X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;ds=sidebyside;f=servers%2Fslapd%2Fsearch.c;h=9912d1799fc156596e35e84f933fd52fc8e72c5a;hb=b3c3d89140dadff2de0bf987d48b1dfe77035811;hp=6d9f57480ab17f9a8e5cdff157c3670e55192d46;hpb=473f3ab840ae1d8d026e3c0a7d16f232f90867bb;p=openldap diff --git a/servers/slapd/search.c b/servers/slapd/search.c index 6d9f57480a..9912d1799f 100644 --- a/servers/slapd/search.c +++ b/servers/slapd/search.c @@ -1,7 +1,7 @@ /* $OpenLDAP$ */ /* This work is part of OpenLDAP Software . * - * Copyright 1998-2005 The OpenLDAP Foundation. + * Copyright 1998-2012 The OpenLDAP Foundation. * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -41,8 +41,8 @@ do_search( struct berval base = BER_BVNULL; ber_len_t siz, off, i; - Debug( LDAP_DEBUG_TRACE, "do_search\n", 0, 0, 0 ); - + Debug( LDAP_DEBUG_TRACE, "%s do_search\n", + op->o_log_prefix, 0, 0 ); /* * Parse the search request. It looks like this: * @@ -92,9 +92,7 @@ do_search( case LDAP_SCOPE_BASE: case LDAP_SCOPE_ONELEVEL: case LDAP_SCOPE_SUBTREE: -#ifdef LDAP_SCOPE_SUBORDINATE case LDAP_SCOPE_SUBORDINATE: -#endif break; default: send_ldap_error( op, rs, LDAP_PROTOCOL_ERROR, "invalid scope" ); @@ -114,8 +112,8 @@ do_search( rs->sr_err = dnPrettyNormal( NULL, &base, &op->o_req_dn, &op->o_req_ndn, op->o_tmpmemctx ); if( rs->sr_err != LDAP_SUCCESS ) { - Debug( LDAP_DEBUG_ANY, - "do_search: invalid dn (%s)\n", base.bv_val, 0, 0 ); + Debug( LDAP_DEBUG_ANY, "%s do_search: invalid dn: \"%s\"\n", + op->o_log_prefix, base.bv_val, 0 ); send_ldap_error( op, rs, LDAP_INVALID_DN_SYNTAX, "invalid DN" ); goto return_results; } @@ -154,19 +152,49 @@ do_search( const char *dummy; /* ignore msgs from bv2ad */ op->ors_attrs[i].an_desc = NULL; op->ors_attrs[i].an_oc = NULL; - op->ors_attrs[i].an_oc_exclude = 0; + op->ors_attrs[i].an_flags = 0; if ( slap_bv2ad( &op->ors_attrs[i].an_name, &op->ors_attrs[i].an_desc, &dummy ) != LDAP_SUCCESS ) { - slap_bv2undef_ad( &op->ors_attrs[i].an_name, + if ( slap_bv2undef_ad( &op->ors_attrs[i].an_name, &op->ors_attrs[i].an_desc, &dummy, - SLAP_AD_PROXIED|SLAP_AD_NOINSERT ); - }; + SLAP_AD_PROXIED|SLAP_AD_NOINSERT ) ) + { + struct berval *bv = &op->ors_attrs[i].an_name; + + /* RFC 4511 LDAPv3: All User Attributes */ + if ( bvmatch( bv, slap_bv_all_user_attrs ) ) { + continue; + } + + /* RFC 3673 LDAPv3: All Operational Attributes */ + if ( bvmatch( bv, slap_bv_all_operational_attrs ) ) { + continue; + } + + /* RFC 4529 LDAP: Requesting Attributes by Object Class */ + if ( bv->bv_len > 1 && bv->bv_val[0] == '@' ) { + /* FIXME: check if remaining is valid oc name? */ + continue; + } + + /* add more "exceptions" to RFC 4511 4.5.1.8. */ + + /* invalid attribute description? remove */ + if ( ad_keystring( bv ) ) { + /* NOTE: parsed in-place, don't modify; + * rather add "1.1", which must be ignored */ + BER_BVSTR( &op->ors_attrs[i].an_name, LDAP_NO_ATTRS ); + } + + /* otherwise leave in place... */ + } + } } if( get_ctrls( op, rs, 1 ) != LDAP_SUCCESS ) { - Debug( LDAP_DEBUG_ANY, "do_search: get_ctrls failed\n", 0, 0, 0 ); - + Debug( LDAP_DEBUG_ANY, "%s do_search: get_ctrls failed\n", + op->o_log_prefix, 0, 0 ); goto return_results; } @@ -182,7 +210,7 @@ do_search( if ( StatslogTest( LDAP_DEBUG_STATS ) ) { char abuf[BUFSIZ/2], *ptr = abuf; - int len = 0, alen; + unsigned len = 0, alen; sprintf(abuf, "scope=%d deref=%d", op->ors_scope, op->ors_deref); Statslog( LDAP_DEBUG_STATS, @@ -229,7 +257,7 @@ return_results:; op->o_tmpfree( op->ors_filterstr.bv_val, op->o_tmpmemctx ); } if ( op->ors_filter != NULL) { - filter_free_x( op, op->ors_filter ); + filter_free_x( op, op->ors_filter, 1 ); } if ( op->ors_attrs != NULL ) { op->o_tmpfree( op->ors_attrs, op->o_tmpmemctx ); @@ -241,13 +269,9 @@ return_results:; int fe_op_search( Operation *op, SlapReply *rs ) { - int manageDSAit; - int be_manageDSAit; + BackendDB *bd = op->o_bd; - manageDSAit = get_manageDSAit( op ); - - /* fake while loop to allow breaking out */ - while ( op->ors_scope == LDAP_SCOPE_BASE ) { + if ( op->ors_scope == LDAP_SCOPE_BASE ) { Entry *entry = NULL; if ( BER_BVISEMPTY( &op->o_req_ndn ) ) { @@ -280,6 +304,12 @@ fe_op_search( Operation *op, SlapReply *rs ) goto return_results; } else if ( entry != NULL ) { + if ( get_assert( op ) && + ( test_filter( op, entry, get_assertion( op )) != LDAP_COMPARE_TRUE )) { + rs->sr_err = LDAP_ASSERTION_FAILED; + goto fail1; + } + rs->sr_err = test_filter( op, entry, op->ors_filter ); if( rs->sr_err == LDAP_COMPARE_TRUE ) { @@ -298,13 +328,12 @@ fe_op_search( Operation *op, SlapReply *rs ) rs->sr_entry = NULL; rs->sr_operational_attrs = NULL; } - entry_free( entry ); - rs->sr_err = LDAP_SUCCESS; +fail1: + entry_free( entry ); send_ldap_result( op, rs ); goto return_results; } - break; } if( BER_BVISEMPTY( &op->o_req_ndn ) && !BER_BVISEMPTY( &default_search_nbase ) ) { @@ -321,18 +350,15 @@ fe_op_search( Operation *op, SlapReply *rs ) * if we don't hold it. */ - be_manageDSAit = manageDSAit; - - op->o_bd = select_backend( &op->o_req_ndn, be_manageDSAit, 1 ); + op->o_bd = select_backend( &op->o_req_ndn, 1 ); if ( op->o_bd == NULL ) { rs->sr_ref = referral_rewrite( default_referral, NULL, &op->o_req_dn, op->ors_scope ); if (!rs->sr_ref) rs->sr_ref = default_referral; rs->sr_err = LDAP_REFERRAL; - op->o_bd = frontendDB; + op->o_bd = bd; send_ldap_result( op, rs ); - op->o_bd = NULL; if (rs->sr_ref != default_referral) ber_bvarray_free( rs->sr_ref ); @@ -351,9 +377,28 @@ fe_op_search( Operation *op, SlapReply *rs ) goto return_results; } - /* actually do the search and send the result(s) */ - if ( op->o_bd->be_search ) { + if ( SLAP_SHADOW(op->o_bd) && get_dontUseCopy(op) ) { + /* don't use shadow copy */ + BerVarray defref = op->o_bd->be_update_refs + ? op->o_bd->be_update_refs : default_referral; + + if( defref != NULL ) { + rs->sr_ref = referral_rewrite( defref, + NULL, &op->o_req_dn, op->ors_scope ); + if( !rs->sr_ref) rs->sr_ref = defref; + rs->sr_err = LDAP_REFERRAL; + send_ldap_result( op, rs ); + + if (rs->sr_ref != defref) ber_bvarray_free( rs->sr_ref ); + + } else { + send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM, + "copy not used; no referral information available" ); + } + + } else if ( op->o_bd->be_search ) { if ( limits_check( op, rs ) == 0 ) { + /* actually do the search and send the result(s) */ (op->o_bd->be_search)( op, rs ); } /* else limits_check() sends error */ @@ -364,6 +409,7 @@ fe_op_search( Operation *op, SlapReply *rs ) } return_results:; + op->o_bd = bd; return rs->sr_err; }