upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-07-14 19:51:17 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

cap_net: do not allow new limits to drop keys from the old ones

Browse source 
If the old limit had family/hosts/sockaddr set, the new limit must
have them too. Before, a missing key in the new limit was treated as
"allow any", which let a caller silently extend their limits.

Approved by:	re
Approved by:	so
Security:	FreeBSD-SA-26:24.cap_net
Security:	CVE-2026-45254
Reported by:	Joshua Rogers of AISLE Research Team
Reviewed by:	markj
MFC after:	1 day
Differential Revision:	https://reviews.freebsd.org/D56991

(cherry picked from commit d705a519525f2acae3c1efba11436ec6ee8aea0a)
(cherry picked from commit 7eb3fd691d64dd42f9d32e04cb9b5811fd7c8e55)
This commit is contained in:
Mariusz Zaborski 2026-05-12 10:33:41 +02:00 committed by Mark Johnston
parent ccfb260ac1
commit 5a135f8b45
1 changed files with 31 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
lib/libcasper/services/cap_net/cap_net.c
View file

@ -1122,12 +1122,37 @@ net_connect(const nvlist_t *limits, nvlist_t *nvlin, nvlist_t *nvlout)
return (0);
}
/*
* If the old sublimit restricted a subkey, the new one must too;
* a missing subkey means "allow any" at request time.
*/
static bool
verify_subkeys_present(const nvlist_t *oldfunclimits,
const nvlist_t *newfunclimit)
{
void *cookie;
const char *name;
if (oldfunclimits == NULL)
return (true);
cookie = NULL;
while ((name = nvlist_next(oldfunclimits, NULL, &cookie)) != NULL) {
if (!nvlist_exists(newfunclimit, name))
return (false);
}
return (true);
}
static bool
verify_only_sa_newlimts(const nvlist_t *oldfunclimits,
const nvlist_t *newfunclimit)
{
void *cookie;
if (!verify_subkeys_present(oldfunclimits, newfunclimit))
return (false);
cookie = NULL;
while (nvlist_next(newfunclimit, NULL, &cookie) != NULL) {
void *sacookie;
@ -1200,6 +1225,9 @@ verify_addr2name_newlimits(const nvlist_t *oldlimits,
LIMIT_NV_ADDR2NAME, NULL);
}
if (!verify_subkeys_present(oldfunclimits, newfunclimit))
return (false);
cookie = NULL;
while (nvlist_next(newfunclimit, NULL, &cookie) != NULL) {
if (strcmp(cnvlist_name(cookie), "sockaddr") == 0) {
@ -1258,6 +1286,9 @@ verify_name2addr_newlimits(const nvlist_t *oldlimits,
LIMIT_NV_NAME2ADDR, NULL);
}
if (!verify_subkeys_present(oldfunclimits, newfunclimit))
return (false);
cookie = NULL;
while (nvlist_next(newfunclimit, NULL, &cookie) != NULL) {
if (strcmp(cnvlist_name(cookie), "hosts") == 0) {