Correclty pass through Ipv6 addresses in sharenfs #11939
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
felixdoerre
force-pushed
the
ipv6_sharenfs
branch
3 times, most recently
from
beba464 to
9782d81
Compare
behlendorf
added
Status: Work in Progress
felixdoerre
force-pushed
the
ipv6_sharenfs
branch
4 times, most recently
from
68dad9c to
8fe9726
Compare
|
@behlendorf Hi, I've found time to build/run testcases locally. I have now moved some of the testing into a new test case and in the last force-push updated only the assertions in that test case. I have run the new test-case locally and it goes through, so I am resonably sure that we shouldn't see any CI-Failure caused by the changes. I'd say that this PR is now ready for review, but I can't remove the "Work-In-Progress"-Label. It would be nice, if you could do that. |
felixdoerre
force-pushed
the
ipv6_sharenfs
branch
2 times, most recently
from
1503482 to
bd2ca17
Compare
behlendorf
added
Status: Code Review Needed
felixdoerre
force-pushed
the
ipv6_sharenfs
branch
from
cbb1b65 to
a56fe2f
Compare
felixdoerre
force-pushed
the
ipv6_sharenfs
branch
from
a56fe2f to
4bdbf57
Compare
felixdoerre
force-pushed
the
ipv6_sharenfs
branch
2 times, most recently
from
f263525 to
51ddcd5
Compare
behlendorf
approved these changes
Oct 18, 2021
tests/zfs-tests/tests/functional/cli_root/zfs_share/zfs_share_013_pos.ksh
Outdated
Show resolved
Hide resolved
tests/zfs-tests/tests/functional/cli_root/zfs_share/zfs_share_013_pos.ksh
Show resolved
Hide resolved
Closes: openzfs#11171, openzfs#1894 Signed-off-by: Felix Dörre <[email protected]>
felixdoerre
force-pushed
the
ipv6_sharenfs
branch
from
c5f08c0 to
5421a04
Compare
behlendorf
added
Status: Accepted
|
Do you know when this pull request will make it into the official release? I see it merged in the master branch, but the code is not making in the official releases |
behlendorf
pushed a commit
to behlendorf/zfs
that referenced
this pull request
Dec 21, 2023
Recognize when the host part of a sharenfs attribute is an ipv6 Literal and pass that through without modification. Reviewed-by: Brian Behlendorf <[email protected]> Signed-off-by: Felix Dörre <[email protected]> Closes: openzfs#11171 Closes openzfs#11939 Closes: openzfs#1894
behlendorf
pushed a commit
that referenced
this pull request
Dec 22, 2023
Recognize when the host part of a sharenfs attribute is an ipv6 Literal and pass that through without modification. Reviewed-by: Brian Behlendorf <[email protected]> Signed-off-by: Felix Dörre <[email protected]> Closes: #11171 Closes #11939 Closes: #1894
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Recognize when the host part of a
sharenfsattribute is an ipv6 Literal and pass that through without modification.Motivation and Context
Closes: #11171
Closes: #1894
It might also solve CVE-2013-20001. This depends on the expectations an admin has. CVE-2013-20001 is exploitable when an admin configures an ipv6 address (range) for sharenfs and it is effectively ignored resulting in no error. With this patch, the Ipv6 range is interpreted successfully if enclosed in square brackets. If it is not enclosed in square brackets it is still interpreted as before: a list of strange host names, which could result in the confusion for CVE-2013-20001.
Description
If a host starts with
[it is interpreted as an Ipv6 Literal. In that case, the host is assumed to go until the next]. If such a]does not occur, it is treated as syntax error. The next byte after]must be either:(for another host) or a null byte or/indicating an IP-Range.How Has This Been Tested?
Created a new test case that runs through perfectly. Also manually setting the property and inspecting the corresponding file in
/etc/exportsshows the expected contents.Types of changes
Checklist:
Signed-off-by.