[Devel] [PATCH v2] netfilter: check per-ve netfilter status on actual operation

[Andrey Ryabinin]

On 07/21/2017 03:06 PM, Stanislav Kinsburskiy wrote:
> v2:
> 1) Return ENOPROTOOPT instead of ENOENT from ip_setsockopt
> 
> Signed-off-by: Stanislav Kinsburskiy <skinsbursky at virtuozzo.com>
> ---
>  net/ipv4/ip_sockglue.c |    7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
> index bcca7f3..8b22763 100644
> --- a/net/ipv4/ip_sockglue.c
> +++ b/net/ipv4/ip_sockglue.c
> @@ -1119,6 +1119,10 @@ int ip_setsockopt(struct sock *sk, int level,
>  			optname != IP_IPSEC_POLICY &&
>  			optname != IP_XFRM_POLICY &&
>  			!ip_mroute_opt(optname)) {
> +
> +		if (!ve_ipt_permitted(net, VE_IP_FILTER))
> +			return -ENOPROTOOPT;
> +
>  		lock_sock(sk);
>  		err = nf_setsockopt(sk, PF_INET, optname, optval, optlen);
>  		release_sock(sk);
> @@ -1424,6 +1428,9 @@ int ip_getsockopt(struct sock *sk, int level,
>  		if (get_user(len, optlen))
>  			return -EFAULT;
>  
> +		if (!ve_ipt_permitted(net, VE_IP_FILTER))
> +			return -ENOENT;

And the same err here ?

> +
>  		lock_sock(sk);
>  		err = nf_getsockopt(sk, PF_INET, optname, optval,
>  				&len);
>