From owner-svn-src-all@FreeBSD.ORG Tue Sep 10 10:13:16 2013 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id 92B8033E; Tue, 10 Sep 2013 10:13:16 +0000 (UTC) (envelope-from des@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 7E6642ABA; Tue, 10 Sep 2013 10:13:16 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r8AADGpM001832; Tue, 10 Sep 2013 10:13:16 GMT (envelope-from des@svn.freebsd.org) Received: (from des@localhost) by svn.freebsd.org (8.14.7/8.14.5/Submit) id r8AADFwF001822; Tue, 10 Sep 2013 10:13:15 GMT (envelope-from des@svn.freebsd.org) Message-Id: <201309101013.r8AADFwF001822@svn.freebsd.org> From: Dag-Erling Smørgrav Date: Tue, 10 Sep 2013 10:13:15 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org Subject: svn commit: r255446 - in releng/8.3: . sys/conf sys/fs/nullfs sys/net sys/netinet6 sys/netnatm X-SVN-Group: releng MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Sep 2013 10:13:16 -0000 Author: des Date: Tue Sep 10 10:13:14 2013 New Revision: 255446 URL: http://svnweb.freebsd.org/changeset/base/255446 Log: In IPv6 and NetATM, stop SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR and SIOCSIFNETMASK at the socket layer rather than pass them on to the link layer without validation or credential checks. [SA-13:12] Prevent cross-mount hardlinks between different nullfs mounts of the same underlying filesystem. [SA-13:13] Security: CVE-2013-5691 Security: FreeBSD-SA-13:12.ifioctl Security: CVE-2013-5710 Security: FreeBSD-SA-13:13.nullfs Approved by: so Modified: releng/8.3/UPDATING releng/8.3/sys/conf/newvers.sh releng/8.3/sys/fs/nullfs/null_vnops.c releng/8.3/sys/net/if.c releng/8.3/sys/netinet6/in6.c releng/8.3/sys/netnatm/natm.c Modified: releng/8.3/UPDATING ============================================================================== --- releng/8.3/UPDATING Tue Sep 10 10:12:09 2013 (r255445) +++ releng/8.3/UPDATING Tue Sep 10 10:13:14 2013 (r255446) @@ -15,6 +15,17 @@ NOTE TO PEOPLE WHO THINK THAT FreeBSD 8. debugging tools present in HEAD were left in place because sun4v support still needs work to become production ready. +20130910: p11 FreeBSD-SA-13:12.ifioctl + FreeBSD-SA-13:13.nullfs + + In IPv6 and NetATM, stop SIOCSIFADDR, SIOCSIFBRDADDR, + SIOCSIFDSTADDR and SIOCSIFNETMASK at the socket layer rather + than pass them on to the link layer without validation or + credential checks. [SA-13:12] + + Prevent cross-mount hardlinks between different nullfs mounts + of the same underlying filesystem. [SA-13:13] + 20130822: p10 FreeBSD-SA-13:09.ip_multicast FreeBSD-SA-13:10.sctp Fix an integer overflow in computing the size of a temporary buffer Modified: releng/8.3/sys/conf/newvers.sh ============================================================================== --- releng/8.3/sys/conf/newvers.sh Tue Sep 10 10:12:09 2013 (r255445) +++ releng/8.3/sys/conf/newvers.sh Tue Sep 10 10:13:14 2013 (r255446) @@ -32,7 +32,7 @@ TYPE="FreeBSD" REVISION="8.3" -BRANCH="RELEASE-p10" +BRANCH="RELEASE-p11" if [ "X${BRANCH_OVERRIDE}" != "X" ]; then BRANCH=${BRANCH_OVERRIDE} fi Modified: releng/8.3/sys/fs/nullfs/null_vnops.c ============================================================================== --- releng/8.3/sys/fs/nullfs/null_vnops.c Tue Sep 10 10:12:09 2013 (r255445) +++ releng/8.3/sys/fs/nullfs/null_vnops.c Tue Sep 10 10:13:14 2013 (r255446) @@ -817,6 +817,15 @@ null_vptocnp(struct vop_vptocnp_args *ap return (error); } +static int +null_link(struct vop_link_args *ap) +{ + + if (ap->a_tdvp->v_mount != ap->a_vp->v_mount) + return (EXDEV); + return (null_bypass((struct vop_generic_args *)ap)); +} + /* * Global vfs data structures */ @@ -829,6 +838,7 @@ struct vop_vector null_vnodeops = { .vop_getwritemount = null_getwritemount, .vop_inactive = null_inactive, .vop_islocked = vop_stdislocked, + .vop_link = null_link, .vop_lock1 = null_lock, .vop_lookup = null_lookup, .vop_open = null_open, Modified: releng/8.3/sys/net/if.c ============================================================================== --- releng/8.3/sys/net/if.c Tue Sep 10 10:12:09 2013 (r255445) +++ releng/8.3/sys/net/if.c Tue Sep 10 10:13:14 2013 (r255446) @@ -2606,11 +2606,23 @@ ifioctl(struct socket *so, u_long cmd, c CURVNET_RESTORE(); return (EOPNOTSUPP); } + + /* + * Pass the request on to the socket control method, and if the + * latter returns EOPNOTSUPP, directly to the interface. + * + * Make an exception for the legacy SIOCSIF* requests. Drivers + * trust SIOCSIFADDR et al to come from an already privileged + * layer, and do not perform any credentials checks or input + * validation. + */ #ifndef COMPAT_43 error = ((*so->so_proto->pr_usrreqs->pru_control)(so, cmd, data, ifp, td)); - if (error == EOPNOTSUPP && ifp != NULL && ifp->if_ioctl != NULL) + if (error == EOPNOTSUPP && ifp != NULL && ifp->if_ioctl != NULL && + cmd != SIOCSIFADDR && cmd != SIOCSIFBRDADDR && + cmd != SIOCSIFDSTADDR && cmd != SIOCSIFNETMASK) error = (*ifp->if_ioctl)(ifp, cmd, data); #else { @@ -2654,7 +2666,9 @@ ifioctl(struct socket *so, u_long cmd, c data, ifp, td)); if (error == EOPNOTSUPP && ifp != NULL && - ifp->if_ioctl != NULL) + ifp->if_ioctl != NULL && + cmd != SIOCSIFADDR && cmd != SIOCSIFBRDADDR && + cmd != SIOCSIFDSTADDR && cmd != SIOCSIFNETMASK) error = (*ifp->if_ioctl)(ifp, cmd, data); switch (ocmd) { Modified: releng/8.3/sys/netinet6/in6.c ============================================================================== --- releng/8.3/sys/netinet6/in6.c Tue Sep 10 10:12:09 2013 (r255445) +++ releng/8.3/sys/netinet6/in6.c Tue Sep 10 10:13:14 2013 (r255446) @@ -339,6 +339,18 @@ in6_control(struct socket *so, u_long cm case SIOCGIFSTAT_ICMP6: sa6 = &ifr->ifr_addr; break; + case SIOCSIFADDR: + case SIOCSIFBRDADDR: + case SIOCSIFDSTADDR: + case SIOCSIFNETMASK: + /* + * Although we should pass any non-INET6 ioctl requests + * down to driver, we filter some legacy INET requests. + * Drivers trust SIOCSIFADDR et al to come from an already + * privileged layer, and do not perform any credentials + * checks or input validation. + */ + return (EINVAL); default: sa6 = NULL; break; Modified: releng/8.3/sys/netnatm/natm.c ============================================================================== --- releng/8.3/sys/netnatm/natm.c Tue Sep 10 10:12:09 2013 (r255445) +++ releng/8.3/sys/netnatm/natm.c Tue Sep 10 10:13:14 2013 (r255446) @@ -339,6 +339,21 @@ natm_usr_control(struct socket *so, u_lo npcb = (struct natmpcb *)so->so_pcb; KASSERT(npcb != NULL, ("natm_usr_control: npcb == NULL")); + switch (cmd) { + case SIOCSIFADDR: + case SIOCSIFBRDADDR: + case SIOCSIFDSTADDR: + case SIOCSIFNETMASK: + /* + * Although we should pass any non-ATM ioctl requests + * down to driver, we filter some legacy INET requests. + * Drivers trust SIOCSIFADDR et al to come from an already + * privileged layer, and do not perform any credentials + * checks or input validation. + */ + return (EINVAL); + } + if (ifp == NULL || ifp->if_ioctl == NULL) return (EOPNOTSUPP); return ((*ifp->if_ioctl)(ifp, cmd, arg));