More system schema checks

[openldap] / servers / slapd / bind.c

diff --git a/servers/slapd/bind.c b/servers/slapd/bind.c
index 737046be185b56e11158888abb70c8c273d2da55..072f812abd42ec2b1af6d990f91164a82048a774 100644 (file)
--- a/servers/slapd/bind.c
+++ b/servers/slapd/bind.c
@@ -1,7 +1,7 @@
 /* bind.c - decode an ldap bind operation and pass it to a backend db */
 /* $OpenLDAP$ */
 /*
- * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
+ * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
  */
 
@@ -92,7 +92,7 @@ do_bind(
         *      }
         */
 
-       tag = ber_scanf( ber, "{iot" /*}*/, &version, &dn, &method );
+       tag = ber_scanf( ber, "{imt" /*}*/, &version, &dn, &method );
 
        if ( tag == LBER_ERROR ) {
 #ifdef NEW_LOGGING
@@ -110,7 +110,7 @@ do_bind(
        op->o_protocol = version;
 
        if( method != LDAP_AUTH_SASL ) {
-               tag = ber_scanf( ber, /*{*/ "o}", &cred );
+               tag = ber_scanf( ber, /*{*/ "m}", &cred );
 
        } else {
                tag = ber_scanf( ber, "{a" /*}*/, &mech );
@@ -120,7 +120,7 @@ do_bind(
                        tag = ber_peek_tag( ber, &len );
 
                        if ( tag == LDAP_TAG_LDAPCRED ) { 
-                               tag = ber_scanf( ber, "o", &cred );
+                               tag = ber_scanf( ber, "m", &cred );
                        } else {
                                tag = LDAP_TAG_LDAPCRED;
                                cred.bv_val = NULL;
@@ -221,6 +221,15 @@ do_bind(
        conn->c_protocol = version;
        ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
 
+       /* check for inappropriate controls */
+       if( get_manageDSAit( op ) == SLAP_CRITICAL_CONTROL ) {
+               send_ldap_result( conn, op,
+                       rc = LDAP_UNAVAILABLE_CRITICAL_EXTENSION,
+                       NULL, "manageDSAit control inappropriate",
+                       NULL, NULL );
+               goto cleanup;
+       }
+
        if ( method == LDAP_AUTH_SASL ) {
                char *edn;
                slap_ssf_t ssf = 0;
@@ -240,7 +249,7 @@ do_bind(
                        goto cleanup;
                }
 
-               if( mech == NULL || *mech == '\0' ) {
+               if( mech == NULL || mech[0] == '\0' ) {
 #ifdef NEW_LOGGING
                        LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
                                   "do_bind: conn %d  no SASL mechanism provided\n",
@@ -440,13 +449,13 @@ do_bind(
 
        if ( (be = select_backend( &ndn, 0, 0 )) == NULL ) {
                if ( default_referral ) {
-                       struct berval **ref = referral_rewrite( default_referral,
+                       BVarray ref = referral_rewrite( default_referral,
                                NULL, &pdn, LDAP_SCOPE_DEFAULT );
 
                        send_ldap_result( conn, op, rc = LDAP_REFERRAL,
                                NULL, NULL, ref ? ref : default_referral, NULL );
 
-                       ber_bvecfree( ref );
+                       bvarray_free( ref );
 
                } else {
                        /* noSuchObject is not allowed to be returned by bind */
@@ -486,7 +495,7 @@ do_bind(
                        } else {
                                ber_dupbv( &conn->c_dn, &pdn );
                        }
-                       conn->c_cdn = pdn.bv_val;
+                       conn->c_cdn = pdn;
                        pdn.bv_val = NULL;
                        pdn.bv_len = 0;
 
@@ -503,11 +512,11 @@ do_bind(
 #ifdef NEW_LOGGING
                        LDAP_LOG(( "operation", LDAP_LEVEL_DETAIL1,
                                "do_bind: conn %d  v%d bind: \"%s\" to \"%s\" \n",
-                               conn->c_connid, version, conn->c_cdn, conn->c_dn.bv_val ));
+                               conn->c_connid, version, conn->c_cdn.bv_val, conn->c_dn.bv_val ));
 #else
                        Debug( LDAP_DEBUG_TRACE,
                                "do_bind: v%d bind: \"%s\" to \"%s\"\n",
-                               version, conn->c_cdn, conn->c_dn.bv_val );
+                               version, conn->c_cdn.bv_val, conn->c_dn.bv_val );
 #endif
 
                        ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
@@ -527,7 +536,6 @@ do_bind(
        }
 
 cleanup:
-       free( dn.bv_val );
        if( pdn.bv_val != NULL ) {
                free( pdn.bv_val );
        }
@@ -537,9 +545,6 @@ cleanup:
        if ( mech != NULL ) {
                free( mech );
        }
-       if ( cred.bv_val != NULL ) {
-               free( cred.bv_val );
-       }
 
        return rc;
 }