Commit 69b4f123 authored by Lev Walkin's avatar Lev Walkin

remove inconsequential webcgi subproject

parent 5df59a52
......@@ -29,10 +29,6 @@
/asn1c/tests/Makefile
/asn1c/tests/test-*
# /asn1c/webcgi/
/asn1c/webcgi/Makefile
/asn1c/webcgi/asn1c-suid-helper
# /doc/
/doc/Makefile
......
......@@ -11,6 +11,7 @@
* ENUMERATED extension values check relaxed. Reported by Gabriel Burca.
* Fixed decimal decoding of REAL values in -fnative-types mode
(Severity: medium; Security impact: medium)
* Removed webcgi subproject (introduced in 2004) as inconsequential.
0.9.22: 2008-Nov-19
......
SUBDIRS = . webcgi tests
SUBDIRS = . tests
AM_CFLAGS = @ADD_CFLAGS@
AM_CPPFLAGS = \
......
......@@ -263,7 +263,7 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
SUBDIRS = . webcgi tests
SUBDIRS = . tests
AM_CFLAGS = @ADD_CFLAGS@
AM_CPPFLAGS = \
-I${top_srcdir}/libasn1compiler \
......
dist_noinst_SCRIPTS = asn1c.cgi
noinst_PROGRAMS = asn1c-suid-helper
This diff is collapsed.
This is the source of the CGI-based Web wrapper around asn1c compiler.
To install, execute the following steps in this directory
CGIDIR=/path/where/webserver/CGIs/are/stored
make # Ensure the binary files are built
cp asn1c.cgi asn1c-suid-helper $CGIDIR
chgrp www $CGIDIR/asn1c-suid-helper # Or whatever Web server has
chown root $CGIDIR/asn1c-suid-helper
chmod 4550 $CGIDIR/asn1c-suid-helper # Make it setuid
# edit the $CGIDIR/asn1c.cgi to set up a few preferences
# in the beginning of that Perl script.
The chmod command makes the asn1c-suid-helper program setuid.
The asn1c-suid-helper is a tiny wrapper (look in the asn1c-suid-helper.c),
which has the single purpose of running the asn1c compiler under extremely
strict environment.
The root uid and 4555 mode actually _raise_ security of the whole ASN.1 CGI
system, so don't worry.
If you're still uncertain, just go read the source code, it's only a page long.
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>
#include <sysexits.h>
#ifdef _WIN32
#define setuid(s)
#define getuid()
#define setgid(s)
#define getgid()
#define chroot(p) (-1)
#endif
/*
* This program chroots into a given directory,
* then executes the asn1c command with strict arguments checking.
*/
int
main(int ac, char **av) {
char cmdPath[32];
char *envp[] = { NULL }; /* Empty environment */
int ret;
int i;
if(ac < 4) {
setgid(getgid());
setuid(getuid());
fprintf(stderr,
"Usage: %s <chroot-to> <chdir-to> <command> [options]\n",
av[0]);
exit(EX_USAGE);
}
ret = chroot(av[1]);
/* Drop the privileges */
setgid(getgid());
setuid(getuid());
if(ret != 0) {
fprintf(stderr, "chroot(\"%s\") failed: %s\n",
av[1], strerror(errno));
exit(EX_OSERR);
}
if(chdir(av[2]) != 0) {
fprintf(stderr, "chdir(\"%s\") failed: %s\n",
av[2], strerror(errno));
exit(EX_OSERR);
}
if(ac > 64) {
fprintf(stderr, "Insecure number of arguments: %d\n", ac);
exit(EX_DATAERR);
}
/*
* Add an argument if this is an asn1c compiler.
*/
if(strcmp(av[3], "asn1c") == 0) {
ac -= 2;
av += 2;
av[0] = "asn1c";
av[1] = "-S/skeletons";
i = 2;
strcpy(cmdPath, "/bin/asn1c");
} else {
ac -= 3;
av += 3;
i = 0;
}
if(strlen(av[0]) > sizeof(cmdPath)/2) {
fprintf(stderr, "Insecure command name: %s\n", av[0]);
exit(EX_DATAERR);
}
memcpy(cmdPath, "/bin/", 5);
strcpy(cmdPath + 5, av[0]);
/*
* Check arguments for the permitted alphabet constraints.
*/
for(; i < ac; i++) {
char *p;
for(p = av[i];; p++) {
switch(*p) {
case '0' ... '9': case 'A' ... 'Z': case 'a' ... 'z':
case '.': case '_': case '-': case '=':
continue;
case '\0':
default:
break;
}
break;
}
if(*p || (p - av[i]) > 250) {
fprintf(stderr, "Insecure argument %d\n", i);
exit(EX_DATAERR);
}
}
execve(cmdPath, av, envp);
perror(cmdPath);
exit(EX_UNAVAILABLE);
}
This diff is collapsed.
......@@ -13969,7 +13969,7 @@ fi
done
ac_config_files="$ac_config_files skeletons/standard-modules/Makefile skeletons/tests/Makefile libasn1compiler/Makefile libasn1parser/Makefile libasn1print/Makefile asn1c/webcgi/Makefile asn1c/tests/Makefile libasn1fix/Makefile doc/docsrc/Makefile skeletons/Makefile examples/Makefile tests/Makefile asn1c/Makefile doc/Makefile asn1c.spec Makefile"
ac_config_files="$ac_config_files skeletons/standard-modules/Makefile skeletons/tests/Makefile libasn1compiler/Makefile libasn1parser/Makefile libasn1print/Makefile asn1c/tests/Makefile libasn1fix/Makefile doc/docsrc/Makefile skeletons/Makefile examples/Makefile tests/Makefile asn1c/Makefile doc/Makefile asn1c.spec Makefile"
cat >confcache <<\_ACEOF
# This file is a shell script that caches the results of configure
......@@ -14867,7 +14867,6 @@ do
"libasn1compiler/Makefile") CONFIG_FILES="$CONFIG_FILES libasn1compiler/Makefile" ;;
"libasn1parser/Makefile") CONFIG_FILES="$CONFIG_FILES libasn1parser/Makefile" ;;
"libasn1print/Makefile") CONFIG_FILES="$CONFIG_FILES libasn1print/Makefile" ;;
"asn1c/webcgi/Makefile") CONFIG_FILES="$CONFIG_FILES asn1c/webcgi/Makefile" ;;
"asn1c/tests/Makefile") CONFIG_FILES="$CONFIG_FILES asn1c/tests/Makefile" ;;
"libasn1fix/Makefile") CONFIG_FILES="$CONFIG_FILES libasn1fix/Makefile" ;;
"doc/docsrc/Makefile") CONFIG_FILES="$CONFIG_FILES doc/docsrc/Makefile" ;;
......
......@@ -70,7 +70,6 @@ skeletons/tests/Makefile \
libasn1compiler/Makefile \
libasn1parser/Makefile \
libasn1print/Makefile \
asn1c/webcgi/Makefile \
asn1c/tests/Makefile \
libasn1fix/Makefile \
doc/docsrc/Makefile \
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment