Validate interface name passed in ECS_OFFHOST_INTROSPECTION_INTERFACE_NAME

[sparrc]

Summary

ECS_OFFHOST_INTROSPECTION_INTERFACE_NAME allows system administrators to input an interface name in the ecs.config file. This user input is then passed into an exec iptables command here:

amazon-ecs-agent/ecs-init/exec/iptables/iptables.go

Lines 206 to 222 in 4480f9d

	func getBlockIntrospectionOffhostAccessInputChainArgs() []string {
	return []string{
	"INPUT",
	"-p", "tcp",
	"-i", defaultOffhostIntrospectionInterface,
	"--dport", agentIntrospectionServerPort,
	"-j", "DROP",
	}
	}
	func getOffhostIntrospectionInterface() (string, error) {
	s := os.Getenv(offhostIntrospectonAccessInterfaceEnv)
	if s != "" {
	return s, nil
	}
	return getDefaultNetworkInterfaceIPv4()
	}

ecs.config is a protected file that only the root user has write access to, so the threat is limited. But we should still validate that this is a valid linux interface name anyways, so that this env var cannot be used to inject an unexpected command into the middle of this iptables command.

Testing

New tests cover the changes: yes

Description for the changelog

Enhancement: Validate ECS_OFFHOST_INTROSPECTION_INTERFACE_NAME is a valid interface name.

Licensing

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.