static AttributeDescription *ad_queryId, *ad_cachedQueryURL;
#ifdef PCACHE_MONITOR
+static AttributeDescription *ad_numQueries, *ad_numEntries;
static ObjectClass *oc_olmPCache;
#endif /* PCACHE_MONITOR */
"NO-USER-MODIFICATION "
"USAGE directoryOperation )",
&ad_cachedQueryURL },
+#ifdef PCACHE_MONITOR
+ { "( PCacheAttributes:3 "
+ "NAME 'pcacheNumQueries' "
+ "DESC 'Number of cached queries' "
+ "EQUALITY integerMatch "
+ "SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 "
+ "NO-USER-MODIFICATION "
+ "USAGE directoryOperation )",
+ &ad_numQueries },
+ { "( PCacheAttributes:4 "
+ "NAME 'pcacheNumEntries' "
+ "DESC 'Number of cached entries' "
+ "EQUALITY integerMatch "
+ "SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 "
+ "NO-USER-MODIFICATION "
+ "USAGE directoryOperation )",
+ &ad_numEntries },
+#endif /* PCACHE_MONITOR */
{ NULL }
};
"NAME ( 'olmPCache' ) "
"SUP top AUXILIARY "
"MAY ( "
- "pcacheQueryURL"
- ") )",
+ "pcacheQueryURL "
+ "$ pcacheNumQueries "
+ "$ pcacheNumEntries "
+ " ) )",
&oc_olmPCache },
#endif /* PCACHE_MONITOR */
*ret = NULL;
- attrs = ch_malloc(( set->count+1 )*sizeof(AttributeName));
+ attrs = ch_calloc( set->count + 1, sizeof(AttributeName) );
for ( i=0; i < set->count; i++ )
attrs[i] = set->attrs[i];
attr_cnt = i;
return rs->sr_err;
}
+static int
+pc_setpw( Operation *op, struct berval *pwd, cache_manager *cm )
+{
+ struct berval vals[2];
+
+ {
+ const char *text = NULL;
+ BER_BVZERO( &vals[0] );
+ slap_passwd_hash( pwd, &vals[0], &text );
+ if ( BER_BVISEMPTY( &vals[0] )) {
+ Debug( pcache_debug, "pc_setpw: hash failed %s\n",
+ text, 0, 0 );
+ return LDAP_OTHER;
+ }
+ }
+
+ BER_BVZERO( &vals[1] );
+
+ {
+ Modifications mod;
+ SlapReply sr = { REP_RESULT };
+ slap_callback cb = { 0, slap_null_cb, 0, 0 };
+ int rc;
+
+ mod.sml_op = LDAP_MOD_REPLACE;
+ mod.sml_flags = 0;
+ mod.sml_desc = slap_schema.si_ad_userPassword;
+ mod.sml_type = mod.sml_desc->ad_cname;
+ mod.sml_values = vals;
+ mod.sml_nvalues = NULL;
+ mod.sml_numvals = 1;
+ mod.sml_next = NULL;
+
+ op->o_tag = LDAP_REQ_MODIFY;
+ op->orm_modlist = &mod;
+ op->o_bd = &cm->db;
+ op->o_dn = op->o_bd->be_rootdn;
+ op->o_ndn = op->o_bd->be_rootndn;
+ op->o_callback = &cb;
+ Debug( pcache_debug, "pc_setpw: CACHING BIND for %s\n",
+ op->o_req_dn.bv_val, 0, 0 );
+ rc = op->o_bd->be_modify( op, &sr );
+ ch_free( vals[0].bv_val );
+ return rc;
+ }
+}
+
typedef struct bindcacheinfo {
slap_overinst *on;
CachedQuery *qc;
} bindcacheinfo;
-
+
static int
pc_bind_save( Operation *op, SlapReply *rs )
{
bindcacheinfo *bci = op->o_callback->sc_private;
slap_overinst *on = bci->on;
cache_manager *cm = on->on_bi.bi_private;
- struct berval vals[2];
- const char *text = NULL;
-
- BER_BVZERO( &vals[0] );
- BER_BVZERO( &vals[1] );
- slap_passwd_hash( &op->orb_cred, &vals[0], &text );
- if ( BER_BVISEMPTY( &vals[0] )) {
- Debug( pcache_debug, "pcache_bind_save: hash failed %s\n",
- text, 0, 0 );
- } else {
- Operation op2 = *op;
- Modifications mod;
- SlapReply sr = { REP_RESULT };
- slap_callback cb = { 0, slap_null_cb, 0, 0 };
-
- mod.sml_op = LDAP_MOD_REPLACE;
- mod.sml_flags = 0;
- mod.sml_desc = slap_schema.si_ad_userPassword;
- mod.sml_type = mod.sml_desc->ad_cname;
- mod.sml_values = vals;
- mod.sml_nvalues = NULL;
- mod.sml_numvals = 1;
- mod.sml_next = NULL;
- op2.o_tag = LDAP_REQ_MODIFY;
- op2.orm_modlist = &mod;
- op2.o_bd = &cm->db;
- op2.o_dn = op2.o_bd->be_rootdn;
- op2.o_ndn = op2.o_bd->be_rootndn;
- op2.o_callback = &cb;
- Debug( pcache_debug, "pcache_bind_save: caching bind for %s\n",
- op->o_req_dn.bv_val, 0, 0 );
- if ( op2.o_bd->be_modify( &op2, &sr ) == LDAP_SUCCESS )
- bci->qc->bindref_time = op->o_time + bci->qc->qtemp->bindttr;
- ch_free( vals[0].bv_val );
- }
+ Operation op2 = *op;
+ if ( pc_setpw( &op2, &op->orb_cred, cm ) == LDAP_SUCCESS )
+ bci->qc->bindref_time = op->o_time + bci->qc->qtemp->bindttr;
}
return SLAP_CB_CONTINUE;
}
return SLAP_CB_CONTINUE;
}
+#ifdef PCACHE_CONTROL_PRIVDB
static int
-pcache_op_bind(
+pcache_op_privdb(
Operation *op,
SlapReply *rs )
{
slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
cache_manager *cm = on->on_bi.bi_private;
- QueryTemplate *temp;
- Entry *e;
- slap_callback cb = { 0 }, *sc;
- bindinfo bi;
- bindcacheinfo *bci;
- Operation op2;
- int is_priv = 0, rc;
-
-#ifdef PCACHE_CONTROL_PRIVDB
- if ( op->o_ctrlflag[ privDB_cid ] == SLAP_CONTROL_CRITICAL )
- is_priv = 1;
-#endif
+ slap_callback *save_cb;
+ slap_op_t type;
- /* Skip if we're not configured for Binds, and no priv control */
- if ( !cm->cache_binds && !is_priv )
+ /* skip if control is unset */
+ if ( op->o_ctrlflag[ privDB_cid ] != SLAP_CONTROL_CRITICAL ) {
return SLAP_CB_CONTINUE;
+ }
/* The cache DB isn't open yet */
if ( cm->defer_db_open ) {
- if ( !is_priv ) {
- /* Just passthru for now */
- return SLAP_CB_CONTINUE;
- } else {
- send_ldap_error( op, rs, LDAP_UNAVAILABLE,
- "pcachePrivDB: cacheDB not available" );
- return rs->sr_err;
- }
+ send_ldap_error( op, rs, LDAP_UNAVAILABLE,
+ "pcachePrivDB: cacheDB not available" );
+ return rs->sr_err;
}
- if ( is_priv ) {
- int rc;
- slap_callback *save_cb;
+ /* FIXME: might be a little bit exaggerated... */
+ if ( !be_isroot( op ) ) {
+ save_cb = op->o_callback;
+ op->o_callback = NULL;
+ send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
+ "pcachePrivDB: operation not allowed" );
+ op->o_callback = save_cb;
- /* FIXME: might be a little bit exaggerated... */
- if ( !be_isroot( op ) ) {
- save_cb = op->o_callback;
- op->o_callback = NULL;
- send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
- "pcachePrivDB: operation not allowed" );
- op->o_callback = save_cb;
+ return rs->sr_err;
+ }
- return rs->sr_err;
- }
+ /* map tag to operation */
+ type = slap_req2op( op->o_tag );
+ if ( type != SLAP_OP_LAST ) {
+ BI_op_func **func;
+ int rc;
/* execute, if possible */
- if ( cm->db.be_bind != NULL ) {
- op2 = *op;
+ func = &cm->db.be_bind;
+ if ( func[ type ] != NULL ) {
+ Operation op2 = *op;
+
op2.o_bd = &cm->db;
- rc = op2.o_bd->be_bind( &op2, rs );
- if ( rc == LDAP_SUCCESS ) {
+ rc = func[ type ]( &op2, rs );
+ if ( type == SLAP_OP_BIND && rc == LDAP_SUCCESS ) {
op->o_conn->c_authz_cookie = cm->db.be_private;
}
- } else {
- /* otherwise fall back to error */
- save_cb = op->o_callback;
- op->o_callback = NULL;
- send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
- "operation not supported with pcachePrivDB control" );
- op->o_callback = save_cb;
- }
- return rs->sr_err;
+ return rs->sr_err;
+ }
}
+ /* otherwise fall back to error */
+ save_cb = op->o_callback;
+ op->o_callback = NULL;
+ send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
+ "operation not supported with pcachePrivDB control" );
+ op->o_callback = save_cb;
+
+ return rs->sr_err;
+}
+#endif /* PCACHE_CONTROL_PRIVDB */
+
+static int
+pcache_op_bind(
+ Operation *op,
+ SlapReply *rs )
+{
+ slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
+ cache_manager *cm = on->on_bi.bi_private;
+ QueryTemplate *temp;
+ Entry *e;
+ slap_callback cb = { 0 }, *sc;
+ bindinfo bi;
+ bindcacheinfo *bci;
+ Operation op2;
+ int rc;
+
+#ifdef PCACHE_CONTROL_PRIVDB
+ if ( op->o_ctrlflag[ privDB_cid ] == SLAP_CONTROL_CRITICAL )
+ return pcache_op_privdb( op, rs );
+#endif /* PCACHE_CONTROL_PRIVDB */
+
+ /* Skip if we're not configured for Binds, or cache DB isn't open yet */
+ if ( !cm->cache_binds || cm->defer_db_open )
+ return SLAP_CB_CONTINUE;
+
/* First find a matching template with Bind info */
for ( temp=cm->qm->templates; temp; temp=temp->qmnext ) {
if ( temp->bindttr && dnIsSuffix( &op->o_req_ndn, &temp->bindbase ))
e = NULL;
rc = be_entry_get_rw( &op2, &op->o_req_ndn, NULL, NULL, 0, &e );
if ( rc == LDAP_SUCCESS && e ) {
- int i;
- Attribute *a;
-
bi.bi_flags |= BI_LOOKUP;
op2.ors_filter = pc_bind_attrs( op, e, temp, &op2.ors_filterstr );
be_entry_release_r( &op2, e );
BackendDB *be = op->o_bd;
op->o_bd = &cm->db;
+ Debug( pcache_debug, "pcache_op_bind: CACHED BIND for %s\n",
+ op->o_req_dn.bv_val, 0, 0 );
+
if ( op->o_bd->be_bind( op, rs ) == LDAP_SUCCESS ) {
op->o_conn->c_authz_cookie = cm->db.be_private;
}
return SLAP_CB_CONTINUE;
}
-#ifdef PCACHE_CONTROL_PRIVDB
-static int
-pcache_op_privdb(
- Operation *op,
- SlapReply *rs )
-{
- slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
- cache_manager *cm = on->on_bi.bi_private;
- slap_callback *save_cb;
- slap_op_t type;
-
- /* skip if control is unset */
- if ( op->o_ctrlflag[ privDB_cid ] != SLAP_CONTROL_CRITICAL ) {
- return SLAP_CB_CONTINUE;
- }
-
- /* The cache DB isn't open yet */
- if ( cm->defer_db_open ) {
- send_ldap_error( op, rs, LDAP_UNAVAILABLE,
- "pcachePrivDB: cacheDB not available" );
- return rs->sr_err;
- }
-
- /* FIXME: might be a little bit exaggerated... */
- if ( !be_isroot( op ) ) {
- save_cb = op->o_callback;
- op->o_callback = NULL;
- send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
- "pcachePrivDB: operation not allowed" );
- op->o_callback = save_cb;
-
- return rs->sr_err;
- }
-
- /* map tag to operation */
- type = slap_req2op( op->o_tag );
- if ( type != SLAP_OP_LAST ) {
- BI_op_func **func;
- int rc;
-
- /* execute, if possible */
- func = &cm->db.be_bind;
- if ( func[ type ] != NULL ) {
- Operation op2 = *op;
-
- op2.o_bd = &cm->db;
-
- rc = func[ type ]( &op2, rs );
- if ( type == SLAP_OP_BIND && rc == LDAP_SUCCESS ) {
- op->o_conn->c_authz_cookie = cm->db.be_private;
- }
-
- return rs->sr_err;
- }
- }
-
- /* otherwise fall back to error */
- save_cb = op->o_callback;
- op->o_callback = NULL;
- send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
- "operation not supported with pcachePrivDB control" );
- op->o_callback = save_cb;
-
- return rs->sr_err;
-}
-#endif /* PCACHE_CONTROL_PRIVDB */
-
static int
pcache_op_search(
Operation *op,
temp->attr_set_index,
temp->bindttr,
ldap_pvt_scope2str( temp->bindscope ));
- bv.bv_len += temp->bindbase.bv_len + temp->bindftemp.bv_len + 3;
- bv.bv_val = ch_malloc( bv.bv_len+1 );
+ bv.bv_len += temp->bindbase.bv_len + temp->bindftemp.bv_len + 4;
+ bv.bv_val = ch_malloc( bv.bv_len + 1 );
ptr = bv.bv_val;
*ptr++ = '"';
ptr = lutil_strcopy( ptr, temp->bindftemp.bv_val );
op->ors_slimit = 1;
op->ors_tlimit = SLAP_NO_LIMIT;
op->ors_limit = NULL;
- ber_str2bv( "(cachedQueryURL=*)", 0, 0, &op->ors_filterstr );
+ ber_str2bv( "(pcacheQueryURL=*)", 0, 0, &op->ors_filterstr );
f.f_choice = LDAP_FILTER_PRESENT;
f.f_desc = ad_cachedQueryURL;
op->ors_filter = &f;
};
#endif /* PCACHE_CONTROL_PRIVDB */
+static struct berval pcache_exop_MODIFY_PASSWD = BER_BVC( LDAP_EXOP_MODIFY_PASSWD );
#ifdef PCACHE_EXOP_QUERY_DELETE
static struct berval pcache_exop_QUERY_DELETE = BER_BVC( PCACHE_EXOP_QUERY_DELETE );
return rs->sr_err;
}
+#endif /* PCACHE_EXOP_QUERY_DELETE */
static int
pcache_op_extended( Operation *op, SlapReply *rs )
}
#endif /* PCACHE_CONTROL_PRIVDB */
+#ifdef PCACHE_EXOP_QUERY_DELETE
if ( bvmatch( &op->ore_reqoid, &pcache_exop_QUERY_DELETE ) ) {
struct berval uuid = BER_BVNULL;
ber_tag_t tag = LBER_DEFAULT;
}
op->o_tmpfree( uuid.bv_val, op->o_tmpmemctx );
+ return rs->sr_err;
}
+#endif /* PCACHE_EXOP_QUERY_DELETE */
- return rs->sr_err;
+ /* We only care if we're configured for Bind caching */
+ if ( bvmatch( &op->ore_reqoid, &pcache_exop_MODIFY_PASSWD ) &&
+ cm->cache_binds ) {
+ /* See if the local entry exists and has a password.
+ * It's too much work to find the matching query, so
+ * we just see if there's a hashed password to update.
+ */
+ Operation op2 = *op;
+ Entry *e = NULL;
+ int rc;
+ int doit = 0;
+
+ op2.o_bd = &cm->db;
+ op2.o_dn = op->o_bd->be_rootdn;
+ op2.o_ndn = op->o_bd->be_rootndn;
+ rc = be_entry_get_rw( &op2, &op->o_req_ndn, NULL,
+ slap_schema.si_ad_userPassword, 0, &e );
+ if ( rc == LDAP_SUCCESS && e ) {
+ /* See if a recognized password is hashed here */
+ Attribute *a = attr_find( e->e_attrs,
+ slap_schema.si_ad_userPassword );
+ if ( a && a->a_vals[0].bv_val[0] == '{' &&
+ lutil_passwd_scheme( a->a_vals[0].bv_val )) {
+ doit = 1;
+ }
+ be_entry_release_r( &op2, e );
+ }
+
+ if ( doit ) {
+ rc = overlay_op_walk( op, rs, op_extended, on->on_info,
+ on->on_next );
+ if ( rc == LDAP_SUCCESS ) {
+ req_pwdexop_s *qpw = &op->oq_pwdexop;
+
+ /* We don't care if it succeeds or not */
+ pc_setpw( &op2, &qpw->rs_new, cm );
+ }
+ return rc;
+ }
+ }
+ return SLAP_CB_CONTINUE;
}
-#endif /* PCACHE_EXOP_QUERY_DELETE */
#ifdef PCACHE_MONITOR
CachedQuery *qc;
BerVarray vals = NULL;
- assert( ad_cachedQueryURL != NULL );
-
attr_delete( &e->e_attrs, ad_cachedQueryURL );
if ( ( SLAP_OPATTRS( rs->sr_attr_flags ) || ad_inlist( ad_cachedQueryURL, rs->sr_attrs ) )
&& qm->templates != NULL )
}
}
+ {
+ Attribute *a;
+ char buf[ SLAP_TEXT_BUFLEN ];
+ struct berval bv;
+
+ /* number of cached queries */
+ a = attr_find( e->e_attrs, ad_numQueries );
+ assert( a != NULL );
+
+ bv.bv_val = buf;
+ bv.bv_len = snprintf( buf, sizeof( buf ), "%lu", cm->num_cached_queries );
+
+ if ( a->a_nvals != a->a_vals ) {
+ ber_bvreplace( &a->a_nvals[ 0 ], &bv );
+ }
+ ber_bvreplace( &a->a_vals[ 0 ], &bv );
+
+ /* number of cached entries */
+ a = attr_find( e->e_attrs, ad_numEntries );
+ assert( a != NULL );
+
+ bv.bv_val = buf;
+ bv.bv_len = snprintf( buf, sizeof( buf ), "%d", cm->cur_entries );
+
+ if ( a->a_nvals != a->a_vals ) {
+ ber_bvreplace( &a->a_nvals[ 0 ], &bv );
+ }
+ ber_bvreplace( &a->a_vals[ 0 ], &bv );
+ }
+
return SLAP_CB_CONTINUE;
}
textbuf, sizeof( textbuf ) );
/* don't care too much about return code... */
+ /* remove attrs */
+ mod.sm_values = NULL;
+ mod.sm_desc = ad_numQueries;
+ mod.sm_numvals = 0;
+ rc = modify_delete_values( e, &mod, 1, &text,
+ textbuf, sizeof( textbuf ) );
+ /* don't care too much about return code... */
+
+ /* remove attrs */
+ mod.sm_values = NULL;
+ mod.sm_desc = ad_numEntries;
+ mod.sm_numvals = 0;
+ rc = modify_delete_values( e, &mod, 1, &text,
+ textbuf, sizeof( textbuf ) );
+ /* don't care too much about return code... */
+
return SLAP_CB_CONTINUE;
}
}
/* alloc as many as required (plus 1 for objectClass) */
- a = attrs_alloc( 1 + 0 );
+ a = attrs_alloc( 1 + 2 );
if ( a == NULL ) {
rc = 1;
goto cleanup;
attr_valadd( a, &oc_olmPCache->soc_cname, NULL, 1 );
next = a->a_next;
+ {
+ struct berval bv = BER_BVC( "0" );
+
+ next->a_desc = ad_numQueries;
+ attr_valadd( next, &bv, NULL, 1 );
+ next = next->a_next;
+
+ next->a_desc = ad_numEntries;
+ attr_valadd( next, &bv, NULL, 1 );
+ next = next->a_next;
+ }
+
cb = ch_calloc( sizeof( monitor_callback_t ), 1 );
cb->mc_update = pcache_monitor_update;
cb->mc_free = pcache_monitor_free;
pcache.on_bi.bi_op_add = pcache_op_privdb;
pcache.on_bi.bi_op_delete = pcache_op_privdb;
#endif /* PCACHE_CONTROL_PRIVDB */
-#ifdef PCACHE_EXOP_QUERY_DELETE
pcache.on_bi.bi_extended = pcache_op_extended;
-#elif defined( PCACHE_CONTROL_PRIVDB )
- pcache.on_bi.bi_extended = pcache_op_privdb;
-#endif
pcache.on_bi.bi_chk_controls = pcache_chk_controls;