#include "portable.h"
-#include <ac/stdlib.h>
#include <stdio.h>
-#include "slap.h"
-#include "proto-slap.h"
-
+#include <ac/stdlib.h>
#include <ac/string.h>
+#include "slap.h"
+
#ifdef HAVE_CYRUS_SASL
#include <limits.h>
#include <sasl.h>
#include <ldap_pvt.h>
#endif
+/* URI format: ldap://<host>/<base>[?[<attrs>][?[<scope>][?[<filter>]]]] */
-
-
-
-/* URI format: ldap://<host>/<base>[?[<attrs>][?[<scope>][?[<filter>]]]] */
-
-int slap_parseURI( char *uri, char **searchbase, int *scope, Filter **filter )
+static int slap_parseURI( char *uri,
+ struct berval *searchbase, int *scope, Filter **filter )
{
char *start, *end;
+ struct berval bv;
+ int rc;
assert( uri != NULL );
- *searchbase = NULL;
+ searchbase->bv_val = NULL;
+ searchbase->bv_len = 0;
*scope = -1;
*filter = NULL;
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_parseURI: parsing %s\n", uri ));
+ "slap_parseURI: parsing %s\n", uri ));
#else
Debug( LDAP_DEBUG_TRACE, "slap_parseURI: parsing %s\n", uri, 0, 0 );
#endif
-
/* If it does not look like a URI, assume it is a DN */
- if( !strncasecmp( uri, "dn:", 3 ) ) {
- uri += 3;
+ if( !strncasecmp( uri, "dn:", sizeof("dn:")-1 ) ) {
+ uri += sizeof("dn:")-1;
uri += strspn( uri, " " );
- *searchbase = ch_strdup( uri );
- dn_normalize( *searchbase );
- *scope = LDAP_SCOPE_BASE;
- return( LDAP_SUCCESS );
+ bv.bv_val = uri;
+ /* FIXME: if dnNormalize actually uses input bv_len we
+ * will have to make this right.
+ */
+is_dn: bv.bv_len = 1;
+ rc = dnNormalize2( NULL, &bv, searchbase );
+ if (rc == LDAP_SUCCESS) {
+ *scope = LDAP_SCOPE_BASE;
+ }
+ return( rc );
}
- if( strncasecmp( uri, "ldap://", 7 ) ) {
- *searchbase = ch_strdup( uri );
- dn_normalize( *searchbase );
- *scope = LDAP_SCOPE_BASE;
- return( LDAP_SUCCESS );
+
+ /* FIXME: should use ldap_url_parse() */
+ if( strncasecmp( uri, "ldap://", sizeof("ldap://")-1 ) ) {
+ bv.bv_val = uri;
+ goto is_dn;
}
- end = strchr( uri + 7, '/' );
+ end = strchr( uri + (sizeof("ldap://")-1), '/' );
if ( end == NULL )
return( LDAP_PROTOCOL_ERROR );
/* Grab the searchbase */
start = end+1;
end = strchr( start, '?' );
+ bv.bv_val = start;
if( end == NULL ) {
- *searchbase = ch_strdup( start );
- dn_normalize( *searchbase );
- return( LDAP_SUCCESS );
+ bv.bv_len = 1;
+ return dnNormalize2( NULL, &bv, searchbase );
}
*end = '\0';
- *searchbase = ch_strdup( start );
+ bv.bv_len = end - start;
+ rc = dnNormalize2( NULL, &bv, searchbase );
*end = '?';
- dn_normalize( *searchbase );
+ if (rc != LDAP_SUCCESS)
+ return( rc );
/* Skip the attrs */
start = end+1;
/* Grab the scope */
start = end+1;
- if( !strncasecmp( start, "base?", 5 )) {
+ if( !strncasecmp( start, "base?", sizeof("base?")-1 )) {
*scope = LDAP_SCOPE_BASE;
- start += 5;
+ start += sizeof("base?")-1;
}
- else if( !strncasecmp( start, "one?", 4 )) {
+ else if( !strncasecmp( start, "one?", sizeof("one?")-1 )) {
*scope = LDAP_SCOPE_ONELEVEL;
- start += 4;
+ start += sizeof("one?")-1;
}
- else if( !strncasecmp( start, "sub?", 3 )) {
+ else if( !strncasecmp( start, "sub?", sizeof("sub?")-1 )) {
*scope = LDAP_SCOPE_SUBTREE;
- start += 4;
+ start += sizeof("sub?")-1;
}
else {
- ch_free( *searchbase );
- *searchbase = NULL;
+ free( searchbase->bv_val );
+ searchbase->bv_val = NULL;
return( LDAP_PROTOCOL_ERROR );
}
}
-
-
-
int slap_sasl_regexp_config( const char *match, const char *replace )
{
#ifdef HAVE_CYRUS_SASL
if ( rc ) {
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
- "slap_sasl_regexp_config: \"%s\" could not be compiled.\n"
+ "slap_sasl_regexp_config: \"%s\" could not be compiled.\n",
reg->match ));
#else
Debug( LDAP_DEBUG_ANY,
}
-
-
-
#ifdef HAVE_CYRUS_SASL
-
-
/* Take the passed in SASL name and attempt to convert it into an
LDAP URI to find the matching LDAP entry, using the pattern matching
strings given in the saslregexp config file directive(s) */
int i, n, len, insert;
SaslRegexp_t *reg;
-
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_regexp: converting SASL name %s\n", saslname ));
+ "slap_sasl_regexp: converting SASL name %s\n", saslname ));
#else
Debug( LDAP_DEBUG_TRACE, "slap_sasl_regexp: converting SASL name %s\n",
saslname, 0, 0 );
uri[insert] = '\0';
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_regexp: converted SASL name to %s\n", uri ));
+ "slap_sasl_regexp: converted SASL name to %s\n", uri ));
#else
Debug( LDAP_DEBUG_TRACE,
"slap_sasl_regexp: converted SASL name to %s\n", uri, 0, 0 );
return( uri );
}
+/* Two empty callback functions to avoid sending results */
+static void sasl_sc_r( Connection *conn, Operation *o, ber_tag_t tag,
+ ber_int_t msgid, ber_int_t err, const char *matched,
+ const char *text, BerVarray ref, const char *resoid,
+ struct berval *resdata, struct berval *sasldata, LDAPControl **c)
+{
+}
+static void sasl_sc_s( Connection *conn, Operation *o, ber_int_t err,
+ const char *matched, const char *text, BerVarray refs, LDAPControl **c,
+ int nentries)
+{
+}
+/* This callback actually does some work...*/
+static int sasl_sc_sasl2dn( BackendDB *be, Connection *conn, Operation *o,
+ Entry *e, AttributeName *an, int ao, LDAPControl **c)
+{
+ struct berval *ndn = o->o_callback->sc_private;
+ /* We only want to be called once */
+ if (ndn->bv_val) {
+ free(ndn->bv_val);
+ ndn->bv_val = NULL;
+#ifdef NEW_LOGGING
+ LDAP_LOG(( "sasl", LDAP_LEVEL_DETAIL1,
+ "slap_sasl2dn: search DN returned more than 1 entry\n" ));
+#else
+ Debug( LDAP_DEBUG_TRACE,
+ "slap_sasl2dn: search DN returned more than 1 entry\n", 0,0,0 );
+#endif
+ return -1;
+ } else {
+ ber_dupbv(ndn, &e->e_nname);
+ return 0;
+ }
+}
/*
* Given a SASL name (e.g. "UID=name,cn=REALM,cn=MECH,cn=AUTH")
char *slap_sasl2dn( char *saslname )
{
- char *uri=NULL, *searchbase=NULL, *DN=NULL;
+ char *uri=NULL;
+ struct berval searchbase = {0, NULL};
+ struct berval dn = {0, NULL};
int rc, scope;
Backend *be;
Filter *filter=NULL;
- Connection *conn=NULL;
- LDAP *client=NULL;
- LDAPMessage *res=NULL, *msg;
-
+ slap_callback cb = {sasl_sc_r, sasl_sc_s, sasl_sc_sasl2dn, &dn};
+ Operation op = {0};
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl2dn: converting SASL name %s to DN.\n", saslname ));
+ "slap_sasl2dn: converting SASL name %s to DN.\n", saslname ));
#else
Debug( LDAP_DEBUG_TRACE,
- "==>slap_sasl2dn: Converting SASL name %s to a DN\n", saslname, 0,0 );
+ "==>slap_sasl2dn: Converting SASL name %s to a DN\n", saslname, 0,0 );
#endif
-
/* Convert the SASL name into an LDAP URI */
uri = slap_sasl_regexp( saslname );
if( uri == NULL )
goto FINISHED;
rc = slap_parseURI( uri, &searchbase, &scope, &filter );
- if( rc )
+ if( rc ) {
goto FINISHED;
+ }
/* Massive shortcut: search scope == base */
if( scope == LDAP_SCOPE_BASE ) {
- DN = ch_strdup( searchbase );
+ dn = searchbase;
+ searchbase.bv_len = 0;
+ searchbase.bv_val = NULL;
goto FINISHED;
}
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_DETAIL1,
- "slap_sasl2dn: performing internal search (base=%s, scope=%s)\n",
- searchbase, scope ));
+ "slap_sasl2dn: performing internal search (base=%s, scope=%d)\n",
+ searchbase.bv_val, scope ));
#else
Debug( LDAP_DEBUG_TRACE,
"slap_sasl2dn: performing internal search (base=%s, scope=%d)\n",
- searchbase, scope, 0 );
+ searchbase.bv_val, scope, 0 );
#endif
-
- be = select_backend( searchbase, 0 );
+ be = select_backend( &searchbase, 0, 1 );
if(( be == NULL ) || ( be->be_search == NULL))
goto FINISHED;
- searchbase = suffix_alias( be, searchbase );
+ suffix_alias( be, &searchbase );
- rc = connection_internal_open( &conn, &client, saslname );
- if( rc != LDAP_SUCCESS )
- goto FINISHED;
+ ldap_pvt_thread_mutex_init( &op.o_abandonmutex );
+ op.o_tag = LDAP_REQ_SEARCH;
+ op.o_protocol = LDAP_VERSION3;
+ op.o_ndn.bv_val = saslname;
+ op.o_ndn.bv_len = strlen(saslname);
+ op.o_callback = &cb;
+ op.o_time = slap_get_time();
- (*be->be_search)( be, conn, conn->c_ops, /*base=*/NULL, searchbase,
+ (*be->be_search)( be, /*conn*/NULL, &op, /*base*/NULL, &searchbase,
scope, /*deref=*/1, /*sizelimit=*/1, /*time=*/0, filter, /*fstr=*/NULL,
/*attrs=*/NULL, /*attrsonly=*/0 );
-
-
- /* Read the client side of the internal search */
- rc = ldap_result( client, LDAP_RES_ANY, LDAP_MSG_ALL, NULL, &res );
- if( rc == -1 )
- goto FINISHED;
-
- /* Make sure exactly one entry was returned */
- rc = ldap_count_entries( client, res );
-#ifdef NEW_LOGGING
- LDAP_LOG(( "sasl", LDAP_LEVEL_DETAIL1,
- "slap_sasl2dn: search DN returned %d entries\n", rc ));
-#else
- Debug( LDAP_DEBUG_TRACE,
- "slap_sasl2dn: search DN returned %d entries\n", rc,0,0 );
-#endif
-
- if( rc != 1 )
- goto FINISHED;
-
- msg = ldap_first_entry( client, res );
- DN = ldap_get_dn( client, msg );
+
+ ldap_pvt_thread_mutex_destroy( &op.o_abandonmutex );
FINISHED:
- if( searchbase ) ch_free( searchbase );
+ if( searchbase.bv_len ) ch_free( searchbase.bv_val );
if( filter ) filter_free( filter );
if( uri ) ch_free( uri );
- if( conn ) connection_internal_close( conn );
- if( res ) ldap_msgfree( res );
- if( client ) ldap_unbind( client );
- if( DN ) dn_normalize( DN );
+
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl2dn: Converted SASL name to %s\n", DN ? DN : "<nothing>" ));
+ "slap_sasl2dn: Converted SASL name to %s\n",
+ dn.bv_len ? dn.bv_val : "<nothing>" ));
#else
Debug( LDAP_DEBUG_TRACE, "<==slap_sasl2dn: Converted SASL name to %s\n",
- DN ? DN : "<nothing>", 0, 0 );
+ dn.bv_len ? dn.bv_val : "<nothing>", 0, 0 );
#endif
- return( DN );
+ return( dn.bv_val );
}
+typedef struct smatch_info {
+ struct berval *dn;
+ int match;
+} smatch_info;
+static int sasl_sc_smatch( BackendDB *be, Connection *conn, Operation *o,
+ Entry *e, AttributeName *an, int ao, LDAPControl **c)
+{
+ smatch_info *sm = o->o_callback->sc_private;
-
+ if (dn_match(sm->dn, &e->e_nname)) {
+ sm->match = 1;
+ return -1; /* short-circuit the search */
+ } else {
+ return 1;
+ }
+}
/*
* Map a SASL regexp rule to a DN. If the rule is just a DN or a scope=base
*/
static
-int slap_sasl_match( char *rule, char *assertDN, char *authc )
+int slap_sasl_match( char *rule, struct berval *assertDN, char *authc )
{
- char *searchbase=NULL, *dn=NULL;
+ struct berval searchbase = {0, NULL};
int rc, scope;
Backend *be;
Filter *filter=NULL;
- Connection *conn=NULL;
- LDAP *client=NULL;
- LDAPMessage *res=NULL, *msg;
regex_t reg;
-
+ smatch_info sm;
+ slap_callback cb = {sasl_sc_r, sasl_sc_s, sasl_sc_smatch, &sm};
+ Operation op = {0};
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_match: comparing DN %s to rule %s\n", assertDN, rule );
+ "slap_sasl_match: comparing DN %s to rule %s\n", assertDN->bv_val, rule ));
#else
Debug( LDAP_DEBUG_TRACE,
- "===>slap_sasl_match: comparing DN %s to rule %s\n", assertDN, rule, 0 );
+ "===>slap_sasl_match: comparing DN %s to rule %s\n", assertDN->bv_val, rule, 0 );
#endif
-
rc = slap_parseURI( rule, &searchbase, &scope, &filter );
if( rc != LDAP_SUCCESS )
goto CONCLUDED;
/* Massive shortcut: search scope == base */
if( scope == LDAP_SCOPE_BASE ) {
- dn_normalize( searchbase );
- rc = regcomp(®, searchbase, REG_EXTENDED|REG_ICASE|REG_NOSUB);
+ rc = regcomp(®, searchbase.bv_val,
+ REG_EXTENDED|REG_ICASE|REG_NOSUB);
if ( rc == 0 ) {
- rc = regexec(®, assertDN, 0, NULL, 0);
+ rc = regexec(®, assertDN->bv_val, 0, NULL, 0);
regfree( ® );
}
if ( rc == 0 )
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_DETAIL1,
- "slap_sasl_match: performing internal search (base=%s, scope=%d)\n",
- searchbase, scope ));
+ "slap_sasl_match: performing internal search (base=%s, scope=%d)\n",
+ searchbase.bv_val, scope ));
#else
Debug( LDAP_DEBUG_TRACE,
"slap_sasl_match: performing internal search (base=%s, scope=%d)\n",
- searchbase, scope, 0 );
+ searchbase.bv_val, scope, 0 );
#endif
-
- be = select_backend( searchbase, 0 );
+ be = select_backend( &searchbase, 0, 1 );
if(( be == NULL ) || ( be->be_search == NULL)) {
rc = LDAP_INAPPROPRIATE_AUTH;
goto CONCLUDED;
}
- searchbase = suffix_alias( be, searchbase );
+ suffix_alias( be, &searchbase );
- /* Make an internal connection on which to run the search */
- rc = connection_internal_open( &conn, &client, authc );
- if( rc != LDAP_SUCCESS )
- goto CONCLUDED;
+ sm.dn = assertDN;
+ sm.match = 0;
- (*be->be_search)( be, conn, conn->c_ops, /*base=*/NULL, searchbase,
+ ldap_pvt_thread_mutex_init( &op.o_abandonmutex );
+ op.o_tag = LDAP_REQ_SEARCH;
+ op.o_protocol = LDAP_VERSION3;
+ op.o_ndn.bv_val = authc;
+ op.o_ndn.bv_len = strlen(authc);
+ op.o_callback = &cb;
+ op.o_time = slap_get_time();
+
+ (*be->be_search)( be, /*conn=*/NULL, &op, /*base=*/NULL, &searchbase,
scope, /*deref=*/1, /*sizelimit=*/0, /*time=*/0, filter, /*fstr=*/NULL,
/*attrs=*/NULL, /*attrsonly=*/0 );
+ ldap_pvt_thread_mutex_destroy( &op.o_abandonmutex );
- /* On the client side of the internal search, read the results. Check
- if the assertDN matches any of the DN's returned by the search */
- rc = ldap_result( client, LDAP_RES_ANY, LDAP_MSG_ALL, NULL, &res );
- if( rc == -1 )
- goto CONCLUDED;
-
- for( msg=ldap_first_entry( client, res );
- msg;
- msg=ldap_next_entry( client, msg ) ) {
- dn = ldap_get_dn( client, msg );
- dn_normalize( dn );
- rc = strcmp( dn, assertDN );
- ch_free( dn );
- if( rc == 0 ) {
- rc = LDAP_SUCCESS;
- goto CONCLUDED;
- }
- }
- rc = LDAP_INAPPROPRIATE_AUTH;
+ if (sm.match)
+ rc = LDAP_SUCCESS;
+ else
+ rc = LDAP_INAPPROPRIATE_AUTH;
CONCLUDED:
- if( searchbase ) ch_free( searchbase );
+ if( searchbase.bv_len ) ch_free( searchbase.bv_val );
if( filter ) filter_free( filter );
- if( conn ) connection_internal_close( conn );
- if( res ) ldap_msgfree( res );
- if( client ) ldap_unbind( client );
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
"slap_sasl_match: comparison returned %d\n", rc ));
}
-
-
-
/*
* This function answers the question, "Can this ID authorize to that ID?",
* based on authorization rules. The rules are stored in the *searchDN, in the
*
* DN's passed in should have a dn: prefix
*/
-
static int
-slap_sasl_check_authz(char *searchDN, char *assertDN, char *attr, char *authc)
+slap_sasl_check_authz(char *searchDN, char *assertDN, struct berval *attr, char *authc)
{
const char *errmsg;
int i, rc;
- struct berval **vals=NULL;
+ BerVarray vals=NULL;
AttributeDescription *ad=NULL;
-
+ struct berval bv;
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
"slap_sasl_check_authz: does %s match %s rule in %s?\n",
- assertDN, attr, searchDN ));
+ assertDN, attr->bv_val, searchDN ));
#else
Debug( LDAP_DEBUG_TRACE,
"==>slap_sasl_check_authz: does %s match %s rule in %s?\n",
- assertDN, attr, searchDN);
+ assertDN, attr->bv_val, searchDN);
#endif
- rc = slap_str2ad( attr, &ad, &errmsg );
+ rc = slap_bv2ad( attr, &ad, &errmsg );
if( rc != LDAP_SUCCESS )
goto COMPLETE;
- rc = backend_attribute( NULL, NULL, NULL, NULL, searchDN+3, ad, &vals );
+ bv.bv_val = searchDN+3;
+ bv.bv_len = strlen(bv.bv_val);
+ rc = backend_attribute( NULL, NULL, NULL, NULL, &bv, ad, &vals );
if( rc != LDAP_SUCCESS )
goto COMPLETE;
+ bv.bv_val = assertDN+3;
+ bv.bv_len = strlen(bv.bv_val);
/* Check if the *assertDN matches any **vals */
- for( i=0; vals[i] != NULL; i++ ) {
- rc = slap_sasl_match( vals[i]->bv_val, assertDN+3, authc );
+ for( i=0; vals[i].bv_val != NULL; i++ ) {
+ rc = slap_sasl_match( vals[i].bv_val, &bv, authc );
if ( rc == LDAP_SUCCESS )
goto COMPLETE;
}
rc = LDAP_INAPPROPRIATE_AUTH;
COMPLETE:
- if( vals ) ber_bvecfree( vals );
- if( ad ) ad_free( ad, 1 );
+ if( vals ) ber_bvarray_free( vals );
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_check_authz: %s check returning %s\n", attr, rc ));
+ "slap_sasl_check_authz: %s check returning %s\n", attr->bv_val, rc ));
#else
Debug( LDAP_DEBUG_TRACE,
- "<==slap_sasl_check_authz: %s check returning %d\n", attr, rc, 0);
+ "<==slap_sasl_check_authz: %s check returning %d\n", attr->bv_val, rc, 0);
#endif
return( rc );
}
-
-
-
#endif /* HAVE_CYRUS_SASL */
-
-
-
/* Check if a bind can SASL authorize to another identity.
Accepts authorization DN's with "dn:" prefix */
+static struct berval sasl_authz_src = {
+ sizeof(SASL_AUTHZ_SOURCE_ATTR)-1, SASL_AUTHZ_SOURCE_ATTR };
+
+static struct berval sasl_authz_dst = {
+ sizeof(SASL_AUTHZ_DEST_ATTR)-1, SASL_AUTHZ_DEST_ATTR };
+
int slap_sasl_authorized( char *authcDN, char *authzDN )
{
- int rc;
+ int rc = LDAP_INAPPROPRIATE_AUTH;
#ifdef HAVE_CYRUS_SASL
/* User binding as anonymous */
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_authorized: can %s become %s?\n", authcDN, authzDN ));
+ "slap_sasl_authorized: can %s become %s?\n", authcDN, authzDN ));
#else
Debug( LDAP_DEBUG_TRACE,
"==>slap_sasl_authorized: can %s become %s?\n", authcDN, authzDN, 0 );
#endif
-
/* If person is authorizing to self, succeed */
if ( !strcmp( authcDN, authzDN ) ) {
rc = LDAP_SUCCESS;
}
/* Check source rules */
- rc = slap_sasl_check_authz( authcDN, authzDN, SASL_AUTHZ_SOURCE_ATTR,
+ rc = slap_sasl_check_authz( authcDN, authzDN, &sasl_authz_src,
authcDN );
- if( rc == LDAP_SUCCESS )
+ if( rc == LDAP_SUCCESS ) {
goto DONE;
+ }
/* Check destination rules */
- rc = slap_sasl_check_authz( authzDN, authcDN, SASL_AUTHZ_DEST_ATTR,
+ rc = slap_sasl_check_authz( authzDN, authcDN, &sasl_authz_dst,
authcDN );
- if( rc == LDAP_SUCCESS )
+ if( rc == LDAP_SUCCESS ) {
goto DONE;
+ }
-#endif
rc = LDAP_INAPPROPRIATE_AUTH;
DONE:
+#endif
+
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_authorized: return %s\n", rc ));
+ "slap_sasl_authorized: return %d\n", rc ));
#else
- Debug( LDAP_DEBUG_TRACE, "<== slap_sasl_authorized: return %d\n",rc,0,0 );
+ Debug( LDAP_DEBUG_TRACE,
+ "<== slap_sasl_authorized: return %d\n", rc, 0, 0 );
#endif
return( rc );
projects / openldap / blobdiff