Project

General

Profile

Actions
Copy link

Bug #12000

closed
SW VG

Remote log server input validation allows invalid values

Bug #12000: Remote log server input validation allows invalid values

Added by Steve Wheeler over 5 years ago. Updated almost 5 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Viktor Gurov
Category:
Logging
Target version:
2.6.0
Start date:
06/06/2021
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
22.01
Release Notes:
Default
Affected Version:
All
Affected Architecture:
All

Description

When configuring remote syslog servers in status_logs_settings.php each server is entered as IP[:port]. Port 514 is assumed if no port in entered.

However the page will allow you to enter a range on invalid values there such as:

5140
514:5140
192.168.1.105140

All result in invalid syslog configs.
Some are interpreted as IP addresses resulting in sending syslog data to an unintended target. For example 514 is seen as 0.0.2.2.

Tested 21.05 and 2.5.2.b.20210604.0300

Related issues 1 (0 open — 1 closed)

Related to Regression #12245: Input validation error in system.phpResolvedViktor Gurov

Actions

VG Updated by Viktor Gurov over 5 years ago Actions
Copy link
 #1

OS interprets numeric-only value as decimal IP address:

[2.6.0-DEVELOPMENT][root@pf41.localdomain]/root: ping 10
PING 10 (0.0.0.10): 56 data bytes
[2.6.0-DEVELOPMENT][root@pf41.localdomain]/root: ping 255
PING 255 (0.0.0.255): 56 data bytes
[2.6.0-DEVELOPMENT][root@pf41.localdomain]/root: ping 256
PING 256 (0.0.1.0): 56 data bytes

`is_hostname()` improvement:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/275

JP Updated by Jim Pingle over 5 years ago Actions
Copy link
 #2

  • Status changed from New to Pull Request Review

RB Updated by Renato Botelho about 5 years ago Actions
Copy link
 #3

  • Status changed from Pull Request Review to Feedback
  • Assignee set to Viktor Gurov

PR has been merged. Thanks!

VG Updated by Viktor Gurov about 5 years ago Actions
Copy link
 #4

  • % Done changed from 0 to 100

Applied in changeset commit:c2c11dcf6dd2b71d554d2870a39373e75c70e624.

DZ Updated by Danilo Zrenjanin about 5 years ago Actions
Copy link
 #5

Tested on the:

2.6.0-DEVELOPMENT (amd64)
built on Mon Jul 26 14:27:42 EDT 2021
FreeBSD 12.2-STABLE

The validation check works only in the first input filed. If you insert a valid value in the first field and an invalid in the second and third, it will accept the settings.

Please check.

DZ Updated by Danilo Zrenjanin about 5 years ago Actions
Copy link
 #6

  • Status changed from Feedback to Resolved

It works fine. It considered my entry as FQDN (192.168.33.33333) and passed the validity check.

The ticket can be resolved.

JP Updated by Jim Pingle about 5 years ago Actions
Copy link
 #7

VG Updated by Viktor Gurov about 5 years ago Actions
Copy link
 #8

  • Status changed from Resolved to Feedback

re-test required after #12245

DZ Updated by Danilo Zrenjanin about 5 years ago Actions
Copy link
 #9

  • Status changed from Feedback to Resolved

Re-tested on the:

2.6.0-DEVELOPMENT (amd64)
built on Sat Aug 21 01:10:46 EDT 2021
FreeBSD 12.2-STABLE

Works fine.

Ticket resolved.

JP Updated by Jim Pingle about 5 years ago Actions
Copy link
 #10

  • Subject changed from Remote syslog server input validation passes invalid values to Remote log server input validation allows invalid values
  • Category changed from Web Interface to Logging

Updating subject for release notes.

JP Updated by Jim Pingle almost 5 years ago Actions
Copy link
 #11

  • Plus Target Version changed from 21.09 to 22.01
Actions
Copy link

Also available in: Atom