diff options
| author | David Sommerseth <dazo@users.sourceforge.net> | 2009-10-04 23:13:06 +0200 |
|---|---|---|
| committer | David Sommerseth <dazo@users.sourceforge.net> | 2009-10-04 23:13:06 +0200 |
| commit | 53611ee129ab91c60f61a591b32e46bfac39abf7 (patch) | |
| tree | 30e660503318f20568282cd83f960acbd6c2f328 /plugin | |
| parent | 5a4b0d9ec4202e9a1f035b6d8df63535431f2cbb (diff) | |
| download | eurephia-53611ee129ab91c60f61a591b32e46bfac39abf7.tar.gz eurephia-53611ee129ab91c60f61a591b32e46bfac39abf7.tar.xz eurephia-53611ee129ab91c60f61a591b32e46bfac39abf7.zip | |
Restrict input data length for plug-in arguments from openvpn
This only affects functions related to MAC address and certificate depth
Diffstat (limited to 'plugin')
| -rw-r--r-- | plugin/eurephia.c | 4 | ||||
| -rw-r--r-- | plugin/firewall/eurephiafw.c | 15 |
2 files changed, 11 insertions, 8 deletions
diff --git a/plugin/eurephia.c b/plugin/eurephia.c index b571a59..f06c684 100644 --- a/plugin/eurephia.c +++ b/plugin/eurephia.c @@ -319,7 +319,7 @@ int eurephia_tlsverify(eurephiaCTX *ctx, const char **env, const char *depth) } // Check if certificate digest is blacklisted - tls_digest = (char *) get_env(ctx, 0, 60, env, "tls_digest_%s", depth); + tls_digest = (char *) get_env(ctx, 0, 60, env, "tls_digest_%i", atoi_nullsafe(depth)); if( eDBblacklist_check(ctx, attempt_CERTIFICATE, tls_digest) == 1 ) { eDBregister_attempt(ctx, attempt_IPADDR, ATTEMPT_REGISTER, ipaddr); eDBregister_attempt(ctx, attempt_CERTIFICATE, ATTEMPT_REGISTER, tls_digest); @@ -673,7 +673,7 @@ int eurephia_learn_address(eurephiaCTX *ctx, const char *mode, const char *macad char *fwprofile = NULL, *fwdest = NULL; int ret = 0, fw_enabled = 0; - DEBUG(ctx, 10, "** Function call: eurephia_learn_address(ctx, '%s', '%s', ...)", + DEBUG(ctx, 10, "** Function call: eurephia_learn_address(ctx, '%.10s', '%.18s', ...)", mode, macaddr); // Get firewall information diff --git a/plugin/firewall/eurephiafw.c b/plugin/firewall/eurephiafw.c index 2c6755f..deec3db 100644 --- a/plugin/firewall/eurephiafw.c +++ b/plugin/firewall/eurephiafw.c @@ -381,26 +381,29 @@ int eFW_UpdateFirewall(eurephiaCTX *ctx, int mode, memset(&buf, 0, 1026); switch( mode ) { case FWRULE_ADD: - eurephia_log(ctx, LOG_INFO, 3, "Function call: eFW_UpdateFirewall(ctx, %s, '%s', '%s', '%s')", + eurephia_log(ctx, LOG_INFO, 3, + "Function call: eFW_UpdateFirewall(ctx, %s, '%.18s', '%s', '%s')", "ADD", addr, fwdest, fwprofile); - snprintf(buf, 1024, "A %s %s %s", addr, fwdest, fwprofile); + snprintf(buf, 1024, "A %.18s %s %s", addr, fwdest, fwprofile); mq_send((*ctx->fwcfg).thrdata.msgq, buf, strlen(buf)+1, 1); return 1; case FWRULE_DELETE: - eurephia_log(ctx, LOG_INFO, 3, "Function call: eFW_UpdateFirewall(ctx, %s, '%s', '%s', '%s')", + eurephia_log(ctx, LOG_INFO, 3, + "Function call: eFW_UpdateFirewall(ctx, %s, '%.18s', '%s', '%s')", "DELETE", addr, fwdest, fwprofile); - snprintf(buf, 1024, "D %s %s %s", addr, fwdest, fwprofile); + snprintf(buf, 1024, "D %.18s %s %s", addr, fwdest, fwprofile); mq_send((*ctx->fwcfg).thrdata.msgq, buf, strlen(buf)+1, 1); return 1; case FWRULE_BLACKLIST: - eurephia_log(ctx, LOG_INFO, 3, "Function call: eFW_UpdateFirewall(ctx, %s, '%s','%s', NULL)", + eurephia_log(ctx, LOG_INFO, 3, + "Function call: eFW_UpdateFirewall(ctx, %s, '%.34s','%s', NULL)", "BLACKLIST", addr, fwdest); // Check if IP address is already registered as blacklisted if( (blchk = eGet_value(ctx->fwcfg->blacklisted, addr)) == NULL ) { - snprintf(buf, 1024, "B %s %s %s", addr, fwdest, ctx->fwcfg->fwblacklist_sendto); + snprintf(buf, 1024, "B %.34s %s %s", addr, fwdest, ctx->fwcfg->fwblacklist_sendto); mq_send((*ctx->fwcfg).thrdata.msgq, buf, strlen(buf)+1, 1); eAdd_value(ctx, ctx->fwcfg->blacklisted, addr, fwdest); } else { |