ITS#5328 - cosmetic cleanup (0 -> LDAP_SUCCESS)

[openldap] / servers / slapd / backend.c

diff --git a/servers/slapd/backend.c b/servers/slapd/backend.c
index f1d49e2c07e39150f38b4752a520ee2ae544bd1b..b36b65c3d1030cefeb69d3c5157580914f744089 100644 (file)
--- a/servers/slapd/backend.c
+++ b/servers/slapd/backend.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2007 The OpenLDAP Foundation.
+ * Copyright 1998-2008 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -209,6 +209,17 @@ int backend_startup_one(Backend *be, ConfigReply *cr)
        /* set database controls */
        (void)backend_set_controls( be );
 
+#if 0
+       if ( !BER_BVISEMPTY( &be->be_rootndn )
+               && select_backend( &be->be_rootndn, 0 ) == be
+               && BER_BVISNULL( &be->be_rootpw ) )
+       {
+               /* warning: if rootdn entry is created,
+                * it can take rootdn privileges;
+                * set empty rootpw to prevent */
+       }
+#endif
+
        if ( be->bd_info->bi_db_open ) {
                rc = be->bd_info->bi_db_open( be, cr );
                if ( rc == 0 ) {
@@ -693,6 +704,26 @@ be_issuffix(
        return 0;
 }
 
+int
+be_issubordinate(
+    Backend *be,
+    struct berval *bvsubordinate )
+{
+       int     i;
+
+       if ( be->be_nsuffix == NULL ) {
+               return 0;
+       }
+
+       for ( i = 0; !BER_BVISNULL( &be->be_nsuffix[i] ); i++ ) {
+               if ( dnIsSuffix( bvsubordinate, &be->be_nsuffix[i] ) ) {
+                       return 1;
+               }
+       }
+
+       return 0;
+}
+
 int
 be_isroot_dn( Backend *be, struct berval *ndn )
 {
@@ -745,28 +776,82 @@ be_isroot( Operation *op )
 int
 be_isroot_pw( Operation *op )
 {
-       int result;
+       return be_rootdn_bind( op, NULL ) == LDAP_SUCCESS;
+}
 
-       if ( ! be_isroot_dn( op->o_bd, &op->o_req_ndn ) ) {
-               return 0;
+/*
+ * checks if binding as rootdn
+ *
+ * return value:
+ *     SLAP_CB_CONTINUE                if not the rootdn, or if rootpw is null
+ *     LDAP_SUCCESS                    if rootdn & rootpw
+ *     LDAP_INVALID_CREDENTIALS        if rootdn & !rootpw
+ *
+ * if rs != NULL
+ *     if LDAP_SUCCESS, op->orb_edn is set
+ *     if LDAP_INVALID_CREDENTIALS, response is sent to client
+ */
+int
+be_rootdn_bind( Operation *op, SlapReply *rs )
+{
+       int             rc;
+#ifdef SLAPD_SPASSWD
+       void    *old_authctx = NULL;
+#endif
+
+       assert( op->o_tag == LDAP_REQ_BIND );
+       assert( op->orb_method == LDAP_AUTH_SIMPLE );
+
+       if ( !be_isroot_dn( op->o_bd, &op->o_req_ndn ) ) {
+               return SLAP_CB_CONTINUE;
+       }
+
+       if ( BER_BVISNULL( &op->o_bd->be_rootpw ) ) {
+               /* give the database a chance */
+               return SLAP_CB_CONTINUE;
        }
 
        if ( BER_BVISEMPTY( &op->o_bd->be_rootpw ) ) {
-               return 0;
+               /* rootdn bind explicitly disallowed */
+               rc = LDAP_INVALID_CREDENTIALS;
+               if ( rs ) {
+                       goto send_result;
+               }
+
+               return rc;
        }
 
 #ifdef SLAPD_SPASSWD
-       ldap_pvt_thread_pool_setkey( op->o_threadctx, slap_sasl_bind,
-               op->o_conn->c_sasl_authctx, NULL );
+       ldap_pvt_thread_pool_setkey( op->o_threadctx, (void *)slap_sasl_bind,
+               op->o_conn->c_sasl_authctx, 0, &old_authctx, NULL );
 #endif
 
-       result = lutil_passwd( &op->o_bd->be_rootpw, &op->orb_cred, NULL, NULL );
+       rc = lutil_passwd( &op->o_bd->be_rootpw, &op->orb_cred, NULL, NULL );
 
 #ifdef SLAPD_SPASSWD
-       ldap_pvt_thread_pool_setkey( op->o_threadctx, slap_sasl_bind, NULL, NULL );
+       ldap_pvt_thread_pool_setkey( op->o_threadctx, (void *)slap_sasl_bind,
+               old_authctx, 0, NULL, NULL );
 #endif
 
-       return result == 0;
+       rc = ( rc == 0 ? LDAP_SUCCESS : LDAP_INVALID_CREDENTIALS );
+       if ( rs ) {
+send_result:;
+               rs->sr_err = rc;
+
+               Debug( LDAP_DEBUG_TRACE, "%s: rootdn=\"%s\" bind%s\n", 
+                       op->o_log_prefix, op->o_bd->be_rootdn.bv_val,
+                       rc == LDAP_SUCCESS ? " succeeded" : " failed" );
+
+               if ( rc == LDAP_SUCCESS ) {
+                       /* Set to the pretty rootdn */
+                       ber_dupbv( &op->orb_edn, &op->o_bd->be_rootdn );
+
+               } else {
+                       send_ldap_result( op, rs );
+               }
+       }
+
+       return rc;
 }
 
 int
@@ -1420,10 +1505,10 @@ loopit:
                                op->o_bd = b2;
 
                        } else {
-                               rc = value_find_ex( group_at,
+                               rc = attr_valfind( a,
                                        SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH |
                                        SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH,
-                                       a->a_nvals, op_ndn, op->o_tmpmemctx );
+                                       op_ndn, NULL, op->o_tmpmemctx );
                                if ( rc == LDAP_NO_SUCH_ATTRIBUTE ) {
                                        rc = LDAP_COMPARE_FALSE;
                                }
@@ -1567,9 +1652,7 @@ fe_acl_attribute(
                                goto freeit;
                        }
 
-                       for ( i = 0; !BER_BVISNULL( &a->a_vals[i] ); i++ )
-                               ;
-                       
+                       i = a->a_numvals;
                        v = op->o_tmpalloc( sizeof(struct berval) * ( i + 1 ),
                                op->o_tmpmemctx );
                        for ( i = 0, j = 0; !BER_BVISNULL( &a->a_vals[i] ); i++ )
@@ -1747,7 +1830,7 @@ fe_aux_operational(
        SlapReply *rs )
 {
        Attribute               **ap;
-       int                     rc = 0;
+       int                     rc = LDAP_SUCCESS;
 
        for ( ap = &rs->sr_operational_attrs; *ap; ap = &(*ap)->a_next )
                /* just count them */ ;