Fix ITS#1991 - referrals with sarch base == target (wasn't sure at first,

[openldap] / servers / slapd / bind.c

diff --git a/servers/slapd/bind.c b/servers/slapd/bind.c
index 15055120b4e5ca95d24336b916bfb50a5e83a81b..e4e8dd5e1891fd45e6b990c20c47d3530915b2a5 100644 (file)
--- a/servers/slapd/bind.c
+++ b/servers/slapd/bind.c
@@ -45,11 +45,10 @@ do_bind(
        int     rc = LDAP_SUCCESS;
        const char *text;
        struct berval cred = { 0, NULL };
-       Backend *be;
+       Backend *be = NULL;
 
 #ifdef NEW_LOGGING
-       LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY,
-               "do_bind: conn %d\n", conn->c_connid ));
+       LDAP_LOG( OPERATION, ENTRY, "do_bind: conn %d\n", conn->c_connid, 0, 0 );
 #else
        Debug( LDAP_DEBUG_TRACE, "do_bind\n", 0, 0, 0 );
 #endif
@@ -58,7 +57,9 @@ do_bind(
         * Force to connection to "anonymous" until bind succeeds.
         */
        ldap_pvt_thread_mutex_lock( &conn->c_mutex );
+       if ( conn->c_sasl_bind_in_progress ) be = conn->c_authz_backend;
        connection2anonymous( conn );
+       if ( conn->c_sasl_bind_in_progress ) conn->c_authz_backend = be;
        ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
 
        if ( op->o_dn.bv_val != NULL ) {
@@ -97,8 +98,8 @@ do_bind(
 
        if ( tag == LBER_ERROR ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                       "do_bind: conn %d  ber_scanf failed\n", conn->c_connid ));
+               LDAP_LOG( OPERATION, ERR, 
+                       "do_bind: conn %d  ber_scanf failed\n", conn->c_connid, 0, 0 );
 #else
                Debug( LDAP_DEBUG_ANY, "bind: ber_scanf failed\n", 0, 0, 0 );
 #endif
@@ -144,8 +145,8 @@ do_bind(
 
        if( (rc = get_ctrls( conn, op, 1 )) != LDAP_SUCCESS ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
-                       "do_bind: conn %d  get_ctrls failed\n", conn->c_connid ));
+               LDAP_LOG( OPERATION, INFO, 
+                       "do_bind: conn %d  get_ctrls failed\n", conn->c_connid, 0, 0 );
 #else
                Debug( LDAP_DEBUG_ANY, "do_bind: get_ctrls failed\n", 0, 0, 0 );
 #endif
@@ -155,9 +156,9 @@ do_bind(
        rc = dnPrettyNormal( NULL, &dn, &pdn, &ndn );
        if ( rc != LDAP_SUCCESS ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
-                       "do_bind: conn %d  invalid dn (%s)\n",
-                       conn->c_connid, dn.bv_val ));
+               LDAP_LOG( OPERATION, INFO, 
+                       "do_bind: conn %d  invalid dn (%s)\n", 
+                       conn->c_connid, dn.bv_val, 0 );
 #else
                Debug( LDAP_DEBUG_ANY, "bind: invalid dn (%s)\n",
                        dn.bv_val, 0, 0 );
@@ -169,9 +170,9 @@ do_bind(
 
        if( method == LDAP_AUTH_SASL ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation",  LDAP_LEVEL_DETAIL1,
-                       "do_sasl_bind: conn %d  dn (%s) mech %s\n", conn->c_connid,
-                       pdn.bv_val, mech.bv_val ));
+               LDAP_LOG( OPERATION,     DETAIL1, 
+                       "do_sasl_bind: conn %d  dn (%s) mech %s\n", 
+                       conn->c_connid, pdn.bv_val, mech.bv_val );
 #else
                Debug( LDAP_DEBUG_TRACE, "do_sasl_bind: dn (%s) mech %s\n",
                        pdn.bv_val, mech.bv_val, NULL );
@@ -179,10 +180,9 @@ do_bind(
 
        } else {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_DETAIL1,
-                       "do_bind: conn %d  version=%ld dn=\"%s\" method=%ld\n",
-                       conn->c_connid, (unsigned long) version,
-                       pdn.bv_val, (unsigned long)method ));
+               LDAP_LOG( OPERATION, DETAIL1, 
+                       "do_bind: version=%ld dn=\"%s\" method=%ld\n",
+                       (unsigned long) version, pdn.bv_val, (unsigned long)method );
 #else
                Debug( LDAP_DEBUG_TRACE,
                        "do_bind: version=%ld dn=\"%s\" method=%ld\n",
@@ -196,9 +196,9 @@ do_bind(
 
        if ( version < LDAP_VERSION_MIN || version > LDAP_VERSION_MAX ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
+               LDAP_LOG( OPERATION, INFO, 
                        "do_bind: conn %d  unknown version = %ld\n",
-                       conn->c_connid, (unsigned long)version ));
+                       conn->c_connid, (unsigned long)version, 0 );
 #else
                Debug( LDAP_DEBUG_ANY, "do_bind: unknown version=%ld\n",
                        (unsigned long) version, 0, 0 );
@@ -231,14 +231,17 @@ do_bind(
                goto cleanup;
        }
 
+       /* Set the bindop for the benefit of in-directory SASL lookups */
+       conn->c_sasl_bindop = op;
+
        if ( method == LDAP_AUTH_SASL ) {
                slap_ssf_t ssf = 0;
 
                if ( version < LDAP_VERSION3 ) {
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
+                       LDAP_LOG( OPERATION, INFO, 
                                "do_bind: conn %d  sasl with LDAPv%ld\n",
-                               conn->c_connid, (unsigned long)version ));
+                               conn->c_connid, (unsigned long)version , 0 );
 #else
                        Debug( LDAP_DEBUG_ANY, "do_bind: sasl with LDAPv%ld\n",
                                (unsigned long) version, 0, 0 );
@@ -251,9 +254,9 @@ do_bind(
 
                if( mech.bv_len == 0 ) {
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
+                       LDAP_LOG( OPERATION, INFO, 
                                   "do_bind: conn %d  no SASL mechanism provided\n",
-                                  conn->c_connid ));
+                                  conn->c_connid, 0, 0 );
 #else
                        Debug( LDAP_DEBUG_ANY,
                                "do_bind: no sasl mechanism provided\n",
@@ -312,6 +315,16 @@ do_bind(
                                        LBER_SB_OPT_SET_MAX_INCOMING, &max );
                        }
 
+#ifdef NEW_LOGGING
+                       LDAP_LOG( OPERATION, DETAIL1, 
+                               "do_bind: SASL/%s bind: dn=\"%s\" ssf=%d\n",
+                               conn->c_authmech.bv_val, conn->c_dn.bv_val, ssf );
+#else
+                       Debug( LDAP_DEBUG_TRACE,
+                               "do_bind: SASL/%s bind: dn=\"%s\" ssf=%d\n",
+                               conn->c_authmech.bv_val, conn->c_dn.bv_val, ssf );
+#endif
+
                } else if ( rc == LDAP_SASL_BIND_IN_PROGRESS ) {
                        conn->c_sasl_bind_in_progress = 1;
 
@@ -378,9 +391,9 @@ do_bind(
                        send_ldap_result( conn, op, rc,
                                NULL, text, NULL, NULL );
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "operation", LDAP_LEVEL_DETAIL1,
+                       LDAP_LOG( OPERATION, DETAIL1, 
                                   "do_bind: conn %d  v%d anonymous bind\n",
-                                  conn->c_connid, version ));
+                                  conn->c_connid, version , 0 );
 #else
                        Debug( LDAP_DEBUG_TRACE, "do_bind: v%d anonymous bind\n",
                                version, 0, 0 );
@@ -395,9 +408,9 @@ do_bind(
                        send_ldap_result( conn, op, rc,
                                NULL, text, NULL, NULL );
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
+                       LDAP_LOG( OPERATION, INFO, 
                                   "do_bind: conn %d  v%d simple bind(%s) disallowed\n",
-                                  conn->c_connid, version, ndn.bv_val ));
+                                  conn->c_connid, version, ndn.bv_val );
 #else
                        Debug( LDAP_DEBUG_TRACE,
                                "do_bind: v%d simple bind(%s) disallowed\n",
@@ -416,9 +429,9 @@ do_bind(
                                NULL, text, NULL, NULL );
 
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "operation", LDAP_LEVEL_INFO, "do_bind: conn %d  "
+                       LDAP_LOG( OPERATION, INFO, "do_bind: conn %d  "
                                "v%d unprotected simple bind(%s) disallowed\n",
-                               conn->c_connid, version, ndn.bv_val ));
+                               conn->c_connid, version, ndn.bv_val );
 #else
                        Debug( LDAP_DEBUG_TRACE,
                                "do_bind: v%d unprotected simple bind(%s) disallowed\n",
@@ -437,9 +450,9 @@ do_bind(
                        send_ldap_result( conn, op, rc,
                                NULL, text, NULL, NULL );
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "operation", LDAP_LEVEL_DETAIL1,
+                       LDAP_LOG( OPERATION, DETAIL1, 
                                   "do_bind: conn %d  v%d Kerberos V4 bind\n",
-                                  conn->c_connid, version ));
+                                  conn->c_connid, version , 0 );
 #else
                        Debug( LDAP_DEBUG_TRACE, "do_bind: v%d Kerberos V4 bind\n",
                                version, 0, 0 );
@@ -455,9 +468,9 @@ do_bind(
                send_ldap_result( conn, op, rc,
                        NULL, text, NULL, NULL );
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
+               LDAP_LOG( OPERATION, INFO, 
                           "do_bind: conn %ld  v%d unknown authentication method (%ld)\n",
-                          conn->c_connid, version, method ));
+                          conn->c_connid, version, method );
 #else
                Debug( LDAP_DEBUG_TRACE,
                        "do_bind: v%d unknown authentication method (%ld)\n",
@@ -534,9 +547,9 @@ do_bind(
                        }
 
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "operation", LDAP_LEVEL_DETAIL1,
-                               "do_bind: conn %d  v%d bind: \"%s\" to \"%s\" \n",
-                               conn->c_connid, version, dn.bv_val, conn->c_dn.bv_val ));
+                       LDAP_LOG( OPERATION, DETAIL1, 
+                               "do_bind: v%d bind: \"%s\" to \"%s\" \n",
+                               version, conn->c_dn.bv_val, conn->c_dn.bv_val );
 #else
                        Debug( LDAP_DEBUG_TRACE,
                                "do_bind: v%d bind: \"%s\" to \"%s\"\n",
@@ -560,6 +573,8 @@ do_bind(
        }
 
 cleanup:
+       conn->c_sasl_bindop = NULL;
+
        if( pdn.bv_val != NULL ) {
                free( pdn.bv_val );
        }