Write safe code

In these days, I come cross a few vulnerability of squid. Here are some lessons learned:


(1) strcmp

If you pass the strcmp with NULL pointer, the behavior is undefined and program may crash. Also check the NULL, '\0' and string can be trivial. This assumes that the str1 and str2 is end with '\0':


int compare(char* str1, char* str2)

{

         if (str1==NULL || str2==NULL)

         {

                if (str1==str2)

                     return 0;

                 if (str1==NULL)

                     return -1;

                 if (str2==NULL)

                     return 1;

          }

           return strcmp(str1,str2);

}


(2) check the minor major version in HTTP header.
Squid was using this code to get numeric version number from HTTP header (HTTP/1.1...):


//assume the data stored in buffer, assume we only care about major digit now..

int maj=-1;



if (buffer see line end)

  maj=1;

else

   return;


for (pos=verStart;  isdigit(buffer[pos]); pos++)

{

          maj = maj * 10;

          maj = maj + (hmsg->buf[i]) - '0';

}


//The maj should never be -1 until it is overflow at 65536

assert(maj!=-1)

(3) Recently, there is a vulnerablity in bzip2 code
int N, result;
while (buffer not end)
{
       //read buffer;
       result+=N*2;
}

Here the result is signed integer and it may overflow, which cause undefined behavior.

From Red Hat 8.0 to Centos 5.3

This page is reserved for the porting from Red Hat 8.0 to Centos 5.3:

1). What is changed?
a). Native Posix Thread support. Special synchronization primitive: futex
b). O(1) scheduler and SMP Scalability.
c). Preemptive kernel.
d). Latency improvement. schedule latency <0.5 microseconds
e). Redesign block layer
f). Improved VM Subsystem

set up a user on centos

Here are some notes to add a user and set up sudo in CentOS:
(1) Create a user ,for example, alice:
useradd alice
passwd alice

(2) Add to the sudo file
visudo
Then add this to the last line:
alice All=(ALL) ALL

(3) ssh-agent

/usr/bin/ssh-agent $SHELL

ssh-add

(4) ssh-agent automatically
sudo yum install openssh-askpass
Main Menu Button (on the Panel) => Preferences => More Preferences =>Sessions, and click on the Startup Programs tab. Click Add and enter /usr/bin/ssh-add in the Startup Command text area

Redirect https via proxy

It is hard to redirect https via proxy, for example, generating a block page for the https traffic as IE stop you doing that:


The idea is to send 500 page back with javascript and/or html redirect in place, after the page is loaded in browser, then the browser will try to access redirected https web site.

Array is not a const pointer

It sounds like you can use the array and pointer interchangeably:
char a[]="abcdef";

char* b=a;

b[0]='e';
it will change the a[0] to 'e'.

However, the sizeof(a) and sizeof(b) is different. The former is 6 and the latter is 4 (32 bit system).

suffix/prefix expressions in google safe browsing

google uses host suffix/path prefix expressions to hash the blacklist and malwarelist url for google safe browsing.

When you try to match against a URL: http://www.google.com/header/x.html, you will try all the combination:
google.com/
google.com/header/
google.com/header/x.html

The original design only download 4 bytes hash, when it matches, it will contact the google server again to download 32 bytes hash.

URL categorization

Some resources to help collect URL categorization information:

Google top 1000

Alexa 1,000,000 top sites

URLblacklist

K9 Web Protection

Squid Guard

Dans Guardian

The Dans Guardian has the regular expression for content filter under the folder:
configs/lists