oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Pass NI_NUMERICSERV|NI_NUMERICSCOPE if NI_NUMERICHOST to getnameinfo.

Browse Source 
This addresses part of https://github.com/heimdal/heimdal/issues/1214
to audit potential network leaks with [libdefaults] block_dns = yes.

NI_NUMERICHOST is _probably_ sufficient -- we probably won't see many
systems using NIS to look up service names by number if we fail to
specify NI_NUMERICSERV, and such systems probably require careful
auditing of their own.  And I don't know of any way NI_NUMERICSCOPE
could trigger network leaks.  But named scope ids are such a niche
option with IPv6 that setting it to forestall concerns can't hurt
much, and it makes reviewing easier if we just unconditionally flip
on all the numeric-only options.
This commit is contained in:
Taylor R Campbell
2024-01-10 01:20:02 +00:00
committed by Nico Williams
parent 4d39fe8d04
commit f051c36471
4 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
appl/gssmask/gssmask.c
View File

@@ -1117,7 +1117,7 @@ create_client(krb5_socket_t sock, int port, const char *moniker)
getnameinfo((struct sockaddr *)&c->sa, c->salen, getnameinfo((struct sockaddr *)&c->sa, c->salen,
c->servername, sizeof(c->servername), c->servername, sizeof(c->servername),
NULL, 0, NI_NUMERICHOST); NULL, 0, NI_NUMERICHOST|NI_NUMERICSERV|NI_NUMERICSCOPE);
} }
c->sock = krb5_storage_from_socket(sock); c->sock = krb5_storage_from_socket(sock);

3
lib/kadm5/ipropd_slave.c
View File

@@ -85,7 +85,8 @@ connect_to_master (krb5_context context, const char *master,
for (a = ai; a != NULL; a = a->ai_next) { for (a = ai; a != NULL; a = a->ai_next) {
char node[NI_MAXHOST]; char node[NI_MAXHOST];
error = getnameinfo(a->ai_addr, a->ai_addrlen, error = getnameinfo(a->ai_addr, a->ai_addrlen,
node, sizeof(node), NULL, 0, NI_NUMERICHOST); node, sizeof(node), NULL, 0,
NI_NUMERICHOST|NI_NUMERICSERV|NI_NUMERICSCOPE);
if (error) if (error)
strlcpy(node, "[unknown-addr]", sizeof(node)); strlcpy(node, "[unknown-addr]", sizeof(node));

2
lib/krb5/krbhst.c
View File

@@ -656,7 +656,7 @@ add_locate(void *ctx, int type, struct sockaddr *addr)
portnum = socket_get_port(addr); portnum = socket_get_port(addr);
ret = getnameinfo(addr, socklen, host, sizeof(host), port, sizeof(port), ret = getnameinfo(addr, socklen, host, sizeof(host), port, sizeof(port),
NI_NUMERICHOST|NI_NUMERICSERV); NI_NUMERICHOST|NI_NUMERICSERV|NI_NUMERICSCOPE);
if (ret != 0) if (ret != 0)
return 0; return 0;

3
lib/krb5/send_to_kdc.c
View File

@@ -369,7 +369,8 @@ debug_host(krb5_context context, int level, struct host *host, const char *fmt,
proto = "udp"; proto = "udp";
if (getnameinfo(host->ai->ai_addr, host->ai->ai_addrlen, if (getnameinfo(host->ai->ai_addr, host->ai->ai_addrlen,
name, sizeof(name), port, sizeof(port), NI_NUMERICHOST) != 0) name, sizeof(name), port, sizeof(port),
NI_NUMERICHOST|NI_NUMERICSERV|NI_NUMERICSCOPE) != 0)
name[0] = '\0'; name[0] = '\0';
switch (host->state) { switch (host->state) {