mirror of https://github.com/OpenIdentityPlatform/OpenDJ.git

Jean-Noel Rouvignac
25.21.2013 fe4d6b1f8ee49c858ca2644851377ba2402d9509
refs
author Jean-Noel Rouvignac <jean-noel.rouvignac@forgerock.com>
Thursday, July 25, 2013 15:21 +0200
committer Jean-Noel Rouvignac <jean-noel.rouvignac@forgerock.com>
Thursday, July 25, 2013 15:21 +0200
commitfe4d6b1f8ee49c858ca2644851377ba2402d9509
tree c15bac57e8dacf1d27e9d39c4baec1d73f5eb435 tree | zip | gz
parent 2c7af8129bbd29fb3c7c29923b438475a9e928dd view | diff
OPENDJ-948 (CR-1873) unauthorized disclosure of directory contents 

This commit addresses information disclosure for:

- result code: change from info disclosing result codes to a default result code that hides the ACI-protected info to the current operation.
- error message (additional information): any message containing the entryDN will be filtered out if the entryDN is ACI-protected.
- matchedDN: check whether the matchedDN is ACI-protected
- debugsearchindex


Information disclosing result code and error message are now saved as masked result code and masked message and are logged as such when they are present.



config.ldif:
Added "debugsearchindex" to an ACI to prevent Anonymous Read Access. If this is not enough, then we would need to create a new ACI.


AccessControlHandler.java:
Added canDiscloseInformation().

Operation.java, AbstractOperation.java, OperationWrapper.java:
Added getMaskedResultCode(), setMaskedResultCode(), getMaskedErrorMessage(), setMaskedErrorMessage(), appendMaskedErrorMessage().
In setReponseData(), copied the masked result code and error message.

DirectoryException.java:
Added getMaskedResultCode(), setMaskedResultCode(), getMaskedErrorMessage(), setMaskedErrorMessage().

LocalBackendWorkflowElement.java:
Used javadocs.
Created method newDirectoryException(), setResultCodeAndMessageNoInfoDisclosure() and filterNonDisclosableMatchedDN().

LocalBackend*Operation.java:
Added setResultCodeAndMessageNoInfoDisclosure() and newDirectoryException() forwarding to the corresponding LocalBackendWorkflowElement methods + extensively made use of these methods.
In processLocal*() methods, added a try/finally to call LocalBackendWorkflowElement.filterNonDisclosableMatchedDN().
Moved some blocks of code under the protection of try/catch blocks to ensure proper error handling when calling the exception throwing setResultCodeAndMessageNoInfoDisclosure() + as a consequence, moved some null checks to the finally blocks.
Removed some try/catch duplicating outer try/catch blocks.

LocalBackendModifyOperation.java:
In processLocalModify(), removed try/catch around checkWritability() because catch is duplicated with outer try/catch.
Used StaticUtils.collectionToString().

TextAccessLogPublisher.java:
Renamed appendMessage() into appendResultCodeAndMessage() + integrated there logging of "result" + added logging of "maskedResult" and "maskedMessage".
15 files modified
1401 ■■■■■ changed files
opends/resource/config/config.ldif 2 ●●● diff | view | raw | blame | history
opends/src/server/org/opends/server/api/AccessControlHandler.java 37 ●●●●● diff | view | raw | blame | history
opends/src/server/org/opends/server/core/OperationWrapper.java 42 ●●●●● diff | view | raw | blame | history
opends/src/server/org/opends/server/loggers/TextAccessLogPublisher.java 63 ●●●●● diff | view | raw | blame | history
opends/src/server/org/opends/server/types/AbstractOperation.java 84 ●●●● diff | view | raw | blame | history
opends/src/server/org/opends/server/types/DirectoryException.java 85 ●●●● diff | view | raw | blame | history
opends/src/server/org/opends/server/types/Operation.java 46 ●●●●● diff | view | raw | blame | history
opends/src/server/org/opends/server/workflowelement/localbackend/LocalBackendAddOperation.java 164 ●●●●● diff | view | raw | blame | history
opends/src/server/org/opends/server/workflowelement/localbackend/LocalBackendCompareOperation.java 119 ●●●●● diff | view | raw | blame | history
opends/src/server/org/opends/server/workflowelement/localbackend/LocalBackendDeleteOperation.java 133 ●●●●● diff | view | raw | blame | history
opends/src/server/org/opends/server/workflowelement/localbackend/LocalBackendModifyDNOperation.java 176 ●●●●● diff | view | raw | blame | history
opends/src/server/org/opends/server/workflowelement/localbackend/LocalBackendModifyOperation.java 222 ●●●●● diff | view | raw | blame | history
opends/src/server/org/opends/server/workflowelement/localbackend/LocalBackendSearchOperation.java 41 ●●●●● diff | view | raw | blame | history
opends/src/server/org/opends/server/workflowelement/localbackend/LocalBackendWorkflowElement.java 185 ●●●● diff | view | raw | blame | history
opends/tests/unit-tests-testng/src/server/org/opends/server/authorization/dseecompat/TargetControlTestCase.java 2 ●●● diff | view | raw | blame | history