From 27f9aa16d664c8eccdf06fb5c82c7498fcdf823a Mon Sep 17 00:00:00 2001 From: Murali Reddy Date: Mon, 16 Jul 2018 12:43:09 +0530 Subject: [PATCH] 3206: Protect against CNI plugin being called with the host namespace adding a check to verify if network namespace is not host network namespace Fixes #3206 --- plugin/net/cni.go | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/plugin/net/cni.go b/plugin/net/cni.go index 363971a3..04d2de4e 100644 --- a/plugin/net/cni.go +++ b/plugin/net/cni.go @@ -117,6 +117,16 @@ func (c *CNIPlugin) CmdAdd(args *skel.CmdArgs) error { } defer ns.Close() + hostNs, err := netns.Get() + if err != nil { + return fmt.Errorf("error accessing host network namespace: %s", err) + } + defer hostNs.Close() + + if ns.Equal(hostNs) { + return fmt.Errorf("can not specify host network namespace as network namespace to which container should be added") + } + id := args.ContainerID if len(id) < 5 { data := make([]byte, 5)