ocserv

mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-08-09 09:51:49 +08:00

Files

T

Nikos Mavrogiannopoulos d79eda6013 ip-util: reject routes with characters outside address/prefix syntax

ip_route_sanity_check() was a format normalizer, not a validator: any
dot-free route (all IPv6, or arbitrary text) returned success
unexamined, and a dotted-netmask IPv4 route passed through unchanged.
Since route_adddel() substitutes the validated route into
route-add-cmd/route-del-cmd and executes it via `/bin/sh -c` as root,
a route string carrying shell metacharacters that survived this check
was a root command-injection vector.

Rewrite the check to fully parse the route as an IPv4 or IPv6 address
plus prefix, or the literal keyword "default" (the documented
all-traffic-through-VPN shortcut, checked separately by config.c after
this function runs), and reject anything left over. Numeric IPv4
prefixes are still normalized to a dotted netmask as before.

Adds REQ-MAIN-SEC-008 and tests/route-sanity-check.c, confirmed
against real config/test usage (including "route = default") so the
stricter validation doesn't regress documented syntax.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

2026-07-28 08:00:06 +02:00

requirements

ip-util: reject routes with characters outside address/prefix syntax

2026-07-28 08:00:06 +02:00

scripts

Added the STATS_DURATION script environment variable.

2014-05-04 11:20:32 +02:00

systemd

Cleanup of the logging subsystem; allow logging to stderr only

2023-12-15 13:04:40 +01:00

DCO.txt

Added contribution guide and require DCO