Skip to content

net: only perform IPv4 map check for AF_INET6 sockets #45155

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from

Conversation

jrick
Copy link
Contributor

@jrick jrick commented Mar 22, 2021

This change avoids executing syscalls testing if IPv4 address mapping
is possible unless the socket being opened belongs to the AF_INET6
family.

In a pledged OpenBSD process, this test is only allowed when the
"inet" pledge is granted; however this check was also being performed
for AF_UNIX sockets (separately permitted under the "unix" pledge),
and would cause the process to be killed by the kernel. By avoiding
the IPv4 address mapping check until the socket is checked to be
AF_INET6, a pledged OpenBSD process using AF_UNIX sockets without the
"inet" pledge won't be killed for this misbehavior.

The OpenBSD kernel is not currently ready to support using UNIX domain
sockets with only the "unix" pledge (and without "inet"), but this is
one change necessary to support this.

This change avoids executing syscalls testing if IPv4 address mapping
is possible unless the socket being opened belongs to the AF_INET6
family.

In a pledged OpenBSD process, this test is only allowed when the
"inet" pledge is granted; however this check was also being performed
for AF_UNIX sockets (separately permitted under the "unix" pledge),
and would cause the process to be killed by the kernel.  By avoiding
the IPv4 address mapping check until the socket is checked to be
AF_INET6, a pledged OpenBSD process using AF_UNIX sockets without the
"inet" pledge won't be killed for this misbehavior.

The OpenBSD kernel is not currently ready to support using UNIX domain
sockets with only the "unix" pledge (and without "inet"), but this is
one change necessary to support this.
@google-cla google-cla bot added the cla: yes Used by googlebot to label PRs as having a valid CLA. The text of this label should not change. label Mar 22, 2021
@jrick
Copy link
Contributor Author

jrick commented Mar 22, 2021

For the OpenBSD kernel patch which is also needed to try this, see https://marc.info/?l=openbsd-tech&m=161221087502321&w=2

@gopherbot
Copy link
Contributor

This PR (HEAD: 3c5541b) has been imported to Gerrit for code review.

Please visit https://go-review.googlesource.com/c/go/+/303276 to see it.

Tip: You can toggle comments from me using the comments slash command (e.g. /comments off)
See the Wiki page for more info

@gopherbot
Copy link
Contributor

Message from Go Bot:

Patch Set 1:

Congratulations on opening your first change. Thank you for your contribution!

Next steps:
A maintainer will review your change and provide feedback. See
https://golang.org/doc/contribute.html#review for more info and tips to get your
patch through code review.

Most changes in the Go project go through a few rounds of revision. This can be
surprising to people new to the project. The careful, iterative review process
is our way of helping mentor contributors and ensuring that their contributions
have a lasting impact.

During May-July and Nov-Jan the Go project is in a code freeze, during which
little code gets reviewed or merged. If a reviewer responds with a comment like
R=go1.11 or adds a tag like "wait-release", it means that this CL will be
reviewed as part of the next development cycle. See https://golang.org/s/release
for more details.


Please don’t reply on this GitHub thread. Visit golang.org/cl/303276.
After addressing review feedback, remember to publish your drafts!

@gopherbot
Copy link
Contributor

Message from Josh Rickmar:

Patch Set 1:

(1 comment)


Please don’t reply on this GitHub thread. Visit golang.org/cl/303276.
After addressing review feedback, remember to publish your drafts!

@tklauser tklauser changed the title net: Only perform IPv4 map check for AF_INET6 sockets net: only perform IPv4 map check for AF_INET6 sockets Mar 25, 2021
@gopherbot
Copy link
Contributor

Message from Tobias Klauser:

Patch Set 2: Run-TryBot+1


Please don’t reply on this GitHub thread. Visit golang.org/cl/303276.
After addressing review feedback, remember to publish your drafts!

@gopherbot
Copy link
Contributor

Message from Go Bot:

Patch Set 2:

TryBots beginning. Status page: https://farmer.golang.org/try?commit=92dfbe1b


Please don’t reply on this GitHub thread. Visit golang.org/cl/303276.
After addressing review feedback, remember to publish your drafts!

@gopherbot
Copy link
Contributor

Message from Go Bot:

Patch Set 2: TryBot-Result+1

TryBots are happy.


Please don’t reply on this GitHub thread. Visit golang.org/cl/303276.
After addressing review feedback, remember to publish your drafts!

@gopherbot
Copy link
Contributor

Message from Tobias Klauser:

Patch Set 2: Code-Review+2

(1 comment)


Please don’t reply on this GitHub thread. Visit golang.org/cl/303276.
After addressing review feedback, remember to publish your drafts!

@gopherbot
Copy link
Contributor

Message from Aaron Bieber:

Patch Set 2: Code-Review+1


Please don’t reply on this GitHub thread. Visit golang.org/cl/303276.
After addressing review feedback, remember to publish your drafts!

gopherbot pushed a commit that referenced this pull request Mar 25, 2021
This change avoids executing syscalls testing if IPv4 address mapping
is possible unless the socket being opened belongs to the AF_INET6
family.

In a pledged OpenBSD process, this test is only allowed when the
"inet" pledge is granted; however this check was also being performed
for AF_UNIX sockets (separately permitted under the "unix" pledge),
and would cause the process to be killed by the kernel.  By avoiding
the IPv4 address mapping check until the socket is checked to be
AF_INET6, a pledged OpenBSD process using AF_UNIX sockets without the
"inet" pledge won't be killed for this misbehavior.

The OpenBSD kernel is not currently ready to support using UNIX domain
sockets with only the "unix" pledge (and without "inet"), but this is
one change necessary to support this.

Change-Id: If6962a7ad999b71bcfc9fd8e10d9c4067fa3f338
GitHub-Last-Rev: 3c5541b
GitHub-Pull-Request: #45155
Reviewed-on: https://go-review.googlesource.com/c/go/+/303276
Run-TryBot: Tobias Klauser <[email protected]>
TryBot-Result: Go Bot <[email protected]>
Reviewed-by: Tobias Klauser <[email protected]>
Reviewed-by: Aaron Bieber <[email protected]>
Trust: Ian Lance Taylor <[email protected]>
@gopherbot
Copy link
Contributor

This PR is being closed because golang.org/cl/303276 has been merged.

@gopherbot gopherbot closed this Mar 25, 2021
@jrick jrick deleted the avoid_ipv4map_check branch March 25, 2021 20:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
cla: yes Used by googlebot to label PRs as having a valid CLA. The text of this label should not change.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants