bughz/tinyproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

(check_allowed_connect_ports): By default DENY any CONNECT requests

Browse Source 
unless explicitly allowed by a configuration directive.
This commit is contained in:
Robert James Kaes 2004-08-12 20:15:04 +00:00
parent 28dd133623
commit b3943c21f2
1 changed files with 9 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/reqs.c
View File

@ -1,4 +1,4 @@
/* $Id: reqs.c,v 1.115 2004-08-12 19:57:15 rjkaes Exp $ /* $Id: reqs.c,v 1.116 2004-08-12 20:15:04 rjkaes Exp $
* *
* This is where all the work in tinyproxy is actually done. Incoming * This is where all the work in tinyproxy is actually done. Incoming
* connections have a new child created for them. The child then * connections have a new child created for them. The child then
@ -111,7 +111,6 @@ add_connect_port_allowed(int port)
* *
* Returns: 1 if allowed * Returns: 1 if allowed
* 0 if denied * 0 if denied
* negative upon error
*/ */
static int static int
check_allowed_connect_ports(int port) check_allowed_connect_ports(int port)
@ -120,18 +119,15 @@ check_allowed_connect_ports(int port)
int *data; int *data;
/* /*
* If the port list doesn't exist, allow everything. This might need * A port list is REQUIRED for a CONNECT request to function
* to be changed in the future. * properly. This closes a potential security hole.
*/ */
if (!ports_allowed_by_connect) if (!ports_allowed_by_connect)
return 1; return 0;
for (i = 0; i != vector_length(ports_allowed_by_connect); ++i) { for (i = 0; i != vector_length(ports_allowed_by_connect); ++i) {
data = vector_getentry(ports_allowed_by_connect, i, NULL); data = vector_getentry(ports_allowed_by_connect, i, NULL);
if (!data) if (data && *data == port)
return -1;
if (*data == port)
return 1; return 1;
} }
@ -762,7 +758,7 @@ process_request(struct conn_s *connptr, hashmap_t hashofheaders)
} }
/* Verify that the port in the CONNECT method is allowed */ /* Verify that the port in the CONNECT method is allowed */
if (check_allowed_connect_ports(request->port) <= 0) { if (!check_allowed_connect_ports(request->port)) {
indicate_http_error(connptr, 403, "Access violation", indicate_http_error(connptr, 403, "Access violation",
"detail", "The CONNECT method not allowed " \ "detail", "The CONNECT method not allowed " \
"with the port you tried to use.", "with the port you tried to use.",