From 476db83e80eb9ac03c2455a8645eeeca948d057e Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Tue, 9 Dec 2014 13:27:28 +0100
Subject: [PATCH 01/30] ggated: Ignore SIGPIPE to prevent DoS

... by a single prematurely closed client connection.

Reported to security-officer@FreeBSD.org on 2014-12-09.

Obtained from: ElectroBSD
---
 sbin/ggate/ggated/ggated.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sbin/ggate/ggated/ggated.c b/sbin/ggate/ggated/ggated.c
index f61efdc61690..afe16b625884 100644
--- a/sbin/ggate/ggated/ggated.c
+++ b/sbin/ggate/ggated/ggated.c
@@ -1040,6 +1040,7 @@ main(int argc, char *argv[])
 	pidfile_write(pfh);
 
 	signal(SIGCHLD, SIG_IGN);
+	signal(SIGPIPE, SIG_IGN);
 
 	sfd = socket(AF_INET, SOCK_STREAM, 0);
 	if (sfd == -1)
-- 
2.32.0


From 58e45d775c68e369061d12d3ba1bcab26757ac3f Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Tue, 9 Dec 2014 13:47:31 +0100
Subject: [PATCH 02/30] ggated: Remove connection if the initial packet
 couldn't be sent

Should help to mitigate DoS after flooding ggated
with incomplete requests:

   error: accept(): Software caused connection abort.
   error: Exiting.

Reported to security-officer@FreeBSD.org on 2014-12-09.

Obtained from: ElectroBSD
---
 sbin/ggate/ggated/ggated.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sbin/ggate/ggated/ggated.c b/sbin/ggate/ggated/ggated.c
index afe16b625884..595845034993 100644
--- a/sbin/ggate/ggated/ggated.c
+++ b/sbin/ggate/ggated/ggated.c
@@ -943,6 +943,7 @@ handshake(struct sockaddr *from, int sfd)
 	if (data == -1) {
 		sendfail(sfd, errno, "Error while sending initial packet: %s.",
 		    strerror(errno));
+		connection_remove(conn);
 		return (0);
 	}
 
-- 
2.32.0


From d5ca1238d7368e5af821fca687bc30bf2dea8a3f Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Tue, 9 Dec 2014 14:09:24 +0100
Subject: [PATCH 03/30] ggated: Continue if accept() is interrupted or the
 remote connection is lost

Reported to security-officer@FreeBSD.org on 2014-12-09.

Obtained from: ElectroBSD
---
 sbin/ggate/ggated/ggated.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sbin/ggate/ggated/ggated.c b/sbin/ggate/ggated/ggated.c
index 595845034993..147d41cc49bd 100644
--- a/sbin/ggate/ggated/ggated.c
+++ b/sbin/ggate/ggated/ggated.c
@@ -1065,9 +1065,11 @@ main(int argc, char *argv[])
 	for (;;) {
 		fromlen = sizeof(from);
 		tmpsfd = accept(sfd, &from, &fromlen);
-		if (tmpsfd == -1)
+		if (tmpsfd == -1) {
+			if (errno == EINTR || errno == ECONNABORTED)
+				continue;
 			g_gate_xlog("accept(): %s.", strerror(errno));
-
+		}
 		if (got_sighup) {
 			got_sighup = 0;
 			exports_get();
-- 
2.32.0


From e47012a2249d9f8f4cbe77f947458ac6c7b506d3 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Tue, 9 Dec 2014 14:16:47 +0100
Subject: [PATCH 04/30] ggated: Prevent c_diskfd leaks through
 connection_remove()

Should help against DoS:

     [...]
     debug: Connection created [127.0.0.1, /tank/scratch/testfile].
     debug: New connection created (token=2197914058).
     debug: exports[/tank/scratch/testfile2]: Path mismatch.
     debug: Sending initial packet.
     error: accept(): Too many open files.
     error: Exiting.

Reported to security-officer@FreeBSD.org on 2014-12-09.

Obtained from: ElectroBSD
---
 sbin/ggate/ggated/ggated.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sbin/ggate/ggated/ggated.c b/sbin/ggate/ggated/ggated.c
index 147d41cc49bd..ae5308e7af34 100644
--- a/sbin/ggate/ggated/ggated.c
+++ b/sbin/ggate/ggated/ggated.c
@@ -527,6 +527,8 @@ connection_remove(struct ggd_connection *conn)
 		close(conn->c_sendfd);
 	if (conn->c_recvfd != -1)
 		close(conn->c_recvfd);
+	if (conn->c_diskfd != -1)
+		close(conn->c_diskfd);
 	free(conn->c_path);
 	free(conn);
 }
-- 
2.32.0


From 89d10b366689c1cd84ec47320768c97590d60b3d Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Tue, 9 Dec 2014 15:52:39 +0100
Subject: [PATCH 05/30] ggated: Check for connection_add() failures properly

Prevents a socket leak

Reported to security-officer@FreeBSD.org on 2014-12-09.

Obtained from: ElectroBSD
---
 sbin/ggate/ggated/ggated.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sbin/ggate/ggated/ggated.c b/sbin/ggate/ggated/ggated.c
index ae5308e7af34..769f76e1d788 100644
--- a/sbin/ggate/ggated/ggated.c
+++ b/sbin/ggate/ggated/ggated.c
@@ -905,7 +905,7 @@ handshake(struct sockaddr *from, int sfd)
 		 */
 		g_gate_log(LOG_DEBUG, "Found existing connection (token=%lu).",
 		    (unsigned long)conn->c_token);
-		if (connection_add(conn, &cinit, from, sfd) == -1) {
+		if (connection_add(conn, &cinit, from, sfd) == EEXIST) {
 			connection_remove(conn);
 			return (0);
 		}
-- 
2.32.0


From 6daf356d5b92949b13a6c805571682d25a63851a Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Mon, 8 Dec 2014 17:59:38 +0100
Subject: [PATCH 06/30] ggated: Do not leak stack data in sendfail()

Reported to security-officer@FreeBSD.org on 2014-12-09.

Obtained from: ElectroBSD
---
 sbin/ggate/ggated/ggated.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sbin/ggate/ggated/ggated.c b/sbin/ggate/ggated/ggated.c
index 769f76e1d788..6005221052e2 100644
--- a/sbin/ggate/ggated/ggated.c
+++ b/sbin/ggate/ggated/ggated.c
@@ -606,6 +606,7 @@ sendfail(int sfd, int error, const char *fmt, ...)
 	va_list ap;
 	ssize_t data;
 
+	bzero(&sinit, sizeof(sinit));
 	sinit.gs_error = error;
 	g_gate_swap2n_sinit(&sinit);
 	data = g_gate_send(sfd, &sinit, sizeof(sinit), 0);
-- 
2.32.0


From 62e60a52b1f275f256beeafccf2c935b18ea2639 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Thu, 2 Apr 2015 15:24:58 +0200
Subject: [PATCH 07/30] ggated recv_thread(): Do not queue incomplete WRITE
 requests

Verifying that g_gate_recv()'s return code isn't -1 is insufficient
as it's a thin wrapper arround recv(2) which, quoting its man page,
"may still return less data than requested if a signal is caught,
an error or disconnect occurs, or the next data to be received is
of a different type than that returned".

Previously incomplete WRITE requests would be scheduled with partially
uninitialized memory, potentially resulting in file system corruption
or, worse, bogus data being later on returned as valid.

Security impact: A MITM may cause data corruption by disrupting
the connection from ggatec's send_thread() to ggated's recv_thread()
at the right point in time.

This does not require access to the plain text traffic but if encryption
is involved the attacker would have to guess that it's ggate traffic and
disrupt connections blindly, hoping that some of the disruptions trigger
the bug.

The issue was discovered after ZFS on the ggatec side reported checksum
errors which weren't reproducible on the ggated side where ZFS had
received and checksummed bogus data. The ggate traffic was tunneled
through SSH and Tor with sshd running as Tor location hidden service.

Reported to security-officer@FreeBSD.org on 2015-04-05.

Obtained from: ElectroBSD
---
 sbin/ggate/ggated/ggated.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sbin/ggate/ggated/ggated.c b/sbin/ggate/ggated/ggated.c
index 6005221052e2..525d92bd4957 100644
--- a/sbin/ggate/ggated/ggated.c
+++ b/sbin/ggate/ggated/ggated.c
@@ -684,6 +684,9 @@ recv_thread(void *arg)
 			if (data == -1) {
 				g_gate_xlog("Error while receiving data: %s.",
 				    strerror(errno));
+			} else if ((uint32_t)data != req->r_length) {
+				g_gate_xlog("Received %d bytes of data while "
+				    "expecting %u.", data, req->r_length);
 			}
 		}
 
-- 
2.32.0


From 6a93065183c7303edbd838bd0ee72c006d903360 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Thu, 2 Apr 2015 12:09:40 +0200
Subject: [PATCH 08/30] ggated recv_thread(): Do not queue requests with
 invalid values

... that would cause abort()s when read by the disk_thread() later on.

From ggatec's point of view it doesn't make a difference as the connection
will get closed either way, but at least the admin on the server side
doesn't have to deal with core dumps.

Security impact: An authenticated attacker may intentionally cause the
ggated process that handles the attacker's connection to core dump and
thus use more disk space than intentionally provisioned by the server
admin. Without the following patch ggated core dumps may require more
than 100 GB of disk space.

Reported to security-officer@FreeBSD.org on 2015-04-05.

Obtained from: ElectroBSD
---
 sbin/ggate/ggated/ggated.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/sbin/ggate/ggated/ggated.c b/sbin/ggate/ggated/ggated.c
index 525d92bd4957..29c227dbd693 100644
--- a/sbin/ggate/ggated/ggated.c
+++ b/sbin/ggate/ggated/ggated.c
@@ -668,6 +668,23 @@ recv_thread(void *arg)
 		g_gate_log(LOG_DEBUG, "%s: offset=%" PRIu64 " length=%" PRIu32,
 		    __func__, req->r_offset, req->r_length);
 
+		/*
+		 * Reject requests that violate assertions in disk_thread().
+		 */
+		if (req->r_cmd != GGATE_CMD_READ &&
+		    req->r_cmd != GGATE_CMD_WRITE) {
+			g_gate_xlog("Request contains invalid command.");
+		}
+		if (req->r_offset + req->r_length >
+		    (uintmax_t)conn->c_mediasize) {
+			g_gate_xlog("Request out of bounds.");
+		}
+		if (req->r_offset % conn->c_sectorsize != 0 ||
+		    req->r_length % conn->c_sectorsize != 0) {
+			g_gate_xlog("Request length or offset does "
+			    "not fit sector size.");
+		}
+
 		/*
 		 * Allocate memory for data.
 		 */
-- 
2.32.0


From 6b427c5746b6394a04769d4ee684564e974cdfa3 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Thu, 2 Apr 2015 19:52:54 +0200
Subject: [PATCH 09/30] ggated recv_thread(): Reject request with more than
 MAXPHYS bytes of data

.. to limit the amount of memory we (try to) allocate on behalf
of the client without knowing whether or not the client actually
intents to use it.

MAXPHYS is the hardcoded limit in ggatec so anything above it is
suspicious and could be a DoS attempt. This commit forces users who
like to tune MAXPHYS to make sure the value used by ggated is not
below the one used by ggatec. While not ideal, this seems preferable
to the DoS risk.

Reported to security-officer@FreeBSD.org on 2015-04-05.

Obtained from: ElectroBSD
---
 sbin/ggate/ggated/ggated.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/sbin/ggate/ggated/ggated.c b/sbin/ggate/ggated/ggated.c
index 29c227dbd693..edbf9b952ba7 100644
--- a/sbin/ggate/ggated/ggated.c
+++ b/sbin/ggate/ggated/ggated.c
@@ -685,6 +685,16 @@ recv_thread(void *arg)
 			    "not fit sector size.");
 		}
 
+		/*
+		 * Limit the amount of memory we allocate on behalf of
+		 * the client. MAXPHYS is the hard limit in ggatec,
+		 * values above it are thus pretty suspicious.
+		 */
+		if (req->r_length > MAXPHYS) {
+			g_gate_xlog("Request length above MAXPHYS: %u > %u",
+			    (unsigned)req->r_length, MAXPHYS);
+		}
+
 		/*
 		 * Allocate memory for data.
 		 */
-- 
2.32.0


From ff56ea1c98999dfcadce7b53e6e926171c2b1dfc Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Fri, 24 Apr 2015 14:04:31 +0200
Subject: [PATCH 10/30] ggatec: Add support for SOCKS5 with domain names

Obtained from: ElectroBSD
---
 sbin/ggate/ggatec/ggatec.c | 104 +++++++++++++++++++++++++++++++++++--
 1 file changed, 99 insertions(+), 5 deletions(-)

diff --git a/sbin/ggate/ggatec/ggatec.c b/sbin/ggate/ggatec/ggatec.c
index 0695dae0dca2..c647deb614b5 100644
--- a/sbin/ggate/ggatec/ggatec.c
+++ b/sbin/ggate/ggatec/ggatec.c
@@ -67,6 +67,8 @@ static unsigned flags = 0;
 static int force = 0;
 static unsigned queue_size = G_GATE_QUEUE_SIZE;
 static unsigned port = G_GATE_PORT;
+static char *socks_dest = NULL;
+static unsigned dest_port = 3080;
 static off_t mediasize;
 static unsigned sectorsize = 0;
 static unsigned timeout = G_GATE_TIMEOUT;
@@ -81,9 +83,11 @@ usage(void)
 
 	fprintf(stderr, "usage: %s create [-nv] [-o <ro|wo|rw>] [-p port] "
 	    "[-q queue_size] [-R rcvbuf] [-S sndbuf] [-s sectorsize] "
-	    "[-t timeout] [-u unit] <host> <path>\n", getprogname());
+	    "[-t timeout] [-T <host>:<socksport>] [-u unit] <host> <path>\n",
+	    getprogname());
 	fprintf(stderr, "       %s rescue [-nv] [-o <ro|wo|rw>] [-p port] "
-	    "[-R rcvbuf] [-S sndbuf] <-u unit> <host> <path>\n", getprogname());
+	    "[-R rcvbuf] [-S sndbuf] [-T <host>:<socksport>] <-u unit> "
+	    "<host> <path>\n", getprogname());
 	fprintf(stderr, "       %s destroy [-f] <-u unit>\n", getprogname());
 	fprintf(stderr, "       %s list [-v] [-u unit]\n", getprogname());
 	exit(EXIT_FAILURE);
@@ -262,6 +266,69 @@ recv_thread(void *arg __unused)
 	pthread_exit(NULL);
 }
 
+static void
+negotiate_socks_connection(int sfd)
+{
+	struct negotiation_request {
+	    char version;
+	    char nmethods;
+	    char method;
+	} neg_request;
+	struct socks_request {
+	    char version;
+	    char cmd;
+	    char reserved;
+	    char address_type;
+	    char host_length;
+	    char dest[255 + 2];
+	} socks_request;
+	char response[10];
+	size_t request_length;
+	size_t host_length;
+
+	host_length = strlen(socks_dest);
+
+	neg_request.version  = '\x05';
+	neg_request.nmethods = '\x01'; /* We support one method: */
+	neg_request.method   = '\x00'; /* no authentication */
+
+	g_gate_log(LOG_DEBUG, "Starting SOCKS negotiation.");
+	if (g_gate_send(sfd, &neg_request, sizeof(neg_request), MSG_NOSIGNAL) == -1)
+		g_gate_xlog("Failed to send SOCKS negotiation request.");
+
+	if (g_gate_recv(sfd, &response, sizeof(response), MSG_WAITALL) != 2)
+		g_gate_xlog("Failed to read SOCKS negotiation response.");
+
+	if (response[0] != '\x05' || response[1] != '\x00')
+		g_gate_xlog("SOCKS negotiation failed.");
+
+	g_gate_log(LOG_DEBUG, "Negotiated SOCKS5. "
+	    "Requesting connection to %s:%d.", socks_dest, dest_port);
+
+	socks_request.version	   = '\x05';
+	socks_request.cmd	   = '\x01'; /* Connect */
+	socks_request.reserved	   = '\x00';
+	socks_request.address_type = '\x03'; /* Address is domain name */;
+	socks_request.host_length  = (char)host_length;
+	strncpy(socks_request.dest, socks_dest, host_length);
+	socks_request.dest[host_length] = (char)((dest_port >> 8) & 0xff);
+	socks_request.dest[host_length + 1] = (char)(dest_port & 0xff);
+	request_length = sizeof(socks_request) - sizeof(socks_request.dest)
+	    + host_length + 2;
+
+	if (g_gate_send(sfd, &socks_request, request_length, MSG_NOSIGNAL) == -1)
+		g_gate_xlog("Failed to send SOCKS5 request.");
+
+	if (g_gate_recv(sfd, &response, sizeof(response), MSG_WAITALL) != sizeof(response))
+		g_gate_xlog("Failed to read SOCKS5 response.");
+
+	if (response[0] != '\x05' || response[1] != '\x00')
+		g_gate_xlog("Failed to SOCKS5 connect to %s:%d",
+		    socks_dest, dest_port);
+
+	g_gate_log(LOG_INFO, "Connected to: %s:%d.", socks_dest, dest_port);
+}
+
 static int
 handshake(int dir)
 {
@@ -300,6 +367,9 @@ handshake(int dir)
 
 	g_gate_log(LOG_INFO, "Connected to the server: %s:%d.", host, port);
 
+	if (socks_dest != NULL)
+		negotiate_socks_connection(sfd);
+
 	/*
 	 * Create and send version packet.
 	 */
@@ -479,8 +549,13 @@ g_gatec_create(void)
 	ggioc.gctl_maxcount = queue_size;
 	ggioc.gctl_timeout = timeout;
 	ggioc.gctl_unit = unit;
-	snprintf(ggioc.gctl_info, sizeof(ggioc.gctl_info), "%s:%u %s", host,
-	    port, path);
+	if (socks_dest != NULL)
+		snprintf(ggioc.gctl_info, sizeof(ggioc.gctl_info),
+		    "socks5://%s:%u -> %s:%u %s", host,
+		    port, socks_dest, dest_port, path);
+	else
+		snprintf(ggioc.gctl_info, sizeof(ggioc.gctl_info), "%s:%u %s",
+		    host, port, path);
 	g_gate_ioctl(G_GATE_CMD_CREATE, &ggioc);
 	if (unit == -1) {
 		printf("%s%u\n", G_GATE_PROVIDER_NAME, ggioc.gctl_unit);
@@ -529,8 +604,9 @@ main(int argc, char *argv[])
 	argv += 1;
 	for (;;) {
 		int ch;
+		char *p;
 
-		ch = getopt(argc, argv, "fno:p:q:R:S:s:t:u:v");
+		ch = getopt(argc, argv, "fno:p:q:R:S:s:t:T:u:v");
 		if (ch == -1)
 			break;
 		switch (ch) {
@@ -598,6 +674,24 @@ main(int argc, char *argv[])
 			if (sectorsize == 0 && errno != 0)
 				errx(EXIT_FAILURE, "Invalid sectorsize.");
 			break;
+		case 'T':
+			if (action != CREATE && action != RESCUE)
+				usage();
+			socks_dest = optarg;
+			p = strchr(socks_dest, ':');
+			if (p != NULL) {
+				errno = 0;
+				*p = '\0';
+				p++;
+				dest_port = strtoul(p, NULL, 10);
+				if (dest_port == 0 && errno != 0)
+					errx(EXIT_FAILURE,
+					    "Invalid socks5t port: %s.", p);
+			}
+			if (strlen(socks_dest) > (size_t)255)
+				errx(EXIT_FAILURE,
+				    "Socks destination address too long.");
+			break;
 		case 't':
 			if (action != CREATE)
 				usage();
-- 
2.32.0


From c2232f57c17f12fb468eecf9411b9f492dc9cd08 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Fri, 24 Apr 2015 15:26:42 +0200
Subject: [PATCH 11/30] ggatec.8: Document SOCKS5 support

Obtained from: ElectroBSD
---
 sbin/ggate/ggatec/ggatec.8 | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/sbin/ggate/ggatec/ggatec.8 b/sbin/ggate/ggatec/ggatec.8
index 6f761dcfd99b..ba3c9ecb6f0b 100644
--- a/sbin/ggate/ggatec/ggatec.8
+++ b/sbin/ggate/ggatec/ggatec.8
@@ -41,6 +41,7 @@
 .Op Fl R Ar rcvbuf
 .Op Fl S Ar sndbuf
 .Op Fl s Ar sectorsize
+.Op Fl T Ar remote_target:port
 .Op Fl t Ar timeout
 .Op Fl u Ar unit
 .Ar host
@@ -53,6 +54,7 @@
 .Op Fl p Ar port
 .Op Fl R Ar rcvbuf
 .Op Fl S Ar sndbuf
+.Op Fl T Ar remote_target:port
 .Fl u Ar unit
 .Ar host
 .Ar path
@@ -137,6 +139,9 @@ Sector size for
 .Nm ggate
 provider.
 If not specified, it is taken from the device, or set to 512 bytes for files.
+.It Fl T Ar remote_host:port
+Use SOCK5 to open connection to remote_host:port before switching
+to the ggated protocol.
 .It Fl t Ar timeout
 Number of seconds to wait before an I/O request will be canceled.
 Default is 0, which means no timeout.
@@ -167,6 +172,14 @@ server# ggated
 client# ggatec create -o ro server /dev/cd0
 ggate0
 client# mount_cd9660 /dev/ggate0 /cdrom
+
+.Ed
+Connect to 127.0.1.1:9050, SOCKS5-negotiate a connection to
+the Tor location hidden service czdqtfrgvizltdal.onion:1312
+and access a ZVOL:
+.Bd -literal -offset indent
+# ggatec create -T czdqtfrgvizltdal.onion:1312 -p 9050 \\
+                127.0.1.1 /dev/zvol/dpool/ggated/czdqtfrgvizltdal.eli
 .Ed
 .Sh SEE ALSO
 .Xr geom 4 ,
-- 
2.32.0


From c5ad13c0682d9965c4f259f0ff8a12368b71ff67 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Mon, 27 Apr 2015 19:10:17 +0200
Subject: [PATCH 12/30] ggatec: Reject unexpected GGATE commands in
 recv_thread()

Obtained from: ElectroBSD
---
 sbin/ggate/ggatec/ggatec.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sbin/ggate/ggatec/ggatec.c b/sbin/ggate/ggatec/ggatec.c
index c647deb614b5..99e46697efbe 100644
--- a/sbin/ggate/ggatec/ggatec.c
+++ b/sbin/ggate/ggatec/ggatec.c
@@ -242,6 +242,10 @@ recv_thread(void *arg __unused)
 			g_gate_log(LOG_ERR, "Received too big response: %zd", ggio.gctl_length);
 			break;
 		}
+		if (ggio.gctl_cmd != GGATE_CMD_READ &&
+		    ggio.gctl_cmd != GGATE_CMD_WRITE) {
+			g_gate_xlog("Unexpected GGATE_CMD: %d", ggio.gctl_cmd);
+		}
 
 		if (ggio.gctl_error == 0 && ggio.gctl_cmd == GGATE_CMD_READ) {
 			data = g_gate_recv(recvfd, ggio.gctl_data,
-- 
2.32.0


From 75c808108119d1c82baf45653b749ccf991ee923 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Mon, 27 Apr 2015 19:15:18 +0200
Subject: [PATCH 13/30] ggatec: Log if the remote side signals errors

Obtained from: ElectroBSD
---
 sbin/ggate/ggatec/ggatec.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sbin/ggate/ggatec/ggatec.c b/sbin/ggate/ggatec/ggatec.c
index 99e46697efbe..171c25b7d781 100644
--- a/sbin/ggate/ggatec/ggatec.c
+++ b/sbin/ggate/ggatec/ggatec.c
@@ -247,6 +247,12 @@ recv_thread(void *arg __unused)
 			g_gate_xlog("Unexpected GGATE_CMD: %d", ggio.gctl_cmd);
 		}
 
+		if (ggio.gctl_error != 0) {
+			g_gate_log(LOG_ERR,
+			    "Remote side signaled error %d: %s.",
+			    ggio.gctl_error, strerror(ggio.gctl_error));
+		}
+
 		if (ggio.gctl_error == 0 && ggio.gctl_cmd == GGATE_CMD_READ) {
 			data = g_gate_recv(recvfd, ggio.gctl_data,
 			    ggio.gctl_length, MSG_WAITALL);
-- 
2.32.0


From a4a74c364e33eb89c3a6b4879a04596637c23964 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Mon, 27 Apr 2015 19:53:30 +0200
Subject: [PATCH 14/30] ggate[cd]: Add BIO_FLUSH support

Let ggated transform BIO_FLUSH requests into fsync() calls.

Obtained from: ElectroBSD
---
 sbin/ggate/ggatec/ggatec.c |  8 +++++++-
 sbin/ggate/ggated/ggated.c | 23 ++++++++++++++++++-----
 sbin/ggate/shared/ggate.h  |  1 +
 3 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/sbin/ggate/ggatec/ggatec.c b/sbin/ggate/ggatec/ggatec.c
index 171c25b7d781..b9f159ce272f 100644
--- a/sbin/ggate/ggatec/ggatec.c
+++ b/sbin/ggate/ggatec/ggatec.c
@@ -149,6 +149,11 @@ send_thread(void *arg __unused)
 		case BIO_WRITE:
 			hdr.gh_cmd = GGATE_CMD_WRITE;
 			break;
+		case BIO_FLUSH:
+			g_gate_log(LOG_DEBUG, "FLUSH request");
+			hdr.gh_cmd = GGATE_CMD_FLUSH;
+			assert(ggio.gctl_length == 0);
+			break;
 		default:
 			g_gate_log(LOG_NOTICE, "Unknown gctl_cmd: %i", ggio.gctl_cmd);
 			ggio.gctl_error = EOPNOTSUPP;
@@ -243,7 +248,8 @@ recv_thread(void *arg __unused)
 			break;
 		}
 		if (ggio.gctl_cmd != GGATE_CMD_READ &&
-		    ggio.gctl_cmd != GGATE_CMD_WRITE) {
+		    ggio.gctl_cmd != GGATE_CMD_WRITE &&
+		    ggio.gctl_cmd != GGATE_CMD_FLUSH) {
 			g_gate_xlog("Unexpected GGATE_CMD: %d", ggio.gctl_cmd);
 		}
 
diff --git a/sbin/ggate/ggated/ggated.c b/sbin/ggate/ggated/ggated.c
index edbf9b952ba7..12517a51d70f 100644
--- a/sbin/ggate/ggated/ggated.c
+++ b/sbin/ggate/ggated/ggated.c
@@ -672,8 +672,10 @@ recv_thread(void *arg)
 		 * Reject requests that violate assertions in disk_thread().
 		 */
 		if (req->r_cmd != GGATE_CMD_READ &&
-		    req->r_cmd != GGATE_CMD_WRITE) {
-			g_gate_xlog("Request contains invalid command.");
+		    req->r_cmd != GGATE_CMD_WRITE &&
+		    req->r_cmd != GGATE_CMD_FLUSH) {
+			g_gate_xlog("Request contains invalid command: %d",
+			    req->r_cmd);
 		}
 		if (req->r_offset + req->r_length >
 		    (uintmax_t)conn->c_mediasize) {
@@ -696,9 +698,10 @@ recv_thread(void *arg)
 		}
 
 		/*
-		 * Allocate memory for data.
+		 * Allocate memory for data, except when flushing.
 		 */
-		req->r_data = malloc_waitok(req->r_length);
+		req->r_data = req->r_cmd != GGATE_CMD_FLUSH ?
+                    malloc_waitok(req->r_length) : NULL;
 
 		/*
 		 * Receive data to write for WRITE request.
@@ -758,7 +761,9 @@ disk_thread(void *arg)
 		/*
 		 * Check the request.
 		 */
-		assert(req->r_cmd == GGATE_CMD_READ || req->r_cmd == GGATE_CMD_WRITE);
+		assert(req->r_cmd == GGATE_CMD_READ ||
+		    req->r_cmd == GGATE_CMD_WRITE ||
+		    req->r_cmd == GGATE_CMD_FLUSH);
 		assert(req->r_offset + req->r_length <= (uintmax_t)conn->c_mediasize);
 		assert((req->r_offset % conn->c_sectorsize) == 0);
 		assert((req->r_length % conn->c_sectorsize) == 0);
@@ -782,6 +787,14 @@ disk_thread(void *arg)
 			free(req->r_data);
 			req->r_data = NULL;
 			break;
+		case GGATE_CMD_FLUSH:
+			g_gate_log(LOG_DEBUG, "Flushing");
+			if (fsync(fd)) {
+				req->r_error = errno;
+				g_gate_log(LOG_ERR, "Flushing failed: %s",
+				    strerror(errno));
+			}
+			break;
 		}
 		if (data != (ssize_t)req->r_length) {
 			/* Report short reads/writes as I/O errors. */
diff --git a/sbin/ggate/shared/ggate.h b/sbin/ggate/shared/ggate.h
index 9ea901036726..a649e7fd322d 100644
--- a/sbin/ggate/shared/ggate.h
+++ b/sbin/ggate/shared/ggate.h
@@ -57,6 +57,7 @@
 
 #define	GGATE_CMD_READ		0
 #define	GGATE_CMD_WRITE		1
+#define	GGATE_CMD_FLUSH		2
 
 extern int g_gate_devfd;
 extern int g_gate_verbose;
-- 
2.32.0


From 8469743a34e2d0475ae74f61e528eb7c7c540eb3 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Wed, 29 Apr 2015 12:44:56 +0200
Subject: [PATCH 15/30] ggatec: Log the command type for hdr packets (when
 debugging)

... and provide more details about failed requests.

Obtained from: ElectroBSD
---
 sbin/ggate/ggatec/ggatec.c | 11 ++++++++---
 sbin/ggate/shared/ggate.c  | 16 ++++++++++++++++
 sbin/ggate/shared/ggate.h  |  1 +
 3 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/sbin/ggate/ggatec/ggatec.c b/sbin/ggate/ggatec/ggatec.c
index b9f159ce272f..3be5d63a1ac9 100644
--- a/sbin/ggate/ggatec/ggatec.c
+++ b/sbin/ggate/ggatec/ggatec.c
@@ -176,7 +176,9 @@ send_thread(void *arg __unused)
 		g_gate_swap2n_hdr(&hdr);
 
 		data = g_gate_send(sendfd, &hdr, sizeof(hdr), MSG_NOSIGNAL);
-		g_gate_log(LOG_DEBUG, "Sent hdr packet.");
+		g_gate_log(LOG_DEBUG, "Sent hdr packet (%s).",
+		    g_gate_cmd2str(hdr.gh_cmd));
+
 		g_gate_swap2h_hdr(&hdr);
 		if (reconnect)
 			break;
@@ -234,7 +236,8 @@ recv_thread(void *arg __unused)
 			pthread_kill(sendtd, SIGUSR1);
 			break;
 		}
-		g_gate_log(LOG_DEBUG, "Received hdr packet.");
+		g_gate_log(LOG_DEBUG, "Received hdr packet (%s).",
+		    g_gate_cmd2str(hdr.gh_cmd));
 
 		ggio.gctl_seq = hdr.gh_seq;
 		ggio.gctl_cmd = hdr.gh_cmd;
@@ -255,7 +258,9 @@ recv_thread(void *arg __unused)
 
 		if (ggio.gctl_error != 0) {
 			g_gate_log(LOG_ERR,
-			    "Remote side signaled error %d: %s.",
+			    "%s for %d bytes at offset %d failed. "
+			    "Error %d: %s.", g_gate_cmd2str(ggio.gctl_cmd),
+			    ggio.gctl_length, ggio.gctl_offset,
 			    ggio.gctl_error, strerror(ggio.gctl_error));
 		}
 
diff --git a/sbin/ggate/shared/ggate.c b/sbin/ggate/shared/ggate.c
index 2f544f7a2c9c..6197540d9678 100644
--- a/sbin/ggate/shared/ggate.c
+++ b/sbin/ggate/shared/ggate.c
@@ -409,3 +409,19 @@ g_gate_str2ip(const char *str)
 		return (INADDR_NONE);
 	return (((struct in_addr *)(void *)hp->h_addr)->s_addr);
 }
+
+const char *
+g_gate_cmd2str(int cmd)
+{
+
+	switch (cmd) {
+	case GGATE_CMD_READ:
+		return ("GGATE_CMD_READ");
+	case GGATE_CMD_WRITE:
+		return ("GGATE_CMD_WRITE");
+	case GGATE_CMD_FLUSH:
+		return ("GGATE_CMD_FLUSH");
+	}
+
+	return ("unknown (invalid?) GGATE command");
+}
diff --git a/sbin/ggate/shared/ggate.h b/sbin/ggate/shared/ggate.h
index a649e7fd322d..50758708f522 100644
--- a/sbin/ggate/shared/ggate.h
+++ b/sbin/ggate/shared/ggate.h
@@ -114,6 +114,7 @@ void	g_gate_socket_settings(int sfd);
 void	g_gate_list(int unit, int verbose);
 #endif
 in_addr_t g_gate_str2ip(const char *str);
+const char *g_gate_cmd2str(int cmd);
 
 /*
  * g_gate_swap2h_* - functions swap bytes to host byte order (from big endian).
-- 
2.32.0


From 25852785c7a42108771c2a660679b7966e434cd2 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Wed, 6 May 2015 15:55:08 +0200
Subject: [PATCH 16/30] ggated disk_thread(): Include the command in the debug
 output

Obtained from: ElectroBSD
---
 sbin/ggate/ggated/ggated.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sbin/ggate/ggated/ggated.c b/sbin/ggate/ggated/ggated.c
index 12517a51d70f..5bc3979506c7 100644
--- a/sbin/ggate/ggated/ggated.c
+++ b/sbin/ggate/ggated/ggated.c
@@ -768,8 +768,10 @@ disk_thread(void *arg)
 		assert((req->r_offset % conn->c_sectorsize) == 0);
 		assert((req->r_length % conn->c_sectorsize) == 0);
 
-		g_gate_log(LOG_DEBUG, "%s: offset=%" PRIu64 " length=%" PRIu32,
-		     __func__, req->r_offset, req->r_length);
+		g_gate_log(LOG_DEBUG,
+		    "%s: cmd=%s offset=%" PRIu64 " length=%" PRIu32,
+		   __func__, g_gate_cmd2str(req->r_cmd), req->r_offset,
+		    req->r_length);
 
 		/*
 		 * Do the request.
-- 
2.32.0


From 3f2268c30ae3d92ed7d85f702ac34042bde8b166 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Tue, 5 May 2015 17:39:16 +0200
Subject: [PATCH 17/30] ggate[cd]: Add BIO_DELETE support

On the ggated side the requests are translated into writes of
zero which ZFS will convert into BIO_DELETE requests again when
zle compression is enabled.

Obtained from: ElectroBSD
---
 sbin/ggate/ggatec/ggatec.c |  5 ++++
 sbin/ggate/ggated/ggated.c | 47 ++++++++++++++++++++++++++++++++------
 sbin/ggate/shared/ggate.c  |  2 ++
 sbin/ggate/shared/ggate.h  |  1 +
 4 files changed, 48 insertions(+), 7 deletions(-)

diff --git a/sbin/ggate/ggatec/ggatec.c b/sbin/ggate/ggatec/ggatec.c
index 3be5d63a1ac9..b60fb35d5ff5 100644
--- a/sbin/ggate/ggatec/ggatec.c
+++ b/sbin/ggate/ggatec/ggatec.c
@@ -149,6 +149,10 @@ send_thread(void *arg __unused)
 		case BIO_WRITE:
 			hdr.gh_cmd = GGATE_CMD_WRITE;
 			break;
+		case BIO_DELETE:
+			g_gate_log(LOG_DEBUG, "DELETE request");
+			hdr.gh_cmd = GGATE_CMD_DELETE;
+			break;
 		case BIO_FLUSH:
 			g_gate_log(LOG_DEBUG, "FLUSH request");
 			hdr.gh_cmd = GGATE_CMD_FLUSH;
@@ -252,6 +256,7 @@ recv_thread(void *arg __unused)
 		}
 		if (ggio.gctl_cmd != GGATE_CMD_READ &&
 		    ggio.gctl_cmd != GGATE_CMD_WRITE &&
+		    ggio.gctl_cmd != GGATE_CMD_DELETE &&
 		    ggio.gctl_cmd != GGATE_CMD_FLUSH) {
 			g_gate_xlog("Unexpected GGATE_CMD: %d", ggio.gctl_cmd);
 		}
diff --git a/sbin/ggate/ggated/ggated.c b/sbin/ggate/ggated/ggated.c
index 5bc3979506c7..8bb5972ac576 100644
--- a/sbin/ggate/ggated/ggated.c
+++ b/sbin/ggate/ggated/ggated.c
@@ -651,6 +651,7 @@ recv_thread(void *arg)
 		 * Get header packet.
 		 */
 		req = malloc_waitok(sizeof(*req));
+		memset(req, 0, sizeof(*req));
 		data = g_gate_recv(fd, &req->r_hdr, sizeof(req->r_hdr),
 		    MSG_WAITALL);
 		if (data == 0) {
@@ -673,6 +674,7 @@ recv_thread(void *arg)
 		 */
 		if (req->r_cmd != GGATE_CMD_READ &&
 		    req->r_cmd != GGATE_CMD_WRITE &&
+		    req->r_cmd != GGATE_CMD_DELETE &&
 		    req->r_cmd != GGATE_CMD_FLUSH) {
 			g_gate_xlog("Request contains invalid command: %d",
 			    req->r_cmd);
@@ -692,21 +694,16 @@ recv_thread(void *arg)
 		 * the client. MAXPHYS is the hard limit in ggatec,
 		 * values above it are thus pretty suspicious.
 		 */
-		if (req->r_length > MAXPHYS) {
+		if (req->r_length > MAXPHYS && req->r_cmd != GGATE_CMD_DELETE) {
 			g_gate_xlog("Request length above MAXPHYS: %u > %u",
 			    (unsigned)req->r_length, MAXPHYS);
 		}
 
-		/*
-		 * Allocate memory for data, except when flushing.
-		 */
-		req->r_data = req->r_cmd != GGATE_CMD_FLUSH ?
-                    malloc_waitok(req->r_length) : NULL;
-
 		/*
 		 * Receive data to write for WRITE request.
 		 */
 		if (req->r_cmd == GGATE_CMD_WRITE) {
+			req->r_data = malloc_waitok(req->r_length);
 			g_gate_log(LOG_DEBUG, "Waiting for %u bytes of data...",
 			    req->r_length);
 			data = g_gate_recv(fd, req->r_data, req->r_length,
@@ -733,6 +730,34 @@ recv_thread(void *arg)
 	}
 }
 
+static ssize_t
+delete_range(int fd, size_t length, off_t offset)
+{
+	static char zeros[MAXPHYS];
+	size_t written;
+
+        written = 0;
+
+	do
+	{
+		int ret;
+		size_t bytes_left;
+		size_t chunk_size;
+
+		bytes_left = length - written;
+		chunk_size = bytes_left > MAXPHYS ? MAXPHYS : bytes_left;
+		ret = pwrite(fd, zeros, chunk_size, offset + written);
+		if (ret == -1)
+			return (written);
+		written += ret;
+	} while (written < length);
+
+	g_gate_log(LOG_DEBUG, "Overwritten %u bytes at offset %jd with zeros",
+	    written, (intmax_t)offset);
+
+	return (written);
+}
+
 static void *
 disk_thread(void *arg)
 {
@@ -763,6 +788,7 @@ disk_thread(void *arg)
 		 */
 		assert(req->r_cmd == GGATE_CMD_READ ||
 		    req->r_cmd == GGATE_CMD_WRITE ||
+		    req->r_cmd == GGATE_CMD_DELETE ||
 		    req->r_cmd == GGATE_CMD_FLUSH);
 		assert(req->r_offset + req->r_length <= (uintmax_t)conn->c_mediasize);
 		assert((req->r_offset % conn->c_sectorsize) == 0);
@@ -779,9 +805,16 @@ disk_thread(void *arg)
 		data = 0;
 		switch (req->r_cmd) {
 		case GGATE_CMD_READ:
+			assert(req->r_data == NULL);
+			req->r_data = malloc_waitok(req->r_length);
 			data = pread(fd, req->r_data, req->r_length,
 			    req->r_offset);
 			break;
+		case GGATE_CMD_DELETE:
+			data = delete_range(fd, req->r_length,
+			    req->r_offset);
+			assert((size_t)data <= req->r_length);
+			break;
 		case GGATE_CMD_WRITE:
 			data = pwrite(fd, req->r_data, req->r_length,
 			    req->r_offset);
diff --git a/sbin/ggate/shared/ggate.c b/sbin/ggate/shared/ggate.c
index 6197540d9678..d6be4948d9c6 100644
--- a/sbin/ggate/shared/ggate.c
+++ b/sbin/ggate/shared/ggate.c
@@ -419,6 +419,8 @@ g_gate_cmd2str(int cmd)
 		return ("GGATE_CMD_READ");
 	case GGATE_CMD_WRITE:
 		return ("GGATE_CMD_WRITE");
+	case GGATE_CMD_DELETE:
+		return ("GGATE_CMD_DELETE");
 	case GGATE_CMD_FLUSH:
 		return ("GGATE_CMD_FLUSH");
 	}
diff --git a/sbin/ggate/shared/ggate.h b/sbin/ggate/shared/ggate.h
index 50758708f522..cc67ca49571f 100644
--- a/sbin/ggate/shared/ggate.h
+++ b/sbin/ggate/shared/ggate.h
@@ -58,6 +58,7 @@
 #define	GGATE_CMD_READ		0
 #define	GGATE_CMD_WRITE		1
 #define	GGATE_CMD_FLUSH		2
+#define	GGATE_CMD_DELETE	3
 
 extern int g_gate_devfd;
 extern int g_gate_verbose;
-- 
2.32.0


From 64a4aa0898d6b1a1b1bb4f85cb319be6892afce0 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Wed, 29 Apr 2015 10:55:40 +0200
Subject: [PATCH 18/30] ggated send_thread(): Assert that we only send data for
 read requests

Obtained from: ElectroBSD
---
 sbin/ggate/ggated/ggated.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sbin/ggate/ggated/ggated.c b/sbin/ggate/ggated/ggated.c
index 8bb5972ac576..faf44cc11423 100644
--- a/sbin/ggate/ggated/ggated.c
+++ b/sbin/ggate/ggated/ggated.c
@@ -899,6 +899,7 @@ send_thread(void *arg)
 		g_gate_log(LOG_DEBUG, "Sent hdr packet.");
 		g_gate_swap2h_hdr(&req->r_hdr);
 		if (req->r_data != NULL) {
+			assert(req->r_cmd == GGATE_CMD_READ);
 			data = g_gate_send(fd, req->r_data, req->r_length, 0);
 			if (data != (ssize_t)req->r_length) {
 				g_gate_xlog("Error while sending data: %s.",
-- 
2.32.0


From ac883bd78be9e41e1f518cfcdbd6f606c4ccc1bb Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Mon, 4 May 2015 18:00:04 +0200
Subject: [PATCH 19/30] ggated: Open the listening socket CLOEXEC

Obtained from: ElectroBSD
---
 sbin/ggate/ggated/ggated.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sbin/ggate/ggated/ggated.c b/sbin/ggate/ggated/ggated.c
index faf44cc11423..436f7f8a6d98 100644
--- a/sbin/ggate/ggated/ggated.c
+++ b/sbin/ggate/ggated/ggated.c
@@ -1125,7 +1125,7 @@ main(int argc, char *argv[])
 	signal(SIGCHLD, SIG_IGN);
 	signal(SIGPIPE, SIG_IGN);
 
-	sfd = socket(AF_INET, SOCK_STREAM, 0);
+	sfd = socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, 0);
 	if (sfd == -1)
 		g_gate_xlog("Cannot open stream socket: %s.", strerror(errno));
 	bzero(&serv, sizeof(serv));
-- 
2.32.0


From 1afdd5b27b71647e0c61e7db0455c38f4c81543b Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Mon, 4 May 2015 18:31:46 +0200
Subject: [PATCH 20/30] ggated: Fix another socket leak

Obtained from: ElectroBSD
---
 sbin/ggate/ggated/ggated.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/sbin/ggate/ggated/ggated.c b/sbin/ggate/ggated/ggated.c
index 436f7f8a6d98..fed36964939f 100644
--- a/sbin/ggate/ggated/ggated.c
+++ b/sbin/ggate/ggated/ggated.c
@@ -344,6 +344,11 @@ exports_check(struct ggd_export *ex, struct g_gate_cinit *cinit,
 			return (EPERM);
 		}
 	}
+	if (conn->c_diskfd != -1) {
+		g_gate_log(LOG_DEBUG, "Requested file %s is already open: %d",
+		    ex->e_path, conn->c_diskfd);
+		return(0);
+	}
 	if ((conn->c_flags & GGATE_FLAG_RDONLY) != 0)
 		flags = O_RDONLY;
 	else if ((conn->c_flags & GGATE_FLAG_WRONLY) != 0)
-- 
2.32.0


From cd2468473b94066c062a36cf0b65a81189c6800a Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Thu, 30 Apr 2015 11:52:06 +0200
Subject: [PATCH 21/30] ggated recv_thread(): In case of read-only files, only
 accept read commands

Accepting write commands etc. is not a security problem because
the file descriptor isn't writeable anyway, but accepting requests
other than reads could hide client bugs.

Obtained from: ElectroBSD
---
 sbin/ggate/ggated/ggated.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sbin/ggate/ggated/ggated.c b/sbin/ggate/ggated/ggated.c
index fed36964939f..f811b853f79c 100644
--- a/sbin/ggate/ggated/ggated.c
+++ b/sbin/ggate/ggated/ggated.c
@@ -694,6 +694,12 @@ recv_thread(void *arg)
 			    "not fit sector size.");
 		}
 
+		if ((conn->c_flags & GGATE_FLAG_RDONLY) != 0
+		    && req->r_cmd != GGATE_CMD_READ) {
+			g_gate_xlog("%s request received for read-only file",
+			    g_gate_cmd2str(req->r_cmd));
+		}
+
 		/*
 		 * Limit the amount of memory we allocate on behalf of
 		 * the client. MAXPHYS is the hard limit in ggatec,
-- 
2.32.0


From 683c9158e97d16277ee806ae7c1fcf8a6c088724 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Sun, 3 May 2015 14:02:02 +0200
Subject: [PATCH 22/30] ggatec: Add log-to-file support

Obtained from: ElectroBSD
---
 sbin/ggate/ggatec/ggatec.c |  5 ++++-
 sbin/ggate/shared/ggate.c  | 26 +++++++++++++++++++++-----
 sbin/ggate/shared/ggate.h  |  1 +
 3 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/sbin/ggate/ggatec/ggatec.c b/sbin/ggate/ggatec/ggatec.c
index b60fb35d5ff5..6af026e80277 100644
--- a/sbin/ggate/ggatec/ggatec.c
+++ b/sbin/ggate/ggatec/ggatec.c
@@ -632,7 +632,7 @@ main(int argc, char *argv[])
 		int ch;
 		char *p;
 
-		ch = getopt(argc, argv, "fno:p:q:R:S:s:t:T:u:v");
+		ch = getopt(argc, argv, "fl:no:p:q:R:S:s:t:T:u:v");
 		if (ch == -1)
 			break;
 		switch (ch) {
@@ -641,6 +641,9 @@ main(int argc, char *argv[])
 				usage();
 			force = 1;
 			break;
+		case 'l':
+			g_gate_open_log(optarg);
+			break;
 		case 'n':
 			if (action != CREATE && action != RESCUE)
 				usage();
diff --git a/sbin/ggate/shared/ggate.c b/sbin/ggate/shared/ggate.c
index d6be4948d9c6..084db7304e53 100644
--- a/sbin/ggate/shared/ggate.c
+++ b/sbin/ggate/shared/ggate.c
@@ -28,6 +28,7 @@
  * $FreeBSD$
  */
 
+#define _WITH_DPRINTF
 #include <stdio.h>
 #include <stdlib.h>
 #include <unistd.h>
@@ -61,13 +62,23 @@
 
 int g_gate_devfd = -1;
 int g_gate_verbose = 0;
+static int g_gate_logfd = -1;
 
+void
+g_gate_open_log(const char *logfile)
+{
+
+	g_gate_logfd = open(logfile, O_CREAT | O_WRONLY | O_APPEND, S_IWUSR |S_IRUSR);
+	if (g_gate_logfd == -1) {
+		g_gate_xlog("Failed to open %s: %s", logfile, strerror(errno));
+	}
+}
 
 void
 g_gate_vlog(int priority, const char *message, va_list ap)
 {
 
-	if (g_gate_verbose) {
+	if (g_gate_verbose || g_gate_logfd != -1) {
 		const char *prefix;
 
 		switch (priority) {
@@ -89,10 +100,15 @@ g_gate_vlog(int priority, const char *message, va_list ap)
 		default:
 			prefix = "unknown";
 		}
-
-		printf("%s: ", prefix);
-		vprintf(message, ap);
-		printf("\n");
+		if (g_gate_logfd == -1) {
+			printf("%s: ", prefix);
+			vprintf(message, ap);
+			printf("\n");
+		} else if (g_gate_verbose || priority != LOG_DEBUG) {
+			dprintf(g_gate_logfd, "%s: ", prefix);
+			vdprintf(g_gate_logfd, message, ap);
+			dprintf(g_gate_logfd, "\n");
+		}
 	} else {
 		if (priority != LOG_DEBUG)
 			vsyslog(priority, message, ap);
diff --git a/sbin/ggate/shared/ggate.h b/sbin/ggate/shared/ggate.h
index cc67ca49571f..422a60e0b7d5 100644
--- a/sbin/ggate/shared/ggate.h
+++ b/sbin/ggate/shared/ggate.h
@@ -97,6 +97,7 @@ struct g_gate_hdr {
 	uint16_t	gh_error;	/* error value (0 if ok) */
 } __packed;
 
+void    g_gate_open_log(const char *logfile);
 void	g_gate_vlog(int priority, const char *message, va_list ap);
 void	g_gate_log(int priority, const char *message, ...);
 void	g_gate_xvlog(const char *message, va_list ap) __dead2;
-- 
2.32.0


From 19f6110f5f8aa994cbc788795b26774e4aaadf62 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Thu, 30 Apr 2015 13:52:39 +0200
Subject: [PATCH 23/30] ggate[cd]: Add Jail and Capsicum support

The capsicum support for ggatec is incomplete and only
enabled if the -c flag is used as it currently prevents
ggatec from reconnecting which is very inconvenient.

Obtained from: ElectroBSD
---
 sbin/ggate/ggatec/ggatec.8 |   8 +++
 sbin/ggate/ggatec/ggatec.c |  37 ++++++++--
 sbin/ggate/ggated/ggated.c |   5 ++
 sbin/ggate/shared/ggate.c  | 137 +++++++++++++++++++++++++++++++++++++
 sbin/ggate/shared/ggate.h  |   2 +
 5 files changed, 182 insertions(+), 7 deletions(-)

diff --git a/sbin/ggate/ggatec/ggatec.8 b/sbin/ggate/ggatec/ggatec.8
index ba3c9ecb6f0b..f4bf7cf43902 100644
--- a/sbin/ggate/ggatec/ggatec.8
+++ b/sbin/ggate/ggatec/ggatec.8
@@ -33,6 +33,7 @@
 .Sh SYNOPSIS
 .Nm
 .Cm create
+.Op Fl c
 .Op Fl n
 .Op Fl v
 .Op Fl o Cm ro | wo | rw
@@ -48,6 +49,7 @@
 .Ar path
 .Nm
 .Cm rescue
+.Op Fl c
 .Op Fl n
 .Op Fl v
 .Op Fl o Cm ro | wo | rw
@@ -104,6 +106,12 @@ providers.
 .Pp
 Available options:
 .Bl -tag -width ".Fl s Cm ro | wo | rw"
+.It Fl c
+Enter capsicum sandbox.
+Currently this prevents
+.Nm ggatec
+from reconnecting which is somewhat inconvenient.
+The flag will go away once this is fixed.
 .It Fl f
 Forcibly destroy
 .Nm ggate
diff --git a/sbin/ggate/ggatec/ggatec.c b/sbin/ggate/ggatec/ggatec.c
index 6af026e80277..93da6bd1173b 100644
--- a/sbin/ggate/ggatec/ggatec.c
+++ b/sbin/ggate/ggatec/ggatec.c
@@ -53,6 +53,7 @@
 #include <netinet/in.h>
 #include <netinet/tcp.h>
 #include <arpa/inet.h>
+#include <sys/capsicum.h>
 
 #include <geom/gate/g_gate.h>
 #include "ggate.h"
@@ -62,6 +63,8 @@ static enum { UNSET, CREATE, DESTROY, LIST, RESCUE } action = UNSET;
 
 static const char *path = NULL;
 static const char *host = NULL;
+static in_addr_t host_ip;
+static const char *logfile = NULL;
 static int unit = G_GATE_UNIT_AUTO;
 static unsigned flags = 0;
 static int force = 0;
@@ -76,6 +79,7 @@ static int sendfd, recvfd;
 static uint32_t token;
 static pthread_t sendtd, recvtd;
 static int reconnect;
+static int drop_capabilities = 0;
 
 static void
 usage(void)
@@ -369,7 +373,7 @@ handshake(int dir)
 	 */
 	bzero(&serv, sizeof(serv));
 	serv.sin_family = AF_INET;
-	serv.sin_addr.s_addr = g_gate_str2ip(host);
+	serv.sin_addr.s_addr = host_ip;
 	if (serv.sin_addr.s_addr == INADDR_NONE) {
 		g_gate_log(LOG_DEBUG, "Invalid IP/host name: %s.", host);
 		return (-1);
@@ -477,7 +481,7 @@ static void
 mydaemon(void)
 {
 
-	if (g_gate_verbose > 0)
+	if (logfile == NULL && g_gate_verbose > 0)
 		return;
 	if (daemon(0, 0) == 0)
 		return;
@@ -542,6 +546,10 @@ g_gatec_loop(void)
 	signal(SIGUSR1, signop);
 	for (;;) {
 		g_gatec_start();
+
+		if (cap_sandboxed())
+		    g_gate_xlog("Got disconnected while being sandboxed.");
+
 		g_gate_log(LOG_NOTICE, "Disconnected [%s %s]. Connecting...",
 		    host, path);
 		while (!g_gatec_connect()) {
@@ -564,9 +572,6 @@ g_gatec_create(void)
 	if (!g_gatec_connect())
 		g_gate_xlog("Cannot connect: %s.", strerror(errno));
 
-	/*
-	 * Ok, got both sockets, time to create provider.
-	 */
 	memset(&ggioc, 0, sizeof(ggioc));
 	ggioc.gctl_version = G_GATE_VERSION;
 	ggioc.gctl_mediasize = mediasize;
@@ -589,6 +594,9 @@ g_gatec_create(void)
 	}
 	unit = ggioc.gctl_unit;
 
+	if (drop_capabilities)
+		g_gate_drop_capabilities(sendfd, recvfd);
+
 	mydaemon();
 	g_gatec_loop();
 }
@@ -601,6 +609,9 @@ g_gatec_rescue(void)
 	if (!g_gatec_connect())
 		g_gate_xlog("Cannot connect: %s.", strerror(errno));
 
+	if (drop_capabilities)
+		g_gate_drop_capabilities(sendfd, recvfd);
+
 	ggioc.gctl_version = G_GATE_VERSION;
 	ggioc.gctl_unit = unit;
 	ggioc.gctl_seq = 0;
@@ -632,17 +643,21 @@ main(int argc, char *argv[])
 		int ch;
 		char *p;
 
-		ch = getopt(argc, argv, "fl:no:p:q:R:S:s:t:T:u:v");
+		ch = getopt(argc, argv, "cfl:no:p:q:R:S:s:t:T:u:v");
 		if (ch == -1)
 			break;
 		switch (ch) {
+		case 'c':
+			drop_capabilities = 1;
+			force = 1;
+			break;
 		case 'f':
 			if (action != DESTROY)
 				usage();
 			force = 1;
 			break;
 		case 'l':
-			g_gate_open_log(optarg);
+			logfile = optarg;
 			break;
 		case 'n':
 			if (action != CREATE && action != RESCUE)
@@ -754,7 +769,11 @@ main(int argc, char *argv[])
 		g_gate_load_module();
 		g_gate_open_device();
 		host = argv[0];
+		host_ip = g_gate_str2ip(host);
 		path = argv[1];
+		if (logfile != NULL)
+			g_gate_open_log(logfile);
+		g_gate_drop_privs("hast", host_ip);
 		g_gatec_create();
 		break;
 	case DESTROY:
@@ -778,7 +797,11 @@ main(int argc, char *argv[])
 		}
 		g_gate_open_device();
 		host = argv[0];
+		host_ip = g_gate_str2ip(host);
 		path = argv[1];
+		if (logfile != NULL)
+			g_gate_open_log(logfile);
+		g_gate_drop_privs("hast", host_ip);
 		g_gatec_rescue();
 		break;
 	case UNSET:
diff --git a/sbin/ggate/ggated/ggated.c b/sbin/ggate/ggated/ggated.c
index f811b853f79c..46c3063b02b2 100644
--- a/sbin/ggate/ggated/ggated.c
+++ b/sbin/ggate/ggated/ggated.c
@@ -560,6 +560,11 @@ connection_launch(struct ggd_connection *conn)
 	}
 	g_gate_log(LOG_DEBUG, "Process created [%s].", conn->c_path);
 
+	if (getuid() == 0)
+		g_gate_drop_privs("hast", bindaddr);
+
+	g_gate_drop_capabilities(conn->c_sendfd, conn->c_recvfd);
+
 	/*
 	 * Create condition variables and mutexes for in-queue and out-queue
 	 * synchronization.
diff --git a/sbin/ggate/shared/ggate.c b/sbin/ggate/shared/ggate.c
index 084db7304e53..4c0d3886f463 100644
--- a/sbin/ggate/shared/ggate.c
+++ b/sbin/ggate/shared/ggate.c
@@ -55,6 +55,11 @@
 #include <stdarg.h>
 #include <stdint.h>
 #include <libgeom.h>
+#include <sys/jail.h>
+#include <sys/types.h>
+#include <pwd.h>
+#include <assert.h>
+#include <sys/capsicum.h>
 
 #include <geom/gate/g_gate.h>
 #include "ggate.h"
@@ -443,3 +448,135 @@ g_gate_cmd2str(int cmd)
 
 	return ("unknown (invalid?) GGATE command");
 }
+
+/*
+ * The functions below are based on drop_privs() from ../../hastd/subr.c
+ *
+ * Changes:
+ * - HAST_USER replaced with ggate_user option
+ * - pjdlog_* replaced with g_gate_xlog().
+ * - Don't fall back to chroot if jailing fails.
+ */
+#define PJDLOG_VERIFY assert
+void
+g_gate_drop_privs(const char *ggate_user, in_addr_t jail_address)
+{
+	char jailhost[32];
+	struct jail jailst;
+	struct passwd *pw;
+	uid_t ruid, euid, suid;
+	gid_t rgid, egid, sgid;
+	gid_t gidset[1];
+        struct in_addr jail_ip;
+	/*
+	 * According to getpwnam(3) we have to clear errno before calling the
+	 * function to be able to distinguish between an error and missing
+	 * entry (with is not treated as error by getpwnam(3)).
+	 */
+	errno = 0;
+	pw = getpwnam(ggate_user);
+	if (pw == NULL) {
+		if (errno != 0) {
+			g_gate_xlog("Unable to find info about '%s' user",
+                            ggate_user);
+		} else {
+			g_gate_xlog("'%s' user doesn't exist.", ggate_user);
+		}
+	}
+
+        jail_ip.s_addr = jail_address;
+
+	bzero(&jailst, sizeof(jailst));
+	jailst.version = JAIL_API_VERSION;
+	jailst.path = pw->pw_dir;
+        (void)snprintf(jailhost, sizeof(jailhost), "%s-jail", getprogname());
+	jailst.hostname = jailhost;
+	jailst.jailname = NULL;
+	jailst.ip4s = 1;
+	jailst.ip4 = &jail_ip;
+	jailst.ip6s = 0;
+	jailst.ip6 = NULL;
+	if (jail(&jailst) == -1) {
+		g_gate_xlog("Unable to jail process in directory %s", pw->pw_dir);
+	}
+	PJDLOG_VERIFY(chdir("/") == 0);
+	gidset[0] = pw->pw_gid;
+	if (setgroups(1, gidset) == -1) {
+		g_gate_xlog("Unable to set groups to gid %u",
+		    (unsigned int)pw->pw_gid);
+	}
+	if (setgid(pw->pw_gid) == -1) {
+		g_gate_xlog("Unable to set gid to %u",
+		    (unsigned int)pw->pw_gid);
+	}
+	if (setuid(pw->pw_uid) == -1) {
+		g_gate_xlog("Unable to set uid to %u",
+		    (unsigned int)pw->pw_uid);
+	}
+
+	/*
+	 * Better be sure that everything succeeded.
+	 */
+	PJDLOG_VERIFY(getresuid(&ruid, &euid, &suid) == 0);
+	PJDLOG_VERIFY(ruid == pw->pw_uid);
+	PJDLOG_VERIFY(euid == pw->pw_uid);
+	PJDLOG_VERIFY(suid == pw->pw_uid);
+	PJDLOG_VERIFY(getresgid(&rgid, &egid, &sgid) == 0);
+	PJDLOG_VERIFY(rgid == pw->pw_gid);
+	PJDLOG_VERIFY(egid == pw->pw_gid);
+	PJDLOG_VERIFY(sgid == pw->pw_gid);
+	PJDLOG_VERIFY(getgroups(0, NULL) == 1);
+	PJDLOG_VERIFY(getgroups(1, gidset) == 1);
+	PJDLOG_VERIFY(gidset[0] == pw->pw_gid);
+
+	g_gate_log(LOG_DEBUG, "Privileges successfully dropped using "
+            "jail+setgid+setuid.");
+}
+
+int
+g_gate_drop_capabilities(int sendfd, int recvfd)
+{
+	cap_rights_t rights;
+	static const unsigned long ggatecmds[] = {
+	    G_GATE_CMD_START,
+	    G_GATE_CMD_DONE,
+	    G_GATE_CMD_CANCEL,
+	};
+
+	if (cap_enter() != 0) {
+		g_gate_xlog("Failed to sandbox using capsicum");
+	}
+
+	cap_rights_init(&rights, CAP_PREAD, CAP_PWRITE);
+	if (cap_rights_limit(sendfd, &rights) == -1) {
+		g_gate_xlog("Unable to limit capability "
+		    "rights on sendfd %d", sendfd);
+	}
+	if (cap_rights_limit(recvfd, &rights) == -1) {
+		g_gate_xlog("Unable to limit capability "
+		    "rights on recvfd %d", recvfd);
+	}
+
+	/* Only the client uses this. */
+	if (g_gate_devfd != -1) {
+		cap_rights_init(&rights, CAP_IOCTL, CAP_PREAD, CAP_PWRITE);
+		if (cap_rights_limit(g_gate_devfd, &rights) == -1) {
+			g_gate_xlog("Unable to limit capability rights "
+			    "to CAP_IOCTL on ggate descriptor");
+		}
+		if (cap_ioctls_limit(g_gate_devfd, ggatecmds,
+		    sizeof(ggatecmds) / sizeof(ggatecmds[0])) == -1) {
+			g_gate_xlog("Unable to limit allowed ggate ioctls");
+		}
+	}
+	cap_rights_init(&rights, CAP_PWRITE);
+	if (g_gate_logfd != -1 &&
+	   cap_rights_limit(g_gate_logfd, &rights) == -1) {
+		g_gate_xlog("Unable to limit capability "
+		    "rights on logfd %d", g_gate_logfd);
+	}
+
+	g_gate_log(LOG_DEBUG, "Entered Capsicum sandbox");
+
+	return (0);
+}
diff --git a/sbin/ggate/shared/ggate.h b/sbin/ggate/shared/ggate.h
index 422a60e0b7d5..37049e431a83 100644
--- a/sbin/ggate/shared/ggate.h
+++ b/sbin/ggate/shared/ggate.h
@@ -117,6 +117,8 @@ void	g_gate_list(int unit, int verbose);
 #endif
 in_addr_t g_gate_str2ip(const char *str);
 const char *g_gate_cmd2str(int cmd);
+void g_gate_drop_privs(const char *ggate_user, in_addr_t jail_address);
+int g_gate_drop_capabilities(int sendfd, int recvfd);
 
 /*
  * g_gate_swap2h_* - functions swap bytes to host byte order (from big endian).
-- 
2.32.0


From 7c0d273d4eb1aadf71c05223a29d31bee8ab8064 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Tue, 28 Apr 2015 13:02:25 +0200
Subject: [PATCH 24/30] Bump GGATE_VERSION due to FLUSH and DELETE support and
 various bug fixes

Unpatched ggate[cd] versions may cause data corruption
so we no longer want to speak to them.

Obtained from: ElectroBSD
---
 sbin/ggate/shared/ggate.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sbin/ggate/shared/ggate.h b/sbin/ggate/shared/ggate.h
index 37049e431a83..5d3a9bd6025b 100644
--- a/sbin/ggate/shared/ggate.h
+++ b/sbin/ggate/shared/ggate.h
@@ -42,7 +42,7 @@
 #define	G_GATE_TIMEOUT		0
 
 #define	GGATE_MAGIC		"GEOM_GATE       "
-#define	GGATE_VERSION		0
+#define	GGATE_VERSION		1
 
 #define	GGATE_FLAG_RDONLY	0x0001
 #define	GGATE_FLAG_WRONLY	0x0002
-- 
2.32.0


From 4c8234a0c4e3a9dee91c91d16f3914a86f3e516f Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Sun, 9 Aug 2015 15:20:48 +0200
Subject: [PATCH 25/30] ggate: Use dedicated users for ggatec and ggated

Obtained from: ElectroBSD
---
 etc/group                  | 2 ++
 etc/master.passwd          | 2 ++
 sbin/ggate/ggatec/ggatec.c | 4 ++--
 sbin/ggate/ggated/ggated.c | 2 +-
 4 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/etc/group b/etc/group
index 9f24beda5aea..48b2672dbbc2 100644
--- a/etc/group
+++ b/etc/group
@@ -32,6 +32,8 @@ www:*:80:
 ntpd:*:123:
 _ypldap:*:160:
 hast:*:845:
+ggatec:*:846:
+ggated:*:847:
 tests:*:977:
 nogroup:*:65533:
 nobody:*:65534:
diff --git a/etc/master.passwd b/etc/master.passwd
index a1be886f1e8d..2db4d7368058 100644
--- a/etc/master.passwd
+++ b/etc/master.passwd
@@ -25,5 +25,7 @@ www:*:80:80::0:0:World Wide Web Owner:/nonexistent:/usr/sbin/nologin
 ntpd:*:123:123::0:0:NTP Daemon:/var/db/ntp:/usr/sbin/nologin
 _ypldap:*:160:160::0:0:YP LDAP unprivileged user:/var/empty:/usr/sbin/nologin
 hast:*:845:845::0:0:HAST unprivileged user:/var/empty:/usr/sbin/nologin
+ggatec:*:846:846::0:0:ggatec unprivileged user:/var/empty:/usr/sbin/nologin
+ggated:*:847:847::0:0:ggated unprivileged user:/var/empty:/usr/sbin/nologin
 tests:*:977:977::0:0:Unprivileged user for tests:/nonexistent:/usr/sbin/nologin
 nobody:*:65534:65534::0:0:Unprivileged user:/nonexistent:/usr/sbin/nologin
diff --git a/sbin/ggate/ggatec/ggatec.c b/sbin/ggate/ggatec/ggatec.c
index 93da6bd1173b..ee719aabf17c 100644
--- a/sbin/ggate/ggatec/ggatec.c
+++ b/sbin/ggate/ggatec/ggatec.c
@@ -773,7 +773,7 @@ main(int argc, char *argv[])
 		path = argv[1];
 		if (logfile != NULL)
 			g_gate_open_log(logfile);
-		g_gate_drop_privs("hast", host_ip);
+		g_gate_drop_privs("ggatec", host_ip);
 		g_gatec_create();
 		break;
 	case DESTROY:
@@ -801,7 +801,7 @@ main(int argc, char *argv[])
 		path = argv[1];
 		if (logfile != NULL)
 			g_gate_open_log(logfile);
-		g_gate_drop_privs("hast", host_ip);
+		g_gate_drop_privs("ggatec", host_ip);
 		g_gatec_rescue();
 		break;
 	case UNSET:
diff --git a/sbin/ggate/ggated/ggated.c b/sbin/ggate/ggated/ggated.c
index 46c3063b02b2..82df8a8aa391 100644
--- a/sbin/ggate/ggated/ggated.c
+++ b/sbin/ggate/ggated/ggated.c
@@ -561,7 +561,7 @@ connection_launch(struct ggd_connection *conn)
 	g_gate_log(LOG_DEBUG, "Process created [%s].", conn->c_path);
 
 	if (getuid() == 0)
-		g_gate_drop_privs("hast", bindaddr);
+		g_gate_drop_privs("ggated", bindaddr);
 
 	g_gate_drop_capabilities(conn->c_sendfd, conn->c_recvfd);
 
-- 
2.32.0


From d566254205e8df594ee4d2c4be8ca9e514b8bf70 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Fri, 28 Apr 2017 22:46:35 +0200
Subject: [PATCH 26/30] ggate: Increase maximum BIO length to 1MB

This is required for ggatec/ggated to work with
ZFS pools with recordsize=1m.

XXX: Incrementing the zeros buffer shouldn't be necessary
and is unlikely to speed up the trimming.

Obtained from: ElectroBSD
---
 sbin/ggate/ggatec/ggatec.c |  6 +++---
 sbin/ggate/ggated/ggated.c | 17 ++++++++++-------
 sbin/ggate/shared/ggate.h  |  2 ++
 3 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/sbin/ggate/ggatec/ggatec.c b/sbin/ggate/ggatec/ggatec.c
index ee719aabf17c..37f03f4423ec 100644
--- a/sbin/ggate/ggatec/ggatec.c
+++ b/sbin/ggate/ggatec/ggatec.c
@@ -102,7 +102,7 @@ send_thread(void *arg __unused)
 {
 	struct g_gate_ctl_io ggio;
 	struct g_gate_hdr hdr;
-	char buf[MAXPHYS];
+	char buf[GGATE_MAX_BIO_LENGTH];
 	ssize_t data;
 	int error;
 
@@ -170,7 +170,7 @@ send_thread(void *arg __unused)
 		}
 
 		/* Don't send requests for more data than we can handle the response for! */
-		if (ggio.gctl_length > MAXPHYS) {
+		if (ggio.gctl_length > GGATE_MAX_BIO_LENGTH) {
 			g_gate_log(LOG_ERR, "Request too big: %zd", ggio.gctl_length);
 			ggio.gctl_error = EOPNOTSUPP;
 			g_gate_ioctl(G_GATE_CMD_DONE, &ggio);
@@ -222,7 +222,7 @@ recv_thread(void *arg __unused)
 {
 	struct g_gate_ctl_io ggio;
 	struct g_gate_hdr hdr;
-	char buf[MAXPHYS];
+	char buf[GGATE_MAX_BIO_LENGTH];
 	ssize_t data;
 
 	g_gate_log(LOG_NOTICE, "%s: started!", __func__);
diff --git a/sbin/ggate/ggated/ggated.c b/sbin/ggate/ggated/ggated.c
index 82df8a8aa391..132998bab152 100644
--- a/sbin/ggate/ggated/ggated.c
+++ b/sbin/ggate/ggated/ggated.c
@@ -707,12 +707,14 @@ recv_thread(void *arg)
 
 		/*
 		 * Limit the amount of memory we allocate on behalf of
-		 * the client. MAXPHYS is the hard limit in ggatec,
-		 * values above it are thus pretty suspicious.
+		 * the client. GGATE_MAX_BIO_LENGTH is the hard limit in
+		 * ggatec, values above it are thus pretty suspicious.
 		 */
-		if (req->r_length > MAXPHYS && req->r_cmd != GGATE_CMD_DELETE) {
-			g_gate_xlog("Request length above MAXPHYS: %u > %u",
-			    (unsigned)req->r_length, MAXPHYS);
+		if (req->r_length > GGATE_MAX_BIO_LENGTH &&
+		    req->r_cmd != GGATE_CMD_DELETE) {
+			g_gate_xlog("Request length above "
+			    "GGATE_MAX_BIO_LENGTH: %u > %u",
+			    (unsigned)req->r_length, GGATE_MAX_BIO_LENGTH);
 		}
 
 		/*
@@ -749,7 +751,7 @@ recv_thread(void *arg)
 static ssize_t
 delete_range(int fd, size_t length, off_t offset)
 {
-	static char zeros[MAXPHYS];
+	static char zeros[GGATE_MAX_BIO_LENGTH];
 	size_t written;
 
         written = 0;
@@ -761,7 +763,8 @@ delete_range(int fd, size_t length, off_t offset)
 		size_t chunk_size;
 
 		bytes_left = length - written;
-		chunk_size = bytes_left > MAXPHYS ? MAXPHYS : bytes_left;
+		chunk_size = bytes_left > sizeof(zeros) ?
+		    sizeof(zeros) : bytes_left;
 		ret = pwrite(fd, zeros, chunk_size, offset + written);
 		if (ret == -1)
 			return (written);
diff --git a/sbin/ggate/shared/ggate.h b/sbin/ggate/shared/ggate.h
index 5d3a9bd6025b..bb6ddc4ac8f8 100644
--- a/sbin/ggate/shared/ggate.h
+++ b/sbin/ggate/shared/ggate.h
@@ -60,6 +60,8 @@
 #define	GGATE_CMD_FLUSH		2
 #define	GGATE_CMD_DELETE	3
 
+#define GGATE_MAX_BIO_LENGTH	1048576
+
 extern int g_gate_devfd;
 extern int g_gate_verbose;
 
-- 
2.32.0


From ce9465d1c4c7f7f820de434d3587a72199f5df33 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Sun, 19 Apr 2015 22:58:49 +0200
Subject: [PATCH 27/30] ggated: Default to listening to 127.0.0.1 only

Obtained from: ElectroBSD
---
 sbin/ggate/ggated/ggated.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sbin/ggate/ggated/ggated.c b/sbin/ggate/ggated/ggated.c
index 132998bab152..d7fa6b62769c 100644
--- a/sbin/ggate/ggated/ggated.c
+++ b/sbin/ggate/ggated/ggated.c
@@ -1074,7 +1074,7 @@ main(int argc, char *argv[])
 	int ch, sfd, tmpsfd;
 	unsigned port;
 
-	bindaddr = htonl(INADDR_ANY);
+	bindaddr = g_gate_str2ip("127.0.0.1");
 	port = G_GATE_PORT;
 	while ((ch = getopt(argc, argv, "a:hnp:F:R:S:v")) != -1) {
 		switch (ch) {
-- 
2.32.0


From 7cd2ce8a4ae591f80d0c50f004eab7f261dda96e Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Mon, 1 Nov 2021 15:06:57 +0100
Subject: [PATCH 28/30] ggated: Add undocumented -j option to test jailing

Obtained from: ElectroBSD
---
 sbin/ggate/ggated/ggated.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/sbin/ggate/ggated/ggated.c b/sbin/ggate/ggated/ggated.c
index d7fa6b62769c..656cfe6e7e66 100644
--- a/sbin/ggate/ggated/ggated.c
+++ b/sbin/ggate/ggated/ggated.c
@@ -1073,10 +1073,11 @@ main(int argc, char *argv[])
 	pid_t otherpid;
 	int ch, sfd, tmpsfd;
 	unsigned port;
+	int g_gate_jail_test = 0;
 
 	bindaddr = g_gate_str2ip("127.0.0.1");
 	port = G_GATE_PORT;
-	while ((ch = getopt(argc, argv, "a:hnp:F:R:S:v")) != -1) {
+	while ((ch = getopt(argc, argv, "a:hnjp:F:R:S:v")) != -1) {
 		switch (ch) {
 		case 'a':
 			bindaddr = g_gate_str2ip(optarg);
@@ -1088,6 +1089,9 @@ main(int argc, char *argv[])
 		case 'F':
 			ggated_pidfile = optarg;
 			break;
+		case 'j':
+			g_gate_jail_test = 1;
+			break;
 		case 'n':
 			nagle = 0;
 			break;
@@ -1122,7 +1126,8 @@ main(int argc, char *argv[])
 
 	if (argv[0] != NULL)
 		exports_file = argv[0];
-	exports_get();
+	if (!g_gate_jail_test)
+		exports_get();
 
 	pfh = pidfile_open(ggated_pidfile, 0600, &otherpid);
 	if (pfh == NULL) {
@@ -1163,6 +1168,12 @@ main(int argc, char *argv[])
 
 	signal(SIGHUP, huphandler);
 
+	if (g_gate_jail_test) {
+		g_gate_drop_privs("ggated", bindaddr);
+		pidfile_remove(pfh);
+		exit(EXIT_SUCCESS);
+	}
+
 	for (;;) {
 		fromlen = sizeof(from);
 		tmpsfd = accept(sfd, &from, &fromlen);
-- 
2.32.0


From a1d6c30ff4e42fb4a2d7fd704a5052d78ec54265 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Mon, 1 Nov 2021 16:32:40 +0100
Subject: [PATCH 29/30] ggated: Add undocumented -J flag to disable jailing

Should work around:

    fk@r500 ~ $sudo ggated -v -j
    info: Reading exports file (/etc/gg.exports).
    debug: Added 127.0.0.1/32 /dev/zvol/r500/ggated/t520.eli RW to exports list.
    info: Exporting 1 object(s).
    info: Listen on port: 3080.
    error: Unable to jail process in directory /var/empty
    error: Exiting.

Obtained from: ElectroBSD
---
 sbin/ggate/ggated/ggated.c | 5 ++++-
 sbin/ggate/shared/ggate.c  | 3 ++-
 sbin/ggate/shared/ggate.h  | 1 +
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/sbin/ggate/ggated/ggated.c b/sbin/ggate/ggated/ggated.c
index 656cfe6e7e66..ee308ccf65c3 100644
--- a/sbin/ggate/ggated/ggated.c
+++ b/sbin/ggate/ggated/ggated.c
@@ -1077,7 +1077,7 @@ main(int argc, char *argv[])
 
 	bindaddr = g_gate_str2ip("127.0.0.1");
 	port = G_GATE_PORT;
-	while ((ch = getopt(argc, argv, "a:hnjp:F:R:S:v")) != -1) {
+	while ((ch = getopt(argc, argv, "a:hnjJp:F:R:S:v")) != -1) {
 		switch (ch) {
 		case 'a':
 			bindaddr = g_gate_str2ip(optarg);
@@ -1089,6 +1089,9 @@ main(int argc, char *argv[])
 		case 'F':
 			ggated_pidfile = optarg;
 			break;
+		case 'J':
+			g_gate_no_jailing = 1;
+			break;
 		case 'j':
 			g_gate_jail_test = 1;
 			break;
diff --git a/sbin/ggate/shared/ggate.c b/sbin/ggate/shared/ggate.c
index 4c0d3886f463..05a2cdcd1f83 100644
--- a/sbin/ggate/shared/ggate.c
+++ b/sbin/ggate/shared/ggate.c
@@ -66,6 +66,7 @@
 
 
 int g_gate_devfd = -1;
+int g_gate_no_jailing = 0;
 int g_gate_verbose = 0;
 static int g_gate_logfd = -1;
 
@@ -496,7 +497,7 @@ g_gate_drop_privs(const char *ggate_user, in_addr_t jail_address)
 	jailst.ip4 = &jail_ip;
 	jailst.ip6s = 0;
 	jailst.ip6 = NULL;
-	if (jail(&jailst) == -1) {
+	if (!g_gate_no_jailing && jail(&jailst) == -1) {
 		g_gate_xlog("Unable to jail process in directory %s", pw->pw_dir);
 	}
 	PJDLOG_VERIFY(chdir("/") == 0);
diff --git a/sbin/ggate/shared/ggate.h b/sbin/ggate/shared/ggate.h
index bb6ddc4ac8f8..0a648d5e3513 100644
--- a/sbin/ggate/shared/ggate.h
+++ b/sbin/ggate/shared/ggate.h
@@ -63,6 +63,7 @@
 #define GGATE_MAX_BIO_LENGTH	1048576
 
 extern int g_gate_devfd;
+extern int g_gate_no_jailing;
 extern int g_gate_verbose;
 
 extern int nagle;
-- 
2.32.0


From a411e44572a667c825c3e38f844f8add09500d90 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Sun, 7 Nov 2021 17:35:51 +0100
Subject: [PATCH 30/30] Add sysctl to control whether or not pwd_chroot_chdir()
 calls chroot_refuse_vdir_fds()

Obtained from: ElectroBSD
---
 sys/kern/kern_descrip.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/sys/kern/kern_descrip.c b/sys/kern/kern_descrip.c
index 6e97a1e8e2f5..5dfcc7b9a950 100644
--- a/sys/kern/kern_descrip.c
+++ b/sys/kern/kern_descrip.c
@@ -3290,6 +3290,12 @@ pwd_chdir(struct thread *td, struct vnode *vp)
 	vrele(oldvp);
 }
 
+static int pwd_chroot_chdir_check_open_directories = 1;
+
+SYSCTL_INT(_kern, OID_AUTO, pwd_chroot_chdir_check_open_directories, CTLFLAG_RW,
+    &pwd_chroot_chdir_check_open_directories, 0,
+    "Let pwd_chroot_chdir() check for open directories and fail if there are any");
+
 /*
  * jail_attach(2) changes both root and working directories.
  */
@@ -3302,10 +3308,12 @@ pwd_chroot_chdir(struct thread *td, struct vnode *vp)
 
 	fdp = td->td_proc->p_fd;
 	FILEDESC_XLOCK(fdp);
-	error = chroot_refuse_vdir_fds(fdp);
-	if (error != 0) {
-		FILEDESC_XUNLOCK(fdp);
-		return (error);
+	if (pwd_chroot_chdir_check_open_directories != 0) {
+		error = chroot_refuse_vdir_fds(fdp);
+		if (error != 0) {
+			FILEDESC_XUNLOCK(fdp);
+			return (error);
+		}
 	}
 	oldvrp = fdp->fd_rdir;
 	vrefact(vp);
-- 
2.32.0