git.sur5r.net Git - openldap/blob - servers/slapd/backend.c

   1 /* $OpenLDAP$ */
   2 /*
   3  * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
   4  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   5  */
   6 /* backend.c - routines for dealing with back-end databases */
   7
   8
   9 #include "portable.h"
  10
  11 #include <stdio.h>
  12
  13 #include <ac/string.h>
  14 #include <ac/socket.h>
  15 #include <sys/stat.h>
  16
  17 #include "slap.h"
  18 #include "lutil.h"
  19 #include "lber_pvt.h"
  20
  21 #ifdef LDAP_SLAPI
  22 #include "slapi.h"
  23 #endif
  24
  25 /*
  26  * If a module is configured as dynamic, its header should not
  27  * get included into slapd. While this is a general rule and does
  28  * not have much of an effect in UNIX, this rule should be adhered
  29  * to for Windows, where dynamic object code should not be implicitly
  30  * imported into slapd without appropriate __declspec(dllimport) directives.
  31  */
  32
  33 #if defined(SLAPD_BDB) && !defined(SLAPD_BDB_DYNAMIC)
  34 #include "back-bdb/external.h"
  35 #endif
  36 #if defined(SLAPD_DNSSRV) && !defined(SLAPD_DNSSRV_DYNAMIC)
  37 #include "back-dnssrv/external.h"
  38 #endif
  39 #if defined(SLAPD_LDAP) && !defined(SLAPD_LDAP_DYNAMIC)
  40 #include "back-ldap/external.h"
  41 #endif
  42 #if defined(SLAPD_LDBM) && !defined(SLAPD_LDBM_DYNAMIC)
  43 #include "back-ldbm/external.h"
  44 #endif
  45 #if defined(SLAPD_META) && !defined(SLAPD_META_DYNAMIC)
  46 #include "back-meta/external.h"
  47 #endif
  48 #if defined(SLAPD_MONITOR) && !defined(SLAPD_MONITOR_DYNAMIC)
  49 #include "back-monitor/external.h"
  50 #endif
  51 #if defined(SLAPD_NULL) && !defined(SLAPD_NULL_DYNAMIC)
  52 #include "back-null/external.h"
  53 #endif
  54 #if defined(SLAPD_PASSWD) && !defined(SLAPD_PASSWD_DYNAMIC)
  55 #include "back-passwd/external.h"
  56 #endif
  57 #if defined(SLAPD_PERL) && !defined(SLAPD_PERL_DYNAMIC)
  58 #include "back-perl/external.h"
  59 #endif
  60 #if defined(SLAPD_SHELL) && !defined(SLAPD_SHELL_DYNAMIC)
  61 #include "back-shell/external.h"
  62 #endif
  63 #if defined(SLAPD_TCL) && !defined(SLAPD_TCL_DYNAMIC)
  64 #include "back-tcl/external.h"
  65 #endif
  66 #if defined(SLAPD_SQL) && !defined(SLAPD_SQL_DYNAMIC)
  67 #include "back-sql/external.h"
  68 #endif
  69 #if defined(SLAPD_PRIVATE) && !defined(SLAPD_PRIVATE_DYNAMIC)
  70 #include "private/external.h"
  71 #endif
  72
  73 static BackendInfo binfo[] = {
  74 #if defined(SLAPD_BDB) && !defined(SLAPD_BDB_DYNAMIC)
  75         {"bdb", bdb_initialize},
  76 #endif
  77 #if defined(SLAPD_DNSSRV) && !defined(SLAPD_DNSSRV_DYNAMIC)
  78         {"dnssrv",      dnssrv_back_initialize},
  79 #endif
  80 #if defined(SLAPD_LDAP) && !defined(SLAPD_LDAP_DYNAMIC)
  81         {"ldap",        ldap_back_initialize},
  82 #endif
  83 #if defined(SLAPD_LDBM) && !defined(SLAPD_LDBM_DYNAMIC)
  84         {"ldbm",        ldbm_back_initialize},
  85 #endif
  86 #if defined(SLAPD_META) && !defined(SLAPD_META_DYNAMIC)
  87         {"meta",        meta_back_initialize},
  88 #endif
  89 #if defined(SLAPD_MONITOR) && !defined(SLAPD_MONITOR_DYNAMIC)
  90         {"monitor",     monitor_back_initialize},
  91 #endif
  92 #if defined(SLAPD_NULL) && !defined(SLAPD_NULL_DYNAMIC)
  93         {"null",        null_back_initialize},
  94 #endif
  95 #if defined(SLAPD_PASSWD) && !defined(SLAPD_PASSWD_DYNAMIC)
  96         {"passwd",      passwd_back_initialize},
  97 #endif
  98 #if defined(SLAPD_PERL) && !defined(SLAPD_PERL_DYNAMIC)
  99         {"perl",        perl_back_initialize},
 100 #endif
 101 #if defined(SLAPD_SHELL) && !defined(SLAPD_SHELL_DYNAMIC)
 102         {"shell",       shell_back_initialize},
 103 #endif
 104 #if defined(SLAPD_TCL) && !defined(SLAPD_TCL_DYNAMIC)
 105         {"tcl",         tcl_back_initialize},
 106 #endif
 107 #if defined(SLAPD_SQL) && !defined(SLAPD_SQL_DYNAMIC)
 108         {"sql",         sql_back_initialize},
 109 #endif
 110         /* for any private backend */
 111 #if defined(SLAPD_PRIVATE) && !defined(SLAPD_PRIVATE_DYNAMIC)
 112         {"private",     private_back_initialize},
 113 #endif
 114         {NULL}
 115 };
 116
 117 int                     nBackendInfo = 0;
 118 BackendInfo     *backendInfo = NULL;
 119
 120 int                     nBackendDB = 0;
 121 BackendDB       *backendDB = NULL;
 122
 123 int backend_init(void)
 124 {
 125         int rc = -1;
 126
 127         if((nBackendInfo != 0) || (backendInfo != NULL)) {
 128                 /* already initialized */
 129 #ifdef NEW_LOGGING
 130                 LDAP_LOG( BACKEND, ERR,
 131                         "backend_init:  backend already initialized\n", 0, 0, 0 );
 132 #else
 133                 Debug( LDAP_DEBUG_ANY,
 134                         "backend_init: already initialized.\n", 0, 0, 0 );
 135 #endif
 136                 return -1;
 137         }
 138
 139         for( ;
 140                 binfo[nBackendInfo].bi_type != NULL;
 141                 nBackendInfo++ )
 142         {
 143                 rc = binfo[nBackendInfo].bi_init( &binfo[nBackendInfo] );
 144
 145                 if(rc != 0) {
 146 #ifdef NEW_LOGGING
 147                         LDAP_LOG( BACKEND, INFO,
 148                                 "backend_init:  initialized for type \"%s\"\n",
 149                                 binfo[nBackendInfo].bi_type, 0, 0 );
 150 #else
 151                         Debug( LDAP_DEBUG_ANY,
 152                                 "backend_init: initialized for type \"%s\"\n",
 153                                 binfo[nBackendInfo].bi_type, 0, 0 );
 154 #endif
 155                         /* destroy those we've already inited */
 156                         for( nBackendInfo--;
 157                                 nBackendInfo >= 0 ;
 158                                 nBackendInfo-- )
 159                         {
 160                                 if ( binfo[nBackendInfo].bi_destroy ) {
 161                                         binfo[nBackendInfo].bi_destroy(
 162                                                 &binfo[nBackendInfo] );
 163                                 }
 164                         }
 165                         return rc;
 166                 }
 167         }
 168
 169         if ( nBackendInfo > 0) {
 170                 backendInfo = binfo;
 171                 return 0;
 172         }
 173
 174 #ifdef SLAPD_MODULES
 175         return 0;
 176 #else
 177
 178 #ifdef NEW_LOGGING
 179         LDAP_LOG( BACKEND, ERR, "backend_init: failed\n", 0, 0, 0 );
 180 #else
 181         Debug( LDAP_DEBUG_ANY,
 182                 "backend_init: failed\n",
 183                 0, 0, 0 );
 184 #endif
 185
 186         return rc;
 187 #endif /* SLAPD_MODULES */
 188 }
 189
 190 int backend_add(BackendInfo *aBackendInfo)
 191 {
 192    int rc = 0;
 193
 194    if ((rc = aBackendInfo->bi_init(aBackendInfo)) != 0) {
 195 #ifdef NEW_LOGGING
 196         LDAP_LOG( BACKEND, ERR,
 197                   "backend_add:  initialization for type \"%s\" failed\n",
 198                   aBackendInfo->bi_type, 0, 0 );
 199 #else
 200       Debug( LDAP_DEBUG_ANY,
 201              "backend_add: initialization for type \"%s\" failed\n",
 202              aBackendInfo->bi_type, 0, 0 );
 203 #endif
 204       return rc;
 205    }
 206
 207    /* now add the backend type to the Backend Info List */
 208    {
 209       BackendInfo *newBackendInfo = 0;
 210
 211       /* if backendInfo == binfo no deallocation of old backendInfo */
 212       if (backendInfo == binfo) {
 213          newBackendInfo = ch_calloc(nBackendInfo + 1, sizeof(BackendInfo));
 214          AC_MEMCPY(newBackendInfo, backendInfo, sizeof(BackendInfo) *
 215                 nBackendInfo);
 216       } else {
 217          newBackendInfo = ch_realloc(backendInfo, sizeof(BackendInfo) *
 218                                      (nBackendInfo + 1));
 219       }
 220       AC_MEMCPY(&newBackendInfo[nBackendInfo], aBackendInfo,
 221              sizeof(BackendInfo));
 222       backendInfo = newBackendInfo;
 223       nBackendInfo++;
 224
 225       return 0;
 226    }
 227 }
 228
 229 int backend_startup(Backend *be)
 230 {
 231         int i;
 232         int rc = 0;
 233
 234         if( ! ( nBackendDB > 0 ) ) {
 235                 /* no databases */
 236 #ifdef NEW_LOGGING
 237                 LDAP_LOG( BACKEND, INFO,
 238                         "backend_startup: %d databases to startup. \n", nBackendDB, 0, 0 );
 239 #else
 240                 Debug( LDAP_DEBUG_ANY,
 241                         "backend_startup: %d databases to startup.\n",
 242                         nBackendDB, 0, 0 );
 243 #endif
 244                 return 1;
 245         }
 246
 247         if(be != NULL) {
 248                 /* startup a specific backend database */
 249 #ifdef NEW_LOGGING
 250                 LDAP_LOG( BACKEND, DETAIL1, "backend_startup:  starting \"%s\"\n",
 251                            be->be_suffix[0].bv_val, 0, 0 );
 252 #else
 253                 Debug( LDAP_DEBUG_TRACE,
 254                         "backend_startup: starting \"%s\"\n",
 255                         be->be_suffix[0].bv_val, 0, 0 );
 256 #endif
 257
 258                 if ( be->bd_info->bi_open ) {
 259                         rc = be->bd_info->bi_open( be->bd_info );
 260                         if ( rc != 0 ) {
 261 #ifdef NEW_LOGGING
 262                                 LDAP_LOG( BACKEND, CRIT, "backend_startup: bi_open failed!\n", 0, 0, 0 );
 263 #else
 264                                 Debug( LDAP_DEBUG_ANY,
 265                                         "backend_startup: bi_open failed!\n",
 266                                         0, 0, 0 );
 267 #endif
 268
 269                                 return rc;
 270                         }
 271                 }
 272
 273                 if ( be->bd_info->bi_db_open ) {
 274                         rc = be->bd_info->bi_db_open( be );
 275                         if ( rc != 0 ) {
 276 #ifdef NEW_LOGGING
 277                                 LDAP_LOG( BACKEND, CRIT,
 278                                         "backend_startup: bi_db_open failed! (%d)\n", rc, 0, 0 );
 279 #else
 280                                 Debug( LDAP_DEBUG_ANY,
 281                                         "backend_startup: bi_db_open failed! (%d)\n",
 282                                         rc, 0, 0 );
 283 #endif
 284                                 return rc;
 285                         }
 286                 }
 287
 288                 return rc;
 289         }
 290
 291         /* open each backend type */
 292         for( i = 0; i < nBackendInfo; i++ ) {
 293                 if( backendInfo[i].bi_nDB == 0) {
 294                         /* no database of this type, don't open */
 295                         continue;
 296                 }
 297
 298                 if( backendInfo[i].bi_open ) {
 299                         rc = backendInfo[i].bi_open(
 300                                 &backendInfo[i] );
 301                         if ( rc != 0 ) {
 302 #ifdef NEW_LOGGING
 303                                 LDAP_LOG( BACKEND, CRIT,
 304                                         "backend_startup: bi_open %d failed!\n", i, 0, 0 );
 305 #else
 306                                 Debug( LDAP_DEBUG_ANY,
 307                                         "backend_startup: bi_open %d failed!\n",
 308                                         i, 0, 0 );
 309 #endif
 310                                 return rc;
 311                         }
 312                 }
 313         }
 314
 315         /* open each backend database */
 316         for( i = 0; i < nBackendDB; i++ ) {
 317 #ifndef SLAPD_MULTIMASTER
 318                 if ( backendDB[i].be_update_ndn.bv_val && (
 319                         !backendDB[i].be_update_refs &&
 320                         !default_referral ) ) {
 321 #ifdef NEW_LOGGING
 322                         LDAP_LOG( BACKEND, CRIT,
 323                                 "backend_startup: slave \"%s\" updateref missing\n",
 324                                 backendDB[i].be_suffix[0].bv_val, 0, 0 );
 325
 326 #else
 327                         Debug( LDAP_DEBUG_ANY,
 328                                 "backend_startup: slave \"%s\" updateref missing\n",
 329                                 backendDB[i].be_suffix[0].bv_val, 0, 0 );
 330 #endif
 331                         return -1;
 332                 }
 333 #endif
 334
 335                 /* append global access controls */
 336                 acl_append( &backendDB[i].be_acl, global_acl );
 337
 338                 if ( backendDB[i].bd_info->bi_db_open ) {
 339                         rc = backendDB[i].bd_info->bi_db_open(
 340                                 &backendDB[i] );
 341                         if ( rc != 0 ) {
 342 #ifdef NEW_LOGGING
 343                                 LDAP_LOG( BACKEND, CRIT,
 344                                         "backend_startup: bi_db_open(%d) failed! (%d)\n", i, rc, 0 );
 345 #else
 346                                 Debug( LDAP_DEBUG_ANY,
 347                                         "backend_startup: bi_db_open(%d) failed! (%d)\n",
 348                                         i, rc, 0 );
 349 #endif
 350                                 return rc;
 351                         }
 352                 }
 353         }
 354
 355         return rc;
 356 }
 357
 358 int backend_num( Backend *be )
 359 {
 360         int i;
 361
 362         if( be == NULL ) return -1;
 363
 364         for( i = 0; i < nBackendDB; i++ ) {
 365                 if( be == &backendDB[i] ) return i;
 366         }
 367         return -1;
 368 }
 369
 370 int backend_shutdown( Backend *be )
 371 {
 372         int i;
 373         int rc = 0;
 374
 375         if( be != NULL ) {
 376                 /* shutdown a specific backend database */
 377
 378                 if ( be->bd_info->bi_nDB == 0 ) {
 379                         /* no database of this type, we never opened it */
 380                         return 0;
 381                 }
 382
 383                 if ( be->bd_info->bi_db_close ) {
 384                         be->bd_info->bi_db_close( be );
 385                 }
 386
 387                 if( be->bd_info->bi_close ) {
 388                         be->bd_info->bi_close( be->bd_info );
 389                 }
 390
 391                 return 0;
 392         }
 393
 394         /* close each backend database */
 395         for( i = 0; i < nBackendDB; i++ ) {
 396                 if ( backendDB[i].bd_info->bi_db_close ) {
 397                         backendDB[i].bd_info->bi_db_close(
 398                                 &backendDB[i] );
 399                 }
 400
 401                 if(rc != 0) {
 402 #ifdef NEW_LOGGING
 403                         LDAP_LOG( BACKEND, NOTICE,
 404                                 "backend_shutdown: bi_close %s failed!\n",
 405                                 backendDB[i].be_type, 0, 0 );
 406 #else
 407                         Debug( LDAP_DEBUG_ANY,
 408                                 "backend_close: bi_close %s failed!\n",
 409                                 backendDB[i].be_type, 0, 0 );
 410 #endif
 411                 }
 412         }
 413
 414         /* close each backend type */
 415         for( i = 0; i < nBackendInfo; i++ ) {
 416                 if( backendInfo[i].bi_nDB == 0 ) {
 417                         /* no database of this type */
 418                         continue;
 419                 }
 420
 421                 if( backendInfo[i].bi_close ) {
 422                         backendInfo[i].bi_close(
 423                                 &backendInfo[i] );
 424                 }
 425         }
 426
 427         return 0;
 428 }
 429
 430 int backend_destroy(void)
 431 {
 432         int i;
 433         BackendDB *bd;
 434
 435         /* destroy each backend database */
 436         for( i = 0, bd = backendDB; i < nBackendDB; i++, bd++ ) {
 437                 if ( bd->bd_info->bi_db_destroy ) {
 438                         bd->bd_info->bi_db_destroy( bd );
 439                 }
 440                 ber_bvarray_free( bd->be_suffix );
 441                 ber_bvarray_free( bd->be_nsuffix );
 442                 if ( bd->be_rootdn.bv_val ) free( bd->be_rootdn.bv_val );
 443                 if ( bd->be_rootndn.bv_val ) free( bd->be_rootndn.bv_val );
 444                 if ( bd->be_rootpw.bv_val ) free( bd->be_rootpw.bv_val );
 445                 acl_destroy( bd->be_acl, global_acl );
 446         }
 447         free( backendDB );
 448
 449         /* destroy each backend type */
 450         for( i = 0; i < nBackendInfo; i++ ) {
 451                 if( backendInfo[i].bi_destroy ) {
 452                         backendInfo[i].bi_destroy(
 453                                 &backendInfo[i] );
 454                 }
 455         }
 456
 457 #ifdef SLAPD_MODULES
 458         if (backendInfo != binfo) {
 459            free(backendInfo);
 460         }
 461 #endif /* SLAPD_MODULES */
 462
 463         nBackendInfo = 0;
 464         backendInfo = NULL;
 465
 466         return 0;
 467 }
 468
 469 BackendInfo* backend_info(const char *type)
 470 {
 471         int i;
 472
 473         /* search for the backend type */
 474         for( i = 0; i < nBackendInfo; i++ ) {
 475                 if( strcasecmp(backendInfo[i].bi_type, type) == 0 ) {
 476                         return &backendInfo[i];
 477                 }
 478         }
 479
 480         return NULL;
 481 }
 482
 483
 484 BackendDB *
 485 backend_db_init(
 486     const char  *type
 487 )
 488 {
 489         Backend *be;
 490         BackendInfo *bi = backend_info(type);
 491         int     rc = 0;
 492
 493         if( bi == NULL ) {
 494                 fprintf( stderr, "Unrecognized database type (%s)\n", type );
 495                 return NULL;
 496         }
 497
 498         backendDB = (BackendDB *) ch_realloc(
 499                         (char *) backendDB,
 500                     (nBackendDB + 1) * sizeof(Backend) );
 501
 502         memset( &backendDB[nbackends], '\0', sizeof(Backend) );
 503
 504         be = &backends[nbackends++];
 505
 506         be->bd_info = bi;
 507         be->be_def_limit = deflimit;
 508         be->be_dfltaccess = global_default_access;
 509
 510         be->be_restrictops = global_restrictops;
 511         be->be_requires = global_requires;
 512         be->be_ssf_set = global_ssf_set;
 513
 514         /* assign a default depth limit for alias deref */
 515         be->be_max_deref_depth = SLAPD_DEFAULT_MAXDEREFDEPTH;
 516
 517         if(bi->bi_db_init) {
 518                 rc = bi->bi_db_init( be );
 519         }
 520
 521         if(rc != 0) {
 522                 fprintf( stderr, "database init failed (%s)\n", type );
 523                 nbackends--;
 524                 return NULL;
 525         }
 526
 527         bi->bi_nDB++;
 528         return( be );
 529 }
 530
 531 void
 532 be_db_close( void )
 533 {
 534         int     i;
 535
 536         for ( i = 0; i < nbackends; i++ ) {
 537                 if ( backends[i].bd_info->bi_db_close ) {
 538                         (*backends[i].bd_info->bi_db_close)( &backends[i] );
 539                 }
 540         }
 541 }
 542
 543 Backend *
 544 select_backend(
 545         struct berval * dn,
 546         int manageDSAit,
 547         int noSubs )
 548 {
 549         int     i, j;
 550         ber_len_t len, dnlen = dn->bv_len;
 551         Backend *be = NULL;
 552
 553         for ( i = 0; i < nbackends; i++ ) {
 554                 for ( j = 0; backends[i].be_nsuffix != NULL &&
 555                     backends[i].be_nsuffix[j].bv_val != NULL; j++ )
 556                 {
 557                         if ( ( SLAP_GLUE_SUBORDINATE( &backends[i] ) )
 558                                 && noSubs )
 559                         {
 560                                 continue;
 561                         }
 562
 563                         len = backends[i].be_nsuffix[j].bv_len;
 564
 565                         if ( len > dnlen ) {
 566                                 /* suffix is longer than DN */
 567                                 continue;
 568                         }
 569
 570                         /*
 571                          * input DN is normalized, so the separator check
 572                          * need not look at escaping
 573                          */
 574                         if ( len && len < dnlen &&
 575                                 !DN_SEPARATOR( dn->bv_val[(dnlen-len)-1] ))
 576                         {
 577                                 continue;
 578                         }
 579
 580                         if ( strcmp( backends[i].be_nsuffix[j].bv_val,
 581                                 &dn->bv_val[dnlen-len] ) == 0 )
 582                         {
 583                                 if( be == NULL ) {
 584                                         be = &backends[i];
 585
 586                                         if( manageDSAit && len == dnlen &&
 587                                                 !SLAP_GLUE_SUBORDINATE( be ) ) {
 588                                                 continue;
 589                                         }
 590                                 } else {
 591                                         be = &backends[i];
 592                                 }
 593                                 return be;
 594                         }
 595                 }
 596         }
 597
 598         return be;
 599 }
 600
 601 int
 602 be_issuffix(
 603     Backend     *be,
 604     struct berval       *bvsuffix
 605 )
 606 {
 607         int     i;
 608
 609         for ( i = 0; be->be_nsuffix != NULL && be->be_nsuffix[i].bv_val != NULL; i++ ) {
 610                 if ( bvmatch( &be->be_nsuffix[i], bvsuffix ) ) {
 611                         return( 1 );
 612                 }
 613         }
 614
 615         return( 0 );
 616 }
 617
 618 int
 619 be_isroot( Backend *be, struct berval *ndn )
 620 {
 621         if ( !ndn->bv_len ) {
 622                 return( 0 );
 623         }
 624
 625         if ( !be->be_rootndn.bv_len ) {
 626                 return( 0 );
 627         }
 628
 629         return dn_match( &be->be_rootndn, ndn );
 630 }
 631
 632 int
 633 be_isupdate( Backend *be, struct berval *ndn )
 634 {
 635         if ( !ndn->bv_len ) {
 636                 return( 0 );
 637         }
 638
 639         if ( !be->be_update_ndn.bv_len ) {
 640                 return( 0 );
 641         }
 642
 643         return dn_match( &be->be_update_ndn, ndn );
 644 }
 645
 646 struct berval *
 647 be_root_dn( Backend *be )
 648 {
 649         return &be->be_rootdn;
 650 }
 651
 652 int
 653 be_isroot_pw( Backend *be,
 654         Connection *conn,
 655         struct berval *ndn,
 656         struct berval *cred )
 657 {
 658         int result;
 659         char *errmsg;
 660
 661         if ( ! be_isroot( be, ndn ) ) {
 662                 return 0;
 663         }
 664
 665         if( be->be_rootpw.bv_len == 0 ) {
 666                 return 0;
 667         }
 668
 669 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
 670         ldap_pvt_thread_mutex_lock( &passwd_mutex );
 671 #ifdef SLAPD_SPASSWD
 672         lutil_passwd_sasl_conn = conn->c_sasl_context;
 673 #endif
 674 #endif
 675
 676         result = lutil_passwd( &be->be_rootpw, cred, NULL, NULL );
 677
 678 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
 679 #ifdef SLAPD_SPASSWD
 680         lutil_passwd_sasl_conn = NULL;
 681 #endif
 682         ldap_pvt_thread_mutex_unlock( &passwd_mutex );
 683 #endif
 684
 685         return result == 0;
 686 }
 687
 688 int
 689 be_entry_release_rw(
 690         BackendDB *be,
 691         Connection *conn,
 692         Operation *op,
 693         Entry *e,
 694         int rw )
 695 {
 696         if ( be->be_release ) {
 697                 /* free and release entry from backend */
 698                 return be->be_release( be, conn, op, e, rw );
 699         } else {
 700                 /* free entry */
 701                 entry_free( e );
 702                 return 0;
 703         }
 704 }
 705
 706 int
 707 backend_unbind(
 708         Connection   *conn,
 709         Operation    *op
 710 )
 711 {
 712         int             i;
 713 #if defined( LDAP_SLAPI )
 714         Slapi_PBlock *pb = op->o_pb;
 715
 716         int     rc;
 717         slapi_x_connection_set_pb( pb, conn );
 718         slapi_x_operation_set_pb( pb, op );
 719 #endif /* defined( LDAP_SLAPI ) */
 720
 721         for ( i = 0; i < nbackends; i++ ) {
 722 #if defined( LDAP_SLAPI )
 723                 slapi_pblock_set( pb, SLAPI_BACKEND, (void *)&backends[i] );
 724                 rc = doPluginFNs( &backends[i], SLAPI_PLUGIN_PRE_UNBIND_FN,
 725                                 (Slapi_PBlock *)pb );
 726                 if ( rc != 0 ) {
 727                         /*
 728                          * A preoperation plugin failure will abort the
 729                          * entire operation.
 730                          */
 731 #ifdef NEW_LOGGING
 732                         LDAP_LOG( OPERATION, INFO, "do_bind: Unbind preoperation plugin "
 733                                         "failed\n", 0, 0, 0);
 734 #else
 735                         Debug(LDAP_DEBUG_TRACE, "do_bind: Unbind preoperation plugin "
 736                                         "failed.\n", 0, 0, 0);
 737 #endif
 738                         return 0;
 739                 }
 740 #endif /* defined( LDAP_SLAPI ) */
 741
 742                 if ( backends[i].be_unbind ) {
 743                         (*backends[i].be_unbind)( &backends[i], conn, op );
 744                 }
 745
 746 #if defined( LDAP_SLAPI )
 747                 if ( doPluginFNs( &backends[i], SLAPI_PLUGIN_POST_UNBIND_FN,
 748                                 (Slapi_PBlock *)pb ) != 0 ) {
 749 #ifdef NEW_LOGGING
 750                         LDAP_LOG( OPERATION, INFO, "do_unbind: Unbind postoperation plugins "
 751                                         "failed\n", 0, 0, 0);
 752 #else
 753                         Debug(LDAP_DEBUG_TRACE, "do_unbind: Unbind postoperation plugins "
 754                                         "failed.\n", 0, 0, 0);
 755 #endif
 756                 }
 757 #endif /* defined( LDAP_SLAPI ) */
 758         }
 759
 760         return 0;
 761 }
 762
 763 int
 764 backend_connection_init(
 765         Connection   *conn
 766 )
 767 {
 768         int     i;
 769
 770         for ( i = 0; i < nbackends; i++ ) {
 771                 if ( backends[i].be_connection_init ) {
 772                         (*backends[i].be_connection_init)( &backends[i], conn);
 773                 }
 774         }
 775
 776         return 0;
 777 }
 778
 779 int
 780 backend_connection_destroy(
 781         Connection   *conn
 782 )
 783 {
 784         int     i;
 785
 786         for ( i = 0; i < nbackends; i++ ) {
 787                 if ( backends[i].be_connection_destroy ) {
 788                         (*backends[i].be_connection_destroy)( &backends[i], conn);
 789                 }
 790         }
 791
 792         return 0;
 793 }
 794
 795 static int
 796 backend_check_controls(
 797         Backend *be,
 798         Connection *conn,
 799         Operation *op,
 800         const char **text )
 801 {
 802         LDAPControl **ctrls = op->o_ctrls;
 803
 804         if( ctrls == NULL ) return LDAP_SUCCESS;
 805
 806         for( ; *ctrls != NULL ; ctrls++ ) {
 807                 if( (*ctrls)->ldctl_iscritical &&
 808                         !ldap_charray_inlist( be->be_controls, (*ctrls)->ldctl_oid ) )
 809                 {
 810                         *text = "control unavailable in context";
 811                         return LDAP_UNAVAILABLE_CRITICAL_EXTENSION;
 812                 }
 813         }
 814
 815         return LDAP_SUCCESS;
 816 }
 817
 818 int
 819 backend_check_restrictions(
 820         Backend *be,
 821         Connection *conn,
 822         Operation *op,
 823         struct berval *opdata,
 824         const char **text )
 825 {
 826         int rc;
 827         slap_mask_t restrictops;
 828         slap_mask_t requires;
 829         slap_mask_t opflag;
 830         slap_ssf_set_t *ssf;
 831         int updateop = 0;
 832         int starttls = 0;
 833         int session = 0;
 834
 835         if( be ) {
 836                 rc = backend_check_controls( be, conn, op, text );
 837
 838                 if( rc != LDAP_SUCCESS ) {
 839                         return rc;
 840                 }
 841
 842                 restrictops = be->be_restrictops;
 843                 requires = be->be_requires;
 844                 ssf = &be->be_ssf_set;
 845
 846         } else {
 847                 restrictops = global_restrictops;
 848                 requires = global_requires;
 849                 ssf = &global_ssf_set;
 850         }
 851
 852         switch( op->o_tag ) {
 853         case LDAP_REQ_ADD:
 854                 opflag = SLAP_RESTRICT_OP_ADD;
 855                 updateop++;
 856                 break;
 857         case LDAP_REQ_BIND:
 858                 opflag = SLAP_RESTRICT_OP_BIND;
 859                 session++;
 860                 break;
 861         case LDAP_REQ_COMPARE:
 862                 opflag = SLAP_RESTRICT_OP_COMPARE;
 863                 break;
 864         case LDAP_REQ_DELETE:
 865                 updateop++;
 866                 opflag = SLAP_RESTRICT_OP_DELETE;
 867                 break;
 868         case LDAP_REQ_EXTENDED:
 869                 opflag = SLAP_RESTRICT_OP_EXTENDED;
 870
 871                 if( !opdata ) {
 872                         /* treat unspecified as a modify */
 873                         opflag = SLAP_RESTRICT_OP_MODIFY;
 874                         updateop++;
 875                         break;
 876                 }
 877
 878                 {
 879                         struct berval bv = BER_BVC( LDAP_EXOP_START_TLS );
 880                         if( bvmatch( opdata, &bv ) ) {
 881                                 session++;
 882                                 starttls++;
 883                                 break;
 884                         }
 885                 }
 886
 887                 {
 888                         struct berval bv = BER_BVC( LDAP_EXOP_X_WHO_AM_I );
 889                         if( bvmatch( opdata, &bv ) ) {
 890                                 break;
 891                         }
 892                 }
 893
 894 #ifdef LDAP_EXOP_X_CANCEL
 895                 {
 896                         struct berval bv = BER_BVC( LDAP_EXOP_X_CANCEL );
 897                         if ( bvmatch( opdata, &bv ) ) {
 898                                 break;
 899                         }
 900                 }
 901 #endif
 902
 903                 /* treat everything else as a modify */
 904                 opflag = SLAP_RESTRICT_OP_MODIFY;
 905                 updateop++;
 906                 break;
 907
 908         case LDAP_REQ_MODIFY:
 909                 updateop++;
 910                 opflag = SLAP_RESTRICT_OP_MODIFY;
 911                 break;
 912         case LDAP_REQ_RENAME:
 913                 updateop++;
 914                 opflag = SLAP_RESTRICT_OP_RENAME;
 915                 break;
 916         case LDAP_REQ_SEARCH:
 917                 opflag = SLAP_RESTRICT_OP_SEARCH;
 918                 break;
 919         case LDAP_REQ_UNBIND:
 920                 session++;
 921                 opflag = 0;
 922                 break;
 923         default:
 924                 *text = "restrict operations internal error";
 925                 return LDAP_OTHER;
 926         }
 927
 928         if ( !starttls ) {
 929                 /* these checks don't apply to StartTLS */
 930
 931                 if( op->o_transport_ssf < ssf->sss_transport ) {
 932                         *text = "transport confidentiality required";
 933                         return LDAP_CONFIDENTIALITY_REQUIRED;
 934                 }
 935
 936                 if( op->o_tls_ssf < ssf->sss_tls ) {
 937                         *text = "TLS confidentiality required";
 938                         return LDAP_CONFIDENTIALITY_REQUIRED;
 939                 }
 940
 941
 942                 if( op->o_tag == LDAP_REQ_BIND && opdata == NULL ) {
 943                         /* simple bind specific check */
 944                         if( op->o_ssf < ssf->sss_simple_bind ) {
 945                                 *text = "confidentiality required";
 946                                 return LDAP_CONFIDENTIALITY_REQUIRED;
 947                         }
 948                 }
 949
 950                 if( op->o_tag != LDAP_REQ_BIND || opdata == NULL ) {
 951                         /* these checks don't apply to SASL bind */
 952
 953                         if( op->o_sasl_ssf < ssf->sss_sasl ) {
 954                                 *text = "SASL confidentiality required";
 955                                 return LDAP_CONFIDENTIALITY_REQUIRED;
 956                         }
 957
 958                         if( op->o_ssf < ssf->sss_ssf ) {
 959                                 *text = "confidentiality required";
 960                                 return LDAP_CONFIDENTIALITY_REQUIRED;
 961                         }
 962                 }
 963
 964                 if( updateop ) {
 965                         if( op->o_transport_ssf < ssf->sss_update_transport ) {
 966                                 *text = "transport update confidentiality required";
 967                                 return LDAP_CONFIDENTIALITY_REQUIRED;
 968                         }
 969
 970                         if( op->o_tls_ssf < ssf->sss_update_tls ) {
 971                                 *text = "TLS update confidentiality required";
 972                                 return LDAP_CONFIDENTIALITY_REQUIRED;
 973                         }
 974
 975                         if( op->o_sasl_ssf < ssf->sss_update_sasl ) {
 976                                 *text = "SASL update confidentiality required";
 977                                 return LDAP_CONFIDENTIALITY_REQUIRED;
 978                         }
 979
 980                         if( op->o_ssf < ssf->sss_update_ssf ) {
 981                                 *text = "update confidentiality required";
 982                                 return LDAP_CONFIDENTIALITY_REQUIRED;
 983                         }
 984
 985                         if( !( global_allows & SLAP_ALLOW_UPDATE_ANON ) &&
 986                                 op->o_ndn.bv_len == 0 )
 987                         {
 988                                 *text = "modifications require authentication";
 989                                 return LDAP_STRONG_AUTH_REQUIRED;
 990                         }
 991
 992 #ifdef SLAP_X_LISTENER_MOD
 993                         if ( ! ( conn->c_listener->sl_perms & S_IWUSR ) ) {
 994                                 /* no "w" mode means readonly */
 995                                 *text = "modifications not allowed on this listener";
 996                                 return LDAP_UNWILLING_TO_PERFORM;
 997                         }
 998 #endif /* SLAP_X_LISTENER_MOD */
 999                 }
1000         }
1001
1002         if ( !session ) {
1003                 /* these checks don't apply to Bind, StartTLS, or Unbind */
1004
1005                 if( requires & SLAP_REQUIRE_STRONG ) {
1006                         /* should check mechanism */
1007                         if( ( op->o_transport_ssf < ssf->sss_transport
1008                                 && op->o_authmech.bv_len == 0 ) || op->o_dn.bv_len == 0 )
1009                         {
1010                                 *text = "strong authentication required";
1011                                 return LDAP_STRONG_AUTH_REQUIRED;
1012                         }
1013                 }
1014
1015                 if( requires & SLAP_REQUIRE_SASL ) {
1016                         if( op->o_authmech.bv_len == 0 || op->o_dn.bv_len == 0 ) {
1017                                 *text = "SASL authentication required";
1018                                 return LDAP_STRONG_AUTH_REQUIRED;
1019                         }
1020                 }
1021
1022                 if( requires & SLAP_REQUIRE_AUTHC ) {
1023                         if( op->o_dn.bv_len == 0 ) {
1024                                 *text = "authentication required";
1025                                 return LDAP_UNWILLING_TO_PERFORM;
1026                         }
1027                 }
1028
1029                 if( requires & SLAP_REQUIRE_BIND ) {
1030                         int version;
1031                         ldap_pvt_thread_mutex_lock( &conn->c_mutex );
1032                         version = conn->c_protocol;
1033                         ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
1034
1035                         if( !version ) {
1036                                 /* no bind has occurred */
1037                                 *text = "BIND required";
1038                                 return LDAP_OPERATIONS_ERROR;
1039                         }
1040                 }
1041
1042                 if( requires & SLAP_REQUIRE_LDAP_V3 ) {
1043                         if( op->o_protocol < LDAP_VERSION3 ) {
1044                                 /* no bind has occurred */
1045                                 *text = "operation restricted to LDAPv3 clients";
1046                                 return LDAP_OPERATIONS_ERROR;
1047                         }
1048                 }
1049
1050 #ifdef SLAP_X_LISTENER_MOD
1051                 if ( !starttls && op->o_dn.bv_len == 0 ) {
1052                         if ( ! ( conn->c_listener->sl_perms & S_IXUSR ) ) {
1053                                 /* no "x" mode means bind required */
1054                                 *text = "bind required on this listener";
1055                                 return LDAP_STRONG_AUTH_REQUIRED;
1056                         }
1057                 }
1058
1059                 if ( !starttls && !updateop ) {
1060                         if ( ! ( conn->c_listener->sl_perms & S_IRUSR ) ) {
1061                                 /* no "r" mode means no read */
1062                                 *text = "read not allowed on this listener";
1063                                 return LDAP_UNWILLING_TO_PERFORM;
1064                         }
1065                 }
1066 #endif /* SLAP_X_LISTENER_MOD */
1067
1068         }
1069
1070         if( restrictops & opflag ) {
1071                 if( restrictops == SLAP_RESTRICT_OP_READS ) {
1072                         *text = "read operations restricted";
1073                 } else {
1074                         *text = "operation restricted";
1075                 }
1076                 return LDAP_UNWILLING_TO_PERFORM;
1077         }
1078
1079         return LDAP_SUCCESS;
1080 }
1081
1082 int backend_check_referrals(
1083         Backend *be,
1084         Connection *conn,
1085         Operation *op,
1086         struct berval *dn,
1087         struct berval *ndn )
1088 {
1089         int rc = LDAP_SUCCESS;
1090
1091         if( be->be_chk_referrals ) {
1092                 const char *text;
1093
1094                 rc = be->be_chk_referrals( be,
1095                         conn, op, dn, ndn, &text );
1096
1097                 if( rc != LDAP_SUCCESS && rc != LDAP_REFERRAL ) {
1098                         send_ldap_result( conn, op, rc,
1099                                 NULL, text, NULL, NULL );
1100                 }
1101         }
1102
1103         return rc;
1104 }
1105
1106 int
1107 backend_group(
1108         Backend *be,
1109         Connection *conn,
1110         Operation *op,
1111         Entry   *target,
1112         struct berval *gr_ndn,
1113         struct berval *op_ndn,
1114         ObjectClass *group_oc,
1115         AttributeDescription *group_at
1116 )
1117 {
1118         GroupAssertion *g;
1119
1120         if ( op->o_abandon ) return SLAPD_ABANDON;
1121
1122         if ( !dn_match( &target->e_nname, gr_ndn ) ) {
1123                 /* we won't attempt to send it to a different backend */
1124
1125                 be = select_backend( gr_ndn, 0, 0 );
1126
1127                 if (be == NULL) {
1128                         return LDAP_NO_SUCH_OBJECT;
1129                 }
1130         }
1131
1132         ldap_pvt_thread_mutex_lock( &conn->c_mutex );
1133
1134         for (g = conn->c_groups; g; g=g->ga_next) {
1135                 if (g->ga_be != be || g->ga_oc != group_oc ||
1136                         g->ga_at != group_at || g->ga_len != gr_ndn->bv_len)
1137                         continue;
1138                 if (strcmp( g->ga_ndn, gr_ndn->bv_val ) == 0)
1139                         break;
1140         }
1141
1142         ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
1143
1144         if (g) {
1145                 return g->ga_res;
1146         }
1147
1148         if( be->be_group ) {
1149                 int res = be->be_group( be, conn, op,
1150                         target, gr_ndn, op_ndn,
1151                         group_oc, group_at );
1152
1153                 if ( op->o_tag != LDAP_REQ_BIND && !op->o_do_not_cache ) {
1154                         g = ch_malloc(sizeof(GroupAssertion) + gr_ndn->bv_len);
1155                         g->ga_be = be;
1156                         g->ga_oc = group_oc;
1157                         g->ga_at = group_at;
1158                         g->ga_res = res;
1159                         g->ga_len = gr_ndn->bv_len;
1160                         strcpy(g->ga_ndn, gr_ndn->bv_val);
1161                         ldap_pvt_thread_mutex_lock( &conn->c_mutex );
1162                         g->ga_next = conn->c_groups;
1163                         conn->c_groups = g;
1164                         ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
1165                 }
1166
1167                 return res;
1168         }
1169
1170         return LDAP_UNWILLING_TO_PERFORM;
1171 }
1172
1173 int
1174 backend_attribute(
1175         Backend *be,
1176         Connection *conn,
1177         Operation *op,
1178         Entry   *target,
1179         struct berval   *edn,
1180         AttributeDescription *entry_at,
1181         BerVarray *vals
1182 )
1183 {
1184         if ( target == NULL || !dn_match( &target->e_nname, edn ) ) {
1185                 /* we won't attempt to send it to a different backend */
1186
1187                 be = select_backend( edn, 0, 0 );
1188
1189                 if (be == NULL) {
1190                         return LDAP_NO_SUCH_OBJECT;
1191                 }
1192         }
1193
1194         if( be->be_attribute ) {
1195                 return be->be_attribute( be, conn, op, target, edn,
1196                         entry_at, vals );
1197         }
1198
1199         return LDAP_UNWILLING_TO_PERFORM;
1200 }
1201
1202 Attribute *backend_operational(
1203         Backend *be,
1204         Connection *conn,
1205         Operation *op,
1206         Entry *e,
1207         AttributeName *attrs,
1208         int opattrs     )
1209 {
1210         Attribute *a = NULL, **ap = &a;
1211
1212         /*
1213          * If operational attributes (allegedly) are required,
1214          * and the backend supports specific operational attributes,
1215          * add them to the attribute list
1216          */
1217         if ( opattrs || ( attrs &&
1218                 ad_inlist( slap_schema.si_ad_subschemaSubentry, attrs )) ) {
1219                 *ap = slap_operational_subschemaSubentry( be );
1220                 ap = &(*ap)->a_next;
1221         }
1222
1223         if ( ( opattrs || attrs ) && be && be->be_operational != NULL ) {
1224                 ( void )be->be_operational( be, conn, op, e, attrs, opattrs, ap );
1225         }
1226
1227         return a;
1228 }
1229