git.sur5r.net Git - openldap/blob - libraries/libldap/cyrus.c

   1 /* $OpenLDAP$ */
   2 /*
   3  * Copyright 1999-2003 The OpenLDAP Foundation, All Rights Reserved.
   4  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   5  */
   6
   7 #include "portable.h"
   8
   9 #include <stdio.h>
  10
  11 #include <ac/socket.h>
  12 #include <ac/stdlib.h>
  13 #include <ac/string.h>
  14 #include <ac/time.h>
  15 #include <ac/errno.h>
  16 #include <ac/ctype.h>
  17 #include <ac/unistd.h>
  18
  19 #include "ldap-int.h"
  20
  21 #ifdef HAVE_CYRUS_SASL
  22
  23 #ifdef LDAP_R_COMPILE
  24 ldap_pvt_thread_mutex_t ldap_int_sasl_mutex;
  25 #endif
  26
  27 #ifdef HAVE_SASL_SASL_H
  28 #include <sasl/sasl.h>
  29 #else
  30 #include <sasl.h>
  31 #endif
  32
  33 #if SASL_VERSION_MAJOR >= 2
  34 #define SASL_CONST const
  35 #else
  36 #define SASL_CONST
  37 #endif
  38
  39 /*
  40 * Various Cyrus SASL related stuff.
  41 */
  42
  43 int ldap_int_sasl_init( void )
  44 {
  45         /* XXX not threadsafe */
  46         static int sasl_initialized = 0;
  47
  48         static sasl_callback_t client_callbacks[] = {
  49 #ifdef SASL_CB_GETREALM
  50                 { SASL_CB_GETREALM, NULL, NULL },
  51 #endif
  52                 { SASL_CB_USER, NULL, NULL },
  53                 { SASL_CB_AUTHNAME, NULL, NULL },
  54                 { SASL_CB_PASS, NULL, NULL },
  55                 { SASL_CB_ECHOPROMPT, NULL, NULL },
  56                 { SASL_CB_NOECHOPROMPT, NULL, NULL },
  57                 { SASL_CB_LIST_END, NULL, NULL }
  58         };
  59
  60 #ifdef HAVE_SASL_VERSION
  61         /* stringify the version number, sasl.h doesn't do it for us */
  62 #define VSTR0(maj, min, pat)    #maj "." #min "." #pat
  63 #define VSTR(maj, min, pat)     VSTR0(maj, min, pat)
  64 #define SASL_VERSION_STRING     VSTR(SASL_VERSION_MAJOR, SASL_VERSION_MINOR, \
  65                                 SASL_VERSION_STEP)
  66         { int rc;
  67         sasl_version( NULL, &rc );
  68         if ( ((rc >> 16) != ((SASL_VERSION_MAJOR << 8)|SASL_VERSION_MINOR)) ||
  69                 (rc & 0xffff) < SASL_VERSION_STEP) {
  70                 char version[sizeof("xxx.xxx.xxxxx")];
  71                 sprintf( version, "%u.%d.%d", (unsigned)rc >> 24, (rc >> 16) & 0xff,
  72                         rc & 0xffff );
  73
  74 #ifdef NEW_LOGGING
  75                 LDAP_LOG( TRANSPORT, INFO,
  76                 "ldap_int_sasl_init: SASL library version mismatch:"
  77                 " expected " SASL_VERSION_STRING ","
  78                 " got %s\n", version, 0, 0 );
  79 #else
  80                 Debug( LDAP_DEBUG_ANY,
  81                 "ldap_int_sasl_init: SASL library version mismatch:"
  82                 " expected " SASL_VERSION_STRING ","
  83                 " got %s\n", version, 0, 0 );
  84 #endif
  85                 return -1;
  86         }
  87         }
  88 #endif
  89         if ( sasl_initialized ) {
  90                 return 0;
  91         }
  92
  93 /* SASL 2 takes care of its own memory completely internally */
  94 #if SASL_VERSION_MAJOR < 2 && !defined(CSRIMALLOC)
  95         sasl_set_alloc(
  96                 ber_memalloc,
  97                 ber_memcalloc,
  98                 ber_memrealloc,
  99                 ber_memfree );
 100 #endif /* CSRIMALLOC */
 101
 102 #ifdef LDAP_R_COMPILE
 103         sasl_set_mutex(
 104                 ldap_pvt_sasl_mutex_new,
 105                 ldap_pvt_sasl_mutex_lock,
 106                 ldap_pvt_sasl_mutex_unlock,
 107                 ldap_pvt_sasl_mutex_dispose );
 108
 109         ldap_pvt_thread_mutex_init( &ldap_int_sasl_mutex );
 110 #endif
 111
 112         if ( sasl_client_init( client_callbacks ) == SASL_OK ) {
 113                 sasl_initialized = 1;
 114                 return 0;
 115         }
 116
 117 #if SASL_VERSION_MAJOR < 2
 118         /* A no-op to make sure we link with Cyrus 1.5 */
 119         sasl_client_auth( NULL, NULL, NULL, 0, NULL, NULL );
 120 #endif
 121         return -1;
 122 }
 123
 124 /*
 125  * SASL encryption support for LBER Sockbufs
 126  */
 127
 128 struct sb_sasl_data {
 129         sasl_conn_t             *sasl_context;
 130         unsigned                *sasl_maxbuf;
 131         Sockbuf_Buf             sec_buf_in;
 132         Sockbuf_Buf             buf_in;
 133         Sockbuf_Buf             buf_out;
 134 };
 135
 136 static int
 137 sb_sasl_setup( Sockbuf_IO_Desc *sbiod, void *arg )
 138 {
 139         struct sb_sasl_data     *p;
 140
 141         assert( sbiod != NULL );
 142
 143         p = LBER_MALLOC( sizeof( *p ) );
 144         if ( p == NULL )
 145                 return -1;
 146         p->sasl_context = (sasl_conn_t *)arg;
 147         ber_pvt_sb_buf_init( &p->sec_buf_in );
 148         ber_pvt_sb_buf_init( &p->buf_in );
 149         ber_pvt_sb_buf_init( &p->buf_out );
 150         if ( ber_pvt_sb_grow_buffer( &p->sec_buf_in, SASL_MIN_BUFF_SIZE ) < 0 ) {
 151                 LBER_FREE( p );
 152                 errno = ENOMEM;
 153                 return -1;
 154         }
 155         sasl_getprop( p->sasl_context, SASL_MAXOUTBUF,
 156                 (SASL_CONST void **) &p->sasl_maxbuf );
 157
 158         sbiod->sbiod_pvt = p;
 159
 160         return 0;
 161 }
 162
 163 static int
 164 sb_sasl_remove( Sockbuf_IO_Desc *sbiod )
 165 {
 166         struct sb_sasl_data     *p;
 167
 168         assert( sbiod != NULL );
 169
 170         p = (struct sb_sasl_data *)sbiod->sbiod_pvt;
 171 #if SASL_VERSION_MAJOR >= 2
 172         /*
 173          * SASLv2 encode/decode buffers are managed by
 174          * libsasl2. Ensure they are not freed by liblber.
 175          */
 176         p->buf_in.buf_base = NULL;
 177         p->buf_out.buf_base = NULL;
 178 #endif
 179         ber_pvt_sb_buf_destroy( &p->sec_buf_in );
 180         ber_pvt_sb_buf_destroy( &p->buf_in );
 181         ber_pvt_sb_buf_destroy( &p->buf_out );
 182         LBER_FREE( p );
 183         sbiod->sbiod_pvt = NULL;
 184         return 0;
 185 }
 186
 187 static ber_len_t
 188 sb_sasl_pkt_length( const unsigned char *buf, unsigned max, int debuglevel )
 189 {
 190         ber_len_t               size;
 191
 192         assert( buf != NULL );
 193
 194         size = buf[0] << 24
 195                 | buf[1] << 16
 196                 | buf[2] << 8
 197                 | buf[3];
 198
 199         if ( size > SASL_MAX_BUFF_SIZE ) {
 200                 /* somebody is trying to mess me up. */
 201                 ber_log_printf( LDAP_DEBUG_ANY, debuglevel,
 202                         "sb_sasl_pkt_length: received illegal packet length "
 203                         "of %lu bytes\n", (unsigned long)size );
 204                 size = 16; /* this should lead to an error. */
 205         }
 206
 207         return size + 4; /* include the size !!! */
 208 }
 209
 210 /* Drop a processed packet from the input buffer */
 211 static void
 212 sb_sasl_drop_packet ( Sockbuf_Buf *sec_buf_in, unsigned max, int debuglevel )
 213 {
 214         ber_slen_t                      len;
 215
 216         len = sec_buf_in->buf_ptr - sec_buf_in->buf_end;
 217         if ( len > 0 )
 218                 AC_MEMCPY( sec_buf_in->buf_base, sec_buf_in->buf_base +
 219                         sec_buf_in->buf_end, len );
 220
 221         if ( len >= 4 ) {
 222                 sec_buf_in->buf_end = sb_sasl_pkt_length(
 223                         (unsigned char *) sec_buf_in->buf_base, max, debuglevel);
 224         }
 225         else {
 226                 sec_buf_in->buf_end = 0;
 227         }
 228         sec_buf_in->buf_ptr = len;
 229 }
 230
 231 static ber_slen_t
 232 sb_sasl_read( Sockbuf_IO_Desc *sbiod, void *buf, ber_len_t len)
 233 {
 234         struct sb_sasl_data     *p;
 235         ber_slen_t              ret, bufptr;
 236
 237         assert( sbiod != NULL );
 238         assert( SOCKBUF_VALID( sbiod->sbiod_sb ) );
 239
 240         p = (struct sb_sasl_data *)sbiod->sbiod_pvt;
 241
 242         /* Are there anything left in the buffer? */
 243         ret = ber_pvt_sb_copy_out( &p->buf_in, buf, len );
 244         bufptr = ret;
 245         len -= ret;
 246
 247         if ( len == 0 )
 248                 return bufptr;
 249
 250 #if SASL_VERSION_MAJOR >= 2
 251         ber_pvt_sb_buf_init( &p->buf_in );
 252 #else
 253         ber_pvt_sb_buf_destroy( &p->buf_in );
 254 #endif
 255
 256         /* Read the length of the packet */
 257         while ( p->sec_buf_in.buf_ptr < 4 ) {
 258                 ret = LBER_SBIOD_READ_NEXT( sbiod, p->sec_buf_in.buf_base,
 259                         4 - p->sec_buf_in.buf_ptr );
 260 #ifdef EINTR
 261                 if ( ( ret < 0 ) && ( errno == EINTR ) )
 262                         continue;
 263 #endif
 264                 if ( ret <= 0 )
 265                         return bufptr ? bufptr : ret;
 266
 267                 p->sec_buf_in.buf_ptr += ret;
 268         }
 269
 270         /* The new packet always starts at p->sec_buf_in.buf_base */
 271         ret = sb_sasl_pkt_length( (unsigned char *) p->sec_buf_in.buf_base,
 272                 *p->sasl_maxbuf, sbiod->sbiod_sb->sb_debug );
 273
 274         /* Grow the packet buffer if neccessary */
 275         if ( ( p->sec_buf_in.buf_size < (ber_len_t) ret ) &&
 276                 ber_pvt_sb_grow_buffer( &p->sec_buf_in, ret ) < 0 )
 277         {
 278                 errno = ENOMEM;
 279                 return -1;
 280         }
 281         p->sec_buf_in.buf_end = ret;
 282
 283         /* Did we read the whole encrypted packet? */
 284         while ( p->sec_buf_in.buf_ptr < p->sec_buf_in.buf_end ) {
 285                 /* No, we have got only a part of it */
 286                 ret = p->sec_buf_in.buf_end - p->sec_buf_in.buf_ptr;
 287
 288                 ret = LBER_SBIOD_READ_NEXT( sbiod, p->sec_buf_in.buf_base +
 289                         p->sec_buf_in.buf_ptr, ret );
 290 #ifdef EINTR
 291                 if ( ( ret < 0 ) && ( errno == EINTR ) )
 292                         continue;
 293 #endif
 294                 if ( ret <= 0 )
 295                         return bufptr ? bufptr : ret;
 296
 297                 p->sec_buf_in.buf_ptr += ret;
 298         }
 299
 300         /* Decode the packet */
 301         ret = sasl_decode( p->sasl_context, p->sec_buf_in.buf_base,
 302                 p->sec_buf_in.buf_end,
 303                 (SASL_CONST char **)&p->buf_in.buf_base,
 304                 (unsigned *)&p->buf_in.buf_end );
 305
 306         /* Drop the packet from the input buffer */
 307         sb_sasl_drop_packet( &p->sec_buf_in,
 308                         *p->sasl_maxbuf, sbiod->sbiod_sb->sb_debug );
 309
 310         if ( ret != SASL_OK ) {
 311                 ber_log_printf( LDAP_DEBUG_ANY, sbiod->sbiod_sb->sb_debug,
 312                         "sb_sasl_read: failed to decode packet: %s\n",
 313                         sasl_errstring( ret, NULL, NULL ) );
 314                 errno = EIO;
 315                 return -1;
 316         }
 317
 318         p->buf_in.buf_size = p->buf_in.buf_end;
 319
 320         bufptr += ber_pvt_sb_copy_out( &p->buf_in, (char*) buf + bufptr, len );
 321
 322         return bufptr;
 323 }
 324
 325 static ber_slen_t
 326 sb_sasl_write( Sockbuf_IO_Desc *sbiod, void *buf, ber_len_t len)
 327 {
 328         struct sb_sasl_data     *p;
 329         int                     ret;
 330
 331         assert( sbiod != NULL );
 332         assert( SOCKBUF_VALID( sbiod->sbiod_sb ) );
 333
 334         p = (struct sb_sasl_data *)sbiod->sbiod_pvt;
 335
 336         /* Are there anything left in the buffer? */
 337         if ( p->buf_out.buf_ptr != p->buf_out.buf_end ) {
 338                 ret = ber_pvt_sb_do_write( sbiod, &p->buf_out );
 339                 if ( ret < 0 )
 340                         return ret;
 341                 /* Still have something left?? */
 342                 if ( p->buf_out.buf_ptr != p->buf_out.buf_end ) {
 343                         errno = EAGAIN;
 344                         return 0;
 345                 }
 346         }
 347
 348         /* now encode the next packet. */
 349 #if SASL_VERSION_MAJOR >= 2
 350         ber_pvt_sb_buf_init( &p->buf_out );
 351         /* sasl v2 makes sure this number is correct */
 352         if ( len > *p->sasl_maxbuf )
 353                 len = *p->sasl_maxbuf;
 354 #else
 355         ber_pvt_sb_buf_destroy( &p->buf_out );
 356         if ( len > *p->sasl_maxbuf - 100 )
 357                 len = *p->sasl_maxbuf - 100;    /* For safety margin */
 358 #endif
 359         ret = sasl_encode( p->sasl_context, buf, len,
 360                 (SASL_CONST char **)&p->buf_out.buf_base,
 361                 (unsigned *)&p->buf_out.buf_size );
 362         if ( ret != SASL_OK ) {
 363                 ber_log_printf( LDAP_DEBUG_ANY, sbiod->sbiod_sb->sb_debug,
 364                         "sb_sasl_write: failed to encode packet: %s\n",
 365                         sasl_errstring( ret, NULL, NULL ) );
 366                 return -1;
 367         }
 368         p->buf_out.buf_end = p->buf_out.buf_size;
 369
 370         ret = ber_pvt_sb_do_write( sbiod, &p->buf_out );
 371         if ( ret <= 0 )
 372                 return ret;
 373         return len;
 374 }
 375
 376 static int
 377 sb_sasl_ctrl( Sockbuf_IO_Desc *sbiod, int opt, void *arg )
 378 {
 379         struct sb_sasl_data     *p;
 380
 381         p = (struct sb_sasl_data *)sbiod->sbiod_pvt;
 382
 383         if ( opt == LBER_SB_OPT_DATA_READY ) {
 384                 if ( p->buf_in.buf_ptr != p->buf_in.buf_end )
 385                         return 1;
 386         }
 387
 388         return LBER_SBIOD_CTRL_NEXT( sbiod, opt, arg );
 389 }
 390
 391 Sockbuf_IO ldap_pvt_sockbuf_io_sasl = {
 392         sb_sasl_setup,          /* sbi_setup */
 393         sb_sasl_remove,         /* sbi_remove */
 394         sb_sasl_ctrl,           /* sbi_ctrl */
 395         sb_sasl_read,           /* sbi_read */
 396         sb_sasl_write,          /* sbi_write */
 397         NULL                    /* sbi_close */
 398 };
 399
 400 int ldap_pvt_sasl_install( Sockbuf *sb, void *ctx_arg )
 401 {
 402 #ifdef NEW_LOGGING
 403         LDAP_LOG ( TRANSPORT, ENTRY, "ldap_pvt_sasl_install\n", 0, 0, 0 );
 404 #else
 405         Debug( LDAP_DEBUG_TRACE, "ldap_pvt_sasl_install\n",
 406                 0, 0, 0 );
 407 #endif
 408
 409         /* don't install the stuff unless security has been negotiated */
 410
 411         if ( !ber_sockbuf_ctrl( sb, LBER_SB_OPT_HAS_IO,
 412                         &ldap_pvt_sockbuf_io_sasl ) )
 413         {
 414 #ifdef LDAP_DEBUG
 415                 ber_sockbuf_add_io( sb, &ber_sockbuf_io_debug,
 416                         LBER_SBIOD_LEVEL_APPLICATION, (void *)"sasl_" );
 417 #endif
 418                 ber_sockbuf_add_io( sb, &ldap_pvt_sockbuf_io_sasl,
 419                         LBER_SBIOD_LEVEL_APPLICATION, ctx_arg );
 420         }
 421
 422         return LDAP_SUCCESS;
 423 }
 424
 425 void ldap_pvt_sasl_remove( Sockbuf *sb )
 426 {
 427         ber_sockbuf_remove_io( sb, &ldap_pvt_sockbuf_io_sasl,
 428                 LBER_SBIOD_LEVEL_APPLICATION );
 429 #ifdef LDAP_DEBUG
 430         ber_sockbuf_remove_io( sb, &ber_sockbuf_io_debug,
 431                 LBER_SBIOD_LEVEL_APPLICATION );
 432 #endif
 433 }
 434
 435 static int
 436 sasl_err2ldap( int saslerr )
 437 {
 438         int rc;
 439
 440         switch (saslerr) {
 441                 case SASL_CONTINUE:
 442                         rc = LDAP_MORE_RESULTS_TO_RETURN;
 443                         break;
 444                 case SASL_INTERACT:
 445                         rc = LDAP_LOCAL_ERROR;
 446                         break;
 447                 case SASL_OK:
 448                         rc = LDAP_SUCCESS;
 449                         break;
 450                 case SASL_FAIL:
 451                         rc = LDAP_LOCAL_ERROR;
 452                         break;
 453                 case SASL_NOMEM:
 454                         rc = LDAP_NO_MEMORY;
 455                         break;
 456                 case SASL_NOMECH:
 457                         rc = LDAP_AUTH_UNKNOWN;
 458                         break;
 459                 case SASL_BADAUTH:
 460                         rc = LDAP_AUTH_UNKNOWN;
 461                         break;
 462                 case SASL_NOAUTHZ:
 463                         rc = LDAP_PARAM_ERROR;
 464                         break;
 465                 case SASL_TOOWEAK:
 466                 case SASL_ENCRYPT:
 467                         rc = LDAP_AUTH_UNKNOWN;
 468                         break;
 469                 default:
 470                         rc = LDAP_LOCAL_ERROR;
 471                         break;
 472         }
 473
 474         assert( rc == LDAP_SUCCESS || LDAP_API_ERROR( rc ) );
 475         return rc;
 476 }
 477
 478 int
 479 ldap_int_sasl_open(
 480         LDAP *ld,
 481         LDAPConn *lc,
 482         const char * host )
 483 {
 484         int rc;
 485         sasl_conn_t *ctx;
 486
 487         assert( lc->lconn_sasl_authctx == NULL );
 488
 489         if ( host == NULL ) {
 490                 ld->ld_errno = LDAP_LOCAL_ERROR;
 491                 return ld->ld_errno;
 492         }
 493
 494 #if SASL_VERSION_MAJOR >= 2
 495         rc = sasl_client_new( "ldap", host, NULL, NULL,
 496                 NULL, 0, &ctx );
 497 #else
 498         rc = sasl_client_new( "ldap", host, NULL,
 499                 SASL_SECURITY_LAYER, &ctx );
 500 #endif
 501
 502         if ( rc != SASL_OK ) {
 503                 ld->ld_errno = sasl_err2ldap( rc );
 504                 return ld->ld_errno;
 505         }
 506
 507 #ifdef NEW_LOGGING
 508         LDAP_LOG ( TRANSPORT, DETAIL1, "ldap_int_sasl_open: host=%s\n",
 509                 host, 0, 0 );
 510 #else
 511         Debug( LDAP_DEBUG_TRACE, "ldap_int_sasl_open: host=%s\n",
 512                 host, 0, 0 );
 513 #endif
 514
 515         lc->lconn_sasl_authctx = ctx;
 516
 517         return LDAP_SUCCESS;
 518 }
 519
 520 int ldap_int_sasl_close( LDAP *ld, LDAPConn *lc )
 521 {
 522         sasl_conn_t *ctx = lc->lconn_sasl_authctx;
 523
 524         if( ctx != NULL ) {
 525                 sasl_dispose( &ctx );
 526                 if ( lc->lconn_sasl_sockctx &&
 527                         lc->lconn_sasl_authctx != lc->lconn_sasl_sockctx ) {
 528                         ctx = lc->lconn_sasl_sockctx;
 529                         sasl_dispose( &ctx );
 530                 }
 531                 lc->lconn_sasl_sockctx = NULL;
 532                 lc->lconn_sasl_authctx = NULL;
 533         }
 534
 535         return LDAP_SUCCESS;
 536 }
 537
 538 int
 539 ldap_int_sasl_bind(
 540         LDAP                    *ld,
 541         const char              *dn,
 542         const char              *mechs,
 543         LDAPControl             **sctrls,
 544         LDAPControl             **cctrls,
 545         unsigned                flags,
 546         LDAP_SASL_INTERACT_PROC *interact,
 547         void * defaults )
 548 {
 549         char *data;
 550         const char *mech = NULL;
 551         const char *pmech = NULL;
 552         int                     saslrc, rc;
 553         sasl_ssf_t              *ssf = NULL;
 554         sasl_conn_t     *ctx, *oldctx = NULL;
 555         sasl_interact_t *prompts = NULL;
 556         unsigned credlen;
 557         struct berval ccred;
 558         ber_socket_t            sd;
 559         void    *ssl;
 560
 561 #ifdef NEW_LOGGING
 562         LDAP_LOG ( TRANSPORT, ARGS, "ldap_int_sasl_bind: %s\n",
 563                 mechs ? mechs : "<null>", 0, 0 );
 564 #else
 565         Debug( LDAP_DEBUG_TRACE, "ldap_int_sasl_bind: %s\n",
 566                 mechs ? mechs : "<null>", 0, 0 );
 567 #endif
 568
 569         /* do a quick !LDAPv3 check... ldap_sasl_bind will do the rest. */
 570         if (ld->ld_version < LDAP_VERSION3) {
 571                 ld->ld_errno = LDAP_NOT_SUPPORTED;
 572                 return ld->ld_errno;
 573         }
 574
 575         ber_sockbuf_ctrl( ld->ld_sb, LBER_SB_OPT_GET_FD, &sd );
 576
 577         if ( sd == AC_SOCKET_INVALID ) {
 578                 /* not connected yet */
 579                 int rc;
 580
 581                 rc = ldap_open_defconn( ld );
 582                 if( rc < 0 ) return ld->ld_errno;
 583
 584                 ber_sockbuf_ctrl( ld->ld_sb, LBER_SB_OPT_GET_FD, &sd );
 585
 586                 if( sd == AC_SOCKET_INVALID ) {
 587                         ld->ld_errno = LDAP_LOCAL_ERROR;
 588                         return ld->ld_errno;
 589                 }
 590         }
 591
 592         oldctx = ld->ld_defconn->lconn_sasl_authctx;
 593
 594         /* If we already have an authentication context, clear it out */
 595         if( oldctx ) {
 596                 if ( oldctx != ld->ld_defconn->lconn_sasl_sockctx ) {
 597                         sasl_dispose( &oldctx );
 598                 }
 599                 ld->ld_defconn->lconn_sasl_authctx = NULL;
 600         }
 601
 602         rc = ldap_int_sasl_open( ld, ld->ld_defconn,
 603                 ld->ld_defconn->lconn_server->lud_host ?
 604                 ld->ld_defconn->lconn_server->lud_host : "localhost" );
 605
 606         if ( rc != LDAP_SUCCESS ) return rc;
 607
 608         ctx = ld->ld_defconn->lconn_sasl_authctx;
 609
 610         /* Check for TLS */
 611         ssl = ldap_pvt_tls_sb_ctx( ld->ld_sb );
 612         if ( ssl ) {
 613                 struct berval authid = { 0, NULL };
 614                 ber_len_t fac;
 615
 616                 fac = ldap_pvt_tls_get_strength( ssl );
 617                 /* failure is OK, we just can't use SASL EXTERNAL */
 618                 (void) ldap_pvt_tls_get_my_dn( ssl, &authid, NULL, 0 );
 619
 620                 (void) ldap_int_sasl_external( ld, ld->ld_defconn, authid.bv_val, fac );
 621                 LDAP_FREE( authid.bv_val );
 622         }
 623
 624         /* Check for local */
 625         if ( ldap_pvt_url_scheme2proto( ld->ld_defconn->lconn_server->lud_scheme ) == LDAP_PROTO_IPC ) {
 626                 char authid[sizeof("uidNumber=4294967295+gidNumber=4294967295,"
 627                         "cn=peercred,cn=external,cn=auth")];
 628                 sprintf( authid, "uidNumber=%d+gidNumber=%d,"
 629                         "cn=peercred,cn=external,cn=auth",
 630                         (int) geteuid(), (int) getegid() );
 631                 (void) ldap_int_sasl_external( ld, ld->ld_defconn, authid, LDAP_PVT_SASL_LOCAL_SSF );
 632         }
 633
 634         /* (re)set security properties */
 635         sasl_setprop( ctx, SASL_SEC_PROPS,
 636                 &ld->ld_options.ldo_sasl_secprops );
 637
 638         ccred.bv_val = NULL;
 639         ccred.bv_len = 0;
 640
 641         do {
 642                 saslrc = sasl_client_start( ctx,
 643                         mechs,
 644 #if SASL_VERSION_MAJOR < 2
 645                         NULL,
 646 #endif
 647                         &prompts,
 648                         (SASL_CONST char **)&ccred.bv_val,
 649                         &credlen,
 650                         &mech );
 651
 652                 if( pmech == NULL && mech != NULL ) {
 653                         pmech = mech;
 654
 655                         if( flags != LDAP_SASL_QUIET ) {
 656                                 fprintf(stderr,
 657                                         "SASL/%s authentication started\n",
 658                                         pmech );
 659                         }
 660                 }
 661
 662                 if( saslrc == SASL_INTERACT ) {
 663                         int res;
 664                         if( !interact ) break;
 665                         res = (interact)( ld, flags, defaults, prompts );
 666
 667                         if( res != LDAP_SUCCESS ) break;
 668                 }
 669         } while ( saslrc == SASL_INTERACT );
 670
 671         ccred.bv_len = credlen;
 672
 673         if ( (saslrc != SASL_OK) && (saslrc != SASL_CONTINUE) ) {
 674                 rc = ld->ld_errno = sasl_err2ldap( saslrc );
 675 #if SASL_VERSION_MAJOR >= 2
 676                 ld->ld_error = LDAP_STRDUP( sasl_errdetail( ctx ) );
 677 #endif
 678                 goto done;
 679         }
 680
 681         do {
 682                 struct berval *scred;
 683                 unsigned credlen;
 684
 685                 scred = NULL;
 686
 687                 rc = ldap_sasl_bind_s( ld, dn, mech, &ccred, sctrls, cctrls, &scred );
 688
 689                 if ( ccred.bv_val != NULL ) {
 690 #if SASL_VERSION_MAJOR < 2
 691                         LDAP_FREE( ccred.bv_val );
 692 #endif
 693                         ccred.bv_val = NULL;
 694                 }
 695
 696                 if ( rc != LDAP_SUCCESS && rc != LDAP_SASL_BIND_IN_PROGRESS ) {
 697                         if( scred && scred->bv_len ) {
 698                                 /* and server provided us with data? */
 699 #ifdef NEW_LOGGING
 700                                 LDAP_LOG ( TRANSPORT, DETAIL1,
 701                                         "ldap_int_sasl_bind: rc=%d sasl=%d len=%ld\n",
 702                                         rc, saslrc, scred->bv_len );
 703 #else
 704                                 Debug( LDAP_DEBUG_TRACE,
 705                                         "ldap_int_sasl_bind: rc=%d sasl=%d len=%ld\n",
 706                                         rc, saslrc, scred->bv_len );
 707 #endif
 708                                 ber_bvfree( scred );
 709                         }
 710                         rc = ld->ld_errno;
 711                         goto done;
 712                 }
 713
 714                 if( rc == LDAP_SUCCESS && saslrc == SASL_OK ) {
 715                         /* we're done, no need to step */
 716                         if( scred && scred->bv_len ) {
 717                                 /* but server provided us with data! */
 718 #ifdef NEW_LOGGING
 719                                 LDAP_LOG ( TRANSPORT, DETAIL1,
 720                                         "ldap_int_sasl_bind: rc=%d sasl=%d len=%ld\n",
 721                                         rc, saslrc, scred->bv_len );
 722 #else
 723                                 Debug( LDAP_DEBUG_TRACE,
 724                                         "ldap_int_sasl_bind: rc=%d sasl=%d len=%ld\n",
 725                                         rc, saslrc, scred->bv_len );
 726 #endif
 727                                 ber_bvfree( scred );
 728                                 rc = ld->ld_errno = LDAP_LOCAL_ERROR;
 729                                 goto done;
 730                         }
 731                         break;
 732                 }
 733
 734                 do {
 735                         saslrc = sasl_client_step( ctx,
 736                                 (scred == NULL) ? NULL : scred->bv_val,
 737                                 (scred == NULL) ? 0 : scred->bv_len,
 738                                 &prompts,
 739                                 (SASL_CONST char **)&ccred.bv_val,
 740                                 &credlen );
 741
 742 #ifdef NEW_LOGGING
 743                                 LDAP_LOG ( TRANSPORT, DETAIL1,
 744                                         "ldap_int_sasl_bind: sasl_client_step: %d\n", saslrc,0,0 );
 745 #else
 746                         Debug( LDAP_DEBUG_TRACE, "sasl_client_step: %d\n",
 747                                 saslrc, 0, 0 );
 748 #endif
 749
 750                         if( saslrc == SASL_INTERACT ) {
 751                                 int res;
 752                                 if( !interact ) break;
 753                                 res = (interact)( ld, flags, defaults, prompts );
 754                                 if( res != LDAP_SUCCESS ) break;
 755                         }
 756                 } while ( saslrc == SASL_INTERACT );
 757
 758                 ccred.bv_len = credlen;
 759                 ber_bvfree( scred );
 760
 761                 if ( (saslrc != SASL_OK) && (saslrc != SASL_CONTINUE) ) {
 762                         ld->ld_errno = sasl_err2ldap( saslrc );
 763 #if SASL_VERSION_MAJOR >= 2
 764                         ld->ld_error = LDAP_STRDUP( sasl_errdetail( ctx ) );
 765 #endif
 766                         rc = ld->ld_errno;
 767                         goto done;
 768                 }
 769         } while ( rc == LDAP_SASL_BIND_IN_PROGRESS );
 770
 771         if ( rc != LDAP_SUCCESS ) goto done;
 772
 773         if ( saslrc != SASL_OK ) {
 774 #if SASL_VERSION_MAJOR >= 2
 775                 ld->ld_error = LDAP_STRDUP( sasl_errdetail( ctx ) );
 776 #endif
 777                 rc = ld->ld_errno = sasl_err2ldap( saslrc );
 778                 goto done;
 779         }
 780
 781         if( flags != LDAP_SASL_QUIET ) {
 782                 saslrc = sasl_getprop( ctx, SASL_USERNAME, (SASL_CONST void **) &data );
 783                 if( saslrc == SASL_OK && data && *data ) {
 784                         fprintf( stderr, "SASL username: %s\n", data );
 785                 }
 786
 787 #if SASL_VERSION_MAJOR < 2
 788                 saslrc = sasl_getprop( ctx, SASL_REALM, (SASL_CONST void **) &data );
 789                 if( saslrc == SASL_OK && data && *data ) {
 790                         fprintf( stderr, "SASL realm: %s\n", data );
 791                 }
 792 #endif
 793         }
 794
 795         saslrc = sasl_getprop( ctx, SASL_SSF, (SASL_CONST void **) &ssf );
 796         if( saslrc == SASL_OK ) {
 797                 if( flags != LDAP_SASL_QUIET ) {
 798                         fprintf( stderr, "SASL SSF: %lu\n",
 799                                 (unsigned long) *ssf );
 800                 }
 801
 802                 if( ssf && *ssf ) {
 803                         if( flags != LDAP_SASL_QUIET ) {
 804                                 fprintf( stderr, "SASL installing layers\n" );
 805                         }
 806                         if ( ld->ld_defconn->lconn_sasl_sockctx ) {
 807                                 oldctx = ld->ld_defconn->lconn_sasl_sockctx;
 808                                 sasl_dispose( &oldctx );
 809                                 ldap_pvt_sasl_remove( ld->ld_sb );
 810                         }
 811                         ldap_pvt_sasl_install( ld->ld_conns->lconn_sb, ctx );
 812                         ld->ld_defconn->lconn_sasl_sockctx = ctx;
 813                 }
 814         }
 815         ld->ld_defconn->lconn_sasl_authctx = ctx;
 816
 817 done:
 818         return rc;
 819 }
 820
 821 int
 822 ldap_int_sasl_external(
 823         LDAP *ld,
 824         LDAPConn *conn,
 825         const char * authid,
 826         ber_len_t ssf )
 827 {
 828         int sc;
 829         sasl_conn_t *ctx;
 830 #if SASL_VERSION_MAJOR < 2
 831         sasl_external_properties_t extprops;
 832 #endif
 833
 834         ctx = conn->lconn_sasl_authctx;
 835
 836         if ( ctx == NULL ) {
 837                 return LDAP_LOCAL_ERROR;
 838         }
 839
 840 #if SASL_VERSION_MAJOR >= 2
 841         sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL, &ssf );
 842         if ( sc == SASL_OK )
 843                 sc = sasl_setprop( ctx, SASL_AUTH_EXTERNAL, authid );
 844 #else
 845         memset( &extprops, '\0', sizeof(extprops) );
 846         extprops.ssf = ssf;
 847         extprops.auth_id = (char *) authid;
 848
 849         sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL,
 850                 (void *) &extprops );
 851 #endif
 852
 853         if ( sc != SASL_OK ) {
 854                 return LDAP_LOCAL_ERROR;
 855         }
 856
 857         return LDAP_SUCCESS;
 858 }
 859
 860
 861 int ldap_pvt_sasl_secprops(
 862         const char *in,
 863         sasl_security_properties_t *secprops )
 864 {
 865         int i;
 866         char **props = ldap_str2charray( in, "," );
 867         unsigned sflags = 0;
 868         int got_sflags = 0;
 869         sasl_ssf_t max_ssf = 0;
 870         int got_max_ssf = 0;
 871         sasl_ssf_t min_ssf = 0;
 872         int got_min_ssf = 0;
 873         unsigned maxbufsize = 0;
 874         int got_maxbufsize = 0;
 875
 876         if( props == NULL || secprops == NULL ) {
 877                 return LDAP_PARAM_ERROR;
 878         }
 879
 880         for( i=0; props[i]; i++ ) {
 881                 if( !strcasecmp(props[i], "none") ) {
 882                         got_sflags++;
 883
 884                 } else if( !strcasecmp(props[i], "noplain") ) {
 885                         got_sflags++;
 886                         sflags |= SASL_SEC_NOPLAINTEXT;
 887
 888                 } else if( !strcasecmp(props[i], "noactive") ) {
 889                         got_sflags++;
 890                         sflags |= SASL_SEC_NOACTIVE;
 891
 892                 } else if( !strcasecmp(props[i], "nodict") ) {
 893                         got_sflags++;
 894                         sflags |= SASL_SEC_NODICTIONARY;
 895
 896                 } else if( !strcasecmp(props[i], "forwardsec") ) {
 897                         got_sflags++;
 898                         sflags |= SASL_SEC_FORWARD_SECRECY;
 899
 900                 } else if( !strcasecmp(props[i], "noanonymous")) {
 901                         got_sflags++;
 902                         sflags |= SASL_SEC_NOANONYMOUS;
 903
 904                 } else if( !strcasecmp(props[i], "passcred") ) {
 905                         got_sflags++;
 906                         sflags |= SASL_SEC_PASS_CREDENTIALS;
 907
 908                 } else if( !strncasecmp(props[i],
 909                         "minssf=", sizeof("minssf")) )
 910                 {
 911                         if( isdigit( (unsigned char) props[i][sizeof("minssf")] ) ) {
 912                                 got_min_ssf++;
 913                                 min_ssf = atoi( &props[i][sizeof("minssf")] );
 914                         } else {
 915                                 return LDAP_NOT_SUPPORTED;
 916                         }
 917
 918                 } else if( !strncasecmp(props[i],
 919                         "maxssf=", sizeof("maxssf")) )
 920                 {
 921                         if( isdigit( (unsigned char) props[i][sizeof("maxssf")] ) ) {
 922                                 got_max_ssf++;
 923                                 max_ssf = atoi( &props[i][sizeof("maxssf")] );
 924                         } else {
 925                                 return LDAP_NOT_SUPPORTED;
 926                         }
 927
 928                 } else if( !strncasecmp(props[i],
 929                         "maxbufsize=", sizeof("maxbufsize")) )
 930                 {
 931                         if( isdigit( (unsigned char) props[i][sizeof("maxbufsize")] ) ) {
 932                                 got_maxbufsize++;
 933                                 maxbufsize = atoi( &props[i][sizeof("maxbufsize")] );
 934                         } else {
 935                                 return LDAP_NOT_SUPPORTED;
 936                         }
 937
 938                         if( maxbufsize && (( maxbufsize < SASL_MIN_BUFF_SIZE )
 939                                 || (maxbufsize > SASL_MAX_BUFF_SIZE )))
 940                         {
 941                                 /* bad maxbufsize */
 942                                 return LDAP_PARAM_ERROR;
 943                         }
 944
 945                 } else {
 946                         return LDAP_NOT_SUPPORTED;
 947                 }
 948         }
 949
 950         if(got_sflags) {
 951                 secprops->security_flags = sflags;
 952         }
 953         if(got_min_ssf) {
 954                 secprops->min_ssf = min_ssf;
 955         }
 956         if(got_max_ssf) {
 957                 secprops->max_ssf = max_ssf;
 958         }
 959         if(got_maxbufsize) {
 960                 secprops->maxbufsize = maxbufsize;
 961         }
 962
 963         ldap_charray_free( props );
 964         return LDAP_SUCCESS;
 965 }
 966
 967 int
 968 ldap_int_sasl_config( struct ldapoptions *lo, int option, const char *arg )
 969 {
 970         int rc;
 971
 972         switch( option ) {
 973         case LDAP_OPT_X_SASL_SECPROPS:
 974                 rc = ldap_pvt_sasl_secprops( arg, &lo->ldo_sasl_secprops );
 975                 if( rc == LDAP_SUCCESS ) return 0;
 976         }
 977
 978         return -1;
 979 }
 980
 981 int
 982 ldap_int_sasl_get_option( LDAP *ld, int option, void *arg )
 983 {
 984         if ( ld == NULL )
 985                 return -1;
 986
 987         switch ( option ) {
 988                 case LDAP_OPT_X_SASL_MECH: {
 989                         *(char **)arg = ld->ld_options.ldo_def_sasl_mech
 990                                 ? LDAP_STRDUP( ld->ld_options.ldo_def_sasl_mech ) : NULL;
 991                 } break;
 992                 case LDAP_OPT_X_SASL_REALM: {
 993                         *(char **)arg = ld->ld_options.ldo_def_sasl_realm
 994                                 ? LDAP_STRDUP( ld->ld_options.ldo_def_sasl_realm ) : NULL;
 995                 } break;
 996                 case LDAP_OPT_X_SASL_AUTHCID: {
 997                         *(char **)arg = ld->ld_options.ldo_def_sasl_authcid
 998                                 ? LDAP_STRDUP( ld->ld_options.ldo_def_sasl_authcid ) : NULL;
 999                 } break;
1000                 case LDAP_OPT_X_SASL_AUTHZID: {
1001                         *(char **)arg = ld->ld_options.ldo_def_sasl_authzid
1002                                 ? LDAP_STRDUP( ld->ld_options.ldo_def_sasl_authzid ) : NULL;
1003                 } break;
1004
1005                 case LDAP_OPT_X_SASL_SSF: {
1006                         int sc;
1007                         sasl_ssf_t      *ssf;
1008                         sasl_conn_t *ctx;
1009
1010                         if( ld->ld_defconn == NULL ) {
1011                                 return -1;
1012                         }
1013
1014                         ctx = ld->ld_defconn->lconn_sasl_sockctx;
1015
1016                         if ( ctx == NULL ) {
1017                                 return -1;
1018                         }
1019
1020                         sc = sasl_getprop( ctx, SASL_SSF,
1021                                 (SASL_CONST void **) &ssf );
1022
1023                         if ( sc != SASL_OK ) {
1024                                 return -1;
1025                         }
1026
1027                         *(ber_len_t *)arg = *ssf;
1028                 } break;
1029
1030                 case LDAP_OPT_X_SASL_SSF_EXTERNAL:
1031                         /* this option is write only */
1032                         return -1;
1033
1034                 case LDAP_OPT_X_SASL_SSF_MIN:
1035                         *(ber_len_t *)arg = ld->ld_options.ldo_sasl_secprops.min_ssf;
1036                         break;
1037                 case LDAP_OPT_X_SASL_SSF_MAX:
1038                         *(ber_len_t *)arg = ld->ld_options.ldo_sasl_secprops.max_ssf;
1039                         break;
1040                 case LDAP_OPT_X_SASL_MAXBUFSIZE:
1041                         *(ber_len_t *)arg = ld->ld_options.ldo_sasl_secprops.maxbufsize;
1042                         break;
1043
1044                 case LDAP_OPT_X_SASL_SECPROPS:
1045                         /* this option is write only */
1046                         return -1;
1047
1048                 default:
1049                         return -1;
1050         }
1051         return 0;
1052 }
1053
1054 int
1055 ldap_int_sasl_set_option( LDAP *ld, int option, void *arg )
1056 {
1057         if ( ld == NULL )
1058                 return -1;
1059
1060         switch ( option ) {
1061         case LDAP_OPT_X_SASL_SSF:
1062                 /* This option is read-only */
1063                 return -1;
1064
1065         case LDAP_OPT_X_SASL_SSF_EXTERNAL: {
1066                 int sc;
1067 #if SASL_VERSION_MAJOR < 2
1068                 sasl_external_properties_t extprops;
1069 #endif
1070                 sasl_conn_t *ctx;
1071
1072                 if( ld->ld_defconn == NULL ) {
1073                         return -1;
1074                 }
1075
1076                 ctx = ld->ld_defconn->lconn_sasl_authctx;
1077
1078                 if ( ctx == NULL ) {
1079                         return -1;
1080                 }
1081
1082 #if SASL_VERSION_MAJOR >= 2
1083                 sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL, arg);
1084 #else
1085                 memset(&extprops, 0L, sizeof(extprops));
1086
1087                 extprops.ssf = * (ber_len_t *) arg;
1088
1089                 sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL,
1090                         (void *) &extprops );
1091 #endif
1092
1093                 if ( sc != SASL_OK ) {
1094                         return -1;
1095                 }
1096                 } break;
1097
1098         case LDAP_OPT_X_SASL_SSF_MIN:
1099                 ld->ld_options.ldo_sasl_secprops.min_ssf = *(ber_len_t *)arg;
1100                 break;
1101         case LDAP_OPT_X_SASL_SSF_MAX:
1102                 ld->ld_options.ldo_sasl_secprops.max_ssf = *(ber_len_t *)arg;
1103                 break;
1104         case LDAP_OPT_X_SASL_MAXBUFSIZE:
1105                 ld->ld_options.ldo_sasl_secprops.maxbufsize = *(ber_len_t *)arg;
1106                 break;
1107
1108         case LDAP_OPT_X_SASL_SECPROPS: {
1109                 int sc;
1110                 sc = ldap_pvt_sasl_secprops( (char *) arg,
1111                         &ld->ld_options.ldo_sasl_secprops );
1112
1113                 return sc == LDAP_SUCCESS ? 0 : -1;
1114                 }
1115
1116         default:
1117                 return -1;
1118         }
1119         return 0;
1120 }
1121
1122 #ifdef LDAP_R_COMPILE
1123 #define LDAP_DEBUG_R_SASL
1124 void *ldap_pvt_sasl_mutex_new(void)
1125 {
1126         ldap_pvt_thread_mutex_t *mutex;
1127
1128         mutex = (ldap_pvt_thread_mutex_t *) LDAP_MALLOC(
1129                 sizeof(ldap_pvt_thread_mutex_t) );
1130
1131         if ( ldap_pvt_thread_mutex_init( mutex ) == 0 ) {
1132                 return mutex;
1133         }
1134 #ifndef LDAP_DEBUG_R_SASL
1135         assert( 0 );
1136 #endif /* !LDAP_DEBUG_R_SASL */
1137         return NULL;
1138 }
1139
1140 int ldap_pvt_sasl_mutex_lock(void *mutex)
1141 {
1142 #ifdef LDAP_DEBUG_R_SASL
1143         if ( mutex == NULL ) {
1144                 return SASL_OK;
1145         }
1146 #else /* !LDAP_DEBUG_R_SASL */
1147         assert( mutex );
1148 #endif /* !LDAP_DEBUG_R_SASL */
1149         return ldap_pvt_thread_mutex_lock( (ldap_pvt_thread_mutex_t *)mutex )
1150                 ? SASL_FAIL : SASL_OK;
1151 }
1152
1153 int ldap_pvt_sasl_mutex_unlock(void *mutex)
1154 {
1155 #ifdef LDAP_DEBUG_R_SASL
1156         if ( mutex == NULL ) {
1157                 return SASL_OK;
1158         }
1159 #else /* !LDAP_DEBUG_R_SASL */
1160         assert( mutex );
1161 #endif /* !LDAP_DEBUG_R_SASL */
1162         return ldap_pvt_thread_mutex_unlock( (ldap_pvt_thread_mutex_t *)mutex )
1163                 ? SASL_FAIL : SASL_OK;
1164 }
1165
1166 void ldap_pvt_sasl_mutex_dispose(void *mutex)
1167 {
1168 #ifdef LDAP_DEBUG_R_SASL
1169         if ( mutex == NULL ) {
1170                 return;
1171         }
1172 #else /* !LDAP_DEBUG_R_SASL */
1173         assert( mutex );
1174 #endif /* !LDAP_DEBUG_R_SASL */
1175         (void) ldap_pvt_thread_mutex_destroy( (ldap_pvt_thread_mutex_t *)mutex );
1176         LDAP_FREE( mutex );
1177 }
1178 #endif
1179
1180 #else
1181 int ldap_int_sasl_init( void )
1182 { return LDAP_SUCCESS; }
1183
1184 int ldap_int_sasl_close( LDAP *ld, LDAPConn *lc )
1185 { return LDAP_SUCCESS; }
1186
1187 int
1188 ldap_int_sasl_bind(
1189         LDAP                    *ld,
1190         const char              *dn,
1191         const char              *mechs,
1192         LDAPControl             **sctrls,
1193         LDAPControl             **cctrls,
1194         unsigned                flags,
1195         LDAP_SASL_INTERACT_PROC *interact,
1196         void * defaults )
1197 { return LDAP_NOT_SUPPORTED; }
1198
1199 int
1200 ldap_int_sasl_external(
1201         LDAP *ld,
1202         LDAPConn *conn,
1203         const char * authid,
1204         ber_len_t ssf )
1205 { return LDAP_SUCCESS; }
1206
1207 #endif /* HAVE_CYRUS_SASL */