|
 |
2fc102 |
From 0a509d518dd5d17e32e3a4c34b319a38210ba17b Mon Sep 17 00:00:00 2001
|
|
|
2fc102 |
From: Lukas Slebodnik <lslebodn@redhat.com>
|
|
|
2fc102 |
Date: Mon, 25 Nov 2013 16:01:59 +0100
|
|
|
2fc102 |
Subject: [PATCH 9/9] SYSDB: Sanitize filter before removing ghost attrs
|
|
|
2fc102 |
|
|
|
2fc102 |
sysdb_add_user fails with EIO if enumeration is disabled and user contains
|
|
|
2fc102 |
backslashes.
|
|
|
2fc102 |
We try to remove ghost attributes from groups with disabled enumeration,
|
|
|
2fc102 |
but unsanitized filter is used to find ghost attributes
|
|
|
2fc102 |
"(|(ghost=usr\\\\002)" and ldb cannot parse this filter.
|
|
|
2fc102 |
|
|
|
2fc102 |
Resolves:
|
|
|
2fc102 |
https://fedorahosted.org/sssd/ticket/2163
|
|
|
2fc102 |
---
|
|
|
2fc102 |
src/db/sysdb_ops.c | 9 ++++++++-
|
|
|
2fc102 |
src/tests/sysdb-tests.c | 19 +++++++++++++++++++
|
|
|
2fc102 |
2 files changed, 27 insertions(+), 1 deletion(-)
|
|
|
2fc102 |
|
|
|
2fc102 |
diff --git a/src/db/sysdb_ops.c b/src/db/sysdb_ops.c
|
|
|
2fc102 |
index eb88cd256d0c2e45e1528e8a867e42354215cc7f..890bf1eb3cc5fc0b6eb6f7a145aee6d87945cd8d 100644
|
|
|
2fc102 |
--- a/src/db/sysdb_ops.c
|
|
|
2fc102 |
+++ b/src/db/sysdb_ops.c
|
|
|
2fc102 |
@@ -1091,6 +1091,7 @@ sysdb_remove_ghostattr_from_groups(struct sysdb_ctx *sysdb,
|
|
|
2fc102 |
struct ldb_dn *tmpdn;
|
|
|
2fc102 |
const char *group_attrs[] = {SYSDB_NAME, SYSDB_GHOST, SYSDB_ORIG_MEMBER, NULL};
|
|
|
2fc102 |
const char *userdn;
|
|
|
2fc102 |
+ char *sanitized_name;
|
|
|
2fc102 |
char *filter;
|
|
|
2fc102 |
errno_t ret = EOK;
|
|
|
2fc102 |
size_t group_count = 0;
|
|
|
2fc102 |
@@ -1101,7 +1102,13 @@ sysdb_remove_ghostattr_from_groups(struct sysdb_ctx *sysdb,
|
|
|
2fc102 |
return ENOENT;
|
|
|
2fc102 |
}
|
|
|
2fc102 |
|
|
|
2fc102 |
- filter = talloc_asprintf(tmp_ctx, "(|(%s=%s)", SYSDB_GHOST, name);
|
|
|
2fc102 |
+ ret = sss_filter_sanitize(tmp_ctx, name, &sanitized_name);
|
|
|
2fc102 |
+ if (ret != EOK) {
|
|
|
2fc102 |
+ goto done;
|
|
|
2fc102 |
+ }
|
|
|
2fc102 |
+
|
|
|
2fc102 |
+ filter = talloc_asprintf(tmp_ctx, "(|(%s=%s)",
|
|
|
2fc102 |
+ SYSDB_GHOST, sanitized_name);
|
|
|
2fc102 |
if (!filter) {
|
|
|
2fc102 |
ret = ENOMEM;
|
|
|
2fc102 |
goto done;
|
|
|
2fc102 |
diff --git a/src/tests/sysdb-tests.c b/src/tests/sysdb-tests.c
|
|
|
2fc102 |
index bf964fd76d33bbceac6c1846db7a5011db1375f5..ddbf6f28fd5024945fedcb3c6e2122948c4f1459 100644
|
|
|
2fc102 |
--- a/src/tests/sysdb-tests.c
|
|
|
2fc102 |
+++ b/src/tests/sysdb-tests.c
|
|
|
2fc102 |
@@ -3900,6 +3900,8 @@ START_TEST(test_odd_characters)
|
|
|
2fc102 |
struct ldb_message *msg;
|
|
|
2fc102 |
const struct ldb_val *val;
|
|
|
2fc102 |
const char odd_username[] = "*(odd)\\user,name";
|
|
|
2fc102 |
+ const char odd_username_orig_dn[] =
|
|
|
2fc102 |
+ "\\2a\\28odd\\29\\5cuser,name,cn=users,dc=example,dc=com";
|
|
|
2fc102 |
const char odd_groupname[] = "*(odd\\*)\\group,name";
|
|
|
2fc102 |
const char odd_netgroupname[] = "*(odd\\*)\\netgroup,name";
|
|
|
2fc102 |
const char *received_user;
|
|
|
2fc102 |
@@ -4010,6 +4012,23 @@ START_TEST(test_odd_characters)
|
|
|
2fc102 |
fail_unless(ret == EOK, "sysdb_delete_group error [%d][%s]",
|
|
|
2fc102 |
ret, strerror(ret));
|
|
|
2fc102 |
|
|
|
2fc102 |
+ /* Add */
|
|
|
2fc102 |
+ ret = sysdb_add_user(test_ctx->sysdb,
|
|
|
2fc102 |
+ test_ctx->domain,
|
|
|
2fc102 |
+ odd_username,
|
|
|
2fc102 |
+ 10000, 0,
|
|
|
2fc102 |
+ "","","",
|
|
|
2fc102 |
+ odd_username_orig_dn,
|
|
|
2fc102 |
+ NULL, 5400, 0);
|
|
|
2fc102 |
+ fail_unless(ret == EOK, "sysdb_add_user error [%d][%s]",
|
|
|
2fc102 |
+ ret, strerror(ret));
|
|
|
2fc102 |
+
|
|
|
2fc102 |
+ /* Delete User */
|
|
|
2fc102 |
+ ret = sysdb_delete_user(test_ctx->sysdb, test_ctx->domain,
|
|
|
2fc102 |
+ odd_username, 10000);
|
|
|
2fc102 |
+ fail_unless(ret == EOK, "sysdb_delete_user error [%d][%s]",
|
|
|
2fc102 |
+ ret, strerror(ret));
|
|
|
2fc102 |
+
|
|
|
2fc102 |
/* ===== Netgroups ===== */
|
|
|
2fc102 |
/* Add */
|
|
|
2fc102 |
ret = sysdb_add_netgroup(test_ctx->sysdb, test_ctx->domain,
|
|
|
2fc102 |
--
|
|
|
2fc102 |
1.8.4.2
|
|
|
2fc102 |
|