git.sur5r.net Git - openldap/blob - servers/slapd/controls.c

   1 /* $OpenLDAP$ */
   2 /*
   3  * Copyright 1999-2003 The OpenLDAP Foundation.
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms are permitted only
   7  * as authorized by the OpenLDAP Public License.  A copy of this
   8  * license is available at http://www.OpenLDAP.org/license.html or
   9  * in file LICENSE in the top-level directory of the distribution.
  10  */
  11 #include "portable.h"
  12
  13 #include <stdio.h>
  14
  15 #include <ac/string.h>
  16 #include <ac/socket.h>
  17
  18 #include "slap.h"
  19
  20 #include "../../libraries/liblber/lber-int.h"
  21
  22 #define SLAP_CTRL_FRONTEND                      0x80000000U
  23 #define SLAP_CTRL_FRONTEND_SEARCH       0x01000000U     /* for NOOP */
  24
  25 #define SLAP_CTRL_OPFLAGS                       0x0000FFFFU
  26 #define SLAP_CTRL_ABANDON                       0x00000001U
  27 #define SLAP_CTRL_ADD                           0x00002002U
  28 #define SLAP_CTRL_BIND                          0x00000004U
  29 #define SLAP_CTRL_COMPARE                       0x00001008U
  30 #define SLAP_CTRL_DELETE                        0x00002010U
  31 #define SLAP_CTRL_MODIFY                        0x00002020U
  32 #define SLAP_CTRL_RENAME                        0x00002040U
  33 #define SLAP_CTRL_SEARCH                        0x00001080U
  34 #define SLAP_CTRL_UNBIND                        0x00000100U
  35
  36 #define SLAP_CTRL_INTROGATE     (SLAP_CTRL_COMPARE|SLAP_CTRL_SEARCH)
  37 #define SLAP_CTRL_UPDATE \
  38         (SLAP_CTRL_ADD|SLAP_CTRL_DELETE|SLAP_CTRL_MODIFY|SLAP_CTRL_RENAME)
  39 #define SLAP_CTRL_ACCESS        (SLAP_CTRL_INTROGATE|SLAP_CTRL_UPDATE)
  40
  41 typedef int (SLAP_CTRL_PARSE_FN) LDAP_P((
  42         Connection *conn,
  43         Operation *op,
  44         LDAPControl *ctrl,
  45         const char **text ));
  46
  47 static SLAP_CTRL_PARSE_FN parseProxyAuthz;
  48 static SLAP_CTRL_PARSE_FN parseManageDSAit;
  49 static SLAP_CTRL_PARSE_FN parseNoOp;
  50 static SLAP_CTRL_PARSE_FN parsePagedResults;
  51 static SLAP_CTRL_PARSE_FN parseValuesReturnFilter;
  52 static SLAP_CTRL_PARSE_FN parsePermitModify;
  53 static SLAP_CTRL_PARSE_FN parseNoReferrals;
  54
  55 #ifdef LDAP_CONTROL_SUBENTRIES
  56 static SLAP_CTRL_PARSE_FN parseSubentries;
  57 #endif
  58 #ifdef LDAP_CLIENT_UPDATE
  59 static SLAP_CTRL_PARSE_FN parseClientUpdate;
  60 #endif
  61 #ifdef LDAP_SYNC
  62 static SLAP_CTRL_PARSE_FN parseLdupSync;
  63 #endif
  64
  65 #undef sc_mask /* avoid conflict with Irix 6.5 <sys/signal.h> */
  66
  67 static char *proxy_authz_extops[] = {
  68         LDAP_EXOP_MODIFY_PASSWD,
  69         LDAP_EXOP_X_WHO_AM_I,
  70         NULL
  71 };
  72
  73 static struct slap_control {
  74         char *sc_oid;
  75         slap_mask_t sc_mask;
  76         char **sc_extendedops;
  77         SLAP_CTRL_PARSE_FN *sc_parse;
  78
  79 } supportedControls[] = {
  80         { LDAP_CONTROL_PROXY_AUTHZ,
  81                 SLAP_CTRL_FRONTEND|SLAP_CTRL_ACCESS, proxy_authz_extops,
  82                 parseProxyAuthz },
  83         { LDAP_CONTROL_MANAGEDSAIT,
  84                 SLAP_CTRL_ACCESS, NULL,
  85                 parseManageDSAit },
  86         { LDAP_CONTROL_NOOP,
  87                 SLAP_CTRL_ACCESS, NULL,
  88                 parseNoOp },
  89         { LDAP_CONTROL_PAGEDRESULTS,
  90                 SLAP_CTRL_SEARCH, NULL,
  91                 parsePagedResults },
  92         { LDAP_CONTROL_VALUESRETURNFILTER,
  93                 SLAP_CTRL_SEARCH, NULL,
  94                 parseValuesReturnFilter },
  95 #ifdef LDAP_CONTROL_SUBENTRIES
  96         { LDAP_CONTROL_SUBENTRIES,
  97                 SLAP_CTRL_SEARCH, NULL,
  98                 parseSubentries },
  99 #endif
 100 #ifdef LDAP_CONTROL_PERMITMODIFY
 101         { LDAP_CONTROL_PERMITMODIFY,
 102                 SLAP_CTRL_UPDATE, NULL,
 103                 parsePermitModify },
 104 #endif
 105 #ifdef LDAP_CONTROL_NOREFERRALS
 106         { LDAP_CONTROL_NOREFERRALS,
 107                 SLAP_CTRL_SEARCH, NULL,
 108                 parseNoReferrals },
 109 #endif
 110 #ifdef LDAP_CLIENT_UPDATE
 111         { LDAP_CONTROL_CLIENT_UPDATE,
 112                 SLAP_CTRL_SEARCH, NULL,
 113                 parseClientUpdate },
 114 #endif
 115 #ifdef LDAP_SYNC
 116         { LDAP_CONTROL_SYNC,
 117                 SLAP_CTRL_SEARCH, NULL,
 118                 parseLdupSync },
 119 #endif
 120         { NULL, 0, NULL, 0 }
 121 };
 122
 123 char *
 124 get_supported_ctrl(int index)
 125 {
 126         return supportedControls[index].sc_oid;
 127 }
 128
 129 slap_mask_t
 130 get_supported_ctrl_mask(int index)
 131 {
 132         return supportedControls[index].sc_mask;
 133 }
 134
 135 static struct slap_control *
 136 find_ctrl( const char *oid )
 137 {
 138         int i;
 139         for( i=0; supportedControls[i].sc_oid; i++ ) {
 140                 if( strcmp( oid, supportedControls[i].sc_oid ) == 0 ) {
 141                         return &supportedControls[i];
 142                 }
 143         }
 144         return NULL;
 145 }
 146
 147 int get_ctrls(
 148         Connection *conn,
 149         Operation *op,
 150         int sendres )
 151 {
 152         int nctrls = 0;
 153         ber_tag_t tag;
 154         ber_len_t len;
 155         char *opaque;
 156         BerElement *ber = op->o_ber;
 157         struct slap_control *sc;
 158         int rc = LDAP_SUCCESS;
 159         const char *errmsg = NULL;
 160
 161         len = ber_pvt_ber_remaining(ber);
 162
 163         if( len == 0) {
 164                 /* no controls */
 165                 rc = LDAP_SUCCESS;
 166                 return rc;
 167         }
 168
 169         if(( tag = ber_peek_tag( ber, &len )) != LDAP_TAG_CONTROLS ) {
 170                 if( tag == LBER_ERROR ) {
 171                         rc = SLAPD_DISCONNECT;
 172                         errmsg = "unexpected data in PDU";
 173                 }
 174
 175                 goto return_results;
 176         }
 177
 178 #ifdef NEW_LOGGING
 179         LDAP_LOG( OPERATION, ENTRY,
 180                 "get_ctrls: conn %lu\n", conn->c_connid, 0, 0 );
 181 #else
 182         Debug( LDAP_DEBUG_TRACE,
 183                 "=> get_ctrls\n", 0, 0, 0 );
 184 #endif
 185
 186         if( op->o_protocol < LDAP_VERSION3 ) {
 187                 rc = SLAPD_DISCONNECT;
 188                 errmsg = "controls require LDAPv3";
 189                 goto return_results;
 190         }
 191
 192         /* one for first control, one for termination */
 193         op->o_ctrls = ch_malloc( 2 * sizeof(LDAPControl *) );
 194
 195 #if 0
 196         if( op->ctrls == NULL ) {
 197                 rc = LDAP_NO_MEMORY;
 198                 errmsg = "no memory";
 199                 goto return_results;
 200         }
 201 #endif
 202
 203         op->o_ctrls[nctrls] = NULL;
 204
 205         /* step through each element */
 206         for( tag = ber_first_element( ber, &len, &opaque );
 207                 tag != LBER_ERROR;
 208                 tag = ber_next_element( ber, &len, opaque ) )
 209         {
 210                 LDAPControl *c;
 211                 LDAPControl **tctrls;
 212
 213                 c = ch_calloc( 1, sizeof(LDAPControl) );
 214
 215 #if 0
 216                 if( c == NULL ) {
 217                         ldap_controls_free(op->o_ctrls);
 218                         op->o_ctrls = NULL;
 219
 220                         rc = LDAP_NO_MEMORY;
 221                         errmsg = "no memory";
 222                         goto return_results;
 223                 }
 224 #endif
 225
 226                 /* allocate pointer space for current controls (nctrls)
 227                  * + this control + extra NULL
 228                  */
 229                 tctrls = ch_realloc( op->o_ctrls,
 230                         (nctrls+2) * sizeof(LDAPControl *));
 231
 232 #if 0
 233                 if( tctrls == NULL ) {
 234                         ch_free( c );
 235                         ldap_controls_free(op->o_ctrls);
 236                         op->o_ctrls = NULL;
 237
 238                         rc = LDAP_NO_MEMORY;
 239                         errmsg = "no memory";
 240                         goto return_results;
 241                 }
 242 #endif
 243                 op->o_ctrls = tctrls;
 244
 245                 op->o_ctrls[nctrls++] = c;
 246                 op->o_ctrls[nctrls] = NULL;
 247
 248                 tag = ber_scanf( ber, "{a" /*}*/, &c->ldctl_oid );
 249
 250                 if( tag == LBER_ERROR ) {
 251 #ifdef NEW_LOGGING
 252                         LDAP_LOG( OPERATION, INFO, "get_ctrls: conn %lu get OID failed.\n",
 253                                 conn->c_connid, 0, 0 );
 254 #else
 255                         Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: get oid failed.\n",
 256                                 0, 0, 0 );
 257 #endif
 258
 259                         ldap_controls_free( op->o_ctrls );
 260                         op->o_ctrls = NULL;
 261                         rc = SLAPD_DISCONNECT;
 262                         errmsg = "decoding controls error";
 263                         goto return_results;
 264
 265                 } else if( c->ldctl_oid == NULL ) {
 266 #ifdef NEW_LOGGING
 267                         LDAP_LOG( OPERATION, INFO,
 268                                 "get_ctrls: conn %lu got emtpy OID.\n",
 269                                 conn->c_connid, 0, 0 );
 270 #else
 271                         Debug( LDAP_DEBUG_TRACE,
 272                                 "get_ctrls: conn %lu got emtpy OID.\n",
 273                                 conn->c_connid, 0, 0 );
 274 #endif
 275
 276                         ldap_controls_free( op->o_ctrls );
 277                         op->o_ctrls = NULL;
 278                         rc = LDAP_PROTOCOL_ERROR;
 279                         errmsg = "OID field is empty";
 280                         goto return_results;
 281                 }
 282
 283                 tag = ber_peek_tag( ber, &len );
 284
 285                 if( tag == LBER_BOOLEAN ) {
 286                         ber_int_t crit;
 287                         tag = ber_scanf( ber, "b", &crit );
 288
 289                         if( tag == LBER_ERROR ) {
 290 #ifdef NEW_LOGGING
 291                                 LDAP_LOG( OPERATION, INFO,
 292                                         "get_ctrls: conn %lu get crit failed.\n",
 293                                         conn->c_connid, 0, 0 );
 294 #else
 295                                 Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: get crit failed.\n",
 296                                         0, 0, 0 );
 297 #endif
 298                                 ldap_controls_free( op->o_ctrls );
 299                                 op->o_ctrls = NULL;
 300                                 rc = SLAPD_DISCONNECT;
 301                                 errmsg = "decoding controls error";
 302                                 goto return_results;
 303                         }
 304
 305                         c->ldctl_iscritical = (crit != 0);
 306                         tag = ber_peek_tag( ber, &len );
 307                 }
 308
 309                 if( tag == LBER_OCTETSTRING ) {
 310                         tag = ber_scanf( ber, "o", &c->ldctl_value );
 311
 312                         if( tag == LBER_ERROR ) {
 313 #ifdef NEW_LOGGING
 314                                 LDAP_LOG( OPERATION, INFO, "get_ctrls: conn %lu: "
 315                                         "%s (%scritical): get value failed.\n",
 316                                         conn->c_connid, c->ldctl_oid,
 317                                         c->ldctl_iscritical ? "" : "non" );
 318 #else
 319                                 Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: conn %lu: "
 320                                         "%s (%scritical): get value failed.\n",
 321                                         conn->c_connid, c->ldctl_oid,
 322                                         c->ldctl_iscritical ? "" : "non" );
 323 #endif
 324                                 ldap_controls_free( op->o_ctrls );
 325                                 op->o_ctrls = NULL;
 326                                 rc = SLAPD_DISCONNECT;
 327                                 errmsg = "decoding controls error";
 328                                 goto return_results;
 329                         }
 330                 }
 331
 332 #ifdef NEW_LOGGING
 333                 LDAP_LOG( OPERATION, INFO,
 334                         "get_ctrls: conn %lu oid=\"%s\" (%scritical)\n",
 335                         conn->c_connid, c->ldctl_oid, c->ldctl_iscritical ? "" : "non" );
 336 #else
 337                 Debug( LDAP_DEBUG_TRACE,
 338                         "=> get_ctrls: oid=\"%s\" (%scritical)\n",
 339                         c->ldctl_oid, c->ldctl_iscritical ? "" : "non", 0 );
 340 #endif
 341
 342                 sc = find_ctrl( c->ldctl_oid );
 343                 if( sc != NULL ) {
 344                         /* recognized control */
 345                         slap_mask_t tagmask;
 346                         switch( op->o_tag ) {
 347                         case LDAP_REQ_ADD:
 348                                 tagmask = SLAP_CTRL_ADD;
 349                                 break;
 350                         case LDAP_REQ_BIND:
 351                                 tagmask = SLAP_CTRL_BIND;
 352                                 break;
 353                         case LDAP_REQ_COMPARE:
 354                                 tagmask = SLAP_CTRL_COMPARE;
 355                                 break;
 356                         case LDAP_REQ_DELETE:
 357                                 tagmask = SLAP_CTRL_DELETE;
 358                                 break;
 359                         case LDAP_REQ_MODIFY:
 360                                 tagmask = SLAP_CTRL_MODIFY;
 361                                 break;
 362                         case LDAP_REQ_RENAME:
 363                                 tagmask = SLAP_CTRL_RENAME;
 364                                 break;
 365                         case LDAP_REQ_SEARCH:
 366                                 tagmask = SLAP_CTRL_SEARCH;
 367                                 break;
 368                         case LDAP_REQ_UNBIND:
 369                                 tagmask = SLAP_CTRL_UNBIND;
 370                                 break;
 371                         case LDAP_REQ_ABANDON:
 372                                 tagmask = SLAP_CTRL_ABANDON;
 373                                 break;
 374                         case LDAP_REQ_EXTENDED:
 375                                 tagmask=~0L;
 376                                 assert( op->o_extendedop != NULL );
 377                                 if( sc->sc_extendedops != NULL ) {
 378                                         int i;
 379                                         for( i=0; sc->sc_extendedops[i] != NULL; i++ ) {
 380                                                 if( strcmp( op->o_extendedop, sc->sc_extendedops[i] )
 381                                                         == 0 )
 382                                                 {
 383                                                         tagmask=0L;
 384                                                         break;
 385                                                 }
 386                                         }
 387                                 }
 388                                 break;
 389                         default:
 390                                 rc = LDAP_OTHER;
 391                                 errmsg = "controls internal error";
 392                                 goto return_results;
 393                         }
 394
 395                         if (( sc->sc_mask & tagmask ) == tagmask ) {
 396                                 /* available extension */
 397
 398                                 if( !sc->sc_parse ) {
 399                                         rc = LDAP_OTHER;
 400                                         errmsg = "not yet implemented";
 401                                         goto return_results;
 402                                 }
 403
 404                                 rc = sc->sc_parse( conn, op, c, &errmsg );
 405
 406                                 if( rc != LDAP_SUCCESS ) goto return_results;
 407
 408                                 if ( sc->sc_mask & SLAP_CTRL_FRONTEND ) {
 409                                         /* kludge to disable backend_control() check */
 410                                         c->ldctl_iscritical = 0;
 411
 412                                 } else if ( tagmask == SLAP_CTRL_SEARCH &&
 413                                         sc->sc_mask & SLAP_CTRL_FRONTEND_SEARCH )
 414                                 {
 415                                         /* kludge to disable backend_control() check */
 416                                         c->ldctl_iscritical = 0;
 417                                 }
 418
 419                         } else if( c->ldctl_iscritical ) {
 420                                 /* unavailable CRITICAL control */
 421                                 rc = LDAP_UNAVAILABLE_CRITICAL_EXTENSION;
 422                                 errmsg = "critical extension is unavailable";
 423                                 goto return_results;
 424                         }
 425
 426                 } else if( c->ldctl_iscritical ) {
 427                         /* unrecognized CRITICAL control */
 428                         rc = LDAP_UNAVAILABLE_CRITICAL_EXTENSION;
 429                         errmsg = "critical extension is not recognized";
 430                         goto return_results;
 431                 }
 432         }
 433
 434 return_results:
 435 #ifdef NEW_LOGGING
 436         LDAP_LOG( OPERATION, RESULTS,
 437                 "get_ctrls: n=%d rc=%d err=\"%s\"\n",
 438                 nctrls, rc, errmsg ? errmsg : "" );
 439 #else
 440         Debug( LDAP_DEBUG_TRACE,
 441                 "<= get_ctrls: n=%d rc=%d err=\"%s\"\n",
 442                 nctrls, rc, errmsg ? errmsg : "");
 443 #endif
 444
 445         if( sendres && rc != LDAP_SUCCESS ) {
 446                 if( rc == SLAPD_DISCONNECT ) {
 447                         send_ldap_disconnect( conn, op, LDAP_PROTOCOL_ERROR, errmsg );
 448                 } else {
 449                         send_ldap_result( conn, op, rc,
 450                                 NULL, errmsg, NULL, NULL );
 451                 }
 452         }
 453
 454         return rc;
 455 }
 456
 457 static int parseManageDSAit (
 458         Connection *conn,
 459         Operation *op,
 460         LDAPControl *ctrl,
 461         const char **text )
 462 {
 463         if ( op->o_managedsait != SLAP_NO_CONTROL ) {
 464                 *text = "manageDSAit control specified multiple times";
 465                 return LDAP_PROTOCOL_ERROR;
 466         }
 467
 468         if ( ctrl->ldctl_value.bv_len ) {
 469                 *text = "manageDSAit control value not empty";
 470                 return LDAP_PROTOCOL_ERROR;
 471         }
 472
 473         op->o_managedsait = ctrl->ldctl_iscritical
 474                 ? SLAP_CRITICAL_CONTROL
 475                 : SLAP_NONCRITICAL_CONTROL;
 476
 477         return LDAP_SUCCESS;
 478 }
 479
 480 static int parseProxyAuthz (
 481         Connection *conn,
 482         Operation *op,
 483         LDAPControl *ctrl,
 484         const char **text )
 485 {
 486         int rc;
 487         struct berval dn;
 488
 489         if ( op->o_proxy_authz != SLAP_NO_CONTROL ) {
 490                 *text = "proxy authorization control specified multiple times";
 491                 return LDAP_PROTOCOL_ERROR;
 492         }
 493
 494         op->o_proxy_authz = ctrl->ldctl_iscritical
 495                 ? SLAP_CRITICAL_CONTROL
 496                 : SLAP_NONCRITICAL_CONTROL;
 497
 498 #ifdef NEW_LOGGING
 499         LDAP_LOG( OPERATION, ARGS,
 500                 "parseProxyAuthz: conn %lu authzid=\"%s\"\n",
 501                 conn->c_connid,
 502                 ctrl->ldctl_value.bv_len ?  ctrl->ldctl_value.bv_val : "anonymous",
 503                 0 );
 504 #else
 505         Debug( LDAP_DEBUG_ARGS,
 506                 "parseProxyAuthz: conn %lu authzid=\"%s\"\n",
 507                 conn->c_connid,
 508                 ctrl->ldctl_value.bv_len ?  ctrl->ldctl_value.bv_val : "anonymous",
 509                 0 );
 510 #endif
 511
 512         if( ctrl->ldctl_value.bv_len == 0 ) {
 513 #ifdef NEW_LOGGING
 514                 LDAP_LOG( OPERATION, RESULTS,
 515                         "parseProxyAuthz: conn=%lu anonymous\n",
 516                         conn->c_connid, 0, 0 );
 517 #else
 518                 Debug( LDAP_DEBUG_TRACE,
 519                         "parseProxyAuthz: conn=%lu anonymous\n",
 520                         conn->c_connid, 0, 0 );
 521 #endif
 522
 523                 /* anonymous */
 524                 free( op->o_dn.bv_val );
 525                 op->o_dn.bv_len = 0;
 526                 op->o_dn.bv_val = ch_strdup( "" );
 527
 528                 free( op->o_ndn.bv_val );
 529                 op->o_ndn.bv_len = 0;
 530                 op->o_ndn.bv_val = ch_strdup( "" );
 531
 532                 return LDAP_SUCCESS;
 533         }
 534
 535         rc = slap_sasl_getdn( conn,
 536                 ctrl->ldctl_value.bv_val, ctrl->ldctl_value.bv_len,
 537                 NULL, &dn, SLAP_GETDN_AUTHZID );
 538
 539         if( rc != LDAP_SUCCESS || !dn.bv_len ) {
 540                 *text = "authzId mapping failed";
 541                 return LDAP_PROXY_AUTHZ_FAILURE;
 542         }
 543
 544 #ifdef NEW_LOGGING
 545         LDAP_LOG( OPERATION, RESULTS,
 546                 "parseProxyAuthz: conn=%lu \"%s\"\n",
 547                 conn->c_connid,
 548                 dn.bv_len ? dn.bv_val : "(NULL)", 0 );
 549 #else
 550         Debug( LDAP_DEBUG_TRACE,
 551                 "parseProxyAuthz: conn=%lu \"%s\"\n",
 552                 conn->c_connid,
 553                 dn.bv_len ? dn.bv_val : "(NULL)", 0 );
 554 #endif
 555
 556         rc = slap_sasl_authorized( conn, &op->o_ndn, &dn );
 557
 558         if( rc ) {
 559                 ch_free( dn.bv_val );
 560                 *text = "not authorized to assume identity";
 561                 return LDAP_PROXY_AUTHZ_FAILURE;
 562         }
 563
 564         ch_free( op->o_dn.bv_val );
 565         ch_free( op->o_ndn.bv_val );
 566
 567         op->o_dn.bv_val = NULL;
 568         op->o_ndn = dn;
 569         ber_dupbv( &op->o_dn, &dn );
 570
 571         return LDAP_SUCCESS;
 572 }
 573
 574 static int parseNoOp (
 575         Connection *conn,
 576         Operation *op,
 577         LDAPControl *ctrl,
 578         const char **text )
 579 {
 580         if ( op->o_noop != SLAP_NO_CONTROL ) {
 581                 *text = "noop control specified multiple times";
 582                 return LDAP_PROTOCOL_ERROR;
 583         }
 584
 585         if ( ctrl->ldctl_value.bv_len ) {
 586                 *text = "noop control value not empty";
 587                 return LDAP_PROTOCOL_ERROR;
 588         }
 589
 590         op->o_noop = ctrl->ldctl_iscritical
 591                 ? SLAP_CRITICAL_CONTROL
 592                 : SLAP_NONCRITICAL_CONTROL;
 593
 594         return LDAP_SUCCESS;
 595 }
 596
 597 static int parsePagedResults (
 598         Connection *conn,
 599         Operation *op,
 600         LDAPControl *ctrl,
 601         const char **text )
 602 {
 603         ber_tag_t tag;
 604         ber_int_t size;
 605         BerElement *ber;
 606         struct berval cookie = { 0, NULL };
 607
 608         if ( op->o_pagedresults != SLAP_NO_CONTROL ) {
 609                 *text = "paged results control specified multiple times";
 610                 return LDAP_PROTOCOL_ERROR;
 611         }
 612
 613         if ( ctrl->ldctl_value.bv_len == 0 ) {
 614                 *text = "paged results control value is empty (or absent)";
 615                 return LDAP_PROTOCOL_ERROR;
 616         }
 617
 618         /* Parse the control value
 619          *      realSearchControlValue ::= SEQUENCE {
 620          *              size    INTEGER (0..maxInt),
 621          *                              -- requested page size from client
 622          *                              -- result set size estimate from server
 623          *              cookie  OCTET STRING
 624          */
 625         ber = ber_init( &ctrl->ldctl_value );
 626         if( ber == NULL ) {
 627                 *text = "internal error";
 628                 return LDAP_OTHER;
 629         }
 630
 631         tag = ber_scanf( ber, "{im}", &size, &cookie );
 632         (void) ber_free( ber, 1 );
 633
 634         if( tag == LBER_ERROR ) {
 635                 *text = "paged results control could not be decoded";
 636                 return LDAP_PROTOCOL_ERROR;
 637         }
 638
 639         if( size < 0 ) {
 640                 *text = "paged results control size invalid";
 641                 return LDAP_PROTOCOL_ERROR;
 642         }
 643
 644         if( cookie.bv_len ) {
 645                 PagedResultsCookie reqcookie;
 646                 if( cookie.bv_len != sizeof( reqcookie ) ) {
 647                         /* bad cookie */
 648                         *text = "paged results cookie is invalid";
 649                         return LDAP_PROTOCOL_ERROR;
 650                 }
 651
 652                 AC_MEMCPY( &reqcookie, cookie.bv_val, sizeof( reqcookie ));
 653
 654                 if( reqcookie > op->o_pagedresults_state.ps_cookie ) {
 655                         /* bad cookie */
 656                         *text = "paged results cookie is invalid";
 657                         return LDAP_PROTOCOL_ERROR;
 658
 659                 } else if( reqcookie < op->o_pagedresults_state.ps_cookie ) {
 660                         *text = "paged results cookie is invalid or old";
 661                         return LDAP_UNWILLING_TO_PERFORM;
 662                 }
 663         } else {
 664                 /* Initial request.  Initialize state. */
 665                 op->o_pagedresults_state.ps_cookie = 0;
 666                 op->o_pagedresults_state.ps_id = NOID;
 667         }
 668
 669         op->o_pagedresults_size = size;
 670
 671         op->o_pagedresults = ctrl->ldctl_iscritical
 672                 ? SLAP_CRITICAL_CONTROL
 673                 : SLAP_NONCRITICAL_CONTROL;
 674
 675         return LDAP_SUCCESS;
 676 }
 677
 678 int parseValuesReturnFilter (
 679         Connection *conn,
 680         Operation *op,
 681         LDAPControl *ctrl,
 682         const char **text )
 683 {
 684         int             rc;
 685         BerElement      *ber;
 686         struct berval   fstr = { 0, NULL };
 687         const char *err_msg = "";
 688
 689         if ( op->o_valuesreturnfilter != SLAP_NO_CONTROL ) {
 690                 *text = "valuesReturnFilter control specified multiple times";
 691                 return LDAP_PROTOCOL_ERROR;
 692         }
 693
 694         if ( ctrl->ldctl_value.bv_len == 0 ) {
 695                 *text = "valuesReturnFilter control value is empty (or absent)";
 696                 return LDAP_PROTOCOL_ERROR;
 697         }
 698
 699         ber = ber_init( &(ctrl->ldctl_value) );
 700         if (ber == NULL) {
 701                 *text = "internal error";
 702                 return LDAP_OTHER;
 703         }
 704
 705         rc = get_vrFilter( conn, ber, &(op->vrFilter), &err_msg);
 706
 707         if( rc != LDAP_SUCCESS ) {
 708                 text = &err_msg;
 709                 if( rc == SLAPD_DISCONNECT ) {
 710                         send_ldap_disconnect( conn, op,
 711                                 LDAP_PROTOCOL_ERROR, *text );
 712                 } else {
 713                         send_ldap_result( conn, op, rc,
 714                                 NULL, *text, NULL, NULL );
 715                 }
 716                 if( fstr.bv_val != NULL) free( fstr.bv_val );
 717                 if( op->vrFilter != NULL) vrFilter_free( op->vrFilter );
 718
 719         } else {
 720                 vrFilter2bv( op->vrFilter, &fstr );
 721         }
 722
 723 #ifdef NEW_LOGGING
 724         LDAP_LOG( OPERATION, ARGS,
 725                 "parseValuesReturnFilter: conn %d       vrFilter: %s\n",
 726                 conn->c_connid, fstr.bv_len ? fstr.bv_val : "empty" , 0 );
 727 #else
 728         Debug( LDAP_DEBUG_ARGS, "       vrFilter: %s\n",
 729                 fstr.bv_len ? fstr.bv_val : "empty", 0, 0 );
 730 #endif
 731
 732         op->o_valuesreturnfilter = ctrl->ldctl_iscritical
 733                 ? SLAP_CRITICAL_CONTROL
 734                 : SLAP_NONCRITICAL_CONTROL;
 735
 736         return LDAP_SUCCESS;
 737 }
 738
 739 #ifdef LDAP_CONTROL_SUBENTRIES
 740 static int parseSubentries (
 741         Connection *conn,
 742         Operation *op,
 743         LDAPControl *ctrl,
 744         const char **text )
 745 {
 746         if ( op->o_subentries != SLAP_NO_CONTROL ) {
 747                 *text = "subentries control specified multiple times";
 748                 return LDAP_PROTOCOL_ERROR;
 749         }
 750
 751         /* FIXME: should use BER library */
 752         if( ( ctrl->ldctl_value.bv_len != 3 )
 753                 && ( ctrl->ldctl_value.bv_val[0] != 0x01 )
 754                 && ( ctrl->ldctl_value.bv_val[1] != 0x01 ))
 755         {
 756                 *text = "subentries control value encoding is bogus";
 757                 return LDAP_PROTOCOL_ERROR;
 758         }
 759
 760         op->o_subentries = ctrl->ldctl_iscritical
 761                 ? SLAP_CRITICAL_CONTROL
 762                 : SLAP_NONCRITICAL_CONTROL;
 763
 764         op->o_subentries_visibility = (ctrl->ldctl_value.bv_val[2] != 0x00);
 765
 766         return LDAP_SUCCESS;
 767 }
 768 #endif
 769
 770 #ifdef LDAP_CONTROL_PERMITMODIFY
 771 static int parsePermitModify (
 772         Connection *conn,
 773         Operation *op,
 774         LDAPControl *ctrl,
 775         const char **text )
 776 {
 777         if ( op->o_permitmodify != SLAP_NO_CONTROL ) {
 778                 *text = "permitmodify control specified multiple times";
 779                 return LDAP_PROTOCOL_ERROR;
 780         }
 781
 782         if ( ctrl->ldctl_value.bv_len ) {
 783                 *text = "permitmodify control value not empty";
 784                 return LDAP_PROTOCOL_ERROR;
 785         }
 786
 787         op->o_permitmodify = ctrl->ldctl_iscritical
 788                 ? SLAP_CRITICAL_CONTROL
 789                 : SLAP_NONCRITICAL_CONTROL;
 790
 791         return LDAP_SUCCESS;
 792 }
 793 #endif
 794
 795 #ifdef LDAP_CONTROL_NOREFERRALS
 796 static int parseNoReferrals (
 797         Connection *conn,
 798         Operation *op,
 799         LDAPControl *ctrl,
 800         const char **text )
 801 {
 802         if ( op->o_noreferrals != SLAP_NO_CONTROL ) {
 803                 *text = "noreferrals control specified multiple times";
 804                 return LDAP_PROTOCOL_ERROR;
 805         }
 806
 807         if ( ctrl->ldctl_value.bv_len ) {
 808                 *text = "noreferrals control value not empty";
 809                 return LDAP_PROTOCOL_ERROR;
 810         }
 811
 812         op->o_noreferrals = ctrl->ldctl_iscritical
 813                 ? SLAP_CRITICAL_CONTROL
 814                 : SLAP_NONCRITICAL_CONTROL;
 815
 816         return LDAP_SUCCESS;
 817 }
 818 #endif
 819
 820 #ifdef LDAP_CLIENT_UPDATE
 821 static int parseClientUpdate (
 822         Connection *conn,
 823         Operation *op,
 824         LDAPControl *ctrl,
 825         const char **text )
 826 {
 827         ber_tag_t tag;
 828         BerElement *ber;
 829         ber_int_t type;
 830         ber_int_t interval;
 831         ber_len_t len;
 832         struct berval scheme = { 0, NULL };
 833         struct berval cookie = { 0, NULL };
 834
 835         if ( op->o_clientupdate != SLAP_NO_CONTROL ) {
 836                 *text = "LCUP client update control specified multiple times";
 837                 return LDAP_PROTOCOL_ERROR;
 838         }
 839
 840 #ifdef LDAP_SYNC
 841         if ( op->o_sync != SLAP_NO_CONTROL ) {
 842                 *text = "LDAP Client Update and Sync controls used together";
 843                 return LDAP_PROTOCOL_ERROR;
 844         }
 845 #endif
 846
 847         if ( ctrl->ldctl_value.bv_len == 0 ) {
 848                 *text = "LCUP client update control value is empty (or absent)";
 849                 return LDAP_PROTOCOL_ERROR;
 850         }
 851
 852         /* Parse the control value
 853          *      ClientUpdateControlValue ::= SEQUENCE {
 854          *              updateType      ENUMERATED {
 855          *                                      synchronizeOnly {0},
 856          *                                      synchronizeAndPersist {1},
 857          *                                      persistOnly {2} },
 858          *              sendCookieInterval INTEGER OPTIONAL,
 859          *              cookie          LCUPCookie OPTIONAL
 860          *      }
 861          */
 862
 863         ber = ber_init( &ctrl->ldctl_value );
 864         if( ber == NULL ) {
 865                 *text = "internal error";
 866                 return LDAP_OTHER;
 867         }
 868
 869         if ( (tag = ber_scanf( ber, "{i" /*}*/, &type )) == LBER_ERROR ) {
 870                 *text = "LCUP client update control : decoding error";
 871                 return LDAP_PROTOCOL_ERROR;
 872         }
 873
 874         switch( type ) {
 875         case LDAP_CUP_SYNC_ONLY:
 876                 type = SLAP_LCUP_SYNC;
 877                 break;
 878         case LDAP_CUP_SYNC_AND_PERSIST:
 879                 type = SLAP_LCUP_SYNC_AND_PERSIST;
 880                 break;
 881         case LDAP_CUP_PERSIST_ONLY:
 882                 type = SLAP_LCUP_PERSIST;
 883                 break;
 884         default:
 885                 *text = "LCUP client update control : unknown update type";
 886                 return LDAP_PROTOCOL_ERROR;
 887         }
 888
 889         if ( (tag = ber_peek_tag( ber, &len )) == LBER_DEFAULT ) {
 890                 *text = "LCUP client update control : decoding error";
 891                 return LDAP_PROTOCOL_ERROR;
 892         }
 893
 894         if ( tag == LDAP_TAG_INTERVAL ) {
 895                 if ( (tag = ber_scanf( ber, "i", &interval )) == LBER_ERROR ) {
 896                         *text = "LCUP client update control : decoding error";
 897                         return LDAP_PROTOCOL_ERROR;
 898                 }
 899
 900                 if ( interval <= 0 ) {
 901                         /* server chooses interval */
 902                         interval = LDAP_CUP_DEFAULT_SEND_COOKIE_INTERVAL;
 903                 }
 904
 905         } else {
 906                 /* server chooses interval */
 907                 interval = LDAP_CUP_DEFAULT_SEND_COOKIE_INTERVAL;
 908         }
 909
 910         if ( (tag = ber_peek_tag( ber, &len )) == LBER_DEFAULT ) {
 911                 *text = "LCUP client update control : decoding error";
 912                 return LDAP_PROTOCOL_ERROR;
 913         }
 914
 915         if ( tag == LDAP_LCUP_TAG_COOKIE ) {
 916                 if ( (tag = ber_scanf( ber, /*{*/ "{mm}}",
 917                                         &scheme, &cookie )) == LBER_ERROR ) {
 918                         *text = "LCUP client update control : decoding error";
 919                         return LDAP_PROTOCOL_ERROR;
 920                 }
 921         }
 922
 923         /* TODO : Cookie Scheme Validation */
 924 #if 0
 925         if ( lcup_cookie_scheme_validate(scheme) != LDAP_SUCCESS ) {
 926                 *text = "Unsupported LCUP cookie scheme";
 927                 return LCUP_UNSUPPORTED_SCHEME;
 928         }
 929
 930         if ( lcup_cookie_validate(scheme, cookie) != LDAP_SUCCESS ) {
 931                 *text = "Invalid LCUP cookie";
 932                 return LCUP_INVALID_COOKIE;
 933         }
 934 #endif
 935
 936         ber_dupbv( &op->o_clientupdate_state, &cookie );
 937
 938         (void) ber_free( ber, 1 );
 939
 940         op->o_clientupdate_type = (char) type;
 941         op->o_clientupdate_interval = interval;
 942
 943         op->o_clientupdate = ctrl->ldctl_iscritical
 944                 ? SLAP_CRITICAL_CONTROL
 945                 : SLAP_NONCRITICAL_CONTROL;
 946
 947         return LDAP_SUCCESS;
 948 }
 949 #endif
 950
 951 #ifdef LDAP_SYNC
 952 static int parseLdupSync (
 953         Connection *conn,
 954         Operation *op,
 955         LDAPControl *ctrl,
 956         const char **text )
 957 {
 958         ber_tag_t tag;
 959         BerElement *ber;
 960         ber_int_t mode;
 961         ber_len_t len;
 962         struct berval cookie = { 0, NULL };
 963
 964         if ( op->o_sync != SLAP_NO_CONTROL ) {
 965                 *text = "LDAP Sync control specified multiple times";
 966                 return LDAP_PROTOCOL_ERROR;
 967         }
 968
 969 #ifdef LDAP_CLIENT_UPDATE
 970         if ( op->o_clientupdate != SLAP_NO_CONTROL ) {
 971                 *text = "LDAP Sync and LDAP Client Update controls used together";
 972                 return LDAP_PROTOCOL_ERROR;
 973         }
 974 #endif
 975
 976         if ( ctrl->ldctl_value.bv_len == 0 ) {
 977                 *text = "LDAP Sync control value is empty (or absent)";
 978                 return LDAP_PROTOCOL_ERROR;
 979         }
 980
 981         /* Parse the control value
 982          *      syncRequestValue ::= SEQUENCE {
 983          *              mode   ENUMERATED {
 984          *                      -- 0 unused
 985          *                      refreshOnly             (1),
 986          *                      -- 2 reserved
 987          *                      refreshAndPersist       (3)
 988          *              },
 989          *              cookie  syncCookie OPTIONAL
 990          *      }
 991          */
 992
 993         ber = ber_init( &ctrl->ldctl_value );
 994         if( ber == NULL ) {
 995                 *text = "internal error";
 996                 return LDAP_OTHER;
 997         }
 998
 999         if ( (tag = ber_scanf( ber, "{i" /*}*/, &mode )) == LBER_ERROR ) {
1000                 *text = "LDAP Sync control : mode decoding error";
1001                 return LDAP_PROTOCOL_ERROR;
1002         }
1003
1004         switch( mode ) {
1005         case LDAP_SYNC_REFRESH_ONLY:
1006                 mode = SLAP_SYNC_REFRESH;
1007                 break;
1008         case LDAP_SYNC_REFRESH_AND_PERSIST:
1009                 mode = SLAP_SYNC_REFRESH_AND_PERSIST;
1010                 break;
1011         default:
1012                 *text = "LDAP Sync control : unknown update mode";
1013                 return LDAP_PROTOCOL_ERROR;
1014         }
1015
1016         tag = ber_peek_tag( ber, &len );
1017
1018         if ( tag == LDAP_SYNC_TAG_COOKIE ) {
1019                 if (( ber_scanf( ber, /*{*/ "m}",
1020                                         &cookie )) == LBER_ERROR ) {
1021                         *text = "LDAP Sync control : cookie decoding error";
1022                         return LDAP_PROTOCOL_ERROR;
1023                 }
1024         } else {
1025                 if (( ber_scanf( ber, /*{*/ "}")) == LBER_ERROR ) {
1026                         *text = "LDAP Sync control : decoding error";
1027                         return LDAP_PROTOCOL_ERROR;
1028                 }
1029                 cookie.bv_len = 0;
1030                 cookie.bv_val = NULL;
1031         }
1032
1033         /* TODO : Cookie Scheme Validation */
1034 #if 0
1035         if ( lcup_cookie_scheme_validate(scheme) != LDAP_SUCCESS ) {
1036                 *text = "Unsupported LCUP cookie scheme";
1037                 return LCUP_UNSUPPORTED_SCHEME;
1038         }
1039
1040         if ( lcup_cookie_validate(scheme, cookie) != LDAP_SUCCESS ) {
1041                 *text = "Invalid LCUP cookie";
1042                 return LCUP_INVALID_COOKIE;
1043         }
1044 #endif
1045
1046         ber_dupbv( &op->o_sync_state, &cookie );
1047
1048         (void) ber_free( ber, 1 );
1049
1050         op->o_sync_mode = (char) mode;
1051
1052         op->o_sync = ctrl->ldctl_iscritical
1053                 ? SLAP_CRITICAL_CONTROL
1054                 : SLAP_NONCRITICAL_CONTROL;
1055
1056         return LDAP_SUCCESS;
1057 }
1058 #endif