/* $OpenLDAP$ */
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
*
- * Copyright 1998-2004 The OpenLDAP Foundation.
+ * Copyright 1998-2005 The OpenLDAP Foundation.
* Portions Copyright 2000 Mark Adamson, Carnegie Mellon.
* All rights reserved.
*
#include "portable.h"
#include <stdio.h>
+#ifdef HAVE_LIMITS_H
+#include <limits.h>
+#endif
#include <ac/stdlib.h>
#include <ac/string.h>
#include "slap.h"
-#include <limits.h>
-
-#include <ldap_pvt.h>
#include "lutil.h"
#define SASLREGEX_REPLACE 10
#define SASL_AUTHZ_TO 0x02
#define SASL_AUTHZ_AND 0x10
+static const char *policy_txt[] = {
+ "none", "from", "to", "any"
+};
+
static int authz_policy = SASL_AUTHZ_NONE;
static
return rc;
}
+const char * slap_sasl_getpolicy()
+{
+ if ( authz_policy == (SASL_AUTHZ_FROM | SASL_AUTHZ_TO | SASL_AUTHZ_AND) )
+ return "all";
+ else
+ return policy_txt[authz_policy];
+}
+
int slap_parse_user( struct berval *id, struct berval *user,
struct berval *realm, struct berval *mech )
{
*scope = -1;
*filter = NULL;
-#ifdef NEW_LOGGING
- LDAP_LOG( TRANSPORT, ENTRY,
- "slap_parseURI: parsing %s\n", uri->bv_val, 0, 0 );
-#else
Debug( LDAP_DEBUG_TRACE,
"slap_parseURI: parsing %s\n", uri->bv_val, 0, 0 );
-#endif
rc = LDAP_PROTOCOL_ERROR;
/*
* <filter> must pass str2filter()
*/
rc = ldap_url_parse( uri->bv_val, &ludp );
- if ( rc == LDAP_URL_ERR_BADSCHEME ) {
+ switch ( rc ) {
+ case LDAP_URL_SUCCESS:
+ /* FIXME: the check is pedantic, but I think it's necessary,
+ * because people tend to use things like ldaps:// which
+ * gives the idea SSL is being used. Maybe we could
+ * accept ldapi:// as well, but the point is that we use
+ * an URL as an easy means to define bits of a search with
+ * little parsing.
+ */
+ if ( strcasecmp( ludp->lud_scheme, "ldap" ) != 0 ) {
+ /*
+ * must be ldap:///
+ */
+ return LDAP_PROTOCOL_ERROR;
+ }
+ break;
+
+ case LDAP_URL_ERR_BADSCHEME:
/*
* last chance: assume it's a(n exact) DN ...
*
bv.bv_val = uri->bv_val;
*scope = LDAP_X_SCOPE_EXACT;
goto is_dn;
- }
- if ( rc != LDAP_URL_SUCCESS ) {
+ default:
return LDAP_PROTOCOL_ERROR;
}
- if (( ludp->lud_host && *ludp->lud_host )
+ if ( ( ludp->lud_host && *ludp->lud_host )
|| ludp->lud_attrs || ludp->lud_exts )
{
/* host part must be empty */
}
if ( *c == '$' ) {
if ( n == SASLREGEX_REPLACE ) {
-#ifdef NEW_LOGGING
- LDAP_LOG( TRANSPORT, ERR,
- "slap_sasl_rx_off: \"%s\" has too many $n "
- "placeholders (max %d)\n", rep, SASLREGEX_REPLACE, 0 );
-#else
Debug( LDAP_DEBUG_ANY,
"SASL replace pattern %s has too many $n "
"placeholders (max %d)\n",
rep, SASLREGEX_REPLACE, 0 );
-#endif
return( LDAP_OTHER );
}
int slap_sasl_regexp_config( const char *match, const char *replace )
{
-#ifdef SLAP_AUTH_REWRITE
- return slap_sasl_regexp_rewrite_config( "sasl-regexp", 0,
- match, replace, AUTHID_CONTEXT );
-#else /* ! SLAP_AUTH_REWRITE */
int rc;
SaslRegexp_t *reg;
reg->sr_match = ch_strdup( match );
reg->sr_replace = ch_strdup( replace );
+#ifdef SLAP_AUTH_REWRITE
+ rc = slap_sasl_regexp_rewrite_config( "sasl-regexp", 0,
+ match, replace, AUTHID_CONTEXT );
+ if ( rc == LDAP_SUCCESS ) nSaslRegexp++;
+ return rc;
+#else /* ! SLAP_AUTH_REWRITE */
+
/* Precompile matching pattern */
rc = regcomp( ®->sr_workspace, reg->sr_match, REG_EXTENDED|REG_ICASE );
if ( rc ) {
-#ifdef NEW_LOGGING
- LDAP_LOG( TRANSPORT, ERR,
- "slap_sasl_regexp_config: \"%s\" could not be compiled.\n",
- reg->sr_match, 0, 0 );
-#else
Debug( LDAP_DEBUG_ANY,
"SASL match pattern %s could not be compiled by regexp engine\n",
reg->sr_match, 0, 0 );
-#endif
return( LDAP_OTHER );
}
#endif /* ! SLAP_AUTH_REWRITE */
}
+void slap_sasl_regexp_unparse( BerVarray *out )
+{
+ int i;
+ struct berval bv;
+ BerVarray bva = NULL;
+ char ibuf[32], *ptr;
+ struct berval idx;
+
+ if ( !nSaslRegexp ) return;
+
+ idx.bv_val = ibuf;
+ bva = ch_malloc( (nSaslRegexp+1) * sizeof(struct berval) );
+ BER_BVZERO(bva+nSaslRegexp);
+ for ( i=0; i<nSaslRegexp; i++ ) {
+ idx.bv_len = sprintf( idx.bv_val, "{%d}", i);
+ bva[i].bv_len = idx.bv_len + strlen( SaslRegexp[i].sr_match ) +
+ strlen( SaslRegexp[i].sr_replace ) + 5;
+ bva[i].bv_val = ch_malloc( bva[i].bv_len+1 );
+ ptr = lutil_strcopy( bva[i].bv_val, ibuf );
+ *ptr++ = '"';
+ ptr = lutil_strcopy( ptr, SaslRegexp[i].sr_match );
+ ptr = lutil_strcopy( ptr, "\" \"" );
+ ptr = lutil_strcopy( ptr, SaslRegexp[i].sr_replace );
+ *ptr++ = '"';
+ *ptr = '\0';
+ }
+ *out = bva;
+}
+
/* Perform replacement on regexp matches */
static void slap_sasl_rx_exp(
const char *rep,
if ( !BER_BVISNULL( out ) ) {
char *val = out->bv_val;
ber_str2bv_x( val, 0, 1, out, ctx );
- free( val );
+ if ( val != in->bv_val ) {
+ free( val );
+ }
} else {
ber_dupbv_x( out, in, ctx );
}
-#ifdef NEW_LOGGING
- LDAP_LOG( BACK_LDAP, DETAIL1,
- "[rw] %s: \"%s\" -> \"%s\"\n",
- context, in->bv_val, out->bv_val );
-#else /* !NEW_LOGGING */
Debug( LDAP_DEBUG_ARGS,
"[rw] %s: \"%s\" -> \"%s\"\n",
context, in->bv_val, out->bv_val );
-#endif /* !NEW_LOGGING */
return 1;
case REWRITE_REGEXEC_UNWILLING:
memset( out, 0, sizeof( *out ) );
-#ifdef NEW_LOGGING
- LDAP_LOG( TRANSPORT, ENTRY,
- "slap_authz_regexp: converting SASL name %s\n", saslname, 0, 0 );
-#else
Debug( LDAP_DEBUG_TRACE, "slap_authz_regexp: converting SASL name %s\n",
saslname, 0, 0 );
-#endif
if (( saslname == NULL ) || ( nSaslRegexp == 0 )) {
return( 0 );
slap_sasl_rx_exp( reg->sr_replace, reg->sr_offset,
sr_strings, saslname, out, ctx );
-#ifdef NEW_LOGGING
- LDAP_LOG( TRANSPORT, ENTRY,
- "slap_authz_regexp: converted SASL name to %s\n",
- BER_BVISEMPTY( out ) ? "" : out->bv_val, 0, 0 );
-#else
Debug( LDAP_DEBUG_TRACE,
"slap_authz_regexp: converted SASL name to %s\n",
BER_BVISEMPTY( out ) ? "" : out->bv_val, 0, 0 );
-#endif
return( 1 );
#endif /* ! SLAP_AUTH_REWRITE */
o->o_tmpfree(ndn->bv_val, o->o_tmpmemctx);
BER_BVZERO( ndn );
-#ifdef NEW_LOGGING
- LDAP_LOG( TRANSPORT, DETAIL1,
- "slap_sc_sasl2dn: search DN returned more than 1 entry\n", 0, 0, 0 );
-#else
Debug( LDAP_DEBUG_TRACE,
"slap_sc_sasl2dn: search DN returned more than 1 entry\n", 0, 0, 0 );
-#endif
return -1;
}
slap_callback cb = { NULL, sasl_sc_smatch, NULL, NULL };
Operation op = {0};
SlapReply rs = {REP_RESULT};
+ struct berval base = BER_BVNULL;
sm.dn = assertDN;
sm.match = 0;
cb.sc_private = &sm;
-#ifdef NEW_LOGGING
- LDAP_LOG( TRANSPORT, ENTRY,
- "slap_sasl_match: comparing DN %s to rule %s\n",
- assertDN->bv_val, rule->bv_val,0 );
-#else
Debug( LDAP_DEBUG_TRACE,
"===>slap_sasl_match: comparing DN %s to rule %s\n",
assertDN->bv_val, rule->bv_val, 0 );
-#endif
- rc = slap_parseURI( opx, rule, &op.o_req_dn,
+ rc = slap_parseURI( opx, rule, &base,
&op.o_req_ndn, &op.ors_scope, &op.ors_filter,
&op.ors_filterstr );
if( rc != LDAP_SUCCESS ) goto CONCLUDED;
goto CONCLUDED;
}
-#ifdef NEW_LOGGING
- LDAP_LOG( TRANSPORT, DETAIL1,
- "slap_sasl_match: performing internal search (base=%s, scope=%d)\n",
- op.o_req_ndn.bv_val, op.ors_scope, 0 );
-#else
Debug( LDAP_DEBUG_TRACE,
"slap_sasl_match: performing internal search (base=%s, scope=%d)\n",
op.o_req_ndn.bv_val, op.ors_scope, 0 );
-#endif
op.o_bd = select_backend( &op.o_req_ndn, 0, 1 );
if(( op.o_bd == NULL ) || ( op.o_bd->be_search == NULL)) {
goto CONCLUDED;
}
+ op.o_hdr = opx->o_hdr;
op.o_tag = LDAP_REQ_SEARCH;
- op.o_protocol = LDAP_VERSION3;
op.o_ndn = *authc;
op.o_callback = &cb;
op.o_time = slap_get_time();
op.o_do_not_cache = 1;
op.o_is_auth_check = 1;
- op.o_threadctx = opx->o_threadctx;
- op.o_tmpmemctx = opx->o_tmpmemctx;
- op.o_tmpmfuncs = opx->o_tmpmfuncs;
-#ifdef LDAP_SLAPI
- op.o_pb = opx->o_pb;
-#endif
- op.o_conn = opx->o_conn;
- op.o_connid = opx->o_connid;
/* use req_ndn as req_dn instead of non-pretty base of uri */
- if( !BER_BVISNULL( &op.o_req_dn ) ) ch_free( op.o_req_dn.bv_val );
+ if( !BER_BVISNULL( &base ) ) {
+ ch_free( base.bv_val );
+ /* just in case... */
+ BER_BVZERO( &base );
+ }
ber_dupbv_x( &op.o_req_dn, &op.o_req_ndn, op.o_tmpmemctx );
+ op.ors_deref = LDAP_DEREF_NEVER;
op.ors_slimit = 1;
op.ors_tlimit = SLAP_NO_LIMIT;
op.ors_attrs = slap_anlist_no_attrs;
op.ors_attrsonly = 1;
- op.o_sync_slog_size = -1;
op.o_bd->be_search( &op, &rs );
if( op.ors_filter ) filter_free_x( opx, op.ors_filter );
if( !BER_BVISNULL( &op.ors_filterstr ) ) ch_free( op.ors_filterstr.bv_val );
-#ifdef NEW_LOGGING
- LDAP_LOG( TRANSPORT, ENTRY,
- "slap_sasl_match: comparison returned %d\n", rc, 0, 0 );
-#else
Debug( LDAP_DEBUG_TRACE,
"<===slap_sasl_match: comparison returned %d\n", rc, 0, 0);
-#endif
return( rc );
}
int i, rc;
BerVarray vals = NULL;
-#ifdef NEW_LOGGING
- LDAP_LOG( TRANSPORT, ENTRY,
- "slap_sasl_check_authz: does %s match %s rule in %s?\n",
- assertDN->bv_val, ad->ad_cname.bv_val, searchDN->bv_val);
-#else
Debug( LDAP_DEBUG_TRACE,
"==>slap_sasl_check_authz: does %s match %s rule in %s?\n",
assertDN->bv_val, ad->ad_cname.bv_val, searchDN->bv_val);
-#endif
- rc = backend_attribute( op, NULL, searchDN, ad, &vals );
+ rc = backend_attribute( op, NULL, searchDN, ad, &vals, ACL_AUTH );
if( rc != LDAP_SUCCESS ) goto COMPLETE;
/* Check if the *assertDN matches any *vals */
COMPLETE:
if( vals ) ber_bvarray_free_x( vals, op->o_tmpmemctx );
-#ifdef NEW_LOGGING
- LDAP_LOG( TRANSPORT, RESULTS,
- "slap_sasl_check_authz: %s check returning %d\n",
- ad->ad_cname.bv_val, rc, 0 );
-#else
Debug( LDAP_DEBUG_TRACE,
"<==slap_sasl_check_authz: %s check returning %d\n",
ad->ad_cname.bv_val, rc, 0);
-#endif
return( rc );
}
Operation op = {0};
SlapReply rs = {REP_RESULT};
struct berval regout = BER_BVNULL;
+ struct berval base = BER_BVNULL;
-#ifdef NEW_LOGGING
- LDAP_LOG( TRANSPORT, ENTRY,
- "slap_sasl2dn: converting SASL name %s to DN.\n",
- saslname->bv_val, 0, 0 );
-#else
Debug( LDAP_DEBUG_TRACE, "==>slap_sasl2dn: "
"converting SASL name %s to a DN\n",
saslname->bv_val, 0,0 );
-#endif
- sasldn->bv_val = NULL;
- sasldn->bv_len = 0;
+ BER_BVZERO( sasldn );
cb.sc_private = sasldn;
/* Convert the SASL name into a minimal URI */
goto FINISHED;
}
- rc = slap_parseURI( opx, ®out, &op.o_req_dn,
+ rc = slap_parseURI( opx, ®out, &base,
&op.o_req_ndn, &op.ors_scope, &op.ors_filter,
&op.ors_filterstr );
if ( !BER_BVISNULL( ®out ) ) slap_sl_free( regout.bv_val, opx->o_tmpmemctx );
assert( 0 );
}
-#ifdef NEW_LOGGING
- LDAP_LOG( TRANSPORT, DETAIL1,
- "slap_sasl2dn: performing internal search (base=%s, scope=%d)\n",
- op.o_req_ndn.bv_val, op.ors_scope, 0 );
-#else
Debug( LDAP_DEBUG_TRACE,
"slap_sasl2dn: performing internal search (base=%s, scope=%d)\n",
op.o_req_ndn.bv_val, op.ors_scope, 0 );
-#endif
- if(( op.o_bd == NULL ) || ( op.o_bd->be_search == NULL)) {
+ if ( ( op.o_bd == NULL ) || ( op.o_bd->be_search == NULL) ) {
goto FINISHED;
}
- op.o_conn = opx->o_conn;
- op.o_connid = opx->o_connid;
+ /* Must run an internal search. */
+ if ( op.ors_filter == NULL ) {
+ rc = LDAP_FILTER_ERROR;
+ goto FINISHED;
+ }
+
+ op.o_hdr = opx->o_hdr;
op.o_tag = LDAP_REQ_SEARCH;
- op.o_protocol = LDAP_VERSION3;
op.o_ndn = opx->o_conn->c_ndn;
op.o_callback = &cb;
op.o_time = slap_get_time();
op.o_do_not_cache = 1;
op.o_is_auth_check = 1;
- op.o_threadctx = opx->o_threadctx;
- op.o_tmpmemctx = opx->o_tmpmemctx;
- op.o_tmpmfuncs = opx->o_tmpmfuncs;
-#ifdef LDAP_SLAPI
- op.o_pb = opx->o_pb;
-#endif
op.ors_deref = LDAP_DEREF_NEVER;
op.ors_slimit = 1;
op.ors_tlimit = SLAP_NO_LIMIT;
op.ors_attrs = slap_anlist_no_attrs;
op.ors_attrsonly = 1;
- op.o_sync_slog_size = -1;
/* use req_ndn as req_dn instead of non-pretty base of uri */
- if( !BER_BVISNULL( &op.o_req_dn ) ) ch_free( op.o_req_dn.bv_val );
+ if( !BER_BVISNULL( &base ) ) {
+ ch_free( base.bv_val );
+ /* just in case... */
+ BER_BVZERO( &base );
+ }
ber_dupbv_x( &op.o_req_dn, &op.o_req_ndn, op.o_tmpmemctx );
op.o_bd->be_search( &op, &rs );
ch_free( op.ors_filterstr.bv_val );
}
-#ifdef NEW_LOGGING
- LDAP_LOG( TRANSPORT, ENTRY,
- "slap_sasl2dn: Converted SASL name to %s\n",
- !BER_BVISEMPTY( sasldn ) ? sasldn->bv_val : "<nothing>", 0, 0 );
-#else
Debug( LDAP_DEBUG_TRACE, "<==slap_sasl2dn: Converted SASL name to %s\n",
!BER_BVISEMPTY( sasldn ) ? sasldn->bv_val : "<nothing>", 0, 0 );
-#endif
return;
}
goto DONE;
}
-#ifdef NEW_LOGGING
- LDAP_LOG( TRANSPORT, ENTRY,
- "slap_sasl_authorized: can %s become %s?\n",
- authcDN->bv_val, authzDN->bv_val, 0 );
-#else
Debug( LDAP_DEBUG_TRACE,
"==>slap_sasl_authorized: can %s become %s?\n",
authcDN->bv_val, authzDN->bv_val, 0 );
-#endif
/* If person is authorizing to self, succeed */
if ( dn_match( authcDN, authzDN ) ) {
DONE:
-#ifdef NEW_LOGGING
- LDAP_LOG( TRANSPORT, RESULTS, "slap_sasl_authorized: return %d\n", rc,0,0 );
-#else
Debug( LDAP_DEBUG_TRACE,
"<== slap_sasl_authorized: return %d\n", rc, 0, 0 );
-#endif
return( rc );
}
projects / openldap / blobdiff