CVS log for servers/slapd/sasl.c

Up to [OpenLDAP] / servers / slapd

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

Happy New Year

typo in error message

ITS#6758 Avoid SlapReply reuse.
Caller provides a SlapReply and reads the result after the operation,
then reuses it.  Reinitialize before reuse, or move declaration inwards.

noop commit for ITS#6758: simplify future commits

test slap_dontUseCopy_propnames (ITS#6729)

add support for don't use copy in SASL auxprops lookup/store (ITS#6475; TODO: document new directives)

happy belated New Year

ITS#5195 - use connection's ssf for auxprop lookup

ITS#6441 cyrus-sasl 2.1.24 auxprop_lookup plugin returns status.

Silence warning in initializer

Use OperationBuffer for fake op

ITS#6101, did not always (re)set rs->sr_sasldata before send_ldap_sasl()

ITS#6147 add sasl-auxprop config, default to "slapd"

Update copyright notices

Warning cleanup: signed meets unsigned: SASL struct propval {unsigned nvalues}.

Warning cleanup: signed meets unsigned.  ber_flatten2() returns -1 on
error, not LBER_ERROR.

don't free and reuse filter structure; don't rewrite undefined filter values (ITS#5731,ITS#5732)

ITS#5368 partially revert 1.239

Warning cleanup: function ptr <=> void* at ldap_pvt_thread_pool_<set/get>key()

Happy New Year (belated)

Axe obsolete Cyrus 1.5 support

ITS#5298 use SASL's memory for temporary DN storage

ITS#5259 fix sasl_auxprop_store to allow cleanup after bindop is gone

ITS#5209 sasl_host may be different from global_host

ITS#3864 use sasl_ssf_t where expected

Attribute/Modification value counters

consistently use o_log_prefix

Fallout from ITS#4986 - remove unused param of select_backend()

Give OperationBuffer normal struct members instead of using
LBER_ALIGNED_BUFFER(OPERATION_BUFFER_SIZE), as discussed in ITS#4078.
Add a corresponding SyncOperationBuffer in overlays/syncprov.c.

printf format paranoia: macros could be changed to contain format chars

ITS#4954 clear c_sasl_dn after error

coverity fix, slapd_rw_apply NULL filter

Fix C errors

Added "slapd" rewrite map handler, connection_fake_init2 to use existing
tmpmemctx without reinitializing

Coverity - fix IPv6 addr parsing

Plug global_host race condition/leak

happy new year

(blind) compile fix; please review

make slap_sasl_open() comply with URL notation for IPv6 addresses

ITS#3755 silence strict-aliasing warnings

cleanup

Happy new year!

cleanup

cleanup for (ITS#4180); has nothing to do with the solution yet...

Additional error detail

Improve SASL error handling

Move CSN invocations to backends

merge sml_managing into sml_flags (SLAP_MOD_MANAGING)

zero out sml_managing any time a Modifications is built (use calloc?)

ITS#3845 allow rootpw to be used for rootdn SASL binds, based on
patch from Jason Townsend

slap_mods2entry() should not zero pointers into the modifications
list because checking is performed on these, rather than the entry.

slap_mods_free() now takes an extra argument indicating whether to
free the values or not.

Cleanup

assert expects int. (int)<nonnull ptr/long> can be 0. Use assert(arg!=0/NULL).

really fix the invalid free issue (I totally overlooked this piece of code)

attempt to fix invalid free

assert expects int. (int)<nonnull ptr/long> can be 0. Use assert(arg!=0/NULL).

ITS#3846 don't give hashed passwords to SASL, it only wants cleartext.

Format fixes (%d<->%lu etc)

Add SLAP_MOD_INTERNAL flag to Modifications, allow internal ops to bypass
ACL checks when modifying user-modifiable attributes as non-root user.

Add manage obsolete attributes capability.

<limits.h> cleanup && ITS#3643

Add conn->c_sasl_authz_dn, store SASL authzDN separately from authcDN

Reorganiza SLAPD_CRYPT and SLAPD_SPASSWD support for better reentrancy

Added ldap_pvt_sasl_secprops_unparse, slap_sasl_secprops_unparse

Rearrange, merge sasl config back into main config

Happy New Year!

improve usability of global ovrlays for write operations; may need to anticipate SLAPI accordingly.  More work needed for add (overlays need to understand they're global and call slap_mods2entry() explicitly)

hardcode "uid" into slapd & improve previous commit

ITS#3419: values in built auth DNs may need DN escaping, so build them via ldap_dn2bv

Split Operation into Opheader and op

ITS#3311: check sasl_auxprop_add_plugin return
cleanup

Revert ITS#3353 patch, it needs to be reworked.

ITS#3353 consolidate slapd globals into a single struct

multiple precision with BIGNUM/gmp/ulong

memory leak fixes

unifdef -UNEW_LOGGING

cleanup function name in log

rework op/rs structures to deal with opeartional attributes

clarify no limits in (internal) searches

ITS#3092: Rename sl_free() and friends to slap_sl_free()

s/saslAuthz/authz/

cleanup

lots of cleanup

Cleanup, fix for SASL/PLAIN

use BER_BVNULL

ITS#3048 delete sasl_checkpass support

ITS#2961 check for NULL authcDN

ITS#2934 - don't touch conn->c_sasl_dn for Simple Binds

Fix typo in slap_auxprop_init() (should not impact behavior) (ITS#2909)
found by Nalin Dahyabhai (Redhat).

Happy new year

Misc cleanup

Revert to simple authzID behavior

Move experimental built-in SASL behind SLAP_BUILTIN_SASL macro

propagate flags to sasl-regexp functions (will need it later)

Completely untested built-in EXTERNAL implementation
Needs identity mapping and proxy authorization support

fix a couple of (too optimistic) comments...

saslAuthzTo/From stuff

when comparing IDs to saslAuthzTo/From values, the saslAuthzTo
saslAuthzFrom values can take different forms:

dn[.<style>]:<pattern>

<style> ::= 	exact		; exact match
		children	; children of <pattern> match
		subtree		; <pattern> or children of <pattern> match
		regex		; <pattern> is regcomp() & regexec()
if no <style>, then exact is assumed

u[.<mech>][/<realm>]:<user>

when parsing a proxyAuthz value, only exact DN is allowed,
and no <mech> can be specified.  <user> cannot contain ':'
and <mech> cannot contain '/'.

Use c_authmech when c_sasl_bind_mech is empty

Look for the '@' in userid@realm in reverse so that a@b@c results
in userid of a@b and realm of c.

note a potential problem

conn must be non-null

Added sc_next and sc_cleanup to slap_callback

Added slap_null_cb

#ifdef for slap_auxprop_store

cleanup

clarify auxprop_store member type

Add auxprop_store support for Cyrus SASL 2.1.16+

Updated notices

ITS#2825 fix SASL internal searches

ITS#2762 tweak SASL include paths

add "proxy" to "authorization" in a few places

ITS#2729 fix typos

Clarify/standardize library version mismatch error messages

Inherit operation pblock for SLAPI

Change slap_sasl_authorized to take an Operation instead of a Connection,
for compatibility with proxyAuthz control

ITS#2424 use two SASL contexts per session to conform to RFC 2222

Fix prev commit

ITS#2424 reset SASL on an existing connection

Added errmsg arg to lutil_passwd_{check,hash} functions

remove dnNormalize2
replace calls to dnNormalize2 with calls to dnNormalize

Reduce warnings: Add missing 0 or NULL initializers for struct members.

Memory context tweaks for Bind

More memory context tweaks

Minor cleanups

First cut at thread-local malloc. Only used by search() for now...
Needs work in normalizers, etc.

Don't build generic_filter dynamically, it's a simple static.

Minor cleanup, use shorthand macros

Consolidated slap_callbacks into one function. Removed send_search_result.

Minor cleanup

Major API change - (SLAP_OP_BLOCKS) All request parameters are
consolidated into the Operation structure. All reply parameters
are consolidated into the new SlapReply structure. Most operations
now have identical call signatures... Changes are not #ifdef'd,
revert to -r NO_SLAP_OP_BLOCKS if necessary to back out.

SLAP_NVALUES changes
and misc cleanup

Added op->o_is_auth_check; use ACL_AUTH instead of ACL_SEARCH/ACL_READ
in access_allowed() if flag is set. Set in sasl/saslauth searches.

Use struct berval for exop reqoid everywhere. Define berval constants
for the known exops.

(mostly blind) fix of possible leak/dangling pointer and cleanup

make sure the DN is null-terminated before normalizing it

Add search ref callback

ITS#2268: SASL/ANONYMOUS fixes from kuenne@rentec.com

Happy new year

Minor cleanup

Correct fix

if 0 out bad statslog

Fix Statslog messages

Statslog additions:
	Added StatslogTest macro.
	Added attributes to modify and search Statslog.
	Added Statslog of SASL authcid.

cleanup

Fix ITS#2234 canonicalization bug

Treat all EXTERNAL DNs are already normalized.

First-cut proxy authorization support.

Fix ITS#2200, must use SASL creds exactly as received

ITS#2202, set SASL_SUCCESS_DATA on sasl_server_new().

Fix ITS#2200, revert patch in rev 1.128. SASL/Kerberos4 requires a patch
to Cyrus SASL lib/server.c, can't fix it here.

Converted ch_malloc and ch_calloc calls to SLAP_MALLOC and SLAP_CALLOC.

Fix sasl_server_start invocation, must pass NULL cred when credlen is 0.

Remove lint

Replace HACK in slap_sasl_canonicalize with safer test.

Don't use sasl_set_alloc on Cyrus 2, it manages all of its memory
internally and we don't want to get in the way.

Include lber_pvt.h

Added no-op sasl_client_auth if SASL_VERSION_MAJOR < 2.

cleanup

Added check for Cyrus SASL sasl_version()

Experimental cruft to propagate valid Operation to SASL callbacks.
If you have a better way, jupm on in...

use ldap_charray_*() instead of charray_*()

Use search callbacks in slap_sasl_checkpass and slap_auxprop_lookup,
use ACL_AUTH for acl checks.

silence warnings

Add #include "lutil.h" for lutil_str* functions

Fix lutil_str*() warnings

Fix for:
	SASL regex segmentation faults with group based acls (ITS#1978)
based, in part, by patch submitted by Simon Wilkinson <simon@sxw.org.uk>.

Moved slap_strcopy, slap_strncopy to lutil_strcopy, lutil_strncopy

Converted LDAP_LOG messages to use new Macro

Fix previous commit - the stub was never needed.

Fix order of params to sasl_setpass. Added initial stub for setpass to
change in-directory password.

Coverted LDAP_LOG macro to use subsystem ID int values instead of string values

Added saslAuthzTo and saslAuthzFrom to system schema.
Added sasl-authz-policy config keyword to control proxy authorization.
Moved sasl-related config processing to sasl.c:slap_sasl_config().
Moved other global defs used only in saslauthz.c into saslauthz.c.

Fix typo in previous commit

Finished slap_sasl_setpass for Cyrus 1.5; Cyrus 2.1 is incomplete.
Added conn->c_sasl_dn, streamlined slap_sasl_bind.

An almost complete slap_sasl_setpass()

Cleanup log msg

Check for NULL before comparing authcid

Skip processing if canonicalization is invoked redundantly (SASL PLAIN).
Truncate large username instead of failing with SASL_BUFOVER; we only care
about the DN anyway. (SASL 2 only)

Fix, SASL authzIDs might not be NUL-terminated. prop names must only be
set once; setting erases all existing values.

Fix typo in 1.97

Cleaned up getdn normalization

Fix previous commit, free in wrong place

Cleanup HAVE_TLS dependencies, cleanup username with embedded realm handling

Don't use slap_empty_bv in structures that are expected to be free'able.

Delete unused CANON_BUF_SIZE #define

Cyrus 2 support now requires Cyrus 2.1.3. Adds support for in-directory
SASL secrets. (Only works with plaintext userpassword tho.)

Fix check for "anonymous" in sasl_getdn

deleted sasl_external_x509dn_convert; X509 DNs are always converted to
normalized LDAP DNs now.

Changed dnDCEnormalize to dnX509normalize, added dnX509peerNormalize,
based on new ldap_X509dn2bv() etc.

Delete more unused code, no need to fetch REALM in slap_sasl_bind

Fix ssf declaration

More SASL DN simplification. No more "dn:" prefix used anywhere internally.

ITS#1712, rewritten dn_openssl2ldap(). Added dnDCEnormalize(), used by
dn_openssl2ldap() and sasl_external_x509dn_convert. Fixed realm handling
for foreign Kerberos realms embedded in usernames.

Fix name canonicalization and authorization for Cyrus SASL 2.x

Previous commit included undesired changes.

Fix previous commit, == instead of !=

Fix ITS#1722 - IPv4 addresses also need to be massaged for sasl_server_new.

ITS#1714 dn->bv_val malloc len+1

ITS#1636 fix

Note that we likely need to make some of this conditional.

Don't use 'shtool mkln' as ln(1) replacement.
Allow both <sasl/sasl.h> and <sasl.h>

notes needs for future additions

Fix compile error properly

Update Cyrus SASL detection to always look for <sasl.h> regardless
of version and then try -lsasl2 and -lsasl.  Make SASL code
conditional on SASL_VERSION_MAJOR, not HAVE_CYRUS_SASL.

Support for Cyrus SASLv2. Untested.

Add whoami extended operation.
Add no-op control (needs backend implementation)
Updated modify password extended option API
Kludged control infrastructure to support frontend only controls

Changed slap_authz_info.sai_mech to struct berval.
Changed sasl_* to use struct bervals.

more cleanup

Update copyright statements

use sizeof instead of strlen/hardcoded-consts

More struct berval DN changes
decrease dependency on dn_validate/dn_normalize

Additional struct berval DN changes...

More thorough backend_destroy. Added config_destroy. Destroy slap_listeners.
Plugged other small leaks.

Minor strlen cleanup

minor cleanup

fix various memory leaks

ldif.h include cleanup

Minor cleanup of last commit

Patch for SASL EXTERNAL.  Needs to be tested with other mechanisms.

Fix crashes for SASL/EXTERNAL binds:
  in slap_sasl_getdn, test id, not dn. dn is still NULL
  also, don't check for trailing slash
  in slap_sasl_bind, initialize reslen to 0

Skip over the "dn:" prefix when passing a DN to dn_normalize().

fix logging macros (thanks Mei)

Make sure the variable used for SASL REALM is initialized, in case of no REALM.

Fix more typos

Fix typo

Add "sasl-external-x509dn-convert" configuration option aimed
at providing authid TLS/X.509 to LDAP DN mapping.  Experimental.

Fix SASL_REALM bug
Minor cleanup of logging code, variable scope

Change the SASL DN's from cn=authzid to cn=auth

fix format

More new logging (Behind NEW_LOGGING)

Make SASL authorization work for NULL, "u:", and "dn:" authz strings.

Fix layer installation

We need to set sasl_layers prior to returning result...

Make sure authzid form produces a valid subject DN.  Support
both u: and dn: forms.
Rework sasl-regex DN be of the form
	uid=user,cn=realm,cn=mech,cn=authz
Fix up slapd.conf(5)

remove cruft

remove lint
update bdb codes

Implementation of SASL authorization.

Fix logging bug

merge changes from authPassword work which should fix SPASSWD code...

Add sasl-host option and treat sasl-realm as global only
(ie: not backend specific).

Minor typedef and other clean ups

Make settings match manual page.

Fix typos

Add char* ldap_pvt_get_fqdn(char*) which returns the FQDN of the
input.  In input==NULL, returns FQDN of local host.
Fixed copy_hostent() uninitialized pointer bug.
Replaced gethostname calls with ldap_pvt_get_fqdn( NULL ) calls.

Working SASL security layers!

Fix typo

Rework authorization handling such that authzid u:user gets mapped to
authzdn uid=user.  Disallow authzid in DN form until we have a
validator.

Fix sasl end game processing.

Fix mech==NULL bug

Rework SASL command line arguments.  Default is now to authenticate
using best available mechanism.  (authzid prompting to be disabled)
To use simple bind, -x is required (implied if -P 2) with -D/-[Ww]
To use simple "anonymous" bind, just -x will do.

Misc cleanup

Store sasl callbacks in session handle so that they can properly freed.

Fix callbacks.

Fix SSF reporting.

rework SASL callbacks

Add logging support

Update SASL code to reuse context through life of session.
Replace 'negotiated' with 'interactive' bind
Add hooks for SASL/EXTERNAL
Disable SASL security layers
Rework SASL command line and config file parameters

Change reporting of SASL username

Return last step output in final response.
And some code cleanup.

Reverse SASL mechanism restriction #ifdef

Misc code cleanup.

Const'ification
SASL mech removed from backend bind callback (as SASL is managed by frontend)
Changes to some backends are untested (as I don't have all dependent
  software install)

Rework root dse and other info entry codes to produce entry
to caller (do_search) such that info can be used by other
operations (ie: do_compare).
SLAPD_SCHEMA_NOT_COMPAT: Add additional code to support filters (needs work)

Fix unsigned * vs unsigned long * bugs

Y2k copyright update

hostname needs to be static

Add experimental code to check simple bind passwords
against Cyrus SASLdb.  Like other cleartext mechanisms,
should be protected from eavesdropping.

Error handling changes including separation of client v. server
SASL to LDAP translation.  plus comments and other minor changes

fix -UHAVE_CYRUS_SASL

SASL: me thinks I got the states okay...  now to test.

SASL closer to working from frontend only, need to work through
states.

SASL code without backend support.   Should work with
external store, but not yet tested.  [Intent is to support
both in same server... may not be doable]

bind/sasl cleanup PRIOR TO moving call from backend to frontend

Merged in preliminary support for Cyrus SASL library;
support for DCE slash-delimited, left-to-right DNs;
support for a domain socket transport (enable with
--enable-ldapi); and extensions to URL parsing to
support the latter transport.

Add OpenLDAP RCSid to *.[ch] in clients, libraries, and servers.
Replace old Id as needed (back-tcl).
Leave updating of contribWare to contributors (for now).

Add copyright notices.

Don't have time to finish SASL right now...  this is a work in progress
but is safely tucked away behind --with-cyrus-sasl.

List supportedSASLmechanisms based upon what sasl_listmech() returns.

s/exit(1)/exit(EXIT_FAILURE)/
s/exit(0)/exit(EXIT_SUCCESS)/
add <ac/stdlib.h> where needed and other minor header adjustments

Add a little SASL framework and remove old X-DIGEST-MD5 hardcode.
This code is not called (yet).

Added call to sasl_client_auth() to enforce linking with Cyrus 1.5
(The call is a no-op in Cyrus 1.5 and doesn't exist in 2.1.)

Update copyrights for year 2002

Fix SASL/EXTERNAL looping

Fix layers installation

Fix SASL layering bug

remove cruft

Fix logging error

Imported from devel
+ Fixed clients printf/usage bugs (ITS#749)
+ Fixed slapd spasswd support (ITS#751)
+ Fixed --enable-spasswd (ITS#751)
+ Fixed ldif(5) file:/// bug (ITS#750)

Import latest from devel

Import typedef and other misc changes

Align with man page

Import latest changes from devel

Import latest from devel

Latest changes from devel

Import from devel

Merge latest devel codes into releng 2 branch.
Remove back-perl, back-sql, back-tcl from branch as they have yet
to be updated.
Additional changes are needed prior to release of alpha4.

Merge in all devel changes since 2.0-alpha2.
Move OPENLDAP_REL_ENG_2_MP forward.

Merge in all -devel changes made since branch was created.

ITS#3048 - delete slap_sasl_checkpass etc.

Import ITS#2961 fix from HEAD

Import ITS#2871 from HEAD - always set mech, don't parse realms.

ITS#2909 fix benign typo

ITS#2825 fix internal search parameters

Import lutil_passwd changes from HEAD

ITS#2762: header include fix

Lots of fixes from HEAD

internal SASL searches need to be checked for "auth" access,
not "search"/"read".

First round of imports from HEAD

Suck in latest from HEAD including modrdn fixes, lint removal

correct fix

Quick fix for bad statslog

Revert data ready loop fix
fixup gethostby problems
misc sasl fixes

SASL/EXTERNAL fixes and cleanup

backglue, sasl, and tool fixes

SASL tweaks (ITS#2000) (ITS#2202)

malloc fixes and other misc cleanup

Empty cred fix

Remove lint

workaround Cyrus SASL authcid == authzid bugs

Sync with HEAD, including
	- subclass indexing
	- bdb locker id fixes

Update saslauthz code

include <lutil.h>

Sync with HEAD

remove lint

mostly new logging

Suck in changes from HEAD
    Fix slapd schema error alignment bug
    Update slapd SASL proxy policy code
    Update slapd require "strong" check
    Update back-bdb entry locking
    Add slapd disallow bind_simple_unprotected directive
    Add back-monitor added monitorContext support
    Add slapd IPv4/v6 only options
    Ass slapd SASL setpass support
    Remove lint
    Build Environment
        Add monitor backend test
        Update <ac/socket.h> SHUT_RDWR
        Fix SASL-less build issues
        Fix back-perl build issues

Suck in latest changes from HEAD

More resyncing with HEAD

Resync with HEAD

Suck in HEAD changes since 2.1alpha

ITS#3846 don't use hashed passwords on SASL bind

Happy new year!

import fix to ITS#3419

syncrepl memleak fix

Changes from HEAD, including
+       Fixed back-bdb ignore deadlock bug (ITS#3188)
+       Fixed back-bdb pagedResults no end cookie bug (ITS#3161)
+       Fixed back-bdb pagedResults clear controls bug (ITS#3182)
+       Fixed back-bdb pagedResults ignore control bug
+       Fixed slapd internal search limit bugs (ITS#3183)
+       Added slapd -l USER/DAEMON options (ITS#3187)
+       Build environments
+               Fixed back-sql trace build

From HEAD:
New module build stuff
updateref updates, new SHADOW DBFLAGS, etc.
paging control updates
limits updates
fixed duplicate value checks
fixed permissive modify
sasl auxprop propname changes
back-bdb "" suffix fixes
fixed back-bdb/ldbm approx non-indexing fixings
updated back-sql

Suck in changes from HEAD (CHANGES needs ITS #s)
+       Fixed slapd syncrepl replication bugs
+       Fixed slapd slurpd update bugs
+       Fixed slapd inappropriate bind error disclosure bugs
+       Fixed slapd sun_path portability bug
+       Fixed slapd passwd referral memory leak
+       Fixed slapd sasl userdb checkpass bug
+       Added slapd Delivery Method syntax validation
+       Updated slapd overlay framework
+       Updated back-ldap backend
+       Updated back-meta backend

Sync with HEAD as of 14-March-2004

sync with HEAD

Fix typo in slapd's slap_auxprop_init() function (ITS#2909)

Happy new year

(Partial) Sync with HEAD

Sync with HEAD

Sync with HEAD

Sync with HEAD

Sync with HEAD

First rounded of changes in prep for 2.2.beta3

Sync with HEAD

Ready for 2.2beta

Changes from HEAD for beta

Happy new year! (belated)

ITS#3864 from HEAD

ITS#4954 c_sasl_dn fix from HEAD

ITS#4805 memleak fixes from HEAD

happy new year

Happy new year!

Sync with HEAD

Sync with HEAD

Sync with HEAD

Sync with HEAD
ready for 2.3.6?

Sync with HEAD

Sync with HEAD

Sync with HEAD

Sync with HEAD (ready for 2.3 "release"?)

Merge in recent changes to HEAD

Initial round of changes for 2.3 beta

Sync with HEAD

Sync with HEAD

Sync with HEAD

Sync with HEAD

Happy New Year!

typo in error message

ITS#5195

ITS#6441

happy belated new year

Silence warning in initializer

ITS#6373

ITS#6101

ITS#6147

Update copyright for next release

Warning cleanup: signed meets unsigned.

Warnings cleanup

ITS#5731,ITS#5732

ITS#5368

Warning cleanup: function ptr <=> void* at ldap_pvt_thread_pool_<set/get>key()

Happy new year! (belated)

Axe obsolete Cyrus 1.5 support

ITS#5298

ITS#5259

ITS#5209 Fix sasl_host may be different from global_host

ITS#3864 from HEAD

ITS#5153 from HEAD - sorted values

Sync with HEAD for OL 2.4.5

Import recent changes in 2.4 for release

Quick merge: everything from HEAD

Preliminary checkin for new access_allowed() signature. Still need
to update backends and overlays.