summaryrefslogtreecommitdiff
path: root/sys/net
diff options
context:
space:
mode:
authorjakllsch <jakllsch@NetBSD.org>2023-01-05 18:29:45 +0000
committerjakllsch <jakllsch@NetBSD.org>2023-01-05 18:29:45 +0000
commit7055aecf7766edbbddae67ee20b093951b87faf2 (patch)
treeb27f097beb63c801cdf71f1b0d3cf7fcb731a59e /sys/net
parent2574644d2f48af6d1fe9bf301b6f927b6644465b (diff)
wg(4): Allow non-root to retrieve information other than the private
key and the peer preshared key. Add kauth(9) enums for wg(4) and add use them in suser secmodel. Refines fix for PR 57161.
Diffstat (limited to 'sys/net')
-rw-r--r--sys/net/if_wg.c38
1 files changed, 21 insertions, 17 deletions
diff --git a/sys/net/if_wg.c b/sys/net/if_wg.c
index 120e2c268bc..65b70f0b41a 100644
--- a/sys/net/if_wg.c
+++ b/sys/net/if_wg.c
@@ -1,4 +1,4 @@
-/* $NetBSD: if_wg.c,v 1.72 2023/01/05 02:38:51 jakllsch Exp $ */
+/* $NetBSD: if_wg.c,v 1.73 2023/01/05 18:29:46 jakllsch Exp $ */
/*
* Copyright (C) Ryota Ozaki <ozaki.ryota@gmail.com>
@@ -41,7 +41,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_wg.c,v 1.72 2023/01/05 02:38:51 jakllsch Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_wg.c,v 1.73 2023/01/05 18:29:46 jakllsch Exp $");
#ifdef _KERNEL_OPT
#include "opt_altq_enabled.h"
@@ -4463,9 +4463,14 @@ wg_ioctl_get(struct wg_softc *wg, struct ifdrv *ifd)
if (prop_dict == NULL)
goto error;
- if (!prop_dictionary_set_data(prop_dict, "private_key", wg->wg_privkey,
- WG_STATIC_KEY_LEN))
- goto error;
+ if (kauth_authorize_network(kauth_cred_get(),
+ KAUTH_NETWORK_INTERFACE_WG,
+ KAUTH_REQ_NETWORK_INTERFACE_WG_GETPRIV, &wg->wg_if,
+ (void *)SIOCGDRVSPEC, NULL) == 0) {
+ if (!prop_dictionary_set_data(prop_dict, "private_key",
+ wg->wg_privkey, WG_STATIC_KEY_LEN))
+ goto error;
+ }
if (wg->wg_listen_port != 0) {
if (!prop_dictionary_set_uint16(prop_dict, "listen_port",
@@ -4507,10 +4512,15 @@ wg_ioctl_get(struct wg_softc *wg, struct ifdrv *ifd)
uint8_t psk_zero[WG_PRESHARED_KEY_LEN] = {0};
if (!consttime_memequal(wgp->wgp_psk, psk_zero,
sizeof(wgp->wgp_psk))) {
- if (!prop_dictionary_set_data(prop_peer,
- "preshared_key",
- wgp->wgp_psk, sizeof(wgp->wgp_psk)))
- goto next;
+ if (kauth_authorize_network(kauth_cred_get(),
+ KAUTH_NETWORK_INTERFACE_WG,
+ KAUTH_REQ_NETWORK_INTERFACE_WG_GETPRIV, &wg->wg_if,
+ (void *)SIOCGDRVSPEC, NULL) == 0) {
+ if (!prop_dictionary_set_data(prop_peer,
+ "preshared_key",
+ wgp->wgp_psk, sizeof(wgp->wgp_psk)))
+ goto next;
+ }
}
wgsa = wg_get_endpoint_sa(wgp, &wgsa_psref);
@@ -4650,8 +4660,8 @@ wg_ioctl(struct ifnet *ifp, u_long cmd, void *data)
return error;
case SIOCSDRVSPEC:
if (kauth_authorize_network(kauth_cred_get(),
- KAUTH_NETWORK_INTERFACE,
- KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, &wg->wg_if,
+ KAUTH_NETWORK_INTERFACE_WG,
+ KAUTH_REQ_NETWORK_INTERFACE_WG_SETPRIV, &wg->wg_if,
(void *)cmd, NULL) != 0) {
return EPERM;
}
@@ -4674,12 +4684,6 @@ wg_ioctl(struct ifnet *ifp, u_long cmd, void *data)
}
return error;
case SIOCGDRVSPEC:
- if (kauth_authorize_network(kauth_cred_get(),
- KAUTH_NETWORK_INTERFACE,
- KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, &wg->wg_if,
- (void *)cmd, NULL) != 0) {
- return EPERM;
- }
return wg_ioctl_get(wg, ifd);
case SIOCSIFFLAGS:
if ((error = ifioctl_common(ifp, cmd, data)) != 0)