Add "allow tls_2_anon" to allow StartTLS to force session to anonymous.

Add "disallow tls_authc" to disallow StartTLS when session is authenticated.
Create and use connection2anonymous routine for consistency.

diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5
index 064b6b2f9a4bb05c0d1c040902fedbb859700b23..25563576ee5621211302e8163aa2804a9abda3e6 100644 (file)
--- a/doc/man/man5/slapd.conf.5
+++ b/doc/man/man5/slapd.conf.5
@@ -72,6 +72,13 @@ attributes (specified by <what>) by one or more requestors (specified
 by <who>).
 See the "OpenLDAP's Administrator's Guide" for details.
 .TP
+.B allow <features>
+Specify a set of features (separated by white space) to allow.
+.B tls_2_anon
+allows Start TLS to force session to anonymous status (see also
+.B disallow
+.BR tls_authc ).
+.TP
 .B argsfile <filename>
 The ( absolute ) name of a file that will hold the 
 .B slapd
@@ -136,6 +143,10 @@ disables anonymous bind creditials are not empty (e.g. when
 DN is empty).
 .B bind_anon_dn
 disables anonymous bind when DN is not empty.
+.B tls_authc
+disables StartTLS if authenticated (see also
+.B allow
+.BR tls_2_anon ).
 .TP
 .B idletimeout <integer>
 Specify the number of seconds to wait before forcibly closing

diff --git a/servers/slapd/bind.c b/servers/slapd/bind.c
index e825eeb850d6352af19e2a05341d2d45e7c6ba0a..c9a00d942106e2f65492773e2f4923a4f146caaa 100644 (file)
--- a/servers/slapd/bind.c
+++ b/servers/slapd/bind.c
@@ -53,30 +53,11 @@ do_bind(
        mech = NULL;
        cred.bv_val = NULL;
 
-       ldap_pvt_thread_mutex_lock( &conn->c_mutex );
-
        /*
         * Force to connection to "anonymous" until bind succeeds.
         */
-
-       if ( conn->c_authmech != NULL ) {
-               free( conn->c_authmech );
-               conn->c_authmech = NULL;
-       }
-
-       if ( conn->c_cdn != NULL ) {
-               free( conn->c_cdn );
-               conn->c_cdn = NULL;
-       }
-
-       if ( conn->c_dn != NULL ) {
-               free( conn->c_dn );
-               conn->c_dn = NULL;
-       }
-
-       conn->c_authc_backend = NULL;
-       conn->c_authz_backend = NULL;
-
+       ldap_pvt_thread_mutex_lock( &conn->c_mutex );
+       connection2anonymous( conn );
        ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
 
        if ( op->o_dn != NULL ) {

diff --git a/servers/slapd/config.c b/servers/slapd/config.c
index 142eb6c8648b9d573297f3c21391cf611e0ecc41..a95f014157e458544a74d59ce276d926b9a4ea44 100644 (file)
--- a/servers/slapd/config.c
+++ b/servers/slapd/config.c
@@ -26,6 +26,7 @@ int           deftime = SLAPD_DEFAULT_TIMELIMIT;
 AccessControl  *global_acl = NULL;
 slap_access_t          global_default_access = ACL_READ;
 slap_mask_t            global_restrictops = 0;
+slap_mask_t            global_allows = 0;
 slap_mask_t            global_disallows = 0;
 slap_mask_t            global_requires = 0;
 slap_ssf_set_t global_ssf_set;
@@ -506,6 +507,41 @@ read_config( const char *fname )
                        }
 
 
+               /* allow these features */
+               } else if ( strcasecmp( cargv[0], "allows" ) == 0 ||
+                       strcasecmp( cargv[0], "allow" ) == 0 )
+               {
+                       slap_mask_t     allows;
+
+                       if ( be != NULL ) {
+                               Debug( LDAP_DEBUG_ANY,
+"%s: line %d: allow line must appear prior to database definitions\n",
+                                   fname, lineno, 0 );
+                       }
+
+                       if ( cargc < 2 ) {
+                               Debug( LDAP_DEBUG_ANY,
+           "%s: line %d: missing feature(s) in \"allow <features>\" line\n",
+                                   fname, lineno, 0 );
+                               return( 1 );
+                       }
+
+                       allows = 0;
+
+                       for( i=1; i < cargc; i++ ) {
+                               if( strcasecmp( cargv[i], "tls_2_anon" ) == 0 ) {
+                                       allows |= SLAP_ALLOW_TLS_2_ANON;
+
+                               } else if( strcasecmp( cargv[i], "none" ) != 0 ) {
+                                       Debug( LDAP_DEBUG_ANY,
+                   "%s: line %d: unknown feature %s in \"allow <features>\" line\n",
+                                           fname, lineno, cargv[i] );
+                                       return( 1 );
+                               }
+                       }
+
+                       global_allows = allows;
+
                /* disallow these features */
                } else if ( strcasecmp( cargv[0], "disallows" ) == 0 ||
                        strcasecmp( cargv[0], "disallow" ) == 0 )
@@ -520,7 +556,7 @@ read_config( const char *fname )
 
                        if ( cargc < 2 ) {
                                Debug( LDAP_DEBUG_ANY,
-           "%s: line %d: missing feature(s) in \"disallows <features>\" line\n",
+           "%s: line %d: missing feature(s) in \"disallow <features>\" line\n",
                                    fname, lineno, 0 );
                                return( 1 );
                        }
@@ -540,6 +576,9 @@ read_config( const char *fname )
                                } else if( strcasecmp( cargv[i], "bind_anon_dn" ) == 0 ) {
                                        disallows |= SLAP_DISALLOW_BIND_ANON_DN;
 
+                               } else if( strcasecmp( cargv[i], "tls_authc" ) == 0 ) {
+                                       disallows |= SLAP_DISALLOW_TLS_AUTHC;
+
                                } else if( strcasecmp( cargv[i], "none" ) != 0 ) {
                                        Debug( LDAP_DEBUG_ANY,
                    "%s: line %d: unknown feature %s in \"disallow <features>\" line\n",

diff --git a/servers/slapd/connection.c b/servers/slapd/connection.c
index e41e239d319b62ba1773ce2fb2c4f26e80969285..d03a7c9a790b61a895d434a5affb3560ffb34149 100644 (file)
--- a/servers/slapd/connection.c
+++ b/servers/slapd/connection.c
@@ -473,6 +473,30 @@ long connection_init(
     return id;
 }
 
+void connection2anonymous( Connection *c )
+{
+    assert( connections != NULL );
+    assert( c != NULL );
+
+       if(c->c_authmech != NULL ) {
+               free(c->c_authmech);
+               c->c_authmech = NULL;
+       }
+
+    if(c->c_dn != NULL) {
+        free(c->c_dn);
+        c->c_dn = NULL;
+    }
+
+       if(c->c_cdn != NULL) {
+               free(c->c_cdn);
+               c->c_cdn = NULL;
+       }
+
+       c->c_authc_backend = NULL;
+       c->c_authz_backend = NULL;
+}
+
 static void
 connection_destroy( Connection *c )
 {
@@ -492,22 +516,13 @@ connection_destroy( Connection *c )
 
     c->c_activitytime = c->c_starttime = 0;
 
-       if(c->c_authmech != NULL ) {
-               free(c->c_authmech);
-               c->c_authmech = NULL;
-       }
-    if(c->c_dn != NULL) {
-        free(c->c_dn);
-        c->c_dn = NULL;
-    }
-       if(c->c_cdn != NULL) {
-               free(c->c_cdn);
-               c->c_cdn = NULL;
-       }
+       connection2anonymous( c );
+
        if(c->c_listener_url != NULL) {
                free(c->c_listener_url);
                c->c_listener_url = NULL;
        }
+
        if(c->c_peer_domain != NULL) {
                free(c->c_peer_domain);
                c->c_peer_domain = NULL;

diff --git a/servers/slapd/proto-slap.h b/servers/slapd/proto-slap.h
index c324adf29682428e24ebf9276b5db62af15f0b00..11721406076c4a5360ffe757b9e2c3475aea2110 100644 (file)
--- a/servers/slapd/proto-slap.h
+++ b/servers/slapd/proto-slap.h
@@ -286,6 +286,8 @@ LDAP_SLAPD_F (Connection *) connection_first LDAP_P((ber_socket_t *));
 LDAP_SLAPD_F (Connection *) connection_next LDAP_P((Connection *, ber_socket_t *));
 LDAP_SLAPD_F (void) connection_done LDAP_P((Connection *));
 
+LDAP_SLAPD_F (void) connection2anonymous LDAP_P((Connection *));
+
 /*
  * dn.c
  */
@@ -753,6 +755,7 @@ LDAP_SLAPD_F (int)  krbv4_ldap_auth();
  */
 
 LDAP_SLAPD_F (slap_mask_t)     global_restrictops;
+LDAP_SLAPD_F (slap_mask_t)     global_allows;
 LDAP_SLAPD_F (slap_mask_t)     global_disallows;
 LDAP_SLAPD_F (slap_mask_t)     global_requires;
 LDAP_SLAPD_F (slap_ssf_set_t)  global_ssf_set;

diff --git a/servers/slapd/slap.h b/servers/slapd/slap.h
index 76bf82d2ff28a23c755f8e8290fb82913305c941..f9864894779ca9779ae36a3ffac1310e2353fb9a 100644 (file)
--- a/servers/slapd/slap.h
+++ b/servers/slapd/slap.h
@@ -854,6 +854,8 @@ struct slap_backend_db {
        | SLAP_RESTRICT_OP_MODIFY \
        | SLAP_RESTRICT_OP_RENAME )
 
+#define SLAP_ALLOW_TLS_2_ANON  0x0001U /* StartTLS -> Anonymous */
+
 #define SLAP_DISALLOW_BIND_V2  0x0001U /* LDAPv2 bind */
 #define SLAP_DISALLOW_BIND_ANON 0x0002U /* no anonymous */
 #define SLAP_DISALLOW_BIND_ANON_CRED \
@@ -861,6 +863,11 @@ struct slap_backend_db {
 #define SLAP_DISALLOW_BIND_ANON_DN \
                                                                0x0008U /* dn should be empty */
 
+#define SLAP_DISALLOW_BIND_SIMPLE      0x0010U /* simple authentication */
+#define SLAP_DISALLOW_BIND_KERBEROS    0x0020U /* Kerberos authentication */
+
+#define SLAP_DISALLOW_TLS_AUTHC        0x0100U /* TLS while authenticated */
+
        slap_mask_t     be_requires;    /* pre-operation requirements */
 #define SLAP_REQUIRE_BIND              0x0001U /* bind before op */
 #define SLAP_REQUIRE_LDAP_V3   0x0002U /* LDAPv3 before op */
@@ -868,7 +875,6 @@ struct slap_backend_db {
 #define SLAP_REQUIRE_SASL              0x0008U /* SASL before op  */
 #define SLAP_REQUIRE_STRONG            0x0010U /* strong authentication before op */
 
-
        /* Required Security Strength Factor */
        slap_ssf_set_t be_ssf_set;
 

diff --git a/servers/slapd/starttls.c b/servers/slapd/starttls.c
index bd12f32c73d0be0c140d9c0b4cd10dad23ce2ef5..97bbab084ac9dd34cbd9fd11cb3a06b1333133b0 100644 (file)
--- a/servers/slapd/starttls.c
+++ b/servers/slapd/starttls.c
@@ -59,6 +59,21 @@ starttls_extop (
                goto done;
        }
 
+       if ( ( global_disallows & SLAP_DISALLOW_TLS_AUTHC ) &&
+               ( conn->c_dn != NULL ) )
+       {
+               *text = "cannot start TLS after authentication";
+               rc = LDAP_OPERATIONS_ERROR;
+               goto done;
+       }
+
+       if ( ( global_allows & SLAP_ALLOW_TLS_2_ANON ) &&
+               ( conn->c_dn != NULL ) )
+       {
+               /* force to anonymous */
+               connection2anonymous( conn );
+       }
+
        /* fail if TLS could not be initialized */
        if (ldap_pvt_tls_get_option(NULL, LDAP_OPT_X_TLS_CERT, &ctx) != 0
                || ctx == NULL)

diff --git a/servers/slapd/tools/mimic.c b/servers/slapd/tools/mimic.c
index 2398308aca710d7a0c0263ebe6baeda3207c92c3..555a1b31cc32c697cf0397460fe73eacd6192476 100644 (file)
--- a/servers/slapd/tools/mimic.c
+++ b/servers/slapd/tools/mimic.c
@@ -152,3 +152,7 @@ char * slap_sasl_secprops( const char *in )
        return NULL;
 }
 
+void connection2anonymous( Connection *c )
+{
+       assert(0);
+}