From 11f43f144a2e0681a25579bcc108f6671fd8b056 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 12 Feb 2015 12:01:34 +0100 Subject: [PATCH] eliminated auth message upper limit --- src/auth/gssapi.c | 10 +++++++--- src/auth/pam.c | 14 +++++++------- src/auth/plain.c | 4 ++-- src/auth/radius.c | 4 ++-- src/sec-mod-auth.c | 10 ++++++++-- src/sec-mod-auth.h | 2 +- src/sec-mod-db.c | 1 + src/sec-mod.h | 2 +- src/vpn.h | 1 - src/worker-auth.c | 32 +++++++++++++++++++------------- 10 files changed, 48 insertions(+), 32 deletions(-) diff --git a/src/auth/gssapi.c b/src/auth/gssapi.c index b5479b77..334412c0 100644 --- a/src/auth/gssapi.c +++ b/src/auth/gssapi.c @@ -226,18 +226,22 @@ static int gssapi_auth_pass(void *ctx, const char *spnego, unsigned spnego_len) } } -static int gssapi_auth_msg(void *ctx, char *msg, size_t msg_size) +static int gssapi_auth_msg(void *ctx, void *pool, char **msg) { struct gssapi_ctx_st *pctx = ctx; OM_uint32 min; + unsigned length; /* our msg is our SPNEGO reply */ if (pctx->msg.value != NULL) { - base64_encode((char *)pctx->msg.value, pctx->msg.length, (char *)msg, msg_size); + length = BASE64_LENGTH(pctx->msg.length)+1; + *msg = talloc_size(pool, length); + + base64_encode((char *)pctx->msg.value, pctx->msg.length, *msg, length); gss_release_buffer(&min, &pctx->msg); pctx->msg.value = NULL; } else { - msg[0] = 0; + *msg = NULL; } return 0; } diff --git a/src/auth/pam.c b/src/auth/pam.c index c5aee89a..f563b37f 100644 --- a/src/auth/pam.c +++ b/src/auth/pam.c @@ -200,10 +200,9 @@ fail1: return -1; } -static int pam_auth_msg(void* ctx, char* msg, size_t msg_size) +static int pam_auth_msg(void* ctx, void *pool, char** msg) { struct pam_ctx_st * pctx = ctx; -int size; if (pctx->state != PAM_S_INIT && pctx->state != PAM_S_WAIT_FOR_PASS) { syslog(LOG_AUTH, "PAM-auth: conversation in wrong state (%d)", pctx->state); @@ -224,13 +223,14 @@ int size; if (msg != NULL) { if (pctx->msg.length == 0) if (pctx->changing) - strlcpy(msg, "Please enter the new password.", msg_size); + *msg = talloc_strdup(pool, "Please enter the new password."); else - strlcpy(msg, "Please enter your password.", msg_size); + *msg = talloc_strdup(pool, "Please enter your password."); else { - size = MIN(msg_size-1, pctx->msg.length); - memcpy(msg, pctx->msg.data, size); - msg[size] = 0; + if (str_append_data(&pctx->msg, "\0", 1) < 0) + return -1; + + *msg = talloc_strdup(pool, (char*)pctx->msg.data); } } diff --git a/src/auth/plain.c b/src/auth/plain.c index fbc5b491..2d3f5204 100644 --- a/src/auth/plain.c +++ b/src/auth/plain.c @@ -250,11 +250,11 @@ static int plain_auth_pass(void *ctx, const char *pass, unsigned pass_len) } } -static int plain_auth_msg(void *ctx, char *msg, size_t msg_size) +static int plain_auth_msg(void *ctx, void *pool, char **msg) { struct plain_ctx_st *pctx = ctx; - strlcpy(msg, pctx->pass_msg, msg_size); + *msg = talloc_strdup(pool, pctx->pass_msg); return 0; } diff --git a/src/auth/radius.c b/src/auth/radius.c index 230056e1..9f848b66 100644 --- a/src/auth/radius.c +++ b/src/auth/radius.c @@ -295,11 +295,11 @@ static int radius_auth_pass(void *ctx, const char *pass, unsigned pass_len) } } -static int radius_auth_msg(void *ctx, char *msg, size_t msg_size) +static int radius_auth_msg(void *ctx, void *pool, char **msg) { struct radius_ctx_st *pctx = ctx; - strlcpy(msg, pctx->pass_msg, msg_size); + *msg = talloc_strdup(pool, pctx->pass_msg); return 0; } diff --git a/src/sec-mod-auth.c b/src/sec-mod-auth.c index 73465ddf..325ee31e 100644 --- a/src/sec-mod-auth.c +++ b/src/sec-mod-auth.c @@ -123,7 +123,7 @@ int send_sec_auth_reply(int cfd, sec_mod_st * sec, client_entry_st * entry, AUTH msg.user_name = entry->username; - if (entry->msg_str[0] != 0) { + if (entry->msg_str != NULL) { msg.msg = entry->msg_str; } @@ -156,6 +156,9 @@ int send_sec_auth_reply(int cfd, sec_mod_st * sec, client_entry_st * entry, AUTH return ret; } + talloc_free(entry->msg_str); + entry->msg_str = NULL; + return 0; } @@ -179,6 +182,9 @@ int send_sec_auth_reply_msg(int cfd, sec_mod_st * sec, client_entry_st * e) seclog(sec, LOG_ERR, "send_auth_reply_msg error"); } + talloc_free(e->msg_str); + e->msg_str = NULL; + return ret; } @@ -550,7 +556,7 @@ int handle_sec_auth_init(int cfd, sec_mod_st * sec, const SecAuthInitMsg * req) strlcpy(e->username, req->user_name, sizeof(e->username)); } - ret = e->module->auth_msg(e->auth_ctx, e->msg_str, sizeof(e->msg_str)); + ret = e->module->auth_msg(e->auth_ctx, e, &e->msg_str); if (ret < 0) { ret = -1; goto cleanup; diff --git a/src/sec-mod-auth.h b/src/sec-mod-auth.h index 9040bee4..9b6c8dc1 100644 --- a/src/sec-mod-auth.h +++ b/src/sec-mod-auth.h @@ -32,7 +32,7 @@ struct auth_mod_st { void (*global_init)(void *pool, void* additional); void (*global_deinit)(void); int (*auth_init)(void** ctx, void *pool, const char* username, const char* ip, void* additional); - int (*auth_msg)(void* ctx, char* msg, size_t msg_size); + int (*auth_msg)(void* ctx, void *pool, char** msg); int (*auth_pass)(void* ctx, const char* pass, unsigned pass_len); int (*auth_group)(void* ctx, const char *suggested, char *groupname, int groupname_size); int (*auth_user)(void* ctx, char *groupname, int groupname_size); diff --git a/src/sec-mod-db.c b/src/sec-mod-db.c index 7c49a1d8..07ff01ce 100644 --- a/src/sec-mod-db.c +++ b/src/sec-mod-db.c @@ -138,6 +138,7 @@ client_entry_st *find_client_entry(sec_mod_st *sec, uint8_t sid[SID_SIZE]) static void clean_entry(sec_mod_st *sec, client_entry_st * e) { sec_auth_user_deinit(sec, e); + talloc_free(e->msg_str); talloc_free(e); } diff --git a/src/sec-mod.h b/src/sec-mod.h index 47ce986c..2f9dc0a7 100644 --- a/src/sec-mod.h +++ b/src/sec-mod.h @@ -56,7 +56,7 @@ typedef struct client_entry_st { unsigned in_use; /* counter of users of this structure */ unsigned tls_auth_ok; - char msg_str[MAX_MSG_SIZE]; + char *msg_str; stats_st stats; diff --git a/src/vpn.h b/src/vpn.h index 1a886e96..a6a8c349 100644 --- a/src/vpn.h +++ b/src/vpn.h @@ -113,7 +113,6 @@ extern int syslog_open; #define MAX_CIPHERSUITE_NAME 64 -#define MAX_MSG_SIZE 2048 #define SID_SIZE 16 typedef enum { diff --git a/src/worker-auth.c b/src/worker-auth.c index 406520db..614feb31 100644 --- a/src/worker-auth.c +++ b/src/worker-auth.c @@ -696,8 +696,7 @@ int connect_to_secmod(worker_st * ws) return sd; } -static int recv_auth_reply(worker_st * ws, int sd, char *txt, - size_t max_txt_size) +static int recv_auth_reply(worker_st * ws, int sd, char **txt) { int ret; SecAuthReplyMsg *msg = NULL; @@ -713,7 +712,7 @@ static int recv_auth_reply(worker_st * ws, int sd, char *txt, oclog(ws, LOG_DEBUG, "received auth reply message (value: %u)", (unsigned)msg->reply); - if (txt) txt[0] = 0; + if (txt) *txt = NULL; switch (msg->reply) { case AUTH__REP__MSG: @@ -722,7 +721,7 @@ static int recv_auth_reply(worker_st * ws, int sd, char *txt, return ERR_AUTH_FAIL; } - strlcpy(txt, msg->msg, max_txt_size); + *txt = talloc_strdup(ws, msg->msg); if (msg->has_sid && msg->sid.len == sizeof(ws->sid)) { /* update our sid */ memcpy(ws->sid, msg->sid.data, sizeof(ws->sid)); @@ -761,8 +760,8 @@ static int recv_auth_reply(worker_st * ws, int sd, char *txt, memcpy(ws->session_id, msg->dtls_session_id.data, msg->dtls_session_id.len); - if (msg->msg && txt) - strlcpy(txt, msg->msg, max_txt_size); + if (txt) + *txt = talloc_strdup(ws, msg->msg); break; case AUTH__REP__FAILED: @@ -1143,7 +1142,7 @@ int post_auth_handler(worker_st * ws, unsigned http_ver) char *password = NULL; char *groupname = NULL; char ipbuf[128]; - char msg[MAX_MSG_SIZE]; + char *msg = NULL; unsigned def_group = 0; if (req->body_length > 0) { @@ -1328,7 +1327,7 @@ int post_auth_handler(worker_st * ws, unsigned http_ver) goto auth_fail; } - ret = recv_auth_reply(ws, sd, msg, sizeof(msg)); + ret = recv_auth_reply(ws, sd, &msg); if (sd != -1) { close(sd); sd = -1; @@ -1339,10 +1338,12 @@ int post_auth_handler(worker_st * ws, unsigned http_ver) ws->username); ws->auth_state = S_AUTH_REQ; - if (ws->selected_auth->type & AUTH_TYPE_GSSAPI) - return basic_auth_handler(ws, http_ver, msg); - else - return get_auth_handler2(ws, http_ver, msg); + if (ws->selected_auth->type & AUTH_TYPE_GSSAPI) { + ret = basic_auth_handler(ws, http_ver, msg); + } else { + ret = get_auth_handler2(ws, http_ver, msg); + } + goto cleanup; } else if (ret < 0) { oclog(ws, LOG_ERR, "failed authentication for '%s'", ws->username); @@ -1352,7 +1353,8 @@ int post_auth_handler(worker_st * ws, unsigned http_ver) oclog(ws, LOG_HTTP_DEBUG, "user '%s' obtained cookie", ws->username); ws->auth_state = S_AUTH_COOKIE; - return post_common_handler(ws, http_ver, msg); + ret = post_common_handler(ws, http_ver, msg); + goto cleanup; ask_auth: @@ -1366,5 +1368,9 @@ int post_auth_handler(worker_st * ws, unsigned http_ver) "HTTP/1.1 401 Unauthorized\r\nX-Reason: %s\r\n\r\n", reason); cstp_fatal_close(ws, GNUTLS_A_ACCESS_DENIED); + talloc_free(msg); exit(1); + cleanup: + talloc_free(msg); + return ret; }