74ca47
From d2648bbddbf087c4e3803a89cb67541a50682eae Mon Sep 17 00:00:00 2001
74ca47
From: William Brown <firstyear@redhat.com>
74ca47
Date: Mon, 15 May 2017 09:04:45 +1000
74ca47
Subject: [PATCH] Ticket 49231 - force EXTERNAL always
74ca47
74ca47
Bug Description:  Because of how our sasl code works, EXTERNAL bypasses
74ca47
a number of checks so is always available.
74ca47
74ca47
Fix Description:  Force EXTERNAL to the present mech list, regardless
74ca47
of the whitelist.
74ca47
74ca47
https://pagure.io/389-ds-base/issue/49231
74ca47
74ca47
Author: wibrown
74ca47
74ca47
Review by: mreynosd (Thanks!)
74ca47
74ca47
(cherry picked from commit e6e0db35842fc6612134cff5a08c4968230d1b2f)
74ca47
---
74ca47
 dirsrvtests/tests/suites/sasl/allowed_mechs.py | 13 +++++++++++--
74ca47
 ldap/servers/slapd/charray.c                   | 14 ++++++++++++++
74ca47
 ldap/servers/slapd/saslbind.c                  |  9 +++++++++
74ca47
 ldap/servers/slapd/slapi-private.h             |  2 ++
74ca47
 4 files changed, 36 insertions(+), 2 deletions(-)
74ca47
74ca47
diff --git a/dirsrvtests/tests/suites/sasl/allowed_mechs.py b/dirsrvtests/tests/suites/sasl/allowed_mechs.py
74ca47
index a3e385e..7958db4 100644
74ca47
--- a/dirsrvtests/tests/suites/sasl/allowed_mechs.py
74ca47
+++ b/dirsrvtests/tests/suites/sasl/allowed_mechs.py
74ca47
@@ -25,12 +25,21 @@ def test_sasl_allowed_mechs(topology_st):
74ca47
     assert('EXTERNAL' in orig_mechs)
74ca47
 
74ca47
     # Now edit the supported mechs. CHeck them again.
74ca47
-    standalone.config.set('nsslapd-allowed-sasl-mechanisms', 'EXTERNAL, PLAIN')
74ca47
+    standalone.config.set('nsslapd-allowed-sasl-mechanisms', 'PLAIN')
74ca47
 
74ca47
     limit_mechs = standalone.rootdse.supported_sasl()
74ca47
-    print(limit_mechs)
74ca47
     assert('PLAIN' in limit_mechs)
74ca47
+    # Should always be in the allowed list, even if not set.
74ca47
     assert('EXTERNAL' in limit_mechs)
74ca47
+    # Should not be there!
74ca47
+    assert('GSSAPI' not in limit_mechs)
74ca47
+
74ca47
+    standalone.config.set('nsslapd-allowed-sasl-mechanisms', 'PLAIN, EXTERNAL')
74ca47
+
74ca47
+    limit_mechs = standalone.rootdse.supported_sasl()
74ca47
+    assert('PLAIN' in limit_mechs)
74ca47
+    assert('EXTERNAL' in limit_mechs)
74ca47
+    # Should not be there!
74ca47
     assert('GSSAPI' not in limit_mechs)
74ca47
 
74ca47
     # Do a config reset
74ca47
diff --git a/ldap/servers/slapd/charray.c b/ldap/servers/slapd/charray.c
74ca47
index 6b89714..9056f16 100644
74ca47
--- a/ldap/servers/slapd/charray.c
74ca47
+++ b/ldap/servers/slapd/charray.c
74ca47
@@ -272,6 +272,20 @@ charray_utf8_inlist(
74ca47
     return( 0 );
74ca47
 }
74ca47
 
74ca47
+/*
74ca47
+ * Assert that some str s is in the charray, or add it.
74ca47
+ */
74ca47
+void
74ca47
+charray_assert_present(char ***a, char *s)
74ca47
+{
74ca47
+    int result = charray_utf8_inlist(*a, s);
74ca47
+    /* Not in the list */
74ca47
+    if (result == 0) {
74ca47
+        char *sdup = slapi_ch_strdup(s);
74ca47
+        slapi_ch_array_add_ext(a, sdup);
74ca47
+    }
74ca47
+}
74ca47
+
74ca47
 int slapi_ch_array_utf8_inlist(char **a, char *s)
74ca47
 {
74ca47
 	return charray_utf8_inlist(a,s);
74ca47
diff --git a/ldap/servers/slapd/saslbind.c b/ldap/servers/slapd/saslbind.c
74ca47
index 75b83fe..dd0c4fb 100644
74ca47
--- a/ldap/servers/slapd/saslbind.c
74ca47
+++ b/ldap/servers/slapd/saslbind.c
74ca47
@@ -794,6 +794,15 @@ char **ids_sasl_listmech(Slapi_PBlock *pb)
74ca47
         ret = sup_ret;
74ca47
     }
74ca47
 
74ca47
+    /*
74ca47
+     * https://pagure.io/389-ds-base/issue/49231
74ca47
+     * Because of the way that SASL mechs are managed in bind.c and saslbind.c
74ca47
+     * even if EXTERNAL was *not* in the list of allowed mechs, it was allowed
74ca47
+     * in the bind process because it bypasses lots of our checking. As a result
74ca47
+     * we have to always present it.
74ca47
+     */
74ca47
+    charray_assert_present(&ret, "EXTERNAL");
74ca47
+
74ca47
     slapi_log_err(SLAPI_LOG_TRACE, "ids_sasl_listmech", "<=\n");
74ca47
 
74ca47
     return ret;
74ca47
diff --git a/ldap/servers/slapd/slapi-private.h b/ldap/servers/slapd/slapi-private.h
74ca47
index 3f732e8..0836d66 100644
74ca47
--- a/ldap/servers/slapd/slapi-private.h
74ca47
+++ b/ldap/servers/slapd/slapi-private.h
74ca47
@@ -834,6 +834,8 @@ void charray_subtract( char **a, char **b, char ***c );
74ca47
 char **charray_intersection(char **a, char **b);
74ca47
 int charray_get_index(char **array, char *s);
74ca47
 int charray_normdn_add(char ***chararray, char *dn, char *errstr);
74ca47
+void charray_assert_present(char ***a, char *s);
74ca47
+
74ca47
 
74ca47
 /******************************************************************************
74ca47
  * value array routines.
74ca47
-- 
74ca47
2.9.4
74ca47