X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslurpd%2Fldap_op.c;h=38882a1b42226351b564a2174a60d21276f683c3;hb=3fddf93a7bdb21a055dda7bf7936dbb596c4bfd4;hp=79d1ba34674e435a4de4ca4e01f66b4165591b43;hpb=4dfc7fc674b78298cdad9638d8c91e3b5e933517;p=openldap diff --git a/servers/slurpd/ldap_op.c b/servers/slurpd/ldap_op.c index 79d1ba3467..38882a1b42 100644 --- a/servers/slurpd/ldap_op.c +++ b/servers/slurpd/ldap_op.c @@ -1,4 +1,8 @@ /* $OpenLDAP$ */ +/* + * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved. + * COPYING RESTRICTIONS APPLY, see COPYRIGHT file + */ /* * Copyright (c) 1996 Regents of the University of Michigan. * All rights reserved. @@ -27,16 +31,8 @@ #include #include -#include - -#if defined( STR_TRANSLATION ) && defined( LDAP_DEFAULT_CHARSET ) -/* Get LDAP->ld_lberoptions. Must precede slurp.h, both define ldap_debug. */ -#include "../../libraries/libldap/ldap-int.h" -#endif - -#include #include - +#include "lutil_ldap.h" #include "slurp.h" /* Forward references */ @@ -50,23 +46,14 @@ static void free_ldapmod LDAP_P(( LDAPMod * )); static void free_ldmarr LDAP_P(( LDAPMod ** )); static int getmodtype LDAP_P(( char * )); static void dump_ldm_array LDAP_P(( LDAPMod ** )); -static char **read_krbnames LDAP_P(( Ri * )); -#ifdef HAVE_KERBEROS -static void upcase LDAP_P(( char * )); -#endif static int do_bind LDAP_P(( Ri *, int * )); static int do_unbind LDAP_P(( Ri * )); -static char *kattrs[] = {"kerberosName", NULL }; -static struct timeval kst = {30L, 0L}; - - - /* * Determine the type of ldap operation being performed and call the * appropriate routine. - * - If successful, returns ERR_DO_LDAP_OK + * - If successful, returns DO_LDAP_OK * - If a retryable error occurs, ERR_DO_LDAP_RETRYABLE is returned. * The caller should wait a while and retry the operation. * - If a fatal error occurs, ERR_DO_LDAP_FATAL is returned. The caller @@ -75,92 +62,129 @@ static struct timeval kst = {30L, 0L}; */ int do_ldap( - Ri *ri, - Re *re, - char **errmsg + Ri *ri, + Re *re, + char **errmsg ) { - int rc = 0; - int lderr = LDAP_SUCCESS; - int retry = 2; + int retry = 2; + *errmsg = NULL; - *errmsg = NULL; + do { + int lderr; + if ( ri->ri_ldp == NULL ) { + lderr = do_bind( ri, &lderr ); - while ( retry > 0 ) { - if ( ri->ri_ldp == NULL ) { - rc = do_bind( ri, &lderr ); + if ( lderr != BIND_OK ) { + return DO_LDAP_ERR_RETRYABLE; + } + } - if ( rc != BIND_OK ) { - (void) do_unbind( ri ); - return DO_LDAP_ERR_RETRYABLE; - } - } + switch ( re->re_changetype ) { + case T_ADDCT: + lderr = op_ldap_add( ri, re, errmsg ); + if ( lderr != LDAP_SUCCESS ) { +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, "do_ldap: " + "Error: ldap_add_s failed adding \"%s\": %s\n", + *errmsg ? *errmsg : ldap_err2string( lderr ), + re->re_dn, 0 ); +#else + Debug( LDAP_DEBUG_ANY, + "Error: ldap_add_s failed adding \"%s\": %s\n", + *errmsg ? *errmsg : ldap_err2string( lderr ), + re->re_dn, 0 ); +#endif + } + break; + + case T_MODIFYCT: + lderr = op_ldap_modify( ri, re, errmsg ); + if ( lderr != LDAP_SUCCESS ) { +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, "do_ldap: " + "Error: ldap_modify_s failed modifying \"%s\": %s\n", + *errmsg ? *errmsg : ldap_err2string( lderr ), + re->re_dn, 0 ); +#else + Debug( LDAP_DEBUG_ANY, + "Error: ldap_modify_s failed modifying \"%s\": %s\n", + *errmsg ? *errmsg : ldap_err2string( lderr ), + re->re_dn, 0 ); +#endif + } + break; + + case T_DELETECT: + lderr = op_ldap_delete( ri, re, errmsg ); + if ( lderr != LDAP_SUCCESS ) { +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, "do_ldap: " + "Error: ldap_delete_s failed deleting \"%s\": %s\n", + *errmsg ? *errmsg : ldap_err2string( lderr ), + re->re_dn, 0 ); +#else + Debug( LDAP_DEBUG_ANY, + "Error: ldap_delete_s failed deleting \"%s\": %s\n", + *errmsg ? *errmsg : ldap_err2string( lderr ), + re->re_dn, 0 ); +#endif + } + break; + + case T_MODRDNCT: + lderr = op_ldap_modrdn( ri, re, errmsg ); + if ( lderr != LDAP_SUCCESS ) { +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, "do_ldap: " + "Error: ldap_modrdn_s failed modifying %s: %s\n", + *errmsg ? *errmsg : ldap_err2string( lderr ), + re->re_dn, 0 ); +#else + Debug( LDAP_DEBUG_ANY, + "Error: ldap_modrdn_s failed modifying %s: %s\n", + *errmsg ? *errmsg : ldap_err2string( lderr ), + re->re_dn, 0 ); +#endif + } + break; + + default: +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, "do_ldap: " + "Error: bad op \"%d\", dn = \"%s\"\n", + re->re_changetype, re->re_dn, 0 ); +#else + Debug( LDAP_DEBUG_ANY, + "Error: do_ldap: bad op \"%d\", dn = \"%s\"\n", + re->re_changetype, re->re_dn, 0 ); +#endif + return DO_LDAP_ERR_FATAL; + } - switch ( re->re_changetype ) { - case T_ADDCT: - lderr = op_ldap_add( ri, re, errmsg ); - if ( lderr != LDAP_SUCCESS ) { - Debug( LDAP_DEBUG_ANY, - "Error: ldap_add_s failed adding \"%s\": %s\n", - *errmsg ? *errmsg : ldap_err2string( lderr ), - re->re_dn, 0 ); - } - break; - case T_MODIFYCT: - lderr = op_ldap_modify( ri, re, errmsg ); - if ( lderr != LDAP_SUCCESS ) { - Debug( LDAP_DEBUG_ANY, - "Error: ldap_modify_s failed modifying \"%s\": %s\n", - *errmsg ? *errmsg : ldap_err2string( lderr ), - re->re_dn, 0 ); - } - break; - case T_DELETECT: - lderr = op_ldap_delete( ri, re, errmsg ); - if ( lderr != LDAP_SUCCESS ) { - Debug( LDAP_DEBUG_ANY, - "Error: ldap_delete_s failed deleting \"%s\": %s\n", - *errmsg ? *errmsg : ldap_err2string( lderr ), - re->re_dn, 0 ); - } - break; - case T_MODRDNCT: - lderr = op_ldap_modrdn( ri, re, errmsg ); - if ( lderr != LDAP_SUCCESS ) { - Debug( LDAP_DEBUG_ANY, - "Error: ldap_modrdn_s failed modifying %s: %s\n", - *errmsg ? *errmsg : ldap_err2string( lderr ), - re->re_dn, 0 ); - } - break; - default: - Debug( LDAP_DEBUG_ANY, - "Error: do_ldap: bad op \"%d\", dn = \"%s\"\n", - re->re_changetype, re->re_dn, 0 ); - return DO_LDAP_ERR_FATAL; - } + /* + * Analyze return code. If ok, just return. If LDAP_SERVER_DOWN, + * we may have been idle long enough that the remote slapd timed + * us out. Rebind and try again. + */ + switch( lderr ) { + case LDAP_SUCCESS: + return DO_LDAP_OK; + + default: + return DO_LDAP_ERR_FATAL; + + case LDAP_SERVER_DOWN: /* server went down */ + (void) do_unbind( ri ); + retry--; + } + } while ( retry > 0 ); - /* - * Analyze return code. If ok, just return. If LDAP_SERVER_DOWN, - * we may have been idle long enough that the remote slapd timed - * us out. Rebind and try again. - */ - if ( lderr == LDAP_SUCCESS ) { - return DO_LDAP_OK; - } else if ( lderr == LDAP_SERVER_DOWN ) { - /* The LDAP server may have timed us out - rebind and try again */ - (void) do_unbind( ri ); - retry--; - } else { - return DO_LDAP_ERR_FATAL; - } - } - return DO_LDAP_ERR_FATAL; + return DO_LDAP_ERR_RETRYABLE; } - /* * Perform an ldap add operation. */ @@ -200,16 +224,27 @@ op_ldap_add( ldmarr[ nattrs ] = NULL; /* Perform the operation */ +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ARGS, + "op_ldap_add: replica %s:%d - add dn \"%s\"\n", + ri->ri_hostname, ri->ri_port, re->re_dn ); +#else Debug( LDAP_DEBUG_ARGS, "replica %s:%d - add dn \"%s\"\n", ri->ri_hostname, ri->ri_port, re->re_dn ); +#endif rc = ldap_add_s( ri->ri_ldp, re->re_dn, ldmarr ); ldap_get_option( ri->ri_ldp, LDAP_OPT_ERROR_NUMBER, &lderr); } else { *errmsg = "No modifications to do"; +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, + "op_ldap_add: Error: no mods to do (%s)!\n", re->re_dn, 0, 0 ); +#else Debug( LDAP_DEBUG_ANY, "Error: op_ldap_add: no mods to do (%s)!\n", re->re_dn, 0, 0 ); +#endif } free_ldmarr( ldmarr ); return( lderr ); @@ -233,7 +268,7 @@ op_ldap_modify( int state; /* This code is a simple-minded state machine */ int nvals; /* Number of values we're modifying */ int nops; /* Number of LDAPMod structs in ldmarr */ - LDAPMod *ldm, **ldmarr; + LDAPMod *ldm = NULL, **ldmarr; int i, len; char *type, *value; int rc = 0; @@ -245,8 +280,13 @@ op_ldap_modify( if ( re->re_mods == NULL ) { *errmsg = "No arguments given"; +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, + "op_ldap_modify: Error: no arguments\n" , 0, 0, 0 ); +#else Debug( LDAP_DEBUG_ANY, "Error: op_ldap_modify: no arguments\n", 0, 0, 0 ); +#endif return -1; } @@ -293,20 +333,34 @@ op_ldap_modify( break; default: if ( state == AWAITING_OP ) { +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, + "op_ldap_modify: Error: unknown mod type \"%s\"\n", type, 0, 0 ); +#else Debug( LDAP_DEBUG_ANY, "Error: op_ldap_modify: unknown mod type \"%s\"\n", type, 0, 0 ); +#endif continue; } + assert( ldm ); + /* * We should have an attribute: value pair here. * Construct the mod_bvalues part of the ldapmod struct. */ if ( strcasecmp( type, ldm->mod_type )) { +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, + "op_ldap_modify: Error: " + "malformed modify op, %s: %s (expecting \"%s\")\n", + type, value, ldm->mod_type ); +#else Debug( LDAP_DEBUG_ANY, "Error: malformed modify op, %s: %s (expecting %s:)\n", type, value, ldm->mod_type ); +#endif continue; } ldm->mod_bvalues = ( struct berval ** ) @@ -324,8 +378,14 @@ op_ldap_modify( if ( nops > 0 ) { /* Actually perform the LDAP operation */ +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, DETAIL1, + "op_ldap_modify: replica %s:%d - modify dn \"%s\"\n", + ri->ri_hostname, ri->ri_port, re->re_dn ); +#else Debug( LDAP_DEBUG_ARGS, "replica %s:%d - modify dn \"%s\"\n", ri->ri_hostname, ri->ri_port, re->re_dn ); +#endif rc = ldap_modify_s( ri->ri_ldp, re->re_dn, ldmarr ); } free_ldmarr( ldmarr ); @@ -347,8 +407,14 @@ op_ldap_delete( { int rc; +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ARGS, + "op_ldap_delete: replica %s:%d - delete dn \"%s\"\n", + ri->ri_hostname, ri->ri_port, re->re_dn ); +#else Debug( LDAP_DEBUG_ARGS, "replica %s:%d - delete dn \"%s\"\n", ri->ri_hostname, ri->ri_port, re->re_dn ); +#endif rc = ldap_delete_s( ri->ri_ldp, re->re_dn ); return( rc ); @@ -379,13 +445,18 @@ op_ldap_modrdn( int lderr = 0; int state = 0; int drdnflag = -1; - char *newrdn; + char *newrdn = NULL; char *newsup = NULL; if ( re->re_mods == NULL ) { *errmsg = "No arguments given"; +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, + "op_ldap_modrdn: Error: no arguments\n" , 0, 0, 0 ); +#else Debug( LDAP_DEBUG_ANY, "Error: op_ldap_modrdn: no arguments\n", 0, 0, 0 ); +#endif return -1; } @@ -395,9 +466,15 @@ op_ldap_modrdn( for ( mi = re->re_mods, i = 0; mi[ i ].mi_type != NULL; i++ ) { if ( !strcmp( mi[ i ].mi_type, T_NEWRDNSTR )) { if( state & GOT_NEWRDN ) { +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, + "op_ldap_modrdn: Error: multiple newrdn arg \"%s\"\n", + mi[ i ].mi_val, 0, 0 ); +#else Debug( LDAP_DEBUG_ANY, "Error: op_ldap_modrdn: multiple newrdn arg \"%s\"\n", mi[ i ].mi_val, 0, 0 ); +#endif *errmsg = "Multiple newrdn argument"; return -1; } @@ -407,9 +484,15 @@ op_ldap_modrdn( } else if ( !strcmp( mi[ i ].mi_type, T_DELOLDRDNSTR )) { if( state & GOT_DELOLDRDN ) { +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, + "op_ldap_modrdn: Error: multiple deleteoldrdn arg \"%s\"\n", + mi[ i ].mi_val, 0, 0 ); +#else Debug( LDAP_DEBUG_ANY, "Error: op_ldap_modrdn: multiple deleteoldrdn arg \"%s\"\n", mi[ i ].mi_val, 0, 0 ); +#endif *errmsg = "Multiple newrdn argument"; return -1; } @@ -420,28 +503,46 @@ op_ldap_modrdn( } else if ( !strcmp( mi[ i ].mi_val, "1" )) { drdnflag = 1; } else { +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, + "op_ldap_modrdn: Error: bad deleteoldrdn arg \"%s\"\n", + mi[ i ].mi_val, 0, 0 ); +#else Debug( LDAP_DEBUG_ANY, "Error: op_ldap_modrdn: bad deleteoldrdn arg \"%s\"\n", mi[ i ].mi_val, 0, 0 ); +#endif *errmsg = "Incorrect argument to deleteoldrdn"; return -1; } } else if ( !strcmp( mi[ i ].mi_type, T_NEWSUPSTR )) { if( state & GOT_NEWSUP ) { +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, + "op_ldap_modrdn: Error: multiple newsuperior arg \"%s\"\n", + mi[ i ].mi_val, 0, 0 ); +#else Debug( LDAP_DEBUG_ANY, "Error: op_ldap_modrdn: multiple newsuperior arg \"%s\"\n", mi[ i ].mi_val, 0, 0 ); - *errmsg = "Multiple newrdn argument"; +#endif + *errmsg = "Multiple newsuperior argument"; return -1; } - newrdn = mi[ i ].mi_val; + newsup = mi[ i ].mi_val; state |= GOT_NEWSUP; } else { +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, + "op_ldap_modrdn: Error: bad type \"%s\"\n", + mi[ i ].mi_type, 0, 0 ); +#else Debug( LDAP_DEBUG_ANY, "Error: op_ldap_modrdn: bad type \"%s\"\n", mi[ i ].mi_type, 0, 0 ); +#endif *errmsg = "Bad value in replication log entry"; return -1; } @@ -450,9 +551,14 @@ op_ldap_modrdn( /* * Punt if we don't have all the args. */ - if ( GOT_ALL_MODDN(state) ) { + if ( !GOT_ALL_MODDN(state) ) { +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, + "op_ldap_modrdn: Error: missing arguments\n" , 0, 0, 0 ); +#else Debug( LDAP_DEBUG_ANY, "Error: op_ldap_modrdn: missing arguments\n", 0, 0, 0 ); +#endif *errmsg = "Missing argument: requires \"newrdn\" and \"deleteoldrdn\""; return -1; } @@ -461,19 +567,30 @@ op_ldap_modrdn( if ( ldap_debug & LDAP_DEBUG_ARGS ) { char buf[ 256 ]; char *buf2; - sprintf( buf, "%s:%d", ri->ri_hostname, ri->ri_port ); - buf2 = (char *) ch_malloc( strlen( re->re_dn ) + strlen( mi->mi_val ) - + 10 ); - sprintf( buf2, "(\"%s\" -> \"%s\")", re->re_dn, mi->mi_val ); + int buf2len = strlen( re->re_dn ) + strlen( mi->mi_val ) + 11; + + snprintf( buf, sizeof(buf), "%s:%d", ri->ri_hostname, ri->ri_port ); + + buf2 = (char *) ch_malloc( buf2len ); + snprintf( buf2, buf2len, "(\"%s\" -> \"%s\")", re->re_dn, mi->mi_val ); + +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ARGS, + "op_ldap_modrdn: replica %s - modify rdn %s (flag: %d)\n", + buf, buf2, drdnflag ); +#else Debug( LDAP_DEBUG_ARGS, "replica %s - modify rdn %s (flag: %d)\n", buf, buf2, drdnflag ); +#endif free( buf2 ); } #endif /* LDAP_DEBUG */ + assert( newrdn ); + /* Do the modrdn */ - rc = ldap_rename2_s( ri->ri_ldp, re->re_dn, mi->mi_val, newsup, drdnflag ); + rc = ldap_rename2_s( ri->ri_ldp, re->re_dn, newrdn, newsup, drdnflag ); ldap_get_option( ri->ri_ldp, LDAP_OPT_ERROR_NUMBER, &lderr); return( lderr ); @@ -598,9 +715,15 @@ do_unbind( if (( ri != NULL ) && ( ri->ri_ldp != NULL )) { rc = ldap_unbind( ri->ri_ldp ); if ( rc != LDAP_SUCCESS ) { +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, + "do_unbind: ldap_unbind failed for %s:%d: %s\n", + ri->ri_hostname, ri->ri_port, ldap_err2string( rc ) ); +#else Debug( LDAP_DEBUG_ANY, "Error: do_unbind: ldap_unbind failed for %s:%d: %s\n", ri->ri_hostname, ri->ri_port, ldap_err2string( rc ) ); +#endif } ri->ri_ldp = NULL; } @@ -627,167 +750,283 @@ do_bind( ) { int ldrc; -#ifdef HAVE_KERBEROS - int rc; - int retval = 0; - int kni, got_tgt; - char **krbnames; - char *skrbnames[ 2 ]; - char realm[ REALM_SZ ]; - char name[ ANAME_SZ ]; - char instance[ INST_SZ ]; -#endif /* HAVE_KERBEROS */ *lderr = 0; if ( ri == NULL ) { +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, "do_bind: null ri ptr\n" , 0, 0, 0 ); +#else Debug( LDAP_DEBUG_ANY, "Error: do_bind: null ri ptr\n", 0, 0, 0 ); +#endif return( BIND_ERR_BADRI ); } if ( ri->ri_ldp != NULL ) { ldrc = ldap_unbind( ri->ri_ldp ); if ( ldrc != LDAP_SUCCESS ) { +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, + "do_bind: ldap_unbind failed: %s\n", ldap_err2string( ldrc ), 0, 0 ); +#else Debug( LDAP_DEBUG_ANY, "Error: do_bind: ldap_unbind failed: %s\n", ldap_err2string( ldrc ), 0, 0 ); +#endif } ri->ri_ldp = NULL; } +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ARGS, + "do_bind: Initializing session to %s:%d\n", + ri->ri_hostname, ri->ri_port, 0 ); +#else Debug( LDAP_DEBUG_ARGS, "Initializing session to %s:%d\n", ri->ri_hostname, ri->ri_port, 0 ); +#endif + ri->ri_ldp = ldap_init( ri->ri_hostname, ri->ri_port ); if ( ri->ri_ldp == NULL ) { - Debug( LDAP_DEBUG_ANY, "Error: ldap_init(%s, %d) failed: %s\n", - ri->ri_hostname, ri->ri_port, sys_errlist[ errno ] ); - return( BIND_ERR_OPEN ); +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, + "do_bind: ldap_init (%s, %d) failed: %s\n", + ri->ri_hostname, ri->ri_port, sys_errlist[ errno ] ); +#else + Debug( LDAP_DEBUG_ANY, "Error: ldap_init(%s, %d) failed: %s\n", + ri->ri_hostname, ri->ri_port, sys_errlist[ errno ] ); +#endif + return( BIND_ERR_OPEN ); } - /* - * Disable string translation if enabled by default. - * The replication log is written in the internal format, - * so this would do another translation, breaking havoc. - */ -#if defined( STR_TRANSLATION ) && defined( LDAP_DEFAULT_CHARSET ) - ri->ri_ldp->ld_lberoptions &= ~LBER_TRANSLATE_STRINGS; -#endif /* STR_TRANSLATION && LDAP_DEFAULT_CHARSET */ + { /* set version 3 */ + int err, version = 3; + err = ldap_set_option(ri->ri_ldp, + LDAP_OPT_PROTOCOL_VERSION, &version); + + if( err != LDAP_OPT_SUCCESS ) { +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, "do_bind: " + "Error: ldap_set_option(%s, LDAP_OPT_VERSION, 3) failed!\n", + ri->ri_hostname, 0, 0 ); +#else + Debug( LDAP_DEBUG_ANY, + "Error: ldap_set_option(%s, LDAP_OPT_VERSION, 3) failed!\n", + ri->ri_hostname, NULL, NULL ); +#endif + + ldap_unbind( ri->ri_ldp ); + ri->ri_ldp = NULL; + return BIND_ERR_VERSION; + } + } /* * Set ldap library options to (1) not follow referrals, and * (2) restart the select() system call. */ - ldap_set_option(ri->ri_ldp, LDAP_OPT_REFERRALS, LDAP_OPT_OFF); + { + int err; + err = ldap_set_option(ri->ri_ldp, LDAP_OPT_REFERRALS, LDAP_OPT_OFF); + + if( err != LDAP_OPT_SUCCESS ) { +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, "do_bind: " + "Error: ldap_set_option(%s, REFERRALS, OFF) failed!\n", + ri->ri_hostname, 0, 0 ); +#else + Debug( LDAP_DEBUG_ANY, + "Error: ldap_set_option(%s,REFERRALS, OFF) failed!\n", + ri->ri_hostname, NULL, NULL ); +#endif + ldap_unbind( ri->ri_ldp ); + ri->ri_ldp = NULL; + return BIND_ERR_REFERRALS; + } + } ldap_set_option(ri->ri_ldp, LDAP_OPT_RESTART, LDAP_OPT_ON); - switch ( ri->ri_bind_method ) { - case AUTH_KERBEROS: -#ifndef HAVE_KERBEROS - Debug( LDAP_DEBUG_ANY, - "Error: Kerberos bind for %s:%d, but not compiled w/kerberos\n", - ri->ri_hostname, ri->ri_port, 0 ); - return( BIND_ERR_KERBEROS_FAILED ); -#else /* HAVE_KERBEROS */ - /* - * Bind using kerberos. - * If "bindprincipal" was given in the config file, then attempt - * to get a TGT for that principal (via the srvtab file). If only - * a binddn was given, then we need to read that entry to get - * the kerberosName attributes, and try to get a TGT for one - * of them. All are tried. The first one which succeeds is - * returned. XXX It might be a good idea to just require a - * bindprincipal. Reading the entry every time might be a significant - * amount of overhead, if the connection is closed between most - * updates. - */ + if( ri->ri_tls ) { + int err; + err = ldap_start_tls_s(ri->ri_ldp, NULL, NULL); + + if( err != LDAP_SUCCESS ) { +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, "do_bind: " + "%s: ldap_start_tls failed: %s (%d)\n", + ri->ri_tls == TLS_CRITICAL ? "Error" : "Warning", + ldap_err2string( err ), err ); +#else + Debug( LDAP_DEBUG_ANY, + "%s: ldap_start_tls failed: %s (%d)\n", + ri->ri_tls == TLS_CRITICAL ? "Error" : "Warning", + ldap_err2string( err ), err ); +#endif - if ( ri->ri_principal != NULL ) { - skrbnames[ 0 ] = ri->ri_principal; - skrbnames[ 1 ] = NULL; - krbnames = skrbnames; - } else { - krbnames = read_krbnames( ri ); - } - - if (( krbnames == NULL ) || ( krbnames[ 0 ] == NULL )) { - Debug( LDAP_DEBUG_ANY, - "Error: Can't find krbname for binddn \"%s\"\n", - ri->ri_bind_dn, 0, 0 ); - retval = BIND_ERR_KERBEROS_FAILED; - goto kexit; - } - /* - * Now we've got one or more kerberos principals. See if any - * of them are in the srvtab file. - */ - got_tgt = 0; - for ( kni = 0; krbnames[ kni ] != NULL; kni++ ) { - rc = kname_parse( name, instance, realm, krbnames[ kni ]); - if ( rc != KSUCCESS ) { - continue; - } - upcase( realm ); - rc = krb_get_svc_in_tkt( name, instance, realm, "krbtgt", realm, - 1, ri->ri_srvtab ); - if ( rc != KSUCCESS) { - Debug( LDAP_DEBUG_ANY, "Error: Can't get TGT for %s: %s\n", - krbnames[ kni ], krb_err_txt[ rc ], 0 ); - } else { - got_tgt = 1; - break; - } - } - if (!got_tgt) { - Debug( LDAP_DEBUG_ANY, - "Error: Could not obtain TGT for DN \"%s\"\n", - ri->ri_bind_dn, 0, 0 ); - retval = BIND_ERR_KERBEROS_FAILED; - goto kexit; - } - /* - * We've got a TGT. Do a kerberos bind. - */ - Debug( LDAP_DEBUG_ARGS, "bind to %s:%d as %s (kerberos)\n", - ri->ri_hostname, ri->ri_port, ri->ri_bind_dn ); - ldrc = ldap_kerberos_bind_s( ri->ri_ldp, ri->ri_bind_dn ); - ri->ri_principal = strdup( krbnames[ kni ] ); - if ( ldrc != LDAP_SUCCESS ) { - Debug( LDAP_DEBUG_ANY, "Error: kerberos bind for %s:%dfailed: %s\n", - ri->ri_hostname, ri->ri_port, ldap_err2string( ldrc )); - *lderr = ldrc; - retval = BIND_ERR_KERBEROS_FAILED; - goto kexit; - } -kexit: if ( krbnames != NULL ) { - ldap_value_free( krbnames ); + if( ri->ri_tls == TLS_CRITICAL ) { + ldap_unbind( ri->ri_ldp ); + ri->ri_ldp = NULL; + return BIND_ERR_TLS_FAILED; + } + } } - return( retval); - break; -#endif /* HAVE_KERBEROS */ + + switch ( ri->ri_bind_method ) { case AUTH_SIMPLE: /* * Bind with a plaintext password. */ +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ARGS, + "do_bind: bind to %s:%d as %s (simple)\n", + ri->ri_hostname, ri->ri_port, ri->ri_bind_dn ); +#else Debug( LDAP_DEBUG_ARGS, "bind to %s:%d as %s (simple)\n", ri->ri_hostname, ri->ri_port, ri->ri_bind_dn ); +#endif ldrc = ldap_simple_bind_s( ri->ri_ldp, ri->ri_bind_dn, ri->ri_password ); if ( ldrc != LDAP_SUCCESS ) { +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, "do_bind: " + "Error: ldap_simple_bind_s for %s:%d failed: %s\n", + ri->ri_hostname, ri->ri_port, ldap_err2string( ldrc ) ); +#else Debug( LDAP_DEBUG_ANY, "Error: ldap_simple_bind_s for %s:%d failed: %s\n", ri->ri_hostname, ri->ri_port, ldap_err2string( ldrc )); +#endif *lderr = ldrc; + ldap_unbind( ri->ri_ldp ); + ri->ri_ldp = NULL; return( BIND_ERR_SIMPLE_FAILED ); - } else { - return( BIND_OK ); } break; + + case AUTH_SASL: +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ARGS, + "do_bind: bind to %s as %s via %s (SASL)\n", + ri->ri_hostname, + ri->ri_authcId ? ri->ri_authcId : "-", + ri->ri_saslmech ); +#else + Debug( LDAP_DEBUG_ARGS, "bind to %s as %s via %s (SASL)\n", + ri->ri_hostname, + ri->ri_authcId ? ri->ri_authcId : "-", + ri->ri_saslmech ); +#endif + +#ifdef HAVE_CYRUS_SASL + if( ri->ri_secprops != NULL ) { + int err; + err = ldap_set_option(ri->ri_ldp, LDAP_OPT_X_SASL_SECPROPS, + ri->ri_secprops); + + if( err != LDAP_OPT_SUCCESS ) { +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, "do_bind: " + "Error: ldap_set_option(%s,SECPROPS,\"%s\") failed!\n", + ri->ri_hostname, ri->ri_secprops, 0 ); +#else + Debug( LDAP_DEBUG_ANY, + "Error: ldap_set_option(%s,SECPROPS,\"%s\") failed!\n", + ri->ri_hostname, ri->ri_secprops, NULL ); +#endif + ldap_unbind( ri->ri_ldp ); + ri->ri_ldp = NULL; + return BIND_ERR_SASL_FAILED; + } + } + + { + char *passwd = ri->ri_password ? ber_strdup( ri->ri_password ) : NULL; + void *defaults = lutil_sasl_defaults( ri->ri_ldp, ri->ri_saslmech, + ri->ri_realm, ri->ri_authcId, passwd, ri->ri_authzId ); + + ldrc = ldap_sasl_interactive_bind_s( ri->ri_ldp, ri->ri_bind_dn, + ri->ri_saslmech, NULL, NULL, + LDAP_SASL_QUIET, lutil_sasl_interact, defaults ); + if ( ldrc != LDAP_SUCCESS ) { +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, "do_bind: " + "Error: LDAP SASL for %s:%d failed: %s\n", + ri->ri_hostname, ri->ri_port, ldap_err2string( ldrc ) ); +#else + Debug( LDAP_DEBUG_ANY, "Error: LDAP SASL for %s:%d failed: %s\n", + ri->ri_hostname, ri->ri_port, ldap_err2string( ldrc )); +#endif + *lderr = ldrc; + ldap_unbind( ri->ri_ldp ); + ri->ri_ldp = NULL; + return( BIND_ERR_SASL_FAILED ); + } + + ber_memfree( passwd ); + ber_memfree( defaults ); + } + break; +#else +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, "do_bind: " + "Error: do_bind: SASL not supported %s:%d\n", + ri->ri_hostname, ri->ri_port, 0 ); +#else + Debug( LDAP_DEBUG_ANY, + "Error: do_bind: SASL not supported %s:%d\n", + ri->ri_hostname, ri->ri_port, NULL ); +#endif + ldap_unbind( ri->ri_ldp ); + ri->ri_ldp = NULL; + return( BIND_ERR_BAD_ATYPE ); +#endif + default: +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, "do_bind: " + "Error: do_bind: unknown auth type \"%d\" for %s:%d\n", + ri->ri_bind_method, ri->ri_hostname, ri->ri_port ); +#else Debug( LDAP_DEBUG_ANY, "Error: do_bind: unknown auth type \"%d\" for %s:%d\n", ri->ri_bind_method, ri->ri_hostname, ri->ri_port ); +#endif + ldap_unbind( ri->ri_ldp ); + ri->ri_ldp = NULL; return( BIND_ERR_BAD_ATYPE ); } + + { + int err; + LDAPControl c; + LDAPControl *ctrls[2]; + ctrls[0] = &c; + ctrls[1] = NULL; + + c.ldctl_oid = LDAP_CONTROL_MANAGEDSAIT; + c.ldctl_value.bv_val = NULL; + c.ldctl_value.bv_len = 0; + c.ldctl_iscritical = 0; + + err = ldap_set_option(ri->ri_ldp, LDAP_OPT_SERVER_CONTROLS, &ctrls); + + if( err != LDAP_OPT_SUCCESS ) { +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, ERR, "do_bind: " + "ldap_set_option(%s, SERVER_CONTROLS, ManageDSAit) failed!\n", + ri->ri_hostname, 0, 0 ); +#else + Debug( LDAP_DEBUG_ANY, "Error: " + "ldap_set_option(%s, SERVER_CONTROLS, ManageDSAit) failed!\n", + ri->ri_hostname, NULL, NULL ); +#endif + ldap_unbind( ri->ri_ldp ); + ri->ri_ldp = NULL; + return BIND_ERR_MANAGEDSAIT; + } + } + + return( BIND_OK ); } @@ -809,6 +1048,17 @@ dump_ldm_array( for ( i = 0; ldmarr[ i ] != NULL; i++ ) { ldm = ldmarr[ i ]; +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, INFO, "dump_ldm_array: " + "Trace (%ld): *** ldmarr[ %d ] contents:\n", + (long) getpid(), i, 0 ); + LDAP_LOG ( OPERATION, INFO, "dump_ldm_array: " + "Trace (%ld): *** ldm->mod_op: %d\n", + (long) getpid(), ldm->mod_op, 0 ); + LDAP_LOG ( OPERATION, INFO, "dump_ldm_array: " + "Trace (%ld): *** ldm->mod_type: %s\n", + (long) getpid(), ldm->mod_type, 0 ); +#else Debug( LDAP_DEBUG_TRACE, "Trace (%ld): *** ldmarr[ %d ] contents:\n", (long) getpid(), i, 0 ); @@ -818,93 +1068,21 @@ dump_ldm_array( Debug( LDAP_DEBUG_TRACE, "Trace (%ld): *** ldm->mod_type: %s\n", (long) getpid(), ldm->mod_type, 0 ); +#endif if ( ldm->mod_bvalues != NULL ) { for ( j = 0; ( b = ldm->mod_bvalues[ j ] ) != NULL; j++ ) { msgbuf = ch_malloc( b->bv_len + 512 ); sprintf( msgbuf, "***** bv[ %d ] len = %ld, val = <%s>", j, b->bv_len, b->bv_val ); +#ifdef NEW_LOGGING + LDAP_LOG ( OPERATION, INFO, "dump_ldm_array: " + "Trace (%ld):%s\n", (long) getpid(), msgbuf, 0 ); +#else Debug( LDAP_DEBUG_TRACE, "Trace (%ld):%s\n", (long) getpid(), msgbuf, 0 ); +#endif free( msgbuf ); } } } } - - -/* - * Get the kerberos names from the binddn for "replica" via an ldap search. - * Returns a null-terminated array of char *, or NULL if the entry could - * not be found or there were no kerberosName attributes. The caller is - * responsible for freeing the returned array and strings it points to. - */ -static char ** -read_krbnames( - Ri *ri -) -{ - int rc; - char **krbnames; - int ne; - LDAPMessage *result, *entry; - - /* First need to bind as NULL */ - rc = ldap_simple_bind_s( ri->ri_ldp, NULL, NULL ); - if ( rc != LDAP_SUCCESS ) { - Debug( LDAP_DEBUG_ANY, - "Error: null bind failed getting krbnames for %s:%d: %s\n", - ri->ri_hostname, ri->ri_port, ldap_err2string( rc )); - return( NULL ); - } - rc = ldap_search_st( ri->ri_ldp, ri->ri_bind_dn, LDAP_SCOPE_BASE, - "objectclass=*", kattrs, 0, &kst, &result ); - if ( rc != LDAP_SUCCESS ) { - Debug( LDAP_DEBUG_ANY, - "Error: search failed getting krbnames for %s:%d: %s\n", - ri->ri_hostname, ri->ri_port, ldap_err2string( rc )); - return( NULL ); - } - ne = ldap_count_entries( ri->ri_ldp, result ); - if ( ne == 0 ) { - Debug( LDAP_DEBUG_ANY, - "Error: Can't find entry \"%s\" for %s:%d kerberos bind\n", - ri->ri_bind_dn, ri->ri_hostname, ri->ri_port ); - return( NULL ); - } - if ( ne > 1 ) { - Debug( LDAP_DEBUG_ANY, - "Error: Kerberos binddn \"%s\" for %s:%dis ambiguous\n", - ri->ri_bind_dn, ri->ri_hostname, ri->ri_port ); - return( NULL ); - } - entry = ldap_first_entry( ri->ri_ldp, result ); - if ( entry == NULL ) { - Debug( LDAP_DEBUG_ANY, - "Error: Can't find \"%s\" for kerberos binddn for %s:%d\n", - ri->ri_bind_dn, ri->ri_hostname, ri->ri_port ); - return( NULL ); - } - krbnames = ldap_get_values( ri->ri_ldp, entry, "kerberosName" ); - ldap_msgfree( result ); - return( krbnames ); -} - - -#ifdef HAVE_KERBEROS - -/* - * upcase a string - */ -static void -upcase( - char *s -) -{ - char *p; - - for ( p = s; ( p != NULL ) && ( *p != '\0' ); p++ ) { - *p = TOUPPER( (unsigned char) *p ); - } -} - -#endif /* HAVE_KERBEROS */