From f9c4e3a1617c18de11e8f631e7d3be5b154a9471 Mon Sep 17 00:00:00 2001
From: William Brown <firstyear@redhat.com>
Date: Tue, 5 Sep 2017 11:58:47 +1000
Subject: [PATCH] Ticket 49312 - pwdhash -D used default hash algo

Bug Description:  The "pwdhash -D configdir" command uses the default
hashing algorithm and neither the current value set in
nsslapd-rootpwstoragescheme nor passwordStorageScheme.

Fix Description:  pwenc.c did not correctly read the configuration
during slapd_init, as a result, despite loading all plugin types
from the instance, we would still ignore the rootpwscheme.

Because this command is often used to reset a root password hash
we think that having this read the root hash is appropriate.

https://pagure.io/389-ds-base/issue/49312

Author: wibrown

Review by: ???
---
 ldap/servers/slapd/tools/pwenc.c | 33 +++++++++++++++++++++++++++------
 1 file changed, 27 insertions(+), 6 deletions(-)

diff --git a/ldap/servers/slapd/tools/pwenc.c b/ldap/servers/slapd/tools/pwenc.c
index e1e1cfe..4d3a81a 100644
--- a/ldap/servers/slapd/tools/pwenc.c
+++ b/ldap/servers/slapd/tools/pwenc.c
@@ -214,7 +214,13 @@ main(int argc, char *argv[])
     }
 
     if (cmppwsp == NULL && pwsp == NULL) {
-        pwsp = pw_name2scheme(DEFAULT_PASSWORD_SCHEME_NAME);
+        if (slapdFrontendConfig != NULL) {
+            char *rootschemename = config_get_rootpwstoragescheme();
+            pwsp = pw_name2scheme(rootschemename);
+            free(rootschemename);
+        } else {
+            pwsp = pw_name2scheme(DEFAULT_PASSWORD_SCHEME_NAME);
+        }
     }
 
     if (argc <= optind) {
@@ -284,11 +290,13 @@ slapd_config(const char *configdir, const char *givenconfigfile)
     char *buf = 0;
     char *lastp = 0;
     char *entrystr = 0;
+    char *rootschemename = NULL;
 
     if (!givenconfigfile) {
         givenconfigfile = CONFIG_FILENAME;
     }
 
+
     PR_snprintf(configfile, sizeof(configfile), "%s/%s", configdir, givenconfigfile);
     if ((rc = PR_GetFileInfo64(configfile, &prfinfo)) != PR_SUCCESS) {
         fprintf(stderr,
@@ -318,6 +326,8 @@ slapd_config(const char *configdir, const char *givenconfigfile)
             /* Convert LDIF to entry structures */
             Slapi_DN plug_dn;
             slapi_sdn_init_dn_byref(&plug_dn, PLUGIN_BASE_DN);
+            Slapi_DN config_dn;
+            slapi_sdn_init_dn_byref(&config_dn, SLAPD_CONFIG_DN);
             while ((entrystr = dse_read_next_entry(buf, &lastp)) != NULL) {
                 /*
                  * XXXmcs: it would be better to also pass
@@ -349,20 +359,31 @@ slapd_config(const char *configdir, const char *givenconfigfile)
                             exit(1); /* yes this sucks, but who knows what else would go on if I did the right thing */
                         }
                     }
+                } else if (slapi_sdn_compare(&config_dn, slapi_entry_get_sdn_const(e)) == 0) {
+                    /* Get the root scheme out and initialise it (if it exists) */
+                    rootschemename = slapi_entry_attr_get_charptr(e, CONFIG_ROOTPWSTORAGESCHEME_ATTRIBUTE);
                 }
 
                 slapi_entry_free(e);
             }
 
-            /* kexcoff: initialize rootpwstoragescheme and pw_storagescheme
-             *            if not explicilty set in the config file
-             */
-            config_set_storagescheme();
-
             slapi_sdn_done(&plug_dn);
+            slapi_sdn_done(&config_dn);
             rc = 1; /* OK */
         }
 
+        /* initialize rootpwstoragescheme and pw_storagescheme
+         * in case they are not set by the configuration file.
+         * This needs to be after we init the plugins else this fails to create the
+         * scheme.
+         */
+        config_set_storagescheme();
+
+        if (rootschemename != NULL) {
+            config_set_rootpwstoragescheme(CONFIG_ROOTPWSTORAGESCHEME_ATTRIBUTE, rootschemename, NULL, 1);
+            free(rootschemename);
+        }
+
         slapi_ch_free_string(&buf);
     }
 
-- 
1.8.3.1