2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
4 * Copyright 1999-2011 The OpenLDAP Foundation.
5 * Portions Copyright 2001-2003 Pierangelo Masarati.
6 * Portions Copyright 1999-2003 Howard Chu.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted only as authorized by the OpenLDAP
13 * A copy of this license is available in the file LICENSE in the
14 * top-level directory of the distribution or, alternatively, at
15 * <http://www.OpenLDAP.org/license.html>.
18 * This work was initially developed by the Howard Chu for inclusion
19 * in OpenLDAP Software and subsequently enhanced by Pierangelo
28 #include <ac/socket.h>
29 #include <ac/string.h>
34 #include "../back-ldap/back-ldap.h"
35 #include "back-meta.h"
37 #include "lutil_ldap.h"
40 meta_back_proxy_authz_bind(
45 ldap_back_send_t sendok,
49 meta_back_single_bind(
56 meta_back_bind( Operation *op, SlapReply *rs )
58 metainfo_t *mi = ( metainfo_t * )op->o_bd->be_private;
59 metaconn_t *mc = NULL;
66 SlapReply *candidates;
68 rs->sr_err = LDAP_SUCCESS;
70 Debug( LDAP_DEBUG_ARGS, "%s meta_back_bind: dn=\"%s\".\n",
71 op->o_log_prefix, op->o_req_dn.bv_val, 0 );
73 /* the test on the bind method should be superfluous */
74 switch ( be_rootdn_bind( op, rs ) ) {
76 if ( META_BACK_DEFER_ROOTDN_BIND( mi ) ) {
77 /* frontend will return success */
84 case SLAP_CB_CONTINUE:
88 /* be_rootdn_bind() sent result */
92 /* we need meta_back_getconn() not send result even on error,
93 * because we want to intercept the error and make it
94 * invalidCredentials */
95 mc = meta_back_getconn( op, rs, NULL, LDAP_BACK_BIND_DONTSEND );
97 if ( LogTest( LDAP_DEBUG_ANY ) ) {
98 char buf[ SLAP_TEXT_BUFLEN ];
100 snprintf( buf, sizeof( buf ),
101 "meta_back_bind: no target "
102 "for dn \"%s\" (%d%s%s).",
103 op->o_req_dn.bv_val, rs->sr_err,
104 rs->sr_text ? ". " : "",
105 rs->sr_text ? rs->sr_text : "" );
106 Debug( LDAP_DEBUG_ANY,
108 op->o_log_prefix, buf, 0 );
111 /* FIXME: there might be cases where we don't want
112 * to map the error onto invalidCredentials */
113 switch ( rs->sr_err ) {
114 case LDAP_NO_SUCH_OBJECT:
115 case LDAP_UNWILLING_TO_PERFORM:
116 rs->sr_err = LDAP_INVALID_CREDENTIALS;
120 send_ldap_result( op, rs );
124 candidates = meta_back_candidates_get( op );
127 * Each target is scanned ...
129 mc->mc_authz_target = META_BOUND_NONE;
130 for ( i = 0; i < mi->mi_ntargets; i++ ) {
131 metatarget_t *mt = mi->mi_targets[ i ];
135 * Skip non-candidates
137 if ( !META_IS_CANDIDATE( &candidates[ i ] ) ) {
142 /* set rc to LDAP_SUCCESS only if at least
143 * one candidate has been tried */
147 } else if ( !isroot ) {
149 * A bind operation is expected to have
150 * ONE CANDIDATE ONLY!
152 Debug( LDAP_DEBUG_ANY,
153 "### %s meta_back_bind: more than one"
154 " candidate selected...\n",
155 op->o_log_prefix, 0, 0 );
159 if ( mt->mt_idassert_authmethod == LDAP_AUTH_NONE
160 || BER_BVISNULL( &mt->mt_idassert_authcDN ) )
162 metasingleconn_t *msc = &mc->mc_conns[ i ];
164 /* skip the target if no pseudorootdn is provided */
165 if ( !BER_BVISNULL( &msc->msc_bound_ndn ) ) {
166 ch_free( msc->msc_bound_ndn.bv_val );
167 BER_BVZERO( &msc->msc_bound_ndn );
170 if ( !BER_BVISNULL( &msc->msc_cred ) ) {
171 /* destroy sensitive data */
172 memset( msc->msc_cred.bv_val, 0,
173 msc->msc_cred.bv_len );
174 ch_free( msc->msc_cred.bv_val );
175 BER_BVZERO( &msc->msc_cred );
182 (void)meta_back_proxy_authz_bind( mc, i, op, rs, LDAP_BACK_DONTSEND, 1 );
186 lerr = meta_back_single_bind( op, rs, mc, i );
189 if ( lerr != LDAP_SUCCESS ) {
190 rc = rs->sr_err = lerr;
192 /* FIXME: in some cases (e.g. unavailable)
193 * do not assume it's not candidate; rather
194 * mark this as an error to be eventually
195 * reported to client */
196 META_CANDIDATE_CLEAR( &candidates[ i ] );
201 /* must re-insert if local DN changed as result of bind */
202 if ( rc == LDAP_SUCCESS ) {
204 mc->mc_authz_target = META_BOUND_ALL;
207 if ( !LDAP_BACK_PCONN_ISPRIV( mc )
208 && !dn_match( &op->o_req_ndn, &mc->mc_local_ndn ) )
212 /* wait for all other ops to release the connection */
213 ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
214 assert( mc->mc_refcnt == 1 );
215 #if META_BACK_PRINT_CONNTREE > 0
216 meta_back_print_conntree( mi, ">>> meta_back_bind" );
217 #endif /* META_BACK_PRINT_CONNTREE */
219 /* delete all cached connections with the current connection */
220 if ( LDAP_BACK_SINGLECONN( mi ) ) {
223 while ( ( tmpmc = avl_delete( &mi->mi_conninfo.lai_tree, (caddr_t)mc, meta_back_conn_cmp ) ) != NULL )
225 assert( !LDAP_BACK_PCONN_ISPRIV( mc ) );
226 Debug( LDAP_DEBUG_TRACE,
227 "=>meta_back_bind: destroying conn %lu (refcnt=%u)\n",
228 mc->mc_conn->c_connid, mc->mc_refcnt, 0 );
230 if ( tmpmc->mc_refcnt != 0 ) {
232 LDAP_BACK_CONN_TAINTED_SET( tmpmc );
236 * Needs a test because the handler may be corrupted,
237 * and calling ldap_unbind on a corrupted header results
238 * in a segmentation fault
240 meta_back_conn_free( tmpmc );
245 ber_bvreplace( &mc->mc_local_ndn, &op->o_req_ndn );
246 lerr = avl_insert( &mi->mi_conninfo.lai_tree, (caddr_t)mc,
247 meta_back_conndn_cmp, meta_back_conndn_dup );
248 #if META_BACK_PRINT_CONNTREE > 0
249 meta_back_print_conntree( mi, "<<< meta_back_bind" );
250 #endif /* META_BACK_PRINT_CONNTREE */
253 /* NOTE: a connection cannot be privileged
254 * and be in the avl tree at the same time
257 LDAP_BACK_CONN_ISPRIV_SET( mc );
258 LDAP_BACK_PCONN_SET( mc, op );
261 LDAP_BACK_CONN_CACHED_SET( mc );
264 LDAP_BACK_CONN_CACHED_CLEAR( mc );
266 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
271 meta_back_release_conn( mi, mc );
275 * rc is LDAP_SUCCESS if at least one bind succeeded,
276 * err is the last error that occurred during a bind;
277 * if at least (and at most?) one bind succeeds, fine.
279 if ( rc != LDAP_SUCCESS ) {
282 * deal with bind failure ...
286 * no target was found within the naming context,
287 * so bind must fail with invalid credentials
289 if ( rs->sr_err == LDAP_SUCCESS && gotit == 0 ) {
290 rs->sr_err = LDAP_INVALID_CREDENTIALS;
292 rs->sr_err = slap_map_api2result( rs );
294 send_ldap_result( op, rs );
303 meta_back_bind_op_result(
309 ldap_back_send_t sendok,
312 metainfo_t *mi = ( metainfo_t * )op->o_bd->be_private;
313 metatarget_t *mt = mi->mi_targets[ candidate ];
314 metasingleconn_t *msc = &mc->mc_conns[ candidate ];
318 int nretries = mt->mt_nretries;
319 char buf[ SLAP_TEXT_BUFLEN ];
321 Debug( LDAP_DEBUG_TRACE,
322 ">>> %s meta_back_bind_op_result[%d]\n",
323 op->o_log_prefix, candidate, 0 );
325 /* make sure this is clean */
326 assert( rs->sr_ctrls == NULL );
328 if ( rs->sr_err == LDAP_SUCCESS ) {
329 time_t stoptime = (time_t)(-1),
331 int timeout_err = op->o_protocol >= LDAP_VERSION3 ?
332 LDAP_ADMINLIMIT_EXCEEDED : LDAP_OTHER;
333 const char *timeout_text = "Operation timed out";
334 slap_op_t opidx = slap_req2op( op->o_tag );
336 /* since timeout is not specified, compute and use
337 * the one specific to the ongoing operation */
338 if ( opidx == LDAP_REQ_SEARCH ) {
339 if ( op->ors_tlimit <= 0 ) {
343 timeout = op->ors_tlimit;
344 timeout_err = LDAP_TIMELIMIT_EXCEEDED;
349 timeout = mt->mt_timeout[ opidx ];
352 /* better than nothing :) */
353 if ( timeout == 0 ) {
354 if ( mi->mi_idle_timeout ) {
355 timeout = mi->mi_idle_timeout;
357 } else if ( mi->mi_conn_ttl ) {
358 timeout = mi->mi_conn_ttl;
363 stoptime = op->o_time + timeout;
366 LDAP_BACK_TV_SET( &tv );
372 rc = ldap_result( msc->msc_ld, msgid, LDAP_MSG_ALL, &tv, &res );
375 if ( nretries != META_RETRY_NEVER
376 || ( timeout && slap_get_time() <= stoptime ) )
378 ldap_pvt_thread_yield();
379 if ( nretries > 0 ) {
382 tv = mt->mt_bind_timeout;
386 /* don't let anyone else use this handler,
387 * because there's a pending bind that will not
390 ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
392 assert( LDAP_BACK_CONN_BINDING( msc ) );
395 Debug( LDAP_DEBUG_ANY, "### %s meta_back_bind_op_result ldap_unbind_ext[%d] ld=%p\n",
396 op->o_log_prefix, candidate, (void *)msc->msc_ld );
397 #endif /* DEBUG_205 */
399 meta_clear_one_candidate( op, mc, candidate );
401 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
404 rs->sr_err = timeout_err;
405 rs->sr_text = timeout_text;
409 ldap_get_option( msc->msc_ld, LDAP_OPT_ERROR_NUMBER,
412 snprintf( buf, sizeof( buf ),
413 "err=%d (%s) nretries=%d",
414 rs->sr_err, ldap_err2string( rs->sr_err ), nretries );
415 Debug( LDAP_DEBUG_ANY,
416 "### %s meta_back_bind_op_result[%d]: %s.\n",
417 op->o_log_prefix, candidate, buf );
421 /* only touch when activity actually took place... */
422 if ( mi->mi_idle_timeout != 0 && msc->msc_time < op->o_time ) {
423 msc->msc_time = op->o_time;
426 /* FIXME: matched? referrals? response controls? */
427 rc = ldap_parse_result( msc->msc_ld, res, &rs->sr_err,
428 NULL, NULL, NULL, NULL, 1 );
429 if ( rc != LDAP_SUCCESS ) {
432 rs->sr_err = slap_map_api2result( rs );
437 rs->sr_err = slap_map_api2result( rs );
439 Debug( LDAP_DEBUG_TRACE,
440 "<<< %s meta_back_bind_op_result[%d] err=%d\n",
441 op->o_log_prefix, candidate, rs->sr_err );
447 * meta_back_single_bind
449 * attempts to perform a bind with creds
452 meta_back_single_bind(
458 metainfo_t *mi = ( metainfo_t * )op->o_bd->be_private;
459 metatarget_t *mt = mi->mi_targets[ candidate ];
460 struct berval mdn = BER_BVNULL;
461 metasingleconn_t *msc = &mc->mc_conns[ candidate ];
464 struct berval save_o_dn;
465 int save_o_do_not_cache;
466 LDAPControl **ctrls = NULL;
468 if ( !BER_BVISNULL( &msc->msc_bound_ndn ) ) {
469 ch_free( msc->msc_bound_ndn.bv_val );
470 BER_BVZERO( &msc->msc_bound_ndn );
473 if ( !BER_BVISNULL( &msc->msc_cred ) ) {
474 /* destroy sensitive data */
475 memset( msc->msc_cred.bv_val, 0, msc->msc_cred.bv_len );
476 ch_free( msc->msc_cred.bv_val );
477 BER_BVZERO( &msc->msc_cred );
481 * Rewrite the bind dn if needed
484 dc.conn = op->o_conn;
488 if ( ldap_back_dn_massage( &dc, &op->o_req_dn, &mdn ) ) {
489 rs->sr_text = "DN rewrite error";
490 rs->sr_err = LDAP_OTHER;
494 /* don't add proxyAuthz; set the bindDN */
495 save_o_dn = op->o_dn;
496 save_o_do_not_cache = op->o_do_not_cache;
497 op->o_do_not_cache = 1;
498 op->o_dn = op->o_req_dn;
501 rs->sr_err = meta_back_controls_add( op, rs, mc, candidate, &ctrls );
502 op->o_dn = save_o_dn;
503 op->o_do_not_cache = save_o_do_not_cache;
504 if ( rs->sr_err != LDAP_SUCCESS ) {
508 /* FIXME: this fixes the bind problem right now; we need
509 * to use the asynchronous version to get the "matched"
510 * and more in case of failure ... */
511 /* FIXME: should we check if at least some of the op->o_ctrls
512 * can/should be passed? */
514 rs->sr_err = ldap_sasl_bind( msc->msc_ld, mdn.bv_val,
515 LDAP_SASL_SIMPLE, &op->orb_cred,
516 ctrls, NULL, &msgid );
517 if ( rs->sr_err != LDAP_X_CONNECTING ) {
520 ldap_pvt_thread_yield();
523 mi->mi_ldap_extra->controls_free( op, rs, &ctrls );
525 meta_back_bind_op_result( op, rs, mc, candidate, msgid, LDAP_BACK_DONTSEND, 1 );
526 if ( rs->sr_err != LDAP_SUCCESS ) {
530 /* If defined, proxyAuthz will be used also when
531 * back-ldap is the authorizing backend; for this
532 * purpose, a successful bind is followed by a
533 * bind with the configured identity assertion */
534 /* NOTE: use with care */
535 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OVERRIDE ) {
536 meta_back_proxy_authz_bind( mc, candidate, op, rs, LDAP_BACK_SENDERR, 1 );
537 if ( !LDAP_BACK_CONN_ISBOUND( msc ) ) {
543 ber_bvreplace( &msc->msc_bound_ndn, &op->o_req_ndn );
544 LDAP_BACK_CONN_ISBOUND_SET( msc );
545 mc->mc_authz_target = candidate;
547 if ( META_BACK_TGT_SAVECRED( mt ) ) {
548 if ( !BER_BVISNULL( &msc->msc_cred ) ) {
549 memset( msc->msc_cred.bv_val, 0,
550 msc->msc_cred.bv_len );
552 ber_bvreplace( &msc->msc_cred, &op->orb_cred );
553 ldap_set_rebind_proc( msc->msc_ld, mt->mt_rebind_f, msc );
557 if ( mi->mi_cache.ttl != META_DNCACHE_DISABLED
558 && !BER_BVISEMPTY( &op->o_req_ndn ) )
560 ( void )meta_dncache_update_entry( &mi->mi_cache,
561 &op->o_req_ndn, candidate );
565 if ( mdn.bv_val != op->o_req_dn.bv_val ) {
569 if ( META_BACK_TGT_QUARANTINE( mt ) ) {
570 meta_back_quarantine( op, rs, candidate );
577 * meta_back_single_dobind
580 meta_back_single_dobind(
585 ldap_back_send_t sendok,
589 metainfo_t *mi = ( metainfo_t * )op->o_bd->be_private;
590 metatarget_t *mt = mi->mi_targets[ candidate ];
591 metaconn_t *mc = *mcp;
592 metasingleconn_t *msc = &mc->mc_conns[ candidate ];
595 assert( !LDAP_BACK_CONN_ISBOUND( msc ) );
597 /* NOTE: this obsoletes pseudorootdn */
598 if ( op->o_conn != NULL &&
599 !op->o_do_not_cache &&
600 ( BER_BVISNULL( &msc->msc_bound_ndn ) ||
601 BER_BVISEMPTY( &msc->msc_bound_ndn ) ||
602 ( LDAP_BACK_CONN_ISPRIV( mc ) && dn_match( &msc->msc_bound_ndn, &mt->mt_idassert_authcDN ) ) ||
603 ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OVERRIDE ) ) )
605 (void)meta_back_proxy_authz_bind( mc, candidate, op, rs, sendok, dolock );
609 struct berval cred = BER_BVC( "" );
611 /* use credentials if available */
612 if ( !BER_BVISNULL( &msc->msc_bound_ndn )
613 && !BER_BVISNULL( &msc->msc_cred ) )
615 binddn = msc->msc_bound_ndn.bv_val;
616 cred = msc->msc_cred;
619 /* FIXME: should we check if at least some of the op->o_ctrls
620 * can/should be passed? */
622 rs->sr_err = ldap_sasl_bind( msc->msc_ld,
623 binddn, LDAP_SASL_SIMPLE, &cred,
624 NULL, NULL, &msgid );
625 if ( rs->sr_err != LDAP_X_CONNECTING ) {
628 ldap_pvt_thread_yield();
631 rs->sr_err = meta_back_bind_op_result( op, rs, mc, candidate, msgid, sendok, dolock );
633 /* if bind succeeded, but anonymous, clear msc_bound_ndn */
634 if ( rs->sr_err != LDAP_SUCCESS || binddn[0] == '\0' ) {
635 if ( !BER_BVISNULL( &msc->msc_bound_ndn ) ) {
636 ber_memfree( msc->msc_bound_ndn.bv_val );
637 BER_BVZERO( &msc->msc_bound_ndn );
640 if ( !BER_BVISNULL( &msc->msc_cred ) ) {
641 memset( msc->msc_cred.bv_val, 0, msc->msc_cred.bv_len );
642 ber_memfree( msc->msc_cred.bv_val );
643 BER_BVZERO( &msc->msc_cred );
648 if ( rs->sr_err != LDAP_SUCCESS ) {
650 ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
652 LDAP_BACK_CONN_BINDING_CLEAR( msc );
653 if ( META_BACK_ONERR_STOP( mi ) ) {
654 LDAP_BACK_CONN_TAINTED_SET( mc );
655 meta_back_release_conn_lock( mi, mc, 0 );
659 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
663 if ( META_BACK_TGT_QUARANTINE( mt ) ) {
664 meta_back_quarantine( op, rs, candidate );
678 ldap_back_send_t sendok )
680 metainfo_t *mi = ( metainfo_t * )op->o_bd->be_private;
686 SlapReply *candidates;
688 if ( be_isroot( op ) ) {
692 if ( LogTest( LDAP_DEBUG_TRACE ) ) {
693 char buf[STRLENOF("4294967295U") + 1] = { 0 };
694 mi->mi_ldap_extra->connid2str( &mc->mc_base, buf, sizeof(buf) );
696 Debug( LDAP_DEBUG_TRACE,
697 "%s meta_back_dobind: conn=%s%s\n",
698 op->o_log_prefix, buf,
699 isroot ? " (isroot)" : "" );
703 * all the targets are bound as pseudoroot
705 if ( mc->mc_authz_target == META_BOUND_ALL ) {
710 candidates = meta_back_candidates_get( op );
712 for ( i = 0; i < mi->mi_ntargets; i++ ) {
713 metatarget_t *mt = mi->mi_targets[ i ];
714 metasingleconn_t *msc = &mc->mc_conns[ i ];
720 if ( !META_IS_CANDIDATE( &candidates[ i ] ) ) {
724 assert( msc->msc_ld != NULL );
727 * If the target is already bound it is skipped
731 ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
732 if ( LDAP_BACK_CONN_ISBOUND( msc )
733 || ( LDAP_BACK_CONN_ISANON( msc )
734 && mt->mt_idassert_authmethod == LDAP_AUTH_NONE ) )
736 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
740 } else if ( META_BACK_CONN_CREATING( msc ) || LDAP_BACK_CONN_BINDING( msc ) )
742 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
743 ldap_pvt_thread_yield();
748 LDAP_BACK_CONN_BINDING_SET( msc );
749 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
751 rc = meta_back_single_dobind( op, rs, &mc, i,
752 LDAP_BACK_DONTSEND, mt->mt_nretries, 1 );
754 * NOTE: meta_back_single_dobind() already retries;
755 * in case of failure, it resets mc...
757 if ( rc != LDAP_SUCCESS ) {
758 char buf[ SLAP_TEXT_BUFLEN ];
761 /* meta_back_single_dobind() already sent
762 * response and released connection */
767 if ( rc == LDAP_UNAVAILABLE ) {
768 /* FIXME: meta_back_retry() already re-calls
769 * meta_back_single_dobind() */
770 if ( meta_back_retry( op, rs, &mc, i, sendok ) ) {
775 ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
776 LDAP_BACK_CONN_BINDING_CLEAR( msc );
777 meta_back_release_conn_lock( mi, mc, 0 );
778 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
784 ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
785 LDAP_BACK_CONN_BINDING_CLEAR( msc );
786 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
788 snprintf( buf, sizeof( buf ),
789 "meta_back_dobind[%d]: (%s) err=%d (%s).",
790 i, isroot ? op->o_bd->be_rootdn.bv_val : "anonymous",
791 rc, ldap_err2string( rc ) );
792 Debug( LDAP_DEBUG_ANY,
794 op->o_log_prefix, buf, 0 );
797 * null cred bind should always succeed
798 * as anonymous, so a failure means
799 * the target is no longer candidate possibly
800 * due to technical reasons (remote host down?)
801 * so better clear the handle
803 /* leave the target candidate, but record the error for later use */
804 candidates[ i ].sr_err = rc;
805 if ( META_BACK_ONERR_STOP( mi ) ) {
814 Debug( LDAP_DEBUG_TRACE,
815 "%s meta_back_dobind[%d]: "
818 isroot ? op->o_bd->be_rootdn.bv_val : "anonymous" );
820 ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
821 LDAP_BACK_CONN_BINDING_CLEAR( msc );
823 LDAP_BACK_CONN_ISBOUND_SET( msc );
825 LDAP_BACK_CONN_ISANON_SET( msc );
827 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
832 if ( LogTest( LDAP_DEBUG_TRACE ) ) {
833 char buf[STRLENOF("4294967295U") + 1] = { 0 };
834 mi->mi_ldap_extra->connid2str( &mc->mc_base, buf, sizeof(buf) );
836 Debug( LDAP_DEBUG_TRACE,
837 "%s meta_back_dobind: conn=%s bound=%d\n",
838 op->o_log_prefix, buf, bound );
842 meta_back_release_conn( mi, mc );
845 if ( sendok & LDAP_BACK_SENDERR ) {
846 if ( rs->sr_err == LDAP_SUCCESS ) {
847 rs->sr_err = LDAP_BUSY;
849 send_ldap_result( op, rs );
855 return ( bound > 0 );
859 * meta_back_default_rebind
861 * This is a callback used for chasing referrals using the same
862 * credentials as the original user on this session.
865 meta_back_default_rebind(
867 LDAP_CONST char *url,
872 metasingleconn_t *msc = ( metasingleconn_t * )params;
874 return ldap_sasl_bind_s( ld, msc->msc_bound_ndn.bv_val,
875 LDAP_SASL_SIMPLE, &msc->msc_cred,
880 * meta_back_default_urllist
882 * This is a callback used for mucking with the urllist
885 meta_back_default_urllist(
887 LDAPURLDesc **urllist,
891 metatarget_t *mt = (metatarget_t *)params;
892 LDAPURLDesc **urltail;
894 if ( urllist == url ) {
898 for ( urltail = &(*url)->lud_next; *urltail; urltail = &(*urltail)->lud_next )
905 ldap_pvt_thread_mutex_lock( &mt->mt_uri_mutex );
907 ch_free( mt->mt_uri );
910 ldap_get_option( ld, LDAP_OPT_URI, (void *)&mt->mt_uri );
911 ldap_pvt_thread_mutex_unlock( &mt->mt_uri_mutex );
923 ldap_back_send_t sendok )
925 metainfo_t *mi = (metainfo_t *)op->o_bd->be_private;
927 metatarget_t *mt = mi->mi_targets[ candidate ];
928 metasingleconn_t *msc = &mc->mc_conns[ candidate ];
932 Debug( LDAP_DEBUG_TRACE, ">>> %s meta_back_cancel[%d] msgid=%d\n",
933 op->o_log_prefix, candidate, msgid );
935 /* default behavior */
936 if ( META_BACK_TGT_ABANDON( mt ) ) {
937 rc = ldap_abandon_ext( msc->msc_ld, msgid, NULL, NULL );
939 } else if ( META_BACK_TGT_IGNORE( mt ) ) {
940 rc = ldap_pvt_discard( msc->msc_ld, msgid );
942 } else if ( META_BACK_TGT_CANCEL( mt ) ) {
943 rc = ldap_cancel_s( msc->msc_ld, msgid, NULL, NULL );
949 Debug( LDAP_DEBUG_TRACE, "<<< %s meta_back_cancel[%d] err=%d\n",
950 op->o_log_prefix, candidate, rc );
958 * FIXME: error return must be handled in a cleaner way ...
968 ldap_back_send_t sendok )
970 metainfo_t *mi = ( metainfo_t * )op->o_bd->be_private;
972 const char *save_text = rs->sr_text,
973 *save_matched = rs->sr_matched;
974 BerVarray save_ref = rs->sr_ref;
975 LDAPControl **save_ctrls = rs->sr_ctrls;
976 void *matched_ctx = NULL;
978 char *matched = NULL;
981 LDAPControl **ctrls = NULL;
983 assert( mc != NULL );
986 rs->sr_matched = NULL;
990 if ( candidate != META_TARGET_NONE ) {
991 metatarget_t *mt = mi->mi_targets[ candidate ];
992 metasingleconn_t *msc = &mc->mc_conns[ candidate ];
994 if ( LDAP_ERR_OK( rs->sr_err ) ) {
997 LDAPMessage *res = NULL;
998 time_t stoptime = (time_t)(-1);
999 int timeout_err = op->o_protocol >= LDAP_VERSION3 ?
1000 LDAP_ADMINLIMIT_EXCEEDED : LDAP_OTHER;
1001 const char *timeout_text = "Operation timed out";
1003 /* if timeout is not specified, compute and use
1004 * the one specific to the ongoing operation */
1005 if ( timeout == (time_t)(-1) ) {
1006 slap_op_t opidx = slap_req2op( op->o_tag );
1008 if ( opidx == SLAP_OP_SEARCH ) {
1009 if ( op->ors_tlimit <= 0 ) {
1013 timeout = op->ors_tlimit;
1014 timeout_err = LDAP_TIMELIMIT_EXCEEDED;
1015 timeout_text = NULL;
1019 timeout = mt->mt_timeout[ opidx ];
1023 /* better than nothing :) */
1024 if ( timeout == 0 ) {
1025 if ( mi->mi_idle_timeout ) {
1026 timeout = mi->mi_idle_timeout;
1028 } else if ( mi->mi_conn_ttl ) {
1029 timeout = mi->mi_conn_ttl;
1034 stoptime = op->o_time + timeout;
1037 LDAP_BACK_TV_SET( &tv );
1040 rc = ldap_result( msc->msc_ld, msgid, LDAP_MSG_ALL, &tv, &res );
1043 if ( timeout && slap_get_time() > stoptime ) {
1044 (void)meta_back_cancel( mc, op, rs, msgid, candidate, sendok );
1045 rs->sr_err = timeout_err;
1046 rs->sr_text = timeout_text;
1050 LDAP_BACK_TV_SET( &tv );
1051 ldap_pvt_thread_yield();
1055 ldap_get_option( msc->msc_ld, LDAP_OPT_RESULT_CODE,
1060 /* otherwise get the result; if it is not
1061 * LDAP_SUCCESS, record it in the reply
1062 * structure (this includes
1063 * LDAP_COMPARE_{TRUE|FALSE}) */
1065 /* only touch when activity actually took place... */
1066 if ( mi->mi_idle_timeout != 0 && msc->msc_time < op->o_time ) {
1067 msc->msc_time = op->o_time;
1070 rc = ldap_parse_result( msc->msc_ld, res, &rs->sr_err,
1071 &matched, &text, &refs, &ctrls, 1 );
1073 if ( rc == LDAP_SUCCESS ) {
1078 rs->sr_err = slap_map_api2result( rs );
1080 /* RFC 4511: referrals can only appear
1081 * if result code is LDAP_REFERRAL */
1083 && refs[ 0 ] != NULL
1084 && refs[ 0 ][ 0 ] != '\0' )
1086 if ( rs->sr_err != LDAP_REFERRAL ) {
1087 Debug( LDAP_DEBUG_ANY,
1088 "%s meta_back_op_result[%d]: "
1089 "got referrals with err=%d\n",
1091 candidate, rs->sr_err );
1096 for ( i = 0; refs[ i ] != NULL; i++ )
1098 rs->sr_ref = op->o_tmpalloc( sizeof( struct berval ) * ( i + 1 ),
1100 for ( i = 0; refs[ i ] != NULL; i++ ) {
1101 ber_str2bv( refs[ i ], 0, 0, &rs->sr_ref[ i ] );
1103 BER_BVZERO( &rs->sr_ref[ i ] );
1106 } else if ( rs->sr_err == LDAP_REFERRAL ) {
1107 Debug( LDAP_DEBUG_ANY,
1108 "%s meta_back_op_result[%d]: "
1109 "got err=%d with null "
1110 "or empty referrals\n",
1112 candidate, rs->sr_err );
1114 rs->sr_err = LDAP_NO_SUCH_OBJECT;
1117 if ( ctrls != NULL ) {
1118 rs->sr_ctrls = ctrls;
1122 assert( res == NULL );
1125 /* if the error in the reply structure is not
1126 * LDAP_SUCCESS, try to map it from client
1127 * to server error */
1128 if ( !LDAP_ERR_OK( rs->sr_err ) ) {
1129 rs->sr_err = slap_map_api2result( rs );
1131 /* internal ops ( op->o_conn == NULL )
1132 * must not reply to client */
1133 if ( op->o_conn && !op->o_do_not_cache && matched ) {
1135 /* record the (massaged) matched
1136 * DN into the reply structure */
1137 rs->sr_matched = matched;
1141 if ( META_BACK_TGT_QUARANTINE( mt ) ) {
1142 meta_back_quarantine( op, rs, candidate );
1149 for ( i = 0; i < mi->mi_ntargets; i++ ) {
1150 metasingleconn_t *msc = &mc->mc_conns[ i ];
1152 char *xmatched = NULL;
1154 if ( msc->msc_ld == NULL ) {
1158 rs->sr_err = LDAP_SUCCESS;
1160 ldap_get_option( msc->msc_ld, LDAP_OPT_RESULT_CODE, &rs->sr_err );
1161 if ( rs->sr_err != LDAP_SUCCESS ) {
1163 * better check the type of error. In some cases
1164 * (search ?) it might be better to return a
1165 * success if at least one of the targets gave
1166 * positive result ...
1168 ldap_get_option( msc->msc_ld,
1169 LDAP_OPT_DIAGNOSTIC_MESSAGE, &xtext );
1170 if ( xtext != NULL && xtext [ 0 ] == '\0' ) {
1171 ldap_memfree( xtext );
1175 ldap_get_option( msc->msc_ld,
1176 LDAP_OPT_MATCHED_DN, &xmatched );
1177 if ( xmatched != NULL && xmatched[ 0 ] == '\0' ) {
1178 ldap_memfree( xmatched );
1182 rs->sr_err = slap_map_api2result( rs );
1184 if ( LogTest( LDAP_DEBUG_ANY ) ) {
1185 char buf[ SLAP_TEXT_BUFLEN ];
1187 snprintf( buf, sizeof( buf ),
1188 "meta_back_op_result[%d] "
1189 "err=%d text=\"%s\" matched=\"%s\"",
1191 ( xtext ? xtext : "" ),
1192 ( xmatched ? xmatched : "" ) );
1193 Debug( LDAP_DEBUG_ANY, "%s %s.\n",
1194 op->o_log_prefix, buf, 0 );
1198 * FIXME: need to rewrite "match" (need rwinfo)
1200 switch ( rs->sr_err ) {
1203 if ( xtext != NULL ) {
1205 ldap_memfree( text );
1210 if ( xmatched != NULL ) {
1212 ldap_memfree( matched );
1221 ldap_memfree( xtext );
1225 ldap_memfree( xmatched );
1229 if ( META_BACK_TGT_QUARANTINE( mi->mi_targets[ i ] ) ) {
1230 meta_back_quarantine( op, rs, i );
1234 if ( err != LDAP_SUCCESS ) {
1239 if ( matched != NULL ) {
1240 struct berval dn, pdn;
1242 ber_str2bv( matched, 0, 0, &dn );
1243 if ( dnPretty( NULL, &dn, &pdn, op->o_tmpmemctx ) == LDAP_SUCCESS ) {
1244 ldap_memfree( matched );
1245 matched_ctx = op->o_tmpmemctx;
1246 matched = pdn.bv_val;
1248 rs->sr_matched = matched;
1251 if ( rs->sr_err == LDAP_UNAVAILABLE ) {
1252 if ( !( sendok & LDAP_BACK_RETRYING ) ) {
1253 if ( op->o_conn && ( sendok & LDAP_BACK_SENDERR ) ) {
1254 if ( rs->sr_text == NULL ) rs->sr_text = "Proxy operation retry failed";
1255 send_ldap_result( op, rs );
1259 } else if ( op->o_conn &&
1260 ( ( ( sendok & LDAP_BACK_SENDOK ) && LDAP_ERR_OK( rs->sr_err ) )
1261 || ( ( sendok & LDAP_BACK_SENDERR ) && !LDAP_ERR_OK( rs->sr_err ) ) ) )
1263 send_ldap_result( op, rs );
1266 op->o_tmpfree( (char *)rs->sr_matched, matched_ctx );
1269 ldap_memfree( text );
1272 op->o_tmpfree( rs->sr_ref, op->o_tmpmemctx );
1276 ber_memvfree( (void **)refs );
1279 assert( rs->sr_ctrls != NULL );
1280 ldap_controls_free( ctrls );
1283 rs->sr_text = save_text;
1284 rs->sr_matched = save_matched;
1285 rs->sr_ref = save_ref;
1286 rs->sr_ctrls = save_ctrls;
1288 return( LDAP_ERR_OK( rs->sr_err ) ? LDAP_SUCCESS : rs->sr_err );
1292 * meta_back_proxy_authz_cred()
1294 * prepares credentials & method for meta_back_proxy_authz_bind();
1295 * or, if method is SASL, performs the SASL bind directly.
1298 meta_back_proxy_authz_cred(
1303 ldap_back_send_t sendok,
1304 struct berval *binddn,
1305 struct berval *bindcred,
1308 metainfo_t *mi = (metainfo_t *)op->o_bd->be_private;
1309 metatarget_t *mt = mi->mi_targets[ candidate ];
1310 metasingleconn_t *msc = &mc->mc_conns[ candidate ];
1314 /* don't proxyAuthz if protocol is not LDAPv3 */
1315 switch ( mt->mt_version ) {
1320 if ( op->o_protocol == 0 || op->o_protocol == LDAP_VERSION3 ) {
1326 rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
1327 if ( sendok & LDAP_BACK_SENDERR ) {
1328 send_ldap_result( op, rs );
1330 LDAP_BACK_CONN_ISBOUND_CLEAR( msc );
1334 if ( op->o_tag == LDAP_REQ_BIND ) {
1335 ndn = op->o_req_ndn;
1337 } else if ( !BER_BVISNULL( &op->o_conn->c_ndn ) ) {
1338 ndn = op->o_conn->c_ndn;
1345 * FIXME: we need to let clients use proxyAuthz
1346 * otherwise we cannot do symmetric pools of servers;
1347 * we have to live with the fact that a user can
1348 * authorize itself as any ID that is allowed
1349 * by the authzTo directive of the "proxyauthzdn".
1352 * NOTE: current Proxy Authorization specification
1353 * and implementation do not allow proxy authorization
1354 * control to be provided with Bind requests
1357 * if no bind took place yet, but the connection is bound
1358 * and the "proxyauthzdn" is set, then bind as
1359 * "proxyauthzdn" and explicitly add the proxyAuthz
1360 * control to every operation with the dn bound
1361 * to the connection as control value.
1364 /* bind as proxyauthzdn only if no idassert mode
1365 * is requested, or if the client's identity
1367 switch ( mt->mt_idassert_mode ) {
1368 case LDAP_BACK_IDASSERT_LEGACY:
1369 if ( !BER_BVISNULL( &ndn ) && !BER_BVISEMPTY( &ndn ) ) {
1370 if ( !BER_BVISNULL( &mt->mt_idassert_authcDN ) && !BER_BVISEMPTY( &mt->mt_idassert_authcDN ) )
1372 *binddn = mt->mt_idassert_authcDN;
1373 *bindcred = mt->mt_idassert_passwd;
1380 /* NOTE: rootdn can always idassert */
1381 if ( BER_BVISNULL( &ndn )
1382 && mt->mt_idassert_authz == NULL
1383 && !( mt->mt_idassert_flags & LDAP_BACK_AUTH_AUTHZ_ALL ) )
1385 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_PRESCRIPTIVE ) {
1386 rs->sr_err = LDAP_INAPPROPRIATE_AUTH;
1387 if ( sendok & LDAP_BACK_SENDERR ) {
1388 send_ldap_result( op, rs );
1390 LDAP_BACK_CONN_ISBOUND_CLEAR( msc );
1395 rs->sr_err = LDAP_SUCCESS;
1396 *binddn = slap_empty_bv;
1397 *bindcred = slap_empty_bv;
1400 } else if ( mt->mt_idassert_authz && !be_isroot( op ) ) {
1401 struct berval authcDN;
1403 if ( BER_BVISNULL( &ndn ) ) {
1404 authcDN = slap_empty_bv;
1409 rs->sr_err = slap_sasl_matches( op, mt->mt_idassert_authz,
1410 &authcDN, &authcDN );
1411 if ( rs->sr_err != LDAP_SUCCESS ) {
1412 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_PRESCRIPTIVE ) {
1413 if ( sendok & LDAP_BACK_SENDERR ) {
1414 send_ldap_result( op, rs );
1416 LDAP_BACK_CONN_ISBOUND_CLEAR( msc );
1420 rs->sr_err = LDAP_SUCCESS;
1421 *binddn = slap_empty_bv;
1422 *bindcred = slap_empty_bv;
1427 *binddn = mt->mt_idassert_authcDN;
1428 *bindcred = mt->mt_idassert_passwd;
1433 if ( dobind && mt->mt_idassert_authmethod == LDAP_AUTH_SASL ) {
1434 #ifdef HAVE_CYRUS_SASL
1435 void *defaults = NULL;
1436 struct berval authzID = BER_BVNULL;
1439 /* if SASL supports native authz, prepare for it */
1440 if ( ( !op->o_do_not_cache || !op->o_is_auth_check ) &&
1441 ( mt->mt_idassert_flags & LDAP_BACK_AUTH_NATIVE_AUTHZ ) )
1443 switch ( mt->mt_idassert_mode ) {
1444 case LDAP_BACK_IDASSERT_OTHERID:
1445 case LDAP_BACK_IDASSERT_OTHERDN:
1446 authzID = mt->mt_idassert_authzID;
1449 case LDAP_BACK_IDASSERT_ANONYMOUS:
1450 BER_BVSTR( &authzID, "dn:" );
1453 case LDAP_BACK_IDASSERT_SELF:
1454 if ( BER_BVISNULL( &ndn ) ) {
1455 /* connection is not authc'd, so don't idassert */
1456 BER_BVSTR( &authzID, "dn:" );
1459 authzID.bv_len = STRLENOF( "dn:" ) + ndn.bv_len;
1460 authzID.bv_val = slap_sl_malloc( authzID.bv_len + 1, op->o_tmpmemctx );
1461 AC_MEMCPY( authzID.bv_val, "dn:", STRLENOF( "dn:" ) );
1462 AC_MEMCPY( authzID.bv_val + STRLENOF( "dn:" ),
1463 ndn.bv_val, ndn.bv_len + 1 );
1472 if ( mt->mt_idassert_secprops != NULL ) {
1473 rs->sr_err = ldap_set_option( msc->msc_ld,
1474 LDAP_OPT_X_SASL_SECPROPS,
1475 (void *)mt->mt_idassert_secprops );
1477 if ( rs->sr_err != LDAP_OPT_SUCCESS ) {
1478 rs->sr_err = LDAP_OTHER;
1479 if ( sendok & LDAP_BACK_SENDERR ) {
1480 send_ldap_result( op, rs );
1482 LDAP_BACK_CONN_ISBOUND_CLEAR( msc );
1487 defaults = lutil_sasl_defaults( msc->msc_ld,
1488 mt->mt_idassert_sasl_mech.bv_val,
1489 mt->mt_idassert_sasl_realm.bv_val,
1490 mt->mt_idassert_authcID.bv_val,
1491 mt->mt_idassert_passwd.bv_val,
1493 if ( defaults == NULL ) {
1494 rs->sr_err = LDAP_OTHER;
1495 LDAP_BACK_CONN_ISBOUND_CLEAR( msc );
1496 if ( sendok & LDAP_BACK_SENDERR ) {
1497 send_ldap_result( op, rs );
1502 rs->sr_err = ldap_sasl_interactive_bind_s( msc->msc_ld, binddn->bv_val,
1503 mt->mt_idassert_sasl_mech.bv_val, NULL, NULL,
1504 LDAP_SASL_QUIET, lutil_sasl_interact,
1507 rs->sr_err = slap_map_api2result( rs );
1508 if ( rs->sr_err != LDAP_SUCCESS ) {
1509 LDAP_BACK_CONN_ISBOUND_CLEAR( msc );
1510 if ( sendok & LDAP_BACK_SENDERR ) {
1511 send_ldap_result( op, rs );
1515 LDAP_BACK_CONN_ISBOUND_SET( msc );
1518 lutil_sasl_freedefs( defaults );
1520 slap_sl_free( authzID.bv_val, op->o_tmpmemctx );
1524 #endif /* HAVE_CYRUS_SASL */
1527 *method = mt->mt_idassert_authmethod;
1528 switch ( mt->mt_idassert_authmethod ) {
1529 case LDAP_AUTH_NONE:
1530 BER_BVSTR( binddn, "" );
1531 BER_BVSTR( bindcred, "" );
1534 case LDAP_AUTH_SIMPLE:
1539 LDAP_BACK_CONN_ISBOUND_CLEAR( msc );
1540 rs->sr_err = LDAP_AUTH_METHOD_NOT_SUPPORTED;
1541 if ( sendok & LDAP_BACK_SENDERR ) {
1542 send_ldap_result( op, rs );
1549 if ( !BER_BVISEMPTY( binddn ) ) {
1550 LDAP_BACK_CONN_ISIDASSERT_SET( msc );
1557 meta_back_proxy_authz_bind(
1562 ldap_back_send_t sendok,
1565 metainfo_t *mi = (metainfo_t *)op->o_bd->be_private;
1566 metatarget_t *mt = mi->mi_targets[ candidate ];
1567 metasingleconn_t *msc = &mc->mc_conns[ candidate ];
1568 struct berval binddn = BER_BVC( "" ),
1569 cred = BER_BVC( "" );
1570 int method = LDAP_AUTH_NONE,
1573 rc = meta_back_proxy_authz_cred( mc, candidate, op, rs, sendok, &binddn, &cred, &method );
1574 if ( rc == LDAP_SUCCESS && !LDAP_BACK_CONN_ISBOUND( msc ) ) {
1578 case LDAP_AUTH_NONE:
1579 case LDAP_AUTH_SIMPLE:
1581 rs->sr_err = ldap_sasl_bind( msc->msc_ld,
1582 binddn.bv_val, LDAP_SASL_SIMPLE,
1583 &cred, NULL, NULL, &msgid );
1584 if ( rs->sr_err != LDAP_X_CONNECTING ) {
1587 ldap_pvt_thread_yield();
1589 rc = meta_back_bind_op_result( op, rs, mc, candidate, msgid, sendok, dolock );
1590 if ( rc == LDAP_SUCCESS ) {
1591 /* set rebind stuff in case of successful proxyAuthz bind,
1592 * so that referral chasing is attempted using the right
1594 LDAP_BACK_CONN_ISBOUND_SET( msc );
1595 ber_bvreplace( &msc->msc_bound_ndn, &binddn );
1597 if ( META_BACK_TGT_SAVECRED( mt ) ) {
1598 if ( !BER_BVISNULL( &msc->msc_cred ) ) {
1599 memset( msc->msc_cred.bv_val, 0,
1600 msc->msc_cred.bv_len );
1602 ber_bvreplace( &msc->msc_cred, &cred );
1603 ldap_set_rebind_proc( msc->msc_ld, mt->mt_rebind_f, msc );
1614 return LDAP_BACK_CONN_ISBOUND( msc );
1620 * if any needs to be added, it is prepended to existing ones,
1621 * in a newly allocated array. The companion function
1622 * mi->mi_ldap_extra->controls_free() must be used to restore the original
1623 * status of op->o_ctrls.
1626 meta_back_controls_add(
1631 LDAPControl ***pctrls )
1633 metainfo_t *mi = (metainfo_t *)op->o_bd->be_private;
1634 metatarget_t *mt = mi->mi_targets[ candidate ];
1635 metasingleconn_t *msc = &mc->mc_conns[ candidate ];
1637 LDAPControl **ctrls = NULL;
1638 /* set to the maximum number of controls this backend can add */
1639 LDAPControl c[ 2 ] = {{ 0 }};
1640 int n = 0, i, j1 = 0, j2 = 0;
1644 rs->sr_err = LDAP_SUCCESS;
1646 /* don't add controls if protocol is not LDAPv3 */
1647 switch ( mt->mt_version ) {
1652 if ( op->o_protocol == 0 || op->o_protocol == LDAP_VERSION3 ) {
1661 /* put controls that go __before__ existing ones here */
1663 /* proxyAuthz for identity assertion */
1664 switch ( mi->mi_ldap_extra->proxy_authz_ctrl( op, rs, &msc->msc_bound_ndn,
1665 mt->mt_version, &mt->mt_idassert, &c[ j1 ] ) )
1667 case SLAP_CB_CONTINUE:
1678 /* put controls that go __after__ existing ones here */
1680 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
1681 /* session tracking */
1682 if ( META_BACK_TGT_ST_REQUEST( mt ) ) {
1683 switch ( slap_ctrl_session_tracking_request_add( op, rs, &c[ j1 + j2 ] ) ) {
1684 case SLAP_CB_CONTINUE:
1695 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
1697 if ( rs->sr_err == SLAP_CB_CONTINUE ) {
1698 rs->sr_err = LDAP_SUCCESS;
1701 /* if nothing to do, just bail out */
1702 if ( j1 == 0 && j2 == 0 ) {
1706 assert( j1 + j2 <= (int) (sizeof( c )/sizeof( c[0] )) );
1708 if ( op->o_ctrls ) {
1709 for ( n = 0; op->o_ctrls[ n ]; n++ )
1710 /* just count ctrls */ ;
1713 ctrls = op->o_tmpalloc( (n + j1 + j2 + 1) * sizeof( LDAPControl * ) + ( j1 + j2 ) * sizeof( LDAPControl ),
1716 ctrls[ 0 ] = (LDAPControl *)&ctrls[ n + j1 + j2 + 1 ];
1717 *ctrls[ 0 ] = c[ 0 ];
1718 for ( i = 1; i < j1; i++ ) {
1719 ctrls[ i ] = &ctrls[ 0 ][ i ];
1720 *ctrls[ i ] = c[ i ];
1725 if ( op->o_ctrls ) {
1726 for ( i = 0; op->o_ctrls[ i ]; i++ ) {
1727 ctrls[ i + j1 ] = op->o_ctrls[ i ];
1733 ctrls[ n ] = (LDAPControl *)&ctrls[ n + j2 + 1 ] + j1;
1734 *ctrls[ n ] = c[ j1 ];
1735 for ( i = 1; i < j2; i++ ) {
1736 ctrls[ n + i ] = &ctrls[ n ][ i ];
1737 *ctrls[ n + i ] = c[ i ];
1741 ctrls[ n + j2 ] = NULL;
1744 if ( ctrls == NULL ) {
1745 ctrls = op->o_ctrls;