From: Arran Cudbard-Bell Date: Wed, 17 May 2017 13:42:37 +0000 (-0400) Subject: Add taint to fr_value_box_from_str X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=23b763a34748dee0b42739e95f662e4d72c05c19;p=thirdparty%2Ffreeradius-server.git Add taint to fr_value_box_from_str --- diff --git a/src/include/value.h b/src/include/value.h index 97b8a871e22..97ebace6edc 100644 --- a/src/include/value.h +++ b/src/include/value.h @@ -238,7 +238,7 @@ int fr_value_box_memdup_buffer_shallow(TALLOC_CTX *ctx, fr_value_box_t *dst, ui */ int fr_value_box_from_str(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_type_t *src_type, fr_dict_attr_t const *src_enumv, - char const *src, ssize_t src_len, char quote); + char const *src, ssize_t src_len, char quote, bool tainted); /* * Printing diff --git a/src/lib/util/dict.c b/src/lib/util/dict.c index 26d7f254a56..c047728636b 100644 --- a/src/lib/util/dict.c +++ b/src/lib/util/dict.c @@ -2046,7 +2046,7 @@ static int dict_read_process_value(fr_dict_t *dict, char **argv, int argc) { fr_type_t type = da->type; /* Might change - Stupid combo IP */ - if (fr_value_box_from_str(NULL, &value, &type, NULL, argv[2], -1, '\0') < 0) { + if (fr_value_box_from_str(NULL, &value, &type, NULL, argv[2], -1, '\0', false) < 0) { fr_strerror_printf_push("Invalid VALUE for ATTRIBUTE \"%s\"", da->name); return -1; } @@ -2829,7 +2829,7 @@ int fr_dict_from_file(TALLOC_CTX *ctx, fr_dict_t **out, char const *dir, char co type = da->type; if (fr_value_box_from_str(this, &value, &type, NULL, - this->value, talloc_array_length(this->value) - 1, '\0') < 0) { + this->value, talloc_array_length(this->value) - 1, '\0', false) < 0) { fr_strerror_printf_push("Invalid VALUE for ATTRIBUTE \"%s\"", da->name); goto error; } diff --git a/src/lib/util/pair.c b/src/lib/util/pair.c index 434a7efad50..3df81ba5a04 100644 --- a/src/lib/util/pair.c +++ b/src/lib/util/pair.c @@ -1977,7 +1977,7 @@ int fr_pair_value_from_str(VALUE_PAIR *vp, char const *value, size_t inlen) * We presume that the input data is from a double quoted * string, and needs escaping */ - if (fr_value_box_from_str(vp, &vp->data, &type, vp->da, value, inlen, '"') < 0) return -1; + if (fr_value_box_from_str(vp, &vp->data, &type, vp->da, value, inlen, '"', false) < 0) return -1; /* * If we parsed to a different type than the DA associated with diff --git a/src/lib/util/value.c b/src/lib/util/value.c index 1ac319b49ab..87dffc8c7cc 100644 --- a/src/lib/util/value.c +++ b/src/lib/util/value.c @@ -1444,7 +1444,7 @@ static inline int fr_value_box_cast_to_ipv4addr(TALLOC_CTX *ctx, fr_value_box_t case FR_TYPE_STRING: if (fr_value_box_from_str(ctx, dst, &dst_type, dst_enumv, - src->datum.strvalue, src->datum.length, '\0') < 0) return -1; + src->datum.strvalue, src->datum.length, '\0', false) < 0) return -1; break; case FR_TYPE_OCTETS: @@ -1545,7 +1545,7 @@ static inline int fr_value_box_cast_to_ipv4prefix(TALLOC_CTX *ctx, fr_value_box_ case FR_TYPE_STRING: if (fr_value_box_from_str(ctx, dst, &dst_type, dst_enumv, - src->datum.strvalue, src->datum.length, '\0') < 0) return -1; + src->datum.strvalue, src->datum.length, '\0', false) < 0) return -1; break; @@ -1655,7 +1655,7 @@ static inline int fr_value_box_cast_to_ipv6addr(TALLOC_CTX *ctx, fr_value_box_t case FR_TYPE_STRING: if (fr_value_box_from_str(ctx, dst, &dst_type, dst_enumv, - src->datum.strvalue, src->datum.length, '\0') < 0) return -1; + src->datum.strvalue, src->datum.length, '\0', false) < 0) return -1; break; case FR_TYPE_OCTETS: @@ -1738,7 +1738,7 @@ static inline int fr_value_box_cast_to_ipv6prefix(TALLOC_CTX *ctx, fr_value_box_ case FR_TYPE_STRING: if (fr_value_box_from_str(ctx, dst, &dst_type, dst_enumv, - src->datum.strvalue, src->datum.length, '\0') < 0) return -1; + src->datum.strvalue, src->datum.length, '\0', false) < 0) return -1; break; case FR_TYPE_OCTETS: @@ -1869,7 +1869,8 @@ int fr_value_box_cast(TALLOC_CTX *ctx, fr_value_box_t *dst, * Deserialise a fr_value_box_t */ if (src->type == FR_TYPE_STRING) return fr_value_box_from_str(ctx, dst, &dst_type, dst_enumv, - src->datum.strvalue, src->datum.length, '\0'); + src->datum.strvalue, + src->datum.length, '\0', false); if ((src->type == FR_TYPE_IFID) && (dst_type == FR_TYPE_UINT64)) { @@ -2819,13 +2820,14 @@ static int fr_value_box_integer_str(fr_value_box_t *dst, fr_type_t dst_type, cha * length, else inlen should be the length of the string or * sub string to parse. * @param[in] quote character used set unescape mode. @see value_str_unescape. + * @param[in] tainted Whether the value came from a trusted source. * @return * - 0 on success. * - -1 on parse error. */ int fr_value_box_from_str(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_type_t *dst_type, fr_dict_attr_t const *dst_enumv, - char const *in, ssize_t inlen, char quote) + char const *in, ssize_t inlen, char quote, bool tainted) { size_t len; ssize_t ret; @@ -3253,6 +3255,7 @@ parse: finish: dst->datum.length = ret; dst->type = *dst_type; + dst->tainted = tainted; /* * Fixup enumv diff --git a/src/main/cond_tokenize.c b/src/main/cond_tokenize.c index db05f1d9095..fd28cdb0e33 100644 --- a/src/main/cond_tokenize.c +++ b/src/main/cond_tokenize.c @@ -187,7 +187,8 @@ static ssize_t cond_tokenize_string(TALLOC_CTX *ctx, char **out, char const **e */ if (quote == '/') quote = '\0'; - if (fr_value_box_from_str(ctx, &data, &src_type, NULL, start + 1, p - (start + 1), quote) < 0) { + if (fr_value_box_from_str(ctx, &data, &src_type, NULL, + start + 1, p - (start + 1), quote, false) < 0) { *error = "error parsing string"; return -1; } diff --git a/src/main/tmpl.c b/src/main/tmpl.c index 4fefdad762e..cc28aefe5a1 100644 --- a/src/main/tmpl.c +++ b/src/main/tmpl.c @@ -1013,7 +1013,8 @@ ssize_t tmpl_afrom_str(TALLOC_CTX *ctx, vp_tmpl_t **out, char const *in, size_t parse: if (do_unescape) { - if (fr_value_box_from_str(ctx, &data, &data_type, NULL, in, inlen, quote) < 0) return 0; + if (fr_value_box_from_str(ctx, &data, &data_type, NULL, + in, inlen, quote, false) < 0) return 0; vpt = tmpl_alloc(ctx, TMPL_TYPE_UNPARSED, data.datum.strvalue, talloc_array_length(data.datum.strvalue) - 1, type); @@ -1053,7 +1054,7 @@ ssize_t tmpl_afrom_str(TALLOC_CTX *ctx, vp_tmpl_t **out, char const *in, size_t */ if (do_unescape) { if (fr_value_box_from_str(ctx, &data, &data_type, NULL, in, - inlen, fr_token_quote[type]) < 0) return -1; + inlen, fr_token_quote[type], false) < 0) return -1; if (do_xlat) { vpt = tmpl_alloc(ctx, TMPL_TYPE_XLAT, data.datum.strvalue, talloc_array_length(data.datum.strvalue) - 1, type); @@ -1077,7 +1078,7 @@ ssize_t tmpl_afrom_str(TALLOC_CTX *ctx, vp_tmpl_t **out, char const *in, size_t case T_BACK_QUOTED_STRING: if (do_unescape) { if (fr_value_box_from_str(ctx, &data, &data_type, NULL, in, - inlen, fr_token_quote[type]) < 0) return -1; + inlen, fr_token_quote[type], false) < 0) return -1; vpt = tmpl_alloc(ctx, TMPL_TYPE_EXEC, data.datum.strvalue, talloc_array_length(data.datum.strvalue) - 1, type); @@ -1156,7 +1157,7 @@ int tmpl_cast_in_place(vp_tmpl_t *vpt, fr_type_t type, fr_dict_attr_t const *enu * Why do we pass a pointer to the tmpl type? Goddamn WiMAX. */ if (fr_value_box_from_str(vpt, &vpt->tmpl_value_box, &vpt->tmpl_fr_value_box_type, - enumv, vpt->name, vpt->len, '\0') < 0) return -1; + enumv, vpt->name, vpt->len, '\0', false) < 0) return -1; vpt->type = TMPL_TYPE_DATA; break; @@ -1773,7 +1774,8 @@ ssize_t _tmpl_to_atype(TALLOC_CTX *ctx, void *out, * * @fixme We need a way of signalling xlat not to escape things. */ - ret = fr_value_box_from_str(tmp_ctx, &tmp, &src_type, NULL, value.datum.strvalue, value.datum.length, '"'); + ret = fr_value_box_from_str(tmp_ctx, &tmp, &src_type, NULL, + value.datum.strvalue, value.datum.length, '"', false); if (ret < 0) goto error; value.datum.strvalue = tmp.datum.strvalue; @@ -1804,7 +1806,7 @@ ssize_t _tmpl_to_atype(TALLOC_CTX *ctx, void *out, * @fixme We need a way of signalling xlat not to escape things. */ ret = fr_value_box_from_str(tmp_ctx, &tmp, &src_type, NULL, - value.datum.strvalue, value.datum.length, '"'); + value.datum.strvalue, value.datum.length, '"', false); if (ret < 0) goto error; value.datum.strvalue = tmp.datum.strvalue; diff --git a/src/main/xlat_eval.c b/src/main/xlat_eval.c index edd168dddb0..6c16845ad3b 100644 --- a/src/main/xlat_eval.c +++ b/src/main/xlat_eval.c @@ -513,7 +513,7 @@ static char *xlat_aprint(TALLOC_CTX *ctx, REQUEST *request, xlat_exp_t const * c type = FR_TYPE_STRING; if (fr_value_box_from_str(ctx, &data, &type, NULL, child, - talloc_array_length(child) - 1, '"') < 0) { + talloc_array_length(child) - 1, '"', false) < 0) { talloc_free(child); return NULL; }