Commit graph

26 commits

Author SHA1 Message Date
Your Name
50fba1b2f1 fix 2017-06-04 01:02:11 +02:00
KLuka
4aa0eb97e4 Disable HTTP fallback via "/plain" URL (CVE-2015-8400)
* Disabled all methods of HTTP fallback when HTTPS is enabled. This
  is enforced on server side so that even modified client code (JS)
  can not redirect client from HTTPS to HTTP, like it was possible
  before (issue #355).
* Current solution unfortunately also disables automatic upgrade from
  HTTP to HTTPS (when available), since all non-SSL connections are
  droped immediately.
2015-12-03 17:47:26 +01:00
KLuka
6c9f98bf34 Logging and debuging
* Added prefixes to all log messages. Prefix should describe source of
  message, like "config", "http", "ssl", "server", etc... This should
  give users more info to figure out what went wrong or what is going
  on. Prefixes also make automatic processing easier.
* Usage is not displayed by default when given command line options are
  incorrect. This way it is easier to notice actual error.
2015-08-23 19:25:36 +02:00
KLuka
458cd7aa8f Minor improvments
* Added "reconnect" and "onsessionchange" message types to use with
  embedded terminal. Usage examples were added to misc/embedded.html
  file.
* Improved code for unix domain socket functionality.
2015-07-09 21:51:43 +02:00
KLuka
bdca920abc Another update for unix domain sockets support
* Changed initialization of variables and handling of unix socket path.
* Added fixes for command line argument parsing, that I forgot in previous
  commit.
2015-07-07 10:48:14 +02:00
KLuka
c6186530bb Minor fixes for unix domain sockets
* Improved user input checking and error handling for code from #320.
* Added some guards for unlinking socket file in server init and destroy
  functions.
* Added peer name handling for AF_UNIX type connections in HTTP handling
  code.
2015-07-06 22:02:54 +02:00
Witold Filipczyk
4d8ec30100 Unix domain sockets support.
The socket is not removed on shutdown, but the rest seems to work.
2015-07-01 13:06:04 +02:00
KLuka
b3309b23d8 Fixes for some defects found by Coverity
* Added more checks for return values and null pointers.
* Removed some dead code and unused variables.
* Fixed handling of calls to exec() family functions. If this functions
  fail we need to cleanup resources.
2015-05-31 13:04:00 +02:00
KLuka
62871a605d Issue #186: Does not build on OpenBSD
* Added stdint.h include for uintptr_t compilation error
2015-03-17 13:32:05 +01:00
Ezra Buehler
284d90ccc4 Remove trailing whitespace 2015-03-11 17:56:36 +01:00
zodiac@gmail.com
1867125c3b Second try :-)
git-svn-id: https://shellinabox.googlecode.com/svn/trunk@239 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2010-10-02 23:54:49 +00:00
zodiac@gmail.com
1a33fc8127 The server could sometimes end up listening for events even though it
was not really interested in them. This could result in inefficient I/O
behavior and most noticably it broke the ability to interrupt long running
output with CTRL-C.


git-svn-id: https://shellinabox.googlecode.com/svn/trunk@238 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2010-10-02 23:40:24 +00:00
zodiac@gmail.com
2c2389fe30 Some more research on the web suggests the Apple ships their operating
systems with an implementation of poll() that isn't completely POSIX
compliant. We now fall back on calling select() instead. That's not our
first choice, but it is presumably the best that MacOS X can do.


git-svn-id: https://shellinabox.googlecode.com/svn/trunk@236 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2010-10-02 01:54:29 +00:00
zodiac@gmail.com
301823036a Some changes to improve compatibility with MacOS X.
git-svn-id: https://shellinabox.googlecode.com/svn/trunk@231 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2010-09-29 06:28:58 +00:00
zodiac@gmail.com
13d0448fc6 Fix a pointer aliasing violation by explicitly breaking aliasing with a
call to memcpy().


git-svn-id: https://shellinabox.googlecode.com/svn/trunk@220 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2010-09-03 19:17:11 +00:00
zodiac@gmail.com
9b0a937e35 Started working on support for WebSockets.
Fixed some compiler warnings when compiling with -Wextra

Thanks to Jan Jaeger's excellent bug report, made some changes
that should make it easier to build ShellInABox for OpenWRT.


git-svn-id: https://shellinabox.googlecode.com/svn/trunk@202 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2010-03-29 16:40:17 +00:00
zodiac@gmail.com
5ec8c4c19b Added new "--localhost-only" command line option.
git-svn-id: https://shellinabox.googlecode.com/svn/trunk@125 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2009-06-21 19:55:20 +00:00
zodiac
0258d46926 - Add support for commands that want to read before they write anything.
- A couple of changes to avoid false error messages in valgrind.
- Fixed a bug that could potentially lead to a double-free()


git-svn-id: https://shellinabox.googlecode.com/svn/trunk@114 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2009-04-16 05:33:05 +00:00
zodiac
e1863d0a47 More IE6 tweaks. Allow root to listen on privileged ports.
git-svn-id: https://shellinabox.googlecode.com/svn/trunk@80 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2009-03-18 18:15:28 +00:00
zodiac
11d1a710f2 Work-around for compilers that turn on "-Wformat=2" by default. This is an
ill-advised choice, as this particular compiler options has a tendency to
generate a lot of false positives.


git-svn-id: https://shellinabox.googlecode.com/svn/trunk@62 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2009-02-15 20:01:53 +00:00
zodiac
1e27276feb Use a config.h file, instead of passing configuration options on the compiler's
command line.

Fix fatal compilation warning when building without SSL support.


git-svn-id: https://shellinabox.googlecode.com/svn/trunk@59 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2009-02-11 23:25:15 +00:00
zodiac
90d9d492b7 Added better compatibility with different versions of compilers and libaries.
In particular, work around a problem with gcc complaining about NULL format
strings. And added additional system header files that might be required on
some platforms.

This should fix some of the problems reported when compiling on BSD-style
systems. But we are still using SysV style session management code. This
probably needs to be rewritten before ShellInABox can be run on BSD-style
system.

In particular, we rely on grantpt(), we use the utmpx API, and we access
/dev/urandom.


git-svn-id: https://shellinabox.googlecode.com/svn/trunk@55 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2009-02-02 00:55:15 +00:00
zodiac
e40a555cbf Allow SSL certificate and key to be passed in through a file handle.
git-svn-id: https://shellinabox.googlecode.com/svn/trunk@46 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2009-01-17 03:37:20 +00:00
zodiac
046a9305c9 Updated copyright notice.
git-svn-id: https://shellinabox.googlecode.com/svn/trunk@25 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2009-01-02 06:09:13 +00:00
zodiac
35aa1a7881 - Tightened setuid operation to not allow any user or group changes.
- Added support for --cgi mode.


git-svn-id: https://shellinabox.googlecode.com/svn/trunk@22 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2009-01-01 05:53:04 +00:00
zodiac
aab20f5ed0 First public release of the version 2.0 rewrite. This is the
first release of ShellInABox that supports an AJAX interface
instead of the original Java applet.


git-svn-id: https://shellinabox.googlecode.com/svn/trunk@2 0da03de8-d603-11dd-86c2-0f8696b7b6f9
2008-12-29 23:57:07 +00:00