carp: retire ioctl(2) API

[glebius]

Summary

All supported stable branches use netlink(4) API to configure carp(4).
The deleted code also has kernel stack leak vulnerability, that requires
extra effort to fix.

[glebius]

For the stable branches I don't see a value in investing time for a proper fix. Instead, for the stable/15 and stable/14 I'm thinking of just refusing wildcard SIOCGVH with error. This will close the security hole and if somebody uses ifconfig(8) from stable/13 on a supported stable system, they would still be able to configure CARP vhids. The wildcard SIOCGVH will return error instead of leaking kernel memory as a return value. So, it will actually be less broken then it is now.

P.S. I'm 99% sure that no software outside the tree use these ioctls.

[glebius]

Remove unneeded assignment.

[ae]

Also, there are some references in carp(4) man page and ifconfig code.

[bms]

OT: carp(4) could do with being refactored to use HMAC from opencrypto rather than rolling its own.

[pouria]

sys/netinet/ip_carp.h

187

do we need this?

[pouria]

sys/netinet/ip_carp.c

2586–2589

Shouldn't be more graceful?
for example (dirty):

[pouria]

sys/netinet/ip_carp.c

2628

As far as I can understand, this lock only used for write operations and we don't perform any write operation under nl_get.
otherwise, we probably used it too late in other functions!

[pouria]

tested, works. LGTM

[glebius]

sys/netinet/ip_carp.c

2586–2589

That would be functional change for the Netlink handler and the goal of this change is to just remove ioctl(2) and don't introduce any behavior changes to Netlink.

2628

Could be so, but again the goal is not introduce any logical changes to the netlink configuration path. For reading the lock is indeed almost not needed. The sc->sc_key can't be copied atomically, but we probably are protected by the carp_sx.

[glebius]

• Verbose error output in ifconfig(8) instead of old ioctl name.
• Remove carp_ioctl() declaration.
• Remove mentioning ioctls from manual.