MFp4:	@229469:

Garbage-collect dead prototypes.

Reviewed by:	brooks
Sponsored by:	The FreeBSD Foundation
MFp4 @229470:

Remove unused argument from send_packet().

Reviewed by:	brooks
Sponsored by:	The FreeBSD Foundation
MFp4 @229471:

Remove unused argument from assemble_hw_header().

Reviewed by:	brooks
Sponsored by:	The FreeBSD Foundation
MFp4 @229472:

Use the same type for 'from' and 'to' argument in send_packet().

Reviewed by:	brooks
Sponsored by:	The FreeBSD Foundation
MFp4 @229473:

No caller checks send_packet() return value, so make it void.

Reviewed by:	brooks
Sponsored by:	The FreeBSD Foundation
MFp4 @229474:

iov_base field is 'void *' in FreeBSD, no need to cast.

Reviewed by:	brooks
Sponsored by:	The FreeBSD Foundation
MFp4 @229476,229478:

Make use of two fields: rfdesc and wfdesc to keep bpf descriptor open for
reading only in rfdesc and bpf descriptor open for writing only in wfdesc.
In the end they will be used by two different processes.

Reviewed by:	brooks
Sponsored by:	The FreeBSD Foundation
Remove redundant white-spaces.
MFp4 @229477:

The gethostname(3) function won't work in capability mode, because reading
kern.hostname sysctl is not permitted there.  Cache hostname early and use
cached value later.

Reviewed by:	brooks
Sponsored by:	The FreeBSD Foundation
MFp4 @229479:

- Add new request (IMSG_SEND_PACKET) that will be handled by privileged process.
- Add $FreeBSD$.

Reviewed by:	brooks
Sponsored by:	The FreeBSD Foundation
MFp4 @229480:

Shutdown write direction of the routing socket. We only need to read from it.

Reviewed by:	brooks
Sponsored by:	The FreeBSD Foundation
MFp4 @229481:

Currently it was allowed to send any UDP packets from unprivileged process and
possibly any packets because /dev/bpf was open for writing.

Move sending packets to privileged process. Unprivileged process has no longer
access to not connected UDP socket and has only access to /dev/bpf in read-only
mode.

Reviewed by:	brooks
Sponsored by:	The FreeBSD Foundation
MFp4 @229482:

- Limit bpf descriptor in unprivileged process to CAP_POLL_EVENT, CAP_READ and
  allow for SIOCGIFFLAGS, SIOCGIFMEDIA ioctls.
- While here limit bpf descriptor in privileged process to only CAP_WRITE.

Reviewed by:	brooks
Sponsored by:	The FreeBSD Foundation
MFp4 @229483:

Limit communication pipe with privileged process to CAP_READ and CAP_WRITE.

Reviewed by:	brooks
Sponsored by:	The FreeBSD Foundation
MFp4 @229484:

Limit routing socket so only poll(2) and read(2) are allowed (CAP_POLL_EVENT
and CAP_READ). This prevents unprivileged process from adding, removing or
modifying system routes.

Reviewed by:	brooks
Sponsored by:	The FreeBSD Foundation
MFp4 @229485:

Only allow to overwrite lease file.

Reviewed by:	brooks
Sponsored by:	The FreeBSD Foundation
MFp4 @229486:

Once PID is written to the pidfile, revoke all capability rights.
We just want to keep the pidfile open.

Reviewed by:	brooks
Sponsored by:	The FreeBSD Foundation
MFp4 @229487:

Revoke all capability rights from STDIN and allow only for write to STDOUT and
STDERR. All those descriptors are redirected to /dev/null.

Reviewed by:	brooks
Sponsored by:	The FreeBSD Foundation
MFp4 @229488:

Sandbox unprivileged process using capability mode.

Reviewed by:	brooks
Sponsored by:	The FreeBSD Foundation