#ifdef HAVE_CYRUS_SASL
#include <limits.h>
+
+#ifdef HAVE_SASL_SASL_H
+#include <sasl/sasl.h>
+#else
#include <sasl.h>
+#endif
+
#include <ldap_pvt.h>
#endif
/* URI format: ldap://<host>/<base>[?[<attrs>][?[<scope>][?[<filter>]]]] */
-static int slap_parseURI( char *uri,
+static int slap_parseURI( struct berval *uri,
struct berval *searchbase, int *scope, Filter **filter )
{
- char *start, *end;
struct berval bv;
int rc;
+ LDAPURLDesc *ludp;
-
- assert( uri != NULL );
+ assert( uri != NULL && uri->bv_val != NULL );
searchbase->bv_val = NULL;
searchbase->bv_len = 0;
*scope = -1;
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_parseURI: parsing %s\n", uri ));
+ "slap_parseURI: parsing %s\n", uri->bv_val ));
#else
- Debug( LDAP_DEBUG_TRACE, "slap_parseURI: parsing %s\n", uri, 0, 0 );
+ Debug( LDAP_DEBUG_TRACE, "slap_parseURI: parsing %s\n", uri->bv_val, 0, 0 );
#endif
/* If it does not look like a URI, assume it is a DN */
- if( !strncasecmp( uri, "dn:", sizeof("dn:")-1 ) ) {
- uri += sizeof("dn:")-1;
- uri += strspn( uri, " " );
- bv.bv_val = uri;
- /* FIXME: if dnNormalize actually uses input bv_len we
- * will have to make this right.
- */
-is_dn: bv.bv_len = 1;
+ if( !strncasecmp( uri->bv_val, "dn:", sizeof("dn:")-1 ) ) {
+ bv.bv_val = uri->bv_val + sizeof("dn:")-1;
+ bv.bv_val += strspn( bv.bv_val, " " );
+
+is_dn: bv.bv_len = uri->bv_len - (bv.bv_val - uri->bv_val);
rc = dnNormalize2( NULL, &bv, searchbase );
if (rc == LDAP_SUCCESS) {
*scope = LDAP_SCOPE_BASE;
return( rc );
}
- /* FIXME: should use ldap_url_parse() */
- if( strncasecmp( uri, "ldap://", sizeof("ldap://")-1 ) ) {
- bv.bv_val = uri;
+ rc = ldap_url_parse( uri->bv_val, &ludp );
+ if ( rc == LDAP_URL_ERR_BADSCHEME ) {
+ bv.bv_val = uri->bv_val;
goto is_dn;
}
- end = strchr( uri + (sizeof("ldap://")-1), '/' );
- if ( end == NULL )
+ if ( rc != LDAP_URL_SUCCESS ) {
return( LDAP_PROTOCOL_ERROR );
+ }
/* could check the hostname here */
- /* Grab the searchbase */
- start = end+1;
- end = strchr( start, '?' );
- bv.bv_val = start;
- if( end == NULL ) {
- bv.bv_len = 1;
- return dnNormalize2( NULL, &bv, searchbase );
- }
- *end = '\0';
- bv.bv_len = end - start;
- rc = dnNormalize2( NULL, &bv, searchbase );
- *end = '?';
- if (rc != LDAP_SUCCESS)
- return( rc );
+ /* Grab the scope */
+ *scope = ludp->lud_scope;
- /* Skip the attrs */
- start = end+1;
- end = strchr( start, '?' );
- if( end == NULL ) {
- return( LDAP_SUCCESS );
+ /* Grab the filter */
+ if ( ludp->lud_filter ) {
+ *filter = str2filter( ludp->lud_filter );
+ if ( *filter == NULL )
+ rc = LDAP_PROTOCOL_ERROR;
}
- /* Grab the scope */
- start = end+1;
- if( !strncasecmp( start, "base?", sizeof("base?")-1 )) {
- *scope = LDAP_SCOPE_BASE;
- start += sizeof("base?")-1;
- }
- else if( !strncasecmp( start, "one?", sizeof("one?")-1 )) {
- *scope = LDAP_SCOPE_ONELEVEL;
- start += sizeof("one?")-1;
- }
- else if( !strncasecmp( start, "sub?", sizeof("sub?")-1 )) {
- *scope = LDAP_SCOPE_SUBTREE;
- start += sizeof("sub?")-1;
- }
- else {
- free( searchbase->bv_val );
- searchbase->bv_val = NULL;
- return( LDAP_PROTOCOL_ERROR );
+ /* Grab the searchbase */
+ if ( rc == LDAP_URL_SUCCESS ) {
+ bv.bv_val = ludp->lud_dn;
+ bv.bv_len = strlen( bv.bv_val );
+ rc = dnNormalize2( NULL, &bv, searchbase );
}
- /* Grab the filter */
- *filter = str2filter( start );
+ ldap_free_urldesc( ludp );
- return( LDAP_SUCCESS );
+ return( rc );
}
const char *c;
int rc, n;
SaslRegexp_t *reg;
+ struct berval bv, nbv;
SaslRegexp = (SaslRegexp_t *) ch_realloc( (char *) SaslRegexp,
(nSaslRegexp + 1) * sizeof(SaslRegexp_t) );
reg = &( SaslRegexp[nSaslRegexp] );
- reg->match = ch_strdup( match );
- reg->replace = ch_strdup( replace );
- dn_normalize( reg->match );
- dn_normalize( reg->replace );
+ ber_str2bv( match, 0, 0, &bv );
+ rc = dnNormalize2( NULL, &bv, &nbv );
+ if ( rc ) {
+#ifdef NEW_LOGGING
+ LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
+ "slap_sasl_regexp_config: \"%s\" could not be normalized.\n",
+ match ));
+#else
+ Debug( LDAP_DEBUG_ANY,
+ "SASL match pattern %s could not be normalized.\n",
+ match, 0, 0 );
+#endif
+ return( rc );
+ }
+ reg->sr_match = nbv.bv_val;
+
+ ber_str2bv( replace, 0, 0, &bv );
+ rc = dnNormalize2( NULL, &bv, &nbv );
+ if ( rc ) {
+#ifdef NEW_LOGGING
+ LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
+ "slap_sasl_regexp_config: \"%s\" could not be normalized.\n",
+ replace ));
+#else
+ Debug( LDAP_DEBUG_ANY,
+ "SASL replace pattern %s could not be normalized.\n",
+ replace, 0, 0 );
+#endif
+ return( rc );
+ }
+ reg->sr_replace = nbv.bv_val;
/* Precompile matching pattern */
- rc = regcomp( ®->workspace, reg->match, REG_EXTENDED|REG_ICASE );
+ rc = regcomp( ®->sr_workspace, reg->sr_match, REG_EXTENDED|REG_ICASE );
if ( rc ) {
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
"slap_sasl_regexp_config: \"%s\" could not be compiled.\n",
- reg->match ));
+ reg->sr_match ));
#else
Debug( LDAP_DEBUG_ANY,
"SASL match pattern %s could not be compiled by regexp engine\n",
- reg->match, 0, 0 );
+ reg->sr_match, 0, 0 );
#endif
return( LDAP_OPERATIONS_ERROR );
}
/* Precompile replace pattern. Find the $<n> placeholders */
- reg->offset[0] = -2;
+ reg->sr_offset[0] = -2;
n = 1;
- for ( c = reg->replace; *c; c++ ) {
- if ( *c == '\\' ) {
+ for ( c = reg->sr_replace; *c; c++ ) {
+ if ( *c == '\\' && c[1] ) {
c++;
continue;
}
if ( n == SASLREGEX_REPLACE ) {
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
- "slap_sasl_regexp_config: \"%s\" has too many $n placeholders (max %d)\n",
- reg->replace, SASLREGEX_REPLACE ));
+ "slap_sasl_regexp_config: \"%s\" has too many $n "
+ "placeholders (max %d)\n",
+ reg->sr_replace, SASLREGEX_REPLACE ));
#else
Debug( LDAP_DEBUG_ANY,
- "SASL replace pattern %s has too many $n placeholders (max %d)\n",
- reg->replace, SASLREGEX_REPLACE, 0 );
+ "SASL replace pattern %s has too many $n "
+ "placeholders (max %d)\n",
+ reg->sr_replace, SASLREGEX_REPLACE, 0 );
#endif
return( LDAP_OPERATIONS_ERROR );
}
- reg->offset[n] = c - reg->replace;
+ reg->sr_offset[n] = c - reg->sr_replace;
n++;
}
}
/* Final placeholder, after the last $n */
- reg->offset[n] = c - reg->replace;
+ reg->sr_offset[n] = c - reg->sr_replace;
n++;
- reg->offset[n] = -1;
+ reg->sr_offset[n] = -1;
nSaslRegexp++;
#endif
/* Take the passed in SASL name and attempt to convert it into an
LDAP URI to find the matching LDAP entry, using the pattern matching
strings given in the saslregexp config file directive(s) */
-static
-char *slap_sasl_regexp( char *saslname )
+static int slap_sasl_regexp( struct berval *in, struct berval *out )
{
- char *uri=NULL;
+ char *saslname = in->bv_val;
int i, n, len, insert;
SaslRegexp_t *reg;
+ out->bv_val = NULL;
+ out->bv_len = 0;
+
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
"slap_sasl_regexp: converting SASL name %s\n", saslname ));
#endif
if (( saslname == NULL ) || ( nSaslRegexp == 0 ))
- return( NULL );
+ return( 0 );
/* Match the normalized SASL name to the saslregexp patterns */
for( reg = SaslRegexp,i=0; i<nSaslRegexp; i++,reg++ ) {
- if ( regexec( ®->workspace, saslname, SASLREGEX_REPLACE,
- reg->strings, 0) == 0 )
+ if ( regexec( ®->sr_workspace, saslname, SASLREGEX_REPLACE,
+ reg->sr_strings, 0) == 0 )
break;
}
if( i >= nSaslRegexp )
- return( NULL );
+ return( 0 );
/*
* The match pattern may have been of the form "a(b.*)c(d.*)e" and the
n=1;
len = 0;
- while( reg->offset[n] >= 0 ) {
+ while( reg->sr_offset[n] >= 0 ) {
/* Len of next section from replacement string (x,y,z above) */
- len += reg->offset[n] - reg->offset[n-1] - 2;
- if( reg->offset[n+1] < 0)
+ len += reg->sr_offset[n] - reg->sr_offset[n-1] - 2;
+ if( reg->sr_offset[n+1] < 0)
break;
/* Len of string from saslname that matched next $i (b,d above) */
- i = reg->replace[ reg->offset[n] + 1 ] - '0';
- len += reg->strings[i].rm_eo - reg->strings[i].rm_so;
+ i = reg->sr_replace[ reg->sr_offset[n] + 1 ] - '0';
+ len += reg->sr_strings[i].rm_eo - reg->sr_strings[i].rm_so;
n++;
}
- uri = ch_malloc( len + 1 );
+ out->bv_val = ch_malloc( len + 1 );
+ out->bv_len = len;
/* Fill in URI with replace string, replacing $i as we go */
n=1;
insert = 0;
- while( reg->offset[n] >= 0) {
+ while( reg->sr_offset[n] >= 0) {
/* Paste in next section from replacement string (x,y,z above) */
- len = reg->offset[n] - reg->offset[n-1] - 2;
- strncpy( uri+insert, reg->replace + reg->offset[n-1] + 2, len);
+ len = reg->sr_offset[n] - reg->sr_offset[n-1] - 2;
+ strncpy( out->bv_val+insert, reg->sr_replace + reg->sr_offset[n-1] + 2, len);
insert += len;
- if( reg->offset[n+1] < 0)
+ if( reg->sr_offset[n+1] < 0)
break;
/* Paste in string from saslname that matched next $i (b,d above) */
- i = reg->replace[ reg->offset[n] + 1 ] - '0';
- len = reg->strings[i].rm_eo - reg->strings[i].rm_so;
- strncpy( uri+insert, saslname + reg->strings[i].rm_so, len );
+ i = reg->sr_replace[ reg->sr_offset[n] + 1 ] - '0';
+ len = reg->sr_strings[i].rm_eo - reg->sr_strings[i].rm_so;
+ strncpy( out->bv_val+insert, saslname + reg->sr_strings[i].rm_so, len );
insert += len;
n++;
}
- uri[insert] = '\0';
+ out->bv_val[insert] = '\0';
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_regexp: converted SASL name to %s\n", uri ));
+ "slap_sasl_regexp: converted SASL name to %s\n", out->bv_val ));
#else
Debug( LDAP_DEBUG_TRACE,
- "slap_sasl_regexp: converted SASL name to %s\n", uri, 0, 0 );
+ "slap_sasl_regexp: converted SASL name to %s\n", out->bv_val, 0, 0 );
#endif
- return( uri );
+ return( 1 );
}
/* Two empty callback functions to avoid sending results */
void slap_sasl2dn( struct berval *saslname, struct berval *dn )
{
- char *uri=NULL;
+ struct berval uri = {0, NULL};
struct berval searchbase = {0, NULL};
int rc, scope;
Backend *be;
cb.sc_private = dn;
/* Convert the SASL name into an LDAP URI */
- uri = slap_sasl_regexp( saslname->bv_val );
- if( uri == NULL )
+ if( !slap_sasl_regexp( saslname, &uri ) )
goto FINISHED;
- rc = slap_parseURI( uri, &searchbase, &scope, &filter );
+ rc = slap_parseURI( &uri, &searchbase, &scope, &filter );
if( rc ) {
goto FINISHED;
}
goto FINISHED;
suffix_alias( be, &searchbase );
- ldap_pvt_thread_mutex_init( &op.o_abandonmutex );
op.o_tag = LDAP_REQ_SEARCH;
op.o_protocol = LDAP_VERSION3;
op.o_ndn = *saslname;
scope, /*deref=*/1, /*sizelimit=*/1, /*time=*/0, filter, /*fstr=*/NULL,
/*attrs=*/NULL, /*attrsonly=*/0 );
- ldap_pvt_thread_mutex_destroy( &op.o_abandonmutex );
-
FINISHED:
if( searchbase.bv_len ) ch_free( searchbase.bv_val );
if( filter ) filter_free( filter );
- if( uri ) ch_free( uri );
+ if( uri.bv_val ) ch_free( uri.bv_val );
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
*/
static
-int slap_sasl_match( char *rule, struct berval *assertDN, struct berval *authc )
+int slap_sasl_match( struct berval *rule, struct berval *assertDN, struct berval *authc )
{
struct berval searchbase = {0, NULL};
int rc, scope;
Filter *filter=NULL;
regex_t reg;
smatch_info sm;
- slap_callback cb = {sasl_sc_r, sasl_sc_s, sasl_sc_smatch, &sm};
+ slap_callback cb = { sasl_sc_r, sasl_sc_s, sasl_sc_smatch, NULL };
Operation op = {0};
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_match: comparing DN %s to rule %s\n", assertDN->bv_val, rule ));
+ "slap_sasl_match: comparing DN %s to rule %s\n", assertDN->bv_val, rule->bv_val ));
#else
Debug( LDAP_DEBUG_TRACE,
- "===>slap_sasl_match: comparing DN %s to rule %s\n", assertDN->bv_val, rule, 0 );
+ "===>slap_sasl_match: comparing DN %s to rule %s\n", assertDN->bv_val, rule->bv_val, 0 );
#endif
rc = slap_parseURI( rule, &searchbase, &scope, &filter );
sm.dn = assertDN;
sm.match = 0;
+ cb.sc_private = &sm;
- ldap_pvt_thread_mutex_init( &op.o_abandonmutex );
op.o_tag = LDAP_REQ_SEARCH;
op.o_protocol = LDAP_VERSION3;
op.o_ndn = *authc;
scope, /*deref=*/1, /*sizelimit=*/0, /*time=*/0, filter, /*fstr=*/NULL,
/*attrs=*/NULL, /*attrsonly=*/0 );
- ldap_pvt_thread_mutex_destroy( &op.o_abandonmutex );
-
if (sm.match)
rc = LDAP_SUCCESS;
else
bv.bv_len = assertDN->bv_len - 3;
/* Check if the *assertDN matches any **vals */
for( i=0; vals[i].bv_val != NULL; i++ ) {
- rc = slap_sasl_match( vals[i].bv_val, &bv, authc );
+ rc = slap_sasl_match( &vals[i], &bv, authc );
if ( rc == LDAP_SUCCESS )
goto COMPLETE;
}
projects / openldap / blobdiff