lib/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2025-07-31 00:03:07 +03:00
Code Activity

fix: change ipv6 addresses processing for CIDR matching

Browse Source 
Signed-off-by: Francesco Rollo <eferollo@gmail.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
This commit is contained in:
Francesco Rollo
2024-06-07 12:58:21 +02:00
parent e33ef71dee
commit cf1e02010c
3 changed files with 32 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/config.c
View File

@ -41,6 +41,7 @@
# include <sys/wait.h>
# include <ifaddrs.h>
# include <net/if.h>
# include <netinet/in.h>
#endif
#include "libssh/config_parser.h"

26
src/match.c
View File

@ -40,6 +40,11 @@
#include <ctype.h>
#include <stdbool.h>
#include <sys/types.h>
#ifndef _WIN32
#include <arpa/inet.h>
#include <netinet/in.h>
#include <sys/socket.h>
#endif
#include "libssh/priv.h"
@ -219,29 +224,28 @@ cidr_match_6(struct in6_addr *host_addr,
struct in6_addr *net_addr,
unsigned int bits)
{
const uint32_t *a = host_addr->s6_addr32;
const uint32_t *b = net_addr->s6_addr32;
const uint8_t *a = host_addr->s6_addr;
const uint8_t *b = net_addr->s6_addr;
unsigned int qwords_whole, bits_left;
unsigned int byte_whole, bits_left;
/* The number of complete 32-bit words covered by the prefix */
qwords_whole = bits / 32;
/* The number of a complete byte covered by the prefix */
byte_whole = bits / 8;
/*
* The number of bits remaining in the incomplete (last) 32-bit word
* The number of bits remaining in the incomplete (last) byte
* covered by the prefix
*/
bits_left = bits % 32;
bits_left = bits % 8;
if (qwords_whole) {
if (memcmp(a, b, qwords_whole * 4) != 0) {
if (byte_whole) {
if (memcmp(a, b, byte_whole) != 0) {
return 0;
}
}
if (bits_left) {
if ((a[qwords_whole] ^ b[qwords_whole]) &
htonl((0xFFFFFFFFu << (32 - bits_left)) & 0xFFFFFFFFu)) {
if ((a[byte_whole] ^ b[byte_whole]) & (0xFFu << (8 - bits_left))) {
return 0;
}
}

22
tests/unittests/torture_config_match_localnetwork.c
View File

@ -103,16 +103,17 @@ subnet_mask_to_prefix_length_4(struct in_addr subnet_mask)
static int
subnet_mask_to_prefix_length_6(struct in6_addr subnet_mask)
{
uint32_t *mask = NULL, chunk;
int i, prefix_length = 0;
uint8_t *mask = NULL, chunk;
int i, j, prefix_length = 0;
mask = (uint32_t *)&subnet_mask.s6_addr[0];
mask = subnet_mask.s6_addr;
/* Count the number of consecutive 1 bits in each 32-bit chunk */
for (i = 0; i < 4; i++) {
chunk = ntohl(mask[i]);
/* Count the number of consecutive 1 bits in each byte chunk */
for (i = 0; i < 16; i++) {
chunk = mask[i];
while (chunk) {
if (chunk & 0x80000000) {
for (j = 0; j < 8; j++) {
if (chunk & 0x80) {
prefix_length++;
chunk <<= 1;
} else {
@ -120,6 +121,7 @@ subnet_mask_to_prefix_length_6(struct in6_addr subnet_mask)
}
}
}
}
return prefix_length;
}
@ -244,9 +246,9 @@ get_network_id(char *net_id_4, char *net_id_6)
}
/* Calculate the network ID */
for (i = 0; i < 4; i++) {
network_id_6.s6_addr32[i] =
addr6.s6_addr32[i] & subnet_mask_6.s6_addr32[i];
for (i = 0; i < 16; i++) {
network_id_6.s6_addr[i] =
addr6.s6_addr[i] & subnet_mask_6.s6_addr[i];
}
/* Convert network ID to string and compute prefix length */