Do you plan adding LZ4(much faster than gzip) support to stunnel?
2
1
dereferences in 4.54
Reply-To:
In-Reply-To: <mailman.1.1359889202.25775.stunnel-users(a)stunnel.org>
On Sun, Feb 03, 2013 at 12:00:02PM +0100, stunnel-users-request(a)stunnel.org wrote:
> > - char line_text[CONFLINELEN], *errstr;
> > + char line_text[CONFLINELEN], *errstr = NULL;
> Were you able to identify a case where it's used without
> initialization? This is interesting.
> It would be a good idea to fix it there instead of implementing a
> workaround here.
Hi,
I will provide the output of coverity run for these defect:
int parse_conf(char *name, CONF_TYPE type) {
1997 DISK_FILE *df;
At (1): Declaring variable "errstr" without initializer.
1998 char line_text[CONFLINELEN], *errstr;
1999 char config_line[CONFLINELEN], *config_opt, *config_arg;
2000 int line_number, i;
2001 SERVICE_OPTIONS *section, *new_section;
2002 static char *filename=NULL; /* a copy of config file name for reloading */
2003#ifndef USE_WIN32
2004 int fd;
2005 char *tmpstr;
2006#endif
2007
At (2): Condition "name", taking true branch
2008 if(name) /* not reload */
2009 filename=str_dup(name);
2010
At (3): Condition "type == 2U", taking true branch
2011 s_log(LOG_NOTICE, "Reading configuration from %s %s",
2012 type==CONF_FD ? "descriptor" : "file", filename);
2013#ifndef USE_WIN32
At (4): Condition "type == 2U", taking true branch
2014 if(type==CONF_FD) { /* file descriptor */
2015 fd=strtol(filename, &tmpstr, 10);
At (5): Condition "tmpstr == filename", taking false branch
At (6): Condition "*tmpstr", taking false branch
2016 if(tmpstr==filename || *tmpstr) { /* not a number */
2017 s_log(LOG_ERR, "Invalid file descriptor number");
2018 print_syntax();
2019 return 1;
2020 }
2021 df=file_fdopen(fd);
At (7): Falling through to end of if statement
2022 } else
2023#endif
2024 df=file_open(filename, 0);
At (8): Condition "!df", taking false branch
2025 if(!df) {
2026 s_log(LOG_ERR, "Cannot read configuration");
2027 if(type!=CONF_RELOAD)
2028 print_syntax();
2029 return 1;
2030 }
2031
2032 memset(&new_global_options, 0, sizeof(GLOBAL_OPTIONS)); /* reset global options */
2033 memset(&new_service_options, 0, sizeof(SERVICE_OPTIONS)); /* reset local options */
2034 new_service_options.next=NULL;
2035 section=&new_service_options;
2036 parse_global_option(CMD_BEGIN, NULL, NULL);
2037 parse_service_option(CMD_BEGIN, section, NULL, NULL);
At (9): Condition "type != 0U", taking true branch
2038 if(type!=CONF_RELOAD) { /* provide defaults for gui.c */
2039 memcpy(&global_options, &new_global_options, sizeof(GLOBAL_OPTIONS));
2040 memcpy(&service_options, &new_service_options, sizeof(SERVICE_OPTIONS));
2041 }
2042
2043 line_number=0;
At (10): Condition "file_getline(df, line_text, 16384) >= 0", taking true branch
At (19): Condition "file_getline(df, line_text, 16384) >= 0", taking false branch
2044 while(file_getline(df, line_text, CONFLINELEN)>=0) {
2045 memcpy(config_line, line_text, CONFLINELEN);
2046 ++line_number;
2047 config_opt=config_line;
At (11): Condition "__istype((unsigned char)*config_opt, 16384UL)", taking true branch
At (12): Condition "__istype((unsigned char)*config_opt, 16384UL)", taking false branch
2048 while(isspace((unsigned char)*config_opt))
2049 ++config_opt; /* remove initial whitespaces */
At (13): Condition "i >= 0", taking true branch
At (14): Condition "__istype((unsigned char)config_opt[i], 16384UL)", taking true branch
At (15): Condition "i >= 0", taking true branch
At (16): Condition "__istype((unsigned char)config_opt[i], 16384UL)", taking false branch
2050 for(i=strlen(config_opt)-1; i>=0 && isspace((unsigned char)config_opt[i]); --i)
2051 config_opt[i]='\0'; /* remove trailing whitespaces */
At (17): Condition "config_opt[0] == 0", taking true branch
2052 if(config_opt[0]=='\0' || config_opt[0]=='#' || config_opt[0]==';') /* empty or comment */
At (18): Continuing loop
2053 continue;
2054 if(config_opt[0]=='[' && config_opt[strlen(config_opt)-1]==']') { /* new section */
2055 if(!new_service_options.next) {
2056 errstr=parse_global_option(CMD_END, NULL, NULL);
2057 if(errstr) {
2058 s_log(LOG_ERR, "Line %d: \"%s\": %s", line_number, line_text, errstr);
2059 file_close(df);
2060 return 1;
2061 }
2062 }
2063 ++config_opt;
2064 config_opt[strlen(config_opt)-1]='\0';
2065 new_section=str_alloc(sizeof(SERVICE_OPTIONS));
2066 memcpy(new_section, &new_service_options, sizeof(SERVICE_OPTIONS));
2067 new_section->servname=str_dup(config_opt);
2068 new_section->session=NULL;
2069 new_section->next=NULL;
2070 section->next=new_section;
2071 section=new_section;
2072 continue;
2073 }
2074 config_arg=strchr(config_line, '=');
2075 if(!config_arg) {
2076 s_log(LOG_ERR, "Line %d: \"%s\": No '=' found", line_number, line_text);
2077 file_close(df);
2078 return 1;
2079 }
2080 *config_arg++='\0'; /* split into option name and argument value */
2081 for(i=strlen(config_opt)-1; i>=0 && isspace((unsigned char)config_opt[i]); --i)
2082 config_opt[i]='\0'; /* remove trailing whitespaces */
2083 while(isspace((unsigned char)*config_arg))
2084 ++config_arg; /* remove initial whitespaces */
2085 errstr=parse_service_option(CMD_EXEC, section, config_opt, config_arg);
2086 if(!new_service_options.next && errstr==option_not_found)
2087 errstr=parse_global_option(CMD_EXEC, config_opt, config_arg);
2088 if(errstr) {
2089 s_log(LOG_ERR, "Line %d: \"%s\": %s", line_number, line_text, errstr);
2090 file_close(df);
2091 return 1;
2092 }
2093 }
2094 file_close(df);
2095
At (20): Condition "new_service_options.next", taking true branch
2096 if(new_service_options.next) { /* daemon mode: initialize sections */
At (21): Condition "section", taking false branch
2097 for(section=new_service_options.next; section; section=section->next) {
2098 s_log(LOG_INFO, "Initializing service [%s]", section->servname);
2099 errstr=parse_service_option(CMD_END, section, NULL, NULL);
2100 if(errstr)
2101 break;
2102 }
At (22): Falling through to end of if statement
2103 } else { /* inetd mode: need to initialize global options */
2104 errstr=parse_global_option(CMD_END, NULL, NULL);
2105 if(errstr) {
2106 s_log(LOG_ERR, "Global options: %s", errstr);
2107 return 1;
2108 }
2109 s_log(LOG_INFO, "Initializing inetd mode configuration");
2110 section=&new_service_options;
2111 errstr=parse_service_option(CMD_END, section, NULL, NULL);
2112 }
CID 32706: Uninitialized pointer read (UNINIT)At (23): Using uninitialized value "errstr".
2113 if(errstr) {
CID 32693: Dereference after null check (FORWARD_NULL) [select defect]
2114 s_log(LOG_ERR, "Service [%s]: %s", section->servname, errstr);
2115 return 1;
2116 }
> > - s_log(LOG_ERR, "Service [%s]: %s", section->servname, errstr);
> > + s_log(LOG_ERR, "Service [%s]: %s", section ? section->servname : "",
> > + errstr);
> Again it would be useful to fix the root cause instead of implementing a
> workaround.
Coverity output:
At (1): Condition "name", taking true branch
2008 if(name) /* not reload */
2009 filename=str_dup(name);
2010
At (2): Condition "type == 2U", taking true branch
2011 s_log(LOG_NOTICE, "Reading configuration from %s %s",
2012 type==CONF_FD ? "descriptor" : "file", filename);
2013#ifndef USE_WIN32
At (3): Condition "type == 2U", taking true branch
2014 if(type==CONF_FD) { /* file descriptor */
2015 fd=strtol(filename, &tmpstr, 10);
At (4): Condition "tmpstr == filename", taking false branch
At (5): Condition "*tmpstr", taking false branch
2016 if(tmpstr==filename || *tmpstr) { /* not a number */
2017 s_log(LOG_ERR, "Invalid file descriptor number");
2018 print_syntax();
2019 return 1;
2020 }
2021 df=file_fdopen(fd);
At (6): Falling through to end of if statement
2022 } else
2023#endif
2024 df=file_open(filename, 0);
At (7): Condition "!df", taking false branch
2025 if(!df) {
2026 s_log(LOG_ERR, "Cannot read configuration");
2027 if(type!=CONF_RELOAD)
2028 print_syntax();
2029 return 1;
2030 }
2031
2032 memset(&new_global_options, 0, sizeof(GLOBAL_OPTIONS)); /* reset global options */
2033 memset(&new_service_options, 0, sizeof(SERVICE_OPTIONS)); /* reset local options */
2034 new_service_options.next=NULL;
2035 section=&new_service_options;
2036 parse_global_option(CMD_BEGIN, NULL, NULL);
2037 parse_service_option(CMD_BEGIN, section, NULL, NULL);
At (8): Condition "type != 0U", taking true branch
2038 if(type!=CONF_RELOAD) { /* provide defaults for gui.c */
2039 memcpy(&global_options, &new_global_options, sizeof(GLOBAL_OPTIONS));
2040 memcpy(&service_options, &new_service_options, sizeof(SERVICE_OPTIONS));
2041 }
2042
2043 line_number=0;
At (9): Condition "file_getline(df, line_text, 16384) >= 0", taking true branch
At (18): Condition "file_getline(df, line_text, 16384) >= 0", taking false branch
2044 while(file_getline(df, line_text, CONFLINELEN)>=0) {
2045 memcpy(config_line, line_text, CONFLINELEN);
2046 ++line_number;
2047 config_opt=config_line;
At (10): Condition "__istype((unsigned char)*config_opt, 16384UL)", taking true branch
At (11): Condition "__istype((unsigned char)*config_opt, 16384UL)", taking false branch
2048 while(isspace((unsigned char)*config_opt))
2049 ++config_opt; /* remove initial whitespaces */
At (12): Condition "i >= 0", taking true branch
At (13): Condition "__istype((unsigned char)config_opt[i], 16384UL)", taking true branch
At (14): Condition "i >= 0", taking true branch
At (15): Condition "__istype((unsigned char)config_opt[i], 16384UL)", taking false branch
2050 for(i=strlen(config_opt)-1; i>=0 && isspace((unsigned char)config_opt[i]); --i)
2051 config_opt[i]='\0'; /* remove trailing whitespaces */
At (16): Condition "config_opt[0] == 0", taking true branch
2052 if(config_opt[0]=='\0' || config_opt[0]=='#' || config_opt[0]==';') /* empty or comment */
At (17): Continuing loop
2053 continue;
2054 if(config_opt[0]=='[' && config_opt[strlen(config_opt)-1]==']') { /* new section */
2055 if(!new_service_options.next) {
2056 errstr=parse_global_option(CMD_END, NULL, NULL);
2057 if(errstr) {
2058 s_log(LOG_ERR, "Line %d: \"%s\": %s", line_number, line_text, errstr);
2059 file_close(df);
2060 return 1;
2061 }
2062 }
2063 ++config_opt;
2064 config_opt[strlen(config_opt)-1]='\0';
2065 new_section=str_alloc(sizeof(SERVICE_OPTIONS));
2066 memcpy(new_section, &new_service_options, sizeof(SERVICE_OPTIONS));
2067 new_section->servname=str_dup(config_opt);
2068 new_section->session=NULL;
2069 new_section->next=NULL;
2070 section->next=new_section;
2071 section=new_section;
2072 continue;
2073 }
2074 config_arg=strchr(config_line, '=');
2075 if(!config_arg) {
2076 s_log(LOG_ERR, "Line %d: \"%s\": No '=' found", line_number, line_text);
2077 file_close(df);
2078 return 1;
2079 }
2080 *config_arg++='\0'; /* split into option name and argument value */
2081 for(i=strlen(config_opt)-1; i>=0 && isspace((unsigned char)config_opt[i]); --i)
2082 config_opt[i]='\0'; /* remove trailing whitespaces */
2083 while(isspace((unsigned char)*config_arg))
2084 ++config_arg; /* remove initial whitespaces */
2085 errstr=parse_service_option(CMD_EXEC, section, config_opt, config_arg);
2086 if(!new_service_options.next && errstr==option_not_found)
2087 errstr=parse_global_option(CMD_EXEC, config_opt, config_arg);
2088 if(errstr) {
2089 s_log(LOG_ERR, "Line %d: \"%s\": %s", line_number, line_text, errstr);
2090 file_close(df);
2091 return 1;
2092 }
2093 }
2094 file_close(df);
2095
At (19): Condition "new_service_options.next", taking true branch
2096 if(new_service_options.next) { /* daemon mode: initialize sections */
At (20): Comparing "section" to null implies that "section" might be null.
At (21): Condition "section", taking false branch
2097 for(section=new_service_options.next; section; section=section->next) {
2098 s_log(LOG_INFO, "Initializing service [%s]", section->servname);
2099 errstr=parse_service_option(CMD_END, section, NULL, NULL);
2100 if(errstr)
2101 break;
2102 }
At (22): Falling through to end of if statement
2103 } else { /* inetd mode: need to initialize global options */
2104 errstr=parse_global_option(CMD_END, NULL, NULL);
2105 if(errstr) {
2106 s_log(LOG_ERR, "Global options: %s", errstr);
2107 return 1;
2108 }
2109 s_log(LOG_INFO, "Initializing inetd mode configuration");
2110 section=&new_service_options;
2111 errstr=parse_service_option(CMD_END, section, NULL, NULL);
2112 }
CID 32706: Uninitialized pointer read (UNINIT) [select defect]
At (23): Condition "errstr", taking true branch
2113 if(errstr) {
CID 32693: Dereference after null check (FORWARD_NULL)At (24): Dereferencing null pointer "section".
2114 s_log(LOG_ERR, "Service [%s]: %s", section->servname, errstr);
2115 return 1;
2116 }
> > - if(!strcasecmp(fl->name, string)) {
> > + if(string && !strcasecmp(fl->name, string)) {
> Could you give an example parameter where "string" may be NULL here?
2238/* facilities only make sense on Unix */
2239#if !defined (USE_WIN32) && !defined (__vms)
At (1): Condition "strchr(string, 46)", taking true branch
2240 if(strchr(string, '.')) { /* we have a facility specified */
2241 new_global_options.facility=-1;
2242 string=strtok(arg_copy, "."); /* break it up */
2243
At (2): Condition "fl->name", taking true branch
2244 for(fl=facilities; fl->name; ++fl) {
At (3): Condition "!strcasecmp(fl->name, string)", taking true branch
2245 if(!strcasecmp(fl->name, string)) {
2246 new_global_options.facility=fl->value;
At (4): Breaking from loop
2247 break;
2248 }
2249 }
At (5): Condition "new_global_options.facility == -1", taking false branch
2250 if(new_global_options.facility==-1)
2251 return 1; /* FAILED */
2252 string=strtok(NULL, "."); /* set to the remainder */
2253 }
2254#endif /* USE_WIN32, __vms */
2255
2256 /* time to check the syslog level */
At (6): Comparing "string" to null implies that "string" might be null.
At (7): Condition "string", taking false branch
2257 if(string && strlen(string)==1 && *string>='0' && *string<='7') {
2258 new_global_options.debug_level=*string-'0';
2259 return 0; /* OK */
2260 }
2261 new_global_options.debug_level=8; /* illegal level */
At (8): Condition "fl->name", taking true branch
2262 for(fl=levels; fl->name; ++fl) {
CID 11183: Dereference after null check (FORWARD_NULL)At (9): Passing null pointer "string" to function "strcasecmp(char const *, char const *)", which dereferences it.
2263 if(!strcasecmp(fl->name, string)) {
2264 new_global_options.debug_level=fl->value;
2265 break;
2266 }
2267 }
2268 if(new_global_options.debug_level==8)
2269 return 1; /* FAILED */
2270 return 0; /* OK */
2271}
Let me know if more info is required.
Thanks
5
16
Hi,
I am trying to figure out where bug reports should be submitted.
https://www.stunnel.org/lists.html references this mailing list, so here
is my attempt at a bug report with a potential fix. If this is not an
appropriate list, please redirect me.
A coverity run has uncovered quite a few memory and other resource
leaks, plus some potential NULL dereferences. Inline is an attempt to
fix them. Imho, these are mostly self-explanatory, but if someone needs
more details, I would be happy to provide those as well.
Thanks
diff -ru stunnel-4.54/src/options.c stunnel-4.54.p/src/options.c
--- stunnel-4.54/src/options.c 2012-10-09 01:50:54.000000000 -0700
+++ stunnel-4.54.p/src/options.c 2013-01-29 16:26:00.000000000 -0800
@@ -1988,7 +1988,7 @@
int parse_conf(char *name, CONF_TYPE type) {
DISK_FILE *df;
- char line_text[CONFLINELEN], *errstr;
+ char line_text[CONFLINELEN], *errstr = NULL;
char config_line[CONFLINELEN], *config_opt, *config_arg;
int line_number, i;
SERVICE_OPTIONS *section, *new_section;
@@ -2104,7 +2104,8 @@
errstr=parse_service_option(CMD_END, section, NULL, NULL);
}
if(errstr) {
- s_log(LOG_ERR, "Service [%s]: %s", section->servname, errstr);
+ s_log(LOG_ERR, "Service [%s]: %s", section ? section->servname : "",
+ errstr);
return 1;
}
@@ -2253,7 +2254,7 @@
}
new_global_options.debug_level=8; /* illegal level */
for(fl=levels; fl->name; ++fl) {
- if(!strcasecmp(fl->name, string)) {
+ if(string && !strcasecmp(fl->name, string)) {
new_global_options.debug_level=fl->value;
break;
}
@@ -2428,6 +2429,7 @@
if(get_last_socket_error()!=S_ENOPROTOOPT) {
s_log(LOG_ERR, "Failed to get %s OS default", ptr->opt_str);
sockerror("getsockopt");
+ close(fd);
return 1; /* FAILED */
}
td=str_dup("write-only");
@@ -2442,6 +2444,7 @@
ptr->opt_str, ta, tl, tr, td);
str_free(ta); str_free(tl); str_free(tr); str_free(td);
}
+ close(fd);
return 0; /* OK */
}
Only in stunnel-4.54.p/src: options.c.orig
diff -ru stunnel-4.54/src/protocol.c stunnel-4.54.p/src/protocol.c
--- stunnel-4.54/src/protocol.c 2012-10-09 01:46:47.000000000 -0700
+++ stunnel-4.54.p/src/protocol.c 2013-01-29 16:26:00.000000000 -0800
@@ -244,30 +244,36 @@
/**************************************** smtp */
static void smtp_client(CLI *c) {
- char *line;
+ char *line = NULL;
do { /* copy multiline greeting */
+ str_free(line); /* okay to str_free(NULL) */
line=fd_getline(c, c->remote_fd.fd);
fd_putline(c, c->local_wfd.fd, line);
} while(isprefix(line, "220-"));
fd_putline(c, c->remote_fd.fd, "EHLO localhost");
do { /* skip multiline reply */
+ str_free(line);
line=fd_getline(c, c->remote_fd.fd);
} while(isprefix(line, "250-"));
if(!isprefix(line, "250 ")) { /* error */
+ str_free(line);
s_log(LOG_ERR, "Remote server is not RFC 1425 compliant");
longjmp(c->err, 1);
}
fd_putline(c, c->remote_fd.fd, "STARTTLS");
do { /* skip multiline reply */
+ str_free(line);
line=fd_getline(c, c->remote_fd.fd);
} while(isprefix(line, "220-"));
if(!isprefix(line, "220 ")) { /* error */
+ str_free(line);
s_log(LOG_ERR, "Remote server is not RFC 2487 compliant");
longjmp(c->err, 1);
}
+ str_free(line);
}
static void smtp_server(CLI *c) {
@@ -290,21 +296,27 @@
line=fd_getline(c, c->remote_fd.fd);
if(!isprefix(line, "220")) {
s_log(LOG_ERR, "Unknown server welcome");
+ str_free(line);
longjmp(c->err, 1);
}
fd_printf(c, c->local_wfd.fd, "%s + stunnel", line);
+ str_free(line);
line=fd_getline(c, c->local_rfd.fd);
if(!isprefix(line, "EHLO ")) {
s_log(LOG_ERR, "Unknown client EHLO");
+ str_free(line);
longjmp(c->err, 1);
}
fd_printf(c, c->local_wfd.fd, "250-%s Welcome", line);
+ str_free(line);
fd_putline(c, c->local_wfd.fd, "250 STARTTLS");
line=fd_getline(c, c->local_rfd.fd);
if(!isprefix(line, "STARTTLS")) {
s_log(LOG_ERR, "STARTTLS expected");
+ str_free(line);
longjmp(c->err, 1);
}
+ str_free(line);
fd_putline(c, c->local_wfd.fd, "220 Go ahead");
}
@@ -316,15 +328,19 @@
line=fd_getline(c, c->remote_fd.fd);
if(!isprefix(line, "+OK ")) {
s_log(LOG_ERR, "Unknown server welcome");
+ str_free(line);
longjmp(c->err, 1);
}
fd_putline(c, c->local_wfd.fd, line);
+ str_free(line);
fd_putline(c, c->remote_fd.fd, "STLS");
line=fd_getline(c, c->remote_fd.fd);
if(!isprefix(line, "+OK ")) {
s_log(LOG_ERR, "Server does not support TLS");
+ str_free(line);
longjmp(c->err, 1);
}
+ str_free(line);
}
static void pop3_server(CLI *c) {
@@ -332,17 +348,21 @@
line=fd_getline(c, c->remote_fd.fd);
fd_printf(c, c->local_wfd.fd, "%s + stunnel", line);
+ str_free(line);
line=fd_getline(c, c->local_rfd.fd);
if(isprefix(line, "CAPA")) { /* client wants RFC 2449 extensions */
fd_putline(c, c->local_wfd.fd, "+OK Stunnel capability list follows");
fd_putline(c, c->local_wfd.fd, "STLS");
fd_putline(c, c->local_wfd.fd, ".");
+ str_free(line);
line=fd_getline(c, c->local_rfd.fd);
}
if(!isprefix(line, "STLS")) {
+ str_free(line);
s_log(LOG_ERR, "Client does not want TLS");
longjmp(c->err, 1);
}
+ str_free(line);
fd_putline(c, c->local_wfd.fd, "+OK Stunnel starts TLS negotiation");
}
@@ -353,18 +373,22 @@
line=fd_getline(c, c->remote_fd.fd);
if(!isprefix(line, "* OK")) {
+ str_free(line);
s_log(LOG_ERR, "Unknown server welcome");
longjmp(c->err, 1);
}
fd_putline(c, c->local_wfd.fd, line);
+ str_free(line);
fd_putline(c, c->remote_fd.fd, "stunnel STARTTLS");
line=fd_getline(c, c->remote_fd.fd);
if(!isprefix(line, "stunnel OK")) {
+ str_free(line);
fd_putline(c, c->local_wfd.fd,
"* BYE stunnel: Server does not support TLS");
s_log(LOG_ERR, "Server does not support TLS");
longjmp(c->err, 2); /* don't reset */
}
+ str_free(line);
}
static void imap_server(CLI *c) {
@@ -387,6 +411,7 @@
/* process server welcome and send it to client */
line=fd_getline(c, c->remote_fd.fd);
if(!isprefix(line, "* OK")) {
+ str_free(line);
s_log(LOG_ERR, "Unknown server welcome");
longjmp(c->err, 1);
}
@@ -396,22 +421,29 @@
if(capa)
*capa='K'; /* disable CAPABILITY within greeting */
fd_printf(c, c->local_wfd.fd, "%s (stunnel)", line);
+ str_free(line);
while(1) { /* process client commands */
line=fd_getline(c, c->local_rfd.fd);
/* split line into id and tail */
id=str_dup(line);
tail=strchr(id, ' ');
- if(!tail)
+ if(!tail) {
+ str_free(line);
+ str_free(id);
break;
+ }
*tail++='\0';
if(isprefix(tail, "STARTTLS")) {
fd_printf(c, c->local_wfd.fd,
"%s OK Begin TLS negotiation now", id);
+ str_free(line);
+ str_free(id);
return; /* success */
} else if(isprefix(tail, "CAPABILITY")) {
fd_putline(c, c->remote_fd.fd, line); /* send it to server */
+ str_free(line);
line=fd_getline(c, c->remote_fd.fd); /* get the capabilites */
if(*line=='*') {
/*
@@ -421,6 +453,7 @@
* LOGIN would fail as "unexpected command", anyway
*/
fd_printf(c, c->local_wfd.fd, "%s STARTTLS", line);
+ str_free(line);
line=fd_getline(c, c->remote_fd.fd); /* next line */
}
fd_putline(c, c->local_wfd.fd, line); /* forward to the client */
@@ -429,24 +462,35 @@
fd_putline(c, c->local_wfd.fd,
"* BYE unexpected server response");
s_log(LOG_ERR, "Unexpected server response: %s", line);
+ str_free(line);
+ str_free(id);
break;
}
+ str_free(line);
+ str_free(id);
} else if(isprefix(tail, "LOGOUT")) {
fd_putline(c, c->local_wfd.fd, "* BYE server terminating");
fd_printf(c, c->local_wfd.fd, "%s OK LOGOUT completed", id);
+ str_free(id);
+ str_free(line);
break;
} else {
fd_putline(c, c->local_wfd.fd, "* BYE stunnel: unexpected command");
fd_printf(c, c->local_wfd.fd, "%s BAD %s unexpected", id, tail);
s_log(LOG_ERR, "Unexpected client command %s", tail);
+ str_free(line);
+ str_free(id);
break;
}
}
/* clean server shutdown */
fd_putline(c, c->remote_fd.fd, "stunnel LOGOUT");
line=fd_getline(c, c->remote_fd.fd);
- if(*line=='*')
+ if(*line=='*') {
+ str_free(line);
line=fd_getline(c, c->remote_fd.fd);
+ }
+ str_free(line);
longjmp(c->err, 2); /* don't reset */
}
@@ -458,15 +502,19 @@
line=fd_getline(c, c->remote_fd.fd);
if(!isprefix(line, "200 ") && !isprefix(line, "201 ")) {
s_log(LOG_ERR, "Unknown server welcome");
+ str_free(line);
longjmp(c->err, 1);
}
fd_putline(c, c->local_wfd.fd, line);
fd_putline(c, c->remote_fd.fd, "STARTTLS");
+ str_free(line);
line=fd_getline(c, c->remote_fd.fd);
if(!isprefix(line, "382 ")) {
s_log(LOG_ERR, "Server does not support TLS");
+ str_free(line);
longjmp(c->err, 1);
}
+ str_free(line);
}
/**************************************** connect */
@@ -548,13 +596,17 @@
/* not "HTTP/1.0 200 Connection established" */
s_log(LOG_ERR, "CONNECT request rejected");
do { /* read all headers */
+ str_free(line);
line=fd_getline(c, c->remote_fd.fd);
} while(*line);
+ str_free(line);
longjmp(c->err, 1);
}
+ str_free(line);
s_log(LOG_INFO, "CONNECT request accepted");
do {
line=fd_getline(c, c->remote_fd.fd); /* read all headers */
+ str_free(line);
} while(*line);
}
@@ -588,10 +640,13 @@
if(line[9]!='4' || line[10]!='0' || line[11]!='7') { /* code 407 */
s_log(LOG_ERR, "NTLM authorization request rejected");
do { /* read all headers */
+ str_free(line);
line=fd_getline(c, c->remote_fd.fd);
} while(*line);
+ str_free(line);
longjmp(c->err, 1);
}
+ str_free(line);
ntlm2_txt=NULL;
do { /* read all headers */
line=fd_getline(c, c->remote_fd.fd);
@@ -599,6 +654,7 @@
ntlm2_txt=str_dup(line+25);
else if(isprefix(line, "Content-Length: "))
content_length=atol(line+16);
+ str_free(line);
} while(*line);
if(!ntlm2_txt) { /* no Proxy-Authenticate: NTLM header */
s_log(LOG_ERR, "Proxy-Authenticate: NTLM header not found");
Only in stunnel-4.54.p/src: protocol.c.orig
diff -ru stunnel-4.54/src/stunnel.c stunnel-4.54.p/src/stunnel.c
--- stunnel-4.54/src/stunnel.c 2012-08-18 14:11:53.000000000 -0700
+++ stunnel-4.54.p/src/stunnel.c 2013-01-29 16:26:00.000000000 -0800
@@ -119,12 +119,16 @@
fatal("Could not open /dev/null");
#endif /* standard Unix */
main_initialize();
- if(main_configure(argc>1 ? argv[1] : NULL, argc>2 ? argv[2] : NULL))
+ if(main_configure(argc>1 ? argv[1] : NULL, argc>2 ? argv[2] : NULL)) {
+ close(fd);
return 1;
+ }
if(service_options.next) { /* there are service sections -> daemon mode */
#if !defined(__vms) && !defined(USE_OS2)
- if(daemonize(fd))
+ if(daemonize(fd)) {
+ close(fd);
return 1;
+ }
close(fd);
/* create_pid() must be called after drop_privileges()
* or it won't be possible to remove the file on exit */
Only in stunnel-4.54.p/src: stunnel.c.orig
3
4
Hello,
We're looking for a way to add some kind of cross-control between an
application and the TLS tunnelling tool that protects the data. I'll give
an example, that may be easier to understand.
My BigDatabase has it's login/password authentication process. Since my
customers want to access the database through bad Internet, we set up a
SSL/TLS frontend. Each customer has his own X509 certificate, with all
proper bells and jingles in it. The frontend checks the certificate (CA
sig, validity, revocation, etc.) and then, as it should, passes the
unencrypted flow to the application.
There is no way (or, rather, we have not found any way) to cross-check
that the certificate AND the requested, application-level login, are
linked together. This means that my evil neighbour, which bribed my
gullible cat to get my login and password, could connect to my account
(app-level auth) using his X509 cert (TLS tunnel auth).
We would like to perform this cross-check between X509 certificate AND
application-level auth.
>From our point of view, this means that we need to "extract and send" some
parts of the certificate (DN, validity dates, etc.) to some secondary
tool/proxy. This one will check if the data is coherent wrt application
credentials.
M. Henrik Riomar sent a patch
(http://www.stunnel.org/pipermail/stunnel-users/2012-October/003909.html)
on the list last october that is one step closer to what we are looking
for. We could build from it.
Maybe some of you have already solved this kind of problem, or know of a
tool that answer to this kind of needs ?
Tia,
--
Pierre-Yves Bonnetain-Nesterenko
B&A Consultants - Sécurité informatique - www.ba-consultants.fr
Tel. : +33 (0) 563 277 241 - Fax : +33 (0) 567 737 829
2
5
Hello,
a client setup such as this:
client = yes
foreground = yes
connect = example.com:80
exec = cat
execargs = cat
causes stunnel-4.54 to fail with error:
Service [stunnel]: Inetd mode must define one endpoint
The attached patch fixes the problem for me. Dunno if the endpoint check
is too lax for other cases then, though.
--
Thanks,
Micha
2
1