Skip to content

Commit faef0b3

Browse files
arkqarkq
committed
Reject all but BlueZ calls on /org/bluez endpoints
1 parent 3e45d84 commit faef0b3

File tree

7 files changed

+93
-133
lines changed

7 files changed

+93
-133
lines changed

‎.github/workflows/build-and-test.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ jobs:
6969
sanitize-prepare:
7070
runs-on: ubuntu-22.04
7171
steps:
72-
- uses: actions/cache@v3
72+
- uses: actions/cache@v4
7373
id: cache
7474
with:
7575
key: sanitize-env
@@ -153,7 +153,7 @@ jobs:
153153
make clean
154154
SANITIZERS=$(for x in ${{ matrix.sanitize }}; do echo -n " -fsanitize=$x"; done)
155155
make check CFLAGS="-g -O2 $SANITIZERS -fno-sanitize-recover=all" TESTS=
156-
- uses: actions/cache/restore@v3
156+
- uses: actions/cache/restore@v4
157157
if: ${{ matrix.sanitize == 'thread' }}
158158
with:
159159
key: sanitize-env

‎doc/bluealsa-cli.1.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ info *PCM_PATH*
8989
The list of available A2DP codecs requires BlueZ SEP support
9090
(BlueZ >= 5.52)
9191

92-
codec [--force] *PCM_PATH* [*CODEC*[:*CONFIG*]]
92+
codec [--force] *PCM_PATH* [*CODEC*\ [:*CONFIG*]]
9393
Get or set the Bluetooth codec used by the given PCM.
9494

9595
If *CODEC* is given, change the codec to be used by the given PCM. This

‎src/ba-transport.c

+4-11
Original file line numberDiff line numberDiff line change
@@ -288,14 +288,10 @@ static int transport_acquire_bt_a2dp(struct ba_transport *t) {
288288
t->a2dp.state == BLUEZ_A2DP_TRANSPORT_STATE_PENDING ? "TryAcquire" : "Acquire");
289289

290290
if ((rep = g_dbus_connection_send_message_with_reply_sync(config.dbus, msg,
291-
G_DBUS_SEND_MESSAGE_FLAGS_NONE, -1, NULL, NULL, &err)) == NULL)
291+
G_DBUS_SEND_MESSAGE_FLAGS_NONE, -1, NULL, NULL, &err)) == NULL ||
292+
g_dbus_message_to_gerror(rep, &err))
292293
goto fail;
293294

294-
if (g_dbus_message_get_message_type(rep) == G_DBUS_MESSAGE_TYPE_ERROR) {
295-
g_dbus_message_to_gerror(rep, &err);
296-
goto fail;
297-
}
298-
299295
uint16_t mtu_read, mtu_write;
300296
g_variant_get(g_dbus_message_get_body(rep), "(hqq)",
301297
NULL, &mtu_read, &mtu_write);
@@ -351,11 +347,8 @@ static int transport_release_bt_a2dp(struct ba_transport *t) {
351347
BLUEZ_IFACE_MEDIA_TRANSPORT, "Release");
352348

353349
if ((rep = g_dbus_connection_send_message_with_reply_sync(config.dbus, msg,
354-
G_DBUS_SEND_MESSAGE_FLAGS_NONE, -1, NULL, NULL, &err)) == NULL)
355-
goto fail;
356-
357-
if (g_dbus_message_get_message_type(rep) == G_DBUS_MESSAGE_TYPE_ERROR) {
358-
g_dbus_message_to_gerror(rep, &err);
350+
G_DBUS_SEND_MESSAGE_FLAGS_NONE, -1, NULL, NULL, &err)) == NULL ||
351+
g_dbus_message_to_gerror(rep, &err)) {
359352
if (err->code == G_DBUS_ERROR_NO_REPLY ||
360353
err->code == G_DBUS_ERROR_SERVICE_UNKNOWN ||
361354
err->code == G_DBUS_ERROR_UNKNOWN_OBJECT) {

‎src/bluez.c

+34-27
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/*
22
* BlueALSA - bluez.c
3-
* Copyright (c) 2016-2023 Arkadiusz Bokowy
3+
* Copyright (c) 2016-2024 Arkadiusz Bokowy
44
*
55
* This file is a part of bluez-alsa.
66
*
@@ -91,20 +91,27 @@ struct bluez_adapter {
9191
static pthread_mutex_t bluez_mutex = PTHREAD_MUTEX_INITIALIZER;
9292
static GHashTable *dbus_object_data_map = NULL;
9393
static struct bluez_adapter bluez_adapters[HCI_MAX_DEV] = { 0 };
94+
static char bluez_dbus_unique_name[64] = "";
9495

9596
static void bluez_register_a2dp_all(struct ba_adapter *);
9697

9798
static void bluez_register_media_application_finish(GObject *source,
9899
GAsyncResult *result, void *userdata) {
99100
(void)userdata;
100101

102+
GDBusMessage *rep;
101103
GError *err = NULL;
102-
GDBusMessage *rep = g_dbus_connection_send_message_with_reply_finish(
103-
G_DBUS_CONNECTION(source), result, &err);
104-
if (rep != NULL &&
105-
g_dbus_message_get_message_type(rep) == G_DBUS_MESSAGE_TYPE_ERROR)
106-
g_dbus_message_to_gerror(rep, &err);
107104

105+
if ((rep = g_dbus_connection_send_message_with_reply_finish(
106+
G_DBUS_CONNECTION(source), result, &err)) == NULL ||
107+
g_dbus_message_to_gerror(rep, &err))
108+
goto fail;
109+
110+
/* Save sender (BlueZ) unique name for calls filtering. */
111+
const char *sender = g_dbus_message_get_sender(rep);
112+
strncpy(bluez_dbus_unique_name, sender, sizeof(bluez_dbus_unique_name) - 1);
113+
114+
fail:
108115
if (rep != NULL)
109116
g_object_unref(rep);
110117
if (err != NULL) {
@@ -146,12 +153,12 @@ static void bluez_register_battery_provider_finish(GObject *source,
146153
GAsyncResult *result, void *userdata) {
147154
(void)userdata;
148155

156+
GDBusMessage *rep;
149157
GError *err = NULL;
150-
GDBusMessage *rep = g_dbus_connection_send_message_with_reply_finish(
151-
G_DBUS_CONNECTION(source), result, &err);
152-
if (rep != NULL &&
153-
g_dbus_message_get_message_type(rep) == G_DBUS_MESSAGE_TYPE_ERROR) {
154-
g_dbus_message_to_gerror(rep, &err);
158+
159+
if ((rep = g_dbus_connection_send_message_with_reply_finish(
160+
G_DBUS_CONNECTION(source), result, &err)) == NULL ||
161+
g_dbus_message_to_gerror(rep, &err)) {
155162
if (err->code == G_DBUS_ERROR_UNKNOWN_METHOD) {
156163
/* Suppress warning message in case when BlueZ has no battery provider
157164
* support enabled, because it's not a mandatory feature. */
@@ -658,12 +665,16 @@ static void bluez_export_a2dp(
658665

659666
static const GDBusMethodCallDispatcher dispatchers[] = {
660667
{ .method = "SelectConfiguration",
668+
.sender = bluez_dbus_unique_name,
661669
.handler = bluez_endpoint_select_configuration },
662670
{ .method = "SetConfiguration",
671+
.sender = bluez_dbus_unique_name,
663672
.handler = bluez_endpoint_set_configuration },
664673
{ .method = "ClearConfiguration",
674+
.sender = bluez_dbus_unique_name,
665675
.handler = bluez_endpoint_clear_configuration },
666676
{ .method = "Release",
677+
.sender = bluez_dbus_unique_name,
667678
.handler = bluez_endpoint_release },
668679
{ 0 },
669680
};
@@ -983,7 +994,7 @@ static int bluez_register_profile(
983994
GError **error) {
984995

985996
GDBusMessage *msg = NULL, *rep = NULL;
986-
int ret = 0;
997+
int ret = -1;
987998

988999
debug("Registering hands-free profile: %s", dbus_obj->path);
9891000

@@ -1002,20 +1013,17 @@ static int bluez_register_profile(
10021013
g_variant_builder_clear(&options);
10031014

10041015
if ((rep = g_dbus_connection_send_message_with_reply_sync(config.dbus, msg,
1005-
G_DBUS_SEND_MESSAGE_FLAGS_NONE, -1, NULL, NULL, error)) == NULL)
1016+
G_DBUS_SEND_MESSAGE_FLAGS_NONE, -1, NULL, NULL, error)) == NULL ||
1017+
g_dbus_message_to_gerror(rep, error))
10061018
goto fail;
10071019

1008-
if (g_dbus_message_get_message_type(rep) == G_DBUS_MESSAGE_TYPE_ERROR) {
1009-
g_dbus_message_to_gerror(rep, error);
1010-
goto fail;
1011-
}
1020+
/* Save sender (BlueZ) unique name for calls filtering. */
1021+
const char *sender = g_dbus_message_get_sender(rep);
1022+
strncpy(bluez_dbus_unique_name, sender, sizeof(bluez_dbus_unique_name) - 1);
10121023

1013-
goto final;
1024+
ret = 0;
10141025

10151026
fail:
1016-
ret = -1;
1017-
1018-
final:
10191027
if (msg != NULL)
10201028
g_object_unref(msg);
10211029
if (rep != NULL)
@@ -1034,10 +1042,13 @@ static void bluez_register_hfp(
10341042

10351043
static const GDBusMethodCallDispatcher dispatchers[] = {
10361044
{ .method = "NewConnection",
1045+
.sender = bluez_dbus_unique_name,
10371046
.handler = bluez_profile_new_connection },
10381047
{ .method = "RequestDisconnection",
1048+
.sender = bluez_dbus_unique_name,
10391049
.handler = bluez_profile_request_disconnection },
10401050
{ .method = "Release",
1051+
.sender = bluez_dbus_unique_name,
10411052
.handler = bluez_profile_release },
10421053
{ 0 },
10431054
};
@@ -1655,14 +1666,10 @@ bool bluez_a2dp_set_configuration(
16551666
pthread_mutex_unlock(&bluez_mutex);
16561667

16571668
if ((rep = g_dbus_connection_send_message_with_reply_sync(config.dbus, msg,
1658-
G_DBUS_SEND_MESSAGE_FLAGS_NONE, -1, NULL, NULL, error)) == NULL)
1669+
G_DBUS_SEND_MESSAGE_FLAGS_NONE, -1, NULL, NULL, error)) == NULL ||
1670+
g_dbus_message_to_gerror(rep, error))
16591671
goto fail;
16601672

1661-
if (g_dbus_message_get_message_type(rep) == G_DBUS_MESSAGE_TYPE_ERROR) {
1662-
g_dbus_message_to_gerror(rep, error);
1663-
goto fail;
1664-
}
1665-
16661673
rv = true;
16671674

16681675
fail:

‎src/dbus.c

+12-20
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/*
22
* BlueALSA - dbus.c
3-
* Copyright (c) 2016-2023 Arkadiusz Bokowy
3+
* Copyright (c) 2016-2024 Arkadiusz Bokowy
44
*
55
* This file is a part of bluez-alsa.
66
*
@@ -51,7 +51,8 @@ static bool g_dbus_dispatch_method_call(const GDBusMethodCallDispatcher *dispatc
5151
}
5252

5353
/* make sure that we will not leak the invocation object */
54-
g_dbus_method_invocation_return_value(invocation, NULL);
54+
g_dbus_method_invocation_return_error(invocation, G_DBUS_ERROR,
55+
G_DBUS_ERROR_UNKNOWN_METHOD, "Unknown method: %s.%s()", interface, method);
5556
return false;
5657
}
5758

@@ -179,14 +180,10 @@ GVariantIter *g_dbus_get_managed_objects(GDBusConnection *conn,
179180
DBUS_IFACE_OBJECT_MANAGER, "GetManagedObjects");
180181

181182
if ((rep = g_dbus_connection_send_message_with_reply_sync(conn, msg,
182-
G_DBUS_SEND_MESSAGE_FLAGS_NONE, -1, NULL, NULL, error)) == NULL)
183+
G_DBUS_SEND_MESSAGE_FLAGS_NONE, -1, NULL, NULL, error)) == NULL ||
184+
g_dbus_message_to_gerror(rep, error))
183185
goto fail;
184186

185-
if (g_dbus_message_get_message_type(rep) == G_DBUS_MESSAGE_TYPE_ERROR) {
186-
g_dbus_message_to_gerror(rep, error);
187-
goto fail;
188-
}
189-
190187
g_variant_get(g_dbus_message_get_body(rep), "(a{oa{sa{sv}}})", &objects);
191188

192189
fail:
@@ -222,13 +219,9 @@ GVariant *g_dbus_get_property(GDBusConnection *conn, const char *service,
222219
g_dbus_message_set_body(msg, g_variant_new("(ss)", interface, property));
223220

224221
if ((rep = g_dbus_connection_send_message_with_reply_sync(conn, msg,
225-
G_DBUS_SEND_MESSAGE_FLAGS_NONE, -1, NULL, NULL, error)) == NULL)
226-
goto fail;
227-
228-
if (g_dbus_message_get_message_type(rep) == G_DBUS_MESSAGE_TYPE_ERROR) {
229-
g_dbus_message_to_gerror(rep, error);
222+
G_DBUS_SEND_MESSAGE_FLAGS_NONE, -1, NULL, NULL, error)) == NULL ||
223+
g_dbus_message_to_gerror(rep, error))
230224
goto fail;
231-
}
232225

233226
g_variant_get(g_dbus_message_get_body(rep), "(v)", &value);
234227

@@ -258,18 +251,17 @@ bool g_dbus_set_property(GDBusConnection *conn, const char *service,
258251
const GVariant *value, GError **error) {
259252

260253
GDBusMessage *msg = NULL, *rep = NULL;
254+
bool rv = false;
261255

262256
msg = g_dbus_message_new_method_call(service, path, DBUS_IFACE_PROPERTIES, "Set");
263257
g_dbus_message_set_body(msg, g_variant_new("(ssv)", interface, property, value));
264258

265259
if ((rep = g_dbus_connection_send_message_with_reply_sync(conn, msg,
266-
G_DBUS_SEND_MESSAGE_FLAGS_NONE, -1, NULL, NULL, error)) == NULL)
260+
G_DBUS_SEND_MESSAGE_FLAGS_NONE, -1, NULL, NULL, error)) == NULL ||
261+
g_dbus_message_to_gerror(rep, error))
267262
goto fail;
268263

269-
if (g_dbus_message_get_message_type(rep) == G_DBUS_MESSAGE_TYPE_ERROR) {
270-
g_dbus_message_to_gerror(rep, error);
271-
goto fail;
272-
}
264+
rv = true;
273265

274266
fail:
275267

@@ -278,5 +270,5 @@ bool g_dbus_set_property(GDBusConnection *conn, const char *service,
278270
if (rep != NULL)
279271
g_object_unref(rep);
280272

281-
return error == NULL;
273+
return rv;
282274
}

0 commit comments

Comments
 (0)