aboutsummaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)AuthorFilesLines
2021-02-18m_cleanup: fix memory leaksmemory_leaksjeremy marchand1-0/+12
m_cleanup didn't cleanup the if_batchq and if_fastq queues, resulting in a memory leak (reported by ASAN while fuzzing).
2021-02-18ip6_output: fix memory leak on fast-sendndp-leakSamuel Thibault1-0/+3
When emitting NDP Neighbour Sollicitations, ip6_output immediately calls if_encap without going through any queue. if_encap however does not free the mbuf, so ip6_output has to do it. This was leaking one mbuf per NDP NS sent by slirp. Hopefully the guest was not using more than NDP_TABLE_SIZE (16) IPv6 addresses, in which case it was limited to a bound number, but more addresses would result to leaks.
2021-02-16Reject host forwarding to ipv6 "addr-any"Doug Evans1-0/+8
Libslirp currently only provides a stateless DHCPv6 server, and thus can't do the "addr-any -> guest IP address" translation that is done for ipv4. Until a stateful DHCPv6 server is available, reject addr-any. Signed-off-by: Doug Evans <dje@google.com>
2021-02-11tcpx_listen: Pass sizeof(addr) to memsetDoug Evans1-2/+2
Signed-off-by: Doug Evans <dje@google.com>
2021-02-11Complete timeout documentationSamuel Thibault1-1/+1
2021-02-11Document the slirp APISamuel Thibault1-9/+55
2021-02-03Merge branch 'ipv6-host-fwd-9-patch' into 'master'Samuel Thibault7-44/+191
Add ipv6 host forward support See merge request slirp/libslirp!62
2021-02-03Add ipv6 host forward supportDoug Evans7-44/+191
Two exported functions are added which are the ipv6 versions of their ipv4 counterparts: slirp_add_ipv6_hostfwd, slirp_remove_ipv6_hostfwd. Signed-off-by: Doug Evans <dje@google.com>
2021-01-29tcp_subr: simplify codeSamuel Thibault1-1/+1
This is actually similar to the fix in 9f78e94912f9 ("Fix a typo that can cause slow socket response on Windows."), except that here there is no semantic change since s = so->s above. Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2021-01-29[PATCH] Fix a typo that can cause slow socket response on Windows.Hafiz Abid Qadeer1-1/+1
We observed slow responses on a host forwarded port on Windows. Investigation revealed that qemu_fd_register was being called with fd=-1 and this caused g_poll in qemu_poll_ns timing out. I tracked this behavior to following commit: 748f8f4 slirp: replace qemu_set_nonblock() @@ -482,7 +483,8 @@ void tcp_connect(struct socket *inso) tcp_close(sototcpcb(so)); /* This will sofree() as well */ return; } - qemu_set_nonblock(s); + slirp_set_nonblock(s); + so->slirp->cb->register_poll_fd(so->s); It seems that calling register_poll_fd with so->s instead of s may be a typo. Changing it back to s solves this issue. The commit 748f8f4 made similar change in tcp_fconnect but I have not touched it. Signed-off-by: Hafiz Abid Qadeer <abidh@codesourcery.com>
2021-01-24Fix unused variablesMarc-André Lureau1-2/+0
../../subprojects/libslirp/src/slirp.c:131:17: error: unused variable 'old_stat' [-Werror,-Wunused-variable] struct stat old_stat; ^ ../../subprojects/libslirp/src/slirp.c:143:10: error: unused variable 'buff' [-Werror,-Wunused-variable] char buff[512]; ^ 2 errors generated. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2021-01-20fork_exec_child_setup: improve signal handlingNathaniel Wesley Filardo1-0/+8
Blocked signal state is inherited across exec(), so let's zero that out rather than inherit whatever it was when we spawned the child. POSIX has some strange rules about SIG_IGN'd SIGCHLD across exec, so let's not do that, just for consistency.
2020-12-04Remove some needless (void)castsMarc-André Lureau7-18/+18
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-12-01Merge branch 'consume-empty-packet' into 'master'Samuel Thibault1-3/+0
socket: consume empty packets See merge request slirp/libslirp!55
2020-12-01socket: consume empty packetsGiuseppe Scrivano1-3/+0
it fixes a tightloop when a packet with len==0 is received. Closes: https://github.com/rootless-containers/slirp4netns/issues/227 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2020-11-27Merge branch 'errors' into 'master'Samuel Thibault6-6/+96
Enable forwarding ICMP errors See merge request slirp/libslirp!49
2020-11-27Merge branch 'ttl' into 'master'Samuel Thibault3-0/+45
udp, udp6, icmp: handle TTL value See merge request slirp/libslirp!48
2020-11-27slirp: check pkt_len before reading protocol headerPrasad J Pandit2-0/+8
While processing ARP/NCSI packets in 'arp_input' or 'ncsi_input' routines, ensure that pkt_len is large enough to accommodate the respective protocol headers, lest it should do an OOB access. Add check to avoid it. CVE-2020-29129 CVE-2020-29130 QEMU: slirp: out-of-bounds access while processing ARP/NCSI packets -> https://www.openwall.com/lists/oss-security/2020/11/27/1 Reported-by: Qiuhao Li <Qiuhao.Li@outlook.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <20201126135706.273950-1-ppandit@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-10-12Add DNS resolving for iOSosy1-2/+99
iOS does not support reading /etc/resolv.conf so we have to use libresolv Also modified build script to support building on Darwin systems.
2020-08-27Add G_GNUC_PRINTF to local function slirp_vsnprintfStefan Weil1-0/+1
Signed-off-by: Stefan Weil <sw@weilnetz.de>
2020-08-19sosendoob: better document what urgc is used forSamuel Thibault1-3/+4
2020-08-18TCPIPHDR_DELTA: Fix potential negative valueSamuel Thibault1-2/+2
sizeof() returns a size_t so the tcpiphdr / ip+tcphdr difference will be a size_t and always be >= 0, while this intended to detect the difference getting < 0. This is actually a no-op with the current code because it currently has tcpiphdr bigger than ip+tcphdr. Spotted by Coverity: CID 212435. Spotted by Coverity: CID 212440. Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2020-07-19udp, udp6, icmp, icmp6: Enable forwarding errors on LinuxSamuel Thibault2-1/+76
Not all icmp errors are reported as errno errors. Linux however lets us get them through a message error queue. Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2020-07-19icmp, icmp6: Add icmp_forward_error and icmp6_forward_errorSamuel Thibault4-5/+20
They work like icmp_send_error and icmp6_send_error but allow to specify the source IP address Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2020-07-19udp, udp6, icmp: handle TTL valueSamuel Thibault3-0/+45
For traceroute and such, we need to handle the TTL value like a router. Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2020-07-17ip_stripoptions use memmoveDr. David Alan Gilbert1-1/+1
ip_stripoptions is moving data long in the same buffer; that's undefined with memcpy, use memmove. Buglink: https://bugs.launchpad.net/qemu/+bug/1878043 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-07-08util: do not silently truncateMarc-André Lureau1-1/+1
snprintf() always nul-terminate. The return value is the number of business bytes that would be produced if the buffer was large enough. If it returns N for a N size buffer, it means truncation occurred (and we lost one business byte). Related to: #22 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-07-03Fix MTU checkRalf Haferkamp1-1/+1
The size for Header has to be accounted for as well.
2020-07-03Drop bogus IPv6 messagesRalf Haferkamp1-0/+7
Drop IPv6 message shorter than what's mentioned in the payload length header (+ the size of the IPv6 header). They're invalid an could lead to data leakage in icmp6_send_echoreply().
2020-06-01Remove unnecessary breakPhilippe Mathieu-Daudé3-5/+0
The code is unreachable, so no need to break. This silence static analyzer warnings. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2020-06-01Fix constness warningsPhilippe Mathieu-Daudé5-5/+9
Fix the following GCC warnings: src/ncsi.c: In function ‘ncsi_input’: src/ncsi.c:139:31: error: cast discards ‘const’ qualifier from pointer target type [-Werror=cast-qual] 139 | struct ncsi_pkt_hdr *nh = (struct ncsi_pkt_hdr *)(pkt + ETH_HLEN); | ^ src/dnssearch.c: In function ‘translate_dnssearch’: src/dnssearch.c:242:33: error: cast discards ‘const’ qualifier from pointer target type [-Werror=cast-qual] 242 | num_domains = g_strv_length((GStrv)names); | ^ src/slirp.c: In function ‘arp_input’: src/slirp.c:747:31: error: cast discards ‘const’ qualifier from pointer target type [-Werror=cast-qual] 747 | struct slirp_arphdr *ah = (struct slirp_arphdr *)(pkt + ETH_HLEN); | ^ src/dnssearch.c: In function ‘translate_dnssearch’: src/dnssearch.c:242:33: error: cast discards ‘const’ qualifier from pointer target type [-Werror=cast-qual] 242 | num_domains = g_strv_length((const GStrv)names); | ^ src/slirp.c: In function ‘arp_input’: src/slirp.c:764:48: error: passing argument 3 of ‘arp_table_add’ discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers] 764 | arp_table_add(slirp, ah->ar_sip, ah->ar_sha); | ~~^~~~~~~~ In file included from src/slirp.c:25: src/slirp.h:101:60: note: expected ‘uint8_t *’ {aka ‘unsigned char *’} but argument is of type ‘const unsigned char *’ 101 | void arp_table_add(Slirp *slirp, uint32_t ip_addr, uint8_t ethaddr[ETH_ALEN]); | ~~~~~~~~^~~~~~~~~~~~~~~~~ src/slirp.c:783:48: error: passing argument 3 of ‘arp_table_add’ discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers] 783 | arp_table_add(slirp, ah->ar_sip, ah->ar_sha); | ~~^~~~~~~~ In file included from src/slirp.c:25: src/slirp.h:101:60: note: expected ‘uint8_t *’ {aka ‘unsigned char *’} but argument is of type ‘const unsigned char *’ 101 | void arp_table_add(Slirp *slirp, uint32_t ip_addr, uint8_t ethaddr[ETH_ALEN]); | ~~~~~~~~^~~~~~~~~~~~~~~~~ src/slirp.c:804:44: error: passing argument 3 of ‘arp_table_add’ discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers] 804 | arp_table_add(slirp, ah->ar_sip, ah->ar_sha); | ~~^~~~~~~~ In file included from src/slirp.c:25: src/slirp.h:101:60: note: expected ‘uint8_t *’ {aka ‘unsigned char *’} but argument is of type ‘const unsigned char *’ 101 | void arp_table_add(Slirp *slirp, uint32_t ip_addr, uint8_t ethaddr[ETH_ALEN]); | ~~~~~~~~^~~~~~~~~~~~~~~~~ Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2020-06-01Fix win32 builds by using the SLIRP_PACKED definitionPhilippe Mathieu-Daudé1-1/+3
A packed struct needs different gcc attributes for compilations with MinGW compilers because glib-2.0 adds compiler flag -mms-bitfields which modifies the packing algorithm. Attribute gcc_struct reverses the negative effects of -mms-bitfields. We already have the SLIRP_PACKED definition for that, use it. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2020-05-27Check lseek() for failureJindrich Novy1-1/+3
Error: CHECKED_RETURN (CWE-252): [#def26] libslirp-4.3.0/src/tftp.c:121: check_return: Calling "lseek(spt->fd, block_nr * spt->block_size, 0)" without checking return value. This library function may fail and return an error code. 119| 120| if (len) { 121|-> lseek(spt->fd, block_nr * spt->block_size, SEEK_SET); 122| 123| bytes_read = read(spt->fd, buf, len); Signed-off-by: Jindrich Novy <jnovy@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-05-27Be sure to initialize sockaddr structureJindrich Novy1-0/+1
Error: UNINIT (CWE-457): [#def30] libslirp-4.3.0/src/udp.c:325: var_decl: Declaring variable "addr" without initializer. libslirp-4.3.0/src/udp.c:342: uninit_use_in_call: Using uninitialized value "addr". Field "addr.sin_zero" is uninitialized when calling "bind". Signed-off-by: Jindrich Novy <jnovy@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-05-27Use secure string copy to avoid overflowJindrich Novy1-2/+2
Error: STRING_OVERFLOW (CWE-120): [#def2] libslirp-4.3.0/src/ip_icmp.c:277: fixed_size_dest: You might overrun the 20-character fixed-size string "bufa" by copying the return value of "inet_ntoa" without checking the length. 275| if (slirp_debug & DBG_MISC) { 276| char bufa[20], bufb[20]; 277|-> strcpy(bufa, inet_ntoa(ip->ip_src)); 278| strcpy(bufb, inet_ntoa(ip->ip_dst)); 279| DEBUG_MISC(" %.16s to %.16s", bufa, bufb); Error: STRING_OVERFLOW (CWE-120): [#def3] libslirp-4.3.0/src/ip_icmp.c:278: fixed_size_dest: You might overrun the 20-character fixed-size string "bufb" by copying the return value of "inet_ntoa" without checking the length. 276| char bufa[20], bufb[20]; 277| strcpy(bufa, inet_ntoa(ip->ip_src)); 278|-> strcpy(bufb, inet_ntoa(ip->ip_dst)); 279| DEBUG_MISC(" %.16s to %.16s", bufa, bufb); 280| } Signed-off-by: Jindrich Novy <jnovy@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-05-27Fix possible infinite loops and use-after-freeJindrich Novy2-3/+9
Error: USE_AFTER_FREE (CWE-416): [#def1] libslirp-4.3.0/src/ip_icmp.c:79: freed_arg: "icmp_detach" frees "slirp->icmp.so_next". libslirp-4.3.0/src/ip_icmp.c:79: deref_arg: Calling "icmp_detach" dereferences freed pointer "slirp->icmp.so_next". 77| { 78| while (slirp->icmp.so_next != &slirp->icmp) { 79|-> icmp_detach(slirp->icmp.so_next); 80| } 81| } Error: USE_AFTER_FREE (CWE-416): [#def27] libslirp-4.3.0/src/udp.c:56: freed_arg: "udp_detach" frees "slirp->udb.so_next". libslirp-4.3.0/src/udp.c:56: deref_arg: Calling "udp_detach" dereferences freed pointer "slirp->udb.so_next". 54| { 55| while (slirp->udb.so_next != &slirp->udb) { 56|-> udp_detach(slirp->udb.so_next); 57| } 58| } Signed-off-by: Jindrich Novy <jnovy@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-04-06Fix use-afte-free in ip_reass() (CVE-2020-1983)Marc-André Lureau1-4/+2
The q pointer is updated when the mbuf data is moved from m_dat to m_ext. m_ext buffer may also be realloc()'ed and moved during m_cat(): q should also be updated in this case. Reported-by: Aviv Sasson <asasson@paloaltonetworks.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2020-03-25libslirp.h: fix SlirpConfig v3 documentationAkihiro Suda1-0/+3
Follow-up to 1021b0dc38d39f1dc95a296fe3e05a24a087cdc6 (https://gitlab.freedesktop.org/slirp/libslirp/-/merge_requests/31) Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2020-03-24limit vnameserver_addr to port 535eraph1-2/+2
Fixes #16 Signed-off-by: 5eraph <5eraph@protonmail.com>
2020-03-23disable_dns option5eraph4-3/+12
Fixes #16 Signed-off-by: 5eraph <5eraph@protonmail.com>
2020-03-20build-sys: fix NetBSD build regressionMarc-André Lureau1-0/+5
Fixes: 09d410adbff5422b7ba7596bce0ca71f9f807ea9 ("allow custom MTU") Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-03-17Merge branch 'vcs-version' into 'master'Marc-André Lureau2-4/+2
Teach slirp_version_string() to return vcs version See merge request slirp/libslirp!34
2020-03-17Teach slirp_version_string() to return vcs versionMarc-André Lureau2-4/+2
Meson build will use a vcs-generate version, while Makefile will always use -git version, since it is only intended for submodule usage. Eventually can be improved if needed. Fixes: https://gitlab.freedesktop.org/slirp/libslirp/issues/17 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-03-17Revert "socket: remove need for extra scope_id variable"Marc-André Lureau1-1/+6
Oops, it turns out the variable is there for portability reasons. This reverts commit d65f3030a82743bf506b0611a6a1a0358ea5d52b. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-03-16socket: do not fallback on loopback addr for addresses in our mask/prefixMarc-André Lureau1-16/+12
Currently, any address within the subnetwork will fallback on loopback. It seems it has always been like that, but it seems wrong, and I don't see a good reason to keep it this way. Fortunately, lack of ARP reply made this unusable in practice, so we shouldn't break much existing users. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-03-16socket: do not fallback on host loopback if get_dns_addr() failedMarc-André Lureau1-6/+2
Somewhat related to #16, but not as restrictive. (imho, it should be possible to access any port on the given DNS IP, not just 53) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-03-16socket: remove need for extra scope_id variableMarc-André Lureau1-3/+1
The value is only set on success. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-03-16socket: factor out sotranslate ipv4/ipv6 handlingMarc-André Lureau1-42/+54
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-03-16socket: remove extra label and variableMarc-André Lureau1-9/+6
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-03-02Use specific outbound IP address5eraph8-1/+58
Fixes #14 Signed-off-by: 5eraph <bcervenka@protonmail.com>
generated by cgit v1.1 at 2024-07-10 07:19:48 +0000