fix aci bypass, mem leak, url validation

Author: jchapma

ldap/servers/slapd/hibp_client.c

@@ -358,6 +358,7 @@ hibp_query_api(const char *prefix, const char *api_url, HIBPResponse *response,
     if (curl_easy_setopt(curl, CURLOPT_URL, url) != CURLE_OK ||
         curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, hibp_write_callback) != CURLE_OK ||
         curl_easy_setopt(curl, CURLOPT_WRITEDATA, response) != CURLE_OK ||
+        curl_easy_setopt(curl, CURLOPT_PROTOCOLS, CURLPROTO_HTTPS) != CURLE_OK ||
         curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L) != CURLE_OK ||
         curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L) != CURLE_OK) {
         slapi_log_err(SLAPI_LOG_ERR, "hibp_query_api",

ldap/servers/slapd/libglobs.c

@@ -3829,9 +3829,14 @@ config_set_pw_breach_check(const char *attrname, char *value, char *errorbuf, in
     slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
 
 #ifndef ENABLE_HIBP
-    if (apply && value && strcasecmp(value, "on") == 0) {
-        slapi_log_err(SLAPI_LOG_WARNING, "config_set_pw_breach_check",
-                      "HIBP breached password checking not enabled - passwordBreachCheck has no effect\n");
+    if (value && strcasecmp(value, "on") == 0) {
+        slapi_create_errormsg(errorbuf, SLAPI_DSE_RETURNTEXT_SIZE,
+                              "%s: HIBP breached password checking is not available. "
+                              "Rebuild with --enable-hibp to enable this feature.", attrname);
+        slapi_log_err(SLAPI_LOG_ERR, "config_set_pw_breach_check",
+                      "HIBP breached password checking is not available - "
+                      "rebuild with --enable-hibp to enable this feature\n");
+        return LDAP_UNWILLING_TO_PERFORM;
     }
 #endif
 
@@ -3849,18 +3854,37 @@ config_set_pw_breach_url(const char *attrname, char *value, char *errorbuf, int
 {
     int32_t retVal = LDAP_SUCCESS;
     slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
+    size_t len;
 
 #ifndef ENABLE_HIBP
     if (apply && value && strlen(value) > 0) {
         slapi_log_err(SLAPI_LOG_WARNING, "config_set_pw_breach_url",
-                      "HIBP breached password checking not enabled  - passwordBreachDbUrl has no effect\n");
+                      "HIBP breached password checking not enabled - passwordBreachDbUrl has no effect\n");
     }
 #endif
 
     if (config_value_is_null(attrname, value, errorbuf, 0)) {
         value = NULL;
     }
 
+    /* Validate URL if provided */
+    if (value && strlen(value) > 0) {
+        /* Require https:// endpoint for security */
+        if (strncasecmp(value, "https://", 8) != 0) {
+            slapi_create_errormsg(errorbuf, SLAPI_DSE_RETURNTEXT_SIZE,
+                                  "%s: URL must use https://", attrname);
+            return LDAP_UNWILLING_TO_PERFORM;
+        }
+        /* Require trailing slash for correct URL construction */
+        len = strlen(value);
+        if (value[len - 1] != '/') {
+            slapi_create_errormsg(errorbuf, SLAPI_DSE_RETURNTEXT_SIZE,
+                                  "%s: URL must end with a trailing slash (e.g., https://api.pwnedpasswords.com/range/)",
+                                  attrname);
+            return LDAP_UNWILLING_TO_PERFORM;
+        }
+    }
+
     if (apply) {
         CFG_LOCK_WRITE(slapdFrontendConfig);
         slapi_ch_free_string(&slapdFrontendConfig->pw_policy.pw_breach_db_url);

ldap/servers/slapd/modify.c

@@ -1306,38 +1306,6 @@ op_shared_allow_pw_change(Slapi_PBlock *pb, LDAPMod *mod, char **old_pw, Slapi_M
     pwpolicy = new_passwdPolicy(pb, (char *)slapi_sdn_get_ndn(&sdn));
     internal_op = operation_is_flag_set(operation, OP_FLAG_INTERNAL);
 
-#ifdef ENABLE_HIBP
-    /* Check all passwords against breach database before any other checks */
-    if (pwpolicy->pw_check_breach && mod->mod_bvalues) {
-        Slapi_Value **breach_vals = NULL;
-        valuearray_init_bervalarray(mod->mod_bvalues, &breach_vals);
-        if (breach_vals) {
-            for (size_t i = 0; breach_vals[i] != NULL; i++) {
-                const char *pwd = slapi_value_get_string(breach_vals[i]);
-                if (pwd && !slapi_is_encoded((char *)pwd)) {
-                    int breach_count = hibp_check_password(pwd, pwpolicy);
-                    if (breach_count > 0) {
-                        slapi_log_err(SLAPI_LOG_WARNING, "op_shared_allow_pw_change",
-                            "Rejecting password for %s - found in breach database (%d occurrences)\n",
-                            dn, breach_count);
-                        if (pwresponse_req == 1) {
-                            slapi_pwpolicy_make_response_control(pb, -1, -1, LDAP_PWPOLICY_INVALIDPWDSYNTAX);
-                        }
-                        send_ldap_result(pb, LDAP_CONSTRAINT_VIOLATION, NULL,
-                            "Password found in breach database - choose a different password", 0, NULL);
-                        valuearray_free(&breach_vals);
-                        rc = -1;
-                        goto done;
-                    } else if (breach_count < 0) {
-                        slapi_log_err(SLAPI_LOG_WARNING, "op_shared_allow_pw_change",
-                            "Failed to check password against breach database for %s\n", dn);
-                    }
-                }
-            }
-            valuearray_free(&breach_vals);
-        }
-    }
-#endif
     /* internal operation has root permissions for subtrees it is allowed to access */
     if (!internal_op) {
         /* slapi_acl_check_mods needs an array of LDAPMods, but
@@ -1392,6 +1360,43 @@ op_shared_allow_pw_change(Slapi_PBlock *pb, LDAPMod *mod, char **old_pw, Slapi_M
         /* done with slapi entry e */
         slapi_search_get_entry_done(&entry_pb);
 
+#ifdef ENABLE_HIBP
+        /*
+         * Check password against breach database after ACI validation.
+         */
+        if (!SLAPI_IS_MOD_DELETE(mod->mod_op) &&
+            !pw_is_pwp_admin(pb, pwpolicy, PWP_ADMIN_OR_ROOTDN) &&
+            pwpolicy->pw_check_breach && mod->mod_bvalues) {
+            Slapi_Value **breach_vals = NULL;
+            valuearray_init_bervalarray(mod->mod_bvalues, &breach_vals);
+            if (breach_vals) {
+                for (size_t i = 0; breach_vals[i] != NULL; i++) {
+                    const char *pwd = slapi_value_get_string(breach_vals[i]);
+                    if (pwd && !slapi_is_encoded((char *)pwd)) {
+                        int breach_count = hibp_check_password(pwd, pwpolicy);
+                        if (breach_count > 0) {
+                            slapi_log_err(SLAPI_LOG_PWDPOLICY, PWDPOLICY_DEBUG,
+                                "Rejecting password for %s - found in breach database (%d occurrences)\n",
+                                dn, breach_count);
+                            if (pwresponse_req == 1) {
+                                slapi_pwpolicy_make_response_control(pb, -1, -1, LDAP_PWPOLICY_INVALIDPWDSYNTAX);
+                            }
+                            send_ldap_result(pb, LDAP_CONSTRAINT_VIOLATION, NULL,
+                                "Password found in breach database - choose a different password", 0, NULL);
+                            valuearray_free(&breach_vals);
+                            rc = -1;
+                            goto done;
+                        } else if (breach_count < 0) {
+                            slapi_log_err(SLAPI_LOG_WARNING, "op_shared_allow_pw_change",
+                                "Failed to check password against breach database for %s\n", dn);
+                        }
+                    }
+                }
+                valuearray_free(&breach_vals);
+            }
+        }
+#endif
+
         /*
          * If this mod is being performed by a password administrator/rootDN,
          * just return success.

ldap/servers/slapd/pw.c

@@ -2513,6 +2513,7 @@ delete_passwdPolicy(passwdPolicy **pwpolicy)
             slapi_ch_free_string(&(*(*pwpolicy)).pw_bad_words);
             slapi_ch_array_free((*(*pwpolicy)).pw_cmp_attrs_array);
             slapi_ch_free_string(&(*(*pwpolicy)).pw_cmp_attrs);
+            slapi_ch_free_string(&(*(*pwpolicy)).pw_breach_db_url);
         }
         slapi_ch_free_string(&(*(*pwpolicy)).pw_local_dn);
         slapi_ch_free((void **)pwpolicy);