2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
4 * Copyright 1999-2011 The OpenLDAP Foundation.
5 * Portions Copyright 2001-2003 Pierangelo Masarati.
6 * Portions Copyright 1999-2003 Howard Chu.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted only as authorized by the OpenLDAP
13 * A copy of this license is available in the file LICENSE in the
14 * top-level directory of the distribution or, alternatively, at
15 * <http://www.OpenLDAP.org/license.html>.
18 * This work was initially developed by the Howard Chu for inclusion
19 * in OpenLDAP Software and subsequently enhanced by Pierangelo
28 #include <ac/socket.h>
29 #include <ac/string.h>
34 #include "../back-ldap/back-ldap.h"
35 #include "back-meta.h"
37 #include "lutil_ldap.h"
40 meta_back_proxy_authz_bind(
45 ldap_back_send_t sendok );
48 meta_back_single_bind(
55 meta_back_bind( Operation *op, SlapReply *rs )
57 metainfo_t *mi = ( metainfo_t * )op->o_bd->be_private;
58 metaconn_t *mc = NULL;
65 SlapReply *candidates;
67 rs->sr_err = LDAP_SUCCESS;
69 Debug( LDAP_DEBUG_ARGS, "%s meta_back_bind: dn=\"%s\".\n",
70 op->o_log_prefix, op->o_req_dn.bv_val, 0 );
72 /* the test on the bind method should be superfluous */
73 switch ( be_rootdn_bind( op, rs ) ) {
75 if ( META_BACK_DEFER_ROOTDN_BIND( mi ) ) {
76 /* frontend will return success */
83 case SLAP_CB_CONTINUE:
87 /* be_rootdn_bind() sent result */
91 /* we need meta_back_getconn() not send result even on error,
92 * because we want to intercept the error and make it
93 * invalidCredentials */
94 mc = meta_back_getconn( op, rs, NULL, LDAP_BACK_BIND_DONTSEND );
96 if ( LogTest( LDAP_DEBUG_ANY ) ) {
97 char buf[ SLAP_TEXT_BUFLEN ];
99 snprintf( buf, sizeof( buf ),
100 "meta_back_bind: no target "
101 "for dn \"%s\" (%d%s%s).",
102 op->o_req_dn.bv_val, rs->sr_err,
103 rs->sr_text ? ". " : "",
104 rs->sr_text ? rs->sr_text : "" );
105 Debug( LDAP_DEBUG_ANY,
107 op->o_log_prefix, buf, 0 );
110 /* FIXME: there might be cases where we don't want
111 * to map the error onto invalidCredentials */
112 switch ( rs->sr_err ) {
113 case LDAP_NO_SUCH_OBJECT:
114 case LDAP_UNWILLING_TO_PERFORM:
115 rs->sr_err = LDAP_INVALID_CREDENTIALS;
119 send_ldap_result( op, rs );
123 candidates = meta_back_candidates_get( op );
126 * Each target is scanned ...
128 mc->mc_authz_target = META_BOUND_NONE;
129 for ( i = 0; i < mi->mi_ntargets; i++ ) {
130 metatarget_t *mt = mi->mi_targets[ i ];
134 * Skip non-candidates
136 if ( !META_IS_CANDIDATE( &candidates[ i ] ) ) {
141 /* set rc to LDAP_SUCCESS only if at least
142 * one candidate has been tried */
146 } else if ( !isroot ) {
148 * A bind operation is expected to have
149 * ONE CANDIDATE ONLY!
151 Debug( LDAP_DEBUG_ANY,
152 "### %s meta_back_bind: more than one"
153 " candidate selected...\n",
154 op->o_log_prefix, 0, 0 );
158 if ( mt->mt_idassert_authmethod == LDAP_AUTH_NONE
159 || BER_BVISNULL( &mt->mt_idassert_authcDN ) )
161 metasingleconn_t *msc = &mc->mc_conns[ i ];
163 /* skip the target if no pseudorootdn is provided */
164 if ( !BER_BVISNULL( &msc->msc_bound_ndn ) ) {
165 ch_free( msc->msc_bound_ndn.bv_val );
166 BER_BVZERO( &msc->msc_bound_ndn );
169 if ( !BER_BVISNULL( &msc->msc_cred ) ) {
170 /* destroy sensitive data */
171 memset( msc->msc_cred.bv_val, 0,
172 msc->msc_cred.bv_len );
173 ch_free( msc->msc_cred.bv_val );
174 BER_BVZERO( &msc->msc_cred );
181 (void)meta_back_proxy_authz_bind( mc, i, op, rs, LDAP_BACK_DONTSEND );
185 lerr = meta_back_single_bind( op, rs, mc, i );
188 if ( lerr != LDAP_SUCCESS ) {
189 rc = rs->sr_err = lerr;
191 /* FIXME: in some cases (e.g. unavailable)
192 * do not assume it's not candidate; rather
193 * mark this as an error to be eventually
194 * reported to client */
195 META_CANDIDATE_CLEAR( &candidates[ i ] );
200 /* must re-insert if local DN changed as result of bind */
201 if ( rc == LDAP_SUCCESS ) {
203 mc->mc_authz_target = META_BOUND_ALL;
206 if ( !LDAP_BACK_PCONN_ISPRIV( mc )
207 && !dn_match( &op->o_req_ndn, &mc->mc_local_ndn ) )
211 /* wait for all other ops to release the connection */
212 ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
213 assert( mc->mc_refcnt == 1 );
214 #if META_BACK_PRINT_CONNTREE > 0
215 meta_back_print_conntree( mi, ">>> meta_back_bind" );
216 #endif /* META_BACK_PRINT_CONNTREE */
218 /* delete all cached connections with the current connection */
219 if ( LDAP_BACK_SINGLECONN( mi ) ) {
222 while ( ( tmpmc = avl_delete( &mi->mi_conninfo.lai_tree, (caddr_t)mc, meta_back_conn_cmp ) ) != NULL )
224 assert( !LDAP_BACK_PCONN_ISPRIV( mc ) );
225 Debug( LDAP_DEBUG_TRACE,
226 "=>meta_back_bind: destroying conn %lu (refcnt=%u)\n",
227 mc->mc_conn->c_connid, mc->mc_refcnt, 0 );
229 if ( tmpmc->mc_refcnt != 0 ) {
231 LDAP_BACK_CONN_TAINTED_SET( tmpmc );
235 * Needs a test because the handler may be corrupted,
236 * and calling ldap_unbind on a corrupted header results
237 * in a segmentation fault
239 meta_back_conn_free( tmpmc );
244 ber_bvreplace( &mc->mc_local_ndn, &op->o_req_ndn );
245 lerr = avl_insert( &mi->mi_conninfo.lai_tree, (caddr_t)mc,
246 meta_back_conndn_cmp, meta_back_conndn_dup );
247 #if META_BACK_PRINT_CONNTREE > 0
248 meta_back_print_conntree( mi, "<<< meta_back_bind" );
249 #endif /* META_BACK_PRINT_CONNTREE */
252 /* NOTE: a connection cannot be privileged
253 * and be in the avl tree at the same time
256 LDAP_BACK_CONN_ISPRIV_SET( mc );
257 LDAP_BACK_PCONN_SET( mc, op );
260 LDAP_BACK_CONN_CACHED_SET( mc );
263 LDAP_BACK_CONN_CACHED_CLEAR( mc );
265 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
270 meta_back_release_conn( mi, mc );
274 * rc is LDAP_SUCCESS if at least one bind succeeded,
275 * err is the last error that occurred during a bind;
276 * if at least (and at most?) one bind succeeds, fine.
278 if ( rc != LDAP_SUCCESS ) {
281 * deal with bind failure ...
285 * no target was found within the naming context,
286 * so bind must fail with invalid credentials
288 if ( rs->sr_err == LDAP_SUCCESS && gotit == 0 ) {
289 rs->sr_err = LDAP_INVALID_CREDENTIALS;
291 rs->sr_err = slap_map_api2result( rs );
293 send_ldap_result( op, rs );
302 meta_back_bind_op_result(
308 ldap_back_send_t sendok )
310 metainfo_t *mi = ( metainfo_t * )op->o_bd->be_private;
311 metatarget_t *mt = mi->mi_targets[ candidate ];
312 metasingleconn_t *msc = &mc->mc_conns[ candidate ];
316 int nretries = mt->mt_nretries;
317 char buf[ SLAP_TEXT_BUFLEN ];
319 Debug( LDAP_DEBUG_TRACE,
320 ">>> %s meta_back_bind_op_result[%d]\n",
321 op->o_log_prefix, candidate, 0 );
323 /* make sure this is clean */
324 assert( rs->sr_ctrls == NULL );
326 if ( rs->sr_err == LDAP_SUCCESS ) {
327 time_t stoptime = (time_t)(-1),
329 int timeout_err = op->o_protocol >= LDAP_VERSION3 ?
330 LDAP_ADMINLIMIT_EXCEEDED : LDAP_OTHER;
331 const char *timeout_text = "Operation timed out";
332 slap_op_t opidx = slap_req2op( op->o_tag );
334 /* since timeout is not specified, compute and use
335 * the one specific to the ongoing operation */
336 if ( opidx == LDAP_REQ_SEARCH ) {
337 if ( op->ors_tlimit <= 0 ) {
341 timeout = op->ors_tlimit;
342 timeout_err = LDAP_TIMELIMIT_EXCEEDED;
347 timeout = mt->mt_timeout[ opidx ];
350 /* better than nothing :) */
351 if ( timeout == 0 ) {
352 if ( mi->mi_idle_timeout ) {
353 timeout = mi->mi_idle_timeout;
355 } else if ( mi->mi_conn_ttl ) {
356 timeout = mi->mi_conn_ttl;
361 stoptime = op->o_time + timeout;
364 LDAP_BACK_TV_SET( &tv );
370 rc = ldap_result( msc->msc_ld, msgid, LDAP_MSG_ALL, &tv, &res );
373 if ( nretries != META_RETRY_NEVER
374 || ( timeout && slap_get_time() <= stoptime ) )
376 ldap_pvt_thread_yield();
377 if ( nretries > 0 ) {
380 tv = mt->mt_bind_timeout;
384 /* don't let anyone else use this handler,
385 * because there's a pending bind that will not
387 ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
388 assert( LDAP_BACK_CONN_BINDING( msc ) );
391 Debug( LDAP_DEBUG_ANY, "### %s meta_back_bind_op_result ldap_unbind_ext[%d] ld=%p\n",
392 op->o_log_prefix, candidate, (void *)msc->msc_ld );
393 #endif /* DEBUG_205 */
395 meta_clear_one_candidate( op, mc, candidate );
396 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
398 rs->sr_err = timeout_err;
399 rs->sr_text = timeout_text;
403 ldap_get_option( msc->msc_ld, LDAP_OPT_ERROR_NUMBER,
406 snprintf( buf, sizeof( buf ),
407 "err=%d (%s) nretries=%d",
408 rs->sr_err, ldap_err2string( rs->sr_err ), nretries );
409 Debug( LDAP_DEBUG_ANY,
410 "### %s meta_back_bind_op_result[%d]: %s.\n",
411 op->o_log_prefix, candidate, buf );
415 /* only touch when activity actually took place... */
416 if ( mi->mi_idle_timeout != 0 && msc->msc_time < op->o_time ) {
417 msc->msc_time = op->o_time;
420 /* FIXME: matched? referrals? response controls? */
421 rc = ldap_parse_result( msc->msc_ld, res, &rs->sr_err,
422 NULL, NULL, NULL, NULL, 1 );
423 if ( rc != LDAP_SUCCESS ) {
426 rs->sr_err = slap_map_api2result( rs );
431 rs->sr_err = slap_map_api2result( rs );
433 Debug( LDAP_DEBUG_TRACE,
434 "<<< %s meta_back_bind_op_result[%d] err=%d\n",
435 op->o_log_prefix, candidate, rs->sr_err );
441 * meta_back_single_bind
443 * attempts to perform a bind with creds
446 meta_back_single_bind(
452 metainfo_t *mi = ( metainfo_t * )op->o_bd->be_private;
453 metatarget_t *mt = mi->mi_targets[ candidate ];
454 struct berval mdn = BER_BVNULL;
455 metasingleconn_t *msc = &mc->mc_conns[ candidate ];
458 struct berval save_o_dn;
459 int save_o_do_not_cache;
460 LDAPControl **ctrls = NULL;
462 if ( !BER_BVISNULL( &msc->msc_bound_ndn ) ) {
463 ch_free( msc->msc_bound_ndn.bv_val );
464 BER_BVZERO( &msc->msc_bound_ndn );
467 if ( !BER_BVISNULL( &msc->msc_cred ) ) {
468 /* destroy sensitive data */
469 memset( msc->msc_cred.bv_val, 0, msc->msc_cred.bv_len );
470 ch_free( msc->msc_cred.bv_val );
471 BER_BVZERO( &msc->msc_cred );
475 * Rewrite the bind dn if needed
478 dc.conn = op->o_conn;
482 if ( ldap_back_dn_massage( &dc, &op->o_req_dn, &mdn ) ) {
483 rs->sr_text = "DN rewrite error";
484 rs->sr_err = LDAP_OTHER;
488 /* don't add proxyAuthz; set the bindDN */
489 save_o_dn = op->o_dn;
490 save_o_do_not_cache = op->o_do_not_cache;
491 op->o_do_not_cache = 1;
492 op->o_dn = op->o_req_dn;
495 rs->sr_err = meta_back_controls_add( op, rs, mc, candidate, &ctrls );
496 op->o_dn = save_o_dn;
497 op->o_do_not_cache = save_o_do_not_cache;
498 if ( rs->sr_err != LDAP_SUCCESS ) {
502 /* FIXME: this fixes the bind problem right now; we need
503 * to use the asynchronous version to get the "matched"
504 * and more in case of failure ... */
505 /* FIXME: should we check if at least some of the op->o_ctrls
506 * can/should be passed? */
508 rs->sr_err = ldap_sasl_bind( msc->msc_ld, mdn.bv_val,
509 LDAP_SASL_SIMPLE, &op->orb_cred,
510 ctrls, NULL, &msgid );
511 if ( rs->sr_err != LDAP_X_CONNECTING ) {
514 ldap_pvt_thread_yield();
517 mi->mi_ldap_extra->controls_free( op, rs, &ctrls );
519 meta_back_bind_op_result( op, rs, mc, candidate, msgid, LDAP_BACK_DONTSEND );
520 if ( rs->sr_err != LDAP_SUCCESS ) {
524 /* If defined, proxyAuthz will be used also when
525 * back-ldap is the authorizing backend; for this
526 * purpose, a successful bind is followed by a
527 * bind with the configured identity assertion */
528 /* NOTE: use with care */
529 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OVERRIDE ) {
530 meta_back_proxy_authz_bind( mc, candidate, op, rs, LDAP_BACK_SENDERR );
531 if ( !LDAP_BACK_CONN_ISBOUND( msc ) ) {
537 ber_bvreplace( &msc->msc_bound_ndn, &op->o_req_ndn );
538 LDAP_BACK_CONN_ISBOUND_SET( msc );
539 mc->mc_authz_target = candidate;
541 if ( META_BACK_TGT_SAVECRED( mt ) ) {
542 if ( !BER_BVISNULL( &msc->msc_cred ) ) {
543 memset( msc->msc_cred.bv_val, 0,
544 msc->msc_cred.bv_len );
546 ber_bvreplace( &msc->msc_cred, &op->orb_cred );
547 ldap_set_rebind_proc( msc->msc_ld, mt->mt_rebind_f, msc );
551 if ( mi->mi_cache.ttl != META_DNCACHE_DISABLED
552 && !BER_BVISEMPTY( &op->o_req_ndn ) )
554 ( void )meta_dncache_update_entry( &mi->mi_cache,
555 &op->o_req_ndn, candidate );
559 if ( mdn.bv_val != op->o_req_dn.bv_val ) {
563 if ( META_BACK_TGT_QUARANTINE( mt ) ) {
564 meta_back_quarantine( op, rs, candidate );
571 * meta_back_single_dobind
574 meta_back_single_dobind(
579 ldap_back_send_t sendok,
583 metainfo_t *mi = ( metainfo_t * )op->o_bd->be_private;
584 metatarget_t *mt = mi->mi_targets[ candidate ];
585 metaconn_t *mc = *mcp;
586 metasingleconn_t *msc = &mc->mc_conns[ candidate ];
589 assert( !LDAP_BACK_CONN_ISBOUND( msc ) );
591 /* NOTE: this obsoletes pseudorootdn */
592 if ( op->o_conn != NULL &&
593 !op->o_do_not_cache &&
594 ( BER_BVISNULL( &msc->msc_bound_ndn ) ||
595 BER_BVISEMPTY( &msc->msc_bound_ndn ) ||
596 ( LDAP_BACK_CONN_ISPRIV( mc ) && dn_match( &msc->msc_bound_ndn, &mt->mt_idassert_authcDN ) ) ||
597 ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OVERRIDE ) ) )
599 (void)meta_back_proxy_authz_bind( mc, candidate, op, rs, sendok );
603 struct berval cred = BER_BVC( "" );
605 /* use credentials if available */
606 if ( !BER_BVISNULL( &msc->msc_bound_ndn )
607 && !BER_BVISNULL( &msc->msc_cred ) )
609 binddn = msc->msc_bound_ndn.bv_val;
610 cred = msc->msc_cred;
613 /* FIXME: should we check if at least some of the op->o_ctrls
614 * can/should be passed? */
616 rs->sr_err = ldap_sasl_bind( msc->msc_ld,
617 binddn, LDAP_SASL_SIMPLE, &cred,
618 NULL, NULL, &msgid );
619 if ( rs->sr_err != LDAP_X_CONNECTING ) {
622 ldap_pvt_thread_yield();
625 rs->sr_err = meta_back_bind_op_result( op, rs, mc, candidate, msgid, sendok );
627 /* if bind succeeded, but anonymous, clear msc_bound_ndn */
628 if ( rs->sr_err != LDAP_SUCCESS || binddn[0] == '\0' ) {
629 if ( !BER_BVISNULL( &msc->msc_bound_ndn ) ) {
630 ber_memfree( msc->msc_bound_ndn.bv_val );
631 BER_BVZERO( &msc->msc_bound_ndn );
634 if ( !BER_BVISNULL( &msc->msc_cred ) ) {
635 memset( msc->msc_cred.bv_val, 0, msc->msc_cred.bv_len );
636 ber_memfree( msc->msc_cred.bv_val );
637 BER_BVZERO( &msc->msc_cred );
642 if ( rs->sr_err != LDAP_SUCCESS ) {
644 ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
646 LDAP_BACK_CONN_BINDING_CLEAR( msc );
647 if ( META_BACK_ONERR_STOP( mi ) ) {
648 LDAP_BACK_CONN_TAINTED_SET( mc );
649 meta_back_release_conn_lock( mi, mc, 0 );
653 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
657 if ( META_BACK_TGT_QUARANTINE( mt ) ) {
658 meta_back_quarantine( op, rs, candidate );
672 ldap_back_send_t sendok )
674 metainfo_t *mi = ( metainfo_t * )op->o_bd->be_private;
680 SlapReply *candidates;
682 if ( be_isroot( op ) ) {
686 if ( LogTest( LDAP_DEBUG_TRACE ) ) {
687 char buf[STRLENOF("4294967295U") + 1] = { 0 };
688 mi->mi_ldap_extra->connid2str( &mc->mc_base, buf, sizeof(buf) );
690 Debug( LDAP_DEBUG_TRACE,
691 "%s meta_back_dobind: conn=%s%s\n",
692 op->o_log_prefix, buf,
693 isroot ? " (isroot)" : "" );
697 * all the targets are bound as pseudoroot
699 if ( mc->mc_authz_target == META_BOUND_ALL ) {
704 candidates = meta_back_candidates_get( op );
706 for ( i = 0; i < mi->mi_ntargets; i++ ) {
707 metatarget_t *mt = mi->mi_targets[ i ];
708 metasingleconn_t *msc = &mc->mc_conns[ i ];
714 if ( !META_IS_CANDIDATE( &candidates[ i ] ) ) {
718 assert( msc->msc_ld != NULL );
721 * If the target is already bound it is skipped
725 ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
726 if ( LDAP_BACK_CONN_ISBOUND( msc )
727 || ( LDAP_BACK_CONN_ISANON( msc )
728 && mt->mt_idassert_authmethod == LDAP_AUTH_NONE ) )
730 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
734 } else if ( META_BACK_CONN_CREATING( msc ) || LDAP_BACK_CONN_BINDING( msc ) )
736 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
737 ldap_pvt_thread_yield();
742 LDAP_BACK_CONN_BINDING_SET( msc );
743 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
745 rc = meta_back_single_dobind( op, rs, &mc, i,
746 LDAP_BACK_DONTSEND, mt->mt_nretries, 1 );
748 * NOTE: meta_back_single_dobind() already retries;
749 * in case of failure, it resets mc...
751 if ( rc != LDAP_SUCCESS ) {
752 char buf[ SLAP_TEXT_BUFLEN ];
755 /* meta_back_single_dobind() already sent
756 * response and released connection */
761 if ( rc == LDAP_UNAVAILABLE ) {
762 /* FIXME: meta_back_retry() already re-calls
763 * meta_back_single_dobind() */
764 if ( meta_back_retry( op, rs, &mc, i, sendok ) ) {
769 ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
770 LDAP_BACK_CONN_BINDING_CLEAR( msc );
771 meta_back_release_conn_lock( mi, mc, 0 );
772 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
778 ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
779 LDAP_BACK_CONN_BINDING_CLEAR( msc );
780 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
782 snprintf( buf, sizeof( buf ),
783 "meta_back_dobind[%d]: (%s) err=%d (%s).",
784 i, isroot ? op->o_bd->be_rootdn.bv_val : "anonymous",
785 rc, ldap_err2string( rc ) );
786 Debug( LDAP_DEBUG_ANY,
788 op->o_log_prefix, buf, 0 );
791 * null cred bind should always succeed
792 * as anonymous, so a failure means
793 * the target is no longer candidate possibly
794 * due to technical reasons (remote host down?)
795 * so better clear the handle
797 /* leave the target candidate, but record the error for later use */
798 candidates[ i ].sr_err = rc;
799 if ( META_BACK_ONERR_STOP( mi ) ) {
808 Debug( LDAP_DEBUG_TRACE,
809 "%s meta_back_dobind[%d]: "
812 isroot ? op->o_bd->be_rootdn.bv_val : "anonymous" );
814 ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
815 LDAP_BACK_CONN_BINDING_CLEAR( msc );
817 LDAP_BACK_CONN_ISBOUND_SET( msc );
819 LDAP_BACK_CONN_ISANON_SET( msc );
821 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
826 if ( LogTest( LDAP_DEBUG_TRACE ) ) {
827 char buf[STRLENOF("4294967295U") + 1] = { 0 };
828 mi->mi_ldap_extra->connid2str( &mc->mc_base, buf, sizeof(buf) );
830 Debug( LDAP_DEBUG_TRACE,
831 "%s meta_back_dobind: conn=%s bound=%d\n",
832 op->o_log_prefix, buf, bound );
836 meta_back_release_conn( mi, mc );
839 if ( sendok & LDAP_BACK_SENDERR ) {
840 if ( rs->sr_err == LDAP_SUCCESS ) {
841 rs->sr_err = LDAP_BUSY;
843 send_ldap_result( op, rs );
849 return ( bound > 0 );
853 * meta_back_default_rebind
855 * This is a callback used for chasing referrals using the same
856 * credentials as the original user on this session.
859 meta_back_default_rebind(
861 LDAP_CONST char *url,
866 metasingleconn_t *msc = ( metasingleconn_t * )params;
868 return ldap_sasl_bind_s( ld, msc->msc_bound_ndn.bv_val,
869 LDAP_SASL_SIMPLE, &msc->msc_cred,
874 * meta_back_default_urllist
876 * This is a callback used for mucking with the urllist
879 meta_back_default_urllist(
881 LDAPURLDesc **urllist,
885 metatarget_t *mt = (metatarget_t *)params;
886 LDAPURLDesc **urltail;
888 if ( urllist == url ) {
892 for ( urltail = &(*url)->lud_next; *urltail; urltail = &(*urltail)->lud_next )
899 ldap_pvt_thread_mutex_lock( &mt->mt_uri_mutex );
901 ch_free( mt->mt_uri );
904 ldap_get_option( ld, LDAP_OPT_URI, (void *)&mt->mt_uri );
905 ldap_pvt_thread_mutex_unlock( &mt->mt_uri_mutex );
917 ldap_back_send_t sendok )
919 metainfo_t *mi = (metainfo_t *)op->o_bd->be_private;
921 metatarget_t *mt = mi->mi_targets[ candidate ];
922 metasingleconn_t *msc = &mc->mc_conns[ candidate ];
926 Debug( LDAP_DEBUG_TRACE, ">>> %s meta_back_cancel[%d] msgid=%d\n",
927 op->o_log_prefix, candidate, msgid );
929 /* default behavior */
930 if ( META_BACK_TGT_ABANDON( mt ) ) {
931 rc = ldap_abandon_ext( msc->msc_ld, msgid, NULL, NULL );
933 } else if ( META_BACK_TGT_IGNORE( mt ) ) {
934 rc = ldap_pvt_discard( msc->msc_ld, msgid );
936 } else if ( META_BACK_TGT_CANCEL( mt ) ) {
937 rc = ldap_cancel_s( msc->msc_ld, msgid, NULL, NULL );
943 Debug( LDAP_DEBUG_TRACE, "<<< %s meta_back_cancel[%d] err=%d\n",
944 op->o_log_prefix, candidate, rc );
952 * FIXME: error return must be handled in a cleaner way ...
962 ldap_back_send_t sendok )
964 metainfo_t *mi = ( metainfo_t * )op->o_bd->be_private;
966 const char *save_text = rs->sr_text,
967 *save_matched = rs->sr_matched;
968 BerVarray save_ref = rs->sr_ref;
969 LDAPControl **save_ctrls = rs->sr_ctrls;
970 void *matched_ctx = NULL;
972 char *matched = NULL;
975 LDAPControl **ctrls = NULL;
977 assert( mc != NULL );
980 rs->sr_matched = NULL;
984 if ( candidate != META_TARGET_NONE ) {
985 metatarget_t *mt = mi->mi_targets[ candidate ];
986 metasingleconn_t *msc = &mc->mc_conns[ candidate ];
988 if ( LDAP_ERR_OK( rs->sr_err ) ) {
991 LDAPMessage *res = NULL;
992 time_t stoptime = (time_t)(-1);
993 int timeout_err = op->o_protocol >= LDAP_VERSION3 ?
994 LDAP_ADMINLIMIT_EXCEEDED : LDAP_OTHER;
995 const char *timeout_text = "Operation timed out";
997 /* if timeout is not specified, compute and use
998 * the one specific to the ongoing operation */
999 if ( timeout == (time_t)(-1) ) {
1000 slap_op_t opidx = slap_req2op( op->o_tag );
1002 if ( opidx == SLAP_OP_SEARCH ) {
1003 if ( op->ors_tlimit <= 0 ) {
1007 timeout = op->ors_tlimit;
1008 timeout_err = LDAP_TIMELIMIT_EXCEEDED;
1009 timeout_text = NULL;
1013 timeout = mt->mt_timeout[ opidx ];
1017 /* better than nothing :) */
1018 if ( timeout == 0 ) {
1019 if ( mi->mi_idle_timeout ) {
1020 timeout = mi->mi_idle_timeout;
1022 } else if ( mi->mi_conn_ttl ) {
1023 timeout = mi->mi_conn_ttl;
1028 stoptime = op->o_time + timeout;
1031 LDAP_BACK_TV_SET( &tv );
1034 rc = ldap_result( msc->msc_ld, msgid, LDAP_MSG_ALL, &tv, &res );
1037 if ( timeout && slap_get_time() > stoptime ) {
1038 (void)meta_back_cancel( mc, op, rs, msgid, candidate, sendok );
1039 rs->sr_err = timeout_err;
1040 rs->sr_text = timeout_text;
1044 LDAP_BACK_TV_SET( &tv );
1045 ldap_pvt_thread_yield();
1049 ldap_get_option( msc->msc_ld, LDAP_OPT_RESULT_CODE,
1054 /* otherwise get the result; if it is not
1055 * LDAP_SUCCESS, record it in the reply
1056 * structure (this includes
1057 * LDAP_COMPARE_{TRUE|FALSE}) */
1059 /* only touch when activity actually took place... */
1060 if ( mi->mi_idle_timeout != 0 && msc->msc_time < op->o_time ) {
1061 msc->msc_time = op->o_time;
1064 rc = ldap_parse_result( msc->msc_ld, res, &rs->sr_err,
1065 &matched, &text, &refs, &ctrls, 1 );
1067 if ( rc == LDAP_SUCCESS ) {
1072 rs->sr_err = slap_map_api2result( rs );
1074 /* RFC 4511: referrals can only appear
1075 * if result code is LDAP_REFERRAL */
1077 && refs[ 0 ] != NULL
1078 && refs[ 0 ][ 0 ] != '\0' )
1080 if ( rs->sr_err != LDAP_REFERRAL ) {
1081 Debug( LDAP_DEBUG_ANY,
1082 "%s meta_back_op_result[%d]: "
1083 "got referrals with err=%d\n",
1085 candidate, rs->sr_err );
1090 for ( i = 0; refs[ i ] != NULL; i++ )
1092 rs->sr_ref = op->o_tmpalloc( sizeof( struct berval ) * ( i + 1 ),
1094 for ( i = 0; refs[ i ] != NULL; i++ ) {
1095 ber_str2bv( refs[ i ], 0, 0, &rs->sr_ref[ i ] );
1097 BER_BVZERO( &rs->sr_ref[ i ] );
1100 } else if ( rs->sr_err == LDAP_REFERRAL ) {
1101 Debug( LDAP_DEBUG_ANY,
1102 "%s meta_back_op_result[%d]: "
1103 "got err=%d with null "
1104 "or empty referrals\n",
1106 candidate, rs->sr_err );
1108 rs->sr_err = LDAP_NO_SUCH_OBJECT;
1111 if ( ctrls != NULL ) {
1112 rs->sr_ctrls = ctrls;
1116 assert( res == NULL );
1119 /* if the error in the reply structure is not
1120 * LDAP_SUCCESS, try to map it from client
1121 * to server error */
1122 if ( !LDAP_ERR_OK( rs->sr_err ) ) {
1123 rs->sr_err = slap_map_api2result( rs );
1125 /* internal ops ( op->o_conn == NULL )
1126 * must not reply to client */
1127 if ( op->o_conn && !op->o_do_not_cache && matched ) {
1129 /* record the (massaged) matched
1130 * DN into the reply structure */
1131 rs->sr_matched = matched;
1135 if ( META_BACK_TGT_QUARANTINE( mt ) ) {
1136 meta_back_quarantine( op, rs, candidate );
1143 for ( i = 0; i < mi->mi_ntargets; i++ ) {
1144 metasingleconn_t *msc = &mc->mc_conns[ i ];
1146 char *xmatched = NULL;
1148 if ( msc->msc_ld == NULL ) {
1152 rs->sr_err = LDAP_SUCCESS;
1154 ldap_get_option( msc->msc_ld, LDAP_OPT_RESULT_CODE, &rs->sr_err );
1155 if ( rs->sr_err != LDAP_SUCCESS ) {
1157 * better check the type of error. In some cases
1158 * (search ?) it might be better to return a
1159 * success if at least one of the targets gave
1160 * positive result ...
1162 ldap_get_option( msc->msc_ld,
1163 LDAP_OPT_DIAGNOSTIC_MESSAGE, &xtext );
1164 if ( xtext != NULL && xtext [ 0 ] == '\0' ) {
1165 ldap_memfree( xtext );
1169 ldap_get_option( msc->msc_ld,
1170 LDAP_OPT_MATCHED_DN, &xmatched );
1171 if ( xmatched != NULL && xmatched[ 0 ] == '\0' ) {
1172 ldap_memfree( xmatched );
1176 rs->sr_err = slap_map_api2result( rs );
1178 if ( LogTest( LDAP_DEBUG_ANY ) ) {
1179 char buf[ SLAP_TEXT_BUFLEN ];
1181 snprintf( buf, sizeof( buf ),
1182 "meta_back_op_result[%d] "
1183 "err=%d text=\"%s\" matched=\"%s\"",
1185 ( xtext ? xtext : "" ),
1186 ( xmatched ? xmatched : "" ) );
1187 Debug( LDAP_DEBUG_ANY, "%s %s.\n",
1188 op->o_log_prefix, buf, 0 );
1192 * FIXME: need to rewrite "match" (need rwinfo)
1194 switch ( rs->sr_err ) {
1197 if ( xtext != NULL ) {
1199 ldap_memfree( text );
1204 if ( xmatched != NULL ) {
1206 ldap_memfree( matched );
1215 ldap_memfree( xtext );
1219 ldap_memfree( xmatched );
1223 if ( META_BACK_TGT_QUARANTINE( mi->mi_targets[ i ] ) ) {
1224 meta_back_quarantine( op, rs, i );
1228 if ( err != LDAP_SUCCESS ) {
1233 if ( matched != NULL ) {
1234 struct berval dn, pdn;
1236 ber_str2bv( matched, 0, 0, &dn );
1237 if ( dnPretty( NULL, &dn, &pdn, op->o_tmpmemctx ) == LDAP_SUCCESS ) {
1238 ldap_memfree( matched );
1239 matched_ctx = op->o_tmpmemctx;
1240 matched = pdn.bv_val;
1242 rs->sr_matched = matched;
1245 if ( rs->sr_err == LDAP_UNAVAILABLE ) {
1246 if ( !( sendok & LDAP_BACK_RETRYING ) ) {
1247 if ( op->o_conn && ( sendok & LDAP_BACK_SENDERR ) ) {
1248 if ( rs->sr_text == NULL ) rs->sr_text = "Proxy operation retry failed";
1249 send_ldap_result( op, rs );
1253 } else if ( op->o_conn &&
1254 ( ( ( sendok & LDAP_BACK_SENDOK ) && LDAP_ERR_OK( rs->sr_err ) )
1255 || ( ( sendok & LDAP_BACK_SENDERR ) && !LDAP_ERR_OK( rs->sr_err ) ) ) )
1257 send_ldap_result( op, rs );
1260 op->o_tmpfree( (char *)rs->sr_matched, matched_ctx );
1263 ldap_memfree( text );
1266 op->o_tmpfree( rs->sr_ref, op->o_tmpmemctx );
1270 ber_memvfree( (void **)refs );
1273 assert( rs->sr_ctrls != NULL );
1274 ldap_controls_free( ctrls );
1277 rs->sr_text = save_text;
1278 rs->sr_matched = save_matched;
1279 rs->sr_ref = save_ref;
1280 rs->sr_ctrls = save_ctrls;
1282 return( LDAP_ERR_OK( rs->sr_err ) ? LDAP_SUCCESS : rs->sr_err );
1286 * meta_back_proxy_authz_cred()
1288 * prepares credentials & method for meta_back_proxy_authz_bind();
1289 * or, if method is SASL, performs the SASL bind directly.
1292 meta_back_proxy_authz_cred(
1297 ldap_back_send_t sendok,
1298 struct berval *binddn,
1299 struct berval *bindcred,
1302 metainfo_t *mi = (metainfo_t *)op->o_bd->be_private;
1303 metatarget_t *mt = mi->mi_targets[ candidate ];
1304 metasingleconn_t *msc = &mc->mc_conns[ candidate ];
1308 /* don't proxyAuthz if protocol is not LDAPv3 */
1309 switch ( mt->mt_version ) {
1314 if ( op->o_protocol == 0 || op->o_protocol == LDAP_VERSION3 ) {
1320 rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
1321 if ( sendok & LDAP_BACK_SENDERR ) {
1322 send_ldap_result( op, rs );
1324 LDAP_BACK_CONN_ISBOUND_CLEAR( msc );
1328 if ( op->o_tag == LDAP_REQ_BIND ) {
1329 ndn = op->o_req_ndn;
1331 } else if ( !BER_BVISNULL( &op->o_conn->c_ndn ) ) {
1332 ndn = op->o_conn->c_ndn;
1339 * FIXME: we need to let clients use proxyAuthz
1340 * otherwise we cannot do symmetric pools of servers;
1341 * we have to live with the fact that a user can
1342 * authorize itself as any ID that is allowed
1343 * by the authzTo directive of the "proxyauthzdn".
1346 * NOTE: current Proxy Authorization specification
1347 * and implementation do not allow proxy authorization
1348 * control to be provided with Bind requests
1351 * if no bind took place yet, but the connection is bound
1352 * and the "proxyauthzdn" is set, then bind as
1353 * "proxyauthzdn" and explicitly add the proxyAuthz
1354 * control to every operation with the dn bound
1355 * to the connection as control value.
1358 /* bind as proxyauthzdn only if no idassert mode
1359 * is requested, or if the client's identity
1361 switch ( mt->mt_idassert_mode ) {
1362 case LDAP_BACK_IDASSERT_LEGACY:
1363 if ( !BER_BVISNULL( &ndn ) && !BER_BVISEMPTY( &ndn ) ) {
1364 if ( !BER_BVISNULL( &mt->mt_idassert_authcDN ) && !BER_BVISEMPTY( &mt->mt_idassert_authcDN ) )
1366 *binddn = mt->mt_idassert_authcDN;
1367 *bindcred = mt->mt_idassert_passwd;
1374 /* NOTE: rootdn can always idassert */
1375 if ( BER_BVISNULL( &ndn )
1376 && mt->mt_idassert_authz == NULL
1377 && !( mt->mt_idassert_flags & LDAP_BACK_AUTH_AUTHZ_ALL ) )
1379 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_PRESCRIPTIVE ) {
1380 rs->sr_err = LDAP_INAPPROPRIATE_AUTH;
1381 if ( sendok & LDAP_BACK_SENDERR ) {
1382 send_ldap_result( op, rs );
1384 LDAP_BACK_CONN_ISBOUND_CLEAR( msc );
1389 rs->sr_err = LDAP_SUCCESS;
1390 *binddn = slap_empty_bv;
1391 *bindcred = slap_empty_bv;
1394 } else if ( mt->mt_idassert_authz && !be_isroot( op ) ) {
1395 struct berval authcDN;
1397 if ( BER_BVISNULL( &ndn ) ) {
1398 authcDN = slap_empty_bv;
1403 rs->sr_err = slap_sasl_matches( op, mt->mt_idassert_authz,
1404 &authcDN, &authcDN );
1405 if ( rs->sr_err != LDAP_SUCCESS ) {
1406 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_PRESCRIPTIVE ) {
1407 if ( sendok & LDAP_BACK_SENDERR ) {
1408 send_ldap_result( op, rs );
1410 LDAP_BACK_CONN_ISBOUND_CLEAR( msc );
1414 rs->sr_err = LDAP_SUCCESS;
1415 *binddn = slap_empty_bv;
1416 *bindcred = slap_empty_bv;
1421 *binddn = mt->mt_idassert_authcDN;
1422 *bindcred = mt->mt_idassert_passwd;
1427 if ( dobind && mt->mt_idassert_authmethod == LDAP_AUTH_SASL ) {
1428 #ifdef HAVE_CYRUS_SASL
1429 void *defaults = NULL;
1430 struct berval authzID = BER_BVNULL;
1433 /* if SASL supports native authz, prepare for it */
1434 if ( ( !op->o_do_not_cache || !op->o_is_auth_check ) &&
1435 ( mt->mt_idassert_flags & LDAP_BACK_AUTH_NATIVE_AUTHZ ) )
1437 switch ( mt->mt_idassert_mode ) {
1438 case LDAP_BACK_IDASSERT_OTHERID:
1439 case LDAP_BACK_IDASSERT_OTHERDN:
1440 authzID = mt->mt_idassert_authzID;
1443 case LDAP_BACK_IDASSERT_ANONYMOUS:
1444 BER_BVSTR( &authzID, "dn:" );
1447 case LDAP_BACK_IDASSERT_SELF:
1448 if ( BER_BVISNULL( &ndn ) ) {
1449 /* connection is not authc'd, so don't idassert */
1450 BER_BVSTR( &authzID, "dn:" );
1453 authzID.bv_len = STRLENOF( "dn:" ) + ndn.bv_len;
1454 authzID.bv_val = slap_sl_malloc( authzID.bv_len + 1, op->o_tmpmemctx );
1455 AC_MEMCPY( authzID.bv_val, "dn:", STRLENOF( "dn:" ) );
1456 AC_MEMCPY( authzID.bv_val + STRLENOF( "dn:" ),
1457 ndn.bv_val, ndn.bv_len + 1 );
1466 if ( mt->mt_idassert_secprops != NULL ) {
1467 rs->sr_err = ldap_set_option( msc->msc_ld,
1468 LDAP_OPT_X_SASL_SECPROPS,
1469 (void *)mt->mt_idassert_secprops );
1471 if ( rs->sr_err != LDAP_OPT_SUCCESS ) {
1472 rs->sr_err = LDAP_OTHER;
1473 if ( sendok & LDAP_BACK_SENDERR ) {
1474 send_ldap_result( op, rs );
1476 LDAP_BACK_CONN_ISBOUND_CLEAR( msc );
1481 defaults = lutil_sasl_defaults( msc->msc_ld,
1482 mt->mt_idassert_sasl_mech.bv_val,
1483 mt->mt_idassert_sasl_realm.bv_val,
1484 mt->mt_idassert_authcID.bv_val,
1485 mt->mt_idassert_passwd.bv_val,
1487 if ( defaults == NULL ) {
1488 rs->sr_err = LDAP_OTHER;
1489 LDAP_BACK_CONN_ISBOUND_CLEAR( msc );
1490 if ( sendok & LDAP_BACK_SENDERR ) {
1491 send_ldap_result( op, rs );
1496 rs->sr_err = ldap_sasl_interactive_bind_s( msc->msc_ld, binddn->bv_val,
1497 mt->mt_idassert_sasl_mech.bv_val, NULL, NULL,
1498 LDAP_SASL_QUIET, lutil_sasl_interact,
1501 rs->sr_err = slap_map_api2result( rs );
1502 if ( rs->sr_err != LDAP_SUCCESS ) {
1503 LDAP_BACK_CONN_ISBOUND_CLEAR( msc );
1504 if ( sendok & LDAP_BACK_SENDERR ) {
1505 send_ldap_result( op, rs );
1509 LDAP_BACK_CONN_ISBOUND_SET( msc );
1512 lutil_sasl_freedefs( defaults );
1514 slap_sl_free( authzID.bv_val, op->o_tmpmemctx );
1518 #endif /* HAVE_CYRUS_SASL */
1521 *method = mt->mt_idassert_authmethod;
1522 switch ( mt->mt_idassert_authmethod ) {
1523 case LDAP_AUTH_NONE:
1524 BER_BVSTR( binddn, "" );
1525 BER_BVSTR( bindcred, "" );
1528 case LDAP_AUTH_SIMPLE:
1533 LDAP_BACK_CONN_ISBOUND_CLEAR( msc );
1534 rs->sr_err = LDAP_AUTH_METHOD_NOT_SUPPORTED;
1535 if ( sendok & LDAP_BACK_SENDERR ) {
1536 send_ldap_result( op, rs );
1543 if ( !BER_BVISEMPTY( binddn ) ) {
1544 LDAP_BACK_CONN_ISIDASSERT_SET( msc );
1551 meta_back_proxy_authz_bind( metaconn_t *mc, int candidate, Operation *op, SlapReply *rs, ldap_back_send_t sendok )
1553 metainfo_t *mi = (metainfo_t *)op->o_bd->be_private;
1554 metatarget_t *mt = mi->mi_targets[ candidate ];
1555 metasingleconn_t *msc = &mc->mc_conns[ candidate ];
1556 struct berval binddn = BER_BVC( "" ),
1557 cred = BER_BVC( "" );
1558 int method = LDAP_AUTH_NONE,
1561 rc = meta_back_proxy_authz_cred( mc, candidate, op, rs, sendok, &binddn, &cred, &method );
1562 if ( rc == LDAP_SUCCESS && !LDAP_BACK_CONN_ISBOUND( msc ) ) {
1566 case LDAP_AUTH_NONE:
1567 case LDAP_AUTH_SIMPLE:
1569 rs->sr_err = ldap_sasl_bind( msc->msc_ld,
1570 binddn.bv_val, LDAP_SASL_SIMPLE,
1571 &cred, NULL, NULL, &msgid );
1572 if ( rs->sr_err != LDAP_X_CONNECTING ) {
1575 ldap_pvt_thread_yield();
1577 rc = meta_back_bind_op_result( op, rs, mc, candidate, msgid, sendok );
1578 if ( rc == LDAP_SUCCESS ) {
1579 /* set rebind stuff in case of successful proxyAuthz bind,
1580 * so that referral chasing is attempted using the right
1582 LDAP_BACK_CONN_ISBOUND_SET( msc );
1583 ber_bvreplace( &msc->msc_bound_ndn, &binddn );
1585 if ( META_BACK_TGT_SAVECRED( mt ) ) {
1586 if ( !BER_BVISNULL( &msc->msc_cred ) ) {
1587 memset( msc->msc_cred.bv_val, 0,
1588 msc->msc_cred.bv_len );
1590 ber_bvreplace( &msc->msc_cred, &cred );
1591 ldap_set_rebind_proc( msc->msc_ld, mt->mt_rebind_f, msc );
1602 return LDAP_BACK_CONN_ISBOUND( msc );
1608 * if any needs to be added, it is prepended to existing ones,
1609 * in a newly allocated array. The companion function
1610 * mi->mi_ldap_extra->controls_free() must be used to restore the original
1611 * status of op->o_ctrls.
1614 meta_back_controls_add(
1619 LDAPControl ***pctrls )
1621 metainfo_t *mi = (metainfo_t *)op->o_bd->be_private;
1622 metatarget_t *mt = mi->mi_targets[ candidate ];
1623 metasingleconn_t *msc = &mc->mc_conns[ candidate ];
1625 LDAPControl **ctrls = NULL;
1626 /* set to the maximum number of controls this backend can add */
1627 LDAPControl c[ 2 ] = {{ 0 }};
1628 int n = 0, i, j1 = 0, j2 = 0;
1632 rs->sr_err = LDAP_SUCCESS;
1634 /* don't add controls if protocol is not LDAPv3 */
1635 switch ( mt->mt_version ) {
1640 if ( op->o_protocol == 0 || op->o_protocol == LDAP_VERSION3 ) {
1649 /* put controls that go __before__ existing ones here */
1651 /* proxyAuthz for identity assertion */
1652 switch ( mi->mi_ldap_extra->proxy_authz_ctrl( op, rs, &msc->msc_bound_ndn,
1653 mt->mt_version, &mt->mt_idassert, &c[ j1 ] ) )
1655 case SLAP_CB_CONTINUE:
1666 /* put controls that go __after__ existing ones here */
1668 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
1669 /* session tracking */
1670 if ( META_BACK_TGT_ST_REQUEST( mt ) ) {
1671 switch ( slap_ctrl_session_tracking_request_add( op, rs, &c[ j1 + j2 ] ) ) {
1672 case SLAP_CB_CONTINUE:
1683 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
1685 if ( rs->sr_err == SLAP_CB_CONTINUE ) {
1686 rs->sr_err = LDAP_SUCCESS;
1689 /* if nothing to do, just bail out */
1690 if ( j1 == 0 && j2 == 0 ) {
1694 assert( j1 + j2 <= (int) (sizeof( c )/sizeof( c[0] )) );
1696 if ( op->o_ctrls ) {
1697 for ( n = 0; op->o_ctrls[ n ]; n++ )
1698 /* just count ctrls */ ;
1701 ctrls = op->o_tmpalloc( (n + j1 + j2 + 1) * sizeof( LDAPControl * ) + ( j1 + j2 ) * sizeof( LDAPControl ),
1704 ctrls[ 0 ] = (LDAPControl *)&ctrls[ n + j1 + j2 + 1 ];
1705 *ctrls[ 0 ] = c[ 0 ];
1706 for ( i = 1; i < j1; i++ ) {
1707 ctrls[ i ] = &ctrls[ 0 ][ i ];
1708 *ctrls[ i ] = c[ i ];
1713 if ( op->o_ctrls ) {
1714 for ( i = 0; op->o_ctrls[ i ]; i++ ) {
1715 ctrls[ i + j1 ] = op->o_ctrls[ i ];
1721 ctrls[ n ] = (LDAPControl *)&ctrls[ n + j2 + 1 ] + j1;
1722 *ctrls[ n ] = c[ j1 ];
1723 for ( i = 1; i < j2; i++ ) {
1724 ctrls[ n + i ] = &ctrls[ n ][ i ];
1725 *ctrls[ n + i ] = c[ i ];
1729 ctrls[ n + j2 ] = NULL;
1732 if ( ctrls == NULL ) {
1733 ctrls = op->o_ctrls;