X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fpasswd.c;h=2eb9a96da15ce7be328c628354abdb385876cb5b;hb=9b4bf8a973c8cfea809be9a4b658f785a6b16f2f;hp=3a8ddd9c1dce03b616542d9c6722393ac9fc2d99;hpb=af02eee0d544cb7e10d143169d33b5002a018157;p=openldap diff --git a/servers/slapd/passwd.c b/servers/slapd/passwd.c index 3a8ddd9c1d..2eb9a96da1 100644 --- a/servers/slapd/passwd.c +++ b/servers/slapd/passwd.c @@ -1,7 +1,7 @@ /* bind.c - ldbm backend bind and unbind routines */ /* $OpenLDAP$ */ /* - * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved. + * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved. * COPYING RESTRICTIONS APPLY, see COPYRIGHT file */ @@ -20,56 +20,52 @@ #include int passwd_extop( - Connection *conn, Operation *op, - const char *reqoid, - struct berval *reqdata, - char **rspoid, - struct berval **rspdata, - LDAPControl ***rspctrls, - const char **text, - BerVarray *refs ) + Operation *op, + SlapReply *rs ) { - int rc; - - assert( reqoid != NULL ); - assert( strcmp( LDAP_EXOP_MODIFY_PASSWD, reqoid ) == 0 ); + assert( ber_bvcmp( &slap_EXOP_MODIFY_PASSWD, &op->ore_reqoid ) == 0 ); if( op->o_dn.bv_len == 0 ) { - *text = "only authenticated users may change passwords"; + rs->sr_text = "only authenticated users may change passwords"; return LDAP_STRONG_AUTH_REQUIRED; } - if( conn->c_authz_backend == NULL || !conn->c_authz_backend->be_extended ) { - *text = "operation not supported for current user"; + ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex ); + op->o_bd = op->o_conn->c_authz_backend; + ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex ); + + if( op->o_bd && !op->o_bd->be_extended ) { + rs->sr_text = "operation not supported for current user"; return LDAP_UNWILLING_TO_PERFORM; } - { - struct berval passwd = BER_BVC( LDAP_EXOP_MODIFY_PASSWD ); - - rc = backend_check_restrictions( conn->c_authz_backend, - conn, op, &passwd, text ); + if (backend_check_restrictions( op, rs, + (struct berval *)&slap_EXOP_MODIFY_PASSWD ) != LDAP_SUCCESS) { + return rs->sr_err; } - if( rc != LDAP_SUCCESS ) { - return rc; - } + if( op->o_bd == NULL ) { +#ifdef HAVE_CYRUS_SASL + rs->sr_err = slap_sasl_setpass( op, rs ); +#else + rs->sr_text = "no authz backend"; + rs->sr_err = LDAP_OTHER; +#endif - if( conn->c_authz_backend->be_update_ndn.bv_len ) { +#ifndef SLAPD_MULTIMASTER + /* This does not apply to multi-master case */ + } else if( op->o_bd->be_update_ndn.bv_len ) { /* we SHOULD return a referral in this case */ - *refs = referral_rewrite( conn->c_authz_backend->be_update_refs, + rs->sr_ref = referral_rewrite( op->o_bd->be_update_refs, NULL, NULL, LDAP_SCOPE_DEFAULT ); - rc = LDAP_REFERRAL; + rs->sr_err = LDAP_REFERRAL; +#endif /* !SLAPD_MULTIMASTER */ } else { - rc = conn->c_authz_backend->be_extended( - conn->c_authz_backend, conn, op, - reqoid, reqdata, - rspoid, rspdata, rspctrls, - text, refs ); + rs->sr_err = op->o_bd->be_extended( op, rs ); } - return rc; + return rs->sr_err; } int slap_passwd_parse( struct berval *reqdata, @@ -81,13 +77,18 @@ int slap_passwd_parse( struct berval *reqdata, int rc = LDAP_SUCCESS; ber_tag_t tag; ber_len_t len; - char berbuf[256]; + char berbuf[LBER_ELEMENT_SIZEOF]; BerElement *ber = (BerElement *)berbuf; if( reqdata == NULL ) { return LDAP_SUCCESS; } + if( reqdata->bv_len == 0 ) { + *text = "empty request data field"; + return LDAP_PROTOCOL_ERROR; + } + /* ber_init2 uses reqdata directly, doesn't allocate new buffers */ ber_init2( ber, reqdata, 0 ); @@ -100,8 +101,8 @@ int slap_passwd_parse( struct berval *reqdata, if( tag == LDAP_TAG_EXOP_MODIFY_PASSWD_ID ) { if( id == NULL ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ERR, - "slap_passwd_parse: ID not allowed.\n")); + LDAP_LOG( OPERATION, ERR, + "slap_passwd_parse: ID not allowed.\n", 0, 0, 0 ); #else Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID not allowed.\n", 0, 0, 0 ); @@ -116,8 +117,8 @@ int slap_passwd_parse( struct berval *reqdata, if( tag == LBER_ERROR ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ERR, - "slap_passwd_parse: ID parse failed.\n")); + LDAP_LOG( OPERATION, ERR, + "slap_passwd_parse: ID parse failed.\n", 0, 0, 0 ); #else Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID parse failed.\n", 0, 0, 0 ); @@ -132,8 +133,8 @@ int slap_passwd_parse( struct berval *reqdata, if( tag == LDAP_TAG_EXOP_MODIFY_PASSWD_OLD ) { if( oldpass == NULL ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ERR, - "slap_passwd_parse: OLD not allowed.\n" )); + LDAP_LOG( OPERATION, ERR, + "slap_passwd_parse: OLD not allowed.\n" , 0, 0, 0 ); #else Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: OLD not allowed.\n", 0, 0, 0 ); @@ -148,8 +149,8 @@ int slap_passwd_parse( struct berval *reqdata, if( tag == LBER_ERROR ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ERR, - "slap_passwd_parse: ID parse failed.\n" )); + LDAP_LOG( OPERATION, ERR, + "slap_passwd_parse: ID parse failed.\n" , 0, 0, 0 ); #else Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID parse failed.\n", 0, 0, 0 ); @@ -164,8 +165,8 @@ int slap_passwd_parse( struct berval *reqdata, if( tag == LDAP_TAG_EXOP_MODIFY_PASSWD_NEW ) { if( newpass == NULL ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ERR, - "slap_passwd_parse: NEW not allowed.\n" )); + LDAP_LOG( OPERATION, ERR, + "slap_passwd_parse: NEW not allowed.\n", 0, 0, 0 ); #else Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: NEW not allowed.\n", 0, 0, 0 ); @@ -180,8 +181,8 @@ int slap_passwd_parse( struct berval *reqdata, if( tag == LBER_ERROR ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ERR, - "slap_passwd_parse: OLD parse failed.\n")); + LDAP_LOG( OPERATION, ERR, + "slap_passwd_parse: OLD parse failed.\n", 0, 0, 0 ); #else Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: OLD parse failed.\n", 0, 0, 0 ); @@ -196,15 +197,14 @@ int slap_passwd_parse( struct berval *reqdata, if( len != 0 ) { decoding_error: #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ERR, - "slap_passwd_parse: decoding error, len=%ld\n", (long)len )); + LDAP_LOG( OPERATION, ERR, + "slap_passwd_parse: decoding error, len=%ld\n", (long)len, 0, 0 ); #else Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: decoding error, len=%ld\n", (long) len, 0, 0 ); #endif - *text = "data decoding error"; rc = LDAP_PROTOCOL_ERROR; } @@ -218,15 +218,15 @@ struct berval * slap_passwd_return( { int rc; struct berval *bv = NULL; - char berbuf[256]; + char berbuf[LBER_ELEMENT_SIZEOF]; /* opaque structure, size unknown but smaller than berbuf */ BerElement *ber = (BerElement *)berbuf; assert( cred != NULL ); #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY, - "slap_passwd_return: %ld\n",(long)cred->bv_len )); + LDAP_LOG( OPERATION, ENTRY, + "slap_passwd_return: %ld\n",(long)cred->bv_len, 0, 0 ); #else Debug( LDAP_DEBUG_TRACE, "slap_passwd_return: %ld\n", (long) cred->bv_len, 0, 0 ); @@ -284,8 +284,7 @@ slap_passwd_generate( struct berval *pass ) { struct berval *tmp; #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY, - "slap_passwd_generate: begin\n" )); + LDAP_LOG( OPERATION, ENTRY, "slap_passwd_generate: begin\n", 0, 0, 0 ); #else Debug( LDAP_DEBUG_TRACE, "slap_passwd_generate\n", 0, 0, 0 ); #endif @@ -321,13 +320,17 @@ slap_passwd_hash( #endif tmp = lutil_passwd_hash( cred , hash ); - assert( tmp != NULL ); #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD ) ldap_pvt_thread_mutex_unlock( &passwd_mutex ); #endif + + if( tmp == NULL ) { + new->bv_len = 0; + new->bv_val = NULL; + } + *new = *tmp; free( tmp ); - return; }