Patch: Escape character troubles (ITS#1753)

[openldap] / servers / slapd / saslauthz.c

diff --git a/servers/slapd/saslauthz.c b/servers/slapd/saslauthz.c
index 57b204ee73f9b886940d2dad593ed25871119ffe..5c1d6505a6d50b534a7236575241650a257ab839 100644 (file)
--- a/servers/slapd/saslauthz.c
+++ b/servers/slapd/saslauthz.c
@@ -12,109 +12,93 @@
 
 #include "portable.h"
 
 
 #include "portable.h"
 

-#include <ac/stdlib.h>

 #include <stdio.h>
 
 #include <stdio.h>
 

+#include <ac/stdlib.h>

 #include <ac/string.h>
 
 #include "slap.h"
 
 #ifdef HAVE_CYRUS_SASL
 #include <limits.h>
 #include <ac/string.h>
 
 #include "slap.h"
 
 #ifdef HAVE_CYRUS_SASL
 #include <limits.h>

+
+#ifdef HAVE_SASL_SASL_H
+#include <sasl/sasl.h>
+#else

 #include <sasl.h>
 #include <sasl.h>

+#endif
+

 #include <ldap_pvt.h>
 #endif
 
 #include <ldap_pvt.h>
 #endif
 

-/* URI format: ldap://<host>/<base>[?[<attrs>][?[<scope>][?[<filter>]]]]   */
+/* URI format: ldap://<host>/<base>[?[<attrs>][?[<scope>][?[<filter>]]]] */

 
 

-int slap_parseURI( char *uri, char **searchbase, int *scope, Filter **filter )
+static int slap_parseURI( struct berval *uri,
+       struct berval *searchbase, int *scope, Filter **filter )

 {
 {

-       char *start, *end;
+       struct berval bv;
+       int rc;
+       LDAPURLDesc *ludp;

 
 

-
-       assert( uri != NULL );
-       *searchbase = NULL;
+       assert( uri != NULL && uri->bv_val != NULL );
+       searchbase->bv_val = NULL;
+       searchbase->bv_len = 0;

        *scope = -1;
        *filter = NULL;
 
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
        *scope = -1;
        *filter = NULL;
 
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,

-                  "slap_parseURI: parsing %s\n", uri ));
+               "slap_parseURI: parsing %s\n", uri->bv_val ));

 #else
 #else

-       Debug( LDAP_DEBUG_TRACE, "slap_parseURI: parsing %s\n", uri, 0, 0 );
+       Debug( LDAP_DEBUG_TRACE, "slap_parseURI: parsing %s\n", uri->bv_val, 0, 0 );

 #endif
 
 #endif
 

-

        /* If it does not look like a URI, assume it is a DN */
        /* If it does not look like a URI, assume it is a DN */

-       if( !strncasecmp( uri, "dn:", 3 ) ) {
-               uri += 3;
-               uri += strspn( uri, " " );
-               *searchbase = ch_strdup( uri );
-               dn_normalize( *searchbase );
-               *scope = LDAP_SCOPE_BASE;
-               return( LDAP_SUCCESS );
+       if( !strncasecmp( uri->bv_val, "dn:", sizeof("dn:")-1 ) ) {
+               bv.bv_val = uri->bv_val + sizeof("dn:")-1;
+               bv.bv_val += strspn( bv.bv_val, " " );
+
+is_dn:         bv.bv_len = uri->bv_len - (bv.bv_val - uri->bv_val);
+               rc = dnNormalize2( NULL, &bv, searchbase );
+               if (rc == LDAP_SUCCESS) {
+                       *scope = LDAP_SCOPE_BASE;
+               }
+               return( rc );

        }
        }

-       if( strncasecmp( uri, "ldap://", 7 ) ) {
-               *searchbase = ch_strdup( uri );
-               dn_normalize( *searchbase );
-               *scope = LDAP_SCOPE_BASE;
-               return( LDAP_SUCCESS );
+
+       rc = ldap_url_parse( uri->bv_val, &ludp );
+       if ( rc == LDAP_URL_ERR_BADSCHEME ) {
+               bv.bv_val = uri->bv_val;
+               goto is_dn;

        }
 
        }
 

-       end = strchr( uri + 7, '/' );
-       if ( end == NULL )
+       if ( rc != LDAP_URL_SUCCESS ) {

                return( LDAP_PROTOCOL_ERROR );
                return( LDAP_PROTOCOL_ERROR );

+       }

 
        /* could check the hostname here */
 
 
        /* could check the hostname here */
 

-       /* Grab the searchbase */
-       start = end+1;
-       end = strchr( start, '?' );
-       if( end == NULL ) {
-               *searchbase = ch_strdup( start );
-               dn_normalize( *searchbase );
-               return( LDAP_SUCCESS );
-       }
-       *end = '\0';
-       *searchbase = ch_strdup( start );
-       *end = '?';
-       dn_normalize( *searchbase );
-
-       /* Skip the attrs */
-       start = end+1;
-       end = strchr( start, '?' );
-       if( end == NULL ) {
-               return( LDAP_SUCCESS );
-       }
-

        /* Grab the scope */
        /* Grab the scope */

-       start = end+1;
-       if( !strncasecmp( start, "base?", 5 )) {
-               *scope = LDAP_SCOPE_BASE;
-               start += 5;
-       }
-       else if( !strncasecmp( start, "one?", 4 )) {
-               *scope = LDAP_SCOPE_ONELEVEL;
-               start += 4;
-       }
-       else if( !strncasecmp( start, "sub?", 3 )) {
-               *scope = LDAP_SCOPE_SUBTREE;
-               start += 4;
-       }
-       else {
-               ch_free( *searchbase );
-               *searchbase = NULL;
-               return( LDAP_PROTOCOL_ERROR );
-       }
+       *scope = ludp->lud_scope;

 
        /* Grab the filter */
 
        /* Grab the filter */

-       *filter = str2filter( start );
-
-       return( LDAP_SUCCESS );
-}
+       if ( ludp->lud_filter ) {
+               *filter = str2filter( ludp->lud_filter );
+               if ( *filter == NULL )
+                       rc = LDAP_PROTOCOL_ERROR;
+       }

 
 

+       /* Grab the searchbase */
+       if ( rc == LDAP_URL_SUCCESS ) {
+               bv.bv_val = ludp->lud_dn;
+               bv.bv_len = strlen( bv.bv_val );
+               rc = dnNormalize2( NULL, &bv, searchbase );
+       }

 
 

+       ldap_free_urldesc( ludp );

 
 

+       return( rc );
+}

 
 
 int slap_sasl_regexp_config( const char *match, const char *replace )
 
 
 int slap_sasl_regexp_config( const char *match, const char *replace )


@@ -123,36 +107,64 @@ int slap_sasl_regexp_config( const char *match, const char *replace )
        const char *c;
        int rc, n;
        SaslRegexp_t *reg;
        const char *c;
        int rc, n;
        SaslRegexp_t *reg;

+       struct berval bv, nbv;

 
        SaslRegexp = (SaslRegexp_t *) ch_realloc( (char *) SaslRegexp,
          (nSaslRegexp + 1) * sizeof(SaslRegexp_t) );
        reg = &( SaslRegexp[nSaslRegexp] );
 
        SaslRegexp = (SaslRegexp_t *) ch_realloc( (char *) SaslRegexp,
          (nSaslRegexp + 1) * sizeof(SaslRegexp_t) );
        reg = &( SaslRegexp[nSaslRegexp] );

-       reg->match = ch_strdup( match );
-       reg->replace = ch_strdup( replace );
-       dn_normalize( reg->match );
-       dn_normalize( reg->replace );
+       ber_str2bv( match, 0, 0, &bv );
+       rc = dnNormalize2( NULL, &bv, &nbv );
+       if ( rc ) {
+#ifdef NEW_LOGGING
+               LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
+                          "slap_sasl_regexp_config: \"%s\" could not be normalized.\n",
+                          match ));
+#else
+               Debug( LDAP_DEBUG_ANY,
+               "SASL match pattern %s could not be normalized.\n",
+               match, 0, 0 );
+#endif
+               return( rc );
+       }
+       reg->sr_match = nbv.bv_val;
+
+       ber_str2bv( replace, 0, 0, &bv );
+       rc = dnNormalize2( NULL, &bv, &nbv );
+       if ( rc ) {
+#ifdef NEW_LOGGING
+               LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
+                          "slap_sasl_regexp_config: \"%s\" could not be normalized.\n",
+                          replace ));
+#else
+               Debug( LDAP_DEBUG_ANY,
+               "SASL replace pattern %s could not be normalized.\n",
+               replace, 0, 0 );
+#endif
+               return( rc );
+       }
+       reg->sr_replace = nbv.bv_val;

 
        /* Precompile matching pattern */
 
        /* Precompile matching pattern */

-       rc = regcomp( &reg->workspace, reg->match, REG_EXTENDED|REG_ICASE );
+       rc = regcomp( &reg->sr_workspace, reg->sr_match, REG_EXTENDED|REG_ICASE );

        if ( rc ) {
 #ifdef NEW_LOGGING
                LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
                           "slap_sasl_regexp_config: \"%s\" could not be compiled.\n",
        if ( rc ) {
 #ifdef NEW_LOGGING
                LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
                           "slap_sasl_regexp_config: \"%s\" could not be compiled.\n",

-                          reg->match ));
+                          reg->sr_match ));

 #else
                Debug( LDAP_DEBUG_ANY,
                "SASL match pattern %s could not be compiled by regexp engine\n",
 #else
                Debug( LDAP_DEBUG_ANY,
                "SASL match pattern %s could not be compiled by regexp engine\n",

-               reg->match, 0, 0 );
+               reg->sr_match, 0, 0 );

 #endif
 
                return( LDAP_OPERATIONS_ERROR );
        }
 
        /* Precompile replace pattern. Find the $<n> placeholders */
 #endif
 
                return( LDAP_OPERATIONS_ERROR );
        }
 
        /* Precompile replace pattern. Find the $<n> placeholders */

-       reg->offset[0] = -2;
+       reg->sr_offset[0] = -2;

        n = 1;
        n = 1;

-       for ( c = reg->replace;  *c;  c++ ) {
-               if ( *c == '\\' ) {
+       for ( c = reg->sr_replace;       *c;  c++ ) {
+               if ( *c == '\\' && c[1] ) {

                        c++;
                        continue;
                }
                        c++;
                        continue;
                }


@@ -160,25 +172,27 @@ int slap_sasl_regexp_config( const char *match, const char *replace )
                        if ( n == SASLREGEX_REPLACE ) {
 #ifdef NEW_LOGGING
                                LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
                        if ( n == SASLREGEX_REPLACE ) {
 #ifdef NEW_LOGGING
                                LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,

-                                          "slap_sasl_regexp_config: \"%s\" has too many $n placeholders (max %d)\n",
-                                          reg->replace, SASLREGEX_REPLACE ));
+                                       "slap_sasl_regexp_config: \"%s\" has too many $n "
+                                               "placeholders (max %d)\n",
+                                       reg->sr_replace, SASLREGEX_REPLACE ));

 #else
                                Debug( LDAP_DEBUG_ANY,
 #else
                                Debug( LDAP_DEBUG_ANY,

-                                  "SASL replace pattern %s has too many $n placeholders (max %d)\n",
-                                  reg->replace, SASLREGEX_REPLACE, 0 );
+                                       "SASL replace pattern %s has too many $n "
+                                               "placeholders (max %d)\n",
+                                       reg->sr_replace, SASLREGEX_REPLACE, 0 );

 #endif
 
                                return( LDAP_OPERATIONS_ERROR );
                        }
 #endif
 
                                return( LDAP_OPERATIONS_ERROR );
                        }

-                       reg->offset[n] = c - reg->replace;
+                       reg->sr_offset[n] = c - reg->sr_replace;

                        n++;
                }
        }
 
        /* Final placeholder, after the last $n */
                        n++;
                }
        }
 
        /* Final placeholder, after the last $n */

-       reg->offset[n] = c - reg->replace;
+       reg->sr_offset[n] = c - reg->sr_replace;

        n++;
        n++;

-       reg->offset[n] = -1;
+       reg->sr_offset[n] = -1;

 
        nSaslRegexp++;
 #endif
 
        nSaslRegexp++;
 #endif


@@ -186,44 +200,40 @@ int slap_sasl_regexp_config( const char *match, const char *replace )
 }
 
 
 }
 
 

-
-
-

 #ifdef HAVE_CYRUS_SASL
 
 #ifdef HAVE_CYRUS_SASL
 

-
-

 /* Take the passed in SASL name and attempt to convert it into an
    LDAP URI to find the matching LDAP entry, using the pattern matching
    strings given in the saslregexp config file directive(s) */
 /* Take the passed in SASL name and attempt to convert it into an
    LDAP URI to find the matching LDAP entry, using the pattern matching
    strings given in the saslregexp config file directive(s) */

-static
-char *slap_sasl_regexp( char *saslname )
+static int slap_sasl_regexp( struct berval *in, struct berval *out )

 {
 {

-       char *uri=NULL;
+       char *saslname = in->bv_val;

        int i, n, len, insert;
        SaslRegexp_t *reg;
 
        int i, n, len, insert;
        SaslRegexp_t *reg;
 

+       out->bv_val = NULL;
+       out->bv_len = 0;

 
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
 
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,

-                  "slap_sasl_regexp: converting SASL name %s\n", saslname ));
+               "slap_sasl_regexp: converting SASL name %s\n", saslname ));

 #else
        Debug( LDAP_DEBUG_TRACE, "slap_sasl_regexp: converting SASL name %s\n",
           saslname, 0, 0 );
 #endif
 
        if (( saslname == NULL ) || ( nSaslRegexp == 0 ))
 #else
        Debug( LDAP_DEBUG_TRACE, "slap_sasl_regexp: converting SASL name %s\n",
           saslname, 0, 0 );
 #endif
 
        if (( saslname == NULL ) || ( nSaslRegexp == 0 ))

-               return( NULL );
+               return( 0 );

 
        /* Match the normalized SASL name to the saslregexp patterns */
        for( reg = SaslRegexp,i=0;  i<nSaslRegexp;  i++,reg++ ) {
 
        /* Match the normalized SASL name to the saslregexp patterns */
        for( reg = SaslRegexp,i=0;  i<nSaslRegexp;  i++,reg++ ) {

-               if ( regexec( &reg->workspace, saslname, SASLREGEX_REPLACE,
-                 reg->strings, 0)  == 0 )
+               if ( regexec( &reg->sr_workspace, saslname, SASLREGEX_REPLACE,
+                 reg->sr_strings, 0)  == 0 )

                        break;
        }
 
        if( i >= nSaslRegexp )
                        break;
        }
 
        if( i >= nSaslRegexp )

-               return( NULL );
+               return( 0 );

 
        /*
         * The match pattern may have been of the form "a(b.*)c(d.*)e" and the
 
        /*
         * The match pattern may have been of the form "a(b.*)c(d.*)e" and the


@@ -236,54 +246,89 @@ char *slap_sasl_regexp( char *saslname )
 
        n=1;
        len = 0;
 
        n=1;
        len = 0;

-       while( reg->offset[n] >= 0 ) {
+       while( reg->sr_offset[n] >= 0 ) {

                /* Len of next section from replacement string (x,y,z above) */
                /* Len of next section from replacement string (x,y,z above) */

-               len += reg->offset[n] - reg->offset[n-1] - 2;
-               if( reg->offset[n+1] < 0)
+               len += reg->sr_offset[n] - reg->sr_offset[n-1] - 2;
+               if( reg->sr_offset[n+1] < 0)

                        break;
 
                /* Len of string from saslname that matched next $i  (b,d above) */
                        break;
 
                /* Len of string from saslname that matched next $i  (b,d above) */

-               i = reg->replace[ reg->offset[n] + 1 ]  - '0';
-               len += reg->strings[i].rm_eo - reg->strings[i].rm_so;
+               i = reg->sr_replace[ reg->sr_offset[n] + 1 ]    - '0';
+               len += reg->sr_strings[i].rm_eo - reg->sr_strings[i].rm_so;

                n++;
        }
                n++;
        }

-       uri = ch_malloc( len + 1 );
+       out->bv_val = ch_malloc( len + 1 );
+       out->bv_len = len;

 
        /* Fill in URI with replace string, replacing $i as we go */
        n=1;
        insert = 0;
 
        /* Fill in URI with replace string, replacing $i as we go */
        n=1;
        insert = 0;

-       while( reg->offset[n] >= 0) {
+       while( reg->sr_offset[n] >= 0) {

                /* Paste in next section from replacement string (x,y,z above) */
                /* Paste in next section from replacement string (x,y,z above) */

-               len = reg->offset[n] - reg->offset[n-1] - 2;
-               strncpy( uri+insert, reg->replace + reg->offset[n-1] + 2, len);
+               len = reg->sr_offset[n] - reg->sr_offset[n-1] - 2;
+               strncpy( out->bv_val+insert, reg->sr_replace + reg->sr_offset[n-1] + 2, len);

                insert += len;
                insert += len;

-               if( reg->offset[n+1] < 0)
+               if( reg->sr_offset[n+1] < 0)

                        break;
 
                /* Paste in string from saslname that matched next $i  (b,d above) */
                        break;
 
                /* Paste in string from saslname that matched next $i  (b,d above) */

-               i = reg->replace[ reg->offset[n] + 1 ]  - '0';
-               len = reg->strings[i].rm_eo - reg->strings[i].rm_so;
-               strncpy( uri+insert, saslname + reg->strings[i].rm_so, len );
+               i = reg->sr_replace[ reg->sr_offset[n] + 1 ]    - '0';
+               len = reg->sr_strings[i].rm_eo - reg->sr_strings[i].rm_so;
+               strncpy( out->bv_val+insert, saslname + reg->sr_strings[i].rm_so, len );

                insert += len;
 
                n++;
        }
 
                insert += len;
 
                n++;
        }
 

-       uri[insert] = '\0';
+       out->bv_val[insert] = '\0';

 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,

-                  "slap_sasl_regexp: converted SASL name to %s\n", uri ));
+               "slap_sasl_regexp: converted SASL name to %s\n", out->bv_val ));

 #else
        Debug( LDAP_DEBUG_TRACE,
 #else
        Debug( LDAP_DEBUG_TRACE,

-          "slap_sasl_regexp: converted SASL name to %s\n", uri, 0, 0 );
+          "slap_sasl_regexp: converted SASL name to %s\n", out->bv_val, 0, 0 );

 #endif
 
 #endif
 

-       return( uri );
+       return( 1 );

 }
 
 }
 

+/* Two empty callback functions to avoid sending results */
+static void sasl_sc_r( Connection *conn, Operation *o, ber_tag_t tag,
+       ber_int_t msgid, ber_int_t err, const char *matched,
+       const char *text, BerVarray ref, const char *resoid,
+       struct berval *resdata, struct berval *sasldata, LDAPControl **c)
+{
+}

 
 

+static void sasl_sc_s( Connection *conn, Operation *o, ber_int_t err,
+       const char *matched, const char *text, BerVarray refs, LDAPControl **c,
+       int nentries)
+{
+}

 
 

+/* This callback actually does some work...*/
+static int sasl_sc_sasl2dn( BackendDB *be, Connection *conn, Operation *o,
+       Entry *e, AttributeName *an, int ao, LDAPControl **c)
+{
+       struct berval *ndn = o->o_callback->sc_private;

 
 

+       /* We only want to be called once */
+       if (ndn->bv_val) {
+               free(ndn->bv_val);
+               ndn->bv_val = NULL;
+#ifdef NEW_LOGGING
+       LDAP_LOG(( "sasl", LDAP_LEVEL_DETAIL1,
+                  "slap_sasl2dn: search DN returned more than 1 entry\n" ));
+#else
+       Debug( LDAP_DEBUG_TRACE,
+          "slap_sasl2dn: search DN returned more than 1 entry\n", 0,0,0 );
+#endif
+               return -1;
+       } else {
+               ber_dupbv(ndn, &e->e_nname);
+               return 0;
+       }
+}

 
 /*
  * Given a SASL name (e.g. "UID=name,cn=REALM,cn=MECH,cn=AUTH")
 
 /*
  * Given a SASL name (e.g. "UID=name,cn=REALM,cn=MECH,cn=AUTH")


@@ -294,40 +339,41 @@ char *slap_sasl_regexp( char *saslname )
  * entry, return the DN of that one entry.
  */
 
  * entry, return the DN of that one entry.
  */
 

-char *slap_sasl2dn( char *saslname )
+void slap_sasl2dn( struct berval *saslname, struct berval *dn )

 {
 {

-       char *uri=NULL, *DN=NULL;
+       struct berval uri = {0, NULL};

        struct berval searchbase = {0, NULL};
        int rc, scope;
        Backend *be;
        Filter *filter=NULL;
        struct berval searchbase = {0, NULL};
        int rc, scope;
        Backend *be;
        Filter *filter=NULL;

-       Connection *conn=NULL;
-       LDAP *client=NULL;
-       LDAPMessage *res=NULL, *msg;
-
+       slap_callback cb = {sasl_sc_r, sasl_sc_s, sasl_sc_sasl2dn, NULL};
+       Operation op = {0};

 
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
 
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,

-                  "slap_sasl2dn: converting SASL name %s to DN.\n", saslname ));
+               "slap_sasl2dn: converting SASL name %s to DN.\n", saslname->bv_val ));

 #else
        Debug( LDAP_DEBUG_TRACE,
 #else
        Debug( LDAP_DEBUG_TRACE,

-         "==>slap_sasl2dn: Converting SASL name %s to a DN\n", saslname, 0,0 );
+               "==>slap_sasl2dn: Converting SASL name %s to a DN\n", saslname->bv_val, 0,0 );

 #endif
 #endif

-
+       dn->bv_val = NULL;
+       dn->bv_len = 0;
+       cb.sc_private = dn;

 
        /* Convert the SASL name into an LDAP URI */
 
        /* Convert the SASL name into an LDAP URI */

-       uri = slap_sasl_regexp( saslname );
-       if( uri == NULL )
+       if( !slap_sasl_regexp( saslname, &uri ) )

                goto FINISHED;
 
                goto FINISHED;
 

-       rc = slap_parseURI( uri, &searchbase.bv_val, &scope, &filter );
-       if( rc )
+       rc = slap_parseURI( &uri, &searchbase, &scope, &filter );
+       if( rc ) {

                goto FINISHED;
                goto FINISHED;

+       }

 
 

-       searchbase.bv_len = strlen( searchbase.bv_val );

        /* Massive shortcut: search scope == base */
        if( scope == LDAP_SCOPE_BASE ) {
        /* Massive shortcut: search scope == base */
        if( scope == LDAP_SCOPE_BASE ) {

-               DN = ch_strdup( searchbase.bv_val );
+               *dn = searchbase;
+               searchbase.bv_len = 0;
+               searchbase.bv_val = NULL;

                goto FINISHED;
        }
 
                goto FINISHED;
        }
 


@@ -343,64 +389,55 @@ char *slap_sasl2dn( char *saslname )
           searchbase.bv_val, scope, 0 );
 #endif
 
           searchbase.bv_val, scope, 0 );
 #endif
 

-

        be = select_backend( &searchbase, 0, 1 );
        if(( be == NULL ) || ( be->be_search == NULL))
                goto FINISHED;
        suffix_alias( be, &searchbase );
 
        be = select_backend( &searchbase, 0, 1 );
        if(( be == NULL ) || ( be->be_search == NULL))
                goto FINISHED;
        suffix_alias( be, &searchbase );
 

-       rc = connection_internal_open( &conn, &client, saslname );
-       if( rc != LDAP_SUCCESS )
-               goto FINISHED;
+       op.o_tag = LDAP_REQ_SEARCH;
+       op.o_protocol = LDAP_VERSION3;
+       op.o_ndn = *saslname;
+       op.o_callback = &cb;
+       op.o_time = slap_get_time();

 
 

-       (*be->be_search)( be, conn, conn->c_ops, /*base=*/NULL, searchbase.bv_val,
+       (*be->be_search)( be, /*conn*/NULL, &op, /*base*/NULL, &searchbase,

           scope, /*deref=*/1, /*sizelimit=*/1, /*time=*/0, filter, /*fstr=*/NULL,
           /*attrs=*/NULL, /*attrsonly=*/0 );
           scope, /*deref=*/1, /*sizelimit=*/1, /*time=*/0, filter, /*fstr=*/NULL,
           /*attrs=*/NULL, /*attrsonly=*/0 );

-
-
-       /* Read the client side of the internal search */
-       rc = ldap_result( client, LDAP_RES_ANY, LDAP_MSG_ALL, NULL, &res );
-       if( rc == -1 )
-               goto FINISHED;
-
-       /* Make sure exactly one entry was returned */
-       rc = ldap_count_entries( client, res );
-#ifdef NEW_LOGGING
-       LDAP_LOG(( "sasl", LDAP_LEVEL_DETAIL1,
-                  "slap_sasl2dn: search DN returned %d entries\n", rc ));
-#else
-       Debug( LDAP_DEBUG_TRACE,
-          "slap_sasl2dn: search DN returned %d entries\n", rc,0,0 );
-#endif
-
-       if( rc != 1 )
-               goto FINISHED;
-
-       msg = ldap_first_entry( client, res );
-       DN = ldap_get_dn( client, msg );
-
+       

 FINISHED:
        if( searchbase.bv_len ) ch_free( searchbase.bv_val );
        if( filter ) filter_free( filter );
 FINISHED:
        if( searchbase.bv_len ) ch_free( searchbase.bv_val );
        if( filter ) filter_free( filter );

-       if( uri ) ch_free( uri );
-       if( conn ) connection_internal_close( conn );
-       if( res ) ldap_msgfree( res );
-       if( client  ) ldap_unbind( client );
-       if( DN ) dn_normalize( DN );
+       if( uri.bv_val ) ch_free( uri.bv_val );
+

 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,

-                  "slap_sasl2dn: Converted SASL name to %s\n", DN ? DN : "<nothing>" ));
+               "slap_sasl2dn: Converted SASL name to %s\n",
+               dn->bv_len ? dn->bv_val : "<nothing>" ));

 #else
        Debug( LDAP_DEBUG_TRACE, "<==slap_sasl2dn: Converted SASL name to %s\n",
 #else
        Debug( LDAP_DEBUG_TRACE, "<==slap_sasl2dn: Converted SASL name to %s\n",

-          DN ? DN : "<nothing>", 0, 0 );
+               dn->bv_len ? dn->bv_val : "<nothing>", 0, 0 );

 #endif
 
 #endif
 

-       return( DN );
+       return;

 }
 
 }
 

+typedef struct smatch_info {
+       struct berval *dn;
+       int match;
+} smatch_info;

 
 

+static int sasl_sc_smatch( BackendDB *be, Connection *conn, Operation *o,
+       Entry *e, AttributeName *an, int ao, LDAPControl **c)
+{
+       smatch_info *sm = o->o_callback->sc_private;

 
 

-
+       if (dn_match(sm->dn, &e->e_nname)) {
+               sm->match = 1;
+               return -1;      /* short-circuit the search */
+       } else {
+               return 1;
+       }
+}

 
 /*
  * Map a SASL regexp rule to a DN. If the rule is just a DN or a scope=base
 
 /*
  * Map a SASL regexp rule to a DN. If the rule is just a DN or a scope=base


@@ -412,39 +449,35 @@ FINISHED:
  */
 
 static
  */
 
 static

-int slap_sasl_match( char *rule, char *assertDN, char *authc )
+int slap_sasl_match( struct berval *rule, struct berval *assertDN, struct berval *authc )

 {
 {

-       char *dn=NULL;

        struct berval searchbase = {0, NULL};
        int rc, scope;
        Backend *be;
        Filter *filter=NULL;
        struct berval searchbase = {0, NULL};
        int rc, scope;
        Backend *be;
        Filter *filter=NULL;

-       Connection *conn=NULL;
-       LDAP *client=NULL;
-       LDAPMessage *res=NULL, *msg;

        regex_t reg;
        regex_t reg;

-
+       smatch_info sm;
+       slap_callback cb = { sasl_sc_r, sasl_sc_s, sasl_sc_smatch, NULL };
+       Operation op = {0};

 
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
 
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,

-                  "slap_sasl_match: comparing DN %s to rule %s\n", assertDN, rule ));
+               "slap_sasl_match: comparing DN %s to rule %s\n", assertDN->bv_val, rule->bv_val ));

 #else
        Debug( LDAP_DEBUG_TRACE,
 #else
        Debug( LDAP_DEBUG_TRACE,

-          "===>slap_sasl_match: comparing DN %s to rule %s\n", assertDN, rule, 0 );
+          "===>slap_sasl_match: comparing DN %s to rule %s\n", assertDN->bv_val, rule->bv_val, 0 );

 #endif
 
 #endif
 

-
-       rc = slap_parseURI( rule, &searchbase.bv_val, &scope, &filter );
+       rc = slap_parseURI( rule, &searchbase, &scope, &filter );

        if( rc != LDAP_SUCCESS )
                goto CONCLUDED;
 
        if( rc != LDAP_SUCCESS )
                goto CONCLUDED;
 

-       searchbase.bv_len = strlen( searchbase.bv_val );

        /* Massive shortcut: search scope == base */
        if( scope == LDAP_SCOPE_BASE ) {
        /* Massive shortcut: search scope == base */
        if( scope == LDAP_SCOPE_BASE ) {

-               dn_normalize( searchbase.bv_val );
-               rc = regcomp(&reg, searchbase.bv_val, REG_EXTENDED|REG_ICASE|REG_NOSUB);
+               rc = regcomp(&reg, searchbase.bv_val,
+                       REG_EXTENDED|REG_ICASE|REG_NOSUB);

                if ( rc == 0 ) {
                if ( rc == 0 ) {

-                       rc = regexec(&reg, assertDN, 0, NULL, 0);
+                       rc = regexec(&reg, assertDN->bv_val, 0, NULL, 0);

                        regfree( &reg );
                }
                if ( rc == 0 )
                        regfree( &reg );
                }
                if ( rc == 0 )


@@ -458,15 +491,14 @@ int slap_sasl_match( char *rule, char *assertDN, char *authc )
 
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_DETAIL1,
 
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_DETAIL1,

-                  "slap_sasl_match: performing internal search (base=%s, scope=%d)\n",
-                  searchbase.bv_val, scope ));
+               "slap_sasl_match: performing internal search (base=%s, scope=%d)\n",
+               searchbase.bv_val, scope ));

 #else
        Debug( LDAP_DEBUG_TRACE,
           "slap_sasl_match: performing internal search (base=%s, scope=%d)\n",
           searchbase.bv_val, scope, 0 );
 #endif
 
 #else
        Debug( LDAP_DEBUG_TRACE,
           "slap_sasl_match: performing internal search (base=%s, scope=%d)\n",
           searchbase.bv_val, scope, 0 );
 #endif
 

-

        be = select_backend( &searchbase, 0, 1 );
        if(( be == NULL ) || ( be->be_search == NULL)) {
                rc = LDAP_INAPPROPRIATE_AUTH;
        be = select_backend( &searchbase, 0, 1 );
        if(( be == NULL ) || ( be->be_search == NULL)) {
                rc = LDAP_INAPPROPRIATE_AUTH;


@@ -474,42 +506,28 @@ int slap_sasl_match( char *rule, char *assertDN, char *authc )
        }
        suffix_alias( be, &searchbase );
 
        }
        suffix_alias( be, &searchbase );
 

-       /* Make an internal connection on which to run the search */
-       rc = connection_internal_open( &conn, &client, authc );
-       if( rc != LDAP_SUCCESS )
-               goto CONCLUDED;
+       sm.dn = assertDN;
+       sm.match = 0;
+       cb.sc_private = &sm;

 
 

-       (*be->be_search)( be, conn, conn->c_ops, /*base=*/NULL, searchbase.bv_val,
+       op.o_tag = LDAP_REQ_SEARCH;
+       op.o_protocol = LDAP_VERSION3;
+       op.o_ndn = *authc;
+       op.o_callback = &cb;
+       op.o_time = slap_get_time();
+
+       (*be->be_search)( be, /*conn=*/NULL, &op, /*base=*/NULL, &searchbase,

           scope, /*deref=*/1, /*sizelimit=*/0, /*time=*/0, filter, /*fstr=*/NULL,
           /*attrs=*/NULL, /*attrsonly=*/0 );
 
           scope, /*deref=*/1, /*sizelimit=*/0, /*time=*/0, filter, /*fstr=*/NULL,
           /*attrs=*/NULL, /*attrsonly=*/0 );
 

-
-       /* On the client side of the internal search, read the results. Check
-          if the assertDN matches any of the DN's returned by the search */
-       rc = ldap_result( client, LDAP_RES_ANY, LDAP_MSG_ALL, NULL, &res );
-       if( rc == -1 )
-               goto CONCLUDED;
-
-       for( msg=ldap_first_entry( client, res );
-             msg;
-             msg=ldap_next_entry( client, msg ) )   {
-               dn = ldap_get_dn( client, msg );
-               dn_normalize( dn );
-               rc = strcmp( dn, assertDN );
-               ch_free( dn );
-               if( rc == 0 ) {
-                       rc = LDAP_SUCCESS;
-                       goto CONCLUDED;
-               }
-       }
-       rc = LDAP_INAPPROPRIATE_AUTH;
+       if (sm.match)
+               rc = LDAP_SUCCESS;
+       else
+               rc = LDAP_INAPPROPRIATE_AUTH;

 
 CONCLUDED:
        if( searchbase.bv_len ) ch_free( searchbase.bv_val );
        if( filter ) filter_free( filter );
 
 CONCLUDED:
        if( searchbase.bv_len ) ch_free( searchbase.bv_val );
        if( filter ) filter_free( filter );

-       if( conn ) connection_internal_close( conn );
-       if( res ) ldap_msgfree( res );
-       if( client  ) ldap_unbind( client );

 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
                   "slap_sasl_match: comparison returned %d\n", rc ));
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
                   "slap_sasl_match: comparison returned %d\n", rc ));


@@ -522,9 +540,6 @@ CONCLUDED:
 }
 
 
 }
 
 

-
-
-

 /*
  * This function answers the question, "Can this ID authorize to that ID?",
  * based on authorization rules. The rules are stored in the *searchDN, in the
 /*
  * This function answers the question, "Can this ID authorize to that ID?",
  * based on authorization rules. The rules are stored in the *searchDN, in the


@@ -533,68 +548,71 @@ CONCLUDED:
  *
  * DN's passed in should have a dn: prefix
  */
  *
  * DN's passed in should have a dn: prefix
  */

-

 static int
 static int

-slap_sasl_check_authz(char *searchDN, char *assertDN, char *attr, char *authc)
+slap_sasl_check_authz(struct berval *searchDN, struct berval *assertDN, struct berval *attr, struct berval *authc)

 {
        const char *errmsg;
        int i, rc;
 {
        const char *errmsg;
        int i, rc;

-       struct berval **vals=NULL;
+       BerVarray vals=NULL;

        AttributeDescription *ad=NULL;
        AttributeDescription *ad=NULL;

-
+       struct berval bv;

 
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
                   "slap_sasl_check_authz: does %s match %s rule in %s?\n",
 
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
                   "slap_sasl_check_authz: does %s match %s rule in %s?\n",

-                  assertDN, attr, searchDN ));
+                  assertDN->bv_val, attr->bv_val, searchDN->bv_val ));

 #else
        Debug( LDAP_DEBUG_TRACE,
           "==>slap_sasl_check_authz: does %s match %s rule in %s?\n",
 #else
        Debug( LDAP_DEBUG_TRACE,
           "==>slap_sasl_check_authz: does %s match %s rule in %s?\n",

-          assertDN, attr, searchDN);
+          assertDN->bv_val, attr->bv_val, searchDN->bv_val);

 #endif
 
 #endif
 

-       rc = slap_str2ad( attr, &ad, &errmsg );
+       rc = slap_bv2ad( attr, &ad, &errmsg );

        if( rc != LDAP_SUCCESS )
                goto COMPLETE;
 
        if( rc != LDAP_SUCCESS )
                goto COMPLETE;
 

-       rc = backend_attribute( NULL, NULL, NULL, NULL, searchDN+3, ad, &vals );
+       bv.bv_val = searchDN->bv_val + 3;
+       bv.bv_len = searchDN->bv_len - 3;
+       rc = backend_attribute( NULL, NULL, NULL, NULL, &bv, ad, &vals );

        if( rc != LDAP_SUCCESS )
                goto COMPLETE;
 
        if( rc != LDAP_SUCCESS )
                goto COMPLETE;
 

+       bv.bv_val = assertDN->bv_val + 3;
+       bv.bv_len = assertDN->bv_len - 3;

        /* Check if the *assertDN matches any **vals */
        /* Check if the *assertDN matches any **vals */

-       for( i=0; vals[i] != NULL; i++ ) {
-               rc = slap_sasl_match( vals[i]->bv_val, assertDN+3, authc );
+       for( i=0; vals[i].bv_val != NULL; i++ ) {
+               rc = slap_sasl_match( &vals[i], &bv, authc );

                if ( rc == LDAP_SUCCESS )
                        goto COMPLETE;
        }
        rc = LDAP_INAPPROPRIATE_AUTH;
 
 COMPLETE:
                if ( rc == LDAP_SUCCESS )
                        goto COMPLETE;
        }
        rc = LDAP_INAPPROPRIATE_AUTH;
 
 COMPLETE:

-       if( vals ) ber_bvecfree( vals );
+       if( vals ) ber_bvarray_free( vals );

 
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
 
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,

-                  "slap_sasl_check_authz: %s check returning %s\n", attr, rc ));
+                  "slap_sasl_check_authz: %s check returning %s\n", attr->bv_val, rc ));

 #else
        Debug( LDAP_DEBUG_TRACE,
 #else
        Debug( LDAP_DEBUG_TRACE,

-          "<==slap_sasl_check_authz: %s check returning %d\n", attr, rc, 0);
+          "<==slap_sasl_check_authz: %s check returning %d\n", attr->bv_val, rc, 0);

 #endif
 
        return( rc );
 }
 #endif
 
        return( rc );
 }

-
-
-

 #endif /* HAVE_CYRUS_SASL */
 
 
 #endif /* HAVE_CYRUS_SASL */
 
 

-
-
-

 /* Check if a bind can SASL authorize to another identity.
    Accepts authorization DN's with "dn:" prefix */
 
 /* Check if a bind can SASL authorize to another identity.
    Accepts authorization DN's with "dn:" prefix */
 

-int slap_sasl_authorized( char *authcDN, char *authzDN )
+static struct berval sasl_authz_src = {
+       sizeof(SASL_AUTHZ_SOURCE_ATTR)-1, SASL_AUTHZ_SOURCE_ATTR };
+
+static struct berval sasl_authz_dst = {
+       sizeof(SASL_AUTHZ_DEST_ATTR)-1, SASL_AUTHZ_DEST_ATTR };
+
+int slap_sasl_authorized( struct berval *authcDN, struct berval *authzDN )

 {
        int rc = LDAP_INAPPROPRIATE_AUTH;
 
 {
        int rc = LDAP_INAPPROPRIATE_AUTH;
 


@@ -607,28 +625,27 @@ int slap_sasl_authorized( char *authcDN, char *authzDN )
 
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
 
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,

-                  "slap_sasl_authorized: can %s become %s?\n", authcDN, authzDN ));
+               "slap_sasl_authorized: can %s become %s?\n", authcDN->bv_val, authzDN->bv_val ));

 #else
        Debug( LDAP_DEBUG_TRACE,
 #else
        Debug( LDAP_DEBUG_TRACE,

-          "==>slap_sasl_authorized: can %s become %s?\n", authcDN, authzDN, 0 );
+          "==>slap_sasl_authorized: can %s become %s?\n", authcDN->bv_val, authzDN->bv_val, 0 );

 #endif
 
 #endif
 

-

        /* If person is authorizing to self, succeed */
        /* If person is authorizing to self, succeed */

-       if ( !strcmp( authcDN, authzDN ) ) {
+       if ( dn_match( authcDN, authzDN ) ) {

                rc = LDAP_SUCCESS;
                goto DONE;
        }
 
        /* Check source rules */
                rc = LDAP_SUCCESS;
                goto DONE;
        }
 
        /* Check source rules */

-       rc = slap_sasl_check_authz( authcDN, authzDN, SASL_AUTHZ_SOURCE_ATTR,
+       rc = slap_sasl_check_authz( authcDN, authzDN, &sasl_authz_src,

           authcDN );
        if( rc == LDAP_SUCCESS ) {
                goto DONE;
        }
 
        /* Check destination rules */
           authcDN );
        if( rc == LDAP_SUCCESS ) {
                goto DONE;
        }
 
        /* Check destination rules */

-       rc = slap_sasl_check_authz( authzDN, authcDN, SASL_AUTHZ_DEST_ATTR,
+       rc = slap_sasl_check_authz( authzDN, authcDN, &sasl_authz_dst,

           authcDN );
        if( rc == LDAP_SUCCESS ) {
                goto DONE;
           authcDN );
        if( rc == LDAP_SUCCESS ) {
                goto DONE;


@@ -641,9 +658,10 @@ DONE:
 
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
 
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,

-                  "slap_sasl_authorized: return %d\n", rc ));
+               "slap_sasl_authorized: return %d\n", rc ));

 #else
 #else

-       Debug( LDAP_DEBUG_TRACE, "<== slap_sasl_authorized: return %d\n",rc,0,0 );
+       Debug( LDAP_DEBUG_TRACE,
+               "<== slap_sasl_authorized: return %d\n", rc, 0, 0 );

 #endif
 
        return( rc );
 #endif
 
        return( rc );