Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4cd6b475 authored by Mahesh Bandewar's avatar Mahesh Bandewar Committed by David S. Miller
Browse files

bonding: Display LACP info only to CAP_NET_ADMIN capable user 



Actor and Partner details can be accessed via proc-fs, sys-fs
entries or netlink interface. These interfaces are world readable
at this moment. The earlier patch-series made the LACP communication
secure to avoid nuisance attack from within the same L2 domain but
it did not prevent "someone unprivileged" looking at that information
on host and perform the same act.

This patch essentially avoids spitting those entries if the user
in question does not have enough privileges.

Signed-off-by: default avatarMahesh Bandewar <maheshb@google.com>
Signed-off-by: default avatarAndy Gospodarek <gospo@cumulusnetworks.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1f02c09b

drivers/net/bonding/bond_netlink.c

+12 −11
Original line number Original line Diff line number Diff line
@@ -601,6 +601,7 @@ static int bond_fill_info(struct sk_buff *skb, 
	if (BOND_MODE(bond) == BOND_MODE_8023AD) {

	if (BOND_MODE(bond) == BOND_MODE_8023AD) {

		struct ad_info info;

		struct ad_info info;





		if (capable(CAP_NET_ADMIN)) {

			if (nla_put_u16(skb, IFLA_BOND_AD_ACTOR_SYS_PRIO,

			if (nla_put_u16(skb, IFLA_BOND_AD_ACTOR_SYS_PRIO,

					bond->params.ad_actor_sys_prio))

					bond->params.ad_actor_sys_prio))

				goto nla_put_failure;

				goto nla_put_failure;
@@ -613,7 +614,7 @@ static int bond_fill_info(struct sk_buff *skb, 
				    sizeof(bond->params.ad_actor_system),

				    sizeof(bond->params.ad_actor_system),

				    &bond->params.ad_actor_system))

				    &bond->params.ad_actor_system))

				goto nla_put_failure;

				goto nla_put_failure;



		}

		if (!bond_3ad_get_active_agg_info(bond, &info)) {

		if (!bond_3ad_get_active_agg_info(bond, &info)) {

			struct nlattr *nest;

			struct nlattr *nest;

drivers/net/bonding/bond_procfs.c

+53 −48
Original line number Original line Diff line number Diff line
@@ -135,13 +135,15 @@ static void bond_info_show_master(struct seq_file *seq) 
					  bond->params.ad_select);

					  bond->params.ad_select);

		seq_printf(seq, "Aggregator selection policy (ad_select): %s\n",

		seq_printf(seq, "Aggregator selection policy (ad_select): %s\n",

			   optval->string);

			   optval->string);

		if (capable(CAP_NET_ADMIN)) {

			seq_printf(seq, "System priority: %d\n",

			seq_printf(seq, "System priority: %d\n",

				   BOND_AD_INFO(bond).system.sys_priority);

				   BOND_AD_INFO(bond).system.sys_priority);

			seq_printf(seq, "System MAC address: %pM\n",

			seq_printf(seq, "System MAC address: %pM\n",

				   &BOND_AD_INFO(bond).system.sys_mac_addr);

				   &BOND_AD_INFO(bond).system.sys_mac_addr);





			if (__bond_3ad_get_active_agg_info(bond, &ad_info)) {

			if (__bond_3ad_get_active_agg_info(bond, &ad_info)) {

			seq_printf(seq, "bond %s has no active aggregator\n",

				seq_printf(seq,

					   "bond %s has no active aggregator\n",

					   bond->dev->name);

					   bond->dev->name);

			} else {

			} else {

				seq_printf(seq, "Active Aggregator Info:\n");

				seq_printf(seq, "Active Aggregator Info:\n");
@@ -159,6 +161,7 @@ static void bond_info_show_master(struct seq_file *seq) 
			}

			}

		}

		}

	}

	}

}





static void bond_info_show_slave(struct seq_file *seq,

static void bond_info_show_slave(struct seq_file *seq,

				 const struct slave *slave)

				 const struct slave *slave)
@@ -199,6 +202,7 @@ static void bond_info_show_slave(struct seq_file *seq, 
			seq_printf(seq, "Partner Churned Count: %d\n",

			seq_printf(seq, "Partner Churned Count: %d\n",

				   port->churn_partner_count);

				   port->churn_partner_count);





			if (capable(CAP_NET_ADMIN)) {

				seq_puts(seq, "details actor lacp pdu:\n");

				seq_puts(seq, "details actor lacp pdu:\n");

				seq_printf(seq, "    system priority: %d\n",

				seq_printf(seq, "    system priority: %d\n",

					   port->actor_system_priority);

					   port->actor_system_priority);
@@ -226,6 +230,7 @@ static void bond_info_show_slave(struct seq_file *seq, 
					   port->partner_oper.port_number);

					   port->partner_oper.port_number);

				seq_printf(seq, "    port state: %d\n",

				seq_printf(seq, "    port state: %d\n",

					   port->partner_oper.port_state);

					   port->partner_oper.port_state);

			}

		} else {

		} else {

			seq_puts(seq, "Aggregator ID: N/A\n");

			seq_puts(seq, "Aggregator ID: N/A\n");

		}

		}

drivers/net/bonding/bond_sysfs.c

+6 −6
Original line number Original line Diff line number Diff line
@@ -549,7 +549,7 @@ static ssize_t bonding_show_ad_actor_key(struct device *d, 
	int count = 0;

	int count = 0;

	struct bonding *bond = to_bond(d);

	struct bonding *bond = to_bond(d);





	if (BOND_MODE(bond) == BOND_MODE_8023AD) {

	if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN)) {

		struct ad_info ad_info;

		struct ad_info ad_info;

		count = sprintf(buf, "%d\n",

		count = sprintf(buf, "%d\n",

				bond_3ad_get_active_agg_info(bond, &ad_info)

				bond_3ad_get_active_agg_info(bond, &ad_info)
@@ -569,7 +569,7 @@ static ssize_t bonding_show_ad_partner_key(struct device *d, 
	int count = 0;

	int count = 0;

	struct bonding *bond = to_bond(d);

	struct bonding *bond = to_bond(d);





	if (BOND_MODE(bond) == BOND_MODE_8023AD) {

	if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN)) {

		struct ad_info ad_info;

		struct ad_info ad_info;

		count = sprintf(buf, "%d\n",

		count = sprintf(buf, "%d\n",

				bond_3ad_get_active_agg_info(bond, &ad_info)

				bond_3ad_get_active_agg_info(bond, &ad_info)
@@ -589,7 +589,7 @@ static ssize_t bonding_show_ad_partner_mac(struct device *d, 
	int count = 0;

	int count = 0;

	struct bonding *bond = to_bond(d);

	struct bonding *bond = to_bond(d);





	if (BOND_MODE(bond) == BOND_MODE_8023AD) {

	if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN)) {

		struct ad_info ad_info;

		struct ad_info ad_info;

		if (!bond_3ad_get_active_agg_info(bond, &ad_info))

		if (!bond_3ad_get_active_agg_info(bond, &ad_info))

			count = sprintf(buf, "%pM\n", ad_info.partner_system);

			count = sprintf(buf, "%pM\n", ad_info.partner_system);
@@ -698,7 +698,7 @@ static ssize_t bonding_show_ad_actor_sys_prio(struct device *d, 
{

{

	struct bonding *bond = to_bond(d);

	struct bonding *bond = to_bond(d);





	if (BOND_MODE(bond) == BOND_MODE_8023AD)

	if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN))

		return sprintf(buf, "%hu\n", bond->params.ad_actor_sys_prio);

		return sprintf(buf, "%hu\n", bond->params.ad_actor_sys_prio);





	return 0;

	return 0;
@@ -712,7 +712,7 @@ static ssize_t bonding_show_ad_actor_system(struct device *d, 
{

{

	struct bonding *bond = to_bond(d);

	struct bonding *bond = to_bond(d);





	if (BOND_MODE(bond) == BOND_MODE_8023AD)

	if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN))

		return sprintf(buf, "%pM\n", bond->params.ad_actor_system);

		return sprintf(buf, "%pM\n", bond->params.ad_actor_system);





	return 0;

	return 0;
@@ -727,7 +727,7 @@ static ssize_t bonding_show_ad_user_port_key(struct device *d, 
{

{

	struct bonding *bond = to_bond(d);

	struct bonding *bond = to_bond(d);





	if (BOND_MODE(bond) == BOND_MODE_8023AD)

	if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN))

		return sprintf(buf, "%hu\n", bond->params.ad_user_port_key);

		return sprintf(buf, "%hu\n", bond->params.ad_user_port_key);





	return 0;

	return 0;