--- libraries/libldap/sasl.c 1999/12/17 02:27:17 1.5 +++ libraries/libldap/sasl.c 2000/06/23 23:40:40 1.27 @@ -1,6 +1,6 @@ -/* $OpenLDAP: pkg/ldap/libraries/libldap/sasl.c,v 1.4 1999/12/12 04:02:03 kdz Exp $ */ +/* $OpenLDAP: pkg/ldap/libraries/libldap/sasl.c,v 1.26 2000/06/10 20:39:31 kurt Exp $ */ /* - * Copyright 1998-1999 The OpenLDAP Foundation, All Rights Reserved. + * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved. * COPYING RESTRICTIONS APPLY, see COPYRIGHT file */ @@ -10,7 +10,7 @@ * name DistinguishedName, -- who * authentication CHOICE { * simple [0] OCTET STRING -- passwd -#ifdef HAVE_KERBEROS +#ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND * krbv42ldap [1] OCTET STRING * krbv42dsa [2] OCTET STRING #endif @@ -32,18 +32,20 @@ #include #include #include +#include #include "ldap-int.h" /* - * ldap_sasl_bind - bind to the ldap server (and X.500). The dn, mechanism, and - * credentials of the entry to which to bind are supplied. The message id - * of the request initiated is provided upon successful (LDAP_SUCCESS) return. + * ldap_sasl_bind - bind to the ldap server (and X.500). + * The dn (usually NULL), mechanism, and credentials are provided. + * The message id of the request initiated is provided upon successful + * (LDAP_SUCCESS) return. * * Example: - * ldap_sasl_bind( ld, "cn=manager, o=university of michigan, c=us", - * "mechanism", "secret", NULL, NULL, &msgid ) + * ldap_sasl_bind( ld, NULL, "mechanism", + * cred, NULL, NULL, &msgid ) */ int @@ -95,21 +97,21 @@ ldap_sasl_bind( if( mechanism == LDAP_SASL_SIMPLE ) { /* simple bind */ - rc = ber_printf( ber, "{it{istO}" /*}*/, + rc = ber_printf( ber, "{it{istON}" /*}*/, ++ld->ld_msgid, LDAP_REQ_BIND, ld->ld_version, dn, LDAP_AUTH_SIMPLE, cred ); } else if ( cred == NULL ) { /* SASL bind w/o creditials */ - rc = ber_printf( ber, "{it{ist{s}}" /*}*/, + rc = ber_printf( ber, "{it{ist{sN}N}" /*}*/, ++ld->ld_msgid, LDAP_REQ_BIND, ld->ld_version, dn, LDAP_AUTH_SASL, mechanism ); } else { /* SASL bind w/ creditials */ - rc = ber_printf( ber, "{it{ist{sO}}" /*}*/, + rc = ber_printf( ber, "{it{ist{sON}N}" /*}*/, ++ld->ld_msgid, LDAP_REQ_BIND, ld->ld_version, dn, LDAP_AUTH_SASL, mechanism, cred ); @@ -127,7 +129,7 @@ ldap_sasl_bind( return ld->ld_errno; } - if ( ber_printf( ber, /*{*/ "}" ) == -1 ) { + if ( ber_printf( ber, /*{*/ "N}" ) == -1 ) { ld->ld_errno = LDAP_ENCODING_ERROR; ber_free( ber, 1 ); return ld->ld_errno; @@ -148,16 +150,6 @@ ldap_sasl_bind( return LDAP_SUCCESS; } -/* - * ldap_sasl_bind_s - bind to the ldap server (and X.500) using simple - * authentication. The dn and password of the entry to which to bind are - * supplied. LDAP_SUCCESS is returned upon success, the ldap error code - * otherwise. - * - * Example: - * ldap_sasl_bind_s( ld, "cn=manager, o=university of michigan, c=us", - * "mechanism", "secret", NULL, NULL, &servercred ) - */ int ldap_sasl_bind_s( @@ -200,19 +192,21 @@ ldap_sasl_bind_s( rc = ldap_parse_sasl_bind_result( ld, result, &scredp, 0 ); } - if( rc != LDAP_SUCCESS ) { + if ( rc != LDAP_SUCCESS && rc != LDAP_SASL_BIND_IN_PROGRESS ) { ldap_msgfree( result ); return( rc ); } rc = ldap_result2error( ld, result, 1 ); - if( rc == LDAP_SUCCESS ) { + if ( rc == LDAP_SUCCESS || rc == LDAP_SASL_BIND_IN_PROGRESS ) { if( servercredp != NULL ) { *servercredp = scredp; + scredp = NULL; } + } - } else if (scredp != NULL ) { + if ( scredp != NULL ) { ber_bvfree(scredp); } @@ -221,18 +215,18 @@ ldap_sasl_bind_s( /* - * Parse BindResponse: - * - * BindResponse ::= [APPLICATION 1] SEQUENCE { - * COMPONENTS OF LDAPResult, - * serverSaslCreds [7] OCTET STRING OPTIONAL } - * - * LDAPResult ::= SEQUENCE { - * resultCode ENUMERATED, - * matchedDN LDAPDN, - * errorMessage LDAPString, - * referral [3] Referral OPTIONAL } - */ +* Parse BindResponse: +* +* BindResponse ::= [APPLICATION 1] SEQUENCE { +* COMPONENTS OF LDAPResult, +* serverSaslCreds [7] OCTET STRING OPTIONAL } +* +* LDAPResult ::= SEQUENCE { +* resultCode ENUMERATED, +* matchedDN LDAPDN, +* errorMessage LDAPString, +* referral [3] Referral OPTIONAL } +*/ int ldap_parse_sasl_bind_result( @@ -350,3 +344,772 @@ ldap_parse_sasl_bind_result( return( ld->ld_errno ); } + +#ifdef HAVE_CYRUS_SASL +/* +* Various Cyrus SASL related stuff. +*/ + +#define MAX_BUFF_SIZE 65536 +#define MIN_BUFF_SIZE 4096 + +static char * +array2str( char **a ) +{ + char *s, **v, *p; + int len = 0; + + for ( v = a; *v != NULL; v++ ) { + len += strlen( *v ) + 1; /* for a space */ + } + + if ( len == 0 ) { + return NULL; + } + + s = LDAP_MALLOC ( len ); /* last space holds \0 */ + + if ( s == NULL ) { + return NULL; + } + + p = s; + for ( v = a; *v != NULL; v++ ) { + int len; + + if ( v != a ) { + strncpy( p, " ", 1 ); + ++p; + } + len = strlen( *v ); + strncpy( p, *v, len ); + p += len; + } + + *p = '\0'; + + return s; +} + +int ldap_pvt_sasl_init( void ) +{ + /* XXX not threadsafe */ + static int sasl_initialized = 0; + + if ( sasl_initialized ) { + return 0; + } +#ifndef CSRIMALLOC + sasl_set_alloc( ber_memalloc, ber_memcalloc, ber_memrealloc, ber_memfree ); +#endif /* CSRIMALLOC */ + + if ( sasl_client_init( NULL ) == SASL_OK ) { + sasl_initialized = 1; + return 0; + } + + return -1; +} + +/* + * SASL encryption support for LBER Sockbufs + */ + +struct sb_sasl_data { + sasl_conn_t *sasl_context; + Sockbuf_Buf sec_buf_in; + Sockbuf_Buf buf_in; + Sockbuf_Buf buf_out; +}; + +static int +sb_sasl_setup( Sockbuf_IO_Desc *sbiod, void *arg ) +{ + struct sb_sasl_data *p; + + assert( sbiod != NULL ); + + p = LBER_MALLOC( sizeof( *p ) ); + if ( p == NULL ) + return -1; + p->sasl_context = (sasl_conn_t *)arg; + ber_pvt_sb_buf_init( &p->sec_buf_in ); + ber_pvt_sb_buf_init( &p->buf_in ); + ber_pvt_sb_buf_init( &p->buf_out ); + if ( ber_pvt_sb_grow_buffer( &p->sec_buf_in, MIN_BUFF_SIZE ) < 0 ) { + errno = ENOMEM; + return -1; + } + + sbiod->sbiod_pvt = p; + + return 0; +} + +static int +sb_sasl_remove( Sockbuf_IO_Desc *sbiod ) +{ + struct sb_sasl_data *p; + + assert( sbiod != NULL ); + + p = (struct sb_sasl_data *)sbiod->sbiod_pvt; + ber_pvt_sb_buf_destroy( &p->sec_buf_in ); + ber_pvt_sb_buf_destroy( &p->buf_in ); + ber_pvt_sb_buf_destroy( &p->buf_out ); + LBER_FREE( p ); + sbiod->sbiod_pvt = NULL; + return 0; +} + +static ber_len_t +sb_sasl_pkt_length( const char *buf, int debuglevel ) +{ + ber_len_t size; + long tmp; + + assert( buf != NULL ); + + tmp = *((long *)buf); + size = ntohl( tmp ); + + if ( size > MAX_BUFF_SIZE ) { + /* somebody is trying to mess me up. */ + ber_log_printf( LDAP_DEBUG_ANY, debuglevel, + "sb_sasl_pkt_length: received illegal packet length " + "of %lu bytes\n", (unsigned long)size ); + size = 16; /* this should lead to an error. */ +} + + return size + 4; /* include the size !!! */ +} + +/* Drop a processed packet from the input buffer */ +static void +sb_sasl_drop_packet ( Sockbuf_Buf *sec_buf_in, int debuglevel ) +{ + ber_slen_t len; + + len = sec_buf_in->buf_ptr - sec_buf_in->buf_end; + if ( len > 0 ) + memmove( sec_buf_in->buf_base, sec_buf_in->buf_base + + sec_buf_in->buf_end, len ); + + if ( len >= 4 ) { + sec_buf_in->buf_end = sb_sasl_pkt_length( sec_buf_in->buf_base, + debuglevel); + } + else { + sec_buf_in->buf_end = 0; + } + sec_buf_in->buf_ptr = len; +} + +static ber_slen_t +sb_sasl_read( Sockbuf_IO_Desc *sbiod, void *buf, ber_len_t len) +{ + struct sb_sasl_data *p; + ber_slen_t ret, bufptr; + + assert( sbiod != NULL ); + assert( SOCKBUF_VALID( sbiod->sbiod_sb ) ); + + p = (struct sb_sasl_data *)sbiod->sbiod_pvt; + + /* Are there anything left in the buffer? */ + ret = ber_pvt_sb_copy_out( &p->buf_in, buf, len ); + bufptr = ret; + len -= ret; + + if ( len == 0 ) + return bufptr; + + ber_pvt_sb_buf_destroy( &p->buf_in ); + + /* Read the length of the packet */ + while ( p->sec_buf_in.buf_ptr < 4 ) { + ret = LBER_SBIOD_READ_NEXT( sbiod, p->sec_buf_in.buf_base, + 4 - p->sec_buf_in.buf_ptr ); +#ifdef EINTR + if ( ( ret < 0 ) && ( errno == EINTR ) ) + continue; +#endif + if ( ret <= 0 ) + return ret; + + p->sec_buf_in.buf_ptr += ret; + } + + /* The new packet always starts at p->sec_buf_in.buf_base */ + ret = sb_sasl_pkt_length( p->sec_buf_in.buf_base, + sbiod->sbiod_sb->sb_debug ); + + /* Grow the packet buffer if neccessary */ + if ( ( p->sec_buf_in.buf_size < ret ) && + ber_pvt_sb_grow_buffer( &p->sec_buf_in, ret ) < 0 ) { + errno = ENOMEM; + return -1; + } + p->sec_buf_in.buf_end = ret; + + /* Did we read the whole encrypted packet? */ + while ( p->sec_buf_in.buf_ptr < p->sec_buf_in.buf_end ) { + /* No, we have got only a part of it */ + ret = p->sec_buf_in.buf_end - p->sec_buf_in.buf_ptr; + + ret = LBER_SBIOD_READ_NEXT( sbiod, p->sec_buf_in.buf_base + + p->sec_buf_in.buf_ptr, ret ); +#ifdef EINTR + if ( ( ret < 0 ) && ( errno == EINTR ) ) + continue; +#endif + if ( ret <= 0 ) + return ret; + + p->sec_buf_in.buf_ptr += ret; + } + + /* Decode the packet */ + ret = sasl_decode( p->sasl_context, p->sec_buf_in.buf_base, + p->sec_buf_in.buf_end, &p->buf_in.buf_base, + (unsigned *)&p->buf_in.buf_end ); + if ( ret != SASL_OK ) { + ber_log_printf( LDAP_DEBUG_ANY, sbiod->sbiod_sb->sb_debug, + "sb_sasl_read: failed to decode packet: %s\n", + sasl_errstring( ret, NULL, NULL ) ); + sb_sasl_drop_packet( &p->sec_buf_in, + sbiod->sbiod_sb->sb_debug ); + errno = EIO; + return -1; + } + + /* Drop the packet from the input buffer */ + sb_sasl_drop_packet( &p->sec_buf_in, sbiod->sbiod_sb->sb_debug ); + + p->buf_in.buf_size = p->buf_in.buf_end; + + bufptr += ber_pvt_sb_copy_out( &p->buf_in, (char*) buf + bufptr, len ); + + return bufptr; +} + +static ber_slen_t +sb_sasl_write( Sockbuf_IO_Desc *sbiod, void *buf, ber_len_t len) +{ + struct sb_sasl_data *p; + int ret; + + assert( sbiod != NULL ); + assert( SOCKBUF_VALID( sbiod->sbiod_sb ) ); + + p = (struct sb_sasl_data *)sbiod->sbiod_pvt; + + /* Are there anything left in the buffer? */ + if ( p->buf_out.buf_ptr != p->buf_out.buf_end ) { + ret = ber_pvt_sb_do_write( sbiod, &p->buf_out ); + if ( ret <= 0 ) + return ret; + } + + /* now encode the next packet. */ + ber_pvt_sb_buf_destroy( &p->buf_out ); + ret = sasl_encode( p->sasl_context, buf, len, &p->buf_out.buf_base, + (unsigned *)&p->buf_out.buf_size ); + if ( ret != SASL_OK ) { + ber_log_printf( LDAP_DEBUG_ANY, sbiod->sbiod_sb->sb_debug, + "sb_sasl_write: failed to encode packet: %s\n", + sasl_errstring( ret, NULL, NULL ) ); + return -1; + } + p->buf_out.buf_end = p->buf_out.buf_size; + + ret = ber_pvt_sb_do_write( sbiod, &p->buf_out ); + if ( ret <= 0 ) + return ret; + return len; +} + +static int +sb_sasl_ctrl( Sockbuf_IO_Desc *sbiod, int opt, void *arg ) +{ + struct sb_sasl_data *p; + + p = (struct sb_sasl_data *)sbiod->sbiod_pvt; + + if ( opt == LBER_SB_OPT_DATA_READY ) { + if ( p->buf_in.buf_ptr != p->buf_in.buf_end ) + return 1; + } + + return LBER_SBIOD_CTRL_NEXT( sbiod, opt, arg ); +} + +Sockbuf_IO ldap_pvt_sockbuf_io_sasl = +{ + sb_sasl_setup, /* sbi_setup */ + sb_sasl_remove, /* sbi_remove */ + sb_sasl_ctrl, /* sbi_ctrl */ + sb_sasl_read, /* sbi_read */ + sb_sasl_write, /* sbi_write */ + NULL /* sbi_close */ +}; + +int ldap_pvt_sasl_install( Sockbuf *sb, void *ctx_arg ) +{ + /* don't install the stuff unless security has been negotiated */ + + if ( !ber_sockbuf_ctrl( sb, LBER_SB_OPT_HAS_IO, + &ldap_pvt_sockbuf_io_sasl ) ) + ber_sockbuf_add_io( sb, &ldap_pvt_sockbuf_io_sasl, + LBER_SBIOD_LEVEL_APPLICATION, ctx_arg ); + + return LDAP_SUCCESS; +} + +static int +sasl_err2ldap( int saslerr ) +{ + int rc; + + switch (saslerr) { + case SASL_CONTINUE: + rc = LDAP_MORE_RESULTS_TO_RETURN; + break; + case SASL_OK: + rc = LDAP_SUCCESS; + break; + case SASL_FAIL: + rc = LDAP_LOCAL_ERROR; + break; + case SASL_NOMEM: + rc = LDAP_NO_MEMORY; + break; + case SASL_NOMECH: + rc = LDAP_AUTH_UNKNOWN; + break; + case SASL_BADAUTH: + rc = LDAP_AUTH_UNKNOWN; + break; + case SASL_NOAUTHZ: + rc = LDAP_PARAM_ERROR; + break; + case SASL_TOOWEAK: + case SASL_ENCRYPT: + rc = LDAP_AUTH_UNKNOWN; + break; + default: + rc = LDAP_LOCAL_ERROR; + break; + } + + assert( rc == LDAP_SUCCESS || LDAP_API_ERROR( rc ) ); + return rc; +} + +int +ldap_pvt_sasl_getmechs ( LDAP *ld, char **pmechlist ) +{ + /* we need to query the server for supported mechs anyway */ + LDAPMessage *res, *e; + char *attrs[] = { "supportedSASLMechanisms", NULL }; + char **values, *mechlist; + int rc; + + Debug( LDAP_DEBUG_TRACE, "ldap_pvt_sasl_getmech\n", 0, 0, 0 ); + + rc = ldap_search_s( ld, NULL, LDAP_SCOPE_BASE, + NULL, attrs, 0, &res ); + + if ( rc != LDAP_SUCCESS ) { + return ld->ld_errno; + } + + e = ldap_first_entry( ld, res ); + if ( e == NULL ) { + if ( ld->ld_errno == LDAP_SUCCESS ) { + ld->ld_errno = LDAP_UNAVAILABLE; + } + return ld->ld_errno; + } + + values = ldap_get_values( ld, e, "supportedSASLMechanisms" ); + if ( values == NULL ) { + ld->ld_errno = LDAP_NO_SUCH_ATTRIBUTE; + ldap_msgfree( res ); + return ld->ld_errno; + } + + mechlist = array2str( values ); + if ( mechlist == NULL ) { + ld->ld_errno = LDAP_NO_MEMORY; + LDAP_VFREE( values ); + ldap_msgfree( res ); + return ld->ld_errno; + } + + LDAP_VFREE( values ); + ldap_msgfree( res ); + + *pmechlist = mechlist; + + return LDAP_SUCCESS; +} + +int +ldap_pvt_sasl_bind( + LDAP *ld, + LDAP_CONST char *dn, + LDAP_CONST char *mechs, + LDAP_CONST sasl_callback_t *callbacks, + LDAPControl **sctrls, + LDAPControl **cctrls ) +{ + const char *mech; + int saslrc, rc; + sasl_ssf_t *ssf = NULL; + unsigned credlen; + struct berval ccred, *scred; + char *host; + sasl_interact_t *client_interact = NULL; + struct sockaddr_in sin; + socklen_t len; + sasl_security_properties_t secprops; + ber_socket_t sd; + + Debug( LDAP_DEBUG_TRACE, "ldap_pvt_sasl_bind\n", 0, 0, 0 ); + + /* do a quick !LDAPv3 check... ldap_sasl_bind will do the rest. */ + if (ld->ld_version < LDAP_VERSION3) { + ld->ld_errno = LDAP_NOT_SUPPORTED; + return ld->ld_errno; + } + + ber_sockbuf_ctrl( ld->ld_sb, LBER_SB_OPT_GET_FD, &sd ); + + if ( sd == AC_SOCKET_INVALID ) { + /* not connected yet */ + int rc = ldap_open_defconn( ld ); + + if( rc < 0 ) return ld->ld_errno; + ber_sockbuf_ctrl( ld->ld_sb, LBER_SB_OPT_GET_FD, &sd ); + } + + /* XXX this doesn't work with PF_LOCAL hosts */ + host = ldap_host_connected_to( ld->ld_sb ); + + if ( host == NULL ) { + ld->ld_errno = LDAP_UNAVAILABLE; + return ld->ld_errno; + } + + if ( ld->ld_sasl_context != NULL ) { + sasl_dispose( &ld->ld_sasl_context ); + } + + saslrc = sasl_client_new( "ldap", host, callbacks, SASL_SECURITY_LAYER, + &ld->ld_sasl_context ); + + LDAP_FREE( host ); + + if ( (saslrc != SASL_OK) && (saslrc != SASL_CONTINUE) ) { + ld->ld_errno = sasl_err2ldap( saslrc ); + sasl_dispose( &ld->ld_sasl_context ); + return ld->ld_errno; + } + + len = sizeof( sin ); + if ( getpeername( sd, (struct sockaddr *)&sin, &len ) == -1 ) { + Debug( LDAP_DEBUG_ANY, "SASL: can't query remote IP.\n", + 0, 0, 0 ); + ld->ld_errno = LDAP_OPERATIONS_ERROR; + return ld->ld_errno; + } + sasl_setprop( ld->ld_sasl_context, SASL_IP_REMOTE, &sin ); + + len = sizeof( sin ); + if ( getsockname( sd, (struct sockaddr *)&sin, &len ) == -1 ) { + Debug( LDAP_DEBUG_ANY, "SASL: can't query local IP.\n", + 0, 0, 0 ); + ld->ld_errno = LDAP_OPERATIONS_ERROR; + return ld->ld_errno; + } + sasl_setprop( ld->ld_sasl_context, SASL_IP_LOCAL, &sin ); + + memset( &secprops, '\0', sizeof( secprops ) ); + secprops.min_ssf = ld->ld_options.ldo_sasl_minssf; + secprops.max_ssf = ld->ld_options.ldo_sasl_maxssf; + secprops.security_flags = SASL_SECURITY_LAYER; + secprops.maxbufsize = 65536; + sasl_setprop( ld->ld_sasl_context, SASL_SEC_PROPS, &secprops ); + + ccred.bv_val = NULL; + ccred.bv_len = 0; + + saslrc = sasl_client_start( ld->ld_sasl_context, + mechs, + NULL, + &client_interact, + &ccred.bv_val, + &credlen, + &mech ); + + ccred.bv_len = credlen; + + if ( (saslrc != SASL_OK) && (saslrc != SASL_CONTINUE) ) { + ld->ld_errno = sasl_err2ldap( saslrc ); + sasl_dispose( &ld->ld_sasl_context ); + return ld->ld_errno; + } + + scred = NULL; + + do { + unsigned credlen; + sasl_interact_t *client_interact = NULL; + + rc = ldap_sasl_bind_s( ld, dn, mech, &ccred, sctrls, cctrls, &scred ); + if ( rc == LDAP_SUCCESS ) { + break; + } else if ( rc != LDAP_SASL_BIND_IN_PROGRESS ) { + if ( ccred.bv_val != NULL ) { + LDAP_FREE( ccred.bv_val ); + } + sasl_dispose( &ld->ld_sasl_context ); + return ld->ld_errno; + } + + if ( ccred.bv_val != NULL ) { + LDAP_FREE( ccred.bv_val ); + ccred.bv_val = NULL; + } + + saslrc = sasl_client_step( ld->ld_sasl_context, + (scred == NULL) ? NULL : scred->bv_val, + (scred == NULL) ? 0 : scred->bv_len, + &client_interact, + &ccred.bv_val, + &credlen ); + + ccred.bv_len = credlen; + ber_bvfree( scred ); + + if ( (saslrc != SASL_OK) && (saslrc != SASL_CONTINUE) ) { + ld->ld_errno = sasl_err2ldap( saslrc ); + sasl_dispose( &ld->ld_sasl_context ); + return ld->ld_errno; + } + } while ( rc == LDAP_SASL_BIND_IN_PROGRESS ); + + assert ( rc == LDAP_SUCCESS ); + + if ( sasl_getprop( ld->ld_sasl_context, SASL_SSF, (void **)&ssf ) + == SASL_OK && ssf && *ssf ) { + ldap_pvt_sasl_install( ld->ld_sb, ld->ld_sasl_context ); + } + + return rc; +} + +/* based on sample/sample-client.c */ +static int +ldap_pvt_sasl_getsecret(sasl_conn_t *conn, + void *context, int id, sasl_secret_t **psecret) +{ + struct berval *passphrase = (struct berval *)context; + size_t len; + + if ( conn == NULL || psecret == NULL || id != SASL_CB_PASS ) { + return SASL_BADPARAM; + } + + len = (passphrase != NULL) ? (size_t)passphrase->bv_len: 0; + + *psecret = (sasl_secret_t *) LDAP_MALLOC( sizeof( sasl_secret_t ) + len ); + if ( *psecret == NULL ) { + return SASL_NOMEM; + } + + (*psecret)->len = passphrase->bv_len; + + if ( passphrase != NULL ) { + memcpy((*psecret)->data, passphrase->bv_val, len); + } + + return SASL_OK; +} + +static int +ldap_pvt_sasl_getsimple(void *context, int id, const char **result, int *len) +{ + const char *value = (const char *)context; + + if ( result == NULL ) { + return SASL_BADPARAM; + } + + switch ( id ) { + case SASL_CB_USER: + case SASL_CB_AUTHNAME: + *result = value; + if ( len ) + *len = value ? strlen( value ) : 0; + break; + case SASL_CB_LANGUAGE: + *result = NULL; + if ( len ) + *len = 0; + break; + default: + return SASL_BADPARAM; + } + + return SASL_OK; +} + +int +ldap_pvt_sasl_get_option( LDAP *ld, int option, void *arg ) +{ + sasl_ssf_t *ssf; + + if ( ld == NULL ) + return -1; + + switch ( option ) { + case LDAP_OPT_X_SASL_MINSSF: + *(int *)arg = ld->ld_options.ldo_sasl_minssf; + break; + case LDAP_OPT_X_SASL_MAXSSF: + *(int *)arg = ld->ld_options.ldo_sasl_maxssf; + break; + case LDAP_OPT_X_SASL_ACTSSF: + if ( ld->ld_sasl_context == NULL ) { + *(int *)arg = -1; + break; + } + if ( sasl_getprop( ld->ld_sasl_context, SASL_SSF, + (void **) &ssf ) != SASL_OK ) + { + return -1; + } + *(int *)arg = *ssf; + break; + default: + return -1; + } + return 0; +} + +int +ldap_pvt_sasl_set_option( LDAP *ld, int option, void *arg ) +{ + if ( ld == NULL ) + return -1; + + switch ( option ) { + case LDAP_OPT_X_SASL_MINSSF: + ld->ld_options.ldo_sasl_minssf = *(int *)arg; + break; + case LDAP_OPT_X_SASL_MAXSSF: + ld->ld_options.ldo_sasl_maxssf = *(int *)arg; + break; + case LDAP_OPT_X_SASL_ACTSSF: + /* This option is read-only */ + default: + return -1; + } + return 0; +} + +/* + * ldap_negotiated_sasl_bind_s - bind to the ldap server (and X.500) + * using SASL authentication. + * + * This routine attempts to authenticate the user referred by the + * authentication id using the provided password. An optional + * authorization identity may be provided. An DN is generally not + * provided [see AuthMethod]. + * + * If the mechanism negotiated does not require a password, the + * passwd field is ignored. [A callback mechanism should really + * be used]. + * + * LDAP_SUCCESS is returned upon success, the ldap error code + * otherwise. + * + * Examples: + * ldap_negotiated_sasl_bind_s( ld, NULL, + * NULL, NULL, NULL, + * NULL, NULL, NULL, NULL ); + * + * ldap_negotiated_sasl_bind_s( ld, NULL, + * "user@OPENLDAP.ORG", NULL, NULL, + * "GSSAPI", NULL, NULL, NULL ); + * + * ldap_negotiated_sasl_bind_s( ld, NULL, + * "manager", "dn:cn=user,dc=openldap,dc=org", NULL, + * "DIGEST-MD5", NULL, NULL, NULL ); + * + * ldap_negotiated_sasl_bind_s( ld, NULL, + * "root@OPENLDAP.ORG", "u:user@OPENLDAP.ORG", NULL, + * "GSSAPI", NULL, NULL, NULL ); + * + * ldap_negotiated_sasl_bind_s( ld, NULL, + * "manager", "dn:cn=user,dc=openldap,dc=org", NULL, + * "DIGEST-MD5", NULL, NULL, NULL ); + */ +int +ldap_negotiated_sasl_bind_s( + LDAP *ld, + LDAP_CONST char *dn, /* usually NULL */ + LDAP_CONST char *authenticationId, + LDAP_CONST char *authorizationId, /* commonly NULL */ + LDAP_CONST char *saslMechanism, + struct berval *passPhrase, + LDAPControl **serverControls, + LDAPControl **clientControls) +{ + int n; + sasl_callback_t callbacks[4]; + int rc; + + Debug( LDAP_DEBUG_TRACE, "ldap_negotiated_sasl_bind_s\n", 0, 0, 0 ); + + if( saslMechanism == NULL || *saslMechanism == '\0' ) { + char *mechs; + rc = ldap_pvt_sasl_getmechs( ld, &mechs ); + + if( rc != LDAP_SUCCESS ) { + return rc; + } + + saslMechanism = mechs; + } + + /* SASL Authentication Identity */ + callbacks[n=0].id = SASL_CB_AUTHNAME; + callbacks[n].proc = ldap_pvt_sasl_getsimple; + callbacks[n].context = (void *)authenticationId; + + /* SASL Authorization Identity (userid) */ + if( authorizationId != NULL ) { + callbacks[++n].id = SASL_CB_USER; + callbacks[n].proc = ldap_pvt_sasl_getsimple; + callbacks[n].context = (void *)authorizationId; + } + + callbacks[++n].id = SASL_CB_PASS; + callbacks[n].proc = ldap_pvt_sasl_getsecret; + callbacks[n].context = (void *)passPhrase; + + callbacks[++n].id = SASL_CB_LIST_END; + callbacks[n].proc = NULL; + callbacks[n].context = NULL; + + assert( n * sizeof(sasl_callback_t) < sizeof(callbacks) ); + + rc = ldap_pvt_sasl_bind(ld, dn, saslMechanism, callbacks, + serverControls, clientControls); + + return rc; +} +#endif /* HAVE_CYRUS_SASL */