d6aade7578
Backport applicable private-pcp security fixes to PCP 6.3.7 for RHEL 9.9. CVE-2026-16531 is not applicable because the pmproxy logger servlet is absent in this release. Resolves: RHEL-213747 CVE-2026-16530 Resolves: RHEL-213736 CVE-2026-16529 Resolves: RHEL-213711 CVE-2026-16527 Resolves: RHEL-213687 CVE-2026-16526 Resolves: RHEL-213658 CVE-2026-16524 Co-authored-by: Cursor <cursoragent@cursor.com>
44 lines
1.5 KiB
Diff
44 lines
1.5 KiB
Diff
From 81a9efe96d Mon Sep 17 00:00:00 2001
|
|
From: Nathan Scott <nathans@redhat.com>
|
|
Subject: [PATCH] pmproxy: enforce -Q (CERT_REQD) for REST API connections
|
|
|
|
The -Q flag (PM_SERVER_FEATURE_CERT_REQD) was only enforced in the
|
|
legacy PCP wire protocol path (deprecated.c). The modern HTTP/REST
|
|
API path had no check, allowing unauthenticated plain-HTTP clients
|
|
to access all endpoints even when -Q was specified.
|
|
|
|
Add enforcement in on_headers_complete() alongside the existing -S
|
|
(CREDS_REQD) check: when CERT_REQD is active, reject requests where
|
|
the connection is not TLS or no client certificate was presented.
|
|
Returns HTTP 403 Forbidden. If OpenSSL is not compiled in, all
|
|
connections are rejected when -Q is set since TLS is unavailable.
|
|
|
|
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
|
|
|
---
|
|
diff --git a/src/pmproxy/src/http.c b/src/pmproxy/src/http.c
|
|
index cfbc8aec0c..e0d28ffc28 100644
|
|
--- a/src/pmproxy/src/http.c
|
|
+++ b/src/pmproxy/src/http.c
|
|
@@ -1094,6 +1094,20 @@ on_headers_complete(http_parser *request)
|
|
}
|
|
}
|
|
|
|
+ /* client certificate required for all servlets */
|
|
+ if (__pmServerHasFeature(PM_SERVER_FEATURE_CERT_REQD)) {
|
|
+#ifdef HAVE_OPENSSL
|
|
+ if (!client->stream.secure ||
|
|
+ !client->secure.ssl ||
|
|
+ SSL_get_peer_certificate(client->secure.ssl) == NULL) {
|
|
+ client->u.http.parser.status_code = HTTP_STATUS_FORBIDDEN;
|
|
+ }
|
|
+#else
|
|
+ /* no TLS support compiled in, reject all connections */
|
|
+ client->u.http.parser.status_code = HTTP_STATUS_FORBIDDEN;
|
|
+#endif
|
|
+ }
|
|
+
|
|
return sts;
|
|
}
|
|
|