f92ce9
From 4b812a1af367ed409e21abe73a77e57092e5a5f3 Mon Sep 17 00:00:00 2001
f92ce9
From: Mark Reynolds <mreynolds@redhat.com>
f92ce9
Date: Tue, 16 Dec 2014 16:53:07 -0500
f92ce9
Subject: [PATCH 33/53] Fix for CVE-2014-8105
f92ce9
f92ce9
Description:  At server startup check for the Retro Changelog default ACI
f92ce9
              on cn=changelog, if present delete it.
f92ce9
f92ce9
Reviewed by: lkrispenz(Thanks!)
f92ce9
---
f92ce9
 ldap/servers/plugins/retrocl/retrocl.c        | 67 ++++++++++++++++++++++++++-
f92ce9
 ldap/servers/plugins/retrocl/retrocl_create.c |  4 --
f92ce9
 2 files changed, 66 insertions(+), 5 deletions(-)
f92ce9
f92ce9
diff --git a/ldap/servers/plugins/retrocl/retrocl.c b/ldap/servers/plugins/retrocl/retrocl.c
f92ce9
index 0d2a6dc..8a0f350 100644
f92ce9
--- a/ldap/servers/plugins/retrocl/retrocl.c
f92ce9
+++ b/ldap/servers/plugins/retrocl/retrocl.c
f92ce9
@@ -308,6 +308,68 @@ char *retrocl_get_config_str(const char *attrt)
f92ce9
     return ma;
f92ce9
 }
f92ce9
 
f92ce9
+static void
f92ce9
+retrocl_remove_legacy_default_aci(void)
f92ce9
+{
f92ce9
+    Slapi_PBlock *pb = NULL;
f92ce9
+    Slapi_Entry **entries;
f92ce9
+    char **aci_vals = NULL;
f92ce9
+    char *attrs[] = {"aci", NULL};
f92ce9
+    int rc;
f92ce9
+
f92ce9
+    pb = slapi_pblock_new();
f92ce9
+    slapi_search_internal_set_pb(pb, RETROCL_CHANGELOG_DN, LDAP_SCOPE_BASE, "objectclass=*",
f92ce9
+            attrs, 0, NULL, NULL, g_plg_identity[PLUGIN_RETROCL] , 0);
f92ce9
+    slapi_search_internal_pb(pb);
f92ce9
+    slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &rc);
f92ce9
+    if (rc == LDAP_SUCCESS) {
f92ce9
+        slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &entries);
f92ce9
+        if(entries && entries[0]){
f92ce9
+            if((aci_vals = slapi_entry_attr_get_charray(entries[0], "aci"))){
f92ce9
+                if(charray_inlist(aci_vals, RETROCL_ACL)){
f92ce9
+                    /*
f92ce9
+                     * Okay, we need to remove the aci
f92ce9
+                     */
f92ce9
+                    LDAPMod mod;
f92ce9
+                    LDAPMod *mods[2];
f92ce9
+                    char *val[2];
f92ce9
+                    Slapi_PBlock *mod_pb = 0;
f92ce9
+
f92ce9
+                    mod_pb = slapi_pblock_new();
f92ce9
+                    mods[0] = &mod;
f92ce9
+                    mods[1] = 0;
f92ce9
+                    val[0] = RETROCL_ACL;
f92ce9
+                    val[1] = 0;
f92ce9
+                    mod.mod_op = LDAP_MOD_DELETE;
f92ce9
+                    mod.mod_type = "aci";
f92ce9
+                    mod.mod_values = val;
f92ce9
+
f92ce9
+                    slapi_modify_internal_set_pb_ext(mod_pb, slapi_entry_get_sdn(entries[0]),
f92ce9
+                                                    mods, 0, 0, g_plg_identity[PLUGIN_RETROCL], 0);
f92ce9
+                    slapi_modify_internal_pb(mod_pb);
f92ce9
+                    slapi_pblock_get(mod_pb, SLAPI_PLUGIN_INTOP_RESULT, &rc);
f92ce9
+                    if(rc == LDAP_SUCCESS){
f92ce9
+                        slapi_log_error( SLAPI_LOG_FATAL, RETROCL_PLUGIN_NAME,
f92ce9
+                                "Successfully removed vulnerable legacy default aci \"%s\".  "
f92ce9
+                                "If the aci removal was not desired please use a different \"acl "
f92ce9
+                                "name\" so it is not removed at the next plugin startup.\n",
f92ce9
+                                RETROCL_ACL);
f92ce9
+                    } else {
f92ce9
+                        slapi_log_error( SLAPI_LOG_FATAL, RETROCL_PLUGIN_NAME,
f92ce9
+                                "Failed to removed vulnerable legacy default aci (%s) error %d\n",
f92ce9
+                                RETROCL_ACL, rc);
f92ce9
+                    }
f92ce9
+                    slapi_pblock_destroy(mod_pb);
f92ce9
+                }
f92ce9
+                slapi_ch_array_free(aci_vals);
f92ce9
+            }
f92ce9
+        }
f92ce9
+    }
f92ce9
+    slapi_free_search_results_internal(pb);
f92ce9
+    slapi_pblock_destroy(pb);
f92ce9
+}
f92ce9
+
f92ce9
+
f92ce9
 /*
f92ce9
  * Function: retrocl_start
f92ce9
  *
f92ce9
@@ -333,7 +395,10 @@ static int retrocl_start (Slapi_PBlock *pb)
f92ce9
       LDAPDebug1Arg(LDAP_DEBUG_TRACE,"Couldnt find backend, not trimming retro changelog (%d).\n",rc);
f92ce9
       return rc;
f92ce9
     }
f92ce9
-   
f92ce9
+
f92ce9
+    /* Remove the old default aci as it exposes passwords changes to anonymous users */
f92ce9
+    retrocl_remove_legacy_default_aci();
f92ce9
+
f92ce9
     retrocl_init_trimming();
f92ce9
 
f92ce9
     if (slapi_pblock_get(pb, SLAPI_ADD_ENTRY, &e) != 0) {
f92ce9
diff --git a/ldap/servers/plugins/retrocl/retrocl_create.c b/ldap/servers/plugins/retrocl/retrocl_create.c
f92ce9
index 1ffdaae..870421c 100644
f92ce9
--- a/ldap/servers/plugins/retrocl/retrocl_create.c
f92ce9
+++ b/ldap/servers/plugins/retrocl/retrocl_create.c
f92ce9
@@ -344,10 +344,6 @@ void retrocl_create_cle (void)
f92ce9
     val.bv_len = strlen(val.bv_val);
f92ce9
     slapi_entry_add_values( e, "cn", vals );  
f92ce9
     
f92ce9
-    val.bv_val = RETROCL_ACL;
f92ce9
-    val.bv_len = strlen(val.bv_val);
f92ce9
-    slapi_entry_add_values( e, "aci", vals );  
f92ce9
-
f92ce9
     pb = slapi_pblock_new ();
f92ce9
     slapi_add_entry_internal_set_pb( pb, e, NULL /* controls */, 
f92ce9
 				     g_plg_identity[PLUGIN_RETROCL], 
f92ce9
-- 
f92ce9
1.9.3
f92ce9