fix(net): tighten sendto non-IP fall-through to close a destination-policy TOCTOU

Splits the high-priority sendto half out of #130 (per the maintainer's request
to land it as a fix that can go in quickly).

A non-IP sendto with no fs-path gate previously fell through to `_ => Continue`,
letting the kernel re-read `sockfd` and the destination after the supervisor's
decision. Under an active destination policy a child could race a
`dup2(inet_sock, sockfd)` + address swap into that window and ride the Continue
out to a denied IP.

Under `has_net_destination_policy` the arm no longer Continues: it pins the fd
via `dup_fd_from_pid`, classifies on the STABLE socket domain via the new pure
`classify_send_path` helper, and either sends the unix datagram on-behalf on the
pinned fd (UnixOnBehalf) or fails closed with EAFNOSUPPORT. With no destination
policy there is nothing to bypass, so Continue is preserved. The non-UnixOnBehalf
outcomes collapse to a single fail-closed errno arm rather than unreachable!(),
so any future drift in the classifier fails closed instead of panicking (a panic
on this seccomp-notif path would unwind the supervisor and DoS the sandbox).

The pure `classify_send_path` helper and its 4 unit tests land here (sendto is
its first consumer); `send_path_non_ip_on_non_unix_socket_is_rejected` is the
deterministic fail-without-fix witness (pre-fix logic yielded Continue). The
sendmsg/sendmmsg symmetric rework consumes the same helper and stays in draft
#130 — so until #130 lands, sendto and sendmsg differ on a non-IP unix datagram
(sendto sends on-behalf, sendmsg still returns EAFNOSUPPORT); this preserves the
pre-existing sendto behavior (it already sent via Continue) while closing its
TOCTOU, and #130 aligns sendmsg.

Behavior scope (fail-closed hardening, only under a destination policy): a non-IP
send on a non-unix/non-IP datagram family (AF_PACKET/AF_VSOCK/...) now returns
EAFNOSUPPORT instead of Continue; abstract/named-fs-gate-off unix datagrams now
send on-behalf, so the receiver observes the supervisor's SO_PEERCRED rather than
the child's. Same Continue-shape as the chroot AF_UNIX gate report (#143).

Author: dzerik

crates/sandlock-core/src/network/send.rs

@@ -21,7 +21,7 @@ use super::unix::{
     mmsg_entry_named_unix_path, sendmmsg_named_unix_on_behalf, sendto_named_unix_on_behalf,
     unix_sendmsg_gate,
 };
-use super::verdict::{check_ip_destination, path_under_any};
+use super::verdict::{check_ip_destination, classify_send_path, path_under_any, SendPath};
 use super::{query_socket_protocol, socket_is_unix, Protocol};
 
 // ============================================================
@@ -127,7 +127,54 @@ pub(super) async fn sendto_on_behalf(
                     )
                 }
             }
-            _ => NotifAction::Continue,
+            _ => {
+                // Non-IP destination with no fs-path gate: an abstract unix
+                // address, a named unix address with the fs-gate off, or a non-IP
+                // address on a non-unix socket. With NO destination policy there
+                // is nothing to bypass, so Continue (matching the connected fast
+                // path). Under a destination policy do NOT Continue: the kernel
+                // would re-read `sockfd` and the address after our decision, and a
+                // racing `dup2(inet_sock, sockfd)` + address swap could ride the
+                // Continue out to a denied IP. Pin the fd and gate on its STABLE
+                // socket domain instead. NOTE: this fails closed for non-IP sends
+                // on non-unix/non-IP datagram families (AF_PACKET/AF_VSOCK/...)
+                // under a destination policy — see the PR description.
+                if !ctx.policy.has_net_destination_policy {
+                    return NotifAction::Continue;
+                }
+                let dup_fd = match crate::seccomp::notif::dup_fd_from_pid(notif.pid, sockfd) {
+                    Ok(fd) => fd,
+                    Err(e) => return NotifAction::Errno(e.raw_os_error().unwrap_or(libc::EBADF)),
+                };
+                // The address is non-IP here (parse_ip_from_sockaddr returned
+                // None), so classify on the pinned socket's stable domain.
+                match classify_send_path(false, None, socket_is_unix(dup_fd.as_raw_fd())) {
+                    SendPath::UnixOnBehalf => {
+                        let data =
+                            match read_child_mem(notif_fd, notif.id, notif.pid, buf_ptr, buf_len) {
+                                Ok(b) => b,
+                                Err(_) => return NotifAction::Errno(libc::EIO),
+                            };
+                        let m = MaterializedMsg {
+                            data,
+                            control: None,
+                            addr: addr_bytes,
+                            _scm_fds: Vec::new(),
+                            _pinned: None,
+                        };
+                        let blocking = wants_blocking(dup_fd.as_raw_fd(), flags);
+                        resolve_send(dup_fd, m, flags, blocking)
+                    }
+                    // Reject (non-IP address on a non-unix socket — the
+                    // address-family-swap shape) and, defensively, the
+                    // connected/IP variants that classify_send_path(false, None, _)
+                    // cannot return: fail closed with an errno (parity with the
+                    // sendmsg Reject arm) rather than panic in the seccomp-notif
+                    // supervisor — a panic on this untrusted path would unwind the
+                    // supervisor task and DoS the whole sandbox.
+                    _ => NotifAction::Errno(libc::EAFNOSUPPORT),
+                }
+            }
         }
     }
 }

crates/sandlock-core/src/network/verdict.rs

@@ -76,6 +76,47 @@ pub(crate) fn path_under_any(path: &std::path::Path, prefixes: &[std::path::Path
     prefixes.iter().any(|p| norm.starts_with(p))
 }
 
+/// The send path selected for one message, from the already-parsed destination
+/// shape and the *stable* socket domain. Pure: the caller supplies whether the
+/// message is connected, the parsed IP (if any), and whether the pinned socket
+/// is `AF_UNIX`, so the decision is unit-testable and cannot re-read child state.
+///
+/// The unix-datagram arm sends on-behalf on the pinned fd rather than returning
+/// `Continue`: gating on the transient address family and Continuing would let a
+/// racing `dup2(inet_sock, sockfd)` + `msg_name` swap ride out on the kernel's
+/// re-read and reach a denied IP. Sending on the pinned fd we already checked
+/// closes that window.
+#[derive(Debug, PartialEq, Eq)]
+pub(crate) enum SendPath {
+    /// Connected socket: no per-message destination; send on-behalf, no check.
+    ConnectedOnBehalf,
+    /// IP destination: validate `ip` against the allowlist, then send on-behalf.
+    IpChecked(IpAddr),
+    /// Non-IP address on a unix-domain socket: a unix datagram; send on-behalf on
+    /// the pinned fd with no IP check (the kernel constrains a unix socket to
+    /// unix peers, and we never Continue).
+    UnixOnBehalf,
+    /// Non-IP address on a non-unix socket: the address-family-swap shape; fail
+    /// closed with `EAFNOSUPPORT`.
+    Reject,
+}
+
+/// Classify a send destination into the [`SendPath`] the handler should take.
+pub(crate) fn classify_send_path(
+    connected: bool,
+    ip: Option<IpAddr>,
+    is_unix_socket: bool,
+) -> SendPath {
+    if connected {
+        return SendPath::ConnectedOnBehalf;
+    }
+    match ip {
+        Some(ip) => SendPath::IpChecked(ip),
+        None if is_unix_socket => SendPath::UnixOnBehalf,
+        None => SendPath::Reject,
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -120,4 +161,43 @@ mod tests {
         let allowed: IpAddr = "10.0.0.1".parse().unwrap();
         assert_eq!(destination_verdict(&p, allowed, None), Err(ECONNREFUSED));
     }
+
+    #[test]
+    fn send_path_connected_never_checks_address() {
+        // A connected socket carries no per-message destination; the parsed
+        // address and socket domain are irrelevant.
+        let ip: IpAddr = "10.0.0.1".parse().unwrap();
+        assert_eq!(
+            classify_send_path(true, Some(ip), false),
+            SendPath::ConnectedOnBehalf
+        );
+        assert_eq!(
+            classify_send_path(true, None, true),
+            SendPath::ConnectedOnBehalf
+        );
+    }
+
+    #[test]
+    fn send_path_ip_destination_is_checked() {
+        let ip: IpAddr = "10.0.0.1".parse().unwrap();
+        assert_eq!(classify_send_path(false, Some(ip), false), SendPath::IpChecked(ip));
+        // Socket domain does not override a parsed IP destination.
+        assert_eq!(classify_send_path(false, Some(ip), true), SendPath::IpChecked(ip));
+    }
+
+    #[test]
+    fn send_path_non_ip_on_unix_socket_goes_on_behalf() {
+        // A non-IP address on a unix-domain socket is a unix datagram: send it
+        // on-behalf on the pinned fd (never Continue), so a raced fd/addr swap
+        // cannot redirect it to a denied IP.
+        assert_eq!(classify_send_path(false, None, true), SendPath::UnixOnBehalf);
+    }
+
+    #[test]
+    fn send_path_non_ip_on_non_unix_socket_is_rejected() {
+        // A non-IP address on a non-unix (IP) socket is the address-family-swap
+        // shape; fail closed. Pre-fix logic returned Continue for this input, so
+        // this assertion is the deterministic fail-without-fix witness.
+        assert_eq!(classify_send_path(false, None, false), SendPath::Reject);
+    }
 }