[Bug 1560429] Re: squid3: segfault when ftp passive mode is not available

Fri Jul 7 15:00:19 UTC 2017

** Description changed:

  [Impact]

  Users who use squid as an FTP proxy and access sites that block ftp PASV
  mode will trigger a squid segfault. That means a brief service
  interruption, as upstart/systemd will restart it.

  Since this is a crash, the backport seems justified. But there is an
  effective workaround, see below.

  Upstream committed a fix, the same fix we are introducing here, which
  essentially adds a lot of NULL checks but at the same time disables the
  fallback ftp command EPRT should passive mode fail. Upstream states that
  this command doesn't work properly in squid yet.

  This is also the recommended workaround: disable EPRT by setting the
  following in /etc/squid/squid.conf and restarting the service:

  ftp_eprt off

  [Test Case]

-  * detailed instructions how to reproduce the bug
+ - setup a xenial machine/lxd with proftpd configured like this
+ (/etc/proftpd/proftpd.conf):

-  * these should allow someone who is not familiar with the affected
-    package to reproduce the bug and verify that the updated package fixes
-    the problem.
+ http://pastebin.ubuntu.com/25039718/
+ 
+ Alternatively, setup any anonymout ftp server to your liking with
+ passive mode disabled/forbidden.
+ 
+ - Create a simple file under the anonymous area, for the ftp client to fetch later on:
+ echo hello | sudo tee /srv/ftp/readme.txt
+ 
+ - install the squid proxy under test in another machine/lxd.
+ 
+ - configure /etc/squid/squid.conf like this:
+ http://pastebin.ubuntu.com/25039736/
+ 
+ - in the above, adjust localnet to your network, or replace the line "http_access allow localnet" with "http_access allow all" to accept everything
+ - access the ftp server via the squid proxy:
+ 
+ $ ftp_proxy=http://xenial-squid-passive.lxd:3128/ wget ftp://xenial-
+ proftpd.lxd/readme.txt -O /dev/null  -t1
+ 
+ (replace the URLs with whatever you need to reach the squid server under
+ test, and the ftp server you setup)
+ 
+ In the case of a vulnerable squid server you will get:
+ a) wget gives up:
+ andreas at nsn7:~$ ftp_proxy=http://xenial-squid-passive.lxd:3128/ wget ftp://xenial-proftpd.lxd/readme.txt -O /dev/null  -t1
+ --2017-07-07 11:58:16--  ftp://xenial-proftpd.lxd/readme.txt
+ Resolving xenial-squid-passive.lxd (xenial-squid-passive.lxd)... 10.0.100.151
+ Connecting to xenial-squid-passive.lxd (xenial-squid-passive.lxd)|10.0.100.151|:3128... connected.
+ Proxy request sent, awaiting response... No data received.
+ Giving up.
+ 
+ b) /var/log/squid/cache.log shows a squid restart with a new PID:
+ 2017/07/07 14:58:19 kid1| Starting Squid Cache version 3.5.12 for x86_64-pc-linux-gnu...
+ 2017/07/07 14:58:19 kid1| Service Name: squid
+ 2017/07/07 14:58:19 kid1| Process ID 1638
+ 
+ c) proftpd /var/log/proftpd/extended.log will show the passive ftp attempts being forbidden with a 501 error:
+ xenial-squid-passive.lxd UNKNOWN - [07/Jul/2017:14:58:16 +0000] "USER anonymous" 331 -
+ xenial-squid-passive.lxd UNKNOWN ftp [07/Jul/2017:14:58:16 +0000] "PASS (hidden)" 230 -
+ xenial-squid-passive.lxd UNKNOWN ftp [07/Jul/2017:14:58:16 +0000] "TYPE A" 200 -
+ xenial-squid-passive.lxd UNKNOWN ftp [07/Jul/2017:14:58:16 +0000] "MDTM readme.txt" 213 -
+ xenial-squid-passive.lxd UNKNOWN ftp [07/Jul/2017:14:58:16 +0000] "EPSV 1" 501 -
+ xenial-squid-passive.lxd UNKNOWN ftp [07/Jul/2017:14:58:16 +0000] "PASV" 501 -
+ 

  [Regression Potential]

   * discussion of how regressions are most likely to manifest as a result
  of this change.

   * It is assumed that any SRU candidate patch is well-tested before
     upload and has a low overall risk of regression, but it's important
     to make the effort to think about what ''could'' happen in the
     event of a regression.

   * This both shows the SRU team that the risks have been considered,
     and provides guidance to testers in regression-testing the SRU.

  [Other Info]

   * Anything else you think is useful to include
   * Anticipate questions from users, SRU, +1 maintenance, security teams and the Technical Board
   * and address these questions in advance

** Description changed:

  [Impact]