[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

Re: [Patch] Subversion 1.5 SASL doesn't work correctly with Kerberos cross-realm authentication

From: Alec Kloss <alec-svn-keyword-bare.330a49_at_setfilepointer.com>
Date: Sat, 21 Mar 2009 07:07:40 -0500

I once pined:

On 2008-08-12 14:00, Alec Kloss wrote:
> First off, Subversion's code is lovely to read.
>
> The subject pretty much says it all. The SASL support in
> Subversion 1.5 blindly removes realm specifiers from the user's
> authentication.
>
> There's a seatbelt early in cyrus_auth.c which protects against
> security problems associated with removing the realm as described
> by this comment:
>
> /* The only valid realm is user_realm (i.e. the repository's realm).
> If the user gave us another realm, complain. */
>
> Later, at the end of cyrus_auth_request() the realm is yanked off
> of the authenticated user, which creates the potential security
> issue that the seatbelt in cyrus_auth.c is protecting against:
>
> if ((p = strchr(user, '@')) != NULL)
> /* Drop the realm part. */
> b->user = apr_pstrndup(b->pool, user, p - (char *)user);
> else
>
> I guess I'd propose changing the default behavior to allow
> cross-realm and strip the realm part off in cyrus_auth_request()
> if-and-only-if it matches the configured "user_realm". I'd like to
> see a flag to disable the stripping of the realm entirely, as
> people with lots of cross-realm will almost certainly prefer that.
>
> (And while I'm commenting, has no one looked into logging in
> svnserve since 2005? It's kinda a big thing to be missing, at
> least among the paranoid.)

Please see attached patch. It works against 1.6.0 and trunk r36738.

-- 
Alec Kloss  alec_at_SetFilePointer.com   IM: daemonalec_at_gmail.com
PGP key at http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xA241980E
"No Bunny!" -- Simon, http://wiki.adultswim.com/xwiki/bin/Frisky+Dingo/Simon

  • application/pgp-signature attachment: stored
Received on 2009-03-21 13:23:40 CET

This is an archived mail posted to the Subversion Dev mailing list.

This site is subject to the Apache Privacy Policy and the Apache Public Forum Archive Policy.