On Tue, 26 Nov 2013 12:48:01 +0000, Ben Morrow wrote: > To: [email protected]
Restoring cc ipfw@ and others after the inet_pton side?thread in stable@. grepping /usr/src for inet_pton suggests that a behavioural change in inet_pton at this stage seems rather unlikely :) > Quoth Michael Butler <[email protected]>: > > > > Misinterpreting "10.2.3.01" as "0.0.0.10/32" without so much as a > > warning from either inet_pton() or ipfw is an egregious breach of POLA, > > That's not a bug in inet_pton, though, that's a bug in ipfw. It's > blindly passing the string to atoi or some such when inet_pton fails, > and ignoring the fact it doesn't consume the whole string. Indeed it is; strtol actually, which quits at the first (here decimal) non-digit. It does return a pointer to it though, and a check for that character being '.' seems like a fair indicator of a failed dotted quad? http://svnweb.freebsd.org/base/head/sbin/ipfw/ipfw2.c?revision=250759&view=co if (ishexnumber(*arg) != 0 || *arg == ':') { /* Remove / if exists */ if ((p = strchr(arg, '/')) != NULL) { *p = '\0'; mask = atoi(p + 1); } if (inet_pton(AF_INET, arg, paddr) == 1) { ... } else if (inet_pton(AF_INET6, arg, paddr) == 1) { ... } else { /* Port or any other key */ key = strtol(arg, &p, 10); /* Skip non-base 10 entries like 'fa1' */ if (p != arg) { pkey = (uint32_t *)paddr; *pkey = htonl(key); type = IPFW_TABLE_CIDR; addrlen = sizeof(uint32_t); } } } if (type == 0 && strchr(arg, '.') == NULL) { /* Assume interface name. Copy significant data only */ ... } if (type == 0) { if (lookup_host(arg, (struct in_addr *)paddr) != 0) errx(EX_NOHOST, "hostname ``%s'' unknown", arg); ... } ... } I'm mostly a pascal programmer (oh, the shame! :) so I can easily misuse C pointers, but my reading of strtol(3) leads to suggest something like: } else { /* Port or any other key */ key = strtol(arg, &p, 10); /* Skip non-base 10 entries like 'fa1' */ if (p != arg) { + /* IPv4 address that failed inet_pton */ + if (*p == '.') { + errx(EX_DATAERR, "bad IPv4 address"); + } pkey = (uint32_t *)paddr; *pkey = htonl(key); type = IPFW_TABLE_CIDR; addrlen = sizeof(uint32_t); } } cheers, Ian _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw To unsubscribe, send any mail to "[email protected]"
