According to RFC 1918, the following IP prefixes are reserved for
private internets:
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
This PR fixes the prefix lengths in references to private networks
("RFC 1918 networks", "the standard private IP address ranges").
The changes are limited to man pages.
Signed-off-by: Yusuke Ichiki <[email protected]>
Pull Request: https://github.com/freebsd/freebsd-src/pull/2328
MFC after: 3 days
These functions take the source or destintation address indirectly from
a potentially missaligned buffer. Rename them to refect this and to
free up the copy{in,out}ptr names.
Some of the code in question is dead code and doesn't or won't compile,
but I've changed it all for consistency.
NB: If the pointers are actually stored under aligned then this code is
broken with CHERI.
Reviewed by: cy
Effort: CHERI upstreaming
Sponsored by: Innovate UK
Differential Revision: https://reviews.freebsd.org/D54232
When copying ipfs data from user space, don't just check that the payload
length is nonzero, but also that it does not exceed the size of the stack
buffer we're copying it into.
While we're at it, use a union to create a buffer of the exact size we
need instead of guessing that 2048 will be enough (and not too much).
Finally, check the size of the payload once it gets to where it's used.
MFC after: 3 days
Reported by: Ilja Van Sprundel <[email protected]>
Reviewed by: cy
Differential Revision: https://reviews.freebsd.org/D54194
At the moment ipfs(8) is a tool that can be easily abused. Though the
concept is sound the implementation needs some work.
ipfs(8) should be considered experimental at the moment.
This commit also makes ipfs support in the kernel optional.
Reviewed by: emaste, glebius
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D53787
Add a sysctl/tunable (net.inet.ipf.jail_allowed) to control whether a
jail can manage its own ipfilter rules, pools, and settings. A jail's
control over its own ipfilter rules and settings may not be desireable.
The default is jail access to ipfilter is denied.
The host system can stil manage a jail's rules by attaching the rules,
using the on keyword, limiting the rule to the jail's interface. Or
the sysctl/tunable can be enabled to allow a jail control over its own
ipfilter rules and settings.
Implementation note: Rather than store the jail_allowed variable,
referenced by sysctl(9), in a global area, storing the variable in the
ipfilter softc is consistent with ipfilter's use of its softc.
Discussed with: emaste, jrm
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D53623
The ipnat struct is built by ipnat(8), specifically ipnat_y.y when
parsing the ipnat configuration file (typically ipnat.conf). ipnat
contains a variable length string field at the end of the struct. This
data field, called in_names, may contain various text strings such as
NIC names. There is no upper bound limit to the length of strings as
long as the in_namelen length field specifies the length of in_names
within the ipnat structure and in_size specifies the size of the ipnat
structure itself.
Reported by: Ilja Van Sprundel <[email protected]>
Reviewed by: markj
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D53843
The frentry struct is built by ipf(8), specifically ipf_y.y when parsing
the ipfilter configuration file (typically ipf.conf). frentry contains
a variable length string field at the end of the struct. This data field,
called fr_names, may contain various text strings such as NIC names,
destination list (dstlist) names, and filter rule comments. The length
field specifies the length of fr_names within the frentry structure and
fr_size specifies the size of the frentry structure itself.
The upper bound limit to the length of strings field is controlled by the
fr_max_namelen sysctl/kenv or the max_namelen ipfilter tuneable.
The initial concepts were discussed with emaste and jrm.
Reported by: Ilja Van Sprundel <[email protected]>
Reviewed by: markj
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D53843
ipf_htable_create() trusts a user-supplied iph_size from iphtable_t
and computes the allocation size as iph->iph_size * sizeof(*iph->iph_table)
without checking for integer overflow. A sufficiently large iph_size
causes the multiplication to wrap, resulting in an under-sized allocation
for the table pointer array. Subsequent code (e.g., in ipf_htent_insert())
can then write past the end of the allocated buffer, corrupting kernel
memory and causing DoS or potential privilege escalation.
This is not typically a problem when using the ipfilter provided
userland tools as calculate the correct lengths. This mitigates a
rogue actor calling ipfilter ioctls directly.
Reported by: Ilja Van Sprundel <[email protected]>
Reviewed by: markj
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D53286
It serves no purpose to manually manage the IPF_NUM_ERRORS count.
Calculate it instead.
Reviewed by: emaste, markj
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D53308
Remove unneeded th_x2 initalization, use named constants
instead of magic numbers (fixing one oversight) and add
some line breaks. Expand one man page slightly.
No functional change intended.
Reviewed By: tuexen, cc
Sponsored by: NetApp, Inc.
Differential Revision: https://reviews.freebsd.org/D48065
Add support for the AE Flag in the TCP header to pf and ppp.
Commonalize to the use of "E"(ECE), "W"(CWR) and "e"(AE)
for the TCP header flags, in line with tcpdump.
Reviewers: kp, cc, tuexen, cy, #transport!
Sponsored by: NetApp, Inc.
Differential Revision: https://reviews.freebsd.org/D47106
The full mandoc warnings were:
skipping paragraph macro: PP after SS
skipping paragraph macro: PP after SH
The rendered output (in ascii and html) is not affected by this commit.
Fixes made by script in https://github.com/Tarsnap/freebsd-doc-scripts
Signed-off-by: Graham Percival <[email protected]>
Reviewed by: jlduran, mhorne
MFC after: 1 week
Sponsored by: Tarsnap Backup Inc.
Pull Request: https://github.com/freebsd/freebsd-src/pull/1524
Include the IP address in the message when a hashnode add error occurs.
This helps to identify the ippool.conf statement that the error occurred.
MFC after: 1 week
Replace inet_ntoa(3) with inet_ntop(3). This supporting the printing of
IPv6 IP addresses in addition to IPv4 IP addresses in error message.
MFC after: 1 week
When a node in a tree is discovered in error, i.e. duplicate, the
IP address of the node is printed but no closing bracket completes
the node in the message. Fix this.
MFC after: 1 week
As with when printing errors for failed poolnodes, printing the hash
node (IP address) only leads to speculation which hash pool the failed
add occurred. This is especially useful when the same IP address is
listed in multiple hash pools.
MFC after: 1 week
Printing the pool node (IP address) only leads to speculation which
pool the failed add occurred. This is especially useful when the same
IP address is listed in multiple pools.
MFC after: 1 week
Avoid overrunning the message buffer when printing an ippool btree error.
We do this in two ways. First we increase the message buffer from 80 to
255 bytes and secondly we replace strcat(3) with strlcat(3).
MFC after: 1 week
These changes were made by accident in:
ipfilter: Adjust userland returns to conform to style(9)
2582ae5740
That commit made similar mistakes in other man pages, but those have
already been fixed.
Signed-off-by: Graham Percival <[email protected]>
Reviewed by: mhorne
Sponsored by: Tarsnap Backup Inc.
Pull Request: https://github.com/freebsd/freebsd-src/pull/1433
For the uncommon items: Go through the tree and remove sccs tags that
didn't fit any nice pattern. If in the neighborhood, other SCM tags were
removed when they were detritis of long-ago CVS somehow in the early
mists of the project. Some adjacent copyrights stringswere removed (they
duplicated the copyright notices in the file). This also removed
non-standard formations of omission of SCCS tags (usually by adding an
extra #if 0 somewhere.
After this commit, a number of strings tagged with the 'what' @(#)
prefix remain, but they are primarily copyright notices.
Sponsored by: Netflix
Remove ancient SCCS tags from the tree, automated scripting, with two
minor fixup to keep things compiling. All the common forms in the tree
were removed with a perl script.
Sponsored by: Netflix
Yusuke Ichiki