Reject excessively long dst, src, and localip ACL parameters

[k-furman]

This change fixes buffer overflows when acl_ip_data::FactoryParse() is
given malformed dst, src, and localip ACL configuration parameters
with values exceeding 255 characters. Squid now also detects (and
rejects) trailing parameter garbage in more cases.

FactoryParse() sscanf() calls were writing raw input into 256-byte
buffers without checking input size. This change adds these limits:

• IPv6 input patterns: 39 bytes per address and 3 bytes for the mask.
• IPv4 input patterns: 15 bytes per address and 15 bytes for the mask.
• Non-IP input patterns: 255 per address and 255 for the mask.

[rousskov]

Thank you for posting this PR. It needs a few corrections, but nothing major AFAICT. Please let me know if you want me to do any of the suggested changes.

Please check the adjusted PR title/description. They will become a commit message when this PR is merged. I edited them to focus the title on admin-visible effects and to avoid retelling what the diff clearly says. I also wanted to clarify the scope of the proposed trailing garbage checks.

Finally, please add the author line from the first PR branch commit (or, if needed, an alternative entry) to CONTRIBUTORS. Our CI tests will check for that automatically. If you do not want any such entry, please let me know, and we will take care of that manually.

[k-furman]

Many thanks for detailed answer!

I fixed all things you suggested, squash commits, change commit message and head as in PR, and force-pushed it.

Also, I add a line with my name in CONTRIBUTORS, as you tell.

[kinkie]

Suggested change

	#define SCAN_ACL1_6 "%39[0123456789ABCDEFabcdef:]-%39[0123456789ABCDEFabcdef:]/%3[0123456789]%c"
	const char* SCAN_ACL1_6 = "%39[0123456789ABCDEFabcdef:]-%39[0123456789ABCDEFabcdef:]/%3[0123456789]%c";

and the same for all others

There should be no harm from using the type system

[rousskov]

If we are going to use the "type system" in this PR, we should use AAA:

Suggested change

	#define SCAN_ACL1_6 "%39[0123456789ABCDEFabcdef:]-%39[0123456789ABCDEFabcdef:]/%3[0123456789]%c"
	const auto SCAN_ACL1_6 = "%39[0123456789ABCDEFabcdef:]-%39[0123456789ABCDEFabcdef:]/%3[0123456789]%c";

Also, these variables would have to be moved to the function using them.

IMO, we should keep this polishing outside this PR scope to make the diff as clear as possible. IIRC, diff clarity is what allowed us to spot several serious problems in the earlier variations of this PR.

[rousskov]

I removed "We now also extend trailing garbage checks to all of the above patterns" from PR description to keep it up to date with the recent change.

[rousskov]

If my analysis at #2478 (review) is correct, then the >= 2 condition in the official code is buggy. Given the associated discussion, if possible, please preserve that and several other similar bugs instead of trying to fix them. In other words, if possible, please restrict this PR to what Amos called "adding the field length details". We will fix the other bugs in another/dedicated PR.

If these conditions must be changed when adding field lengths, please remind me why.

[rousskov]

We are almost done, I hope. AFAICT, we should now remove this new code as unreachable and adjust PR title to replace the specific "reject" claim with something vague like "Improve handling of long dst, src, and localip ACL parameters".

Suggested change

	} else {
	delete q;
	throw TextException(ToSBuf("Excessively long ACL parameter value: ", t), Here());

If the above is correct, please remove the no-longer-necessary #include "sbuf/Stream.h" addition as well.

[rousskov]

@k-furman, just FYI: No need to squash commits and/or rebase, especially when there are no merge conflicts. Our merge bot will squash automatically.