diff options
author | jamie <jamie@FreeBSD.org> | 2009-02-05 14:06:09 +0000 |
---|---|---|
committer | jamie <jamie@FreeBSD.org> | 2009-02-05 14:06:09 +0000 |
commit | 12bbe1869f5926ca7e3457f5424afdca31a1189b (patch) | |
tree | 71fe0b10296684e7094a545ca78ed6f72789d82d /sys/netinet6/raw_ip6.c | |
parent | 2926f8fa435de3f0b595eb5309b2a0c364703371 (diff) | |
download | FreeBSD-src-12bbe1869f5926ca7e3457f5424afdca31a1189b.zip FreeBSD-src-12bbe1869f5926ca7e3457f5424afdca31a1189b.tar.gz |
Standardize the various prison_foo_ip[46] functions and prison_if to
return zero on success and an error code otherwise. The possible errors
are EADDRNOTAVAIL if an address being checked for doesn't match the
prison, and EAFNOSUPPORT if the prison doesn't have any addresses in
that address family. For most callers of these functions, use the
returned error code instead of e.g. a hard-coded EADDRNOTAVAIL or
EINVAL.
Always include a jailed() check in these functions, where a non-jailed
cred always returns success (and makes no changes). Remove the explicit
jailed() checks that preceded many of the function calls.
Approved by: bz (mentor)
Diffstat (limited to 'sys/netinet6/raw_ip6.c')
-rw-r--r-- | sys/netinet6/raw_ip6.c | 18 |
1 files changed, 7 insertions, 11 deletions
diff --git a/sys/netinet6/raw_ip6.c b/sys/netinet6/raw_ip6.c index 18b8131..da781a0 100644 --- a/sys/netinet6/raw_ip6.c +++ b/sys/netinet6/raw_ip6.c @@ -179,10 +179,8 @@ rip6_input(struct mbuf **mp, int *offp, int proto) if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr) && !IN6_ARE_ADDR_EQUAL(&in6p->in6p_faddr, &ip6->ip6_src)) continue; - if (jailed(in6p->inp_cred)) { - if (!prison_check_ip6(in6p->inp_cred, &ip6->ip6_dst)) - continue; - } + if (prison_check_ip6(in6p->inp_cred, &ip6->ip6_dst) != 0) + continue; INP_RLOCK(in6p); if (in6p->in6p_cksum != -1) { V_rip6stat.rip6s_isum++; @@ -411,11 +409,9 @@ rip6_output(m, va_alist) error = EADDRNOTAVAIL; goto bad; } - if (jailed(in6p->inp_cred)) - if (prison_get_ip6(in6p->inp_cred, in6a) != 0) { - error = EPERM; - goto bad; - } + error = prison_get_ip6(in6p->inp_cred, in6a); + if (error != 0) + goto bad; ip6->ip6_src = *in6a; if (oifp && scope_ambiguous) { @@ -678,8 +674,8 @@ rip6_bind(struct socket *so, struct sockaddr *nam, struct thread *td) if (nam->sa_len != sizeof(*addr)) return (EINVAL); - if (!prison_check_ip6(td->td_ucred, &addr->sin6_addr)) - return (EADDRNOTAVAIL); + if ((error = prison_check_ip6(td->td_ucred, &addr->sin6_addr)) != 0) + return (error); if (TAILQ_EMPTY(&V_ifnet) || addr->sin6_family != AF_INET6) return (EADDRNOTAVAIL); if ((error = sa6_embedscope(addr, V_ip6_use_defzone)) != 0) |