mirror/openldap
2
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2024-12-21 03:10:25 +08:00
Code Issues Packages Projects Releases Wiki Activity

Don't disclose information to attacker.

Browse Source 
Referrals need work (not sure why return referrals for bind requests)
This commit is contained in:
Kurt Zeilenga 2004-03-27 18:19:52 +00:00
parent 9b9127eb3f
commit 2876b3bb84
2 changed files with 55 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
servers/slapd/back-bdb/bind.c
View File

@ -44,9 +44,11 @@ bdb_bind( Operation *op, SlapReply *rs )
DB_LOCK lock;
#ifdef NEW_LOGGING
LDAP_LOG ( OPERATION, ARGS, "==> bdb_bind: dn: %s\n", op->o_req_dn.bv_val, 0, 0 );
LDAP_LOG ( OPERATION, ARGS,
"==> bdb_bind: dn: %s\n", op->o_req_dn.bv_val, 0, 0 );
#else
Debug( LDAP_DEBUG_ARGS, "==> bdb_bind: dn: %s\n", op->o_req_dn.bv_val, 0, 0);
Debug( LDAP_DEBUG_ARGS,
"==> bdb_bind: dn: %s\n", op->o_req_dn.bv_val, 0, 0);
#endif
/* allow noauth binds */
@ -99,7 +101,8 @@ dn2entry_retry:
rs->sr_flags |= REP_MATCHED_MUSTBEFREED;
}
bdb_cache_return_entry_r( bdb->bi_dbenv, &bdb->bi_cache, e, &lock );
bdb_cache_return_entry_r( bdb->bi_dbenv,
&bdb->bi_cache, e, &lock );
e = NULL;
} else {
rs->sr_ref = referral_rewrite( default_referral,
@ -144,14 +147,18 @@ dn2entry_retry:
if ( is_entry_alias( e ) ) {
/* entry is an alias, don't allow bind */
#ifdef NEW_LOGGING
LDAP_LOG ( OPERATION, DETAIL1, "bdb_bind: entry is alias\n", 0, 0, 0 );
LDAP_LOG ( OPERATION, DETAIL1,
"bdb_bind: entry is alias\n", 0, 0, 0 );
#else
Debug( LDAP_DEBUG_TRACE, "entry is alias\n", 0,
0, 0 );
Debug( LDAP_DEBUG_TRACE, "entry is alias\n", 0, 0, 0 );
#endif
#if 1
rs->sr_err = LDAP_INVALID_CREDENTIALS;
#else
rs->sr_err = LDAP_ALIAS_PROBLEM;
rs->sr_text = "entry is alias";
#endif
goto done;
}
#endif
@ -183,16 +190,26 @@ dn2entry_retry:
rs->sr_err = access_allowed( op, e,
password, NULL, ACL_AUTH, NULL );
if ( ! rs->sr_err ) {
#if 1
rs->sr_err = LDAP_INVALID_CREDENTIALS;
#else
rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
#endif
goto done;
}
if ( (a = attr_find( e->e_attrs, password )) == NULL ) {
#if 1
rs->sr_err = LDAP_INVALID_CREDENTIALS;
#else
rs->sr_err = LDAP_INAPPROPRIATE_AUTH;
#endif
goto done;
}
if ( slap_passwd_check( op->o_conn, a, &op->oq_bind.rb_cred, &rs->sr_text ) != 0 ) {
if ( slap_passwd_check( op->o_conn,
a, &op->oq_bind.rb_cred, &rs->sr_text ) != 0 )
{
rs->sr_err = LDAP_INVALID_CREDENTIALS;
goto done;
}
@ -202,7 +219,9 @@ dn2entry_retry:
#ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
case LDAP_AUTH_KRBV41:
if ( krbv4_ldap_auth( op->o_bd, &op->oq_bind.rb_cred, &ad ) != LDAP_SUCCESS ) {
if ( krbv4_ldap_auth( op->o_bd, &op->oq_bind.rb_cred, &ad )
!= LDAP_SUCCESS )
{
rs->sr_err = LDAP_INVALID_CREDENTIALS,
goto done;
}
@ -214,8 +233,8 @@ dn2entry_retry:
goto done;
}
krbval.bv_len = sprintf( krbname, "%s%s%s@%s", ad.pname, *ad.pinst ? "."
: "", ad.pinst, ad.prealm );
krbval.bv_len = sprintf( krbname, "%s%s%s@%s", ad.pname,
*ad.pinst ? "." : "", ad.pinst, ad.prealm );
if ( (a = attr_find( e->e_attrs, krbattr )) == NULL ) {
/*
@ -238,14 +257,10 @@ dn2entry_retry:
}
rs->sr_err = 0;
break;
case LDAP_AUTH_KRBV42:
rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
rs->sr_text = "Kerberos bind step 2 not supported";
goto done;
#endif
default:
assert( 0 ); /* should not be unreachable */
rs->sr_err = LDAP_STRONG_AUTH_NOT_SUPPORTED;
rs->sr_text = "authentication method not supported";
}

38
servers/slapd/back-ldbm/bind.c
View File

@ -49,7 +49,8 @@ ldbm_back_bind(
LDAP_LOG( BACK_LDBM, ENTRY,
"ldbm_back_bind: dn: %s.\n", op->o_req_dn.bv_val, 0, 0 );
#else
Debug(LDAP_DEBUG_ARGS, "==> ldbm_back_bind: dn: %s\n", op->o_req_dn.bv_val, 0, 0);
Debug(LDAP_DEBUG_ARGS,
"==> ldbm_back_bind: dn: %s\n", op->o_req_dn.bv_val, 0, 0);
#endif
if ( op->oq_bind.rb_method == LDAP_AUTH_SIMPLE && be_isroot_pw( op ) ) {
@ -114,13 +115,18 @@ ldbm_back_bind(
/* entry is an alias, don't allow bind */
#ifdef NEW_LOGGING
LDAP_LOG( BACK_LDBM, INFO,
"ldbm_back_bind: entry (%s) is an alias.\n", e->e_name.bv_val, 0, 0 );
"ldbm_back_bind: entry (%s) is an alias.\n",
e->e_name.bv_val, 0, 0 );
#else
Debug( LDAP_DEBUG_TRACE, "entry is alias\n", 0,
0, 0 );
Debug( LDAP_DEBUG_TRACE, "entry is alias\n", 0, 0, 0 );
#endif
#if 1
rc = LDAP_INVALID_CREDENTIALS;
#else
rs->sr_text = "entry is alias";
rc = LDAP_ALIAS_PROBLEM;
#endif
goto return_results;
}
@ -136,7 +142,6 @@ ldbm_back_bind(
0, 0 );
#endif
if( rs->sr_ref != NULL ) {
rc = LDAP_REFERRAL;
rs->sr_matched = ch_strdup( e->e_name.bv_val );
@ -153,17 +158,27 @@ ldbm_back_bind(
if ( ! access_allowed( op, e,
password, NULL, ACL_AUTH, NULL ) )
{
#if 1
rc = LDAP_INVALID_CREDENTIALS;
#else
rc = LDAP_INSUFFICIENT_ACCESS;
#endif
goto return_results;
}
if ( (a = attr_find( e->e_attrs, password )) == NULL ) {
/* stop front end from sending result */
#if 1
rc = LDAP_INVALID_CREDENTIALS;
#else
rc = LDAP_INAPPROPRIATE_AUTH;
#endif
goto return_results;
}
if ( slap_passwd_check( op->o_conn, a, &op->oq_bind.rb_cred, &rs->sr_text ) != 0 ) {
if ( slap_passwd_check( op->o_conn,
a, &op->oq_bind.rb_cred, &rs->sr_text ) != 0 )
{
/* stop front end from sending result */
rc = LDAP_INVALID_CREDENTIALS;
goto return_results;
@ -174,7 +189,9 @@ ldbm_back_bind(
#ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
case LDAP_AUTH_KRBV41:
if ( krbv4_ldap_auth( op->o_bd, &op->oq_bind.rb_cred, &ad ) != LDAP_SUCCESS ) {
if ( krbv4_ldap_auth( op->o_bd, &op->oq_bind.rb_cred, &ad )
!= LDAP_SUCCESS )
{
rc = LDAP_INVALID_CREDENTIALS;
goto return_results;
}
@ -213,15 +230,10 @@ ldbm_back_bind(
}
rc = 0;
break;
case LDAP_AUTH_KRBV42:
rs->sr_text = "Kerberos bind step 2 not supported";
/* stop front end from sending result */
rc = LDAP_UNWILLING_TO_PERFORM;
goto return_results;
#endif
default:
assert( 0 ); /* should not be reachable */
rs->sr_text = "authentication method not supported";
rc = LDAP_STRONG_AUTH_NOT_SUPPORTED;
goto return_results;