From owner-svn-src-head@FreeBSD.ORG Thu Nov 28 10:28:29 2013 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 5A54DBC8; Thu, 28 Nov 2013 10:28:29 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 45EEF13E3; Thu, 28 Nov 2013 10:28:29 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id rASASTKB086576; Thu, 28 Nov 2013 10:28:29 GMT (envelope-from melifaro@svn.freebsd.org) Received: (from melifaro@localhost) by svn.freebsd.org (8.14.7/8.14.5/Submit) id rASASSoE086573; Thu, 28 Nov 2013 10:28:28 GMT (envelope-from melifaro@svn.freebsd.org) Message-Id: <201311281028.rASASSoE086573@svn.freebsd.org> From: "Alexander V. Chernikov" Date: Thu, 28 Nov 2013 10:28:28 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r258708 - in head: sbin/ipfw sys/netpfil/ipfw X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.16 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Nov 2013 10:28:29 -0000 Author: melifaro Date: Thu Nov 28 10:28:28 2013 New Revision: 258708 URL: http://svnweb.freebsd.org/changeset/base/258708 Log: Check ipfw table numbers in both user and kernel space before rule addition. Found by: Saychik Pavel MFC after: 2 weeks Sponsored by: Yandex LLC Modified: head/sbin/ipfw/ipfw2.c head/sbin/ipfw/ipfw2.h head/sys/netpfil/ipfw/ip_fw_sockopt.c Modified: head/sbin/ipfw/ipfw2.c ============================================================================== --- head/sbin/ipfw/ipfw2.c Thu Nov 28 10:04:53 2013 (r258707) +++ head/sbin/ipfw/ipfw2.c Thu Nov 28 10:28:28 2013 (r258708) @@ -60,6 +60,8 @@ int resvd_set_number = RESVD_SET; int ipfw_socket = -1; +uint32_t ipfw_tables_max = 0; /* Number of tables supported by kernel */ + #ifndef s6_addr32 #define s6_addr32 __u6_addr.__u6_addr32 #endif @@ -2203,6 +2205,7 @@ fill_ip(ipfw_insn_ip *cmd, char *av, int { int len = 0; uint32_t *d = ((ipfw_insn_u32 *)cmd)->d; + uint32_t tables_max; cmd->o.len &= ~F_LEN_MASK; /* zero len */ @@ -2221,6 +2224,10 @@ fill_ip(ipfw_insn_ip *cmd, char *av, int *p++ = '\0'; cmd->o.opcode = O_IP_DST_LOOKUP; cmd->o.arg1 = strtoul(av + 6, NULL, 0); + tables_max = ipfw_get_tables_max(); + if (cmd->o.arg1 > tables_max) + errx(EX_USAGE, "The table number exceeds the maximum " + "allowed value (%u)", tables_max - 1); if (p) { cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32); d[0] = strtoul(p, NULL, 0); @@ -4119,6 +4126,33 @@ static void table_list(uint16_t num, int static void table_fill_xentry(char *arg, ipfw_table_xentry *xent); /* + * Retrieve maximum number of tables supported by ipfw(4) module. + */ +uint32_t +ipfw_get_tables_max() +{ + size_t len; + uint32_t tables_max; + + if (ipfw_tables_max != 0) + return (ipfw_tables_max); + + len = sizeof(tables_max); + if (sysctlbyname("net.inet.ip.fw.tables_max", &tables_max, &len, + NULL, 0) == -1) { + if (co.test_only) + tables_max = 128; /* Old conservative default */ + else + errx(1, "Can't determine maximum number of ipfw tables." + " Perhaps you forgot to load ipfw module?"); + } + + ipfw_tables_max = tables_max; + + return (ipfw_tables_max); +} + +/* * This one handles all table-related commands * ipfw table N add addr[/masklen] [value] * ipfw table N delete addr[/masklen] @@ -4131,19 +4165,10 @@ ipfw_table_handler(int ac, char *av[]) ipfw_table_xentry xent; int do_add; int is_all; - size_t len; uint32_t a; uint32_t tables_max; - len = sizeof(tables_max); - if (sysctlbyname("net.inet.ip.fw.tables_max", &tables_max, &len, - NULL, 0) == -1) { - if (co.test_only) - tables_max = 128; /* Old conservative default */ - else - errx(1, "Can't determine maximum number of ipfw tables." - " Perhaps you forgot to load ipfw module?"); - } + tables_max = ipfw_get_tables_max(); memset(&xent, 0, sizeof(xent)); Modified: head/sbin/ipfw/ipfw2.h ============================================================================== --- head/sbin/ipfw/ipfw2.h Thu Nov 28 10:04:53 2013 (r258707) +++ head/sbin/ipfw/ipfw2.h Thu Nov 28 10:28:28 2013 (r258708) @@ -228,6 +228,8 @@ char const *match_value(struct _s_x *p, int do_cmd(int optname, void *optval, uintptr_t optlen); +uint32_t ipfw_get_tables_max(void); + struct in6_addr; void n2mask(struct in6_addr *mask, int n); int contigmask(uint8_t *p, int len); Modified: head/sys/netpfil/ipfw/ip_fw_sockopt.c ============================================================================== --- head/sys/netpfil/ipfw/ip_fw_sockopt.c Thu Nov 28 10:04:53 2013 (r258707) +++ head/sys/netpfil/ipfw/ip_fw_sockopt.c Thu Nov 28 10:28:28 2013 (r258708) @@ -653,7 +653,7 @@ check_ipfw_struct(struct ip_fw *rule, in case O_IP_SRC_LOOKUP: case O_IP_DST_LOOKUP: - if (cmd->arg1 >= IPFW_TABLES_MAX) { + if (cmd->arg1 >= V_fw_tables_max) { printf("ipfw: invalid table number %d\n", cmd->arg1); return (EINVAL);