X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;ds=sidebyside;f=servers%2Fslapd%2Fback-meta%2Fbind.c;h=c6aaa87cf38c21f20e14317cb920797902507f84;hb=182ad0ff2721faeef5e2c6ec374db38ee247d3b2;hp=e3fdad50278fbef4496cb35169469ff313eab7bc;hpb=90766f4d4f89e9c5f48c8aa556f4daaafda1ac26;p=openldap diff --git a/servers/slapd/back-meta/bind.c b/servers/slapd/back-meta/bind.c index e3fdad5027..c6aaa87cf3 100644 --- a/servers/slapd/back-meta/bind.c +++ b/servers/slapd/back-meta/bind.c @@ -1,67 +1,23 @@ -/* - * Copyright 1998-2001 The OpenLDAP Foundation, All Rights Reserved. - * COPYING RESTRICTIONS APPLY, see COPYRIGHT file - * - * Copyright 2001, Pierangelo Masarati, All rights reserved. - * - * This work has been developed to fulfill the requirements - * of SysNet s.n.c. and it has been donated - * to the OpenLDAP Foundation in the hope that it may be useful - * to the Open Source community, but WITHOUT ANY WARRANTY. - * - * Permission is granted to anyone to use this software for any purpose - * on any computer system, and to alter it and redistribute it, subject - * to the following restrictions: - * - * 1. The author and SysNet s.n.c. are not responsible for the consequences - * of use of this software, no matter how awful, even if they arise from - * flaws in it. - * - * 2. The origin of this software must not be misrepresented, either by - * explicit claim or by omission. Since few users ever read sources, - * credits should appear in the documentation. - * - * 3. Altered versions must be plainly marked as such, and must not be - * misrepresented as being the original software. Since few users - * ever read sources, credits should appear in the documentation. - * SysNet s.n.c. cannot be responsible for the consequences of the - * alterations. - * - * 4. This notice may not be removed or altered. - * - * - * This software is based on the backend back-ldap, implemented - * by Howard Chu , and modified by Mark Valence - * , Pierangelo Masarati and other - * contributors. The contribution of the original software to the present - * implementation is acknowledged in this copyright statement. - * - * A special acknowledgement goes to Howard for the overall architecture - * (and for borrowing large pieces of code), and to Mark, who implemented - * from scratch the attribute/objectclass mapping. - * - * The original copyright statement follows. - * - * Copyright 1999, Howard Chu, All rights reserved. - * - * Permission is granted to anyone to use this software for any purpose - * on any computer system, and to alter it and redistribute it, subject - * to the following restrictions: +/* $OpenLDAP$ */ +/* This work is part of OpenLDAP Software . * - * 1. The author is not responsible for the consequences of use of this - * software, no matter how awful, even if they arise from flaws in it. + * Copyright 1999-2004 The OpenLDAP Foundation. + * Portions Copyright 2001-2003 Pierangelo Masarati. + * Portions Copyright 1999-2003 Howard Chu. + * All rights reserved. * - * 2. The origin of this software must not be misrepresented, either by - * explicit claim or by omission. Since few users ever read sources, - * credits should appear in the documentation. - * - * 3. Altered versions must be plainly marked as such, and must not be - * misrepresented as being the original software. Since few users - * ever read sources, credits should appear in the - * documentation. - * - * 4. This notice may not be removed or altered. + * Redistribution and use in source and binary forms, with or without + * modification, are permitted only as authorized by the OpenLDAP + * Public License. * + * A copy of this license is available in the file LICENSE in the + * top-level directory of the distribution or, alternatively, at + * . + */ +/* ACKNOWLEDGEMENTS: + * This work was initially developed by the Howard Chu for inclusion + * in OpenLDAP Software and subsequently enhanced by Pierangelo + * Masarati. */ #include "portable.h" @@ -77,59 +33,63 @@ #include "../back-ldap/back-ldap.h" #include "back-meta.h" +static LDAP_REBIND_PROC meta_back_rebind; + +static int +meta_back_do_single_bind( + struct metaconn *lc, + Operation *op, + SlapReply *rs, + int candidate +); + int -meta_back_bind( - Backend *be, - Connection *conn, - Operation *op, - const char *dn, - const char *ndn, - int method, - struct berval *cred, - char **edn -) +meta_back_bind( Operation *op, SlapReply *rs ) { - struct metainfo *li = ( struct metainfo * )be->be_private; + struct metainfo *li = ( struct metainfo * )op->o_bd->be_private; struct metaconn *lc; - int rc = -1, i, gotit = 0, ndnlen, err = LDAP_SUCCESS; + int rc = -1, i, gotit = 0, ndnlen, isroot = 0; + int op_type = META_OP_ALLOW_MULTIPLE; -#ifdef NEW_LOGGING - LDAP_LOG(( "backend", LDAP_LEVEL_ENTRY, - "meta_back_bind: dn: %s.\n", dn )); -#else /* !NEW_LOGGING */ - Debug( LDAP_DEBUG_ARGS, "meta_back_bind: dn: %s.\n%s%s", dn, "", "" ); -#endif /* !NEW_LOGGING */ + rs->sr_err = LDAP_SUCCESS; - *edn = NULL; + Debug( LDAP_DEBUG_ARGS, "meta_back_bind: dn: %s.\n%s%s", + op->o_req_dn.bv_val, "", "" ); - lc = meta_back_getconn( li, conn, op, META_OP_ALLOW_MULTIPLE, - ndn, NULL ); + if ( op->oq_bind.rb_method == LDAP_AUTH_SIMPLE && be_isroot_pw( op ) ) { + isroot = 1; + ber_dupbv( &op->oq_bind.rb_edn, be_root_dn( op->o_bd ) ); + op_type = META_OP_REQUIRE_ALL; + } + lc = meta_back_getconn( op, rs, op_type, + &op->o_req_ndn, NULL ); if ( !lc ) { -#ifdef NEW_LOGGING - LDAP_LOG(( "backend", LDAP_LEVEL_NOTICE, - "meta_back_bind: no target for dn %s.\n", - dn )); -#else /* !NEW_LOGGING */ Debug( LDAP_DEBUG_ANY, "meta_back_bind: no target for dn %s.\n%s%s", - dn, "", ""); -#endif /* !NEW_LOGGING */ + op->o_req_dn.bv_val, "", ""); + + send_ldap_result( op, rs ); return -1; } /* * Each target is scanned ... */ - lc->bound_target = -1; - ndnlen = strlen( ndn ); + lc->bound_target = META_BOUND_NONE; + ndnlen = op->o_req_ndn.bv_len; for ( i = 0; i < li->ntargets; i++ ) { - int lerr; + int lerr; + struct berval orig_dn = op->o_req_dn; + struct berval orig_ndn = op->o_req_ndn; + struct berval orig_cred = op->oq_bind.rb_cred; + int orig_method = op->oq_bind.rb_method; + /* * Skip non-candidates */ - if ( lc->conns[ i ]->candidate != META_CANDIDATE ) { + if ( lc->conns[ i ].candidate != META_CANDIDATE ) { continue; } @@ -140,29 +100,36 @@ meta_back_bind( * A bind operation is expected to have * ONE CANDIDATE ONLY! */ -#ifdef NEW_LOGGING - LDAP_LOG(( "backend", LDAP_LEVEL_WARNING, - "==>meta_back_bind: more than one" - " candidate is attempting to bind" - " ...\n" )); -#else /* !NEW_LOGGING */ Debug( LDAP_DEBUG_ANY, "==>meta_back_bind: more than one" " candidate is attempting to bind" " ...\n%s%s%s", "", "", "" ); -#endif /* !NEW_LOGGING */ } - - lerr = meta_back_do_single_bind( li, lc, dn, ndn, cred, - method, i ); + if ( isroot && li->targets[ i ]->pseudorootdn.bv_val != NULL ) { + op->o_req_dn = li->targets[ i ]->pseudorootdn; + op->o_req_ndn = li->targets[ i ]->pseudorootdn; + op->oq_bind.rb_cred = li->targets[ i ]->pseudorootpw; + op->oq_bind.rb_method = LDAP_AUTH_SIMPLE; + } + + lerr = meta_back_do_single_bind( lc, op, rs, i ); if ( lerr != LDAP_SUCCESS ) { - err = lerr; - ( void )meta_clear_one_candidate( lc->conns[ i ], 1 ); + rs->sr_err = lerr; + ( void )meta_clear_one_candidate( &lc->conns[ i ], 1 ); } else { rc = LDAP_SUCCESS; } + + op->o_req_dn = orig_dn; + op->o_req_ndn = orig_ndn; + op->oq_bind.rb_cred = orig_cred; + op->oq_bind.rb_method = orig_method; + } + + if ( isroot ) { + lc->bound_target = META_BOUND_ALL; } /* @@ -170,13 +137,23 @@ meta_back_bind( * err is the last error that occurred during a bind; * if at least (and at most?) one bind succeedes, fine. */ - if ( rc != LDAP_SUCCESS /* && err != LDAP_SUCCESS */ ) { + if ( rc != LDAP_SUCCESS /* && rs->sr_err != LDAP_SUCCESS */ ) { /* * deal with bind failure ... */ - err = ldap_back_map_result( err ); - send_ldap_result( conn, op, err, NULL, "", NULL, NULL ); + + /* + * no target was found within the naming context, + * so bind must fail with invalid credentials + */ + if ( rs->sr_err == LDAP_SUCCESS && gotit == 0 ) { + rs->sr_err = LDAP_INVALID_CREDENTIALS; + } + + rs->sr_err = slap_map_api2result( rs ); + send_ldap_result( op, rs ); + return -1; } return 0; @@ -187,67 +164,86 @@ meta_back_bind( * * attempts to perform a bind with creds */ -int +static int meta_back_do_single_bind( - struct metainfo *li, struct metaconn *lc, - const char *dn, - const char *ndn, - struct berval *cred, - int method, + Operation *op, + SlapReply *rs, int candidate ) { - char *mdn = NULL; - int rc; + struct metainfo *li = ( struct metainfo * )op->o_bd->be_private; + struct berval mdn = BER_BVNULL; + ber_int_t msgid; + dncookie dc; + struct metasingleconn *lsc = &lc->conns[ candidate ]; + LDAPMessage *res; /* * Rewrite the bind dn if needed */ - switch ( rewrite_session( li->targets[ candidate ]->rwinfo, - "bindDn", dn, lc->conn, &mdn ) ) { - case REWRITE_REGEXEC_OK: - if ( mdn == NULL ) { - mdn = ( char * )dn; + dc.rwmap = &li->targets[ candidate ]->rwmap; + dc.conn = op->o_conn; + dc.rs = rs; + dc.ctx = "bindDN"; + + if ( ldap_back_dn_massage( &dc, &op->o_req_dn, &mdn ) ) { + send_ldap_result( op, rs ); + return -1; + } + + if ( op->o_ctrls ) { + rs->sr_err = ldap_set_option( lsc->ld, + LDAP_OPT_SERVER_CONTROLS, op->o_ctrls ); + if ( rs->sr_err != LDAP_SUCCESS ) { + rs->sr_err = slap_map_api2result( rs ); + goto return_results; } -#ifdef NEW_LOGGING - LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1, - "[rw] bindDn: \"%s\" -> \"%s\"\n", dn, mdn )); -#else /* !NEW_LOGGING */ - Debug( LDAP_DEBUG_ARGS, - "rw> bindDn: \"%s\" -> \"%s\"\n%s", - dn, mdn, "" ); -#endif /* !NEW_LOGGING */ - break; - - case REWRITE_REGEXEC_UNWILLING: - return LDAP_UNWILLING_TO_PERFORM; + } - case REWRITE_REGEXEC_ERR: - return LDAP_OPERATIONS_ERROR; + /* FIXME: this fixes the bind problem right now; we need + * to use the asynchronous version to get the "matched" + * and more in case of failure ... */ + rs->sr_err = ldap_sasl_bind_s(lsc->ld, mdn.bv_val, + LDAP_SASL_SIMPLE, &op->oq_bind.rb_cred, + op->o_ctrls, NULL, NULL); + if ( rs->sr_err != LDAP_SUCCESS ) { + rs->sr_err = slap_map_api2result( rs ); + goto return_results; } - rc = ldap_bind_s( lc->conns[ candidate ]->ld, mdn, - cred->bv_val, method ); - if ( rc != LDAP_SUCCESS ) { - rc = ldap_back_map_result( rc ); - } else { - lc->conns[ candidate ]->bound_dn = ch_strdup( dn ); - lc->conns[ candidate ]->bound = META_BOUND; - lc->bound_target = candidate; - - if ( li->cache.ttl != META_DNCACHE_DISABLED - && ndn[ 0 ] != '\0' ) { - ( void )meta_dncache_update_entry( &li->cache, - ch_strdup( ndn ), candidate ); + /* + * FIXME: handle response!!! + */ + if ( lsc->bound_dn.bv_val != NULL ) { + ber_memfree( lsc->bound_dn.bv_val ); + } + ber_dupbv( &lsc->bound_dn, &op->o_req_dn ); + lsc->bound = META_BOUND; + lc->bound_target = candidate; + + if ( li->savecred ) { + if ( lsc->cred.bv_val ) { + memset( lsc->cred.bv_val, 0, lsc->cred.bv_len ); + ber_memfree( lsc->cred.bv_val ); } + ber_dupbv( &lsc->cred, &op->oq_bind.rb_cred ); + ldap_set_rebind_proc( lsc->ld, meta_back_rebind, lsc ); } + + if ( li->cache.ttl != META_DNCACHE_DISABLED + && op->o_req_ndn.bv_len != 0 ) { + ( void )meta_dncache_update_entry( &li->cache, + &op->o_req_ndn, candidate ); + } + +return_results:; - if ( mdn != dn ) { - free( mdn ); + if ( mdn.bv_val != op->o_req_dn.bv_val ) { + free( mdn.bv_val ); } - return rc; + return rs->sr_err; } /* @@ -256,23 +252,42 @@ meta_back_do_single_bind( int meta_back_dobind( struct metaconn *lc, Operation *op ) { - struct metasingleconn **lsc; + struct metasingleconn *lsc; int bound = 0, i; - for ( i = 0, lsc = lc->conns; lsc[ 0 ] != NULL; ++i, ++lsc ) { - int rc; + /* + * all the targets are bound as pseudoroot + */ + if ( lc->bound_target == META_BOUND_ALL ) { + return 1; + } + + for ( i = 0, lsc = lc->conns; !META_LAST(lsc); ++i, ++lsc ) { + int rc; + struct berval cred = BER_BVC(""); /* * Not a candidate or something wrong with this target ... */ - if ( lsc[ 0 ]->ld == NULL ) { + if ( lsc->ld == NULL ) { continue; } + /* + * If required, set controls + */ + if ( op->o_ctrls ) { + if ( ldap_set_option( lsc->ld, LDAP_OPT_SERVER_CONTROLS, + op->o_ctrls ) != LDAP_SUCCESS ) { + ( void )meta_clear_one_candidate( lsc, 1 ); + continue; + } + } + /* * If the target is already bound it is skipped */ - if ( lsc[ 0 ]->bound == META_BOUND && lc->bound_target == i ) { + if ( lsc->bound == META_BOUND && lc->bound_target == i ) { ++bound; continue; } @@ -282,25 +297,29 @@ meta_back_dobind( struct metaconn *lc, Operation *op ) * (note: if the target was already bound, the anonymous * bind clears the previous bind). */ - rc = ldap_bind_s( lsc[ 0 ]->ld, lsc[ 0 ]->bound_dn, - NULL, LDAP_AUTH_SIMPLE ); + if ( lsc->bound_dn.bv_val ) { + ber_memfree( lsc->bound_dn.bv_val ); + lsc->bound_dn.bv_val = NULL; + lsc->bound_dn.bv_len = 0; + } + + if ( /* FIXME: need li ... li->savecred && */ + lsc->cred.bv_val ) { + memset( lsc->cred.bv_val, 0, lsc->cred.bv_len ); + ber_memfree( lsc->cred.bv_val ); + lsc->cred.bv_val = NULL; + lsc->cred.bv_len = 0; + } + + rc = ldap_sasl_bind_s(lsc->ld, "", LDAP_SASL_SIMPLE, &cred, + op->o_ctrls, NULL, NULL); if ( rc != LDAP_SUCCESS ) { -#ifdef NEW_LOGGING - LDAP_LOG(( "backend", LDAP_LEVEL_WARNING, - "meta_back_dobind: (anonymous)" - " bind as \"%s\" failed" - " with error \"%s\"\n", - lsc[ 0 ]->bound_dn, - ldap_err2string( rc ) )); -#else /* !NEW_LOGGING */ Debug( LDAP_DEBUG_ANY, "==>meta_back_dobind: (anonymous)" - " bind as \"%s\" failed" - " with error \"%s\"\n%s", - lsc[ 0 ]->bound_dn, - ldap_err2string( rc ), "" ); -#endif /* !NEW_LOGGING */ + " bind failed" + " with error %d (%s)\n", + rc, ldap_err2string( rc ), 0 ); /* * null cred bind should always succeed @@ -309,64 +328,117 @@ meta_back_dobind( struct metaconn *lc, Operation *op ) * due to technical reasons (remote host down?) * so better clear the handle */ - ( void )meta_clear_one_candidate( lsc[ 0 ], 1 ); + ( void )meta_clear_one_candidate( lsc, 1 ); continue; } /* else */ - lsc[ 0 ]->bound = META_ANONYMOUS; + lsc->bound = META_ANONYMOUS; ++bound; } return( bound > 0 ); } +/* + * + */ +int +meta_back_is_valid( struct metaconn *lc, int candidate ) +{ + struct metasingleconn *lsc; + int i; + + assert( lc ); + + if ( candidate < 0 ) { + return 0; + } + + for ( i = 0, lsc = lc->conns; !META_LAST(lsc) && i < candidate; + ++i, ++lsc ); + + if ( !META_LAST(lsc) ) { + return( lsc->ld != NULL ); + } + + return 0; +} + +/* + * meta_back_rebind + * + * This is a callback used for chasing referrals using the same + * credentials as the original user on this session. + */ +static int +meta_back_rebind( LDAP *ld, LDAP_CONST char *url, ber_tag_t request, + ber_int_t msgid, void *params ) +{ + struct metasingleconn *lc = params; + + return ldap_bind_s( ld, lc->bound_dn.bv_val, lc->cred.bv_val, + LDAP_AUTH_SIMPLE ); +} + /* * FIXME: error return must be handled in a cleaner way ... */ int -meta_back_op_result( struct metaconn *lc, Operation *op ) +meta_back_op_result( struct metaconn *lc, Operation *op, SlapReply *rs ) { - int i, err = LDAP_SUCCESS; - char *msg = NULL; - char *match = NULL; - struct metasingleconn **lsc; - - for ( i = 0, lsc = lc->conns; lsc[ 0 ] != NULL; ++i, ++lsc ) { - ldap_get_option( lsc[ 0 ]->ld, LDAP_OPT_ERROR_NUMBER, &err ); - if ( err != LDAP_SUCCESS ) { + int i, rerr = LDAP_SUCCESS; + struct metasingleconn *lsc; + char *rmsg = NULL; + char *rmatch = NULL; + int free_rmsg = 0, free_rmatch = 0; + + for ( i = 0, lsc = lc->conns; !META_LAST(lsc); ++i, ++lsc ) { + char *msg = NULL; + char *match = NULL; + + rs->sr_err = LDAP_SUCCESS; + + ldap_get_option( lsc->ld, LDAP_OPT_ERROR_NUMBER, &rs->sr_err ); + if ( rs->sr_err != LDAP_SUCCESS ) { /* * better check the type of error. In some cases * (search ?) it might be better to return a * success if at least one of the targets gave * positive result ... */ - ldap_get_option( lsc[ 0 ]->ld, + ldap_get_option( lsc->ld, LDAP_OPT_ERROR_STRING, &msg ); - ldap_get_option( lsc[ 0 ]->ld, + ldap_get_option( lsc->ld, LDAP_OPT_MATCHED_DN, &match ); - err = ldap_back_map_result( err ); + rs->sr_err = slap_map_api2result( rs ); - /* - * FIXME: need to rewrite "match" (need rwinfo) - */ - send_ldap_result( lc->conn, op, err, match, msg, - NULL, NULL ); - -#ifdef NEW_LOGGING - LDAP_LOG(( "backend", LDAP_DEBUG_NOTICE, - "meta_back_op_result: target" - " <%d> sending msg \"%s\"" - " (matched \"%s\")\n", - i, ( msg ? msg : "" ), - ( match ? match : "" ) )); -#else /* !NEW_LOGGING */ Debug(LDAP_DEBUG_ANY, "==> meta_back_op_result: target" " <%d> sending msg \"%s\"" " (matched \"%s\")\n", i, ( msg ? msg : "" ), ( match ? match : "" ) ); -#endif /* !NEW_LOGGING */ + + /* + * FIXME: need to rewrite "match" (need rwinfo) + */ + switch ( rs->sr_err ) { + default: + rerr = rs->sr_err; + if ( rmsg ) { + ber_memfree( rmsg ); + } + rmsg = msg; + free_rmsg = 1; + msg = NULL; + if ( rmatch ) { + ber_memfree( rmatch ); + } + rmatch = match; + free_rmatch = 1; + match = NULL; + break; + } /* better test the pointers before freeing? */ if ( match ) { @@ -375,10 +447,22 @@ meta_back_op_result( struct metaconn *lc, Operation *op ) if ( msg ) { free( msg ); } - return -1; } } - return ( err == LDAP_SUCCESS ) ? 0 : -1; + rs->sr_err = rerr; + rs->sr_text = rmsg; + rs->sr_matched = rmatch; + send_ldap_result( op, rs ); + if ( free_rmsg ) { + ber_memfree( rmsg ); + } + if ( free_rmatch ) { + ber_memfree( rmatch ); + } + rs->sr_text = NULL; + rs->sr_matched = NULL; + + return ( ( rerr == LDAP_SUCCESS ) ? 0 : -1 ); }