mir/sudo
2
0
Fork 0
mirror of https://github.com/sudo-project/sudo.git synced 2025-09-01 06:45:10 +00:00
Code Issues Releases Wiki Activity

Ignore SIGPIPE when connecting to the LDAP server so we can get a

Browse Source 
proper error message with the IBM LDAP libs.  Also return LDAP_SUCCESS
instead of 0 from most sudo_ldap_* functions that return an int.
This commit is contained in:
Todd C. Miller
2013-10-23 11:15:24 -06:00
parent 340fc0a583
commit 994879c044
1 changed files with 49 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

77
plugins/sudoers/ldap.c
View File

@@ -46,6 +46,7 @@
#include <fcntl.h> #include <fcntl.h>
#include <pwd.h> #include <pwd.h>
#include <grp.h> #include <grp.h>
#include <signal.h>
#include <netinet/in.h> #include <netinet/in.h>
#include <arpa/inet.h> #include <arpa/inet.h>
#ifdef HAVE_LBER_H #ifdef HAVE_LBER_H
@@ -433,6 +434,7 @@ toobig:
* For each uri, convert to host:port pairs. For ldaps:// enable SSL * For each uri, convert to host:port pairs. For ldaps:// enable SSL
* Accepts: uris of the form ldap:/// or ldap://hostname:portnum/ * Accepts: uris of the form ldap:/// or ldap://hostname:portnum/
* where the trailing slash is optional. * where the trailing slash is optional.
* Returns LDAP_SUCCESS on success, else non-zero.
*/ */
static int static int
sudo_ldap_parse_uri(const struct ldap_config_str_list *uri_list) sudo_ldap_parse_uri(const struct ldap_config_str_list *uri_list)
@@ -503,7 +505,7 @@ sudo_ldap_parse_uri(const struct ldap_config_str_list *uri_list)
efree(ldap_conf.host); efree(ldap_conf.host);
ldap_conf.host = estrdup(hostbuf); ldap_conf.host = estrdup(hostbuf);
rc = 0; rc = LDAP_SUCCESS;
done: done:
efree(buf); efree(buf);
@@ -540,10 +542,15 @@ sudo_ldap_join_uri(struct ldap_config_str_list *uri_list)
} }
#endif /* HAVE_LDAP_INITIALIZE */ #endif /* HAVE_LDAP_INITIALIZE */
/*
* Wrapper for ldap_create() or ldap_init() that handles
* SSL/TLS initialization as well.
* Returns LDAP_SUCCESS on success, else non-zero.
*/
static int static int
sudo_ldap_init(LDAP **ldp, const char *host, int port) sudo_ldap_init(LDAP **ldp, const char *host, int port)
{ {
LDAP *ld = NULL; LDAP *ld;
int rc = LDAP_CONNECT_ERROR; int rc = LDAP_CONNECT_ERROR;
debug_decl(sudo_ldap_init, SUDO_DEBUG_LDAP) debug_decl(sudo_ldap_init, SUDO_DEBUG_LDAP)
@@ -605,7 +612,7 @@ sudo_ldap_init(LDAP **ldp, const char *host, int port)
if (rc != LDAP_SUCCESS) { if (rc != LDAP_SUCCESS) {
warningx("ldap_ssl_client_init(): %s (SSL reason code %d)", warningx("ldap_ssl_client_init(): %s (SSL reason code %d)",
ldap_err2string(rc), sslrc); ldap_err2string(rc), sslrc);
debug_return_int(-1); goto done;
} }
DPRINTF2("ldap_ssl_init(%s, %d, NULL)", host, port); DPRINTF2("ldap_ssl_init(%s, %d, NULL)", host, port);
if ((ld = ldap_ssl_init((char *)host, port, NULL)) != NULL) if ((ld = ldap_ssl_init((char *)host, port, NULL)) != NULL)
@@ -627,8 +634,8 @@ sudo_ldap_init(LDAP **ldp, const char *host, int port)
#endif #endif
} }
done:
*ldp = ld; *ldp = ld;
done:
debug_return_int(rc); debug_return_int(rc);
} }
@@ -1653,7 +1660,7 @@ sudo_ldap_read_config(void)
if (!STAILQ_EMPTY(&ldap_conf.uri)) { if (!STAILQ_EMPTY(&ldap_conf.uri)) {
struct ldap_config_str *uri; struct ldap_config_str *uri;
if (sudo_ldap_parse_uri(&ldap_conf.uri) != 0) if (sudo_ldap_parse_uri(&ldap_conf.uri) != LDAP_SUCCESS)
debug_return_bool(false); debug_return_bool(false);
while ((uri = STAILQ_FIRST(&ldap_conf.uri)) != NULL) { while ((uri = STAILQ_FIRST(&ldap_conf.uri)) != NULL) {
STAILQ_REMOVE_HEAD(&ldap_conf.uri, entries); STAILQ_REMOVE_HEAD(&ldap_conf.uri, entries);
@@ -2166,6 +2173,7 @@ sudo_ldap_sasl_interact(LDAP *ld, unsigned int flags, void *_auth_id,
/* /*
* Set LDAP options from the specified options table * Set LDAP options from the specified options table
* Returns LDAP_SUCCESS on success, else non-zero.
*/ */
static int static int
sudo_ldap_set_options_table(LDAP *ld, struct ldap_config_table *table) sudo_ldap_set_options_table(LDAP *ld, struct ldap_config_table *table)
@@ -2207,11 +2215,12 @@ sudo_ldap_set_options_table(LDAP *ld, struct ldap_config_table *table)
break; break;
} }
} }
debug_return_int(errors ? -1 : 0); debug_return_int(errors ? -1 : LDAP_SUCCESS);
} }
/* /*
* Set LDAP options based on the global config table. * Set LDAP options based on the global config table.
* Returns LDAP_SUCCESS on success, else non-zero.
*/ */
static int static int
sudo_ldap_set_options_global(void) sudo_ldap_set_options_global(void)
@@ -2227,13 +2236,12 @@ sudo_ldap_set_options_global(void)
/* Parse global LDAP options table. */ /* Parse global LDAP options table. */
rc = sudo_ldap_set_options_table(NULL, ldap_conf_global); rc = sudo_ldap_set_options_table(NULL, ldap_conf_global);
if (rc == -1) debug_return_int(rc);
debug_return_int(-1);
debug_return_int(0);
} }
/* /*
* Set LDAP options based on the per-connection config table. * Set LDAP options based on the per-connection config table.
* Returns LDAP_SUCCESS on success, else non-zero.
*/ */
static int static int
sudo_ldap_set_options_conn(LDAP *ld) sudo_ldap_set_options_conn(LDAP *ld)
@@ -2291,7 +2299,7 @@ sudo_ldap_set_options_conn(LDAP *ld)
} }
} }
#endif #endif
debug_return_int(0); debug_return_int(LDAP_SUCCESS);
} }
/* /*
@@ -2353,7 +2361,8 @@ sudo_ldap_result_add_search(struct ldap_result *lres, LDAP *ldap,
} }
/* /*
* Connect to the LDAP server specified by ld * Connect to the LDAP server specified by ld.
* Returns LDAP_SUCCESS on success, else non-zero.
*/ */
static int static int
sudo_ldap_bind_s(LDAP *ld) sudo_ldap_bind_s(LDAP *ld)
@@ -2408,7 +2417,7 @@ sudo_ldap_bind_s(LDAP *ld)
if (rc != LDAP_SUCCESS) { if (rc != LDAP_SUCCESS) {
warningx("ldap_sasl_interactive_bind_s(): %s", warningx("ldap_sasl_interactive_bind_s(): %s",
ldap_err2string(rc)); ldap_err2string(rc));
debug_return_int(-1); goto done;
} }
DPRINTF1("ldap_sasl_interactive_bind_s() ok"); DPRINTF1("ldap_sasl_interactive_bind_s() ok");
} else } else
@@ -2424,7 +2433,7 @@ sudo_ldap_bind_s(LDAP *ld)
NULL, NULL, NULL); NULL, NULL, NULL);
if (rc != LDAP_SUCCESS) { if (rc != LDAP_SUCCESS) {
warningx("ldap_sasl_bind_s(): %s", ldap_err2string(rc)); warningx("ldap_sasl_bind_s(): %s", ldap_err2string(rc));
debug_return_int(-1); goto done;
} }
DPRINTF1("ldap_sasl_bind_s() ok"); DPRINTF1("ldap_sasl_bind_s() ok");
} }
@@ -2433,12 +2442,13 @@ sudo_ldap_bind_s(LDAP *ld)
rc = ldap_simple_bind_s(ld, ldap_conf.binddn, ldap_conf.bindpw); rc = ldap_simple_bind_s(ld, ldap_conf.binddn, ldap_conf.bindpw);
if (rc != LDAP_SUCCESS) { if (rc != LDAP_SUCCESS) {
warningx("ldap_simple_bind_s(): %s", ldap_err2string(rc)); warningx("ldap_simple_bind_s(): %s", ldap_err2string(rc));
debug_return_int(-1); goto done;
} }
DPRINTF1("ldap_simple_bind_s() ok"); DPRINTF1("ldap_simple_bind_s() ok");
} }
#endif #endif
debug_return_int(0); done:
debug_return_int(rc);
} }
/* /*
@@ -2449,13 +2459,20 @@ static int
sudo_ldap_open(struct sudo_nss *nss) sudo_ldap_open(struct sudo_nss *nss)
{ {
LDAP *ld; LDAP *ld;
int rc; int rc = -1;
sigaction_t sa, saved_sa_pipe;
bool ldapnoinit = false; bool ldapnoinit = false;
struct sudo_ldap_handle *handle; struct sudo_ldap_handle *handle;
debug_decl(sudo_ldap_open, SUDO_DEBUG_LDAP) debug_decl(sudo_ldap_open, SUDO_DEBUG_LDAP)
/* Ignore SIGPIPE if we cannot bind to the server. */
memset(&sa, 0, sizeof(sa));
sigemptyset(&sa.sa_mask);
sa.sa_handler = SIG_IGN;
(void) sigaction(SIGPIPE, &sa, &saved_sa_pipe);
if (!sudo_ldap_read_config()) if (!sudo_ldap_read_config())
debug_return_int(-1); goto done;
/* Prevent reading of user ldaprc and system defaults. */ /* Prevent reading of user ldaprc and system defaults. */
if (sudo_getenv("LDAPNOINIT") == NULL) { if (sudo_getenv("LDAPNOINIT") == NULL) {
@@ -2464,8 +2481,8 @@ sudo_ldap_open(struct sudo_nss *nss)
} }
/* Set global LDAP options */ /* Set global LDAP options */
if (sudo_ldap_set_options_global() < 0) if (sudo_ldap_set_options_global() != LDAP_SUCCESS)
debug_return_int(-1); goto done;
/* Connect to LDAP server */ /* Connect to LDAP server */
#ifdef HAVE_LDAP_INITIALIZE #ifdef HAVE_LDAP_INITIALIZE
@@ -2480,11 +2497,12 @@ sudo_ldap_open(struct sudo_nss *nss)
#endif #endif
rc = sudo_ldap_init(&ld, ldap_conf.host, ldap_conf.port); rc = sudo_ldap_init(&ld, ldap_conf.host, ldap_conf.port);
if (rc != LDAP_SUCCESS) if (rc != LDAP_SUCCESS)
debug_return_int(-1); goto done;
/* Set LDAP per-connection options */ /* Set LDAP per-connection options */
if (sudo_ldap_set_options_conn(ld) < 0) rc = sudo_ldap_set_options_conn(ld);
debug_return_int(-1); if (rc != LDAP_SUCCESS)
goto done;
if (ldapnoinit) if (ldapnoinit)
sudo_unsetenv("LDAPNOINIT"); sudo_unsetenv("LDAPNOINIT");
@@ -2494,7 +2512,7 @@ sudo_ldap_open(struct sudo_nss *nss)
rc = ldap_start_tls_s(ld, NULL, NULL); rc = ldap_start_tls_s(ld, NULL, NULL);
if (rc != LDAP_SUCCESS) { if (rc != LDAP_SUCCESS) {
warningx("ldap_start_tls_s(): %s", ldap_err2string(rc)); warningx("ldap_start_tls_s(): %s", ldap_err2string(rc));
debug_return_int(-1); goto done;
} }
DPRINTF1("ldap_start_tls_s() ok"); DPRINTF1("ldap_start_tls_s() ok");
#elif defined(HAVE_LDAP_SSL_CLIENT_INIT) && defined(HAVE_LDAP_START_TLS_S_NP) #elif defined(HAVE_LDAP_SSL_CLIENT_INIT) && defined(HAVE_LDAP_START_TLS_S_NP)
@@ -2504,12 +2522,12 @@ sudo_ldap_open(struct sudo_nss *nss)
if (rc != LDAP_SUCCESS) { if (rc != LDAP_SUCCESS) {
warningx("ldap_ssl_client_init(): %s (SSL reason code %d)", warningx("ldap_ssl_client_init(): %s (SSL reason code %d)",
ldap_err2string(rc), sslrc); ldap_err2string(rc), sslrc);
debug_return_int(-1); goto done;
} }
rc = ldap_start_tls_s_np(ld, NULL); rc = ldap_start_tls_s_np(ld, NULL);
if (rc != LDAP_SUCCESS) { if (rc != LDAP_SUCCESS) {
warningx("ldap_start_tls_s_np(): %s", ldap_err2string(rc)); warningx("ldap_start_tls_s_np(): %s", ldap_err2string(rc));
debug_return_int(-1); goto done;
} }
DPRINTF1("ldap_start_tls_s_np() ok"); DPRINTF1("ldap_start_tls_s_np() ok");
#else #else
@@ -2518,8 +2536,9 @@ sudo_ldap_open(struct sudo_nss *nss)
} }
/* Actually connect */ /* Actually connect */
if (sudo_ldap_bind_s(ld) != 0) rc = sudo_ldap_bind_s(ld);
debug_return_int(-1); if (rc != LDAP_SUCCESS)
goto done;
/* Create a handle container. */ /* Create a handle container. */
handle = ecalloc(1, sizeof(struct sudo_ldap_handle)); handle = ecalloc(1, sizeof(struct sudo_ldap_handle));
@@ -2529,7 +2548,9 @@ sudo_ldap_open(struct sudo_nss *nss)
/* handle->grlist = NULL; */ /* handle->grlist = NULL; */
nss->handle = handle; nss->handle = handle;
debug_return_int(0); done:
(void) sigaction(SIGPIPE, &saved_sa_pipe, NULL);
debug_return_int(rc == LDAP_SUCCESS ? 0 : -1);
} }
static int static int