silence excessive logging

[openldap] / libraries / libldap / cyrus.c

diff --git a/libraries/libldap/cyrus.c b/libraries/libldap/cyrus.c
index d14e893c058357e21e0bffac8a99350001a696cc..06d275eeb4865c783742c5d8e8f24dc003eca865 100644 (file)
--- a/libraries/libldap/cyrus.c
+++ b/libraries/libldap/cyrus.c
@@ -92,6 +92,7 @@ int ldap_int_sasl_init( void )
 
 struct sb_sasl_data {
        sasl_conn_t             *sasl_context;
+       unsigned                *sasl_maxbuf;
        Sockbuf_Buf             sec_buf_in;
        Sockbuf_Buf             buf_in;
        Sockbuf_Buf             buf_out;
@@ -112,9 +113,12 @@ sb_sasl_setup( Sockbuf_IO_Desc *sbiod, void *arg )
        ber_pvt_sb_buf_init( &p->buf_in );
        ber_pvt_sb_buf_init( &p->buf_out );
        if ( ber_pvt_sb_grow_buffer( &p->sec_buf_in, SASL_MIN_BUFF_SIZE ) < 0 ) {
+               LBER_FREE( p );
                errno = ENOMEM;
                return -1;
        }
+       sasl_getprop( p->sasl_context, SASL_MAXOUTBUF,
+               (SASL_CONST void **) &p->sasl_maxbuf );
 
        sbiod->sbiod_pvt = p;
 
@@ -146,7 +150,7 @@ sb_sasl_remove( Sockbuf_IO_Desc *sbiod )
 }
 
 static ber_len_t
-sb_sasl_pkt_length( const unsigned char *buf, int debuglevel )
+sb_sasl_pkt_length( const unsigned char *buf, unsigned max, int debuglevel )
 {
        ber_len_t               size;
 
@@ -157,10 +161,7 @@ sb_sasl_pkt_length( const unsigned char *buf, int debuglevel )
                | buf[2] << 8
                | buf[3];
    
-       /* we really should check against actual buffer size set
-        * in the secopts.
-        */
-       if ( size > SASL_MAX_BUFF_SIZE ) {
+       if ( size > max ) {
                /* somebody is trying to mess me up. */
                ber_log_printf( LDAP_DEBUG_ANY, debuglevel,
                        "sb_sasl_pkt_length: received illegal packet length "
@@ -173,7 +174,7 @@ sb_sasl_pkt_length( const unsigned char *buf, int debuglevel )
 
 /* Drop a processed packet from the input buffer */
 static void
-sb_sasl_drop_packet ( Sockbuf_Buf *sec_buf_in, int debuglevel )
+sb_sasl_drop_packet ( Sockbuf_Buf *sec_buf_in, unsigned max, int debuglevel )
 {
        ber_slen_t                      len;
 
@@ -184,7 +185,7 @@ sb_sasl_drop_packet ( Sockbuf_Buf *sec_buf_in, int debuglevel )
    
        if ( len >= 4 ) {
                sec_buf_in->buf_end = sb_sasl_pkt_length( sec_buf_in->buf_base,
-                       debuglevel);
+                       max, debuglevel);
        }
        else {
                sec_buf_in->buf_end = 0;
@@ -233,7 +234,7 @@ sb_sasl_read( Sockbuf_IO_Desc *sbiod, void *buf, ber_len_t len)
 
        /* The new packet always starts at p->sec_buf_in.buf_base */
        ret = sb_sasl_pkt_length( p->sec_buf_in.buf_base,
-               sbiod->sbiod_sb->sb_debug );
+               *p->sasl_maxbuf, sbiod->sbiod_sb->sb_debug );
 
        /* Grow the packet buffer if neccessary */
        if ( ( p->sec_buf_in.buf_size < (ber_len_t) ret ) && 
@@ -266,19 +267,19 @@ sb_sasl_read( Sockbuf_IO_Desc *sbiod, void *buf, ber_len_t len)
                p->sec_buf_in.buf_end,
                (SASL_CONST char **)&p->buf_in.buf_base,
                (unsigned *)&p->buf_in.buf_end );
+
+       /* Drop the packet from the input buffer */
+       sb_sasl_drop_packet( &p->sec_buf_in,
+                       *p->sasl_maxbuf, sbiod->sbiod_sb->sb_debug );
+
        if ( ret != SASL_OK ) {
                ber_log_printf( LDAP_DEBUG_ANY, sbiod->sbiod_sb->sb_debug,
                        "sb_sasl_read: failed to decode packet: %s\n",
                        sasl_errstring( ret, NULL, NULL ) );
-               sb_sasl_drop_packet( &p->sec_buf_in,
-                       sbiod->sbiod_sb->sb_debug );
                errno = EIO;
                return -1;
        }
        
-       /* Drop the packet from the input buffer */
-       sb_sasl_drop_packet( &p->sec_buf_in, sbiod->sbiod_sb->sb_debug );
-
        p->buf_in.buf_size = p->buf_in.buf_end;
 
        bufptr += ber_pvt_sb_copy_out( &p->buf_in, (char*) buf + bufptr, len );
@@ -310,6 +311,8 @@ sb_sasl_write( Sockbuf_IO_Desc *sbiod, void *buf, ber_len_t len)
 #else
        ber_pvt_sb_buf_destroy( &p->buf_out );
 #endif
+       if ( len > *p->sasl_maxbuf - 100 )
+               len = *p->sasl_maxbuf - 100;    /* For safety margin */
        ret = sasl_encode( p->sasl_context, buf, len,
                (SASL_CONST char **)&p->buf_out.buf_base,
                (unsigned *)&p->buf_out.buf_size );
@@ -429,19 +432,6 @@ ldap_int_sasl_open(
        int rc;
        sasl_conn_t *ctx;
 
-       sasl_callback_t *session_callbacks =
-               LDAP_CALLOC( 2, sizeof( sasl_callback_t ) );
-
-       if( session_callbacks == NULL ) return LDAP_NO_MEMORY;
-
-       session_callbacks[0].id = SASL_CB_USER;
-       session_callbacks[0].proc = NULL;
-       session_callbacks[0].context = ld;
-
-       session_callbacks[1].id = SASL_CB_LIST_END;
-       session_callbacks[1].proc = NULL;
-       session_callbacks[1].context = NULL;
-
        assert( lc->lconn_sasl_ctx == NULL );
 
        if ( host == NULL ) {
@@ -451,12 +441,11 @@ ldap_int_sasl_open(
 
 #if SASL_VERSION_MAJOR >= 2
        rc = sasl_client_new( "ldap", host, NULL, NULL,
-               session_callbacks, 0, &ctx );
+               NULL, 0, &ctx );
 #else
-       rc = sasl_client_new( "ldap", host, session_callbacks,
+       rc = sasl_client_new( "ldap", host, NULL,
                SASL_SECURITY_LAYER, &ctx );
 #endif
-       LDAP_FREE( session_callbacks );
 
        if ( rc != SASL_OK ) {
                ld->ld_errno = sasl_err2ldap( rc );
@@ -619,6 +608,9 @@ ldap_int_sasl_bind(
 
        if ( (saslrc != SASL_OK) && (saslrc != SASL_CONTINUE) ) {
                ld->ld_errno = sasl_err2ldap( saslrc );
+#if SASL_VERSION_MAJOR >= 2
+               ld->ld_error = (char *)sasl_errdetail( ctx );
+#endif
                return ld->ld_errno;
        }
 
@@ -712,6 +704,9 @@ ldap_int_sasl_bind(
 
                if ( (saslrc != SASL_OK) && (saslrc != SASL_CONTINUE) ) {
                        ld->ld_errno = sasl_err2ldap( saslrc );
+#if SASL_VERSION_MAJOR >= 2
+                       ld->ld_error = (char *)sasl_errdetail( ctx );
+#endif
                        return ld->ld_errno;
                }
        } while ( rc == LDAP_SASL_BIND_IN_PROGRESS );
@@ -721,6 +716,9 @@ ldap_int_sasl_bind(
        }
 
        if ( saslrc != SASL_OK ) {
+#if SASL_VERSION_MAJOR >= 2
+               ld->ld_error = (char *)sasl_errdetail( ctx );
+#endif
                return ld->ld_errno = sasl_err2ldap( saslrc );
        }
 
@@ -779,6 +777,8 @@ ldap_int_sasl_external(
    
 #if SASL_VERSION_MAJOR >= 2
        sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL, &ssf );
+       if ( sc == SASL_OK )
+               sc = sasl_setprop( ctx, SASL_AUTH_EXTERNAL, authid );
 #else
        memset( &extprops, '\0', sizeof(extprops) );
        extprops.ssf = ssf;