git.sur5r.net Git - openldap/blob - servers/slapd/passwd.c

   1 /* bind.c - ldbm backend bind and unbind routines */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
   5  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   6  */
   7
   8 #include "portable.h"
   9
  10 #include <stdio.h>
  11
  12 #include <ac/krb.h>
  13 #include <ac/socket.h>
  14 #include <ac/string.h>
  15 #include <ac/unistd.h>
  16
  17 #include "slap.h"
  18
  19 #include <lber_pvt.h>
  20 #include <lutil.h>
  21
  22 int passwd_extop(
  23         Connection *conn, Operation *op,
  24         const char *reqoid,
  25         struct berval *reqdata,
  26         char **rspoid,
  27         struct berval **rspdata,
  28         LDAPControl ***rspctrls,
  29         const char **text,
  30         BerVarray *refs )
  31 {
  32         Backend *be;
  33         int rc;
  34
  35         assert( reqoid != NULL );
  36         assert( strcmp( LDAP_EXOP_MODIFY_PASSWD, reqoid ) == 0 );
  37
  38         if( op->o_dn.bv_len == 0 ) {
  39                 *text = "only authenticated users may change passwords";
  40                 return LDAP_STRONG_AUTH_REQUIRED;
  41         }
  42
  43         ldap_pvt_thread_mutex_lock( &conn->c_mutex );
  44         be = conn->c_authz_backend;
  45         ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
  46
  47         if( be && !be->be_extended ) {
  48                 *text = "operation not supported for current user";
  49                 return LDAP_UNWILLING_TO_PERFORM;
  50         }
  51
  52         {
  53                 struct berval passwd = BER_BVC( LDAP_EXOP_MODIFY_PASSWD );
  54                 rc = backend_check_restrictions( be, conn, op, &passwd, text );
  55         }
  56
  57         if( rc != LDAP_SUCCESS ) {
  58                 return rc;
  59         }
  60
  61         if( be == NULL ) {
  62 #ifdef HAVE_CYRUS_SASL
  63                 rc = slap_sasl_setpass( conn, op,
  64                         reqoid, reqdata,
  65                         rspoid, rspdata, rspctrls,
  66                         text );
  67 #else
  68                 *text = "no authz backend";
  69                 rc = LDAP_OTHER;
  70 #endif
  71
  72 #ifndef SLAPD_MULTIMASTER
  73         /* This does not apply to multi-master case */
  74         } else if( be->be_update_ndn.bv_len ) {
  75                 /* we SHOULD return a referral in this case */
  76                 *refs = referral_rewrite( be->be_update_refs,
  77                         NULL, NULL, LDAP_SCOPE_DEFAULT );
  78                         rc = LDAP_REFERRAL;
  79 #endif /* !SLAPD_MULTIMASTER */
  80
  81         } else {
  82                 rc = be->be_extended(
  83                         be, conn, op,
  84                         reqoid, reqdata,
  85                         rspoid, rspdata, rspctrls,
  86                         text, refs );
  87         }
  88
  89         return rc;
  90 }
  91
  92 int slap_passwd_parse( struct berval *reqdata,
  93         struct berval *id,
  94         struct berval *oldpass,
  95         struct berval *newpass,
  96         const char **text )
  97 {
  98         int rc = LDAP_SUCCESS;
  99         ber_tag_t tag;
 100         ber_len_t len;
 101         char berbuf[LBER_ELEMENT_SIZEOF];
 102         BerElement *ber = (BerElement *)berbuf;
 103
 104         if( reqdata == NULL ) {
 105                 return LDAP_SUCCESS;
 106         }
 107
 108         if( reqdata->bv_len == 0 ) {
 109                 *text = "empty request data field";
 110                 return LDAP_PROTOCOL_ERROR;
 111         }
 112
 113         /* ber_init2 uses reqdata directly, doesn't allocate new buffers */
 114         ber_init2( ber, reqdata, 0 );
 115
 116         tag = ber_scanf( ber, "{" /*}*/ );
 117
 118         if( tag != LBER_ERROR ) {
 119                 tag = ber_peek_tag( ber, &len );
 120         }
 121
 122         if( tag == LDAP_TAG_EXOP_MODIFY_PASSWD_ID ) {
 123                 if( id == NULL ) {
 124 #ifdef NEW_LOGGING
 125                         LDAP_LOG( OPERATION, ERR,
 126                            "slap_passwd_parse: ID not allowed.\n", 0, 0, 0 );
 127 #else
 128                         Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID not allowed.\n",
 129                                 0, 0, 0 );
 130 #endif
 131
 132                         *text = "user must change own password";
 133                         rc = LDAP_UNWILLING_TO_PERFORM;
 134                         goto done;
 135                 }
 136
 137                 tag = ber_scanf( ber, "m", id );
 138
 139                 if( tag == LBER_ERROR ) {
 140 #ifdef NEW_LOGGING
 141                         LDAP_LOG( OPERATION, ERR,
 142                            "slap_passwd_parse:  ID parse failed.\n", 0, 0, 0 );
 143 #else
 144                         Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID parse failed.\n",
 145                                 0, 0, 0 );
 146 #endif
 147
 148                         goto decoding_error;
 149                 }
 150
 151                 tag = ber_peek_tag( ber, &len);
 152         }
 153
 154         if( tag == LDAP_TAG_EXOP_MODIFY_PASSWD_OLD ) {
 155                 if( oldpass == NULL ) {
 156 #ifdef NEW_LOGGING
 157                         LDAP_LOG( OPERATION, ERR,
 158                            "slap_passwd_parse: OLD not allowed.\n" , 0, 0, 0 );
 159 #else
 160                         Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: OLD not allowed.\n",
 161                                 0, 0, 0 );
 162 #endif
 163
 164                         *text = "use bind to verify old password";
 165                         rc = LDAP_UNWILLING_TO_PERFORM;
 166                         goto done;
 167                 }
 168
 169                 tag = ber_scanf( ber, "m", oldpass );
 170
 171                 if( tag == LBER_ERROR ) {
 172 #ifdef NEW_LOGGING
 173                         LDAP_LOG( OPERATION, ERR,
 174                            "slap_passwd_parse:  ID parse failed.\n" , 0, 0, 0 );
 175 #else
 176                         Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID parse failed.\n",
 177                                 0, 0, 0 );
 178 #endif
 179
 180                         goto decoding_error;
 181                 }
 182
 183                 tag = ber_peek_tag( ber, &len );
 184         }
 185
 186         if( tag == LDAP_TAG_EXOP_MODIFY_PASSWD_NEW ) {
 187                 if( newpass == NULL ) {
 188 #ifdef NEW_LOGGING
 189                         LDAP_LOG( OPERATION, ERR,
 190                            "slap_passwd_parse:  NEW not allowed.\n", 0, 0, 0 );
 191 #else
 192                         Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: NEW not allowed.\n",
 193                                 0, 0, 0 );
 194 #endif
 195
 196                         *text = "user specified passwords disallowed";
 197                         rc = LDAP_UNWILLING_TO_PERFORM;
 198                         goto done;
 199                 }
 200
 201                 tag = ber_scanf( ber, "m", newpass );
 202
 203                 if( tag == LBER_ERROR ) {
 204 #ifdef NEW_LOGGING
 205                         LDAP_LOG( OPERATION, ERR,
 206                            "slap_passwd_parse:  OLD parse failed.\n", 0, 0, 0 );
 207 #else
 208                         Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: OLD parse failed.\n",
 209                                 0, 0, 0 );
 210 #endif
 211
 212                         goto decoding_error;
 213                 }
 214
 215                 tag = ber_peek_tag( ber, &len );
 216         }
 217
 218         if( len != 0 ) {
 219 decoding_error:
 220 #ifdef NEW_LOGGING
 221                 LDAP_LOG( OPERATION, ERR,
 222                         "slap_passwd_parse: decoding error, len=%ld\n", (long)len, 0, 0 );
 223 #else
 224                 Debug( LDAP_DEBUG_TRACE,
 225                         "slap_passwd_parse: decoding error, len=%ld\n",
 226                         (long) len, 0, 0 );
 227 #endif
 228
 229                 *text = "data decoding error";
 230                 rc = LDAP_PROTOCOL_ERROR;
 231         }
 232
 233 done:
 234         return rc;
 235 }
 236
 237 struct berval * slap_passwd_return(
 238         struct berval           *cred )
 239 {
 240         int rc;
 241         struct berval *bv = NULL;
 242         char berbuf[LBER_ELEMENT_SIZEOF];
 243         /* opaque structure, size unknown but smaller than berbuf */
 244         BerElement *ber = (BerElement *)berbuf;
 245
 246         assert( cred != NULL );
 247
 248 #ifdef NEW_LOGGING
 249         LDAP_LOG( OPERATION, ENTRY,
 250                 "slap_passwd_return: %ld\n",(long)cred->bv_len, 0, 0 );
 251 #else
 252         Debug( LDAP_DEBUG_TRACE, "slap_passwd_return: %ld\n",
 253                 (long) cred->bv_len, 0, 0 );
 254 #endif
 255
 256         ber_init_w_nullc( ber, LBER_USE_DER );
 257
 258         rc = ber_printf( ber, "{tON}",
 259                 LDAP_TAG_EXOP_MODIFY_PASSWD_GEN, cred );
 260
 261         if( rc >= 0 ) {
 262                 (void) ber_flatten( ber, &bv );
 263         }
 264
 265         ber_free_buf( ber );
 266
 267         return bv;
 268 }
 269
 270 int
 271 slap_passwd_check(
 272         Connection *conn,
 273         Attribute *a,
 274         struct berval *cred )
 275 {
 276         int result = 1;
 277         struct berval *bv;
 278
 279 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
 280         ldap_pvt_thread_mutex_lock( &passwd_mutex );
 281 #ifdef SLAPD_SPASSWD
 282         lutil_passwd_sasl_conn = conn->c_sasl_context;
 283 #endif
 284 #endif
 285
 286         for ( bv = a->a_vals; bv->bv_val != NULL; bv++ ) {
 287                 if( !lutil_passwd( bv, cred, NULL ) ) {
 288                         result = 0;
 289                         break;
 290                 }
 291         }
 292
 293 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
 294 #ifdef SLAPD_SPASSWD
 295         lutil_passwd_sasl_conn = NULL;
 296 #endif
 297         ldap_pvt_thread_mutex_unlock( &passwd_mutex );
 298 #endif
 299
 300         return result;
 301 }
 302
 303 void
 304 slap_passwd_generate( struct berval *pass )
 305 {
 306         struct berval *tmp;
 307 #ifdef NEW_LOGGING
 308         LDAP_LOG( OPERATION, ENTRY, "slap_passwd_generate: begin\n", 0, 0, 0 );
 309 #else
 310         Debug( LDAP_DEBUG_TRACE, "slap_passwd_generate\n", 0, 0, 0 );
 311 #endif
 312         /*
 313          * generate passwords of only 8 characters as some getpass(3)
 314          * implementations truncate at 8 characters.
 315          */
 316         tmp = lutil_passwd_generate( 8 );
 317         if (tmp) {
 318                 *pass = *tmp;
 319                 free(tmp);
 320         } else {
 321                 pass->bv_val = NULL;
 322                 pass->bv_len = 0;
 323         }
 324 }
 325
 326 void
 327 slap_passwd_hash(
 328         struct berval * cred,
 329         struct berval * new )
 330 {
 331         struct berval *tmp;
 332 #ifdef LUTIL_SHA1_BYTES
 333         char* hash = default_passwd_hash ?  default_passwd_hash : "{SSHA}";
 334 #else
 335         char* hash = default_passwd_hash ?  default_passwd_hash : "{SMD5}";
 336 #endif
 337
 338
 339 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
 340         ldap_pvt_thread_mutex_lock( &passwd_mutex );
 341 #endif
 342
 343         tmp = lutil_passwd_hash( cred , hash );
 344
 345 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
 346         ldap_pvt_thread_mutex_unlock( &passwd_mutex );
 347 #endif
 348
 349         if( tmp == NULL ) {
 350                 new->bv_len = 0;
 351                 new->bv_val = NULL;
 352         }
 353
 354         *new = *tmp;
 355         free( tmp );
 356         return;
 357 }