path: root/ldap/servers/slapd/passwd_extop.c

/** BEGIN COPYRIGHT BLOCK
 * Copyright (C) 2005 Red Hat, Inc.
 * All rights reserved.
 * END COPYRIGHT BLOCK **/
/*
 * Password Modify - LDAP Extended Operation.
 * RFC 3062
 *
 *
 * This plugin implements the "Password Modify - LDAP3" 
 * extended operation for LDAP. The plugin function is called by
 * the server if an LDAP client request contains the OID:
 * "1.3.6.1.4.1.4203.1.11.1".
 *
 */

#include <stdio.h>
#include <string.h>
#include <private/pprio.h>


#include <prio.h>
#include <ssl.h>
#include "slap.h"
#include "slapi-plugin.h"
#include "fe.h"

/* Type of connection for this operation;*/
#define LDAP_EXTOP_PASSMOD_CONN_SECURE

/* Uncomment the following line FOR TESTING: allows non-SSL connections to use the password change extended op */
/* #undef LDAP_EXTOP_PASSMOD_CONN_SECURE */

/* ber tags for the PasswdModifyRequestValue sequence */
#define LDAP_EXTOP_PASSMOD_TAG_USERID	0x80U
#define LDAP_EXTOP_PASSMOD_TAG_OLDPWD	0x81U
#define LDAP_EXTOP_PASSMOD_TAG_NEWPWD	0x82U

/* OID of the extended operation handled by this plug-in */
#define EXOP_PASSWD_OID	"1.3.6.1.4.1.4203.1.11.1"


Slapi_PluginDesc passwdopdesc = { "passwd_modify_plugin", "Netscape", "0.1",
	"Password Modify extended operation plugin" };

/* Check SLAPI_USERPWD_ATTR attribute of the directory entry 
 * return 0, if the userpassword attribute contains the given pwd value
 * return -1, if userPassword attribute is absent for given Entry
 * return LDAP_INVALID_CREDENTIALS,if userPassword attribute and given pwd don't match
 */
static int passwd_check_pwd(Slapi_Entry *targetEntry, const char *pwd){
	int rc = LDAP_SUCCESS;
	Slapi_Attr *attr = NULL;
	Slapi_Value cv;
	Slapi_Value **bvals; 

	LDAPDebug( LDAP_DEBUG_TRACE, "=> passwd_check_pwd\n", 0, 0, 0 );
	
	slapi_value_init_string(&cv,pwd);
	
	if ( (rc = slapi_entry_attr_find( targetEntry, SLAPI_USERPWD_ATTR, &attr )) == 0 )
	{ /* we have found the userPassword attribute and it has some value */
		bvals = attr_get_present_values( attr );
		if ( slapi_pw_find_sv( bvals, &cv ) != 0 )
		{
			rc = LDAP_INVALID_CREDENTIALS;
		}
	}

	value_done(&cv);
	LDAPDebug( LDAP_DEBUG_TRACE, "<= passwd_check_pwd: %d\n", rc, 0, 0 );
	
	/* if the userPassword attribute is absent then rc is -1 */
	return rc;
}


/* Searches the dn in directory, 
 *  If found	 : fills in slapi_entry structure and returns 0
 *  If NOT found : returns the search result as LDAP_NO_SUCH_OBJECT
 */
static int 
passwd_modify_getEntry( const char *dn, Slapi_Entry **e2 ) {
	int		search_result = 0;
	Slapi_DN 	sdn;
	LDAPDebug( LDAP_DEBUG_TRACE, "=> passwd_modify_getEntry\n", 0, 0, 0 );
	slapi_sdn_init_dn_byref( &sdn, dn );
	if ((search_result = slapi_search_internal_get_entry( &sdn, NULL, e2,
 					plugin_get_default_component_id())) != LDAP_SUCCESS ){
	 LDAPDebug (LDAP_DEBUG_TRACE, "passwd_modify_getEntry: No such entry-(%s), err (%d)\n",
					 dn, search_result, 0);
	}

	slapi_sdn_done( &sdn );
	LDAPDebug( LDAP_DEBUG_TRACE, "<= passwd_modify_getEntry: %d\n", search_result, 0, 0 );
	return search_result;
}


/* Construct Mods pblock and perform the modify operation 
 * Sets result of operation in SLAPI_PLUGIN_INTOP_RESULT 
 */
static int passwd_apply_mods(const char *dn, Slapi_Mods *mods) 
{
	Slapi_PBlock pb;
	Slapi_Operation *operation= NULL;
	int ret=0;

	LDAPDebug( LDAP_DEBUG_TRACE, "=> passwd_apply_mods\n", 0, 0, 0 );

	if (mods && (slapi_mods_get_num_mods(mods) > 0)) 
	{
		pblock_init(&pb);
		slapi_modify_internal_set_pb (&pb, dn, 
		  slapi_mods_get_ldapmods_byref(mods),
		  NULL, /* Controls */
		  NULL, /* UniqueID */
		  pw_get_componentID(), /* PluginID */
		  0); /* Flags */ 

	 /* Plugin operations are INTERNAL by default, bypass it to enforce ACL checks */
	 slapi_pblock_get (&pb, SLAPI_OPERATION, &operation);

	 ret =slapi_modify_internal_pb (&pb);
  
	 slapi_pblock_get(&pb, SLAPI_PLUGIN_INTOP_RESULT, &ret);

	 if (ret != LDAP_SUCCESS){
	  LDAPDebug(LDAP_DEBUG_TRACE, "WARNING: passwordPolicy modify error %d on entry '%s'\n",
			ret, dn, 0);
	 }

	pblock_done(&pb);
 	}
 
 	LDAPDebug( LDAP_DEBUG_TRACE, "<= passwd_apply_mods: %d\n", ret, 0, 0 );
 
 	return ret;
}



/* Modify the userPassword attribute field of the entry */
static int passwd_modify_userpassword(Slapi_Entry *targetEntry, const char *newPasswd)
{
	char *dn = NULL;
	int ret = 0;
	Slapi_Mods smods;
	
    LDAPDebug( LDAP_DEBUG_TRACE, "=> passwd_modify_userpassword\n", 0, 0, 0 );
	
	slapi_mods_init (&smods, 0);
	dn = slapi_entry_get_ndn( targetEntry );
	slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, SLAPI_USERPWD_ATTR, newPasswd);


	ret = passwd_apply_mods(dn, &smods);
 
	slapi_mods_done(&smods);
	
    LDAPDebug( LDAP_DEBUG_TRACE, "<= passwd_modify_userpassword: %d\n", ret, 0, 0 );

	return ret;
}

/* Password Modify Extended operation plugin function */
int
passwd_modify_extop( Slapi_PBlock *pb )
{
	char		*oid = NULL;
	char 		*bindDN = NULL;
	char		*dn = NULL;
	char		*oldPasswd = NULL;
	char		*newPasswd = NULL;
	char		*errMesg = NULL;
	char		**reqvals = NULL;
	int             ret=0, rc=0;
	unsigned long	tag=0, len=-1;
	LDAPControl	**ctrlp = NULL; /* unused */
	Slapi_Operation *operation = NULL; /* unused */
	struct berval *extop_value = NULL;
	BerElement	*ber = NULL;
	Slapi_Entry *targetEntry=NULL;
	Connection      *conn = NULL;
	/* Slapi_DN sdn; */

    	LDAPDebug( LDAP_DEBUG_TRACE, "=> passwd_modify_extop\n", 0, 0, 0 );
	/* Get the pb ready for sending Password Modify Extended Responses back to the client. 
	 * The only requirement is to set the LDAP OID of the extended response to the EXOP_PASSWD_OID. */

	if ( slapi_pblock_set( pb, SLAPI_EXT_OP_RET_OID, EXOP_PASSWD_OID ) != 0 ) {
		errMesg = "Could not set extended response oid.\n";
		rc = LDAP_OPERATIONS_ERROR;
		slapi_log_error( SLAPI_LOG_PLUGIN, "passwd_modify_extop", 
				 errMesg );
		goto free_and_return;
	}

	/* Before going any further, we'll make sure that the right extended operation plugin
	 * has been called: i.e., the OID shipped whithin the extended operation request must 
	 * match this very plugin's OID: EXOP_PASSWD_OID. */
	if ( slapi_pblock_get( pb, SLAPI_EXT_OP_REQ_OID, &oid ) != 0 ) {
		errMesg = "Could not get OID value from request.\n";
		rc = LDAP_OPERATIONS_ERROR;
		slapi_log_error( SLAPI_LOG_PLUGIN, "passwd_modify_extop", 
				 errMesg );
		goto free_and_return;
	} else {
	        slapi_log_error( SLAPI_LOG_PLUGIN, "passwd_modify_extop", 
				 "Received extended operation request with OID %s\n", oid );
	}
	
	if ( strcasecmp( oid, EXOP_PASSWD_OID ) != 0) {
	        errMesg = "Request OID does not match Passwd OID.\n";
		rc = LDAP_OPERATIONS_ERROR;
		goto free_and_return;
	} else {
	        slapi_log_error( SLAPI_LOG_PLUGIN, "passwd_modify_extop", 
				 "Password Modify extended operation request confirmed.\n" );
	}
	
	/* Now , at least we know that the request was indeed a Password Modify one. */

#ifdef LDAP_EXTOP_PASSMOD_CONN_SECURE
	/* Allow password modify only for SSL/TLS established connections */
	conn = pb->pb_conn;
	if ( (conn->c_flags & CONN_FLAG_SSL) != CONN_FLAG_SSL) {
		errMesg = "Operation requires a secure connection.\n";
		rc = LDAP_CONFIDENTIALITY_REQUIRED;
		goto free_and_return;
	}
#endif

	/* Get the ber value of the extended operation */
	slapi_pblock_get(pb, SLAPI_EXT_OP_REQ_VALUE, &extop_value);
	
	if ((ber = ber_init(extop_value)) == NULL)
	{
		errMesg = "PasswdModify Request decode failed.\n";
		rc = LDAP_PROTOCOL_ERROR;
		goto free_and_return;
	}

	/* Format of request to parse
	*
   	* PasswdModifyRequestValue ::= SEQUENCE {
     	* userIdentity    [0]  OCTET STRING OPTIONAL
     	* oldPasswd       [1]  OCTET STRING OPTIONAL
     	* newPasswd       [2]  OCTET STRING OPTIONAL }
	*/
	slapi_pblock_get(pb, SLAPI_EXT_OP_REQ_VALUE, &extop_value);

	/* ber parse code */
	if ( ber_scanf( ber, "{") == LBER_ERROR )
    	{
    		LDAPDebug( LDAP_DEBUG_ANY,
    		    "ber_scanf failed :{\n", 0, 0, 0 );
    		errMesg = "ber_scanf failed\n";
		rc = LDAP_PROTOCOL_ERROR;
		goto free_and_return;
    	} else {
		tag = ber_peek_tag( ber, &len);
	}

	
	/* identify userID field by tags */
	if (tag == LDAP_EXTOP_PASSMOD_TAG_USERID )
	{
		if ( ber_scanf( ber, "a", &dn) == LBER_ERROR )
    		{
    		LDAPDebug( LDAP_DEBUG_ANY,
    		    "ber_scanf failed :{\n", 0, 0, 0 );
    		errMesg = "ber_scanf failed at userID parse.\n";
		rc = LDAP_PROTOCOL_ERROR;
		goto free_and_return;
    		}
		
		tag = ber_peek_tag( ber, &len);
	} 
	
	
	/* identify oldPasswd field by tags */
	if (tag == LDAP_EXTOP_PASSMOD_TAG_OLDPWD )
	{
		if ( ber_scanf( ber, "a", &oldPasswd ) == LBER_ERROR )
    		{
    		LDAPDebug( LDAP_DEBUG_ANY,
    		    "ber_scanf failed :{\n", 0, 0, 0 );
    		errMesg = "ber_scanf failed at oldPasswd parse.\n";
		rc = LDAP_PROTOCOL_ERROR;
		goto free_and_return;
    		}
		tag = ber_peek_tag( ber, &len);
	} else {
		errMesg = "Current passwd must be supplied by the user.\n";
		rc = LDAP_PARAM_ERROR;
		goto free_and_return;
	}
	
	/* identify newPasswd field by tags */
	if (tag ==  LDAP_EXTOP_PASSMOD_TAG_NEWPWD )
	{
		if ( ber_scanf( ber, "a", &newPasswd ) == LBER_ERROR )
    		{
    		LDAPDebug( LDAP_DEBUG_ANY,
    		    "ber_scanf failed :{\n", 0, 0, 0 );
    		errMesg = "ber_scanf failed at newPasswd parse.\n";
		rc = LDAP_PROTOCOL_ERROR;
		goto free_and_return;
    		}
	} else {
		errMesg = "New passwd must be supplied by the user.\n";
		rc = LDAP_PARAM_ERROR;
		goto free_and_return;
	}
	
	/* Uncomment for debugging, otherwise we don't want to leak the password values into the log... */
	/* LDAPDebug( LDAP_DEBUG_ARGS, "passwd: dn (%s), oldPasswd (%s) ,newPasswd (%s)\n",
					 dn, oldPasswd, newPasswd); */

	 
	 if (oldPasswd == NULL || *oldPasswd == '\0') {
	 /* Refuse to handle this operation because current password is not provided */
		errMesg = "Current passwd must be supplied by the user.\n";
		rc = LDAP_PARAM_ERROR;
		goto free_and_return;
	 }
	 
	 /* We don't implement password generation, so if the request implies 
	  * that they asked us to do that, we must refuse to process it  */
	 if (newPasswd == NULL || *newPasswd == '\0') {
	 /* Refuse to handle this operation because we don't allow password generation */
		errMesg = "New passwd must be supplied by the user.\n";
		rc = LDAP_PARAM_ERROR;
		goto free_and_return;
	 }
	 
	 /* Get Bind DN */
	slapi_pblock_get( pb, SLAPI_CONN_DN, &bindDN );

	/* If the connection is bound anonymously, we must refuse to process this operation. */
	 if (bindDN == NULL || *bindDN == '\0') {
	 	/* Refuse the operation because they're bound anonymously */
		errMesg = "Anonymous Binds are not allowed.\n";
		rc = LDAP_INSUFFICIENT_ACCESS;
		goto free_and_return;
	 }
	 
	 /* Determine the target DN for this operation */
	 /* Did they give us a DN ? */
	 if (dn == NULL || *dn == '\0') {
	 	/* Get the DN from the bind identity on this connection */
		dn = bindDN;
		LDAPDebug( LDAP_DEBUG_ANY,
    		    "Missing userIdentity in request, using the bind DN instead.\n",
		     0, 0, 0 );
	 }
	 
	 slapi_pblock_set( pb, SLAPI_ORIGINAL_TARGET, dn ); 

	 /* Now we have the DN, look for the entry */
	 ret = passwd_modify_getEntry(dn, &targetEntry);
	 /* If we can't find the entry, then that's an error */
	 if (ret) {
	 	/* Couldn't find the entry, fail */
		errMesg = "No such Entry exists.\n" ;
		rc = LDAP_NO_SUCH_OBJECT ;
		goto free_and_return;
	 }
	 
	 /* First thing to do is to ask access control if the bound identity has
	    rights to modify the userpassword attribute on this entry. If not, then
		we fail immediately with insufficient access. This means that we don't
		leak any useful information to the client such as current password
		wrong, etc.
	  */

	operation_set_target_spec (pb->pb_op, slapi_entry_get_sdn(targetEntry));
	slapi_pblock_set( pb, SLAPI_REQUESTOR_ISROOT, &pb->pb_op->o_isroot );

	/* In order to perform the access control check , we need to select a backend (even though
	 * we don't actually need it otherwise).
	 */
	{
		Slapi_Backend *be = NULL;

		be = slapi_mapping_tree_find_backend_for_sdn(slapi_entry_get_sdn(targetEntry));
		if (NULL == be) {
			errMesg = "Failed to find backend for target entry";
			rc = LDAP_OPERATIONS_ERROR;
			goto free_and_return;
		}
		slapi_pblock_set(pb, SLAPI_BACKEND, be);
	}

	ret = slapi_access_allowed ( pb, targetEntry, SLAPI_USERPWD_ATTR, NULL, SLAPI_ACL_WRITE );
    if ( ret != LDAP_SUCCESS ) {
		errMesg = "Insufficient access rights\n";
		rc = LDAP_INSUFFICIENT_ACCESS;
		goto free_and_return;	
	}
	 	 	 
	/* Now we have the entry which we want to modify
 	 * They gave us a password (old), check it against the target entry
	 * Is the old password valid ?
	 */
	ret = passwd_check_pwd(targetEntry, oldPasswd);
	if (ret) {
		/* No, then we fail this operation */
		errMesg = "Invalid oldPasswd value.\n";
		rc = ret;
		goto free_and_return;
	}
	

	/* Now we're ready to make actual password change */
	ret = passwd_modify_userpassword(targetEntry, newPasswd);
	if (ret != LDAP_SUCCESS) {
		/* Failed to modify the password, e.g. because insufficient access allowed */
		errMesg = "Failed to update password\n";
		rc = ret;
		goto free_and_return;
	}
	
	LDAPDebug( LDAP_DEBUG_TRACE, "<= passwd_modify_extop: %d\n", rc, 0, 0 );
	
	/* Free anything that we allocated above */
	free_and_return:
	
	if ( targetEntry != NULL ){
		slapi_entry_free (targetEntry); 
	}
	
	if ( ber != NULL ){
		ber_free(ber, 1);
		ber = NULL;
	}
	
	
	slapi_log_error( SLAPI_LOG_PLUGIN, "passwd_modify_extop", 
				 errMesg );
	send_ldap_result( pb, rc, NULL, errMesg, 0, NULL );
	

	return( SLAPI_PLUGIN_EXTENDED_SENT_RESULT );

}/* passwd_modify_extop */


static char *passwd_oid_list[] = {
	EXOP_PASSWD_OID,
	NULL
};


static char *passwd_name_list[] = {
	"passwd_modify_extop",
	NULL
};


/* Initialization function */
int passwd_modify_init( Slapi_PBlock *pb )
{
	char	**argv;
	char	*oid;

	/* Get the arguments appended to the plugin extendedop directive. The first argument 
	 * (after the standard arguments for the directive) should contain the OID of the
	 * extended operation.
	 */ 

	if ( slapi_pblock_get( pb, SLAPI_PLUGIN_ARGV, &argv ) != 0 ) {
	        slapi_log_error( SLAPI_LOG_PLUGIN, "passwd_modify_init", "Could not get argv\n" );
		return( -1 );
	}

	/* Compare the OID specified in the configuration file against the Passwd OID. */

	if ( argv == NULL || strcmp( argv[0], EXOP_PASSWD_OID ) != 0 ) {
		slapi_log_error( SLAPI_LOG_PLUGIN, "passwd_modify_init", 
				 "OID is missing or is not %s\n", EXOP_PASSWD_OID );
		return( -1 );
	} else {
		oid = slapi_ch_strdup( argv[0] );
		slapi_log_error( SLAPI_LOG_PLUGIN, "passwd_modify_init", 
				 "Registering plug-in for Password Modify extended op %s.\n", oid );
	}

	/* Register the plug-in function as an extended operation
	 * plug-in function that handles the operation identified by
	 * OID 1.3.6.1.4.1.4203.1.11.1 .  Also specify the version of the server 
	 * plug-in */ 
	if ( slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_VERSION_01 ) != 0 || 
	     slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&passwdopdesc ) != 0 ||
	     slapi_pblock_set( pb, SLAPI_PLUGIN_EXT_OP_FN, (void *) passwd_modify_extop ) != 0 ||
	     slapi_pblock_set( pb, SLAPI_PLUGIN_EXT_OP_OIDLIST, passwd_oid_list ) != 0 ||
	     slapi_pblock_set( pb, SLAPI_PLUGIN_EXT_OP_NAMELIST, passwd_name_list ) != 0 ) {

		slapi_log_error( SLAPI_LOG_PLUGIN, "passwd_modify_init",
				 "Failed to set plug-in version, function, and OID.\n" );
		return( -1 );
	}
	
	return( 0 );
}

int passwd_modify_register_plugin()
{
	slapi_register_plugin( "extendedop", 1 /* Enabled */, "passwd_modify_init", 
			passwd_modify_init, "Password Modify extended operation",
			passwd_oid_list, NULL );

	return 0;
}