Bug Summary

File:daemons/ipa-kdb/ipa_kdb_kdcpolicy.c
Warning:line 49, column 28
Access to field 'magic' results in a dereference of a null pointer (loaded from variable 'ied')

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name ipa_kdb_kdcpolicy.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -mthread-model posix -mframe-pointer=all -fmath-errno -fno-rounding-math -masm-verbose -mconstructor-aliases -munwind-tables -target-cpu x86-64 -dwarf-column-info -fno-split-dwarf-inlining -debugger-tuning=gdb -resource-dir /usr/lib64/clang/10.0.0 -D HAVE_CONFIG_H -I . -I ../.. -I . -I ../../util -D PREFIX="/usr/local" -D BINDIR="/usr/local/bin" -D LIBDIR="/usr/local/lib" -D LIBEXECDIR="/usr/local/libexec" -D DATADIR="/usr/local/share" -D LDAPIDIR="/run" -I /usr/include/samba-4.0 -D _GNU_SOURCE=1 -D HAVE_IMMEDIATE_STRUCTURES=1 -I /usr/include/nss3 -I /usr/include/nspr4 -I /usr/include/nspr4 -I /usr/include/nss3 -I /usr/include/nspr4 -D __STDC_WANT_LIB_EXT1__=1 -D _DEFAULT_SOURCE=1 -D _POSIX_C_SOURCE=200809L -D PIC -internal-isystem /usr/local/include -internal-isystem /usr/lib64/clang/10.0.0/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -fdebug-compilation-dir /home/heimes/redhat/freeipa/daemons/ipa-kdb -ferror-limit 19 -fmessage-length 0 -fgnuc-version=4.2.1 -fobjc-runtime=gcc -fdiagnostics-show-option -analyzer-output=html -faddrsig -o /home/heimes/redhat/freeipa/report/2020-06-05-101548-295465-1 -x c ipa_kdb_kdcpolicy.c
1/*
2 * Copyright (C) 2018 FreeIPA Contributors see COPYING for license
3 */
4
5#include <errno(*__errno_location ()).h>
6#include <syslog.h>
7#include <krb5/kdcpolicy_plugin.h>
8
9#include "ipa_krb5.h"
10#include "ipa_kdb.h"
11
12static krb5_error_code
13ipa_kdcpolicy_check_as(krb5_context context, krb5_kdcpolicy_moddata moddata,
14 const krb5_kdc_req *request,
15 const krb5_db_entry *client,
16 const krb5_db_entry *server,
17 const char *const *auth_indicators,
18 const char **status, krb5_deltat *lifetime_out,
19 krb5_deltat *renew_lifetime_out)
20{
21 krb5_error_code kerr;
22 enum ipadb_user_auth ua;
23 struct ipadb_e_data *ied;
24 struct ipadb_e_pol_limits *pol_limits = NULL((void*)0);
25 int valid_auth_indicators = 0, flags = 0;
26 krb5_db_entry *client_actual = NULL((void*)0);
27
28#ifdef KRB5_KDB_FLAG_ALIAS_OK
29 flags = KRB5_KDB_FLAG_ALIAS_OK;
30#endif
31
32
33 *status = NULL((void*)0);
34 *lifetime_out = 0;
35 *renew_lifetime_out = 0;
36
37 ied = (struct ipadb_e_data *)client->e_data;
38 if (ied == NULL((void*)0) || ied->magic != IPA_E_DATA_MAGIC0x0eda7a) {
1
Assuming 'ied' is equal to NULL
→
39 /* e-data is not availble, getting user auth from LDAP */
40 krb5_klog_syslog(LOG_INFO6, "IPA kdcpolicy: client e_data not availble. Try fetching...");
41 kerr = ipadb_get_principal(context, request->client, flags,
42 &client_actual);
43 if (kerr != 0) {
2
←
Assuming 'kerr' is equal to 0
→
3
←
Taking false branch
→
44 krb5_klog_syslog(LOG_ERR3, "IPA kdcpolicy: ipadb_find_principal failed.");
45 return kerr;
46 }
47
48 ied = (struct ipadb_e_data *)client_actual->e_data;
4
←
Value assigned to 'ied'
→
49 if (ied == NULL((void*)0) && ied->magic != IPA_E_DATA_MAGIC0x0eda7a) {
5
←
Assuming 'ied' is equal to NULL
→
6
←
Access to field 'magic' results in a dereference of a null pointer (loaded from variable 'ied')
50 krb5_klog_syslog(LOG_ERR3, "IPA kdcpolicy: client e_data fetching failed.");
51 return EINVAL22;
52 }
53 }
54
55 ua = ied->user_auth;
56
57 /* If no mechanisms are set, allow every auth method */
58 if (ua == IPADB_USER_AUTH_NONE) {
59 return 0;
60 }
61
62 /* For each auth indicator, see if it is allowed for that user */
63 for (int i = 0; auth_indicators[i] != NULL((void*)0); i++) {
64 const char *auth_indicator = auth_indicators[i];
65
66 if (strcmp(auth_indicator, "otp") == 0) {
67 valid_auth_indicators++;
68 if (!(ua & IPADB_USER_AUTH_OTP)) {
69 *status = "OTP pre-authentication not allowed for this user.";
70 return KRB5KDC_ERR_POLICY(-1765328372L);
71 }
72 pol_limits = &(ied->pol_limits[IPADB_USER_AUTH_IDX_OTP]);
73 } else if (strcmp(auth_indicator, "radius") == 0) {
74 valid_auth_indicators++;
75 if (!(ua & IPADB_USER_AUTH_RADIUS)) {
76 *status = "OTP pre-authentication not allowed for this user.";
77 return KRB5KDC_ERR_POLICY(-1765328372L);
78 }
79 pol_limits = &(ied->pol_limits[IPADB_USER_AUTH_IDX_RADIUS]);
80 } else if (strcmp(auth_indicator, "pkinit") == 0) {
81 valid_auth_indicators++;
82 if (!(ua & IPADB_USER_AUTH_PKINIT)) {
83 *status = "PKINIT pre-authentication not allowed for this user.";
84 return KRB5KDC_ERR_POLICY(-1765328372L);
85 }
86 pol_limits = &(ied->pol_limits[IPADB_USER_AUTH_IDX_PKINIT]);
87 } else if (strcmp(auth_indicator, "hardened") == 0) {
88 valid_auth_indicators++;
89 /* Allow hardened even if only password pre-auth is allowed */
90 if (!(ua & (IPADB_USER_AUTH_HARDENED | IPADB_USER_AUTH_PASSWORD))) {
91 *status = "Password pre-authentication not not allowed for this user.";
92 return KRB5KDC_ERR_POLICY(-1765328372L);
93 }
94 pol_limits = &(ied->pol_limits[IPADB_USER_AUTH_IDX_HARDENED]);
95 }
96 }
97
98 /* There is no auth indicator assigned for non-hardened password authentication
99 * so we assume password is used when no supported indicator exists */
100 if (!valid_auth_indicators) {
101 if (!(ua & IPADB_USER_AUTH_PASSWORD)) {
102 *status = "Non-hardened password authentication not allowed for this user.";
103 return KRB5KDC_ERR_POLICY(-1765328372L);
104 }
105 }
106
107 /* If there were policy limits associated with the authentication indicators,
108 * apply them */
109 if (pol_limits != NULL((void*)0)) {
110 if (pol_limits->max_life != 0) {
111 *lifetime_out = pol_limits->max_life;
112 }
113
114 if (pol_limits->max_renewable_life != 0) {
115 *renew_lifetime_out = pol_limits->max_renewable_life;
116 }
117 }
118
119 return 0;
120}
121
122static krb5_error_code
123ipa_kdcpolicy_check_tgs(krb5_context context, krb5_kdcpolicy_moddata moddata,
124 const krb5_kdc_req *request,
125 const krb5_db_entry *server,
126 const krb5_ticket *ticket,
127 const char *const *auth_indicators,
128 const char **status, krb5_deltat *lifetime_out,
129 krb5_deltat *renew_lifetime_out)
130{
131 *status = NULL((void*)0);
132 *lifetime_out = 0;
133 *renew_lifetime_out = 0;
134
135 return 0;
136}
137
138krb5_error_code kdcpolicy_ipakdb_initvt(krb5_context context,
139 int maj_ver, int min_ver,
140 krb5_plugin_vtable vtable)
141{
142 krb5_kdcpolicy_vtable vt;
143
144 if (maj_ver != 1)
145 return KRB5_PLUGIN_VER_NOTSUPP(-1750600192L);
146
147 vt = (krb5_kdcpolicy_vtable)vtable;
148 vt->name = "ipakdb";
149 vt->init = NULL((void*)0);
150 vt->fini = NULL((void*)0);
151 vt->check_as = ipa_kdcpolicy_check_as;
152 vt->check_tgs = ipa_kdcpolicy_check_tgs;
153 return 0;
154}