updated HariSekhonUtils.pm allow vlans in isInterface#46
updated HariSekhonUtils.pm allow vlans in isInterface#46samsk wants to merge 1 commit intoHariSekhon:masterfrom
Conversation
| $interface .= "." . $vlan | ||
| } | ||
| # TODO: consider checking if the interface actually exists on the system | ||
| $interface =~ /^((?:em|eth|bond|lo|docker)\d+|lo|veth[A-Fa-f0-9]+)$/ or return; |
There was a problem hiding this comment.
I think removing this line checking the format on the interface name needs some kind of reinstating to avoid weakening the check.
Unit tests need to be extended a bit to test failure of a fake interface called hari0 instead of eth0 for example, which fails on this branch, which highlights the weakening without the regex validation.
Also, the regex test should be done to untaint the returned interface. The code base runs entirely in taint security mode and relies on known good specific regexes to untaint user inputs. This patch inadvertently removes the untainting.
There was a problem hiding this comment.
Hi, thanks for the response.
I've dared to removed the regex check, because its IMHO not possible to craft a regex to match interface names other than alnum - ie. the former regex did not worked for brX, tailscaleX, tunX, wlanX, wmnetX just to name a few. btw. interface hari0 is also valid interface name ;-)
$ ip link add link eth0 name hari0 type vlan id 101
hari0: flags=4098<BROADCAST,MULTICAST> mtu 1500
ether 96:00:03:6c:82:23 txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
Also, the isInterface() was not used till now anywhere except of validate_interface(), that was mentioned only in the comment of check_linux_interface.pl (https://github.com/HariSekhon/Nagios-Plugins/blob/master/check_linux_interface.pl#L61).
The untainting is done in isAlnum and isInt (as it was till now, directly in check_linux_interface.pl), but I can improve it more if you have some suggestion how. One possibility can be, to close this todo
# TODO: consider checking if the interface actually exists on the system
and check interface name against /proc/net/dev.
This PR modifies isInterface() to allow any alfanumeric interface name with vlan suffix (ie. eth0.100).