Skip to content

some security improvements #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

some security improvements #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0ecfc33
fail HELLO command when SSL is required
Aug 13, 2019
588850a
escape peername in SQL statements
Aug 13, 2019
9274254
repeat gnutls_handshake() call in case of warnings
Aug 13, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
71 changes: 39 additions & 32 deletions conn.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -276,6 +276,7 @@ int conn_activate_ssl(int server_role)
char *ssl_keyfile;
char *ssl_certfile;
int err;
int handshake_repeat = 0;

if (csync_conn_usessl)
return 0;
Expand Down Expand Up @@ -333,40 +334,46 @@ int conn_activate_ssl(int server_role)
(gnutls_transport_ptr_t)(long)conn_fd_out
);

err = gnutls_handshake(conn_tls_session);
switch(err) {
case GNUTLS_E_SUCCESS:
break;

case GNUTLS_E_WARNING_ALERT_RECEIVED:
alrt = gnutls_alert_get(conn_tls_session);
fprintf(
csync_debug_out,
"SSL: warning alert received from peer: %d (%s).\n",
alrt, gnutls_alert_get_name(alrt)
);
break;

case GNUTLS_E_FATAL_ALERT_RECEIVED:
alrt = gnutls_alert_get(conn_tls_session);
fprintf(
csync_debug_out,
"SSL: fatal alert received from peer: %d (%s).\n",
alrt, gnutls_alert_get_name(alrt)
);

default:
gnutls_bye(conn_tls_session, GNUTLS_SHUT_RDWR);
gnutls_deinit(conn_tls_session);
gnutls_certificate_free_credentials(conn_x509_cred);
gnutls_global_deinit();
do {
handshake_repeat = 0;
err = gnutls_handshake(conn_tls_session);
switch(err) {
case GNUTLS_E_SUCCESS:
break;

csync_fatal(
"SSL: handshake failed: %s (%s)\n",
gnutls_strerror(err),
gnutls_strerror_name(err)
);
}
case GNUTLS_E_WARNING_ALERT_RECEIVED:
alrt = gnutls_alert_get(conn_tls_session);
fprintf(
csync_debug_out,
"SSL: warning alert received from peer: %d (%s).\n",
alrt, gnutls_alert_get_name(alrt)
);
handshake_repeat = 1;
break;

case GNUTLS_E_FATAL_ALERT_RECEIVED:
alrt = gnutls_alert_get(conn_tls_session);
fprintf(
csync_debug_out,
"SSL: fatal alert received from peer: %d (%s).\n",
alrt, gnutls_alert_get_name(alrt)
);
// fall-through!

default:
gnutls_bye(conn_tls_session, GNUTLS_SHUT_RDWR);
gnutls_deinit(conn_tls_session);
gnutls_certificate_free_credentials(conn_x509_cred);
gnutls_global_deinit();

csync_fatal(
"SSL: handshake failed: %s (%s)\n",
gnutls_strerror(err),
gnutls_strerror_name(err)
);
}
} while (handshake_repeat);

csync_conn_usessl = 1;

Expand Down
3 changes: 2 additions & 1 deletion daemon.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@ void csync_file_update(const char *filename, const char *peername)
struct stat st;
SQL("Removing file from dirty db",
"delete from dirty where filename = '%s' and peername = '%s'",
url_encode(filename), peername);
url_encode(filename), url_encode(peername));
if ( lstat_strict(prefixsubst(filename), &st) != 0 || csync_check_pure(filename) ) {
SQL("Removing file from file db",
"delete from file where filename = '%s'",
Expand Down Expand Up @@ -747,6 +747,7 @@ void csync_daemon_session()
goto conn_without_ssl_ok;
}
cmd_error = conn_response(CR_ERR_SSL_EXPECTED);
peer = NULL;
}
conn_without_ssl_ok:;
#endif
Expand Down
3 changes: 2 additions & 1 deletion update.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1156,11 +1156,12 @@ void csync_remove_old()
const struct csync_group_host *h;

const char *filename = url_decode(SQL_V(0));
const char *peername = url_decode(SQL_V(2));

while ((g=csync_find_next(g, filename)) != 0) {
if (!strcmp(g->myname, SQL_V(1)))
for (h = g->host; h; h = h->next) {
if (!strcmp(h->hostname, SQL_V(2)))
if (!strcmp(h->hostname, peername))
goto this_dirty_record_is_ok;
}
}
Expand Down