git.sur5r.net Git - openldap/blob - contrib/slapd-modules/authzid/authzid.c

   1 /* authzid.c - RFC 3829 Authzid Control */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 2010-2018 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* ACKNOWLEDGEMENTS:
  17  * This work was initially developed by Pierangelo Masarati for inclusion
  18  * in OpenLDAP Software.
  19  */
  20
  21 /*
  22  * RFC 3829 Authzid
  23  *
  24  * must be instantiated as a global overlay
  25  */
  26
  27 #include "portable.h"
  28
  29 #include "slap.h"
  30 #include "config.h"
  31 #include "lutil.h"
  32 #include "ac/string.h"
  33
  34 typedef struct authzid_conn_t {
  35         Connection *conn;
  36         int refcnt;
  37         char authzid_flag;
  38 } authzid_conn_t;
  39
  40 static ldap_pvt_thread_mutex_t authzid_mutex;
  41 static Avlnode *authzid_tree;
  42
  43 static int
  44 authzid_conn_cmp( const void *c1, const void *c2 )
  45 {
  46         const authzid_conn_t *ac1 = (const authzid_conn_t *)c1;
  47         const authzid_conn_t *ac2 = (const authzid_conn_t *)c2;
  48
  49         return SLAP_PTRCMP( ac1->conn, ac2->conn );
  50 }
  51
  52 static int
  53 authzid_conn_dup( void *c1, void *c2 )
  54 {
  55         authzid_conn_t *ac1 = (authzid_conn_t *)c1;
  56         authzid_conn_t *ac2 = (authzid_conn_t *)c2;
  57
  58         if ( ac1->conn == ac2->conn ) {
  59                 return -1;
  60         }
  61
  62         return 0;
  63 }
  64
  65 static int authzid_cid;
  66 static slap_overinst authzid;
  67
  68 static authzid_conn_t *
  69 authzid_conn_find( Connection *c )
  70 {
  71         authzid_conn_t *ac = NULL, tmp = { 0 };
  72
  73         tmp.conn = c;
  74         ac = (authzid_conn_t *)avl_find( authzid_tree, (caddr_t)&tmp, authzid_conn_cmp );
  75         if ( ac == NULL || ( ac != NULL && ac->refcnt != 0 ) ) {
  76                 ac = NULL;
  77         }
  78         if ( ac ) {
  79                 ac->refcnt++;
  80         }
  81
  82         return ac;
  83 }
  84
  85 static authzid_conn_t *
  86 authzid_conn_get( Connection *c )
  87 {
  88         authzid_conn_t *ac = NULL;
  89
  90         ldap_pvt_thread_mutex_lock( &authzid_mutex );
  91         ac = authzid_conn_find( c );
  92         if ( ac && ac->refcnt ) ac = NULL;
  93         if ( ac ) ac->refcnt++;
  94         ldap_pvt_thread_mutex_unlock( &authzid_mutex );
  95
  96         return ac;
  97 }
  98
  99 static void
 100 authzid_conn_release( authzid_conn_t *ac )
 101 {
 102         ldap_pvt_thread_mutex_lock( &authzid_mutex );
 103         ac->refcnt--;
 104         ldap_pvt_thread_mutex_unlock( &authzid_mutex );
 105 }
 106
 107 static int
 108 authzid_conn_insert( Connection *c, char flag )
 109 {
 110         authzid_conn_t *ac;
 111         int rc;
 112
 113         ldap_pvt_thread_mutex_lock( &authzid_mutex );
 114         ac = authzid_conn_find( c );
 115         if ( ac ) {
 116                 ldap_pvt_thread_mutex_unlock( &authzid_mutex );
 117                 return -1;
 118         }
 119
 120         ac = SLAP_MALLOC( sizeof( authzid_conn_t ) );
 121         ac->conn = c;
 122         ac->refcnt = 0;
 123         ac->authzid_flag = flag;
 124         rc = avl_insert( &authzid_tree, (caddr_t)ac,
 125                 authzid_conn_cmp, authzid_conn_dup );
 126         ldap_pvt_thread_mutex_unlock( &authzid_mutex );
 127
 128         return rc;
 129 }
 130
 131 static int
 132 authzid_conn_remove( Connection *c )
 133 {
 134         authzid_conn_t *ac, *tmp;
 135
 136         ldap_pvt_thread_mutex_lock( &authzid_mutex );
 137         ac = authzid_conn_find( c );
 138         if ( !ac ) {
 139                 ldap_pvt_thread_mutex_unlock( &authzid_mutex );
 140                 return -1;
 141         }
 142         tmp = avl_delete( &authzid_tree, (caddr_t)ac, authzid_conn_cmp );
 143         ldap_pvt_thread_mutex_unlock( &authzid_mutex );
 144
 145         assert( tmp == ac );
 146         SLAP_FREE( ac );
 147
 148         return 0;
 149 }
 150
 151 static int
 152 authzid_response(
 153         Operation *op,
 154         SlapReply *rs )
 155 {
 156         LDAPControl **ctrls;
 157         struct berval edn = BER_BVNULL;
 158         ber_len_t len = 0;
 159         int n = 0;
 160
 161         assert( rs->sr_tag = LDAP_RES_BIND );
 162
 163         if ( rs->sr_err == LDAP_SASL_BIND_IN_PROGRESS ) {
 164                 authzid_conn_t *ac = op->o_controls[ authzid_cid ];
 165                 if ( ac ) {
 166                         authzid_conn_release( ac );
 167                 } else {
 168                         (void)authzid_conn_insert( op->o_conn, op->o_ctrlflag[ authzid_cid ] );
 169                 }
 170                 return SLAP_CB_CONTINUE;
 171         }
 172
 173         (void)authzid_conn_remove( op->o_conn );
 174
 175         if ( rs->sr_err != LDAP_SUCCESS ) {
 176                 return SLAP_CB_CONTINUE;
 177         }
 178
 179         if ( !BER_BVISEMPTY( &op->orb_edn ) ) {
 180                 edn = op->orb_edn;
 181
 182         } else if ( !BER_BVISEMPTY( &op->o_conn->c_dn ) ) {
 183                 edn = op->o_conn->c_dn;
 184         }
 185
 186         if ( !BER_BVISEMPTY( &edn ) ) {
 187                 ber_tag_t save_tag = op->o_tag;
 188                 struct berval save_dn = op->o_dn;
 189                 struct berval save_ndn = op->o_ndn;
 190                 int rc;
 191
 192                 /* pretend it's an extop without data,
 193                  * so it is treated as a generic write
 194                  */
 195                 op->o_tag = LDAP_REQ_EXTENDED;
 196                 op->o_dn = edn;
 197                 op->o_ndn = edn;
 198                 rc = backend_check_restrictions( op, rs, NULL );
 199                 op->o_tag = save_tag;
 200                 op->o_dn = save_dn;
 201                 op->o_ndn = save_ndn;
 202                 if ( rc != LDAP_SUCCESS ) {
 203                         rs->sr_err = LDAP_CONFIDENTIALITY_REQUIRED;
 204                         return SLAP_CB_CONTINUE;
 205                 }
 206
 207                 len = STRLENOF("dn:") + edn.bv_len;
 208         }
 209
 210         /* save original controls in sc_private;
 211          * will be restored by sc_cleanup
 212          */
 213         if ( rs->sr_ctrls != NULL ) {
 214                 op->o_callback->sc_private = rs->sr_ctrls;
 215                 for ( ; rs->sr_ctrls[n] != NULL; n++ )
 216                         ;
 217         }
 218
 219         ctrls = op->o_tmpalloc( sizeof( LDAPControl * )*( n + 2 ), op->o_tmpmemctx );
 220         n = 0;
 221         if ( rs->sr_ctrls ) {
 222                 for ( ; rs->sr_ctrls[n] != NULL; n++ ) {
 223                         ctrls[n] = rs->sr_ctrls[n];
 224                 }
 225         }
 226
 227         /* anonymous: "", otherwise "dn:<dn>" */
 228         ctrls[n] = op->o_tmpalloc( sizeof( LDAPControl ) + len + 1, op->o_tmpmemctx );
 229         ctrls[n]->ldctl_oid = LDAP_CONTROL_AUTHZID_RESPONSE;
 230         ctrls[n]->ldctl_iscritical = 0;
 231         ctrls[n]->ldctl_value.bv_len = len;
 232         ctrls[n]->ldctl_value.bv_val = (char *)&ctrls[n][1];
 233         if ( len ) {
 234                 char *ptr;
 235
 236                 ptr = lutil_strcopy( ctrls[n]->ldctl_value.bv_val, "dn:" );
 237                 ptr = lutil_strncopy( ptr, edn.bv_val, edn.bv_len );
 238         }
 239         ctrls[n]->ldctl_value.bv_val[len] = '\0';
 240         ctrls[n + 1] = NULL;
 241
 242         rs->sr_ctrls = ctrls;
 243
 244         return SLAP_CB_CONTINUE;
 245 }
 246
 247 static int
 248 authzid_cleanup(
 249         Operation *op,
 250         SlapReply *rs )
 251 {
 252         if ( rs->sr_ctrls ) {
 253                 LDAPControl *ctrl;
 254
 255                 /* if ours, cleanup */
 256                 ctrl = ldap_control_find( LDAP_CONTROL_AUTHZID_RESPONSE, rs->sr_ctrls, NULL );
 257                 if ( ctrl ) {
 258                         op->o_tmpfree( rs->sr_ctrls, op->o_tmpmemctx );
 259                         rs->sr_ctrls = NULL;
 260                 }
 261
 262                 if ( op->o_callback->sc_private != NULL ) {
 263                         rs->sr_ctrls = (LDAPControl **)op->o_callback->sc_private;
 264                         op->o_callback->sc_private = NULL;
 265                 }
 266         }
 267
 268         op->o_tmpfree( op->o_callback, op->o_tmpmemctx );
 269         op->o_callback = NULL;
 270
 271         return SLAP_CB_CONTINUE;
 272 }
 273
 274 static int
 275 authzid_op_bind(
 276         Operation *op,
 277         SlapReply *rs )
 278 {
 279         slap_callback *sc;
 280
 281         if ( op->o_ctrlflag[ authzid_cid ] <= SLAP_CONTROL_IGNORED ) {
 282                 authzid_conn_t *ac = authzid_conn_get( op->o_conn );
 283                 if ( ac ) {
 284                         op->o_ctrlflag[ authzid_cid ] = ac->authzid_flag;
 285                         op->o_controls[ authzid_cid] = ac;
 286                 }
 287         }
 288
 289         if ( op->o_ctrlflag[ authzid_cid ] > SLAP_CONTROL_IGNORED ) {
 290                 sc = op->o_callback;
 291                 op->o_callback = op->o_tmpalloc( sizeof( slap_callback ), op->o_tmpmemctx );
 292                 op->o_callback->sc_response = authzid_response;
 293                 op->o_callback->sc_cleanup = authzid_cleanup;
 294                 op->o_callback->sc_private = NULL;
 295                 op->o_callback->sc_writewait = NULL;
 296                 op->o_callback->sc_next = sc;
 297         }
 298
 299         return SLAP_CB_CONTINUE;
 300 }
 301
 302 static int
 303 parse_authzid_ctrl(
 304         Operation       *op,
 305         SlapReply       *rs,
 306         LDAPControl     *ctrl )
 307 {
 308         if ( op->o_ctrlflag[ authzid_cid ] != SLAP_CONTROL_NONE ) {
 309                 rs->sr_text = "authzid control specified multiple times";
 310                 return LDAP_PROTOCOL_ERROR;
 311         }
 312
 313         if ( !BER_BVISNULL( &ctrl->ldctl_value ) ) {
 314                 rs->sr_text = "authzid control value not absent";
 315                 return LDAP_PROTOCOL_ERROR;
 316         }
 317
 318         /* drop ongoing requests */
 319         (void)authzid_conn_remove( op->o_conn );
 320
 321         op->o_ctrlflag[ authzid_cid ] = ctrl->ldctl_iscritical ?  SLAP_CONTROL_CRITICAL : SLAP_CONTROL_NONCRITICAL;
 322
 323         return LDAP_SUCCESS;
 324 }
 325
 326 static int
 327 authzid_db_init( BackendDB *be, ConfigReply *cr )
 328 {
 329         if ( !SLAP_ISGLOBALOVERLAY( be ) ) {
 330                 /* do not allow slapo-ppolicy to be global by now (ITS#5858) */
 331                 if ( cr ) {
 332                         snprintf( cr->msg, sizeof(cr->msg),
 333                                 "slapo-authzid must be global" );
 334                         Debug( LDAP_DEBUG_ANY, "%s\n", cr->msg, 0, 0 );
 335                 }
 336                 return 1;
 337         }
 338
 339         int rc;
 340
 341         rc = register_supported_control( LDAP_CONTROL_AUTHZID_REQUEST,
 342                 SLAP_CTRL_GLOBAL|SLAP_CTRL_BIND|SLAP_CTRL_HIDE, NULL,
 343                 parse_authzid_ctrl, &authzid_cid );
 344         if ( rc != LDAP_SUCCESS ) {
 345                 Debug( LDAP_DEBUG_ANY,
 346                         "authzid_initialize: Failed to register control '%s' (%d)\n",
 347                         LDAP_CONTROL_AUTHZID_REQUEST, rc, 0 );
 348                 return rc;
 349         }
 350
 351         return LDAP_SUCCESS;
 352 }
 353
 354 /*
 355  * Almost pointless, by now, since this overlay needs to be global,
 356  * and global overlays deletion is not supported yet.
 357  */
 358 static int
 359 authzid_db_destroy( BackendDB *be, ConfigReply *cr )
 360 {
 361 #ifdef SLAP_CONFIG_DELETE
 362         overlay_unregister_control( be, LDAP_CONTROL_AUTHZID_REQUEST );
 363 #endif /* SLAP_CONFIG_DELETE */
 364
 365         unregister_supported_control( LDAP_CONTROL_AUTHZID_REQUEST );
 366
 367         return 0;
 368 }
 369
 370 static int
 371 authzid_initialize( void )
 372 {
 373         ldap_pvt_thread_mutex_init( &authzid_mutex );
 374
 375         authzid.on_bi.bi_type = "authzid";
 376
 377         authzid.on_bi.bi_db_init = authzid_db_init;
 378         authzid.on_bi.bi_db_destroy = authzid_db_destroy;
 379         authzid.on_bi.bi_op_bind = authzid_op_bind;
 380
 381         return overlay_register( &authzid );
 382 }
 383
 384 int
 385 init_module( int argc, char *argv[] )
 386 {
 387         return authzid_initialize();
 388 }
 389