X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fback-bdb%2Fbind.c;h=0d8717c8134ce4e1186ece827630ebd4a5a3a2fc;hb=6aa36375457daa267dd6dceab0cb4f14565c0fa0;hp=a85fb468ba5cedbe4c05a69fee3e08a5319278cc;hpb=49e3e8899d465701bd67b8d2aa7f6b75a96e6c5d;p=openldap

diff --git a/servers/slapd/back-bdb/bind.c b/servers/slapd/back-bdb/bind.c
index a85fb468ba..0d8717c813 100644
--- a/servers/slapd/back-bdb/bind.c
+++ b/servers/slapd/back-bdb/bind.c
@@ -1,7 +1,7 @@
 /* bind.c - bdb backend bind routine */
 /* $OpenLDAP$ */
 /*
- * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
+ * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
  */
 
@@ -16,236 +16,254 @@
 #include "external.h"
 
 int
-bdb_bind(
-	Backend		*be,
-	Connection		*conn,
-	Operation		*op,
-	const char		*dn,
-	const char		*ndn,
-	int			method,
-	struct berval	*cred,
-	char**	edn
-)
+bdb_bind( Operation *op, SlapReply *rs )
 {
-	struct bdb_info *bdb = (struct bdb_info *) be->be_private;
+	struct bdb_info *bdb = (struct bdb_info *) op->o_bd->be_private;
 	Entry		*e;
 	Attribute	*a;
-	int		rc;
-	Entry		*matched;
+	EntryInfo	*ei;
 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
 	char		krbname[MAX_K_NAME_SZ + 1];
 	AttributeDescription *krbattr = slap_schema.si_ad_krbName;
+	struct berval	krbval;
 	AUTH_DAT	ad;
 #endif
 
 	AttributeDescription *password = slap_schema.si_ad_userPassword;
 
-	Debug( LDAP_DEBUG_ARGS, "==> bdb_bind: dn: %s\n", dn, 0, 0);
+	u_int32_t	locker;
+	DB_LOCK		lock;
 
-	*edn = NULL;
+#ifdef NEW_LOGGING
+	LDAP_LOG ( OPERATION, ARGS, "==> bdb_bind: dn: %s\n", op->o_req_dn.bv_val, 0, 0 );
+#else
+	Debug( LDAP_DEBUG_ARGS, "==> bdb_bind: dn: %s\n", op->o_req_dn.bv_val, 0, 0);
+#endif
 
-	/* get entry */
-	rc = bdb_dn2entry( be, NULL, ndn, &e, &matched, 0 );
+	/* allow noauth binds */
+	if ( op->oq_bind.rb_method == LDAP_AUTH_SIMPLE && be_isroot_pw( op )) {
+		ber_dupbv( &op->oq_bind.rb_edn, be_root_dn( op->o_bd ) );
+		/* front end will send result */
+		return LDAP_SUCCESS;
+	}
 
-	switch(rc) {
-	case DB_NOTFOUND:
+	rs->sr_err = LOCK_ID(bdb->bi_dbenv, &locker);
+	switch(rs->sr_err) {
 	case 0:
 		break;
 	default:
-		send_ldap_result( conn, op, rc=LDAP_OTHER,
-			NULL, "internal error", NULL, NULL );
-		return rc;
+		rs->sr_text = "internal error";
+		send_ldap_result( op, rs );
+		return rs->sr_err;
 	}
 
+dn2entry_retry:
 	/* get entry with reader lock */
-	if ( e == NULL ) {
-		char *matched_dn = NULL;
-		struct berval **refs;
+	rs->sr_err = bdb_dn2entry( op->o_bd, NULL, &op->o_req_ndn, &ei, 1,
+		locker, &lock, op->o_tmpmemctx );
 
-		if( matched != NULL ) {
-			matched_dn = ch_strdup( matched->e_dn );
+	switch(rs->sr_err) {
+	case DB_NOTFOUND:
+	case 0:
+		break;
+	case LDAP_BUSY:
+		send_ldap_error( op, rs, LDAP_BUSY, "ldap_server_busy" );
+		LOCK_ID_FREE(bdb->bi_dbenv, locker);
+		return LDAP_BUSY;
+	case DB_LOCK_DEADLOCK:
+	case DB_LOCK_NOTGRANTED:
+		goto dn2entry_retry;
+	default:
+		send_ldap_error( op, rs, LDAP_OTHER, "internal error" );
+		LOCK_ID_FREE(bdb->bi_dbenv, locker);
+		return rs->sr_err;
+	}
 
-			refs = is_entry_referral( matched )
-				? get_entry_referrals( be, conn, op, matched,
-					dn, LDAP_SCOPE_DEFAULT )
+	e = ei->bei_e;
+	if ( rs->sr_err == DB_NOTFOUND ) {
+		if( e != NULL ) {
+			rs->sr_ref = is_entry_referral( e )
+				? get_entry_referrals( op, e )
 				: NULL;
+			if (rs->sr_ref)
+				rs->sr_matched = ch_strdup( e->e_name.bv_val );
 
-			bdb_entry_return( be, matched );
-			matched = NULL;
-
+			bdb_cache_return_entry_r( bdb->bi_dbenv, &bdb->bi_cache, e, &lock );
+			e = NULL;
 		} else {
-			refs = referral_rewrite( default_referral,
-				NULL, dn, LDAP_SCOPE_DEFAULT );
+			rs->sr_ref = referral_rewrite( default_referral,
+				NULL, &op->o_req_dn, LDAP_SCOPE_DEFAULT );
 		}
 
-		/* allow noauth binds */
-		rc = 1;
-		if ( method == LDAP_AUTH_SIMPLE ) {
-			if ( be_isroot_pw( be, conn, ndn, cred ) ) {
-				*edn = ch_strdup( be_root_dn( be ) );
-				rc = LDAP_SUCCESS; /* front end will send result */
-
-			} else if ( refs != NULL ) {
-				send_ldap_result( conn, op, rc = LDAP_REFERRAL,
-					matched_dn, NULL, refs, NULL );
-
-			} else {
-				send_ldap_result( conn, op, rc = LDAP_INVALID_CREDENTIALS,
-					NULL, NULL, NULL, NULL );
-			}
-
-		} else if ( refs != NULL ) {
-			send_ldap_result( conn, op, rc = LDAP_REFERRAL,
-				matched_dn, NULL, refs, NULL );
-
+		if ( rs->sr_ref != NULL ) {
+			rs->sr_err = LDAP_REFERRAL;
+			send_ldap_result( op, rs );
+			free( (char *)rs->sr_matched );
+			ber_bvarray_free( rs->sr_ref );
+			rs->sr_ref = NULL;
+			rs->sr_matched = NULL;
 		} else {
-			send_ldap_result( conn, op, rc = LDAP_INVALID_CREDENTIALS,
-				NULL, NULL, NULL, NULL );
+			rs->sr_err = LDAP_INVALID_CREDENTIALS;
+			send_ldap_result( op, rs );
 		}
 
-		ber_bvecfree( refs );
-		free( matched_dn );
+		LOCK_ID_FREE(bdb->bi_dbenv, locker);
 
-		return rc;
+		return rs->sr_err;
 	}
 
-	*edn = ch_strdup( e->e_dn );
+	ber_dupbv( &op->oq_bind.rb_edn, &e->e_name );
 
 	/* check for deleted */
+#ifdef BDB_SUBENTRIES
+	if ( is_entry_subentry( e ) ) {
+		/* entry is an subentry, don't allow bind */
+#ifdef NEW_LOGGING
+		LDAP_LOG ( OPERATION, DETAIL1, 
+			"bdb_bind: entry is subentry\n", 0, 0, 0 );
+#else
+		Debug( LDAP_DEBUG_TRACE, "entry is subentry\n", 0,
+			0, 0 );
+#endif
 
+		rs->sr_err = LDAP_INVALID_CREDENTIALS;
+		send_ldap_result( op, rs );
+
+		goto done;
+	}
+#endif
+
+#ifdef BDB_ALIASES
 	if ( is_entry_alias( e ) ) {
 		/* entry is an alias, don't allow bind */
+#ifdef NEW_LOGGING
+		LDAP_LOG ( OPERATION, DETAIL1, "bdb_bind: entry is alias\n", 0, 0, 0 );
+#else
 		Debug( LDAP_DEBUG_TRACE, "entry is alias\n", 0,
 			0, 0 );
+#endif
 
-		send_ldap_result( conn, op, rc = LDAP_ALIAS_PROBLEM,
-			NULL, "entry is alias", NULL, NULL );
+		send_ldap_error( op, rs, LDAP_ALIAS_PROBLEM, "entry is alias");
 
 		goto done;
 	}
+#endif
 
 	if ( is_entry_referral( e ) ) {
 		/* entry is a referral, don't allow bind */
-		struct berval **refs = get_entry_referrals( be,
-			conn, op, e, dn, LDAP_SCOPE_DEFAULT );
+		rs->sr_ref = get_entry_referrals( op, e );
 
+#ifdef NEW_LOGGING
+		LDAP_LOG ( OPERATION, DETAIL1, 
+			"bdb_bind: entry is referral\n", 0, 0, 0 );
+#else
 		Debug( LDAP_DEBUG_TRACE, "entry is referral\n", 0,
 			0, 0 );
+#endif
 
-		if( refs != NULL ) {
-			send_ldap_result( conn, op, rc = LDAP_REFERRAL,
-				e->e_dn, NULL, refs, NULL );
-
+		if( rs->sr_ref != NULL ) {
+			rs->sr_err = LDAP_REFERRAL;
+			rs->sr_matched = e->e_name.bv_val;
+			send_ldap_result( op, rs );
+			ber_bvarray_free( rs->sr_ref );
+			rs->sr_ref = NULL;
+			rs->sr_matched = NULL;
 		} else {
-			send_ldap_result( conn, op, rc = LDAP_INVALID_CREDENTIALS,
-				NULL, NULL, NULL, NULL );
+			rs->sr_err = LDAP_INVALID_CREDENTIALS;
+			send_ldap_result( op, rs );
 		}
 
-		ber_bvecfree( refs );
-
 		goto done;
 	}
 
-	switch ( method ) {
+	switch ( op->oq_bind.rb_method ) {
 	case LDAP_AUTH_SIMPLE:
-		/* check for root dn/passwd */
-		if ( be_isroot_pw( be, conn, ndn, cred ) ) {
-			/* front end will send result */
-			if(*edn != NULL) free( *edn );
-			*edn = ch_strdup( be_root_dn( be ) );
-			rc = LDAP_SUCCESS;
-			goto done;
-		}
-
-		if ( ! access_allowed( be, conn, op, e,
-			password, NULL, ACL_AUTH ) )
-		{
-			send_ldap_result( conn, op, rc = LDAP_INSUFFICIENT_ACCESS,
-				NULL, NULL, NULL, NULL );
+		rs->sr_err = access_allowed( op, e,
+			password, NULL, ACL_AUTH, NULL );
+		if ( ! rs->sr_err ) {
+			rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
+			send_ldap_result( op, rs );
 			goto done;
 		}
 
 		if ( (a = attr_find( e->e_attrs, password )) == NULL ) {
-			send_ldap_result( conn, op, rc = LDAP_INAPPROPRIATE_AUTH,
-				NULL, NULL, NULL, NULL );
+			rs->sr_err = LDAP_INAPPROPRIATE_AUTH;
+			send_ldap_result( op, rs );
 			goto done;
 		}
 
-		if ( slap_passwd_check( conn, a, cred ) != 0 ) {
-			send_ldap_result( conn, op, rc = LDAP_INVALID_CREDENTIALS,
-				NULL, NULL, NULL, NULL );
+		if ( slap_passwd_check( op->o_conn, a, &op->oq_bind.rb_cred, &rs->sr_text ) != 0 ) {
+			rs->sr_err = LDAP_INVALID_CREDENTIALS;
+			send_ldap_result( op, rs );
 			goto done;
 		}
 
-		rc = 0;
+		rs->sr_err = 0;
 		break;
 
 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
 	case LDAP_AUTH_KRBV41:
-		if ( krbv4_ldap_auth( be, cred, &ad ) != LDAP_SUCCESS ) {
-			send_ldap_result( conn, op, rc = LDAP_INVALID_CREDENTIALS,
-				NULL, NULL, NULL, NULL );
+		if ( krbv4_ldap_auth( op->o_bd, &op->oq_bind.rb_cred, &ad ) != LDAP_SUCCESS ) {
+			rs->sr_err = LDAP_INVALID_CREDENTIALS,
+			send_ldap_result( op );
 			goto done;
 		}
 
-		if ( ! access_allowed( be, conn, op, e,
-			krbattr, NULL, ACL_AUTH ) )
-		{
-			send_ldap_result( conn, op, rc = LDAP_INSUFFICIENT_ACCESS,
-				NULL, NULL, NULL, NULL );
+		rs->sr_err = access_allowed( op, e,
+			krbattr, NULL, ACL_AUTH, NULL );
+		if ( ! rs->sr_err ) {
+			rs->sr_err = LDAP_INSUFFICIENT_ACCESS,
+			send_ldap_result( op );
 			goto done;
 		}
 
-		sprintf( krbname, "%s%s%s@%s", ad.pname, *ad.pinst ? "."
+		krbval.bv_len = sprintf( krbname, "%s%s%s@%s", ad.pname, *ad.pinst ? "."
 			: "", ad.pinst, ad.prealm );
 
 		if ( (a = attr_find( e->e_attrs, krbattr )) == NULL ) {
 			/*
-			 * no krbname values present:  check against DN
+			 * no krbname values present: check against DN
 			 */
-			if ( strcasecmp( dn, krbname ) == 0 ) {
-				rc = 0;
+			if ( strcasecmp( op->o_req_dn.bv_val, krbname ) == 0 ) {
+				rs->sr_err = 0;
 				break;
 			}
-			send_ldap_result( conn, op, rc = LDAP_INAPPROPRIATE_AUTH,
-				NULL, NULL, NULL, NULL );
+			rs->sr_err = LDAP_INAPPROPRIATE_AUTH,
+			send_ldap_result( op );
 			goto done;
 
 		} else {	/* look for krbname match */
-			struct berval	krbval;
-
 			krbval.bv_val = krbname;
-			krbval.bv_len = strlen( krbname );
 
 			if ( value_find( a->a_desc, a->a_vals, &krbval ) != 0 ) {
-				send_ldap_result( conn, op,
-					rc = LDAP_INVALID_CREDENTIALS,
-					NULL, NULL, NULL, NULL );
+				rs->sr_err = LDAP_INVALID_CREDENTIALS;
+				send_ldap_result( op );
 				goto done;
 			}
 		}
-		rc = 0;
+		rs->sr_err = 0;
 		break;
 
 	case LDAP_AUTH_KRBV42:
-		send_ldap_result( conn, op, rc = LDAP_UNWILLING_TO_PERFORM,
-			NULL, "Kerberos bind step 2 not supported",
-			NULL, NULL );
+		send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
+			"Kerberos bind step 2 not supported" );
 		goto done;
 #endif
 
 	default:
-		send_ldap_result( conn, op, rc = LDAP_STRONG_AUTH_NOT_SUPPORTED,
-			NULL, "authentication method not supported", NULL, NULL );
+		send_ldap_error( op, rs, LDAP_STRONG_AUTH_NOT_SUPPORTED,
+			"authentication method not supported" );
 		goto done;
 	}
 
 done:
 	/* free entry and reader lock */
 	if( e != NULL ) {
-		bdb_entry_return( be, e );
+		bdb_cache_return_entry_r( bdb->bi_dbenv, &bdb->bi_cache, e, &lock );
 	}
 
-	/* front end with send result on success (rc==0) */
-	return rc;
+	LOCK_ID_FREE(bdb->bi_dbenv, locker);
+
+	/* front end will send result on success (rs->sr_err==0) */
+	return rs->sr_err;
 }