sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-18 06:04:06 +03:00
Code

CVE-2023-0614 ldb: Centralise checking for inaccessible matches

Browse Source 
This makes it less likely that we forget to handle a case.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15270

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Joseph Sutton 2023-02-14 13:17:24 +13:00 committed by Jule Anger
parent 58b4a0e3eb
commit d60683e5e9
2 changed files with 31 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/ldb-samba/ldb_matching_rules.c
View File

@ -87,11 +87,6 @@ static int ldb_eval_transitive_filter_helper(TALLOC_CTX *mem_ctx,
return LDB_SUCCESS; return LDB_SUCCESS;
} }
if (ldb_msg_element_is_inaccessible(el)) {
*matched = false;
return LDB_SUCCESS;
}
/* /*
* If the value to match is present in the attribute values of the * If the value to match is present in the attribute values of the
* current entry being visited, set matched to true and return OK * current entry being visited, set matched to true and return OK

56
lib/ldb/common/ldb_match.c
View File

@ -99,11 +99,6 @@ static int ldb_match_present(struct ldb_context *ldb,
return LDB_SUCCESS; return LDB_SUCCESS;
} }
if (ldb_msg_element_is_inaccessible(el)) {
*matched = false;
return LDB_SUCCESS;
}
a = ldb_schema_attribute_by_name(ldb, el->name); a = ldb_schema_attribute_by_name(ldb, el->name);
if (!a) { if (!a) {
return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX; return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
@ -145,11 +140,6 @@ static int ldb_match_comparison(struct ldb_context *ldb,
return LDB_SUCCESS; return LDB_SUCCESS;
} }
if (ldb_msg_element_is_inaccessible(el)) {
*matched = false;
return LDB_SUCCESS;
}
a = ldb_schema_attribute_by_name(ldb, el->name); a = ldb_schema_attribute_by_name(ldb, el->name);
if (!a) { if (!a) {
return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX; return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
@ -220,11 +210,6 @@ static int ldb_match_equality(struct ldb_context *ldb,
return LDB_SUCCESS; return LDB_SUCCESS;
} }
if (ldb_msg_element_is_inaccessible(el)) {
*matched = false;
return LDB_SUCCESS;
}
a = ldb_schema_attribute_by_name(ldb, el->name); a = ldb_schema_attribute_by_name(ldb, el->name);
if (a == NULL) { if (a == NULL) {
return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX; return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
@ -425,11 +410,6 @@ static int ldb_match_substring(struct ldb_context *ldb,
return LDB_SUCCESS; return LDB_SUCCESS;
} }
if (ldb_msg_element_is_inaccessible(el)) {
*matched = false;
return LDB_SUCCESS;
}
for (i = 0; i < el->num_values; i++) { for (i = 0; i < el->num_values; i++) {
int ret; int ret;
ret = ldb_wildcard_compare(ldb, tree, el->values[i], matched); ret = ldb_wildcard_compare(ldb, tree, el->values[i], matched);
@ -503,11 +483,6 @@ static int ldb_match_bitmask(struct ldb_context *ldb,
return LDB_SUCCESS; return LDB_SUCCESS;
} }
if (ldb_msg_element_is_inaccessible(el)) {
*matched = false;
return LDB_SUCCESS;
}
for (i=0;i<el->num_values;i++) { for (i=0;i<el->num_values;i++) {
int ret; int ret;
struct ldb_val *v = &el->values[i]; struct ldb_val *v = &el->values[i];
@ -596,6 +571,26 @@ static int ldb_match_extended(struct ldb_context *ldb,
&tree->u.extended.value, matched); &tree->u.extended.value, matched);
} }
static bool ldb_must_suppress_match(const struct ldb_message *msg,
const struct ldb_parse_tree *tree)
{
const char *attr = NULL;
struct ldb_message_element *el = NULL;
attr = ldb_parse_tree_get_attr(tree);
if (attr == NULL) {
return false;
}
/* find the message element */
el = ldb_msg_find_element(msg, attr);
if (el == NULL) {
return false;
}
return ldb_msg_element_is_inaccessible(el);
}
/* /*
Check if a particular message will match the given filter Check if a particular message will match the given filter
@ -620,6 +615,17 @@ int ldb_match_message(struct ldb_context *ldb,
return LDB_SUCCESS; return LDB_SUCCESS;
} }
/*
* Suppress matches on confidential attributes (handled
* manually in extended matches as these can do custom things
* like read other parts of the DB or other attributes).
*/
if (tree->operation != LDB_OP_EXTENDED) {
if (ldb_must_suppress_match(msg, tree)) {
return LDB_SUCCESS;
}
}
switch (tree->operation) { switch (tree->operation) {
case LDB_OP_AND: case LDB_OP_AND:
for (i=0;i<tree->u.list.num_elements;i++) { for (i=0;i<tree->u.list.num_elements;i++) {