summaryrefslogtreecommitdiffstats
path: root/sys/net/if_gre.c
diff options
context:
space:
mode:
authorbz <bz@FreeBSD.org>2011-03-02 21:39:08 +0000
committerbz <bz@FreeBSD.org>2011-03-02 21:39:08 +0000
commit209ebad7afe0e7749d0576ce93225b05fbbd0322 (patch)
tree30a6d1098a34879754cd4af6e0ce4afe1edb786b /sys/net/if_gre.c
parentd456b2027b593444bd9b87f1422f78b394761f3b (diff)
downloadFreeBSD-src-209ebad7afe0e7749d0576ce93225b05fbbd0322.zip
FreeBSD-src-209ebad7afe0e7749d0576ce93225b05fbbd0322.tar.gz
Hide the outer IP addresses of a tunnel interfaces (gif(4), gre(4))
from processes inside jails if the addresses do not belong to the jail. Originally reported by: Pieter de Boer via remko PR: kern/151119 Tested by: Piotr KUCHARSKI (nospam 42.pl) [gif] MFC after: 1 week
Diffstat (limited to 'sys/net/if_gre.c')
-rw-r--r--sys/net/if_gre.c19
1 files changed, 19 insertions, 0 deletions
diff --git a/sys/net/if_gre.c b/sys/net/if_gre.c
index 1f1e108..de968af 100644
--- a/sys/net/if_gre.c
+++ b/sys/net/if_gre.c
@@ -46,6 +46,7 @@
#include "opt_inet6.h"
#include <sys/param.h>
+#include <sys/jail.h>
#include <sys/kernel.h>
#include <sys/malloc.h>
#include <sys/module.h>
@@ -636,6 +637,9 @@ gre_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
si.sin_len = sizeof(struct sockaddr_in);
si.sin_addr.s_addr = sc->g_src.s_addr;
sa = sintosa(&si);
+ error = prison_if(curthread->td_ucred, sa);
+ if (error != 0)
+ break;
ifr->ifr_addr = *sa;
break;
case GREGADDRD:
@@ -644,6 +648,9 @@ gre_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
si.sin_len = sizeof(struct sockaddr_in);
si.sin_addr.s_addr = sc->g_dst.s_addr;
sa = sintosa(&si);
+ error = prison_if(curthread->td_ucred, sa);
+ if (error != 0)
+ break;
ifr->ifr_addr = *sa;
break;
case SIOCSIFPHYADDR:
@@ -707,8 +714,14 @@ gre_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
si.sin_family = AF_INET;
si.sin_len = sizeof(struct sockaddr_in);
si.sin_addr.s_addr = sc->g_src.s_addr;
+ error = prison_if(curthread->td_ucred, (struct sockaddr *)&si);
+ if (error != 0)
+ break;
memcpy(&lifr->addr, &si, sizeof(si));
si.sin_addr.s_addr = sc->g_dst.s_addr;
+ error = prison_if(curthread->td_ucred, (struct sockaddr *)&si);
+ if (error != 0)
+ break;
memcpy(&lifr->dstaddr, &si, sizeof(si));
break;
case SIOCGIFPSRCADDR:
@@ -723,6 +736,9 @@ gre_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
si.sin_family = AF_INET;
si.sin_len = sizeof(struct sockaddr_in);
si.sin_addr.s_addr = sc->g_src.s_addr;
+ error = prison_if(curthread->td_ucred, (struct sockaddr *)&si);
+ if (error != 0)
+ break;
bcopy(&si, &ifr->ifr_addr, sizeof(ifr->ifr_addr));
break;
case SIOCGIFPDSTADDR:
@@ -737,6 +753,9 @@ gre_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
si.sin_family = AF_INET;
si.sin_len = sizeof(struct sockaddr_in);
si.sin_addr.s_addr = sc->g_dst.s_addr;
+ error = prison_if(curthread->td_ucred, (struct sockaddr *)&si);
+ if (error != 0)
+ break;
bcopy(&si, &ifr->ifr_addr, sizeof(ifr->ifr_addr));
break;
case GRESKEY:
OpenPOWER on IntegriCloud