From b712341fcdbbdb0e508a8a297dd91bec0fc24e04 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Wed, 27 Jul 2011 18:34:04 +0200 Subject: [PATCH 1/2] Provide means of forcing TLS and GSSAPI enabled/disabled for sdap connections --- src/providers/ipa/ipa_auth.c | 2 +- src/providers/ldap/ldap_id.c | 3 ++- src/providers/ldap/sdap_async.h | 4 +++- src/providers/ldap/sdap_async_connection.c | 28 +++++++++++++++++++++------- src/providers/ldap/sdap_id_op.c | 4 +++- 5 files changed, 30 insertions(+), 11 deletions(-) diff --git a/src/providers/ipa/ipa_auth.c b/src/providers/ipa/ipa_auth.c index f0bdd429ea9c99cb345057369835d8126a935b07..083508d29f59ce2c7960aa7db57ee342dfda8a9c 100644 --- a/src/providers/ipa/ipa_auth.c +++ b/src/providers/ipa/ipa_auth.c @@ -92,7 +92,7 @@ static struct tevent_req *get_password_migration_flag_send(TALLOC_CTX *memctx, subreq = sdap_cli_connect_send(state, ev, sdap_auth_ctx->opts, sdap_auth_ctx->be, sdap_auth_ctx->service, - true); + true, NULL, false); if (subreq == NULL) { DEBUG(1, ("sdap_cli_connect_send failed.\n")); goto fail; diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c index d300184886244e030fb9fdd629d2596f3c54922b..22e28eeffd81274c5f7151a599d4c9cb5646d710 100644 --- a/src/providers/ldap/ldap_id.c +++ b/src/providers/ldap/ldap_id.c @@ -672,7 +672,8 @@ void sdap_check_online(struct be_req *be_req) struct sdap_id_ctx); req = sdap_cli_connect_send(be_req, be_req->be_ctx->ev, ctx->opts, - be_req->be_ctx, ctx->service, false); + be_req->be_ctx, ctx->service, false, + NULL, false); if (req == NULL) { DEBUG(1, ("sdap_cli_connect_send failed.\n")); goto done; diff --git a/src/providers/ldap/sdap_async.h b/src/providers/ldap/sdap_async.h index 5da2cff4e131ac0a1e11498adf5a5395c943085c..85fa4effad10238abe7d57f752972cbcb3869efd 100644 --- a/src/providers/ldap/sdap_async.h +++ b/src/providers/ldap/sdap_async.h @@ -136,7 +136,9 @@ struct tevent_req *sdap_cli_connect_send(TALLOC_CTX *memctx, struct sdap_options *opts, struct be_ctx *be, struct sdap_service *service, - bool skip_rootdse); + bool skip_rootdse, + bool *force_tls, + bool skip_auth); int sdap_cli_connect_recv(struct tevent_req *req, TALLOC_CTX *memctx, bool *can_retry, diff --git a/src/providers/ldap/sdap_async_connection.c b/src/providers/ldap/sdap_async_connection.c index 076e7ee3708d97341bd3cd2a0269331557ff19f1..614e2fda81de25c7a03016a74d88aa2117288b87 100644 --- a/src/providers/ldap/sdap_async_connection.c +++ b/src/providers/ldap/sdap_async_connection.c @@ -1125,6 +1125,9 @@ struct sdap_cli_connect_state { struct fo_server *srv; struct sdap_server_opts *srv_opts; + + bool *force_tls; + bool do_auth; }; static int sdap_cli_resolve_next(struct tevent_req *req); @@ -1142,7 +1145,9 @@ struct tevent_req *sdap_cli_connect_send(TALLOC_CTX *memctx, struct sdap_options *opts, struct be_ctx *be, struct sdap_service *service, - bool skip_rootdse) + bool skip_rootdse, + bool *force_tls, + bool skip_auth) { struct sdap_cli_connect_state *state; struct tevent_req *req; @@ -1159,6 +1164,8 @@ struct tevent_req *sdap_cli_connect_send(TALLOC_CTX *memctx, state->srv_opts = NULL; state->be = be; state->use_rootdse = !skip_rootdse; + state->force_tls = force_tls; + state->do_auth = !skip_auth; ret = sdap_cli_resolve_next(req); if (ret) { @@ -1196,8 +1203,9 @@ static void sdap_cli_resolve_done(struct tevent_req *subreq) struct sdap_cli_connect_state *state = tevent_req_data(req, struct sdap_cli_connect_state); int ret; - bool use_tls = dp_opt_get_bool(state->opts->basic, - SDAP_ID_TLS); + bool use_tls = state->force_tls ? *state->force_tls : \ + dp_opt_get_bool(state->opts->basic, + SDAP_ID_TLS); ret = be_resolve_server_recv(subreq, &state->srv); talloc_zfree(subreq); @@ -1260,7 +1268,7 @@ static void sdap_cli_connect_done(struct tevent_req *subreq) sasl_mech = dp_opt_get_string(state->opts->basic, SDAP_SASL_MECH); - if (sasl_mech && state->use_rootdse) { + if (state->do_auth && sasl_mech && state->use_rootdse) { /* check if server claims to support GSSAPI */ if (!sdap_is_sasl_mech_supported(state->sh, sasl_mech)) { tevent_req_error(req, ENOTSUP); @@ -1268,7 +1276,7 @@ static void sdap_cli_connect_done(struct tevent_req *subreq) } } - if (sasl_mech && (strcasecmp(sasl_mech, "GSSAPI") == 0)) { + if (state->do_auth && sasl_mech && (strcasecmp(sasl_mech, "GSSAPI") == 0)) { if (dp_opt_get_bool(state->opts->basic, SDAP_KRB5_KINIT)) { sdap_cli_kinit_step(req); return; @@ -1372,7 +1380,7 @@ static void sdap_cli_rootdse_done(struct tevent_req *subreq) sasl_mech = dp_opt_get_string(state->opts->basic, SDAP_SASL_MECH); - if (sasl_mech && state->use_rootdse) { + if (state->do_auth && sasl_mech && state->use_rootdse) { /* check if server claims to support GSSAPI */ if (!sdap_is_sasl_mech_supported(state->sh, sasl_mech)) { tevent_req_error(req, ENOTSUP); @@ -1380,7 +1388,7 @@ static void sdap_cli_rootdse_done(struct tevent_req *subreq) } } - if (sasl_mech && (strcasecmp(sasl_mech, "GSSAPI") == 0)) { + if (state->do_auth && sasl_mech && (strcasecmp(sasl_mech, "GSSAPI") == 0)) { if (dp_opt_get_bool(state->opts->basic, SDAP_KRB5_KINIT)) { sdap_cli_kinit_step(req); return; @@ -1464,6 +1472,12 @@ static void sdap_cli_auth_step(struct tevent_req *req) struct sdap_cli_connect_state); struct tevent_req *subreq; + if (!state->do_auth) { + /* No authentication requested or GSSAPI auth forced off */ + tevent_req_done(req); + return; + } + subreq = sdap_auth_send(state, state->ev, state->sh, diff --git a/src/providers/ldap/sdap_id_op.c b/src/providers/ldap/sdap_id_op.c index 11a379cc96a77615bd62b1fe58daa2413f38087a..debc2771ff32d97bb6371012e51f6cfc235b00bb 100644 --- a/src/providers/ldap/sdap_id_op.c +++ b/src/providers/ldap/sdap_id_op.c @@ -465,7 +465,9 @@ static int sdap_id_op_connect_step(struct tevent_req *req) subreq = sdap_cli_connect_send(conn_data, state->ev, state->id_ctx->opts, state->id_ctx->be, - state->id_ctx->service, false); + state->id_ctx->service, false, + NULL, false); + if (!subreq) { ret = ENOMEM; goto done; -- 1.7.7