From owner-cvs-src-old@FreeBSD.ORG Sun Dec 13 13:58:27 2009 Return-Path: Delivered-To: cvs-src-old@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 23C74106568B for ; Sun, 13 Dec 2009 13:58:27 +0000 (UTC) (envelope-from bz@FreeBSD.org) Received: from repoman.freebsd.org (repoman.freebsd.org [IPv6:2001:4f8:fff6::29]) by mx1.freebsd.org (Postfix) with ESMTP id 102FA8FC1C for ; Sun, 13 Dec 2009 13:58:27 +0000 (UTC) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.14.3/8.14.3) with ESMTP id nBDDwQg2093200 for ; Sun, 13 Dec 2009 13:58:26 GMT (envelope-from bz@repoman.freebsd.org) Received: (from svn2cvs@localhost) by repoman.freebsd.org (8.14.3/8.14.3/Submit) id nBDDwQOM093199 for cvs-src-old@freebsd.org; Sun, 13 Dec 2009 13:58:26 GMT (envelope-from bz@repoman.freebsd.org) Message-Id: <200912131358.nBDDwQOM093199@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: svn2cvs set sender to bz@repoman.freebsd.org using -f From: "Bjoern A. Zeeb" Date: Sun, 13 Dec 2009 13:57:32 +0000 (UTC) To: cvs-src-old@freebsd.org X-FreeBSD-CVS-Branch: HEAD Subject: cvs commit: src/sys/kern kern_jail.c src/sys/net rtsock.c src/sys/netinet raw_ip.c src/sys/netinet6 raw_ip6.c src/sys/sys jail.h X-BeenThere: cvs-src-old@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: **OBSOLETE** CVS commit messages for the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 Dec 2009 13:58:27 -0000 bz 2009-12-13 13:57:32 UTC FreeBSD src repository Modified files: sys/kern kern_jail.c sys/net rtsock.c sys/netinet raw_ip.c sys/netinet6 raw_ip6.c sys/sys jail.h Log: SVN rev 200473 on 2009-12-13 13:57:32Z by bz Throughout the network stack we have a few places of if (jailed(cred)) left. If you are running with a vnet (virtual network stack) those will return true and defer you to classic IP-jails handling and thus things will be "denied" or returned with an error. Work around this problem by introducing another "jailed()" function, jailed_without_vnet(), that also takes vnets into account, and permits the calls, should the jail from the given cred have its own virtual network stack. We cannot change the classic jailed() call to do that, as it is used outside the network stack as well. Discussed with: julian, zec, jamie, rwatson (back in Sept) MFC after: 5 days Revision Changes Path 1.128 +24 -1 src/sys/kern/kern_jail.c 1.185 +2 -2 src/sys/net/rtsock.c 1.225 +2 -2 src/sys/netinet/raw_ip.c 1.113 +1 -1 src/sys/netinet6/raw_ip6.c 1.52 +1 -0 src/sys/sys/jail.h