[#3969] Validate unix socket path in kea-netconf

diff --git a/src/bin/netconf/netconf_config.cc b/src/bin/netconf/netconf_config.cc
index d03b8129b38e933ca9520729f51796a970126751..292f9d12660ce28c3fb1f10b741a7f96eb41b980 100644 (file)
--- a/src/bin/netconf/netconf_config.cc
+++ b/src/bin/netconf/netconf_config.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2018-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2018-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,6 +7,7 @@
 #include <config.h>
 
 #include <asiolink/io_error.h>
+#include <config/unix_command_config.h>
 #include <exceptions/exceptions.h>
 #include <netconf/netconf_cfg_mgr.h>
 #include <netconf/netconf_log.h>
@@ -154,6 +155,10 @@ ControlSocketConfigParser::parse(ConstElementPtr ctrl_sock_config) {
                   << getPosition("socket-url", ctrl_sock_config)  << ")");
     }
 
+    if (type == CfgControlSocket::Type::UNIX) {
+        isc::config::UnixCommandConfig::validatePath(name);
+    }
+
     // Create the control socket.
     try {
         result.reset(new CfgControlSocket(type, name, url));

diff --git a/src/bin/netconf/unix_control_socket.cc b/src/bin/netconf/unix_control_socket.cc
index a882cadcc3e2be74bb899cb4d4c3dfe8e4c15c87..165ff40077e5cd75ce7c8b88499c7262fd2444d0 100644 (file)
--- a/src/bin/netconf/unix_control_socket.cc
+++ b/src/bin/netconf/unix_control_socket.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2018-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2018-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -15,6 +15,7 @@
 #include <cc/json_feed.h>
 #include <config/client_connection.h>
 #include <config/timeouts.h>
+#include <config/unix_command_config.h>
 #include <netconf/unix_control_socket.h>
 
 using namespace std;
@@ -59,7 +60,10 @@ UnixControlSocket::sendCommand(ConstElementPtr command) {
     boost::system::error_code received_ec;
     ConstJSONFeedPtr received_feed;
 
-    conn.start(ClientConnection::SocketPath(getName()),
+    string name(getName());
+    name = isc::config::UnixCommandConfig::validatePath(name);
+
+    conn.start(ClientConnection::SocketPath(name),
                ClientConnection::ControlCommand(command->toWire()),
                [&io_service, &received_ec, &received_feed]
                (const boost::system::error_code& ec, ConstJSONFeedPtr feed) {