[Devel] [PATCH 3/5] netfilter: check per-ve netfilter status on actual operation

[Stanislav Kinsburskiy]

21.07.2017 12:50, Andrey Ryabinin пишет:
> 
> 
> On 07/21/2017 10:23 AM, Stanislav Kinsburskiy wrote:
>> Signed-off-by: Stanislav Kinsburskiy <skinsbursky at virtuozzo.com>
>> ---
>>  net/ipv4/ip_sockglue.c |    7 +++++++
>>  1 file changed, 7 insertions(+)
>>
>> diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
>> index bcca7f3..316b477 100644
>> --- a/net/ipv4/ip_sockglue.c
>> +++ b/net/ipv4/ip_sockglue.c
>> @@ -1119,6 +1119,10 @@ int ip_setsockopt(struct sock *sk, int level,
>>  			optname != IP_IPSEC_POLICY &&
>>  			optname != IP_XFRM_POLICY &&
>>  			!ip_mroute_opt(optname)) {
>> +
>> +		if (!ve_ipt_permitted(net, VE_IP_FILTER))
>> +			return -EINVAL;
> 
> 
> EINVAL doesn't look a right choice for the error code here.
> I'd say ENOPROTOOPT or maybe EPERM would be better?
> 

Agreed. ENOPROTOOPT looks better. Will do.

>> +
>>  		lock_sock(sk);
>>  		err = nf_setsockopt(sk, PF_INET, optname, optval, optlen);
>>  		release_sock(sk);
>> @@ -1424,6 +1428,9 @@ int ip_getsockopt(struct sock *sk, int level,
>>  		if (get_user(len, optlen))
>>  			return -EFAULT;
>>  
>> +		if (!ve_ipt_permitted(net, VE_IP_FILTER))
>> +			return -ENOENT;
>> +
>>  		lock_sock(sk);
>>  		err = nf_getsockopt(sk, PF_INET, optname, optval,
>>  				&len);
>>
>> _______________________________________________
>> Devel mailing list
>> Devel at openvz.org
>> https://lists.openvz.org/mailman/listinfo/devel
>>