|
 |
74ca47 |
From d2648bbddbf087c4e3803a89cb67541a50682eae Mon Sep 17 00:00:00 2001
|
|
|
74ca47 |
From: William Brown <firstyear@redhat.com>
|
|
|
74ca47 |
Date: Mon, 15 May 2017 09:04:45 +1000
|
|
|
74ca47 |
Subject: [PATCH] Ticket 49231 - force EXTERNAL always
|
|
|
74ca47 |
|
|
|
74ca47 |
Bug Description: Because of how our sasl code works, EXTERNAL bypasses
|
|
|
74ca47 |
a number of checks so is always available.
|
|
|
74ca47 |
|
|
|
74ca47 |
Fix Description: Force EXTERNAL to the present mech list, regardless
|
|
|
74ca47 |
of the whitelist.
|
|
|
74ca47 |
|
|
|
74ca47 |
https://pagure.io/389-ds-base/issue/49231
|
|
|
74ca47 |
|
|
|
74ca47 |
Author: wibrown
|
|
|
74ca47 |
|
|
|
74ca47 |
Review by: mreynosd (Thanks!)
|
|
|
74ca47 |
|
|
|
74ca47 |
(cherry picked from commit e6e0db35842fc6612134cff5a08c4968230d1b2f)
|
|
|
74ca47 |
---
|
|
|
74ca47 |
dirsrvtests/tests/suites/sasl/allowed_mechs.py | 13 +++++++++++--
|
|
|
74ca47 |
ldap/servers/slapd/charray.c | 14 ++++++++++++++
|
|
|
74ca47 |
ldap/servers/slapd/saslbind.c | 9 +++++++++
|
|
|
74ca47 |
ldap/servers/slapd/slapi-private.h | 2 ++
|
|
|
74ca47 |
4 files changed, 36 insertions(+), 2 deletions(-)
|
|
|
74ca47 |
|
|
|
74ca47 |
diff --git a/dirsrvtests/tests/suites/sasl/allowed_mechs.py b/dirsrvtests/tests/suites/sasl/allowed_mechs.py
|
|
|
74ca47 |
index a3e385e..7958db4 100644
|
|
|
74ca47 |
--- a/dirsrvtests/tests/suites/sasl/allowed_mechs.py
|
|
|
74ca47 |
+++ b/dirsrvtests/tests/suites/sasl/allowed_mechs.py
|
|
|
74ca47 |
@@ -25,12 +25,21 @@ def test_sasl_allowed_mechs(topology_st):
|
|
|
74ca47 |
assert('EXTERNAL' in orig_mechs)
|
|
|
74ca47 |
|
|
|
74ca47 |
# Now edit the supported mechs. CHeck them again.
|
|
|
74ca47 |
- standalone.config.set('nsslapd-allowed-sasl-mechanisms', 'EXTERNAL, PLAIN')
|
|
|
74ca47 |
+ standalone.config.set('nsslapd-allowed-sasl-mechanisms', 'PLAIN')
|
|
|
74ca47 |
|
|
|
74ca47 |
limit_mechs = standalone.rootdse.supported_sasl()
|
|
|
74ca47 |
- print(limit_mechs)
|
|
|
74ca47 |
assert('PLAIN' in limit_mechs)
|
|
|
74ca47 |
+ # Should always be in the allowed list, even if not set.
|
|
|
74ca47 |
assert('EXTERNAL' in limit_mechs)
|
|
|
74ca47 |
+ # Should not be there!
|
|
|
74ca47 |
+ assert('GSSAPI' not in limit_mechs)
|
|
|
74ca47 |
+
|
|
|
74ca47 |
+ standalone.config.set('nsslapd-allowed-sasl-mechanisms', 'PLAIN, EXTERNAL')
|
|
|
74ca47 |
+
|
|
|
74ca47 |
+ limit_mechs = standalone.rootdse.supported_sasl()
|
|
|
74ca47 |
+ assert('PLAIN' in limit_mechs)
|
|
|
74ca47 |
+ assert('EXTERNAL' in limit_mechs)
|
|
|
74ca47 |
+ # Should not be there!
|
|
|
74ca47 |
assert('GSSAPI' not in limit_mechs)
|
|
|
74ca47 |
|
|
|
74ca47 |
# Do a config reset
|
|
|
74ca47 |
diff --git a/ldap/servers/slapd/charray.c b/ldap/servers/slapd/charray.c
|
|
|
74ca47 |
index 6b89714..9056f16 100644
|
|
|
74ca47 |
--- a/ldap/servers/slapd/charray.c
|
|
|
74ca47 |
+++ b/ldap/servers/slapd/charray.c
|
|
|
74ca47 |
@@ -272,6 +272,20 @@ charray_utf8_inlist(
|
|
|
74ca47 |
return( 0 );
|
|
|
74ca47 |
}
|
|
|
74ca47 |
|
|
|
74ca47 |
+/*
|
|
|
74ca47 |
+ * Assert that some str s is in the charray, or add it.
|
|
|
74ca47 |
+ */
|
|
|
74ca47 |
+void
|
|
|
74ca47 |
+charray_assert_present(char ***a, char *s)
|
|
|
74ca47 |
+{
|
|
|
74ca47 |
+ int result = charray_utf8_inlist(*a, s);
|
|
|
74ca47 |
+ /* Not in the list */
|
|
|
74ca47 |
+ if (result == 0) {
|
|
|
74ca47 |
+ char *sdup = slapi_ch_strdup(s);
|
|
|
74ca47 |
+ slapi_ch_array_add_ext(a, sdup);
|
|
|
74ca47 |
+ }
|
|
|
74ca47 |
+}
|
|
|
74ca47 |
+
|
|
|
74ca47 |
int slapi_ch_array_utf8_inlist(char **a, char *s)
|
|
|
74ca47 |
{
|
|
|
74ca47 |
return charray_utf8_inlist(a,s);
|
|
|
74ca47 |
diff --git a/ldap/servers/slapd/saslbind.c b/ldap/servers/slapd/saslbind.c
|
|
|
74ca47 |
index 75b83fe..dd0c4fb 100644
|
|
|
74ca47 |
--- a/ldap/servers/slapd/saslbind.c
|
|
|
74ca47 |
+++ b/ldap/servers/slapd/saslbind.c
|
|
|
74ca47 |
@@ -794,6 +794,15 @@ char **ids_sasl_listmech(Slapi_PBlock *pb)
|
|
|
74ca47 |
ret = sup_ret;
|
|
|
74ca47 |
}
|
|
|
74ca47 |
|
|
|
74ca47 |
+ /*
|
|
|
74ca47 |
+ * https://pagure.io/389-ds-base/issue/49231
|
|
|
74ca47 |
+ * Because of the way that SASL mechs are managed in bind.c and saslbind.c
|
|
|
74ca47 |
+ * even if EXTERNAL was *not* in the list of allowed mechs, it was allowed
|
|
|
74ca47 |
+ * in the bind process because it bypasses lots of our checking. As a result
|
|
|
74ca47 |
+ * we have to always present it.
|
|
|
74ca47 |
+ */
|
|
|
74ca47 |
+ charray_assert_present(&ret, "EXTERNAL");
|
|
|
74ca47 |
+
|
|
|
74ca47 |
slapi_log_err(SLAPI_LOG_TRACE, "ids_sasl_listmech", "<=\n");
|
|
|
74ca47 |
|
|
|
74ca47 |
return ret;
|
|
|
74ca47 |
diff --git a/ldap/servers/slapd/slapi-private.h b/ldap/servers/slapd/slapi-private.h
|
|
|
74ca47 |
index 3f732e8..0836d66 100644
|
|
|
74ca47 |
--- a/ldap/servers/slapd/slapi-private.h
|
|
|
74ca47 |
+++ b/ldap/servers/slapd/slapi-private.h
|
|
|
74ca47 |
@@ -834,6 +834,8 @@ void charray_subtract( char **a, char **b, char ***c );
|
|
|
74ca47 |
char **charray_intersection(char **a, char **b);
|
|
|
74ca47 |
int charray_get_index(char **array, char *s);
|
|
|
74ca47 |
int charray_normdn_add(char ***chararray, char *dn, char *errstr);
|
|
|
74ca47 |
+void charray_assert_present(char ***a, char *s);
|
|
|
74ca47 |
+
|
|
|
74ca47 |
|
|
|
74ca47 |
/******************************************************************************
|
|
|
74ca47 |
* value array routines.
|
|
|
74ca47 |
--
|
|
|
74ca47 |
2.9.4
|
|
|
74ca47 |
|