lkml.org 
[lkml]   [2013]   [Sep]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 06/11] staging: usbip: Add support for ACLs in usbipd
    Date
    Interpret the ACLs stored in sysfs in usbipd and reject clients not
    matching one of the ACLs.

    Signed-off-by: Kurt Kanzenbach <ly80toro@cip.cs.fau.de>
    Signed-off-by: Dominik Paulus <dominik.paulus@fau.de>
    Signed-off-by: Tobias Polzer <tobias.polzer@fau.de>
    ---
    drivers/staging/usbip/userspace/src/Makefile.am | 2 +-
    drivers/staging/usbip/userspace/src/usbipd.c | 79 +++++++++++++++++++++++++
    2 files changed, 80 insertions(+), 1 deletion(-)

    diff --git a/drivers/staging/usbip/userspace/src/Makefile.am b/drivers/staging/usbip/userspace/src/Makefile.am
    index a113003..5161bae 100644
    --- a/drivers/staging/usbip/userspace/src/Makefile.am
    +++ b/drivers/staging/usbip/userspace/src/Makefile.am
    @@ -9,4 +9,4 @@ usbip_SOURCES := usbip.h utils.h usbip.c utils.c usbip_network.c \
    usbip_bind.c usbip_unbind.c


    -usbipd_SOURCES := usbip_network.h usbipd.c usbip_network.c
    +usbipd_SOURCES := usbip_network.h usbipd.c usbip_network.c utils.c
    diff --git a/drivers/staging/usbip/userspace/src/usbipd.c b/drivers/staging/usbip/userspace/src/usbipd.c
    index 8db2f27..bc1fd19 100644
    --- a/drivers/staging/usbip/userspace/src/usbipd.c
    +++ b/drivers/staging/usbip/userspace/src/usbipd.c
    @@ -48,6 +48,7 @@
    #include "usbip_host_driver.h"
    #include "usbip_common.h"
    #include "usbip_network.h"
    +#include "utils.h"

    #undef PROGNAME
    #define PROGNAME "usbipd"
    @@ -169,12 +170,69 @@ static void usbipd_help(void)
    printf("%s\n", usbipd_help_string);
    }

    +/*
    + * Checks whether client IP matches at least one
    + * ACL entry
    + *
    + * Returns:
    + * 1 if matches
    + * 0 if not
    + * -1 on error
    + */
    +static int check_allowed(char *acls, int sockfd)
    +{
    + int rc, match;
    + struct sockaddr_storage sa;
    + char *acl_cpy, *iter, *saveptr;
    + socklen_t sa_len = sizeof(sa);
    +
    + rc = getpeername(sockfd, (struct sockaddr *) &sa, &sa_len);
    + if (rc || sa_len > sizeof(sa)) {
    + err("getpeername failed: %s", strerror(errno));
    + return -1;
    + }
    +
    + /*
    + * We are going to modify our argument,
    + * thus, we need to duplicate it.
    + */
    + acl_cpy = strdup(acls);
    + if (!acl_cpy) {
    + err("strdup(): %s", strerror(errno));
    + return -1;
    + }
    +
    + match = 0;
    + iter = strtok_r(acl_cpy, "\n", &saveptr);
    + /*
    + * Iterate over ACL entries and check for
    + * matching one.
    + */
    + while (iter) {
    + struct subnet net;
    +
    + if (parse_cidr(iter, &net) < 0) {
    + dbg("parse_cidr() failed");
    + } else if (in_range(&sa, net)) {
    + match = 1;
    + break;
    + }
    +
    + iter = strtok_r(NULL, "\n", &saveptr);
    + }
    +
    + free(acl_cpy);
    + return match;
    +}
    +
    static int recv_request_import(int sockfd)
    {
    struct op_import_request req;
    struct op_common reply;
    struct usbip_exported_device *edev;
    struct usbip_usb_device pdu_udev;
    + struct sysfs_attribute *usbip_acl;
    + char ip_attr_path[SYSFS_PATH_MAX];
    int found = 0;
    int error = 0;
    int rc;
    @@ -206,6 +264,27 @@ static int recv_request_import(int sockfd)
    rc = usbip_host_export_device(edev, sockfd);
    if (rc < 0)
    error = 1;
    +
    + /* check for allowed IPs */
    + snprintf(ip_attr_path, sizeof(ip_attr_path), "%s/%s:%d.%d/%s",
    + edev->udev.path, edev->udev.busid,
    + edev->udev.bConfigurationValue, 0, "usbip_acl");
    +
    + usbip_acl = sysfs_open_attribute(ip_attr_path);
    + if (usbip_acl) {
    + rc = sysfs_read_attribute(usbip_acl);
    + if (rc < 0) {
    + err("Unable to open sysfs");
    + error = 1;
    + } else if (check_allowed(usbip_acl->value, sockfd) != 1) {
    + info("Access denied to device %s",
    + edev->udev.busid);
    + error = 1;
    + }
    + sysfs_close_attribute(usbip_acl);
    + } else {
    + err("failed to get ip list");
    + }
    } else {
    info("requested device not found: %s", req.busid);
    error = 1;
    --
    1.8.4


    \
     
     \ /
      Last update: 2013-09-11 18:41    [W:4.289 / U:0.328 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site