git.sur5r.net Git - openldap/blob - servers/slapd/controls.c

   1 /* $OpenLDAP$ */
   2 /*
   3  * Copyright 1999-2002 The OpenLDAP Foundation.
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms are permitted only
   7  * as authorized by the OpenLDAP Public License.  A copy of this
   8  * license is available at http://www.OpenLDAP.org/license.html or
   9  * in file LICENSE in the top-level directory of the distribution.
  10  */
  11 #include "portable.h"
  12
  13 #include <stdio.h>
  14
  15 #include <ac/string.h>
  16 #include <ac/socket.h>
  17
  18 #include "slap.h"
  19
  20 #include "../../libraries/liblber/lber-int.h"
  21
  22 #define SLAP_CTRL_FRONTEND      0x80000000U
  23
  24 #define SLAP_CTRL_OPFLAGS       0x0000FFFFU
  25 #define SLAP_CTRL_ABANDON       0x00000001U
  26 #define SLAP_CTRL_ADD           0x00002002U
  27 #define SLAP_CTRL_BIND          0x00000004U
  28 #define SLAP_CTRL_COMPARE       0x00001008U
  29 #define SLAP_CTRL_DELETE        0x00002010U
  30 #define SLAP_CTRL_MODIFY        0x00002020U
  31 #define SLAP_CTRL_RENAME        0x00002040U
  32 #define SLAP_CTRL_SEARCH        0x00001080U
  33 #define SLAP_CTRL_UNBIND        0x00000100U
  34
  35 #define SLAP_CTRL_INTROGATE     (SLAP_CTRL_COMPARE|SLAP_CTRL_SEARCH)
  36 #define SLAP_CTRL_UPDATE \
  37         (SLAP_CTRL_ADD|SLAP_CTRL_DELETE|SLAP_CTRL_MODIFY|SLAP_CTRL_RENAME)
  38 #define SLAP_CTRL_ACCESS        (SLAP_CTRL_INTROGATE|SLAP_CTRL_UPDATE)
  39
  40 typedef int (SLAP_CTRL_PARSE_FN) LDAP_P((
  41         Connection *conn,
  42         Operation *op,
  43         LDAPControl *ctrl,
  44         const char **text ));
  45
  46 static SLAP_CTRL_PARSE_FN parseManageDSAit;
  47 static SLAP_CTRL_PARSE_FN parseSubentries;
  48 static SLAP_CTRL_PARSE_FN parseNoOp;
  49 static SLAP_CTRL_PARSE_FN parsePagedResults;
  50
  51 static struct slap_control {
  52         char *sc_oid;
  53         slap_mask_t sc_mask;
  54         char **sc_extendedops;
  55         SLAP_CTRL_PARSE_FN *sc_parse;
  56
  57 } supportedControls[] = {
  58         { LDAP_CONTROL_MANAGEDSAIT,
  59                 SLAP_CTRL_ACCESS, NULL,
  60                 parseManageDSAit },
  61 #ifdef LDAP_CONTROL_SUBENTRIES
  62         { LDAP_CONTROL_SUBENTRIES,
  63                 SLAP_CTRL_SEARCH, NULL,
  64                 parseSubentries },
  65 #endif
  66 #ifdef LDAP_CONTROL_NOOP
  67         { LDAP_CONTROL_NOOP,
  68                 SLAP_CTRL_UPDATE, NULL,
  69                 parseNoOp },
  70 #endif
  71 #ifdef LDAP_CONTROL_PAGEDRESULTS_REQUEST
  72         { LDAP_CONTROL_PAGEDRESULTS_REQUEST,
  73                 SLAP_CTRL_SEARCH, NULL,
  74                 parsePagedResults },
  75 #endif
  76         { NULL }
  77 };
  78
  79 char *
  80 get_supported_ctrl(int index)
  81 {
  82         return supportedControls[index].sc_oid;
  83 }
  84
  85 static struct slap_control *
  86 find_ctrl( const char *oid )
  87 {
  88         int i;
  89         for( i=0; supportedControls[i].sc_oid; i++ ) {
  90                 if( strcmp( oid, supportedControls[i].sc_oid ) == 0 ) {
  91                         return &supportedControls[i];
  92                 }
  93         }
  94         return NULL;
  95 }
  96
  97 int get_ctrls(
  98         Connection *conn,
  99         Operation *op,
 100         int sendres )
 101 {
 102         int nctrls = 0;
 103         ber_tag_t tag;
 104         ber_len_t len;
 105         char *opaque;
 106         BerElement *ber = op->o_ber;
 107         struct slap_control *sc;
 108         int rc = LDAP_SUCCESS;
 109         const char *errmsg = NULL;
 110
 111         len = ber_pvt_ber_remaining(ber);
 112
 113         if( len == 0) {
 114                 /* no controls */
 115                 rc = LDAP_SUCCESS;
 116                 return rc;
 117         }
 118
 119         if(( tag = ber_peek_tag( ber, &len )) != LDAP_TAG_CONTROLS ) {
 120                 if( tag == LBER_ERROR ) {
 121                         rc = SLAPD_DISCONNECT;
 122                         errmsg = "unexpected data in PDU";
 123                 }
 124
 125                 goto return_results;
 126         }
 127
 128 #ifdef NEW_LOGGING
 129         LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY,
 130                 "get_ctrls: conn %lu\n", conn->c_connid ));
 131 #else
 132         Debug( LDAP_DEBUG_TRACE, "=> get_ctrls\n", 0, 0, 0 );
 133 #endif
 134         if( op->o_protocol < LDAP_VERSION3 ) {
 135                 rc = SLAPD_DISCONNECT;
 136                 errmsg = "controls require LDAPv3";
 137                 goto return_results;
 138         }
 139
 140         /* one for first control, one for termination */
 141         op->o_ctrls = ch_malloc( 2 * sizeof(LDAPControl *) );
 142
 143 #if 0
 144         if( op->ctrls == NULL ) {
 145                 rc = LDAP_NO_MEMORY;
 146                 errmsg = "no memory";
 147                 goto return_results;
 148         }
 149 #endif
 150
 151         op->o_ctrls[nctrls] = NULL;
 152
 153         /* step through each element */
 154         for( tag = ber_first_element( ber, &len, &opaque );
 155                 tag != LBER_ERROR;
 156                 tag = ber_next_element( ber, &len, opaque ) )
 157         {
 158                 LDAPControl *c;
 159                 LDAPControl **tctrls;
 160
 161                 c = ch_calloc( 1, sizeof(LDAPControl) );
 162
 163 #if 0
 164                 if( c == NULL ) {
 165                         ldap_controls_free(op->o_ctrls);
 166                         op->o_ctrls = NULL;
 167
 168                         rc = LDAP_NO_MEMORY;
 169                         errmsg = "no memory";
 170                         goto return_results;
 171                 }
 172 #endif
 173
 174                 /* allocate pointer space for current controls (nctrls)
 175                  * + this control + extra NULL
 176                  */
 177                 tctrls = ch_realloc( op->o_ctrls,
 178                         (nctrls+2) * sizeof(LDAPControl *));
 179
 180 #if 0
 181                 if( tctrls == NULL ) {
 182                         ch_free( c );
 183                         ldap_controls_free(op->o_ctrls);
 184                         op->o_ctrls = NULL;
 185
 186                         rc = LDAP_NO_MEMORY;
 187                         errmsg = "no memory";
 188                         goto return_results;
 189                 }
 190 #endif
 191                 op->o_ctrls = tctrls;
 192
 193                 op->o_ctrls[nctrls++] = c;
 194                 op->o_ctrls[nctrls] = NULL;
 195
 196                 tag = ber_scanf( ber, "{a" /*}*/, &c->ldctl_oid );
 197
 198                 if( tag == LBER_ERROR ) {
 199 #ifdef NEW_LOGGING
 200                         LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
 201                                 "get_ctrls: conn %lu get OID failed.\n",
 202                                 conn->c_connid ));
 203 #else
 204                         Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: get oid failed.\n",
 205                                 0, 0, 0 );
 206 #endif
 207                         ldap_controls_free( op->o_ctrls );
 208                         op->o_ctrls = NULL;
 209                         rc = SLAPD_DISCONNECT;
 210                         errmsg = "decoding controls error";
 211                         goto return_results;
 212                 }
 213
 214                 tag = ber_peek_tag( ber, &len );
 215
 216                 if( tag == LBER_BOOLEAN ) {
 217                         ber_int_t crit;
 218                         tag = ber_scanf( ber, "b", &crit );
 219
 220                         if( tag == LBER_ERROR ) {
 221 #ifdef NEW_LOGGING
 222                                 LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
 223                                         "get_ctrls: conn %lu get crit failed.\n",
 224                                         conn->c_connid ));
 225 #else
 226                                 Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: get crit failed.\n",
 227                                         0, 0, 0 );
 228 #endif
 229                                 ldap_controls_free( op->o_ctrls );
 230                                 op->o_ctrls = NULL;
 231                                 rc = SLAPD_DISCONNECT;
 232                                 errmsg = "decoding controls error";
 233                                 goto return_results;
 234                         }
 235
 236                         c->ldctl_iscritical = (crit != 0);
 237                         tag = ber_peek_tag( ber, &len );
 238                 }
 239
 240                 if( tag == LBER_OCTETSTRING ) {
 241                         tag = ber_scanf( ber, "o", &c->ldctl_value );
 242
 243                         if( tag == LBER_ERROR ) {
 244 #ifdef NEW_LOGGING
 245                                 LDAP_LOG(( "operation", LDAP_LEVEL_INFO, "get_ctrls: conn %lu: "
 246                                         "%s (%scritical): get value failed.\n",
 247                                         conn->c_connid,
 248                                         c->ldctl_oid ? c->ldctl_oid : "(NULL)",
 249                                         c->ldctl_iscritical ? "" : "non" ));
 250 #else
 251                                 Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: conn %lu: "
 252                                         "%s (%scritical): get value failed.\n",
 253                                         conn->c_connid,
 254                                         c->ldctl_oid ? c->ldctl_oid : "(NULL)",
 255                                         c->ldctl_iscritical ? "" : "non" );
 256 #endif
 257                                 ldap_controls_free( op->o_ctrls );
 258                                 op->o_ctrls = NULL;
 259                                 rc = SLAPD_DISCONNECT;
 260                                 errmsg = "decoding controls error";
 261                                 goto return_results;
 262                         }
 263                 }
 264
 265 #ifdef NEW_LOGGING
 266                 LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
 267                         "get_ctrls: conn %lu oid=\"%s\" (%scritical)\n",
 268                         conn->c_connid,
 269                         c->ldctl_oid ? c->ldctl_oid : "(NULL)",
 270                         c->ldctl_iscritical ? "" : "non" ));
 271 #else
 272                 Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: oid=\"%s\" (%scritical)\n",
 273                         c->ldctl_oid ? c->ldctl_oid : "(NULL)",
 274                         c->ldctl_iscritical ? "" : "non",
 275                         0 );
 276 #endif
 277
 278                 sc = find_ctrl( c->ldctl_oid );
 279                 if( sc != NULL ) {
 280                         /* recognized control */
 281                         slap_mask_t tagmask;
 282                         switch( op->o_tag ) {
 283                         case LDAP_REQ_ADD:
 284                                 tagmask = SLAP_CTRL_ADD;
 285                                 break;
 286                         case LDAP_REQ_BIND:
 287                                 tagmask = SLAP_CTRL_BIND;
 288                                 break;
 289                         case LDAP_REQ_COMPARE:
 290                                 tagmask = SLAP_CTRL_COMPARE;
 291                                 break;
 292                         case LDAP_REQ_DELETE:
 293                                 tagmask = SLAP_CTRL_DELETE;
 294                                 break;
 295                         case LDAP_REQ_MODIFY:
 296                                 tagmask = SLAP_CTRL_MODIFY;
 297                                 break;
 298                         case LDAP_REQ_RENAME:
 299                                 tagmask = SLAP_CTRL_RENAME;
 300                                 break;
 301                         case LDAP_REQ_SEARCH:
 302                                 tagmask = SLAP_CTRL_SEARCH;
 303                                 break;
 304                         case LDAP_REQ_UNBIND:
 305                                 tagmask = SLAP_CTRL_UNBIND;
 306                                 break;
 307                         case LDAP_REQ_EXTENDED:
 308                                 /* FIXME: check list of extended operations */
 309                                 tagmask = ~0U;
 310                                 break;
 311                         default:
 312                                 rc = LDAP_OTHER;
 313                                 errmsg = "controls internal error";
 314                                 goto return_results;
 315                         }
 316
 317                         if (( sc->sc_mask & tagmask ) == tagmask ) {
 318                                 /* available extension */
 319
 320                                 if( !sc->sc_parse ) {
 321                                         rc = LDAP_OTHER;
 322                                         errmsg = "not yet implemented";
 323                                         goto return_results;
 324                                 }
 325
 326                                 rc = sc->sc_parse( conn, op, c, &errmsg );
 327
 328                                 if( rc != LDAP_SUCCESS ) goto return_results;
 329
 330                                 if( sc->sc_mask & SLAP_CTRL_FRONTEND ) {
 331                                         /* kludge to disable backend_control() check */
 332                                         c->ldctl_iscritical = 0;
 333                                 }
 334
 335                         } else if( c->ldctl_iscritical ) {
 336                                 /* unavailable CRITICAL control */
 337                                 rc = LDAP_UNAVAILABLE_CRITICAL_EXTENSION;
 338                                 errmsg = "critical extension is unavailable";
 339                                 goto return_results;
 340                         }
 341
 342                 } else if( c->ldctl_iscritical ) {
 343                         /* unrecognized CRITICAL control */
 344                         rc = LDAP_UNAVAILABLE_CRITICAL_EXTENSION;
 345                         errmsg = "critical extension is not recognized";
 346                         goto return_results;
 347                 }
 348         }
 349
 350 return_results:
 351 #ifdef NEW_LOGGING
 352         LDAP_LOG(( "operation", LDAP_LEVEL_RESULTS,
 353                 "get_ctrls: conn=%lu    n=%d rc=%d err=%s\n",
 354                 conn->c_connid, nctrls, rc, errmsg ? errmsg : "" ));
 355 #else
 356         Debug( LDAP_DEBUG_TRACE, "<= get_ctrls: n=%d rc=%d err=%s\n",
 357                 nctrls, rc, errmsg ? errmsg : "");
 358 #endif
 359
 360         if( sendres && rc != LDAP_SUCCESS ) {
 361                 if( rc == SLAPD_DISCONNECT ) {
 362                         send_ldap_disconnect( conn, op, LDAP_PROTOCOL_ERROR, errmsg );
 363                 } else {
 364                         send_ldap_result( conn, op, rc,
 365                                 NULL, errmsg, NULL, NULL );
 366                 }
 367         }
 368
 369         return rc;
 370 }
 371
 372 static int parseManageDSAit (
 373         Connection *conn,
 374         Operation *op,
 375         LDAPControl *ctrl,
 376         const char **text )
 377 {
 378         if ( op->o_managedsait != SLAP_NO_CONTROL ) {
 379                 *text = "manageDSAit control specified multiple times";
 380                 return LDAP_PROTOCOL_ERROR;
 381         }
 382
 383         if ( ctrl->ldctl_value.bv_len ) {
 384                 *text = "manageDSAit control value not empty";
 385                 return LDAP_PROTOCOL_ERROR;
 386         }
 387
 388         op->o_managedsait = ctrl->ldctl_iscritical
 389                 ? SLAP_CRITICAL_CONTROL
 390                 : SLAP_NONCRITICAL_CONTROL;
 391
 392         return LDAP_SUCCESS;
 393 }
 394
 395 #ifdef LDAP_CONTROL_SUBENTRIES
 396 static int parseSubentries (
 397         Connection *conn,
 398         Operation *op,
 399         LDAPControl *ctrl,
 400         const char **text )
 401 {
 402         if ( op->o_subentries != SLAP_NO_CONTROL ) {
 403                 *text = "subentries control specified multiple times";
 404                 return LDAP_PROTOCOL_ERROR;
 405         }
 406
 407         /* FIXME: should use BER library */
 408         if( ( ctrl->ldctl_value.bv_len != 3 )
 409                 && ( ctrl->ldctl_value.bv_val[0] != 0x01 )
 410                 && ( ctrl->ldctl_value.bv_val[1] != 0x01 ))
 411         {
 412                 *text = "subentries control value encoding is bogus";
 413                 return LDAP_PROTOCOL_ERROR;
 414         }
 415
 416         op->o_subentries = ctrl->ldctl_iscritical
 417                 ? SLAP_CRITICAL_CONTROL
 418                 : SLAP_NONCRITICAL_CONTROL;
 419
 420         op->o_subentries_visibility = (ctrl->ldctl_value.bv_val[2] != 0x00);
 421
 422         return LDAP_SUCCESS;
 423 }
 424 #endif
 425
 426 #ifdef LDAP_CONTROL_NOOP
 427 static int parseNoOp (
 428         Connection *conn,
 429         Operation *op,
 430         LDAPControl *ctrl,
 431         const char **text )
 432 {
 433         if ( op->o_noop != SLAP_NO_CONTROL ) {
 434                 *text = "noop control specified multiple times";
 435                 return LDAP_PROTOCOL_ERROR;
 436         }
 437
 438         if ( ctrl->ldctl_value.bv_len ) {
 439                 *text = "noop control value not empty";
 440                 return LDAP_PROTOCOL_ERROR;
 441         }
 442
 443         op->o_noop = ctrl->ldctl_iscritical
 444                 ? SLAP_CRITICAL_CONTROL
 445                 : SLAP_NONCRITICAL_CONTROL;
 446
 447         return LDAP_SUCCESS;
 448 }
 449 #endif
 450
 451 #ifdef LDAP_CONTROL_PAGEDRESULTS_REQUEST
 452 static int parsePagedResults (
 453         Connection *conn,
 454         Operation *op,
 455         LDAPControl *ctrl,
 456         const char **text )
 457 {
 458         ber_tag_t tag;
 459         ber_int_t size;
 460         BerElement *ber;
 461         struct berval cookie = { 0, NULL };
 462
 463         if ( op->o_pagedresults != SLAP_NO_CONTROL ) {
 464                 *text = "paged results control specified multiple times";
 465                 return LDAP_PROTOCOL_ERROR;
 466         }
 467
 468         if ( ctrl->ldctl_value.bv_len == 0 ) {
 469                 *text = "paged results control value is empty";
 470                 return LDAP_PROTOCOL_ERROR;
 471         }
 472
 473         /* Parse the control value
 474          *      realSearchControlValue ::= SEQUENCE {
 475          *              size    INTEGER (0..maxInt),
 476          *                              -- requested page size from client
 477          *                              -- result set size estimate from server
 478          *              cookie  OCTET STRING
 479          */
 480         ber = ber_init( &ctrl->ldctl_value );
 481         if( ber == NULL ) {
 482                 *text = "internal error";
 483                 return LDAP_OTHER;
 484         }
 485
 486         tag = ber_scanf( ber, "{im}", &size, &cookie );
 487         (void) ber_free( ber, 1 );
 488
 489         if( tag == LBER_ERROR ) {
 490                 *text = "paged results control could not be decoded";
 491                 return LDAP_PROTOCOL_ERROR;
 492         }
 493
 494         if( size <= 0 ) {
 495                 *text = "paged results control size invalid";
 496                 return LDAP_PROTOCOL_ERROR;
 497         }
 498
 499         if( cookie.bv_len ) {
 500                 PagedResultsCookie reqcookie;
 501                 if( cookie.bv_len != sizeof( reqcookie ) ) {
 502                         /* bad cookie */
 503                         *text = "paged results cookie is invalid";
 504                         return LDAP_PROTOCOL_ERROR;
 505                 }
 506
 507                 AC_MEMCPY( &reqcookie, cookie.bv_val, sizeof( reqcookie ));
 508
 509                 if( reqcookie > op->o_pagedresults_state.ps_cookie ) {
 510                         /* bad cookie */
 511                         *text = "paged results cookie is invalid";
 512                         return LDAP_PROTOCOL_ERROR;
 513
 514                 } else if( reqcookie < op->o_pagedresults_state.ps_cookie ) {
 515                         *text = "paged results cookie is invalid or old";
 516                         return LDAP_UNWILLING_TO_PERFORM;
 517                 }
 518         }
 519
 520         op->o_pagedresults_state.ps_cookie = op->o_opid;
 521         op->o_pagedresults_size = size;
 522
 523         op->o_pagedresults = ctrl->ldctl_iscritical
 524                 ? SLAP_CRITICAL_CONTROL
 525                 : SLAP_NONCRITICAL_CONTROL;
 526
 527         return LDAP_SUCCESS;
 528 }
 529 #endif