git.sur5r.net Git - openldap/blob - servers/slapd/back-ldap/search.c

   1 /* search.c - ldap backend search function */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 1999-2005 The OpenLDAP Foundation.
   6  * Portions Copyright 1999-2003 Howard Chu.
   7  * Portions Copyright 2000-2003 Pierangelo Masarati.
   8  * All rights reserved.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted only as authorized by the OpenLDAP
  12  * Public License.
  13  *
  14  * A copy of this license is available in the file LICENSE in the
  15  * top-level directory of the distribution or, alternatively, at
  16  * <http://www.OpenLDAP.org/license.html>.
  17  */
  18 /* ACKNOWLEDGEMENTS:
  19  * This work was initially developed by the Howard Chu for inclusion
  20  * in OpenLDAP Software and subsequently enhanced by Pierangelo
  21  * Masarati.
  22  */
  23
  24 #include "portable.h"
  25
  26 #include <stdio.h>
  27
  28 #include <ac/socket.h>
  29 #include <ac/string.h>
  30 #include <ac/time.h>
  31
  32 #include "slap.h"
  33 #include "back-ldap.h"
  34 #undef ldap_debug       /* silence a warning in ldap-int.h */
  35 #include "../../../libraries/libldap/ldap-int.h"
  36
  37 #include "lutil.h"
  38
  39 static int
  40 ldap_build_entry( Operation *op, LDAPMessage *e, Entry *ent,
  41          struct berval *bdn, int flags );
  42 #define LDAP_BUILD_ENTRY_PRIVATE        0x01
  43
  44 int
  45 ldap_back_search(
  46                 Operation       *op,
  47                 SlapReply       *rs )
  48 {
  49         struct ldapconn *lc;
  50         struct timeval  tv;
  51         LDAPMessage     *res,
  52                         *e;
  53         int             rc = 0,
  54                         msgid;
  55         struct berval   match = BER_BVNULL;
  56         int             i;
  57         char            **attrs = NULL;
  58         int             dontfreetext = 0;
  59         int             freeconn = 0;
  60         int             do_retry = 1;
  61         LDAPControl     **ctrls = NULL;
  62
  63         lc = ldap_back_getconn( op, rs );
  64         if ( !lc ) {
  65                 return -1;
  66         }
  67
  68         /*
  69          * FIXME: in case of values return filter, we might want
  70          * to map attrs and maybe rewrite value
  71          */
  72         if ( !ldap_back_dobind( lc, op, rs ) ) {
  73                 return -1;
  74         }
  75
  76         /* should we check return values? */
  77         if ( op->ors_deref != -1 ) {
  78                 ldap_set_option( lc->lc_ld, LDAP_OPT_DEREF,
  79                                 (void *)&op->ors_deref );
  80         }
  81
  82         if ( op->ors_tlimit != SLAP_NO_LIMIT ) {
  83                 tv.tv_sec = op->ors_tlimit;
  84                 tv.tv_usec = 0;
  85
  86         } else {
  87                 tv.tv_sec = 0;
  88         }
  89
  90         if ( op->ors_attrs ) {
  91                 for ( i = 0; !BER_BVISNULL( &op->ors_attrs[i].an_name ); i++ )
  92                         /* just count attrs */ ;
  93
  94                 attrs = ch_malloc( ( i + 1 )*sizeof( char * ) );
  95                 if ( attrs == NULL ) {
  96                         rs->sr_err = LDAP_NO_MEMORY;
  97                         rc = -1;
  98                         goto finish;
  99                 }
 100
 101                 for ( i = 0; !BER_BVISNULL( &op->ors_attrs[i].an_name ); i++ ) {
 102                         attrs[ i ] = op->ors_attrs[i].an_name.bv_val;
 103                 }
 104                 attrs[ i ] = NULL;
 105         }
 106
 107         ctrls = op->o_ctrls;
 108 #ifdef LDAP_BACK_PROXY_AUTHZ
 109         rc = ldap_back_proxy_authz_ctrl( lc, op, rs, &ctrls );
 110         if ( rc != LDAP_SUCCESS ) {
 111                 dontfreetext = 1;
 112                 goto finish;
 113         }
 114 #endif /* LDAP_BACK_PROXY_AUTHZ */
 115
 116 retry:
 117         rs->sr_err = ldap_search_ext( lc->lc_ld, op->o_req_ndn.bv_val,
 118                         op->ors_scope, op->ors_filterstr.bv_val,
 119                         attrs, op->ors_attrsonly, ctrls, NULL,
 120                         tv.tv_sec ? &tv : NULL,
 121                         op->ors_slimit, &msgid );
 122
 123         if ( rs->sr_err != LDAP_SUCCESS ) {
 124 fail:;
 125                 rc = ldap_back_op_result( lc, op, rs, msgid, 0 );
 126                 if ( freeconn ) {
 127                         ldap_back_freeconn( op, lc );
 128                         lc = NULL;
 129                 }
 130                 goto finish;
 131         }
 132
 133         /* We pull apart the ber result, stuff it into a slapd entry, and
 134          * let send_search_entry stuff it back into ber format. Slow & ugly,
 135          * but this is necessary for version matching, and for ACL processing.
 136          */
 137
 138         for ( rc = 0; rc != -1; rc = ldap_result( lc->lc_ld, msgid, 0, &tv, &res ) )
 139         {
 140                 /* check for abandon */
 141                 if ( op->o_abandon ) {
 142                         ldap_abandon_ext( lc->lc_ld, msgid, NULL, NULL );
 143                         rc = 0;
 144                         goto finish;
 145                 }
 146
 147                 if ( rc == 0 ) {
 148                         tv.tv_sec = 0;
 149                         tv.tv_usec = 100000;
 150                         ldap_pvt_thread_yield();
 151
 152                 } else if ( rc == LDAP_RES_SEARCH_ENTRY ) {
 153                         Entry           ent = {0};
 154                         struct berval   bdn;
 155                         int             abort = 0;
 156
 157                         do_retry = 0;
 158
 159                         e = ldap_first_entry( lc->lc_ld, res );
 160                         rc = ldap_build_entry( op, e, &ent, &bdn,
 161                                         LDAP_BUILD_ENTRY_PRIVATE );
 162                        if ( rc == LDAP_SUCCESS ) {
 163                                 rs->sr_entry = &ent;
 164                                 rs->sr_attrs = op->ors_attrs;
 165                                 rs->sr_operational_attrs = NULL;
 166                                 rs->sr_flags = 0;
 167                                 abort = send_search_entry( op, rs );
 168                                 while ( ent.e_attrs ) {
 169                                         Attribute       *a;
 170                                         BerVarray       v;
 171
 172                                         a = ent.e_attrs;
 173                                         ent.e_attrs = a->a_next;
 174
 175                                         v = a->a_vals;
 176                                         if ( a->a_vals != &slap_dummy_bv ) {
 177                                                 ber_bvarray_free( a->a_vals );
 178                                         }
 179                                         if ( a->a_nvals != v ) {
 180                                                 ber_bvarray_free( a->a_nvals );
 181                                         }
 182                                         ch_free( a );
 183                                 }
 184
 185                                 if ( ent.e_dn && ( ent.e_dn != bdn.bv_val ) ) {
 186                                         free( ent.e_dn );
 187                                 }
 188                                 if ( ent.e_ndn ) {
 189                                         free( ent.e_ndn );
 190                                 }
 191                         }
 192                         ldap_msgfree( res );
 193                         if ( abort ) {
 194                                 ldap_abandon_ext( lc->lc_ld, msgid, NULL, NULL );
 195                                 goto finish;
 196                         }
 197
 198                 } else if ( rc == LDAP_RES_SEARCH_REFERENCE ) {
 199                         char            **references = NULL;
 200                         int             cnt;
 201
 202                         do_retry = 0;
 203                         rc = ldap_parse_reference( lc->lc_ld, res,
 204                                         &references, &rs->sr_ctrls, 1 );
 205
 206                         if ( rc != LDAP_SUCCESS ) {
 207                                 continue;
 208                         }
 209
 210                         if ( references == NULL ) {
 211                                 continue;
 212                         }
 213
 214                         for ( cnt = 0; references[ cnt ]; cnt++ )
 215                                 /* NO OP */ ;
 216
 217                         rs->sr_ref = ch_calloc( cnt + 1, sizeof( struct berval ) );
 218
 219                         for ( cnt = 0; references[ cnt ]; cnt++ ) {
 220                                 ber_str2bv( references[ cnt ], 0, 0, &rs->sr_ref[ cnt ] );
 221                         }
 222
 223                         /* ignore return value by now */
 224                         ( void )send_search_reference( op, rs );
 225
 226                         /* cleanup */
 227                         if ( references ) {
 228                                 ldap_value_free( references );
 229                                 ch_free( rs->sr_ref );
 230                                 rs->sr_ref = NULL;
 231                         }
 232
 233                         if ( rs->sr_ctrls ) {
 234                                 ldap_controls_free( rs->sr_ctrls );
 235                                 rs->sr_ctrls = NULL;
 236                         }
 237
 238                 } else {
 239                         rc = ldap_parse_result( lc->lc_ld, res, &rs->sr_err,
 240                                         &match.bv_val, (char **)&rs->sr_text,
 241                                         NULL, &rs->sr_ctrls, 1 );
 242                         if (rc != LDAP_SUCCESS ) {
 243                                 rs->sr_err = rc;
 244                         }
 245                         rs->sr_err = slap_map_api2result( rs );
 246                         rc = 0;
 247                         break;
 248                 }
 249         }
 250
 251         if ( rc == -1 ) {
 252                 if ( do_retry ) {
 253                         do_retry = 0;
 254                         if ( ldap_back_retry( lc, op, rs ) ) {
 255                                 goto retry;
 256                         }
 257                 }
 258                 /* FIXME: invalidate the connection? */
 259                 rs->sr_err = LDAP_SERVER_DOWN;
 260                 freeconn = 1;
 261                 goto fail;
 262         }
 263
 264         /*
 265          * Rewrite the matched portion of the search base, if required
 266          */
 267         if ( !BER_BVISNULL( &match ) && !BER_BVISEMPTY( &match ) ) {
 268                 rs->sr_matched = match.bv_val;
 269         }
 270         if ( rs->sr_v2ref ) {
 271                 rs->sr_err = LDAP_REFERRAL;
 272         }
 273
 274 finish:;
 275         send_ldap_result( op, rs );
 276
 277 #ifdef LDAP_BACK_PROXY_AUTHZ
 278         (void)ldap_back_proxy_authz_ctrl_free( op, &ctrls );
 279 #endif /* LDAP_BACK_PROXY_AUTHZ */
 280
 281         if ( rs->sr_ctrls ) {
 282                 ldap_controls_free( rs->sr_ctrls );
 283                 rs->sr_ctrls = NULL;
 284         }
 285
 286         if ( match.bv_val ) {
 287                 rs->sr_matched = NULL;
 288                 LDAP_FREE( match.bv_val );
 289         }
 290         if ( rs->sr_text ) {
 291                 if ( !dontfreetext ) {
 292                         LDAP_FREE( (char *)rs->sr_text );
 293                 }
 294                 rs->sr_text = NULL;
 295         }
 296         if ( attrs ) {
 297                 ch_free( attrs );
 298         }
 299
 300         return rc;
 301 }
 302
 303 static int
 304 ldap_build_entry(
 305                 Operation       *op,
 306                 LDAPMessage     *e,
 307                 Entry           *ent,
 308                 struct berval   *bdn,
 309                 int             flags )
 310 {
 311         struct berval   a;
 312         BerElement      ber = *e->lm_ber;
 313         Attribute       *attr, **attrp;
 314         const char      *text;
 315         int             last;
 316         int             private = flags & LDAP_BUILD_ENTRY_PRIVATE;
 317
 318         /* safe assumptions ... */
 319         assert( ent );
 320         BER_BVZERO( &ent->e_bv );
 321
 322         if ( ber_scanf( &ber, "{m{", bdn ) == LBER_ERROR ) {
 323                 return LDAP_DECODING_ERROR;
 324         }
 325
 326         /*
 327          * Note: this may fail if the target host(s) schema differs
 328          * from the one known to the meta, and a DN with unknown
 329          * attributes is returned.
 330          *
 331          * FIXME: should we log anything, or delegate to dnNormalize?
 332          */
 333         /* Note: if the distinguished values or the naming attributes
 334          * change, should we massage them as well?
 335          */
 336         if ( dnPrettyNormal( NULL, bdn, &ent->e_name, &ent->e_nname,
 337                 op->o_tmpmemctx ) != LDAP_SUCCESS )
 338         {
 339                 return LDAP_INVALID_DN_SYNTAX;
 340         }
 341
 342         attrp = &ent->e_attrs;
 343
 344         while ( ber_scanf( &ber, "{m", &a ) != LBER_ERROR ) {
 345                 int                             i;
 346                 slap_syntax_validate_func       *validate;
 347                 slap_syntax_transform_func      *pretty;
 348
 349                 attr = (Attribute *)ch_malloc( sizeof( Attribute ) );
 350                 if ( attr == NULL ) {
 351                         continue;
 352                 }
 353                 attr->a_flags = 0;
 354                 attr->a_next = 0;
 355                 attr->a_desc = NULL;
 356                 if ( slap_bv2ad( &a, &attr->a_desc, &text )
 357                                 != LDAP_SUCCESS )
 358                 {
 359                         if ( slap_bv2undef_ad( &a, &attr->a_desc, &text )
 360                                         != LDAP_SUCCESS )
 361                         {
 362                                 Debug( LDAP_DEBUG_ANY,
 363                                         "slap_bv2undef_ad(%s):  %s\n",
 364                                         a.bv_val, text, 0 );
 365                                 ch_free( attr );
 366                                 continue;
 367                         }
 368                 }
 369
 370                 /* no subschemaSubentry */
 371                 if ( attr->a_desc == slap_schema.si_ad_subschemaSubentry ) {
 372
 373                         /*
 374                          * We eat target's subschemaSubentry because
 375                          * a search for this value is likely not
 376                          * to resolve to the appropriate backend;
 377                          * later, the local subschemaSubentry is
 378                          * added.
 379                          */
 380                         ( void )ber_scanf( &ber, "x" /* [W] */ );
 381
 382                         ch_free( attr );
 383                         continue;
 384                 }
 385
 386                 if ( ber_scanf( &ber, "[W]", &attr->a_vals ) == LBER_ERROR
 387                                 || attr->a_vals == NULL )
 388                 {
 389                         /*
 390                          * Note: attr->a_vals can be null when using
 391                          * values result filter
 392                          */
 393                         if ( private ) {
 394                                 attr->a_vals = (struct berval *)&slap_dummy_bv;
 395
 396                         } else {
 397                                 attr->a_vals = ch_malloc( sizeof( struct berval ) );
 398                                 BER_BVZERO( &attr->a_vals[ 0 ] );
 399                         }
 400                         last = 0;
 401
 402                 } else {
 403                         for ( last = 0; !BER_BVISNULL( &attr->a_vals[ last ] ); last++ )
 404                                 /* just count vals */ ;
 405                 }
 406
 407                 validate = attr->a_desc->ad_type->sat_syntax->ssyn_validate;
 408                 pretty = attr->a_desc->ad_type->sat_syntax->ssyn_pretty;
 409
 410                 if ( !validate && !pretty ) {
 411                         attr->a_nvals = NULL;
 412                         attr_free( attr );
 413                         goto next_attr;
 414                 }
 415
 416                 for ( i = 0; i < last; i++ ) {
 417                         struct berval   pval;
 418                         int             rc;
 419
 420                         if ( pretty ) {
 421                                 rc = pretty( attr->a_desc->ad_type->sat_syntax,
 422                                         &attr->a_vals[i], &pval, NULL );
 423
 424                         } else {
 425                                 rc = validate( attr->a_desc->ad_type->sat_syntax,
 426                                         &attr->a_vals[i] );
 427                         }
 428
 429                         if ( rc != LDAP_SUCCESS ) {
 430                                 /* check if, by chance, it's an undefined objectClass */
 431                                 if ( attr->a_desc == slap_schema.si_ad_objectClass &&
 432                                                 oc_bvfind_undef( &attr->a_vals[i] ) != NULL )
 433                                 {
 434                                         ber_dupbv( &pval, &attr->a_vals[i] );
 435
 436                                 } else {
 437                                         attr->a_nvals = NULL;
 438                                         attr_free( attr );
 439                                         goto next_attr;
 440                                 }
 441                         }
 442
 443                         if ( pretty ) {
 444                                 LBER_FREE( attr->a_vals[i].bv_val );
 445                                 attr->a_vals[i] = pval;
 446                         }
 447                 }
 448
 449                 if ( last && attr->a_desc->ad_type->sat_equality &&
 450                                 attr->a_desc->ad_type->sat_equality->smr_normalize )
 451                 {
 452                         attr->a_nvals = ch_malloc( ( last + 1 )*sizeof( struct berval ) );
 453                         for ( i = 0; i < last; i++ ) {
 454                                 int             rc;
 455
 456                                 /*
 457                                  * check that each value is valid per syntax
 458                                  * and pretty if appropriate
 459                                  */
 460                                 rc = attr->a_desc->ad_type->sat_equality->smr_normalize(
 461                                         SLAP_MR_VALUE_OF_ATTRIBUTE_SYNTAX,
 462                                         attr->a_desc->ad_type->sat_syntax,
 463                                         attr->a_desc->ad_type->sat_equality,
 464                                         &attr->a_vals[i], &attr->a_nvals[i],
 465                                         NULL );
 466
 467                                 if ( rc != LDAP_SUCCESS ) {
 468                                         BER_BVZERO( &attr->a_nvals[i] );
 469                                         ch_free( attr );
 470                                         goto next_attr;
 471                                 }
 472                         }
 473                         BER_BVZERO( &attr->a_nvals[i] );
 474
 475                 } else {
 476                         attr->a_nvals = attr->a_vals;
 477                 }
 478                 *attrp = attr;
 479                 attrp = &attr->a_next;
 480
 481 next_attr:;
 482         }
 483
 484         return LDAP_SUCCESS;
 485 }
 486
 487 /* return 0 IFF we can retrieve the entry with ndn
 488  */
 489 int
 490 ldap_back_entry_get(
 491                 Operation               *op,
 492                 struct berval           *ndn,
 493                 ObjectClass             *oc,
 494                 AttributeDescription    *at,
 495                 int                     rw,
 496                 Entry                   **ent
 497 )
 498 {
 499         struct ldapconn *lc;
 500         int             rc = 1,
 501                         is_oc,
 502                         do_not_cache;
 503         struct berval   bdn;
 504         LDAPMessage     *result = NULL,
 505                         *e = NULL;
 506         char            *gattr[3];
 507         char            *filter = NULL;
 508         Connection      *oconn;
 509         SlapReply       rs;
 510         int             do_retry = 1;
 511
 512         /* Tell getconn this is a privileged op */
 513         do_not_cache = op->o_do_not_cache;
 514         op->o_do_not_cache = 1;
 515         lc = ldap_back_getconn( op, &rs );
 516         oconn = op->o_conn;
 517         op->o_conn = NULL;
 518         if ( !lc || !ldap_back_dobind( lc, op, &rs ) ) {
 519                 op->o_do_not_cache = do_not_cache;
 520                 op->o_conn = oconn;
 521                 return 1;
 522         }
 523         op->o_do_not_cache = do_not_cache;
 524         op->o_conn = oconn;
 525
 526         if ( at ) {
 527                 is_oc = ( strcasecmp( "objectclass", at->ad_cname.bv_val ) == 0 );
 528                 if ( oc && !is_oc ) {
 529                         gattr[0] = "objectclass";
 530                         gattr[1] = at->ad_cname.bv_val;
 531                         gattr[2] = NULL;
 532
 533                 } else {
 534                         gattr[0] = at->ad_cname.bv_val;
 535                         gattr[1] = NULL;
 536                 }
 537         }
 538
 539         if ( oc ) {
 540                 char    *ptr;
 541
 542                 filter = ch_malloc( STRLENOF( "(objectclass=)" )
 543                                 + oc->soc_cname.bv_len + 1 );
 544                 ptr = lutil_strcopy( filter, "(objectclass=" );
 545                 ptr = lutil_strcopy( ptr, oc->soc_cname.bv_val );
 546                 *ptr++ = ')';
 547                 *ptr++ = '\0';
 548         }
 549
 550 retry:
 551         rc = ldap_search_ext_s( lc->lc_ld, ndn->bv_val, LDAP_SCOPE_BASE, filter,
 552                                 at ? gattr : NULL, 0, NULL, NULL, LDAP_NO_LIMIT,
 553                                 LDAP_NO_LIMIT, &result );
 554         if ( rc != LDAP_SUCCESS ) {
 555                 if ( rc == LDAP_SERVER_DOWN && do_retry ) {
 556                         do_retry = 0;
 557                         if ( ldap_back_retry( lc, op, &rs ) ) {
 558                                 goto retry;
 559                         }
 560                 }
 561                 goto cleanup;
 562         }
 563
 564         e = ldap_first_entry( lc->lc_ld, result );
 565         if ( e == NULL ) {
 566                 goto cleanup;
 567         }
 568
 569         *ent = ch_calloc( 1, sizeof( Entry ) );
 570
 571         rc = ldap_build_entry( op, e, *ent, &bdn, 0 );
 572
 573         if ( rc != LDAP_SUCCESS ) {
 574                 ch_free( *ent );
 575                 *ent = NULL;
 576         }
 577
 578 cleanup:
 579         if ( result ) {
 580                 ldap_msgfree( result );
 581         }
 582
 583         if ( filter ) {
 584                 ch_free( filter );
 585         }
 586
 587         return rc;
 588 }
 589