]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/back-ldap/chain.c
allow proxies to filter out search references (ITS#5593)
[openldap] / servers / slapd / back-ldap / chain.c
index 054f0b8ae8b861ba888c24f4644d56b2169a495f..32783ed0a9765a66baea47b8f39e484290920a43 100644 (file)
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2003-2006 The OpenLDAP Foundation.
+ * Copyright 2003-2008 The OpenLDAP Foundation.
  * Portions Copyright 2003 Howard Chu.
  * All rights reserved.
  *
@@ -27,9 +27,9 @@
 #include <ac/string.h>
 #include <ac/socket.h>
 
+#include "lutil.h"
 #include "slap.h"
 #include "back-ldap.h"
-
 #include "config.h"
 
 #ifdef LDAP_CONTROL_X_CHAINING_BEHAVIOR
@@ -110,9 +110,9 @@ typedef struct ldap_chain_t {
 
 static int ldap_chain_db_init_common( BackendDB        *be );
 static int ldap_chain_db_init_one( BackendDB *be );
-#define        ldap_chain_db_open_one(be)      (lback)->bi_db_open( (be) )
+static int ldap_chain_db_open_one( BackendDB *be );
 #define        ldap_chain_db_close_one(be)     (0)
-#define        ldap_chain_db_destroy_one(be)   (lback)->bi_db_destroy( (be) )
+#define        ldap_chain_db_destroy_one(be, rs)       (lback)->bi_db_destroy( (be), (rs) )
 
 typedef struct ldap_chain_cb_t {
        ldap_chain_status_t     lb_status;
@@ -136,6 +136,8 @@ ldap_chain_search(
        BerVarray       ref,
        int             depth );
 
+static slap_overinst ldapchain;
+
 #ifdef LDAP_CONTROL_X_CHAINING_BEHAVIOR
 static int
 chaining_control_add(
@@ -412,14 +414,19 @@ ldap_chain_op(
        li.li_bvuri = bvuri;
        first_rc = -1;
        for ( ; !BER_BVISNULL( ref ); ref++ ) {
-               LDAPURLDesc     *srv;
-               char            *save_dn;
+               SlapReply       rs2 = { 0 };
+               LDAPURLDesc     *srv = NULL;
+               struct berval   save_req_dn = op->o_req_dn,
+                               save_req_ndn = op->o_req_ndn,
+                               dn = BER_BVNULL,
+                               pdn = BER_BVNULL,
+                               ndn = BER_BVNULL;
                int             temporary = 0;
                        
                /* We're setting the URI of the first referral;
                 * what if there are more?
 
-Document: draft-ietf-ldapbis-protocol-27.txt
+Document: RFC 4511
 
 4.1.10. Referral 
    ...
@@ -441,22 +448,42 @@ Document: draft-ietf-ldapbis-protocol-27.txt
                        continue;
                }
 
-               /* remove DN essentially because later on 
-                * ldap_initialize() will parse the URL 
-                * as a comma-separated URL list */
-               save_dn = srv->lud_dn;
-               srv->lud_dn = "";
+               /* normalize DN */
+               rc = LDAP_SUCCESS;
                srv->lud_scope = LDAP_SCOPE_DEFAULT;
+               if ( srv->lud_dn != NULL ) {
+                       ber_str2bv( srv->lud_dn, 0, 0, &dn );
+                       rc = dnPrettyNormal( NULL, &dn, &pdn, &ndn, op->o_tmpmemctx );
+                       if ( rc == LDAP_SUCCESS ) {
+                               /* remove DN essentially because later on 
+                                * ldap_initialize() will parse the URL 
+                                * as a comma-separated URL list */
+                               srv->lud_dn = "";
+                       }
+
+               } else {
+                       srv->lud_dn = "";
+               }
+
                li.li_uri = ldap_url_desc2str( srv );
-               srv->lud_dn = save_dn;
+               srv->lud_dn = dn.bv_val;
                ldap_free_urldesc( srv );
 
-               if ( li.li_uri == NULL ) {
+               if ( rc != LDAP_SUCCESS ) {
                        /* try next */
                        rc = LDAP_OTHER;
                        continue;
                }
 
+               if ( li.li_uri == NULL ) {
+                       /* try next */
+                       rc = LDAP_OTHER;
+                       goto further_cleanup;
+               }
+
+               op->o_req_dn = pdn;
+               op->o_req_ndn = ndn;
+
                ber_str2bv( li.li_uri, 0, 0, &li.li_bvuri[ 0 ] );
 
                /* Searches for a ldapinfo in the avl tree */
@@ -478,7 +505,9 @@ Document: draft-ietf-ldapbis-protocol-27.txt
                        lip->li_bvuri = bvuri;
                        rc = ldap_chain_db_open_one( op->o_bd );
                        if ( rc != 0 ) {
-                               (void)ldap_chain_db_destroy_one( op->o_bd );
+                               lip->li_uri = NULL;
+                               lip->li_bvuri = NULL;
+                               (void)ldap_chain_db_destroy_one( op->o_bd, NULL);
                                goto cleanup;
                        }
 
@@ -502,7 +531,7 @@ Document: draft-ietf-ldapbis-protocol-27.txt
                lb->lb_op_f = op_f;
                lb->lb_depth = depth + 1;
 
-               rc = op_f( op, rs );
+               rc = op_f( op, &rs2 );
 
                /* note the first error */
                if ( first_rc == -1 ) {
@@ -517,12 +546,26 @@ cleanup:;
                        lip->li_uri = NULL;
                        lip->li_bvuri = NULL;
                        (void)ldap_chain_db_close_one( op->o_bd );
-                       (void)ldap_chain_db_destroy_one( op->o_bd );
+                       (void)ldap_chain_db_destroy_one( op->o_bd, NULL );
                }
+
+further_cleanup:;
+               if ( !BER_BVISNULL( &pdn ) ) {
+                       op->o_tmpfree( pdn.bv_val, op->o_tmpmemctx );
+               }
+               op->o_req_dn = save_req_dn;
+
+               if ( !BER_BVISNULL( &ndn ) ) {
+                       op->o_tmpfree( ndn.bv_val, op->o_tmpmemctx );
+               }
+               op->o_req_ndn = save_req_ndn;
                
-               if ( rc == LDAP_SUCCESS && rs->sr_err == LDAP_SUCCESS ) {
+               if ( rc == LDAP_SUCCESS && rs2.sr_err == LDAP_SUCCESS ) {
+                       *rs = rs2;
                        break;
                }
+
+               rc = rs2.sr_err;
        }
 
 #ifdef LDAP_CONTROL_X_CHAINING_BEHAVIOR
@@ -554,7 +597,8 @@ ldap_chain_search(
                        ondn = op->o_req_ndn;
        slap_response   *save_response = op->o_callback->sc_response;
 
-       int             rc = LDAP_OTHER;
+       int             rc = LDAP_OTHER,
+                       first_rc = -1;
 
 #ifdef LDAP_CONTROL_X_CHAINING_BEHAVIOR
        LDAPControl     **ctrls = NULL;
@@ -573,8 +617,13 @@ ldap_chain_search(
         * to be set once for all (correct?) */
        li.li_bvuri = bvuri;
        for ( ; !BER_BVISNULL( &ref[0] ); ref++ ) {
+               SlapReply       rs2 = { 0 };
                LDAPURLDesc     *srv;
-               char            *save_dn;
+               struct berval   save_req_dn = op->o_req_dn,
+                               save_req_ndn = op->o_req_ndn,
+                               dn,
+                               pdn = BER_BVNULL,
+                               ndn = BER_BVNULL;
                int             temporary = 0;
 
                /* parse reference and use
@@ -586,29 +635,38 @@ ldap_chain_search(
                        continue;
                }
 
-               /* remove DN essentially because later on 
-                * ldap_initialize() will parse the URL 
-                * as a comma-separated URL list */
-               save_dn = srv->lud_dn;
-               srv->lud_dn = "";
-               srv->lud_scope = LDAP_SCOPE_DEFAULT;
-               li.li_uri = ldap_url_desc2str( srv );
-               if ( li.li_uri != NULL ) {
-                       ber_str2bv_x( save_dn, 0, 1, &op->o_req_dn,
-                                       op->o_tmpmemctx );
-                       ber_dupbv_x( &op->o_req_ndn, &op->o_req_dn,
-                                       op->o_tmpmemctx );
+               /* normalize DN */
+               rc = LDAP_INVALID_SYNTAX;
+               if ( srv->lud_dn != NULL ) {
+                       ber_str2bv( srv->lud_dn, 0, 0, &dn );
+                       rc = dnPrettyNormal( NULL, &dn, &pdn, &ndn, op->o_tmpmemctx );
+                       if ( rc == LDAP_SUCCESS ) {
+                               /* remove DN essentially because later on 
+                                * ldap_initialize() will parse the URL 
+                                * as a comma-separated URL list */
+                               srv->lud_dn = "";
+                               srv->lud_scope = LDAP_SCOPE_DEFAULT;
+                               li.li_uri = ldap_url_desc2str( srv );
+                               srv->lud_dn = dn.bv_val;
+                       }
                }
-
-               srv->lud_dn = save_dn;
                ldap_free_urldesc( srv );
 
-               if ( li.li_uri == NULL ) {
+               if ( rc != LDAP_SUCCESS ) {
                        /* try next */
-                       rs->sr_err = LDAP_OTHER;
+                       rc = LDAP_OTHER;
                        continue;
                }
 
+               if ( li.li_uri == NULL ) {
+                       /* try next */
+                       rc = LDAP_OTHER;
+                       goto further_cleanup;
+               }
+
+               op->o_req_dn = pdn;
+               op->o_req_ndn = ndn;
+
                ber_str2bv( li.li_uri, 0, 0, &li.li_bvuri[ 0 ] );
 
                /* Searches for a ldapinfo in the avl tree */
@@ -631,7 +689,9 @@ ldap_chain_search(
                        lip->li_bvuri = bvuri;
                        rc = ldap_chain_db_open_one( op->o_bd );
                        if ( rc != 0 ) {
-                               (void)ldap_chain_db_destroy_one( op->o_bd );
+                               lip->li_uri = NULL;
+                               lip->li_bvuri = NULL;
+                               (void)ldap_chain_db_destroy_one( op->o_bd, NULL );
                                goto cleanup;
                        }
 
@@ -657,27 +717,39 @@ ldap_chain_search(
 
                /* FIXME: should we also copy filter and scope?
                 * according to RFC3296, no */
-               rc = lback->bi_op_search( op, rs );
+               rc = lback->bi_op_search( op, &rs2 );
+               if ( first_rc == -1 ) {
+                       first_rc = rc;
+               }
 
 cleanup:;
                ldap_memfree( li.li_uri );
                li.li_uri = NULL;
 
-               op->o_tmpfree( op->o_req_dn.bv_val, op->o_tmpmemctx );
-               op->o_tmpfree( op->o_req_ndn.bv_val, op->o_tmpmemctx );
-
                if ( temporary ) {
                        lip->li_uri = NULL;
                        lip->li_bvuri = NULL;
                        (void)ldap_chain_db_close_one( op->o_bd );
-                       (void)ldap_chain_db_destroy_one( op->o_bd );
+                       (void)ldap_chain_db_destroy_one( op->o_bd, NULL );
                }
                
-               if ( rc == LDAP_SUCCESS && rs->sr_err == LDAP_SUCCESS ) {
+further_cleanup:;
+               if ( !BER_BVISNULL( &pdn ) ) {
+                       op->o_tmpfree( pdn.bv_val, op->o_tmpmemctx );
+               }
+               op->o_req_dn = save_req_dn;
+
+               if ( !BER_BVISNULL( &ndn ) ) {
+                       op->o_tmpfree( ndn.bv_val, op->o_tmpmemctx );
+               }
+               op->o_req_ndn = save_req_ndn;
+               
+               if ( rc == LDAP_SUCCESS && rs2.sr_err == LDAP_SUCCESS ) {
+                       *rs = rs2;
                        break;
                }
 
-               rc = rs->sr_err;
+               rc = rs2.sr_err;
        }
 
 #ifdef LDAP_CONTROL_X_CHAINING_BEHAVIOR
@@ -692,7 +764,12 @@ cleanup:;
 
        if ( rc != LDAP_SUCCESS ) {
                /* couldn't chase any of the referrals */
-               rc = SLAP_CB_CONTINUE;
+               if ( first_rc != -1 ) {
+                       rc = first_rc;
+
+               } else {
+                       rc = SLAP_CB_CONTINUE;
+               }
        }
 
        return rc;
@@ -703,11 +780,12 @@ ldap_chain_response( Operation *op, SlapReply *rs )
 {
        slap_overinst   *on = (slap_overinst *)op->o_bd->bd_info;
        ldap_chain_t    *lc = (ldap_chain_t *)on->on_bi.bi_private;
-       void            *private = op->o_bd->be_private;
+       BackendDB       db, *bd = op->o_bd;
        ldap_chain_cb_t lb = { 0 };
        slap_callback   *sc = op->o_callback,
                        sc2 = { 0 };
        int             rc = 0;
+       const char      *text = NULL;
        const char      *matched;
        BerVarray       ref;
        struct berval   ndn = op->o_ndn;
@@ -759,6 +837,12 @@ ldap_chain_response( Operation *op, SlapReply *rs )
         *   e) what ssf
         */
 
+       db = *op->o_bd;
+       SLAP_DBFLAGS( &db ) &= ~SLAP_DBFLAG_MONITORING;
+       op->o_bd = &db;
+
+       text = rs->sr_text;
+       rs->sr_text = NULL;
        matched = rs->sr_matched;
        rs->sr_matched = NULL;
        ref = rs->sr_ref;
@@ -841,6 +925,7 @@ ldap_chain_response( Operation *op, SlapReply *rs )
                 * to send it... */
                /* FIXME: what about chaining? */
                if ( rc != SLAPD_ABANDON ) {
+                       rs->sr_err = rc;
                        send_ldap_extended( op, rs );
                        rc = LDAP_SUCCESS;
                }
@@ -892,6 +977,7 @@ cannot_chain:;
                                rc = SLAP_CB_CONTINUE;
                                rs->sr_err = sr_err;
                                rs->sr_type = sr_type;
+                               rs->sr_text = text;
                                rs->sr_matched = matched;
                                rs->sr_ref = ref;
                        }
@@ -910,9 +996,10 @@ cannot_chain:;
 dont_chain:;
        rs->sr_err = sr_err;
        rs->sr_type = sr_type;
+       rs->sr_text = text;
        rs->sr_matched = matched;
        rs->sr_ref = ref;
-       op->o_bd->be_private = private;
+       op->o_bd = bd;
        op->o_callback = sc;
        op->o_ndn = ndn;
 
@@ -1086,19 +1173,23 @@ chain_ldadd( CfEntryInfo *p, Entry *e, ConfigArgs *ca )
        if ( lc->lc_common_li == NULL ) {
                lc->lc_common_li = li;
 
-       } else if ( avl_insert( &lc->lc_lai.lai_tree, (caddr_t)li,
-               ldap_chain_uri_cmp, ldap_chain_uri_dup ) )
-       {
-               Debug( LDAP_DEBUG_ANY, "slapd-chain: "
-                       "database \"%s\" insert failed.\n",
-                       e->e_name.bv_val, 0, 0 );
-               rc = LDAP_CONSTRAINT_VIOLATION;
-               goto done;
+       } else {
+               li->li_uri = ch_strdup( at->a_vals[ 0 ].bv_val );
+               value_add_one( &li->li_bvuri, &at->a_vals[ 0 ] );
+               if ( avl_insert( &lc->lc_lai.lai_tree, (caddr_t)li,
+                       ldap_chain_uri_cmp, ldap_chain_uri_dup ) )
+               {
+                       Debug( LDAP_DEBUG_ANY, "slapd-chain: "
+                               "database \"%s\" insert failed.\n",
+                               e->e_name.bv_val, 0, 0 );
+                       rc = LDAP_CONSTRAINT_VIOLATION;
+                       goto done;
+               }
        }
 
 done:;
        if ( rc != LDAP_SUCCESS ) {
-               (void)ldap_chain_db_destroy_one( ca->be );
+               (void)ldap_chain_db_destroy_one( ca->be, NULL );
                ch_free( ca->be );
                ca->be = NULL;
        }
@@ -1123,9 +1214,9 @@ ldap_chain_cfadd_apply( void *datum, void *arg )
        struct berval                   bv;
 
        /* FIXME: should not hardcode "olcDatabase" here */
-       bv.bv_len = snprintf( lca->ca->msg, sizeof( lca->ca->msg ),
+       bv.bv_len = snprintf( lca->ca->cr_msg, sizeof( lca->ca->cr_msg ),
                "olcDatabase={%d}%s", lca->count, lback->bi_type );
-       bv.bv_val = lca->ca->msg;
+       bv.bv_val = lca->ca->cr_msg;
 
        lca->ca->be->be_private = (void *)li;
        config_build_entry( lca->op, lca->rs, lca->p->e_private, lca->ca,
@@ -1385,11 +1476,11 @@ chain_cf_gen( ConfigArgs *c )
 
        case CH_MAX_DEPTH:
                if ( c->value_int < 0 ) {
-                       snprintf( c->msg, sizeof( c->msg ),
+                       snprintf( c->cr_msg, sizeof( c->cr_msg ),
                                "<%s> invalid max referral depth %d",
                                c->argv[0], c->value_int );
                        Debug( LDAP_DEBUG_ANY, "%s: %s.\n",
-                               c->log, c->msg, 0 );
+                               c->log, c->cr_msg, 0 );
                        rc = 1;
                        break;
                }
@@ -1412,17 +1503,24 @@ chain_cf_gen( ConfigArgs *c )
 
 static int
 ldap_chain_db_init(
-       BackendDB *be )
+       BackendDB *be,
+       ConfigReply *cr )
 {
        slap_overinst   *on = (slap_overinst *)be->bd_info;
        ldap_chain_t    *lc = NULL;
 
        if ( lback == NULL ) {
+               static BackendInfo      lback2;
+
                lback = backend_info( "ldap" );
 
                if ( lback == NULL ) {
                        return 1;
                }
+
+               lback2 = *lback;
+               lback2.bi_type = ldapchain.on_bi.bi_type;
+               lback = &lback2;
        }
 
        lc = ch_malloc( sizeof( ldap_chain_t ) );
@@ -1537,7 +1635,7 @@ private_destroy:;
 
                                db.bd_info = lback;
                                db.be_private = (void *)lc->lc_cfg_li;
-                               ldap_chain_db_destroy_one( &db );
+                               ldap_chain_db_destroy_one( &db, NULL );
                                lc->lc_cfg_li = NULL;
 
                        } else {
@@ -1590,7 +1688,7 @@ ldap_chain_db_apply( void *datum, void *arg )
 
        lca->be->be_private = (void *)li;
 
-       return lca->func( lca->be );
+       return lca->func( lca->be, NULL );
 }
 
 static int
@@ -1613,7 +1711,7 @@ ldap_chain_db_func(
                        db.bd_info = lback;
                        db.be_private = lc->lc_common_li;
 
-                       rc = func( &db );
+                       rc = func( &db, NULL );
 
                        if ( rc != 0 ) {
                                return rc;
@@ -1637,14 +1735,15 @@ ldap_chain_db_func(
 
 static int
 ldap_chain_db_open(
-       BackendDB       *be )
+       BackendDB       *be,
+       ConfigReply     *cr )
 {
        slap_overinst   *on = (slap_overinst *) be->bd_info;
        ldap_chain_t    *lc = (ldap_chain_t *)on->on_bi.bi_private;
+       slap_mask_t     monitoring;
+       int             rc = 0;
 
 #ifdef LDAP_CONTROL_X_CHAINING_BEHAVIOR
-       int     rc = 0;
-
        rc = overlay_register_control( be, LDAP_CONTROL_X_CHAINING_BEHAVIOR );
        if ( rc != 0 ) {
                return rc;
@@ -1658,19 +1757,27 @@ ldap_chain_db_open(
                be->be_private = be_private;
        }
 
-       return ldap_chain_db_func( be, db_open );
+       /* filter out and restore monitoring */
+       monitoring = ( SLAP_DBFLAGS( be ) & SLAP_DBFLAG_MONITORING );
+       SLAP_DBFLAGS( be ) &= ~SLAP_DBFLAG_MONITORING;
+       rc = ldap_chain_db_func( be, db_open );
+       SLAP_DBFLAGS( be ) |= monitoring;
+
+       return rc;
 }
 
 static int
 ldap_chain_db_close(
-       BackendDB       *be )
+       BackendDB       *be,
+       ConfigReply     *cr )
 {
        return ldap_chain_db_func( be, db_close );
 }
 
 static int
 ldap_chain_db_destroy(
-       BackendDB       *be )
+       BackendDB       *be,
+       ConfigReply     *cr )
 {
        slap_overinst   *on = (slap_overinst *) be->bd_info;
        ldap_chain_t    *lc = (ldap_chain_t *)on->on_bi.bi_private;
@@ -1698,17 +1805,18 @@ ldap_chain_db_init_common(
 {
        BackendInfo     *bi = be->bd_info;
        ldapinfo_t      *li;
-       int             t;
+       int             rc;
 
        be->bd_info = lback;
        be->be_private = NULL;
-       t = lback->bi_db_init( be );
-       if ( t != 0 ) {
-               return t;
+       rc = lback->bi_db_init( be, NULL );
+       if ( rc != 0 ) {
+               return rc;
        }
        li = (ldapinfo_t *)be->be_private;
        li->li_urllist_f = NULL;
        li->li_urllist_p = NULL;
+
        be->bd_info = bi;
 
        return 0;
@@ -1732,11 +1840,11 @@ ldap_chain_db_init_one(
        BackendInfo     *bi = be->bd_info;
        ldapinfo_t      *li;
 
-       int             t;
+       slap_op_t       t;
 
        be->bd_info = lback;
        be->be_private = NULL;
-       t = lback->bi_db_init( be );
+       t = lback->bi_db_init( be, NULL );
        if ( t != 0 ) {
                return t;
        }
@@ -1748,7 +1856,7 @@ ldap_chain_db_init_one(
        li->li_nretries = lc->lc_common_li->li_nretries;
        li->li_flags = lc->lc_common_li->li_flags;
        li->li_version = lc->lc_common_li->li_version;
-       for ( t = 0; t < LDAP_BACK_OP_LAST; t++ ) {
+       for ( t = 0; t < SLAP_OP_LAST; t++ ) {
                li->li_timeout[ t ] = lc->lc_common_li->li_timeout[ t ];
        }
        be->bd_info = bi;
@@ -1756,6 +1864,33 @@ ldap_chain_db_init_one(
        return 0;
 }
 
+static int
+ldap_chain_db_open_one(
+       BackendDB       *be )
+{
+       if ( SLAP_DBMONITORING( be ) ) {
+               ldapinfo_t      *li = (ldapinfo_t *)be->be_private;
+
+               if ( li->li_uri == NULL ) {
+                       ber_str2bv( "cn=Common Connections", 0, 1,
+                               &li->li_monitor_info.lmi_rdn );
+
+               } else {
+                       char            *ptr;
+
+                       li->li_monitor_info.lmi_rdn.bv_len
+                               = STRLENOF( "cn=" ) + strlen( li->li_uri );
+                       ptr = li->li_monitor_info.lmi_rdn.bv_val
+                               = ch_malloc( li->li_monitor_info.lmi_rdn.bv_len + 1 );
+                       ptr = lutil_strcopy( ptr, "cn=" );
+                       ptr = lutil_strcopy( ptr, li->li_uri );
+                       ptr[ 0 ] = '\0';
+               }
+       }
+
+       return lback->bi_db_open( be, NULL );
+}
+
 typedef struct ldap_chain_conn_apply_t {
        BackendDB       *be;
        Connection      *conn;
@@ -1924,8 +2059,6 @@ ldap_chain_parse_ctrl(
 }
 #endif /* LDAP_CONTROL_X_CHAINING_BEHAVIOR */
 
-static slap_overinst ldapchain;
-
 int
 chain_initialize( void )
 {