xref: /freebsd/sys/netinet/in_jail.c (revision 9f23cbd6cae82fd77edfad7173432fa8dccd0a95)
1 /*-
2  * Copyright (c) 1999 Poul-Henning Kamp.
3  * Copyright (c) 2008 Bjoern A. Zeeb.
4  * Copyright (c) 2009 James Gritton.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 
29 #include <sys/cdefs.h>
30 __FBSDID("$FreeBSD$");
31 
32 #include "opt_ddb.h"
33 #include "opt_inet.h"
34 #include "opt_inet6.h"
35 
36 #include <sys/param.h>
37 #include <sys/types.h>
38 #include <sys/kernel.h>
39 #include <sys/systm.h>
40 #include <sys/errno.h>
41 #include <sys/sysproto.h>
42 #include <sys/malloc.h>
43 #include <sys/osd.h>
44 #include <sys/priv.h>
45 #include <sys/proc.h>
46 #include <sys/taskqueue.h>
47 #include <sys/fcntl.h>
48 #include <sys/jail.h>
49 #include <sys/lock.h>
50 #include <sys/mutex.h>
51 #include <sys/racct.h>
52 #include <sys/refcount.h>
53 #include <sys/sx.h>
54 #include <sys/namei.h>
55 #include <sys/mount.h>
56 #include <sys/queue.h>
57 #include <sys/socket.h>
58 #include <sys/syscallsubr.h>
59 #include <sys/sysctl.h>
60 #include <sys/vnode.h>
61 
62 #include <net/if.h>
63 #include <net/vnet.h>
64 
65 #include <netinet/in.h>
66 
67 static in_addr_t
68 prison_primary_ip4(const struct prison *pr)
69 {
70 
71 	return (((const struct in_addr *)prison_ip_get0(pr, PR_INET))->s_addr);
72 }
73 
74 int
75 prison_qcmp_v4(const void *ip1, const void *ip2)
76 {
77 	in_addr_t iaa, iab;
78 
79 	/*
80 	 * We need to compare in HBO here to get the list sorted as expected
81 	 * by the result of the code.  Sorting NBO addresses gives you
82 	 * interesting results.  If you do not understand, do not try.
83 	 */
84 	iaa = ntohl(((const struct in_addr *)ip1)->s_addr);
85 	iab = ntohl(((const struct in_addr *)ip2)->s_addr);
86 
87 	/*
88 	 * Do not simply return the difference of the two numbers, the int is
89 	 * not wide enough.
90 	 */
91 	if (iaa > iab)
92 		return (1);
93 	else if (iaa < iab)
94 		return (-1);
95 	else
96 		return (0);
97 }
98 
99 bool
100 prison_valid_v4(const void *ip)
101 {
102 	in_addr_t ia = ((const struct in_addr *)ip)->s_addr;
103 
104 	/*
105 	 * We do not have to care about byte order for these
106 	 * checks so we will do them in NBO.
107 	 */
108 	return (ia != INADDR_ANY && ia != INADDR_BROADCAST);
109 }
110 
111 /*
112  * Pass back primary IPv4 address of this jail.
113  *
114  * If not restricted return success but do not alter the address.  Caller has
115  * to make sure to initialize it correctly (e.g. INADDR_ANY).
116  *
117  * Returns 0 on success, EAFNOSUPPORT if the jail doesn't allow IPv4.
118  * Address returned in NBO.
119  */
120 int
121 prison_get_ip4(struct ucred *cred, struct in_addr *ia)
122 {
123 	struct prison *pr;
124 
125 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
126 	KASSERT(ia != NULL, ("%s: ia is NULL", __func__));
127 
128 	pr = cred->cr_prison;
129 	if (!(pr->pr_flags & PR_IP4))
130 		return (0);
131 	mtx_lock(&pr->pr_mtx);
132 	if (!(pr->pr_flags & PR_IP4)) {
133 		mtx_unlock(&pr->pr_mtx);
134 		return (0);
135 	}
136 	if (pr->pr_addrs[PR_INET] == NULL) {
137 		mtx_unlock(&pr->pr_mtx);
138 		return (EAFNOSUPPORT);
139 	}
140 
141 	ia->s_addr = prison_primary_ip4(pr);
142 	mtx_unlock(&pr->pr_mtx);
143 	return (0);
144 }
145 
146 /*
147  * Return true if we should do proper source address selection or are not jailed.
148  * We will return false if we should bypass source address selection in favour
149  * of the primary jail IPv4 address. Only in this case *ia will be updated and
150  * returned in NBO.
151  * Return true, even in case this jail does not allow IPv4.
152  */
153 bool
154 prison_saddrsel_ip4(struct ucred *cred, struct in_addr *ia)
155 {
156 	struct prison *pr;
157 	struct in_addr lia;
158 
159 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
160 	KASSERT(ia != NULL, ("%s: ia is NULL", __func__));
161 
162 	if (!jailed(cred))
163 		return (true);
164 
165 	pr = cred->cr_prison;
166 	if (pr->pr_flags & PR_IP4_SADDRSEL)
167 		return (true);
168 
169 	lia.s_addr = INADDR_ANY;
170 	if (prison_get_ip4(cred, &lia) != 0)
171 		return (true);
172 	if (lia.s_addr == INADDR_ANY)
173 		return (true);
174 
175 	ia->s_addr = lia.s_addr;
176 	return (false);
177 }
178 
179 /*
180  * Return true if pr1 and pr2 have the same IPv4 address restrictions.
181  */
182 bool
183 prison_equal_ip4(struct prison *pr1, struct prison *pr2)
184 {
185 
186 	if (pr1 == pr2)
187 		return (true);
188 
189 	/*
190 	 * No need to lock since the PR_IP4_USER flag can't be altered for
191 	 * existing prisons.
192 	 */
193 	while (pr1 != &prison0 &&
194 #ifdef VIMAGE
195 	       !(pr1->pr_flags & PR_VNET) &&
196 #endif
197 	       !(pr1->pr_flags & PR_IP4_USER))
198 		pr1 = pr1->pr_parent;
199 	while (pr2 != &prison0 &&
200 #ifdef VIMAGE
201 	       !(pr2->pr_flags & PR_VNET) &&
202 #endif
203 	       !(pr2->pr_flags & PR_IP4_USER))
204 		pr2 = pr2->pr_parent;
205 	return (pr1 == pr2);
206 }
207 
208 /*
209  * Make sure our (source) address is set to something meaningful to this
210  * jail.
211  *
212  * Returns 0 if jail doesn't restrict IPv4 or if address belongs to jail,
213  * EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if the jail
214  * doesn't allow IPv4.  Address passed in in NBO and returned in NBO.
215  */
216 int
217 prison_local_ip4(struct ucred *cred, struct in_addr *ia)
218 {
219 	struct prison *pr;
220 	struct in_addr ia0;
221 	int error;
222 
223 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
224 	KASSERT(ia != NULL, ("%s: ia is NULL", __func__));
225 
226 	pr = cred->cr_prison;
227 	if (!(pr->pr_flags & PR_IP4))
228 		return (0);
229 	mtx_lock(&pr->pr_mtx);
230 	if (!(pr->pr_flags & PR_IP4)) {
231 		mtx_unlock(&pr->pr_mtx);
232 		return (0);
233 	}
234 	if (pr->pr_addrs[PR_INET] == NULL) {
235 		mtx_unlock(&pr->pr_mtx);
236 		return (EAFNOSUPPORT);
237 	}
238 
239 	ia0.s_addr = ntohl(ia->s_addr);
240 
241 	if (ia0.s_addr == INADDR_ANY) {
242 		/*
243 		 * In case there is only 1 IPv4 address, bind directly.
244 		 */
245 		if (prison_ip_cnt(pr, PR_INET) == 1)
246 			ia->s_addr = prison_primary_ip4(pr);
247 		mtx_unlock(&pr->pr_mtx);
248 		return (0);
249 	}
250 
251 	error = prison_check_ip4_locked(pr, ia);
252 	if (error == EADDRNOTAVAIL && ia0.s_addr == INADDR_LOOPBACK) {
253 		ia->s_addr = prison_primary_ip4(pr);
254 		error = 0;
255 	}
256 
257 	mtx_unlock(&pr->pr_mtx);
258 	return (error);
259 }
260 
261 /*
262  * Rewrite destination address in case we will connect to loopback address.
263  *
264  * Returns 0 on success, EAFNOSUPPORT if the jail doesn't allow IPv4.
265  * Address passed in in NBO and returned in NBO.
266  */
267 int
268 prison_remote_ip4(struct ucred *cred, struct in_addr *ia)
269 {
270 	struct prison *pr;
271 
272 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
273 	KASSERT(ia != NULL, ("%s: ia is NULL", __func__));
274 
275 	pr = cred->cr_prison;
276 	if (!(pr->pr_flags & PR_IP4))
277 		return (0);
278 	mtx_lock(&pr->pr_mtx);
279 	if (!(pr->pr_flags & PR_IP4)) {
280 		mtx_unlock(&pr->pr_mtx);
281 		return (0);
282 	}
283 	if (pr->pr_addrs[PR_INET] == NULL) {
284 		mtx_unlock(&pr->pr_mtx);
285 		return (EAFNOSUPPORT);
286 	}
287 
288 	if (ntohl(ia->s_addr) == INADDR_LOOPBACK &&
289 	    prison_check_ip4_locked(pr, ia) == EADDRNOTAVAIL) {
290 		ia->s_addr = prison_primary_ip4(pr);
291 		mtx_unlock(&pr->pr_mtx);
292 		return (0);
293 	}
294 
295 	/*
296 	 * Return success because nothing had to be changed.
297 	 */
298 	mtx_unlock(&pr->pr_mtx);
299 	return (0);
300 }
301 
302 /*
303  * Check if given address belongs to the jail referenced by cred/prison.
304  *
305  * Returns 0 if address belongs to jail,
306  * EADDRNOTAVAIL if the address doesn't belong to the jail.
307  */
308 int
309 prison_check_ip4_locked(const struct prison *pr, const struct in_addr *ia)
310 {
311 
312 	if (!(pr->pr_flags & PR_IP4))
313 		return (0);
314 
315 	return (prison_ip_check(pr, PR_INET, ia));
316 }
317 
318 int
319 prison_check_ip4(const struct ucred *cred, const struct in_addr *ia)
320 {
321 	struct prison *pr;
322 	int error;
323 
324 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
325 	KASSERT(ia != NULL, ("%s: ia is NULL", __func__));
326 
327 	pr = cred->cr_prison;
328 	if (!(pr->pr_flags & PR_IP4))
329 		return (0);
330 	mtx_lock(&pr->pr_mtx);
331 	if (!(pr->pr_flags & PR_IP4)) {
332 		mtx_unlock(&pr->pr_mtx);
333 		return (0);
334 	}
335 	if (pr->pr_addrs[PR_INET] == NULL) {
336 		mtx_unlock(&pr->pr_mtx);
337 		return (EAFNOSUPPORT);
338 	}
339 
340 	error = prison_check_ip4_locked(pr, ia);
341 	mtx_unlock(&pr->pr_mtx);
342 	return (error);
343 }
344