diff options
| author | Mark Michelson <mmichelson@digium.com> | 2015-04-28 17:00:37 -0500 |
|---|---|---|
| committer | Mark Michelson <mmichelson@digium.com> | 2015-04-30 10:43:51 -0500 |
| commit | 11ffcf662f6b19eb0e9d5f8914d379ebef0177c4 (patch) | |
| tree | a2727599061f560cce4900094e4854364c9c7add /main | |
| parent | 57cbb4bc8dda4cf4939f029e60290e3335a82c05 (diff) | |
Restrict functionality when ACLs are misconfigured.
This patch has two main purposes:
1) Improve warning messages when ACLs are configured improperly.
2) Prevent misconfigured ACLs from allowing potentially unwanted
traffic.
To acomplish point (2) in most cases, whatever configuration object that
the ACL belonged to was not allowed to load.
The one exception is res_pjsip_acl. In that case, ACLs are their own
configuration object. Furthermore, the module loading code has no
indication that a ACL configuration had a failure. So the tactic taken
here is to create an ACL that just blocks everything.
ASTERISK-24969
Reported by Corey Farrell
Change-Id: I2ebcb6959cefad03cea4d81401be946203fcacae
Diffstat (limited to 'main')
| -rw-r--r-- | main/acl.c | 2 | ||||
| -rw-r--r-- | main/manager.c | 8 |
2 files changed, 8 insertions, 2 deletions
diff --git a/main/acl.c b/main/acl.c index 92b675443..d133b2a07 100644 --- a/main/acl.c +++ b/main/acl.c @@ -479,7 +479,7 @@ void ast_append_acl(const char *sense, const char *stuff, struct ast_acl_list ** AST_LIST_TRAVERSE(working_list, current, list) { if (!strcasecmp(current->name, tmp)) { /* ACL= */ /* Inclusion of the same ACL multiple times isn't a catastrophic error, but it will raise the error flag and skip the entry. */ - ast_log(LOG_ERROR, "Named ACL '%s' is already included in the ast_acl container.", tmp); + ast_log(LOG_ERROR, "Named ACL '%s' occurs multiple times in ACL definition. Please update your ACL configuration.", tmp); if (error) { *error = 1; } diff --git a/main/manager.c b/main/manager.c index 2ff9df930..846f6e604 100644 --- a/main/manager.c +++ b/main/manager.c @@ -8977,7 +8977,13 @@ static int __init_manager(int reload, int by_external_config) } else if (!strcasecmp(var->name, "deny") || !strcasecmp(var->name, "permit") || !strcasecmp(var->name, "acl")) { - ast_append_acl(var->name, var->value, &user->acl, NULL, &acl_subscription_flag); + int acl_error = 0; + + ast_append_acl(var->name, var->value, &user->acl, &acl_error, &acl_subscription_flag); + if (acl_error) { + ast_log(LOG_ERROR, "Invalid ACL '%s' for manager user '%s' on line %d. Deleting user\n"); + user->keep = 0; + } } else if (!strcasecmp(var->name, "read") ) { user->readperm = get_perm(var->value); } else if (!strcasecmp(var->name, "write") ) { |