1 /*-
2 * Copyright (c) 1999 Poul-Henning Kamp.
3 * Copyright (c) 2008 Bjoern A. Zeeb.
4 * Copyright (c) 2009 James Gritton.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 #include "opt_ddb.h"
30 #include "opt_inet.h"
31 #include "opt_inet6.h"
32
33 #include <sys/param.h>
34 #include <sys/types.h>
35 #include <sys/kernel.h>
36 #include <sys/systm.h>
37 #include <sys/errno.h>
38 #include <sys/sysproto.h>
39 #include <sys/malloc.h>
40 #include <sys/osd.h>
41 #include <sys/priv.h>
42 #include <sys/proc.h>
43 #include <sys/taskqueue.h>
44 #include <sys/fcntl.h>
45 #include <sys/jail.h>
46 #include <sys/lock.h>
47 #include <sys/mutex.h>
48 #include <sys/racct.h>
49 #include <sys/refcount.h>
50 #include <sys/sx.h>
51 #include <sys/namei.h>
52 #include <sys/mount.h>
53 #include <sys/queue.h>
54 #include <sys/socket.h>
55 #include <sys/syscallsubr.h>
56 #include <sys/sysctl.h>
57 #include <sys/vnode.h>
58
59 #include <net/if.h>
60 #include <net/vnet.h>
61
62 #include <netinet/in.h>
63
64 static in_addr_t
prison_primary_ip4(const struct prison * pr)65 prison_primary_ip4(const struct prison *pr)
66 {
67
68 return (((const struct in_addr *)prison_ip_get0(pr, PR_INET))->s_addr);
69 }
70
71 int
prison_qcmp_v4(const void * ip1,const void * ip2)72 prison_qcmp_v4(const void *ip1, const void *ip2)
73 {
74 in_addr_t iaa, iab;
75
76 /*
77 * We need to compare in HBO here to get the list sorted as expected
78 * by the result of the code. Sorting NBO addresses gives you
79 * interesting results. If you do not understand, do not try.
80 */
81 iaa = ntohl(((const struct in_addr *)ip1)->s_addr);
82 iab = ntohl(((const struct in_addr *)ip2)->s_addr);
83
84 /*
85 * Do not simply return the difference of the two numbers, the int is
86 * not wide enough.
87 */
88 if (iaa > iab)
89 return (1);
90 else if (iaa < iab)
91 return (-1);
92 else
93 return (0);
94 }
95
96 bool
prison_valid_v4(const void * ip)97 prison_valid_v4(const void *ip)
98 {
99 return (!in_broadcast(*(const struct in_addr *)ip));
100 }
101
102 /*
103 * Pass back primary IPv4 address of this jail.
104 *
105 * If not restricted return success but do not alter the address. Caller has
106 * to make sure to initialize it correctly (e.g. INADDR_ANY).
107 *
108 * Returns 0 on success, EAFNOSUPPORT if the jail doesn't allow IPv4.
109 * Address returned in NBO.
110 */
111 int
prison_get_ip4(struct ucred * cred,struct in_addr * ia)112 prison_get_ip4(struct ucred *cred, struct in_addr *ia)
113 {
114 struct prison *pr;
115
116 KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
117 KASSERT(ia != NULL, ("%s: ia is NULL", __func__));
118
119 pr = cred->cr_prison;
120 if (!(pr->pr_flags & PR_IP4))
121 return (0);
122 mtx_lock(&pr->pr_mtx);
123 if (!(pr->pr_flags & PR_IP4)) {
124 mtx_unlock(&pr->pr_mtx);
125 return (0);
126 }
127 if (pr->pr_addrs[PR_INET] == NULL) {
128 mtx_unlock(&pr->pr_mtx);
129 return (EAFNOSUPPORT);
130 }
131
132 ia->s_addr = prison_primary_ip4(pr);
133 mtx_unlock(&pr->pr_mtx);
134 return (0);
135 }
136
137 /*
138 * Return true if we should do proper source address selection or are not jailed.
139 * We will return false if we should bypass source address selection in favour
140 * of the primary jail IPv4 address. Only in this case *ia will be updated and
141 * returned in NBO.
142 * Return true, even in case this jail does not allow IPv4.
143 */
144 bool
prison_saddrsel_ip4(struct ucred * cred,struct in_addr * ia)145 prison_saddrsel_ip4(struct ucred *cred, struct in_addr *ia)
146 {
147 struct prison *pr;
148 struct in_addr lia;
149
150 KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
151 KASSERT(ia != NULL, ("%s: ia is NULL", __func__));
152
153 if (!jailed(cred))
154 return (true);
155
156 pr = cred->cr_prison;
157 if (pr->pr_flags & PR_IP4_SADDRSEL)
158 return (true);
159
160 lia.s_addr = INADDR_ANY;
161 if (prison_get_ip4(cred, &lia) != 0)
162 return (true);
163 if (lia.s_addr == INADDR_ANY)
164 return (true);
165
166 ia->s_addr = lia.s_addr;
167 return (false);
168 }
169
170 /*
171 * Return true if pr1 and pr2 have the same IPv4 address restrictions.
172 */
173 bool
prison_equal_ip4(struct prison * pr1,struct prison * pr2)174 prison_equal_ip4(struct prison *pr1, struct prison *pr2)
175 {
176
177 if (pr1 == pr2)
178 return (true);
179
180 /*
181 * No need to lock since the PR_IP4_USER flag can't be altered for
182 * existing prisons.
183 */
184 while (pr1 != &prison0 &&
185 #ifdef VIMAGE
186 !(pr1->pr_flags & PR_VNET) &&
187 #endif
188 !(pr1->pr_flags & PR_IP4_USER))
189 pr1 = pr1->pr_parent;
190 while (pr2 != &prison0 &&
191 #ifdef VIMAGE
192 !(pr2->pr_flags & PR_VNET) &&
193 #endif
194 !(pr2->pr_flags & PR_IP4_USER))
195 pr2 = pr2->pr_parent;
196 return (pr1 == pr2);
197 }
198
199 /*
200 * Make sure our (source) address is set to something meaningful to this
201 * jail.
202 *
203 * Returns 0 if jail doesn't restrict IPv4 or if address belongs to jail,
204 * EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if the jail
205 * doesn't allow IPv4. Address passed in in NBO and returned in NBO.
206 */
207 int
prison_local_ip4(struct ucred * cred,struct in_addr * ia)208 prison_local_ip4(struct ucred *cred, struct in_addr *ia)
209 {
210 struct prison *pr;
211 struct in_addr ia0;
212 int error;
213
214 KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
215 KASSERT(ia != NULL, ("%s: ia is NULL", __func__));
216
217 pr = cred->cr_prison;
218 if (!(pr->pr_flags & PR_IP4))
219 return (0);
220 mtx_lock(&pr->pr_mtx);
221 if (!(pr->pr_flags & PR_IP4)) {
222 mtx_unlock(&pr->pr_mtx);
223 return (0);
224 }
225 if (pr->pr_addrs[PR_INET] == NULL) {
226 mtx_unlock(&pr->pr_mtx);
227 return (EAFNOSUPPORT);
228 }
229
230 ia0.s_addr = ntohl(ia->s_addr);
231
232 if (ia0.s_addr == INADDR_ANY) {
233 /*
234 * In case there is only 1 IPv4 address, bind directly.
235 */
236 if (prison_ip_cnt(pr, PR_INET) == 1)
237 ia->s_addr = prison_primary_ip4(pr);
238 mtx_unlock(&pr->pr_mtx);
239 return (0);
240 }
241
242 error = prison_check_ip4_locked(pr, ia);
243 if (error == EADDRNOTAVAIL && ia0.s_addr == INADDR_LOOPBACK) {
244 ia->s_addr = prison_primary_ip4(pr);
245 error = 0;
246 }
247
248 mtx_unlock(&pr->pr_mtx);
249 return (error);
250 }
251
252 /*
253 * Rewrite destination address in case we will connect to loopback address.
254 *
255 * Returns 0 on success, EAFNOSUPPORT if the jail doesn't allow IPv4.
256 * Address passed in in NBO and returned in NBO.
257 */
258 int
prison_remote_ip4(struct ucred * cred,struct in_addr * ia)259 prison_remote_ip4(struct ucred *cred, struct in_addr *ia)
260 {
261 struct prison *pr;
262
263 KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
264 KASSERT(ia != NULL, ("%s: ia is NULL", __func__));
265
266 pr = cred->cr_prison;
267 if (!(pr->pr_flags & PR_IP4))
268 return (0);
269 mtx_lock(&pr->pr_mtx);
270 if (!(pr->pr_flags & PR_IP4)) {
271 mtx_unlock(&pr->pr_mtx);
272 return (0);
273 }
274 if (pr->pr_addrs[PR_INET] == NULL) {
275 mtx_unlock(&pr->pr_mtx);
276 return (EAFNOSUPPORT);
277 }
278
279 if (ntohl(ia->s_addr) == INADDR_LOOPBACK &&
280 prison_check_ip4_locked(pr, ia) == EADDRNOTAVAIL) {
281 ia->s_addr = prison_primary_ip4(pr);
282 mtx_unlock(&pr->pr_mtx);
283 return (0);
284 }
285
286 /*
287 * Return success because nothing had to be changed.
288 */
289 mtx_unlock(&pr->pr_mtx);
290 return (0);
291 }
292
293 /*
294 * Check if given address belongs to the jail referenced by cred/prison.
295 *
296 * Returns 0 if address belongs to jail,
297 * EADDRNOTAVAIL if the address doesn't belong to the jail.
298 */
299 int
prison_check_ip4_locked(const struct prison * pr,const struct in_addr * ia)300 prison_check_ip4_locked(const struct prison *pr, const struct in_addr *ia)
301 {
302
303 if (!(pr->pr_flags & PR_IP4))
304 return (0);
305
306 return (prison_ip_check(pr, PR_INET, ia));
307 }
308
309 int
prison_check_ip4(const struct ucred * cred,const struct in_addr * ia)310 prison_check_ip4(const struct ucred *cred, const struct in_addr *ia)
311 {
312 struct prison *pr;
313 int error;
314
315 KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
316 KASSERT(ia != NULL, ("%s: ia is NULL", __func__));
317
318 pr = cred->cr_prison;
319 if (!(pr->pr_flags & PR_IP4))
320 return (0);
321 mtx_lock(&pr->pr_mtx);
322 if (!(pr->pr_flags & PR_IP4)) {
323 mtx_unlock(&pr->pr_mtx);
324 return (0);
325 }
326 if (pr->pr_addrs[PR_INET] == NULL) {
327 mtx_unlock(&pr->pr_mtx);
328 return (EAFNOSUPPORT);
329 }
330
331 error = prison_check_ip4_locked(pr, ia);
332 mtx_unlock(&pr->pr_mtx);
333 return (error);
334 }
335