SECURITY HOLE: the file descriptor for the secret key was left open and

[become] / src / check.c

diff --git a/src/check.c b/src/check.c
index 34d1e52..f0a98b7 100644 (file)
--- a/src/check.c
+++ b/src/check.c
@@ -1,10 +1,10 @@
 /* -*-c-*-
  *
- * $Id: check.c,v 1.3 1997/08/07 09:49:38 mdw Exp $
+ * $Id: check.c,v 1.8 1998/06/18 15:10:44 mdw Exp $
  *
  * Check validity of requests
  *
- * (c) 1997 EBI
+ * (c) 1998 EBI
  */
 
 /*----- Licensing notice --------------------------------------------------*
@@ -29,9 +29,30 @@
 /*----- Revision history --------------------------------------------------*
  *
  * $Log: check.c,v $
- * Revision 1.3  1997/08/07 09:49:38  mdw
- * Extensive modifications to handle netgroups.  Also sanitise user and group
- * names before adding them to the symbol table.
+ * Revision 1.8  1998/06/18 15:10:44  mdw
+ * SECURITY HOLE: the file descriptor for the secret key was left open and
+ * inherited by the target process.  This is now fixed.  Also set
+ * close-on-exec flags on key file, close config file carefully, and close
+ * UDP socket after receiving reply from server.
+ *
+ * Revision 1.7  1998/04/23 13:22:08  mdw
+ * Support no-network configuration option, and new interface to
+ * configuration file parser.
+ *
+ * Revision 1.6  1998/01/12 16:45:47  mdw
+ * Fix copyright date.
+ *
+ * Revision 1.5  1997/09/26 09:14:58  mdw
+ * Merged blowfish branch into trunk.
+ *
+ * Revision 1.4.2.1  1997/09/26 09:08:01  mdw
+ * Use the Blowfish encryption algorithm instead of IDEA.  This is partly
+ * because I prefer Blowfish (without any particularly strong evidence) but
+ * mainly because IDEA is patented and Blowfish isn't.
+ *
+ * Revision 1.4  1997/08/07 09:52:05  mdw
+ * (Log entry for previous version is bogus.)  Added support for multiple
+ * servers.
  *
  * Revision 1.2  1997/08/04 10:24:20  mdw
  * Sources placed under CVS control.
@@ -62,15 +83,16 @@
 
 #include <arpa/inet.h>
 
+#include <fcntl.h>
 #include <netdb.h>
 #include <unistd.h>
 
 /* --- Local headers --- */
 
 #include "become.h"
+#include "blowfish.h"
 #include "config.h"
 #include "crypt.h"
-#include "idea.h"
 #include "lexer.h"
 #include "name.h"
 #include "netg.h"
@@ -80,7 +102,9 @@
 #include "userdb.h"
 #include "utils.h"
 
-/*----- Main code ---------------------------------------------------------*/
+/*----- Client-end network support ----------------------------------------*/
+
+#ifndef NONETWORK
 
 /* --- @check__send@ --- *
  *
@@ -133,14 +157,14 @@ static int check__ask(request *rq, struct sockaddr_in *serv, size_t n_serv)
 {
   int fd;
   unsigned char crq[crq_size];
-  unsigned char sk[IDEA_KEYSIZE];
+  unsigned char sk[BLOWFISH_KEYSIZE];
   time_t t;
   pid_t pid;
 
   /* --- First, build the encrypted request packet --- */
 
   {
-    unsigned char k[IDEA_KEYSIZE];
+    unsigned char k[BLOWFISH_KEYSIZE];
     FILE *fp;
 
     /* --- Read in the encryption key --- */
@@ -149,7 +173,12 @@ static int check__ask(request *rq, struct sockaddr_in *serv, size_t n_serv)
       die("couldn't open key file `%s': %s", file_KEY,
          strerror(errno));
     }
+    if (fcntl(fileno(fp), F_SETFD, 1) < 0) {
+      die("couldn't set close-on-exec on key file `%s': %s", file_KEY,
+         strerror(errno));
+    }
     tx_getBits(k, 128, fp);
+    fclose(fp);
 
     /* --- Now build a request packet --- */
 
@@ -283,7 +312,7 @@ static int check__ask(request *rq, struct sockaddr_in *serv, size_t n_serv)
          T( trace(TRACE_CLIENT, "client: reply from unknown host"); )
          continue;
        }
-    
+
        /* --- Unpack and verify the response --- */
 
        answer = crypt_unpackReply(buff, sk, t, pid);
@@ -292,6 +321,7 @@ static int check__ask(request *rq, struct sockaddr_in *serv, size_t n_serv)
                   "client: invalid or corrupt reply packet"); )
          continue;
        }
+       close(fd);
        return (answer);
       }
     }
@@ -498,6 +528,10 @@ int check__client(request *rq, FILE *fp)
   return (check__ask(rq, serv, n_serv));
 }
 
+#endif
+
+/*----- Main checking function --------------------------------------------*/
+
 /* --- @check@ --- *
  *
  * Arguments:  @request *rq@ = pointer to request buffer
@@ -513,8 +547,10 @@ int check(request *rq)
 
   /* --- Check if we need to talk to a server --- */
 
+#ifndef NONETWORK
   if ((fp = fopen(file_SERVER, "r")) != 0)
     return (check__client(rq, fp));
+#endif
 
   /* --- Otherwise do this all the old-fashioned way --- */
 
@@ -530,7 +566,8 @@ int check(request *rq)
   name_init();
   rule_init();
   lexer_scan(fp);
-  yyparse();
+  parse();
+  fclose(fp);
 
   return (rule_check(rq));
 }