[11925] in Kerberos-V5-bugs
[krbdev.mit.edu #6879] Kerberos 1.9 : Bug in LDAP plugin in
daemon@ATHENA.MIT.EDU (Dominique Laigle via RT)
Tue Mar 8 15:38:46 2011
Mail-followup-to: rt@krbdev.mit.edu
mail-copies-to: never
From: "Dominique Laigle via RT" <rt-comment@krbdev.MIT.EDU>
In-Reply-To: <rt-6879@krbdev.mit.edu>
Message-ID: <rt-6879-33879.0.130044604320361@krbdev.mit.edu>
To: "'AdminCc of krbdev.mit.edu Ticket #6879'":;"'AdminCc of krbdev.mit.edu Ticket #6879'":;@MIT.EDU
Date: Tue, 8 Mar 2011 15:38:41 -0500 (EST)
Reply-To: rt-comment@krbdev.MIT.EDU
Content-Type: multipart/mixed; boundary="===============0814186776=="
Errors-To: krb5-bugs-bounces@mit.edu
--===============0814186776==
To: krb5-bugs@mit.edu
Subject: misspelled "Kerberos" in title of installation guide
From: dlaigle@gmail.com
Reply-To: dlaigle@gmail.com
>Submitter-Id: BULL Luxembourg
>Originator: Dominique Laigle
>Organization:
BULL Luxembourg SA
>Confidential: no
>Synopsis: Bug in kdb_ldap::ldap_err.c
>Severity: critical
>Priority: high
>Category: krb5-kdc
>Class: sw-bug
>Release: 1.9 stable
>Environment:
<machine, os, target, libraries (multiple lines)>
System: Solaris 10 (SPARC,x86) & AIX (5.3, 6.1)
Machine: T52220
Using OpenLDAP 2.4.23, Build 32 bit on Solaris, 64 bit on AIX,
both with gcc
>Description:
When principal names are badly formed, ending with "("
kdc loops on initiating new LDAP connection, which leads to saturate
slapd up to the max connections possible (and make it to ignore all
other incoming requests = DoS on LDAP)
>How-To-Repeat:
create badly formed principal name, say "foo(" and get
the TGT with kinit.
>Fix:
*** Explanations
All principal lookup ends up in LDAP_SEARCH_1 defined in
kdb_ldap.h:
#define LDAP_SEARCH_1(...) \
do { \
st = ldap_search_ext_s(...); \
if (translate_ldap_error(st, OP_SEARCH) == KRB5_KDB_ACCESS_ERROR) { \
tempst = krb5_ldap_rebind(ldap_context, &ldap_server_handle); \
[...]
} \
} while (translate_ldap_error(st, OP_SEARCH) ==
KRB5_KDB_ACCESS_ERROR && tempst == 0);
1. So long "translate_ldap_error" returns KRB5_KDB_ACCESS_ERROR,
LDAP_SEARCH_1 will loop
and initiate a new LDAP connection with "krb5_ldap_rebind".
2. When the filter is not correct - this appears when the principal
name ends with "(" -, "ldap_search_ext_s" returns LDAP_FILTER_ERROR,
value "-7". The function "translate_ldap_error" defined in ldap_err.c
doesn't catch this case and considers it as "LDAP_API_ERROR". Thus, in
our case of badly named principals, "translate_ldap_error" always
returns KRB5_KDB_ACCESS_ERROR making LDAP_SEARCH_1 to loop after
having initiated a new connection.
*** Fix proposal:
Change ldap_err.c making "translate_ldap_error" to return another
error than KRB5_KDB_ACCESS_ERROR.
I propose to add one statment forcing the return code to "No ENTRY" as
showed in the diff -u hereafter:
--- ldap_err.c.org Tue Mar 1 11:39:36 2011
+++ ldap_err.c Tue Mar 1 11:40:15 2011
@@ -139,6 +139,7 @@
return KRB5_KDB_CONSTRAINT_VIOLATION;
case LDAP_REFERRAL:
+ case LDAP_FILTER_ERROR:
return KRB5_KDB_NOENTRY;
case LDAP_ADMINLIMIT_EXCEEDED:
Regards
- Dominique Laigle
--===============0814186776==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
--===============0814186776==--
