current cgi.c, 1.170, 1.171 loadcfg.c, 1.154, 1.155 project.h, 1.219, 1.220

Update of /cvsroot/ijbswa/current
In directory sfp-cvs-1.v30.ch3.sourceforge.com:/tmp/cvs-serv15213

Modified Files:
	cgi.c loadcfg.c project.h 
Log Message:
Add a 'trusted-cgi-referrer' directive

It allows to configure another page or site that can be used
to reach sensitive CGI ressources.

Example:
trusted-cgi-referer http://www.example.org/blafasel

Currently the parameter is a vanilla string (not a regular
expression) and has to match the beginning of the Referer
the client used to reach a harmful ressource.

Sponsored by: Robert Klemme


Index: project.h
===================================================================
RCS file: /cvsroot/ijbswa/current/project.h,v
retrieving revision 1.219
retrieving revision 1.220
diff -C2 -d -r1.219 -r1.220
*** project.h	23 Jan 2017 16:10:28 -0000	1.219
--- project.h	20 Feb 2017 13:44:32 -0000	1.220
***************
*** 1338,1341 ****
--- 1338,1346 ----
     const char *haddr[MAX_LISTENING_SOCKETS];
  
+    /** Trusted referring site that can be used to reach CGI
+      * pages that aren't marked as harmful.
+      */
+    const char *trusted_cgi_referrer;
+ 
     /** Ports to bind to.  Defaults to HADDR_PORT == 8118. */
     int         hport[MAX_LISTENING_SOCKETS];

Index: cgi.c
===================================================================
RCS file: /cvsroot/ijbswa/current/cgi.c,v
retrieving revision 1.170
retrieving revision 1.171
diff -C2 -d -r1.170 -r1.171
*** cgi.c	23 Jan 2017 16:12:18 -0000	1.170
--- cgi.c	20 Feb 2017 13:44:32 -0000	1.171
***************
*** 442,445 ****
--- 442,446 ----
     char *referrer;
     static const char alternative_prefix[] = "http://" CGI_SITE_1_HOST "/";
+    const char *trusted_cgi_referrer = csp->config->trusted_cgi_referrer;
  
     referrer = grep_cgi_referrer(csp);
***************
*** 460,463 ****
--- 461,476 ----
        return TRUE;
     }
+    else if ((trusted_cgi_referrer != NULL) && (0 == strncmp(referrer,
+             trusted_cgi_referrer, strlen(trusted_cgi_referrer))))
+    {
+       /*
+        * After some more testing this block should be merged with
+        * the previous one or the log level should bedowngraded.
+        */
+       log_error(LOG_LEVEL_INFO, "Granting access to %s based on trusted referrer %s",
+          csp->http->url, referrer);
+ 
+       return TRUE;
+    }
     else
     {

Index: loadcfg.c
===================================================================
RCS file: /cvsroot/ijbswa/current/loadcfg.c,v
retrieving revision 1.154
retrieving revision 1.155
diff -C2 -d -r1.154 -r1.155
*** loadcfg.c	27 Sep 2016 22:48:28 -0000	1.154
--- loadcfg.c	20 Feb 2017 13:44:32 -0000	1.155
***************
*** 169,172 ****
--- 169,173 ----
  #define hash_trust_info_url               430331967U /* "trust-info-url" */
  #define hash_trust_x_forwarded_for       2971537414U /* "trust-x-forwarded-for" */
+ #define hash_trusted_cgi_referrer        4270883427U /* "trusted-cgi-referrer" */
  #define hash_trustfile                     56494766U /* "trustfile" */
  #define hash_usermanual                  1416668518U /* "user-manual" */
***************
*** 258,261 ****
--- 259,263 ----
     freez(config->proxy_args);
     freez(config->usermanual);
+    freez(config->trusted_cgi_referrer);
  
  #ifdef FEATURE_TRUST
***************
*** 603,606 ****
--- 605,609 ----
  #endif
     config->trust_x_forwarded_for     = 0;
+    config->trusted_cgi_referrer      = NULL;
     /*
      * 128 client sockets ought to be enough for everybody who can't
***************
*** 1599,1602 ****
--- 1602,1617 ----
  
  /* *************************************************************************
+  * trusted-cgi-referrer http://www.example.org/some/path.html
+  * *************************************************************************/
+          case hash_trusted_cgi_referrer :
+             /*
+              * We don't validate the specified referrer as
+              * it's only used for string comparison.
+              */
+             freez(config->trusted_cgi_referrer);
+             config->trusted_cgi_referrer = strdup_or_die(arg);
+             break;
+ 
+ /* *************************************************************************
   * trustfile filename
   * (In confdir by default.)


------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot