misc/jitterbug/patches/patch-ac

   1 $NetBSD$
   2
   3 Security patches for jitterbug (taken from Debian GNU/Linux).
   4 See http://www.debian.org/security/2004/dsa-420
   5
   6 --- new_message.c.orig  Wed Nov 11 13:30:17 1998
   7 +++ new_message.c       Wed Jan 14 17:34:04 2004
   8 @@ -206,6 +206,133 @@
   9         smtp_end_mail(fd);
  10  }
  11
  12 +/* This function should always return success */
  13 +static int mail_failure(char* from, char* to, char* content)
  14 +{
  15 +       int fd;
  16 +       fd = smtp_start_mail(from, to, NULL, NULL, "Request failed", strlen(content));
  17 +       if ( fd == -1 ) {
  18 +               fprintf(stderr, "Failed to send failure\n");
  19 +               return 0;
  20 +       }
  21 +       smtp_write(fd, "\n");
  22 +       smtp_write_data(fd, content);
  23 +       smtp_end_mail(fd);
  24 +       return 0;
  25 +}
  26 +
  27 +static int is_a_bug(char* name)
  28 +{
  29 +       if (*name >= '1' && *name <= '9')
  30 +               return !is_directory(name);
  31 +       return 0;
  32 +}
  33 +
  34 +static int get_bug(char *mbuf, char* to, char *query)
  35 +{
  36 +       int fd;
  37 +       char *from, *p;
  38 +       char *subject="Jitterbug results";
  39 +       char buf[1024];
  40 +       unsigned int size=0;
  41 +       char boundary[128];
  42 +       struct stat st;
  43 +       char *bug;
  44 +       char* msg_id;
  45 +       char *msg_list;
  46 +
  47 +       snprintf(boundary, sizeof(boundary), "jitterbug-burp-%d-%d", getpid(), time(NULL));
  48 +
  49 +       /* maybe check for lp_download? */
  50 +       /* maybe add info to audit? */
  51 +       from = lp_from_address();
  52 +
  53 +       while (*query && *query == ' ') query++;
  54 +       if (!strncmp(query, "list", 4)) {
  55 +               char** dir_l, **file_l;
  56 +               int i, j;
  57 +               query += 4;
  58 +               fd = smtp_start_mail(from, to, NULL, NULL, subject, 0);
  59 +               if ( fd == -1 )
  60 +                       return 1;
  61 +
  62 +               msg_id = getmailheader(mbuf, "Message-ID:", 0);
  63 +               if ( msg_id )
  64 +                       smtp_write(fd, "References: %s\n", msg_id);
  65 +               smtp_write(fd, "\nList for query: %s\n\n", query);
  66 +               trim_string(query, " ", " ");
  67 +               /* use strtok to allow multiple queries */
  68 +               if (!*query || *query == '/' || *query == '.') {
  69 +                       query = ".";
  70 +                       dir_l = load_dir_list(query, is_directory);
  71 +               } else {
  72 +                       dir_l = new_list();
  73 +                       add_list_item(dir_l, query);
  74 +               }
  75 +               for (i=0; dir_l && dir_l[i]; ++i) {
  76 +                       file_l = load_dir_list(dir_l[i], is_a_bug);
  77 +                       /* maybe add subject, from, ... */
  78 +                       for (j=0; file_l && file_l[j]; ++j)
  79 +                               smtp_write(fd, "%s/%s\n", dir_l[i], file_l[j]);
  80 +                       free_list(file_l);
  81 +               }
  82 +               free_list(dir_l);
  83 +               smtp_end_mail(fd);
  84 +               return 0;
  85 +       } else if (!strncmp(query, "get", 3)) {
  86 +               query += 3;
  87 +       } else if (!strncmp(query, "search", 6)) {
  88 +               query += 6;
  89 +               snprintf(buf, sizeof(buf), "Not implemeted (%s)\n", query);
  90 +               return mail_failure(from, to, buf);
  91 +       } else {
  92 +               snprintf(buf, sizeof(buf), "Not implemeted (%s)\n", query);
  93 +               return mail_failure(from, to, buf);
  94 +       }
  95 +
  96 +       fd = smtp_start_mail(from, to, NULL, NULL, subject, 0);
  97 +       if ( fd == -1 )
  98 +               return 1;
  99 +
 100 +       msg_id = getmailheader(mbuf, "Message-ID:", 0);
 101 +       if ( msg_id )
 102 +               smtp_write(fd, "References: %s\n", msg_id);
 103 +       smtp_write(fd, "Mime-Version: 1.0\n");
 104 +       smtp_write(fd, "Content-Type: multipart/mixed; boundary=%s\n\n", boundary);
 105 +       msg_list = strdup(query);
 106 +       for (query = strtok(msg_list, " \t,;"); query; query = strtok(NULL, " \t,;")) {
 107 +               smtp_write(fd, "\n--%s\nContent-Type: text/plain; charset=us-ascii\n", boundary);
 108 +               /* a few security checks */
 109 +               if (*query == '/' || strchr(query, '.') || !(p=strchr(query, '/'))) {
 110 +                       smtp_write(fd, "\nNot allowed (%s)\n", query);
 111 +                       continue;
 112 +               }
 113 +               *p = 0;
 114 +               if ( !is_directory(query) ) {
 115 +                       smtp_write(fd, "\nNot allowed (%s)\n", query);
 116 +                       continue;
 117 +               }
 118 +               *p = '/';
 119 +               bug = load_file(query, &st, 0);
 120 +               if ( !bug ) {
 121 +                       smtp_write(fd, "\nCannot load (%s)\n", query);
 122 +                       continue;
 123 +               }
 124 +               /* replace / with _ in filename */
 125 +               p = query;
 126 +               while(*p) {
 127 +                       if (*p == '/') *p = '_';
 128 +                       ++p;
 129 +               }
 130 +               smtp_write(fd, "Content-Disposition: attachment; filename=\"%s\"\n\n", query);
 131 +               smtp_write_data(fd, bug);
 132 +               free(bug);
 133 +       }
 134 +       free(msg_list);
 135 +
 136 +       smtp_end_mail(fd);
 137 +       return 0;
 138 +}
 139
 140  int process_mail(char *def_dir)
 141  {
 142 @@ -253,6 +380,10 @@
 143                 return 1;
 144         }
 145
 146 +       if (strncasecmp(from, "MAILER-DAEMON", 13) == 0) {
 147 +               fprintf(stderr,"Ignoring bounced mail\n");
 148 +               return 1;
 149 +       }
 150
 151         /* work out if it has an existing id */
 152         id = getid(mbuf);
 153 @@ -273,6 +404,12 @@
 154                 }
 155         }
 156
 157 +       subject = getmailheader(mbuf, "Subject:", 0);
 158 +       if (subject && !strncmp(subject, "GETBUG:", 7)) {
 159 +               unlink(".newnsg");
 160 +               return get_bug(mbuf, from, subject + 7);
 161 +       }
 162 +
 163         if (! *fname) {
 164                 char *idfile = load_file(".nextid", NULL, 0);
 165                 nextid=1;
 166 @@ -306,7 +443,6 @@
 167         }
 168
 169         /* forward to "forward public" if message not marked private */
 170 -       subject = getmailheader(mbuf, "Subject:", 0);
 171
 172         if (subject &&
 173             lp_forward_public() && !strstr(subject,"PRIVATE")) {