sudo_ldap_role_to_priv: treat an invalid sudoNotAfter as expired

MANIFEST

@@ -1135,6 +1135,8 @@ plugins/sudoers/regress/testsudoers/test32.out.ok
 plugins/sudoers/regress/testsudoers/test32.sh
 plugins/sudoers/regress/testsudoers/test33.out.ok
 plugins/sudoers/regress/testsudoers/test33.sh
+plugins/sudoers/regress/testsudoers/test34.out.ok
+plugins/sudoers/regress/testsudoers/test34.sh
 plugins/sudoers/regress/testsudoers/test4.out.ok
 plugins/sudoers/regress/testsudoers/test4.sh
 plugins/sudoers/regress/testsudoers/test5.out.ok

plugins/sudoers/gentime.c

@@ -93,7 +93,9 @@ parse_gentime(const char *timestr)
 	    /* ignore fractional second */
 	    break;
 	}
-	cp += 2;	/* skip over radix and fraction */
+	/* skip over radix and fraction, only the first digit is used */
+	for (cp += 2; isdigit((unsigned char)*cp); cp++)
+	    continue;
     }
 
     /* Parse optional time zone. */

plugins/sudoers/ldap_util.c

@@ -355,6 +355,7 @@ sudo_ldap_role_to_priv(const char *cn, void *hosts, void *runasusers,
     struct cmndspec *prev_cmndspec = NULL;
     struct privilege *priv;
     struct member *m;
+    bool bad_time = false;
     char *cmnd;
     debug_decl(sudo_ldap_role_to_priv, SUDOERS_DEBUG_LDAP);
 
@@ -457,11 +458,36 @@ sudo_ldap_role_to_priv(const char *cn, void *hosts, void *runasusers,
 		    goto oom;
 	    }
 
-	    /* Parse sudoNotBefore / sudoNotAfter */
-	    if (notbefore != NULL)
+	    /*
+	     * Parse sudoNotBefore / sudoNotAfter.
+	     * The parse_gentime() error value is the same as UNSPEC,
+	     * so an invalid value would otherwise remove the restriction.
+	     * Treat an entry with an invalid time as having expired.
+	     */
+	    if (notbefore != NULL) {
 		cmndspec->notbefore = parse_gentime(notbefore);
-	    if (notafter != NULL)
+		if (cmndspec->notbefore == -1) {
+		    if (warnings) {
+			sudo_warnx(U_("invalid sudoNotBefore value: %s"),
+			    notbefore);
+		    }
+		    bad_time = true;
+		}
+	    }
+	    if (notafter != NULL) {
 		cmndspec->notafter = parse_gentime(notafter);
+		if (cmndspec->notafter == -1) {
+		    if (warnings) {
+			sudo_warnx(U_("invalid sudoNotAfter value: %s"),
+			    notafter);
+		    }
+		    bad_time = true;
+		}
+	    }
+	    if (bad_time) {
+		cmndspec->notbefore = UNSPEC;
+		cmndspec->notafter = 0;
+	    }
 
 	    /* Parse sudoOptions. */
 	    if (opts != NULL) {

plugins/sudoers/regress/parser/check_gentime.c

@@ -52,6 +52,10 @@ const struct gentime_test {
     { "201702142359,4Z", 1487116764 },
     { "2017021408.5Z", 1487061000 },
     { "2017021408,5Z", 1487061000 },
+    { "20170214083000.123Z", 1487061000 },
+    { "201702142359.45Z", 1487116764 },
+    { "2017021408.50-0500", 1487079000 },
+    { "20170214083000.Z", -1 },
     { "20170214Z", -1 },
 };
 

plugins/sudoers/regress/testsudoers/test34.out.ok

@@ -0,0 +1,38 @@
+Parses OK
+
+Entries for user root:
+
+ALL = (ALL) NOTAFTER=20200101000000Z /bin/sh
+	host  allowed
+	date  denied
+
+Password required
+
+Command unmatched
+
+testsudoers: invalid sudoNotAfter value: bogus
+Parses OK
+
+Entries for user root:
+
+ALL = (ALL) NOTAFTER=19700101000000Z /bin/sh
+	host  allowed
+	date  denied
+
+Password required
+
+Command unmatched
+
+testsudoers: invalid sudoNotBefore value: bogus
+Parses OK
+
+Entries for user root:
+
+ALL = (ALL) NOTAFTER=19700101000000Z /bin/sh
+	host  allowed
+	date  denied
+
+Password required
+
+Command unmatched
+

plugins/sudoers/regress/testsudoers/test34.sh

@@ -0,0 +1,27 @@
+#!/bin/sh
+#
+# Verify that an LDAP sudoNotBefore or sudoNotAfter value that cannot
+# be parsed does not remove the time restriction.
+#
+
+: ${TESTSUDOERS=testsudoers}
+
+exec 2>&1
+
+for attr in "sudoNotAfter: 20200101000000.00Z" "sudoNotAfter: bogus" \
+    "sudoNotBefore: bogus"; do
+    $TESTSUDOERS -i ldif root /bin/sh <<-EOF
+	dn: cn=root,ou=SUDOers,dc=sudo,dc=ws
+	objectClass: top
+	objectClass: sudoRole
+	cn: root
+	sudoUser: root
+	sudoRunAs: ALL
+	sudoHost: ALL
+	sudoCommand: /bin/sh
+	$attr
+	EOF
+    echo ""
+done
+
+exit 0