DeforaNetworks/fwknop
3
0
Fork 0
Code Releases Activity

[server] add is_valid_file() function, default to lstat() instead of stat(), more %include_folder tests

Browse Source
This commit is contained in:
Michael Rash
2015-12-13 01:39:29 -08:00
parent b305f67ca5
commit d8dc1fcdee
6 changed files with 100 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configure.ac
+1 -1
View File
@@ -375,7 +375,7 @@ AC_FUNC_MALLOC
AC_FUNC_REALLOC
AC_FUNC_STAT
AC_CHECK_FUNCS([bzero gettimeofday memmove memset socket strchr strcspn strdup strncasecmp strndup strrchr strspn strnlen stat chmod chown strlcat strlcpy])
AC_CHECK_FUNCS([bzero gettimeofday memmove memset socket strchr strcspn strdup strncasecmp strndup strrchr strspn strnlen stat lstat chmod chown strlcat strlcpy])
dnl Decide whether or not to check for the execvpe() function
dnl
server/access.c
+2 -3
View File
@@ -1362,13 +1362,13 @@ parse_access_folder(fko_srv_options_t *opts, char *access_folder, int *depth)
acc_stanza_init(opts);
}
if((ndx = strrchr(access_folder, '/')) != NULL)
{
if (strlen(ndx) == 1)
*ndx = '\0';
}
dir_ptr = opendir(access_folder);
//grab the file names in the directory and loop through them
if (dir_ptr == NULL)
{
@@ -1376,9 +1376,8 @@ parse_access_folder(fko_srv_options_t *opts, char *access_folder, int *depth)
return EXIT_FAILURE;
}
while ((dp = readdir(dir_ptr)) != NULL) {
printf("%s", dp->d_name);
extension = (strrchr(dp->d_name, '.')); // Capture just the extension
if (extension && !strcmp(extension, ".conf"))
if (extension && !strncmp(extension, ".conf", 5))
{
if (strlen(access_folder) + 1 + strlen(dp->d_name) > MAX_PATH_LEN - 1) //Bail out rather than write past the end of include_file
{
server/config_init.c
+27 -11
View File
@@ -1200,10 +1200,25 @@ config_init(fko_srv_options_t *opts, int argc, char **argv)
#endif
break;
case 'a':
set_config_entry(opts, CONF_ACCESS_FILE, optarg);
if (is_valid_file(optarg))
set_config_entry(opts, CONF_ACCESS_FILE, optarg);
else
{
log_msg(LOG_ERR,
"[*] Invalid access.conf file path '%s'", optarg);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
break;
case ACCESS_FOLDER:
set_config_entry(opts, CONF_ACCESS_FOLDER, optarg);
if (is_valid_dir(optarg))
set_config_entry(opts, CONF_ACCESS_FOLDER, optarg);
else
{
log_msg(LOG_ERR,
"[*] Invalid access folder directory '%s' could not lstat(), does not exist, or too large?",
optarg);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
break;
case 'c':
/* This was handled earlier */
@@ -1259,26 +1274,22 @@ config_init(fko_srv_options_t *opts, int argc, char **argv)
break;
case GPG_EXE_PATH:
if (is_valid_exe(optarg))
{
set_config_entry(opts, CONF_GPG_EXE, optarg);
}
else
{
log_msg(LOG_ERR,
"[*] gpg path '%s' could not stat()/not executable?",
"[*] gpg path '%s' could not lstat()/not executable?",
optarg);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
break;
case GPG_HOME_DIR:
if (is_valid_dir(optarg))
{
set_config_entry(opts, CONF_GPG_HOME_DIR, optarg);
}
else
{
log_msg(LOG_ERR,
"[*] gpg home directory '%s' could not stat()/does not exist?",
"[*] gpg home directory '%s' could not lstat(), does not exist, or too large?",
optarg);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
@@ -1308,7 +1319,14 @@ config_init(fko_srv_options_t *opts, int argc, char **argv)
set_config_entry(opts, CONF_PCAP_FILTER, optarg);
break;
case PCAP_FILE:
set_config_entry(opts, CONF_PCAP_FILE, optarg);
if (is_valid_file(optarg))
set_config_entry(opts, CONF_PCAP_FILE, optarg);
else
{
log_msg(LOG_ERR,
"[*] Invalid pcap file path '%s'", optarg);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
break;
case ENABLE_PCAP_ANY_DIRECTION:
opts->pcap_any_direction = 1;
@@ -1327,9 +1345,7 @@ config_init(fko_srv_options_t *opts, int argc, char **argv)
break;
case SUDO_EXE_PATH:
if (is_valid_exe(optarg))
{
set_config_entry(opts, CONF_SUDO_EXE, optarg);
}
else
{
log_msg(LOG_ERR,
server/utils.c
+28 -2
View File
@@ -83,17 +83,32 @@ hex_dump(const unsigned char *data, const int size)
static int
is_valid_path(const char *path, const int file_type)
{
#if HAVE_STAT
if(strnlen(path, MAX_PATH_LEN) == MAX_PATH_LEN)
{
log_msg(LOG_ERR, "[-] Provided path is too long");
return(0);
}
#if HAVE_STAT || HAVE_LSTAT
struct stat st;
/* If we are unable to stat the given path, then return with error.
*/
#if HAVE_LSTAT /* prefer lstat() to stat() */
if(lstat(path, &st) != 0)
{
log_msg(LOG_ERR, "[-] unable to lstat() path: %s: %s",
path, strerror(errno));
return(0);
}
#else
if(stat(path, &st) != 0)
{
log_msg(LOG_ERR, "[-] unable to stat() path: %s: %s",
path, strerror(errno));
return(0);
}
#endif
if(file_type == IS_DIR)
{
@@ -105,10 +120,15 @@ is_valid_path(const char *path, const int file_type)
if(!S_ISREG(st.st_mode) || ! (st.st_mode & S_IXUSR))
return(0);
}
else if(file_type == IS_FILE)
{
if(!S_ISREG(st.st_mode))
return(0);
}
else
return(0);
#endif /* HAVE_STAT */
#endif /* HAVE_STAT || HAVE_LSTAT */
return(1);
}
@@ -125,6 +145,12 @@ is_valid_exe(const char *path)
return is_valid_path(path, IS_EXE);
}
int
is_valid_file(const char *path)
{
return is_valid_path(path, IS_FILE);
}
int
verify_file_perms_ownership(const char *file)
{
server/utils.h
+4 -2
View File
@@ -54,8 +54,9 @@
x == '#' || x == '\n' || x == '\r' || x == ';' || x == '\0' \
)
#define IS_DIR 1
#define IS_EXE 2
#define IS_DIR 1
#define IS_EXE 2
#define IS_FILE 3
/* Prototypes
*/
@@ -63,6 +64,7 @@ void hex_dump(const unsigned char *data, const int size);
char* dump_ctx(fko_ctx_t ctx);
int is_valid_dir(const char *path);
int is_valid_exe(const char *path);
int is_valid_file(const char *path);
int verify_file_perms_ownership(const char *file);
void chop_newline(char *str);
void chop_char(char *str, const char chop);
test/tests/basic_operations.pl
+38 -1
View File
@@ -638,6 +638,7 @@
'detail' => 'access.conf include_folder one stanza',
'function' => \&server_conf_files,
'fwknopd_cmdline' => "$server_rewrite_conf_files -D --exit-parse-config -v",
'exec_err' => $YES,
'server_access_file' => [
"%include_folder $access_include_dir/no-access-files",
@@ -646,11 +647,47 @@
'KEY stanza1test',
'REQUIRE_USERNAME user1',
],
'exec_err' => $YES,
'server_conf_file' => [
'### comment'
],
},
{
'category' => 'basic operations',
'subcategory' => 'server',
'detail' => 'access.conf include_folder /dev/null (1)',
'function' => \&generic_exec,
'cmdline' => "$fwknopdCmd -c $cf{'def'} --exit-parse-config --access-folder /dev/null",
'exec_err' => $YES,
'positive_output_matches' => [qr/Invalid access folder directory/],
},
{
'category' => 'basic operations',
'subcategory' => 'server',
'detail' => 'access.conf include_folder /dev/null (2)',
'function' => \&server_conf_files,
'fwknopd_cmdline' => "$server_rewrite_conf_files -D --exit-parse-config -v",
'exec_err' => $YES,
'server_access_file' => [
"%include_folder /dev/null",
'SOURCE 1.1.1.1',
'KEY stanza1test',
'REQUIRE_USERNAME user1',
],
'server_conf_file' => [
'### comment'
],
},
{
'category' => 'basic operations',
'subcategory' => 'server',
'detail' => 'access.conf include_folder long dir',
'function' => \&generic_exec,
'cmdline' => "$fwknopdCmd -c $cf{'def'} --exit-parse-config --access-folder " . 'A'x1030,
'exec_err' => $YES,
'positive_output_matches' => [qr/path is too long/],
},
{
'category' => 'basic operations',