From owner-freebsd-bugs@FreeBSD.ORG Wed May 11 19:50:03 2005 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 091D916A4CE for ; Wed, 11 May 2005 19:50:03 +0000 (GMT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id B67BC43D41 for ; Wed, 11 May 2005 19:50:02 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id j4BJo2dF021112 for ; Wed, 11 May 2005 19:50:02 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.3/8.13.1/Submit) id j4BJo2Tx021111; Wed, 11 May 2005 19:50:02 GMT (envelope-from gnats) Resent-Date: Wed, 11 May 2005 19:50:02 GMT Resent-Message-Id: <200505111950.j4BJo2Tx021111@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, "Guy F. Boyd" Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B600716A4CE for ; Wed, 11 May 2005 19:41:45 +0000 (GMT) Received: from vtamail.vta.com (vta.com [208.199.187.6]) by mx1.FreeBSD.org (Postfix) with ESMTP id EC1A643D70 for ; Wed, 11 May 2005 19:41:44 +0000 (GMT) (envelope-from gfb@vtamail.vta.com) Received: from vtamail.vta.com (localhost.vta.com [127.0.0.1]) by vtamail.vta.com (8.12.9/8.12.9) with ESMTP id j4BJfibs062091 for ; Wed, 11 May 2005 15:41:44 -0400 (EDT) (envelope-from gfb@vtamail.vta.com) Received: (from root@localhost) by vtamail.vta.com (8.13.1/8.12.9/Submit) id j4BJfi7x062089; Wed, 11 May 2005 15:41:44 -0400 (EDT) Message-Id: <200505111941.j4BJfi7x062089@vtamail.vta.com> Date: Wed, 11 May 2005 15:41:44 -0400 (EDT) From: "Guy F. Boyd" To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Subject: bin/80913: /sbin/ipfw2 silently discards MAC addr arg with improper X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: "Guy F. Boyd" List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 May 2005 19:50:03 -0000 >Number: 80913 >Category: bin >Synopsis: /sbin/ipfw2 silently discards MAC addr arg with improper >Confidential: no >Severity: critical >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed May 11 19:50:02 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Guy F. Boyd >Release: FreeBSD 4.11-STABLE i386 >Organization: >Environment: System: FreeBSD nyc-end 4.11-STABLE FreeBSD 4.11-STABLE #4: Tue May 10 17:27:02 EDT 2005 root@nyc-end:/usr/src/sys/compile/NYC_END i386 Dell Optiplex GX200, FreeBSD 4-11 STABLE, i386 >Description: /sbin/ipfw2 silently discards improperly formatted 6-byte Media Access Controller address strings that contain ascii characters which are outside of the range of the set of characters that correctly represent 4-bit hex values. ipfw2 then processes the remaining arguments into a firewall rule that may have unintended effects on the total ruleset. >How-To-Repeat: # create a default deny rule ipfw add 1000 deny all from any to any # allow 1 client -- oops finger slipped on last '0' should be '0' not 'O' ipfw add 999 allow all from any to any mac any 08:00:5b:00:aO:ac # result: nyc-end# ipfw show |grep 999 999 22739 2004155 allow ip from any to any MAC any any arguably pilot error but ipfw should generate a syntax error in this case instead. >Fix: $FreeBSD: src/sbin/ipfw/ipfw2.c,v 1.4.2.23 2004/11/08 18:47:11 pjd Exp $ Add argument format checking to src/sbin/ipfw/ipfw2.c at add_mac() for string arguments containing ':' delimiter. Return errx() as syntax error for improperly formatted arguments. First pass at patch attached. >Release-Note: >Audit-Trail: >Unformatted: ascii chars, then adds rule