X-Git-Url: https://tinc-vpn.org/git/browse?a=blobdiff_plain;f=src%2Fsubnet_parse.c;h=044d6e729564ce5c6b7cdc962131bbfd7af4a0bd;hb=04b588ea6be2ebd62922b638eae90a6a47326370;hp=c54d343d68c78cb1bf948e228f04bfa7eac3fdb5;hpb=f6e87ab476a0faf8b124ecaaa27f967d825e6457;p=tinc

diff --git a/src/subnet_parse.c b/src/subnet_parse.c
index c54d343d..044d6e72 100644
--- a/src/subnet_parse.c
+++ b/src/subnet_parse.c
@@ -1,6 +1,6 @@
 /*
     subnet_parse.c -- handle subnet parsing
-    Copyright (C) 2000-2012 Guus Sliepen <guus@tinc-vpn.org>,
+    Copyright (C) 2000-2021 Guus Sliepen <guus@tinc-vpn.org>,
                   2000-2005 Ivo Timmermans
 
     This program is free software; you can redistribute it and/or modify
@@ -87,6 +87,17 @@ void maskcpy(void *va, const void *vb, int masklen, int len) {
 	}
 }
 
+bool subnetcheck(const subnet_t subnet) {
+	if(((subnet.type == SUBNET_IPV4)
+	                && !maskcheck(&subnet.net.ipv4.address, subnet.net.ipv4.prefixlength, sizeof(subnet.net.ipv4.address)))
+	                || ((subnet.type == SUBNET_IPV6)
+	                    && !maskcheck(&subnet.net.ipv6.address, subnet.net.ipv6.prefixlength, sizeof(subnet.net.ipv6.address)))) {
+		return false;
+	}
+
+	return true;
+}
+
 bool maskcheck(const void *va, int masklen, int len) {
 	int i;
 	const char *a = va;
@@ -175,9 +186,7 @@ static int subnet_compare_ipv6(const subnet_t *a, const subnet_t *b) {
 }
 
 int subnet_compare(const subnet_t *a, const subnet_t *b) {
-	int result;
-
-	result = a->type - b->type;
+	int result = (int)a->type - (int)b->type;
 
 	if(result) {
 		return result;
@@ -252,7 +261,7 @@ bool str2net(subnet_t *subnet, const char *subnetstr) {
 	if(sscanf(str, "%hx:%hx:%hx:%hx:%hx:%hx%n", &x[0], &x[1], &x[2], &x[3], &x[4], &x[5], &consumed) >= 6 && !str[consumed]) {
 		/*
 		   Normally we should check that each part has two digits to prevent ambiguities.
-		   However, in old tinc versions net2str() will agressively return MAC addresses with one-digit parts,
+		   However, in old tinc versions net2str() will aggressively return MAC addresses with one-digit parts,
 		   so we have to accept them otherwise we would be unable to parse ADD_SUBNET messages.
 		*/
 		if(prefixlength >= 0) {
@@ -297,6 +306,11 @@ bool str2net(subnet_t *subnet, const char *subnetstr) {
 
 	char *last_colon = strrchr(str, ':');
 
+	/* Check that the last colon is not further than possible in an IPv6 address */
+	if(last_colon >= str + 5 * 8) {
+		return false;
+	}
+
 	if(last_colon && sscanf(last_colon, ":%hu.%hu.%hu.%hu%n", &x[0], &x[1], &x[2], &x[3], &consumed) >= 4 && !last_colon[consumed]) {
 		/* Dotted quad suffix notation, convert to standard IPv6 notation */
 		for(int i = 0; i < 4; i++)
@@ -371,7 +385,7 @@ bool str2net(subnet_t *subnet, const char *subnetstr) {
 
 bool net2str(char *netstr, int len, const subnet_t *subnet) {
 	if(!netstr || !subnet) {
-		logger(DEBUG_ALWAYS, LOG_ERR, "net2str() was called with netstr=%p, subnet=%p!", netstr, subnet);
+		logger(DEBUG_ALWAYS, LOG_ERR, "net2str() was called with netstr=%p, subnet=%p!", (void *)netstr, (void *)subnet);
 		return false;
 	}