1 /* translucent.c - translucent proxy module */
3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
5 * Copyright 2004-2005 The OpenLDAP Foundation.
6 * Portions Copyright 2005 Symas Corporation.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted only as authorized by the OpenLDAP
13 * A copy of this license is available in the file LICENSE in the
14 * top-level directory of the distribution or, alternatively, at
15 * <http://www.OpenLDAP.org/license.html>.
18 * This work was initially developed by Symas Corp. for inclusion in
19 * OpenLDAP Software. This work was sponsored by Hewlett-Packard.
24 #ifdef SLAPD_OVER_TRANSLUCENT
28 #include <ac/string.h>
29 #include <ac/socket.h>
36 typedef struct translucent_configuration {
41 } translucent_configuration;
43 /* stack of captive backends */
45 typedef struct overlay_stack {
46 BackendInfo *info; /* captive backend */
47 void *private; /* local backend_private */
48 translucent_configuration *config; /* our_private: configuration */
51 /* for translucent_init() */
53 static slap_overinst translucent;
57 ** call syncrepl_add_glue() with the parent suffix;
61 static struct berval glue[] = { BER_BVC("top"), BER_BVC("glue"), BER_BVNULL };
63 void glue_parent(Operation *op) {
65 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
66 struct berval dn = { 0, NULL };
71 dnParent( &op->o_req_ndn, &pdn );
72 ber_dupbv( &dn, &pdn );
74 Debug(LDAP_DEBUG_TRACE, "=> glue_parent: fabricating glue for <%s>\n", dn.bv_val, 0, 0);
76 e = ch_calloc(1, sizeof(Entry));
78 ber_dupbv(&e->e_name, &dn);
79 ber_dupbv(&e->e_nname, &dn);
81 a = ch_calloc(1, sizeof(Attribute));
82 a->a_desc = slap_schema.si_ad_objectClass;
83 a->a_vals = ch_malloc(sizeof(struct berval) * 3);
84 ber_dupbv(&a->a_vals[0], &glue[0]);
85 ber_dupbv(&a->a_vals[1], &glue[1]);
86 ber_dupbv(&a->a_vals[2], &glue[2]);
87 a->a_nvals = a->a_vals;
88 a->a_next = e->e_attrs;
91 a = ch_calloc(1, sizeof(Attribute));
92 a->a_desc = slap_schema.si_ad_structuralObjectClass;
93 a->a_vals = ch_malloc(sizeof(struct berval) * 2);
94 ber_dupbv(&a->a_vals[0], &glue[1]);
95 ber_dupbv(&a->a_vals[1], &glue[2]);
96 a->a_nvals = a->a_vals;
97 a->a_next = e->e_attrs;
103 nop.o_bd->bd_info = (BackendInfo *) on->on_info->oi_orig;
105 syncrepl_add_glue(&nop, e);
114 BerVarray dup_bervarray(BerVarray b) {
117 for(len = 0; b[len].bv_val; len++);
118 nb = ch_malloc((len+1) * sizeof(BerValue));
119 for(i = 0; i < len; i++) ber_dupbv(&nb[i], &b[i]);
120 nb[len].bv_val = NULL;
127 ** free only the Attribute*, not the contents;
130 void free_attr_chain(Attribute *a) {
132 for(ax = NULL; a; a = a->a_next) {
141 ** if not bound as root, send ACCESS error;
142 ** if config.glue, glue_parent();
147 static int translucent_add(Operation *op, SlapReply *rs) {
148 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
149 overlay_stack *ov = on->on_bi.bi_private;
150 Debug(LDAP_DEBUG_TRACE, "==> translucent_add: %s\n",
151 op->o_req_dn.bv_val, 0, 0);
153 op->o_bd->bd_info = (BackendInfo *) on->on_info;
154 send_ldap_error(op, rs, LDAP_INSUFFICIENT_ACCESS,
155 "user modification of overlay database not permitted");
158 if(!ov->config->glue) glue_parent(op);
159 return(SLAP_CB_CONTINUE);
163 ** translucent_modrdn()
164 ** if not bound as root, send ACCESS error;
165 ** if !config.glue, glue_parent();
166 ** else return CONTINUE;
170 static int translucent_modrdn(Operation *op, SlapReply *rs) {
171 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
172 overlay_stack *ov = on->on_bi.bi_private;
173 Debug(LDAP_DEBUG_TRACE, "==> translucent_modrdn: %s -> %s\n",
174 op->o_req_dn.bv_val, op->orr_newrdn.bv_val, 0);
176 op->o_bd->bd_info = (BackendInfo *) on->on_info;
177 send_ldap_error(op, rs, LDAP_INSUFFICIENT_ACCESS,
178 "user modification of overlay database not permitted");
181 if(!ov->config->glue) glue_parent(op);
182 return(SLAP_CB_CONTINUE);
186 ** translucent_delete()
187 ** if not bound as root, send ACCESS error;
188 ** else return CONTINUE;
192 static int translucent_delete(Operation *op, SlapReply *rs) {
193 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
194 Debug(LDAP_DEBUG_TRACE, "==> translucent_delete: %s\n",
195 op->o_req_dn.bv_val, 0, 0);
197 op->o_bd->bd_info = (BackendInfo *) on->on_info;
198 send_ldap_error(op, rs, LDAP_INSUFFICIENT_ACCESS,
199 "user modification of overlay database not permitted");
202 return(SLAP_CB_CONTINUE);
206 translucent_tag_cb( Operation *op, SlapReply *rs )
208 op->o_tag = (ber_tag_t)op->o_callback->sc_private;
209 rs->sr_tag = slap_req2res( op->o_tag );
211 return SLAP_CB_CONTINUE;
215 ** translucent_modify()
216 ** modify in local backend if exists in both;
217 ** otherwise, add to local backend;
218 ** fail if not defined in captive backend;
222 static int translucent_modify(Operation *op, SlapReply *rs) {
223 SlapReply nrs = { REP_RESULT };
226 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
227 overlay_stack *ov = on->on_bi.bi_private;
228 void *private = op->o_bd->be_private;
229 Entry ne, *e, *re = NULL;
231 Modifications *m, *mm;
232 int del, rc, erc = 0;
233 slap_callback cb = { 0 }, *save_cb;
235 Debug(LDAP_DEBUG_TRACE, "==> translucent_modify: %s\n",
236 op->o_req_dn.bv_val, 0, 0);
239 ** fetch entry from the captive backend;
240 ** if it did not exist, fail;
241 ** release it, if captive backend supports this;
245 op->o_bd->bd_info = (BackendInfo *) on->on_info;
246 op->o_bd->be_private = ov->private;
247 rc = ov->info->bi_entry_get_rw(op, &op->o_req_ndn, NULL, NULL, 0, &re);
248 op->o_bd->be_private = private;
250 /* if(ov->config->no_add && (!re || rc != LDAP_SUCCESS)) */
251 if(!re || rc != LDAP_SUCCESS) {
252 send_ldap_error(op, rs, LDAP_NO_SUCH_OBJECT,
253 "attempt to modify nonexistent local record");
258 ** fetch entry from local backend;
260 ** foreach Modification:
261 ** if attr not present in local:
262 ** if Mod == LDAP_MOD_DELETE:
263 ** if remote attr not present, return NO_SUCH;
264 ** if remote attr present, drop this Mod;
265 ** else force this Mod to LDAP_MOD_ADD;
270 rc = be_entry_get_rw(op, &op->o_req_ndn, NULL, NULL, 0, &e);
272 if(e && rc == LDAP_SUCCESS) {
273 Debug(LDAP_DEBUG_TRACE, "=> translucent_modify: found local entry\n", 0, 0, 0);
274 for(m = op->orm_modlist; m; m = m->sml_next) {
275 for(a = e->e_attrs; a; a = a->a_next)
276 if(a->a_desc == m->sml_desc) break;
277 if(a) continue; /* found local attr */
278 if(m->sml_op == LDAP_MOD_DELETE) {
279 for(a = re->e_attrs; a; a = a->a_next)
280 if(a->a_desc == m->sml_desc) break;
281 /* not found remote attr */
283 erc = LDAP_NO_SUCH_ATTRIBUTE;
286 if(ov->config->strict) {
287 erc = LDAP_CONSTRAINT_VIOLATION;
290 Debug(LDAP_DEBUG_TRACE,
291 "=> translucent_modify: silently dropping delete: %s\n",
292 m->sml_desc->ad_cname.bv_val, 0, 0);
293 for(mm = op->orm_modlist; mm->sml_next != m; mm = mm->sml_next);
294 mm->sml_next = m->sml_next;
297 mm->sml_next = NULL; /* hack */
298 slap_mods_free(mm, 1);
301 m->sml_op = LDAP_MOD_ADD;
303 erc = SLAP_CB_CONTINUE;
306 op->o_bd->be_private = ov->private;
307 if(ov->info->bi_entry_release_rw)
308 ov->info->bi_entry_release_rw(op, re, 0);
311 op->o_bd->be_private = private;
313 be_entry_release_r(op, e);
314 if(erc == SLAP_CB_CONTINUE) {
315 op->o_bd->bd_info = (BackendInfo *) on;
318 send_ldap_error(op, rs, erc,
319 "attempt to delete nonexistent attribute");
325 ** foreach Modification:
326 ** if MOD_ADD or MOD_REPLACE, add Attribute;
327 ** if no Modifications were suitable:
328 ** if config.strict, throw CONSTRAINT_VIOLATION;
329 ** else, return early SUCCESS;
330 ** fabricate Entry with new Attribute chain;
331 ** glue_parent() for this Entry;
332 ** call bi_op_add() in local backend;
336 Debug(LDAP_DEBUG_TRACE, "=> translucent_modify: fabricating local add\n", 0, 0, 0);
338 for(del = 0, ax = NULL, m = op->orm_modlist; m; m = m->sml_next) {
339 if(((m->sml_op & LDAP_MOD_OP) != LDAP_MOD_ADD) &&
340 ((m->sml_op & LDAP_MOD_OP) != LDAP_MOD_REPLACE)) {
341 Debug(LDAP_DEBUG_ANY,
342 "=> translucent_modify: silently dropped modification(%d): %s\n",
343 m->sml_op, m->sml_desc->ad_cname.bv_val, 0);
344 if((m->sml_op & LDAP_MOD_OP) == LDAP_MOD_DELETE) del++;
347 a = ch_calloc(1, sizeof(Attribute));
348 a->a_desc = m->sml_desc;
349 a->a_vals = m->sml_values;
350 a->a_nvals = m->sml_nvalues;
355 if(del && ov->config->strict) {
357 send_ldap_error(op, rs, LDAP_CONSTRAINT_VIOLATION,
358 "attempt to delete attributes from local database");
363 if(ov->config->strict) {
364 send_ldap_error(op, rs, LDAP_CONSTRAINT_VIOLATION,
365 "modification contained other than ADD or REPLACE");
368 op->o_bd->bd_info = (BackendInfo *) on;
369 /* rs->sr_text = "no valid modification found"; */
370 rs->sr_err = LDAP_SUCCESS;
371 send_ldap_result(op, rs);
376 ne.e_name = op->o_req_dn;
377 ne.e_nname = op->o_req_ndn;
381 ne.e_bv.bv_val = NULL;
384 nop.o_tag = LDAP_REQ_ADD;
385 nop.oq_add.rs_e = ≠
387 op->o_bd->bd_info = (BackendInfo *) on;
390 save_cb = op->o_callback;
391 cb.sc_response = translucent_tag_cb;
392 cb.sc_private = (void *)LDAP_REQ_MODIFY;
393 cb.sc_next = nop.o_callback;
394 nop.o_callback = &cb;
395 rc = on->on_info->oi_orig->bi_op_add(&nop, &nrs);
396 nop.o_callback = save_cb;
402 static int translucent_compare(Operation *op, SlapReply *rs) {
403 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
404 overlay_stack *ov = on->on_bi.bi_private;
405 void *private = op->o_bd->be_private;
407 AttributeAssertion *ava = op->orc_ava;
411 Debug(LDAP_DEBUG_TRACE, "==> translucent_compare: <%s> %s:%s\n",
412 op->o_req_dn.bv_val, ava->aa_desc->ad_cname.bv_val, ava->aa_value.bv_val);
415 ** if the local backend has an entry for this attribute:
416 ** CONTINUE and let it do the compare;
420 op->o_bd->bd_info = (BackendInfo *) on->on_info;
421 rc = be_entry_get_rw(op, &op->o_req_ndn, NULL, ava->aa_desc, 0, &e);
422 if(e && rc == LDAP_SUCCESS) {
423 be_entry_release_r(op, e);
424 op->o_bd->bd_info = (BackendInfo *) on;
425 return(SLAP_CB_CONTINUE);
429 ** call compare() in the captive backend;
430 ** return the result;
434 op->o_bd->be_private = ov->private;
435 rc = ov->info->bi_op_compare(op, rs);
436 op->o_bd->be_private = private;
437 op->o_bd->bd_info = (BackendInfo *) on;
442 ** translucent_search_cb()
443 ** merge local data with the search result
447 static int translucent_search_cb(Operation *op, SlapReply *rs) {
449 Entry *e, *re = NULL;
450 Attribute *a, *ax, *an, *as = NULL;
454 if(!op || !rs || rs->sr_type != REP_SEARCH || !rs->sr_entry)
455 return(SLAP_CB_CONTINUE);
457 Debug(LDAP_DEBUG_TRACE, "==> tranclucent_search_cb: %s\n",
458 rs->sr_entry->e_name.bv_val, 0, 0);
460 on = (slap_overinst *) op->o_bd->bd_info;
461 op->o_bd->bd_info = (BackendInfo *) on->on_info;
463 private = op->o_bd->be_private;
464 op->o_bd->be_private = op->o_callback->sc_private;
466 rc = be_entry_get_rw(op, &rs->sr_entry->e_nname, NULL, NULL, 0, &e);
469 ** if we got an entry from local backend:
470 ** make a copy of this search result;
471 ** foreach local attr:
472 ** foreach search result attr:
473 ** if match, result attr with local attr;
474 ** if new local, add to list;
475 ** append new local attrs to search result;
479 if(e && rc == LDAP_SUCCESS) {
480 re = entry_dup(rs->sr_entry);
481 for(ax = e->e_attrs; ax; ax = ax->a_next) {
483 if(is_at_operational(ax->a_desc->ad_type)) continue;
485 for(a = re->e_attrs; a; a = a->a_next) {
486 if(a->a_desc == ax->a_desc) {
487 if(a->a_vals != a->a_nvals)
488 ber_bvarray_free(a->a_nvals);
489 ber_bvarray_free(a->a_vals);
490 a->a_vals = dup_bervarray(ax->a_vals);
491 a->a_nvals = (ax->a_vals == ax->a_nvals) ?
492 a->a_vals : dup_bervarray(ax->a_nvals);
501 be_entry_release_r(op, e);
503 /* literally append, so locals are always last */
506 for(ax = re->e_attrs; ax->a_next; ax = ax->a_next);
513 rs->sr_flags |= REP_ENTRY_MUSTBEFREED;
516 op->o_bd->be_private = private;
517 op->o_bd->bd_info = (BackendInfo *) on;
519 return(SLAP_CB_CONTINUE);
523 ** translucent_search()
524 ** search via captive backend;
525 ** override results with any local data;
529 static int translucent_search(Operation *op, SlapReply *rs) {
532 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
533 slap_callback cb = { NULL, NULL, NULL, NULL };
534 overlay_stack *ov = on->on_bi.bi_private;
535 void *private = op->o_bd->be_private;
538 Debug(LDAP_DEBUG_TRACE, "==> translucent_search: <%s> %s\n",
539 op->o_req_dn.bv_val, op->ors_filterstr.bv_val, 0);
540 cb.sc_response = (slap_response *) translucent_search_cb;
541 cb.sc_private = private;
543 cb.sc_next = nop.o_callback;
544 nop.o_callback = &cb;
546 op->o_bd->be_private = ov->private;
547 rc = ov->info->bi_op_search(&nop, rs);
548 op->o_bd->be_private = private;
555 ** translucent_bind()
556 ** pass bind request to captive backend;
560 static int translucent_bind(Operation *op, SlapReply *rs) {
561 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
562 overlay_stack *ov = on->on_bi.bi_private;
563 void *private = op->o_bd->be_private;
566 Debug(LDAP_DEBUG_TRACE, "translucent_bind: <%s> method %d\n",
567 op->o_req_dn.bv_val, op->orb_method, 0);
569 op->o_bd->be_private = ov->private;
570 rc = ov->info->bi_op_bind(op, rs);
571 op->o_bd->be_private = private;
577 ** translucent_config()
578 ** pass config directives to captive backend;
579 ** parse unrecognized directives ourselves;
583 static int translucent_config(
591 slap_overinst *on = (slap_overinst *) be->bd_info;
592 overlay_stack *ov = on->on_bi.bi_private;
593 void *private = be->be_private;
594 void *be_cf_ocs = be->be_cf_ocs;
597 /* "this should never happen" */
599 fprintf(stderr, "fatal: captive backend not initialized");
603 be->be_private = ov->private;
604 be->be_cf_ocs = ov->info->bi_cf_ocs;
605 rc = ov->info->bi_db_config ? ov->info->bi_db_config(be, fname, lineno, argc, argv) : 0;
606 be->be_private = private;
607 be->be_cf_ocs = be_cf_ocs;
609 /* pass okay or error up, SLAP_CONF_UNKNOWN might be ours */
610 if(rc == 0 || rc == 1) return(rc);
613 if(!strcasecmp(*argv, "translucent_strict")) {
614 ov->config->strict++;
615 } else if(!strcasecmp(*argv, "translucent_no_add")) {
616 ov->config->no_add++;
617 } else if(!strcasecmp(*argv, "translucent_no_glue")) {
619 } else if(!strcasecmp(*argv, "translucent_debug")) {
621 ov->config->debug = 0xFFFF;
623 } else if(argc == 2) {
624 if ( lutil_atoi( &ov->config->debug, argv[1]) != 0 ) {
625 fprintf(stderr, "%s: line %d: unable to parse debug \"%s\"\n",
626 fname, lineno, argv[1]);
631 fprintf(stderr, "%s: line %d: too many arguments (%d) to debug\n",
632 fname, lineno, argc);
636 fprintf(stderr, "%s: line %d: unknown keyword %s\n",
637 fname, lineno, *argv);
638 rc = SLAP_CONF_UNKNOWN;
644 ** translucent_db_init()
645 ** initialize the captive backend;
649 static int translucent_db_init(BackendDB *be) {
650 slap_overinst *on = (slap_overinst *) be->bd_info;
651 void *private = be->be_private;
655 Debug(LDAP_DEBUG_TRACE, "==> translucent_init\n", 0, 0, 0);
657 ov = ch_calloc(1, sizeof(overlay_stack));
658 ov->config = ch_calloc(1, sizeof(translucent_configuration));
659 ov->info = backend_info("ldap");
662 Debug(LDAP_DEBUG_ANY, "translucent: backend_info failed!\n", 0, 0, 0);
666 /* forcibly disable schema checking on the local backend */
667 SLAP_DBFLAGS(be) |= SLAP_DBFLAG_NO_SCHEMA_CHECK;
669 be->be_private = NULL;
670 rc = ov->info->bi_db_init ? ov->info->bi_db_init(be) : 0;
672 if(rc) Debug(LDAP_DEBUG_TRACE,
673 "translucent: bi_db_init() returned error %d\n", rc, 0, 0);
675 ov->private = be->be_private;
676 be->be_private = private;
677 on->on_bi.bi_private = ov;
682 ** translucent_open()
683 ** if the captive backend has an open() method, call it;
687 static int translucent_open(BackendDB *be) {
688 slap_overinst *on = (slap_overinst *) be->bd_info;
689 overlay_stack *ov = on->on_bi.bi_private;
690 void *private = be->be_private;
693 /* "should never happen" */
695 Debug(LDAP_DEBUG_ANY, "translucent_open() called with bad ov->info\n", 0, 0, 0);
699 Debug(LDAP_DEBUG_TRACE, "translucent_open\n", 0, 0, 0);
701 be->be_private = ov->private;
702 rc = ov->info->bi_db_open ? ov->info->bi_db_open(be) : 0;
703 be->be_private = private;
705 if(rc) Debug(LDAP_DEBUG_TRACE,
706 "translucent: bi_db_open() returned error %d\n", rc, 0, 0);
712 ** translucent_close()
713 ** if the captive backend has a close() method, call it;
714 ** free any config data;
718 static int translucent_close(BackendDB *be) {
719 slap_overinst *on = (slap_overinst *) be->bd_info;
720 overlay_stack *ov = on->on_bi.bi_private;
721 void *private = be->be_private;
724 be->be_private = ov->private;
725 rc = (ov->info && ov->info->bi_db_close) ? ov->info->bi_db_close(be) : 0;
726 be->be_private = private;
727 if(ov->config) ch_free(ov->config);
733 ** translucent_init()
734 ** initialize the slap_overinst with our entry points;
738 int translucent_initialize() {
740 translucent.on_bi.bi_type = "translucent";
741 translucent.on_bi.bi_db_init = translucent_db_init;
742 translucent.on_bi.bi_db_config = translucent_config;
743 translucent.on_bi.bi_db_open = translucent_open;
744 translucent.on_bi.bi_db_close = translucent_close;
745 translucent.on_bi.bi_op_bind = translucent_bind;
746 translucent.on_bi.bi_op_add = translucent_add;
747 translucent.on_bi.bi_op_modify = translucent_modify;
748 translucent.on_bi.bi_op_modrdn = translucent_modrdn;
749 translucent.on_bi.bi_op_delete = translucent_delete;
750 translucent.on_bi.bi_op_search = translucent_search;
751 translucent.on_bi.bi_op_compare = translucent_compare;
753 return(overlay_register(&translucent));
756 #if SLAPD_OVER_TRANSLUCENT == SLAPD_MOD_DYNAMIC && defined(PIC)
757 int init_module(int argc, char *argv[]) {
758 return translucent_initialize();
762 #endif /* SLAPD_OVER_TRANSLUCENT */