Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1069417 > unrolled thread

Bug#983591: iproute2: running 'ip -6 -r route' results in printing an unitialized buffer for the hostname on 'dev' routes

Back to article view | Back to linux.debian.bugs.dist

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Bug#983591: iproute2: running 'ip -6 -r route' results in printing an unitialized buffer for the hostname on 'dev' routes Luca Boccassi <bluca@debian.org> - 2021-09-02 12:50 +0200
    Bug#983591: iproute2: running 'ip -6 -r route' results in printing an unitialized buffer for the hostname on 'dev' routes Axel Scheepers <axel.scheepers76@gmail.com> - 2021-09-02 19:00 +0200

#1069417 — Bug#983591: iproute2: running 'ip -6 -r route' results in printing an unitialized buffer for the hostname on 'dev' routes

[Multipart message — attachments visible in raw view] — view raw

Control: tags -1 moreinfo

On Fri, 26 Feb 2021 21:41:17 +0100 Axel Scheepers
<axel.scheepers76@gmail.com> wrote:
> Package: iproute2
> Version: 5.10.0-4
> Severity: normal
> Tags: ipv6
> 
> Dear Maintainer,
> 
>    * What led up to the situation?
> 
> Using ip -6 -r route shows (on 10.8) either an information leak:
> $ ip -6 -r r
> +U dev lo proto kernel metric 256 pref medium
> 
> or (on testing) empty output:
> 
> $ ip -6 -r r
>  dev lo proto kernel metric 256 pref medium
> 
> for the resolved hostname.
> 
>    * What outcome did you expect instead?
> 
> Printing of the resolved name, e.g. 'localhost' for dev lo.
> 
> Reading the source and a bit of printf debugging i can see it's
> in lib/utils.c, format_host_r:
> 
> 1113z20n
> 1113    const char *format_host_r(int af, int len, const void *addr,
> 1114                            char *buf, int buflen)
> 1115    {
> 1116    #ifdef RESOLVE_HOSTNAMES
> 1117            if (resolve_hosts) {
> 1118                    const char *n;
> 1119
> 1120                    puts("XXX: here");
> 1121                    len = len <= 0 ? af_byte_len(af) : len;
> 1122
> 1123                    if (len > 0 &&
> 1124                        (n = resolve_address(addr, len, af)) !=
> NULL)
> 1125                    {
> 1126                            printf("n is '%s'\n", n);
> 1127                            strncpy(buf, n, buflen);
> 1128                            return n;
> 1129                    }
> 1130            }
> 1131    #endif
> 
> 
> results in:
> ./ip/ip -6 -r r
> XXX: here
> n is 'localhost'
> localhost dev lo proto kernel metric 256 pref medium
> 
> 
> Something better then this awful hack should be implemented i guess.
> 
> Kind regards,

This is fixed for me with 5.13, which is now in testing - can you
confirm?

$ ip -6 -r r
localhost dev lo proto kernel metric 256 pref medium
$ ip -V
ip utility, iproute2-5.13.0, libbpf 0.4.0

-- 
Kind regards,
Luca Boccassi

[toc] | [next] | [standalone]

#1069451

Hello Luca,

On Thu, Sep 02, 2021 at 11:44:09AM +0100, Luca Boccassi wrote:
> This is fixed for me with 5.13, which is now in testing - can you
> confirm?

Yes indeed it works on testing for me too, thanks!

Kind regards,

Axel Scheepers

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web