From 845915e82846c3e84a9c7585ff584da32c1c5f38 Mon Sep 17 00:00:00 2001

From: Noriko Hosoi <nhosoi@redhat.com>

Date: Tue, 12 Jul 2016 14:33:17 -0700

Subject: [PATCH 12/15] Bug 1347760 - CI test: test case for bug 1347760

Description: Information disclosure via repeated use of LDAP ADD operation, etc.

(cherry picked from commit 27b8987108d875e3e9ee0d844548f8d94db350d1)

---

 dirsrvtests/tests/tickets/ticket1347760_test.py | 440 ++++++++++++++++++++++++

 1 file changed, 440 insertions(+)

 create mode 100644 dirsrvtests/tests/tickets/ticket1347760_test.py

diff --git a/dirsrvtests/tests/tickets/ticket1347760_test.py b/dirsrvtests/tests/tickets/ticket1347760_test.py

new file mode 100644

index 0000000..d2e9e37

--- /dev/null

+++ b/dirsrvtests/tests/tickets/ticket1347760_test.py

@@ -0,0 +1,440 @@

+# --- BEGIN COPYRIGHT BLOCK ---

+# Copyright (C) 2016 Red Hat, Inc.

+# All rights reserved.

+#

+# License: GPL (version 3 or any later version).

+# See LICENSE for details.

+# --- END COPYRIGHT BLOCK ---

+#

+import os

+import sys

+import time

+import ldap

+import logging

+import pytest

+from lib389 import DirSrv, Entry, tools, tasks

+from lib389.tools import DirSrvTools

+from lib389._constants import *

+from lib389.properties import *

+from lib389.tasks import *

+from lib389.utils import *

+

+logging.getLogger(__name__).setLevel(logging.DEBUG)

+log = logging.getLogger(__name__)

+

+installation1_prefix = None

+

+CONFIG_DN = 'cn=config'

+BOU = 'BOU'

+BINDOU = 'ou=%s,%s' % (BOU, DEFAULT_SUFFIX)

+BUID = 'buser123'

+TUID = 'tuser0'

+BINDDN = 'uid=%s,%s' % (BUID, BINDOU)

+BINDPW = BUID

+TESTDN = 'uid=%s,ou=people,%s' % (TUID, DEFAULT_SUFFIX)

+TESTPW = TUID

+BOGUSDN = 'uid=bogus,%s' % DEFAULT_SUFFIX

+BOGUSDN2 = 'uid=bogus,ou=people,%s' % DEFAULT_SUFFIX

+BOGUSSUFFIX = 'uid=bogus,ou=people,dc=bogus'

+GROUPOU = 'ou=groups,%s' % DEFAULT_SUFFIX

+BOGUSOU = 'ou=OU,%s' % DEFAULT_SUFFIX

+

+logging.getLogger(__name__).setLevel(logging.DEBUG)

+log = logging.getLogger(__name__)

+

+installation1_prefix = None

+

+class TopologyStandalone(object):

+    def __init__(self, standalone):

+        standalone.open()

+        self.standalone = standalone

+

+

+@pytest.fixture(scope="module")

+def topology(request):

+    global installation1_prefix

+    if installation1_prefix:

+        args_instance[SER_DEPLOYED_DIR] = installation1_prefix

+

+    # Creating standalone instance ...

+    standalone = DirSrv(verbose=False)

+    args_instance[SER_HOST] = HOST_STANDALONE

+    args_instance[SER_PORT] = PORT_STANDALONE

+    args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE

+    args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX

+    args_standalone = args_instance.copy()

+    standalone.allocate(args_standalone)

+    instance_standalone = standalone.exists()

+    if instance_standalone:

+        standalone.delete()

+    standalone.create()

+    standalone.open()

+

+    # Delete each instance in the end

+#    def fin():

+#        standalone.delete()

+#    request.addfinalizer(fin)

+

+    # Clear out the tmp dir

+    standalone.clearTmpDir(__file__)

+

+    return TopologyStandalone(standalone)

+

+def pattern_accesslog(file, log_pattern):

+    try:

+        pattern_accesslog.last_pos += 1

+    except AttributeError:

+        pattern_accesslog.last_pos = 0

+

+    found = None

+    file.seek(pattern_accesslog.last_pos)

+

+    # Use a while true iteration because 'for line in file: hit a

+    # python bug that break file.tell()

+    while True:

+        line = file.readline()

+        found = log_pattern.search(line)

+        if ((line == '') or (found)):

+            break

+

+    pattern_accesslog.last_pos = file.tell()

+    if found:

+        return line

+    else:

+        return None

+

+def check_op_result(server, op, dn, superior, exists, rc):

+    targetdn = dn

+    if op == 'search':

+        if exists:

+            opstr = 'Searching existing entry'

+        else:

+            opstr = 'Searching non-existing entry'

+    elif op == 'add':

+        if exists:

+            opstr = 'Adding existing entry'

+        else:

+            opstr = 'Adding non-existing entry'

+    elif op == 'modify':

+        if exists:

+            opstr = 'Modifying existing entry'

+        else:

+            opstr = 'Modifying non-existing entry'

+    elif op == 'modrdn':

+        if superior != None:

+            targetdn = superior

+            if exists:

+                opstr = 'Moving to existing superior'

+            else:

+                opstr = 'Moving to non-existing superior'

+        else:

+            if exists:

+                opstr = 'Renaming existing entry'

+            else:

+                opstr = 'Renaming non-existing entry'

+    elif op == 'delete':

+        if exists:

+            opstr = 'Deleting existing entry'

+        else:

+            opstr = 'Deleting non-existing entry'

+

+    if ldap.SUCCESS == rc:

+        expstr = 'be ok'

+    else:

+        expstr = 'fail with %s' % rc.__name__

+

+    log.info('%s %s, which should %s.' % (opstr, targetdn, expstr))

+    hit = 0

+    try:

+        if op == 'search':

+            centry = server.search_s(dn, ldap.SCOPE_BASE, 'objectclass=*')

+        elif op == 'add':

+            server.add_s(Entry((dn, {'objectclass': 'top extensibleObject'.split(),

+                                     'cn': 'test entry'})))

+        elif op == 'modify':

+            server.modify_s(dn, [(ldap.MOD_REPLACE, 'description', 'test')])

+        elif op == 'modrdn':

+            if superior != None:

+                server.rename_s(dn, 'uid=new', newsuperior=superior, delold=1)

+            else:

+                server.rename_s(dn, 'uid=new', delold=1)

+        elif op == 'delete':

+            server.delete_s(dn)

+        else:

+            log.fatal('Unknown operation %s' % op)

+            assert False

+    except ldap.LDAPError as e:

+        hit = 1

+        log.info("Exception (expected): %s" % type(e).__name__)

+        log.info('Desc ' + e.message['desc'])

+        assert isinstance(e, rc)

+        if e.message.has_key('matched'):

+            log.info('Matched is returned: ' + e.message['matched'])

+            if rc != ldap.NO_SUCH_OBJECT:

+                assert False

+

+    if ldap.SUCCESS == rc:

+        if op == 'search':

+            log.info('Search should return none')

+            assert len(centry) == 0

+    else:

+        if 0 == hit:

+            log.info('Expected to fail with %s, but passed' % rc.__name__)

+            assert False

+

+    log.info('PASSED\n')

+

+def test_ticket1347760(topology):

+    """

+    Prevent revealing the entry info to whom has no access rights.

+    """

+    log.info('Testing Bug 1347760 - Information disclosure via repeated use of LDAP ADD operation, etc.')

+

+    log.info('Disabling accesslog logbuffering')

+    topology.standalone.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE, 'nsslapd-accesslog-logbuffering', 'off')])

+

+    log.info('Bind as {%s,%s}' % (DN_DM, PASSWORD))

+    topology.standalone.simple_bind_s(DN_DM, PASSWORD)

+

+    log.info('Adding ou=%s a bind user belongs to.' % BOU)

+    topology.standalone.add_s(Entry((BINDOU, {

+                              'objectclass': 'top organizationalunit'.split(),

+                              'ou': BOU})))

+

+    log.info('Adding a bind user.')

+    topology.standalone.add_s(Entry((BINDDN,

+                                     {'objectclass': "top person organizationalPerson inetOrgPerson".split(),

+                                      'cn': 'bind user',

+                                      'sn': 'user',

+                                      'userPassword': BINDPW})))

+

+    log.info('Adding a test user.')

+    topology.standalone.add_s(Entry((TESTDN,

+                                     {'objectclass': "top person organizationalPerson inetOrgPerson".split(),

+                                      'cn': 'test user',

+                                      'sn': 'user',

+                                      'userPassword': TESTPW})))

+

+    log.info('Deleting aci in %s.' % DEFAULT_SUFFIX)

+    topology.standalone.modify_s(DEFAULT_SUFFIX, [(ldap.MOD_DELETE, 'aci', None)])

+

+    log.info('Bind case 1. the bind user has no rights to read the entry itself, bind should be successful.')

+    log.info('Bind as {%s,%s} who has no access rights.' % (BINDDN, BINDPW))

+    try:

+        topology.standalone.simple_bind_s(BINDDN, BINDPW)

+    except ldap.LDAPError as e:

+        log.info('Desc ' + e.message['desc'])

+        assert False

+

+    file_path = os.path.join(topology.standalone.prefix, 'var/log/dirsrv/slapd-%s/access' % topology.standalone.serverid)

+    file_obj = open(file_path, "r")

+    log.info('Access log path: %s' % file_path)

+

+    log.info('Bind case 2-1. the bind user does not exist, bind should fail with error %s' % ldap.INVALID_CREDENTIALS.__name__)

+    log.info('Bind as {%s,%s} who does not exist.' % (BOGUSDN, 'bogus'))

+    try:

+        topology.standalone.simple_bind_s(BOGUSDN, 'bogus')

+    except ldap.LDAPError as e:

+        log.info("Exception (expected): %s" % type(e).__name__)

+        log.info('Desc ' + e.message['desc'])

+        assert isinstance(e, ldap.INVALID_CREDENTIALS)

+        regex = re.compile('No such entry')

+        cause = pattern_accesslog(file_obj, regex)

+        if cause == None:

+            log.fatal('Cause not found - %s' % cause)

+            assert False

+        else:

+            log.info('Cause found - %s' % cause)

+

+    log.info('Bind case 2-2. the bind user\'s suffix does not exist, bind should fail with error %s' % ldap.INVALID_CREDENTIALS.__name__)

+    log.info('Bind as {%s,%s} who does not exist.' % (BOGUSSUFFIX, 'bogus'))

+    try:

+        topology.standalone.simple_bind_s(BOGUSSUFFIX, 'bogus')

+    except ldap.LDAPError as e:

+        log.info("Exception (expected): %s" % type(e).__name__)

+        log.info('Desc ' + e.message['desc'])

+        assert isinstance(e, ldap.INVALID_CREDENTIALS)

+        regex = re.compile('No such suffix')

+        cause = pattern_accesslog(file_obj, regex)

+        if cause == None:

+            log.fatal('Cause not found - %s' % cause)

+            assert False

+        else:

+            log.info('Cause found - %s' % cause)

+

+    log.info('Bind case 2-3. the bind user\'s password is wrong, bind should fail with error %s' % ldap.INVALID_CREDENTIALS.__name__)

+    log.info('Bind as {%s,%s} who does not exist.' % (BINDDN, 'bogus'))

+    try:

+        topology.standalone.simple_bind_s(BINDDN, 'bogus')

+    except ldap.LDAPError as e:

+        log.info("Exception (expected): %s" % type(e).__name__)

+        log.info('Desc ' + e.message['desc'])

+        assert isinstance(e, ldap.INVALID_CREDENTIALS)

+        regex = re.compile('Invalid credentials')

+        cause = pattern_accesslog(file_obj, regex)

+        if cause == None:

+            log.fatal('Cause not found - %s' % cause)

+            assert False

+        else:

+            log.info('Cause found - %s' % cause)

+

+    log.info('Adding aci for %s to %s.' % (BINDDN, BINDOU))

+    acival = '(targetattr="*")(version 3.0; acl "%s"; allow(all) userdn = "ldap:///%s";)' % (BUID, BINDDN)

+    log.info('aci: %s' % acival)

+    log.info('Bind as {%s,%s}' % (DN_DM, PASSWORD))

+    topology.standalone.simple_bind_s(DN_DM, PASSWORD)

+    topology.standalone.modify_s(BINDOU, [(ldap.MOD_ADD, 'aci', acival)])

+

+    log.info('Bind case 3. the bind user has the right to read the entry itself, bind should be successful.')

+    log.info('Bind as {%s,%s} which should be ok.\n' % (BINDDN, BINDPW))

+    topology.standalone.simple_bind_s(BINDDN, BINDPW)

+

+    log.info('The following operations are against the subtree the bind user %s has no rights.' % BINDDN)

+    # Search

+    exists = True

+    rc = ldap.SUCCESS

+    log.info('Search case 1. the bind user has no rights to read the search entry, it should return no search results with %s' % rc)

+    check_op_result(topology.standalone, 'search', TESTDN, None, exists, rc)

+

+    exists = False

+    rc = ldap.SUCCESS

+    log.info('Search case 2-1. the search entry does not exist, the search should return no search results with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'search', BOGUSDN, None, exists, rc)

+

+    exists = False

+    rc = ldap.SUCCESS

+    log.info('Search case 2-2. the search entry does not exist, the search should return no search results with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'search', BOGUSDN2, None, exists, rc)

+

+    # Add

+    exists = True

+    rc = ldap.INSUFFICIENT_ACCESS

+    log.info('Add case 1. the bind user has no rights AND the adding entry exists, it should fail with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'add', TESTDN, None, exists, rc)

+

+    exists = False

+    rc = ldap.INSUFFICIENT_ACCESS

+    log.info('Add case 2-1. the bind user has no rights AND the adding entry does not exist, it should fail with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'add', BOGUSDN, None, exists, rc)

+

+    exists = False

+    rc = ldap.INSUFFICIENT_ACCESS

+    log.info('Add case 2-2. the bind user has no rights AND the adding entry does not exist, it should fail with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'add', BOGUSDN2, None, exists, rc)

+

+    # Modify

+    exists = True

+    rc = ldap.INSUFFICIENT_ACCESS

+    log.info('Modify case 1. the bind user has no rights AND the modifying entry exists, it should fail with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'modify', TESTDN, None, exists, rc)

+

+    exists = False

+    rc = ldap.INSUFFICIENT_ACCESS

+    log.info('Modify case 2-1. the bind user has no rights AND the modifying entry does not exist, it should fail with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'modify', BOGUSDN, None, exists, rc)

+

+    exists = False

+    rc = ldap.INSUFFICIENT_ACCESS

+    log.info('Modify case 2-2. the bind user has no rights AND the modifying entry does not exist, it should fail with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'modify', BOGUSDN2, None, exists, rc)

+

+    # Modrdn

+    exists = True

+    rc = ldap.INSUFFICIENT_ACCESS

+    log.info('Modrdn case 1. the bind user has no rights AND the renaming entry exists, it should fail with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'modrdn', TESTDN, None, exists, rc)

+

+    exists = False

+    rc = ldap.INSUFFICIENT_ACCESS

+    log.info('Modrdn case 2-1. the bind user has no rights AND the renaming entry does not exist, it should fail with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'modrdn', BOGUSDN, None, exists, rc)

+

+    exists = False

+    rc = ldap.INSUFFICIENT_ACCESS

+    log.info('Modrdn case 2-2. the bind user has no rights AND the renaming entry does not exist, it should fail with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'modrdn', BOGUSDN2, None, exists, rc)

+

+    exists = True

+    rc = ldap.INSUFFICIENT_ACCESS

+    log.info('Modrdn case 3. the bind user has no rights AND the node moving an entry to exists, it should fail with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'modrdn', TESTDN, GROUPOU, exists, rc)

+

+    exists = False

+    rc = ldap.INSUFFICIENT_ACCESS

+    log.info('Modrdn case 4-1. the bind user has no rights AND the node moving an entry to does not, it should fail with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'modrdn', TESTDN, BOGUSOU, exists, rc)

+

+    exists = False

+    rc = ldap.INSUFFICIENT_ACCESS

+    log.info('Modrdn case 4-2. the bind user has no rights AND the node moving an entry to does not, it should fail with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'modrdn', TESTDN, BOGUSOU, exists, rc)

+

+    # Delete

+    exists = True

+    rc = ldap.INSUFFICIENT_ACCESS

+    log.info('Delete case 1. the bind user has no rights AND the deleting entry exists, it should fail with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'delete', TESTDN, None, exists, rc)

+

+    exists = False

+    rc = ldap.INSUFFICIENT_ACCESS

+    log.info('Delete case 2-1. the bind user has no rights AND the deleting entry does not exist, it should fail with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'delete', BOGUSDN, None, exists, rc)

+

+    exists = False

+    rc = ldap.INSUFFICIENT_ACCESS

+    log.info('Delete case 2-2. the bind user has no rights AND the deleting entry does not exist, it should fail with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'delete', BOGUSDN2, None, exists, rc)

+

+    log.info('EXTRA: Check no regressions')

+    log.info('Adding aci for %s to %s.' % (BINDDN, DEFAULT_SUFFIX))

+    acival = '(targetattr="*")(version 3.0; acl "%s-all"; allow(all) userdn = "ldap:///%s";)' % (BUID, BINDDN)

+    log.info('Bind as {%s,%s}' % (DN_DM, PASSWORD))

+    topology.standalone.simple_bind_s(DN_DM, PASSWORD)

+    topology.standalone.modify_s(DEFAULT_SUFFIX, [(ldap.MOD_ADD, 'aci', acival)])

+

+    log.info('Bind as {%s,%s}.' % (BINDDN, BINDPW))

+    try:

+        topology.standalone.simple_bind_s(BINDDN, BINDPW)

+    except ldap.LDAPError as e:

+        log.info('Desc ' + e.message['desc'])

+        assert False

+

+    exists = False

+    rc = ldap.NO_SUCH_OBJECT

+    log.info('Search case. the search entry does not exist, the search should fail with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'search', BOGUSDN2, None, exists, rc)

+    file_obj.close()

+

+    exists = True

+    rc = ldap.ALREADY_EXISTS

+    log.info('Add case. the adding entry already exists, it should fail with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'add', TESTDN, None, exists, rc)

+

+    exists = False

+    rc = ldap.NO_SUCH_OBJECT

+    log.info('Modify case. the modifying entry does not exist, it should fail with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'modify', BOGUSDN, None, exists, rc)

+

+    exists = False

+    rc = ldap.NO_SUCH_OBJECT

+    log.info('Modrdn case 1. the renaming entry does not exist, it should fail with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'modrdn', BOGUSDN, None, exists, rc)

+

+    exists = False

+    rc = ldap.NO_SUCH_OBJECT

+    log.info('Modrdn case 2. the node moving an entry to does not, it should fail with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'modrdn', TESTDN, BOGUSOU, exists, rc)

+

+    exists = False

+    rc = ldap.NO_SUCH_OBJECT

+    log.info('Delete case. the deleting entry does not exist, it should fail with %s' % rc.__name__)

+    check_op_result(topology.standalone, 'delete', BOGUSDN, None, exists, rc)

+

+    log.info('SUCCESS')

+

+if __name__ == '__main__':

+    # Run isolated

+    # -s for DEBUG mode

+

+    CURRENT_FILE = os.path.realpath(__file__)

+    pytest.main("-s %s" % CURRENT_FILE)

-- 

2.4.11