Date: Wed, 27 May 2009 18:44:35 +0200 From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= <des@des.no> To: rea-fbsd@codelabs.ru Cc: freebsd-hackers@freebsd.org, Jakub Lach <jakub_lach@mailplus.pl> Subject: Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability Message-ID: <86vdnmijgs.fsf@ds4.des.no> In-Reply-To: <nhZ4ZNM2NtGGBpfrd4LGzlLPCPs@10Ilc7MfiXA2JVIRVQpZfk7cTQ4> (Eygene Ryabinkin's message of "Wed, 27 May 2009 17:16:25 %2B0400") References: <23727599.post@talk.nabble.com> <86prdvipwe.fsf@ds4.des.no> <0vGjPHEq7MqxjtFmBufY%2BmBxlR4@7oUjtCwN654QcDr16CH%2BkAk8bJg> <86vdnmiz30.fsf@ds4.des.no> <15QQC%2B1YeDzOjf35dqyJmioc1ik@XX1fo6zQUfC4h0jjRC6IBz3oNH4> <86prdug1p0.fsf@ds4.des.no> <nhZ4ZNM2NtGGBpfrd4LGzlLPCPs@10Ilc7MfiXA2JVIRVQpZfk7cTQ4>
next in thread | previous in thread | raw e-mail | index | archive | help
--=-=-=
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Eygene Ryabinkin <rea-fbsd@codelabs.ru> writes:
> [new three-part patch]
I committed the namei.h cleanup patch and the vfs_lookup.c comment
patch.
I made a number of changes to the trailing-slash patch. Can you
double-check it before I commit it?
DES
--=20
Dag-Erling Sm=C3=B8rgrav - des@des.no
--=-=-=
Content-Type: text/x-patch
Content-Disposition: inline; filename=vfs_lookup-trailing-slash.diff
Index: sys/kern/vfs_lookup.c
===================================================================
--- sys/kern/vfs_lookup.c (revision 192899)
+++ sys/kern/vfs_lookup.c (working copy)
@@ -147,6 +147,9 @@
cnp->cn_flags &= ~LOCKSHARED;
fdp = p->p_fd;
+ /* We will set this ourselves if we need it. */
+ cnp->cn_flags &= ~TRAILINGSLASH;
+
/*
* Get a buffer for the name to be translated, and copy the
* name into the buffer.
@@ -533,6 +536,8 @@
if (*cp == '\0') {
trailing_slash = 1;
*ndp->ni_next = '\0'; /* XXX for direnter() ... */
+ if (cnp->cn_flags & ISLASTCN)
+ cnp->cn_flags |= TRAILINGSLASH;
}
}
ndp->ni_next = cp;
@@ -807,14 +812,6 @@
goto success;
}
- /*
- * Check for bogus trailing slashes.
- */
- if (trailing_slash && dp->v_type != VDIR) {
- error = ENOTDIR;
- goto bad2;
- }
-
nextname:
/*
* Not a symbolic link. If more pathname,
@@ -838,6 +835,14 @@
goto dirloop;
}
/*
+ * If we're processing a path with a trailing slash,
+ * check that the end result is a directory.
+ */
+ if ((cnp->cn_flags & TRAILINGSLASH) && dp->v_type != VDIR) {
+ error = ENOTDIR;
+ goto bad2;
+ }
+ /*
* Disallow directory write attempts on read-only filesystems.
*/
if (rdonly &&
Index: sys/sys/namei.h
===================================================================
--- sys/sys/namei.h (revision 192900)
+++ sys/sys/namei.h (working copy)
@@ -143,6 +143,8 @@
#define AUDITVNODE1 0x04000000 /* audit the looked up vnode information */
#define AUDITVNODE2 0x08000000 /* audit the looked up vnode information */
#define PARAMASK 0x0ffffe00 /* mask of parameter descriptors */
+#define TRAILINGSLASH 0x10000000 /* path ended in a slash */
+#define PARAMASK 0x1ffffe00 /* mask of parameter descriptors */
#define NDHASGIANT(NDP) (((NDP)->ni_cnd.cn_flags & GIANTHELD) != 0)
--=-=-=--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?86vdnmijgs.fsf>