Don't use denyusers/allowusers unless configured in msntauth.conf

Fixed a DoS condition.

diff --git a/helpers/basic_auth/MSNT/README.html b/helpers/basic_auth/MSNT/README.html
index 28a70e0edba9e73f75d96eef0e302b2a1e418e6a..5fec2982776823f2cae4b1d50cf75b0f468b35ad 100644 (file)
--- a/helpers/basic_auth/MSNT/README.html
+++ b/helpers/basic_auth/MSNT/README.html
@@ -173,7 +173,7 @@ the msntauth process receives a SIGHUP signal.
 
 <P>
 The denied user file is set using the 'denyusers' directive
-in msntauth.h.  The denied user file
+in msntauth.conf.  The denied user file
 contains a list of usernames in no particular structure or form.
 If the file does not exist, no users are denied.
 The file must be readable by the web proxy user.
@@ -191,7 +191,7 @@ allowed supposed to be accessing a proxy.
 
 <P>
 The allowed user file is set using the 'allowusers' directive
-in msntauth.h.
+in msntauth.conf.
 If the file does not exist or if empty, all users are allowed.
 
 <P>

diff --git a/helpers/basic_auth/MSNT/allowusers.c b/helpers/basic_auth/MSNT/allowusers.c
index 33ec88c0a7f96ad5a40bde97c53f56f51c9c1af7..c161dd527e6237012665b1ceeee0826f4bbc1448 100644 (file)
--- a/helpers/basic_auth/MSNT/allowusers.c
+++ b/helpers/basic_auth/MSNT/allowusers.c
@@ -30,7 +30,10 @@ Read_allowusers(void)
        memset(&AllowUsers, '\0', sizeof(AllowUsers));
        init = 1;
     }
-    return Read_usersfile(Allowuserpath, &AllowUsers);
+    if (*Allowuserpath)
+       return Read_usersfile(Allowuserpath, &AllowUsers);
+    else
+       return 0;
 }
 
 int

diff --git a/helpers/basic_auth/MSNT/confload.c b/helpers/basic_auth/MSNT/confload.c
index a7f1552b4aec6f411b1e02b78ecf5a4cf4618ada..5823a49e1f93fd9261a7351255674ee9b5628b38 100644 (file)
--- a/helpers/basic_auth/MSNT/confload.c
+++ b/helpers/basic_auth/MSNT/confload.c
@@ -27,8 +27,6 @@
 #define SYSCONFDIR "/usr/local/squid/etc"
 #endif
 #define CONFIGFILE   SYSCONFDIR "/msntauth.conf"
-#define DENYUSERSDEFAULT   SYSCONFDIR "/denyusers"
-#define ALLOWUSERSDEFAULT  SYSCONFDIR "/allowusers"
 
 /* Maximum number of servers to query. This number can be increased. */
 #define MAXSERVERS 5
@@ -69,8 +67,6 @@ OpenConfigFile(void)
     memset(ServerArray, '\0', sizeof(ServerArray));
     memset(Denyuserpath, '\0', MAXPATHLEN);
     memset(Allowuserpath, '\0', MAXPATHLEN);
-    strncpy(Denyuserpath, DENYUSERSDEFAULT, MAXPATHLEN - 1);
-    strncpy(Allowuserpath, ALLOWUSERSDEFAULT, MAXPATHLEN - 1);
 
     /* Open file */
     if ((ConfigFile = fopen(CONFIGFILE, "r")) == NULL) {

diff --git a/helpers/basic_auth/MSNT/denyusers.c b/helpers/basic_auth/MSNT/denyusers.c
index 661f5a7eb5e271e6ad041bc05c65990197caf538..fd44f2f3a6d0a0597e5c3c85b443d7a4d8b88585 100644 (file)
--- a/helpers/basic_auth/MSNT/denyusers.c
+++ b/helpers/basic_auth/MSNT/denyusers.c
@@ -31,7 +31,10 @@ Read_denyusers(void)
        memset(&DenyUsers, '\0', sizeof(DenyUsers));
        init = 1;
     }
-    return Read_usersfile(Denyuserpath, &DenyUsers);
+    if (*Denyuserpath)
+       return Read_usersfile(Denyuserpath, &DenyUsers);
+    else
+       return 0;
 }
 
 static void

diff --git a/helpers/basic_auth/MSNT/msntauth.c b/helpers/basic_auth/MSNT/msntauth.c
index 8b939eb20662f85b2484ce7136a24d2d19ecff47..5b018924006cdba02d8a2daa57430abe0f2e2388 100644 (file)
--- a/helpers/basic_auth/MSNT/msntauth.c
+++ b/helpers/basic_auth/MSNT/msntauth.c
@@ -53,6 +53,7 @@ main(int argc, char **argv)
     char username[256];
     char password[256];
     char wstr[256];
+    int err = 0;
 
     openlog("msnt_auth", LOG_PID, LOG_USER);
     setbuf(stdout, NULL);
@@ -89,8 +90,12 @@ main(int argc, char **argv)
        if (fgets(wstr, 255, stdin) == NULL)
            break;
        /* ignore this line if we didn't get the end-of-line marker */
-       if (NULL == strchr(wstr, '\n'))
-           break;
+       if (NULL == strchr(wstr, '\n')) {
+           err = 1;
+           continue;
+       }
+       if (err)
+           goto error;
 
        /*
         * extract username and password.
@@ -118,8 +123,11 @@ main(int argc, char **argv)
            puts("ERR");
        else if (QueryServers(username, password) == 0)
            puts("OK");
-       else
+       else {
+error:
            puts("ERR");
+       }
+       err = 0;
     }
 
     return 0;