X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Foverlays%2Fppolicy.c;h=503a9c63fa108dc643f8ae35c52b21cd67a33c19;hb=ec49990d51658542eff1461366806cbfb58eb63f;hp=958da9ee6b6327487bd80fcf8de0e04c0a447f70;hpb=e014144f985904e73efc26328be32eaa75f463f2;p=openldap diff --git a/servers/slapd/overlays/ppolicy.c b/servers/slapd/overlays/ppolicy.c index 958da9ee6b..503a9c63fa 100644 --- a/servers/slapd/overlays/ppolicy.c +++ b/servers/slapd/overlays/ppolicy.c @@ -1,7 +1,7 @@ /* $OpenLDAP$ */ /* This work is part of OpenLDAP Software . * - * Copyright 2004 The OpenLDAP Foundation. + * Copyright 2004-2005 The OpenLDAP Foundation. * Portions Copyright 2004 Howard Chu, Symas Corporation. * Portions Copyright 2004 Hewlett-Packard Company. * All rights reserved. @@ -23,19 +23,18 @@ #include "portable.h" /* This file implements "Password Policy for LDAP Directories", - * based on draft behera-ldap-password-policy-07 + * based on draft behera-ldap-password-policy-08 */ #ifdef SLAPD_OVER_PPOLICY -#if SLAPD_OVER_PPOLICY == SLAPD_MOD_DYNAMIC -#define SLAPD_IMPORT -#endif - #include #include "lutil.h" #include "slap.h" +#if SLAPD_MODULES +#define LIBLTDL_DLL_IMPORT /* Win32: don't re-export libltdl's symbols */ #include +#endif #include #include #include @@ -49,16 +48,18 @@ typedef struct pp_info { struct berval def_policy; /* DN of default policy subentry */ int use_lockout; /* send AccountLocked result? */ + int hash_passwords; /* transparently hash cleartext pwds */ } pp_info; /* Our per-connection info - note, it is not per-instance, it is * used by all instances */ typedef struct pw_conn { - int restrict; /* TRUE if connection is restricted */ + int restricted; /* TRUE if connection is restricted */ } pw_conn; static pw_conn *pwcons; +static int ppolicy_cid; typedef struct pass_policy { AttributeDescription *ad; /* attribute to which the policy applies */ @@ -70,7 +71,7 @@ typedef struct pass_policy { int pwdMinLength; /* minimum number of chars in password */ int pwdExpireWarning; /* number of seconds that warning controls are sent before a password expires */ - int pwdGraceLoginLimit; /* number of times you can log in with an + int pwdGraceAuthNLimit; /* number of times you can log in with an expired password */ int pwdLockout; /* 0 = do not lockout passwords, 1 = lock them out */ int pwdLockoutDuration; /* time in seconds a password is locked out for */ @@ -97,8 +98,8 @@ typedef struct pw_hist { /* Operational attributes */ static AttributeDescription *ad_pwdChangedTime, *ad_pwdAccountLockedTime, - *ad_pwdExpirationWarned, *ad_pwdFailureTime, *ad_pwdHistory, - *ad_pwdGraceUseTime, *ad_pwdReset, *ad_pwdPolicySubentry; + *ad_pwdFailureTime, *ad_pwdHistory, *ad_pwdGraceUseTime, *ad_pwdReset, + *ad_pwdPolicySubentry; static struct schema_info { char *def; @@ -110,7 +111,7 @@ static struct schema_info { "EQUALITY generalizedTimeMatch " "ORDERING generalizedTimeOrderingMatch " "SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 " - "SINGLE-VALUE USAGE directoryOperation )", + "SINGLE-VALUE USAGE directoryOperation NO-USER-MODIFICATION )", &ad_pwdChangedTime }, { "( 1.3.6.1.4.1.42.2.27.8.1.17 " "NAME ( 'pwdAccountLockedTime' ) " @@ -120,14 +121,6 @@ static struct schema_info { "SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 " "SINGLE-VALUE USAGE directoryOperation )", &ad_pwdAccountLockedTime }, - { "( 1.3.6.1.4.1.42.2.27.8.1.18 " - "NAME ( 'pwdExpirationWarned' ) " - "DESC 'The time the user was first warned about the coming expiration of the password' " - "EQUALITY generalizedTimeMatch " - "ORDERING generalizedTimeOrderingMatch " - "SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 " - "SINGLE-VALUE USAGE directoryOperation )", - &ad_pwdExpirationWarned }, { "( 1.3.6.1.4.1.42.2.27.8.1.19 " "NAME ( 'pwdFailureTime' ) " "DESC 'The timestamps of the last consecutive authentication failures' " @@ -141,14 +134,14 @@ static struct schema_info { "DESC 'The history of users passwords' " "EQUALITY octetStringMatch " "SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 " - "USAGE directoryOperation )", + "USAGE directoryOperation NO-USER-MODIFICATION )", &ad_pwdHistory }, { "( 1.3.6.1.4.1.42.2.27.8.1.21 " "NAME ( 'pwdGraceUseTime' ) " "DESC 'The timestamps of the grace login once the password has expired' " "EQUALITY generalizedTimeMatch " "SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 " - "USAGE directoryOperation )", + "USAGE directoryOperation NO-USER-MODIFICATION )", &ad_pwdGraceUseTime }, { "( 1.3.6.1.4.1.42.2.27.8.1.22 " "NAME ( 'pwdReset' ) " @@ -170,7 +163,7 @@ static struct schema_info { /* User attributes */ static AttributeDescription *ad_pwdMinAge, *ad_pwdMaxAge, *ad_pwdInHistory, *ad_pwdCheckQuality, *ad_pwdMinLength, *ad_pwdMaxFailure, - *ad_pwdGraceLoginLimit, *ad_pwdExpireWarning, *ad_pwdLockoutDuration, + *ad_pwdGraceAuthNLimit, *ad_pwdExpireWarning, *ad_pwdLockoutDuration, *ad_pwdFailureCountInterval, *ad_pwdCheckModule, *ad_pwdLockout, *ad_pwdMustChange, *ad_pwdAllowUserChange, *ad_pwdSafeModify, *ad_pwdAttribute; @@ -185,7 +178,7 @@ static struct schema_info pwd_UsSchema[] = { TAB(pwdCheckQuality), TAB(pwdMinLength), TAB(pwdMaxFailure), - TAB(pwdGraceLoginLimit), + TAB(pwdGraceAuthNLimit), TAB(pwdExpireWarning), TAB(pwdLockout), TAB(pwdLockoutDuration), @@ -218,10 +211,8 @@ account_locked( Operation *op, Entry *e, PassPolicy *pp, Modifications **mod ) { Attribute *la; - int rc; - Entry *de; - assert(mod); + assert(mod != NULL); if ( (la = attr_find( e->e_attrs, ad_pwdAccountLockedTime )) != NULL ) { BerVarray vals = la->a_nvals; @@ -232,9 +223,11 @@ account_locked( Operation *op, Entry *e, */ if (vals[0].bv_val != NULL) { time_t then, now; - struct berval bv; Modifications *m; + if (!pp->pwdLockoutDuration) + return 1; + if ((then = parse_time( vals[0].bv_val )) == (time_t)0) return 1; @@ -245,6 +238,7 @@ account_locked( Operation *op, Entry *e, m = ch_calloc( sizeof(Modifications), 1 ); m->sml_op = LDAP_MOD_DELETE; + m->sml_flags = 0; m->sml_type = ad_pwdAccountLockedTime->ad_cname; m->sml_desc = ad_pwdAccountLockedTime; m->sml_next = *mod; @@ -313,13 +307,11 @@ ppolicy_get( Operation *op, Entry *e, PassPolicy *pp ) pp_info *pi = on->on_bi.bi_private; Attribute *a; BerVarray vals; - int i, rc, nent; + int rc; Entry *pe = NULL; - AttributeDescription *oca = slap_schema.si_ad_objectClass; +#if 0 const char *text; - AttributeDescription *ad; - struct berval bv; - void *opr = op->o_private; +#endif memset( pp, 0, sizeof(PassPolicy) ); @@ -342,8 +334,6 @@ ppolicy_get( Operation *op, Entry *e, PassPolicy *pp ) } } - /* back-bdb stores lock info in o_private */ - op->o_private = NULL; op->o_bd->bd_info = (BackendInfo *)on->on_info; rc = be_entry_get_rw( op, vals, NULL, NULL, 0, &pe ); op->o_bd->bd_info = (BackendInfo *)on; @@ -369,8 +359,8 @@ ppolicy_get( Operation *op, Entry *e, PassPolicy *pp ) pp->pwdMinLength = atoi(a->a_vals[0].bv_val ); if ((a = attr_find( pe->e_attrs, ad_pwdMaxFailure ))) pp->pwdMaxFailure = atoi(a->a_vals[0].bv_val ); - if ((a = attr_find( pe->e_attrs, ad_pwdGraceLoginLimit ))) - pp->pwdGraceLoginLimit = atoi(a->a_vals[0].bv_val ); + if ((a = attr_find( pe->e_attrs, ad_pwdGraceAuthNLimit ))) + pp->pwdGraceAuthNLimit = atoi(a->a_vals[0].bv_val ); if ((a = attr_find( pe->e_attrs, ad_pwdExpireWarning ))) pp->pwdExpireWarning = atoi(a->a_vals[0].bv_val ); if ((a = attr_find( pe->e_attrs, ad_pwdFailureCountInterval ))) @@ -397,13 +387,11 @@ ppolicy_get( Operation *op, Entry *e, PassPolicy *pp ) be_entry_release_r( op, pe ); op->o_bd->bd_info = (BackendInfo *)on; - op->o_private = opr; return; defaultpol: Debug( LDAP_DEBUG_ANY, "ppolicy_get: using default policy\n", 0, 0, 0 ); - op->o_private = opr; return; } @@ -424,12 +412,9 @@ password_scheme( struct berval *cred, struct berval *sch ) for(e = 1; cred->bv_val[e] && cred->bv_val[e] != '}'; e++); if (cred->bv_val[e]) { - char *sc = ch_calloc( sizeof(char), e + 2); - sc[e + 1] = '\0'; /* terminate string */ - strncpy( sc, cred->bv_val, e + 1); - e = lutil_passwd_scheme( sc ); - free( sc ); - if (e && sch) { + int rc; + rc = lutil_passwd_scheme( cred->bv_val ); + if (rc && sch) { sch->bv_val = cred->bv_val; sch->bv_len = e; return LDAP_SUCCESS; @@ -439,11 +424,10 @@ password_scheme( struct berval *cred, struct berval *sch ) } static int -check_password_quality( struct berval *cred, PassPolicy *pp, LDAPPasswordPolicyError *err ) +check_password_quality( struct berval *cred, PassPolicy *pp, LDAPPasswordPolicyError *err, Entry *e ) { int rc = LDAP_SUCCESS, ok = LDAP_SUCCESS; char *ptr = cred->bv_val; - char *modpath; struct berval sch; assert( cred != NULL ); @@ -485,8 +469,9 @@ check_password_quality( struct berval *cred, PassPolicy *pp, LDAPPasswordPolicyE } rc = LDAP_SUCCESS; - + if (pp->pwdCheckModule[0]) { +#if SLAPD_MODULES lt_dlhandle mod; const char *err; @@ -498,7 +483,7 @@ check_password_quality( struct berval *cred, PassPolicy *pp, LDAPPasswordPolicyE pp->pwdCheckModule, err, 0 ); ok = LDAP_OTHER; /* internal error */ } else { - int (*prog)( char *passwd, char **text, void *arg ); + int (*prog)( char *passwd, char **text, Entry *ent ); if ((prog = lt_dlsym( mod, "check_password" )) == NULL) { err = lt_dlerror(); @@ -511,7 +496,7 @@ check_password_quality( struct berval *cred, PassPolicy *pp, LDAPPasswordPolicyE char *txt = NULL; ldap_pvt_thread_mutex_lock( &chk_syntax_mutex ); - ok = prog( cred->bv_val, &txt, NULL ); + ok = prog( cred->bv_val, &txt, e ); ldap_pvt_thread_mutex_unlock( &chk_syntax_mutex ); if (txt) { Debug(LDAP_DEBUG_ANY, @@ -524,6 +509,10 @@ check_password_quality( struct berval *cred, PassPolicy *pp, LDAPPasswordPolicyE lt_dlclose( mod ); } +#else + Debug(LDAP_DEBUG_ANY, "check_password_quality: external modules not " + "supported. pwdCheckModule ignored.\n", 0, 0, 0); +#endif /* SLAPD_MODULES */ } @@ -631,9 +620,9 @@ make_pwd_history_value( char *timebuf, struct berval *bv, Attribute *pa ) int nlen; snprintf( str, MAX_PWD_HISTORY_SZ, - "%s#%s#%d#", timebuf, + "%s#%s#%lu#", timebuf, pa->a_desc->ad_type->sat_syntax->ssyn_oid, - pa->a_nvals[0].bv_len ); + (unsigned long) pa->a_nvals[0].bv_len ); str[MAX_PWD_HISTORY_SZ-1] = 0; nlen = strlen(str); @@ -687,12 +676,11 @@ ppolicy_bind_resp( Operation *op, SlapReply *rs ) slap_overinst *on = ppb->on; Modifications *mod = ppb->mod, *m; int pwExpired = 0; - int ngut = -1, warn = -1, age, rc, i; + int ngut = -1, warn = -1, age, rc; Attribute *a; - struct tm *tm; - time_t now, then, pwtime = (time_t)-1; - const char *txt; + time_t now, pwtime = (time_t)-1; char nowstr[ LDAP_LUTIL_GENTIME_BUFSIZE ]; + struct berval timestamp; BackendInfo *bi = op->o_bd->bd_info; Entry *e; @@ -710,21 +698,21 @@ ppolicy_bind_resp( Operation *op, SlapReply *rs ) } now = slap_get_time(); /* stored for later consideration */ - ldap_pvt_thread_mutex_lock( &gmtime_mutex ); - tm = gmtime(&now); - lutil_gentime( nowstr, sizeof(nowstr), tm ); - ldap_pvt_thread_mutex_unlock( &gmtime_mutex ); + timestamp.bv_val = nowstr; + timestamp.bv_len = sizeof(nowstr); + slap_timestamp( &now, ×tamp ); if ( rs->sr_err == LDAP_INVALID_CREDENTIALS ) { int i = 0, fc = 0; m = ch_calloc( sizeof(Modifications), 1 ); m->sml_op = LDAP_MOD_ADD; + m->sml_flags = 0; m->sml_type = ad_pwdFailureTime->ad_cname; m->sml_desc = ad_pwdFailureTime; m->sml_values = ch_calloc( sizeof(struct berval), 2 ); - ber_str2bv( nowstr, 0, 1, &m->sml_values[0] ); + ber_dupbv( &m->sml_values[0], ×tamp ); m->sml_next = mod; mod = m; @@ -766,10 +754,11 @@ ppolicy_bind_resp( Operation *op, SlapReply *rs ) */ m = ch_calloc( sizeof(Modifications), 1 ); m->sml_op = LDAP_MOD_REPLACE; + m->sml_flags = 0; m->sml_type = ad_pwdAccountLockedTime->ad_cname; m->sml_desc = ad_pwdAccountLockedTime; m->sml_values = ch_calloc( sizeof(struct berval), 2 ); - ber_str2bv( nowstr, 0, 1, &m->sml_values[0] ); + ber_dupbv( &m->sml_values[0], ×tamp ); m->sml_next = mod; mod = m; } @@ -781,6 +770,7 @@ ppolicy_bind_resp( Operation *op, SlapReply *rs ) if ( attr_find( e->e_attrs, ad_pwdFailureTime )) { m = ch_calloc( sizeof(Modifications), 1 ); m->sml_op = LDAP_MOD_DELETE; + m->sml_flags = 0; m->sml_type = ad_pwdFailureTime->ad_cname; m->sml_desc = ad_pwdFailureTime; m->sml_next = mod; @@ -799,7 +789,7 @@ ppolicy_bind_resp( Operation *op, SlapReply *rs ) * that we are disallowed from doing anything * other than change password. */ - pwcons[op->o_conn->c_conn_idx].restrict = 1; + pwcons[op->o_conn->c_conn_idx].restricted = 1; ppb->pErr = PP_changeAfterReset; @@ -842,10 +832,10 @@ grace: if (!pwExpired) goto check_expiring_password; if ((a = attr_find( e->e_attrs, ad_pwdGraceUseTime )) == NULL) - ngut = ppb->pp.pwdGraceLoginLimit; + ngut = ppb->pp.pwdGraceAuthNLimit; else { for(ngut=0; a->a_nvals[ngut].bv_val; ngut++); - ngut = ppb->pp.pwdGraceLoginLimit - ngut; + ngut = ppb->pp.pwdGraceAuthNLimit - ngut; } /* @@ -866,10 +856,11 @@ grace: */ m = ch_calloc( sizeof(Modifications), 1 ); m->sml_op = LDAP_MOD_ADD; + m->sml_flags = 0; m->sml_type = ad_pwdGraceUseTime->ad_cname; m->sml_desc = ad_pwdGraceUseTime; m->sml_values = ch_calloc( sizeof(struct berval), 2 ); - ber_str2bv( nowstr, 0, 1, &m->sml_values[0] ); + ber_dupbv( &m->sml_values[0], ×tamp ); m->sml_next = mod; mod = m; @@ -897,19 +888,8 @@ check_expiring_password: */ if (ppb->pp.pwdMaxAge - age < ppb->pp.pwdExpireWarning ) { /* - * Set the warning value, add expiration warned timestamp to the entry. + * Set the warning value. */ - if ((a = attr_find( e->e_attrs, ad_pwdExpirationWarned )) == NULL) { - m = ch_calloc( sizeof(Modifications), 1 ); - m->sml_op = LDAP_MOD_ADD; - m->sml_type = ad_pwdExpirationWarned->ad_cname; - m->sml_desc = ad_pwdExpirationWarned; - m->sml_values = ch_calloc( sizeof(struct berval), 2 ); - ber_str2bv( nowstr, 0, 1, &m->sml_values[0] ); - m->sml_next = mod; - mod = m; - } - warn = ppb->pp.pwdMaxAge - age; /* seconds left until expiry */ if (warn < 0) warn = 0; /* something weird here - why is pwExpired not set? */ @@ -939,7 +919,7 @@ locked: op2.o_ndn = op->o_bd->be_rootndn; op2.o_bd->bd_info = (BackendInfo *)on->on_info; rc = op->o_bd->be_modify( &op2, &r2 ); - slap_mods_free( mod ); + slap_mods_free( mod, 1 ); } if ( ppb->send_ctrl ) { @@ -967,7 +947,7 @@ ppolicy_bind( Operation *op, SlapReply *rs ) /* Root bypasses policy */ if ( !be_isroot_dn( op->o_bd, &op->o_req_ndn )) { Entry *e; - int i, rc; + int rc; ppbind *ppb; slap_callback *cb; @@ -992,13 +972,8 @@ ppolicy_bind( Operation *op, SlapReply *rs ) op->o_callback->sc_next = cb; /* Did we receive a password policy request control? */ - for ( i=0; op->o_ctrls && op->o_ctrls[i]; i++ ) { - if ( !strcmp( op->o_ctrls[i]->ldctl_oid, - LDAP_CONTROL_PASSWORDPOLICYREQUEST ) ) - { - ppb->send_ctrl = 1; - break; - } + if ( op->o_ctrlflag[ppolicy_cid] ) { + ppb->send_ctrl = 1; } op->o_bd->bd_info = (BackendInfo *)on; @@ -1021,11 +996,11 @@ ppolicy_bind( Operation *op, SlapReply *rs ) return SLAP_CB_CONTINUE; } -/* Reset the restrict flag for the next session on this connection */ +/* Reset the restricted flag for the next session on this connection */ static int -ppolicy_unbind( Operation *op, SlapReply *rs ) +ppolicy_connection_destroy( BackendDB *bd, Connection *conn ) { - pwcons[op->o_conn->c_conn_idx].restrict = 0; + pwcons[conn->c_conn_idx].restricted = 0; return SLAP_CB_CONTINUE; } @@ -1036,18 +1011,14 @@ ppolicy_restrict( SlapReply *rs ) { slap_overinst *on = (slap_overinst *)op->o_bd->bd_info; - int i, send_ctrl = 0; + int send_ctrl = 0; /* Did we receive a password policy request control? */ - for ( i=0; op->o_ctrls && op->o_ctrls[i]; i++ ) { - if ( !strcmp( op->o_ctrls[i]->ldctl_oid, - LDAP_CONTROL_PASSWORDPOLICYREQUEST ) ) { - send_ctrl = 1; - break; - } + if ( op->o_ctrlflag[ppolicy_cid] ) { + send_ctrl = 1; } - if ( op->o_conn && pwcons[op->o_conn->c_conn_idx].restrict ) { + if ( op->o_conn && pwcons[op->o_conn->c_conn_idx].restricted ) { Debug( LDAP_DEBUG_TRACE, "connection restricted to password changing only\n", 0, 0, 0); if ( send_ctrl ) { @@ -1059,7 +1030,7 @@ ppolicy_restrict( rs->sr_ctrls = ctrls; } op->o_bd->bd_info = (BackendInfo *)on->on_info; - send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM, + send_ldap_error( op, rs, LDAP_INSUFFICIENT_ACCESS, "Operations are restricted to bind/unbind/abandon/StartTLS/modify password" ); return rs->sr_err; } @@ -1073,9 +1044,10 @@ ppolicy_add( SlapReply *rs ) { slap_overinst *on = (slap_overinst *)op->o_bd->bd_info; + pp_info *pi = on->on_bi.bi_private; PassPolicy pp; - int pw; Attribute *pa; + const char *txt; if ( ppolicy_restrict( op, rs ) != SLAP_CB_CONTINUE ) return rs->sr_err; @@ -1089,21 +1061,17 @@ ppolicy_add( * then we need to check that the password fits in with the * security policy for the new entry. */ - ppolicy_get( op, op->oq_add.rs_e, &pp ); + ppolicy_get( op, op->ora_e, &pp ); if (pp.pwdCheckQuality > 0 && !be_isroot( op )) { struct berval *bv = &(pa->a_vals[0]); - int rc, i, send_ctrl = 0; + int rc, send_ctrl = 0; LDAPPasswordPolicyError pErr = PP_noError; /* Did we receive a password policy request control? */ - for ( i=0; op->o_ctrls && op->o_ctrls[i]; i++ ) { - if ( !strcmp( op->o_ctrls[i]->ldctl_oid, - LDAP_CONTROL_PASSWORDPOLICYREQUEST ) ) { - send_ctrl = 1; - break; - } + if ( op->o_ctrlflag[ppolicy_cid] ) { + send_ctrl = 1; } - rc = check_password_quality( bv, &pp, &pErr ); + rc = check_password_quality( bv, &pp, &pErr, op->ora_e ); if (rc != LDAP_SUCCESS) { op->o_bd->bd_info = (BackendInfo *)on->on_info; if ( send_ctrl ) { @@ -1117,21 +1085,47 @@ ppolicy_add( send_ldap_error( op, rs, rc, "Password fails quality checking policy" ); return rs->sr_err; } + /* + * A controversial bit. We hash cleartext + * passwords provided via add and modify operations + * You're not really supposed to do this, since + * the X.500 model says "store attributes" as they + * get provided. By default, this is what we do + * + * But if the hash_passwords flag is set, we hash + * any cleartext password attribute values via the + * default password hashing scheme. + */ + if ((pi->hash_passwords) && + (password_scheme( &(pa->a_vals[0]), NULL ) != LDAP_SUCCESS)) { + struct berval hpw; + + slap_passwd_hash( &(pa->a_vals[0]), &hpw, &txt ); + if (hpw.bv_val == NULL) { + /* + * hashing didn't work. Emit an error. + */ + rs->sr_err = LDAP_OTHER; + rs->sr_text = txt; + send_ldap_error( op, rs, LDAP_OTHER, "Password hashing failed" ); + return rs->sr_err; + } + + memset( pa->a_vals[0].bv_val, 0, pa->a_vals[0].bv_len); + ber_memfree( pa->a_vals[0].bv_val ); + pa->a_vals[0].bv_val = hpw.bv_val; + pa->a_vals[0].bv_len = hpw.bv_len; + } } /* If password aging is in effect, set the pwdChangedTime */ - if (( pp.pwdMaxAge || pp.pwdMinAge ) && !be_isupdate( op )) { + if (( pp.pwdMaxAge || pp.pwdMinAge ) && !be_shadow_update( op )) { struct berval timestamp; char timebuf[ LDAP_LUTIL_GENTIME_BUFSIZE ]; - struct tm *ltm; time_t now = slap_get_time(); - ldap_pvt_thread_mutex_lock( &gmtime_mutex ); - ltm = gmtime( &now ); - lutil_gentime( timebuf, sizeof(timebuf), ltm ); - ldap_pvt_thread_mutex_unlock( &gmtime_mutex ); - timestamp.bv_val = timebuf; - timestamp.bv_len = strlen(timebuf); + timestamp.bv_len = sizeof(timebuf); + slap_timestamp( &now, ×tamp ); attr_merge_one( op->ora_e, ad_pwdChangedTime, ×tamp, NULL ); } @@ -1143,12 +1137,12 @@ static int ppolicy_modify( Operation *op, SlapReply *rs ) { slap_overinst *on = (slap_overinst *)op->o_bd->bd_info; + pp_info *pi = on->on_bi.bi_private; int i, rc, mod_pw_only, pwmod, pwmop, deladd, hsize = 0; PassPolicy pp; Modifications *mods = NULL, *modtail, *ml, *delmod, *addmod; - Attribute *pa, *ha, *ra, at; - int repl_user = be_isupdate( op ); + Attribute *pa, *ha, at; const char *txt; pw_hist *tl = NULL, *p; int zapReset, send_ctrl = 0; @@ -1164,12 +1158,8 @@ ppolicy_modify( Operation *op, SlapReply *rs ) if ( rc != LDAP_SUCCESS ) return SLAP_CB_CONTINUE; /* Did we receive a password policy request control? */ - for ( i=0; op->o_ctrls && op->o_ctrls[i]; i++ ) { - if ( !strcmp( op->o_ctrls[i]->ldctl_oid, - LDAP_CONTROL_PASSWORDPOLICYREQUEST ) ) { - send_ctrl = 1; - break; - } + if ( op->o_ctrlflag[ppolicy_cid] ) { + send_ctrl = 1; } /* See if this is a pwdModify exop. If so, we can @@ -1235,10 +1225,10 @@ ppolicy_modify( Operation *op, SlapReply *rs ) } } - if (pwcons[op->o_conn->c_conn_idx].restrict && !mod_pw_only) { + if (pwcons[op->o_conn->c_conn_idx].restricted && !mod_pw_only) { Debug( LDAP_DEBUG_TRACE, "connection restricted to password changing only\n", 0, 0, 0 ); - rs->sr_err = LDAP_UNWILLING_TO_PERFORM; + rs->sr_err = LDAP_INSUFFICIENT_ACCESS; rs->sr_text = "Operations are restricted to bind/unbind/abandon/StartTLS/modify password"; pErr = PP_changeAfterReset; goto return_results; @@ -1274,7 +1264,6 @@ ppolicy_modify( Operation *op, SlapReply *rs ) if (pp.pwdInHistory > 0 && (ha = attr_find( e->e_attrs, ad_pwdHistory ))) { struct berval oldpw; time_t oldtime; - char *oid; for(i=0; ha->a_nvals[i].bv_val; i++) { rc = parse_pwdhistory( &(ha->a_nvals[i]), NULL, @@ -1301,6 +1290,7 @@ ppolicy_modify( Operation *op, SlapReply *rs ) if (pp.pwdSafeModify && oldpw.bv_val ) { ml = (Modifications *) ch_malloc( sizeof( Modifications ) ); ml->sml_op = LDAP_MOD_DELETE; + ml->sml_flags = SLAP_MOD_INTERNAL; ml->sml_desc = pp.ad; ml->sml_type = pp.ad->ad_cname; ml->sml_values = (BerVarray) ch_malloc( 2 * sizeof( struct berval ) ); @@ -1318,14 +1308,14 @@ ppolicy_modify( Operation *op, SlapReply *rs ) Debug( LDAP_DEBUG_TRACE, "change password must use DELETE followed by ADD/REPLACE\n", 0, 0, 0 ); - rs->sr_err = LDAP_UNWILLING_TO_PERFORM; + rs->sr_err = LDAP_INSUFFICIENT_ACCESS; rs->sr_text = "Must supply old password to be changed as well as new one"; pErr = PP_mustSupplyOldPassword; goto return_results; } if (!pp.pwdAllowUserChange) { - rs->sr_err = LDAP_UNWILLING_TO_PERFORM; + rs->sr_err = LDAP_INSUFFICIENT_ACCESS; rs->sr_text = "User alteration of password is not allowed"; pErr = PP_passwordModNotAllowed; goto return_results; @@ -1340,7 +1330,7 @@ ppolicy_modify( Operation *op, SlapReply *rs ) now = slap_get_time(); age = (int)(now - pwtime); if ((pwtime != (time_t)-1) && (age < pp.pwdMinAge)) { - rs->sr_err = LDAP_UNWILLING_TO_PERFORM; + rs->sr_err = LDAP_CONSTRAINT_VIOLATION; rs->sr_text = "Password is too young to change"; pErr = PP_passwordTooYoung; goto return_results; @@ -1355,7 +1345,8 @@ ppolicy_modify( Operation *op, SlapReply *rs ) const char *txt; bv = oldpw.bv_val ? &oldpw : delmod->sml_values; - rc = slap_passwd_check( op->o_conn, pa, bv, &txt ); + /* FIXME: no access checking? */ + rc = slap_passwd_check( op, NULL, pa, bv, &txt ); if (rc != LDAP_SUCCESS) { Debug( LDAP_DEBUG_TRACE, "old password check failed: %s\n", txt, 0, 0 ); @@ -1387,7 +1378,7 @@ ppolicy_modify( Operation *op, SlapReply *rs ) bv = newpw.bv_val ? &newpw : addmod->sml_values; if (pp.pwdCheckQuality > 0) { - rc = check_password_quality( bv, &pp, &pErr ); + rc = check_password_quality( bv, &pp, &pErr, e ); if (rc != LDAP_SUCCESS) { rs->sr_err = rc; rs->sr_text = "Password fails quality checking policy"; @@ -1399,7 +1390,8 @@ ppolicy_modify( Operation *op, SlapReply *rs ) /* * Last check - the password history. */ - if (slap_passwd_check( op->o_conn, pa, bv, &txt ) == LDAP_SUCCESS) { + /* FIXME: no access checking? */ + if (slap_passwd_check( op, NULL, pa, bv, &txt ) == LDAP_SUCCESS) { /* * This is bad - it means that the user is attempting * to set the password to the same as the old one. @@ -1421,7 +1413,8 @@ ppolicy_modify( Operation *op, SlapReply *rs ) cr[1].bv_val = NULL; for(p=tl; p; p=p->next) { cr[0] = p->pw; - rc = slap_passwd_check( op->o_conn, &at, bv, &txt ); + /* FIXME: no access checking? */ + rc = slap_passwd_check( op, NULL, &at, bv, &txt ); if (rc != LDAP_SUCCESS) continue; @@ -1433,25 +1426,20 @@ ppolicy_modify( Operation *op, SlapReply *rs ) } do_modify: - if ((pwmod) && (!repl_user)) { + if ((pwmod) && (!be_shadow_update( op ))) { struct berval timestamp; char timebuf[ LDAP_LUTIL_GENTIME_BUFSIZE ]; - struct tm *ltm; time_t now = slap_get_time(); - Attribute *ga; /* * keep the necessary pwd.. operational attributes * up to date. */ - ldap_pvt_thread_mutex_lock( &gmtime_mutex ); - ltm = gmtime( &now ); - lutil_gentime( timebuf, sizeof(timebuf), ltm ); - ldap_pvt_thread_mutex_unlock( &gmtime_mutex ); - timestamp.bv_val = timebuf; - timestamp.bv_len = strlen(timebuf); + timestamp.bv_len = sizeof(timebuf); + slap_timestamp( &now, ×tamp ); + mods = (Modifications *) ch_malloc( sizeof( Modifications ) ); mods->sml_type.bv_val = NULL; mods->sml_desc = ad_pwdChangedTime; @@ -1461,11 +1449,12 @@ do_modify: ber_dupbv( &mods->sml_values[0], ×tamp ); mods->sml_values[1].bv_len = 0; mods->sml_values[1].bv_val = NULL; - assert( mods->sml_values[0].bv_val ); + assert( mods->sml_values[0].bv_val != NULL ); } else { mods->sml_op = LDAP_MOD_DELETE; mods->sml_values = NULL; } + mods->sml_flags = SLAP_MOD_INTERNAL; mods->sml_nvalues = NULL; mods->sml_next = NULL; modtail->sml_next = mods; @@ -1474,6 +1463,7 @@ do_modify: if (attr_find(e->e_attrs, ad_pwdGraceUseTime )) { mods = (Modifications *) ch_malloc( sizeof( Modifications ) ); mods->sml_op = LDAP_MOD_DELETE; + mods->sml_flags = SLAP_MOD_INTERNAL; mods->sml_type.bv_val = NULL; mods->sml_desc = ad_pwdGraceUseTime; mods->sml_values = NULL; @@ -1483,22 +1473,11 @@ do_modify: modtail = mods; } - if (attr_find(e->e_attrs, ad_pwdExpirationWarned )) { - mods = (Modifications *) ch_malloc( sizeof( Modifications ) ); - mods->sml_op = LDAP_MOD_DELETE; - mods->sml_type.bv_val = NULL; - mods->sml_desc = ad_pwdExpirationWarned; - mods->sml_values = NULL; - mods->sml_nvalues = NULL; - mods->sml_next = NULL; - modtail->sml_next = mods; - modtail = mods; - } - /* Delete the pwdReset attribute, since it's being reset */ if ((zapReset) && (attr_find(e->e_attrs, ad_pwdReset ))) { mods = (Modifications *) ch_malloc( sizeof( Modifications ) ); mods->sml_op = LDAP_MOD_DELETE; + mods->sml_flags = SLAP_MOD_INTERNAL; mods->sml_type.bv_val = NULL; mods->sml_desc = ad_pwdReset; mods->sml_values = NULL; @@ -1528,6 +1507,7 @@ do_modify: */ mods = (Modifications *) ch_malloc( sizeof( Modifications ) ); mods->sml_op = LDAP_MOD_DELETE; + mods->sml_flags = SLAP_MOD_INTERNAL; mods->sml_type.bv_val = NULL; mods->sml_desc = ad_pwdHistory; mods->sml_nvalues = NULL; @@ -1560,6 +1540,7 @@ do_modify: if ((pa = attr_find( e->e_attrs, pp.ad )) != NULL) { mods = (Modifications *) ch_malloc( sizeof( Modifications ) ); mods->sml_op = LDAP_MOD_ADD; + mods->sml_flags = SLAP_MOD_INTERNAL; mods->sml_type.bv_val = NULL; mods->sml_desc = ad_pwdHistory; mods->sml_nvalues = NULL; @@ -1593,7 +1574,7 @@ do_modify: * leave it alone. */ - if ((addmod) && !newpw.bv_val && + if ((pi->hash_passwords) && (addmod) && !newpw.bv_val && (password_scheme( &(addmod->sml_values[0]), NULL ) != LDAP_SUCCESS)) { struct berval hpw, bv; @@ -1649,6 +1630,7 @@ ppolicy_parseCtrl( rs->sr_text = "passwordPolicyRequest control invalid criticality"; return LDAP_PROTOCOL_ERROR; } + op->o_ctrlflag[ppolicy_cid] = SLAP_CONTROL_NONCRITICAL; return LDAP_SUCCESS; } @@ -1682,6 +1664,14 @@ ppolicy_db_init( return 0; } +static int +ppolicy_db_open( + BackendDB *be +) +{ + return overlay_register_control( be, LDAP_CONTROL_PASSWORDPOLICYREQUEST ); +} + static int ppolicy_close( BackendDB *be @@ -1733,6 +1723,13 @@ ppolicy_config( } pi->use_lockout = 1; return 0; + } else if ( strcasecmp( argv[0], "ppolicy_hash_cleartext" ) == 0 ) { + if ( argc != 1 ) { + fprintf( stderr, "%s: line %d: ppolicy_hash_cleartext " + "takes no arguments\n", fname, lineno ); + return ( 1 ); + } + pi->hash_passwords = 1; } return SLAP_CONF_UNKNOWN; } @@ -1758,7 +1755,7 @@ int ppolicy_init() ldap_scherr2str(code), err ); return code; } - code = at_add( at, &err ); + code = at_add( at, 0, NULL, &err ); if ( !code ) { slap_str2ad( at->at_names[0], pwd_OpSchema[i].ad, &err ); } @@ -1771,8 +1768,8 @@ int ppolicy_init() } code = register_supported_control( LDAP_CONTROL_PASSWORDPOLICYREQUEST, - SLAP_CTRL_ADD|SLAP_CTRL_BIND|SLAP_CTRL_MODIFY, extops, - ppolicy_parseCtrl ); + SLAP_CTRL_ADD|SLAP_CTRL_BIND|SLAP_CTRL_MODIFY|SLAP_CTRL_HIDE, extops, + ppolicy_parseCtrl, &ppolicy_cid ); if ( code != LDAP_SUCCESS ) { fprintf( stderr, "Failed to register control %d\n", code ); return code; @@ -1782,16 +1779,17 @@ int ppolicy_init() ppolicy.on_bi.bi_type = "ppolicy"; ppolicy.on_bi.bi_db_init = ppolicy_db_init; + ppolicy.on_bi.bi_db_open = ppolicy_db_open; ppolicy.on_bi.bi_db_config = ppolicy_config; ppolicy.on_bi.bi_db_close = ppolicy_close; ppolicy.on_bi.bi_op_add = ppolicy_add; ppolicy.on_bi.bi_op_bind = ppolicy_bind; - ppolicy.on_bi.bi_op_unbind = ppolicy_unbind; ppolicy.on_bi.bi_op_compare = ppolicy_restrict; ppolicy.on_bi.bi_op_delete = ppolicy_restrict; ppolicy.on_bi.bi_op_modify = ppolicy_modify; ppolicy.on_bi.bi_op_search = ppolicy_restrict; + ppolicy.on_bi.bi_connection_destroy = ppolicy_connection_destroy; return overlay_register( &ppolicy ); }