Per ITS#419, don't require SLAPD_RLOOKUPS when HAVE_TCPD

[openldap] / servers / slapd / passwd.c

diff --git a/servers/slapd/passwd.c b/servers/slapd/passwd.c
index 875bdf6fd0ac6454308234fb2d7d5ec5c061af9d..124d674dbbd3c0e9830a54b33044027e8f3801d7 100644 (file)
--- a/servers/slapd/passwd.c
+++ b/servers/slapd/passwd.c
@@ -20,30 +20,43 @@
 
 int passwd_extop(
        SLAP_EXTOP_CALLBACK_FN ext_callback,
-       Connection *conn, Operation *op, char *oid,
-       struct berval *reqdata, struct berval **rspdata, char **text )
+       Connection *conn, Operation *op,
+       char *reqoid,
+       struct berval *reqdata,
+       char **rspoid,
+       struct berval **rspdata,
+       LDAPControl ***rspctrls,
+       char **text,
+       struct berval ***refs )
 {
        int rc;
 
-       assert( oid != NULL );
-       assert( strcmp( LDAP_EXOP_X_MODIFY_PASSWD, oid ) == 0 );
+       assert( reqoid != NULL );
+       assert( strcmp( LDAP_EXOP_X_MODIFY_PASSWD, reqoid ) == 0 );
 
        if( op->o_dn == NULL || op->o_dn[0] == '\0' ) {
                *text = ch_strdup("only authenicated users may change passwords");
                return LDAP_STRONG_AUTH_REQUIRED;
        }
 
-       if( reqdata == NULL || reqdata->bv_len == 0 ) {
-               *text = ch_strdup("request data missing");
-               return LDAP_PROTOCOL_ERROR;
-       }
-
-       if( conn->c_authz_backend != NULL &&
-               conn->c_authz_backend->be_extended )
+       if( conn->c_authz_backend != NULL && conn->c_authz_backend->be_extended )
        {
-               rc = conn->c_authz_backend->be_extended(
-                       conn->c_authz_backend,
-                       conn, op, oid, reqdata, rspdata, text );
+               if( global_readonly || conn->c_authz_backend->be_readonly ) {
+                       *text = ch_strdup("authorization database is read only");
+                       rc = LDAP_UNWILLING_TO_PERFORM;
+
+               } else if( conn->c_authz_backend->be_update_ndn != NULL ) {
+                       /* we SHOULD return a referral in this case */
+                       *refs = conn->c_authz_backend->be_update_refs;
+                       rc = LDAP_REFERRAL;
+
+               } else {
+                       rc = conn->c_authz_backend->be_extended(
+                               conn->c_authz_backend, conn, op,
+                               reqoid, reqdata,
+                               rspoid, rspdata, rspctrls,
+                               text, refs );
+               }
 
        } else {
                *text = ch_strdup("operation not supported for current user");
@@ -64,7 +77,9 @@ int slap_passwd_parse( struct berval *reqdata,
        ber_len_t len;
        BerElement *ber;
 
-       assert( reqdata != NULL );
+       if( reqdata == NULL ) {
+               return LDAP_SUCCESS;
+       }
 
        ber = ber_init( reqdata );
 
@@ -75,14 +90,12 @@ int slap_passwd_parse( struct berval *reqdata,
                return LDAP_PROTOCOL_ERROR;
        }
 
-       tag = ber_scanf(ber, "{" /*}*/);
+       tag = ber_scanf( ber, "{" /*}*/ );
 
-       if( tag == LBER_ERROR ) {
-               goto decoding_error;
+       if( tag != LBER_ERROR ) {
+               tag = ber_peek_tag( ber, &len );
        }
 
-       tag = ber_peek_tag( ber, &len );
-
        if( tag == LDAP_TAG_EXOP_X_MODIFY_PASSWD_ID ) {
                if( id == NULL ) {
                        Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID not allowed.\n",
@@ -175,6 +188,35 @@ done:
        return rc;
 }
 
+struct berval * slap_passwd_return(
+       struct berval           *cred )
+{
+       int rc;
+       struct berval *bv;
+       BerElement *ber = ber_alloc_t(LBER_USE_DER);
+
+       assert( cred != NULL );
+
+       Debug( LDAP_DEBUG_TRACE, "slap_passwd_return: %ld\n",
+               (long) cred->bv_len, 0, 0 );
+
+       if( ber == NULL ) return NULL;
+       
+       rc = ber_printf( ber, "{tO}",
+               LDAP_TAG_EXOP_X_MODIFY_PASSWD_GEN, cred );
+
+       if( rc == -1 ) {
+               ber_free( ber, 1 );
+               return NULL;
+       }
+
+       (void) ber_flatten( ber, &bv );
+
+       ber_free( ber, 1 );
+
+       return bv;
+}
+
 int
 slap_passwd_check(
        Attribute *a,
@@ -200,7 +242,18 @@ slap_passwd_check(
        return( 1 );
 }
 
-struct berval * slap_passwd_generate(
+struct berval * slap_passwd_generate( void )
+{
+       Debug( LDAP_DEBUG_TRACE, "slap_passwd_generate\n", 0, 0, 0 );
+
+       /*
+        * generate passwords of only 8 characters as some getpass(3)
+        * implementations truncate at 8 characters.
+        */
+       return lutil_passwd_generate( 8 );
+}
+
+struct berval * slap_passwd_hash(
        struct berval * cred )
 {
        char* hash = default_passwd_hash ? default_passwd_hash : "{SSHA}";
@@ -211,7 +264,7 @@ struct berval * slap_passwd_generate(
        ldap_pvt_thread_mutex_lock( &crypt_mutex );
 #endif
 
-       new = lutil_passwd_generate( cred , hash );
+       new = lutil_passwd_hash( cred , hash );
        
 #ifdef SLAPD_CRYPT
        ldap_pvt_thread_mutex_unlock( &crypt_mutex );