hgqKT-0003IK-RH for qemu-devel@nongnu.org; Fri, 28 Jun 2019 08:50:17 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hgqKS-000497-1Y for qemu-devel@nongnu.org; Fri, 28 Jun 2019 08:50:13 -0400 Received: from mx1.redhat.com ([209.132.183.28]:51980) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1hgqKR-00041u-Ey for qemu-devel@nongnu.org; Fri, 28 Jun 2019 08:50:11 -0400 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 1E46D1796 for ; Fri, 28 Jun 2019 11:32:23 +0000 (UTC) Received: from redhat.com (unknown [10.42.17.95]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 69F9D60920; Fri, 28 Jun 2019 11:32:22 +0000 (UTC) Date: Fri, 28 Jun 2019 12:32:20 +0100 From: Daniel =?utf-8?B?UC4gQmVycmFuZ8Op?= To: P J P Message-ID: <20190628113220.GD23344@redhat.com> References: <20190628094901.13347-1-ppandit@redhat.com> <20190628110457.GA23344@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.12.0 (2019-05-25) X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Fri, 28 Jun 2019 11:32:24 +0000 (UTC) Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.132.183.28 Subject: Re: [Qemu-devel] [PATCH] qemu-bridge-helper: restrict bridge name to IFNAMSIZ X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Daniel =?utf-8?B?UC4gQmVycmFuZ8Op?= Cc: Riccardo Schirone , Qemu Developers Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" On Fri, Jun 28, 2019 at 04:51:31PM +0530, P J P wrote: > +-- On Fri, 28 Jun 2019, Daniel P. Berrang=C3=A9 wrote --+ > | Can you elaborate on the way to exploit this as I'm not seeing > | any way that doesn't involve mis-configuration of the ACL > | config file data. >=20 > True, it depends on having an 'allow all' rule. If the bridge.conf had = an=20 > 'allow all' rule below >=20 > =3D=3D > deny BridgeLength0xF > allow all > =3D=3D >=20 > And user supplied name as --br=3DBridgeLength0xFun >=20 > if (strcmp(bridge, acl_rule->iface) =3D=3D 0) { >=20 > the strcmp(3) above would not match the deny ACL rule, because given br= idge=20 > name is longer. And qemu-bridge-helper would go on to connect the tap d= evice=20 > with a bridge that is configured to have access denied. Ok, so we should explicitly report an error if the user supplied bridge name is too long, not silently truncate it. We should also reoprt an error if config file has too long a bridge name. Regards, Daniel --=20 |: https://berrange.com -o- https://www.flickr.com/photos/dberran= ge :| |: https://libvirt.org -o- https://fstop138.berrange.c= om :| |: https://entangle-photo.org -o- https://www.instagram.com/dberran= ge :|