upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-05-28 04:12:45 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

cap_net: correct capability name from addr2name to name2addr

Browse source 
Previously, while checking name2addr capabilities, we mistakenly used
the addr2name set. This error could cause a process to inadvertently
reset its limitations.

Reported by:	Shawn Webb <shawn.webb@hardenedbsd.org>

(cherry picked from commit afd74c400075d94e01dd3430844bb290834660ef)
This commit is contained in:
Mariusz Zaborski 2023-10-23 23:03:51 +02:00 committed by Ed Maste
parent ae6e3ea5e1
commit 765757c630
2 changed files with 13 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lib/libcasper/services/cap_net/cap_net.c
View file

@ -1232,7 +1232,7 @@ verify_name2addr_newlimits(const nvlist_t *oldlimits,
oldfunclimits = NULL;
if (oldlimits != NULL) {
oldfunclimits = dnvlist_get_nvlist(oldlimits,
LIMIT_NV_ADDR2NAME, NULL);
LIMIT_NV_NAME2ADDR, NULL);
}
cookie = NULL;

12
lib/libcasper/services/cap_net/tests/net_test.c
View file

@ -783,6 +783,18 @@ ATF_TC_BODY(capnet__limits_name2addr_hosts, tc)
limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
ATF_REQUIRE(cap_net_limit(limit) != 0);
/* Try to extend the limit. */
limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
ATF_REQUIRE(limit != NULL);
cap_net_limit_name2addr(limit, TEST_DOMAIN_1, NULL);
ATF_REQUIRE(cap_net_limit(limit) != 0);
limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
ATF_REQUIRE(limit != NULL);
cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
cap_net_limit_name2addr(limit, TEST_DOMAIN_1, NULL);
ATF_REQUIRE(cap_net_limit(limit) != 0);
cap_close(capnet);
}