Commit 0ddb44b0 authored by Andreas Jung's avatar Andreas Jung

      - Fixed vulnerabilities in the ZEO network protocol 
        affecting ZEO storage servers.
parent 354fee48
...@@ -98,7 +98,7 @@ class ZEOStorage: ...@@ -98,7 +98,7 @@ class ZEOStorage:
for func in self.extensions: for func in self.extensions:
self._extensions[func.func_name] = None self._extensions[func.func_name] = None
def finish_auth(self, authenticated): def _finish_auth(self, authenticated):
if not self.auth_realm: if not self.auth_realm:
return 1 return 1
self.authenticated = authenticated self.authenticated = authenticated
...@@ -350,6 +350,7 @@ class ZEOStorage: ...@@ -350,6 +350,7 @@ class ZEOStorage:
def new_oids(self, n=100): def new_oids(self, n=100):
"""Return a sequence of n new oids, where n defaults to 100""" """Return a sequence of n new oids, where n defaults to 100"""
n = min(n, 100)
if self.read_only: if self.read_only:
raise ReadOnlyError() raise ReadOnlyError()
if n <= 0: if n <= 0:
......
...@@ -121,7 +121,7 @@ class StorageClass(ZEOStorage): ...@@ -121,7 +121,7 @@ class StorageClass(ZEOStorage):
check = hexdigest("%s:%s" % (h_up, challenge)) check = hexdigest("%s:%s" % (h_up, challenge))
if check == response: if check == response:
self.connection.setSessionKey(session_key(h_up, self._key_nonce)) self.connection.setSessionKey(session_key(h_up, self._key_nonce))
return self.finish_auth(check == response) return self._finish_auth(check == response)
extensions = [auth_get_challenge, auth_response] extensions = [auth_get_challenge, auth_response]
......
...@@ -41,7 +41,7 @@ class StorageClass(ZEOStorage): ...@@ -41,7 +41,7 @@ class StorageClass(ZEOStorage):
self.connection.setSessionKey(session_key(username, self.connection.setSessionKey(session_key(username,
self.database.realm, self.database.realm,
password)) password))
return self.finish_auth(dbpw == password_dig) return self._finish_auth(dbpw == password_dig)
class PlaintextClient(Client): class PlaintextClient(Client):
extensions = ["auth"] extensions = ["auth"]
......
...@@ -22,7 +22,7 @@ import logging ...@@ -22,7 +22,7 @@ import logging
import ThreadedAsync import ThreadedAsync
from ZEO.zrpc import smac from ZEO.zrpc import smac
from ZEO.zrpc.error import ZRPCError, DisconnectedError from ZEO.zrpc.error import ZRPCError, DisconnectedError
from ZEO.zrpc.marshal import Marshaller from ZEO.zrpc.marshal import Marshaller, ServerMarshaller
from ZEO.zrpc.trigger import trigger from ZEO.zrpc.trigger import trigger
from ZEO.zrpc.log import short_repr, log from ZEO.zrpc.log import short_repr, log
from ZODB.loglevels import BLATHER, TRACE from ZODB.loglevels import BLATHER, TRACE
...@@ -724,6 +724,7 @@ class ManagedServerConnection(Connection): ...@@ -724,6 +724,7 @@ class ManagedServerConnection(Connection):
def __init__(self, sock, addr, obj, mgr): def __init__(self, sock, addr, obj, mgr):
self.mgr = mgr self.mgr = mgr
self.__super_init(sock, addr, obj, 'S') self.__super_init(sock, addr, obj, 'S')
self.marshal = ServerMarshaller()
self.obj.notifyConnected(self) self.obj.notifyConnected(self)
def handshake(self): def handshake(self):
......
...@@ -53,6 +53,20 @@ class Marshaller: ...@@ -53,6 +53,20 @@ class Marshaller:
level=logging.ERROR) level=logging.ERROR)
raise raise
class ServerMarshaller(Marshaller):
def decode(self, msg):
"""Decodes msg and returns its parts"""
unpickler = cPickle.Unpickler(StringIO(msg))
unpickler.find_global = server_find_global
try:
return unpickler.load() # msgid, flags, name, args
except:
log("can't decode message: %s" % short_repr(msg),
level=logging.ERROR)
raise
_globals = globals() _globals = globals()
_silly = ('__doc__',) _silly = ('__doc__',)
...@@ -77,3 +91,19 @@ def find_global(module, name): ...@@ -77,3 +91,19 @@ def find_global(module, name):
return r return r
raise ZRPCError("Unsafe global: %s.%s" % (module, name)) raise ZRPCError("Unsafe global: %s.%s" % (module, name))
def server_find_global(module, name):
"""Helper for message unpickler"""
try:
if module != 'ZopeUndo.Prefix':
raise ImportError
m = __import__(module, _globals, _globals, _silly)
except ImportError, msg:
raise ZRPCError("import error %s: %s" % (module, msg))
try:
r = getattr(m, name)
except AttributeError:
raise ZRPCError("module %s has no global %s" % (module, name))
return r
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment