From c14f9ee2f4f1d6283db04d5f5ca7fe43eca0a585 Mon Sep 17 00:00:00 2001 From: Bo Chen Date: Tue, 9 Jan 2024 14:08:12 -0800 Subject: [PATCH] vmm: ignore and warn TAP FDs send in vm.create This does the same thing as df2a7c17 ("vmm: Ignore and warn TAP FDs sent via the HTTP request body"), but for the vm.create endpoint, which also previously would accept file descriptors in the body, and try to use whatever fd occupied that number as a TAP device. Signed-off-by: Alyssa Ross Signed-off-by: Bo Chen (cherry picked from commit fba0b5f93c65473bd84f74e766fc272216f5e51c) --- vmm/src/api/http_endpoint.rs | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/vmm/src/api/http_endpoint.rs b/vmm/src/api/http_endpoint.rs index e15192ca7..79f166a2e 100644 --- a/vmm/src/api/http_endpoint.rs +++ b/vmm/src/api/http_endpoint.rs @@ -36,13 +36,22 @@ impl EndpointHandler for VmCreate { match &req.body { Some(body) => { // Deserialize into a VmConfig - let vm_config: VmConfig = match serde_json::from_slice(body.raw()) + let mut vm_config: VmConfig = match serde_json::from_slice(body.raw()) .map_err(HttpError::SerdeJsonDeserialize) { Ok(config) => config, Err(e) => return error_response(e, StatusCode::BadRequest), }; + if let Some(ref mut nets) = vm_config.net { + if nets.iter().any(|net| net.fds.is_some()) { + warn!("Ignoring FDs sent via the HTTP request body"); + } + for net in nets { + net.fds = None; + } + } + // Call vm_create() match vm_create(api_notifier, api_sender, Arc::new(Mutex::new(vm_config))) .map_err(HttpError::ApiError)