aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2020-04-23Merge branch 'release-v4.3.0' into 'master'v4.3.0Marc-André Lureau3-6/+4
Release v4.3.0 See merge request slirp/libslirp!39
2020-04-22Release v4.3.0Marc-André Lureau3-6/+4
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-04-20Merge branch 'cve-2020-1983' into 'master'Marc-André Lureau2-6/+13
Cve 2020 1983 Closes #20 See merge request slirp/libslirp!38
2020-04-20Update CHANGELOGMarc-André Lureau1-2/+11
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-04-06Fix use-afte-free in ip_reass() (CVE-2020-1983)Marc-André Lureau1-4/+2
The q pointer is updated when the mbuf data is moved from m_dat to m_ext. m_ext buffer may also be realloc()'ed and moved during m_cat(): q should also be updated in this case. Reported-by: Aviv Sasson <asasson@paloaltonetworks.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2020-03-25Merge branch 'fix-slirpconfig-3-doc' into 'master'Marc-André Lureau1-0/+3
libslirp.h: fix SlirpConfig v3 documentation See merge request slirp/libslirp!37
2020-03-25libslirp.h: fix SlirpConfig v3 documentationAkihiro Suda1-0/+3
Follow-up to 1021b0dc38d39f1dc95a296fe3e05a24a087cdc6 (https://gitlab.freedesktop.org/slirp/libslirp/-/merge_requests/31) Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2020-03-24Merge branch 'master' into 'master'Marc-André Lureau4-5/+14
Limit dns passthrough to port 53 only and `disable_dns` Closes #16 See merge request slirp/libslirp!31
2020-03-24limit vnameserver_addr to port 535eraph1-2/+2
Fixes #16 Signed-off-by: 5eraph <5eraph@protonmail.com>
2020-03-23disable_dns option5eraph4-3/+12
Fixes #16 Signed-off-by: 5eraph <5eraph@protonmail.com>
2020-03-21build-sys: make libslirp-version.h depend on MakefileMarc-André Lureau1-1/+1
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-03-20Merge branch 'netbsd-fix' into 'master'Marc-André Lureau1-0/+5
build-sys: fix NetBSD build regression See merge request slirp/libslirp!36
2020-03-20build-sys: fix NetBSD build regressionMarc-André Lureau1-0/+5
Fixes: 09d410adbff5422b7ba7596bce0ca71f9f807ea9 ("allow custom MTU") Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-03-18meson: bump required version to 0.49Marc-André Lureau1-1/+2
We didn't specify any version so far, but the git generated version requires 0.49: WARNING: Project specifies a minimum meson_version '>= 0.48' but uses features which were added in newer versions: * 0.49.0: {'Calling "add_dist_script" with multiple arguments'} Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-03-17Merge branch 'vcs-version' into 'master'Marc-André Lureau7-7/+185
Teach slirp_version_string() to return vcs version See merge request slirp/libslirp!34
2020-03-17Merge branch 'mingw-fix' into 'master'Marc-André Lureau2-3/+8
Fix mingw scope-id warning See merge request slirp/libslirp!35
2020-03-17Teach slirp_version_string() to return vcs versionMarc-André Lureau7-7/+185
Meson build will use a vcs-generate version, while Makefile will always use -git version, since it is only intended for submodule usage. Eventually can be improved if needed. Fixes: https://gitlab.freedesktop.org/slirp/libslirp/issues/17 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-03-17Revert "socket: remove need for extra scope_id variable"Marc-André Lureau1-1/+6
Oops, it turns out the variable is there for portability reasons. This reverts commit d65f3030a82743bf506b0611a6a1a0358ea5d52b. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-03-17.gitlab-ci: add --werror, treat CI build warnings as errorsMarc-André Lureau1-2/+2
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-03-17changelog: fix linkMarc-André Lureau1-1/+1
2020-03-17changelog: post-releaseMarc-André Lureau1-1/+11
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-03-17Merge branch 'release-v4.2.0' into 'master'v4.2.0Marc-André Lureau3-6/+12
Release v4.2.0 Closes #15 See merge request slirp/libslirp!33
2020-03-17Merge branch 'translate-fix' into 'master'Marc-André Lureau1-47/+46
Translate fixes See merge request slirp/libslirp!32
2020-03-17Prepare for v4.2.0 releaseMarc-André Lureau3-6/+12
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-03-16socket: do not fallback on loopback addr for addresses in our mask/prefixMarc-André Lureau1-16/+12
Currently, any address within the subnetwork will fallback on loopback. It seems it has always been like that, but it seems wrong, and I don't see a good reason to keep it this way. Fortunately, lack of ARP reply made this unusable in practice, so we shouldn't break much existing users. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-03-16socket: do not fallback on host loopback if get_dns_addr() failedMarc-André Lureau1-6/+2
Somewhat related to #16, but not as restrictive. (imho, it should be possible to access any port on the given DNS IP, not just 53) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-03-16socket: remove need for extra scope_id variableMarc-André Lureau1-3/+1
The value is only set on success. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-03-16socket: factor out sotranslate ipv4/ipv6 handlingMarc-André Lureau1-42/+54
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-03-16socket: remove extra label and variableMarc-André Lureau1-9/+6
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-03-02Merge branch 'master' into 'master'Samuel Thibault8-1/+58
use specific outbound IP address See merge request slirp/libslirp!30 Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2020-03-02Use specific outbound IP address5eraph8-1/+58
Fixes #14 Signed-off-by: 5eraph <bcervenka@protonmail.com>
2020-02-03Merge branch 'slirp-fmt' into 'master'Marc-André Lureau3-7/+9
misc: slirp_fmt*() improvements See merge request slirp/libslirp!28
2020-01-30Merge branch 'aw-guestfwd-state' into 'master'Marc-André Lureau1-0/+2
Fix loading of guestfwd state Unsure how testing usually is done for changes in this project. I have built qemu with this change and it fixes the bug in my setup (testbed where a system is booted a snapshot is created, and then that snapshot is restored many times to run different tests. Outbound syslog uses a guestfwd to a qemu chardev) See merge request slirp/libslirp!29
2020-01-30state: fix loading of guestfwd stateAnders Waldenborg1-0/+2
The refactoring done in commit d181d14b "slirp: use a dedicated field for chardev pointer" forgot to change one place in slirp_state_load where 'ex_exec' was used to store the chardev ptr. This broke loading of saved state. Later commit 4f38cfb5 "slirp: remove unused EMU_RSH" removed this line all together, as it now looked like it didn't do anything. This commit ensures that guestfwd is properly setup on the socket when loading state. Signed-off-by: Anders Waldenborg <anders@0x63.nu>
2020-01-27util: add gnuc format function attribute to slirp_fmt*Marc-André Lureau1-2/+4
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
2020-01-27Use g_snprintf()Marc-André Lureau2-3/+3
The GLib impl guarantees GNU compatible format strings, which fixes the horror of Windows platform format strings. Suggested-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-01-27misc: improve error reportMarc-André Lureau1-2/+2
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-01-27tcp_emu: fix unsafe snprintf() usagesMarc-André Lureau1-23/+21
Various calls to snprintf() assume that snprintf() returns "only" the number of bytes written (excluding terminating NUL). https://pubs.opengroup.org/onlinepubs/9699919799/functions/snprintf.html#tag_16_159_04 "Upon successful completion, the snprintf() function shall return the number of bytes that would be written to s had n been sufficiently large excluding the terminating null byte." Before patch ce131029, if there isn't enough room in "m_data" for the "DCC ..." message, we overflow "m_data". After the patch, if there isn't enough room for the same, we don't overflow "m_data", but we set "m_len" out-of-bounds. The next time an access is bounded by "m_len", we'll have a buffer overflow then. Use slirp_fmt*() to fix potential OOB memory access. Reported-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Message-Id: <20200127092414.169796-7-marcandre.lureau@redhat.com>
2020-01-27tcp_ctl: use slirp_fmt()Marc-André Lureau1-3/+2
Make it safer to OOB (sb_cc must not go out of sb_data), warn on truncation, abort on error. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Message-Id: <20200127092414.169796-6-marcandre.lureau@redhat.com>
2020-01-27tftp: use slirp_fmt0()Marc-André Lureau1-6/+2
Make it OOB-safe, warn on truncation, always \0-end, abort on error. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Message-Id: <20200127092414.169796-5-marcandre.lureau@redhat.com>
2020-01-27misc: use slirp_fmt0()Marc-André Lureau1-6/+6
Those are safe and should never fail. Nevertheless, use slirp_snfillf0() for more safety. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Message-Id: <20200127092414.169796-4-marcandre.lureau@redhat.com>
2020-01-27dhcpv6: use slirp_fmt()Marc-André Lureau1-7/+6
Warn if result is truncated, return bytes actually written (excluding \0). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Message-Id: <20200127092414.169796-3-marcandre.lureau@redhat.com>
2020-01-27util: add slirp_fmt() helpersMarc-André Lureau2-0/+65
Various calls to snprintf() in libslirp assume that snprintf() returns "only" the number of bytes written (excluding terminating NUL). https://pubs.opengroup.org/onlinepubs/9699919799/functions/snprintf.html#tag_16_159_04 "Upon successful completion, the snprintf() function shall return the number of bytes that would be written to s had n been sufficiently large excluding the terminating null byte." Introduce slirp_fmt() that handles several pathological cases the way libslirp usually expect: - treat error as fatal (instead of silently returning -1) - fmt0() will always \0 end - return the number of bytes actually written (instead of what would have been written, which would usually result in OOB later), including the ending \0 for fmt0() - warn if truncation happened (instead of ignoring) Other less common cases can still be handled with strcpy/snprintf() etc. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Message-Id: <20200127092414.169796-2-marcandre.lureau@redhat.com>
2020-01-22tcp_emu: add more fixme/warnings commentsMarc-André Lureau1-0/+3
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2020-01-22tftp: clarify what is actually OACK m_lenMarc-André Lureau1-2/+1
The current computation is a bit convoluted, and doesn't reflect >0. What is actually computed is sizeof(): struct tftp_t { struct udphdr udp; uint16_t tp_op; union { ... char tp_buf[TFTP_BLOCKSIZE_MAX + 2]; } x; } - sizeof(struct udphdr) == udp field - (TFTP_BLOCKSIZE_MAX + 2) == tp_buf field + n What remains is: G_SIZEOF_MEMBER(struct tftp_t, tp_op) + n. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2020-01-22bootp: replace simple snprintf() with strcpy()Marc-André Lureau1-3/+4
Minor code simplification. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-01-22bootp: remove extra castMarc-André Lureau2-2/+2
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2020-01-22Check bootp_filename is not going to be truncatedMarc-André Lureau1-0/+3
If the given bootp_filename is too long, it is silently truncated in bootp.c snprintf(). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2020-01-22util: add G_SIZEOF_MEMBER() macroMarc-André Lureau1-0/+4
I am (overly?) optimistic this macro will be added to glib: https://gitlab.gnome.org/GNOME/glib/merge_requests/1333 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2020-01-14slirp: tftp: restrict relative path accessPrasad J Pandit1-2/+7
tftp restricts relative or directory path access on Linux systems. Apply same restrictions on Windows systems too. It helps to avoid directory traversal issue. Fixes: https://bugs.launchpad.net/qemu/+bug/1812451 Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Message-Id: <20200113121431.156708-1-ppandit@redhat.com>
generated by cgit v1.1 at 2024-07-17 04:43:37 +0000