18371587892

Committed 09 Oct 2025 09:19AM UTC coverage: 64.106% (-0.03%) from 64.136%

Build # 18371587892

Build Type

Pull #16225

github

Committed by

web-flow

Commit Message

Merge 6d95f2fdb into 152db0df0

Pull Request Pull Request #16225: auth: logic botch in ldap backend

Run Details

42785 of 101504 branches covered (42.15%)

Branch coverage included in aggregate %.

0 of 24 new or added lines in 2 files covered. (0.0%)

94 existing lines in 16 files now uncovered.

129869 of 167822 relevant lines covered (77.38%)

5474348.22 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/modules/ldapbackend/primary.cc

/*
 * This file is part of PowerDNS or dnsdist.
 * Copyright -- PowerDNS.COM B.V. and its contributors
 * originally authored by Norbert Sendetzky
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
 * published by the Free Software Foundation.
 *
 * In addition, for the avoidance of any doubt, permission is granted to
 * link this program with OpenSSL and to (re)distribute the binaries
 * produced as the result of such linking.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
#include "exceptions.hh"
#include "ldapbackend.hh"
#include <cstdlib>

void LdapBackend::getUpdatedPrimaries(vector<DomainInfo>& domains, std::unordered_set<DNSName>& catalogs, CatalogHashMap& catalogHashes)
{
  string filter;
  PowerLDAP::SearchResult::Ptr search;
  PowerLDAP::sentry_t result;
  const char* attronly[] = {
    "associatedDomain",
    NULL};

  try {
    // First get all domains on which we are primary.
    filter = strbind(":target:", "&(SOARecord=*)(PdnsDomainId=*)", getArg("filter-axfr"));
    search = d_pldap->search(getArg("basedn"), LDAP_SCOPE_SUBTREE, filter, attronly);
  }
  catch (LDAPTimeout& lt) {
    g_log << Logger::Warning << d_myname << " Unable to search LDAP directory: " << lt.what() << endl;
    throw DBException("LDAP server timeout");
  }
  catch (LDAPNoConnection& lnc) {
    g_log << Logger::Warning << d_myname << " Connection to LDAP lost, trying to reconnect" << endl;
    if (reconnect()) {
      return this->getUpdatedPrimaries(domains, catalogs, catalogHashes);
    }
    throw PDNSException("Failed to reconnect to LDAP server");
  }
  catch (LDAPException& le) {
    g_log << Logger::Error << d_myname << " Unable to search LDAP directory: " << le.what() << endl;
    throw PDNSException("LDAP server unreachable"); // try to reconnect to another server
  }
  catch (std::exception& e) {
    throw DBException("STL exception");
  }

  while (search->getNext(result)) {
    if (!result.count("associatedDomain") || result["associatedDomain"].empty())
      continue;

    DomainInfo di;
    if (!getDomainInfo(ZoneName(result["associatedDomain"][0]), di)) {
      continue;
    }

    if (di.notified_serial < di.serial)
      domains.push_back(di);
  }
}

// NOLINTNEXTLINE(readability-identifier-length)
void LdapBackend::setNotified(domainid_t id, uint32_t serial)
{
  string filter;
  PowerLDAP::SearchResult::Ptr search;
  PowerLDAP::sresult_t results;
  PowerLDAP::sentry_t entry;
  const char* attronly[] = {"associatedDomain", NULL};

  try {
    // Try to find the notified domain
    filter = strbind(":target:", "PdnsDomainId=" + std::to_string(id), getArg("filter-axfr"));
    search = d_pldap->search(getArg("basedn"), LDAP_SCOPE_SUBTREE, filter, attronly);
    search->getAll(results, true);
  }
  catch (LDAPTimeout& lt) {
    g_log << Logger::Warning << d_myname << " Unable to search LDAP directory: " << lt.what() << endl;
    throw DBException("LDAP server timeout");
  }
  catch (LDAPNoConnection& lnc) {
    g_log << Logger::Warning << d_myname << " Connection to LDAP lost, trying to reconnect" << endl;
    if (reconnect()) {
      this->setNotified(id, serial);
      return;
    }
    throw PDNSException("Failed to reconnect to LDAP server");
  }
  catch (LDAPException& le) {
    g_log << Logger::Error << d_myname << " Unable to search LDAP directory: " << le.what() << endl;
    throw PDNSException("LDAP server unreachable"); // try to reconnect to another server
  }
  catch (std::exception& e) {
    throw DBException("STL exception");
  }

  if (results.empty())
    throw PDNSException("No results found when trying to update domain notified_serial for ID " + std::to_string(id));

  entry = results.front();
  string dn = entry["dn"][0];
  string serialStr = std::to_string(serial);
  LDAPMod* mods[2];
  LDAPMod mod;
  char* vals[2];

  mod.mod_op = LDAP_MOD_REPLACE;
  mod.mod_type = (char*)"PdnsDomainNotifiedSerial";
  vals[0] = const_cast<char*>(serialStr.c_str());
  vals[1] = NULL;
  mod.mod_values = vals;

  mods[0] = &mod;
  mods[1] = NULL;

  try {
    d_pldap->modify(dn, mods);
  }
  catch (LDAPNoConnection& lnc) {
    g_log << Logger::Warning << d_myname << " Connection to LDAP lost, trying to reconnect" << endl;
    if (reconnect()) {
      this->setNotified(id, serial);
      return;
    }
    throw PDNSException("Failed to reconnect to LDAP server");
  }
  catch (LDAPException& le) {
    g_log << Logger::Error << d_myname << " Unable to search LDAP directory: " << le.what() << endl;
    throw PDNSException("LDAP server unreachable"); // try to reconnect to another server
  }
  catch (std::exception& e) {
    throw DBException("STL exception");
  }
}

1	/*
2	* This file is part of PowerDNS or dnsdist.
3	* Copyright -- PowerDNS.COM B.V. and its contributors
4	* originally authored by Norbert Sendetzky
5	*
6	* This program is free software; you can redistribute it and/or modify
7	* it under the terms of version 2 of the GNU General Public License as
8	* published by the Free Software Foundation.
9	*
10	* In addition, for the avoidance of any doubt, permission is granted to
11	* link this program with OpenSSL and to (re)distribute the binaries
12	* produced as the result of such linking.
13	*
14	* This program is distributed in the hope that it will be useful,
15	* but WITHOUT ANY WARRANTY; without even the implied warranty of
16	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17	* GNU General Public License for more details.
18	*
19	* You should have received a copy of the GNU General Public License
20	* along with this program; if not, write to the Free Software
21	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
22	*/
23	#include "exceptions.hh"
24	#include "ldapbackend.hh"
25	#include <cstdlib>
26
27	void LdapBackend::getUpdatedPrimaries(vector<DomainInfo>& domains, std::unordered_set<DNSName>& catalogs, CatalogHashMap& catalogHashes)
28	{	×
29	string filter;	×
30	PowerLDAP::SearchResult::Ptr search;	×
31	PowerLDAP::sentry_t result;	×
32	const char* attronly[] = {	×
33	"associatedDomain",	×
34	NULL};	×
35
36	try {	×
37	// First get all domains on which we are primary.
38	filter = strbind(":target:", "&(SOARecord=)(PdnsDomainId=)", getArg("filter-axfr"));	×
39	search = d_pldap->search(getArg("basedn"), LDAP_SCOPE_SUBTREE, filter, attronly);	×
40	}	×
41	catch (LDAPTimeout& lt) {	×
42	g_log << Logger::Warning << d_myname << " Unable to search LDAP directory: " << lt.what() << endl;	×
43	throw DBException("LDAP server timeout");	×
44	}	×
45	catch (LDAPNoConnection& lnc) {	×
46	g_log << Logger::Warning << d_myname << " Connection to LDAP lost, trying to reconnect" << endl;	×
NEW 47	if (reconnect()) {	×
NEW 48	return this->getUpdatedPrimaries(domains, catalogs, catalogHashes);	×
NEW 49	}	×
NEW 50	throw PDNSException("Failed to reconnect to LDAP server");	×
51	}	×
52	catch (LDAPException& le) {	×
53	g_log << Logger::Error << d_myname << " Unable to search LDAP directory: " << le.what() << endl;	×
54	throw PDNSException("LDAP server unreachable"); // try to reconnect to another server	×
55	}	×
56	catch (std::exception& e) {	×
57	throw DBException("STL exception");	×
58	}	×
59
60	while (search->getNext(result)) {	×
61	if (!result.count("associatedDomain") \|\| result["associatedDomain"].empty())	×
62	continue;	×
63
64	DomainInfo di;	×
65	if (!getDomainInfo(ZoneName(result["associatedDomain"][0]), di)) {	×
66	continue;	×
67	}	×
68
69	if (di.notified_serial < di.serial)	×
70	domains.push_back(di);	×
71	}	×
72	}	×
73
74	// NOLINTNEXTLINE(readability-identifier-length)
75	void LdapBackend::setNotified(domainid_t id, uint32_t serial)
76	{	×
77	string filter;	×
78	PowerLDAP::SearchResult::Ptr search;	×
79	PowerLDAP::sresult_t results;	×
80	PowerLDAP::sentry_t entry;	×
81	const char* attronly[] = {"associatedDomain", NULL};	×
82
83	try {	×
84	// Try to find the notified domain
85	filter = strbind(":target:", "PdnsDomainId=" + std::to_string(id), getArg("filter-axfr"));	×
86	search = d_pldap->search(getArg("basedn"), LDAP_SCOPE_SUBTREE, filter, attronly);	×
87	search->getAll(results, true);	×
88	}	×
89	catch (LDAPTimeout& lt) {	×
90	g_log << Logger::Warning << d_myname << " Unable to search LDAP directory: " << lt.what() << endl;	×
91	throw DBException("LDAP server timeout");	×
92	}	×
93	catch (LDAPNoConnection& lnc) {	×
94	g_log << Logger::Warning << d_myname << " Connection to LDAP lost, trying to reconnect" << endl;	×
NEW 95	if (reconnect()) {	×
96	this->setNotified(id, serial);	×
NEW 97	return;	×
NEW 98	}	×
NEW 99	throw PDNSException("Failed to reconnect to LDAP server");	×
100	}	×
101	catch (LDAPException& le) {	×
102	g_log << Logger::Error << d_myname << " Unable to search LDAP directory: " << le.what() << endl;	×
103	throw PDNSException("LDAP server unreachable"); // try to reconnect to another server	×
104	}	×
105	catch (std::exception& e) {	×
106	throw DBException("STL exception");	×
107	}	×
108
109	if (results.empty())	×
110	throw PDNSException("No results found when trying to update domain notified_serial for ID " + std::to_string(id));	×
111
112	entry = results.front();	×
113	string dn = entry["dn"][0];	×
114	string serialStr = std::to_string(serial);	×
115	LDAPMod* mods[2];	×
116	LDAPMod mod;	×
117	char* vals[2];	×
118
119	mod.mod_op = LDAP_MOD_REPLACE;	×
120	mod.mod_type = (char*)"PdnsDomainNotifiedSerial";	×
121	vals[0] = const_cast<char*>(serialStr.c_str());	×
122	vals[1] = NULL;	×
123	mod.mod_values = vals;	×
124
125	mods[0] = &mod;	×
126	mods[1] = NULL;	×
127
128	try {	×
129	d_pldap->modify(dn, mods);	×
130	}	×
131	catch (LDAPNoConnection& lnc) {	×
132	g_log << Logger::Warning << d_myname << " Connection to LDAP lost, trying to reconnect" << endl;	×
NEW 133	if (reconnect()) {	×
134	this->setNotified(id, serial);	×
NEW 135	return;	×
NEW 136	}	×
NEW 137	throw PDNSException("Failed to reconnect to LDAP server");	×
138	}	×
139	catch (LDAPException& le) {	×
140	g_log << Logger::Error << d_myname << " Unable to search LDAP directory: " << le.what() << endl;	×
141	throw PDNSException("LDAP server unreachable"); // try to reconnect to another server	×
142	}	×
143	catch (std::exception& e) {	×
144	throw DBException("STL exception");	×
145	}	×
146	}	×

PowerDNS / pdns / 18371587892

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous