I have created Issue #3394 and attached the proposed patch.
Gavin.
On 21/03/2009, at 11:07 PM, Alec Kloss wrote:
> I once pined:
>
> On 2008-08-12 14:00, Alec Kloss wrote:
>> First off, Subversion's code is lovely to read.
>>
>> The subject pretty much says it all. The SASL support in
>> Subversion 1.5 blindly removes realm specifiers from the user's
>> authentication.
>>
>> There's a seatbelt early in cyrus_auth.c which protects against
>> security problems associated with removing the realm as described
>> by this comment:
>>
>> /* The only valid realm is user_realm (i.e. the repository's
>> realm).
>> If the user gave us another realm, complain. */
>>
>> Later, at the end of cyrus_auth_request() the realm is yanked off
>> of the authenticated user, which creates the potential security
>> issue that the seatbelt in cyrus_auth.c is protecting against:
>>
>> if ((p = strchr(user, '@')) != NULL)
>> /* Drop the realm part. */
>> b->user = apr_pstrndup(b->pool, user, p - (char *)user);
>> else
>>
>> I guess I'd propose changing the default behavior to allow
>> cross-realm and strip the realm part off in cyrus_auth_request()
>> if-and-only-if it matches the configured "user_realm". I'd like to
>> see a flag to disable the stripping of the realm entirely, as
>> people with lots of cross-realm will almost certainly prefer that.
>>
>> (And while I'm commenting, has no one looked into logging in
>> svnserve since 2005? It's kinda a big thing to be missing, at
>> least among the paranoid.)
>
> Please see attached patch. It works against 1.6.0 and trunk r36738.
>
> --
> Alec Kloss alec_at_SetFilePointer.com IM: daemonalec_at_gmail.com
> PGP key at http://pgp.mit.edu:11371/pks/lookup?
> op=get&search=0xA241980E
> "No Bunny!" -- Simon, http://wiki.adultswim.com/xwiki/bin/Frisky+Dingo/Simon
> <sasl-patch.txt>
------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=462&dsMessageId=1605348
Received on 2009-04-09 02:54:43 CEST