From 1d03b1e60f309e186179983d0f1011d1ea1d2e25 Mon Sep 17 00:00:00 2001 From: leitner Date: Tue, 14 May 2002 20:11:36 +0000 Subject: [PATCH] searchrequest scope handling (fixed by Thomas Walpuski) add (primitive) auth support --- .cvsignore | 5 +++ Makefile | 4 ++- THANKS | 2 ++ addindex.c | 12 +++++--- auth.c | 22 +++++++++++++ auth.h | 7 +++++ ldap_match_mapped.c | 15 +++++++-- ldif.h | 1 + tinyldap.c | 75 +++++++++++++++++++++++++++++++++++++++++---- 9 files changed, 129 insertions(+), 14 deletions(-) create mode 100644 auth.c create mode 100644 auth.h diff --git a/.cvsignore b/.cvsignore index 7d1585c..7ba2235 100644 --- a/.cvsignore +++ b/.cvsignore @@ -12,3 +12,8 @@ data dumpidx parse tinyldap_debug +attic +doit +idx2ldif +ldap-capture +server diff --git a/Makefile b/Makefile index 14cb631..5fba996 100644 --- a/Makefile +++ b/Makefile @@ -23,6 +23,8 @@ ldif.a: ldif_parse.o ldap_match.o ldap_match_mapped.o storage.a: strstorage.o strduptab.o mstorage_add.o mduptab_add.o +auth.a: auth.o + DIET=/opt/diet/bin/diet -Os CC=gcc CFLAGS=-pipe -I. -Wall -W @@ -43,7 +45,7 @@ endif t1 parse: ldif.a storage.a t2: ldap.a asn1.a t3 t4 t5 addindex: storage.a -tinyldap tinyldap_standalone tinyldap_debug: ldif.a storage.a +tinyldap tinyldap_standalone tinyldap_debug: ldif.a storage.a auth.a bindrequest tinyldap tinyldap_standalone tinyldap_debug ldapclient ldapclient_str: ldap.a asn1.a tinyldap_standalone: tinyldap.c diff --git a/THANKS b/THANKS index 6978c77..c02cb83 100644 --- a/THANKS +++ b/THANKS @@ -3,3 +3,5 @@ Trevor Harrison found a bug in fmt_asn1tag for the multibyte encoding. David Lichteblau found lots of problems in the ASN.1 code. Özgür Kesim helped fix the substring search. + +Thomas Walpuski has found lots of problems with the LDAP code. diff --git a/addindex.c b/addindex.c index 277cd0c..ab786ee 100644 --- a/addindex.c +++ b/addindex.c @@ -56,7 +56,10 @@ int main(int argc,char* argv[]) { for (i=0; i2; --j) { diff --git a/auth.c b/auth.c new file mode 100644 index 0000000..6318239 --- /dev/null +++ b/auth.c @@ -0,0 +1,22 @@ +#include +#include "ldap.h" +#include "auth.h" +#include "str.h" +#include "textcode.h" +#include "byte.h" + +int check_password(const char* fromdb,struct string* plaintext) { + if (str_start(fromdb,"{MD5}")) { + char digest[17]; + char md5[40]; + MD5_CTX c; + MD5Init(&c); + MD5Update(&c,plaintext->s,plaintext->l); + MD5Final(digest,&c); + digest[16]=0; + fmt_hexdump(md5,digest,16); + if (byte_equal(md5,32,fromdb+5)) + return 1; + } + return 0; +} diff --git a/auth.h b/auth.h new file mode 100644 index 0000000..5bde75a --- /dev/null +++ b/auth.h @@ -0,0 +1,7 @@ +#ifndef _AUTH_H +#define _AUTH_H + +/* return non-zero if the password matches */ +int check_password(const char* fromdb,struct string* plaintext); + +#endif diff --git a/ldap_match_mapped.c b/ldap_match_mapped.c index a66ea69..c3a3c53 100644 --- a/ldap_match_mapped.c +++ b/ldap_match_mapped.c @@ -50,6 +50,17 @@ int ldap_match_present(uint32 ofs,uint32 attrofs) { return 0; } +uint32 ldap_find_attr_value(uint32 ofs,uint32 attrofs) { + uint32 j,k; + if (attrofs==dn_ofs) return uint32_read(map+ofs+8); + if (attrofs==objectClass_ofs) return uint32_read(map+ofs+12); + uint32_unpack(map+ofs,&j); + for (k=2; kx; @@ -165,7 +176,7 @@ int ldap_match_mapped(uint32 ofs,struct SearchRequest* sr) { return 0; } /* we want "o=foo, o=bar" and "o=FOO,o=baR" to be equal */ - if (sr->baseObject.l && !(l=match(sr->baseObject.s,sr->baseObject.l,map+k))) { + if (sr->baseObject.l && !match(sr->baseObject.s,sr->baseObject.l,map+k)) { // puts("fail: not suffix"); return 0; } @@ -175,7 +186,7 @@ int ldap_match_mapped(uint32 ofs,struct SearchRequest* sr) { case baseObject: if (l==sr->baseObject.l) break; return 0; default: i=str_chr(map+k,','); - if (i+2>=sr->baseObject.l-l) break; + if (i+2>=l-sr->baseObject.l) break; return 0; } return ldap_matchfilter_mapped(ofs,sr->filter); diff --git a/ldif.h b/ldif.h index 88ef81a..8369408 100644 --- a/ldif.h +++ b/ldif.h @@ -25,3 +25,4 @@ int ldif_parse(const char* filename); int ldap_match(struct ldaprec* r,struct SearchRequest* sr); int ldap_match_mapped(uint32 ofs,struct SearchRequest* sr); int ldap_match_present(uint32 ofs,uint32 attrofs); +uint32 ldap_find_attr_value(uint32 ofs,uint32 attrofs); diff --git a/tinyldap.c b/tinyldap.c index 61d70cf..50bf0c6 100644 --- a/tinyldap.c +++ b/tinyldap.c @@ -1,5 +1,6 @@ #include #include +#include #include "byte.h" #include "buffer.h" #include "ldap.h" @@ -7,13 +8,14 @@ #include "open.h" #include "mmap.h" #include "uint32.h" +#include "auth.h" #ifdef STANDALONE #include "socket.h" #include "ip6.h" #include #endif -#define verbose 0 +#define verbose 1 #define debug 1 char* map; @@ -24,7 +26,7 @@ uint32 magic,attribute_count,record_count,indices_offset,size_of_string_table; uint32 record_set_length; /* some pre-looked-up attribute offsets to speed up ldap_match_mapped */ -uint32 dn_ofs,objectClass_ofs; +uint32 dn_ofs,objectClass_ofs,userPassword_ofs; #define BUFSIZE 8192 @@ -215,8 +217,9 @@ static uint32 findrec(uint32 dat) { while ((top>=bottom)) { uint32 mid=(top+bottom)/2; uint32 l; + l=uint32_read(map+uint32_read(&records[mid])+8); - if (l=record_count-1) l=uint32_read(map+uint32_read(&records[0])+12); else @@ -548,6 +551,64 @@ int handle(int in,int out) { buffer_putulong(buffer_2,method); buffer_putsflush(buffer_2,".\n"); } + if (name.l) { + struct Filter f; + struct string password; + f.type=EQUAL; f.attrofs=dn_ofs; + scan_ldapstring(buf+res+tmp,buf+res+len,&password); + f.ava.desc.l=2; f.ava.desc.s="dn"; + f.ava.value=name; + f.next=0; + + if (!indexable(&f)) { +authfailure: + { + char outbuf[1024]; + int s=100; + int len=fmt_ldapbindresponse(outbuf+s,48,"","authentication failure",""); + int hlen=fmt_ldapmessage(0,messageid,BindResponse,len); + fmt_ldapmessage(outbuf+s-hlen,messageid,BindResponse,len); + write(out,outbuf+s-hlen,len+hlen); + continue; + } + } else { + unsigned long* result; + unsigned long i,done; + result=alloca(record_set_length*sizeof(unsigned long)); + useindex(&f,result); + done=0; + for (i=0; i