Do not return pointers into BerElement we do not own

[openldap] / servers / slapd / back-meta / bind.c

diff --git a/servers/slapd/back-meta/bind.c b/servers/slapd/back-meta/bind.c
index 8735d3e0946d836bcfdc21edc2d7d4c95f3d0a53..4c1c9bec780612946b88de6645b3c491996cf71a 100644 (file)
--- a/servers/slapd/back-meta/bind.c
+++ b/servers/slapd/back-meta/bind.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
+ * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
  *
  * Copyright 2001, Pierangelo Masarati, All rights reserved. <ando@sys-net.it>
@@ -77,6 +77,20 @@
 #include "../back-ldap/back-ldap.h"
 #include "back-meta.h"
 
+static LDAP_REBIND_PROC        meta_back_rebind;
+
+static int
+meta_back_do_single_bind(
+               struct metainfo         *li,
+               struct metaconn         *lc,
+               Operation               *op,
+               struct berval           *dn,
+               struct berval           *ndn,
+               struct berval           *cred,
+               int                     method,
+               int                     candidate
+);
+
 int
 meta_back_bind(
                Backend         *be,
@@ -177,7 +191,7 @@ meta_back_bind(
                        realmethod = method;
                }
                
-               lerr = meta_back_do_single_bind( li, lc,
+               lerr = meta_back_do_single_bind( li, lc, op,
                                realdn, realndn, realcred, realmethod, i );
                if ( lerr != LDAP_SUCCESS ) {
                        err = lerr;
@@ -223,10 +237,11 @@ meta_back_bind(
  *
  * attempts to perform a bind with creds
  */
-int
+static int
 meta_back_do_single_bind(
                struct metainfo         *li,
                struct metaconn         *lc,
+               Operation               *op,
                struct berval           *dn,
                struct berval           *ndn,
                struct berval           *cred,
@@ -234,8 +249,9 @@ meta_back_do_single_bind(
                int                     candidate
 )
 {
-       struct berval mdn = { 0, NULL };
-       int rc;
+       struct berval   mdn = { 0, NULL };
+       int             rc;
+       ber_int_t       msgid;
        
        /*
         * Rewrite the bind dn if needed
@@ -263,7 +279,17 @@ meta_back_do_single_bind(
                return LDAP_OTHER;
        }
 
-       rc = ldap_bind_s( lc->conns[ candidate ].ld, mdn.bv_val, cred->bv_val, method );
+       if ( op->o_ctrls ) {
+               rc = ldap_set_option( lc->conns[ candidate ].ld, 
+                               LDAP_OPT_SERVER_CONTROLS, op->o_ctrls );
+               if ( rc != LDAP_SUCCESS ) {
+                       rc = ldap_back_map_result( rc );
+                       goto return_results;
+               }
+       }
+       
+       rc = ldap_sasl_bind(lc->conns[ candidate ].ld, mdn.bv_val,
+                       LDAP_SASL_SIMPLE, cred, op->o_ctrls, NULL, &msgid);
        if ( rc != LDAP_SUCCESS ) {
                rc = ldap_back_map_result( rc );
        } else {
@@ -271,12 +297,23 @@ meta_back_do_single_bind(
                lc->conns[ candidate ].bound = META_BOUND;
                lc->bound_target = candidate;
 
+               if ( li->savecred ) {
+                       if ( lc->conns[ candidate ].cred.bv_val )
+                               ch_free( lc->conns[ candidate ].cred.bv_val );
+                       ber_dupbv( &lc->conns[ candidate ].cred, cred );
+                       ldap_set_rebind_proc( lc->conns[ candidate ].ld, 
+                                       meta_back_rebind, 
+                                       &lc->conns[ candidate ] );
+               }
+
                if ( li->cache.ttl != META_DNCACHE_DISABLED
                                && ndn->bv_len != 0 ) {
                        ( void )meta_dncache_update_entry( &li->cache,
                                        ndn, candidate );
                }
        }
+
+return_results:;
        
        if ( mdn.bv_val != dn->bv_val ) {
                free( mdn.bv_val );
@@ -311,6 +348,17 @@ meta_back_dobind( struct metaconn *lc, Operation *op )
                        continue;
                }
 
+               /*
+                * If required, set controls
+                */
+               if ( op->o_ctrls ) {
+                       if ( ldap_set_option( lsc->ld, LDAP_OPT_SERVER_CONTROLS,
+                                       op->o_ctrls ) != LDAP_SUCCESS ) {
+                               ( void )meta_clear_one_candidate( lsc, 1 );
+                               continue;
+                       }
+               }
+       
                /*
                 * If the target is already bound it is skipped
                 */
@@ -329,23 +377,23 @@ meta_back_dobind( struct metaconn *lc, Operation *op )
                        lsc->bound_dn.bv_val = NULL;
                        lsc->bound_dn.bv_len = 0;
                }
+               
+
                rc = ldap_bind_s( lsc->ld, 0, NULL, LDAP_AUTH_SIMPLE );
                if ( rc != LDAP_SUCCESS ) {
                        
 #ifdef NEW_LOGGING
                        LDAP_LOG( BACK_META, WARNING,
                                        "meta_back_dobind: (anonymous)"
-                                       " bind as \"%s\" failed"
-                                       " with error \"%s\"\n",
-                                       lsc->bound_dn.bv_val,
-                                       ldap_err2string( rc ), 0 );
+                                       " bind failed"
+                                       " with error %d (%s)\n",
+                                       rc, ldap_err2string( rc ), 0 );
 #else /* !NEW_LOGGING */
                        Debug( LDAP_DEBUG_ANY,
                                        "==>meta_back_dobind: (anonymous)"
-                                       " bind as \"%s\" failed"
-                                       " with error \"%s\"\n%s",
-                                       lsc->bound_dn.bv_val,
-                                       ldap_err2string( rc ), "" );
+                                       " bind failed"
+                                       " with error %d (%s)\n",
+                                       rc, ldap_err2string( rc ), 0 );
 #endif /* !NEW_LOGGING */
 
                        /*
@@ -391,6 +439,22 @@ meta_back_is_valid( struct metaconn *lc, int candidate )
        return 0;
 }
 
+/*
+ * meta_back_rebind
+ *
+ * This is a callback used for chasing referrals using the same
+ * credentials as the original user on this session.
+ */
+static int 
+meta_back_rebind( LDAP *ld, LDAP_CONST char *url, ber_tag_t request,
+       ber_int_t msgid, void *params )
+{
+       struct metasingleconn *lc = params;
+
+       return ldap_bind_s( ld, lc->bound_dn.bv_val, lc->cred.bv_val,
+                       LDAP_AUTH_SIMPLE );
+}
+
 /*
  * FIXME: error return must be handled in a cleaner way ...
  */