#include "portable.h"
-#include <ac/stdlib.h>
#include <stdio.h>
+#include <ac/stdlib.h>
#include <ac/string.h>
#include "slap.h"
#include <ldap_pvt.h>
#endif
-/* URI format: ldap://<host>/<base>[?[<attrs>][?[<scope>][?[<filter>]]]] */
+/* URI format: ldap://<host>/<base>[?[<attrs>][?[<scope>][?[<filter>]]]] */
-int slap_parseURI( char *uri, struct berval *searchbase, int *scope, Filter **filter )
+static int slap_parseURI( char *uri,
+ struct berval *searchbase, int *scope, Filter **filter )
{
char *start, *end;
- struct berval bv, *nbase = NULL;
+ struct berval bv;
int rc;
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_parseURI: parsing %s\n", uri ));
+ "slap_parseURI: parsing %s\n", uri ));
#else
Debug( LDAP_DEBUG_TRACE, "slap_parseURI: parsing %s\n", uri, 0, 0 );
#endif
-
/* If it does not look like a URI, assume it is a DN */
- if( !strncasecmp( uri, "dn:", 3 ) ) {
- uri += 3;
+ if( !strncasecmp( uri, "dn:", sizeof("dn:")-1 ) ) {
+ uri += sizeof("dn:")-1;
uri += strspn( uri, " " );
bv.bv_val = uri;
/* FIXME: if dnNormalize actually uses input bv_len we
* will have to make this right.
*/
is_dn: bv.bv_len = 1;
- rc = dnNormalize( NULL, &bv, &nbase );
+ rc = dnNormalize2( NULL, &bv, searchbase );
if (rc == LDAP_SUCCESS) {
*scope = LDAP_SCOPE_BASE;
- *searchbase = *nbase;
- free( nbase );
}
return( rc );
}
- if( strncasecmp( uri, "ldap://", 7 ) ) {
+
+ /* FIXME: should use ldap_url_parse() */
+ if( strncasecmp( uri, "ldap://", sizeof("ldap://")-1 ) ) {
bv.bv_val = uri;
goto is_dn;
}
- end = strchr( uri + 7, '/' );
+ end = strchr( uri + (sizeof("ldap://")-1), '/' );
if ( end == NULL )
return( LDAP_PROTOCOL_ERROR );
bv.bv_val = start;
if( end == NULL ) {
bv.bv_len = 1;
- rc = dnNormalize( NULL, &bv, &nbase );
- if (rc == LDAP_SUCCESS) {
- *searchbase = *nbase;
- free( nbase );
- }
- return( rc );
+ return dnNormalize2( NULL, &bv, searchbase );
}
*end = '\0';
bv.bv_len = end - start;
- rc = dnNormalize( NULL, &bv, &nbase );
+ rc = dnNormalize2( NULL, &bv, searchbase );
*end = '?';
if (rc != LDAP_SUCCESS)
return( rc );
- *searchbase = *nbase;
- free( nbase );
/* Skip the attrs */
start = end+1;
/* Grab the scope */
start = end+1;
- if( !strncasecmp( start, "base?", 5 )) {
+ if( !strncasecmp( start, "base?", sizeof("base?")-1 )) {
*scope = LDAP_SCOPE_BASE;
- start += 5;
+ start += sizeof("base?")-1;
}
- else if( !strncasecmp( start, "one?", 4 )) {
+ else if( !strncasecmp( start, "one?", sizeof("one?")-1 )) {
*scope = LDAP_SCOPE_ONELEVEL;
- start += 4;
+ start += sizeof("one?")-1;
}
- else if( !strncasecmp( start, "sub?", 3 )) {
+ else if( !strncasecmp( start, "sub?", sizeof("sub?")-1 )) {
*scope = LDAP_SCOPE_SUBTREE;
- start += 4;
+ start += sizeof("sub?")-1;
}
else {
free( searchbase->bv_val );
}
-
-
-
int slap_sasl_regexp_config( const char *match, const char *replace )
{
#ifdef HAVE_CYRUS_SASL
}
-
-
-
#ifdef HAVE_CYRUS_SASL
-
-
/* Take the passed in SASL name and attempt to convert it into an
LDAP URI to find the matching LDAP entry, using the pattern matching
strings given in the saslregexp config file directive(s) */
int i, n, len, insert;
SaslRegexp_t *reg;
-
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_regexp: converting SASL name %s\n", saslname ));
+ "slap_sasl_regexp: converting SASL name %s\n", saslname ));
#else
Debug( LDAP_DEBUG_TRACE, "slap_sasl_regexp: converting SASL name %s\n",
saslname, 0, 0 );
uri[insert] = '\0';
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_regexp: converted SASL name to %s\n", uri ));
+ "slap_sasl_regexp: converted SASL name to %s\n", uri ));
#else
Debug( LDAP_DEBUG_TRACE,
"slap_sasl_regexp: converted SASL name to %s\n", uri, 0, 0 );
char *uri=NULL;
struct berval searchbase = {0, NULL};
struct berval dn = {0, NULL};
- struct berval *ndn = NULL;
+ struct berval ndn;
int rc, scope;
Backend *be;
Filter *filter=NULL;
if( rc != LDAP_SUCCESS )
goto FINISHED;
- (*be->be_search)( be, conn, conn->c_ops, /*base*/NULL, &searchbase,
+ (*be->be_search)( be, conn, LDAP_STAILQ_FIRST(&conn->c_ops), /*base*/NULL, &searchbase,
scope, /*deref=*/1, /*sizelimit=*/1, /*time=*/0, filter, /*fstr=*/NULL,
/*attrs=*/NULL, /*attrsonly=*/0 );
dn.bv_val = ldap_get_dn( client, msg );
dn.bv_len = dn.bv_val ? strlen( dn.bv_val ) : 0;
if( dn.bv_val ) {
- rc = dnNormalize( NULL, &dn, &ndn );
+ rc = dnNormalize2( NULL, &dn, &ndn );
ldap_memfree( dn.bv_val );
if( rc != LDAP_SUCCESS ) {
dn.bv_val = NULL;
dn.bv_len = 0;
goto FINISHED;
}
- dn = *ndn;
- free( ndn );
+ dn = ndn;
}
FINISHED:
if( rc != LDAP_SUCCESS )
goto CONCLUDED;
- (*be->be_search)( be, conn, conn->c_ops, /*base=*/NULL, &searchbase,
+ (*be->be_search)( be, conn, LDAP_STAILQ_FIRST(&conn->c_ops), /*base=*/NULL, &searchbase,
scope, /*deref=*/1, /*sizelimit=*/0, /*time=*/0, filter, /*fstr=*/NULL,
/*attrs=*/NULL, /*attrsonly=*/0 );
dn.bv_val = ldap_get_dn( client, msg );
if( dn.bv_val ) {
- struct berval *ndn = NULL;
+ struct berval ndn;
dn.bv_len = strlen( dn.bv_val );
- rc = dnNormalize( NULL, &dn, &ndn );
+ rc = dnNormalize2( NULL, &dn, &ndn );
ldap_memfree( dn.bv_val );
if( rc != LDAP_SUCCESS ) {
goto CONCLUDED;
}
- rc = strcmp( ndn->bv_val, assertDN );
- ber_bvfree( ndn );
+ rc = strcmp( ndn.bv_val, assertDN );
+ free( ndn.bv_val );
if( rc == 0 ) {
rc = LDAP_SUCCESS;
goto CONCLUDED;
}
-
-
-
/*
* This function answers the question, "Can this ID authorize to that ID?",
* based on authorization rules. The rules are stored in the *searchDN, in the
*
* DN's passed in should have a dn: prefix
*/
-
static int
slap_sasl_check_authz(char *searchDN, char *assertDN, char *attr, char *authc)
{
const char *errmsg;
int i, rc;
- struct berval **vals=NULL;
+ BVarray vals=NULL;
AttributeDescription *ad=NULL;
struct berval bv;
-
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
"slap_sasl_check_authz: does %s match %s rule in %s?\n",
goto COMPLETE;
/* Check if the *assertDN matches any **vals */
- for( i=0; vals[i] != NULL; i++ ) {
- rc = slap_sasl_match( vals[i]->bv_val, assertDN+3, authc );
+ for( i=0; vals[i].bv_val != NULL; i++ ) {
+ rc = slap_sasl_match( vals[i].bv_val, assertDN+3, authc );
if ( rc == LDAP_SUCCESS )
goto COMPLETE;
}
rc = LDAP_INAPPROPRIATE_AUTH;
COMPLETE:
- if( vals ) ber_bvecfree( vals );
+ if( vals ) bvarray_free( vals );
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
return( rc );
}
-
-
-
#endif /* HAVE_CYRUS_SASL */
-
-
-
/* Check if a bind can SASL authorize to another identity.
Accepts authorization DN's with "dn:" prefix */
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_authorized: can %s become %s?\n", authcDN, authzDN ));
+ "slap_sasl_authorized: can %s become %s?\n", authcDN, authzDN ));
#else
Debug( LDAP_DEBUG_TRACE,
"==>slap_sasl_authorized: can %s become %s?\n", authcDN, authzDN, 0 );
#endif
-
/* If person is authorizing to self, succeed */
if ( !strcmp( authcDN, authzDN ) ) {
rc = LDAP_SUCCESS;
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_authorized: return %d\n", rc ));
+ "slap_sasl_authorized: return %d\n", rc ));
#else
- Debug( LDAP_DEBUG_TRACE, "<== slap_sasl_authorized: return %d\n",rc,0,0 );
+ Debug( LDAP_DEBUG_TRACE,
+ "<== slap_sasl_authorized: return %d\n", rc, 0, 0 );
#endif
return( rc );