Date: Mon, 20 Jun 2011 23:04:13 +0000 (UTC) From: Jamie Gritton <jamie@FreeBSD.org> To: src-committers@freebsd.org, svn-src-projects@freebsd.org Subject: svn commit: r223351 - projects/jailconf/usr.sbin/jail Message-ID: <201106202304.p5KN4Dow069484@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: jamie Date: Mon Jun 20 23:04:13 2011 New Revision: 223351 URL: http://svn.freebsd.org/changeset/base/223351 Log: Following r222465: Check for IPv4 or IPv6 to be available by the kernel to not provoke errors trying to query options not available. Make it possible to compile out INET or INET6 only parts. Modified: projects/jailconf/usr.sbin/jail/Makefile projects/jailconf/usr.sbin/jail/command.c projects/jailconf/usr.sbin/jail/config.c projects/jailconf/usr.sbin/jail/jail.c projects/jailconf/usr.sbin/jail/jailp.h Modified: projects/jailconf/usr.sbin/jail/Makefile ============================================================================== --- projects/jailconf/usr.sbin/jail/Makefile Mon Jun 20 22:59:29 2011 (r223350) +++ projects/jailconf/usr.sbin/jail/Makefile Mon Jun 20 23:04:13 2011 (r223351) @@ -15,6 +15,9 @@ CFLAGS+=-I. -I${.CURDIR} .if ${MK_INET6_SUPPORT} != "no" CFLAGS+= -DINET6 .endif +.if ${MK_INET_SUPPORT} != "no" +CFLAGS+= -DINET +.endif CLEANFILES= y.output Modified: projects/jailconf/usr.sbin/jail/command.c ============================================================================== --- projects/jailconf/usr.sbin/jail/command.c Mon Jun 20 22:59:29 2011 (r223350) +++ projects/jailconf/usr.sbin/jail/command.c Mon Jun 20 23:04:13 2011 (r223351) @@ -247,12 +247,15 @@ run_command(struct cfjail *j) const struct cfstring *comstring, *s; login_cap_t *lcap; char **argv; - char *cs, *addr, *comcs, *devpath; + char *cs, *comcs, *devpath; const char *jidstr, *conslog, *path, *ruleset, *term, *username; enum intparam comparam; size_t comlen; pid_t pid; int argc, bg, clean, consfd, down, fib, i, injail, sjuser, timeout; +#if defined(INET) || defined(INET6) + char *addr; +#endif static char *cleanenv; @@ -295,6 +298,7 @@ run_command(struct cfjail *j) comstring = j->comstring; bg = 0; switch (comparam) { +#ifdef INET case IP__IP4_IFADDR: argv = alloca(8 * sizeof(char *)); *(const char **)&argv[0] = _PATH_IFCONFIG; @@ -326,6 +330,7 @@ run_command(struct cfjail *j) *(const char **)&argv[argc] = down ? "-alias" : "alias"; argv[argc + 1] = NULL; break; +#endif #ifdef INET6 case IP__IP6_IFADDR: Modified: projects/jailconf/usr.sbin/jail/config.c ============================================================================== --- projects/jailconf/usr.sbin/jail/config.c Mon Jun 20 22:59:29 2011 (r223350) +++ projects/jailconf/usr.sbin/jail/config.c Mon Jun 20 23:04:13 2011 (r223351) @@ -40,6 +40,7 @@ __FBSDID("$FreeBSD$"); #include <stdio.h> #include <stdlib.h> #include <string.h> +#include <unistd.h> #include "jailp.h" @@ -74,15 +75,19 @@ static const struct ipspec intparams[] = PF_INTERNAL | PF_BOOL}, [IP_EXEC_SYSTEM_USER] = {"exec.system_user", PF_INTERNAL}, [IP_EXEC_TIMEOUT] = {"exec.timeout", PF_INTERNAL | PF_INT}, +#if defined(INET) || defined(INET6) [IP_INTERFACE] = {"interface", PF_INTERNAL}, [IP_IP_HOSTNAME] = {"ip_hostname", PF_INTERNAL | PF_BOOL}, +#endif [IP_MOUNT] = {"mount", PF_INTERNAL}, [IP_MOUNT_DEVFS] = {"mount.devfs", PF_INTERNAL | PF_BOOL}, [IP_MOUNT_DEVFS_RULESET]= {"mount.devfs.ruleset", PF_INTERNAL}, [IP_MOUNT_FSTAB] = {"mount.fstab", PF_INTERNAL}, [IP_STOP_TIMEOUT] = {"stop.timeout", PF_INTERNAL | PF_INT}, [IP_VNET_INTERFACE] = {"vnet.interface", PF_INTERNAL}, +#ifdef INET [IP__IP4_IFADDR] = {"ip4.addr", PF_INTERNAL | PF_CONV}, +#endif #ifdef INET6 [IP__IP6_IFADDR] = {"ip6.addr", PF_INTERNAL | PF_CONV}, #endif @@ -96,7 +101,9 @@ static const struct ipspec intparams[] = [KP_ALLOW_SYSVIPC] = {"allow.sysvipc", 0}, [KP_ENFORCE_STATFS] = {"enforce_statfs", 0}, [KP_HOST_HOSTNAME] = {"host.hostname", 0}, +#ifdef INET [KP_IP4_ADDR] = {"ip4.addr", 0}, +#endif #ifdef INET6 [KP_IP6_ADDR] = {"ip6.addr", 0}, #endif @@ -427,21 +434,27 @@ string_param(const struct cfparam *p) int check_intparams(struct cfjail *j) { - struct in_addr addr4; - struct addrinfo hints; - struct addrinfo *ai0, *ai; struct cfparam *p; struct cfstring *s; FILE *f; - const char *hostname, *val; + const char *val; char *cs, *ep, *ln; - size_t size, lnlen; - int error, gicode, ip4ok, defif, prefix; - int mib[4]; + size_t lnlen; + int error; +#if defined(INET) || defined(INET6) + struct addrinfo hints; + struct addrinfo *ai0, *ai; + const char *hostname; + int gicode, defif, prefix; +#endif +#ifdef INET + struct in_addr addr4; + int ip4ok; char avalue4[INET_ADDRSTRLEN]; +#endif #ifdef INET6 struct in6_addr addr6; - int ip6ok, isip6; + int ip6ok; char avalue6[INET6_ADDRSTRLEN]; #endif @@ -471,6 +484,7 @@ check_intparams(struct cfjail *j) } } +#if defined(INET) || defined(INET6) /* * The ip_hostname parameter looks up the hostname, and adds parameters * for any IP addresses it finds. @@ -484,27 +498,32 @@ check_intparams(struct cfjail *j) * Silently ignore unsupported address families from * DNS lookups. */ - size = 4; - ip4ok = sysctlnametomib("security.jail.param.ip4", mib, &size) - == 0; -#ifdef INET6 - size = 4; - ip6ok = sysctlnametomib("security.jail.param.ip6", mib, &size) - == 0; +#ifdef INET + ip4ok = feature_present("inet"); #endif - if (ip4ok #ifdef INET6 - || ip6ok + ip6ok = feature_present("inet6"); +#endif + if ( +#if defined(INET) && defined(INET6) + ip4ok || ip6ok +#elif defined(INET) + ip4ok +#elif defined(INET6) + ip6ok #endif - ) { + ) { /* Look up the hostname (or get the address) */ memset(&hints, 0, sizeof(hints)); hints.ai_socktype = SOCK_STREAM; hints.ai_family = -#ifdef INET6 - ip6ok ? (ip4ok ? PF_UNSPEC : PF_INET6) : -#endif +#if defined(INET) && defined(INET6) + ip4ok ? (ip6ok ? PF_UNSPEC : PF_INET) : PF_INET6; +#elif defined(INET) PF_INET; +#elif defined(INET6) + PF_INET6; +#endif gicode = getaddrinfo(hostname, NULL, &hints, &ai0); if (gicode != 0) { jail_warnx(j, "host.hostname %s: %s", hostname, @@ -518,6 +537,7 @@ check_intparams(struct cfjail *j) */ for (ai = ai0; ai; ai = ai->ai_next) switch (ai->ai_family) { +#ifdef INET case AF_INET: memcpy(&addr4, &((struct sockaddr_in *) @@ -530,6 +550,7 @@ check_intparams(struct cfjail *j) add_param(j, NULL, KP_IP4_ADDR, avalue4); break; +#endif #ifdef INET6 case AF_INET6: memcpy(&addr6, @@ -555,43 +576,46 @@ check_intparams(struct cfjail *j) * and a netmask/suffix for that address. */ defif = string_param(j->intparams[IP_INTERFACE]) != NULL; -#ifdef INET6 - for (isip6 = 0; isip6 <= 1; isip6++) -#else -#define isip6 0 - do -#endif - { - if (j->intparams[KP_IP4_ADDR + isip6] == NULL) - continue; - TAILQ_FOREACH(s, &j->intparams[KP_IP4_ADDR + isip6]->val, tq) { +#ifdef INET + if (j->intparams[KP_IP4_ADDR] != NULL) { + TAILQ_FOREACH(s, &j->intparams[KP_IP4_ADDR]->val, tq) { cs = strchr(s->s, '|'); if (cs || defif) - add_param(j, NULL, IP__IP4_IFADDR + isip6, - s->s); + add_param(j, NULL, IP__IP4_IFADDR, s->s); if (cs) { strcpy(s->s, cs + 1); s->len -= cs + 1 - s->s; } if ((cs = strchr(s->s, '/'))) { prefix = strtol(cs + 1, &ep, 10); - if ( -#ifdef INET6 - !isip6 && -#endif - *ep == '.' + if (*ep == '.' ? inet_pton(AF_INET, cs + 1, &addr4) != 1 - : *ep || prefix < 0 || prefix > ( -#ifdef INET6 - isip6 ? 128 : -#endif - 32)) { + : *ep || prefix < 0 || prefix > 32) { jail_warnx(j, -#ifdef INET6 - isip6 - ? "ip6.addr: bad prefixlen \"%s\"" : + "ip4.addr: bad netmask \"%s\"", cs); + error = -1; + } + *cs = '\0'; + s->len = cs - s->s + 1; + } + } + } #endif - "ip4.addr: bad netmask \"%s\"", +#ifdef INET6 + if (j->intparams[KP_IP6_ADDR] != NULL) { + TAILQ_FOREACH(s, &j->intparams[KP_IP6_ADDR]->val, tq) { + cs = strchr(s->s, '|'); + if (cs || defif) + add_param(j, NULL, IP__IP6_IFADDR, s->s); + if (cs) { + strcpy(s->s, cs + 1); + s->len -= cs + 1 - s->s; + } + if ((cs = strchr(s->s, '/'))) { + prefix = strtol(cs + 1, &ep, 10); + if (*ep || prefix < 0 || prefix > 128) { + jail_warnx(j, + "ip6.addr: bad prefixlen \"%s\"", cs); error = -1; } @@ -600,8 +624,7 @@ check_intparams(struct cfjail *j) } } } -#ifndef INET6 - while (0); +#endif #endif /* Modified: projects/jailconf/usr.sbin/jail/jail.c ============================================================================== --- projects/jailconf/usr.sbin/jail/jail.c Mon Jun 20 22:59:29 2011 (r223350) +++ projects/jailconf/usr.sbin/jail/jail.c Mon Jun 20 23:04:13 2011 (r223351) @@ -80,7 +80,9 @@ static struct permspec perm_sysctl[] = { static const enum intparam startcommands[] = { 0, +#ifdef INET IP__IP4_IFADDR, +#endif #ifdef INET6 IP__IP6_IFADDR, #endif @@ -109,25 +111,30 @@ static const enum intparam stopcommands[ #ifdef INET6 IP__IP6_IFADDR, #endif +#ifdef INET IP__IP4_IFADDR, +#endif 0 }; int main(int argc, char **argv) { -#ifdef INET6 - struct in6_addr addr6; -#endif struct stat st; FILE *jfp; struct cfjail *j; - char *cs, *ncs, *JidFile; + char *JidFile; size_t sysvallen; unsigned op, pi; int ch, docf, error, i, oldcl, sysval; int dflag, iflag, Rflag; char enforce_statfs[4]; +#if defined(INET) || defined(INET6) + char *cs, *ncs; +#endif +#if defined(INET) && defined(INET6) + struct in6_addr addr6; +#endif op = 0; dflag = iflag = Rflag = 0; @@ -147,7 +154,9 @@ main(int argc, char **argv) cfname = optarg; break; case 'h': +#if defined(INET) || defined(INET6) add_param(NULL, NULL, IP_IP_HOSTNAME, NULL); +#endif docf = 0; break; case 'i': @@ -219,21 +228,27 @@ main(int argc, char **argv) oldcl = 1; add_param(NULL, NULL, KP_PATH, argv[0]); add_param(NULL, NULL, KP_HOST_HOSTNAME, argv[1]); +#if defined(INET) || defined(INET6) if (argv[2][0] != '\0') { for (cs = argv[2];; cs = ncs + 1) { ncs = strchr(cs, ','); if (ncs) *ncs = '\0'; add_param(NULL, NULL, -#ifdef INET6 +#if defined(INET) && defined(INET6) inet_pton(AF_INET6, cs, &addr6) == 1 - ? KP_IP6_ADDR : + ? KP_IP6_ADDR : KP_IP4_ADDR, +#elif defined(INET) + KP_IP4_ADDR, +#elif defined(INET6) + KP_IP6_ADDR, #endif - KP_IP4_ADDR, cs); + cs); if (!ncs) break; } } +#endif for (i = 3; i < argc; i++) add_param(NULL, NULL, IP_COMMAND, argv[i]); /* Emulate the defaults from security.jail.* sysctls. */ @@ -866,15 +881,18 @@ print_jail(FILE *fp, struct cfjail *j, i putc('\t', fp); print_param(fp, j->intparams[KP_HOST_HOSTNAME], ',', 0); putc('\t', fp); +#ifdef INET print_param(fp, j->intparams[KP_IP4_ADDR], ',', 0); #ifdef INET6 - if (j->intparams[KP_IP6_ADDR] && - !TAILQ_EMPTY(&j->intparams[KP_IP6_ADDR]->val)) { - if (j->intparams[KP_IP4_ADDR] && - !TAILQ_EMPTY(&j->intparams[KP_IP4_ADDR]->val)) - putc(',', fp); - print_param(fp, j->intparams[KP_IP6_ADDR], ',', 0); - } + if (j->intparams[KP_IP4_ADDR] && + !TAILQ_EMPTY(&j->intparams[KP_IP4_ADDR]->val) && + j->intparams[KP_IP6_ADDR] && + !TAILQ_EMPTY(&j->intparams[KP_IP6_ADDR]->val)) + putc(',', fp); +#endif +#endif +#ifdef INET6 + print_param(fp, j->intparams[KP_IP6_ADDR], ',', 0); #endif putc('\t', fp); print_param(fp, j->intparams[IP_COMMAND], ' ', 0); Modified: projects/jailconf/usr.sbin/jail/jailp.h ============================================================================== --- projects/jailconf/usr.sbin/jail/jailp.h Mon Jun 20 22:59:29 2011 (r223350) +++ projects/jailconf/usr.sbin/jail/jailp.h Mon Jun 20 23:04:13 2011 (r223351) @@ -87,15 +87,19 @@ enum intparam { IP_EXEC_SYSTEM_JAIL_USER,/* Get jail_user from system passwd file */ IP_EXEC_SYSTEM_USER, /* Run non-jailed commands as this user */ IP_EXEC_TIMEOUT, /* Time to wait for a command to complete */ +#if defined(INET) || defined(INET6) IP_INTERFACE, /* Add IP addresses to this interface */ IP_IP_HOSTNAME, /* Get jail IP address(es) from hostname */ +#endif IP_MOUNT, /* Mount points in fstab(5) form */ IP_MOUNT_DEVFS, /* Mount /dev under prison root */ IP_MOUNT_DEVFS_RULESET, /* Ruleset for the devfs mount */ IP_MOUNT_FSTAB, /* A standard fstab(5) file */ IP_STOP_TIMEOUT, /* Time to wait after sending SIGTERM */ IP_VNET_INTERFACE, /* Assign interface(s) to vnet jail */ +#ifdef INET IP__IP4_IFADDR, /* Copy of ip4.addr with interface/netmask */ +#endif #ifdef INET6 IP__IP6_IFADDR, /* Copy of ip6.addr with interface/prefixlen */ #endif @@ -109,7 +113,9 @@ enum intparam { KP_ALLOW_SYSVIPC, KP_ENFORCE_STATFS, KP_HOST_HOSTNAME, +#ifdef INET KP_IP4_ADDR, +#endif #ifdef INET6 KP_IP6_ADDR, #endif
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201106202304.p5KN4Dow069484>