Attachment 13809 Details for Bug 11573 – [PATCH 1/2] heimdal: add include/includedir directives for krb5.conf

[patch] [PATCH 1/2] heimdal: add include/includedir directives for krb5.conf

0001-heimdal-add-include-includedir-directives-for-krb5.c.patch (text/plain), 8.05 KB, created by Evgeny Sinelnikov on 2017-11-25 19:19:44 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Evgeny Sinelnikov

Created: 2017-11-25 19:19:44 UTC

Size: 8.05 KB

patch

obsolete

>From 9baaed98f22598648d5fb24cf32dca8eaafea1cd Mon Sep 17 00:00:00 2001
>From: Evgeny Sinelnikov <sin@altlinux.org>
>Date: Thu, 23 Nov 2017 06:32:36 +0400
>Subject: [PATCH 1/2] heimdal: add include/includedir directives for krb5.conf
>
>---
> source4/heimdal/lib/krb5/config_file.c | 98 ++++++++++++++++++++++++++++++++--
> source4/heimdal/lib/krb5/context.c     |  3 +-
> source4/heimdal/lib/krb5/krb5_locl.h   |  1 +
> 3 files changed, 98 insertions(+), 4 deletions(-)
>
>diff --git a/source4/heimdal/lib/krb5/config_file.c b/source4/heimdal/lib/krb5/config_file.c
>index 4ac25ae..dfd50cd 100644
>--- a/source4/heimdal/lib/krb5/config_file.c
>+++ b/source4/heimdal/lib/krb5/config_file.c
>@@ -41,6 +41,7 @@
> 
> /* Gaah! I want a portable funopen */
> struct fileptr {
>+    krb5_context context;
>     const char *s;
>     FILE *f;
> };
>@@ -363,18 +364,34 @@ krb5_config_parse_debug (struct fileptr *f,
> 	    ++p;
> 	if (*p == '#' || *p == ';')
> 	    continue;
>-	if (*p == '[') {
>+        if (*p == '[') {
> 	    ret = parse_section(p, &s, res, err_message);
> 	    if (ret)
> 		return ret;
> 	    b = NULL;
> 	} else if (*p == '}') {
> 	    *err_message = "unmatched }";
>-	    return EINVAL;	/* XXX */
>+	    return KRB5_CONFIG_BADFORMAT;
>+        } else if (strncmp(p, "include", sizeof("include") - 1) == 0 &&
>+            isspace(p[sizeof("include") - 1])) {
>+            p += sizeof("include");
>+            while (isspace(*p))
>+                p++;
>+            ret = krb5_config_parse_file_multi(f->context, p, res);
>+	    if (ret)
>+		return ret;
>+        } else if (strncmp(p, "includedir", sizeof("includedir") - 1) == 0 &&
>+            isspace(p[sizeof("includedir") - 1])) {
>+            p += sizeof("includedir");
>+            while (isspace(*p))
>+                p++;
>+            ret = krb5_config_parse_dir_multi(f->context, p, res);
>+	    if (ret)
>+		return ret;
> 	} else if(*p != '\0') {
> 	    if (s == NULL) {
> 		*err_message = "binding before section";
>-		return EINVAL;
>+		return KRB5_CONFIG_BADFORMAT;
> 	    }
> 	    ret = parse_binding(f, lineno, p, &b, &s->u.list, err_message);
> 	    if (ret)
>@@ -397,6 +414,64 @@ is_plist_file(const char *fname)
> }
> 
> /**
>+ * Parse configuration files in the given directory and add the result
>+ * into res.  Only files whose names consist only of alphanumeric
>+ * characters, hyphen, and underscore, will be parsed, though files
>+ * ending in ".conf" will also be parsed.
>+ *
>+ * This interface can be used to parse several configuration directories
>+ * into one resulting krb5_config_section by calling it repeatably.
>+ *
>+ * @param context a Kerberos 5 context.
>+ * @param dname a directory name to a Kerberos configuration file
>+ * @param res the returned result, must be free with krb5_free_config_files().
>+ * @return Return an error code or 0, see krb5_get_error_message().
>+ *
>+ * @ingroup krb5_support
>+ */
>+
>+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
>+krb5_config_parse_dir_multi(krb5_context context,
>+                            const char *dname,
>+                            krb5_config_section **res)
>+{
>+    struct dirent *entry;
>+    krb5_error_code ret;
>+    DIR *d;
>+
>+    if ((d = opendir(dname)) == NULL)
>+        return errno;
>+
>+    while ((entry = readdir(d)) != NULL) {
>+        char *p = entry->d_name;
>+        char *path;
>+        int is_valid = 1;
>+
>+        while (*p) {
>+            if (!isalpha(*p) && *p != '_' && *p != '-' &&
>+                strcmp(p, ".conf") != 0) {
>+                is_valid = 0;
>+                break;
>+            }
>+            p++;
>+        }
>+        if (!is_valid)
>+            continue;
>+
>+        if (asprintf(&path, "%s/%s", dname, entry->d_name) == -1 ||
>+            path == NULL)
>+            return krb5_enomem(context);
>+        ret = krb5_config_parse_file_multi(context, path, res);
>+        free(path);
>+        if (ret == ENOMEM)
>+            return krb5_enomem(context);;
>+        /* Ignore malformed config files */
>+    }
>+    (void) closedir(d);
>+    return 0;
>+}
>+
>+/**
>  * Parse a configuration file and add the result into res. This
>  * interface can be used to parse several configuration files into one
>  * resulting krb5_config_section by calling it repeatably.
>@@ -420,6 +495,13 @@ krb5_config_parse_file_multi (krb5_context context,
>     krb5_error_code ret;
>     struct fileptr f;
> 
>+    if (context->config_include_depth > 5) {
>+        krb5_warnx(context, "Maximum config file include depth reached; "
>+                   "not including %s", fname);
>+        return 0;
>+    }
>+    context->config_include_depth++;
>+
>     /**
>      * If the fname starts with "~/" parse configuration file in the
>      * current users home directory. The behavior can be disabled and
>@@ -430,6 +512,7 @@ krb5_config_parse_file_multi (krb5_context context,
> 	const char *home = NULL;
> 
> 	if (!_krb5_homedir_access(context)) {
>+        context->config_include_depth--;
> 	    krb5_set_error_message(context, EPERM,
> 				   "Access to home directory not allowed");
> 	    return EPERM;
>@@ -446,6 +529,7 @@ krb5_config_parse_file_multi (krb5_context context,
> 	if (home) {
> 	    asprintf(&newfname, "%s%s", home, &fname[1]);
> 	    if (newfname == NULL) {
>+                context->config_include_depth--;
> 		krb5_set_error_message(context, ENOMEM,
> 				       N_("malloc: out of memory", ""));
> 		return ENOMEM;
>@@ -456,6 +540,7 @@ krb5_config_parse_file_multi (krb5_context context,
> 	if (asprintf(&newfname, "%%{USERCONFIG}%s", &fname[1]) < 0 ||
> 	    newfname == NULL)
> 	{
>+            context->config_include_depth--;
> 	    krb5_set_error_message(context, ENOMEM,
> 				   N_("malloc: out of memory", ""));
> 	    return ENOMEM;
>@@ -467,6 +552,7 @@ krb5_config_parse_file_multi (krb5_context context,
>     if (is_plist_file(fname)) {
> #ifdef __APPLE__
> 	ret = parse_plist_config(context, fname, res);
>+        context->config_include_depth--;
> 	if (ret) {
> 	    krb5_set_error_message(context, ret,
> 				   "Failed to parse plist %s", fname);
>@@ -485,6 +571,7 @@ krb5_config_parse_file_multi (krb5_context context,
> 
> 	ret = _krb5_expand_path_tokens(context, fname, &exp_fname);
> 	if (ret) {
>+            context->config_include_depth--;
> 	    if (newfname)
> 		free(newfname);
> 	    return ret;
>@@ -495,9 +582,11 @@ krb5_config_parse_file_multi (krb5_context context,
> 	fname = newfname = exp_fname;
> #endif
> 
>+        f.context = context;
> 	f.f = fopen(fname, "r");
> 	f.s = NULL;
> 	if(f.f == NULL) {
>+            context->config_include_depth--;
> 	    ret = errno;
> 	    krb5_set_error_message (context, ret, "open %s: %s",
> 				    fname, strerror(ret));
>@@ -507,6 +596,7 @@ krb5_config_parse_file_multi (krb5_context context,
> 	}
> 
> 	ret = krb5_config_parse_debug (&f, res, &lineno, &str);
>+        context->config_include_depth--;
> 	fclose(f.f);
> 	if (ret) {
> 	    krb5_set_error_message (context, ret, "%s:%u: %s",
>@@ -1310,6 +1400,8 @@ krb5_config_parse_string_multi(krb5_context context,
>     unsigned lineno = 0;
>     krb5_error_code ret;
>     struct fileptr f;
>+
>+    f.context = context;
>     f.f = NULL;
>     f.s = string;
> 
>diff --git a/source4/heimdal/lib/krb5/context.c b/source4/heimdal/lib/krb5/context.c
>index 23e3879..770f012 100644
>--- a/source4/heimdal/lib/krb5/context.c
>+++ b/source4/heimdal/lib/krb5/context.c
>@@ -646,7 +646,8 @@ krb5_set_config_files(krb5_context context, char **filenames)
>     krb5_config_binding *tmp = NULL;
>     while(filenames != NULL && *filenames != NULL && **filenames != '\0') {
> 	ret = krb5_config_parse_file_multi(context, *filenames, &tmp);
>-	if(ret != 0 && ret != ENOENT && ret != EACCES && ret != EPERM) {
>+	if (ret != 0 && ret != ENOENT && ret != EACCES && ret != EPERM
>+	    && ret != KRB5_CONFIG_BADFORMAT) {
> 	    krb5_config_file_free(context, tmp);
> 	    return ret;
> 	}
>diff --git a/source4/heimdal/lib/krb5/krb5_locl.h b/source4/heimdal/lib/krb5/krb5_locl.h
>index 49c614d..f9c40e3 100644
>--- a/source4/heimdal/lib/krb5/krb5_locl.h
>+++ b/source4/heimdal/lib/krb5/krb5_locl.h
>@@ -262,6 +262,7 @@ typedef struct krb5_context_data {
>     int32_t kdc_sec_offset;
>     int32_t kdc_usec_offset;
>     krb5_config_section *cf;
>+    size_t config_include_depth;
>     struct et_list *et_list;
>     struct krb5_log_facility *warn_dest;
>     struct krb5_log_facility *debug_dest;
>-- 
>2.10.2
>

Actions: View

Attachments on bug 11573: 11593 | 13809 | 13810 | 13819 | 13820 | 14239 | 14246