git.sur5r.net Git - openldap/blob - servers/slapd/back-ldap/extended.c

   1 /* extended.c - ldap backend extended routines */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 2003-2010 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* ACKNOWLEDGEMENTS:
  17  * This work was initially developed by the Howard Chu for inclusion
  18  * in OpenLDAP Software and subsequently enhanced by Pierangelo
  19  * Masarati.
  20  */
  21
  22 #include "portable.h"
  23
  24 #include <stdio.h>
  25 #include <ac/string.h>
  26
  27 #include "slap.h"
  28 #include "back-ldap.h"
  29 #include "lber_pvt.h"
  30
  31 typedef int (ldap_back_exop_f)( Operation *op, SlapReply *rs, ldapconn_t **lc );
  32
  33 static ldap_back_exop_f ldap_back_exop_passwd;
  34 static ldap_back_exop_f ldap_back_exop_generic;
  35
  36 static struct exop {
  37         struct berval           oid;
  38         ldap_back_exop_f        *extended;
  39 } exop_table[] = {
  40         { BER_BVC(LDAP_EXOP_MODIFY_PASSWD),     ldap_back_exop_passwd },
  41         { BER_BVNULL, NULL }
  42 };
  43
  44 static int
  45 ldap_back_extended_one( Operation *op, SlapReply *rs, ldap_back_exop_f exop )
  46 {
  47         ldapinfo_t      *li = (ldapinfo_t *) op->o_bd->be_private;
  48
  49         ldapconn_t      *lc = NULL;
  50         LDAPControl     **ctrls = NULL, **oldctrls = NULL;
  51         int             rc;
  52
  53         /* FIXME: this needs to be called here, so it is
  54          * called twice; maybe we could avoid the
  55          * ldap_back_dobind() call inside each extended()
  56          * call ... */
  57         if ( !ldap_back_dobind( &lc, op, rs, LDAP_BACK_SENDERR ) ) {
  58                 return -1;
  59         }
  60
  61         ctrls = op->o_ctrls;
  62         if ( ldap_back_controls_add( op, rs, lc, &ctrls ) )
  63         {
  64                 op->o_ctrls = oldctrls;
  65                 send_ldap_extended( op, rs );
  66                 rs->sr_text = NULL;
  67                 /* otherwise frontend resends result */
  68                 rc = rs->sr_err = SLAPD_ABANDON;
  69                 goto done;
  70         }
  71
  72         op->o_ctrls = ctrls;
  73         rc = exop( op, rs, &lc );
  74
  75         op->o_ctrls = oldctrls;
  76         (void)ldap_back_controls_free( op, rs, &ctrls );
  77
  78 done:;
  79         if ( lc != NULL ) {
  80                 ldap_back_release_conn( li, lc );
  81         }
  82
  83         return rc;
  84 }
  85
  86 int
  87 ldap_back_extended(
  88                 Operation       *op,
  89                 SlapReply       *rs )
  90 {
  91         int     i;
  92
  93         for ( i = 0; exop_table[i].extended != NULL; i++ ) {
  94                 if ( bvmatch( &exop_table[i].oid, &op->oq_extended.rs_reqoid ) )
  95                 {
  96                         return ldap_back_extended_one( op, rs, exop_table[i].extended );
  97                 }
  98         }
  99
 100         /* if we get here, the exop is known; the best that we can do
 101          * is pass it thru as is */
 102         /* FIXME: maybe a list of OIDs to pass thru would be safer */
 103         return ldap_back_extended_one( op, rs, ldap_back_exop_generic );
 104 }
 105
 106 static int
 107 ldap_back_exop_passwd(
 108         Operation       *op,
 109         SlapReply       *rs,
 110         ldapconn_t      **lcp )
 111 {
 112         ldapinfo_t      *li = (ldapinfo_t *) op->o_bd->be_private;
 113
 114         ldapconn_t      *lc = *lcp;
 115         req_pwdexop_s   *qpw = &op->oq_pwdexop;
 116         LDAPMessage     *res;
 117         ber_int_t       msgid;
 118         int             rc, isproxy, freedn = 0;
 119         int             do_retry = 1;
 120         char            *text = NULL;
 121         struct berval   dn = op->o_req_dn,
 122                         ndn = op->o_req_ndn;
 123
 124         assert( lc != NULL );
 125         assert( rs->sr_ctrls == NULL );
 126
 127         if ( BER_BVISNULL( &ndn ) && op->ore_reqdata != NULL ) {
 128                 /* NOTE: most of this code is mutated
 129                  * from slap_passwd_parse();
 130                  * But here we only need
 131                  * the first berval... */
 132
 133                 ber_tag_t tag;
 134                 ber_len_t len = -1;
 135                 BerElementBuffer berbuf;
 136                 BerElement *ber = (BerElement *)&berbuf;
 137
 138                 struct berval   tmpid = BER_BVNULL;
 139
 140                 if ( op->ore_reqdata->bv_len == 0 ) {
 141                         return LDAP_PROTOCOL_ERROR;
 142                 }
 143
 144                 /* ber_init2 uses reqdata directly, doesn't allocate new buffers */
 145                 ber_init2( ber, op->ore_reqdata, 0 );
 146
 147                 tag = ber_scanf( ber, "{" /*}*/ );
 148
 149                 if ( tag == LBER_ERROR ) {
 150                         return LDAP_PROTOCOL_ERROR;
 151                 }
 152
 153                 tag = ber_peek_tag( ber, &len );
 154                 if ( tag == LDAP_TAG_EXOP_MODIFY_PASSWD_ID ) {
 155                         tag = ber_get_stringbv( ber, &tmpid, LBER_BV_NOTERM );
 156
 157                         if ( tag == LBER_ERROR ) {
 158                                 return LDAP_PROTOCOL_ERROR;
 159                         }
 160                 }
 161
 162                 if ( !BER_BVISEMPTY( &tmpid ) ) {
 163                         char idNull = tmpid.bv_val[tmpid.bv_len];
 164                         tmpid.bv_val[tmpid.bv_len] = '\0';
 165                         rs->sr_err = dnPrettyNormal( NULL, &tmpid, &dn,
 166                                 &ndn, op->o_tmpmemctx );
 167                         tmpid.bv_val[tmpid.bv_len] = idNull;
 168                         if ( rs->sr_err != LDAP_SUCCESS ) {
 169                                 /* should have been successfully parsed earlier! */
 170                                 return rs->sr_err;
 171                         }
 172                         freedn = 1;
 173
 174                 } else {
 175                         dn = op->o_dn;
 176                         ndn = op->o_ndn;
 177                 }
 178         }
 179
 180         isproxy = ber_bvcmp( &ndn, &op->o_ndn );
 181
 182         Debug( LDAP_DEBUG_ARGS, "==> ldap_back_exop_passwd(\"%s\")%s\n",
 183                 dn.bv_val, isproxy ? " (proxy)" : "", 0 );
 184
 185 retry:
 186         rc = ldap_passwd( lc->lc_ld, isproxy ? &dn : NULL,
 187                 qpw->rs_old.bv_val ? &qpw->rs_old : NULL,
 188                 qpw->rs_new.bv_val ? &qpw->rs_new : NULL,
 189                 op->o_ctrls, NULL, &msgid );
 190
 191         if ( rc == LDAP_SUCCESS ) {
 192                 /* TODO: set timeout? */
 193                 /* by now, make sure no timeout is used (ITS#6282) */
 194                 struct timeval tv;
 195                 tv.tv_sec = -1;
 196                 if ( ldap_result( lc->lc_ld, msgid, LDAP_MSG_ALL, &tv, &res ) == -1 ) {
 197                         ldap_get_option( lc->lc_ld, LDAP_OPT_ERROR_NUMBER, &rc );
 198                         rs->sr_err = rc;
 199
 200                 } else {
 201                         /* only touch when activity actually took place... */
 202                         if ( li->li_idle_timeout && lc ) {
 203                                 lc->lc_time = op->o_time;
 204                         }
 205
 206                         /* sigh. parse twice, because parse_passwd
 207                          * doesn't give us the err / match / msg info.
 208                          */
 209                         rc = ldap_parse_result( lc->lc_ld, res, &rs->sr_err,
 210                                         (char **)&rs->sr_matched,
 211                                         &text,
 212                                         NULL, &rs->sr_ctrls, 0 );
 213
 214                         if ( rc == LDAP_SUCCESS ) {
 215                                 if ( rs->sr_err == LDAP_SUCCESS ) {
 216                                         struct berval   newpw;
 217
 218                                         /* this never happens because
 219                                          * the frontend is generating
 220                                          * the new password, so when
 221                                          * the passwd exop is proxied,
 222                                          * it never delegates password
 223                                          * generation to the remote server
 224                                          */
 225                                         rc = ldap_parse_passwd( lc->lc_ld, res,
 226                                                         &newpw );
 227                                         if ( rc == LDAP_SUCCESS &&
 228                                                         !BER_BVISNULL( &newpw ) )
 229                                         {
 230                                                 rs->sr_type = REP_EXTENDED;
 231                                                 rs->sr_rspdata = slap_passwd_return( &newpw );
 232                                                 free( newpw.bv_val );
 233                                         }
 234
 235                                 } else {
 236                                         rc = rs->sr_err;
 237                                 }
 238                         }
 239                         ldap_msgfree( res );
 240                 }
 241         }
 242
 243         if ( rc != LDAP_SUCCESS ) {
 244                 rs->sr_err = slap_map_api2result( rs );
 245                 if ( rs->sr_err == LDAP_UNAVAILABLE && do_retry ) {
 246                         do_retry = 0;
 247                         if ( ldap_back_retry( &lc, op, rs, LDAP_BACK_SENDERR ) ) {
 248                                 goto retry;
 249                         }
 250                 }
 251
 252                 if ( LDAP_BACK_QUARANTINE( li ) ) {
 253                         ldap_back_quarantine( op, rs );
 254                 }
 255
 256                 if ( text ) rs->sr_text = text;
 257                 send_ldap_extended( op, rs );
 258                 /* otherwise frontend resends result */
 259                 rc = rs->sr_err = SLAPD_ABANDON;
 260
 261         } else if ( LDAP_BACK_QUARANTINE( li ) ) {
 262                 ldap_back_quarantine( op, rs );
 263         }
 264
 265         if ( freedn ) {
 266                 op->o_tmpfree( dn.bv_val, op->o_tmpmemctx );
 267                 op->o_tmpfree( ndn.bv_val, op->o_tmpmemctx );
 268         }
 269
 270         /* these have to be freed anyway... */
 271         if ( rs->sr_matched ) {
 272                 free( (char *)rs->sr_matched );
 273                 rs->sr_matched = NULL;
 274         }
 275
 276         if ( rs->sr_ctrls ) {
 277                 ldap_controls_free( rs->sr_ctrls );
 278                 rs->sr_ctrls = NULL;
 279         }
 280
 281         if ( text ) {
 282                 free( text );
 283                 rs->sr_text = NULL;
 284         }
 285
 286         /* in case, cleanup handler */
 287         if ( lc == NULL ) {
 288                 *lcp = NULL;
 289         }
 290
 291         return rc;
 292 }
 293
 294 static int
 295 ldap_back_exop_generic(
 296         Operation       *op,
 297         SlapReply       *rs,
 298         ldapconn_t      **lcp )
 299 {
 300         ldapinfo_t      *li = (ldapinfo_t *) op->o_bd->be_private;
 301
 302         ldapconn_t      *lc = *lcp;
 303         LDAPMessage     *res;
 304         ber_int_t       msgid;
 305         int             rc;
 306         int             do_retry = 1;
 307         char            *text = NULL;
 308
 309         assert( lc != NULL );
 310         assert( rs->sr_ctrls == NULL );
 311
 312         Debug( LDAP_DEBUG_ARGS, "==> ldap_back_exop_generic(%s, \"%s\")\n",
 313                 op->ore_reqoid.bv_val, op->o_req_dn.bv_val, 0 );
 314
 315 retry:
 316         rc = ldap_extended_operation( lc->lc_ld,
 317                 op->ore_reqoid.bv_val, op->ore_reqdata,
 318                 op->o_ctrls, NULL, &msgid );
 319
 320         if ( rc == LDAP_SUCCESS ) {
 321                 /* TODO: set timeout? */
 322                 /* by now, make sure no timeout is used (ITS#6282) */
 323                 struct timeval tv;
 324                 tv.tv_sec = -1;
 325                 if ( ldap_result( lc->lc_ld, msgid, LDAP_MSG_ALL, &tv, &res ) == -1 ) {
 326                         ldap_get_option( lc->lc_ld, LDAP_OPT_ERROR_NUMBER, &rc );
 327                         rs->sr_err = rc;
 328
 329                 } else {
 330                         /* only touch when activity actually took place... */
 331                         if ( li->li_idle_timeout && lc ) {
 332                                 lc->lc_time = op->o_time;
 333                         }
 334
 335                         /* sigh. parse twice, because parse_passwd
 336                          * doesn't give us the err / match / msg info.
 337                          */
 338                         rc = ldap_parse_result( lc->lc_ld, res, &rs->sr_err,
 339                                         (char **)&rs->sr_matched,
 340                                         &text,
 341                                         NULL, &rs->sr_ctrls, 0 );
 342                         if ( rc == LDAP_SUCCESS ) {
 343                                 if ( rs->sr_err == LDAP_SUCCESS ) {
 344                                         rc = ldap_parse_extended_result( lc->lc_ld, res,
 345                                                         (char **)&rs->sr_rspoid, &rs->sr_rspdata, 0 );
 346                                         if ( rc == LDAP_SUCCESS ) {
 347                                                 rs->sr_type = REP_EXTENDED;
 348                                         }
 349
 350                                 } else {
 351                                         rc = rs->sr_err;
 352                                 }
 353                         }
 354                         ldap_msgfree( res );
 355                 }
 356         }
 357
 358         if ( rc != LDAP_SUCCESS ) {
 359                 rs->sr_err = slap_map_api2result( rs );
 360                 if ( rs->sr_err == LDAP_UNAVAILABLE && do_retry ) {
 361                         do_retry = 0;
 362                         if ( ldap_back_retry( &lc, op, rs, LDAP_BACK_SENDERR ) ) {
 363                                 goto retry;
 364                         }
 365                 }
 366
 367                 if ( LDAP_BACK_QUARANTINE( li ) ) {
 368                         ldap_back_quarantine( op, rs );
 369                 }
 370
 371                 if ( text ) rs->sr_text = text;
 372                 send_ldap_extended( op, rs );
 373                 /* otherwise frontend resends result */
 374                 rc = rs->sr_err = SLAPD_ABANDON;
 375
 376         } else if ( LDAP_BACK_QUARANTINE( li ) ) {
 377                 ldap_back_quarantine( op, rs );
 378         }
 379
 380         /* these have to be freed anyway... */
 381         if ( rs->sr_matched ) {
 382                 free( (char *)rs->sr_matched );
 383                 rs->sr_matched = NULL;
 384         }
 385
 386         if ( rs->sr_ctrls ) {
 387                 ldap_controls_free( rs->sr_ctrls );
 388                 rs->sr_ctrls = NULL;
 389         }
 390
 391         if ( text ) {
 392                 free( text );
 393                 rs->sr_text = NULL;
 394         }
 395
 396         /* in case, cleanup handler */
 397         if ( lc == NULL ) {
 398                 *lcp = NULL;
 399         }
 400
 401         return rc;
 402 }
 403