GitLab

Fixes: CVE-2021-3595
Fixes: https://gitlab.freedesktop.org/slirp/libslirp/-/issues/46

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

Fixes: CVE-2021-3593
Fixes: https://gitlab.freedesktop.org/slirp/libslirp/-/issues/45

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

Fixes: CVE-2021-3592
Fixes: https://gitlab.freedesktop.org/slirp/libslirp/-/issues/44

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

sizeof(bootp_t) currently holds DHCP_OPT_LEN. Remove this optional field
from the structure, to help with the following patch checking for
minimal header size. Modify the bootp_reply() function to take the
buffer boundaries and avoiding potential buffer overflow.

Related to CVE-2021-3592.

https://gitlab.freedesktop.org/slirp/libslirp/-/issues/44

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

Recent security issues demonstrate the lack of safety care when casting
a mbuf to a particular structure type. At least, it should check that
the buffer is large enough. The following patches will make use of this
function.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>

mbuf: Add debugging helpers for allocation

See merge request !90

This adds a few helpers for debugging mbuf allocations when running in
debugging mode (lsan, valgrind, etc.)

- We do not want to cache allocations, so always set M_DOFREE to prevent
  us from putting any mbuf in it.
- We want to update the mbuf allocation owner on function call for more
  precise leak reporting.

Based on Jeremy Marchand's fuzzing work.
Signed-off-by: jeremy marchand <jeremy.marchand@etu.u-bordeaux.fr>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>

ncsi: make ncsi_calculate_checksum work with unaligned data

Closes #43

See merge request !89

Fixes #43

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>

Fix typos in comments

See merge request !88

Found with the "codespell" utility.
Signed-off-by: Thomas Huth <thuth@redhat.com>

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

Release v4.5.0

Closes #40

See merge request !87

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

ndp_table: For unspecified address, return broadcast ethernet address

See merge request !86

We cannot let the guest crash libslirp by making it answer a tftp
request such as shown in
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33873
https://gitlab.com/qemu-project/qemu/-/issues/111

unspecified addresses may also be used for non-configured devices, so it
makes sense to use the broadcast ethernet address in that case, just
like we do with IPv4.

Remove alloca() call in get_dns_addr_resolv_conf()

See merge request !84

The ALLOCA(3) man-page mentions its "use is discouraged".

For now get_dns_addr_resolv_conf() is called with pointer to
a in_addr/in6_addr structure, and its size. Declare a union
of these structures on the stack, able to hold both of them.
This allows us to remove the alloca() call, keeping the buffer
on the stack.

Add an assertion in the unlikely case another inet address
is handled by this function.
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20210507133212.1952121-1-philmd@redhat.com>

Perform lazy guest address resolution for IPv6

See merge request !81

Previously QEMU rejected IPv6 host-forward attempts that had an
unspecified guest address. This is because for IPv6 the guest's
IP address isn't necessarily known ahead of time: Libslirp only
provides a "stateless" DHCPv6 server, which if the macaddr is
random then the IPv6 address is random too.

This patch changes this to do the address resolution lazily, in the
hopes that the guest's IPv6 address is known at the time the user
wants to connect to the guest. The request can still fail if the
guest doesn't have an IPv6 address yet (e.g., it's still early in
the boot). Such requests are immediately rejected.
Signed-off-by: Doug Evans <dje@google.com>

Listen v6only

See merge request !77

tcpx_listen: tcp_newtcpcb doesn't fail

See merge request !79

slirp_add_host*fwd: Ensure all error paths set errno

See merge request !80

Debugging bind/listen failures without errno can get painful.
Signed-off-by: Doug Evans <dje@google.com>

Signed-off-by: Doug Evans <dje@google.com>

They are superseded by slirp_add/remove_hostxfwd
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>

Move DEBUG_CALL("if_start") to DEBUG_VERBOSE_CALL

See merge request !78

Add ipv4/ipv6-agnostic host forwarding functions

See merge request !75

That allows to request binding on v6 addresses only.
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>

This debugging printf reduces the overall S/N ratio of debug output
in the normal case, so separate it out.
Signed-off-by: Doug Evans <dje@google.com>

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>

This actually makes most of the code simpler.

Neighbor info

See merge request !71