git.sur5r.net Git - openldap/blob - servers/slapd/backend.c

   1 /* $OpenLDAP$ */
   2 /*
   3  * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
   4  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   5  */
   6 /* backend.c - routines for dealing with back-end databases */
   7
   8
   9 #include "portable.h"
  10
  11 #include <stdio.h>
  12 #include <ac/string.h>
  13 #include <ac/socket.h>
  14 #include <sys/stat.h>
  15
  16 #include "slap.h"
  17 #include "slapi.h"
  18 #include "lutil.h"
  19 #include "lber_pvt.h"
  20
  21 /*
  22  * If a module is configured as dynamic, its header should not
  23  * get included into slapd. While this is a general rule and does
  24  * not have much of an effect in UNIX, this rule should be adhered
  25  * to for Windows, where dynamic object code should not be implicitly
  26  * imported into slapd without appropriate __declspec(dllimport) directives.
  27  */
  28
  29 #if defined(SLAPD_BDB) && !defined(SLAPD_BDB_DYNAMIC)
  30 #include "back-bdb/external.h"
  31 #endif
  32 #if defined(SLAPD_DNSSRV) && !defined(SLAPD_DNSSRV_DYNAMIC)
  33 #include "back-dnssrv/external.h"
  34 #endif
  35 #if defined(SLAPD_LDAP) && !defined(SLAPD_LDAP_DYNAMIC)
  36 #include "back-ldap/external.h"
  37 #endif
  38 #if defined(SLAPD_LDBM) && !defined(SLAPD_LDBM_DYNAMIC)
  39 #include "back-ldbm/external.h"
  40 #endif
  41 #if defined(SLAPD_META) && !defined(SLAPD_META_DYNAMIC)
  42 #include "back-meta/external.h"
  43 #endif
  44 #if defined(SLAPD_MONITOR) && !defined(SLAPD_MONITOR_DYNAMIC)
  45 #include "back-monitor/external.h"
  46 #endif
  47 #if defined(SLAPD_NULL) && !defined(SLAPD_NULL_DYNAMIC)
  48 #include "back-null/external.h"
  49 #endif
  50 #if defined(SLAPD_PASSWD) && !defined(SLAPD_PASSWD_DYNAMIC)
  51 #include "back-passwd/external.h"
  52 #endif
  53 #if defined(SLAPD_PERL) && !defined(SLAPD_PERL_DYNAMIC)
  54 #include "back-perl/external.h"
  55 #endif
  56 #if defined(SLAPD_SHELL) && !defined(SLAPD_SHELL_DYNAMIC)
  57 #include "back-shell/external.h"
  58 #endif
  59 #if defined(SLAPD_TCL) && !defined(SLAPD_TCL_DYNAMIC)
  60 #include "back-tcl/external.h"
  61 #endif
  62 #if defined(SLAPD_SQL) && !defined(SLAPD_SQL_DYNAMIC)
  63 #include "back-sql/external.h"
  64 #endif
  65 #if defined(SLAPD_PRIVATE) && !defined(SLAPD_PRIVATE_DYNAMIC)
  66 #include "private/external.h"
  67 #endif
  68
  69 static BackendInfo binfo[] = {
  70 #if defined(SLAPD_BDB) && !defined(SLAPD_BDB_DYNAMIC)
  71         {"bdb", bdb_initialize},
  72 #endif
  73 #if defined(SLAPD_DNSSRV) && !defined(SLAPD_DNSSRV_DYNAMIC)
  74         {"dnssrv",      dnssrv_back_initialize},
  75 #endif
  76 #if defined(SLAPD_LDAP) && !defined(SLAPD_LDAP_DYNAMIC)
  77         {"ldap",        ldap_back_initialize},
  78 #endif
  79 #if defined(SLAPD_LDBM) && !defined(SLAPD_LDBM_DYNAMIC)
  80         {"ldbm",        ldbm_back_initialize},
  81 #endif
  82 #if defined(SLAPD_META) && !defined(SLAPD_META_DYNAMIC)
  83         {"meta",        meta_back_initialize},
  84 #endif
  85 #if defined(SLAPD_MONITOR) && !defined(SLAPD_MONITOR_DYNAMIC)
  86         {"monitor",     monitor_back_initialize},
  87 #endif
  88 #if defined(SLAPD_NULL) && !defined(SLAPD_NULL_DYNAMIC)
  89         {"null",        null_back_initialize},
  90 #endif
  91 #if defined(SLAPD_PASSWD) && !defined(SLAPD_PASSWD_DYNAMIC)
  92         {"passwd",      passwd_back_initialize},
  93 #endif
  94 #if defined(SLAPD_PERL) && !defined(SLAPD_PERL_DYNAMIC)
  95         {"perl",        perl_back_initialize},
  96 #endif
  97 #if defined(SLAPD_SHELL) && !defined(SLAPD_SHELL_DYNAMIC)
  98         {"shell",       shell_back_initialize},
  99 #endif
 100 #if defined(SLAPD_TCL) && !defined(SLAPD_TCL_DYNAMIC)
 101         {"tcl",         tcl_back_initialize},
 102 #endif
 103 #if defined(SLAPD_SQL) && !defined(SLAPD_SQL_DYNAMIC)
 104         {"sql",         sql_back_initialize},
 105 #endif
 106         /* for any private backend */
 107 #if defined(SLAPD_PRIVATE) && !defined(SLAPD_PRIVATE_DYNAMIC)
 108         {"private",     private_back_initialize},
 109 #endif
 110         {NULL}
 111 };
 112
 113 int                     nBackendInfo = 0;
 114 BackendInfo     *backendInfo = NULL;
 115
 116 int                     nBackendDB = 0;
 117 BackendDB       *backendDB = NULL;
 118
 119 int backend_init(void)
 120 {
 121         int rc = -1;
 122
 123         if((nBackendInfo != 0) || (backendInfo != NULL)) {
 124                 /* already initialized */
 125 #ifdef NEW_LOGGING
 126                 LDAP_LOG( BACKEND, ERR,
 127                         "backend_init:  backend already initialized\n", 0, 0, 0 );
 128 #else
 129                 Debug( LDAP_DEBUG_ANY,
 130                         "backend_init: already initialized.\n", 0, 0, 0 );
 131 #endif
 132                 return -1;
 133         }
 134
 135         for( ;
 136                 binfo[nBackendInfo].bi_type != NULL;
 137                 nBackendInfo++ )
 138         {
 139                 rc = binfo[nBackendInfo].bi_init( &binfo[nBackendInfo] );
 140
 141                 if(rc != 0) {
 142 #ifdef NEW_LOGGING
 143                         LDAP_LOG( BACKEND, INFO,
 144                                 "backend_init:  initialized for type \"%s\"\n",
 145                                 binfo[nBackendInfo].bi_type, 0, 0 );
 146 #else
 147                         Debug( LDAP_DEBUG_ANY,
 148                                 "backend_init: initialized for type \"%s\"\n",
 149                                 binfo[nBackendInfo].bi_type, 0, 0 );
 150 #endif
 151                         /* destroy those we've already inited */
 152                         for( nBackendInfo--;
 153                                 nBackendInfo >= 0 ;
 154                                 nBackendInfo-- )
 155                         {
 156                                 if ( binfo[nBackendInfo].bi_destroy ) {
 157                                         binfo[nBackendInfo].bi_destroy(
 158                                                 &binfo[nBackendInfo] );
 159                                 }
 160                         }
 161                         return rc;
 162                 }
 163         }
 164
 165         if ( nBackendInfo > 0) {
 166                 backendInfo = binfo;
 167                 return 0;
 168         }
 169
 170 #ifdef SLAPD_MODULES
 171         return 0;
 172 #else
 173
 174 #ifdef NEW_LOGGING
 175         LDAP_LOG( BACKEND, ERR, "backend_init: failed\n", 0, 0, 0 );
 176 #else
 177         Debug( LDAP_DEBUG_ANY,
 178                 "backend_init: failed\n",
 179                 0, 0, 0 );
 180 #endif
 181
 182         return rc;
 183 #endif /* SLAPD_MODULES */
 184 }
 185
 186 int backend_add(BackendInfo *aBackendInfo)
 187 {
 188    int rc = 0;
 189
 190    if ((rc = aBackendInfo->bi_init(aBackendInfo)) != 0) {
 191 #ifdef NEW_LOGGING
 192         LDAP_LOG( BACKEND, ERR,
 193                   "backend_add:  initialization for type \"%s\" failed\n",
 194                   aBackendInfo->bi_type, 0, 0 );
 195 #else
 196       Debug( LDAP_DEBUG_ANY,
 197              "backend_add: initialization for type \"%s\" failed\n",
 198              aBackendInfo->bi_type, 0, 0 );
 199 #endif
 200       return rc;
 201    }
 202
 203    /* now add the backend type to the Backend Info List */
 204    {
 205       BackendInfo *newBackendInfo = 0;
 206
 207       /* if backendInfo == binfo no deallocation of old backendInfo */
 208       if (backendInfo == binfo) {
 209          newBackendInfo = ch_calloc(nBackendInfo + 1, sizeof(BackendInfo));
 210          AC_MEMCPY(newBackendInfo, backendInfo, sizeof(BackendInfo) *
 211                 nBackendInfo);
 212       } else {
 213          newBackendInfo = ch_realloc(backendInfo, sizeof(BackendInfo) *
 214                                      (nBackendInfo + 1));
 215       }
 216       AC_MEMCPY(&newBackendInfo[nBackendInfo], aBackendInfo,
 217              sizeof(BackendInfo));
 218       backendInfo = newBackendInfo;
 219       nBackendInfo++;
 220
 221       return 0;
 222    }
 223 }
 224
 225 int backend_startup(Backend *be)
 226 {
 227         int i;
 228         int rc = 0;
 229
 230         if( ! ( nBackendDB > 0 ) ) {
 231                 /* no databases */
 232 #ifdef NEW_LOGGING
 233                 LDAP_LOG( BACKEND, INFO,
 234                         "backend_startup: %d databases to startup. \n", nBackendDB, 0, 0 );
 235 #else
 236                 Debug( LDAP_DEBUG_ANY,
 237                         "backend_startup: %d databases to startup.\n",
 238                         nBackendDB, 0, 0 );
 239 #endif
 240                 return 1;
 241         }
 242
 243         if(be != NULL) {
 244                 /* startup a specific backend database */
 245 #ifdef NEW_LOGGING
 246                 LDAP_LOG( BACKEND, DETAIL1, "backend_startup:  starting \"%s\"\n",
 247                            be->be_suffix[0].bv_val, 0, 0 );
 248 #else
 249                 Debug( LDAP_DEBUG_TRACE,
 250                         "backend_startup: starting \"%s\"\n",
 251                         be->be_suffix[0].bv_val, 0, 0 );
 252 #endif
 253
 254                 if ( be->bd_info->bi_open ) {
 255                         rc = be->bd_info->bi_open( be->bd_info );
 256                         if ( rc != 0 ) {
 257 #ifdef NEW_LOGGING
 258                                 LDAP_LOG( BACKEND, CRIT, "backend_startup: bi_open failed!\n", 0, 0, 0 );
 259 #else
 260                                 Debug( LDAP_DEBUG_ANY,
 261                                         "backend_startup: bi_open failed!\n",
 262                                         0, 0, 0 );
 263 #endif
 264
 265                                 return rc;
 266                         }
 267                 }
 268
 269                 if ( be->bd_info->bi_db_open ) {
 270                         rc = be->bd_info->bi_db_open( be );
 271                         if ( rc != 0 ) {
 272 #ifdef NEW_LOGGING
 273                                 LDAP_LOG( BACKEND, CRIT,
 274                                         "backend_startup: bi_db_open failed! (%d)\n", rc, 0, 0 );
 275 #else
 276                                 Debug( LDAP_DEBUG_ANY,
 277                                         "backend_startup: bi_db_open failed! (%d)\n",
 278                                         rc, 0, 0 );
 279 #endif
 280                                 return rc;
 281                         }
 282                 }
 283
 284                 return rc;
 285         }
 286
 287         /* open each backend type */
 288         for( i = 0; i < nBackendInfo; i++ ) {
 289                 if( backendInfo[i].bi_nDB == 0) {
 290                         /* no database of this type, don't open */
 291                         continue;
 292                 }
 293
 294                 if( backendInfo[i].bi_open ) {
 295                         rc = backendInfo[i].bi_open(
 296                                 &backendInfo[i] );
 297                         if ( rc != 0 ) {
 298 #ifdef NEW_LOGGING
 299                                 LDAP_LOG( BACKEND, CRIT,
 300                                         "backend_startup: bi_open %d failed!\n", i, 0, 0 );
 301 #else
 302                                 Debug( LDAP_DEBUG_ANY,
 303                                         "backend_startup: bi_open %d failed!\n",
 304                                         i, 0, 0 );
 305 #endif
 306                                 return rc;
 307                         }
 308                 }
 309         }
 310
 311         /* open each backend database */
 312         for( i = 0; i < nBackendDB; i++ ) {
 313                 /* append global access controls */
 314                 acl_append( &backendDB[i].be_acl, global_acl );
 315
 316                 if ( backendDB[i].bd_info->bi_db_open ) {
 317                         rc = backendDB[i].bd_info->bi_db_open(
 318                                 &backendDB[i] );
 319                         if ( rc != 0 ) {
 320 #ifdef NEW_LOGGING
 321                                 LDAP_LOG( BACKEND, CRIT,
 322                                         "backend_startup: bi_db_open(%d) failed! (%d)\n", i, rc, 0 );
 323 #else
 324                                 Debug( LDAP_DEBUG_ANY,
 325                                         "backend_startup: bi_db_open(%d) failed! (%d)\n",
 326                                         i, rc, 0 );
 327 #endif
 328                                 return rc;
 329                         }
 330                 }
 331         }
 332
 333         return rc;
 334 }
 335
 336 int backend_num( Backend *be )
 337 {
 338         int i;
 339
 340         if( be == NULL ) return -1;
 341
 342         for( i = 0; i < nBackendDB; i++ ) {
 343                 if( be == &backendDB[i] ) return i;
 344         }
 345         return -1;
 346 }
 347
 348 int backend_shutdown( Backend *be )
 349 {
 350         int i;
 351         int rc = 0;
 352
 353         if( be != NULL ) {
 354                 /* shutdown a specific backend database */
 355
 356                 if ( be->bd_info->bi_nDB == 0 ) {
 357                         /* no database of this type, we never opened it */
 358                         return 0;
 359                 }
 360
 361                 if ( be->bd_info->bi_db_close ) {
 362                         be->bd_info->bi_db_close( be );
 363                 }
 364
 365                 if( be->bd_info->bi_close ) {
 366                         be->bd_info->bi_close( be->bd_info );
 367                 }
 368
 369                 return 0;
 370         }
 371
 372         /* close each backend database */
 373         for( i = 0; i < nBackendDB; i++ ) {
 374                 if ( backendDB[i].bd_info->bi_db_close ) {
 375                         backendDB[i].bd_info->bi_db_close(
 376                                 &backendDB[i] );
 377                 }
 378
 379                 if(rc != 0) {
 380 #ifdef NEW_LOGGING
 381                         LDAP_LOG( BACKEND, NOTICE,
 382                                 "backend_shutdown: bi_close %s failed!\n",
 383                                 backendDB[i].be_type, 0, 0 );
 384 #else
 385                         Debug( LDAP_DEBUG_ANY,
 386                                 "backend_close: bi_close %s failed!\n",
 387                                 backendDB[i].be_type, 0, 0 );
 388 #endif
 389                 }
 390         }
 391
 392         /* close each backend type */
 393         for( i = 0; i < nBackendInfo; i++ ) {
 394                 if( backendInfo[i].bi_nDB == 0 ) {
 395                         /* no database of this type */
 396                         continue;
 397                 }
 398
 399                 if( backendInfo[i].bi_close ) {
 400                         backendInfo[i].bi_close(
 401                                 &backendInfo[i] );
 402                 }
 403         }
 404
 405         return 0;
 406 }
 407
 408 int backend_destroy(void)
 409 {
 410         int i;
 411         BackendDB *bd;
 412
 413         /* destroy each backend database */
 414         for( i = 0, bd = backendDB; i < nBackendDB; i++, bd++ ) {
 415                 if ( bd->bd_info->bi_db_destroy ) {
 416                         bd->bd_info->bi_db_destroy( bd );
 417                 }
 418                 ber_bvarray_free( bd->be_suffix );
 419                 ber_bvarray_free( bd->be_nsuffix );
 420                 if ( bd->be_rootdn.bv_val ) free( bd->be_rootdn.bv_val );
 421                 if ( bd->be_rootndn.bv_val ) free( bd->be_rootndn.bv_val );
 422                 if ( bd->be_rootpw.bv_val ) free( bd->be_rootpw.bv_val );
 423                 acl_destroy( bd->be_acl, global_acl );
 424         }
 425         free( backendDB );
 426
 427         /* destroy each backend type */
 428         for( i = 0; i < nBackendInfo; i++ ) {
 429                 if( backendInfo[i].bi_destroy ) {
 430                         backendInfo[i].bi_destroy(
 431                                 &backendInfo[i] );
 432                 }
 433         }
 434
 435 #ifdef SLAPD_MODULES
 436         if (backendInfo != binfo) {
 437            free(backendInfo);
 438         }
 439 #endif /* SLAPD_MODULES */
 440
 441         nBackendInfo = 0;
 442         backendInfo = NULL;
 443
 444         return 0;
 445 }
 446
 447 BackendInfo* backend_info(const char *type)
 448 {
 449         int i;
 450
 451         /* search for the backend type */
 452         for( i = 0; i < nBackendInfo; i++ ) {
 453                 if( strcasecmp(backendInfo[i].bi_type, type) == 0 ) {
 454                         return &backendInfo[i];
 455                 }
 456         }
 457
 458         return NULL;
 459 }
 460
 461
 462 BackendDB *
 463 backend_db_init(
 464     const char  *type
 465 )
 466 {
 467         Backend *be;
 468         BackendInfo *bi = backend_info(type);
 469         int     rc = 0;
 470
 471         if( bi == NULL ) {
 472                 fprintf( stderr, "Unrecognized database type (%s)\n", type );
 473                 return NULL;
 474         }
 475
 476         backendDB = (BackendDB *) ch_realloc(
 477                         (char *) backendDB,
 478                     (nBackendDB + 1) * sizeof(Backend) );
 479
 480         memset( &backendDB[nbackends], '\0', sizeof(Backend) );
 481
 482         be = &backends[nbackends++];
 483
 484         be->bd_info = bi;
 485         be->be_def_limit = deflimit;
 486         be->be_dfltaccess = global_default_access;
 487
 488         be->be_restrictops = global_restrictops;
 489         be->be_requires = global_requires;
 490         be->be_ssf_set = global_ssf_set;
 491
 492         /* assign a default depth limit for alias deref */
 493         be->be_max_deref_depth = SLAPD_DEFAULT_MAXDEREFDEPTH;
 494
 495         if(bi->bi_db_init) {
 496                 rc = bi->bi_db_init( be );
 497         }
 498
 499         if(rc != 0) {
 500                 fprintf( stderr, "database init failed (%s)\n", type );
 501                 nbackends--;
 502                 return NULL;
 503         }
 504
 505         bi->bi_nDB++;
 506         return( be );
 507 }
 508
 509 void
 510 be_db_close( void )
 511 {
 512         int     i;
 513
 514         for ( i = 0; i < nbackends; i++ ) {
 515                 if ( backends[i].bd_info->bi_db_close ) {
 516                         (*backends[i].bd_info->bi_db_close)( &backends[i] );
 517                 }
 518         }
 519 }
 520
 521 Backend *
 522 select_backend(
 523         struct berval * dn,
 524         int manageDSAit,
 525         int noSubs )
 526 {
 527         int     i, j;
 528         ber_len_t len, dnlen = dn->bv_len;
 529         Backend *be = NULL;
 530
 531         for ( i = 0; i < nbackends; i++ ) {
 532                 for ( j = 0; backends[i].be_nsuffix != NULL &&
 533                     backends[i].be_nsuffix[j].bv_val != NULL; j++ )
 534                 {
 535                         if (( backends[i].be_flags & SLAP_BFLAG_GLUE_SUBORDINATE )
 536                                 && noSubs )
 537                         {
 538                                 continue;
 539                         }
 540
 541                         len = backends[i].be_nsuffix[j].bv_len;
 542
 543                         if ( len > dnlen ) {
 544                                 /* suffix is longer than DN */
 545                                 continue;
 546                         }
 547
 548                         /*
 549                          * input DN is normalized, so the separator check
 550                          * need not look at escaping
 551                          */
 552                         if ( len && len < dnlen &&
 553                                 !DN_SEPARATOR( dn->bv_val[(dnlen-len)-1] ))
 554                         {
 555                                 continue;
 556                         }
 557
 558                         if ( strcmp( backends[i].be_nsuffix[j].bv_val,
 559                                 &dn->bv_val[dnlen-len] ) == 0 )
 560                         {
 561                                 if( be == NULL ) {
 562                                         be = &backends[i];
 563
 564                                         if( manageDSAit && len == dnlen ) {
 565                                                 continue;
 566                                         }
 567                                 } else {
 568                                         be = &backends[i];
 569                                 }
 570                                 return be;
 571                         }
 572                 }
 573         }
 574
 575         return be;
 576 }
 577
 578 int
 579 be_issuffix(
 580     Backend     *be,
 581     struct berval       *bvsuffix
 582 )
 583 {
 584         int     i;
 585
 586         for ( i = 0; be->be_nsuffix != NULL && be->be_nsuffix[i].bv_val != NULL; i++ ) {
 587                 if ( bvmatch( &be->be_nsuffix[i], bvsuffix ) ) {
 588                         return( 1 );
 589                 }
 590         }
 591
 592         return( 0 );
 593 }
 594
 595 int
 596 be_isroot( Backend *be, struct berval *ndn )
 597 {
 598         if ( !ndn->bv_len ) {
 599                 return( 0 );
 600         }
 601
 602         if ( !be->be_rootndn.bv_len ) {
 603                 return( 0 );
 604         }
 605
 606         return dn_match( &be->be_rootndn, ndn );
 607 }
 608
 609 int
 610 be_isupdate( Backend *be, struct berval *ndn )
 611 {
 612         if ( !ndn->bv_len ) {
 613                 return( 0 );
 614         }
 615
 616         if ( !be->be_update_ndn.bv_len ) {
 617                 return( 0 );
 618         }
 619
 620         return dn_match( &be->be_update_ndn, ndn );
 621 }
 622
 623 struct berval *
 624 be_root_dn( Backend *be )
 625 {
 626         return &be->be_rootdn;
 627 }
 628
 629 int
 630 be_isroot_pw( Backend *be,
 631         Connection *conn,
 632         struct berval *ndn,
 633         struct berval *cred )
 634 {
 635         int result;
 636
 637         if ( ! be_isroot( be, ndn ) ) {
 638                 return 0;
 639         }
 640
 641         if( be->be_rootpw.bv_len == 0 ) {
 642                 return 0;
 643         }
 644
 645 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
 646         ldap_pvt_thread_mutex_lock( &passwd_mutex );
 647 #ifdef SLAPD_SPASSWD
 648         lutil_passwd_sasl_conn = conn->c_sasl_context;
 649 #endif
 650 #endif
 651
 652         result = lutil_passwd( &be->be_rootpw, cred, NULL );
 653
 654 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
 655 #ifdef SLAPD_SPASSWD
 656         lutil_passwd_sasl_conn = NULL;
 657 #endif
 658         ldap_pvt_thread_mutex_unlock( &passwd_mutex );
 659 #endif
 660
 661         return result == 0;
 662 }
 663
 664 int
 665 be_entry_release_rw(
 666         BackendDB *be,
 667         Connection *conn,
 668         Operation *op,
 669         Entry *e,
 670         int rw )
 671 {
 672         if ( be->be_release ) {
 673                 /* free and release entry from backend */
 674                 return be->be_release( be, conn, op, e, rw );
 675         } else {
 676                 /* free entry */
 677                 entry_free( e );
 678                 return 0;
 679         }
 680 }
 681
 682 int
 683 backend_unbind(
 684         Connection   *conn,
 685         Operation    *op
 686 )
 687 {
 688         int             i;
 689         Slapi_PBlock *pb = op->o_pb;
 690
 691 #if defined( LDAP_SLAPI )
 692         int     rc;
 693         slapi_x_connection_set_pb( pb, conn );
 694         slapi_x_operation_set_pb( pb, op );
 695 #endif /* defined( LDAP_SLAPI ) */
 696
 697         for ( i = 0; i < nbackends; i++ ) {
 698 #if defined( LDAP_SLAPI )
 699                 slapi_pblock_set( pb, SLAPI_BACKEND, (void *)&backends[i] );
 700                 rc = doPluginFNs( &backends[i], SLAPI_PLUGIN_PRE_UNBIND_FN,
 701                                 (Slapi_PBlock *)pb );
 702                 if ( rc != 0 ) {
 703                         /*
 704                          * A preoperation plugin failure will abort the
 705                          * entire operation.
 706                          */
 707 #ifdef NEW_LOGGING
 708                         LDAP_LOG( OPERATION, INFO, "do_bind: Unbind preoperation plugin "
 709                                         "failed\n", 0, 0, 0);
 710 #else
 711                         Debug(LDAP_DEBUG_TRACE, "do_bind: Unbind preoperation plugin "
 712                                         "failed.\n", 0, 0, 0);
 713 #endif
 714                         return 0;
 715                 }
 716 #endif /* defined( LDAP_SLAPI ) */
 717
 718                 if ( backends[i].be_unbind ) {
 719                         (*backends[i].be_unbind)( &backends[i], conn, op );
 720                 }
 721
 722 #if defined( LDAP_SLAPI )
 723                 if ( doPluginFNs( &backends[i], SLAPI_PLUGIN_POST_UNBIND_FN,
 724                                 (Slapi_PBlock *)pb ) != 0 ) {
 725 #ifdef NEW_LOGGING
 726                         LDAP_LOG( OPERATION, INFO, "do_unbind: Unbind postoperation plugins "
 727                                         "failed\n", 0, 0, 0);
 728 #else
 729                         Debug(LDAP_DEBUG_TRACE, "do_unbind: Unbind postoperation plugins "
 730                                         "failed.\n", 0, 0, 0);
 731 #endif
 732                 }
 733 #endif /* defined( LDAP_SLAPI ) */
 734         }
 735
 736         return 0;
 737 }
 738
 739 int
 740 backend_connection_init(
 741         Connection   *conn
 742 )
 743 {
 744         int     i;
 745
 746         for ( i = 0; i < nbackends; i++ ) {
 747                 if ( backends[i].be_connection_init ) {
 748                         (*backends[i].be_connection_init)( &backends[i], conn);
 749                 }
 750         }
 751
 752         return 0;
 753 }
 754
 755 int
 756 backend_connection_destroy(
 757         Connection   *conn
 758 )
 759 {
 760         int     i;
 761
 762         for ( i = 0; i < nbackends; i++ ) {
 763                 if ( backends[i].be_connection_destroy ) {
 764                         (*backends[i].be_connection_destroy)( &backends[i], conn);
 765                 }
 766         }
 767
 768         return 0;
 769 }
 770
 771 static int
 772 backend_check_controls(
 773         Backend *be,
 774         Connection *conn,
 775         Operation *op,
 776         const char **text )
 777 {
 778         LDAPControl **ctrls = op->o_ctrls;
 779
 780         if( ctrls == NULL ) return LDAP_SUCCESS;
 781
 782         for( ; *ctrls != NULL ; ctrls++ ) {
 783                 if( (*ctrls)->ldctl_iscritical &&
 784                         !ldap_charray_inlist( be->be_controls, (*ctrls)->ldctl_oid ) )
 785                 {
 786                         *text = "control unavailable in context";
 787                         return LDAP_UNAVAILABLE_CRITICAL_EXTENSION;
 788                 }
 789         }
 790
 791         return LDAP_SUCCESS;
 792 }
 793
 794 int
 795 backend_check_restrictions(
 796         Backend *be,
 797         Connection *conn,
 798         Operation *op,
 799         struct berval *opdata,
 800         const char **text )
 801 {
 802         int rc;
 803         slap_mask_t restrictops;
 804         slap_mask_t requires;
 805         slap_mask_t opflag;
 806         slap_ssf_set_t *ssf;
 807         int updateop = 0;
 808         int starttls = 0;
 809         int session = 0;
 810
 811         if( be ) {
 812                 rc = backend_check_controls( be, conn, op, text );
 813
 814                 if( rc != LDAP_SUCCESS ) {
 815                         return rc;
 816                 }
 817
 818                 restrictops = be->be_restrictops;
 819                 requires = be->be_requires;
 820                 ssf = &be->be_ssf_set;
 821
 822         } else {
 823                 restrictops = global_restrictops;
 824                 requires = global_requires;
 825                 ssf = &global_ssf_set;
 826         }
 827
 828         switch( op->o_tag ) {
 829         case LDAP_REQ_ADD:
 830                 opflag = SLAP_RESTRICT_OP_ADD;
 831                 updateop++;
 832                 break;
 833         case LDAP_REQ_BIND:
 834                 opflag = SLAP_RESTRICT_OP_BIND;
 835                 session++;
 836                 break;
 837         case LDAP_REQ_COMPARE:
 838                 opflag = SLAP_RESTRICT_OP_COMPARE;
 839                 break;
 840         case LDAP_REQ_DELETE:
 841                 updateop++;
 842                 opflag = SLAP_RESTRICT_OP_DELETE;
 843                 break;
 844         case LDAP_REQ_EXTENDED:
 845                 opflag = SLAP_RESTRICT_OP_EXTENDED;
 846
 847                 if( !opdata ) {
 848                         /* treat unspecified as a modify */
 849                         opflag = SLAP_RESTRICT_OP_MODIFY;
 850                         updateop++;
 851                         break;
 852                 }
 853
 854                 {
 855                         struct berval bv = BER_BVC( LDAP_EXOP_START_TLS );
 856                         if( bvmatch( opdata, &bv ) ) {
 857                                 session++;
 858                                 starttls++;
 859                                 break;
 860                         }
 861                 }
 862
 863                 {
 864                         struct berval bv = BER_BVC( LDAP_EXOP_X_WHO_AM_I );
 865                         if( bvmatch( opdata, &bv ) ) {
 866                                 break;
 867                         }
 868                 }
 869
 870                 {
 871                         struct berval bv = BER_BVC( LDAP_EXOP_X_CANCEL );
 872                         if ( bvmatch( opdata, &bv ) ) {
 873                                 break;
 874                         }
 875                 }
 876
 877                 /* treat everything else as a modify */
 878                 opflag = SLAP_RESTRICT_OP_MODIFY;
 879                 updateop++;
 880                 break;
 881
 882         case LDAP_REQ_MODIFY:
 883                 updateop++;
 884                 opflag = SLAP_RESTRICT_OP_MODIFY;
 885                 break;
 886         case LDAP_REQ_RENAME:
 887                 updateop++;
 888                 opflag = SLAP_RESTRICT_OP_RENAME;
 889                 break;
 890         case LDAP_REQ_SEARCH:
 891                 opflag = SLAP_RESTRICT_OP_SEARCH;
 892                 break;
 893         case LDAP_REQ_UNBIND:
 894                 session++;
 895                 opflag = 0;
 896                 break;
 897         default:
 898                 *text = "restrict operations internal error";
 899                 return LDAP_OTHER;
 900         }
 901
 902         if ( !starttls ) {
 903                 /* these checks don't apply to StartTLS */
 904
 905                 if( op->o_transport_ssf < ssf->sss_transport ) {
 906                         *text = "transport confidentiality required";
 907                         return LDAP_CONFIDENTIALITY_REQUIRED;
 908                 }
 909
 910                 if( op->o_tls_ssf < ssf->sss_tls ) {
 911                         *text = "TLS confidentiality required";
 912                         return LDAP_CONFIDENTIALITY_REQUIRED;
 913                 }
 914
 915
 916                 if( op->o_tag == LDAP_REQ_BIND && opdata == NULL ) {
 917                         /* simple bind specific check */
 918                         if( op->o_ssf < ssf->sss_simple_bind ) {
 919                                 *text = "confidentiality required";
 920                                 return LDAP_CONFIDENTIALITY_REQUIRED;
 921                         }
 922                 }
 923
 924                 if( op->o_tag != LDAP_REQ_BIND || opdata == NULL ) {
 925                         /* these checks don't apply to SASL bind */
 926
 927                         if( op->o_sasl_ssf < ssf->sss_sasl ) {
 928                                 *text = "SASL confidentiality required";
 929                                 return LDAP_CONFIDENTIALITY_REQUIRED;
 930                         }
 931
 932                         if( op->o_ssf < ssf->sss_ssf ) {
 933                                 *text = "confidentiality required";
 934                                 return LDAP_CONFIDENTIALITY_REQUIRED;
 935                         }
 936                 }
 937
 938                 if( updateop ) {
 939                         if( op->o_transport_ssf < ssf->sss_update_transport ) {
 940                                 *text = "transport update confidentiality required";
 941                                 return LDAP_CONFIDENTIALITY_REQUIRED;
 942                         }
 943
 944                         if( op->o_tls_ssf < ssf->sss_update_tls ) {
 945                                 *text = "TLS update confidentiality required";
 946                                 return LDAP_CONFIDENTIALITY_REQUIRED;
 947                         }
 948
 949                         if( op->o_sasl_ssf < ssf->sss_update_sasl ) {
 950                                 *text = "SASL update confidentiality required";
 951                                 return LDAP_CONFIDENTIALITY_REQUIRED;
 952                         }
 953
 954                         if( op->o_ssf < ssf->sss_update_ssf ) {
 955                                 *text = "update confidentiality required";
 956                                 return LDAP_CONFIDENTIALITY_REQUIRED;
 957                         }
 958
 959                         if( !( global_allows & SLAP_ALLOW_UPDATE_ANON ) &&
 960                                 op->o_ndn.bv_len == 0 )
 961                         {
 962                                 *text = "modifications require authentication";
 963                                 return LDAP_STRONG_AUTH_REQUIRED;
 964                         }
 965
 966 #ifdef SLAP_X_LISTENER_MOD
 967                         if ( ! ( conn->c_listener->sl_perms & S_IWUSR ) ) {
 968                                 /* no "w" mode means readonly */
 969                                 *text = "modifications not allowed on this listener";
 970                                 return LDAP_UNWILLING_TO_PERFORM;
 971                         }
 972 #endif /* SLAP_X_LISTENER_MOD */
 973                 }
 974         }
 975
 976         if ( !session ) {
 977                 /* these checks don't apply to Bind, StartTLS, or Unbind */
 978
 979                 if( requires & SLAP_REQUIRE_STRONG ) {
 980                         /* should check mechanism */
 981                         if( ( op->o_transport_ssf < ssf->sss_transport
 982                                 && op->o_authmech.bv_len == 0 ) || op->o_dn.bv_len == 0 )
 983                         {
 984                                 *text = "strong authentication required";
 985                                 return LDAP_STRONG_AUTH_REQUIRED;
 986                         }
 987                 }
 988
 989                 if( requires & SLAP_REQUIRE_SASL ) {
 990                         if( op->o_authmech.bv_len == 0 || op->o_dn.bv_len == 0 ) {
 991                                 *text = "SASL authentication required";
 992                                 return LDAP_STRONG_AUTH_REQUIRED;
 993                         }
 994                 }
 995
 996                 if( requires & SLAP_REQUIRE_AUTHC ) {
 997                         if( op->o_dn.bv_len == 0 ) {
 998                                 *text = "authentication required";
 999                                 return LDAP_UNWILLING_TO_PERFORM;
1000                         }
1001                 }
1002
1003                 if( requires & SLAP_REQUIRE_BIND ) {
1004                         int version;
1005                         ldap_pvt_thread_mutex_lock( &conn->c_mutex );
1006                         version = conn->c_protocol;
1007                         ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
1008
1009                         if( !version ) {
1010                                 /* no bind has occurred */
1011                                 *text = "BIND required";
1012                                 return LDAP_OPERATIONS_ERROR;
1013                         }
1014                 }
1015
1016                 if( requires & SLAP_REQUIRE_LDAP_V3 ) {
1017                         if( op->o_protocol < LDAP_VERSION3 ) {
1018                                 /* no bind has occurred */
1019                                 *text = "operation restricted to LDAPv3 clients";
1020                                 return LDAP_OPERATIONS_ERROR;
1021                         }
1022                 }
1023
1024 #ifdef SLAP_X_LISTENER_MOD
1025                 if ( !starttls && op->o_dn.bv_len == 0 ) {
1026                         if ( ! ( conn->c_listener->sl_perms & S_IXUSR ) ) {
1027                                 /* no "x" mode means bind required */
1028                                 *text = "bind required on this listener";
1029                                 return LDAP_STRONG_AUTH_REQUIRED;
1030                         }
1031                 }
1032
1033                 if ( !starttls && !updateop ) {
1034                         if ( ! ( conn->c_listener->sl_perms & S_IRUSR ) ) {
1035                                 /* no "r" mode means no read */
1036                                 *text = "read not allowed on this listener";
1037                                 return LDAP_UNWILLING_TO_PERFORM;
1038                         }
1039                 }
1040 #endif /* SLAP_X_LISTENER_MOD */
1041
1042         }
1043
1044         if( restrictops & opflag ) {
1045                 if( restrictops == SLAP_RESTRICT_OP_READS ) {
1046                         *text = "read operations restricted";
1047                 } else {
1048                         *text = "operation restricted";
1049                 }
1050                 return LDAP_UNWILLING_TO_PERFORM;
1051         }
1052
1053         return LDAP_SUCCESS;
1054 }
1055
1056 int backend_check_referrals(
1057         Backend *be,
1058         Connection *conn,
1059         Operation *op,
1060         struct berval *dn,
1061         struct berval *ndn )
1062 {
1063         int rc = LDAP_SUCCESS;
1064
1065         if( be->be_chk_referrals ) {
1066                 const char *text;
1067
1068                 rc = be->be_chk_referrals( be,
1069                         conn, op, dn, ndn, &text );
1070
1071                 if( rc != LDAP_SUCCESS && rc != LDAP_REFERRAL ) {
1072                         send_ldap_result( conn, op, rc,
1073                                 NULL, text, NULL, NULL );
1074                 }
1075         }
1076
1077         return rc;
1078 }
1079
1080 int
1081 backend_group(
1082         Backend *be,
1083         Connection *conn,
1084         Operation *op,
1085         Entry   *target,
1086         struct berval *gr_ndn,
1087         struct berval *op_ndn,
1088         ObjectClass *group_oc,
1089         AttributeDescription *group_at
1090 )
1091 {
1092         GroupAssertion *g;
1093
1094         if ( op->o_abandon ) return SLAPD_ABANDON;
1095
1096         if ( !dn_match( &target->e_nname, gr_ndn ) ) {
1097                 /* we won't attempt to send it to a different backend */
1098
1099                 be = select_backend( gr_ndn, 0, 0 );
1100
1101                 if (be == NULL) {
1102                         return LDAP_NO_SUCH_OBJECT;
1103                 }
1104         }
1105
1106         ldap_pvt_thread_mutex_lock( &conn->c_mutex );
1107
1108         for (g = conn->c_groups; g; g=g->ga_next) {
1109                 if (g->ga_be != be || g->ga_oc != group_oc ||
1110                         g->ga_at != group_at || g->ga_len != gr_ndn->bv_len)
1111                         continue;
1112                 if (strcmp( g->ga_ndn, gr_ndn->bv_val ) == 0)
1113                         break;
1114         }
1115
1116         ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
1117
1118         if (g) {
1119                 return g->ga_res;
1120         }
1121
1122         if( be->be_group ) {
1123                 int res = be->be_group( be, conn, op,
1124                         target, gr_ndn, op_ndn,
1125                         group_oc, group_at );
1126
1127                 if ( op->o_tag != LDAP_REQ_BIND && !op->o_do_not_cache ) {
1128                         g = ch_malloc(sizeof(GroupAssertion) + gr_ndn->bv_len);
1129                         g->ga_be = be;
1130                         g->ga_oc = group_oc;
1131                         g->ga_at = group_at;
1132                         g->ga_res = res;
1133                         g->ga_len = gr_ndn->bv_len;
1134                         strcpy(g->ga_ndn, gr_ndn->bv_val);
1135                         ldap_pvt_thread_mutex_lock( &conn->c_mutex );
1136                         g->ga_next = conn->c_groups;
1137                         conn->c_groups = g;
1138                         ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
1139                 }
1140
1141                 return res;
1142         }
1143
1144         return LDAP_UNWILLING_TO_PERFORM;
1145 }
1146
1147 int
1148 backend_attribute(
1149         Backend *be,
1150         Connection *conn,
1151         Operation *op,
1152         Entry   *target,
1153         struct berval   *edn,
1154         AttributeDescription *entry_at,
1155         BerVarray *vals
1156 )
1157 {
1158         if ( target == NULL || !dn_match( &target->e_nname, edn ) ) {
1159                 /* we won't attempt to send it to a different backend */
1160
1161                 be = select_backend( edn, 0, 0 );
1162
1163                 if (be == NULL) {
1164                         return LDAP_NO_SUCH_OBJECT;
1165                 }
1166         }
1167
1168         if( be->be_attribute ) {
1169                 return be->be_attribute( be, conn, op, target, edn,
1170                         entry_at, vals );
1171         }
1172
1173         return LDAP_UNWILLING_TO_PERFORM;
1174 }
1175
1176 Attribute *backend_operational(
1177         Backend *be,
1178         Connection *conn,
1179         Operation *op,
1180         Entry *e,
1181         AttributeName *attrs,
1182         int opattrs     )
1183 {
1184         Attribute *a = NULL, **ap = &a;
1185
1186         /*
1187          * If operational attributes (allegedly) are required,
1188          * and the backend supports specific operational attributes,
1189          * add them to the attribute list
1190          */
1191         if ( opattrs || ( attrs &&
1192                 ad_inlist( slap_schema.si_ad_subschemaSubentry, attrs )) ) {
1193                 *ap = slap_operational_subschemaSubentry( be );
1194                 ap = &(*ap)->a_next;
1195         }
1196
1197         if ( ( opattrs || attrs ) && be && be->be_operational != NULL ) {
1198                 ( void )be->be_operational( be, conn, op, e, attrs, opattrs, ap );
1199         }
1200
1201         return a;
1202 }
1203