git.sur5r.net Git - openldap/blob - servers/slapd/backend.c

   1 /* $OpenLDAP$ */
   2 /*
   3  * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
   4  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   5  */
   6 /* backend.c - routines for dealing with back-end databases */
   7
   8
   9 #include "portable.h"
  10 #include "slapi_common.h"
  11
  12 #include <stdio.h>
  13
  14 #include <ac/string.h>
  15 #include <ac/socket.h>
  16
  17 #include <sys/stat.h>
  18
  19 #include "slap.h"
  20 #include "slapi.h"
  21 #include "lutil.h"
  22 #include "lber_pvt.h"
  23
  24 /*
  25  * If a module is configured as dynamic, its header should not
  26  * get included into slapd. While this is a general rule and does
  27  * not have much of an effect in UNIX, this rule should be adhered
  28  * to for Windows, where dynamic object code should not be implicitly
  29  * imported into slapd without appropriate __declspec(dllimport) directives.
  30  */
  31
  32 #if defined(SLAPD_BDB) && !defined(SLAPD_BDB_DYNAMIC)
  33 #include "back-bdb/external.h"
  34 #endif
  35 #if defined(SLAPD_DNSSRV) && !defined(SLAPD_DNSSRV_DYNAMIC)
  36 #include "back-dnssrv/external.h"
  37 #endif
  38 #if defined(SLAPD_LDAP) && !defined(SLAPD_LDAP_DYNAMIC)
  39 #include "back-ldap/external.h"
  40 #endif
  41 #if defined(SLAPD_LDBM) && !defined(SLAPD_LDBM_DYNAMIC)
  42 #include "back-ldbm/external.h"
  43 #endif
  44 #if defined(SLAPD_META) && !defined(SLAPD_META_DYNAMIC)
  45 #include "back-meta/external.h"
  46 #endif
  47 #if defined(SLAPD_MONITOR) && !defined(SLAPD_MONITOR_DYNAMIC)
  48 #include "back-monitor/external.h"
  49 #endif
  50 #if defined(SLAPD_NULL) && !defined(SLAPD_NULL_DYNAMIC)
  51 #include "back-null/external.h"
  52 #endif
  53 #if defined(SLAPD_PASSWD) && !defined(SLAPD_PASSWD_DYNAMIC)
  54 #include "back-passwd/external.h"
  55 #endif
  56 #if defined(SLAPD_PERL) && !defined(SLAPD_PERL_DYNAMIC)
  57 #include "back-perl/external.h"
  58 #endif
  59 #if defined(SLAPD_SHELL) && !defined(SLAPD_SHELL_DYNAMIC)
  60 #include "back-shell/external.h"
  61 #endif
  62 #if defined(SLAPD_TCL) && !defined(SLAPD_TCL_DYNAMIC)
  63 #include "back-tcl/external.h"
  64 #endif
  65 #if defined(SLAPD_SQL) && !defined(SLAPD_SQL_DYNAMIC)
  66 #include "back-sql/external.h"
  67 #endif
  68 #if defined(SLAPD_PRIVATE) && !defined(SLAPD_PRIVATE_DYNAMIC)
  69 #include "private/external.h"
  70 #endif
  71
  72 static BackendInfo binfo[] = {
  73 #if defined(SLAPD_BDB) && !defined(SLAPD_BDB_DYNAMIC)
  74         {"bdb", bdb_initialize},
  75 #endif
  76 #if defined(SLAPD_DNSSRV) && !defined(SLAPD_DNSSRV_DYNAMIC)
  77         {"dnssrv",      dnssrv_back_initialize},
  78 #endif
  79 #if defined(SLAPD_LDAP) && !defined(SLAPD_LDAP_DYNAMIC)
  80         {"ldap",        ldap_back_initialize},
  81 #endif
  82 #if defined(SLAPD_LDBM) && !defined(SLAPD_LDBM_DYNAMIC)
  83         {"ldbm",        ldbm_back_initialize},
  84 #endif
  85 #if defined(SLAPD_META) && !defined(SLAPD_META_DYNAMIC)
  86         {"meta",        meta_back_initialize},
  87 #endif
  88 #if defined(SLAPD_MONITOR) && !defined(SLAPD_MONITOR_DYNAMIC)
  89         {"monitor",     monitor_back_initialize},
  90 #endif
  91 #if defined(SLAPD_NULL) && !defined(SLAPD_NULL_DYNAMIC)
  92         {"null",        null_back_initialize},
  93 #endif
  94 #if defined(SLAPD_PASSWD) && !defined(SLAPD_PASSWD_DYNAMIC)
  95         {"passwd",      passwd_back_initialize},
  96 #endif
  97 #if defined(SLAPD_PERL) && !defined(SLAPD_PERL_DYNAMIC)
  98         {"perl",        perl_back_initialize},
  99 #endif
 100 #if defined(SLAPD_SHELL) && !defined(SLAPD_SHELL_DYNAMIC)
 101         {"shell",       shell_back_initialize},
 102 #endif
 103 #if defined(SLAPD_TCL) && !defined(SLAPD_TCL_DYNAMIC)
 104         {"tcl",         tcl_back_initialize},
 105 #endif
 106 #if defined(SLAPD_SQL) && !defined(SLAPD_SQL_DYNAMIC)
 107         {"sql",         sql_back_initialize},
 108 #endif
 109         /* for any private backend */
 110 #if defined(SLAPD_PRIVATE) && !defined(SLAPD_PRIVATE_DYNAMIC)
 111         {"private",     private_back_initialize},
 112 #endif
 113         {NULL}
 114 };
 115
 116 int                     nBackendInfo = 0;
 117 BackendInfo     *backendInfo = NULL;
 118
 119 int                     nBackendDB = 0;
 120 BackendDB       *backendDB = NULL;
 121
 122 int backend_init(void)
 123 {
 124         int rc = -1;
 125
 126         if((nBackendInfo != 0) || (backendInfo != NULL)) {
 127                 /* already initialized */
 128 #ifdef NEW_LOGGING
 129                 LDAP_LOG( BACKEND, ERR,
 130                         "backend_init:  backend already initialized\n", 0, 0, 0 );
 131 #else
 132                 Debug( LDAP_DEBUG_ANY,
 133                         "backend_init: already initialized.\n", 0, 0, 0 );
 134 #endif
 135                 return -1;
 136         }
 137
 138         for( ;
 139                 binfo[nBackendInfo].bi_type != NULL;
 140                 nBackendInfo++ )
 141         {
 142                 rc = binfo[nBackendInfo].bi_init( &binfo[nBackendInfo] );
 143
 144                 if(rc != 0) {
 145 #ifdef NEW_LOGGING
 146                         LDAP_LOG( BACKEND, INFO,
 147                                 "backend_init:  initialized for type \"%s\"\n",
 148                                 binfo[nBackendInfo].bi_type, 0, 0 );
 149 #else
 150                         Debug( LDAP_DEBUG_ANY,
 151                                 "backend_init: initialized for type \"%s\"\n",
 152                                 binfo[nBackendInfo].bi_type, 0, 0 );
 153 #endif
 154                         /* destroy those we've already inited */
 155                         for( nBackendInfo--;
 156                                 nBackendInfo >= 0 ;
 157                                 nBackendInfo-- )
 158                         {
 159                                 if ( binfo[nBackendInfo].bi_destroy ) {
 160                                         binfo[nBackendInfo].bi_destroy(
 161                                                 &binfo[nBackendInfo] );
 162                                 }
 163                         }
 164                         return rc;
 165                 }
 166         }
 167
 168         if ( nBackendInfo > 0) {
 169                 backendInfo = binfo;
 170                 return 0;
 171         }
 172
 173 #ifdef SLAPD_MODULES
 174         return 0;
 175 #else
 176
 177 #ifdef NEW_LOGGING
 178         LDAP_LOG( BACKEND, ERR, "backend_init: failed\n", 0, 0, 0 );
 179 #else
 180         Debug( LDAP_DEBUG_ANY,
 181                 "backend_init: failed\n",
 182                 0, 0, 0 );
 183 #endif
 184
 185         return rc;
 186 #endif /* SLAPD_MODULES */
 187 }
 188
 189 int backend_add(BackendInfo *aBackendInfo)
 190 {
 191    int rc = 0;
 192
 193    if ((rc = aBackendInfo->bi_init(aBackendInfo)) != 0) {
 194 #ifdef NEW_LOGGING
 195         LDAP_LOG( BACKEND, ERR,
 196                   "backend_add:  initialization for type \"%s\" failed\n",
 197                   aBackendInfo->bi_type, 0, 0 );
 198 #else
 199       Debug( LDAP_DEBUG_ANY,
 200              "backend_add: initialization for type \"%s\" failed\n",
 201              aBackendInfo->bi_type, 0, 0 );
 202 #endif
 203       return rc;
 204    }
 205
 206    /* now add the backend type to the Backend Info List */
 207    {
 208       BackendInfo *newBackendInfo = 0;
 209
 210       /* if backendInfo == binfo no deallocation of old backendInfo */
 211       if (backendInfo == binfo) {
 212          newBackendInfo = ch_calloc(nBackendInfo + 1, sizeof(BackendInfo));
 213          AC_MEMCPY(newBackendInfo, backendInfo, sizeof(BackendInfo) *
 214                 nBackendInfo);
 215       } else {
 216          newBackendInfo = ch_realloc(backendInfo, sizeof(BackendInfo) *
 217                                      (nBackendInfo + 1));
 218       }
 219       AC_MEMCPY(&newBackendInfo[nBackendInfo], aBackendInfo,
 220              sizeof(BackendInfo));
 221       backendInfo = newBackendInfo;
 222       nBackendInfo++;
 223
 224       return 0;
 225    }
 226 }
 227
 228 int backend_startup(Backend *be)
 229 {
 230         int i;
 231         int rc = 0;
 232
 233         if( ! ( nBackendDB > 0 ) ) {
 234                 /* no databases */
 235 #ifdef NEW_LOGGING
 236                 LDAP_LOG( BACKEND, INFO,
 237                         "backend_startup: %d databases to startup. \n", nBackendDB, 0, 0 );
 238 #else
 239                 Debug( LDAP_DEBUG_ANY,
 240                         "backend_startup: %d databases to startup.\n",
 241                         nBackendDB, 0, 0 );
 242 #endif
 243                 return 1;
 244         }
 245
 246         if(be != NULL) {
 247                 /* startup a specific backend database */
 248 #ifdef NEW_LOGGING
 249                 LDAP_LOG( BACKEND, DETAIL1, "backend_startup:  starting \"%s\"\n",
 250                            be->be_suffix[0].bv_val, 0, 0 );
 251 #else
 252                 Debug( LDAP_DEBUG_TRACE,
 253                         "backend_startup: starting \"%s\"\n",
 254                         be->be_suffix[0].bv_val, 0, 0 );
 255 #endif
 256
 257                 if ( be->bd_info->bi_open ) {
 258                         rc = be->bd_info->bi_open( be->bd_info );
 259                         if ( rc != 0 ) {
 260 #ifdef NEW_LOGGING
 261                                 LDAP_LOG( BACKEND, CRIT, "backend_startup: bi_open failed!\n", 0, 0, 0 );
 262 #else
 263                                 Debug( LDAP_DEBUG_ANY,
 264                                         "backend_startup: bi_open failed!\n",
 265                                         0, 0, 0 );
 266 #endif
 267
 268                                 return rc;
 269                         }
 270                 }
 271
 272                 if ( be->bd_info->bi_db_open ) {
 273                         rc = be->bd_info->bi_db_open( be );
 274                         if ( rc != 0 ) {
 275 #ifdef NEW_LOGGING
 276                                 LDAP_LOG( BACKEND, CRIT,
 277                                         "backend_startup: bi_db_open failed! (%d)\n", rc, 0, 0 );
 278 #else
 279                                 Debug( LDAP_DEBUG_ANY,
 280                                         "backend_startup: bi_db_open failed! (%d)\n",
 281                                         rc, 0, 0 );
 282 #endif
 283                                 return rc;
 284                         }
 285                 }
 286
 287                 return rc;
 288         }
 289
 290         /* open each backend type */
 291         for( i = 0; i < nBackendInfo; i++ ) {
 292                 if( backendInfo[i].bi_nDB == 0) {
 293                         /* no database of this type, don't open */
 294                         continue;
 295                 }
 296
 297                 if( backendInfo[i].bi_open ) {
 298                         rc = backendInfo[i].bi_open(
 299                                 &backendInfo[i] );
 300                         if ( rc != 0 ) {
 301 #ifdef NEW_LOGGING
 302                                 LDAP_LOG( BACKEND, CRIT,
 303                                         "backend_startup: bi_open %d failed!\n", i, 0, 0 );
 304 #else
 305                                 Debug( LDAP_DEBUG_ANY,
 306                                         "backend_startup: bi_open %d failed!\n",
 307                                         i, 0, 0 );
 308 #endif
 309                                 return rc;
 310                         }
 311                 }
 312         }
 313
 314         /* open each backend database */
 315         for( i = 0; i < nBackendDB; i++ ) {
 316                 /* append global access controls */
 317                 acl_append( &backendDB[i].be_acl, global_acl );
 318
 319                 if ( backendDB[i].bd_info->bi_db_open ) {
 320                         rc = backendDB[i].bd_info->bi_db_open(
 321                                 &backendDB[i] );
 322                         if ( rc != 0 ) {
 323 #ifdef NEW_LOGGING
 324                                 LDAP_LOG( BACKEND, CRIT,
 325                                         "backend_startup: bi_db_open(%d) failed! (%d)\n", i, rc, 0 );
 326 #else
 327                                 Debug( LDAP_DEBUG_ANY,
 328                                         "backend_startup: bi_db_open(%d) failed! (%d)\n",
 329                                         i, rc, 0 );
 330 #endif
 331                                 return rc;
 332                         }
 333                 }
 334         }
 335
 336         return rc;
 337 }
 338
 339 int backend_num( Backend *be )
 340 {
 341         int i;
 342
 343         if( be == NULL ) return -1;
 344
 345         for( i = 0; i < nBackendDB; i++ ) {
 346                 if( be == &backendDB[i] ) return i;
 347         }
 348         return -1;
 349 }
 350
 351 int backend_shutdown( Backend *be )
 352 {
 353         int i;
 354         int rc = 0;
 355
 356         if( be != NULL ) {
 357                 /* shutdown a specific backend database */
 358
 359                 if ( be->bd_info->bi_nDB == 0 ) {
 360                         /* no database of this type, we never opened it */
 361                         return 0;
 362                 }
 363
 364                 if ( be->bd_info->bi_db_close ) {
 365                         be->bd_info->bi_db_close( be );
 366                 }
 367
 368                 if( be->bd_info->bi_close ) {
 369                         be->bd_info->bi_close( be->bd_info );
 370                 }
 371
 372                 return 0;
 373         }
 374
 375         /* close each backend database */
 376         for( i = 0; i < nBackendDB; i++ ) {
 377                 if ( backendDB[i].bd_info->bi_db_close ) {
 378                         backendDB[i].bd_info->bi_db_close(
 379                                 &backendDB[i] );
 380                 }
 381
 382                 if(rc != 0) {
 383 #ifdef NEW_LOGGING
 384                         LDAP_LOG( BACKEND, NOTICE,
 385                                 "backend_shutdown: bi_close %s failed!\n",
 386                                 backendDB[i].be_type, 0, 0 );
 387 #else
 388                         Debug( LDAP_DEBUG_ANY,
 389                                 "backend_close: bi_close %s failed!\n",
 390                                 backendDB[i].be_type, 0, 0 );
 391 #endif
 392                 }
 393         }
 394
 395         /* close each backend type */
 396         for( i = 0; i < nBackendInfo; i++ ) {
 397                 if( backendInfo[i].bi_nDB == 0 ) {
 398                         /* no database of this type */
 399                         continue;
 400                 }
 401
 402                 if( backendInfo[i].bi_close ) {
 403                         backendInfo[i].bi_close(
 404                                 &backendInfo[i] );
 405                 }
 406         }
 407
 408         return 0;
 409 }
 410
 411 int backend_destroy(void)
 412 {
 413         int i;
 414         BackendDB *bd;
 415
 416         /* destroy each backend database */
 417         for( i = 0, bd = backendDB; i < nBackendDB; i++, bd++ ) {
 418                 if ( bd->bd_info->bi_db_destroy ) {
 419                         bd->bd_info->bi_db_destroy( bd );
 420                 }
 421                 ber_bvarray_free( bd->be_suffix );
 422                 ber_bvarray_free( bd->be_nsuffix );
 423                 if ( bd->be_rootdn.bv_val ) free( bd->be_rootdn.bv_val );
 424                 if ( bd->be_rootndn.bv_val ) free( bd->be_rootndn.bv_val );
 425                 if ( bd->be_rootpw.bv_val ) free( bd->be_rootpw.bv_val );
 426                 acl_destroy( bd->be_acl, global_acl );
 427         }
 428         free( backendDB );
 429
 430         /* destroy each backend type */
 431         for( i = 0; i < nBackendInfo; i++ ) {
 432                 if( backendInfo[i].bi_destroy ) {
 433                         backendInfo[i].bi_destroy(
 434                                 &backendInfo[i] );
 435                 }
 436         }
 437
 438 #ifdef SLAPD_MODULES
 439         if (backendInfo != binfo) {
 440            free(backendInfo);
 441         }
 442 #endif /* SLAPD_MODULES */
 443
 444         nBackendInfo = 0;
 445         backendInfo = NULL;
 446
 447         return 0;
 448 }
 449
 450 BackendInfo* backend_info(const char *type)
 451 {
 452         int i;
 453
 454         /* search for the backend type */
 455         for( i = 0; i < nBackendInfo; i++ ) {
 456                 if( strcasecmp(backendInfo[i].bi_type, type) == 0 ) {
 457                         return &backendInfo[i];
 458                 }
 459         }
 460
 461         return NULL;
 462 }
 463
 464
 465 BackendDB *
 466 backend_db_init(
 467     const char  *type
 468 )
 469 {
 470         Backend *be;
 471         BackendInfo *bi = backend_info(type);
 472         int     rc = 0;
 473
 474         if( bi == NULL ) {
 475                 fprintf( stderr, "Unrecognized database type (%s)\n", type );
 476                 return NULL;
 477         }
 478
 479         backendDB = (BackendDB *) ch_realloc(
 480                         (char *) backendDB,
 481                     (nBackendDB + 1) * sizeof(Backend) );
 482
 483         memset( &backendDB[nbackends], '\0', sizeof(Backend) );
 484
 485         be = &backends[nbackends++];
 486
 487         be->bd_info = bi;
 488         be->be_def_limit = deflimit;
 489         be->be_dfltaccess = global_default_access;
 490
 491         be->be_restrictops = global_restrictops;
 492         be->be_requires = global_requires;
 493         be->be_ssf_set = global_ssf_set;
 494
 495         /* assign a default depth limit for alias deref */
 496         be->be_max_deref_depth = SLAPD_DEFAULT_MAXDEREFDEPTH;
 497
 498         if(bi->bi_db_init) {
 499                 rc = bi->bi_db_init( be );
 500         }
 501
 502         if(rc != 0) {
 503                 fprintf( stderr, "database init failed (%s)\n", type );
 504                 nbackends--;
 505                 return NULL;
 506         }
 507
 508         bi->bi_nDB++;
 509         return( be );
 510 }
 511
 512 void
 513 be_db_close( void )
 514 {
 515         int     i;
 516
 517         for ( i = 0; i < nbackends; i++ ) {
 518                 if ( backends[i].bd_info->bi_db_close ) {
 519                         (*backends[i].bd_info->bi_db_close)( &backends[i] );
 520                 }
 521         }
 522 }
 523
 524 Backend *
 525 select_backend(
 526         struct berval * dn,
 527         int manageDSAit,
 528         int noSubs )
 529 {
 530         int     i, j;
 531         ber_len_t len, dnlen = dn->bv_len;
 532         Backend *be = NULL;
 533
 534         for ( i = 0; i < nbackends; i++ ) {
 535                 for ( j = 0; backends[i].be_nsuffix != NULL &&
 536                     backends[i].be_nsuffix[j].bv_val != NULL; j++ )
 537                 {
 538                         if (( backends[i].be_flags & SLAP_BFLAG_GLUE_SUBORDINATE )
 539                                 && noSubs )
 540                         {
 541                                 continue;
 542                         }
 543
 544                         len = backends[i].be_nsuffix[j].bv_len;
 545
 546                         if ( len > dnlen ) {
 547                                 /* suffix is longer than DN */
 548                                 continue;
 549                         }
 550
 551                         /*
 552                          * input DN is normalized, so the separator check
 553                          * need not look at escaping
 554                          */
 555                         if ( len && len < dnlen &&
 556                                 !DN_SEPARATOR( dn->bv_val[(dnlen-len)-1] ))
 557                         {
 558                                 continue;
 559                         }
 560
 561                         if ( strcmp( backends[i].be_nsuffix[j].bv_val,
 562                                 &dn->bv_val[dnlen-len] ) == 0 )
 563                         {
 564                                 if( be == NULL ) {
 565                                         be = &backends[i];
 566
 567                                         if( manageDSAit && len == dnlen ) {
 568                                                 continue;
 569                                         }
 570                                 } else {
 571                                         be = &backends[i];
 572                                 }
 573                                 return be;
 574                         }
 575                 }
 576         }
 577
 578         return be;
 579 }
 580
 581 int
 582 be_issuffix(
 583     Backend     *be,
 584     struct berval       *bvsuffix
 585 )
 586 {
 587         int     i;
 588
 589         for ( i = 0; be->be_nsuffix != NULL && be->be_nsuffix[i].bv_val != NULL; i++ ) {
 590                 if ( bvmatch( &be->be_nsuffix[i], bvsuffix ) ) {
 591                         return( 1 );
 592                 }
 593         }
 594
 595         return( 0 );
 596 }
 597
 598 int
 599 be_isroot( Backend *be, struct berval *ndn )
 600 {
 601         if ( !ndn->bv_len ) {
 602                 return( 0 );
 603         }
 604
 605         if ( !be->be_rootndn.bv_len ) {
 606                 return( 0 );
 607         }
 608
 609         return dn_match( &be->be_rootndn, ndn );
 610 }
 611
 612 int
 613 be_isupdate( Backend *be, struct berval *ndn )
 614 {
 615         if ( !ndn->bv_len ) {
 616                 return( 0 );
 617         }
 618
 619         if ( !be->be_update_ndn.bv_len ) {
 620                 return( 0 );
 621         }
 622
 623         return dn_match( &be->be_update_ndn, ndn );
 624 }
 625
 626 struct berval *
 627 be_root_dn( Backend *be )
 628 {
 629         return &be->be_rootdn;
 630 }
 631
 632 int
 633 be_isroot_pw( Backend *be,
 634         Connection *conn,
 635         struct berval *ndn,
 636         struct berval *cred )
 637 {
 638         int result;
 639
 640         if ( ! be_isroot( be, ndn ) ) {
 641                 return 0;
 642         }
 643
 644         if( be->be_rootpw.bv_len == 0 ) {
 645                 return 0;
 646         }
 647
 648 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
 649         ldap_pvt_thread_mutex_lock( &passwd_mutex );
 650 #ifdef SLAPD_SPASSWD
 651         lutil_passwd_sasl_conn = conn->c_sasl_context;
 652 #endif
 653 #endif
 654
 655         result = lutil_passwd( &be->be_rootpw, cred, NULL );
 656
 657 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
 658 #ifdef SLAPD_SPASSWD
 659         lutil_passwd_sasl_conn = NULL;
 660 #endif
 661         ldap_pvt_thread_mutex_unlock( &passwd_mutex );
 662 #endif
 663
 664         return result == 0;
 665 }
 666
 667 int
 668 be_entry_release_rw(
 669         BackendDB *be,
 670         Connection *conn,
 671         Operation *op,
 672         Entry *e,
 673         int rw )
 674 {
 675         if ( be->be_release ) {
 676                 /* free and release entry from backend */
 677                 return be->be_release( be, conn, op, e, rw );
 678         } else {
 679                 /* free entry */
 680                 entry_free( e );
 681                 return 0;
 682         }
 683 }
 684
 685 int
 686 backend_unbind(
 687         Connection   *conn,
 688         Operation    *op
 689 )
 690 {
 691         int             i;
 692         int     rc;
 693         Slapi_PBlock *pb = op->o_pb;
 694
 695 #if defined( LDAP_SLAPI )
 696         slapi_pblock_set( pb, SLAPI_CONNECTION, (void *)conn );
 697         slapi_pblock_set( pb, SLAPI_OPERATION, (void *)op );
 698 #endif /* defined( LDAP_SLAPI ) */
 699
 700         for ( i = 0; i < nbackends; i++ ) {
 701 #if defined( LDAP_SLAPI )
 702                 slapi_pblock_set( pb, SLAPI_BACKEND, (void *)&backends[i] );
 703                 rc = doPluginFNs( &backends[i], SLAPI_PLUGIN_PRE_UNBIND_FN,
 704                                 (Slapi_PBlock *)pb );
 705                 if ( rc != 0 && rc != LDAP_OTHER ) {
 706                         /*
 707                          * either there is no preOp (unbind) plugins
 708                          * or a plugin failed. Just log it.
 709                          *
 710                          * FIXME: is this correct?
 711                          */
 712 #ifdef NEW_LOGGING
 713                         LDAP_LOG(( "operation", LDAP_LEVEL_INFO, "do_bind: Unbind preOps failed\n"));
 714 #else
 715                         Debug (LDAP_DEBUG_TRACE, " Unbind preOps failed.\n", 0, 0, 0);
 716 #endif
 717                 }
 718 #endif /* defined( LDAP_SLAPI ) */
 719
 720                 if ( backends[i].be_unbind ) {
 721                         (*backends[i].be_unbind)( &backends[i], conn, op );
 722                 }
 723
 724 #if defined( LDAP_SLAPI )
 725                 rc = doPluginFNs( &backends[i], SLAPI_PLUGIN_POST_UNBIND_FN,
 726                                 (Slapi_PBlock *)pb );
 727                 if ( rc != 0 && rc != LDAP_OTHER ) {
 728                         /*
 729                          * either there is no postOp (unbind) plugins
 730                          * or a plugin failed. Just log it.
 731                          *
 732                          * FIXME: is this correct?
 733                          */
 734 #ifdef NEW_LOGGING
 735                         LDAP_LOG(( "operation", LDAP_LEVEL_INFO, "do_unbind: Unbind postOps failed\n"));
 736 #else
 737                         Debug (LDAP_DEBUG_TRACE, " Unbind postOps failed.\n", 0, 0, 0);
 738 #endif
 739                 }
 740 #endif /* defined( LDAP_SLAPI ) */
 741         }
 742
 743         return 0;
 744 }
 745
 746 int
 747 backend_connection_init(
 748         Connection   *conn
 749 )
 750 {
 751         int     i;
 752
 753         for ( i = 0; i < nbackends; i++ ) {
 754                 if ( backends[i].be_connection_init ) {
 755                         (*backends[i].be_connection_init)( &backends[i], conn);
 756                 }
 757         }
 758
 759         return 0;
 760 }
 761
 762 int
 763 backend_connection_destroy(
 764         Connection   *conn
 765 )
 766 {
 767         int     i;
 768
 769         for ( i = 0; i < nbackends; i++ ) {
 770                 if ( backends[i].be_connection_destroy ) {
 771                         (*backends[i].be_connection_destroy)( &backends[i], conn);
 772                 }
 773         }
 774
 775         return 0;
 776 }
 777
 778 static int
 779 backend_check_controls(
 780         Backend *be,
 781         Connection *conn,
 782         Operation *op,
 783         const char **text )
 784 {
 785         LDAPControl **ctrls = op->o_ctrls;
 786
 787         if( ctrls == NULL ) return LDAP_SUCCESS;
 788
 789         for( ; *ctrls != NULL ; ctrls++ ) {
 790                 if( (*ctrls)->ldctl_iscritical &&
 791                         !ldap_charray_inlist( be->be_controls, (*ctrls)->ldctl_oid ) )
 792                 {
 793                         *text = "control unavailable in context";
 794                         return LDAP_UNAVAILABLE_CRITICAL_EXTENSION;
 795                 }
 796         }
 797
 798         return LDAP_SUCCESS;
 799 }
 800
 801 int
 802 backend_check_restrictions(
 803         Backend *be,
 804         Connection *conn,
 805         Operation *op,
 806         struct berval *opdata,
 807         const char **text )
 808 {
 809         int rc;
 810         slap_mask_t restrictops;
 811         slap_mask_t requires;
 812         slap_mask_t opflag;
 813         slap_ssf_set_t *ssf;
 814         int updateop = 0;
 815         int starttls = 0;
 816         int session = 0;
 817
 818         if( be ) {
 819                 rc = backend_check_controls( be, conn, op, text );
 820
 821                 if( rc != LDAP_SUCCESS ) {
 822                         return rc;
 823                 }
 824
 825                 restrictops = be->be_restrictops;
 826                 requires = be->be_requires;
 827                 ssf = &be->be_ssf_set;
 828
 829         } else {
 830                 restrictops = global_restrictops;
 831                 requires = global_requires;
 832                 ssf = &global_ssf_set;
 833         }
 834
 835         switch( op->o_tag ) {
 836         case LDAP_REQ_ADD:
 837                 opflag = SLAP_RESTRICT_OP_ADD;
 838                 updateop++;
 839                 break;
 840         case LDAP_REQ_BIND:
 841                 opflag = SLAP_RESTRICT_OP_BIND;
 842                 session++;
 843                 break;
 844         case LDAP_REQ_COMPARE:
 845                 opflag = SLAP_RESTRICT_OP_COMPARE;
 846                 break;
 847         case LDAP_REQ_DELETE:
 848                 updateop++;
 849                 opflag = SLAP_RESTRICT_OP_DELETE;
 850                 break;
 851         case LDAP_REQ_EXTENDED:
 852                 opflag = SLAP_RESTRICT_OP_EXTENDED;
 853
 854                 if( !opdata ) {
 855                         /* treat unspecified as a modify */
 856                         opflag = SLAP_RESTRICT_OP_MODIFY;
 857                         updateop++;
 858                         break;
 859                 }
 860
 861                 {
 862                         struct berval bv = BER_BVC( LDAP_EXOP_START_TLS );
 863                         if( bvmatch( opdata, &bv ) ) {
 864                                 session++;
 865                                 starttls++;
 866                                 break;
 867                         }
 868                 }
 869
 870                 {
 871                         struct berval bv = BER_BVC( LDAP_EXOP_X_WHO_AM_I );
 872                         if( bvmatch( opdata, &bv ) ) {
 873                                 break;
 874                         }
 875                 }
 876
 877                 /* treat everything else as a modify */
 878                 opflag = SLAP_RESTRICT_OP_MODIFY;
 879                 updateop++;
 880                 break;
 881
 882         case LDAP_REQ_MODIFY:
 883                 updateop++;
 884                 opflag = SLAP_RESTRICT_OP_MODIFY;
 885                 break;
 886         case LDAP_REQ_RENAME:
 887                 updateop++;
 888                 opflag = SLAP_RESTRICT_OP_RENAME;
 889                 break;
 890         case LDAP_REQ_SEARCH:
 891                 opflag = SLAP_RESTRICT_OP_SEARCH;
 892                 break;
 893         case LDAP_REQ_UNBIND:
 894                 session++;
 895                 opflag = 0;
 896                 break;
 897         default:
 898                 *text = "restrict operations internal error";
 899                 return LDAP_OTHER;
 900         }
 901
 902         if ( !starttls ) {
 903                 /* these checks don't apply to StartTLS */
 904
 905                 if( op->o_transport_ssf < ssf->sss_transport ) {
 906                         *text = "transport confidentiality required";
 907                         return LDAP_CONFIDENTIALITY_REQUIRED;
 908                 }
 909
 910                 if( op->o_tls_ssf < ssf->sss_tls ) {
 911                         *text = "TLS confidentiality required";
 912                         return LDAP_CONFIDENTIALITY_REQUIRED;
 913                 }
 914
 915
 916                 if( op->o_tag == LDAP_REQ_BIND && opdata == NULL ) {
 917                         /* simple bind specific check */
 918                         if( op->o_ssf < ssf->sss_simple_bind ) {
 919                                 *text = "confidentiality required";
 920                                 return LDAP_CONFIDENTIALITY_REQUIRED;
 921                         }
 922                 }
 923
 924                 if( op->o_tag != LDAP_REQ_BIND || opdata == NULL ) {
 925                         /* these checks don't apply to SASL bind */
 926
 927                         if( op->o_sasl_ssf < ssf->sss_sasl ) {
 928                                 *text = "SASL confidentiality required";
 929                                 return LDAP_CONFIDENTIALITY_REQUIRED;
 930                         }
 931
 932                         if( op->o_ssf < ssf->sss_ssf ) {
 933                                 *text = "confidentiality required";
 934                                 return LDAP_CONFIDENTIALITY_REQUIRED;
 935                         }
 936                 }
 937
 938                 if( updateop ) {
 939                         if( op->o_transport_ssf < ssf->sss_update_transport ) {
 940                                 *text = "transport update confidentiality required";
 941                                 return LDAP_CONFIDENTIALITY_REQUIRED;
 942                         }
 943
 944                         if( op->o_tls_ssf < ssf->sss_update_tls ) {
 945                                 *text = "TLS update confidentiality required";
 946                                 return LDAP_CONFIDENTIALITY_REQUIRED;
 947                         }
 948
 949                         if( op->o_sasl_ssf < ssf->sss_update_sasl ) {
 950                                 *text = "SASL update confidentiality required";
 951                                 return LDAP_CONFIDENTIALITY_REQUIRED;
 952                         }
 953
 954                         if( op->o_ssf < ssf->sss_update_ssf ) {
 955                                 *text = "update confidentiality required";
 956                                 return LDAP_CONFIDENTIALITY_REQUIRED;
 957                         }
 958
 959                         if( !( global_allows & SLAP_ALLOW_UPDATE_ANON ) &&
 960                                 op->o_ndn.bv_len == 0 )
 961                         {
 962                                 *text = "modifications require authentication";
 963                                 return LDAP_STRONG_AUTH_REQUIRED;
 964                         }
 965
 966 #ifdef SLAP_X_LISTENER_MOD
 967                         if ( ! ( conn->c_listener->sl_perms & S_IWUSR ) ) {
 968                                 /* no "w" mode means readonly */
 969                                 *text = "modifications not allowed on this listener";
 970                                 return LDAP_UNWILLING_TO_PERFORM;
 971                         }
 972 #endif /* SLAP_X_LISTENER_MOD */
 973                 }
 974         }
 975
 976         if ( !session ) {
 977                 /* these checks don't apply to Bind, StartTLS, or Unbind */
 978
 979                 if( requires & SLAP_REQUIRE_STRONG ) {
 980                         /* should check mechanism */
 981                         if( ( op->o_transport_ssf < ssf->sss_transport
 982                                 && op->o_authmech.bv_len == 0 ) || op->o_dn.bv_len == 0 )
 983                         {
 984                                 *text = "strong authentication required";
 985                                 return LDAP_STRONG_AUTH_REQUIRED;
 986                         }
 987                 }
 988
 989                 if( requires & SLAP_REQUIRE_SASL ) {
 990                         if( op->o_authmech.bv_len == 0 || op->o_dn.bv_len == 0 ) {
 991                                 *text = "SASL authentication required";
 992                                 return LDAP_STRONG_AUTH_REQUIRED;
 993                         }
 994                 }
 995
 996                 if( requires & SLAP_REQUIRE_AUTHC ) {
 997                         if( op->o_dn.bv_len == 0 ) {
 998                                 *text = "authentication required";
 999                                 return LDAP_UNWILLING_TO_PERFORM;
1000                         }
1001                 }
1002
1003                 if( requires & SLAP_REQUIRE_BIND ) {
1004                         int version;
1005                         ldap_pvt_thread_mutex_lock( &conn->c_mutex );
1006                         version = conn->c_protocol;
1007                         ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
1008
1009                         if( !version ) {
1010                                 /* no bind has occurred */
1011                                 *text = "BIND required";
1012                                 return LDAP_OPERATIONS_ERROR;
1013                         }
1014                 }
1015
1016                 if( requires & SLAP_REQUIRE_LDAP_V3 ) {
1017                         if( op->o_protocol < LDAP_VERSION3 ) {
1018                                 /* no bind has occurred */
1019                                 *text = "operation restricted to LDAPv3 clients";
1020                                 return LDAP_OPERATIONS_ERROR;
1021                         }
1022                 }
1023
1024 #ifdef SLAP_X_LISTENER_MOD
1025                 if ( !starttls && op->o_dn.bv_len == 0 ) {
1026                         if ( ! ( conn->c_listener->sl_perms & S_IXUSR ) ) {
1027                                 /* no "x" mode means bind required */
1028                                 *text = "bind required on this listener";
1029                                 return LDAP_STRONG_AUTH_REQUIRED;
1030                         }
1031                 }
1032
1033                 if ( !starttls && !updateop ) {
1034                         if ( ! ( conn->c_listener->sl_perms & S_IRUSR ) ) {
1035                                 /* no "r" mode means no read */
1036                                 *text = "read not allowed on this listener";
1037                                 return LDAP_UNWILLING_TO_PERFORM;
1038                         }
1039                 }
1040 #endif /* SLAP_X_LISTENER_MOD */
1041
1042         }
1043
1044         if( restrictops & opflag ) {
1045                 if( restrictops == SLAP_RESTRICT_OP_READS ) {
1046                         *text = "read operations restricted";
1047                 } else {
1048                         *text = "operation restricted";
1049                 }
1050                 return LDAP_UNWILLING_TO_PERFORM;
1051         }
1052
1053         return LDAP_SUCCESS;
1054 }
1055
1056 int backend_check_referrals(
1057         Backend *be,
1058         Connection *conn,
1059         Operation *op,
1060         struct berval *dn,
1061         struct berval *ndn )
1062 {
1063         int rc = LDAP_SUCCESS;
1064
1065         if( be->be_chk_referrals ) {
1066                 const char *text;
1067
1068                 rc = be->be_chk_referrals( be,
1069                         conn, op, dn, ndn, &text );
1070
1071                 if( rc != LDAP_SUCCESS && rc != LDAP_REFERRAL ) {
1072                         send_ldap_result( conn, op, rc,
1073                                 NULL, text, NULL, NULL );
1074                 }
1075         }
1076
1077         return rc;
1078 }
1079
1080 int
1081 backend_group(
1082         Backend *be,
1083         Connection *conn,
1084         Operation *op,
1085         Entry   *target,
1086         struct berval *gr_ndn,
1087         struct berval *op_ndn,
1088         ObjectClass *group_oc,
1089         AttributeDescription *group_at
1090 )
1091 {
1092         GroupAssertion *g;
1093
1094         if ( op->o_abandon ) return SLAPD_ABANDON;
1095
1096         if ( !dn_match( &target->e_nname, gr_ndn ) ) {
1097                 /* we won't attempt to send it to a different backend */
1098
1099                 be = select_backend( gr_ndn, 0, 0 );
1100
1101                 if (be == NULL) {
1102                         return LDAP_NO_SUCH_OBJECT;
1103                 }
1104         }
1105
1106         ldap_pvt_thread_mutex_lock( &conn->c_mutex );
1107
1108         for (g = conn->c_groups; g; g=g->ga_next) {
1109                 if (g->ga_be != be || g->ga_oc != group_oc ||
1110                         g->ga_at != group_at || g->ga_len != gr_ndn->bv_len)
1111                         continue;
1112                 if (strcmp( g->ga_ndn, gr_ndn->bv_val ) == 0)
1113                         break;
1114         }
1115
1116         ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
1117
1118         if (g) {
1119                 return g->ga_res;
1120         }
1121
1122         if( be->be_group ) {
1123                 int res = be->be_group( be, conn, op,
1124                         target, gr_ndn, op_ndn,
1125                         group_oc, group_at );
1126
1127                 if ( op->o_tag != LDAP_REQ_BIND && !op->o_do_not_cache ) {
1128                         g = ch_malloc(sizeof(GroupAssertion) + gr_ndn->bv_len);
1129                         g->ga_be = be;
1130                         g->ga_oc = group_oc;
1131                         g->ga_at = group_at;
1132                         g->ga_res = res;
1133                         g->ga_len = gr_ndn->bv_len;
1134                         strcpy(g->ga_ndn, gr_ndn->bv_val);
1135                         ldap_pvt_thread_mutex_lock( &conn->c_mutex );
1136                         g->ga_next = conn->c_groups;
1137                         conn->c_groups = g;
1138                         ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
1139                 }
1140
1141                 return res;
1142         }
1143
1144         return LDAP_UNWILLING_TO_PERFORM;
1145 }
1146
1147 int
1148 backend_attribute(
1149         Backend *be,
1150         Connection *conn,
1151         Operation *op,
1152         Entry   *target,
1153         struct berval   *edn,
1154         AttributeDescription *entry_at,
1155         BerVarray *vals
1156 )
1157 {
1158         if ( target == NULL || !dn_match( &target->e_nname, edn ) ) {
1159                 /* we won't attempt to send it to a different backend */
1160
1161                 be = select_backend( edn, 0, 0 );
1162
1163                 if (be == NULL) {
1164                         return LDAP_NO_SUCH_OBJECT;
1165                 }
1166         }
1167
1168         if( be->be_attribute ) {
1169                 return be->be_attribute( be, conn, op, target, edn,
1170                         entry_at, vals );
1171         }
1172
1173         return LDAP_UNWILLING_TO_PERFORM;
1174 }
1175
1176 Attribute *backend_operational(
1177         Backend *be,
1178         Connection *conn,
1179         Operation *op,
1180         Entry *e,
1181         AttributeName *attrs,
1182         int opattrs     )
1183 {
1184         Attribute *a = NULL, **ap = &a;
1185
1186         /*
1187          * If operational attributes (allegedly) are required,
1188          * and the backend supports specific operational attributes,
1189          * add them to the attribute list
1190          */
1191         if ( opattrs || ( attrs &&
1192                 ad_inlist( slap_schema.si_ad_subschemaSubentry, attrs )) ) {
1193                 *ap = slap_operational_subschemaSubentry( be );
1194                 ap = &(*ap)->a_next;
1195         }
1196
1197         if ( ( opattrs || attrs ) && be && be->be_operational != NULL ) {
1198                 ( void )be->be_operational( be, conn, op, e, attrs, opattrs, ap );
1199         }
1200
1201         return a;
1202 }
1203