git.sur5r.net Git - openldap/blob - servers/slapd/controls.c

   1 /* $OpenLDAP$ */
   2 /*
   3  * Copyright 1999-2002 The OpenLDAP Foundation.
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms are permitted only
   7  * as authorized by the OpenLDAP Public License.  A copy of this
   8  * license is available at http://www.OpenLDAP.org/license.html or
   9  * in file LICENSE in the top-level directory of the distribution.
  10  */
  11 #include "portable.h"
  12
  13 #include <stdio.h>
  14
  15 #include <ac/string.h>
  16 #include <ac/socket.h>
  17
  18 #include "slap.h"
  19
  20 #include "../../libraries/liblber/lber-int.h"
  21
  22 #define SLAP_CTRL_FRONTEND      0x80000000U
  23
  24 #define SLAP_CTRL_OPFLAGS       0x0000FFFFU
  25 #define SLAP_CTRL_ABANDON       0x00000001U
  26 #define SLAP_CTRL_ADD           0x00002002U
  27 #define SLAP_CTRL_BIND          0x00000004U
  28 #define SLAP_CTRL_COMPARE       0x00001008U
  29 #define SLAP_CTRL_DELETE        0x00002010U
  30 #define SLAP_CTRL_MODIFY        0x00002020U
  31 #define SLAP_CTRL_RENAME        0x00002040U
  32 #define SLAP_CTRL_SEARCH        0x00001080U
  33 #define SLAP_CTRL_UNBIND        0x00000100U
  34
  35 #define SLAP_CTRL_INTROGATE     (SLAP_CTRL_COMPARE|SLAP_CTRL_SEARCH)
  36 #define SLAP_CTRL_UPDATE \
  37         (SLAP_CTRL_ADD|SLAP_CTRL_DELETE|SLAP_CTRL_MODIFY|SLAP_CTRL_RENAME)
  38 #define SLAP_CTRL_ACCESS        (SLAP_CTRL_INTROGATE|SLAP_CTRL_UPDATE)
  39
  40 typedef int (SLAP_CTRL_PARSE_FN) LDAP_P((
  41         Connection *conn,
  42         Operation *op,
  43         LDAPControl *ctrl,
  44         const char **text ));
  45
  46 static SLAP_CTRL_PARSE_FN parseManageDSAit;
  47 static SLAP_CTRL_PARSE_FN parseSubentries;
  48 static SLAP_CTRL_PARSE_FN parseNoOp;
  49
  50 static struct slap_control {
  51         char *sc_oid;
  52         slap_mask_t sc_mask;
  53         char **sc_extendedops;
  54         SLAP_CTRL_PARSE_FN *sc_parse;
  55
  56 } supportedControls[] = {
  57         { LDAP_CONTROL_MANAGEDSAIT,
  58                 SLAP_CTRL_ACCESS, NULL,
  59                 parseManageDSAit },
  60         { LDAP_CONTROL_SUBENTRIES,
  61                 SLAP_CTRL_SEARCH, NULL,
  62                 parseSubentries },
  63 #ifdef LDAP_CONTROL_NOOP
  64         { LDAP_CONTROL_NOOP,
  65                 SLAP_CTRL_UPDATE, NULL,
  66                 parseNoOp },
  67 #endif
  68         { NULL }
  69 };
  70
  71 char *
  72 get_supported_ctrl(int index)
  73 {
  74         return supportedControls[index].sc_oid;
  75 }
  76
  77 static struct slap_control *
  78 find_ctrl( const char *oid )
  79 {
  80         int i;
  81         for( i=0; supportedControls[i].sc_oid; i++ ) {
  82                 if( strcmp( oid, supportedControls[i].sc_oid ) == 0 ) {
  83                         return &supportedControls[i];
  84                 }
  85         }
  86         return NULL;
  87 }
  88
  89 int get_ctrls(
  90         Connection *conn,
  91         Operation *op,
  92         int sendres )
  93 {
  94         int nctrls = 0;
  95         ber_tag_t tag;
  96         ber_len_t len;
  97         char *opaque;
  98         BerElement *ber = op->o_ber;
  99         LDAPControl ***ctrls = &op->o_ctrls;
 100         struct slap_control *c;
 101         int rc = LDAP_SUCCESS;
 102         const char *errmsg = NULL;
 103
 104         len = ber_pvt_ber_remaining(ber);
 105
 106         if( len == 0) {
 107                 /* no controls */
 108                 rc = LDAP_SUCCESS;
 109                 return rc;
 110         }
 111
 112         if(( tag = ber_peek_tag( ber, &len )) != LDAP_TAG_CONTROLS ) {
 113                 if( tag == LBER_ERROR ) {
 114                         rc = SLAPD_DISCONNECT;
 115                         errmsg = "unexpected data in PDU";
 116                 }
 117
 118                 goto return_results;
 119         }
 120
 121 #ifdef NEW_LOGGING
 122         LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY,
 123                 "get_ctrls: conn %d\n", conn->c_connid ));
 124 #else
 125         Debug( LDAP_DEBUG_TRACE, "=> get_ctrls\n", 0, 0, 0 );
 126 #endif
 127         if( op->o_protocol < LDAP_VERSION3 ) {
 128                 rc = SLAPD_DISCONNECT;
 129                 errmsg = "controls require LDAPv3";
 130                 goto return_results;
 131         }
 132
 133         /* set through each element */
 134         *ctrls = ch_malloc( 1 * sizeof(LDAPControl *) );
 135
 136 #if 0
 137         if( *ctrls == NULL ) {
 138                 rc = LDAP_NO_MEMORY;
 139                 errmsg = "no memory";
 140                 goto return_results;
 141         }
 142 #endif
 143
 144         *ctrls[nctrls] = NULL;
 145
 146         for( tag = ber_first_element( ber, &len, &opaque );
 147                 tag != LBER_ERROR;
 148                 tag = ber_next_element( ber, &len, opaque ) )
 149         {
 150                 LDAPControl *tctrl;
 151                 LDAPControl **tctrls;
 152
 153                 tctrl = ch_calloc( 1, sizeof(LDAPControl) );
 154                 tctrl->ldctl_oid = NULL;
 155                 tctrl->ldctl_value.bv_val = NULL;
 156
 157                 /* allocate pointer space for current controls (nctrls)
 158                  * + this control + extra NULL
 159                  */
 160                 tctrls = (tctrl == NULL) ? NULL :
 161                         ch_realloc(*ctrls, (nctrls+2) * sizeof(LDAPControl *));
 162
 163 #if 0
 164                 if( tctrls == NULL ) {
 165                         /* one of the above allocation failed */
 166
 167                         if( tctrl != NULL ) {
 168                                 ch_free( tctrl );
 169                         }
 170
 171                         ldap_controls_free(*ctrls);
 172                         *ctrls = NULL;
 173
 174                         rc = LDAP_NO_MEMORY;
 175                         errmsg = "no memory";
 176                         goto return_results;
 177                 }
 178 #endif
 179
 180                 tctrls[nctrls++] = tctrl;
 181                 tctrls[nctrls] = NULL;
 182
 183                 tag = ber_scanf( ber, "{a" /*}*/, &tctrl->ldctl_oid );
 184
 185                 if( tag == LBER_ERROR ) {
 186 #ifdef NEW_LOGGING
 187                         LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
 188                                 "get_ctrls: conn %d get OID failed.\n",
 189                                 conn->c_connid ));
 190 #else
 191                         Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: get oid failed.\n",
 192                                 0, 0, 0 );
 193 #endif
 194                         *ctrls = NULL;
 195                         ldap_controls_free( tctrls );
 196                         rc = SLAPD_DISCONNECT;
 197                         errmsg = "decoding controls error";
 198                         goto return_results;
 199                 }
 200
 201                 tag = ber_peek_tag( ber, &len );
 202
 203                 if( tag == LBER_BOOLEAN ) {
 204                         ber_int_t crit;
 205                         tag = ber_scanf( ber, "b", &crit );
 206
 207                         if( tag == LBER_ERROR ) {
 208 #ifdef NEW_LOGGING
 209                                 LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
 210                                         "get_ctrls: conn %d get crit failed.\n",
 211                                         conn->c_connid ));
 212 #else
 213                                 Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: get crit failed.\n",
 214                                         0, 0, 0 );
 215 #endif
 216                                 *ctrls = NULL;
 217                                 ldap_controls_free( tctrls );
 218                                 rc = SLAPD_DISCONNECT;
 219                                 errmsg = "decoding controls error";
 220                                 goto return_results;
 221                         }
 222
 223                         tctrl->ldctl_iscritical = (crit != 0);
 224                         tag = ber_peek_tag( ber, &len );
 225                 }
 226
 227 #ifdef NEW_LOGGING
 228                 LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
 229                         "get_ctrls: conn %d oid=\"%s\" (%scritical)\n",
 230                         conn->c_connid, tctrl->ldctl_oid,
 231                         tctrl->ldctl_iscritical ? "" : "non" ));
 232 #else
 233                 Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: oid=\"%s\" (%scritical)\n",
 234                         tctrl->ldctl_oid,
 235                         tctrl->ldctl_iscritical ? "" : "non",
 236                         0 );
 237 #endif
 238                 if( tag == LBER_OCTETSTRING ) {
 239                         tag = ber_scanf( ber, "o", &tctrl->ldctl_value );
 240
 241                         if( tag == LBER_ERROR ) {
 242 #ifdef NEW_LOGGING
 243                                 LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
 244                                         "get_ctrls: conn %d  get value failed.\n", conn->c_connid ));
 245 #else
 246                                 Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: get value failed.\n",
 247                                         0, 0, 0 );
 248 #endif
 249                                 *ctrls = NULL;
 250                                 ldap_controls_free( tctrls );
 251                                 rc = SLAPD_DISCONNECT;
 252                                 errmsg = "decoding controls error";
 253                                 goto return_results;
 254                         }
 255                 }
 256
 257                 c = find_ctrl( tctrl->ldctl_oid );
 258                 if( c != NULL ) {
 259                         /* recongized control */
 260                         slap_mask_t tagmask;
 261                         switch( op->o_tag ) {
 262                         case LDAP_REQ_ADD:
 263                                 tagmask = SLAP_CTRL_ADD;
 264                                 break;
 265                         case LDAP_REQ_BIND:
 266                                 tagmask = SLAP_CTRL_BIND;
 267                                 break;
 268                         case LDAP_REQ_COMPARE:
 269                                 tagmask = SLAP_CTRL_COMPARE;
 270                                 break;
 271                         case LDAP_REQ_DELETE:
 272                                 tagmask = SLAP_CTRL_DELETE;
 273                                 break;
 274                         case LDAP_REQ_MODIFY:
 275                                 tagmask = SLAP_CTRL_MODIFY;
 276                                 break;
 277                         case LDAP_REQ_RENAME:
 278                                 tagmask = SLAP_CTRL_RENAME;
 279                                 break;
 280                         case LDAP_REQ_SEARCH:
 281                                 tagmask = SLAP_CTRL_SEARCH;
 282                                 break;
 283                         case LDAP_REQ_UNBIND:
 284                                 tagmask = SLAP_CTRL_UNBIND;
 285                                 break;
 286                         case LDAP_REQ_EXTENDED:
 287                                 /* FIXME: check list of extended operations */
 288                                 tagmask = ~0U;
 289                                 break;
 290                         default:
 291                                 rc = LDAP_OTHER;
 292                                 errmsg = "controls internal error";
 293                                 goto return_results;
 294                         }
 295
 296                         if (( c->sc_mask & tagmask ) == tagmask ) {
 297                                 /* available extension */
 298
 299                                 if( !c->sc_parse ) {
 300                                         rc = LDAP_OTHER;
 301                                         errmsg = "not yet implemented";
 302                                         goto return_results;
 303                                 }
 304
 305                                 rc = c->sc_parse( conn, op, tctrl, &errmsg );
 306
 307                                 if( rc != LDAP_SUCCESS ) goto return_results;
 308
 309                                 if( c->sc_mask & SLAP_CTRL_FRONTEND ) {
 310                                         /* kludge to disable backend_control() check */
 311                                         tctrl->ldctl_iscritical = 0;
 312                                 }
 313
 314                         } else if( tctrl->ldctl_iscritical ) {
 315                                 /* unavailable CRITICAL control */
 316                                 rc = LDAP_UNAVAILABLE_CRITICAL_EXTENSION;
 317                                 errmsg = "critical extension is unavailable";
 318                                 goto return_results;
 319                         }
 320
 321                 } else if( tctrl->ldctl_iscritical ) {
 322                         /* unrecongized CRITICAL control */
 323                         rc = LDAP_UNAVAILABLE_CRITICAL_EXTENSION;
 324                         errmsg = "critical extension is not recongized";
 325                         goto return_results;
 326                 }
 327
 328                 *ctrls = tctrls;
 329         }
 330
 331 return_results:
 332 #ifdef NEW_LOGGING
 333         LDAP_LOG(( "operation", LDAP_LEVEL_RESULTS,
 334                 "get_ctrls: conn %d     %d %d %s\n",
 335                 conn->c_connid, nctrls, rc, errmsg ? errmsg : "" ));
 336 #else
 337         Debug( LDAP_DEBUG_TRACE, "<= get_ctrls: %d %d %s\n",
 338                 nctrls, rc, errmsg ? errmsg : "");
 339 #endif
 340
 341         if( sendres && rc != LDAP_SUCCESS ) {
 342                 if( rc == SLAPD_DISCONNECT ) {
 343                         send_ldap_disconnect( conn, op, LDAP_PROTOCOL_ERROR, errmsg );
 344                 } else {
 345                         send_ldap_result( conn, op, rc,
 346                                 NULL, errmsg, NULL, NULL );
 347                 }
 348         }
 349
 350         return rc;
 351 }
 352
 353 static int parseManageDSAit (
 354         Connection *conn,
 355         Operation *op,
 356         LDAPControl *ctrl,
 357         const char **text )
 358 {
 359         if ( op->o_managedsait != SLAP_NO_CONTROL ) {
 360                 *text = "manageDSAit control specified multiple times";
 361                 return LDAP_PROTOCOL_ERROR;
 362         }
 363
 364         if ( ctrl->ldctl_value.bv_len ) {
 365                 *text = "manageDSAit control value not empty";
 366                 return LDAP_PROTOCOL_ERROR;
 367         }
 368
 369         op->o_managedsait = ctrl->ldctl_iscritical
 370                 ? SLAP_CRITICAL_CONTROL
 371                 : SLAP_NONCRITICAL_CONTROL;
 372
 373         return LDAP_SUCCESS;
 374 }
 375
 376 static int parseSubentries (
 377         Connection *conn,
 378         Operation *op,
 379         LDAPControl *ctrl,
 380         const char **text )
 381 {
 382         if ( op->o_subentries != SLAP_NO_CONTROL ) {
 383                 *text = "subentries control specified multiple times";
 384                 return LDAP_PROTOCOL_ERROR;
 385         }
 386
 387         /* FIXME: should use BER library */
 388         if( ( ctrl->ldctl_value.bv_len != 3 )
 389                 && ( ctrl->ldctl_value.bv_val[0] != 0x01 )
 390                 && ( ctrl->ldctl_value.bv_val[1] != 0x01 ))
 391         {
 392                 *text = "subentries control value encoding is bogus";
 393                 return LDAP_PROTOCOL_ERROR;
 394         }
 395
 396         op->o_subentries = ctrl->ldctl_iscritical
 397                 ? SLAP_CRITICAL_CONTROL
 398                 : SLAP_NONCRITICAL_CONTROL;
 399
 400         op->o_subentries_visibility = (ctrl->ldctl_value.bv_val[2] != 0x00);
 401
 402         return LDAP_SUCCESS;
 403 }
 404
 405 static int parseNoOp (
 406         Connection *conn,
 407         Operation *op,
 408         LDAPControl *ctrl,
 409         const char **text )
 410 {
 411         if ( op->o_noop != SLAP_NO_CONTROL ) {
 412                 *text = "noop control specified multiple times";
 413                 return LDAP_PROTOCOL_ERROR;
 414         }
 415
 416         if ( ctrl->ldctl_value.bv_len ) {
 417                 *text = "noop control value not empty";
 418                 return LDAP_PROTOCOL_ERROR;
 419         }
 420
 421         op->o_noop = ctrl->ldctl_iscritical
 422                 ? SLAP_CRITICAL_CONTROL
 423                 : SLAP_NONCRITICAL_CONTROL;
 424
 425         return LDAP_SUCCESS;
 426 }
 427