git.sur5r.net Git - openldap/blob - servers/slapd/bind.c

   1 /* bind.c - decode an ldap bind operation and pass it to a backend db */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 1998-2015 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
  17  * All rights reserved.
  18  *
  19  * Redistribution and use in source and binary forms are permitted
  20  * provided that this notice is preserved and that due credit is given
  21  * to the University of Michigan at Ann Arbor. The name of the University
  22  * may not be used to endorse or promote products derived from this
  23  * software without specific prior written permission. This software
  24  * is provided ``as is'' without express or implied warranty.
  25  */
  26
  27 #include "portable.h"
  28
  29 #include <stdio.h>
  30
  31 #include <ac/string.h>
  32 #include <ac/socket.h>
  33
  34 #include "slap.h"
  35 #include "lutil.h"
  36
  37 int
  38 do_bind(
  39     Operation   *op,
  40     SlapReply   *rs )
  41 {
  42         BerElement *ber = op->o_ber;
  43         ber_int_t version;
  44         ber_tag_t method;
  45         struct berval mech = BER_BVNULL;
  46         struct berval dn = BER_BVNULL;
  47         ber_tag_t tag;
  48         Backend *be = NULL;
  49         char *sl = op->o_logptr;
  50
  51         Debug( LDAP_DEBUG_TRACE, "%s do_bind\n",
  52                 op->o_log_prefix, 0, 0 );
  53
  54         /*
  55          * Force the connection to "anonymous" until bind succeeds.
  56          */
  57         ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
  58         if ( op->o_conn->c_sasl_bind_in_progress ) {
  59                 be = op->o_conn->c_authz_backend;
  60         }
  61         if ( !BER_BVISEMPTY( &op->o_conn->c_dn ) && StatslogTest( LDAP_DEBUG_STATS )) {
  62                 /* log authorization identity demotion */
  63                 sl = lutil_strcopy( sl, " BIND anonymous mech=implicit ssf=0\n" );
  64         }
  65         connection2anonymous( op->o_conn );
  66         if ( op->o_conn->c_sasl_bind_in_progress ) {
  67                 op->o_conn->c_authz_backend = be;
  68         }
  69         ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
  70         if ( !BER_BVISNULL( &op->o_dn ) ) {
  71                 /* NOTE: temporarily wasting few bytes
  72                  * (until bind is completed), but saving
  73                  * a couple of ch_free() and ch_strdup("") */
  74                 op->o_dn.bv_val[0] = '\0';
  75                 op->o_dn.bv_len = 0;
  76         }
  77         if ( !BER_BVISNULL( &op->o_ndn ) ) {
  78                 op->o_ndn.bv_val[0] = '\0';
  79                 op->o_ndn.bv_len = 0;
  80         }
  81
  82         /*
  83          * Parse the bind request.  It looks like this:
  84          *
  85          *      BindRequest ::= SEQUENCE {
  86          *              version         INTEGER,                 -- version
  87          *              name            DistinguishedName,       -- dn
  88          *              authentication  CHOICE {
  89          *                      simple          [0] OCTET STRING -- passwd
  90          *                      krbv42ldap      [1] OCTET STRING -- OBSOLETE
  91          *                      krbv42dsa       [2] OCTET STRING -- OBSOLETE
  92          *                      SASL            [3] SaslCredentials
  93          *              }
  94          *      }
  95          *
  96          *      SaslCredentials ::= SEQUENCE {
  97          *              mechanism           LDAPString,
  98          *              credentials         OCTET STRING OPTIONAL
  99          *      }
 100          */
 101
 102         tag = ber_scanf( ber, "{imt" /*}*/, &version, &dn, &method );
 103
 104         if ( tag == LBER_ERROR ) {
 105                 Debug( LDAP_DEBUG_ANY, "%s do_bind: ber_scanf failed\n",
 106                         op->o_log_prefix, 0, 0 );
 107                 send_ldap_discon( op, rs, LDAP_PROTOCOL_ERROR, "decoding error" );
 108                 rs->sr_err = SLAPD_DISCONNECT;
 109                 goto cleanup;
 110         }
 111
 112         op->o_protocol = version;
 113         op->orb_method = method;
 114
 115         if( op->orb_method != LDAP_AUTH_SASL ) {
 116                 tag = ber_scanf( ber, /*{*/ "m}", &op->orb_cred );
 117
 118         } else {
 119                 tag = ber_scanf( ber, "{m" /*}*/, &mech );
 120
 121                 if ( tag != LBER_ERROR ) {
 122                         ber_len_t len;
 123                         tag = ber_peek_tag( ber, &len );
 124
 125                         if ( tag == LDAP_TAG_LDAPCRED ) {
 126                                 tag = ber_scanf( ber, "m", &op->orb_cred );
 127                         } else {
 128                                 tag = LDAP_TAG_LDAPCRED;
 129                                 BER_BVZERO( &op->orb_cred );
 130                         }
 131
 132                         if ( tag != LBER_ERROR ) {
 133                                 tag = ber_scanf( ber, /*{{*/ "}}" );
 134                         }
 135                 }
 136         }
 137
 138         if ( tag == LBER_ERROR ) {
 139                 Debug( LDAP_DEBUG_ANY, "%s do_bind: ber_scanf failed\n",
 140                         op->o_log_prefix, 0, 0 );
 141                 send_ldap_discon( op, rs, LDAP_PROTOCOL_ERROR, "decoding error" );
 142                 rs->sr_err = SLAPD_DISCONNECT;
 143                 goto cleanup;
 144         }
 145
 146         if( get_ctrls( op, rs, 1 ) != LDAP_SUCCESS ) {
 147                 Debug( LDAP_DEBUG_ANY, "%s do_bind: get_ctrls failed\n",
 148                         op->o_log_prefix, 0, 0 );
 149                 goto cleanup;
 150         }
 151
 152         /* We use the tmpmemctx here because it speeds up normalization.
 153          * However, we must dup with regular malloc when storing any
 154          * resulting DNs in the op or conn structures.
 155          */
 156         rs->sr_err = dnPrettyNormal( NULL, &dn, &op->o_req_dn, &op->o_req_ndn,
 157                 op->o_tmpmemctx );
 158         if ( rs->sr_err != LDAP_SUCCESS ) {
 159                 Debug( LDAP_DEBUG_ANY, "%s do_bind: invalid dn (%s)\n",
 160                         op->o_log_prefix, dn.bv_val, 0 );
 161                 send_ldap_error( op, rs, LDAP_INVALID_DN_SYNTAX, "invalid DN" );
 162                 goto cleanup;
 163         }
 164
 165         if ( StatslogTest( LDAP_DEBUG_STATS )) {
 166                 sl += sprintf( sl, " BIND dn=\"%s\" method=%ld\n",
 167                 op->o_req_dn.bv_val, (unsigned long) op->orb_method );
 168                 if ( ldap_debug & LDAP_DEBUG_STATS )
 169                         lutil_debug( ldap_debug, LDAP_DEBUG_STATS, "%s", op->o_log_prefix );
 170                 if ( ldap_syslog & LDAP_DEBUG_STATS )
 171                         sendlog( op->o_logbuf, sl - op->o_logbuf );
 172                 sl = op->o_logptr;
 173                 *sl = '\0';
 174         }
 175
 176         if( op->orb_method == LDAP_AUTH_SASL ) {
 177                 Debug( LDAP_DEBUG_TRACE, "do_bind: dn (%s) SASL mech %s\n",
 178                         op->o_req_dn.bv_val, mech.bv_val, NULL );
 179
 180         } else {
 181                 Debug( LDAP_DEBUG_TRACE,
 182                         "do_bind: version=%ld dn=\"%s\" method=%ld\n",
 183                         (unsigned long) version, op->o_req_dn.bv_val,
 184                         (unsigned long) op->orb_method );
 185         }
 186
 187         if ( version < LDAP_VERSION_MIN || version > LDAP_VERSION_MAX ) {
 188                 Debug( LDAP_DEBUG_ANY, "%s do_bind: unknown version=%ld\n",
 189                         op->o_log_prefix, (unsigned long) version, 0 );
 190                 send_ldap_error( op, rs, LDAP_PROTOCOL_ERROR,
 191                         "requested protocol version not supported" );
 192                 goto cleanup;
 193
 194         } else if (!( global_allows & SLAP_ALLOW_BIND_V2 ) &&
 195                 version < LDAP_VERSION3 )
 196         {
 197                 send_ldap_error( op, rs, LDAP_PROTOCOL_ERROR,
 198                         "historical protocol version requested, use LDAPv3 instead" );
 199                 goto cleanup;
 200         }
 201
 202         /*
 203          * we set connection version regardless of whether bind succeeds or not.
 204          */
 205         ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
 206         op->o_conn->c_protocol = version;
 207         ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
 208
 209         op->orb_mech = mech;
 210
 211         op->o_bd = frontendDB;
 212         rs->sr_err = frontendDB->be_bind( op, rs );
 213
 214 cleanup:
 215         if ( sl != op->o_logptr ) {
 216                 if ( ldap_debug & LDAP_DEBUG_STATS )
 217                         lutil_debug( ldap_debug, LDAP_DEBUG_STATS, "%s", op->o_log_prefix );
 218                 if ( ldap_syslog & LDAP_DEBUG_STATS )
 219                         sendlog( op->o_logbuf, sl - op->o_logbuf );
 220                 *op->o_logptr = '\0';
 221         }
 222         if ( rs->sr_err == LDAP_SUCCESS ) {
 223                 if ( op->orb_method != LDAP_AUTH_SASL ) {
 224                         ber_dupbv( &op->o_conn->c_authmech, &mech );
 225                 }
 226                 op->o_conn->c_authtype = op->orb_method;
 227         }
 228
 229         if( !BER_BVISNULL( &op->o_req_dn ) ) {
 230                 slap_sl_free( op->o_req_dn.bv_val, op->o_tmpmemctx );
 231                 BER_BVZERO( &op->o_req_dn );
 232         }
 233         if( !BER_BVISNULL( &op->o_req_ndn ) ) {
 234                 slap_sl_free( op->o_req_ndn.bv_val, op->o_tmpmemctx );
 235                 BER_BVZERO( &op->o_req_ndn );
 236         }
 237
 238         return rs->sr_err;
 239 }
 240
 241 int
 242 fe_op_bind( Operation *op, SlapReply *rs )
 243 {
 244         BackendDB       *bd = op->o_bd;
 245
 246         /* check for inappropriate controls */
 247         if( get_manageDSAit( op ) == SLAP_CONTROL_CRITICAL ) {
 248                 send_ldap_error( op, rs,
 249                         LDAP_UNAVAILABLE_CRITICAL_EXTENSION,
 250                         "manageDSAit control inappropriate" );
 251                 goto cleanup;
 252         }
 253
 254         if ( op->orb_method == LDAP_AUTH_SASL ) {
 255                 if ( op->o_protocol < LDAP_VERSION3 ) {
 256                         Debug( LDAP_DEBUG_ANY, "do_bind: sasl with LDAPv%ld\n",
 257                                 (unsigned long)op->o_protocol, 0, 0 );
 258                         send_ldap_discon( op, rs,
 259                                 LDAP_PROTOCOL_ERROR, "SASL bind requires LDAPv3" );
 260                         rs->sr_err = SLAPD_DISCONNECT;
 261                         goto cleanup;
 262                 }
 263
 264                 if( BER_BVISNULL( &op->orb_mech ) || BER_BVISEMPTY( &op->orb_mech ) ) {
 265                         Debug( LDAP_DEBUG_ANY,
 266                                 "do_bind: no sasl mechanism provided\n",
 267                                 0, 0, 0 );
 268                         send_ldap_error( op, rs, LDAP_AUTH_METHOD_NOT_SUPPORTED,
 269                                 "no SASL mechanism provided" );
 270                         goto cleanup;
 271                 }
 272
 273                 /* check restrictions */
 274                 if( backend_check_restrictions( op, rs, &op->orb_mech ) != LDAP_SUCCESS ) {
 275                         send_ldap_result( op, rs );
 276                         goto cleanup;
 277                 }
 278
 279                 ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
 280                 if ( op->o_conn->c_sasl_bind_in_progress ) {
 281                         if( !bvmatch( &op->o_conn->c_sasl_bind_mech, &op->orb_mech ) ) {
 282                                 /* mechanism changed between bind steps */
 283                                 slap_sasl_reset(op->o_conn);
 284                         }
 285                 } else {
 286                         ber_dupbv(&op->o_conn->c_sasl_bind_mech, &op->orb_mech);
 287                 }
 288
 289                 /* Set the bindop for the benefit of in-directory SASL lookups */
 290                 op->o_conn->c_sasl_bindop = op;
 291
 292                 ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
 293
 294                 rs->sr_err = slap_sasl_bind( op, rs );
 295
 296                 goto cleanup;
 297
 298         } else {
 299                 /* Not SASL, cancel any in-progress bind */
 300                 ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
 301
 302                 if ( !BER_BVISNULL( &op->o_conn->c_sasl_bind_mech ) ) {
 303                         free( op->o_conn->c_sasl_bind_mech.bv_val );
 304                         BER_BVZERO( &op->o_conn->c_sasl_bind_mech );
 305                 }
 306                 op->o_conn->c_sasl_bind_in_progress = 0;
 307
 308                 slap_sasl_reset( op->o_conn );
 309                 ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
 310         }
 311
 312         if ( op->orb_method == LDAP_AUTH_SIMPLE ) {
 313                 BER_BVSTR( &op->orb_mech, "SIMPLE" );
 314                 /* accept "anonymous" binds */
 315                 if ( BER_BVISEMPTY( &op->orb_cred ) || BER_BVISEMPTY( &op->o_req_ndn ) ) {
 316                         rs->sr_err = LDAP_SUCCESS;
 317
 318                         if( !BER_BVISEMPTY( &op->orb_cred ) &&
 319                                 !( global_allows & SLAP_ALLOW_BIND_ANON_CRED ))
 320                         {
 321                                 /* cred is not empty, disallow */
 322                                 rs->sr_err = LDAP_INVALID_CREDENTIALS;
 323
 324                         } else if ( !BER_BVISEMPTY( &op->o_req_ndn ) &&
 325                                 !( global_allows & SLAP_ALLOW_BIND_ANON_DN ))
 326                         {
 327                                 /* DN is not empty, disallow */
 328                                 rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 329                                 rs->sr_text =
 330                                         "unauthenticated bind (DN with no password) disallowed";
 331
 332                         } else if ( global_disallows & SLAP_DISALLOW_BIND_ANON ) {
 333                                 /* disallow */
 334                                 rs->sr_err = LDAP_INAPPROPRIATE_AUTH;
 335                                 rs->sr_text = "anonymous bind disallowed";
 336
 337                         } else {
 338                                 backend_check_restrictions( op, rs, &op->orb_mech );
 339                         }
 340
 341                         /*
 342                          * we already forced connection to "anonymous",
 343                          * just need to send success
 344                          */
 345                         send_ldap_result( op, rs );
 346                         Debug( LDAP_DEBUG_TRACE, "do_bind: v%d anonymous bind\n",
 347                                 op->o_protocol, 0, 0 );
 348                         goto cleanup;
 349
 350                 } else if ( global_disallows & SLAP_DISALLOW_BIND_SIMPLE ) {
 351                         /* disallow simple authentication */
 352                         rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 353                         rs->sr_text = "unwilling to perform simple authentication";
 354
 355                         send_ldap_result( op, rs );
 356                         Debug( LDAP_DEBUG_TRACE,
 357                                 "do_bind: v%d simple bind(%s) disallowed\n",
 358                                 op->o_protocol, op->o_req_ndn.bv_val, 0 );
 359                         goto cleanup;
 360                 }
 361
 362         } else {
 363                 rs->sr_err = LDAP_AUTH_METHOD_NOT_SUPPORTED;
 364                 rs->sr_text = "unknown authentication method";
 365
 366                 send_ldap_result( op, rs );
 367                 Debug( LDAP_DEBUG_TRACE,
 368                         "do_bind: v%d unknown authentication method (%d)\n",
 369                         op->o_protocol, op->orb_method, 0 );
 370                 goto cleanup;
 371         }
 372
 373         /*
 374          * We could be serving multiple database backends.  Select the
 375          * appropriate one, or send a referral to our "referral server"
 376          * if we don't hold it.
 377          */
 378
 379         if ( (op->o_bd = select_backend( &op->o_req_ndn, 0 )) == NULL ) {
 380                 /* don't return referral for bind requests */
 381                 /* noSuchObject is not allowed to be returned by bind */
 382                 rs->sr_err = LDAP_INVALID_CREDENTIALS;
 383                 op->o_bd = bd;
 384                 send_ldap_result( op, rs );
 385                 goto cleanup;
 386         }
 387
 388         /* check restrictions */
 389         if( backend_check_restrictions( op, rs, NULL ) != LDAP_SUCCESS ) {
 390                 send_ldap_result( op, rs );
 391                 goto cleanup;
 392         }
 393
 394         if( op->o_bd->be_bind ) {
 395                 op->o_conn->c_authz_cookie = NULL;
 396
 397                 rs->sr_err = (op->o_bd->be_bind)( op, rs );
 398
 399                 if ( rs->sr_err == 0 ) {
 400                         (void)fe_op_bind_success( op, rs );
 401
 402                 } else if ( !BER_BVISNULL( &op->orb_edn ) ) {
 403                         free( op->orb_edn.bv_val );
 404                         BER_BVZERO( &op->orb_edn );
 405                 }
 406
 407         } else {
 408                 send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
 409                         "operation not supported within naming context" );
 410         }
 411
 412 cleanup:;
 413         op->o_bd = bd;
 414         return rs->sr_err;
 415 }
 416
 417 int
 418 fe_op_bind_success( Operation *op, SlapReply *rs )
 419 {
 420         ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
 421
 422         if( op->o_conn->c_authz_backend == NULL ) {
 423                 op->o_conn->c_authz_backend = op->o_bd;
 424         }
 425
 426         /* be_bind returns regular/global edn */
 427         if( !BER_BVISEMPTY( &op->orb_edn ) ) {
 428                 op->o_conn->c_dn = op->orb_edn;
 429         } else {
 430                 ber_dupbv(&op->o_conn->c_dn, &op->o_req_dn);
 431         }
 432
 433         ber_dupbv( &op->o_conn->c_ndn, &op->o_req_ndn );
 434
 435         /* op->o_conn->c_sb may be 0 for internal operations */
 436         if( !BER_BVISEMPTY( &op->o_conn->c_dn ) && op->o_conn->c_sb != 0 ) {
 437                 ber_len_t max = sockbuf_max_incoming_auth;
 438                 ber_sockbuf_ctrl( op->o_conn->c_sb,
 439                         LBER_SB_OPT_SET_MAX_INCOMING, &max );
 440         }
 441
 442         /* log authorization identity */
 443         Statslog( LDAP_DEBUG_STATS,
 444                 "%s BIND dn=\"%s\" mech=%s ssf=0\n",
 445                 op->o_log_prefix,
 446                 op->o_conn->c_dn.bv_val, op->orb_mech.bv_val, 0, 0 );
 447
 448         Debug( LDAP_DEBUG_TRACE,
 449                 "do_bind: v%d bind: \"%s\" to \"%s\"\n",
 450                 op->o_protocol, op->o_req_dn.bv_val, op->o_conn->c_dn.bv_val );
 451
 452         ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
 453
 454         /* send this here to avoid a race condition */
 455         send_ldap_result( op, rs );
 456
 457         return LDAP_SUCCESS;
 458 }