From 6ced3f552e4c29f588eb3a56def5a485c2e89a73 Mon Sep 17 00:00:00 2001
From: Mark Reynolds <mreynolds@redhat.com>
Date: Thu, 19 Mar 2020 21:24:05 -0400
Subject: [PATCH 1/4] Issue 50800 - wildcards in rootdn-allow-ip attribute are
not accepted
Description: The asterick character was missing from the allowed character list.
Also cleaned up the source in the C file.
Thanks @yrro for contributing the original patch!
relates: https://pagure.io/389-ds-base/issue/50800
Reviewed by: firstyear (Thanks!)
---
.../suites/plugins/rootdn_plugin_test.py | 73 ++++++++++-
.../plugins/rootdn_access/rootdn_access.c | 119 ++++++++++--------
2 files changed, 137 insertions(+), 55 deletions(-)
diff --git a/dirsrvtests/tests/suites/plugins/rootdn_plugin_test.py b/dirsrvtests/tests/suites/plugins/rootdn_plugin_test.py
index af5c4c4d4..a54fd8efc 100644
--- a/dirsrvtests/tests/suites/plugins/rootdn_plugin_test.py
+++ b/dirsrvtests/tests/suites/plugins/rootdn_plugin_test.py
@@ -13,7 +13,6 @@ import pytest
from lib389.tasks import *
from lib389.tools import DirSrvTools
from lib389.topologies import topology_st
-
from lib389._constants import PLUGIN_ROOTDN_ACCESS, DN_CONFIG, DEFAULT_SUFFIX, DN_DM, PASSWORD
logging.getLogger(__name__).setLevel(logging.DEBUG)
@@ -439,6 +438,7 @@ def test_rootdn_access_allowed_ip(topology_st):
log.fatal('test_rootdn_access_allowed_ip: Root DN was incorrectly able to bind')
assert False
+
#
# Allow localhost
#
@@ -745,6 +745,77 @@ def test_rootdn_config_validate(topology_st):
log.info('test_rootdn_config_validate: PASSED')
+def test_rootdn_access_denied_ip_wildcard(topology_st, rootdn_setup, rootdn_cleanup):
+ """Test denied IP feature with a wildcard
+
+ :id: 73c74f62-9ac2-4bb6-8a63-bacc8d8bbf93
+ :setup: Standalone instance, rootdn plugin set up
+ :steps:
+ 1. Set rootdn-deny-ip to '127.*'
+ 2. Bind as Root DN
+ 3. Change the denied IP so root DN succeeds
+ 4. Bind as Root DN
+ :expectedresults:
+ 1. Success
+ 2. Should fail
+ 3. Success
+ 4. Success
+ """
+
+ log.info('Running test_rootdn_access_denied_ip_wildcard...')
+
+ plugin.add_deny_ip('127.*')
+ time.sleep(.5)
+
+ # Bind as root DN - should fail
+ uri = 'ldap://{}:{}'.format('127.0.0.1', topology_st.standalone.port)
+ with pytest.raises(ldap.UNWILLING_TO_PERFORM):
+ rootdn_bind(topology_st.standalone, uri=uri)
+
+ # Change the denied IP so root DN succeeds
+ plugin.apply_mods([(ldap.MOD_REPLACE, 'rootdn-deny-ip', '255.255.255.255')])
+ time.sleep(.5)
+
+ # Bind should succeed
+ rootdn_bind(topology_st.standalone, uri=uri)
+
+
+def test_rootdn_access_allowed_ip_wildcard(topology_st, rootdn_setup, rootdn_cleanup):
+ """Test allowed ip feature
+
+ :id: c3e22c61-9ed2-4e89-8243-6ff686ecad9b
+ :setup: Standalone instance, rootdn plugin set up
+ :steps:
+ 1. Set allowed ip to 255.255.255.255 - blocks the Root DN
+ 2. Bind as Root DN
+ 3. Allow 127.*
+ 4. Bind as Root DN
+ :expectedresults:
+ 1. Success
+ 2. Should fail
+ 3. Success
+ 4. Success
+ """
+
+ log.info('Running test_rootdn_access_allowed_ip...')
+
+ # Set allowed ip to 255.255.255.255 - blocks the Root DN
+ plugin.add_allow_ip('255.255.255.255')
+ time.sleep(.5)
+
+ # Bind as Root DN - should fail
+ uri = 'ldap://{}:{}'.format("127.0.0.1", topology_st.standalone.port)
+ with pytest.raises(ldap.UNWILLING_TO_PERFORM):
+ rootdn_bind(topology_st.standalone, uri=uri)
+
+ # Allow localhost
+ plugin.add_allow_ip('127.*')
+ time.sleep(.5)
+
+ # Bind should succeed
+ rootdn_bind(topology_st.standalone, uri=uri)
+
+
if __name__ == '__main__':
# Run isolated
# -s for DEBUG mode
diff --git a/ldap/servers/plugins/rootdn_access/rootdn_access.c b/ldap/servers/plugins/rootdn_access/rootdn_access.c
index 1cb999792..aba44ce72 100644
--- a/ldap/servers/plugins/rootdn_access/rootdn_access.c
+++ b/ldap/servers/plugins/rootdn_access/rootdn_access.c
@@ -48,14 +48,14 @@
/*
* Plugin Functions
*/
-int rootdn_init(Slapi_PBlock *pb);
-static int rootdn_start(Slapi_PBlock *pb);
-static int rootdn_close(Slapi_PBlock *pb);
-static int rootdn_load_config(Slapi_PBlock *pb);
-static int rootdn_check_access(Slapi_PBlock *pb);
-static int rootdn_check_host_wildcard(char *host, char *client_host);
+int32_t rootdn_init(Slapi_PBlock *pb);
+static int32_t rootdn_start(Slapi_PBlock *pb);
+static int32_t rootdn_close(Slapi_PBlock *pb);
+static int32_t rootdn_load_config(Slapi_PBlock *pb);
+static int32_t rootdn_check_access(Slapi_PBlock *pb);
+static int32_t rootdn_check_host_wildcard(char *host, char *client_host);
static int rootdn_check_ip_wildcard(char *ip, char *client_ip);
-static int rootdn_preop_bind_init(Slapi_PBlock *pb);
+static int32_t rootdn_preop_bind_init(Slapi_PBlock *pb);
char *strToLower(char *str);
/*
@@ -104,10 +104,10 @@ rootdn_get_plugin_dn(void)
}
-int
+int32_t
rootdn_init(Slapi_PBlock *pb)
{
- int status = 0;
+ int32_t status = 0;
char *plugin_identity = NULL;
slapi_log_err(SLAPI_LOG_TRACE, ROOTDN_PLUGIN_SUBSYSTEM,
@@ -157,7 +157,7 @@ rootdn_init(Slapi_PBlock *pb)
return status;
}
-static int
+static int32_t
rootdn_preop_bind_init(Slapi_PBlock *pb)
{
if (slapi_pblock_set(pb, SLAPI_PLUGIN_INTERNAL_PRE_BIND_FN, (void *)rootdn_check_access) != 0) {
@@ -169,7 +169,7 @@ rootdn_preop_bind_init(Slapi_PBlock *pb)
return 0;
}
-static int
+static int32_t
rootdn_start(Slapi_PBlock *pb __attribute__((unused)))
{
slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "--> rootdn_start\n");
@@ -196,14 +196,14 @@ rootdn_free(void)
ips_to_deny = NULL;
}
-static int
+static int32_t
rootdn_close(Slapi_PBlock *pb __attribute__((unused)))
{
rootdn_free();
return 0;
}
-static int
+static int32_t
rootdn_load_config(Slapi_PBlock *pb)
{
Slapi_Entry *e = NULL;
@@ -217,9 +217,9 @@ rootdn_load_config(Slapi_PBlock *pb)
char *token, *iter = NULL, *copy;
char hour[3], min[3];
size_t end;
- int result = 0;
- int time;
- int i;
+ int32_t result = 0;
+ int32_t time;
+
slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "--> rootdn_load_config\n");
@@ -346,7 +346,7 @@ rootdn_load_config(Slapi_PBlock *pb)
goto free_and_return;
}
if (hosts_tmp) {
- for (i = 0; hosts_tmp[i] != NULL; i++) {
+ for (size_t i = 0; hosts_tmp[i] != NULL; i++) {
end = strspn(hosts_tmp[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz");
if (!end || hosts_tmp[i][end] != '\0') {
slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config - "
@@ -359,7 +359,7 @@ rootdn_load_config(Slapi_PBlock *pb)
}
}
if (hosts_to_deny_tmp) {
- for (i = 0; hosts_to_deny_tmp[i] != NULL; i++) {
+ for (size_t i = 0; hosts_to_deny_tmp[i] != NULL; i++) {
end = strspn(hosts_to_deny_tmp[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz");
if (!end || hosts_to_deny_tmp[i][end] != '\0') {
slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config - "
@@ -372,8 +372,8 @@ rootdn_load_config(Slapi_PBlock *pb)
}
}
if (ips_tmp) {
- for (i = 0; ips_tmp[i] != NULL; i++) {
- end = strspn(ips_tmp[i], "0123456789:ABCDEFabcdef.");
+ for (size_t i = 0; ips_tmp[i] != NULL; i++) {
+ end = strspn(ips_tmp[i], "0123456789:ABCDEFabcdef.*");
if (!end || ips_tmp[i][end] != '\0') {
slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config - "
"IP address contains invalid characters (%s), skipping\n",
@@ -399,7 +399,7 @@ rootdn_load_config(Slapi_PBlock *pb)
}
}
if (ips_to_deny_tmp) {
- for (i = 0; ips_to_deny_tmp[i] != NULL; i++) {
+ for (size_t i = 0; ips_to_deny_tmp[i] != NULL; i++) {
end = strspn(ips_to_deny_tmp[i], "0123456789:ABCDEFabcdef.*");
if (!end || ips_to_deny_tmp[i][end] != '\0') {
slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config - "
@@ -453,7 +453,7 @@ free_and_return:
}
-static int
+static int32_t
rootdn_check_access(Slapi_PBlock *pb)
{
PRNetAddr *client_addr = NULL;
@@ -461,9 +461,8 @@ rootdn_check_access(Slapi_PBlock *pb)
time_t curr_time;
struct tm *timeinfo = NULL;
char *dnsName = NULL;
- int isRoot = 0;
- int rc = SLAPI_PLUGIN_SUCCESS;
- int i;
+ int32_t isRoot = 0;
+ int32_t rc = SLAPI_PLUGIN_SUCCESS;
/*
* Verify this is a root DN
@@ -493,8 +492,8 @@ rootdn_check_access(Slapi_PBlock *pb)
curr_total = (time_t)(timeinfo->tm_hour * 3600) + (timeinfo->tm_min * 60);
if ((curr_total < open_time) || (curr_total >= close_time)) {
- slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - Bind not in the "
- "allowed time window\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Bind not in the allowed time window\n");
return -1;
}
}
@@ -512,8 +511,8 @@ rootdn_check_access(Slapi_PBlock *pb)
daysAllowed = strToLower(daysAllowed);
if (!strstr(daysAllowed, today)) {
- slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
- "Bind not allowed for today(%s), only allowed on days: %s\n",
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
+ "Bind not allowed for today(%s), only allowed on days: %s\n",
today, daysAllowed);
return -1;
}
@@ -522,7 +521,7 @@ rootdn_check_access(Slapi_PBlock *pb)
* Check the host restrictions, deny always overrides allow
*/
if (hosts || hosts_to_deny) {
- char buf[PR_NETDB_BUF_SIZE];
+ char buf[PR_NETDB_BUF_SIZE] = {0};
char *host;
/*
@@ -530,8 +529,8 @@ rootdn_check_access(Slapi_PBlock *pb)
*/
client_addr = (PRNetAddr *)slapi_ch_malloc(sizeof(PRNetAddr));
if (slapi_pblock_get(pb, SLAPI_CONN_CLIENTNETADDR, client_addr) != 0) {
- slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
- "Could not get client address for hosts.\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Could not get client address for hosts.\n");
rc = -1;
goto free_and_return;
}
@@ -545,14 +544,14 @@ rootdn_check_access(Slapi_PBlock *pb)
dnsName = slapi_ch_strdup(host_entry->h_name);
} else {
/* no hostname */
- slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
- "Client address missing hostname\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Client address missing hostname\n");
rc = -1;
goto free_and_return;
}
} else {
- slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
- "client IP address could not be resolved\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - client IP address could not be resolved\n");
rc = -1;
goto free_and_return;
}
@@ -560,18 +559,22 @@ rootdn_check_access(Slapi_PBlock *pb)
* Now we have our hostname, now do our checks
*/
if (hosts_to_deny) {
- for (i = 0; hosts_to_deny[i] != NULL; i++) {
+ for (size_t i = 0; hosts_to_deny[i] != NULL; i++) {
host = hosts_to_deny[i];
/* check for wild cards */
if (host[0] == '*') {
if (rootdn_check_host_wildcard(host, dnsName) == 0) {
/* match, return failure */
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
+ "hostname (%s) matched denied host (%s)\n", dnsName, host);
rc = -1;
goto free_and_return;
}
} else {
if (strcasecmp(host, dnsName) == 0) {
/* we have a match, return failure */
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
+ "hostname (%s) matched denied host (%s)\n", dnsName, host);
rc = -1;
goto free_and_return;
}
@@ -580,7 +583,7 @@ rootdn_check_access(Slapi_PBlock *pb)
rc = 0;
}
if (hosts) {
- for (i = 0; hosts[i] != NULL; i++) {
+ for (size_t i = 0; hosts[i] != NULL; i++) {
host = hosts[i];
/* check for wild cards */
if (host[0] == '*') {
@@ -604,14 +607,15 @@ rootdn_check_access(Slapi_PBlock *pb)
* Check the IP address restrictions, deny always overrides allow
*/
if (ips || ips_to_deny) {
- char ip_str[256];
+ char ip_str[256] = {0};
char *ip;
- int ip_len, i;
+ int32_t ip_len;
if (client_addr == NULL) {
client_addr = (PRNetAddr *)slapi_ch_malloc(sizeof(PRNetAddr));
if (slapi_pblock_get(pb, SLAPI_CONN_CLIENTNETADDR, client_addr) != 0) {
- slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - Could not get client address for IP.\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Could not get client address for IP.\n");
rc = -1;
goto free_and_return;
}
@@ -624,13 +628,15 @@ rootdn_check_access(Slapi_PBlock *pb)
v4addr.inet.family = PR_AF_INET;
v4addr.inet.ip = client_addr->ipv6.ip.pr_s6_addr32[3];
if (PR_NetAddrToString(&v4addr, ip_str, sizeof(ip_str)) != PR_SUCCESS) {
- slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - Could not get IPv4 from client address.\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Could not get IPv4 from client address.\n");
rc = -1;
goto free_and_return;
}
} else {
if (PR_NetAddrToString(client_addr, ip_str, sizeof(ip_str)) != PR_SUCCESS) {
- slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - Could not get IPv6 from client address.\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Could not get IPv6 from client address.\n");
rc = -1;
goto free_and_return;
}
@@ -639,18 +645,22 @@ rootdn_check_access(Slapi_PBlock *pb)
* Now we have our IP address, do our checks
*/
if (ips_to_deny) {
- for (i = 0; ips_to_deny[i] != NULL; i++) {
+ for (size_t i = 0; ips_to_deny[i] != NULL; i++) {
ip = ips_to_deny[i];
ip_len = strlen(ip);
if (ip[ip_len - 1] == '*') {
if (rootdn_check_ip_wildcard(ips_to_deny[i], ip_str) == 0) {
/* match, return failure */
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
+ "ip address (%s) matched denied IP address (%s)\n", ip_str, ip);
rc = -1;
goto free_and_return;
}
} else {
if (strcasecmp(ip_str, ip) == 0) {
/* match, return failure */
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
+ "ip address (%s) matched denied IP address (%s)\n", ip_str, ip);
rc = -1;
goto free_and_return;
}
@@ -659,7 +669,7 @@ rootdn_check_access(Slapi_PBlock *pb)
rc = 0;
}
if (ips) {
- for (i = 0; ips[i] != NULL; i++) {
+ for (size_t i = 0; ips[i] != NULL; i++) {
ip = ips[i];
ip_len = strlen(ip);
if (ip[ip_len - 1] == '*') {
@@ -668,6 +678,7 @@ rootdn_check_access(Slapi_PBlock *pb)
rc = 0;
goto free_and_return;
}
+
} else {
if (strcasecmp(ip_str, ip) == 0) {
/* match, return success */
@@ -688,17 +699,19 @@ free_and_return:
return rc;
}
-static int
+static int32_t
rootdn_check_host_wildcard(char *host, char *client_host)
{
- int host_len = strlen(host);
- int client_len = strlen(client_host);
- int i, j;
+ size_t host_len = strlen(host);
+ size_t client_len = strlen(client_host);
+ size_t i, j;
+
/*
* Start at the end of the string and move backwards, and skip the first char "*"
*/
if (client_len < host_len) {
/* this can't be a match */
+
return -1;
}
for (i = host_len - 1, j = client_len - 1; i > 0; i--, j--) {
@@ -714,7 +727,7 @@ static int
rootdn_check_ip_wildcard(char *ip, char *client_ip)
{
size_t ip_len = strlen(ip);
- int i;
+
/*
* Start at the beginning of the string and move forward, and skip the last char "*"
*/
@@ -722,7 +735,7 @@ rootdn_check_ip_wildcard(char *ip, char *client_ip)
/* this can't be a match */
return -1;
}
- for (i = 0; i < ip_len - 1; i++) {
+ for (size_t i = 0; i < ip_len - 1; i++) {
if (ip[i] != client_ip[i]) {
return -1;
}
@@ -734,9 +747,7 @@ rootdn_check_ip_wildcard(char *ip, char *client_ip)
char *
strToLower(char *str)
{
- size_t i;
-
- for (i = 0; str && i < strlen(str); i++) {
+ for (size_t i = 0; str && i < strlen(str); i++) {
str[i] = tolower(str[i]);
}
return str;
--
2.25.3