X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;ds=sidebyside;f=servers%2Fslapd%2Fsaslauthz.c;h=001c0ecdb0935eb941f20a96f72d5526e673cad9;hb=54fa643a9bd33e59059b84bda010b5f668cd45bb;hp=035a3ee0b5d53b66776c616eeb7ab4e3dacf0b38;hpb=b94d5e17e22b58b990dac4d4af5319be915366a6;p=openldap

diff --git a/servers/slapd/saslauthz.c b/servers/slapd/saslauthz.c
index 035a3ee0b5..001c0ecdb0 100644
--- a/servers/slapd/saslauthz.c
+++ b/servers/slapd/saslauthz.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2004 The OpenLDAP Foundation.
+ * Copyright 1998-2005 The OpenLDAP Foundation.
  * Portions Copyright 2000 Mark Adamson, Carnegie Mellon.
  * All rights reserved.
  *
@@ -17,6 +17,9 @@
 #include "portable.h"
 
 #include <stdio.h>
+#ifdef HAVE_LIMITS_H
+#include <limits.h>
+#endif
 
 #include <ac/stdlib.h>
 #include <ac/string.h>
@@ -24,9 +27,6 @@
 
 #include "slap.h"
 
-#include <limits.h>
-
-#include <ldap_pvt.h>
 #include "lutil.h"
 
 #define SASLREGEX_REPLACE 10
@@ -88,6 +88,10 @@ struct rewrite_info	*sasl_rwinfo = NULL;
 #define	SASL_AUTHZ_TO	0x02
 #define SASL_AUTHZ_AND	0x10
 
+static const char *policy_txt[] = {
+	"none", "from", "to", "any"
+};
+
 static int authz_policy = SASL_AUTHZ_NONE;
 
 static
@@ -114,6 +118,14 @@ int slap_sasl_setpolicy( const char *arg )
 	return rc;
 }
 
+const char * slap_sasl_getpolicy()
+{
+	if ( authz_policy == (SASL_AUTHZ_FROM | SASL_AUTHZ_TO | SASL_AUTHZ_AND) )
+		return "all";
+	else
+		return policy_txt[authz_policy];
+}
+
 int slap_parse_user( struct berval *id, struct berval *user,
 		struct berval *realm, struct berval *mech )
 {
@@ -206,13 +218,8 @@ static int slap_parseURI( Operation *op, struct berval *uri,
 	*scope = -1;
 	*filter = NULL;
 
-#ifdef NEW_LOGGING
-	LDAP_LOG( TRANSPORT, ENTRY, 
-		"slap_parseURI: parsing %s\n", uri->bv_val, 0, 0 );
-#else
 	Debug( LDAP_DEBUG_TRACE,
 		"slap_parseURI: parsing %s\n", uri->bv_val, 0, 0 );
-#endif
 
 	rc = LDAP_PROTOCOL_ERROR;
 	/*
@@ -415,7 +422,24 @@ is_dn:		bv.bv_len = uri->bv_len - (bv.bv_val - uri->bv_val);
 	 * <filter> must pass str2filter()
 	 */
 	rc = ldap_url_parse( uri->bv_val, &ludp );
-	if ( rc == LDAP_URL_ERR_BADSCHEME ) {
+	switch ( rc ) {
+	case LDAP_URL_SUCCESS:
+		/* FIXME: the check is pedantic, but I think it's necessary,
+		 * because people tend to use things like ldaps:// which
+		 * gives the idea SSL is being used.  Maybe we could
+		 * accept ldapi:// as well, but the point is that we use
+		 * an URL as an easy means to define bits of a search with
+		 * little parsing.
+		 */
+		if ( strcasecmp( ludp->lud_scheme, "ldap" ) != 0 ) {
+			/*
+			 * must be ldap:///
+			 */
+			return LDAP_PROTOCOL_ERROR;
+		}
+		break;
+
+	case LDAP_URL_ERR_BADSCHEME:
 		/*
 		 * last chance: assume it's a(n exact) DN ...
 		 *
@@ -424,13 +448,12 @@ is_dn:		bv.bv_len = uri->bv_len - (bv.bv_val - uri->bv_val);
 		bv.bv_val = uri->bv_val;
 		*scope = LDAP_X_SCOPE_EXACT;
 		goto is_dn;
-	}
 
-	if ( rc != LDAP_URL_SUCCESS ) {
+	default:
 		return LDAP_PROTOCOL_ERROR;
 	}
 
-	if (( ludp->lud_host && *ludp->lud_host )
+	if ( ( ludp->lud_host && *ludp->lud_host )
 		|| ludp->lud_attrs || ludp->lud_exts )
 	{
 		/* host part must be empty */
@@ -486,16 +509,10 @@ static int slap_sasl_rx_off(char *rep, int *off)
 		}
 		if ( *c == '$' ) {
 			if ( n == SASLREGEX_REPLACE ) {
-#ifdef NEW_LOGGING
-				LDAP_LOG( TRANSPORT, ERR, 
-					"slap_sasl_rx_off: \"%s\" has too many $n "
-					"placeholders (max %d)\n", rep, SASLREGEX_REPLACE, 0  );
-#else
 				Debug( LDAP_DEBUG_ANY,
 					"SASL replace pattern %s has too many $n "
 						"placeholders (max %d)\n",
 					rep, SASLREGEX_REPLACE, 0 );
-#endif
 
 				return( LDAP_OTHER );
 			}
@@ -588,10 +605,6 @@ int slap_sasl_regexp_rewrite_config(
 
 int slap_sasl_regexp_config( const char *match, const char *replace )
 {
-#ifdef SLAP_AUTH_REWRITE
-	return slap_sasl_regexp_rewrite_config( "sasl-regexp", 0,
-			match, replace, AUTHID_CONTEXT );
-#else /* ! SLAP_AUTH_REWRITE */
 	int rc;
 	SaslRegexp_t *reg;
 
@@ -603,18 +616,19 @@ int slap_sasl_regexp_config( const char *match, const char *replace )
 	reg->sr_match = ch_strdup( match );
 	reg->sr_replace = ch_strdup( replace );
 
+#ifdef SLAP_AUTH_REWRITE
+	rc = slap_sasl_regexp_rewrite_config( "sasl-regexp", 0,
+			match, replace, AUTHID_CONTEXT );
+	if ( rc == LDAP_SUCCESS ) nSaslRegexp++;
+	return rc;
+#else /* ! SLAP_AUTH_REWRITE */
+
 	/* Precompile matching pattern */
 	rc = regcomp( &reg->sr_workspace, reg->sr_match, REG_EXTENDED|REG_ICASE );
 	if ( rc ) {
-#ifdef NEW_LOGGING
-		LDAP_LOG( TRANSPORT, ERR, 
-			"slap_sasl_regexp_config: \"%s\" could not be compiled.\n",
-			reg->sr_match, 0, 0 );
-#else
 		Debug( LDAP_DEBUG_ANY,
 		"SASL match pattern %s could not be compiled by regexp engine\n",
 		reg->sr_match, 0, 0 );
-#endif
 
 		return( LDAP_OTHER );
 	}
@@ -627,6 +641,35 @@ int slap_sasl_regexp_config( const char *match, const char *replace )
 #endif /* ! SLAP_AUTH_REWRITE */
 }
 
+void slap_sasl_regexp_unparse( BerVarray *out )
+{
+	int i;
+	struct berval bv;
+	BerVarray bva = NULL;
+	char ibuf[32], *ptr;
+	struct berval idx;
+
+	if ( !nSaslRegexp ) return;
+
+	idx.bv_val = ibuf;
+	bva = ch_malloc( (nSaslRegexp+1) * sizeof(struct berval) );
+	BER_BVZERO(bva+nSaslRegexp);
+	for ( i=0; i<nSaslRegexp; i++ ) {
+		idx.bv_len = sprintf( idx.bv_val, "{%d}", i);
+		bva[i].bv_len = idx.bv_len + strlen( SaslRegexp[i].sr_match ) +
+			strlen( SaslRegexp[i].sr_replace ) + 5;
+		bva[i].bv_val = ch_malloc( bva[i].bv_len+1 );
+		ptr = lutil_strcopy( bva[i].bv_val, ibuf );
+		*ptr++ = '"';
+		ptr = lutil_strcopy( ptr, SaslRegexp[i].sr_match );
+		ptr = lutil_strcopy( ptr, "\" \"" );
+		ptr = lutil_strcopy( ptr, SaslRegexp[i].sr_replace );
+		*ptr++ = '"';
+		*ptr = '\0';
+	}
+	*out = bva;
+}
+
 /* Perform replacement on regexp matches */
 static void slap_sasl_rx_exp(
 	const char *rep,
@@ -702,19 +745,15 @@ static int slap_authz_regexp( struct berval *in, struct berval *out,
 		if ( !BER_BVISNULL( out ) ) {
 			char *val = out->bv_val;
 			ber_str2bv_x( val, 0, 1, out, ctx );
-			free( val );
+			if ( val != in->bv_val ) {
+				free( val );
+			}
 		} else {
 			ber_dupbv_x( out, in, ctx );
 		}
-#ifdef NEW_LOGGING
-		LDAP_LOG( BACK_LDAP, DETAIL1, 
-			"[rw] %s: \"%s\" -> \"%s\"\n",
-			context, in->bv_val, out->bv_val );		
-#else /* !NEW_LOGGING */
 		Debug( LDAP_DEBUG_ARGS,
 			"[rw] %s: \"%s\" -> \"%s\"\n",
 			context, in->bv_val, out->bv_val );		
-#endif /* !NEW_LOGGING */
 		return 1;
  		
  	case REWRITE_REGEXEC_UNWILLING:
@@ -731,13 +770,8 @@ static int slap_authz_regexp( struct berval *in, struct berval *out,
 
 	memset( out, 0, sizeof( *out ) );
 
-#ifdef NEW_LOGGING
-	LDAP_LOG( TRANSPORT, ENTRY, 
-		"slap_authz_regexp: converting SASL name %s\n", saslname, 0, 0 );
-#else
 	Debug( LDAP_DEBUG_TRACE, "slap_authz_regexp: converting SASL name %s\n",
 	   saslname, 0, 0 );
-#endif
 
 	if (( saslname == NULL ) || ( nSaslRegexp == 0 )) {
 		return( 0 );
@@ -760,15 +794,9 @@ static int slap_authz_regexp( struct berval *in, struct berval *out,
 	slap_sasl_rx_exp( reg->sr_replace, reg->sr_offset,
 		sr_strings, saslname, out, ctx );
 
-#ifdef NEW_LOGGING
-	LDAP_LOG( TRANSPORT, ENTRY, 
-		"slap_authz_regexp: converted SASL name to %s\n",
-		BER_BVISEMPTY( out ) ? "" : out->bv_val, 0, 0 );
-#else
 	Debug( LDAP_DEBUG_TRACE,
 		"slap_authz_regexp: converted SASL name to %s\n",
 		BER_BVISEMPTY( out ) ? "" : out->bv_val, 0, 0 );
-#endif
 
 	return( 1 );
 #endif /* ! SLAP_AUTH_REWRITE */
@@ -786,13 +814,8 @@ static int sasl_sc_sasl2dn( Operation *o, SlapReply *rs )
 		o->o_tmpfree(ndn->bv_val, o->o_tmpmemctx);
 		BER_BVZERO( ndn );
 
-#ifdef NEW_LOGGING
-		LDAP_LOG( TRANSPORT, DETAIL1,
-			"slap_sc_sasl2dn: search DN returned more than 1 entry\n", 0, 0, 0 );
-#else
 		Debug( LDAP_DEBUG_TRACE,
 			"slap_sc_sasl2dn: search DN returned more than 1 entry\n", 0, 0, 0 );
-#endif
 		return -1;
 	}
 
@@ -869,22 +892,17 @@ int slap_sasl_match( Operation *opx, struct berval *rule,
 	slap_callback cb = { NULL, sasl_sc_smatch, NULL, NULL };
 	Operation op = {0};
 	SlapReply rs = {REP_RESULT};
+	struct berval base = BER_BVNULL;
 
 	sm.dn = assertDN;
 	sm.match = 0;
 	cb.sc_private = &sm;
 
-#ifdef NEW_LOGGING
-	LDAP_LOG( TRANSPORT, ENTRY, 
-		"slap_sasl_match: comparing DN %s to rule %s\n", 
-		assertDN->bv_val, rule->bv_val,0 );
-#else
 	Debug( LDAP_DEBUG_TRACE,
 	   "===>slap_sasl_match: comparing DN %s to rule %s\n",
 		assertDN->bv_val, rule->bv_val, 0 );
-#endif
 
-	rc = slap_parseURI( opx, rule, &op.o_req_dn,
+	rc = slap_parseURI( opx, rule, &base,
 		&op.o_req_ndn, &op.ors_scope, &op.ors_filter,
 		&op.ors_filterstr );
 	if( rc != LDAP_SUCCESS ) goto CONCLUDED;
@@ -1018,15 +1036,9 @@ exact_match:
 		goto CONCLUDED;
 	}
 
-#ifdef NEW_LOGGING
-	LDAP_LOG( TRANSPORT, DETAIL1, 
-		"slap_sasl_match: performing internal search (base=%s, scope=%d)\n",
-		op.o_req_ndn.bv_val, op.ors_scope, 0 );
-#else
 	Debug( LDAP_DEBUG_TRACE,
 	   "slap_sasl_match: performing internal search (base=%s, scope=%d)\n",
 	   op.o_req_ndn.bv_val, op.ors_scope, 0 );
-#endif
 
 	op.o_bd = select_backend( &op.o_req_ndn, 0, 1 );
 	if(( op.o_bd == NULL ) || ( op.o_bd->be_search == NULL)) {
@@ -1034,29 +1046,25 @@ exact_match:
 		goto CONCLUDED;
 	}
 
+	op.o_hdr = opx->o_hdr;
 	op.o_tag = LDAP_REQ_SEARCH;
-	op.o_protocol = LDAP_VERSION3;
 	op.o_ndn = *authc;
 	op.o_callback = &cb;
 	op.o_time = slap_get_time();
 	op.o_do_not_cache = 1;
 	op.o_is_auth_check = 1;
-	op.o_threadctx = opx->o_threadctx;
-	op.o_tmpmemctx = opx->o_tmpmemctx;
-	op.o_tmpmfuncs = opx->o_tmpmfuncs;
-#ifdef LDAP_SLAPI
-	op.o_pb = opx->o_pb;
-#endif
-	op.o_conn = opx->o_conn;
-	op.o_connid = opx->o_connid;
 	/* use req_ndn as req_dn instead of non-pretty base of uri */
-	if( !BER_BVISNULL( &op.o_req_dn ) ) ch_free( op.o_req_dn.bv_val );
+	if( !BER_BVISNULL( &base ) ) {
+		ch_free( base.bv_val );
+		/* just in case... */
+		BER_BVZERO( &base );
+	}
 	ber_dupbv_x( &op.o_req_dn, &op.o_req_ndn, op.o_tmpmemctx );
+	op.ors_deref = LDAP_DEREF_NEVER;
 	op.ors_slimit = 1;
 	op.ors_tlimit = SLAP_NO_LIMIT;
 	op.ors_attrs = slap_anlist_no_attrs;
 	op.ors_attrsonly = 1;
-	op.o_sync_slog_size = -1;
 
 	op.o_bd->be_search( &op, &rs );
 
@@ -1072,13 +1080,8 @@ CONCLUDED:
 	if( op.ors_filter ) filter_free_x( opx, op.ors_filter );
 	if( !BER_BVISNULL( &op.ors_filterstr ) ) ch_free( op.ors_filterstr.bv_val );
 
-#ifdef NEW_LOGGING
-	LDAP_LOG( TRANSPORT, ENTRY, 
-		"slap_sasl_match: comparison returned %d\n", rc, 0, 0 );
-#else
 	Debug( LDAP_DEBUG_TRACE,
 	   "<===slap_sasl_match: comparison returned %d\n", rc, 0, 0);
-#endif
 
 	return( rc );
 }
@@ -1102,17 +1105,11 @@ slap_sasl_check_authz( Operation *op,
 	int i, rc;
 	BerVarray vals = NULL;
 
-#ifdef NEW_LOGGING
-	LDAP_LOG( TRANSPORT, ENTRY, 
-		"slap_sasl_check_authz: does %s match %s rule in %s?\n",
-	    assertDN->bv_val, ad->ad_cname.bv_val, searchDN->bv_val);
-#else
 	Debug( LDAP_DEBUG_TRACE,
 	   "==>slap_sasl_check_authz: does %s match %s rule in %s?\n",
 	   assertDN->bv_val, ad->ad_cname.bv_val, searchDN->bv_val);
-#endif
 
-	rc = backend_attribute( op, NULL, searchDN, ad, &vals );
+	rc = backend_attribute( op, NULL, searchDN, ad, &vals, ACL_AUTH );
 	if( rc != LDAP_SUCCESS ) goto COMPLETE;
 
 	/* Check if the *assertDN matches any *vals */
@@ -1121,15 +1118,9 @@ slap_sasl_check_authz( Operation *op,
 COMPLETE:
 	if( vals ) ber_bvarray_free_x( vals, op->o_tmpmemctx );
 
-#ifdef NEW_LOGGING
-	LDAP_LOG( TRANSPORT, RESULTS, 
-		"slap_sasl_check_authz: %s check returning %d\n",
-		ad->ad_cname.bv_val, rc, 0 );
-#else
 	Debug( LDAP_DEBUG_TRACE,
 	   "<==slap_sasl_check_authz: %s check returning %d\n",
 		ad->ad_cname.bv_val, rc, 0);
-#endif
 
 	return( rc );
 }
@@ -1150,19 +1141,13 @@ void slap_sasl2dn( Operation *opx,
 	Operation op = {0};
 	SlapReply rs = {REP_RESULT};
 	struct berval regout = BER_BVNULL;
+	struct berval base = BER_BVNULL;
 
-#ifdef NEW_LOGGING
-	LDAP_LOG( TRANSPORT, ENTRY, 
-		"slap_sasl2dn: converting SASL name %s to DN.\n",
-		saslname->bv_val, 0, 0 );
-#else
 	Debug( LDAP_DEBUG_TRACE, "==>slap_sasl2dn: "
 		"converting SASL name %s to a DN\n",
 		saslname->bv_val, 0,0 );
-#endif
 
-	sasldn->bv_val = NULL;
-	sasldn->bv_len = 0;
+	BER_BVZERO( sasldn );
 	cb.sc_private = sasldn;
 
 	/* Convert the SASL name into a minimal URI */
@@ -1170,7 +1155,7 @@ void slap_sasl2dn( Operation *opx,
 		goto FINISHED;
 	}
 
-	rc = slap_parseURI( opx, &regout, &op.o_req_dn,
+	rc = slap_parseURI( opx, &regout, &base,
 		&op.o_req_ndn, &op.ors_scope, &op.ors_filter,
 		&op.ors_filterstr );
 	if ( !BER_BVISNULL( &regout ) ) slap_sl_free( regout.bv_val, opx->o_tmpmemctx );
@@ -1210,43 +1195,38 @@ void slap_sasl2dn( Operation *opx,
 		assert( 0 );
 	}
 
-#ifdef NEW_LOGGING
-	LDAP_LOG( TRANSPORT, DETAIL1, 
-		"slap_sasl2dn: performing internal search (base=%s, scope=%d)\n",
-		op.o_req_ndn.bv_val, op.ors_scope, 0 );
-#else
 	Debug( LDAP_DEBUG_TRACE,
 		"slap_sasl2dn: performing internal search (base=%s, scope=%d)\n",
 		op.o_req_ndn.bv_val, op.ors_scope, 0 );
-#endif
 
-	if(( op.o_bd == NULL ) || ( op.o_bd->be_search == NULL)) {
+	if ( ( op.o_bd == NULL ) || ( op.o_bd->be_search == NULL) ) {
 		goto FINISHED;
 	}
 
-	op.o_conn = opx->o_conn;
-	op.o_connid = opx->o_connid;
+	/* Must run an internal search. */
+	if ( op.ors_filter == NULL ) {
+		rc = LDAP_FILTER_ERROR;
+		goto FINISHED;
+	}
+
+	op.o_hdr = opx->o_hdr;
 	op.o_tag = LDAP_REQ_SEARCH;
-	op.o_protocol = LDAP_VERSION3;
 	op.o_ndn = opx->o_conn->c_ndn;
 	op.o_callback = &cb;
 	op.o_time = slap_get_time();
 	op.o_do_not_cache = 1;
 	op.o_is_auth_check = 1;
-	op.o_threadctx = opx->o_threadctx;
-	op.o_tmpmemctx = opx->o_tmpmemctx;
-	op.o_tmpmfuncs = opx->o_tmpmfuncs;
-#ifdef LDAP_SLAPI
-	op.o_pb = opx->o_pb;
-#endif
 	op.ors_deref = LDAP_DEREF_NEVER;
 	op.ors_slimit = 1;
 	op.ors_tlimit = SLAP_NO_LIMIT;
 	op.ors_attrs = slap_anlist_no_attrs;
 	op.ors_attrsonly = 1;
-	op.o_sync_slog_size = -1;
 	/* use req_ndn as req_dn instead of non-pretty base of uri */
-	if( !BER_BVISNULL( &op.o_req_dn ) ) ch_free( op.o_req_dn.bv_val );
+	if( !BER_BVISNULL( &base ) ) {
+		ch_free( base.bv_val );
+		/* just in case... */
+		BER_BVZERO( &base );
+	}
 	ber_dupbv_x( &op.o_req_dn, &op.o_req_ndn, op.o_tmpmemctx );
 
 	op.o_bd->be_search( &op, &rs );
@@ -1268,14 +1248,8 @@ FINISHED:
 		ch_free( op.ors_filterstr.bv_val );
 	}
 
-#ifdef NEW_LOGGING
-	LDAP_LOG( TRANSPORT, ENTRY, 
-		"slap_sasl2dn: Converted SASL name to %s\n",
-		!BER_BVISEMPTY( sasldn ) ? sasldn->bv_val : "<nothing>", 0, 0 );
-#else
 	Debug( LDAP_DEBUG_TRACE, "<==slap_sasl2dn: Converted SASL name to %s\n",
 		!BER_BVISEMPTY( sasldn ) ? sasldn->bv_val : "<nothing>", 0, 0 );
-#endif
 
 	return;
 }
@@ -1296,15 +1270,9 @@ int slap_sasl_authorized( Operation *op,
 		goto DONE;
 	}
 
-#ifdef NEW_LOGGING
-	LDAP_LOG( TRANSPORT, ENTRY, 
-		"slap_sasl_authorized: can %s become %s?\n", 
-		authcDN->bv_val, authzDN->bv_val, 0 );
-#else
 	Debug( LDAP_DEBUG_TRACE,
 	   "==>slap_sasl_authorized: can %s become %s?\n",
 		authcDN->bv_val, authzDN->bv_val, 0 );
-#endif
 
 	/* If person is authorizing to self, succeed */
 	if ( dn_match( authcDN, authzDN ) ) {
@@ -1342,12 +1310,8 @@ int slap_sasl_authorized( Operation *op,
 
 DONE:
 
-#ifdef NEW_LOGGING
-	LDAP_LOG( TRANSPORT, RESULTS, "slap_sasl_authorized: return %d\n", rc,0,0 );
-#else
 	Debug( LDAP_DEBUG_TRACE,
 		"<== slap_sasl_authorized: return %d\n", rc, 0, 0 );
-#endif
 
 	return( rc );
 }