Skip to content

Commit c41cdec

Browse files
JeremiahM37JeremiahM37
committed
correct config, KV, protocol, and utility logic
1 parent 1abbe4e commit c41cdec

6 files changed

Lines changed: 50 additions & 35 deletions

File tree

‎src/json/centijson_value.c‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1943,31 +1943,31 @@ json_value_clone(WOLFSENTRY_CONTEXT_ARGS_IN_EX(struct wolfsentry_allocator *allo
19431943
RBTREE **stack = (RBTREE **)malloc(rbtree_stack_size_needed(src_dict)); /* put this on the heap to avoid runaway growth of stack on deep JSON trees. */
19441944
if (! stack) {
19451945
ret = JSON_ERR_OUTOFMEMORY;
1946-
break;
1947-
}
1948-
1949-
stack_size = json_value_dict_leftmost_path(stack, src_dict->root);
1950-
1951-
while(stack_size > 0) {
1952-
src_dict_node = stack[--stack_size];
1953-
dest_node = json_value_dict_get_or_add_(WOLFSENTRY_CONTEXT_ARGS_OUT_EX(allocator), clone, json_value_string(&src_dict_node->key), json_value_string_length(&src_dict_node->key));
1954-
if (! dest_node) {
1955-
ret = JSON_ERR_OUTOFMEMORY;
1956-
break;
1946+
} else {
1947+
stack_size = json_value_dict_leftmost_path(stack, src_dict->root);
1948+
1949+
while(stack_size > 0) {
1950+
src_dict_node = stack[--stack_size];
1951+
dest_node = json_value_dict_get_or_add_(WOLFSENTRY_CONTEXT_ARGS_OUT_EX(allocator), clone, json_value_string(&src_dict_node->key), json_value_string_length(&src_dict_node->key));
1952+
if (! dest_node) {
1953+
ret = JSON_ERR_OUTOFMEMORY;
1954+
break;
1955+
}
1956+
ret = json_value_clone(WOLFSENTRY_CONTEXT_ARGS_OUT_EX(allocator), &src_dict_node->json_value, dest_node);
1957+
if (ret < 0)
1958+
break;
1959+
stack_size += json_value_dict_leftmost_path(stack + stack_size, src_dict_node->right);
19571960
}
1958-
ret = json_value_clone(WOLFSENTRY_CONTEXT_ARGS_OUT_EX(allocator), &src_dict_node->json_value, dest_node);
1959-
if (ret < 0)
1960-
break;
1961-
stack_size += json_value_dict_leftmost_path(stack + stack_size, src_dict_node->right);
1962-
}
19631961

1964-
free((void *)stack);
1962+
free((void *)stack);
1963+
}
19651964
}
19661965
if (ret < 0) {
19671966
int ret2 = json_value_fini(WOLFSENTRY_CONTEXT_ARGS_OUT_EX(allocator), clone);
19681967
if (ret2 < 0)
19691968
WOLFSENTRY_WARN("json_value_fini: %s\n", json_error_str(ret2));
19701969
}
1970+
break;
19711971
}
19721972
}
19731973

‎src/json/load_config.c‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
#define WOLFSENTRY_SOURCE_ID WOLFSENTRY_SOURCE_ID_JSON_LOAD_CONFIG_C
2727

2828
#include <stdlib.h>
29+
#include <limits.h>
2930

3031
#define MAX_IPV4_ADDR_BITS (sizeof(struct in_addr) * BITS_PER_BYTE)
3132
#define MAX_IPV6_ADDR_BITS (sizeof(struct in6_addr) * BITS_PER_BYTE)
@@ -384,12 +385,18 @@ static wolfsentry_errcode_t convert_wolfsentry_duration(struct wolfsentry_contex
384385

385386
switch (*endptr) {
386387
case 'd':
388+
if (conv > LONG_MAX / 24 || conv < LONG_MIN / 24)
389+
WOLFSENTRY_ERROR_RETURN(CONFIG_INVALID_VALUE);
387390
conv *= 24;
388391
/* fallthrough */
389392
case 'h':
393+
if (conv > LONG_MAX / 60 || conv < LONG_MIN / 60)
394+
WOLFSENTRY_ERROR_RETURN(CONFIG_INVALID_VALUE);
390395
conv *= 60;
391396
/* fallthrough */
392397
case 'm':
398+
if (conv > LONG_MAX / 60 || conv < LONG_MIN / 60)
399+
WOLFSENTRY_ERROR_RETURN(CONFIG_INVALID_VALUE);
393400
conv *= 60;
394401
/* fallthrough */
395402
case 's':
@@ -1968,7 +1975,7 @@ WOLFSENTRY_API wolfsentry_errcode_t wolfsentry_config_json_fini(
19681975
struct wolfsentry_route_table *old_route_table, *new_route_table;
19691976
if ((ret = wolfsentry_route_get_main_table(JPSP_WOLFSENTRY_ACTUAL_CONTEXT_ARGS_OUT, &old_route_table)) < 0)
19701977
goto out;
1971-
if ((ret = wolfsentry_route_get_main_table(JPSP_WOLFSENTRY_ACTUAL_CONTEXT_ARGS_OUT, &new_route_table)) < 0)
1978+
if ((ret = wolfsentry_route_get_main_table(JPSP_WOLFSENTRY_CONTEXT_ARGS_OUT, &new_route_table)) < 0)
19721979
goto out;
19731980
if (wolfsentry_table_n_deletes((struct wolfsentry_table_header *)new_route_table)
19741981
!= wolfsentry_table_n_deletes((struct wolfsentry_table_header *)old_route_table))

‎src/kv.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1054,7 +1054,7 @@ WOLFSENTRY_API wolfsentry_errcode_t wolfsentry_user_value_get_json(
10541054
struct wolfsentry_kv_pair_internal **user_value_record)
10551055
{
10561056
wolfsentry_errcode_t ret;
1057-
if ((ret = wolfsentry_kv_get_reference(WOLFSENTRY_CONTEXT_ARGS_OUT, wolfsentry->user_values, key, key_len, WOLFSENTRY_KV_STRING, user_value_record)) < 0)
1057+
if ((ret = wolfsentry_kv_get_reference(WOLFSENTRY_CONTEXT_ARGS_OUT, wolfsentry->user_values, key, key_len, WOLFSENTRY_KV_JSON, user_value_record)) < 0)
10581058
WOLFSENTRY_ERROR_RERETURN(ret);
10591059
*value = WOLFSENTRY_KV_V_JSON(&(*user_value_record)->kv);
10601060
WOLFSENTRY_RETURN_OK;

‎src/lwip/packet_filter_glue.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1098,10 +1098,10 @@ static err_t icmp6_filter_with_wolfsentry(
10981098
else
10991099
memset(&local.local.addr, 0, sizeof *laddr);
11001100

1101-
remote.remote.sa_proto = IPPROTO_ICMP;
1101+
remote.remote.sa_proto = IPPROTO_ICMPV6;
11021102
remote.remote.sa_port = 0;
11031103

1104-
local.local.sa_proto = IPPROTO_ICMP;
1104+
local.local.sa_proto = IPPROTO_ICMPV6;
11051105
local.local.sa_port = icmp6_type;
11061106

11071107
if (event->netif)

‎src/routes.c‎

Lines changed: 18 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2366,6 +2366,9 @@ static wolfsentry_errcode_t wolfsentry_route_event_dispatch_0(
23662366
wolfsentry_route_flags_t current_rule_route_flags;
23672367
wolfsentry_errcode_t ret;
23682368
wolfsentry_time_t now;
2369+
int penalty_triggered = 0;
2370+
wolfsentry_hitcount_t derog_snap;
2371+
wolfsentry_hitcount_t commend_snap;
23692372

23702373
if (target_route == NULL)
23712374
WOLFSENTRY_ERROR_RETURN(INVALID_ARG);
@@ -2553,20 +2556,25 @@ static wolfsentry_errcode_t wolfsentry_route_event_dispatch_0(
25532556
}
25542557
}
25552558

2559+
/* Snapshot atomic counts once so the guard and arithmetic operate on the
2560+
* same values (avoid TOCTOU between successive loads). */
2561+
derog_snap = WOLFSENTRY_ATOMIC_LOAD(rule_route->meta.derogatory_count);
2562+
commend_snap = WOLFSENTRY_ATOMIC_LOAD(rule_route->meta.commendable_count);
2563+
if (config->config.derogatory_threshold_for_penaltybox > 0) {
2564+
if (config->config.flags & WOLFSENTRY_EVENTCONFIG_FLAG_DEROGATORY_THRESHOLD_IGNORE_COMMENDABLE) {
2565+
penalty_triggered = (derog_snap >= config->config.derogatory_threshold_for_penaltybox);
2566+
} else {
2567+
penalty_triggered = (derog_snap >= commend_snap)
2568+
&& ((derog_snap - commend_snap)
2569+
>= config->config.derogatory_threshold_for_penaltybox);
2570+
}
2571+
}
2572+
25562573
if (current_rule_route_flags & WOLFSENTRY_ROUTE_FLAG_PENALTYBOXED) {
25572574
*action_results |= WOLFSENTRY_ACTION_RES_REJECT;
25582575
ret = WOLFSENTRY_ERROR_ENCODE(OK);
25592576
goto done;
2560-
} else if ((config->config.derogatory_threshold_for_penaltybox > 0)
2561-
&& ((config->config.flags & WOLFSENTRY_EVENTCONFIG_FLAG_DEROGATORY_THRESHOLD_IGNORE_COMMENDABLE) ?
2562-
(WOLFSENTRY_ATOMIC_LOAD(rule_route->meta.derogatory_count)
2563-
>= config->config.derogatory_threshold_for_penaltybox)
2564-
:
2565-
((WOLFSENTRY_ATOMIC_LOAD(rule_route->meta.derogatory_count)
2566-
>= WOLFSENTRY_ATOMIC_LOAD(rule_route->meta.commendable_count))
2567-
&& ((wolfsentry_hitcount_t)(WOLFSENTRY_ATOMIC_LOAD(rule_route->meta.derogatory_count)
2568-
- WOLFSENTRY_ATOMIC_LOAD(rule_route->meta.commendable_count))
2569-
>= config->config.derogatory_threshold_for_penaltybox))))
2577+
} else if (penalty_triggered)
25702578
{
25712579
wolfsentry_route_flags_t flags_before;
25722580
WOLFSENTRY_WARN_ON_FAILURE(

‎src/wolfsentry_util.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -232,7 +232,7 @@ WOLFSENTRY_API const char *wolfsentry_errcode_error_string(wolfsentry_errcode_t
232232
return "unknown user defined error code";
233233
} else if (i >= WOLFSENTRY_SUCCESS_ID_USER_BASE) {
234234
if (user_defined_successes[i - WOLFSENTRY_SUCCESS_ID_USER_BASE])
235-
return user_defined_errors[i - WOLFSENTRY_SUCCESS_ID_USER_BASE];
235+
return user_defined_successes[i - WOLFSENTRY_SUCCESS_ID_USER_BASE];
236236
else
237237
return "unknown user defined success code";
238238
} else if (i >= 0)
@@ -634,7 +634,7 @@ static void *wolfsentry_builtin_malloc(
634634
WOLFSENTRY_CONTEXT_ARGS_THREAD_NOT_USED;
635635
#ifdef WOLFSENTRY_MALLOC_DEBUG
636636
{
637-
ret = malloc(size);
637+
void *ret = malloc(size);
638638
if (ret != NULL)
639639
WOLFSENTRY_ATOMIC_INCREMENT(n_mallocs, 1);
640640
WOLFSENTRY_RETURN_VALUE(ret);
@@ -989,9 +989,9 @@ WOLFSENTRY_API wolfsentry_errcode_t wolfsentry_get_deadline_rel(WOLFSENTRY_CONTE
989989
WOLFSENTRY_SUCCESS_RETURN(EXPIRED);
990990
} else {
991991
if (now >= deadline)
992-
WOLFSENTRY_RETURN_OK;
993-
else
994992
WOLFSENTRY_SUCCESS_RETURN(EXPIRED);
993+
else
994+
WOLFSENTRY_RETURN_OK;
995995
}
996996
}
997997
}

0 commit comments

Comments
 (0)