NetBSD Problem Report #50057

From Wolfgang.Stukenbrock@nagler-company.com  Fri Jul 17 11:33:58 2015
Return-Path: <Wolfgang.Stukenbrock@nagler-company.com>
Received: from mail.netbsd.org (mail.netbsd.org [149.20.53.66])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "mail.netbsd.org", Issuer "Postmaster NetBSD.org" (verified OK))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 76AC7A65B9
	for <gnats-bugs@gnats.NetBSD.org>; Fri, 17 Jul 2015 11:33:58 +0000 (UTC)
Message-Id: <20150717102021.0298225C2EB@s010.nagler-company.com>
Date: Fri, 17 Jul 2015 12:20:20 +0200 (CEST)
From: Wolfgang.Stukenbrock@nagler-company.com
Reply-To: Wolfgang.Stukenbrock@nagler-company.com
To: gnats-bugs@gnats.NetBSD.org
Subject: yp-map transfer removes SECURE-flag
X-Send-Pr-Version: 3.95

>Number:         50057
>Category:       bin
>Synopsis:       yp-map transfer removes SECURE-flag
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    bin-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jul 17 11:35:00 +0000 2015
>Closed-Date:    Thu Aug 10 23:46:02 +0000 2017
>Last-Modified:  Thu Aug 10 23:46:02 +0000 2017
>Originator:     Wolfgang Stukenbrock
>Release:        NetBSD 6.1
>Organization:
Dr. Nagler & Company GmbH
>Environment:


System: NetBSD s010 6.1 NetBSD 6.1 (NSW-VM) #8: Mon Jul 14 10:19:49 CEST 2014 tsdauche@s012:/export/NetBSD-6.1/N+C-build/.OBJDIR_amd64/export/NetBSD-6.1/src/sys/arch/amd64/compile/NSW-VM amd64
Architecture: x86_64
Machine: amd64
>Description:
	When transfering a SECURE yp-map to a slave server (both NetBSD 6.1) the SECURE-flag gets lost.
>How-To-Repeat:
	Setup a YP-Master with a secure map and a YP-Slave server and transfer the map.

	Example - map on Master:

	s010# makedbm -u master.passwd.byname | head -4
	YP_LAST_MODIFIED 1435744801
	YP_MASTER_NAME s010.nagler-company.com
	YP_SECURE
	aabock aabock:XXXXXXXXXX:1097:1100::0:0:Alona Bock:/home/schn/aabock:/bin/sh

	Example - map on Slave after transfer - remark: no local ypserv running on test-system:

	test-s0# ypxfr -d N+C -h s010 master.passwd.byname
	test-s0# makedbm -u master.passwd.byname | head -4
	YP_LAST_MODIFIED 1435744801
	YP_MASTER_NAME s010.nagler-company.com
	aabock aabock:XXXXXXXXXX:1097:1100::0:0:Alona Bock:/home/schn/aabock:/bin/sh
	aakral aakral:XXXXXXXXXX:1311:1100::0:0:Attila Kral:/home/schn/aakral:/bin/sh

	remark: password fields replaced by XXXXXXXXXX
	remark: running 'ypcat master.passwd.byname' against the Slave-Server reports the information to any user
>Fix:
	The ypxfr programm uses yp_match_host() in function add_secure(). This tries to get the entry with
	YPPROC_MATCH and that fails, because ypserv does not accept any requet to YP-private entries.
	The following patch to /usr/src/usr.sbin/ypserv/ypserv/ypserv.c will fix this problem.
	It allows requesting YP-private map entries in a "ypmatch"-call when connected from a secure port.
	No "normal" client is affected.
	The patch uses the secure-flag of the map to avoid an additional call to securecheck() or to save
	the result of the previous call.

diff -u -r1.1 ypserv_proc.c
--- ypserv_proc.c       2015/07/10 09:24:06     1.1
+++ ypserv_proc.c       2015/07/10 09:26:47
@@ -166,7 +166,8 @@
        if (secure && securecheck(caller))
                res.status = YP_YPERR;
        else
-               res = ypdb_get_record(k->domain, k->map, k->keydat, FALSE);
+               /* fix transport of secure maps */
+               res = ypdb_get_record(k->domain, k->map, k->keydat, secure);

        return ((void *)&res);
 }

>Release-Note:

>Audit-Trail:
From: "Christos Zoulas" <christos@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/50057 CVS commit: src/usr.sbin/ypserv/ypserv
Date: Fri, 17 Jul 2015 11:58:01 -0400

 Module Name:	src
 Committed By:	christos
 Date:		Fri Jul 17 15:58:01 UTC 2015

 Modified Files:
 	src/usr.sbin/ypserv/ypserv: ypserv_proc.c

 Log Message:
 PR/50057: Wolfgang Stukenbrock: yp-map transfer removes SECURE-flag


 To generate a diff of this commit:
 cvs rdiff -u -r1.16 -r1.17 src/usr.sbin/ypserv/ypserv/ypserv_proc.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Soren Jacobsen" <snj@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/50057 CVS commit: [netbsd-7] src/usr.sbin/ypserv/ypserv
Date: Fri, 31 Jul 2015 17:06:56 +0000

 Module Name:	src
 Committed By:	snj
 Date:		Fri Jul 31 17:06:56 UTC 2015

 Modified Files:
 	src/usr.sbin/ypserv/ypserv [netbsd-7]: ypserv_proc.c

 Log Message:
 Pull up following revision(s) (requested by christos in ticket #919):
 	usr.sbin/ypserv/ypserv/ypserv_proc.c: revision 1.17
 PR/50057: Wolfgang Stukenbrock: yp-map transfer removes SECURE-flag


 To generate a diff of this commit:
 cvs rdiff -u -r1.16 -r1.16.20.1 src/usr.sbin/ypserv/ypserv/ypserv_proc.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->closed
State-Changed-By: ginsbach@NetBSD.org
State-Changed-When: Thu, 10 Aug 2017 23:46:02 +0000
State-Changed-Why:
christos committed fix; pulled up to netbsd-7. Thanks!


>Unformatted:

Home	PR Database Search