Repository navigation
Conversation
oscap_expand_ipv6() counted one group too many when an address ended in "::", so fd19:c33d:98bc:: and "::" expanded to seven groups and the ARF failed the Asset Identification ip-v6 pattern. The parser also wrote into a fixed 40-byte buffer without bounds checks and read past the NUL when the input ended in a single ':'. Parse with inet_pton and print eight lowercase groups without leading zeros, which the pattern accepts. Input that is not an IPv6 address or carries a %zone is returned unchanged, since macOS inet_pton accepts zones and writes the interface index into link-local addresses. Signed-off-by: Josephine Pfeiffer <josie@redhat.com>
pfeifferj
requested review from
Mab879,
jan-cerny and
matusmarhefka
as code owners
October 23, 2026 11:10
No test exercised this function directly, so the "::" miscount only showed up as ARF validation failures on hosts with such an address. Pin the eight-group output for compressed, uppercase, zero-padded and IPv4-embedded input, including one longer than the old 40-byte buffer, and the pass-through of zoned and malformed strings. Global addresses come from the documentation ranges in RFC 3849 and RFC 5737. Signed-off-by: Josephine Pfeiffer <josie@redhat.com>
pfeifferj
force-pushed
the
fix_expand_ipv6
branch
from
October 23, 2026 11:21
433e0ae to
b190571
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
oscap_expand_ipv6() counts one group too many when an address ends in "::", so a host with e.g. fd19:c33d:98bc:: (whonix's ipv6 setup puts that on its libvirt bridge) writes ARF that fails the asset identification ip-v6 pattern.
the parser also writes into a fixed 40-byte buffer without bounds checks and reads past the NUL when the input ends in a single ':'. both callers get target-address strings, which can come from input documents
this swaps it for inet_pton and prints eight lowercase groups. anything that isn't an IPv6 address, or has a %zone, comes back unchanged. the '%' check is there because macos inet_pton drops the zone and writes the interface index into link-local addresses, while glibc rejects it
on open question I have: zoned addresses still fail the ip-v6 pattern, same as before. afaict from wine's conformance tests, WSAAddressToStringW appends %scope on windows. stripping the zone before parsing would fix that but also drops it from xccdf:target-address. i can do that here or in a follow-up if you'd rather have it that way