summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* uci: manually clear uci_ptr flags after uci_delete() operationsopenwrt-19.07Jo-Philipp Wich2021-01-171-1/+5
| | | | | | | | | | | This is required to avoid potential use-after-free errors through the uci_set()->uci_delete()->uci_expand_ptr() call chain when passing zero-length strings as values. Ref: https://bugs.openwrt.org/index.php?do=details&task_id=3528 Suggested-by: olegio170 <olegios170@gmail.com> Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit d3f2041f4363e76fda57dd6b581eb71cf1a0e114)
* uci: reset uci_ptr flags when merging options during section addJo-Philipp Wich2020-05-261-0/+1
| | | | | | Fixes: FS#3126 Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit 078bb57e0769c987c05244abe1f7d8d53e0e323e)
* session: deny access if password login is disabledFabian Bläse2020-05-261-1/+1
| | | | | | | | | | | | | | | | | | | | | The special characters '!' and '*' in /etc/shadow are used to disable password login for a specific account. The character 'x' has no special meaning, but should not be interpreted as an empty password. However, rpcd did treat these special characters like no password was set, which allows access even though the account is disabled. By removing the additional checks for these characters, the encrypted password string is passed to crypt, which returns NULL if the salt has an invalid format and therefore access is denied. Fixes: FS#2634 Signed-off-by: Fabian Bläse <fabian@blaese.de> (cherry picked from commit 3df62bcebd2caff47506ccffb42df8d2d2123c06)
* file: extend exec acl checks to commands with argumentsJo-Philipp Wich2019-12-111-2/+28
| | | | | | | | | | | | | | | | | | | When the initial exec permission check on the executable path fails, concatenate the command line with spaces and use the resulting string as lookup path for a second exec permission check. This allows for exec acls similar to this example: "file": { "/usr/bin/program --flag --option=1 arg *": [ "exec" ] } The example above would allow executing `/usr/bin/program` with the arguments `--flag`, `--option=1` and `arg` in exactly this order, followed by any number of optional arguments as denoted by the asterisk. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* plugin: avoid truncating numeric valuesJo-Philipp Wich2019-11-101-2/+72
| | | | | | | When parsing the JSON output of exec plugins, store integer values exceeding 32bit value limits as 64bit integer blob values. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* plugin: fix double free in finish callbackJo-Philipp Wich2019-10-291-1/+0
| | | | | Fixes: 37aa919 ("plugin: fix leaking invoked method name for exec plugins") Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* main: exec_self: make clang analyzer happyYousong Zhou2019-10-291-3/+8
| | | | | | | | | Prevent a theoretical leak of the args memory when the executable path cannot be found. Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com> [fix whitespace, commit description] Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* file: exec: properly free memory on errorYousong Zhou2019-10-291-3/+18
| | | | | | Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com> [fix whitespace] Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* uci: free configs list memory on returnYousong Zhou2019-10-291-0/+4
| | | | | | Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com> [fix whitespace] Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* exec: always call finish_cb to allow plugin to free up memoryYousong Zhou2019-10-291-5/+5
| | | | | | Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com> [fix whitespace, subject typo] Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* plugin: do not free method name separatelyJo-Philipp Wich2019-10-291-4/+1
| | | | | | | | | A previous commit changed the allocation method for the call context to include the method name string memory directly, so we must not treat the method member separately anymore. Fixes: 37aa919 ("plugin: fix leaking invoked method name for exec plugins") Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* exec: properly free memory on rpc_exec() errorYousong Zhou2019-10-292-4/+12
| | | | | | Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com> [fix whitespace] Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* plugin: exec: properly free memory on parse errorYousong Zhou2019-10-291-2/+7
| | | | Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* uci: reset uci_ptr flags when merging set operationsJo-Philipp Wich2019-10-291-0/+1
| | | | | | | | | | | | | | | | In some cases, e.g. when subsequently setting multiple empty option values, uci_set() might free the section pointer of the given reused uci_ptr structure without zeroing it, leading to a use-after-free on processing subsequent options. Avoid this issue by clearing the lookup pointer flags in order to prevent uci_set() from incorrectly branching into a uci_delete() operation leading to the freeing of the section member. Ref: http://lists.infradead.org/pipermail/openwrt-devel/2019-October/019592.html Reported-by: Daniel Danzberger <daniel@dd-wrt.com> Suggested-by: Yousong Zhou <yszhou4tech@gmail.com> Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* plugin: fix leaking invoked method name for exec pluginsJo-Philipp Wich2019-10-171-3/+3
| | | | | | | | | | | The invoked method name was separately duplicated from the call_context structure. The structure itself is eventually freed by rpc_exec_reply() but the method string it points to is lost after that. Use calloc_a() instead to allocate the string copy buffer together with the context structure, to ensure that all involved memory is freed. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* file: increase minimum read buffer size to 4096 bytesJo-Philipp Wich2019-09-211-1/+1
| | | | | | | Some sysfs or proc files contain more than 128 byte of data, e.g. the /proc/filesystems or /proc/mounts files. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* iwinfo: add WPA3 supportJo-Philipp Wich2019-09-091-10/+10
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* file: refactor message parsing and permission checkingJo-Philipp Wich2019-09-081-80/+43
| | | | | | | | | | | | | | Refactor rpc_check_path() and wrap it with a macro to allow passing different policies and permission names. This allows using the function for non-read operations and simplifies the message parsing code there. Also change the stat and list methods to require "list" instead of "read" permissions which is useful to allow browing the filesystem without allowing read access to all files. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* iwinfo: expose all rate info fields in assoclist replyJo-Philipp Wich2019-09-041-8/+22
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* sys: fix symbol redeclarationJo-Philipp Wich2019-09-041-2/+2
| | | | | Fixes: 27c24c7 ("rpcd: sys: actually move timespec declaration") Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* rpcd: sys: actually move timespec declarationJo-Philipp Wich2019-09-031-1/+1
| | | | | | | | Move the timespec declaration to the function header, as mentioned in commit "rpcd: Switch to nanosleep". Fixes: 604db20 ("rpcd: Switch to nanosleep") Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* file: add remove operationJo-Philipp Wich2019-09-031-6/+88
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* rpcd: Switch to nanosleepRosen Penev2019-09-031-1/+2
| | | | | | | | | | | | usleep has been deprecated by POSIX.1-2001 and removed in POSIX.1-2008. Fixes compilation when libc does not include usleep (optional with uClibc-ng). nanosleep also has the advantage of being more accurate. Signed-off-by: Rosen Penev <rosenp@gmail.com> [move timespec definition to the top of the function] Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* file: add path based read/write/exec ACL checksJo-Philipp Wich2019-09-011-20/+156
| | | | | | | | | | | | | | | | | | | | | | | | Introduce ACL checks to verify that the requested path may be read, written or executed. This allows to restrict ubus file commands to specific paths. To setup the required ACLs, the following ubus command may be used on the command line: ubus call session grant '{ "ubus_rpc_session": "d41d8cd98f00b204e9800998ecf8427e", "scope": "file", "objects": [ [ "/etc", "read" ], [ "/etc/*", "write" ], [ "/sbin/sysupgrade", "exec" ] ] }' The "read", "list", "stat" and "md5" procedures require "read" permissions, the "write" procedure requires "write" permission and the "exec" procedure requires "exec" permissions. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* file: add stat() information to directory listingsJo-Philipp Wich2019-09-011-24/+41
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* Fix possible linker errors by using CMake find_library macroPetr Štetiar2019-06-051-4/+9
| | | | | | | | | | Fixes following errors while compiling natively on x86: cc -fPIC -shared -o rpcsys.so sys.c.o -lubox -lubus ld: cannot find -lubox ld: cannot find -lubus Signed-off-by: Petr Štetiar <ynezz@true.cz>
* session: handle NULL return values of crypt()Jo-Philipp Wich2019-05-221-1/+1
| | | | | | | | | | | | The crypt() function may return NULL with errno ENOSYS when an attempt was made to crypt the plaintext password using a salt requesting an unsupported cipher. Avoid triggering segmentation faults in the subsequent strcmp() operation by checking for a non-NULL hash value. Fixes: FS#2291 Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* iwinfo: add mesh infos in assoclist.Daniel Danzberger2019-03-051-0/+7
| | | | Signed-off-by: Daniel Danzberger <daniel@dd-wrt.com>
* iwinfo: add survey.Daniel Danzberger2019-03-051-0/+40
| | | | Signed-off-by: Daniel Danzberger <daniel@dd-wrt.com>
* iwinfo: show more stats from assoclist.Daniel Danzberger2019-03-051-0/+16
| | | | Signed-off-by: Daniel Danzberger <daniel@dd-wrt.com>
* file: avoid closing stdio descriptors in rpc_file_exec_runJo-Philipp Wich2018-12-211-5/+12
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* file: patch process stdin to /dev/nullJo-Philipp Wich2018-12-211-1/+8
| | | | | | | | This prevents broken pipe errors in executed child processes that attempt to access stdin. Suggested-by: Vytautas Virvičius <vy.virvicius@gmail.com> Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* file: remove unused members from struct rpc_file_exec_contextJo-Philipp Wich2018-12-211-4/+0
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* file: rpc_file_exec_run: fix potential memory leak and integer overflowJo-Philipp Wich2018-12-211-4/+16
| | | | | | | | | | | - Store the realloc result in a separate pointer so that we can free the original on allocation failure - Use an explicit uint8_t for the argument vector length instead of "char" which might be signed or unsigned, depending on the arch - Bail out with an invalid argument error if the argument vector exceeds 255 items Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* file: access exec timeout via daemon ops structureJo-Philipp Wich2018-11-281-1/+5
| | | | | | | | Since the plugin is not linked, but dlopen()'d with RTLD_LOCAL, we cannot access global rpcd variables but need to access them via the common ops structure symbol. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* plugin: store pointer to exec timeout value in the ops structureJo-Philipp Wich2018-11-282-0/+2
| | | | | | | | This is required for plugins that need access to the configured execution timeout. The global variable cannot be used as-is since we dlopen() with RTLD_LOCAL. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* treewide: rename exec_timeout to rpc_exec_timeoutJo-Philipp Wich2018-11-284-6/+6
| | | | | | Rename the extern int to denote a global symbol. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* main: fix logic bug when not specifying a timeout optionJo-Philipp Wich2018-11-221-4/+2
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* file: use global exec timeout instead of own hardcoded limitJo-Philipp Wich2018-11-221-2/+1
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* exec: increase maximum execution time to 120sJo-Philipp Wich2018-11-223-3/+19
| | | | | | | Increase the maximum possible execution time to 120 seconds and add a new command line flag `-t` which allows overwriting the default value. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* uci: tighten uci reorder operation error handlingJo-Philipp Wich2018-08-091-3/+15
| | | | | - Return UBUS_STATUS_INVALID_ARGUMENT for invalid section names - Return UBUS_STATUS_NOT_FOUND if a section name could not be resolved
* uci: tighten uci delete operation error handlingJo-Philipp Wich2018-08-091-10/+33
| | | | | | | - Return UBUS_STATUS_NOT_FOUND if no object could be resolved for delete - Return UBUS_STATUS_INVALID_ARGUMENT for invalid section names or types Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* uci: tighten uci set operation error handlingJo-Philipp Wich2018-08-091-14/+45
| | | | | | | - Return UBUS_STATUS_NOT_FOUND if no section could be resolved for set - Return UBUS_STATUS_INVALID_ARGUMENT if unserializable values are found Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* uci: tighten uci add operation error handlingJo-Philipp Wich2018-08-091-9/+40
| | | | | | | - Return UBUS_STATUS_INVALID_ARGUMENT for invalid section or option names - Return UBUS_STATUS_NOT_FOUND if a section name could not be resolved Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* uci: reject invalid section and option namesJo-Philipp Wich2018-08-081-0/+74
| | | | | | | | | | | | The invoked libuci functions do not reliably check their arguments, causing malformed section and option names to end up in the delta file, letting the uci cli and other components to segfault when processung such invalid entries. In order to prevent that, manually test received values before passing them on to libuci. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* uci: fix memory leak in rpc_uci_replace_savedir()Jo-Philipp Wich2018-05-131-1/+5
| | | | | | | | | | | | The rpc_uci_replace_savedir() function did not take into account that libuci uci_set_savedir() does an additional implicit uci_strdup() of the directory path string when appending a new delta directory item. Due to this oversight, only the struct uci_element items got freed, but not the duplicated path string, leading to leaking memory when invoking the uci api with session id argument. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* exec: close stdout and stderr streams on child signalJo-Philipp Wich2018-05-081-0/+6
| | | | | | | This prevents timing out ubus call when the child invokes further detached childs inheriting stdio descriptors. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* uci: use correct sort index when reordering sectionsJo-Philipp Wich2018-04-281-1/+1
| | | | | | | | | When reordering, the section indexes must be 0-based while the current implementation incorrectly numbers starting with 1. Fix this by start numbering ther sections with index 0. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* uci: fix memory leak in rpc_uci_apply_timeout()Jo-Philipp Wich2018-04-201-0/+2
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* uci: switch to proper save directory on apply/rollbackJo-Philipp Wich2018-04-201-35/+49
| | | | | | | | | | | | | | | The existing code failed to set the uci cursor save directory to the current session path, causing the apply routine to either fail or to merge settings from unrelated neighboring sessions, potentially leaking data. Solve the issue by switching the uci cursor save directory to the session directory before performing the actual apply actions. Additionally set the save directory path to "/dev/null" during rollback, to avoid merging unrelated system wide uci changes when restoring configs from the snapshot directory. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
View Lorry Controller Status