[Fedora-directory-commits] ldapserver/ldap/servers/slapd/tools ldaptool-sasl.c, NONE, 1.1 ldaptool-sasl.h, NONE, 1.1 ldaptool.h, NONE, 1.1
Nathan Kinder (nkinder)
fedora-directory-commits at redhat.com
Fri Jun 8 23:19:21 UTC 2007
- Previous message (by thread): [Fedora-directory-commits] ldapserver/ldap/servers/slapd saslbind.c, 1.23, 1.24
- Next message (by thread): [Fedora-directory-commits] ldapserver/ldap/servers/slapd/tools/ldclt ldapfct.c, 1.2, 1.3 ldclt.c, 1.3, 1.4 ldclt.h, 1.2, 1.3 ldclt.use, 1.1, 1.2 ldcltU.c, 1.2, 1.3 scalab01.c, 1.2, 1.3
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: nkinder
Update of /cvs/dirsec/ldapserver/ldap/servers/slapd/tools
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv31128/ldap/servers/slapd/tools
Added Files:
ldaptool-sasl.c ldaptool-sasl.h ldaptool.h
Log Message:
Resolves: 240583
Summary: Added SASL support to ldclt as well as some thread-safety fixes for ns-slapd when using SASL.
--- NEW FILE ldaptool-sasl.c ---
/* ***** BEGIN LICENSE BLOCK *****
* Version: MPL 1.1/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Mozilla Public License Version
* 1.1 (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
* http://www.mozilla.org/MPL/
*
* Software distributed under the License is distributed on an "AS IS" basis,
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
* for the specific language governing rights and limitations under the
* License.
*
* The Original Code is Sun LDAP C SDK.
*
* The Initial Developer of the Original Code is Sun Microsystems, Inc.
*
* Portions created by Sun Microsystems, Inc are Copyright (C) 2005
* Sun Microsystems, Inc. All Rights Reserved.
*
* Contributor(s):
*
* Alternatively, the contents of this file may be used under the terms of
* either the GNU General Public License Version 2 or later (the "GPL"), or
* the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the MPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/*
* File for ldaptool routines for SASL
*/
#include <ldap.h>
#include "ldaptool.h"
#include "ldaptool-sasl.h"
#include <sasl.h>
#include <stdio.h>
#if defined(HPUX)
#include <sys/termios.h> /* for tcgetattr and tcsetattr */
#endif /* HPUX */
#define SASL_PROMPT "Interact"
typedef struct {
char *mech;
char *authid;
char *username;
char *passwd;
char *realm;
} ldaptoolSASLdefaults;
static int get_default(ldaptoolSASLdefaults *defaults, sasl_interact_t *interact, unsigned flags);
static int get_new_value(sasl_interact_t *interact, unsigned flags);
/* WIN32 does not have getlogin() so roll our own */
#if defined( _WINDOWS ) || defined( _WIN32 )
#include "LMCons.h"
static char *getlogin()
{
LPTSTR lpszSystemInfo; /* pointer to system information string */
DWORD cchBuff = UNLEN; /* size of user name */
static TCHAR tchBuffer[UNLEN + 1]; /* buffer for expanded string */
lpszSystemInfo = tchBuffer;
GetUserName(lpszSystemInfo, &cchBuff);
return lpszSystemInfo;
}
#endif /* _WINDOWS || _WIN32 */
/*
Note that it is important to use "" (the empty string, length 0) as the default
username value for non-interactive cases. This allows the sasl library to find the best
possible default. For example, if using GSSAPI, you want the default value for
the username to be extracted from the Kerberos tgt. The sasl library will do
that for you if you set the default username to "".
*/
void *
ldaptool_set_sasl_defaults ( LDAP *ld, unsigned flags, char *mech, char *authid, char *username,
char *passwd, char *realm )
{
ldaptoolSASLdefaults *defaults;
char *login = NULL;
if ((defaults = calloc(sizeof(ldaptoolSASLdefaults), 1)) == NULL) {
return NULL;
}
/* Try to get the login name */
if ((login = getlogin()) == NULL) {
login = "";
}
if (mech) {
defaults->mech = strdup(mech);
} else {
ldap_get_option(ld, LDAP_OPT_X_SASL_MECH, &defaults->mech);
}
if (authid) { /* use explicit passed in value */
defaults->authid = strdup(authid);
} else { /* use option value if any */
ldap_get_option(ld, LDAP_OPT_X_SASL_AUTHCID, &defaults->authid);
if (!defaults->authid) {
/* Default to the login name that is running the command */
defaults->authid = strdup( login );
}
}
if (username) { /* use explicit passed in value */
defaults->username = strdup(username);
} else { /* use option value if any */
ldap_get_option(ld, LDAP_OPT_X_SASL_AUTHZID, &defaults->username);
if (!defaults->username && (flags == LDAP_SASL_INTERACTIVE)) {
/* Default to the login name that is running the command */
defaults->username = strdup( login );
} else if (!defaults->username) { /* not interactive - use default sasl value */
defaults->username = strdup( "" );
}
}
if (passwd)
defaults->passwd = strdup (passwd);
else
defaults->passwd = strdup ("");
if (realm) {
defaults->realm = realm;
} else {
ldap_get_option(ld, LDAP_OPT_X_SASL_REALM, &defaults->realm);
}
return defaults;
}
void
ldaptool_free_defaults( void *defaults ) {
ldaptoolSASLdefaults *sasl_defaults = defaults;
if (sasl_defaults) {
if (sasl_defaults->mech)
free (sasl_defaults->mech);
if (sasl_defaults->authid)
free (sasl_defaults->authid);
if (sasl_defaults->username)
free (sasl_defaults->username);
if (sasl_defaults->passwd)
free (sasl_defaults->passwd);
free (sasl_defaults);
sasl_defaults = NULL;
}
}
int
ldaptool_sasl_interact( LDAP *ld, unsigned flags, void *defaults, void *prompts ) {
sasl_interact_t *interact = NULL;
ldaptoolSASLdefaults *sasldefaults = defaults;
int rc;
if (prompts == NULL) {
return (LDAP_PARAM_ERROR);
}
for (interact = prompts; interact->id != SASL_CB_LIST_END; interact++) {
/* Obtain the default value */
if ((rc = get_default(sasldefaults, interact, flags)) != LDAP_SUCCESS) {
return (rc);
}
/* always prompt in interactive mode - only prompt in automatic mode
if there is no default - never prompt in quiet mode */
if ( (flags == LDAP_SASL_INTERACTIVE) ||
((interact->result == NULL) && (flags == LDAP_SASL_AUTOMATIC)) ) {
if ((rc = get_new_value(interact, flags)) != LDAP_SUCCESS)
return (rc);
}
}
return (LDAP_SUCCESS);
}
static int
get_default(ldaptoolSASLdefaults *defaults, sasl_interact_t *interact, unsigned flags) {
const char *defvalue = interact->defresult;
if (defaults != NULL) {
switch( interact->id ) {
case SASL_CB_AUTHNAME:
defvalue = defaults->authid;
break;
case SASL_CB_USER:
defvalue = defaults->username;
break;
case SASL_CB_PASS:
defvalue = defaults->passwd;
break;
case SASL_CB_GETREALM:
defvalue = defaults->realm;
break;
}
}
if (defvalue != NULL) {
interact->result = defvalue;
if ((char *)interact->result == NULL)
return (LDAP_NO_MEMORY);
interact->len = strlen((char *)(interact->result));
}
return (LDAP_SUCCESS);
}
/*
* This function should always be called in LDAP_SASL_INTERACTIVE mode, or
* in LDAP_SASL_AUTOMATIC mode when there is no default value. This function
* will print out the challenge, default value, and prompt to get the value.
* If there is a default value, the user can just press Return/Enter at the
* prompt to use the default value. If there is no default, and the user
* didn't enter anything, this will return "" (the empty string) as the
* value.
*/
static int
get_new_value(sasl_interact_t *interact, unsigned flags) {
char *newvalue = NULL, str[1024];
int len = 0;
if ((interact->id == SASL_CB_ECHOPROMPT) || (interact->id == SASL_CB_NOECHOPROMPT)) {
if (interact->challenge) {
fprintf(stderr, "Challenge: %s\n", interact->challenge);
}
}
if (interact->result) {
fprintf(stderr, "Default: %s\n", (char *)interact->result);
}
snprintf(str, sizeof(str), "%s:", interact->prompt?interact->prompt:SASL_PROMPT);
str[sizeof(str)-1] = '\0';
/* Get the new value */
if ((interact->id == SASL_CB_PASS) || (interact->id == SASL_CB_NOECHOPROMPT)) {
if ((newvalue = ldaptool_getpass( str )) == NULL) {
return (LDAP_UNAVAILABLE);
}
len = strlen(newvalue);
} else {
fputs(str, stderr);
if ((newvalue = fgets(str, sizeof(str), stdin)) == NULL) {
return (LDAP_UNAVAILABLE);
}
len = strlen(str);
if ((len > 0) && (str[len - 1] == '\n')) {
str[len - 1] = '\0';
len--;
}
}
if (len > 0) { /* user typed in something - use it */
if (interact->result) {
free((void *)interact->result);
}
interact->result = strdup(newvalue);
memset(newvalue, '\0', len);
if (interact->result == NULL) {
return (LDAP_NO_MEMORY);
}
interact->len = len;
} else { /* use default or "" */
if (!interact->result) {
interact->result = "";
}
interact->len = strlen(interact->result);
}
return (LDAP_SUCCESS);
}
/*
* Implements getpass like functionality for supported platforms.
*
* It is the callers responsibility to zero out the memory used
* to store the password and to free it when it's finished with
* it.
*/
char *
ldaptool_getpass ( const char *prompt )
{
char *pass;
#if defined(_WIN32)
char pbuf[257];
fputs(prompt,stdout);
fflush(stdout);
if (fgets(pbuf,256,stdin) == NULL) {
pass = NULL;
} else {
char *tmp;
tmp = strchr(pbuf,'\n');
if (tmp) *tmp = '\0';
tmp = strchr(pbuf,'\r');
if (tmp) *tmp = '\0';
pass = strdup(pbuf);
}
#else
#if defined(SOLARIS)
/* 256 characters on Solaris */
pass = (char *)getpassphrase(prompt);
#else
#if defined(HPUX)
/* HP-UX has deprecated their password asking function, so we have
* to resort to doing it the hard way . . . */
char pbuf[257];
struct termios termstat;
tcflag_t savestat;
/* Only perform terminal manipulation if stdin is a terminal */
int havetty = isatty(fileno(stdin));
fputs(prompt, stdout);
fflush(stdout);
if(havetty) {
if(tcgetattr(fileno(stdin), &termstat) < 0) {
perror( "tcgetattr" );
exit( LDAP_LOCAL_ERROR );
}
savestat = termstat.c_lflag;
termstat.c_lflag &= ~(ECHO | ECHOE | ECHOK);
termstat.c_lflag |= (ICANON | ECHONL);
if(tcsetattr(fileno(stdin), TCSANOW, &termstat) < 0) {
perror( "tcsetattr" );
exit( LDAP_LOCAL_ERROR );
}
}
if (fgets(pbuf,256,stdin) == NULL) {
pass = NULL;
} else {
char *tmp;
pass = NULL;
tmp = strchr(pbuf,'\n');
if (tmp)
*tmp = '\0';
pass = strdup(pbuf);
}
if(havetty) {
termstat.c_lflag = savestat;
if(tcsetattr(fileno(stdin), TCSANOW, &termstat) < 0) {
perror( "tcgetattr" );
exit( LDAP_LOCAL_ERROR );
}
}
#else
/* limited to 16 chars on Tru64, 32 on AIX */
pass = (char *)getpass(prompt);
#endif
#endif
#endif
return pass;
}
--- NEW FILE ldaptool-sasl.h ---
/* ***** BEGIN LICENSE BLOCK *****
* Version: MPL 1.1/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Mozilla Public License Version
* 1.1 (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
* http://www.mozilla.org/MPL/
*
* Software distributed under the License is distributed on an "AS IS" basis,
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
* for the specific language governing rights and limitations under the
* License.
*
* The Original Code is Sun LDAP C SDK.
*
* The Initial Developer of the Original Code is Sun Microsystems, Inc.
*
* Portions created by Sun Microsystems, Inc are Copyright (C) 2005
* Sun Microsystems, Inc. All Rights Reserved.
*
* Contributor(s):
*
* Alternatively, the contents of this file may be used under the terms of
* either the GNU General Public License Version 2 or later (the "GPL"), or
* the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the MPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/*
* Include file for ldaptool routines for SASL
*/
void *ldaptool_set_sasl_defaults ( LDAP *ld, unsigned flags, char *mech, char *authid, char *username, char *passwd, char *realm );
void ldaptool_free_defaults( void *defaults );
int ldaptool_sasl_interact ( LDAP *ld, unsigned flags, void *defaults, void *p );
char *
ldaptool_getpass ( const char *prompt );
--- NEW FILE ldaptool.h ---
/* ***** BEGIN LICENSE BLOCK *****
* Version: MPL 1.1/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Mozilla Public License Version
* 1.1 (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
* http://www.mozilla.org/MPL/
*
* Software distributed under the License is distributed on an "AS IS" basis,
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
* for the specific language governing rights and limitations under the
* License.
*
* The Original Code is Mozilla Communicator client code, released
* March 31, 1998.
*
* The Initial Developer of the Original Code is
* Netscape Communications Corporation.
* Portions created by the Initial Developer are Copyright (C) 1998-1999
* the Initial Developer. All Rights Reserved.
*
* Contributor(s):
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the MPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
#ifndef _LDAPTOOL_H
#define _LDAPTOOL_H
/* XXX:mhein The following is a workaround for the redefinition of */
/* const problem on OSF. Fix to be provided by NSS */
/* This is a pretty benign workaround for us which */
/* should not cause problems in the future even if */
/* we forget to take it out :-) */
#ifdef OSF1V4D
#ifndef __STDC__
# define __STDC__
#endif /* __STDC__ */
#endif /* OSF1V4D */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#ifdef AIX
#include <strings.h>
#endif
#ifdef SCOOS
#include <sys/types.h>
#endif
#ifdef _WINDOWS
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
extern int getopt (int argc, char *const *argv, const char *optstring);
#include <io.h> /* for _mktemp() */
#define LDAPTOOL_MKTEMP( p ) _mktemp( p )
#else
#include <sys/file.h>
#include <sys/stat.h>
#include <unistd.h>
#define LDAPTOOL_MKTEMP( p ) mktemp( p )
#endif
#ifdef LINUX
#include <getopt.h> /* not always included from unistd.h */
#endif
#include <ctype.h>
#ifndef SCOOS
#include <sys/types.h>
#endif
#include <sys/stat.h>
#include <fcntl.h>
#if defined(NET_SSL)
#include <ssl.h>
#endif
#include <portable.h>
#include <ldap.h>
#include <ldaplog.h>
#include <ldif.h>
#if defined(NET_SSL)
#include <ldap_ssl.h>
#endif
#include <ldappr.h>
#ifdef __cplusplus
extern "C" {
#endif
/*
* shared macros, structures, etc.
*/
#define LDAPTOOL_RESULT_IS_AN_ERROR( rc ) \
( (rc) != LDAP_SUCCESS && (rc) != LDAP_COMPARE_TRUE \
&& (rc) != LDAP_COMPARE_FALSE )
#define LDAPTOOL_DEFSEP "=" /* used by ldapcmp and ldapsearch */
#define LDAPTOOL_DEFHOST "localhost"
#define LDAPTOOL_DEFSSLSTRENGTH LDAPSSL_AUTH_CERT
#define LDAPTOOL_DEFCERTDBPATH "."
#define LDAPTOOL_DEFKEYDBPATH "."
#define LDAPTOOL_DEFREFHOPLIMIT 5
#define LDAPTOOL_SAFEREALLOC( ptr, size ) ( ptr == NULL ? malloc( size ) : \
realloc( ptr, size ))
/* this defines the max number of control requests for the tools */
#define CONTROL_REQUESTS 50
/*
* globals (defined in common.c)
*/
extern char *ldaptool_host;
extern char *ldaptool_host2;
extern int ldaptool_port;
extern int ldaptool_port2;
extern int ldaptool_verbose;
extern int ldaptool_not;
extern int ldaptool_nobind;
extern int ldaptool_noconv_passwd;
extern char *ldaptool_progname;
extern FILE *ldaptool_fp;
extern char *ldaptool_charset;
extern LDAPControl *ldaptool_request_ctrls[];
#ifdef LDAP_DEBUG
extern int ldaptool_dbg_lvl;
#define LDAPToolDebug(lvl,fmt,arg1,arg2,arg3) if (lvl & ldaptool_dbg_lvl) { fprintf(stderr,fmt,arg1,arg2,arg3); }
#else
#define LDAPToolDebug(lvl,fmt,arg1,arg2,arg3)
#endif /* LDAP_DEBUG */
/*
* function prototypes
*/
void ldaptool_common_usage( int two_hosts );
int ldaptool_process_args( int argc, char **argv, char *extra_opts,
int two_hosts, void (*extra_opt_callback)( int option, char *optarg ));
LDAP *ldaptool_ldap_init( int second_host );
void ldaptool_bind( LDAP *ld );
void ldaptool_cleanup( LDAP *ld );
int ldaptool_print_lderror( LDAP *ld, char *msg, int check4ssl );
#define LDAPTOOL_CHECK4SSL_NEVER 0
#define LDAPTOOL_CHECK4SSL_ALWAYS 1
#define LDAPTOOL_CHECK4SSL_IF_APPROP 2 /* if appropriate */
LDAPControl *ldaptool_create_manage_dsait_control( void );
void ldaptool_print_referrals( char **refs );
int ldaptool_print_extended_response( LDAP *ld, LDAPMessage *res, char *msg );
LDAPControl *ldaptool_create_proxyauth_control( LDAP *ld );
LDAPControl *ldaptool_create_geteffectiveRights_control ( LDAP *ld,
const char *authzid, const char **attrlist );
void ldaptool_add_control_to_array( LDAPControl *ctrl, LDAPControl **array);
void ldaptool_reset_control_array( LDAPControl **array );
char *ldaptool_get_tmp_dir( void );
char *ldaptool_local2UTF8( const char *s, const char *desc );
char *ldaptool_getpass( const char *prompt );
char *ldaptool_read_password( FILE *mod_password_fp );
int ldaptool_berval_is_ascii( const struct berval *bvp );
int ldaptool_sasl_bind_s( LDAP *ld, const char *dn, const char *mechanism,
const struct berval *cred, LDAPControl **serverctrls,
LDAPControl **clientctrls, struct berval **servercredp, char *msg );
int ldaptool_simple_bind_s( LDAP *ld, const char *dn, const char *passwd,
LDAPControl **serverctrls, LDAPControl **clientctrls, char *msg );
int ldaptool_add_ext_s( LDAP *ld, const char *dn, LDAPMod **attrs,
LDAPControl **serverctrls, LDAPControl **clientctrls, char *msg );
int ldaptool_modify_ext_s( LDAP *ld, const char *dn, LDAPMod **mods,
LDAPControl **serverctrls, LDAPControl **clientctrls, char *msg );
int ldaptool_delete_ext_s( LDAP *ld, const char *dn, LDAPControl **serverctrls,
LDAPControl **clientctrls, char *msg );
int ldaptool_rename_s( LDAP *ld, const char *dn, const char *newrdn,
const char *newparent, int deleteoldrdn, LDAPControl **serverctrls,
LDAPControl **clientctrls, char *msg );
int ldaptool_compare_ext_s( LDAP *ld, const char *dn, const char *attrtype,
const struct berval *bvalue, LDAPControl **serverctrls,
LDAPControl **clientctrls, char *msg );
int ldaptool_boolean_str2value ( const char *s, int strict );
int ldaptool_parse_ctrl_arg ( char *ctrl_arg, char sep, char **ctrl_oid,
int *ctrl_criticality, char **ctrl_value, int *vlen);
FILE *ldaptool_open_file ( const char *filename, const char * mode);
#ifdef __cplusplus
}
#endif
#endif /* LDAPTOOL_H */
- Previous message (by thread): [Fedora-directory-commits] ldapserver/ldap/servers/slapd saslbind.c, 1.23, 1.24
- Next message (by thread): [Fedora-directory-commits] ldapserver/ldap/servers/slapd/tools/ldclt ldapfct.c, 1.2, 1.3 ldclt.c, 1.3, 1.4 ldclt.h, 1.2, 1.3 ldclt.use, 1.1, 1.2 ldcltU.c, 1.2, 1.3 scalab01.c, 1.2, 1.3
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the Fedora-directory-commits
mailing list