lib: Add per-user packet pools

The IRMd will now check the user UID and GID for privileged access,
avoiding unprivileged users being able to disrupt all IPC (e.g. by
shm_open the single pool and corrupting its metadata).

Non-privileged users are now limited to a PUP (per-user pool) for
sending/receiving packets. It is still created by the IRMd, but owned
by the user (uid) with 600 permissions. It does not add additional
copies for local IPC between their own processes (i.e. over the local
IPCP), but packets between processes owned by a different user or
destined over the network (other IPCPs) will incur a copy when
crossing the PUP / PUP or the PUP / GSPP boundary.

Privileged users and users in the ouroboros group still have direct
access to the GSPP (globally shared private pool) for packet transfer
that will avoid additional copies when processing packets between
processes owned by different users and to the network.

This aligns the security model with UNIX trust domains defined by UID
and GID by leveraging file permission on the pools in shared memory.

┌─────────────────────────────────────────────────────────────┐
│ Source Pool    │ Dest Pool      │ Operation    │ Copies     │
├─────────────────────────────────────────────────────────────┤
│ GSPP           │ GSPP           │ Zero-copy    │ 0          │
│ PUP.uid        │ PUP.uid        │ Zero-copy    │ 0          │
│ PUP.uid1       │ PUP.uid2       │ memcpy()     │ 1          │
│ PUP.uid        │ GSPP           │ memcpy()     │ 1          │
│ GSPP           │ PUP.uid        │ memcpy()     │ 1          │
└─────────────────────────────────────────────────────────────┘

This also renames the struct ai ("application instance") in dev.c to
struct proc (process).

Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>

1 files changed, 50 insertions, 6 deletions

diff --git a/src/ipcpd/ipcp.c b/src/ipcpd/ipcp.c
index ebb9b1c5..3ea77da9 100644
--- a/src/ipcpd/ipcp.c
+++ b/src/ipcpd/ipcp.c
@@ -52,6 +52,7 @@
 #include <ouroboros/utils.h>
 
 #include "ipcp.h"
+#include "np1.h"
 
 #include <signal.h>
 #include <string.h>
@@ -131,6 +132,8 @@ struct {
         pthread_t          acceptor;
 } ipcpd;
 
+struct np1_state np1;
+
 struct cmd {
         struct list_head next;
 
@@ -633,9 +636,11 @@ static void do_flow_alloc(pid_t            pid,
                           uint8_t *        dst,
                           qosspec_t        qs,
                           const buffer_t * data,
+                          uid_t            uid,
                           ipcp_msg_t *     ret_msg)
 {
-        int fd;
+        int               fd;
+        struct ssm_pool * pool = NULL;
 
         log_info("Allocating flow %d for %d to " HASH_FMT32 ".",
                  flow_id, pid, HASH_VAL32(dst));
@@ -662,6 +667,17 @@ static void do_flow_alloc(pid_t            pid,
                 return;
         }
 
+        if (uid != 0) {
+                pool = ssm_pool_open(uid);
+                if (pool == NULL) {
+                        log_err("Failed to open PUP for uid %d.", uid);
+                        ret_msg->result = -ENOMEM;
+                        return;
+                }
+        }
+
+        NP1_SET_POOL(fd, pool);
+
         ret_msg->result = ipcpd.ops->ipcp_flow_alloc(fd, dst, qs, data);
 
         log_info("Finished allocating flow %d to " HASH_FMT32 ".",
@@ -672,9 +688,11 @@ static void do_flow_alloc(pid_t            pid,
 static void do_flow_join(pid_t           pid,
                          int             flow_id,
                          const uint8_t * dst,
+                         uid_t           uid,
                          ipcp_msg_t *    ret_msg)
 {
-        int fd;
+        int               fd;
+        struct ssm_pool * pool = NULL;
 
         log_info("Joining layer " HASH_FMT32 ".", HASH_VAL32(dst));
 
@@ -699,6 +717,17 @@ static void do_flow_join(pid_t           pid,
                 return;
         }
 
+        if (uid != 0) {
+                pool = ssm_pool_open(uid);
+                if (pool == NULL) {
+                        log_err("Failed to open PUP for uid %d.", uid);
+                        ret_msg->result = -ENOMEM;
+                        return;
+                }
+        }
+
+        NP1_SET_POOL(fd, pool);
+
         ret_msg->result = ipcpd.ops->ipcp_flow_join(fd, dst);
 
         log_info("Finished joining layer " HASH_FMT32 ".", HASH_VAL32(dst));
@@ -706,10 +735,12 @@ static void do_flow_join(pid_t           pid,
 
 static void do_flow_alloc_resp(int              resp,
                                int              flow_id,
+                               uid_t            uid,
                                const buffer_t * data,
                                ipcp_msg_t *     ret_msg)
 {
-        int fd = -1;
+        int               fd = -1;
+        struct ssm_pool * pool = NULL;
 
         log_info("Responding %d to alloc on flow_id %d.", resp, flow_id);
 
@@ -737,6 +768,17 @@ static void do_flow_alloc_resp(int              resp,
                 return;
         }
 
+        if (uid != 0) {
+                pool = ssm_pool_open(uid);
+                if (pool == NULL) {
+                        log_err("Failed to open PUP for uid %d.", uid);
+                        ret_msg->result = -ENOMEM;
+                        return;
+                }
+        }
+
+        NP1_SET_POOL(fd, pool);
+
         ret_msg->result = ipcpd.ops->ipcp_flow_alloc_resp(fd, resp, data);
 
         log_info("Finished responding %d to allocation request.",
@@ -857,12 +899,12 @@ static void * mainloop(void * o)
                         qs = qos_spec_msg_to_s(msg->qosspec);
                         do_flow_alloc(msg->pid, msg->flow_id,
                                       msg->hash.data, qs,
-                                      &data, &ret_msg);
+                                      &data, msg->uid, &ret_msg);
                         break;
                 case IPCP_MSG_CODE__IPCP_FLOW_JOIN:
                         assert(msg->hash.len == ipcp_dir_hash_len());
                         do_flow_join(msg->pid, msg->flow_id,
-                                     msg->hash.data, &ret_msg);
+                                     msg->hash.data, msg->uid, &ret_msg);
                         break;
                 case IPCP_MSG_CODE__IPCP_FLOW_ALLOC_RESP:
                         assert(msg->pk.len > 0 ? msg->pk.data != NULL
@@ -870,7 +912,7 @@ static void * mainloop(void * o)
                         data.len = msg->pk.len;
                         data.data = msg->pk.data;
                         do_flow_alloc_resp(msg->response, msg->flow_id,
-                                           &data, &ret_msg);
+                                           msg->uid, &data, &ret_msg);
                         break;
                 case IPCP_MSG_CODE__IPCP_FLOW_DEALLOC:
                         do_flow_dealloc(msg->flow_id, msg->timeo_sec, &ret_msg);
@@ -1035,6 +1077,8 @@ int ipcp_init(int               argc,
 
         ipcpd.alloc_id = -1;
 
+        memset(&np1, 0, sizeof(np1));
+
         pthread_condattr_destroy(&cattr);
 
         ipcp_set_state(IPCP_INIT);