-
Notifications
You must be signed in to change notification settings - Fork 1.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[TACACS+]: Extract tacacs support functions into library and fix memory leak issue. #8659
Merged
Merged
Changes from 12 commits
Commits
Show all changes
13 commits
Select commit
Hold shift + click to select a range
00e9867
[TACACS+]: Add TACACS support library and fix memory leak issue.
liuh-80 2f636c5
Improve PR.
liuh-80 2648dcd
Merge remote-tracking branch 'origin/master' into dev/liuh/tac_suppor…
liuh-80 bb9fec3
Add setting flag for authorization and accounting.
liuh-80 7022bb3
Fix source address code issue..
liuh-80 19f27fa
Fix trailing whitespace.
liuh-80 8e3d88f
Fix apply patch issue.
liuh-80 b30ace5
Fix secret key issue.
liuh-80 761c1cf
Improve patch file.
liuh-80 14ea9aa
Fix PR comments.
liuh-80 140e4d4
Improve patches.
liuh-80 15168a1
Fix PR comments.
liuh-80 a0911fa
Fix tab issue in patch file.
liuh-80 File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
124 changes: 124 additions & 0 deletions
124
src/tacacs/pam/0007-Fix-memory-leak-when-parse-configuration.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,124 @@ | ||
| From 99eeeccd14c905b7ad77210343bb07334eb0e8d1 Mon Sep 17 00:00:00 2001 | ||
| From: liuh-80 <58683130+liuh-80@users.noreply.github.com> | ||
| Date: Tue, 12 Oct 2021 10:05:28 +0800 | ||
| Subject: [PATCH 2/4] Fix memory leak when parse configuration. | ||
liuh-80 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| The fix code in this patch are copy from upstream project: https://github.com/kravietz/pam_tacplus/blob/master/support.c | ||
|
|
||
| --- | ||
| pam_tacplus.c | 6 ++++-- | ||
| support.c | 37 +++++++++++++++++++++++++++++++++---- | ||
| support.h | 2 +- | ||
| 3 files changed, 38 insertions(+), 7 deletions(-) | ||
|
|
||
| diff --git a/pam_tacplus.c b/pam_tacplus.c | ||
| index 9fc6be7..d062359 100644 | ||
| --- a/pam_tacplus.c | ||
| +++ b/pam_tacplus.c | ||
| @@ -323,7 +323,8 @@ int pam_sm_authenticate (pam_handle_t * pamh, int flags, | ||
| status = PAM_SUCCESS; | ||
| communicating = 0; | ||
| active_server.addr = tac_srv[srv_i].addr; | ||
| - active_server.key = tac_srv[srv_i].key; | ||
| + /* copy secret to key */ | ||
| + snprintf(active_server.key, sizeof(active_server.key), "%s", tac_srv[srv_i].key); | ||
|
|
||
| if (ctrl & PAM_TAC_DEBUG) | ||
| syslog(LOG_DEBUG, "%s: active srv %d", __FUNCTION__, srv_i); | ||
| @@ -820,7 +821,8 @@ int pam_sm_chauthtok(pam_handle_t * pamh, int flags, | ||
| communicating = 0; | ||
|
|
||
| active_server.addr = tac_srv[srv_i].addr; | ||
| - active_server.key = tac_srv[srv_i].key; | ||
| + /* copy secret to key */ | ||
| + snprintf(active_server.key, sizeof(active_server.key), "%s", tac_srv[srv_i].key); | ||
|
|
||
| if (ctrl & PAM_TAC_DEBUG) | ||
| syslog(LOG_DEBUG, "%s: active srv %d", __FUNCTION__, srv_i); | ||
| diff --git a/support.c b/support.c | ||
| index 164df62..e22fa31 100644 | ||
| --- a/support.c | ||
| +++ b/support.c | ||
| @@ -30,7 +30,12 @@ | ||
| #include <stdlib.h> | ||
| #include <string.h> | ||
|
|
||
| +/* tacacs server information */ | ||
| tacplus_server_t tac_srv[TAC_PLUS_MAXSERVERS]; | ||
| +struct addrinfo tac_srv_addr[TAC_PLUS_MAXSERVERS]; | ||
| +struct sockaddr tac_sock_addr[TAC_PLUS_MAXSERVERS]; | ||
| +struct sockaddr_in6 tac_sock6_addr[TAC_PLUS_MAXSERVERS]; | ||
| + | ||
| int tac_srv_no = 0; | ||
|
|
||
| char tac_service[64]; | ||
| @@ -173,6 +178,26 @@ int tacacs_get_password (pam_handle_t * pamh, int flags | ||
| return PAM_SUCCESS; | ||
| } | ||
|
|
||
| +/* | ||
| + * Set tacacs server addrinfo. | ||
| + */ | ||
| +void set_tacacs_server_addr(int tac_srv_no, struct addrinfo* server) { | ||
liuh-80 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| + tac_srv[tac_srv_no].addr = &(tac_srv_addr[tac_srv_no]); | ||
| + memcpy(tac_srv[tac_srv_no].addr, server, sizeof(struct addrinfo)); | ||
| + | ||
| + if (server->ai_family == AF_INET6) { | ||
| + tac_srv[tac_srv_no].addr->ai_addr = (struct sockaddr *)&(tac_sock6_addr[tac_srv_no]); | ||
| + memcpy(tac_srv[tac_srv_no].addr->ai_addr, server->ai_addr, sizeof(struct sockaddr_in6)); | ||
| + } | ||
| + else { | ||
| + tac_srv[tac_srv_no].addr->ai_addr = &(tac_sock_addr[tac_srv_no]); | ||
| + memcpy(tac_srv[tac_srv_no].addr->ai_addr, server->ai_addr, sizeof(struct sockaddr)); | ||
| + } | ||
| + | ||
| + tac_srv[tac_srv_no].addr->ai_canonname = NULL; | ||
| + tac_srv[tac_srv_no].addr->ai_next = NULL; | ||
| +} | ||
| + | ||
| /* set source ip address for the outgoing tacacs packets */ | ||
| void set_source_ip(const char *tac_source_ip) { | ||
| /* | ||
| @@ -284,8 +309,11 @@ int _pam_parse (int argc, const char **argv) { | ||
| } | ||
| if ((rv = getaddrinfo(server_name, (port == NULL) ? "49" : port, &hints, &servers)) == 0) { | ||
| for(server = servers; server != NULL && tac_srv_no < TAC_PLUS_MAXSERVERS; server = server->ai_next) { | ||
| - tac_srv[tac_srv_no].addr = server; | ||
| - tac_srv[tac_srv_no].key = current_secret; | ||
| + /* set server address with allocate memory */ | ||
| + set_tacacs_server_addr(tac_srv_no, server); | ||
liuh-80 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| + | ||
| + /* copy secret to key */ | ||
| + snprintf(tac_srv[tac_srv_no].key, sizeof(tac_srv[tac_srv_no].key), "%s", current_secret); | ||
| tac_srv_no++; | ||
| } | ||
| } else { | ||
| @@ -304,10 +332,11 @@ int _pam_parse (int argc, const char **argv) { | ||
|
|
||
| /* if 'secret=' was given after a 'server=' parameter, fill in the current secret */ | ||
| for(i = tac_srv_no-1; i >= 0; i--) { | ||
| - if (tac_srv[i].key != NULL) | ||
| + if (tac_srv[i].key[0] != 0) | ||
| break; | ||
|
|
||
| - tac_srv[i].key = current_secret; | ||
| + /* copy secret to key */ | ||
| + snprintf(tac_srv[i].key, sizeof(tac_srv[i].key), "%s", current_secret); | ||
| } | ||
| } else if (!strncmp (*argv, "timeout=", 8)) { | ||
| /* FIXME atoi() doesn't handle invalid numeric strings well */ | ||
| diff --git a/support.h b/support.h | ||
| index b1faf43..6bcb07f 100644 | ||
| --- a/support.h | ||
| +++ b/support.h | ||
| @@ -28,7 +28,7 @@ | ||
|
|
||
| typedef struct { | ||
| struct addrinfo *addr; | ||
| - const char *key; | ||
| + char key[256]; | ||
| } tacplus_server_t; | ||
|
|
||
| extern tacplus_server_t tac_srv[TAC_PLUS_MAXSERVERS]; | ||
| -- | ||
| 2.17.1.windows.2 | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Use 4 spaces instead of 1 tab #Closed