/usr/src/usr.sbin/dhcpd/dispatch.c

Bug Summary

File:	src/usr.sbin/dhcpd/dispatch.c
Warning:	line 357, column 15 Dereference of null pointer

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name dispatch.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/dhcpd/obj -resource-dir /usr/local/llvm16/lib/clang/16 -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/dhcpd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/usr.sbin/dhcpd/dispatch.c

1/*	$OpenBSD: dispatch.c,v 1.45 2023/09/02 10:18:45 kn Exp $ */

3/*
* Copyright (c) 1995, 1996, 1997, 1998, 1999
* The Internet Software Consortium.   All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of The Internet Software Consortium nor the names
*    of its contributors may be used to endorse or promote products derived
*    from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE INTERNET SOFTWARE CONSORTIUM AND
* CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED.  IN NO EVENT SHALL THE INTERNET SOFTWARE CONSORTIUM OR
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
* USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* This software has been written for the Internet Software Consortium
* by Ted Lemon <mellon@fugue.com> in cooperation with Vixie
* Enterprises.  To learn more about the Internet Software Consortium,
* see ``http://www.vix.com/isc''.  To learn more about Vixie
* Enterprises, see ``http://www.vix.com''.
*/

41#include <sys/types.h>
42#include <sys/ioctl.h>
43#include <sys/socket.h>

45#include <arpa/inet.h>

47#include <net/if.h>
48#include <net/if_dl.h>
49#include <net/if_media.h>

51#include <netinet/in.h>

53#include <errno(*__errno()).h>
54#include <ifaddrs.h>
55#include <limits.h>
56#include <poll.h>
57#include <stdio.h>
58#include <stdlib.h>
59#include <string.h>
60#include <syslog.h>
61#include <time.h>
62#include <unistd.h>

64#include "dhcp.h"
65#include "tree.h"
66#include "dhcpd.h"
67#include "log.h"
68#include "sync.h"

70extern int syncfd;

72struct interface_info *interfaces;
73struct protocol *protocols;
74struct dhcpd_timeout *timeouts;
75static struct dhcpd_timeout *free_timeouts;
76static int interfaces_invalidated;

78static int interface_status(struct interface_info *ifinfo);
79int get_rdomain(char *);

81/* Use getifaddrs() to get a list of all the attached interfaces.
 For each interface that's of type INET and not the loopback interface,
 register that interface with the network I/O software, figure out what
 subnet it's on, and add it to the list of interfaces. */

86void
87discover_interfaces(int *rdomain)
88{
struct interface_info *tmp;
struct interface_info *last, *next;
struct subnet *subnet;
struct shared_network *share;
struct sockaddr_in foo;
int ir = 0, ird;
struct ifreq *tif;
struct ifaddrs *ifap, *ifa;

if (getifaddrs(&ifap) != 0)
fatalx("getifaddrs failed");

/*
* If we already have a list of interfaces, the interfaces were
* requested.
*/
if (interfaces != NULL((void *)0))
ir = 1;
else
/* must specify an interface when rdomains are used */
*rdomain = 0;

/* Cycle through the list of interfaces looking for IP addresses. */
for (ifa = ifap; ifa != NULL((void *)0); ifa = ifa->ifa_next) {
/*
 * See if this is the sort of interface we want to
 * deal with.
 */
if ((ifa->ifa_flags & IFF_LOOPBACK0x8) ||
    (ifa->ifa_flags & IFF_POINTOPOINT0x10) ||
    (!(ifa->ifa_flags & IFF_BROADCAST0x2)))
	continue;

/* See if we've seen an interface that matches this one. */
for (tmp = interfaces; tmp; tmp = tmp->next)
	if (!strcmp(tmp->name, ifa->ifa_name))
		break;

/* If we are looking for specific interfaces, ignore others. */
if (tmp == NULL((void *)0) && ir)
	continue;

ird = get_rdomain(ifa->ifa_name);
if (*rdomain == -1)
	*rdomain = ird;
else if (*rdomain != ird && ir)
	fatalx("Interface %s is not in rdomain %d",
	    tmp->name, *rdomain);
else if (*rdomain != ird && !ir)
	continue;

/* If there isn't already an interface by this name,
   allocate one. */
if (tmp == NULL((void *)0)) {
	tmp = calloc(1, sizeof *tmp);
	if (!tmp)
		fatalx("Insufficient memory to %s %s",
		    "record interface", ifa->ifa_name);
	strlcpy(tmp->name, ifa->ifa_name, sizeof(tmp->name));
	tmp->next = interfaces;
	tmp->noifmedia = tmp->dead = tmp->errors = 0;
	interfaces = tmp;
}

/* If we have the capability, extract link information
   and record it in a linked list. */
if (ifa->ifa_addr->sa_family == AF_LINK18) {
	struct sockaddr_dl *sdl =
	    ((struct sockaddr_dl *)(ifa->ifa_addr));
	tmp->index = sdl->sdl_index;
	tmp->hw_address.hlen = sdl->sdl_alen;
	tmp->hw_address.htype = HTYPE_ETHER1; /* XXX */
	memcpy(tmp->hw_address.haddr,
	    LLADDR(sdl)((caddr_t)((sdl)->sdl_data + (sdl)->sdl_nlen)), sdl->sdl_alen);
} else if (ifa->ifa_addr->sa_family == AF_INET2) {
	struct iaddr addr;

	/* Get a pointer to the address... */
	memcpy(&foo, ifa->ifa_addr, sizeof(foo));

	/* We don't want the loopback interface. */
	if (foo.sin_addr.s_addr == htonl (INADDR_LOOPBACK)(__uint32_t)(__builtin_constant_p(((u_int32_t)(0x7f000001))) ?
 (__uint32_t)(((__uint32_t)(((u_int32_t)(0x7f000001))) & 0xff
) << 24 | ((__uint32_t)(((u_int32_t)(0x7f000001))) &
 0xff00) << 8 | ((__uint32_t)(((u_int32_t)(0x7f000001))
) & 0xff0000) >> 8 | ((__uint32_t)(((u_int32_t)(0x7f000001
))) & 0xff000000) >> 24) : __swap32md(((u_int32_t)(
0x7f000001)))))
		continue;

	/* If this is the first real IP address we've
	   found, keep a pointer to ifreq structure in
	   which we found it. */
	if (!tmp->ifp) {
		int len = (IFNAMSIZ16 + ifa->ifa_addr->sa_len);
		tif = malloc(len);
		if (!tif)
			fatalx("no space to remember ifp.");
		strlcpy(tif->ifr_name, ifa->ifa_name,
		    IFNAMSIZ16);
		memcpy(&tif->ifr_addrifr_ifru.ifru_addr, ifa->ifa_addr,
		    ifa->ifa_addr->sa_len);
		tmp->ifp = tif;
		tmp->primary_address = foo.sin_addr;
	}

	/* Grab the address... */
	addr.len = 4;
	memcpy(addr.iabuf, &foo.sin_addr.s_addr, addr.len);

	/* If there's a registered subnet for this address,
	   connect it together... */
	if ((subnet = find_subnet(addr))) {
		/* If this interface has multiple aliases
		   on the same subnet, ignore all but the
		   first we encounter. */
		if (!subnet->interface) {
			subnet->interface = tmp;
			subnet->interface_address = addr;
		} else if (subnet->interface != tmp) {
			log_warnx("Multiple %s %s: %s %s",
			    "interfaces match the",
			    "same subnet",
			    subnet->interface->name,
			    tmp->name);
		}
		share = subnet->shared_network;
		if (tmp->shared_network &&
		    tmp->shared_network != share) {
			log_warnx("Interface %s matches %s",
			    tmp->name,
			    "multiple shared networks");
		} else {
			tmp->shared_network = share;
		}

		if (!share->interface) {
			share->interface = tmp;
		} else if (share->interface != tmp) {
			log_warnx("Multiple %s %s: %s %s",
			    "interfaces match the",
			    "same shared network",
			    share->interface->name,
			    tmp->name);
		}
	}
}
}

/* Discard interfaces we can't listen on. */
last = NULL((void *)0);
for (tmp = interfaces; tmp; tmp = next) {
next = tmp->next;

if (!tmp->ifp) {
	log_warnx("Can't listen on %s - it has no IP address.",
	    tmp->name);
	/* Remove tmp from the list of interfaces. */
	if (!last)
		interfaces = interfaces->next;
	else
		last->next = tmp->next;
	continue;
}

memcpy(&foo, &tmp->ifp->ifr_addrifr_ifru.ifru_addr, sizeof tmp->ifp->ifr_addrifr_ifru.ifru_addr);

if (!tmp->shared_network) {
	log_warnx("Can't listen on %s - dhcpd.conf has no "
	    "subnet declaration for %s.", tmp->name,
	    inet_ntoa(foo.sin_addr));
	/* Remove tmp from the list of interfaces. */
	if (!last)
		interfaces = interfaces->next;
	else
		last->next = tmp->next;
	continue;
}

last = tmp;

/* Find subnets that don't have valid interface addresses. */
for (subnet = (tmp->shared_network ?
    tmp->shared_network->subnets : NULL((void *)0)); subnet;
    subnet = subnet->next_sibling) {
	if (!subnet->interface_address.len) {
		/*
		 * Set the interface address for this subnet
		 * to the first address we found.
		 */
		subnet->interface_address.len = 4;
		memcpy(subnet->interface_address.iabuf,
		    &foo.sin_addr.s_addr, 4);
	}
}

/* Register the interface... */
if_register_receive(tmp);
if_register_send(tmp);
log_info("Listening on %s (%s).", tmp->name,
    inet_ntoa(foo.sin_addr));
}

if (interfaces == NULL((void *)0))
fatalx("No interfaces to listen on.");

/* Now register all the remaining interfaces as protocols. */
for (tmp = interfaces; tmp; tmp = tmp->next)
add_protocol(tmp->name, tmp->rfdesc, got_one, tmp);

freeifaddrs(ifap);
294}

296/*
* Wait for packets to come in using poll().  When a packet comes in,
* call receive_packet to receive the packet and possibly strip hardware
* addressing information from it, and then process it in do_packet.
*/
301void
302dispatch(void)
303{
int nfds, i, to_msec;
struct protocol *l;
static struct pollfd *fds;
1
'fds' initialized to a null pointer value→
static int nfds_max;
time_t howlong;

for (nfds = 0, l = protocols; l; l = l->next)
2
←
Loop condition is false. Execution continues on line 312→
nfds++;
if (syncfd != -1)
3
←
Assuming the condition is false→
4
←
Taking false branch→
nfds++;
if (nfds4.1
'nfds' is <= 'nfds_max'
 > nfds_max) {
5
←
Taking false branch→
fds = reallocarray(fds, nfds, sizeof(struct pollfd));
if (fds == NULL((void *)0))
	fatalx("Can't allocate poll structures.");
nfds_max = nfds;
}

for (;;) {
6
←
Loop condition is true.  Entering loop body→
/*
 * Call any expired timeouts, and then if there's
 * still a timeout registered, time out the poll
 * call then.
 */
time(&cur_time);
328another:
if (timeouts) {
7
←
Assuming 'timeouts' is non-null→
8
←
Taking true branch→
12
←
Assuming 'timeouts' is null→
13
←
Taking false branch→
	if (timeouts->when <= cur_time) {
9
←
Assuming 'cur_time' is >= field 'when'→
10
←
Taking true branch→
		struct dhcpd_timeout *t = timeouts;
		timeouts = timeouts->next;
		(*(t->func))(t->what);
		t->next = free_timeouts;
		free_timeouts = t;
		goto another;
11
←
Control jumps to line 329→
	}

	/*
	 * Figure timeout in milliseconds, and check for
	 * potential overflow, so we can cram into an int
	 * for poll, while not polling with a negative
	 * timeout and blocking indefinitely.
	 */
	howlong = timeouts->when - cur_time;
	if (howlong > INT_MAX0x7fffffff / 1000)
		howlong = INT_MAX0x7fffffff / 1000;
	to_msec = howlong * 1000;
} else
	to_msec = -1;

/* Set up the descriptors to be polled. */
for (i = 0, l = protocols; l; l = l->next) {
14
←
Loop condition is true.  Entering loop body→
	struct interface_info *ip = l->local;

	if (ip && (l->handler != got_one || !ip->dead)) {
15
←
Assuming 'ip' is non-null→
16
←
Assuming field 'handler' is not equal to got_one→
		fds[i].fd = l->fd;
17
←
Dereference of null pointer
		fds[i].events = POLLIN0x0001;
		++i;
	}
}

if (i == 0)
	fatalx("No live interfaces to poll on - exiting.");

if (syncfd != -1) {
	/* add syncer */
	fds[i].fd = syncfd;
	fds[i].events = POLLIN0x0001;
}

/* Wait for a packet or a timeout... */
switch (poll(fds, nfds, to_msec)) {
case -1:
	if (errno(*__errno()) != EAGAIN35 && errno(*__errno()) != EINTR4)
		fatal("poll");
	/* FALLTHROUGH */
case 0:
	continue;	/* no packets */
}
time(&cur_time);

for (i = 0, l = protocols; l; l = l->next) {
	struct interface_info *ip = l->local;

	if ((fds[i].revents & (POLLIN0x0001 | POLLHUP0x0010))) {
		if (ip && (l->handler != got_one ||
		    !ip->dead))
			(*(l->handler))(l);
		if (interfaces_invalidated)
			break;
	}
	++i;
}
if ((syncfd != -1) && (fds[i].revents & (POLLIN0x0001 | POLLHUP0x0010)))
	sync_recv();
interfaces_invalidated = 0;
}
399}


402void
403got_one(struct protocol *l)
404{
struct sockaddr_in from;
struct hardware hfrom;
struct iaddr ifrom;
ssize_t result;
union {
unsigned char packbuf[4095];
struct dhcp_packet packet;
} u;
struct interface_info *ip = l->local;

memset(&u, 0, sizeof(u));

if ((result = receive_packet(ip, u.packbuf, sizeof u,
   &from, &hfrom)) == -1) {
log_warn("receive_packet failed on %s", ip->name);
ip->errors++;
if ((!interface_status(ip)) ||
    (ip->noifmedia && ip->errors > 20)) {
	/* our interface has gone away. */
	log_warnx("Interface %s no longer appears valid.",
	    ip->name);
	ip->dead = 1;
	interfaces_invalidated = 1;
	close(l->fd);
	remove_protocol(l);
	free(ip);
}
return;
}
if (result == 0)
return;

ifrom.len = 4;
memcpy(ifrom.iabuf, &from.sin_addr, ifrom.len);

do_packet(ip, &u.packet, result, from.sin_port, ifrom, &hfrom);
441}

443int
444interface_status(struct interface_info *ifinfo)
445{
char * ifname = ifinfo->name;
int ifsock = ifinfo->rfdesc;
struct ifreq ifr;
struct ifmediareq ifmr;

/* get interface flags */
memset(&ifr, 0, sizeof(ifr));
strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name));
if (ioctl(ifsock, SIOCGIFFLAGS(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifreq) & 0x1fff) << 16) | ((('i')) <<
 8) | ((17))), &ifr) == -1) {
log_warn("ioctl(SIOCGIFFLAGS) on %s", ifname);
goto inactive;
}
/*
* if one of UP and RUNNING flags is dropped,
* the interface is not active.
*/
if ((ifr.ifr_flagsifr_ifru.ifru_flags & (IFF_UP0x1|IFF_RUNNING0x40)) != (IFF_UP0x1|IFF_RUNNING0x40))
goto inactive;

/* Next, check carrier on the interface, if possible */
if (ifinfo->noifmedia)
goto active;
memset(&ifmr, 0, sizeof(ifmr));
strlcpy(ifmr.ifm_name, ifname, sizeof(ifmr.ifm_name));
if (ioctl(ifsock, SIOCGIFMEDIA(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifmediareq) & 0x1fff) << 16) | ((('i')) <<
 8) | ((56))), (caddr_t)&ifmr) == -1) {
if (errno(*__errno()) != EINVAL22) {
	log_debug("ioctl(SIOCGIFMEDIA) on %s", ifname);
	ifinfo->noifmedia = 1;
	goto active;
}
/*
 * EINVAL (or ENOTTY) simply means that the interface
 * does not support the SIOCGIFMEDIA ioctl. We regard it alive.
 */
ifinfo->noifmedia = 1;
goto active;
}
if (ifmr.ifm_status & IFM_AVALID0x0000000000000001ULL) {
switch (ifmr.ifm_active & IFM_NMASK0x000000000000ff00ULL) {
case IFM_ETHER0x0000000000000100ULL:
	if (ifmr.ifm_status & IFM_ACTIVE0x0000000000000002ULL)
		goto active;
	else
		goto inactive;
	break;
default:
	goto inactive;
}
}
inactive:
return (0);
active:
return (1);
499}

501int
502locate_network(struct packet *packet)
503{
struct iaddr ia;

/* If this came through a gateway, find the corresponding subnet... */
if (packet->raw->giaddr.s_addr) {
struct subnet *subnet;

ia.len = 4;
memcpy(ia.iabuf, &packet->raw->giaddr, 4);
subnet = find_subnet(ia);
if (subnet)
	packet->shared_network = subnet->shared_network;
else
	packet->shared_network = NULL((void *)0);
} else {
packet->shared_network = packet->interface->shared_network;
}
if (packet->shared_network)
return 1;
return 0;
523}

525void
526add_timeout(time_t when, void (*where)(void *), void *what)
527{
struct dhcpd_timeout *t, *q;

/* See if this timeout supersedes an existing timeout. */
t = NULL((void *)0);
for (q = timeouts; q; q = q->next) {
if (q->func == where && q->what == what) {
	if (t)
		t->next = q->next;
	else
		timeouts = q->next;
	break;
}
t = q;
}

/* If we didn't supersede a timeout, allocate a timeout
  structure now. */
if (!q) {
if (free_timeouts) {
	q = free_timeouts;
	free_timeouts = q->next;
	q->func = where;
	q->what = what;
} else {
	q = malloc(sizeof (struct dhcpd_timeout));
	if (!q)
		fatalx("Can't allocate timeout structure!");
	q->func = where;
	q->what = what;
}
}

q->when = when;

/* Now sort this timeout into the timeout list. */

/* Beginning of list? */
if (!timeouts || timeouts->when > q->when) {
q->next = timeouts;
timeouts = q;
return;
}

/* Middle of list? */
for (t = timeouts; t->next; t = t->next) {
if (t->next->when > q->when) {
	q->next = t->next;
	t->next = q;
	return;
}
}

/* End of list. */
t->next = q;
q->next = NULL((void *)0);
583}

585void
586cancel_timeout(void (*where)(void *), void *what)
587{
struct dhcpd_timeout *t, *q;

/* Look for this timeout on the list, and unlink it if we find it. */
t = NULL((void *)0);
for (q = timeouts; q; q = q->next) {
if (q->func == where && q->what == what) {
	if (t)
		t->next = q->next;
	else
		timeouts = q->next;
	break;
}
t = q;
}

/* If we found the timeout, put it on the free list. */
if (q) {
q->next = free_timeouts;
free_timeouts = q;
}
608}

610/* Add a protocol to the list of protocols... */
611void
612add_protocol(char *name, int fd, void (*handler)(struct protocol *),
  void *local)
614{
struct protocol *p;

p = malloc(sizeof *p);
if (!p)
fatalx("can't allocate protocol struct for %s", name);
p->fd = fd;
p->handler = handler;
p->local = local;
p->next = protocols;
protocols = p;
625}

627void
628remove_protocol(struct protocol *proto)
629{
struct protocol *p, *next, *prev = NULL((void *)0);

for (p = protocols; p; p = next) {
next = p->next;
if (p == proto) {
	if (prev)
		prev->next = p->next;
	else
		protocols = p->next;
	free(p);
}
}
642}

644int
645get_rdomain(char *name)
646{
int rv = 0, s;
struct  ifreq ifr;

if ((s = socket(AF_INET2, SOCK_DGRAM2, 0)) == -1)
fatal("get_rdomain socket");

memset(&ifr, 0, sizeof(ifr));
strlcpy(ifr.ifr_name, name, sizeof(ifr.ifr_name));
if (ioctl(s, SIOCGIFRDOMAIN(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifreq) & 0x1fff) << 16) | ((('i')) <<
 8) | ((160))), (caddr_t)&ifr) != -1)
rv = ifr.ifr_rdomainidifr_ifru.ifru_metric;

close(s);
return rv;
660}