]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/back-ldap/chain.c
allow proxies to filter out search references (ITS#5593)
[openldap] / servers / slapd / back-ldap / chain.c
index ca42a146d4a309761086885454946ef47a7428db..32783ed0a9765a66baea47b8f39e484290920a43 100644 (file)
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2003-2007 The OpenLDAP Foundation.
+ * Copyright 2003-2008 The OpenLDAP Foundation.
  * Portions Copyright 2003 Howard Chu.
  * All rights reserved.
  *
@@ -112,7 +112,7 @@ static int ldap_chain_db_init_common( BackendDB     *be );
 static int ldap_chain_db_init_one( BackendDB *be );
 static int ldap_chain_db_open_one( BackendDB *be );
 #define        ldap_chain_db_close_one(be)     (0)
-#define        ldap_chain_db_destroy_one(be)   (lback)->bi_db_destroy( (be) )
+#define        ldap_chain_db_destroy_one(be, rs)       (lback)->bi_db_destroy( (be), (rs) )
 
 typedef struct ldap_chain_cb_t {
        ldap_chain_status_t     lb_status;
@@ -414,10 +414,11 @@ ldap_chain_op(
        li.li_bvuri = bvuri;
        first_rc = -1;
        for ( ; !BER_BVISNULL( ref ); ref++ ) {
+               SlapReply       rs2 = { 0 };
                LDAPURLDesc     *srv = NULL;
                struct berval   save_req_dn = op->o_req_dn,
                                save_req_ndn = op->o_req_ndn,
-                               dn,
+                               dn = BER_BVNULL,
                                pdn = BER_BVNULL,
                                ndn = BER_BVNULL;
                int             temporary = 0;
@@ -448,17 +449,24 @@ Document: RFC 4511
                }
 
                /* normalize DN */
-               ber_str2bv( srv->lud_dn, 0, 0, &dn );
-               rc = dnPrettyNormal( NULL, &dn, &pdn, &ndn, op->o_tmpmemctx );
-               if ( rc == LDAP_SUCCESS ) {
-                       /* remove DN essentially because later on 
-                        * ldap_initialize() will parse the URL 
-                        * as a comma-separated URL list */
+               rc = LDAP_SUCCESS;
+               srv->lud_scope = LDAP_SCOPE_DEFAULT;
+               if ( srv->lud_dn != NULL ) {
+                       ber_str2bv( srv->lud_dn, 0, 0, &dn );
+                       rc = dnPrettyNormal( NULL, &dn, &pdn, &ndn, op->o_tmpmemctx );
+                       if ( rc == LDAP_SUCCESS ) {
+                               /* remove DN essentially because later on 
+                                * ldap_initialize() will parse the URL 
+                                * as a comma-separated URL list */
+                               srv->lud_dn = "";
+                       }
+
+               } else {
                        srv->lud_dn = "";
-                       srv->lud_scope = LDAP_SCOPE_DEFAULT;
-                       li.li_uri = ldap_url_desc2str( srv );
-                       srv->lud_dn = dn.bv_val;
                }
+
+               li.li_uri = ldap_url_desc2str( srv );
+               srv->lud_dn = dn.bv_val;
                ldap_free_urldesc( srv );
 
                if ( rc != LDAP_SUCCESS ) {
@@ -499,7 +507,7 @@ Document: RFC 4511
                        if ( rc != 0 ) {
                                lip->li_uri = NULL;
                                lip->li_bvuri = NULL;
-                               (void)ldap_chain_db_destroy_one( op->o_bd );
+                               (void)ldap_chain_db_destroy_one( op->o_bd, NULL);
                                goto cleanup;
                        }
 
@@ -523,7 +531,7 @@ Document: RFC 4511
                lb->lb_op_f = op_f;
                lb->lb_depth = depth + 1;
 
-               rc = op_f( op, rs );
+               rc = op_f( op, &rs2 );
 
                /* note the first error */
                if ( first_rc == -1 ) {
@@ -538,7 +546,7 @@ cleanup:;
                        lip->li_uri = NULL;
                        lip->li_bvuri = NULL;
                        (void)ldap_chain_db_close_one( op->o_bd );
-                       (void)ldap_chain_db_destroy_one( op->o_bd );
+                       (void)ldap_chain_db_destroy_one( op->o_bd, NULL );
                }
 
 further_cleanup:;
@@ -552,9 +560,12 @@ further_cleanup:;
                }
                op->o_req_ndn = save_req_ndn;
                
-               if ( rc == LDAP_SUCCESS && rs->sr_err == LDAP_SUCCESS ) {
+               if ( rc == LDAP_SUCCESS && rs2.sr_err == LDAP_SUCCESS ) {
+                       *rs = rs2;
                        break;
                }
+
+               rc = rs2.sr_err;
        }
 
 #ifdef LDAP_CONTROL_X_CHAINING_BEHAVIOR
@@ -606,6 +617,7 @@ ldap_chain_search(
         * to be set once for all (correct?) */
        li.li_bvuri = bvuri;
        for ( ; !BER_BVISNULL( &ref[0] ); ref++ ) {
+               SlapReply       rs2 = { 0 };
                LDAPURLDesc     *srv;
                struct berval   save_req_dn = op->o_req_dn,
                                save_req_ndn = op->o_req_ndn,
@@ -624,16 +636,19 @@ ldap_chain_search(
                }
 
                /* normalize DN */
-               ber_str2bv( srv->lud_dn, 0, 0, &dn );
-               rc = dnPrettyNormal( NULL, &dn, &pdn, &ndn, op->o_tmpmemctx );
-               if ( rc == LDAP_SUCCESS ) {
-                       /* remove DN essentially because later on 
-                        * ldap_initialize() will parse the URL 
-                        * as a comma-separated URL list */
-                       srv->lud_dn = "";
-                       srv->lud_scope = LDAP_SCOPE_DEFAULT;
-                       li.li_uri = ldap_url_desc2str( srv );
-                       srv->lud_dn = dn.bv_val;
+               rc = LDAP_INVALID_SYNTAX;
+               if ( srv->lud_dn != NULL ) {
+                       ber_str2bv( srv->lud_dn, 0, 0, &dn );
+                       rc = dnPrettyNormal( NULL, &dn, &pdn, &ndn, op->o_tmpmemctx );
+                       if ( rc == LDAP_SUCCESS ) {
+                               /* remove DN essentially because later on 
+                                * ldap_initialize() will parse the URL 
+                                * as a comma-separated URL list */
+                               srv->lud_dn = "";
+                               srv->lud_scope = LDAP_SCOPE_DEFAULT;
+                               li.li_uri = ldap_url_desc2str( srv );
+                               srv->lud_dn = dn.bv_val;
+                       }
                }
                ldap_free_urldesc( srv );
 
@@ -676,7 +691,7 @@ ldap_chain_search(
                        if ( rc != 0 ) {
                                lip->li_uri = NULL;
                                lip->li_bvuri = NULL;
-                               (void)ldap_chain_db_destroy_one( op->o_bd );
+                               (void)ldap_chain_db_destroy_one( op->o_bd, NULL );
                                goto cleanup;
                        }
 
@@ -702,7 +717,7 @@ ldap_chain_search(
 
                /* FIXME: should we also copy filter and scope?
                 * according to RFC3296, no */
-               rc = lback->bi_op_search( op, rs );
+               rc = lback->bi_op_search( op, &rs2 );
                if ( first_rc == -1 ) {
                        first_rc = rc;
                }
@@ -711,14 +726,11 @@ cleanup:;
                ldap_memfree( li.li_uri );
                li.li_uri = NULL;
 
-               op->o_tmpfree( op->o_req_dn.bv_val, op->o_tmpmemctx );
-               op->o_tmpfree( op->o_req_ndn.bv_val, op->o_tmpmemctx );
-
                if ( temporary ) {
                        lip->li_uri = NULL;
                        lip->li_bvuri = NULL;
                        (void)ldap_chain_db_close_one( op->o_bd );
-                       (void)ldap_chain_db_destroy_one( op->o_bd );
+                       (void)ldap_chain_db_destroy_one( op->o_bd, NULL );
                }
                
 further_cleanup:;
@@ -732,11 +744,12 @@ further_cleanup:;
                }
                op->o_req_ndn = save_req_ndn;
                
-               if ( rc == LDAP_SUCCESS && rs->sr_err == LDAP_SUCCESS ) {
+               if ( rc == LDAP_SUCCESS && rs2.sr_err == LDAP_SUCCESS ) {
+                       *rs = rs2;
                        break;
                }
 
-               rc = rs->sr_err;
+               rc = rs2.sr_err;
        }
 
 #ifdef LDAP_CONTROL_X_CHAINING_BEHAVIOR
@@ -772,6 +785,7 @@ ldap_chain_response( Operation *op, SlapReply *rs )
        slap_callback   *sc = op->o_callback,
                        sc2 = { 0 };
        int             rc = 0;
+       const char      *text = NULL;
        const char      *matched;
        BerVarray       ref;
        struct berval   ndn = op->o_ndn;
@@ -827,6 +841,8 @@ ldap_chain_response( Operation *op, SlapReply *rs )
        SLAP_DBFLAGS( &db ) &= ~SLAP_DBFLAG_MONITORING;
        op->o_bd = &db;
 
+       text = rs->sr_text;
+       rs->sr_text = NULL;
        matched = rs->sr_matched;
        rs->sr_matched = NULL;
        ref = rs->sr_ref;
@@ -909,6 +925,7 @@ ldap_chain_response( Operation *op, SlapReply *rs )
                 * to send it... */
                /* FIXME: what about chaining? */
                if ( rc != SLAPD_ABANDON ) {
+                       rs->sr_err = rc;
                        send_ldap_extended( op, rs );
                        rc = LDAP_SUCCESS;
                }
@@ -960,6 +977,7 @@ cannot_chain:;
                                rc = SLAP_CB_CONTINUE;
                                rs->sr_err = sr_err;
                                rs->sr_type = sr_type;
+                               rs->sr_text = text;
                                rs->sr_matched = matched;
                                rs->sr_ref = ref;
                        }
@@ -978,6 +996,7 @@ cannot_chain:;
 dont_chain:;
        rs->sr_err = sr_err;
        rs->sr_type = sr_type;
+       rs->sr_text = text;
        rs->sr_matched = matched;
        rs->sr_ref = ref;
        op->o_bd = bd;
@@ -1170,7 +1189,7 @@ chain_ldadd( CfEntryInfo *p, Entry *e, ConfigArgs *ca )
 
 done:;
        if ( rc != LDAP_SUCCESS ) {
-               (void)ldap_chain_db_destroy_one( ca->be );
+               (void)ldap_chain_db_destroy_one( ca->be, NULL );
                ch_free( ca->be );
                ca->be = NULL;
        }
@@ -1195,9 +1214,9 @@ ldap_chain_cfadd_apply( void *datum, void *arg )
        struct berval                   bv;
 
        /* FIXME: should not hardcode "olcDatabase" here */
-       bv.bv_len = snprintf( lca->ca->msg, sizeof( lca->ca->msg ),
+       bv.bv_len = snprintf( lca->ca->cr_msg, sizeof( lca->ca->cr_msg ),
                "olcDatabase={%d}%s", lca->count, lback->bi_type );
-       bv.bv_val = lca->ca->msg;
+       bv.bv_val = lca->ca->cr_msg;
 
        lca->ca->be->be_private = (void *)li;
        config_build_entry( lca->op, lca->rs, lca->p->e_private, lca->ca,
@@ -1457,11 +1476,11 @@ chain_cf_gen( ConfigArgs *c )
 
        case CH_MAX_DEPTH:
                if ( c->value_int < 0 ) {
-                       snprintf( c->msg, sizeof( c->msg ),
+                       snprintf( c->cr_msg, sizeof( c->cr_msg ),
                                "<%s> invalid max referral depth %d",
                                c->argv[0], c->value_int );
                        Debug( LDAP_DEBUG_ANY, "%s: %s.\n",
-                               c->log, c->msg, 0 );
+                               c->log, c->cr_msg, 0 );
                        rc = 1;
                        break;
                }
@@ -1484,7 +1503,8 @@ chain_cf_gen( ConfigArgs *c )
 
 static int
 ldap_chain_db_init(
-       BackendDB *be )
+       BackendDB *be,
+       ConfigReply *cr )
 {
        slap_overinst   *on = (slap_overinst *)be->bd_info;
        ldap_chain_t    *lc = NULL;
@@ -1615,7 +1635,7 @@ private_destroy:;
 
                                db.bd_info = lback;
                                db.be_private = (void *)lc->lc_cfg_li;
-                               ldap_chain_db_destroy_one( &db );
+                               ldap_chain_db_destroy_one( &db, NULL );
                                lc->lc_cfg_li = NULL;
 
                        } else {
@@ -1668,7 +1688,7 @@ ldap_chain_db_apply( void *datum, void *arg )
 
        lca->be->be_private = (void *)li;
 
-       return lca->func( lca->be );
+       return lca->func( lca->be, NULL );
 }
 
 static int
@@ -1691,7 +1711,7 @@ ldap_chain_db_func(
                        db.bd_info = lback;
                        db.be_private = lc->lc_common_li;
 
-                       rc = func( &db );
+                       rc = func( &db, NULL );
 
                        if ( rc != 0 ) {
                                return rc;
@@ -1715,7 +1735,8 @@ ldap_chain_db_func(
 
 static int
 ldap_chain_db_open(
-       BackendDB       *be )
+       BackendDB       *be,
+       ConfigReply     *cr )
 {
        slap_overinst   *on = (slap_overinst *) be->bd_info;
        ldap_chain_t    *lc = (ldap_chain_t *)on->on_bi.bi_private;
@@ -1747,14 +1768,16 @@ ldap_chain_db_open(
 
 static int
 ldap_chain_db_close(
-       BackendDB       *be )
+       BackendDB       *be,
+       ConfigReply     *cr )
 {
        return ldap_chain_db_func( be, db_close );
 }
 
 static int
 ldap_chain_db_destroy(
-       BackendDB       *be )
+       BackendDB       *be,
+       ConfigReply     *cr )
 {
        slap_overinst   *on = (slap_overinst *) be->bd_info;
        ldap_chain_t    *lc = (ldap_chain_t *)on->on_bi.bi_private;
@@ -1786,7 +1809,7 @@ ldap_chain_db_init_common(
 
        be->bd_info = lback;
        be->be_private = NULL;
-       rc = lback->bi_db_init( be );
+       rc = lback->bi_db_init( be, NULL );
        if ( rc != 0 ) {
                return rc;
        }
@@ -1821,7 +1844,7 @@ ldap_chain_db_init_one(
 
        be->bd_info = lback;
        be->be_private = NULL;
-       t = lback->bi_db_init( be );
+       t = lback->bi_db_init( be, NULL );
        if ( t != 0 ) {
                return t;
        }
@@ -1865,7 +1888,7 @@ ldap_chain_db_open_one(
                }
        }
 
-       return lback->bi_db_open( be );
+       return lback->bi_db_open( be, NULL );
 }
 
 typedef struct ldap_chain_conn_apply_t {