From nobody Fri Jan 13 21:25:57 2023 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Ntvbn6fdSz2ql5R; Fri, 13 Jan 2023 21:25:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Ntvbn5Ssyz44Xy; Fri, 13 Jan 2023 21:25:57 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1673645157; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=jesthFvkvjwpIiizSmxFZzRLg9LtR3duvYdi3EVOZMI=; b=abKVB/JRB7ptlavHHe9RZ6UNwsEKrvN8ZQNL/EpBLD2q6zgsCj3S4x+KqWwz9zXZ8ne3Ky kkbBt3YO0ZfFARnyAwGwgiQSk+1PGJJkM+qHjRAEOwIH1hRwbvR0tyBJb/8GzzUWZQHd2j 98e6I2JRw/vbsxQCHwyroJ5SoMG3m6gHm/vMKrsxC5ExrvoYyZhHCMR0mhUG4Rtt4gku96 +LIrGouBKLpHcikl+ckkhVdvchWrvXrusYAHRO/f0bnteWpyzEC7oZH+utDa5G6cfkkKJU uvlIGqwKmxtz6IhNYQ19VrDANGknepful4J5o+R7QGi/uDOsir9X5EPPj6pTSA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1673645157; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=jesthFvkvjwpIiizSmxFZzRLg9LtR3duvYdi3EVOZMI=; b=huC4hnW0LLztNSjki3HslVhM+iwqBrkjMt5gXe1ZGjTceSnY587yFWRkRHyaSxwLUDho+w RsOTMdpE7iDoTe7lV1bpul6xZ/1FWbg0MdlDwr8y/AhCF3p8lET8lOqSjD/GxU9yZGeiQN DwnTr3PM1KrkGDiLCHdYCXI+QYtgcUX91q0b5jIc5Fidut/RnhX4dyG1R7UneiNCbyEtIW UGKeoEI+98akcuSauYWY1TX8Pfv5tNzvz9obuNeCgiplKb8ppJToXYJO+UMiQ8xBK1UcB4 lm6F0sieo+/QQyGkxSZ5QEeKB4YFE1ffAYFkUIUKr9Rmu/6kqrYANEQszYJWrg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1673645157; a=rsa-sha256; cv=none; b=ju/8QVeyPgvUjMXqeXIIYAOtxvgpBExnBD4JSVMwicq9CE2lEszTdw7SXbUo8UutpE2bwj UgyQeiIK4AO+bSVSer00sGQOHTVpWfmEpsiM0EBI2uLePNRYK3ZKA4b6agXBgBDzrS7gbr M/m2JfSisrh34FvdU9Jz4Dnvvh0bIrhCVtNDdvexhhqBuSt1pGI8uXQ847iYH69Vss/f6V yXC4jpd/3LXDoE9Tzt7qXCGJOB3DjNr3Tj9TK9tydo0R4+SFt7KxBBgWcOAJcdMMzFT0in 4m59SDs69XGm9okaV0eaH61sTdPv+U4B5x+Dy/KyDT1SLeVsl5HHo6W6iermMg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Ntvbn4VGRzNBg; Fri, 13 Jan 2023 21:25:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 30DLPvJ0042573; Fri, 13 Jan 2023 21:25:57 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 30DLPvHT042572; Fri, 13 Jan 2023 21:25:57 GMT (envelope-from git) Date: Fri, 13 Jan 2023 21:25:57 GMT Message-Id: <202301132125.30DLPvHT042572@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: "Alexander V. Chernikov" Subject: git: 77afa3132ee9 - stable/13 - netinet: pass cred instead of the curthread to ifaddr manipulation funcs. List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-branches@freebsd.org X-BeenThere: dev-commits-src-branches@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: melifaro X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 77afa3132ee96872ad2c715d81699bf1635c52ba Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch stable/13 has been updated by melifaro: URL: https://cgit.FreeBSD.org/src/commit/?id=77afa3132ee96872ad2c715d81699bf1635c52ba commit 77afa3132ee96872ad2c715d81699bf1635c52ba Author: Alexander V. Chernikov AuthorDate: 2022-09-26 12:07:18 +0000 Commit: Alexander V. Chernikov CommitDate: 2023-01-13 21:24:12 +0000 netinet: pass cred instead of the curthread to ifaddr manipulation funcs. Pass the credentials directly to the functions, so non-ioctl kernel users can also performan address manipulations. MFC after: 2 weeks (cherry picked from commit f375bf0e6f0bc6bce3e5b3c6adabc465be2665d0) --- sys/netinet/in.c | 42 ++++++++++++++++++++++-------------------- 1 file changed, 22 insertions(+), 20 deletions(-) diff --git a/sys/netinet/in.c b/sys/netinet/in.c index 9fa9ab289fd3..15779d6e61a7 100644 --- a/sys/netinet/in.c +++ b/sys/netinet/in.c @@ -75,9 +75,9 @@ __FBSDID("$FreeBSD$"); #include #include -static int in_aifaddr_ioctl(u_long, caddr_t, struct ifnet *, struct thread *); -static int in_difaddr_ioctl(u_long, caddr_t, struct ifnet *, struct thread *); -static int in_gifaddr_ioctl(u_long, caddr_t, struct ifnet *, struct thread *); +static int in_aifaddr_ioctl(u_long, caddr_t, struct ifnet *, struct ucred *); +static int in_difaddr_ioctl(u_long, caddr_t, struct ifnet *, struct ucred *); +static int in_gifaddr_ioctl(u_long, caddr_t, struct ifnet *, struct ucred *); static void in_socktrim(struct sockaddr_in *); static void in_purgemaddrs(struct ifnet *); @@ -280,6 +280,8 @@ in_control(struct socket *so, u_long cmd, caddr_t data, struct ifnet *ifp, if (ifp == NULL) return (EADDRNOTAVAIL); + struct ucred *cred = (td != NULL) ? td->td_ucred : NULL; + /* * Filter out 4 ioctls we implement directly. Forward the rest * to specific functions and ifp->if_ioctl(). @@ -292,18 +294,18 @@ in_control(struct socket *so, u_long cmd, caddr_t data, struct ifnet *ifp, break; case SIOCGIFALIAS: sx_xlock(&in_control_sx); - error = in_gifaddr_ioctl(cmd, data, ifp, td); + error = in_gifaddr_ioctl(cmd, data, ifp, cred); sx_xunlock(&in_control_sx); return (error); case SIOCDIFADDR: sx_xlock(&in_control_sx); - error = in_difaddr_ioctl(cmd, data, ifp, td); + error = in_difaddr_ioctl(cmd, data, ifp, cred); sx_xunlock(&in_control_sx); return (error); case OSIOCAIFADDR: /* 9.x compat */ case SIOCAIFADDR: sx_xlock(&in_control_sx); - error = in_aifaddr_ioctl(cmd, data, ifp, td); + error = in_aifaddr_ioctl(cmd, data, ifp, cred); sx_xunlock(&in_control_sx); return (error); case SIOCSIFADDR: @@ -319,7 +321,7 @@ in_control(struct socket *so, u_long cmd, caddr_t data, struct ifnet *ifp, } if (addr->sin_addr.s_addr != INADDR_ANY && - prison_check_ip4(td->td_ucred, &addr->sin_addr) != 0) + prison_check_ip4(cred, &addr->sin_addr) != 0) return (EADDRNOTAVAIL); /* @@ -339,7 +341,7 @@ in_control(struct socket *so, u_long cmd, caddr_t data, struct ifnet *ifp, CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) if (ifa->ifa_addr->sa_family == AF_INET) { ia = (struct in_ifaddr *)ifa; - if (prison_check_ip4(td->td_ucred, + if (prison_check_ip4(cred, &ia->ia_addr.sin_addr) == 0) break; } @@ -382,7 +384,7 @@ in_control(struct socket *so, u_long cmd, caddr_t data, struct ifnet *ifp, } static int -in_aifaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, struct thread *td) +in_aifaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, struct ucred *cred) { const struct in_aliasreq *ifra = (struct in_aliasreq *)data; const struct sockaddr_in *addr = &ifra->ifra_addr; @@ -396,7 +398,7 @@ in_aifaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, struct thread *td) bool iaIsFirst; int error = 0; - error = priv_check(td, PRIV_NET_ADDIFADDR); + error = priv_check_cred(cred, PRIV_NET_ADDIFADDR); if (error) return (error); @@ -436,7 +438,7 @@ in_aifaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, struct thread *td) it = (struct in_ifaddr *)ifa; if (it->ia_addr.sin_addr.s_addr == addr->sin_addr.s_addr && - prison_check_ip4(td->td_ucred, &addr->sin_addr) == 0) + prison_check_ip4(cred, &addr->sin_addr) == 0) ia = it; else iaIsFirst = false; @@ -444,7 +446,7 @@ in_aifaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, struct thread *td) NET_EPOCH_EXIT(et); if (ia != NULL) - (void )in_difaddr_ioctl(cmd, data, ifp, td); + (void )in_difaddr_ioctl(cmd, data, ifp, cred); ifa = ifa_alloc(sizeof(struct in_ifaddr), M_WAITOK); ia = (struct in_ifaddr *)ifa; @@ -598,7 +600,7 @@ fail1: } static int -in_difaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, struct thread *td) +in_difaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, struct ucred *cred) { const struct ifreq *ifr = (struct ifreq *)data; const struct sockaddr_in *addr = (const struct sockaddr_in *) @@ -608,8 +610,8 @@ in_difaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, struct thread *td) bool deleteAny, iaIsLast; int error; - if (td != NULL) { - error = priv_check(td, PRIV_NET_DELIFADDR); + if (cred != NULL) { + error = priv_check_cred(cred, PRIV_NET_DELIFADDR); if (error) return (error); } @@ -630,12 +632,12 @@ in_difaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, struct thread *td) continue; it = (struct in_ifaddr *)ifa; - if (deleteAny && ia == NULL && (td == NULL || - prison_check_ip4(td->td_ucred, &it->ia_addr.sin_addr) == 0)) + if (deleteAny && ia == NULL && (cred == NULL || + prison_check_ip4(cred, &it->ia_addr.sin_addr) == 0)) ia = it; if (it->ia_addr.sin_addr.s_addr == addr->sin_addr.s_addr && - (td == NULL || prison_check_ip4(td->td_ucred, + (cred == NULL || prison_check_ip4(cred, &addr->sin_addr) == 0)) ia = it; @@ -702,7 +704,7 @@ in_difaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, struct thread *td) } static int -in_gifaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, struct thread *td) +in_gifaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, struct ucred *cred) { struct in_aliasreq *ifra = (struct in_aliasreq *)data; const struct sockaddr_in *addr = &ifra->ifra_addr; @@ -730,7 +732,7 @@ in_gifaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, struct thread *td) it = (struct in_ifaddr *)ifa; if (it->ia_addr.sin_addr.s_addr == addr->sin_addr.s_addr && - prison_check_ip4(td->td_ucred, &addr->sin_addr) == 0) { + prison_check_ip4(cred, &addr->sin_addr) == 0) { ia = it; break; }