From nobody Sun Apr 9 13:53:14 2023 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4PvYTl1PvKz44VJY; Sun, 9 Apr 2023 13:53:15 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4PvYTl0YZbz42Dh; Sun, 9 Apr 2023 13:53:15 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1681048395; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=sjUG3uBGYet/AS+3xv7Y0Rw3nAax7UwgMJO7QuQlpXc=; b=XFSZFrhvjhrlLY5RbNFx69JkonfPTEZRBsxogZDBNn0qKMtr0NNw7QHmxkabDk1K7JcyBN T4ZSA6206R8LUDojkR7hZUEVXh7qPQmKfHsHrV4au6gepPFF8w4dxfOUgh6pe3DbTkBLgD BnvnveqKoOWUmfTu10UBCA3CcI7lprTGQqFvfa3JNZKRk82JJKYrnNKIxV7iu2iBh+t3QF 53XkSxTQ8/mn6Qme4tnJaBZEC7mUeBGBtdDGtSNcNaZstNDvaz9mNf82FXAD2dMVtNWegC nKBdTu9kqNhAvWUYkrkQUXfoS5n5vqzJ7Sv7oamK1rkAFZB9Y0h1iVtqqkx1pQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1681048395; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=sjUG3uBGYet/AS+3xv7Y0Rw3nAax7UwgMJO7QuQlpXc=; b=RwIxjBKW1sn0JWWlNHr0JhDvnNPoZCTR9JP80egVtp+mymo2cusRWOBT4F5gCVS2U9wnPi 28YQjzMXAeIb8f8m+HZma59tGA3jjwx2E5vkRKbu0fDXx27gxMxoL0/ymAku2wUxrnpHR7 KbjKqTCX8qKWbwIWCqFRvgAT1gnRCFh6dxhuskcjXhkiGZnHY655IgvJCzHub0qgC4sbUG ZPq/cTKatEU4gUCielvhVxkyXjtTYrOQazVDkdHmFWtzdYYTpJ97VDCyADoBkuv7L2EIgJ Q/uyJWkfKGdcIZiYB7llObIF736G9F1HQs0A3zqWx2JHSTdILo+LmZJhCqZDCA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1681048395; a=rsa-sha256; cv=none; b=Q5twO0FQXbNOaExLDPNd+jmceOx5UEiGS11fu4eqjIDXBbjqZpRfx5aDVu1lopXIPmRZHD 6HqsIdNxLHm4M7Voxin4j3x5TFjAdSlsVQJYJkwhYFpiknHtLR9osZc8WeUTMFsR43mbMD 20t5rVgLqky1mrXuOJmO8ZCVra0sB4AjUQSCcgp5y+J5cVnR/ChcmatN1tdQvlMwMUYAJh 7zRgk97Nkx39p/4I1JowxmH++UmwruBjRnKWkwNW82ookdE0gx6qpj4FIlWsIFekrige2a WX9VusSEZoIngaXula/3DnNCbrP2OgNU7uXGoOANB2cw6I5pC6bEJMR0O6hNJw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4PvYTk6N3bz19rw; Sun, 9 Apr 2023 13:53:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 339DrEQt019409; Sun, 9 Apr 2023 13:53:14 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 339DrEgO019408; Sun, 9 Apr 2023 13:53:14 GMT (envelope-from git) Date: Sun, 9 Apr 2023 13:53:14 GMT Message-Id: <202304091353.339DrEgO019408@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: "Alexander V. Chernikov" Subject: git: 2ccf6388ba60 - stable/13 - routing: add public rt_is_exportable() version to check if the route can be exported to userland when jailed. List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: melifaro X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 2ccf6388ba60ab8f1acc697a1112d8891102f36f Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch stable/13 has been updated by melifaro: URL: https://cgit.FreeBSD.org/src/commit/?id=2ccf6388ba60ab8f1acc697a1112d8891102f36f commit 2ccf6388ba60ab8f1acc697a1112d8891102f36f Author: Alexander V. Chernikov AuthorDate: 2023-03-26 08:19:56 +0000 Commit: Alexander V. Chernikov CommitDate: 2023-04-09 13:52:55 +0000 routing: add public rt_is_exportable() version to check if the route can be exported to userland when jailed. Differential Revision: https://reviews.freebsd.org/D39204 MFC after: 2 weeks (cherry picked from commit 2cda6a2fb0d9473a53931dc2b0171af54dd79b04) --- sys/net/route/route_ctl.h | 2 ++ sys/net/route/route_rtentry.c | 24 ++++++++++++++++++++++++ sys/net/rtsock.c | 29 ++++------------------------- 3 files changed, 30 insertions(+), 25 deletions(-) diff --git a/sys/net/route/route_ctl.h b/sys/net/route/route_ctl.h index e8560e681ddb..b65b64fcdaa0 100644 --- a/sys/net/route/route_ctl.h +++ b/sys/net/route/route_ctl.h @@ -121,6 +121,7 @@ void rib_foreach_table_walk_del(int family, rib_filter_f_t *filter_f, void *arg) struct nhop_object; struct nhgrp_object; +struct ucred; const struct rtentry *rib_lookup_prefix(uint32_t fibnum, int family, const struct sockaddr *dst, const struct sockaddr *netmask, @@ -133,6 +134,7 @@ bool rt_is_host(const struct rtentry *rt); sa_family_t rt_get_family(const struct rtentry *); struct nhop_object *rt_get_raw_nhop(const struct rtentry *rt); void rt_get_rnd(const struct rtentry *rt, struct route_nhop_data *rnd); +bool rt_is_exportable(const struct rtentry *rt, struct ucred *cred); #ifdef INET struct in_addr; void rt_get_inet_prefix_plen(const struct rtentry *rt, struct in_addr *paddr, diff --git a/sys/net/route/route_rtentry.c b/sys/net/route/route_rtentry.c index 64900ae3ae39..7bf624f01540 100644 --- a/sys/net/route/route_rtentry.c +++ b/sys/net/route/route_rtentry.c @@ -35,6 +35,7 @@ __FBSDID("$FreeBSD$"); #include #include #include +#include #include #include #include @@ -198,6 +199,29 @@ rt_get_rnd(const struct rtentry *rt, struct route_nhop_data *rnd) rnd->rnd_weight = rt->rt_weight; } +/* + * If the process in in jail w/o VNET, export only host routes for the + * addresses assigned to the jail. + * Otherwise, allow exporting the entire table. + */ +bool +rt_is_exportable(const struct rtentry *rt, struct ucred *cred) +{ + if (!rt_is_host(rt)) { + /* + * Performance optimisation: only host routes are allowed + * in the jail w/o vnet. + */ + if (jailed_without_vnet(cred)) + return (false); + } else { + if (prison_if(cred, rt_key_const(rt)) != 0) + return (false); + } + + return (true); +} + #ifdef INET /* * Stores IPv4 address and prefix length of @rt inside diff --git a/sys/net/rtsock.c b/sys/net/rtsock.c index fc9439602c13..0c6d856ed7ad 100644 --- a/sys/net/rtsock.c +++ b/sys/net/rtsock.c @@ -208,8 +208,6 @@ static int update_rtm_from_rc(struct rt_addrinfo *info, static void send_rtm_reply(struct socket *so, struct rt_msghdr *rtm, struct mbuf *m, sa_family_t saf, u_int fibnum, int rtm_errno); -static bool can_export_rte(struct ucred *td_ucred, bool rt_is_host, - const struct sockaddr *rt_dst); static void rtsock_notify_event(uint32_t fibnum, const struct rib_cmd_info *rc); static void rtsock_ifmsg(struct ifnet *ifp, int if_flags_mask); @@ -1229,11 +1227,8 @@ route_output(struct mbuf *m, struct socket *so, ...) senderr(error); nh = rc.rc_nh_new; - if (!can_export_rte(curthread->td_ucred, - info.rti_info[RTAX_NETMASK] == NULL, - info.rti_info[RTAX_DST])) { + if (!rt_is_exportable(rc.rc_rt, curthread->td_ucred)) senderr(ESRCH); - } break; default: @@ -2273,23 +2268,6 @@ rt_dispatch(struct mbuf *m, sa_family_t saf) netisr_queue(NETISR_ROUTE, m); /* mbuf is free'd on failure. */ } -/* - * Checks if rte can be exported w.r.t jails/vnets. - * - * Returns true if it can, false otherwise. - */ -static bool -can_export_rte(struct ucred *td_ucred, bool rt_is_host, - const struct sockaddr *rt_dst) -{ - - if ((!rt_is_host) ? jailed_without_vnet(td_ucred) - : prison_if(td_ucred, rt_dst) != 0) - return (false); - return (true); -} - - /* * This is used in dumping the kernel table via sysctl(). */ @@ -2301,9 +2279,10 @@ sysctl_dumpentry(struct rtentry *rt, void *vw) NET_EPOCH_ASSERT(); - export_rtaddrs(rt, w->dst, w->mask); - if (!can_export_rte(w->w_req->td->td_ucred, rt_is_host(rt), w->dst)) + if (!rt_is_exportable(rt, w->w_req->td->td_ucred)) return (0); + + export_rtaddrs(rt, w->dst, w->mask); nh = rt_get_raw_nhop(rt); #ifdef ROUTE_MPATH if (NH_IS_NHGRP(nh)) {