Deleted Added
sdiff udiff text old ( 173578 ) new ( 173679 )
full compact
priv_netinet_ipsec.c (173578) priv_netinet_ipsec.c (173679)
1/*-
2 * Copyright (c) 2007 Bjoern A. Zeeb
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright

--- 9 unchanged lines hidden (view full) ---

18 * INC., OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
19 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
20 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
21 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
22 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
23 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
24 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 *
1/*-
2 * Copyright (c) 2007 Bjoern A. Zeeb
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright

--- 9 unchanged lines hidden (view full) ---

18 * INC., OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
19 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
20 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
21 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
22 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
23 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
24 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 *
26 * $FreeBSD: head/tools/regression/priv/priv_netinet_ipsec.c 173578 2007-11-13 08:59:29Z bz $
26 * $FreeBSD: head/tools/regression/priv/priv_netinet_ipsec.c 173679 2007-11-16 21:24:45Z bz $
27 */
28
29/*
30 * Confirm that privilege is required to open a pfkey socket, and that this
31 * is not allowed in jail.
32 */
33
34#include <sys/types.h>
35#include <sys/socket.h>
36#include <net/pfkeyv2.h>
27 */
28
29/*
30 * Confirm that privilege is required to open a pfkey socket, and that this
31 * is not allowed in jail.
32 */
33
34#include <sys/types.h>
35#include <sys/socket.h>
36#include <net/pfkeyv2.h>
37#include <netinet/in.h>
38#include <netipsec/ipsec.h>
37
39
40#include <err.h>
38#include <errno.h>
41#include <errno.h>
42#include <stdlib.h>
39#include <unistd.h>
40
41#include "main.h"
42
43#include <unistd.h>
44
45#include "main.h"
46
47static char policy_bypass[] = "in bypass";
48static char policy_entrust[] = "in entrust";
49static char *bypassbuf = NULL;
50static char *entrustbuf = NULL;
51static int sd = -1;
52
53
54static int
55priv_netinet_ipsec_policy_bypass_setup_af(int asroot, int injail,
56 struct test *test, int af)
57{
58
59 bypassbuf = ipsec_set_policy(policy_bypass, sizeof(policy_bypass) - 1);
60 if (bypassbuf == NULL) {
61 warn("%s: ipsec_set_policy(NULL)", __func__);
62 return (-1);
63 }
64 switch (af) {
65 case AF_INET:
66 sd = socket(AF_INET, SOCK_DGRAM, 0);
67 if (sd < 0) {
68 warn("%s: socket4", __func__);
69 return (-1);
70 }
71 break;
72 case AF_INET6:
73 sd = socket(AF_INET6, SOCK_DGRAM, 0);
74 if (sd < 0) {
75 warn("%s: socket6", __func__);
76 return (-1);
77 }
78 break;
79 default:
80 warnx("%s: unexpected address family", __func__);
81 return (-1);
82 }
83 return (0);
84}
85
43int
86int
44priv_netinet_ipsec_pfkey_setup(int asroot, int injail, struct test *test)
87priv_netinet_ipsec_policy4_bypass_setup(int asroot, int injail,
88 struct test *test)
45{
46
89{
90
91 return (priv_netinet_ipsec_policy_bypass_setup_af(asroot, injail, test,
92 AF_INET));
93}
94
95int
96priv_netinet_ipsec_policy6_bypass_setup(int asroot, int injail,
97 struct test *test)
98{
99
100 return (priv_netinet_ipsec_policy_bypass_setup_af(asroot, injail, test,
101 AF_INET6));
102}
103
104
105
106static int
107priv_netinet_ipsec_policy_entrust_setup_af(int asroot, int injail,
108 struct test *test, int af)
109{
110
111 entrustbuf = ipsec_set_policy(policy_entrust, sizeof(policy_entrust)-1);
112 if (entrustbuf == NULL) {
113 warn("%s: ipsec_set_policy(NULL)", __func__);
114 return (-1);
115 }
116 switch (af) {
117 case AF_INET:
118 sd = socket(AF_INET, SOCK_DGRAM, 0);
119 if (sd < 0) {
120 warn("%s: socket4", __func__);
121 return (-1);
122 }
123 break;
124 case AF_INET6:
125 sd = socket(AF_INET6, SOCK_DGRAM, 0);
126 if (sd < 0) {
127 warn("%s: socket6", __func__);
128 return (-1);
129 }
130 break;
131 default:
132 warnx("%s: unexpected address family", __func__);
133 return (-1);
134 }
47 return (0);
48}
49
135 return (0);
136}
137
138int
139priv_netinet_ipsec_policy4_entrust_setup(int asroot, int injail,
140 struct test *test)
141{
142
143 return (priv_netinet_ipsec_policy_entrust_setup_af(asroot, injail, test,
144 AF_INET));
145}
146
147int
148priv_netinet_ipsec_policy6_entrust_setup(int asroot, int injail,
149 struct test *test)
150{
151
152 return (priv_netinet_ipsec_policy_entrust_setup_af(asroot, injail, test,
153 AF_INET6));
154}
155
156
50void
51priv_netinet_ipsec_pfkey(int asroot, int injail, struct test *test)
52{
53 int error, fd;
54
55 fd = socket(PF_KEY, SOCK_RAW, PF_KEY_V2);
56 if (fd < 0)
57 error = -1;

--- 14 unchanged lines hidden (view full) ---

72 -1, EPROTONOSUPPORT);
73 if (!asroot && !injail)
74 expect("priv_netinet_ipsec_pfkey(!asroot, !injail)", error,
75 -1, EPERM);
76 if (fd >= 0)
77 (void)close(fd);
78}
79
157void
158priv_netinet_ipsec_pfkey(int asroot, int injail, struct test *test)
159{
160 int error, fd;
161
162 fd = socket(PF_KEY, SOCK_RAW, PF_KEY_V2);
163 if (fd < 0)
164 error = -1;

--- 14 unchanged lines hidden (view full) ---

179 -1, EPROTONOSUPPORT);
180 if (!asroot && !injail)
181 expect("priv_netinet_ipsec_pfkey(!asroot, !injail)", error,
182 -1, EPERM);
183 if (fd >= 0)
184 (void)close(fd);
185}
186
187
188static void
189priv_netinet_ipsec_policy_bypass_af(int asroot, int injail, struct test *test,
190 int af)
191{
192 int error, level, optname;
193
194 switch (af) {
195 case AF_INET:
196 level = IPPROTO_IP;
197 optname = IP_IPSEC_POLICY;
198 break;
199 case AF_INET6:
200 level = IPPROTO_IPV6;
201 optname = IPV6_IPSEC_POLICY;
202 break;
203 default:
204 warnx("%s: unexpected address family", __func__);
205 return;
206 }
207 error = setsockopt(sd, level, optname,
208 bypassbuf, ipsec_get_policylen(bypassbuf));
209 if (asroot && injail)
210 expect("priv_netinet_ipsec_policy_bypass(asroot, injail)",
211 error, -1, EACCES); /* see ipsec_set_policy */
212 if (asroot && !injail)
213 expect("priv_netinet_ipsec_policy_bypass(asroot, !injail)",
214 error, 0, 0);
215 if (!asroot && injail)
216 expect("priv_netinet_ipsec_policy_bypass(!asroot, injail)",
217 error, -1, EACCES); /* see ipsec_set_policy */
218 if (!asroot && !injail)
219 expect("priv_netinet_ipsec_policy_bypass(!asroot, !injail)",
220 error, -1, EACCES); /* see ipsec_set_policy */
221}
222
80void
223void
81priv_netinet_ipsec_pfkey_cleanup(int asroot, int injail, struct test *test)
224priv_netinet_ipsec_policy4_bypass(int asroot, int injail, struct test *test)
82{
83
225{
226
227 priv_netinet_ipsec_policy_bypass_af(asroot, injail, test, AF_INET);
84}
85
228}
229
230void
231priv_netinet_ipsec_policy6_bypass(int asroot, int injail, struct test *test)
232{
233
234 priv_netinet_ipsec_policy_bypass_af(asroot, injail, test, AF_INET6);
235}
236
237
238static void
239priv_netinet_ipsec_policy_entrust_af(int asroot, int injail, struct test *test,
240 int af)
241{
242 int error, level, optname;
243
244 switch (af) {
245 case AF_INET:
246 level = IPPROTO_IP;
247 optname = IP_IPSEC_POLICY;
248 break;
249 case AF_INET6:
250 level = IPPROTO_IPV6;
251 optname = IPV6_IPSEC_POLICY;
252 break;
253 default:
254 warnx("%s: unexpected address family", __func__);
255 return;
256 }
257 error = setsockopt(sd, level, optname,
258 entrustbuf, ipsec_get_policylen(entrustbuf));
259 if (asroot && injail)
260 expect("priv_netinet_ipsec_policy_entrust(asroot, injail)",
261 error, 0, 0); /* XXX ipsec_set_policy */
262 if (asroot && !injail)
263 expect("priv_netinet_ipsec_policy_entrust(asroot, !injail)",
264 error, 0, 0);
265 if (!asroot && injail)
266 expect("priv_netinet_ipsec_policy_entrust(!asroot, injail)",
267 error, 0, 0); /* XXX ipsec_set_policy */
268 if (!asroot && !injail)
269 expect("priv_netinet_ipsec_policy_entrust(!asroot, !injail)",
270 error, 0, 0); /* XXX ipsec_set_policy */
271}
272
273void
274priv_netinet_ipsec_policy4_entrust(int asroot, int injail, struct test *test)
275{
276
277 priv_netinet_ipsec_policy_entrust_af(asroot, injail, test, AF_INET);
278}
279
280void
281priv_netinet_ipsec_policy6_entrust(int asroot, int injail, struct test *test)
282{
283
284 priv_netinet_ipsec_policy_entrust_af(asroot, injail, test, AF_INET6);
285}
286
287
288void
289priv_netinet_ipsec_policy_bypass_cleanup(int asroot, int injail,
290 struct test *test)
291{
292
293 if (bypassbuf != NULL) {
294 free(bypassbuf);
295 bypassbuf = NULL;
296 }
297 if (sd >= 0) {
298 close(sd);
299 sd = -1;
300 }
301}
302
303void
304priv_netinet_ipsec_policy_entrust_cleanup(int asroot, int injail,
305 struct test *test)
306{
307
308 if (entrustbuf != NULL) {
309 free(entrustbuf);
310 entrustbuf = NULL;
311 }
312 if (sd >= 0) {
313 close(sd);
314 sd = -1;
315 }
316}
317