]> The Tcpdump Group git mirrors - tcpdump/blobdiff - print-nfs.c
CVE-2017-13045/VQP: add some bounds checks
[tcpdump] / print-nfs.c
index 50334d10e5ea78ab0778f0ecaf8ebac64b215d13..e752a59cf4b9122df2a84ff677a411c84464aa57 100644 (file)
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
 
+/* \summary: Network File System (NFS) printer */
+
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
 
-#include <tcpdump-stdinc.h>
+#include <netdissect-stdinc.h>
 
 #include <stdio.h>
 #include <string.h>
 
-#include "interface.h"
+#include "netdissect.h"
 #include "addrtoname.h"
 #include "extract.h"
 
@@ -36,9 +38,7 @@
 #include "nfsfh.h"
 
 #include "ip.h"
-#ifdef INET6
 #include "ip6.h"
-#endif
 #include "rpc_auth.h"
 #include "rpc_msg.h"
 
@@ -54,7 +54,7 @@ static const uint32_t *parse_post_op_attr(netdissect_options *, const uint32_t *
 /*
  * Mapping of old NFS Version 2 RPC numbers to generic numbers.
  */
-uint32_t nfsv3_procid[NFS_NPROCS] = {
+static uint32_t nfsv3_procid[NFS_NPROCS] = {
        NFSPROC_NULL,
        NFSPROC_GETATTR,
        NFSPROC_SETATTR,
@@ -203,15 +203,8 @@ print_nfsaddr(netdissect_options *ndo,
               const u_char *bp, const char *s, const char *d)
 {
        const struct ip *ip;
-#ifdef INET6
        const struct ip6_hdr *ip6;
        char srcaddr[INET6_ADDRSTRLEN], dstaddr[INET6_ADDRSTRLEN];
-#else
-#ifndef INET_ADDRSTRLEN
-#define INET_ADDRSTRLEN        16
-#endif
-       char srcaddr[INET_ADDRSTRLEN], dstaddr[INET_ADDRSTRLEN];
-#endif
 
        srcaddr[0] = dstaddr[0] = '\0';
        switch (IP_V((const struct ip *)bp)) {
@@ -220,7 +213,6 @@ print_nfsaddr(netdissect_options *ndo,
                strlcpy(srcaddr, ipaddr_string(ndo, &ip->ip_src), sizeof(srcaddr));
                strlcpy(dstaddr, ipaddr_string(ndo, &ip->ip_dst), sizeof(dstaddr));
                break;
-#ifdef INET6
        case 6:
                ip6 = (const struct ip6_hdr *)bp;
                strlcpy(srcaddr, ip6addr_string(ndo, &ip6->ip6_src),
@@ -228,7 +220,6 @@ print_nfsaddr(netdissect_options *ndo,
                strlcpy(dstaddr, ip6addr_string(ndo, &ip6->ip6_dst),
                    sizeof(dstaddr));
                break;
-#endif
        default:
                strlcpy(srcaddr, "?", sizeof(srcaddr));
                strlcpy(dstaddr, "?", sizeof(dstaddr));
@@ -637,17 +628,15 @@ nfsreq_print_noaddr(netdissect_options *ndo,
                if ((dp = parsereq(ndo, rp, length)) != NULL &&
                    (dp = parsefh(ndo, dp, v3)) != NULL) {
                        if (v3) {
-                               ND_TCHECK(dp[2]);
+                               ND_TCHECK(dp[4]);
                                ND_PRINT((ndo, " %u (%u) bytes @ %" PRIu64,
                                                EXTRACT_32BITS(&dp[4]),
                                                EXTRACT_32BITS(&dp[2]),
                                                EXTRACT_64BITS(&dp[0])));
                                if (ndo->ndo_vflag) {
-                                       dp += 3;
-                                       ND_TCHECK(dp[0]);
                                        ND_PRINT((ndo, " <%s>",
                                                tok2str(nfsv3_writemodes,
-                                                       NULL, EXTRACT_32BITS(dp))));
+                                                       NULL, EXTRACT_32BITS(&dp[3]))));
                                }
                        } else {
                                ND_TCHECK(dp[3]);
@@ -662,12 +651,12 @@ nfsreq_print_noaddr(netdissect_options *ndo,
                break;
 
        case NFSPROC_SYMLINK:
-               if ((dp = parsereq(ndo, rp, length)) != 0 &&
-                   (dp = parsefhn(ndo, dp, v3)) != 0) {
+               if ((dp = parsereq(ndo, rp, length)) != NULL &&
+                   (dp = parsefhn(ndo, dp, v3)) != NULL) {
                        ND_PRINT((ndo, " ->"));
-                       if (v3 && (dp = parse_sattr3(ndo, dp, &sa3)) == 0)
+                       if (v3 && (dp = parse_sattr3(ndo, dp, &sa3)) == NULL)
                                break;
-                       if (parsefn(ndo, dp) == 0)
+                       if (parsefn(ndo, dp) == NULL)
                                break;
                        if (v3 && ndo->ndo_vflag)
                                print_sattr3(ndo, &sa3, ndo->ndo_vflag);
@@ -676,12 +665,12 @@ nfsreq_print_noaddr(netdissect_options *ndo,
                break;
 
        case NFSPROC_MKNOD:
-               if ((dp = parsereq(ndo, rp, length)) != 0 &&
-                   (dp = parsefhn(ndo, dp, v3)) != 0) {
+               if ((dp = parsereq(ndo, rp, length)) != NULL &&
+                   (dp = parsefhn(ndo, dp, v3)) != NULL) {
                        ND_TCHECK(*dp);
                        type = (nfs_type)EXTRACT_32BITS(dp);
                        dp++;
-                       if ((dp = parse_sattr3(ndo, dp, &sa3)) == 0)
+                       if ((dp = parse_sattr3(ndo, dp, &sa3)) == NULL)
                                break;
                        ND_PRINT((ndo, " %s", tok2str(type2str, "unk-ft %d", type)));
                        if (ndo->ndo_vflag && (type == NFCHR || type == NFBLK)) {
@@ -818,11 +807,15 @@ nfs_printfh(netdissect_options *ndo,
 
        if (sfsname) {
                /* file system ID is ASCII, not numeric, for this server OS */
-               static char temp[NFSX_V3FHMAX+1];
+               char temp[NFSX_V3FHMAX+1];
+               u_int stringlen;
 
                /* Make sure string is null-terminated */
-               strncpy(temp, sfsname, NFSX_V3FHMAX);
-               temp[sizeof(temp) - 1] = '\0';
+               stringlen = len;
+               if (stringlen > NFSX_V3FHMAX)
+                       stringlen = NFSX_V3FHMAX;
+               strncpy(temp, sfsname, stringlen);
+               temp[stringlen] = '\0';
                /* Remove trailing spaces */
                spacep = strchr(temp, ' ');
                if (spacep)
@@ -850,13 +843,8 @@ nfs_printfh(netdissect_options *ndo,
 struct xid_map_entry {
        uint32_t        xid;            /* transaction ID (net order) */
        int ipver;                      /* IP version (4 or 6) */
-#ifdef INET6
        struct in6_addr client;         /* client IP address (net order) */
        struct in6_addr server;         /* server IP address (net order) */
-#else
-       struct in_addr  client;         /* client IP address (net order) */
-       struct in_addr  server;         /* server IP address (net order) */
-#endif
        uint32_t        proc;           /* call proc number (host order) */
        uint32_t        vers;           /* program version (host order) */
 };
@@ -869,32 +857,28 @@ struct xid_map_entry {
 
 #define        XIDMAPSIZE      64
 
-struct xid_map_entry xid_map[XIDMAPSIZE];
+static struct xid_map_entry xid_map[XIDMAPSIZE];
 
-int    xid_map_next = 0;
-int    xid_map_hint = 0;
+static int xid_map_next = 0;
+static int xid_map_hint = 0;
 
 static int
 xid_map_enter(netdissect_options *ndo,
               const struct sunrpc_msg *rp, const u_char *bp)
 {
        const struct ip *ip = NULL;
-#ifdef INET6
        const struct ip6_hdr *ip6 = NULL;
-#endif
        struct xid_map_entry *xmep;
 
-       if (!ND_TTEST(rp->rm_call.cb_vers))
+       if (!ND_TTEST(rp->rm_call.cb_proc))
                return (0);
        switch (IP_V((const struct ip *)bp)) {
        case 4:
                ip = (const struct ip *)bp;
                break;
-#ifdef INET6
        case 6:
                ip6 = (const struct ip6_hdr *)bp;
                break;
-#endif
        default:
                return (1);
        }
@@ -910,13 +894,11 @@ xid_map_enter(netdissect_options *ndo,
                UNALIGNED_MEMCPY(&xmep->client, &ip->ip_src, sizeof(ip->ip_src));
                UNALIGNED_MEMCPY(&xmep->server, &ip->ip_dst, sizeof(ip->ip_dst));
        }
-#ifdef INET6
        else if (ip6) {
                xmep->ipver = 6;
                UNALIGNED_MEMCPY(&xmep->client, &ip6->ip6_src, sizeof(ip6->ip6_src));
                UNALIGNED_MEMCPY(&xmep->server, &ip6->ip6_dst, sizeof(ip6->ip6_dst));
        }
-#endif
        xmep->proc = EXTRACT_32BITS(&rp->rm_call.cb_proc);
        xmep->vers = EXTRACT_32BITS(&rp->rm_call.cb_vers);
        return (1);
@@ -932,13 +914,12 @@ xid_map_find(const struct sunrpc_msg *rp, const u_char *bp, uint32_t *proc,
 {
        int i;
        struct xid_map_entry *xmep;
-       uint32_t xid = rp->rm_xid;
+       uint32_t xid;
        const struct ip *ip = (const struct ip *)bp;
-#ifdef INET6
        const struct ip6_hdr *ip6 = (const struct ip6_hdr *)bp;
-#endif
        int cmp;
 
+       UNALIGNED_MEMCPY(&xid, &rp->rm_xid, sizeof(xmep->xid));
        /* Start searching from where we last left off */
        i = xid_map_hint;
        do {
@@ -955,7 +936,6 @@ xid_map_find(const struct sunrpc_msg *rp, const u_char *bp, uint32_t *proc,
                                cmp = 0;
                        }
                        break;
-#ifdef INET6
                case 6:
                        if (UNALIGNED_MEMCMP(&ip6->ip6_src, &xmep->server,
                                   sizeof(ip6->ip6_src)) != 0 ||
@@ -964,7 +944,6 @@ xid_map_find(const struct sunrpc_msg *rp, const u_char *bp, uint32_t *proc,
                                cmp = 0;
                        }
                        break;
-#endif
                default:
                        cmp = 0;
                        break;
@@ -1025,11 +1004,11 @@ parserep(netdissect_options *ndo,
         * skip past the ar_verf credentials.
         */
        dp += (len + (2*sizeof(uint32_t) + 3)) / sizeof(uint32_t);
-       ND_TCHECK2(dp[0], 0);
 
        /*
         * now we can check the ar_stat field
         */
+       ND_TCHECK(dp[0]);
        astat = (enum sunrpc_accept_stat) EXTRACT_32BITS(dp);
        if (astat != SUNRPC_SUCCESS) {
                ND_PRINT((ndo, " %s", tok2str(sunrpc_str, "ar_stat %d", astat)));
@@ -1266,6 +1245,7 @@ static const uint32_t *
 parse_wcc_attr(netdissect_options *ndo,
                const uint32_t *dp)
 {
+       /* Our caller has already checked this */
        ND_PRINT((ndo, " sz %" PRIu64, EXTRACT_64BITS(&dp[0])));
        ND_PRINT((ndo, " mtime %u.%06u ctime %u.%06u",
               EXTRACT_32BITS(&dp[2]), EXTRACT_32BITS(&dp[3]),
@@ -1367,7 +1347,7 @@ parsewccres(netdissect_options *ndo,
 
        if (!(dp = parsestatus(ndo, dp, &er)))
                return (0);
-       return parse_wcc_data(ndo, dp, verbose) != 0;
+       return parse_wcc_data(ndo, dp, verbose) != NULL;
 }
 
 static const uint32_t *
@@ -1534,8 +1514,10 @@ interp_reply(netdissect_options *ndo,
                        ND_PRINT((ndo, " attr:"));
                if (!(dp = parse_post_op_attr(ndo, dp, ndo->ndo_vflag)))
                        break;
-               if (!er)
+               if (!er) {
+                       ND_TCHECK(dp[0]);
                        ND_PRINT((ndo, " c %04x", EXTRACT_32BITS(&dp[0])));
+               }
                return;
 
        case NFSPROC_READLINK:
@@ -1599,7 +1581,7 @@ interp_reply(netdissect_options *ndo,
                if (!(dp = parserep(ndo, rp, length)))
                        break;
                if (v3) {
-                       if (parsecreateopres(ndo, dp, ndo->ndo_vflag) != 0)
+                       if (parsecreateopres(ndo, dp, ndo->ndo_vflag) != NULL)
                                return;
                } else {
                        if (parsediropres(ndo, dp) != 0)
@@ -1611,10 +1593,10 @@ interp_reply(netdissect_options *ndo,
                if (!(dp = parserep(ndo, rp, length)))
                        break;
                if (v3) {
-                       if (parsecreateopres(ndo, dp, ndo->ndo_vflag) != 0)
+                       if (parsecreateopres(ndo, dp, ndo->ndo_vflag) != NULL)
                                return;
                } else {
-                       if (parsestatus(ndo, dp, &er) != 0)
+                       if (parsestatus(ndo, dp, &er) != NULL)
                                return;
                }
                break;
@@ -1622,7 +1604,7 @@ interp_reply(netdissect_options *ndo,
        case NFSPROC_MKNOD:
                if (!(dp = parserep(ndo, rp, length)))
                        break;
-               if (parsecreateopres(ndo, dp, ndo->ndo_vflag) != 0)
+               if (parsecreateopres(ndo, dp, ndo->ndo_vflag) != NULL)
                        return;
                break;
 
@@ -1634,7 +1616,7 @@ interp_reply(netdissect_options *ndo,
                        if (parsewccres(ndo, dp, ndo->ndo_vflag))
                                return;
                } else {
-                       if (parsestatus(ndo, dp, &er) != 0)
+                       if (parsestatus(ndo, dp, &er) != NULL)
                                return;
                }
                break;
@@ -1655,7 +1637,7 @@ interp_reply(netdissect_options *ndo,
                        }
                        return;
                } else {
-                       if (parsestatus(ndo, dp, &er) != 0)
+                       if (parsestatus(ndo, dp, &er) != NULL)
                                return;
                }
                break;
@@ -1676,7 +1658,7 @@ interp_reply(netdissect_options *ndo,
                                return;
                        }
                } else {
-                       if (parsestatus(ndo, dp, &er) != 0)
+                       if (parsestatus(ndo, dp, &er) != NULL)
                                return;
                }
                break;