148 lines
5.3 KiB
Diff
148 lines
5.3 KiB
Diff
commit 7794977f3ac5950885592f0dbf3ae870ffbe0a1a
|
|
Author: Patrick Monnerat <patrick@monnerat.net>
|
|
Date: Mon Apr 25 11:44:05 2022 +0200
|
|
|
|
[Backport] url: check sasl additional parameters for connection reuse.
|
|
|
|
Offering: RTOS
|
|
CVE: CVE-2022-22576
|
|
Reference: upstream_commit_id=852aa5ad351ea53e5f01d2f44b5b4370c2bf5425
|
|
|
|
DTS/AR: DTS2022042805098
|
|
type: LTS
|
|
reason: fix CVE-2022-22576 for curl.
|
|
weblink：https://github.com/curl/curl/commit/852aa5ad351ea53e5f01d2f44b5b4370c2bf5425
|
|
|
|
Also move static function safecmp() as non-static Curl_safecmp() since
|
|
its purpose is needed at several places.
|
|
|
|
Bug: https://curl.se/docs/CVE-2022-22576.html
|
|
|
|
CVE-2022-22576
|
|
|
|
Closes #8746
|
|
|
|
Signed-off-by: lvshengyuan <lvshengyuan1@h-partners.com>
|
|
|
|
diff --git a/lib/strcase.c b/lib/strcase.c
|
|
index 955e3c79e..cd04f2c0b 100644
|
|
--- a/lib/strcase.c
|
|
+++ b/lib/strcase.c
|
|
@@ -251,6 +251,16 @@ void Curl_strntolower(char *dest, const char *src, size_t n)
|
|
} while(*src++ && --n);
|
|
}
|
|
|
|
+/* Compare case-sensitive NUL-terminated strings, taking care of possible
|
|
+ * null pointers. Return true if arguments match.
|
|
+ */
|
|
+bool Curl_safecmp(char *a, char *b)
|
|
+{
|
|
+ if(a && b)
|
|
+ return !strcmp(a, b);
|
|
+ return !a && !b;
|
|
+}
|
|
+
|
|
/* --- public functions --- */
|
|
|
|
int curl_strequal(const char *first, const char *second)
|
|
diff --git a/lib/strcase.h b/lib/strcase.h
|
|
index 10dc69881..127bfdd44 100644
|
|
--- a/lib/strcase.h
|
|
+++ b/lib/strcase.h
|
|
@@ -48,4 +48,6 @@ char Curl_raw_toupper(char in);
|
|
void Curl_strntoupper(char *dest, const char *src, size_t n);
|
|
void Curl_strntolower(char *dest, const char *src, size_t n);
|
|
|
|
+bool Curl_safecmp(char *a, char *b);
|
|
+
|
|
#endif /* HEADER_CURL_STRCASE_H */
|
|
diff --git a/lib/url.c b/lib/url.c
|
|
index 8a2845ddd..b93a921ed 100644
|
|
--- a/lib/url.c
|
|
+++ b/lib/url.c
|
|
@@ -784,6 +784,7 @@ static void conn_free(struct connectdata *conn)
|
|
Curl_safefree(conn->passwd);
|
|
Curl_safefree(conn->sasl_authzid);
|
|
Curl_safefree(conn->options);
|
|
+ Curl_safefree(conn->oauth_bearer);
|
|
Curl_dyn_free(&conn->trailer);
|
|
Curl_safefree(conn->host.rawalloc); /* host name buffer */
|
|
Curl_safefree(conn->conn_to_host.rawalloc); /* host name buffer */
|
|
@@ -1332,7 +1333,9 @@ ConnectionExists(struct Curl_easy *data,
|
|
/* This protocol requires credentials per connection,
|
|
so verify that we're using the same name and password as well */
|
|
if(strcmp(needle->user, check->user) ||
|
|
- strcmp(needle->passwd, check->passwd)) {
|
|
+ strcmp(needle->passwd, check->passwd) ||
|
|
+ !Curl_safecmp(needle->sasl_authzid, check->sasl_authzid) ||
|
|
+ !Curl_safecmp(needle->oauth_bearer, check->oauth_bearer)) {
|
|
/* one of them was different */
|
|
continue;
|
|
}
|
|
@@ -3592,6 +3595,14 @@ static CURLcode create_conn(struct Curl_easy *data,
|
|
}
|
|
}
|
|
|
|
+ if(data->set.str[STRING_BEARER]) {
|
|
+ conn->oauth_bearer = strdup(data->set.str[STRING_BEARER]);
|
|
+ if(!conn->oauth_bearer) {
|
|
+ result = CURLE_OUT_OF_MEMORY;
|
|
+ goto out;
|
|
+ }
|
|
+ }
|
|
+
|
|
#ifdef USE_UNIX_SOCKETS
|
|
if(data->set.str[STRING_UNIX_SOCKET_PATH]) {
|
|
conn->unix_domain_socket = strdup(data->set.str[STRING_UNIX_SOCKET_PATH]);
|
|
diff --git a/lib/urldata.h b/lib/urldata.h
|
|
index 1d9911208..d3f337638 100644
|
|
--- a/lib/urldata.h
|
|
+++ b/lib/urldata.h
|
|
@@ -979,6 +979,7 @@ struct connectdata {
|
|
char *passwd; /* password string, allocated */
|
|
char *options; /* options string, allocated */
|
|
char *sasl_authzid; /* authorisation identity string, allocated */
|
|
+ char *oauth_bearer; /* OAUTH2 bearer, allocated */
|
|
unsigned char httpversion; /* the HTTP version*10 reported by the server */
|
|
struct curltime now; /* "current" time */
|
|
struct curltime created; /* creation time */
|
|
diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
|
|
index e5bbe1f5f..4c24348c2 100644
|
|
--- a/lib/vtls/vtls.c
|
|
+++ b/lib/vtls/vtls.c
|
|
@@ -125,15 +125,6 @@ static bool blobcmp(struct curl_blob *first, struct curl_blob *second)
|
|
return !memcmp(first->data, second->data, first->len); /* same data */
|
|
}
|
|
|
|
-static bool safecmp(char *a, char *b)
|
|
-{
|
|
- if(a && b)
|
|
- return !strcmp(a, b);
|
|
- else if(!a && !b)
|
|
- return TRUE; /* match */
|
|
- return FALSE; /* no match */
|
|
-}
|
|
-
|
|
|
|
bool
|
|
Curl_ssl_config_matches(struct ssl_primary_config *data,
|
|
@@ -147,12 +138,12 @@ Curl_ssl_config_matches(struct ssl_primary_config *data,
|
|
blobcmp(data->cert_blob, needle->cert_blob) &&
|
|
blobcmp(data->ca_info_blob, needle->ca_info_blob) &&
|
|
blobcmp(data->issuercert_blob, needle->issuercert_blob) &&
|
|
- safecmp(data->CApath, needle->CApath) &&
|
|
- safecmp(data->CAfile, needle->CAfile) &&
|
|
- safecmp(data->issuercert, needle->issuercert) &&
|
|
- safecmp(data->clientcert, needle->clientcert) &&
|
|
- safecmp(data->random_file, needle->random_file) &&
|
|
- safecmp(data->egdsocket, needle->egdsocket) &&
|
|
+ Curl_safecmp(data->CApath, needle->CApath) &&
|
|
+ Curl_safecmp(data->CAfile, needle->CAfile) &&
|
|
+ Curl_safecmp(data->issuercert, needle->issuercert) &&
|
|
+ Curl_safecmp(data->clientcert, needle->clientcert) &&
|
|
+ Curl_safecmp(data->random_file, needle->random_file) &&
|
|
+ Curl_safecmp(data->egdsocket, needle->egdsocket) &&
|
|
Curl_safe_strcasecompare(data->cipher_list, needle->cipher_list) &&
|
|
Curl_safe_strcasecompare(data->cipher_list13, needle->cipher_list13) &&
|
|
Curl_safe_strcasecompare(data->curves, needle->curves) &&
|