static char *proxy_authz_extops[] = {
LDAP_EXOP_MODIFY_PASSWD,
- LDAP_EXOP_X_WHO_AM_I,
+ LDAP_EXOP_WHO_AM_I,
LDAP_EXOP_REFRESH,
NULL
};
SLAP_CTRL_GLOBAL|SLAP_CTRL_UPDATE|SLAP_CTRL_HIDE,
NULL, NULL,
parseManageDIT, LDAP_SLIST_ENTRY_INITIALIZER(next) },
+#endif
+#ifdef LDAP_X_TXN
+ { LDAP_CONTROL_X_TXN_SPEC,
+ (int)offsetof(struct slap_control_ids, sc_txnSpec),
+ SLAP_CTRL_UPDATE|SLAP_CTRL_HIDE,
+ NULL, NULL,
+ txn_spec_ctrl, LDAP_SLIST_ENTRY_INITIALIZER(next) },
#endif
{ LDAP_CONTROL_MANAGEDSAIT,
(int)offsetof(struct slap_control_ids, sc_manageDSAit),
} else {
if ( sc->sc_extendedopsbv ) {
+ /* FIXME: in principle, we should rather merge
+ * existing extops with those supported by the
+ * new control handling implementation.
+ * In fact, whether a control is compatible with
+ * an extop should not be a matter of implementation.
+ * We likely also need a means for a newly
+ * registered extop to declare that it is
+ * comptible with an already registered control.
+ */
ber_bvarray_free( sc->sc_extendedopsbv );
sc->sc_extendedopsbv = NULL;
sc->sc_extendedops = NULL;
}
masks = (slap_mask_t *)SLAP_MALLOC( (n + 1) * sizeof(slap_mask_t) );
if ( masks == NULL ) {
- ch_free( oids );
+ SLAP_FREE( oids );
return LDAP_NO_MEMORY;
}
return LDAP_COMPARE_TRUE;
}
+#if 0
Debug( LDAP_DEBUG_TRACE,
"slap_global_control: unavailable control: %s\n",
oid, 0, 0 );
+#endif
return LDAP_COMPARE_FALSE;
}
if ( !( global_allows & SLAP_ALLOW_PROXY_AUTHZ_ANON )
&& BER_BVISEMPTY( &op->o_ndn ) )
{
- rs->sr_text = "anonymous proxyAuthz not allowed";
- return LDAP_PROXY_AUTHZ_FAILURE;
+ rs->sr_text = "anonymous proxied authorization not allowed";
+ return LDAP_PROXIED_AUTHORIZATION_DENIED;
}
op->o_proxy_authz = ctrl->ldctl_iscritical
ch_free( dn.bv_val );
}
rs->sr_text = "authzId mapping failed";
- return LDAP_PROXY_AUTHZ_FAILURE;
+ return LDAP_PROXIED_AUTHORIZATION_DENIED;
}
Debug( LDAP_DEBUG_TRACE,
if ( rc ) {
ch_free( dn.bv_val );
rs->sr_text = "not authorized to assume identity";
- return LDAP_PROXY_AUTHZ_FAILURE;
+ return LDAP_PROXIED_AUTHORIZATION_DENIED;
}
ch_free( op->o_ndn.bv_val );
rs->sr_err = get_filter( op, ber, (Filter **)&(op->o_assertion),
&rs->sr_text);
+ (void) ber_free( ber, 1 );
if( rs->sr_err != LDAP_SUCCESS ) {
if( rs->sr_err == SLAPD_DISCONNECT ) {
rs->sr_err = LDAP_PROTOCOL_ERROR;
return LDAP_PROTOCOL_ERROR;
}
+#ifdef LDAP_X_TXN
+ if ( op->o_txnSpec ) { /* temporary limitation */
+ rs->sr_text = "cannot perform pre-read in transaction";
+ return LDAP_UNWILLING_TO_PERFORM;
+ }
+#endif
+
ber = ber_init( &(ctrl->ldctl_value) );
if (ber == NULL) {
rs->sr_text = "preread control: internal error";
return LDAP_OTHER;
}
+ rs->sr_err = LDAP_SUCCESS;
+
siz = sizeof( AttributeName );
off = offsetof( AttributeName, an_name );
if ( ber_scanf( ber, "{M}", &an, &siz, off ) == LBER_ERROR ) {
rs->sr_text = "preread control: decoding error";
- return LDAP_PROTOCOL_ERROR;
+ rs->sr_err = LDAP_PROTOCOL_ERROR;
+ goto done;
}
for( i=0; i<siz; i++ ) {
- int rc = LDAP_SUCCESS;
const char *dummy = NULL;
an[i].an_desc = NULL;
an[i].an_oc = NULL;
an[i].an_oc_exclude = 0;
- rc = slap_bv2ad( &an[i].an_name, &an[i].an_desc, &dummy );
- if ( rc != LDAP_SUCCESS && ctrl->ldctl_iscritical ) {
+ rs->sr_err = slap_bv2ad( &an[i].an_name, &an[i].an_desc, &dummy );
+ if ( rs->sr_err != LDAP_SUCCESS && ctrl->ldctl_iscritical ) {
rs->sr_text = dummy
? dummy
: "postread control: unknown attributeType";
- return rc;
+ goto done;
}
}
op->o_preread_attrs = an;
- rs->sr_err = LDAP_SUCCESS;
- return LDAP_SUCCESS;
+done:
+ (void) ber_free( ber, 1 );
+ return rs->sr_err;
}
static int parsePostRead (
return LDAP_PROTOCOL_ERROR;
}
+#ifdef LDAP_X_TXN
+ if ( op->o_txnSpec ) { /* temporary limitation */
+ rs->sr_text = "cannot perform post-read in transaction";
+ return LDAP_UNWILLING_TO_PERFORM;
+ }
+#endif
+
ber = ber_init( &(ctrl->ldctl_value) );
if (ber == NULL) {
rs->sr_text = "postread control: internal error";
return LDAP_OTHER;
}
+ rs->sr_err = LDAP_SUCCESS;
siz = sizeof( AttributeName );
off = offsetof( AttributeName, an_name );
if ( ber_scanf( ber, "{M}", &an, &siz, off ) == LBER_ERROR ) {
rs->sr_text = "postread control: decoding error";
- return LDAP_PROTOCOL_ERROR;
+ rs->sr_err = LDAP_PROTOCOL_ERROR;
+ goto done;
}
for( i=0; i<siz; i++ ) {
- int rc = LDAP_SUCCESS;
const char *dummy = NULL;
an[i].an_desc = NULL;
an[i].an_oc = NULL;
an[i].an_oc_exclude = 0;
- rc = slap_bv2ad( &an[i].an_name, &an[i].an_desc, &dummy );
- if ( rc != LDAP_SUCCESS && ctrl->ldctl_iscritical ) {
+ rs->sr_err = slap_bv2ad( &an[i].an_name, &an[i].an_desc, &dummy );
+ if ( rs->sr_err != LDAP_SUCCESS && ctrl->ldctl_iscritical ) {
rs->sr_text = dummy
? dummy
: "postread control: unknown attributeType";
- return rc;
+ goto done;
}
}
op->o_postread_attrs = an;
- rs->sr_err = LDAP_SUCCESS;
- return LDAP_SUCCESS;
+done:
+ (void) ber_free( ber, 1 );
+ return rs->sr_err;
}
static int parseValuesReturnFilter (
rs->sr_err = get_vrFilter( op, ber,
(ValuesReturnFilter **)&(op->o_vrFilter), &rs->sr_text);
+ (void) ber_free( ber, 1 );
+
if( rs->sr_err != LDAP_SUCCESS ) {
if( rs->sr_err == SLAPD_DISCONNECT ) {
rs->sr_err = LDAP_PROTOCOL_ERROR;
return LDAP_OTHER;
}
- if ( (tag = ber_scanf( ber, "{i}", &search_flags )) == LBER_ERROR ) {
+ tag = ber_scanf( ber, "{i}", &search_flags );
+ (void) ber_free( ber, 1 );
+
+ if ( tag == LBER_ERROR ) {
rs->sr_text = "searchOptions control decoding error";
return LDAP_PROTOCOL_ERROR;
}
- (void) ber_free( ber, 1 );
-
if ( search_flags & LDAP_SEARCH_FLAG_DOMAIN_SCOPE ) {
if ( op->o_domain_scope != SLAP_CONTROL_NONE ) {
rs->sr_text = "searchOptions control specified multiple times "