luc14n0/glib
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/glib.git synced 2025-08-01 23:13:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

gio: don't accept nonstandard IPv4 "numbers-and-dots" addresses

Browse Source 
In addition to the standard "192.168.1.1" format, there are numerous
legacy IPv4 address formats (such as "192.168.257",
"0xc0.0xa8.0x01.0x01", "0300.0250.0001.0001", "3232235777", and
"0xc0a80101"). However, none of these forms are ever used any more
except in phishing attempts. GLib wasn't supposed to be accepting
these addresses (neither g_hostname_is_ip_address() nor
g_inet_address_new_from_string() recognizes them), but getaddrinfo()
accepts them, and so the parts of gio that use getaddrinfo()
accidentally did accept those formats.

Fix GNetworkAddress and GResolver to reject these address formats.

https://bugzilla.gnome.org/show_bug.cgi?id=679957
This commit is contained in:
Dan Winship
2013-08-20 21:36:25 -04:00
parent 5cab3fcec1
commit 5575a3e9cb
7 changed files with 256 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

74
gio/ginetsocketaddress.c
View File

@@ -328,6 +328,80 @@ g_inet_socket_address_new (GInetAddress *address,
NULL);
}
/**
* g_inet_socket_address_new_from_string:
* @address: the string form of an IP address
* @port: a port number
*
* Creates a new #GInetSocketAddress for @address and @port.
*
* If @address is an IPv6 address, it can also contain a scope ID
* (separated from the address by a "<literal>%</literal>").
*
* Returns: a new #GInetSocketAddress, or %NULL if @address cannot be
* parsed.
*
* Since: 2.40
*/
GSocketAddress *
g_inet_socket_address_new_from_string (const char *address,
guint port)
{
static struct addrinfo *hints, hints_struct;
GSocketAddress *saddr;
GInetAddress *iaddr;
struct addrinfo *res;
gint status;
if (strchr (address, ':'))
{
/* IPv6 address (or it's invalid). We use getaddrinfo() because
* it will handle parsing a scope_id as well.
*/
if (G_UNLIKELY (g_once_init_enter (&hints)))
{
hints_struct.ai_socktype = SOCK_STREAM;
hints_struct.ai_flags = AI_NUMERICHOST;
g_once_init_leave (&hints, &hints_struct);
}
status = getaddrinfo (address, NULL, hints, &res);
if (status != 0)
return NULL;
if (res->ai_family == AF_INET6 &&
res->ai_addrlen == sizeof (struct sockaddr_in6))
{
((struct sockaddr_in6 *)res->ai_addr)->sin6_port = g_htons (port);
saddr = g_socket_address_new_from_native (res->ai_addr, res->ai_addrlen);
}
else
saddr = NULL;
freeaddrinfo (res);
}
else
{
/* IPv4 (or invalid). We don't want to use getaddrinfo() here,
* because it accepts the stupid "IPv4 numbers-and-dots
* notation" addresses that are never used for anything except
* phishing. Since we don't have to worry about scope IDs for
* IPv4, we can just use g_inet_address_new_from_string().
*/
iaddr = g_inet_address_new_from_string (address);
if (!iaddr)
return NULL;
g_warn_if_fail (g_inet_address_get_family (iaddr) == G_SOCKET_FAMILY_IPV4);
saddr = g_inet_socket_address_new (iaddr, port);
g_object_unref (iaddr);
}
return saddr;
}
/**
* g_inet_socket_address_get_address:
* @address: a #GInetSocketAddress