From owner-trustedbsd-cvs@FreeBSD.ORG Sun Oct 29 21:15:48 2006 Return-Path: X-Original-To: trustedbsd-cvs@freebsd.org Delivered-To: trustedbsd-cvs@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id DBBC116A403 for ; Sun, 29 Oct 2006 21:15:48 +0000 (UTC) (envelope-from owner-perforce@freebsd.org) Received: from cyrus.watson.org (cyrus.watson.org [209.31.154.42]) by mx1.FreeBSD.org (Postfix) with ESMTP id D254A43D49 for ; Sun, 29 Oct 2006 21:15:47 +0000 (GMT) (envelope-from owner-perforce@freebsd.org) Received: from mx2.freebsd.org (mx2.freebsd.org [216.136.204.119]) by cyrus.watson.org (Postfix) with ESMTP id EEE7546D58 for ; Sun, 29 Oct 2006 16:15:46 -0500 (EST) Received: from hub.freebsd.org (hub.freebsd.org [216.136.204.18]) by mx2.freebsd.org (Postfix) with ESMTP id BEF7555E5F; Sun, 29 Oct 2006 21:15:45 +0000 (GMT) (envelope-from owner-perforce@freebsd.org) Received: by hub.freebsd.org (Postfix, from userid 32767) id ADA9C16A416; Sun, 29 Oct 2006 21:15:45 +0000 (UTC) X-Original-To: perforce@freebsd.org Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6DE6A16A415 for ; Sun, 29 Oct 2006 21:15:45 +0000 (UTC) (envelope-from csjp@freebsd.org) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id 44A0D43D45 for ; Sun, 29 Oct 2006 21:15:45 +0000 (GMT) (envelope-from csjp@freebsd.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.13.6/8.13.6) with ESMTP id k9TLFjUl026671 for ; Sun, 29 Oct 2006 21:15:45 GMT (envelope-from csjp@freebsd.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.13.6/8.13.4/Submit) id k9TLFiGr026668 for perforce@freebsd.org; Sun, 29 Oct 2006 21:15:44 GMT (envelope-from csjp@freebsd.org) Date: Sun, 29 Oct 2006 21:15:44 GMT Message-Id: <200610292115.k9TLFiGr026668@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to csjp@freebsd.org using -f From: "Christian S.J. Peron" To: Perforce Change Reviews Cc: Subject: PERFORCE change 108692 for review X-BeenThere: trustedbsd-cvs@FreeBSD.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: TrustedBSD CVS and Perforce commit message list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 29 Oct 2006 21:15:48 -0000 http://perforce.freebsd.org/chv.cgi?CH=108692 Change 108692 by csjp@csjp_xor on 2006/10/29 21:14:45 Change the type of ar_arg_sockaddr from struct sockaddr to struct sockaddr_storage. This structure is defined in RFC 2553 and is a more semantically correct structure for holding IP and IP6 sockaddr information. struct sockaddr is not big enough to hold all the required information for IP6, resulting in truncated addresses et al when auditing IP6 sockaddr information. We also need to assume that the sa->sa_len has been validated before the call to audit_arg_sockaddr() is made, otherwise it could result in a buffer overflow. This is being done to accomidate auditing of network related arguments (like connect, bind et al) that will be added soon. Affected files ... .. //depot/projects/trustedbsd/audit3/sys/security/audit/audit_arg.c#22 edit .. //depot/projects/trustedbsd/audit3/sys/security/audit/audit_private.h#35 edit Differences ... ==== //depot/projects/trustedbsd/audit3/sys/security/audit/audit_arg.c#22 (text+ko) ==== @@ -417,8 +417,7 @@ if (ar == NULL) return; - bcopy(sa, &ar->k_ar.ar_arg_sockaddr, - sizeof(ar->k_ar.ar_arg_sockaddr)); + bcopy(sa, &ar->k_ar.ar_arg_sockaddr, sa->sa_len); switch (sa->sa_family) { case AF_INET: ARG_SET_VALID(ar, ARG_SADDRINET); ==== //depot/projects/trustedbsd/audit3/sys/security/audit/audit_private.h#35 (text+ko) ==== @@ -208,7 +208,6 @@ u_int ar_arg_signum; char ar_arg_login[MAXLOGNAME]; int ar_arg_ctlname[CTL_MAXNAME]; - struct sockaddr ar_arg_sockaddr; struct socket_au_info ar_arg_sockinfo; char *ar_arg_upath1; char *ar_arg_upath2; @@ -230,6 +229,7 @@ int ar_arg_envc; int ar_arg_exitstatus; int ar_arg_exitretval; + struct sockaddr_storage ar_arg_sockaddr; }; /*