Attachment 129263 Details for Bug 99622 – On bus startup check given auth in config file against supported mechanisms.

[patch] On bus startup check given auth in config file against supported mechanisms.

On-bus-startup-check-given-auth-in-config-file-aga.patch (text/plain), 4.30 KB, created by Ralf Habacker on 2017-01-31 21:26:47 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ralf Habacker

Created: 2017-01-31 21:26:47 UTC

Size: 4.30 KB

patch

obsolete

>From 1c32a66a120fbef3da18bb018019ca2fe26d7a3c Mon Sep 17 00:00:00 2001
>From: Ralf Habacker <ralf.habacker@freenet.de>
>Date: Tue, 31 Jan 2017 22:20:38 +0100
>Subject: [PATCH] On bus startup check given auth in config file against
> supported mechanisms.
>
>With recent code starting dbus-daemon with an unsupported auth mechanism
>let dbus-daemon silently ignore this issue. Clients connecting to this
>server fails to connect without any descriptive explanation of the
>root cause, only the message 'Rejected client connection due to lack
>of memory' error is reported in dbus-daemon verbose log, which is disabled
>in production environments.
>
>With this patch dbus-daemon checks the supported auth mechanisms on startup
>and shuts down with a descriptive error message, which gives admins an
>immediate feedback on service startup/restart.
>
>Signed-off-by: Ralf Habacker <ralf.habacker@freenet.de>
>
>Bug: https://bugs.freedesktop.org/show_bug.cgi?id=99622
>---
> bus/bus.c        | 21 +++++++++++++++++++++
> dbus/dbus-auth.c | 41 +++++++++++++++++++++++++++++++++++++++++
> dbus/dbus-auth.h |  4 ++++
> 3 files changed, 66 insertions(+)
>
>diff --git a/bus/bus.c b/bus/bus.c
>index b27b4a5..b4d89ef 100644
>--- a/bus/bus.c
>+++ b/bus/bus.c
>@@ -37,6 +37,7 @@
> #include "apparmor.h"
> #include "audit.h"
> #include "dir-watch.h"
>+#include <dbus/dbus-auth.h>
> #include <dbus/dbus-list.h>
> #include <dbus/dbus-hash.h>
> #include <dbus/dbus-credentials.h>
>@@ -429,6 +430,26 @@ process_config_first_time_only (BusContext       *context,
>       link = _dbus_list_get_first_link (auth_mechanisms_list);
>       while (link != NULL)
>         {
>+          DBusString name;
>+          _dbus_string_init_const (&name, link->data);
>+          if (!_dbus_auth_is_supported_mechanism (&name))
>+            {
>+              DBusString list;
>+              if (!_dbus_string_init (&list))
>+                goto oom;
>+
>+              if (!_dbus_auth_dump_supported_mechanisms (&list))
>+                {
>+                  _dbus_string_free (&list);
>+                  goto oom;
>+                }
>+              dbus_set_error (error, DBUS_ERROR_FAILED,
>+                              "Unsupported auth mechanism \"%s\" in bus config file detected. Supported mechanisms are \"%s\".",
>+                              link->data,
>+                              _dbus_string_get_const_data (&list));
>+              _dbus_string_free (&list);
>+              goto failed;
>+            }
>           auth_mechanisms[i] = _dbus_strdup (link->data);
>           if (auth_mechanisms[i] == NULL)
>             goto oom;
>diff --git a/dbus/dbus-auth.c b/dbus/dbus-auth.c
>index ea43ce7..265b424 100644
>--- a/dbus/dbus-auth.c
>+++ b/dbus/dbus-auth.c
>@@ -2837,6 +2837,47 @@ _dbus_auth_get_unix_fd_negotiated(DBusAuth *auth)
>   return auth->unix_fd_negotiated;
> }
> 
>+/**
>+ * Queries whether the given auth mechanism is supported.
>+ *
>+ * @param auth the auth mechanism to query for
>+ * @returns #TRUE when auth mechanism is supported
>+ */
>+dbus_bool_t
>+_dbus_auth_is_supported_mechanism (DBusString *name)
>+{
>+  _dbus_assert (name != NULL);
>+
>+  return find_mech (name, NULL) != NULL;
>+}
>+
>+/**
>+ * Return a human-readable string containing all supported auth mechanisms.
>+ *
>+ * @param string to hold the supported auth mechanisms
>+ * @returns #FALSE on oom
>+ */
>+dbus_bool_t
>+_dbus_auth_dump_supported_mechanisms (DBusString *buffer)
>+{
>+  int i;
>+  _dbus_assert (buffer != NULL);
>+
>+  i = 0;
>+  while (all_mechanisms[i].mechanism != NULL)
>+    {
>+      if (i > 0)
>+        {
>+          if (!_dbus_string_append (buffer, ", "))
>+            return FALSE;
>+        }
>+      if (!_dbus_string_append (buffer, all_mechanisms[i].mechanism))
>+        return FALSE;
>+      ++i;
>+    }
>+  return TRUE;
>+}
>+
> /** @} */
> 
> /* tests in dbus-auth-util.c */
>diff --git a/dbus/dbus-auth.h b/dbus/dbus-auth.h
>index c62bcd1..991daca 100644
>--- a/dbus/dbus-auth.h
>+++ b/dbus/dbus-auth.h
>@@ -92,6 +92,10 @@ const char*   _dbus_auth_get_guid_from_server(DBusAuth               *auth);
> 
> void          _dbus_auth_set_unix_fd_possible(DBusAuth               *auth, dbus_bool_t b);
> dbus_bool_t   _dbus_auth_get_unix_fd_negotiated(DBusAuth             *auth);
>+DBUS_PRIVATE_EXPORT
>+dbus_bool_t   _dbus_auth_is_supported_mechanism(DBusString         *name);
>+DBUS_PRIVATE_EXPORT
>+dbus_bool_t   _dbus_auth_dump_supported_mechanisms(DBusString        *buffer);
> 
> DBUS_END_DECLS
> 
>-- 
>2.6.6

Actions: View | Splinter Review

Attachments on bug 99622: 129263 | 129279

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.