X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fback-meta%2Fbind.c;h=120959699f61ca10732d2c937179a78931d39bee;hb=be53e8265065e7de61a0996e37732f44e22fdec7;hp=aca04ac11e0b3df2d62b77aa2c211b6be0ff1254;hpb=af8488c37d79aa125fc1b8a0244e22695823dca6;p=openldap diff --git a/servers/slapd/back-meta/bind.c b/servers/slapd/back-meta/bind.c index aca04ac11e..120959699f 100644 --- a/servers/slapd/back-meta/bind.c +++ b/servers/slapd/back-meta/bind.c @@ -1,67 +1,23 @@ -/* - * Copyright 1998-2001 The OpenLDAP Foundation, All Rights Reserved. - * COPYING RESTRICTIONS APPLY, see COPYRIGHT file - * - * Copyright 2001, Pierangelo Masarati, All rights reserved. - * - * This work has been developed to fulfill the requirements - * of SysNet s.n.c. and it has been donated - * to the OpenLDAP Foundation in the hope that it may be useful - * to the Open Source community, but WITHOUT ANY WARRANTY. - * - * Permission is granted to anyone to use this software for any purpose - * on any computer system, and to alter it and redistribute it, subject - * to the following restrictions: - * - * 1. The author and SysNet s.n.c. are not responsible for the consequences - * of use of this software, no matter how awful, even if they arise from - * flaws in it. - * - * 2. The origin of this software must not be misrepresented, either by - * explicit claim or by omission. Since few users ever read sources, - * credits should appear in the documentation. - * - * 3. Altered versions must be plainly marked as such, and must not be - * misrepresented as being the original software. Since few users - * ever read sources, credits should appear in the documentation. - * SysNet s.n.c. cannot be responsible for the consequences of the - * alterations. - * - * 4. This notice may not be removed or altered. - * +/* $OpenLDAP$ */ +/* This work is part of OpenLDAP Software . * - * This software is based on the backend back-ldap, implemented - * by Howard Chu , and modified by Mark Valence - * , Pierangelo Masarati and other - * contributors. The contribution of the original software to the present - * implementation is acknowledged in this copyright statement. + * Copyright 1999-2005 The OpenLDAP Foundation. + * Portions Copyright 2001-2003 Pierangelo Masarati. + * Portions Copyright 1999-2003 Howard Chu. + * All rights reserved. * - * A special acknowledgement goes to Howard for the overall architecture - * (and for borrowing large pieces of code), and to Mark, who implemented - * from scratch the attribute/objectclass mapping. - * - * The original copyright statement follows. - * - * Copyright 1999, Howard Chu, All rights reserved. - * - * Permission is granted to anyone to use this software for any purpose - * on any computer system, and to alter it and redistribute it, subject - * to the following restrictions: - * - * 1. The author is not responsible for the consequences of use of this - * software, no matter how awful, even if they arise from flaws in it. - * - * 2. The origin of this software must not be misrepresented, either by - * explicit claim or by omission. Since few users ever read sources, - * credits should appear in the documentation. - * - * 3. Altered versions must be plainly marked as such, and must not be - * misrepresented as being the original software. Since few users - * ever read sources, credits should appear in the - * documentation. - * - * 4. This notice may not be removed or altered. + * Redistribution and use in source and binary forms, with or without + * modification, are permitted only as authorized by the OpenLDAP + * Public License. * + * A copy of this license is available in the file LICENSE in the + * top-level directory of the distribution or, alternatively, at + * . + */ +/* ACKNOWLEDGEMENTS: + * This work was initially developed by the Howard Chu for inclusion + * in OpenLDAP Software and subsequently enhanced by Pierangelo + * Masarati. */ #include "portable.h" @@ -77,116 +33,108 @@ #include "../back-ldap/back-ldap.h" #include "back-meta.h" +static LDAP_REBIND_PROC meta_back_rebind; + +static int +meta_back_single_bind( + Operation *op, + SlapReply *rs, + metaconn_t *mc, + int candidate ); + int -meta_back_bind( - Backend *be, - Connection *conn, - Operation *op, - const char *dn, - const char *ndn, - int method, - struct berval *cred, - char **edn -) +meta_back_bind( Operation *op, SlapReply *rs ) { - struct metainfo *li = ( struct metainfo * )be->be_private; - struct metaconn *lc; + metainfo_t *mi = ( metainfo_t * )op->o_bd->be_private; + metaconn_t *mc; - int rc = -1, i, gotit = 0, ndnlen, isroot = 0; - int op_type = META_OP_ALLOW_MULTIPLE; - int err = LDAP_SUCCESS; + int rc = LDAP_OTHER, + i, gotit = 0, isroot = 0; - char *realdn = (char *)dn; - char *realndn = (char *)ndn; - char *realcred = cred->bv_val; - int realmethod = method; + SlapReply *candidates = meta_back_candidates_get( op ); -#ifdef NEW_LOGGING - LDAP_LOG(( "backend", LDAP_LEVEL_ENTRY, - "meta_back_bind: dn: %s.\n", dn )); -#else /* !NEW_LOGGING */ - Debug( LDAP_DEBUG_ARGS, "meta_back_bind: dn: %s.\n%s%s", dn, "", "" ); -#endif /* !NEW_LOGGING */ + rs->sr_err = LDAP_SUCCESS; - *edn = NULL; + Debug( LDAP_DEBUG_ARGS, "meta_back_bind: dn: %s.\n%s%s", + op->o_req_dn.bv_val, "", "" ); - if ( method == LDAP_AUTH_SIMPLE - && be_isroot_pw( be, conn, ndn, cred ) ) { + if ( op->orb_method == LDAP_AUTH_SIMPLE && be_isroot_pw( op ) ) { isroot = 1; - *edn = ch_strdup( be_root_dn( be ) ); - op_type = META_OP_REQUIRE_ALL; + ber_dupbv( &op->orb_edn, be_root_dn( op->o_bd ) ); } - lc = meta_back_getconn( li, conn, op, op_type, ndn, NULL ); - if ( !lc ) { -#ifdef NEW_LOGGING - LDAP_LOG(( "backend", LDAP_LEVEL_NOTICE, - "meta_back_bind: no target for dn %s.\n", - dn )); -#else /* !NEW_LOGGING */ + + /* we need meta_back_getconn() not send result even on error, + * because we want to intercept the error and make it + * invalidCredentials */ + mc = meta_back_getconn( op, rs, NULL, LDAP_BACK_DONTSEND ); + if ( !mc ) { Debug( LDAP_DEBUG_ANY, - "meta_back_bind: no target for dn %s.\n%s%s", - dn, "", ""); -#endif /* !NEW_LOGGING */ - send_ldap_result( conn, op, LDAP_OPERATIONS_ERROR, - NULL, NULL, NULL, NULL ); - return -1; + "meta_back_bind: no target " + "for dn \"%s\" (%d: %s).\n", + op->o_req_dn.bv_val, rs->sr_err, + rs->sr_text ? rs->sr_text : "" ); + /* FIXME: there might be cases where we don't want + * to map the error onto invalidCredentials */ + switch ( rs->sr_err ) { + case LDAP_NO_SUCH_OBJECT: + case LDAP_UNWILLING_TO_PERFORM: + rs->sr_err = LDAP_INVALID_CREDENTIALS; + rs->sr_text = NULL; + break; + } + send_ldap_result( op, rs ); + return rs->sr_err; } /* * Each target is scanned ... */ - lc->bound_target = META_BOUND_NONE; - ndnlen = strlen( ndn ); - for ( i = 0; i < li->ntargets; i++ ) { - int lerr; + mc->mc_auth_target = META_BOUND_NONE; + for ( i = 0; i < mi->mi_ntargets; i++ ) { + int lerr; + Operation op2 = *op; /* * Skip non-candidates */ - if ( lc->conns[ i ]->candidate != META_CANDIDATE ) { + if ( candidates[ i ].sr_tag != META_CANDIDATE ) { continue; } if ( gotit == 0 ) { gotit = 1; - } else { + + } else if ( isroot == 0 ) { /* * A bind operation is expected to have * ONE CANDIDATE ONLY! */ -#ifdef NEW_LOGGING - LDAP_LOG(( "backend", LDAP_LEVEL_WARNING, - "==>meta_back_bind: more than one" - " candidate is attempting to bind" - " ...\n" )); -#else /* !NEW_LOGGING */ Debug( LDAP_DEBUG_ANY, "==>meta_back_bind: more than one" - " candidate is attempting to bind" - " ...\n%s%s%s", - "", "", "" ); -#endif /* !NEW_LOGGING */ + " candidate is trying to bind...\n", + 0, 0, 0 ); } - if ( isroot && li->targets[ i ]->pseudorootdn != NULL ) { - realdn = li->targets[ i ]->pseudorootdn; - realndn = li->targets[ i ]->pseudorootdn; - realcred = li->targets[ i ]->pseudorootpw; - realmethod = LDAP_AUTH_SIMPLE; + if ( isroot && !BER_BVISNULL( &mi->mi_targets[ i ].mt_pseudorootdn ) ) + { + op2.o_req_dn = mi->mi_targets[ i ].mt_pseudorootdn; + op2.o_req_ndn = mi->mi_targets[ i ].mt_pseudorootdn; + op2.orb_cred = mi->mi_targets[ i ].mt_pseudorootpw; + op2.orb_method = LDAP_AUTH_SIMPLE; } - lerr = meta_back_do_single_bind( li, lc, - realdn, realndn, realcred, realmethod, i ); + lerr = meta_back_single_bind( &op2, rs, mc, i ); if ( lerr != LDAP_SUCCESS ) { - err = lerr; - ( void )meta_clear_one_candidate( lc->conns[ i ], 1 ); + rs->sr_err = lerr; + candidates[ i ].sr_tag = META_NOT_CANDIDATE; + } else { rc = LDAP_SUCCESS; } } if ( isroot ) { - lc->bound_target = META_BOUND_ALL; + mc->mc_auth_target = META_BOUND_ALL; } /* @@ -194,81 +142,303 @@ meta_back_bind( * err is the last error that occurred during a bind; * if at least (and at most?) one bind succeedes, fine. */ - if ( rc != LDAP_SUCCESS /* && err != LDAP_SUCCESS */ ) { + if ( rc != LDAP_SUCCESS ) { /* * deal with bind failure ... */ - err = ldap_back_map_result( err ); - send_ldap_result( conn, op, err, NULL, NULL, NULL, NULL ); - return -1; + + /* + * no target was found within the naming context, + * so bind must fail with invalid credentials + */ + if ( rs->sr_err == LDAP_SUCCESS && gotit == 0 ) { + rs->sr_err = LDAP_INVALID_CREDENTIALS; + } + + rs->sr_err = slap_map_api2result( rs ); + send_ldap_result( op, rs ); + return rs->sr_err; } - return 0; + return LDAP_SUCCESS; } /* - * meta_back_do_single_bind + * meta_back_single_bind * * attempts to perform a bind with creds */ -int -meta_back_do_single_bind( - struct metainfo *li, - struct metaconn *lc, - const char *dn, - const char *ndn, - const char *cred, - int method, - int candidate -) +static int +meta_back_single_bind( + Operation *op, + SlapReply *rs, + metaconn_t *mc, + int candidate ) { - char *mdn = NULL; - int rc; + metainfo_t *mi = ( metainfo_t * )op->o_bd->be_private; + metatarget_t *mt = &mi->mi_targets[ candidate ]; + struct berval mdn = BER_BVNULL; + dncookie dc; + metasingleconn_t *msc = &mc->mc_conns[ candidate ]; + int msgid, + rebinding = 0; /* * Rewrite the bind dn if needed */ - switch ( rewrite_session( li->targets[ candidate ]->rwinfo, - "bindDn", dn, lc->conn, &mdn ) ) { - case REWRITE_REGEXEC_OK: - if ( mdn == NULL ) { - mdn = ( char * )dn; + dc.target = &mi->mi_targets[ candidate ]; + dc.conn = op->o_conn; + dc.rs = rs; + dc.ctx = "bindDN"; + + if ( ldap_back_dn_massage( &dc, &op->o_req_dn, &mdn ) ) { + send_ldap_result( op, rs ); + return -1; + } + + /* FIXME: this fixes the bind problem right now; we need + * to use the asynchronous version to get the "matched" + * and more in case of failure ... */ + /* FIXME: should be check if at least some of the op->o_ctrls + * can/should be passed? */ +rebind:; + rs->sr_err = ldap_sasl_bind( msc->msc_ld, mdn.bv_val, + LDAP_SASL_SIMPLE, &op->orb_cred, + op->o_ctrls, NULL, &msgid ); + if ( rs->sr_err == LDAP_SUCCESS ) { + LDAPMessage *res; + struct timeval tv; + int rc; + int nretries = mt->mt_nretries; + + /* + * handle response!!! + */ +retry:; + tv.tv_sec = 0; + tv.tv_usec = META_BIND_TIMEOUT; + switch ( ldap_result( msc->msc_ld, msgid, 0, &tv, &res ) ) { + case 0: + Debug( LDAP_DEBUG_ANY, "%s meta_back_single_bind: ldap_result=%d nretries=%d\n", + op->o_log_prefix, 0, nretries ); + + if ( nretries != META_RETRY_NEVER ) { + ldap_pvt_thread_yield(); + if ( nretries > 0 ) { + nretries--; + } + goto retry; + } + rs->sr_err = LDAP_BUSY; + if ( rebinding ) { + ldap_abandon_ext( msc->msc_ld, msgid, NULL, NULL ); + break; + } + + /* FIXME: some times the request times out + * while the other party is not willing to + * send a response any more. Give it a second + * chance with a freshly bound connection */ + rebinding = 1; + nretries = mt->mt_nretries; + /* fallthru */ + + case -1: + ldap_get_option( msc->msc_ld, LDAP_OPT_ERROR_NUMBER, + &rs->sr_err ); + + if ( rebinding ) { + ldap_abandon_ext( msc->msc_ld, msgid, NULL, NULL ); + } + + Debug( LDAP_DEBUG_ANY, "### %s meta_back_single_bind: err=%d nretries=%d\n", + op->o_log_prefix, rs->sr_err, nretries ); + + rc = slap_map_api2result( rs ); + if ( rs->sr_err == LDAP_UNAVAILABLE && nretries != META_RETRY_NEVER ) { + ldap_unbind_ext_s( msc->msc_ld, NULL, NULL ); + msc->msc_ld = NULL; + msc->msc_bound = 0; + + /* mc here must be the regular mc, reset and ready for init */ + rc = meta_back_init_one_conn( op, rs, mt, msc, + LDAP_BACK_DONTSEND ); + if ( rc ) { + if ( nretries > 0 ) { + nretries--; + } + ldap_pvt_thread_yield(); + goto rebind; + } + } + break; + + default: + rc = ldap_parse_result( msc->msc_ld, res, &rs->sr_err, + NULL, NULL, NULL, NULL, 1 ); + if ( rc != LDAP_SUCCESS ) { + rs->sr_err = rc; + } + break; } -#ifdef NEW_LOGGING - LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1, - "[rw] bindDn: \"%s\" -> \"%s\"\n", dn, mdn )); -#else /* !NEW_LOGGING */ - Debug( LDAP_DEBUG_ARGS, - "rw> bindDn: \"%s\" -> \"%s\"\n%s", - dn, mdn, "" ); -#endif /* !NEW_LOGGING */ - break; - - case REWRITE_REGEXEC_UNWILLING: - return LDAP_UNWILLING_TO_PERFORM; + } - case REWRITE_REGEXEC_ERR: - return LDAP_OPERATIONS_ERROR; + if ( rs->sr_err != LDAP_SUCCESS ) { + rs->sr_err = slap_map_api2result( rs ); + goto return_results; } - rc = ldap_bind_s( lc->conns[ candidate ]->ld, mdn, cred, method ); - if ( rc != LDAP_SUCCESS ) { - rc = ldap_back_map_result( rc ); - } else { - lc->conns[ candidate ]->bound_dn = ch_strdup( dn ); - lc->conns[ candidate ]->bound = META_BOUND; - lc->bound_target = candidate; - - if ( li->cache.ttl != META_DNCACHE_DISABLED - && ndn[ 0 ] != '\0' ) { - ( void )meta_dncache_update_entry( &li->cache, - ch_strdup( ndn ), candidate ); + ber_bvreplace( &msc->msc_bound_ndn, &op->o_req_dn ); + msc->msc_bound = META_BOUND; + mc->mc_auth_target = candidate; + + if ( LDAP_BACK_SAVECRED( mi ) ) { + ber_bvreplace( &msc->msc_cred, &op->orb_cred ); + ldap_set_rebind_proc( msc->msc_ld, meta_back_rebind, msc ); + } + + if ( mi->mi_cache.ttl != META_DNCACHE_DISABLED + && op->o_req_ndn.bv_len != 0 ) + { + ( void )meta_dncache_update_entry( &mi->mi_cache, + &op->o_req_ndn, candidate ); + } + +return_results:; + if ( mdn.bv_val != op->o_req_dn.bv_val ) { + free( mdn.bv_val ); + } + + return rs->sr_err; +} + +/* + * meta_back_single_dobind + */ +int +meta_back_single_dobind( + Operation *op, + SlapReply *rs, + metaconn_t *mc, + int candidate, + ldap_back_send_t sendok, + int nretries ) +{ + metainfo_t *mi = ( metainfo_t * )op->o_bd->be_private; + metatarget_t *mt = &mi->mi_targets[ candidate ]; + metasingleconn_t *msc = &mc->mc_conns[ candidate ]; + int rc; + struct berval cred = BER_BVC( "" ); + int msgid, + rebinding = 0, + save_nretries = nretries; + + /* + * Otherwise an anonymous bind is performed + * (note: if the target was already bound, the anonymous + * bind clears the previous bind). + */ + if ( !BER_BVISNULL( &msc->msc_bound_ndn ) ) { + ber_memfree( msc->msc_bound_ndn.bv_val ); + BER_BVZERO( &msc->msc_bound_ndn ); + } + + if ( !BER_BVISNULL( &msc->msc_cred ) ) { + /* destroy sensitive data */ + memset( msc->msc_cred.bv_val, 0, msc->msc_cred.bv_len ); + ber_memfree( msc->msc_cred.bv_val ); + BER_BVZERO( &msc->msc_cred ); + } + + /* FIXME: should we check if at least some of the op->o_ctrls + * can/should be passed? */ +rebind:; + rc = ldap_sasl_bind( msc->msc_ld, "", LDAP_SASL_SIMPLE, &cred, + NULL, NULL, &msgid ); + if ( rc == LDAP_SUCCESS ) { + LDAPMessage *res; + struct timeval tv; + + /* + * handle response!!! + */ +retry:; + tv.tv_sec = 0; + tv.tv_usec = META_BIND_TIMEOUT; + switch ( ldap_result( msc->msc_ld, msgid, 0, &tv, &res ) ) { + case 0: + Debug( LDAP_DEBUG_ANY, "%s meta_back_single_dobind: ldap_result=%d nretries=%d\n", + op->o_log_prefix, 0, nretries ); + + if ( nretries != META_RETRY_NEVER ) { + ldap_pvt_thread_yield(); + if ( nretries > 0 ) { + nretries--; + } + goto retry; + } + + rc = LDAP_BUSY; + if ( rebinding ) { + ldap_abandon_ext( msc->msc_ld, msgid, NULL, NULL ); + break; + } + + /* FIXME: some times the request times out + * while the other party is not willing to + * send a response any more. Give it a second + * chance with a freshly bound connection */ + rebinding = 1; + nretries = save_nretries; + /* fallthru */ + + case -1: + ldap_get_option( msc->msc_ld, + LDAP_OPT_ERROR_NUMBER, &rs->sr_err ); + + if ( rebinding ) { + ldap_abandon_ext( msc->msc_ld, msgid, NULL, NULL ); + } + + Debug( LDAP_DEBUG_ANY, "### %s meta_back_single_dobind: err=%d nretries=%d\n", + op->o_log_prefix, rs->sr_err, nretries ); + + rc = slap_map_api2result( rs ); + if ( rc == LDAP_UNAVAILABLE && nretries != META_RETRY_NEVER ) { + ldap_unbind_ext_s( msc->msc_ld, NULL, NULL ); + msc->msc_ld = NULL; + msc->msc_bound = 0; + + /* mc here must be the regular mc, reset and ready for init */ + rc = meta_back_init_one_conn( op, rs, mt, msc, LDAP_BACK_DONTSEND ); + + if ( rc == LDAP_SUCCESS ) { + ldap_pvt_thread_yield(); + if ( nretries > 0 ) { + nretries--; + } + goto rebind; + } + } + break; + + default: + rc = ldap_parse_result( msc->msc_ld, res, &rs->sr_err, + NULL, NULL, NULL, NULL, 1 ); + if ( rc == LDAP_SUCCESS ) { + rc = slap_map_api2result( rs ); + } + break; } + + } else { + rc = slap_map_api2result( rs ); } - - if ( mdn != dn ) { - free( mdn ); + + rs->sr_err = rc; + if ( rc != LDAP_SUCCESS && ( sendok & LDAP_BACK_SENDERR ) ) { + send_ldap_result( op, rs ); } return rc; @@ -278,60 +448,66 @@ meta_back_do_single_bind( * meta_back_dobind */ int -meta_back_dobind( struct metaconn *lc, Operation *op ) +meta_back_dobind( + Operation *op, + SlapReply *rs, + metaconn_t *mc, + ldap_back_send_t sendok ) { - struct metasingleconn **lsc; - int bound = 0, i; + metainfo_t *mi = ( metainfo_t * )op->o_bd->be_private; + + int bound = 0, i; + + SlapReply *candidates = meta_back_candidates_get( op ); + + ldap_pvt_thread_mutex_lock( &mc->mc_mutex ); + + Debug( LDAP_DEBUG_TRACE, + "%s meta_back_dobind: conn=%ld\n", + op->o_log_prefix, mc->mc_conn->c_connid, 0 ); /* * all the targets are bound as pseudoroot */ - if ( lc->bound_target == META_BOUND_ALL ) { - return 1; + if ( mc->mc_auth_target == META_BOUND_ALL ) { + bound = 1; + goto done; } - for ( i = 0, lsc = lc->conns; lsc[ 0 ] != NULL; ++i, ++lsc ) { - int rc; + for ( i = 0; i < mi->mi_ntargets; i++ ) { + metatarget_t *mt = &mi->mi_targets[ i ]; + metasingleconn_t *msc = &mc->mc_conns[ i ]; + int rc; /* - * Not a candidate or something wrong with this target ... + * Not a candidate */ - if ( lsc[ 0 ]->ld == NULL ) { + if ( candidates[ i ].sr_tag != META_CANDIDATE ) { continue; } + assert( msc->msc_ld != NULL ); + /* * If the target is already bound it is skipped */ - if ( lsc[ 0 ]->bound == META_BOUND && lc->bound_target == i ) { + if ( msc->msc_bound == META_BOUND && mc->mc_auth_target == i ) { ++bound; + + Debug( LDAP_DEBUG_TRACE, "%s meta_back_dobind[%d]: " + "authcTarget\n", + op->o_log_prefix, i, 0 ); continue; } - /* - * Otherwise an anonymous bind is performed - * (note: if the target was already bound, the anonymous - * bind clears the previous bind). - */ - rc = ldap_bind_s( lsc[ 0 ]->ld, lsc[ 0 ]->bound_dn, - NULL, LDAP_AUTH_SIMPLE ); + rc = meta_back_single_dobind( op, rs, mc, i, + LDAP_BACK_DONTSEND, mt->mt_nretries ); if ( rc != LDAP_SUCCESS ) { - -#ifdef NEW_LOGGING - LDAP_LOG(( "backend", LDAP_LEVEL_WARNING, - "meta_back_dobind: (anonymous)" - " bind as \"%s\" failed" - " with error \"%s\"\n", - lsc[ 0 ]->bound_dn, - ldap_err2string( rc ) )); -#else /* !NEW_LOGGING */ - Debug( LDAP_DEBUG_ANY, - "==>meta_back_dobind: (anonymous)" - " bind as \"%s\" failed" - " with error \"%s\"\n%s", - lsc[ 0 ]->bound_dn, - ldap_err2string( rc ), "" ); -#endif /* !NEW_LOGGING */ + rs->sr_err = slap_map_api2result( rs ); + + Debug( LDAP_DEBUG_ANY, "%s meta_back_dobind[%d]: " + "(anonymous) err=%d\n", + op->o_log_prefix, i, rc ); /* * null cred bind should always succeed @@ -340,87 +516,182 @@ meta_back_dobind( struct metaconn *lc, Operation *op ) * due to technical reasons (remote host down?) * so better clear the handle */ - ( void )meta_clear_one_candidate( lsc[ 0 ], 1 ); + candidates[ i ].sr_tag = META_NOT_CANDIDATE; continue; } /* else */ - lsc[ 0 ]->bound = META_ANONYMOUS; + Debug( LDAP_DEBUG_TRACE, "%s meta_back_dobind[%d]: " + "(anonymous)\n", + op->o_log_prefix, i, 0 ); + + msc->msc_bound = META_ANONYMOUS; ++bound; } +done:; + ldap_pvt_thread_mutex_unlock( &mc->mc_mutex ); + + Debug( LDAP_DEBUG_TRACE, + "%s meta_back_dobind: conn=%ld bound=%d\n", + op->o_log_prefix, mc->mc_conn->c_connid, bound ); + + if ( bound == 0 && ( sendok & LDAP_BACK_SENDERR ) ) { + if ( rs->sr_err == LDAP_SUCCESS ) { + rs->sr_err = LDAP_BUSY; + } + send_ldap_result( op, rs ); + } + return( bound > 0 ); } +/* + * meta_back_rebind + * + * This is a callback used for chasing referrals using the same + * credentials as the original user on this session. + */ +static int +meta_back_rebind( + LDAP *ld, + LDAP_CONST char *url, + ber_tag_t request, + ber_int_t msgid, + void *params ) +{ + metasingleconn_t *msc = ( metasingleconn_t * )params; + + return ldap_sasl_bind_s( ld, msc->msc_bound_ndn.bv_val, + LDAP_SASL_SIMPLE, &msc->msc_cred, + NULL, NULL, NULL ); +} + /* * FIXME: error return must be handled in a cleaner way ... */ int -meta_back_op_result( struct metaconn *lc, Operation *op ) +meta_back_op_result( + metaconn_t *mc, + Operation *op, + SlapReply *rs, + int candidate ) { - int i, rerr = LDAP_SUCCESS; - struct metasingleconn **lsc; - char *rmsg = NULL; - char *rmatch = NULL; - - for ( i = 0, lsc = lc->conns; lsc[ 0 ] != NULL; ++i, ++lsc ) { - int err = LDAP_SUCCESS; - char *msg = NULL; - char *match = NULL; - - ldap_get_option( lsc[ 0 ]->ld, LDAP_OPT_ERROR_NUMBER, &err ); - if ( err != LDAP_SUCCESS ) { + metainfo_t *mi = ( metainfo_t * )op->o_bd->be_private; + + int i, + rerr = LDAP_SUCCESS; + char *rmsg = NULL; + char *rmatch = NULL; + int free_rmsg = 0, + free_rmatch = 0; + + if ( candidate != META_TARGET_NONE ) { + metasingleconn_t *msc = &mc->mc_conns[ candidate ]; + + rs->sr_err = LDAP_SUCCESS; + + ldap_get_option( msc->msc_ld, LDAP_OPT_ERROR_NUMBER, &rs->sr_err ); + if ( rs->sr_err != LDAP_SUCCESS ) { /* * better check the type of error. In some cases * (search ?) it might be better to return a * success if at least one of the targets gave * positive result ... */ - ldap_get_option( lsc[ 0 ]->ld, - LDAP_OPT_ERROR_STRING, &msg ); - ldap_get_option( lsc[ 0 ]->ld, - LDAP_OPT_MATCHED_DN, &match ); - err = ldap_back_map_result( err ); - -#ifdef NEW_LOGGING - LDAP_LOG(( "backend", LDAP_DEBUG_NOTICE, - "meta_back_op_result: target" - " <%d> sending msg \"%s\"" - " (matched \"%s\")\n", - i, ( msg ? msg : "" ), - ( match ? match : "" ) )); -#else /* !NEW_LOGGING */ + ldap_get_option( msc->msc_ld, + LDAP_OPT_ERROR_STRING, &rmsg ); + ldap_get_option( msc->msc_ld, + LDAP_OPT_MATCHED_DN, &rmatch ); + rerr = rs->sr_err = slap_map_api2result( rs ); + + if ( rmsg ) { + free_rmsg = 1; + } + if ( rmatch ) { + free_rmatch = 1; + } + Debug(LDAP_DEBUG_ANY, "==> meta_back_op_result: target" " <%d> sending msg \"%s\"" " (matched \"%s\")\n", - i, ( msg ? msg : "" ), - ( match ? match : "" ) ); -#endif /* !NEW_LOGGING */ - - /* - * FIXME: need to rewrite "match" (need rwinfo) - */ - switch ( err ) { - default: - rerr = err; - rmsg = msg; - msg = NULL; - rmatch = match; - match = NULL; - break; - } + candidate, ( rmsg ? rmsg : "" ), + ( rmatch ? rmatch : "" ) ); + } - /* better test the pointers before freeing? */ - if ( match ) { - free( match ); - } - if ( msg ) { - free( msg ); + } else { + for ( i = 0; i < mi->mi_ntargets; i++ ) { + metasingleconn_t *msc = &mc->mc_conns[ i ]; + char *msg = NULL; + char *match = NULL; + + rs->sr_err = LDAP_SUCCESS; + + ldap_get_option( msc->msc_ld, LDAP_OPT_ERROR_NUMBER, &rs->sr_err ); + if ( rs->sr_err != LDAP_SUCCESS ) { + /* + * better check the type of error. In some cases + * (search ?) it might be better to return a + * success if at least one of the targets gave + * positive result ... + */ + ldap_get_option( msc->msc_ld, + LDAP_OPT_ERROR_STRING, &msg ); + ldap_get_option( msc->msc_ld, + LDAP_OPT_MATCHED_DN, &match ); + rs->sr_err = slap_map_api2result( rs ); + + Debug(LDAP_DEBUG_ANY, + "==> meta_back_op_result: target" + " <%d> sending msg \"%s\"" + " (matched \"%s\")\n", + i, ( msg ? msg : "" ), + ( match ? match : "" ) ); + + /* + * FIXME: need to rewrite "match" (need rwinfo) + */ + switch ( rs->sr_err ) { + default: + rerr = rs->sr_err; + if ( rmsg ) { + ber_memfree( rmsg ); + } + rmsg = msg; + free_rmsg = 1; + msg = NULL; + if ( rmatch ) { + ber_memfree( rmatch ); + } + rmatch = match; + free_rmatch = 1; + match = NULL; + break; + } + + /* better test the pointers before freeing? */ + if ( match ) { + free( match ); + } + if ( msg ) { + free( msg ); + } } } } - - send_ldap_result( lc->conn, op, rerr, rmatch, rmsg, NULL, NULL ); + + rs->sr_err = rerr; + rs->sr_text = rmsg; + rs->sr_matched = rmatch; + send_ldap_result( op, rs ); + if ( free_rmsg ) { + ber_memfree( rmsg ); + } + if ( free_rmatch ) { + ber_memfree( rmatch ); + } + rs->sr_text = NULL; + rs->sr_matched = NULL; return ( ( rerr == LDAP_SUCCESS ) ? 0 : -1 ); }