Issue 6367 - RFE support of Session Tracking Control internet draft

[tbordaz]

Bug description:
This RFE is to support https://datatracker.ietf.org/doc/html/draft-wahl-ldap-session-03
In short, it allows a client to send strings in a control.
Those strings are added to the operation result logged in the
access logs.
Those strings are meaningful for the client (debug,
kmonitoring,...).

Fix description:
The design is https://www.port389.org/docs/389ds/design/session-identifier-in-logs.html

fixes: #6367

Reviewed by:

[Firstyear]

This is potentially an RCE due to ascii control characters when viewed by an admin.

[tbordaz]

Thank @Firstyear for the rapid review. I assume RCE means remote code execution. I agree that taking client data requires careful checking. This data is ascii printable, less than 64K long. It is truncated to 15 first chars that are print in the log. Those chars (15bytes) are stored in the pblock. How can it be a RCE ?

[progier389]

Not sure if it is really a RCE but anyway I think that @Firstyear concern is valid:
Logging directly the tag could be tricky for admin reading or running script on the log files and generates problems.
We should better escape the tag when logging it in access log to avoid bad surprise.

[Firstyear]

@tbordaz ascii control characters - there is a method of adding them into a log such than an admin who views the log will trigger code to exec in their shell.

You need to filter our ascii control chars is generally the easiest fix.

[progier389]

Looks good except a few minor points:
code simplification (ber parsing and redundant size testing)
and more importantly an error message that IMHO should be changed

[progier389]

LGTM