git.sur5r.net Git - openldap/blob - servers/slapd/overlays/rwm.c

   1 /* rwm.c - rewrite/remap operations */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 2003-2007 The OpenLDAP Foundation.
   6  * Portions Copyright 2003 Pierangelo Masarati.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted only as authorized by the OpenLDAP
  11  * Public License.
  12  *
  13  * A copy of this license is available in the file LICENSE in the
  14  * top-level directory of the distribution or, alternatively, at
  15  * <http://www.OpenLDAP.org/license.html>.
  16  */
  17
  18 #include "portable.h"
  19
  20 #ifdef SLAPD_OVER_RWM
  21
  22 #include <stdio.h>
  23
  24 #include <ac/string.h>
  25
  26 #include "slap.h"
  27 #include "rwm.h"
  28
  29 typedef struct rwm_op_state {
  30         ber_tag_t r_tag;
  31         struct berval ro_dn;
  32         struct berval ro_ndn;
  33         struct berval r_dn;
  34         struct berval r_ndn;
  35         AttributeName *mapped_attrs;
  36         OpRequest o_request;
  37 } rwm_op_state;
  38
  39 static int
  40 rwm_db_destroy( BackendDB *be );
  41
  42 typedef struct rwm_op_cb {
  43         slap_callback cb;
  44         rwm_op_state ros;
  45 } rwm_op_cb;
  46
  47 static int
  48 rwm_op_cleanup( Operation *op, SlapReply *rs )
  49 {
  50         slap_callback   *cb = op->o_callback;
  51         rwm_op_state *ros = cb->sc_private;
  52
  53         if ( rs->sr_type == REP_RESULT || rs->sr_type == REP_EXTENDED ||
  54                 op->o_abandon || rs->sr_err == SLAPD_ABANDON ) {
  55
  56                 op->o_req_dn = ros->ro_dn;
  57                 op->o_req_ndn = ros->ro_ndn;
  58
  59                 if ( !BER_BVISEMPTY( &ros->r_dn )) ch_free( ros->r_dn.bv_val );
  60                 if ( !BER_BVISEMPTY( &ros->r_ndn )) ch_free( ros->r_ndn.bv_val );
  61
  62                 switch( ros->r_tag ) {
  63                 case LDAP_REQ_COMPARE:
  64                         if ( op->orc_ava->aa_value.bv_val != ros->orc_ava->aa_value.bv_val )
  65                                 op->o_tmpfree( op->orc_ava->aa_value.bv_val, op->o_tmpmemctx );
  66                         op->orc_ava = ros->orc_ava;
  67                         break;
  68                 case LDAP_REQ_MODIFY:
  69                         slap_mods_free( op->orm_modlist, 1 );
  70                         op->orm_modlist = ros->orm_modlist;
  71                         break;
  72                 case LDAP_REQ_MODRDN:
  73                         if ( op->orr_newSup != ros->orr_newSup ) {
  74                                 ch_free( op->orr_newSup->bv_val );
  75                                 ch_free( op->orr_nnewSup->bv_val );
  76                                 op->o_tmpfree( op->orr_newSup, op->o_tmpmemctx );
  77                                 op->o_tmpfree( op->orr_nnewSup, op->o_tmpmemctx );
  78                                 op->orr_newSup = ros->orr_newSup;
  79                                 op->orr_nnewSup = ros->orr_nnewSup;
  80                         }
  81                         break;
  82                 case LDAP_REQ_SEARCH:
  83                         ch_free( ros->mapped_attrs );
  84                         filter_free_x( op, op->ors_filter );
  85                         ch_free( op->ors_filterstr.bv_val );
  86                         op->ors_attrs = ros->ors_attrs;
  87                         op->ors_filter = ros->ors_filter;
  88                         op->ors_filterstr = ros->ors_filterstr;
  89                         break;
  90                 case LDAP_REQ_EXTENDED:
  91                         if ( op->ore_reqdata != ros->ore_reqdata ) {
  92                                 ber_bvfree( op->ore_reqdata );
  93                                 op->ore_reqdata = ros->ore_reqdata;
  94                         }
  95                         break;
  96                 default:        break;
  97                 }
  98                 op->o_callback = op->o_callback->sc_next;
  99                 op->o_tmpfree( cb, op->o_tmpmemctx );
 100         }
 101
 102         return SLAP_CB_CONTINUE;
 103 }
 104
 105 static rwm_op_cb *
 106 rwm_callback_get( Operation *op, SlapReply *rs )
 107 {
 108         rwm_op_cb       *roc = NULL;
 109
 110         roc = op->o_tmpalloc( sizeof( struct rwm_op_cb ), op->o_tmpmemctx );
 111         roc->cb.sc_cleanup = rwm_op_cleanup;
 112         roc->cb.sc_response = NULL;
 113         roc->cb.sc_next = op->o_callback;
 114         roc->cb.sc_private = &roc->ros;
 115         roc->ros.r_tag = op->o_tag;
 116         roc->ros.ro_dn = op->o_req_dn;
 117         roc->ros.ro_ndn = op->o_req_ndn;
 118         roc->ros.o_request = op->o_request;
 119         BER_BVZERO( &roc->ros.r_dn );
 120         BER_BVZERO( &roc->ros.r_ndn );
 121
 122         return roc;
 123 }
 124
 125
 126 static int
 127 rwm_op_dn_massage( Operation *op, SlapReply *rs, void *cookie,
 128         rwm_op_state *ros )
 129 {
 130         slap_overinst           *on = (slap_overinst *) op->o_bd->bd_info;
 131         struct ldaprwmap        *rwmap =
 132                         (struct ldaprwmap *)on->on_bi.bi_private;
 133
 134         struct berval           dn = BER_BVNULL,
 135                                 ndn = BER_BVNULL;
 136         int                     rc = 0;
 137         dncookie                dc;
 138
 139         /*
 140          * Rewrite the dn if needed
 141          */
 142         dc.rwmap = rwmap;
 143 #ifdef ENABLE_REWRITE
 144         dc.conn = op->o_conn;
 145         dc.rs = rs;
 146         dc.ctx = (char *)cookie;
 147 #else /* ! ENABLE_REWRITE */
 148         dc.tofrom = ((int *)cookie)[0];
 149         dc.normalized = 0;
 150 #endif /* ! ENABLE_REWRITE */
 151
 152         /* NOTE: in those cases where only the ndn is available,
 153          * and the caller sets op->o_req_dn = op->o_req_ndn,
 154          * only rewrite the op->o_req_ndn and use it as
 155          * op->o_req_dn as well */
 156         ndn = op->o_req_ndn;
 157         if ( op->o_req_dn.bv_val != op->o_req_ndn.bv_val ) {
 158                 dn = op->o_req_dn;
 159                 rc = rwm_dn_massage_pretty_normalize( &dc, &op->o_req_dn, &dn, &ndn );
 160         } else {
 161                 rc = rwm_dn_massage_normalize( &dc, &op->o_req_ndn, &ndn );
 162         }
 163
 164         if ( rc != LDAP_SUCCESS ) {
 165                 return rc;
 166         }
 167
 168         if ( ( op->o_req_dn.bv_val != op->o_req_ndn.bv_val && dn.bv_val == op->o_req_dn.bv_val )
 169                         || ndn.bv_val == op->o_req_ndn.bv_val )
 170         {
 171                 return LDAP_SUCCESS;
 172         }
 173
 174         if ( op->o_req_dn.bv_val != op->o_req_ndn.bv_val ) {
 175                 op->o_req_dn = dn;
 176                 ros->r_dn  = dn;
 177         } else {
 178                 op->o_req_dn = ndn;
 179         }
 180         ros->r_ndn = ndn;
 181         op->o_req_ndn = ndn;
 182
 183         return LDAP_SUCCESS;
 184 }
 185
 186 static int
 187 rwm_op_add( Operation *op, SlapReply *rs )
 188 {
 189         slap_overinst           *on = (slap_overinst *) op->o_bd->bd_info;
 190         struct ldaprwmap        *rwmap =
 191                         (struct ldaprwmap *)on->on_bi.bi_private;
 192
 193         int                     rc,
 194                                 i;
 195         Attribute               **ap = NULL;
 196         char                    *olddn = op->o_req_dn.bv_val;
 197         int                     isupdate;
 198
 199         rwm_op_cb *roc = rwm_callback_get( op, rs );
 200
 201 #ifdef ENABLE_REWRITE
 202         rc = rwm_op_dn_massage( op, rs, "addDN", &roc->ros );
 203 #else /* ! ENABLE_REWRITE */
 204         rc = 1;
 205         rc = rwm_op_dn_massage( op, rs, &rc, &roc->ros );
 206 #endif /* ! ENABLE_REWRITE */
 207         if ( rc != LDAP_SUCCESS ) {
 208                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
 209                 send_ldap_error( op, rs, rc, "addDN massage error" );
 210                 return -1;
 211         }
 212
 213         if ( olddn != op->o_req_dn.bv_val ) {
 214                 ber_bvreplace( &op->ora_e->e_name, &op->o_req_dn );
 215                 ber_bvreplace( &op->ora_e->e_nname, &op->o_req_ndn );
 216         }
 217
 218         /* Count number of attributes in entry */
 219         isupdate = be_shadow_update( op );
 220         for ( i = 0, ap = &op->oq_add.rs_e->e_attrs; *ap; ) {
 221                 Attribute       *a;
 222
 223                 if ( (*ap)->a_desc == slap_schema.si_ad_objectClass ||
 224                                 (*ap)->a_desc == slap_schema.si_ad_structuralObjectClass )
 225                 {
 226                         int             j, last;
 227
 228                         for ( last = 0; !BER_BVISNULL( &(*ap)->a_vals[ last ] ); last++ )
 229                                         /* count values */ ;
 230                         last--;
 231                         for ( j = 0; !BER_BVISNULL( &(*ap)->a_vals[ j ] ); j++ ) {
 232                                 struct ldapmapping      *mapping = NULL;
 233
 234                                 ( void )rwm_mapping( &rwmap->rwm_oc, &(*ap)->a_vals[ j ],
 235                                                 &mapping, RWM_MAP );
 236                                 if ( mapping == NULL ) {
 237                                         if ( rwmap->rwm_at.drop_missing ) {
 238                                                 /* FIXME: we allow to remove objectClasses as well;
 239                                                  * if the resulting entry is inconsistent, that's
 240                                                  * the relayed database's business...
 241                                                  */
 242                                                 ch_free( (*ap)->a_vals[ j ].bv_val );
 243                                                 if ( last > j ) {
 244                                                         (*ap)->a_vals[ j ] = (*ap)->a_vals[ last ];
 245                                                 }
 246                                                 BER_BVZERO( &(*ap)->a_vals[ last ] );
 247                                                 last--;
 248                                                 j--;
 249                                         }
 250
 251                                 } else {
 252                                         ch_free( (*ap)->a_vals[ j ].bv_val );
 253                                         ber_dupbv( &(*ap)->a_vals[ j ], &mapping->m_dst );
 254                                 }
 255                         }
 256
 257                 } else if ( !isupdate && !get_manageDIT( op ) && (*ap)->a_desc->ad_type->sat_no_user_mod )
 258                 {
 259                         goto next_attr;
 260
 261                 } else {
 262                         struct ldapmapping      *mapping = NULL;
 263
 264                         ( void )rwm_mapping( &rwmap->rwm_at, &(*ap)->a_desc->ad_cname,
 265                                         &mapping, RWM_MAP );
 266                         if ( mapping == NULL ) {
 267                                 if ( rwmap->rwm_at.drop_missing ) {
 268                                         goto cleanup_attr;
 269                                 }
 270                         }
 271
 272                         if ( (*ap)->a_desc->ad_type->sat_syntax == slap_schema.si_syn_distinguishedName
 273                                         || ( mapping != NULL && mapping->m_dst_ad->ad_type->sat_syntax == slap_schema.si_syn_distinguishedName ) )
 274                         {
 275                                 /*
 276                                  * FIXME: rewrite could fail; in this case
 277                                  * the operation should give up, right?
 278                                  */
 279 #ifdef ENABLE_REWRITE
 280                                 rc = rwm_dnattr_rewrite( op, rs, "addAttrDN",
 281                                                 (*ap)->a_vals,
 282                                                 (*ap)->a_nvals ? &(*ap)->a_nvals : NULL );
 283 #else /* ! ENABLE_REWRITE */
 284                                 rc = 1;
 285                                 rc = rwm_dnattr_rewrite( op, rs, &rc, (*ap)->a_vals,
 286                                                 (*ap)->a_nvals ? &(*ap)->a_nvals : NULL );
 287 #endif /* ! ENABLE_REWRITE */
 288                                 if ( rc ) {
 289                                         goto cleanup_attr;
 290                                 }
 291
 292                         } else if ( (*ap)->a_desc == slap_schema.si_ad_ref ) {
 293 #ifdef ENABLE_REWRITE
 294                                 rc = rwm_referral_rewrite( op, rs, "referralAttrDN",
 295                                                 (*ap)->a_vals,
 296                                                 (*ap)->a_nvals ? &(*ap)->a_nvals : NULL );
 297 #else /* ! ENABLE_REWRITE */
 298                                 rc = 1;
 299                                 rc = rwm_referral_rewrite( op, rs, &rc, (*ap)->a_vals,
 300                                                 (*ap)->a_nvals ? &(*ap)->a_nvals : NULL );
 301 #endif /* ! ENABLE_REWRITE */
 302                                 if ( rc != LDAP_SUCCESS ) {
 303                                         goto cleanup_attr;
 304                                 }
 305                         }
 306
 307                         if ( mapping != NULL ) {
 308                                 assert( mapping->m_dst_ad != NULL );
 309                                 (*ap)->a_desc = mapping->m_dst_ad;
 310                         }
 311                 }
 312
 313 next_attr:;
 314                 ap = &(*ap)->a_next;
 315                 continue;
 316
 317 cleanup_attr:;
 318                 /* FIXME: leaking attribute/values? */
 319                 a = *ap;
 320
 321                 *ap = (*ap)->a_next;
 322                 attr_free( a );
 323         }
 324
 325         op->o_callback = &roc->cb;
 326
 327         return SLAP_CB_CONTINUE;
 328 }
 329
 330 #ifdef ENABLE_REWRITE
 331 static int
 332 rwm_conn_init( BackendDB *be, Connection *conn )
 333 {
 334         slap_overinst           *on = (slap_overinst *) be->bd_info;
 335         struct ldaprwmap        *rwmap =
 336                         (struct ldaprwmap *)on->on_bi.bi_private;
 337
 338         ( void )rewrite_session_init( rwmap->rwm_rw, conn );
 339
 340         return SLAP_CB_CONTINUE;
 341 }
 342
 343 static int
 344 rwm_conn_destroy( BackendDB *be, Connection *conn )
 345 {
 346         slap_overinst           *on = (slap_overinst *) be->bd_info;
 347         struct ldaprwmap        *rwmap =
 348                         (struct ldaprwmap *)on->on_bi.bi_private;
 349
 350         ( void )rewrite_session_delete( rwmap->rwm_rw, conn );
 351
 352         return SLAP_CB_CONTINUE;
 353 }
 354 #endif /* ENABLE_REWRITE */
 355
 356 static int
 357 rwm_op_bind( Operation *op, SlapReply *rs )
 358 {
 359         slap_overinst           *on = (slap_overinst *) op->o_bd->bd_info;
 360         int                     rc;
 361
 362         rwm_op_cb *roc = rwm_callback_get( op, rs );
 363
 364 #ifdef ENABLE_REWRITE
 365         rc = rwm_op_dn_massage( op, rs, "bindDN", &roc->ros );
 366 #else /* ! ENABLE_REWRITE */
 367         rc = 1;
 368         rc = rwm_op_dn_massage( op, rs, &rc, &roc->ros );
 369 #endif /* ! ENABLE_REWRITE */
 370         if ( rc != LDAP_SUCCESS ) {
 371                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
 372                 send_ldap_error( op, rs, rc, "bindDN massage error" );
 373                 return -1;
 374         }
 375
 376         op->o_callback = &roc->cb;
 377
 378         return SLAP_CB_CONTINUE;
 379 }
 380
 381 static int
 382 rwm_op_unbind( Operation *op, SlapReply *rs )
 383 {
 384         slap_overinst           *on = (slap_overinst *) op->o_bd->bd_info;
 385         struct ldaprwmap        *rwmap =
 386                         (struct ldaprwmap *)on->on_bi.bi_private;
 387
 388 #ifdef ENABLE_REWRITE
 389         rewrite_session_delete( rwmap->rwm_rw, op->o_conn );
 390 #endif /* ENABLE_REWRITE */
 391
 392         return SLAP_CB_CONTINUE;
 393 }
 394
 395 static int
 396 rwm_op_compare( Operation *op, SlapReply *rs )
 397 {
 398         slap_overinst           *on = (slap_overinst *) op->o_bd->bd_info;
 399         struct ldaprwmap        *rwmap =
 400                         (struct ldaprwmap *)on->on_bi.bi_private;
 401
 402         int                     rc;
 403         struct berval mapped_vals[2] = { BER_BVNULL, BER_BVNULL };
 404
 405         rwm_op_cb *roc = rwm_callback_get( op, rs );
 406
 407 #ifdef ENABLE_REWRITE
 408         rc = rwm_op_dn_massage( op, rs, "compareDN", &roc->ros );
 409 #else /* ! ENABLE_REWRITE */
 410         rc = 1;
 411         rc = rwm_op_dn_massage( op, rs, &rc, &roc->ros );
 412 #endif /* ! ENABLE_REWRITE */
 413         if ( rc != LDAP_SUCCESS ) {
 414                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
 415                 send_ldap_error( op, rs, rc, "compareDN massage error" );
 416                 return -1;
 417         }
 418
 419         /* if the attribute is an objectClass, try to remap its value */
 420         if ( op->orc_ava->aa_desc == slap_schema.si_ad_objectClass
 421                         || op->orc_ava->aa_desc == slap_schema.si_ad_structuralObjectClass )
 422         {
 423                 rwm_map( &rwmap->rwm_oc, &op->orc_ava->aa_value,
 424                                 &mapped_vals[0], RWM_MAP );
 425                 if ( BER_BVISNULL( &mapped_vals[0] ) || BER_BVISEMPTY( &mapped_vals[0] ) )
 426                 {
 427                         op->o_bd->bd_info = (BackendInfo *)on->on_info;
 428                         send_ldap_error( op, rs, LDAP_OTHER, "compare objectClass map error" );
 429                         return -1;
 430
 431                 } else if ( mapped_vals[0].bv_val != op->orc_ava->aa_value.bv_val ) {
 432                         ber_dupbv_x( &op->orc_ava->aa_value, &mapped_vals[0],
 433                                 op->o_tmpmemctx );
 434                 }
 435
 436         } else {
 437                 struct ldapmapping      *mapping = NULL;
 438                 AttributeDescription    *ad = op->orc_ava->aa_desc;
 439
 440                 ( void )rwm_mapping( &rwmap->rwm_at, &op->orc_ava->aa_desc->ad_cname,
 441                                 &mapping, RWM_MAP );
 442                 if ( mapping == NULL ) {
 443                         if ( rwmap->rwm_at.drop_missing ) {
 444                                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
 445                                 send_ldap_error( op, rs, LDAP_OTHER, "compare attributeType map error" );
 446                                 return -1;
 447                         }
 448
 449                 } else {
 450                         assert( mapping->m_dst_ad != NULL );
 451                         ad = mapping->m_dst_ad;
 452                 }
 453
 454                 if ( op->orc_ava->aa_desc->ad_type->sat_syntax == slap_schema.si_syn_distinguishedName
 455                                 || ( mapping != NULL && mapping->m_dst_ad->ad_type->sat_syntax == slap_schema.si_syn_distinguishedName ) )
 456                 {
 457                         struct berval   *mapped_valsp[2];
 458
 459                         mapped_valsp[0] = &mapped_vals[0];
 460                         mapped_valsp[1] = &mapped_vals[1];
 461
 462                         mapped_vals[0] = op->orc_ava->aa_value;
 463
 464 #ifdef ENABLE_REWRITE
 465                         rc = rwm_dnattr_rewrite( op, rs, "compareAttrDN", NULL, mapped_valsp );
 466 #else /* ! ENABLE_REWRITE */
 467                         rc = 1;
 468                         rc = rwm_dnattr_rewrite( op, rs, &rc, NULL, mapped_valsp );
 469 #endif /* ! ENABLE_REWRITE */
 470
 471                         if ( rc != LDAP_SUCCESS ) {
 472                                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
 473                                 send_ldap_error( op, rs, rc, "compareAttrDN massage error" );
 474                                 return -1;
 475                         }
 476
 477                         if ( mapped_vals[ 0 ].bv_val != op->orc_ava->aa_value.bv_val ) {
 478                                 /* NOTE: if we get here, rwm_dnattr_rewrite()
 479                                  * already freed the old value, so now
 480                                  * it's invalid */
 481                                 ber_dupbv_x( &op->orc_ava->aa_value, &mapped_vals[0],
 482                                         op->o_tmpmemctx );
 483                                 ber_memfree_x( mapped_vals[ 0 ].bv_val, NULL );
 484                         }
 485                 }
 486                 op->orc_ava->aa_desc = ad;
 487         }
 488
 489         op->o_callback = &roc->cb;
 490
 491         return SLAP_CB_CONTINUE;
 492 }
 493
 494 static int
 495 rwm_op_delete( Operation *op, SlapReply *rs )
 496 {
 497         slap_overinst           *on = (slap_overinst *) op->o_bd->bd_info;
 498         int                     rc;
 499
 500         rwm_op_cb *roc = rwm_callback_get( op, rs );
 501
 502 #ifdef ENABLE_REWRITE
 503         rc = rwm_op_dn_massage( op, rs, "deleteDN", &roc->ros );
 504 #else /* ! ENABLE_REWRITE */
 505         rc = 1;
 506         rc = rwm_op_dn_massage( op, rs, &rc, &roc->ros );
 507 #endif /* ! ENABLE_REWRITE */
 508         if ( rc != LDAP_SUCCESS ) {
 509                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
 510                 send_ldap_error( op, rs, rc, "deleteDN massage error" );
 511                 return -1;
 512         }
 513
 514         op->o_callback = &roc->cb;
 515
 516         return SLAP_CB_CONTINUE;
 517 }
 518
 519 static int
 520 rwm_op_modify( Operation *op, SlapReply *rs )
 521 {
 522         slap_overinst           *on = (slap_overinst *) op->o_bd->bd_info;
 523         struct ldaprwmap        *rwmap =
 524                         (struct ldaprwmap *)on->on_bi.bi_private;
 525
 526         int                     isupdate;
 527         Modifications           **mlp;
 528         int                     rc;
 529
 530         rwm_op_cb *roc = rwm_callback_get( op, rs );
 531
 532 #ifdef ENABLE_REWRITE
 533         rc = rwm_op_dn_massage( op, rs, "modifyDN", &roc->ros );
 534 #else /* ! ENABLE_REWRITE */
 535         rc = 1;
 536         rc = rwm_op_dn_massage( op, rs, &rc, &roc->ros );
 537 #endif /* ! ENABLE_REWRITE */
 538         if ( rc != LDAP_SUCCESS ) {
 539                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
 540                 send_ldap_error( op, rs, rc, "modifyDN massage error" );
 541                 return -1;
 542         }
 543
 544         isupdate = be_shadow_update( op );
 545         for ( mlp = &op->oq_modify.rs_modlist; *mlp; ) {
 546                 int                     is_oc = 0;
 547                 Modifications           *ml;
 548                 struct ldapmapping      *mapping = NULL;
 549
 550                 /* duplicate the modlist */
 551                 ml = ch_malloc( sizeof( Modifications ));
 552                 *ml = **mlp;
 553                 *mlp = ml;
 554
 555                 if ( ml->sml_desc == slap_schema.si_ad_objectClass
 556                                 || ml->sml_desc == slap_schema.si_ad_structuralObjectClass )
 557                 {
 558                         is_oc = 1;
 559
 560                 } else if ( !isupdate && !get_manageDIT( op ) && (*mlp)->sml_desc->ad_type->sat_no_user_mod  )
 561                 {
 562                         goto next_mod;
 563
 564                 } else {
 565                         int                     drop_missing;
 566
 567                         drop_missing = rwm_mapping( &rwmap->rwm_at,
 568                                         &ml->sml_desc->ad_cname,
 569                                         &mapping, RWM_MAP );
 570                         if ( drop_missing || ( mapping != NULL && BER_BVISNULL( &mapping->m_dst ) ) )
 571                         {
 572                                 goto cleanup_mod;
 573                         }
 574                 }
 575
 576                 if ( ml->sml_values != NULL ) {
 577                         int i, num;
 578                         struct berval *bva;
 579
 580                         for ( num = 0; !BER_BVISNULL( &ml->sml_values[ num ] ); num++ )
 581                                 /* count values */ ;
 582
 583                         bva = ch_malloc( (num+1) * sizeof( struct berval ));
 584                         for (i=0; i<num; i++)
 585                                 ber_dupbv( &bva[i], &ml->sml_values[i] );
 586                         BER_BVZERO( &bva[i] );
 587                         ml->sml_values = bva;
 588
 589                         if ( ml->sml_nvalues ) {
 590                                 bva = ch_malloc( (num+1) * sizeof( struct berval ));
 591                                 for (i=0; i<num; i++)
 592                                         ber_dupbv( &bva[i], &ml->sml_nvalues[i] );
 593                                 BER_BVZERO( &bva[i] );
 594                                 ml->sml_nvalues = bva;
 595                         }
 596
 597                         if ( is_oc ) {
 598                                 int     last, j;
 599
 600                                 last = num-1;
 601
 602                                 for ( j = 0; !BER_BVISNULL( &ml->sml_values[ j ] ); j++ ) {
 603                                         struct ldapmapping      *oc_mapping = NULL;
 604
 605                                         ( void )rwm_mapping( &rwmap->rwm_oc, &ml->sml_values[ j ],
 606                                                         &oc_mapping, RWM_MAP );
 607                                         if ( oc_mapping == NULL ) {
 608                                                 if ( rwmap->rwm_at.drop_missing ) {
 609                                                         /* FIXME: we allow to remove objectClasses as well;
 610                                                          * if the resulting entry is inconsistent, that's
 611                                                          * the relayed database's business...
 612                                                          */
 613                                                         if ( last > j ) {
 614                                                                 ch_free( ml->sml_values[ j ].bv_val );
 615                                                                 ml->sml_values[ j ] = ml->sml_values[ last ];
 616                                                         }
 617                                                         BER_BVZERO( &ml->sml_values[ last ] );
 618                                                         last--;
 619                                                         j--;
 620                                                 }
 621
 622                                         } else {
 623                                                 ch_free( ml->sml_values[ j ].bv_val );
 624                                                 ber_dupbv( &ml->sml_values[ j ], &oc_mapping->m_dst );
 625                                         }
 626                                 }
 627
 628                         } else {
 629                                 if ( ml->sml_desc->ad_type->sat_syntax == slap_schema.si_syn_distinguishedName
 630                                                 || ( mapping != NULL && mapping->m_dst_ad->ad_type->sat_syntax == slap_schema.si_syn_distinguishedName ) )
 631                                 {
 632 #ifdef ENABLE_REWRITE
 633                                         rc = rwm_dnattr_rewrite( op, rs, "modifyAttrDN",
 634                                                         ml->sml_values,
 635                                                         ml->sml_nvalues ? &ml->sml_nvalues : NULL );
 636 #else /* ! ENABLE_REWRITE */
 637                                         rc = 1;
 638                                         rc = rwm_dnattr_rewrite( op, rs, &rc,
 639                                                         ml->sml_values,
 640                                                         ml->sml_nvalues ? &ml->sml_nvalues : NULL );
 641 #endif /* ! ENABLE_REWRITE */
 642
 643                                 } else if ( ml->sml_desc == slap_schema.si_ad_ref ) {
 644 #ifdef ENABLE_REWRITE
 645                                         rc = rwm_referral_rewrite( op, rs,
 646                                                         "referralAttrDN",
 647                                                         ml->sml_values,
 648                                                         ml->sml_nvalues ? &ml->sml_nvalues : NULL );
 649 #else /* ! ENABLE_REWRITE */
 650                                         rc = 1;
 651                                         rc = rwm_referral_rewrite( op, rs, &rc,
 652                                                         ml->sml_values,
 653                                                         ml->sml_nvalues ? &ml->sml_nvalues : NULL );
 654 #endif /* ! ENABLE_REWRITE */
 655                                         if ( rc != LDAP_SUCCESS ) {
 656                                                 goto cleanup_mod;
 657                                         }
 658                                 }
 659
 660                                 if ( rc != LDAP_SUCCESS ) {
 661                                         goto cleanup_mod;
 662                                 }
 663                         }
 664                 }
 665
 666 next_mod:;
 667                 if ( mapping != NULL ) {
 668                         /* use new attribute description */
 669                         assert( mapping->m_dst_ad != NULL );
 670                         ml->sml_desc = mapping->m_dst_ad;
 671                 }
 672
 673                 mlp = &ml->sml_next;
 674                 continue;
 675
 676 cleanup_mod:;
 677                 ml = *mlp;
 678                 *mlp = (*mlp)->sml_next;
 679                 slap_mod_free( &ml->sml_mod, 0 );
 680                 free( ml );
 681         }
 682
 683         op->o_callback = &roc->cb;
 684
 685         return SLAP_CB_CONTINUE;
 686 }
 687
 688 static int
 689 rwm_op_modrdn( Operation *op, SlapReply *rs )
 690 {
 691         slap_overinst           *on = (slap_overinst *) op->o_bd->bd_info;
 692         struct ldaprwmap        *rwmap =
 693                         (struct ldaprwmap *)on->on_bi.bi_private;
 694
 695         int                     rc;
 696
 697         rwm_op_cb *roc = rwm_callback_get( op, rs );
 698
 699         if ( op->orr_newSup ) {
 700                 dncookie        dc;
 701                 struct berval   nnewSup = BER_BVNULL;
 702                 struct berval   newSup = BER_BVNULL;
 703
 704                 /*
 705                  * Rewrite the new superior, if defined and required
 706                  */
 707                 dc.rwmap = rwmap;
 708 #ifdef ENABLE_REWRITE
 709                 dc.conn = op->o_conn;
 710                 dc.rs = rs;
 711                 dc.ctx = "newSuperiorDN";
 712 #else /* ! ENABLE_REWRITE */
 713                 dc.tofrom = 0;
 714                 dc.normalized = 0;
 715 #endif /* ! ENABLE_REWRITE */
 716                 newSup = *op->orr_newSup;
 717                 nnewSup = *op->orr_nnewSup;
 718                 rc = rwm_dn_massage_pretty_normalize( &dc, op->orr_newSup, &newSup, &nnewSup );
 719                 if ( rc != LDAP_SUCCESS ) {
 720                         op->o_bd->bd_info = (BackendInfo *)on->on_info;
 721                         send_ldap_error( op, rs, rc, "newSuperiorDN massage error" );
 722                         return -1;
 723                 }
 724
 725                 if ( op->orr_newSup->bv_val != newSup.bv_val ) {
 726                         op->orr_newSup = op->o_tmpalloc( sizeof( struct berval ),
 727                                 op->o_tmpmemctx );
 728                         op->orr_nnewSup = op->o_tmpalloc( sizeof( struct berval ),
 729                                 op->o_tmpmemctx );
 730                         *op->orr_newSup = newSup;
 731                         *op->orr_nnewSup = nnewSup;
 732                 }
 733         }
 734
 735         /*
 736          * Rewrite the dn, if needed
 737          */
 738 #ifdef ENABLE_REWRITE
 739         rc = rwm_op_dn_massage( op, rs, "renameDN", &roc->ros );
 740 #else /* ! ENABLE_REWRITE */
 741         rc = 1;
 742         rc = rwm_op_dn_massage( op, rs, &rc, &roc->ros );
 743 #endif /* ! ENABLE_REWRITE */
 744         if ( rc != LDAP_SUCCESS ) {
 745                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
 746                 send_ldap_error( op, rs, rc, "renameDN massage error" );
 747                 if ( op->orr_newSup != roc->ros.orr_newSup ) {
 748                         ch_free( op->orr_newSup->bv_val );
 749                         ch_free( op->orr_nnewSup->bv_val );
 750                         op->o_tmpfree( op->orr_newSup, op->o_tmpmemctx );
 751                         op->o_tmpfree( op->orr_nnewSup, op->o_tmpmemctx );
 752                         op->orr_newSup = roc->ros.orr_newSup;
 753                         op->orr_nnewSup = roc->ros.orr_nnewSup;
 754                 }
 755                 return -1;
 756         }
 757
 758         /* TODO: rewrite newRDN, attribute types,
 759          * values of DN-valued attributes ... */
 760
 761         op->o_callback = &roc->cb;
 762
 763         return SLAP_CB_CONTINUE;
 764 }
 765
 766
 767 static int
 768 rwm_swap_attrs( Operation *op, SlapReply *rs )
 769 {
 770         slap_callback   *cb = op->o_callback;
 771         rwm_op_state *ros = cb->sc_private;
 772
 773         rs->sr_attrs = ros->ors_attrs;
 774
 775         /* other overlays might have touched op->ors_attrs,
 776          * so we restore the original version here, otherwise
 777          * attribute-mapping might fail */
 778         op->ors_attrs = ros->mapped_attrs;
 779
 780         return SLAP_CB_CONTINUE;
 781 }
 782
 783 static int
 784 rwm_op_search( Operation *op, SlapReply *rs )
 785 {
 786         slap_overinst           *on = (slap_overinst *) op->o_bd->bd_info;
 787         struct ldaprwmap        *rwmap =
 788                         (struct ldaprwmap *)on->on_bi.bi_private;
 789
 790         int                     rc;
 791         dncookie                dc;
 792
 793         struct berval           fstr = BER_BVNULL;
 794         Filter                  *f = NULL;
 795
 796         AttributeName           *an = NULL;
 797
 798         char                    *text = NULL;
 799
 800         rwm_op_cb *roc = rwm_callback_get( op, rs );
 801
 802 #ifdef ENABLE_REWRITE
 803         rc = rewrite_session_var_set( rwmap->rwm_rw, op->o_conn,
 804                 "searchFilter", op->ors_filterstr.bv_val );
 805         if ( rc == LDAP_SUCCESS )
 806                 rc = rwm_op_dn_massage( op, rs, "searchDN", &roc->ros );
 807 #else /* ! ENABLE_REWRITE */
 808         rc = 1;
 809         rc = rwm_op_dn_massage( op, rs, &rc, &roc->ros );
 810 #endif /* ! ENABLE_REWRITE */
 811         if ( rc != LDAP_SUCCESS ) {
 812                 text = "searchDN massage error";
 813                 goto error_return;
 814         }
 815
 816         /*
 817          * Rewrite the dn if needed
 818          */
 819         dc.rwmap = rwmap;
 820 #ifdef ENABLE_REWRITE
 821         dc.conn = op->o_conn;
 822         dc.rs = rs;
 823         dc.ctx = "searchFilterAttrDN";
 824 #else /* ! ENABLE_REWRITE */
 825         dc.tofrom = 0;
 826         dc.normalized = 0;
 827 #endif /* ! ENABLE_REWRITE */
 828
 829         rc = rwm_filter_map_rewrite( op, &dc, op->ors_filter, &fstr );
 830         if ( rc != LDAP_SUCCESS ) {
 831                 text = "searchFilter/searchFilterAttrDN massage error";
 832                 goto error_return;
 833         }
 834
 835         f = str2filter_x( op, fstr.bv_val );
 836
 837         if ( f == NULL ) {
 838                 text = "massaged filter parse error";
 839                 goto error_return;
 840         }
 841
 842         op->ors_filter = f;
 843         op->ors_filterstr = fstr;
 844
 845         rc = rwm_map_attrnames( &rwmap->rwm_at, &rwmap->rwm_oc,
 846                         op->ors_attrs, &an, RWM_MAP );
 847         if ( rc != LDAP_SUCCESS ) {
 848                 text = "attribute list mapping error";
 849                 goto error_return;
 850         }
 851
 852         op->ors_attrs = an;
 853         /* store the mapped Attributes for later usage, in
 854          * the case that other overlays change op->ors_attrs */
 855         roc->ros.mapped_attrs = an;
 856         roc->cb.sc_response = rwm_swap_attrs;
 857
 858         op->o_callback = &roc->cb;
 859
 860         return SLAP_CB_CONTINUE;
 861
 862 error_return:;
 863         if ( an != NULL ) {
 864                 ch_free( an );
 865         }
 866
 867         if ( f != NULL ) {
 868                 filter_free_x( op, f );
 869         }
 870
 871         if ( !BER_BVISNULL( &fstr ) ) {
 872                 ch_free( fstr.bv_val );
 873         }
 874
 875         op->oq_search = roc->ros.oq_search;
 876
 877         op->o_bd->bd_info = (BackendInfo *)on->on_info;
 878         send_ldap_error( op, rs, rc, text );
 879
 880         return -1;
 881
 882 }
 883
 884 static int
 885 rwm_exop_passwd( Operation *op, SlapReply *rs )
 886 {
 887         slap_overinst           *on = (slap_overinst *) op->o_bd->bd_info;
 888         int                     rc;
 889         rwm_op_cb *roc;
 890
 891         struct berval   id = BER_BVNULL,
 892                         pwold = BER_BVNULL,
 893                         pwnew = BER_BVNULL;
 894         BerElement *ber = NULL;
 895
 896         if ( !BER_BVISNULL( &op->o_req_ndn ) ) {
 897                 return LDAP_SUCCESS;
 898         }
 899
 900         if ( !SLAP_ISGLOBALOVERLAY( op->o_bd ) ) {
 901                 rs->sr_err = LDAP_OTHER;
 902                 return rs->sr_err;
 903         }
 904
 905         rs->sr_err = slap_passwd_parse( op->ore_reqdata, &id,
 906                 &pwold, &pwnew, &rs->sr_text );
 907         if ( rs->sr_err != LDAP_SUCCESS ) {
 908                 return rs->sr_err;
 909         }
 910
 911         if ( !BER_BVISNULL( &id ) ) {
 912                 rs->sr_err = dnPrettyNormal( NULL, &id, &op->o_req_dn,
 913                                 &op->o_req_ndn, op->o_tmpmemctx );
 914                 if ( rs->sr_err != LDAP_SUCCESS ) {
 915                         rs->sr_text = "Invalid DN";
 916                         return rs->sr_err;
 917                 }
 918
 919         } else {
 920                 ber_dupbv_x( &op->o_req_dn, &op->o_dn, op->o_tmpmemctx );
 921                 ber_dupbv_x( &op->o_req_ndn, &op->o_ndn, op->o_tmpmemctx );
 922         }
 923
 924         roc = rwm_callback_get( op, rs );
 925
 926 #ifdef ENABLE_REWRITE
 927         rc = rwm_op_dn_massage( op, rs, "extendedDN", &roc->ros );
 928 #else /* ! ENABLE_REWRITE */
 929         rc = 1;
 930         rc = rwm_op_dn_massage( op, rs, &rc, &roc->ros );
 931 #endif /* ! ENABLE_REWRITE */
 932         if ( rc != LDAP_SUCCESS ) {
 933                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
 934                 send_ldap_error( op, rs, rc, "extendedDN massage error" );
 935                 return -1;
 936         }
 937
 938         ber = ber_alloc_t( LBER_USE_DER );
 939         if ( !ber ) {
 940                 rs->sr_err = LDAP_OTHER;
 941                 rs->sr_text = "No memory";
 942                 return rs->sr_err;
 943         }
 944         ber_printf( ber, "{" );
 945         if ( !BER_BVISNULL( &id )) {
 946                 ber_printf( ber, "tO", LDAP_TAG_EXOP_MODIFY_PASSWD_ID,
 947                         &op->o_req_dn );
 948         }
 949         if ( !BER_BVISNULL( &pwold )) {
 950                 ber_printf( ber, "tO", LDAP_TAG_EXOP_MODIFY_PASSWD_OLD, &pwold );
 951         }
 952         if ( !BER_BVISNULL( &pwnew )) {
 953                 ber_printf( ber, "tO", LDAP_TAG_EXOP_MODIFY_PASSWD_NEW, &pwnew );
 954         }
 955         ber_printf( ber, "N}" );
 956         ber_flatten( ber, &op->ore_reqdata );
 957         ber_free( ber, 1 );
 958
 959         op->o_callback = &roc->cb;
 960
 961         return SLAP_CB_CONTINUE;
 962 }
 963
 964 static struct exop {
 965         struct berval   oid;
 966         BI_op_extended  *extended;
 967 } exop_table[] = {
 968         { BER_BVC(LDAP_EXOP_MODIFY_PASSWD),     rwm_exop_passwd },
 969         { BER_BVNULL, NULL }
 970 };
 971
 972 static int
 973 rwm_extended( Operation *op, SlapReply *rs )
 974 {
 975         slap_overinst           *on = (slap_overinst *) op->o_bd->bd_info;
 976         int                     rc;
 977         rwm_op_cb *roc;
 978
 979         int     i;
 980
 981         for ( i = 0; exop_table[i].extended != NULL; i++ ) {
 982                 if ( bvmatch( &exop_table[i].oid, &op->oq_extended.rs_reqoid ) )
 983                 {
 984                         rc = exop_table[i].extended( op, rs );
 985                         switch ( rc ) {
 986                         case LDAP_SUCCESS:
 987                                 break;
 988
 989                         case SLAP_CB_CONTINUE:
 990                         case SLAPD_ABANDON:
 991                                 return rc;
 992
 993                         default:
 994                                 send_ldap_result( op, rs );
 995                                 return rc;
 996                         }
 997                         break;
 998                 }
 999         }
1000
1001         roc = rwm_callback_get( op, rs );
1002
1003 #ifdef ENABLE_REWRITE
1004         rc = rwm_op_dn_massage( op, rs, "extendedDN", &roc->ros );
1005 #else /* ! ENABLE_REWRITE */
1006         rc = 1;
1007         rc = rwm_op_dn_massage( op, rs, &rc, &roc->ros );
1008 #endif /* ! ENABLE_REWRITE */
1009         if ( rc != LDAP_SUCCESS ) {
1010                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
1011                 send_ldap_error( op, rs, rc, "extendedDN massage error" );
1012                 return -1;
1013         }
1014
1015         /* TODO: rewrite/map extended data ? ... */
1016         op->o_callback = &roc->cb;
1017
1018         return SLAP_CB_CONTINUE;
1019 }
1020
1021 static int
1022 rwm_matched( Operation *op, SlapReply *rs )
1023 {
1024         slap_overinst           *on = (slap_overinst *) op->o_bd->bd_info;
1025         struct ldaprwmap        *rwmap =
1026                         (struct ldaprwmap *)on->on_bi.bi_private;
1027
1028         struct berval           dn, mdn;
1029         dncookie                dc;
1030         int                     rc;
1031
1032         if ( rs->sr_matched == NULL ) {
1033                 return SLAP_CB_CONTINUE;
1034         }
1035
1036         dc.rwmap = rwmap;
1037 #ifdef ENABLE_REWRITE
1038         dc.conn = op->o_conn;
1039         dc.rs = rs;
1040         dc.ctx = "matchedDN";
1041 #else /* ! ENABLE_REWRITE */
1042         dc.tofrom = 0;
1043         dc.normalized = 0;
1044 #endif /* ! ENABLE_REWRITE */
1045         ber_str2bv( rs->sr_matched, 0, 0, &dn );
1046         mdn = dn;
1047         rc = rwm_dn_massage_pretty( &dc, &dn, &mdn );
1048         if ( rc != LDAP_SUCCESS ) {
1049                 rs->sr_err = rc;
1050                 rs->sr_text = "Rewrite error";
1051                 return 1;
1052         }
1053
1054         if ( mdn.bv_val != dn.bv_val ) {
1055                 if ( rs->sr_flags & REP_MATCHED_MUSTBEFREED ) {
1056                         ch_free( (void *)rs->sr_matched );
1057
1058                 } else {
1059                         rs->sr_flags |= REP_MATCHED_MUSTBEFREED;
1060                 }
1061                 rs->sr_matched = mdn.bv_val;
1062         }
1063
1064         return SLAP_CB_CONTINUE;
1065 }
1066
1067 static int
1068 rwm_attrs( Operation *op, SlapReply *rs, Attribute** a_first, int stripEntryDN )
1069 {
1070         slap_overinst           *on = (slap_overinst *) op->o_bd->bd_info;
1071         struct ldaprwmap        *rwmap =
1072                         (struct ldaprwmap *)on->on_bi.bi_private;
1073
1074         dncookie                dc;
1075         int                     rc;
1076         Attribute               **ap;
1077         int                     isupdate;
1078
1079         /*
1080          * Rewrite the dn attrs, if needed
1081          */
1082         dc.rwmap = rwmap;
1083 #ifdef ENABLE_REWRITE
1084         dc.conn = op->o_conn;
1085         dc.rs = NULL;
1086 #else /* ! ENABLE_REWRITE */
1087         dc.tofrom = 0;
1088         dc.normalized = 0;
1089 #endif /* ! ENABLE_REWRITE */
1090
1091         /* FIXME: the entries are in the remote mapping form;
1092          * so we need to select those attributes we are willing
1093          * to return, and remap them accordingly */
1094
1095         /* FIXME: in principle, one could map an attribute
1096          * on top of another, which already exists.
1097          * As such, in the end there might exist more than
1098          * one instance of an attribute.
1099          * We should at least check if this occurs, and issue
1100          * an error (because multiple instances of attrs in
1101          * response are not valid), or merge the values (what
1102          * about duplicate values?) */
1103         isupdate = be_shadow_update( op );
1104         for ( ap = a_first; *ap; ) {
1105                 struct ldapmapping      *mapping = NULL;
1106                 int                     drop_missing;
1107                 int                     last;
1108                 Attribute               *a;
1109
1110                 if ( SLAP_OPATTRS( rs->sr_attr_flags ) && is_at_operational( (*ap)->a_desc->ad_type ) )
1111                 {
1112                         /* go on */ ;
1113
1114                 } else {
1115                         if ( op->ors_attrs != NULL &&
1116                                         !SLAP_USERATTRS( rs->sr_attr_flags ) &&
1117                                         !ad_inlist( (*ap)->a_desc, op->ors_attrs ) )
1118                         {
1119                                 goto cleanup_attr;
1120                         }
1121
1122                         drop_missing = rwm_mapping( &rwmap->rwm_at,
1123                                         &(*ap)->a_desc->ad_cname, &mapping, RWM_REMAP );
1124                         if ( drop_missing || ( mapping != NULL && BER_BVISEMPTY( &mapping->m_dst ) ) )
1125                         {
1126                                 goto cleanup_attr;
1127                         }
1128
1129                         if ( mapping != NULL ) {
1130                                 (*ap)->a_desc = mapping->m_dst_ad;
1131                         }
1132                 }
1133
1134                 if ( (*ap)->a_desc == slap_schema.si_ad_entryDN ) {
1135                         if ( stripEntryDN ) {
1136                                 /* will be generated by frontend */
1137                                 goto cleanup_attr;
1138                         }
1139
1140                 } else if ( !isupdate
1141                         && !get_manageDIT( op )
1142                         && (*ap)->a_desc->ad_type->sat_no_user_mod
1143                         && (*ap)->a_desc->ad_type != slap_schema.si_at_undefined )
1144                 {
1145                         goto next_attr;
1146                 }
1147
1148                 for ( last = 0; !BER_BVISNULL( &(*ap)->a_vals[last] ); last++ )
1149                         /* just count */ ;
1150
1151                 if ( last == 0 ) {
1152                         /* empty? leave it in place because of attrsonly and vlv */
1153                         goto next_attr;
1154                 }
1155                 last--;
1156
1157                 if ( (*ap)->a_desc == slap_schema.si_ad_objectClass
1158                                 || (*ap)->a_desc == slap_schema.si_ad_structuralObjectClass )
1159                 {
1160                         struct berval   *bv;
1161
1162                         for ( bv = (*ap)->a_vals; !BER_BVISNULL( bv ); bv++ ) {
1163                                 struct berval   mapped;
1164
1165                                 rwm_map( &rwmap->rwm_oc, &bv[0], &mapped, RWM_REMAP );
1166                                 if ( BER_BVISNULL( &mapped ) || BER_BVISEMPTY( &mapped ) ) {
1167                                         ch_free( bv[0].bv_val );
1168                                         BER_BVZERO( &bv[0] );
1169                                         if ( &(*ap)->a_vals[last] > &bv[0] ) {
1170                                                 bv[0] = (*ap)->a_vals[last];
1171                                                 BER_BVZERO( &(*ap)->a_vals[last] );
1172                                         }
1173                                         last--;
1174                                         bv--;
1175
1176                                 } else if ( mapped.bv_val != bv[0].bv_val ) {
1177                                         /*
1178                                          * FIXME: after LBER_FREEing
1179                                          * the value is replaced by
1180                                          * ch_alloc'ed memory
1181                                          */
1182                                         ber_bvreplace( &bv[0], &mapped );
1183                                 }
1184                         }
1185
1186                 /*
1187                  * It is necessary to try to rewrite attributes with
1188                  * dn syntax because they might be used in ACLs as
1189                  * members of groups; since ACLs are applied to the
1190                  * rewritten stuff, no dn-based subject clause could
1191                  * be used at the ldap backend side (see
1192                  * http://www.OpenLDAP.org/faq/data/cache/452.html)
1193                  * The problem can be overcome by moving the dn-based
1194                  * ACLs to the target directory server, and letting
1195                  * everything pass thru the ldap backend. */
1196                 /* FIXME: handle distinguishedName-like syntaxes, like
1197                  * nameAndOptionalUID */
1198                 } else if ( (*ap)->a_desc->ad_type->sat_syntax == slap_schema.si_syn_distinguishedName
1199                                 || ( mapping != NULL && mapping->m_src_ad->ad_type->sat_syntax == slap_schema.si_syn_distinguishedName ) )
1200                 {
1201 #ifdef ENABLE_REWRITE
1202                         dc.ctx = "searchAttrDN";
1203 #endif /* ENABLE_REWRITE */
1204                         rc = rwm_dnattr_result_rewrite( &dc, (*ap)->a_vals );
1205                         if ( rc != LDAP_SUCCESS ) {
1206                                 goto cleanup_attr;
1207                         }
1208
1209                 } else if ( (*ap)->a_desc == slap_schema.si_ad_ref ) {
1210 #ifdef ENABLE_REWRITE
1211                         dc.ctx = "searchAttrDN";
1212 #endif /* ENABLE_REWRITE */
1213                         rc = rwm_referral_result_rewrite( &dc, (*ap)->a_vals );
1214                         if ( rc != LDAP_SUCCESS ) {
1215                                 goto cleanup_attr;
1216                         }
1217                 }
1218
1219                 if ( mapping != NULL ) {
1220                         /* rewrite the attribute description */
1221                         assert( mapping->m_dst_ad != NULL );
1222                         (*ap)->a_desc = mapping->m_dst_ad;
1223                 }
1224
1225 next_attr:;
1226                 ap = &(*ap)->a_next;
1227                 continue;
1228
1229 cleanup_attr:;
1230                 a = *ap;
1231                 *ap = (*ap)->a_next;
1232
1233                 attr_free( a );
1234         }
1235
1236         return 0;
1237 }
1238
1239 static int
1240 rwm_send_entry( Operation *op, SlapReply *rs )
1241 {
1242         slap_overinst           *on = (slap_overinst *) op->o_bd->bd_info;
1243         struct ldaprwmap        *rwmap =
1244                         (struct ldaprwmap *)on->on_bi.bi_private;
1245
1246         Entry                   *e = NULL;
1247         slap_mask_t             flags;
1248         struct berval           dn = BER_BVNULL,
1249                                 ndn = BER_BVNULL;
1250         dncookie                dc;
1251         int                     rc;
1252
1253         assert( rs->sr_entry != NULL );
1254
1255         /*
1256          * Rewrite the dn of the result, if needed
1257          */
1258         dc.rwmap = rwmap;
1259 #ifdef ENABLE_REWRITE
1260         dc.conn = op->o_conn;
1261         dc.rs = NULL;
1262         dc.ctx = "searchEntryDN";
1263 #else /* ! ENABLE_REWRITE */
1264         dc.tofrom = 0;
1265         dc.normalized = 0;
1266 #endif /* ! ENABLE_REWRITE */
1267
1268         e = rs->sr_entry;
1269         flags = rs->sr_flags;
1270         if ( !( rs->sr_flags & REP_ENTRY_MODIFIABLE ) ) {
1271                 /* FIXME: all we need to duplicate are:
1272                  * - dn
1273                  * - ndn
1274                  * - attributes that are requested
1275                  * - no values if attrsonly is set
1276                  */
1277
1278                 e = entry_dup( e );
1279                 if ( e == NULL ) {
1280                         rc = LDAP_NO_MEMORY;
1281                         goto fail;
1282                 }
1283
1284                 flags &= ~REP_ENTRY_MUSTRELEASE;
1285                 flags |= ( REP_ENTRY_MODIFIABLE | REP_ENTRY_MUSTBEFREED );
1286         }
1287
1288         /*
1289          * Note: this may fail if the target host(s) schema differs
1290          * from the one known to the meta, and a DN with unknown
1291          * attributes is returned.
1292          */
1293         dn = e->e_name;
1294         ndn = e->e_nname;
1295         rc = rwm_dn_massage_pretty_normalize( &dc, &e->e_name, &dn, &ndn );
1296         if ( rc != LDAP_SUCCESS ) {
1297                 rc = 1;
1298                 goto fail;
1299         }
1300
1301         if ( e->e_name.bv_val != dn.bv_val ) {
1302                 ch_free( e->e_name.bv_val );
1303                 ch_free( e->e_nname.bv_val );
1304
1305                 e->e_name = dn;
1306                 e->e_nname = ndn;
1307         }
1308
1309         /* TODO: map entry attribute types, objectclasses
1310          * and dn-valued attribute values */
1311
1312         /* FIXME: the entries are in the remote mapping form;
1313          * so we need to select those attributes we are willing
1314          * to return, and remap them accordingly */
1315         (void)rwm_attrs( op, rs, &e->e_attrs, 1 );
1316
1317         if ( rs->sr_flags & REP_ENTRY_MUSTRELEASE ) {
1318                 be_entry_release_rw( op, rs->sr_entry, 0 );
1319         }
1320
1321         rs->sr_entry = e;
1322         rs->sr_flags = flags;
1323
1324         return SLAP_CB_CONTINUE;
1325
1326 fail:;
1327         if ( e != NULL && e != rs->sr_entry ) {
1328                 if ( e->e_name.bv_val == dn.bv_val ) {
1329                         BER_BVZERO( &e->e_name );
1330                 }
1331
1332                 if ( e->e_nname.bv_val == ndn.bv_val ) {
1333                         BER_BVZERO( &e->e_nname );
1334                 }
1335
1336                 entry_free( e );
1337         }
1338
1339         if ( !BER_BVISNULL( &dn ) ) {
1340                 ch_free( dn.bv_val );
1341         }
1342
1343         if ( !BER_BVISNULL( &ndn ) ) {
1344                 ch_free( ndn.bv_val );
1345         }
1346
1347         return rc;
1348 }
1349
1350 static int
1351 rwm_operational( Operation *op, SlapReply *rs )
1352 {
1353         /* FIXME: the entries are in the remote mapping form;
1354          * so we need to select those attributes we are willing
1355          * to return, and remap them accordingly */
1356         if ( rs->sr_operational_attrs ) {
1357                 rwm_attrs( op, rs, &rs->sr_operational_attrs, 1 );
1358         }
1359
1360         return SLAP_CB_CONTINUE;
1361 }
1362
1363 #if 0
1364 /* don't use this; it cannot be reverted, and leaves op->o_req_dn
1365  * rewritten for subsequent operations; fine for plain suffixmassage,
1366  * but destroys everything else */
1367 static int
1368 rwm_chk_referrals( Operation *op, SlapReply *rs )
1369 {
1370         slap_overinst           *on = (slap_overinst *) op->o_bd->bd_info;
1371         int                     rc;
1372
1373 #ifdef ENABLE_REWRITE
1374         rc = rwm_op_dn_massage( op, rs, "referralCheckDN" );
1375 #else /* ! ENABLE_REWRITE */
1376         rc = 1;
1377         rc = rwm_op_dn_massage( op, rs, &rc );
1378 #endif /* ! ENABLE_REWRITE */
1379         if ( rc != LDAP_SUCCESS ) {
1380                 op->o_bd->bd_info = (BackendInfo *)on->on_info;
1381                 send_ldap_error( op, rs, rc, "referralCheckDN massage error" );
1382                 return -1;
1383         }
1384
1385         return SLAP_CB_CONTINUE;
1386 }
1387 #endif
1388
1389 static int
1390 rwm_rw_config(
1391         BackendDB       *be,
1392         const char      *fname,
1393         int             lineno,
1394         int             argc,
1395         char            **argv )
1396 {
1397 #ifdef ENABLE_REWRITE
1398         slap_overinst           *on = (slap_overinst *) be->bd_info;
1399         struct ldaprwmap        *rwmap =
1400                         (struct ldaprwmap *)on->on_bi.bi_private;
1401
1402         return rewrite_parse( rwmap->rwm_rw,
1403                                 fname, lineno, argc, argv );
1404
1405 #else /* !ENABLE_REWRITE */
1406         fprintf( stderr, "%s: line %d: rewrite capabilities "
1407                         "are not enabled\n", fname, lineno );
1408 #endif /* !ENABLE_REWRITE */
1409
1410         return 0;
1411 }
1412
1413 static int
1414 rwm_suffixmassage_config(
1415         BackendDB       *be,
1416         const char      *fname,
1417         int             lineno,
1418         int             argc,
1419         char            **argv )
1420 {
1421         slap_overinst           *on = (slap_overinst *) be->bd_info;
1422         struct ldaprwmap        *rwmap =
1423                         (struct ldaprwmap *)on->on_bi.bi_private;
1424
1425         struct berval           bvnc, nvnc, pvnc, brnc, nrnc, prnc;
1426         int                     massaged;
1427 #ifdef ENABLE_REWRITE
1428         int                     rc;
1429 #endif /* ENABLE_REWRITE */
1430
1431         /*
1432          * syntax:
1433          *
1434          *      suffixmassage [<suffix>] <massaged suffix>
1435          *
1436          * the [<suffix>] field must be defined as a valid suffix
1437          * for the current database;
1438          * the <massaged suffix> shouldn't have already been
1439          * defined as a valid suffix for the current server
1440          */
1441         if ( argc == 2 ) {
1442                 if ( be->be_suffix == NULL ) {
1443                         fprintf( stderr, "%s: line %d: "
1444                                        " \"suffixMassage [<suffix>]"
1445                                        " <massaged suffix>\" without "
1446                                        "<suffix> part requires database "
1447                                        "suffix be defined first.\n",
1448                                 fname, lineno );
1449                         return 1;
1450                 }
1451                 bvnc = be->be_suffix[ 0 ];
1452                 massaged = 1;
1453
1454         } else if ( argc == 3 ) {
1455                 ber_str2bv( argv[ 1 ], 0, 0, &bvnc );
1456                 massaged = 2;
1457
1458         } else  {
1459                 fprintf( stderr, "%s: line %d: syntax is"
1460                                " \"suffixMassage [<suffix>]"
1461                                " <massaged suffix>\"\n",
1462                         fname, lineno );
1463                 return 1;
1464         }
1465
1466         if ( dnPrettyNormal( NULL, &bvnc, &pvnc, &nvnc, NULL ) != LDAP_SUCCESS ) {
1467                 fprintf( stderr, "%s: line %d: suffix DN %s is invalid\n",
1468                         fname, lineno, bvnc.bv_val );
1469                 return 1;
1470         }
1471
1472         ber_str2bv( argv[ massaged ], 0, 0, &brnc );
1473         if ( dnPrettyNormal( NULL, &brnc, &prnc, &nrnc, NULL ) != LDAP_SUCCESS ) {
1474                 fprintf( stderr, "%s: line %d: suffix DN %s is invalid\n",
1475                                 fname, lineno, brnc.bv_val );
1476                 free( nvnc.bv_val );
1477                 free( pvnc.bv_val );
1478                 return 1;
1479         }
1480
1481 #ifdef ENABLE_REWRITE
1482         /*
1483          * The suffix massaging is emulated
1484          * by means of the rewrite capabilities
1485          */
1486         rc = rwm_suffix_massage_config( rwmap->rwm_rw,
1487                         &pvnc, &nvnc, &prnc, &nrnc );
1488         free( nvnc.bv_val );
1489         free( pvnc.bv_val );
1490         free( nrnc.bv_val );
1491         free( prnc.bv_val );
1492
1493         return( rc );
1494
1495 #else /* !ENABLE_REWRITE */
1496         ber_bvarray_add( &rwmap->rwm_suffix_massage, &pvnc );
1497         ber_bvarray_add( &rwmap->rwm_suffix_massage, &nvnc );
1498
1499         ber_bvarray_add( &rwmap->rwm_suffix_massage, &prnc );
1500         ber_bvarray_add( &rwmap->rwm_suffix_massage, &nrnc );
1501 #endif /* !ENABLE_REWRITE */
1502
1503         return 0;
1504 }
1505
1506 static int
1507 rwm_m_config(
1508         BackendDB       *be,
1509         const char      *fname,
1510         int             lineno,
1511         int             argc,
1512         char            **argv )
1513 {
1514         slap_overinst           *on = (slap_overinst *) be->bd_info;
1515         struct ldaprwmap        *rwmap =
1516                         (struct ldaprwmap *)on->on_bi.bi_private;
1517
1518         /* objectclass/attribute mapping */
1519         return rwm_map_config( &rwmap->rwm_oc,
1520                         &rwmap->rwm_at,
1521                         fname, lineno, argc, argv );
1522 }
1523
1524 static int
1525 rwm_response( Operation *op, SlapReply *rs )
1526 {
1527         slap_overinst           *on = (slap_overinst *)op->o_bd->bd_info;
1528         struct ldaprwmap        *rwmap =
1529                         (struct ldaprwmap *)on->on_bi.bi_private;
1530
1531         int             rc;
1532
1533         if ( op->o_tag == LDAP_REQ_SEARCH && rs->sr_type == REP_SEARCH ) {
1534                 return rwm_send_entry( op, rs );
1535         }
1536
1537         switch( op->o_tag ) {
1538         case LDAP_REQ_SEARCH:
1539         case LDAP_REQ_BIND:
1540         case LDAP_REQ_ADD:
1541         case LDAP_REQ_DELETE:
1542         case LDAP_REQ_MODRDN:
1543         case LDAP_REQ_MODIFY:
1544         case LDAP_REQ_COMPARE:
1545         case LDAP_REQ_EXTENDED:
1546                 if ( rs->sr_ref ) {
1547                         dncookie                dc;
1548
1549                         /*
1550                          * Rewrite the dn of the referrals, if needed
1551                          */
1552                         dc.rwmap = rwmap;
1553 #ifdef ENABLE_REWRITE
1554                         dc.conn = op->o_conn;
1555                         dc.rs = NULL;
1556                         dc.ctx = "referralDN";
1557 #else /* ! ENABLE_REWRITE */
1558                         dc.tofrom = 0;
1559                         dc.normalized = 0;
1560 #endif /* ! ENABLE_REWRITE */
1561                         rc = rwm_referral_result_rewrite( &dc, rs->sr_ref );
1562                         if ( rc != LDAP_SUCCESS ) {
1563                                 rc = 1;
1564                                 break;
1565                         }
1566                 }
1567                 rc = rwm_matched( op, rs );
1568                 break;
1569
1570         default:
1571                 rc = SLAP_CB_CONTINUE;
1572                 break;
1573         }
1574
1575         return rc;
1576 }
1577
1578 static int
1579 rwm_db_config(
1580         BackendDB       *be,
1581         const char      *fname,
1582         int             lineno,
1583         int             argc,
1584         char            **argv )
1585 {
1586         slap_overinst           *on = (slap_overinst *) be->bd_info;
1587         struct ldaprwmap        *rwmap =
1588                         (struct ldaprwmap *)on->on_bi.bi_private;
1589
1590         int             rc = 0;
1591         char            *argv0 = NULL;
1592
1593         if ( strncasecmp( argv[ 0 ], "rwm-", STRLENOF( "rwm-" ) ) == 0 ) {
1594                 argv0 = argv[ 0 ];
1595                 argv[ 0 ] = &argv0[ STRLENOF( "rwm-" ) ];
1596         }
1597
1598         if ( strncasecmp( argv[0], "rewrite", STRLENOF("rewrite") ) == 0 ) {
1599                 rc = rwm_rw_config( be, fname, lineno, argc, argv );
1600
1601         } else if ( strcasecmp( argv[0], "map" ) == 0 ) {
1602                 rc = rwm_m_config( be, fname, lineno, argc, argv );
1603
1604         } else if ( strcasecmp( argv[0], "suffixmassage" ) == 0 ) {
1605                 rc = rwm_suffixmassage_config( be, fname, lineno, argc, argv );
1606
1607         } else if ( strcasecmp( argv[0], "t-f-support" ) == 0 ) {
1608                 if ( argc != 2 ) {
1609                         fprintf( stderr,
1610                 "%s: line %d: \"t-f-support {no|yes|discover}\" needs 1 argument.\n",
1611                                         fname, lineno );
1612                         return( 1 );
1613                 }
1614
1615                 if ( strcasecmp( argv[ 1 ], "no" ) == 0 ) {
1616                         rwmap->rwm_flags &= ~(RWM_F_SUPPORT_T_F|RWM_F_SUPPORT_T_F_DISCOVER);
1617
1618                 } else if ( strcasecmp( argv[ 1 ], "yes" ) == 0 ) {
1619                         rwmap->rwm_flags |= RWM_F_SUPPORT_T_F;
1620
1621                 /* TODO: not implemented yet */
1622                 } else if ( strcasecmp( argv[ 1 ], "discover" ) == 0 ) {
1623                         fprintf( stderr,
1624                 "%s: line %d: \"discover\" not supported yet "
1625                 "in \"t-f-support {no|yes|discover}\".\n",
1626                                         fname, lineno );
1627                         return( 1 );
1628 #if 0
1629                         rwmap->rwm_flags |= RWM_F_SUPPORT_T_F_DISCOVER;
1630 #endif
1631
1632                 } else {
1633                         fprintf( stderr,
1634         "%s: line %d: unknown value \"%s\" for \"t-f-support {no|yes|discover}\".\n",
1635                                 fname, lineno, argv[ 1 ] );
1636                         return 1;
1637                 }
1638
1639         } else {
1640                 rc = SLAP_CONF_UNKNOWN;
1641         }
1642
1643         if ( argv0 ) {
1644                 argv[ 0 ] = argv0;
1645         }
1646
1647         return rc;
1648 }
1649
1650 static int
1651 rwm_db_init(
1652         BackendDB       *be )
1653 {
1654         slap_overinst           *on = (slap_overinst *) be->bd_info;
1655         struct ldaprwmap        *rwmap;
1656 #ifdef ENABLE_REWRITE
1657         char                    *rargv[ 3 ];
1658 #endif /* ENABLE_REWRITE */
1659         int                     rc = 0;
1660
1661         rwmap = (struct ldaprwmap *)ch_calloc( 1, sizeof( struct ldaprwmap ) );
1662
1663 #ifdef ENABLE_REWRITE
1664         rwmap->rwm_rw = rewrite_info_init( REWRITE_MODE_USE_DEFAULT );
1665         if ( rwmap->rwm_rw == NULL ) {
1666                 rc = -1;
1667                 goto error_return;
1668         }
1669
1670         /* this rewriteContext by default must be null;
1671          * rules can be added if required */
1672         rargv[ 0 ] = "rewriteContext";
1673         rargv[ 1 ] = "searchFilter";
1674         rargv[ 2 ] = NULL;
1675         rewrite_parse( rwmap->rwm_rw, "<suffix massage>", 1, 2, rargv );
1676
1677         rargv[ 0 ] = "rewriteContext";
1678         rargv[ 1 ] = "default";
1679         rargv[ 2 ] = NULL;
1680         rewrite_parse( rwmap->rwm_rw, "<suffix massage>", 2, 2, rargv );
1681 #endif /* ENABLE_REWRITE */
1682
1683 error_return:;
1684         on->on_bi.bi_private = (void *)rwmap;
1685
1686         if ( rc ) {
1687                 (void)rwm_db_destroy( be );
1688         }
1689
1690         return rc;
1691 }
1692
1693 static int
1694 rwm_db_destroy(
1695         BackendDB       *be )
1696 {
1697         slap_overinst   *on = (slap_overinst *) be->bd_info;
1698         int             rc = 0;
1699
1700         if ( on->on_bi.bi_private ) {
1701                 struct ldaprwmap        *rwmap =
1702                         (struct ldaprwmap *)on->on_bi.bi_private;
1703
1704 #ifdef ENABLE_REWRITE
1705                 if ( rwmap->rwm_rw ) {
1706                         rewrite_info_delete( &rwmap->rwm_rw );
1707                 }
1708 #else /* !ENABLE_REWRITE */
1709                 if ( rwmap->rwm_suffix_massage ) {
1710                         ber_bvarray_free( rwmap->rwm_suffix_massage );
1711                 }
1712 #endif /* !ENABLE_REWRITE */
1713
1714                 avl_free( rwmap->rwm_oc.remap, rwm_mapping_dst_free );
1715                 avl_free( rwmap->rwm_oc.map, rwm_mapping_free );
1716                 avl_free( rwmap->rwm_at.remap, rwm_mapping_dst_free );
1717                 avl_free( rwmap->rwm_at.map, rwm_mapping_free );
1718
1719                 ch_free( rwmap );
1720         }
1721
1722         return rc;
1723 }
1724
1725 static slap_overinst rwm = { { NULL } };
1726
1727 #if SLAPD_OVER_RWM == SLAPD_MOD_DYNAMIC
1728 static
1729 #endif /* SLAPD_OVER_RWM == SLAPD_MOD_DYNAMIC */
1730 int
1731 rwm_initialize( void )
1732 {
1733         memset( &rwm, 0, sizeof( slap_overinst ) );
1734
1735         rwm.on_bi.bi_type = "rwm";
1736
1737         rwm.on_bi.bi_db_init = rwm_db_init;
1738         rwm.on_bi.bi_db_config = rwm_db_config;
1739         rwm.on_bi.bi_db_destroy = rwm_db_destroy;
1740
1741         rwm.on_bi.bi_op_bind = rwm_op_bind;
1742         rwm.on_bi.bi_op_search = rwm_op_search;
1743         rwm.on_bi.bi_op_compare = rwm_op_compare;
1744         rwm.on_bi.bi_op_modify = rwm_op_modify;
1745         rwm.on_bi.bi_op_modrdn = rwm_op_modrdn;
1746         rwm.on_bi.bi_op_add = rwm_op_add;
1747         rwm.on_bi.bi_op_delete = rwm_op_delete;
1748         rwm.on_bi.bi_op_unbind = rwm_op_unbind;
1749         rwm.on_bi.bi_extended = rwm_extended;
1750
1751         rwm.on_bi.bi_operational = rwm_operational;
1752         rwm.on_bi.bi_chk_referrals = 0 /* rwm_chk_referrals */ ;
1753
1754 #ifdef ENABLE_REWRITE
1755         rwm.on_bi.bi_connection_init = rwm_conn_init;
1756         rwm.on_bi.bi_connection_destroy = rwm_conn_destroy;
1757 #endif /* ENABLE_REWRITE */
1758
1759         rwm.on_response = rwm_response;
1760
1761         return overlay_register( &rwm );
1762 }
1763
1764 #if SLAPD_OVER_RWM == SLAPD_MOD_DYNAMIC
1765 int
1766 init_module( int argc, char *argv[] )
1767 {
1768         return rwm_initialize();
1769 }
1770 #endif /* SLAPD_OVER_RWM == SLAPD_MOD_DYNAMIC */
1771
1772 #endif /* SLAPD_OVER_RWM */