Date: Thu, 28 May 2009 13:56:59 +0400 From: Eygene Ryabinkin <rea-fbsd@codelabs.ru> To: Mel Flynn <mel.flynn+fbsd.hackers@mailing.thruhere.net> Cc: freebsd-hackers@freebsd.org, Jakub Lach <jakub_lach@mailplus.pl>, Dag-Erling Sm??rgrav <des@des.no> Subject: Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability Message-ID: <SYq4sF6iy06tc2rWCFGePYRwybQ@XX1fo6zQUfC4h0jjRC6IBz3oNH4> In-Reply-To: <200905281107.12864.mel.flynn%2Bfbsd.hackers@mailing.thruhere.net> References: <23727599.post@talk.nabble.com> <86prdvipwe.fsf@ds4.des.no> <86my8z8su6.fsf@ds4.des.no> <200905281107.12864.mel.flynn%2Bfbsd.hackers@mailing.thruhere.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Mel, good day.
Thu, May 28, 2009 at 11:07:12AM +0200, Mel Flynn wrote:
> On Tuesday 26 May 2009 23:20:01 Dag-Erling Sm??rgrav wrote:
> > Dag-Erling Sm??rgrav <des@des.no> writes:
> > > Like bde@ pointed out, the patch is incorrect. It moves the test for
> > > v_type != VDIR up to a point where, in the case of a symlink, v_type is
> > > always (by definition) VLNK.
> >
> > Hmm, actually, symlinks are resolved in namei(), not lookup(). This is
> > not going to be pretty. I'll be back later...
> I don't pretend to comprehend the kernel side of things fully, but
> wouldn't it be easier to append a dot to all trailing slashes inside
> or before passing to namei?
A dirty hack that puts some additional burden on the namei() ;-/
> This works in userland at present and lighttpd could use something
> similar as a work around until it's fixed:
Yes, this will work, but it is better to apply the real fix ;)) Dirty
hacks aren't good at the long timescales -- they tend to obfuscate the
code and put unneeded interprocedure constraints (you should prepend dot
to the slash if you want to call namei()/we should add dot to slash to
make our life easier/etc).
--
Eygene
_ ___ _.--. #
\`.|\..----...-'` `-._.-'_.-'` # Remember that it is hard
/ ' ` , __.--' # to read the on-line manual
)/' _/ \ `-_, / # while single-stepping the kernel.
`-'" `"\_ ,_.-;_.-\_ ', fsc/as #
_.-'_./ {_.' ; / # -- FreeBSD Developers handbook
{_.-``-' {_/ #
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?SYq4sF6iy06tc2rWCFGePYRwybQ>