summaryrefslogtreecommitdiffstats
path: root/src/privsep-bpf.c
Commit message (Collapse)AuthorAge
* eloop: Make the API more like native poll/kqueue/epollRoy Marples2021-02-02
| | | | | | | | | Just have the one callback, but return an abstracted event mask to work out if we can read/write have something else. Log diagnostics if the event mask is unexpected. While here add more logging if we fail to register an event to monitor.
* A belated welcome to 2021Roy Marples2021-01-31
|
* privsep: Ensure BPF listener pid is logged in debugRoy Marples2021-01-27
| | | | This mirrors the inet listener.
* privsep: Don't log a BPF error that network is downRoy Marples2020-12-09
| | | | The master process will catch this clean remove the BPF process.
* privsep: Close BPF socket on ENXIO.Roy Marples2020-10-25
| | | | | This stops log spam if RTM_IFANNOUNCE is delayed for the departing interface.
* privsep: Ensure command is for BPF first and interface valid secondRoy Marples2020-10-09
| | | | Otherwise we won't call inet_dispatch on a message meant for it.
* privsep: Remove capsicum specific hooks from BPFRoy Marples2020-10-04
| | | | We no longer change the filter as it's locked if the OS supports.
* privsep: fix crash when interface departs before bpf returns for itRoy Marples2020-09-28
|
* FreeBSD: Fix buildRoy Marples2020-09-20
|
* privsep: Log if the platform sandbox is unavailable or availableRoy Marples2020-09-20
| | | | This is kinda important.
* privsep: Fold capsicum and pledge entry points into ps_entersandboxRoy Marples2020-09-19
|
* privsep: Only the master process accepts signalsRoy Marples2020-08-20
| | | | | The master process dictates when processes should stop, which allows for a clean shutdown when the admin issues `pkill dhcpcd`.
* privsep: Simplyfy signal handlingRoy Marples2020-06-16
| | | | | All privsep processes only need to act on SIGTERM. The privileged actioneer also needs to act on SIGCHLD.
* privsep: Don't handle any signals meant for the main processRoy Marples2020-06-16
| | | | Just incase someone issues a killall -HUP dhcpcd
* privsep: Log ECONNRESET errors againRoy Marples2020-06-04
| | | | Now that we've improved the robustness of the IPC this is important.
* Fix some memory issues with priorRoy Marples2020-05-24
|
* privsep: Pass BPF flags via ps_flagsRoy Marples2020-05-24
|
* privsep: Ensure we don't scribble garbage to BPFRoy Marples2020-05-20
| | | | | | Well, it's not garbage, it's a privsep IPC message telling us to start BPF which the BPF process should not have recieved! Add code to ensure this cannot happen.
* privsep: Add comment about BPF returing EPERM on OpenBSD.Roy Marples2020-05-20
| | | | Looks like an OpenBSD bug.
* privsep: No need for ipv4stateRoy Marples2020-05-19
|
* Fix compile on LinuxRoy Marples2020-05-19
|
* privsep: Enable Capsicum for all processes.Roy Marples2020-05-19
| | | | | | | | | | | | | | | | | Except for the priviledged process. This is quite an in-depth change: * ARP is now one process per address * BPF flags are now returned via privsep * BPF write filters are locked when supported * The root process sends to the network The last step is done by opening RAW sockets and then sending a UDP header (where applicable) to avoid binding to an address which is already in use by the reader sockets. This is slightly wasteful for OS's without sandboxing but does have the very nice side effect of not needing a source address to unicast DHCPs replies from which makes the code smaller.
* ARP: Remove ability to filter specific addressesRoy Marples2020-05-15
| | | | | | | | | | | | | | | This is only really needed for long lasting ARP, which is only used for IPv4 address defence. Modern NetBSD does not need this and it fails to work with OpenBSD Pledge. FreeBSD Capsicum is more secure without this as the BPF fd can then be locked for other changes [1]. That just leaves Linux and Solaris. If anyone feels dhcpcd is processing to much ARP then please implement RFC 5227 in the kernel like NetBSD. [1] Locking the BPF fd is questionable because the inet proxy using sendmsg can send any packet to any destination.
* BPF: Set write filters where supportedRoy Marples2020-05-15
| | | | | While here make Capsicum and Pledge more granular so we can easily Pledge the BPF BOOTP process but not the ARP one.
* privsep: Handle all file IO in the Priviledged ActioneerRoy Marples2020-05-12
| | | | | | | | | | This allows us to move the database directory back into the root of the filesystem. While here, harden the files by denying any user read access to them. As part of this change, init the DUID from any machine data and cache the default DHCP vendor field before dropping priviledges as we may lose access to this later.
* privsep: Implement pledge(2) support as found on OpenBSDRoy Marples2020-05-10
|
* privsep: Enable capsicum for network facing processesRoy Marples2020-05-07
| | | | | | | All fd's in network facing processes are fully limited. Capability mode is only enabled for BPF processes because it's too restrictive otherwise - the reasons are noted in the commit.
* privsep: Fix build without ARP supportRoy Marples2020-02-16
|
* spelling: Correct both privilege and separationRoy Marples2020-02-10
| | | | Found by Arfrever.
* DHCP: Support jumbo framesRoy Marples2020-02-05
| | | | | Also important as we now need to store the frame header in the initial buffer.
* ioctl: The POSIX signature differs from BSD and glibcRoy Marples2020-01-08
| | | | | | | | | | BSD and glibc have the signature for request as unsigned long. musl and Solaris have a signed int. As such, we need to detect this at compile time and adjust the signature of our internal ioctl functions to match. To keep the onwire format the same, memcpy the request to the unsigned long request and back again, thus preserving the signedness.
* Welcome to 2020!Roy Marples2020-01-03
|
* Refix assertation....Roy Marples2019-12-11
|
* privsep: Enable ARP BPF filtering for interesting addressesRoy Marples2019-12-10
| | | | | This brings parity with non privsep features. Aside from the lack of Solaris support, but that's another day.
* privsep: Fix an assertationRoy Marples2019-12-07
| | | | Found by LGTM bot.
* privsep: guard spawn debug messages behind PRIVSEP_DEBUGRoy Marples2019-11-29
|
* Solaris: start privsep supportRoy Marples2019-11-29
| | | | Compiles but lacks support for DLPI and ioctl needs rework.
* privsep: Add support for priviledge separationRoy Marples2019-11-28
Not enabled by default - enable with ./configure --enable-privsep Requires a user added to the system - default _dhcpcd Several processes will be spawned off the main state engine: a privileged actioneer and a generic network proxy. Only the privileged actioneer process will retain root permissions. When required, the privileged actioneer will also spawn BPF listeners for BOOTP (DHCP) and ARP. The BOOTP BPF listener should be a short lived process. On kernels with RFC 5227 support, the ARP BPF listener will only be used for ARPing and announcing a preferred address and will also be a short lived process. When not running in master mode, an address listener will be spawned for each address (with the exception of RA dervived addresses) dhcpcd cares about. TODO: * Solaris support. * ARP BPF address filtering.
generated by cgit v1.2.3 (git 2.25.1) at 2021-03-13 23:11:37 +0000