mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2025-02-17 14:59:45 +08:00
Code Issues Packages Projects Releases Wiki Activity

ftp,imap,pop3: do not ignore --ssl-reqd

Browse Source 
In imap and pop3, check if TLS is required even when capabilities
request has failed.

In ftp, ignore preauthentication (230 status of server greeting) if TLS
is required.

Bug: https://curl.se/docs/CVE-2021-22946.html

CVE-2021-22946
This commit is contained in:
Patrick Monnerat 2021-09-08 11:56:22 +02:00 committed by Daniel Stenberg
parent 43157490a5
commit 364f174724
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
7 changed files with 195 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
lib/ftp.c
View File

@ -2681,9 +2681,12 @@ static CURLcode ftp_statemachine(struct Curl_easy *data,
/* we have now received a full FTP server response */
switch(ftpc->state) {
case FTP_WAIT220:
if(ftpcode == 230)
/* 230 User logged in - already! */
return ftp_state_user_resp(data, ftpcode, ftpc->state);
if(ftpcode == 230) {
/* 230 User logged in - already! Take as 220 if TLS required. */
if(data->set.use_ssl <= CURLUSESSL_TRY ||
conn->bits.ftp_use_control_ssl)
return ftp_state_user_resp(data, ftpcode, ftpc->state);
}
else if(ftpcode != 220) {
failf(data, "Got a %03d ftp-server response when 220 was expected",
ftpcode);

24
lib/imap.c
View File

@ -934,22 +934,18 @@ static CURLcode imap_state_capability_resp(struct Curl_easy *data,
line += wordlen;
}
}
else if(imapcode == IMAP_RESP_OK) {
if(data->set.use_ssl && !conn->ssl[FIRSTSOCKET].use) {
/* We don't have a SSL/TLS connection yet, but SSL is requested */
if(imapc->tls_supported)
/* Switch to TLS connection now */
result = imap_perform_starttls(data, conn);
else if(data->set.use_ssl == CURLUSESSL_TRY)
/* Fallback and carry on with authentication */
result = imap_perform_authentication(data, conn);
else {
failf(data, "STARTTLS not supported.");
result = CURLE_USE_SSL_FAILED;
}
else if(data->set.use_ssl && !conn->ssl[FIRSTSOCKET].use) {
/* PREAUTH is not compatible with STARTTLS. */
if(imapcode == IMAP_RESP_OK && imapc->tls_supported && !imapc->preauth) {
/* Switch to TLS connection now */
result = imap_perform_starttls(data, conn);
}
else
else if(data->set.use_ssl <= CURLUSESSL_TRY)
result = imap_perform_authentication(data, conn);
else {
failf(data, "STARTTLS not available.");
result = CURLE_USE_SSL_FAILED;
}
}
else
result = imap_perform_authentication(data, conn);

33
lib/pop3.c
View File

@ -740,28 +740,23 @@ static CURLcode pop3_state_capa_resp(struct Curl_easy *data, int pop3code,
}
}
}
else if(pop3code == '+') {
if(data->set.use_ssl && !conn->ssl[FIRSTSOCKET].use) {
/* We don't have a SSL/TLS connection yet, but SSL is requested */
if(pop3c->tls_supported)
/* Switch to TLS connection now */
result = pop3_perform_starttls(data, conn);
else if(data->set.use_ssl == CURLUSESSL_TRY)
/* Fallback and carry on with authentication */
result = pop3_perform_authentication(data, conn);
else {
failf(data, "STLS not supported.");
result = CURLE_USE_SSL_FAILED;
}
}
else
result = pop3_perform_authentication(data, conn);
}
else {
/* Clear text is supported when CAPA isn't recognised */
pop3c->authtypes |= POP3_TYPE_CLEARTEXT;
if(pop3code != '+')
pop3c->authtypes |= POP3_TYPE_CLEARTEXT;
result = pop3_perform_authentication(data, conn);
if(!data->set.use_ssl || conn->ssl[FIRSTSOCKET].use)
result = pop3_perform_authentication(data, conn);
else if(pop3code == '+' && pop3c->tls_supported)
/* Switch to TLS connection now */
result = pop3_perform_starttls(data, conn);
else if(data->set.use_ssl <= CURLUSESSL_TRY)
/* Fallback and carry on with authentication */
result = pop3_perform_authentication(data, conn);
else {
failf(data, "STLS not supported.");
result = CURLE_USE_SSL_FAILED;
}
}
return result;

2
tests/data/Makefile.inc
View File

@ -118,6 +118,8 @@ test954 test955 test956 test957 test958 test959 test960 test961 test962 \
test963 test964 test965 test966 test967 test968 test969 test970 test971 \
test972 \
\
test984 test985 test986 \
\
test1000 test1001 test1002 test1003 test1004 test1005 test1006 test1007 \
test1008 test1009 test1010 test1011 test1012 test1013 test1014 test1015 \
test1016 test1017 test1018 test1019 test1020 test1021 test1022 test1023 \

56
tests/data/test984 Normal file
View File

@ -0,0 +1,56 @@
<testcase>
<info>
<keywords>
IMAP
STARTTLS
</keywords>
</info>
#
# Server-side
<reply>
<servercmd>
REPLY CAPABILITY A001 BAD Not implemented
</servercmd>
</reply>
#
# Client-side
<client>
<features>
SSL
</features>
<server>
imap
</server>
<name>
IMAP require STARTTLS with failing capabilities
</name>
<command>
imap://%HOSTIP:%IMAPPORT/%TESTNUMBER -T log/upload%TESTNUMBER -u user:secret --ssl-reqd
</command>
<file name="log/upload%TESTNUMBER">
Date: Mon, 7 Feb 1994 21:52:25 -0800 (PST)
From: Fred Foobar <foobar@example.COM>
Subject: afternoon meeting
To: joe@example.com
Message-Id: <B27397-0100000@example.COM>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Hello Joe, do you think we can meet at 3:30 tomorrow?
</file>
</client>
#
# Verify data after the test has been "shot"
<verify>
# 64 is CURLE_USE_SSL_FAILED
<errorcode>
64
</errorcode>
<protocol>
A001 CAPABILITY
</protocol>
</verify>
</testcase>

54
tests/data/test985 Normal file
View File

@ -0,0 +1,54 @@
<testcase>
<info>
<keywords>
POP3
STARTTLS
</keywords>
</info>
#
# Server-side
<reply>
<servercmd>
REPLY CAPA -ERR Not implemented
</servercmd>
<data nocheck="yes">
From: me@somewhere
To: fake@nowhere
body
--
yours sincerely
</data>
</reply>
#
# Client-side
<client>
<features>
SSL
</features>
<server>
pop3
</server>
<name>
POP3 require STARTTLS with failing capabilities
</name>
<command>
pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret --ssl-reqd
</command>
</client>
#
# Verify data after the test has been "shot"
<verify>
# 64 is CURLE_USE_SSL_FAILED
<errorcode>
64
</errorcode>
<protocol>
CAPA
</protocol>
</verify>
</testcase>

53
tests/data/test986 Normal file
View File

@ -0,0 +1,53 @@
<testcase>
<info>
<keywords>
FTP
STARTTLS
</keywords>
</info>
#
# Server-side
<reply>
<servercmd>
REPLY welcome 230 Welcome
REPLY AUTH 500 unknown command
</servercmd>
</reply>
# Client-side
<client>
<features>
SSL
</features>
<server>
ftp
</server>
<name>
FTP require STARTTLS while preauthenticated
</name>
<file name="log/test%TESTNUMBER.txt">
data
to
see
that FTPS
works
so does it?
</file>
<command>
--ssl-reqd --ftp-ssl-control ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -T log/test%TESTNUMBER.txt -u user:secret
</command>
</client>
# Verify data after the test has been "shot"
<verify>
# 64 is CURLE_USE_SSL_FAILED
<errorcode>
64
</errorcode>
<protocol>
AUTH SSL
AUTH TLS
</protocol>
</verify>
</testcase>