lib/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2025-07-31 00:03:07 +03:00
Code Activity

fix: change ipv6 addresses processing for CIDR matching

Browse Source 
Signed-off-by: Francesco Rollo <eferollo@gmail.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
This commit is contained in:
Francesco Rollo
2024-06-07 12:58:21 +02:00
parent e33ef71dee
commit cf1e02010c
3 changed files with 32 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/config.c
View File

@ -41,6 +41,7 @@
# include <sys/wait.h> # include <sys/wait.h>
# include <ifaddrs.h> # include <ifaddrs.h>
# include <net/if.h> # include <net/if.h>
# include <netinet/in.h>
#endif #endif
#include "libssh/config_parser.h" #include "libssh/config_parser.h"

26
src/match.c
View File

@ -40,6 +40,11 @@
#include <ctype.h> #include <ctype.h>
#include <stdbool.h> #include <stdbool.h>
#include <sys/types.h> #include <sys/types.h>
#ifndef _WIN32
#include <arpa/inet.h>
#include <netinet/in.h>
#include <sys/socket.h>
#endif
#include "libssh/priv.h" #include "libssh/priv.h"
@ -219,29 +224,28 @@ cidr_match_6(struct in6_addr *host_addr,
struct in6_addr *net_addr, struct in6_addr *net_addr,
unsigned int bits) unsigned int bits)
{ {
const uint32_t *a = host_addr->s6_addr32; const uint8_t *a = host_addr->s6_addr;
const uint32_t *b = net_addr->s6_addr32; const uint8_t *b = net_addr->s6_addr;
unsigned int qwords_whole, bits_left; unsigned int byte_whole, bits_left;
/* The number of complete 32-bit words covered by the prefix */ /* The number of a complete byte covered by the prefix */
qwords_whole = bits / 32; byte_whole = bits / 8;
/* /*
* The number of bits remaining in the incomplete (last) 32-bit word * The number of bits remaining in the incomplete (last) byte
* covered by the prefix * covered by the prefix
*/ */
bits_left = bits % 32; bits_left = bits % 8;
if (qwords_whole) { if (byte_whole) {
if (memcmp(a, b, qwords_whole * 4) != 0) { if (memcmp(a, b, byte_whole) != 0) {
return 0; return 0;
} }
} }
if (bits_left) { if (bits_left) {
if ((a[qwords_whole] ^ b[qwords_whole]) & if ((a[byte_whole] ^ b[byte_whole]) & (0xFFu << (8 - bits_left))) {
htonl((0xFFFFFFFFu << (32 - bits_left)) & 0xFFFFFFFFu)) {
return 0; return 0;
} }
} }

30
tests/unittests/torture_config_match_localnetwork.c
View File

@ -103,20 +103,22 @@ subnet_mask_to_prefix_length_4(struct in_addr subnet_mask)
static int static int
subnet_mask_to_prefix_length_6(struct in6_addr subnet_mask) subnet_mask_to_prefix_length_6(struct in6_addr subnet_mask)
{ {
uint32_t *mask = NULL, chunk; uint8_t *mask = NULL, chunk;
int i, prefix_length = 0; int i, j, prefix_length = 0;
mask = (uint32_t *)&subnet_mask.s6_addr[0]; mask = subnet_mask.s6_addr;
/* Count the number of consecutive 1 bits in each 32-bit chunk */ /* Count the number of consecutive 1 bits in each byte chunk */
for (i = 0; i < 4; i++) { for (i = 0; i < 16; i++) {
chunk = ntohl(mask[i]); chunk = mask[i];
while (chunk) { while (chunk) {
if (chunk & 0x80000000) { for (j = 0; j < 8; j++) {
prefix_length++; if (chunk & 0x80) {
chunk <<= 1; prefix_length++;
} else { chunk <<= 1;
break; } else {
break;
}
} }
} }
} }
@ -244,9 +246,9 @@ get_network_id(char *net_id_4, char *net_id_6)
} }
/* Calculate the network ID */ /* Calculate the network ID */
for (i = 0; i < 4; i++) { for (i = 0; i < 16; i++) {
network_id_6.s6_addr32[i] = network_id_6.s6_addr[i] =
addr6.s6_addr32[i] & subnet_mask_6.s6_addr32[i]; addr6.s6_addr[i] & subnet_mask_6.s6_addr[i];
} }
/* Convert network ID to string and compute prefix length */ /* Convert network ID to string and compute prefix length */