#endif
#include <ldap_pvt.h>
-#endif
+
+#define SASLREGEX_REPLACE 10
+
+typedef struct sasl_uri {
+ struct berval dn;
+ struct berval filter;
+ int scope;
+} SaslUri_t;
+
+typedef struct sasl_regexp {
+ char *sr_match; /* regexp match pattern */
+ SaslUri_t sr_replace; /* regexp replace pattern */
+ regex_t sr_workspace; /* workspace for regexp engine */
+ regmatch_t sr_strings[SASLREGEX_REPLACE]; /* strings matching $1,$2 ... */
+ int sr_dn_offset[SASLREGEX_REPLACE+2]; /* offsets of $1,$2... in *replace */
+ int sr_fi_offset[SASLREGEX_REPLACE+2]; /* offsets of $1,$2... in *replace */
+} SaslRegexp_t;
+
+static int nSaslRegexp = 0;
+static SaslRegexp_t *SaslRegexp = NULL;
+
+/* What SASL proxy authorization policies are allowed? */
+#define SASL_AUTHZ_NONE 0
+#define SASL_AUTHZ_FROM 1
+#define SASL_AUTHZ_TO 2
+
+static int authz_policy = SASL_AUTHZ_NONE;
+
+int slap_sasl_setpolicy( const char *arg )
+{
+ int rc = LDAP_SUCCESS;
+
+ if ( strcasecmp( arg, "none" ) == 0 )
+ authz_policy = SASL_AUTHZ_NONE;
+ else if ( strcasecmp( arg, "from" ) == 0 )
+ authz_policy = SASL_AUTHZ_FROM;
+ else if ( strcasecmp( arg, "to" ) == 0 )
+ authz_policy = SASL_AUTHZ_TO;
+ else if ( strcasecmp( arg, "both" ) == 0 )
+ authz_policy = SASL_AUTHZ_FROM | SASL_AUTHZ_TO;
+ else
+ rc = LDAP_OTHER;
+ return rc;
+}
/* URI format: ldap://<host>/<base>[?[<attrs>][?[<scope>][?[<filter>]]]] */
static int slap_parseURI( struct berval *uri,
- struct berval *searchbase, int *scope, Filter **filter )
+ struct berval *searchbase, int *scope, Filter **filter,
+ struct berval *fstr )
{
struct berval bv;
int rc;
*scope = -1;
*filter = NULL;
+ if ( fstr ) {
+ fstr->bv_val = NULL;
+ fstr->bv_len = 0;
+ }
+
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
"slap_parseURI: parsing %s\n", uri->bv_val ));
return( LDAP_PROTOCOL_ERROR );
}
- /* could check the hostname here */
+ if ( ludp->lud_host && *ludp->lud_host ) {
+ /* host part should be empty */
+ return( LDAP_PROTOCOL_ERROR );
+ }
/* Grab the scope */
*scope = ludp->lud_scope;
*filter = str2filter( ludp->lud_filter );
if ( *filter == NULL )
rc = LDAP_PROTOCOL_ERROR;
+ else if ( fstr )
+ ber_str2bv( ludp->lud_filter, 0, 1, fstr );
}
/* Grab the searchbase */
return( rc );
}
+static int slap_sasl_rx_off(char *rep, int *off)
+{
+ const char *c;
+ int n;
+
+ /* Precompile replace pattern. Find the $<n> placeholders */
+ off[0] = -2;
+ n = 1;
+ for ( c = rep; *c; c++ ) {
+ if ( *c == '\\' && c[1] ) {
+ c++;
+ continue;
+ }
+ if ( *c == '$' ) {
+ if ( n == SASLREGEX_REPLACE ) {
+#ifdef NEW_LOGGING
+ LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
+ "slap_sasl_regexp_config: \"%s\" has too many $n "
+ "placeholders (max %d)\n",
+ rep, SASLREGEX_REPLACE ));
+#else
+ Debug( LDAP_DEBUG_ANY,
+ "SASL replace pattern %s has too many $n "
+ "placeholders (max %d)\n",
+ rep, SASLREGEX_REPLACE, 0 );
+#endif
+
+ return( LDAP_OPERATIONS_ERROR );
+ }
+ off[n] = c - rep;
+ n++;
+ }
+ }
+
+ /* Final placeholder, after the last $n */
+ off[n] = c - rep;
+ n++;
+ off[n] = -1;
+ return( LDAP_SUCCESS );
+}
+#endif /* HAVE_CYRUS_SASL */
int slap_sasl_regexp_config( const char *match, const char *replace )
{
int rc, n;
SaslRegexp_t *reg;
struct berval bv, nbv;
+ Filter *filter;
SaslRegexp = (SaslRegexp_t *) ch_realloc( (char *) SaslRegexp,
(nSaslRegexp + 1) * sizeof(SaslRegexp_t) );
reg->sr_match = nbv.bv_val;
ber_str2bv( replace, 0, 0, &bv );
- rc = dnNormalize2( NULL, &bv, &nbv );
+ rc = slap_parseURI( &bv, ®->sr_replace.dn, ®->sr_replace.scope,
+ &filter, ®->sr_replace.filter );
+ if ( filter ) filter_free( filter );
if ( rc ) {
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
- "slap_sasl_regexp_config: \"%s\" could not be normalized.\n",
+ "slap_sasl_regexp_config: \"%s\" could not be parsed.\n",
replace ));
#else
Debug( LDAP_DEBUG_ANY,
- "SASL replace pattern %s could not be normalized.\n",
+ "SASL replace pattern %s could not be parsed.\n",
replace, 0, 0 );
#endif
return( rc );
}
- reg->sr_replace = nbv.bv_val;
/* Precompile matching pattern */
rc = regcomp( ®->sr_workspace, reg->sr_match, REG_EXTENDED|REG_ICASE );
return( LDAP_OPERATIONS_ERROR );
}
- /* Precompile replace pattern. Find the $<n> placeholders */
- reg->sr_offset[0] = -2;
- n = 1;
- for ( c = reg->sr_replace; *c; c++ ) {
- if ( *c == '\\' && c[1] ) {
- c++;
- continue;
- }
- if ( *c == '$' ) {
- if ( n == SASLREGEX_REPLACE ) {
-#ifdef NEW_LOGGING
- LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
- "slap_sasl_regexp_config: \"%s\" has too many $n "
- "placeholders (max %d)\n",
- reg->sr_replace, SASLREGEX_REPLACE ));
-#else
- Debug( LDAP_DEBUG_ANY,
- "SASL replace pattern %s has too many $n "
- "placeholders (max %d)\n",
- reg->sr_replace, SASLREGEX_REPLACE, 0 );
-#endif
+ rc = slap_sasl_rx_off( reg->sr_replace.dn.bv_val, reg->sr_dn_offset );
+ if ( rc != LDAP_SUCCESS ) return rc;
- return( LDAP_OPERATIONS_ERROR );
- }
- reg->sr_offset[n] = c - reg->sr_replace;
- n++;
- }
+ if (reg->sr_replace.filter.bv_val ) {
+ rc = slap_sasl_rx_off( reg->sr_replace.filter.bv_val, reg->sr_fi_offset );
+ if ( rc != LDAP_SUCCESS ) return rc;
}
- /* Final placeholder, after the last $n */
- reg->sr_offset[n] = c - reg->sr_replace;
- n++;
- reg->sr_offset[n] = -1;
-
nSaslRegexp++;
#endif
return( LDAP_SUCCESS );
#ifdef HAVE_CYRUS_SASL
+/* Perform replacement on regexp matches */
+static void slap_sasl_rx_exp( char *rep, int *off, regmatch_t *str,
+ char *saslname, struct berval *out )
+{
+ int i, n, len, insert;
+
+ /* Get the total length of the final URI */
+
+ n=1;
+ len = 0;
+ while( off[n] >= 0 ) {
+ /* Len of next section from replacement string (x,y,z above) */
+ len += off[n] - off[n-1] - 2;
+ if( off[n+1] < 0)
+ break;
+
+ /* Len of string from saslname that matched next $i (b,d above) */
+ i = rep[ off[n] + 1 ] - '0';
+ len += str[i].rm_eo - str[i].rm_so;
+ n++;
+ }
+ out->bv_val = ch_malloc( len + 1 );
+ out->bv_len = len;
+
+ /* Fill in URI with replace string, replacing $i as we go */
+ n=1;
+ insert = 0;
+ while( off[n] >= 0) {
+ /* Paste in next section from replacement string (x,y,z above) */
+ len = off[n] - off[n-1] - 2;
+ strncpy( out->bv_val+insert, rep + off[n-1] + 2, len);
+ insert += len;
+ if( off[n+1] < 0)
+ break;
+
+ /* Paste in string from saslname that matched next $i (b,d above) */
+ i = rep[ off[n] + 1 ] - '0';
+ len = str[i].rm_eo - str[i].rm_so;
+ strncpy( out->bv_val+insert, saslname + str[i].rm_so, len );
+ insert += len;
+
+ n++;
+ }
+
+ out->bv_val[insert] = '\0';
+}
+
/* Take the passed in SASL name and attempt to convert it into an
LDAP URI to find the matching LDAP entry, using the pattern matching
strings given in the saslregexp config file directive(s) */
-static int slap_sasl_regexp( struct berval *in, struct berval *out )
+
+static int slap_sasl_regexp( struct berval *in, SaslUri_t *out )
{
char *saslname = in->bv_val;
- int i, n, len, insert;
+ char *scope[] = { "base", "one", "sub" };
SaslRegexp_t *reg;
+ int i;
- out->bv_val = NULL;
- out->bv_len = 0;
+ memset( out, 0, sizeof( *out ) );
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
* replace pattern of the form "x$1y$2z". The returned string needs
* to replace the $1,$2 with the strings that matched (b.*) and (d.*)
*/
+ slap_sasl_rx_exp( reg->sr_replace.dn.bv_val, reg->sr_dn_offset,
+ reg->sr_strings, saslname, &out->dn );
+ if ( reg->sr_replace.filter.bv_val )
+ slap_sasl_rx_exp( reg->sr_replace.filter.bv_val,
+ reg->sr_fi_offset, reg->sr_strings, saslname, &out->filter );
+
+ out->scope = reg->sr_replace.scope;
- /* Get the total length of the final URI */
-
- n=1;
- len = 0;
- while( reg->sr_offset[n] >= 0 ) {
- /* Len of next section from replacement string (x,y,z above) */
- len += reg->sr_offset[n] - reg->sr_offset[n-1] - 2;
- if( reg->sr_offset[n+1] < 0)
- break;
-
- /* Len of string from saslname that matched next $i (b,d above) */
- i = reg->sr_replace[ reg->sr_offset[n] + 1 ] - '0';
- len += reg->sr_strings[i].rm_eo - reg->sr_strings[i].rm_so;
- n++;
- }
- out->bv_val = ch_malloc( len + 1 );
- out->bv_len = len;
-
- /* Fill in URI with replace string, replacing $i as we go */
- n=1;
- insert = 0;
- while( reg->sr_offset[n] >= 0) {
- /* Paste in next section from replacement string (x,y,z above) */
- len = reg->sr_offset[n] - reg->sr_offset[n-1] - 2;
- strncpy( out->bv_val+insert, reg->sr_replace + reg->sr_offset[n-1] + 2, len);
- insert += len;
- if( reg->sr_offset[n+1] < 0)
- break;
-
- /* Paste in string from saslname that matched next $i (b,d above) */
- i = reg->sr_replace[ reg->sr_offset[n] + 1 ] - '0';
- len = reg->sr_strings[i].rm_eo - reg->sr_strings[i].rm_so;
- strncpy( out->bv_val+insert, saslname + reg->sr_strings[i].rm_so, len );
- insert += len;
-
- n++;
- }
-
- out->bv_val[insert] = '\0';
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_regexp: converted SASL name to %s\n", out->bv_val ));
+ "slap_sasl_regexp: converted SASL name to ldap:///%s??%s?%s\n",
+ out->dn.bv_val, scope[out->scope], out->filter.bv_val ?
+ out->filter.bv_val : "" ));
#else
Debug( LDAP_DEBUG_TRACE,
- "slap_sasl_regexp: converted SASL name to %s\n", out->bv_val, 0, 0 );
+ "slap_sasl_regexp: converted SASL name to ldap:///%s??%s?%s\n",
+ out->dn.bv_val, scope[out->scope], out->filter.bv_val ?
+ out->filter.bv_val : "" );
#endif
return( 1 );
struct berval *ndn = o->o_callback->sc_private;
/* We only want to be called once */
- if (ndn->bv_val) {
+ if( ndn->bv_val ) {
free(ndn->bv_val);
ndn->bv_val = NULL;
+
#ifdef NEW_LOGGING
- LDAP_LOG(( "sasl", LDAP_LEVEL_DETAIL1,
- "slap_sasl2dn: search DN returned more than 1 entry\n" ));
+ LDAP_LOG(( "sasl", LDAP_LEVEL_DETAIL1,
+ "slap_sasl2dn: search DN returned more than 1 entry\n" ));
#else
- Debug( LDAP_DEBUG_TRACE,
- "slap_sasl2dn: search DN returned more than 1 entry\n", 0,0,0 );
+ Debug( LDAP_DEBUG_TRACE,
+ "slap_sasl2dn: search DN returned more than 1 entry\n", 0,0,0 );
#endif
return -1;
- } else {
- ber_dupbv(ndn, &e->e_nname);
- return 0;
}
+
+ ber_dupbv(ndn, &e->e_nname);
+ return 0;
}
/*
* entry, return the DN of that one entry.
*/
-void slap_sasl2dn( struct berval *saslname, struct berval *dn )
+void slap_sasl2dn( Connection *conn, struct berval *saslname, struct berval *dn )
{
- struct berval uri = {0, NULL};
- struct berval searchbase = {0, NULL};
- int rc, scope;
+ int rc;
Backend *be;
Filter *filter=NULL;
slap_callback cb = {sasl_sc_r, sasl_sc_s, sasl_sc_sasl2dn, NULL};
Operation op = {0};
+ SaslUri_t uri;
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
"slap_sasl2dn: converting SASL name %s to DN.\n", saslname->bv_val ));
#else
- Debug( LDAP_DEBUG_TRACE,
- "==>slap_sasl2dn: Converting SASL name %s to a DN\n", saslname->bv_val, 0,0 );
+ Debug( LDAP_DEBUG_TRACE, "==>slap_sasl2dn: "
+ "converting SASL name %s to a DN\n", saslname->bv_val, 0,0 );
#endif
+
dn->bv_val = NULL;
dn->bv_len = 0;
cb.sc_private = dn;
- /* Convert the SASL name into an LDAP URI */
+ /* Convert the SASL name into a minimal URI */
if( !slap_sasl_regexp( saslname, &uri ) )
goto FINISHED;
- rc = slap_parseURI( &uri, &searchbase, &scope, &filter );
- if( rc ) {
- goto FINISHED;
- }
+ if ( uri.filter.bv_val )
+ filter = str2filter( uri.filter.bv_val );
+
+ /* Must do an internal search */
+
+ be = select_backend( &uri.dn, 0, 1 );
- /* FIXME: move this check to after select_backend, and set
- * the selected backend in conn->c_authz_backend, to allow
- * passwd_extop to be used on in-directory SASL secrets.
- * ... when all of that gets implemented...
- */
/* Massive shortcut: search scope == base */
- if( scope == LDAP_SCOPE_BASE ) {
- *dn = searchbase;
- searchbase.bv_len = 0;
- searchbase.bv_val = NULL;
+ if( uri.scope == LDAP_SCOPE_BASE ) {
+ *dn = uri.dn;
+ uri.dn.bv_len = 0;
+ uri.dn.bv_val = NULL;
goto FINISHED;
}
- /* Must do an internal search */
-
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_DETAIL1,
- "slap_sasl2dn: performing internal search (base=%s, scope=%d)\n",
- searchbase.bv_val, scope ));
+ "slap_sasl2dn: performing internal search (base=%s, scope=%d)\n",
+ uri.dn.bv_val, uri.scope ));
#else
Debug( LDAP_DEBUG_TRACE,
"slap_sasl2dn: performing internal search (base=%s, scope=%d)\n",
- searchbase.bv_val, scope, 0 );
+ uri.dn.bv_val, uri.scope, 0 );
#endif
- be = select_backend( &searchbase, 0, 1 );
- if(( be == NULL ) || ( be->be_search == NULL))
+ if(( be == NULL ) || ( be->be_search == NULL)) {
goto FINISHED;
- suffix_alias( be, &searchbase );
+ }
+ suffix_alias( be, &uri.dn );
op.o_tag = LDAP_REQ_SEARCH;
op.o_protocol = LDAP_VERSION3;
op.o_callback = &cb;
op.o_time = slap_get_time();
- (*be->be_search)( be, /*conn*/NULL, &op, /*base*/NULL, &searchbase,
- scope, /*deref=*/1, /*sizelimit=*/1, /*time=*/0, filter, /*fstr=*/NULL,
- /*attrs=*/NULL, /*attrsonly=*/0 );
+ (*be->be_search)( be, NULL, &op, NULL, &uri.dn,
+ uri.scope, LDAP_DEREF_NEVER, 1, 0,
+ filter, NULL, NULL, 1 );
+ if( dn->bv_len ) {
+ conn->c_authz_backend = be;
+ }
+
FINISHED:
- if( searchbase.bv_len ) ch_free( searchbase.bv_val );
+ if( uri.dn.bv_len ) ch_free( uri.dn.bv_val );
+ if( uri.filter.bv_len ) ch_free( uri.filter.bv_val );
if( filter ) filter_free( filter );
- if( uri.bv_val ) ch_free( uri.bv_val );
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
"===>slap_sasl_match: comparing DN %s to rule %s\n", assertDN->bv_val, rule->bv_val, 0 );
#endif
- rc = slap_parseURI( rule, &searchbase, &scope, &filter );
+ rc = slap_parseURI( rule, &searchbase, &scope, &filter, NULL );
if( rc != LDAP_SUCCESS )
goto CONCLUDED;
* The DNs should not have the dn: prefix
*/
static int
-slap_sasl_check_authz(struct berval *searchDN, struct berval *assertDN, struct berval *attr, struct berval *authc)
+slap_sasl_check_authz(struct berval *searchDN, struct berval *assertDN, AttributeDescription *ad, struct berval *authc)
{
- const char *errmsg;
int i, rc;
BerVarray vals=NULL;
- AttributeDescription *ad=NULL;
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
"slap_sasl_check_authz: does %s match %s rule in %s?\n",
- assertDN->bv_val, attr->bv_val, searchDN->bv_val ));
+ assertDN->bv_val, ad->ad_cname.bv_val, searchDN->bv_val ));
#else
Debug( LDAP_DEBUG_TRACE,
"==>slap_sasl_check_authz: does %s match %s rule in %s?\n",
- assertDN->bv_val, attr->bv_val, searchDN->bv_val);
+ assertDN->bv_val, ad->ad_cname.bv_val, searchDN->bv_val);
#endif
- rc = slap_bv2ad( attr, &ad, &errmsg );
- if( rc != LDAP_SUCCESS )
- goto COMPLETE;
-
rc = backend_attribute( NULL, NULL, NULL, NULL, searchDN, ad, &vals );
if( rc != LDAP_SUCCESS )
goto COMPLETE;
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_check_authz: %s check returning %s\n", attr->bv_val, rc ));
+ "slap_sasl_check_authz: %s check returning %s\n", ad->ad_cname.bv_val, rc ));
#else
Debug( LDAP_DEBUG_TRACE,
- "<==slap_sasl_check_authz: %s check returning %d\n", attr->bv_val, rc, 0);
+ "<==slap_sasl_check_authz: %s check returning %d\n", ad->ad_cname.bv_val, rc, 0);
#endif
return( rc );
* The DNs should not have the dn: prefix
*/
-static struct berval sasl_authz_src = {
- sizeof(SASL_AUTHZ_SOURCE_ATTR)-1, SASL_AUTHZ_SOURCE_ATTR };
-
-static struct berval sasl_authz_dst = {
- sizeof(SASL_AUTHZ_DEST_ATTR)-1, SASL_AUTHZ_DEST_ATTR };
-
int slap_sasl_authorized( struct berval *authcDN, struct berval *authzDN )
{
int rc = LDAP_INAPPROPRIATE_AUTH;
}
/* Check source rules */
- rc = slap_sasl_check_authz( authcDN, authzDN, &sasl_authz_src,
- authcDN );
- if( rc == LDAP_SUCCESS ) {
- goto DONE;
+ if( authz_policy & SASL_AUTHZ_TO ) {
+ rc = slap_sasl_check_authz( authcDN, authzDN,
+ slap_schema.si_ad_saslAuthzTo, authcDN );
+ if( rc == LDAP_SUCCESS ) {
+ goto DONE;
+ }
}
/* Check destination rules */
- rc = slap_sasl_check_authz( authzDN, authcDN, &sasl_authz_dst,
- authcDN );
- if( rc == LDAP_SUCCESS ) {
- goto DONE;
+ if( authz_policy & SASL_AUTHZ_FROM ) {
+ rc = slap_sasl_check_authz( authzDN, authcDN,
+ slap_schema.si_ad_saslAuthzFrom, authcDN );
+ if( rc == LDAP_SUCCESS ) {
+ goto DONE;
+ }
}
rc = LDAP_INAPPROPRIATE_AUTH;