NPF : User/group id filtering #47
Closed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
zoulasc
reviewed
Mar 29, 2025
usr.sbin/npf/npfctl/npf_data.c
Outdated
| * both uid and gid are both uint32_t | ||
| */ | ||
| struct r_id | ||
| npfctl_init_rid(uint32_t id1, uint32_t id2, uint8_t op) |
There was a problem hiding this comment.
pass the rid pointer to be initialized to avoid extra copies.
Emmankoko
force-pushed
the
rid
branch
3 times, most recently
from
20e7cfb to
e402ccb
Compare
zoulasc
reviewed
May 24, 2025
usr.sbin/npf/npfctl/npf_show.c
Outdated
| @@ -548,6 +575,14 @@ npfctl_print_rule(npf_conf_info_t *ctx, nl_rule_t *rl, unsigned level) | |||
| ctx->fpos += fprintf(ctx->fp, "all "); | |||
| } | |||
|
|
|||
| if (!npf_rule_getrid(&rid, rl, "r_user")) { | |||
| ctx->fpos += fprintf(ctx->fp, "user \"%s\" ", print_guid(rid)); | |||
Emmankoko
force-pushed
the
rid
branch
6 times, most recently
from
024cdd6 to
7ae56f4
Compare
zoulasc
reviewed
May 31, 2025
sys/net/npf/npf_handler.c
Outdated
| @@ -251,7 +251,8 @@ npfk_packet_handler(npf_t *npf, struct mbuf **mp, ifnet_t *ifp, int di) | |||
| error = npf_rule_reverse(&npc, &mi, error); | |||
| } | |||
|
|
|||
| if (error) { | |||
| /* sidewaysh handling of rejecting packets whose addr-port pair matches no sockets */ | |||
There was a problem hiding this comment.
I think this should be done in a separate commit and "sideways"?
zoulasc
reviewed
May 31, 2025
sys/net/npf/npf_ruleset.c
Outdated
| } | ||
|
|
||
| return matched; | ||
| /* make sure if both uid and gid is set on rule, both must be mtching to agree */ |
zoulasc
reviewed
May 31, 2025
sys/net/npf/npf_ruleset.c
Outdated
| @@ -1013,7 +1013,7 @@ int | |||
| npf_rule_match_rid(npf_rule_t *rl, npf_cache_t *npc, int dir) | |||
| { | |||
| uint32_t sock_gid, sock_uid; | |||
| int matched = 0; | |||
| int uid_matched = 0, gid_matched = 0; | |||
zoulasc
reviewed
May 31, 2025
| @@ -0,0 +1,270 @@ | |||
| /* | |||
zoulasc
reviewed
May 31, 2025
| int id_match; | ||
|
|
||
| id_match = npf_rule_match_rid(rl, npc, t->di); | ||
| error = npf_rule_conclude(rl, &mi); |
There was a problem hiding this comment.
error gets overwritten below and not tested here.
zoulasc
reviewed
May 31, 2025
| static struct socket * | ||
| test_socket(int dir, uid_t uid, gid_t gid) | ||
| { | ||
| struct sockaddr_in Server; |
zoulasc
reviewed
May 31, 2025
| test_socket(int dir, uid_t uid, gid_t gid) | ||
| { | ||
| struct sockaddr_in Server; | ||
| struct lwp *cur = curlwp; |
zoulasc
reviewed
May 31, 2025
|
|
||
| struct socket *so; | ||
| int error = socreate(AF_INET, &so, SOCK_DGRAM, 0, cur, NULL); | ||
| if(error) { |
There was a problem hiding this comment.
Space after keyword (everywhere)
There was a problem hiding this comment.
why printf instead of warn(3)?
zoulasc
reviewed
May 31, 2025
| sounlock(so); | ||
|
|
||
| if((error = sobind(so, (struct sockaddr *)&Server, cur)) != 0) { | ||
| printf("bind failed %d\n", error); |
There was a problem hiding this comment.
Again warn is better (everywhere)?
zoulasc
reviewed
May 31, 2025
| static bool | ||
| test_static(bool verbose) | ||
| { | ||
| for (unsigned i = 0; i < __arraycount(test_cases); i++) { |
Emmankoko
force-pushed
the
rid
branch
5 times, most recently
from
2d134c0 to
10b8936
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.