git.sur5r.net Git - openldap/blob - servers/slapd/controls.c

   1 /* $OpenLDAP$ */
   2 /*
   3  * Copyright 1999-2002 The OpenLDAP Foundation.
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms are permitted only
   7  * as authorized by the OpenLDAP Public License.  A copy of this
   8  * license is available at http://www.OpenLDAP.org/license.html or
   9  * in file LICENSE in the top-level directory of the distribution.
  10  */
  11 #include "portable.h"
  12
  13 #include <stdio.h>
  14
  15 #include <ac/string.h>
  16 #include <ac/socket.h>
  17
  18 #include "slap.h"
  19
  20 #include "../../libraries/liblber/lber-int.h"
  21
  22 #define SLAP_CTRL_FRONTEND                      0x80000000U
  23 #define SLAP_CTRL_FRONTEND_SEARCH       0x01000000U     /* for NOOP */
  24
  25 #define SLAP_CTRL_OPFLAGS                       0x0000FFFFU
  26 #define SLAP_CTRL_ABANDON                       0x00000001U
  27 #define SLAP_CTRL_ADD                           0x00002002U
  28 #define SLAP_CTRL_BIND                          0x00000004U
  29 #define SLAP_CTRL_COMPARE                       0x00001008U
  30 #define SLAP_CTRL_DELETE                        0x00002010U
  31 #define SLAP_CTRL_MODIFY                        0x00002020U
  32 #define SLAP_CTRL_RENAME                        0x00002040U
  33 #define SLAP_CTRL_SEARCH                        0x00001080U
  34 #define SLAP_CTRL_UNBIND                        0x00000100U
  35
  36 #define SLAP_CTRL_INTROGATE     (SLAP_CTRL_COMPARE|SLAP_CTRL_SEARCH)
  37 #define SLAP_CTRL_UPDATE \
  38         (SLAP_CTRL_ADD|SLAP_CTRL_DELETE|SLAP_CTRL_MODIFY|SLAP_CTRL_RENAME)
  39 #define SLAP_CTRL_ACCESS        (SLAP_CTRL_INTROGATE|SLAP_CTRL_UPDATE)
  40
  41 typedef int (SLAP_CTRL_PARSE_FN) LDAP_P((
  42         Connection *conn,
  43         Operation *op,
  44         LDAPControl *ctrl,
  45         const char **text ));
  46
  47 static SLAP_CTRL_PARSE_FN parseManageDSAit;
  48 static SLAP_CTRL_PARSE_FN parseSubentries;
  49 static SLAP_CTRL_PARSE_FN parseNoOp;
  50 static SLAP_CTRL_PARSE_FN parsePagedResults;
  51 static SLAP_CTRL_PARSE_FN parseValuesReturnFilter;
  52
  53 #undef sc_mask /* avoid conflict with Irix 6.5 <sys/signal.h> */
  54
  55 static struct slap_control {
  56         char *sc_oid;
  57         slap_mask_t sc_mask;
  58         char **sc_extendedops;
  59         SLAP_CTRL_PARSE_FN *sc_parse;
  60
  61 } supportedControls[] = {
  62         { LDAP_CONTROL_MANAGEDSAIT,
  63                 SLAP_CTRL_ACCESS, NULL,
  64                 parseManageDSAit },
  65 #ifdef LDAP_CONTROL_SUBENTRIES
  66         { LDAP_CONTROL_SUBENTRIES,
  67                 SLAP_CTRL_SEARCH, NULL,
  68                 parseSubentries },
  69 #endif
  70 #ifdef LDAP_CONTROL_NOOP
  71         { LDAP_CONTROL_NOOP,
  72                 SLAP_CTRL_ACCESS, NULL,
  73                 parseNoOp },
  74 #endif
  75 #ifdef LDAP_CONTROL_PAGEDRESULTS_REQUEST
  76         { LDAP_CONTROL_PAGEDRESULTS_REQUEST,
  77                 SLAP_CTRL_SEARCH, NULL,
  78                 parsePagedResults },
  79 #endif
  80 #ifdef LDAP_CONTROL_VALUESRETURNFILTER
  81         { LDAP_CONTROL_VALUESRETURNFILTER,
  82                 SLAP_CTRL_SEARCH, NULL,
  83                 parseValuesReturnFilter },
  84 #endif
  85         { NULL }
  86 };
  87
  88 char *
  89 get_supported_ctrl(int index)
  90 {
  91         return supportedControls[index].sc_oid;
  92 }
  93
  94 static struct slap_control *
  95 find_ctrl( const char *oid )
  96 {
  97         int i;
  98         for( i=0; supportedControls[i].sc_oid; i++ ) {
  99                 if( strcmp( oid, supportedControls[i].sc_oid ) == 0 ) {
 100                         return &supportedControls[i];
 101                 }
 102         }
 103         return NULL;
 104 }
 105
 106 int get_ctrls(
 107         Connection *conn,
 108         Operation *op,
 109         int sendres )
 110 {
 111         int nctrls = 0;
 112         ber_tag_t tag;
 113         ber_len_t len;
 114         char *opaque;
 115         BerElement *ber = op->o_ber;
 116         struct slap_control *sc;
 117         int rc = LDAP_SUCCESS;
 118         const char *errmsg = NULL;
 119
 120         len = ber_pvt_ber_remaining(ber);
 121
 122         if( len == 0) {
 123                 /* no controls */
 124                 rc = LDAP_SUCCESS;
 125                 return rc;
 126         }
 127
 128         if(( tag = ber_peek_tag( ber, &len )) != LDAP_TAG_CONTROLS ) {
 129                 if( tag == LBER_ERROR ) {
 130                         rc = SLAPD_DISCONNECT;
 131                         errmsg = "unexpected data in PDU";
 132                 }
 133
 134                 goto return_results;
 135         }
 136
 137 #ifdef NEW_LOGGING
 138         LDAP_LOG( OPERATION, ENTRY, "get_ctrls: conn %lu\n", conn->c_connid, 0, 0 );
 139 #else
 140         Debug( LDAP_DEBUG_TRACE, "=> get_ctrls\n", 0, 0, 0 );
 141 #endif
 142         if( op->o_protocol < LDAP_VERSION3 ) {
 143                 rc = SLAPD_DISCONNECT;
 144                 errmsg = "controls require LDAPv3";
 145                 goto return_results;
 146         }
 147
 148         /* one for first control, one for termination */
 149         op->o_ctrls = ch_malloc( 2 * sizeof(LDAPControl *) );
 150
 151 #if 0
 152         if( op->ctrls == NULL ) {
 153                 rc = LDAP_NO_MEMORY;
 154                 errmsg = "no memory";
 155                 goto return_results;
 156         }
 157 #endif
 158
 159         op->o_ctrls[nctrls] = NULL;
 160
 161         /* step through each element */
 162         for( tag = ber_first_element( ber, &len, &opaque );
 163                 tag != LBER_ERROR;
 164                 tag = ber_next_element( ber, &len, opaque ) )
 165         {
 166                 LDAPControl *c;
 167                 LDAPControl **tctrls;
 168
 169                 c = ch_calloc( 1, sizeof(LDAPControl) );
 170
 171 #if 0
 172                 if( c == NULL ) {
 173                         ldap_controls_free(op->o_ctrls);
 174                         op->o_ctrls = NULL;
 175
 176                         rc = LDAP_NO_MEMORY;
 177                         errmsg = "no memory";
 178                         goto return_results;
 179                 }
 180 #endif
 181
 182                 /* allocate pointer space for current controls (nctrls)
 183                  * + this control + extra NULL
 184                  */
 185                 tctrls = ch_realloc( op->o_ctrls,
 186                         (nctrls+2) * sizeof(LDAPControl *));
 187
 188 #if 0
 189                 if( tctrls == NULL ) {
 190                         ch_free( c );
 191                         ldap_controls_free(op->o_ctrls);
 192                         op->o_ctrls = NULL;
 193
 194                         rc = LDAP_NO_MEMORY;
 195                         errmsg = "no memory";
 196                         goto return_results;
 197                 }
 198 #endif
 199                 op->o_ctrls = tctrls;
 200
 201                 op->o_ctrls[nctrls++] = c;
 202                 op->o_ctrls[nctrls] = NULL;
 203
 204                 tag = ber_scanf( ber, "{a" /*}*/, &c->ldctl_oid );
 205
 206                 if( tag == LBER_ERROR ) {
 207 #ifdef NEW_LOGGING
 208                         LDAP_LOG( OPERATION, INFO, "get_ctrls: conn %lu get OID failed.\n",
 209                                 conn->c_connid, 0, 0 );
 210 #else
 211                         Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: get oid failed.\n",
 212                                 0, 0, 0 );
 213 #endif
 214                         ldap_controls_free( op->o_ctrls );
 215                         op->o_ctrls = NULL;
 216                         rc = SLAPD_DISCONNECT;
 217                         errmsg = "decoding controls error";
 218                         goto return_results;
 219                 }
 220
 221                 tag = ber_peek_tag( ber, &len );
 222
 223                 if( tag == LBER_BOOLEAN ) {
 224                         ber_int_t crit;
 225                         tag = ber_scanf( ber, "b", &crit );
 226
 227                         if( tag == LBER_ERROR ) {
 228 #ifdef NEW_LOGGING
 229                                 LDAP_LOG( OPERATION, INFO,
 230                                         "get_ctrls: conn %lu get crit failed.\n",
 231                                         conn->c_connid, 0, 0 );
 232 #else
 233                                 Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: get crit failed.\n",
 234                                         0, 0, 0 );
 235 #endif
 236                                 ldap_controls_free( op->o_ctrls );
 237                                 op->o_ctrls = NULL;
 238                                 rc = SLAPD_DISCONNECT;
 239                                 errmsg = "decoding controls error";
 240                                 goto return_results;
 241                         }
 242
 243                         c->ldctl_iscritical = (crit != 0);
 244                         tag = ber_peek_tag( ber, &len );
 245                 }
 246
 247                 if( tag == LBER_OCTETSTRING ) {
 248                         tag = ber_scanf( ber, "o", &c->ldctl_value );
 249
 250                         if( tag == LBER_ERROR ) {
 251 #ifdef NEW_LOGGING
 252                                 LDAP_LOG( OPERATION, INFO, "get_ctrls: conn %lu: "
 253                                         "%s (%scritical): get value failed.\n",
 254                                         conn->c_connid, c->ldctl_oid ? c->ldctl_oid : "(NULL)",
 255                                         c->ldctl_iscritical ? "" : "non" );
 256 #else
 257                                 Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: conn %lu: "
 258                                         "%s (%scritical): get value failed.\n",
 259                                         conn->c_connid,
 260                                         c->ldctl_oid ? c->ldctl_oid : "(NULL)",
 261                                         c->ldctl_iscritical ? "" : "non" );
 262 #endif
 263                                 ldap_controls_free( op->o_ctrls );
 264                                 op->o_ctrls = NULL;
 265                                 rc = SLAPD_DISCONNECT;
 266                                 errmsg = "decoding controls error";
 267                                 goto return_results;
 268                         }
 269                 }
 270
 271 #ifdef NEW_LOGGING
 272                 LDAP_LOG( OPERATION, INFO,
 273                         "get_ctrls: conn %lu oid=\"%s\" (%scritical)\n",
 274                         conn->c_connid, c->ldctl_oid ? c->ldctl_oid : "(NULL)",
 275                         c->ldctl_iscritical ? "" : "non" );
 276 #else
 277                 Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: oid=\"%s\" (%scritical)\n",
 278                         c->ldctl_oid ? c->ldctl_oid : "(NULL)",
 279                         c->ldctl_iscritical ? "" : "non",
 280                         0 );
 281 #endif
 282
 283                 sc = find_ctrl( c->ldctl_oid );
 284                 if( sc != NULL ) {
 285                         /* recognized control */
 286                         slap_mask_t tagmask;
 287                         switch( op->o_tag ) {
 288                         case LDAP_REQ_ADD:
 289                                 tagmask = SLAP_CTRL_ADD;
 290                                 break;
 291                         case LDAP_REQ_BIND:
 292                                 tagmask = SLAP_CTRL_BIND;
 293                                 break;
 294                         case LDAP_REQ_COMPARE:
 295                                 tagmask = SLAP_CTRL_COMPARE;
 296                                 break;
 297                         case LDAP_REQ_DELETE:
 298                                 tagmask = SLAP_CTRL_DELETE;
 299                                 break;
 300                         case LDAP_REQ_MODIFY:
 301                                 tagmask = SLAP_CTRL_MODIFY;
 302                                 break;
 303                         case LDAP_REQ_RENAME:
 304                                 tagmask = SLAP_CTRL_RENAME;
 305                                 break;
 306                         case LDAP_REQ_SEARCH:
 307                                 tagmask = SLAP_CTRL_SEARCH;
 308                                 break;
 309                         case LDAP_REQ_UNBIND:
 310                                 tagmask = SLAP_CTRL_UNBIND;
 311                                 break;
 312                         case LDAP_REQ_EXTENDED:
 313                                 /* FIXME: check list of extended operations */
 314                                 tagmask = ~0U;
 315                                 break;
 316                         default:
 317                                 rc = LDAP_OTHER;
 318                                 errmsg = "controls internal error";
 319                                 goto return_results;
 320                         }
 321
 322                         if (( sc->sc_mask & tagmask ) == tagmask ) {
 323                                 /* available extension */
 324
 325                                 if( !sc->sc_parse ) {
 326                                         rc = LDAP_OTHER;
 327                                         errmsg = "not yet implemented";
 328                                         goto return_results;
 329                                 }
 330
 331                                 rc = sc->sc_parse( conn, op, c, &errmsg );
 332
 333                                 if( rc != LDAP_SUCCESS ) goto return_results;
 334
 335                                 if ( sc->sc_mask & SLAP_CTRL_FRONTEND ) {
 336                                         /* kludge to disable backend_control() check */
 337                                         c->ldctl_iscritical = 0;
 338
 339                                 } else if ( tagmask == SLAP_CTRL_SEARCH &&
 340                                         sc->sc_mask & SLAP_CTRL_FRONTEND_SEARCH )
 341                                 {
 342                                         /* kludge to disable backend_control() check */
 343                                         c->ldctl_iscritical = 0;
 344                                 }
 345
 346                         } else if( c->ldctl_iscritical ) {
 347                                 /* unavailable CRITICAL control */
 348                                 rc = LDAP_UNAVAILABLE_CRITICAL_EXTENSION;
 349                                 errmsg = "critical extension is unavailable";
 350                                 goto return_results;
 351                         }
 352
 353                 } else if( c->ldctl_iscritical ) {
 354                         /* unrecognized CRITICAL control */
 355                         rc = LDAP_UNAVAILABLE_CRITICAL_EXTENSION;
 356                         errmsg = "critical extension is not recognized";
 357                         goto return_results;
 358                 }
 359         }
 360
 361 return_results:
 362 #ifdef NEW_LOGGING
 363         LDAP_LOG( OPERATION, RESULTS,
 364                 "get_ctrls: n=%d rc=%d err=%s\n", nctrls, rc, errmsg ? errmsg : "" );
 365 #else
 366         Debug( LDAP_DEBUG_TRACE, "<= get_ctrls: n=%d rc=%d err=%s\n",
 367                 nctrls, rc, errmsg ? errmsg : "");
 368 #endif
 369
 370         if( sendres && rc != LDAP_SUCCESS ) {
 371                 if( rc == SLAPD_DISCONNECT ) {
 372                         send_ldap_disconnect( conn, op, LDAP_PROTOCOL_ERROR, errmsg );
 373                 } else {
 374                         send_ldap_result( conn, op, rc,
 375                                 NULL, errmsg, NULL, NULL );
 376                 }
 377         }
 378
 379         return rc;
 380 }
 381
 382 static int parseManageDSAit (
 383         Connection *conn,
 384         Operation *op,
 385         LDAPControl *ctrl,
 386         const char **text )
 387 {
 388         if ( op->o_managedsait != SLAP_NO_CONTROL ) {
 389                 *text = "manageDSAit control specified multiple times";
 390                 return LDAP_PROTOCOL_ERROR;
 391         }
 392
 393         if ( ctrl->ldctl_value.bv_len ) {
 394                 *text = "manageDSAit control value not empty";
 395                 return LDAP_PROTOCOL_ERROR;
 396         }
 397
 398         op->o_managedsait = ctrl->ldctl_iscritical
 399                 ? SLAP_CRITICAL_CONTROL
 400                 : SLAP_NONCRITICAL_CONTROL;
 401
 402         return LDAP_SUCCESS;
 403 }
 404
 405 #ifdef LDAP_CONTROL_SUBENTRIES
 406 static int parseSubentries (
 407         Connection *conn,
 408         Operation *op,
 409         LDAPControl *ctrl,
 410         const char **text )
 411 {
 412         if ( op->o_subentries != SLAP_NO_CONTROL ) {
 413                 *text = "subentries control specified multiple times";
 414                 return LDAP_PROTOCOL_ERROR;
 415         }
 416
 417         /* FIXME: should use BER library */
 418         if( ( ctrl->ldctl_value.bv_len != 3 )
 419                 && ( ctrl->ldctl_value.bv_val[0] != 0x01 )
 420                 && ( ctrl->ldctl_value.bv_val[1] != 0x01 ))
 421         {
 422                 *text = "subentries control value encoding is bogus";
 423                 return LDAP_PROTOCOL_ERROR;
 424         }
 425
 426         op->o_subentries = ctrl->ldctl_iscritical
 427                 ? SLAP_CRITICAL_CONTROL
 428                 : SLAP_NONCRITICAL_CONTROL;
 429
 430         op->o_subentries_visibility = (ctrl->ldctl_value.bv_val[2] != 0x00);
 431
 432         return LDAP_SUCCESS;
 433 }
 434 #endif
 435
 436 #ifdef LDAP_CONTROL_NOOP
 437 static int parseNoOp (
 438         Connection *conn,
 439         Operation *op,
 440         LDAPControl *ctrl,
 441         const char **text )
 442 {
 443         if ( op->o_noop != SLAP_NO_CONTROL ) {
 444                 *text = "noop control specified multiple times";
 445                 return LDAP_PROTOCOL_ERROR;
 446         }
 447
 448         if ( ctrl->ldctl_value.bv_len ) {
 449                 *text = "noop control value not empty";
 450                 return LDAP_PROTOCOL_ERROR;
 451         }
 452
 453         op->o_noop = ctrl->ldctl_iscritical
 454                 ? SLAP_CRITICAL_CONTROL
 455                 : SLAP_NONCRITICAL_CONTROL;
 456
 457         return LDAP_SUCCESS;
 458 }
 459 #endif
 460
 461 #ifdef LDAP_CONTROL_PAGEDRESULTS_REQUEST
 462 static int parsePagedResults (
 463         Connection *conn,
 464         Operation *op,
 465         LDAPControl *ctrl,
 466         const char **text )
 467 {
 468         ber_tag_t tag;
 469         ber_int_t size;
 470         BerElement *ber;
 471         struct berval cookie = { 0, NULL };
 472
 473         if ( op->o_pagedresults != SLAP_NO_CONTROL ) {
 474                 *text = "paged results control specified multiple times";
 475                 return LDAP_PROTOCOL_ERROR;
 476         }
 477
 478         if ( ctrl->ldctl_value.bv_len == 0 ) {
 479                 *text = "paged results control value is empty";
 480                 return LDAP_PROTOCOL_ERROR;
 481         }
 482
 483         /* Parse the control value
 484          *      realSearchControlValue ::= SEQUENCE {
 485          *              size    INTEGER (0..maxInt),
 486          *                              -- requested page size from client
 487          *                              -- result set size estimate from server
 488          *              cookie  OCTET STRING
 489          */
 490         ber = ber_init( &ctrl->ldctl_value );
 491         if( ber == NULL ) {
 492                 *text = "internal error";
 493                 return LDAP_OTHER;
 494         }
 495
 496         tag = ber_scanf( ber, "{im}", &size, &cookie );
 497         (void) ber_free( ber, 1 );
 498
 499         if( tag == LBER_ERROR ) {
 500                 *text = "paged results control could not be decoded";
 501                 return LDAP_PROTOCOL_ERROR;
 502         }
 503
 504         if( size <= 0 ) {
 505                 *text = "paged results control size invalid";
 506                 return LDAP_PROTOCOL_ERROR;
 507         }
 508
 509         if( cookie.bv_len ) {
 510                 PagedResultsCookie reqcookie;
 511                 if( cookie.bv_len != sizeof( reqcookie ) ) {
 512                         /* bad cookie */
 513                         *text = "paged results cookie is invalid";
 514                         return LDAP_PROTOCOL_ERROR;
 515                 }
 516
 517                 AC_MEMCPY( &reqcookie, cookie.bv_val, sizeof( reqcookie ));
 518
 519                 if( reqcookie > op->o_pagedresults_state.ps_cookie ) {
 520                         /* bad cookie */
 521                         *text = "paged results cookie is invalid";
 522                         return LDAP_PROTOCOL_ERROR;
 523
 524                 } else if( reqcookie < op->o_pagedresults_state.ps_cookie ) {
 525                         *text = "paged results cookie is invalid or old";
 526                         return LDAP_UNWILLING_TO_PERFORM;
 527                 }
 528         }
 529
 530         op->o_pagedresults_state.ps_cookie = op->o_opid;
 531         op->o_pagedresults_size = size;
 532
 533         op->o_pagedresults = ctrl->ldctl_iscritical
 534                 ? SLAP_CRITICAL_CONTROL
 535                 : SLAP_NONCRITICAL_CONTROL;
 536
 537         return LDAP_SUCCESS;
 538 }
 539 #endif
 540
 541 #ifdef LDAP_CONTROL_VALUESRETURNFILTER
 542 int parseValuesReturnFilter (
 543         Connection *conn,
 544         Operation *op,
 545         LDAPControl *ctrl,
 546         const char **text )
 547 {
 548         int             rc;
 549         BerElement      *ber;
 550         struct berval   fstr = { 0, NULL };
 551         const char *err_msg = "";
 552
 553         if ( op->o_valuesreturnfilter != SLAP_NO_CONTROL ) {
 554                 *text = "valuesreturnfilter control specified multiple times";
 555                 return LDAP_PROTOCOL_ERROR;
 556         }
 557
 558         ber = ber_init( &(ctrl->ldctl_value) );
 559         if (ber == NULL) {
 560                 *text = "internal error";
 561                 return LDAP_OTHER;
 562         }
 563
 564         rc = get_vrFilter( conn, ber, &(op->vrFilter), &err_msg);
 565
 566         if( rc != LDAP_SUCCESS ) {
 567                 text = &err_msg;
 568                 if( rc == SLAPD_DISCONNECT ) {
 569                         send_ldap_disconnect( conn, op,
 570                                 LDAP_PROTOCOL_ERROR, *text );
 571                 } else {
 572                         send_ldap_result( conn, op, rc,
 573                                 NULL, *text, NULL, NULL );
 574                 }
 575                 if( fstr.bv_val != NULL) free( fstr.bv_val );
 576                 if( op->vrFilter != NULL) vrFilter_free( op->vrFilter );
 577
 578         } else {
 579                 vrFilter2bv( op->vrFilter, &fstr );
 580         }
 581
 582 #ifdef NEW_LOGGING
 583         LDAP_LOG( OPERATION, ARGS,
 584                 "parseValuesReturnFilter: conn %d       vrFilter: %s\n",
 585                 conn->c_connid, fstr.bv_len ? fstr.bv_val : "empty" , 0 );
 586 #else
 587         Debug( LDAP_DEBUG_ARGS, "       vrFilter: %s\n",
 588                 fstr.bv_len ? fstr.bv_val : "empty", 0, 0 );
 589 #endif
 590
 591         op->o_valuesreturnfilter = ctrl->ldctl_iscritical
 592                 ? SLAP_CRITICAL_CONTROL
 593                 : SLAP_NONCRITICAL_CONTROL;
 594
 595         return LDAP_SUCCESS;
 596 }
 597 #endif