Commit 639c5912 authored by Ondřej Kuzník's avatar Ondřej Kuzník Committed by Ondřej Kuzník
Browse files

Client authentication

parent e5f68bcf
......@@ -21,10 +21,10 @@ XSRCS = version.c
NT_SRCS = nt_svc.c
NT_OBJS = nt_svc.o ../../libraries/liblutil/slapdmsg.res
SRCS = main.c globals.c backend.c config.c connection.c client.c daemon.c \
ch_malloc.c init.c operation.c user.c sl_malloc.c upstream.c value.c \
libevent_support.c \
$(@PLAT@_SRCS)
SRCS = main.c globals.c backend.c bind.c config.c connection.c client.c \
daemon.c ch_malloc.c init.c operation.c user.c sl_malloc.c \
upstream.c value.c libevent_support.c \
$(@PLAT@_SRCS)
OBJS = $(patsubst %.c,%.o,$(SRCS)) $(@PLAT@_OBJS)
......
......@@ -86,12 +86,12 @@ backend_select( Operation *op )
ldap_pvt_thread_mutex_lock( &b->b_mutex );
c = b->b_conns;
ldap_pvt_thread_mutex_lock( &c->c_mutex );
ldap_pvt_thread_mutex_lock( &c->c_io_mutex );
if ( c->c_state == SLAP_C_READY && !c->c_pendingber ) {
ldap_pvt_thread_mutex_unlock( &b->b_mutex );
return b->b_conns;
}
ldap_pvt_thread_mutex_unlock( &c->c_mutex );
ldap_pvt_thread_mutex_unlock( &c->c_io_mutex );
ldap_pvt_thread_mutex_unlock( &b->b_mutex );
}
......
/* $OpenLDAP$ */
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
*
* Copyright 1998-2020 The OpenLDAP Foundation.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted only as authorized by the OpenLDAP
* Public License.
*
* A copy of this license is available in the file LICENSE in the
* top-level directory of the distribution or, alternatively, at
* <http://www.OpenLDAP.org/license.html>.
*/
#include "portable.h"
#include <ac/socket.h>
#include <ac/errno.h>
#include <ac/string.h>
#include <ac/time.h>
#include <ac/unistd.h>
#include "lutil.h"
#include "slap.h"
static int
request_bind( Operation *op )
{
Connection *c = op->o_upstream;
BerElement *ber, *copy = NULL;
BerValue binddn;
ber_tag_t tag;
ber_int_t version;
ber = c->c_pendingber;
if ( ber == NULL && (ber = ber_alloc()) == NULL ) {
Debug( LDAP_DEBUG_ANY, "request_bind: "
"ber_alloc failed\n" );
goto fail;
}
c->c_pendingber = ber;
if ( (copy = ber_alloc()) == NULL ) {
goto fail;
}
ber_init2( copy, &op->o_request, 0 );
tag = ber_get_int( copy, &version );
if ( tag == LBER_ERROR ) {
goto fail;
} else if ( version != LDAP_VERSION3 ) {
/* TODO: result code and message */
operation_send_reject(
op, LDAP_PROTOCOL_ERROR, "LDAP version unsupported" );
ber_free( copy, 0 );
return 0;
}
tag = ber_get_stringbv( copy, &binddn, LBER_BV_NOTERM );
if ( tag == LBER_ERROR ) {
goto fail;
}
ldap_pvt_thread_mutex_lock( &c->c_mutex );
if ( !BER_BVISNULL( &c->c_auth ) ) {
ber_memfree( c->c_auth.bv_val );
}
if ( !BER_BVISEMPTY( &binddn ) ) {
char *ptr;
c->c_auth.bv_len = STRLENOF("dn:") + binddn.bv_len;
c->c_auth.bv_val = ch_malloc( c->c_auth.bv_len + 1 );
ptr = lutil_strcopy( c->c_auth.bv_val, "dn:" );
ptr = lutil_strncopy( ptr, binddn.bv_val, binddn.bv_len );
*ptr = '\0';
} else {
BER_BVZERO( &c->c_auth );
}
op->o_upstream_msgid = c->c_next_msgid++;
ber_printf( ber, "t{titOtO}", LDAP_TAG_MESSAGE,
LDAP_TAG_MSGID, op->o_upstream_msgid,
LDAP_REQ_BIND, &op->o_request,
LDAP_TAG_CONTROLS, BER_BV_OPTIONAL( &op->o_ctrls ) );
if ( tavl_insert( &c->c_ops, op, operation_upstream_cmp, avl_dup_error ) ) {
assert(0);
}
ldap_pvt_thread_mutex_unlock( &c->c_mutex );
ldap_pvt_thread_mutex_unlock( &c->c_io_mutex );
ber_free( copy, 0 );
upstream_write_cb( -1, 0, c );
return 0;
fail:
if ( copy ) {
ber_free( copy, 0 );
}
ldap_pvt_thread_mutex_unlock( &c->c_io_mutex );
ldap_pvt_thread_mutex_lock( &op->o_client->c_mutex );
client_destroy( op->o_client );
return 1;
}
static int
request_bind_as_vc( Operation *op )
{
Connection *c = op->o_upstream;
BerElement *ber, *request, *copy = NULL;
BerValue binddn, auth, mech;
ber_int_t version;
ber_tag_t tag;
ber_len_t len;
if ( (request = ber_alloc()) == NULL ) {
goto fail;
}
ber_init2( request, &op->o_request, 0 );
tag = ber_scanf( request, "im", &version, &binddn );
if ( tag == LBER_ERROR || version != LDAP_VERSION3 ) {
goto fail;
}
copy = ber_dup( request );
if ( !copy ) {
goto fail;
}
tag = ber_skip_element( request, &auth );
if ( tag == LBER_ERROR ) {
goto fail;
}
ber = c->c_pendingber;
if ( ber == NULL && (ber = ber_alloc()) == NULL ) {
Debug( LDAP_DEBUG_ANY, "request_bind_as_vc: "
"ber_alloc failed\n" );
goto fail;
}
c->c_pendingber = ber;
op->o_upstream_msgid = c->c_next_msgid++;
ldap_pvt_thread_mutex_lock( &c->c_mutex );
ber_printf( ber, "t{tit{tst{{tOOtOtO}}}}", LDAP_TAG_MESSAGE,
LDAP_TAG_MSGID, op->o_upstream_msgid,
LDAP_REQ_EXTENDED,
LDAP_TAG_EXOP_REQ_OID, LDAP_EXOP_VERIFY_CREDENTIALS,
LDAP_TAG_EXOP_REQ_VALUE,
LDAP_TAG_EXOP_VERIFY_CREDENTIALS_COOKIE, BER_BV_OPTIONAL( &c->c_vc_cookie ),
&binddn, tag, &auth,
LDAP_TAG_EXOP_VERIFY_CREDENTIALS_CONTROLS, BER_BV_OPTIONAL( &op->o_ctrls ) );
tag = ber_peek_tag( copy, &len );
switch ( tag ) {
case LDAP_AUTH_SASL:
ber_get_stringbv( copy, &mech, LBER_BV_NOTERM );
if ( ber_bvcmp( &mech, &c->c_sasl_bind_mech ) ) {
ber_memfree( c->c_sasl_bind_mech.bv_val );
ber_dupbv( &c->c_sasl_bind_mech, &mech );
}
/* TODO: extract authzdn from the message */
break;
case LDAP_AUTH_SIMPLE:
if ( !BER_BVISNULL( &c->c_auth ) ) {
ber_memfree( c->c_auth.bv_val );
}
ber_dupbv( &c->c_auth, &binddn );
if ( !BER_BVISNULL( &c->c_sasl_bind_mech ) ) {
ber_memfree( c->c_sasl_bind_mech.bv_val );
BER_BVZERO( &c->c_sasl_bind_mech );
}
break;
default:
ldap_pvt_thread_mutex_unlock( &c->c_mutex );
goto fail;
}
if ( tavl_insert( &c->c_ops, op, operation_upstream_cmp, avl_dup_error ) ) {
assert(0);
}
ldap_pvt_thread_mutex_unlock( &c->c_mutex );
ldap_pvt_thread_mutex_unlock( &c->c_io_mutex );
ber_free( copy, 0 );
upstream_write_cb( -1, 0, c );
return 0;
fail:
if ( copy ) {
ber_free( copy, 0 );
}
ldap_pvt_thread_mutex_unlock( &c->c_io_mutex );
ldap_pvt_thread_mutex_lock( &op->o_client->c_mutex );
client_destroy( op->o_client );
return 1;
}
void *
client_reset( void *ctx, void *arg )
{
Operation *op = arg;
Connection *c = op->o_client;
TAvlnode *root;
int freed, destroy = 1;
ldap_pvt_thread_mutex_lock( &c->c_mutex );
root = c->c_ops;
c->c_ops = NULL;
c->c_state = SLAP_C_CLOSING;
if ( op->o_tag == LDAP_REQ_BIND ) {
c->c_state = SLAP_C_BINDING;
destroy = 0;
}
ldap_pvt_thread_mutex_unlock( &c->c_mutex );
tavl_delete( &root, op, operation_client_cmp );
freed = tavl_free( root, (AVL_FREE)operation_abandon );
Debug( LDAP_DEBUG_TRACE, "client_reset: "
"dropped %d operations\n",
freed );
if ( destroy ) {
operation_destroy( op );
ldap_pvt_thread_mutex_lock( &c->c_mutex );
client_destroy( c );
}
return NULL;
}
void *
client_bind( void *ctx, void *arg )
{
Operation *op = arg;
Connection *upstream, *client = op->o_client;
int rc = 0;
client_reset( ctx, arg );
upstream = backend_select( op );
if ( !upstream ) {
Debug( LDAP_DEBUG_STATS, "client_bind: "
"no available connection found\n" );
operation_send_reject(
op, LDAP_UNAVAILABLE, "no connections available" );
return NULL;
}
op->o_upstream = upstream;
if ( upstream->c_features & SLAP_C_VC ) {
rc = request_bind_as_vc( op );
} else {
rc = request_bind( op );
}
if ( rc ) {
/* client doesn't exist anymore */
return NULL;
}
ldap_pvt_thread_mutex_lock( &client->c_mutex );
rc = tavl_insert( &client->c_ops, op, operation_client_cmp, avl_dup_error );
assert( rc == LDAP_SUCCESS );
ldap_pvt_thread_mutex_unlock( &client->c_mutex );
return NULL;
}
......@@ -24,16 +24,15 @@
#include "lutil.h"
#include "slap.h"
static void client_destroy( Connection *c );
static void
client_read_cb( evutil_socket_t s, short what, void *arg )
{
Connection *c = arg;
BerElement *ber;
Operation *op;
Operation *op = NULL;
ber_tag_t tag;
ber_len_t len;
int rc = 0;
ldap_pvt_thread_mutex_lock( &c->c_mutex );
Debug( LDAP_DEBUG_CONNS, "client_read_cb: "
......@@ -71,26 +70,47 @@ client_read_cb( evutil_socket_t s, short what, void *arg )
if ( !op ) {
Debug( LDAP_DEBUG_ANY, "client_read_cb: "
"operation_init failed\n" );
ber_free( ber, 1 );
goto fail;
}
if ( ldap_pvt_thread_pool_submit(
&connection_pool, operation_process, op ) ) {
/* what could have happened? */
switch ( op->o_tag ) {
case LDAP_REQ_UNBIND:
/* We do not expect anything more from the client */
event_del( c->c_read_event );
rc = ldap_pvt_thread_pool_submit(
&connection_pool, client_reset, op );
if ( rc ) {
tavl_delete( &c->c_ops, op, operation_client_cmp );
operation_destroy( op );
client_destroy( c );
return;
}
break;
case LDAP_REQ_BIND:
rc = ldap_pvt_thread_pool_submit(
&connection_pool, client_bind, op );
break;
default:
rc = ldap_pvt_thread_pool_submit(
&connection_pool, request_process, op );
break;
}
if ( !rc ) {
ldap_pvt_thread_mutex_unlock( &c->c_mutex );
operation_destroy( op );
ldap_pvt_thread_mutex_lock( &c->c_mutex );
goto fail;
return;
}
ldap_pvt_thread_mutex_unlock( &c->c_mutex );
return;
fail:
client_destroy( c );
if ( ber ) {
ber_free( ber, 1 );
if ( op ) {
tavl_delete( &c->c_ops, op, operation_client_cmp );
op->o_client = NULL;
operation_destroy( op );
}
client_destroy( c );
return;
}
......@@ -171,12 +191,14 @@ fail:
return NULL;
}
static void
void
client_destroy( Connection *c )
{
assert( c->c_read_event != NULL );
event_del( c->c_read_event );
event_free( c->c_read_event );
assert( c->c_write_event != NULL );
event_del( c->c_write_event );
event_free( c->c_write_event );
......
......@@ -108,6 +108,8 @@ operation_destroy( Operation *op )
{
Connection *c;
ber_free( op->o_ber, 1 );
/* TODO: this is a stopgap and there are many races here, just get
* something in to test with until we implement the freelist */
if ( op->o_client ) {
......@@ -137,6 +139,7 @@ operation_init( Connection *c, BerElement *ber )
op = ch_calloc( 1, sizeof(Operation) );
op->o_client = c;
op->o_ber = ber;
tag = ber_get_int( ber, &op->o_client_msgid );
if ( tag != LDAP_TAG_MSGID ) {
......@@ -179,8 +182,97 @@ fail:
return NULL;
}
void
operation_abandon( Operation *op )
{
int rc;
if ( op->o_upstream ) {
Connection *c = op->o_upstream;
BerElement *ber;
ldap_pvt_thread_mutex_lock( &c->c_mutex );
rc = ( tavl_delete( &c->c_ops, op, operation_upstream_cmp ) == NULL );
ldap_pvt_thread_mutex_unlock( &c->c_mutex );
if ( rc ) {
/* The operation has already been abandoned or finished */
goto done;
}
ldap_pvt_thread_mutex_lock( &c->c_io_mutex );
ber = c->c_pendingber;
if ( ber == NULL && (ber = ber_alloc()) == NULL ) {
Debug( LDAP_DEBUG_ANY, "operation_abandon: "
"ber_alloc failed\n" );
ldap_pvt_thread_mutex_unlock( &c->c_io_mutex );
return;
}
c->c_pendingber = ber;
rc = ber_printf( ber, "t{titi}", LDAP_TAG_MESSAGE,
LDAP_TAG_MSGID, c->c_next_msgid++,
LDAP_REQ_ABANDON, op->o_upstream_msgid );
ldap_pvt_thread_mutex_unlock( &c->c_io_mutex );
if ( rc == -1 ) {
ber_free( ber, 1 );
return;
}
upstream_write_cb( -1, 0, c );
}
done:
operation_destroy( op );
}
void
operation_send_reject( Operation *op, int result, const char *msg )
{
Connection *c = op->o_client;
BerElement *ber;
int found;
ldap_pvt_thread_mutex_lock( &c->c_mutex );
found = ( tavl_delete( &c->c_ops, op, operation_client_cmp ) == op );
ldap_pvt_thread_mutex_unlock( &c->c_mutex );
if ( !found ) {
return;
}
ldap_pvt_thread_mutex_lock( &c->c_io_mutex );
ber = c->c_pendingber;
if ( ber == NULL && (ber = ber_alloc()) == NULL ) {
ldap_pvt_thread_mutex_unlock( &c->c_io_mutex );
client_destroy( c );
return;
}
c->c_pendingber = ber;
ber_printf( ber, "t{tit{ess}}", LDAP_TAG_MESSAGE,
LDAP_TAG_MSGID, op->o_client_msgid,
slap_req2res( op->o_tag ), result, "", msg );
ldap_pvt_thread_mutex_unlock( &c->c_io_mutex );
client_write_cb( -1, 0, c );
operation_destroy( op );
}
void
operation_lost_upstream( Operation *op )
{
operation_send_reject( op, LDAP_UNAVAILABLE,
"connection to the remote server has been severed" );
}
void *
operation_process( void *ctx, void *arg )
request_process( void *ctx, void *arg )
{
Operation *op = arg;
BerElement *output;
......@@ -190,33 +282,34 @@ operation_process( void *ctx, void *arg )
c = backend_select( op );
if ( !c ) {
Debug( LDAP_DEBUG_STATS, "operation_process: "
Debug( LDAP_DEBUG_STATS, "request_process: "
"no available connection found\n" );
goto fail;
}
op->o_upstream = c;
c->c_pendingber = output = ber_alloc();
if ( !output ) {
output = c->c_pendingber;
if ( output == NULL && (output = ber_alloc()) == NULL ) {
goto fail;
}
c->c_pendingber = output;
ldap_pvt_thread_mutex_lock( &c->c_mutex );
op->o_upstream_msgid = msgid = c->c_next_msgid++;
rc = tavl_insert( &c->c_ops, op, operation_upstream_cmp, avl_dup_error );
assert( rc == LDAP_SUCCESS );
ldap_pvt_thread_mutex_unlock( &c->c_mutex );
ber_start_seq( output, LDAP_TAG_MESSAGE );
ber_put_int( output, msgid, LDAP_TAG_MSGID );
ber_put_berval( output, &op->o_request, op->o_tag );
if ( !BER_BVISNULL( &op->o_ctrls ) ) {
ber_put_berval( output, &op->o_ctrls, LDAP_TAG_CONTROLS );
}
ber_put_seq( output );
ber_printf( output, "t{titOtO}", LDAP_TAG_MESSAGE,
LDAP_TAG_MSGID, msgid,
op->o_tag, &op->o_request,
LDAP_TAG_CONTROLS, BER_BV_OPTIONAL( &op->o_ctrls ) );
ldap_pvt_thread_mutex_unlock( &c->c_io_mutex );
ldap_pvt_thread_mutex_unlock( &c->c_mutex );
upstream_write_cb( -1, 0, c );
return NULL;
fail:
operation_send_reject( op, LDAP_OTHER, "internal error" );
return NULL;
}
......@@ -58,11 +58,18 @@ LDAP_SLAPD_F (void) ch_free( void * );
#define free ch_free
#endif
/*
* bind.c
*/
LDAP_SLAPD_F (void *) client_reset( void *ctx, void *arg );
LDAP_SLAPD_F (void *) client_bind( void *ctx, void *arg );
/*
* client.c
*/
LDAP_SLAPD_F (Connection *) client_init( ber_socket_t s, Listener *url, const char *peername, struct event_base *base, int use_tls );
LDAP_SLAPD_F (void) client_write_cb( evutil_socket_t s, short what, void *arg );
LDAP_SLAPD_F (void) client_destroy( Connection *c );
/*
* config.c
......@@ -139,9 +146,12 @@ LDAP_SLAPD_V (const char *) slapd_slp_attrs;
LDAP_SLAPD_F (const char *) slap_msgtype2str( ber_tag_t tag );
LDAP_SLAPD_F (int) operation_upstream_cmp( const void *l, const void *r );
LDAP_SLAPD_F (int) operation_client_cmp( const void *l, const void *r );
LDAP_SLAPD_F (void *) operation_process( void *ctx, void *arg );
LDAP_SLAPD_F (Operation *) operation_init( Connection *c, BerElement *ber );
LDAP_SLAPD_F (void) operation_abandon( Operation *op );
LDAP_SLAPD_F (void) operation_send_reject( Operation *op, int result, const char *msg );
LDAP_SLAPD_F (void) operation_lost_upstream( Operation *op );
LDAP_SLAPD_F (void) operation_destroy( Operation *op );
LDAP_SLAPD_F (void *) request_process( void *ctx, void *arg );
/*
* sl_malloc.c
......@@ -168,6 +178,7 @@ LDAP_SLAPD_F (void *) slap_sl_context( void *ptr );
LDAP_SLAPD_F (void) upstream_write_cb( evutil_socket_t s, short what, void *arg );
LDAP_SLAPD_F (void) upstream_read_cb( evutil_socket_t s, short what, void *arg );
LDAP_SLAPD_F (Connection *) upstream_init( ber_socket_t s, Backend *b );
LDAP_SLAPD_F (void) upstream_destroy( Connection *c );
/*
* user.c
......
......@@ -233,6 +233,7 @@ enum lload_tls_type {
LLOAD_STARTTLS,
};
/* Can hold mutex when locking a linked connection */
struct Backend {
struct slap_bindconf b_bindconf;
ldap_pvt_thread_mutex_t b_mutex;
......@@ -247,6 +248,8 @@ struct Backend {
LDAP_STAILQ_ENTRY(Backend) b_next;
};