libraries/libldap/sasl.c - diff

Return to sasl.c CVS log

Up to [OpenLDAP] / libraries / libldap

Diff for /libraries/libldap/sasl.c between versions 1.31 and 1.63

version 1.31, 2000/07/17 19:23:59	version 1.63, 2006/01/03 22:12:09
Line 1	Line 1
/* $OpenLDAP: pkg/ldap/libraries/libldap/sasl.c,v 1.30 2000/07/16 22:56:30 kurt Exp $ */	/* $OpenLDAP: pkg/ldap/libraries/libldap/sasl.c,v 1.62 2005/12/13 19:11:26 ando Exp $ */
/*	/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
* Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.	*
* COPYING RESTRICTIONS APPLY, see COPYRIGHT file	* Copyright 1998-2006 The OpenLDAP Foundation.
	* All rights reserved.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted only as authorized by the OpenLDAP
	* Public License.
	*
	* A copy of this license is available in the file LICENSE in the
	* top-level directory of the distribution or, alternatively, at
	* <http://www.OpenLDAP.org/license.html>.
	*/
	/* Portions Copyright (C) The Internet Society (1997)
	* ASN.1 fragments are from RFC 2251; see RFC for full legal notices.
*/	*/

/*	/*
Line 27	Line 39

#include "portable.h"	#include "portable.h"

#include <stdlib.h>
#include <stdio.h>	#include <stdio.h>

#include <ac/socket.h>	#include <ac/socket.h>
	#include <ac/stdlib.h>
#include <ac/string.h>	#include <ac/string.h>
#include <ac/time.h>	#include <ac/time.h>
#include <ac/errno.h>	#include <ac/errno.h>

#include "ldap-int.h"	#include "ldap-int.h"


/*	/*
* ldap_sasl_bind - bind to the ldap server (and X.500).	* ldap_sasl_bind - bind to the ldap server (and X.500).
* The dn (usually NULL), mechanism, and credentials are provided.	* The dn (usually NULL), mechanism, and credentials are provided.
Line 61 ldap_sasl_bind(	Line 72 ldap_sasl_bind(
{	{
BerElement *ber;	BerElement *ber;
int rc;	int rc;
	ber_int_t id;

Debug( LDAP_DEBUG_TRACE, "ldap_sasl_bind\n", 0, 0, 0 );	Debug( LDAP_DEBUG_TRACE, "ldap_sasl_bind\n", 0, 0, 0 );

Line 68 ldap_sasl_bind(	Line 80 ldap_sasl_bind(
assert( LDAP_VALID( ld ) );	assert( LDAP_VALID( ld ) );
assert( msgidp != NULL );	assert( msgidp != NULL );

if( msgidp == NULL ) {	/* check client controls */
ld->ld_errno = LDAP_PARAM_ERROR;	rc = ldap_int_client_controls( ld, cctrls );
return ld->ld_errno;	if( rc != LDAP_SUCCESS ) return rc;
}

if( mechanism == LDAP_SASL_SIMPLE ) {	if( mechanism == LDAP_SASL_SIMPLE ) {
if( dn == NULL && cred != NULL ) {	if( dn == NULL && cred != NULL && cred->bv_len ) {
/* use default binddn */	/* use default binddn */
dn = ld->ld_defbinddn;	dn = ld->ld_defbinddn;
}	}
Line 94 ldap_sasl_bind(	Line 105 ldap_sasl_bind(
return ld->ld_errno;	return ld->ld_errno;
}	}

assert( BER_VALID( ber ) );	assert( LBER_VALID( ber ) );

	LDAP_NEXT_MSGID( ld, id );
if( mechanism == LDAP_SASL_SIMPLE ) {	if( mechanism == LDAP_SASL_SIMPLE ) {
/* simple bind */	/* simple bind */
rc = ber_printf( ber, "{it{istON}" /}/,	rc = ber_printf( ber, "{it{istON}" /}/,
++ld->ld_msgid, LDAP_REQ_BIND,	id, LDAP_REQ_BIND,
ld->ld_version, dn, LDAP_AUTH_SIMPLE,	ld->ld_version, dn, LDAP_AUTH_SIMPLE,
cred );	cred );

} else if ( cred == NULL ) {	} else if ( cred == NULL \|\| cred->bv_val == NULL ) {
/* SASL bind w/o creditials */	/* SASL bind w/o credentials */
rc = ber_printf( ber, "{it{ist{sN}N}" /}/,	rc = ber_printf( ber, "{it{ist{sN}N}" /}/,
++ld->ld_msgid, LDAP_REQ_BIND,	id, LDAP_REQ_BIND,
ld->ld_version, dn, LDAP_AUTH_SASL,	ld->ld_version, dn, LDAP_AUTH_SASL,
mechanism );	mechanism );

} else {	} else {
/* SASL bind w/ creditials */	/* SASL bind w/ credentials */
rc = ber_printf( ber, "{it{ist{sON}N}" /}/,	rc = ber_printf( ber, "{it{ist{sON}N}" /}/,
++ld->ld_msgid, LDAP_REQ_BIND,	id, LDAP_REQ_BIND,
ld->ld_version, dn, LDAP_AUTH_SASL,	ld->ld_version, dn, LDAP_AUTH_SASL,
mechanism, cred );	mechanism, cred );
}	}
Line 136 ldap_sasl_bind(	Line 148 ldap_sasl_bind(
return ld->ld_errno;	return ld->ld_errno;
}	}

#ifndef LDAP_NOCACHE
if ( ld->ld_cache != NULL ) {
ldap_flush_cache( ld );
}
#endif /* !LDAP_NOCACHE */

/* send the message */	/* send the message */
*msgidp = ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber );	*msgidp = ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber, id );

if(*msgidp < 0)	if(*msgidp < 0)
return ld->ld_errno;	return ld->ld_errno;
Line 183 ldap_sasl_bind_s(	Line 190 ldap_sasl_bind_s(
return( rc );	return( rc );
}	}

if ( ldap_result( ld, msgid, 1, NULL, &result ) == -1 ) {	#ifdef LDAP_CONNECTIONLESS
	if (LDAP_IS_UDP(ld)) {
	return( rc );
	}
	#endif

	if ( ldap_result( ld, msgid, LDAP_MSG_ALL, NULL, &result ) == -1 ) {
return( ld->ld_errno ); /* ldap_result sets ld_errno */	return( ld->ld_errno ); /* ldap_result sets ld_errno */
}	}

Line 248 ldap_parse_sasl_bind_result(	Line 261 ldap_parse_sasl_bind_result(
assert( LDAP_VALID( ld ) );	assert( LDAP_VALID( ld ) );
assert( res != NULL );	assert( res != NULL );

if ( ld == NULL \|\| res == NULL ) {
return LDAP_PARAM_ERROR;
}

if( servercredp != NULL ) {	if( servercredp != NULL ) {
if( ld->ld_version < LDAP_VERSION2 ) {	if( ld->ld_version < LDAP_VERSION2 ) {
return LDAP_NOT_SUPPORTED;	return LDAP_NOT_SUPPORTED;
Line 285 ldap_parse_sasl_bind_result(	Line 294 ldap_parse_sasl_bind_result(
}	}

if ( ld->ld_version < LDAP_VERSION2 ) {	if ( ld->ld_version < LDAP_VERSION2 ) {
	#ifdef LDAP_NULL_IS_NULL
	tag = ber_scanf( ber, "{iA}",
	&errcode, &ld->ld_error );
	#else /* ! LDAP_NULL_IS_NULL */
tag = ber_scanf( ber, "{ia}",	tag = ber_scanf( ber, "{ia}",
&errcode, &ld->ld_error );	&errcode, &ld->ld_error );
	#endif /* ! LDAP_NULL_IS_NULL */

if( tag == LBER_ERROR ) {	if( tag == LBER_ERROR ) {
ber_free( ber, 0 );	ber_free( ber, 0 );
Line 297 ldap_parse_sasl_bind_result(	Line 311 ldap_parse_sasl_bind_result(
} else {	} else {
ber_len_t len;	ber_len_t len;

tag = ber_scanf( ber, "{iaa" /}/,	#ifdef LDAP_NULL_IS_NULL
	tag = ber_scanf( ber, "{eAA" /}/,
&errcode, &ld->ld_matched, &ld->ld_error );	&errcode, &ld->ld_matched, &ld->ld_error );
	#else /* ! LDAP_NULL_IS_NULL */
	tag = ber_scanf( ber, "{eaa" /}/,
	&errcode, &ld->ld_matched, &ld->ld_error );
	#endif /* ! LDAP_NULL_IS_NULL */

if( tag == LBER_ERROR ) {	if( tag == LBER_ERROR ) {
ber_free( ber, 0 );	ber_free( ber, 0 );
Line 357 ldap_pvt_sasl_getmechs ( LDAP *ld, char	Line 376 ldap_pvt_sasl_getmechs ( LDAP *ld, char

Debug( LDAP_DEBUG_TRACE, "ldap_pvt_sasl_getmech\n", 0, 0, 0 );	Debug( LDAP_DEBUG_TRACE, "ldap_pvt_sasl_getmech\n", 0, 0, 0 );

rc = ldap_search_s( ld, NULL, LDAP_SCOPE_BASE,	rc = ldap_search_s( ld, "", LDAP_SCOPE_BASE,
NULL, attrs, 0, &res );	NULL, attrs, 0, &res );

if ( rc != LDAP_SUCCESS ) {	if ( rc != LDAP_SUCCESS ) {
Line 366 ldap_pvt_sasl_getmechs ( LDAP *ld, char	Line 385 ldap_pvt_sasl_getmechs ( LDAP *ld, char

e = ldap_first_entry( ld, res );	e = ldap_first_entry( ld, res );
if ( e == NULL ) {	if ( e == NULL ) {
	ldap_msgfree( res );
if ( ld->ld_errno == LDAP_SUCCESS ) {	if ( ld->ld_errno == LDAP_SUCCESS ) {
ld->ld_errno = LDAP_UNAVAILABLE;	ld->ld_errno = LDAP_NO_SUCH_OBJECT;
}	}
return ld->ld_errno;	return ld->ld_errno;
}	}

values = ldap_get_values( ld, e, "supportedSASLMechanisms" );	values = ldap_get_values( ld, e, "supportedSASLMechanisms" );
if ( values == NULL ) {	if ( values == NULL ) {
ld->ld_errno = LDAP_NO_SUCH_ATTRIBUTE;
ldap_msgfree( res );	ldap_msgfree( res );
	ld->ld_errno = LDAP_NO_SUCH_ATTRIBUTE;
return ld->ld_errno;	return ld->ld_errno;
}	}

mechlist = ldap_charray2str( values, " " );	mechlist = ldap_charray2str( values, " " );
if ( mechlist == NULL ) {	if ( mechlist == NULL ) {
ld->ld_errno = LDAP_NO_MEMORY;
LDAP_VFREE( values );	LDAP_VFREE( values );
ldap_msgfree( res );	ldap_msgfree( res );
	ld->ld_errno = LDAP_NO_MEMORY;
return ld->ld_errno;	return ld->ld_errno;
}	}

Line 415 ldap_sasl_interactive_bind_s(	Line 435 ldap_sasl_interactive_bind_s(
void *defaults )	void *defaults )
{	{
int rc;	int rc;
	char *smechs = NULL;

if( mechs == NULL \|\| *mechs == '\0' ) {	#if defined( LDAP_R_COMPILE ) && defined( HAVE_CYRUS_SASL )
char *smechs;	ldap_pvt_thread_mutex_lock( &ldap_int_sasl_mutex );
	#endif
	#ifdef LDAP_CONNECTIONLESS
	if( LDAP_IS_UDP(ld) ) {
	/* Just force it to simple bind, silly to make the user
	* ask all the time. No, we don't ever actually bind, but I'll
	* let the final bind handler take care of saving the cdn.
	*/
	rc = ldap_simple_bind( ld, dn, NULL );
	rc = rc < 0 ? rc : 0;
	goto done;
	} else
	#endif

	#ifdef HAVE_CYRUS_SASL
	if( mechs == NULL \|\| *mechs == '\0' ) {
	mechs = ld->ld_options.ldo_def_sasl_mech;
	}
	#endif

	if( mechs == NULL \|\| *mechs == '\0' ) {
rc = ldap_pvt_sasl_getmechs( ld, &smechs );	rc = ldap_pvt_sasl_getmechs( ld, &smechs );

if( rc != LDAP_SUCCESS ) {	if( rc != LDAP_SUCCESS ) {
return rc;	goto done;
}	}

Debug( LDAP_DEBUG_TRACE,	Debug( LDAP_DEBUG_TRACE,
"ldap_interactive_sasl_bind_s: server supports: %s\n",	"ldap_sasl_interactive_bind_s: server supports: %s\n",
smechs, 0, 0 );	smechs, 0, 0 );

mechs = smechs;	mechs = smechs;

} else {	} else {
Debug( LDAP_DEBUG_TRACE,	Debug( LDAP_DEBUG_TRACE,
"ldap_interactive_sasl_bind_s: user selected: %s\n",	"ldap_sasl_interactive_bind_s: user selected: %s\n",
mechs, 0, 0 );	mechs, 0, 0 );
}	}

Line 441 ldap_sasl_interactive_bind_s(	Line 480 ldap_sasl_interactive_bind_s(
serverControls, clientControls,	serverControls, clientControls,
flags, interact, defaults );	flags, interact, defaults );

	done:
	#if defined( LDAP_R_COMPILE ) && defined( HAVE_CYRUS_SASL )
	ldap_pvt_thread_mutex_unlock( &ldap_int_sasl_mutex );
	#endif
	if ( smechs ) LDAP_FREE( smechs );

return rc;	return rc;
}	}

Removed from v.1.31
changed lines
	Added in v.1.63