fix acme wrt. security, redundancy, consistency #672
Conversation
|
@jelmd Thanks for the corrections! License: I used the common header, because I don't have info about this legal agreements, if it is still valid, or not. I do my best to serve this project, but I am very alone with my efforts, so I invite you to join me and help me maintain the project if you have time for it. I will review and merge it soon. Sorry for the delay.. |
|
Yes, good catch. :) |
|
Thanks!! |
With notable exceptions of: src/apps/common/win/* src/apps/relay/telnet.* The purpose of this change is to add the SPDX tags from https://spdx.dev/, which is a linux foundation project, to the source code. This provides automated code provenance tools, which are used in setting up software bill of materials reports, an easy time verifying that the code license is known and no incompatibilities are present in a codebase. No copyright date, author, or license changes are made. Note also that 7e525c8 is the original commit for the ACME code (acme.h and acme.c) which was then moved to acme.h and acme.c in this commit d468675 but neither commit indicates what license the ACME code was submitted as. https://github.com/coturn/coturn?tab=License-1-ov-file#readme is the 3-clause BSD license, but #672 documents that the author's intent was for the MIT license. So I've used the SPDX tag and content of the MIT license for this change.
The #551 PR rewrite/current implementation has several issues:
req_urlcopy may point to anything else, but not the intended locationreqis not checked and thus may overflow thereq_urlbufferis_acme_req()already takes care of it. It returns the position of the 2nd space of the request-line (seeplen, RFC 2616, 5.1. The first space gets covered by theGET_ACME_PREFIX). If the request is not RFC conform, we do not care - ignore it.GET_WELLKNOWN_ACMECHALLANGE_URL_PREFIX_LENGTHgot introduced in the rewrite. The corresponding string is missing. So a corresponding#definegot introduced here.acme.hor anything else.int send_data_from_ioa_socket_nbh()is unreliable and does not send the expected HTTP response for whatever reason (I guess, the "return socket" is already closed). So on ubuntu per default a workaround will be used to make sure, that a proper answer gets sent. To forcesend_data_from_ioa_socket_nbh()usage on ubuntu, one mayexport LIBEV_OK=1before running./configure ....Adding an outdated default header is IMHO not ok. Not sure, whether Citrix maintainers are still onboard, but I do not wanna get sued by anybody, just for re-using my own code. Therefore I added the MIT license header, which should be compatible with the project, does not require a change any other files, but still allows me (and others) to re-use it somewhere else.