mirror of
https://github.com/open5gs/open5gs.git
synced 2026-08-11 01:14:40 +00:00
e7f9c50013
Validate Flow-Description strings before passing them to the bundled ipfw parser. The parser accepts syntax that ogs_ipfw_rule_t cannot represent and may silently truncate or discard parts of malformed rules. Some invalid inputs can also reach errx() paths in the vendored parser and terminate the process. Validate the supported IPFilterRule subset, including: - action and direction - protocol names and numbers - IPv4 and IPv6 addresses and prefixes - source and destination address-family consistency - port numbers and ranges - unsupported trailing tokens and port lists - unsupported source-side "assigned" Protocol 41 with an IPv4 literal is rejected because the bundled parser uses protocol 41 as an address-family selector and passes the literal to the IPv6 address parser. Although an IPv4 outer address is valid for IPv6 encapsulation, this combination is not currently supported by the bundled parser and can terminate the process. Propagate compile_rule() failures to the caller and only swap uplink rules after successful compilation. The Flow-Description form reported in #4711 now fails cleanly with a diagnostic and is not installed. This does not add support for "assigned" in the source position. The parser already uses static storage and is not reentrant, and its current callers run serially in the event loop, so the parse-error flag does not introduce an additional concurrency limitation. Reported-in: #4711 |
||
|---|---|---|
| .. | ||
| objs/include_e | ||
| dummynet.c | ||
| expand_number.c | ||
| glue.c | ||
| glue.h | ||
| humanize_number.c | ||
| ipfw2.c | ||
| ipfw2.h | ||
| ipv6.c | ||
| meson.build | ||
| missing.h | ||
| ogs-ipfw.c | ||
| ogs-ipfw.h | ||
| tables.c | ||