From d2648bbddbf087c4e3803a89cb67541a50682eae Mon Sep 17 00:00:00 2001

From: William Brown <firstyear@redhat.com>

Date: Mon, 15 May 2017 09:04:45 +1000

Subject: [PATCH] Ticket 49231 - force EXTERNAL always

Bug Description:  Because of how our sasl code works, EXTERNAL bypasses

a number of checks so is always available.

Fix Description:  Force EXTERNAL to the present mech list, regardless

of the whitelist.

https://pagure.io/389-ds-base/issue/49231

Author: wibrown

Review by: mreynosd (Thanks!)

(cherry picked from commit e6e0db35842fc6612134cff5a08c4968230d1b2f)

---

 dirsrvtests/tests/suites/sasl/allowed_mechs.py | 13 +++++++++++--

 ldap/servers/slapd/charray.c                   | 14 ++++++++++++++

 ldap/servers/slapd/saslbind.c                  |  9 +++++++++

 ldap/servers/slapd/slapi-private.h             |  2 ++

 4 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/dirsrvtests/tests/suites/sasl/allowed_mechs.py b/dirsrvtests/tests/suites/sasl/allowed_mechs.py

index a3e385e..7958db4 100644

--- a/dirsrvtests/tests/suites/sasl/allowed_mechs.py

+++ b/dirsrvtests/tests/suites/sasl/allowed_mechs.py

@@ -25,12 +25,21 @@ def test_sasl_allowed_mechs(topology_st):

     assert('EXTERNAL' in orig_mechs)

     # Now edit the supported mechs. CHeck them again.

-    standalone.config.set('nsslapd-allowed-sasl-mechanisms', 'EXTERNAL, PLAIN')

+    standalone.config.set('nsslapd-allowed-sasl-mechanisms', 'PLAIN')

     limit_mechs = standalone.rootdse.supported_sasl()

-    print(limit_mechs)

     assert('PLAIN' in limit_mechs)

+    # Should always be in the allowed list, even if not set.

     assert('EXTERNAL' in limit_mechs)

+    # Should not be there!

+    assert('GSSAPI' not in limit_mechs)

+

+    standalone.config.set('nsslapd-allowed-sasl-mechanisms', 'PLAIN, EXTERNAL')

+

+    limit_mechs = standalone.rootdse.supported_sasl()

+    assert('PLAIN' in limit_mechs)

+    assert('EXTERNAL' in limit_mechs)

+    # Should not be there!

     assert('GSSAPI' not in limit_mechs)

     # Do a config reset

diff --git a/ldap/servers/slapd/charray.c b/ldap/servers/slapd/charray.c

index 6b89714..9056f16 100644

--- a/ldap/servers/slapd/charray.c

+++ b/ldap/servers/slapd/charray.c

@@ -272,6 +272,20 @@ charray_utf8_inlist(

     return( 0 );

 }

+/*

+ * Assert that some str s is in the charray, or add it.

+ */

+void

+charray_assert_present(char ***a, char *s)

+{

+    int result = charray_utf8_inlist(*a, s);

+    /* Not in the list */

+    if (result == 0) {

+        char *sdup = slapi_ch_strdup(s);

+        slapi_ch_array_add_ext(a, sdup);

+    }

+}

+

 int slapi_ch_array_utf8_inlist(char **a, char *s)

 {

 	return charray_utf8_inlist(a,s);

diff --git a/ldap/servers/slapd/saslbind.c b/ldap/servers/slapd/saslbind.c

index 75b83fe..dd0c4fb 100644

--- a/ldap/servers/slapd/saslbind.c

+++ b/ldap/servers/slapd/saslbind.c

@@ -794,6 +794,15 @@ char **ids_sasl_listmech(Slapi_PBlock *pb)

         ret = sup_ret;

     }

+    /*

+     * https://pagure.io/389-ds-base/issue/49231

+     * Because of the way that SASL mechs are managed in bind.c and saslbind.c

+     * even if EXTERNAL was *not* in the list of allowed mechs, it was allowed

+     * in the bind process because it bypasses lots of our checking. As a result

+     * we have to always present it.

+     */

+    charray_assert_present(&ret, "EXTERNAL");

+

     slapi_log_err(SLAPI_LOG_TRACE, "ids_sasl_listmech", "<=\n");

     return ret;

diff --git a/ldap/servers/slapd/slapi-private.h b/ldap/servers/slapd/slapi-private.h

index 3f732e8..0836d66 100644

--- a/ldap/servers/slapd/slapi-private.h

+++ b/ldap/servers/slapd/slapi-private.h

@@ -834,6 +834,8 @@ void charray_subtract( char **a, char **b, char ***c );

 char **charray_intersection(char **a, char **b);

 int charray_get_index(char **array, char *s);

 int charray_normdn_add(char ***chararray, char *dn, char *errstr);

+void charray_assert_present(char ***a, char *s);

+

 /******************************************************************************

  * value array routines.

-- 

2.9.4