OpenSAF / Tickets / #1009 IMM: Validation done for 'longDnsAllowed' needs to be improved.

Anders Bjornerstedt - 2014-09-04

status: assigned --> accepted
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Description has changed:

Diff:

--- old
+++ new
@@ -1,18 +1,21 @@
-The attribute 'londDnsAllowed' in the object class 'openSafImm' for the
-single object 'opensafImm=opensafImm,safApp=safImmService' needs to be
+Validation for the attribute 'londDnsAllowed' in the class 'openSafImm'
+for the single object 'opensafImm=opensafImm,safApp=safImmService' needs to be
 improved. Curently a local validation is made as part of ccbObjectModify
 that checks that if longDnsAllowed is changed to '0' meaning no long DNs
 are allowed, that no object exists with a long DN.

-This has two holes: 
-1) It misses attributes of type SaNameT that contain a dangling reference,
-i.e. a DN that currently matches no object in the daabas. Such attributes can
+But this misses attributes of type SaNameT that contain a dangling reference,
+i.e. a DN that currently matches no object in the database. The value may then
+be a long DN without any such object existing. Such attributes can
 be fetched by users and if longDnsAllowed is false, then the user should never
 be exposed to a long DN from IMM.

-2) Global validation is really needed here. That is the validation needs to
-be done as part of apply/completed. This since it is theoretically possible
-for the *same* CCB (that disallows longDNs) in a later operation to add
-an object with a long DN or a dangling reference containing a long DN.
-The risk for this should be very low since typically the disabling of longDns
-will not be done in a CCB that also creates and modifies other objects.
+Classic validation against longDnsAllowed as part of apply/completed is
+actually not needed. This because it is covered by the 'ccbIdLongDnGuard'.
+This is a static boolean set to true as soon as a ccb adds a modify
+operation that proposes to set the config attribute 'longDnsAllowed' to true
+(non-zero). A global check is made there and then that no long Dns exists
+in the IMM. After this and untill this ccb commits or aborts, the
+ccbIdLongDnGuard will stop any ccb from adding long Dns already in the
+operation phase (crreate or modify). 
+

Hans Feldt - 2014-09-04

please also reject all changes to the IMM service object by non root users

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anders Bjornerstedt - 2014-09-05

status: accepted --> review
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anders Bjornerstedt - 2014-09-05

https://sourceforge.net/p/opensaf/mailman/message/32799986/

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anders Bjornerstedt - 2014-09-05

Priority: minor --> major
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anders Bjornerstedt - 2014-09-09

status: review --> fixed
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anders Bjornerstedt - 2014-09-09

changeset: 5753:a070c5206574
tag: tip
user: Anders Bjornerstedt anders.bjornerstedt@ericsson.com
date: Fri Sep 05 16:18:42 2014 +0200
summary: #1009 IMM: Only allow root users to modify imm service objects.

changeset: 5752:9a34520be67f
parent: 5749:4e114380bc34
user: Anders Bjornerstedt anders.bjornerstedt@ericsson.com
date: Tue Sep 09 12:11:21 2014 +0200
summary: #1009 IMM: Add checks of all reference attributes when zeroing longDnsAllowed

changeset: 5751:e76a6a91e564
branch: opensaf-4.5.x
user: Anders Bjornerstedt anders.bjornerstedt@ericsson.com
date: Fri Sep 05 16:18:42 2014 +0200
summary: #1009 IMM: Only allow root users to modify imm service objects.

changeset: 5750:275423dcea16
branch: opensaf-4.5.x
parent: 5748:34dd92423752
user: Anders Bjornerstedt anders.bjornerstedt@ericsson.com
date: Tue Sep 09 12:11:21 2014 +0200
summary: #1009 IMM: Add checks of all reference attributes when zeroing longDnsAllowed

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anders Bjornerstedt - 2014-10-03

status: fixed --> assigned
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anders Bjornerstedt - 2014-10-03

When transitioning 'longDnsAllowed' from 1 to 0, there also needs to be a check on RDN length never exceeding 64 bytes.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anders Bjornerstedt - 2014-10-03

status: assigned --> accepted
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anders Bjornerstedt - 2014-10-07

status: accepted --> review
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anders Bjornerstedt - 2014-10-07

https://sourceforge.net/p/opensaf/mailman/message/32905179/

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anders Bjornerstedt - 2014-10-07

Milestone: 4.5.0 --> 4.5.1
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anders Bjornerstedt - 2014-10-08

status: review --> fixed
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anders Bjornerstedt - 2014-10-08

changeset: 6020:f4d653dcd2cb
tag: tip
parent: 6018:1b4c8e3fee0f
user: Anders Bjornerstedt anders.bjornerstedt@ericsson.com
date: Tue Oct 07 13:53:42 2014 +0200
summary: IMM: Validating longDnsAllowed=0 checks normal RDNs are at most 64 bytes [#1009]

changeset: 6019:3d0fc4b03f9e
branch: opensaf-4.5.x
parent: 6012:c315f4b53f92
user: Anders Bjornerstedt anders.bjornerstedt@ericsson.com
date: Tue Oct 07 13:53:42 2014 +0200
summary: IMM: Validating longDnsAllowed=0 checks normal RDNs are at most 64 bytes [#1009]

Related

Tickets: ~~#1009~~

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

IMM: Validation done for 'longDnsAllowed' needs to be improved.

Milestone

Searches

Help

#1009 IMM: Validation done for 'longDnsAllowed' needs to be improved.

Related

Discussion

Related