Add additional check for i2c master write read command
For security reasons, in i2c master RW IPMI command,
if the write date count > 1, needs to check if it is in MTF mode.
Tested:
In normal mode,
ipmitool raw 0x6 0x52 0xf 0xa2 8 0 works, but
ipmitool raw 0x6 0x52 0xf 0xa2 8 0 0 fails with
Insufficient privilege level.
Boot into MFG mode, the above command works.
Signed-off-by: Yong Li <yong.b.li@linux.intel.com>
Change-Id: I364f41f632ed3790bcd1d9e9193c9c4a3529af53
diff --git a/src/manufacturingcommands.cpp b/src/manufacturingcommands.cpp
index 50c91b9..e395e8c 100644
--- a/src/manufacturingcommands.cpp
+++ b/src/manufacturingcommands.cpp
@@ -587,6 +587,25 @@
return ipmi::response(resetMtmTimer(yield));
}
+ipmi::Cc mfgFilterMessage(ipmi::message::Request::ptr request)
+{
+ // i2c master write read command needs additional checking
+ if ((request->ctx->netFn == ipmi::netFnApp) &&
+ (request->ctx->cmd == ipmi::app::cmdMasterWriteRead))
+ {
+ if (request->payload.size() > 4)
+ {
+ // Allow write data count > 1, only if it is in MFG mode
+ if (mtm.getAccessLvl() != MtmLvl::mtmAvailable)
+ {
+ return ipmi::ccInsufficientPrivilege;
+ }
+ }
+ }
+
+ return ipmi::ccSuccess;
+}
+
} // namespace ipmi
void register_mtm_commands() __attribute__((constructor));
@@ -608,5 +627,10 @@
static_cast<ipmi::Cmd>(IPMINetfnIntelOEMGeneralCmd::cmdMtmKeepAlive),
ipmi::Privilege::Admin, ipmi::mtmKeepAlive);
+ ipmi::registerFilter(ipmi::netFnOemOne,
+ [](ipmi::message::Request::ptr request) {
+ return ipmi::mfgFilterMessage(request);
+ });
+
return;
}