git.sur5r.net Git - openldap/blob - servers/slapd/overlays/ppolicy.c

   1 /* $OpenLDAP$ */
   2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   3  *
   4  * Copyright 2004-2015 The OpenLDAP Foundation.
   5  * Portions Copyright 2004-2005 Howard Chu, Symas Corporation.
   6  * Portions Copyright 2004 Hewlett-Packard Company.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted only as authorized by the OpenLDAP
  11  * Public License.
  12  *
  13  * A copy of this license is available in the file LICENSE in the
  14  * top-level directory of the distribution or, alternatively, at
  15  * <http://www.OpenLDAP.org/license.html>.
  16  */
  17 /* ACKNOWLEDGEMENTS:
  18  * This work was developed by Howard Chu for inclusion in
  19  * OpenLDAP Software, based on prior work by Neil Dunbar (HP).
  20  * This work was sponsored by the Hewlett-Packard Company.
  21  */
  22
  23 #include "portable.h"
  24
  25 /* This file implements "Password Policy for LDAP Directories",
  26  * based on draft behera-ldap-password-policy-09
  27  */
  28
  29 #ifdef SLAPD_OVER_PPOLICY
  30
  31 #include <ldap.h>
  32 #include "lutil.h"
  33 #include "slap.h"
  34 #ifdef SLAPD_MODULES
  35 #define LIBLTDL_DLL_IMPORT      /* Win32: don't re-export libltdl's symbols */
  36 #include <ltdl.h>
  37 #endif
  38 #include <ac/errno.h>
  39 #include <ac/time.h>
  40 #include <ac/string.h>
  41 #include <ac/ctype.h>
  42 #include "config.h"
  43
  44 #ifndef MODULE_NAME_SZ
  45 #define MODULE_NAME_SZ 256
  46 #endif
  47
  48 /* Per-instance configuration information */
  49 typedef struct pp_info {
  50         struct berval def_policy;       /* DN of default policy subentry */
  51         int use_lockout;                /* send AccountLocked result? */
  52         int hash_passwords;             /* transparently hash cleartext pwds */
  53         int forward_updates;    /* use frontend for policy state updates */
  54 } pp_info;
  55
  56 /* Our per-connection info - note, it is not per-instance, it is
  57  * used by all instances
  58  */
  59 typedef struct pw_conn {
  60         struct berval dn;       /* DN of restricted user */
  61 } pw_conn;
  62
  63 static pw_conn *pwcons;
  64 static int ppolicy_cid;
  65 static int ov_count;
  66
  67 typedef struct pass_policy {
  68         AttributeDescription *ad; /* attribute to which the policy applies */
  69         int pwdMinAge; /* minimum time (seconds) until passwd can change */
  70         int pwdMaxAge; /* time in seconds until pwd will expire after change */
  71         int pwdInHistory; /* number of previous passwords kept */
  72         int pwdCheckQuality; /* 0 = don't check quality, 1 = check if possible,
  73                                                    2 = check mandatory; fail if not possible */
  74         int pwdMinLength; /* minimum number of chars in password */
  75         int pwdExpireWarning; /* number of seconds that warning controls are
  76                                                         sent before a password expires */
  77         int pwdGraceAuthNLimit; /* number of times you can log in with an
  78                                                         expired password */
  79         int pwdLockout; /* 0 = do not lockout passwords, 1 = lock them out */
  80         int pwdLockoutDuration; /* time in seconds a password is locked out for */
  81         int pwdMaxFailure; /* number of failed binds allowed before lockout */
  82         int pwdFailureCountInterval; /* number of seconds before failure
  83                                                                         counts are zeroed */
  84         int pwdMustChange; /* 0 = users can use admin set password
  85                                                         1 = users must change password after admin set */
  86         int pwdAllowUserChange; /* 0 = users cannot change their passwords
  87                                                                 1 = users can change them */
  88         int pwdSafeModify; /* 0 = old password doesn't need to come
  89                                                                 with password change request
  90                                                         1 = password change must supply existing pwd */
  91         char pwdCheckModule[MODULE_NAME_SZ]; /* name of module to dynamically
  92                                                                                     load to check password */
  93 } PassPolicy;
  94
  95 typedef struct pw_hist {
  96         time_t t;       /* timestamp of history entry */
  97         struct berval pw;       /* old password hash */
  98         struct berval bv;       /* text of entire entry */
  99         struct pw_hist *next;
 100 } pw_hist;
 101
 102 /* Operational attributes */
 103 static AttributeDescription *ad_pwdChangedTime, *ad_pwdAccountLockedTime,
 104         *ad_pwdFailureTime, *ad_pwdHistory, *ad_pwdGraceUseTime, *ad_pwdReset,
 105         *ad_pwdPolicySubentry;
 106
 107 static struct schema_info {
 108         char *def;
 109         AttributeDescription **ad;
 110 } pwd_OpSchema[] = {
 111         {       "( 1.3.6.1.4.1.42.2.27.8.1.16 "
 112                 "NAME ( 'pwdChangedTime' ) "
 113                 "DESC 'The time the password was last changed' "
 114                 "EQUALITY generalizedTimeMatch "
 115                 "ORDERING generalizedTimeOrderingMatch "
 116                 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 "
 117                 "SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )",
 118                 &ad_pwdChangedTime },
 119         {       "( 1.3.6.1.4.1.42.2.27.8.1.17 "
 120                 "NAME ( 'pwdAccountLockedTime' ) "
 121                 "DESC 'The time an user account was locked' "
 122                 "EQUALITY generalizedTimeMatch "
 123                 "ORDERING generalizedTimeOrderingMatch "
 124                 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 "
 125                 "SINGLE-VALUE "
 126 #if 0
 127                 /* Not until Relax control is released */
 128                 "NO-USER-MODIFICATION "
 129 #endif
 130                 "USAGE directoryOperation )",
 131                 &ad_pwdAccountLockedTime },
 132         {       "( 1.3.6.1.4.1.42.2.27.8.1.19 "
 133                 "NAME ( 'pwdFailureTime' ) "
 134                 "DESC 'The timestamps of the last consecutive authentication failures' "
 135                 "EQUALITY generalizedTimeMatch "
 136                 "ORDERING generalizedTimeOrderingMatch "
 137                 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 "
 138                 "NO-USER-MODIFICATION USAGE directoryOperation )",
 139                 &ad_pwdFailureTime },
 140         {       "( 1.3.6.1.4.1.42.2.27.8.1.20 "
 141                 "NAME ( 'pwdHistory' ) "
 142                 "DESC 'The history of users passwords' "
 143                 "EQUALITY octetStringMatch "
 144                 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 "
 145                 "NO-USER-MODIFICATION USAGE directoryOperation )",
 146                 &ad_pwdHistory },
 147         {       "( 1.3.6.1.4.1.42.2.27.8.1.21 "
 148                 "NAME ( 'pwdGraceUseTime' ) "
 149                 "DESC 'The timestamps of the grace login once the password has expired' "
 150                 "EQUALITY generalizedTimeMatch "
 151                 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 "
 152                 "NO-USER-MODIFICATION USAGE directoryOperation )",
 153                 &ad_pwdGraceUseTime },
 154         {       "( 1.3.6.1.4.1.42.2.27.8.1.22 "
 155                 "NAME ( 'pwdReset' ) "
 156                 "DESC 'The indication that the password has been reset' "
 157                 "EQUALITY booleanMatch "
 158                 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 "
 159                 "SINGLE-VALUE USAGE directoryOperation )",
 160                 &ad_pwdReset },
 161         {       "( 1.3.6.1.4.1.42.2.27.8.1.23 "
 162                 "NAME ( 'pwdPolicySubentry' ) "
 163                 "DESC 'The pwdPolicy subentry in effect for this object' "
 164                 "EQUALITY distinguishedNameMatch "
 165                 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 "
 166                 "SINGLE-VALUE "
 167 #if 0
 168                 /* Not until Relax control is released */
 169                 "NO-USER-MODIFICATION "
 170 #endif
 171                 "USAGE directoryOperation )",
 172                 &ad_pwdPolicySubentry },
 173         { NULL, NULL }
 174 };
 175
 176 /* User attributes */
 177 static AttributeDescription *ad_pwdMinAge, *ad_pwdMaxAge, *ad_pwdInHistory,
 178         *ad_pwdCheckQuality, *ad_pwdMinLength, *ad_pwdMaxFailure,
 179         *ad_pwdGraceAuthNLimit, *ad_pwdExpireWarning, *ad_pwdLockoutDuration,
 180         *ad_pwdFailureCountInterval, *ad_pwdCheckModule, *ad_pwdLockout,
 181         *ad_pwdMustChange, *ad_pwdAllowUserChange, *ad_pwdSafeModify,
 182         *ad_pwdAttribute;
 183
 184 #define TAB(name)       { #name, &ad_##name }
 185
 186 static struct schema_info pwd_UsSchema[] = {
 187         TAB(pwdAttribute),
 188         TAB(pwdMinAge),
 189         TAB(pwdMaxAge),
 190         TAB(pwdInHistory),
 191         TAB(pwdCheckQuality),
 192         TAB(pwdMinLength),
 193         TAB(pwdMaxFailure),
 194         TAB(pwdGraceAuthNLimit),
 195         TAB(pwdExpireWarning),
 196         TAB(pwdLockout),
 197         TAB(pwdLockoutDuration),
 198         TAB(pwdFailureCountInterval),
 199         TAB(pwdCheckModule),
 200         TAB(pwdMustChange),
 201         TAB(pwdAllowUserChange),
 202         TAB(pwdSafeModify),
 203         { NULL, NULL }
 204 };
 205
 206 static ldap_pvt_thread_mutex_t chk_syntax_mutex;
 207
 208 enum {
 209         PPOLICY_DEFAULT = 1,
 210         PPOLICY_HASH_CLEARTEXT,
 211         PPOLICY_USE_LOCKOUT
 212 };
 213
 214 static ConfigDriver ppolicy_cf_default;
 215
 216 static ConfigTable ppolicycfg[] = {
 217         { "ppolicy_default", "policyDN", 2, 2, 0,
 218           ARG_DN|ARG_QUOTE|ARG_MAGIC|PPOLICY_DEFAULT, ppolicy_cf_default,
 219           "( OLcfgOvAt:12.1 NAME 'olcPPolicyDefault' "
 220           "DESC 'DN of a pwdPolicy object for uncustomized objects' "
 221           "SYNTAX OMsDN SINGLE-VALUE )", NULL, NULL },
 222         { "ppolicy_hash_cleartext", "on|off", 1, 2, 0,
 223           ARG_ON_OFF|ARG_OFFSET|PPOLICY_HASH_CLEARTEXT,
 224           (void *)offsetof(pp_info,hash_passwords),
 225           "( OLcfgOvAt:12.2 NAME 'olcPPolicyHashCleartext' "
 226           "DESC 'Hash passwords on add or modify' "
 227           "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
 228         { "ppolicy_forward_updates", "on|off", 1, 2, 0,
 229           ARG_ON_OFF|ARG_OFFSET,
 230           (void *)offsetof(pp_info,forward_updates),
 231           "( OLcfgOvAt:12.4 NAME 'olcPPolicyForwardUpdates' "
 232           "DESC 'Allow policy state updates to be forwarded via updateref' "
 233           "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
 234         { "ppolicy_use_lockout", "on|off", 1, 2, 0,
 235           ARG_ON_OFF|ARG_OFFSET|PPOLICY_USE_LOCKOUT,
 236           (void *)offsetof(pp_info,use_lockout),
 237           "( OLcfgOvAt:12.3 NAME 'olcPPolicyUseLockout' "
 238           "DESC 'Warn clients with AccountLocked' "
 239           "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
 240         { NULL, NULL, 0, 0, 0, ARG_IGNORED }
 241 };
 242
 243 static ConfigOCs ppolicyocs[] = {
 244         { "( OLcfgOvOc:12.1 "
 245           "NAME 'olcPPolicyConfig' "
 246           "DESC 'Password Policy configuration' "
 247           "SUP olcOverlayConfig "
 248           "MAY ( olcPPolicyDefault $ olcPPolicyHashCleartext $ "
 249           "olcPPolicyUseLockout $ olcPPolicyForwardUpdates ) )",
 250           Cft_Overlay, ppolicycfg },
 251         { NULL, 0, NULL }
 252 };
 253
 254 static int
 255 ppolicy_cf_default( ConfigArgs *c )
 256 {
 257         slap_overinst *on = (slap_overinst *)c->bi;
 258         pp_info *pi = (pp_info *)on->on_bi.bi_private;
 259         int rc = ARG_BAD_CONF;
 260
 261         assert ( c->type == PPOLICY_DEFAULT );
 262         Debug(LDAP_DEBUG_TRACE, "==> ppolicy_cf_default\n", 0, 0, 0);
 263
 264         switch ( c->op ) {
 265         case SLAP_CONFIG_EMIT:
 266                 Debug(LDAP_DEBUG_TRACE, "==> ppolicy_cf_default emit\n", 0, 0, 0);
 267                 rc = 0;
 268                 if ( !BER_BVISEMPTY( &pi->def_policy )) {
 269                         rc = value_add_one( &c->rvalue_vals,
 270                                             &pi->def_policy );
 271                         if ( rc ) return rc;
 272                         rc = value_add_one( &c->rvalue_nvals,
 273                                             &pi->def_policy );
 274                 }
 275                 break;
 276         case LDAP_MOD_DELETE:
 277                 Debug(LDAP_DEBUG_TRACE, "==> ppolicy_cf_default delete\n", 0, 0, 0);
 278                 if ( pi->def_policy.bv_val ) {
 279                         ber_memfree ( pi->def_policy.bv_val );
 280                         pi->def_policy.bv_val = NULL;
 281                 }
 282                 pi->def_policy.bv_len = 0;
 283                 rc = 0;
 284                 break;
 285         case SLAP_CONFIG_ADD:
 286                 /* fallthrough to LDAP_MOD_ADD */
 287         case LDAP_MOD_ADD:
 288                 Debug(LDAP_DEBUG_TRACE, "==> ppolicy_cf_default add\n", 0, 0, 0);
 289                 if ( pi->def_policy.bv_val ) {
 290                         ber_memfree ( pi->def_policy.bv_val );
 291                 }
 292                 pi->def_policy = c->value_ndn;
 293                 ber_memfree( c->value_dn.bv_val );
 294                 BER_BVZERO( &c->value_dn );
 295                 BER_BVZERO( &c->value_ndn );
 296                 rc = 0;
 297                 break;
 298         default:
 299                 abort ();
 300         }
 301
 302         return rc;
 303 }
 304
 305 static time_t
 306 parse_time( char *atm )
 307 {
 308         struct lutil_tm tm;
 309         struct lutil_timet tt;
 310         time_t ret = (time_t)-1;
 311
 312         if ( lutil_parsetime( atm, &tm ) == 0) {
 313                 lutil_tm2time( &tm, &tt );
 314                 ret = tt.tt_sec;
 315         }
 316         return ret;
 317 }
 318
 319 static int
 320 account_locked( Operation *op, Entry *e,
 321                 PassPolicy *pp, Modifications **mod )
 322 {
 323         Attribute       *la;
 324
 325         assert(mod != NULL);
 326
 327         if ( !pp->pwdLockout )
 328                 return 0;
 329
 330         if ( (la = attr_find( e->e_attrs, ad_pwdAccountLockedTime )) != NULL ) {
 331                 BerVarray vals = la->a_nvals;
 332
 333                 /*
 334                  * there is a lockout stamp - we now need to know if it's
 335                  * a valid one.
 336                  */
 337                 if (vals[0].bv_val != NULL) {
 338                         time_t then, now;
 339                         Modifications *m;
 340
 341                         if ((then = parse_time( vals[0].bv_val )) == (time_t)0)
 342                                 return 1;
 343
 344                         now = slap_get_time();
 345
 346                         /* Still in the future? not yet in effect */
 347                         if (now < then)
 348                                 return 0;
 349
 350                         if (!pp->pwdLockoutDuration)
 351                                 return 1;
 352
 353                         if (now < then + pp->pwdLockoutDuration)
 354                                 return 1;
 355
 356                         m = ch_calloc( sizeof(Modifications), 1 );
 357                         m->sml_op = LDAP_MOD_DELETE;
 358                         m->sml_flags = 0;
 359                         m->sml_type = ad_pwdAccountLockedTime->ad_cname;
 360                         m->sml_desc = ad_pwdAccountLockedTime;
 361                         m->sml_next = *mod;
 362                         *mod = m;
 363                 }
 364         }
 365
 366         return 0;
 367 }
 368
 369 /* IMPLICIT TAGS, all context-specific */
 370 #define PPOLICY_WARNING 0xa0L   /* constructed + 0 */
 371 #define PPOLICY_ERROR 0x81L             /* primitive + 1 */
 372
 373 #define PPOLICY_EXPIRE 0x80L    /* primitive + 0 */
 374 #define PPOLICY_GRACE  0x81L    /* primitive + 1 */
 375
 376 static const char ppolicy_ctrl_oid[] = LDAP_CONTROL_PASSWORDPOLICYRESPONSE;
 377
 378 static LDAPControl *
 379 create_passcontrol( Operation *op, int exptime, int grace, LDAPPasswordPolicyError err )
 380 {
 381         BerElementBuffer berbuf, bb2;
 382         BerElement *ber = (BerElement *) &berbuf, *b2 = (BerElement *) &bb2;
 383         LDAPControl c = { 0 }, *cp;
 384         struct berval bv;
 385         int rc;
 386
 387         BER_BVZERO( &c.ldctl_value );
 388
 389         ber_init2( ber, NULL, LBER_USE_DER );
 390         ber_printf( ber, "{" /*}*/ );
 391
 392         if ( exptime >= 0 ) {
 393                 ber_init2( b2, NULL, LBER_USE_DER );
 394                 ber_printf( b2, "ti", PPOLICY_EXPIRE, exptime );
 395                 rc = ber_flatten2( b2, &bv, 1 );
 396                 (void)ber_free_buf(b2);
 397                 if (rc == -1) {
 398                         cp = NULL;
 399                         goto fail;
 400                 }
 401                 ber_printf( ber, "tO", PPOLICY_WARNING, &bv );
 402                 ch_free( bv.bv_val );
 403         } else if ( grace > 0 ) {
 404                 ber_init2( b2, NULL, LBER_USE_DER );
 405                 ber_printf( b2, "ti", PPOLICY_GRACE, grace );
 406                 rc = ber_flatten2( b2, &bv, 1 );
 407                 (void)ber_free_buf(b2);
 408                 if (rc == -1) {
 409                         cp = NULL;
 410                         goto fail;
 411                 }
 412                 ber_printf( ber, "tO", PPOLICY_WARNING, &bv );
 413                 ch_free( bv.bv_val );
 414         }
 415
 416         if (err != PP_noError ) {
 417                 ber_printf( ber, "te", PPOLICY_ERROR, err );
 418         }
 419         ber_printf( ber, /*{*/ "N}" );
 420
 421         if (ber_flatten2( ber, &c.ldctl_value, 0 ) == -1) {
 422                 return NULL;
 423         }
 424         cp = op->o_tmpalloc( sizeof( LDAPControl ) + c.ldctl_value.bv_len, op->o_tmpmemctx );
 425         cp->ldctl_oid = (char *)ppolicy_ctrl_oid;
 426         cp->ldctl_iscritical = 0;
 427         cp->ldctl_value.bv_val = (char *)&cp[1];
 428         cp->ldctl_value.bv_len = c.ldctl_value.bv_len;
 429         AC_MEMCPY( cp->ldctl_value.bv_val, c.ldctl_value.bv_val, c.ldctl_value.bv_len );
 430 fail:
 431         (void)ber_free_buf(ber);
 432
 433         return cp;
 434 }
 435
 436 static LDAPControl **
 437 add_passcontrol( Operation *op, SlapReply *rs, LDAPControl *ctrl )
 438 {
 439         LDAPControl **ctrls, **oldctrls = rs->sr_ctrls;
 440         int n;
 441
 442         n = 0;
 443         if ( oldctrls ) {
 444                 for ( ; oldctrls[n]; n++ )
 445                         ;
 446         }
 447         n += 2;
 448
 449         ctrls = op->o_tmpcalloc( sizeof( LDAPControl * ), n, op->o_tmpmemctx );
 450
 451         n = 0;
 452         if ( oldctrls ) {
 453                 for ( ; oldctrls[n]; n++ ) {
 454                         ctrls[n] = oldctrls[n];
 455                 }
 456         }
 457         ctrls[n] = ctrl;
 458         ctrls[n+1] = NULL;
 459
 460         rs->sr_ctrls = ctrls;
 461
 462         return oldctrls;
 463 }
 464
 465 static void
 466 ppolicy_get( Operation *op, Entry *e, PassPolicy *pp )
 467 {
 468         slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
 469         pp_info *pi = on->on_bi.bi_private;
 470         Attribute *a;
 471         BerVarray vals;
 472         int rc;
 473         Entry *pe = NULL;
 474 #if 0
 475         const char *text;
 476 #endif
 477
 478         memset( pp, 0, sizeof(PassPolicy) );
 479
 480         pp->ad = slap_schema.si_ad_userPassword;
 481
 482         /* Users can change their own password by default */
 483         pp->pwdAllowUserChange = 1;
 484
 485         if ((a = attr_find( e->e_attrs, ad_pwdPolicySubentry )) == NULL) {
 486                 /*
 487                  * entry has no password policy assigned - use default
 488                  */
 489                 vals = &pi->def_policy;
 490                 if ( !vals->bv_val )
 491                         goto defaultpol;
 492         } else {
 493                 vals = a->a_nvals;
 494                 if (vals[0].bv_val == NULL) {
 495                         Debug( LDAP_DEBUG_ANY,
 496                                 "ppolicy_get: NULL value for policySubEntry\n", 0, 0, 0 );
 497                         goto defaultpol;
 498                 }
 499         }
 500
 501         op->o_bd->bd_info = (BackendInfo *)on->on_info;
 502         rc = be_entry_get_rw( op, vals, NULL, NULL, 0, &pe );
 503         op->o_bd->bd_info = (BackendInfo *)on;
 504
 505         if ( rc ) goto defaultpol;
 506
 507 #if 0   /* Only worry about userPassword for now */
 508         if ((a = attr_find( pe->e_attrs, ad_pwdAttribute )))
 509                 slap_bv2ad( &a->a_vals[0], &pp->ad, &text );
 510 #endif
 511
 512         if ( ( a = attr_find( pe->e_attrs, ad_pwdMinAge ) )
 513                         && lutil_atoi( &pp->pwdMinAge, a->a_vals[0].bv_val ) != 0 )
 514                 goto defaultpol;
 515         if ( ( a = attr_find( pe->e_attrs, ad_pwdMaxAge ) )
 516                         && lutil_atoi( &pp->pwdMaxAge, a->a_vals[0].bv_val ) != 0 )
 517                 goto defaultpol;
 518         if ( ( a = attr_find( pe->e_attrs, ad_pwdInHistory ) )
 519                         && lutil_atoi( &pp->pwdInHistory, a->a_vals[0].bv_val ) != 0 )
 520                 goto defaultpol;
 521         if ( ( a = attr_find( pe->e_attrs, ad_pwdCheckQuality ) )
 522                         && lutil_atoi( &pp->pwdCheckQuality, a->a_vals[0].bv_val ) != 0 )
 523                 goto defaultpol;
 524         if ( ( a = attr_find( pe->e_attrs, ad_pwdMinLength ) )
 525                         && lutil_atoi( &pp->pwdMinLength, a->a_vals[0].bv_val ) != 0 )
 526                 goto defaultpol;
 527         if ( ( a = attr_find( pe->e_attrs, ad_pwdMaxFailure ) )
 528                         && lutil_atoi( &pp->pwdMaxFailure, a->a_vals[0].bv_val ) != 0 )
 529                 goto defaultpol;
 530         if ( ( a = attr_find( pe->e_attrs, ad_pwdGraceAuthNLimit ) )
 531                         && lutil_atoi( &pp->pwdGraceAuthNLimit, a->a_vals[0].bv_val ) != 0 )
 532                 goto defaultpol;
 533         if ( ( a = attr_find( pe->e_attrs, ad_pwdExpireWarning ) )
 534                         && lutil_atoi( &pp->pwdExpireWarning, a->a_vals[0].bv_val ) != 0 )
 535                 goto defaultpol;
 536         if ( ( a = attr_find( pe->e_attrs, ad_pwdFailureCountInterval ) )
 537                         && lutil_atoi( &pp->pwdFailureCountInterval, a->a_vals[0].bv_val ) != 0 )
 538                 goto defaultpol;
 539         if ( ( a = attr_find( pe->e_attrs, ad_pwdLockoutDuration ) )
 540                         && lutil_atoi( &pp->pwdLockoutDuration, a->a_vals[0].bv_val ) != 0 )
 541                 goto defaultpol;
 542
 543         if ( ( a = attr_find( pe->e_attrs, ad_pwdCheckModule ) ) ) {
 544                 strncpy( pp->pwdCheckModule, a->a_vals[0].bv_val,
 545                         sizeof(pp->pwdCheckModule) );
 546                 pp->pwdCheckModule[sizeof(pp->pwdCheckModule)-1] = '\0';
 547         }
 548
 549         if ((a = attr_find( pe->e_attrs, ad_pwdLockout )))
 550                 pp->pwdLockout = bvmatch( &a->a_nvals[0], &slap_true_bv );
 551         if ((a = attr_find( pe->e_attrs, ad_pwdMustChange )))
 552                 pp->pwdMustChange = bvmatch( &a->a_nvals[0], &slap_true_bv );
 553         if ((a = attr_find( pe->e_attrs, ad_pwdAllowUserChange )))
 554                 pp->pwdAllowUserChange = bvmatch( &a->a_nvals[0], &slap_true_bv );
 555         if ((a = attr_find( pe->e_attrs, ad_pwdSafeModify )))
 556                 pp->pwdSafeModify = bvmatch( &a->a_nvals[0], &slap_true_bv );
 557
 558         op->o_bd->bd_info = (BackendInfo *)on->on_info;
 559         be_entry_release_r( op, pe );
 560         op->o_bd->bd_info = (BackendInfo *)on;
 561
 562         return;
 563
 564 defaultpol:
 565         Debug( LDAP_DEBUG_TRACE,
 566                 "ppolicy_get: using default policy\n", 0, 0, 0 );
 567         return;
 568 }
 569
 570 static int
 571 password_scheme( struct berval *cred, struct berval *sch )
 572 {
 573         int e;
 574
 575         assert( cred != NULL );
 576
 577         if (sch) {
 578                 sch->bv_val = NULL;
 579                 sch->bv_len = 0;
 580         }
 581
 582         if ((cred->bv_len == 0) || (cred->bv_val == NULL) ||
 583                 (cred->bv_val[0] != '{')) return LDAP_OTHER;
 584
 585         for(e = 1; cred->bv_val[e] && cred->bv_val[e] != '}'; e++);
 586         if (cred->bv_val[e]) {
 587                 int rc;
 588                 rc = lutil_passwd_scheme( cred->bv_val );
 589                 if (rc) {
 590                         if (sch) {
 591                                 sch->bv_val = cred->bv_val;
 592                                 sch->bv_len = e;
 593                         }
 594                         return LDAP_SUCCESS;
 595                 }
 596         }
 597         return LDAP_OTHER;
 598 }
 599
 600 static int
 601 check_password_quality( struct berval *cred, PassPolicy *pp, LDAPPasswordPolicyError *err, Entry *e, char **txt )
 602 {
 603         int rc = LDAP_SUCCESS, ok = LDAP_SUCCESS;
 604         char *ptr;
 605         struct berval sch;
 606
 607         assert( cred != NULL );
 608         assert( pp != NULL );
 609         assert( txt != NULL );
 610
 611         ptr = cred->bv_val;
 612
 613         *txt = NULL;
 614
 615         if ((cred->bv_len == 0) || (pp->pwdMinLength > cred->bv_len)) {
 616                 rc = LDAP_CONSTRAINT_VIOLATION;
 617                 if ( err ) *err = PP_passwordTooShort;
 618                 return rc;
 619         }
 620
 621         /*
 622          * We need to know if the password is already hashed - if so
 623          * what scheme is it. The reason being that the "hash" of
 624          * {cleartext} still allows us to check the password.
 625          */
 626         rc = password_scheme( cred, &sch );
 627         if (rc == LDAP_SUCCESS) {
 628                 if ((sch.bv_val) && (strncasecmp( sch.bv_val, "{cleartext}",
 629                         sch.bv_len ) == 0)) {
 630                         /*
 631                          * We can check the cleartext "hash"
 632                          */
 633                         ptr = cred->bv_val + sch.bv_len;
 634                 } else {
 635                         /* everything else, we can't check */
 636                         if (pp->pwdCheckQuality == 2) {
 637                                 rc = LDAP_CONSTRAINT_VIOLATION;
 638                                 if (err) *err = PP_insufficientPasswordQuality;
 639                                 return rc;
 640                         }
 641                         /*
 642                          * We can't check the syntax of the password, but it's not
 643                          * mandatory (according to the policy), so we return success.
 644                          */
 645
 646                         return LDAP_SUCCESS;
 647                 }
 648         }
 649
 650         rc = LDAP_SUCCESS;
 651
 652         if (pp->pwdCheckModule[0]) {
 653 #ifdef SLAPD_MODULES
 654                 lt_dlhandle mod;
 655                 const char *err;
 656
 657                 if ((mod = lt_dlopen( pp->pwdCheckModule )) == NULL) {
 658                         err = lt_dlerror();
 659
 660                         Debug(LDAP_DEBUG_ANY,
 661                         "check_password_quality: lt_dlopen failed: (%s) %s.\n",
 662                                 pp->pwdCheckModule, err, 0 );
 663                         ok = LDAP_OTHER; /* internal error */
 664                 } else {
 665                         /* FIXME: the error message ought to be passed thru a
 666                          * struct berval, with preallocated buffer and size
 667                          * passed in. Module can still allocate a buffer for
 668                          * it if the provided one is too small.
 669                          */
 670                         int (*prog)( char *passwd, char **text, Entry *ent );
 671
 672                         if ((prog = lt_dlsym( mod, "check_password" )) == NULL) {
 673                                 err = lt_dlerror();
 674
 675                                 Debug(LDAP_DEBUG_ANY,
 676                                         "check_password_quality: lt_dlsym failed: (%s) %s.\n",
 677                                         pp->pwdCheckModule, err, 0 );
 678                                 ok = LDAP_OTHER;
 679                         } else {
 680                                 ldap_pvt_thread_mutex_lock( &chk_syntax_mutex );
 681                                 ok = prog( ptr, txt, e );
 682                                 ldap_pvt_thread_mutex_unlock( &chk_syntax_mutex );
 683                                 if (ok != LDAP_SUCCESS) {
 684                                         Debug(LDAP_DEBUG_ANY,
 685                                                 "check_password_quality: module error: (%s) %s.[%d]\n",
 686                                                 pp->pwdCheckModule, *txt ? *txt : "", ok );
 687                                 }
 688                         }
 689
 690                         lt_dlclose( mod );
 691                 }
 692 #else
 693         Debug(LDAP_DEBUG_ANY, "check_password_quality: external modules not "
 694                 "supported. pwdCheckModule ignored.\n", 0, 0, 0);
 695 #endif /* SLAPD_MODULES */
 696         }
 697
 698
 699         if (ok != LDAP_SUCCESS) {
 700                 rc = LDAP_CONSTRAINT_VIOLATION;
 701                 if (err) *err = PP_insufficientPasswordQuality;
 702         }
 703
 704         return rc;
 705 }
 706
 707 static int
 708 parse_pwdhistory( struct berval *bv, char **oid, time_t *oldtime, struct berval *oldpw )
 709 {
 710         char *ptr;
 711         struct berval nv, npw;
 712         ber_len_t i, j;
 713
 714         assert (bv && (bv->bv_len > 0) && (bv->bv_val) && oldtime && oldpw );
 715
 716         if ( oid ) {
 717                 *oid = 0;
 718         }
 719         *oldtime = (time_t)-1;
 720         BER_BVZERO( oldpw );
 721
 722         ber_dupbv( &nv, bv );
 723
 724         /* first get the time field */
 725         for ( i = 0; (i < nv.bv_len) && (nv.bv_val[i] != '#'); i++ )
 726                 ;
 727         if ( i == nv.bv_len ) {
 728                 goto exit_failure; /* couldn't locate the '#' separator */
 729         }
 730         nv.bv_val[i++] = '\0'; /* terminate the string & move to next field */
 731         ptr = nv.bv_val;
 732         *oldtime = parse_time( ptr );
 733         if (*oldtime == (time_t)-1) {
 734                 goto exit_failure;
 735         }
 736
 737         /* get the OID field */
 738         for (ptr = &(nv.bv_val[i]); (i < nv.bv_len) && (nv.bv_val[i] != '#'); i++ )
 739                 ;
 740         if ( i == nv.bv_len ) {
 741                 goto exit_failure; /* couldn't locate the '#' separator */
 742         }
 743         nv.bv_val[i++] = '\0'; /* terminate the string & move to next field */
 744         if ( oid ) {
 745                 *oid = ber_strdup( ptr );
 746         }
 747
 748         /* get the length field */
 749         for ( ptr = &(nv.bv_val[i]); (i < nv.bv_len) && (nv.bv_val[i] != '#'); i++ )
 750                 ;
 751         if ( i == nv.bv_len ) {
 752                 goto exit_failure; /* couldn't locate the '#' separator */
 753         }
 754         nv.bv_val[i++] = '\0'; /* terminate the string & move to next field */
 755         oldpw->bv_len = strtol( ptr, NULL, 10 );
 756         if (errno == ERANGE) {
 757                 goto exit_failure;
 758         }
 759
 760         /* lastly, get the octets of the string */
 761         for ( j = i, ptr = &(nv.bv_val[i]); i < nv.bv_len; i++ )
 762                 ;
 763         if ( i - j != oldpw->bv_len) {
 764                 goto exit_failure; /* length is wrong */
 765         }
 766
 767         npw.bv_val = ptr;
 768         npw.bv_len = oldpw->bv_len;
 769         ber_dupbv( oldpw, &npw );
 770         ber_memfree( nv.bv_val );
 771
 772         return LDAP_SUCCESS;
 773
 774 exit_failure:;
 775         if ( oid && *oid ) {
 776                 ber_memfree(*oid);
 777                 *oid = NULL;
 778         }
 779         if ( oldpw->bv_val ) {
 780                 ber_memfree( oldpw->bv_val);
 781                 BER_BVZERO( oldpw );
 782         }
 783         ber_memfree( nv.bv_val );
 784
 785         return LDAP_OTHER;
 786 }
 787
 788 static void
 789 add_to_pwd_history( pw_hist **l, time_t t,
 790                     struct berval *oldpw, struct berval *bv )
 791 {
 792         pw_hist *p, *p1, *p2;
 793
 794         if (!l) return;
 795
 796         p = ch_malloc( sizeof( pw_hist ));
 797         p->pw = *oldpw;
 798         ber_dupbv( &p->bv, bv );
 799         p->t = t;
 800         p->next = NULL;
 801
 802         if (*l == NULL) {
 803                 /* degenerate case */
 804                 *l = p;
 805                 return;
 806         }
 807         /*
 808          * advance p1 and p2 such that p1 is the node before the
 809          * new one, and p2 is the node after it
 810          */
 811         for (p1 = NULL, p2 = *l; p2 && p2->t <= t; p1 = p2, p2=p2->next );
 812         p->next = p2;
 813         if (p1 == NULL) { *l = p; return; }
 814         p1->next = p;
 815 }
 816
 817 #ifndef MAX_PWD_HISTORY_SZ
 818 #define MAX_PWD_HISTORY_SZ 1024
 819 #endif /* MAX_PWD_HISTORY_SZ */
 820
 821 static void
 822 make_pwd_history_value( char *timebuf, struct berval *bv, Attribute *pa )
 823 {
 824         char str[ MAX_PWD_HISTORY_SZ ];
 825         int nlen;
 826
 827         snprintf( str, MAX_PWD_HISTORY_SZ,
 828                   "%s#%s#%lu#", timebuf,
 829                   pa->a_desc->ad_type->sat_syntax->ssyn_oid,
 830                   (unsigned long) pa->a_nvals[0].bv_len );
 831         str[MAX_PWD_HISTORY_SZ-1] = 0;
 832         nlen = strlen(str);
 833
 834         /*
 835          * We have to assume that the string is a string of octets,
 836          * not readable characters. In reality, yes, it probably is
 837          * a readable (ie, base64) string, but we can't count on that
 838          * Hence, while the first 3 fields of the password history
 839          * are definitely readable (a timestamp, an OID and an integer
 840          * length), the remaining octets of the actual password
 841          * are deemed to be binary data.
 842          */
 843         AC_MEMCPY( str + nlen, pa->a_nvals[0].bv_val, pa->a_nvals[0].bv_len );
 844         nlen += pa->a_nvals[0].bv_len;
 845         bv->bv_val = ch_malloc( nlen + 1 );
 846         AC_MEMCPY( bv->bv_val, str, nlen );
 847         bv->bv_val[nlen] = '\0';
 848         bv->bv_len = nlen;
 849 }
 850
 851 static void
 852 free_pwd_history_list( pw_hist **l )
 853 {
 854         pw_hist *p;
 855
 856         if (!l) return;
 857         p = *l;
 858         while (p) {
 859                 pw_hist *pp = p->next;
 860
 861                 free(p->pw.bv_val);
 862                 free(p->bv.bv_val);
 863                 free(p);
 864                 p = pp;
 865         }
 866         *l = NULL;
 867 }
 868
 869 typedef struct ppbind {
 870         slap_overinst *on;
 871         int send_ctrl;
 872         int set_restrict;
 873         LDAPControl **oldctrls;
 874         Modifications *mod;
 875         LDAPPasswordPolicyError pErr;
 876         PassPolicy pp;
 877 } ppbind;
 878
 879 static void
 880 ctrls_cleanup( Operation *op, SlapReply *rs, LDAPControl **oldctrls )
 881 {
 882         int n;
 883
 884         assert( rs->sr_ctrls != NULL );
 885         assert( rs->sr_ctrls[0] != NULL );
 886
 887         for ( n = 0; rs->sr_ctrls[n]; n++ ) {
 888                 if ( rs->sr_ctrls[n]->ldctl_oid == ppolicy_ctrl_oid ) {
 889                         op->o_tmpfree( rs->sr_ctrls[n], op->o_tmpmemctx );
 890                         rs->sr_ctrls[n] = (LDAPControl *)(-1);
 891                         break;
 892                 }
 893         }
 894
 895         if ( rs->sr_ctrls[n] == NULL ) {
 896                 /* missed? */
 897         }
 898
 899         op->o_tmpfree( rs->sr_ctrls, op->o_tmpmemctx );
 900
 901         rs->sr_ctrls = oldctrls;
 902 }
 903
 904 static int
 905 ppolicy_ctrls_cleanup( Operation *op, SlapReply *rs )
 906 {
 907         ppbind *ppb = op->o_callback->sc_private;
 908         if ( ppb->send_ctrl ) {
 909                 ctrls_cleanup( op, rs, ppb->oldctrls );
 910         }
 911         return SLAP_CB_CONTINUE;
 912 }
 913
 914 static int
 915 ppolicy_bind_response( Operation *op, SlapReply *rs )
 916 {
 917         ppbind *ppb = op->o_callback->sc_private;
 918         slap_overinst *on = ppb->on;
 919         Modifications *mod = ppb->mod, *m;
 920         int pwExpired = 0;
 921         int ngut = -1, warn = -1, age, rc;
 922         Attribute *a;
 923         time_t now, pwtime = (time_t)-1;
 924         struct lutil_tm now_tm;
 925         struct lutil_timet now_usec;
 926         char nowstr[ LDAP_LUTIL_GENTIME_BUFSIZE ];
 927         char nowstr_usec[ LDAP_LUTIL_GENTIME_BUFSIZE+8 ];
 928         struct berval timestamp, timestamp_usec;
 929         BackendInfo *bi = op->o_bd->bd_info;
 930         Entry *e;
 931
 932         /* If we already know it's locked, just get on with it */
 933         if ( ppb->pErr != PP_noError ) {
 934                 goto locked;
 935         }
 936
 937         op->o_bd->bd_info = (BackendInfo *)on->on_info;
 938         rc = be_entry_get_rw( op, &op->o_req_ndn, NULL, NULL, 0, &e );
 939         op->o_bd->bd_info = bi;
 940
 941         if ( rc != LDAP_SUCCESS ) {
 942                 return SLAP_CB_CONTINUE;
 943         }
 944
 945         ldap_pvt_gettime(&now_tm); /* stored for later consideration */
 946         lutil_tm2time(&now_tm, &now_usec);
 947         now = now_usec.tt_sec;
 948         timestamp.bv_val = nowstr;
 949         timestamp.bv_len = sizeof(nowstr);
 950         slap_timestamp( &now, &timestamp );
 951
 952         /* Separate timestamp for pwdFailureTime with microsecond granularity */
 953         strcpy(nowstr_usec, nowstr);
 954         timestamp_usec.bv_val = nowstr_usec;
 955         timestamp_usec.bv_len = timestamp.bv_len;
 956         snprintf( timestamp_usec.bv_val + timestamp_usec.bv_len-1, sizeof(".123456Z"), ".%06dZ", now_usec.tt_usec );
 957         timestamp_usec.bv_len += STRLENOF(".123456");
 958
 959         if ( rs->sr_err == LDAP_INVALID_CREDENTIALS ) {
 960                 int i = 0, fc = 0;
 961
 962                 m = ch_calloc( sizeof(Modifications), 1 );
 963                 m->sml_op = LDAP_MOD_ADD;
 964                 m->sml_flags = 0;
 965                 m->sml_type = ad_pwdFailureTime->ad_cname;
 966                 m->sml_desc = ad_pwdFailureTime;
 967                 m->sml_numvals = 1;
 968                 m->sml_values = ch_calloc( sizeof(struct berval), 2 );
 969                 m->sml_nvalues = ch_calloc( sizeof(struct berval), 2 );
 970
 971                 ber_dupbv( &m->sml_values[0], &timestamp_usec );
 972                 ber_dupbv( &m->sml_nvalues[0], &timestamp_usec );
 973                 m->sml_next = mod;
 974                 mod = m;
 975
 976                 /*
 977                  * Count the pwdFailureTimes - if it's
 978                  * greater than the policy pwdMaxFailure,
 979                  * then lock the account.
 980                  */
 981                 if ((a = attr_find( e->e_attrs, ad_pwdFailureTime )) != NULL) {
 982                         for(i=0; a->a_nvals[i].bv_val; i++) {
 983
 984                                 /*
 985                                  * If the interval is 0, then failures
 986                                  * stay on the record until explicitly
 987                                  * reset by successful authentication.
 988                                  */
 989                                 if (ppb->pp.pwdFailureCountInterval == 0) {
 990                                         fc++;
 991                                 } else if (now <=
 992                                                         parse_time(a->a_nvals[i].bv_val) +
 993                                                         ppb->pp.pwdFailureCountInterval) {
 994
 995                                         fc++;
 996                                 }
 997                                 /*
 998                                  * We only count those failures
 999                                  * which are not due to expire.
1000                                  */
1001                         }
1002                 }
1003
1004                 if ((ppb->pp.pwdMaxFailure > 0) &&
1005                         (fc >= ppb->pp.pwdMaxFailure - 1)) {
1006
1007                         /*
1008                          * We subtract 1 from the failure max
1009                          * because the new failure entry hasn't
1010                          * made it to the entry yet.
1011                          */
1012                         m = ch_calloc( sizeof(Modifications), 1 );
1013                         m->sml_op = LDAP_MOD_REPLACE;
1014                         m->sml_flags = 0;
1015                         m->sml_type = ad_pwdAccountLockedTime->ad_cname;
1016                         m->sml_desc = ad_pwdAccountLockedTime;
1017                         m->sml_numvals = 1;
1018                         m->sml_values = ch_calloc( sizeof(struct berval), 2 );
1019                         m->sml_nvalues = ch_calloc( sizeof(struct berval), 2 );
1020                         ber_dupbv( &m->sml_values[0], &timestamp );
1021                         ber_dupbv( &m->sml_nvalues[0], &timestamp );
1022                         m->sml_next = mod;
1023                         mod = m;
1024                 }
1025         } else if ( rs->sr_err == LDAP_SUCCESS ) {
1026                 if ((a = attr_find( e->e_attrs, ad_pwdChangedTime )) != NULL)
1027                         pwtime = parse_time( a->a_nvals[0].bv_val );
1028
1029                 /* delete all pwdFailureTimes */
1030                 if ( attr_find( e->e_attrs, ad_pwdFailureTime )) {
1031                         m = ch_calloc( sizeof(Modifications), 1 );
1032                         m->sml_op = LDAP_MOD_DELETE;
1033                         m->sml_flags = 0;
1034                         m->sml_type = ad_pwdFailureTime->ad_cname;
1035                         m->sml_desc = ad_pwdFailureTime;
1036                         m->sml_next = mod;
1037                         mod = m;
1038                 }
1039
1040                 /*
1041                  * check to see if the password must be changed
1042                  */
1043                 if ( ppb->pp.pwdMustChange &&
1044                         (a = attr_find( e->e_attrs, ad_pwdReset )) &&
1045                         bvmatch( &a->a_nvals[0], &slap_true_bv ) )
1046                 {
1047                         /*
1048                          * need to inject client controls here to give
1049                          * more information. For the moment, we ensure
1050                          * that we are disallowed from doing anything
1051                          * other than change password.
1052                          */
1053                         if ( ppb->set_restrict ) {
1054                                 ber_dupbv( &pwcons[op->o_conn->c_conn_idx].dn,
1055                                         &op->o_conn->c_ndn );
1056                         }
1057
1058                         ppb->pErr = PP_changeAfterReset;
1059
1060                 } else {
1061                         /*
1062                          * the password does not need to be changed, so
1063                          * we now check whether the password has expired.
1064                          *
1065                          * We can skip this bit if passwords don't age in
1066                          * the policy. Also, if there was no pwdChangedTime
1067                          * attribute in the entry, the password never expires.
1068                          */
1069                         if (ppb->pp.pwdMaxAge == 0) goto grace;
1070
1071                         if (pwtime != (time_t)-1) {
1072                                 /*
1073                                  * Check: was the last change time of
1074                                  * the password older than the maximum age
1075                                  * allowed. (Ignore case 2 from I-D, it's just silly.)
1076                                  */
1077                                 if (now - pwtime > ppb->pp.pwdMaxAge ) pwExpired = 1;
1078                         }
1079                 }
1080
1081 grace:
1082                 if (!pwExpired) goto check_expiring_password;
1083
1084                 if ((a = attr_find( e->e_attrs, ad_pwdGraceUseTime )) == NULL)
1085                         ngut = ppb->pp.pwdGraceAuthNLimit;
1086                 else {
1087                         for(ngut=0; a->a_nvals[ngut].bv_val; ngut++);
1088                         ngut = ppb->pp.pwdGraceAuthNLimit - ngut;
1089                 }
1090
1091                 /*
1092                  * ngut is the number of remaining grace logins
1093                  */
1094                 Debug( LDAP_DEBUG_ANY,
1095                         "ppolicy_bind: Entry %s has an expired password: %d grace logins\n",
1096                         e->e_name.bv_val, ngut, 0);
1097
1098                 if (ngut < 1) {
1099                         ppb->pErr = PP_passwordExpired;
1100                         rs->sr_err = LDAP_INVALID_CREDENTIALS;
1101                         goto done;
1102                 }
1103
1104                 /*
1105                  * Add a grace user time to the entry
1106                  */
1107                 m = ch_calloc( sizeof(Modifications), 1 );
1108                 m->sml_op = LDAP_MOD_ADD;
1109                 m->sml_flags = 0;
1110                 m->sml_type = ad_pwdGraceUseTime->ad_cname;
1111                 m->sml_desc = ad_pwdGraceUseTime;
1112                 m->sml_numvals = 1;
1113                 m->sml_values = ch_calloc( sizeof(struct berval), 2 );
1114                 m->sml_nvalues = ch_calloc( sizeof(struct berval), 2 );
1115                 ber_dupbv( &m->sml_values[0], &timestamp );
1116                 ber_dupbv( &m->sml_nvalues[0], &timestamp );
1117                 m->sml_next = mod;
1118                 mod = m;
1119
1120 check_expiring_password:
1121                 /*
1122                  * Now we need to check to see
1123                  * if it is about to expire, and if so, should the user
1124                  * be warned about it in the password policy control.
1125                  *
1126                  * If the password has expired, and we're in the grace period, then
1127                  * we don't need to do this bit. Similarly, if we don't have password
1128                  * aging, then there's no need to do this bit either.
1129                  */
1130                 if ((ppb->pp.pwdMaxAge < 1) || (pwExpired) || (ppb->pp.pwdExpireWarning < 1))
1131                         goto done;
1132
1133                 age = (int)(now - pwtime);
1134
1135                 /*
1136                  * We know that there is a password Change Time attribute - if
1137                  * there wasn't, then the pwdExpired value would be true, unless
1138                  * there is no password aging - and if there is no password aging,
1139                  * then this section isn't called anyway - you can't have an
1140                  * expiring password if there's no limit to expire.
1141                  */
1142                 if (ppb->pp.pwdMaxAge - age < ppb->pp.pwdExpireWarning ) {
1143                         /*
1144                          * Set the warning value.
1145                          */
1146                         warn = ppb->pp.pwdMaxAge - age; /* seconds left until expiry */
1147                         if (warn < 0) warn = 0; /* something weird here - why is pwExpired not set? */
1148
1149                         Debug( LDAP_DEBUG_ANY,
1150                                 "ppolicy_bind: Setting warning for password expiry for %s = %d seconds\n",
1151                                 op->o_req_dn.bv_val, warn, 0 );
1152                 }
1153         }
1154
1155 done:
1156         op->o_bd->bd_info = (BackendInfo *)on->on_info;
1157         be_entry_release_r( op, e );
1158
1159 locked:
1160         if ( mod ) {
1161                 Operation op2 = *op;
1162                 SlapReply r2 = { REP_RESULT };
1163                 slap_callback cb = { NULL, slap_null_cb, NULL, NULL };
1164                 pp_info *pi = on->on_bi.bi_private;
1165                 LDAPControl c, *ca[2];
1166
1167                 op2.o_tag = LDAP_REQ_MODIFY;
1168                 op2.o_callback = &cb;
1169                 op2.orm_modlist = mod;
1170                 op2.orm_no_opattrs = 0;
1171                 op2.o_dn = op->o_bd->be_rootdn;
1172                 op2.o_ndn = op->o_bd->be_rootndn;
1173
1174                 /* If this server is a shadow and forward_updates is true,
1175                  * use the frontend to perform this modify. That will trigger
1176                  * the update referral, which can then be forwarded by the
1177                  * chain overlay. Obviously the updateref and chain overlay
1178                  * must be configured appropriately for this to be useful.
1179                  */
1180                 if ( SLAP_SHADOW( op->o_bd ) && pi->forward_updates ) {
1181                         op2.o_bd = frontendDB;
1182
1183                         /* Must use Relax control since these are no-user-mod */
1184                         op2.o_relax = SLAP_CONTROL_CRITICAL;
1185                         op2.o_ctrls = ca;
1186                         ca[0] = &c;
1187                         ca[1] = NULL;
1188                         BER_BVZERO( &c.ldctl_value );
1189                         c.ldctl_iscritical = 1;
1190                         c.ldctl_oid = LDAP_CONTROL_RELAX;
1191                 } else {
1192                         /* If not forwarding, don't update opattrs and don't replicate */
1193                         if ( SLAP_SINGLE_SHADOW( op->o_bd )) {
1194                                 op2.orm_no_opattrs = 1;
1195                                 op2.o_dont_replicate = 1;
1196                         }
1197                         op2.o_bd->bd_info = (BackendInfo *)on->on_info;
1198                 }
1199                 rc = op2.o_bd->be_modify( &op2, &r2 );
1200                 slap_mods_free( mod, 1 );
1201         }
1202
1203         if ( ppb->send_ctrl ) {
1204                 LDAPControl *ctrl = NULL;
1205                 pp_info *pi = on->on_bi.bi_private;
1206
1207                 /* Do we really want to tell that the account is locked? */
1208                 if ( ppb->pErr == PP_accountLocked && !pi->use_lockout ) {
1209                         ppb->pErr = PP_noError;
1210                 }
1211                 ctrl = create_passcontrol( op, warn, ngut, ppb->pErr );
1212                 ppb->oldctrls = add_passcontrol( op, rs, ctrl );
1213                 op->o_callback->sc_cleanup = ppolicy_ctrls_cleanup;
1214         }
1215         op->o_bd->bd_info = bi;
1216         return SLAP_CB_CONTINUE;
1217 }
1218
1219 static int
1220 ppolicy_bind( Operation *op, SlapReply *rs )
1221 {
1222         slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
1223
1224         /* Reset lockout status on all Bind requests */
1225         if ( !BER_BVISEMPTY( &pwcons[op->o_conn->c_conn_idx].dn )) {
1226                 ch_free( pwcons[op->o_conn->c_conn_idx].dn.bv_val );
1227                 BER_BVZERO( &pwcons[op->o_conn->c_conn_idx].dn );
1228         }
1229
1230         /* Root bypasses policy */
1231         if ( !be_isroot_dn( op->o_bd, &op->o_req_ndn )) {
1232                 Entry *e;
1233                 int rc;
1234                 ppbind *ppb;
1235                 slap_callback *cb;
1236
1237                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
1238                 rc = be_entry_get_rw( op, &op->o_req_ndn, NULL, NULL, 0, &e );
1239
1240                 if ( rc != LDAP_SUCCESS ) {
1241                         return SLAP_CB_CONTINUE;
1242                 }
1243
1244                 cb = op->o_tmpcalloc( sizeof(ppbind)+sizeof(slap_callback),
1245                         1, op->o_tmpmemctx );
1246                 ppb = (ppbind *)(cb+1);
1247                 ppb->on = on;
1248                 ppb->pErr = PP_noError;
1249                 ppb->set_restrict = 1;
1250
1251                 /* Setup a callback so we can munge the result */
1252
1253                 cb->sc_response = ppolicy_bind_response;
1254                 cb->sc_next = op->o_callback->sc_next;
1255                 cb->sc_private = ppb;
1256                 op->o_callback->sc_next = cb;
1257
1258                 /* Did we receive a password policy request control? */
1259                 if ( op->o_ctrlflag[ppolicy_cid] ) {
1260                         ppb->send_ctrl = 1;
1261                 }
1262
1263                 op->o_bd->bd_info = (BackendInfo *)on;
1264                 ppolicy_get( op, e, &ppb->pp );
1265
1266                 rc = account_locked( op, e, &ppb->pp, &ppb->mod );
1267
1268                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
1269                 be_entry_release_r( op, e );
1270
1271                 if ( rc ) {
1272                         ppb->pErr = PP_accountLocked;
1273                         send_ldap_error( op, rs, LDAP_INVALID_CREDENTIALS, NULL );
1274                         return rs->sr_err;
1275                 }
1276
1277         }
1278
1279         return SLAP_CB_CONTINUE;
1280 }
1281
1282 /* Reset the restricted info for the next session on this connection */
1283 static int
1284 ppolicy_connection_destroy( BackendDB *bd, Connection *conn )
1285 {
1286         if ( pwcons && !BER_BVISEMPTY( &pwcons[conn->c_conn_idx].dn )) {
1287                 ch_free( pwcons[conn->c_conn_idx].dn.bv_val );
1288                 BER_BVZERO( &pwcons[conn->c_conn_idx].dn );
1289         }
1290         return SLAP_CB_CONTINUE;
1291 }
1292
1293 /* Check if this connection is restricted */
1294 static int
1295 ppolicy_restrict(
1296         Operation *op,
1297         SlapReply *rs )
1298 {
1299         slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
1300         int send_ctrl = 0;
1301
1302         /* Did we receive a password policy request control? */
1303         if ( op->o_ctrlflag[ppolicy_cid] ) {
1304                 send_ctrl = 1;
1305         }
1306
1307         if ( op->o_conn && !BER_BVISEMPTY( &pwcons[op->o_conn->c_conn_idx].dn )) {
1308                 LDAPControl **oldctrls;
1309                 /* if the current authcDN doesn't match the one we recorded,
1310                  * then an intervening Bind has succeeded and the restriction
1311                  * no longer applies. (ITS#4516)
1312                  */
1313                 if ( !dn_match( &op->o_conn->c_ndn,
1314                                 &pwcons[op->o_conn->c_conn_idx].dn )) {
1315                         ch_free( pwcons[op->o_conn->c_conn_idx].dn.bv_val );
1316                         BER_BVZERO( &pwcons[op->o_conn->c_conn_idx].dn );
1317                         return SLAP_CB_CONTINUE;
1318                 }
1319
1320                 Debug( LDAP_DEBUG_TRACE,
1321                         "connection restricted to password changing only\n", 0, 0, 0);
1322                 if ( send_ctrl ) {
1323                         LDAPControl *ctrl = NULL;
1324                         ctrl = create_passcontrol( op, -1, -1, PP_changeAfterReset );
1325                         oldctrls = add_passcontrol( op, rs, ctrl );
1326                 }
1327                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
1328                 send_ldap_error( op, rs, LDAP_INSUFFICIENT_ACCESS,
1329                         "Operations are restricted to bind/unbind/abandon/StartTLS/modify password" );
1330                 if ( send_ctrl ) {
1331                         ctrls_cleanup( op, rs, oldctrls );
1332                 }
1333                 return rs->sr_err;
1334         }
1335
1336         return SLAP_CB_CONTINUE;
1337 }
1338
1339 static int
1340 ppolicy_compare_response(
1341         Operation *op,
1342         SlapReply *rs )
1343 {
1344         /* map compare responses to bind responses */
1345         if ( rs->sr_err == LDAP_COMPARE_TRUE )
1346                 rs->sr_err = LDAP_SUCCESS;
1347         else if ( rs->sr_err == LDAP_COMPARE_FALSE )
1348                 rs->sr_err = LDAP_INVALID_CREDENTIALS;
1349
1350         ppolicy_bind_response( op, rs );
1351
1352         /* map back to compare */
1353         if ( rs->sr_err == LDAP_SUCCESS )
1354                 rs->sr_err = LDAP_COMPARE_TRUE;
1355         else if ( rs->sr_err == LDAP_INVALID_CREDENTIALS )
1356                 rs->sr_err = LDAP_COMPARE_FALSE;
1357
1358         return SLAP_CB_CONTINUE;
1359 }
1360
1361 static int
1362 ppolicy_compare(
1363         Operation *op,
1364         SlapReply *rs )
1365 {
1366         slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
1367
1368         if ( ppolicy_restrict( op, rs ) != SLAP_CB_CONTINUE )
1369                 return rs->sr_err;
1370
1371         /* Did we receive a password policy request control?
1372          * Are we testing the userPassword?
1373          */
1374         if ( op->o_ctrlflag[ppolicy_cid] &&
1375                 op->orc_ava->aa_desc == slap_schema.si_ad_userPassword ) {
1376                 Entry *e;
1377                 int rc;
1378                 ppbind *ppb;
1379                 slap_callback *cb;
1380
1381                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
1382                 rc = be_entry_get_rw( op, &op->o_req_ndn, NULL, NULL, 0, &e );
1383
1384                 if ( rc != LDAP_SUCCESS ) {
1385                         return SLAP_CB_CONTINUE;
1386                 }
1387
1388                 cb = op->o_tmpcalloc( sizeof(ppbind)+sizeof(slap_callback),
1389                         1, op->o_tmpmemctx );
1390                 ppb = (ppbind *)(cb+1);
1391                 ppb->on = on;
1392                 ppb->pErr = PP_noError;
1393                 ppb->send_ctrl = 1;
1394                 /* failures here don't lockout the connection */
1395                 ppb->set_restrict = 0;
1396
1397                 /* Setup a callback so we can munge the result */
1398
1399                 cb->sc_response = ppolicy_compare_response;
1400                 cb->sc_next = op->o_callback->sc_next;
1401                 cb->sc_private = ppb;
1402                 op->o_callback->sc_next = cb;
1403
1404                 op->o_bd->bd_info = (BackendInfo *)on;
1405                 ppolicy_get( op, e, &ppb->pp );
1406
1407                 rc = account_locked( op, e, &ppb->pp, &ppb->mod );
1408
1409                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
1410                 be_entry_release_r( op, e );
1411
1412                 if ( rc ) {
1413                         ppb->pErr = PP_accountLocked;
1414                         send_ldap_error( op, rs, LDAP_COMPARE_FALSE, NULL );
1415                         return rs->sr_err;
1416                 }
1417         }
1418         return SLAP_CB_CONTINUE;
1419 }
1420
1421 static int
1422 ppolicy_add(
1423         Operation *op,
1424         SlapReply *rs )
1425 {
1426         slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
1427         pp_info *pi = on->on_bi.bi_private;
1428         PassPolicy pp;
1429         Attribute *pa;
1430         const char *txt;
1431
1432         if ( ppolicy_restrict( op, rs ) != SLAP_CB_CONTINUE )
1433                 return rs->sr_err;
1434
1435         /* If this is a replica, assume the master checked everything */
1436         if ( be_shadow_update( op ))
1437                 return SLAP_CB_CONTINUE;
1438
1439         /* Check for password in entry */
1440         if ((pa = attr_find( op->oq_add.rs_e->e_attrs,
1441                 slap_schema.si_ad_userPassword )))
1442         {
1443                 assert( pa->a_vals != NULL );
1444                 assert( !BER_BVISNULL( &pa->a_vals[ 0 ] ) );
1445
1446                 if ( !BER_BVISNULL( &pa->a_vals[ 1 ] ) ) {
1447                         send_ldap_error( op, rs, LDAP_CONSTRAINT_VIOLATION, "Password policy only allows one password value" );
1448                         return rs->sr_err;
1449                 }
1450
1451                 /*
1452                  * new entry contains a password - if we're not the root user
1453                  * then we need to check that the password fits in with the
1454                  * security policy for the new entry.
1455                  */
1456                 ppolicy_get( op, op->ora_e, &pp );
1457                 if (pp.pwdCheckQuality > 0 && !be_isroot( op )) {
1458                         struct berval *bv = &(pa->a_vals[0]);
1459                         int rc, send_ctrl = 0;
1460                         LDAPPasswordPolicyError pErr = PP_noError;
1461                         char *txt;
1462
1463                         /* Did we receive a password policy request control? */
1464                         if ( op->o_ctrlflag[ppolicy_cid] ) {
1465                                 send_ctrl = 1;
1466                         }
1467                         rc = check_password_quality( bv, &pp, &pErr, op->ora_e, &txt );
1468                         if (rc != LDAP_SUCCESS) {
1469                                 LDAPControl **oldctrls = NULL;
1470                                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
1471                                 if ( send_ctrl ) {
1472                                         LDAPControl *ctrl = NULL;
1473                                         ctrl = create_passcontrol( op, -1, -1, pErr );
1474                                         oldctrls = add_passcontrol( op, rs, ctrl );
1475                                 }
1476                                 send_ldap_error( op, rs, rc, txt ? txt : "Password fails quality checking policy" );
1477                                 if ( txt ) {
1478                                         free( txt );
1479                                 }
1480                                 if ( send_ctrl ) {
1481                                         ctrls_cleanup( op, rs, oldctrls );
1482                                 }
1483                                 return rs->sr_err;
1484                         }
1485                 }
1486                         /*
1487                          * A controversial bit. We hash cleartext
1488                          * passwords provided via add and modify operations
1489                          * You're not really supposed to do this, since
1490                          * the X.500 model says "store attributes" as they
1491                          * get provided. By default, this is what we do
1492                          *
1493                          * But if the hash_passwords flag is set, we hash
1494                          * any cleartext password attribute values via the
1495                          * default password hashing scheme.
1496                          */
1497                 if ((pi->hash_passwords) &&
1498                         (password_scheme( &(pa->a_vals[0]), NULL ) != LDAP_SUCCESS)) {
1499                         struct berval hpw;
1500
1501                         slap_passwd_hash( &(pa->a_vals[0]), &hpw, &txt );
1502                         if (hpw.bv_val == NULL) {
1503                                 /*
1504                                  * hashing didn't work. Emit an error.
1505                                  */
1506                                 rs->sr_err = LDAP_OTHER;
1507                                 rs->sr_text = txt;
1508                                 send_ldap_error( op, rs, LDAP_OTHER, "Password hashing failed" );
1509                                 return rs->sr_err;
1510                         }
1511
1512                         memset( pa->a_vals[0].bv_val, 0, pa->a_vals[0].bv_len);
1513                         ber_memfree( pa->a_vals[0].bv_val );
1514                         pa->a_vals[0].bv_val = hpw.bv_val;
1515                         pa->a_vals[0].bv_len = hpw.bv_len;
1516                 }
1517
1518                 /* If password aging is in effect, set the pwdChangedTime */
1519                 if ( pp.pwdMaxAge || pp.pwdMinAge ) {
1520                         struct berval timestamp;
1521                         char timebuf[ LDAP_LUTIL_GENTIME_BUFSIZE ];
1522                         time_t now = slap_get_time();
1523
1524                         timestamp.bv_val = timebuf;
1525                         timestamp.bv_len = sizeof(timebuf);
1526                         slap_timestamp( &now, &timestamp );
1527
1528                         attr_merge_one( op->ora_e, ad_pwdChangedTime, &timestamp, &timestamp );
1529                 }
1530         }
1531         return SLAP_CB_CONTINUE;
1532 }
1533
1534 static int
1535 ppolicy_mod_cb( Operation *op, SlapReply *rs )
1536 {
1537         slap_callback *sc = op->o_callback;
1538         op->o_callback = sc->sc_next;
1539         if ( rs->sr_err == LDAP_SUCCESS ) {
1540                 ch_free( pwcons[op->o_conn->c_conn_idx].dn.bv_val );
1541                 BER_BVZERO( &pwcons[op->o_conn->c_conn_idx].dn );
1542         }
1543         op->o_tmpfree( sc, op->o_tmpmemctx );
1544         return SLAP_CB_CONTINUE;
1545 }
1546
1547 static int
1548 ppolicy_modify( Operation *op, SlapReply *rs )
1549 {
1550         slap_overinst           *on = (slap_overinst *)op->o_bd->bd_info;
1551         pp_info                 *pi = on->on_bi.bi_private;
1552         int                     i, rc, mod_pw_only, pwmod, pwmop = -1, deladd,
1553                                 hsize = 0;
1554         PassPolicy              pp;
1555         Modifications           *mods = NULL, *modtail = NULL,
1556                                 *ml, *delmod, *addmod;
1557         Attribute               *pa, *ha, at;
1558         const char              *txt;
1559         pw_hist                 *tl = NULL, *p;
1560         int                     zapReset, send_ctrl = 0, free_txt = 0;
1561         Entry                   *e;
1562         struct berval           newpw = BER_BVNULL, oldpw = BER_BVNULL,
1563                                 *bv, cr[2];
1564         LDAPPasswordPolicyError pErr = PP_noError;
1565         LDAPControl             *ctrl = NULL;
1566         LDAPControl             **oldctrls = NULL;
1567         int                     is_pwdexop = 0;
1568
1569         op->o_bd->bd_info = (BackendInfo *)on->on_info;
1570         rc = be_entry_get_rw( op, &op->o_req_ndn, NULL, NULL, 0, &e );
1571         op->o_bd->bd_info = (BackendInfo *)on;
1572
1573         if ( rc != LDAP_SUCCESS ) return SLAP_CB_CONTINUE;
1574
1575         /* If this is a replica, we may need to tweak some of the
1576          * master's modifications. Otherwise, just pass it through.
1577          */
1578         if ( be_shadow_update( op )) {
1579                 Modifications **prev;
1580                 int got_del_grace = 0, got_del_lock = 0, got_pw = 0, got_del_fail = 0;
1581                 Attribute *a_grace, *a_lock, *a_fail;
1582
1583                 a_grace = attr_find( e->e_attrs, ad_pwdGraceUseTime );
1584                 a_lock = attr_find( e->e_attrs, ad_pwdAccountLockedTime );
1585                 a_fail = attr_find( e->e_attrs, ad_pwdFailureTime );
1586
1587                 for( prev = &op->orm_modlist, ml = *prev; ml; ml = *prev ) {
1588
1589                         if ( ml->sml_desc == slap_schema.si_ad_userPassword )
1590                                 got_pw = 1;
1591
1592                         /* If we're deleting an attr that didn't exist,
1593                          * drop this delete op
1594                          */
1595                         if ( ml->sml_op == LDAP_MOD_DELETE ) {
1596                                 int drop = 0;
1597
1598                                 if ( ml->sml_desc == ad_pwdGraceUseTime ) {
1599                                         got_del_grace = 1;
1600                                         if ( !a_grace )
1601                                                 drop = 1;
1602                                 } else
1603                                 if ( ml->sml_desc == ad_pwdAccountLockedTime ) {
1604                                         got_del_lock = 1;
1605                                         if ( !a_lock )
1606                                                 drop = 1;
1607                                 } else
1608                                 if ( ml->sml_desc == ad_pwdFailureTime ) {
1609                                         got_del_fail = 1;
1610                                         if ( !a_fail )
1611                                                 drop = 1;
1612                                 }
1613                                 if ( drop ) {
1614                                         *prev = ml->sml_next;
1615                                         ml->sml_next = NULL;
1616                                         slap_mods_free( ml, 1 );
1617                                         continue;
1618                                 }
1619                         }
1620                         prev = &ml->sml_next;
1621                 }
1622
1623                 /* If we're resetting the password, make sure grace, accountlock,
1624                  * and failure also get removed.
1625                  */
1626                 if ( got_pw ) {
1627                         if ( a_grace && !got_del_grace ) {
1628                                 ml = (Modifications *) ch_malloc( sizeof( Modifications ) );
1629                                 ml->sml_op = LDAP_MOD_DELETE;
1630                                 ml->sml_flags = SLAP_MOD_INTERNAL;
1631                                 ml->sml_type.bv_val = NULL;
1632                                 ml->sml_desc = ad_pwdGraceUseTime;
1633                                 ml->sml_numvals = 0;
1634                                 ml->sml_values = NULL;
1635                                 ml->sml_nvalues = NULL;
1636                                 ml->sml_next = NULL;
1637                                 *prev = ml;
1638                                 prev = &ml->sml_next;
1639                         }
1640                         if ( a_lock && !got_del_lock ) {
1641                                 ml = (Modifications *) ch_malloc( sizeof( Modifications ) );
1642                                 ml->sml_op = LDAP_MOD_DELETE;
1643                                 ml->sml_flags = SLAP_MOD_INTERNAL;
1644                                 ml->sml_type.bv_val = NULL;
1645                                 ml->sml_desc = ad_pwdAccountLockedTime;
1646                                 ml->sml_numvals = 0;
1647                                 ml->sml_values = NULL;
1648                                 ml->sml_nvalues = NULL;
1649                                 ml->sml_next = NULL;
1650                                 *prev = ml;
1651                         }
1652                         if ( a_fail && !got_del_fail ) {
1653                                 ml = (Modifications *) ch_malloc( sizeof( Modifications ) );
1654                                 ml->sml_op = LDAP_MOD_DELETE;
1655                                 ml->sml_flags = SLAP_MOD_INTERNAL;
1656                                 ml->sml_type.bv_val = NULL;
1657                                 ml->sml_desc = ad_pwdFailureTime;
1658                                 ml->sml_numvals = 0;
1659                                 ml->sml_values = NULL;
1660                                 ml->sml_nvalues = NULL;
1661                                 ml->sml_next = NULL;
1662                                 *prev = ml;
1663                         }
1664                 }
1665                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
1666                 be_entry_release_r( op, e );
1667                 return SLAP_CB_CONTINUE;
1668         }
1669
1670         /* Did we receive a password policy request control? */
1671         if ( op->o_ctrlflag[ppolicy_cid] ) {
1672                 send_ctrl = 1;
1673         }
1674
1675         /* See if this is a pwdModify exop. If so, we can
1676          * access the plaintext passwords from that request.
1677          */
1678         {
1679                 slap_callback *sc;
1680
1681                 for ( sc = op->o_callback; sc; sc=sc->sc_next ) {
1682                         if ( sc->sc_response == slap_null_cb &&
1683                                 sc->sc_private ) {
1684                                 req_pwdexop_s *qpw = sc->sc_private;
1685                                 newpw = qpw->rs_new;
1686                                 oldpw = qpw->rs_old;
1687                                 is_pwdexop = 1;
1688                                 break;
1689                         }
1690                 }
1691         }
1692
1693         ppolicy_get( op, e, &pp );
1694
1695         for ( ml = op->orm_modlist,
1696                         pwmod = 0, mod_pw_only = 1,
1697                         deladd = 0, delmod = NULL,
1698                         addmod = NULL,
1699                         zapReset = 1;
1700                 ml != NULL; modtail = ml, ml = ml->sml_next )
1701         {
1702                 if ( ml->sml_desc == pp.ad ) {
1703                         pwmod = 1;
1704                         pwmop = ml->sml_op;
1705                         if ((deladd == 0) && (ml->sml_op == LDAP_MOD_DELETE) &&
1706                                 (ml->sml_values) && !BER_BVISNULL( &ml->sml_values[0] ))
1707                         {
1708                                 deladd = 1;
1709                                 delmod = ml;
1710                         }
1711
1712                         if ((ml->sml_op == LDAP_MOD_ADD) ||
1713                                 (ml->sml_op == LDAP_MOD_REPLACE))
1714                         {
1715                                 if ( ml->sml_values && !BER_BVISNULL( &ml->sml_values[0] )) {
1716                                         if ( deladd == 1 )
1717                                                 deladd = 2;
1718
1719                                         /* FIXME: there's no easy way to ensure
1720                                          * that add does not cause multiple
1721                                          * userPassword values; one way (that
1722                                          * would be consistent with the single
1723                                          * password constraint) would be to turn
1724                                          * add into replace); another would be
1725                                          * to disallow add.
1726                                          *
1727                                          * Let's check at least that a single value
1728                                          * is being added
1729                                          */
1730                                         if ( addmod || !BER_BVISNULL( &ml->sml_values[ 1 ] ) ) {
1731                                                 rs->sr_err = LDAP_CONSTRAINT_VIOLATION;
1732                                                 rs->sr_text = "Password policy only allows one password value";
1733                                                 goto return_results;
1734                                         }
1735
1736                                         addmod = ml;
1737                                 } else {
1738                                         /* replace can have no values, add cannot */
1739                                         assert( ml->sml_op == LDAP_MOD_REPLACE );
1740                                 }
1741                         }
1742
1743                 } else if ( !(ml->sml_flags & SLAP_MOD_INTERNAL) && !is_at_operational( ml->sml_desc->ad_type ) ) {
1744                         mod_pw_only = 0;
1745                         /* modifying something other than password */
1746                 }
1747
1748                 /*
1749                  * If there is a request to explicitly add a pwdReset
1750                  * attribute, then we suppress the normal behaviour on
1751                  * password change, which is to remove the pwdReset
1752                  * attribute.
1753                  *
1754                  * This enables an administrator to assign a new password
1755                  * and place a "must reset" flag on the entry, which will
1756                  * stay until the user explicitly changes his/her password.
1757                  */
1758                 if (ml->sml_desc == ad_pwdReset ) {
1759                         if ((ml->sml_op == LDAP_MOD_ADD) ||
1760                                 (ml->sml_op == LDAP_MOD_REPLACE))
1761                                 zapReset = 0;
1762                 }
1763         }
1764
1765         if (!BER_BVISEMPTY( &pwcons[op->o_conn->c_conn_idx].dn ) && !mod_pw_only ) {
1766                 if ( dn_match( &op->o_conn->c_ndn,
1767                                 &pwcons[op->o_conn->c_conn_idx].dn )) {
1768                         Debug( LDAP_DEBUG_TRACE,
1769                                 "connection restricted to password changing only\n", 0, 0, 0 );
1770                         rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
1771                         rs->sr_text = "Operations are restricted to bind/unbind/abandon/StartTLS/modify password";
1772                         pErr = PP_changeAfterReset;
1773                         goto return_results;
1774                 } else {
1775                         ch_free( pwcons[op->o_conn->c_conn_idx].dn.bv_val );
1776                         BER_BVZERO( &pwcons[op->o_conn->c_conn_idx].dn );
1777                 }
1778         }
1779
1780         /*
1781          * if we have a "safe password modify policy", then we need to check if we're doing
1782          * a delete (with the old password), followed by an add (with the new password).
1783          *
1784          * If we got just a delete with nothing else, just let it go. We also skip all the checks if
1785          * the root user is bound. Root can do anything, including avoid the policies.
1786          */
1787
1788         if (!pwmod) goto do_modify;
1789
1790         /*
1791          * Build the password history list in ascending time order
1792          * We need this, even if the user is root, in order to maintain
1793          * the pwdHistory operational attributes properly.
1794          */
1795         if (addmod && pp.pwdInHistory > 0 && (ha = attr_find( e->e_attrs, ad_pwdHistory ))) {
1796                 struct berval oldpw;
1797                 time_t oldtime;
1798
1799                 for(i=0; ha->a_nvals[i].bv_val; i++) {
1800                         rc = parse_pwdhistory( &(ha->a_nvals[i]), NULL,
1801                                 &oldtime, &oldpw );
1802
1803                         if (rc != LDAP_SUCCESS) continue; /* invalid history entry */
1804
1805                         if (oldpw.bv_val) {
1806                                 add_to_pwd_history( &tl, oldtime, &oldpw,
1807                                         &(ha->a_nvals[i]) );
1808                                 oldpw.bv_val = NULL;
1809                                 oldpw.bv_len = 0;
1810                         }
1811                 }
1812                 for(p=tl; p; p=p->next, hsize++); /* count history size */
1813         }
1814
1815         if (be_isroot( op )) goto do_modify;
1816
1817         /* NOTE: according to draft-behera-ldap-password-policy
1818          * pwdAllowUserChange == FALSE must only prevent pwd changes
1819          * by the user the pwd belongs to (ITS#7021) */
1820         if (!pp.pwdAllowUserChange && dn_match(&op->o_req_ndn, &op->o_ndn)) {
1821                 rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
1822                 rs->sr_text = "User alteration of password is not allowed";
1823                 pErr = PP_passwordModNotAllowed;
1824                 goto return_results;
1825         }
1826
1827         /* Just deleting? */
1828         if (!addmod) {
1829                 /* skip everything else */
1830                 pwmod = 0;
1831                 goto do_modify;
1832         }
1833
1834         /* This is a pwdModify exop that provided the old pw.
1835          * We need to create a Delete mod for this old pw and
1836          * let the matching value get found later
1837          */
1838         if (pp.pwdSafeModify && oldpw.bv_val ) {
1839                 ml = (Modifications *)ch_calloc( sizeof( Modifications ), 1 );
1840                 ml->sml_op = LDAP_MOD_DELETE;
1841                 ml->sml_flags = SLAP_MOD_INTERNAL;
1842                 ml->sml_desc = pp.ad;
1843                 ml->sml_type = pp.ad->ad_cname;
1844                 ml->sml_numvals = 1;
1845                 ml->sml_values = (BerVarray) ch_malloc( 2 * sizeof( struct berval ) );
1846                 ber_dupbv( &ml->sml_values[0], &oldpw );
1847                 BER_BVZERO( &ml->sml_values[1] );
1848                 ml->sml_next = op->orm_modlist;
1849                 op->orm_modlist = ml;
1850                 delmod = ml;
1851                 deladd = 2;
1852         }
1853
1854         if (pp.pwdSafeModify && deladd != 2) {
1855                 Debug( LDAP_DEBUG_TRACE,
1856                         "change password must use DELETE followed by ADD/REPLACE\n",
1857                         0, 0, 0 );
1858                 rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
1859                 rs->sr_text = "Must supply old password to be changed as well as new one";
1860                 pErr = PP_mustSupplyOldPassword;
1861                 goto return_results;
1862         }
1863
1864         /* Check age, but only if pwdReset is not TRUE */
1865         pa = attr_find( e->e_attrs, ad_pwdReset );
1866         if ((!pa || !bvmatch( &pa->a_nvals[0], &slap_true_bv )) &&
1867                 pp.pwdMinAge > 0) {
1868                 time_t pwtime = (time_t)-1, now;
1869                 int age;
1870
1871                 if ((pa = attr_find( e->e_attrs, ad_pwdChangedTime )) != NULL)
1872                         pwtime = parse_time( pa->a_nvals[0].bv_val );
1873                 now = slap_get_time();
1874                 age = (int)(now - pwtime);
1875                 if ((pwtime != (time_t)-1) && (age < pp.pwdMinAge)) {
1876                         rs->sr_err = LDAP_CONSTRAINT_VIOLATION;
1877                         rs->sr_text = "Password is too young to change";
1878                         pErr = PP_passwordTooYoung;
1879                         goto return_results;
1880                 }
1881         }
1882
1883         /* pa is used in password history check below, be sure it's set */
1884         if ((pa = attr_find( e->e_attrs, pp.ad )) != NULL && delmod) {
1885                 /*
1886                  * we have a password to check
1887                  */
1888                 bv = oldpw.bv_val ? &oldpw : delmod->sml_values;
1889                 /* FIXME: no access checking? */
1890                 rc = slap_passwd_check( op, NULL, pa, bv, &txt );
1891                 if (rc != LDAP_SUCCESS) {
1892                         Debug( LDAP_DEBUG_TRACE,
1893                                 "old password check failed: %s\n", txt, 0, 0 );
1894
1895                         rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
1896                         rs->sr_text = "Must supply correct old password to change to new one";
1897                         pErr = PP_mustSupplyOldPassword;
1898                         goto return_results;
1899
1900                 } else {
1901                         int i;
1902
1903                         /*
1904                          * replace the delete value with the (possibly hashed)
1905                          * value which is currently in the password.
1906                          */
1907                         for ( i = 0; !BER_BVISNULL( &delmod->sml_values[i] ); i++ ) {
1908                                 free( delmod->sml_values[i].bv_val );
1909                                 BER_BVZERO( &delmod->sml_values[i] );
1910                         }
1911                         free( delmod->sml_values );
1912                         delmod->sml_values = ch_calloc( sizeof(struct berval), 2 );
1913                         BER_BVZERO( &delmod->sml_values[1] );
1914                         ber_dupbv( &(delmod->sml_values[0]),  &(pa->a_nvals[0]) );
1915                 }
1916         }
1917
1918         bv = newpw.bv_val ? &newpw : &addmod->sml_values[0];
1919         if (pp.pwdCheckQuality > 0) {
1920
1921                 rc = check_password_quality( bv, &pp, &pErr, e, (char **)&txt );
1922                 if (rc != LDAP_SUCCESS) {
1923                         rs->sr_err = rc;
1924                         if ( txt ) {
1925                                 rs->sr_text = txt;
1926                                 free_txt = 1;
1927                         } else {
1928                                 rs->sr_text = "Password fails quality checking policy";
1929                         }
1930                         goto return_results;
1931                 }
1932         }
1933
1934         /* If pwdInHistory is zero, passwords may be reused */
1935         if (pa && pp.pwdInHistory > 0) {
1936                 /*
1937                  * Last check - the password history.
1938                  */
1939                 /* FIXME: no access checking? */
1940                 if (slap_passwd_check( op, NULL, pa, bv, &txt ) == LDAP_SUCCESS) {
1941                         /*
1942                          * This is bad - it means that the user is attempting
1943                          * to set the password to the same as the old one.
1944                          */
1945                         rs->sr_err = LDAP_CONSTRAINT_VIOLATION;
1946                         rs->sr_text = "Password is not being changed from existing value";
1947                         pErr = PP_passwordInHistory;
1948                         goto return_results;
1949                 }
1950
1951                 /*
1952                  * Iterate through the password history, and fail on any
1953                  * password matches.
1954                  */
1955                 at = *pa;
1956                 at.a_vals = cr;
1957                 cr[1].bv_val = NULL;
1958                 for(p=tl; p; p=p->next) {
1959                         cr[0] = p->pw;
1960                         /* FIXME: no access checking? */
1961                         rc = slap_passwd_check( op, NULL, &at, bv, &txt );
1962
1963                         if (rc != LDAP_SUCCESS) continue;
1964
1965                         rs->sr_err = LDAP_CONSTRAINT_VIOLATION;
1966                         rs->sr_text = "Password is in history of old passwords";
1967                         pErr = PP_passwordInHistory;
1968                         goto return_results;
1969                 }
1970         }
1971
1972 do_modify:
1973         if (pwmod) {
1974                 struct berval timestamp;
1975                 char timebuf[ LDAP_LUTIL_GENTIME_BUFSIZE ];
1976                 time_t now = slap_get_time();
1977
1978                 /* If the conn is restricted, set a callback to clear it
1979                  * if the pwmod succeeds
1980                  */
1981                 if (!BER_BVISEMPTY( &pwcons[op->o_conn->c_conn_idx].dn )) {
1982                         slap_callback *sc = op->o_tmpcalloc( 1, sizeof( slap_callback ),
1983                                 op->o_tmpmemctx );
1984                         sc->sc_next = op->o_callback;
1985                         /* Must use sc_response to insure we reset on success, before
1986                          * the client sees the response. Must use sc_cleanup to insure
1987                          * that it gets cleaned up if sc_response is not called.
1988                          */
1989                         sc->sc_response = ppolicy_mod_cb;
1990                         sc->sc_cleanup = ppolicy_mod_cb;
1991                         op->o_callback = sc;
1992                 }
1993
1994                 /*
1995                  * keep the necessary pwd.. operational attributes
1996                  * up to date.
1997                  */
1998
1999                 timestamp.bv_val = timebuf;
2000                 timestamp.bv_len = sizeof(timebuf);
2001                 slap_timestamp( &now, &timestamp );
2002
2003                 mods = NULL;
2004                 if (pwmop != LDAP_MOD_DELETE) {
2005                         mods = (Modifications *) ch_calloc( sizeof( Modifications ), 1 );
2006                         mods->sml_op = LDAP_MOD_REPLACE;
2007                         mods->sml_numvals = 1;
2008                         mods->sml_values = (BerVarray) ch_malloc( 2 * sizeof( struct berval ) );
2009                         ber_dupbv( &mods->sml_values[0], &timestamp );
2010                         BER_BVZERO( &mods->sml_values[1] );
2011                         assert( !BER_BVISNULL( &mods->sml_values[0] ) );
2012                 } else if (attr_find(e->e_attrs, ad_pwdChangedTime )) {
2013                         mods = (Modifications *) ch_calloc( sizeof( Modifications ), 1 );
2014                         mods->sml_op = LDAP_MOD_DELETE;
2015                 }
2016                 if (mods) {
2017                         mods->sml_desc = ad_pwdChangedTime;
2018                         mods->sml_flags = SLAP_MOD_INTERNAL;
2019                         mods->sml_next = NULL;
2020                         modtail->sml_next = mods;
2021                         modtail = mods;
2022                 }
2023
2024                 if (attr_find(e->e_attrs, ad_pwdGraceUseTime )) {
2025                         mods = (Modifications *) ch_calloc( sizeof( Modifications ), 1 );
2026                         mods->sml_op = LDAP_MOD_DELETE;
2027                         mods->sml_desc = ad_pwdGraceUseTime;
2028                         mods->sml_flags = SLAP_MOD_INTERNAL;
2029                         mods->sml_next = NULL;
2030                         modtail->sml_next = mods;
2031                         modtail = mods;
2032                 }
2033
2034                 if (attr_find(e->e_attrs, ad_pwdAccountLockedTime )) {
2035                         mods = (Modifications *) ch_calloc( sizeof( Modifications ), 1 );
2036                         mods->sml_op = LDAP_MOD_DELETE;
2037                         mods->sml_desc = ad_pwdAccountLockedTime;
2038                         mods->sml_flags = SLAP_MOD_INTERNAL;
2039                         mods->sml_next = NULL;
2040                         modtail->sml_next = mods;
2041                         modtail = mods;
2042                 }
2043
2044                 if (attr_find(e->e_attrs, ad_pwdFailureTime )) {
2045                         mods = (Modifications *) ch_calloc( sizeof( Modifications ), 1 );
2046                         mods->sml_op = LDAP_MOD_DELETE;
2047                         mods->sml_desc = ad_pwdFailureTime;
2048                         mods->sml_flags = SLAP_MOD_INTERNAL;
2049                         mods->sml_next = NULL;
2050                         modtail->sml_next = mods;
2051                         modtail = mods;
2052                 }
2053
2054                 /* Delete the pwdReset attribute, since it's being reset */
2055                 if ((zapReset) && (attr_find(e->e_attrs, ad_pwdReset ))) {
2056                         mods = (Modifications *) ch_calloc( sizeof( Modifications ), 1 );
2057                         mods->sml_op = LDAP_MOD_DELETE;
2058                         mods->sml_desc = ad_pwdReset;
2059                         mods->sml_flags = SLAP_MOD_INTERNAL;
2060                         mods->sml_next = NULL;
2061                         modtail->sml_next = mods;
2062                         modtail = mods;
2063                 }
2064
2065                 if (pp.pwdInHistory > 0) {
2066                         if (hsize >= pp.pwdInHistory) {
2067                                 /*
2068                                  * We use the >= operator, since we are going to add
2069                                  * the existing password attribute value into the
2070                                  * history - thus the cardinality of history values is
2071                                  * about to rise by one.
2072                                  *
2073                                  * If this would push it over the limit of history
2074                                  * values (remembering - the password policy could have
2075                                  * changed since the password was last altered), we must
2076                                  * delete at least 1 value from the pwdHistory list.
2077                                  *
2078                                  * In fact, we delete '(#pwdHistory attrs - max pwd
2079                                  * history length) + 1' values, starting with the oldest.
2080                                  * This is easily evaluated, since the linked list is
2081                                  * created in ascending time order.
2082                                  */
2083                                 mods = (Modifications *) ch_calloc( sizeof( Modifications ), 1 );
2084                                 mods->sml_op = LDAP_MOD_DELETE;
2085                                 mods->sml_flags = SLAP_MOD_INTERNAL;
2086                                 mods->sml_desc = ad_pwdHistory;
2087                                 mods->sml_numvals = hsize - pp.pwdInHistory + 1;
2088                                 mods->sml_values = ch_calloc( sizeof( struct berval ),
2089                                         hsize - pp.pwdInHistory + 2 );
2090                                 BER_BVZERO( &mods->sml_values[ hsize - pp.pwdInHistory + 1 ] );
2091                                 for(i=0,p=tl; i < (hsize - pp.pwdInHistory + 1); i++, p=p->next) {
2092                                         BER_BVZERO( &mods->sml_values[i] );
2093                                         ber_dupbv( &(mods->sml_values[i]), &p->bv );
2094                                 }
2095                                 mods->sml_next = NULL;
2096                                 modtail->sml_next = mods;
2097                                 modtail = mods;
2098                         }
2099                         free_pwd_history_list( &tl );
2100
2101                         /*
2102                          * Now add the existing password into the history list.
2103                          * This will be executed even if the operation is to delete
2104                          * the password entirely.
2105                          *
2106                          * This isn't in the spec explicitly, but it seems to make
2107                          * sense that the password history list is the list of all
2108                          * previous passwords - even if they were deleted. Thus, if
2109                          * someone tries to add a historical password at some future
2110                          * point, it will fail.
2111                          */
2112                         if ((pa = attr_find( e->e_attrs, pp.ad )) != NULL) {
2113                                 mods = (Modifications *) ch_malloc( sizeof( Modifications ) );
2114                                 mods->sml_op = LDAP_MOD_ADD;
2115                                 mods->sml_flags = SLAP_MOD_INTERNAL;
2116                                 mods->sml_type.bv_val = NULL;
2117                                 mods->sml_desc = ad_pwdHistory;
2118                                 mods->sml_nvalues = NULL;
2119                                 mods->sml_numvals = 1;
2120                                 mods->sml_values = ch_calloc( sizeof( struct berval ), 2 );
2121                                 mods->sml_values[ 1 ].bv_val = NULL;
2122                                 mods->sml_values[ 1 ].bv_len = 0;
2123                                 make_pwd_history_value( timebuf, &mods->sml_values[0], pa );
2124                                 mods->sml_next = NULL;
2125                                 modtail->sml_next = mods;
2126                                 modtail = mods;
2127
2128                         } else {
2129                                 Debug( LDAP_DEBUG_TRACE,
2130                                 "ppolicy_modify: password attr lookup failed\n", 0, 0, 0 );
2131                         }
2132                 }
2133
2134                 /*
2135                  * Controversial bit here. If the new password isn't hashed
2136                  * (ie, is cleartext), we probably should hash it according
2137                  * to the default hash. The reason for this is that we want
2138                  * to use the policy if possible, but if we hash the password
2139                  * before, then we're going to run into trouble when it
2140                  * comes time to check the password.
2141                  *
2142                  * Now, the right thing to do is to use the extended password
2143                  * modify operation, but not all software can do this,
2144                  * therefore it makes sense to hash the new password, now
2145                  * we know it passes the policy requirements.
2146                  *
2147                  * Of course, if the password is already hashed, then we
2148                  * leave it alone.
2149                  */
2150
2151                 if ((pi->hash_passwords) && (addmod) && !newpw.bv_val &&
2152                         (password_scheme( &(addmod->sml_values[0]), NULL ) != LDAP_SUCCESS))
2153                 {
2154                         struct berval hpw, bv;
2155
2156                         slap_passwd_hash( &(addmod->sml_values[0]), &hpw, &txt );
2157                         if (hpw.bv_val == NULL) {
2158                                         /*
2159                                          * hashing didn't work. Emit an error.
2160                                          */
2161                                 rs->sr_err = LDAP_OTHER;
2162                                 rs->sr_text = txt;
2163                                 goto return_results;
2164                         }
2165                         bv = addmod->sml_values[0];
2166                                 /* clear and discard the clear password */
2167                         memset(bv.bv_val, 0, bv.bv_len);
2168                         ber_memfree(bv.bv_val);
2169                         addmod->sml_values[0] = hpw;
2170                 }
2171         }
2172         op->o_bd->bd_info = (BackendInfo *)on->on_info;
2173         be_entry_release_r( op, e );
2174         return SLAP_CB_CONTINUE;
2175
2176 return_results:
2177         free_pwd_history_list( &tl );
2178         op->o_bd->bd_info = (BackendInfo *)on->on_info;
2179         be_entry_release_r( op, e );
2180         if ( send_ctrl ) {
2181                 ctrl = create_passcontrol( op, -1, -1, pErr );
2182                 oldctrls = add_passcontrol( op, rs, ctrl );
2183         }
2184         send_ldap_result( op, rs );
2185         if ( free_txt ) {
2186                 free( (char *)txt );
2187                 rs->sr_text = NULL;
2188         }
2189         if ( send_ctrl ) {
2190                 if ( is_pwdexop ) {
2191                         if ( rs->sr_flags & REP_CTRLS_MUSTBEFREED ) {
2192                                 op->o_tmpfree( oldctrls, op->o_tmpmemctx );
2193                         }
2194                         oldctrls = NULL;
2195                         rs->sr_flags |= REP_CTRLS_MUSTBEFREED;
2196
2197                 } else {
2198                         ctrls_cleanup( op, rs, oldctrls );
2199                 }
2200         }
2201         return rs->sr_err;
2202 }
2203
2204 static int
2205 ppolicy_parseCtrl(
2206         Operation *op,
2207         SlapReply *rs,
2208         LDAPControl *ctrl )
2209 {
2210         if ( !BER_BVISNULL( &ctrl->ldctl_value ) ) {
2211                 rs->sr_text = "passwordPolicyRequest control value not absent";
2212                 return LDAP_PROTOCOL_ERROR;
2213         }
2214         op->o_ctrlflag[ppolicy_cid] = ctrl->ldctl_iscritical
2215                 ? SLAP_CONTROL_CRITICAL
2216                 : SLAP_CONTROL_NONCRITICAL;
2217
2218         return LDAP_SUCCESS;
2219 }
2220
2221 static int
2222 attrPretty(
2223         Syntax *syntax,
2224         struct berval *val,
2225         struct berval *out,
2226         void *ctx )
2227 {
2228         AttributeDescription *ad = NULL;
2229         const char *err;
2230         int code;
2231
2232         code = slap_bv2ad( val, &ad, &err );
2233         if ( !code ) {
2234                 ber_dupbv_x( out, &ad->ad_type->sat_cname, ctx );
2235         }
2236         return code;
2237 }
2238
2239 static int
2240 attrNormalize(
2241         slap_mask_t use,
2242         Syntax *syntax,
2243         MatchingRule *mr,
2244         struct berval *val,
2245         struct berval *out,
2246         void *ctx )
2247 {
2248         AttributeDescription *ad = NULL;
2249         const char *err;
2250         int code;
2251
2252         code = slap_bv2ad( val, &ad, &err );
2253         if ( !code ) {
2254                 ber_str2bv_x( ad->ad_type->sat_oid, 0, 1, out, ctx );
2255         }
2256         return code;
2257 }
2258
2259 static int
2260 ppolicy_db_init(
2261         BackendDB *be,
2262         ConfigReply *cr
2263 )
2264 {
2265         slap_overinst *on = (slap_overinst *) be->bd_info;
2266
2267         if ( SLAP_ISGLOBALOVERLAY( be ) ) {
2268                 /* do not allow slapo-ppolicy to be global by now (ITS#5858) */
2269                 if ( cr ){
2270                         snprintf( cr->msg, sizeof(cr->msg),
2271                                 "slapo-ppolicy cannot be global" );
2272                         Debug( LDAP_DEBUG_ANY, "%s\n", cr->msg, 0, 0 );
2273                 }
2274                 return 1;
2275         }
2276
2277         /* Has User Schema been initialized yet? */
2278         if ( !pwd_UsSchema[0].ad[0] ) {
2279                 const char *err;
2280                 int i, code;
2281
2282                 for (i=0; pwd_UsSchema[i].def; i++) {
2283                         code = slap_str2ad( pwd_UsSchema[i].def, pwd_UsSchema[i].ad, &err );
2284                         if ( code ) {
2285                                 if ( cr ){
2286                                         snprintf( cr->msg, sizeof(cr->msg),
2287                                                 "User Schema load failed for attribute \"%s\". Error code %d: %s",
2288                                                 pwd_UsSchema[i].def, code, err );
2289                                         Debug( LDAP_DEBUG_ANY, "%s\n", cr->msg, 0, 0 );
2290                                 }
2291                                 return code;
2292                         }
2293                 }
2294                 {
2295                         Syntax *syn;
2296                         MatchingRule *mr;
2297
2298                         syn = ch_malloc( sizeof( Syntax ));
2299                         *syn = *ad_pwdAttribute->ad_type->sat_syntax;
2300                         syn->ssyn_pretty = attrPretty;
2301                         ad_pwdAttribute->ad_type->sat_syntax = syn;
2302
2303                         mr = ch_malloc( sizeof( MatchingRule ));
2304                         *mr = *ad_pwdAttribute->ad_type->sat_equality;
2305                         mr->smr_normalize = attrNormalize;
2306                         ad_pwdAttribute->ad_type->sat_equality = mr;
2307                 }
2308         }
2309
2310         on->on_bi.bi_private = ch_calloc( sizeof(pp_info), 1 );
2311
2312         if ( dtblsize && !pwcons ) {
2313                 /* accommodate for c_conn_idx == -1 */
2314                 pwcons = ch_calloc( sizeof(pw_conn), dtblsize + 1 );
2315                 pwcons++;
2316         }
2317
2318         ov_count++;
2319
2320         return 0;
2321 }
2322
2323 static int
2324 ppolicy_db_open(
2325         BackendDB *be,
2326         ConfigReply *cr
2327 )
2328 {
2329         return overlay_register_control( be, LDAP_CONTROL_PASSWORDPOLICYREQUEST );
2330 }
2331
2332 static int
2333 ppolicy_db_close(
2334         BackendDB *be,
2335         ConfigReply *cr
2336 )
2337 {
2338 #ifdef SLAP_CONFIG_DELETE
2339         overlay_unregister_control( be, LDAP_CONTROL_PASSWORDPOLICYREQUEST );
2340 #endif /* SLAP_CONFIG_DELETE */
2341
2342         return 0;
2343 }
2344
2345 static int
2346 ppolicy_db_destroy(
2347         BackendDB *be,
2348         ConfigReply *cr
2349 )
2350 {
2351         slap_overinst *on = (slap_overinst *) be->bd_info;
2352         pp_info *pi = on->on_bi.bi_private;
2353
2354         on->on_bi.bi_private = NULL;
2355         free( pi->def_policy.bv_val );
2356         free( pi );
2357
2358         ov_count--;
2359         if ( ov_count <=0 && pwcons ) {
2360                 pw_conn *pwc = pwcons;
2361                 pwcons = NULL;
2362                 pwc--;
2363                 ch_free( pwc );
2364         }
2365         return 0;
2366 }
2367
2368 static char *extops[] = {
2369         LDAP_EXOP_MODIFY_PASSWD,
2370         NULL
2371 };
2372
2373 static slap_overinst ppolicy;
2374
2375 int ppolicy_initialize()
2376 {
2377         int i, code;
2378
2379         for (i=0; pwd_OpSchema[i].def; i++) {
2380                 code = register_at( pwd_OpSchema[i].def, pwd_OpSchema[i].ad, 0 );
2381                 if ( code ) {
2382                         Debug( LDAP_DEBUG_ANY,
2383                                 "ppolicy_initialize: register_at failed\n", 0, 0, 0 );
2384                         return code;
2385                 }
2386                 /* Allow Manager to set these as needed */
2387                 if ( is_at_no_user_mod( (*pwd_OpSchema[i].ad)->ad_type )) {
2388                         (*pwd_OpSchema[i].ad)->ad_type->sat_flags |=
2389                                 SLAP_AT_MANAGEABLE;
2390                 }
2391         }
2392
2393         code = register_supported_control( LDAP_CONTROL_PASSWORDPOLICYREQUEST,
2394                 SLAP_CTRL_ADD|SLAP_CTRL_BIND|SLAP_CTRL_MODIFY|SLAP_CTRL_HIDE, extops,
2395                 ppolicy_parseCtrl, &ppolicy_cid );
2396         if ( code != LDAP_SUCCESS ) {
2397                 Debug( LDAP_DEBUG_ANY, "Failed to register control %d\n", code, 0, 0 );
2398                 return code;
2399         }
2400
2401         ldap_pvt_thread_mutex_init( &chk_syntax_mutex );
2402
2403         ppolicy.on_bi.bi_type = "ppolicy";
2404         ppolicy.on_bi.bi_db_init = ppolicy_db_init;
2405         ppolicy.on_bi.bi_db_open = ppolicy_db_open;
2406         ppolicy.on_bi.bi_db_close = ppolicy_db_close;
2407         ppolicy.on_bi.bi_db_destroy = ppolicy_db_destroy;
2408
2409         ppolicy.on_bi.bi_op_add = ppolicy_add;
2410         ppolicy.on_bi.bi_op_bind = ppolicy_bind;
2411         ppolicy.on_bi.bi_op_compare = ppolicy_compare;
2412         ppolicy.on_bi.bi_op_delete = ppolicy_restrict;
2413         ppolicy.on_bi.bi_op_modify = ppolicy_modify;
2414         ppolicy.on_bi.bi_op_search = ppolicy_restrict;
2415         ppolicy.on_bi.bi_connection_destroy = ppolicy_connection_destroy;
2416
2417         ppolicy.on_bi.bi_cf_ocs = ppolicyocs;
2418         code = config_register_schema( ppolicycfg, ppolicyocs );
2419         if ( code ) return code;
2420
2421         return overlay_register( &ppolicy );
2422 }
2423
2424 #if SLAPD_OVER_PPOLICY == SLAPD_MOD_DYNAMIC
2425 int init_module(int argc, char *argv[]) {
2426         return ppolicy_initialize();
2427 }
2428 #endif
2429
2430 #endif  /* defined(SLAPD_OVER_PPOLICY) */