Merge in latest from -current.

[openldap] / servers / slapd / back-ldbm / bind.c

diff --git a/servers/slapd/back-ldbm/bind.c b/servers/slapd/back-ldbm/bind.c
index be453f8e5dd8f47c2e944d2cf66889a0956e765a..66dfddbceb55fff38dc5908f1f2c953635238a09 100644 (file)
--- a/servers/slapd/back-ldbm/bind.c
+++ b/servers/slapd/back-ldbm/bind.c
@@ -6,6 +6,7 @@
 #include <sys/socket.h>
 #include "slap.h"
 #include "back-ldbm.h"
+#include "proto-back-ldbm.h"
 #ifdef KERBEROS
 #ifdef KERBEROS_V
 #include <kerberosIV/krb.h>
@@ -32,7 +33,6 @@ extern char *crypt (char *key, char *salt);
 
 #include <lutil.h>
 
-extern Entry           *dn2entry();
 extern Attribute       *attr_find();
 
 #ifdef KERBEROS
@@ -140,7 +140,10 @@ ldbm_back_bind(
        AUTH_DAT        ad;
 #endif
 
-       if ( (e = dn2entry( be, dn, &matched )) == NULL ) {
+       Debug(LDAP_DEBUG_ARGS, "==> ldbm_back_bind: dn: %s\n", dn, 0, 0);
+
+       /* get entry with reader lock */
+       if ( (e = dn2entry_r( be, dn, &matched )) == NULL ) {
                /* allow noauth binds */
                if ( method == LDAP_AUTH_SIMPLE && cred->bv_len == 0 ) {
                        /*
@@ -153,8 +156,7 @@ ldbm_back_bind(
                        /* front end will send result */
                        rc = 0;
                } else {
-                       send_ldap_result( conn, op, LDAP_NO_SUCH_OBJECT,
-                           matched, NULL );
+                       send_ldap_result( conn, op, LDAP_NO_SUCH_OBJECT, matched, NULL );
                        rc = 1;
                }
                if ( matched != NULL ) {
@@ -163,25 +165,32 @@ ldbm_back_bind(
                return( rc );
        }
 
+       /* check for deleted */
+
        switch ( method ) {
        case LDAP_AUTH_SIMPLE:
                if ( cred->bv_len == 0 ) {
                        send_ldap_result( conn, op, LDAP_SUCCESS, NULL, NULL );
-                       return( 1 );
+
+                       /* stop front end from sending result */
+                       rc = 1;
+                       goto return_results;
                } else if ( be_isroot_pw( be, dn, cred ) ) {
                        /* front end will send result */
-                       return( 0 );
+                       rc = 0;
+                       goto return_results;
                }
 
                if ( (a = attr_find( e->e_attrs, "userpassword" )) == NULL ) {
                        if ( be_isroot_pw( be, dn, cred ) ) {
                                /* front end will send result */
-                               return( 0 );
+                               rc = 0;
+                               goto return_results;
                        }
                        send_ldap_result( conn, op, LDAP_INAPPROPRIATE_AUTH,
                            NULL, NULL );
-                       cache_return_entry( &li->li_cache, e );
-                       return( 1 );
+                       rc = 1;
+                       goto return_results;
                }
 
 #ifdef LDAP_CRYPT
@@ -189,16 +198,18 @@ ldbm_back_bind(
 #else
                if ( value_find( a->a_vals, cred, a->a_syntax, 0 ) != 0 )
 #endif
-{
+               {
                        if ( be_isroot_pw( be, dn, cred ) ) {
                                /* front end will send result */
-                               return( 0 );
+                               rc = 0;
+                               goto return_results;
                        }
                        send_ldap_result( conn, op, LDAP_INVALID_CREDENTIALS,
                                NULL, NULL );
-                       cache_return_entry( &li->li_cache, e );
-                       return( 1 );
+                       rc = 1;
+                       goto return_results;
                }
+               rc = 0;
                break;
 
 #ifdef KERBEROS
@@ -206,8 +217,8 @@ ldbm_back_bind(
                if ( krbv4_ldap_auth( be, cred, &ad ) != LDAP_SUCCESS ) {
                        send_ldap_result( conn, op, LDAP_INVALID_CREDENTIALS,
                            NULL, NULL );
-                       cache_return_entry( &li->li_cache, e );
-                       return( 1 );
+                       rc = 0;
+                       goto return_results;
                }
                sprintf( krbname, "%s%s%s@%s", ad.pname, *ad.pinst ? "."
                    : "", ad.pinst, ad.prealm );
@@ -216,43 +227,47 @@ ldbm_back_bind(
                         * no krbName values present:  check against DN
                         */
                        if ( strcasecmp( dn, krbname ) == 0 ) {
+                               rc = 0; /* XXX wild ass guess */
                                break;
                        }
                        send_ldap_result( conn, op, LDAP_INAPPROPRIATE_AUTH,
                            NULL, NULL );
-                       cache_return_entry( &li->li_cache, e );
-                       return( 1 );
+                       rc = 1;
+                       goto return_results;
                } else {        /* look for krbName match */
                        struct berval   krbval;
 
                        krbval.bv_val = krbname;
                        krbval.bv_len = strlen( krbname );
 
-                       if ( value_find( a->a_vals, &krbval, a->a_syntax, 3 )
-                           != 0 ) {
+                       if ( value_find( a->a_vals, &krbval, a->a_syntax, 3 ) != 0 ) {
                                send_ldap_result( conn, op,
                                    LDAP_INVALID_CREDENTIALS, NULL, NULL );
-                               cache_return_entry( &li->li_cache, e );
-                               return( 1 );
+                               rc = 1;
+                               goto return_results;
                        }
                }
                break;
 
        case LDAP_AUTH_KRBV42:
                send_ldap_result( conn, op, LDAP_SUCCESS, NULL, NULL );
-               cache_return_entry( &li->li_cache, e );
-               return( 1 );
+               /* stop front end from sending result */
+               rc = 1;
+               goto return_results;
 #endif
 
        default:
                send_ldap_result( conn, op, LDAP_STRONG_AUTH_NOT_SUPPORTED,
                    NULL, "auth method not supported" );
-               cache_return_entry( &li->li_cache, e );
-               return( 1 );
+               rc = 1;
+               goto return_results;
        }
 
-       cache_return_entry( &li->li_cache, e );
+return_results:;
+       /* free entry and reader lock */
+       cache_return_entry_r( &li->li_cache, e );
 
-       /* success:  front end will send result */
-       return( 0 );
+       /* front end with send result on success (rc==0) */
+       return( rc );
 }
+