1 /*-
2 * Copyright (c) 1999-2002, 2007 Robert N. M. Watson
3 * Copyright (c) 2001-2002 Networks Associates Technology, Inc.
4 * Copyright (c) 2006 SPARTA, Inc.
5 * All rights reserved.
6 *
7 * This software was developed by Robert Watson for the TrustedBSD Project.
8 *
9 * This software was developed for the FreeBSD Project in part by Network
10 * Associates Laboratories, the Security Research Division of Network
11 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
12 * as part of the DARPA CHATS research program.
13 *
14 * This software was enhanced by SPARTA ISSO under SPAWAR contract
15 * N66001-04-C-6019 ("SEFOS").
16 *
17 * Redistribution and use in source and binary forms, with or without
18 * modification, are permitted provided that the following conditions
19 * are met:
20 * 1. Redistributions of source code must retain the above copyright
21 * notice, this list of conditions and the following disclaimer.
22 * 2. Redistributions in binary form must reproduce the above copyright
23 * notice, this list of conditions and the following disclaimer in the
24 * documentation and/or other materials provided with the distribution.
25 *
26 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
27 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 * SUCH DAMAGE.
37 */
38
39 /*
40 * Developed by the TrustedBSD Project.
41 *
42 * Limit access to interfaces until they are specifically administratively
43 * enabled. Prevents protocol stack-driven packet leakage in unsafe
44 * environments.
45 */
46
47 #include <sys/param.h>
48 #include <sys/kernel.h>
49 #include <sys/module.h>
50 #include <sys/mbuf.h>
51 #include <sys/socket.h>
52 #include <sys/sysctl.h>
53
54 #include <net/if.h>
55 #include <net/if_var.h>
56 #include <net/if_types.h>
57 #include <net/bpfdesc.h>
58
59 #include <security/mac/mac_policy.h>
60
61 SYSCTL_DECL(_security_mac);
62
63 static SYSCTL_NODE(_security_mac, OID_AUTO, ifoff,
64 CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
65 "TrustedBSD mac_ifoff policy controls");
66
67 static int ifoff_enabled = 1;
68 SYSCTL_INT(_security_mac_ifoff, OID_AUTO, enabled, CTLFLAG_RWTUN,
69 &ifoff_enabled, 0, "Enforce ifoff policy");
70
71 static int ifoff_lo_enabled = 1;
72 SYSCTL_INT(_security_mac_ifoff, OID_AUTO, lo_enabled, CTLFLAG_RWTUN,
73 &ifoff_lo_enabled, 0, "Enable loopback interfaces");
74
75 static int ifoff_other_enabled = 0;
76 SYSCTL_INT(_security_mac_ifoff, OID_AUTO, other_enabled, CTLFLAG_RWTUN,
77 &ifoff_other_enabled, 0, "Enable other interfaces");
78
79 static int ifoff_bpfrecv_enabled = 0;
80 SYSCTL_INT(_security_mac_ifoff, OID_AUTO, bpfrecv_enabled, CTLFLAG_RWTUN,
81 &ifoff_bpfrecv_enabled, 0, "Enable BPF reception even when interface "
82 "is disabled");
83
84 static int
ifnet_check_outgoing(struct ifnet * ifp)85 ifnet_check_outgoing(struct ifnet *ifp)
86 {
87
88 if (!ifoff_enabled)
89 return (0);
90
91 if (ifoff_lo_enabled && if_gettype(ifp) == IFT_LOOP)
92 return (0);
93
94 if (ifoff_other_enabled && if_gettype(ifp) != IFT_LOOP)
95 return (0);
96
97 return (EPERM);
98 }
99
100 static int
ifnet_check_incoming(struct ifnet * ifp,int viabpf)101 ifnet_check_incoming(struct ifnet *ifp, int viabpf)
102 {
103 if (!ifoff_enabled)
104 return (0);
105
106 if (ifoff_lo_enabled && if_gettype(ifp) == IFT_LOOP)
107 return (0);
108
109 if (ifoff_other_enabled && if_gettype(ifp) != IFT_LOOP)
110 return (0);
111
112 if (viabpf && ifoff_bpfrecv_enabled)
113 return (0);
114
115 return (EPERM);
116 }
117
118 /*
119 * Object-specific entry point implementations are sorted alphabetically by
120 * object type and then by operation.
121 */
122 static int
ifoff_bpfdesc_check_receive(struct bpf_d * d,struct label * dlabel,struct ifnet * ifp,struct label * ifplabel)123 ifoff_bpfdesc_check_receive(struct bpf_d *d, struct label *dlabel,
124 struct ifnet *ifp, struct label *ifplabel)
125 {
126
127 return (ifnet_check_incoming(ifp, 1));
128 }
129
130 static int
ifoff_ifnet_check_transmit(struct ifnet * ifp,struct label * ifplabel,struct mbuf * m,struct label * mlabel)131 ifoff_ifnet_check_transmit(struct ifnet *ifp, struct label *ifplabel,
132 struct mbuf *m, struct label *mlabel)
133 {
134
135 return (ifnet_check_outgoing(ifp));
136 }
137
138 static int
ifoff_inpcb_check_deliver(struct inpcb * inp,struct label * inplabel,struct mbuf * m,struct label * mlabel)139 ifoff_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel,
140 struct mbuf *m, struct label *mlabel)
141 {
142
143 M_ASSERTPKTHDR(m);
144 if (m->m_pkthdr.rcvif != NULL)
145 return (ifnet_check_incoming(m->m_pkthdr.rcvif, 0));
146
147 return (0);
148 }
149
150 static int
ifoff_socket_check_deliver(struct socket * so,struct label * solabel,struct mbuf * m,struct label * mlabel)151 ifoff_socket_check_deliver(struct socket *so, struct label *solabel,
152 struct mbuf *m, struct label *mlabel)
153 {
154
155 M_ASSERTPKTHDR(m);
156 if (m->m_pkthdr.rcvif != NULL)
157 return (ifnet_check_incoming(m->m_pkthdr.rcvif, 0));
158
159 return (0);
160 }
161
162 static struct mac_policy_ops ifoff_ops =
163 {
164 .mpo_bpfdesc_check_receive = ifoff_bpfdesc_check_receive,
165 .mpo_ifnet_check_transmit = ifoff_ifnet_check_transmit,
166 .mpo_inpcb_check_deliver = ifoff_inpcb_check_deliver,
167 .mpo_socket_check_deliver = ifoff_socket_check_deliver,
168 };
169
170 MAC_POLICY_SET(&ifoff_ops, mac_ifoff, "TrustedBSD MAC/ifoff",
171 MPC_LOADTIME_FLAG_UNLOADOK, NULL);
172