git.sur5r.net Git - openldap/blob - servers/slapd/backend.c

   1 /* backend.c - routines for dealing with back-end databases */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 1998-2005 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
  17  * All rights reserved.
  18  *
  19  * Redistribution and use in source and binary forms are permitted
  20  * provided that this notice is preserved and that due credit is given
  21  * to the University of Michigan at Ann Arbor. The name of the University
  22  * may not be used to endorse or promote products derived from this
  23  * software without specific prior written permission. This software
  24  * is provided ``as is'' without express or implied warranty.
  25  */
  26
  27
  28 #include "portable.h"
  29
  30 #include <stdio.h>
  31
  32 #include <ac/string.h>
  33 #include <ac/socket.h>
  34 #include <sys/stat.h>
  35
  36 #include "slap.h"
  37 #include "lutil.h"
  38 #include "lber_pvt.h"
  39
  40 #include "ldap_rq.h"
  41
  42 #ifdef LDAP_SLAPI
  43 #include "slapi/slapi.h"
  44
  45 static void init_group_pblock( Operation *op, Entry *target,
  46         Entry *e, struct berval *op_ndn, AttributeDescription *group_at );
  47 static int call_group_preop_plugins( Operation *op );
  48 static void call_group_postop_plugins( Operation *op );
  49 #endif /* LDAP_SLAPI */
  50
  51 /*
  52  * If a module is configured as dynamic, its header should not
  53  * get included into slapd. While this is a general rule and does
  54  * not have much of an effect in UNIX, this rule should be adhered
  55  * to for Windows, where dynamic object code should not be implicitly
  56  * imported into slapd without appropriate __declspec(dllimport) directives.
  57  */
  58
  59 int                     nBackendInfo = 0;
  60 BackendInfo             *backendInfo = NULL;
  61
  62 int                     nBackendDB = 0;
  63 BackendDB               *backendDB = NULL;
  64
  65 ldap_pvt_thread_pool_t  syncrepl_pool;
  66 int                     syncrepl_pool_max = SLAP_MAX_SYNCREPL_THREADS;
  67
  68 static int
  69 backend_init_controls( BackendInfo *bi )
  70 {
  71         if ( bi->bi_controls ) {
  72                 int     i;
  73
  74                 for ( i = 0; bi->bi_controls[ i ]; i++ ) {
  75                         int     cid;
  76
  77                         if ( slap_find_control_id( bi->bi_controls[ i ], &cid )
  78                                         == LDAP_CONTROL_NOT_FOUND )
  79                         {
  80                                 if ( !( slapMode & SLAP_TOOL_MODE ) ) {
  81                                         assert( 0 );
  82                                 }
  83
  84                                 return -1;
  85                         }
  86
  87                         bi->bi_ctrls[ cid ] = 1;
  88                 }
  89         }
  90
  91         return 0;
  92 }
  93
  94 int backend_init(void)
  95 {
  96         int rc = -1;
  97
  98         ldap_pvt_thread_pool_init( &syncrepl_pool, syncrepl_pool_max, 0 );
  99
 100         if((nBackendInfo != 0) || (backendInfo != NULL)) {
 101                 /* already initialized */
 102                 Debug( LDAP_DEBUG_ANY,
 103                         "backend_init: already initialized\n", 0, 0, 0 );
 104                 return -1;
 105         }
 106
 107         for( ;
 108                 slap_binfo[nBackendInfo].bi_type != NULL;
 109                 nBackendInfo++ )
 110         {
 111                 assert( slap_binfo[nBackendInfo].bi_init );
 112
 113                 rc = slap_binfo[nBackendInfo].bi_init( &slap_binfo[nBackendInfo] );
 114
 115                 if(rc != 0) {
 116                         Debug( LDAP_DEBUG_ANY,
 117                                 "backend_init: initialized for type \"%s\"\n",
 118                                 slap_binfo[nBackendInfo].bi_type, 0, 0 );
 119                         /* destroy those we've already inited */
 120                         for( nBackendInfo--;
 121                                 nBackendInfo >= 0 ;
 122                                 nBackendInfo-- )
 123                         {
 124                                 if ( slap_binfo[nBackendInfo].bi_destroy ) {
 125                                         slap_binfo[nBackendInfo].bi_destroy(
 126                                                 &slap_binfo[nBackendInfo] );
 127                                 }
 128                         }
 129                         return rc;
 130                 }
 131         }
 132
 133         if ( nBackendInfo > 0) {
 134                 backendInfo = slap_binfo;
 135                 return 0;
 136         }
 137
 138 #ifdef SLAPD_MODULES
 139         return 0;
 140 #else
 141
 142         Debug( LDAP_DEBUG_ANY,
 143                 "backend_init: failed\n",
 144                 0, 0, 0 );
 145
 146         return rc;
 147 #endif /* SLAPD_MODULES */
 148 }
 149
 150 int backend_add(BackendInfo *aBackendInfo)
 151 {
 152         int rc = 0;
 153
 154         if ( aBackendInfo->bi_init == NULL ) {
 155                 Debug( LDAP_DEBUG_ANY, "backend_add: "
 156                         "backend type \"%s\" does not have the (mandatory)init function\n",
 157                         aBackendInfo->bi_type, 0, 0 );
 158                 return -1;
 159         }
 160
 161         rc = aBackendInfo->bi_init(aBackendInfo);
 162         if ( rc != 0) {
 163                 Debug( LDAP_DEBUG_ANY,
 164                         "backend_add:  initialization for type \"%s\" failed\n",
 165                         aBackendInfo->bi_type, 0, 0 );
 166                 return rc;
 167         }
 168
 169         (void)backend_init_controls( aBackendInfo );
 170
 171         /* now add the backend type to the Backend Info List */
 172         {
 173                 BackendInfo *newBackendInfo = 0;
 174
 175                 /* if backendInfo == slap_binfo no deallocation of old backendInfo */
 176                 if (backendInfo == slap_binfo) {
 177                         newBackendInfo = ch_calloc(nBackendInfo + 1, sizeof(BackendInfo));
 178                         AC_MEMCPY(newBackendInfo, backendInfo,
 179                                 sizeof(BackendInfo) * nBackendInfo);
 180                 } else {
 181                         newBackendInfo = ch_realloc(backendInfo,
 182                                 sizeof(BackendInfo) * (nBackendInfo + 1));
 183                 }
 184
 185                 AC_MEMCPY(&newBackendInfo[nBackendInfo], aBackendInfo,
 186                         sizeof(BackendInfo));
 187                 backendInfo = newBackendInfo;
 188                 nBackendInfo++;
 189                 return 0;
 190         }
 191 }
 192
 193 static int
 194 backend_set_controls( BackendDB *be )
 195 {
 196         BackendInfo     *bi = be->bd_info;
 197
 198         /* back-relay takes care of itself; so may do other */
 199         if ( overlay_is_over( be ) ) {
 200                 bi = ((slap_overinfo *)be->bd_info->bi_private)->oi_orig;
 201         }
 202
 203         if ( bi->bi_controls ) {
 204                 if ( be->be_ctrls[ SLAP_MAX_CIDS ] == 0 ) {
 205                         AC_MEMCPY( be->be_ctrls, bi->bi_ctrls,
 206                                         sizeof( be->be_ctrls ) );
 207                         be->be_ctrls[ SLAP_MAX_CIDS ] = 1;
 208
 209                 } else {
 210                         int     i;
 211
 212                         for ( i = 0; i < SLAP_MAX_CIDS; i++ ) {
 213                                 if ( bi->bi_ctrls[ i ] ) {
 214                                         be->be_ctrls[ i ] = bi->bi_ctrls[ i ];
 215                                 }
 216                         }
 217                 }
 218         }
 219
 220         return 0;
 221 }
 222
 223
 224 /* startup a specific backend database */
 225 int backend_startup_one(Backend *be)
 226 {
 227         int             rc = 0;
 228
 229         be->be_pending_csn_list = (struct be_pcl *)
 230                 ch_calloc( 1, sizeof( struct be_pcl ));
 231
 232         LDAP_TAILQ_INIT( be->be_pending_csn_list );
 233
 234         Debug( LDAP_DEBUG_TRACE,
 235                 "backend_startup_one: starting \"%s\"\n",
 236                 be->be_suffix ? be->be_suffix[0].bv_val : "(unknown)",
 237                 0, 0 );
 238         (void)backend_set_controls( be );
 239         if ( be->bd_info->bi_db_open ) {
 240                 rc = be->bd_info->bi_db_open( be );
 241                 if ( rc == 0 ) {
 242                         (void)backend_set_controls( be );
 243
 244                 } else {
 245                         Debug( LDAP_DEBUG_ANY,
 246                                 "backend_startup_one: bi_db_open failed! (%d)\n",
 247                                 rc, 0, 0 );
 248                 }
 249         }
 250
 251         return rc;
 252 }
 253
 254 int backend_startup(Backend *be)
 255 {
 256         int i;
 257         int rc = 0;
 258
 259         if( ! ( nBackendDB > 0 ) ) {
 260                 /* no databases */
 261                 Debug( LDAP_DEBUG_ANY,
 262                         "backend_startup: %d databases to startup.\n",
 263                         nBackendDB, 0, 0 );
 264                 return 1;
 265         }
 266
 267         if(be != NULL) {
 268                 if ( be->bd_info->bi_open ) {
 269                         rc = be->bd_info->bi_open( be->bd_info );
 270                         if ( rc != 0 ) {
 271                                 Debug( LDAP_DEBUG_ANY,
 272                                         "backend_startup: bi_open failed!\n",
 273                                         0, 0, 0 );
 274
 275                                 return rc;
 276                         }
 277                 }
 278
 279                 return backend_startup_one( be );
 280         }
 281
 282         /* open frontend, if required */
 283         if ( frontendDB->bd_info->bi_db_open ) {
 284                 rc = frontendDB->bd_info->bi_db_open( frontendDB );
 285                 if ( rc != 0 ) {
 286                         Debug( LDAP_DEBUG_ANY,
 287                                 "backend_startup: bi_db_open(frontend) failed! (%d)\n",
 288                                 rc, 0, 0 );
 289                         return rc;
 290                 }
 291         }
 292
 293         /* open each backend type */
 294         for( i = 0; i < nBackendInfo; i++ ) {
 295                 if( backendInfo[i].bi_nDB == 0) {
 296                         /* no database of this type, don't open */
 297                         continue;
 298                 }
 299
 300                 if( backendInfo[i].bi_open ) {
 301                         rc = backendInfo[i].bi_open( &backendInfo[i] );
 302                         if ( rc != 0 ) {
 303                                 Debug( LDAP_DEBUG_ANY,
 304                                         "backend_startup: bi_open %d failed!\n",
 305                                         i, 0, 0 );
 306                                 return rc;
 307                         }
 308                 }
 309
 310                 (void)backend_init_controls( &backendInfo[i] );
 311         }
 312
 313         ldap_pvt_thread_mutex_init( &slapd_rq.rq_mutex );
 314         LDAP_STAILQ_INIT( &slapd_rq.task_list );
 315         LDAP_STAILQ_INIT( &slapd_rq.run_list );
 316
 317         /* open each backend database */
 318         for( i = 0; i < nBackendDB; i++ ) {
 319                 if ( backendDB[i].be_suffix == NULL ) {
 320                         Debug( LDAP_DEBUG_ANY,
 321                                 "backend_startup: warning, database %d (%s) "
 322                                 "has no suffix\n",
 323                                 i, backendDB[i].bd_info->bi_type, 0 );
 324                 }
 325                 /* append global access controls */
 326                 acl_append( &backendDB[i].be_acl, frontendDB->be_acl );
 327
 328                 rc = backend_startup_one( &backendDB[i] );
 329
 330                 if ( rc ) return rc;
 331
 332
 333                 if ( backendDB[i].be_syncinfo ) {
 334                         syncinfo_t *si;
 335
 336                         if ( !( backendDB[i].be_search && backendDB[i].be_add &&
 337                                 backendDB[i].be_modify && backendDB[i].be_delete )) {
 338                                 Debug( LDAP_DEBUG_ANY,
 339                                         "backend_startup: database(%d) does not support "
 340                                         "operations required for syncrepl", i, 0, 0 );
 341                                 continue;
 342                         }
 343
 344                         {
 345                                 si = backendDB[i].be_syncinfo;
 346                                 si->si_be = &backendDB[i];
 347                                 init_syncrepl( si );
 348                                 ldap_pvt_thread_mutex_lock( &slapd_rq.rq_mutex );
 349                                 ldap_pvt_runqueue_insert( &slapd_rq,
 350                                                 si->si_interval, do_syncrepl, (void *) si );
 351                                 ldap_pvt_thread_mutex_unlock( &slapd_rq.rq_mutex );
 352                         }
 353                 }
 354         }
 355
 356         return rc;
 357 }
 358
 359 int backend_num( Backend *be )
 360 {
 361         int i;
 362
 363         if( be == NULL ) return -1;
 364
 365         for( i = 0; i < nBackendDB; i++ ) {
 366                 if( be == &backendDB[i] ) return i;
 367         }
 368         return -1;
 369 }
 370
 371 int backend_shutdown( Backend *be )
 372 {
 373         int i;
 374         int rc = 0;
 375
 376         if( be != NULL ) {
 377                 /* shutdown a specific backend database */
 378
 379                 if ( be->bd_info->bi_nDB == 0 ) {
 380                         /* no database of this type, we never opened it */
 381                         return 0;
 382                 }
 383
 384                 if ( be->bd_info->bi_db_close ) {
 385                         be->bd_info->bi_db_close( be );
 386                 }
 387
 388                 if( be->bd_info->bi_close ) {
 389                         be->bd_info->bi_close( be->bd_info );
 390                 }
 391
 392                 return 0;
 393         }
 394
 395         /* close each backend database */
 396         for( i = 0; i < nBackendDB; i++ ) {
 397                 if ( backendDB[i].bd_info->bi_db_close ) {
 398                         backendDB[i].bd_info->bi_db_close(
 399                                 &backendDB[i] );
 400                 }
 401
 402                 if(rc != 0) {
 403                         Debug( LDAP_DEBUG_ANY,
 404                                 "backend_close: bi_db_close %s failed!\n",
 405                                 backendDB[i].be_type, 0, 0 );
 406                 }
 407         }
 408
 409         /* close each backend type */
 410         for( i = 0; i < nBackendInfo; i++ ) {
 411                 if( backendInfo[i].bi_nDB == 0 ) {
 412                         /* no database of this type */
 413                         continue;
 414                 }
 415
 416                 if( backendInfo[i].bi_close ) {
 417                         backendInfo[i].bi_close(
 418                                 &backendInfo[i] );
 419                 }
 420         }
 421
 422         /* close frontend, if required */
 423         if ( frontendDB->bd_info->bi_db_close ) {
 424                 rc = frontendDB->bd_info->bi_db_close ( frontendDB );
 425                 if ( rc != 0 ) {
 426                         Debug( LDAP_DEBUG_ANY,
 427                                 "backend_startup: bi_db_close(frontend) failed! (%d)\n",
 428                                 rc, 0, 0 );
 429                 }
 430         }
 431
 432         return 0;
 433 }
 434
 435 int backend_destroy(void)
 436 {
 437         int i;
 438         BackendDB *bd;
 439         struct slap_csn_entry *csne;
 440
 441         ldap_pvt_thread_pool_destroy( &syncrepl_pool, 1 );
 442
 443         /* destroy each backend database */
 444         for( i = 0, bd = backendDB; i < nBackendDB; i++, bd++ ) {
 445
 446                 if ( bd->be_syncinfo ) {
 447                         syncinfo_free( bd->be_syncinfo );
 448                 }
 449
 450                 if ( bd->be_pending_csn_list ) {
 451                         csne = LDAP_TAILQ_FIRST( bd->be_pending_csn_list );
 452                         while ( csne ) {
 453                                 struct slap_csn_entry *tmp_csne = csne;
 454
 455                                 LDAP_TAILQ_REMOVE( bd->be_pending_csn_list, csne, ce_csn_link );
 456                                 ch_free( csne->ce_csn.bv_val );
 457                                 csne = LDAP_TAILQ_NEXT( csne, ce_csn_link );
 458                                 ch_free( tmp_csne );
 459                         }
 460                 }
 461
 462                 if ( bd->bd_info->bi_db_destroy ) {
 463                         bd->bd_info->bi_db_destroy( bd );
 464                 }
 465                 ber_bvarray_free( bd->be_suffix );
 466                 ber_bvarray_free( bd->be_nsuffix );
 467                 if ( !BER_BVISNULL( &bd->be_rootdn ) ) {
 468                         free( bd->be_rootdn.bv_val );
 469                 }
 470                 if ( !BER_BVISNULL( &bd->be_rootndn ) ) {
 471                         free( bd->be_rootndn.bv_val );
 472                 }
 473                 if ( !BER_BVISNULL( &bd->be_rootpw ) ) {
 474                         free( bd->be_rootpw.bv_val );
 475                 }
 476                 acl_destroy( bd->be_acl, frontendDB->be_acl );
 477         }
 478         free( backendDB );
 479
 480         /* destroy each backend type */
 481         for( i = 0; i < nBackendInfo; i++ ) {
 482                 if( backendInfo[i].bi_destroy ) {
 483                         backendInfo[i].bi_destroy(
 484                                 &backendInfo[i] );
 485                 }
 486         }
 487
 488 #ifdef SLAPD_MODULES
 489         if (backendInfo != slap_binfo) {
 490            free(backendInfo);
 491         }
 492 #endif /* SLAPD_MODULES */
 493
 494         nBackendInfo = 0;
 495         backendInfo = NULL;
 496
 497         /* destroy frontend database */
 498         bd = frontendDB;
 499         if ( bd ) {
 500                 if ( bd->bd_info->bi_db_destroy ) {
 501                         bd->bd_info->bi_db_destroy( bd );
 502                 }
 503                 ber_bvarray_free( bd->be_suffix );
 504                 ber_bvarray_free( bd->be_nsuffix );
 505                 if ( !BER_BVISNULL( &bd->be_rootdn ) ) {
 506                         free( bd->be_rootdn.bv_val );
 507                 }
 508                 if ( !BER_BVISNULL( &bd->be_rootndn ) ) {
 509                         free( bd->be_rootndn.bv_val );
 510                 }
 511                 if ( !BER_BVISNULL( &bd->be_rootpw ) ) {
 512                         free( bd->be_rootpw.bv_val );
 513                 }
 514                 acl_destroy( bd->be_acl, frontendDB->be_acl );
 515         }
 516
 517         return 0;
 518 }
 519
 520 BackendInfo* backend_info(const char *type)
 521 {
 522         int i;
 523
 524         /* search for the backend type */
 525         for( i = 0; i < nBackendInfo; i++ ) {
 526                 if( strcasecmp(backendInfo[i].bi_type, type) == 0 ) {
 527                         return &backendInfo[i];
 528                 }
 529         }
 530
 531         return NULL;
 532 }
 533
 534
 535 BackendDB *
 536 backend_db_init(
 537     const char  *type )
 538 {
 539         Backend *be;
 540         BackendInfo *bi = backend_info(type);
 541         int     rc = 0;
 542
 543         if( bi == NULL ) {
 544                 fprintf( stderr, "Unrecognized database type (%s)\n", type );
 545                 return NULL;
 546         }
 547
 548         be = backendDB;
 549
 550         backendDB = (BackendDB *) ch_realloc(
 551                         (char *) backendDB,
 552                     (nBackendDB + 1) * sizeof(Backend) );
 553
 554         memset( &backendDB[nbackends], '\0', sizeof(Backend) );
 555
 556         /* did realloc move our table? if so, fix up dependent pointers */
 557         if ( be != backendDB ) {
 558                 int i;
 559                 for ( i=0, be=backendDB; i<nbackends; i++, be++ ) {
 560                         be->be_pcl_mutexp = &be->be_pcl_mutex;
 561                 }
 562         }
 563
 564         be = &backends[nbackends++];
 565
 566         be->bd_info = bi;
 567
 568         be->be_def_limit = frontendDB->be_def_limit;
 569         be->be_dfltaccess = frontendDB->be_dfltaccess;
 570
 571         be->be_restrictops = frontendDB->be_restrictops;
 572         be->be_requires = frontendDB->be_requires;
 573         be->be_ssf_set = frontendDB->be_ssf_set;
 574
 575         be->be_pcl_mutexp = &be->be_pcl_mutex;
 576         ldap_pvt_thread_mutex_init( be->be_pcl_mutexp );
 577
 578         /* assign a default depth limit for alias deref */
 579         be->be_max_deref_depth = SLAPD_DEFAULT_MAXDEREFDEPTH;
 580
 581         if ( bi->bi_db_init ) {
 582                 rc = bi->bi_db_init( be );
 583         }
 584
 585         if ( rc != 0 ) {
 586                 fprintf( stderr, "database init failed (%s)\n", type );
 587                 nbackends--;
 588                 return NULL;
 589         }
 590
 591         bi->bi_nDB++;
 592         return( be );
 593 }
 594
 595 void
 596 be_db_close( void )
 597 {
 598         int     i;
 599
 600         for ( i = 0; i < nbackends; i++ ) {
 601                 if ( backends[i].bd_info->bi_db_close ) {
 602                         (*backends[i].bd_info->bi_db_close)( &backends[i] );
 603                 }
 604         }
 605
 606         if ( frontendDB->bd_info->bi_db_close ) {
 607                 (*frontendDB->bd_info->bi_db_close)( frontendDB );
 608         }
 609
 610 }
 611
 612 Backend *
 613 select_backend(
 614         struct berval * dn,
 615         int manageDSAit,
 616         int noSubs )
 617 {
 618         int             i, j;
 619         ber_len_t       len, dnlen = dn->bv_len;
 620         Backend         *be = NULL;
 621
 622         for ( i = 0; i < nbackends; i++ ) {
 623                 if ( backends[i].be_nsuffix == NULL ) {
 624                         continue;
 625                 }
 626
 627                 for ( j = 0; !BER_BVISNULL( &backends[i].be_nsuffix[j] ); j++ )
 628                 {
 629                         if ( ( SLAP_GLUE_SUBORDINATE( &backends[i] ) )
 630                                 && noSubs )
 631                         {
 632                                 continue;
 633                         }
 634
 635                         len = backends[i].be_nsuffix[j].bv_len;
 636
 637                         if ( len > dnlen ) {
 638                                 /* suffix is longer than DN */
 639                                 continue;
 640                         }
 641
 642                         /*
 643                          * input DN is normalized, so the separator check
 644                          * need not look at escaping
 645                          */
 646                         if ( len && len < dnlen &&
 647                                 !DN_SEPARATOR( dn->bv_val[(dnlen-len)-1] ))
 648                         {
 649                                 continue;
 650                         }
 651
 652                         if ( strcmp( backends[i].be_nsuffix[j].bv_val,
 653                                 &dn->bv_val[dnlen-len] ) == 0 )
 654                         {
 655                                 if( be == NULL ) {
 656                                         be = &backends[i];
 657
 658                                         if( manageDSAit && len == dnlen &&
 659                                                 !SLAP_GLUE_SUBORDINATE( be ) ) {
 660                                                 continue;
 661                                         }
 662                                 } else {
 663                                         be = &backends[i];
 664                                 }
 665                                 return be;
 666                         }
 667                 }
 668         }
 669
 670         return be;
 671 }
 672
 673 int
 674 be_issuffix(
 675     Backend *be,
 676     struct berval *bvsuffix )
 677 {
 678         int     i;
 679
 680         if ( be->be_nsuffix == NULL ) {
 681                 return 0;
 682         }
 683
 684         for ( i = 0; !BER_BVISNULL( &be->be_nsuffix[i] ); i++ ) {
 685                 if ( bvmatch( &be->be_nsuffix[i], bvsuffix ) ) {
 686                         return 1;
 687                 }
 688         }
 689
 690         return 0;
 691 }
 692
 693 int
 694 be_isroot_dn( Backend *be, struct berval *ndn )
 695 {
 696         if ( BER_BVISEMPTY( ndn ) || BER_BVISEMPTY( &be->be_rootndn ) ) {
 697                 return 0;
 698         }
 699
 700         return dn_match( &be->be_rootndn, ndn );
 701 }
 702
 703 int
 704 be_slurp_update( Operation *op )
 705 {
 706         return ( SLAP_SLURP_SHADOW( op->o_bd ) &&
 707                 be_isupdate_dn( op->o_bd, &op->o_ndn ) );
 708 }
 709
 710 int
 711 be_shadow_update( Operation *op )
 712 {
 713         return ( SLAP_SYNC_SHADOW( op->o_bd ) ||
 714                 ( SLAP_SHADOW( op->o_bd ) && be_isupdate_dn( op->o_bd, &op->o_ndn ) ) );
 715 }
 716
 717 int
 718 be_isupdate_dn( Backend *be, struct berval *ndn )
 719 {
 720         if ( BER_BVISEMPTY( ndn ) || BER_BVISEMPTY( &be->be_update_ndn ) ) {
 721                 return 0;
 722         }
 723
 724         return dn_match( &be->be_update_ndn, ndn );
 725 }
 726
 727 struct berval *
 728 be_root_dn( Backend *be )
 729 {
 730         return &be->be_rootdn;
 731 }
 732
 733 int
 734 be_isroot( Operation *op )
 735 {
 736         return be_isroot_dn( op->o_bd, &op->o_ndn );
 737 }
 738
 739 int
 740 be_isroot_pw( Operation *op )
 741 {
 742         int result;
 743
 744         if ( ! be_isroot_dn( op->o_bd, &op->o_req_ndn ) ) {
 745                 return 0;
 746         }
 747
 748         if ( BER_BVISEMPTY( &op->o_bd->be_rootpw ) ) {
 749                 return 0;
 750         }
 751
 752 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
 753         ldap_pvt_thread_mutex_lock( &passwd_mutex );
 754 #ifdef SLAPD_SPASSWD
 755         lutil_passwd_sasl_conn = op->o_conn->c_sasl_authctx;
 756 #endif
 757 #endif
 758
 759         result = lutil_passwd( &op->o_bd->be_rootpw, &op->orb_cred, NULL, NULL );
 760
 761 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
 762 #ifdef SLAPD_SPASSWD
 763         lutil_passwd_sasl_conn = NULL;
 764 #endif
 765         ldap_pvt_thread_mutex_unlock( &passwd_mutex );
 766 #endif
 767
 768         return result == 0;
 769 }
 770
 771 int
 772 be_entry_release_rw(
 773         Operation *op,
 774         Entry *e,
 775         int rw )
 776 {
 777         if ( op->o_bd->be_release ) {
 778                 /* free and release entry from backend */
 779                 return op->o_bd->be_release( op, e, rw );
 780         } else {
 781                 /* free entry */
 782                 entry_free( e );
 783                 return 0;
 784         }
 785 }
 786
 787 int
 788 backend_unbind( Operation *op, SlapReply *rs )
 789 {
 790         int             i;
 791
 792         for ( i = 0; i < nbackends; i++ ) {
 793 #if defined( LDAP_SLAPI )
 794                 if ( op->o_pb ) {
 795                         int rc;
 796                         if ( i == 0 ) slapi_int_pblock_set_operation( op->o_pb, op );
 797                         slapi_pblock_set( op->o_pb, SLAPI_BACKEND, (void *)&backends[i] );
 798                         rc = slapi_int_call_plugins( &backends[i],
 799                                 SLAPI_PLUGIN_PRE_UNBIND_FN, (Slapi_PBlock *)op->o_pb );
 800                         if ( rc < 0 ) {
 801                                 /*
 802                                  * A preoperation plugin failure will abort the
 803                                  * entire operation.
 804                                  */
 805                                 Debug(LDAP_DEBUG_TRACE,
 806                                         "do_bind: Unbind preoperation plugin failed\n",
 807                                         0, 0, 0);
 808                                 return 0;
 809                         }
 810                 }
 811 #endif /* defined( LDAP_SLAPI ) */
 812
 813                 if ( backends[i].be_unbind ) {
 814                         op->o_bd = &backends[i];
 815                         (*backends[i].be_unbind)( op, rs );
 816                 }
 817
 818 #if defined( LDAP_SLAPI )
 819                 if ( op->o_pb != NULL && slapi_int_call_plugins( &backends[i],
 820                         SLAPI_PLUGIN_POST_UNBIND_FN, (Slapi_PBlock *)op->o_pb ) < 0 )
 821                 {
 822                         Debug(LDAP_DEBUG_TRACE,
 823                                 "do_unbind: Unbind postoperation plugins failed\n",
 824                                 0, 0, 0);
 825                 }
 826 #endif /* defined( LDAP_SLAPI ) */
 827         }
 828
 829         return 0;
 830 }
 831
 832 int
 833 backend_connection_init(
 834         Connection   *conn )
 835 {
 836         int     i;
 837
 838         for ( i = 0; i < nbackends; i++ ) {
 839                 if ( backends[i].be_connection_init ) {
 840                         (*backends[i].be_connection_init)( &backends[i], conn);
 841                 }
 842         }
 843
 844         return 0;
 845 }
 846
 847 int
 848 backend_connection_destroy(
 849         Connection   *conn )
 850 {
 851         int     i;
 852
 853         for ( i = 0; i < nbackends; i++ ) {
 854                 if ( backends[i].be_connection_destroy ) {
 855                         (*backends[i].be_connection_destroy)( &backends[i], conn);
 856                 }
 857         }
 858
 859         return 0;
 860 }
 861
 862 static int
 863 backend_check_controls(
 864         Operation *op,
 865         SlapReply *rs )
 866 {
 867         LDAPControl **ctrls = op->o_ctrls;
 868         rs->sr_err = LDAP_SUCCESS;
 869
 870         if( ctrls ) {
 871                 for( ; *ctrls != NULL ; ctrls++ ) {
 872                         int cid;
 873
 874                         switch ( slap_global_control( op, (*ctrls)->ldctl_oid, &cid ) ) {
 875                         case LDAP_CONTROL_NOT_FOUND:
 876                                 /* unrecognized control */
 877                                 if ( (*ctrls)->ldctl_iscritical ) {
 878                                         /* should not be reachable */
 879                                         Debug( LDAP_DEBUG_ANY,
 880                                                 "backend_check_controls: unrecognized control: %s\n",
 881                                                 (*ctrls)->ldctl_oid, 0, 0 );
 882                                         assert( 0 );
 883                                 }
 884                                 break;
 885
 886                         case LDAP_COMPARE_FALSE:
 887                                 if ( !op->o_bd->be_ctrls[ cid ] )
 888                                 {
 889                                         /* Per RFC 2251 (and LDAPBIS discussions), if the control
 890                                          * is recognized and appropriate for the operation (which
 891                                          * we've already verified), then the server should make
 892                                          * use of the control when performing the operation.
 893                                          *
 894                                          * Here we find that operation extended by the control
 895                                          * is not unavailable in a particular context, hence the
 896                                          * return of unwillingToPerform.
 897                                          */
 898                                         rs->sr_text = "control unavailable in context";
 899                                         rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 900                                         goto done;
 901                                 }
 902                                 break;
 903
 904                         case LDAP_COMPARE_TRUE:
 905                                 break;
 906
 907                         default:
 908                                 /* unreachable */
 909                                 rs->sr_err = "unable to check control";
 910                                 rs->sr_err = LDAP_OTHER;
 911                                 goto done;
 912                         }
 913                 }
 914         }
 915
 916 done:;
 917         return rs->sr_err;
 918 }
 919
 920 int
 921 backend_check_restrictions(
 922         Operation *op,
 923         SlapReply *rs,
 924         struct berval *opdata )
 925 {
 926         slap_mask_t restrictops;
 927         slap_mask_t requires;
 928         slap_mask_t opflag;
 929         slap_mask_t exopflag = 0;
 930         slap_ssf_set_t *ssf;
 931         int updateop = 0;
 932         int starttls = 0;
 933         int session = 0;
 934
 935         if ( op->o_bd ) {
 936                 int     rc = SLAP_CB_CONTINUE;
 937
 938                 if ( op->o_bd->be_chk_controls ) {
 939                         rc = ( *op->o_bd->be_chk_controls )( op, rs );
 940                 }
 941
 942                 if ( rc == SLAP_CB_CONTINUE ) {
 943                         rc = backend_check_controls( op, rs );
 944                 }
 945
 946                 if ( rc != LDAP_SUCCESS ) {
 947                         return rs->sr_err;
 948                 }
 949
 950                 restrictops = op->o_bd->be_restrictops;
 951                 requires = op->o_bd->be_requires;
 952                 ssf = &op->o_bd->be_ssf_set;
 953
 954         } else {
 955                 restrictops = frontendDB->be_restrictops;
 956                 requires = frontendDB->be_requires;
 957                 ssf = &frontendDB->be_ssf_set;
 958         }
 959
 960         switch( op->o_tag ) {
 961         case LDAP_REQ_ADD:
 962                 opflag = SLAP_RESTRICT_OP_ADD;
 963                 updateop++;
 964                 break;
 965         case LDAP_REQ_BIND:
 966                 opflag = SLAP_RESTRICT_OP_BIND;
 967                 session++;
 968                 break;
 969         case LDAP_REQ_COMPARE:
 970                 opflag = SLAP_RESTRICT_OP_COMPARE;
 971                 break;
 972         case LDAP_REQ_DELETE:
 973                 updateop++;
 974                 opflag = SLAP_RESTRICT_OP_DELETE;
 975                 break;
 976         case LDAP_REQ_EXTENDED:
 977                 opflag = SLAP_RESTRICT_OP_EXTENDED;
 978
 979                 if( !opdata ) {
 980                         /* treat unspecified as a modify */
 981                         opflag = SLAP_RESTRICT_OP_MODIFY;
 982                         updateop++;
 983                         break;
 984                 }
 985
 986                 if( bvmatch( opdata, &slap_EXOP_START_TLS ) ) {
 987                         session++;
 988                         starttls++;
 989                         exopflag = SLAP_RESTRICT_EXOP_START_TLS;
 990                         break;
 991                 }
 992
 993                 if( bvmatch( opdata, &slap_EXOP_WHOAMI ) ) {
 994                         exopflag = SLAP_RESTRICT_EXOP_WHOAMI;
 995                         break;
 996                 }
 997
 998                 if ( bvmatch( opdata, &slap_EXOP_CANCEL ) ) {
 999                         exopflag = SLAP_RESTRICT_EXOP_CANCEL;
1000                         break;
1001                 }
1002
1003                 if ( bvmatch( opdata, &slap_EXOP_MODIFY_PASSWD ) ) {
1004                         exopflag = SLAP_RESTRICT_EXOP_MODIFY_PASSWD;
1005                         updateop++;
1006                         break;
1007                 }
1008
1009                 /* treat everything else as a modify */
1010                 opflag = SLAP_RESTRICT_OP_MODIFY;
1011                 updateop++;
1012                 break;
1013
1014         case LDAP_REQ_MODIFY:
1015                 updateop++;
1016                 opflag = SLAP_RESTRICT_OP_MODIFY;
1017                 break;
1018         case LDAP_REQ_RENAME:
1019                 updateop++;
1020                 opflag = SLAP_RESTRICT_OP_RENAME;
1021                 break;
1022         case LDAP_REQ_SEARCH:
1023                 opflag = SLAP_RESTRICT_OP_SEARCH;
1024                 break;
1025         case LDAP_REQ_UNBIND:
1026                 session++;
1027                 opflag = 0;
1028                 break;
1029         default:
1030                 rs->sr_text = "restrict operations internal error";
1031                 rs->sr_err = LDAP_OTHER;
1032                 return rs->sr_err;
1033         }
1034
1035         if ( !starttls ) {
1036                 /* these checks don't apply to StartTLS */
1037
1038                 rs->sr_err = LDAP_CONFIDENTIALITY_REQUIRED;
1039                 if( op->o_transport_ssf < ssf->sss_transport ) {
1040                         rs->sr_text = op->o_transport_ssf
1041                                 ? "stronger transport confidentiality required"
1042                                 : "transport confidentiality required";
1043                         return rs->sr_err;
1044                 }
1045
1046                 if( op->o_tls_ssf < ssf->sss_tls ) {
1047                         rs->sr_text = op->o_tls_ssf
1048                                 ? "stronger TLS confidentiality required"
1049                                 : "TLS confidentiality required";
1050                         return rs->sr_err;
1051                 }
1052
1053
1054                 if( op->o_tag == LDAP_REQ_BIND && opdata == NULL ) {
1055                         /* simple bind specific check */
1056                         if( op->o_ssf < ssf->sss_simple_bind ) {
1057                                 rs->sr_text = op->o_ssf
1058                                         ? "stronger confidentiality required"
1059                                         : "confidentiality required";
1060                                 return rs->sr_err;
1061                         }
1062                 }
1063
1064                 if( op->o_tag != LDAP_REQ_BIND || opdata == NULL ) {
1065                         /* these checks don't apply to SASL bind */
1066
1067                         if( op->o_sasl_ssf < ssf->sss_sasl ) {
1068                                 rs->sr_text = op->o_sasl_ssf
1069                                         ? "stronger SASL confidentiality required"
1070                                         : "SASL confidentiality required";
1071                                 return rs->sr_err;
1072                         }
1073
1074                         if( op->o_ssf < ssf->sss_ssf ) {
1075                                 rs->sr_text = op->o_ssf
1076                                         ? "stronger confidentiality required"
1077                                         : "confidentiality required";
1078                                 return rs->sr_err;
1079                         }
1080                 }
1081
1082                 if( updateop ) {
1083                         if( op->o_transport_ssf < ssf->sss_update_transport ) {
1084                                 rs->sr_text = op->o_transport_ssf
1085                                         ? "stronger transport confidentiality required for update"
1086                                         : "transport confidentiality required for update";
1087                                 return rs->sr_err;
1088                         }
1089
1090                         if( op->o_tls_ssf < ssf->sss_update_tls ) {
1091                                 rs->sr_text = op->o_tls_ssf
1092                                         ? "stronger TLS confidentiality required for update"
1093                                         : "TLS confidentiality required for update";
1094                                 return rs->sr_err;
1095                         }
1096
1097                         if( op->o_sasl_ssf < ssf->sss_update_sasl ) {
1098                                 rs->sr_text = op->o_sasl_ssf
1099                                         ? "stronger SASL confidentiality required for update"
1100                                         : "SASL confidentiality required for update";
1101                                 return rs->sr_err;
1102                         }
1103
1104                         if( op->o_ssf < ssf->sss_update_ssf ) {
1105                                 rs->sr_text = op->o_ssf
1106                                         ? "stronger confidentiality required for update"
1107                                         : "confidentiality required for update";
1108                                 return rs->sr_err;
1109                         }
1110
1111                         if( !( global_allows & SLAP_ALLOW_UPDATE_ANON ) &&
1112                                 BER_BVISEMPTY( &op->o_ndn ) )
1113                         {
1114                                 rs->sr_text = "modifications require authentication";
1115                                 rs->sr_err = LDAP_STRONG_AUTH_REQUIRED;
1116                                 return rs->sr_err;
1117                         }
1118
1119 #ifdef SLAP_X_LISTENER_MOD
1120                         if ( op->o_conn->c_listener && ! ( op->o_conn->c_listener->sl_perms & ( !BER_BVISEMPTY( &op->o_ndn ) ? S_IWUSR : S_IWOTH ) ) ) {
1121                                 /* no "w" mode means readonly */
1122                                 rs->sr_text = "modifications not allowed on this listener";
1123                                 rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
1124                                 return rs->sr_err;
1125                         }
1126 #endif /* SLAP_X_LISTENER_MOD */
1127                 }
1128         }
1129
1130         if ( !session ) {
1131                 /* these checks don't apply to Bind, StartTLS, or Unbind */
1132
1133                 if( requires & SLAP_REQUIRE_STRONG ) {
1134                         /* should check mechanism */
1135                         if( ( op->o_transport_ssf < ssf->sss_transport
1136                                 && op->o_authtype == LDAP_AUTH_SIMPLE )
1137                                 || BER_BVISEMPTY( &op->o_dn ) )
1138                         {
1139                                 rs->sr_text = "strong(er) authentication required";
1140                                 rs->sr_err = LDAP_STRONG_AUTH_REQUIRED;
1141                                 return rs->sr_err;
1142                         }
1143                 }
1144
1145                 if( requires & SLAP_REQUIRE_SASL ) {
1146                         if( op->o_authtype != LDAP_AUTH_SASL || BER_BVISEMPTY( &op->o_dn ) ) {
1147                                 rs->sr_text = "SASL authentication required";
1148                                 rs->sr_err = LDAP_STRONG_AUTH_REQUIRED;
1149                                 return rs->sr_err;
1150                         }
1151                 }
1152
1153                 if( requires & SLAP_REQUIRE_AUTHC ) {
1154                         if( BER_BVISEMPTY( &op->o_dn ) ) {
1155                                 rs->sr_text = "authentication required";
1156                                 rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
1157                                 return rs->sr_err;
1158                         }
1159                 }
1160
1161                 if( requires & SLAP_REQUIRE_BIND ) {
1162                         int version;
1163                         ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
1164                         version = op->o_conn->c_protocol;
1165                         ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
1166
1167                         if( !version ) {
1168                                 /* no bind has occurred */
1169                                 rs->sr_text = "BIND required";
1170                                 rs->sr_err = LDAP_OPERATIONS_ERROR;
1171                                 return rs->sr_err;
1172                         }
1173                 }
1174
1175                 if( requires & SLAP_REQUIRE_LDAP_V3 ) {
1176                         if( op->o_protocol < LDAP_VERSION3 ) {
1177                                 /* no bind has occurred */
1178                                 rs->sr_text = "operation restricted to LDAPv3 clients";
1179                                 rs->sr_err = LDAP_OPERATIONS_ERROR;
1180                                 return rs->sr_err;
1181                         }
1182                 }
1183
1184 #ifdef SLAP_X_LISTENER_MOD
1185                 if ( !starttls && BER_BVISEMPTY( &op->o_dn ) ) {
1186                         if ( op->o_conn->c_listener &&
1187                                 !( op->o_conn->c_listener->sl_perms & S_IXOTH ))
1188                 {
1189                                 /* no "x" mode means bind required */
1190                                 rs->sr_text = "bind required on this listener";
1191                                 rs->sr_err = LDAP_STRONG_AUTH_REQUIRED;
1192                                 return rs->sr_err;
1193                         }
1194                 }
1195
1196                 if ( !starttls && !updateop ) {
1197                         if ( op->o_conn->c_listener &&
1198                                 !( op->o_conn->c_listener->sl_perms &
1199                                         ( !BER_BVISEMPTY( &op->o_dn ) ? S_IRUSR : S_IROTH )))
1200                         {
1201                                 /* no "r" mode means no read */
1202                                 rs->sr_text = "read not allowed on this listener";
1203                                 rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
1204                                 return rs->sr_err;
1205                         }
1206                 }
1207 #endif /* SLAP_X_LISTENER_MOD */
1208
1209         }
1210
1211         if( ( restrictops & opflag )
1212                         || ( exopflag && ( restrictops & exopflag ) ) ) {
1213                 if( ( restrictops & SLAP_RESTRICT_OP_MASK) == SLAP_RESTRICT_OP_READS ) {
1214                         rs->sr_text = "read operations restricted";
1215                 } else if ( restrictops & exopflag ) {
1216                         rs->sr_text = "extended operation restricted";
1217                 } else {
1218                         rs->sr_text = "operation restricted";
1219                 }
1220                 rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
1221                 return rs->sr_err;
1222         }
1223
1224         rs->sr_err = LDAP_SUCCESS;
1225         return rs->sr_err;
1226 }
1227
1228 int backend_check_referrals( Operation *op, SlapReply *rs )
1229 {
1230         rs->sr_err = LDAP_SUCCESS;
1231
1232         if( op->o_bd->be_chk_referrals ) {
1233                 rs->sr_err = op->o_bd->be_chk_referrals( op, rs );
1234
1235                 if( rs->sr_err != LDAP_SUCCESS && rs->sr_err != LDAP_REFERRAL ) {
1236                         send_ldap_result( op, rs );
1237                 }
1238         }
1239
1240         return rs->sr_err;
1241 }
1242
1243 int
1244 be_entry_get_rw(
1245         Operation *op,
1246         struct berval *ndn,
1247         ObjectClass *oc,
1248         AttributeDescription *at,
1249         int rw,
1250         Entry **e )
1251 {
1252         int rc;
1253
1254         *e = NULL;
1255
1256         if (op->o_bd == NULL) {
1257                 rc = LDAP_NO_SUCH_OBJECT;
1258         } else if ( op->o_bd->be_fetch ) {
1259                 rc = ( op->o_bd->be_fetch )( op, ndn,
1260                         oc, at, rw, e );
1261         } else {
1262                 rc = LDAP_UNWILLING_TO_PERFORM;
1263         }
1264         return rc;
1265 }
1266
1267 int
1268 backend_group(
1269         Operation *op,
1270         Entry   *target,
1271         struct berval *gr_ndn,
1272         struct berval *op_ndn,
1273         ObjectClass *group_oc,
1274         AttributeDescription *group_at )
1275 {
1276         Entry *e;
1277         Attribute *a;
1278         int rc;
1279         GroupAssertion *g;
1280         Backend *be = op->o_bd;
1281
1282         if ( op->o_abandon ) return SLAPD_ABANDON;
1283
1284         op->o_bd = select_backend( gr_ndn, 0, 0 );
1285
1286         for ( g = op->o_groups; g; g = g->ga_next ) {
1287                 if ( g->ga_be != op->o_bd || g->ga_oc != group_oc ||
1288                         g->ga_at != group_at || g->ga_len != gr_ndn->bv_len )
1289                 {
1290                         continue;
1291                 }
1292                 if ( strcmp( g->ga_ndn, gr_ndn->bv_val ) == 0 ) {
1293                         break;
1294                 }
1295         }
1296
1297         if ( g ) {
1298                 rc = g->ga_res;
1299                 goto done;
1300         }
1301
1302         if ( target && dn_match( &target->e_nname, gr_ndn ) ) {
1303                 e = target;
1304                 rc = 0;
1305         } else {
1306                 rc = be_entry_get_rw( op, gr_ndn, group_oc, group_at, 0, &e );
1307         }
1308         if ( e ) {
1309 #ifdef LDAP_SLAPI
1310                 if ( op->o_pb != NULL ) {
1311                         init_group_pblock( op, target, e, op_ndn, group_at );
1312
1313                         rc = call_group_preop_plugins( op );
1314                         if ( rc == LDAP_SUCCESS ) {
1315                                 goto done;
1316                         }
1317                 }
1318 #endif /* LDAP_SLAPI */
1319
1320                 a = attr_find( e->e_attrs, group_at );
1321                 if ( a ) {
1322                         /* If the attribute is a subtype of labeledURI, treat this as
1323                          * a dynamic group ala groupOfURLs
1324                          */
1325                         if (is_at_subtype( group_at->ad_type,
1326                                 slap_schema.si_ad_labeledURI->ad_type ) )
1327                         {
1328                                 int i;
1329                                 LDAPURLDesc *ludp;
1330                                 struct berval bv, nbase;
1331                                 Filter *filter;
1332                                 Entry *user;
1333                                 Backend *b2 = op->o_bd;
1334
1335                                 if ( target && dn_match( &target->e_nname, op_ndn ) ) {
1336                                         user = target;
1337                                 } else {
1338                                         op->o_bd = select_backend( op_ndn, 0, 0 );
1339                                         rc = be_entry_get_rw(op, op_ndn, NULL, NULL, 0, &user );
1340                                 }
1341
1342                                 if ( rc == 0 ) {
1343                                         rc = 1;
1344                                         for ( i = 0; !BER_BVISNULL( &a->a_vals[i] ); i++ ) {
1345                                                 if ( ldap_url_parse( a->a_vals[i].bv_val, &ludp ) !=
1346                                                         LDAP_URL_SUCCESS )
1347                                                 {
1348                                                         continue;
1349                                                 }
1350                                                 BER_BVZERO( &nbase );
1351                                                 /* host part must be empty */
1352                                                 /* attrs and extensions parts must be empty */
1353                                                 if ( ( ludp->lud_host && *ludp->lud_host ) ||
1354                                                         ludp->lud_attrs || ludp->lud_exts )
1355                                                 {
1356                                                         goto loopit;
1357                                                 }
1358                                                 ber_str2bv( ludp->lud_dn, 0, 0, &bv );
1359                                                 if ( dnNormalize( 0, NULL, NULL, &bv, &nbase,
1360                                                         op->o_tmpmemctx ) != LDAP_SUCCESS )
1361                                                 {
1362                                                         goto loopit;
1363                                                 }
1364                                                 switch ( ludp->lud_scope ) {
1365                                                 case LDAP_SCOPE_BASE:
1366                                                         if ( !dn_match( &nbase, op_ndn ) ) {
1367                                                                 goto loopit;
1368                                                         }
1369                                                         break;
1370                                                 case LDAP_SCOPE_ONELEVEL:
1371                                                         dnParent( op_ndn, &bv );
1372                                                         if ( !dn_match( &nbase, &bv ) ) {
1373                                                                 goto loopit;
1374                                                         }
1375                                                         break;
1376                                                 case LDAP_SCOPE_SUBTREE:
1377                                                         if ( !dnIsSuffix( op_ndn, &nbase ) ) {
1378                                                                 goto loopit;
1379                                                         }
1380                                                         break;
1381 #ifdef LDAP_SCOPE_SUBORDINATE
1382                                                 case LDAP_SCOPE_SUBORDINATE:
1383                                                         if ( dn_match( &nbase, op_ndn ) ||
1384                                                                 !dnIsSuffix( op_ndn, &nbase ) )
1385                                                         {
1386                                                                 goto loopit;
1387                                                         }
1388 #endif
1389                                                 }
1390                                                 filter = str2filter_x( op, ludp->lud_filter );
1391                                                 if ( filter ) {
1392                                                         if ( test_filter( NULL, user, filter ) ==
1393                                                                 LDAP_COMPARE_TRUE )
1394                                                         {
1395                                                                 rc = 0;
1396                                                         }
1397                                                         filter_free_x( op, filter );
1398                                                 }
1399 loopit:
1400                                                 ldap_free_urldesc( ludp );
1401                                                 if ( !BER_BVISNULL( &nbase ) ) {
1402                                                         op->o_tmpfree( nbase.bv_val, op->o_tmpmemctx );
1403                                                 }
1404                                                 if ( rc == 0 ) break;
1405                                         }
1406                                         if ( user != target ) {
1407                                                 be_entry_release_r( op, user );
1408                                         }
1409                                 }
1410                                 op->o_bd = b2;
1411                         } else {
1412                                 rc = value_find_ex( group_at,
1413                                 SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH |
1414                                 SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH,
1415                                 a->a_nvals, op_ndn, op->o_tmpmemctx );
1416                         }
1417                 } else {
1418                         rc = LDAP_NO_SUCH_ATTRIBUTE;
1419                 }
1420                 if (e != target ) {
1421                         be_entry_release_r( op, e );
1422                 }
1423         } else {
1424                 rc = LDAP_NO_SUCH_OBJECT;
1425         }
1426
1427 #ifdef LDAP_SLAPI
1428         if ( op->o_pb ) call_group_postop_plugins( op );
1429 #endif /* LDAP_SLAPI */
1430
1431         if ( op->o_tag != LDAP_REQ_BIND && !op->o_do_not_cache ) {
1432                 g = op->o_tmpalloc( sizeof( GroupAssertion ) + gr_ndn->bv_len,
1433                         op->o_tmpmemctx );
1434                 g->ga_be = op->o_bd;
1435                 g->ga_oc = group_oc;
1436                 g->ga_at = group_at;
1437                 g->ga_res = rc;
1438                 g->ga_len = gr_ndn->bv_len;
1439                 strcpy( g->ga_ndn, gr_ndn->bv_val );
1440                 g->ga_next = op->o_groups;
1441                 op->o_groups = g;
1442         }
1443 done:
1444         op->o_bd = be;
1445         return rc;
1446 }
1447
1448 #ifdef LDAP_SLAPI
1449 static int backend_compute_output_attr(computed_attr_context *c, Slapi_Attr *a, Slapi_Entry *e)
1450 {
1451         BerVarray v;
1452         int rc;
1453         BerVarray *vals = (BerVarray *)c->cac_private;
1454         Operation *op = NULL;
1455         int i, j;
1456
1457         slapi_pblock_get( c->cac_pb, SLAPI_OPERATION, &op );
1458         if ( op == NULL ) {
1459                 return 1;
1460         }
1461
1462         if ( op->o_conn && access_allowed( op,
1463                 e, a->a_desc, NULL, ACL_AUTH,
1464                 &c->cac_acl_state ) == 0 ) {
1465                 return 1;
1466         }
1467
1468         for ( i = 0; !BER_BVISNULL( &a->a_vals[i] ); i++ ) ;
1469
1470         v = op->o_tmpalloc( sizeof(struct berval) * (i+1),
1471                 op->o_tmpmemctx );
1472         for ( i = 0, j = 0; !BER_BVISNULL( &a->a_vals[i] ); i++ ) {
1473                 if ( op->o_conn && access_allowed( op,
1474                         e, a->a_desc,
1475                         &a->a_nvals[i],
1476                         ACL_AUTH, &c->cac_acl_state ) == 0 ) {
1477                         continue;
1478                 }
1479                 ber_dupbv_x( &v[j],
1480                         &a->a_nvals[i], op->o_tmpmemctx );
1481                 if ( !BER_BVISNULL( &v[j] ) ) {
1482                         j++;
1483                 }
1484         }
1485
1486         if ( j == 0 ) {
1487                 op->o_tmpfree( v, op->o_tmpmemctx );
1488                 *vals = NULL;
1489                 rc = 1;
1490         } else {
1491                 BER_BVZERO( &v[j] );
1492                 *vals = v;
1493                 rc = 0;
1494         }
1495
1496         return rc;
1497 }
1498 #endif /* LDAP_SLAPI */
1499
1500 int
1501 backend_attribute(
1502         Operation *op,
1503         Entry   *target,
1504         struct berval   *edn,
1505         AttributeDescription *entry_at,
1506         BerVarray *vals,
1507         slap_access_t access )
1508 {
1509         Entry                   *e = NULL;
1510         Attribute               *a = NULL;
1511         int                     freeattr = 0, i, j, rc = LDAP_SUCCESS;
1512         AccessControlState      acl_state = ACL_STATE_INIT;
1513         Backend                 *be = op->o_bd;
1514
1515         op->o_bd = select_backend( edn, 0, 0 );
1516
1517         if ( target && dn_match( &target->e_nname, edn ) ) {
1518                 e = target;
1519
1520         } else {
1521                 rc = be_entry_get_rw( op, edn, NULL, entry_at, 0, &e );
1522         }
1523
1524         if ( e ) {
1525                 a = attr_find( e->e_attrs, entry_at );
1526                 if ( a == NULL ) {
1527                         SlapReply       rs = { 0 };
1528                         AttributeName   anlist[ 2 ];
1529
1530                         anlist[ 0 ].an_name = entry_at->ad_cname;
1531                         anlist[ 0 ].an_desc = entry_at;
1532                         BER_BVZERO( &anlist[ 1 ].an_name );
1533                         rs.sr_attrs = anlist;
1534
1535                         /* NOTE: backend_operational() is also called
1536                          * when returning results, so it's supposed
1537                          * to do no harm to entries */
1538                         rs.sr_entry = e;
1539                         rc = backend_operational( op, &rs );
1540                         rs.sr_entry = NULL;
1541
1542                         if ( rc == LDAP_SUCCESS ) {
1543                                 if ( rs.sr_operational_attrs ) {
1544                                         freeattr = 1;
1545                                         a = rs.sr_operational_attrs;
1546
1547                                 } else {
1548                                         rc = LDAP_NO_SUCH_ATTRIBUTE;
1549                                 }
1550                         }
1551                 }
1552
1553                 if ( a ) {
1554                         BerVarray v;
1555
1556                         if ( op->o_conn && access > ACL_NONE && access_allowed( op,
1557                                 e, entry_at, NULL, access,
1558                                 &acl_state ) == 0 ) {
1559                                 rc = LDAP_INSUFFICIENT_ACCESS;
1560                                 goto freeit;
1561                         }
1562
1563                         for ( i = 0; !BER_BVISNULL( &a->a_vals[i] ); i++ )
1564                                 ;
1565
1566                         v = op->o_tmpalloc( sizeof(struct berval) * ( i + 1 ),
1567                                 op->o_tmpmemctx );
1568                         for ( i = 0,j = 0; !BER_BVISNULL( &a->a_vals[i] ); i++ )
1569                         {
1570                                 if ( op->o_conn && access > ACL_NONE &&
1571                                                 access_allowed( op, e,
1572                                                         entry_at,
1573                                                         &a->a_nvals[i],
1574                                                         access,
1575                                                         &acl_state ) == 0 )
1576                                 {
1577                                         continue;
1578                                 }
1579                                 ber_dupbv_x( &v[j], &a->a_nvals[i],
1580                                                 op->o_tmpmemctx );
1581                                 if ( !BER_BVISNULL( &v[j] ) ) {
1582                                         j++;
1583                                 }
1584                         }
1585                         if ( j == 0 ) {
1586                                 op->o_tmpfree( v, op->o_tmpmemctx );
1587                                 *vals = NULL;
1588                                 rc = LDAP_INSUFFICIENT_ACCESS;
1589
1590                         } else {
1591                                 BER_BVZERO( &v[j] );
1592                                 *vals = v;
1593                                 rc = LDAP_SUCCESS;
1594                         }
1595                 }
1596 #ifdef LDAP_SLAPI
1597                 else if ( op->o_pb ) {
1598                         /* try any computed attributes */
1599                         computed_attr_context   ctx;
1600
1601                         slapi_int_pblock_set_operation( op->o_pb, op );
1602
1603                         ctx.cac_pb = op->o_pb;
1604                         ctx.cac_attrs = NULL;
1605                         ctx.cac_userattrs = 0;
1606                         ctx.cac_opattrs = 0;
1607                         ctx.cac_acl_state = acl_state;
1608                         ctx.cac_private = (void *)vals;
1609
1610                         rc = compute_evaluator( &ctx, entry_at->ad_cname.bv_val, e, backend_compute_output_attr );
1611                         if ( rc == 1 ) {
1612                                 rc = LDAP_INSUFFICIENT_ACCESS;
1613
1614                         } else {
1615                                 rc = LDAP_SUCCESS;
1616                         }
1617                 }
1618 #endif /* LDAP_SLAPI */
1619 freeit:         if ( e != target ) {
1620                         be_entry_release_r( op, e );
1621                 }
1622                 if ( freeattr ) {
1623                         attr_free( a );
1624                 }
1625         }
1626
1627         op->o_bd = be;
1628         return rc;
1629 }
1630
1631 #ifdef LDAP_SLAPI
1632 static int backend_compute_output_attr_access(computed_attr_context *c, Slapi_Attr *a, Slapi_Entry *e)
1633 {
1634         struct berval   *nval = (struct berval *)c->cac_private;
1635         Operation       *op = NULL;
1636
1637         slapi_pblock_get( c->cac_pb, SLAPI_OPERATION, &op );
1638         if ( op == NULL ) {
1639                 return 1;
1640         }
1641
1642         return access_allowed( op, e, a->a_desc, nval, ACL_AUTH, NULL ) == 0;
1643 }
1644 #endif /* LDAP_SLAPI */
1645
1646 int
1647 backend_access(
1648         Operation               *op,
1649         Entry                   *target,
1650         struct berval           *edn,
1651         AttributeDescription    *entry_at,
1652         struct berval           *nval,
1653         slap_access_t           access,
1654         slap_mask_t             *mask )
1655 {
1656         Entry           *e = NULL;
1657         int             rc = LDAP_INSUFFICIENT_ACCESS;
1658         Backend         *be = op->o_bd;
1659
1660         /* pedantic */
1661         assert( op );
1662         assert( op->o_conn );
1663         assert( edn );
1664         assert( access > ACL_NONE );
1665
1666         op->o_bd = select_backend( edn, 0, 0 );
1667
1668         if ( target && dn_match( &target->e_nname, edn ) ) {
1669                 e = target;
1670
1671         } else {
1672                 rc = be_entry_get_rw( op, edn, NULL, entry_at, 0, &e );
1673         }
1674
1675         if ( e ) {
1676                 Attribute       *a = NULL;
1677                 int             freeattr = 0;
1678
1679                 if ( entry_at == NULL ) {
1680                         entry_at = slap_schema.si_ad_entry;
1681                 }
1682
1683                 if ( entry_at == slap_schema.si_ad_entry || entry_at == slap_schema.si_ad_children )
1684                 {
1685                         if ( access_allowed_mask( op, e, entry_at,
1686                                         NULL, access, NULL, mask ) == 0 )
1687                         {
1688                                 rc = LDAP_INSUFFICIENT_ACCESS;
1689
1690                         } else {
1691                                 rc = LDAP_SUCCESS;
1692                         }
1693
1694                 } else {
1695                         a = attr_find( e->e_attrs, entry_at );
1696                         if ( a == NULL ) {
1697                                 SlapReply       rs = { 0 };
1698                                 AttributeName   anlist[ 2 ];
1699
1700                                 anlist[ 0 ].an_name = entry_at->ad_cname;
1701                                 anlist[ 0 ].an_desc = entry_at;
1702                                 BER_BVZERO( &anlist[ 1 ].an_name );
1703                                 rs.sr_attrs = anlist;
1704
1705                                 rs.sr_attr_flags = slap_attr_flags( rs.sr_attrs );
1706
1707                                 /* NOTE: backend_operational() is also called
1708                                  * when returning results, so it's supposed
1709                                  * to do no harm to entries */
1710                                 rs.sr_entry = e;
1711                                 rc = backend_operational( op, &rs );
1712                                 rs.sr_entry = NULL;
1713
1714                                 if ( rc == LDAP_SUCCESS ) {
1715                                         if ( rs.sr_operational_attrs ) {
1716                                                 freeattr = 1;
1717                                                 a = rs.sr_operational_attrs;
1718
1719                                         } else {
1720                                                 rc = LDAP_NO_SUCH_OBJECT;
1721                                         }
1722                                 }
1723                         }
1724
1725                         if ( a ) {
1726                                 if ( access_allowed_mask( op, e, entry_at,
1727                                                 nval, access, NULL, mask ) == 0 )
1728                                 {
1729                                         rc = LDAP_INSUFFICIENT_ACCESS;
1730                                         goto freeit;
1731                                 }
1732                                 rc = LDAP_SUCCESS;
1733                         }
1734 #ifdef LDAP_SLAPI
1735                         else if ( op->o_pb ) {
1736                                 /* try any computed attributes */
1737                                 computed_attr_context   ctx;
1738
1739                                 slapi_int_pblock_set_operation( op->o_pb, op );
1740
1741                                 ctx.cac_pb = op->o_pb;
1742                                 ctx.cac_attrs = NULL;
1743                                 ctx.cac_userattrs = 0;
1744                                 ctx.cac_opattrs = 0;
1745                                 ctx.cac_private = (void *)nval;
1746
1747                                 rc = compute_evaluator( &ctx, entry_at->ad_cname.bv_val, e, backend_compute_output_attr_access );
1748                                 if ( rc == 1 ) {
1749                                         rc = LDAP_INSUFFICIENT_ACCESS;
1750
1751                                 } else {
1752                                         rc = LDAP_SUCCESS;
1753                                 }
1754                         }
1755 #endif /* LDAP_SLAPI */
1756                 }
1757 freeit:         if ( e != target ) {
1758                         be_entry_release_r( op, e );
1759                 }
1760                 if ( freeattr ) {
1761                         attr_free( a );
1762                 }
1763         }
1764
1765         op->o_bd = be;
1766         return rc;
1767 }
1768
1769 int backend_operational(
1770         Operation *op,
1771         SlapReply *rs )
1772 {
1773         Attribute       **ap;
1774         int             rc = 0;
1775         BackendDB       *be_orig;
1776
1777         for ( ap = &rs->sr_operational_attrs; *ap; ap = &(*ap)->a_next )
1778                 /* just count them */ ;
1779
1780         /*
1781          * If operational attributes (allegedly) are required,
1782          * and the backend supports specific operational attributes,
1783          * add them to the attribute list
1784          */
1785         if ( SLAP_OPATTRS( rs->sr_attr_flags ) || ( rs->sr_attrs &&
1786                 ad_inlist( slap_schema.si_ad_entryDN, rs->sr_attrs )))
1787         {
1788                 *ap = slap_operational_entryDN( rs->sr_entry );
1789                 ap = &(*ap)->a_next;
1790         }
1791
1792         if ( SLAP_OPATTRS( rs->sr_attr_flags ) || ( rs->sr_attrs &&
1793                 ad_inlist( slap_schema.si_ad_subschemaSubentry, rs->sr_attrs )))
1794         {
1795                 *ap = slap_operational_subschemaSubentry( op->o_bd );
1796                 ap = &(*ap)->a_next;
1797         }
1798
1799         /* Let the overlays have a chance at this */
1800         be_orig = op->o_bd;
1801         if ( SLAP_ISOVERLAY( be_orig ))
1802                 op->o_bd = select_backend( be_orig->be_nsuffix, 0, 0 );
1803
1804         if (( SLAP_OPATTRS( rs->sr_attr_flags ) || rs->sr_attrs ) &&
1805                 op->o_bd && op->o_bd->be_operational != NULL )
1806         {
1807                 Attribute       *a;
1808
1809                 a = rs->sr_operational_attrs;
1810                 rs->sr_operational_attrs = NULL;
1811                 rc = op->o_bd->be_operational( op, rs );
1812                 *ap = rs->sr_operational_attrs;
1813                 if ( a != NULL ) {
1814                         rs->sr_operational_attrs = a;
1815                 }
1816
1817                 for ( ; *ap; ap = &(*ap)->a_next )
1818                         /* just count them */ ;
1819         }
1820         op->o_bd = be_orig;
1821
1822         return rc;
1823 }
1824
1825 #ifdef LDAP_SLAPI
1826 static void init_group_pblock( Operation *op, Entry *target,
1827         Entry *e, struct berval *op_ndn, AttributeDescription *group_at )
1828 {
1829         slapi_int_pblock_set_operation( op->o_pb, op );
1830
1831         slapi_pblock_set( op->o_pb,
1832                 SLAPI_X_GROUP_ENTRY, (void *)e );
1833         slapi_pblock_set( op->o_pb,
1834                 SLAPI_X_GROUP_OPERATION_DN, (void *)op_ndn->bv_val );
1835         slapi_pblock_set( op->o_pb,
1836                 SLAPI_X_GROUP_ATTRIBUTE, (void *)group_at->ad_cname.bv_val );
1837         slapi_pblock_set( op->o_pb,
1838                 SLAPI_X_GROUP_TARGET_ENTRY, (void *)target );
1839 }
1840
1841 static int call_group_preop_plugins( Operation *op )
1842 {
1843         int rc;
1844
1845         rc = slapi_int_call_plugins( op->o_bd,
1846                 SLAPI_X_PLUGIN_PRE_GROUP_FN, op->o_pb );
1847         if ( rc < 0 ) {
1848                 if (( slapi_pblock_get( op->o_pb, SLAPI_RESULT_CODE,
1849                         (void *)&rc ) != 0 ) || rc == LDAP_SUCCESS )
1850                 {
1851                         rc = LDAP_NO_SUCH_ATTRIBUTE;
1852                 }
1853         } else {
1854                 rc = LDAP_SUCCESS;
1855         }
1856
1857         return rc;
1858 }
1859
1860 static void call_group_postop_plugins( Operation *op )
1861 {
1862         (void) slapi_int_call_plugins( op->o_bd, SLAPI_X_PLUGIN_POST_GROUP_FN, op->o_pb );
1863 }
1864 #endif /* LDAP_SLAPI */
1865