diff options
| author | Lorenzo Colitti <lorenzo@google.com> | 2013-02-01 13:18:35 +0900 |
|---|---|---|
| committer | Lorenzo Colitti <lorenzo@google.com> | 2013-02-22 18:56:10 +0900 |
| commit | 4f3d78640de4573ced186edd3a09b1247d981edf (patch) | |
| tree | acd4f84b14a34a44ac4faf6a9fb2f782eb2f7f79 /netlink_msg.c | |
| parent | 70aba57df0f4a0ee800e7ba3694dbd9b6302a470 (diff) | |
| download | android_external_android-clat-4f3d78640de4573ced186edd3a09b1247d981edf.tar.gz android_external_android-clat-4f3d78640de4573ced186edd3a09b1247d981edf.tar.bz2 android_external_android-clat-4f3d78640de4573ced186edd3a09b1247d981edf.zip | |
Ensure netlink messages come from the kernel.
Currently clatd accepts all netlink messages without validating
that they come from the kernel. This could allow another app to
spoof these messages. Fix this by connecting the socket to the
kernel so that no other process can send it messages.
Bug: 7664960
Change-Id: I994641ea13cfd07fb25ccf52fcbbf5d1c9633ec4
Diffstat (limited to 'netlink_msg.c')
| -rw-r--r-- | netlink_msg.c | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/netlink_msg.c b/netlink_msg.c index 7363028..2ba237d 100644 --- a/netlink_msg.c +++ b/netlink_msg.c @@ -103,6 +103,21 @@ struct nl_msg *nlmsg_alloc_rtmsg(uint16_t type, uint16_t flags, struct rtmsg *rt return nlmsg_alloc_generic(type, flags, rt, sizeof(*rt)); } +/* function: netlink_set_kernel_only + * sets a socket to receive messages only from the kernel + * sock - socket to connect + */ +int netlink_set_kernel_only(struct nl_sock *nl_sk) { + struct sockaddr_nl addr = { AF_NETLINK, 0, 0, 0 }; + + if (!nl_sk) { + return -EFAULT; + } + + int sockfd = nl_socket_get_fd(nl_sk); + return connect(sockfd, (struct sockaddr *) &addr, sizeof(addr)); +} + /* function: send_netlink_msg * sends a netlink message, reads a response, and hands the response(s) to the callbacks * msg - netlink message to send @@ -121,6 +136,9 @@ void send_netlink_msg(struct nl_msg *msg, struct nl_cb *callbacks) { if(nl_send_auto_complete(nl_sk, msg) < 0) goto cleanup; + if(netlink_set_kernel_only(nl_sk) < 0) + goto cleanup; + nl_recvmsgs(nl_sk, callbacks); cleanup: |