cleanup bind

[openldap] / servers / slapd / saslauthz.c

diff --git a/servers/slapd/saslauthz.c b/servers/slapd/saslauthz.c
index c2e2200beea83ee011843371c6d19d2e517a76fc..775979bf1dc0914d952d2e16b375d8cb069de927 100644 (file)
--- a/servers/slapd/saslauthz.c
+++ b/servers/slapd/saslauthz.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
+ * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
  */
 /*
@@ -51,16 +51,17 @@ int slap_sasl_setpolicy( const char *arg )
 {
        int rc = LDAP_SUCCESS;
 
-       if ( strcasecmp( arg, "none" ) == 0 )
+       if ( strcasecmp( arg, "none" ) == 0 ) {
                authz_policy = SASL_AUTHZ_NONE;
-       else if ( strcasecmp( arg, "from" ) == 0 )
+       } else if ( strcasecmp( arg, "from" ) == 0 ) {
                authz_policy = SASL_AUTHZ_FROM;
-       else if ( strcasecmp( arg, "to" ) == 0 )
+       } else if ( strcasecmp( arg, "to" ) == 0 ) {
                authz_policy = SASL_AUTHZ_TO;
-       else if ( strcasecmp( arg, "both" ) == 0 )
+       } else if ( strcasecmp( arg, "both" ) == 0 ) {
                authz_policy = SASL_AUTHZ_FROM | SASL_AUTHZ_TO;
-       else
+       } else {
                rc = LDAP_OTHER;
+       }
        return rc;
 }
 
@@ -292,8 +293,9 @@ static int slap_sasl_regexp( struct berval *in, struct berval *out )
           saslname, 0, 0 );
 #endif
 
-       if (( saslname == NULL ) || ( nSaslRegexp == 0 ))
+       if (( saslname == NULL ) || ( nSaslRegexp == 0 )) {
                return( 0 );
+       }
 
        /* Match the normalized SASL name to the saslregexp patterns */
        for( reg = SaslRegexp,i=0;  i<nSaslRegexp;  i++,reg++ ) {
@@ -302,8 +304,7 @@ static int slap_sasl_regexp( struct berval *in, struct berval *out )
                        break;
        }
 
-       if( i >= nSaslRegexp )
-               return( 0 );
+       if( i >= nSaslRegexp ) return( 0 );
 
        /*
         * The match pattern may have been of the form "a(b.*)c(d.*)e" and the
@@ -340,6 +341,12 @@ void slap_cb_null_sresult( Connection *conn, Operation *o, ber_int_t err,
 {
 }
 
+int slap_cb_null_sreference( BackendDB *db, Connection *conn, Operation *o, 
+       Entry *e, BerVarray r, LDAPControl **c, BerVarray *v2)
+{
+       return 0;
+}
+
 /* This callback actually does some work...*/
 static int sasl_sc_sasl2dn( BackendDB *be, Connection *conn, Operation *o,
        Entry *e, AttributeName *an, int ao, LDAPControl **c)
@@ -352,8 +359,8 @@ static int sasl_sc_sasl2dn( BackendDB *be, Connection *conn, Operation *o,
                ndn->bv_val = NULL;
 
 #ifdef NEW_LOGGING
-       LDAP_LOG( TRANSPORT, DETAIL1,
-                   "slap_sasl2dn: search DN returned more than 1 entry\n", 0, 0, 0 );
+               LDAP_LOG( TRANSPORT, DETAIL1,
+                       "slap_sasl2dn: search DN returned more than 1 entry\n", 0, 0, 0 );
 #else
                Debug( LDAP_DEBUG_TRACE,
                        "slap_sasl2dn: search DN returned more than 1 entry\n", 0,0,0 );
@@ -379,9 +386,9 @@ static int sasl_sc_smatch( BackendDB *be, Connection *conn, Operation *o,
        if (dn_match(sm->dn, &e->e_nname)) {
                sm->match = 1;
                return -1;      /* short-circuit the search */
-       } else {
-               return 1;
        }
+
+       return 1;
 }
 
 /*
@@ -402,7 +409,12 @@ int slap_sasl_match(Connection *conn, struct berval *rule, struct berval *assert
        Filter *filter=NULL;
        regex_t reg;
        smatch_info sm;
-       slap_callback cb = { slap_cb_null_response, slap_cb_null_sresult, sasl_sc_smatch, NULL };
+       slap_callback cb = {
+               slap_cb_null_response,
+               slap_cb_null_sresult,
+               sasl_sc_smatch,
+               NULL
+       };
        Operation op = {0};
 
 #ifdef NEW_LOGGING
@@ -411,12 +423,12 @@ int slap_sasl_match(Connection *conn, struct berval *rule, struct berval *assert
                assertDN->bv_val, rule->bv_val,0 );
 #else
        Debug( LDAP_DEBUG_TRACE,
-          "===>slap_sasl_match: comparing DN %s to rule %s\n", assertDN->bv_val, rule->bv_val, 0 );
+          "===>slap_sasl_match: comparing DN %s to rule %s\n",
+               assertDN->bv_val, rule->bv_val, 0 );
 #endif
 
        rc = slap_parseURI( rule, &searchbase, &scope, &filter );
-       if( rc != LDAP_SUCCESS )
-               goto CONCLUDED;
+       if( rc != LDAP_SUCCESS ) goto CONCLUDED;
 
        /* Massive shortcut: search scope == base */
        if( scope == LDAP_SCOPE_BASE ) {
@@ -426,10 +438,11 @@ int slap_sasl_match(Connection *conn, struct berval *rule, struct berval *assert
                        rc = regexec(&reg, assertDN->bv_val, 0, NULL, 0);
                        regfree( &reg );
                }
-               if ( rc == 0 )
+               if ( rc == 0 ) {
                        rc = LDAP_SUCCESS;
-               else
+               } else {
                        rc = LDAP_INAPPROPRIATE_AUTH;
+               }
                goto CONCLUDED;
        }
 
@@ -450,7 +463,6 @@ int slap_sasl_match(Connection *conn, struct berval *rule, struct berval *assert
                rc = LDAP_INAPPROPRIATE_AUTH;
                goto CONCLUDED;
        }
-       suffix_alias( be, &searchbase );
 
        sm.dn = assertDN;
        sm.match = 0;
@@ -462,20 +474,23 @@ int slap_sasl_match(Connection *conn, struct berval *rule, struct berval *assert
        op.o_callback = &cb;
        op.o_time = slap_get_time();
        op.o_do_not_cache = 1;
+       op.o_is_auth_check = 1;
        op.o_threadctx = conn->c_sasl_bindop->o_threadctx;
 
        (*be->be_search)( be, conn, &op, /*base=*/NULL, &searchbase,
           scope, /*deref=*/1, /*sizelimit=*/0, /*time=*/0, filter, /*fstr=*/NULL,
           /*attrs=*/NULL, /*attrsonly=*/0 );
 
-       if (sm.match)
+       if (sm.match) {
                rc = LDAP_SUCCESS;
-       else
+       } else {
                rc = LDAP_INAPPROPRIATE_AUTH;
+       }
 
 CONCLUDED:
        if( searchbase.bv_len ) ch_free( searchbase.bv_val );
        if( filter ) filter_free( filter );
+
 #ifdef NEW_LOGGING
        LDAP_LOG( TRANSPORT, ENTRY, 
                "slap_sasl_match: comparison returned %d\n", rc, 0, 0 );
@@ -518,14 +533,12 @@ slap_sasl_check_authz( Connection *conn,
 
        rc = backend_attribute( NULL, NULL, conn->c_sasl_bindop, NULL,
                searchDN, ad, &vals );
-       if( rc != LDAP_SUCCESS )
-               goto COMPLETE;
+       if( rc != LDAP_SUCCESS ) goto COMPLETE;
 
        /* Check if the *assertDN matches any **vals */
        for( i=0; vals[i].bv_val != NULL; i++ ) {
                rc = slap_sasl_match( conn, &vals[i], assertDN, authc );
-               if ( rc == LDAP_SUCCESS )
-                       goto COMPLETE;
+               if ( rc == LDAP_SUCCESS ) goto COMPLETE;
        }
        rc = LDAP_INAPPROPRIATE_AUTH;
 
@@ -562,7 +575,7 @@ void slap_sasl2dn( Connection *conn,
        int scope = LDAP_SCOPE_BASE;
        Filter *filter = NULL;
        slap_callback cb = { slap_cb_null_response,
-               slap_cb_null_sresult, sasl_sc_sasl2dn, NULL};
+               slap_cb_null_sresult, sasl_sc_sasl2dn, slap_cb_null_sreference, NULL};
        Operation op = {0};
        struct berval regout = { 0, NULL };
 
@@ -586,6 +599,7 @@ void slap_sasl2dn( Connection *conn,
        }
 
        rc = slap_parseURI( &regout, &dn, &scope, &filter );
+       if( regout.bv_val ) ch_free( regout.bv_val );
        if( rc != LDAP_SUCCESS ) {
                goto FINISHED;
        }
@@ -614,7 +628,6 @@ void slap_sasl2dn( Connection *conn,
        if(( be == NULL ) || ( be->be_search == NULL)) {
                goto FINISHED;
        }
-       suffix_alias( be, &dn );
 
        op.o_tag = LDAP_REQ_SEARCH;
        op.o_protocol = LDAP_VERSION3;
@@ -622,7 +635,9 @@ void slap_sasl2dn( Connection *conn,
        op.o_callback = &cb;
        op.o_time = slap_get_time();
        op.o_do_not_cache = 1;
-       op.o_threadctx = conn->c_sasl_bindop->o_threadctx;
+       op.o_is_auth_check = 1;
+       op.o_threadctx = conn->c_sasl_bindop ? conn->c_sasl_bindop->o_threadctx:
+               ldap_pvt_thread_pool_context( &connection_pool );
 
        (*be->be_search)( be, conn, &op, NULL, &dn,
                scope, LDAP_DEREF_NEVER, 1, 0,
@@ -679,6 +694,12 @@ int slap_sasl_authorized( Connection *conn,
                goto DONE;
        }
 
+       /* Allow the manager to authorize as any DN. */
+       if( conn->c_authz_backend && be_isroot( conn->c_authz_backend, authcDN )) {
+               rc = LDAP_SUCCESS;
+               goto DONE;
+       }
+
        /* Check source rules */
        if( authz_policy & SASL_AUTHZ_TO ) {
                rc = slap_sasl_check_authz( conn, authcDN, authzDN,