From nobody Mon Jan 22 16:43:03 2024 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4TJbcl2fWMz57lW4; Mon, 22 Jan 2024 16:43:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4TJbcl27L8z4XCJ; Mon, 22 Jan 2024 16:43:03 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1705941783; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=2TUt0mu4Gghk0b6KyQ1GwtXeUCDCgbWI/pOP5AydS/A=; b=KvzP+c+Es/YsAlznrbkeROfU9RBLWjqewZLn8ME0WrgSvFP1BrdLFgFzOYQyYe+g256jHv MpYOsrVORrnPGSG/9xpSmon1ZjIP3cJCgL4CQwvmACDt2GSX5XbNsQ8barHUWtgFhJQVVf 7OGxFeK2YU7QodDyEX+jsP/Y1sGMqgr1o3pEO/It1ft0+fpLHZbLIQoOas2Q8o197hXPDZ ng5ehaEQ7TaY9vNWZ7UtVSjVfVwoHhG5w3rYC0a7BCTO2b5dtjejpnYLg/ulieI5aMFCyR AriRsGNMQR4Zc1mQGCspEXEncmmbrGsEFblgGaayunZ3VRXHuj8xLoTDuJztZQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1705941783; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=2TUt0mu4Gghk0b6KyQ1GwtXeUCDCgbWI/pOP5AydS/A=; b=NrHoHa/8Qxd28AmBlGGINO/ibEbCnWIpbPIdJTGX3aQ3vIDDRyuAOH/lTAuPezHQrWQdHq XVnMcISpaPV0lnlmpophOwI+UJqHdKcRd8VGN0QyyMeIscl2q85ws76aUj5a6HSosTPpS/ FqAmJkTZBgJpaOrMNbKZOgOny5ZndIH4HSB85jUaZu1GhmLDmav0d4V1adi/1A7Ufvdksj u2aAjkip8vvcFwH20C5CrPXHryPg2uK8KHJhC5wAffqJjg4ENUGgUGJyo0tdPIbPVio/eV jqqDNtqpGkb5qZIX6DWm0MEGYN9OhYOwF3UADRtz37xdUrpDdLE7bBI48VIhSQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1705941783; a=rsa-sha256; cv=none; b=A73XaEoXXN+jKmHn61jz2I7boMBlap9LGHPnxbK4ecyg541z6WPM2takcDOkfXvvOxkCaU hA4Hkbb9c25KanqyuUlX+IW10/sO1UiQ3sSGi6/YfXyqA2eVXi3+vRZ7fD8j4fHh8KXIAP a23jCQ25mNuZgctLm02TRZzBiRcs4KCd2hvHqNrw5AplI8D+S4mXCfh3uFP4HSxLDru9Ag wg/91DTrAM4t6RjXLmSVaUvpki0Ci+BdyLnQ6Sx+vGPrOB/wY169bo2J6IkGE2SIR795/U y0jqZeQmVuH2tDXx9dFXJjzBj84aNFBESNPyPYal0fW6jzld++7F1wnLalSLjA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4TJbcl1BRZz18Xy; Mon, 22 Jan 2024 16:43:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 40MGh3GM036562; Mon, 22 Jan 2024 16:43:03 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 40MGh3Qq036559; Mon, 22 Jan 2024 16:43:03 GMT (envelope-from git) Date: Mon, 22 Jan 2024 16:43:03 GMT Message-Id: <202401221643.40MGh3Qq036559@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mike Karels Subject: git: 74e52718aa73 - stable/13 - route: error on IPv4 network routes with incorrect destination List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-branches@freebsd.org X-BeenThere: dev-commits-src-branches@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: karels X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 74e52718aa737deb2477350b16697def98259836 Auto-Submitted: auto-generated The branch stable/13 has been updated by karels: URL: https://cgit.FreeBSD.org/src/commit/?id=74e52718aa737deb2477350b16697def98259836 commit 74e52718aa737deb2477350b16697def98259836 Author: Mike Karels AuthorDate: 2024-01-15 21:14:54 +0000 Commit: Mike Karels CommitDate: 2024-01-22 16:42:52 +0000 route: error on IPv4 network routes with incorrect destination Route destinations like 10/8 are most likely intended as a shorthand for 10.0.0.0/8, but instead it means 0.0.0.10/8, which includes only bits in the host part of the mask, and hence adds a route to 0.0.0.0/8. In 12.x, there was code to "do what I mean", which was removed as part of a cleanup of old network class remnants. Given that we have gone this long without that code, do not restore that behavior. Instead, detect the issue and produce an error. Specifically, if there are no dots in a numeric IPv4 address, the mask is specified with CIDR notation (using a slash), and there are bits set in the host part, produce an error like this for 10/8: route: malformed address, bits set after mask; 10 means 0.0.0.10 PR: 258874 Reviewed by: melifaro, emaste Differential Revision: https://reviews.freebsd.org/D43384 (cherry picked from commit b9e8ae1d8a424194b4e185359da4ded163f24f4e) --- sbin/route/route.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/sbin/route/route.c b/sbin/route/route.c index c0452e71811e..c48a39b490dd 100644 --- a/sbin/route/route.c +++ b/sbin/route/route.c @@ -1309,6 +1309,9 @@ getaddr(int idx, char *str, int nrflags) q = strchr(str,'/'); if (q != NULL && idx == RTAX_DST) { /* A.B.C.D/NUM */ + struct sockaddr_in *mask; + uint32_t mask_bits; + *q = '\0'; if (inet_aton(str, &sin->sin_addr) == 0) errx(EX_NOHOST, "bad address: %s", str); @@ -1318,6 +1321,20 @@ getaddr(int idx, char *str, int nrflags) errx(EX_NOHOST, "bad mask length: %s", q + 1); inet_makemask((struct sockaddr_in *)&so[RTAX_NETMASK],masklen); + + /* + * Check for bogus destination such as "10/8"; heuristic is + * that there are bits set in the host part, and no dot + * is present. + */ + mask = ((struct sockaddr_in *) &so[RTAX_NETMASK]); + mask_bits = ntohl(mask->sin_addr.s_addr); + if ((ntohl(sin->sin_addr.s_addr) & ~mask_bits) != 0 && + strchr(str, '.') == NULL) + errx(EX_NOHOST, + "malformed address, bits set after mask;" + " %s means %s", + str, inet_ntoa(sin->sin_addr)); return (0); } if (inet_aton(str, &sin->sin_addr) != 0)