git.sur5r.net Git - openldap/blob - servers/slapd/controls.c

   1 /* $OpenLDAP$ */
   2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   3  *
   4  * Copyright 1998-2004 The OpenLDAP Foundation.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted only as authorized by the OpenLDAP
   9  * Public License.
  10  *
  11  * A copy of this license is available in the file LICENSE in the
  12  * top-level directory of the distribution or, alternatively, at
  13  * <http://www.OpenLDAP.org/license.html>.
  14  */
  15
  16 #include "portable.h"
  17
  18 #include <stdio.h>
  19
  20 #include <ac/string.h>
  21 #include <ac/socket.h>
  22
  23 #include "slap.h"
  24
  25 #include "../../libraries/liblber/lber-int.h"
  26
  27 static SLAP_CTRL_PARSE_FN parseAssert;
  28 static SLAP_CTRL_PARSE_FN parsePreRead;
  29 static SLAP_CTRL_PARSE_FN parsePostRead;
  30 static SLAP_CTRL_PARSE_FN parseProxyAuthz;
  31 static SLAP_CTRL_PARSE_FN parseManageDSAit;
  32 static SLAP_CTRL_PARSE_FN parseModifyIncrement;
  33 static SLAP_CTRL_PARSE_FN parseNoOp;
  34 static SLAP_CTRL_PARSE_FN parsePagedResults;
  35 static SLAP_CTRL_PARSE_FN parseValuesReturnFilter;
  36 static SLAP_CTRL_PARSE_FN parsePermissiveModify;
  37 static SLAP_CTRL_PARSE_FN parseDomainScope;
  38 static SLAP_CTRL_PARSE_FN parseTreeDelete;
  39 static SLAP_CTRL_PARSE_FN parseSearchOptions;
  40
  41 #ifdef LDAP_CONTROL_SUBENTRIES
  42 static SLAP_CTRL_PARSE_FN parseSubentries;
  43 #endif
  44 static SLAP_CTRL_PARSE_FN parseLDAPsync;
  45
  46 #undef sc_mask /* avoid conflict with Irix 6.5 <sys/signal.h> */
  47
  48 const struct berval slap_pre_read_bv = BER_BVC(LDAP_CONTROL_PRE_READ);
  49 const struct berval slap_post_read_bv = BER_BVC(LDAP_CONTROL_POST_READ);
  50
  51 struct slap_control {
  52         /* Control OID */
  53         char *sc_oid;
  54
  55         /* Operations supported by control */
  56         slap_mask_t sc_mask;
  57
  58         /* Extended operations supported by control */
  59         char **sc_extendedops;
  60
  61         /* Control parsing callback */
  62         SLAP_CTRL_PARSE_FN *sc_parse;
  63
  64         LDAP_SLIST_ENTRY(slap_control) sc_next;
  65 };
  66
  67 static LDAP_SLIST_HEAD(ControlsList, slap_control) controls_list
  68         = LDAP_SLIST_HEAD_INITIALIZER(&controls_list);
  69
  70 /*
  71  * all known request control OIDs should be added to this list
  72  */
  73 char **slap_known_controls = NULL;
  74
  75 static char *proxy_authz_extops[] = {
  76         LDAP_EXOP_MODIFY_PASSWD,
  77         LDAP_EXOP_X_WHO_AM_I,
  78         NULL
  79 };
  80
  81 static struct slap_control control_defs[] = {
  82         { LDAP_CONTROL_ASSERT,
  83                 SLAP_CTRL_HIDE|SLAP_CTRL_ACCESS, NULL,
  84                 parseAssert, LDAP_SLIST_ENTRY_INITIALIZER(next) },
  85         { LDAP_CONTROL_PRE_READ,
  86                 SLAP_CTRL_HIDE|SLAP_CTRL_DELETE|SLAP_CTRL_MODIFY|SLAP_CTRL_RENAME, NULL,
  87                 parsePreRead, LDAP_SLIST_ENTRY_INITIALIZER(next) },
  88         { LDAP_CONTROL_POST_READ,
  89                 SLAP_CTRL_HIDE|SLAP_CTRL_ADD|SLAP_CTRL_MODIFY|SLAP_CTRL_RENAME, NULL,
  90                 parsePostRead, LDAP_SLIST_ENTRY_INITIALIZER(next) },
  91         { LDAP_CONTROL_VALUESRETURNFILTER,
  92                 SLAP_CTRL_SEARCH, NULL,
  93                 parseValuesReturnFilter, LDAP_SLIST_ENTRY_INITIALIZER(next) },
  94         { LDAP_CONTROL_PAGEDRESULTS,
  95                 SLAP_CTRL_SEARCH, NULL,
  96                 parsePagedResults, LDAP_SLIST_ENTRY_INITIALIZER(next) },
  97 #ifdef LDAP_CONTROL_X_DOMAIN_SCOPE
  98         { LDAP_CONTROL_X_DOMAIN_SCOPE,
  99                 SLAP_CTRL_FRONTEND|SLAP_CTRL_SEARCH, NULL,
 100                 parseDomainScope, LDAP_SLIST_ENTRY_INITIALIZER(next) },
 101 #endif
 102 #ifdef LDAP_CONTROL_X_PERMISSIVE_MODIFY
 103         { LDAP_CONTROL_X_PERMISSIVE_MODIFY,
 104                 SLAP_CTRL_MODIFY, NULL,
 105                 parsePermissiveModify, LDAP_SLIST_ENTRY_INITIALIZER(next) },
 106 #endif
 107 #ifdef LDAP_CONTROL_X_TREE_DELETE
 108         { LDAP_CONTROL_X_TREE_DELETE,
 109                 SLAP_CTRL_DELETE, NULL,
 110                 parseTreeDelete, LDAP_SLIST_ENTRY_INITIALIZER(next) },
 111 #endif
 112 #ifdef LDAP_CONTORL_X_SEARCH_OPTIONS
 113         { LDAP_CONTORL_X_SEARCH_OPTIONS,
 114                 SLAP_CTRL_FRONTEND|SLAP_CTRL_SEARCH, NULL,
 115                 parseSearchOptions, LDAP_SLIST_ENTRY_INITIALIZER(next) },
 116 #endif
 117 #ifdef LDAP_CONTROL_SUBENTRIES
 118         { LDAP_CONTROL_SUBENTRIES,
 119                 SLAP_CTRL_SEARCH, NULL,
 120                 parseSubentries, LDAP_SLIST_ENTRY_INITIALIZER(next) },
 121 #endif
 122         { LDAP_CONTROL_NOOP,
 123                 SLAP_CTRL_HIDE|SLAP_CTRL_ACCESS, NULL,
 124                 parseNoOp, LDAP_SLIST_ENTRY_INITIALIZER(next) },
 125         { LDAP_CONTROL_SYNC,
 126                 SLAP_CTRL_HIDE|SLAP_CTRL_SEARCH, NULL,
 127                 parseLDAPsync, LDAP_SLIST_ENTRY_INITIALIZER(next) },
 128 #ifdef LDAP_CONTROL_MODIFY_INCREMENT
 129         { LDAP_CONTROL_MODIFY_INCREMENT,
 130                 SLAP_CTRL_HIDE|SLAP_CTRL_MODIFY, NULL,
 131                 parseModifyIncrement, LDAP_SLIST_ENTRY_INITIALIZER(next) },
 132 #endif
 133         { LDAP_CONTROL_MANAGEDSAIT,
 134                 SLAP_CTRL_ACCESS, NULL,
 135                 parseManageDSAit, LDAP_SLIST_ENTRY_INITIALIZER(next) },
 136         { LDAP_CONTROL_PROXY_AUTHZ,
 137                 SLAP_CTRL_FRONTEND|SLAP_CTRL_ACCESS, proxy_authz_extops,
 138                 parseProxyAuthz, LDAP_SLIST_ENTRY_INITIALIZER(next) },
 139         { NULL, 0, NULL, 0, LDAP_SLIST_ENTRY_INITIALIZER(next) }
 140 };
 141
 142 /*
 143  * Register a supported control.
 144  *
 145  * This can be called by an OpenLDAP plugin or, indirectly, by a
 146  * SLAPI plugin calling slapi_register_supported_control().
 147  */
 148 int
 149 register_supported_control(const char *controloid,
 150         slap_mask_t controlmask,
 151         char **controlexops,
 152         SLAP_CTRL_PARSE_FN *controlparsefn)
 153 {
 154         struct slap_control *sc;
 155         int i;
 156
 157         if ( controloid == NULL ) {
 158                 return LDAP_PARAM_ERROR;
 159         }
 160
 161         sc = (struct slap_control *)SLAP_MALLOC( sizeof( *sc ) );
 162         if ( sc == NULL ) {
 163                 return LDAP_NO_MEMORY;
 164         }
 165         sc->sc_oid = ch_strdup( controloid );
 166         sc->sc_mask = controlmask;
 167         if ( controlexops != NULL ) {
 168                 sc->sc_extendedops = ldap_charray_dup( controlexops );
 169                 if ( sc->sc_extendedops == NULL ) {
 170                         ch_free( sc );
 171                         return LDAP_NO_MEMORY;
 172                 }
 173         } else {
 174                 sc->sc_extendedops = NULL;
 175         }
 176         sc->sc_parse = controlparsefn;
 177
 178         /* Update slap_known_controls, too. */
 179         if ( slap_known_controls == NULL ) {
 180                 slap_known_controls = (char **)SLAP_MALLOC( 2 * sizeof(char *) );
 181                 if ( slap_known_controls == NULL ) {
 182                         if ( sc->sc_extendedops != NULL ) ldap_charray_free( sc->sc_extendedops );
 183                         ch_free( sc );
 184                         return LDAP_NO_MEMORY;
 185                 }
 186                 slap_known_controls[0] = ch_strdup( sc->sc_oid );
 187                 slap_known_controls[1] = NULL;
 188         } else {
 189                 for ( i = 0; slap_known_controls[i] != NULL; i++ )
 190                         ;
 191                 slap_known_controls = (char **)SLAP_REALLOC( slap_known_controls, (i + 2) * sizeof(char *) );
 192                 if ( slap_known_controls == NULL ) {
 193                         if ( sc->sc_extendedops != NULL ) ldap_charray_free( sc->sc_extendedops );
 194                         ch_free( sc );
 195                         return LDAP_NO_MEMORY;
 196                 }
 197                 slap_known_controls[i++] = ch_strdup( sc->sc_oid );
 198                 slap_known_controls[i] = NULL;
 199         }
 200
 201         LDAP_SLIST_NEXT( sc, sc_next ) = NULL;
 202         LDAP_SLIST_INSERT_HEAD( &controls_list, sc, sc_next );
 203
 204         return LDAP_SUCCESS;
 205 }
 206
 207 /*
 208  * One-time initialization of internal controls.
 209  */
 210 int
 211 slap_controls_init( void )
 212 {
 213         int i, rc;
 214         struct slap_control *sc;
 215
 216         rc = LDAP_SUCCESS;
 217
 218         for ( i = 0; control_defs[i].sc_oid != NULL; i++ ) {
 219                 rc = register_supported_control( control_defs[i].sc_oid,
 220                         control_defs[i].sc_mask, control_defs[i].sc_extendedops,
 221                         control_defs[i].sc_parse );
 222                 if ( rc != LDAP_SUCCESS )
 223                         break;
 224         }
 225
 226         return rc;
 227 }
 228
 229 /*
 230  * Free memory associated with list of supported controls.
 231  */
 232 void
 233 controls_destroy( void )
 234 {
 235         struct slap_control *sc;
 236
 237         while ( !LDAP_SLIST_EMPTY(&controls_list) ) {
 238                 sc = LDAP_SLIST_FIRST(&controls_list);
 239                 LDAP_SLIST_REMOVE_HEAD(&controls_list, sc_next);
 240
 241                 ch_free( sc->sc_oid );
 242                 if ( sc->sc_extendedops != NULL ) {
 243                         ldap_charray_free( sc->sc_extendedops );
 244                 }
 245                 ch_free( sc );
 246         }
 247         ldap_charray_free( slap_known_controls );
 248 }
 249
 250 /*
 251  * Format the supportedControl attribute of the root DSE,
 252  * detailing which controls are supported by the directory
 253  * server.
 254  */
 255 int
 256 controls_root_dse_info( Entry *e )
 257 {
 258         AttributeDescription *ad_supportedControl
 259                 = slap_schema.si_ad_supportedControl;
 260         struct berval vals[2];
 261         struct slap_control *sc;
 262
 263         vals[1].bv_val = NULL;
 264         vals[1].bv_len = 0;
 265
 266         LDAP_SLIST_FOREACH( sc, &controls_list, sc_next ) {
 267                 if( sc->sc_mask & SLAP_CTRL_HIDE ) continue;
 268
 269                 vals[0].bv_val = sc->sc_oid;
 270                 vals[0].bv_len = strlen( sc->sc_oid );
 271
 272                 if ( attr_merge( e, ad_supportedControl, vals, NULL ) ) {
 273                         return -1;
 274                 }
 275         }
 276
 277         return 0;
 278 }
 279
 280 /*
 281  * Return a list of OIDs and operation masks for supported
 282  * controls. Used by SLAPI.
 283  */
 284 int
 285 get_supported_controls(char ***ctrloidsp,
 286         slap_mask_t **ctrlmasks)
 287 {
 288         int i, n;
 289         char **oids;
 290         slap_mask_t *masks;
 291         int rc;
 292         struct slap_control *sc;
 293
 294         n = 0;
 295
 296         LDAP_SLIST_FOREACH( sc, &controls_list, sc_next ) {
 297                 n++;
 298         }
 299
 300         if ( n == 0 ) {
 301                 *ctrloidsp = NULL;
 302                 *ctrlmasks = NULL;
 303                 return LDAP_SUCCESS;
 304         }
 305
 306         oids = (char **)SLAP_MALLOC( (n + 1) * sizeof(char *) );
 307         if ( oids == NULL ) {
 308                 return LDAP_NO_MEMORY;
 309         }
 310         masks = (slap_mask_t *)SLAP_MALLOC( (n + 1) * sizeof(slap_mask_t) );
 311         if  ( masks == NULL ) {
 312                 ch_free( oids );
 313                 return LDAP_NO_MEMORY;
 314         }
 315
 316         n = 0;
 317
 318         LDAP_SLIST_FOREACH( sc, &controls_list, sc_next ) {
 319                 oids[n] = ch_strdup( sc->sc_oid );
 320                 masks[n] = sc->sc_mask;
 321                 n++;
 322         }
 323         oids[n] = NULL;
 324         masks[n] = 0;
 325
 326         *ctrloidsp = oids;
 327         *ctrlmasks = masks;
 328
 329         return LDAP_SUCCESS;
 330 }
 331
 332 /*
 333  * Find a control given its OID.
 334  */
 335 static struct slap_control *
 336 find_ctrl( const char *oid )
 337 {
 338         struct slap_control *sc;
 339
 340         LDAP_SLIST_FOREACH( sc, &controls_list, sc_next ) {
 341                 if ( strcmp( oid, sc->sc_oid ) == 0 ) {
 342                         return sc;
 343                 }
 344         }
 345
 346         return NULL;
 347 }
 348
 349 void slap_free_ctrls(
 350         Operation *op,
 351         LDAPControl **ctrls
 352 )
 353 {
 354         int i;
 355
 356         for (i=0; ctrls[i]; i++) {
 357                 op->o_tmpfree(ctrls[i], op->o_tmpmemctx );
 358         }
 359         op->o_tmpfree( ctrls, op->o_tmpmemctx );
 360 }
 361
 362 int get_ctrls(
 363         Operation *op,
 364         SlapReply *rs,
 365         int sendres )
 366 {
 367         int nctrls = 0;
 368         ber_tag_t tag;
 369         ber_len_t len;
 370         char *opaque;
 371         BerElement *ber = op->o_ber;
 372         struct slap_control *sc;
 373         struct berval bv;
 374
 375         len = ber_pvt_ber_remaining(ber);
 376
 377         if( len == 0) {
 378                 /* no controls */
 379                 rs->sr_err = LDAP_SUCCESS;
 380                 return rs->sr_err;
 381         }
 382
 383         if(( tag = ber_peek_tag( ber, &len )) != LDAP_TAG_CONTROLS ) {
 384                 if( tag == LBER_ERROR ) {
 385                         rs->sr_err = SLAPD_DISCONNECT;
 386                         rs->sr_text = "unexpected data in PDU";
 387                 }
 388
 389                 goto return_results;
 390         }
 391
 392 #ifdef NEW_LOGGING
 393         LDAP_LOG( OPERATION, ENTRY,
 394                 "get_ctrls: conn %lu\n", op->o_connid, 0, 0 );
 395 #else
 396         Debug( LDAP_DEBUG_TRACE,
 397                 "=> get_ctrls\n", 0, 0, 0 );
 398 #endif
 399
 400         if( op->o_protocol < LDAP_VERSION3 ) {
 401                 rs->sr_err = SLAPD_DISCONNECT;
 402                 rs->sr_text = "controls require LDAPv3";
 403                 goto return_results;
 404         }
 405
 406         /* one for first control, one for termination */
 407         op->o_ctrls = op->o_tmpalloc( 2 * sizeof(LDAPControl *), op->o_tmpmemctx );
 408
 409 #if 0
 410         if( op->ctrls == NULL ) {
 411                 rs->sr_err = LDAP_NO_MEMORY;
 412                 rs->sr_text = "no memory";
 413                 goto return_results;
 414         }
 415 #endif
 416
 417         op->o_ctrls[nctrls] = NULL;
 418
 419         /* step through each element */
 420         for( tag = ber_first_element( ber, &len, &opaque );
 421                 tag != LBER_ERROR;
 422                 tag = ber_next_element( ber, &len, opaque ) )
 423         {
 424                 LDAPControl *c;
 425                 LDAPControl **tctrls;
 426
 427                 c = op->o_tmpalloc( sizeof(LDAPControl), op->o_tmpmemctx );
 428                 memset(c, 0, sizeof(LDAPControl));
 429
 430                 /* allocate pointer space for current controls (nctrls)
 431                  * + this control + extra NULL
 432                  */
 433                 tctrls = op->o_tmprealloc( op->o_ctrls,
 434                         (nctrls+2) * sizeof(LDAPControl *), op->o_tmpmemctx );
 435
 436 #if 0
 437                 if( tctrls == NULL ) {
 438                         ch_free( c );
 439                         ldap_controls_free(op->o_ctrls);
 440                         op->o_ctrls = NULL;
 441
 442                         rs->sr_err = LDAP_NO_MEMORY;
 443                         rs->sr_text = "no memory";
 444                         goto return_results;
 445                 }
 446 #endif
 447                 op->o_ctrls = tctrls;
 448
 449                 op->o_ctrls[nctrls++] = c;
 450                 op->o_ctrls[nctrls] = NULL;
 451
 452                 tag = ber_scanf( ber, "{m" /*}*/, &bv );
 453                 c->ldctl_oid = bv.bv_val;
 454
 455                 if( tag == LBER_ERROR ) {
 456 #ifdef NEW_LOGGING
 457                         LDAP_LOG( OPERATION, INFO, "get_ctrls: conn %lu get OID failed.\n",
 458                                 op->o_connid, 0, 0 );
 459 #else
 460                         Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: get oid failed.\n",
 461                                 0, 0, 0 );
 462 #endif
 463
 464                         slap_free_ctrls( op, op->o_ctrls );
 465                         op->o_ctrls = NULL;
 466                         rs->sr_err = SLAPD_DISCONNECT;
 467                         rs->sr_text = "decoding controls error";
 468                         goto return_results;
 469
 470                 } else if( c->ldctl_oid == NULL ) {
 471 #ifdef NEW_LOGGING
 472                         LDAP_LOG( OPERATION, INFO,
 473                                 "get_ctrls: conn %lu got emtpy OID.\n",
 474                                 op->o_connid, 0, 0 );
 475 #else
 476                         Debug( LDAP_DEBUG_TRACE,
 477                                 "get_ctrls: conn %lu got emtpy OID.\n",
 478                                 op->o_connid, 0, 0 );
 479 #endif
 480
 481                         slap_free_ctrls( op, op->o_ctrls );
 482                         op->o_ctrls = NULL;
 483                         rs->sr_err = LDAP_PROTOCOL_ERROR;
 484                         rs->sr_text = "OID field is empty";
 485                         goto return_results;
 486                 }
 487
 488                 tag = ber_peek_tag( ber, &len );
 489
 490                 if( tag == LBER_BOOLEAN ) {
 491                         ber_int_t crit;
 492                         tag = ber_scanf( ber, "b", &crit );
 493
 494                         if( tag == LBER_ERROR ) {
 495 #ifdef NEW_LOGGING
 496                                 LDAP_LOG( OPERATION, INFO,
 497                                         "get_ctrls: conn %lu get crit failed.\n",
 498                                         op->o_connid, 0, 0 );
 499 #else
 500                                 Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: get crit failed.\n",
 501                                         0, 0, 0 );
 502 #endif
 503                                 slap_free_ctrls( op, op->o_ctrls );
 504                                 op->o_ctrls = NULL;
 505                                 rs->sr_err = SLAPD_DISCONNECT;
 506                                 rs->sr_text = "decoding controls error";
 507                                 goto return_results;
 508                         }
 509
 510                         c->ldctl_iscritical = (crit != 0);
 511                         tag = ber_peek_tag( ber, &len );
 512                 }
 513
 514                 if( tag == LBER_OCTETSTRING ) {
 515                         tag = ber_scanf( ber, "m", &c->ldctl_value );
 516
 517                         if( tag == LBER_ERROR ) {
 518 #ifdef NEW_LOGGING
 519                                 LDAP_LOG( OPERATION, INFO, "get_ctrls: conn %lu: "
 520                                         "%s (%scritical): get value failed.\n",
 521                                         op->o_connid, c->ldctl_oid,
 522                                         c->ldctl_iscritical ? "" : "non" );
 523 #else
 524                                 Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: conn %lu: "
 525                                         "%s (%scritical): get value failed.\n",
 526                                         op->o_connid, c->ldctl_oid,
 527                                         c->ldctl_iscritical ? "" : "non" );
 528 #endif
 529                                 slap_free_ctrls( op, op->o_ctrls );
 530                                 op->o_ctrls = NULL;
 531                                 rs->sr_err = SLAPD_DISCONNECT;
 532                                 rs->sr_text = "decoding controls error";
 533                                 goto return_results;
 534                         }
 535                 }
 536
 537 #ifdef NEW_LOGGING
 538                 LDAP_LOG( OPERATION, INFO,
 539                         "get_ctrls: conn %lu oid=\"%s\" (%scritical)\n",
 540                         op->o_connid, c->ldctl_oid, c->ldctl_iscritical ? "" : "non" );
 541 #else
 542                 Debug( LDAP_DEBUG_TRACE,
 543                         "=> get_ctrls: oid=\"%s\" (%scritical)\n",
 544                         c->ldctl_oid, c->ldctl_iscritical ? "" : "non", 0 );
 545 #endif
 546
 547                 sc = find_ctrl( c->ldctl_oid );
 548                 if( sc != NULL ) {
 549                         /* recognized control */
 550                         slap_mask_t tagmask;
 551                         switch( op->o_tag ) {
 552                         case LDAP_REQ_ADD:
 553                                 tagmask = SLAP_CTRL_ADD;
 554                                 break;
 555                         case LDAP_REQ_BIND:
 556                                 tagmask = SLAP_CTRL_BIND;
 557                                 break;
 558                         case LDAP_REQ_COMPARE:
 559                                 tagmask = SLAP_CTRL_COMPARE;
 560                                 break;
 561                         case LDAP_REQ_DELETE:
 562                                 tagmask = SLAP_CTRL_DELETE;
 563                                 break;
 564                         case LDAP_REQ_MODIFY:
 565                                 tagmask = SLAP_CTRL_MODIFY;
 566                                 break;
 567                         case LDAP_REQ_RENAME:
 568                                 tagmask = SLAP_CTRL_RENAME;
 569                                 break;
 570                         case LDAP_REQ_SEARCH:
 571                                 tagmask = SLAP_CTRL_SEARCH;
 572                                 break;
 573                         case LDAP_REQ_UNBIND:
 574                                 tagmask = SLAP_CTRL_UNBIND;
 575                                 break;
 576                         case LDAP_REQ_ABANDON:
 577                                 tagmask = SLAP_CTRL_ABANDON;
 578                                 break;
 579                         case LDAP_REQ_EXTENDED:
 580                                 tagmask=~0L;
 581                                 assert( op->ore_reqoid.bv_val != NULL );
 582                                 if( sc->sc_extendedops != NULL ) {
 583                                         int i;
 584                                         for( i=0; sc->sc_extendedops[i] != NULL; i++ ) {
 585                                                 if( strcmp( op->ore_reqoid.bv_val, sc->sc_extendedops[i] )
 586                                                         == 0 )
 587                                                 {
 588                                                         tagmask=0L;
 589                                                         break;
 590                                                 }
 591                                         }
 592                                 }
 593                                 break;
 594                         default:
 595                                 rs->sr_err = LDAP_OTHER;
 596                                 rs->sr_text = "controls internal error";
 597                                 goto return_results;
 598                         }
 599
 600                         if (( sc->sc_mask & tagmask ) == tagmask ) {
 601                                 /* available extension */
 602
 603                                 if( !sc->sc_parse ) {
 604                                         rs->sr_err = LDAP_OTHER;
 605                                         rs->sr_text = "not yet implemented";
 606                                         goto return_results;
 607                                 }
 608
 609                                 rs->sr_err = sc->sc_parse( op, rs, c );
 610
 611                                 if( rs->sr_err != LDAP_SUCCESS ) goto return_results;
 612
 613                                 if ( sc->sc_mask & SLAP_CTRL_FRONTEND ) {
 614                                         /* kludge to disable backend_control() check */
 615                                         c->ldctl_iscritical = 0;
 616
 617                                 } else if ( tagmask == SLAP_CTRL_SEARCH &&
 618                                         sc->sc_mask & SLAP_CTRL_FRONTEND_SEARCH )
 619                                 {
 620                                         /* kludge to disable backend_control() check */
 621                                         c->ldctl_iscritical = 0;
 622                                 }
 623
 624                         } else if( c->ldctl_iscritical ) {
 625                                 /* unavailable CRITICAL control */
 626                                 rs->sr_err = LDAP_UNAVAILABLE_CRITICAL_EXTENSION;
 627                                 rs->sr_text = "critical extension is unavailable";
 628                                 goto return_results;
 629                         }
 630
 631                 } else if( c->ldctl_iscritical ) {
 632                         /* unrecognized CRITICAL control */
 633                         rs->sr_err = LDAP_UNAVAILABLE_CRITICAL_EXTENSION;
 634                         rs->sr_text = "critical extension is not recognized";
 635                         goto return_results;
 636                 }
 637         }
 638
 639 return_results:
 640 #ifdef NEW_LOGGING
 641         LDAP_LOG( OPERATION, RESULTS,
 642                 "get_ctrls: n=%d rc=%d err=\"%s\"\n",
 643                 nctrls, rs->sr_err, rs->sr_text ? rs->sr_text : "" );
 644 #else
 645         Debug( LDAP_DEBUG_TRACE,
 646                 "<= get_ctrls: n=%d rc=%d err=\"%s\"\n",
 647                 nctrls, rs->sr_err, rs->sr_text ? rs->sr_text : "");
 648 #endif
 649
 650         if( sendres && rs->sr_err != LDAP_SUCCESS ) {
 651                 if( rs->sr_err == SLAPD_DISCONNECT ) {
 652                         rs->sr_err = LDAP_PROTOCOL_ERROR;
 653                         send_ldap_disconnect( op, rs );
 654                         rs->sr_err = SLAPD_DISCONNECT;
 655                 } else {
 656                         send_ldap_result( op, rs );
 657                 }
 658         }
 659
 660         return rs->sr_err;
 661 }
 662
 663 static int parseModifyIncrement (
 664         Operation *op,
 665         SlapReply *rs,
 666         LDAPControl *ctrl )
 667 {
 668 #if 0
 669         if ( op->o_parseModifyIncrement != SLAP_NO_CONTROL ) {
 670                 rs->sr_text = "modifyIncrement control specified multiple times";
 671                 return LDAP_PROTOCOL_ERROR;
 672         }
 673 #endif
 674
 675         if ( ctrl->ldctl_value.bv_len ) {
 676                 rs->sr_text = "modifyIncrement control value not empty";
 677                 return LDAP_PROTOCOL_ERROR;
 678         }
 679
 680 #if 0
 681         op->o_parseModifyIncrement = ctrl->ldctl_iscritical
 682                 ? SLAP_CRITICAL_CONTROL
 683                 : SLAP_NONCRITICAL_CONTROL;
 684 #endif
 685
 686         return LDAP_SUCCESS;
 687 }
 688
 689 static int parseManageDSAit (
 690         Operation *op,
 691         SlapReply *rs,
 692         LDAPControl *ctrl )
 693 {
 694         if ( op->o_managedsait != SLAP_NO_CONTROL ) {
 695                 rs->sr_text = "manageDSAit control specified multiple times";
 696                 return LDAP_PROTOCOL_ERROR;
 697         }
 698
 699         if ( ctrl->ldctl_value.bv_len ) {
 700                 rs->sr_text = "manageDSAit control value not empty";
 701                 return LDAP_PROTOCOL_ERROR;
 702         }
 703
 704         op->o_managedsait = ctrl->ldctl_iscritical
 705                 ? SLAP_CRITICAL_CONTROL
 706                 : SLAP_NONCRITICAL_CONTROL;
 707
 708         return LDAP_SUCCESS;
 709 }
 710
 711 static int parseProxyAuthz (
 712         Operation *op,
 713         SlapReply *rs,
 714         LDAPControl *ctrl )
 715 {
 716         int             rc;
 717         struct berval   dn = BER_BVNULL;
 718
 719         if ( op->o_proxy_authz != SLAP_NO_CONTROL ) {
 720                 rs->sr_text = "proxy authorization control specified multiple times";
 721                 return LDAP_PROTOCOL_ERROR;
 722         }
 723
 724         op->o_proxy_authz = ctrl->ldctl_iscritical
 725                 ? SLAP_CRITICAL_CONTROL
 726                 : SLAP_NONCRITICAL_CONTROL;
 727
 728 #ifdef NEW_LOGGING
 729         LDAP_LOG( OPERATION, ARGS,
 730                 "parseProxyAuthz: conn %lu authzid=\"%s\"\n",
 731                 op->o_connid,
 732                 ctrl->ldctl_value.bv_len ?  ctrl->ldctl_value.bv_val : "anonymous",
 733                 0 );
 734 #else
 735         Debug( LDAP_DEBUG_ARGS,
 736                 "parseProxyAuthz: conn %lu authzid=\"%s\"\n",
 737                 op->o_connid,
 738                 ctrl->ldctl_value.bv_len ?  ctrl->ldctl_value.bv_val : "anonymous",
 739                 0 );
 740 #endif
 741
 742         if( ctrl->ldctl_value.bv_len == 0 ) {
 743 #ifdef NEW_LOGGING
 744                 LDAP_LOG( OPERATION, RESULTS,
 745                         "parseProxyAuthz: conn=%lu anonymous\n",
 746                         op->o_connid, 0, 0 );
 747 #else
 748                 Debug( LDAP_DEBUG_TRACE,
 749                         "parseProxyAuthz: conn=%lu anonymous\n",
 750                         op->o_connid, 0, 0 );
 751 #endif
 752
 753                 /* anonymous */
 754                 free( op->o_dn.bv_val );
 755                 op->o_dn.bv_len = 0;
 756                 op->o_dn.bv_val = ch_strdup( "" );
 757
 758                 free( op->o_ndn.bv_val );
 759                 op->o_ndn.bv_len = 0;
 760                 op->o_ndn.bv_val = ch_strdup( "" );
 761
 762                 return LDAP_SUCCESS;
 763         }
 764
 765         rc = slap_sasl_getdn( op->o_conn, op, &ctrl->ldctl_value,
 766                         NULL, &dn, SLAP_GETDN_AUTHZID );
 767
 768         if( rc != LDAP_SUCCESS || !dn.bv_len ) {
 769                 if ( dn.bv_val ) {
 770                         ch_free( dn.bv_val );
 771                 }
 772                 rs->sr_text = "authzId mapping failed";
 773                 return LDAP_PROXY_AUTHZ_FAILURE;
 774
 775         }
 776
 777 #ifdef NEW_LOGGING
 778         LDAP_LOG( OPERATION, RESULTS,
 779                 "parseProxyAuthz: conn=%lu \"%s\"\n",
 780                 op->o_connid,
 781                 dn.bv_len ? dn.bv_val : "(NULL)", 0 );
 782 #else
 783         Debug( LDAP_DEBUG_TRACE,
 784                 "parseProxyAuthz: conn=%lu \"%s\"\n",
 785                 op->o_connid,
 786                 dn.bv_len ? dn.bv_val : "(NULL)", 0 );
 787 #endif
 788
 789         rc = slap_sasl_authorized( op, &op->o_ndn, &dn );
 790
 791         if( rc ) {
 792                 ch_free( dn.bv_val );
 793                 rs->sr_text = "not authorized to assume identity";
 794                 return LDAP_PROXY_AUTHZ_FAILURE;
 795         }
 796
 797         ch_free( op->o_dn.bv_val );
 798         ch_free( op->o_ndn.bv_val );
 799
 800         op->o_dn.bv_val = NULL;
 801         op->o_ndn = dn;
 802
 803         /*
 804          * NOTE: since slap_sasl_getdn() returns a normalized dn,
 805          * from now on op->o_dn is normalized
 806          */
 807         ber_dupbv( &op->o_dn, &dn );
 808
 809         return LDAP_SUCCESS;
 810 }
 811
 812 static int parseNoOp (
 813         Operation *op,
 814         SlapReply *rs,
 815         LDAPControl *ctrl )
 816 {
 817         if ( op->o_noop != SLAP_NO_CONTROL ) {
 818                 rs->sr_text = "noop control specified multiple times";
 819                 return LDAP_PROTOCOL_ERROR;
 820         }
 821
 822         if ( ctrl->ldctl_value.bv_len ) {
 823                 rs->sr_text = "noop control value not empty";
 824                 return LDAP_PROTOCOL_ERROR;
 825         }
 826
 827         op->o_noop = ctrl->ldctl_iscritical
 828                 ? SLAP_CRITICAL_CONTROL
 829                 : SLAP_NONCRITICAL_CONTROL;
 830
 831         return LDAP_SUCCESS;
 832 }
 833
 834 static int parsePagedResults (
 835         Operation *op,
 836         SlapReply *rs,
 837         LDAPControl *ctrl )
 838 {
 839         ber_tag_t tag;
 840         ber_int_t size;
 841         BerElement *ber;
 842         struct berval cookie = BER_BVNULL;
 843
 844         if ( op->o_pagedresults != SLAP_NO_CONTROL ) {
 845                 rs->sr_text = "paged results control specified multiple times";
 846                 return LDAP_PROTOCOL_ERROR;
 847         }
 848
 849         if ( ctrl->ldctl_value.bv_len == 0 ) {
 850                 rs->sr_text = "paged results control value is empty (or absent)";
 851                 return LDAP_PROTOCOL_ERROR;
 852         }
 853
 854         /* Parse the control value
 855          *      realSearchControlValue ::= SEQUENCE {
 856          *              size    INTEGER (0..maxInt),
 857          *                              -- requested page size from client
 858          *                              -- result set size estimate from server
 859          *              cookie  OCTET STRING
 860          * }
 861          */
 862         ber = ber_init( &ctrl->ldctl_value );
 863         if( ber == NULL ) {
 864                 rs->sr_text = "internal error";
 865                 return LDAP_OTHER;
 866         }
 867
 868         tag = ber_scanf( ber, "{im}", &size, &cookie );
 869         (void) ber_free( ber, 1 );
 870
 871         if( tag == LBER_ERROR ) {
 872                 rs->sr_text = "paged results control could not be decoded";
 873                 return LDAP_PROTOCOL_ERROR;
 874         }
 875
 876         if( size < 0 ) {
 877                 rs->sr_text = "paged results control size invalid";
 878                 return LDAP_PROTOCOL_ERROR;
 879         }
 880
 881         if( cookie.bv_len ) {
 882                 PagedResultsCookie reqcookie;
 883                 if( cookie.bv_len != sizeof( reqcookie ) ) {
 884                         /* bad cookie */
 885                         rs->sr_text = "paged results cookie is invalid";
 886                         return LDAP_PROTOCOL_ERROR;
 887                 }
 888
 889                 AC_MEMCPY( &reqcookie, cookie.bv_val, sizeof( reqcookie ));
 890
 891                 if ( reqcookie > op->o_pagedresults_state.ps_cookie ) {
 892                         /* bad cookie */
 893                         rs->sr_text = "paged results cookie is invalid";
 894                         return LDAP_PROTOCOL_ERROR;
 895
 896                 } else if ( reqcookie < op->o_pagedresults_state.ps_cookie ) {
 897                         rs->sr_text = "paged results cookie is invalid or old";
 898                         return LDAP_UNWILLING_TO_PERFORM;
 899                 }
 900
 901         } else {
 902                 /* Initial request.  Initialize state. */
 903                 op->o_pagedresults_state.ps_cookie = 0;
 904                 op->o_pagedresults_state.ps_id = NOID;
 905                 op->o_pagedresults_state.ps_count = 0;
 906         }
 907
 908         op->o_pagedresults_size = size;
 909
 910         op->o_pagedresults = ctrl->ldctl_iscritical
 911                 ? SLAP_CRITICAL_CONTROL
 912                 : SLAP_NONCRITICAL_CONTROL;
 913
 914         return LDAP_SUCCESS;
 915 }
 916
 917 static int parseAssert (
 918         Operation *op,
 919         SlapReply *rs,
 920         LDAPControl *ctrl )
 921 {
 922         BerElement      *ber;
 923         struct berval   fstr = BER_BVNULL;
 924         const char *err_msg = "";
 925
 926         if ( op->o_assert != SLAP_NO_CONTROL ) {
 927                 rs->sr_text = "assert control specified multiple times";
 928                 return LDAP_PROTOCOL_ERROR;
 929         }
 930
 931         if ( ctrl->ldctl_value.bv_len == 0 ) {
 932                 rs->sr_text = "assert control value is empty (or absent)";
 933                 return LDAP_PROTOCOL_ERROR;
 934         }
 935
 936         ber = ber_init( &(ctrl->ldctl_value) );
 937         if (ber == NULL) {
 938                 rs->sr_text = "assert control: internal error";
 939                 return LDAP_OTHER;
 940         }
 941
 942         rs->sr_err = get_filter( op, ber, &(op->o_assertion), &rs->sr_text);
 943
 944         if( rs->sr_err != LDAP_SUCCESS ) {
 945                 if( rs->sr_err == SLAPD_DISCONNECT ) {
 946                         rs->sr_err = LDAP_PROTOCOL_ERROR;
 947                         send_ldap_disconnect( op, rs );
 948                         rs->sr_err = SLAPD_DISCONNECT;
 949                 } else {
 950                         send_ldap_result( op, rs );
 951                 }
 952                 if( op->o_assertion != NULL ) {
 953                         filter_free_x( op, op->o_assertion );
 954                 }
 955                 return rs->sr_err;
 956         }
 957
 958 #ifdef LDAP_DEBUG
 959         filter2bv_x( op, op->o_assertion, &fstr );
 960
 961 #ifdef NEW_LOGGING
 962         LDAP_LOG( OPERATION, ARGS,
 963                 "parseAssert: conn %ld assert: %s\n",
 964                 op->o_connid, fstr.bv_len ? fstr.bv_val : "empty" , 0 );
 965 #else
 966         Debug( LDAP_DEBUG_ARGS, "parseAssert: conn %ld assert: %s\n",
 967                 op->o_connid, fstr.bv_len ? fstr.bv_val : "empty" , 0 );
 968 #endif
 969         op->o_tmpfree( fstr.bv_val, op->o_tmpmemctx );
 970 #endif
 971
 972         op->o_assert = ctrl->ldctl_iscritical
 973                 ? SLAP_CRITICAL_CONTROL
 974                 : SLAP_NONCRITICAL_CONTROL;
 975
 976         rs->sr_err = LDAP_SUCCESS;
 977         return LDAP_SUCCESS;
 978 }
 979
 980 static int parsePreRead (
 981         Operation *op,
 982         SlapReply *rs,
 983         LDAPControl *ctrl )
 984 {
 985         ber_len_t siz, off, i;
 986         AttributeName *an = NULL;
 987         BerElement      *ber;
 988
 989         if ( op->o_preread != SLAP_NO_CONTROL ) {
 990                 rs->sr_text = "preread control specified multiple times";
 991                 return LDAP_PROTOCOL_ERROR;
 992         }
 993
 994         if ( ctrl->ldctl_value.bv_len == 0 ) {
 995                 rs->sr_text = "preread control value is empty (or absent)";
 996                 return LDAP_PROTOCOL_ERROR;
 997         }
 998
 999         ber = ber_init( &(ctrl->ldctl_value) );
1000         if (ber == NULL) {
1001                 rs->sr_text = "preread control: internal error";
1002                 return LDAP_OTHER;
1003         }
1004
1005         siz = sizeof( AttributeName );
1006         off = offsetof( AttributeName, an_name );
1007         if ( ber_scanf( ber, "{M}", &an, &siz, off ) == LBER_ERROR ) {
1008                 rs->sr_text = "preread control: decoding error";
1009                 return LDAP_PROTOCOL_ERROR;
1010         }
1011
1012         for( i=0; i<siz; i++ ) {
1013                 int             rc = LDAP_SUCCESS;
1014                 const char      *dummy = NULL;
1015
1016                 an[i].an_desc = NULL;
1017                 an[i].an_oc = NULL;
1018                 an[i].an_oc_exclude = 0;
1019                 rc = slap_bv2ad( &an[i].an_name, &an[i].an_desc, &dummy );
1020                 if ( rc != LDAP_SUCCESS && ctrl->ldctl_iscritical ) {
1021                         rs->sr_text = dummy ? dummy : "postread control: unknown attributeType";
1022                         return rc;
1023                 }
1024         }
1025
1026         op->o_preread = ctrl->ldctl_iscritical
1027                 ? SLAP_CRITICAL_CONTROL
1028                 : SLAP_NONCRITICAL_CONTROL;
1029
1030         op->o_preread_attrs = an;
1031
1032         rs->sr_err = LDAP_SUCCESS;
1033         return LDAP_SUCCESS;
1034 }
1035
1036 static int parsePostRead (
1037         Operation *op,
1038         SlapReply *rs,
1039         LDAPControl *ctrl )
1040 {
1041         ber_len_t siz, off, i;
1042         AttributeName *an = NULL;
1043         BerElement      *ber;
1044
1045         if ( op->o_postread != SLAP_NO_CONTROL ) {
1046                 rs->sr_text = "postread control specified multiple times";
1047                 return LDAP_PROTOCOL_ERROR;
1048         }
1049
1050         if ( ctrl->ldctl_value.bv_len == 0 ) {
1051                 rs->sr_text = "postread control value is empty (or absent)";
1052                 return LDAP_PROTOCOL_ERROR;
1053         }
1054
1055         ber = ber_init( &(ctrl->ldctl_value) );
1056         if (ber == NULL) {
1057                 rs->sr_text = "postread control: internal error";
1058                 return LDAP_OTHER;
1059         }
1060
1061         siz = sizeof( AttributeName );
1062         off = offsetof( AttributeName, an_name );
1063         if ( ber_scanf( ber, "{M}", &an, &siz, off ) == LBER_ERROR ) {
1064                 rs->sr_text = "postread control: decoding error";
1065                 return LDAP_PROTOCOL_ERROR;
1066         }
1067
1068         for( i=0; i<siz; i++ ) {
1069                 int             rc = LDAP_SUCCESS;
1070                 const char      *dummy = NULL;
1071
1072                 an[i].an_desc = NULL;
1073                 an[i].an_oc = NULL;
1074                 an[i].an_oc_exclude = 0;
1075                 rc = slap_bv2ad( &an[i].an_name, &an[i].an_desc, &dummy );
1076                 if ( rc != LDAP_SUCCESS && ctrl->ldctl_iscritical ) {
1077                         rs->sr_text = dummy ? dummy : "postread control: unknown attributeType";
1078                         return rc;
1079                 }
1080         }
1081
1082         op->o_postread = ctrl->ldctl_iscritical
1083                 ? SLAP_CRITICAL_CONTROL
1084                 : SLAP_NONCRITICAL_CONTROL;
1085
1086         op->o_postread_attrs = an;
1087
1088         rs->sr_err = LDAP_SUCCESS;
1089         return LDAP_SUCCESS;
1090 }
1091
1092 int parseValuesReturnFilter (
1093         Operation *op,
1094         SlapReply *rs,
1095         LDAPControl *ctrl )
1096 {
1097         BerElement      *ber;
1098         struct berval   fstr = BER_BVNULL;
1099         const char *err_msg = "";
1100
1101         if ( op->o_valuesreturnfilter != SLAP_NO_CONTROL ) {
1102                 rs->sr_text = "valuesReturnFilter control specified multiple times";
1103                 return LDAP_PROTOCOL_ERROR;
1104         }
1105
1106         if ( ctrl->ldctl_value.bv_len == 0 ) {
1107                 rs->sr_text = "valuesReturnFilter control value is empty (or absent)";
1108                 return LDAP_PROTOCOL_ERROR;
1109         }
1110
1111         ber = ber_init( &(ctrl->ldctl_value) );
1112         if (ber == NULL) {
1113                 rs->sr_text = "internal error";
1114                 return LDAP_OTHER;
1115         }
1116
1117         rs->sr_err = get_vrFilter( op, ber, &(op->o_vrFilter), &rs->sr_text);
1118
1119         if( rs->sr_err != LDAP_SUCCESS ) {
1120                 if( rs->sr_err == SLAPD_DISCONNECT ) {
1121                         rs->sr_err = LDAP_PROTOCOL_ERROR;
1122                         send_ldap_disconnect( op, rs );
1123                         rs->sr_err = SLAPD_DISCONNECT;
1124                 } else {
1125                         send_ldap_result( op, rs );
1126                 }
1127                 if( op->o_vrFilter != NULL) vrFilter_free( op, op->o_vrFilter );
1128         }
1129 #ifdef LDAP_DEBUG
1130         else {
1131                 vrFilter2bv( op, op->o_vrFilter, &fstr );
1132         }
1133
1134 #ifdef NEW_LOGGING
1135         LDAP_LOG( OPERATION, ARGS,
1136                 "parseValuesReturnFilter: conn %d       vrFilter: %s\n",
1137                 op->o_connid, fstr.bv_len ? fstr.bv_val : "empty" , 0 );
1138 #else
1139         Debug( LDAP_DEBUG_ARGS, "       vrFilter: %s\n",
1140                 fstr.bv_len ? fstr.bv_val : "empty", 0, 0 );
1141 #endif
1142         op->o_tmpfree( fstr.bv_val, op->o_tmpmemctx );
1143 #endif
1144
1145         op->o_valuesreturnfilter = ctrl->ldctl_iscritical
1146                 ? SLAP_CRITICAL_CONTROL
1147                 : SLAP_NONCRITICAL_CONTROL;
1148
1149         rs->sr_err = LDAP_SUCCESS;
1150         return LDAP_SUCCESS;
1151 }
1152
1153 #ifdef LDAP_CONTROL_SUBENTRIES
1154 static int parseSubentries (
1155         Operation *op,
1156         SlapReply *rs,
1157         LDAPControl *ctrl )
1158 {
1159         if ( op->o_subentries != SLAP_NO_CONTROL ) {
1160                 rs->sr_text = "subentries control specified multiple times";
1161                 return LDAP_PROTOCOL_ERROR;
1162         }
1163
1164         /* FIXME: should use BER library */
1165         if( ( ctrl->ldctl_value.bv_len != 3 )
1166                 && ( ctrl->ldctl_value.bv_val[0] != 0x01 )
1167                 && ( ctrl->ldctl_value.bv_val[1] != 0x01 ))
1168         {
1169                 rs->sr_text = "subentries control value encoding is bogus";
1170                 return LDAP_PROTOCOL_ERROR;
1171         }
1172
1173         op->o_subentries = ctrl->ldctl_iscritical
1174                 ? SLAP_CRITICAL_CONTROL
1175                 : SLAP_NONCRITICAL_CONTROL;
1176
1177         op->o_subentries_visibility = (ctrl->ldctl_value.bv_val[2] != 0x00);
1178
1179         return LDAP_SUCCESS;
1180 }
1181 #endif
1182
1183 #ifdef LDAP_CONTROL_X_PERMISSIVE_MODIFY
1184 static int parsePermissiveModify (
1185         Operation *op,
1186         SlapReply *rs,
1187         LDAPControl *ctrl )
1188 {
1189         if ( op->o_permissive_modify != SLAP_NO_CONTROL ) {
1190                 rs->sr_text = "permissiveModify control specified multiple times";
1191                 return LDAP_PROTOCOL_ERROR;
1192         }
1193
1194         if ( ctrl->ldctl_value.bv_len ) {
1195                 rs->sr_text = "permissiveModify control value not empty";
1196                 return LDAP_PROTOCOL_ERROR;
1197         }
1198
1199         op->o_permissive_modify = ctrl->ldctl_iscritical
1200                 ? SLAP_CRITICAL_CONTROL
1201                 : SLAP_NONCRITICAL_CONTROL;
1202
1203         return LDAP_SUCCESS;
1204 }
1205 #endif
1206
1207 #ifdef LDAP_CONTROL_X_DOMAIN_SCOPE
1208 static int parseDomainScope (
1209         Operation *op,
1210         SlapReply *rs,
1211         LDAPControl *ctrl )
1212 {
1213         if ( op->o_domain_scope != SLAP_NO_CONTROL ) {
1214                 rs->sr_text = "domainScope control specified multiple times";
1215                 return LDAP_PROTOCOL_ERROR;
1216         }
1217
1218         if ( ctrl->ldctl_value.bv_len ) {
1219                 rs->sr_text = "domainScope control value not empty";
1220                 return LDAP_PROTOCOL_ERROR;
1221         }
1222
1223         op->o_domain_scope = ctrl->ldctl_iscritical
1224                 ? SLAP_CRITICAL_CONTROL
1225                 : SLAP_NONCRITICAL_CONTROL;
1226
1227         return LDAP_SUCCESS;
1228 }
1229 #endif
1230
1231 #ifdef LDAP_CONTROL_X_TREE_DELETE
1232 static int parseTreeDelete (
1233         Operation *op,
1234         SlapReply *rs,
1235         LDAPControl *ctrl )
1236 {
1237         if ( op->o_tree_delete != SLAP_NO_CONTROL ) {
1238                 rs->sr_text = "treeDelete control specified multiple times";
1239                 return LDAP_PROTOCOL_ERROR;
1240         }
1241
1242         if ( ctrl->ldctl_value.bv_len ) {
1243                 rs->sr_text = "treeDelete control value not empty";
1244                 return LDAP_PROTOCOL_ERROR;
1245         }
1246
1247         op->o_tree_delete = ctrl->ldctl_iscritical
1248                 ? SLAP_CRITICAL_CONTROL
1249                 : SLAP_NONCRITICAL_CONTROL;
1250
1251         return LDAP_SUCCESS;
1252 }
1253 #endif
1254
1255 #ifdef LDAP_CONTORL_X_SEARCH_OPTIONS
1256 static int parseSearchOptions (
1257         Operation *op,
1258         SlapReply *rs,
1259         LDAPControl *ctrl )
1260 {
1261         BerElement *ber;
1262         ber_int_t search_flags;
1263
1264         if ( ctrl->ldctl_value.bv_len == 0 ) {
1265                 rs->sr_text = "searchOptions control value not empty";
1266                 return LDAP_PROTOCOL_ERROR;
1267         }
1268
1269         ber = ber_init( &ctrl->ldctl_value );
1270         if( ber == NULL ) {
1271                 rs->sr_text = "internal error";
1272                 return LDAP_OTHER;
1273         }
1274
1275         if ( (tag = ber_scanf( ber, "{i}", &search_flags )) == LBER_ERROR ) {
1276                 rs->sr_text = "searchOptions control decoding error";
1277                 return LDAP_PROTOCOL_ERROR;
1278         }
1279
1280         (void) ber_free( ber, 1 );
1281
1282         if ( search_flags & LDAP_SEARCH_FLAG_DOMAIN_SCOPE ) {
1283                 if ( op->o_domain_scope != SLAP_NO_CONTROL ) {
1284                         rs->sr_text = "searchOptions control specified multiple times or with domainScope control";
1285                         return LDAP_PROTOCOL_ERROR;
1286                 }
1287
1288                 op->o_domain_scope = ctrl->ldctl_iscritical
1289                         ? SLAP_CRITICAL_CONTROL
1290                         : SLAP_NONCRITICAL_CONTROL;
1291         }
1292
1293         if ( search_flags & ~(LDAP_SEARCH_FLAG_DOMAIN_SCOPE) ) {
1294                 /* Other search flags not recognised so far */
1295                 rs->sr_text = "searchOptions contained invalid flag";
1296                 return LDAP_UNAVAILABLE_CRITICAL_EXTENSION;
1297         }
1298
1299         return LDAP_SUCCESS;
1300 }
1301 #endif
1302
1303 static int parseLDAPsync (
1304         Operation *op,
1305         SlapReply *rs,
1306         LDAPControl *ctrl )
1307 {
1308         ber_tag_t tag;
1309         BerElement *ber;
1310         ber_int_t mode;
1311         ber_len_t len;
1312         struct slap_session_entry *se;
1313
1314         if ( op->o_sync != SLAP_NO_CONTROL ) {
1315                 rs->sr_text = "LDAP Sync control specified multiple times";
1316                 return LDAP_PROTOCOL_ERROR;
1317         }
1318
1319         if ( ctrl->ldctl_value.bv_len == 0 ) {
1320                 rs->sr_text = "LDAP Sync control value is empty (or absent)";
1321                 return LDAP_PROTOCOL_ERROR;
1322         }
1323
1324         /* Parse the control value
1325          *      syncRequestValue ::= SEQUENCE {
1326          *              mode   ENUMERATED {
1327          *                      -- 0 unused
1328          *                      refreshOnly             (1),
1329          *                      -- 2 reserved
1330          *                      refreshAndPersist       (3)
1331          *              },
1332          *              cookie  syncCookie OPTIONAL
1333          *      }
1334          */
1335
1336         ber = ber_init( &ctrl->ldctl_value );
1337         if( ber == NULL ) {
1338                 rs->sr_text = "internal error";
1339                 return LDAP_OTHER;
1340         }
1341
1342         if ( (tag = ber_scanf( ber, "{i" /*}*/, &mode )) == LBER_ERROR ) {
1343                 rs->sr_text = "LDAP Sync control : mode decoding error";
1344                 return LDAP_PROTOCOL_ERROR;
1345         }
1346
1347         switch( mode ) {
1348         case LDAP_SYNC_REFRESH_ONLY:
1349                 mode = SLAP_SYNC_REFRESH;
1350                 break;
1351         case LDAP_SYNC_REFRESH_AND_PERSIST:
1352                 mode = SLAP_SYNC_REFRESH_AND_PERSIST;
1353                 break;
1354         default:
1355                 rs->sr_text = "LDAP Sync control : unknown update mode";
1356                 return LDAP_PROTOCOL_ERROR;
1357         }
1358
1359         tag = ber_peek_tag( ber, &len );
1360
1361         if ( tag == LDAP_TAG_SYNC_COOKIE ) {
1362                 struct berval tmp_bv;
1363                 if (( ber_scanf( ber, /*{*/ "o", &tmp_bv )) == LBER_ERROR ) {
1364                         rs->sr_text = "LDAP Sync control : cookie decoding error";
1365                         return LDAP_PROTOCOL_ERROR;
1366                 }
1367                 ber_bvarray_add( &op->o_sync_state.octet_str, &tmp_bv );
1368                 slap_parse_sync_cookie( &op->o_sync_state );
1369         }
1370         if ( tag == LDAP_TAG_RELOAD_HINT ) {
1371                 if (( ber_scanf( ber, /*{*/ "b", &op->o_sync_rhint )) == LBER_ERROR ) {
1372                         rs->sr_text = "LDAP Sync control : rhint decoding error";
1373                         return LDAP_PROTOCOL_ERROR;
1374                 }
1375         }
1376         if (( ber_scanf( ber, /*{*/ "}")) == LBER_ERROR ) {
1377                         rs->sr_text = "LDAP Sync control : decoding error";
1378                         return LDAP_PROTOCOL_ERROR;
1379         }
1380
1381         (void) ber_free( ber, 1 );
1382
1383         op->o_sync_mode = (char) mode;
1384
1385         op->o_sync = ctrl->ldctl_iscritical
1386                 ? SLAP_CRITICAL_CONTROL
1387                 : SLAP_NONCRITICAL_CONTROL;
1388
1389         return LDAP_SUCCESS;
1390 }