Coverage Report

Created: 2026-02-26 06:46

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/openssh/addrmatch.c
Line
Count
Source
1
/*  $OpenBSD: addrmatch.c,v 1.19 2026/02/14 00:18:34 jsg Exp $ */
2
3
/*
4
 * Copyright (c) 2004-2008 Damien Miller <djm@mindrot.org>
5
 *
6
 * Permission to use, copy, modify, and distribute this software for any
7
 * purpose with or without fee is hereby granted, provided that the above
8
 * copyright notice and this permission notice appear in all copies.
9
 *
10
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
 */
18
19
#include "includes.h"
20
21
#include <sys/types.h>
22
#include <netinet/in.h>
23
24
#include <string.h>
25
#include <stdlib.h>
26
#include <stdio.h>
27
#include <stdarg.h>
28
29
#include "addr.h"
30
#include "match.h"
31
#include "log.h"
32
33
/*
34
 * Match "addr" against list pattern list "_list", which may contain a
35
 * mix of CIDR addresses and old-school wildcards.
36
 *
37
 * If addr is NULL, then no matching is performed, but _list is parsed
38
 * and checked for well-formedness.
39
 *
40
 * Returns 1 on match found (never returned when addr == NULL).
41
 * Returns 0 on if no match found, or no errors found when addr == NULL.
42
 * Returns -1 on negated match found (never returned when addr == NULL).
43
 * Returns -2 on invalid list entry.
44
 */
45
int
46
addr_match_list(const char *addr, const char *_list)
47
0
{
48
0
  char *list, *cp, *o;
49
0
  struct xaddr try_addr, match_addr;
50
0
  u_int masklen, neg;
51
0
  int ret = 0, r;
52
53
0
  if (addr != NULL && addr_pton(addr, &try_addr) != 0) {
54
0
    debug2_f("couldn't parse address %.100s", addr);
55
0
    return 0;
56
0
  }
57
0
  if ((o = list = strdup(_list)) == NULL)
58
0
    return -1;
59
0
  while ((cp = strsep(&list, ",")) != NULL) {
60
0
    neg = *cp == '!';
61
0
    if (neg)
62
0
      cp++;
63
0
    if (*cp == '\0') {
64
0
      ret = -2;
65
0
      break;
66
0
    }
67
    /* Prefer CIDR address matching */
68
0
    r = addr_pton_cidr(cp, &match_addr, &masklen);
69
0
    if (r == -2) {
70
0
      debug2_f("inconsistent mask length for "
71
0
          "match network \"%.100s\"", cp);
72
0
      ret = -2;
73
0
      break;
74
0
    } else if (r == 0) {
75
0
      if (addr != NULL && addr_netmatch(&try_addr,
76
0
          &match_addr, masklen) == 0) {
77
0
 foundit:
78
0
        if (neg) {
79
0
          ret = -1;
80
0
          break;
81
0
        }
82
0
        ret = 1;
83
0
      }
84
0
      continue;
85
0
    } else {
86
      /* If CIDR parse failed, try wildcard string match */
87
0
      if (addr != NULL && match_pattern(addr, cp) == 1)
88
0
        goto foundit;
89
0
    }
90
0
  }
91
0
  free(o);
92
93
0
  return ret;
94
0
}
95
96
/*
97
 * Match "addr" against list CIDR list "_list". Lexical wildcards and
98
 * negation are not supported. If "addr" == NULL, will verify structure
99
 * of "_list".
100
 *
101
 * Returns 1 on match found (never returned when addr == NULL).
102
 * Returns 0 on if no match found, or no errors found when addr == NULL.
103
 * Returns -1 on error
104
 */
105
int
106
addr_match_cidr_list(const char *addr, const char *_list)
107
0
{
108
0
  char *list, *cp, *o;
109
0
  struct xaddr try_addr, match_addr;
110
0
  u_int masklen;
111
0
  int ret = 0, r;
112
113
0
  if (addr != NULL && addr_pton(addr, &try_addr) != 0) {
114
0
    debug2_f("couldn't parse address %.100s", addr);
115
0
    return 0;
116
0
  }
117
0
  if ((o = list = strdup(_list)) == NULL)
118
0
    return -1;
119
0
  while ((cp = strsep(&list, ",")) != NULL) {
120
0
    if (*cp == '\0') {
121
0
      error_f("empty entry in list \"%.100s\"", o);
122
0
      ret = -1;
123
0
      break;
124
0
    }
125
126
    /*
127
     * NB. This function is called in pre-auth with untrusted data,
128
     * so be extra paranoid about junk reaching getaddrinfo (via
129
     * addr_pton_cidr).
130
     */
131
132
    /* Stop junk from reaching getaddrinfo. +3 is for masklen */
133
0
    if (strlen(cp) > INET6_ADDRSTRLEN + 3) {
134
0
      error_f("list entry \"%.100s\" too long", cp);
135
0
      ret = -1;
136
0
      break;
137
0
    }
138
0
#define VALID_CIDR_CHARS "0123456789abcdefABCDEF.:/"
139
0
    if (strspn(cp, VALID_CIDR_CHARS) != strlen(cp)) {
140
0
      error_f("list entry \"%.100s\" contains invalid "
141
0
          "characters", cp);
142
0
      ret = -1;
143
0
    }
144
145
    /* Prefer CIDR address matching */
146
0
    r = addr_pton_cidr(cp, &match_addr, &masklen);
147
0
    if (r == -1) {
148
0
      error("Invalid network entry \"%.100s\"", cp);
149
0
      ret = -1;
150
0
      break;
151
0
    } else if (r == -2) {
152
0
      error("Inconsistent mask length for "
153
0
          "network \"%.100s\"", cp);
154
0
      ret = -1;
155
0
      break;
156
0
    } else if (r == 0 && addr != NULL) {
157
0
      if (addr_netmatch(&try_addr, &match_addr,
158
0
          masklen) == 0)
159
0
        ret = 1;
160
0
      continue;
161
0
    }
162
0
  }
163
0
  free(o);
164
165
0
  return ret;
166
0
}