X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fpasswd.c;h=f45b974272d4bb57a657a29aea2d56f4c2313c0f;hb=ecfb311f8f2b4f8b8e74c0ee88b8ef572e792c99;hp=0c898771ec4b4c2a9defe96c4f18789c092bd23c;hpb=ec46a2f33a602c5603f1cf6415b183f6ff0939d5;p=openldap diff --git a/servers/slapd/passwd.c b/servers/slapd/passwd.c index 0c898771ec..f45b974272 100644 --- a/servers/slapd/passwd.c +++ b/servers/slapd/passwd.c @@ -16,6 +16,7 @@ #include "slap.h" +#include #include int passwd_extop( @@ -26,40 +27,60 @@ int passwd_extop( struct berval **rspdata, LDAPControl ***rspctrls, const char **text, - BVarray *refs ) + BerVarray *refs ) { + Backend *be; int rc; assert( reqoid != NULL ); - assert( strcmp( LDAP_EXOP_X_MODIFY_PASSWD, reqoid ) == 0 ); + assert( strcmp( LDAP_EXOP_MODIFY_PASSWD, reqoid ) == 0 ); if( op->o_dn.bv_len == 0 ) { *text = "only authenticated users may change passwords"; return LDAP_STRONG_AUTH_REQUIRED; } - if( conn->c_authz_backend != NULL && conn->c_authz_backend->be_extended ) { - if( conn->c_authz_backend->be_restrictops & SLAP_RESTRICT_OP_MODIFY ) { - *text = "authorization database is read only"; - rc = LDAP_UNWILLING_TO_PERFORM; + ldap_pvt_thread_mutex_lock( &conn->c_mutex ); + be = conn->c_authz_backend; + ldap_pvt_thread_mutex_unlock( &conn->c_mutex ); - } else if( conn->c_authz_backend->be_update_ndn.bv_len ) { - /* we SHOULD return a referral in this case */ - *refs = referral_rewrite( conn->c_authz_backend->be_update_refs, - NULL, NULL, LDAP_SCOPE_DEFAULT ); - rc = LDAP_REFERRAL; + if( be && !be->be_extended ) { + *text = "operation not supported for current user"; + return LDAP_UNWILLING_TO_PERFORM; + } - } else { - rc = conn->c_authz_backend->be_extended( - conn->c_authz_backend, conn, op, - reqoid, reqdata, - rspoid, rspdata, rspctrls, - text, refs ); - } + { + struct berval passwd = BER_BVC( LDAP_EXOP_MODIFY_PASSWD ); + rc = backend_check_restrictions( be, conn, op, &passwd, text ); + } + + if( rc != LDAP_SUCCESS ) { + return rc; + } + + if( be == NULL ) { +#ifdef HAVE_CYRUS_SASL + rc = slap_sasl_setpass( conn, op, + reqoid, reqdata, + rspoid, rspdata, rspctrls, + text ); +#else + *text = "no authz backend"; + rc = LDAP_OTHER; +#endif + + } else if( be->be_update_ndn.bv_len ) { + /* we SHOULD return a referral in this case */ + *refs = referral_rewrite( be->be_update_refs, + NULL, NULL, LDAP_SCOPE_DEFAULT ); + rc = LDAP_REFERRAL; } else { - *text = "operation not supported for current user"; - rc = LDAP_UNWILLING_TO_PERFORM; + rc = be->be_extended( + be, conn, op, + reqoid, reqdata, + rspoid, rspdata, rspctrls, + text, refs ); } return rc; @@ -74,38 +95,32 @@ int slap_passwd_parse( struct berval *reqdata, int rc = LDAP_SUCCESS; ber_tag_t tag; ber_len_t len; - BerElement *ber; + char berbuf[256]; + BerElement *ber = (BerElement *)berbuf; if( reqdata == NULL ) { return LDAP_SUCCESS; } - ber = ber_init( reqdata ); - - if( ber == NULL ) { -#ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ERR, - "slap_passwd_parse: ber_init failed\n" )); -#else - Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ber_init failed\n", - 0, 0, 0 ); -#endif - - *text = "password decoding error"; + if( reqdata->bv_len == 0 ) { + *text = "empty request data field"; return LDAP_PROTOCOL_ERROR; } + /* ber_init2 uses reqdata directly, doesn't allocate new buffers */ + ber_init2( ber, reqdata, 0 ); + tag = ber_scanf( ber, "{" /*}*/ ); if( tag != LBER_ERROR ) { tag = ber_peek_tag( ber, &len ); } - if( tag == LDAP_TAG_EXOP_X_MODIFY_PASSWD_ID ) { + if( tag == LDAP_TAG_EXOP_MODIFY_PASSWD_ID ) { if( id == NULL ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ERR, - "slap_passwd_parse: ID not allowed.\n")); + LDAP_LOG( OPERATION, ERR, + "slap_passwd_parse: ID not allowed.\n", 0, 0, 0 ); #else Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID not allowed.\n", 0, 0, 0 ); @@ -120,8 +135,8 @@ int slap_passwd_parse( struct berval *reqdata, if( tag == LBER_ERROR ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ERR, - "slap_passwd_parse: ID parse failed.\n")); + LDAP_LOG( OPERATION, ERR, + "slap_passwd_parse: ID parse failed.\n", 0, 0, 0 ); #else Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID parse failed.\n", 0, 0, 0 ); @@ -133,11 +148,11 @@ int slap_passwd_parse( struct berval *reqdata, tag = ber_peek_tag( ber, &len); } - if( tag == LDAP_TAG_EXOP_X_MODIFY_PASSWD_OLD ) { + if( tag == LDAP_TAG_EXOP_MODIFY_PASSWD_OLD ) { if( oldpass == NULL ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ERR, - "slap_passwd_parse: OLD not allowed.\n" )); + LDAP_LOG( OPERATION, ERR, + "slap_passwd_parse: OLD not allowed.\n" , 0, 0, 0 ); #else Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: OLD not allowed.\n", 0, 0, 0 ); @@ -152,8 +167,8 @@ int slap_passwd_parse( struct berval *reqdata, if( tag == LBER_ERROR ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ERR, - "slap_passwd_parse: ID parse failed.\n" )); + LDAP_LOG( OPERATION, ERR, + "slap_passwd_parse: ID parse failed.\n" , 0, 0, 0 ); #else Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID parse failed.\n", 0, 0, 0 ); @@ -162,14 +177,14 @@ int slap_passwd_parse( struct berval *reqdata, goto decoding_error; } - tag = ber_peek_tag( ber, &len); + tag = ber_peek_tag( ber, &len ); } - if( tag == LDAP_TAG_EXOP_X_MODIFY_PASSWD_NEW ) { + if( tag == LDAP_TAG_EXOP_MODIFY_PASSWD_NEW ) { if( newpass == NULL ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ERR, - "slap_passwd_parse: NEW not allowed.\n" )); + LDAP_LOG( OPERATION, ERR, + "slap_passwd_parse: NEW not allowed.\n", 0, 0, 0 ); #else Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: NEW not allowed.\n", 0, 0, 0 ); @@ -184,8 +199,8 @@ int slap_passwd_parse( struct berval *reqdata, if( tag == LBER_ERROR ) { #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ERR, - "slap_passwd_parse: OLD parse failed.\n")); + LDAP_LOG( OPERATION, ERR, + "slap_passwd_parse: OLD parse failed.\n", 0, 0, 0 ); #else Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: OLD parse failed.\n", 0, 0, 0 ); @@ -200,38 +215,19 @@ int slap_passwd_parse( struct berval *reqdata, if( len != 0 ) { decoding_error: #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ERR, - "slap_passwd_parse: decoding error, len=%ld\n", (long)len )); + LDAP_LOG( OPERATION, ERR, + "slap_passwd_parse: decoding error, len=%ld\n", (long)len, 0, 0 ); #else Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: decoding error, len=%ld\n", (long) len, 0, 0 ); #endif - *text = "data decoding error"; rc = LDAP_PROTOCOL_ERROR; } done: - if( rc != LDAP_SUCCESS ) { - if( id && id->bv_val != NULL ) { - free( id->bv_val ); - id->bv_val = NULL; - } - - if( oldpass && oldpass->bv_val != NULL ) { - free( oldpass->bv_val ); - oldpass->bv_val = NULL; - } - - if( newpass && newpass->bv_val != NULL ) { - free( newpass->bv_val ); - newpass->bv_val = NULL; - } - } - - ber_free( ber, 1 ); return rc; } @@ -247,8 +243,8 @@ struct berval * slap_passwd_return( assert( cred != NULL ); #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY, - "slap_passwd_return: %ld\n",(long)cred->bv_len )); + LDAP_LOG( OPERATION, ENTRY, + "slap_passwd_return: %ld\n",(long)cred->bv_len, 0, 0 ); #else Debug( LDAP_DEBUG_TRACE, "slap_passwd_return: %ld\n", (long) cred->bv_len, 0, 0 ); @@ -257,7 +253,7 @@ struct berval * slap_passwd_return( ber_init_w_nullc( ber, LBER_USE_DER ); rc = ber_printf( ber, "{tON}", - LDAP_TAG_EXOP_X_MODIFY_PASSWD_GEN, cred ); + LDAP_TAG_EXOP_MODIFY_PASSWD_GEN, cred ); if( rc >= 0 ) { (void) ber_flatten( ber, &bv ); @@ -306,8 +302,7 @@ slap_passwd_generate( struct berval *pass ) { struct berval *tmp; #ifdef NEW_LOGGING - LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY, - "slap_passwd_generate: begin\n" )); + LDAP_LOG( OPERATION, ENTRY, "slap_passwd_generate: begin\n", 0, 0, 0 ); #else Debug( LDAP_DEBUG_TRACE, "slap_passwd_generate\n", 0, 0, 0 ); #endif @@ -347,8 +342,13 @@ slap_passwd_hash( #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD ) ldap_pvt_thread_mutex_unlock( &passwd_mutex ); #endif + + if( tmp == NULL ) { + new->bv_len = 0; + new->bv_val = NULL; + } + *new = *tmp; free( tmp ); - return; }