Update backend "restrictions"

diff --git a/servers/slapd/backend.c b/servers/slapd/backend.c
index 60ed9eb142f90b196f262aceab67647fc17e1f11..bbcfdea56ba40ce50902bf30dd6850afb5409e8c 100644 (file)
--- a/servers/slapd/backend.c
+++ b/servers/slapd/backend.c
@@ -637,7 +637,7 @@ backend_check_restrictions(
        Backend *be,
        Connection *conn,
        Operation *op,
-       const char *extoid,
+       const void *opdata,
        const char **text )
 {
        int rc;
@@ -701,7 +701,9 @@ backend_check_restrictions(
                return LDAP_OTHER;
        }
 
-       if (( extoid == NULL || strcmp( extoid, LDAP_EXOP_START_TLS ) ) ) {
+       if ( op->o_tag != LDAP_REQ_EXTENDED
+               || strcmp( (const char *) opdata, LDAP_EXOP_START_TLS ) )
+       {
                /* these checks don't apply to StartTLS */
 
                if( op->o_tag == LDAP_REQ_EXTENDED ) {
@@ -709,47 +711,57 @@ backend_check_restrictions(
                        updateop++;
                }
 
-               if( op->o_ssf < ssf->sss_ssf ) {
-                       *text = "confidentiality required";
-                       return LDAP_CONFIDENTIALITY_REQUIRED;
-               }
                if( op->o_transport_ssf < ssf->sss_transport ) {
                        *text = "transport confidentiality required";
                        return LDAP_CONFIDENTIALITY_REQUIRED;
                }
+
                if( op->o_tls_ssf < ssf->sss_tls ) {
                        *text = "TLS confidentiality required";
                        return LDAP_CONFIDENTIALITY_REQUIRED;
                }
-               if( op->o_sasl_ssf < ssf->sss_sasl ) {
-                       *text = "SASL confidentiality required";
-                       return LDAP_CONFIDENTIALITY_REQUIRED;
-               }
 
-               if( updateop ) {
-                       if( op->o_ssf < ssf->sss_update_ssf ) {
-                               *text = "update confidentiality required";
+               if( op->o_tag != LDAP_REQ_BIND || opdata == NULL ) {
+                       /* these checks don't apply to SASL bind */
+
+                       if( op->o_sasl_ssf < ssf->sss_sasl ) {
+                               *text = "SASL confidentiality required";
                                return LDAP_CONFIDENTIALITY_REQUIRED;
                        }
+
+                       if( op->o_ssf < ssf->sss_ssf ) {
+                               *text = "confidentiality required";
+                               return LDAP_CONFIDENTIALITY_REQUIRED;
+                       }
+               }
+
+               if( updateop ) {
                        if( op->o_transport_ssf < ssf->sss_update_transport ) {
                                *text = "transport update confidentiality required";
                                return LDAP_CONFIDENTIALITY_REQUIRED;
                        }
+
                        if( op->o_tls_ssf < ssf->sss_update_tls ) {
                                *text = "TLS update confidentiality required";
                                return LDAP_CONFIDENTIALITY_REQUIRED;
                        }
+
                        if( op->o_sasl_ssf < ssf->sss_update_sasl ) {
                                *text = "SASL update confidentiality required";
                                return LDAP_CONFIDENTIALITY_REQUIRED;
                        }
+
+                       if( op->o_ssf < ssf->sss_update_ssf ) {
+                               *text = "update confidentiality required";
+                               return LDAP_CONFIDENTIALITY_REQUIRED;
+                       }
                }
        }
 
-       if (( extoid == NULL || strcmp( extoid, LDAP_EXOP_START_TLS ) )
-               || op->o_tag == LDAP_REQ_BIND )
+       if ( op->o_tag != LDAP_REQ_BIND && ( op->o_tag != LDAP_REQ_EXTENDED ||
+               strcmp( (const char *) opdata, LDAP_EXOP_START_TLS ) ) )
        {
-               /* these checks don't apply to StartTLS or Bind */
+               /* these checks don't apply to Bind or StartTLS */
 
                if( requires & SLAP_REQUIRE_STRONG ) {
                        /* should check mechanism */

diff --git a/servers/slapd/bind.c b/servers/slapd/bind.c
index 460883b88ecd271bd898d2e540fd0cf2ccc54f09..b7c4315ed1599d8da92cd579f4a08a009430fed9 100644 (file)
--- a/servers/slapd/bind.c
+++ b/servers/slapd/bind.c
@@ -203,6 +203,14 @@ do_bind(
                        goto cleanup;
                }
 
+               /* check restrictions */
+               rc = backend_check_restrictions( NULL, conn, op, mech, &text );
+               if( rc != LDAP_SUCCESS ) {
+                       send_ldap_result( conn, op, rc,
+                               NULL, text, NULL, NULL );
+                       goto cleanup;
+               }
+
                ldap_pvt_thread_mutex_lock( &conn->c_mutex );
 
                if ( conn->c_sasl_bind_mech != NULL ) {
@@ -290,6 +298,9 @@ do_bind(
                                /* disallow */
                                rc = LDAP_INAPPROPRIATE_AUTH;
                                text = "anonymous bind disallowed";
+
+                       } else {
+                               rc = backend_check_restrictions( NULL, conn, op, mech, &text );
                        }
 
                        /*
@@ -363,7 +374,7 @@ do_bind(
        }
 
        /* check restrictions */
-       rc = backend_check_restrictions( be, conn, op, NULL, &text ) ;
+       rc = backend_check_restrictions( be, conn, op, NULL, &text );
        if( rc != LDAP_SUCCESS ) {
                send_ldap_result( conn, op, rc,
                        NULL, text, NULL, NULL );

diff --git a/servers/slapd/proto-slap.h b/servers/slapd/proto-slap.h
index 043e55baa4c125e73fbc584793f2a415253f4460..ecdaaf2dfef8953f9209bef61c6dec302c8c00ef 100644 (file)
--- a/servers/slapd/proto-slap.h
+++ b/servers/slapd/proto-slap.h
@@ -166,7 +166,7 @@ LDAP_SLAPD_F( int ) backend_check_restrictions LDAP_P((
        Backend *be,
        Connection *conn,
        Operation *op,
-       const char *extoid,
+       const void *opdata,
        const char **text ));
 
 LDAP_SLAPD_F( int )    backend_check_referrals LDAP_P((
@@ -779,6 +779,7 @@ LDAP_SLAPD_F (int)          global_idletimeout;
 LDAP_SLAPD_F (int)             global_schemacheck;
 LDAP_SLAPD_F (char)            *global_host;
 LDAP_SLAPD_F (char)            *global_realm;
+LDAP_SLAPD_F (int)             sasl_external_x509dn_convert;
 LDAP_SLAPD_F (char)            *default_passwd_hash;
 LDAP_SLAPD_F (int)             lber_debug;
 LDAP_SLAPD_F (int)             ldap_syslog;

diff --git a/servers/slapd/search.c b/servers/slapd/search.c
index a0835501f19f9212508946632ba29fec09de7b25..5c93c7944ed80e92ccafa37e60e6234ab97fc795 100644 (file)
--- a/servers/slapd/search.c
+++ b/servers/slapd/search.c
@@ -27,7 +27,7 @@
 
 int
 do_search(
-    Connection *conn,  /* where to send results                       */
+    Connection *conn,  /* where to send results */
     Operation  *op     /* info about the op to which we're responding */
 ) {
        int             i;
@@ -140,7 +140,7 @@ do_search(
                goto return_results;
        } 
 
-       rc = 0;
+       rc = LDAP_SUCCESS;
 
        Debug( LDAP_DEBUG_ARGS, "    attrs:", 0, 0, 0 );
 
@@ -156,28 +156,62 @@ do_search(
            "conn=%ld op=%d SRCH base=\"%s\" scope=%d filter=\"%s\"\n",
            op->o_connid, op->o_opid, base, scope, fstr );
 
+       manageDSAit = get_manageDSAit( op );
+
        if ( scope == LDAP_SCOPE_BASE ) {
                Entry *entry = NULL;
 
                if ( strcasecmp( nbase, LDAP_ROOT_DSE ) == 0 ) {
+                       /* check restrictions */
+                       rc = backend_check_restrictions( NULL, conn, op, NULL, &text ) ;
+                       if( rc != LDAP_SUCCESS ) {
+                               send_ldap_result( conn, op, rc,
+                                       NULL, text, NULL, NULL );
+                               goto return_results;
+                       }
+
                        rc = root_dse_info( conn, &entry, &text );
                }
 
 #if defined( SLAPD_MONITOR_DN )
                else if ( strcasecmp( nbase, SLAPD_MONITOR_DN ) == 0 ) {
+                       /* check restrictions */
+                       rc = backend_check_restrictions( NULL, conn, op, NULL, &text ) ;
+                       if( rc != LDAP_SUCCESS ) {
+                               send_ldap_result( conn, op, rc,
+                                       NULL, text, NULL, NULL );
+                               goto return_results;
+                       }
+
                        rc = monitor_info( &entry, &text );
                }
 #endif
 
 #if defined( SLAPD_CONFIG_DN )
                else if ( strcasecmp( nbase, SLAPD_CONFIG_DN ) == 0 ) {
+                       /* check restrictions */
+                       rc = backend_check_restrictions( NULL, conn, op, NULL, &text ) ;
+                       if( rc != LDAP_SUCCESS ) {
+                               send_ldap_result( conn, op, rc,
+                                       NULL, text, NULL, NULL );
+                               goto return_results;
+                       }
+
                        rc = config_info( &entry, &text );
                }
 #endif
 
 #if defined( SLAPD_SCHEMA_DN )
                else if ( strcasecmp( nbase, SLAPD_SCHEMA_DN ) == 0 ) {
-                       rc= schema_info( &entry, &text );
+                       /* check restrictions */
+                       rc = backend_check_restrictions( NULL, conn, op, NULL, &text ) ;
+                       if( rc != LDAP_SUCCESS ) {
+                               send_ldap_result( conn, op, rc,
+                                       NULL, text, NULL, NULL );
+                               goto return_results;
+                       }
+
+                       rc = schema_info( &entry, &text );
                }
 #endif
 
@@ -210,8 +244,6 @@ do_search(
                nbase = ch_strdup( default_search_nbase );
        }
 
-       manageDSAit = get_manageDSAit( op );
-
        /*
         * We could be serving multiple database backends.  Select the
         * appropriate one, or send a referral to our "referral server"