From owner-svn-src-stable-7@FreeBSD.ORG Sat Feb 7 13:46:54 2009 Return-Path: Delivered-To: svn-src-stable-7@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 1C7EC106567E; Sat, 7 Feb 2009 13:46:54 +0000 (UTC) (envelope-from bz@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 4D4148FC23; Sat, 7 Feb 2009 13:46:52 +0000 (UTC) (envelope-from bz@FreeBSD.org) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id n17DkpsN093464; Sat, 7 Feb 2009 13:46:51 GMT (envelope-from bz@svn.freebsd.org) Received: (from bz@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id n17DkpI6093463; Sat, 7 Feb 2009 13:46:51 GMT (envelope-from bz@svn.freebsd.org) Message-Id: <200902071346.n17DkpI6093463@svn.freebsd.org> From: "Bjoern A. Zeeb" Date: Sat, 7 Feb 2009 13:46:51 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-7@freebsd.org X-SVN-Group: stable-7 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r188284 - in stable/7/sys: . contrib/pf dev/ath/ath_hal dev/cxgb net X-BeenThere: svn-src-stable-7@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: SVN commit messages for only the 7-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 07 Feb 2009 13:46:56 -0000 Author: bz Date: Sat Feb 7 13:46:51 2009 New Revision: 188284 URL: http://svn.freebsd.org/changeset/base/188284 Log: MFC: r186956 Take the cred from curthread rather than curproc as curproc would need locking but the credential from curthread (usually) never changes. r186980 Restrict arp, ndp and theoretically the FIB listing (if not read with libkvm) to the addresses of a prison, when inside a jail. While touching RTM_GET in route_output(), consistently use curthread credentials rather than the creds from the socket there. r186986 Rather than using the cred from curthread, take it from the thread referenced in the sysctl req argument. Modified: stable/7/sys/ (props changed) stable/7/sys/contrib/pf/ (props changed) stable/7/sys/dev/ath/ath_hal/ (props changed) stable/7/sys/dev/cxgb/ (props changed) stable/7/sys/net/rtsock.c Modified: stable/7/sys/net/rtsock.c ============================================================================== --- stable/7/sys/net/rtsock.c Sat Feb 7 13:32:49 2009 (r188283) +++ stable/7/sys/net/rtsock.c Sat Feb 7 13:46:51 2009 (r188284) @@ -585,6 +585,12 @@ route_output(struct mbuf *m, struct sock case RTM_GET: report: RT_LOCK_ASSERT(rt); + if (jailed(curthread->td_ucred) && + ((rt->rt_flags & RTF_HOST) == 0 || + !prison_if(curthread->td_ucred, rt_key(rt)))) { + RT_UNLOCK(rt); + senderr(ESRCH); + } info.rti_info[RTAX_DST] = rt_key(rt); info.rti_info[RTAX_GATEWAY] = rt->rt_gateway; info.rti_info[RTAX_NETMASK] = rt_mask(rt); @@ -594,10 +600,10 @@ route_output(struct mbuf *m, struct sock if (ifp) { info.rti_info[RTAX_IFP] = ifp->if_addr->ifa_addr; - if (jailed(so->so_cred)) { + if (jailed(curthread->td_ucred)) { error = rtm_get_jailed( &info, ifp, rt, &saun, - so->so_cred); + curthread->td_ucred); if (error != 0) { RT_UNLOCK(rt); senderr(ESRCH); @@ -1224,6 +1230,10 @@ sysctl_dumpentry(struct radix_node *rn, if (w->w_op == NET_RT_FLAGS && !(rt->rt_flags & w->w_arg)) return 0; + if (jailed(w->w_req->td->td_ucred) && + ((rt->rt_flags & RTF_HOST) == 0 || + !prison_if(w->w_req->td->td_ucred, rt_key(rt)))) + return (0); bzero((caddr_t)&info, sizeof(info)); info.rti_info[RTAX_DST] = rt_key(rt); info.rti_info[RTAX_GATEWAY] = rt->rt_gateway; @@ -1283,8 +1293,8 @@ sysctl_iflist(int af, struct walkarg *w) while ((ifa = TAILQ_NEXT(ifa, ifa_link)) != NULL) { if (af && af != ifa->ifa_addr->sa_family) continue; - if (jailed(curthread->td_ucred) && - !prison_if(curthread->td_ucred, ifa->ifa_addr)) + if (jailed(w->w_req->td->td_ucred) && + !prison_if(w->w_req->td->td_ucred, ifa->ifa_addr)) continue; info.rti_info[RTAX_IFA] = ifa->ifa_addr; info.rti_info[RTAX_NETMASK] = ifa->ifa_netmask; @@ -1311,7 +1321,7 @@ done: return (error); } -int +static int sysctl_ifmalist(int af, struct walkarg *w) { struct ifnet *ifp; @@ -1331,8 +1341,8 @@ sysctl_ifmalist(int af, struct walkarg * TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) { if (af && af != ifma->ifma_addr->sa_family) continue; - if (jailed(curproc->p_ucred) && - !prison_if(curproc->p_ucred, ifma->ifma_addr)) + if (jailed(w->w_req->td->td_ucred) && + !prison_if(w->w_req->td->td_ucred, ifma->ifma_addr)) continue; info.rti_info[RTAX_IFA] = ifma->ifma_addr; info.rti_info[RTAX_GATEWAY] = @@ -1397,7 +1407,7 @@ sysctl_rtsock(SYSCTL_HANDLER_ARGS) } else /* dump only one table */ i = lim = af; for (error = 0; error == 0 && i <= lim; i++) - if ((rnh = rt_tables[curthread->td_proc->p_fibnum][i]) != NULL) { + if ((rnh = rt_tables[req->td->td_proc->p_fibnum][i]) != NULL) { RADIX_NODE_HEAD_LOCK(rnh); error = rnh->rnh_walktree(rnh, sysctl_dumpentry, &w);