339e3c62f
Denys Vlasenko
2026-09-21
Subject
httpd: fix handling of "D:1.2.3/999"
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
networking/httpd.c+18 -14
| @@ -41,7 +41,7 @@ | |
| * H:/serverroot # define the server root. It will override -h | |
| * A:172.20. # Allow address from 172.20.0.0/16 | |
| * A:10.0.0.0/25 # Allow any address from 10.0.0.0-10.0.0.127 | |
| - | * A:10.0.0.0/255.255.255.128 # Allow any address that previous set |
| + | * A:10.0.0.0/255.255.255.128 # Same as the previous |
| * A:127.0.0.1 # Allow local loopback connections | |
| * D:* # Deny from other IP connections | |
| * E404:/path/e404.html # /path/e404.html is the 404 (not found) error page | |
| @@ -63,7 +63,7 @@ | |
| * Deny/Allow IP logic: | |
| * - Default is to allow all (Allow all (A:*) is a no-op). | |
| * - Deny rules take precedence over allow rules. | |
| - | * - "Deny all" rule (D:*) is applied last. |
| + | * - However, "Deny all" rule (D:*) is applied last. |
| * | |
| * Example: | |
| * 1. Allow only specified addresses | |
| @@ -381,8 +381,8 @@ typedef struct Htaccess { | |
| /* Must have "next" as a first member */ | |
| typedef struct Htaccess_IP { | |
| struct Htaccess_IP *next; | |
| - | unsigned ip; |
| - | unsigned mask; |
| + | uint32_t ip; /* host-endian */ |
| + | uint32_t mask; /* host-endian */ |
| int allow_deny; | |
| } Htaccess_IP; | |
| #endif | |
| @@ -653,11 +653,11 @@ static ALWAYS_INLINE void free_Htaccess_IP_list(Htaccess_IP **pptr) | |
| #if ENABLE_FEATURE_HTTPD_ACL_IP | |
| /* Returns presumed mask width in bits or < 0 on error. | |
| * Updates strp, stores IP at provided pointer */ | |
| - | static int scan_ip(const char **strp, unsigned *ipp, unsigned char endc) |
| + | static int scan_ip(const char **strp, uint32_t *ipp, unsigned char endc) |
| { | |
| const char *p = *strp; | |
| int auto_mask = 8; | |
| - | unsigned ip = 0; |
| + | uint32_t ip = 0; |
| int j; | |
| if (*p == '/') | |
| @@ -695,10 +695,10 @@ static int scan_ip(const char **strp, unsigned *ipp, unsigned char endc) | |
| } | |
| /* Returns 0 on success. Stores IP and mask at provided pointers */ | |
| - | static int scan_ip_mask(const char *str, unsigned *ipp, unsigned *maskp) |
| + | static int scan_ip_mask(const char *str, uint32_t *ipp, uint32_t *maskp) |
| { | |
| int i; | |
| - | unsigned mask; |
| + | uint32_t mask; |
| char *p; | |
| i = scan_ip(&str, ipp, '/'); | |
| @@ -713,15 +713,16 @@ static int scan_ip_mask(const char *str, unsigned *ipp, unsigned *maskp) | |
| /* (return 0 (success) only if it has N.N.N.N form) */ | |
| return scan_ip(&str, maskp, '\0') - 32; | |
| } | |
| - | if (*p) |
| + | if (*p) /* 'xxx' had something apart from just digits */ |
| return -1; | |
| } | |
| + | //else: i = "automask" (the count of explicit IP components: "10.0[.]" = 16) |
| if (i > 32) | |
| return -1; | |
| - | if (sizeof(unsigned) == 4 && i == 32) { |
| - | /* mask >>= 32 below may not work */ |
| + | if (i == 32) { |
| + | /* mask >>= 32 below may not work (according to C standard) */ |
| mask = 0; | |
| } else { | |
| mask = 0xffffffff; | |
| @@ -890,15 +891,18 @@ static int parse_conf(const char *path, int flag) | |
| if (scan_ip_mask(after_colon, &pip->ip, &pip->mask)) { | |
| /* IP{/mask} syntax error detected, protect all */ | |
| ch = 'D'; | |
| + | //bb_error_msg("ERR"); |
| + | pip->ip = 0; /* could be set before error is detected - zero it (again) */ |
| pip->mask = 0; | |
| } | |
| + | //bb_error_msg_and_die("ip:0x%08x mask:0x%08x", pip->ip, pip->mask); |
| pip->allow_deny = ch; | |
| if (ch == 'D') { | |
| /* Deny:from_IP - prepend */ | |
| pip->next = G.ip_a_d; | |
| G.ip_a_d = pip; | |
| } else { | |
| - | /* A:from_IP - append (thus all D's precedes A's) */ |
| + | /* A:from_IP - append (thus all D's precede A's) */ |
| Htaccess_IP *prev_IP = G.ip_a_d; | |
| if (prev_IP == NULL) { | |
| G.ip_a_d = pip; | |
| @@ -2045,7 +2049,7 @@ static NOINLINE void send_file_and_exit(const char *url, int what) | |
| } | |
| #if ENABLE_FEATURE_HTTPD_ACL_IP | |
| - | static void if_ip_denied_send_HTTP_FORBIDDEN_and_exit(unsigned remote_ip) |
| + | static void if_ip_denied_send_HTTP_FORBIDDEN_and_exit(uint32_t remote_ip) |
| { | |
| Htaccess_IP *cur; | |
| @@ -2337,7 +2341,7 @@ static void handle_incoming_and_exit(const len_and_sockaddr *fromAddr) | |
| char *urlp; | |
| char *tptr; | |
| #if ENABLE_FEATURE_HTTPD_ACL_IP | |
| - | unsigned remote_ip; |
| + | uint32_t remote_ip; |
| #endif | |
| #if ENABLE_FEATURE_HTTPD_CGI | |
| unsigned total_headers_len; | |