[PATCH] http.c security
"Alexander Malysh" <[email protected]>
| Newsgroups | gmane.comp.mobile.kannel.devel |
|---|---|
| Message-ID | <[email protected]> |
Hi All, please find attached security bug fix for http.c. We have issue when we use keep alive connections with our connection pool. Just imagine such scenario without a patch: 1) http_start_request(..., ssl=0,certkeyfile=NULL,our_host=NULL) 2) http_start_request(..., ssl=1,certkeyfile=XYZ,our_host=XYZ) in (2) we will get from conn_pool_get connection from (1)! Votes please? -- Thanks, Alex
http-sec.diff
(application/octet-stream, 2 KB)
=== gwlib/http.c
==================================================================
--- gwlib/http.c (revision 241)
+++ gwlib/http.c (local)
@@ -768,9 +768,10 @@
}
-static inline Octstr *conn_pool_key(Octstr *host, int port)
+static inline Octstr *conn_pool_key(Octstr *host, int port, int ssl, Octstr *certfile, Octstr *our_host)
{
- return octstr_format("%S:%d", host, port);
+ return octstr_format("%S:%d:%d:%S:%S", host, port, ssl?1:0, certfile?certfile:octstr_imm(""),
+ our_host?our_host:octstr_imm(""));
}
@@ -784,7 +785,7 @@
do {
retry = 0;
- key = conn_pool_key(host, port);
+ key = conn_pool_key(host, port, ssl, certkeyfile, our_host);
mutex_lock(conn_pool_lock);
list = dict_get(conn_pool, key);
if (list != NULL)
@@ -843,7 +844,6 @@
return;
}
/* check if connection still ok */
- conn_wait(conn, 0);
if (conn_error(conn) || conn_eof(conn)) {
List *list;
mutex_lock(conn_pool_lock);
@@ -869,12 +869,12 @@
}
-static void conn_pool_put(Connection *conn, Octstr *host, int port)
+static void conn_pool_put(Connection *conn, Octstr *host, int port, int ssl, Octstr *certfile, Octstr *our_host)
{
Octstr *key;
List *list;
- key = conn_pool_key(host, port);
+ key = conn_pool_key(host, port, ssl, certfile, our_host);
mutex_lock(conn_pool_lock);
list = dict_get(conn_pool, key);
if (list == NULL) {
@@ -1077,9 +1077,9 @@
#ifdef USE_KEEPALIVE
if (trans->persistent) {
if (proxy_used_for_host(trans->host, trans->url))
- conn_pool_put(trans->conn, proxy_hostname, proxy_port);
+ conn_pool_put(trans->conn, proxy_hostname, proxy_port, trans->ssl, trans->certkeyfile, http_interface);
else
- conn_pool_put(trans->conn, trans->host, trans->port);
+ conn_pool_put(trans->conn, trans->host, trans->port, trans->ssl, trans->certkeyfile, http_interface);
} else
#endif
conn_destroy(trans->conn);