git.sur5r.net Git - openldap/blob - servers/slapd/controls.c

   1 /* $OpenLDAP$ */
   2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   3  *
   4  * Copyright 1998-2004 The OpenLDAP Foundation.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted only as authorized by the OpenLDAP
   9  * Public License.
  10  *
  11  * A copy of this license is available in the file LICENSE in the
  12  * top-level directory of the distribution or, alternatively, at
  13  * <http://www.OpenLDAP.org/license.html>.
  14  */
  15
  16 #include "portable.h"
  17
  18 #include <stdio.h>
  19
  20 #include <ac/string.h>
  21 #include <ac/socket.h>
  22
  23 #include "slap.h"
  24
  25 #include "../../libraries/liblber/lber-int.h"
  26
  27 static SLAP_CTRL_PARSE_FN parseAssert;
  28 static SLAP_CTRL_PARSE_FN parsePreRead;
  29 static SLAP_CTRL_PARSE_FN parsePostRead;
  30 static SLAP_CTRL_PARSE_FN parseProxyAuthz;
  31 static SLAP_CTRL_PARSE_FN parseManageDSAit;
  32 static SLAP_CTRL_PARSE_FN parseModifyIncrement;
  33 static SLAP_CTRL_PARSE_FN parseNoOp;
  34 static SLAP_CTRL_PARSE_FN parsePagedResults;
  35 static SLAP_CTRL_PARSE_FN parseValuesReturnFilter;
  36 static SLAP_CTRL_PARSE_FN parsePermissiveModify;
  37 static SLAP_CTRL_PARSE_FN parseDomainScope;
  38 static SLAP_CTRL_PARSE_FN parseTreeDelete;
  39 static SLAP_CTRL_PARSE_FN parseSearchOptions;
  40
  41 #ifdef LDAP_CONTROL_SUBENTRIES
  42 static SLAP_CTRL_PARSE_FN parseSubentries;
  43 #endif
  44 static SLAP_CTRL_PARSE_FN parseLDAPsync;
  45
  46 #undef sc_mask /* avoid conflict with Irix 6.5 <sys/signal.h> */
  47
  48 const struct berval slap_pre_read_bv = BER_BVC(LDAP_CONTROL_PRE_READ);
  49 const struct berval slap_post_read_bv = BER_BVC(LDAP_CONTROL_POST_READ);
  50
  51 struct slap_control {
  52         /* Control OID */
  53         char *sc_oid;
  54
  55         /* Operations supported by control */
  56         slap_mask_t sc_mask;
  57
  58         /* Extended operations supported by control */
  59         char **sc_extendedops;
  60
  61         /* Control parsing callback */
  62         SLAP_CTRL_PARSE_FN *sc_parse;
  63
  64         LDAP_SLIST_ENTRY(slap_control) sc_next;
  65 };
  66
  67 static LDAP_SLIST_HEAD(ControlsList, slap_control) controls_list
  68         = LDAP_SLIST_HEAD_INITIALIZER(&controls_list);
  69
  70 /*
  71  * all known request control OIDs should be added to this list
  72  */
  73 char **slap_known_controls = NULL;
  74
  75 static char *proxy_authz_extops[] = {
  76         LDAP_EXOP_MODIFY_PASSWD,
  77         LDAP_EXOP_X_WHO_AM_I,
  78         NULL
  79 };
  80
  81 static struct slap_control control_defs[] = {
  82         { LDAP_CONTROL_ASSERT,
  83                 SLAP_CTRL_HIDE|SLAP_CTRL_ACCESS, NULL,
  84                 parseAssert, LDAP_SLIST_ENTRY_INITIALIZER(next) },
  85         { LDAP_CONTROL_PRE_READ,
  86                 SLAP_CTRL_HIDE|SLAP_CTRL_DELETE|SLAP_CTRL_MODIFY|SLAP_CTRL_RENAME, NULL,
  87                 parsePreRead, LDAP_SLIST_ENTRY_INITIALIZER(next) },
  88         { LDAP_CONTROL_POST_READ,
  89                 SLAP_CTRL_HIDE|SLAP_CTRL_ADD|SLAP_CTRL_MODIFY|SLAP_CTRL_RENAME, NULL,
  90                 parsePostRead, LDAP_SLIST_ENTRY_INITIALIZER(next) },
  91         { LDAP_CONTROL_VALUESRETURNFILTER,
  92                 SLAP_CTRL_SEARCH, NULL,
  93                 parseValuesReturnFilter, LDAP_SLIST_ENTRY_INITIALIZER(next) },
  94         { LDAP_CONTROL_PAGEDRESULTS,
  95                 SLAP_CTRL_SEARCH, NULL,
  96                 parsePagedResults, LDAP_SLIST_ENTRY_INITIALIZER(next) },
  97 #ifdef LDAP_CONTROL_X_DOMAIN_SCOPE
  98         { LDAP_CONTROL_X_DOMAIN_SCOPE,
  99                 SLAP_CTRL_FRONTEND|SLAP_CTRL_SEARCH, NULL,
 100                 parseDomainScope, LDAP_SLIST_ENTRY_INITIALIZER(next) },
 101 #endif
 102 #ifdef LDAP_CONTROL_X_PERMISSIVE_MODIFY
 103         { LDAP_CONTROL_X_PERMISSIVE_MODIFY,
 104                 SLAP_CTRL_MODIFY, NULL,
 105                 parsePermissiveModify, LDAP_SLIST_ENTRY_INITIALIZER(next) },
 106 #endif
 107 #ifdef LDAP_CONTROL_X_TREE_DELETE
 108         { LDAP_CONTROL_X_TREE_DELETE,
 109                 SLAP_CTRL_DELETE, NULL,
 110                 parseTreeDelete, LDAP_SLIST_ENTRY_INITIALIZER(next) },
 111 #endif
 112 #ifdef LDAP_CONTORL_X_SEARCH_OPTIONS
 113         { LDAP_CONTORL_X_SEARCH_OPTIONS,
 114                 SLAP_CTRL_FRONTEND|SLAP_CTRL_SEARCH, NULL,
 115                 parseSearchOptions, LDAP_SLIST_ENTRY_INITIALIZER(next) },
 116 #endif
 117 #ifdef LDAP_CONTROL_SUBENTRIES
 118         { LDAP_CONTROL_SUBENTRIES,
 119                 SLAP_CTRL_SEARCH, NULL,
 120                 parseSubentries, LDAP_SLIST_ENTRY_INITIALIZER(next) },
 121 #endif
 122         { LDAP_CONTROL_NOOP,
 123                 SLAP_CTRL_HIDE|SLAP_CTRL_ACCESS, NULL,
 124                 parseNoOp, LDAP_SLIST_ENTRY_INITIALIZER(next) },
 125         { LDAP_CONTROL_SYNC,
 126                 SLAP_CTRL_HIDE|SLAP_CTRL_SEARCH, NULL,
 127                 parseLDAPsync, LDAP_SLIST_ENTRY_INITIALIZER(next) },
 128 #ifdef LDAP_CONTROL_MODIFY_INCREMENT
 129         { LDAP_CONTROL_MODIFY_INCREMENT,
 130                 SLAP_CTRL_HIDE|SLAP_CTRL_MODIFY, NULL,
 131                 parseModifyIncrement, LDAP_SLIST_ENTRY_INITIALIZER(next) },
 132 #endif
 133         { LDAP_CONTROL_MANAGEDSAIT,
 134                 SLAP_CTRL_ACCESS, NULL,
 135                 parseManageDSAit, LDAP_SLIST_ENTRY_INITIALIZER(next) },
 136         { LDAP_CONTROL_PROXY_AUTHZ,
 137                 SLAP_CTRL_FRONTEND|SLAP_CTRL_ACCESS, proxy_authz_extops,
 138                 parseProxyAuthz, LDAP_SLIST_ENTRY_INITIALIZER(next) },
 139         { NULL, 0, NULL, 0, LDAP_SLIST_ENTRY_INITIALIZER(next) }
 140 };
 141
 142 /*
 143  * Register a supported control.
 144  *
 145  * This can be called by an OpenLDAP plugin or, indirectly, by a
 146  * SLAPI plugin calling slapi_register_supported_control().
 147  */
 148 int
 149 register_supported_control(const char *controloid,
 150         slap_mask_t controlmask,
 151         char **controlexops,
 152         SLAP_CTRL_PARSE_FN *controlparsefn)
 153 {
 154         struct slap_control *sc;
 155         int i;
 156
 157         if ( controloid == NULL ) {
 158                 return LDAP_PARAM_ERROR;
 159         }
 160
 161         sc = (struct slap_control *)SLAP_MALLOC( sizeof( *sc ) );
 162         if ( sc == NULL ) {
 163                 return LDAP_NO_MEMORY;
 164         }
 165         sc->sc_oid = ch_strdup( controloid );
 166         sc->sc_mask = controlmask;
 167         if ( controlexops != NULL ) {
 168                 sc->sc_extendedops = ldap_charray_dup( controlexops );
 169                 if ( sc->sc_extendedops == NULL ) {
 170                         ch_free( sc );
 171                         return LDAP_NO_MEMORY;
 172                 }
 173         } else {
 174                 sc->sc_extendedops = NULL;
 175         }
 176         sc->sc_parse = controlparsefn;
 177
 178         /* Update slap_known_controls, too. */
 179         if ( slap_known_controls == NULL ) {
 180                 slap_known_controls = (char **)SLAP_MALLOC( 2 * sizeof(char *) );
 181                 if ( slap_known_controls == NULL ) {
 182                         if ( sc->sc_extendedops != NULL ) ldap_charray_free( sc->sc_extendedops );
 183                         ch_free( sc );
 184                         return LDAP_NO_MEMORY;
 185                 }
 186                 slap_known_controls[0] = ch_strdup( sc->sc_oid );
 187                 slap_known_controls[1] = NULL;
 188         } else {
 189                 for ( i = 0; slap_known_controls[i] != NULL; i++ )
 190                         ;
 191                 slap_known_controls = (char **)SLAP_REALLOC( slap_known_controls, (i + 2) * sizeof(char *) );
 192                 if ( slap_known_controls == NULL ) {
 193                         if ( sc->sc_extendedops != NULL ) ldap_charray_free( sc->sc_extendedops );
 194                         ch_free( sc );
 195                         return LDAP_NO_MEMORY;
 196                 }
 197                 slap_known_controls[i++] = ch_strdup( sc->sc_oid );
 198                 slap_known_controls[i] = NULL;
 199         }
 200
 201         LDAP_SLIST_NEXT( sc, sc_next ) = NULL;
 202         LDAP_SLIST_INSERT_HEAD( &controls_list, sc, sc_next );
 203
 204         return LDAP_SUCCESS;
 205 }
 206
 207 /*
 208  * One-time initialization of internal controls.
 209  */
 210 int
 211 slap_controls_init( void )
 212 {
 213         int i, rc;
 214         struct slap_control *sc;
 215
 216         rc = LDAP_SUCCESS;
 217
 218         for ( i = 0; control_defs[i].sc_oid != NULL; i++ ) {
 219                 rc = register_supported_control( control_defs[i].sc_oid,
 220                         control_defs[i].sc_mask, control_defs[i].sc_extendedops,
 221                         control_defs[i].sc_parse );
 222                 if ( rc != LDAP_SUCCESS )
 223                         break;
 224         }
 225
 226         return rc;
 227 }
 228
 229 /*
 230  * Free memory associated with list of supported controls.
 231  */
 232 void
 233 controls_destroy( void )
 234 {
 235         struct slap_control *sc;
 236
 237         while ( !LDAP_SLIST_EMPTY(&controls_list) ) {
 238                 sc = LDAP_SLIST_FIRST(&controls_list);
 239                 LDAP_SLIST_REMOVE_HEAD(&controls_list, sc_next);
 240
 241                 ch_free( sc->sc_oid );
 242                 if ( sc->sc_extendedops != NULL ) {
 243                         ldap_charray_free( sc->sc_extendedops );
 244                 }
 245                 ch_free( sc );
 246         }
 247         ldap_charray_free( slap_known_controls );
 248 }
 249
 250 /*
 251  * Format the supportedControl attribute of the root DSE,
 252  * detailing which controls are supported by the directory
 253  * server.
 254  */
 255 int
 256 controls_root_dse_info( Entry *e )
 257 {
 258         AttributeDescription *ad_supportedControl
 259                 = slap_schema.si_ad_supportedControl;
 260         struct berval vals[2];
 261         struct slap_control *sc;
 262
 263         vals[1].bv_val = NULL;
 264         vals[1].bv_len = 0;
 265
 266         LDAP_SLIST_FOREACH( sc, &controls_list, sc_next ) {
 267                 if( sc->sc_mask & SLAP_CTRL_HIDE ) continue;
 268
 269                 vals[0].bv_val = sc->sc_oid;
 270                 vals[0].bv_len = strlen( sc->sc_oid );
 271
 272                 if ( attr_merge( e, ad_supportedControl, vals, NULL ) ) {
 273                         return -1;
 274                 }
 275         }
 276
 277         return 0;
 278 }
 279
 280 /*
 281  * Return a list of OIDs and operation masks for supported
 282  * controls. Used by SLAPI.
 283  */
 284 int
 285 get_supported_controls(char ***ctrloidsp,
 286         slap_mask_t **ctrlmasks)
 287 {
 288         int i, n;
 289         char **oids;
 290         slap_mask_t *masks;
 291         int rc;
 292         struct slap_control *sc;
 293
 294         n = 0;
 295
 296         LDAP_SLIST_FOREACH( sc, &controls_list, sc_next ) {
 297                 n++;
 298         }
 299
 300         if ( n == 0 ) {
 301                 *ctrloidsp = NULL;
 302                 *ctrlmasks = NULL;
 303                 return LDAP_SUCCESS;
 304         }
 305
 306         oids = (char **)SLAP_MALLOC( (n + 1) * sizeof(char *) );
 307         if ( oids == NULL ) {
 308                 return LDAP_NO_MEMORY;
 309         }
 310         masks = (slap_mask_t *)SLAP_MALLOC( (n + 1) * sizeof(slap_mask_t) );
 311         if  ( masks == NULL ) {
 312                 ch_free( oids );
 313                 return LDAP_NO_MEMORY;
 314         }
 315
 316         n = 0;
 317
 318         LDAP_SLIST_FOREACH( sc, &controls_list, sc_next ) {
 319                 oids[n] = ch_strdup( sc->sc_oid );
 320                 masks[n] = sc->sc_mask;
 321                 n++;
 322         }
 323         oids[n] = NULL;
 324         masks[n] = 0;
 325
 326         *ctrloidsp = oids;
 327         *ctrlmasks = masks;
 328
 329         return LDAP_SUCCESS;
 330 }
 331
 332 /*
 333  * Find a control given its OID.
 334  */
 335 static struct slap_control *
 336 find_ctrl( const char *oid )
 337 {
 338         struct slap_control *sc;
 339
 340         LDAP_SLIST_FOREACH( sc, &controls_list, sc_next ) {
 341                 if ( strcmp( oid, sc->sc_oid ) == 0 ) {
 342                         return sc;
 343                 }
 344         }
 345
 346         return NULL;
 347 }
 348
 349 void slap_free_ctrls(
 350         Operation *op,
 351         LDAPControl **ctrls
 352 )
 353 {
 354         int i;
 355
 356         for (i=0; ctrls[i]; i++) {
 357                 op->o_tmpfree(ctrls[i], op->o_tmpmemctx );
 358         }
 359         op->o_tmpfree( ctrls, op->o_tmpmemctx );
 360 }
 361
 362 int get_ctrls(
 363         Operation *op,
 364         SlapReply *rs,
 365         int sendres )
 366 {
 367         int nctrls = 0;
 368         ber_tag_t tag;
 369         ber_len_t len;
 370         char *opaque;
 371         BerElement *ber = op->o_ber;
 372         struct slap_control *sc;
 373         struct berval bv;
 374
 375         len = ber_pvt_ber_remaining(ber);
 376
 377         if( len == 0) {
 378                 /* no controls */
 379                 rs->sr_err = LDAP_SUCCESS;
 380                 return rs->sr_err;
 381         }
 382
 383         if(( tag = ber_peek_tag( ber, &len )) != LDAP_TAG_CONTROLS ) {
 384                 if( tag == LBER_ERROR ) {
 385                         rs->sr_err = SLAPD_DISCONNECT;
 386                         rs->sr_text = "unexpected data in PDU";
 387                 }
 388
 389                 goto return_results;
 390         }
 391
 392 #ifdef NEW_LOGGING
 393         LDAP_LOG( OPERATION, ENTRY,
 394                 "get_ctrls: conn %lu\n", op->o_connid, 0, 0 );
 395 #else
 396         Debug( LDAP_DEBUG_TRACE,
 397                 "=> get_ctrls\n", 0, 0, 0 );
 398 #endif
 399
 400         if( op->o_protocol < LDAP_VERSION3 ) {
 401                 rs->sr_err = SLAPD_DISCONNECT;
 402                 rs->sr_text = "controls require LDAPv3";
 403                 goto return_results;
 404         }
 405
 406         /* one for first control, one for termination */
 407         op->o_ctrls = op->o_tmpalloc( 2 * sizeof(LDAPControl *), op->o_tmpmemctx );
 408
 409 #if 0
 410         if( op->ctrls == NULL ) {
 411                 rs->sr_err = LDAP_NO_MEMORY;
 412                 rs->sr_text = "no memory";
 413                 goto return_results;
 414         }
 415 #endif
 416
 417         op->o_ctrls[nctrls] = NULL;
 418
 419         /* step through each element */
 420         for( tag = ber_first_element( ber, &len, &opaque );
 421                 tag != LBER_ERROR;
 422                 tag = ber_next_element( ber, &len, opaque ) )
 423         {
 424                 LDAPControl *c;
 425                 LDAPControl **tctrls;
 426
 427                 c = op->o_tmpalloc( sizeof(LDAPControl), op->o_tmpmemctx );
 428                 memset(c, 0, sizeof(LDAPControl));
 429
 430                 /* allocate pointer space for current controls (nctrls)
 431                  * + this control + extra NULL
 432                  */
 433                 tctrls = op->o_tmprealloc( op->o_ctrls,
 434                         (nctrls+2) * sizeof(LDAPControl *), op->o_tmpmemctx );
 435
 436 #if 0
 437                 if( tctrls == NULL ) {
 438                         ch_free( c );
 439                         ldap_controls_free(op->o_ctrls);
 440                         op->o_ctrls = NULL;
 441
 442                         rs->sr_err = LDAP_NO_MEMORY;
 443                         rs->sr_text = "no memory";
 444                         goto return_results;
 445                 }
 446 #endif
 447                 op->o_ctrls = tctrls;
 448
 449                 op->o_ctrls[nctrls++] = c;
 450                 op->o_ctrls[nctrls] = NULL;
 451
 452                 tag = ber_scanf( ber, "{m" /*}*/, &bv );
 453                 c->ldctl_oid = bv.bv_val;
 454
 455                 if( tag == LBER_ERROR ) {
 456 #ifdef NEW_LOGGING
 457                         LDAP_LOG( OPERATION, INFO, "get_ctrls: conn %lu get OID failed.\n",
 458                                 op->o_connid, 0, 0 );
 459 #else
 460                         Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: get oid failed.\n",
 461                                 0, 0, 0 );
 462 #endif
 463
 464                         slap_free_ctrls( op, op->o_ctrls );
 465                         op->o_ctrls = NULL;
 466                         rs->sr_err = SLAPD_DISCONNECT;
 467                         rs->sr_text = "decoding controls error";
 468                         goto return_results;
 469
 470                 } else if( c->ldctl_oid == NULL ) {
 471 #ifdef NEW_LOGGING
 472                         LDAP_LOG( OPERATION, INFO,
 473                                 "get_ctrls: conn %lu got emtpy OID.\n",
 474                                 op->o_connid, 0, 0 );
 475 #else
 476                         Debug( LDAP_DEBUG_TRACE,
 477                                 "get_ctrls: conn %lu got emtpy OID.\n",
 478                                 op->o_connid, 0, 0 );
 479 #endif
 480
 481                         slap_free_ctrls( op, op->o_ctrls );
 482                         op->o_ctrls = NULL;
 483                         rs->sr_err = LDAP_PROTOCOL_ERROR;
 484                         rs->sr_text = "OID field is empty";
 485                         goto return_results;
 486                 }
 487
 488                 tag = ber_peek_tag( ber, &len );
 489
 490                 if( tag == LBER_BOOLEAN ) {
 491                         ber_int_t crit;
 492                         tag = ber_scanf( ber, "b", &crit );
 493
 494                         if( tag == LBER_ERROR ) {
 495 #ifdef NEW_LOGGING
 496                                 LDAP_LOG( OPERATION, INFO,
 497                                         "get_ctrls: conn %lu get crit failed.\n",
 498                                         op->o_connid, 0, 0 );
 499 #else
 500                                 Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: get crit failed.\n",
 501                                         0, 0, 0 );
 502 #endif
 503                                 slap_free_ctrls( op, op->o_ctrls );
 504                                 op->o_ctrls = NULL;
 505                                 rs->sr_err = SLAPD_DISCONNECT;
 506                                 rs->sr_text = "decoding controls error";
 507                                 goto return_results;
 508                         }
 509
 510                         c->ldctl_iscritical = (crit != 0);
 511                         tag = ber_peek_tag( ber, &len );
 512                 }
 513
 514                 if( tag == LBER_OCTETSTRING ) {
 515                         tag = ber_scanf( ber, "m", &c->ldctl_value );
 516
 517                         if( tag == LBER_ERROR ) {
 518 #ifdef NEW_LOGGING
 519                                 LDAP_LOG( OPERATION, INFO, "get_ctrls: conn %lu: "
 520                                         "%s (%scritical): get value failed.\n",
 521                                         op->o_connid, c->ldctl_oid,
 522                                         c->ldctl_iscritical ? "" : "non" );
 523 #else
 524                                 Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: conn %lu: "
 525                                         "%s (%scritical): get value failed.\n",
 526                                         op->o_connid, c->ldctl_oid,
 527                                         c->ldctl_iscritical ? "" : "non" );
 528 #endif
 529                                 slap_free_ctrls( op, op->o_ctrls );
 530                                 op->o_ctrls = NULL;
 531                                 rs->sr_err = SLAPD_DISCONNECT;
 532                                 rs->sr_text = "decoding controls error";
 533                                 goto return_results;
 534                         }
 535                 }
 536
 537 #ifdef NEW_LOGGING
 538                 LDAP_LOG( OPERATION, INFO,
 539                         "get_ctrls: conn %lu oid=\"%s\" (%scritical)\n",
 540                         op->o_connid, c->ldctl_oid, c->ldctl_iscritical ? "" : "non" );
 541 #else
 542                 Debug( LDAP_DEBUG_TRACE,
 543                         "=> get_ctrls: oid=\"%s\" (%scritical)\n",
 544                         c->ldctl_oid, c->ldctl_iscritical ? "" : "non", 0 );
 545 #endif
 546
 547                 sc = find_ctrl( c->ldctl_oid );
 548                 if( sc != NULL ) {
 549                         /* recognized control */
 550                         slap_mask_t tagmask;
 551                         switch( op->o_tag ) {
 552                         case LDAP_REQ_ADD:
 553                                 tagmask = SLAP_CTRL_ADD;
 554                                 break;
 555                         case LDAP_REQ_BIND:
 556                                 tagmask = SLAP_CTRL_BIND;
 557                                 break;
 558                         case LDAP_REQ_COMPARE:
 559                                 tagmask = SLAP_CTRL_COMPARE;
 560                                 break;
 561                         case LDAP_REQ_DELETE:
 562                                 tagmask = SLAP_CTRL_DELETE;
 563                                 break;
 564                         case LDAP_REQ_MODIFY:
 565                                 tagmask = SLAP_CTRL_MODIFY;
 566                                 break;
 567                         case LDAP_REQ_RENAME:
 568                                 tagmask = SLAP_CTRL_RENAME;
 569                                 break;
 570                         case LDAP_REQ_SEARCH:
 571                                 tagmask = SLAP_CTRL_SEARCH;
 572                                 break;
 573                         case LDAP_REQ_UNBIND:
 574                                 tagmask = SLAP_CTRL_UNBIND;
 575                                 break;
 576                         case LDAP_REQ_ABANDON:
 577                                 tagmask = SLAP_CTRL_ABANDON;
 578                                 break;
 579                         case LDAP_REQ_EXTENDED:
 580                                 tagmask=~0L;
 581                                 assert( op->ore_reqoid.bv_val != NULL );
 582                                 if( sc->sc_extendedops != NULL ) {
 583                                         int i;
 584                                         for( i=0; sc->sc_extendedops[i] != NULL; i++ ) {
 585                                                 if( strcmp( op->ore_reqoid.bv_val, sc->sc_extendedops[i] )
 586                                                         == 0 )
 587                                                 {
 588                                                         tagmask=0L;
 589                                                         break;
 590                                                 }
 591                                         }
 592                                 }
 593                                 break;
 594                         default:
 595                                 rs->sr_err = LDAP_OTHER;
 596                                 rs->sr_text = "controls internal error";
 597                                 goto return_results;
 598                         }
 599
 600                         if (( sc->sc_mask & tagmask ) == tagmask ) {
 601                                 /* available extension */
 602
 603                                 if( !sc->sc_parse ) {
 604                                         rs->sr_err = LDAP_OTHER;
 605                                         rs->sr_text = "not yet implemented";
 606                                         goto return_results;
 607                                 }
 608
 609                                 rs->sr_err = sc->sc_parse( op, rs, c );
 610
 611                                 if( rs->sr_err != LDAP_SUCCESS ) goto return_results;
 612
 613                                 if ( sc->sc_mask & SLAP_CTRL_FRONTEND ) {
 614                                         /* kludge to disable backend_control() check */
 615                                         c->ldctl_iscritical = 0;
 616
 617                                 } else if ( tagmask == SLAP_CTRL_SEARCH &&
 618                                         sc->sc_mask & SLAP_CTRL_FRONTEND_SEARCH )
 619                                 {
 620                                         /* kludge to disable backend_control() check */
 621                                         c->ldctl_iscritical = 0;
 622                                 }
 623
 624                         } else if( c->ldctl_iscritical ) {
 625                                 /* unavailable CRITICAL control */
 626                                 rs->sr_err = LDAP_UNAVAILABLE_CRITICAL_EXTENSION;
 627                                 rs->sr_text = "critical extension is unavailable";
 628                                 goto return_results;
 629                         }
 630
 631                 } else if( c->ldctl_iscritical ) {
 632                         /* unrecognized CRITICAL control */
 633                         rs->sr_err = LDAP_UNAVAILABLE_CRITICAL_EXTENSION;
 634                         rs->sr_text = "critical extension is not recognized";
 635                         goto return_results;
 636                 }
 637         }
 638
 639 return_results:
 640 #ifdef NEW_LOGGING
 641         LDAP_LOG( OPERATION, RESULTS,
 642                 "get_ctrls: n=%d rc=%d err=\"%s\"\n",
 643                 nctrls, rs->sr_err, rs->sr_text ? rs->sr_text : "" );
 644 #else
 645         Debug( LDAP_DEBUG_TRACE,
 646                 "<= get_ctrls: n=%d rc=%d err=\"%s\"\n",
 647                 nctrls, rs->sr_err, rs->sr_text ? rs->sr_text : "");
 648 #endif
 649
 650         if( sendres && rs->sr_err != LDAP_SUCCESS ) {
 651                 if( rs->sr_err == SLAPD_DISCONNECT ) {
 652                         rs->sr_err = LDAP_PROTOCOL_ERROR;
 653                         send_ldap_disconnect( op, rs );
 654                         rs->sr_err = SLAPD_DISCONNECT;
 655                 } else {
 656                         send_ldap_result( op, rs );
 657                 }
 658         }
 659
 660         return rs->sr_err;
 661 }
 662
 663 static int parseModifyIncrement (
 664         Operation *op,
 665         SlapReply *rs,
 666         LDAPControl *ctrl )
 667 {
 668 #if 0
 669         if ( op->o_parseModifyIncrement != SLAP_NO_CONTROL ) {
 670                 rs->sr_text = "modifyIncrement control specified multiple times";
 671                 return LDAP_PROTOCOL_ERROR;
 672         }
 673 #endif
 674
 675         if ( ctrl->ldctl_value.bv_len ) {
 676                 rs->sr_text = "modifyIncrement control value not empty";
 677                 return LDAP_PROTOCOL_ERROR;
 678         }
 679
 680 #if 0
 681         op->o_parseModifyIncrement = ctrl->ldctl_iscritical
 682                 ? SLAP_CRITICAL_CONTROL
 683                 : SLAP_NONCRITICAL_CONTROL;
 684 #endif
 685
 686         return LDAP_SUCCESS;
 687 }
 688
 689 static int parseManageDSAit (
 690         Operation *op,
 691         SlapReply *rs,
 692         LDAPControl *ctrl )
 693 {
 694         if ( op->o_managedsait != SLAP_NO_CONTROL ) {
 695                 rs->sr_text = "manageDSAit control specified multiple times";
 696                 return LDAP_PROTOCOL_ERROR;
 697         }
 698
 699         if ( ctrl->ldctl_value.bv_len ) {
 700                 rs->sr_text = "manageDSAit control value not empty";
 701                 return LDAP_PROTOCOL_ERROR;
 702         }
 703
 704         op->o_managedsait = ctrl->ldctl_iscritical
 705                 ? SLAP_CRITICAL_CONTROL
 706                 : SLAP_NONCRITICAL_CONTROL;
 707
 708         return LDAP_SUCCESS;
 709 }
 710
 711 static int parseProxyAuthz (
 712         Operation *op,
 713         SlapReply *rs,
 714         LDAPControl *ctrl )
 715 {
 716         int             rc;
 717         struct berval   dn = { 0, NULL };
 718
 719         if ( op->o_proxy_authz != SLAP_NO_CONTROL ) {
 720                 rs->sr_text = "proxy authorization control specified multiple times";
 721                 return LDAP_PROTOCOL_ERROR;
 722         }
 723
 724         op->o_proxy_authz = ctrl->ldctl_iscritical
 725                 ? SLAP_CRITICAL_CONTROL
 726                 : SLAP_NONCRITICAL_CONTROL;
 727
 728 #ifdef NEW_LOGGING
 729         LDAP_LOG( OPERATION, ARGS,
 730                 "parseProxyAuthz: conn %lu authzid=\"%s\"\n",
 731                 op->o_connid,
 732                 ctrl->ldctl_value.bv_len ?  ctrl->ldctl_value.bv_val : "anonymous",
 733                 0 );
 734 #else
 735         Debug( LDAP_DEBUG_ARGS,
 736                 "parseProxyAuthz: conn %lu authzid=\"%s\"\n",
 737                 op->o_connid,
 738                 ctrl->ldctl_value.bv_len ?  ctrl->ldctl_value.bv_val : "anonymous",
 739                 0 );
 740 #endif
 741
 742         if( ctrl->ldctl_value.bv_len == 0 ) {
 743 #ifdef NEW_LOGGING
 744                 LDAP_LOG( OPERATION, RESULTS,
 745                         "parseProxyAuthz: conn=%lu anonymous\n",
 746                         op->o_connid, 0, 0 );
 747 #else
 748                 Debug( LDAP_DEBUG_TRACE,
 749                         "parseProxyAuthz: conn=%lu anonymous\n",
 750                         op->o_connid, 0, 0 );
 751 #endif
 752
 753                 /* anonymous */
 754                 free( op->o_dn.bv_val );
 755                 op->o_dn.bv_len = 0;
 756                 op->o_dn.bv_val = ch_strdup( "" );
 757
 758                 free( op->o_ndn.bv_val );
 759                 op->o_ndn.bv_len = 0;
 760                 op->o_ndn.bv_val = ch_strdup( "" );
 761
 762                 return LDAP_SUCCESS;
 763         }
 764
 765         rc = slap_sasl_getdn( op->o_conn, op,
 766                         ctrl->ldctl_value.bv_val, ctrl->ldctl_value.bv_len,
 767                         NULL, &dn, SLAP_GETDN_AUTHZID );
 768
 769         if( rc != LDAP_SUCCESS || !dn.bv_len ) {
 770                 if ( dn.bv_val ) {
 771                         ch_free( dn.bv_val );
 772                 }
 773                 rs->sr_text = "authzId mapping failed";
 774                 return LDAP_PROXY_AUTHZ_FAILURE;
 775
 776         }
 777
 778 #ifdef NEW_LOGGING
 779         LDAP_LOG( OPERATION, RESULTS,
 780                 "parseProxyAuthz: conn=%lu \"%s\"\n",
 781                 op->o_connid,
 782                 dn.bv_len ? dn.bv_val : "(NULL)", 0 );
 783 #else
 784         Debug( LDAP_DEBUG_TRACE,
 785                 "parseProxyAuthz: conn=%lu \"%s\"\n",
 786                 op->o_connid,
 787                 dn.bv_len ? dn.bv_val : "(NULL)", 0 );
 788 #endif
 789
 790         rc = slap_sasl_authorized( op, &op->o_ndn, &dn );
 791
 792         if( rc ) {
 793                 ch_free( dn.bv_val );
 794                 rs->sr_text = "not authorized to assume identity";
 795                 return LDAP_PROXY_AUTHZ_FAILURE;
 796         }
 797
 798         ch_free( op->o_dn.bv_val );
 799         ch_free( op->o_ndn.bv_val );
 800
 801         op->o_dn.bv_val = NULL;
 802         op->o_ndn = dn;
 803
 804         /*
 805          * NOTE: since slap_sasl_getdn() returns a normalized dn,
 806          * from now on op->o_dn is normalized
 807          */
 808         ber_dupbv( &op->o_dn, &dn );
 809
 810         return LDAP_SUCCESS;
 811 }
 812
 813 static int parseNoOp (
 814         Operation *op,
 815         SlapReply *rs,
 816         LDAPControl *ctrl )
 817 {
 818         if ( op->o_noop != SLAP_NO_CONTROL ) {
 819                 rs->sr_text = "noop control specified multiple times";
 820                 return LDAP_PROTOCOL_ERROR;
 821         }
 822
 823         if ( ctrl->ldctl_value.bv_len ) {
 824                 rs->sr_text = "noop control value not empty";
 825                 return LDAP_PROTOCOL_ERROR;
 826         }
 827
 828         op->o_noop = ctrl->ldctl_iscritical
 829                 ? SLAP_CRITICAL_CONTROL
 830                 : SLAP_NONCRITICAL_CONTROL;
 831
 832         return LDAP_SUCCESS;
 833 }
 834
 835 static int parsePagedResults (
 836         Operation *op,
 837         SlapReply *rs,
 838         LDAPControl *ctrl )
 839 {
 840         ber_tag_t tag;
 841         ber_int_t size;
 842         BerElement *ber;
 843         struct berval cookie = { 0, NULL };
 844
 845         if ( op->o_pagedresults != SLAP_NO_CONTROL ) {
 846                 rs->sr_text = "paged results control specified multiple times";
 847                 return LDAP_PROTOCOL_ERROR;
 848         }
 849
 850         if ( ctrl->ldctl_value.bv_len == 0 ) {
 851                 rs->sr_text = "paged results control value is empty (or absent)";
 852                 return LDAP_PROTOCOL_ERROR;
 853         }
 854
 855         /* Parse the control value
 856          *      realSearchControlValue ::= SEQUENCE {
 857          *              size    INTEGER (0..maxInt),
 858          *                              -- requested page size from client
 859          *                              -- result set size estimate from server
 860          *              cookie  OCTET STRING
 861          * }
 862          */
 863         ber = ber_init( &ctrl->ldctl_value );
 864         if( ber == NULL ) {
 865                 rs->sr_text = "internal error";
 866                 return LDAP_OTHER;
 867         }
 868
 869         tag = ber_scanf( ber, "{im}", &size, &cookie );
 870         (void) ber_free( ber, 1 );
 871
 872         if( tag == LBER_ERROR ) {
 873                 rs->sr_text = "paged results control could not be decoded";
 874                 return LDAP_PROTOCOL_ERROR;
 875         }
 876
 877         if( size < 0 ) {
 878                 rs->sr_text = "paged results control size invalid";
 879                 return LDAP_PROTOCOL_ERROR;
 880         }
 881
 882         if( cookie.bv_len ) {
 883                 PagedResultsCookie reqcookie;
 884                 if( cookie.bv_len != sizeof( reqcookie ) ) {
 885                         /* bad cookie */
 886                         rs->sr_text = "paged results cookie is invalid";
 887                         return LDAP_PROTOCOL_ERROR;
 888                 }
 889
 890                 AC_MEMCPY( &reqcookie, cookie.bv_val, sizeof( reqcookie ));
 891
 892                 if( reqcookie > op->o_pagedresults_state.ps_cookie ) {
 893                         /* bad cookie */
 894                         rs->sr_text = "paged results cookie is invalid";
 895                         return LDAP_PROTOCOL_ERROR;
 896
 897                 } else if( reqcookie < op->o_pagedresults_state.ps_cookie ) {
 898                         rs->sr_text = "paged results cookie is invalid or old";
 899                         return LDAP_UNWILLING_TO_PERFORM;
 900                 }
 901         } else {
 902                 /* Initial request.  Initialize state. */
 903                 op->o_pagedresults_state.ps_cookie = 0;
 904                 op->o_pagedresults_state.ps_id = NOID;
 905         }
 906
 907         op->o_pagedresults_size = size;
 908
 909         op->o_pagedresults = ctrl->ldctl_iscritical
 910                 ? SLAP_CRITICAL_CONTROL
 911                 : SLAP_NONCRITICAL_CONTROL;
 912
 913         return LDAP_SUCCESS;
 914 }
 915
 916 static int parseAssert (
 917         Operation *op,
 918         SlapReply *rs,
 919         LDAPControl *ctrl )
 920 {
 921         BerElement      *ber;
 922         struct berval   fstr = { 0, NULL };
 923         const char *err_msg = "";
 924
 925         if ( op->o_assert != SLAP_NO_CONTROL ) {
 926                 rs->sr_text = "assert control specified multiple times";
 927                 return LDAP_PROTOCOL_ERROR;
 928         }
 929
 930         if ( ctrl->ldctl_value.bv_len == 0 ) {
 931                 rs->sr_text = "assert control value is empty (or absent)";
 932                 return LDAP_PROTOCOL_ERROR;
 933         }
 934
 935         ber = ber_init( &(ctrl->ldctl_value) );
 936         if (ber == NULL) {
 937                 rs->sr_text = "assert control: internal error";
 938                 return LDAP_OTHER;
 939         }
 940
 941         rs->sr_err = get_filter( op, ber, &(op->o_assertion), &rs->sr_text);
 942
 943         if( rs->sr_err != LDAP_SUCCESS ) {
 944                 if( rs->sr_err == SLAPD_DISCONNECT ) {
 945                         rs->sr_err = LDAP_PROTOCOL_ERROR;
 946                         send_ldap_disconnect( op, rs );
 947                         rs->sr_err = SLAPD_DISCONNECT;
 948                 } else {
 949                         send_ldap_result( op, rs );
 950                 }
 951                 if( op->o_assertion != NULL ) {
 952                         filter_free_x( op, op->o_assertion );
 953                 }
 954                 return rs->sr_err;
 955         }
 956
 957 #ifdef LDAP_DEBUG
 958         filter2bv_x( op, op->o_assertion, &fstr );
 959
 960 #ifdef NEW_LOGGING
 961         LDAP_LOG( OPERATION, ARGS,
 962                 "parseAssert: conn %ld assert: %s\n",
 963                 op->o_connid, fstr.bv_len ? fstr.bv_val : "empty" , 0 );
 964 #else
 965         Debug( LDAP_DEBUG_ARGS, "parseAssert: conn %ld assert: %s\n",
 966                 op->o_connid, fstr.bv_len ? fstr.bv_val : "empty" , 0 );
 967 #endif
 968         op->o_tmpfree( fstr.bv_val, op->o_tmpmemctx );
 969 #endif
 970
 971         op->o_assert = ctrl->ldctl_iscritical
 972                 ? SLAP_CRITICAL_CONTROL
 973                 : SLAP_NONCRITICAL_CONTROL;
 974
 975         rs->sr_err = LDAP_SUCCESS;
 976         return LDAP_SUCCESS;
 977 }
 978
 979 static int parsePreRead (
 980         Operation *op,
 981         SlapReply *rs,
 982         LDAPControl *ctrl )
 983 {
 984         ber_len_t siz, off, i;
 985         AttributeName *an = NULL;
 986         BerElement      *ber;
 987
 988         if ( op->o_preread != SLAP_NO_CONTROL ) {
 989                 rs->sr_text = "preread control specified multiple times";
 990                 return LDAP_PROTOCOL_ERROR;
 991         }
 992
 993         if ( ctrl->ldctl_value.bv_len == 0 ) {
 994                 rs->sr_text = "preread control value is empty (or absent)";
 995                 return LDAP_PROTOCOL_ERROR;
 996         }
 997
 998         ber = ber_init( &(ctrl->ldctl_value) );
 999         if (ber == NULL) {
1000                 rs->sr_text = "preread control: internal error";
1001                 return LDAP_OTHER;
1002         }
1003
1004         siz = sizeof( AttributeName );
1005         off = offsetof( AttributeName, an_name );
1006         if ( ber_scanf( ber, "{M}", &an, &siz, off ) == LBER_ERROR ) {
1007                 rs->sr_text = "preread control: decoding error";
1008                 return LDAP_PROTOCOL_ERROR;
1009         }
1010
1011         for( i=0; i<siz; i++ ) {
1012                 int             rc = LDAP_SUCCESS;
1013                 const char      *dummy = NULL;
1014
1015                 an[i].an_desc = NULL;
1016                 an[i].an_oc = NULL;
1017                 an[i].an_oc_exclude = 0;
1018                 rc = slap_bv2ad( &an[i].an_name, &an[i].an_desc, &dummy );
1019                 if ( rc != LDAP_SUCCESS && ctrl->ldctl_iscritical ) {
1020                         rs->sr_text = dummy ? dummy : "postread control: unknown attributeType";
1021                         return rc;
1022                 }
1023         }
1024
1025         op->o_preread = ctrl->ldctl_iscritical
1026                 ? SLAP_CRITICAL_CONTROL
1027                 : SLAP_NONCRITICAL_CONTROL;
1028
1029         op->o_preread_attrs = an;
1030
1031         rs->sr_err = LDAP_SUCCESS;
1032         return LDAP_SUCCESS;
1033 }
1034
1035 static int parsePostRead (
1036         Operation *op,
1037         SlapReply *rs,
1038         LDAPControl *ctrl )
1039 {
1040         ber_len_t siz, off, i;
1041         AttributeName *an = NULL;
1042         BerElement      *ber;
1043
1044         if ( op->o_postread != SLAP_NO_CONTROL ) {
1045                 rs->sr_text = "postread control specified multiple times";
1046                 return LDAP_PROTOCOL_ERROR;
1047         }
1048
1049         if ( ctrl->ldctl_value.bv_len == 0 ) {
1050                 rs->sr_text = "postread control value is empty (or absent)";
1051                 return LDAP_PROTOCOL_ERROR;
1052         }
1053
1054         ber = ber_init( &(ctrl->ldctl_value) );
1055         if (ber == NULL) {
1056                 rs->sr_text = "postread control: internal error";
1057                 return LDAP_OTHER;
1058         }
1059
1060         siz = sizeof( AttributeName );
1061         off = offsetof( AttributeName, an_name );
1062         if ( ber_scanf( ber, "{M}", &an, &siz, off ) == LBER_ERROR ) {
1063                 rs->sr_text = "postread control: decoding error";
1064                 return LDAP_PROTOCOL_ERROR;
1065         }
1066
1067         for( i=0; i<siz; i++ ) {
1068                 int             rc = LDAP_SUCCESS;
1069                 const char      *dummy = NULL;
1070
1071                 an[i].an_desc = NULL;
1072                 an[i].an_oc = NULL;
1073                 an[i].an_oc_exclude = 0;
1074                 rc = slap_bv2ad( &an[i].an_name, &an[i].an_desc, &dummy );
1075                 if ( rc != LDAP_SUCCESS && ctrl->ldctl_iscritical ) {
1076                         rs->sr_text = dummy ? dummy : "postread control: unknown attributeType";
1077                         return rc;
1078                 }
1079         }
1080
1081         op->o_postread = ctrl->ldctl_iscritical
1082                 ? SLAP_CRITICAL_CONTROL
1083                 : SLAP_NONCRITICAL_CONTROL;
1084
1085         op->o_postread_attrs = an;
1086
1087         rs->sr_err = LDAP_SUCCESS;
1088         return LDAP_SUCCESS;
1089 }
1090
1091 int parseValuesReturnFilter (
1092         Operation *op,
1093         SlapReply *rs,
1094         LDAPControl *ctrl )
1095 {
1096         BerElement      *ber;
1097         struct berval   fstr = { 0, NULL };
1098         const char *err_msg = "";
1099
1100         if ( op->o_valuesreturnfilter != SLAP_NO_CONTROL ) {
1101                 rs->sr_text = "valuesReturnFilter control specified multiple times";
1102                 return LDAP_PROTOCOL_ERROR;
1103         }
1104
1105         if ( ctrl->ldctl_value.bv_len == 0 ) {
1106                 rs->sr_text = "valuesReturnFilter control value is empty (or absent)";
1107                 return LDAP_PROTOCOL_ERROR;
1108         }
1109
1110         ber = ber_init( &(ctrl->ldctl_value) );
1111         if (ber == NULL) {
1112                 rs->sr_text = "internal error";
1113                 return LDAP_OTHER;
1114         }
1115
1116         rs->sr_err = get_vrFilter( op, ber, &(op->o_vrFilter), &rs->sr_text);
1117
1118         if( rs->sr_err != LDAP_SUCCESS ) {
1119                 if( rs->sr_err == SLAPD_DISCONNECT ) {
1120                         rs->sr_err = LDAP_PROTOCOL_ERROR;
1121                         send_ldap_disconnect( op, rs );
1122                         rs->sr_err = SLAPD_DISCONNECT;
1123                 } else {
1124                         send_ldap_result( op, rs );
1125                 }
1126                 if( op->o_vrFilter != NULL) vrFilter_free( op, op->o_vrFilter );
1127         }
1128 #ifdef LDAP_DEBUG
1129         else {
1130                 vrFilter2bv( op, op->o_vrFilter, &fstr );
1131         }
1132
1133 #ifdef NEW_LOGGING
1134         LDAP_LOG( OPERATION, ARGS,
1135                 "parseValuesReturnFilter: conn %d       vrFilter: %s\n",
1136                 op->o_connid, fstr.bv_len ? fstr.bv_val : "empty" , 0 );
1137 #else
1138         Debug( LDAP_DEBUG_ARGS, "       vrFilter: %s\n",
1139                 fstr.bv_len ? fstr.bv_val : "empty", 0, 0 );
1140 #endif
1141         op->o_tmpfree( fstr.bv_val, op->o_tmpmemctx );
1142 #endif
1143
1144         op->o_valuesreturnfilter = ctrl->ldctl_iscritical
1145                 ? SLAP_CRITICAL_CONTROL
1146                 : SLAP_NONCRITICAL_CONTROL;
1147
1148         rs->sr_err = LDAP_SUCCESS;
1149         return LDAP_SUCCESS;
1150 }
1151
1152 #ifdef LDAP_CONTROL_SUBENTRIES
1153 static int parseSubentries (
1154         Operation *op,
1155         SlapReply *rs,
1156         LDAPControl *ctrl )
1157 {
1158         if ( op->o_subentries != SLAP_NO_CONTROL ) {
1159                 rs->sr_text = "subentries control specified multiple times";
1160                 return LDAP_PROTOCOL_ERROR;
1161         }
1162
1163         /* FIXME: should use BER library */
1164         if( ( ctrl->ldctl_value.bv_len != 3 )
1165                 && ( ctrl->ldctl_value.bv_val[0] != 0x01 )
1166                 && ( ctrl->ldctl_value.bv_val[1] != 0x01 ))
1167         {
1168                 rs->sr_text = "subentries control value encoding is bogus";
1169                 return LDAP_PROTOCOL_ERROR;
1170         }
1171
1172         op->o_subentries = ctrl->ldctl_iscritical
1173                 ? SLAP_CRITICAL_CONTROL
1174                 : SLAP_NONCRITICAL_CONTROL;
1175
1176         op->o_subentries_visibility = (ctrl->ldctl_value.bv_val[2] != 0x00);
1177
1178         return LDAP_SUCCESS;
1179 }
1180 #endif
1181
1182 #ifdef LDAP_CONTROL_X_PERMISSIVE_MODIFY
1183 static int parsePermissiveModify (
1184         Operation *op,
1185         SlapReply *rs,
1186         LDAPControl *ctrl )
1187 {
1188         if ( op->o_permissive_modify != SLAP_NO_CONTROL ) {
1189                 rs->sr_text = "permissiveModify control specified multiple times";
1190                 return LDAP_PROTOCOL_ERROR;
1191         }
1192
1193         if ( ctrl->ldctl_value.bv_len ) {
1194                 rs->sr_text = "permissiveModify control value not empty";
1195                 return LDAP_PROTOCOL_ERROR;
1196         }
1197
1198         op->o_permissive_modify = ctrl->ldctl_iscritical
1199                 ? SLAP_CRITICAL_CONTROL
1200                 : SLAP_NONCRITICAL_CONTROL;
1201
1202         return LDAP_SUCCESS;
1203 }
1204 #endif
1205
1206 #ifdef LDAP_CONTROL_X_DOMAIN_SCOPE
1207 static int parseDomainScope (
1208         Operation *op,
1209         SlapReply *rs,
1210         LDAPControl *ctrl )
1211 {
1212         if ( op->o_domain_scope != SLAP_NO_CONTROL ) {
1213                 rs->sr_text = "domainScope control specified multiple times";
1214                 return LDAP_PROTOCOL_ERROR;
1215         }
1216
1217         if ( ctrl->ldctl_value.bv_len ) {
1218                 rs->sr_text = "domainScope control value not empty";
1219                 return LDAP_PROTOCOL_ERROR;
1220         }
1221
1222         op->o_domain_scope = ctrl->ldctl_iscritical
1223                 ? SLAP_CRITICAL_CONTROL
1224                 : SLAP_NONCRITICAL_CONTROL;
1225
1226         return LDAP_SUCCESS;
1227 }
1228 #endif
1229
1230 #ifdef LDAP_CONTROL_X_TREE_DELETE
1231 static int parseTreeDelete (
1232         Operation *op,
1233         SlapReply *rs,
1234         LDAPControl *ctrl )
1235 {
1236         if ( op->o_tree_delete != SLAP_NO_CONTROL ) {
1237                 rs->sr_text = "treeDelete control specified multiple times";
1238                 return LDAP_PROTOCOL_ERROR;
1239         }
1240
1241         if ( ctrl->ldctl_value.bv_len ) {
1242                 rs->sr_text = "treeDelete control value not empty";
1243                 return LDAP_PROTOCOL_ERROR;
1244         }
1245
1246         op->o_tree_delete = ctrl->ldctl_iscritical
1247                 ? SLAP_CRITICAL_CONTROL
1248                 : SLAP_NONCRITICAL_CONTROL;
1249
1250         return LDAP_SUCCESS;
1251 }
1252 #endif
1253
1254 #ifdef LDAP_CONTORL_X_SEARCH_OPTIONS
1255 static int parseSearchOptions (
1256         Operation *op,
1257         SlapReply *rs,
1258         LDAPControl *ctrl )
1259 {
1260         BerElement *ber;
1261         ber_int_t search_flags;
1262
1263         if ( ctrl->ldctl_value.bv_len == 0 ) {
1264                 rs->sr_text = "searchOptions control value not empty";
1265                 return LDAP_PROTOCOL_ERROR;
1266         }
1267
1268         ber = ber_init( &ctrl->ldctl_value );
1269         if( ber == NULL ) {
1270                 rs->sr_text = "internal error";
1271                 return LDAP_OTHER;
1272         }
1273
1274         if ( (tag = ber_scanf( ber, "{i}", &search_flags )) == LBER_ERROR ) {
1275                 rs->sr_text = "searchOptions control decoding error";
1276                 return LDAP_PROTOCOL_ERROR;
1277         }
1278
1279         (void) ber_free( ber, 1 );
1280
1281         if ( search_flags & LDAP_SEARCH_FLAG_DOMAIN_SCOPE ) {
1282                 if ( op->o_domain_scope != SLAP_NO_CONTROL ) {
1283                         rs->sr_text = "searchOptions control specified multiple times or with domainScope control";
1284                         return LDAP_PROTOCOL_ERROR;
1285                 }
1286
1287                 op->o_domain_scope = ctrl->ldctl_iscritical
1288                         ? SLAP_CRITICAL_CONTROL
1289                         : SLAP_NONCRITICAL_CONTROL;
1290         }
1291
1292         if ( search_flags & ~(LDAP_SEARCH_FLAG_DOMAIN_SCOPE) ) {
1293                 /* Other search flags not recognised so far */
1294                 rs->sr_text = "searchOptions contained invalid flag";
1295                 return LDAP_UNAVAILABLE_CRITICAL_EXTENSION;
1296         }
1297
1298         return LDAP_SUCCESS;
1299 }
1300 #endif
1301
1302 static int parseLDAPsync (
1303         Operation *op,
1304         SlapReply *rs,
1305         LDAPControl *ctrl )
1306 {
1307         ber_tag_t tag;
1308         BerElement *ber;
1309         ber_int_t mode;
1310         ber_len_t len;
1311         struct slap_session_entry *se;
1312
1313         if ( op->o_sync != SLAP_NO_CONTROL ) {
1314                 rs->sr_text = "LDAP Sync control specified multiple times";
1315                 return LDAP_PROTOCOL_ERROR;
1316         }
1317
1318         if ( ctrl->ldctl_value.bv_len == 0 ) {
1319                 rs->sr_text = "LDAP Sync control value is empty (or absent)";
1320                 return LDAP_PROTOCOL_ERROR;
1321         }
1322
1323         /* Parse the control value
1324          *      syncRequestValue ::= SEQUENCE {
1325          *              mode   ENUMERATED {
1326          *                      -- 0 unused
1327          *                      refreshOnly             (1),
1328          *                      -- 2 reserved
1329          *                      refreshAndPersist       (3)
1330          *              },
1331          *              cookie  syncCookie OPTIONAL
1332          *      }
1333          */
1334
1335         ber = ber_init( &ctrl->ldctl_value );
1336         if( ber == NULL ) {
1337                 rs->sr_text = "internal error";
1338                 return LDAP_OTHER;
1339         }
1340
1341         if ( (tag = ber_scanf( ber, "{i" /*}*/, &mode )) == LBER_ERROR ) {
1342                 rs->sr_text = "LDAP Sync control : mode decoding error";
1343                 return LDAP_PROTOCOL_ERROR;
1344         }
1345
1346         switch( mode ) {
1347         case LDAP_SYNC_REFRESH_ONLY:
1348                 mode = SLAP_SYNC_REFRESH;
1349                 break;
1350         case LDAP_SYNC_REFRESH_AND_PERSIST:
1351                 mode = SLAP_SYNC_REFRESH_AND_PERSIST;
1352                 break;
1353         default:
1354                 rs->sr_text = "LDAP Sync control : unknown update mode";
1355                 return LDAP_PROTOCOL_ERROR;
1356         }
1357
1358         tag = ber_peek_tag( ber, &len );
1359
1360         if ( tag == LDAP_TAG_SYNC_COOKIE ) {
1361                 struct berval tmp_bv;
1362                 if (( ber_scanf( ber, /*{*/ "o", &tmp_bv )) == LBER_ERROR ) {
1363                         rs->sr_text = "LDAP Sync control : cookie decoding error";
1364                         return LDAP_PROTOCOL_ERROR;
1365                 }
1366                 ber_bvarray_add( &op->o_sync_state.octet_str, &tmp_bv );
1367                 slap_parse_sync_cookie( &op->o_sync_state );
1368         }
1369         if ( tag == LDAP_TAG_RELOAD_HINT ) {
1370                 if (( ber_scanf( ber, /*{*/ "b", &op->o_sync_rhint )) == LBER_ERROR ) {
1371                         rs->sr_text = "LDAP Sync control : rhint decoding error";
1372                         return LDAP_PROTOCOL_ERROR;
1373                 }
1374         }
1375         if (( ber_scanf( ber, /*{*/ "}")) == LBER_ERROR ) {
1376                         rs->sr_text = "LDAP Sync control : decoding error";
1377                         return LDAP_PROTOCOL_ERROR;
1378         }
1379
1380         (void) ber_free( ber, 1 );
1381
1382         op->o_sync_mode = (char) mode;
1383
1384         op->o_sync = ctrl->ldctl_iscritical
1385                 ? SLAP_CRITICAL_CONTROL
1386                 : SLAP_NONCRITICAL_CONTROL;
1387
1388         return LDAP_SUCCESS;
1389 }