Author: ae
Date: Tue Nov 3 10:29:46 2015
New Revision: 290332
URL: https://svnweb.freebsd.org/changeset/base/290332
Log:
Add ipfw_check_object_name_generic() function to do basic checks for an
object name correctness. Each type of object can do more strict checking
in own implementation. Do such checks for tables in check_table_name().
Reviewed by: melifaro
Obtained from: Yandex LLC
Sponsored by: Yandex LLC
Modified:
head/sys/netpfil/ipfw/ip_fw_private.h
head/sys/netpfil/ipfw/ip_fw_sockopt.c
head/sys/netpfil/ipfw/ip_fw_table.c
head/sys/netpfil/ipfw/ip_fw_table.h
Modified: head/sys/netpfil/ipfw/ip_fw_private.h
==============================================================================
--- head/sys/netpfil/ipfw/ip_fw_private.h Tue Nov 3 10:24:54 2015
(r290331)
+++ head/sys/netpfil/ipfw/ip_fw_private.h Tue Nov 3 10:29:46 2015
(r290332)
@@ -693,6 +693,7 @@ void update_opcode_kidx(ipfw_insn *cmd,
int classify_opcode_kidx(ipfw_insn *cmd, uint16_t *puidx);
void ipfw_init_srv(struct ip_fw_chain *ch);
void ipfw_destroy_srv(struct ip_fw_chain *ch);
+int ipfw_check_object_name_generic(const char *name);
/* In ip_fw_table.c */
struct table_info;
Modified: head/sys/netpfil/ipfw/ip_fw_sockopt.c
==============================================================================
--- head/sys/netpfil/ipfw/ip_fw_sockopt.c Tue Nov 3 10:24:54 2015
(r290331)
+++ head/sys/netpfil/ipfw/ip_fw_sockopt.c Tue Nov 3 10:29:46 2015
(r290332)
@@ -2156,19 +2156,16 @@ cleanup:
return (error);
}
-static int
-check_object_name(ipfw_obj_ntlv *ntlv)
+int
+ipfw_check_object_name_generic(const char *name)
{
- int error;
-
- switch (ntlv->head.type) {
- case IPFW_TLV_TBL_NAME:
- error = ipfw_check_table_name(ntlv->name);
- break;
- default:
- error = ENOTSUP;
- }
+ int nsize;
+ nsize = sizeof(((ipfw_obj_ntlv *)0)->name);
+ if (strnlen(name, nsize) == nsize)
+ return (EINVAL);
+ if (name[0] == '\0')
+ return (EINVAL);
return (0);
}
@@ -2483,7 +2480,7 @@ add_rules(struct ip_fw_chain *chain, ip_
if (ntlv->head.length != sizeof(ipfw_obj_ntlv))
return (EINVAL);
- error = check_object_name(ntlv);
+ error = ipfw_check_object_name_generic(ntlv->name);
if (error != 0)
return (error);
Modified: head/sys/netpfil/ipfw/ip_fw_table.c
==============================================================================
--- head/sys/netpfil/ipfw/ip_fw_table.c Tue Nov 3 10:24:54 2015
(r290331)
+++ head/sys/netpfil/ipfw/ip_fw_table.c Tue Nov 3 10:29:46 2015
(r290332)
@@ -115,6 +115,7 @@ static int dump_table_xentry(void *e, vo
static int swap_tables(struct ip_fw_chain *ch, struct tid_info *a,
struct tid_info *b);
+static int check_table_name(const char *name);
static int check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts,
struct table_config *tc, struct table_info *ti, uint32_t count);
static int destroy_table(struct ip_fw_chain *ch, struct tid_info *ti);
@@ -1794,7 +1795,7 @@ modify_table(struct ip_fw_chain *ch, ip_
* Check for null-terminated/zero-length strings/
*/
tname = oh->ntlv.name;
- if (ipfw_check_table_name(tname) != 0)
+ if (check_table_name(tname) != 0)
return (EINVAL);
objheader_to_ti(oh, &ti);
@@ -1851,7 +1852,7 @@ create_table(struct ip_fw_chain *ch, ip_
*/
tname = oh->ntlv.name;
aname = i->algoname;
- if (ipfw_check_table_name(tname) != 0 ||
+ if (check_table_name(tname) != 0 ||
strnlen(aname, sizeof(i->algoname)) == sizeof(i->algoname))
return (EINVAL);
@@ -2915,25 +2916,14 @@ static struct opcode_obj_rewrite opcodes
*
* Returns 0 if name is considered valid.
*/
-int
-ipfw_check_table_name(char *name)
+static int
+check_table_name(const char *name)
{
- int nsize;
- ipfw_obj_ntlv *ntlv = NULL;
-
- nsize = sizeof(ntlv->name);
-
- if (strnlen(name, nsize) == nsize)
- return (EINVAL);
-
- if (name[0] == '\0')
- return (EINVAL);
/*
* TODO: do some more complicated checks
*/
-
- return (0);
+ return (ipfw_check_object_name_generic(name));
}
/*
@@ -2965,7 +2955,7 @@ find_name_tlv(void *tlvs, int len, uint1
if (ntlv->idx != uidx)
continue;
- if (ipfw_check_table_name(ntlv->name) != 0)
+ if (check_table_name(ntlv->name) != 0)
return (NULL);
return (ntlv);
Modified: head/sys/netpfil/ipfw/ip_fw_table.h
==============================================================================
--- head/sys/netpfil/ipfw/ip_fw_table.h Tue Nov 3 10:24:54 2015
(r290331)
+++ head/sys/netpfil/ipfw/ip_fw_table.h Tue Nov 3 10:29:46 2015
(r290332)
@@ -187,7 +187,6 @@ void ipfw_unref_rule_tables(struct ip_fw
struct namedobj_instance *ipfw_get_table_objhash(struct ip_fw_chain *ch);
/* utility functions */
-int ipfw_check_table_name(char *name);
int ipfw_move_tables_sets(struct ip_fw_chain *ch, ipfw_range_tlv *rt,
uint32_t new_set);
void ipfw_swap_tables_sets(struct ip_fw_chain *ch, uint32_t old_set,
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "[email protected]"
