+/*
+ * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
+ * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
+ */
/*
* Copyright (c) 2000, Mark Adamson, Carnegie Mellon. All rights reserved.
* This software is not subject to any license of Carnegie Mellon University.
#include "portable.h"
-#include <ac/stdlib.h>
#include <stdio.h>
+#include <ac/stdlib.h>
#include <ac/string.h>
#include "slap.h"
#ifdef HAVE_CYRUS_SASL
#include <limits.h>
+
+#ifdef HAVE_SASL_SASL_H
+#include <sasl/sasl.h>
+#else
#include <sasl.h>
-#include <ldap_pvt.h>
#endif
-/* URI format: ldap://<host>/<base>[?[<attrs>][?[<scope>][?[<filter>]]]] */
+#include <ldap_pvt.h>
+
+#define SASLREGEX_REPLACE 10
+
+typedef struct sasl_regexp {
+ char *sr_match; /* regexp match pattern */
+ char *sr_replace; /* regexp replace pattern */
+ regex_t sr_workspace; /* workspace for regexp engine */
+ regmatch_t sr_strings[SASLREGEX_REPLACE]; /* strings matching $1,$2 ... */
+ int sr_offset[SASLREGEX_REPLACE+2]; /* offsets of $1,$2... in *replace */
+} SaslRegexp_t;
+
+static int nSaslRegexp = 0;
+static SaslRegexp_t *SaslRegexp = NULL;
-int slap_parseURI( char *uri, char **searchbase, int *scope, Filter **filter )
+/* What SASL proxy authorization policies are allowed? */
+#define SASL_AUTHZ_NONE 0
+#define SASL_AUTHZ_FROM 1
+#define SASL_AUTHZ_TO 2
+
+static int authz_policy = SASL_AUTHZ_NONE;
+
+int slap_sasl_setpolicy( const char *arg )
{
- char *start, *end;
+ int rc = LDAP_SUCCESS;
+
+ if ( strcasecmp( arg, "none" ) == 0 )
+ authz_policy = SASL_AUTHZ_NONE;
+ else if ( strcasecmp( arg, "from" ) == 0 )
+ authz_policy = SASL_AUTHZ_FROM;
+ else if ( strcasecmp( arg, "to" ) == 0 )
+ authz_policy = SASL_AUTHZ_TO;
+ else if ( strcasecmp( arg, "both" ) == 0 )
+ authz_policy = SASL_AUTHZ_FROM | SASL_AUTHZ_TO;
+ else
+ rc = LDAP_OTHER;
+ return rc;
+}
+/* URI format: ldap://<host>/<base>[?[<attrs>][?[<scope>][?[<filter>]]]] */
- assert( uri != NULL );
- *searchbase = NULL;
+static int slap_parseURI( struct berval *uri,
+ struct berval *searchbase, int *scope, Filter **filter )
+{
+ struct berval bv;
+ int rc;
+ LDAPURLDesc *ludp;
+
+ assert( uri != NULL && uri->bv_val != NULL );
+ searchbase->bv_val = NULL;
+ searchbase->bv_len = 0;
*scope = -1;
*filter = NULL;
#ifdef NEW_LOGGING
- LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_parseURI: parsing %s\n", uri ));
+ LDAP_LOG( TRANSPORT, ENTRY,
+ "slap_parseURI: parsing %s\n", uri->bv_val, 0, 0 );
#else
- Debug( LDAP_DEBUG_TRACE, "slap_parseURI: parsing %s\n", uri, 0, 0 );
+ Debug( LDAP_DEBUG_TRACE, "slap_parseURI: parsing %s\n", uri->bv_val, 0, 0 );
#endif
-
/* If it does not look like a URI, assume it is a DN */
- if( !strncasecmp( uri, "dn:", 3 ) ) {
- uri += 3;
- uri += strspn( uri, " " );
- *searchbase = ch_strdup( uri );
- dn_normalize( *searchbase );
- *scope = LDAP_SCOPE_BASE;
- return( LDAP_SUCCESS );
- }
- if( strncasecmp( uri, "ldap://", 7 ) ) {
- *searchbase = ch_strdup( uri );
- dn_normalize( *searchbase );
- *scope = LDAP_SCOPE_BASE;
- return( LDAP_SUCCESS );
- }
-
- end = strchr( uri + 7, '/' );
- if ( end == NULL )
- return( LDAP_PROTOCOL_ERROR );
+ if( !strncasecmp( uri->bv_val, "dn:", sizeof("dn:")-1 ) ) {
+ bv.bv_val = uri->bv_val + sizeof("dn:")-1;
+ bv.bv_val += strspn( bv.bv_val, " " );
- /* could check the hostname here */
+is_dn: bv.bv_len = uri->bv_len - (bv.bv_val - uri->bv_val);
- /* Grab the searchbase */
- start = end+1;
- end = strchr( start, '?' );
- if( end == NULL ) {
- *searchbase = ch_strdup( start );
- dn_normalize( *searchbase );
- return( LDAP_SUCCESS );
- }
- *end = '\0';
- *searchbase = ch_strdup( start );
- *end = '?';
- dn_normalize( *searchbase );
-
- /* Skip the attrs */
- start = end+1;
- end = strchr( start, '?' );
- if( end == NULL ) {
- return( LDAP_SUCCESS );
+ rc = dnNormalize2( NULL, &bv, searchbase );
+ if( rc == LDAP_SUCCESS ) {
+ *scope = LDAP_SCOPE_BASE;
+ }
+ return( rc );
}
- /* Grab the scope */
- start = end+1;
- if( !strncasecmp( start, "base?", 5 )) {
- *scope = LDAP_SCOPE_BASE;
- start += 5;
+ rc = ldap_url_parse( uri->bv_val, &ludp );
+ if ( rc == LDAP_URL_ERR_BADSCHEME ) {
+ bv.bv_val = uri->bv_val;
+ goto is_dn;
}
- else if( !strncasecmp( start, "one?", 4 )) {
- *scope = LDAP_SCOPE_ONELEVEL;
- start += 4;
- }
- else if( !strncasecmp( start, "sub?", 3 )) {
- *scope = LDAP_SCOPE_SUBTREE;
- start += 4;
- }
- else {
- ch_free( *searchbase );
- *searchbase = NULL;
- return( LDAP_PROTOCOL_ERROR );
+
+ if ( rc != LDAP_URL_SUCCESS ) {
+ return LDAP_PROTOCOL_ERROR;
}
- /* Grab the filter */
- *filter = str2filter( start );
+ if (( ludp->lud_host && *ludp->lud_host )
+ || ludp->lud_attrs || ludp->lud_exts )
+ {
+ /* host part should be empty */
+ /* attrs and extensions parts should be empty */
+ return LDAP_PROTOCOL_ERROR;
+ }
- return( LDAP_SUCCESS );
-}
+ /* Grab the scope */
+ *scope = ludp->lud_scope;
+ /* Grab the filter */
+ if ( ludp->lud_filter ) {
+ *filter = str2filter( ludp->lud_filter );
+ if ( *filter == NULL ) {
+ rc = LDAP_PROTOCOL_ERROR;
+ goto done;
+ }
+ }
+ /* Grab the searchbase */
+ bv.bv_val = ludp->lud_dn;
+ bv.bv_len = strlen( bv.bv_val );
+ rc = dnNormalize2( NULL, &bv, searchbase );
+done:
+ if( rc != LDAP_SUCCESS ) {
+ if( *filter ) filter_free( *filter );
+ }
+ ldap_free_urldesc( ludp );
+ return( rc );
+}
-int slap_sasl_regexp_config( const char *match, const char *replace )
+static int slap_sasl_rx_off(char *rep, int *off)
{
-#ifdef HAVE_CYRUS_SASL
const char *c;
- int rc, n;
- SaslRegexp_t *reg;
-
- SaslRegexp = (SaslRegexp_t *) ch_realloc( (char *) SaslRegexp,
- (nSaslRegexp + 1) * sizeof(SaslRegexp_t) );
- reg = &( SaslRegexp[nSaslRegexp] );
- reg->match = ch_strdup( match );
- reg->replace = ch_strdup( replace );
- dn_normalize( reg->match );
- dn_normalize( reg->replace );
-
- /* Precompile matching pattern */
- rc = regcomp( ®->workspace, reg->match, REG_EXTENDED|REG_ICASE );
- if ( rc ) {
-#ifdef NEW_LOGGING
- LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
- "slap_sasl_regexp_config: \"%s\" could not be compiled.\n",
- reg->match ));
-#else
- Debug( LDAP_DEBUG_ANY,
- "SASL match pattern %s could not be compiled by regexp engine\n",
- reg->match, 0, 0 );
-#endif
-
- return( LDAP_OPERATIONS_ERROR );
- }
+ int n;
/* Precompile replace pattern. Find the $<n> placeholders */
- reg->offset[0] = -2;
+ off[0] = -2;
n = 1;
- for ( c = reg->replace; *c; c++ ) {
- if ( *c == '\\' ) {
+ for ( c = rep; *c; c++ ) {
+ if ( *c == '\\' && c[1] ) {
c++;
continue;
}
if ( *c == '$' ) {
if ( n == SASLREGEX_REPLACE ) {
#ifdef NEW_LOGGING
- LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
- "slap_sasl_regexp_config: \"%s\" has too many $n placeholders (max %d)\n",
- reg->replace, SASLREGEX_REPLACE ));
+ LDAP_LOG( TRANSPORT, ERR,
+ "slap_sasl_rx_off: \"%s\" has too many $n "
+ "placeholders (max %d)\n", rep, SASLREGEX_REPLACE, 0 );
#else
Debug( LDAP_DEBUG_ANY,
- "SASL replace pattern %s has too many $n placeholders (max %d)\n",
- reg->replace, SASLREGEX_REPLACE, 0 );
+ "SASL replace pattern %s has too many $n "
+ "placeholders (max %d)\n",
+ rep, SASLREGEX_REPLACE, 0 );
#endif
- return( LDAP_OPERATIONS_ERROR );
+ return( LDAP_OTHER );
}
- reg->offset[n] = c - reg->replace;
+ off[n] = c - rep;
n++;
}
}
/* Final placeholder, after the last $n */
- reg->offset[n] = c - reg->replace;
+ off[n] = c - rep;
n++;
- reg->offset[n] = -1;
+ off[n] = -1;
+ return( LDAP_SUCCESS );
+}
- nSaslRegexp++;
+int slap_sasl_regexp_config( const char *match, const char *replace )
+{
+ int rc;
+ SaslRegexp_t *reg;
+
+ SaslRegexp = (SaslRegexp_t *) ch_realloc( (char *) SaslRegexp,
+ (nSaslRegexp + 1) * sizeof(SaslRegexp_t) );
+
+ reg->sr_match = ch_strdup( match );
+ reg->sr_replace = ch_strdup( replace );
+
+ /* Precompile matching pattern */
+ rc = regcomp( ®->sr_workspace, reg->sr_match, REG_EXTENDED|REG_ICASE );
+ if ( rc ) {
+#ifdef NEW_LOGGING
+ LDAP_LOG( TRANSPORT, ERR,
+ "slap_sasl_regexp_config: \"%s\" could not be compiled.\n",
+ reg->sr_match, 0, 0 );
+#else
+ Debug( LDAP_DEBUG_ANY,
+ "SASL match pattern %s could not be compiled by regexp engine\n",
+ reg->sr_match, 0, 0 );
#endif
+
+ return( LDAP_OTHER );
+ }
+
+ rc = slap_sasl_rx_off( reg->sr_replace, reg->sr_offset );
+ if ( rc != LDAP_SUCCESS ) return rc;
+
+ nSaslRegexp++;
return( LDAP_SUCCESS );
}
+/* Perform replacement on regexp matches */
+static void slap_sasl_rx_exp(
+ const char *rep,
+ const int *off,
+ regmatch_t *str,
+ const char *saslname,
+ struct berval *out )
+{
+ int i, n, len, insert;
+
+ /* Get the total length of the final URI */
+
+ n=1;
+ len = 0;
+ while( off[n] >= 0 ) {
+ /* Len of next section from replacement string (x,y,z above) */
+ len += off[n] - off[n-1] - 2;
+ if( off[n+1] < 0)
+ break;
+ /* Len of string from saslname that matched next $i (b,d above) */
+ i = rep[ off[n] + 1 ] - '0';
+ len += str[i].rm_eo - str[i].rm_so;
+ n++;
+ }
+ out->bv_val = ch_malloc( len + 1 );
+ out->bv_len = len;
+ /* Fill in URI with replace string, replacing $i as we go */
+ n=1;
+ insert = 0;
+ while( off[n] >= 0) {
+ /* Paste in next section from replacement string (x,y,z above) */
+ len = off[n] - off[n-1] - 2;
+ strncpy( out->bv_val+insert, rep + off[n-1] + 2, len);
+ insert += len;
+ if( off[n+1] < 0)
+ break;
-#ifdef HAVE_CYRUS_SASL
+ /* Paste in string from saslname that matched next $i (b,d above) */
+ i = rep[ off[n] + 1 ] - '0';
+ len = str[i].rm_eo - str[i].rm_so;
+ strncpy( out->bv_val+insert, saslname + str[i].rm_so, len );
+ insert += len;
+ n++;
+ }
+ out->bv_val[insert] = '\0';
+}
/* Take the passed in SASL name and attempt to convert it into an
LDAP URI to find the matching LDAP entry, using the pattern matching
strings given in the saslregexp config file directive(s) */
-static
-char *slap_sasl_regexp( char *saslname )
+
+static int slap_sasl_regexp( struct berval *in, struct berval *out )
{
- char *uri=NULL;
- int i, n, len, insert;
+ char *saslname = in->bv_val;
+ char *scope[] = { "base", "one", "sub" };
SaslRegexp_t *reg;
+ int i;
+ memset( out, 0, sizeof( *out ) );
#ifdef NEW_LOGGING
- LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_regexp: converting SASL name %s\n", saslname ));
+ LDAP_LOG( TRANSPORT, ENTRY,
+ "slap_sasl_regexp: converting SASL name %s\n", saslname, 0, 0 );
#else
Debug( LDAP_DEBUG_TRACE, "slap_sasl_regexp: converting SASL name %s\n",
saslname, 0, 0 );
#endif
if (( saslname == NULL ) || ( nSaslRegexp == 0 ))
- return( NULL );
+ return( 0 );
/* Match the normalized SASL name to the saslregexp patterns */
for( reg = SaslRegexp,i=0; i<nSaslRegexp; i++,reg++ ) {
- if ( regexec( ®->workspace, saslname, SASLREGEX_REPLACE,
- reg->strings, 0) == 0 )
+ if ( regexec( ®->sr_workspace, saslname, SASLREGEX_REPLACE,
+ reg->sr_strings, 0) == 0 )
break;
}
if( i >= nSaslRegexp )
- return( NULL );
+ return( 0 );
/*
* The match pattern may have been of the form "a(b.*)c(d.*)e" and the
* replace pattern of the form "x$1y$2z". The returned string needs
* to replace the $1,$2 with the strings that matched (b.*) and (d.*)
*/
+ slap_sasl_rx_exp( reg->sr_replace, reg->sr_offset,
+ reg->sr_strings, saslname, out );
+#ifdef NEW_LOGGING
+ LDAP_LOG( TRANSPORT, ENTRY,
+ "slap_sasl_regexp: converted SASL name to %s\n",
+ out->bv_len ? out->bv_val : "", 0, 0 );
+#else
+ Debug( LDAP_DEBUG_TRACE,
+ "slap_sasl_regexp: converted SASL name to ldap:///%s??%s?%s\n",
+ out->bv_len ? out->bv_val : "", 0, 0 );
+#endif
- /* Get the total length of the final URI */
-
- n=1;
- len = 0;
- while( reg->offset[n] >= 0 ) {
- /* Len of next section from replacement string (x,y,z above) */
- len += reg->offset[n] - reg->offset[n-1] - 2;
- if( reg->offset[n+1] < 0)
- break;
+ return( 1 );
+}
- /* Len of string from saslname that matched next $i (b,d above) */
- i = reg->replace[ reg->offset[n] + 1 ] - '0';
- len += reg->strings[i].rm_eo - reg->strings[i].rm_so;
- n++;
- }
- uri = ch_malloc( len + 1 );
+/* Two empty callback functions to avoid sending results */
+static void sasl_sc_r( Connection *conn, Operation *o, ber_tag_t tag,
+ ber_int_t msgid, ber_int_t err, const char *matched,
+ const char *text, BerVarray ref, const char *resoid,
+ struct berval *resdata, struct berval *sasldata, LDAPControl **c)
+{
+}
- /* Fill in URI with replace string, replacing $i as we go */
- n=1;
- insert = 0;
- while( reg->offset[n] >= 0) {
- /* Paste in next section from replacement string (x,y,z above) */
- len = reg->offset[n] - reg->offset[n-1] - 2;
- strncpy( uri+insert, reg->replace + reg->offset[n-1] + 2, len);
- insert += len;
- if( reg->offset[n+1] < 0)
- break;
+static void sasl_sc_s( Connection *conn, Operation *o, ber_int_t err,
+ const char *matched, const char *text, BerVarray refs, LDAPControl **c,
+ int nentries)
+{
+}
- /* Paste in string from saslname that matched next $i (b,d above) */
- i = reg->replace[ reg->offset[n] + 1 ] - '0';
- len = reg->strings[i].rm_eo - reg->strings[i].rm_so;
- strncpy( uri+insert, saslname + reg->strings[i].rm_so, len );
- insert += len;
+/* This callback actually does some work...*/
+static int sasl_sc_sasl2dn( BackendDB *be, Connection *conn, Operation *o,
+ Entry *e, AttributeName *an, int ao, LDAPControl **c)
+{
+ struct berval *ndn = o->o_callback->sc_private;
- n++;
- }
+ /* We only want to be called once */
+ if( ndn->bv_val ) {
+ free(ndn->bv_val);
+ ndn->bv_val = NULL;
- uri[insert] = '\0';
#ifdef NEW_LOGGING
- LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_regexp: converted SASL name to %s\n", uri ));
+ LDAP_LOG( TRANSPORT, DETAIL1,
+ "slap_sasl2dn: search DN returned more than 1 entry\n", 0, 0, 0 );
#else
- Debug( LDAP_DEBUG_TRACE,
- "slap_sasl_regexp: converted SASL name to %s\n", uri, 0, 0 );
+ Debug( LDAP_DEBUG_TRACE,
+ "slap_sasl2dn: search DN returned more than 1 entry\n", 0,0,0 );
#endif
+ return -1;
+ }
- return( uri );
+ ber_dupbv(ndn, &e->e_nname);
+ return 0;
}
-
-
-
-
/*
* Given a SASL name (e.g. "UID=name,cn=REALM,cn=MECH,cn=AUTH")
* return the LDAP DN to which it matches. The SASL regexp rules in the config
* entry, return the DN of that one entry.
*/
-char *slap_sasl2dn( char *saslname )
+void slap_sasl2dn( Connection *conn,
+ struct berval *saslname, struct berval *sasldn )
{
- char *uri=NULL, *DN=NULL;
- struct berval searchbase = {0, NULL};
- int rc, scope;
+ int rc;
Backend *be;
- Filter *filter=NULL;
- Connection *conn=NULL;
- LDAP *client=NULL;
- LDAPMessage *res=NULL, *msg;
-
+ struct berval dn = { 0, NULL };
+ int scope = LDAP_SCOPE_BASE;
+ Filter *filter = NULL;
+ slap_callback cb = {sasl_sc_r, sasl_sc_s, sasl_sc_sasl2dn, NULL};
+ Operation op = {0};
+ struct berval regout = { 0, NULL };
#ifdef NEW_LOGGING
- LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl2dn: converting SASL name %s to DN.\n", saslname ));
+ LDAP_LOG( TRANSPORT, ENTRY,
+ "slap_sasl2dn: converting SASL name %s to DN.\n",
+ saslname->bv_val, 0, 0 );
#else
- Debug( LDAP_DEBUG_TRACE,
- "==>slap_sasl2dn: Converting SASL name %s to a DN\n", saslname, 0,0 );
+ Debug( LDAP_DEBUG_TRACE, "==>slap_sasl2dn: "
+ "converting SASL name %s to a DN\n",
+ saslname->bv_val, 0,0 );
#endif
+ sasldn->bv_val = NULL;
+ sasldn->bv_len = 0;
+ cb.sc_private = sasldn;
- /* Convert the SASL name into an LDAP URI */
- uri = slap_sasl_regexp( saslname );
- if( uri == NULL )
- goto FINISHED;
-
- rc = slap_parseURI( uri, &searchbase.bv_val, &scope, &filter );
- if( rc )
+ /* Convert the SASL name into a minimal URI */
+ if( !slap_sasl_regexp( saslname, ®out ) ) {
goto FINISHED;
+ }
- searchbase.bv_len = strlen( searchbase.bv_val );
- /* Massive shortcut: search scope == base */
- if( scope == LDAP_SCOPE_BASE ) {
- DN = ch_strdup( searchbase.bv_val );
+ rc = slap_parseURI( ®out, &dn, &scope, &filter );
+ if( rc != LDAP_SUCCESS ) {
goto FINISHED;
}
/* Must do an internal search */
+ be = select_backend( &dn, 0, 1 );
-#ifdef NEW_LOGGING
- LDAP_LOG(( "sasl", LDAP_LEVEL_DETAIL1,
- "slap_sasl2dn: performing internal search (base=%s, scope=%d)\n",
- searchbase.bv_val, scope ));
-#else
- Debug( LDAP_DEBUG_TRACE,
- "slap_sasl2dn: performing internal search (base=%s, scope=%d)\n",
- searchbase.bv_val, scope, 0 );
-#endif
-
-
- be = select_backend( &searchbase, 0, 1 );
- if(( be == NULL ) || ( be->be_search == NULL))
- goto FINISHED;
- suffix_alias( be, &searchbase );
-
- rc = connection_internal_open( &conn, &client, saslname );
- if( rc != LDAP_SUCCESS )
- goto FINISHED;
-
- (*be->be_search)( be, conn, conn->c_ops, /*base=*/NULL, searchbase.bv_val,
- scope, /*deref=*/1, /*sizelimit=*/1, /*time=*/0, filter, /*fstr=*/NULL,
- /*attrs=*/NULL, /*attrsonly=*/0 );
-
-
- /* Read the client side of the internal search */
- rc = ldap_result( client, LDAP_RES_ANY, LDAP_MSG_ALL, NULL, &res );
- if( rc == -1 )
+ /* Massive shortcut: search scope == base */
+ if( scope == LDAP_SCOPE_BASE ) {
+ *sasldn = dn;
+ dn.bv_len = 0;
+ dn.bv_val = NULL;
goto FINISHED;
+ }
- /* Make sure exactly one entry was returned */
- rc = ldap_count_entries( client, res );
#ifdef NEW_LOGGING
- LDAP_LOG(( "sasl", LDAP_LEVEL_DETAIL1,
- "slap_sasl2dn: search DN returned %d entries\n", rc ));
+ LDAP_LOG( TRANSPORT, DETAIL1,
+ "slap_sasl2dn: performing internal search (base=%s, scope=%d)\n",
+ dn.bv_val, scope, 0 );
#else
Debug( LDAP_DEBUG_TRACE,
- "slap_sasl2dn: search DN returned %d entries\n", rc,0,0 );
+ "slap_sasl2dn: performing internal search (base=%s, scope=%d)\n",
+ dn.bv_val, scope, 0 );
#endif
- if( rc != 1 )
+ if(( be == NULL ) || ( be->be_search == NULL)) {
goto FINISHED;
-
- msg = ldap_first_entry( client, res );
- DN = ldap_get_dn( client, msg );
-
+ }
+ suffix_alias( be, &dn );
+
+ op.o_tag = LDAP_REQ_SEARCH;
+ op.o_protocol = LDAP_VERSION3;
+ op.o_ndn = *saslname;
+ op.o_callback = &cb;
+ op.o_time = slap_get_time();
+ op.o_do_not_cache = 1;
+
+ (*be->be_search)( be, conn, &op, NULL, &dn,
+ scope, LDAP_DEREF_NEVER, 1, 0,
+ filter, NULL, NULL, 1 );
+
FINISHED:
- if( searchbase.bv_len ) ch_free( searchbase.bv_val );
+ if( sasldn->bv_len ) {
+ conn->c_authz_backend = be;
+ }
+ if( dn.bv_len ) ch_free( dn.bv_val );
if( filter ) filter_free( filter );
- if( uri ) ch_free( uri );
- if( conn ) connection_internal_close( conn );
- if( res ) ldap_msgfree( res );
- if( client ) ldap_unbind( client );
- if( DN ) dn_normalize( DN );
+
#ifdef NEW_LOGGING
- LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl2dn: Converted SASL name to %s\n", DN ? DN : "<nothing>" ));
+ LDAP_LOG( TRANSPORT, ENTRY,
+ "slap_sasl2dn: Converted SASL name to %s\n",
+ sasldn->bv_len ? sasldn->bv_val : "<nothing>", 0, 0 );
#else
Debug( LDAP_DEBUG_TRACE, "<==slap_sasl2dn: Converted SASL name to %s\n",
- DN ? DN : "<nothing>", 0, 0 );
+ sasldn->bv_len ? sasldn->bv_val : "<nothing>", 0, 0 );
#endif
- return( DN );
+ return;
}
+typedef struct smatch_info {
+ struct berval *dn;
+ int match;
+} smatch_info;
+static int sasl_sc_smatch( BackendDB *be, Connection *conn, Operation *o,
+ Entry *e, AttributeName *an, int ao, LDAPControl **c)
+{
+ smatch_info *sm = o->o_callback->sc_private;
-
+ if (dn_match(sm->dn, &e->e_nname)) {
+ sm->match = 1;
+ return -1; /* short-circuit the search */
+ } else {
+ return 1;
+ }
+}
/*
* Map a SASL regexp rule to a DN. If the rule is just a DN or a scope=base
*/
static
-int slap_sasl_match( char *rule, char *assertDN, char *authc )
+int slap_sasl_match(Connection *conn, struct berval *rule, struct berval *assertDN, struct berval *authc )
{
- char *dn=NULL;
struct berval searchbase = {0, NULL};
int rc, scope;
Backend *be;
Filter *filter=NULL;
- Connection *conn=NULL;
- LDAP *client=NULL;
- LDAPMessage *res=NULL, *msg;
regex_t reg;
-
+ smatch_info sm;
+ slap_callback cb = { sasl_sc_r, sasl_sc_s, sasl_sc_smatch, NULL };
+ Operation op = {0};
#ifdef NEW_LOGGING
- LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_match: comparing DN %s to rule %s\n", assertDN, rule ));
+ LDAP_LOG( TRANSPORT, ENTRY,
+ "slap_sasl_match: comparing DN %s to rule %s\n",
+ assertDN->bv_val, rule->bv_val,0 );
#else
Debug( LDAP_DEBUG_TRACE,
- "===>slap_sasl_match: comparing DN %s to rule %s\n", assertDN, rule, 0 );
+ "===>slap_sasl_match: comparing DN %s to rule %s\n", assertDN->bv_val, rule->bv_val, 0 );
#endif
-
- rc = slap_parseURI( rule, &searchbase.bv_val, &scope, &filter );
+ rc = slap_parseURI( rule, &searchbase, &scope, &filter );
if( rc != LDAP_SUCCESS )
goto CONCLUDED;
- searchbase.bv_len = strlen( searchbase.bv_val );
/* Massive shortcut: search scope == base */
if( scope == LDAP_SCOPE_BASE ) {
- dn_normalize( searchbase.bv_val );
- rc = regcomp(®, searchbase.bv_val, REG_EXTENDED|REG_ICASE|REG_NOSUB);
+ rc = regcomp(®, searchbase.bv_val,
+ REG_EXTENDED|REG_ICASE|REG_NOSUB);
if ( rc == 0 ) {
- rc = regexec(®, assertDN, 0, NULL, 0);
+ rc = regexec(®, assertDN->bv_val, 0, NULL, 0);
regfree( ® );
}
if ( rc == 0 )
/* Must run an internal search. */
#ifdef NEW_LOGGING
- LDAP_LOG(( "sasl", LDAP_LEVEL_DETAIL1,
- "slap_sasl_match: performing internal search (base=%s, scope=%d)\n",
- searchbase.bv_val, scope ));
+ LDAP_LOG( TRANSPORT, DETAIL1,
+ "slap_sasl_match: performing internal search (base=%s, scope=%d)\n",
+ searchbase.bv_val, scope,0 );
#else
Debug( LDAP_DEBUG_TRACE,
"slap_sasl_match: performing internal search (base=%s, scope=%d)\n",
searchbase.bv_val, scope, 0 );
#endif
-
be = select_backend( &searchbase, 0, 1 );
if(( be == NULL ) || ( be->be_search == NULL)) {
rc = LDAP_INAPPROPRIATE_AUTH;
}
suffix_alias( be, &searchbase );
- /* Make an internal connection on which to run the search */
- rc = connection_internal_open( &conn, &client, authc );
- if( rc != LDAP_SUCCESS )
- goto CONCLUDED;
+ sm.dn = assertDN;
+ sm.match = 0;
+ cb.sc_private = &sm;
+
+ op.o_tag = LDAP_REQ_SEARCH;
+ op.o_protocol = LDAP_VERSION3;
+ op.o_ndn = *authc;
+ op.o_callback = &cb;
+ op.o_time = slap_get_time();
+ op.o_do_not_cache = 1;
- (*be->be_search)( be, conn, conn->c_ops, /*base=*/NULL, searchbase.bv_val,
+ (*be->be_search)( be, conn, &op, /*base=*/NULL, &searchbase,
scope, /*deref=*/1, /*sizelimit=*/0, /*time=*/0, filter, /*fstr=*/NULL,
/*attrs=*/NULL, /*attrsonly=*/0 );
-
- /* On the client side of the internal search, read the results. Check
- if the assertDN matches any of the DN's returned by the search */
- rc = ldap_result( client, LDAP_RES_ANY, LDAP_MSG_ALL, NULL, &res );
- if( rc == -1 )
- goto CONCLUDED;
-
- for( msg=ldap_first_entry( client, res );
- msg;
- msg=ldap_next_entry( client, msg ) ) {
- dn = ldap_get_dn( client, msg );
- dn_normalize( dn );
- rc = strcmp( dn, assertDN );
- ch_free( dn );
- if( rc == 0 ) {
- rc = LDAP_SUCCESS;
- goto CONCLUDED;
- }
- }
- rc = LDAP_INAPPROPRIATE_AUTH;
+ if (sm.match)
+ rc = LDAP_SUCCESS;
+ else
+ rc = LDAP_INAPPROPRIATE_AUTH;
CONCLUDED:
if( searchbase.bv_len ) ch_free( searchbase.bv_val );
if( filter ) filter_free( filter );
- if( conn ) connection_internal_close( conn );
- if( res ) ldap_msgfree( res );
- if( client ) ldap_unbind( client );
#ifdef NEW_LOGGING
- LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_match: comparison returned %d\n", rc ));
+ LDAP_LOG( TRANSPORT, ENTRY,
+ "slap_sasl_match: comparison returned %d\n", rc, 0, 0 );
#else
Debug( LDAP_DEBUG_TRACE,
"<===slap_sasl_match: comparison returned %d\n", rc, 0, 0);
}
-
-
-
/*
* This function answers the question, "Can this ID authorize to that ID?",
* based on authorization rules. The rules are stored in the *searchDN, in the
* attribute named by *attr. If any of those rules map to the *assertDN, the
* authorization is approved.
*
- * DN's passed in should have a dn: prefix
+ * The DNs should not have the dn: prefix
*/
-
static int
-slap_sasl_check_authz(char *searchDN, char *assertDN, char *attr, char *authc)
+slap_sasl_check_authz( Connection *conn,
+ struct berval *searchDN,
+ struct berval *assertDN,
+ AttributeDescription *ad,
+ struct berval *authc )
{
- const char *errmsg;
int i, rc;
- struct berval **vals=NULL;
- AttributeDescription *ad=NULL;
-
+ BerVarray vals=NULL;
#ifdef NEW_LOGGING
- LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
+ LDAP_LOG( TRANSPORT, ENTRY,
"slap_sasl_check_authz: does %s match %s rule in %s?\n",
- assertDN, attr, searchDN ));
+ assertDN->bv_val, ad->ad_cname.bv_val, searchDN->bv_val);
#else
Debug( LDAP_DEBUG_TRACE,
"==>slap_sasl_check_authz: does %s match %s rule in %s?\n",
- assertDN, attr, searchDN);
+ assertDN->bv_val, ad->ad_cname.bv_val, searchDN->bv_val);
#endif
- rc = slap_str2ad( attr, &ad, &errmsg );
- if( rc != LDAP_SUCCESS )
- goto COMPLETE;
-
- rc = backend_attribute( NULL, NULL, NULL, NULL, searchDN+3, ad, &vals );
+ rc = backend_attribute( NULL, NULL, NULL, NULL, searchDN, ad, &vals );
if( rc != LDAP_SUCCESS )
goto COMPLETE;
/* Check if the *assertDN matches any **vals */
- for( i=0; vals[i] != NULL; i++ ) {
- rc = slap_sasl_match( vals[i]->bv_val, assertDN+3, authc );
+ for( i=0; vals[i].bv_val != NULL; i++ ) {
+ rc = slap_sasl_match( conn, &vals[i], assertDN, authc );
if ( rc == LDAP_SUCCESS )
goto COMPLETE;
}
rc = LDAP_INAPPROPRIATE_AUTH;
COMPLETE:
- if( vals ) ber_bvecfree( vals );
+ if( vals ) ber_bvarray_free( vals );
#ifdef NEW_LOGGING
- LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_check_authz: %s check returning %s\n", attr, rc ));
+ LDAP_LOG( TRANSPORT, RESULTS,
+ "slap_sasl_check_authz: %s check returning %s\n",
+ ad->ad_cname.bv_val, rc, 0 );
#else
Debug( LDAP_DEBUG_TRACE,
- "<==slap_sasl_check_authz: %s check returning %d\n", attr, rc, 0);
+ "<==slap_sasl_check_authz: %s check returning %d\n", ad->ad_cname.bv_val, rc, 0);
#endif
return( rc );
}
-
-
-
#endif /* HAVE_CYRUS_SASL */
-
-
-
/* Check if a bind can SASL authorize to another identity.
- Accepts authorization DN's with "dn:" prefix */
+ * The DNs should not have the dn: prefix
+ */
-int slap_sasl_authorized( char *authcDN, char *authzDN )
+int slap_sasl_authorized( Connection *conn,
+ struct berval *authcDN, struct berval *authzDN )
{
int rc = LDAP_INAPPROPRIATE_AUTH;
}
#ifdef NEW_LOGGING
- LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_authorized: can %s become %s?\n", authcDN, authzDN ));
+ LDAP_LOG( TRANSPORT, ENTRY,
+ "slap_sasl_authorized: can %s become %s?\n",
+ authcDN->bv_val, authzDN->bv_val, 0 );
#else
Debug( LDAP_DEBUG_TRACE,
- "==>slap_sasl_authorized: can %s become %s?\n", authcDN, authzDN, 0 );
+ "==>slap_sasl_authorized: can %s become %s?\n", authcDN->bv_val, authzDN->bv_val, 0 );
#endif
-
/* If person is authorizing to self, succeed */
- if ( !strcmp( authcDN, authzDN ) ) {
+ if ( dn_match( authcDN, authzDN ) ) {
rc = LDAP_SUCCESS;
goto DONE;
}
/* Check source rules */
- rc = slap_sasl_check_authz( authcDN, authzDN, SASL_AUTHZ_SOURCE_ATTR,
- authcDN );
- if( rc == LDAP_SUCCESS ) {
- goto DONE;
+ if( authz_policy & SASL_AUTHZ_TO ) {
+ rc = slap_sasl_check_authz( conn, authcDN, authzDN,
+ slap_schema.si_ad_saslAuthzTo, authcDN );
+ if( rc == LDAP_SUCCESS ) {
+ goto DONE;
+ }
}
/* Check destination rules */
- rc = slap_sasl_check_authz( authzDN, authcDN, SASL_AUTHZ_DEST_ATTR,
- authcDN );
- if( rc == LDAP_SUCCESS ) {
- goto DONE;
+ if( authz_policy & SASL_AUTHZ_FROM ) {
+ rc = slap_sasl_check_authz( conn, authzDN, authcDN,
+ slap_schema.si_ad_saslAuthzFrom, authcDN );
+ if( rc == LDAP_SUCCESS ) {
+ goto DONE;
+ }
}
rc = LDAP_INAPPROPRIATE_AUTH;
#endif
#ifdef NEW_LOGGING
- LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_authorized: return %d\n", rc ));
+ LDAP_LOG( TRANSPORT, RESULTS, "slap_sasl_authorized: return %d\n", rc,0,0 );
#else
- Debug( LDAP_DEBUG_TRACE, "<== slap_sasl_authorized: return %d\n",rc,0,0 );
+ Debug( LDAP_DEBUG_TRACE,
+ "<== slap_sasl_authorized: return %d\n", rc, 0, 0 );
#endif
return( rc );
projects / openldap / blobdiff