Backport the util_ldap patch that updates the bind credentials so that... (b15f9bd0) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP Apache Httpd

CHANGES

+5 −0

Changes for CHANGES: 5 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		Changes with Apache 2.0.50

		*) Update the bind credentials for the cached LDAP connection to
		reflect the last bind. This prevents util_ldap from creating
		unnecessary connections rather than reusing cached connections.
		[Brad Nicholes]

		*) mod_isapi: GetServerVariable returned improperly terminated header
		fields given "ALL_HTTP" or "ALL_RAW". PR 20656.
		[Jesse Pelton <jsp pkc.com>]

STATUS

+1 −11

Changes for STATUS: 1 added line, 11 removed lines.
Original line number	Diff line number	Diff line
		APACHE 2.0 STATUS: --text--
		Last modified at [$Date: 2004/04/26 19:03:40 $]
		Last modified at [$Date: 2004/04/26 22:04:58 $]

		Release:

		@@ -167,16 +167,6 @@ PATCHES TO BACKPORT FROM 2.1
		modules/mappers/mod_rewrite.c: r1.255
		+1: nd, trawick

		*) Update the ldc->binddn and ldc->bindpw associated with the LDAP
		connection to match the authenticating user DN and password after
		ldap_simple_bind_s() is called to authenticate the user. Otherwise
		the next time that this connection is reused, it will indicate that
		it is bound to the original user DN specified by ldc->binddn when in
		fact it is bound to a completely different user DN who may not have
		sufficient rights to complete the requested search.
		modules/experimental/util_ldap.c: r1.22, r1.24
		+1: bnicholes, minfrin, trawick

		*) (re-)add support for RewriteRules in <Proxy> containers. PR 27985
		modules/mappers/mod_rewrite.c: r1.254
		+1: nd, trawick

modules/experimental/util_ldap.c

+49 −12

Changes for modules/experimental/util_ldap.c: 49 added lines, 12 removed lines.
Original line number	Diff line number	Diff line
		@@ -88,6 +88,20 @@ void util_ldap_create_config(apr_pool_t p, server_rec *s);
		"\"http://www.w3.org/TR/REC-html40/frameset.dtd\">\n"
		#endif


		static void util_ldap_strdup (char *str, const char newstr)
		{
		if (*str) {
		free(*str);
		*str = NULL;
		}

		if (newstr) {
		*str = calloc(1, strlen(newstr)+1);
		strcpy (*str, newstr);
		}
		}

		/*
		* Status Handler
		* --------------
		@@ -179,6 +193,8 @@ LDAP_DECLARE_NONSTD(apr_status_t) util_ldap_connection_destroy(void *param)
		{
		util_ldap_connection_t *ldc = param;

		if (ldc) {

		/* unbinding from the LDAP server */
		if (ldc->ldap) {
		ldap_unbind_s(ldc->ldap);
		@@ -186,6 +202,14 @@ LDAP_DECLARE_NONSTD(apr_status_t) util_ldap_connection_destroy(void *param)
		ldc->ldap = NULL;
		}

		if (ldc->bindpw) {
		free((void*)ldc->bindpw);
		}

		if (ldc->binddn) {
		free((void*)ldc->binddn);
		}

		/* release the lock we were using. The lock should have
		already been released in the close connection call.
		But just in case it wasn't, we first try to get the lock
		@@ -198,6 +222,7 @@ LDAP_DECLARE_NONSTD(apr_status_t) util_ldap_connection_destroy(void *param)
		apr_thread_mutex_unlock(ldc->lock);
		#endif

		}
		return APR_SUCCESS;
		}

		@@ -290,11 +315,6 @@ LDAP_DECLARE(int) util_ldap_connection_open(request_rec *r,
		/* always default to LDAP V3 */
		ldap_set_option(ldc->ldap, LDAP_OPT_PROTOCOL_VERSION, &version);


		/* add the cleanup to the pool */
		apr_pool_cleanup_register(ldc->pool, ldc,
		util_ldap_connection_destroy,
		apr_pool_cleanup_null);
		}


		@@ -395,8 +415,8 @@ LDAP_DECLARE(util_ldap_connection_t )util_ldap_connection_find(request_rec r,

		/* the bind credentials have changed */
		l->bound = 0;
		l->binddn = apr_pstrdup(st->pool, binddn);
		l->bindpw = apr_pstrdup(st->pool, bindpw);
		util_ldap_strdup((char**)&(l->binddn), binddn);
		util_ldap_strdup((char**)&(l->bindpw), bindpw);
		break;
		}
		#if APR_HAS_THREADS
		@@ -434,10 +454,15 @@ LDAP_DECLARE(util_ldap_connection_t )util_ldap_connection_find(request_rec r,
		l->host = apr_pstrdup(st->pool, host);
		l->port = port;
		l->deref = deref;
		l->binddn = apr_pstrdup(st->pool, binddn);
		l->bindpw = apr_pstrdup(st->pool, bindpw);
		util_ldap_strdup((char**)&(l->binddn), binddn);
		util_ldap_strdup((char**)&(l->bindpw), bindpw);
		l->secure = secure;

		/* add the cleanup to the pool */
		apr_pool_cleanup_register(l->pool, l,
		util_ldap_connection_destroy,
		apr_pool_cleanup_null);

		if (p) {
		p->next = l;
		}
		@@ -817,7 +842,7 @@ start_over:

		/* Grab the dn, copy it into the pool, and free it again */
		dn = ldap_get_dn(ldc->ldap, entry);
		*binddn = apr_pstrdup(st->pool, dn);
		*binddn = apr_pstrdup(r->pool, dn);
		ldap_memfree(dn);

		/*
		@@ -852,6 +877,18 @@ start_over:
		ldap_msgfree(res);
		return result;
		}
		else {
		/*
		* Since we just bound the connection to the authenticating user id, update the
		* ldc->binddn and ldc->bindpw to reflect the change and also to allow the next
		* call to util_ldap_connection_open() to handle the connection reuse appropriately.
		* Otherwise the next time that this connection is reused, it will indicate that
		* it is bound to the original user id specified ldc->binddn when in fact it is
		* bound to a completely different user id.
		*/
		util_ldap_strdup((char*)&(ldc->binddn), binddn);
		util_ldap_strdup((char**)&(ldc->bindpw), bindpw);
		}

		/*
		* Get values for the provided attributes.
		@@ -881,17 +918,17 @@ start_over:
		/*
		* Add the new username to the search cache.
		*/
		if (curl) {
		LDAP_CACHE_WRLOCK();
		the_search_node.username = filter;
		the_search_node.dn = *binddn;
		the_search_node.bindpw = bindpw;
		the_search_node.lastbind = apr_time_now();
		the_search_node.vals = vals;
		if (curl) {
		util_ald_cache_insert(curl->search_cache, &the_search_node);
		LDAP_CACHE_UNLOCK();
		}
		ldap_msgfree(res);
		LDAP_CACHE_UNLOCK();

		ldc->reason = "Authentication successful";
		return LDAP_SUCCESS;