Fix LDAP query injection (courtesy of Anders Kaseorg)

[mod-vhost-ldap.git] / mod_vhost_ldap.c

diff --git a/mod_vhost_ldap.c b/mod_vhost_ldap.c
index d7677c89002347a4c179c9621af194f1a44bbc56..f6633840780088a2ca737863995515f696340dab 100644 (file)
--- a/mod_vhost_ldap.c
+++ b/mod_vhost_ldap.c
@@ -50,6 +50,8 @@
 #define MIN_UID 100
 #define MIN_GID 100
 
+#define MAX_FAILURES 5
+
 module AP_MODULE_DECLARE_DATA vhost_ldap_module;
 
 typedef enum {
@@ -89,7 +91,6 @@ typedef struct mod_vhost_ldap_request_t {
     char *cgiroot;                     /* ScriptAlias */
     char *uid;                         /* Suexec Uid */
     char *gid;                         /* Suexec Gid */
-    char *saved_docroot;                /* Saved DocumentRoot */
 } mod_vhost_ldap_request_t;
 
 char *attributes[] =
@@ -468,7 +469,10 @@ static int mod_vhost_ldap_translate_name(request_rec *r)
     char *cgi;
     const char *hostname = NULL;
     int is_fallback = 0;
-    int sleep = 0;
+    int sleep0 = 0;
+    int sleep1 = 1;
+    int sleep;
+    struct berval hostnamebv, shostnamebv;
 
     reqc =
        (mod_vhost_ldap_request_t *)apr_pcalloc(r->pool, sizeof(mod_vhost_ldap_request_t));
@@ -495,13 +499,19 @@ start_over:
     }
 
     hostname = r->hostname;
+    if (hostname == NULL || hostname[0] == '\0')
+        goto null;
 
 fallback:
 
     ap_log_rerror(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, r,
-                 "[mod_vhost_ldap.c]: translating hostname [%s], uri [%s], try [%d]", hostname, r->uri, failures);
+                 "[mod_vhost_ldap.c]: translating hostname [%s], uri [%s]", hostname, r->uri);
 
-    apr_snprintf(filtbuf, FILTER_LENGTH, "(&(%s)(|(apacheServerName=%s)(apacheServerAlias=%s)))", conf->filter, hostname, hostname);
+    ber_str2bv(hostname, 0, 0, &hostnamebv);
+    if (ldap_bv2escaped_filter_value(&hostnamebv, &shostnamebv) != 0)
+       goto null;
+    apr_snprintf(filtbuf, FILTER_LENGTH, "(&(%s)(|(apacheServerName=%s)(apacheServerAlias=%s)))", conf->filter, shostnamebv.bv_val, shostnamebv.bv_val);
+    ber_memfree(shostnamebv.bv_val);
 
     result = util_ldap_cache_getuserdn(r, ldc, conf->url, conf->basedn, conf->scope,
                                       attributes, filtbuf, &dn, &vals);
@@ -512,10 +522,14 @@ fallback:
     if (AP_LDAP_IS_SERVER_DOWN(result) ||
        (result == LDAP_TIMEOUT) ||
        (result == LDAP_CONNECT_ERROR)) {
-        if (failures++ <= 5) {
+        sleep = sleep0 + sleep1;
+        ap_log_rerror(APLOG_MARK, APLOG_WARNING|APLOG_NOERRNO, 0, r,
+                     "[mod_vhost_ldap.c]: lookup failure, retry number #[%d], sleeping for [%d] seconds", failures, sleep);
+        if (failures++ < MAX_FAILURES) {
            /* Back-off exponentially */
            apr_sleep(apr_time_from_sec(sleep));
-           sleep = sleep+failures;
+           sleep0 = sleep1;
+           sleep1 = sleep;
             goto start_over;
         } else {
            return HTTP_GATEWAY_TIME_OUT;
@@ -523,6 +537,7 @@ fallback:
     }
 
     if (result == LDAP_NO_SUCH_OBJECT) {
+null:
        if (conf->fallback && (is_fallback++ <= 0)) {
            ap_log_rerror(APLOG_MARK, APLOG_NOTICE|APLOG_NOERRNO, 0, r,
                          "[mod_vhost_ldap.c] translate: "
@@ -630,8 +645,6 @@ fallback:
        top->server->server_admin = apr_pstrdup (top->pool, reqc->admin);
     }
 
-    reqc->saved_docroot = apr_pstrdup(top->pool, ap_document_root(r));
-
     result = set_document_root(r, reqc->docroot);
     if (result != OK) {
         return HTTP_INTERNAL_SERVER_ERROR;
@@ -645,16 +658,6 @@ fallback:
     return DECLINED;
 }
 
-static int mod_vhost_ldap_cleanup(request_rec * r)
-{
-    mod_vhost_ldap_request_t *reqc =
-      (mod_vhost_ldap_request_t *)ap_get_module_config(r->request_config,
-                                                      &vhost_ldap_module);
-
-    /* Set ap_document_root back to saved value */
-    return set_document_root(r, reqc->saved_docroot);
-}
-
 #ifdef HAVE_UNIX_SUEXEC
 static ap_unix_identity_t *mod_vhost_ldap_get_suexec_id_doer(const request_rec * r)
 {
@@ -708,7 +711,6 @@ mod_vhost_ldap_register_hooks (apr_pool_t * p)
 
     ap_hook_post_config(mod_vhost_ldap_post_config, NULL, NULL, APR_HOOK_MIDDLE);
     ap_hook_translate_name(mod_vhost_ldap_translate_name, NULL, aszRewrite, APR_HOOK_FIRST);
-    ap_hook_fixups(mod_vhost_ldap_cleanup, aszRewrite, NULL, APR_HOOK_MIDDLE);
 #ifdef HAVE_UNIX_SUEXEC
     ap_hook_get_suexec_identity(mod_vhost_ldap_get_suexec_id_doer, NULL, NULL, APR_HOOK_MIDDLE);
 #endif