git.sur5r.net Git - openldap/blob - servers/slapd/controls.c

   1 /* $OpenLDAP$ */
   2 /*
   3  * Copyright 1999-2002 The OpenLDAP Foundation.
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms are permitted only
   7  * as authorized by the OpenLDAP Public License.  A copy of this
   8  * license is available at http://www.OpenLDAP.org/license.html or
   9  * in file LICENSE in the top-level directory of the distribution.
  10  */
  11 #include "portable.h"
  12
  13 #include <stdio.h>
  14
  15 #include <ac/string.h>
  16 #include <ac/socket.h>
  17
  18 #include "slap.h"
  19
  20 #include "../../libraries/liblber/lber-int.h"
  21
  22 #define SLAP_CTRL_FRONTEND      0x80000000U
  23
  24 #define SLAP_CTRL_OPFLAGS       0x0000FFFFU
  25 #define SLAP_CTRL_ABANDON       0x00000001U
  26 #define SLAP_CTRL_ADD           0x00002002U
  27 #define SLAP_CTRL_BIND          0x00000004U
  28 #define SLAP_CTRL_COMPARE       0x00001008U
  29 #define SLAP_CTRL_DELETE        0x00002010U
  30 #define SLAP_CTRL_MODIFY        0x00002020U
  31 #define SLAP_CTRL_RENAME        0x00002040U
  32 #define SLAP_CTRL_SEARCH        0x00001080U
  33 #define SLAP_CTRL_UNBIND        0x00000100U
  34
  35 #define SLAP_CTRL_INTROGATE     (SLAP_CTRL_COMPARE|SLAP_CTRL_SEARCH)
  36 #define SLAP_CTRL_UPDATE \
  37         (SLAP_CTRL_ADD|SLAP_CTRL_DELETE|SLAP_CTRL_MODIFY|SLAP_CTRL_RENAME)
  38 #define SLAP_CTRL_ACCESS        (SLAP_CTRL_INTROGATE|SLAP_CTRL_UPDATE)
  39
  40 typedef int (SLAP_CTRL_PARSE_FN) LDAP_P((
  41         Connection *conn,
  42         Operation *op,
  43         LDAPControl *ctrl,
  44         const char **text ));
  45
  46 static SLAP_CTRL_PARSE_FN parseManageDSAit;
  47 static SLAP_CTRL_PARSE_FN parseSubentries;
  48 static SLAP_CTRL_PARSE_FN parseNoOp;
  49
  50 static struct slap_control {
  51         char *sc_oid;
  52         slap_mask_t sc_mask;
  53         char **sc_extendedops;
  54         SLAP_CTRL_PARSE_FN *sc_parse;
  55
  56 } supportedControls[] = {
  57         { LDAP_CONTROL_MANAGEDSAIT,
  58                 SLAP_CTRL_ACCESS, NULL,
  59                 parseManageDSAit },
  60         { LDAP_CONTROL_SUBENTRIES,
  61                 SLAP_CTRL_SEARCH, NULL,
  62                 parseSubentries },
  63 #ifdef LDAP_CONTROL_NOOP
  64         { LDAP_CONTROL_NOOP,
  65                 SLAP_CTRL_UPDATE, NULL,
  66                 parseNoOp },
  67 #endif
  68         { NULL }
  69 };
  70
  71 char *
  72 get_supported_ctrl(int index)
  73 {
  74         return supportedControls[index].sc_oid;
  75 }
  76
  77 static struct slap_control *
  78 find_ctrl( const char *oid )
  79 {
  80         int i;
  81         for( i=0; supportedControls[i].sc_oid; i++ ) {
  82                 if( strcmp( oid, supportedControls[i].sc_oid ) == 0 ) {
  83                         return &supportedControls[i];
  84                 }
  85         }
  86         return NULL;
  87 }
  88
  89 int get_ctrls(
  90         Connection *conn,
  91         Operation *op,
  92         int sendres )
  93 {
  94         int nctrls;
  95         ber_tag_t tag;
  96         ber_len_t len;
  97         char *opaque;
  98         BerElement *ber = op->o_ber;
  99         struct slap_control *sc;
 100         int rc = LDAP_SUCCESS;
 101         const char *errmsg = NULL;
 102
 103         len = ber_pvt_ber_remaining(ber);
 104
 105         if( len == 0) {
 106                 /* no controls */
 107                 rc = LDAP_SUCCESS;
 108                 return rc;
 109         }
 110
 111         if(( tag = ber_peek_tag( ber, &len )) != LDAP_TAG_CONTROLS ) {
 112                 if( tag == LBER_ERROR ) {
 113                         rc = SLAPD_DISCONNECT;
 114                         errmsg = "unexpected data in PDU";
 115                 }
 116
 117                 goto return_results;
 118         }
 119
 120 #ifdef NEW_LOGGING
 121         LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY,
 122                 "get_ctrls: conn %d\n", conn->c_connid ));
 123 #else
 124         Debug( LDAP_DEBUG_TRACE, "=> get_ctrls\n", 0, 0, 0 );
 125 #endif
 126         if( op->o_protocol < LDAP_VERSION3 ) {
 127                 rc = SLAPD_DISCONNECT;
 128                 errmsg = "controls require LDAPv3";
 129                 goto return_results;
 130         }
 131
 132         /* one for first control, one for termination */
 133         op->o_ctrls = ch_malloc( 2 * sizeof(LDAPControl *) );
 134
 135 #if 0
 136         if( op->ctrls == NULL ) {
 137                 rc = LDAP_NO_MEMORY;
 138                 errmsg = "no memory";
 139                 goto return_results;
 140         }
 141 #endif
 142
 143         op->o_ctrls[nctrls=0] = NULL;
 144
 145         /* step through each element */
 146         for( tag = ber_first_element( ber, &len, &opaque );
 147                 tag != LBER_ERROR;
 148                 tag = ber_next_element( ber, &len, opaque ) )
 149         {
 150                 LDAPControl *c;
 151                 LDAPControl **tctrls;
 152
 153                 c = ch_calloc( 1, sizeof(LDAPControl) );
 154
 155 #if 0
 156                 if( c == NULL ) {
 157                         ldap_controls_free(op->o_ctrls);
 158                         op->o_ctrls = NULL;
 159
 160                         rc = LDAP_NO_MEMORY;
 161                         errmsg = "no memory";
 162                         goto return_results;
 163                 }
 164 #endif
 165
 166                 /* allocate pointer space for current controls (nctrls)
 167                  * + this control + extra NULL
 168                  */
 169                 tctrls = ch_realloc( op->o_ctrls,
 170                         (nctrls+2) * sizeof(LDAPControl *));
 171
 172 #if 0
 173                 if( tctrls == NULL ) {
 174                         ch_free( c );
 175                         ldap_controls_free(op->o_ctrls);
 176                         op->o_ctrls = NULL;
 177
 178                         rc = LDAP_NO_MEMORY;
 179                         errmsg = "no memory";
 180                         goto return_results;
 181                 }
 182 #endif
 183                 op->o_ctrls = tctrls;
 184
 185                 op->o_ctrls[nctrls++] = c;
 186                 op->o_ctrls[nctrls] = NULL;
 187
 188                 tag = ber_scanf( ber, "{a" /*}*/, &c->ldctl_oid );
 189
 190                 if( tag == LBER_ERROR ) {
 191 #ifdef NEW_LOGGING
 192                         LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
 193                                 "get_ctrls: conn %d get OID failed.\n",
 194                                 conn->c_connid ));
 195 #else
 196                         Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: get oid failed.\n",
 197                                 0, 0, 0 );
 198 #endif
 199                         ldap_controls_free( op->o_ctrls );
 200                         op->o_ctrls = NULL;
 201                         rc = SLAPD_DISCONNECT;
 202                         errmsg = "decoding controls error";
 203                         goto return_results;
 204                 }
 205
 206                 tag = ber_peek_tag( ber, &len );
 207
 208                 if( tag == LBER_BOOLEAN ) {
 209                         ber_int_t crit;
 210                         tag = ber_scanf( ber, "b", &crit );
 211
 212                         if( tag == LBER_ERROR ) {
 213 #ifdef NEW_LOGGING
 214                                 LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
 215                                         "get_ctrls: conn %d get crit failed.\n",
 216                                         conn->c_connid ));
 217 #else
 218                                 Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: get crit failed.\n",
 219                                         0, 0, 0 );
 220 #endif
 221                                 ldap_controls_free( op->o_ctrls );
 222                                 op->o_ctrls = NULL;
 223                                 rc = SLAPD_DISCONNECT;
 224                                 errmsg = "decoding controls error";
 225                                 goto return_results;
 226                         }
 227
 228                         c->ldctl_iscritical = (crit != 0);
 229                         tag = ber_peek_tag( ber, &len );
 230                 }
 231
 232                 if( tag == LBER_OCTETSTRING ) {
 233                         tag = ber_scanf( ber, "o", &c->ldctl_value );
 234
 235                         if( tag == LBER_ERROR ) {
 236 #ifdef NEW_LOGGING
 237                                 LDAP_LOG(( "operation", LDAP_LEVEL_INFO, "get_ctrls: conn %d: "
 238                                         "%s (%scritical): get value failed.\n",
 239                                         conn->c_connid,
 240                                         c->ldctl_oid ? c->ldctl_oid : "(NULL)",
 241                                         c->ldctl_iscritical ? "" : "non" ));
 242 #else
 243                                 Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: conn %d: "
 244                                         "%s (%scritical): get value failed.\n",
 245                                         conn->c_connid,
 246                                         c->ldctl_oid ? c->ldctl_oid : "(NULL)",
 247                                         c->ldctl_iscritical ? "" : "non" );
 248 #endif
 249                                 ldap_controls_free( op->o_ctrls );
 250                                 op->o_ctrls = NULL;
 251                                 rc = SLAPD_DISCONNECT;
 252                                 errmsg = "decoding controls error";
 253                                 goto return_results;
 254                         }
 255                 }
 256
 257 #ifdef NEW_LOGGING
 258                 LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
 259                         "get_ctrls: conn %d oid=\"%s\" (%scritical)\n",
 260                         conn->c_connid,
 261                         c->ldctl_oid ? c->ldctl_oid : "(NULL)",
 262                         c->ldctl_iscritical ? "" : "non" ));
 263 #else
 264                 Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: oid=\"%s\" (%scritical)\n",
 265                         c->ldctl_oid ? c->ldctl_oid : "(NULL)",
 266                         c->ldctl_iscritical ? "" : "non",
 267                         0 );
 268 #endif
 269
 270                 sc = find_ctrl( c->ldctl_oid );
 271                 if( sc != NULL ) {
 272                         /* recognized control */
 273                         slap_mask_t tagmask;
 274                         switch( op->o_tag ) {
 275                         case LDAP_REQ_ADD:
 276                                 tagmask = SLAP_CTRL_ADD;
 277                                 break;
 278                         case LDAP_REQ_BIND:
 279                                 tagmask = SLAP_CTRL_BIND;
 280                                 break;
 281                         case LDAP_REQ_COMPARE:
 282                                 tagmask = SLAP_CTRL_COMPARE;
 283                                 break;
 284                         case LDAP_REQ_DELETE:
 285                                 tagmask = SLAP_CTRL_DELETE;
 286                                 break;
 287                         case LDAP_REQ_MODIFY:
 288                                 tagmask = SLAP_CTRL_MODIFY;
 289                                 break;
 290                         case LDAP_REQ_RENAME:
 291                                 tagmask = SLAP_CTRL_RENAME;
 292                                 break;
 293                         case LDAP_REQ_SEARCH:
 294                                 tagmask = SLAP_CTRL_SEARCH;
 295                                 break;
 296                         case LDAP_REQ_UNBIND:
 297                                 tagmask = SLAP_CTRL_UNBIND;
 298                                 break;
 299                         case LDAP_REQ_EXTENDED:
 300                                 /* FIXME: check list of extended operations */
 301                                 tagmask = ~0U;
 302                                 break;
 303                         default:
 304                                 rc = LDAP_OTHER;
 305                                 errmsg = "controls internal error";
 306                                 goto return_results;
 307                         }
 308
 309                         if (( sc->sc_mask & tagmask ) == tagmask ) {
 310                                 /* available extension */
 311
 312                                 if( !sc->sc_parse ) {
 313                                         rc = LDAP_OTHER;
 314                                         errmsg = "not yet implemented";
 315                                         goto return_results;
 316                                 }
 317
 318                                 rc = sc->sc_parse( conn, op, c, &errmsg );
 319
 320                                 if( rc != LDAP_SUCCESS ) goto return_results;
 321
 322                                 if( sc->sc_mask & SLAP_CTRL_FRONTEND ) {
 323                                         /* kludge to disable backend_control() check */
 324                                         c->ldctl_iscritical = 0;
 325                                 }
 326
 327                         } else if( c->ldctl_iscritical ) {
 328                                 /* unavailable CRITICAL control */
 329                                 rc = LDAP_UNAVAILABLE_CRITICAL_EXTENSION;
 330                                 errmsg = "critical extension is unavailable";
 331                                 goto return_results;
 332                         }
 333
 334                 } else if( c->ldctl_iscritical ) {
 335                         /* unrecognized CRITICAL control */
 336                         rc = LDAP_UNAVAILABLE_CRITICAL_EXTENSION;
 337                         errmsg = "critical extension is not recognized";
 338                         goto return_results;
 339                 }
 340         }
 341
 342 return_results:
 343 #ifdef NEW_LOGGING
 344         LDAP_LOG(( "operation", LDAP_LEVEL_RESULTS,
 345                 "get_ctrls: conn %d     %d %d %s\n",
 346                 conn->c_connid, nctrls, rc, errmsg ? errmsg : "" ));
 347 #else
 348         Debug( LDAP_DEBUG_TRACE, "<= get_ctrls: %d %d %s\n",
 349                 nctrls, rc, errmsg ? errmsg : "");
 350 #endif
 351
 352         if( sendres && rc != LDAP_SUCCESS ) {
 353                 if( rc == SLAPD_DISCONNECT ) {
 354                         send_ldap_disconnect( conn, op, LDAP_PROTOCOL_ERROR, errmsg );
 355                 } else {
 356                         send_ldap_result( conn, op, rc,
 357                                 NULL, errmsg, NULL, NULL );
 358                 }
 359         }
 360
 361         return rc;
 362 }
 363
 364 static int parseManageDSAit (
 365         Connection *conn,
 366         Operation *op,
 367         LDAPControl *ctrl,
 368         const char **text )
 369 {
 370         if ( op->o_managedsait != SLAP_NO_CONTROL ) {
 371                 *text = "manageDSAit control specified multiple times";
 372                 return LDAP_PROTOCOL_ERROR;
 373         }
 374
 375         if ( ctrl->ldctl_value.bv_len ) {
 376                 *text = "manageDSAit control value not empty";
 377                 return LDAP_PROTOCOL_ERROR;
 378         }
 379
 380         op->o_managedsait = ctrl->ldctl_iscritical
 381                 ? SLAP_CRITICAL_CONTROL
 382                 : SLAP_NONCRITICAL_CONTROL;
 383
 384         return LDAP_SUCCESS;
 385 }
 386
 387 static int parseSubentries (
 388         Connection *conn,
 389         Operation *op,
 390         LDAPControl *ctrl,
 391         const char **text )
 392 {
 393         if ( op->o_subentries != SLAP_NO_CONTROL ) {
 394                 *text = "subentries control specified multiple times";
 395                 return LDAP_PROTOCOL_ERROR;
 396         }
 397
 398         /* FIXME: should use BER library */
 399         if( ( ctrl->ldctl_value.bv_len != 3 )
 400                 && ( ctrl->ldctl_value.bv_val[0] != 0x01 )
 401                 && ( ctrl->ldctl_value.bv_val[1] != 0x01 ))
 402         {
 403                 *text = "subentries control value encoding is bogus";
 404                 return LDAP_PROTOCOL_ERROR;
 405         }
 406
 407         op->o_subentries = ctrl->ldctl_iscritical
 408                 ? SLAP_CRITICAL_CONTROL
 409                 : SLAP_NONCRITICAL_CONTROL;
 410
 411         op->o_subentries_visibility = (ctrl->ldctl_value.bv_val[2] != 0x00);
 412
 413         return LDAP_SUCCESS;
 414 }
 415
 416 static int parseNoOp (
 417         Connection *conn,
 418         Operation *op,
 419         LDAPControl *ctrl,
 420         const char **text )
 421 {
 422         if ( op->o_noop != SLAP_NO_CONTROL ) {
 423                 *text = "noop control specified multiple times";
 424                 return LDAP_PROTOCOL_ERROR;
 425         }
 426
 427         if ( ctrl->ldctl_value.bv_len ) {
 428                 *text = "noop control value not empty";
 429                 return LDAP_PROTOCOL_ERROR;
 430         }
 431
 432         op->o_noop = ctrl->ldctl_iscritical
 433                 ? SLAP_CRITICAL_CONTROL
 434                 : SLAP_NONCRITICAL_CONTROL;
 435
 436         return LDAP_SUCCESS;
 437 }
 438