declare oc_bvfind_undef()

[openldap] / servers / slapd / saslauthz.c

diff --git a/servers/slapd/saslauthz.c b/servers/slapd/saslauthz.c
index 7b61f06e0c7dcc76ff5ce9c81bc8bb5199966692..52d928f51236d1a688c203ea1cf5e3b5ee3abc4b 100644 (file)
--- a/servers/slapd/saslauthz.c
+++ b/servers/slapd/saslauthz.c
@@ -26,7 +26,6 @@
 
 #include <limits.h>
 
-#include <ldap_pvt.h>
 #include "lutil.h"
 
 #define SASLREGEX_REPLACE 10
@@ -410,7 +409,17 @@ is_dn:             bv.bv_len = uri->bv_len - (bv.bv_val - uri->bv_val);
         * <filter> must pass str2filter()
         */
        rc = ldap_url_parse( uri->bv_val, &ludp );
-       if ( rc == LDAP_URL_ERR_BADSCHEME ) {
+       switch ( rc ) {
+       case LDAP_URL_SUCCESS:
+               if ( strcasecmp( ludp->lud_scheme, "ldap" ) != 0 ) {
+                       /*
+                        * must be ldap:///
+                        */
+                       return LDAP_PROTOCOL_ERROR;
+               }
+               break;
+
+       case LDAP_URL_ERR_BADSCHEME:
                /*
                 * last chance: assume it's a(n exact) DN ...
                 *
@@ -419,13 +428,12 @@ is_dn:            bv.bv_len = uri->bv_len - (bv.bv_val - uri->bv_val);
                bv.bv_val = uri->bv_val;
                *scope = LDAP_X_SCOPE_EXACT;
                goto is_dn;
-       }
 
-       if ( rc != LDAP_URL_SUCCESS ) {
+       default:
                return LDAP_PROTOCOL_ERROR;
        }
 
-       if (( ludp->lud_host && *ludp->lud_host )
+       if ( ( ludp->lud_host && *ludp->lud_host )
                || ludp->lud_attrs || ludp->lud_exts )
        {
                /* host part must be empty */
@@ -830,6 +838,7 @@ int slap_sasl_match( Operation *opx, struct berval *rule,
        slap_callback cb = { NULL, sasl_sc_smatch, NULL, NULL };
        Operation op = {0};
        SlapReply rs = {REP_RESULT};
+       struct berval base = BER_BVNULL;
 
        sm.dn = assertDN;
        sm.match = 0;
@@ -839,7 +848,7 @@ int slap_sasl_match( Operation *opx, struct berval *rule,
           "===>slap_sasl_match: comparing DN %s to rule %s\n",
                assertDN->bv_val, rule->bv_val, 0 );
 
-       rc = slap_parseURI( opx, rule, &op.o_req_dn,
+       rc = slap_parseURI( opx, rule, &base,
                &op.o_req_ndn, &op.ors_scope, &op.ors_filter,
                &op.ors_filterstr );
        if( rc != LDAP_SUCCESS ) goto CONCLUDED;
@@ -983,29 +992,24 @@ exact_match:
                goto CONCLUDED;
        }
 
+       op.o_hdr = opx->o_hdr;
        op.o_tag = LDAP_REQ_SEARCH;
-       op.o_protocol = LDAP_VERSION3;
        op.o_ndn = *authc;
        op.o_callback = &cb;
        op.o_time = slap_get_time();
        op.o_do_not_cache = 1;
        op.o_is_auth_check = 1;
-       op.o_threadctx = opx->o_threadctx;
-       op.o_tmpmemctx = opx->o_tmpmemctx;
-       op.o_tmpmfuncs = opx->o_tmpmfuncs;
-#ifdef LDAP_SLAPI
-       op.o_pb = opx->o_pb;
-#endif
-       op.o_conn = opx->o_conn;
-       op.o_connid = opx->o_connid;
        /* use req_ndn as req_dn instead of non-pretty base of uri */
-       if( !BER_BVISNULL( &op.o_req_dn ) ) ch_free( op.o_req_dn.bv_val );
+       if( !BER_BVISNULL( &base ) ) {
+               ch_free( base.bv_val );
+               /* just in case... */
+               BER_BVZERO( &base );
+       }
        ber_dupbv_x( &op.o_req_dn, &op.o_req_ndn, op.o_tmpmemctx );
        op.ors_slimit = 1;
        op.ors_tlimit = SLAP_NO_LIMIT;
        op.ors_attrs = slap_anlist_no_attrs;
        op.ors_attrsonly = 1;
-       op.o_sync_slog_size = -1;
 
        op.o_bd->be_search( &op, &rs );
 
@@ -1082,6 +1086,7 @@ void slap_sasl2dn( Operation *opx,
        Operation op = {0};
        SlapReply rs = {REP_RESULT};
        struct berval regout = BER_BVNULL;
+       struct berval base = BER_BVNULL;
 
        Debug( LDAP_DEBUG_TRACE, "==>slap_sasl2dn: "
                "converting SASL name %s to a DN\n",
@@ -1096,7 +1101,7 @@ void slap_sasl2dn( Operation *opx,
                goto FINISHED;
        }
 
-       rc = slap_parseURI( opx, &regout, &op.o_req_dn,
+       rc = slap_parseURI( opx, &regout, &base,
                &op.o_req_ndn, &op.ors_scope, &op.ors_filter,
                &op.ors_filterstr );
        if ( !BER_BVISNULL( &regout ) ) slap_sl_free( regout.bv_val, opx->o_tmpmemctx );
@@ -1140,33 +1145,34 @@ void slap_sasl2dn( Operation *opx,
                "slap_sasl2dn: performing internal search (base=%s, scope=%d)\n",
                op.o_req_ndn.bv_val, op.ors_scope, 0 );
 
-       if(( op.o_bd == NULL ) || ( op.o_bd->be_search == NULL)) {
+       if ( ( op.o_bd == NULL ) || ( op.o_bd->be_search == NULL) ) {
                goto FINISHED;
        }
 
-       op.o_conn = opx->o_conn;
-       op.o_connid = opx->o_connid;
+       /* Must run an internal search. */
+       if ( op.ors_filter == NULL ) {
+               rc = LDAP_FILTER_ERROR;
+               goto FINISHED;
+       }
+
+       op.o_hdr = opx->o_hdr;
        op.o_tag = LDAP_REQ_SEARCH;
-       op.o_protocol = LDAP_VERSION3;
        op.o_ndn = opx->o_conn->c_ndn;
        op.o_callback = &cb;
        op.o_time = slap_get_time();
        op.o_do_not_cache = 1;
        op.o_is_auth_check = 1;
-       op.o_threadctx = opx->o_threadctx;
-       op.o_tmpmemctx = opx->o_tmpmemctx;
-       op.o_tmpmfuncs = opx->o_tmpmfuncs;
-#ifdef LDAP_SLAPI
-       op.o_pb = opx->o_pb;
-#endif
        op.ors_deref = LDAP_DEREF_NEVER;
        op.ors_slimit = 1;
        op.ors_tlimit = SLAP_NO_LIMIT;
        op.ors_attrs = slap_anlist_no_attrs;
        op.ors_attrsonly = 1;
-       op.o_sync_slog_size = -1;
        /* use req_ndn as req_dn instead of non-pretty base of uri */
-       if( !BER_BVISNULL( &op.o_req_dn ) ) ch_free( op.o_req_dn.bv_val );
+       if( !BER_BVISNULL( &base ) ) {
+               ch_free( base.bv_val );
+               /* just in case... */
+               BER_BVZERO( &base );
+       }
        ber_dupbv_x( &op.o_req_dn, &op.o_req_ndn, op.o_tmpmemctx );
 
        op.o_bd->be_search( &op, &rs );