/* $OpenLDAP$ */
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
*
- * Copyright 1999-2007 The OpenLDAP Foundation.
+ * Copyright 1999-2012 The OpenLDAP Foundation.
* Portions Copyright 2001-2003 Pierangelo Masarati.
* Portions Copyright 1999-2003 Howard Chu.
* All rights reserved.
#include "slap.h"
#include "../back-ldap/back-ldap.h"
#include "back-meta.h"
-#undef ldap_debug /* silence a warning in ldap-int.h */
-#include "../../../libraries/libldap/ldap-int.h"
#include "lutil_ldap.h"
int candidate,
Operation *op,
SlapReply *rs,
- ldap_back_send_t sendok );
+ ldap_back_send_t sendok,
+ int dolock );
static int
meta_back_single_bind(
rc = LDAP_SUCCESS;
gotit = 1;
- } else if ( isroot == 0 ) {
+ } else if ( !isroot ) {
/*
* A bind operation is expected to have
* ONE CANDIDATE ONLY!
}
- (void)meta_back_proxy_authz_bind( mc, i, op, rs, LDAP_BACK_DONTSEND );
+ (void)meta_back_proxy_authz_bind( mc, i, op, rs, LDAP_BACK_DONTSEND, 1 );
lerr = rs->sr_err;
} else {
if ( lerr != LDAP_SUCCESS ) {
rc = rs->sr_err = lerr;
- /* Mark the meta_conn struct as tainted so
- * it'll be freed by meta_conn_back_destroy below */
- LDAP_BACK_CONN_TAINTED_SET( mc );
/* FIXME: in some cases (e.g. unavailable)
* do not assume it's not candidate; rather
if ( !LDAP_BACK_PCONN_ISPRIV( mc )
&& !dn_match( &op->o_req_ndn, &mc->mc_local_ndn ) )
{
- metaconn_t *tmpmc;
int lerr;
/* wait for all other ops to release the connection */
-retry_lock:;
ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
- if ( mc->mc_refcnt > 1 ) {
- ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
- ldap_pvt_thread_yield();
- goto retry_lock;
- }
-
assert( mc->mc_refcnt == 1 );
#if META_BACK_PRINT_CONNTREE > 0
meta_back_print_conntree( mi, ">>> meta_back_bind" );
#endif /* META_BACK_PRINT_CONNTREE */
- tmpmc = avl_delete( &mi->mi_conninfo.lai_tree, (caddr_t)mc,
- meta_back_conndn_cmp );
- assert( tmpmc == mc );
/* delete all cached connections with the current connection */
if ( LDAP_BACK_SINGLECONN( mi ) ) {
+ metaconn_t *tmpmc;
+
while ( ( tmpmc = avl_delete( &mi->mi_conninfo.lai_tree, (caddr_t)mc, meta_back_conn_cmp ) ) != NULL )
{
+ assert( !LDAP_BACK_PCONN_ISPRIV( mc ) );
Debug( LDAP_DEBUG_TRACE,
- "=>meta_back_bind: destroying conn %ld (refcnt=%u)\n",
- LDAP_BACK_PCONN_ID( mc ), mc->mc_refcnt, 0 );
+ "=>meta_back_bind: destroying conn %lu (refcnt=%u)\n",
+ mc->mc_conn->c_connid, mc->mc_refcnt, 0 );
if ( tmpmc->mc_refcnt != 0 ) {
/* taint it */
}
ber_bvreplace( &mc->mc_local_ndn, &op->o_req_ndn );
- if ( isroot ) {
- LDAP_BACK_CONN_ISPRIV_SET( mc );
- LDAP_BACK_PCONN_SET( mc, op );
- }
lerr = avl_insert( &mi->mi_conninfo.lai_tree, (caddr_t)mc,
meta_back_conndn_cmp, meta_back_conndn_dup );
#if META_BACK_PRINT_CONNTREE > 0
meta_back_print_conntree( mi, "<<< meta_back_bind" );
#endif /* META_BACK_PRINT_CONNTREE */
- ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
- if ( lerr == -1 ) {
- /* we can do this because mc_refcnt == 1 */
- assert( mc->mc_refcnt == 1 );
- mc->mc_refcnt = 0;
- meta_back_conn_free( mc );
- mc = NULL;
+ if ( lerr == 0 ) {
+#if 0
+ /* NOTE: a connection cannot be privileged
+ * and be in the avl tree at the same time
+ */
+ if ( isroot ) {
+ LDAP_BACK_CONN_ISPRIV_SET( mc );
+ LDAP_BACK_PCONN_SET( mc, op );
+ }
+#endif
+ LDAP_BACK_CONN_CACHED_SET( mc );
+
+ } else {
+ LDAP_BACK_CONN_CACHED_CLEAR( mc );
}
+ ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
}
}
metaconn_t *mc,
int candidate,
int msgid,
- ldap_back_send_t sendok )
+ ldap_back_send_t sendok,
+ int dolock )
{
metainfo_t *mi = ( metainfo_t * )op->o_bd->be_private;
metatarget_t *mt = mi->mi_targets[ candidate ];
/* don't let anyone else use this handler,
* because there's a pending bind that will not
* be acknowledged */
- ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
+ if ( dolock) {
+ ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
+ }
assert( LDAP_BACK_CONN_BINDING( msc ) );
#ifdef DEBUG_205
#endif /* DEBUG_205 */
meta_clear_one_candidate( op, mc, candidate );
- ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
+ if ( dolock ) {
+ ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
+ }
rs->sr_err = timeout_err;
rs->sr_text = timeout_text;
if ( rc != LDAP_SUCCESS ) {
rs->sr_err = rc;
}
+ rs->sr_err = slap_map_api2result( rs );
break;
}
}
ldap_pvt_thread_yield();
}
- ldap_back_controls_free( op, rs, &ctrls );
+ mi->mi_ldap_extra->controls_free( op, rs, &ctrls );
- meta_back_bind_op_result( op, rs, mc, candidate, msgid, LDAP_BACK_DONTSEND );
+ meta_back_bind_op_result( op, rs, mc, candidate, msgid, LDAP_BACK_DONTSEND, 1 );
if ( rs->sr_err != LDAP_SUCCESS ) {
goto return_results;
}
* bind with the configured identity assertion */
/* NOTE: use with care */
if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OVERRIDE ) {
- meta_back_proxy_authz_bind( mc, candidate, op, rs, LDAP_BACK_SENDERR );
+ meta_back_proxy_authz_bind( mc, candidate, op, rs, LDAP_BACK_SENDERR, 1 );
if ( !LDAP_BACK_CONN_ISBOUND( msc ) ) {
goto return_results;
}
LDAP_BACK_CONN_ISBOUND_SET( msc );
mc->mc_authz_target = candidate;
- if ( LDAP_BACK_SAVECRED( mi ) ) {
+ if ( META_BACK_TGT_SAVECRED( mt ) ) {
if ( !BER_BVISNULL( &msc->msc_cred ) ) {
memset( msc->msc_cred.bv_val, 0,
msc->msc_cred.bv_len );
metatarget_t *mt = mi->mi_targets[ candidate ];
metaconn_t *mc = *mcp;
metasingleconn_t *msc = &mc->mc_conns[ candidate ];
- static struct berval cred = BER_BVC( "" );
int msgid;
assert( !LDAP_BACK_CONN_ISBOUND( msc ) );
( LDAP_BACK_CONN_ISPRIV( mc ) && dn_match( &msc->msc_bound_ndn, &mt->mt_idassert_authcDN ) ) ||
( mt->mt_idassert_flags & LDAP_BACK_AUTH_OVERRIDE ) ) )
{
- (void)meta_back_proxy_authz_bind( mc, candidate, op, rs, sendok );
+ (void)meta_back_proxy_authz_bind( mc, candidate, op, rs, sendok, dolock );
} else {
+ char *binddn = "";
+ struct berval cred = BER_BVC( "" );
+
+ /* use credentials if available */
+ if ( !BER_BVISNULL( &msc->msc_bound_ndn )
+ && !BER_BVISNULL( &msc->msc_cred ) )
+ {
+ binddn = msc->msc_bound_ndn.bv_val;
+ cred = msc->msc_cred;
+ }
/* FIXME: should we check if at least some of the op->o_ctrls
* can/should be passed? */
for (;;) {
rs->sr_err = ldap_sasl_bind( msc->msc_ld,
- "", LDAP_SASL_SIMPLE, &cred,
+ binddn, LDAP_SASL_SIMPLE, &cred,
NULL, NULL, &msgid );
if ( rs->sr_err != LDAP_X_CONNECTING ) {
break;
ldap_pvt_thread_yield();
}
- rs->sr_err = meta_back_bind_op_result( op, rs, mc, candidate, msgid, sendok );
+ rs->sr_err = meta_back_bind_op_result( op, rs, mc, candidate, msgid, sendok, dolock );
+
+ /* if bind succeeded, but anonymous, clear msc_bound_ndn */
+ if ( rs->sr_err != LDAP_SUCCESS || binddn[0] == '\0' ) {
+ if ( !BER_BVISNULL( &msc->msc_bound_ndn ) ) {
+ ber_memfree( msc->msc_bound_ndn.bv_val );
+ BER_BVZERO( &msc->msc_bound_ndn );
+ }
+
+ if ( !BER_BVISNULL( &msc->msc_cred ) ) {
+ memset( msc->msc_cred.bv_val, 0, msc->msc_cred.bv_len );
+ ber_memfree( msc->msc_cred.bv_val );
+ BER_BVZERO( &msc->msc_cred );
+ }
+ }
}
if ( rs->sr_err != LDAP_SUCCESS ) {
if ( dolock ) {
ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
}
- LDAP_BACK_CONN_BINDING_CLEAR( msc );
+ LDAP_BACK_CONN_BINDING_CLEAR( msc );
if ( META_BACK_ONERR_STOP( mi ) ) {
- LDAP_BACK_CONN_TAINTED_SET( mc );
+ LDAP_BACK_CONN_TAINTED_SET( mc );
meta_back_release_conn_lock( mi, mc, 0 );
*mcp = NULL;
}
isroot = 1;
}
- Debug( LDAP_DEBUG_TRACE,
- "%s meta_back_dobind: conn=%ld%s\n",
- op->o_log_prefix,
- LDAP_BACK_PCONN_ID( mc ),
- isroot ? " (isroot)" : "" );
+ if ( LogTest( LDAP_DEBUG_TRACE ) ) {
+ char buf[STRLENOF("4294967295U") + 1] = { 0 };
+ mi->mi_ldap_extra->connid2str( &mc->mc_base, buf, sizeof(buf) );
+
+ Debug( LDAP_DEBUG_TRACE,
+ "%s meta_back_dobind: conn=%s%s\n",
+ op->o_log_prefix, buf,
+ isroot ? " (isroot)" : "" );
+ }
/*
* all the targets are bound as pseudoroot
if ( mc != NULL ) {
ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
LDAP_BACK_CONN_BINDING_CLEAR( msc );
+ meta_back_release_conn_lock( mi, mc, 0 );
ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
- meta_back_release_conn( mi, mc );
}
return 0;
}
done:;
- Debug( LDAP_DEBUG_TRACE,
- "%s meta_back_dobind: conn=%ld bound=%d\n",
- op->o_log_prefix, LDAP_BACK_PCONN_ID( mc ), bound );
+ if ( LogTest( LDAP_DEBUG_TRACE ) ) {
+ char buf[STRLENOF("4294967295U") + 1] = { 0 };
+ mi->mi_ldap_extra->connid2str( &mc->mc_base, buf, sizeof(buf) );
+
+ Debug( LDAP_DEBUG_TRACE,
+ "%s meta_back_dobind: conn=%s bound=%d\n",
+ op->o_log_prefix, buf, bound );
+ }
if ( bound == 0 ) {
meta_back_release_conn( mi, mc );
metatarget_t *mt = mi->mi_targets[ candidate ];
metasingleconn_t *msc = &mc->mc_conns[ candidate ];
-#define ERR_OK(err) ((err) == LDAP_SUCCESS || (err) == LDAP_COMPARE_FALSE || (err) == LDAP_COMPARE_TRUE)
-
- if ( ERR_OK( rs->sr_err ) ) {
+ if ( LDAP_ERR_OK( rs->sr_err ) ) {
int rc;
struct timeval tv;
LDAPMessage *res = NULL;
rc = ldap_parse_result( msc->msc_ld, res, &rs->sr_err,
&matched, &text, &refs, &ctrls, 1 );
res = NULL;
- rs->sr_text = text;
- if ( rc != LDAP_SUCCESS ) {
+ if ( rc == LDAP_SUCCESS ) {
+ rs->sr_text = text;
+ } else {
rs->sr_err = rc;
}
+ rs->sr_err = slap_map_api2result( rs );
/* RFC 4511: referrals can only appear
* if result code is LDAP_REFERRAL */
/* if the error in the reply structure is not
* LDAP_SUCCESS, try to map it from client
* to server error */
- if ( !ERR_OK( rs->sr_err ) ) {
+ if ( !LDAP_ERR_OK( rs->sr_err ) ) {
rs->sr_err = slap_map_api2result( rs );
/* internal ops ( op->o_conn == NULL )
char *xtext = NULL;
char *xmatched = NULL;
+ if ( msc->msc_ld == NULL ) {
+ continue;
+ }
+
rs->sr_err = LDAP_SUCCESS;
ldap_get_option( msc->msc_ld, LDAP_OPT_RESULT_CODE, &rs->sr_err );
rs->sr_matched = matched;
}
- if ( op->o_conn &&
- ( ( sendok & LDAP_BACK_SENDOK )
- || ( ( sendok & LDAP_BACK_SENDERR ) && rs->sr_err != LDAP_SUCCESS ) ) )
+ if ( rs->sr_err == LDAP_UNAVAILABLE ) {
+ if ( !( sendok & LDAP_BACK_RETRYING ) ) {
+ if ( op->o_conn && ( sendok & LDAP_BACK_SENDERR ) ) {
+ if ( rs->sr_text == NULL ) rs->sr_text = "Proxy operation retry failed";
+ send_ldap_result( op, rs );
+ }
+ }
+
+ } else if ( op->o_conn &&
+ ( ( ( sendok & LDAP_BACK_SENDOK ) && LDAP_ERR_OK( rs->sr_err ) )
+ || ( ( sendok & LDAP_BACK_SENDERR ) && !LDAP_ERR_OK( rs->sr_err ) ) ) )
{
send_ldap_result( op, rs );
}
rs->sr_ref = save_ref;
rs->sr_ctrls = save_ctrls;
- return( ERR_OK( rs->sr_err ) ? LDAP_SUCCESS : rs->sr_err );
+ return( LDAP_ERR_OK( rs->sr_err ) ? LDAP_SUCCESS : rs->sr_err );
}
/*
} else {
ndn = op->o_ndn;
}
+ rs->sr_err = LDAP_SUCCESS;
/*
* FIXME: we need to let clients use proxyAuthz
}
done:;
+
+ if ( !BER_BVISEMPTY( binddn ) ) {
+ LDAP_BACK_CONN_ISIDASSERT_SET( msc );
+ }
+
return rs->sr_err;
}
static int
-meta_back_proxy_authz_bind( metaconn_t *mc, int candidate, Operation *op, SlapReply *rs, ldap_back_send_t sendok )
+meta_back_proxy_authz_bind(
+ metaconn_t *mc,
+ int candidate,
+ Operation *op,
+ SlapReply *rs,
+ ldap_back_send_t sendok,
+ int dolock )
{
metainfo_t *mi = (metainfo_t *)op->o_bd->be_private;
metatarget_t *mt = mi->mi_targets[ candidate ];
}
ldap_pvt_thread_yield();
}
- rc = meta_back_bind_op_result( op, rs, mc, candidate, msgid, sendok );
+ rc = meta_back_bind_op_result( op, rs, mc, candidate, msgid, sendok, dolock );
if ( rc == LDAP_SUCCESS ) {
/* set rebind stuff in case of successful proxyAuthz bind,
* so that referral chasing is attempted using the right
LDAP_BACK_CONN_ISBOUND_SET( msc );
ber_bvreplace( &msc->msc_bound_ndn, &binddn );
- if ( LDAP_BACK_SAVECRED( mi ) ) {
+ if ( META_BACK_TGT_SAVECRED( mt ) ) {
if ( !BER_BVISNULL( &msc->msc_cred ) ) {
memset( msc->msc_cred.bv_val, 0,
msc->msc_cred.bv_len );
*
* if any needs to be added, it is prepended to existing ones,
* in a newly allocated array. The companion function
- * ldap_back_controls_free() must be used to restore the original
+ * mi->mi_ldap_extra->controls_free() must be used to restore the original
* status of op->o_ctrls.
*/
int
LDAPControl **ctrls = NULL;
/* set to the maximum number of controls this backend can add */
- LDAPControl c[ 2 ] = { 0 };
- int i = 0, j = 0;
+ LDAPControl c[ 2 ] = {{ 0 }};
+ int n = 0, i, j1 = 0, j2 = 0;
*pctrls = NULL;
goto done;
}
+ /* put controls that go __before__ existing ones here */
+
/* proxyAuthz for identity assertion */
- switch ( ldap_back_proxy_authz_ctrl( op, rs, &msc->msc_bound_ndn,
- mt->mt_version, &mt->mt_idassert, &c[ j ] ) )
+ switch ( mi->mi_ldap_extra->proxy_authz_ctrl( op, rs, &msc->msc_bound_ndn,
+ mt->mt_version, &mt->mt_idassert, &c[ j1 ] ) )
{
case SLAP_CB_CONTINUE:
break;
case LDAP_SUCCESS:
- j++;
+ j1++;
break;
default:
goto done;
}
+ /* put controls that go __after__ existing ones here */
+
#ifdef SLAP_CONTROL_X_SESSION_TRACKING
/* session tracking */
if ( META_BACK_TGT_ST_REQUEST( mt ) ) {
- switch ( slap_ctrl_session_tracking_request_add( op, rs, &c[ j ] ) ) {
+ switch ( slap_ctrl_session_tracking_request_add( op, rs, &c[ j1 + j2 ] ) ) {
case SLAP_CB_CONTINUE:
break;
case LDAP_SUCCESS:
- j++;
+ j2++;
break;
default:
rs->sr_err = LDAP_SUCCESS;
}
- if ( j == 0 ) {
+ /* if nothing to do, just bail out */
+ if ( j1 == 0 && j2 == 0 ) {
goto done;
}
+ assert( j1 + j2 <= (int) (sizeof( c )/sizeof( c[0] )) );
+
if ( op->o_ctrls ) {
- for ( i = 0; op->o_ctrls[ i ]; i++ )
+ for ( n = 0; op->o_ctrls[ n ]; n++ )
/* just count ctrls */ ;
}
- ctrls = op->o_tmpalloc( sizeof( LDAPControl * ) * (i + j + 1) + j * sizeof( LDAPControl ),
+ ctrls = op->o_tmpalloc( (n + j1 + j2 + 1) * sizeof( LDAPControl * ) + ( j1 + j2 ) * sizeof( LDAPControl ),
op->o_tmpmemctx );
- ctrls[ 0 ] = (LDAPControl *)&ctrls[ i + j + 1 ];
- *ctrls[ 0 ] = c[ 0 ];
- for ( i = 1; i < j; i++ ) {
- ctrls[ i ] = &ctrls[ 0 ][ i ];
- *ctrls[ i ] = c[ i ];
+ if ( j1 ) {
+ ctrls[ 0 ] = (LDAPControl *)&ctrls[ n + j1 + j2 + 1 ];
+ *ctrls[ 0 ] = c[ 0 ];
+ for ( i = 1; i < j1; i++ ) {
+ ctrls[ i ] = &ctrls[ 0 ][ i ];
+ *ctrls[ i ] = c[ i ];
+ }
}
i = 0;
if ( op->o_ctrls ) {
for ( i = 0; op->o_ctrls[ i ]; i++ ) {
- ctrls[ i + j ] = op->o_ctrls[ i ];
+ ctrls[ i + j1 ] = op->o_ctrls[ i ];
}
}
- ctrls[ i + j ] = NULL;
+
+ n += j1;
+ if ( j2 ) {
+ ctrls[ n ] = (LDAPControl *)&ctrls[ n + j2 + 1 ] + j1;
+ *ctrls[ n ] = c[ j1 ];
+ for ( i = 1; i < j2; i++ ) {
+ ctrls[ n + i ] = &ctrls[ n ][ i ];
+ *ctrls[ n + i ] = c[ i ];
+ }
+ }
+
+ ctrls[ n + j2 ] = NULL;
done:;
if ( ctrls == NULL ) {
projects / openldap / blobdiff