use result of validation (ITS#4028)

[openldap] / servers / slapd / back-meta / bind.c

diff --git a/servers/slapd/back-meta/bind.c b/servers/slapd/back-meta/bind.c
index e211f6363128ac86f7ef1233d2db2115b5b8ef85..eb25c58fe01452ca927466c78c57df73e12e184d 100644 (file)
--- a/servers/slapd/back-meta/bind.c
+++ b/servers/slapd/back-meta/bind.c
@@ -59,9 +59,16 @@ meta_back_bind( Operation *op, SlapReply *rs )
        Debug( LDAP_DEBUG_ARGS, "meta_back_bind: dn: %s.\n%s%s",
                        op->o_req_dn.bv_val, "", "" );
 
-       if ( op->orb_method == LDAP_AUTH_SIMPLE && be_isroot_pw( op ) ) {
+       if ( op->orb_method == LDAP_AUTH_SIMPLE
+               && be_isroot_dn( op->o_bd, &op->o_req_ndn ) )
+       {
+               if ( !be_isroot_pw( op ) ) {
+                       rs->sr_err = LDAP_INVALID_CREDENTIALS;
+                       rs->sr_text = NULL;
+                       send_ldap_result( op, rs );
+                       return rs->sr_err;
+               }
                isroot = 1;
-               ber_dupbv( &op->orb_edn, be_root_dn( op->o_bd ) );
        }
 
        /* we need meta_back_getconn() not send result even on error,
@@ -129,13 +136,19 @@ meta_back_bind( Operation *op, SlapReply *rs )
                        rs->sr_err = lerr;
                        candidates[ i ].sr_tag = META_NOT_CANDIDATE;
 
+                       if ( META_BACK_ONERR_STOP( mi ) ) {
+                               rc = rs->sr_err;
+                               break;
+                       }
+                               
                } else {
                        rc = LDAP_SUCCESS;
                }
        }
 
-       if ( isroot ) {
+       if ( isroot && rc == LDAP_SUCCESS ) {
                mc->mc_auth_target = META_BOUND_ALL;
+               ber_dupbv( &op->orb_edn, be_root_dn( op->o_bd ) );
        }
 
        meta_back_release_conn( op, mc );
@@ -211,7 +224,7 @@ rebind:;
                        op->o_ctrls, NULL, &msgid );
        if ( rs->sr_err == LDAP_SUCCESS ) {
                LDAPMessage     *res;
-               struct timeval  tv;
+               struct timeval  tv = { 0, 100000 };
                int             rc;
                int             nretries = mt->mt_nretries;
 
@@ -234,6 +247,8 @@ retry:;
                                if ( nretries > 0 ) {
                                        nretries--;
                                }
+                               tv.tv_sec = 0;
+                               tv.tv_usec = 100000;
                                goto retry;
                        }
                        rs->sr_err = LDAP_BUSY;
@@ -380,7 +395,7 @@ rebind:;
                        NULL, NULL, &msgid );
        if ( rc == LDAP_SUCCESS ) {
                LDAPMessage     *res;
-               struct timeval  tv;
+               struct timeval  tv = { 0, 100000 };
 
                /*
                 * handle response!!!
@@ -401,6 +416,8 @@ retry:;
                                if ( nretries > 0 ) {
                                        nretries--;
                                }
+                               tv.tv_sec = 0;
+                               tv.tv_usec = 100000;
                                goto retry;
                        }
 
@@ -479,6 +496,7 @@ retry:;
                }
 
        } else {
+               rs->sr_err = rc;
                rc = slap_map_api2result( rs );
        }
 
@@ -571,8 +589,6 @@ meta_back_dobind(
                }
 
                if ( rc != LDAP_SUCCESS ) {
-                       rs->sr_err = slap_map_api2result( rs );
-
                        Debug( LDAP_DEBUG_ANY, "%s meta_back_dobind[%d]: "
                                        "(anonymous) err=%d\n",
                                        op->o_log_prefix, i, rc );
@@ -584,7 +600,12 @@ meta_back_dobind(
                         * due to technical reasons (remote host down?)
                         * so better clear the handle
                         */
-                       candidates[ i ].sr_tag = META_NOT_CANDIDATE;
+                       /* leave the target candidate, but record the error for later use */
+                       candidates[ i ].sr_err = rc;
+                       if ( META_BACK_ONERR_STOP( mi ) ) {
+                               bound = 0;
+                               goto done;
+                       }
                        continue;
                } /* else */
                
@@ -652,10 +673,11 @@ meta_back_op_result(
 
        int                     i,
                                rerr = LDAP_SUCCESS;
-       char                    *rmsg = NULL;
-       char                    *rmatch = NULL;
-       int                     free_rmsg = 0,
-                               free_rmatch = 0;
+       char                    *rmsg = NULL,
+                               *rmatch = NULL;
+       const char              *save_rmsg = NULL,
+                               *save_rmatch = NULL;
+       void                    *rmatch_ctx = NULL;
 
        if ( candidate != META_TARGET_NONE ) {
                metasingleconn_t        *msc = &mc->mc_conns[ candidate ];
@@ -672,17 +694,20 @@ meta_back_op_result(
                         */
                        ldap_get_option( msc->msc_ld,
                                        LDAP_OPT_ERROR_STRING, &rmsg );
+                       if ( rmsg != NULL && rmsg[ 0 ] == '\0' ) {
+                               ldap_memfree( rmsg );
+                               rmsg = NULL;
+                       }
+
                        ldap_get_option( msc->msc_ld,
                                        LDAP_OPT_MATCHED_DN, &rmatch );
-                       rerr = rs->sr_err = slap_map_api2result( rs );
-
-                       if ( rmsg ) {
-                               free_rmsg = 1;
-                       }
-                       if ( rmatch ) {
-                               free_rmatch = 1;
+                       if ( rmatch != NULL && rmatch[ 0 ] == '\0' ) {
+                               ldap_memfree( rmatch );
+                               rmatch = NULL;
                        }
 
+                       rerr = rs->sr_err = slap_map_api2result( rs );
+
                        Debug(LDAP_DEBUG_ANY,
                                        "==> meta_back_op_result: target"
                                        " <%d> sending msg \"%s\""
@@ -709,8 +734,18 @@ meta_back_op_result(
                                 */
                                ldap_get_option( msc->msc_ld,
                                                LDAP_OPT_ERROR_STRING, &msg );
+                               if ( msg != NULL && msg[ 0 ] == '\0' ) {
+                                       ldap_memfree( msg );
+                                       msg = NULL;
+                               }
+
                                ldap_get_option( msc->msc_ld,
                                                LDAP_OPT_MATCHED_DN, &match );
+                               if ( match != NULL && match[ 0 ] == '\0' ) {
+                                       ldap_memfree( match );
+                                       match = NULL;
+                               }
+
                                rs->sr_err = slap_map_api2result( rs );
        
                                Debug(LDAP_DEBUG_ANY,
@@ -726,44 +761,60 @@ meta_back_op_result(
                                switch ( rs->sr_err ) {
                                default:
                                        rerr = rs->sr_err;
-                                       if ( rmsg ) {
-                                               ber_memfree( rmsg );
+                                       if ( msg != NULL ) {
+                                               if ( rmsg ) {
+                                                       ldap_memfree( rmsg );
+                                               }
+                                               rmsg = msg;
+                                               msg = NULL;
                                        }
-                                       rmsg = msg;
-                                       free_rmsg = 1;
-                                       msg = NULL;
-                                       if ( rmatch ) {
-                                               ber_memfree( rmatch );
+                                       if ( match != NULL ) {
+                                               if ( rmatch ) {
+                                                       ldap_memfree( rmatch );
+                                               }
+                                               rmatch = match;
+                                               match = NULL;
                                        }
-                                       rmatch = match;
-                                       free_rmatch = 1;
-                                       match = NULL;
                                        break;
                                }
+
+                               if ( msg ) {
+                                       ldap_memfree( msg );
+                               }
        
-                               /* better test the pointers before freeing? */
                                if ( match ) {
-                                       free( match );
-                               }
-                               if ( msg ) {
-                                       free( msg );
+                                       ldap_memfree( match );
                                }
                        }
                }
        }
        
        rs->sr_err = rerr;
-       rs->sr_text = rmsg;
-       rs->sr_matched = rmatch;
+       if ( rmsg != NULL ) {
+               save_rmsg = rs->sr_text;
+               rs->sr_text = rmsg;
+       }
+       if ( rmatch != NULL ) {
+               struct berval   dn, pdn;
+
+               ber_str2bv( rmatch, 0, 0, &dn );
+               if ( dnPretty( NULL, &dn, &pdn, op->o_tmpmemctx ) == LDAP_SUCCESS ) {
+                       ldap_memfree( rmatch );
+                       rmatch_ctx = op->o_tmpmemctx;
+                       rmatch = pdn.bv_val;
+               }
+               save_rmatch = rs->sr_matched;
+               rs->sr_matched = rmatch;
+       }
        send_ldap_result( op, rs );
-       if ( free_rmsg ) {
+       if ( rmsg != NULL ) {
                ber_memfree( rmsg );
+               rs->sr_text = save_rmsg;
        }
-       if ( free_rmatch ) {
-               ber_memfree( rmatch );
+       if ( rmatch != NULL ) {
+               ber_memfree_x( rmatch, rmatch_ctx );
+               rs->sr_matched = save_rmatch;
        }
-       rs->sr_text = NULL;
-       rs->sr_matched = NULL;
 
        return ( ( rerr == LDAP_SUCCESS ) ? 0 : -1 );
 }