OPENAFS-SA-2018-003 vlserver: prevent unbounded input to VL_RegisterAddrs

[openafs.git] / src / vlserver / vldbint.xg

diff --git a/src/vlserver/vldbint.xg b/src/vlserver/vldbint.xg
index faa568c..523fe80 100644 (file)
--- a/src/vlserver/vldbint.xg
+++ b/src/vlserver/vldbint.xg
@@ -1,24 +1,26 @@
 /*
  * Copyright 2000, International Business Machines Corporation and others.
  * All Rights Reserved.
- * 
+ *
  * This software has been released under the terms of the IBM Public
  * License.  For details, see the LICENSE file in the top-level source
  * directory or online at http://www.openafs.org/dl/license10.html
  */
 
 package        VL_
+prefix S
 statindex 15
 
 #include       "vl_opcodes.h"
-%#include      "vl_opcodes.h"  /* directly to other places */
+%#include      <afs/vl_opcodes.h>      /* directly to other places */
 
 %#ifdef KERNEL
-%#define       xdr_array(a,b,c,d,e,f)  xdr_arrayN(a,b,c,d,e,f)
-%#include "../afs/longc_procs.h"
+%#define       afs_xdr_array(a,b,c,d,e,f)      afs_xdr_arrayN(a,b,c,d,e,f)
 %#endif
 
 /* Current limitations on parameters that affect other packages (i.e. volume) */
+%#define VldbVersion "4"
+
 const  VLDBVERSION_4   =       4;
 const  VLDBVERSION     =       3;
 const  OVLDBVERSION    =       2;
@@ -35,7 +37,7 @@ struct VldbUpdateEntry {
        afs_int32       flags;
        afs_uint32      ReadOnlyId;
        afs_uint32      BackupId;
-       afs_int32       cloneId;
+       afs_uint32      cloneId;
        afs_int32       nModifiedRepsites;
        afs_uint32      RepsitesMask[OMAXNSERVERS];
        afs_int32       RepsitesTargetServer[OMAXNSERVERS];
@@ -63,8 +65,6 @@ const VLUPDATE_REPS_MODSERV   =       0x0400;
 const  VLUPDATE_REPS_MODPART   =       0x0800;
 const  VLUPDATE_REPS_MODFLAG   =       0x1000;
 
-const  VLSERVER_FLAG_UUID      =       0x0010;
-
 /*typedef      string volumename<VL_MAXNAMELEN>;*/
 
 const  DEFAULTBULK     =       10000;
@@ -76,7 +76,7 @@ struct VldbListByAttributes {
        afs_int32       server;
        afs_int32       partition;
        afs_int32       spares3;
-       afs_int32       volumeid;
+       afs_uint32      volumeid;
        afs_int32       flag;
 };
 
@@ -96,7 +96,7 @@ struct vldbentry   {
        afs_int32       serverPartition[OMAXNSERVERS];  /* Server Partition number */
        afs_int32       serverFlags[OMAXNSERVERS];      /* Server flags */
        afs_uint32      volumeId[MAXTYPES];             /* Corresponding volume of each type */
-       afs_int32       cloneId;                                /* Used during cloning */
+       afs_uint32      cloneId;                        /* Used during cloning */
        afs_int32       flags;                          /* General flags */
 };
 
@@ -107,7 +107,7 @@ struct nvldbentry   {
        afs_int32       serverPartition[NMAXNSERVERS];  /* Server Partition number */
        afs_int32       serverFlags[NMAXNSERVERS];      /* Server flags */
        afs_uint32      volumeId[MAXTYPES];             /* Corresponding volume of each type */
-       afs_int32       cloneId;                        /* Used during cloning */
+       afs_uint32      cloneId;                        /* Used during cloning */
        afs_int32       flags;                          /* General flags */
        afs_int32       matchindex;
        afs_int32       spares2;
@@ -140,9 +140,9 @@ struct uvldbentry   {
        afs_int32       serverPartition[NMAXNSERVERS];  /* Server Partition number */
        afs_int32       serverFlags[NMAXNSERVERS];      /* Server flags */
        afs_uint32      volumeId[MAXTYPES];             /* Corresponding volume of each type */
-       afs_int32       cloneId;                        /* Used during cloning */
+       afs_uint32      cloneId;                        /* Used during cloning */
        afs_int32       flags;                          /* General flags */
-       afs_int32       spares1;                        /* The server index we matched */
+       afs_int32       matchindex;                     /* The server index we matched */
        afs_int32       spares2;
        afs_int32       spares3;
        afs_int32       spares4;
@@ -162,7 +162,7 @@ struct vital_vlheader {
     afs_int32    eofPtr;                           /* first free byte in file */
     afs_int32    allocs;                           /* total calls to AllocBlock */
     afs_int32    frees;                            /* total calls to FreeBlock */
-    afs_int32    MaxVolumeId;              /* Global volume id holder */
+    afs_uint32   MaxVolumeId;              /* Global volume id holder */
     afs_int32    totalEntries[MAXTYPES];           /* Total entries by voltype in vldb */
 };
 
@@ -182,6 +182,14 @@ const VLOP_BACKUP      = 0x40;
 const VLOP_DELETE      = 0x80;
 const VLOP_DUMP        = 0x100;
 
+/*
+ * Additional VLOP_xxxx constants cannot be added without breaking
+ * compatibility so must reuse values. New names are added for
+ * code readability.
+ */
+%#define VLOP_ADDSITE   VLOP_DELETE
+%#define VLOP_RESTORE   VLOP_DUMP
+
 %#define VLOP_ALLOPERS ( VLOP_MOVE | VLOP_RELEASE | VLOP_BACKUP | VLOP_DELETE | VLOP_DUMP)
 
 /* defines for convenience of vl users */
@@ -193,12 +201,19 @@ const VLOP_DUMP        = 0x100;
 %#define       VLSF_ROVOL          0x02
 %#define       VLSF_RWVOL          0x04
 %#define       VLSF_BACKVOL        0x08
-%#define       VLSF_DONTUSE        0x20    /* no conflict with VLSERVER_FLAG_UUID */
+%#define       VLSF_UUID           0x10
+%#define       VLSF_DONTUSE        0x20
+%#define       VLSF_RWREPLICA      0x40    /* Volume is a RW replica */
 
 typedef        vldbentry bulkentries<>;
 typedef        nvldbentry nbulkentries<>;
 typedef        uvldbentry ubulkentries<>;
-typedef afs_uint32 bulkaddrs<>;
+/*
+ * 500 is an arbitrary implementation limit, larger than what we support storing.
+ * It lets the XDR decoder detect an attack (excessively large input) and reject
+ * it without incurring excessive resource usage.
+ */
+typedef afs_uint32 bulkaddrs<500>;
 
 struct VLCallBack {
     afs_uint32 CallBackVersion;
@@ -224,7 +239,7 @@ struct VLCallBack {
  */
 
 ProbeServer(
-) = VLPROBE;
+) multi = VLPROBE;
 
 /*
  * VL_GetEntryByName was renamed to VL_GetEntryByNameO to avoid
@@ -287,43 +302,43 @@ CreateEntry(
 ) = VLCREATEENTRY;
 
 DeleteEntry(
-  IN afs_int32 Volid,
+  IN afs_uint32 Volid,
   afs_int32 voltype
 ) = VLDELETEENTRY;
 
 GetEntryByID(
-  IN afs_int32 Volid,
+  IN afs_uint32 Volid,
   afs_int32 voltype,
   OUT vldbentry *entry
 ) = VLGETENTRYBYID;
 
 GetNewVolumeId(
-  IN afs_int32 bumpcount,
-  OUT afs_int32 *newvolumid
+  IN afs_uint32 bumpcount,
+  OUT afs_uint32 *newvolumid
 ) = VLGETNEWVOLUMEID;
 
 ReplaceEntry(
-  IN afs_int32 Volid,
+  IN afs_uint32 Volid,
   afs_int32 voltype,
   vldbentry *newentry,
   afs_int32 ReleaseType
 ) = VLREPLACEENTRY;
 
 UpdateEntry(
-  IN afs_int32 Volid,
+  IN afs_uint32 Volid,
   afs_int32 voltype,
   VldbUpdateEntry *UpdateEntry,
   afs_int32 ReleaseType
 ) = VLUPDATEENTRY;
 
 SetLock(
-  IN afs_int32 Volid,
+  IN afs_uint32 Volid,
   afs_int32 voltype,
   afs_int32 voloper
 ) = VLSETLOCK;
 
 ReleaseLock(
-  IN afs_int32 Volid,
+  IN afs_uint32 Volid,
   afs_int32 voltype,
   afs_int32 ReleaseType
 ) = VLRELEASELOCK;
@@ -361,8 +376,8 @@ GetAddrs(
 ) = VLGETADDRS;
 
 ChangeAddr(
-  IN afs_int32 ip1,
-  afs_int32 ip2
+  IN afs_uint32 ip1,
+  afs_uint32 ip2
 ) = VLCHANGEADDR;
 
 
@@ -371,13 +386,13 @@ CreateEntryN(
 ) = VLCREATEENTRYN;
 
 GetEntryByIDN(
-  IN afs_int32 Volid,
+  IN afs_uint32 Volid,
   afs_int32 voltype,
   OUT nvldbentry *entry
 ) = VLGETENTRYBYIDN;
 
 ReplaceEntryN(
-  IN afs_int32 Volid,
+  IN afs_uint32 Volid,
   afs_int32 voltype,
   nvldbentry *newentry,
   afs_int32 ReleaseType