/* $OpenLDAP$ */
-/*
- * Copyright 1999-2003 The OpenLDAP Foundation, All Rights Reserved.
- * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
+/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
+ *
+ * Copyright 1998-2003 The OpenLDAP Foundation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted only as authorized by the OpenLDAP
+ * Public License.
+ *
+ * A copy of this license is available in the file LICENSE in the
+ * top-level directory of the distribution or, alternatively, at
+ * <http://www.OpenLDAP.org/license.html>.
*/
#include "portable.h"
#include <ac/time.h>
#include <ac/errno.h>
#include <ac/ctype.h>
+#include <ac/unistd.h>
#include "ldap-int.h"
};
#ifdef HAVE_SASL_VERSION
-#define SASL_BUILD_VERSION ((SASL_VERSION_MAJOR << 24) |\
- (SASL_VERSION_MINOR << 16) | SASL_VERSION_STEP)
-
+ /* stringify the version number, sasl.h doesn't do it for us */
+#define VSTR0(maj, min, pat) #maj "." #min "." #pat
+#define VSTR(maj, min, pat) VSTR0(maj, min, pat)
+#define SASL_VERSION_STRING VSTR(SASL_VERSION_MAJOR, SASL_VERSION_MINOR, \
+ SASL_VERSION_STEP)
{ int rc;
sasl_version( NULL, &rc );
if ( ((rc >> 16) != ((SASL_VERSION_MAJOR << 8)|SASL_VERSION_MINOR)) ||
(rc & 0xffff) < SASL_VERSION_STEP) {
+ char version[sizeof("xxx.xxx.xxxxx")];
+ sprintf( version, "%u.%d.%d", (unsigned)rc >> 24, (rc >> 16) & 0xff,
+ rc & 0xffff );
#ifdef NEW_LOGGING
LDAP_LOG( TRANSPORT, INFO,
- "ldap_int_sasl_init: SASL version mismatch, got %x, wanted %x.\n",
- rc, SASL_BUILD_VERSION, 0 );
+ "ldap_int_sasl_init: SASL library version mismatch:"
+ " expected " SASL_VERSION_STRING ","
+ " got %s\n", version, 0, 0 );
#else
Debug( LDAP_DEBUG_ANY,
- "ldap_int_sasl_init: SASL version mismatch, got %x, wanted %x.\n",
- rc, SASL_BUILD_VERSION, 0 );
+ "ldap_int_sasl_init: SASL library version mismatch:"
+ " expected " SASL_VERSION_STRING ","
+ " got %s\n", version, 0, 0 );
#endif
return -1;
}
}
sasl_getprop( p->sasl_context, SASL_MAXOUTBUF,
(SASL_CONST void **) &p->sasl_maxbuf );
-
+
sbiod->sbiod_pvt = p;
return 0;
}
static ber_len_t
-sb_sasl_pkt_length( const unsigned char *buf, unsigned max, int debuglevel )
+sb_sasl_pkt_length( const unsigned char *buf, int debuglevel )
{
ber_len_t size;
/* Drop a processed packet from the input buffer */
static void
-sb_sasl_drop_packet ( Sockbuf_Buf *sec_buf_in, unsigned max, int debuglevel )
+sb_sasl_drop_packet ( Sockbuf_Buf *sec_buf_in, int debuglevel )
{
ber_slen_t len;
sec_buf_in->buf_end, len );
if ( len >= 4 ) {
- sec_buf_in->buf_end = sb_sasl_pkt_length( sec_buf_in->buf_base,
- max, debuglevel);
+ sec_buf_in->buf_end = sb_sasl_pkt_length(
+ (unsigned char *) sec_buf_in->buf_base, debuglevel);
}
else {
sec_buf_in->buf_end = 0;
}
/* The new packet always starts at p->sec_buf_in.buf_base */
- ret = sb_sasl_pkt_length( p->sec_buf_in.buf_base,
- *p->sasl_maxbuf, sbiod->sbiod_sb->sb_debug );
+ ret = sb_sasl_pkt_length( (unsigned char *) p->sec_buf_in.buf_base,
+ sbiod->sbiod_sb->sb_debug );
/* Grow the packet buffer if neccessary */
if ( ( p->sec_buf_in.buf_size < (ber_len_t) ret ) &&
(unsigned *)&p->buf_in.buf_end );
/* Drop the packet from the input buffer */
- sb_sasl_drop_packet( &p->sec_buf_in,
- *p->sasl_maxbuf, sbiod->sbiod_sb->sb_debug );
+ sb_sasl_drop_packet( &p->sec_buf_in, sbiod->sbiod_sb->sb_debug );
if ( ret != SASL_OK ) {
ber_log_printf( LDAP_DEBUG_ANY, sbiod->sbiod_sb->sb_debug,
return LDAP_SUCCESS;
}
+void ldap_pvt_sasl_remove( Sockbuf *sb )
+{
+ ber_sockbuf_remove_io( sb, &ldap_pvt_sockbuf_io_sasl,
+ LBER_SBIOD_LEVEL_APPLICATION );
+#ifdef LDAP_DEBUG
+ ber_sockbuf_remove_io( sb, &ber_sockbuf_io_debug,
+ LBER_SBIOD_LEVEL_APPLICATION );
+#endif
+}
+
static int
sasl_err2ldap( int saslerr )
{
int rc;
sasl_conn_t *ctx;
- assert( lc->lconn_sasl_ctx == NULL );
+ assert( lc->lconn_sasl_authctx == NULL );
if ( host == NULL ) {
ld->ld_errno = LDAP_LOCAL_ERROR;
return ld->ld_errno;
}
+ if ( ldap_int_sasl_init() ) {
+ ld->ld_errno = LDAP_LOCAL_ERROR;
+ return ld->ld_errno;
+ }
+
#if SASL_VERSION_MAJOR >= 2
rc = sasl_client_new( "ldap", host, NULL, NULL,
NULL, 0, &ctx );
host, 0, 0 );
#endif
- lc->lconn_sasl_ctx = ctx;
+ lc->lconn_sasl_authctx = ctx;
return LDAP_SUCCESS;
}
int ldap_int_sasl_close( LDAP *ld, LDAPConn *lc )
{
- sasl_conn_t *ctx = lc->lconn_sasl_ctx;
+ sasl_conn_t *ctx = lc->lconn_sasl_authctx;
if( ctx != NULL ) {
sasl_dispose( &ctx );
- lc->lconn_sasl_ctx = NULL;
+ if ( lc->lconn_sasl_sockctx &&
+ lc->lconn_sasl_authctx != lc->lconn_sasl_sockctx ) {
+ ctx = lc->lconn_sasl_sockctx;
+ sasl_dispose( &ctx );
+ }
+ lc->lconn_sasl_sockctx = NULL;
+ lc->lconn_sasl_authctx = NULL;
}
return LDAP_SUCCESS;
const char *pmech = NULL;
int saslrc, rc;
sasl_ssf_t *ssf = NULL;
- sasl_conn_t *ctx;
+ sasl_conn_t *ctx, *oldctx = NULL;
sasl_interact_t *prompts = NULL;
unsigned credlen;
struct berval ccred;
}
}
- ctx = ld->ld_defconn->lconn_sasl_ctx;
+ oldctx = ld->ld_defconn->lconn_sasl_authctx;
- /* If we already have a context, shut it down */
- if( ctx ) {
- /* Do an anonymous bind to kill the server's context */
- rc = ldap_simple_bind_s( ld, "", NULL );
+ /* If we already have an authentication context, clear it out */
+ if( oldctx ) {
+ if ( oldctx != ld->ld_defconn->lconn_sasl_sockctx ) {
+ sasl_dispose( &oldctx );
+ }
+ ld->ld_defconn->lconn_sasl_authctx = NULL;
+ }
- /* dispose of the old context */
- ldap_int_sasl_close( ld, ld->ld_defconn );
+ { char *saslhost = ldap_host_connected_to( ld->ld_sb, "localhost" );
+ rc = ldap_int_sasl_open( ld, ld->ld_defconn, saslhost );
+ LDAP_FREE( saslhost );
}
- rc = ldap_int_sasl_open( ld, ld->ld_defconn,
- ld->ld_defconn->lconn_server->lud_host ?
- ld->ld_defconn->lconn_server->lud_host : "localhost" );
-
if ( rc != LDAP_SUCCESS ) return rc;
- ctx = ld->ld_defconn->lconn_sasl_ctx;
+ ctx = ld->ld_defconn->lconn_sasl_authctx;
/* Check for TLS */
ssl = ldap_pvt_tls_sb_ctx( ld->ld_sb );
if ( (saslrc != SASL_OK) && (saslrc != SASL_CONTINUE) ) {
rc = ld->ld_errno = sasl_err2ldap( saslrc );
#if SASL_VERSION_MAJOR >= 2
- ld->ld_error = (char *)sasl_errdetail( ctx );
+ ld->ld_error = LDAP_STRDUP( sasl_errdetail( ctx ) );
#endif
goto done;
}
if ( (saslrc != SASL_OK) && (saslrc != SASL_CONTINUE) ) {
ld->ld_errno = sasl_err2ldap( saslrc );
#if SASL_VERSION_MAJOR >= 2
- ld->ld_error = (char *)sasl_errdetail( ctx );
+ ld->ld_error = LDAP_STRDUP( sasl_errdetail( ctx ) );
#endif
rc = ld->ld_errno;
goto done;
if ( saslrc != SASL_OK ) {
#if SASL_VERSION_MAJOR >= 2
- ld->ld_error = (char *)sasl_errdetail( ctx );
+ ld->ld_error = LDAP_STRDUP( sasl_errdetail( ctx ) );
#endif
rc = ld->ld_errno = sasl_err2ldap( saslrc );
goto done;
if( flags != LDAP_SASL_QUIET ) {
fprintf( stderr, "SASL installing layers\n" );
}
+ if ( ld->ld_defconn->lconn_sasl_sockctx ) {
+ oldctx = ld->ld_defconn->lconn_sasl_sockctx;
+ sasl_dispose( &oldctx );
+ ldap_pvt_sasl_remove( ld->ld_sb );
+ }
ldap_pvt_sasl_install( ld->ld_conns->lconn_sb, ctx );
+ ld->ld_defconn->lconn_sasl_sockctx = ctx;
}
}
+ ld->ld_defconn->lconn_sasl_authctx = ctx;
done:
return rc;
sasl_external_properties_t extprops;
#endif
- ctx = conn->lconn_sasl_ctx;
+ ctx = conn->lconn_sasl_authctx;
if ( ctx == NULL ) {
return LDAP_LOCAL_ERROR;
return -1;
}
- ctx = ld->ld_defconn->lconn_sasl_ctx;
+ ctx = ld->ld_defconn->lconn_sasl_sockctx;
if ( ctx == NULL ) {
return -1;
return -1;
}
- ctx = ld->ld_defconn->lconn_sasl_ctx;
+ ctx = ld->ld_defconn->lconn_sasl_authctx;
if ( ctx == NULL ) {
return -1;