1 /* extended.c - ldap backend extended routines */
3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
5 * Copyright 2003-2010 The OpenLDAP Foundation.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted only as authorized by the OpenLDAP
12 * A copy of this license is available in the file LICENSE in the
13 * top-level directory of the distribution or, alternatively, at
14 * <http://www.OpenLDAP.org/license.html>.
17 * This work was initially developed by the Howard Chu for inclusion
18 * in OpenLDAP Software and subsequently enhanced by Pierangelo
25 #include <ac/string.h>
28 #include "back-ldap.h"
31 typedef int (ldap_back_exop_f)( Operation *op, SlapReply *rs, ldapconn_t **lc );
33 static ldap_back_exop_f ldap_back_exop_passwd;
34 static ldap_back_exop_f ldap_back_exop_generic;
38 ldap_back_exop_f *extended;
40 { BER_BVC(LDAP_EXOP_MODIFY_PASSWD), ldap_back_exop_passwd },
45 ldap_back_extended_one( Operation *op, SlapReply *rs, ldap_back_exop_f exop )
47 ldapinfo_t *li = (ldapinfo_t *) op->o_bd->be_private;
49 ldapconn_t *lc = NULL;
50 LDAPControl **ctrls = NULL, **oldctrls = NULL;
53 /* FIXME: this needs to be called here, so it is
54 * called twice; maybe we could avoid the
55 * ldap_back_dobind() call inside each extended()
57 if ( !ldap_back_dobind( &lc, op, rs, LDAP_BACK_SENDERR ) ) {
62 if ( ldap_back_controls_add( op, rs, lc, &ctrls ) )
64 op->o_ctrls = oldctrls;
65 send_ldap_extended( op, rs );
67 /* otherwise frontend resends result */
68 rc = rs->sr_err = SLAPD_ABANDON;
73 rc = exop( op, rs, &lc );
75 op->o_ctrls = oldctrls;
76 (void)ldap_back_controls_free( op, rs, &ctrls );
80 ldap_back_release_conn( li, lc );
93 for ( i = 0; exop_table[i].extended != NULL; i++ ) {
94 if ( bvmatch( &exop_table[i].oid, &op->oq_extended.rs_reqoid ) )
96 return ldap_back_extended_one( op, rs, exop_table[i].extended );
100 /* if we get here, the exop is known; the best that we can do
101 * is pass it thru as is */
102 /* FIXME: maybe a list of OIDs to pass thru would be safer */
103 return ldap_back_extended_one( op, rs, ldap_back_exop_generic );
107 ldap_back_exop_passwd(
112 ldapinfo_t *li = (ldapinfo_t *) op->o_bd->be_private;
114 ldapconn_t *lc = *lcp;
115 req_pwdexop_s *qpw = &op->oq_pwdexop;
118 int rc, isproxy, freedn = 0;
121 struct berval dn = op->o_req_dn,
124 assert( lc != NULL );
125 assert( rs->sr_ctrls == NULL );
127 if ( BER_BVISNULL( &ndn ) && op->ore_reqdata != NULL ) {
128 /* NOTE: most of this code is mutated
129 * from slap_passwd_parse();
130 * But here we only need
131 * the first berval... */
135 BerElementBuffer berbuf;
136 BerElement *ber = (BerElement *)&berbuf;
138 struct berval tmpid = BER_BVNULL;
140 if ( op->ore_reqdata->bv_len == 0 ) {
141 return LDAP_PROTOCOL_ERROR;
144 /* ber_init2 uses reqdata directly, doesn't allocate new buffers */
145 ber_init2( ber, op->ore_reqdata, 0 );
147 tag = ber_scanf( ber, "{" /*}*/ );
149 if ( tag == LBER_ERROR ) {
150 return LDAP_PROTOCOL_ERROR;
153 tag = ber_peek_tag( ber, &len );
154 if ( tag == LDAP_TAG_EXOP_MODIFY_PASSWD_ID ) {
155 tag = ber_get_stringbv( ber, &tmpid, LBER_BV_NOTERM );
157 if ( tag == LBER_ERROR ) {
158 return LDAP_PROTOCOL_ERROR;
162 if ( !BER_BVISEMPTY( &tmpid ) ) {
163 char idNull = tmpid.bv_val[tmpid.bv_len];
164 tmpid.bv_val[tmpid.bv_len] = '\0';
165 rs->sr_err = dnPrettyNormal( NULL, &tmpid, &dn,
166 &ndn, op->o_tmpmemctx );
167 tmpid.bv_val[tmpid.bv_len] = idNull;
168 if ( rs->sr_err != LDAP_SUCCESS ) {
169 /* should have been successfully parsed earlier! */
180 isproxy = ber_bvcmp( &ndn, &op->o_ndn );
182 Debug( LDAP_DEBUG_ARGS, "==> ldap_back_exop_passwd(\"%s\")%s\n",
183 dn.bv_val, isproxy ? " (proxy)" : "", 0 );
186 rc = ldap_passwd( lc->lc_ld, isproxy ? &dn : NULL,
187 qpw->rs_old.bv_val ? &qpw->rs_old : NULL,
188 qpw->rs_new.bv_val ? &qpw->rs_new : NULL,
189 op->o_ctrls, NULL, &msgid );
191 if ( rc == LDAP_SUCCESS ) {
192 /* TODO: set timeout? */
193 /* by now, make sure no timeout is used (ITS#6282) */
194 struct timeval tv = { -1, 0 };
195 if ( ldap_result( lc->lc_ld, msgid, LDAP_MSG_ALL, &tv, &res ) == -1 ) {
196 ldap_get_option( lc->lc_ld, LDAP_OPT_ERROR_NUMBER, &rc );
200 /* only touch when activity actually took place... */
201 if ( li->li_idle_timeout && lc ) {
202 lc->lc_time = op->o_time;
205 /* sigh. parse twice, because parse_passwd
206 * doesn't give us the err / match / msg info.
208 rc = ldap_parse_result( lc->lc_ld, res, &rs->sr_err,
209 (char **)&rs->sr_matched,
211 NULL, &rs->sr_ctrls, 0 );
213 if ( rc == LDAP_SUCCESS ) {
214 if ( rs->sr_err == LDAP_SUCCESS ) {
217 /* this never happens because
218 * the frontend is generating
219 * the new password, so when
220 * the passwd exop is proxied,
221 * it never delegates password
222 * generation to the remote server
224 rc = ldap_parse_passwd( lc->lc_ld, res,
226 if ( rc == LDAP_SUCCESS &&
227 !BER_BVISNULL( &newpw ) )
229 rs->sr_type = REP_EXTENDED;
230 rs->sr_rspdata = slap_passwd_return( &newpw );
231 free( newpw.bv_val );
242 if ( rc != LDAP_SUCCESS ) {
243 rs->sr_err = slap_map_api2result( rs );
244 if ( rs->sr_err == LDAP_UNAVAILABLE && do_retry ) {
246 if ( ldap_back_retry( &lc, op, rs, LDAP_BACK_SENDERR ) ) {
251 if ( LDAP_BACK_QUARANTINE( li ) ) {
252 ldap_back_quarantine( op, rs );
255 if ( text ) rs->sr_text = text;
256 send_ldap_extended( op, rs );
257 /* otherwise frontend resends result */
258 rc = rs->sr_err = SLAPD_ABANDON;
260 } else if ( LDAP_BACK_QUARANTINE( li ) ) {
261 ldap_back_quarantine( op, rs );
265 op->o_tmpfree( dn.bv_val, op->o_tmpmemctx );
266 op->o_tmpfree( ndn.bv_val, op->o_tmpmemctx );
269 /* these have to be freed anyway... */
270 if ( rs->sr_matched ) {
271 free( (char *)rs->sr_matched );
272 rs->sr_matched = NULL;
275 if ( rs->sr_ctrls ) {
276 ldap_controls_free( rs->sr_ctrls );
285 /* in case, cleanup handler */
294 ldap_back_exop_generic(
299 ldapinfo_t *li = (ldapinfo_t *) op->o_bd->be_private;
301 ldapconn_t *lc = *lcp;
308 assert( lc != NULL );
309 assert( rs->sr_ctrls == NULL );
311 Debug( LDAP_DEBUG_ARGS, "==> ldap_back_exop_generic(%s, \"%s\")\n",
312 op->ore_reqoid.bv_val, op->o_req_dn.bv_val, 0 );
315 rc = ldap_extended_operation( lc->lc_ld,
316 op->ore_reqoid.bv_val, op->ore_reqdata,
317 op->o_ctrls, NULL, &msgid );
319 if ( rc == LDAP_SUCCESS ) {
320 /* TODO: set timeout? */
321 /* by now, make sure no timeout is used (ITS#6282) */
322 struct timeval tv = { -1, 0 };
323 if ( ldap_result( lc->lc_ld, msgid, LDAP_MSG_ALL, &tv, &res ) == -1 ) {
324 ldap_get_option( lc->lc_ld, LDAP_OPT_ERROR_NUMBER, &rc );
328 /* only touch when activity actually took place... */
329 if ( li->li_idle_timeout && lc ) {
330 lc->lc_time = op->o_time;
333 /* sigh. parse twice, because parse_passwd
334 * doesn't give us the err / match / msg info.
336 rc = ldap_parse_result( lc->lc_ld, res, &rs->sr_err,
337 (char **)&rs->sr_matched,
339 NULL, &rs->sr_ctrls, 0 );
340 if ( rc == LDAP_SUCCESS ) {
341 if ( rs->sr_err == LDAP_SUCCESS ) {
342 rc = ldap_parse_extended_result( lc->lc_ld, res,
343 (char **)&rs->sr_rspoid, &rs->sr_rspdata, 0 );
344 if ( rc == LDAP_SUCCESS ) {
345 rs->sr_type = REP_EXTENDED;
356 if ( rc != LDAP_SUCCESS ) {
357 rs->sr_err = slap_map_api2result( rs );
358 if ( rs->sr_err == LDAP_UNAVAILABLE && do_retry ) {
360 if ( ldap_back_retry( &lc, op, rs, LDAP_BACK_SENDERR ) ) {
365 if ( LDAP_BACK_QUARANTINE( li ) ) {
366 ldap_back_quarantine( op, rs );
369 if ( text ) rs->sr_text = text;
370 send_ldap_extended( op, rs );
371 /* otherwise frontend resends result */
372 rc = rs->sr_err = SLAPD_ABANDON;
374 } else if ( LDAP_BACK_QUARANTINE( li ) ) {
375 ldap_back_quarantine( op, rs );
378 /* these have to be freed anyway... */
379 if ( rs->sr_matched ) {
380 free( (char *)rs->sr_matched );
381 rs->sr_matched = NULL;
384 if ( rs->sr_ctrls ) {
385 ldap_controls_free( rs->sr_ctrls );
394 /* in case, cleanup handler */