Blob Blame Raw
From ceef0b6ae9edbb60bc6324c3dc045f3a4e5fd725 Mon Sep 17 00:00:00 2001
From: Thierry Bordaz <tbordaz@redhat.com>
Date: Fri, 8 Nov 2019 18:16:06 +0100
Subject: [PATCH] Ticket 50709: Several memory leaks reported by Valgrind for
 389-ds 1.3.9.1-10

Description of the problem:

	When evaluating an ACI with 'ip' subject, it adds a PRNetAddr to the subject
	property list. When the list is free (acl__done_aclpb) the property is not freed.

Description of the fix:

	Add the property to the pblock (SLAPI_CONN_CLIENTNETADDR_ACLIP) so that it
	the property is freed with acl pblock.

https://pagure.io/389-ds-base/issue/50709

Reviewed by: Mark Reynolds, William Brown, Ludwig Krispenz
---
 ldap/servers/plugins/acl/acllas.c | 54 ++++++++++++++++++++-----------
 ldap/servers/slapd/connection.c   |  2 ++
 ldap/servers/slapd/pblock.c       | 16 +++++++++
 ldap/servers/slapd/slap.h         |  1 +
 ldap/servers/slapd/slapi-plugin.h |  1 +
 5 files changed, 56 insertions(+), 18 deletions(-)

diff --git a/ldap/servers/plugins/acl/acllas.c b/ldap/servers/plugins/acl/acllas.c
index 3950fd405..a5602e198 100644
--- a/ldap/servers/plugins/acl/acllas.c
+++ b/ldap/servers/plugins/acl/acllas.c
@@ -251,6 +251,7 @@ DS_LASIpGetter(NSErr_t *errp, PList_t subject, PList_t resource, PList_t auth_in
 {
     struct acl_pblock *aclpb = NULL;
     PRNetAddr *client_praddr = NULL;
+    PRNetAddr *pb_client_praddr = NULL;
     char ip_str[256];
     int rv = LAS_EVAL_TRUE;
 
@@ -262,25 +263,39 @@ DS_LASIpGetter(NSErr_t *errp, PList_t subject, PList_t resource, PList_t auth_in
         return LAS_EVAL_FAIL;
     }
 
-    client_praddr = (PRNetAddr *)slapi_ch_malloc(sizeof(PRNetAddr));
-    if (client_praddr == NULL) {
-        slapi_log_err(SLAPI_LOG_ERR, plugin_name, "DS_LASIpGetter - Failed to allocate client_praddr\n");
-        return (LAS_EVAL_FAIL);
-    }
+    slapi_pblock_get(aclpb->aclpb_pblock, SLAPI_CONN_CLIENTNETADDR_ACLIP, &pb_client_praddr);
+    if (pb_client_praddr == NULL) {
 
-    if (slapi_pblock_get(aclpb->aclpb_pblock, SLAPI_CONN_CLIENTNETADDR, client_praddr) != 0) {
-        slapi_log_err(SLAPI_LOG_ERR, plugin_name, "DS_LASIpGetter - Could not get client IP.\n");
-        slapi_ch_free((void **)&client_praddr);
-        return (LAS_EVAL_FAIL);
-    }
+        client_praddr = (PRNetAddr *) slapi_ch_malloc(sizeof (PRNetAddr));
+        if (client_praddr == NULL) {
+            slapi_log_err(SLAPI_LOG_ERR, plugin_name, "DS_LASIpGetter - Failed to allocate client_praddr\n");
+            return (LAS_EVAL_FAIL);
+        }
 
-    rv = PListInitProp(subject, 0, ACL_ATTR_IP, (void *)client_praddr, NULL);
-    if (rv < 0) {
-        slapi_log_err(SLAPI_LOG_ACL, plugin_name, "DS_LASIpGetter - "
-                                                  "Couldn't set the client addr property(%d)\n",
-                      rv);
-        slapi_ch_free((void **)&client_praddr);
-        return LAS_EVAL_FAIL;
+        if (slapi_pblock_get(aclpb->aclpb_pblock, SLAPI_CONN_CLIENTNETADDR, client_praddr) != 0) {
+            slapi_log_err(SLAPI_LOG_ERR, plugin_name, "DS_LASIpGetter - Could not get client IP.\n");
+            slapi_ch_free((void **) &client_praddr);
+            return (LAS_EVAL_FAIL);
+        }
+
+        rv = PListInitProp(subject, 0, ACL_ATTR_IP, (void *) client_praddr, NULL);
+        if (rv < 0) {
+            slapi_log_err(SLAPI_LOG_ACL, plugin_name, "DS_LASIpGetter - "
+                    "Couldn't set the client addr property(%d)\n",
+                    rv);
+            slapi_ch_free((void **) &client_praddr);
+            return LAS_EVAL_FAIL;
+        }
+
+    } else {
+        client_praddr = pb_client_praddr;
+        rv = PListInitProp(subject, 0, ACL_ATTR_IP, (void *) client_praddr, NULL);
+        if (rv < 0) {
+            slapi_log_err(SLAPI_LOG_ACL, plugin_name, "DS_LASIpGetter - "
+                    "Couldn't set the client addr property(%d)\n",
+                    rv);
+            return LAS_EVAL_FAIL;
+        }
     }
     if (PR_NetAddrToString(client_praddr, ip_str, sizeof(ip_str)) == PR_SUCCESS) {
         slapi_log_err(SLAPI_LOG_ACL, plugin_name, "DS_LASIpGetter - "
@@ -290,7 +305,10 @@ DS_LASIpGetter(NSErr_t *errp, PList_t subject, PList_t resource, PList_t auth_in
         slapi_log_err(SLAPI_LOG_ACL, plugin_name, "DS_LASIpGetter - "
                                                   "Returning client ip address 'unknown'\n");
     }
-
+    if (client_praddr != pb_client_praddr) {
+        /* Set it in pblock only if it is newly allocated */
+        slapi_pblock_set(aclpb->aclpb_pblock, SLAPI_CONN_CLIENTNETADDR_ACLIP, client_praddr);
+    }
     return LAS_EVAL_TRUE;
 }
 
diff --git a/ldap/servers/slapd/connection.c b/ldap/servers/slapd/connection.c
index 9abd546f9..b9b280e6d 100644
--- a/ldap/servers/slapd/connection.c
+++ b/ldap/servers/slapd/connection.c
@@ -205,6 +205,7 @@ connection_cleanup(Connection *conn)
     conn->c_isreplication_session = 0;
     slapi_ch_free((void **)&conn->cin_addr);
     slapi_ch_free((void **)&conn->cin_destaddr);
+    slapi_ch_free((void **)&conn->cin_addr_aclip);
     slapi_ch_free_string(&conn->c_ipaddr);
     if (conn->c_domain != NULL) {
         ber_bvecfree(conn->c_domain);
@@ -397,6 +398,7 @@ connection_reset(Connection *conn, int ns, PRNetAddr *from, int fromLen __attrib
             str_destip = str_unknown;
         }
     }
+    slapi_ch_free((void **)&conn->cin_addr_aclip);
 
 
     if (!in_referral_mode) {
diff --git a/ldap/servers/slapd/pblock.c b/ldap/servers/slapd/pblock.c
index bc18a7b18..d2ad6147a 100644
--- a/ldap/servers/slapd/pblock.c
+++ b/ldap/servers/slapd/pblock.c
@@ -482,6 +482,14 @@ slapi_pblock_get(Slapi_PBlock *pblock, int arg, void *value)
         }
         PR_ExitMonitor(pblock->pb_conn->c_mutex);
         break;
+	case SLAPI_CONN_CLIENTNETADDR_ACLIP:
+        if (pblock->pb_conn == NULL) {
+            break;
+        }
+        pthread_mutex_lock(&(pblock->pb_conn->c_mutex));
+        (*(PRNetAddr **) value) = pblock->pb_conn->cin_addr_aclip;
+        pthread_mutex_unlock(&(pblock->pb_conn->c_mutex));
+        break;
     case SLAPI_CONN_SERVERNETADDR:
         if (pblock->pb_conn == NULL) {
             memset(value, 0, sizeof(PRNetAddr));
@@ -2571,6 +2579,14 @@ slapi_pblock_set(Slapi_PBlock *pblock, int arg, void *value)
         pblock->pb_conn->c_authtype = slapi_ch_strdup((char *)value);
         PR_ExitMonitor(pblock->pb_conn->c_mutex);
         break;
+	case SLAPI_CONN_CLIENTNETADDR_ACLIP:
+        if (pblock->pb_conn == NULL) {
+            break;
+        }
+        pthread_mutex_lock(&(pblock->pb_conn->c_mutex));
+        slapi_ch_free((void **)&pblock->pb_conn->cin_addr_aclip);
+        pblock->pb_conn->cin_addr_aclip = (PRNetAddr *)value;
+        pthread_mutex_unlock(&(pblock->pb_conn->c_mutex));
     case SLAPI_CONN_IS_REPLICATION_SESSION:
         if (pblock->pb_conn == NULL) {
             slapi_log_err(SLAPI_LOG_ERR,
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index a8908d94c..4c53d43dc 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -1617,6 +1617,7 @@ typedef struct conn
     char *c_external_dn;             /* client DN of this SSL session  */
     char *c_external_authtype;       /* used for c_external_dn   */
     PRNetAddr *cin_addr;             /* address of client on this conn */
+    PRNetAddr *cin_addr_aclip;       /* address of client allocated by acl with 'ip' subject */
     PRNetAddr *cin_destaddr;         /* address client connected to    */
     struct berval **c_domain;        /* DNS names of client            */
     Operation *c_ops;                /* list of pending operations      */
diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h
index 0bc3a6fab..679bdbb5c 100644
--- a/ldap/servers/slapd/slapi-plugin.h
+++ b/ldap/servers/slapd/slapi-plugin.h
@@ -6971,6 +6971,7 @@ slapi_timer_result slapi_timespec_expire_check(struct timespec *expire);
 #define SLAPI_CONN_DN                     143
 #define SLAPI_CONN_CLIENTNETADDR          850
 #define SLAPI_CONN_SERVERNETADDR          851
+#define SLAPI_CONN_CLIENTNETADDR_ACLIP    853
 #define SLAPI_CONN_IS_REPLICATION_SESSION 149
 #define SLAPI_CONN_IS_SSL_SESSION         747
 #define SLAPI_CONN_CERT                   743
-- 
2.24.1