Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-06-03 Thread Eygene Ryabinkin
Wed, Jun 03, 2009 at 11:03:45AM +0200, Dag-Erling Sm??rgrav wrote: > Isn't it clearly described in the preceding comment? Specifically, by > the first two sentences: "Replace multiple slashes by a single slash and > trailing slashes by a null. This must be done before VOP_LOOKUP() > because some

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-06-03 Thread Dag-Erling Smørgrav
Eygene Ryabinkin writes: > "Dag-Erling Smørgrav" writes: > > Eygene Ryabinkin writes: > > > Perhaps 'XXX for direnter()' should be changed to something like > > > 'strip trailing slashes in cnp->cn_nameptr'. > > I'll just remove it, since the previous comment clearly explains > > what is going o

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-06-02 Thread Eygene Ryabinkin
Tue, Jun 02, 2009 at 01:28:34PM +0200, Dag-Erling Sm??rgrav wrote: > Eygene Ryabinkin writes: > > For the current code state, check "*cp == '\0'" seems to be redundant: > > [...] By the way, comment before the test "if (rdonly)' seems to be > > slightly misleading [...] > > OK, I see that. I've

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-06-02 Thread Dag-Erling Smørgrav
Bruce Evans writes: > This comment could do with some rewording to emphasize inheritance of the > flag and to improve the grammar of the comment. Suggestions? For reference, here's the entire comment: /* * Replace multiple slashes by a single slash and trailing slashes

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-06-02 Thread Dag-Erling Smørgrav
Eygene Ryabinkin writes: > For the current code state, check "*cp == '\0'" seems to be redundant: > [...] By the way, comment before the test "if (rdonly)' seems to be > slightly misleading [...] OK, I see that. I've removed the check and rewritten the comment. What about this "temporary asser

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-06-02 Thread Eygene Ryabinkin
Dag-Erling, good day. Fri, May 29, 2009 at 06:58:08PM +0200, Dag-Erling Sm??rgrav wrote: > Index: sys/kern/vfs_lookup.c > === > --- sys/kern/vfs_lookup.c (revision 193028) > +++ sys/kern/vfs_lookup.c (working copy) > @@ -454,7

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-05-29 Thread Eygene Ryabinkin
Fri, May 29, 2009 at 06:53:22PM +0200, Dag-Erling Sm??rgrav wrote: > Bruce Evans writes: > > % /* > > %* Get a buffer for the name to be translated, and copy the > > %* name into the buffer. > > % @@ -533,6 +536,8 @@ > > % if (*cp == '\0') { > > % trailing_sla

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-05-29 Thread Dag-Erling Smørgrav
How's this? Index: sys/kern/vfs_lookup.c === --- sys/kern/vfs_lookup.c (revision 193028) +++ sys/kern/vfs_lookup.c (working copy) @@ -454,7 +454,6 @@ int docache;/* == 0 do not cache last compon

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-05-29 Thread Dag-Erling Smørgrav
Bruce Evans writes: > Dag-Erling Smørgrav writes: > % Index: sys/kern/vfs_lookup.c > % === > % --- sys/kern/vfs_lookup.c (revision 192899) > % +++ sys/kern/vfs_lookup.c (working copy) > % @@ -147,6 +147,9 @@ > % cnp->

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-05-28 Thread Eygene Ryabinkin
Mel, good day. Thu, May 28, 2009 at 11:07:12AM +0200, Mel Flynn wrote: > On Tuesday 26 May 2009 23:20:01 Dag-Erling Sm??rgrav wrote: > > Dag-Erling Sm??rgrav writes: > > > Like bde@ pointed out, the patch is incorrect. It moves the test for > > > v_type != VDIR up to a point where, in the case o

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-05-28 Thread Mel Flynn
On Tuesday 26 May 2009 23:20:01 Dag-Erling Smørgrav wrote: > Dag-Erling Smørgrav writes: > > Like bde@ pointed out, the patch is incorrect. It moves the test for > > v_type != VDIR up to a point where, in the case of a symlink, v_type is > > always (by definition) VLNK. > > Hmm, actually, symlink

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-05-27 Thread Dag-Erling Smørgrav
Eygene Ryabinkin writes: > 'if ()' looks suspicious: ISLASTCN is set some lines below so it could > be not yet flagged. Seems like we could omit 'if ()' clause but leave > it's body for the current state of the code -- it will be equivalent to > the mine's check. Yes, I was a little too quick th

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-05-27 Thread Dag-Erling Smørgrav
Oliver Pinter writes: > This is a redefinitions of PARAMASK in the patch, that you attached Sorry, I forgot to regenerate the patch after fixing it. DES -- Dag-Erling Smørgrav - d...@des.no ___ freebsd-hackers@freebsd.org mailing list http://lists.fre

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-05-27 Thread Oliver Pinter
Hi! This is a redefinitions of PARAMASK in the patch, that you attached ---8<- ... #definePARAMASK0x0e00 /* mask of parameter descriptors */ +#defineTRAILINGSLASH 0x1000 /* path ended in a slash */ +#definePARAMASK0x1e00 /* mask

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-05-27 Thread Eygene Ryabinkin
Wed, May 27, 2009 at 06:44:35PM +0200, Dag-Erling Sm??rgrav wrote: > Eygene Ryabinkin writes: > > [new three-part patch] > > I committed the namei.h cleanup patch and the vfs_lookup.c comment > patch. Thanks! > I made a number of changes to the trailing-slash patch. Can you > double-check it b

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-05-27 Thread Dag-Erling Smørgrav
Bruce Evans writes: > This seems to be equivalent to the patch in the PR at the time of PR, > except it risks breaking some other cases, so I don't see how it can > work. As discussed on -hackers, it doesn't. This one does, though. DES -- Dag-Erling Smørgrav - d...@des.no Index: sys/kern/vfs_

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-05-27 Thread Dag-Erling Smørgrav
Eygene Ryabinkin writes: > [new three-part patch] I committed the namei.h cleanup patch and the vfs_lookup.c comment patch. I made a number of changes to the trailing-slash patch. Can you double-check it before I commit it? DES -- Dag-Erling Smørgrav - d...@des.no Index: sys/kern/vfs_lookup.

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-05-27 Thread Dag-Erling Smørgrav
Eygene Ryabinkin writes: > Regarding the 'ln -s /etc/motd file; ln -s file/ anotherone': do you > (or anyone reading this) think that 'cat anotherone' should really > show the contents of /etc/motd or patch's behaviour is good? if you mean $ ln -fs /etc/motd foo $ ln -fs foo/ bar $ readlink foo

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-05-27 Thread Eygene Ryabinkin
Wed, May 27, 2009 at 02:39:07PM +0200, Dag-Erling Sm??rgrav wrote: > I was working on head. The code is (mostly) the same, just shifted > somewhere between ~50 and ~90 lines depending on where you look. Your > patch should apply cleanly. > > BTW, you made a lot of whitespace changes in namei.h.

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-05-27 Thread Dag-Erling Smørgrav
Eygene Ryabinkin writes: > "Dag-Erling Smørgrav" writes: > > (don't be fooled by the comment on line 270; > > the code inside the if statement is for the *non*-symlink case). > Me sees this on the line 226, but may be I hadn't updated my 7.x. I was working on head. The code is (mostly) the same

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-05-27 Thread Eygene Ryabinkin
Wed, May 27, 2009 at 01:07:15PM +0200, Dag-Erling Sm??rgrav wrote: > Eygene Ryabinkin writes: > > May be the attached patch will fix the thing? > > I'm not entirely convinced. Try the regression test I wrote > (head/tools/regression/vfs/trailing_slash.t) I see: you mean that the bare '/' at th

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-05-27 Thread Dag-Erling Smørgrav
Eygene Ryabinkin writes: > May be the attached patch will fix the thing? I'm not entirely convinced. Try the regression test I wrote (head/tools/regression/vfs/trailing_slash.t) > It adds an additional flag, but this was the only thing I was able to > invent to avoid ABI breakage. The flag is

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-05-27 Thread Eygene Ryabinkin
Dag-Erling, *, good day. Tue, May 26, 2009 at 10:13:21PM +0200, Dag-Erling Sm??rgrav wrote: > [moving from security@ to hack...@] > > Jakub Lach writes: > > http://www.freebsd.org/cgi/query-pr.cgi?pr=kern/21768 > > Like bde@ pointed out, the patch is incorrect. It moves the test for > v_type !

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-05-26 Thread Dag-Erling Smørgrav
Dag-Erling Smørgrav writes: > Like bde@ pointed out, the patch is incorrect. It moves the test for > v_type != VDIR up to a point where, in the case of a symlink, v_type is > always (by definition) VLNK. Hmm, actually, symlinks are resolved in namei(), not lookup(). This is not going to be pret

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-05-26 Thread Dag-Erling Smørgrav
Dag-Erling Smørgrav writes: > The attached patch should work. Oops. It actually triggers a KASSERT. DES -- Dag-Erling Smørgrav - d...@des.no ___ freebsd-hackers@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-hackers To uns

Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

2009-05-26 Thread Dag-Erling Smørgrav
[moving from security@ to hack...@] Jakub Lach writes: > http://www.freebsd.org/cgi/query-pr.cgi?pr=kern/21768 Like bde@ pointed out, the patch is incorrect. It moves the test for v_type != VDIR up to a point where, in the case of a symlink, v_type is always (by definition) VLNK. The reason wh