1 /* refint.c - referential integrity module */
3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
5 * Copyright 2004-2005 The OpenLDAP Foundation.
6 * Portions Copyright 2004 Symas Corporation.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted only as authorized by the OpenLDAP
13 * A copy of this license is available in the file LICENSE in the
14 * top-level directory of the distribution or, alternatively, at
15 * <http://www.OpenLDAP.org/license.html>.
18 * This work was initially developed by Symas Corp. for inclusion in
19 * OpenLDAP Software. This work was sponsored by Hewlett-Packard.
24 /* This module maintains referential integrity for a set of
25 * DN-valued attributes by searching for all references to a given
26 * DN whenever the DN is changed or its entry is deleted, and making
27 * the appropriate update.
29 * Updates are performed using the database rootdn, but the ModifiersName
30 * is always set to refint_dn.
33 #ifdef SLAPD_OVER_REFINT
37 #include <ac/string.h>
38 #include <ac/socket.h>
42 static slap_overinst refint;
44 /* The DN to use in the ModifiersName for all refint updates */
45 static BerValue refint_dn = BER_BVC("cn=Referential Integrity Overlay");
47 typedef struct refint_attrs_s {
48 struct refint_attrs_s *next;
49 AttributeDescription *attr;
52 typedef struct dependents_s {
53 struct dependents_s *next;
54 BerValue dn; /* target dn */
58 typedef struct refint_data_s {
59 const char *message; /* breadcrumbs */
60 struct refint_attrs_s *attrs; /* list of known attrs */
61 struct dependents_s *mods; /* modifications returned from callback */
62 BerValue dn; /* basedn in parent, searchdn in call */
63 BerValue newdn; /* replacement value for modrdn callback */
64 BerValue nnewdn; /* normalized replacement value */
65 BerValue nothing; /* the nothing value, if needed */
66 BerValue nnothing; /* normalized nothingness */
70 ** allocate new refint_data;
71 ** initialize, copy basedn;
72 ** store in on_bi.bi_private;
81 slap_overinst *on = (slap_overinst *)be->bd_info;
82 refint_data *id = ch_malloc(sizeof(refint_data));
84 id->message = "_init";
86 id->newdn.bv_val = NULL;
87 id->nothing.bv_val = NULL;
88 id->nnothing.bv_val = NULL;
89 ber_dupbv( &id->dn, &be->be_nsuffix[0] );
90 on->on_bi.bi_private = id;
96 ** if command = attributes:
98 ** convert to attribute;
99 ** add to configured attribute list;
100 ** elseif command = basedn:
101 ** set our basedn to argument;
114 slap_overinst *on = (slap_overinst *) be->bd_info;
115 refint_data *id = on->on_bi.bi_private;
118 AttributeDescription *ad;
122 if(!strcasecmp(*argv, "refint_attributes")) {
123 for(i = 1; i < argc; i++) {
124 for(ip = id->attrs; ip; ip = ip->next)
125 if(!strcmp(argv[i], ip->attr->ad_cname.bv_val)) {
126 Debug(LDAP_DEBUG_ANY,
127 "%s: line %d: duplicate attribute <s>, ignored\n",
128 fname, lineno, argv[i]);
132 if(slap_str2ad(argv[i], &ad, &text) != LDAP_SUCCESS) {
133 Debug(LDAP_DEBUG_ANY,
134 "%s: line %d: bad attribute <%s>, ignored\n",
135 fname, lineno, text);
137 } else if(ad->ad_next) {
138 Debug(LDAP_DEBUG_ANY,
139 "%s: line %d: multiple attributes match <%s>, ignored\n",
140 fname, lineno, argv[i]);
143 ip = ch_malloc(sizeof(refint_attrs));
145 ip->next = id->attrs;
147 Debug(LDAP_DEBUG_ANY, "%s: line %d: new attribute <%s>\n",
148 fname, lineno, argv[i]);
150 } else if(!strcasecmp(*argv, "refint_base")) {
151 /* XXX only one basedn (yet) - need validate argument! */
152 if(id->dn.bv_val) ch_free(id->dn.bv_val);
153 ber_str2bv( argv[1], 0, 0, &dn );
154 Debug(LDAP_DEBUG_ANY, "%s: line %d: new baseDN <%s>\n",
155 fname, lineno, argv[1]);
156 if(dnNormalize(0, NULL, NULL, &dn, &id->dn, NULL)) {
157 Debug(LDAP_DEBUG_ANY, "%s: line %d: bad baseDN!\n", fname, lineno, 0);
160 } else if(!strcasecmp(*argv, "refint_nothing")) {
161 if(id->nothing.bv_val) ch_free(id->nothing.bv_val);
162 if(id->nnothing.bv_val) ch_free(id->nnothing.bv_val);
163 ber_str2bv( argv[1], 0, 1, &id->nothing );
164 if(dnNormalize(0, NULL, NULL, &id->nothing, &id->nnothing, NULL)) {
165 Debug(LDAP_DEBUG_ANY, "%s: line %d: bad nothingDN!\n", fname, lineno, 0);
168 Debug(LDAP_DEBUG_ANY, "%s: line %d: new nothingDN<%s>\n",
169 fname, lineno, argv[1]);
171 return(SLAP_CONF_UNKNOWN);
174 id->message = "_config";
180 ** nothing really happens here;
189 slap_overinst *on = (slap_overinst *)be->bd_info;
190 refint_data *id = on->on_bi.bi_private;
191 id->message = "_open";
197 ** foreach configured attribute:
200 ** (do not) free id->message;
201 ** reset on_bi.bi_private;
202 ** free our config data;
211 slap_overinst *on = (slap_overinst *) be->bd_info;
212 refint_data *id = on->on_bi.bi_private;
213 refint_attrs *ii, *ij;
214 id->message = "_close";
216 for(ii = id->attrs; ii; ii = ij) {
221 ch_free(id->dn.bv_val);
222 ch_free(id->nothing.bv_val);
223 ch_free(id->nnothing.bv_val);
225 on->on_bi.bi_private = NULL; /* XXX */
234 ** generates a list of Modification* from search results
245 refint_data *id, *dd = op->o_callback->sc_private;
246 refint_attrs *ia, *da = dd->attrs;
247 dependent_data *ip, *dp = NULL;
248 Modifications *mp, *ma;
251 Debug(LDAP_DEBUG_TRACE, "refint_delete_cb <%s>\n",
252 rs->sr_entry ? rs->sr_entry->e_name.bv_val : "NOTHING", 0, 0);
254 if (rs->sr_type != REP_SEARCH || !rs->sr_entry) return(0);
255 dd->message = "_delete_cb";
258 ** foreach configured attribute type:
259 ** if this attr exists in the search result,
260 ** and it has a value matching the target:
261 ** allocate a Modification;
262 ** allocate its array of 2 BerValues;
263 ** if only one value, and we have a configured Nothing:
264 ** allocate additional Modification
266 ** BerValues[] = { Nothing, NULL };
269 ** BerValues[] = { our target dn, NULL };
270 ** add this mod to the list of mods;
274 ip = ch_malloc(sizeof(dependent_data));
275 ip->dn.bv_val = NULL;
279 for(ia = da; ia; ia = ia->next) {
280 if ( (a = attr_find(rs->sr_entry->e_attrs, ia->attr) ) )
281 for(i = 0, b = a->a_nvals; b[i].bv_val; i++)
282 if(bvmatch(&dd->dn, &b[i])) {
283 if(!ip->dn.bv_val) ber_dupbv(&ip->dn, &rs->sr_entry->e_nname);
284 if(!b[1].bv_val && dd->nothing.bv_val) {
285 mp = ch_malloc(sizeof(Modifications));
286 mp->sml_desc = ia->attr; /* XXX */
287 mp->sml_type = a->a_desc->ad_cname;
288 mp->sml_values = ch_malloc(2 * sizeof(BerValue));
289 mp->sml_nvalues = ch_malloc(2 * sizeof(BerValue));
290 mp->sml_values[1].bv_len = mp->sml_nvalues[1].bv_len = 0;
291 mp->sml_values[1].bv_val = mp->sml_nvalues[1].bv_val = NULL;
293 mp->sml_op = LDAP_MOD_ADD;
294 ber_dupbv(&mp->sml_values[0], &dd->nothing);
295 ber_dupbv(&mp->sml_nvalues[0], &dd->nnothing);
299 /* this might violate the object class */
300 mp = ch_malloc(sizeof(Modifications));
301 mp->sml_desc = ia->attr; /* XXX */
302 mp->sml_type = a->a_desc->ad_cname;
303 mp->sml_values = ch_malloc(2 * sizeof(BerValue));
304 mp->sml_nvalues = ch_malloc(2 * sizeof(BerValue));
305 mp->sml_values[1].bv_len = mp->sml_nvalues[1].bv_len = 0;
306 mp->sml_values[1].bv_val = mp->sml_nvalues[1].bv_val = NULL;
307 mp->sml_op = LDAP_MOD_DELETE;
308 ber_dupbv(&mp->sml_values[0], &dd->dn);
309 ber_dupbv(&mp->sml_nvalues[0], &mp->sml_values[0]);
312 Debug(LDAP_DEBUG_TRACE, "refint_delete_cb: %s: %s\n",
313 a->a_desc->ad_cname.bv_val, dd->dn.bv_val, 0);
335 ((refint_data *)op->o_callback->sc_private)->message = "_null_cb";
336 return(LDAP_SUCCESS);
341 ** generates a list of Modification* from search results
352 refint_data *id, *dd = op->o_callback->sc_private;
353 refint_attrs *ia, *da = dd->attrs;
354 dependent_data *ip = NULL, *dp = NULL;
358 Debug(LDAP_DEBUG_TRACE, "refint_modrdn_cb <%s>\n",
359 rs->sr_entry ? rs->sr_entry->e_name.bv_val : "NOTHING", 0, 0);
361 if (rs->sr_type != REP_SEARCH || !rs->sr_entry) return(0);
362 dd->message = "_modrdn_cb";
365 ** foreach configured attribute type:
366 ** if this attr exists in the search result,
367 ** and it has a value matching the target:
368 ** allocate a pair of Modifications;
369 ** make it MOD_ADD the new value and MOD_DELETE the old;
370 ** allocate its array of BerValues;
371 ** foreach value in the search result:
372 ** if it matches our target value, replace it;
373 ** otherwise, copy from the search result;
374 ** terminate the array of BerValues;
375 ** add these mods to the list of mods;
379 for(ia = da; ia; ia = ia->next) {
380 if((a = attr_find(rs->sr_entry->e_attrs, ia->attr))) {
381 for(fix = 0, i = 0, b = a->a_nvals; b[i].bv_val; i++)
382 if(bvmatch(&dd->dn, &b[i])) { fix++; break; }
385 ip = ch_malloc(sizeof(dependent_data));
388 ber_dupbv(&ip->dn, &rs->sr_entry->e_nname);
390 mp = ch_malloc(sizeof(Modifications));
391 mp->sml_op = LDAP_MOD_ADD;
392 mp->sml_desc = ia->attr; /* XXX */
393 mp->sml_type = ia->attr->ad_cname;
394 mp->sml_values = ch_malloc(2 * sizeof(BerValue));
395 mp->sml_nvalues = ch_malloc(2 * sizeof(BerValue));
396 ber_dupbv(&mp->sml_values[0], &dd->newdn);
397 ber_dupbv(&mp->sml_nvalues[0], &dd->nnewdn);
398 mp->sml_values[1].bv_len = mp->sml_nvalues[1].bv_len = 0;
399 mp->sml_values[1].bv_val = mp->sml_nvalues[1].bv_val = NULL;
400 mp->sml_next = ip->mm;
402 mp = ch_malloc(sizeof(Modifications));
403 mp->sml_op = LDAP_MOD_DELETE;
404 mp->sml_desc = ia->attr; /* XXX */
405 mp->sml_type = ia->attr->ad_cname;
406 mp->sml_values = ch_malloc(2 * sizeof(BerValue));
407 mp->sml_nvalues = ch_malloc(2 * sizeof(BerValue));
408 ber_dupbv(&mp->sml_values[0], &dd->dn);
409 ber_dupbv(&mp->sml_nvalues[0], &dd->dn);
410 mp->sml_values[1].bv_len = mp->sml_nvalues[1].bv_len = 0;
411 mp->sml_values[1].bv_val = mp->sml_nvalues[1].bv_val = NULL;
412 mp->sml_next = ip->mm;
414 Debug(LDAP_DEBUG_TRACE, "refint_modrdn_cb: %s: %s\n",
415 a->a_desc->ad_cname.bv_val, dd->dn.bv_val, 0);
430 ** search for matching records and modify them
440 SlapReply nrs = { REP_RESULT };
441 slap_callback cb = { NULL, NULL, NULL, NULL };
442 slap_callback cb2 = { NULL, slap_replog_cb, NULL, NULL };
443 slap_callback *cbo, *cbp;
444 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
445 refint_data *id = on->on_bi.bi_private;
446 refint_data dd = *id;
449 char *fstr, *key, *kp, **dnpp, **ndnpp, *cp;
450 BerValue ndn, moddn, pdn;
452 int rc, ac, i, j, ksize;
454 id->message = "_refint_response";
456 /* If the main op failed or is not a Delete or ModRdn, ignore it */
457 if (( op->o_tag != LDAP_REQ_DELETE && op->o_tag != LDAP_REQ_MODRDN ) ||
458 rs->sr_err != LDAP_SUCCESS )
459 return SLAP_CB_CONTINUE;
462 ** validate (and count) the list of attrs;
466 for(ip = id->attrs, ac = 0; ip; ip = ip->next, ac++);
468 rs->sr_err = LDAP_OTHER;
469 rs->sr_text = "refint_response called without any attributes";
470 return SLAP_CB_CONTINUE;
474 ** find the backend that matches our configured basedn;
475 ** make sure it exists and has search and modify methods;
479 nop.o_bd = select_backend(&id->dn, 0, 1);
482 if (!nop.o_bd->be_search || !nop.o_bd->be_modify) {
483 rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
484 rs->sr_text = "backend missing search and/or modify";
485 return SLAP_CB_CONTINUE;
488 rs->sr_err = LDAP_OTHER;
489 rs->sr_text = "no known backend? this shouldn't be happening!";
490 return SLAP_CB_CONTINUE;
496 ** if delete: set delete callback;
497 ** else modrdn: create a newdn, set modify callback;
501 if(op->o_tag == LDAP_REQ_DELETE) {
502 cb.sc_response = &refint_delete_cb;
503 dd.newdn.bv_val = NULL;
504 dd.nnewdn.bv_val = NULL;
506 cb.sc_response = &refint_modrdn_cb;
507 if ( op->oq_modrdn.rs_newSup ) {
508 pdn = *op->oq_modrdn.rs_newSup;
510 dnParent( &op->o_req_dn, &pdn );
512 build_new_dn( &dd.newdn, &pdn, &op->orr_newrdn, NULL );
513 if ( op->oq_modrdn.rs_nnewSup ) {
514 pdn = *op->oq_modrdn.rs_nnewSup;
516 dnParent( &op->o_req_ndn, &pdn );
518 build_new_dn( &dd.nnewdn, &pdn, &op->orr_nnewrdn, NULL );
522 ** calculate the search key size and allocate it;
523 ** build a search filter for all configured attributes;
524 ** populate our Operation;
525 ** pass our data (attr list, dn) to backend via sc_private;
526 ** call the backend search function;
527 ** nb: (|(one=thing)) is valid, but do smart formatting anyway;
528 ** nb: 16 is arbitrarily a dozen or so extra bytes;
532 for(ksize = 16, ip = id->attrs; ip; ip = ip->next)
533 ksize += ip->attr->ad_cname.bv_len + op->o_req_dn.bv_len + 3;
534 kp = key = ch_malloc(ksize);
535 if(--ac) kp += sprintf(key, "(|");
536 for(ip = id->attrs; ip; ip = ip->next)
537 kp += sprintf(kp, "(%s=%s)",
538 ip->attr->ad_cname.bv_val, op->o_req_dn.bv_val);
542 nop.ors_filter = str2filter_x(&nop, key);
543 ber_str2bv(key, 0, 0, &nop.ors_filterstr);
545 /* callback gets the searched dn instead */
546 dd.dn = op->o_req_ndn;
547 dd.message = "_dependent_search";
550 nop.o_callback = &cb;
551 nop.o_tag = LDAP_REQ_SEARCH;
552 nop.ors_scope = LDAP_SCOPE_SUBTREE;
553 nop.ors_deref = LDAP_DEREF_NEVER;
554 nop.ors_slimit = SLAP_NO_LIMIT;
555 nop.ors_tlimit = SLAP_NO_LIMIT;
558 nop.ors_attrs = slap_anlist_no_attrs;
559 nop.ors_attrsonly = 1;
561 nop.o_req_ndn = id->dn;
562 nop.o_req_dn = id->dn;
565 rc = nop.o_bd->be_search(&nop, &nrs);
567 filter_free_x(&nop, nop.ors_filter);
569 ch_free(dd.nnewdn.bv_val);
570 ch_free(dd.newdn.bv_val);
571 dd.newdn.bv_val = NULL;
572 dd.nnewdn.bv_val = NULL;
574 if(rc != LDAP_SUCCESS) {
575 rs->sr_err = nrs.sr_err;
576 rs->sr_text = "refint_response search failed";
580 /* safety? paranoid just in case */
582 rs->sr_err = LDAP_OTHER;
583 rs->sr_text = "whoa! refint_response callback wiped out sc_private?!";
587 /* presto! now it's a modify request with null callback */
588 cb.sc_response = &refint_null_cb;
589 nop.o_tag = LDAP_REQ_MODIFY;
590 dd.message = "_dependent_modify";
592 /* See if the parent operation is going into the replog */
593 for (cbo=op->o_callback, cbp = cbo->sc_next; cbp; cbo=cbp,cbp=cbp->sc_next) {
594 if (cbp->sc_response == slap_replog_cb) {
595 /* Invoke replog now, arrange for our
596 * dependent mods to also be logged
598 cbo->sc_next = cbp->sc_next;
600 nop.o_callback = &cb2;
606 ** [our search callback builds a list of mods]
608 ** make sure its dn has a backend;
609 ** connect Modification* chain to our op;
610 ** call the backend modify function;
611 ** pass any errors upstream;
615 for(dp = dd.mods; dp; dp = dp->next) {
616 Modifications **tail, *m;
618 for(m = dp->mm; m && m->sml_next; m = m->sml_next);
620 nop.o_req_dn = dp->dn;
621 nop.o_req_ndn = dp->dn;
622 nop.o_bd = select_backend(&dp->dn, 0, 1);
624 rs->sr_err = LDAP_OTHER;
625 rs->sr_text = "this should never happen either!";
628 nrs.sr_type = REP_RESULT;
629 nop.orm_modlist = dp->mm; /* callback did all the work */
630 nop.o_dn = refint_dn;
631 nop.o_ndn = refint_dn;
632 rs->sr_err = slap_mods_opattrs( &nop, nop.orm_modlist,
633 tail, &rs->sr_text, NULL, 0, 1 );
634 nop.o_dn = nop.o_bd->be_rootdn;
635 nop.o_ndn = nop.o_bd->be_rootndn;
636 if(rs->sr_err != LDAP_SUCCESS) goto done;
637 if((rc = nop.o_bd->be_modify(&nop, &nrs)) != LDAP_SUCCESS) {
638 rs->sr_err = nrs.sr_err;
639 rs->sr_text = "dependent modify failed";
645 for(dp = dd.mods; dp; dp = dd.mods) {
647 ch_free(dp->dn.bv_val);
648 slap_mods_free(dp->mm);
652 return(SLAP_CB_CONTINUE);
656 ** init_module is last so the symbols resolve "for free" --
657 ** it expects to be called automagically during dynamic module initialization
662 /* statically declared just after the #includes at top */
663 refint.on_bi.bi_type = "refint";
664 refint.on_bi.bi_db_init = refint_db_init;
665 refint.on_bi.bi_db_config = refint_config;
666 refint.on_bi.bi_db_open = refint_open;
667 refint.on_bi.bi_db_close = refint_close;
668 refint.on_response = refint_response;
670 return(overlay_register(&refint));
673 #if SLAPD_OVER_REFINT == SLAPD_MOD_DYNAMIC && defined(PIC)
674 int init_module(int argc, char *argv[]) {
675 return refint_init();
679 #endif /* SLAPD_OVER_REFINT */