ITS#6242

[openldap] / servers / slapd / sasl.c

diff --git a/servers/slapd/sasl.c b/servers/slapd/sasl.c
index f794a99f8790b04eaeab111621e110cb308ec7b6..e12a82946fad2fbc7ae0c9caa64b128f95ea5692 100644 (file)
--- a/servers/slapd/sasl.c
+++ b/servers/slapd/sasl.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2008 The OpenLDAP Foundation.
+ * Copyright 1998-2009 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -63,8 +63,29 @@ typedef struct sasl_ctx {
 
 static struct berval ext_bv = BER_BVC( "EXTERNAL" );
 
+char *slap_sasl_auxprops;
+
 #ifdef HAVE_CYRUS_SASL
 
+/* Just use our internal auxprop by default */
+static int
+slap_sasl_getopt(
+       void *context,
+       const char *plugin_name,
+       const char *option,
+       const char **result,
+       unsigned *len)
+{
+       if ( strcmp( option, "auxprop_plugin" )) {
+               return SASL_FAIL;
+       }
+       if ( slap_sasl_auxprops )
+               *result = slap_sasl_auxprops;
+       else
+               *result = "slapd";
+       return SASL_OK;
+}
+
 int
 slap_sasl_log(
        void *context,
@@ -117,7 +138,7 @@ slap_sasl_log(
        }
 
        Debug( level, "SASL [conn=%ld] %s: %s\n",
-               conn ? conn->c_connid: -1,
+               conn ? (long) conn->c_connid: -1L,
                label, message );
 
 
@@ -216,7 +237,8 @@ sasl_ap_lookup( Operation *op, SlapReply *rs )
                                         * past the scheme name, skip this value.
                                         */
 #ifdef SLAPD_CLEARTEXT
-                                       if ( !ber_bvstrcasecmp( bv, &sc_cleartext ) ) {
+                                       if ( !strncasecmp( bv->bv_val, sc_cleartext.bv_val,
+                                               sc_cleartext.bv_len )) {
                                                struct berval cbv;
                                                cbv.bv_len = bv->bv_len - sc_cleartext.bv_len;
                                                if ( cbv.bv_len > 0 ) {
@@ -396,7 +418,8 @@ slap_auxprop_store(
        Operation op = {0};
        Opheader oph;
        SlapReply rs = {REP_RESULT};
-       int rc, i, j;
+       int rc, i;
+       unsigned j;
        Connection *conn = NULL;
        const struct propval *pr;
        Modifications *modlist = NULL, **modtail = &modlist, *mod;
@@ -553,7 +576,7 @@ slap_sasl_canonicalize(
        *out_len = 0;
 
        Debug( LDAP_DEBUG_ARGS, "SASL Canonicalize [conn=%ld]: %s=\"%s\"\n",
-               conn ? conn->c_connid : -1,
+               conn ? (long) conn->c_connid : -1L,
                (flags & SASL_CU_AUTHID) ? "authcid" : "authzid",
                in ? in : "<empty>");
 
@@ -635,7 +658,7 @@ slap_sasl_canonicalize(
        prop_set( props, names[0], dn.bv_val, dn.bv_len );
 
        Debug( LDAP_DEBUG_ARGS, "SASL Canonicalize [conn=%ld]: %s=\"%s\"\n",
-               conn ? conn->c_connid : -1, names[0]+1,
+               conn ? (long) conn->c_connid : -1L, names[0]+1,
                dn.bv_val ? dn.bv_val : "<EMPTY>" );
 
        /* Not needed any more, SASL has copied it */
@@ -678,7 +701,7 @@ slap_sasl_authorize(
 
        Debug( LDAP_DEBUG_ARGS, "SASL proxy authorize [conn=%ld]: "
                "authcid=\"%s\" authzid=\"%s\"\n",
-               conn ? conn->c_connid : -1, auth_identity, requested_user );
+               conn ? (long) conn->c_connid : -1L, auth_identity, requested_user );
        if ( conn->c_sasl_dn.bv_val ) {
                BER_BVZERO( &conn->c_sasl_dn );
        }
@@ -708,7 +731,7 @@ slap_sasl_authorize(
        if ( rc != LDAP_SUCCESS ) {
                Debug( LDAP_DEBUG_TRACE, "SASL Proxy Authorize [conn=%ld]: "
                        "proxy authorization disallowed (%d)\n",
-                       (long) (conn ? conn->c_connid : -1), rc, 0 );
+                       conn ? (long) conn->c_connid : -1L, rc, 0 );
 
                sasl_seterror( sconn, 0, "not authorized" );
                return SASL_NOAUTHZ;
@@ -728,7 +751,7 @@ ok:
 
        Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
                " proxy authorization allowed authzDN=\"%s\"\n",
-               (long) (conn ? conn->c_connid : -1), 
+               conn ? (long) conn->c_connid : -1L, 
                authzDN.bv_val ? authzDN.bv_val : "", 0 );
        return SASL_OK;
 } 
@@ -1043,7 +1066,7 @@ slapd_rw_apply( void *private, const char *filter, struct berval *val )
                }
                rc = REWRITE_ERR;
        }
-       filter_free_x( op, op->ors_filter );
+       filter_free_x( op, op->ors_filter, 1 );
        op->o_tmpfree( op->ors_filterstr.bv_val, op->o_tmpmemctx );
        return rc;
 }
@@ -1076,6 +1099,7 @@ int slap_sasl_init( void )
        int rc;
        static sasl_callback_t server_callbacks[] = {
                { SASL_CB_LOG, &slap_sasl_log, NULL },
+               { SASL_CB_GETOPT, &slap_sasl_getopt, NULL },
                { SASL_CB_LIST_END, NULL, NULL }
        };
 #endif
@@ -1516,7 +1540,7 @@ int slap_sasl_bind( Operation *op, SlapReply *rs )
                }
 
                /* Must send response using old security layer */
-               if (response.bv_len) rs->sr_sasldata = &response;
+               rs->sr_sasldata = (response.bv_len ? &response : NULL);
                send_ldap_sasl( op, rs );
                
                /* Now dispose of the old security layer.