11:51 a.m.
Author: rmeggins
Update of /cvs/dirsec/adminserver/lib/libdsa
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv5290/adminserver/lib/libdsa
Modified Files:
dsalib_conf.c dsalib_db.c dsalib_util.c
Removed Files:
dsalib_dn.c dsalib_filename.c dsalib_ldif.c dsalib_pw.c
Log Message:
Resolves: bug 186280
Bug Description: Close potential security vulnerabilities in CGI code
Reviewed by: nhosoi (Thanks!)
Fix Description: This is for the CGIs moved into adminserver from ds. There is quite a
bit of code here that we don't use anymore. We can also get rid of Import.java and
Export.java in the ds console code. This addresses the security issues because, even
though the console doesn't ever call the tasks that invoke the CGIs for db2ldif,
ldif2db, etc. a malicious user could still attempt to invoke a task remotely and pass in
bogus file and directory names.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none
Index: dsalib_conf.c
===================================================================
RCS file: /cvs/dirsec/adminserver/lib/libdsa/dsalib_conf.c,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- dsalib_conf.c 31 Aug 2007 17:01:38 -0000 1.5
+++ dsalib_conf.c 14 Nov 2007 17:51:56 -0000 1.6
@@ -139,94 +139,3 @@
}
return NULL;
}
-
-static size_t
-count_quotes (const char* s)
-{
- size_t count = 0;
- const char* t = s;
- if (t) while ((t = strpbrk (t, "\"\\")) != NULL) {
- ++count;
- ++t;
- }
- return count;
-}
-
-DS_EXPORT_SYMBOL char*
-ds_enquote_config_value (int paramnum, char* s)
-{
- char* result;
- char* brkcharset = "\"\\ \t\r\n";
- char *encoded_quote = "22"; /* replace quote with \22 */
- int encoded_quote_len = strlen(encoded_quote);
- char *begin = s;
- if (*s && ! strpbrk (s, brkcharset) &&
- ! (paramnum == DS_AUDITFILE || paramnum == DS_ACCESSLOG ||
-#if defined( XP_WIN32 )
- paramnum == DS_SUFFIX ||
-#endif
- paramnum == DS_ERRORLOG)) {
- result = s;
- } else {
- char* t = malloc (strlen (s) + count_quotes (s) + 3);
- result = t;
- *t++ = '"';
- while (*s) {
- switch (*s) {
-
- case '"':
- /* convert escaped quotes by replacing the quote with
- escape code e.g. 22 so that \" is converted to \22 "*/
- if ((s > begin) && (*(s - 1) == '\\'))
- {
- strcpy(t, encoded_quote);
- t += encoded_quote_len;
- }
- else /* unescaped ", just replace with \22 "*/
- {
- *t++ = '\\';
- strcpy(t, encoded_quote);
- t += encoded_quote_len;
- }
- ++s;
- break;
-
- default:
- *t++ = *s++; /* just copy it */
- break;
- }
- }
- *t++ = '"';
- *t = '\0';
- }
- return result;
-}
-
-DS_EXPORT_SYMBOL char*
-ds_DNS_to_DN (char* DNS)
-{
- static const char* const RDN = "dc=";
- char* DN;
- char* dot;
- size_t components;
- if (DNS == NULL || *DNS == '\0') {
- return strdup ("");
- }
- components = 1;
- for (dot = strchr (DNS, '.'); dot != NULL; dot = strchr (dot + 1,
'.')) {
- ++components;
- }
- DN = malloc (strlen (DNS) + (components * strlen(RDN)) + 1);
- strcpy (DN, RDN);
- for (dot = strchr (DNS, '.'); dot != NULL; dot = strchr (dot + 1,
'.')) {
- *dot = '\0';
- strcat (DN, DNS);
- strcat (DN, ",");
- strcat (DN, RDN);
- DNS = dot + 1;
- *dot = '.';
- }
- strcat (DN, DNS);
- dn_normalize (DN);
- return DN;
-}
Index: dsalib_db.c
===================================================================
RCS file: /cvs/dirsec/adminserver/lib/libdsa/dsalib_db.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- dsalib_db.c 24 Jul 2007 20:10:18 -0000 1.4
+++ dsalib_db.c 14 Nov 2007 17:51:56 -0000 1.5
@@ -80,308 +80,3 @@
return(bak_dirs);
}
-
-/*
- * Restore a database based on a backup directory name.
- * 0: success
- * anything else: failure
- */
-DS_EXPORT_SYMBOL int
-ds_bak2db(char *file)
-{
- char startup_line[BIG_LINE];
- char statfile[PATH_MAX];
- char *tmp_dir;
- char *instdir;
- int haderror = 0;
- int error = -1;
- int status;
- FILE *sf = NULL;
- struct stat fstats;
-
- if ( file == NULL ) {
- return DS_NULL_PARAMETER;
- }
- status = ds_get_updown_status();
- if ( status == DS_SERVER_UP ) {
- return DS_SERVER_MUST_BE_DOWN;
- }
- if ( (instdir = ds_get_instance_dir()) == NULL ) {
- return DS_NO_INSTANCE_DIR;
- }
-
- if ( file[strlen(file) - 1] == '\n' ) /* strip out returns */
- file[strlen(file) - 1] = '\0';
-
- if( stat( file, &fstats ) == -1 && errno == ENOENT ) {
- return DS_CANNOT_OPEN_BACKUP_FILE;
- } else if( !(fstats.st_mode & S_IFDIR) ) {
- return DS_NOT_A_DIRECTORY;
- }
-
- tmp_dir = ds_get_tmp_dir();
- PR_snprintf(statfile, PATH_MAX, "%s%cbak2db.%d", tmp_dir, FILE_SEP,
(int)getpid());
- PR_snprintf(startup_line, BIG_LINE,
- "%s%cbak2db "
- "%s%s%s > "
- "%s%s%s 2>&1",
- instdir, FILE_SEP,
- ENQUOTE, file, ENQUOTE,
- ENQUOTE, statfile, ENQUOTE );
- alter_startup_line(startup_line);
- fflush(0);
- error = system(startup_line);
- fflush(0);
- if ( error == -1 ) {
- return DS_CANNOT_EXEC;
- }
- fflush(0);
- if( !(sf = fopen(statfile, "r")) ) {
- return DS_CANNOT_OPEN_STAT_FILE;
- }
-
- while ( fgets(startup_line, BIG_LINE, sf) ) {
- if ((strstr(startup_line, "- Restoring file")) ||
- (strstr(startup_line, "- Checkpointing"))) {
- ds_show_message(startup_line);
- } else {
- haderror = 1;
- ds_send_error(startup_line, 0);
- }
- }
-
- fclose(sf);
- unlink(statfile);
-
- if ( haderror )
- return DS_UNKNOWN_ERROR;
- return 0;
-}
-
-/*
- * Create a backup based on a file name.
- * 0: success
- * anything else: failure
- */
-DS_EXPORT_SYMBOL int
-ds_db2bak(char *file)
-{
- char startup_line[BIG_LINE];
- char statfile[PATH_MAX];
- char *tmp_dir;
- char *instdir;
- int haderror = 0;
- int error = -1;
- FILE *sf = NULL;
- int lite = 0;
-#ifdef XP_WIN32
- time_t ltime;
-#endif
-
- if ( (instdir = ds_get_instance_dir()) == NULL ) {
- return DS_NO_INSTANCE_DIR;
- }
-
- if ( (file == NULL) || (strlen(file) == 0) )
- file = NULL;
-
- tmp_dir = ds_get_tmp_dir();
- PR_snprintf(statfile, PATH_MAX, "%s%cdb2bak.%d", tmp_dir, FILE_SEP,
(int)getpid());
-
-
-#if defined( XP_WIN32 )
- if( file == NULL )
- {
- file = malloc( BIG_LINE );
-
- time( <ime );
- PR_snprintf( file, BIG_LINE, "%s", ctime( <ime ) );
- ds_timetofname( file );
- }
-
- /* Check if the directory exists or can be created */
- if ( !ds_file_exists( file ) ) {
- char *errmsg = ds_mkdir_p( file, NEWDIR_MODE );
- if( errmsg != NULL ) {
-/* ds_send_error(errmsg, 10);
- */
- return DS_CANNOT_CREATE_DIRECTORY;
- }
- }
-#endif
-
-/* DBDB: note on the following line.
- * Originally this had quotes round the directory name.
- * I found that this made the script not work becuase
- * a path of the form "foo"/bar/"baz" was passed to slapd.
- * the c runtime didn't like this. Perhaps there's a simple
- * solution, but for now I've modified this line here to
- * not quote the directory name. This means that backup
- * directories can't have spaces in them.
- */
-
-
- PR_snprintf(startup_line, sizeof(startup_line),
- "%s%cdb2bak "
- "%s%s%s > "
- "%s%s%s 2>&1",
- instdir, FILE_SEP,
- ENQUOTE,
- (file == NULL) ? "" : file,
- ENQUOTE,
- ENQUOTE, statfile, ENQUOTE);
-
- PATH_FOR_PLATFORM( startup_line );
- alter_startup_line(startup_line);
- fflush(0);
- error = system(startup_line);
- if ( error == -1 ) {
- return DS_CANNOT_EXEC;
- }
- if( !(sf = fopen(statfile, "r")) ) {
- return DS_CANNOT_OPEN_STAT_FILE;
- }
-
- while ( fgets(startup_line, BIG_LINE, sf) ) {
- if (strstr(startup_line, " - Backing up file") ||
- strstr(startup_line, " - Checkpointing database")) {
- ds_show_message(startup_line);
- } else {
- haderror = 1;
- if (strstr ( startup_line, "restricted mode")) {
- lite = 1;
- }
- ds_send_error(startup_line, 0);
- }
- }
- fclose(sf);
- unlink(statfile);
-
- if ( lite && haderror )
- return DS_HAS_TOBE_READONLY_MODE;
-
- if ( haderror )
- return DS_UNKNOWN_ERROR;
- return 0;
-}
-
-static void
-process_and_report( char *line, int line_size, FILE *cmd )
-{
- while(fgets(line, line_size, cmd)) {
- /* Strip off line feeds */
- int ind = strlen( line ) - 1;
- while ( (ind >= 0) &&
- ((line[ind] == '\n') ||
- (line[ind] == '\r')) ) {
- line[ind] = 0;
- ind--;
- }
- if ( ind < 1 ) {
- continue;
- }
- ds_send_status(line);
- }
-}
-
-static int exec_and_report( char *startup_line )
-{
- FILE *cmd = NULL;
- char line[BIG_LINE];
- int haderror = 0;
-
- PATH_FOR_PLATFORM( startup_line );
- alter_startup_line(startup_line);
-
- /*
- fprintf( stdout, "Launching <%s>\n", startup_line );
- */
-
- fflush(0);
- cmd = popen(startup_line, "r");
- if(!cmd) {
- return DS_CANNOT_EXEC;
- }
- process_and_report( line, sizeof(line), cmd );
- pclose(cmd);
-
- /*
- ** The VLV indexing code prints OK,
- ** if the index was successfully created.
- */
- if (strcmp(line,"OK")==0) {
- haderror = 0;
- } else {
- haderror = DS_UNKNOWN_ERROR;
- }
-
- return haderror;
-}
-
-/*
- * Create a vlv index
- * 0: success
- * anything else: failure
- */
-DS_EXPORT_SYMBOL int
-ds_vlvindex(char **backendList, char **vlvList)
-{
- char startup_line[BIG_LINE];
- char *instdir;
- char **vlvc = NULL;
-
-
- instdir = ds_get_instance_dir();
- if ( instdir == NULL ) {
- return DS_NO_INSTANCE_DIR;
- }
-
- PR_snprintf(startup_line, sizeof(startup_line), "%s/%s db2index "
- "-D %s%s/%s "
- "-n %s ",
- CMDBINDIR, SLAPD_NAME,
- ENQUOTE, instdir, ENQUOTE,
- backendList[0]);
-
-
- /* Create vlv TAG */
- vlvc=vlvList;
- while( *vlvc != NULL ) {
- PR_snprintf( startup_line, sizeof(startup_line), "%s -T %s%s%s",
startup_line,"\"",*vlvc,"\"" );
- vlvc++;
- }
-
- return exec_and_report( startup_line );
-}
-
-/*
- * Create one or more indexes
- * 0: success
- * anything else: failure
- */
-DS_EXPORT_SYMBOL int
-ds_addindex(char **attrList, char *backendName)
-{
- char startup_line[BIG_LINE];
- char *instdir;
-
- instdir = ds_get_instance_dir();
-
- if ( instdir == NULL ) {
- return DS_NO_INSTANCE_DIR;
- }
-
- PR_snprintf(startup_line, sizeof(startup_line), "%s/%s db2index "
- "-D %s%s%s "
- "-n %s",
- CMDBINDIR, SLAPD_NAME,
- ENQUOTE, instdir, ENQUOTE,
- backendName);
-
- while( *attrList != NULL ) {
- PR_snprintf( startup_line, sizeof(startup_line), "%s -t %s",
startup_line, *attrList );
- attrList++;
- }
-
- return exec_and_report( startup_line );
-}
Index: dsalib_util.c
===================================================================
RCS file: /cvs/dirsec/adminserver/lib/libdsa/dsalib_util.c,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- dsalib_util.c 31 Aug 2007 17:01:38 -0000 1.3
+++ dsalib_util.c 14 Nov 2007 17:51:56 -0000 1.4
@@ -81,51 +81,6 @@
return 0;
}
-DS_EXPORT_SYMBOL int
-ds_mkdir(char *dir, int mode)
-{
- if(!ds_file_exists(dir)) {
-#ifdef XP_UNIX
- if(mkdir(dir, mode) == -1)
-#else /* XP_WIN32 */
- if(!CreateDirectory(dir, NULL))
-#endif /* XP_WIN32 */
- return -1;
- }
- return 0;
-}
-
-
-DS_EXPORT_SYMBOL char *
-ds_mkdir_p(char *dir, int mode)
-{
- static char errmsg[ERR_SIZE];
- struct stat fi;
- char *t;
-
-#ifdef XP_UNIX
- t = dir + 1;
-#else /* XP_WIN32 */
- t = dir + 3;
-#endif /* XP_WIN32 */
-
- while(1) {
- t = strchr(t, FILE_PATHSEP);
-
- if(t) *t = '\0';
- if(stat(dir, &fi) == -1) {
- if(ds_mkdir(dir, mode) == -1) {
- PR_snprintf(errmsg, sizeof(errmsg), "mkdir %s failed (%s)",
dir, ds_system_errmsg());
- return errmsg;
- }
- }
- if(t) *t++ = FILE_PATHSEP;
- else break;
- }
- return NULL;
-}
-
-
/*
* Given the name of a directory, return a NULL-terminated array of
* the file names contained in that directory. Returns NULL if the directory
@@ -210,100 +165,6 @@
}
#endif /* ( XP_WIN32 ) */
-
-DS_EXPORT_SYMBOL time_t
-ds_get_mtime(char *filename)
-{
- struct stat fi;
-
- if ( stat(filename, &fi) )
- return 0;
- return fi.st_mtime;
-}
-
-/*
- * Copy files: return is
- * 1: success
- * 0: failure
- * Print errors as needed.
- */
-DS_EXPORT_SYMBOL int
-ds_cp_file(char *sfile, char *dfile, int mode)
-{
-#if defined( XP_WIN32 )
- return( CopyFile( sfile, dfile, FALSE ) ); /* Copy even if dfile exists */
-#else
- int sfd, dfd, len;
- struct stat fi;
- char copy_buffer[COPY_BUFFER_SIZE];
- unsigned long read_len;
- char error[BIG_LINE];
-
-/* Make sure we're in the right umask */
- umask(022);
-
- if( (sfd = open(sfile, O_RDONLY)) == -1) {
- PR_snprintf(error, sizeof(error), "Can't open file %s for
reading.", sfile);
- ds_send_error(error, 1);
- return(0);
- }
-
- fstat(sfd, &fi);
- if (!(S_ISREG(fi.st_mode))) {
- PR_snprintf(error, sizeof(error), "File %s is not a regular file.",
sfile);
- ds_send_error(error, 1);
- close(sfd);
- return(0);
- }
- len = fi.st_size;
-
- if( (dfd = open(dfile, O_RDWR | O_CREAT | O_TRUNC, mode)) == -1) {
- PR_snprintf(error, sizeof(error), "can't write to file %s",
dfile);
- ds_send_error(error, 1);
- close(sfd);
- return(0);
- }
- while (len) {
- read_len = len>COPY_BUFFER_SIZE?COPY_BUFFER_SIZE:len;
-
- if ( (read_len = read(sfd, copy_buffer, read_len)) == -1) {
- PR_snprintf(error, sizeof(error), "Error reading file %s for
copy.", sfile);
- ds_send_error(error, 1);
- close(sfd);
- close(dfd);
- return(0);
- }
-
- if ( write(dfd, copy_buffer, read_len) != read_len) {
- PR_snprintf(error, sizeof(error), "Error writing file %s for
copy.", dfile);
- ds_send_error(error, 1);
- close(sfd);
- close(dfd);
- return(0);
- }
-
- len -= read_len;
- }
- close(sfd);
- close(dfd);
- return(1);
-#endif
-}
-
-DS_EXPORT_SYMBOL void
-ds_unixtodospath(char *szText)
-{
- if(szText)
- {
- while(*szText)
- {
- if( *szText == '/' )
- *szText = '\\';
- szText++;
- }
- }
-}
-
/* converts '\' chars to '/' */
DS_EXPORT_SYMBOL void
ds_dostounixpath(char *szText)
@@ -319,134 +180,6 @@
}
}
-/* converts ':' chars to ' ' */
-DS_EXPORT_SYMBOL void
-ds_timetofname(char *szText)
-{
- if(szText)
- {
- /* Replace trailing newline */
- szText[ strlen( szText ) -1 ] = 0;
- while(*szText)
- {
- if( *szText == ':' ||
- *szText == ' ' )
- *szText = '_';
- szText++;
- }
- }
-}
-
-/* Effects a rename in 2 steps, needed on NT because if the
-target of a rename() already exists, the rename() will fail. */
-DS_EXPORT_SYMBOL int
-ds_saferename(char *szSrc, char *szTarget)
-{
-#ifdef XP_WIN32
- int iRetVal;
- char *szTmpFile;
- struct stat buf;
-#endif
-
- if( !szSrc || !szTarget )
- return 1;
-
-#if defined( XP_WIN32 )
-
- szTmpFile = mktemp("slrnXXXXXX" );
- if( stat( szTarget, &buf ) == 0 )
- {
- /* Target file exists */
- if( !szTmpFile )
- return 1;
-
- if( !ds_cp_file( szTarget, szTmpFile, 0644) )
- return( 1 );
-
- unlink( szTarget );
- if( (iRetVal = rename( szSrc, szTarget )) != 0 )
- {
- /* Failed to rename, copy back. */
- ds_cp_file( szTmpFile, szTarget, 0644);
- }
- /* Now remove temp file */
- unlink( szTmpFile );
- }
- else
- iRetVal = rename(szSrc, szTarget);
-
- return iRetVal;
-#else
- return rename(szSrc, szTarget);
-#endif
-
-}
-
-DS_EXPORT_SYMBOL char*
-ds_encode_all (const char* s)
-{
- char* r;
- size_t l;
- size_t i;
- if (s == NULL || *s == '\0') {
- return strdup ("");
- }
- l = strlen (s);
- r = malloc (l * 3 + 1);
- for (i = 0; *s != '\0'; ++s) {
- r[i++] = '%';
- sprintf (r + i, "%.2X", 0xFF & (unsigned int)*s);
- i += 2;
- }
- r[i] = '\0';
- return r;
-}
-
-DS_EXPORT_SYMBOL char*
-ds_URL_encode (const char* s)
-{
- char* r;
- size_t l;
- size_t i;
- if (s == NULL || *s == '\0') {
- return strdup ("");
- }
- l = strlen (s) + 1;
- r = malloc (l);
- for (i = 0; *s != '\0'; ++s) {
- if (*s >= 0x20 && *s <= 0x7E && strchr ("
<>\"#%{}[]|\\^~`?,;=+\n", *s) == NULL) {
- if (l - i <= 1) r = realloc (r, l *= 2);
- r[i++] = *s;
- } else { /* encode *s */
- if (l - i <= 3) r = realloc (r, l *= 2);
- r[i++] = '%';
- sprintf (r + i, "%.2X", 0xFF & (unsigned int)*s);
- i += 2;
- }
- }
- r[i] = '\0';
- return r;
-}
-
-DS_EXPORT_SYMBOL char*
-ds_URL_decode (const char* original)
-{
- char* r = strdup (original);
- char* s;
- for (s = r; *s != '\0'; ++s) {
- if (*s == '+') {
- *s = ' ';
- }
- else if (*s == '%' && isxdigit(s[1]) && isxdigit(s[2])) {
- memmove (s, s+1, 2);
- s[2] = '\0';
- *s = (char)strtoul (s, NULL, 16);
- memmove (s+1, s+3, strlen (s+3) + 1);
- }
- }
- return r;
-}
-
#if !defined( XP_WIN32 )
#include <errno.h> /* errno */
#include <pwd.h> /* getpwnam */
@@ -547,26 +280,6 @@
#endif
}
-/*
- * When a path containing a long filename is passed to system(), the call
- * fails. Therfore, we need to use the short version of the path, when
- * constructing the path to pass to system().
- */
-DS_EXPORT_SYMBOL char*
-ds_makeshort( char * filepath )
-{
-#if defined( XP_WIN32 )
- char *shortpath = malloc( MAX_PATH );
- DWORD dwStatus;
- if( shortpath )
- {
- dwStatus = GetShortPathName( filepath, shortpath, MAX_PATH );
- return( shortpath );
- }
-#endif
- return filepath;
-}
-
/* returns 1 if string "searchstring" found in file "filename" */
/* if found, returnstring is allocated and filled with the line */
/* caller should release the memory */
@@ -711,46 +424,6 @@
return;
}
-DS_EXPORT_SYMBOL void
-ds_show_key_value(char *key, char *value)
-{
- FILE *logfp;
- printf("%s%s%s\n", key, SEPARATOR, value);
-
- if ((logfp = get_logfp())) {
- fprintf(logfp, "%s%s%s\n", key, SEPARATOR, value);
- fclose(logfp);
- }
- return;
-}
-
-/* Stolen from the Admin Server dsgw_escape_for_shell */
-DS_EXPORT_SYMBOL char *
-ds_escape_for_shell( char *s )
-{
- char *escaped;
- char tmpbuf[4];
- size_t x,l;
-
- if ( s == NULL ) {
- return( s );
- }
-
- l = 3 * strlen( s ) + 1;
- escaped = malloc( l );
- memset( escaped, 0, l );
- for ( x = 0; s[x]; x++ ) {
- if (( (unsigned char)s[x] & 0x80 ) == 0 ) {
- strncat( escaped, &s[x], 1 );
- } else {
- /* not an ASCII character - escape it */
- sprintf( tmpbuf, "\\%x", (unsigned)(((unsigned char)(s[x])) &
0xff) );
- strcat( escaped, tmpbuf );
- }
- }
- return( escaped );
-}
-
DS_EXPORT_SYMBOL char *
ds_system_errmsg(void)
{
--- dsalib_dn.c DELETED ---
--- dsalib_filename.c DELETED ---
--- dsalib_ldif.c DELETED ---
--- dsalib_pw.c DELETED ---