mac_ipacl.c

/*-
 * Copyright (c) 2003-2004 Networks Associates Technology, Inc.
 * Copyright (c) 2006 SPARTA, Inc.
 * Copyright (c) 2019, 2023 Shivank Garg <[email protected]>
 *
 * This software was developed for the FreeBSD Project by Network
 * Associates Laboratories, the Security Research Division of Network
 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
 * as part of the DARPA CHATS research program.
 *
 * This software was enhanced by SPARTA ISSO under SPAWAR contract
 * N66001-04-C-6019 ("SEFOS").
 *
 * This code was developed as a Google Summer of Code 2019 project
 * under the guidance of Bjoern A. Zeeb.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

/*
 * The IP address access control policy module - mac_ipacl allows the root of
 * the host to limit the VNET jail's privileges of setting IPv4 and IPv6
 * addresses via sysctl(8) interface. So, the host can define rules for jails
 * and their interfaces about IP addresses.
 * sysctl(8) is to be used to modify the rules string in following format-
 * "jail_id,allow,interface,address_family,IP_addr/prefix_length[@jail_id,...]"
 */

#include "opt_inet.h"
#include "opt_inet6.h"

#include <sys/param.h>
#include <sys/module.h>
#include <sys/errno.h>
#include <sys/kernel.h>
#include <sys/mutex.h>
#include <sys/priv.h>
#include <sys/queue.h>
#include <sys/socket.h>
#include <sys/sysctl.h>
#include <sys/systm.h>
#include <sys/types.h>
#include <sys/ucred.h>
#include <sys/jail.h>

#include <net/if.h>
#include <net/if_var.h>

#include <netinet/in.h>
#include <netinet6/scope6_var.h>

#include <security/mac/mac_policy.h>

static SYSCTL_NODE(_security_mac, OID_AUTO, ipacl, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
    "TrustedBSD mac_ipacl policy controls");

#ifdef INET
static int ipacl_ipv4 = 1;
SYSCTL_INT(_security_mac_ipacl, OID_AUTO, ipv4, CTLFLAG_RWTUN,
    &ipacl_ipv4, 0, "Enforce mac_ipacl for IPv4 addresses");
#endif

#ifdef INET6
static int ipacl_ipv6 = 1;
SYSCTL_INT(_security_mac_ipacl, OID_AUTO, ipv6, CTLFLAG_RWTUN,
    &ipacl_ipv6, 0, "Enforce mac_ipacl for IPv6 addresses");
#endif

static MALLOC_DEFINE(M_IPACL, "ipacl_rule", "Rules for mac_ipacl");

#define	MAC_RULE_STRING_LEN	1024

struct ipacl_addr {
	union {
#ifdef INET
		struct in_addr	ipv4;
#endif
#ifdef INET6
		struct in6_addr	ipv6;
#endif
		u_int8_t	addr8[16];
		u_int16_t	addr16[8];
		u_int32_t	addr32[4];
	} ipa; /* 128 bit address*/
#ifdef INET
#define v4	ipa.ipv4
#endif
#ifdef INET6
#define v6	ipa.ipv6
#endif
#define addr8	ipa.addr8
#define addr16	ipa.addr16
#define addr32	ipa.addr32
};

struct ip_rule {
	int			jid;
	bool			allow;
	bool			subnet_apply; /* Apply rule on whole subnet. */
	char			if_name[IFNAMSIZ];
	int			af; /* Address family. */
	struct	ipacl_addr	addr;
	struct	ipacl_addr	mask;
	TAILQ_ENTRY(ip_rule)	r_entries;
};

static struct mtx			rule_mtx;
static TAILQ_HEAD(rulehead, ip_rule)	rule_head;
static char				rule_string[MAC_RULE_STRING_LEN];

static void
destroy_rules(struct rulehead *head)
{
	struct ip_rule *rule;

	while ((rule = TAILQ_FIRST(head)) != NULL) {
		TAILQ_REMOVE(head, rule, r_entries);
		free(rule, M_IPACL);
	}
}

static void
ipacl_init(struct mac_policy_conf *conf)
{
	mtx_init(&rule_mtx, "rule_mtx", NULL, MTX_DEF);
	TAILQ_INIT(&rule_head);
}

static void
ipacl_destroy(struct mac_policy_conf *conf)
{
	mtx_destroy(&rule_mtx);
	destroy_rules(&rule_head);
}

/*
 * Note: parsing routines are destructive on the passed string.
 */
static int
parse_rule_element(char *element, struct ip_rule *rule)
{
	char *tok, *p;
	int prefix;
#ifdef INET6
	int i;
#endif

	/* Should we support a jail wildcard? */
	tok = strsep(&element, ",");
	if (tok == NULL)
		return (EINVAL);
	rule->jid = strtol(tok, &p, 10);
	if (*p != '\0')
		return (EINVAL);
	tok = strsep(&element, ",");
	if (tok == NULL)
		return (EINVAL);
	rule->allow = strtol(tok, &p, 10);
	if (*p != '\0')
		return (EINVAL);
	tok = strsep(&element, ",");
	if (strlen(tok) + 1 > IFNAMSIZ)
		return (EINVAL);
	/* Empty interface name is wildcard to all interfaces. */
	strlcpy(rule->if_name, tok, strlen(tok) + 1);
	tok = strsep(&element, ",");
	if (tok == NULL)
		return (EINVAL);
	rule->af = (strcmp(tok, "AF_INET") == 0) ? AF_INET :
	    (strcmp(tok, "AF_INET6") == 0) ? AF_INET6 : -1;
	if (rule->af == -1)
		return (EINVAL);
	tok = strsep(&element, "/");
	if (tok == NULL)
		return (EINVAL);
	if (inet_pton(rule->af, tok, rule->addr.addr32) != 1)
		return (EINVAL);
	tok = element;
	if (tok == NULL)
		return (EINVAL);
	prefix = strtol(tok, &p, 10);
	if (*p != '\0')
		return (EINVAL);
	/* Value -1 for prefix make policy applicable to individual IP only. */
	if (prefix == -1)
		rule->subnet_apply = false;
	else {
		rule->subnet_apply = true;
		switch (rule->af) {
#ifdef INET
		case AF_INET:
			if (prefix < 0 || prefix > 32)
				return (EINVAL);

			if (prefix == 0)
				rule->mask.addr32[0] = htonl(0);
			else
				rule->mask.addr32[0] =
				    htonl(~((1 << (32 - prefix)) - 1));
			rule->addr.addr32[0] &= rule->mask.addr32[0];
			break;
#endif
#ifdef INET6
		case AF_INET6:
			if (prefix < 0 || prefix > 128)
				return (EINVAL);

			for (i = 0; prefix > 0; prefix -= 8, i++)
				rule->mask.addr8[i] = prefix >= 8 ? 0xFF :
				    (u_int8_t)((0xFFU << (8 - prefix)) & 0xFFU);
			for (i = 0; i < 16; i++)
				rule->addr.addr8[i] &= rule->mask.addr8[i];
			break;
#endif
		}
	}
	return (0);
}

/*
 * Format of Rule- jid,allow,interface_name,addr_family,ip_addr/subnet_mask
 * Example: sysctl security.mac.ipacl.rules=1,1,epair0b,AF_INET,192.0.2.2/24
 */
static int
parse_rules(char *string, struct rulehead *head)
{
	struct ip_rule *new;
	char *element;
	int error;

	error = 0;
	while ((element = strsep(&string, "@")) != NULL) {
		if (strlen(element) == 0)
			continue;

		new = malloc(sizeof(*new), M_IPACL, M_ZERO | M_WAITOK);
		error = parse_rule_element(element, new);
		if (error != 0) {
			free(new, M_IPACL);
			goto out;
		}
		TAILQ_INSERT_TAIL(head, new, r_entries);
	}
out:
	if (error != 0)
		destroy_rules(head);
	return (error);
}

static int
sysctl_rules(SYSCTL_HANDLER_ARGS)
{
	char *string, *copy_string, *new_string;
	struct rulehead head, save_head;
	int error;

	new_string = NULL;
	if (req->newptr != NULL) {
		new_string = malloc(MAC_RULE_STRING_LEN, M_IPACL,
		    M_WAITOK | M_ZERO);
		mtx_lock(&rule_mtx);
		strcpy(new_string, rule_string);
		mtx_unlock(&rule_mtx);
		string = new_string;
	} else
		string = rule_string;

	error = sysctl_handle_string(oidp, string, MAC_RULE_STRING_LEN, req);
	if (error)
		goto out;

	if (req->newptr != NULL) {
		copy_string = strdup(string, M_IPACL);
		TAILQ_INIT(&head);
		error = parse_rules(copy_string, &head);
		free(copy_string, M_IPACL);
		if (error)
			goto out;

		TAILQ_INIT(&save_head);
		mtx_lock(&rule_mtx);
		TAILQ_CONCAT(&save_head, &rule_head, r_entries);
		TAILQ_CONCAT(&rule_head, &head, r_entries);
		strcpy(rule_string, string);
		mtx_unlock(&rule_mtx);
		destroy_rules(&save_head);
	}
out:
	if (new_string != NULL)
		free(new_string, M_IPACL);
	return (error);
}
SYSCTL_PROC(_security_mac_ipacl, OID_AUTO, rules,
    CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
    0, sysctl_rules, "A", "IP ACL Rules");

static int
rules_check(struct ucred *cred,
    struct ipacl_addr *ip_addr, if_t ifp)
{
	struct ip_rule *rule;
	int error;
#ifdef INET6
	int i;
	bool same_subnet;
#endif

	error = EPERM;

	mtx_lock(&rule_mtx);

	/*
	 * In the case where multiple rules are applicable to an IP address or
	 * a set of IP addresses, the rule that is defined later in the list
	 * determines the outcome, disregarding any previous rule for that IP
	 * address.
	 * Walk the policy rules list in reverse order until rule applicable
	 * to the requested IP address is found.
	 */
	TAILQ_FOREACH_REVERSE(rule, &rule_head, rulehead, r_entries) {
		/* Skip if current rule applies to different jail. */
		if (cred->cr_prison->pr_id != rule->jid)
			continue;

		if (strcmp(rule->if_name, "\0") &&
		    strcmp(rule->if_name, if_name(ifp)))
			continue;

		switch (rule->af) {
#ifdef INET
		case AF_INET:
			if (rule->subnet_apply) {
				if (rule->addr.v4.s_addr !=
				    (ip_addr->v4.s_addr & rule->mask.v4.s_addr))
					continue;
			} else
				if (ip_addr->v4.s_addr != rule->addr.v4.s_addr)
					continue;
			break;
#endif
#ifdef INET6
		case AF_INET6:
			if (rule->subnet_apply) {
				same_subnet = true;
				for (i = 0; i < 16; i++)
					if (rule->addr.v6.s6_addr[i] !=
					    (ip_addr->v6.s6_addr[i] &
					    rule->mask.v6.s6_addr[i])) {
						same_subnet = false;
						break;
					}
				if (!same_subnet)
					continue;
			} else
				if (bcmp(&rule->addr, ip_addr,
				    sizeof(*ip_addr)))
					continue;
			break;
#endif
		}

		if (rule->allow)
			error = 0;
		break;
	}

	mtx_unlock(&rule_mtx);

	return (error);
}

/*
 * Feature request: Can we make this sysctl policy apply to jails by default,
 * but also allow it to be changed to apply to the base system?
 */
#ifdef INET
static int
ipacl_ip4_check_jail(struct ucred *cred,
    const struct in_addr *ia, if_t ifp)
{
	struct ipacl_addr ip4_addr;

	ip4_addr.v4 = *ia;

	if (!jailed(cred))
		return (0);

	/* Checks with the policy only when it is enforced for ipv4. */
	if (ipacl_ipv4)
		return rules_check(cred, &ip4_addr, ifp);

	return (0);
}
#endif

#ifdef INET6
static int
ipacl_ip6_check_jail(struct ucred *cred,
    const struct in6_addr *ia6, if_t ifp)
{
	struct ipacl_addr ip6_addr;

	ip6_addr.v6 = *ia6; /* Make copy to not alter the original. */
	in6_clearscope(&ip6_addr.v6); /* Clear the scope id. */

	if (!jailed(cred))
		return (0);

	/* Checks with the policy when it is enforced for ipv6. */
	if (ipacl_ipv6)
		return rules_check(cred, &ip6_addr, ifp);

	return (0);
}
#endif

static struct mac_policy_ops ipacl_ops =
{
	.mpo_init = ipacl_init,
	.mpo_destroy = ipacl_destroy,
#ifdef INET
	.mpo_ip4_check_jail = ipacl_ip4_check_jail,
#endif
#ifdef INET6
	.mpo_ip6_check_jail = ipacl_ip6_check_jail,
#endif
};

MAC_POLICY_SET(&ipacl_ops, mac_ipacl, "TrustedBSD MAC/ipacl",
    MPC_LOADTIME_FLAG_UNLOADOK, NULL);