X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fbind.c;h=e4e8dd5e1891fd45e6b990c20c47d3530915b2a5;hb=4d36fd5a3ed407b0a53004d1431f1669222138b4;hp=0a2cb3f3f9970b11591ddcb0a9403eef4605add8;hpb=2f3399265caf72d81ba192a86d63a7a96b0c837b;p=openldap diff --git a/servers/slapd/bind.c b/servers/slapd/bind.c index 0a2cb3f3f9..e4e8dd5e18 100644 --- a/servers/slapd/bind.c +++ b/servers/slapd/bind.c @@ -1,7 +1,7 @@ /* bind.c - decode an ldap bind operation and pass it to a backend db */ /* $OpenLDAP$ */ /* - * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved. + * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved. * COPYING RESTRICTIONS APPLY, see COPYRIGHT file */ @@ -36,19 +36,19 @@ do_bind( BerElement *ber = op->o_ber; ber_int_t version; ber_tag_t method; - char *mech = NULL; + struct berval mech = { 0, NULL }; struct berval dn = { 0, NULL }; - struct berval *pdn = NULL; - struct berval *ndn = NULL; + struct berval pdn = { 0, NULL }; + struct berval ndn = { 0, NULL }; + struct berval edn = { 0, NULL }; ber_tag_t tag; int rc = LDAP_SUCCESS; const char *text; struct berval cred = { 0, NULL }; - Backend *be; + Backend *be = NULL; #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY, - "do_bind: conn %d\n", conn->c_connid )); + LDAP_LOG( OPERATION, ENTRY, "do_bind: conn %d\n", conn->c_connid, 0, 0 ); #else Debug( LDAP_DEBUG_TRACE, "do_bind\n", 0, 0, 0 ); #endif @@ -57,7 +57,9 @@ do_bind( * Force to connection to "anonymous" until bind succeeds. */ ldap_pvt_thread_mutex_lock( &conn->c_mutex ); + if ( conn->c_sasl_bind_in_progress ) be = conn->c_authz_backend; connection2anonymous( conn ); + if ( conn->c_sasl_bind_in_progress ) conn->c_authz_backend = be; ldap_pvt_thread_mutex_unlock( &conn->c_mutex ); if ( op->o_dn.bv_val != NULL ) { @@ -92,12 +94,12 @@ do_bind( * } */ - tag = ber_scanf( ber, "{iot" /*}*/, &version, &dn, &method ); + tag = ber_scanf( ber, "{imt" /*}*/, &version, &dn, &method ); if ( tag == LBER_ERROR ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ERR, - "do_bind: conn %d ber_scanf failed\n", conn->c_connid )); + LDAP_LOG( OPERATION, ERR, + "do_bind: conn %d ber_scanf failed\n", conn->c_connid, 0, 0 ); #else Debug( LDAP_DEBUG_ANY, "bind: ber_scanf failed\n", 0, 0, 0 ); #endif @@ -110,17 +112,17 @@ do_bind( op->o_protocol = version; if( method != LDAP_AUTH_SASL ) { - tag = ber_scanf( ber, /*{*/ "o}", &cred ); + tag = ber_scanf( ber, /*{*/ "m}", &cred ); } else { - tag = ber_scanf( ber, "{a" /*}*/, &mech ); + tag = ber_scanf( ber, "{o" /*}*/, &mech ); if ( tag != LBER_ERROR ) { ber_len_t len; tag = ber_peek_tag( ber, &len ); if ( tag == LDAP_TAG_LDAPCRED ) { - tag = ber_scanf( ber, "o", &cred ); + tag = ber_scanf( ber, "m", &cred ); } else { tag = LDAP_TAG_LDAPCRED; cred.bv_val = NULL; @@ -143,35 +145,20 @@ do_bind( if( (rc = get_ctrls( conn, op, 1 )) != LDAP_SUCCESS ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_INFO, - "do_bind: conn %d get_ctrls failed\n", conn->c_connid )); + LDAP_LOG( OPERATION, INFO, + "do_bind: conn %d get_ctrls failed\n", conn->c_connid, 0, 0 ); #else Debug( LDAP_DEBUG_ANY, "do_bind: get_ctrls failed\n", 0, 0, 0 ); #endif goto cleanup; } - rc = dnPretty( NULL, &dn, &pdn ); + rc = dnPrettyNormal( NULL, &dn, &pdn, &ndn ); if ( rc != LDAP_SUCCESS ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_INFO, - "do_bind: conn %d invalid dn (%s)\n", - conn->c_connid, dn.bv_val )); -#else - Debug( LDAP_DEBUG_ANY, "bind: invalid dn (%s)\n", - dn.bv_val, 0, 0 ); -#endif - send_ldap_result( conn, op, rc = LDAP_INVALID_DN_SYNTAX, NULL, - "invalid DN", NULL, NULL ); - goto cleanup; - } - - rc = dnNormalize( NULL, &dn, &ndn ); - if ( rc != LDAP_SUCCESS ) { -#ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_INFO, - "do_bind: conn %d invalid dn (%s)\n", - conn->c_connid, dn.bv_val )); + LDAP_LOG( OPERATION, INFO, + "do_bind: conn %d invalid dn (%s)\n", + conn->c_connid, dn.bv_val, 0 ); #else Debug( LDAP_DEBUG_ANY, "bind: invalid dn (%s)\n", dn.bv_val, 0, 0 ); @@ -183,36 +170,35 @@ do_bind( if( method == LDAP_AUTH_SASL ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_DETAIL1, - "do_sasl_bind: conn %d dn (%s) mech %s\n", conn->c_connid, - pdn->bv_val, mech )); + LDAP_LOG( OPERATION, DETAIL1, + "do_sasl_bind: conn %d dn (%s) mech %s\n", + conn->c_connid, pdn.bv_val, mech.bv_val ); #else Debug( LDAP_DEBUG_TRACE, "do_sasl_bind: dn (%s) mech %s\n", - pdn->bv_val, mech, NULL ); + pdn.bv_val, mech.bv_val, NULL ); #endif } else { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_DETAIL1, - "do_bind: conn %d version=%ld dn=\"%s\" method=%ld\n", - conn->c_connid, (unsigned long) version, - pdn->bv_val, (unsigned long)method )); + LDAP_LOG( OPERATION, DETAIL1, + "do_bind: version=%ld dn=\"%s\" method=%ld\n", + (unsigned long) version, pdn.bv_val, (unsigned long)method ); #else Debug( LDAP_DEBUG_TRACE, "do_bind: version=%ld dn=\"%s\" method=%ld\n", (unsigned long) version, - pdn->bv_val, (unsigned long) method ); + pdn.bv_val, (unsigned long) method ); #endif } - Statslog( LDAP_DEBUG_STATS, "conn=%ld op=%d BIND dn=\"%s\" method=%ld\n", - op->o_connid, op->o_opid, pdn->bv_val, (unsigned long) method, 0 ); + Statslog( LDAP_DEBUG_STATS, "conn=%lu op=%lu BIND dn=\"%s\" method=%ld\n", + op->o_connid, op->o_opid, pdn.bv_val, (unsigned long) method, 0 ); if ( version < LDAP_VERSION_MIN || version > LDAP_VERSION_MAX ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_INFO, + LDAP_LOG( OPERATION, INFO, "do_bind: conn %d unknown version = %ld\n", - conn->c_connid, (unsigned long)version )); + conn->c_connid, (unsigned long)version, 0 ); #else Debug( LDAP_DEBUG_ANY, "do_bind: unknown version=%ld\n", (unsigned long) version, 0, 0 ); @@ -236,15 +222,26 @@ do_bind( conn->c_protocol = version; ldap_pvt_thread_mutex_unlock( &conn->c_mutex ); + /* check for inappropriate controls */ + if( get_manageDSAit( op ) == SLAP_CRITICAL_CONTROL ) { + send_ldap_result( conn, op, + rc = LDAP_UNAVAILABLE_CRITICAL_EXTENSION, + NULL, "manageDSAit control inappropriate", + NULL, NULL ); + goto cleanup; + } + + /* Set the bindop for the benefit of in-directory SASL lookups */ + conn->c_sasl_bindop = op; + if ( method == LDAP_AUTH_SASL ) { - char *edn; slap_ssf_t ssf = 0; if ( version < LDAP_VERSION3 ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_INFO, + LDAP_LOG( OPERATION, INFO, "do_bind: conn %d sasl with LDAPv%ld\n", - conn->c_connid, (unsigned long)version )); + conn->c_connid, (unsigned long)version , 0 ); #else Debug( LDAP_DEBUG_ANY, "do_bind: sasl with LDAPv%ld\n", (unsigned long) version, 0, 0 ); @@ -255,11 +252,11 @@ do_bind( goto cleanup; } - if( mech == NULL || *mech == '\0' ) { + if( mech.bv_len == 0 ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_INFO, + LDAP_LOG( OPERATION, INFO, "do_bind: conn %d no SASL mechanism provided\n", - conn->c_connid )); + conn->c_connid, 0, 0 ); #else Debug( LDAP_DEBUG_ANY, "do_bind: no sasl mechanism provided\n", @@ -271,7 +268,7 @@ do_bind( } /* check restrictions */ - rc = backend_check_restrictions( NULL, conn, op, mech, &text ); + rc = backend_check_restrictions( NULL, conn, op, &mech, &text ); if( rc != LDAP_SUCCESS ) { send_ldap_result( conn, op, rc, NULL, text, NULL, NULL ); @@ -280,33 +277,31 @@ do_bind( ldap_pvt_thread_mutex_lock( &conn->c_mutex ); if ( conn->c_sasl_bind_in_progress ) { - if((strcmp(conn->c_sasl_bind_mech, mech) != 0)) { + if((ber_bvcmp(&conn->c_sasl_bind_mech, &mech) != 0)) { /* mechanism changed between bind steps */ slap_sasl_reset(conn); } } else { conn->c_sasl_bind_mech = mech; - mech = NULL; + mech.bv_val = NULL; + mech.bv_len = 0; } ldap_pvt_thread_mutex_unlock( &conn->c_mutex ); - edn = NULL; rc = slap_sasl_bind( conn, op, - pdn->bv_val, ndn->bv_val, + &pdn, &ndn, &cred, &edn, &ssf ); ldap_pvt_thread_mutex_lock( &conn->c_mutex ); if( rc == LDAP_SUCCESS ) { - conn->c_dn.bv_val = edn; - if( edn != NULL ) { - struct berval *cndn; - conn->c_dn.bv_len = strlen( edn ); - dnNormalize( NULL, &conn->c_dn, &cndn ); - conn->c_ndn = *cndn; - free( cndn ); + conn->c_dn = edn; + if( edn.bv_len != 0 ) { + /* edn is always normalized already */ + ber_dupbv( &conn->c_ndn, &conn->c_dn ); } conn->c_authmech = conn->c_sasl_bind_mech; - conn->c_sasl_bind_mech = NULL; + conn->c_sasl_bind_mech.bv_val = NULL; + conn->c_sasl_bind_mech.bv_len = 0; conn->c_sasl_bind_in_progress = 0; conn->c_sasl_ssf = ssf; @@ -320,13 +315,24 @@ do_bind( LBER_SB_OPT_SET_MAX_INCOMING, &max ); } +#ifdef NEW_LOGGING + LDAP_LOG( OPERATION, DETAIL1, + "do_bind: SASL/%s bind: dn=\"%s\" ssf=%d\n", + conn->c_authmech.bv_val, conn->c_dn.bv_val, ssf ); +#else + Debug( LDAP_DEBUG_TRACE, + "do_bind: SASL/%s bind: dn=\"%s\" ssf=%d\n", + conn->c_authmech.bv_val, conn->c_dn.bv_val, ssf ); +#endif + } else if ( rc == LDAP_SASL_BIND_IN_PROGRESS ) { conn->c_sasl_bind_in_progress = 1; } else { - if ( conn->c_sasl_bind_mech ) { - free( conn->c_sasl_bind_mech ); - conn->c_sasl_bind_mech = NULL; + if ( conn->c_sasl_bind_mech.bv_val ) { + free( conn->c_sasl_bind_mech.bv_val ); + conn->c_sasl_bind_mech.bv_val = NULL; + conn->c_sasl_bind_mech.bv_len = 0; } conn->c_sasl_bind_in_progress = 0; } @@ -338,9 +344,10 @@ do_bind( /* Not SASL, cancel any in-progress bind */ ldap_pvt_thread_mutex_lock( &conn->c_mutex ); - if ( conn->c_sasl_bind_mech != NULL ) { - free(conn->c_sasl_bind_mech); - conn->c_sasl_bind_mech = NULL; + if ( conn->c_sasl_bind_mech.bv_val != NULL ) { + free(conn->c_sasl_bind_mech.bv_val); + conn->c_sasl_bind_mech.bv_val = NULL; + conn->c_sasl_bind_mech.bv_len = 0; } conn->c_sasl_bind_in_progress = 0; @@ -350,7 +357,7 @@ do_bind( if ( method == LDAP_AUTH_SIMPLE ) { /* accept "anonymous" binds */ - if ( cred.bv_len == 0 || ndn->bv_len == 0 ) { + if ( cred.bv_len == 0 || ndn.bv_len == 0 ) { rc = LDAP_SUCCESS; text = NULL; @@ -360,7 +367,7 @@ do_bind( /* cred is not empty, disallow */ rc = LDAP_INVALID_CREDENTIALS; - } else if ( ndn->bv_len && + } else if ( ndn.bv_len && !( global_allows & SLAP_ALLOW_BIND_ANON_DN )) { /* DN is not empty, disallow */ @@ -373,7 +380,8 @@ do_bind( text = "anonymous bind disallowed"; } else { - rc = backend_check_restrictions( NULL, conn, op, mech, &text ); + rc = backend_check_restrictions( NULL, conn, op, + &mech, &text ); } /* @@ -383,9 +391,9 @@ do_bind( send_ldap_result( conn, op, rc, NULL, text, NULL, NULL ); #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_DETAIL1, + LDAP_LOG( OPERATION, DETAIL1, "do_bind: conn %d v%d anonymous bind\n", - conn->c_connid, version )); + conn->c_connid, version , 0 ); #else Debug( LDAP_DEBUG_TRACE, "do_bind: v%d anonymous bind\n", version, 0, 0 ); @@ -400,13 +408,34 @@ do_bind( send_ldap_result( conn, op, rc, NULL, text, NULL, NULL ); #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_INFO, + LDAP_LOG( OPERATION, INFO, "do_bind: conn %d v%d simple bind(%s) disallowed\n", - conn->c_connid, version, ndn )); + conn->c_connid, version, ndn.bv_val ); #else Debug( LDAP_DEBUG_TRACE, "do_bind: v%d simple bind(%s) disallowed\n", - version, ndn, 0 ); + version, ndn.bv_val, 0 ); +#endif + goto cleanup; + + } else if (( global_disallows & SLAP_DISALLOW_BIND_SIMPLE_UNPROTECTED ) + && ( op->o_ssf < global_ssf_set.sss_ssf )) + { + rc = LDAP_CONFIDENTIALITY_REQUIRED; + text = "unwilling to perform simple authentication " + "without confidentilty protection"; + + send_ldap_result( conn, op, rc, + NULL, text, NULL, NULL ); + +#ifdef NEW_LOGGING + LDAP_LOG( OPERATION, INFO, "do_bind: conn %d " + "v%d unprotected simple bind(%s) disallowed\n", + conn->c_connid, version, ndn.bv_val ); +#else + Debug( LDAP_DEBUG_TRACE, + "do_bind: v%d unprotected simple bind(%s) disallowed\n", + version, ndn.bv_val, 0 ); #endif goto cleanup; } @@ -421,9 +450,9 @@ do_bind( send_ldap_result( conn, op, rc, NULL, text, NULL, NULL ); #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_DETAIL1, + LDAP_LOG( OPERATION, DETAIL1, "do_bind: conn %d v%d Kerberos V4 bind\n", - conn->c_connid, version )); + conn->c_connid, version , 0 ); #else Debug( LDAP_DEBUG_TRACE, "do_bind: v%d Kerberos V4 bind\n", version, 0, 0 ); @@ -439,9 +468,9 @@ do_bind( send_ldap_result( conn, op, rc, NULL, text, NULL, NULL ); #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_INFO, + LDAP_LOG( OPERATION, INFO, "do_bind: conn %ld v%d unknown authentication method (%ld)\n", - conn->c_connid, version, method )); + conn->c_connid, version, method ); #else Debug( LDAP_DEBUG_TRACE, "do_bind: v%d unknown authentication method (%ld)\n", @@ -456,15 +485,15 @@ do_bind( * if we don't hold it. */ - if ( (be = select_backend( ndn->bv_val, 0, 0 )) == NULL ) { + if ( (be = select_backend( &ndn, 0, 0 )) == NULL ) { if ( default_referral ) { - struct berval **ref = referral_rewrite( default_referral, - NULL, pdn->bv_val, LDAP_SCOPE_DEFAULT ); + BerVarray ref = referral_rewrite( default_referral, + NULL, &pdn, LDAP_SCOPE_DEFAULT ); send_ldap_result( conn, op, rc = LDAP_REFERRAL, NULL, NULL, ref ? ref : default_referral, NULL ); - ber_bvecfree( ref ); + ber_bvarray_free( ref ); } else { /* noSuchObject is not allowed to be returned by bind */ @@ -483,38 +512,33 @@ do_bind( goto cleanup; } - conn->c_authz_backend = be; - if ( be->be_bind ) { int ret; - /* alias suffix */ - char *edn = NULL; /* deref suffix alias if appropriate */ - ndn->bv_val = suffix_alias( be, ndn->bv_val ); - ndn->bv_len = strlen( ndn->bv_val ); + suffix_alias( be, &ndn ); ret = (*be->be_bind)( be, conn, op, - pdn->bv_val, ndn->bv_val, - method, &cred, &edn ); + &pdn, &ndn, method, &cred, &edn ); if ( ret == 0 ) { ldap_pvt_thread_mutex_lock( &conn->c_mutex ); - if(edn != NULL) { - conn->c_dn.bv_val = edn; - conn->c_dn.bv_len = strlen( edn ); + if( conn->c_authz_backend == NULL ) { + conn->c_authz_backend = be; + } + + if(edn.bv_len) { + conn->c_dn = edn; } else { - conn->c_dn.bv_val = ch_strdup( pdn->bv_val ); - conn->c_dn.bv_len = pdn->bv_len; + conn->c_dn = pdn; + pdn.bv_val = NULL; + pdn.bv_len = 0; } - conn->c_cdn = pdn->bv_val; - pdn->bv_val = NULL; - pdn->bv_len = 0; - conn->c_ndn = *ndn; - ndn->bv_val = NULL; - ndn->bv_len = 0; + conn->c_ndn = ndn; + ndn.bv_val = NULL; + ndn.bv_len = 0; if( conn->c_dn.bv_len != 0 ) { ber_len_t max = sockbuf_max_incoming; @@ -523,13 +547,13 @@ do_bind( } #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_DETAIL1, - "do_bind: conn %d v%d bind: \"%s\" to \"%s\" \n", - conn->c_connid, version, conn->c_cdn, conn->c_dn.bv_val )); + LDAP_LOG( OPERATION, DETAIL1, + "do_bind: v%d bind: \"%s\" to \"%s\" \n", + version, conn->c_dn.bv_val, conn->c_dn.bv_val ); #else Debug( LDAP_DEBUG_TRACE, "do_bind: v%d bind: \"%s\" to \"%s\"\n", - version, conn->c_cdn, conn->c_dn.bv_val ); + version, dn.bv_val, conn->c_dn.bv_val ); #endif ldap_pvt_thread_mutex_unlock( &conn->c_mutex ); @@ -538,8 +562,8 @@ do_bind( send_ldap_result( conn, op, LDAP_SUCCESS, NULL, NULL, NULL, NULL ); - } else if (edn != NULL) { - free( edn ); + } else if (edn.bv_val != NULL) { + free( edn.bv_val ); } } else { @@ -549,18 +573,16 @@ do_bind( } cleanup: - free( dn.bv_val ); - if( pdn != NULL ) { - ber_bvfree( pdn ); - } - if( ndn != NULL ) { - ber_bvfree( ndn ); + conn->c_sasl_bindop = NULL; + + if( pdn.bv_val != NULL ) { + free( pdn.bv_val ); } - if ( mech != NULL ) { - free( mech ); + if( ndn.bv_val != NULL ) { + free( ndn.bv_val ); } - if ( cred.bv_val != NULL ) { - free( cred.bv_val ); + if ( mech.bv_val != NULL ) { + free( mech.bv_val ); } return rc;