diff options
| author | Aaron <aaron@10gen.com> | 2009-12-09 14:00:14 -0800 |
|---|---|---|
| committer | Eliot Horowitz <eliot@10gen.com> | 2009-12-10 10:16:25 -0500 |
| commit | 0775d99ea1b19018c5de41e0adda330c0fed7b56 (patch) | |
| tree | 7813cae39609c9a549276469742647313287cc5e | |
| parent | d6d9ce8ffeb383b942cb267704ae8a3dcb9118a5 (diff) | |
SERVER-469 don't crash when authenticate called before getnonce
| -rw-r--r-- | db/security_commands.cpp | 14 | ||||
| -rw-r--r-- | jstests/auth1.js (renamed from jstests/auth.js) | 0 | ||||
| -rw-r--r-- | jstests/auth2.js | 11 | ||||
| -rw-r--r-- | mongo.xcodeproj/project.pbxproj | 2 |
4 files changed, 23 insertions, 4 deletions
diff --git a/db/security_commands.cpp b/db/security_commands.cpp index 4a801b24916..9d63744045b 100644 --- a/db/security_commands.cpp +++ b/db/security_commands.cpp @@ -97,11 +97,17 @@ namespace mongo { stringstream digestBuilder; { + bool reject = false; nonce *ln = lastNonce.release(); - digestBuilder << hex << *ln; - - if( ln == 0 || digestBuilder.str() != received_nonce ) { - log() << "auth: bad nonce received. could be a driver bug or a security attack. db:" << cc().database()->name << '\n'; + if ( ln == 0 ) { + reject = true; + } else { + digestBuilder << hex << *ln; + reject = digestBuilder.str() != received_nonce; + } + + if ( reject ) { + log() << "auth: bad nonce received or getnonce not called. could be a driver bug or a security attack. db:" << cc().database()->name << '\n'; errmsg = "auth fails"; sleepmillis(30); return false; diff --git a/jstests/auth.js b/jstests/auth1.js index 10fbb11bbca..10fbb11bbca 100644 --- a/jstests/auth.js +++ b/jstests/auth1.js diff --git a/jstests/auth2.js b/jstests/auth2.js new file mode 100644 index 00000000000..bd2dd830910 --- /dev/null +++ b/jstests/auth2.js @@ -0,0 +1,11 @@ +db2 = new Mongo( db.getMongo().host ).getDB( db.getName() ); + +users = db2.getCollection( "system.users" ); +users.remove( {} ); + +pass = "a" + Math.random(); +//print( "password [" + pass + "]" ); + +db2.addUser( "eliot" , pass ); + +assert.commandFailed( db2.runCommand( { authenticate: 1, user: "eliot", nonce: "foo", key: "bar" } ) ); diff --git a/mongo.xcodeproj/project.pbxproj b/mongo.xcodeproj/project.pbxproj index 9476c7d7d82..e2996fc07a5 100644 --- a/mongo.xcodeproj/project.pbxproj +++ b/mongo.xcodeproj/project.pbxproj @@ -208,6 +208,7 @@ 93A6E10D0F24CFB100DA4EBF /* flushtest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = flushtest.cpp; sourceTree = "<group>"; }; 93A6E10E0F24CFD300DA4EBF /* security.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = security.h; sourceTree = "<group>"; }; 93A6E10F0F24CFEA00DA4EBF /* security_commands.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = security_commands.cpp; sourceTree = "<group>"; }; + 93A71D2D10D04D15003C9E90 /* auth2.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = auth2.js; sourceTree = "<group>"; }; 93A8CD170F33B78D00C92B85 /* mmap_mm.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = mmap_mm.cpp; path = util/mmap_mm.cpp; sourceTree = SOURCE_ROOT; }; 93A8CD180F33B7A000C92B85 /* mmap_posix.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = mmap_posix.cpp; path = util/mmap_posix.cpp; sourceTree = SOURCE_ROOT; }; 93A8CD190F33B7AF00C92B85 /* mmap_win.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = mmap_win.cpp; path = util/mmap_win.cpp; sourceTree = SOURCE_ROOT; }; @@ -641,6 +642,7 @@ 93A8D1D10F37544800C92B85 /* jstests */ = { isa = PBXGroup; children = ( + 93A71D2D10D04D15003C9E90 /* auth2.js */, 935E7B8A0FCF37D40024B2E5 /* sharding */, 936D937F0FCC67C700004410 /* index9.js */, 936D931B0FCC58C900004410 /* regex.js */, |