04f75b9802
This change allow to open Netlink sockets in the non-vnet jails, even for unpriviledged processes. The security model largely follows the existing one. To be more specific: * by default, every `NETLINK_ROUTE` command is **NOT** allowed in non-VNET jail UNLESS `RTNL_F_ALLOW_NONVNET_JAIL` flag is specified in the command handler. * All notifications are **disabled** for non-vnet jails (requests to subscribe for the notifications are ignored). This will change to be more fine-grained model once the first netlink provider requiring this gets committed. * Listing interfaces (RTM_GETLINK) is **allowed** w/o limits (**including** interfaces w/o any addresses attached to the jail). The value of this is questionable, but it follows the existing approach. * Listing ARP/NDP neighbours is **forbidden**. This is a **change** from the current approach - currently we list static ARP/ND entries belonging to the addresses attached to the jail. * Listing interface addresses is **allowed**, but the addresses are filtered to match only ones attached to the jail. * Listing routes is **allowed**, but the routes are filtered to provide only host routes matching the addresses attached to the jail. * By default, every `NETLINK_GENERIC` command is **allowed** in non-VNET jail (as sub-families may be unrelated to network at all). It is the goal of the family author to implement the restriction if necessary. Differential Revision: https://reviews.freebsd.org/D39206 MFC after: 1 month
113 lines
3.7 KiB
C
113 lines
3.7 KiB
C
/*-
|
|
* SPDX-License-Identifier: BSD-2-Clause-FreeBSD
|
|
*
|
|
* Copyright (c) 2022 Alexander V. Chernikov <melifaro@FreeBSD.org>
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
* SUCH DAMAGE.
|
|
*/
|
|
|
|
/*
|
|
* This file contains definitions shared among NETLINK_ROUTE family
|
|
*/
|
|
#ifndef _NETLINK_ROUTE_ROUTE_VAR_H_
|
|
#define _NETLINK_ROUTE_ROUTE_VAR_H_
|
|
|
|
#include <sys/priv.h> /* values for priv_check */
|
|
|
|
struct nlmsghdr;
|
|
struct nlpcb;
|
|
struct nl_pstate;
|
|
|
|
typedef int rtnl_msg_cb_f(struct nlmsghdr *hdr, struct nlpcb *nlp,
|
|
struct nl_pstate *npt);
|
|
|
|
struct rtnl_cmd_handler {
|
|
int cmd;
|
|
const char *name;
|
|
rtnl_msg_cb_f *cb;
|
|
int priv;
|
|
int flags;
|
|
};
|
|
|
|
#define RTNL_F_NOEPOCH 0x01 /* Do not enter epoch when handling command */
|
|
#define RTNL_F_ALLOW_NONVNET_JAIL 0x02 /* Allow command execution inside non-VNET jail */
|
|
|
|
bool rtnl_register_messages(const struct rtnl_cmd_handler *handlers, int count);
|
|
|
|
/* route.c */
|
|
struct rib_cmd_info;
|
|
void rtnl_handle_route_event(uint32_t fibnum, const struct rib_cmd_info *rc);
|
|
void rtnl_routes_init(void);
|
|
|
|
/* neigh.c */
|
|
void rtnl_neighs_init(void);
|
|
void rtnl_neighs_destroy(void);
|
|
|
|
/* iface.c */
|
|
struct nl_parsed_link {
|
|
char *ifla_group;
|
|
char *ifla_ifname;
|
|
char *ifla_cloner;
|
|
char *ifla_ifalias;
|
|
struct nlattr *ifla_idata;
|
|
unsigned short ifi_type;
|
|
int ifi_index;
|
|
uint32_t ifla_mtu;
|
|
uint32_t ifi_flags;
|
|
uint32_t ifi_change;
|
|
};
|
|
|
|
typedef int rtnl_iface_create_f(struct nl_parsed_link *lattrs,
|
|
const struct nlattr_bmask *bm, struct nlpcb *nlp, struct nl_pstate *npt);
|
|
typedef int rtnl_iface_modify_f(struct ifnet *ifp, struct nl_parsed_link *lattrs,
|
|
const struct nlattr_bmask *bm, struct nlpcb *nlp, struct nl_pstate *npt);
|
|
typedef int rtnl_iface_dump_f(struct ifnet *ifp, struct nl_writer *nw);
|
|
|
|
struct nl_cloner {
|
|
const char *name;
|
|
rtnl_iface_create_f *create_f;
|
|
rtnl_iface_modify_f *modify_f;
|
|
rtnl_iface_dump_f *dump_f;
|
|
SLIST_ENTRY(nl_cloner) next;
|
|
};
|
|
|
|
extern struct nl_cloner generic_cloner;
|
|
|
|
void rtnl_ifaces_init(void);
|
|
void rtnl_ifaces_destroy(void);
|
|
void rtnl_iface_add_cloner(struct nl_cloner *cloner);
|
|
void rtnl_iface_del_cloner(struct nl_cloner *cloner);
|
|
void rtnl_handle_ifnet_event(struct ifnet *ifp, int if_change_mask);
|
|
|
|
/* iface_drivers.c */
|
|
void rtnl_iface_drivers_register(void);
|
|
|
|
/* nexthop.c */
|
|
void rtnl_nexthops_init(void);
|
|
struct nhop_object *nl_find_nhop(uint32_t fibnum, int family,
|
|
uint32_t uidx, int nh_flags, int *perror);
|
|
int nl_set_nexthop_gw(struct nhop_object *nh, struct sockaddr *gw,
|
|
struct ifnet *ifp, struct nl_pstate *npt);
|
|
|
|
|
|
#endif
|