| Message ID | 20211130110034.12920-1-cgzones@googlemail.com (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [1/2] libsepol/cil: support IPv4/IPv6 address embedding | expand |
On Tue, Nov 30, 2021 at 4:51 PM Christian Göttsche <cgzones@googlemail.com> wrote: > > Accept IPv4 addresses embedded in IPv6, like `::ffff:127.0.0.1`. > This allows using those in nodecon statements leading to fine grained > access control: > > type=AVC msg=audit(11/29/21 20:27:44.437:419) : avc: granted { node_bind } for pid=27500 comm=intercept saddr=::ffff:127.0.0.1 src=46293 scontext=xuser_u:xuser_r:xuser_t:s0 tcontext=system_u:object_r:lo_node_t:s0 tclass=tcp_socket > > This does effect policies in the traditional language due to CIL usage > in semodule(8). > > Also print on conversion failures the address in question. > > Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Acked-by: James Carter <jwcart2@gmail.com> > --- > libsepol/cil/src/cil_build_ast.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > > diff --git a/libsepol/cil/src/cil_build_ast.c b/libsepol/cil/src/cil_build_ast.c > index 9c34be23..eccb331b 100644 > --- a/libsepol/cil/src/cil_build_ast.c > +++ b/libsepol/cil/src/cil_build_ast.c > @@ -5668,10 +5668,10 @@ int cil_fill_ipaddr(struct cil_tree_node *addr_node, struct cil_ipaddr *addr) > goto exit; > } > > - if (strchr(addr_node->data, '.') != NULL) { > - addr->family = AF_INET; > - } else { > + if (strchr(addr_node->data, ':') != NULL) { > addr->family = AF_INET6; > + } else { > + addr->family = AF_INET; > } > > rc = inet_pton(addr->family, addr_node->data, &addr->ip); > @@ -5683,7 +5683,7 @@ int cil_fill_ipaddr(struct cil_tree_node *addr_node, struct cil_ipaddr *addr) > return SEPOL_OK; > > exit: > - cil_log(CIL_ERR, "Bad ip address or netmask\n"); > + cil_log(CIL_ERR, "Bad ip address or netmask: %s\n", (addr_node && addr_node->data) ? (const char *)addr_node->data : "n/a"); > return rc; > } > > -- > 2.34.1 >
On Thu, Dec 9, 2021 at 3:30 PM James Carter <jwcart2@gmail.com> wrote: > > On Tue, Nov 30, 2021 at 4:51 PM Christian Göttsche > <cgzones@googlemail.com> wrote: > > > > Accept IPv4 addresses embedded in IPv6, like `::ffff:127.0.0.1`. > > This allows using those in nodecon statements leading to fine grained > > access control: > > > > type=AVC msg=audit(11/29/21 20:27:44.437:419) : avc: granted { node_bind } for pid=27500 comm=intercept saddr=::ffff:127.0.0.1 src=46293 scontext=xuser_u:xuser_r:xuser_t:s0 tcontext=system_u:object_r:lo_node_t:s0 tclass=tcp_socket > > > > This does effect policies in the traditional language due to CIL usage > > in semodule(8). > > > > Also print on conversion failures the address in question. > > > > Signed-off-by: Christian Göttsche <cgzones@googlemail.com> > > Acked-by: James Carter <jwcart2@gmail.com> > Both of these have been merged. Thanks, Jim > > --- > > libsepol/cil/src/cil_build_ast.c | 8 ++++---- > > 1 file changed, 4 insertions(+), 4 deletions(-) > > > > diff --git a/libsepol/cil/src/cil_build_ast.c b/libsepol/cil/src/cil_build_ast.c > > index 9c34be23..eccb331b 100644 > > --- a/libsepol/cil/src/cil_build_ast.c > > +++ b/libsepol/cil/src/cil_build_ast.c > > @@ -5668,10 +5668,10 @@ int cil_fill_ipaddr(struct cil_tree_node *addr_node, struct cil_ipaddr *addr) > > goto exit; > > } > > > > - if (strchr(addr_node->data, '.') != NULL) { > > - addr->family = AF_INET; > > - } else { > > + if (strchr(addr_node->data, ':') != NULL) { > > addr->family = AF_INET6; > > + } else { > > + addr->family = AF_INET; > > } > > > > rc = inet_pton(addr->family, addr_node->data, &addr->ip); > > @@ -5683,7 +5683,7 @@ int cil_fill_ipaddr(struct cil_tree_node *addr_node, struct cil_ipaddr *addr) > > return SEPOL_OK; > > > > exit: > > - cil_log(CIL_ERR, "Bad ip address or netmask\n"); > > + cil_log(CIL_ERR, "Bad ip address or netmask: %s\n", (addr_node && addr_node->data) ? (const char *)addr_node->data : "n/a"); > > return rc; > > } > > > > -- > > 2.34.1 > >
diff --git a/libsepol/cil/src/cil_build_ast.c b/libsepol/cil/src/cil_build_ast.c index 9c34be23..eccb331b 100644 --- a/libsepol/cil/src/cil_build_ast.c +++ b/libsepol/cil/src/cil_build_ast.c @@ -5668,10 +5668,10 @@ int cil_fill_ipaddr(struct cil_tree_node *addr_node, struct cil_ipaddr *addr) goto exit; } - if (strchr(addr_node->data, '.') != NULL) { - addr->family = AF_INET; - } else { + if (strchr(addr_node->data, ':') != NULL) { addr->family = AF_INET6; + } else { + addr->family = AF_INET; } rc = inet_pton(addr->family, addr_node->data, &addr->ip); @@ -5683,7 +5683,7 @@ int cil_fill_ipaddr(struct cil_tree_node *addr_node, struct cil_ipaddr *addr) return SEPOL_OK; exit: - cil_log(CIL_ERR, "Bad ip address or netmask\n"); + cil_log(CIL_ERR, "Bad ip address or netmask: %s\n", (addr_node && addr_node->data) ? (const char *)addr_node->data : "n/a"); return rc; }
Accept IPv4 addresses embedded in IPv6, like `::ffff:127.0.0.1`. This allows using those in nodecon statements leading to fine grained access control: type=AVC msg=audit(11/29/21 20:27:44.437:419) : avc: granted { node_bind } for pid=27500 comm=intercept saddr=::ffff:127.0.0.1 src=46293 scontext=xuser_u:xuser_r:xuser_t:s0 tcontext=system_u:object_r:lo_node_t:s0 tclass=tcp_socket This does effect policies in the traditional language due to CIL usage in semodule(8). Also print on conversion failures the address in question. Signed-off-by: Christian Göttsche <cgzones@googlemail.com> --- libsepol/cil/src/cil_build_ast.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)