The unlisted sysctl net.inet.tcp.hostcache.list allows a jail to see what hosts the host system and other jails have connections to.
Not even compile tested but if someone could make sure it does the right thing, that would be great: (1) base system should always continue to work as-is. (2) a classic jail should get an "operation not permitted" back on attempting to read. (3) for VIMAGE kernels, base system see (1), classic jail see (2), and a vnet jail should not change either. Index: tcp_hostcache.c =================================================================== --- tcp_hostcache.c (revision 283272) +++ tcp_hostcache.c (working copy) @@ -69,6 +69,7 @@ __FBSDID("$FreeBSD$"); #include <sys/param.h> #include <sys/systm.h> +#include <sys/jail.h> #include <sys/kernel.h> #include <sys/lock.h> #include <sys/mutex.h> @@ -608,6 +609,9 @@ sysctl_tcp_hc_list(SYSCTL_HANDLER_ARGS) char ip6buf[INET6_ADDRSTRLEN]; #endif + if (jailed_without_vnet(curthread->td_cred) != 0) + return (EPERM); + sbuf_new(&sb, NULL, linesize * (V_tcp_hostcache.cache_count + 1), SBUF_INCLUDENUL);
/usr/src/sys/netinet/tcp_hostcache.c:612:35: error: incomplete definition of type 'struct thread' if (jailed_without_vnet(curthread->td_cred) != 0) ~~~~~~~~~^ /usr/src/sys/sys/systm.h:165:8: note: forward declaration of 'struct thread' struct thread; ^ 1 error generated.
I think you also need to include sys/pcpu.h to get curthread definition. Can you try the patch with it and see if it does the right thing?
diff --git a/sys/netinet/tcp_hostcache.c b/sys/netinet/tcp_hostcache.c index bb2efda..8b1aab5 100644 --- a/sys/netinet/tcp_hostcache.c +++ b/sys/netinet/tcp_hostcache.c @@ -69,10 +69,12 @@ __FBSDID("$FreeBSD$"); #include <sys/param.h> #include <sys/systm.h> +#include <sys/jail.h> #include <sys/kernel.h> #include <sys/lock.h> #include <sys/mutex.h> #include <sys/malloc.h> +#include <sys/pcpu.h> #include <sys/sbuf.h> #include <sys/socket.h> #include <sys/socketvar.h> @@ -625,6 +627,9 @@ sysctl_tcp_hc_list(SYSCTL_HANDLER_ARGS) char ip6buf[INET6_ADDRSTRLEN]; #endif + if (jailed_without_vnet(curthread->td_cred) != 0) + return (EPERM); + sbuf_new(&sb, NULL, linesize * (V_tcp_hostcache.cache_count + 1), SBUF_INCLUDENUL); This compiles if anyone wants to test before I can get to it.
(In reply to Hiren Panchasara from comment #4) diff --git a/sys/netinet/tcp_hostcache.c b/sys/netinet/tcp_hostcache.c index bb2efda..d27f2b5 100644 --- a/sys/netinet/tcp_hostcache.c +++ b/sys/netinet/tcp_hostcache.c @@ -69,10 +69,12 @@ __FBSDID("$FreeBSD$"); #include <sys/param.h> #include <sys/systm.h> +#include <sys/jail.h> #include <sys/kernel.h> #include <sys/lock.h> #include <sys/mutex.h> #include <sys/malloc.h> +#include <sys/proc.h> #include <sys/sbuf.h> #include <sys/socket.h> #include <sys/socketvar.h> @@ -625,6 +627,9 @@ sysctl_tcp_hc_list(SYSCTL_HANDLER_ARGS) char ip6buf[INET6_ADDRSTRLEN]; #endif + if (jailed_without_vnet(curthread->td_ucred) != 0) + return (EPERM); + sbuf_new(&sb, NULL, linesize * (V_tcp_hostcache.cache_count + 1), SBUF_INCLUDENUL); Correct version that compiles.
(In reply to Hiren Panchasara from comment #4) Sure Hiren. Will test this diff. Thanks, Lohith
Verified the latest DIFF from hiren. Works as expected. Verified on 10.3-RELEASE. Thanks, Lohith
Verified the same on 12-CURRENT based jails. It works as expected. -Lohith
Thanks Lohith for testing. I've created a review https://reviews.freebsd.org/D9047
A commit references this bug: Author: hiren Date: Thu Jan 5 17:22:09 UTC 2017 New revision: 311453 URL: https://svnweb.freebsd.org/changeset/base/311453 Log: sysctl net.inet.tcp.hostcache.list in a jail can see connections from other jails and the host. This commit fixes it. PR: 200361 Submitted by: bz (original version), hiren (minor corrections) Reported by: Marcus Reid <marcus at blazingdot dot com> Reviewed by: bz, gnn Tested by: Lohith Bellad <lohithbsd at gmail dot com> MFC after: 1 week Sponsored by: Limelight Networks (minor corrections) Changes: head/sys/netinet/tcp_hostcache.c
A commit references this bug: Author: hiren Date: Thu Jan 12 00:50:38 UTC 2017 New revision: 311955 URL: https://svnweb.freebsd.org/changeset/base/311955 Log: MFC r311453 sysctl net.inet.tcp.hostcache.list in a jail can see connections from other jails and the host. This commit fixes it. PR: 200361 Changes: _U stable/11/ stable/11/sys/netinet/tcp_hostcache.c