1 /* translucent.c - translucent proxy module */
3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
5 * Copyright 2004-2005 The OpenLDAP Foundation.
6 * Portions Copyright 2005 Symas Corporation.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted only as authorized by the OpenLDAP
13 * A copy of this license is available in the file LICENSE in the
14 * top-level directory of the distribution or, alternatively, at
15 * <http://www.OpenLDAP.org/license.html>.
18 * This work was initially developed by Symas Corp. for inclusion in
19 * OpenLDAP Software. This work was sponsored by Hewlett-Packard.
24 #ifdef SLAPD_OVER_TRANSLUCENT
28 #include <ac/string.h>
29 #include <ac/socket.h>
35 typedef struct translucent_configuration {
40 } translucent_configuration;
42 /* stack of captive backends */
44 typedef struct overlay_stack {
45 BackendInfo *info; /* captive backend */
46 void *private; /* local backend_private */
47 translucent_configuration *config; /* our_private: configuration */
50 /* for translucent_init() */
52 static slap_overinst translucent;
56 ** call syncrepl_add_glue() with the parent suffix;
60 static struct berval glue[] = { BER_BVC("top"), BER_BVC("glue"), BER_BVNULL };
62 void glue_parent(Operation *op) {
64 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
65 struct berval dn = { 0, NULL };
66 char *odn = op->o_req_ndn.bv_val;
71 /* tis more work to use strchr() for a berval... */
72 for(idn = 0; odn[idn] && odn[idn] != ','; idn++);
73 if(!idn || !odn[idn]) return; /* because you never know */
75 ldn = dn.bv_len = op->o_req_ndn.bv_len - idn;
76 dn.bv_val = ch_malloc(ldn + 1);
77 strcpy(dn.bv_val, odn + idn);
79 Debug(LDAP_DEBUG_TRACE, "=> glue_parent: fabricating glue for <%s>\n", dn.bv_val, 0, 0);
81 e = ch_calloc(1, sizeof(Entry));
83 ber_dupbv(&e->e_name, &dn);
84 ber_dupbv(&e->e_nname, &dn);
86 a = ch_calloc(1, sizeof(Attribute));
87 a->a_desc = slap_schema.si_ad_objectClass;
88 a->a_vals = ch_malloc(sizeof(struct berval) * 3);
89 ber_dupbv(&a->a_vals[0], &glue[0]);
90 ber_dupbv(&a->a_vals[1], &glue[1]);
91 ber_dupbv(&a->a_vals[2], &glue[2]);
92 a->a_nvals = a->a_vals;
93 a->a_next = e->e_attrs;
96 a = ch_calloc(1, sizeof(Attribute));
97 a->a_desc = slap_schema.si_ad_structuralObjectClass;
98 a->a_vals = ch_malloc(sizeof(struct berval) * 2);
99 ber_dupbv(&a->a_vals[0], &glue[1]);
100 ber_dupbv(&a->a_vals[1], &glue[2]);
101 a->a_nvals = a->a_vals;
102 a->a_next = e->e_attrs;
108 nop.o_bd->bd_info = (BackendInfo *) on->on_info->oi_orig;
110 syncrepl_add_glue(&nop, e);
119 BerVarray dup_bervarray(BerVarray b) {
122 for(len = 0; b[len].bv_val; len++);
123 nb = ch_malloc((len+1) * sizeof(BerValue));
124 for(i = 0; i < len; i++) ber_dupbv(&nb[i], &b[i]);
125 nb[len].bv_val = NULL;
132 ** free only the Attribute*, not the contents;
135 void free_attr_chain(Attribute *a) {
137 for(ax = NULL; a; a = a->a_next) {
146 ** if not bound as root, send ACCESS error;
147 ** if config.glue, glue_parent();
152 static int translucent_add(Operation *op, SlapReply *rs) {
153 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
154 overlay_stack *ov = on->on_bi.bi_private;
155 Debug(LDAP_DEBUG_TRACE, "==> translucent_add: %s\n",
156 op->o_req_dn.bv_val, 0, 0);
158 op->o_bd->bd_info = (BackendInfo *) on->on_info;
159 send_ldap_error(op, rs, LDAP_INSUFFICIENT_ACCESS,
160 "user modification of overlay database not permitted");
163 if(!ov->config->glue) glue_parent(op);
164 return(SLAP_CB_CONTINUE);
168 ** translucent_modrdn()
169 ** if not bound as root, send ACCESS error;
170 ** if !config.glue, glue_parent();
171 ** else return CONTINUE;
175 static int translucent_modrdn(Operation *op, SlapReply *rs) {
176 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
177 overlay_stack *ov = on->on_bi.bi_private;
178 Debug(LDAP_DEBUG_TRACE, "==> translucent_modrdn: %s -> %s\n",
179 op->o_req_dn.bv_val, op->orr_newrdn.bv_val, 0);
181 op->o_bd->bd_info = (BackendInfo *) on->on_info;
182 send_ldap_error(op, rs, LDAP_INSUFFICIENT_ACCESS,
183 "user modification of overlay database not permitted");
186 if(!ov->config->glue) glue_parent(op);
187 return(SLAP_CB_CONTINUE);
191 ** translucent_delete()
192 ** if not bound as root, send ACCESS error;
193 ** else return CONTINUE;
197 static int translucent_delete(Operation *op, SlapReply *rs) {
198 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
199 Debug(LDAP_DEBUG_TRACE, "==> translucent_delete: %s\n",
200 op->o_req_dn.bv_val, 0, 0);
202 op->o_bd->bd_info = (BackendInfo *) on->on_info;
203 send_ldap_error(op, rs, LDAP_INSUFFICIENT_ACCESS,
204 "user modification of overlay database not permitted");
207 return(SLAP_CB_CONTINUE);
211 ** translucent_modify()
212 ** modify in local backend if exists in both;
213 ** otherwise, add to local backend;
214 ** fail if not defined in captive backend;
218 static int translucent_modify(Operation *op, SlapReply *rs) {
219 SlapReply nrs = { REP_RESULT };
222 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
223 overlay_stack *ov = on->on_bi.bi_private;
224 translucent_configuration *cf = ov->config;
225 void *private = op->o_bd->be_private;
226 Entry ne, *e, *re = NULL;
228 Modifications *m, *mm;
229 int del, rc, erc = 0;
231 Debug(LDAP_DEBUG_TRACE, "==> translucent_modify: %s\n",
232 op->o_req_dn.bv_val, 0, 0);
235 ** fetch entry from the captive backend;
236 ** if it did not exist, fail;
237 ** release it, if captive backend supports this;
241 op->o_bd->bd_info = (BackendInfo *) on->on_info;
242 op->o_bd->be_private = ov->private;
243 rc = ov->info->bi_entry_get_rw(op, &op->o_req_ndn, NULL, NULL, 0, &re);
244 op->o_bd->be_private = private;
246 /* if(ov->config->no_add && (!re || rc != LDAP_SUCCESS)) */
247 if(!re || rc != LDAP_SUCCESS) {
248 send_ldap_error(op, rs, LDAP_NO_SUCH_OBJECT,
249 "attempt to modify nonexistent local record");
254 ** fetch entry from local backend;
256 ** foreach Modification:
257 ** if attr not present in local:
258 ** if Mod == LDAP_MOD_DELETE:
259 ** if remote attr not present, return NO_SUCH;
260 ** if remote attr present, drop this Mod;
261 ** else force this Mod to LDAP_MOD_ADD;
266 rc = be_entry_get_rw(op, &op->o_req_ndn, NULL, NULL, 0, &e);
268 if(e && rc == LDAP_SUCCESS) {
269 Debug(LDAP_DEBUG_TRACE, "=> translucent_modify: found local entry\n", 0, 0, 0);
270 for(m = op->orm_modlist; m; m = m->sml_next) {
271 for(a = e->e_attrs; a; a = a->a_next)
272 if(a->a_desc == m->sml_desc) break;
273 if(a) continue; /* found local attr */
274 if(m->sml_op == LDAP_MOD_DELETE) {
275 for(a = re->e_attrs; a; a = a->a_next)
276 if(a->a_desc == m->sml_desc) break;
277 /* not found remote attr */
279 erc = LDAP_NO_SUCH_ATTRIBUTE;
282 if(ov->config->strict) {
283 erc = LDAP_CONSTRAINT_VIOLATION;
286 Debug(LDAP_DEBUG_TRACE,
287 "=> translucent_modify: silently dropping delete: %s\n",
288 m->sml_desc->ad_cname.bv_val, 0, 0);
289 for(mm = op->orm_modlist; mm->sml_next != m; mm = mm->sml_next);
290 mm->sml_next = m->sml_next;
293 mm->sml_next = NULL; /* hack */
297 m->sml_op = LDAP_MOD_ADD;
299 erc = SLAP_CB_CONTINUE;
302 op->o_bd->be_private = ov->private;
303 if(ov->info->bi_entry_release_rw)
304 ov->info->bi_entry_release_rw(op, re, 0);
307 op->o_bd->be_private = private;
309 be_entry_release_r(op, e);
310 if(erc == SLAP_CB_CONTINUE) {
311 op->o_bd->bd_info = (BackendInfo *) on;
314 send_ldap_error(op, rs, erc,
315 "attempt to delete nonexistent attribute");
321 ** foreach Modification:
322 ** if MOD_ADD or MOD_REPLACE, add Attribute;
323 ** if no Modifications were suitable:
324 ** if config.strict, throw CONSTRAINT_VIOLATION;
325 ** else, return early SUCCESS;
326 ** fabricate Entry with new Attribute chain;
327 ** glue_parent() for this Entry;
328 ** call bi_op_add() in local backend;
332 Debug(LDAP_DEBUG_TRACE, "=> translucent_modify: fabricating local add\n", 0, 0, 0);
334 for(del = 0, ax = NULL, m = op->orm_modlist; m; m = m->sml_next) {
335 if(((m->sml_op & LDAP_MOD_OP) != LDAP_MOD_ADD) &&
336 ((m->sml_op & LDAP_MOD_OP) != LDAP_MOD_REPLACE)) {
337 Debug(LDAP_DEBUG_ANY,
338 "=> translucent_modify: silently dropped modification(%d): %s\n",
339 m->sml_op, m->sml_desc->ad_cname.bv_val, 0);
340 if((m->sml_op & LDAP_MOD_OP) == LDAP_MOD_DELETE) del++;
343 a = ch_calloc(1, sizeof(Attribute));
344 a->a_desc = m->sml_desc;
345 a->a_vals = m->sml_values;
346 a->a_nvals = m->sml_nvalues;
351 if(del && ov->config->strict) {
353 send_ldap_error(op, rs, LDAP_CONSTRAINT_VIOLATION,
354 "attempt to delete attributes from local database");
359 if(ov->config->strict) {
360 send_ldap_error(op, rs, LDAP_CONSTRAINT_VIOLATION,
361 "modification contained other than ADD or REPLACE");
364 op->o_bd->bd_info = (BackendInfo *) on;
365 /* rs->sr_text = "no valid modification found"; */
366 rs->sr_err = LDAP_SUCCESS;
367 send_ldap_result(op, rs);
372 ne.e_name = op->o_req_dn;
373 ne.e_nname = op->o_req_ndn;
377 ne.e_bv.bv_val = NULL;
380 nop.o_tag = LDAP_REQ_ADD;
381 nop.oq_add.rs_e = ≠
383 op->o_bd->bd_info = (BackendInfo *) on;
386 rc = on->on_info->oi_orig->bi_op_add(&nop, &nrs);
392 static int translucent_compare(Operation *op, SlapReply *rs) {
393 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
394 overlay_stack *ov = on->on_bi.bi_private;
395 void *private = op->o_bd->be_private;
396 translucent_configuration *cf = ov->config;
398 AttributeAssertion *ava = op->orc_ava;
399 Attribute *a, *an, *ra, *as = NULL;
403 Debug(LDAP_DEBUG_TRACE, "==> translucent_compare: <%s> %s:%s\n",
404 op->o_req_dn.bv_val, ava->aa_desc->ad_cname.bv_val, ava->aa_value.bv_val);
407 ** if the local backend has an entry for this attribute:
408 ** CONTINUE and let it do the compare;
412 op->o_bd->bd_info = (BackendInfo *) on->on_info;
413 rc = be_entry_get_rw(op, &op->o_req_ndn, NULL, ava->aa_desc, 0, &e);
414 if(e && rc == LDAP_SUCCESS) {
415 be_entry_release_r(op, e);
416 op->o_bd->bd_info = (BackendInfo *) on;
417 return(SLAP_CB_CONTINUE);
421 ** call compare() in the captive backend;
422 ** return the result;
426 op->o_bd->be_private = ov->private;
427 rc = ov->info->bi_op_compare(op, rs);
428 op->o_bd->be_private = private;
429 op->o_bd->bd_info = (BackendInfo *) on;
434 ** translucent_search_cb()
435 ** merge local data with the search result
439 static int translucent_search_cb(Operation *op, SlapReply *rs) {
441 Entry *e, *re = NULL;
442 Attribute *a, *ax, *an, *as = NULL;
447 if(!op || !rs || rs->sr_type != REP_SEARCH || !rs->sr_entry)
448 return(SLAP_CB_CONTINUE);
450 Debug(LDAP_DEBUG_TRACE, "==> tranclucent_search_cb: %s\n",
451 rs->sr_entry->e_name.bv_val, 0, 0);
453 on = (slap_overinst *) op->o_bd->bd_info;
454 op->o_bd->bd_info = (BackendInfo *) on->on_info;
456 private = op->o_bd->be_private;
457 op->o_bd->be_private = op->o_callback->sc_private;
459 rc = be_entry_get_rw(op, &rs->sr_entry->e_nname, NULL, NULL, 0, &e);
462 ** if we got an entry from local backend:
463 ** make a copy of this search result;
464 ** foreach local attr:
465 ** foreach search result attr:
466 ** if match, result attr with local attr;
467 ** if new local, add to list;
468 ** append new local attrs to search result;
472 if(e && rc == LDAP_SUCCESS) {
473 re = entry_dup(rs->sr_entry);
474 for(ax = e->e_attrs; ax; ax = ax->a_next) {
476 if(is_at_operational(ax->a_desc->ad_type)) continue;
478 for(a = re->e_attrs; a; a = a->a_next) {
479 if(a->a_desc == ax->a_desc) {
480 if(a->a_vals != a->a_nvals)
481 ber_bvarray_free(a->a_nvals);
482 ber_bvarray_free(a->a_vals);
483 a->a_vals = dup_bervarray(ax->a_vals);
484 a->a_nvals = (ax->a_vals == ax->a_nvals) ?
485 a->a_vals : dup_bervarray(ax->a_nvals);
494 be_entry_release_r(op, e);
496 /* literally append, so locals are always last */
499 for(ax = re->e_attrs; ax->a_next; ax = ax->a_next);
506 rs->sr_flags |= REP_ENTRY_MUSTBEFREED;
509 op->o_bd->be_private = private;
510 op->o_bd->bd_info = (BackendInfo *) on;
512 return(SLAP_CB_CONTINUE);
516 ** translucent_search()
517 ** search via captive backend;
518 ** override results with any local data;
522 static int translucent_search(Operation *op, SlapReply *rs) {
525 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
526 slap_callback cb = { NULL, NULL, NULL, NULL };
527 overlay_stack *ov = on->on_bi.bi_private;
528 translucent_configuration *cf = ov->config;
529 void *private = op->o_bd->be_private;
532 Debug(LDAP_DEBUG_TRACE, "==> translucent_search: <%s> %s\n",
533 op->o_req_dn.bv_val, op->ors_filterstr.bv_val, 0);
534 cb.sc_response = (slap_response *) translucent_search_cb;
535 cb.sc_private = private;
537 cb.sc_next = nop.o_callback;
538 nop.o_callback = &cb;
540 op->o_bd->be_private = ov->private;
541 rc = ov->info->bi_op_search(&nop, rs);
542 op->o_bd->be_private = private;
549 ** translucent_bind()
550 ** pass bind request to captive backend;
554 static int translucent_bind(Operation *op, SlapReply *rs) {
555 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
556 overlay_stack *ov = on->on_bi.bi_private;
557 void *private = op->o_bd->be_private;
560 Debug(LDAP_DEBUG_TRACE, "translucent_bind: <%s> method %d\n",
561 op->o_req_dn.bv_val, op->orb_method, 0);
563 op->o_bd->be_private = ov->private;
564 rc = ov->info->bi_op_bind(op, rs);
565 op->o_bd->be_private = private;
571 ** translucent_config()
572 ** pass config directives to captive backend;
573 ** parse unrecognized directives ourselves;
577 static int translucent_config(
585 slap_overinst *on = (slap_overinst *) be->bd_info;
586 overlay_stack *ov = on->on_bi.bi_private;
587 void *private = be->be_private;
588 void *be_cf_ocs = be->be_cf_ocs;
591 /* "this should never happen" */
593 fprintf(stderr, "fatal: captive backend not initialized");
597 be->be_private = ov->private;
598 be->be_cf_ocs = ov->info->bi_cf_ocs;
599 rc = ov->info->bi_db_config ? ov->info->bi_db_config(be, fname, lineno, argc, argv) : 0;
600 be->be_private = private;
601 be->be_cf_ocs = be_cf_ocs;
603 /* pass okay or error up, SLAP_CONF_UNKNOWN might be ours */
604 if(rc == 0 || rc == 1) return(rc);
607 if(!strcasecmp(*argv, "translucent_strict")) {
608 ov->config->strict++;
609 } else if(!strcasecmp(*argv, "translucent_no_add")) {
610 ov->config->no_add++;
611 } else if(!strcasecmp(*argv, "translucent_no_glue")) {
613 } else if(!strcasecmp(*argv, "translucent_debug")) {
615 ov->config->debug = 0xFFFF;
617 } else if(argc == 2) {
618 ov->config->debug = atoi(argv[1]);
621 fprintf(stderr, "%s: line %d: too many arguments (%d) to debug\n",
622 fname, lineno, argc);
626 fprintf(stderr, "%s: line %d: unknown keyword %s\n",
627 fname, lineno, *argv);
628 rc = SLAP_CONF_UNKNOWN;
634 ** translucent_db_init()
635 ** initialize the captive backend;
639 static int translucent_db_init(BackendDB *be) {
640 slap_overinst *on = (slap_overinst *) be->bd_info;
641 void *private = be->be_private;
645 Debug(LDAP_DEBUG_TRACE, "==> translucent_init\n", 0, 0, 0);
647 ov = ch_calloc(1, sizeof(overlay_stack));
648 ov->config = ch_calloc(1, sizeof(translucent_configuration));
649 ov->info = backend_info("ldap");
652 Debug(LDAP_DEBUG_ANY, "translucent: backend_info failed!\n", 0, 0, 0);
656 /* forcibly disable schema checking on the local backend */
657 SLAP_DBFLAGS(be) |= SLAP_DBFLAG_NO_SCHEMA_CHECK;
659 be->be_private = NULL;
660 rc = ov->info->bi_db_init ? ov->info->bi_db_init(be) : 0;
662 if(rc) Debug(LDAP_DEBUG_TRACE,
663 "translucent: bi_db_init() returned error %d\n", rc, 0, 0);
665 ov->private = be->be_private;
666 be->be_private = private;
667 on->on_bi.bi_private = ov;
672 ** translucent_open()
673 ** if the captive backend has an open() method, call it;
677 static int translucent_open(BackendDB *be) {
678 slap_overinst *on = (slap_overinst *) be->bd_info;
679 overlay_stack *ov = on->on_bi.bi_private;
680 void *private = be->be_private;
683 /* "should never happen" */
685 Debug(LDAP_DEBUG_ANY, "translucent_open() called with bad ov->info\n", 0, 0, 0);
689 Debug(LDAP_DEBUG_TRACE, "translucent_open\n", 0, 0, 0);
691 be->be_private = ov->private;
692 rc = ov->info->bi_db_open ? ov->info->bi_db_open(be) : 0;
693 be->be_private = private;
695 if(rc) Debug(LDAP_DEBUG_TRACE,
696 "translucent: bi_db_open() returned error %d\n", rc, 0, 0);
702 ** translucent_close()
703 ** if the captive backend has a close() method, call it;
704 ** free any config data;
708 static int translucent_close(BackendDB *be) {
709 slap_overinst *on = (slap_overinst *) be->bd_info;
710 overlay_stack *ov = on->on_bi.bi_private;
711 translucent_configuration *cf = ov->config;
712 void *private = be->be_private;
715 be->be_private = ov->private;
716 rc = (ov->info && ov->info->bi_db_close) ? ov->info->bi_db_close(be) : 0;
717 be->be_private = private;
718 if(ov->config) ch_free(ov->config);
724 ** translucent_init()
725 ** initialize the slap_overinst with our entry points;
729 int translucent_init() {
731 translucent.on_bi.bi_type = "translucent";
732 translucent.on_bi.bi_db_init = translucent_db_init;
733 translucent.on_bi.bi_db_config = translucent_config;
734 translucent.on_bi.bi_db_open = translucent_open;
735 translucent.on_bi.bi_db_close = translucent_close;
736 translucent.on_bi.bi_op_bind = translucent_bind;
737 translucent.on_bi.bi_op_add = translucent_add;
738 translucent.on_bi.bi_op_modify = translucent_modify;
739 translucent.on_bi.bi_op_modrdn = translucent_modrdn;
740 translucent.on_bi.bi_op_delete = translucent_delete;
741 translucent.on_bi.bi_op_search = translucent_search;
742 translucent.on_bi.bi_op_compare = translucent_compare;
744 return(overlay_register(&translucent));
747 #if SLAPD_OVER_TRANSLUCENT == SLAPD_MOD_DYNAMIC && defined(PIC)
748 int init_module(int argc, char *argv[]) {
749 return translucent_init();
753 #endif /* SLAPD_OVER_TRANSLUCENT */