Skip to content

Harden LDAP control decoding against malformed BER input #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Fusion wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Harden LDAP control decoding against malformed BER input #6

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 48 additions & 7 deletions control.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,8 +100,24 @@ func FindControl(controls []Control, controlType string) Control {
return nil
}

func DecodeControl(packet *ber.Packet) Control {
ControlType := packet.Children[0].Value.(string)
func DecodeControl(packet *ber.Packet) (control Control, err error) {
defer func() {
if r := recover(); r != nil {
control = nil
err = fmt.Errorf("ldap: failed to decode control: %v", r)
}
}()

if packet == nil || len(packet.Children) == 0 {
return nil, fmt.Errorf("ldap: failed to decode control: malformed control packet")
}
if packet.Children[0] == nil {
return nil, fmt.Errorf("ldap: failed to decode control: malformed control packet")
}
ControlType, ok := packet.Children[0].Value.(string)
if !ok {
return nil, fmt.Errorf("ldap: failed to decode control: malformed control type")
}
packet.Children[0].Description = "Control Type (" + ControlTypeMap[ControlType] + ")"
c := new(ControlString)
c.ControlType = ControlType
Expand All @@ -111,8 +127,18 @@ func DecodeControl(packet *ber.Packet) Control {
value := packet.Children[1]
if len(packet.Children) == 3 {
value = packet.Children[2]
if packet.Children[1] == nil {
return nil, fmt.Errorf("ldap: failed to decode control: malformed control criticality")
}
packet.Children[1].Description = "Criticality"
c.Criticality = packet.Children[1].Value.(bool)
criticality, ok := packet.Children[1].Value.(bool)
if !ok {
return nil, fmt.Errorf("ldap: failed to decode control: malformed control criticality")
}
c.Criticality = criticality
}
if value == nil {
return nil, fmt.Errorf("ldap: failed to decode control: malformed control value")
}

value.Description = "Control Value"
Expand All @@ -126,18 +152,33 @@ func DecodeControl(packet *ber.Packet) Control {
value.Value = nil
value.AppendChild(valueChildren)
}
// Exactly one controlValue, RFC2696
if len(value.Children) != 1 || value.Children[0] == nil {
return nil, fmt.Errorf("ldap: failed to decode control: malformed paging control value")
}
value = value.Children[0]
value.Description = "Search Control Value"
if len(value.Children) < 2 || value.Children[0] == nil || value.Children[1] == nil {
return nil, fmt.Errorf("ldap: failed to decode control: malformed paging control value")
}
value.Children[0].Description = "Paging Size"
value.Children[1].Description = "Cookie"
c.PagingSize = uint32(value.Children[0].Value.(int64))
pagingSize, ok := value.Children[0].Value.(int64)
if !ok || pagingSize < 0 || pagingSize > int64(^uint32(0)) {
return nil, fmt.Errorf("ldap: failed to decode control: malformed paging control size")
}
c.PagingSize = uint32(pagingSize)
c.Cookie = value.Children[1].Data.Bytes()
value.Children[1].Value = c.Cookie
return c
return c, nil
}
controlValue, ok := value.Value.(string)
if !ok {
return nil, fmt.Errorf("ldap: failed to decode control: malformed control value")
}
c.ControlValue = value.Value.(string)
c.ControlValue = controlValue
}
return c
return c, nil
}

func NewControlString(controlType string, criticality bool, controlValue string) *ControlString {
Expand Down
6 changes: 5 additions & 1 deletion search.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -331,7 +331,11 @@ func (l *Conn) Search(searchRequest *SearchRequest) (*SearchResult, error) {
}
if len(packet.Children) == 3 {
for _, child := range packet.Children[2].Children {
result.Controls = append(result.Controls, DecodeControl(child))
control, err := DecodeControl(child)
if err != nil {
return result, NewError(ErrorNetwork, err)
}
result.Controls = append(result.Controls, control)
}
}
foundSearchResultDone = true
Expand Down
38 changes: 36 additions & 2 deletions server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -256,7 +256,18 @@ handler:
controls := []Control{}
if len(packet.Children) > 2 {
for _, child := range packet.Children[2].Children {
controls = append(controls, DecodeControl(child))
control, err := DecodeControl(child)
if err != nil {
log.Printf("DecodeControl error %s", err.Error())
responsePacket := encodeProtocolErrorResponse(messageID, req.Tag)
if responsePacket != nil {
if err = sendPacket(conn, responsePacket); err != nil {
log.Printf("sendPacket error %s", err.Error())
}
}
break handler
}
controls = append(controls, control)
}
}

Expand Down Expand Up @@ -324,7 +335,7 @@ handler:
case ApplicationExtendedRequest:
var tlsConn *tls.Conn
if n := len(req.Children); n == 1 || n == 2 {
if name := ber.DecodeString(req.Children[0].Data.Bytes()); name == oidStartTLS && server.TLSConfig != nil {
if name := ber.DecodeString(req.Children[0].Data.Bytes()); name == oidStartTLS {
tlsConn = tls.Server(conn, server.TLSConfig)
}
}
Expand Down Expand Up @@ -401,6 +412,29 @@ func sendPacket(conn net.Conn, packet *ber.Packet) error {
return nil
}

func encodeProtocolErrorResponse(messageID uint64, requestType ber.Tag) *ber.Packet {
switch requestType {
case ApplicationBindRequest:
return encodeBindResponse(messageID, LDAPResultProtocolError)
case ApplicationSearchRequest:
return encodeSearchDone(messageID, LDAPResultProtocolError)
case ApplicationModifyRequest:
return encodeLDAPResponse(messageID, ApplicationModifyResponse, LDAPResultProtocolError, LDAPResultCodeMap[LDAPResultProtocolError])
case ApplicationAddRequest:
return encodeLDAPResponse(messageID, ApplicationAddResponse, LDAPResultProtocolError, LDAPResultCodeMap[LDAPResultProtocolError])
case ApplicationDelRequest:
return encodeLDAPResponse(messageID, ApplicationDelResponse, LDAPResultProtocolError, LDAPResultCodeMap[LDAPResultProtocolError])
case ApplicationModifyDNRequest:
return encodeLDAPResponse(messageID, ApplicationModifyDNResponse, LDAPResultProtocolError, LDAPResultCodeMap[LDAPResultProtocolError])
case ApplicationCompareRequest:
return encodeLDAPResponse(messageID, ApplicationCompareResponse, LDAPResultProtocolError, LDAPResultCodeMap[LDAPResultProtocolError])
case ApplicationExtendedRequest:
return encodeLDAPResponse(messageID, ApplicationExtendedResponse, LDAPResultProtocolError, LDAPResultCodeMap[LDAPResultProtocolError])
default:
return nil
}
}

func routeFunc(dn string, funcNames []string) string {
bestPick := ""
bestPickWeight := 0
Expand Down