X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fbind.c;h=daa473859c9a602927ef1ce64ae288915cd32934;hb=ea44e65a82eecb0eec29d2fcd07beb900b3e02da;hp=b8553f7b6fb78576971ccf4dc9f0e24784e4a27b;hpb=e906747d51576a2aae2caa5a751c5cc35b417c48;p=openldap diff --git a/servers/slapd/bind.c b/servers/slapd/bind.c index b8553f7b6f..daa473859c 100644 --- a/servers/slapd/bind.c +++ b/servers/slapd/bind.c @@ -1,12 +1,19 @@ /* bind.c - decode an ldap bind operation and pass it to a backend db */ /* $OpenLDAP$ */ -/* - * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved. - * COPYING RESTRICTIONS APPLY, see COPYRIGHT file +/* This work is part of OpenLDAP Software . + * + * Copyright 1998-2012 The OpenLDAP Foundation. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted only as authorized by the OpenLDAP + * Public License. + * + * A copy of this license is available in the file LICENSE in the + * top-level directory of the distribution or, alternatively, at + * . */ - -/* - * Copyright (c) 1995 Regents of the University of Michigan. +/* Portions Copyright (c) 1995 Regents of the University of Michigan. * All rights reserved. * * Redistribution and use in source and binary forms are permitted @@ -24,69 +31,51 @@ #include #include -#include "ldap_pvt.h" #include "slap.h" -#ifdef LDAP_SLAPI -#include "slapi.h" -#endif - int do_bind( - Connection *conn, - Operation *op -) + Operation *op, + SlapReply *rs ) { BerElement *ber = op->o_ber; ber_int_t version; ber_tag_t method; - struct berval mech = { 0, NULL }; - struct berval dn = { 0, NULL }; - struct berval pdn = { 0, NULL }; - struct berval ndn = { 0, NULL }; - struct berval edn = { 0, NULL }; + struct berval mech = BER_BVNULL; + struct berval dn = BER_BVNULL; ber_tag_t tag; - int rc = LDAP_SUCCESS; - const char *text; - struct berval cred = { 0, NULL }; Backend *be = NULL; -#ifdef LDAP_SLAPI - Slapi_PBlock *pb = op->o_pb; -#endif - -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, ENTRY, "do_bind: conn %d\n", conn->c_connid, 0, 0 ); -#else - Debug( LDAP_DEBUG_TRACE, "do_bind\n", 0, 0, 0 ); -#endif + Debug( LDAP_DEBUG_TRACE, "%s do_bind\n", + op->o_log_prefix, 0, 0 ); /* - * Force to connection to "anonymous" until bind succeeds. + * Force the connection to "anonymous" until bind succeeds. */ - ldap_pvt_thread_mutex_lock( &conn->c_mutex ); - if ( conn->c_sasl_bind_in_progress ) be = conn->c_authz_backend; - - /* log authorization identity demotion */ - if ( conn->c_dn.bv_len ) { + ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex ); + if ( op->o_conn->c_sasl_bind_in_progress ) { + be = op->o_conn->c_authz_backend; + } + if ( !BER_BVISEMPTY( &op->o_conn->c_dn ) ) { + /* log authorization identity demotion */ Statslog( LDAP_DEBUG_STATS, - "conn=%lu op=%lu BIND anonymous mech=implicit ssf=0", - op->o_connid, op->o_opid, 0, 0, 0 ); + "%s BIND anonymous mech=implicit ssf=0\n", + op->o_log_prefix, 0, 0, 0, 0 ); } - - connection2anonymous( conn ); - if ( conn->c_sasl_bind_in_progress ) conn->c_authz_backend = be; - ldap_pvt_thread_mutex_unlock( &conn->c_mutex ); - - if ( op->o_dn.bv_val != NULL ) { - free( op->o_dn.bv_val ); - op->o_dn.bv_val = ch_strdup( "" ); + connection2anonymous( op->o_conn ); + if ( op->o_conn->c_sasl_bind_in_progress ) { + op->o_conn->c_authz_backend = be; + } + ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex ); + if ( !BER_BVISNULL( &op->o_dn ) ) { + /* NOTE: temporarily wasting few bytes + * (until bind is completed), but saving + * a couple of ch_free() and ch_strdup("") */ + op->o_dn.bv_val[0] = '\0'; op->o_dn.bv_len = 0; } - - if ( op->o_ndn.bv_val != NULL ) { - free( op->o_ndn.bv_val ); - op->o_ndn.bv_val = ch_strdup( "" ); + if ( !BER_BVISNULL( &op->o_ndn ) ) { + op->o_ndn.bv_val[0] = '\0'; op->o_ndn.bv_len = 0; } @@ -98,8 +87,8 @@ do_bind( * name DistinguishedName, -- dn * authentication CHOICE { * simple [0] OCTET STRING -- passwd - * krbv42ldap [1] OCTET STRING - * krbv42dsa [2] OCTET STRING + * krbv42ldap [1] OCTET STRING -- OBSOLETE + * krbv42dsa [2] OCTET STRING -- OBSOLETE * SASL [3] SaslCredentials * } * } @@ -113,36 +102,31 @@ do_bind( tag = ber_scanf( ber, "{imt" /*}*/, &version, &dn, &method ); if ( tag == LBER_ERROR ) { -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, ERR, - "do_bind: conn %d ber_scanf failed\n", conn->c_connid, 0, 0 ); -#else - Debug( LDAP_DEBUG_ANY, "bind: ber_scanf failed\n", 0, 0, 0 ); -#endif - send_ldap_disconnect( conn, op, - LDAP_PROTOCOL_ERROR, "decoding error" ); - rc = -1; + Debug( LDAP_DEBUG_ANY, "%s do_bind: ber_scanf failed\n", + op->o_log_prefix, 0, 0 ); + send_ldap_discon( op, rs, LDAP_PROTOCOL_ERROR, "decoding error" ); + rs->sr_err = SLAPD_DISCONNECT; goto cleanup; } op->o_protocol = version; + op->orb_method = method; - if( method != LDAP_AUTH_SASL ) { - tag = ber_scanf( ber, /*{*/ "m}", &cred ); + if( op->orb_method != LDAP_AUTH_SASL ) { + tag = ber_scanf( ber, /*{*/ "m}", &op->orb_cred ); } else { - tag = ber_scanf( ber, "{o" /*}*/, &mech ); + tag = ber_scanf( ber, "{m" /*}*/, &mech ); if ( tag != LBER_ERROR ) { ber_len_t len; tag = ber_peek_tag( ber, &len ); if ( tag == LDAP_TAG_LDAPCRED ) { - tag = ber_scanf( ber, "m", &cred ); + tag = ber_scanf( ber, "m", &op->orb_cred ); } else { tag = LDAP_TAG_LDAPCRED; - cred.bv_val = NULL; - cred.bv_len = 0; + BER_BVZERO( &op->orb_cred ); } if ( tag != LBER_ERROR ) { @@ -152,358 +136,223 @@ do_bind( } if ( tag == LBER_ERROR ) { - send_ldap_disconnect( conn, op, - LDAP_PROTOCOL_ERROR, - "decoding error" ); - rc = SLAPD_DISCONNECT; + Debug( LDAP_DEBUG_ANY, "%s do_bind: ber_scanf failed\n", + op->o_log_prefix, 0, 0 ); + send_ldap_discon( op, rs, LDAP_PROTOCOL_ERROR, "decoding error" ); + rs->sr_err = SLAPD_DISCONNECT; goto cleanup; } - if( (rc = get_ctrls( conn, op, 1 )) != LDAP_SUCCESS ) { -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, INFO, - "do_bind: conn %d get_ctrls failed\n", conn->c_connid, 0, 0 ); -#else - Debug( LDAP_DEBUG_ANY, "do_bind: get_ctrls failed\n", 0, 0, 0 ); -#endif + if( get_ctrls( op, rs, 1 ) != LDAP_SUCCESS ) { + Debug( LDAP_DEBUG_ANY, "%s do_bind: get_ctrls failed\n", + op->o_log_prefix, 0, 0 ); goto cleanup; } - rc = dnPrettyNormal( NULL, &dn, &pdn, &ndn ); - if ( rc != LDAP_SUCCESS ) { -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, INFO, - "do_bind: conn %d invalid dn (%s)\n", - conn->c_connid, dn.bv_val, 0 ); -#else - Debug( LDAP_DEBUG_ANY, "bind: invalid dn (%s)\n", - dn.bv_val, 0, 0 ); -#endif - send_ldap_result( conn, op, rc = LDAP_INVALID_DN_SYNTAX, NULL, - "invalid DN", NULL, NULL ); + /* We use the tmpmemctx here because it speeds up normalization. + * However, we must dup with regular malloc when storing any + * resulting DNs in the op or conn structures. + */ + rs->sr_err = dnPrettyNormal( NULL, &dn, &op->o_req_dn, &op->o_req_ndn, + op->o_tmpmemctx ); + if ( rs->sr_err != LDAP_SUCCESS ) { + Debug( LDAP_DEBUG_ANY, "%s do_bind: invalid dn (%s)\n", + op->o_log_prefix, dn.bv_val, 0 ); + send_ldap_error( op, rs, LDAP_INVALID_DN_SYNTAX, "invalid DN" ); goto cleanup; } - if( method == LDAP_AUTH_SASL ) { -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, DETAIL1, - "do_sasl_bind: conn %d dn (%s) mech %s\n", - conn->c_connid, pdn.bv_val, mech.bv_val ); -#else - Debug( LDAP_DEBUG_TRACE, "do_sasl_bind: dn (%s) mech %s\n", - pdn.bv_val, mech.bv_val, NULL ); -#endif + Statslog( LDAP_DEBUG_STATS, "%s BIND dn=\"%s\" method=%ld\n", + op->o_log_prefix, op->o_req_dn.bv_val, + (unsigned long) op->orb_method, 0, 0 ); + + if( op->orb_method == LDAP_AUTH_SASL ) { + Debug( LDAP_DEBUG_TRACE, "do_bind: dn (%s) SASL mech %s\n", + op->o_req_dn.bv_val, mech.bv_val, NULL ); } else { -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, DETAIL1, - "do_bind: version=%ld dn=\"%s\" method=%ld\n", - (unsigned long) version, pdn.bv_val, (unsigned long)method ); -#else Debug( LDAP_DEBUG_TRACE, "do_bind: version=%ld dn=\"%s\" method=%ld\n", - (unsigned long) version, - pdn.bv_val, (unsigned long) method ); -#endif + (unsigned long) version, op->o_req_dn.bv_val, + (unsigned long) op->orb_method ); } - Statslog( LDAP_DEBUG_STATS, "conn=%lu op=%lu BIND dn=\"%s\" method=%ld\n", - op->o_connid, op->o_opid, pdn.bv_val, (unsigned long) method, 0 ); - if ( version < LDAP_VERSION_MIN || version > LDAP_VERSION_MAX ) { -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, INFO, - "do_bind: conn %d unknown version = %ld\n", - conn->c_connid, (unsigned long)version, 0 ); -#else - Debug( LDAP_DEBUG_ANY, "do_bind: unknown version=%ld\n", - (unsigned long) version, 0, 0 ); -#endif - send_ldap_result( conn, op, rc = LDAP_PROTOCOL_ERROR, - NULL, "requested protocol version not supported", NULL, NULL ); + Debug( LDAP_DEBUG_ANY, "%s do_bind: unknown version=%ld\n", + op->o_log_prefix, (unsigned long) version, 0 ); + send_ldap_error( op, rs, LDAP_PROTOCOL_ERROR, + "requested protocol version not supported" ); goto cleanup; } else if (!( global_allows & SLAP_ALLOW_BIND_V2 ) && version < LDAP_VERSION3 ) { - send_ldap_result( conn, op, rc = LDAP_PROTOCOL_ERROR, - NULL, "historical protocol version requested, use LDAPv3 instead", - NULL, NULL ); + send_ldap_error( op, rs, LDAP_PROTOCOL_ERROR, + "historical protocol version requested, use LDAPv3 instead" ); goto cleanup; } - /* we set connection version regardless of whether bind succeeds - * or not. + /* + * we set connection version regardless of whether bind succeeds or not. */ - ldap_pvt_thread_mutex_lock( &conn->c_mutex ); - conn->c_protocol = version; - ldap_pvt_thread_mutex_unlock( &conn->c_mutex ); + ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex ); + op->o_conn->c_protocol = version; + ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex ); - /* check for inappropriate controls */ - if( get_manageDSAit( op ) == SLAP_CRITICAL_CONTROL ) { - send_ldap_result( conn, op, - rc = LDAP_UNAVAILABLE_CRITICAL_EXTENSION, - NULL, "manageDSAit control inappropriate", - NULL, NULL ); - goto cleanup; + op->orb_mech = mech; + + op->o_bd = frontendDB; + rs->sr_err = frontendDB->be_bind( op, rs ); + +cleanup: + if ( rs->sr_err == LDAP_SUCCESS ) { + if ( op->orb_method != LDAP_AUTH_SASL ) { + ber_dupbv( &op->o_conn->c_authmech, &mech ); + } + op->o_conn->c_authtype = op->orb_method; } - /* Set the bindop for the benefit of in-directory SASL lookups */ - conn->c_sasl_bindop = op; + if( !BER_BVISNULL( &op->o_req_dn ) ) { + slap_sl_free( op->o_req_dn.bv_val, op->o_tmpmemctx ); + BER_BVZERO( &op->o_req_dn ); + } + if( !BER_BVISNULL( &op->o_req_ndn ) ) { + slap_sl_free( op->o_req_ndn.bv_val, op->o_tmpmemctx ); + BER_BVZERO( &op->o_req_ndn ); + } - if ( method == LDAP_AUTH_SASL ) { - slap_ssf_t ssf = 0; + return rs->sr_err; +} - if ( version < LDAP_VERSION3 ) { -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, INFO, - "do_bind: conn %d sasl with LDAPv%ld\n", - conn->c_connid, (unsigned long)version , 0 ); -#else +int +fe_op_bind( Operation *op, SlapReply *rs ) +{ + BackendDB *bd = op->o_bd; + + /* check for inappropriate controls */ + if( get_manageDSAit( op ) == SLAP_CONTROL_CRITICAL ) { + send_ldap_error( op, rs, + LDAP_UNAVAILABLE_CRITICAL_EXTENSION, + "manageDSAit control inappropriate" ); + goto cleanup; + } + + if ( op->orb_method == LDAP_AUTH_SASL ) { + if ( op->o_protocol < LDAP_VERSION3 ) { Debug( LDAP_DEBUG_ANY, "do_bind: sasl with LDAPv%ld\n", - (unsigned long) version, 0, 0 ); -#endif - send_ldap_disconnect( conn, op, + (unsigned long)op->o_protocol, 0, 0 ); + send_ldap_discon( op, rs, LDAP_PROTOCOL_ERROR, "SASL bind requires LDAPv3" ); - rc = SLAPD_DISCONNECT; + rs->sr_err = SLAPD_DISCONNECT; goto cleanup; } - if( mech.bv_len == 0 ) { -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, INFO, - "do_bind: conn %d no SASL mechanism provided\n", - conn->c_connid, 0, 0 ); -#else + if( BER_BVISNULL( &op->orb_mech ) || BER_BVISEMPTY( &op->orb_mech ) ) { Debug( LDAP_DEBUG_ANY, "do_bind: no sasl mechanism provided\n", 0, 0, 0 ); -#endif - send_ldap_result( conn, op, rc = LDAP_AUTH_METHOD_NOT_SUPPORTED, - NULL, "no SASL mechanism provided", NULL, NULL ); + send_ldap_error( op, rs, LDAP_AUTH_METHOD_NOT_SUPPORTED, + "no SASL mechanism provided" ); goto cleanup; } /* check restrictions */ - rc = backend_check_restrictions( NULL, conn, op, &mech, &text ); - if( rc != LDAP_SUCCESS ) { - send_ldap_result( conn, op, rc, - NULL, text, NULL, NULL ); + if( backend_check_restrictions( op, rs, &op->orb_mech ) != LDAP_SUCCESS ) { + send_ldap_result( op, rs ); goto cleanup; } - ldap_pvt_thread_mutex_lock( &conn->c_mutex ); - if ( conn->c_sasl_bind_in_progress ) { - if( !bvmatch( &conn->c_sasl_bind_mech, &mech ) ) { + ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex ); + if ( op->o_conn->c_sasl_bind_in_progress ) { + if( !bvmatch( &op->o_conn->c_sasl_bind_mech, &op->orb_mech ) ) { /* mechanism changed between bind steps */ - slap_sasl_reset(conn); + slap_sasl_reset(op->o_conn); } } else { - conn->c_sasl_bind_mech = mech; - mech.bv_val = NULL; - mech.bv_len = 0; + ber_dupbv(&op->o_conn->c_sasl_bind_mech, &op->orb_mech); } - ldap_pvt_thread_mutex_unlock( &conn->c_mutex ); - - rc = slap_sasl_bind( conn, op, - &pdn, &ndn, - &cred, &edn, &ssf ); - - ldap_pvt_thread_mutex_lock( &conn->c_mutex ); - if( rc == LDAP_SUCCESS ) { - conn->c_dn = edn; - if( edn.bv_len != 0 ) { - /* edn is always normalized already */ - ber_dupbv( &conn->c_ndn, &conn->c_dn ); - } - conn->c_authmech = conn->c_sasl_bind_mech; - conn->c_sasl_bind_mech.bv_val = NULL; - conn->c_sasl_bind_mech.bv_len = 0; - conn->c_sasl_bind_in_progress = 0; - - conn->c_sasl_ssf = ssf; - if( ssf > conn->c_ssf ) { - conn->c_ssf = ssf; - } - - if( conn->c_dn.bv_len != 0 ) { - ber_len_t max = sockbuf_max_incoming_auth; - ber_sockbuf_ctrl( conn->c_sb, - LBER_SB_OPT_SET_MAX_INCOMING, &max ); - } - /* log authorization identity */ - Statslog( LDAP_DEBUG_STATS, - "conn=%lu op=%lu BIND dn=\"%s\" mech=%s ssf=%d\n", - op->o_connid, op->o_opid, - conn->c_dn.bv_val ? conn->c_dn.bv_val : "", - conn->c_authmech.bv_val, ssf ); - -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, DETAIL1, - "do_bind: SASL/%s bind: dn=\"%s\" ssf=%d\n", - conn->c_authmech.bv_val, - conn->c_dn.bv_val ? conn->c_dn.bv_val : "", - ssf ); -#else - Debug( LDAP_DEBUG_TRACE, - "do_bind: SASL/%s bind: dn=\"%s\" ssf=%d\n", - conn->c_authmech.bv_val, - conn->c_dn.bv_val ? conn->c_dn.bv_val : "", - ssf ); -#endif + /* Set the bindop for the benefit of in-directory SASL lookups */ + op->o_conn->c_sasl_bindop = op; - } else if ( rc == LDAP_SASL_BIND_IN_PROGRESS ) { - conn->c_sasl_bind_in_progress = 1; + ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex ); - } else { - if ( conn->c_sasl_bind_mech.bv_val ) { - free( conn->c_sasl_bind_mech.bv_val ); - conn->c_sasl_bind_mech.bv_val = NULL; - conn->c_sasl_bind_mech.bv_len = 0; - } - conn->c_sasl_bind_in_progress = 0; - } - ldap_pvt_thread_mutex_unlock( &conn->c_mutex ); + rs->sr_err = slap_sasl_bind( op, rs ); goto cleanup; } else { /* Not SASL, cancel any in-progress bind */ - ldap_pvt_thread_mutex_lock( &conn->c_mutex ); + ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex ); - if ( conn->c_sasl_bind_mech.bv_val != NULL ) { - free(conn->c_sasl_bind_mech.bv_val); - conn->c_sasl_bind_mech.bv_val = NULL; - conn->c_sasl_bind_mech.bv_len = 0; + if ( !BER_BVISNULL( &op->o_conn->c_sasl_bind_mech ) ) { + free( op->o_conn->c_sasl_bind_mech.bv_val ); + BER_BVZERO( &op->o_conn->c_sasl_bind_mech ); } - conn->c_sasl_bind_in_progress = 0; + op->o_conn->c_sasl_bind_in_progress = 0; - slap_sasl_reset( conn ); - ldap_pvt_thread_mutex_unlock( &conn->c_mutex ); + slap_sasl_reset( op->o_conn ); + ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex ); } - if ( method == LDAP_AUTH_SIMPLE ) { + if ( op->orb_method == LDAP_AUTH_SIMPLE ) { + BER_BVSTR( &op->orb_mech, "SIMPLE" ); /* accept "anonymous" binds */ - if ( cred.bv_len == 0 || ndn.bv_len == 0 ) { - rc = LDAP_SUCCESS; - text = NULL; + if ( BER_BVISEMPTY( &op->orb_cred ) || BER_BVISEMPTY( &op->o_req_ndn ) ) { + rs->sr_err = LDAP_SUCCESS; - if( cred.bv_len && + if( !BER_BVISEMPTY( &op->orb_cred ) && !( global_allows & SLAP_ALLOW_BIND_ANON_CRED )) { /* cred is not empty, disallow */ - rc = LDAP_INVALID_CREDENTIALS; + rs->sr_err = LDAP_INVALID_CREDENTIALS; - } else if ( ndn.bv_len && + } else if ( !BER_BVISEMPTY( &op->o_req_ndn ) && !( global_allows & SLAP_ALLOW_BIND_ANON_DN )) { /* DN is not empty, disallow */ - rc = LDAP_UNWILLING_TO_PERFORM; - text = "unauthenticated bind (DN with no password) disallowed"; + rs->sr_err = LDAP_UNWILLING_TO_PERFORM; + rs->sr_text = + "unauthenticated bind (DN with no password) disallowed"; } else if ( global_disallows & SLAP_DISALLOW_BIND_ANON ) { /* disallow */ - rc = LDAP_INAPPROPRIATE_AUTH; - text = "anonymous bind disallowed"; + rs->sr_err = LDAP_INAPPROPRIATE_AUTH; + rs->sr_text = "anonymous bind disallowed"; } else { - rc = backend_check_restrictions( NULL, conn, op, - &mech, &text ); + backend_check_restrictions( op, rs, &op->orb_mech ); } /* * we already forced connection to "anonymous", * just need to send success */ - send_ldap_result( conn, op, rc, - NULL, text, NULL, NULL ); -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, DETAIL1, - "do_bind: conn %d v%d anonymous bind\n", - conn->c_connid, version , 0 ); -#else + send_ldap_result( op, rs ); Debug( LDAP_DEBUG_TRACE, "do_bind: v%d anonymous bind\n", - version, 0, 0 ); -#endif + op->o_protocol, 0, 0 ); goto cleanup; } else if ( global_disallows & SLAP_DISALLOW_BIND_SIMPLE ) { /* disallow simple authentication */ - rc = LDAP_UNWILLING_TO_PERFORM; - text = "unwilling to perform simple authentication"; - - send_ldap_result( conn, op, rc, - NULL, text, NULL, NULL ); -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, INFO, - "do_bind: conn %d v%d simple bind(%s) disallowed\n", - conn->c_connid, version, ndn.bv_val ); -#else - Debug( LDAP_DEBUG_TRACE, - "do_bind: v%d simple bind(%s) disallowed\n", - version, ndn.bv_val, 0 ); -#endif - goto cleanup; + rs->sr_err = LDAP_UNWILLING_TO_PERFORM; + rs->sr_text = "unwilling to perform simple authentication"; - } else if (( global_disallows & SLAP_DISALLOW_BIND_SIMPLE_UNPROTECTED ) - && ( op->o_ssf <= 1 )) - { - rc = LDAP_CONFIDENTIALITY_REQUIRED; - text = "unwilling to perform simple authentication " - "without confidentilty protection"; - - send_ldap_result( conn, op, rc, - NULL, text, NULL, NULL ); - -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, INFO, "do_bind: conn %d " - "v%d unprotected simple bind(%s) disallowed\n", - conn->c_connid, version, ndn.bv_val ); -#else + send_ldap_result( op, rs ); Debug( LDAP_DEBUG_TRACE, - "do_bind: v%d unprotected simple bind(%s) disallowed\n", - version, ndn.bv_val, 0 ); -#endif - goto cleanup; - } - -#ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND - } else if ( method == LDAP_AUTH_KRBV41 || method == LDAP_AUTH_KRBV42 ) { - if ( global_disallows & SLAP_DISALLOW_BIND_KRBV4 ) { - /* disallow simple authentication */ - rc = LDAP_UNWILLING_TO_PERFORM; - text = "unwilling to perform Kerberos V4 bind"; - - send_ldap_result( conn, op, rc, - NULL, text, NULL, NULL ); -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, DETAIL1, - "do_bind: conn %d v%d Kerberos V4 bind\n", - conn->c_connid, version , 0 ); -#else - Debug( LDAP_DEBUG_TRACE, "do_bind: v%d Kerberos V4 bind\n", - version, 0, 0 ); -#endif + "do_bind: v%d simple bind(%s) disallowed\n", + op->o_protocol, op->o_req_ndn.bv_val, 0 ); goto cleanup; } -#endif } else { - rc = LDAP_AUTH_METHOD_NOT_SUPPORTED; - text = "unknown authentication method"; - - send_ldap_result( conn, op, rc, - NULL, text, NULL, NULL ); -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, INFO, - "do_bind: conn %ld v%d unknown authentication method (%ld)\n", - conn->c_connid, version, method ); -#else + rs->sr_err = LDAP_AUTH_METHOD_NOT_SUPPORTED; + rs->sr_text = "unknown authentication method"; + + send_ldap_result( op, rs ); Debug( LDAP_DEBUG_TRACE, - "do_bind: v%d unknown authentication method (%ld)\n", - version, method, 0 ); -#endif + "do_bind: v%d unknown authentication method (%d)\n", + op->o_protocol, op->orb_method, 0 ); goto cleanup; } @@ -513,183 +362,83 @@ do_bind( * if we don't hold it. */ - if ( (be = select_backend( &ndn, 0, 0 )) == NULL ) { - if ( default_referral ) { - BerVarray ref = referral_rewrite( default_referral, - NULL, &pdn, LDAP_SCOPE_DEFAULT ); - - send_ldap_result( conn, op, rc = LDAP_REFERRAL, - NULL, NULL, ref ? ref : default_referral, NULL ); - - ber_bvarray_free( ref ); - - } else { - /* noSuchObject is not allowed to be returned by bind */ - send_ldap_result( conn, op, rc = LDAP_INVALID_CREDENTIALS, - NULL, NULL, NULL, NULL ); - } - + if ( (op->o_bd = select_backend( &op->o_req_ndn, 0 )) == NULL ) { + /* don't return referral for bind requests */ + /* noSuchObject is not allowed to be returned by bind */ + rs->sr_err = LDAP_INVALID_CREDENTIALS; + op->o_bd = bd; + send_ldap_result( op, rs ); goto cleanup; } /* check restrictions */ - rc = backend_check_restrictions( be, conn, op, NULL, &text ); - if( rc != LDAP_SUCCESS ) { - send_ldap_result( conn, op, rc, - NULL, text, NULL, NULL ); + if( backend_check_restrictions( op, rs, NULL ) != LDAP_SUCCESS ) { + send_ldap_result( op, rs ); goto cleanup; } -#if defined( LDAP_SLAPI ) - slapi_x_backend_set_pb( pb, be ); - slapi_x_connection_set_pb( pb, conn ); - slapi_x_operation_set_pb( pb, op ); - slapi_pblock_set( pb, SLAPI_BIND_TARGET, (void *)dn.bv_val ); - slapi_pblock_set( pb, SLAPI_BIND_METHOD, (void *)method ); - slapi_pblock_set( pb, SLAPI_BIND_CREDENTIALS, (void *)&cred ); - slapi_pblock_set( pb, SLAPI_MANAGEDSAIT, (void *)(0) ); - - rc = doPluginFNs( be, SLAPI_PLUGIN_PRE_BIND_FN, pb ); - if ( rc != SLAPI_BIND_SUCCESS ) { - /* - * Binding is a special case for SLAPI plugins. It is - * possible for a bind plugin to be successful *and* - * abort further processing; this means it has handled - * a bind request authoritatively. If we have reached - * here, a result has been sent to the client (XXX - * need to check with Sun whether SLAPI_BIND_ANONYMOUS - * means a result has been sent). - */ - int ldapRc; - - if ( slapi_pblock_get( pb, SLAPI_RESULT_CODE, (void *)&ldapRc ) != 0 ) - ldapRc = LDAP_OTHER; - - edn.bv_val = NULL; - edn.bv_len = 0; - if ( rc != SLAPI_BIND_FAIL && ldapRc == LDAP_SUCCESS ) { - /* Set the new connection DN. */ - if ( rc != SLAPI_BIND_ANONYMOUS ) { - slapi_pblock_get( pb, SLAPI_CONN_DN, (void *)&edn.bv_val ); - } - rc = dnPrettyNormal( NULL, &edn, &pdn, &ndn ); - ldap_pvt_thread_mutex_lock( &conn->c_mutex ); - conn->c_dn = pdn; - conn->c_ndn = ndn; - pdn.bv_val = NULL; - pdn.bv_len = 0; - ndn.bv_val = NULL; - ndn.bv_len = 0; - if ( conn->c_dn.bv_len != 0 ) { - ber_len_t max = sockbuf_max_incoming_auth; - ber_sockbuf_ctrl( conn->c_sb, LBER_SB_OPT_SET_MAX_INCOMING, &max ); - } - /* log authorization identity */ - Statslog( LDAP_DEBUG_STATS, - "conn=%lu op=%lu BIND dn=\"%s\" mech=simple (SLAPI) ssf=0\n", - op->o_connid, op->o_opid, - conn->c_dn.bv_val, 0, 0 ); - ldap_pvt_thread_mutex_unlock( &conn->c_mutex ); - } -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, INFO, "do_bind: Bind preoperation plugin returned %d\n", - rc, 0, 0); -#else - Debug(LDAP_DEBUG_TRACE, "do_bind: Bind preoperation plugin returned %d.\n", - rc, 0, 0); -#endif - rc = ldapRc; - goto cleanup; - } -#endif /* defined( LDAP_SLAPI ) */ - - if ( be->be_bind ) { - int ret; + if( op->o_bd->be_bind ) { + op->o_conn->c_authz_cookie = NULL; - ret = (*be->be_bind)( be, conn, op, - &pdn, &ndn, method, &cred, &edn ); + rs->sr_err = (op->o_bd->be_bind)( op, rs ); - if ( ret == 0 ) { - ldap_pvt_thread_mutex_lock( &conn->c_mutex ); - - if( conn->c_authz_backend == NULL ) { - conn->c_authz_backend = be; - } + if ( rs->sr_err == 0 ) { + (void)fe_op_bind_success( op, rs ); - if(edn.bv_len) { - conn->c_dn = edn; - } else { - conn->c_dn = pdn; - pdn.bv_val = NULL; - pdn.bv_len = 0; - } - - conn->c_ndn = ndn; - ndn.bv_val = NULL; - ndn.bv_len = 0; - - if( conn->c_dn.bv_len != 0 ) { - ber_len_t max = sockbuf_max_incoming_auth; - ber_sockbuf_ctrl( conn->c_sb, - LBER_SB_OPT_SET_MAX_INCOMING, &max ); - } + } else if ( !BER_BVISNULL( &op->orb_edn ) ) { + free( op->orb_edn.bv_val ); + BER_BVZERO( &op->orb_edn ); + } - /* log authorization identity */ - Statslog( LDAP_DEBUG_STATS, - "conn=%lu op=%lu BIND dn=\"%s\" mech=simple ssf=0\n", - op->o_connid, op->o_opid, - conn->c_dn.bv_val, conn->c_authmech.bv_val, 0 ); - -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, DETAIL1, - "do_bind: v%d bind: \"%s\" to \"%s\" \n", - version, conn->c_dn.bv_val, conn->c_dn.bv_val ); -#else - Debug( LDAP_DEBUG_TRACE, - "do_bind: v%d bind: \"%s\" to \"%s\"\n", - version, dn.bv_val, conn->c_dn.bv_val ); -#endif + } else { + send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM, + "operation not supported within naming context" ); + } - ldap_pvt_thread_mutex_unlock( &conn->c_mutex ); +cleanup:; + op->o_bd = bd; + return rs->sr_err; +} - /* send this here to avoid a race condition */ - send_ldap_result( conn, op, LDAP_SUCCESS, - NULL, NULL, NULL, NULL ); +int +fe_op_bind_success( Operation *op, SlapReply *rs ) +{ + ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex ); - } else if (edn.bv_val != NULL) { - free( edn.bv_val ); - } + if( op->o_conn->c_authz_backend == NULL ) { + op->o_conn->c_authz_backend = op->o_bd; + } + /* be_bind returns regular/global edn */ + if( !BER_BVISEMPTY( &op->orb_edn ) ) { + op->o_conn->c_dn = op->orb_edn; } else { - send_ldap_result( conn, op, rc = LDAP_UNWILLING_TO_PERFORM, - NULL, "operation not supported within namingContext", - NULL, NULL ); + ber_dupbv(&op->o_conn->c_dn, &op->o_req_dn); } -#if defined( LDAP_SLAPI ) - if ( doPluginFNs( be, SLAPI_PLUGIN_POST_BIND_FN, pb ) != 0 ) { -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, INFO, "do_bind: Bind postoperation plugins failed\n", - 0, 0, 0); -#else - Debug(LDAP_DEBUG_TRACE, "do_bind: Bind postoperation plugins failed.\n", - 0, 0, 0); -#endif + ber_dupbv( &op->o_conn->c_ndn, &op->o_req_ndn ); + + /* op->o_conn->c_sb may be 0 for internal operations */ + if( !BER_BVISEMPTY( &op->o_conn->c_dn ) && op->o_conn->c_sb != 0 ) { + ber_len_t max = sockbuf_max_incoming_auth; + ber_sockbuf_ctrl( op->o_conn->c_sb, + LBER_SB_OPT_SET_MAX_INCOMING, &max ); } -#endif /* defined( LDAP_SLAPI ) */ -cleanup: - conn->c_sasl_bindop = NULL; + /* log authorization identity */ + Statslog( LDAP_DEBUG_STATS, + "%s BIND dn=\"%s\" mech=%s ssf=0\n", + op->o_log_prefix, + op->o_conn->c_dn.bv_val, op->orb_mech.bv_val, 0, 0 ); - if( pdn.bv_val != NULL ) { - free( pdn.bv_val ); - } - if( ndn.bv_val != NULL ) { - free( ndn.bv_val ); - } - if ( mech.bv_val != NULL ) { - free( mech.bv_val ); - } + Debug( LDAP_DEBUG_TRACE, + "do_bind: v%d bind: \"%s\" to \"%s\"\n", + op->o_protocol, op->o_req_dn.bv_val, op->o_conn->c_dn.bv_val ); + + ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex ); + + /* send this here to avoid a race condition */ + send_ldap_result( op, rs ); - return rc; + return LDAP_SUCCESS; }