Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 8 Apr 2008 12:19:07 +0100 (BST)
From:      Robert Watson <rwatson@FreeBSD.org>
To:        Yar Tikhiy <yar@comp.chem.msu.su>
Cc:        freebsd-net@freebsd.org, luigi@freebsd.org, oleg@freebsd.org
Subject:   Re: ipfw uid/gid to match listening TCP sockets?
Message-ID:  <20080408121535.D10870@fledge.watson.org>
In-Reply-To: <20080407081400.GA78448@dg.local>
References:  <20080407081400.GA78448@dg.local>

next in thread | previous in thread | raw e-mail | index | archive | help

On Mon, 7 Apr 2008, Yar Tikhiy wrote:

> Our ipfw currently doesn't seem to match this host's traffic by uid/gid if 
> the traffic goes to a listening TCP socket.  E.g., if one tries to allow 
> passive data connections to a local anonymous FTP server as follows, it 
> won't work:
>
> 	ipfw add 10000 allow tcp from any to me dst-port 49152-65535 uid ftp in keep-state
>
> This behaviour is obvious from ip_fw2.c:
>
>  2009          if (proto == IPPROTO_TCP) {
>  2010                  wildcard = 0;
>  2011                  pi = &tcbinfo;
>  2012          } else if (proto == IPPROTO_UDP) {
>  2013                  wildcard = INPLOOKUP_WILDCARD;
>  2014                  pi = &udbinfo;
>  2015          } else
>  2016                  return 0;
>
> I.e., it is OK for UDP to match PCBs (essentially sockets) with a wildcard 
> foreign (remote) address, but not for TCP.
>
> I wonder if there will be any security or whatever issues if the wildcard 
> flag is set for TCP, too.  The only peculiarity I can see now is that 
> listening sockets shouldn't generate outbound traffic; as soon a 3-way 
> handshake starts, a separate PCB is created.  Thus a listening socket can 
> match inbound packets only.
>
> Are there any other points I missed?  Thanks!

None of this code really makes very much sense anyway, and is vulnerable to a 
number of races and semantic inconsistencies, not to mention application 
behavior that confuses it (such as sshd's opening forwarded sockets using a 
privileged credential).  I'm not sure I agree with your analysis that listen 
sockets don't generate packets, btw: the syncache generates packets that are 
not yet from a specific socket, so arguably they are from the listen socket. 
All that said, I don't see any reason not to match listen sockets in the pcb 
lookup here.

Be aware that uid/gid/jail rules may become less maintainable as our TCP 
locking becomes more mature.  We already jump through some uncomfortable hoops 
to keep it working, but I'm not sure how long that can go on.

Robert N M Watson
Computer Laboratory
University of Cambridge



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20080408121535.D10870>