<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style>img {
max-width: 100%; height: auto;
}
</style>
</head>
<body>
<div class="content">
<p style="color: #777777;">
<a href="https://gitlab.com/dueno">Daiki Ueno</a>
commented:
</p>
<div style="">
<p dir="auto">Indeed. However, this doesn't apply every <code>fopen</code> in <code>lib/</code>. GnuTLS has the <a href="https://www.gnutls.org/manual/gnutls.html#Thread-safety" rel="nofollow noreferrer noopener" target="_blank">design</a> that prohibits access to a single <code>gnutls_session_t</code> object from multiple threads, and also the global initialization within the ELF constructor should be protected.</p>
<p dir="auto">According to <code>git grep</code>, there are the following occurrences of <code>fopen</code>:</p>
<pre class="code highlight js-syntax-highlight plaintext" lang="plaintext" v-pre="true"><code><span id="LC1" class="line" lang="plaintext">lib/auth/psk_passwd.c: fd = fopen(cred->password_file, "r");</span>
<span id="LC2" class="line" lang="plaintext">lib/auth/srp_passwd.c: fd = fopen(pconf_file, "r");</span>
<span id="LC3" class="line" lang="plaintext">lib/auth/srp_passwd.c: fd = fopen(cred->password_file, "r");</span>
<span id="LC4" class="line" lang="plaintext">lib/file.c: fd = fopen(file, "r");</span>
<span id="LC5" class="line" lang="plaintext">lib/fips.c: fd = fopen(FIPS_KERNEL_FILE, "r");</span>
<span id="LC6" class="line" lang="plaintext">lib/inih/ini.c: file = fopen(filename, "r");</span>
<span id="LC7" class="line" lang="plaintext">lib/kx.c: keylog = fopen(keylogfile, "a");</span>
<span id="LC8" class="line" lang="plaintext">lib/minitasn1/structure.c: file = fopen (output_file_name, "w");</span>
<span id="LC9" class="line" lang="plaintext">lib/pkcs11.c: fp = fopen(configfile, "r");</span>
<span id="LC10" class="line" lang="plaintext">lib/verify-tofu.c: fd = fopen(file, "rb");</span>
<span id="LC11" class="line" lang="plaintext">lib/verify-tofu.c: fd = fopen(db_name, "ab+");</span>
<span id="LC12" class="line" lang="plaintext">lib/verify-tofu.c: fd = fopen(db_name, "ab+");</span></code></pre>
<p dir="auto">I think the calls in <code>lib/auth/*</code> and <code>lib/file.c</code> can only reach from the <code>gnutls_session_t</code> interface. Similarly, the calls in <code>lib/fips.c</code> and <code>lib/inih/ini.c</code> are only reachable from the ELF constructor, and the function calling <code>fopen</code> in <code>lib/minitasn1/structure.c</code> is not used at all.</p>
<p dir="auto">The others (keylogfile, PKCS#11 config, and TOFU) might be still problematic, though.</p>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #777;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/-/issues/985#note_339470410">view it on GitLab</a>.
<br>
You're receiving this email because of your account on gitlab.com.
If you'd like to receive fewer emails, you can
<a href="https://gitlab.com/-/sent_notifications/3885e24f73236188c79873110e03eae5/unsubscribe">unsubscribe</a>
from this thread or
adjust your notification settings.
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/-/issues/985#note_339470410"}}</script>
</p>
</div>
</body>
</html>