Poul/group The following patch makes raw sockets comply with prison IP addresses. Some tools such as traceroute(8) may require that the prison IP address be specified on the command line. I.E. traceroute -s <prison ip> <dest address> Otherwise it might fail. (because of this we may want to get rid of the create_raw_sockets MIB all together). Anyway, take a gander at it (testers feedback welcome): Regards Christian S.J. Peron --- sys/netinet/raw_ip.c.b Mon Apr 19 16:23:57 2004 +++ sys/netinet/raw_ip.c Tue Apr 20 19:43:30 2004 @@ -40,6 +40,7 @@ #include "opt_random_ip_id.h" #include <sys/param.h> +#include <sys/jail.h> #include <sys/kernel.h> #include <sys/lock.h> #include <sys/mac.h> @@ -215,6 +216,11 @@ if (inp->inp_faddr.s_addr && inp->inp_faddr.s_addr != ip->ip_src.s_addr) goto docontinue; + if (inp->inp_socket->so_cred->cr_prison) { + if (htonl(inp->inp_socket->so_cred->cr_prison->pr_ip) + != ip->ip_dst.s_addr) + goto docontinue; + } if (last) { struct mbuf *n; @@ -270,7 +276,11 @@ ip->ip_off = 0; ip->ip_p = inp->inp_ip_p; ip->ip_len = m->m_pkthdr.len; - ip->ip_src = inp->inp_laddr; + if (inp->inp_socket->so_cred->cr_prison) + ip->ip_src.s_addr = + htonl(inp->inp_socket->so_cred->cr_prison->pr_ip); + else + ip->ip_src = inp->inp_laddr; ip->ip_dst.s_addr = dst; ip->ip_ttl = inp->inp_ip_ttl; } else { @@ -279,6 +289,13 @@ return(EMSGSIZE); } ip = mtod(m, struct ip *); + if (inp->inp_socket->so_cred->cr_prison) { + if (ip->ip_src.s_addr != + htonl(inp->inp_socket->so_cred->cr_prison->pr_ip)) { + m_freem(m); + return (EPERM); + } + } /* don't allow both user specified and setsockopt options, and don't allow packet length sizes that will crash */ if (((ip->ip_hl != (sizeof (*ip) >> 2)) @@ -505,6 +522,7 @@ } } +extern int jail_allow_raw_sockets; u_long rip_sendspace = RIPSNDQ; u_long rip_recvspace = RIPRCVQ; @@ -527,7 +545,11 @@ INP_INFO_WUNLOCK(&ripcbinfo); return EINVAL; } - if (td && (error = suser(td)) != 0) { + if (td && jailed(td->td_ucred) && !jail_allow_raw_sockets) { + INP_INFO_WUNLOCK(&ripcbinfo); + return (EPERM); + } + if (td && (error = suser_cred(td->td_ucred, PRISON_ROOT)) != 0) { INP_INFO_WUNLOCK(&ripcbinfo); return error; } @@ -626,6 +648,11 @@ if (nam->sa_len != sizeof(*addr)) return EINVAL; + + if (td->td_ucred->cr_prison) + if (htonl(td->td_ucred->cr_prison->pr_ip) + != addr->sin_addr.s_addr) + return (EADDRNOTAVAIL); if (TAILQ_EMPTY(&ifnet) || (addr->sin_family != AF_INET && addr->sin_family != AF_IMPLINK) || --- sys/kern/kern_jail.c.bak Mon Apr 19 16:55:40 2004 +++ sys/kern/kern_jail.c Mon Apr 19 17:56:03 2004 @@ -53,6 +53,11 @@ &jail_sysvipc_allowed, 0, "Processes in jail can use System V IPC primitives"); +int jail_allow_raw_sockets = 0; +SYSCTL_INT(_security_jail, OID_AUTO, allow_raw_sockets, CTLFLAG_RW, + &jail_allow_raw_sockets, 0, + "Prison root can create raw sockets"); + /* allprison, lastprid, and prisoncount are protected by allprison_mtx. */ struct prisonlist allprison; struct mtx allprison_mtx; On 20 Apr 2004 Poul-Henning Kamp wrote: > In message <[email protected]>, "Christian S.J. Peron" w > rites: > > > > Although RAW sockets can be used when specifying the source > > address of packets (defeating one of the aspects of the jail) > > some people may find it usefull to use utilities like ping(8) > > or traceroute(8) from inside jails. > > > > Enclosed is a patch I have written which gives you the option > > of allowing prison-root to create raw sockets inside the prison, > > so that programs various network debugging programs like ping > > and traceroute etc can be used. > > > > This patch will create the security.jail.allow_raw_sockets sysctl > > MIB. I would appriciate any feed-back from testers > > > > See PR #: > > http://www.freebsd.org/cgi/query-pr.cgi?pr=65800 > > Could you take a peek and see how hard it would be to enforce source-IP > compliance with the jail restriction ? > > -- > Poul-Henning Kamp | UNIX since Zilog Zeus 3.20 > [email protected] | TCP/IP since RFC 956 > FreeBSD committer | BSD since 4.3-tahoe > Never attribute to malice what can adequately be explained by incompetence. > _______________________________________________ > [email protected] mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "[email protected]" _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "[email protected]"