From 7c376ede8678339771a6032918f6454c5f5780f3 Mon Sep 17 00:00:00 2001 From: Daria Brashear Date: Wed, 8 Jul 2015 14:11:33 -0400 Subject: [PATCH 2/6] bos: Use crypt for commands where spoofing could be a risk bos defaults to not requiring crypt in a lot of cases, instead using clear. As the simplest way to secure the channel is to enable crypt, do so. FIXES 131782 (CVE-2015-3283) Change-Id: I354fcbb5db37db225391a47b59d99518d1d0b2f9 --- src/bozo/bos.c | 44 ++++++++++++++++++++++---------------------- 1 files changed, 22 insertions(+), 22 deletions(-) diff --git a/src/bozo/bos.c b/src/bozo/bos.c index 9ebdb2f..54935a2 100644 --- a/src/bozo/bos.c +++ b/src/bozo/bos.c @@ -161,7 +161,7 @@ SetAuth(struct cmd_syndesc *as, void *arock) afs_int32 flag; char *tp; - tconn = GetConn(as, 0); + tconn = GetConn(as, 1); tp = as->parms[1].items->data; if (strcmp(tp, "on") == 0) flag = 0; /* auth req.: noauthflag is false */ @@ -226,7 +226,7 @@ Prune(struct cmd_syndesc *as, void *arock) struct rx_connection *tconn; afs_int32 flags; - tconn = GetConn(as, 0); + tconn = GetConn(as, 1); flags = 0; if (as->parms[1].items) flags |= BOZO_PRUNEBAK; @@ -248,7 +248,7 @@ Exec(struct cmd_syndesc *as, void *arock) struct rx_connection *tconn; afs_int32 code; - tconn = GetConn(as, 0); + tconn = GetConn(as, 1); code = BOZO_Exec(tconn, as->parms[1].items->data); if (code) fprintf(stderr, "bos: failed to execute command (%s)\n", em(code)); @@ -314,7 +314,7 @@ UnInstall(struct cmd_syndesc *as, void *arock) struct cmd_item *ti; struct rx_connection *tconn; - tconn = GetConn(as, 0); + tconn = GetConn(as, 1); if (!as->parms[1].items) { fprintf(stderr, "bos: no files to uninstall\n"); return 1; @@ -373,7 +373,7 @@ Install(struct cmd_syndesc *as, void *arock) struct rx_call *tcall; char destDir[256]; - tconn = GetConn(as, 0); + tconn = GetConn(as, 1); if (!as->parms[1].items) { fprintf(stderr, "bos: no files to install\n"); return 1; @@ -425,7 +425,7 @@ Shutdown(struct cmd_syndesc *as, void *arock) afs_int32 code; struct cmd_item *ti; - tconn = GetConn(as, 0); + tconn = GetConn(as, 1); if (as->parms[1].items == 0) { code = BOZO_ShutdownAll(tconn); if (code) @@ -500,7 +500,7 @@ SetRestartCmd(struct cmd_syndesc *as, void *arock) struct rx_connection *tconn; count = 0; - tconn = GetConn(as, 0); + tconn = GetConn(as, 1); if (as->parms[2].items) { count++; type = 1; @@ -537,7 +537,7 @@ Startup(struct cmd_syndesc *as, void *arock) afs_int32 code; struct cmd_item *ti; - tconn = GetConn(as, 0); + tconn = GetConn(as, 1); if (as->parms[1].items == 0) { code = BOZO_StartupAll(tconn); if (code) @@ -560,7 +560,7 @@ Restart(struct cmd_syndesc *as, void *arock) afs_int32 code; struct cmd_item *ti; - tconn = GetConn(as, 0); + tconn = GetConn(as, 1); if (as->parms[2].items) { /* this is really a rebozo command */ if (as->parms[1].items) { @@ -604,7 +604,7 @@ SetCellName(struct cmd_syndesc *as, void *arock) struct rx_connection *tconn; afs_int32 code; - tconn = GetConn(as, 0); + tconn = GetConn(as, 1); code = BOZO_SetCellName(tconn, as->parms[1].items->data); if (code) fprintf(stderr, "bos: failed to set cell (%s)\n", em(code)); @@ -619,7 +619,7 @@ AddHost(struct cmd_syndesc *as, void *arock) struct cmd_item *ti; char name[MAXHOSTCHARS]; - tconn = GetConn(as, 0); + tconn = GetConn(as, 1); for (ti = as->parms[1].items; ti; ti = ti->next) { if (as->parms[2].items) { if (strlen(ti->data) > MAXHOSTCHARS - 3) { @@ -645,7 +645,7 @@ RemoveHost(struct cmd_syndesc *as, void *arock) afs_int32 code; struct cmd_item *ti; - tconn = GetConn(as, 0); + tconn = GetConn(as, 1); for (ti = as->parms[1].items; ti; ti = ti->next) { code = BOZO_DeleteCellHost(tconn, ti->data); if (code) @@ -769,7 +769,7 @@ RemoveKey(struct cmd_syndesc *as, void *arock) afs_int32 temp; struct cmd_item *ti; - tconn = GetConn(as, 0); + tconn = GetConn(as, 1); for (ti = as->parms[1].items; ti; ti = ti->next) { temp = atoi(ti->data); code = BOZO_DeleteKey(tconn, temp); @@ -831,7 +831,7 @@ AddSUser(struct cmd_syndesc *as, void *arock) struct cmd_item *ti; failed = 0; - tconn = GetConn(as, 0); + tconn = GetConn(as, 1); for (ti = as->parms[1].items; ti; ti = ti->next) { code = BOZO_AddSUser(tconn, ti->data); if (code) { @@ -851,7 +851,7 @@ RemoveSUser(struct cmd_syndesc *as, void *arock) int failed; failed = 0; - tconn = GetConn(as, 0); + tconn = GetConn(as, 1); for (ti = as->parms[1].items; ti; ti = ti->next) { code = BOZO_DeleteSUser(tconn, ti->data); if (code) { @@ -950,7 +950,7 @@ CreateServer(struct cmd_syndesc *as, void *arock) int i; char *type, *name, *notifier = NONOTIFIER; - tconn = GetConn(as, 0); + tconn = GetConn(as, 1); for (i = 0; i < 6; i++) parms[i] = ""; for (i = 0, ti = as->parms[3].items; (ti && i < 6); ti = ti->next, i++) { @@ -980,7 +980,7 @@ DeleteServer(struct cmd_syndesc *as, void *arock) struct cmd_item *ti; code = 0; - tconn = GetConn(as, 0); + tconn = GetConn(as, 1); for (ti = as->parms[1].items; ti; ti = ti->next) { code = BOZO_DeleteBnode(tconn, ti->data); if (code) { @@ -1002,7 +1002,7 @@ StartServer(struct cmd_syndesc *as, void *arock) struct cmd_item *ti; code = 0; - tconn = GetConn(as, 0); + tconn = GetConn(as, 1); for (ti = as->parms[1].items; ti; ti = ti->next) { code = BOZO_SetStatus(tconn, ti->data, BSTAT_NORMAL); if (code) @@ -1020,7 +1020,7 @@ StopServer(struct cmd_syndesc *as, void *arock) struct cmd_item *ti; code = 0; - tconn = GetConn(as, 0); + tconn = GetConn(as, 1); for (ti = as->parms[1].items; ti; ti = ti->next) { code = BOZO_SetStatus(tconn, ti->data, BSTAT_SHUTDOWN); if (code) @@ -1239,7 +1239,7 @@ GetLogCmd(struct cmd_syndesc *as, void *arock) int error; printf("Fetching log file '%s'...\n", as->parms[1].items->data); - tconn = GetConn(as, 0); + tconn = GetConn(as, 1); tcall = rx_NewCall(tconn); code = StartBOZO_GetLog(tcall, as->parms[1].items->data); if (code) { @@ -1313,7 +1313,7 @@ SalvageCmd(struct cmd_syndesc *as, void *arock) char * serviceName; /* parm 0 is machine name, 1 is partition, 2 is volume, 3 is -all flag */ - tconn = GetConn(as, 0); + tconn = GetConn(as, 1); /* find out whether fileserver is running demand attach fs */ if (IsDAFS(tconn)) { @@ -1652,7 +1652,7 @@ SetRestrict(struct cmd_syndesc *as, void *arock) struct rx_connection *tconn; afs_int32 code, val; - tconn = GetConn(as, 0); + tconn = GetConn(as, 1); util_GetInt32(as->parms[1].items->data, &val); code = BOZO_SetRestrictedMode(tconn, val); if (code) -- 1.7.1