The INADDR_LOOPBACK constant is in host endianness, and similarly the
IN_MULTICAST macro expects a host endian address. However, there are some
places in passt where we use those with network endian values. This means
that passt will incorrectly allow you to set 127.0.0.1 or a multicast
address as the guest address or DNS forwarding address. Add the necessary
conversions to correct this.
INADDR_ANY and INADDR_BROADCAST logically behave the same way, although
because they're palindromes it doesn't have an effect in practice. Change
them to be logically correct while we're there, though.
Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au>
---
conf.c | 26 +++++++++++++-------------
icmp.c | 2 +-
2 files changed, 14 insertions(+), 14 deletions(-)
diff --git a/conf.c b/conf.c
index 598c711..769df97 100644
--- a/conf.c
+++ b/conf.c
@@ -1164,11 +1164,11 @@ void conf(struct ctx *c, int argc, char **argv)
!IN6_IS_ADDR_LOOPBACK(&c->ip6.dns_fwd))
break;
- if (c->ip4.dns_fwd == INADDR_ANY &&
+ if (c->ip4.dns_fwd == htonl(INADDR_ANY) &&
inet_pton(AF_INET, optarg, &c->ip4.dns_fwd) &&
- c->ip4.dns_fwd != INADDR_ANY &&
- c->ip4.dns_fwd != INADDR_BROADCAST &&
- c->ip4.dns_fwd != INADDR_LOOPBACK)
+ c->ip4.dns_fwd != htonl(INADDR_ANY) &&
+ c->ip4.dns_fwd != htonl(INADDR_BROADCAST) &&
+ c->ip4.dns_fwd != htonl(INADDR_LOOPBACK))
break;
err("Invalid DNS forwarding address: %s", optarg);
@@ -1363,12 +1363,12 @@ void conf(struct ctx *c, int argc, char **argv)
!IN6_IS_ADDR_MULTICAST(&c->ip6.addr))
break;
- if (c->ip4.addr == INADDR_ANY &&
+ if (c->ip4.addr == htonl(INADDR_ANY) &&
inet_pton(AF_INET, optarg, &c->ip4.addr) &&
- c->ip4.addr != INADDR_ANY &&
- c->ip4.addr != INADDR_BROADCAST &&
- c->ip4.addr != INADDR_LOOPBACK &&
- !IN_MULTICAST(c->ip4.addr))
+ c->ip4.addr != htonl(INADDR_ANY) &&
+ c->ip4.addr != htonl(INADDR_BROADCAST) &&
+ c->ip4.addr != htonl(INADDR_LOOPBACK) &&
+ !IN_MULTICAST(ntohl(c->ip4.addr)))
break;
err("Invalid address: %s", optarg);
@@ -1406,11 +1406,11 @@ void conf(struct ctx *c, int argc, char **argv)
!IN6_IS_ADDR_LOOPBACK(&c->ip6.gw))
break;
- if (c->ip4.gw == INADDR_ANY &&
+ if (c->ip4.gw == htonl(INADDR_ANY) &&
inet_pton(AF_INET, optarg, &c->ip4.gw) &&
- c->ip4.gw != INADDR_ANY &&
- c->ip4.gw != INADDR_BROADCAST &&
- c->ip4.gw != INADDR_LOOPBACK)
+ c->ip4.gw != htonl(INADDR_ANY) &&
+ c->ip4.gw != htonl(INADDR_BROADCAST) &&
+ c->ip4.gw != htonl(INADDR_LOOPBACK))
break;
err("Invalid gateway address: %s", optarg);
diff --git a/icmp.c b/icmp.c
index 233acf9..125f314 100644
--- a/icmp.c
+++ b/icmp.c
@@ -148,7 +148,7 @@ int icmp_tap_handler(const struct ctx *c, int af, const void *addr,
union icmp_epoll_ref iref = { .icmp.v6 = 0 };
struct sockaddr_in sa = {
.sin_family = AF_INET,
- .sin_addr = { .s_addr = INADDR_ANY },
+ .sin_addr = { .s_addr = htonl(INADDR_ANY) },
};
struct icmphdr *ih;
int id, s;
--
2.38.1