git.sur5r.net Git - openldap/blob - servers/slapd/sasl.c

   1 /* $OpenLDAP$ */
   2 /*
   3  * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
   4  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   5  */
   6
   7 #include "portable.h"
   8
   9 #include <stdio.h>
  10 #include <ac/stdlib.h>
  11 #include <ac/string.h>
  12
  13 #include <lber.h>
  14 #include <ldap_log.h>
  15
  16 #include "slap.h"
  17
  18 #ifdef HAVE_CYRUS_SASL
  19 #include <limits.h>
  20
  21 #include <sasl.h>
  22
  23 #if SASL_VERSION_MAJOR >= 2
  24 #include <lutil.h>
  25 #define SASL_CONST const
  26 #else
  27 #define SASL_CONST
  28 #endif
  29
  30 #include <ldap_pvt.h>
  31
  32 #ifdef SLAPD_SPASSWD
  33 #include <lutil.h>
  34 #endif
  35
  36 /* Flags for telling slap_sasl_getdn() what type of identity is being passed */
  37 #define FLAG_GETDN_FINAL   1
  38 #define FLAG_GETDN_AUTHCID 2
  39 #define FLAG_GETDN_AUTHZID 4
  40
  41 static sasl_security_properties_t sasl_secprops;
  42
  43 static int
  44 slap_sasl_log(
  45         void *context,
  46         int priority,
  47         const char *message)
  48 {
  49         Connection *conn = context;
  50         int level;
  51         const char * label;
  52
  53         if ( message == NULL ) {
  54                 return SASL_BADPARAM;
  55         }
  56
  57         switch (priority) {
  58 #if SASL_VERSION_MAJOR >= 2
  59         case SASL_LOG_NONE:
  60                 level = LDAP_DEBUG_NONE;
  61                 label = "None";
  62                 break;
  63         case SASL_LOG_ERR:
  64                 level = LDAP_DEBUG_ANY;
  65                 label = "Error";
  66                 break;
  67         case SASL_LOG_FAIL:
  68                 level = LDAP_DEBUG_ANY;
  69                 label = "Failure";
  70                 break;
  71         case SASL_LOG_WARN:
  72                 level = LDAP_DEBUG_TRACE;
  73                 label = "Warning";
  74                 break;
  75         case SASL_LOG_NOTE:
  76                 level = LDAP_DEBUG_TRACE;
  77                 label = "Notice";
  78                 break;
  79         case SASL_LOG_DEBUG:
  80                 level = LDAP_DEBUG_TRACE;
  81                 label = "Debug";
  82                 break;
  83         case SASL_LOG_TRACE:
  84                 level = LDAP_DEBUG_TRACE;
  85                 label = "Trace";
  86                 break;
  87         case SASL_LOG_PASS:
  88                 level = LDAP_DEBUG_TRACE;
  89                 label = "Password Trace";
  90                 break;
  91 #else
  92         case SASL_LOG_ERR:
  93                 level = LDAP_DEBUG_ANY;
  94                 label = "Error";
  95                 break;
  96         case SASL_LOG_WARNING:
  97                 level = LDAP_DEBUG_TRACE;
  98                 label = "Warning";
  99                 break;
 100         case SASL_LOG_INFO:
 101                 level = LDAP_DEBUG_TRACE;
 102                 label = "Info";
 103                 break;
 104 #endif
 105         default:
 106                 return SASL_BADPARAM;
 107         }
 108
 109 #ifdef NEW_LOGGING
 110         LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
 111                 "SASL [conn=%ld] %s: %s\n",
 112                 conn ? conn->c_connid : -1,
 113                 label, message ));
 114 #else
 115         Debug( level, "SASL [conn=%ld] %s: %s\n",
 116                 conn ? conn->c_connid: -1,
 117                 label, message );
 118 #endif
 119
 120
 121         return SASL_OK;
 122 }
 123
 124
 125 /* Take any sort of identity string and return a DN with the "dn:" prefix. The
 126    string returned in *dn is in its own allocated memory, and must be free'd
 127    by the calling process.
 128    -Mark Adamson, Carnegie Mellon
 129 */
 130
 131 #define SET_DN  1
 132 #define SET_U   2
 133
 134 static struct berval ext_bv = { sizeof("EXTERNAL")-1, "EXTERNAL" };
 135
 136 int slap_sasl_getdn( Connection *conn, char *id,
 137         char *user_realm, struct berval *dn, int flags )
 138 {
 139         char *c1;
 140         int rc, len, is_dn = 0;
 141         sasl_conn_t *ctx;
 142         struct berval dn2;
 143
 144 #ifdef NEW_LOGGING
 145         LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
 146                 "slap_sasl_getdn: conn %d id=%s\n",
 147                 conn ? conn->c_connid : -1,
 148                 id ? (*id ? id : "<empty>") : "NULL" ));
 149 #else
 150         Debug( LDAP_DEBUG_ARGS, "slap_sasl_getdn: id=%s\n",
 151       id?(*id?id:"<empty>"):"NULL",0,0 );
 152 #endif
 153
 154         dn->bv_val = NULL;
 155         dn->bv_len = 0;
 156
 157         /* Blatantly anonymous ID */
 158         if( id &&
 159                 ( id[sizeof( "anonymous" )-1] == '\0'
 160                         || id[sizeof( "anonymous" )-1] == '@' ) &&
 161                 !strncasecmp( id, "anonymous", sizeof( "anonymous" )-1) ) {
 162                 return( LDAP_SUCCESS );
 163         }
 164         ctx = conn->c_sasl_context;
 165         len = strlen( id );
 166
 167         /* An authcID needs to be converted to authzID form */
 168         if( flags & FLAG_GETDN_AUTHCID ) {
 169                 if( sasl_external_x509dn_convert
 170                         && conn->c_sasl_bind_mech.bv_len == ext_bv.bv_len
 171                         && ( strcasecmp( ext_bv.bv_val, conn->c_sasl_bind_mech.bv_val ) == 0 )
 172                         && id[0] == '/' )
 173                 {
 174                         /* check SASL external for X.509 style DN and */
 175                         /* convert to dn:<dn> form */
 176                         dn->bv_val = ldap_dcedn2dn( id );
 177                         dn->bv_len = strlen(dn->bv_val);
 178                         is_dn = SET_DN;
 179
 180                 } else {
 181                         /* convert to u:<username> form */
 182                         ber_str2bv( id, len, 1, dn );
 183                         is_dn = SET_U;
 184                 }
 185         }
 186         if( !is_dn ) {
 187                 if( !strncasecmp( id, "u:", sizeof("u:")-1 )) {
 188                         is_dn = SET_U;
 189                         ber_str2bv( id+2, len-2, 1, dn );
 190                 } else if ( !strncasecmp( id, "dn:", sizeof("dn:")-1) ) {
 191                         is_dn = SET_DN;
 192                         ber_str2bv( id+3, len-3, 1, dn );
 193                 }
 194         }
 195
 196         /* An authzID must be properly prefixed */
 197         if( (flags & FLAG_GETDN_AUTHZID) && !is_dn ) {
 198                 free( dn->bv_val );
 199                 dn->bv_val = NULL;
 200                 dn->bv_len = 0;
 201                 return( LDAP_INAPPROPRIATE_AUTH );
 202         }
 203
 204         /* Username strings */
 205         if( is_dn == SET_U ) {
 206                 char *p;
 207                 len = dn->bv_len + sizeof("uid=")-1 + sizeof(",cn=auth")-1;
 208
 209                 if( user_realm && *user_realm ) {
 210                         len += strlen( user_realm ) + sizeof(",cn=")-1;
 211                 }
 212
 213                 if( conn->c_sasl_bind_mech.bv_len ) {
 214                         len += conn->c_sasl_bind_mech.bv_len + sizeof(",cn=")-1;
 215                 }
 216
 217                 /* Build the new dn */
 218                 c1 = dn->bv_val;
 219                 dn->bv_val = ch_malloc( len );
 220                 p = slap_strcopy( dn->bv_val, "uid=" );
 221                 p = slap_strcopy( p, c1 );
 222                 ch_free( c1 );
 223
 224                 if( user_realm ) {
 225                         p = slap_strcopy( p, ",cn=" );
 226                         p = slap_strcopy( p, user_realm );
 227                 }
 228                 if( conn->c_sasl_bind_mech.bv_len ) {
 229                         p = slap_strcopy( p, ",cn=" );
 230                         p = slap_strcopy( p, conn->c_sasl_bind_mech.bv_val );
 231                 }
 232                 p = slap_strcopy( p, ",cn=auth" );
 233                 dn->bv_len = p - dn->bv_val;
 234                 is_dn = SET_DN;
 235
 236 #ifdef NEW_LOGGING
 237                 LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
 238                         "slap_sasl_getdn: u:id converted to %s.\n", dn->bv_val ));
 239 #else
 240                 Debug( LDAP_DEBUG_TRACE, "getdn: u:id converted to %s\n", dn->bv_val,0,0 );
 241 #endif
 242         }
 243
 244         /* DN strings that are a cn=auth identity to run through regexp */
 245         if( is_dn == SET_DN && ( ( flags & FLAG_GETDN_FINAL ) == 0 ) )
 246         {
 247                 slap_sasl2dn( dn, &dn2 );
 248                 if( dn2.bv_val ) {
 249                         ch_free( dn->bv_val );
 250                         *dn = dn2;
 251 #ifdef NEW_LOGGING
 252                         LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
 253                                 "slap_sasl_getdn: dn:id converted to %s.\n", dn->bv_val ));
 254 #else
 255                         Debug( LDAP_DEBUG_TRACE, "getdn: dn:id converted to %s\n",
 256                                 dn->bv_val, 0, 0 );
 257 #endif
 258                 }
 259         }
 260
 261         if( flags & FLAG_GETDN_FINAL ) {
 262                 /* omit "dn:" prefix */
 263                 is_dn = 0;
 264         } else {
 265                 rc = dnNormalize2( NULL, dn, &dn2 );
 266                 free(dn->bv_val);
 267                 if ( rc != LDAP_SUCCESS ) {
 268                         *dn = slap_empty_bv;
 269                         return rc;
 270                 }
 271                 *dn = dn2;
 272         }
 273
 274         /* Attach the "dn:" prefix if needed */
 275         if ( is_dn == SET_DN ) {
 276                 c1 = ch_malloc( dn->bv_len + sizeof("dn:") );
 277                 strcpy( c1, "dn:" );
 278                 strcpy( c1 + 3, dn->bv_val );
 279                 free( dn->bv_val );
 280                 dn->bv_val = c1;
 281                 dn->bv_len += 3;
 282         }
 283
 284         return( LDAP_SUCCESS );
 285 }
 286
 287 #if SASL_VERSION_MAJOR >= 2
 288 static int
 289 slap_sasl_checkpass(
 290         sasl_conn_t *sconn,
 291         void *context,
 292         const char *username,
 293         const char *pass,
 294         unsigned passlen,
 295         struct propctx *propctx)
 296 {
 297         Connection *conn = (Connection *)context;
 298         struct berval dn, cred;
 299         int rc;
 300         BerVarray vals, bv;
 301
 302         cred.bv_val = (char *)pass;
 303         cred.bv_len = passlen;
 304
 305         /* XXX can we do both steps at once? */
 306         rc = slap_sasl_getdn( conn, (char *)username, NULL, &dn,
 307                 FLAG_GETDN_AUTHCID | FLAG_GETDN_FINAL );
 308         if ( rc != LDAP_SUCCESS ) {
 309                 sasl_seterror( sconn, 0, ldap_err2string( rc ) );
 310                 return SASL_NOUSER;
 311         }
 312
 313         if ( dn.bv_len == 0 ) {
 314                 sasl_seterror( sconn, 0,
 315                         "No password is associated with the Root DSE" );
 316                 if ( dn.bv_val != NULL ) {
 317                         ch_free( dn.bv_val );
 318                 }
 319                 return SASL_NOUSER;
 320         }
 321
 322         rc = backend_attribute( NULL, NULL, NULL, NULL, &dn,
 323                 slap_schema.si_ad_userPassword, &vals);
 324         if ( rc != LDAP_SUCCESS ) {
 325                 ch_free( dn.bv_val );
 326                 sasl_seterror( sconn, 0, ldap_err2string( rc ) );
 327                 return SASL_NOVERIFY;
 328         }
 329
 330         rc = SASL_NOVERIFY;
 331
 332         if ( vals != NULL ) {
 333                 for ( bv = vals; bv->bv_val != NULL; bv++ ) {
 334                         if ( !lutil_passwd( bv, &cred, NULL ) ) {
 335                                 rc = SASL_OK;
 336                                 break;
 337                         }
 338                 }
 339                 ber_bvarray_free( vals );
 340         }
 341
 342         if ( rc != SASL_OK ) {
 343                 sasl_seterror( sconn, 0,
 344                         ldap_err2string( LDAP_INVALID_CREDENTIALS ) );
 345         }
 346
 347         ch_free( dn.bv_val );
 348
 349         return rc;
 350 }
 351
 352 static int
 353 slap_sasl_canonicalize(
 354         sasl_conn_t *sconn,
 355         void *context,
 356         const char *in,
 357         unsigned inlen,
 358         unsigned flags,
 359         const char *user_realm,
 360         char *out,
 361         unsigned out_max,
 362         unsigned *out_len)
 363 {
 364         Connection *conn = (Connection *)context;
 365         struct berval dn;
 366         int rc;
 367
 368         *out_len = 0;
 369
 370 #ifdef NEW_LOGGING
 371         LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
 372                 "slap_sasl_canonicalize: conn %d %s=\"%s\"\n",
 373                         conn ? conn->c_connid : -1,
 374                         (flags == SASL_CU_AUTHID) ? "authcid" : "authzid",
 375                         in ? in : "<empty>" ));
 376 #else
 377         Debug( LDAP_DEBUG_ARGS, "SASL Canonicalize [conn=%ld]: "
 378                 "%s=\"%s\"\n",
 379                         conn ? conn->c_connid : -1,
 380                         (flags == SASL_CU_AUTHID) ? "authcid" : "authzid",
 381                         in ? in : "<empty>" );
 382 #endif
 383
 384         rc = slap_sasl_getdn( conn, (char *)in, (char *)user_realm, &dn,
 385                 (flags == SASL_CU_AUTHID) ? FLAG_GETDN_AUTHCID : FLAG_GETDN_AUTHZID );
 386         if ( rc != LDAP_SUCCESS ) {
 387                 sasl_seterror( sconn, 0, ldap_err2string( rc ) );
 388                 return SASL_NOAUTHZ;
 389         }
 390
 391         if ( out_max < dn.bv_len ) {
 392                 return SASL_BUFOVER;
 393         }
 394
 395         AC_MEMCPY( out, dn.bv_val, dn.bv_len );
 396         out[dn.bv_len] = '\0';
 397
 398         *out_len = dn.bv_len;
 399
 400         ch_free( dn.bv_val );
 401
 402 #ifdef NEW_LOGGING
 403         LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
 404                 "slap_sasl_canonicalize: conn %d %s=\"%s\"\n",
 405                         conn ? conn->c_connid : -1,
 406                         (flags == SASL_CU_AUTHID) ? "authcDN" : "authzDN",
 407                         out ));
 408 #else
 409         Debug( LDAP_DEBUG_ARGS, "SASL Canonicalize [conn=%ld]: "
 410                 "%s=\"%s\"\n",
 411                         conn ? conn->c_connid : -1,
 412                         (flags == SASL_CU_AUTHID) ? "authcDN" : "authzDN",
 413                         out );
 414 #endif
 415
 416         return SASL_OK;
 417 }
 418
 419 static int
 420 slap_sasl_authorize(
 421         sasl_conn_t *sconn,
 422         void *context,
 423         const char *requested_user,
 424         unsigned rlen,
 425         const char *auth_identity,
 426         unsigned alen,
 427         const char *def_realm,
 428         unsigned urlen,
 429         struct propctx *propctx)
 430 {
 431         Connection *conn = (Connection *)context;
 432         struct berval authcDN, authzDN;
 433         int rc;
 434
 435         authcDN.bv_val = (char *)auth_identity;
 436         authcDN.bv_len = alen;
 437
 438         authzDN.bv_val = (char *)requested_user;
 439         authzDN.bv_len = rlen;
 440
 441 #ifdef NEW_LOGGING
 442         LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
 443                 "slap_sasl_authorize: conn %d authcDN=\"%s\" authzDN=\"%s\"\n",
 444                         conn ? conn->c_connid : -1, authcDN.bv_val, authzDN.bv_val));
 445 #else
 446         Debug( LDAP_DEBUG_ARGS, "SASL Authorize [conn=%ld]: "
 447                 "authcDN=\"%s\" authzDN=\"%s\"\n",
 448                 conn ? conn->c_connid : -1, authcDN.bv_val, authzDN.bv_val );
 449 #endif
 450
 451         rc = slap_sasl_authorized( &authcDN, &authzDN );
 452         if ( rc != LDAP_SUCCESS ) {
 453 #ifdef NEW_LOGGING
 454                 LDAP_LOG(( "sasl", LDAP_LEVEL_INFO,
 455                            "slap_sasl_authorize: conn %ld  authorization disallowed (%d)\n",
 456                            (long)(conn ? conn->c_connid : -1), rc ));
 457 #else
 458                 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
 459                         " authorization disallowed (%d)\n",
 460                         (long) (conn ? conn->c_connid : -1), rc, 0 );
 461 #endif
 462
 463                 sasl_seterror( sconn, 0, "not authorized" );
 464                 return SASL_NOAUTHZ;
 465         }
 466
 467 #ifdef NEW_LOGGING
 468         LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
 469                    "slap_sasl_authorize: conn %d authorization allowed\n",
 470                    (long)(conn ? conn->c_connid : -1 ) ));
 471 #else
 472         Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
 473                 " authorization allowed\n",
 474                 (long) (conn ? conn->c_connid : -1), 0, 0 );
 475 #endif
 476
 477         return SASL_OK;
 478 }
 479 #else
 480 static int
 481 slap_sasl_authorize(
 482         void *context,
 483         const char *authcid,
 484         const char *authzid,
 485         const char **user,
 486         const char **errstr)
 487 {
 488         struct berval authcDN, authzDN;
 489         int rc;
 490         Connection *conn = context;
 491         char *realm;
 492
 493         *user = NULL;
 494
 495 #ifdef NEW_LOGGING
 496         LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
 497                    "slap_sasl_authorize: conn %d         authcid=\"%s\" authzid=\"%s\"\n",
 498                    conn ? conn->c_connid : -1,
 499                    authcid ? authcid : "<empty>",
 500                    authzid ? authzid : "<empty>" ));
 501 #else
 502         Debug( LDAP_DEBUG_ARGS, "SASL Authorize [conn=%ld]: "
 503                 "authcid=\"%s\" authzid=\"%s\"\n",
 504                 (long) (conn ? conn->c_connid : -1),
 505                 authcid ? authcid : "<empty>",
 506                 authzid ? authzid : "<empty>" );
 507 #endif
 508
 509         /* Figure out how much data we have for the dn */
 510         rc = sasl_getprop( conn->c_sasl_context, SASL_REALM, (void **)&realm );
 511         if( rc != SASL_OK && rc != SASL_NOTDONE ) {
 512 #ifdef NEW_LOGGING
 513                 LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
 514                         "slap_sasl_authorize: getprop(REALM) failed.\n" ));
 515 #else
 516                 Debug(LDAP_DEBUG_TRACE,
 517                         "authorize: getprop(REALM) failed!\n", 0,0,0);
 518 #endif
 519                 *errstr = "Could not extract realm";
 520                 return SASL_NOAUTHZ;
 521         }
 522
 523         /* Convert the identities to DN's. If no authzid was given, client will
 524            be bound as the DN matching their username */
 525         rc = slap_sasl_getdn( conn, (char *)authcid, realm, &authcDN, FLAG_GETDN_AUTHCID );
 526         if( rc != LDAP_SUCCESS ) {
 527                 *errstr = ldap_err2string( rc );
 528                 return SASL_NOAUTHZ;
 529         }
 530         if( ( authzid == NULL ) || !strcmp( authcid,authzid ) ) {
 531 #ifdef NEW_LOGGING
 532                 LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
 533                            "slap_sasl_authorize: conn %d  Using authcDN=%s\n",
 534                            conn ? conn->c_connid : -1, authcDN.bv_val ));
 535 #else
 536                 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
 537                  "Using authcDN=%s\n", (long) (conn ? conn->c_connid : -1), authcDN.bv_val,0 );
 538 #endif
 539
 540                 *user = authcDN.bv_val;
 541                 *errstr = NULL;
 542                 return SASL_OK;
 543         }
 544         rc = slap_sasl_getdn( conn, (char *)authzid, realm, &authzDN, FLAG_GETDN_AUTHZID );
 545         if( rc != LDAP_SUCCESS ) {
 546                 ch_free( authcDN.bv_val );
 547                 *errstr = ldap_err2string( rc );
 548                 return SASL_NOAUTHZ;
 549         }
 550
 551         rc = slap_sasl_authorized( &authcDN, &authzDN );
 552         if( rc ) {
 553 #ifdef NEW_LOGGING
 554                 LDAP_LOG(( "sasl", LDAP_LEVEL_INFO,
 555                            "slap_sasl_authorize: conn %ld  authorization disallowed (%d)\n",
 556                            (long)(conn ? conn->c_connid : -1), rc ));
 557 #else
 558                 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
 559                         " authorization disallowed (%d)\n",
 560                         (long) (conn ? conn->c_connid : -1), rc, 0 );
 561 #endif
 562
 563                 *errstr = "not authorized";
 564                 ch_free( authcDN.bv_val );
 565                 ch_free( authzDN.bv_val );
 566                 return SASL_NOAUTHZ;
 567         }
 568
 569 #ifdef NEW_LOGGING
 570         LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
 571                    "slap_sasl_authorize: conn %d authorization allowed\n",
 572                    (long)(conn ? conn->c_connid : -1 ) ));
 573 #else
 574         Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
 575                 " authorization allowed\n",
 576                 (long) (conn ? conn->c_connid : -1), 0, 0 );
 577 #endif
 578
 579
 580         ch_free( authcDN.bv_val );
 581         *user = authzDN.bv_val;
 582         *errstr = NULL;
 583         return SASL_OK;
 584 }
 585 #endif /* SASL_VERSION_MAJOR >= 2 */
 586
 587 static int
 588 slap_sasl_err2ldap( int saslerr )
 589 {
 590         int rc;
 591
 592         switch (saslerr) {
 593                 case SASL_CONTINUE:
 594                         rc = LDAP_SASL_BIND_IN_PROGRESS;
 595                         break;
 596                 case SASL_FAIL:
 597                         rc = LDAP_OTHER;
 598                         break;
 599                 case SASL_NOMEM:
 600                         rc = LDAP_OTHER;
 601                         break;
 602                 case SASL_NOMECH:
 603                         rc = LDAP_AUTH_METHOD_NOT_SUPPORTED;
 604                         break;
 605                 case SASL_BADAUTH:
 606                         rc = LDAP_INVALID_CREDENTIALS;
 607                         break;
 608                 case SASL_NOAUTHZ:
 609                         rc = LDAP_INSUFFICIENT_ACCESS;
 610                         break;
 611                 case SASL_TOOWEAK:
 612                 case SASL_ENCRYPT:
 613                         rc = LDAP_INAPPROPRIATE_AUTH;
 614                         break;
 615                 default:
 616                         rc = LDAP_OTHER;
 617                         break;
 618         }
 619
 620         return rc;
 621 }
 622 #endif
 623
 624
 625 int slap_sasl_init( void )
 626 {
 627 #ifdef HAVE_CYRUS_SASL
 628         int rc;
 629         static sasl_callback_t server_callbacks[] = {
 630                 { SASL_CB_LOG, &slap_sasl_log, NULL },
 631                 { SASL_CB_LIST_END, NULL, NULL }
 632         };
 633
 634         sasl_set_alloc(
 635                 ch_malloc,
 636                 ch_calloc,
 637                 ch_realloc,
 638                 ch_free );
 639
 640         sasl_set_mutex(
 641                 ldap_pvt_sasl_mutex_new,
 642                 ldap_pvt_sasl_mutex_lock,
 643                 ldap_pvt_sasl_mutex_unlock,
 644                 ldap_pvt_sasl_mutex_dispose );
 645
 646         /* should provide callbacks for logging */
 647         /* server name should be configurable */
 648         rc = sasl_server_init( server_callbacks, "slapd" );
 649
 650         if( rc != SASL_OK ) {
 651 #ifdef NEW_LOGGING
 652                 LDAP_LOG(( "sasl", LDAP_LEVEL_INFO,
 653                            "slap_sasl_init: init failed.\n" ));
 654 #else
 655                 Debug( LDAP_DEBUG_ANY, "sasl_server_init failed\n",
 656                         0, 0, 0 );
 657 #endif
 658
 659                 return -1;
 660         }
 661
 662 #ifdef NEW_LOGGING
 663         LDAP_LOG(( "sasl", LDAP_LEVEL_INFO,
 664                    "slap_sasl_init: initialized!\n"));
 665 #else
 666         Debug( LDAP_DEBUG_TRACE, "slap_sasl_init: initialized!\n",
 667                 0, 0, 0 );
 668 #endif
 669
 670
 671         /* default security properties */
 672         memset( &sasl_secprops, '\0', sizeof(sasl_secprops) );
 673         sasl_secprops.max_ssf = INT_MAX;
 674         sasl_secprops.maxbufsize = 65536;
 675         sasl_secprops.security_flags = SASL_SEC_NOPLAINTEXT|SASL_SEC_NOANONYMOUS;
 676 #endif
 677
 678         return 0;
 679 }
 680
 681 int slap_sasl_destroy( void )
 682 {
 683 #ifdef HAVE_CYRUS_SASL
 684         sasl_done();
 685 #endif
 686         free( global_host );
 687         global_host = NULL;
 688
 689         return 0;
 690 }
 691
 692 int slap_sasl_open( Connection *conn )
 693 {
 694         int cb, sc = LDAP_SUCCESS;
 695 #if SASL_VERSION_MAJOR >= 2
 696         char *ipremoteport = NULL, *iplocalport = NULL;
 697 #endif
 698
 699 #ifdef HAVE_CYRUS_SASL
 700         sasl_conn_t *ctx = NULL;
 701         sasl_callback_t *session_callbacks;
 702
 703         assert( conn->c_sasl_context == NULL );
 704         assert( conn->c_sasl_extra == NULL );
 705
 706         conn->c_sasl_layers = 0;
 707
 708         session_callbacks =
 709 #if SASL_VERSION_MAJOR >= 2
 710                 ch_calloc( 5, sizeof(sasl_callback_t));
 711 #else
 712                 ch_calloc( 3, sizeof(sasl_callback_t));
 713 #endif
 714         conn->c_sasl_extra = session_callbacks;
 715
 716         session_callbacks[cb=0].id = SASL_CB_LOG;
 717         session_callbacks[cb].proc = &slap_sasl_log;
 718         session_callbacks[cb++].context = conn;
 719
 720         session_callbacks[cb].id = SASL_CB_PROXY_POLICY;
 721         session_callbacks[cb].proc = &slap_sasl_authorize;
 722         session_callbacks[cb++].context = conn;
 723
 724 #if SASL_VERSION_MAJOR >= 2
 725         session_callbacks[cb].id = SASL_CB_CANON_USER;
 726         session_callbacks[cb].proc = &slap_sasl_canonicalize;
 727         session_callbacks[cb++].context = conn;
 728
 729         /* XXXX: this should be conditional */
 730         session_callbacks[cb].id = SASL_CB_SERVER_USERDB_CHECKPASS;
 731         session_callbacks[cb].proc = &slap_sasl_checkpass;
 732         session_callbacks[cb++].context = conn;
 733 #endif
 734
 735         session_callbacks[cb].id = SASL_CB_LIST_END;
 736         session_callbacks[cb].proc = NULL;
 737         session_callbacks[cb++].context = NULL;
 738
 739         if( global_host == NULL ) {
 740                 global_host = ldap_pvt_get_fqdn( NULL );
 741         }
 742
 743         /* create new SASL context */
 744 #if SASL_VERSION_MAJOR >= 2
 745         if ( conn->c_sock_name.bv_len != 0 &&
 746              strncmp( conn->c_sock_name.bv_val, "IP=", 3 ) == 0) {
 747                 char *p;
 748
 749                 iplocalport = ch_strdup( conn->c_sock_name.bv_val + 3 );
 750                 /* Convert IPv6 addresses to address;port syntax. */
 751                 p = strrchr( iplocalport, ' ' );
 752                 if ( p != NULL ) {
 753                         *p = ';';
 754                 }
 755         }
 756         if ( conn->c_peer_name.bv_len != 0 &&
 757              strncmp( conn->c_peer_name.bv_val, "IP=", 3 ) == 0) {
 758                 char *p;
 759
 760                 ipremoteport = ch_strdup( conn->c_peer_name.bv_val + 3 );
 761                 /* Convert IPv6 addresses to address;port syntax. */
 762                 p = strrchr( ipremoteport, ' ' );
 763                 if ( p != NULL ) {
 764                         *p = ';';
 765                 }
 766         }
 767         sc = sasl_server_new( "ldap", global_host, global_realm,
 768                 iplocalport, ipremoteport, session_callbacks, 0, &ctx );
 769         if ( iplocalport != NULL ) {
 770                 ch_free( iplocalport );
 771         }
 772         if ( ipremoteport != NULL ) {
 773                 ch_free( ipremoteport );
 774         }
 775 #else
 776         sc = sasl_server_new( "ldap", global_host, global_realm,
 777                 session_callbacks, SASL_SECURITY_LAYER, &ctx );
 778 #endif
 779
 780         if( sc != SASL_OK ) {
 781 #ifdef NEW_LOGGING
 782                 LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
 783                            "slap_sasl_open: sasl_server_new failed: %d\n", sc ));
 784 #else
 785                 Debug( LDAP_DEBUG_ANY, "sasl_server_new failed: %d\n",
 786                         sc, 0, 0 );
 787 #endif
 788
 789                 return -1;
 790         }
 791
 792         conn->c_sasl_context = ctx;
 793
 794         if( sc == SASL_OK ) {
 795                 sc = sasl_setprop( ctx,
 796                         SASL_SEC_PROPS, &sasl_secprops );
 797
 798                 if( sc != SASL_OK ) {
 799 #ifdef NEW_LOGGING
 800                         LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
 801                                    "slap_sasl_open: sasl_setprop failed: %d \n", sc ));
 802 #else
 803                         Debug( LDAP_DEBUG_ANY, "sasl_setprop failed: %d\n",
 804                                 sc, 0, 0 );
 805 #endif
 806
 807                         slap_sasl_close( conn );
 808                         return -1;
 809                 }
 810         }
 811
 812         sc = slap_sasl_err2ldap( sc );
 813 #endif
 814         return sc;
 815 }
 816
 817 int slap_sasl_external(
 818         Connection *conn,
 819         slap_ssf_t ssf,
 820         const char *auth_id )
 821 {
 822 #if SASL_VERSION_MAJOR >= 2
 823         int sc;
 824         sasl_conn_t *ctx = conn->c_sasl_context;
 825
 826         if ( ctx == NULL ) {
 827                 return LDAP_UNAVAILABLE;
 828         }
 829
 830         sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL, &ssf );
 831
 832         if ( sc != SASL_OK ) {
 833                 return LDAP_OTHER;
 834         }
 835
 836         sc = sasl_setprop( ctx, SASL_AUTH_EXTERNAL, auth_id );
 837
 838         if ( sc != SASL_OK ) {
 839                 return LDAP_OTHER;
 840         }
 841
 842 #elif defined(HAVE_CYRUS_SASL)
 843         int sc;
 844         sasl_conn_t *ctx = conn->c_sasl_context;
 845         sasl_external_properties_t extprops;
 846
 847         if ( ctx == NULL ) {
 848                 return LDAP_UNAVAILABLE;
 849         }
 850
 851         memset( &extprops, '\0', sizeof(extprops) );
 852         extprops.ssf = ssf;
 853         extprops.auth_id = (char *) auth_id;
 854
 855         sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL,
 856                 (void *) &extprops );
 857
 858         if ( sc != SASL_OK ) {
 859                 return LDAP_OTHER;
 860         }
 861 #endif
 862
 863         return LDAP_SUCCESS;
 864 }
 865
 866 int slap_sasl_reset( Connection *conn )
 867 {
 868 #ifdef HAVE_CYRUS_SASL
 869         sasl_conn_t *ctx = conn->c_sasl_context;
 870
 871         if( ctx != NULL ) {
 872         }
 873 #endif
 874         /* must return "anonymous" */
 875         return LDAP_SUCCESS;
 876 }
 877
 878 char ** slap_sasl_mechs( Connection *conn )
 879 {
 880         char **mechs = NULL;
 881
 882 #ifdef HAVE_CYRUS_SASL
 883         sasl_conn_t *ctx = conn->c_sasl_context;
 884
 885         if( ctx != NULL ) {
 886                 int sc;
 887                 SASL_CONST char *mechstr;
 888
 889                 sc = sasl_listmech( ctx,
 890                         NULL, NULL, ",", NULL,
 891                         &mechstr, NULL, NULL );
 892
 893                 if( sc != SASL_OK ) {
 894 #ifdef NEW_LOGGING
 895                         LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
 896                                 "slap_sasl_mechs: sasl_listmech failed: %d\n", sc ));
 897 #else
 898                         Debug( LDAP_DEBUG_ANY, "slap_sasl_listmech failed: %d\n",
 899                                 sc, 0, 0 );
 900 #endif
 901
 902                         return NULL;
 903                 }
 904
 905                 mechs = str2charray( mechstr, "," );
 906
 907 #if SASL_VERSION_MAJOR < 2
 908                 ch_free( mechstr );
 909 #endif
 910         }
 911 #endif
 912
 913         return mechs;
 914 }
 915
 916 int slap_sasl_close( Connection *conn )
 917 {
 918 #ifdef HAVE_CYRUS_SASL
 919         sasl_conn_t *ctx = conn->c_sasl_context;
 920
 921         if( ctx != NULL ) {
 922                 sasl_dispose( &ctx );
 923         }
 924
 925         conn->c_sasl_context = NULL;
 926
 927         free( conn->c_sasl_extra );
 928         conn->c_sasl_extra = NULL;
 929 #endif
 930
 931         return LDAP_SUCCESS;
 932 }
 933
 934 int slap_sasl_bind(
 935     Connection          *conn,
 936     Operation           *op,
 937     struct berval       *dn,
 938     struct berval       *ndn,
 939     struct berval       *cred,
 940         struct berval                   *edn,
 941         slap_ssf_t              *ssfp )
 942 {
 943         int rc = 1;
 944
 945 #ifdef HAVE_CYRUS_SASL
 946         sasl_conn_t *ctx = conn->c_sasl_context;
 947         struct berval response;
 948         unsigned reslen = 0;
 949         const char *errstr = NULL;
 950         int sc;
 951
 952 #ifdef NEW_LOGGING
 953         LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
 954                 "sasl_bind: conn %ld dn=\"%s\" mech=%s datalen=%ld\n",
 955                 conn->c_connid,
 956                 dn->bv_len ? dn->bv_val : "",
 957                 conn->c_sasl_bind_in_progress ? "<continuing>" : conn->c_sasl_bind_mech.bv_val,
 958                 cred ? cred->bv_len : 0 ));
 959 #else
 960         Debug(LDAP_DEBUG_ARGS,
 961                 "==> sasl_bind: dn=\"%s\" mech=%s datalen=%ld\n",
 962                 dn->bv_len ? dn->bv_val : "",
 963                 conn->c_sasl_bind_in_progress ? "<continuing>":conn->c_sasl_bind_mech.bv_val,
 964                 cred ? cred->bv_len : 0 );
 965 #endif
 966
 967
 968         if( ctx == NULL ) {
 969                 send_ldap_result( conn, op, LDAP_UNAVAILABLE,
 970                         NULL, "SASL unavailable on this session", NULL, NULL );
 971                 return rc;
 972         }
 973
 974 #if SASL_VERSION_MAJOR >= 2
 975 #define START( ctx, mech, cred, clen, resp, rlen, err ) \
 976         sasl_server_start( ctx, mech, cred, clen, resp, rlen )
 977 #define STEP( ctx, cred, clen, resp, rlen, err ) \
 978         sasl_server_step( ctx, cred, clen, resp, rlen )
 979 #else
 980 #define START( ctx, mech, cred, clen, resp, rlen, err ) \
 981         sasl_server_start( ctx, mech, cred, clen, resp, rlen, err )
 982 #define STEP( ctx, cred, clen, resp, rlen, err ) \
 983         sasl_server_step( ctx, cred, clen, resp, rlen, err )
 984 #endif
 985
 986         if ( !conn->c_sasl_bind_in_progress ) {
 987                 sc = START( ctx,
 988                         conn->c_sasl_bind_mech.bv_val,
 989                         cred->bv_len ? cred->bv_val : "",
 990                         cred->bv_len,
 991                         (SASL_CONST char **)&response.bv_val, &reslen, &errstr );
 992
 993         } else {
 994                 sc = STEP( ctx,
 995                         cred->bv_val, cred->bv_len,
 996                         (SASL_CONST char **)&response.bv_val, &reslen, &errstr );
 997         }
 998
 999         response.bv_len = reslen;
1000
1001         if ( sc == SASL_OK ) {
1002                 char *username = NULL;
1003                 char *realm = NULL;
1004
1005 #if SASL_VERSION_MAJOR >= 2
1006                 sc = sasl_getprop( ctx, SASL_DEFUSERREALM, (const void **)&realm );
1007 #else
1008                 sc = sasl_getprop( ctx, SASL_REALM, (void **)&realm );
1009 #endif
1010                 sc = sasl_getprop( ctx,
1011                         SASL_USERNAME, (SASL_CONST void **)&username );
1012
1013                 if ( sc != SASL_OK ) {
1014 #ifdef NEW_LOGGING
1015                         LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
1016                                 "slap_sasl_bind: getprop(USERNAME) failed: %d\n", sc ));
1017 #else
1018                         Debug(LDAP_DEBUG_TRACE,
1019                                 "slap_sasl_bind: getprop(USERNAME) failed!\n",
1020                                 0, 0, 0);
1021 #endif
1022
1023
1024                         send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
1025                                 NULL, "no SASL username", NULL, NULL );
1026
1027                 } else {
1028                         rc = slap_sasl_getdn( conn, username, realm, edn, FLAG_GETDN_FINAL );
1029
1030                         if( rc == LDAP_SUCCESS ) {
1031                                 sasl_ssf_t *ssf = NULL;
1032                                 (void) sasl_getprop( ctx, SASL_SSF, (void *)&ssf );
1033                                 *ssfp = ssf ? *ssf : 0;
1034
1035                                 if( *ssfp ) {
1036                                         ldap_pvt_thread_mutex_lock( &conn->c_mutex );
1037                                         conn->c_sasl_layers++;
1038                                         ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
1039                                 }
1040
1041                                 send_ldap_sasl( conn, op, rc,
1042                                         NULL, NULL, NULL, NULL,
1043                                         response.bv_len ? &response : NULL );
1044
1045                         } else {
1046                                 send_ldap_result( conn, op, rc,
1047                                         NULL, errstr, NULL, NULL );
1048                         }
1049                 }
1050
1051         } else if ( sc == SASL_CONTINUE ) {
1052                 send_ldap_sasl( conn, op, rc = LDAP_SASL_BIND_IN_PROGRESS,
1053                         NULL, NULL, NULL, NULL, &response );
1054
1055         } else {
1056                 send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
1057                         NULL, errstr, NULL, NULL );
1058         }
1059
1060 #if SASL_VERSION_MAJOR < 2
1061         if( response.bv_len ) {
1062                 ch_free( response.bv_val );
1063         }
1064 #endif
1065
1066 #ifdef NEW_LOGGING
1067         LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
1068                 "slap_sasl_bind: rc=%d\n", rc ));
1069 #else
1070         Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: rc=%d\n", rc, 0, 0);
1071 #endif
1072
1073
1074 #else
1075         send_ldap_result( conn, op, rc = LDAP_UNAVAILABLE,
1076                 NULL, "SASL not supported", NULL, NULL );
1077 #endif
1078
1079         return rc;
1080 }
1081
1082 char* slap_sasl_secprops( const char *in )
1083 {
1084 #ifdef HAVE_CYRUS_SASL
1085         int rc = ldap_pvt_sasl_secprops( in, &sasl_secprops );
1086
1087         return rc == LDAP_SUCCESS ? NULL : "Invalid security properties";
1088 #else
1089         return "SASL not supported";
1090 #endif
1091 }