Add experimental code to check simple bind passwords

[openldap] / libraries / liblutil / passwd.c

diff --git a/libraries/liblutil/passwd.c b/libraries/liblutil/passwd.c
index 5c2c1ed29e9e8f18831582ed4165b15decdd7162..866d68228bf50cb45e3399102803f840ab26fe35 100644 (file)
--- a/libraries/liblutil/passwd.c
+++ b/libraries/liblutil/passwd.c
@@ -22,6 +22,10 @@
 #include <ac/stdlib.h>
 #include <ac/string.h>
 
+#ifdef SLAPD_SPASSWD
+#      include <sasl.h>
+#endif
+
 #ifdef SLAPD_KPASSWD
 #      include <ac/krb.h>
 #      include <ac/krb5.h>
@@ -86,10 +90,19 @@ static int chk_sha1(
        const struct berval *passwd,
        const struct berval *cred );
 
+#ifdef SLAPD_SPASSWD
+static int chk_sasl(
+       const struct pw_scheme *scheme,
+       const struct berval *passwd,
+       const struct berval *cred );
+#endif
+
+#ifdef SLAPD_KPASSWD
 static int chk_kerberos(
        const struct pw_scheme *scheme,
        const struct berval *passwd,
        const struct berval *cred );
+#endif
 
 static int chk_crypt(
        const struct pw_scheme *scheme,
@@ -132,6 +145,10 @@ static const struct pw_scheme pw_schemes[] =
        { {sizeof("{SMD5}")-1, "{SMD5}"},       chk_smd5, hash_smd5 },
        { {sizeof("{MD5}")-1, "{MD5}"},         chk_md5, hash_md5 },
 
+#ifdef SLAPD_SPASSWD
+       { {sizeof("{SASL}")-1, "{SASL}"}, chk_sasl, NULL },
+#endif
+
 #ifdef SLAPD_KPASSWD
        { {sizeof("{KERBEROS}")-1, "{KERBEROS}"}, chk_kerberos, NULL },
 #endif
@@ -383,15 +400,16 @@ static struct berval * pw_string64(
                string.bv_val, string.bv_len,
                &b64->bv_val[sc->name.bv_len], b64len );
 
-       b64->bv_val[b64->bv_len] = '\0';
-
        if( salt ) ber_memfree( string.bv_val );
-
+       
        if( rc < 0 ) {
                ber_bvfree( b64 );
                return NULL;
        }
 
+       /* recompute length */
+       b64->bv_len = sc->name.bv_len + rc;
+       assert( strlen(b64->bv_val) == b64->bv_len );
        return b64;
 }
 
@@ -407,7 +425,7 @@ static int chk_ssha1(
        int rc;
        unsigned char *orig_pass = NULL;
  
-       /* base64 un-encode password */
+       /* decode base64 password */
        orig_pass = (unsigned char *) ber_memalloc( (size_t) (
                LUTIL_BASE64_DECODE_LEN(passwd->bv_len) + 1) );
 
@@ -417,7 +435,7 @@ static int chk_ssha1(
 
        if(rc < 0) {
                ber_memfree(orig_pass);
-               return 1;
+               return -1;
        }
  
        /* hash credentials with salt */
@@ -432,7 +450,7 @@ static int chk_ssha1(
        /* compare */
        rc = memcmp((char *)orig_pass, (char *)SHA1digest, sizeof(SHA1digest));
        ber_memfree(orig_pass);
-       return rc;
+       return rc ? 1 : 0;
 }
 
 static int chk_sha1(
@@ -455,7 +473,7 @@ static int chk_sha1(
 
        if( rc != sizeof(SHA1digest) ) {
                ber_memfree(orig_pass);
-               return 1;
+               return -1;
        }
  
        /* hash credentials with salt */
@@ -467,7 +485,7 @@ static int chk_sha1(
        /* compare */
        rc = memcmp((char *)orig_pass, (char *)SHA1digest, sizeof(SHA1digest));
        ber_memfree(orig_pass);
-       return rc;
+       return rc ? 1 : 0;
 }
 
 static int chk_smd5(
@@ -489,7 +507,7 @@ static int chk_smd5(
        rc = lutil_b64_pton(passwd->bv_val, orig_pass, passwd->bv_len);
        if ( rc < 0 ) {
                ber_memfree(orig_pass);
-               return 1;
+               return -1;
        }
 
        /* hash credentials with salt */
@@ -504,7 +522,7 @@ static int chk_smd5(
        /* compare */
        rc = memcmp((char *)orig_pass, (char *)MD5digest, sizeof(MD5digest));
        ber_memfree(orig_pass);
-       return rc;
+       return rc ? 1 : 0;
 }
 
 static int chk_md5(
@@ -526,7 +544,7 @@ static int chk_md5(
        rc = lutil_b64_pton(passwd->bv_val, orig_pass, passwd->bv_len);
        if ( rc != sizeof(MD5digest) ) {
                ber_memfree(orig_pass);
-               return 1;
+               return -1;
        }
 
        /* hash credentials with salt */
@@ -538,9 +556,62 @@ static int chk_md5(
        /* compare */
        rc = memcmp((char *)orig_pass, (char *)MD5digest, sizeof(MD5digest));
        ber_memfree(orig_pass);
-       return rc;
+       return rc ? 1 : 0;
 }
 
+#ifdef SLAPD_SPASSWD
+#ifdef HAVE_CYRUS_SASL
+sasl_conn_t *lutil_passwd_sasl_conn = NULL;
+#endif
+
+static int chk_sasl(
+       const struct pw_scheme *sc,
+       const struct berval * passwd,
+       const struct berval * cred )
+{
+       int i;
+       int rtn;
+
+       for( i=0; i<cred->bv_len; i++) {
+               if(cred->bv_val[i] == '\0') {
+                       return 1;       /* NUL character in password */
+               }
+       }
+
+       if( cred->bv_val[i] != '\0' ) {
+               return 1;       /* cred must behave like a string */
+       }
+
+       for( i=0; i<passwd->bv_len; i++) {
+               if(passwd->bv_val[i] == '\0') {
+                       return 1;       /* NUL character in password */
+               }
+       }
+
+       if( passwd->bv_val[i] != '\0' ) {
+               return 1;       /* passwd must behave like a string */
+       }
+
+       rtn = 1;
+
+#ifdef HAVE_CYRUS_SASL
+       if( lutil_passwd_sasl_conn != NULL ) {
+               const char *errstr = NULL;
+               int sc;
+
+               sc = sasl_checkpass( lutil_passwd_sasl_conn,
+                       passwd->bv_val, passwd->bv_len,
+                       cred->bv_val, cred->bv_len,
+                       &errstr );
+
+               rtn = ( sc != SASL_OK );
+       }
+#endif
+
+       return rtn;
+}
+#endif
+
 #ifdef SLAPD_KPASSWD
 static int chk_kerberos(
        const struct pw_scheme *sc,
@@ -728,31 +799,31 @@ static int chk_crypt(
        }
 
        if( cred->bv_val[i] != '\0' ) {
-               return 1;       /* cred must behave like a string */
+               return -1;      /* cred must behave like a string */
        }
 
        if( passwd->bv_len < 2 ) {
-               return 1;       /* passwd must be at least two characters long */
+               return -1;      /* passwd must be at least two characters long */
        }
 
        for( i=0; i<passwd->bv_len; i++) {
                if(passwd->bv_val[i] == '\0') {
-                       return 1;       /* NUL character in password */
+                       return -1;      /* NUL character in password */
                }
        }
 
        if( passwd->bv_val[i] != '\0' ) {
-               return 1;       /* passwd must behave like a string */
+               return -1;      /* passwd must behave like a string */
        }
 
        cr = crypt( cred->bv_val, passwd->bv_val );
 
        if( cr == NULL || cr[0] == '\0' ) {
                /* salt must have been invalid */
-               return 1;
+               return -1;
        }
 
-       return strcmp( passwd->bv_val, cr );
+       return strcmp( passwd->bv_val, cr ) ? 1 : 0;
 }
 
 # if defined( HAVE_GETSPNAM ) \
@@ -767,21 +838,21 @@ static int chk_unix(
 
        for( i=0; i<cred->bv_len; i++) {
                if(cred->bv_val[i] == '\0') {
-                       return 1;       /* NUL character in password */
+                       return -1;      /* NUL character in password */
                }
        }
        if( cred->bv_val[i] != '\0' ) {
-               return 1;       /* cred must behave like a string */
+               return -1;      /* cred must behave like a string */
        }
 
        for( i=0; i<passwd->bv_len; i++) {
                if(passwd->bv_val[i] == '\0') {
-                       return 1;       /* NUL character in password */
+                       return -1;      /* NUL character in password */
                }
        }
 
        if( passwd->bv_val[i] != '\0' ) {
-               return 1;       /* passwd must behave like a string */
+               return -1;      /* passwd must behave like a string */
        }
 
 #  ifdef HAVE_GETSPNAM
@@ -789,7 +860,7 @@ static int chk_unix(
                struct spwd *spwd = getspnam(passwd->bv_val);
 
                if(spwd == NULL) {
-                       return 1;       /* not found */
+                       return -1;      /* not found */
                }
 
                pw = spwd->sp_pwdp;
@@ -800,7 +871,7 @@ static int chk_unix(
                struct passwd *pwd = getpwnam(passwd->bv_val);
 
                if(pwd == NULL) {
-                       return 1;       /* not found */
+                       return -1;      /* not found */
                }
 
                pw = pwd->pw_passwd;
@@ -809,17 +880,17 @@ static int chk_unix(
 
        if( pw == NULL || pw[0] == '\0' || pw[1] == '\0' ) {
                /* password must must be at least two characters long */
-               return 1;
+               return -1;
        }
 
        cr = crypt(cred->bv_val, pw);
 
        if( cr == NULL || cr[0] == '\0' ) {
                /* salt must have been invalid */
-               return 1;
+               return -1;
        }
 
-       return strcmp(pw, cr);
+       return strcmp(pw, cr) ? 1 : 0;
 
 }
 # endif