pool privileged connections (ITS#4791)

[openldap] / servers / slapd / back-ldap / search.c

diff --git a/servers/slapd/back-ldap/search.c b/servers/slapd/back-ldap/search.c
index f7e1667e2c761c1719c387de0b4d76ffff705204..c7a20541665543a6ed945e288fde2b43b08900ea 100644 (file)
--- a/servers/slapd/back-ldap/search.c
+++ b/servers/slapd/back-ldap/search.c
@@ -143,15 +143,16 @@ ldap_back_search(
 {
        ldapinfo_t      *li = (ldapinfo_t *) op->o_bd->be_private;
 
-       ldapconn_t      *lc;
+       ldapconn_t      *lc = NULL;
        struct timeval  tv;
-       time_t          stoptime = (time_t)-1;
+       time_t          stoptime = (time_t)(-1);
        LDAPMessage     *res,
                        *e;
        int             rc = 0,
                        msgid; 
        struct berval   match = BER_BVNULL,
                        filter = BER_BVNULL;
+       int             free_filter = 0;
        int             i;
        char            **attrs = NULL;
        int             freetext = 0;
@@ -160,8 +161,7 @@ ldap_back_search(
        /* FIXME: shouldn't this be null? */
        const char      *save_matched = rs->sr_matched;
 
-       lc = ldap_back_getconn( op, rs, LDAP_BACK_SENDERR );
-       if ( !lc || !ldap_back_dobind( lc, op, rs, LDAP_BACK_SENDERR ) ) {
+       if ( !ldap_back_dobind( &lc, op, rs, LDAP_BACK_SENDERR ) ) {
                return rs->sr_err;
        }
 
@@ -203,7 +203,8 @@ ldap_back_search(
        }
 
        ctrls = op->o_ctrls;
-       rc = ldap_back_proxy_authz_ctrl( &lc->lc_bound_ndn, op, rs, &ctrls );
+       rc = ldap_back_proxy_authz_ctrl( &lc->lc_bound_ndn,
+               li->li_version, &li->li_idassert, op, rs, &ctrls );
        if ( rc != LDAP_SUCCESS ) {
                goto finish;
        }
@@ -239,6 +240,7 @@ retry:
 
                case LDAP_FILTER_ERROR:
                        if ( ldap_back_munge_filter( op, &filter ) ) {
+                               free_filter = 1;
                                goto retry;
                        }
 
@@ -286,6 +288,11 @@ retry:
                        continue;
 
                } else {
+                       /* only touch when activity actually took place... */
+                       if ( li->li_idle_timeout && lc ) {
+                               lc->lc_time = op->o_time;
+                       }
+
                        /* don't retry any more */
                        dont_retry = 1;
                }
@@ -419,9 +426,7 @@ retry:
                        }
 
                        if ( match.bv_val != NULL ) {
-                               {
-                                       match.bv_len = strlen( match.bv_val );
-                               }
+                               match.bv_len = strlen( match.bv_val );
                        }
 
                        /* cleanup */
@@ -470,7 +475,11 @@ finish:;
                ldap_back_quarantine( op, rs );
        }
 
-       if ( rc != SLAPD_ABANDON ) {
+#if 0
+       /* let send_ldap_result play cleanup handlers (ITS#4645) */
+       if ( rc != SLAPD_ABANDON )
+#endif
+       {
                send_ldap_result( op, rs );
        }
 
@@ -491,7 +500,7 @@ finish:;
                rs->sr_matched = save_matched;
        }
 
-       if ( !BER_BVISNULL( &filter ) && filter.bv_val != op->ors_filterstr.bv_val ) {
+       if ( free_filter ) {
                op->o_tmpfree( filter.bv_val, op->o_tmpmemctx );
        }
 
@@ -562,13 +571,10 @@ ldap_build_entry(
                slap_syntax_validate_func       *validate;
                slap_syntax_transform_func      *pretty;
 
-               attr = (Attribute *)ch_malloc( sizeof( Attribute ) );
+               attr = attr_alloc( NULL );
                if ( attr == NULL ) {
                        continue;
                }
-               attr->a_flags = 0;
-               attr->a_next = 0;
-               attr->a_desc = NULL;
                if ( slap_bv2ad( &a, &attr->a_desc, &text ) 
                                != LDAP_SUCCESS )
                {
@@ -579,7 +585,7 @@ ldap_build_entry(
                                        "%s ldap_build_entry: "
                                        "slap_bv2undef_ad(%s): %s\n",
                                        op->o_log_prefix, a.bv_val, text );
-                               ch_free( attr );
+                               attr_free( attr );
                                continue;
                        }
                }
@@ -602,7 +608,7 @@ ldap_build_entry(
                         */
                        ( void )ber_scanf( &ber, "x" /* [W] */ );
 
-                       ch_free( attr );
+                       attr_free( attr );
                        continue;
                }
                
@@ -683,7 +689,7 @@ ldap_build_entry(
 
                                if ( rc != LDAP_SUCCESS ) {
                                        BER_BVZERO( &attr->a_nvals[i] );
-                                       ch_free( attr );
+                                       attr_free( attr );
                                        goto next_attr;
                                }
                        }
@@ -710,10 +716,11 @@ ldap_back_entry_get(
                ObjectClass             *oc,
                AttributeDescription    *at,
                int                     rw,
-               Entry                   **ent
-)
+               Entry                   **ent )
 {
-       ldapconn_t      *lc;
+       ldapinfo_t      *li = (ldapinfo_t *) op->o_bd->be_private;
+
+       ldapconn_t      *lc = NULL;
        int             rc = 1,
                        do_not_cache;
        struct berval   bdn;
@@ -730,8 +737,7 @@ ldap_back_entry_get(
        /* Tell getconn this is a privileged op */
        do_not_cache = op->o_do_not_cache;
        op->o_do_not_cache = 1;
-       lc = ldap_back_getconn( op, &rs, LDAP_BACK_DONTSEND );
-       if ( !lc || !ldap_back_dobind( lc, op, &rs, LDAP_BACK_DONTSEND ) ) {
+       if ( !ldap_back_dobind( &lc, op, &rs, LDAP_BACK_DONTSEND ) ) {
                op->o_do_not_cache = do_not_cache;
                return rs.sr_err;
        }
@@ -761,13 +767,14 @@ ldap_back_entry_get(
                *ptr++ = '\0';
        }
 
+retry:
        ctrls = op->o_ctrls;
-       rc = ldap_back_proxy_authz_ctrl( &lc->lc_bound_ndn, op, &rs, &ctrls );
+       rc = ldap_back_proxy_authz_ctrl( &lc->lc_bound_ndn,
+               li->li_version, &li->li_idassert, op, &rs, &ctrls );
        if ( rc != LDAP_SUCCESS ) {
                goto cleanup;
        }
        
-retry:
        rc = ldap_search_ext_s( lc->lc_ld, ndn->bv_val, LDAP_SCOPE_BASE, filter,
                                attrp, 0, ctrls, NULL,
                                NULL, LDAP_NO_LIMIT, &result );
@@ -775,6 +782,8 @@ retry:
                if ( rc == LDAP_SERVER_DOWN && do_retry ) {
                        do_retry = 0;
                        if ( ldap_back_retry( &lc, op, &rs, LDAP_BACK_DONTSEND ) ) {
+                               /* if the identity changed, there might be need to re-authz */
+                               (void)ldap_back_proxy_authz_ctrl_free( op, &ctrls );
                                goto retry;
                        }
                }
@@ -787,7 +796,7 @@ retry:
                goto cleanup;
        }
 
-       *ent = ch_calloc( 1, sizeof( Entry ) );
+       *ent = entry_alloc();
        if ( *ent == NULL ) {
                rc = LDAP_NO_MEMORY;
                goto cleanup;