More conservative authentication with bad input

git-svn-id: https://bacula.svn.sourceforge.net/svnroot/bacula/trunk@388 91ce42f0-d328-0410-95d8-f526ca767f89

diff --git a/bacula/src/dird/authenticate.c b/bacula/src/dird/authenticate.c
index 3d1db7e03fcfb39e8e3025c901b1c3a770362e50..8cb06f61657b16863636fa4bedfbb378351a1d14 100644 (file)
--- a/bacula/src/dird/authenticate.c
+++ b/bacula/src/dird/authenticate.c
@@ -73,13 +73,13 @@ int authenticate_storage_daemon(JCR *jcr)
    }
    Dmsg1(116, ">stored: %s", sd->msg);
    if (bnet_recv(sd) <= 0) {
-      Emsg1(M_FATAL, 0, _("bdird<stored: bad response to Hello command: ERR=%s\n"),
+      Jmsg1(jcr, M_FATAL, 0, _("bdird<stored: bad response to Hello command: ERR=%s\n"),
         bnet_strerror(sd));
       return 0;
    }
    Dmsg1(110, "<stored: %s", sd->msg);
    if (strncmp(sd->msg, OKhello, sizeof(OKhello)) != 0) {
-      Emsg0(M_FATAL, 0, _("Storage daemon rejected Hello command\n"));
+      Jmsg0(jcr, M_FATAL, 0, _("Storage daemon rejected Hello command\n"));
       return 0;
    }
    return 1;
@@ -98,7 +98,7 @@ int authenticate_file_daemon(JCR *jcr)
     */
    strcpy(dirname, director->hdr.name);
    bash_spaces(dirname);
-   if (!bnet_fsend(fd, hello, director->hdr.name)) {
+   if (!bnet_fsend(fd, hello, dirname)) {
       Jmsg(jcr, M_FATAL, 0, _("Error sending Hello to File daemon. ERR=%s\n"), bnet_strerror(fd));
       return 0;
    }
@@ -109,7 +109,7 @@ int authenticate_file_daemon(JCR *jcr)
    }
    Dmsg1(116, ">filed: %s", fd->msg);
    if (bnet_recv(fd) <= 0) {
-      Jmsg(jcr, M_FATAL, 0, _("bdird<filed: bad response to Hello command: ERR=%s\n"),
+      Jmsg(jcr, M_FATAL, 0, _("Bad response from File daemon to Hello command: ERR=%s\n"),
         bnet_strerror(fd));
       return 0;
    }
@@ -129,10 +129,14 @@ int authenticate_user_agent(BSOCK *ua)
    char name[MAXSTRING];
    int ok = 0;
 
-   if (ua->msglen > MAXSTRING ||
-       sscanf(ua->msg, "Hello %127s calling\n", name) != 1) {
+   if (ua->msglen < 16 || ua->msglen >= MAXSTRING-1) {
+      Emsg0(M_ERROR, 0, _("UA Hello is invalid.\n"));
+      return 0;
+   }
+
+   if (sscanf(ua->msg, "Hello %127s calling\n", name) != 1) {
       ua->msg[100] = 0;              /* terminate string */
-      Emsg1(M_ERROR, 0, _("Authentication failure: %s"), ua->msg);
+      Emsg1(M_ERROR, 0, _("UA Hello is invalid. Got: %s\n"), ua->msg);
       return 0;
    }
 

diff --git a/bacula/src/filed/authenticate.c b/bacula/src/filed/authenticate.c
index b6b23f975e113ff3ff251db0f0b9cb71492710f7..9c4440c1ca9f0b06fcdc36b7a50dce1ea1c1ca5f 100644 (file)
--- a/bacula/src/filed/authenticate.c
+++ b/bacula/src/filed/authenticate.c
@@ -45,8 +45,9 @@ static int authenticate(int rcode, BSOCK *bs)
       Emsg1(M_FATAL, 0, _("I only authenticate directors, not %d\n"), rcode);
       return 0;
    }
-   if (bs->msglen > 200) {
-      bs->msglen = 200;
+   if (bs->msglen < 25 || bs->msglen > 200) {
+      Emsg0(M_FATAL, 0, _("Bad Hello command from Director.\n"));
+      return 0;
    }
    dirname = get_pool_memory(PM_MESSAGE);
    dirname = check_pool_memory_size(dirname, bs->msglen);
@@ -54,7 +55,7 @@ static int authenticate(int rcode, BSOCK *bs)
    if (sscanf(bs->msg, "Hello Director %s calling\n", dirname) != 1) {
       free_pool_memory(dirname);
       bs->msg[100] = 0;
-      Emsg1(M_FATAL, 0, _("Bad Hello command from Director: %s"), bs->msg);
+      Emsg1(M_FATAL, 0, _("Bad Hello command from Director: %s\n"), bs->msg);
       return 0;
    }
    director = NULL;

diff --git a/bacula/src/stored/authenticate.c b/bacula/src/stored/authenticate.c
index df7bb393dcdc7d66dbdf59f232e9b864ccee3390..5d4d670901f11418cca20975c474108d4e3e1e0b 100644 (file)
--- a/bacula/src/stored/authenticate.c
+++ b/bacula/src/stored/authenticate.c
@@ -46,8 +46,9 @@ static int authenticate(int rcode, BSOCK *bs)
       Emsg1(M_FATAL, 0, _("I only authenticate Directors, not %d\n"), rcode);
       return 0;
    }
-   if (bs->msglen > 200) {
-      bs->msglen = 200;
+   if (bs->msglen < 25 || bs->msglen > 200) {
+      Emsg0(M_FATAL, 0, _("Bad Hello command from Director.\n"));
+      return 0;
    }
    dirname = get_pool_memory(PM_MESSAGE);
    dirname = check_pool_memory_size(dirname, bs->msglen);