mirror/openldap
2
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2024-12-21 03:10:25 +08:00
Code Issues Packages Projects Releases Wiki Activity

Don't disclose information to attacker.

Browse Source 
Referrals need work (not sure why return referrals for bind requests)
This commit is contained in:
Kurt Zeilenga 2004-03-27 18:19:52 +00:00
parent 9b9127eb3f
commit 2876b3bb84
2 changed files with 55 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
servers/slapd/back-bdb/bind.c
View File

@ -44,9 +44,11 @@ bdb_bind( Operation *op, SlapReply *rs )
DB_LOCK lock; DB_LOCK lock;
#ifdef NEW_LOGGING #ifdef NEW_LOGGING
LDAP_LOG ( OPERATION, ARGS, "==> bdb_bind: dn: %s\n", op->o_req_dn.bv_val, 0, 0 ); LDAP_LOG ( OPERATION, ARGS,
"==> bdb_bind: dn: %s\n", op->o_req_dn.bv_val, 0, 0 );
#else #else
Debug( LDAP_DEBUG_ARGS, "==> bdb_bind: dn: %s\n", op->o_req_dn.bv_val, 0, 0); Debug( LDAP_DEBUG_ARGS,
"==> bdb_bind: dn: %s\n", op->o_req_dn.bv_val, 0, 0);
#endif #endif
/* allow noauth binds */ /* allow noauth binds */
@ -99,7 +101,8 @@ dn2entry_retry:
rs->sr_flags |= REP_MATCHED_MUSTBEFREED; rs->sr_flags |= REP_MATCHED_MUSTBEFREED;
} }
bdb_cache_return_entry_r( bdb->bi_dbenv, &bdb->bi_cache, e, &lock ); bdb_cache_return_entry_r( bdb->bi_dbenv,
&bdb->bi_cache, e, &lock );
e = NULL; e = NULL;
} else { } else {
rs->sr_ref = referral_rewrite( default_referral, rs->sr_ref = referral_rewrite( default_referral,
@ -144,14 +147,18 @@ dn2entry_retry:
if ( is_entry_alias( e ) ) { if ( is_entry_alias( e ) ) {
/* entry is an alias, don't allow bind */ /* entry is an alias, don't allow bind */
#ifdef NEW_LOGGING #ifdef NEW_LOGGING
LDAP_LOG ( OPERATION, DETAIL1, "bdb_bind: entry is alias\n", 0, 0, 0 ); LDAP_LOG ( OPERATION, DETAIL1,
"bdb_bind: entry is alias\n", 0, 0, 0 );
#else #else
Debug( LDAP_DEBUG_TRACE, "entry is alias\n", 0, Debug( LDAP_DEBUG_TRACE, "entry is alias\n", 0, 0, 0 );
0, 0 );
#endif #endif
#if 1
rs->sr_err = LDAP_INVALID_CREDENTIALS;
#else
rs->sr_err = LDAP_ALIAS_PROBLEM; rs->sr_err = LDAP_ALIAS_PROBLEM;
rs->sr_text = "entry is alias"; rs->sr_text = "entry is alias";
#endif
goto done; goto done;
} }
#endif #endif
@ -183,16 +190,26 @@ dn2entry_retry:
rs->sr_err = access_allowed( op, e, rs->sr_err = access_allowed( op, e,
password, NULL, ACL_AUTH, NULL ); password, NULL, ACL_AUTH, NULL );
if ( ! rs->sr_err ) { if ( ! rs->sr_err ) {
#if 1
rs->sr_err = LDAP_INVALID_CREDENTIALS;
#else
rs->sr_err = LDAP_INSUFFICIENT_ACCESS; rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
#endif
goto done; goto done;
} }
if ( (a = attr_find( e->e_attrs, password )) == NULL ) { if ( (a = attr_find( e->e_attrs, password )) == NULL ) {
#if 1
rs->sr_err = LDAP_INVALID_CREDENTIALS;
#else
rs->sr_err = LDAP_INAPPROPRIATE_AUTH; rs->sr_err = LDAP_INAPPROPRIATE_AUTH;
#endif
goto done; goto done;
} }
if ( slap_passwd_check( op->o_conn, a, &op->oq_bind.rb_cred, &rs->sr_text ) != 0 ) { if ( slap_passwd_check( op->o_conn,
a, &op->oq_bind.rb_cred, &rs->sr_text ) != 0 )
{
rs->sr_err = LDAP_INVALID_CREDENTIALS; rs->sr_err = LDAP_INVALID_CREDENTIALS;
goto done; goto done;
} }
@ -202,7 +219,9 @@ dn2entry_retry:
#ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
case LDAP_AUTH_KRBV41: case LDAP_AUTH_KRBV41:
if ( krbv4_ldap_auth( op->o_bd, &op->oq_bind.rb_cred, &ad ) != LDAP_SUCCESS ) { if ( krbv4_ldap_auth( op->o_bd, &op->oq_bind.rb_cred, &ad )
!= LDAP_SUCCESS )
{
rs->sr_err = LDAP_INVALID_CREDENTIALS, rs->sr_err = LDAP_INVALID_CREDENTIALS,
goto done; goto done;
} }
@ -214,8 +233,8 @@ dn2entry_retry:
goto done; goto done;
} }
krbval.bv_len = sprintf( krbname, "%s%s%s@%s", ad.pname, *ad.pinst ? "." krbval.bv_len = sprintf( krbname, "%s%s%s@%s", ad.pname,
: "", ad.pinst, ad.prealm ); *ad.pinst ? "." : "", ad.pinst, ad.prealm );
if ( (a = attr_find( e->e_attrs, krbattr )) == NULL ) { if ( (a = attr_find( e->e_attrs, krbattr )) == NULL ) {
/* /*
@ -238,14 +257,10 @@ dn2entry_retry:
} }
rs->sr_err = 0; rs->sr_err = 0;
break; break;
case LDAP_AUTH_KRBV42:
rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
rs->sr_text = "Kerberos bind step 2 not supported";
goto done;
#endif #endif
default: default:
assert( 0 ); /* should not be unreachable */
rs->sr_err = LDAP_STRONG_AUTH_NOT_SUPPORTED; rs->sr_err = LDAP_STRONG_AUTH_NOT_SUPPORTED;
rs->sr_text = "authentication method not supported"; rs->sr_text = "authentication method not supported";
} }

38
servers/slapd/back-ldbm/bind.c
View File

@ -49,7 +49,8 @@ ldbm_back_bind(
LDAP_LOG( BACK_LDBM, ENTRY, LDAP_LOG( BACK_LDBM, ENTRY,
"ldbm_back_bind: dn: %s.\n", op->o_req_dn.bv_val, 0, 0 ); "ldbm_back_bind: dn: %s.\n", op->o_req_dn.bv_val, 0, 0 );
#else #else
Debug(LDAP_DEBUG_ARGS, "==> ldbm_back_bind: dn: %s\n", op->o_req_dn.bv_val, 0, 0); Debug(LDAP_DEBUG_ARGS,
"==> ldbm_back_bind: dn: %s\n", op->o_req_dn.bv_val, 0, 0);
#endif #endif
if ( op->oq_bind.rb_method == LDAP_AUTH_SIMPLE && be_isroot_pw( op ) ) { if ( op->oq_bind.rb_method == LDAP_AUTH_SIMPLE && be_isroot_pw( op ) ) {
@ -114,13 +115,18 @@ ldbm_back_bind(
/* entry is an alias, don't allow bind */ /* entry is an alias, don't allow bind */
#ifdef NEW_LOGGING #ifdef NEW_LOGGING
LDAP_LOG( BACK_LDBM, INFO, LDAP_LOG( BACK_LDBM, INFO,
"ldbm_back_bind: entry (%s) is an alias.\n", e->e_name.bv_val, 0, 0 ); "ldbm_back_bind: entry (%s) is an alias.\n",
e->e_name.bv_val, 0, 0 );
#else #else
Debug( LDAP_DEBUG_TRACE, "entry is alias\n", 0, Debug( LDAP_DEBUG_TRACE, "entry is alias\n", 0, 0, 0 );
0, 0 );
#endif #endif
#if 1
rc = LDAP_INVALID_CREDENTIALS;
#else
rs->sr_text = "entry is alias"; rs->sr_text = "entry is alias";
rc = LDAP_ALIAS_PROBLEM; rc = LDAP_ALIAS_PROBLEM;
#endif
goto return_results; goto return_results;
} }
@ -136,7 +142,6 @@ ldbm_back_bind(
0, 0 ); 0, 0 );
#endif #endif
if( rs->sr_ref != NULL ) { if( rs->sr_ref != NULL ) {
rc = LDAP_REFERRAL; rc = LDAP_REFERRAL;
rs->sr_matched = ch_strdup( e->e_name.bv_val ); rs->sr_matched = ch_strdup( e->e_name.bv_val );
@ -153,17 +158,27 @@ ldbm_back_bind(
if ( ! access_allowed( op, e, if ( ! access_allowed( op, e,
password, NULL, ACL_AUTH, NULL ) ) password, NULL, ACL_AUTH, NULL ) )
{ {
#if 1
rc = LDAP_INVALID_CREDENTIALS;
#else
rc = LDAP_INSUFFICIENT_ACCESS; rc = LDAP_INSUFFICIENT_ACCESS;
#endif
goto return_results; goto return_results;
} }
if ( (a = attr_find( e->e_attrs, password )) == NULL ) { if ( (a = attr_find( e->e_attrs, password )) == NULL ) {
/* stop front end from sending result */ /* stop front end from sending result */
#if 1
rc = LDAP_INVALID_CREDENTIALS;
#else
rc = LDAP_INAPPROPRIATE_AUTH; rc = LDAP_INAPPROPRIATE_AUTH;
#endif
goto return_results; goto return_results;
} }
if ( slap_passwd_check( op->o_conn, a, &op->oq_bind.rb_cred, &rs->sr_text ) != 0 ) { if ( slap_passwd_check( op->o_conn,
a, &op->oq_bind.rb_cred, &rs->sr_text ) != 0 )
{
/* stop front end from sending result */ /* stop front end from sending result */
rc = LDAP_INVALID_CREDENTIALS; rc = LDAP_INVALID_CREDENTIALS;
goto return_results; goto return_results;
@ -174,7 +189,9 @@ ldbm_back_bind(
#ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
case LDAP_AUTH_KRBV41: case LDAP_AUTH_KRBV41:
if ( krbv4_ldap_auth( op->o_bd, &op->oq_bind.rb_cred, &ad ) != LDAP_SUCCESS ) { if ( krbv4_ldap_auth( op->o_bd, &op->oq_bind.rb_cred, &ad )
!= LDAP_SUCCESS )
{
rc = LDAP_INVALID_CREDENTIALS; rc = LDAP_INVALID_CREDENTIALS;
goto return_results; goto return_results;
} }
@ -213,15 +230,10 @@ ldbm_back_bind(
} }
rc = 0; rc = 0;
break; break;
case LDAP_AUTH_KRBV42:
rs->sr_text = "Kerberos bind step 2 not supported";
/* stop front end from sending result */
rc = LDAP_UNWILLING_TO_PERFORM;
goto return_results;
#endif #endif
default: default:
assert( 0 ); /* should not be reachable */
rs->sr_text = "authentication method not supported"; rs->sr_text = "authentication method not supported";
rc = LDAP_STRONG_AUTH_NOT_SUPPORTED; rc = LDAP_STRONG_AUTH_NOT_SUPPORTED;
goto return_results; goto return_results;