isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,831 Commits 1 Branch 0 Tags
c341608072a33c74fa3e534e987d6d3513f19b51
Commit Graph

350 Commits

Author SHA1 Message Date
Todd C. Miller
a326411903 Use $(GREP) and $(EGREP) variables in Makefile.in files. 2022-09-12 16:30:52 -06:00
Todd C. Miller
f6e4d2765a Add explicit include of unistd.h for getopt(3) and related variables. 2022-07-05 11:35:25 -06:00
Todd C. Miller
b6151781ce Quiet some harmless PVS Studio warnings. 2022-06-29 10:08:55 -06:00
Todd C. Miller
54ed54d94e Use "unable to allocate memory" warning on malloc failure. 
This is consistent with the rest of the sudo source code.
 2022-06-29 10:00:03 -06:00
Todd C. Miller
3e21c8da5c Add missing PVS Studio Open Source comments. 
Also avoid checking protobuf-c source and protobuf-c generated files.
 2022-06-29 09:45:04 -06:00
Todd C. Miller
e5834bd405 Use #include <config.h> not #include "config.h" for consistency. 
Otherwise, some compilers may do the wrong thing in a build
dir if there is a config.h file in the source dir too.
 2022-06-29 08:47:16 -06:00
Todd C. Miller
13672f28df Make sudo pass -Wwrite-strings 2022-06-28 16:33:15 -06:00
Todd C. Miller
f5ac1317c4 Make sudo pass -Wmissing-prototypes 2022-06-27 12:48:03 -06:00
Todd C. Miller
161b01fccd Treat EINTR in a callback like we do EAGAIN. 
We shouldn't get EINTR in practice since we set SA_RESTART when
registering signal handlers but it doesn't hurt to be consistent.
 2022-06-07 09:25:07 -06:00
Todd C. Miller
db6fc237c4 If write(2) returns EAGAIN just re-enter the event loop. 
This is consistent with how we handle EAGAIN for read(2).
 2022-06-06 19:42:06 -06:00
Todd C. Miller
aee276ea63 Quiet two clang analyzer false positives. 2022-06-03 11:05:34 -06:00
Todd C. Miller
5012c7f978 union sockaddr_union: pass in sockaddr_union * instead of sockaddr *. 
This eliminates the need for a few casts and is consistent with how
create_listener() is written.
 2022-06-03 10:11:37 -06:00
Todd C. Miller
2d6b9d22e1 For logsrvd_conf_test include both tls and non-tls configs. 2022-06-02 11:38:43 -06:00
Todd C. Miller
d7b2ff3214 Add a simple regression test for logsrvd.conf parser. 
Unlike the parser fuzzer, this includes sample certs and keys.
This test would have detected the BIO_new_file() bug in set_dhparams().
 2022-06-02 11:13:18 -06:00
Todd C. Miller
0ca222aa88 Fix inverted logic when setting server_log. 
A value that starts with a '/' should be treated as a path.
 2022-06-02 10:59:30 -06:00
Todd C. Miller
15f167c3a0 Fix uninitialized use of ca_store when building with wolfSSL. 2022-05-27 11:23:45 -06:00
Todd C. Miller
38c6e1bffb Standardize protobuf "unable to unpack" warning messages. 2022-05-26 09:35:18 -06:00
Todd C. Miller
583e8bf538 Use explicit library dependencies instead of implicit. 
We now include all the dependent libraries when linking.
Fixes a linking problem on CentOS Stream 9.
 2022-05-19 17:01:14 -06:00
Todd C. Miller
69fa04f069 Include the cert or ca file in error messages where applicable. 2022-05-17 10:44:18 -06:00
Todd C. Miller
a82fe9aa06 Add missing include of string.h for strerror(3). 2022-05-17 09:31:22 -06:00
Todd C. Miller
d7df7abf87 If ERR_reason_error_string() returns NULL, fall back on strerror(errno). 
That way we get reasonable error messages for missing files, etc.
 2022-05-17 09:18:03 -06:00
Todd C. Miller
3ba807b70f set_dhparams: pass BIO_new_file() "r" for the file mode, not O_RDONLY. 
Unlike BIO_new_fp(), BIO_new_file() takes an fopen-style mode string.
 2022-05-17 08:38:49 -06:00
Todd C. Miller
c7ed03c986 sudo_logsrvd: update elapsed time for winsize and suspend in journal mode 
Fixes a bug in store-first relay mode where the commit point messages
sent by the server were incorrect.
 2022-04-24 17:26:05 -06:00
Todd C. Miller
dcb2fb26a5 Rename SSP_(C|LD)FLAGS -> HARDENING_(C|LD)FLAGS 2022-04-01 11:14:59 -06:00
Todd C. Miller
1f64aca229 Unset LANGUAGE when running tests, otherwise it may override LC_ALL. 
Bug #1025.
 2022-03-14 13:51:03 -06:00
Todd C. Miller
c131b27474 For 'make check-verbose' run fuzzers with -verbose=1 
This is the default for libFuzzer but not for the stub fuzzer lib.
 2022-03-03 10:45:56 -07:00
Todd C. Miller
cdee5d48da Add check-verbose Makefile target that runs tests in verbose mode. 2022-03-02 13:32:08 -07:00
Todd C. Miller
e703feeae2 sudo_regex_compile_v1 stub: set errstr on error 2022-02-25 14:07:22 -07:00
Todd C. Miller
590c4cf62f fuzz_logsrvd_conf: add stub version of sudo_regex_compile_v1(). 
We want to fuzz our parser, not the libc regular expression code.
 2022-02-25 10:13:34 -07:00
Todd C. Miller
8290a1e57a iolog_seekto: initialize struct timing_closure before using. 
Coverity CID 249977
 2022-02-23 20:47:18 -07:00
Todd C. Miller
2315c0b3bb iolog_rewrite: initialize struct timing_closure before using. 
Coverity CID 249971
 2022-02-23 20:17:58 -07:00
Todd C. Miller
41bc52302b Do not disable fuzzer output if SUDO_FUZZ_VERBOSE env variable is set. 2022-02-22 12:04:10 -07:00
Todd C. Miller
3c1ce4bf72 store_iobuf_local: fix potential double free on the error path. 2022-02-10 13:33:24 -07:00
Todd C. Miller
c4e67624e3 Add missing default return in last commit. 2022-02-03 10:24:10 -07:00
Todd C. Miller
d18ee79354 sudo_logsrvd: make sure journal exists before writing the alert message. 
Fixes a potential NULL dereference when journaling an alert message.
 2022-02-03 10:19:40 -07:00
Todd C. Miller
6564f1ae4c Work around a glibc regcomp() bug with repeated '+' operators. 
Glibc regcomp() has a bug where it uses excessive memory for repeated
'+' ops.  Collapse them to avoid running the fuzzer out of memory.
 2022-02-01 13:12:19 -07:00
Todd C. Miller
ac555d454f Rebase seed corpus on updated sudo_logsrvd.conf example. 2022-02-01 13:10:05 -07:00
Todd C. Miller
ad719d06be Fix parsing of "retry_interval" in the relay section. 
The setting was present but the callback was missing so it could
not be parsed in the conf file.
 2022-02-01 13:08:40 -07:00
Todd C. Miller
2df2276d56 Use TIME_T_MAX as the upper limit when parsing timeouts. 2022-02-01 13:07:27 -07:00
Todd C. Miller
be4d62e9a4 Check for garbage after [section] in sudo_logsrvd.conf. 2022-01-29 10:50:03 -07:00
Todd C. Miller
9303aec0de Sync fuzzing dictionary with current configuration keyword list. 2022-01-29 10:30:37 -07:00
Todd C. Miller
9b93961b3e Add new log_passwords and passprompt_regex settings. 
When logging terminal input, if log_passwords is false and any
of the regular expressions in the passprompt_regex list are found
in the terminal output, terminal input will be replaced with '*'
characters until a newline or carriage return is found in the input
or an output character is received.
 2022-01-28 08:52:42 -07:00
Todd C. Miller
c13b21c199 Avoid TOCTOU in sudo_mkdir_parents() using openat(2) and mkdirat(2). 
This also allows us to make path const as it should be.
 2021-12-11 08:35:18 -07:00
Todd C. Miller
09b82a22ca Add configure check for sha1sum and use "openssh dgst -sha1" if missing. 
Only needed when building the seed corpus zip files.
 2021-11-10 13:31:42 -07:00
Todd C. Miller
7c4c61be0f Use iolog_openat() when opening the log.json file in the I/O log dir. 2021-10-27 07:45:22 -06:00
Todd C. Miller
ed13faf9f6 Use BIO_new_file() not BIO_new_fd() to read dhparams file. 
Older versions of OpenSSL and wolfSSL lack BIO_new_fd().
Also explicitly include openssl/bio.h and openssl/dh.h for wolfSSL.
 2021-10-26 19:26:20 -06:00
Todd C. Miller
cc6157d7d4 Add support for WolfSSL's OpenSSL compatibility layer. 
Based on changes from Hayden Roche
 2021-10-25 13:17:57 -06:00
Todd C. Miller
87c1dd9d7d Move include of log_server.pb-c.h into logsrvd.h and sendlog.h 
This way there is no include file order issue with the
PROTOBUF_C_VERSION_NUMBER check.
 2021-10-25 12:25:24 -06:00
Todd C. Miller
8a9c8794d0 Use SSL_FILETYPE_PEM with SSL_CTX_use_PrivateKey_file, not X509_FILETYPE_PEM 
While they are defined to the same value in OpenSSL one should not
rely on this.
 2021-10-24 14:47:49 -06:00
Todd C. Miller
e73e9d5e47 sudo_sendlog: send runenv, rungid and runuid from log.json too 
With this change, sudo_sendlog can now round-trip sudo-style I/O
logs that use the newer log.json format without losing any information.
 2021-10-23 09:04:26 -06:00