Blob Blame Raw
From 2040a0a1e517b444fef35a30c86bc6380b03bb21 Mon Sep 17 00:00:00 2001
From: Thierry Bordaz <tbordaz@redhat.com>
Date: Fri, 8 Nov 2019 18:16:06 +0100
Subject: [PATCH] Ticket 50709: Several memory leaks reported by Valgrind for
 389-ds 1.3.9.1-10

Description of the problem:

	When evaluating an ACI with 'ip' subject, it adds a PRNetAddr to the subject
	property list. When the list is free (acl__done_aclpb) the property is not freed.

Description of the fix:

	Add the property to the pblock (SLAPI_CONN_CLIENTNETADDR_ACLIP) so that it
	the property is freed with acl pblock.

https://pagure.io/389-ds-base/issue/50709

Reviewed by: Mark Reynolds, William Brown, Ludwig Krispenz
---
 ldap/servers/plugins/acl/acllas.c | 51 ++++++++++++++++++++-----------
 ldap/servers/slapd/connection.c   |  2 ++
 ldap/servers/slapd/pblock.c       | 16 ++++++++++
 ldap/servers/slapd/slap.h         |  1 +
 ldap/servers/slapd/slapi-plugin.h |  1 +
 5 files changed, 53 insertions(+), 18 deletions(-)

diff --git a/ldap/servers/plugins/acl/acllas.c b/ldap/servers/plugins/acl/acllas.c
index 3950fd405..dd41d41bd 100644
--- a/ldap/servers/plugins/acl/acllas.c
+++ b/ldap/servers/plugins/acl/acllas.c
@@ -251,6 +251,7 @@ DS_LASIpGetter(NSErr_t *errp, PList_t subject, PList_t resource, PList_t auth_in
 {
     struct acl_pblock *aclpb = NULL;
     PRNetAddr *client_praddr = NULL;
+    PRNetAddr *pb_client_praddr = NULL;
     char ip_str[256];
     int rv = LAS_EVAL_TRUE;
 
@@ -262,25 +263,39 @@ DS_LASIpGetter(NSErr_t *errp, PList_t subject, PList_t resource, PList_t auth_in
         return LAS_EVAL_FAIL;
     }
 
-    client_praddr = (PRNetAddr *)slapi_ch_malloc(sizeof(PRNetAddr));
-    if (client_praddr == NULL) {
-        slapi_log_err(SLAPI_LOG_ERR, plugin_name, "DS_LASIpGetter - Failed to allocate client_praddr\n");
-        return (LAS_EVAL_FAIL);
-    }
+    slapi_pblock_get(aclpb->aclpb_pblock, SLAPI_CONN_CLIENTNETADDR_ACLIP, &pb_client_praddr);
+    if (pb_client_praddr == NULL) {
 
-    if (slapi_pblock_get(aclpb->aclpb_pblock, SLAPI_CONN_CLIENTNETADDR, client_praddr) != 0) {
-        slapi_log_err(SLAPI_LOG_ERR, plugin_name, "DS_LASIpGetter - Could not get client IP.\n");
-        slapi_ch_free((void **)&client_praddr);
-        return (LAS_EVAL_FAIL);
-    }
+        client_praddr = (PRNetAddr *) slapi_ch_malloc(sizeof (PRNetAddr));
+        if (client_praddr == NULL) {
+            slapi_log_err(SLAPI_LOG_ERR, plugin_name, "DS_LASIpGetter - Failed to allocate client_praddr\n");
+            return (LAS_EVAL_FAIL);
+        }
 
-    rv = PListInitProp(subject, 0, ACL_ATTR_IP, (void *)client_praddr, NULL);
-    if (rv < 0) {
-        slapi_log_err(SLAPI_LOG_ACL, plugin_name, "DS_LASIpGetter - "
-                                                  "Couldn't set the client addr property(%d)\n",
-                      rv);
-        slapi_ch_free((void **)&client_praddr);
-        return LAS_EVAL_FAIL;
+        if (slapi_pblock_get(aclpb->aclpb_pblock, SLAPI_CONN_CLIENTNETADDR, client_praddr) != 0) {
+            slapi_log_err(SLAPI_LOG_ERR, plugin_name, "DS_LASIpGetter - Could not get client IP.\n");
+            slapi_ch_free((void **) &client_praddr);
+            return (LAS_EVAL_FAIL);
+        }
+
+        rv = PListInitProp(subject, 0, ACL_ATTR_IP, (void *) client_praddr, NULL);
+        if (rv < 0) {
+            slapi_log_err(SLAPI_LOG_ACL, plugin_name, "DS_LASIpGetter - "
+                    "Couldn't set the client addr property(%d)\n",
+                    rv);
+            slapi_ch_free((void **) &client_praddr);
+            return LAS_EVAL_FAIL;
+        }
+
+    } else {
+        client_praddr = pb_client_praddr;
+        rv = PListInitProp(subject, 0, ACL_ATTR_IP, (void *) client_praddr, NULL);
+        if (rv < 0) {
+            slapi_log_err(SLAPI_LOG_ACL, plugin_name, "DS_LASIpGetter - "
+                    "Couldn't set the client addr property(%d)\n",
+                    rv);
+            return LAS_EVAL_FAIL;
+        }
     }
     if (PR_NetAddrToString(client_praddr, ip_str, sizeof(ip_str)) == PR_SUCCESS) {
         slapi_log_err(SLAPI_LOG_ACL, plugin_name, "DS_LASIpGetter - "
@@ -290,7 +305,7 @@ DS_LASIpGetter(NSErr_t *errp, PList_t subject, PList_t resource, PList_t auth_in
         slapi_log_err(SLAPI_LOG_ACL, plugin_name, "DS_LASIpGetter - "
                                                   "Returning client ip address 'unknown'\n");
     }
-
+    slapi_pblock_set(aclpb->aclpb_pblock, SLAPI_CONN_CLIENTNETADDR_ACLIP, client_praddr);
     return LAS_EVAL_TRUE;
 }
 
diff --git a/ldap/servers/slapd/connection.c b/ldap/servers/slapd/connection.c
index e124303be..da954ada6 100644
--- a/ldap/servers/slapd/connection.c
+++ b/ldap/servers/slapd/connection.c
@@ -206,6 +206,7 @@ connection_cleanup(Connection *conn)
     conn->c_isreplication_session = 0;
     slapi_ch_free((void **)&conn->cin_addr);
     slapi_ch_free((void **)&conn->cin_destaddr);
+    slapi_ch_free((void **)&conn->cin_addr_aclip);
     slapi_ch_free_string(&conn->c_ipaddr);
     if (conn->c_domain != NULL) {
         ber_bvecfree(conn->c_domain);
@@ -408,6 +409,7 @@ connection_reset(Connection *conn, int ns, PRNetAddr *from, int fromLen __attrib
             str_destip = str_unknown;
         }
     }
+    slapi_ch_free((void **)&conn->cin_addr_aclip);
 
     if (!in_referral_mode) {
         /* create a sasl connection */
diff --git a/ldap/servers/slapd/pblock.c b/ldap/servers/slapd/pblock.c
index cc44ace30..348cc6f1a 100644
--- a/ldap/servers/slapd/pblock.c
+++ b/ldap/servers/slapd/pblock.c
@@ -482,6 +482,14 @@ slapi_pblock_get(Slapi_PBlock *pblock, int arg, void *value)
         }
         pthread_mutex_unlock(&(pblock->pb_conn->c_mutex));
         break;
+	case SLAPI_CONN_CLIENTNETADDR_ACLIP:
+        if (pblock->pb_conn == NULL) {
+            break;
+        }
+        pthread_mutex_lock(&(pblock->pb_conn->c_mutex));
+        (*(PRNetAddr **) value) = pblock->pb_conn->cin_addr_aclip;
+        pthread_mutex_unlock(&(pblock->pb_conn->c_mutex));
+        break;
     case SLAPI_CONN_SERVERNETADDR:
         if (pblock->pb_conn == NULL) {
             memset(value, 0, sizeof(PRNetAddr));
@@ -2571,6 +2579,14 @@ slapi_pblock_set(Slapi_PBlock *pblock, int arg, void *value)
         pblock->pb_conn->c_authtype = slapi_ch_strdup((char *)value);
         pthread_mutex_unlock(&(pblock->pb_conn->c_mutex));
         break;
+	case SLAPI_CONN_CLIENTNETADDR_ACLIP:
+        if (pblock->pb_conn == NULL) {
+            break;
+        }
+        pthread_mutex_lock(&(pblock->pb_conn->c_mutex));
+        slapi_ch_free((void **)&pblock->pb_conn->cin_addr_aclip);
+        pblock->pb_conn->cin_addr_aclip = (PRNetAddr *)value;
+        pthread_mutex_unlock(&(pblock->pb_conn->c_mutex));
     case SLAPI_CONN_IS_REPLICATION_SESSION:
         if (pblock->pb_conn == NULL) {
             slapi_log_err(SLAPI_LOG_ERR,
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index 0aa2dcc1a..8a2748519 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -1634,6 +1634,7 @@ typedef struct conn
     char *c_external_dn;             /* client DN of this SSL session  */
     char *c_external_authtype;       /* used for c_external_dn   */
     PRNetAddr *cin_addr;             /* address of client on this conn */
+    PRNetAddr *cin_addr_aclip;       /* address of client allocated by acl with 'ip' subject */
     PRNetAddr *cin_destaddr;         /* address client connected to    */
     struct berval **c_domain;        /* DNS names of client            */
     Operation *c_ops;                /* list of pending operations      */
diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h
index 01dcb0554..29a6238d9 100644
--- a/ldap/servers/slapd/slapi-plugin.h
+++ b/ldap/servers/slapd/slapi-plugin.h
@@ -6930,6 +6930,7 @@ slapi_timer_result slapi_timespec_expire_check(struct timespec *expire);
 #define SLAPI_CONN_DN                     143
 #define SLAPI_CONN_CLIENTNETADDR          850
 #define SLAPI_CONN_SERVERNETADDR          851
+#define SLAPI_CONN_CLIENTNETADDR_ACLIP    853
 #define SLAPI_CONN_IS_REPLICATION_SESSION 149
 #define SLAPI_CONN_IS_SSL_SESSION         747
 #define SLAPI_CONN_CERT                   743
-- 
2.21.1