diff options
| author | bz <bz@FreeBSD.org> | 2009-01-09 13:06:56 +0000 |
|---|---|---|
| committer | bz <bz@FreeBSD.org> | 2009-01-09 13:06:56 +0000 |
| commit | 60c950d4ff05ccd0e88e7333e5b3d64868165843 (patch) | |
| tree | 84cf148c8aae2a216120bb00e5abe0953a078f4b /sys/netinet6/in6.c | |
| parent | aa56a975c17dac5562552bb238277fd96c124da2 (diff) | |
| download | FreeBSD-src-60c950d4ff05ccd0e88e7333e5b3d64868165843.zip FreeBSD-src-60c950d4ff05ccd0e88e7333e5b3d64868165843.tar.gz | |
Make SIOCGIFADDR and related, as well as SIOCGIFADDR_IN6 and related
jail-aware. Up to now we returned the first address of the interface
for SIOCGIFADDR w/o an ifr_addr in the query. This caused problems for
programs querying for an address but running inside a jail, as the
address returned usually did not belong to the jail.
Like for v6, if there was an ifr_addr given on v4, you could probe
for more addresses on the interfaces that you were not allowed to see
from inside a jail. Return an error (EADDRNOTAVAIL) in that case
now unless the address is on the given interface and valid for the
jail.
PR: kern/114325
Reviewed by: rwatson
MFC after: 4 weeks
Diffstat (limited to 'sys/netinet6/in6.c')
| -rw-r--r-- | sys/netinet6/in6.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/sys/netinet6/in6.c b/sys/netinet6/in6.c index 4c97999..e36c2dd 100644 --- a/sys/netinet6/in6.c +++ b/sys/netinet6/in6.c @@ -68,6 +68,7 @@ __FBSDID("$FreeBSD$"); #include <sys/param.h> #include <sys/errno.h> +#include <sys/jail.h> #include <sys/malloc.h> #include <sys/socket.h> #include <sys/socketvar.h> @@ -329,6 +330,9 @@ in6_control(struct socket *so, u_long cmd, caddr_t data, error = in6_setscope(&sa6->sin6_addr, ifp, NULL); if (error != 0) return (error); + if (td != NULL && !prison_check_ip6(td->td_ucred, + &sa6->sin6_addr)) + return (EADDRNOTAVAIL); ia = in6ifa_ifpwithaddr(ifp, &sa6->sin6_addr); } else ia = NULL; |
