mirror of
https://git.proxmox.com/git/mirror_frr
synced 2025-11-03 23:47:16 +00:00
42bfee18c2
Fixed below coverity issues
________________________________________________________________________________________________________
*** CID 1511366: (TAINTED_SCALAR)
/ospf6d/ospf6_message.c: 2631 in ospf6_make_lsupdate_list()
2625 + OSPF6_HEADER_SIZE)
2626 > ospf6_packet_max(on->ospf6_if)) {
2627 ospf6_fill_header(on->ospf6_if, (*op)->s,
2628 length + OSPF6_HEADER_SIZE);
2629 (*op)->length = length + OSPF6_HEADER_SIZE;
2630 ospf6_fill_lsupdate_header((*op)->s, *lsa_cnt);
>>> CID 1511366: (TAINTED_SCALAR)
>>> Passing tainted variable "(*op)->length" to a tainted sink.
2631 ospf6_send_lsupdate(on, NULL, *op);
2632
2633 /* refresh packet */
2634 *op = ospf6_packet_new(on->ospf6_if->ifmtu);
2635 length = OSPF6_LS_UPD_MIN_SIZE;
2636 *lsa_cnt = 0;
/ospf6d/ospf6_message.c: 2631 in ospf6_make_lsupdate_list()
2625 + OSPF6_HEADER_SIZE)
2626 > ospf6_packet_max(on->ospf6_if)) {
2627 ospf6_fill_header(on->ospf6_if, (*op)->s,
2628 length + OSPF6_HEADER_SIZE);
2629 (*op)->length = length + OSPF6_HEADER_SIZE;
2630 ospf6_fill_lsupdate_header((*op)->s, *lsa_cnt);
>>> CID 1511366: (TAINTED_SCALAR)
>>> Passing tainted variable "(*op)->length" to a tainted sink.
2631 ospf6_send_lsupdate(on, NULL, *op);
________________________________________________________________________________________________________
*** CID 1511365: (TAINTED_SCALAR)
/ospf6d/ospf6_message.c: 2674 in ospf6_make_ls_retrans_list()
2669 if (on->ospf6_if->state == OSPF6_INTERFACE_POINTTOPOINT)
2670 (*op)->dst = allspfrouters6;
2671 else
2672 (*op)->dst = on->linklocal_addr;
2673
>>> CID 1511365: (TAINTED_SCALAR)
>>> Passing tainted variable "(*op)->length" to a tainted sink.
2674 ospf6_fill_hdr_checksum(on->ospf6_if, *op);
2675 ospf6_packet_add(on->ospf6_if, *op);
2676 OSPF6_MESSAGE_WRITE_ON(on->ospf6_if);
/ospf6d/ospf6_message.c: 2674 in ospf6_make_ls_retrans_list()
2669 if (on->ospf6_if->state == OSPF6_INTERFACE_POINTTOPOINT)
2670 (*op)->dst = allspfrouters6;
2671 else
2672 (*op)->dst = on->linklocal_addr;
2673
>>> CID 1511365: (TAINTED_SCALAR)
>>> Passing tainted variable "(*op)->length" to a tainted sink.
2674 ospf6_fill_hdr_checksum(on->ospf6_if, *op);
2675 ospf6_packet_add(on->ospf6_if, *op);
2676 OSPF6_MESSAGE_WRITE_ON(on->ospf6_if);
/ospf6d/ospf6_message.c: 2674 in ospf6_make_ls_retrans_list()
2668 ospf6_fill_lsupdate_header((*op)->s, *lsa_cnt);
2669 if (on->ospf6_if->state == OSPF6_INTERFACE_POINTTOPOINT)
2670 (*op)->dst = allspfrouters6;
2671 else
2672 (*op)->dst = on->linklocal_addr;
2673
>>> CID 1511365: (TAINTED_SCALAR)
>>> Passing tainted variable "(*op)->length" to a tainted sink.
2674 ospf6_fill_hdr_checksum(on->ospf6_if, *op);
2675 ospf6_packet_add(on->ospf6_if, *op);
2676 OSPF6_MESSAGE_WRITE_ON(on->ospf6_if);
________________________________________________________________________________________________________
*** CID 1511364: Insecure data handling (TAINTED_SCALAR)
/ospf6d/ospf6_message.c: 2125 in ospf6_write()
2120 if (oi->at_data.flags != 0) {
2121 at_len = ospf6_auth_len_get(oi);
2122 if (at_len) {
2123 iovector[0].iov_len =
2124 ntohs(oh->length) + at_len;
>>> CID 1511364: Insecure data handling (TAINTED_SCALAR)
>>> Passing tainted variable "iovector[0].iov_len" to a tainted sink.
2125 ospf6_auth_digest_send(oi->linklocal_addr, oi,
2126 oh, at_len,
2127 iovector[0].iov_len);
2128 } else {
2129 iovector[0].iov_len = ntohs(oh->length);
2130 }
________________________________________________________________________________________________________
*** CID 1511363: (DEADCODE)
/ospf6d/ospf6_auth_trailer.c: 275 in ospf6_hash_hmac_sha_digest()
269 case KEYCHAIN_ALGO_HMAC_SHA512:
270 #ifdef CRYPTO_OPENSSL
271 sha512_digest(mes, len, digest);
272 #endif
273 break;
274 case KEYCHAIN_ALGO_NULL:
>>> CID 1511363: (DEADCODE)
>>> Execution cannot reach this statement: "case KEYCHAIN_ALGO_MAX:".
275 case KEYCHAIN_ALGO_MAX:
276 default:
/ospf6d/ospf6_auth_trailer.c: 274 in ospf6_hash_hmac_sha_digest()
269 case KEYCHAIN_ALGO_HMAC_SHA512:
270 #ifdef CRYPTO_OPENSSL
271 sha512_digest(mes, len, digest);
272 #endif
273 break;
>>> CID 1511363: (DEADCODE)
>>> Execution cannot reach this statement: "case KEYCHAIN_ALGO_NULL:".
274 case KEYCHAIN_ALGO_NULL:
275 case KEYCHAIN_ALGO_MAX:
276 default:
________________________________________________________________________________________________________
*** CID 1511362: Insecure data handling (TAINTED_SCALAR)
/ospf6d/ospf6_auth_trailer.c: 541 in ospf6_auth_check_digest()
535
536 auth_len = ntohs(ospf6_auth->length);
537
538 memcpy(temp_hash, ospf6_auth->data, hash_len);
539 memcpy(ospf6_auth->data, apad, hash_len);
540
>>> CID 1511362: Insecure data handling (TAINTED_SCALAR)
>>> Passing tainted variable "oh_len + auth_len + lls_block_len" to a tainted sink.
541 ospf6_auth_update_digest(oi, oh, ospf6_auth, auth_str,
542 (oh_len + auth_len + lls_block_len),
543 hash_algo);
________________________________________________________________________________________________________
*** CID 1511361: Insecure data handling (TAINTED_SCALAR)
/ospf6d/ospf6_auth_trailer.c: 124 in ospf6_auth_hdr_dump_recv()
118 at_len = length - (oh_len + lls_len);
119 if (at_len > 0) {
120 ospf6_at_hdr =
121 (struct ospf6_auth_hdr *)((uint8_t *)ospfh + oh_len);
122 at_hdr_len = ntohs(ospf6_at_hdr->length);
123 hash_len = at_hdr_len - OSPF6_AUTH_HDR_MIN_SIZE;
>>> CID 1511361: Insecure data handling (TAINTED_SCALAR)
>>> Passing tainted variable "hash_len" to a tainted sink.
124 memcpy(temp, ospf6_at_hdr->data, hash_len);
125 temp[hash_len] = '\0';
________________________________________________________________________________________________________
*** CID 1482146: Insecure data handling (TAINTED_SCALAR)
/ospf6d/ospf6_message.c: 2787 in ospf6_lsupdate_send_neighbor_now()
2781
2782 if (IS_OSPF6_DEBUG_FLOODING
2783 || IS_OSPF6_DEBUG_MESSAGE(OSPF6_MESSAGE_TYPE_LSUPDATE, SEND_HDR))
2784 zlog_debug("%s: Send lsupdate with lsa %s (age %u)", __func__,
2785 lsa->name, ntohs(lsa->header->age));
2786
>>> CID 1482146: Insecure data handling (TAINTED_SCALAR)
>>> Passing tainted variable "op->length" to a tainted sink.
2787 ospf6_send_lsupdate(on, NULL, op);
Signed-off-by: Abhinay Ramesh <rabhinay@vmware.com>
110 lines
3.0 KiB
C
110 lines
3.0 KiB
C
/* key-chain for authentication.
|
|
* Copyright (C) 2000 Kunihiro Ishiguro
|
|
*
|
|
* This file is part of GNU Zebra.
|
|
*
|
|
* GNU Zebra is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published
|
|
* by the Free Software Foundation; either version 2, or (at your
|
|
* option) any later version.
|
|
*
|
|
* GNU Zebra is distributed in the hope that it will be useful, but
|
|
* WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License along
|
|
* with this program; see the file COPYING; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
|
|
*/
|
|
|
|
#ifndef _ZEBRA_KEYCHAIN_H
|
|
#define _ZEBRA_KEYCHAIN_H
|
|
|
|
#include "qobj.h"
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
enum keychain_hash_algo {
|
|
KEYCHAIN_ALGO_NULL,
|
|
KEYCHAIN_ALGO_MD5,
|
|
KEYCHAIN_ALGO_HMAC_SHA1,
|
|
KEYCHAIN_ALGO_HMAC_SHA256,
|
|
KEYCHAIN_ALGO_HMAC_SHA384,
|
|
KEYCHAIN_ALGO_HMAC_SHA512,
|
|
KEYCHAIN_ALGO_MAX
|
|
};
|
|
|
|
#define KEYCHAIN_MD5_HASH_SIZE 16
|
|
#define KEYCHAIN_HMAC_SHA1_HASH_SIZE 20
|
|
#define KEYCHAIN_HMAC_SHA256_HASH_SIZE 32
|
|
#define KEYCHAIN_HMAC_SHA384_HASH_SIZE 48
|
|
#define KEYCHAIN_HMAC_SHA512_HASH_SIZE 64
|
|
#define KEYCHAIN_MAX_HASH_SIZE 64
|
|
|
|
#define KEYCHAIN_ALGO_MD5_INTERNAL_BLK_SIZE 16
|
|
#define KEYCHAIN_ALGO_SHA1_INTERNAL_BLK_SIZE 64
|
|
#define KEYCHAIN_ALGO_SHA256_INTERNAL_BLK_SIZE 64
|
|
#define KEYCHAIN_ALGO_SHA384_INTERNAL_BLK_SIZE 128
|
|
#define KEYCHAIN_ALGO_SHA512_INTERNAL_BLK_SIZE 128
|
|
#define KEYCHAIN_ALGO_MAX_INTERNAL_BLK_SIZE 128
|
|
|
|
struct keychain_algo_info {
|
|
enum keychain_hash_algo key;
|
|
const char *name;
|
|
uint16_t length;
|
|
uint16_t block;
|
|
const char *desc;
|
|
};
|
|
|
|
extern const struct keychain_algo_info algo_info[];
|
|
uint16_t keychain_get_block_size(enum keychain_hash_algo key);
|
|
uint16_t keychain_get_hash_len(enum keychain_hash_algo key);
|
|
const char *keychain_get_description(enum keychain_hash_algo key);
|
|
struct keychain_algo_info
|
|
keychain_get_hash_algo_info(enum keychain_hash_algo key);
|
|
enum keychain_hash_algo keychain_get_algo_id_by_name(const char *name);
|
|
const char *keychain_get_algo_name_by_id(enum keychain_hash_algo key);
|
|
|
|
struct keychain {
|
|
char *name;
|
|
|
|
struct list *key;
|
|
|
|
QOBJ_FIELDS;
|
|
};
|
|
DECLARE_QOBJ_TYPE(keychain);
|
|
|
|
struct key_range {
|
|
time_t start;
|
|
time_t end;
|
|
|
|
uint8_t duration;
|
|
};
|
|
|
|
struct key {
|
|
uint32_t index;
|
|
|
|
char *string;
|
|
enum keychain_hash_algo hash_algo;
|
|
struct key_range send;
|
|
struct key_range accept;
|
|
|
|
QOBJ_FIELDS;
|
|
};
|
|
DECLARE_QOBJ_TYPE(key);
|
|
|
|
extern void keychain_init(void);
|
|
extern struct keychain *keychain_lookup(const char *);
|
|
extern struct key *key_lookup_for_accept(const struct keychain *, uint32_t);
|
|
extern struct key *key_match_for_accept(const struct keychain *, const char *);
|
|
extern struct key *key_lookup_for_send(const struct keychain *);
|
|
const char *keychain_algo_str(enum keychain_hash_algo hash_algo);
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif /* _ZEBRA_KEYCHAIN_H */
|