git.sur5r.net Git - openldap/blob - servers/slapd/passwd.c

   1 /* bind.c - ldbm backend bind and unbind routines */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
   5  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   6  */
   7
   8 #include "portable.h"
   9
  10 #include <stdio.h>
  11
  12 #include <ac/krb.h>
  13 #include <ac/socket.h>
  14 #include <ac/string.h>
  15 #include <ac/unistd.h>
  16
  17 #include "slap.h"
  18
  19 #include <lber_pvt.h>
  20 #include <lutil.h>
  21
  22 int passwd_extop(
  23         Connection *conn, Operation *op,
  24         const char *reqoid,
  25         struct berval *reqdata,
  26         char **rspoid,
  27         struct berval **rspdata,
  28         LDAPControl ***rspctrls,
  29         const char **text,
  30         BerVarray *refs )
  31 {
  32         int rc;
  33
  34         assert( reqoid != NULL );
  35         assert( strcmp( LDAP_EXOP_MODIFY_PASSWD, reqoid ) == 0 );
  36
  37         if( op->o_dn.bv_len == 0 ) {
  38                 *text = "only authenticated users may change passwords";
  39                 return LDAP_STRONG_AUTH_REQUIRED;
  40         }
  41
  42         if( conn->c_authz_backend == NULL || !conn->c_authz_backend->be_extended ) {
  43                 *text = "operation not supported for current user";
  44                 return LDAP_UNWILLING_TO_PERFORM;
  45         }
  46
  47         {
  48                 struct berval passwd = BER_BVC( LDAP_EXOP_MODIFY_PASSWD );
  49
  50                 rc = backend_check_restrictions( conn->c_authz_backend,
  51                         conn, op, &passwd, text );
  52         }
  53
  54         if( rc != LDAP_SUCCESS ) {
  55                 return rc;
  56         }
  57
  58         if( conn->c_authz_backend->be_update_ndn.bv_len ) {
  59                 /* we SHOULD return a referral in this case */
  60                 *refs = referral_rewrite( conn->c_authz_backend->be_update_refs,
  61                         NULL, NULL, LDAP_SCOPE_DEFAULT );
  62                         rc = LDAP_REFERRAL;
  63
  64         } else {
  65                 rc = conn->c_authz_backend->be_extended(
  66                         conn->c_authz_backend, conn, op,
  67                         reqoid, reqdata,
  68                         rspoid, rspdata, rspctrls,
  69                         text, refs );
  70         }
  71
  72         return rc;
  73 }
  74
  75 int slap_passwd_parse( struct berval *reqdata,
  76         struct berval *id,
  77         struct berval *oldpass,
  78         struct berval *newpass,
  79         const char **text )
  80 {
  81         int rc = LDAP_SUCCESS;
  82         ber_tag_t tag;
  83         ber_len_t len;
  84         char berbuf[256];
  85         BerElement *ber = (BerElement *)berbuf;
  86
  87         if( reqdata == NULL ) {
  88                 return LDAP_SUCCESS;
  89         }
  90
  91         /* ber_init2 uses reqdata directly, doesn't allocate new buffers */
  92         ber_init2( ber, reqdata, 0 );
  93
  94         tag = ber_scanf( ber, "{" /*}*/ );
  95
  96         if( tag != LBER_ERROR ) {
  97                 tag = ber_peek_tag( ber, &len );
  98         }
  99
 100         if( tag == LDAP_TAG_EXOP_MODIFY_PASSWD_ID ) {
 101                 if( id == NULL ) {
 102 #ifdef NEW_LOGGING
 103                         LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
 104                                    "slap_passwd_parse: ID not allowed.\n"));
 105 #else
 106                         Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID not allowed.\n",
 107                                 0, 0, 0 );
 108 #endif
 109
 110                         *text = "user must change own password";
 111                         rc = LDAP_UNWILLING_TO_PERFORM;
 112                         goto done;
 113                 }
 114
 115                 tag = ber_scanf( ber, "m", id );
 116
 117                 if( tag == LBER_ERROR ) {
 118 #ifdef NEW_LOGGING
 119                         LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
 120                                    "slap_passwd_parse:  ID parse failed.\n"));
 121 #else
 122                         Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID parse failed.\n",
 123                                 0, 0, 0 );
 124 #endif
 125
 126                         goto decoding_error;
 127                 }
 128
 129                 tag = ber_peek_tag( ber, &len);
 130         }
 131
 132         if( tag == LDAP_TAG_EXOP_MODIFY_PASSWD_OLD ) {
 133                 if( oldpass == NULL ) {
 134 #ifdef NEW_LOGGING
 135                         LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
 136                                    "slap_passwd_parse: OLD not allowed.\n" ));
 137 #else
 138                         Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: OLD not allowed.\n",
 139                                 0, 0, 0 );
 140 #endif
 141
 142                         *text = "use bind to verify old password";
 143                         rc = LDAP_UNWILLING_TO_PERFORM;
 144                         goto done;
 145                 }
 146
 147                 tag = ber_scanf( ber, "m", oldpass );
 148
 149                 if( tag == LBER_ERROR ) {
 150 #ifdef NEW_LOGGING
 151                         LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
 152                                    "slap_passwd_parse:  ID parse failed.\n" ));
 153 #else
 154                         Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID parse failed.\n",
 155                                 0, 0, 0 );
 156 #endif
 157
 158                         goto decoding_error;
 159                 }
 160
 161                 tag = ber_peek_tag( ber, &len );
 162         }
 163
 164         if( tag == LDAP_TAG_EXOP_MODIFY_PASSWD_NEW ) {
 165                 if( newpass == NULL ) {
 166 #ifdef NEW_LOGGING
 167                         LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
 168                                    "slap_passwd_parse:  NEW not allowed.\n" ));
 169 #else
 170                         Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: NEW not allowed.\n",
 171                                 0, 0, 0 );
 172 #endif
 173
 174                         *text = "user specified passwords disallowed";
 175                         rc = LDAP_UNWILLING_TO_PERFORM;
 176                         goto done;
 177                 }
 178
 179                 tag = ber_scanf( ber, "m", newpass );
 180
 181                 if( tag == LBER_ERROR ) {
 182 #ifdef NEW_LOGGING
 183                         LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
 184                                    "slap_passwd_parse:  OLD parse failed.\n"));
 185 #else
 186                         Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: OLD parse failed.\n",
 187                                 0, 0, 0 );
 188 #endif
 189
 190                         goto decoding_error;
 191                 }
 192
 193                 tag = ber_peek_tag( ber, &len );
 194         }
 195
 196         if( len != 0 ) {
 197 decoding_error:
 198 #ifdef NEW_LOGGING
 199                 LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
 200                            "slap_passwd_parse: decoding error, len=%ld\n", (long)len ));
 201 #else
 202                 Debug( LDAP_DEBUG_TRACE,
 203                         "slap_passwd_parse: decoding error, len=%ld\n",
 204                         (long) len, 0, 0 );
 205 #endif
 206
 207
 208                 *text = "data decoding error";
 209                 rc = LDAP_PROTOCOL_ERROR;
 210         }
 211
 212 done:
 213         return rc;
 214 }
 215
 216 struct berval * slap_passwd_return(
 217         struct berval           *cred )
 218 {
 219         int rc;
 220         struct berval *bv = NULL;
 221         char berbuf[256];
 222         /* opaque structure, size unknown but smaller than berbuf */
 223         BerElement *ber = (BerElement *)berbuf;
 224
 225         assert( cred != NULL );
 226
 227 #ifdef NEW_LOGGING
 228         LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY,
 229                    "slap_passwd_return: %ld\n",(long)cred->bv_len ));
 230 #else
 231         Debug( LDAP_DEBUG_TRACE, "slap_passwd_return: %ld\n",
 232                 (long) cred->bv_len, 0, 0 );
 233 #endif
 234
 235         ber_init_w_nullc( ber, LBER_USE_DER );
 236
 237         rc = ber_printf( ber, "{tON}",
 238                 LDAP_TAG_EXOP_MODIFY_PASSWD_GEN, cred );
 239
 240         if( rc >= 0 ) {
 241                 (void) ber_flatten( ber, &bv );
 242         }
 243
 244         ber_free_buf( ber );
 245
 246         return bv;
 247 }
 248
 249 int
 250 slap_passwd_check(
 251         Connection *conn,
 252         Attribute *a,
 253         struct berval *cred )
 254 {
 255         int result = 1;
 256         struct berval *bv;
 257
 258 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
 259         ldap_pvt_thread_mutex_lock( &passwd_mutex );
 260 #ifdef SLAPD_SPASSWD
 261         lutil_passwd_sasl_conn = conn->c_sasl_context;
 262 #endif
 263 #endif
 264
 265         for ( bv = a->a_vals; bv->bv_val != NULL; bv++ ) {
 266                 if( !lutil_passwd( bv, cred, NULL ) ) {
 267                         result = 0;
 268                         break;
 269                 }
 270         }
 271
 272 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
 273 #ifdef SLAPD_SPASSWD
 274         lutil_passwd_sasl_conn = NULL;
 275 #endif
 276         ldap_pvt_thread_mutex_unlock( &passwd_mutex );
 277 #endif
 278
 279         return result;
 280 }
 281
 282 void
 283 slap_passwd_generate( struct berval *pass )
 284 {
 285         struct berval *tmp;
 286 #ifdef NEW_LOGGING
 287         LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY,
 288                    "slap_passwd_generate: begin\n" ));
 289 #else
 290         Debug( LDAP_DEBUG_TRACE, "slap_passwd_generate\n", 0, 0, 0 );
 291 #endif
 292         /*
 293          * generate passwords of only 8 characters as some getpass(3)
 294          * implementations truncate at 8 characters.
 295          */
 296         tmp = lutil_passwd_generate( 8 );
 297         if (tmp) {
 298                 *pass = *tmp;
 299                 free(tmp);
 300         } else {
 301                 pass->bv_val = NULL;
 302                 pass->bv_len = 0;
 303         }
 304 }
 305
 306 void
 307 slap_passwd_hash(
 308         struct berval * cred,
 309         struct berval * new )
 310 {
 311         struct berval *tmp;
 312 #ifdef LUTIL_SHA1_BYTES
 313         char* hash = default_passwd_hash ?  default_passwd_hash : "{SSHA}";
 314 #else
 315         char* hash = default_passwd_hash ?  default_passwd_hash : "{SMD5}";
 316 #endif
 317
 318
 319 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
 320         ldap_pvt_thread_mutex_lock( &passwd_mutex );
 321 #endif
 322
 323         tmp = lutil_passwd_hash( cred , hash );
 324
 325 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
 326         ldap_pvt_thread_mutex_unlock( &passwd_mutex );
 327 #endif
 328
 329         if( tmp == NULL ) {
 330                 new->bv_len = 0;
 331                 new->bv_val = NULL;
 332         }
 333
 334         *new = *tmp;
 335         free( tmp );
 336         return;
 337 }