1 /* translucent.c - translucent proxy module */
3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
5 * Copyright 2004-2006 The OpenLDAP Foundation.
6 * Portions Copyright 2005 Symas Corporation.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted only as authorized by the OpenLDAP
13 * A copy of this license is available in the file LICENSE in the
14 * top-level directory of the distribution or, alternatively, at
15 * <http://www.OpenLDAP.org/license.html>.
18 * This work was initially developed by Symas Corp. for inclusion in
19 * OpenLDAP Software. This work was sponsored by Hewlett-Packard.
24 #ifdef SLAPD_OVER_TRANSLUCENT
28 #include <ac/string.h>
29 #include <ac/socket.h>
35 typedef struct translucent_info {
36 BackendInfo *info; /* captive backend */
37 void *private; /* local backend_private */
42 /* for translucent_init() */
44 static slap_overinst translucent;
48 ** call syncrepl_add_glue() with the parent suffix;
52 static struct berval glue[] = { BER_BVC("top"), BER_BVC("glue"), BER_BVNULL };
54 void glue_parent(Operation *op) {
56 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
57 struct berval ndn = BER_BVNULL;
62 dnParent( &op->o_req_ndn, &pdn );
63 ber_dupbv_x( &ndn, &pdn, op->o_tmpmemctx );
65 Debug(LDAP_DEBUG_TRACE, "=> glue_parent: fabricating glue for <%s>\n", ndn.bv_val, 0, 0);
67 e = ch_calloc(1, sizeof(Entry));
69 ber_dupbv(&e->e_name, &ndn);
70 ber_dupbv(&e->e_nname, &ndn);
72 a = ch_calloc(1, sizeof(Attribute));
73 a->a_desc = slap_schema.si_ad_objectClass;
74 a->a_vals = ch_malloc(sizeof(struct berval) * 3);
75 ber_dupbv(&a->a_vals[0], &glue[0]);
76 ber_dupbv(&a->a_vals[1], &glue[1]);
77 ber_dupbv(&a->a_vals[2], &glue[2]);
78 a->a_nvals = a->a_vals;
79 a->a_next = e->e_attrs;
82 a = ch_calloc(1, sizeof(Attribute));
83 a->a_desc = slap_schema.si_ad_structuralObjectClass;
84 a->a_vals = ch_malloc(sizeof(struct berval) * 2);
85 ber_dupbv(&a->a_vals[0], &glue[1]);
86 ber_dupbv(&a->a_vals[1], &glue[2]);
87 a->a_nvals = a->a_vals;
88 a->a_next = e->e_attrs;
94 nop.o_bd->bd_info = (BackendInfo *) on->on_info->oi_orig;
96 syncrepl_add_glue(&nop, e);
98 op->o_tmpfree( ndn.bv_val, op->o_tmpmemctx );
108 BerVarray dup_bervarray(BerVarray b) {
111 for(len = 0; b[len].bv_val; len++);
112 nb = ch_malloc((len+1) * sizeof(BerValue));
113 for(i = 0; i < len; i++) ber_dupbv(&nb[i], &b[i]);
114 nb[len].bv_val = NULL;
121 ** free only the Attribute*, not the contents;
124 void free_attr_chain(Attribute *a) {
135 ** if not bound as root, send ACCESS error;
136 ** if glue, glue_parent();
141 static int translucent_add(Operation *op, SlapReply *rs) {
142 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
143 translucent_info *ov = on->on_bi.bi_private;
144 Debug(LDAP_DEBUG_TRACE, "==> translucent_add: %s\n",
145 op->o_req_dn.bv_val, 0, 0);
147 op->o_bd->bd_info = (BackendInfo *) on->on_info;
148 send_ldap_error(op, rs, LDAP_INSUFFICIENT_ACCESS,
149 "user modification of overlay database not permitted");
152 if(!ov->glue) glue_parent(op);
153 return(SLAP_CB_CONTINUE);
157 ** translucent_modrdn()
158 ** if not bound as root, send ACCESS error;
159 ** if !glue, glue_parent();
160 ** else return CONTINUE;
164 static int translucent_modrdn(Operation *op, SlapReply *rs) {
165 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
166 translucent_info *ov = on->on_bi.bi_private;
167 Debug(LDAP_DEBUG_TRACE, "==> translucent_modrdn: %s -> %s\n",
168 op->o_req_dn.bv_val, op->orr_newrdn.bv_val, 0);
170 op->o_bd->bd_info = (BackendInfo *) on->on_info;
171 send_ldap_error(op, rs, LDAP_INSUFFICIENT_ACCESS,
172 "user modification of overlay database not permitted");
175 if(!ov->glue) glue_parent(op);
176 return(SLAP_CB_CONTINUE);
180 ** translucent_delete()
181 ** if not bound as root, send ACCESS error;
182 ** else return CONTINUE;
186 static int translucent_delete(Operation *op, SlapReply *rs) {
187 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
188 Debug(LDAP_DEBUG_TRACE, "==> translucent_delete: %s\n",
189 op->o_req_dn.bv_val, 0, 0);
191 op->o_bd->bd_info = (BackendInfo *) on->on_info;
192 send_ldap_error(op, rs, LDAP_INSUFFICIENT_ACCESS,
193 "user modification of overlay database not permitted");
196 return(SLAP_CB_CONTINUE);
200 translucent_tag_cb( Operation *op, SlapReply *rs )
202 op->o_tag = LDAP_REQ_MODIFY;
203 op->orm_modlist = op->o_callback->sc_private;
204 rs->sr_tag = slap_req2res( op->o_tag );
206 return SLAP_CB_CONTINUE;
210 ** translucent_modify()
211 ** modify in local backend if exists in both;
212 ** otherwise, add to local backend;
213 ** fail if not defined in captive backend;
217 static int translucent_modify(Operation *op, SlapReply *rs) {
218 SlapReply nrs = { REP_RESULT };
221 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
222 translucent_info *ov = on->on_bi.bi_private;
223 void *private = op->o_bd->be_private;
224 Entry ne, *e = NULL, *re = NULL;
226 Modifications *m, *mm;
227 int del, rc, erc = 0;
228 slap_callback cb = { 0 };
230 Debug(LDAP_DEBUG_TRACE, "==> translucent_modify: %s\n",
231 op->o_req_dn.bv_val, 0, 0);
234 ** fetch entry from the captive backend;
235 ** if it did not exist, fail;
236 ** release it, if captive backend supports this;
240 op->o_bd->bd_info = (BackendInfo *) on->on_info;
241 op->o_bd->be_private = ov->private;
242 rc = ov->info->bi_entry_get_rw(op, &op->o_req_ndn, NULL, NULL, 0, &re);
243 op->o_bd->be_private = private;
245 if(rc != LDAP_SUCCESS || re == NULL ) {
246 send_ldap_error(op, rs, LDAP_NO_SUCH_OBJECT,
247 "attempt to modify nonexistent local record");
252 ** fetch entry from local backend;
254 ** foreach Modification:
255 ** if attr not present in local:
256 ** if Mod == LDAP_MOD_DELETE:
257 ** if remote attr not present, return NO_SUCH;
258 ** if remote attr present, drop this Mod;
259 ** else force this Mod to LDAP_MOD_ADD;
264 rc = be_entry_get_rw(op, &op->o_req_ndn, NULL, NULL, 0, &e);
266 if(e && rc == LDAP_SUCCESS) {
267 Debug(LDAP_DEBUG_TRACE, "=> translucent_modify: found local entry\n", 0, 0, 0);
268 for(m = op->orm_modlist; m; m = m->sml_next) {
269 for(a = e->e_attrs; a; a = a->a_next)
270 if(a->a_desc == m->sml_desc) break;
271 if(a) continue; /* found local attr */
272 if(m->sml_op == LDAP_MOD_DELETE) {
273 for(a = re->e_attrs; a; a = a->a_next)
274 if(a->a_desc == m->sml_desc) break;
275 /* not found remote attr */
277 erc = LDAP_NO_SUCH_ATTRIBUTE;
281 erc = LDAP_CONSTRAINT_VIOLATION;
284 Debug(LDAP_DEBUG_TRACE,
285 "=> translucent_modify: silently dropping delete: %s\n",
286 m->sml_desc->ad_cname.bv_val, 0, 0);
287 for(mm = op->orm_modlist; mm->sml_next != m; mm = mm->sml_next);
288 mm->sml_next = m->sml_next;
291 mm->sml_next = NULL; /* hack */
292 slap_mods_free(mm, 1);
295 m->sml_op = LDAP_MOD_ADD;
297 erc = SLAP_CB_CONTINUE;
300 op->o_bd->be_private = ov->private;
301 if(ov->info->bi_entry_release_rw)
302 ov->info->bi_entry_release_rw(op, re, 0);
305 op->o_bd->be_private = private;
307 be_entry_release_r(op, e);
308 if(erc == SLAP_CB_CONTINUE) {
309 op->o_bd->bd_info = (BackendInfo *) on;
312 send_ldap_error(op, rs, erc,
313 "attempt to delete nonexistent attribute");
318 /* don't leak remote entry copy */
320 op->o_bd->be_private = ov->private;
321 if(ov->info->bi_entry_release_rw)
322 ov->info->bi_entry_release_rw(op, re, 0);
325 op->o_bd->be_private = private;
328 ** foreach Modification:
329 ** if MOD_ADD or MOD_REPLACE, add Attribute;
330 ** if no Modifications were suitable:
331 ** if strict, throw CONSTRAINT_VIOLATION;
332 ** else, return early SUCCESS;
333 ** fabricate Entry with new Attribute chain;
334 ** glue_parent() for this Entry;
335 ** call bi_op_add() in local backend;
339 Debug(LDAP_DEBUG_TRACE, "=> translucent_modify: fabricating local add\n", 0, 0, 0);
341 for(del = 0, ax = NULL, m = op->orm_modlist; m; m = m->sml_next) {
342 if(((m->sml_op & LDAP_MOD_OP) != LDAP_MOD_ADD) &&
343 ((m->sml_op & LDAP_MOD_OP) != LDAP_MOD_REPLACE)) {
344 Debug(LDAP_DEBUG_ANY,
345 "=> translucent_modify: silently dropped modification(%d): %s\n",
346 m->sml_op, m->sml_desc->ad_cname.bv_val, 0);
347 if((m->sml_op & LDAP_MOD_OP) == LDAP_MOD_DELETE) del++;
350 a = ch_calloc(1, sizeof(Attribute));
351 a->a_desc = m->sml_desc;
352 a->a_vals = m->sml_values;
353 a->a_nvals = m->sml_nvalues;
358 if(del && ov->strict) {
360 send_ldap_error(op, rs, LDAP_CONSTRAINT_VIOLATION,
361 "attempt to delete attributes from local database");
367 send_ldap_error(op, rs, LDAP_CONSTRAINT_VIOLATION,
368 "modification contained other than ADD or REPLACE");
371 op->o_bd->bd_info = (BackendInfo *) on;
372 /* rs->sr_text = "no valid modification found"; */
373 rs->sr_err = LDAP_SUCCESS;
374 send_ldap_result(op, rs);
379 ne.e_name = op->o_req_dn;
380 ne.e_nname = op->o_req_ndn;
384 ne.e_bv.bv_val = NULL;
387 nop.o_tag = LDAP_REQ_ADD;
388 nop.oq_add.rs_e = ≠
390 op->o_bd->bd_info = (BackendInfo *) on;
393 cb.sc_response = translucent_tag_cb;
394 cb.sc_private = op->orm_modlist;
395 cb.sc_next = nop.o_callback;
396 nop.o_callback = &cb;
397 rc = on->on_info->oi_orig->bi_op_add(&nop, &nrs);
403 static int translucent_compare(Operation *op, SlapReply *rs) {
404 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
405 translucent_info *ov = on->on_bi.bi_private;
406 void *private = op->o_bd->be_private;
408 AttributeAssertion *ava = op->orc_ava;
412 Debug(LDAP_DEBUG_TRACE, "==> translucent_compare: <%s> %s:%s\n",
413 op->o_req_dn.bv_val, ava->aa_desc->ad_cname.bv_val, ava->aa_value.bv_val);
416 ** if the local backend has an entry for this attribute:
417 ** CONTINUE and let it do the compare;
421 op->o_bd->bd_info = (BackendInfo *) on->on_info;
422 rc = be_entry_get_rw(op, &op->o_req_ndn, NULL, ava->aa_desc, 0, &e);
423 if(e && rc == LDAP_SUCCESS) {
424 be_entry_release_r(op, e);
425 op->o_bd->bd_info = (BackendInfo *) on;
426 return(SLAP_CB_CONTINUE);
430 ** call compare() in the captive backend;
431 ** return the result;
435 op->o_bd->be_private = ov->private;
436 rc = ov->info->bi_op_compare(op, rs);
437 op->o_bd->be_private = private;
438 op->o_bd->bd_info = (BackendInfo *) on;
443 ** translucent_search_cb()
444 ** merge local data with the search result
448 static int translucent_search_cb(Operation *op, SlapReply *rs) {
450 Entry *e, *re = NULL;
451 Attribute *a, *ax, *an, *as = NULL;
455 if(!op || !rs || rs->sr_type != REP_SEARCH || !rs->sr_entry)
456 return(SLAP_CB_CONTINUE);
458 Debug(LDAP_DEBUG_TRACE, "==> tranclucent_search_cb: %s\n",
459 rs->sr_entry->e_name.bv_val, 0, 0);
461 on = (slap_overinst *) op->o_bd->bd_info;
462 op->o_bd->bd_info = (BackendInfo *) on->on_info;
464 private = op->o_bd->be_private;
465 op->o_bd->be_private = op->o_callback->sc_private;
467 rc = be_entry_get_rw(op, &rs->sr_entry->e_nname, NULL, NULL, 0, &e);
470 ** if we got an entry from local backend:
471 ** make a copy of this search result;
472 ** foreach local attr:
473 ** foreach search result attr:
474 ** if match, result attr with local attr;
475 ** if new local, add to list;
476 ** append new local attrs to search result;
480 if(e && rc == LDAP_SUCCESS) {
481 re = entry_dup(rs->sr_entry);
482 for(ax = e->e_attrs; ax; ax = ax->a_next) {
484 if(is_at_operational(ax->a_desc->ad_type)) continue;
486 for(a = re->e_attrs; a; a = a->a_next) {
487 if(a->a_desc == ax->a_desc) {
488 if(a->a_vals != a->a_nvals)
489 ber_bvarray_free(a->a_nvals);
490 ber_bvarray_free(a->a_vals);
491 a->a_vals = dup_bervarray(ax->a_vals);
492 a->a_nvals = (ax->a_vals == ax->a_nvals) ?
493 a->a_vals : dup_bervarray(ax->a_nvals);
502 be_entry_release_r(op, e);
504 /* literally append, so locals are always last */
507 for(ax = re->e_attrs; ax->a_next; ax = ax->a_next);
514 rs->sr_flags |= REP_ENTRY_MUSTBEFREED;
517 op->o_bd->be_private = private;
518 op->o_bd->bd_info = (BackendInfo *) on;
520 return(SLAP_CB_CONTINUE);
524 ** translucent_search()
525 ** search via captive backend;
526 ** override results with any local data;
530 static int translucent_search(Operation *op, SlapReply *rs) {
533 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
534 slap_callback cb = { NULL, NULL, NULL, NULL };
535 translucent_info *ov = on->on_bi.bi_private;
536 void *private = op->o_bd->be_private;
539 Debug(LDAP_DEBUG_TRACE, "==> translucent_search: <%s> %s\n",
540 op->o_req_dn.bv_val, op->ors_filterstr.bv_val, 0);
541 cb.sc_response = (slap_response *) translucent_search_cb;
542 cb.sc_private = private;
544 cb.sc_next = nop.o_callback;
545 nop.o_callback = &cb;
547 op->o_bd->be_private = ov->private;
548 rc = ov->info->bi_op_search(&nop, rs);
549 op->o_bd->be_private = private;
556 ** translucent_bind()
557 ** pass bind request to captive backend;
561 static int translucent_bind(Operation *op, SlapReply *rs) {
562 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
563 translucent_info *ov = on->on_bi.bi_private;
564 void *private = op->o_bd->be_private;
567 Debug(LDAP_DEBUG_TRACE, "translucent_bind: <%s> method %d\n",
568 op->o_req_dn.bv_val, op->orb_method, 0);
570 op->o_bd->be_private = ov->private;
571 rc = ov->info->bi_op_bind(op, rs);
572 op->o_bd->be_private = private;
578 ** translucent_connection_destroy()
579 ** pass disconnect notification to captive backend;
583 static int translucent_connection_destroy(BackendDB *be, Connection *conn) {
584 slap_overinst *on = (slap_overinst *) be->bd_info;
585 translucent_info *ov = on->on_bi.bi_private;
586 void *private = be->be_private;
589 Debug(LDAP_DEBUG_TRACE, "translucent_connection_destroy\n", 0, 0, 0);
591 be->be_private = ov->private;
592 rc = ov->info->bi_connection_destroy(be, conn);
593 be->be_private = private;
599 ** translucent_db_config()
600 ** pass config directives to captive backend;
601 ** parse unrecognized directives ourselves;
605 static int translucent_db_config(
613 slap_overinst *on = (slap_overinst *) be->bd_info;
614 translucent_info *ov = on->on_bi.bi_private;
615 void *private = be->be_private;
616 void *be_cf_ocs = be->be_cf_ocs;
619 /* "this should never happen" */
621 fprintf(stderr, "fatal: captive backend not initialized");
625 be->be_private = ov->private;
626 be->be_cf_ocs = ov->info->bi_cf_ocs;
627 rc = ov->info->bi_db_config ? ov->info->bi_db_config(be, fname, lineno, argc, argv) : 0;
628 be->be_private = private;
629 be->be_cf_ocs = be_cf_ocs;
631 /* pass okay or error up, SLAP_CONF_UNKNOWN might be ours */
632 if(rc == 0 || rc == 1) return(rc);
635 if(!strcasecmp(*argv, "translucent_strict")) {
637 } else if(!strcasecmp(*argv, "translucent_no_glue")) {
640 fprintf(stderr, "%s: line %d: unknown keyword %s\n",
641 fname, lineno, *argv);
642 rc = SLAP_CONF_UNKNOWN;
648 ** translucent_db_init()
649 ** initialize the captive backend;
653 static int translucent_db_init(BackendDB *be) {
654 slap_overinst *on = (slap_overinst *) be->bd_info;
655 void *private = be->be_private;
656 translucent_info *ov;
659 Debug(LDAP_DEBUG_TRACE, "==> translucent_init\n", 0, 0, 0);
661 ov = ch_calloc(1, sizeof(translucent_info));
662 ov->info = backend_info("ldap");
666 Debug(LDAP_DEBUG_ANY, "translucent: backend_info failed!\n", 0, 0, 0);
670 /* forcibly disable schema checking on the local backend */
671 SLAP_DBFLAGS(be) |= SLAP_DBFLAG_NO_SCHEMA_CHECK;
673 be->be_private = NULL;
674 rc = ov->info->bi_db_init ? ov->info->bi_db_init(be) : 0;
676 if(rc) Debug(LDAP_DEBUG_TRACE,
677 "translucent: bi_db_init() returned error %d\n", rc, 0, 0);
679 ov->private = be->be_private;
680 be->be_private = private;
681 on->on_bi.bi_private = ov;
686 ** translucent_db_open()
687 ** if the captive backend has an open() method, call it;
691 static int translucent_db_open(BackendDB *be) {
692 slap_overinst *on = (slap_overinst *) be->bd_info;
693 translucent_info *ov = on->on_bi.bi_private;
694 void *private = be->be_private;
697 /* "should never happen" */
699 Debug(LDAP_DEBUG_ANY, "translucent_open() called with bad ov->info\n", 0, 0, 0);
703 Debug(LDAP_DEBUG_TRACE, "translucent_open\n", 0, 0, 0);
705 be->be_private = ov->private;
706 rc = ov->info->bi_db_open ? ov->info->bi_db_open(be) : 0;
707 be->be_private = private;
709 if(rc) Debug(LDAP_DEBUG_TRACE,
710 "translucent: bi_db_open() returned error %d\n", rc, 0, 0);
716 ** translucent_db_close()
717 ** if the captive backend has a close() method, call it;
718 ** free any config data;
722 static int translucent_db_close(BackendDB *be) {
723 slap_overinst *on = (slap_overinst *) be->bd_info;
724 translucent_info *ov = on->on_bi.bi_private;
728 void *private = be->be_private;
730 be->be_private = ov->private;
731 rc = (ov->info && ov->info->bi_db_close) ? ov->info->bi_db_close(be) : 0;
732 be->be_private = private;
739 ** translucent_db_destroy()
740 ** if the captive backend has a db_destroy() method, call it
744 static int translucent_db_destroy(BackendDB *be) {
745 slap_overinst *on = (slap_overinst *) be->bd_info;
746 translucent_info *ov = on->on_bi.bi_private;
750 void *private = be->be_private;
752 be->be_private = ov->private;
753 rc = (ov->info && ov->info->bi_db_destroy) ? ov->info->bi_db_destroy(be) : 0;
754 be->be_private = private;
756 on->on_bi.bi_private = NULL;
763 ** translucent_initialize()
764 ** initialize the slap_overinst with our entry points;
768 int translucent_initialize() {
770 translucent.on_bi.bi_type = "translucent";
771 translucent.on_bi.bi_db_init = translucent_db_init;
772 translucent.on_bi.bi_db_config = translucent_db_config;
773 translucent.on_bi.bi_db_open = translucent_db_open;
774 translucent.on_bi.bi_db_close = translucent_db_close;
775 translucent.on_bi.bi_db_destroy = translucent_db_destroy;
776 translucent.on_bi.bi_op_bind = translucent_bind;
777 translucent.on_bi.bi_op_add = translucent_add;
778 translucent.on_bi.bi_op_modify = translucent_modify;
779 translucent.on_bi.bi_op_modrdn = translucent_modrdn;
780 translucent.on_bi.bi_op_delete = translucent_delete;
781 translucent.on_bi.bi_op_search = translucent_search;
782 translucent.on_bi.bi_op_compare = translucent_compare;
783 translucent.on_bi.bi_connection_destroy = translucent_connection_destroy;
785 return(overlay_register(&translucent));
788 #if SLAPD_OVER_TRANSLUCENT == SLAPD_MOD_DYNAMIC && defined(PIC)
789 int init_module(int argc, char *argv[]) {
790 return translucent_initialize();
794 #endif /* SLAPD_OVER_TRANSLUCENT */