/usr/src/usr.sbin/dhcrelay/dispatch.c

Bug Summary

File:	src/usr.sbin/dhcrelay/dispatch.c
Warning:	line 302, column 15 Use of zero-allocated memory

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name dispatch.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/dhcrelay/obj -resource-dir /usr/local/lib/clang/13.0.0 -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/dhcrelay/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.sbin/dhcrelay/dispatch.c

1/*	$OpenBSD: dispatch.c,v 1.23 2021/01/17 13:40:59 claudio Exp $	*/

3/*
* Copyright 2004 Henning Brauer <henning@openbsd.org>
* Copyright (c) 1995, 1996, 1997, 1998, 1999
* The Internet Software Consortium.   All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of The Internet Software Consortium nor the names
*    of its contributors may be used to endorse or promote products derived
*    from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE INTERNET SOFTWARE CONSORTIUM AND
* CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED.  IN NO EVENT SHALL THE INTERNET SOFTWARE CONSORTIUM OR
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
* USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* This software has been written for the Internet Software Consortium
* by Ted Lemon <mellon@fugue.com> in cooperation with Vixie
* Enterprises.  To learn more about the Internet Software Consortium,
* see ``http://www.vix.com/isc''.  To learn more about Vixie
* Enterprises, see ``http://www.vix.com''.
*/

42#include <sys/types.h>
43#include <sys/ioctl.h>
44#include <sys/socket.h>

46#include <net/if.h>
47#include <net/if_dl.h>
48#include <net/if_media.h>
49#include <net/if_types.h>

51#include <netinet/in.h>
52#include <netinet/if_ether.h>

54#include <errno(*__errno()).h>
55#include <ifaddrs.h>
56#include <limits.h>
57#include <poll.h>
58#include <stdlib.h>
59#include <string.h>
60#include <syslog.h>
61#include <time.h>
62#include <unistd.h>

64#include "dhcp.h"
65#include "dhcpd.h"
66#include "log.h"

68/*
* Macros implementation used to generate link-local addresses. This
* code was copied from: sys/netinet6/in6_ifattach.c.
*/
72#define EUI64_UBIT0x02		0x02
73#define EUI64_TO_IFID(in6)do { (in6)->__u6_addr.__u6_addr8[8] ^= 0x02; } while (0) \
do { (in6)->s6_addr__u6_addr.__u6_addr8[8] ^= EUI64_UBIT0x02; } while (0)

76struct protocol *protocols;
77struct timeout *timeouts;
78static struct timeout *free_timeouts;
79static int interfaces_invalidated;

81void (*bootp_packet_handler)(struct interface_info *,
  struct dhcp_packet *, int, struct packet_ctx *);

84static int interface_status(struct interface_info *ifinfo);

86struct interface_info *
87iflist_getbyname(const char *name)
88{
struct interface_info	*intf;

TAILQ_FOREACH(intf, &intflist, entry)for((intf) = ((&intflist)->tqh_first); (intf) != ((void
 *)0); (intf) = ((intf)->entry.tqe_next)) {
if (strcmp(intf->name, name) != 0)
	continue;

return intf;
}

return NULL((void *)0);
99}

101void
102setup_iflist(void)
103{
struct interface_info		*intf;
struct sockaddr_dl		*sdl;
struct ifaddrs			*ifap, *ifa;
struct if_data			*ifi;
struct sockaddr_in		*sin;
struct sockaddr_in6		*sin6;

TAILQ_INIT(&intflist)do { (&intflist)->tqh_first = ((void *)0); (&intflist
)->tqh_last = &(&intflist)->tqh_first; } while (
0);
if (getifaddrs(&ifap))
fatalx("getifaddrs failed");

for (ifa = ifap; ifa != NULL((void *)0); ifa = ifa->ifa_next) {
if ((ifa->ifa_flags & IFF_LOOPBACK0x8) ||
    (ifa->ifa_flags & IFF_POINTOPOINT0x10))
	continue;

/* Find interface or create it. */
intf = iflist_getbyname(ifa->ifa_name);
if (intf == NULL((void *)0)) {
	intf = calloc(1, sizeof(*intf));
	if (intf == NULL((void *)0))
		fatal("calloc");

	strlcpy(intf->name, ifa->ifa_name,
	    sizeof(intf->name));
	TAILQ_INSERT_HEAD(&intflist, intf, entry)do { if (((intf)->entry.tqe_next = (&intflist)->tqh_first
) != ((void *)0)) (&intflist)->tqh_first->entry.tqe_prev
 = &(intf)->entry.tqe_next; else (&intflist)->tqh_last
 = &(intf)->entry.tqe_next; (&intflist)->tqh_first
 = (intf); (intf)->entry.tqe_prev = &(&intflist)->
tqh_first; } while (0);
}

/* Signal disabled interface. */
if ((ifa->ifa_flags & IFF_UP0x1) == 0)
	intf->dead = 1;

if (ifa->ifa_addr->sa_family == AF_LINK18) {
	sdl = (struct sockaddr_dl *)ifa->ifa_addr;
	ifi = (struct if_data *)ifa->ifa_data;

	/* Skip unsupported interfaces. */
	if (ifi->ifi_type != IFT_ETHER0x06 &&
	    ifi->ifi_type != IFT_ENC0xf4 &&
	    ifi->ifi_type != IFT_CARP0xf7) {
		TAILQ_REMOVE(&intflist, intf, entry)do { if (((intf)->entry.tqe_next) != ((void *)0)) (intf)->
entry.tqe_next->entry.tqe_prev = (intf)->entry.tqe_prev
; else (&intflist)->tqh_last = (intf)->entry.tqe_prev
; *(intf)->entry.tqe_prev = (intf)->entry.tqe_next; ; ;
 } while (0);
		free(intf);
		continue;
	}

	if (ifi->ifi_type == IFT_ENC0xf4)
		intf->hw_address.htype = HTYPE_IPSEC_TUNNEL31;
	else
		intf->hw_address.htype = HTYPE_ETHER1;

	intf->index = sdl->sdl_index;
	intf->hw_address.hlen = sdl->sdl_alen;
	memcpy(intf->hw_address.haddr,
	    LLADDR(sdl)((caddr_t)((sdl)->sdl_data + (sdl)->sdl_nlen)), sdl->sdl_alen);
} else if (ifa->ifa_addr->sa_family == AF_INET2) {
	sin = (struct sockaddr_in *)ifa->ifa_addr;
	if (sin->sin_addr.s_addr == htonl(INADDR_LOOPBACK)(__uint32_t)(__builtin_constant_p(((u_int32_t)(0x7f000001))) ?
 (__uint32_t)(((__uint32_t)(((u_int32_t)(0x7f000001))) & 0xff
) << 24 | ((__uint32_t)(((u_int32_t)(0x7f000001))) &
 0xff00) << 8 | ((__uint32_t)(((u_int32_t)(0x7f000001))
) & 0xff0000) >> 8 | ((__uint32_t)(((u_int32_t)(0x7f000001
))) & 0xff000000) >> 24) : __swap32md(((u_int32_t)(
0x7f000001)))) ||
	    intf->primary_address.s_addr != INADDR_ANY((u_int32_t)(0x00000000)))
		continue;

	intf->primary_address = sin->sin_addr;
} else if (ifa->ifa_addr->sa_family == AF_INET624) {
	sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
	if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)(((&sin6->sin6_addr)->__u6_addr.__u6_addr8[0] == 0xfe
) && (((&sin6->sin6_addr)->__u6_addr.__u6_addr8
[1] & 0xc0) == 0x80))) {
		intf->linklocal = sin6->sin6_addr;
169#ifdef __KAME__
		/*
		 * Remove possible scope from address if
		 * link-local.
		 */
		intf->linklocal.s6_addr__u6_addr.__u6_addr8[2] = 0;
		intf->linklocal.s6_addr__u6_addr.__u6_addr8[3] = 0;
176#endif
	} else
		intf->gipv6 = 1;

	/* At least one IPv6 address was found. */
	intf->ipv6 = 1;
}
}

freeifaddrs(ifap);

/*
* Generate link-local IPv6 address for interfaces without it.
*
* For IPv6 DHCP Relay it doesn't matter what is used for
* link-addr field, so let's generate an address that won't
* change during execution so we can always find the interface
* to relay packets back. This is only used for layer 2 relaying
* when the interface might not have an address.
*/
TAILQ_FOREACH(intf, &intflist, entry)for((intf) = ((&intflist)->tqh_first); (intf) != ((void
 *)0); (intf) = ((intf)->entry.tqe_next)) {
if (memcmp(&intf->linklocal, &in6addr_any,
    sizeof(in6addr_any)) != 0)
	continue;

intf->linklocal.s6_addr__u6_addr.__u6_addr8[0] = 0xfe;
intf->linklocal.s6_addr__u6_addr.__u6_addr8[1] = 0x80;
intf->linklocal.s6_addr__u6_addr.__u6_addr8[8] = intf->hw_address.haddr[0];
intf->linklocal.s6_addr__u6_addr.__u6_addr8[9] = intf->hw_address.haddr[1];
intf->linklocal.s6_addr__u6_addr.__u6_addr8[10] = intf->hw_address.haddr[2];
intf->linklocal.s6_addr__u6_addr.__u6_addr8[11] = 0xff;
intf->linklocal.s6_addr__u6_addr.__u6_addr8[12] = 0xfe;
intf->linklocal.s6_addr__u6_addr.__u6_addr8[13] = intf->hw_address.haddr[3];
intf->linklocal.s6_addr__u6_addr.__u6_addr8[14] = intf->hw_address.haddr[4];
intf->linklocal.s6_addr__u6_addr.__u6_addr8[15] = intf->hw_address.haddr[5];
EUI64_TO_IFID(&intf->linklocal)do { (&intf->linklocal)->__u6_addr.__u6_addr8[8] ^=
 0x02; } while (0);
}
213}

215struct interface_info *
216register_interface(const char *ifname, void (*handler)(struct protocol *),
  int isserver)
218{
struct interface_info		*intf;

if ((intf = iflist_getbyname(ifname)) == NULL((void *)0))
return NULL((void *)0);

/* Don't register disabled interfaces. */
if (intf->dead)
return NULL((void *)0);

/* Check if we already registered the interface. */
if (intf->ifr.ifr_name[0] != 0)
return intf;

if (strlcpy(intf->ifr.ifr_name, ifname,
   sizeof(intf->ifr.ifr_name)) >= sizeof(intf->ifr.ifr_name))
fatalx("interface name '%s' too long", ifname);

if_register_receive(intf, isserver);
if_register_send(intf);
add_protocol(intf->name, intf->rfdesc, handler, intf);

return intf;
241}

243/*
* Wait for packets to come in using poll().  When a packet comes in,
* call receive_packet to receive the packet and possibly strip hardware
* addressing information from it, and then call through the
* bootp_packet_handler hook to try to do something with it.
*/
249void
250dispatch(void)
251{
int count, i, to_msec, nfds = 0;
struct protocol *l;
struct pollfd *fds;
time_t howlong;

nfds = 0;
for (l = protocols; l; l = l->next)
1
Loop condition is false. Execution continues on line 261→
nfds++;

fds = calloc(nfds, sizeof(struct pollfd));
2
←
Memory is allocated→
if (fds == NULL((void *)0))
3
←
Assuming 'fds' is not equal to NULL→
4
←
Taking false branch→
fatalx("Can't allocate poll structures.");

do {
/*
 * Call any expired timeouts, and then if there's still
 * a timeout registered, time out the select call then.
 */
270another:
if (timeouts) {
5
←
Assuming 'timeouts' is non-null→
6
←
Taking true branch→
10
←
Assuming 'timeouts' is null→
11
←
Taking false branch→
	if (timeouts->when <= cur_time) {
7
←
Assuming 'cur_time' is >= field 'when'→
8
←
Taking true branch→
		struct timeout *t = timeouts;

		timeouts = timeouts->next;
		(*(t->func))(t->what);
		t->next = free_timeouts;
		free_timeouts = t;
		goto another;
9
←
Control jumps to line 271→
	}

	/*
	 * Figure timeout in milliseconds, and check for
	 * potential overflow, so we can cram into an
	 * int for poll, while not polling with a
	 * negative timeout and blocking indefinitely.
	 */
	howlong = timeouts->when - cur_time;
	if (howlong > INT_MAX2147483647 / 1000)
		howlong = INT_MAX2147483647 / 1000;
	to_msec = howlong * 1000;
} else
	to_msec = -1;

/* Set up the descriptors to be polled. */
i = 0;

for (l = protocols; l; l = l->next) {
12
←
Loop condition is true.  Entering loop body→
	struct interface_info *ip = l->local;

	if (ip && (l->handler != got_one || !ip->dead)) {
13
←
Assuming 'ip' is non-null→
14
←
Assuming field 'handler' is not equal to got_one→
		fds[i].fd = l->fd;
15
←
Use of zero-allocated memory
		fds[i].events = POLLIN0x0001;
		fds[i].revents = 0;
		i++;
	}
}

if (i == 0)
	fatalx("No live interfaces to poll on - exiting.");

/* Wait for a packet or a timeout... XXX */
count = poll(fds, nfds, to_msec);

/* Not likely to be transitory... */
if (count == -1) {
	if (errno(*__errno()) == EAGAIN35 || errno(*__errno()) == EINTR4) {
		time(&cur_time);
		continue;
	}
	else
		fatal("poll");
}

/* Get the current time... */
time(&cur_time);

i = 0;
for (l = protocols; l; l = l->next) {
	struct interface_info *ip = l->local;

	if ((fds[i].revents & (POLLIN0x0001 | POLLHUP0x0010))) {
		fds[i].revents = 0;
		if (ip && (l->handler != got_one ||
		    !ip->dead))
			(*(l->handler))(l);
		if (interfaces_invalidated)
			break;
	}
	i++;
}
interfaces_invalidated = 0;
} while (1);
344}


347void
348got_one(struct protocol *l)
349{
struct packet_ctx pc;
ssize_t result;
union {
/*
 * Packet input buffer.  Must be as large as largest
 * possible MTU.
 */
unsigned char packbuf[4095];
struct dhcp_packet packet;
} u;
struct interface_info *ip = l->local;

memset(&pc, 0, sizeof(pc));

if ((result = receive_packet(ip, u.packbuf, sizeof(u), &pc)) == -1) {
log_warn("receive_packet failed on %s", ip->name);
ip->errors++;
if ((!interface_status(ip)) ||
    (ip->noifmedia && ip->errors > 20)) {
	/* our interface has gone away. */
	log_warnx("Interface %s no longer appears valid.",
	    ip->name);
	ip->dead = 1;
	interfaces_invalidated = 1;
	close(l->fd);
	remove_protocol(l);
	free(ip);
}
return;
}
if (result == 0)
return;

if (bootp_packet_handler)
(*bootp_packet_handler)(ip, &u.packet, result, &pc);
385}

387int
388interface_status(struct interface_info *ifinfo)
389{
char *ifname = ifinfo->name;
int ifsock = ifinfo->rfdesc;
struct ifreq ifr;
struct ifmediareq ifmr;

/* get interface flags */
memset(&ifr, 0, sizeof(ifr));
strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name));
if (ioctl(ifsock, SIOCGIFFLAGS(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifreq) & 0x1fff) << 16) | ((('i')) <<
 8) | ((17))), &ifr) == -1) {
log_warn("ioctl(SIOCGIFFLAGS) on %s", ifname);
goto inactive;
}
/*
* if one of UP and RUNNING flags is dropped,
* the interface is not active.
*/
if ((ifr.ifr_flagsifr_ifru.ifru_flags & (IFF_UP0x1|IFF_RUNNING0x40)) != (IFF_UP0x1|IFF_RUNNING0x40)) {
goto inactive;
}
/* Next, check carrier on the interface, if possible */
if (ifinfo->noifmedia)
goto active;
memset(&ifmr, 0, sizeof(ifmr));
strlcpy(ifmr.ifm_name, ifname, sizeof(ifmr.ifm_name));
if (ioctl(ifsock, SIOCGIFMEDIA(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifmediareq) & 0x1fff) << 16) | ((('i')) <<
 8) | ((56))), (caddr_t)&ifmr) == -1) {
if (errno(*__errno()) != EINVAL22) {
	log_debug("ioctl(SIOCGIFMEDIA) on %s", ifname);
	ifinfo->noifmedia = 1;
	goto active;
}
/*
 * EINVAL (or ENOTTY) simply means that the interface
 * does not support the SIOCGIFMEDIA ioctl. We regard it alive.
 */
ifinfo->noifmedia = 1;
goto active;
}
if (ifmr.ifm_status & IFM_AVALID0x0000000000000001ULL) {
switch (ifmr.ifm_active & IFM_NMASK0x000000000000ff00ULL) {
case IFM_ETHER0x0000000000000100ULL:
	if (ifmr.ifm_status & IFM_ACTIVE0x0000000000000002ULL)
		goto active;
	else
		goto inactive;
	break;
default:
	goto inactive;
}
}
439inactive:
return (0);
441active:
return (1);
443}

445/* Add a protocol to the list of protocols... */
446void
447add_protocol(char *name, int fd, void (*handler)(struct protocol *),
  void *local)
449{
struct protocol *p;

p = malloc(sizeof(*p));
if (!p)
fatalx("can't allocate protocol struct for %s", name);

p->fd = fd;
p->handler = handler;
p->local = local;
p->next = protocols;
protocols = p;
461}

463void
464remove_protocol(struct protocol *proto)
465{
struct protocol *p, *next, *prev;

prev = NULL((void *)0);
for (p = protocols; p; p = next) {
next = p->next;
if (p == proto) {
	if (prev)
		prev->next = p->next;
	else
		protocols = p->next;
	free(p);
}
}
479}