[389-ds-base] branch 389-ds-base-1.4.1 updated: Issue 50974 - UI - wrong title in "Delete Suffix" popup
by pagure＠pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch 389-ds-base-1.4.1
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.4.1 by this push:
new d3a796e Issue 50974 - UI - wrong title in "Delete Suffix" popup
d3a796e is described below
commit d3a796e205896bb6e589df3c9181b923c9d7a2c5
Author: Mark Reynolds <mreynolds(a)redhat.com>
AuthorDate: Mon Mar 23 11:14:57 2020 -0400
Issue 50974 - UI - wrong title in "Delete Suffix" popup
Description: A copy and paste error existed that mixed a replication
title into the "delete suffix" popup
fixes: https://pagure.io/389-ds-base/issue/50974
Reviewed by: mreynolds(one line commit rule)
---
src/cockpit/389-console/src/lib/database/suffix.jsx | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/cockpit/389-console/src/lib/database/suffix.jsx b/src/cockpit/389-console/src/lib/database/suffix.jsx
index 12c2565..5f3e19b 100644
--- a/src/cockpit/389-console/src/lib/database/suffix.jsx
+++ b/src/cockpit/389-console/src/lib/database/suffix.jsx
@@ -887,10 +887,10 @@ export class Suffix extends React.Component {
spinning={this.state.modalSpinning}
item={this.props.suffix}
checked={this.state.modalChecked}
- mTitle="Delete Replication Agreement"
- mMsg="Are you really sure you want to delete the database?"
- mSpinningMsg="Deleting database ..."
- mBtnName="Delete Database"
+ mTitle="Delete Suffix"
+ mMsg="Are you really sure you want to delete this suffix?"
+ mSpinningMsg="Deleting suffix ..."
+ mBtnName="Delete Suffix"
/>
<CreateLinkModal
showModal={this.state.showLinkModal}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 1 month
- 1
- 0
[389-ds-base] branch 389-ds-base-1.4.2 updated: Issue 50974 - UI - wrong title in "Delete Suffix" popup
by pagure＠pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch 389-ds-base-1.4.2
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.4.2 by this push:
new aeb93b0 Issue 50974 - UI - wrong title in "Delete Suffix" popup
aeb93b0 is described below
commit aeb93b029c1d67f0a7a67d15cf086b00f960dd49
Author: Mark Reynolds <mreynolds(a)redhat.com>
AuthorDate: Mon Mar 23 11:14:57 2020 -0400
Issue 50974 - UI - wrong title in "Delete Suffix" popup
Description: A copy and paste error existed that mixed a replication
title into the "delete suffix" popup
fixes: https://pagure.io/389-ds-base/issue/50974
Reviewed by: mreynolds(one line commit rule)
---
src/cockpit/389-console/src/lib/database/suffix.jsx | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/cockpit/389-console/src/lib/database/suffix.jsx b/src/cockpit/389-console/src/lib/database/suffix.jsx
index 12c2565..5f3e19b 100644
--- a/src/cockpit/389-console/src/lib/database/suffix.jsx
+++ b/src/cockpit/389-console/src/lib/database/suffix.jsx
@@ -887,10 +887,10 @@ export class Suffix extends React.Component {
spinning={this.state.modalSpinning}
item={this.props.suffix}
checked={this.state.modalChecked}
- mTitle="Delete Replication Agreement"
- mMsg="Are you really sure you want to delete the database?"
- mSpinningMsg="Deleting database ..."
- mBtnName="Delete Database"
+ mTitle="Delete Suffix"
+ mMsg="Are you really sure you want to delete this suffix?"
+ mSpinningMsg="Deleting suffix ..."
+ mBtnName="Delete Suffix"
/>
<CreateLinkModal
showModal={this.state.showLinkModal}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 1 month
- 1
- 0
[389-ds-base] branch master updated: Issue 50974 - UI - wrong title in "Delete Suffix" popup
by pagure＠pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch master
in repository 389-ds-base.
The following commit(s) were added to refs/heads/master by this push:
new 6f912c3 Issue 50974 - UI - wrong title in "Delete Suffix" popup
6f912c3 is described below
commit 6f912c3e2e574b45665c4e1ec7a69e6a47c79ac8
Author: Mark Reynolds <mreynolds(a)redhat.com>
AuthorDate: Mon Mar 23 11:14:57 2020 -0400
Issue 50974 - UI - wrong title in "Delete Suffix" popup
Description: A copy and paste error existed that mixed a replication
title into the "delete suffix" popup
fixes: https://pagure.io/389-ds-base/issue/50974
Reviewed by: mreynolds(one line commit rule)
---
src/cockpit/389-console/src/lib/database/suffix.jsx | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/cockpit/389-console/src/lib/database/suffix.jsx b/src/cockpit/389-console/src/lib/database/suffix.jsx
index 12c2565..5f3e19b 100644
--- a/src/cockpit/389-console/src/lib/database/suffix.jsx
+++ b/src/cockpit/389-console/src/lib/database/suffix.jsx
@@ -887,10 +887,10 @@ export class Suffix extends React.Component {
spinning={this.state.modalSpinning}
item={this.props.suffix}
checked={this.state.modalChecked}
- mTitle="Delete Replication Agreement"
- mMsg="Are you really sure you want to delete the database?"
- mSpinningMsg="Deleting database ..."
- mBtnName="Delete Database"
+ mTitle="Delete Suffix"
+ mMsg="Are you really sure you want to delete this suffix?"
+ mSpinningMsg="Deleting suffix ..."
+ mBtnName="Delete Suffix"
/>
<CreateLinkModal
showModal={this.state.showLinkModal}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 1 month
- 1
- 0
[389-ds-base] branch 389-ds-base-1.4.1 updated: Issue 50972 - Fix cockpit plugin build
by pagure＠pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch 389-ds-base-1.4.1
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.4.1 by this push:
new 849f078 Issue 50972 - Fix cockpit plugin build
849f078 is described below
commit 849f078ca69df08951caa5bb55645b0b9af62ca3
Author: Stanislav Levin <slev(a)altlinux.org>
AuthorDate: Mon Mar 23 13:06:53 2020 +0300
Issue 50972 - Fix cockpit plugin build
Bug Description:
During 389-console build, `npm run build` complains about the wrong
indentations.
Fix Description:
This is just the correction of indentations.
Fixes: https://pagure.io/389-ds-base/issue/50972
Author: Stanislav Levin <slev(a)altlinux.org>
Review by: mreynolds (Thanks!)
Signed-off-by: Stanislav Levin <slev(a)altlinux.org>
---
src/cockpit/389-console/src/lib/database/databaseConfig.jsx | 4 ++--
src/cockpit/389-console/src/lib/security/ciphers.jsx | 6 +++---
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/src/cockpit/389-console/src/lib/database/databaseConfig.jsx b/src/cockpit/389-console/src/lib/database/databaseConfig.jsx
index ecc9ffc..c1d35f4 100644
--- a/src/cockpit/389-console/src/lib/database/databaseConfig.jsx
+++ b/src/cockpit/389-console/src/lib/database/databaseConfig.jsx
@@ -375,7 +375,7 @@ export class GlobalDatabaseConfig extends React.Component {
checked={db_auto_checked}
onChange={this.select_auto_cache}
>
- Automatic Cache Tuning
+ Automatic Cache Tuning
</Checkbox>
</Col>
<Col sm={1} />
@@ -385,7 +385,7 @@ export class GlobalDatabaseConfig extends React.Component {
checked={import_auto_checked}
onChange={ this.select_auto_import_cache}
>
- Automatic Import Cache Tuning
+ Automatic Import Cache Tuning
</Checkbox>
</Col>
</Row>
diff --git a/src/cockpit/389-console/src/lib/security/ciphers.jsx b/src/cockpit/389-console/src/lib/security/ciphers.jsx
index 94d8f31..d8af1d6 100644
--- a/src/cockpit/389-console/src/lib/security/ciphers.jsx
+++ b/src/cockpit/389-console/src/lib/security/ciphers.jsx
@@ -223,7 +223,7 @@ export class Ciphers extends React.Component {
<hr />
<Row>
<Col componentClass={ControlLabel} sm={2}>
- Cipher Suite
+ Cipher Suite
</Col>
<Col sm={9}>
<select
@@ -239,7 +239,7 @@ export class Ciphers extends React.Component {
</Row>
<Row className="ds-margin-top">
<Col componentClass={ControlLabel} sm={2}>
- Allow Specific Ciphers
+ Allow Specific Ciphers
</Col>
<Col sm={9}>
<Typeahead
@@ -257,7 +257,7 @@ export class Ciphers extends React.Component {
</Row>
<Row className="ds-margin-top">
<Col componentClass={ControlLabel} sm={2}>
- Deny Specific Ciphers
+ Deny Specific Ciphers
</Col>
<Col sm={9}>
<Typeahead
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 1 month
- 1
- 0
[389-ds-base] branch 389-ds-base-1.4.2 updated: Issue 50972 - Fix cockpit plugin build
by pagure＠pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch 389-ds-base-1.4.2
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.4.2 by this push:
new 30712fa Issue 50972 - Fix cockpit plugin build
30712fa is described below
commit 30712fabe631196b5138fbe3de705833abdc0936
Author: Stanislav Levin <slev(a)altlinux.org>
AuthorDate: Mon Mar 23 13:06:53 2020 +0300
Issue 50972 - Fix cockpit plugin build
Bug Description:
During 389-console build, `npm run build` complains about the wrong
indentations.
Fix Description:
This is just the correction of indentations.
Fixes: https://pagure.io/389-ds-base/issue/50972
Author: Stanislav Levin <slev(a)altlinux.org>
Review by: mreynolds (Thanks!)
Signed-off-by: Stanislav Levin <slev(a)altlinux.org>
---
src/cockpit/389-console/src/lib/database/databaseConfig.jsx | 4 ++--
src/cockpit/389-console/src/lib/security/ciphers.jsx | 6 +++---
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/src/cockpit/389-console/src/lib/database/databaseConfig.jsx b/src/cockpit/389-console/src/lib/database/databaseConfig.jsx
index ecc9ffc..c1d35f4 100644
--- a/src/cockpit/389-console/src/lib/database/databaseConfig.jsx
+++ b/src/cockpit/389-console/src/lib/database/databaseConfig.jsx
@@ -375,7 +375,7 @@ export class GlobalDatabaseConfig extends React.Component {
checked={db_auto_checked}
onChange={this.select_auto_cache}
>
- Automatic Cache Tuning
+ Automatic Cache Tuning
</Checkbox>
</Col>
<Col sm={1} />
@@ -385,7 +385,7 @@ export class GlobalDatabaseConfig extends React.Component {
checked={import_auto_checked}
onChange={ this.select_auto_import_cache}
>
- Automatic Import Cache Tuning
+ Automatic Import Cache Tuning
</Checkbox>
</Col>
</Row>
diff --git a/src/cockpit/389-console/src/lib/security/ciphers.jsx b/src/cockpit/389-console/src/lib/security/ciphers.jsx
index 94d8f31..d8af1d6 100644
--- a/src/cockpit/389-console/src/lib/security/ciphers.jsx
+++ b/src/cockpit/389-console/src/lib/security/ciphers.jsx
@@ -223,7 +223,7 @@ export class Ciphers extends React.Component {
<hr />
<Row>
<Col componentClass={ControlLabel} sm={2}>
- Cipher Suite
+ Cipher Suite
</Col>
<Col sm={9}>
<select
@@ -239,7 +239,7 @@ export class Ciphers extends React.Component {
</Row>
<Row className="ds-margin-top">
<Col componentClass={ControlLabel} sm={2}>
- Allow Specific Ciphers
+ Allow Specific Ciphers
</Col>
<Col sm={9}>
<Typeahead
@@ -257,7 +257,7 @@ export class Ciphers extends React.Component {
</Row>
<Row className="ds-margin-top">
<Col componentClass={ControlLabel} sm={2}>
- Deny Specific Ciphers
+ Deny Specific Ciphers
</Col>
<Col sm={9}>
<Typeahead
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 1 month
- 1
- 0
[389-ds-base] branch 389-ds-base-1.3.10 updated: Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
by pagure＠pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch 389-ds-base-1.3.10
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.3.10 by this push:
new 6ced3f5 Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
6ced3f5 is described below
commit 6ced3f552e4c29f588eb3a56def5a485c2e89a73
Author: Mark Reynolds <mreynolds(a)redhat.com>
AuthorDate: Thu Mar 19 21:24:05 2020 -0400
Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
Description: The asterick character was missing from the allowed character list.
Also cleaned up the source in the C file.
Thanks @yrro for contributing the original patch!
relates: https://pagure.io/389-ds-base/issue/50800
Reviewed by: firstyear (Thanks!)
---
.../tests/suites/plugins/rootdn_plugin_test.py | 73 ++++++++++++-
ldap/servers/plugins/rootdn_access/rootdn_access.c | 119 +++++++++++----------
2 files changed, 137 insertions(+), 55 deletions(-)
diff --git a/dirsrvtests/tests/suites/plugins/rootdn_plugin_test.py b/dirsrvtests/tests/suites/plugins/rootdn_plugin_test.py
index af5c4c4..a54fd8e 100644
--- a/dirsrvtests/tests/suites/plugins/rootdn_plugin_test.py
+++ b/dirsrvtests/tests/suites/plugins/rootdn_plugin_test.py
@@ -13,7 +13,6 @@ import pytest
from lib389.tasks import *
from lib389.tools import DirSrvTools
from lib389.topologies import topology_st
-
from lib389._constants import PLUGIN_ROOTDN_ACCESS, DN_CONFIG, DEFAULT_SUFFIX, DN_DM, PASSWORD
logging.getLogger(__name__).setLevel(logging.DEBUG)
@@ -439,6 +438,7 @@ def test_rootdn_access_allowed_ip(topology_st):
log.fatal('test_rootdn_access_allowed_ip: Root DN was incorrectly able to bind')
assert False
+
#
# Allow localhost
#
@@ -745,6 +745,77 @@ def test_rootdn_config_validate(topology_st):
log.info('test_rootdn_config_validate: PASSED')
+def test_rootdn_access_denied_ip_wildcard(topology_st, rootdn_setup, rootdn_cleanup):
+ """Test denied IP feature with a wildcard
+
+ :id: 73c74f62-9ac2-4bb6-8a63-bacc8d8bbf93
+ :setup: Standalone instance, rootdn plugin set up
+ :steps:
+ 1. Set rootdn-deny-ip to '127.*'
+ 2. Bind as Root DN
+ 3. Change the denied IP so root DN succeeds
+ 4. Bind as Root DN
+ :expectedresults:
+ 1. Success
+ 2. Should fail
+ 3. Success
+ 4. Success
+ """
+
+ log.info('Running test_rootdn_access_denied_ip_wildcard...')
+
+ plugin.add_deny_ip('127.*')
+ time.sleep(.5)
+
+ # Bind as root DN - should fail
+ uri = 'ldap://{}:{}'.format('127.0.0.1', topology_st.standalone.port)
+ with pytest.raises(ldap.UNWILLING_TO_PERFORM):
+ rootdn_bind(topology_st.standalone, uri=uri)
+
+ # Change the denied IP so root DN succeeds
+ plugin.apply_mods([(ldap.MOD_REPLACE, 'rootdn-deny-ip', '255.255.255.255')])
+ time.sleep(.5)
+
+ # Bind should succeed
+ rootdn_bind(topology_st.standalone, uri=uri)
+
+
+def test_rootdn_access_allowed_ip_wildcard(topology_st, rootdn_setup, rootdn_cleanup):
+ """Test allowed ip feature
+
+ :id: c3e22c61-9ed2-4e89-8243-6ff686ecad9b
+ :setup: Standalone instance, rootdn plugin set up
+ :steps:
+ 1. Set allowed ip to 255.255.255.255 - blocks the Root DN
+ 2. Bind as Root DN
+ 3. Allow 127.*
+ 4. Bind as Root DN
+ :expectedresults:
+ 1. Success
+ 2. Should fail
+ 3. Success
+ 4. Success
+ """
+
+ log.info('Running test_rootdn_access_allowed_ip...')
+
+ # Set allowed ip to 255.255.255.255 - blocks the Root DN
+ plugin.add_allow_ip('255.255.255.255')
+ time.sleep(.5)
+
+ # Bind as Root DN - should fail
+ uri = 'ldap://{}:{}'.format("127.0.0.1", topology_st.standalone.port)
+ with pytest.raises(ldap.UNWILLING_TO_PERFORM):
+ rootdn_bind(topology_st.standalone, uri=uri)
+
+ # Allow localhost
+ plugin.add_allow_ip('127.*')
+ time.sleep(.5)
+
+ # Bind should succeed
+ rootdn_bind(topology_st.standalone, uri=uri)
+
+
if __name__ == '__main__':
# Run isolated
# -s for DEBUG mode
diff --git a/ldap/servers/plugins/rootdn_access/rootdn_access.c b/ldap/servers/plugins/rootdn_access/rootdn_access.c
index 1cb9997..aba44ce 100644
--- a/ldap/servers/plugins/rootdn_access/rootdn_access.c
+++ b/ldap/servers/plugins/rootdn_access/rootdn_access.c
@@ -48,14 +48,14 @@
/*
* Plugin Functions
*/
-int rootdn_init(Slapi_PBlock *pb);
-static int rootdn_start(Slapi_PBlock *pb);
-static int rootdn_close(Slapi_PBlock *pb);
-static int rootdn_load_config(Slapi_PBlock *pb);
-static int rootdn_check_access(Slapi_PBlock *pb);
-static int rootdn_check_host_wildcard(char *host, char *client_host);
+int32_t rootdn_init(Slapi_PBlock *pb);
+static int32_t rootdn_start(Slapi_PBlock *pb);
+static int32_t rootdn_close(Slapi_PBlock *pb);
+static int32_t rootdn_load_config(Slapi_PBlock *pb);
+static int32_t rootdn_check_access(Slapi_PBlock *pb);
+static int32_t rootdn_check_host_wildcard(char *host, char *client_host);
static int rootdn_check_ip_wildcard(char *ip, char *client_ip);
-static int rootdn_preop_bind_init(Slapi_PBlock *pb);
+static int32_t rootdn_preop_bind_init(Slapi_PBlock *pb);
char *strToLower(char *str);
/*
@@ -104,10 +104,10 @@ rootdn_get_plugin_dn(void)
}
-int
+int32_t
rootdn_init(Slapi_PBlock *pb)
{
- int status = 0;
+ int32_t status = 0;
char *plugin_identity = NULL;
slapi_log_err(SLAPI_LOG_TRACE, ROOTDN_PLUGIN_SUBSYSTEM,
@@ -157,7 +157,7 @@ rootdn_init(Slapi_PBlock *pb)
return status;
}
-static int
+static int32_t
rootdn_preop_bind_init(Slapi_PBlock *pb)
{
if (slapi_pblock_set(pb, SLAPI_PLUGIN_INTERNAL_PRE_BIND_FN, (void *)rootdn_check_access) != 0) {
@@ -169,7 +169,7 @@ rootdn_preop_bind_init(Slapi_PBlock *pb)
return 0;
}
-static int
+static int32_t
rootdn_start(Slapi_PBlock *pb __attribute__((unused)))
{
slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "--> rootdn_start\n");
@@ -196,14 +196,14 @@ rootdn_free(void)
ips_to_deny = NULL;
}
-static int
+static int32_t
rootdn_close(Slapi_PBlock *pb __attribute__((unused)))
{
rootdn_free();
return 0;
}
-static int
+static int32_t
rootdn_load_config(Slapi_PBlock *pb)
{
Slapi_Entry *e = NULL;
@@ -217,9 +217,9 @@ rootdn_load_config(Slapi_PBlock *pb)
char *token, *iter = NULL, *copy;
char hour[3], min[3];
size_t end;
- int result = 0;
- int time;
- int i;
+ int32_t result = 0;
+ int32_t time;
+
slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "--> rootdn_load_config\n");
@@ -346,7 +346,7 @@ rootdn_load_config(Slapi_PBlock *pb)
goto free_and_return;
}
if (hosts_tmp) {
- for (i = 0; hosts_tmp[i] != NULL; i++) {
+ for (size_t i = 0; hosts_tmp[i] != NULL; i++) {
end = strspn(hosts_tmp[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz");
if (!end || hosts_tmp[i][end] != '\0') {
slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config - "
@@ -359,7 +359,7 @@ rootdn_load_config(Slapi_PBlock *pb)
}
}
if (hosts_to_deny_tmp) {
- for (i = 0; hosts_to_deny_tmp[i] != NULL; i++) {
+ for (size_t i = 0; hosts_to_deny_tmp[i] != NULL; i++) {
end = strspn(hosts_to_deny_tmp[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz");
if (!end || hosts_to_deny_tmp[i][end] != '\0') {
slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config - "
@@ -372,8 +372,8 @@ rootdn_load_config(Slapi_PBlock *pb)
}
}
if (ips_tmp) {
- for (i = 0; ips_tmp[i] != NULL; i++) {
- end = strspn(ips_tmp[i], "0123456789:ABCDEFabcdef.");
+ for (size_t i = 0; ips_tmp[i] != NULL; i++) {
+ end = strspn(ips_tmp[i], "0123456789:ABCDEFabcdef.*");
if (!end || ips_tmp[i][end] != '\0') {
slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config - "
"IP address contains invalid characters (%s), skipping\n",
@@ -399,7 +399,7 @@ rootdn_load_config(Slapi_PBlock *pb)
}
}
if (ips_to_deny_tmp) {
- for (i = 0; ips_to_deny_tmp[i] != NULL; i++) {
+ for (size_t i = 0; ips_to_deny_tmp[i] != NULL; i++) {
end = strspn(ips_to_deny_tmp[i], "0123456789:ABCDEFabcdef.*");
if (!end || ips_to_deny_tmp[i][end] != '\0') {
slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config - "
@@ -453,7 +453,7 @@ free_and_return:
}
-static int
+static int32_t
rootdn_check_access(Slapi_PBlock *pb)
{
PRNetAddr *client_addr = NULL;
@@ -461,9 +461,8 @@ rootdn_check_access(Slapi_PBlock *pb)
time_t curr_time;
struct tm *timeinfo = NULL;
char *dnsName = NULL;
- int isRoot = 0;
- int rc = SLAPI_PLUGIN_SUCCESS;
- int i;
+ int32_t isRoot = 0;
+ int32_t rc = SLAPI_PLUGIN_SUCCESS;
/*
* Verify this is a root DN
@@ -493,8 +492,8 @@ rootdn_check_access(Slapi_PBlock *pb)
curr_total = (time_t)(timeinfo->tm_hour * 3600) + (timeinfo->tm_min * 60);
if ((curr_total < open_time) || (curr_total >= close_time)) {
- slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - Bind not in the "
- "allowed time window\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Bind not in the allowed time window\n");
return -1;
}
}
@@ -512,8 +511,8 @@ rootdn_check_access(Slapi_PBlock *pb)
daysAllowed = strToLower(daysAllowed);
if (!strstr(daysAllowed, today)) {
- slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
- "Bind not allowed for today(%s), only allowed on days: %s\n",
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
+ "Bind not allowed for today(%s), only allowed on days: %s\n",
today, daysAllowed);
return -1;
}
@@ -522,7 +521,7 @@ rootdn_check_access(Slapi_PBlock *pb)
* Check the host restrictions, deny always overrides allow
*/
if (hosts || hosts_to_deny) {
- char buf[PR_NETDB_BUF_SIZE];
+ char buf[PR_NETDB_BUF_SIZE] = {0};
char *host;
/*
@@ -530,8 +529,8 @@ rootdn_check_access(Slapi_PBlock *pb)
*/
client_addr = (PRNetAddr *)slapi_ch_malloc(sizeof(PRNetAddr));
if (slapi_pblock_get(pb, SLAPI_CONN_CLIENTNETADDR, client_addr) != 0) {
- slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
- "Could not get client address for hosts.\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Could not get client address for hosts.\n");
rc = -1;
goto free_and_return;
}
@@ -545,14 +544,14 @@ rootdn_check_access(Slapi_PBlock *pb)
dnsName = slapi_ch_strdup(host_entry->h_name);
} else {
/* no hostname */
- slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
- "Client address missing hostname\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Client address missing hostname\n");
rc = -1;
goto free_and_return;
}
} else {
- slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
- "client IP address could not be resolved\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - client IP address could not be resolved\n");
rc = -1;
goto free_and_return;
}
@@ -560,18 +559,22 @@ rootdn_check_access(Slapi_PBlock *pb)
* Now we have our hostname, now do our checks
*/
if (hosts_to_deny) {
- for (i = 0; hosts_to_deny[i] != NULL; i++) {
+ for (size_t i = 0; hosts_to_deny[i] != NULL; i++) {
host = hosts_to_deny[i];
/* check for wild cards */
if (host[0] == '*') {
if (rootdn_check_host_wildcard(host, dnsName) == 0) {
/* match, return failure */
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
+ "hostname (%s) matched denied host (%s)\n", dnsName, host);
rc = -1;
goto free_and_return;
}
} else {
if (strcasecmp(host, dnsName) == 0) {
/* we have a match, return failure */
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
+ "hostname (%s) matched denied host (%s)\n", dnsName, host);
rc = -1;
goto free_and_return;
}
@@ -580,7 +583,7 @@ rootdn_check_access(Slapi_PBlock *pb)
rc = 0;
}
if (hosts) {
- for (i = 0; hosts[i] != NULL; i++) {
+ for (size_t i = 0; hosts[i] != NULL; i++) {
host = hosts[i];
/* check for wild cards */
if (host[0] == '*') {
@@ -604,14 +607,15 @@ rootdn_check_access(Slapi_PBlock *pb)
* Check the IP address restrictions, deny always overrides allow
*/
if (ips || ips_to_deny) {
- char ip_str[256];
+ char ip_str[256] = {0};
char *ip;
- int ip_len, i;
+ int32_t ip_len;
if (client_addr == NULL) {
client_addr = (PRNetAddr *)slapi_ch_malloc(sizeof(PRNetAddr));
if (slapi_pblock_get(pb, SLAPI_CONN_CLIENTNETADDR, client_addr) != 0) {
- slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - Could not get client address for IP.\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Could not get client address for IP.\n");
rc = -1;
goto free_and_return;
}
@@ -624,13 +628,15 @@ rootdn_check_access(Slapi_PBlock *pb)
v4addr.inet.family = PR_AF_INET;
v4addr.inet.ip = client_addr->ipv6.ip.pr_s6_addr32[3];
if (PR_NetAddrToString(&v4addr, ip_str, sizeof(ip_str)) != PR_SUCCESS) {
- slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - Could not get IPv4 from client address.\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Could not get IPv4 from client address.\n");
rc = -1;
goto free_and_return;
}
} else {
if (PR_NetAddrToString(client_addr, ip_str, sizeof(ip_str)) != PR_SUCCESS) {
- slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - Could not get IPv6 from client address.\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Could not get IPv6 from client address.\n");
rc = -1;
goto free_and_return;
}
@@ -639,18 +645,22 @@ rootdn_check_access(Slapi_PBlock *pb)
* Now we have our IP address, do our checks
*/
if (ips_to_deny) {
- for (i = 0; ips_to_deny[i] != NULL; i++) {
+ for (size_t i = 0; ips_to_deny[i] != NULL; i++) {
ip = ips_to_deny[i];
ip_len = strlen(ip);
if (ip[ip_len - 1] == '*') {
if (rootdn_check_ip_wildcard(ips_to_deny[i], ip_str) == 0) {
/* match, return failure */
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
+ "ip address (%s) matched denied IP address (%s)\n", ip_str, ip);
rc = -1;
goto free_and_return;
}
} else {
if (strcasecmp(ip_str, ip) == 0) {
/* match, return failure */
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
+ "ip address (%s) matched denied IP address (%s)\n", ip_str, ip);
rc = -1;
goto free_and_return;
}
@@ -659,7 +669,7 @@ rootdn_check_access(Slapi_PBlock *pb)
rc = 0;
}
if (ips) {
- for (i = 0; ips[i] != NULL; i++) {
+ for (size_t i = 0; ips[i] != NULL; i++) {
ip = ips[i];
ip_len = strlen(ip);
if (ip[ip_len - 1] == '*') {
@@ -668,6 +678,7 @@ rootdn_check_access(Slapi_PBlock *pb)
rc = 0;
goto free_and_return;
}
+
} else {
if (strcasecmp(ip_str, ip) == 0) {
/* match, return success */
@@ -688,17 +699,19 @@ free_and_return:
return rc;
}
-static int
+static int32_t
rootdn_check_host_wildcard(char *host, char *client_host)
{
- int host_len = strlen(host);
- int client_len = strlen(client_host);
- int i, j;
+ size_t host_len = strlen(host);
+ size_t client_len = strlen(client_host);
+ size_t i, j;
+
/*
* Start at the end of the string and move backwards, and skip the first char "*"
*/
if (client_len < host_len) {
/* this can't be a match */
+
return -1;
}
for (i = host_len - 1, j = client_len - 1; i > 0; i--, j--) {
@@ -714,7 +727,7 @@ static int
rootdn_check_ip_wildcard(char *ip, char *client_ip)
{
size_t ip_len = strlen(ip);
- int i;
+
/*
* Start at the beginning of the string and move forward, and skip the last char "*"
*/
@@ -722,7 +735,7 @@ rootdn_check_ip_wildcard(char *ip, char *client_ip)
/* this can't be a match */
return -1;
}
- for (i = 0; i < ip_len - 1; i++) {
+ for (size_t i = 0; i < ip_len - 1; i++) {
if (ip[i] != client_ip[i]) {
return -1;
}
@@ -734,9 +747,7 @@ rootdn_check_ip_wildcard(char *ip, char *client_ip)
char *
strToLower(char *str)
{
- size_t i;
-
- for (i = 0; str && i < strlen(str); i++) {
+ for (size_t i = 0; str && i < strlen(str); i++) {
str[i] = tolower(str[i]);
}
return str;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 1 month
- 1
- 0
[389-ds-base] branch 389-ds-base-1.4.1 updated: Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
by pagure＠pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch 389-ds-base-1.4.1
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.4.1 by this push:
new b811ee0 Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
b811ee0 is described below
commit b811ee04756dc09111419e53687790f7e55e38a6
Author: Mark Reynolds <mreynolds(a)redhat.com>
AuthorDate: Thu Mar 19 21:24:05 2020 -0400
Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
Description: The asterick character was missing from the allowed character list.
Also cleaned up the source in the C file.
Thanks @yrro for contributing the original patch!
relates: https://pagure.io/389-ds-base/issue/50800
Reviewed by: firstyear (Thanks!)
---
.../tests/suites/plugins/rootdn_plugin_test.py | 74 ++++++++++++-
ldap/servers/plugins/rootdn_access/rootdn_access.c | 119 +++++++++++----------
2 files changed, 137 insertions(+), 56 deletions(-)
diff --git a/dirsrvtests/tests/suites/plugins/rootdn_plugin_test.py b/dirsrvtests/tests/suites/plugins/rootdn_plugin_test.py
index 56f1b04..5feb687 100644
--- a/dirsrvtests/tests/suites/plugins/rootdn_plugin_test.py
+++ b/dirsrvtests/tests/suites/plugins/rootdn_plugin_test.py
@@ -17,7 +17,6 @@ from lib389.utils import *
from lib389.tasks import *
from lib389.tools import DirSrvTools
from lib389.topologies import topology_st
-from lib389._constants import DEFAULT_SUFFIX, DN_DM, PASSWORD
from lib389.idm.directorymanager import DirectoryManager
from lib389.plugins import RootDNAccessControlPlugin
@@ -280,7 +279,7 @@ def test_rootdn_access_allowed_ip(topology_st, rootdn_setup, rootdn_cleanup):
time.sleep(.5)
# Bind as Root DN - should fail
- uri = 'ldap://{}:{}'.format(localhost, topology_st.standalone.port)
+ uri = 'ldap://{}:{}'.format('127.0.0.1', topology_st.standalone.port)
with pytest.raises(ldap.UNWILLING_TO_PERFORM):
rootdn_bind(topology_st.standalone, uri=uri)
@@ -460,6 +459,77 @@ def test_rootdn_config_validate(topology_st, rootdn_setup, rootdn_cleanup):
plugin.apply_mods([(ldap.MOD_REPLACE, 'rootdn-deny-host', 'host.####.com')])
+def test_rootdn_access_denied_ip_wildcard(topology_st, rootdn_setup, rootdn_cleanup):
+ """Test denied IP feature with a wildcard
+
+ :id: 73c74f62-9ac2-4bb6-8a63-bacc8d8bbf93
+ :setup: Standalone instance, rootdn plugin set up
+ :steps:
+ 1. Set rootdn-deny-ip to '127.*'
+ 2. Bind as Root DN
+ 3. Change the denied IP so root DN succeeds
+ 4. Bind as Root DN
+ :expectedresults:
+ 1. Success
+ 2. Should fail
+ 3. Success
+ 4. Success
+ """
+
+ log.info('Running test_rootdn_access_denied_ip_wildcard...')
+
+ plugin.add_deny_ip('127.*')
+ time.sleep(.5)
+
+ # Bind as root DN - should fail
+ uri = 'ldap://{}:{}'.format('127.0.0.1', topology_st.standalone.port)
+ with pytest.raises(ldap.UNWILLING_TO_PERFORM):
+ rootdn_bind(topology_st.standalone, uri=uri)
+
+ # Change the denied IP so root DN succeeds
+ plugin.apply_mods([(ldap.MOD_REPLACE, 'rootdn-deny-ip', '255.255.255.255')])
+ time.sleep(.5)
+
+ # Bind should succeed
+ rootdn_bind(topology_st.standalone, uri=uri)
+
+
+def test_rootdn_access_allowed_ip_wildcard(topology_st, rootdn_setup, rootdn_cleanup):
+ """Test allowed ip feature
+
+ :id: c3e22c61-9ed2-4e89-8243-6ff686ecad9b
+ :setup: Standalone instance, rootdn plugin set up
+ :steps:
+ 1. Set allowed ip to 255.255.255.255 - blocks the Root DN
+ 2. Bind as Root DN
+ 3. Allow 127.*
+ 4. Bind as Root DN
+ :expectedresults:
+ 1. Success
+ 2. Should fail
+ 3. Success
+ 4. Success
+ """
+
+ log.info('Running test_rootdn_access_allowed_ip...')
+
+ # Set allowed ip to 255.255.255.255 - blocks the Root DN
+ plugin.add_allow_ip('255.255.255.255')
+ time.sleep(.5)
+
+ # Bind as Root DN - should fail
+ uri = 'ldap://{}:{}'.format("127.0.0.1", topology_st.standalone.port)
+ with pytest.raises(ldap.UNWILLING_TO_PERFORM):
+ rootdn_bind(topology_st.standalone, uri=uri)
+
+ # Allow localhost
+ plugin.add_allow_ip('127.*')
+ time.sleep(.5)
+
+ # Bind should succeed
+ rootdn_bind(topology_st.standalone, uri=uri)
+
+
if __name__ == '__main__':
# Run isolated
# -s for DEBUG mode
diff --git a/ldap/servers/plugins/rootdn_access/rootdn_access.c b/ldap/servers/plugins/rootdn_access/rootdn_access.c
index 2f84aea..b256fa2 100644
--- a/ldap/servers/plugins/rootdn_access/rootdn_access.c
+++ b/ldap/servers/plugins/rootdn_access/rootdn_access.c
@@ -48,14 +48,14 @@
/*
* Plugin Functions
*/
-int rootdn_init(Slapi_PBlock *pb);
-static int rootdn_start(Slapi_PBlock *pb);
-static int rootdn_close(Slapi_PBlock *pb);
-static int rootdn_load_config(Slapi_PBlock *pb);
-static int rootdn_check_access(Slapi_PBlock *pb);
-static int rootdn_check_host_wildcard(char *host, char *client_host);
+int32_t rootdn_init(Slapi_PBlock *pb);
+static int32_t rootdn_start(Slapi_PBlock *pb);
+static int32_t rootdn_close(Slapi_PBlock *pb);
+static int32_t rootdn_load_config(Slapi_PBlock *pb);
+static int32_t rootdn_check_access(Slapi_PBlock *pb);
+static int32_t rootdn_check_host_wildcard(char *host, char *client_host);
static int rootdn_check_ip_wildcard(char *ip, char *client_ip);
-static int rootdn_preop_bind_init(Slapi_PBlock *pb);
+static int32_t rootdn_preop_bind_init(Slapi_PBlock *pb);
char *strToLower(char *str);
/*
@@ -104,10 +104,10 @@ rootdn_get_plugin_dn(void)
}
-int
+int32_t
rootdn_init(Slapi_PBlock *pb)
{
- int status = 0;
+ int32_t status = 0;
char *plugin_identity = NULL;
slapi_log_err(SLAPI_LOG_TRACE, ROOTDN_PLUGIN_SUBSYSTEM,
@@ -157,7 +157,7 @@ rootdn_init(Slapi_PBlock *pb)
return status;
}
-static int
+static int32_t
rootdn_preop_bind_init(Slapi_PBlock *pb)
{
if (slapi_pblock_set(pb, SLAPI_PLUGIN_INTERNAL_PRE_BIND_FN, (void *)rootdn_check_access) != 0) {
@@ -169,7 +169,7 @@ rootdn_preop_bind_init(Slapi_PBlock *pb)
return 0;
}
-static int
+static int32_t
rootdn_start(Slapi_PBlock *pb __attribute__((unused)))
{
slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "--> rootdn_start\n");
@@ -196,14 +196,14 @@ rootdn_free(void)
ips_to_deny = NULL;
}
-static int
+static int32_t
rootdn_close(Slapi_PBlock *pb __attribute__((unused)))
{
rootdn_free();
return 0;
}
-static int
+static int32_t
rootdn_load_config(Slapi_PBlock *pb)
{
Slapi_Entry *e = NULL;
@@ -217,9 +217,9 @@ rootdn_load_config(Slapi_PBlock *pb)
char *token, *iter = NULL, *copy;
char hour[3], min[3];
size_t end;
- int result = 0;
- int time;
- int i;
+ int32_t result = 0;
+ int32_t time;
+
slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "--> rootdn_load_config\n");
@@ -344,7 +344,7 @@ rootdn_load_config(Slapi_PBlock *pb)
goto free_and_return;
}
if (hosts_tmp) {
- for (i = 0; hosts_tmp[i] != NULL; i++) {
+ for (size_t i = 0; hosts_tmp[i] != NULL; i++) {
end = strspn(hosts_tmp[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz");
if (!end || hosts_tmp[i][end] != '\0') {
slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config - "
@@ -357,7 +357,7 @@ rootdn_load_config(Slapi_PBlock *pb)
}
}
if (hosts_to_deny_tmp) {
- for (i = 0; hosts_to_deny_tmp[i] != NULL; i++) {
+ for (size_t i = 0; hosts_to_deny_tmp[i] != NULL; i++) {
end = strspn(hosts_to_deny_tmp[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz");
if (!end || hosts_to_deny_tmp[i][end] != '\0') {
slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config - "
@@ -370,8 +370,8 @@ rootdn_load_config(Slapi_PBlock *pb)
}
}
if (ips_tmp) {
- for (i = 0; ips_tmp[i] != NULL; i++) {
- end = strspn(ips_tmp[i], "0123456789:ABCDEFabcdef.");
+ for (size_t i = 0; ips_tmp[i] != NULL; i++) {
+ end = strspn(ips_tmp[i], "0123456789:ABCDEFabcdef.*");
if (!end || ips_tmp[i][end] != '\0') {
slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config - "
"IP address contains invalid characters (%s), skipping\n",
@@ -397,7 +397,7 @@ rootdn_load_config(Slapi_PBlock *pb)
}
}
if (ips_to_deny_tmp) {
- for (i = 0; ips_to_deny_tmp[i] != NULL; i++) {
+ for (size_t i = 0; ips_to_deny_tmp[i] != NULL; i++) {
end = strspn(ips_to_deny_tmp[i], "0123456789:ABCDEFabcdef.*");
if (!end || ips_to_deny_tmp[i][end] != '\0') {
slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config - "
@@ -449,7 +449,7 @@ free_and_return:
}
-static int
+static int32_t
rootdn_check_access(Slapi_PBlock *pb)
{
PRNetAddr *client_addr = NULL;
@@ -457,9 +457,8 @@ rootdn_check_access(Slapi_PBlock *pb)
time_t curr_time;
struct tm *timeinfo = NULL;
char *dnsName = NULL;
- int isRoot = 0;
- int rc = SLAPI_PLUGIN_SUCCESS;
- int i;
+ int32_t isRoot = 0;
+ int32_t rc = SLAPI_PLUGIN_SUCCESS;
/*
* Verify this is a root DN
@@ -489,8 +488,8 @@ rootdn_check_access(Slapi_PBlock *pb)
curr_total = (time_t)(timeinfo->tm_hour * 3600) + (timeinfo->tm_min * 60);
if ((curr_total < open_time) || (curr_total >= close_time)) {
- slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - Bind not in the "
- "allowed time window\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Bind not in the allowed time window\n");
return -1;
}
}
@@ -508,8 +507,8 @@ rootdn_check_access(Slapi_PBlock *pb)
daysAllowed = strToLower(daysAllowed);
if (!strstr(daysAllowed, today)) {
- slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
- "Bind not allowed for today(%s), only allowed on days: %s\n",
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
+ "Bind not allowed for today(%s), only allowed on days: %s\n",
today, daysAllowed);
return -1;
}
@@ -518,7 +517,7 @@ rootdn_check_access(Slapi_PBlock *pb)
* Check the host restrictions, deny always overrides allow
*/
if (hosts || hosts_to_deny) {
- char buf[PR_NETDB_BUF_SIZE];
+ char buf[PR_NETDB_BUF_SIZE] = {0};
char *host;
/*
@@ -526,8 +525,8 @@ rootdn_check_access(Slapi_PBlock *pb)
*/
client_addr = (PRNetAddr *)slapi_ch_malloc(sizeof(PRNetAddr));
if (slapi_pblock_get(pb, SLAPI_CONN_CLIENTNETADDR, client_addr) != 0) {
- slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
- "Could not get client address for hosts.\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Could not get client address for hosts.\n");
rc = -1;
goto free_and_return;
}
@@ -541,14 +540,14 @@ rootdn_check_access(Slapi_PBlock *pb)
dnsName = slapi_ch_strdup(host_entry->h_name);
} else {
/* no hostname */
- slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
- "Client address missing hostname\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Client address missing hostname\n");
rc = -1;
goto free_and_return;
}
} else {
- slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
- "client IP address could not be resolved\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - client IP address could not be resolved\n");
rc = -1;
goto free_and_return;
}
@@ -556,18 +555,22 @@ rootdn_check_access(Slapi_PBlock *pb)
* Now we have our hostname, now do our checks
*/
if (hosts_to_deny) {
- for (i = 0; hosts_to_deny[i] != NULL; i++) {
+ for (size_t i = 0; hosts_to_deny[i] != NULL; i++) {
host = hosts_to_deny[i];
/* check for wild cards */
if (host[0] == '*') {
if (rootdn_check_host_wildcard(host, dnsName) == 0) {
/* match, return failure */
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
+ "hostname (%s) matched denied host (%s)\n", dnsName, host);
rc = -1;
goto free_and_return;
}
} else {
if (strcasecmp(host, dnsName) == 0) {
/* we have a match, return failure */
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
+ "hostname (%s) matched denied host (%s)\n", dnsName, host);
rc = -1;
goto free_and_return;
}
@@ -576,7 +579,7 @@ rootdn_check_access(Slapi_PBlock *pb)
rc = 0;
}
if (hosts) {
- for (i = 0; hosts[i] != NULL; i++) {
+ for (size_t i = 0; hosts[i] != NULL; i++) {
host = hosts[i];
/* check for wild cards */
if (host[0] == '*') {
@@ -600,14 +603,15 @@ rootdn_check_access(Slapi_PBlock *pb)
* Check the IP address restrictions, deny always overrides allow
*/
if (ips || ips_to_deny) {
- char ip_str[256];
+ char ip_str[256] = {0};
char *ip;
- int ip_len, i;
+ int32_t ip_len;
if (client_addr == NULL) {
client_addr = (PRNetAddr *)slapi_ch_malloc(sizeof(PRNetAddr));
if (slapi_pblock_get(pb, SLAPI_CONN_CLIENTNETADDR, client_addr) != 0) {
- slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - Could not get client address for IP.\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Could not get client address for IP.\n");
rc = -1;
goto free_and_return;
}
@@ -620,13 +624,15 @@ rootdn_check_access(Slapi_PBlock *pb)
v4addr.inet.family = PR_AF_INET;
v4addr.inet.ip = client_addr->ipv6.ip.pr_s6_addr32[3];
if (PR_NetAddrToString(&v4addr, ip_str, sizeof(ip_str)) != PR_SUCCESS) {
- slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - Could not get IPv4 from client address.\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Could not get IPv4 from client address.\n");
rc = -1;
goto free_and_return;
}
} else {
if (PR_NetAddrToString(client_addr, ip_str, sizeof(ip_str)) != PR_SUCCESS) {
- slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - Could not get IPv6 from client address.\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Could not get IPv6 from client address.\n");
rc = -1;
goto free_and_return;
}
@@ -635,18 +641,22 @@ rootdn_check_access(Slapi_PBlock *pb)
* Now we have our IP address, do our checks
*/
if (ips_to_deny) {
- for (i = 0; ips_to_deny[i] != NULL; i++) {
+ for (size_t i = 0; ips_to_deny[i] != NULL; i++) {
ip = ips_to_deny[i];
ip_len = strlen(ip);
if (ip[ip_len - 1] == '*') {
if (rootdn_check_ip_wildcard(ips_to_deny[i], ip_str) == 0) {
/* match, return failure */
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
+ "ip address (%s) matched denied IP address (%s)\n", ip_str, ip);
rc = -1;
goto free_and_return;
}
} else {
if (strcasecmp(ip_str, ip) == 0) {
/* match, return failure */
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
+ "ip address (%s) matched denied IP address (%s)\n", ip_str, ip);
rc = -1;
goto free_and_return;
}
@@ -655,7 +665,7 @@ rootdn_check_access(Slapi_PBlock *pb)
rc = 0;
}
if (ips) {
- for (i = 0; ips[i] != NULL; i++) {
+ for (size_t i = 0; ips[i] != NULL; i++) {
ip = ips[i];
ip_len = strlen(ip);
if (ip[ip_len - 1] == '*') {
@@ -664,6 +674,7 @@ rootdn_check_access(Slapi_PBlock *pb)
rc = 0;
goto free_and_return;
}
+
} else {
if (strcasecmp(ip_str, ip) == 0) {
/* match, return success */
@@ -684,17 +695,19 @@ free_and_return:
return rc;
}
-static int
+static int32_t
rootdn_check_host_wildcard(char *host, char *client_host)
{
- int host_len = strlen(host);
- int client_len = strlen(client_host);
- int i, j;
+ size_t host_len = strlen(host);
+ size_t client_len = strlen(client_host);
+ size_t i, j;
+
/*
* Start at the end of the string and move backwards, and skip the first char "*"
*/
if (client_len < host_len) {
/* this can't be a match */
+
return -1;
}
for (i = host_len - 1, j = client_len - 1; i > 0; i--, j--) {
@@ -710,7 +723,7 @@ static int
rootdn_check_ip_wildcard(char *ip, char *client_ip)
{
size_t ip_len = strlen(ip);
- int i;
+
/*
* Start at the beginning of the string and move forward, and skip the last char "*"
*/
@@ -718,7 +731,7 @@ rootdn_check_ip_wildcard(char *ip, char *client_ip)
/* this can't be a match */
return -1;
}
- for (i = 0; i < ip_len - 1; i++) {
+ for (size_t i = 0; i < ip_len - 1; i++) {
if (ip[i] != client_ip[i]) {
return -1;
}
@@ -730,9 +743,7 @@ rootdn_check_ip_wildcard(char *ip, char *client_ip)
char *
strToLower(char *str)
{
- size_t i;
-
- for (i = 0; str && i < strlen(str); i++) {
+ for (size_t i = 0; str && i < strlen(str); i++) {
str[i] = tolower(str[i]);
}
return str;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 1 month
- 1
- 0
[389-ds-base] branch 389-ds-base-1.4.2 updated: Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
by pagure＠pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch 389-ds-base-1.4.2
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.4.2 by this push:
new d8f2994 Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
d8f2994 is described below
commit d8f2994bd29a04ff212f895d161b3f5b34917b18
Author: Mark Reynolds <mreynolds(a)redhat.com>
AuthorDate: Thu Mar 19 21:24:05 2020 -0400
Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
Description: The asterick character was missing from the allowed character list.
Also cleaned up the source in the C file.
Thanks @yrro for contributing the original patch!
relates: https://pagure.io/389-ds-base/issue/50800
Reviewed by: firstyear (Thanks!)
---
.../tests/suites/plugins/rootdn_plugin_test.py | 74 ++++++++++++-
ldap/servers/plugins/rootdn_access/rootdn_access.c | 119 +++++++++++----------
2 files changed, 137 insertions(+), 56 deletions(-)
diff --git a/dirsrvtests/tests/suites/plugins/rootdn_plugin_test.py b/dirsrvtests/tests/suites/plugins/rootdn_plugin_test.py
index 56f1b04..5feb687 100644
--- a/dirsrvtests/tests/suites/plugins/rootdn_plugin_test.py
+++ b/dirsrvtests/tests/suites/plugins/rootdn_plugin_test.py
@@ -17,7 +17,6 @@ from lib389.utils import *
from lib389.tasks import *
from lib389.tools import DirSrvTools
from lib389.topologies import topology_st
-from lib389._constants import DEFAULT_SUFFIX, DN_DM, PASSWORD
from lib389.idm.directorymanager import DirectoryManager
from lib389.plugins import RootDNAccessControlPlugin
@@ -280,7 +279,7 @@ def test_rootdn_access_allowed_ip(topology_st, rootdn_setup, rootdn_cleanup):
time.sleep(.5)
# Bind as Root DN - should fail
- uri = 'ldap://{}:{}'.format(localhost, topology_st.standalone.port)
+ uri = 'ldap://{}:{}'.format('127.0.0.1', topology_st.standalone.port)
with pytest.raises(ldap.UNWILLING_TO_PERFORM):
rootdn_bind(topology_st.standalone, uri=uri)
@@ -460,6 +459,77 @@ def test_rootdn_config_validate(topology_st, rootdn_setup, rootdn_cleanup):
plugin.apply_mods([(ldap.MOD_REPLACE, 'rootdn-deny-host', 'host.####.com')])
+def test_rootdn_access_denied_ip_wildcard(topology_st, rootdn_setup, rootdn_cleanup):
+ """Test denied IP feature with a wildcard
+
+ :id: 73c74f62-9ac2-4bb6-8a63-bacc8d8bbf93
+ :setup: Standalone instance, rootdn plugin set up
+ :steps:
+ 1. Set rootdn-deny-ip to '127.*'
+ 2. Bind as Root DN
+ 3. Change the denied IP so root DN succeeds
+ 4. Bind as Root DN
+ :expectedresults:
+ 1. Success
+ 2. Should fail
+ 3. Success
+ 4. Success
+ """
+
+ log.info('Running test_rootdn_access_denied_ip_wildcard...')
+
+ plugin.add_deny_ip('127.*')
+ time.sleep(.5)
+
+ # Bind as root DN - should fail
+ uri = 'ldap://{}:{}'.format('127.0.0.1', topology_st.standalone.port)
+ with pytest.raises(ldap.UNWILLING_TO_PERFORM):
+ rootdn_bind(topology_st.standalone, uri=uri)
+
+ # Change the denied IP so root DN succeeds
+ plugin.apply_mods([(ldap.MOD_REPLACE, 'rootdn-deny-ip', '255.255.255.255')])
+ time.sleep(.5)
+
+ # Bind should succeed
+ rootdn_bind(topology_st.standalone, uri=uri)
+
+
+def test_rootdn_access_allowed_ip_wildcard(topology_st, rootdn_setup, rootdn_cleanup):
+ """Test allowed ip feature
+
+ :id: c3e22c61-9ed2-4e89-8243-6ff686ecad9b
+ :setup: Standalone instance, rootdn plugin set up
+ :steps:
+ 1. Set allowed ip to 255.255.255.255 - blocks the Root DN
+ 2. Bind as Root DN
+ 3. Allow 127.*
+ 4. Bind as Root DN
+ :expectedresults:
+ 1. Success
+ 2. Should fail
+ 3. Success
+ 4. Success
+ """
+
+ log.info('Running test_rootdn_access_allowed_ip...')
+
+ # Set allowed ip to 255.255.255.255 - blocks the Root DN
+ plugin.add_allow_ip('255.255.255.255')
+ time.sleep(.5)
+
+ # Bind as Root DN - should fail
+ uri = 'ldap://{}:{}'.format("127.0.0.1", topology_st.standalone.port)
+ with pytest.raises(ldap.UNWILLING_TO_PERFORM):
+ rootdn_bind(topology_st.standalone, uri=uri)
+
+ # Allow localhost
+ plugin.add_allow_ip('127.*')
+ time.sleep(.5)
+
+ # Bind should succeed
+ rootdn_bind(topology_st.standalone, uri=uri)
+
+
if __name__ == '__main__':
# Run isolated
# -s for DEBUG mode
diff --git a/ldap/servers/plugins/rootdn_access/rootdn_access.c b/ldap/servers/plugins/rootdn_access/rootdn_access.c
index 2f84aea..b256fa2 100644
--- a/ldap/servers/plugins/rootdn_access/rootdn_access.c
+++ b/ldap/servers/plugins/rootdn_access/rootdn_access.c
@@ -48,14 +48,14 @@
/*
* Plugin Functions
*/
-int rootdn_init(Slapi_PBlock *pb);
-static int rootdn_start(Slapi_PBlock *pb);
-static int rootdn_close(Slapi_PBlock *pb);
-static int rootdn_load_config(Slapi_PBlock *pb);
-static int rootdn_check_access(Slapi_PBlock *pb);
-static int rootdn_check_host_wildcard(char *host, char *client_host);
+int32_t rootdn_init(Slapi_PBlock *pb);
+static int32_t rootdn_start(Slapi_PBlock *pb);
+static int32_t rootdn_close(Slapi_PBlock *pb);
+static int32_t rootdn_load_config(Slapi_PBlock *pb);
+static int32_t rootdn_check_access(Slapi_PBlock *pb);
+static int32_t rootdn_check_host_wildcard(char *host, char *client_host);
static int rootdn_check_ip_wildcard(char *ip, char *client_ip);
-static int rootdn_preop_bind_init(Slapi_PBlock *pb);
+static int32_t rootdn_preop_bind_init(Slapi_PBlock *pb);
char *strToLower(char *str);
/*
@@ -104,10 +104,10 @@ rootdn_get_plugin_dn(void)
}
-int
+int32_t
rootdn_init(Slapi_PBlock *pb)
{
- int status = 0;
+ int32_t status = 0;
char *plugin_identity = NULL;
slapi_log_err(SLAPI_LOG_TRACE, ROOTDN_PLUGIN_SUBSYSTEM,
@@ -157,7 +157,7 @@ rootdn_init(Slapi_PBlock *pb)
return status;
}
-static int
+static int32_t
rootdn_preop_bind_init(Slapi_PBlock *pb)
{
if (slapi_pblock_set(pb, SLAPI_PLUGIN_INTERNAL_PRE_BIND_FN, (void *)rootdn_check_access) != 0) {
@@ -169,7 +169,7 @@ rootdn_preop_bind_init(Slapi_PBlock *pb)
return 0;
}
-static int
+static int32_t
rootdn_start(Slapi_PBlock *pb __attribute__((unused)))
{
slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "--> rootdn_start\n");
@@ -196,14 +196,14 @@ rootdn_free(void)
ips_to_deny = NULL;
}
-static int
+static int32_t
rootdn_close(Slapi_PBlock *pb __attribute__((unused)))
{
rootdn_free();
return 0;
}
-static int
+static int32_t
rootdn_load_config(Slapi_PBlock *pb)
{
Slapi_Entry *e = NULL;
@@ -217,9 +217,9 @@ rootdn_load_config(Slapi_PBlock *pb)
char *token, *iter = NULL, *copy;
char hour[3], min[3];
size_t end;
- int result = 0;
- int time;
- int i;
+ int32_t result = 0;
+ int32_t time;
+
slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "--> rootdn_load_config\n");
@@ -344,7 +344,7 @@ rootdn_load_config(Slapi_PBlock *pb)
goto free_and_return;
}
if (hosts_tmp) {
- for (i = 0; hosts_tmp[i] != NULL; i++) {
+ for (size_t i = 0; hosts_tmp[i] != NULL; i++) {
end = strspn(hosts_tmp[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz");
if (!end || hosts_tmp[i][end] != '\0') {
slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config - "
@@ -357,7 +357,7 @@ rootdn_load_config(Slapi_PBlock *pb)
}
}
if (hosts_to_deny_tmp) {
- for (i = 0; hosts_to_deny_tmp[i] != NULL; i++) {
+ for (size_t i = 0; hosts_to_deny_tmp[i] != NULL; i++) {
end = strspn(hosts_to_deny_tmp[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz");
if (!end || hosts_to_deny_tmp[i][end] != '\0') {
slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config - "
@@ -370,8 +370,8 @@ rootdn_load_config(Slapi_PBlock *pb)
}
}
if (ips_tmp) {
- for (i = 0; ips_tmp[i] != NULL; i++) {
- end = strspn(ips_tmp[i], "0123456789:ABCDEFabcdef.");
+ for (size_t i = 0; ips_tmp[i] != NULL; i++) {
+ end = strspn(ips_tmp[i], "0123456789:ABCDEFabcdef.*");
if (!end || ips_tmp[i][end] != '\0') {
slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config - "
"IP address contains invalid characters (%s), skipping\n",
@@ -397,7 +397,7 @@ rootdn_load_config(Slapi_PBlock *pb)
}
}
if (ips_to_deny_tmp) {
- for (i = 0; ips_to_deny_tmp[i] != NULL; i++) {
+ for (size_t i = 0; ips_to_deny_tmp[i] != NULL; i++) {
end = strspn(ips_to_deny_tmp[i], "0123456789:ABCDEFabcdef.*");
if (!end || ips_to_deny_tmp[i][end] != '\0') {
slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config - "
@@ -449,7 +449,7 @@ free_and_return:
}
-static int
+static int32_t
rootdn_check_access(Slapi_PBlock *pb)
{
PRNetAddr *client_addr = NULL;
@@ -457,9 +457,8 @@ rootdn_check_access(Slapi_PBlock *pb)
time_t curr_time;
struct tm *timeinfo = NULL;
char *dnsName = NULL;
- int isRoot = 0;
- int rc = SLAPI_PLUGIN_SUCCESS;
- int i;
+ int32_t isRoot = 0;
+ int32_t rc = SLAPI_PLUGIN_SUCCESS;
/*
* Verify this is a root DN
@@ -489,8 +488,8 @@ rootdn_check_access(Slapi_PBlock *pb)
curr_total = (time_t)(timeinfo->tm_hour * 3600) + (timeinfo->tm_min * 60);
if ((curr_total < open_time) || (curr_total >= close_time)) {
- slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - Bind not in the "
- "allowed time window\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Bind not in the allowed time window\n");
return -1;
}
}
@@ -508,8 +507,8 @@ rootdn_check_access(Slapi_PBlock *pb)
daysAllowed = strToLower(daysAllowed);
if (!strstr(daysAllowed, today)) {
- slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
- "Bind not allowed for today(%s), only allowed on days: %s\n",
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
+ "Bind not allowed for today(%s), only allowed on days: %s\n",
today, daysAllowed);
return -1;
}
@@ -518,7 +517,7 @@ rootdn_check_access(Slapi_PBlock *pb)
* Check the host restrictions, deny always overrides allow
*/
if (hosts || hosts_to_deny) {
- char buf[PR_NETDB_BUF_SIZE];
+ char buf[PR_NETDB_BUF_SIZE] = {0};
char *host;
/*
@@ -526,8 +525,8 @@ rootdn_check_access(Slapi_PBlock *pb)
*/
client_addr = (PRNetAddr *)slapi_ch_malloc(sizeof(PRNetAddr));
if (slapi_pblock_get(pb, SLAPI_CONN_CLIENTNETADDR, client_addr) != 0) {
- slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
- "Could not get client address for hosts.\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Could not get client address for hosts.\n");
rc = -1;
goto free_and_return;
}
@@ -541,14 +540,14 @@ rootdn_check_access(Slapi_PBlock *pb)
dnsName = slapi_ch_strdup(host_entry->h_name);
} else {
/* no hostname */
- slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
- "Client address missing hostname\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Client address missing hostname\n");
rc = -1;
goto free_and_return;
}
} else {
- slapi_log_err(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
- "client IP address could not be resolved\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - client IP address could not be resolved\n");
rc = -1;
goto free_and_return;
}
@@ -556,18 +555,22 @@ rootdn_check_access(Slapi_PBlock *pb)
* Now we have our hostname, now do our checks
*/
if (hosts_to_deny) {
- for (i = 0; hosts_to_deny[i] != NULL; i++) {
+ for (size_t i = 0; hosts_to_deny[i] != NULL; i++) {
host = hosts_to_deny[i];
/* check for wild cards */
if (host[0] == '*') {
if (rootdn_check_host_wildcard(host, dnsName) == 0) {
/* match, return failure */
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
+ "hostname (%s) matched denied host (%s)\n", dnsName, host);
rc = -1;
goto free_and_return;
}
} else {
if (strcasecmp(host, dnsName) == 0) {
/* we have a match, return failure */
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
+ "hostname (%s) matched denied host (%s)\n", dnsName, host);
rc = -1;
goto free_and_return;
}
@@ -576,7 +579,7 @@ rootdn_check_access(Slapi_PBlock *pb)
rc = 0;
}
if (hosts) {
- for (i = 0; hosts[i] != NULL; i++) {
+ for (size_t i = 0; hosts[i] != NULL; i++) {
host = hosts[i];
/* check for wild cards */
if (host[0] == '*') {
@@ -600,14 +603,15 @@ rootdn_check_access(Slapi_PBlock *pb)
* Check the IP address restrictions, deny always overrides allow
*/
if (ips || ips_to_deny) {
- char ip_str[256];
+ char ip_str[256] = {0};
char *ip;
- int ip_len, i;
+ int32_t ip_len;
if (client_addr == NULL) {
client_addr = (PRNetAddr *)slapi_ch_malloc(sizeof(PRNetAddr));
if (slapi_pblock_get(pb, SLAPI_CONN_CLIENTNETADDR, client_addr) != 0) {
- slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - Could not get client address for IP.\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Could not get client address for IP.\n");
rc = -1;
goto free_and_return;
}
@@ -620,13 +624,15 @@ rootdn_check_access(Slapi_PBlock *pb)
v4addr.inet.family = PR_AF_INET;
v4addr.inet.ip = client_addr->ipv6.ip.pr_s6_addr32[3];
if (PR_NetAddrToString(&v4addr, ip_str, sizeof(ip_str)) != PR_SUCCESS) {
- slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - Could not get IPv4 from client address.\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Could not get IPv4 from client address.\n");
rc = -1;
goto free_and_return;
}
} else {
if (PR_NetAddrToString(client_addr, ip_str, sizeof(ip_str)) != PR_SUCCESS) {
- slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - Could not get IPv6 from client address.\n");
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM,
+ "rootdn_check_access - Could not get IPv6 from client address.\n");
rc = -1;
goto free_and_return;
}
@@ -635,18 +641,22 @@ rootdn_check_access(Slapi_PBlock *pb)
* Now we have our IP address, do our checks
*/
if (ips_to_deny) {
- for (i = 0; ips_to_deny[i] != NULL; i++) {
+ for (size_t i = 0; ips_to_deny[i] != NULL; i++) {
ip = ips_to_deny[i];
ip_len = strlen(ip);
if (ip[ip_len - 1] == '*') {
if (rootdn_check_ip_wildcard(ips_to_deny[i], ip_str) == 0) {
/* match, return failure */
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
+ "ip address (%s) matched denied IP address (%s)\n", ip_str, ip);
rc = -1;
goto free_and_return;
}
} else {
if (strcasecmp(ip_str, ip) == 0) {
/* match, return failure */
+ slapi_log_err(SLAPI_LOG_ERR, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access - "
+ "ip address (%s) matched denied IP address (%s)\n", ip_str, ip);
rc = -1;
goto free_and_return;
}
@@ -655,7 +665,7 @@ rootdn_check_access(Slapi_PBlock *pb)
rc = 0;
}
if (ips) {
- for (i = 0; ips[i] != NULL; i++) {
+ for (size_t i = 0; ips[i] != NULL; i++) {
ip = ips[i];
ip_len = strlen(ip);
if (ip[ip_len - 1] == '*') {
@@ -664,6 +674,7 @@ rootdn_check_access(Slapi_PBlock *pb)
rc = 0;
goto free_and_return;
}
+
} else {
if (strcasecmp(ip_str, ip) == 0) {
/* match, return success */
@@ -684,17 +695,19 @@ free_and_return:
return rc;
}
-static int
+static int32_t
rootdn_check_host_wildcard(char *host, char *client_host)
{
- int host_len = strlen(host);
- int client_len = strlen(client_host);
- int i, j;
+ size_t host_len = strlen(host);
+ size_t client_len = strlen(client_host);
+ size_t i, j;
+
/*
* Start at the end of the string and move backwards, and skip the first char "*"
*/
if (client_len < host_len) {
/* this can't be a match */
+
return -1;
}
for (i = host_len - 1, j = client_len - 1; i > 0; i--, j--) {
@@ -710,7 +723,7 @@ static int
rootdn_check_ip_wildcard(char *ip, char *client_ip)
{
size_t ip_len = strlen(ip);
- int i;
+
/*
* Start at the beginning of the string and move forward, and skip the last char "*"
*/
@@ -718,7 +731,7 @@ rootdn_check_ip_wildcard(char *ip, char *client_ip)
/* this can't be a match */
return -1;
}
- for (i = 0; i < ip_len - 1; i++) {
+ for (size_t i = 0; i < ip_len - 1; i++) {
if (ip[i] != client_ip[i]) {
return -1;
}
@@ -730,9 +743,7 @@ rootdn_check_ip_wildcard(char *ip, char *client_ip)
char *
strToLower(char *str)
{
- size_t i;
-
- for (i = 0; str && i < strlen(str); i++) {
+ for (size_t i = 0; str && i < strlen(str); i++) {
str[i] = tolower(str[i]);
}
return str;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 1 month
- 1
- 0
[389-ds-base] branch 389-ds-base-1.4.2 updated: Issue 50963 - We should bundle *.min.js files of Console
by pagure＠pagure.io
This is an automated email from the git hooks/post-receive script.
spichugi pushed a commit to branch 389-ds-base-1.4.2
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.4.2 by this push:
new 6e997ea Issue 50963 - We should bundle *.min.js files of Console
6e997ea is described below
commit 6e997ea66b29bcebb9c2263ba0b60945e7ed6554
Author: Simon Pichugin <spichugi(a)redhat.com>
AuthorDate: Wed Mar 18 17:31:29 2020 +0100
Issue 50963 - We should bundle *.min.js files of Console
Description: Currently, we do not bundle in the tarball the *.min.js
files which help with deciphering the obfuscated code which is actually
run by the browser. This leads to end-users submitting partially
unreadable JavaScript stack traces.
Please note this won't result in end-users having to download more data
just to use the Console, since these files are downloaded only when needed,
i.e. when Developer's Console is opened.
https://pagure.io/389-ds-base/issue/50963
Reviewed by: mreynolds (Thanks!)
---
rpm.mk | 2 --
1 file changed, 2 deletions(-)
diff --git a/rpm.mk b/rpm.mk
index 05c3533..d880559 100644
--- a/rpm.mk
+++ b/rpm.mk
@@ -54,7 +54,6 @@ install-node-modules:
build-cockpit: install-node-modules
cd src/cockpit/389-console; \
NODE_ENV=production make -f node_modules.mk build-cockpit-plugin
- cd src/cockpit/389-console; rm -rf cockpit_dist/index.min.js.map
dist-bz2: install-node-modules download-cargo-dependencies
cd src/cockpit/389-console; \
@@ -64,7 +63,6 @@ dist-bz2: install-node-modules download-cargo-dependencies
touch cockpit_dist/*
mkdir -p $(NODE_MODULES_TEST)
touch -r src/cockpit/389-console/package.json $(NODE_MODULES_TEST)
- cd src/cockpit/389-console; rm -rf cockpit_dist/index.min.js.map
tar cjf $(GIT_TAG).tar.bz2 --transform "s,^,$(GIT_TAG)/," $$(git ls-files) src/cockpit/389-console/cockpit_dist/ src/cockpit/389-console/node_modules
cd src/cockpit/389-console; \
rm -rf node_modules; \
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 1 month
- 1
- 0
[389-ds-base] branch 389-ds-base-1.4.1 updated: Issue 50963 - We should bundle *.min.js files of Console
by pagure＠pagure.io
This is an automated email from the git hooks/post-receive script.
spichugi pushed a commit to branch 389-ds-base-1.4.1
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.4.1 by this push:
new 31be5e4 Issue 50963 - We should bundle *.min.js files of Console
31be5e4 is described below
commit 31be5e425cd76b53b44d0e4aa1f1a17ea37e89c6
Author: Simon Pichugin <spichugi(a)redhat.com>
AuthorDate: Wed Mar 18 17:31:29 2020 +0100
Issue 50963 - We should bundle *.min.js files of Console
Description: Currently, we do not bundle in the tarball the *.min.js
files which help with deciphering the obfuscated code which is actually
run by the browser. This leads to end-users submitting partially
unreadable JavaScript stack traces.
Please note this won't result in end-users having to download more data
just to use the Console, since these files are downloaded only when needed,
i.e. when Developer's Console is opened.
https://pagure.io/389-ds-base/issue/50963
Reviewed by: mreynolds (Thanks!)
---
rpm.mk | 2 --
1 file changed, 2 deletions(-)
diff --git a/rpm.mk b/rpm.mk
index 9ae9164..90509a2 100644
--- a/rpm.mk
+++ b/rpm.mk
@@ -39,7 +39,6 @@ install-node-modules:
build-cockpit: install-node-modules
cd src/cockpit/389-console; \
NODE_ENV=production make -f node_modules.mk build-cockpit-plugin
- cd src/cockpit/389-console; rm -rf cockpit_dist/index.min.js.map
dist-bz2: install-node-modules
cd src/cockpit/389-console; \
@@ -49,7 +48,6 @@ dist-bz2: install-node-modules
touch cockpit_dist/*
mkdir -p $(NODE_MODULES_TEST)
touch -r src/cockpit/389-console/package.json $(NODE_MODULES_TEST)
- cd src/cockpit/389-console; rm -rf cockpit_dist/index.min.js.map
tar cjf $(GIT_TAG).tar.bz2 --transform "s,^,$(GIT_TAG)/," $$(git ls-files) src/cockpit/389-console/cockpit_dist/ src/cockpit/389-console/node_modules
cd src/cockpit/389-console; \
rm -rf node_modules; \
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 1 month
- 1
- 0