CVS commit: [netbsd-7] src/sbin/ping
Module Name:src Committed By: snj Date: Fri May 12 05:20:27 UTC 2017 Modified Files: src/sbin/ping [netbsd-7]: ping.c Log Message: Pull up following revision(s) (requested by ryo in ticket #1390): sbin/ping/ping.c: revision 1.116 Fix cksum calculation for clearing the cached route. In ping.c:r1.104, the size of echoreply packet was changed to ICMP_MINLEN, Therefore also calculation size must be ICMP_MINLEN. To generate a diff of this commit: cvs rdiff -u -r1.107.4.2 -r1.107.4.3 src/sbin/ping/ping.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/sbin/ping/ping.c diff -u src/sbin/ping/ping.c:1.107.4.2 src/sbin/ping/ping.c:1.107.4.3 --- src/sbin/ping/ping.c:1.107.4.2 Sun Dec 18 08:22:28 2016 +++ src/sbin/ping/ping.c Fri May 12 05:20:27 2017 @@ -1,4 +1,4 @@ -/* $NetBSD: ping.c,v 1.107.4.2 2016/12/18 08:22:28 snj Exp $ */ +/* $NetBSD: ping.c,v 1.107.4.3 2017/05/12 05:20:27 snj Exp $ */ /* * Copyright (c) 1989, 1993 @@ -58,7 +58,7 @@ #include #ifndef lint -__RCSID("$NetBSD: ping.c,v 1.107.4.2 2016/12/18 08:22:28 snj Exp $"); +__RCSID("$NetBSD: ping.c,v 1.107.4.3 2017/05/12 05:20:27 snj Exp $"); #endif #include @@ -883,7 +883,7 @@ pinger(void) opack_icmp.icmp_id = ~ident; opack_icmp.icmp_cksum = 0; opack_icmp.icmp_cksum = in_cksum((u_int16_t *)_icmp, - phdrlen); + ICMP_MINLEN); sw = 0; if (prog_setsockopt(sloop, IPPROTO_IP, IP_HDRINCL, (char *), sizeof(sw)) < 0)
CVS commit: [netbsd-7] src/sbin/ping
Module Name:src Committed By: snj Date: Fri May 12 05:20:27 UTC 2017 Modified Files: src/sbin/ping [netbsd-7]: ping.c Log Message: Pull up following revision(s) (requested by ryo in ticket #1390): sbin/ping/ping.c: revision 1.116 Fix cksum calculation for clearing the cached route. In ping.c:r1.104, the size of echoreply packet was changed to ICMP_MINLEN, Therefore also calculation size must be ICMP_MINLEN. To generate a diff of this commit: cvs rdiff -u -r1.107.4.2 -r1.107.4.3 src/sbin/ping/ping.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-7] src/sbin/ping
Module Name:src Committed By: snj Date: Sun Dec 18 08:22:29 UTC 2016 Modified Files: src/sbin/ping [netbsd-7]: ping.c Log Message: Pull up following revision(s) (requested by dholland in ticket #1333): sbin/ping/ping.c: revision 1.113 PR bin/36997 Zafer Aydogan: ping doesn't validate numeric inputs enough. Check for values between INT_MAX and LONG_MAX (if they're different) when using strtol to get an int. This applies to the -c and -l options; the other uses were already checked. Also limit the inter-packet interval given with -i to values that don't cause integer overflow calling poll() with milliseconds. Really large intervals (the number is read as floating point) can produce positive poll() values but negative integers when converted to struct timespec; this produces behavior akin to using -l at first and could be construed as a local DoS vulnerability. To generate a diff of this commit: cvs rdiff -u -r1.107.4.1 -r1.107.4.2 src/sbin/ping/ping.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/sbin/ping/ping.c diff -u src/sbin/ping/ping.c:1.107.4.1 src/sbin/ping/ping.c:1.107.4.2 --- src/sbin/ping/ping.c:1.107.4.1 Tue Apr 14 05:26:20 2015 +++ src/sbin/ping/ping.c Sun Dec 18 08:22:28 2016 @@ -1,4 +1,4 @@ -/* $NetBSD: ping.c,v 1.107.4.1 2015/04/14 05:26:20 snj Exp $ */ +/* $NetBSD: ping.c,v 1.107.4.2 2016/12/18 08:22:28 snj Exp $ */ /* * Copyright (c) 1989, 1993 @@ -58,7 +58,7 @@ #include #ifndef lint -__RCSID("$NetBSD: ping.c,v 1.107.4.1 2015/04/14 05:26:20 snj Exp $"); +__RCSID("$NetBSD: ping.c,v 1.107.4.2 2016/12/18 08:22:28 snj Exp $"); #endif #include @@ -291,11 +291,17 @@ main(int argc, char *argv[]) compat = 1; break; case 'c': - npackets = strtol(optarg, , 0); - if (*p != '\0' || npackets <= 0) + l = strtol(optarg, , 0); + if (*p != '\0' || l <= 0) errx(EXIT_FAILURE, "Bad/invalid number of packets: %s", optarg); +#if INT_MAX < LONG_MAX + if (l > INT_MAX) +errx(EXIT_FAILURE, +"Too many packets to count: %ld", l); +#endif + npackets = l; break; case 'D': pingflags |= F_DF; @@ -314,12 +320,27 @@ main(int argc, char *argv[]) if (*p != '\0' || interval <= 0) errx(EXIT_FAILURE, "Bad/invalid interval: %s", optarg); + /* + * In order to avoid overflowing the microseconds + * argument of poll() the interval must be less than + * INT_MAX/1000. Limit it to one second less than + * that to be safe. + */ + if (interval >= INT_MAX/1000.0 - 1.0) +errx(EXIT_FAILURE, +"Timing interval %g too large", interval); break; case 'l': - preload = strtol(optarg, , 0); - if (*p != '\0' || preload < 0) + l = strtol(optarg, , 0); + if (*p != '\0' || l < 0) errx(EXIT_FAILURE, "Bad/invalid preload value: " "%s", optarg); +#if INT_MAX < LONG_MAX + if (l > INT_MAX) +errx(EXIT_FAILURE, +"Too many preload packets: %ld", l); +#endif + preload = l; break; case 'n': pingflags |= F_NUMERIC;
CVS commit: [netbsd-7] src/sbin/ping
Module Name:src Committed By: snj Date: Sun Dec 18 08:22:29 UTC 2016 Modified Files: src/sbin/ping [netbsd-7]: ping.c Log Message: Pull up following revision(s) (requested by dholland in ticket #1333): sbin/ping/ping.c: revision 1.113 PR bin/36997 Zafer Aydogan: ping doesn't validate numeric inputs enough. Check for values between INT_MAX and LONG_MAX (if they're different) when using strtol to get an int. This applies to the -c and -l options; the other uses were already checked. Also limit the inter-packet interval given with -i to values that don't cause integer overflow calling poll() with milliseconds. Really large intervals (the number is read as floating point) can produce positive poll() values but negative integers when converted to struct timespec; this produces behavior akin to using -l at first and could be construed as a local DoS vulnerability. To generate a diff of this commit: cvs rdiff -u -r1.107.4.1 -r1.107.4.2 src/sbin/ping/ping.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-7] src/sbin/ping
Module Name:src Committed By: snj Date: Tue Apr 14 05:26:20 UTC 2015 Modified Files: src/sbin/ping [netbsd-7]: ping.c Log Message: Pull up following revision(s) (requested by christos in ticket #692): sbin/ping/ping.c: revisions 1.108, 1.109 PR/49423: Martin Husemann: ping for small packets does not work in -7 or -current -- Adjust default packet size to 56 data bytes (64 total). Make error messages consistent. To generate a diff of this commit: cvs rdiff -u -r1.107 -r1.107.4.1 src/sbin/ping/ping.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/sbin/ping/ping.c diff -u src/sbin/ping/ping.c:1.107 src/sbin/ping/ping.c:1.107.4.1 --- src/sbin/ping/ping.c:1.107 Sat Oct 19 01:08:25 2013 +++ src/sbin/ping/ping.c Tue Apr 14 05:26:20 2015 @@ -1,4 +1,4 @@ -/* $NetBSD: ping.c,v 1.107 2013/10/19 01:08:25 christos Exp $ */ +/* $NetBSD: ping.c,v 1.107.4.1 2015/04/14 05:26:20 snj Exp $ */ /* * Copyright (c) 1989, 1993 @@ -58,7 +58,7 @@ #include sys/cdefs.h #ifndef lint -__RCSID($NetBSD: ping.c,v 1.107 2013/10/19 01:08:25 christos Exp $); +__RCSID($NetBSD: ping.c,v 1.107.4.1 2015/04/14 05:26:20 snj Exp $); #endif #include stdio.h @@ -252,12 +252,12 @@ main(int argc, char *argv[]) #endif if (prog_init prog_init() == -1) - err(1, init failed); + err(EXIT_FAILURE, init failed); if ((s = prog_socket(AF_INET, SOCK_RAW, IPPROTO_ICMP)) 0) - err(1, Cannot create socket); + err(EXIT_FAILURE, Cannot create socket); if ((sloop = prog_socket(AF_INET, SOCK_RAW, IPPROTO_ICMP)) 0) - err(1, Cannot create socket); + err(EXIT_FAILURE, Cannot create socket); /* * sloop is never read on. This prevents packets from @@ -267,7 +267,7 @@ main(int argc, char *argv[]) warn(Cannot shutdown for read); if (prog_setuid(prog_getuid()) == -1) - err(1, setuid); + err(EXIT_FAILURE, setuid); setprogname(argv[0]); @@ -293,7 +293,9 @@ main(int argc, char *argv[]) case 'c': npackets = strtol(optarg, p, 0); if (*p != '\0' || npackets = 0) -errx(1, Bad/invalid number of packets); +errx(EXIT_FAILURE, +Bad/invalid number of packets: %s, +optarg); break; case 'D': pingflags |= F_DF; @@ -310,13 +312,14 @@ main(int argc, char *argv[]) case 'i': /* wait between sending packets */ interval = strtod(optarg, p); if (*p != '\0' || interval = 0) -errx(1, Bad/invalid interval %s, optarg); +errx(EXIT_FAILURE, Bad/invalid interval: %s, +optarg); break; case 'l': preload = strtol(optarg, p, 0); if (*p != '\0' || preload 0) -errx(1, Bad/invalid preload value %s, - optarg); +errx(EXIT_FAILURE, Bad/invalid preload value: +%s, optarg); break; case 'n': pingflags |= F_NUMERIC; @@ -326,13 +329,15 @@ main(int argc, char *argv[]) break; case 'p': /* fill buffer with user pattern */ if (pingflags F_PING_RANDOM) -errx(1, Only one of -P and -p allowed); +errx(EXIT_FAILURE, +Only one of -P and -p allowed); pingflags |= F_PING_FILLED; fill_pat = optarg; break; case 'P': if (pingflags F_PING_FILLED) -errx(1, Only one of -P and -p allowed); +errx(EXIT_FAILURE, +Only one of -P and -p allowed); pingflags |= F_PING_RANDOM; break; case 'q': @@ -347,9 +352,10 @@ main(int argc, char *argv[]) case 's': /* size of packet to send */ l = strtol(optarg, p, 0); if (*p != '\0' || l 0) -errx(1, Bad/invalid packet size %s, optarg); +errx(EXIT_FAILURE, +Bad/invalid packet size: %s, optarg); if (l MAXPACKET) -errx(1, packet size is too large); +errx(EXIT_FAILURE, packet size is too large); len = (int)l; break; case 'v': @@ -364,12 +370,13 @@ main(int argc, char *argv[]) case 't': tos = strtoul(optarg, p, 0); if (*p != '\0' || tos 0xFF) -errx(1, bad tos value: %s, optarg); +errx(EXIT_FAILURE, bad tos value: %s, optarg); break; case 'T': l = strtol(optarg, p, 0); if (*p != '\0' || l 255 || l = 0) -errx(1, ttl out of range); +errx(EXIT_FAILURE, ttl out of range: %s, +optarg); ttl = (u_char)l;/* cannot check 255 otherwise */ break; case 'I': @@ -383,7 +390,8 @@ main(int argc, char *argv[]) case 'w': maxwait = strtod(optarg, p); if (*p != '\0' || maxwait = 0) -errx(1, Bad/invalid maxwait time %s, optarg); +errx(EXIT_FAILURE, Bad/invalid maxwait time: +%s, optarg); break; #ifdef IPSEC #ifdef IPSEC_POLICY_IPSEC @@ -392,13 +400,14 @@ main(int argc, char *argv[]) if (!strncmp(in, optarg, 2)) { policy_in = strdup(optarg); if (!policy_in) - err(1, strdup); + err(EXIT_FAILURE, strdup); } else if (!strncmp(out, optarg, 3)) { policy_out = strdup(optarg); if (!policy_out) - err(1, strdup); + err(EXIT_FAILURE, strdup); } else -errx(1,
CVS commit: [netbsd-7] src/sbin/ping
Module Name:src Committed By: snj Date: Tue Apr 14 05:26:20 UTC 2015 Modified Files: src/sbin/ping [netbsd-7]: ping.c Log Message: Pull up following revision(s) (requested by christos in ticket #692): sbin/ping/ping.c: revisions 1.108, 1.109 PR/49423: Martin Husemann: ping for small packets does not work in -7 or -current -- Adjust default packet size to 56 data bytes (64 total). Make error messages consistent. To generate a diff of this commit: cvs rdiff -u -r1.107 -r1.107.4.1 src/sbin/ping/ping.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.