From owner-freebsd-hackers@FreeBSD.ORG Thu May 28 09:57:04 2009 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id EB57F106564A for ; Thu, 28 May 2009 09:57:04 +0000 (UTC) (envelope-from rea-fbsd@codelabs.ru) Received: from 0.mx.codelabs.ru (0.mx.codelabs.ru [144.206.177.45]) by mx1.freebsd.org (Postfix) with ESMTP id 9DD028FC08 for ; Thu, 28 May 2009 09:57:04 +0000 (UTC) (envelope-from rea-fbsd@codelabs.ru) DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; s=one; d=codelabs.ru; h=Received:Date:From:To:Cc:Subject:Message-ID:Reply-To:References:MIME-Version:Content-Type:Content-Disposition:In-Reply-To:Sender; b=T14EhhBVyXMFcE7DhERIQYo5fPF/eEjKIGVWiz8qs50zoLkfLz5z7as4eC8Q5d5Mhxsoi75vuCd1fY0HQIiwYptcZug2nwWhGJc2waINgKp8JOVAhBTJu8RY9fsz8gKrtw3gmcVfu+mlDHvC9dtvs16HBZRe5wGKa6MSvzduMc4=; Received: from void.codelabs.ru (void.codelabs.ru [144.206.177.25]) by 0.mx.codelabs.ru with esmtpsa (TLSv1:AES256-SHA:256) id 1M9cMA-000HrL-6T; Thu, 28 May 2009 13:57:02 +0400 Date: Thu, 28 May 2009 13:56:59 +0400 From: Eygene Ryabinkin To: Mel Flynn Message-ID: References: <23727599.post@talk.nabble.com> <86prdvipwe.fsf@ds4.des.no> <86my8z8su6.fsf@ds4.des.no> <200905281107.12864.mel.flynn+fbsd.hackers@mailing.thruhere.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200905281107.12864.mel.flynn+fbsd.hackers@mailing.thruhere.net> Sender: rea-fbsd@codelabs.ru Cc: freebsd-hackers@freebsd.org, Jakub Lach , Dag-Erling Sm??rgrav Subject: Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: rea-fbsd@codelabs.ru List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 May 2009 09:57:05 -0000 Mel, good day. Thu, May 28, 2009 at 11:07:12AM +0200, Mel Flynn wrote: > On Tuesday 26 May 2009 23:20:01 Dag-Erling Sm??rgrav wrote: > > Dag-Erling Sm??rgrav writes: > > > Like bde@ pointed out, the patch is incorrect. It moves the test for > > > v_type != VDIR up to a point where, in the case of a symlink, v_type is > > > always (by definition) VLNK. > > > > Hmm, actually, symlinks are resolved in namei(), not lookup(). This is > > not going to be pretty. I'll be back later... > I don't pretend to comprehend the kernel side of things fully, but > wouldn't it be easier to append a dot to all trailing slashes inside > or before passing to namei? A dirty hack that puts some additional burden on the namei() ;-/ > This works in userland at present and lighttpd could use something > similar as a work around until it's fixed: Yes, this will work, but it is better to apply the real fix ;)) Dirty hacks aren't good at the long timescales -- they tend to obfuscate the code and put unneeded interprocedure constraints (you should prepend dot to the slash if you want to call namei()/we should add dot to slash to make our life easier/etc). -- Eygene _ ___ _.--. # \`.|\..----...-'` `-._.-'_.-'` # Remember that it is hard / ' ` , __.--' # to read the on-line manual )/' _/ \ `-_, / # while single-stepping the kernel. `-'" `"\_ ,_.-;_.-\_ ', fsc/as # _.-'_./ {_.' ; / # -- FreeBSD Developers handbook {_.-``-' {_/ #