Description of problem:
- When analyzing log files with sasl binds (method=sasl and mech=EXTERNAL) with
an empty DN (dn="") they are counted as anonymous. If this is a successful SASL
bind attempt, should this be logged as a sasl bind?
Version-Release number of selected component (if applicable):
Directory Server 8.2
Directory Server 9.1
How reproducible:
Always
Steps to Reproduce:
Run logconv against the following log snippet:
[16/Jun/2014:16:32:05 +0000] conn=34397 fd=8193 slot=8193 SSL connection from
0.0.0.0 to 1.1.1.1
[16/Jun/2014:16:32:05 +0000] conn=34397 SSL 256-bit AES; client
CN=LDAPS-Portal-user-2,OU=People,DC=example,DC=local; issuer CN=CA-1
Certificate Authority,OU=Certification Authorities
[16/Jun/2014:16:32:05 +0000] conn=34397 SSL client bound as
cn=LDAPS-Portal-user-2,ou=People,dc=example,dc=com
[16/Jun/2014:16:32:05 +0000] conn=34397 op=0 BIND dn="" method=sasl version=3
mech=EXTERNAL
Actual results:
Binds:                        1
Unbinds:                      0
 LDAP v2 Binds:               0
 LDAP v3 Binds:               1
 SSL Client Binds:            1
 Failed SSL Client Binds:     0
 SASL Binds:                  1
  1     EXTERNAL
 Directory Manager Binds:     0
 Anonymous Binds:             1
 Other Binds:                 0
Expected results:
Binds:                        1
Unbinds:                      0
 LDAP v2 Binds:               0
 LDAP v3 Binds:               1
 SSL Client Binds:            1
 Failed SSL Client Binds:     0
 SASL Binds:                  1
  1     EXTERNAL
 Directory Manager Binds:     0
 Anonymous Binds:             0
 Other Binds:                 1
Additional info:
~~~
if (m/ BIND/ && m/dn=""/){$anony++; $bindlist{"Anonymous
Binds"}++;inc_stats('anonbind',$s_stats,$m_stats);}
~~~
on line 1463 comes before
~~~
if (/ BIND / && /method=sasl/i){
        $sasl++;
        if ($_ =~ /mech=(.*)/i ){
                $saslmech{$1}++;
        }
~~~
on line 1882. I think it's getting counted as Anonymous and moving to the next
line in the log  before it hits the method=sasl check.