diff --git a/ChangeLog b/ChangeLog index 35cc2e3..9bb3b51 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,6 @@ vNEXT: + Support RFC5952-style IPv6 addresses, e.g. [::]:443. + Call setgroups() before setgid() (fixes potential privilege escalation). (Lars Vogdt) diff --git a/common.c b/common.c index a297176..f35f283 100644 --- a/common.c +++ b/common.c @@ -349,21 +349,31 @@ fullname: input string -- it gets clobbered */ void resolve_name(struct addrinfo **out, char* fullname) { - char *serv, *host; + char *serv, *host, *end; int res; + /* Find port */ char *sep = strrchr(fullname, ':'); - - if (!sep) /* No separator: parameter is just a port */ - { + if (!sep) { /* No separator: parameter is just a port */ fprintf(stderr, "%s: names must be fully specified as hostname:port\n", fullname); exit(1); } - - host = fullname; serv = sep+1; *sep = 0; + host = fullname; + + /* If it is a RFC-Compliant IPv6 address ("[1234::12]:443"), remove brackets + * around IP address */ + if (host[0] == '[') { + end = strrchr(host, ']'); + if (!end) { + fprintf(stderr, "%s: no closing bracket in IPv6 address?\n", host); + } + host++; /* skip first bracket */ + *end = 0; /* remove last bracket */ + } + res = resolve_split_name(out, host, serv); if (res) { fprintf(stderr, "%s `%s'\n", gai_strerror(res), fullname);