d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Currently when ipfw(8) generates the micro-instructions for rules which

Browse Source 
contain O_UID, O_GID and O_JAIL opcodes, the F_NOT or F_OR logical
operator bits get clobbered. Making it impossible to use the ``NOT'' or
``OR'' operators with uid, gid and jail based constraints.

The ipfw_insn instruction template contains a ``len'' element which
stores two pieces of information, the size of the instruction
(in 32-bit words) in the low 6 bits of "len" with the 2 remaining
bits to implement OR and NOT.

The current code clobbers the OR and NOT bits by initializing the
``len'' element to the size, rather than OR'ing the bits. This change
fixes this by changing the initialization of cmd->len to an OR operation
for the O_UID, O_GID and O_JAIL opcodes.

This may be a MFC candidate for RELENG_5.

Reviewed by:	andre
Approved by:	luigi
PR:		kern/63961 (partially)
This commit is contained in:
Christian S.J. Peron 2004-09-11 19:44:29 +00:00
parent 5e4bdb57cb
commit 3a27af0dd4
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=135089
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sbin/ipfw/ipfw2.c
View File

@ -3296,7 +3296,7 @@ add(int ac, char *av[])
if (pwd == NULL)
errx(EX_DATAERR, "uid \"%s\" nonexistent", *av);
cmd32->d[0] = pwd->pw_uid;
cmd->len = F_INSN_SIZE(ipfw_insn_u32);
cmd->len |= F_INSN_SIZE(ipfw_insn_u32);
ac--; av++;
}
break;
@ -3314,7 +3314,7 @@ add(int ac, char *av[])
if (grp == NULL)
errx(EX_DATAERR, "gid \"%s\" nonexistent", *av);
cmd32->d[0] = grp->gr_gid;
cmd->len = F_INSN_SIZE(ipfw_insn_u32);
cmd->len |= F_INSN_SIZE(ipfw_insn_u32);
ac--; av++;
}
break;
@ -3330,7 +3330,7 @@ add(int ac, char *av[])
if (jid < 0 || *end != '\0')
errx(EX_DATAERR, "jail requires prison ID");
cmd32->d[0] = (unsigned int)jid;
cmd->len = F_INSN_SIZE(ipfw_insn_u32);
cmd->len |= F_INSN_SIZE(ipfw_insn_u32);
ac--; av++;
}
break;