git.sur5r.net Git - openldap/blob - servers/slapd/overlays/memberof.c

   1 /* memberof.c - back-reference for group membership */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 2005-2007 Pierangelo Masarati <ando@sys-net.it>
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* ACKNOWLEDGMENTS:
  17  * This work was initially developed by Pierangelo Masarati for inclusion
  18  * in OpenLDAP Software, sponsored by SysNet s.r.l.
  19  */
  20
  21 #include "portable.h"
  22
  23 #ifdef SLAPD_OVER_MEMBEROF
  24
  25 #include <stdio.h>
  26
  27 #include "ac/string.h"
  28 #include "ac/socket.h"
  29
  30 #include "slap.h"
  31 #include "config.h"
  32 #include "lutil.h"
  33
  34 /*
  35  *      Glossary:
  36  *
  37  *              GROUP           a group object (an entry with GROUP_OC
  38  *                              objectClass)
  39  *              MEMBER          a member object (an entry whose DN is
  40  *                              listed as MEMBER_AT value of a GROUP)
  41  *              GROUP_OC        the objectClass of the group object
  42  *                              (default: groupOfNames)
  43  *              MEMBER_AT       the membership attribute, DN-valued;
  44  *                              note: nameAndOptionalUID is tolerated
  45  *                              as soon as the optionalUID is absent
  46  *                              (default: member)
  47  *              MEMBER_OF       reverse membership attribute
  48  *                              (default: memberOf)
  49  *
  50  *      - add:
  51  *              - if the entry that is being added is a GROUP,
  52  *                the MEMBER_AT defined as values of the add operation
  53  *                get the MEMBER_OF value directly from the request.
  54  *
  55  *                if configured to do so, the MEMBER objects do not exist,
  56  *                and no relax control is issued, either:
  57  *                      - fail
  58  *                      - drop non-existing members
  59  *                (by default: don't muck with values)
  60  *
  61  *              - if (configured to do so,) the referenced GROUP exists,
  62  *                the relax control is set and the user has
  63  *                "manage" privileges, allow to add MEMBER_OF values to
  64  *                generic entries.
  65  *
  66  *      - modify:
  67  *              - if the entry being modified is a GROUP_OC and the
  68  *                MEMBER_AT attribute is modified, the MEMBER_OF value
  69  *                of the (existing) MEMBER_AT entries that are affected
  70  *                is modified according to the request:
  71  *                      - if a MEMBER is removed from the group,
  72  *                        delete the corresponding MEMBER_OF
  73  *                      - if a MEMBER is added to a group,
  74  *                        add the corresponding MEMBER_OF
  75  *
  76  *                We need to determine, from the database, if it is
  77  *                a GROUP_OC, and we need to check, from the
  78  *                modification list, if the MEMBER_AT attribute is being
  79  *                affected, and what MEMBER_AT values are affected.
  80  *
  81  *                if configured to do so, the entries corresponding to
  82  *                the MEMBER_AT values do not exist, and no relax control
  83  *                is issued, either:
  84  *                      - fail
  85  *                      - drop non-existing members
  86  *                (by default: don't muck with values)
  87  *
  88  *              - if configured to do so, the referenced GROUP exists,
  89  *                (the relax control is set) and the user has
  90  *                "manage" privileges, allow to add MEMBER_OF values to
  91  *                generic entries; the change is NOT automatically reflected
  92  *                in the MEMBER attribute of the GROUP referenced
  93  *                by the value of MEMBER_OF; a separate modification,
  94  *                with or without relax control, needs to be performed.
  95  *
  96  *      - modrdn:
  97  *              - if the entry being renamed is a GROUP, the MEMBER_OF
  98  *                value of the (existing) MEMBER objects is modified
  99  *                accordingly based on the newDN of the GROUP.
 100  *
 101  *                We need to determine, from the database, if it is
 102  *                a GROUP; the list of MEMBER objects is obtained from
 103  *                the database.
 104  *
 105  *                Non-existing MEMBER objects are ignored, since the
 106  *                MEMBER_AT is not being addressed by the operation.
 107  *
 108  *              - if the entry being renamed has the MEMBER_OF attribute,
 109  *                the corresponding MEMBER value must be modified in the
 110  *                respective group entries.
 111  *
 112  *
 113  *      - delete:
 114  *              - if the entry being deleted is a GROUP, the (existing)
 115  *                MEMBER objects are modified accordingly; a copy of the
 116  *                values of the MEMBER_AT is saved and, if the delete
 117  *                succeeds, the MEMBER_OF value of the (existing) MEMBER
 118  *                objects is deleted.
 119  *
 120  *                We need to determine, from the database, if it is
 121  *                a GROUP.
 122  *
 123  *                Non-existing MEMBER objects are ignored, since the entry
 124  *                is being deleted.
 125  *
 126  *              - if the entry being deleted has the MEMBER_OF attribute,
 127  *                the corresponding value of the MEMBER_AT must be deleted
 128  *                from the respective GROUP entries.
 129  */
 130
 131 #define SLAPD_MEMBEROF_ATTR     "memberOf"
 132
 133 static slap_overinst            memberof;
 134
 135 typedef struct memberof_t {
 136         struct berval           mo_dn;
 137         struct berval           mo_ndn;
 138
 139         ObjectClass             *mo_oc_group;
 140         AttributeDescription    *mo_ad_member;
 141         AttributeDescription    *mo_ad_memberof;
 142
 143         struct berval           mo_groupFilterstr;
 144         AttributeAssertion      mo_groupAVA;
 145         Filter                  mo_groupFilter;
 146
 147         struct berval           mo_memberFilterstr;
 148         Filter                  mo_memberFilter;
 149
 150         unsigned                mo_flags;
 151 #define MEMBEROF_NONE           0x00U
 152 #define MEMBEROF_FDANGLING_DROP 0x01U
 153 #define MEMBEROF_FDANGLING_ERROR        0x02U
 154 #define MEMBEROF_FDANGLING_MASK (MEMBEROF_FDANGLING_DROP|MEMBEROF_FDANGLING_ERROR)
 155 #define MEMBEROF_FREFINT        0x04U
 156 #define MEMBEROF_FREVERSE       0x08U
 157
 158         ber_int_t               mo_dangling_err;
 159
 160 #define MEMBEROF_CHK(mo,f) \
 161         (((mo)->mo_flags & (f)) == (f))
 162 #define MEMBEROF_DANGLING_CHECK(mo) \
 163         ((mo)->mo_flags & MEMBEROF_FDANGLING_MASK)
 164 #define MEMBEROF_DANGLING_DROP(mo) \
 165         MEMBEROF_CHK((mo),MEMBEROF_FDANGLING_DROP)
 166 #define MEMBEROF_DANGLING_ERROR(mo) \
 167         MEMBEROF_CHK((mo),MEMBEROF_FDANGLING_ERROR)
 168 #define MEMBEROF_REFINT(mo) \
 169         MEMBEROF_CHK((mo),MEMBEROF_FREFINT)
 170 #define MEMBEROF_REVERSE(mo) \
 171         MEMBEROF_CHK((mo),MEMBEROF_FREVERSE)
 172 } memberof_t;
 173
 174 typedef enum memberof_is_t {
 175         MEMBEROF_IS_NONE = 0x00,
 176         MEMBEROF_IS_GROUP = 0x01,
 177         MEMBEROF_IS_MEMBER = 0x02,
 178         MEMBEROF_IS_BOTH = (MEMBEROF_IS_GROUP|MEMBEROF_IS_MEMBER)
 179 } memberof_is_t;
 180
 181 /*
 182  * failover storage for member attribute values of groups being deleted
 183  * handles [no]thread cases.
 184  */
 185 static BerVarray        saved_member_vals;
 186 static BerVarray        saved_memberof_vals;
 187
 188 static void
 189 memberof_saved_member_free( void *key, void *data )
 190 {
 191         ber_bvarray_free( (BerVarray)data );
 192 }
 193
 194 static BerVarray
 195 memberof_saved_member_get( Operation *op, void *keyp )
 196 {
 197         BerVarray       vals;
 198         BerVarray       *key = (BerVarray *)keyp;
 199
 200         assert( op != NULL );
 201
 202         if ( op->o_threadctx == NULL ) {
 203                 vals = *key;
 204                 *key = NULL;
 205
 206         } else {
 207                 ldap_pvt_thread_pool_getkey( op->o_threadctx,
 208                                 key, (void **)&vals, NULL );
 209                 ldap_pvt_thread_pool_setkey( op->o_threadctx,
 210                                 key, NULL, NULL );
 211         }
 212
 213         return vals;
 214 }
 215
 216 static void
 217 memberof_saved_member_set( Operation *op, void *keyp, BerVarray vals )
 218 {
 219         BerVarray       saved_vals = NULL;
 220         BerVarray       *key = (BerVarray*)keyp;
 221
 222         assert( op != NULL );
 223
 224         if ( vals ) {
 225                 ber_bvarray_dup_x( &saved_vals, vals, NULL );
 226         }
 227
 228         if ( op->o_threadctx == NULL ) {
 229                 if ( *key ) {
 230                         ber_bvarray_free( *key );
 231                 }
 232                 *key = saved_vals;
 233
 234         } else {
 235                 ldap_pvt_thread_pool_setkey( op->o_threadctx, key,
 236                                 saved_vals, memberof_saved_member_free );
 237         }
 238 }
 239
 240 typedef struct memberof_cookie_t {
 241         AttributeDescription    *ad;
 242         void                    *key;
 243         int                     foundit;
 244 } memberof_cookie_t;
 245
 246 static int
 247 memberof_isGroupOrMember_cb( Operation *op, SlapReply *rs )
 248 {
 249         if ( rs->sr_type == REP_SEARCH ) {
 250                 memberof_cookie_t       *mc;
 251
 252                 mc = (memberof_cookie_t *)op->o_callback->sc_private;
 253                 mc->foundit = 1;
 254         }
 255
 256         return 0;
 257 }
 258
 259 /*
 260  * callback for internal search that saves the member attribute values
 261  * of groups being deleted.
 262  */
 263 static int
 264 memberof_saveMember_cb( Operation *op, SlapReply *rs )
 265 {
 266         if ( rs->sr_type == REP_SEARCH ) {
 267                 memberof_cookie_t       *mc;
 268                 Attribute               *a;
 269                 BerVarray               vals = NULL;
 270
 271                 mc = (memberof_cookie_t *)op->o_callback->sc_private;
 272                 mc->foundit = 1;
 273
 274                 assert( rs->sr_entry != NULL );
 275                 assert( rs->sr_entry->e_attrs != NULL );
 276
 277                 a = attr_find( rs->sr_entry->e_attrs, mc->ad );
 278                 if ( a != NULL ) {
 279                         vals = a->a_nvals;
 280                 }
 281
 282                 memberof_saved_member_set( op, mc->key, vals );
 283
 284                 if ( a && attr_find( a->a_next, mc->ad ) != NULL ) {
 285                         Debug( LDAP_DEBUG_ANY,
 286                                 "%s: memberof_saveMember_cb(\"%s\"): "
 287                                 "more than one occurrence of \"%s\" "
 288                                 "attribute.\n",
 289                                 op->o_log_prefix,
 290                                 rs->sr_entry->e_name.bv_val,
 291                                 mc->ad->ad_cname.bv_val );
 292                 }
 293         }
 294
 295         return 0;
 296 }
 297
 298 /*
 299  * the delete hook performs an internal search that saves the member
 300  * attribute values of groups being deleted.
 301  */
 302 static int
 303 memberof_isGroupOrMember( Operation *op, memberof_is_t *iswhatp )
 304 {
 305         slap_overinst           *on = (slap_overinst *)op->o_bd->bd_info;
 306         memberof_t              *mo = (memberof_t *)on->on_bi.bi_private;
 307
 308         Operation               op2 = *op;
 309         SlapReply               rs2 = { REP_RESULT };
 310         slap_callback           cb = { 0 };
 311         memberof_cookie_t       mc;
 312         AttributeName           an[ 2 ];
 313
 314         memberof_is_t           iswhat = MEMBEROF_IS_NONE;
 315
 316         assert( iswhatp != NULL );
 317         assert( *iswhatp != MEMBEROF_IS_NONE );
 318
 319         cb.sc_private = &mc;
 320         if ( op->o_tag == LDAP_REQ_DELETE ) {
 321                 cb.sc_response = memberof_saveMember_cb;
 322
 323         } else {
 324                 cb.sc_response = memberof_isGroupOrMember_cb;
 325         }
 326
 327         op2.o_tag = LDAP_REQ_SEARCH;
 328         op2.o_callback = &cb;
 329         op2.o_dn = op->o_bd->be_rootdn;
 330         op2.o_ndn = op->o_bd->be_rootndn;
 331
 332         op2.ors_scope = LDAP_SCOPE_BASE;
 333         op2.ors_deref = LDAP_DEREF_NEVER;
 334         BER_BVZERO( &an[ 1 ].an_name );
 335         op2.ors_attrs = an;
 336         op2.ors_attrsonly = 0;
 337         op2.ors_limit = NULL;
 338         op2.ors_slimit = 1;
 339         op2.ors_tlimit = SLAP_NO_LIMIT;
 340
 341         if ( *iswhatp & MEMBEROF_IS_GROUP ) {
 342                 mc.ad = mo->mo_ad_member;
 343                 mc.key = &saved_member_vals;
 344                 mc.foundit = 0;
 345                 an[ 0 ].an_desc = mo->mo_ad_member;
 346                 an[ 0 ].an_name = an[ 0 ].an_desc->ad_cname;
 347                 op2.ors_filterstr = mo->mo_groupFilterstr;
 348                 op2.ors_filter = &mo->mo_groupFilter;
 349
 350                 op2.o_bd->bd_info = (BackendInfo *)on->on_info;
 351                 (void)op->o_bd->be_search( &op2, &rs2 );
 352                 op2.o_bd->bd_info = (BackendInfo *)on;
 353
 354                 if ( mc.foundit ) {
 355                         iswhat |= MEMBEROF_IS_GROUP;
 356
 357                 } else {
 358                         memberof_saved_member_set( op, mc.key, NULL );
 359                 }
 360         }
 361
 362         if ( *iswhatp & MEMBEROF_IS_MEMBER ) {
 363                 mc.ad = mo->mo_ad_memberof;
 364                 mc.key = &saved_memberof_vals;
 365                 mc.foundit = 0;
 366                 an[ 0 ].an_desc = mo->mo_ad_memberof;
 367                 an[ 0 ].an_name = an[ 0 ].an_desc->ad_cname;
 368                 op2.ors_filterstr = mo->mo_memberFilterstr;
 369                 op2.ors_filter = &mo->mo_memberFilter;
 370
 371                 op2.o_bd->bd_info = (BackendInfo *)on->on_info;
 372                 (void)op->o_bd->be_search( &op2, &rs2 );
 373                 op2.o_bd->bd_info = (BackendInfo *)on;
 374
 375                 if ( mc.foundit ) {
 376                         iswhat |= MEMBEROF_IS_MEMBER;
 377
 378                 } else {
 379                         memberof_saved_member_set( op, mc.key, NULL );
 380                 }
 381         }
 382
 383         *iswhatp = iswhat;
 384
 385         return LDAP_SUCCESS;
 386 }
 387
 388 /*
 389  * response callback that adds memberof values when a group is modified.
 390  */
 391 static int
 392 memberof_value_modify(
 393         Operation               *op,
 394         SlapReply               *rs,
 395         struct berval           *ndn,
 396         AttributeDescription    *ad,
 397         struct berval           *old_dn,
 398         struct berval           *old_ndn,
 399         struct berval           *new_dn,
 400         struct berval           *new_ndn )
 401 {
 402         slap_overinst   *on = (slap_overinst *)op->o_bd->bd_info;
 403         memberof_t      *mo = (memberof_t *)on->on_bi.bi_private;
 404
 405         Operation       op2 = *op;
 406         SlapReply       rs2 = { REP_RESULT };
 407         slap_callback   cb = { NULL, slap_null_cb, NULL, NULL };
 408         Modifications   mod[ 2 ] = { { { 0 } } }, *ml;
 409         struct berval   values[ 4 ], nvalues[ 4 ];
 410
 411         op2.o_tag = LDAP_REQ_MODIFY;
 412
 413         op2.o_req_dn = *ndn;
 414         op2.o_req_ndn = *ndn;
 415
 416         op2.o_bd->bd_info = (BackendInfo *)on->on_info;
 417
 418         op2.o_callback = &cb;
 419         op2.o_dn = op->o_bd->be_rootdn;
 420         op2.o_ndn = op->o_bd->be_rootndn;
 421
 422         ml = &mod[ 0 ];
 423         ml->sml_numvals = 1;
 424         ml->sml_values = &values[ 0 ];
 425         ml->sml_values[ 0 ] = mo->mo_dn;
 426         BER_BVZERO( &ml->sml_values[ 1 ] );
 427         ml->sml_nvalues = &nvalues[ 0 ];
 428         ml->sml_nvalues[ 0 ] = mo->mo_ndn;
 429         BER_BVZERO( &ml->sml_nvalues[ 1 ] );
 430         ml->sml_desc = slap_schema.si_ad_modifiersName;
 431         ml->sml_type = ml->sml_desc->ad_cname;
 432         ml->sml_op = LDAP_MOD_REPLACE;
 433         ml->sml_flags = SLAP_MOD_INTERNAL;
 434         ml->sml_next = NULL;
 435         op2.orm_modlist = ml;
 436
 437         ml = &mod[ 1 ];
 438         ml->sml_numvals = 1;
 439         ml->sml_values = &values[ 2 ];
 440         BER_BVZERO( &ml->sml_values[ 1 ] );
 441         ml->sml_nvalues = &nvalues[ 2 ];
 442         BER_BVZERO( &ml->sml_nvalues[ 1 ] );
 443         ml->sml_desc = ad;
 444         ml->sml_type = ml->sml_desc->ad_cname;
 445         ml->sml_flags = SLAP_MOD_INTERNAL;
 446         ml->sml_next = NULL;
 447         op2.orm_modlist->sml_next = ml;
 448
 449         if ( new_ndn != NULL ) {
 450                 assert( !BER_BVISNULL( new_dn ) );
 451                 assert( !BER_BVISNULL( new_ndn ) );
 452
 453                 ml = &mod[ 1 ];
 454                 ml->sml_op = LDAP_MOD_ADD;
 455
 456                 ml->sml_values[ 0 ] = *new_dn;
 457                 ml->sml_nvalues[ 0 ] = *new_ndn;
 458
 459                 (void)op->o_bd->be_modify( &op2, &rs2 );
 460                 if ( rs2.sr_err != LDAP_SUCCESS ) {
 461                         char buf[ SLAP_TEXT_BUFLEN ];
 462                         snprintf( buf, sizeof( buf ),
 463                                 "memberof_value_modify %s=\"%s\" failed err=%d",
 464                                 ad->ad_cname.bv_val, new_dn->bv_val, rs2.sr_err );
 465                         Debug( LDAP_DEBUG_ANY, "%s: %s\n", op->o_log_prefix, buf, 0 );
 466                 }
 467
 468                 assert( op2.orm_modlist == &mod[ 0 ] );
 469                 assert( op2.orm_modlist->sml_next == &mod[ 1 ] );
 470                 ml = op2.orm_modlist->sml_next->sml_next;
 471                 if ( ml != NULL ) {
 472                         slap_mods_free( ml, 1 );
 473                 }
 474         }
 475
 476         if ( old_ndn != NULL ) {
 477                 assert( !BER_BVISNULL( old_dn ) );
 478                 assert( !BER_BVISNULL( old_ndn ) );
 479
 480                 ml = &mod[ 1 ];
 481                 ml->sml_op = LDAP_MOD_DELETE;
 482
 483                 ml->sml_values[ 0 ] = *old_dn;
 484                 ml->sml_nvalues[ 0 ] = *old_ndn;
 485
 486                 (void)op->o_bd->be_modify( &op2, &rs2 );
 487                 if ( rs2.sr_err != LDAP_SUCCESS ) {
 488                         char buf[ SLAP_TEXT_BUFLEN ];
 489                         snprintf( buf, sizeof( buf ),
 490                                 "memberof_value_modify %s=\"%s\" failed err=%d",
 491                                 ad->ad_cname.bv_val, old_dn->bv_val, rs2.sr_err );
 492                         Debug( LDAP_DEBUG_ANY, "%s: %s\n", op->o_log_prefix, buf, 0 );
 493                 }
 494
 495                 assert( op2.orm_modlist == &mod[ 0 ] );
 496                 assert( op2.orm_modlist->sml_next == &mod[ 1 ] );
 497                 ml = op2.orm_modlist->sml_next->sml_next;
 498                 if ( ml != NULL ) {
 499                         slap_mods_free( ml, 1 );
 500                 }
 501         }
 502
 503         /* FIXME: if old_group_ndn doesn't exist, both delete __and__
 504          * add will fail; better split in two operations, although
 505          * not optimal in terms of performance.  At least it would
 506          * move towards self-repairing capabilities. */
 507
 508         op2.o_bd->bd_info = (BackendInfo *)on;
 509
 510         return rs2.sr_err;
 511 }
 512
 513 static int
 514 memberof_op_add( Operation *op, SlapReply *rs )
 515 {
 516         slap_overinst   *on = (slap_overinst *)op->o_bd->bd_info;
 517         memberof_t      *mo = (memberof_t *)on->on_bi.bi_private;
 518
 519         Attribute       **ap, **map = NULL;
 520         int             rc = SLAP_CB_CONTINUE;
 521         int             i;
 522         struct berval   save_dn, save_ndn;
 523
 524         if ( op->ora_e->e_attrs == NULL ) {
 525                 /* FIXME: global overlay; need to deal with */
 526                 Debug( LDAP_DEBUG_ANY, "%s: memberof_op_add(\"%s\"): "
 527                         "consistency checks not implemented when overlay "
 528                         "is instantiated as global.\n",
 529                         op->o_log_prefix, op->o_req_dn.bv_val, 0 );
 530                 return SLAP_CB_CONTINUE;
 531         }
 532
 533         if ( MEMBEROF_REVERSE( mo ) ) {
 534                 for ( ap = &op->ora_e->e_attrs; *ap; ap = &(*ap)->a_next ) {
 535                         Attribute       *a = *ap;
 536
 537                         if ( a->a_desc == mo->mo_ad_memberof ) {
 538                                 map = ap;
 539                                 break;
 540                         }
 541                 }
 542         }
 543
 544         save_dn = op->o_dn;
 545         save_ndn = op->o_ndn;
 546
 547         if ( MEMBEROF_DANGLING_CHECK( mo )
 548                         && !get_relax( op )
 549                         && is_entry_objectclass_or_sub( op->ora_e, mo->mo_oc_group ) )
 550         {
 551                 op->o_dn = op->o_bd->be_rootdn;
 552                 op->o_dn = op->o_bd->be_rootndn;
 553                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
 554
 555                 for ( ap = &op->ora_e->e_attrs; *ap; ) {
 556                         Attribute       *a = *ap;
 557
 558                         if ( !is_ad_subtype( a->a_desc, mo->mo_ad_member ) ) {
 559                                 ap = &a->a_next;
 560                                 continue;
 561                         }
 562
 563                         assert( a->a_nvals != NULL );
 564
 565                         for ( i = 0; !BER_BVISNULL( &a->a_nvals[ i ] ); i++ ) {
 566                                 Entry           *e = NULL;
 567
 568                                 rc = be_entry_get_rw( op, &a->a_nvals[ i ],
 569                                                 NULL, NULL, 0, &e );
 570                                 if ( rc == LDAP_SUCCESS ) {
 571                                         be_entry_release_r( op, e );
 572                                         continue;
 573                                 }
 574
 575                                 if ( MEMBEROF_DANGLING_ERROR( mo ) ) {
 576                                         rc = rs->sr_err = mo->mo_dangling_err;
 577                                         rs->sr_text = "adding non-existing object "
 578                                                 "as group member";
 579                                         send_ldap_result( op, rs );
 580                                         goto done;
 581                                 }
 582
 583                                 if ( MEMBEROF_DANGLING_DROP( mo ) ) {
 584                                         int     j;
 585
 586                                         Debug( LDAP_DEBUG_ANY, "%s: memberof_op_add(\"%s\"): "
 587                                                 "member=\"%s\" does not exist (stripping...)\n",
 588                                                 op->o_log_prefix, op->ora_e->e_name.bv_val,
 589                                                 a->a_vals[ i ].bv_val );
 590
 591                                         for ( j = i + 1; !BER_BVISNULL( &a->a_nvals[ j ] ); j++ );
 592                                         ber_memfree( a->a_vals[ i ].bv_val );
 593                                         BER_BVZERO( &a->a_vals[ i ] );
 594                                         if ( a->a_nvals != a->a_vals ) {
 595                                                 ber_memfree( a->a_nvals[ i ].bv_val );
 596                                                 BER_BVZERO( &a->a_nvals[ i ] );
 597                                         }
 598                                         if ( j - i == 1 ) {
 599                                                 break;
 600                                         }
 601
 602                                         AC_MEMCPY( &a->a_vals[ i ], &a->a_vals[ i + 1 ],
 603                                                 sizeof( struct berval ) * ( j - i ) );
 604                                         if ( a->a_nvals != a->a_vals ) {
 605                                                 AC_MEMCPY( &a->a_nvals[ i ], &a->a_nvals[ i + 1 ],
 606                                                         sizeof( struct berval ) * ( j - i ) );
 607                                         }
 608                                         i--;
 609                                 }
 610                         }
 611
 612                         /* If all values have been removed,
 613                          * remove the attribute itself. */
 614                         if ( BER_BVISNULL( &a->a_nvals[ 0 ] ) ) {
 615                                 *ap = a->a_next;
 616                                 attr_free( a );
 617
 618                         } else {
 619                                 ap = &a->a_next;
 620                         }
 621                 }
 622                 op->o_dn = save_dn;
 623                 op->o_ndn = save_ndn;
 624                 op->o_bd->bd_info = (BackendInfo *)on;
 625         }
 626
 627         if ( map != NULL ) {
 628                 Attribute               *a = *map;
 629                 AccessControlState      acl_state = ACL_STATE_INIT;
 630
 631                 for ( i = 0; !BER_BVISNULL( &a->a_nvals[ i ] ); i++ ) {
 632                         Entry           *e;
 633
 634                         op->o_bd->bd_info = (BackendInfo *)on->on_info;
 635                         /* access is checked with the original identity */
 636                         rc = access_allowed( op, op->ora_e, mo->mo_ad_memberof,
 637                                         &a->a_nvals[ i ], ACL_WADD,
 638                                         &acl_state );
 639                         if ( rc == 0 ) {
 640                                 rc = rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
 641                                 rs->sr_text = NULL;
 642                                 send_ldap_result( op, rs );
 643                                 goto done;
 644                         }
 645                         rc = be_entry_get_rw( op, &a->a_nvals[ i ],
 646                                         NULL, NULL, 0, &e );
 647                         op->o_bd->bd_info = (BackendInfo *)on;
 648                         if ( rc != LDAP_SUCCESS ) {
 649                                 if ( get_relax( op ) ) {
 650                                         continue;
 651                                 }
 652
 653                                 if ( MEMBEROF_DANGLING_ERROR( mo ) ) {
 654                                         rc = rs->sr_err = mo->mo_dangling_err;
 655                                         rs->sr_text = "adding non-existing object "
 656                                                 "as memberof";
 657                                         send_ldap_result( op, rs );
 658                                         goto done;
 659                                 }
 660
 661                                 if ( MEMBEROF_DANGLING_DROP( mo ) ) {
 662                                         int     j;
 663
 664                                         Debug( LDAP_DEBUG_ANY, "%s: memberof_op_add(\"%s\"): "
 665                                                 "memberof=\"%s\" does not exist (stripping...)\n",
 666                                                 op->o_log_prefix, op->ora_e->e_name.bv_val,
 667                                                 a->a_nvals[ i ].bv_val );
 668
 669                                         for ( j = i + 1; !BER_BVISNULL( &a->a_nvals[ j ] ); j++ );
 670                                         ber_memfree( a->a_vals[ i ].bv_val );
 671                                         BER_BVZERO( &a->a_vals[ i ] );
 672                                         if ( a->a_nvals != a->a_vals ) {
 673                                                 ber_memfree( a->a_nvals[ i ].bv_val );
 674                                                 BER_BVZERO( &a->a_nvals[ i ] );
 675                                         }
 676                                         if ( j - i == 1 ) {
 677                                                 break;
 678                                         }
 679
 680                                         AC_MEMCPY( &a->a_vals[ i ], &a->a_vals[ i + 1 ],
 681                                                 sizeof( struct berval ) * ( j - i ) );
 682                                         if ( a->a_nvals != a->a_vals ) {
 683                                                 AC_MEMCPY( &a->a_nvals[ i ], &a->a_nvals[ i + 1 ],
 684                                                         sizeof( struct berval ) * ( j - i ) );
 685                                         }
 686                                         i--;
 687                                 }
 688
 689                                 continue;
 690                         }
 691
 692                         /* access is checked with the original identity */
 693                         op->o_bd->bd_info = (BackendInfo *)on->on_info;
 694                         rc = access_allowed( op, e, mo->mo_ad_member,
 695                                         &op->o_req_ndn, ACL_WADD, NULL );
 696                         be_entry_release_r( op, e );
 697                         op->o_bd->bd_info = (BackendInfo *)on;
 698
 699                         if ( !rc ) {
 700                                 rc = rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
 701                                 rs->sr_text = "insufficient access to object referenced by memberof";
 702                                 send_ldap_result( op, rs );
 703                                 goto done;
 704                         }
 705                 }
 706
 707                 if ( BER_BVISNULL( &a->a_nvals[ 0 ] ) ) {
 708                         *map = a->a_next;
 709                         attr_free( a );
 710                 }
 711         }
 712
 713         rc = SLAP_CB_CONTINUE;
 714
 715 done:;
 716         op->o_dn = save_dn;
 717         op->o_ndn = save_ndn;
 718         op->o_bd->bd_info = (BackendInfo *)on;
 719
 720         return rc;
 721 }
 722
 723 static int
 724 memberof_op_delete( Operation *op, SlapReply *rs )
 725 {
 726         slap_overinst   *on = (slap_overinst *)op->o_bd->bd_info;
 727         memberof_t      *mo = (memberof_t *)on->on_bi.bi_private;
 728
 729         memberof_is_t   iswhat = MEMBEROF_IS_GROUP;
 730
 731         if ( MEMBEROF_REFINT( mo ) ) {
 732                 iswhat = MEMBEROF_IS_BOTH;
 733         }
 734
 735         memberof_isGroupOrMember( op, &iswhat );
 736
 737         return SLAP_CB_CONTINUE;
 738 }
 739
 740 static int
 741 memberof_op_modify( Operation *op, SlapReply *rs )
 742 {
 743         slap_overinst   *on = (slap_overinst *)op->o_bd->bd_info;
 744         memberof_t      *mo = (memberof_t *)on->on_bi.bi_private;
 745
 746         Modifications   **mlp, **mmlp = NULL;
 747         int             rc = SLAP_CB_CONTINUE;
 748         struct berval   save_dn, save_ndn;
 749         memberof_is_t   iswhat = MEMBEROF_IS_GROUP;
 750
 751         if ( MEMBEROF_REVERSE( mo ) ) {
 752                 for ( mlp = &op->orm_modlist; *mlp; mlp = &(*mlp)->sml_next ) {
 753                         Modifications   *ml = *mlp;
 754
 755                         if ( ml->sml_desc == mo->mo_ad_memberof ) {
 756                                 mmlp = mlp;
 757                                 break;
 758                         }
 759                 }
 760         }
 761
 762         save_dn = op->o_dn;
 763         save_ndn = op->o_ndn;
 764
 765         if ( memberof_isGroupOrMember( op, &iswhat ) == LDAP_SUCCESS
 766                 && ( iswhat & MEMBEROF_IS_GROUP ) )
 767         {
 768                 Modifications *ml;
 769                 int save_member = 0;
 770
 771                 for ( ml = op->orm_modlist; ml; ml = ml->sml_next ) {
 772                         if ( ml->sml_desc == mo->mo_ad_member ) {
 773                                 switch ( ml->sml_op ) {
 774                                 case LDAP_MOD_DELETE:
 775                                 case LDAP_MOD_REPLACE:
 776                                         save_member = 1;
 777                                         break;
 778                                 }
 779                         }
 780                 }
 781
 782                 if ( save_member ) {
 783                         BerVarray       vals = NULL;
 784
 785                         op->o_dn = op->o_bd->be_rootdn;
 786                         op->o_dn = op->o_bd->be_rootndn;
 787                         op->o_bd->bd_info = (BackendInfo *)on->on_info;
 788                         rc = backend_attribute( op, NULL, &op->o_req_ndn,
 789                                         mo->mo_ad_member, &vals, ACL_READ );
 790                         op->o_bd->bd_info = (BackendInfo *)on;
 791                         if ( rc == LDAP_SUCCESS && vals != NULL ) {
 792                                 memberof_saved_member_set( op, &saved_member_vals, vals );
 793                                 ber_bvarray_free_x( vals, op->o_tmpmemctx );
 794                         }
 795                 }
 796
 797                 if ( MEMBEROF_DANGLING_CHECK( mo )
 798                                 && !get_relax( op ) )
 799                 {
 800                         op->o_dn = op->o_bd->be_rootdn;
 801                         op->o_dn = op->o_bd->be_rootndn;
 802                         op->o_bd->bd_info = (BackendInfo *)on->on_info;
 803
 804                         assert( op->orm_modlist != NULL );
 805
 806                         for ( mlp = &op->orm_modlist; *mlp; ) {
 807                                 Modifications   *ml = *mlp;
 808                                 int             i;
 809
 810                                 if ( !is_ad_subtype( ml->sml_desc, mo->mo_ad_member ) ) {
 811                                         mlp = &ml->sml_next;
 812                                         continue;
 813                                 }
 814
 815                                 switch ( ml->sml_op ) {
 816                                 case LDAP_MOD_DELETE:
 817                                         /* we don't care about cancellations: if the value
 818                                          * exists, fine; if it doesn't, we let the underlying
 819                                          * database fail as appropriate; */
 820                                         mlp = &ml->sml_next;
 821                                         break;
 822
 823                                 case LDAP_MOD_REPLACE:
 824                                 case LDAP_MOD_ADD:
 825                                         /* NOTE: right now, the attributeType we use
 826                                          * for member must have a normalized value */
 827                                         assert( ml->sml_nvalues != NULL );
 828
 829                                         for ( i = 0; !BER_BVISNULL( &ml->sml_nvalues[ i ] ); i++ ) {
 830                                                 int             rc;
 831                                                 Entry           *e;
 832
 833                                                 if ( be_entry_get_rw( op, &ml->sml_nvalues[ i ],
 834                                                                 NULL, NULL, 0, &e ) == LDAP_SUCCESS )
 835                                                 {
 836                                                         be_entry_release_r( op, e );
 837                                                         continue;
 838                                                 }
 839
 840                                                 if ( MEMBEROF_DANGLING_ERROR( mo ) ) {
 841                                                         rc = rs->sr_err = mo->mo_dangling_err;
 842                                                         rs->sr_text = "adding non-existing object "
 843                                                                 "as group member";
 844                                                         send_ldap_result( op, rs );
 845                                                         goto done;
 846                                                 }
 847
 848                                                 if ( MEMBEROF_DANGLING_DROP( mo ) ) {
 849                                                         int     j;
 850
 851                                                         Debug( LDAP_DEBUG_ANY, "%s: memberof_op_modify(\"%s\"): "
 852                                                                 "member=\"%s\" does not exist (stripping...)\n",
 853                                                                 op->o_log_prefix, op->o_req_dn.bv_val,
 854                                                                 ml->sml_nvalues[ i ].bv_val );
 855
 856                                                         for ( j = i + 1; !BER_BVISNULL( &ml->sml_nvalues[ j ] ); j++ );
 857                                                         ber_memfree( ml->sml_values[ i ].bv_val );
 858                                                         BER_BVZERO( &ml->sml_values[ i ] );
 859                                                         ber_memfree( ml->sml_nvalues[ i ].bv_val );
 860                                                         BER_BVZERO( &ml->sml_nvalues[ i ] );
 861                                                         ml->sml_numvals--;
 862                                                         if ( j - i == 1 ) {
 863                                                                 break;
 864                                                         }
 865
 866                                                         AC_MEMCPY( &ml->sml_values[ i ], &ml->sml_values[ i + 1 ],
 867                                                                 sizeof( struct berval ) * ( j - i ) );
 868                                                         AC_MEMCPY( &ml->sml_nvalues[ i ], &ml->sml_nvalues[ i + 1 ],
 869                                                                 sizeof( struct berval ) * ( j - i ) );
 870                                                         i--;
 871                                                 }
 872                                         }
 873
 874                                         if ( BER_BVISNULL( &ml->sml_nvalues[ 0 ] ) ) {
 875                                                 *mlp = ml->sml_next;
 876                                                 slap_mod_free( &ml->sml_mod, 0 );
 877                                                 free( ml );
 878
 879                                         } else {
 880                                                 mlp = &ml->sml_next;
 881                                         }
 882
 883                                         break;
 884
 885                                 default:
 886                                         assert( 0 );
 887                                 }
 888                         }
 889                 }
 890         }
 891
 892         if ( mmlp != NULL ) {
 893                 Modifications   *ml = *mmlp;
 894                 int             i;
 895                 Entry           *target;
 896
 897                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
 898                 rc = be_entry_get_rw( op, &op->o_req_ndn,
 899                                 NULL, NULL, 0, &target );
 900                 op->o_bd->bd_info = (BackendInfo *)on;
 901                 if ( rc != LDAP_SUCCESS ) {
 902                         rc = rs->sr_err = LDAP_NO_SUCH_OBJECT;
 903                         send_ldap_result( op, rs );
 904                         goto done;
 905                 }
 906
 907                 switch ( ml->sml_op ) {
 908                 case LDAP_MOD_DELETE:
 909                         if ( ml->sml_nvalues != NULL ) {
 910                                 AccessControlState      acl_state = ACL_STATE_INIT;
 911
 912                                 for ( i = 0; !BER_BVISNULL( &ml->sml_nvalues[ i ] ); i++ ) {
 913                                         Entry           *e;
 914
 915                                         op->o_bd->bd_info = (BackendInfo *)on->on_info;
 916                                         /* access is checked with the original identity */
 917                                         rc = access_allowed( op, target,
 918                                                         mo->mo_ad_memberof,
 919                                                         &ml->sml_nvalues[ i ],
 920                                                         ACL_WDEL,
 921                                                         &acl_state );
 922                                         if ( rc == 0 ) {
 923                                                 rc = rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
 924                                                 rs->sr_text = NULL;
 925                                                 send_ldap_result( op, rs );
 926                                                 goto done2;
 927                                         }
 928
 929                                         rc = be_entry_get_rw( op, &ml->sml_nvalues[ i ],
 930                                                         NULL, NULL, 0, &e );
 931                                         op->o_bd->bd_info = (BackendInfo *)on;
 932                                         if ( rc != LDAP_SUCCESS ) {
 933                                                 if ( get_relax( op ) ) {
 934                                                         continue;
 935                                                 }
 936
 937                                                 if ( MEMBEROF_DANGLING_ERROR( mo ) ) {
 938                                                         rc = rs->sr_err = mo->mo_dangling_err;
 939                                                         rs->sr_text = "deleting non-existing object "
 940                                                                 "as memberof";
 941                                                         send_ldap_result( op, rs );
 942                                                         goto done2;
 943                                                 }
 944
 945                                                 if ( MEMBEROF_DANGLING_DROP( mo ) ) {
 946                                                         int     j;
 947
 948                                                         Debug( LDAP_DEBUG_ANY, "%s: memberof_op_modify(\"%s\"): "
 949                                                                 "memberof=\"%s\" does not exist (stripping...)\n",
 950                                                                 op->o_log_prefix, op->o_req_ndn.bv_val,
 951                                                                 ml->sml_nvalues[ i ].bv_val );
 952
 953                                                         for ( j = i + 1; !BER_BVISNULL( &ml->sml_nvalues[ j ] ); j++ );
 954                                                         ber_memfree( ml->sml_values[ i ].bv_val );
 955                                                         BER_BVZERO( &ml->sml_values[ i ] );
 956                                                         if ( ml->sml_nvalues != ml->sml_values ) {
 957                                                                 ber_memfree( ml->sml_nvalues[ i ].bv_val );
 958                                                                 BER_BVZERO( &ml->sml_nvalues[ i ] );
 959                                                         }
 960                                                         ml->sml_numvals--;
 961                                                         if ( j - i == 1 ) {
 962                                                                 break;
 963                                                         }
 964
 965                                                         AC_MEMCPY( &ml->sml_values[ i ], &ml->sml_values[ i + 1 ],
 966                                                                 sizeof( struct berval ) * ( j - i ) );
 967                                                         if ( ml->sml_nvalues != ml->sml_values ) {
 968                                                                 AC_MEMCPY( &ml->sml_nvalues[ i ], &ml->sml_nvalues[ i + 1 ],
 969                                                                         sizeof( struct berval ) * ( j - i ) );
 970                                                         }
 971                                                         i--;
 972                                                 }
 973
 974                                                 continue;
 975                                         }
 976
 977                                         /* access is checked with the original identity */
 978                                         op->o_bd->bd_info = (BackendInfo *)on->on_info;
 979                                         rc = access_allowed( op, e, mo->mo_ad_member,
 980                                                         &op->o_req_ndn,
 981                                                         ACL_WDEL, NULL );
 982                                         be_entry_release_r( op, e );
 983                                         op->o_bd->bd_info = (BackendInfo *)on;
 984
 985                                         if ( !rc ) {
 986                                                 rc = rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
 987                                                 rs->sr_text = "insufficient access to object referenced by memberof";
 988                                                 send_ldap_result( op, rs );
 989                                                 goto done;
 990                                         }
 991                                 }
 992
 993                                 if ( BER_BVISNULL( &ml->sml_nvalues[ 0 ] ) ) {
 994                                         *mmlp = ml->sml_next;
 995                                         slap_mod_free( &ml->sml_mod, 0 );
 996                                         free( ml );
 997                                 }
 998
 999                                 break;
1000                         }
1001                         /* fall thru */
1002
1003                 case LDAP_MOD_REPLACE:
1004
1005                         op->o_bd->bd_info = (BackendInfo *)on->on_info;
1006                         /* access is checked with the original identity */
1007                         rc = access_allowed( op, target,
1008                                         mo->mo_ad_memberof,
1009                                         NULL,
1010                                         ACL_WDEL, NULL );
1011                         op->o_bd->bd_info = (BackendInfo *)on;
1012                         if ( rc == 0 ) {
1013                                 rc = rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
1014                                 rs->sr_text = NULL;
1015                                 send_ldap_result( op, rs );
1016                                 goto done2;
1017                         }
1018
1019                         if ( ml->sml_op == LDAP_MOD_DELETE ) {
1020                                 break;
1021                         }
1022                         /* fall thru */
1023
1024                 case LDAP_MOD_ADD: {
1025                         AccessControlState      acl_state = ACL_STATE_INIT;
1026
1027                         for ( i = 0; !BER_BVISNULL( &ml->sml_nvalues[ i ] ); i++ ) {
1028                                 Entry           *e;
1029
1030                                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
1031                                 /* access is checked with the original identity */
1032                                 rc = access_allowed( op, target,
1033                                                 mo->mo_ad_memberof,
1034                                                 &ml->sml_nvalues[ i ],
1035                                                 ACL_WADD,
1036                                                 &acl_state );
1037                                 if ( rc == 0 ) {
1038                                         rc = rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
1039                                         rs->sr_text = NULL;
1040                                         send_ldap_result( op, rs );
1041                                         goto done2;
1042                                 }
1043
1044                                 rc = be_entry_get_rw( op, &ml->sml_nvalues[ i ],
1045                                                 NULL, NULL, 0, &e );
1046                                 op->o_bd->bd_info = (BackendInfo *)on;
1047                                 if ( rc != LDAP_SUCCESS ) {
1048                                         if ( MEMBEROF_DANGLING_ERROR( mo ) ) {
1049                                                 rc = rs->sr_err = mo->mo_dangling_err;
1050                                                 rs->sr_text = "adding non-existing object "
1051                                                         "as memberof";
1052                                                 send_ldap_result( op, rs );
1053                                                 goto done2;
1054                                         }
1055
1056                                         if ( MEMBEROF_DANGLING_DROP( mo ) ) {
1057                                                 int     j;
1058
1059                                                 Debug( LDAP_DEBUG_ANY, "%s: memberof_op_modify(\"%s\"): "
1060                                                         "memberof=\"%s\" does not exist (stripping...)\n",
1061                                                         op->o_log_prefix, op->o_req_ndn.bv_val,
1062                                                         ml->sml_nvalues[ i ].bv_val );
1063
1064                                                 for ( j = i + 1; !BER_BVISNULL( &ml->sml_nvalues[ j ] ); j++ );
1065                                                 ber_memfree( ml->sml_values[ i ].bv_val );
1066                                                 BER_BVZERO( &ml->sml_values[ i ] );
1067                                                 if ( ml->sml_nvalues != ml->sml_values ) {
1068                                                         ber_memfree( ml->sml_nvalues[ i ].bv_val );
1069                                                         BER_BVZERO( &ml->sml_nvalues[ i ] );
1070                                                 }
1071                                                 ml->sml_numvals--;
1072                                                 if ( j - i == 1 ) {
1073                                                         break;
1074                                                 }
1075
1076                                                 AC_MEMCPY( &ml->sml_values[ i ], &ml->sml_values[ i + 1 ],
1077                                                         sizeof( struct berval ) * ( j - i ) );
1078                                                 if ( ml->sml_nvalues != ml->sml_values ) {
1079                                                         AC_MEMCPY( &ml->sml_nvalues[ i ], &ml->sml_nvalues[ i + 1 ],
1080                                                                 sizeof( struct berval ) * ( j - i ) );
1081                                                 }
1082                                                 i--;
1083                                         }
1084
1085                                         continue;
1086                                 }
1087
1088                                 /* access is checked with the original identity */
1089                                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
1090                                 rc = access_allowed( op, e, mo->mo_ad_member,
1091                                                 &op->o_req_ndn,
1092                                                 ACL_WDEL, NULL );
1093                                 be_entry_release_r( op, e );
1094                                 op->o_bd->bd_info = (BackendInfo *)on;
1095
1096                                 if ( !rc ) {
1097                                         rc = rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
1098                                         rs->sr_text = "insufficient access to object referenced by memberof";
1099                                         send_ldap_result( op, rs );
1100                                         goto done;
1101                                 }
1102                         }
1103
1104                         if ( BER_BVISNULL( &ml->sml_nvalues[ 0 ] ) ) {
1105                                 *mmlp = ml->sml_next;
1106                                 slap_mod_free( &ml->sml_mod, 0 );
1107                                 free( ml );
1108                         }
1109
1110                         } break;
1111
1112                 default:
1113                         assert( 0 );
1114                 }
1115
1116 done2:;
1117                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
1118                 be_entry_release_r( op, target );
1119                 op->o_bd->bd_info = (BackendInfo *)on;
1120         }
1121
1122         rc = SLAP_CB_CONTINUE;
1123
1124 done:;
1125         op->o_dn = save_dn;
1126         op->o_ndn = save_ndn;
1127         op->o_bd->bd_info = (BackendInfo *)on;
1128
1129         return rc;
1130 }
1131
1132 /*
1133  * response callback that adds memberof values when a group is added.
1134  */
1135 static int
1136 memberof_res_add( Operation *op, SlapReply *rs )
1137 {
1138         slap_overinst   *on = (slap_overinst *)op->o_bd->bd_info;
1139         memberof_t      *mo = (memberof_t *)on->on_bi.bi_private;
1140
1141         int             i;
1142
1143         if ( MEMBEROF_REVERSE( mo ) ) {
1144                 Attribute       *ma;
1145
1146                 ma = attr_find( op->ora_e->e_attrs, mo->mo_ad_memberof );
1147                 if ( ma != NULL ) {
1148                         Operation       op2 = *op;
1149                         SlapReply       rs2 = { 0 };
1150
1151                         /* relax is required to allow to add
1152                          * a non-existing member */
1153                         op2.o_relax = SLAP_CONTROL_CRITICAL;
1154
1155                         for ( i = 0; !BER_BVISNULL( &ma->a_nvals[ i ] ); i++ ) {
1156
1157                                 /* the modification is attempted
1158                                  * with the original identity */
1159                                 (void)memberof_value_modify( &op2, &rs2,
1160                                         &ma->a_nvals[ i ], mo->mo_ad_member,
1161                                         NULL, NULL, &op->o_req_dn, &op->o_req_ndn );
1162                         }
1163                 }
1164         }
1165
1166         if ( is_entry_objectclass_or_sub( op->ora_e, mo->mo_oc_group ) ) {
1167                 Attribute       *a;
1168
1169                 for ( a = attrs_find( op->ora_e->e_attrs, mo->mo_ad_member );
1170                                 a != NULL;
1171                                 a = attrs_find( a->a_next, mo->mo_ad_member ) )
1172                 {
1173                         for ( i = 0; !BER_BVISNULL( &a->a_nvals[ i ] ); i++ ) {
1174                                 (void)memberof_value_modify( op, rs,
1175                                                 &a->a_nvals[ i ],
1176                                                 mo->mo_ad_memberof,
1177                                                 NULL, NULL,
1178                                                 &op->o_req_dn,
1179                                                 &op->o_req_ndn );
1180                         }
1181                 }
1182         }
1183
1184         return SLAP_CB_CONTINUE;
1185 }
1186
1187 /*
1188  * response callback that deletes memberof values when a group is deleted.
1189  */
1190 static int
1191 memberof_res_delete( Operation *op, SlapReply *rs )
1192 {
1193         slap_overinst   *on = (slap_overinst *)op->o_bd->bd_info;
1194         memberof_t      *mo = (memberof_t *)on->on_bi.bi_private;
1195
1196         BerVarray       vals;
1197         int             i;
1198
1199         vals = memberof_saved_member_get( op, &saved_member_vals );
1200         if ( vals != NULL ) {
1201                 for ( i = 0; !BER_BVISNULL( &vals[ i ] ); i++ ) {
1202                         (void)memberof_value_modify( op, rs,
1203                                         &vals[ i ], mo->mo_ad_memberof,
1204                                         &op->o_req_dn, &op->o_req_ndn,
1205                                         NULL, NULL );
1206                 }
1207
1208                 ber_bvarray_free( vals );
1209         }
1210
1211         if ( MEMBEROF_REFINT( mo ) ) {
1212                 vals = memberof_saved_member_get( op, &saved_memberof_vals );
1213                 if ( vals != NULL ) {
1214                         for ( i = 0; !BER_BVISNULL( &vals[ i ] ); i++ ) {
1215                                 (void)memberof_value_modify( op, rs,
1216                                                 &vals[ i ], mo->mo_ad_member,
1217                                                 &op->o_req_dn, &op->o_req_ndn,
1218                                                 NULL, NULL );
1219                         }
1220
1221                         ber_bvarray_free( vals );
1222                 }
1223         }
1224
1225         return SLAP_CB_CONTINUE;
1226 }
1227
1228 /*
1229  * response callback that adds/deletes memberof values when a group
1230  * is modified.
1231  */
1232 static int
1233 memberof_res_modify( Operation *op, SlapReply *rs )
1234 {
1235         slap_overinst   *on = (slap_overinst *)op->o_bd->bd_info;
1236         memberof_t      *mo = (memberof_t *)on->on_bi.bi_private;
1237
1238         int             i, rc;
1239         Modifications   *ml, *mml = NULL;
1240         BerVarray       vals;
1241         memberof_is_t   iswhat = MEMBEROF_IS_GROUP;
1242
1243         if ( MEMBEROF_REVERSE( mo ) ) {
1244                 for ( ml = op->orm_modlist; ml; ml = ml->sml_next ) {
1245                         if ( ml->sml_desc == mo->mo_ad_memberof ) {
1246                                 mml = ml;
1247                                 break;
1248                         }
1249                 }
1250         }
1251
1252         if ( mml != NULL ) {
1253                 BerVarray       vals = mml->sml_nvalues;
1254
1255                 switch ( mml->sml_op ) {
1256                 case LDAP_MOD_DELETE:
1257                         if ( vals != NULL ) {
1258                                 for ( i = 0; !BER_BVISNULL( &vals[ i ] ); i++ ) {
1259                                         memberof_value_modify( op, rs,
1260                                                         &vals[ i ], mo->mo_ad_member,
1261                                                         &op->o_req_dn, &op->o_req_ndn,
1262                                                         NULL, NULL );
1263                                 }
1264                                 break;
1265                         }
1266                         /* fall thru */
1267
1268                 case LDAP_MOD_REPLACE:
1269                         /* delete all ... */
1270                         op->o_bd->bd_info = (BackendInfo *)on->on_info;
1271                         rc = backend_attribute( op, NULL, &op->o_req_ndn,
1272                                         mo->mo_ad_memberof, &vals, ACL_READ );
1273                         op->o_bd->bd_info = (BackendInfo *)on;
1274                         if ( rc == LDAP_SUCCESS ) {
1275                                 for ( i = 0; !BER_BVISNULL( &vals[ i ] ); i++ ) {
1276                                         (void)memberof_value_modify( op, rs,
1277                                                         &vals[ i ], mo->mo_ad_member,
1278                                                         &op->o_req_dn, &op->o_req_ndn,
1279                                                         NULL, NULL );
1280                                 }
1281                                 ber_bvarray_free_x( vals, op->o_tmpmemctx );
1282                         }
1283
1284                         if ( ml->sml_op == LDAP_MOD_DELETE ) {
1285                                 break;
1286                         }
1287                         /* fall thru */
1288
1289                 case LDAP_MOD_ADD:
1290                         assert( vals != NULL );
1291
1292                         for ( i = 0; !BER_BVISNULL( &vals[ i ] ); i++ ) {
1293                                 memberof_value_modify( op, rs,
1294                                                 &vals[ i ], mo->mo_ad_member,
1295                                                 NULL, NULL,
1296                                                 &op->o_req_dn, &op->o_req_ndn );
1297                         }
1298                         break;
1299
1300                 default:
1301                         assert( 0 );
1302                 }
1303         }
1304
1305         if ( memberof_isGroupOrMember( op, &iswhat ) == LDAP_SUCCESS
1306                         && ( iswhat & MEMBEROF_IS_GROUP ) )
1307         {
1308                 for ( ml = op->orm_modlist; ml; ml = ml->sml_next ) {
1309                         if ( ml->sml_desc != mo->mo_ad_member ) {
1310                                 continue;
1311                         }
1312
1313                         switch ( ml->sml_op ) {
1314                         case LDAP_MOD_DELETE:
1315                                 vals = ml->sml_nvalues;
1316                                 if ( vals != NULL ) {
1317                                         for ( i = 0; !BER_BVISNULL( &vals[ i ] ); i++ ) {
1318                                                 memberof_value_modify( op, rs,
1319                                                                 &vals[ i ], mo->mo_ad_memberof,
1320                                                                 &op->o_req_dn, &op->o_req_ndn,
1321                                                                 NULL, NULL );
1322                                         }
1323                                         break;
1324                                 }
1325                                 /* fall thru */
1326
1327                         case LDAP_MOD_REPLACE:
1328                                 vals = memberof_saved_member_get( op, &saved_member_vals );
1329
1330                                 /* delete all ... */
1331                                 if ( vals != NULL ) {
1332                                         for ( i = 0; !BER_BVISNULL( &vals[ i ] ); i++ ) {
1333                                                 (void)memberof_value_modify( op, rs,
1334                                                                 &vals[ i ], mo->mo_ad_memberof,
1335                                                                 &op->o_req_dn, &op->o_req_ndn,
1336                                                                 NULL, NULL );
1337                                         }
1338                                         ber_bvarray_free_x( vals, op->o_tmpmemctx );
1339                                 }
1340
1341                                 if ( ml->sml_op == LDAP_MOD_DELETE ) {
1342                                         break;
1343                                 }
1344                                 /* fall thru */
1345
1346                         case LDAP_MOD_ADD:
1347                                 assert( ml->sml_nvalues != NULL );
1348                                 vals = ml->sml_nvalues;
1349                                 for ( i = 0; !BER_BVISNULL( &vals[ i ] ); i++ ) {
1350                                         memberof_value_modify( op, rs,
1351                                                         &vals[ i ], mo->mo_ad_memberof,
1352                                                         NULL, NULL,
1353                                                         &op->o_req_dn, &op->o_req_ndn );
1354                                 }
1355                                 break;
1356
1357                         default:
1358                                 assert( 0 );
1359                         }
1360                 }
1361         }
1362
1363         return SLAP_CB_CONTINUE;
1364 }
1365
1366 /*
1367  * response callback that adds/deletes member values when a group member
1368  * is modified.
1369  */
1370 static int
1371 memberof_res_rename( Operation *op, SlapReply *rs )
1372 {
1373         slap_overinst   *on = (slap_overinst *)op->o_bd->bd_info;
1374         memberof_t      *mo = (memberof_t *)on->on_bi.bi_private;
1375
1376         struct berval   newPDN, newDN = BER_BVNULL, newPNDN, newNDN;
1377         int             i, rc;
1378         BerVarray       vals;
1379
1380         struct berval   save_dn, save_ndn;
1381         memberof_is_t   iswhat = MEMBEROF_IS_GROUP;
1382
1383         if ( MEMBEROF_REFINT( mo ) ) {
1384                 iswhat |= MEMBEROF_IS_MEMBER;
1385         }
1386
1387         if ( op->orr_nnewSup ) {
1388                 newPNDN = *op->orr_nnewSup;
1389
1390         } else {
1391                 dnParent( &op->o_req_ndn, &newPNDN );
1392         }
1393
1394         build_new_dn( &newNDN, &newPNDN, &op->orr_nnewrdn, op->o_tmpmemctx );
1395
1396         save_dn = op->o_req_dn;
1397         save_ndn = op->o_req_ndn;
1398
1399         op->o_req_dn = newNDN;
1400         op->o_req_ndn = newNDN;
1401         rc = memberof_isGroupOrMember( op, &iswhat );
1402         op->o_req_dn = save_dn;
1403         op->o_req_ndn = save_ndn;
1404
1405         if ( rc != LDAP_SUCCESS || iswhat == MEMBEROF_IS_NONE ) {
1406                 goto done;
1407         }
1408
1409         if ( op->orr_newSup ) {
1410                 newPDN = *op->orr_newSup;
1411
1412         } else {
1413                 dnParent( &op->o_req_dn, &newPDN );
1414         }
1415
1416         build_new_dn( &newDN, &newPDN, &op->orr_newrdn, op->o_tmpmemctx );
1417
1418         if ( iswhat & MEMBEROF_IS_GROUP ) {
1419                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
1420                 rc = backend_attribute( op, NULL, &newNDN,
1421                                 mo->mo_ad_member, &vals, ACL_READ );
1422                 op->o_bd->bd_info = (BackendInfo *)on;
1423
1424                 if ( rc == LDAP_SUCCESS ) {
1425                         for ( i = 0; !BER_BVISNULL( &vals[ i ] ); i++ ) {
1426                                 (void)memberof_value_modify( op, rs,
1427                                                 &vals[ i ], mo->mo_ad_memberof,
1428                                                 &op->o_req_dn, &op->o_req_ndn,
1429                                                 &newDN, &newNDN );
1430                         }
1431                         ber_bvarray_free_x( vals, op->o_tmpmemctx );
1432                 }
1433         }
1434
1435         if ( MEMBEROF_REFINT( mo ) && ( iswhat & MEMBEROF_IS_MEMBER ) ) {
1436                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
1437                 rc = backend_attribute( op, NULL, &newNDN,
1438                                 mo->mo_ad_memberof, &vals, ACL_READ );
1439                 op->o_bd->bd_info = (BackendInfo *)on;
1440
1441                 if ( rc == LDAP_SUCCESS ) {
1442                         for ( i = 0; !BER_BVISNULL( &vals[ i ] ); i++ ) {
1443                                 (void)memberof_value_modify( op, rs,
1444                                                 &vals[ i ], mo->mo_ad_member,
1445                                                 &op->o_req_dn, &op->o_req_ndn,
1446                                                 &newDN, &newNDN );
1447                         }
1448                         ber_bvarray_free_x( vals, op->o_tmpmemctx );
1449                 }
1450         }
1451
1452 done:;
1453         if ( !BER_BVISNULL( &newDN ) ) {
1454                 op->o_tmpfree( newDN.bv_val, op->o_tmpmemctx );
1455         }
1456         op->o_tmpfree( newNDN.bv_val, op->o_tmpmemctx );
1457
1458         return SLAP_CB_CONTINUE;
1459 }
1460
1461 static int
1462 memberof_response( Operation *op, SlapReply *rs )
1463 {
1464         if ( rs->sr_err != LDAP_SUCCESS ) {
1465                 return SLAP_CB_CONTINUE;
1466         }
1467
1468         switch ( op->o_tag ) {
1469         case LDAP_REQ_ADD:
1470                 return memberof_res_add( op, rs );
1471
1472         case LDAP_REQ_DELETE:
1473                 return memberof_res_delete( op, rs );
1474
1475         case LDAP_REQ_MODIFY:
1476                 return memberof_res_modify( op, rs );
1477
1478         case LDAP_REQ_MODDN:
1479                 return memberof_res_rename( op, rs );
1480
1481         default:
1482                 return SLAP_CB_CONTINUE;
1483         }
1484 }
1485
1486 static int
1487 memberof_db_init(
1488         BackendDB       *be,
1489         ConfigReply     *cr )
1490 {
1491         slap_overinst   *on = (slap_overinst *)be->bd_info;
1492         memberof_t      tmp_mo = { 0 }, *mo;
1493
1494         mo = (memberof_t *)ch_calloc( 1, sizeof( memberof_t ) );
1495
1496         /* safe default */
1497         mo->mo_dangling_err = LDAP_CONSTRAINT_VIOLATION;
1498
1499         on->on_bi.bi_private = (void *)mo;
1500
1501         return 0;
1502 }
1503
1504 enum {
1505         MO_DN = 1,
1506         MO_DANGLING,
1507         MO_REFINT,
1508         MO_GROUP_OC,
1509         MO_MEMBER_AD,
1510         MO_MEMBER_OF_AD,
1511 #if 0
1512         MO_REVERSE,
1513 #endif
1514
1515         MO_DANGLING_ERROR,
1516
1517         MO_LAST
1518 };
1519
1520 static ConfigDriver mo_cf_gen;
1521
1522 #define OID             "1.3.6.1.4.1.7136.2.666.4"
1523 #define OIDAT           OID ".1.1"
1524 #define OIDCFGAT        OID ".1.2"
1525 #define OIDOC           OID ".2.1"
1526 #define OIDCFGOC        OID ".2.2"
1527
1528
1529 static ConfigTable mo_cfg[] = {
1530         { "memberof-dn", "modifiersName",
1531                 2, 2, 0, ARG_MAGIC|ARG_DN|MO_DN, mo_cf_gen,
1532                 "( OLcfgOvAt:18.0 NAME 'olcMemberOfDN' "
1533                         "DESC 'DN to be used as modifiersName' "
1534                         "SYNTAX OMsDN SINGLE-VALUE )",
1535                 NULL, NULL },
1536
1537         { "memberof-dangling", "ignore|drop|error",
1538                 2, 2, 0, ARG_MAGIC|MO_DANGLING, mo_cf_gen,
1539                 "( OLcfgOvAt:18.1 NAME 'olcMemberOfDangling' "
1540                         "DESC 'Behavior with respect to dangling members, "
1541                                 "constrained to ignore, drop, error' "
1542                         "SYNTAX OMsDirectoryString SINGLE-VALUE )",
1543                 NULL, NULL },
1544
1545         { "memberof-refint", "true|FALSE",
1546                 2, 2, 0, ARG_MAGIC|ARG_ON_OFF|MO_REFINT, mo_cf_gen,
1547                 "( OLcfgOvAt:18.2 NAME 'olcMemberOfRefInt' "
1548                         "DESC 'Take care of referential integrity' "
1549                         "SYNTAX OMsBoolean SINGLE-VALUE )",
1550                 NULL, NULL },
1551
1552         { "memberof-group-oc", "objectClass",
1553                 2, 2, 0, ARG_MAGIC|MO_GROUP_OC, mo_cf_gen,
1554                 "( OLcfgOvAt:18.3 NAME 'olcMemberOfGroupOC' "
1555                         "DESC 'Group objectClass' "
1556                         "SYNTAX OMsDirectoryString SINGLE-VALUE )",
1557                 NULL, NULL },
1558
1559         { "memberof-member-ad", "member attribute",
1560                 2, 2, 0, ARG_MAGIC|MO_MEMBER_AD, mo_cf_gen,
1561                 "( OLcfgOvAt:18.4 NAME 'olcMemberOfMemberAD' "
1562                         "DESC 'member attribute' "
1563                         "SYNTAX OMsDirectoryString SINGLE-VALUE )",
1564                 NULL, NULL },
1565
1566         { "memberof-memberof-ad", "memberOf attribute",
1567                 2, 2, 0, ARG_MAGIC|MO_MEMBER_OF_AD, mo_cf_gen,
1568                 "( OLcfgOvAt:18.5 NAME 'olcMemberOfMemberOfAD' "
1569                         "DESC 'memberOf attribute' "
1570                         "SYNTAX OMsDirectoryString SINGLE-VALUE )",
1571                 NULL, NULL },
1572
1573 #if 0
1574         { "memberof-reverse", "true|FALSE",
1575                 2, 2, 0, ARG_MAGIC|ARG_ON_OFF|MO_REVERSE, mo_cf_gen,
1576                 "( OLcfgOvAt:18.6 NAME 'olcMemberOfReverse' "
1577                         "DESC 'Take care of referential integrity "
1578                                 "also when directly modifying memberOf' "
1579                         "SYNTAX OMsBoolean SINGLE-VALUE )",
1580                 NULL, NULL },
1581 #endif
1582
1583         { "memberof-dangling-error", "error code",
1584                 2, 2, 0, ARG_MAGIC|MO_DANGLING_ERROR, mo_cf_gen,
1585                 "( OLcfgOvAt:18.7 NAME 'olcMemberOfDanglingError' "
1586                         "DESC 'Error code returned in case of dangling back reference' "
1587                         "SYNTAX OMsDirectoryString SINGLE-VALUE )",
1588                 NULL, NULL },
1589
1590         { NULL, NULL, 0, 0, 0, ARG_IGNORED }
1591 };
1592
1593 static ConfigOCs mo_ocs[] = {
1594         { "( OLcfgOvOc:18.1 "
1595                 "NAME 'olcMemberOf' "
1596                 "DESC 'Member-of configuration' "
1597                 "SUP olcOverlayConfig "
1598                 "MAY ( "
1599                         "olcMemberOfDN "
1600                         "$ olcMemberOfDangling "
1601                         "$ olcMemberOfDanglingError"
1602                         "$ olcMemberOfRefInt "
1603                         "$ olcMemberOfGroupOC "
1604                         "$ olcMemberOfMemberAD "
1605                         "$ olcMemberOfMemberOfAD "
1606 #if 0
1607                         "$ olcMemberOfReverse "
1608 #endif
1609                         ") "
1610                 ")",
1611                 Cft_Overlay, mo_cfg, NULL, NULL },
1612         { NULL, 0, NULL }
1613 };
1614
1615 static slap_verbmasks dangling_mode[] = {
1616         { BER_BVC( "ignore" ),          MEMBEROF_NONE },
1617         { BER_BVC( "drop" ),            MEMBEROF_FDANGLING_DROP },
1618         { BER_BVC( "error" ),           MEMBEROF_FDANGLING_ERROR },
1619         { BER_BVNULL,                   0 }
1620 };
1621
1622 static int
1623 memberof_make_group_filter( memberof_t *mo )
1624 {
1625         char            *ptr;
1626
1627         if ( !BER_BVISNULL( &mo->mo_groupFilterstr ) ) {
1628                 ch_free( mo->mo_groupFilterstr.bv_val );
1629         }
1630
1631         mo->mo_groupFilter.f_choice = LDAP_FILTER_EQUALITY;
1632         mo->mo_groupFilter.f_ava = &mo->mo_groupAVA;
1633
1634         mo->mo_groupFilter.f_av_desc = slap_schema.si_ad_objectClass;
1635         mo->mo_groupFilter.f_av_value = mo->mo_oc_group->soc_cname;
1636
1637         mo->mo_groupFilterstr.bv_len = STRLENOF( "(=)" )
1638                 + slap_schema.si_ad_objectClass->ad_cname.bv_len
1639                 + mo->mo_oc_group->soc_cname.bv_len;
1640         ptr = mo->mo_groupFilterstr.bv_val = ch_malloc( mo->mo_groupFilterstr.bv_len + 1 );
1641         *ptr++ = '(';
1642         ptr = lutil_strcopy( ptr, slap_schema.si_ad_objectClass->ad_cname.bv_val );
1643         *ptr++ = '=';
1644         ptr = lutil_strcopy( ptr, mo->mo_oc_group->soc_cname.bv_val );
1645         *ptr++ = ')';
1646         *ptr = '\0';
1647
1648         return 0;
1649 }
1650
1651 static int
1652 memberof_make_member_filter( memberof_t *mo )
1653 {
1654         char            *ptr;
1655
1656         if ( !BER_BVISNULL( &mo->mo_memberFilterstr ) ) {
1657                 ch_free( mo->mo_memberFilterstr.bv_val );
1658         }
1659
1660         mo->mo_memberFilter.f_choice = LDAP_FILTER_PRESENT;
1661         mo->mo_memberFilter.f_desc = mo->mo_ad_memberof;
1662
1663         mo->mo_memberFilterstr.bv_len = STRLENOF( "(=*)" )
1664                 + mo->mo_ad_memberof->ad_cname.bv_len;
1665         ptr = mo->mo_memberFilterstr.bv_val = ch_malloc( mo->mo_memberFilterstr.bv_len + 1 );
1666         *ptr++ = '(';
1667         ptr = lutil_strcopy( ptr, mo->mo_ad_memberof->ad_cname.bv_val );
1668         ptr = lutil_strcopy( ptr, "=*)" );
1669
1670         return 0;
1671 }
1672
1673 static int
1674 mo_cf_gen( ConfigArgs *c )
1675 {
1676         slap_overinst   *on = (slap_overinst *)c->bi;
1677         memberof_t      *mo = (memberof_t *)on->on_bi.bi_private;
1678
1679         int             i, rc = 0;
1680
1681         if ( c->op == SLAP_CONFIG_EMIT ) {
1682                 struct berval bv = BER_BVNULL;
1683
1684                 switch( c->type ) {
1685                 case MO_DN:
1686                         if ( mo->mo_dn.bv_val != NULL) {
1687                                 value_add_one( &c->rvalue_vals, &mo->mo_dn );
1688                                 value_add_one( &c->rvalue_nvals, &mo->mo_ndn );
1689                         }
1690                         break;
1691
1692                 case MO_DANGLING:
1693                         enum_to_verb( dangling_mode, (mo->mo_flags & MEMBEROF_FDANGLING_MASK), &bv );
1694                         if ( BER_BVISNULL( &bv ) ) {
1695                                 /* there's something wrong... */
1696                                 assert( 0 );
1697                                 rc = 1;
1698
1699                         } else {
1700                                 value_add_one( &c->rvalue_vals, &bv );
1701                         }
1702                         break;
1703
1704                 case MO_DANGLING_ERROR:
1705                         if ( mo->mo_flags & MEMBEROF_FDANGLING_ERROR ) {
1706                                 char buf[ SLAP_TEXT_BUFLEN ];
1707                                 enum_to_verb( slap_ldap_response_code, mo->mo_dangling_err, &bv );
1708                                 if ( BER_BVISNULL( &bv ) ) {
1709                                         bv.bv_len = snprintf( buf, sizeof( buf ), "0x%x", mo->mo_dangling_err );
1710                                         if ( bv.bv_len < sizeof( buf ) ) {
1711                                                 bv.bv_val = buf;
1712                                         } else {
1713                                                 rc = 1;
1714                                                 break;
1715                                         }
1716                                 }
1717                                 value_add_one( &c->rvalue_vals, &bv );
1718                         } else {
1719                                 rc = 1;
1720                         }
1721                         break;
1722
1723                 case MO_REFINT:
1724                         c->value_int = MEMBEROF_REFINT( mo );
1725                         break;
1726
1727 #if 0
1728                 case MO_REVERSE:
1729                         c->value_int = MEMBEROF_REVERSE( mo );
1730                         break;
1731 #endif
1732
1733                 case MO_GROUP_OC:
1734                         if ( mo->mo_oc_group != NULL ){
1735                                 value_add_one( &c->rvalue_vals, &mo->mo_oc_group->soc_cname );
1736                         }
1737                         break;
1738
1739                 case MO_MEMBER_AD:
1740                         if ( mo->mo_ad_member != NULL ){
1741                                 value_add_one( &c->rvalue_vals, &mo->mo_ad_member->ad_cname );
1742                         }
1743                         break;
1744
1745                 case MO_MEMBER_OF_AD:
1746                         if ( mo->mo_ad_memberof != NULL ){
1747                                 value_add_one( &c->rvalue_vals, &mo->mo_ad_memberof->ad_cname );
1748                         }
1749                         break;
1750
1751                 default:
1752                         assert( 0 );
1753                         return 1;
1754                 }
1755
1756                 return rc;
1757
1758         } else if ( c->op == LDAP_MOD_DELETE ) {
1759                 return 1;       /* FIXME */
1760
1761         } else {
1762                 switch( c->type ) {
1763                 case MO_DN:
1764                         if ( !BER_BVISNULL( &mo->mo_dn ) ) {
1765                                 ber_memfree( mo->mo_dn.bv_val );
1766                                 ber_memfree( mo->mo_ndn.bv_val );
1767                         }
1768                         mo->mo_dn = c->value_dn;
1769                         mo->mo_ndn = c->value_ndn;
1770                         break;
1771
1772                 case MO_DANGLING:
1773                         i = verb_to_mask( c->argv[ 1 ], dangling_mode );
1774                         if ( BER_BVISNULL( &dangling_mode[ i ].word ) ) {
1775                                 return 1;
1776                         }
1777
1778                         mo->mo_flags &= ~MEMBEROF_FDANGLING_MASK;
1779                         mo->mo_flags |= dangling_mode[ i ].mask;
1780                         break;
1781
1782                 case MO_DANGLING_ERROR:
1783                         i = verb_to_mask( c->argv[ 1 ], slap_ldap_response_code );
1784                         if ( !BER_BVISNULL( &slap_ldap_response_code[ i ].word ) ) {
1785                                 mo->mo_dangling_err = slap_ldap_response_code[ i ].mask;
1786                         } else if ( lutil_atoix( &mo->mo_dangling_err, c->argv[ 1 ], 0 ) ) {
1787                                 return 1;
1788                         }
1789                         break;
1790
1791                 case MO_REFINT:
1792                         if ( c->value_int ) {
1793                                 mo->mo_flags |= MEMBEROF_FREFINT;
1794
1795                         } else {
1796                                 mo->mo_flags &= ~MEMBEROF_FREFINT;
1797                         }
1798                         break;
1799
1800 #if 0
1801                 case MO_REVERSE:
1802                         if ( c->value_int ) {
1803                                 mo->mo_flags |= MEMBEROF_FREVERSE;
1804
1805                         } else {
1806                                 mo->mo_flags &= ~MEMBEROF_FREVERSE;
1807                         }
1808                         break;
1809 #endif
1810
1811                 case MO_GROUP_OC: {
1812                         ObjectClass     *oc = NULL;
1813
1814                         oc = oc_find( c->argv[ 1 ] );
1815                         if ( oc == NULL ) {
1816                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1817                                         "unable to find group objectClass=\"%s\"",
1818                                         c->argv[ 1 ] );
1819                                 Debug( LDAP_DEBUG_CONFIG, "%s: %s.\n",
1820                                         c->log, c->cr_msg, 0 );
1821                                 return 1;
1822                         }
1823
1824                         mo->mo_oc_group = oc;
1825                         memberof_make_group_filter( mo );
1826                         } break;
1827
1828                 case MO_MEMBER_AD: {
1829                         AttributeDescription    *ad = NULL;
1830                         const char              *text = NULL;
1831
1832
1833                         rc = slap_str2ad( c->argv[ 1 ], &ad, &text );
1834                         if ( rc != LDAP_SUCCESS ) {
1835                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1836                                         "unable to find member attribute=\"%s\": %s (%d)",
1837                                         c->argv[ 1 ], text, rc );
1838                                 Debug( LDAP_DEBUG_CONFIG, "%s: %s.\n",
1839                                         c->log, c->cr_msg, 0 );
1840                                 return 1;
1841                         }
1842
1843                         if ( !is_at_syntax( ad->ad_type, SLAPD_DN_SYNTAX )              /* e.g. "member" */
1844                                 && !is_at_syntax( ad->ad_type, SLAPD_NAMEUID_SYNTAX ) ) /* e.g. "uniqueMember" */
1845                         {
1846                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1847                                         "member attribute=\"%s\" must either "
1848                                         "have DN (%s) or nameUID (%s) syntax",
1849                                         c->argv[ 1 ], SLAPD_DN_SYNTAX, SLAPD_NAMEUID_SYNTAX );
1850                                 Debug( LDAP_DEBUG_CONFIG, "%s: %s.\n",
1851                                         c->log, c->cr_msg, 0 );
1852                                 return 1;
1853                         }
1854
1855                         mo->mo_ad_member = ad;
1856                         } break;
1857
1858                 case MO_MEMBER_OF_AD: {
1859                         AttributeDescription    *ad = NULL;
1860                         const char              *text = NULL;
1861
1862
1863                         rc = slap_str2ad( c->argv[ 1 ], &ad, &text );
1864                         if ( rc != LDAP_SUCCESS ) {
1865                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1866                                         "unable to find memberof attribute=\"%s\": %s (%d)",
1867                                         c->argv[ 1 ], text, rc );
1868                                 Debug( LDAP_DEBUG_CONFIG, "%s: %s.\n",
1869                                         c->log, c->cr_msg, 0 );
1870                                 return 1;
1871                         }
1872
1873                         if ( !is_at_syntax( ad->ad_type, SLAPD_DN_SYNTAX )              /* e.g. "member" */
1874                                 && !is_at_syntax( ad->ad_type, SLAPD_NAMEUID_SYNTAX ) ) /* e.g. "uniqueMember" */
1875                         {
1876                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1877                                         "memberof attribute=\"%s\" must either "
1878                                         "have DN (%s) or nameUID (%s) syntax",
1879                                         c->argv[ 1 ], SLAPD_DN_SYNTAX, SLAPD_NAMEUID_SYNTAX );
1880                                 Debug( LDAP_DEBUG_CONFIG, "%s: %s.\n",
1881                                         c->log, c->cr_msg, 0 );
1882                                 return 1;
1883                         }
1884
1885                         mo->mo_ad_memberof = ad;
1886                         memberof_make_member_filter( mo );
1887                         } break;
1888
1889                 default:
1890                         assert( 0 );
1891                         return 1;
1892                 }
1893         }
1894
1895         return 0;
1896 }
1897
1898 static int
1899 memberof_db_open(
1900         BackendDB       *be,
1901         ConfigReply     *cr )
1902 {
1903         slap_overinst   *on = (slap_overinst *)be->bd_info;
1904         memberof_t      *mo = (memberof_t *)on->on_bi.bi_private;
1905
1906         int             rc;
1907         const char      *text = NULL;
1908
1909         if( ! mo->mo_ad_memberof ){
1910                 rc = slap_str2ad( SLAPD_MEMBEROF_ATTR, &mo->mo_ad_memberof, &text );
1911                 if ( rc != LDAP_SUCCESS ) {
1912                         Debug( LDAP_DEBUG_ANY, "memberof_db_open: "
1913                                         "unable to find attribute=\"%s\": %s (%d)\n",
1914                                         SLAPD_MEMBEROF_ATTR, text, rc );
1915                         return rc;
1916                 }
1917         }
1918
1919         if( ! mo->mo_ad_member ){
1920                 rc = slap_str2ad( SLAPD_GROUP_ATTR, &mo->mo_ad_member, &text );
1921                 if ( rc != LDAP_SUCCESS ) {
1922                         Debug( LDAP_DEBUG_ANY, "memberof_db_open: "
1923                                         "unable to find attribute=\"%s\": %s (%d)\n",
1924                                         SLAPD_GROUP_ATTR, text, rc );
1925                         return rc;
1926                 }
1927         }
1928
1929         if( ! mo->mo_oc_group ){
1930                 mo->mo_oc_group = oc_find( SLAPD_GROUP_CLASS );
1931                 if ( mo->mo_oc_group == NULL ) {
1932                         Debug( LDAP_DEBUG_ANY,
1933                                         "memberof_db_open: "
1934                                         "unable to find objectClass=\"%s\"\n",
1935                                         SLAPD_GROUP_CLASS, 0, 0 );
1936                         return 1;
1937                 }
1938         }
1939
1940         if ( BER_BVISNULL( &mo->mo_dn ) ) {
1941                 ber_dupbv( &mo->mo_dn, &be->be_rootdn );
1942                 ber_dupbv( &mo->mo_ndn, &be->be_rootndn );
1943         }
1944
1945         if ( BER_BVISNULL( &mo->mo_groupFilterstr ) ) {
1946                 memberof_make_group_filter( mo );
1947         }
1948
1949         if ( BER_BVISNULL( &mo->mo_memberFilterstr ) ) {
1950                 memberof_make_member_filter( mo );
1951         }
1952
1953         return 0;
1954 }
1955
1956 static int
1957 memberof_db_destroy(
1958         BackendDB       *be,
1959         ConfigReply     *cr )
1960 {
1961         slap_overinst   *on = (slap_overinst *)be->bd_info;
1962         memberof_t      *mo = (memberof_t *)on->on_bi.bi_private;
1963
1964         if ( mo ) {
1965                 if ( !BER_BVISNULL( &mo->mo_dn ) ) {
1966                         ber_memfree( mo->mo_dn.bv_val );
1967                         ber_memfree( mo->mo_ndn.bv_val );
1968                 }
1969
1970                 if ( !BER_BVISNULL( &mo->mo_groupFilterstr ) ) {
1971                         ber_memfree( mo->mo_groupFilterstr.bv_val );
1972                 }
1973
1974                 if ( !BER_BVISNULL( &mo->mo_memberFilterstr ) ) {
1975                         ber_memfree( mo->mo_memberFilterstr.bv_val );
1976                 }
1977
1978                 ber_memfree( mo );
1979         }
1980
1981         return 0;
1982 }
1983
1984 /* unused */
1985 static AttributeDescription     *ad_memberOf;
1986
1987 static struct {
1988         char    *desc;
1989         AttributeDescription **adp;
1990 } as[] = {
1991         { "( 1.2.840.113556.1.2.102 "
1992                 "NAME 'memberOf' "
1993                 "DESC 'Group that the entry belongs to' "
1994                 "SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' "
1995                 "EQUALITY distinguishedNameMatch "      /* added */
1996                 "USAGE dSAOperation "                   /* added; questioned */
1997                 /* "NO-USER-MODIFICATION " */           /* add? */
1998                 "X-ORIGIN 'iPlanet Delegated Administrator' )",
1999                 &ad_memberOf },
2000         { NULL }
2001 };
2002
2003 #if SLAPD_OVER_MEMBEROF == SLAPD_MOD_DYNAMIC
2004 static
2005 #endif /* SLAPD_OVER_MEMBEROF == SLAPD_MOD_DYNAMIC */
2006 int
2007 memberof_initialize( void )
2008 {
2009         int                     code, i;
2010
2011         for ( i = 0; as[ i ].desc != NULL; i++ ) {
2012                 code = register_at( as[ i ].desc, as[ i ].adp, 0 );
2013                 if ( code ) {
2014                         Debug( LDAP_DEBUG_ANY,
2015                                 "memberof_initialize: register_at #%d failed\n",
2016                                 i, 0, 0 );
2017                         return code;
2018                 }
2019         }
2020
2021         memberof.on_bi.bi_type = "memberof";
2022
2023         memberof.on_bi.bi_db_init = memberof_db_init;
2024         memberof.on_bi.bi_db_open = memberof_db_open;
2025         memberof.on_bi.bi_db_destroy = memberof_db_destroy;
2026
2027         memberof.on_bi.bi_op_add = memberof_op_add;
2028         memberof.on_bi.bi_op_delete = memberof_op_delete;
2029         memberof.on_bi.bi_op_modify = memberof_op_modify;
2030
2031         memberof.on_response = memberof_response;
2032
2033         memberof.on_bi.bi_cf_ocs = mo_ocs;
2034
2035         code = config_register_schema( mo_cfg, mo_ocs );
2036         if ( code ) return code;
2037
2038         return overlay_register( &memberof );
2039 }
2040
2041 #if SLAPD_OVER_MEMBEROF == SLAPD_MOD_DYNAMIC
2042 int
2043 init_module( int argc, char *argv[] )
2044 {
2045         return memberof_initialize();
2046 }
2047 #endif /* SLAPD_OVER_MEMBEROF == SLAPD_MOD_DYNAMIC */
2048
2049 #endif /* SLAPD_OVER_MEMBEROF */