v2.2.2 ChangeLog

Fixes: https://github.com/yrutschle/sslh/issues/492

ChangeLog

@@ -1,3 +1,6 @@
+v2.2.2:
+	Fix potential vulnerability similar to CVE-2020-28935
+
 v2.2.1:
 	Added a boolean setting "is_unix" for listen and
 	protocol entries. This will use the 'host' setting

common.c

@@ -986,26 +986,48 @@ void drop_privileges(const char* user_name, const char* chroot_path)
     }
 }
 
+
+#ifndef O_NOFOLLOW
+#define O_NOFOLLOW 0
+#endif
+
 /* Writes my PID */
 void write_pid_file(const char* pidfile)
 {
-    FILE *f;
+    int fd;
-    int res;
+    char pidbuf[32];
+    size_t len, written = 0;
+    ssize_t res;
 
-    f = fopen(pidfile, "w");
+    /* Format PID as string */
-    if (!f) {
+    len = snprintf(pidbuf, sizeof(pidbuf), "%d\n", getpid());
+    if (len >= sizeof(pidbuf)) {
+        print_message(msg_system_error, "write_pid_file: PID string too long\n");
+        return;
+    }
+
+    /* Open file with O_NOFOLLOW to prevent symlink attacks (Similar to CVE-2020-28935) */
+    fd = open(pidfile, O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW ,0644);
+
+    if (fd == -1) {
         print_message(msg_system_error, "write_pid_file: %s: %s\n", pidfile, strerror(errno));
         return;
     }
 
-    res = fprintf(f, "%d\n", getpid());
+    /* Write PID to file with proper error handling */
-    if (res < 0) {
+    while (written < len) {
-        print_message(msg_system_error, "write_pid_file: fprintf: %s\n", strerror(errno));
+        res = write(fd, pidbuf + written, len - written);
+        if (res == -1) {
+            if (errno == EINTR || errno == EAGAIN)
+                continue;
+            print_message(msg_system_error, "write_pid_file: write: %s\n", strerror(errno));
+            break;
+        }
+        written += res;
     }
 
-    res = fclose(f);
+    /* Close file */
-    if (res == EOF) {
+    if (close(fd) == -1) {
-        print_message(msg_system_error, "write_pid_file: fclose: %s\n", strerror(errno));
+        print_message(msg_system_error, "write_pid_file: close: %s\n", strerror(errno));
-        return;
     }
 }

common.h

@@ -34,6 +34,10 @@
 #include <sys/capability.h>
 #endif
 
+#ifdef __APPLE__
+#include <AvailabilityMacros.h>
+#endif
+
 #include "config.h"
 #include "version.h"
 
@@ -182,6 +186,10 @@ extern struct sslhcfg_item cfg;
 extern struct addrinfo *addr_listen;
 extern const char* server_type;
 
+#if defined(__APPLE__) && (MAC_OS_X_VERSION_MIN_REQUIRED < 1080)
+extern int hosts_ctl();
+#endif
+
 /* sslh-fork.c */
 void start_shoveler(int);
 

proxyprotocol.c

@@ -20,6 +20,8 @@
 
 */
 
+#include "config.h"
+
 #ifdef HAVE_PROXYPROTOCOL
 
 #include <proxy_protocol.h>