Nine ATF cases covering PMC_OP_CONFIGURELOG and the descriptor-less
log operations: which descriptors are accepted, when a log is required
in the first place, and what the log operations do without one.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 5)
The companion to pmc_exec_test.c, which covers only the drop side of a
credential-changing exec. Three cases cover what the drop must not
overreach into: an exec that changes no credentials keeps the PMC, a
set-id exec whose credential change the kernel suppresses for a traced
target keeps it too, and a set-id fexecve(2) drops it. They exercise
the permission logic FreeBSD-SA-26:56.hwpmc reworked, not the defect
it fixed.
All three pass on a debug (INVARIANTS+WITNESS) kernel. The two
keep-cases were each observed to fail on a kernel mutated to detach
unconditionally.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 4.8)
Seven ATF cases covering process-attachment teardown orderings: a
target that exits before it is detached, the owner that exits before
its target (hwpmc's other unlink path), releasing a still-running
attached PMC, row exhaustion with out-of-order release, and
PMC_F_DESCENDANTS inheritance including a fork storm.
All pass on a debug (INVARIANTS+WITNESS) and a KASAN kernel.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 5)
A pmc_id_t is a packed integer that the driver hands to userland and
accepts back on eleven operations, and nothing tested what happens when
one comes back forged, stale, or belonging to another process. Neither
was there a test that an unprivileged caller is refused the operations
that need a privilege.
The cases use a SOFT-class PMC wherever the counter itself does not
matter, so they run on a machine with no PMU.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 5)
This tests what FreeBSD-SA-26:56.hwpmc fixed.
exec_setgid_drops_pmc asserts the kernel takes a process-mode PMC away
when its target execs a set-gid program its owner is not entitled to
trace.
exec_setuid_no_double_unlink lets the target exec a set-uid program;
the teardown must unlink the process descriptor exactly once, and
completing at all is the assertion.
Both need an unprivileged owner and must not drop privileges themselves,
since p_candebug() would then refuse the target to its own owner; they
ask for require.user instead.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 5)
Commit 8572367b68 ("pf: remove STATE_LOOKUP") introduced two seemingly
unintentional changes with respect to divert(4)-injected packets (i.e.,
the PACKET_LOOPED case): we no longer return the matching state, and
direct callers of pf_find_state() now treat matches of diverted packets
the same as having no matching state at all.
This seems inadvertent, and breaks certain rulesets which use divert-to.
Fix them, and add a regression test case.
Fixes: 8572367b68 ("pf: remove STATE_LOOKUP")
Reviewed by: kp
MFC after: 2 weeks
Sponsored by: OPNsense
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D59015
This generalizes the divapp logic and makes it usable for other test
scenarios such as diverted TCP connections.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D59067
This helper wasn't updated in commit be1f7435ef, so in reality it was
testing whether "gid" is the first supplemental group. If a user
doesn't belong to a supplementary group, then it's testing an
uninitialized slot; since ucreds are allocated with M_ZERO, this
typically means that we're testing gid == 0.
group_is_primary() has exactly one use, in mac_do. There, it's used to
determine whether the requested primary GID can be used in a setcred(2)
call when the ruleset does not explicitly specify a target primary GID.
I believe this is mostly exploitable by daemons which have explicitly
dropped privileges and called setgroups(0, NULL); logged in users will
have a non-empty supplementary group list by virtue of having gone
through initgroups(3).
Fix group_is_primary(), and add a regression test.
Approved by: so
Security: FreeBSD-SA-26:59.mac_do
Security: CVE-2026-58092
Reported by: Hazley Samsudin of GovTech CSG
Fixes: be1f7435ef ("kern: start tracking cr_gid outside of cr_groups[]")
Reviewed by: olce, kevans
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59051
st_blksize is defined by POSIX as the 'preferred I/O block size for this
object.' It is wrong to use st_blksize as the unit for st_blocks and
expect it to be equal to the object size regardless of the change of
st_blksize.
Fixes: 3a1bf59d19 ("shmfd: consistently return size in 512 byte blocks for fstat(2) st_blocks")
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59014
This is enough to show that the idea works (and to exercise
uexterr_set()), but isn't complete by any means.
Reviewed by: kib
Effort: CHERI upstreaming
Sponsored by: Innovate UK
Differential Revision: https://reviews.freebsd.org/D58060
Modern Netlink arrays encode their elements as repeated attributes of
the same type rather than as children of an additional array container.
Add an SNL callback that parses one nested element for each occurrence
and appends it to a geometrically grown parser array. Retain the
existing parray callback for protocols that use the legacy container
form.
Store the growth capacity in struct snl_parray, appended after its
existing public count and items fields so their offsets remain stable
on LP64 and ILP32. Require parser targets to be real snl_parray
objects, and convert bitset, generic Netlink, and route multipath arrays
accordingly. This avoids relying on layout aliases for private growth
state.
Add regression coverage for a nested bit array that grows beyond its
initial allocation, while preserving replacement semantics when a
legacy array target is reused.
Reviewed by: melifaro, pouria
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58775
connect(2) passes AT_FDCWD to unp_connectat(), so the empty-path
descriptor branch added in 6563dcb6b1 turned any sockaddr whose
sun_path begins with a NUL byte into getsock(AT_FDCWD), failing with
EBADF where the pathname lookup historically failed with ENOENT.
Linux abstract namespace names are exactly that: the linuxulator
passes them through with the leading NUL intact, and libxcb tries the
abstract socket first, falling back to the pathname socket only on
ENOENT or ECONNREFUSED. The EBADF made every Linux X11 client fail
at startup with "Missing X server or $DISPLAY".
Restrict the descriptor interpretation to fd != AT_FDCWD, matching
the contract stated in 6563dcb6b1f5's commit message ("Accept an
empty sun_path when fd is not AT_FDCWD"): connect(2) again reaches
the pathname lookup and fails with ENOENT as it always did.
Add a regression test: a NUL-leading, nonzero-length sun_path through
connect(2) or connectat(2) with AT_FDCWD must fail the pathname
lookup with ENOENT, not EBADF.
Fixes: 6563dcb6b1 ("unix: allow connectat(2) to name the peer socket by descriptor")
Reviewed by: John Ericson <[email protected]>, markj
Differential Revision: https://reviews.freebsd.org/D58792
We created so many states that our bulk-sync occasionally caused epair
to drop packets, which in turn caused the test to fail. That's not what
we're testing here, make it more robust by creating fewer states.
PR: 297307
Sponsored by: Rubicon Communications, LLC ("Netgate")
Empty mchains cannot be copied with simple assignment.
I think this bug is mostly harmless: if mcnext is empty, then it won't
be accessed again before it is reinitialized in the next loop iteration.
So the bug only trips an assertion in INVARIANTS kernels and won't be
visible otherwise.
Add a regression test which triggers this corner case.
Reported by: Jan Bramkamp
Fixes: d157927807 ("unix: new implementation of unix/stream & unix/seqpacket")
Reviewed by: glebius
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58791
A native route Netlink interface will replace this stack.
Requested by: glebius
This reverts commit 1ccf543b21.
This reverts commit 2c04cfa148.
This reverts commit 2d6114f6d2.
This reverts commit d15f2551b2.
This reverts commit ceb282bbd6.
This reverts commit c30021fe0d.
This reverts commit fb1820d23a.
This reverts commit 8696cc600f.
Add tests where first socket and second socket are bound to different
addresses, e.g. first specific and second wildcard and vice versa.
Mark success with SO_REUSEPORT on the second socket as a bug suspect.
Mark failure to bind to INADDR_ANY in presence of other UID's specific
bound socket to the same port as probably too strict.
Differential Revision: https://reviews.freebsd.org/D58088
Allows to add tests to the table where the second socket doesn't take
address from the first. No functional change yet, all tests test the same
conditions.
Differential Revision: https://reviews.freebsd.org/D58087
The test has 6 dimensions: address family, socket type, socket option on
the first socket, socket option on the second socket, is first socket
bound to specific address or wildcard and is the second socket priveleged
or not. Before the change 3 dimensions are implemented as 3 nested for()
loops, 2 dimensions are implemented as repetitions in the test body and
one dimension as two actions in the innermost loop.
I'm about to add one more dimension: whether the second socket is bound to
a specific address or wildcard instead of using first socket's
getsockopt(2) result. Also, there is a change under discussion that would
make SOCK_STREAM sockets behave different to SOCK_DGRAM. That would break
result consistency in the dimensions of socket type.
We expect that consistency in the dimension of address families shall
never break, thus this one remains a for() loop. The priveleged & non-
privileged bind(2) attempts also remain as two actions, but expected
results are in the table. The rest of dimensions are unrolled into a
table, which at the moment has quite a lot of lines with identical
results. However, as more tests are added and SOCK_STREAM behavior
changes, the table will get more mixed results. Also, reading a test that
is written in a declarative manner a table is much easier and modifying it
is more resistent to accidential breakage.
Differential Revision: https://reviews.freebsd.org/D58085
`uipc_listen()` refused a socket that had not been bound, with
`EDESTADDRREQ`. That made sense while a pathname was the only way to
name a peer: an unbound listener could never be reached, so allowing it
would only have created sockets nothing could connect to. Now that
`connectat(2)` can name a peer socket by descriptor, an unbound listener
*is* reachable, and the restriction only stands in the way. It also left
stream sockets oddly stricter than datagram ones, which could already
reach an unbound peer.
Dropping the check additionally permits `bind(2)` after `listen(2)`:
`uipc_bindat()` already allows this, as it only rejects re-binding a
socket that has a name. That ordering closes a window listeners
otherwise have to leave open. Today the socket file must exist before
the socket may listen, so a client connecting in between is refused;
binding afterwards publishes the name only once the socket is ready to
accept.
`unix_seqpacket_test:listen_unbound` asserted the old behaviour, and is
inverted accordingly.
Signed-off-by: John Ericson <[email protected]>
Assisted-by: Claude Code (Claude Opus 4.8 and Fable 5)
Reviewed by: glebius, markj
MFC after: 2 months
Differential Revision: https://reviews.freebsd.org/D58683
Cover the new fd-direct connect path: stream connect and data passing,
the peer address reported by `getpeername(2)`, datagram to an unbound
peer, the `EINVAL`/`ENOTSOCK`/`EPROTOTYPE`/`ECONNREFUSED` error matrix,
and the Capsicum token semantics — a descriptor limited to
`CAP_CONNECTAT` can be connected to but not listened on, accepted from,
or read, and one lacking `CAP_CONNECTAT` cannot be a connect target.
Stream listeners are always bound: `uipc_listen()` refuses unbound
sockets with `EDESTADDRREQ`, so an unbound fd-direct listener is not
reachable even with this feature.
Signed-off-by: John Ericson <[email protected]>
Assisted-by: Claude Code (Claude Opus 4.8 and Fable 5)
Reviewed by: markj
MFC after: 2 months
Differential Revision: https://reviews.freebsd.org/D58406
The main problem is with the handling of errors from unp_externalize().
It turns out that this was quite broken, and unfortunately it's easy to
trigger such errors (e.g., by setting a low per-process fd limit with
setrlimit()).
In non-peek mode, uipc_soreceive_stream_or_seqpacket() cuts a bunch of
mbufs from the head of the socket buffer, to be consumed by userspace.
When unp_externalize() returns an error, we splice the removed mbuf
chain back onto the head of the socket buffer. This is expensive, but
that's ok since such errors are rare.
The problem is that this cutting is not correctly implemented: it does
not clear the "next" pointer for the last mbuf in the chain, so it
still points to the first mbuf still resident in the socket buffer.
This means that mc_init_m() creates a chain that still includes the rest
of the socket buffer, so splicing the chain back into the socket buffer
does not work properly.
Fix this: fully detach the control chain from the socket buffer so that
we can safely use mc_init_m(). Then, incrementally add data mbufs,
taking care to handle "part".
Fix some related bugs while here:
- Don't swallow the error if unp_externalize() fails and there's nothing
left in the socket buffer (i.e., control->m_next == NULL).
- Roll back changes to the partially read mbuf.
Reviewed by: glebius
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58695
Honor RTEXT_FILTER_VF on RTM_GETLINK requests and expose the versioned
SR-IOV VF status through typed nested FreeBSD attributes. Report
IFLA_NUM_VF with a successful requested query and preserve per-provider
errors in the status container.
Map the common nvlist schema to native integer, boolean, string, and
binary attributes. Carry namespaced driver extensions as packed
versioned nvlists so adding a driver-specific field does not expand the
common netlink ABI.
Add SNL parsers, parser verification, a constructed nested-status test,
and an RTM_GETLINK test for an interface without SR-IOV support.
Document the query contract and every attribute.
pfsync packets were allocated with m_get2(), which can't return packets
larger than MJUMPAGESIZE. As a result 9k MTU pfsync interfaces simply didn't work.
Use m_get3(), which can allocate sufficiently large mbufs.
Extend the pfsync:bulk test case to provoke this problem.
PR: 297307
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
pdwait's capsicum/enotcap and procdesc's pdopenpid_capmode enter capability mode.
Require security_capability_mode (and security_capabilities for enotcap) so the
cases skip cleanly on kernels built without CAPABILITIES instead of failing.
Approved by: asomers, gallatin
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D58545
Make it possible to define categories without compiling their
paths into libc (important for third-party modules). The
EXTERR_CATEGORY_DYNAMIC macro can be defined to a string describing the
compilation unit (generally the path relative to src/sys) which takes
the place of EXTERR_CATEGORY.
These strings are assembled in linker sets with category numbers
assigned at system startup or module load time. The strings can be
retrieved from the kern.exterr.categories.<category> sysctl.
Reviewed by: kib
Sponsored by: Innovate UK
Differential Revision: https://reviews.freebsd.org/D58237
pf assumes that network groups and network interfaces share a namespace
(that is, a name is unused, a group or an interface, never both a the
same time). Unfortunately this assumption was broken when interface
renaming was introduced.
Attempt to cope with this rather than panicking. Note that this is a
band-aid, not a full solution. The correct fix is for the network stack
to go back to enforcing a single namespace for groups and interfaces.
PR: 297220
Reported by: Robert Morris
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Migrate to new if_clone KPI and implement netlink support
for gif(4). Also break GIFSOPTS ioctl logic out of gif_ioctl.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D57666
Add a regression test for gre(4)
to make sure all of the gre capabilities and options are
working as intended.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D55363
The child exited immediately after pdfork(), so the parent's pdopenpid() could
catch it mid-exit (P_WEXIT) and fail with EBUSY.
Block the child on a pipe until the parent has opened the second descriptor,
then release it
Approved by: markj
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D58546
The test uses a fail point to inject a decryption error in OCF while
sending a ping across the tunnel. The driver should then fail to
respond to the ping and increment the input error counter on the
interface.
Approved by: so
Security: FreeBSD-SA-26:52.if_wg
Security: CVE-2026-58085
Reviewed by: markj
Sponsored by: Chelsio Communications
knotes with a non-trivial f_copy implementation may be activated before
kqueue_fork_copy_knote() is finished. In particular, it may be enqueued
at the time that kqueue_fork_copy_knote() calls knote_enqueue(). Guard
against this.
Add a test case which triggers the race.
Fix several other problems with the replication of knote state:
- Make sure only the KN_ACTIVE and KN_DISABLED status flags are
inherited, the rest should not be copied.
- Ignore marker knotes.
- Ignore knotes for kqueues. They cannot be safely copied into the
child without more work, as kqueues are inherently local to a process;
on fork, we need to ensure that such knotes are patched to reference
the new kqueue, not the original.
- Try to keep knote state stable by holding the kqueue and knlist locks
while copying.
Approved by: so
Security: FreeBSD-SA-26:50.kqueue
Security: CVE-2026-58083
Reviewed by: kib
Reported by: Hazley Samsudin of GovTech CSG
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58223
Add tests for both IPv4 and IPv6 routes with the prefsrc attribute.
Also test IPv4 routes over IPv6 nexthops and borrow their IPv4
addresses from the loopback interface.
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58326
The FD_RESOLVE_BENEATH flag is supposed to be sticky. It's set when you
receive an fd from a different jail and preserved by openat(<dfd>) etc..
However, if you send the fd to yourself, the flag is stripped since
SCM_RIGHTS message don't preserve file descriptor flags.
Fix this by preserving those flags and checking for UF_RESOLVE_BENEATH
in restrict_rights().
Fixes: 350ba9672a ("unix: Set O_RESOLVE_BENEATH on fds transferred between jails")
Reviewed by: kib
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58317
This unbreaks the build when pmc support is explicitly disabled via the
aforementioned build knob.
MFC after: 10 days
Fixes: 2cfd82f74 ("hwpmc: add regression tests for ...")
Differential Revision: https://reviews.freebsd.org/D58401
Outbound packet which matches rule with source limiter attached,
for example:
source limiter "crash" id 1 entries 10000 limit 1000
pass out from any to any source limiter "crash" keep state
triggers a NULL pointer dereference.
The issue was kindly reported and initial version of fix
submitted by SecBuddyF, Tencent KeenLab.
The submitted diff fixed the issue for failing look up by destination
address in outbound packet. dlg@ also pointed out the change should
be further improved so NULL pointer dereference is avoided when rule
uses nat-to/rdr-to option.
OK dlg@
Obtained from: OpenBSD, sashan <[email protected]>, f0f215c11e
Sponsored by: Rubicon Communications, LLC ("Netgate")
When a protocol-specific 'bind_all_fibs' tunable is set to 0, a
listening socket will only receive traffic originating from the FIB
it was bound to. However, there are no checks to determine whether
an address exists in the target FIB when binding the socket, which can
lead to a situation where a socket and the address it was bound to
belong to different FIBs.
Prevent this footgun by looking up the requested address in the current
FIB if 'bind_all_fibs' is active and returning an error if the address
does not exist.
Sponsored by: Stormshield
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D58281
Reviewed by: glebius, pouria, markj
MFC after: 2 weeks
Skip the message-content check on kernels that do not advertise the
exterr_strings feature, and pin the output format by clearing
EXTERROR_VERBOSE.
Reviewed by: kib
MFC after: 1 week
Assisted-by: Claude Code (Fable 5)
Differential Revision: https://reviews.freebsd.org/D58322
Attach a process-mode counting PMC to the current process, start it,
then detach and release it while it is still loaded on the hardware -
the case that previously leaked the PMC's runcount reference and
wedged pmc_wait_for_pmc_idle() at release. A second case does the same
from a multi-threaded process so the sibling threads' references have
to be drained too.
The tests need an allocatable process-mode counting event and skip
where none is available (hwpmc(4) not loaded, or a VM without a vPMU).
Reviewed by: adrian
MFC after: 2 weeks
Assisted-by: Claude Code (Fable 5)
Differential Revision: https://reviews.freebsd.org/D58343
Konstantin Belousov