6 files changed, 96 insertions, 43 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index a76d2795d..e96a5d63e 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -240,9 +240,10 @@ typedef struct config_t {
         Interface interface1;
         Interface interface2;
         Interface interface3;
-        uint32_t dns1;  // up to 3 IP addresses for dns servers
-        uint32_t dns2;
-        uint32_t dns3;
+        char *dns1;     // up to 3 IP (v4/v6) addresses for dns servers
+        char *dns2;
+        char *dns3;
+        char *dns4;
 
         // seccomp
         char *seccomp_list;//  optional seccomp list on top of default filter
@@ -409,6 +410,7 @@ void net_dns_print(pid_t pid);
 void network_main(pid_t child);
 
 // network.c
+int check_ip46_address(const char *addr);
 void net_if_up(const char *ifname);
 void net_if_down(const char *ifname);
 void net_if_ip(const char *ifname, uint32_t ip, uint32_t mask, int mtu);
diff --git a/src/firejail/fs_hostname.c b/src/firejail/fs_hostname.c
index 137686572..fd823b812 100644
--- a/src/firejail/fs_hostname.c
+++ b/src/firejail/fs_hostname.c
@@ -89,7 +89,7 @@ errexit:
 }
 
 void fs_resolvconf(void) {
-        if (cfg.dns1 == 0)
+        if (cfg.dns1 == NULL)
                 return;
 
         if (arg_debug)
@@ -164,11 +164,13 @@ void fs_resolvconf(void) {
         }
 
         if (cfg.dns1)
-                fprintf(fp, "nameserver %d.%d.%d.%d\n", PRINT_IP(cfg.dns1));
+                fprintf(fp, "nameserver %s\n", cfg.dns1);
         if (cfg.dns2)
-                fprintf(fp, "nameserver %d.%d.%d.%d\n", PRINT_IP(cfg.dns2));
+                fprintf(fp, "nameserver %s\n", cfg.dns2);
         if (cfg.dns3)
-                fprintf(fp, "nameserver %d.%d.%d.%d\n", PRINT_IP(cfg.dns3));
+                fprintf(fp, "nameserver %s\n", cfg.dns3);
+        if (cfg.dns4)
+                fprintf(fp, "nameserver %s\n", cfg.dns4);
 
         // mode and owner
         SET_PERMS_STREAM(fp, 0, 0, 0644);
diff --git a/src/firejail/main.c b/src/firejail/main.c
index bc6eb8219..9cd89d42c 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -2034,18 +2034,20 @@ int main(int argc, char **argv) {
                                         fprintf(stderr, "Error: no network device configured\n");
                                         exit(1);
                                 }
-                                if (br->arg_ip_none || br->ip6sandbox) {
+                                if (br->ip6sandbox) {
                                         fprintf(stderr, "Error: cannot configure the IP address twice for the same interface\n");
                                         exit(1);
                                 }
 
                                 // configure this IP address for the last bridge defined
-                                // todo: verify ipv6 syntax
-                                br->ip6sandbox = argv[i] + 6;
-//                              if (atoip(argv[i] + 5, &br->ipsandbox)) {
-//                                      fprintf(stderr, "Error: invalid IP address\n");
-//                                      exit(1);
-//                              }
+                                if (check_ip46_address(argv[i] + 6) == 0) {
+                                        fprintf(stderr, "Error: invalid IPv6 address\n");
+                                        exit(1);
+                                }
+
+                                br->ip6sandbox = strdup(argv[i] + 6);
+                                if (br->ip6sandbox == NULL)
+                                        errExit("strdup");
                         }
                         else
                                 exit_err_feature("networking");
@@ -2064,20 +2066,24 @@ int main(int argc, char **argv) {
                 }
 #endif
                 else if (strncmp(argv[i], "--dns=", 6) == 0) {
-                        uint32_t dns;
-                        if (atoip(argv[i] + 6, &dns)) {
-                                fprintf(stderr, "Error: invalid DNS server IP address\n");
-                                return 1;
+                        if (check_ip46_address(argv[i] + 6) == 0) {
+                                fprintf(stderr, "Error: invalid DNS server IPv4 or IPv6 address\n");
+                                exit(1);
                         }
+                        char *dns = strdup(argv[i] + 6);
+                        if (!dns)
+                                errExit("strdup");
 
-                        if (cfg.dns1 == 0)
+                        if (cfg.dns1 == NULL)
                                 cfg.dns1 = dns;
-                        else if (cfg.dns2 == 0)
+                        else if (cfg.dns2 == NULL)
                                 cfg.dns2 = dns;
-                        else if (cfg.dns3 == 0)
+                        else if (cfg.dns3 == NULL)
                                 cfg.dns3 = dns;
+                        else if (cfg.dns4 == NULL)
+                                cfg.dns4 = dns;
                         else {
-                                fprintf(stderr, "Error: up to 3 DNS servers can be specified\n");
+                                fprintf(stderr, "Error: up to 4 DNS servers can be specified\n");
                                 return 1;
                         }
                 }
diff --git a/src/firejail/network.c b/src/firejail/network.c
index 80f150ea0..7b84854d3 100644
--- a/src/firejail/network.c
+++ b/src/firejail/network.c
@@ -28,6 +28,40 @@
 #include <net/route.h>
 #include <linux/if_bridge.h>
 
+// return 1 if addr is a IPv4 or IPv6 address
+int check_ip46_address(const char *addr) {
+        // check ipv4 address
+        uint32_t tmp;
+        if (atoip(addr, &tmp) == 0)
+                return 1;
+
+        // check ipv6 address
+        struct in6_addr result;
+
+        char *tmpstr = strdup(addr);
+        if (!tmpstr)
+                errExit("strdup");
+        char *ptr = strchr(tmpstr, '/');
+        if (ptr) {
+                *ptr = '\0';
+                ptr++;
+                int mask = atoi(ptr);
+                // check the network mask
+                if (mask < 0 || mask > 128) {
+                        free(tmpstr);
+                        return 0;
+                }
+        }
+        if (inet_pton(AF_INET6, tmpstr, &result) == 1) {
+                free(tmpstr);
+                return 1;
+        }
+
+        free(tmpstr);
+
+        // failed
+        return 0;
+}
 
 int net_get_mtu(const char *ifname) {
         int mtu = 0;
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 1a944beff..d0c43d13e 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -502,18 +502,20 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                                 fprintf(stderr, "Error: no network device configured\n");
                                 exit(1);
                         }
-                        if (br->arg_ip_none || br->ip6sandbox) {
+                        if (br->ip6sandbox) {
                                 fprintf(stderr, "Error: cannot configure the IP address twice for the same interface\n");
                                 exit(1);
                         }
 
                         // configure this IP address for the last bridge defined
-                        // todo: verify ipv6 syntax
-                        br->ip6sandbox = ptr + 4;
-//                      if (atoip(argv[i] + 5, &br->ipsandbox)) {
-//                              fprintf(stderr, "Error: invalid IP address\n");
-//                              exit(1);
-//                      }
+                        if (check_ip46_address(ptr + 4) == 0) {
+                                fprintf(stderr, "Error: invalid IPv6 address\n");
+                                exit(1);
+                        }
+
+                        br->ip6sandbox = strdup(ptr + 4);
+                        if (br->ip6sandbox == NULL)
+                                errExit("strdup");
 
                 }
                 else
@@ -668,20 +670,25 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 
         // dns
         if (strncmp(ptr, "dns ", 4) == 0) {
-                uint32_t dns;
-                if (atoip(ptr + 4, &dns)) {
-                        fprintf(stderr, "Error: invalid DNS server IP address\n");
-                        return 1;
+
+                if (check_ip46_address(ptr + 4) == 0) {
+                        fprintf(stderr, "Error: invalid DNS server IPv4 or IPv6 address\n");
+                        exit(1);
                 }
+                char *dns = strdup(ptr + 4);
+                if (!dns)
+                        errExit("strdup");
 
-                if (cfg.dns1 == 0)
+                if (cfg.dns1 == NULL)
                         cfg.dns1 = dns;
-                else if (cfg.dns2 == 0)
+                else if (cfg.dns2 == NULL)
                         cfg.dns2 = dns;
-                else if (cfg.dns3 == 0)
+                else if (cfg.dns3 == NULL)
                         cfg.dns3 = dns;
+                else if (cfg.dns4 == NULL)
+                        cfg.dns4 = dns;
                 else {
-                        fprintf(stderr, "Error: up to 3 DNS servers can be specified\n");
+                        fprintf(stderr, "Error: up to 4 DNS servers can be specified\n");
                         return 1;
                 }
                 return 0;
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 010bb06e0..ed0a253b3 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -652,12 +652,14 @@ int sandbox(void* sandbox_arg) {
                                 else
                                         fmessage("Default gateway %d.%d.%d.%d\n", PRINT_IP(cfg.defaultgw));
                         }
-                        if (cfg.dns1 != 0)
-                                fmessage("DNS server %d.%d.%d.%d\n", PRINT_IP(cfg.dns1));
-                        if (cfg.dns2 != 0)
-                                fmessage("DNS server %d.%d.%d.%d\n", PRINT_IP(cfg.dns2));
-                        if (cfg.dns3 != 0)
-                                fmessage("DNS server %d.%d.%d.%d\n", PRINT_IP(cfg.dns3));
+                        if (cfg.dns1 != NULL)
+                                fmessage("DNS server %s\n", cfg.dns1);
+                        if (cfg.dns2 != NULL)
+                                fmessage("DNS server %s\n", cfg.dns2);
+                        if (cfg.dns3 != NULL)
+                                fmessage("DNS server %s\n", cfg.dns3);
+                        if (cfg.dns4 != NULL)
+                                fmessage("DNS server %s\n", cfg.dns4);
                         fmessage("\n");
                 }
         }