From 7433e986363c0cad76d948a456ae6a0d9d36251e Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Wed, 16 Jun 2010 14:01:05 -0400
Subject: [PATCH] Do not throw NoOptionError or NoSuchProviderError in get_domain()

We will now eliminate any unknown options and providers to
guarantee that the domain is safe for use.
---
 src/config/SSSDConfig.py               |   27 +++++++++++++++++++++------
 src/config/SSSDConfigTest.py           |   24 ++++++++++++++++++++++--
 src/config/testconfigs/sssd-valid.conf |   16 ++++++++++++++++
 3 files changed, 59 insertions(+), 8 deletions(-)

diff --git a/src/config/SSSDConfig.py b/src/config/SSSDConfig.py
index 29de609a6bc2ba0db9df50bda5524ee08f229abb..6f4fee0de1e86506d3623740d0b66ba7ca05f29c 100644
--- a/src/config/SSSDConfig.py
+++ b/src/config/SSSDConfig.py
@@ -944,7 +944,10 @@ class SSSDDomain(SSSDConfigObject):
         is_provider = option.rfind('_provider')
         if (is_provider > 0):
             provider = option[:is_provider]
-            self.add_provider(value, provider)
+            try:
+                self.add_provider(value, provider)
+            except NoSuchProviderError:
+                raise NoOptionError
         else:
             self.options[option] = value
 
@@ -1448,12 +1451,24 @@ class SSSDConfig(SSSDChangeConf):
         # errors trying to read in their options
         providers = [ (x['name'],x['value']) for x in self.strip_comments_empty(self.options('domain/%s' % name))
                      if x['name'].rfind('_provider') > 0]
-        [domain.set_option(option, value)
-         for (option, value) in providers]
 
-        [domain.set_option(opt['name'], opt['value'])
-         for opt in self.strip_comments_empty(self.options('domain/%s' % name))
-         if (opt['name'], opt['value']) not in providers]
+        for (option, value) in providers:
+            try:
+                domain.set_option(option, value)
+            except NoOptionError:
+                # If we come across an option that we don't recognize,
+                # we should just ignore it and continue
+                pass
+
+        # Read in all the options from the configuration
+        for opt in self.strip_comments_empty(self.options('domain/%s' % name)):
+            if (opt['name'], opt['value']) not in providers:
+                try:
+                    domain.set_option(opt['name'], opt['value'])
+                except NoOptionError:
+                    # If we come across an option that we don't recognize,
+                    # we should just ignore it and continue
+                    pass
 
         # Determine if this domain is currently active
         domain.active = self.is_domain_active(name)
diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py
index 04d438e0681a594daa6fc7594fd6c76a806437d3..81a868138130b91f2855c8940d4f6bd4355dc81a 100755
--- a/src/config/SSSDConfigTest.py
+++ b/src/config/SSSDConfigTest.py
@@ -1056,6 +1056,8 @@ class SSSDConfigTestSSSDConfig(unittest.TestCase):
             'domain/IPA',
             'domain/LOCAL',
             'domain/LDAP',
+            'domain/INVALIDPROVIDER',
+            'domain/INVALIDOPTION',
             ]
 
         for section in control_list:
@@ -1278,7 +1280,10 @@ class SSSDConfigTestSSSDConfig(unittest.TestCase):
 
         control_list = [
             'PROXY',
-            'LDAP']
+            'LDAP',
+            'INVALIDPROVIDER',
+            'INVALIDOPTION',
+            ]
         inactive_domains = sssdconfig.list_inactive_domains()
 
         for domain in control_list:
@@ -1304,7 +1309,10 @@ class SSSDConfigTestSSSDConfig(unittest.TestCase):
             'IPA',
             'LOCAL',
             'PROXY',
-            'LDAP']
+            'LDAP',
+            'INVALIDPROVIDER',
+            'INVALIDOPTION',
+            ]
         domains = sssdconfig.list_domains()
 
         for domain in control_list:
@@ -1339,6 +1347,18 @@ class SSSDConfigTestSSSDConfig(unittest.TestCase):
         # Negative Test - No such domain
         self.assertRaises(SSSDConfig.NoDomainError, sssdconfig.get_domain, 'nosuchdomain')
 
+        # Positive Test - Domain with unknown provider
+        # Expected result: Domain is imported, but does not contain the
+        # unknown provider entry
+        domain = sssdconfig.get_domain('INVALIDPROVIDER')
+        self.assertFalse(domain.options.has_key('chpass_provider'))
+
+        # Positive Test - Domain with unknown option
+        # Expected result: Domain is imported, but does not contain the
+        # unknown option entry
+        domain = sssdconfig.get_domain('INVALIDOPTION')
+        self.assertFalse(domain.options.has_key('nosuchoption'))
+
     def testNewDomain(self):
         sssdconfig = SSSDConfig.SSSDConfig(srcdir + "/etc/sssd.api.conf",
                                            srcdir + "/etc/sssd.api.d")
diff --git a/src/config/testconfigs/sssd-valid.conf b/src/config/testconfigs/sssd-valid.conf
index 3c2dda80c135a6a4b7dcbbbf9e96ad9927fdc4cc..69cc9d115e4da78be21f45d849dba4ad23c98457 100644
--- a/src/config/testconfigs/sssd-valid.conf
+++ b/src/config/testconfigs/sssd-valid.conf
@@ -36,6 +36,22 @@ id_provider  =    ldap
 auth_provider=ldap
 debug_level = 0
 
+# Domain containing an invalid provider
+[domain/INVALIDPROVIDER]
+ldap_id_use_start_tls = true
+id_provider  =    ldap
+auth_provider=ldap
+debug_level = 0
+chpass_provider = chpass
+
+# Domain containing an invalid option
+[domain/INVALIDOPTION]
+ldap_id_use_start_tls = true
+id_provider  =    ldap
+auth_provider=ldap
+debug_level = 0
+nosuchoption = True
+
 [pam]
 debug_level = 0
 
-- 
1.7.0.1

