From: Daria Brashear <shadow@your-file-system.com>
Date: Wed, 8 Jul 2015 18:11:33 +0000 (-0400)
Subject: bos: Use crypt for commands where spoofing could be a risk
X-Git-Tag: openafs-stable-1_8_0pre1~304
X-Git-Url: http://git.openafs.org/?p=openafs.git;a=commitdiff_plain;h=62926630a82b8635d1cb1514b852f9f7a2609311

bos: Use crypt for commands where spoofing could be a risk

bos defaults to not requiring crypt in a lot of cases, instead using clear.

As the simplest way to secure the channel is to enable crypt, do so.

FIXES 131782 (CVE-2015-3283)

Change-Id: I354fcbb5db37db225391a47b59d99518d1d0b2f9
---

diff --git a/src/bozo/bos.c b/src/bozo/bos.c
index 9ebdb2f..54935a2 100644
--- a/src/bozo/bos.c
+++ b/src/bozo/bos.c
@@ -161,7 +161,7 @@ SetAuth(struct cmd_syndesc *as, void *arock)
     afs_int32 flag;
     char *tp;
 
-    tconn = GetConn(as, 0);
+    tconn = GetConn(as, 1);
     tp = as->parms[1].items->data;
     if (strcmp(tp, "on") == 0)
 	flag = 0;		/* auth req.: noauthflag is false */
@@ -226,7 +226,7 @@ Prune(struct cmd_syndesc *as, void *arock)
     struct rx_connection *tconn;
     afs_int32 flags;
 
-    tconn = GetConn(as, 0);
+    tconn = GetConn(as, 1);
     flags = 0;
     if (as->parms[1].items)
 	flags |= BOZO_PRUNEBAK;
@@ -248,7 +248,7 @@ Exec(struct cmd_syndesc *as, void *arock)
     struct rx_connection *tconn;
     afs_int32 code;
 
-    tconn = GetConn(as, 0);
+    tconn = GetConn(as, 1);
     code = BOZO_Exec(tconn, as->parms[1].items->data);
     if (code)
 	fprintf(stderr, "bos: failed to execute command (%s)\n", em(code));
@@ -314,7 +314,7 @@ UnInstall(struct cmd_syndesc *as, void *arock)
     struct cmd_item *ti;
     struct rx_connection *tconn;
 
-    tconn = GetConn(as, 0);
+    tconn = GetConn(as, 1);
     if (!as->parms[1].items) {
 	fprintf(stderr, "bos: no files to uninstall\n");
 	return 1;
@@ -373,7 +373,7 @@ Install(struct cmd_syndesc *as, void *arock)
     struct rx_call *tcall;
     char destDir[256];
 
-    tconn = GetConn(as, 0);
+    tconn = GetConn(as, 1);
     if (!as->parms[1].items) {
 	fprintf(stderr, "bos: no files to install\n");
 	return 1;
@@ -425,7 +425,7 @@ Shutdown(struct cmd_syndesc *as, void *arock)
     afs_int32 code;
     struct cmd_item *ti;
 
-    tconn = GetConn(as, 0);
+    tconn = GetConn(as, 1);
     if (as->parms[1].items == 0) {
 	code = BOZO_ShutdownAll(tconn);
 	if (code)
@@ -500,7 +500,7 @@ SetRestartCmd(struct cmd_syndesc *as, void *arock)
     struct rx_connection *tconn;
 
     count = 0;
-    tconn = GetConn(as, 0);
+    tconn = GetConn(as, 1);
     if (as->parms[2].items) {
 	count++;
 	type = 1;
@@ -537,7 +537,7 @@ Startup(struct cmd_syndesc *as, void *arock)
     afs_int32 code;
     struct cmd_item *ti;
 
-    tconn = GetConn(as, 0);
+    tconn = GetConn(as, 1);
     if (as->parms[1].items == 0) {
 	code = BOZO_StartupAll(tconn);
 	if (code)
@@ -560,7 +560,7 @@ Restart(struct cmd_syndesc *as, void *arock)
     afs_int32 code;
     struct cmd_item *ti;
 
-    tconn = GetConn(as, 0);
+    tconn = GetConn(as, 1);
     if (as->parms[2].items) {
 	/* this is really a rebozo command */
 	if (as->parms[1].items) {
@@ -604,7 +604,7 @@ SetCellName(struct cmd_syndesc *as, void *arock)
     struct rx_connection *tconn;
     afs_int32 code;
 
-    tconn = GetConn(as, 0);
+    tconn = GetConn(as, 1);
     code = BOZO_SetCellName(tconn, as->parms[1].items->data);
     if (code)
 	fprintf(stderr, "bos: failed to set cell (%s)\n", em(code));
@@ -619,7 +619,7 @@ AddHost(struct cmd_syndesc *as, void *arock)
     struct cmd_item *ti;
     char name[MAXHOSTCHARS];
 
-    tconn = GetConn(as, 0);
+    tconn = GetConn(as, 1);
     for (ti = as->parms[1].items; ti; ti = ti->next) {
 	if (as->parms[2].items) {
 	    if (strlen(ti->data) > MAXHOSTCHARS - 3) {
@@ -645,7 +645,7 @@ RemoveHost(struct cmd_syndesc *as, void *arock)
     afs_int32 code;
     struct cmd_item *ti;
 
-    tconn = GetConn(as, 0);
+    tconn = GetConn(as, 1);
     for (ti = as->parms[1].items; ti; ti = ti->next) {
 	code = BOZO_DeleteCellHost(tconn, ti->data);
 	if (code)
@@ -769,7 +769,7 @@ RemoveKey(struct cmd_syndesc *as, void *arock)
     afs_int32 temp;
     struct cmd_item *ti;
 
-    tconn = GetConn(as, 0);
+    tconn = GetConn(as, 1);
     for (ti = as->parms[1].items; ti; ti = ti->next) {
 	temp = atoi(ti->data);
 	code = BOZO_DeleteKey(tconn, temp);
@@ -831,7 +831,7 @@ AddSUser(struct cmd_syndesc *as, void *arock)
     struct cmd_item *ti;
 
     failed = 0;
-    tconn = GetConn(as, 0);
+    tconn = GetConn(as, 1);
     for (ti = as->parms[1].items; ti; ti = ti->next) {
 	code = BOZO_AddSUser(tconn, ti->data);
 	if (code) {
@@ -851,7 +851,7 @@ RemoveSUser(struct cmd_syndesc *as, void *arock)
     int failed;
 
     failed = 0;
-    tconn = GetConn(as, 0);
+    tconn = GetConn(as, 1);
     for (ti = as->parms[1].items; ti; ti = ti->next) {
 	code = BOZO_DeleteSUser(tconn, ti->data);
 	if (code) {
@@ -950,7 +950,7 @@ CreateServer(struct cmd_syndesc *as, void *arock)
     int i;
     char *type, *name, *notifier = NONOTIFIER;
 
-    tconn = GetConn(as, 0);
+    tconn = GetConn(as, 1);
     for (i = 0; i < 6; i++)
 	parms[i] = "";
     for (i = 0, ti = as->parms[3].items; (ti && i < 6); ti = ti->next, i++) {
@@ -980,7 +980,7 @@ DeleteServer(struct cmd_syndesc *as, void *arock)
     struct cmd_item *ti;
 
     code = 0;
-    tconn = GetConn(as, 0);
+    tconn = GetConn(as, 1);
     for (ti = as->parms[1].items; ti; ti = ti->next) {
 	code = BOZO_DeleteBnode(tconn, ti->data);
 	if (code) {
@@ -1002,7 +1002,7 @@ StartServer(struct cmd_syndesc *as, void *arock)
     struct cmd_item *ti;
 
     code = 0;
-    tconn = GetConn(as, 0);
+    tconn = GetConn(as, 1);
     for (ti = as->parms[1].items; ti; ti = ti->next) {
 	code = BOZO_SetStatus(tconn, ti->data, BSTAT_NORMAL);
 	if (code)
@@ -1020,7 +1020,7 @@ StopServer(struct cmd_syndesc *as, void *arock)
     struct cmd_item *ti;
 
     code = 0;
-    tconn = GetConn(as, 0);
+    tconn = GetConn(as, 1);
     for (ti = as->parms[1].items; ti; ti = ti->next) {
 	code = BOZO_SetStatus(tconn, ti->data, BSTAT_SHUTDOWN);
 	if (code)
@@ -1239,7 +1239,7 @@ GetLogCmd(struct cmd_syndesc *as, void *arock)
     int error;
 
     printf("Fetching log file '%s'...\n", as->parms[1].items->data);
-    tconn = GetConn(as, 0);
+    tconn = GetConn(as, 1);
     tcall = rx_NewCall(tconn);
     code = StartBOZO_GetLog(tcall, as->parms[1].items->data);
     if (code) {
@@ -1313,7 +1313,7 @@ SalvageCmd(struct cmd_syndesc *as, void *arock)
     char * serviceName;
 
     /* parm 0 is machine name, 1 is partition, 2 is volume, 3 is -all flag */
-    tconn = GetConn(as, 0);
+    tconn = GetConn(as, 1);
 
     /* find out whether fileserver is running demand attach fs */
     if (IsDAFS(tconn)) {
@@ -1652,7 +1652,7 @@ SetRestrict(struct cmd_syndesc *as, void *arock)
     struct rx_connection *tconn;
     afs_int32 code, val;
 
-    tconn = GetConn(as, 0);
+    tconn = GetConn(as, 1);
     util_GetInt32(as->parms[1].items->data, &val);
     code = BOZO_SetRestrictedMode(tconn, val);
     if (code)