libcasper: Fix typo (triple T)

Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/954

lib: Automated cleanup of cdefs and other formatting

Apply the following automated changes to try to eliminate
no-longer-needed sys/cdefs.h includes as well as now-empty
blank lines in a row.

Remov

lib: Automated cleanup of cdefs and other formatting

Apply the following automated changes to try to eliminate
no-longer-needed sys/cdefs.h includes as well as now-empty
blank lines in a row.

Remove /^#if.*\n#endif.*\n#include\s+<sys/cdefs.h>.*\n/
Remove /\n+#include\s+<sys/cdefs.h>.*\n+#if.*\n#endif.*\n+/
Remove /\n+#if.*\n#endif.*\n+/
Remove /^#if.*\n#endif.*\n/
Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/types.h>/
Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/param.h>/
Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/capsicum.h>/

Sponsored by: Netflix

show more ...

cap_net: correct capability name from addr2name to name2addr

Previously, while checking name2addr capabilities, we mistakenly used
the addr2name set. This error could cause a process to inadvertentl

cap_net: correct capability name from addr2name to name2addr

Previously, while checking name2addr capabilities, we mistakenly used
the addr2name set. This error could cause a process to inadvertently
reset its limitations.

Reported by: Shawn Webb <shawn.webb@hardenedbsd.org>

show more ...

Remove $FreeBSD$: one-line .c pattern

Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/

cap_net tests: Skip tests if there is no connectivity

When testing cap_connect() and name/addr lookup functions, skip tests if
we fail and the error is not ENOTCAPABLE. This makes the tests amenabl

cap_net tests: Skip tests if there is no connectivity

When testing cap_connect() and name/addr lookup functions, skip tests if
we fail and the error is not ENOTCAPABLE. This makes the tests amenable
to running in CI without Internet connectivity.

Reviewed by: oshogbo
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D39242

show more ...

cap_dns, cap_net: fix host and service buffer handling

If a malicious casper process sent a host or service string that was
too long, cap_getnameinfo would overrun the caller's buffer by one byte.

cap_dns, cap_net: fix host and service buffer handling

If a malicious casper process sent a host or service string that was
too long, cap_getnameinfo would overrun the caller's buffer by one byte.

The backends for this function needlessly allocated one extra byte
for these buffers. This was harmless, but could be confusing to readers.

Reported by: Coverity (an internal run at Dell)
Reviewed by: oshogbo, emaste
MFC after: 1 week
Sponsored by: Dell EMC Isilon
Differential Revision: https://reviews.freebsd.org/D39347

show more ...

cap_net: CAPNET_CONNECT and CAPNET_CONNECTDNS are not mutually exclusive

Fix the for the CAPNET_CONNECT and CAPNET_CONNECTDNS.
Add test to ensure that this is possible.

cap_net: allow to use the service without setting the limits

Add test to ensure that this is possible.

MFH

Sponsored by: Rubicon Communications, LLC (netgate.com)

Merge ^/head r364264 through r364278.

libcasper: Introduce cap_net a network service for Casper.

Reviewed by: emaste, markj (previous version), bcr (man page)
Differential Revision: https://reviews.freebsd.org/D24688