1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
|
From 76f6a80cb3d6131e9c3e98918305c1bf1805fa2a Mon Sep 17 00:00:00 2001
From: Vladislavs Sokurenko <vladislavs.sokurenko@zabbix.com>
Date: Thu, 27 Jul 2023 12:43:02 +0000
Subject: [PATCH] ...G...PS. [DEV-2429] fixed unauthorised file system access
when using cURL
Merge in ZBX/zabbix from feature/DEV-2429-6.0 to release/6.0
* commit 'abf345230ee185d61cc0bd70d432fa4b093b8a53':
...G...PS. [DEV-2429] fixed unautorized file system access when using curl
.......PS. [DEV-2429] fixed unautorized file system access in JS preprocessing
CVE: CVE-2023-29450
Upstream-Status: Backport [https://git.zabbix.com/projects/ZBX/repos/zabbix/commits/76f6a80cb3d]
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
---
src/libs/zbxembed/httprequest.c | 4 +++
src/libs/zbxhistory/history_elastic.c | 30 ++++++++++++++++++++++
src/libs/zbxhttp/http.c | 9 +++++++
src/libs/zbxmedia/email.c | 6 +++++
src/libs/zbxsysinfo/common/http.c | 9 +++++++
src/libs/zbxsysinfo/simple/simple.c | 11 ++++++++
src/zabbix_server/httppoller/httptest.c | 9 +++++++
src/zabbix_server/reporter/report_writer.c | 10 ++++++++
src/zabbix_server/vmware/vmware.c | 9 +++++++
9 files changed, 97 insertions(+)
diff --git a/src/libs/zbxembed/httprequest.c b/src/libs/zbxembed/httprequest.c
index 7f0eed9..871b925 100644
--- a/src/libs/zbxembed/httprequest.c
+++ b/src/libs/zbxembed/httprequest.c
@@ -354,6 +354,10 @@ static duk_ret_t es_httprequest_query(duk_context *ctx, const char *http_request
ZBX_CURL_SETOPT(ctx, request->handle, CURLOPT_CUSTOMREQUEST, http_request, err);
ZBX_CURL_SETOPT(ctx, request->handle, CURLOPT_TIMEOUT_MS, timeout_ms - elapsed_ms, err);
ZBX_CURL_SETOPT(ctx, request->handle, CURLOPT_POSTFIELDS, ZBX_NULL2EMPTY_STR(contents), err);
+#if LIBCURL_VERSION_NUM >= 0x071304
+ /* CURLOPT_PROTOCOLS is supported starting with version 7.19.4 (0x071304) */
+ ZBX_CURL_SETOPT(ctx, request->handle, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS, err);
+#endif
request->data_offset = 0;
request->headers_in_offset = 0;
diff --git a/src/libs/zbxhistory/history_elastic.c b/src/libs/zbxhistory/history_elastic.c
index 8b3ea84..fc881da 100644
--- a/src/libs/zbxhistory/history_elastic.c
+++ b/src/libs/zbxhistory/history_elastic.c
@@ -406,6 +406,16 @@ static void elastic_writer_add_iface(zbx_history_iface_t *hist)
goto out;
}
+#if LIBCURL_VERSION_NUM >= 0x071304
+ /* CURLOPT_PROTOCOLS is supported starting with version 7.19.4 (0x071304) */
+ if (CURLE_OK != (err = curl_easy_setopt(data->handle, opt = CURLOPT_PROTOCOLS,
+ CURLPROTO_HTTP | CURLPROTO_HTTPS)))
+ {
+ zabbix_log(LOG_LEVEL_ERR, "cannot set cURL option %d: [%s]", (int)opt, curl_easy_strerror(err));
+ goto out;
+ }
+#endif
+
*page_w[hist->value_type].errbuf = '\0';
if (CURLE_OK != (err = curl_easy_setopt(data->handle, opt = CURLOPT_PRIVATE, &page_w[hist->value_type])))
@@ -722,6 +732,16 @@ static int elastic_get_values(zbx_history_iface_t *hist, zbx_uint64_t itemid, in
goto out;
}
+#if LIBCURL_VERSION_NUM >= 0x071304
+ /* CURLOPT_PROTOCOLS is supported starting with version 7.19.4 (0x071304) */
+ if (CURLE_OK != (err = curl_easy_setopt(data->handle, opt = CURLOPT_PROTOCOLS,
+ CURLPROTO_HTTP | CURLPROTO_HTTPS)))
+ {
+ zabbix_log(LOG_LEVEL_ERR, "cannot set cURL option %d: [%s]", (int)opt, curl_easy_strerror(err));
+ goto out;
+ }
+#endif
+
zabbix_log(LOG_LEVEL_DEBUG, "sending query to %s; post data: %s", data->post_url, query.buffer);
page_r.offset = 0;
@@ -1065,6 +1085,16 @@ void zbx_elastic_version_extract(struct zbx_json *json)
goto clean;
}
+#if LIBCURL_VERSION_NUM >= 0x071304
+ /* CURLOPT_PROTOCOLS is supported starting with version 7.19.4 (0x071304) */
+ if (CURLE_OK != (err = curl_easy_setopt(handle, opt = CURLOPT_PROTOCOLS,
+ CURLPROTO_HTTP | CURLPROTO_HTTPS)))
+ {
+ zabbix_log(LOG_LEVEL_WARNING, "cannot set cURL option %d: [%s]", (int)opt, curl_easy_strerror(err));
+ goto clean;
+ }
+#endif
+
*errbuf = '\0';
if (CURLE_OK != (err = curl_easy_perform(handle)))
diff --git a/src/libs/zbxhttp/http.c b/src/libs/zbxhttp/http.c
index c10922c..36774cc 100644
--- a/src/libs/zbxhttp/http.c
+++ b/src/libs/zbxhttp/http.c
@@ -333,6 +333,15 @@ int zbx_http_get(const char *url, const char *header, long timeout, char **out,
goto clean;
}
+#if LIBCURL_VERSION_NUM >= 0x071304
+ /* CURLOPT_PROTOCOLS is supported starting with version 7.19.4 (0x071304) */
+ if (CURLE_OK != (err = curl_easy_setopt(easyhandle, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS)))
+ {
+ *error = zbx_dsprintf(NULL, "Cannot set allowed protocols: %s", curl_easy_strerror(err));
+ goto clean;
+ }
+#endif
+
if (CURLE_OK != (err = curl_easy_setopt(easyhandle, CURLOPT_URL, url)))
{
*error = zbx_dsprintf(NULL, "Cannot specify URL: %s", curl_easy_strerror(err));
diff --git a/src/libs/zbxmedia/email.c b/src/libs/zbxmedia/email.c
index 3b987d9..d3af744 100644
--- a/src/libs/zbxmedia/email.c
+++ b/src/libs/zbxmedia/email.c
@@ -661,6 +661,12 @@ static int send_email_curl(const char *smtp_server, unsigned short smtp_port, co
if ('\0' != *smtp_helo)
zbx_snprintf(url + url_offset, sizeof(url) - url_offset, "/%s", smtp_helo);
+#if LIBCURL_VERSION_NUM >= 0x071304
+ /* CURLOPT_PROTOCOLS is supported starting with version 7.19.4 (0x071304) */
+ if (CURLE_OK != (err = curl_easy_setopt(easyhandle, CURLOPT_PROTOCOLS, CURLPROTO_SMTPS | CURLPROTO_SMTP)))
+ goto error;
+#endif
+
if (CURLE_OK != (err = curl_easy_setopt(easyhandle, CURLOPT_URL, url)))
goto error;
diff --git a/src/libs/zbxsysinfo/common/http.c b/src/libs/zbxsysinfo/common/http.c
index acd77e1..8dc4793 100644
--- a/src/libs/zbxsysinfo/common/http.c
+++ b/src/libs/zbxsysinfo/common/http.c
@@ -176,6 +176,15 @@ static int curl_page_get(char *url, char **buffer, char **error)
goto out;
}
+#if LIBCURL_VERSION_NUM >= 0x071304
+ /* CURLOPT_PROTOCOLS is supported starting with version 7.19.4 (0x071304) */
+ if (CURLE_OK != (err = curl_easy_setopt(easyhandle, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS)))
+ {
+ *error = zbx_dsprintf(*error, "Cannot set allowed protocols: %s", curl_easy_strerror(err));
+ goto out;
+ }
+#endif
+
if (CURLE_OK == (err = curl_easy_perform(easyhandle)))
{
if (NULL != buffer)
diff --git a/src/libs/zbxsysinfo/simple/simple.c b/src/libs/zbxsysinfo/simple/simple.c
index be1b9f9..80c5eac 100644
--- a/src/libs/zbxsysinfo/simple/simple.c
+++ b/src/libs/zbxsysinfo/simple/simple.c
@@ -189,6 +189,17 @@ static int check_https(const char *host, unsigned short port, int timeout, int *
goto clean;
}
+#if LIBCURL_VERSION_NUM >= 0x071304
+ /* CURLOPT_PROTOCOLS is supported starting with version 7.19.4 (0x071304) */
+ if (CURLE_OK != (err = curl_easy_setopt(easyhandle, opt = CURLOPT_PROTOCOLS,
+ CURLPROTO_HTTP | CURLPROTO_HTTPS)))
+ {
+ zabbix_log(LOG_LEVEL_DEBUG, "%s: could not set cURL option [%d]: %s",
+ __func__, (int)opt, curl_easy_strerror(err));
+ goto clean;
+ }
+#endif
+
if (NULL != CONFIG_SOURCE_IP)
{
if (CURLE_OK != (err = curl_easy_setopt(easyhandle, opt = CURLOPT_INTERFACE, CONFIG_SOURCE_IP)))
diff --git a/src/zabbix_server/httppoller/httptest.c b/src/zabbix_server/httppoller/httptest.c
index 0ff70ef..0201442 100644
--- a/src/zabbix_server/httppoller/httptest.c
+++ b/src/zabbix_server/httppoller/httptest.c
@@ -696,6 +696,15 @@ static void process_httptest(DC_HOST *host, zbx_httptest_t *httptest)
goto clean;
}
+#if LIBCURL_VERSION_NUM >= 0x071304
+ /* CURLOPT_PROTOCOLS is supported starting with version 7.19.4 (0x071304) */
+ if (CURLE_OK != (err = curl_easy_setopt(easyhandle, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS)))
+ {
+ err_str = zbx_strdup(err_str, curl_easy_strerror(err));
+ goto clean;
+ }
+#endif
+
if (SUCCEED != zbx_http_prepare_ssl(easyhandle, httptest->httptest.ssl_cert_file,
httptest->httptest.ssl_key_file, httptest->httptest.ssl_key_password,
httptest->httptest.verify_peer, httptest->httptest.verify_host, &err_str))
diff --git a/src/zabbix_server/reporter/report_writer.c b/src/zabbix_server/reporter/report_writer.c
index 87d1364..7530ed0 100644
--- a/src/zabbix_server/reporter/report_writer.c
+++ b/src/zabbix_server/reporter/report_writer.c
@@ -162,6 +162,16 @@ static int rw_get_report(const char *url, const char *cookie, int width, int hei
goto out;
}
+#if LIBCURL_VERSION_NUM >= 0x071304
+ /* CURLOPT_PROTOCOLS is supported starting with version 7.19.4 (0x071304) */
+ if (CURLE_OK != (err = curl_easy_setopt(curl, opt = CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS)))
+ {
+ *error = zbx_dsprintf(*error, "Cannot set cURL option %d: %s.", (int)opt,
+ (curl_error = rw_curl_error(err)));
+ goto out;
+ }
+#endif
+
if (NULL != CONFIG_TLS_CA_FILE && '\0' != *CONFIG_TLS_CA_FILE)
{
if (CURLE_OK != (err = curl_easy_setopt(curl, opt = CURLOPT_CAINFO, CONFIG_TLS_CA_FILE)) ||
diff --git a/src/zabbix_server/vmware/vmware.c b/src/zabbix_server/vmware/vmware.c
index b02c8c7..718d519 100644
--- a/src/zabbix_server/vmware/vmware.c
+++ b/src/zabbix_server/vmware/vmware.c
@@ -2045,6 +2045,15 @@ static int vmware_service_authenticate(zbx_vmware_service_t *service, CURL *easy
goto out;
}
+#if LIBCURL_VERSION_NUM >= 0x071304
+ /* CURLOPT_PROTOCOLS is supported starting with version 7.19.4 (0x071304) */
+ if (CURLE_OK != (err = curl_easy_setopt(easyhandle, opt = CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS)))
+ {
+ *error = zbx_dsprintf(*error, "Cannot set cURL option %d: %s.", (int)opt, curl_easy_strerror(err));
+ goto out;
+ }
+#endif
+
if (NULL != CONFIG_SOURCE_IP)
{
if (CURLE_OK != (err = curl_easy_setopt(easyhandle, opt = CURLOPT_INTERFACE, CONFIG_SOURCE_IP)))
--
2.35.5
|
