From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202602 header.b=LPtLGMgW; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id 5968D5A0269 for ; Thu, 16 Apr 2026 03:47:27 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202602; t=1776304043; bh=4FBqB8EtuBr4Zz7VZt4DcAKLxHUMjLxBKLQxcqlHxDk=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=LPtLGMgWw/DzGqeM7fzOAzcpBJX/fLHggcFl7id9RbCvPsZa3N/S43WXEqi4d6+PS zE+gA7Z6T3IbLSXBGn++7ZuvTFCZYb2ZOuUSHQ73vlOKYNsV5GK7e5bu+RMoxp7JpO zq76PVt2gE1BG9/tv4yIGM4Qf2kPPKBDqVX2zJfSvpmaXbTCeo6a0iGA97miHZBs0y Q5up7bqkumpo3Co/IRh624FfXIPSxfG6BfECKE/YWB3iU0eGJrTdG3WBNJEl2ngGwP YVCTE425D0Yaw0XL4fE4nvNfOjAQ9r54cg2ITsAUlfnnuAsbotV/ROMKfhefh66C8Q gOF8BsN/ntDcg== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4fx1975SHLz4wTr; Thu, 16 Apr 2026 11:47:23 +1000 (AEST) Date: Thu, 16 Apr 2026 11:46:22 +1000 From: David Gibson To: Stefano Brivio Subject: Re: [PATCH v2 21/23] conf, fwd: Stricter rule checking in fwd_rule_add() Message-ID: References: <20260410010309.736855-1-david@gibson.dropbear.id.au> <20260410010309.736855-22-david@gibson.dropbear.id.au> <20260416000457.55ecdbec@elisabeth> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="8MMjvBMmU00lovrt" Content-Disposition: inline In-Reply-To: <20260416000457.55ecdbec@elisabeth> Message-ID-Hash: CE6EYOGSIIXKK45IFXHWMA6U5W33BPQP X-Message-ID-Hash: CE6EYOGSIIXKK45IFXHWMA6U5W33BPQP X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --8MMjvBMmU00lovrt Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Apr 16, 2026 at 12:04:58AM +0200, Stefano Brivio wrote: > On Fri, 10 Apr 2026 11:03:07 +1000 > David Gibson wrote: >=20 > > Although fwd_rule_add() performs some sanity checks on the rule it is > > given, there are invalid rules we don't check for, assuming that its > > callers will do that. > >=20 > > That won't be enough when we can get rules inserted by a dynamic update > > client without going through the existing parsing code. So, add strict= er > > checks to fwd_rule_add(), which is now possible thanks to the capabilit= ies > > bits in the struct fwd_table. Where those duplicate existing checks in= the > > callers, remove the old copies. > >=20 > > Signed-off-by: David Gibson > > --- > > conf.c | 19 ------------------- > > fwd.c | 51 ++++++++++++++++++++++++++++++++++++++++++++++----- > > 2 files changed, 46 insertions(+), 24 deletions(-) > >=20 > > diff --git a/conf.c b/conf.c > > index b7a4459e..31627209 100644 > > --- a/conf.c > > +++ b/conf.c > > @@ -310,10 +310,6 @@ static void conf_ports_spec(struct fwd_table *fwd,= uint8_t proto, > > if (p !=3D ep) /* Garbage after the ranges */ > > goto bad; > > =20 > > - if (orig_range.first =3D=3D 0) { > > - die("Can't forward port 0 included in '%s'", spec); > > - } > > - > > conf_ports_range_except(fwd, proto, addr, ifname, > > orig_range.first, orig_range.last, > > exclude, > > @@ -356,11 +352,6 @@ static void conf_ports(char optname, const char *o= ptarg, struct fwd_table *fwd) > > return; > > } > > =20 > > - if (proto =3D=3D IPPROTO_TCP && !(fwd->caps & FWD_CAP_TCP)) > > - die("TCP port forwarding requested but TCP is disabled"); > > - if (proto =3D=3D IPPROTO_UDP && !(fwd->caps & FWD_CAP_UDP)) > > - die("UDP port forwarding requested but UDP is disabled"); > > - > > strncpy(buf, optarg, sizeof(buf) - 1); > > =20 > > if ((spec =3D strchr(buf, '/'))) { > > @@ -405,16 +396,6 @@ static void conf_ports(char optname, const char *o= ptarg, struct fwd_table *fwd) > > addr =3D NULL; > > } > > =20 > > - if (addr) { > > - if (!(fwd->caps & FWD_CAP_IPV4) && inany_v4(addr)) { > > - die("IPv4 is disabled, can't use -%c %s", > > - optname, optarg); > > - } else if (!(fwd->caps & FWD_CAP_IPV6) && !inany_v4(addr)) { > > - die("IPv6 is disabled, can't use -%c %s", > > - optname, optarg); > > - } > > - } > > - > > if (optname =3D=3D 'T' || optname =3D=3D 'U') { > > assert(!addr && !ifname); > > =20 > > diff --git a/fwd.c b/fwd.c > > index c7fd1a9d..98b04d0c 100644 > > --- a/fwd.c > > +++ b/fwd.c > > @@ -367,17 +367,58 @@ int fwd_rule_add(struct fwd_table *fwd, const str= uct fwd_rule *new) > > new->first, new->last); > > return -EINVAL; > > } > > + if (!new->first) { > > + warn("Forwarding rule atttempts to map from port 0"); > > + return -EINVAL; > > + } > > + if (!new->to || (new->to + new->last - new->first) < new->to) { > > + warn("Forwarding rule atttempts to map to port 0"); >=20 > Nit: attempts Oops, fixed. >=20 > > + return -EINVAL; > > + } > > if (new->flags & ~allowed_flags) { > > warn("Rule has invalid flags 0x%hhx", > > new->flags & ~allowed_flags); > > return -EINVAL; > > } > > - if (new->flags & FWD_DUAL_STACK_ANY && > > - !inany_equals(&new->addr, &inany_any6)) { > > - char astr[INANY_ADDRSTRLEN]; > > + if (new->flags & FWD_DUAL_STACK_ANY) { > > + if (!inany_equals(&new->addr, &inany_any6)) { > > + char astr[INANY_ADDRSTRLEN]; > > =20 > > - warn("Dual stack rule has non-wildcard address %s", > > - inany_ntop(&new->addr, astr, sizeof(astr))); > > + warn("Dual stack rule has non-wildcard address %s", > > + inany_ntop(&new->addr, astr, sizeof(astr))); > > + return -EINVAL; > > + } > > + if (!(fwd->caps & FWD_CAP_IPV4)) { > > + warn("Dual stack forward, but IPv4 not enabled"); > > + return -EINVAL; > > + } > > + if (!(fwd->caps & FWD_CAP_IPV6)) { > > + warn("Dual stack forward, but IPv6 not enabled"); > > + return -EINVAL; > > + } > > + } else { > > + if (inany_v4(&new->addr) && !(fwd->caps & FWD_CAP_IPV4)) { > > + warn("IPv4 forward, but IPv4 not enabled"); > > + return -EINVAL; > > + } > > + if (!inany_v4(&new->addr) && !(fwd->caps & FWD_CAP_IPV6)) { > > + warn("IPv6 forward, but IPv6 not enabled"); > > + return -EINVAL; > > + } > > + } > > + if (new->proto =3D=3D IPPROTO_TCP) { > > + if (!(fwd->caps & FWD_CAP_TCP)) { > > + warn("Can't add TCP forwarding rule, TCP not enabled"); > > + return -EINVAL; > > + } > > + } else if (new->proto =3D=3D IPPROTO_UDP) { > > + if (!(fwd->caps & FWD_CAP_UDP)) { > > + warn("Can't add UDP forwarding rule, UDP not enabled"); > > + return -EINVAL; > > + } > > + } else { > > + warn("Unsupported protocol 0x%hhx (%s) for forwarding rule", > > + new->proto, ipproto_name(new->proto)); > > return -EINVAL; > > } > > =20 >=20 > --=20 > Stefano >=20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --8MMjvBMmU00lovrt Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmngP20ACgkQzQJF27ox 2GeMIA//ZamAaCwcgfTF3DzS/6H7Ji6EGtpBM4B4GdRBmQfxqvL/FBnYzWPzGAOV jEt+rouJaHks6lTuTkoEvtF/4cH8xZE9xNH7W515Y8VwXKyGlyp9aYM/4q7CLLkl tiYAfkOYiRc4cFv13FUInUXoMkqeod/04jLRfVd6Yi5HeP/Zpi550GxBnI5tA+cS YrM8X2ltbNFm8EfVsNt0TScmya5YLNpM8QsEZyaBYvq4CHLIcB7Xn18+fKraubWE tFEcWXcW/WE7t+pw2KsuwhFvehj2rE5tvj2gsotoGLDA7NZWqHcb0m/VVy2WImnV TTwYIg62dWcJ98dqTI7dUHhNf3MO4ApBGfEhsKGz2cVk7ZUtLxSyGRXnsg/CSx4q vmjUhsBgVJoqQim80WErClwPFvEtvmbIkc7XToy6AmDnA++ijWsnzClP3dgTMBt1 JERLraG9qZaXg5j+NzYjIIzHdM6FOR8yhTloXpMKnJEvncIk3Sr318GN5h+YbyFu X1lwmyqRjHXOATj4U1mLi6ETUuqKgYNIE9Za1sp9BWIIx0xp3NqfAAetpQWnnXIW ecGmCsJxRXat24llKlIX0dlC2ywt27VG80cFsJy8VZserGd5yyLKJHXkPeosOfcu o4jvAj9hy+UBIKgcCekNW9hGW2/TQWTFiEU0YTS6wUsRdw3w55Q= =z5n2 -----END PGP SIGNATURE----- --8MMjvBMmU00lovrt--