From owner-svn-src-all@FreeBSD.ORG Sat Feb 7 13:51:16 2009 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id A61A91065670; Sat, 7 Feb 2009 13:51:16 +0000 (UTC) (envelope-from bz@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 789AB8FC0C; Sat, 7 Feb 2009 13:51:16 +0000 (UTC) (envelope-from bz@FreeBSD.org) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id n17DpG1l093598; Sat, 7 Feb 2009 13:51:16 GMT (envelope-from bz@svn.freebsd.org) Received: (from bz@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id n17DpGV1093596; Sat, 7 Feb 2009 13:51:16 GMT (envelope-from bz@svn.freebsd.org) Message-Id: <200902071351.n17DpGV1093596@svn.freebsd.org> From: "Bjoern A. Zeeb" Date: Sat, 7 Feb 2009 13:51:16 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-7@freebsd.org X-SVN-Group: stable-7 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r188285 - in stable/7/sys: . contrib/pf dev/ath/ath_hal dev/cxgb netinet netinet6 X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 07 Feb 2009 13:51:17 -0000 Author: bz Date: Sat Feb 7 13:51:15 2009 New Revision: 188285 URL: http://svn.freebsd.org/changeset/base/188285 Log: MFC: r186948 Make SIOCGIFADDR and related, as well as SIOCGIFADDR_IN6 and related jail-aware. Up to now we returned the first address of the interface for SIOCGIFADDR w/o an ifr_addr in the query. This caused problems for programs querying for an address but running inside a jail, as the address returned usually did not belong to the jail. Like for v6, if there was an ifr_addr given on v4, you could probe for more addresses on the interfaces that you were not allowed to see from inside a jail. Return an error (EADDRNOTAVAIL) in that case now unless the address is on the given interface and valid for the jail. PR: kern/114325 Modified: stable/7/sys/ (props changed) stable/7/sys/contrib/pf/ (props changed) stable/7/sys/dev/ath/ath_hal/ (props changed) stable/7/sys/dev/cxgb/ (props changed) stable/7/sys/netinet/in.c stable/7/sys/netinet6/in6.c Modified: stable/7/sys/netinet/in.c ============================================================================== --- stable/7/sys/netinet/in.c Sat Feb 7 13:46:51 2009 (r188284) +++ stable/7/sys/netinet/in.c Sat Feb 7 13:51:15 2009 (r188285) @@ -41,7 +41,9 @@ __FBSDID("$FreeBSD$"); #include #include #include +#include #include +#include #include #include @@ -252,13 +254,19 @@ in_control(struct socket *so, u_long cmd LIST_FOREACH(iap, INADDR_HASH(dst.s_addr), ia_hash) if (iap->ia_ifp == ifp && iap->ia_addr.sin_addr.s_addr == dst.s_addr) { - ia = iap; + if (td == NULL || prison_check_ip4( + td->td_ucred, &dst)) + ia = iap; break; } if (ia == NULL) TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) { iap = ifatoia(ifa); if (iap->ia_addr.sin_family == AF_INET) { + if (td != NULL && + !prison_check_ip4(td->td_ucred, + &iap->ia_addr.sin_addr)) + continue; ia = iap; break; } Modified: stable/7/sys/netinet6/in6.c ============================================================================== --- stable/7/sys/netinet6/in6.c Sat Feb 7 13:46:51 2009 (r188284) +++ stable/7/sys/netinet6/in6.c Sat Feb 7 13:51:15 2009 (r188285) @@ -68,6 +68,7 @@ __FBSDID("$FreeBSD$"); #include #include +#include #include #include #include @@ -468,6 +469,9 @@ in6_control(struct socket *so, u_long cm error = in6_setscope(&sa6->sin6_addr, ifp, NULL); if (error != 0) return (error); + if (td != NULL && !prison_check_ip6(td->td_ucred, + &sa6->sin6_addr)) + return (EADDRNOTAVAIL); ia = in6ifa_ifpwithaddr(ifp, &sa6->sin6_addr); } else ia = NULL;