Changeset 11126 in ntrip

Timestamp:

Oct 24, 2026, 11:14:36 PM (18 hours ago)

Author:

stuerze

Message:

Some fixes from security point of view

Location:

trunk/BNC

Files:

• CHANGELOG.md (modified) (1 diff)
• src/RTCM3/clock_and_orbit/clock_orbit_rtcm_new.cpp (modified) (2 diffs)
• src/RTCM3/crsEncoder.cpp (modified) (5 diffs)
• src/bnchelp.html (modified) (1 diff)
• src/bncnetqueryv2.cpp (modified) (1 diff)
• src/bncwindow.cpp (modified) (1 diff)
• src/upload/bncrtnetuploadcaster.cpp (modified) (2 diffs)
• src/upload/bncuploadcaster.cpp (modified) (4 diffs)

trunk/BNC/CHANGELOG.md

@@ -54 +54 @@
 - FIXED: Memory corruption by stream content: VTEC messages with spherical harmonics degree or order 16 (IGS-SSR and RTCM-SSR; with 4 layers BNC crashed), RTCM-SSR metadata with more than 7 entries, names of 31 characters in RTCM 1300/1301/1302; range check of the VTEC parameters from the RTNet engine
 - FIXED: Password no longer sent in the request line (Ntrip Version 1 via proxy, RTSP) and no longer written to the log (RTSP)
+- FIXED: Upload of CRS messages 1300/1302 (and encoding of 1301): names were sent padded to 31 characters, database links without their length field (unreadable for decoders); no CRS messages for a custom transformation
+- FIXED: Upload via Ntrip 2s: 'Ignore SSL authorization errors' had no effect (handshake failed), and with it ticked no client certificate was presented; SSL errors are logged with their reason; for upload and download the ignored errors are logged; without OpenSSL run-time libraries no upload instead of an unencrypted Ntrip Version 2 upload
+- FIXED: Encoding of new RTCM-SSR metadata with more than 30 additional parameter bits
+- CHANGED: Help text of 'Ignore SSL authorization errors' explains that the server is then not authenticated
 
 ## 2.13.7 (2026-07-31)

trunk/BNC/src/RTCM3/clock_and_orbit/clock_orbit_rtcm_new.cpp

@@ -472 +472 @@
       for (i = 0; i < md->NumEntries; i++) {
         E_MODEL_CORRECTION_TYPE_INDICATOR(md->Entries[i].TypeIndicator)
-        E_ADDITIONAL_MODEL_PARAMETER_INDICATOR(md->Entries[i].ApplicationIndicator)
+        E_MODEL_CORRECTION_APPLICATION_INDICATOR(md->Entries[i].ApplicationIndicator)
         E_NON_DEFAULT_MODEL_CORRECTION_INDICATOR(md->Entries[i].nonDefaultIndicator)
         if (md->Entries[i].nonDefaultIndicator) {
@@ -489 +489 @@
         if (md->Entries[i].nonDefaultIndicator &&
             md->Entries[i].additionalParameterIndicator) {
-          E_ADDITIONAL_MODEL_PARAMETER_DATA(md->Entries[i].additionalParameterData, md->Entries[i].additionalParameterNumBits)       
+          /* up to 255 bits, only 32 stored (leading bits zero); in pieces of
+             16 bits, as ADDBITS cannot handle more than 30 bits */
+          unsigned int k = md->Entries[i].additionalParameterNumBits;
+          while (k) {
+            unsigned int n = (k > 16) ? 16 : k;
+            k -= n;
+            E_ADDITIONAL_MODEL_PARAMETER_DATA((k < 32) ? (md->Entries[i].additionalParameterData >> k) : 0, n)
+          }
       }
     }

trunk/BNC/src/RTCM3/crsEncoder.cpp

@@ -11 +11 @@
 using namespace std;
 
+// Length of a name for the 5-bit length field: up to the terminating 0,
+// at most 31 characters
+////////////////////////////////////////////////////////////////////////////
+static int nameLength(const char* name, size_t bufSize) {
+  size_t n = strnlen(name, bufSize);
+  return (n > 31) ? 31 : int(n);
+}
+
 // build up RTCM3 for serviceCrs
 ////////////////////////////////////////////////////////////////////////////
@@ -17 +25 @@
   INITBLOCK
   ADDBITS(12, 1300)
-  int N = sizeof(serviceCrs._name) / sizeof(serviceCrs._name[0]);
-  if (N > 31) {N = 31;}
+  int N = nameLength(serviceCrs._name, sizeof(serviceCrs._name));
   ADDBITS(5, N)
   for(int i = 0; i < N; i++) {
@@ -35 +42 @@
 
   ADDBITS(12, 1302)
-  int N = sizeof(rtcmCrs._name) / sizeof(rtcmCrs._name[0]);
-  if (N > 31) {N = 31;}
+  int N = nameLength(rtcmCrs._name, sizeof(rtcmCrs._name));
   ADDBITS(5, N)
   for(int i = 0; i < N; i++) {
@@ -44 +50 @@
   ADDBITS(5, rtcmCrs._plateNumber)
   int dblinknum = rtcmCrs._databaseLinks.size();
+  if (dblinknum > 7) {dblinknum = 7;} // 3 bits
   ADDBITS(3, dblinknum);
-  if (dblinknum) {
-    for(int d = 0; d < dblinknum; d++) {
-      N = sizeof(rtcmCrs._databaseLinks[d]) / sizeof(rtcmCrs._databaseLinks[d][0]);
-      for(int i = 0; i < N; i++) {
-        ADDBITS(8, rtcmCrs._databaseLinks[d].toLatin1()[i])
-      }
+  for(int d = 0; d < dblinknum; d++) {
+    QByteArray dblink = rtcmCrs._databaseLinks[d].toLatin1();
+    N = nameLength(dblink.constData(), dblink.size());
+    ADDBITS(5, N)
+    for(int i = 0; i < N; i++) {
+      ADDBITS(8, dblink[i])
     }
   }
@@ -65 +72 @@
 
   ADDBITS(12, 1301)
-  int N = sizeof(helmertPar._sourceName) / sizeof(helmertPar._sourceName[0]);
-  if (N > 31) {N = 31;}
+  int N = nameLength(helmertPar._sourceName, sizeof(helmertPar._sourceName));
   ADDBITS(5, N)
   for(int i = 0; i < N; i++) {
     ADDBITS(8, helmertPar._sourceName[i])
   }
-  N = sizeof(helmertPar._targetName) / sizeof(helmertPar._targetName[0]);
-  if (N > 31) {N = 31;}
+  N = nameLength(helmertPar._targetName, sizeof(helmertPar._targetName));
   ADDBITS(5, N)
   for(int i = 0; i < N; i++) {

trunk/BNC/src/bnchelp.html

@@ -2684 +2684 @@
     Broadcaster. </p>
   <p>
-    Tick 'Ignore SSL authorization errors' if you generally trust the server and do not want to be bothered with this.
+    Tick 'Ignore SSL authorization errors' to accept a server certificate that cannot be verified, e.g. a
+    self-signed certificate or one issued for another host name. The connection is then still encrypted, but the
+    server is not authenticated: anybody able to intercept the connection may receive your user name and password
+    and feed in manipulated data. The ignored errors are logged. Better save the CA certificate of the Ntrip
+    Broadcaster in the 'Path to SSL certificates' directory.
   </p>
   <p><img src="IMG/Figure07.png" width=800 /></p>

trunk/BNC/src/bncnetqueryv2.cpp

@@ -286 +286 @@
     const QSslError& err = it.next();
     msg += err.errorString();
-  }
-
+    if (it.hasNext()) {
+      msg += "; ";
+    }
+  }
+
+  msg = _url.host() + ": " + msg;
   if (_sslIgnoreErrors) {
     _reply->ignoreSslErrors();
-    BNC_CORE->slotMessage("BNC ignores SSL errors as configured", true);
+    BNC_CORE->slotMessage((msg + " (ignored as configured)").toLatin1(), true);
   }
   else {

trunk/BNC/src/bncwindow.cpp

@@ -1548 +1548 @@
   _sslCaCertPathLineEdit->setWhatsThis(tr("<p>Communication with an Ntrip Broadcaster over SSL requires the exchange of server certificates. Specify the path to a directory where you save CA certificates on your system. </p><p>BNC creates from *.crt and *.pem files a CA certificate database, which is used by the socket during the handshake phase to validate the peer's certificate. </p><p>Note that SSL communication is usually done over port 443. <i>[key: sslCaCertPath]</i></p>"));
   _sslClientCertPathLineEdit->setWhatsThis(tr("<p>Two-sided communication with an Ntrip Broadcaster over SSL requires in addition the exchange of client certificates. Specify the full path to the client certificates on your system.</p><p></p><p>The file naming convention for client certificates in BNC is as follows: &lt;hostname&gt;.&lt;port&gt;.crt for the certificate and &lt;hostname&gt;.&lt;port&gt;.key for the private key, where &lt;hostname&gt; is without https://. </p><p> If available, the client or personal authentication certificate is presented to the peer during the SSL handshake process. Password protected key files are not supported. </p><p>Don't try communication via two sided SSL if you are not sure whether this is supported by the involved Ntrip Broadcaster. </p><p>Note that SSL communication is usually done over port 443. <i>[key: sslClientCertPath]</i></p>"));
-  _sslIgnoreErrorsCheckBox->setWhatsThis(tr("<p>SSL communication may involve queries coming from the Ntrip Broadcaster. Tick 'Ignore SSL authorization errors' if you don't want to be bothered with this. <i>[key: sslIgnoreErrors]</i></p>"));
+  _sslIgnoreErrorsCheckBox->setWhatsThis(tr("<p>Tick 'Ignore SSL authorization errors' to accept a server certificate that cannot be verified, e.g. a self-signed certificate or one issued for another host name. The connection is then still encrypted, but the server is not authenticated: anybody able to intercept the connection may receive your user name and password and feed in manipulated data. The ignored errors are logged. Better save the CA certificate of the Ntrip Broadcaster in the 'Path to SSL certificates' directory. <i>[key: sslIgnoreErrors]</i></p>"));
 
   // WhatsThis, General

trunk/BNC/src/upload/bncrtnetuploadcaster.cpp

@@ -1068 +1068 @@
     // -----------
     QByteArray hlpBufferServiceCrs;
-    if (sizeof(serviceCrs._name) > 0) {
+    if (serviceCrs._name[0]) { // no CRS messages for a custom transformation
         if (fmod(epoTime.gpssec(), _samplRtcmCrs) == 0.0) {
             memset(obuffer, 0, sizeof(obuffer));
@@ -1081 +1081 @@
     // --------
     QByteArray hlpBufferRtcmCrs;
-    if (sizeof(rtcmCrs._name) > 0) {
+    if (rtcmCrs._name[0]) {
         if (fmod(epoTime.gpssec(), _samplRtcmCrs) == 0.0) {
             memset(obuffer, 0, sizeof(obuffer));

trunk/BNC/src/upload/bncuploadcaster.cpp

@@ -80 +80 @@
   if (_ntripVersion == "2s") {
     if (!QSslSocket::supportsSsl()) {
-      emit(newMessage(
-          "For SSL support please install OpenSSL run-time libraries: Ntrip Version 2 is tried",
-          true));
-      _ntripVersion == "2";
+      // no fallback to Ntrip Version 2: user name and password would be sent
+      // unencrypted although an encrypted connection was configured
+      emit(newMessage(_mountpoint.toLatin1() + "@" + _casterOutHost.toLatin1() +
+          ": No SSL support, please install OpenSSL run-time libraries: no upload", true));
     } else {
       _secure = true;
@@ -150 +150 @@
       const QSslError& err = it.next();
       msg += err.errorString();
-    }
-    emit(newMessage(msg.toLatin1(), true));
+      if (it.hasNext()) {
+        msg += "; ";
+      }
+    }
+    if (_sslIgnoreErrors) {
+      _outSocket->ignoreSslErrors();
+      msg += " (ignored as configured)";
+    }
+    emit(newMessage(_mountpoint.toLatin1() + "@" + _casterOutHost.toLatin1() + ": " + msg.toLatin1(), true));
   }
 }
@@ -203 +210 @@
   }
 
+  if (_ntripVersion == "2s" && !_secure) { // no SSL support, see constructor
+    return;
+  }
+
   if (_outSocket != 0 &&
       _outSocket->state() == QAbstractSocket::ConnectedState) {
@@ -224 +235 @@
   _outSocket->setProxy(QNetworkProxy::NoProxy);
 
-  if (_sslIgnoreErrors) {
-    _outSocket->ignoreSslErrors();
-  } else {
-    bncSslConfig sslConfig = BNC_SSL_CONFIG;
-    QFile clientCrtFile(_crtFileName);
-    QFile privateKeyFile(_keyFileName);
-    if ( clientCrtFile.exists() && privateKeyFile.exists()) {
-      // set local certificate
-      clientCrtFile.open(QIODevice::ReadOnly);
-      QSslCertificate clientCrt(&clientCrtFile);
-      sslConfig.setLocalCertificate(clientCrt);
-      // set private key if available
-      privateKeyFile.open(QIODevice::ReadOnly);
-      QSslKey privateKey(&privateKeyFile, QSsl::Rsa);
-      sslConfig.setPrivateKey(privateKey);
-    }
-    _outSocket->setSslConfiguration(sslConfig);
-    connect(_outSocket, SIGNAL(sslErrors(QList<QSslError>)), this, SLOT(slotSslErrors(QList<QSslError>)));
-  }
+  bncSslConfig sslConfig = BNC_SSL_CONFIG;
+  QFile clientCrtFile(_crtFileName);
+  QFile privateKeyFile(_keyFileName);
+  if ( clientCrtFile.exists() && privateKeyFile.exists()) {
+    // set local certificate
+    clientCrtFile.open(QIODevice::ReadOnly);
+    QSslCertificate clientCrt(&clientCrtFile);
+    sslConfig.setLocalCertificate(clientCrt);
+    // set private key if available
+    privateKeyFile.open(QIODevice::ReadOnly);
+    QSslKey privateKey(&privateKeyFile, QSsl::Rsa);
+    sslConfig.setPrivateKey(privateKey);
+  }
+  _outSocket->setSslConfiguration(sslConfig);
+  // Direct connection: the socket lives in this thread, the caster object in
+  // the main thread. The slot must run during the handshake, both for
+  // ignoreSslErrors() to take effect and to access _outSocket safely.
+  connect(_outSocket, SIGNAL(sslErrors(QList<QSslError>)), this, SLOT(slotSslErrors(QList<QSslError>)),
+          Qt::DirectConnection);
 
   if (!_proxy) {