X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fbind.c;h=81898e3ea083dd5c6bf159d522581e6e789db920;hb=3b3232f21c000d7562c27e0ea65abc195bd16105;hp=6378d78ddf0ddfca8d1e42439ca356336953ff03;hpb=aee36002767937f0dfe7382270979f0827fcf072;p=openldap diff --git a/servers/slapd/bind.c b/servers/slapd/bind.c index 6378d78ddf..81898e3ea0 100644 --- a/servers/slapd/bind.c +++ b/servers/slapd/bind.c @@ -1,7 +1,7 @@ /* bind.c - decode an ldap bind operation and pass it to a backend db */ /* $OpenLDAP$ */ /* - * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved. + * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved. * COPYING RESTRICTIONS APPLY, see COPYRIGHT file */ @@ -33,44 +33,45 @@ do_bind( Operation *op ) { - BerElement *ber = op->o_ber; - ber_int_t version; + BerElement *ber = op->o_ber; + ber_int_t version; ber_tag_t method; - char *mech; - char *dn; - char *ndn; - ber_tag_t tag; - int rc = LDAP_SUCCESS; - const char *text; - struct berval cred; - Backend *be; + struct berval mech = { 0, NULL }; + struct berval dn = { 0, NULL }; + struct berval pdn = { 0, NULL }; + struct berval ndn = { 0, NULL }; + struct berval edn = { 0, NULL }; + ber_tag_t tag; + int rc = LDAP_SUCCESS; + const char *text; + struct berval cred = { 0, NULL }; + Backend *be; #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY, "do_bind: conn %d\n", conn->c_connid )); + LDAP_LOG( OPERATION, ENTRY, "do_bind: conn %d\n", conn->c_connid, 0, 0 ); #else Debug( LDAP_DEBUG_TRACE, "do_bind\n", 0, 0, 0 ); #endif - dn = NULL; - ndn = NULL; - mech = NULL; - cred.bv_val = NULL; - /* * Force to connection to "anonymous" until bind succeeds. */ ldap_pvt_thread_mutex_lock( &conn->c_mutex ); + if ( conn->c_sasl_bind_in_progress ) be = conn->c_authz_backend; connection2anonymous( conn ); + if ( conn->c_sasl_bind_in_progress ) conn->c_authz_backend = be; ldap_pvt_thread_mutex_unlock( &conn->c_mutex ); - if ( op->o_dn != NULL ) { - free( op->o_dn ); - op->o_dn = ch_strdup( "" ); + if ( op->o_dn.bv_val != NULL ) { + free( op->o_dn.bv_val ); + op->o_dn.bv_val = ch_strdup( "" ); + op->o_dn.bv_len = 0; } - if ( op->o_ndn != NULL ) { - free( op->o_ndn ); - op->o_ndn = ch_strdup( "" ); + if ( op->o_ndn.bv_val != NULL ) { + free( op->o_ndn.bv_val ); + op->o_ndn.bv_val = ch_strdup( "" ); + op->o_ndn.bv_len = 0; } /* @@ -93,12 +94,12 @@ do_bind( * } */ - tag = ber_scanf( ber, "{iat" /*}*/, &version, &dn, &method ); + tag = ber_scanf( ber, "{imt" /*}*/, &version, &dn, &method ); if ( tag == LBER_ERROR ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ERR, - "do_bind: conn %d ber_scanf failed\n", conn->c_connid )); + LDAP_LOG( OPERATION, ERR, + "do_bind: conn %d ber_scanf failed\n", conn->c_connid, 0, 0 ); #else Debug( LDAP_DEBUG_ANY, "bind: ber_scanf failed\n", 0, 0, 0 ); #endif @@ -111,17 +112,17 @@ do_bind( op->o_protocol = version; if( method != LDAP_AUTH_SASL ) { - tag = ber_scanf( ber, /*{*/ "o}", &cred ); + tag = ber_scanf( ber, /*{*/ "m}", &cred ); } else { - tag = ber_scanf( ber, "{a" /*}*/, &mech ); + tag = ber_scanf( ber, "{o" /*}*/, &mech ); if ( tag != LBER_ERROR ) { ber_len_t len; tag = ber_peek_tag( ber, &len ); if ( tag == LDAP_TAG_LDAPCRED ) { - tag = ber_scanf( ber, "o", &cred ); + tag = ber_scanf( ber, "m", &cred ); } else { tag = LDAP_TAG_LDAPCRED; cred.bv_val = NULL; @@ -144,22 +145,23 @@ do_bind( if( (rc = get_ctrls( conn, op, 1 )) != LDAP_SUCCESS ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_INFO, - "do_bind: conn %d get_ctrls failed\n", conn->c_connid )); + LDAP_LOG( OPERATION, INFO, + "do_bind: conn %d get_ctrls failed\n", conn->c_connid, 0, 0 ); #else Debug( LDAP_DEBUG_ANY, "do_bind: get_ctrls failed\n", 0, 0, 0 ); #endif goto cleanup; } - ndn = ch_strdup( dn ); - - if ( dn_normalize( ndn ) == NULL ) { + rc = dnPrettyNormal( NULL, &dn, &pdn, &ndn ); + if ( rc != LDAP_SUCCESS ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_INFO, - "do_bind: conn %d invalid dn (%s)\n", conn->c_connid, dn )); + LDAP_LOG( OPERATION, INFO, + "do_bind: conn %d invalid dn (%s)\n", + conn->c_connid, dn.bv_val, 0 ); #else - Debug( LDAP_DEBUG_ANY, "bind: invalid dn (%s)\n", dn, 0, 0 ); + Debug( LDAP_DEBUG_ANY, "bind: invalid dn (%s)\n", + dn.bv_val, 0, 0 ); #endif send_ldap_result( conn, op, rc = LDAP_INVALID_DN_SYNTAX, NULL, "invalid DN", NULL, NULL ); @@ -168,32 +170,35 @@ do_bind( if( method == LDAP_AUTH_SASL ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_DETAIL1, - "do_sasl_bind: conn %d dn (%s) mech %s\n", conn->c_connid, - dn, mech )); + LDAP_LOG( OPERATION, DETAIL1, + "do_sasl_bind: conn %d dn (%s) mech %s\n", + conn->c_connid, pdn.bv_val, mech.bv_val ); #else Debug( LDAP_DEBUG_TRACE, "do_sasl_bind: dn (%s) mech %s\n", - dn, mech, NULL ); + pdn.bv_val, mech.bv_val, NULL ); #endif + } else { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_DETAIL1, - "do_bind: conn %d version=%ld dn=\"%s\" method=%ld\n", - conn->c_connid, (unsigned long) version, dn, (unsigned long)method )); + LDAP_LOG( OPERATION, DETAIL1, + "do_bind: version=%ld dn=\"%s\" method=%ld\n", + (unsigned long) version, pdn.bv_val, (unsigned long)method ); #else - Debug( LDAP_DEBUG_TRACE, "do_bind: version=%ld dn=\"%s\" method=%ld\n", - (unsigned long) version, dn, (unsigned long) method ); + Debug( LDAP_DEBUG_TRACE, + "do_bind: version=%ld dn=\"%s\" method=%ld\n", + (unsigned long) version, + pdn.bv_val, (unsigned long) method ); #endif } - Statslog( LDAP_DEBUG_STATS, "conn=%ld op=%d BIND dn=\"%s\" method=%ld\n", - op->o_connid, op->o_opid, ndn, (unsigned long) method, 0 ); + Statslog( LDAP_DEBUG_STATS, "conn=%lu op=%lu BIND dn=\"%s\" method=%ld\n", + op->o_connid, op->o_opid, pdn.bv_val, (unsigned long) method, 0 ); if ( version < LDAP_VERSION_MIN || version > LDAP_VERSION_MAX ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_INFO, - "do_bind: conn %d unknown version = %ld\n", - conn->c_connid, (unsigned long)version )); + LDAP_LOG( OPERATION, INFO, + "do_bind: conn %d unknown version = %ld\n", + conn->c_connid, (unsigned long)version, 0 ); #else Debug( LDAP_DEBUG_ANY, "do_bind: unknown version=%ld\n", (unsigned long) version, 0, 0 ); @@ -202,7 +207,7 @@ do_bind( NULL, "requested protocol version not supported", NULL, NULL ); goto cleanup; - } else if (( global_disallows & SLAP_DISALLOW_BIND_V2 ) && + } else if (!( global_allows & SLAP_ALLOW_BIND_V2 ) && version < LDAP_VERSION3 ) { send_ldap_result( conn, op, rc = LDAP_PROTOCOL_ERROR, @@ -217,15 +222,23 @@ do_bind( conn->c_protocol = version; ldap_pvt_thread_mutex_unlock( &conn->c_mutex ); + /* check for inappropriate controls */ + if( get_manageDSAit( op ) == SLAP_CRITICAL_CONTROL ) { + send_ldap_result( conn, op, + rc = LDAP_UNAVAILABLE_CRITICAL_EXTENSION, + NULL, "manageDSAit control inappropriate", + NULL, NULL ); + goto cleanup; + } + if ( method == LDAP_AUTH_SASL ) { - char *edn; slap_ssf_t ssf = 0; if ( version < LDAP_VERSION3 ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_INFO, - "do_bind: conn %d sasl with LDAPv%ld\n", - conn->c_connid, (unsigned long)version )); + LDAP_LOG( OPERATION, INFO, + "do_bind: conn %d sasl with LDAPv%ld\n", + conn->c_connid, (unsigned long)version , 0 ); #else Debug( LDAP_DEBUG_ANY, "do_bind: sasl with LDAPv%ld\n", (unsigned long) version, 0, 0 ); @@ -236,11 +249,11 @@ do_bind( goto cleanup; } - if( mech == NULL || *mech == '\0' ) { + if( mech.bv_len == 0 ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_INFO, + LDAP_LOG( OPERATION, INFO, "do_bind: conn %d no SASL mechanism provided\n", - conn->c_connid )); + conn->c_connid, 0, 0 ); #else Debug( LDAP_DEBUG_ANY, "do_bind: no sasl mechanism provided\n", @@ -252,7 +265,7 @@ do_bind( } /* check restrictions */ - rc = backend_check_restrictions( NULL, conn, op, mech, &text ); + rc = backend_check_restrictions( NULL, conn, op, &mech, &text ); if( rc != LDAP_SUCCESS ) { send_ldap_result( conn, op, rc, NULL, text, NULL, NULL ); @@ -261,24 +274,31 @@ do_bind( ldap_pvt_thread_mutex_lock( &conn->c_mutex ); if ( conn->c_sasl_bind_in_progress ) { - if((strcmp(conn->c_sasl_bind_mech, mech) != 0)) { + if((ber_bvcmp(&conn->c_sasl_bind_mech, &mech) != 0)) { /* mechanism changed between bind steps */ slap_sasl_reset(conn); } } else { conn->c_sasl_bind_mech = mech; - mech = NULL; + mech.bv_val = NULL; + mech.bv_len = 0; } ldap_pvt_thread_mutex_unlock( &conn->c_mutex ); - edn = NULL; - rc = slap_sasl_bind( conn, op, dn, ndn, &cred, &edn, &ssf ); + rc = slap_sasl_bind( conn, op, + &pdn, &ndn, + &cred, &edn, &ssf ); ldap_pvt_thread_mutex_lock( &conn->c_mutex ); if( rc == LDAP_SUCCESS ) { conn->c_dn = edn; + if( edn.bv_len != 0 ) { + /* edn is always normalized already */ + ber_dupbv( &conn->c_ndn, &conn->c_dn ); + } conn->c_authmech = conn->c_sasl_bind_mech; - conn->c_sasl_bind_mech = NULL; + conn->c_sasl_bind_mech.bv_val = NULL; + conn->c_sasl_bind_mech.bv_len = 0; conn->c_sasl_bind_in_progress = 0; conn->c_sasl_ssf = ssf; @@ -286,7 +306,7 @@ do_bind( conn->c_ssf = ssf; } - if( conn->c_dn != NULL ) { + if( conn->c_dn.bv_len != 0 ) { ber_len_t max = sockbuf_max_incoming; ber_sockbuf_ctrl( conn->c_sb, LBER_SB_OPT_SET_MAX_INCOMING, &max ); @@ -296,9 +316,10 @@ do_bind( conn->c_sasl_bind_in_progress = 1; } else { - if ( conn->c_sasl_bind_mech ) { - free( conn->c_sasl_bind_mech ); - conn->c_sasl_bind_mech = NULL; + if ( conn->c_sasl_bind_mech.bv_val ) { + free( conn->c_sasl_bind_mech.bv_val ); + conn->c_sasl_bind_mech.bv_val = NULL; + conn->c_sasl_bind_mech.bv_len = 0; } conn->c_sasl_bind_in_progress = 0; } @@ -310,9 +331,10 @@ do_bind( /* Not SASL, cancel any in-progress bind */ ldap_pvt_thread_mutex_lock( &conn->c_mutex ); - if ( conn->c_sasl_bind_mech != NULL ) { - free(conn->c_sasl_bind_mech); - conn->c_sasl_bind_mech = NULL; + if ( conn->c_sasl_bind_mech.bv_val != NULL ) { + free(conn->c_sasl_bind_mech.bv_val); + conn->c_sasl_bind_mech.bv_val = NULL; + conn->c_sasl_bind_mech.bv_len = 0; } conn->c_sasl_bind_in_progress = 0; @@ -322,18 +344,18 @@ do_bind( if ( method == LDAP_AUTH_SIMPLE ) { /* accept "anonymous" binds */ - if ( cred.bv_len == 0 || ndn == NULL || *ndn == '\0' ) { + if ( cred.bv_len == 0 || ndn.bv_len == 0 ) { rc = LDAP_SUCCESS; text = NULL; if( cred.bv_len && - ( global_disallows & SLAP_DISALLOW_BIND_ANON_CRED )) + !( global_allows & SLAP_ALLOW_BIND_ANON_CRED )) { /* cred is not empty, disallow */ rc = LDAP_INVALID_CREDENTIALS; - } else if ( ndn != NULL && *ndn != '\0' && - ( global_disallows & SLAP_DISALLOW_BIND_ANON_DN )) + } else if ( ndn.bv_len && + !( global_allows & SLAP_ALLOW_BIND_ANON_DN )) { /* DN is not empty, disallow */ rc = LDAP_UNWILLING_TO_PERFORM; @@ -345,7 +367,8 @@ do_bind( text = "anonymous bind disallowed"; } else { - rc = backend_check_restrictions( NULL, conn, op, mech, &text ); + rc = backend_check_restrictions( NULL, conn, op, + &mech, &text ); } /* @@ -355,9 +378,9 @@ do_bind( send_ldap_result( conn, op, rc, NULL, text, NULL, NULL ); #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_DETAIL1, + LDAP_LOG( OPERATION, DETAIL1, "do_bind: conn %d v%d anonymous bind\n", - conn->c_connid, version )); + conn->c_connid, version , 0 ); #else Debug( LDAP_DEBUG_TRACE, "do_bind: v%d anonymous bind\n", version, 0, 0 ); @@ -372,13 +395,34 @@ do_bind( send_ldap_result( conn, op, rc, NULL, text, NULL, NULL ); #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_INFO, + LDAP_LOG( OPERATION, INFO, "do_bind: conn %d v%d simple bind(%s) disallowed\n", - conn->c_connid, version, ndn )); + conn->c_connid, version, ndn.bv_val ); #else Debug( LDAP_DEBUG_TRACE, "do_bind: v%d simple bind(%s) disallowed\n", - version, ndn, 0 ); + version, ndn.bv_val, 0 ); +#endif + goto cleanup; + + } else if (( global_disallows & SLAP_DISALLOW_BIND_SIMPLE_UNPROTECTED ) + && ( op->o_ssf < global_ssf_set.sss_ssf )) + { + rc = LDAP_CONFIDENTIALITY_REQUIRED; + text = "unwilling to perform simple authentication " + "without confidentilty protection"; + + send_ldap_result( conn, op, rc, + NULL, text, NULL, NULL ); + +#ifdef NEW_LOGGING + LDAP_LOG( OPERATION, INFO, "do_bind: conn %d " + "v%d unprotected simple bind(%s) disallowed\n", + conn->c_connid, version, ndn.bv_val ); +#else + Debug( LDAP_DEBUG_TRACE, + "do_bind: v%d unprotected simple bind(%s) disallowed\n", + version, ndn.bv_val, 0 ); #endif goto cleanup; } @@ -393,9 +437,9 @@ do_bind( send_ldap_result( conn, op, rc, NULL, text, NULL, NULL ); #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_DETAIL1, + LDAP_LOG( OPERATION, DETAIL1, "do_bind: conn %d v%d Kerberos V4 bind\n", - conn->c_connid, version )); + conn->c_connid, version , 0 ); #else Debug( LDAP_DEBUG_TRACE, "do_bind: v%d Kerberos V4 bind\n", version, 0, 0 ); @@ -411,9 +455,9 @@ do_bind( send_ldap_result( conn, op, rc, NULL, text, NULL, NULL ); #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_INFO, + LDAP_LOG( OPERATION, INFO, "do_bind: conn %ld v%d unknown authentication method (%ld)\n", - conn->c_connid, version, method )); + conn->c_connid, version, method ); #else Debug( LDAP_DEBUG_TRACE, "do_bind: v%d unknown authentication method (%ld)\n", @@ -428,15 +472,15 @@ do_bind( * if we don't hold it. */ - if ( (be = select_backend( ndn, 0 )) == NULL ) { + if ( (be = select_backend( &ndn, 0, 0 )) == NULL ) { if ( default_referral ) { - struct berval **ref = referral_rewrite( default_referral, - NULL, dn, LDAP_SCOPE_DEFAULT ); + BerVarray ref = referral_rewrite( default_referral, + NULL, &pdn, LDAP_SCOPE_DEFAULT ); send_ldap_result( conn, op, rc = LDAP_REFERRAL, NULL, NULL, ref ? ref : default_referral, NULL ); - ber_bvecfree( ref ); + ber_bvarray_free( ref ); } else { /* noSuchObject is not allowed to be returned by bind */ @@ -455,45 +499,48 @@ do_bind( goto cleanup; } - conn->c_authz_backend = be; - if ( be->be_bind ) { int ret; - /* alias suffix */ - char *edn = NULL; /* deref suffix alias if appropriate */ - ndn = suffix_alias( be, ndn ); + suffix_alias( be, &ndn ); - ret = (*be->be_bind)( be, conn, op, dn, ndn, - method, &cred, &edn ); + ret = (*be->be_bind)( be, conn, op, + &pdn, &ndn, method, &cred, &edn ); if ( ret == 0 ) { ldap_pvt_thread_mutex_lock( &conn->c_mutex ); - conn->c_cdn = dn; - dn = NULL; + if( conn->c_authz_backend == NULL ) { + conn->c_authz_backend = be; + } - if(edn != NULL) { + if(edn.bv_len) { conn->c_dn = edn; } else { - conn->c_dn = ndn; - ndn = NULL; + conn->c_dn = pdn; + pdn.bv_val = NULL; + pdn.bv_len = 0; } - if( conn->c_dn != NULL ) { + conn->c_ndn = ndn; + ndn.bv_val = NULL; + ndn.bv_len = 0; + + if( conn->c_dn.bv_len != 0 ) { ber_len_t max = sockbuf_max_incoming; ber_sockbuf_ctrl( conn->c_sb, LBER_SB_OPT_SET_MAX_INCOMING, &max ); } #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_DETAIL1, - "do_bind: conn %d v%d bind: \"%s\" to \"%s\" \n", - conn->c_connid, version, conn->c_cdn, conn->c_dn )); + LDAP_LOG( OPERATION, DETAIL1, + "do_bind: v%d bind: \"%s\" to \"%s\" \n", + version, conn->c_dn.bv_val, conn->c_dn.bv_val ); #else - Debug( LDAP_DEBUG_TRACE, "do_bind: v%d bind: \"%s\" to \"%s\"\n", - version, conn->c_cdn, conn->c_dn ); + Debug( LDAP_DEBUG_TRACE, + "do_bind: v%d bind: \"%s\" to \"%s\"\n", + version, dn.bv_val, conn->c_dn.bv_val ); #endif ldap_pvt_thread_mutex_unlock( &conn->c_mutex ); @@ -502,27 +549,25 @@ do_bind( send_ldap_result( conn, op, LDAP_SUCCESS, NULL, NULL, NULL, NULL ); - } else if (edn != NULL) { - free( edn ); + } else if (edn.bv_val != NULL) { + free( edn.bv_val ); } } else { send_ldap_result( conn, op, rc = LDAP_UNWILLING_TO_PERFORM, - NULL, "operation not supported within namingContext", NULL, NULL ); + NULL, "operation not supported within namingContext", + NULL, NULL ); } cleanup: - if( dn != NULL ) { - free( dn ); - } - if( ndn != NULL ) { - free( ndn ); + if( pdn.bv_val != NULL ) { + free( pdn.bv_val ); } - if ( mech != NULL ) { - free( mech ); + if( ndn.bv_val != NULL ) { + free( ndn.bv_val ); } - if ( cred.bv_val != NULL ) { - free( cred.bv_val ); + if ( mech.bv_val != NULL ) { + free( mech.bv_val ); } return rc;