bind.c 11.3 KB
Newer Older
Ondřej Kuzník's avatar
Ondřej Kuzník committed
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
/* $OpenLDAP$ */
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
 *
 * Copyright 1998-2020 The OpenLDAP Foundation.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted only as authorized by the OpenLDAP
 * Public License.
 *
 * A copy of this license is available in the file LICENSE in the
 * top-level directory of the distribution or, alternatively, at
 * <http://www.OpenLDAP.org/license.html>.
 */

#include "portable.h"

#include <ac/socket.h>
#include <ac/errno.h>
#include <ac/string.h>
#include <ac/time.h>
#include <ac/unistd.h>

#include "lutil.h"
#include "slap.h"

Ondřej Kuzník's avatar
Ondřej Kuzník committed
27
/*
28
29
 * On entering the function, we've put a reference on both connections and hold
 * upstream's c_io_mutex.
Ondřej Kuzník's avatar
Ondřej Kuzník committed
30
 */
Ondřej Kuzník's avatar
Ondřej Kuzník committed
31
32
33
static int
request_bind( Operation *op )
{
Ondřej Kuzník's avatar
Ondřej Kuzník committed
34
    Connection *client = op->o_client, *upstream = op->o_upstream;
Ondřej Kuzník's avatar
Ondřej Kuzník committed
35
36
37
38
39
    BerElement *ber, *copy = NULL;
    BerValue binddn;
    ber_tag_t tag;
    ber_int_t version;

Ondřej Kuzník's avatar
Ondřej Kuzník committed
40
    ber = upstream->c_pendingber;
Ondřej Kuzník's avatar
Ondřej Kuzník committed
41
42
43
44
45
    if ( ber == NULL && (ber = ber_alloc()) == NULL ) {
        Debug( LDAP_DEBUG_ANY, "request_bind: "
                "ber_alloc failed\n" );
        goto fail;
    }
Ondřej Kuzník's avatar
Ondřej Kuzník committed
46
    upstream->c_pendingber = ber;
Ondřej Kuzník's avatar
Ondřej Kuzník committed
47
48
49
50
51
52
53
54

    if ( (copy = ber_alloc()) == NULL ) {
        goto fail;
    }
    ber_init2( copy, &op->o_request, 0 );

    tag = ber_get_int( copy, &version );
    if ( tag == LBER_ERROR ) {
Ondřej Kuzník's avatar
Ondřej Kuzník committed
55
56
        Debug( LDAP_DEBUG_PACKETS, "request_bind: "
                "failed to parse version field\n" );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
57
58
        goto fail;
    } else if ( version != LDAP_VERSION3 ) {
Ondřej Kuzník's avatar
Ondřej Kuzník committed
59
        ldap_pvt_thread_mutex_unlock( &upstream->c_io_mutex );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
60
        operation_send_reject(
61
                op, LDAP_PROTOCOL_ERROR, "LDAP version unsupported", 1 );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
62
63
64
65
66
67
        ber_free( copy, 0 );
        return 0;
    }

    tag = ber_get_stringbv( copy, &binddn, LBER_BV_NOTERM );
    if ( tag == LBER_ERROR ) {
Ondřej Kuzník's avatar
Ondřej Kuzník committed
68
69
        Debug( LDAP_DEBUG_PACKETS, "request_bind: "
                "failed to parse bind name field\n" );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
70
71
72
        goto fail;
    }

73
    CONNECTION_LOCK(client);
Ondřej Kuzník's avatar
Ondřej Kuzník committed
74
75
    if ( !BER_BVISNULL( &client->c_auth ) ) {
        ch_free( client->c_auth.bv_val );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
76
77
78
79
    }

    if ( !BER_BVISEMPTY( &binddn ) ) {
        char *ptr;
Ondřej Kuzník's avatar
Ondřej Kuzník committed
80
81
        client->c_auth.bv_len = STRLENOF("dn:") + binddn.bv_len;
        client->c_auth.bv_val = ch_malloc( client->c_auth.bv_len + 1 );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
82

Ondřej Kuzník's avatar
Ondřej Kuzník committed
83
        ptr = lutil_strcopy( client->c_auth.bv_val, "dn:" );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
84
85
86
        ptr = lutil_strncopy( ptr, binddn.bv_val, binddn.bv_len );
        *ptr = '\0';
    } else {
Ondřej Kuzník's avatar
Ondřej Kuzník committed
87
        BER_BVZERO( &client->c_auth );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
88
    }
89
    CONNECTION_UNLOCK(client);
Ondřej Kuzník's avatar
Ondřej Kuzník committed
90

91
    CONNECTION_LOCK(upstream);
Ondřej Kuzník's avatar
Ondřej Kuzník committed
92
    op->o_upstream_msgid = upstream->c_next_msgid++;
Ondřej Kuzník's avatar
Ondřej Kuzník committed
93
94
95
96
97
98

    ber_printf( ber, "t{titOtO}", LDAP_TAG_MESSAGE,
            LDAP_TAG_MSGID, op->o_upstream_msgid,
            LDAP_REQ_BIND, &op->o_request,
            LDAP_TAG_CONTROLS, BER_BV_OPTIONAL( &op->o_ctrls ) );

99
    Debug( LDAP_DEBUG_TRACE, "request_bind: "
Ondřej Kuzník's avatar
Ondřej Kuzník committed
100
101
            "added bind from client connid=%lu to upstream connid=%lu "
            "as msgid=%d\n",
102
            op->o_client_connid, op->o_upstream_connid, op->o_upstream_msgid );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
103
104
    if ( tavl_insert( &upstream->c_ops, op, operation_upstream_cmp,
                 avl_dup_error ) ) {
Ondřej Kuzník's avatar
Ondřej Kuzník committed
105
106
        assert(0);
    }
Ondřej Kuzník's avatar
Ondřej Kuzník committed
107
    upstream->c_state = SLAP_C_ACTIVE;
108
    CONNECTION_UNLOCK(upstream);
Ondřej Kuzník's avatar
Ondřej Kuzník committed
109

Ondřej Kuzník's avatar
Ondřej Kuzník committed
110
    ldap_pvt_thread_mutex_unlock( &upstream->c_io_mutex );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
111
112

    ber_free( copy, 0 );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
113
    upstream_write_cb( -1, 0, upstream );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
114
115
116
117
118
119
    return 0;

fail:
    if ( copy ) {
        ber_free( copy, 0 );
    }
Ondřej Kuzník's avatar
Ondřej Kuzník committed
120
    ldap_pvt_thread_mutex_unlock( &upstream->c_io_mutex );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
121
122
123
    Debug( LDAP_DEBUG_STATS, "request_bind: "
            "connid=%lu bind request processing failed, closing\n",
            client->c_connid );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
124
125
126
    return 1;
}

127
#ifdef LDAP_API_FEATURE_VERIFY_CREDENTIALS
Ondřej Kuzník's avatar
Ondřej Kuzník committed
128
/*
129
130
 * On entering the function, we've put a reference on both connections and hold
 * upstream's c_io_mutex.
Ondřej Kuzník's avatar
Ondřej Kuzník committed
131
 */
Ondřej Kuzník's avatar
Ondřej Kuzník committed
132
133
134
static int
request_bind_as_vc( Operation *op )
{
Ondřej Kuzník's avatar
Ondřej Kuzník committed
135
    Connection *client = op->o_client, *upstream = op->o_upstream;
Ondřej Kuzník's avatar
Ondřej Kuzník committed
136
137
    BerElement *ber, *request, *copy = NULL;
    BerValue binddn, auth, mech;
138
139
    char *msg = "internal error";
    int result = LDAP_OTHER;
Ondřej Kuzník's avatar
Ondřej Kuzník committed
140
141
142
143
144
145
146
147
148
149
150
    ber_int_t version;
    ber_tag_t tag;
    ber_len_t len;

    if ( (request = ber_alloc()) == NULL ) {
        goto fail;
    }
    ber_init2( request, &op->o_request, 0 );

    tag = ber_scanf( request, "im", &version, &binddn );
    if ( tag == LBER_ERROR || version != LDAP_VERSION3 ) {
151
152
        result = LDAP_PROTOCOL_ERROR;
        msg = "version not recognised";
Ondřej Kuzník's avatar
Ondřej Kuzník committed
153
154
155
156
157
158
159
160
161
162
        goto fail;
    }

    copy = ber_dup( request );
    if ( !copy ) {
        goto fail;
    }

    tag = ber_skip_element( request, &auth );
    if ( tag == LBER_ERROR ) {
163
164
        result = LDAP_PROTOCOL_ERROR;
        msg = "malformed bind request";
Ondřej Kuzník's avatar
Ondřej Kuzník committed
165
166
167
        goto fail;
    }

Ondřej Kuzník's avatar
Ondřej Kuzník committed
168
    ber = upstream->c_pendingber;
Ondřej Kuzník's avatar
Ondřej Kuzník committed
169
170
171
172
173
    if ( ber == NULL && (ber = ber_alloc()) == NULL ) {
        Debug( LDAP_DEBUG_ANY, "request_bind_as_vc: "
                "ber_alloc failed\n" );
        goto fail;
    }
Ondřej Kuzník's avatar
Ondřej Kuzník committed
174
    upstream->c_pendingber = ber;
Ondřej Kuzník's avatar
Ondřej Kuzník committed
175

Ondřej Kuzník's avatar
Ondřej Kuzník committed
176
    op->o_upstream_msgid = upstream->c_next_msgid++;
Ondřej Kuzník's avatar
Ondřej Kuzník committed
177

178
    CONNECTION_LOCK(upstream);
Ondřej Kuzník's avatar
Ondřej Kuzník committed
179
180
181
182
183
    ber_printf( ber, "t{tit{tst{{tOOtOtO}}}}", LDAP_TAG_MESSAGE,
            LDAP_TAG_MSGID, op->o_upstream_msgid,
            LDAP_REQ_EXTENDED,
            LDAP_TAG_EXOP_REQ_OID, LDAP_EXOP_VERIFY_CREDENTIALS,
            LDAP_TAG_EXOP_REQ_VALUE,
Ondřej Kuzník's avatar
Ondřej Kuzník committed
184
            LDAP_TAG_EXOP_VERIFY_CREDENTIALS_COOKIE, BER_BV_OPTIONAL( &upstream->c_vc_cookie ),
Ondřej Kuzník's avatar
Ondřej Kuzník committed
185
186
            &binddn, tag, &auth,
            LDAP_TAG_EXOP_VERIFY_CREDENTIALS_CONTROLS, BER_BV_OPTIONAL( &op->o_ctrls ) );
187
    CONNECTION_UNLOCK(upstream);
Ondřej Kuzník's avatar
Ondřej Kuzník committed
188
189
190
191
192

    tag = ber_peek_tag( copy, &len );
    switch ( tag ) {
        case LDAP_AUTH_SASL:
            ber_get_stringbv( copy, &mech, LBER_BV_NOTERM );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
193

194
            CONNECTION_LOCK(client);
Ondřej Kuzník's avatar
Ondřej Kuzník committed
195
196
197
            if ( ber_bvcmp( &mech, &client->c_sasl_bind_mech ) ) {
                ber_memfree( client->c_sasl_bind_mech.bv_val );
                ber_dupbv( &client->c_sasl_bind_mech, &mech );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
198
            }
199
            CONNECTION_UNLOCK(client);
Ondřej Kuzník's avatar
Ondřej Kuzník committed
200
201
202
            /* TODO: extract authzdn from the message */
            break;
        case LDAP_AUTH_SIMPLE:
203
            CONNECTION_LOCK(client);
Ondřej Kuzník's avatar
Ondřej Kuzník committed
204
205
            if ( !BER_BVISNULL( &client->c_auth ) ) {
                ch_free( client->c_auth.bv_val );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
206
            }
Ondřej Kuzník's avatar
Ondřej Kuzník committed
207
208
            if ( !BER_BVISEMPTY( &binddn ) ) {
                char *ptr;
Ondřej Kuzník's avatar
Ondřej Kuzník committed
209
210
                client->c_auth.bv_len = STRLENOF("dn:") + binddn.bv_len;
                client->c_auth.bv_val = ch_malloc( client->c_auth.bv_len + 1 );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
211

Ondřej Kuzník's avatar
Ondřej Kuzník committed
212
                ptr = lutil_strcopy( client->c_auth.bv_val, "dn:" );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
213
214
215
                ptr = lutil_strncopy( ptr, binddn.bv_val, binddn.bv_len );
                *ptr = '\0';
            } else {
Ondřej Kuzník's avatar
Ondřej Kuzník committed
216
                BER_BVZERO( &client->c_auth );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
217
218
            }

Ondřej Kuzník's avatar
Ondřej Kuzník committed
219
220
221
            if ( !BER_BVISNULL( &client->c_sasl_bind_mech ) ) {
                ber_memfree( client->c_sasl_bind_mech.bv_val );
                BER_BVZERO( &client->c_sasl_bind_mech );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
222
            }
223
            CONNECTION_UNLOCK(client);
Ondřej Kuzník's avatar
Ondřej Kuzník committed
224
225
            break;
        default:
226
227
            result = LDAP_PROTOCOL_ERROR;
            msg = "malformed bind request";
Ondřej Kuzník's avatar
Ondřej Kuzník committed
228
229
            goto fail;
    }
Ondřej Kuzník's avatar
Ondřej Kuzník committed
230

231
    CONNECTION_LOCK(upstream);
232
    Debug( LDAP_DEBUG_TRACE, "request_bind_as_vc: "
Ondřej Kuzník's avatar
Ondřej Kuzník committed
233
234
            "added bind from client connid=%lu to upstream connid=%lu "
            "as VC exop msgid=%d\n",
235
            op->o_client_connid, op->o_upstream_connid, op->o_upstream_msgid );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
236
237
    if ( tavl_insert( &upstream->c_ops, op, operation_upstream_cmp,
                 avl_dup_error ) ) {
Ondřej Kuzník's avatar
Ondřej Kuzník committed
238
239
        assert(0);
    }
240
    CONNECTION_UNLOCK(upstream);
Ondřej Kuzník's avatar
Ondřej Kuzník committed
241

Ondřej Kuzník's avatar
Ondřej Kuzník committed
242
    ldap_pvt_thread_mutex_unlock( &upstream->c_io_mutex );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
243
244

    ber_free( copy, 0 );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
245
    upstream_write_cb( -1, 0, upstream );
246

Ondřej Kuzník's avatar
Ondřej Kuzník committed
247
248
249
250
251
252
    return 0;

fail:
    if ( copy ) {
        ber_free( copy, 0 );
    }
Ondřej Kuzník's avatar
Ondřej Kuzník committed
253
    ldap_pvt_thread_mutex_unlock( &upstream->c_io_mutex );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
254
255
256
    Debug( LDAP_DEBUG_STATS, "request_bind_as_vc: "
            "connid=%lu bind request processing failed, closing\n",
            client->c_connid );
257
    operation_send_reject( op, result, msg, 1 );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
258
259
    return 1;
}
260
#endif /* LDAP_API_FEATURE_VERIFY_CREDENTIALS */
Ondřej Kuzník's avatar
Ondřej Kuzník committed
261

262
263
void
client_reset( Connection *c )
Ondřej Kuzník's avatar
Ondřej Kuzník committed
264
265
266
267
268
{
    TAvlnode *root;

    root = c->c_ops;
    c->c_ops = NULL;
Ondřej Kuzník's avatar
Ondřej Kuzník committed
269
270
271
272
273
274
275
276
277
278
279
280
281
282

    /* unless op->o_client_refcnt > op->o_client_live, there is noone using the
     * operation from the client side and noone new will now that we've removed
     * it from client's c_ops */
    if ( root ) {
        TAvlnode *node = tavl_end( root, TAVL_DIR_LEFT );
        do {
            Operation *op = node->avl_data;

            /* make sure it's useable after we've unlocked the connection */
            op->o_client_refcnt++;
        } while ( (node = tavl_next( node, TAVL_DIR_RIGHT )) );
    }

Ondřej Kuzník's avatar
Ondřej Kuzník committed
283
284
285
286
287
288
289
290
    if ( !BER_BVISNULL( &c->c_auth ) ) {
        ch_free( c->c_auth.bv_val );
        BER_BVZERO( &c->c_auth );
    }
    if ( !BER_BVISNULL( &c->c_sasl_bind_mech ) ) {
        ch_free( c->c_sasl_bind_mech.bv_val );
        BER_BVZERO( &c->c_sasl_bind_mech );
    }
291
    CONNECTION_UNLOCK_INCREF(c);
Ondřej Kuzník's avatar
Ondřej Kuzník committed
292

Ondřej Kuzník's avatar
Ondřej Kuzník committed
293
    if ( root ) {
294
295
        int freed;
        freed = tavl_free( root, (AVL_FREE)operation_abandon );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
296
297
298
299
        Debug( LDAP_DEBUG_TRACE, "client_reset: "
                "dropped %d operations\n",
                freed );
    }
Ondřej Kuzník's avatar
Ondřej Kuzník committed
300

301
    CONNECTION_LOCK_DECREF(c);
Ondřej Kuzník's avatar
Ondřej Kuzník committed
302
303
}

304
305
int
client_bind( Connection *client, Operation *op )
Ondřej Kuzník's avatar
Ondřej Kuzník committed
306
{
307
308
    Connection *upstream;
    int rc = LDAP_SUCCESS;
Ondřej Kuzník's avatar
Ondřej Kuzník committed
309

310
    /* protect the Bind operation */
Ondřej Kuzník's avatar
Ondřej Kuzník committed
311
    op->o_client_refcnt++;
312
    tavl_delete( &client->c_ops, op, operation_client_cmp );
313

314
    client_reset( client );
315

316
317
318
    client->c_state = SLAP_C_BINDING;
    client->c_type = SLAP_C_OPEN;

319
320
    rc = tavl_insert( &client->c_ops, op, operation_client_cmp, avl_dup_error );
    assert( rc == LDAP_SUCCESS );
321
    CONNECTION_UNLOCK_INCREF(client);
Ondřej Kuzník's avatar
Ondřej Kuzník committed
322
323
324
325

    upstream = backend_select( op );
    if ( !upstream ) {
        Debug( LDAP_DEBUG_STATS, "client_bind: "
Ondřej Kuzník's avatar
Ondřej Kuzník committed
326
327
                "connid=%lu, msgid=%d no available connection found\n",
                op->o_client_connid, op->o_client_msgid );
Ondřej Kuzník's avatar
Ondřej Kuzník committed
328
        operation_send_reject(
329
                op, LDAP_UNAVAILABLE, "no connections available", 1 );
330
        CONNECTION_LOCK_DECREF(client);
Ondřej Kuzník's avatar
Ondřej Kuzník committed
331
332
        op->o_client_refcnt--;
        operation_destroy_from_client( op );
333
        return rc;
Ondřej Kuzník's avatar
Ondřej Kuzník committed
334
335
336
    }

    op->o_upstream = upstream;
337
    op->o_upstream_connid = upstream->c_connid;
338
339

#ifdef LDAP_API_FEATURE_VERIFY_CREDENTIALS
Ondřej Kuzník's avatar
Ondřej Kuzník committed
340
    if ( lload_features & LLOAD_FEATURE_VC ) {
Ondřej Kuzník's avatar
Ondřej Kuzník committed
341
        rc = request_bind_as_vc( op );
342
343
344
    } else
#endif /* LDAP_API_FEATURE_VERIFY_CREDENTIALS */
    {
Ondřej Kuzník's avatar
Ondřej Kuzník committed
345
346
347
        rc = request_bind( op );
    }

348
349
350
    CONNECTION_LOCK_DECREF(upstream);
    UPSTREAM_UNLOCK_OR_DESTROY(upstream);

351
    CONNECTION_LOCK_DECREF(client);
Ondřej Kuzník's avatar
Ondřej Kuzník committed
352
    if ( rc ) {
Ondřej Kuzník's avatar
Ondřej Kuzník committed
353
354
        op->o_client_refcnt--;
        operation_destroy_from_client( op );
355
356
        CLIENT_DESTROY(client);
        return -1;
Ondřej Kuzník's avatar
Ondřej Kuzník committed
357
358
    }

Ondřej Kuzník's avatar
Ondřej Kuzník committed
359
360
    if ( !--op->o_client_refcnt ) {
        operation_destroy_from_client( op );
361
362
363
364
365
366
367
368
369
370
371
372
        if ( client->c_state == SLAP_C_BINDING ) {
            client->c_state = SLAP_C_READY;
            client->c_type = SLAP_C_OPEN;
            if ( !BER_BVISNULL( &client->c_auth ) ) {
                ber_memfree( client->c_auth.bv_val );
                BER_BVZERO( &client->c_auth );
            }
            if ( !BER_BVISNULL( &client->c_sasl_bind_mech ) ) {
                ber_memfree( client->c_sasl_bind_mech.bv_val );
                BER_BVZERO( &client->c_sasl_bind_mech );
            }
        }
Ondřej Kuzník's avatar
Ondřej Kuzník committed
373
    }
Ondřej Kuzník's avatar
Ondřej Kuzník committed
374

375
    return rc;
Ondřej Kuzník's avatar
Ondřej Kuzník committed
376
}