Skip to content

Reject excessively long dst, src, and localip ACL parameters #2478

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
k-furman wants to merge 4 commits into
base: master
Choose a base branch
from
+19 −11
Open

Reject excessively long dst, src, and localip ACL parameters #2478

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c72b844
Reject excessively long dst, src, and localip ACL parameters
k-furman Aug 20, 2026
d4b3572
Add k-furman to contributors
k-furman Aug 21, 2026
6c61cac
Fix build error for missing include
kinkie Sep 12, 2026
f5b9bd8
Remove trailing char from IP patterns in Ip.cc
k-furman Sep 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CONTRIBUTORS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,7 @@ Thank you!
Karl Benoit <karl.isatwork@gmail.com>
Khalid Abdullah <khalidcomilla58@gmail.com>
Kieran Whitbread <k.j.whitbread@qmul.ac.uk>
Kirill Furman <kir.furman@gmail.com>
Klaubert Herr <klaubert@gmail.com>
Klaus Singvogel <kssingvo@suse.de>
Kolics Bertold <bertold@tohotom.vein.hu>
Expand Down
29 changes: 18 additions & 11 deletions src/acl/Ip.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
#include "debug/Stream.h"
#include "ip/tools.h"
#include "MemBuf.h"
#include "sbuf/Stream.h"
#include "wordlist.h"

#include <algorithm>
Expand Down Expand Up @@ -230,15 +231,18 @@ acl_ip_data::containsVetted(const Ip::Address &needle) const
}

/* Handle either type of address, IPv6 will be discarded with a warning if disabled */
#define SCAN_ACL1_6 "%[0123456789ABCDEFabcdef:]-%[0123456789ABCDEFabcdef:]/%[0123456789]"
#define SCAN_ACL2_6 "%[0123456789ABCDEFabcdef:]-%[0123456789ABCDEFabcdef:]%c"
#define SCAN_ACL3_6 "%[0123456789ABCDEFabcdef:]/%[0123456789]"
#define SCAN_ACL4_6 "%[0123456789ABCDEFabcdef:]/%c"
#define SCAN_ACL1_6 "%39[0123456789ABCDEFabcdef:]-%39[0123456789ABCDEFabcdef:]/%3[0123456789]"
#define SCAN_ACL2_6 "%39[0123456789ABCDEFabcdef:]-%39[0123456789ABCDEFabcdef:]%c"
#define SCAN_ACL3_6 "%39[0123456789ABCDEFabcdef:]/%3[0123456789]"
#define SCAN_ACL4_6 "%39[0123456789ABCDEFabcdef:]/%c"
Comment thread
rousskov marked this conversation as resolved.
/* We DO need to know which is which though, for proper CIDR masking. */
#define SCAN_ACL1_4 "%[0123456789.]-%[0123456789.]/%[0123456789.]"
#define SCAN_ACL2_4 "%[0123456789.]-%[0123456789.]%c"
#define SCAN_ACL3_4 "%[0123456789.]/%[0123456789.]"
#define SCAN_ACL4_4 "%[0123456789.]/%c"
#define SCAN_ACL1_4 "%15[0123456789.]-%15[0123456789.]/%15[0123456789.]"
#define SCAN_ACL2_4 "%15[0123456789.]-%15[0123456789.]%c"
#define SCAN_ACL3_4 "%15[0123456789.]/%15[0123456789.]"
#define SCAN_ACL4_4 "%15[0123456789.]/%c"
/* Handle non-ip/incorrect patterns */
#define SCAN_ACLX_1 "%255[^/]/%255s"
#define SCAN_ACLX_2 "%255s"

acl_ip_data *
acl_ip_data::FactoryParse(const char *t)
Expand Down Expand Up @@ -292,10 +296,10 @@ acl_ip_data::FactoryParse(const char *t)
iptype=AF_INET6;

// Neither
} else if (sscanf(t, "%[^/]/%s", addr1, mask) == 2) {
debugs(28, 9, "aclIpParseIpData: '" << t << "' matched: non-IP pattern: %[^/]/%s");
} else if (sscanf(t, SCAN_ACLX_1, addr1, mask) == 2) {
debugs(28, 9, "aclIpParseIpData: '" << t << "' matched: non-IP pattern: " << SCAN_ACLX_1);
addr2[0] = '\0';
} else if (sscanf(t, "%s", addr1) == 1) {
} else if (sscanf(t, SCAN_ACLX_2, addr1) == 1) {
/*
* Note, must use plain getaddrinfo() here because at startup
* ipcache hasn't been initialized
Expand Down Expand Up @@ -357,6 +361,9 @@ acl_ip_data::FactoryParse(const char *t)
}

return q;
} else {
delete q;
throw TextException(ToSBuf("Excessively long ACL parameter value: ", t), Here());
Comment on lines +364 to +366

@rousskov rousskov Sep 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We are almost done, I hope. AFAICT, we should now remove this new code as unreachable and adjust PR title to replace the specific "reject" claim with something vague like "Improve handling of long dst, src, and localip ACL parameters".

Suggested change
} else {
delete q;
throw TextException(ToSBuf("Excessively long ACL parameter value: ", t), Here());

If the above is correct, please remove the no-longer-necessary #include "sbuf/Stream.h" addition as well.

}

/* ignore IPv6 addresses when built with IPv4-only */
Expand Down