X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fcontrols.c;h=5699329c6efa64eb0c135f62086310cff94d8831;hb=021443bd5d355b8171dcbe4650c67507b9e1b83b;hp=465884c412efec812a27f9b1e7a386050581e084;hpb=1b70e1644888c477890722e45307fea60eaa3d77;p=openldap diff --git a/servers/slapd/controls.c b/servers/slapd/controls.c index 465884c412..5699329c6e 100644 --- a/servers/slapd/controls.c +++ b/servers/slapd/controls.c @@ -1,13 +1,18 @@ /* $OpenLDAP$ */ -/* - * Copyright 1999-2002 The OpenLDAP Foundation. +/* This work is part of OpenLDAP Software . + * + * Copyright 1998-2005 The OpenLDAP Foundation. * All rights reserved. * - * Redistribution and use in source and binary forms are permitted only - * as authorized by the OpenLDAP Public License. A copy of this - * license is available at http://www.OpenLDAP.org/license.html or - * in file LICENSE in the top-level directory of the distribution. + * Redistribution and use in source and binary forms, with or without + * modification, are permitted only as authorized by the OpenLDAP + * Public License. + * + * A copy of this license is available in the file LICENSE in the + * top-level directory of the distribution or, alternatively, at + * . */ + #include "portable.h" #include @@ -19,114 +24,424 @@ #include "../../libraries/liblber/lber-int.h" -#define SLAP_CTRL_FRONTEND 0x80000000U -#define SLAP_CTRL_FRONTEND_SEARCH 0x01000000U /* for NOOP */ - -#define SLAP_CTRL_OPFLAGS 0x0000FFFFU -#define SLAP_CTRL_ABANDON 0x00000001U -#define SLAP_CTRL_ADD 0x00002002U -#define SLAP_CTRL_BIND 0x00000004U -#define SLAP_CTRL_COMPARE 0x00001008U -#define SLAP_CTRL_DELETE 0x00002010U -#define SLAP_CTRL_MODIFY 0x00002020U -#define SLAP_CTRL_RENAME 0x00002040U -#define SLAP_CTRL_SEARCH 0x00001080U -#define SLAP_CTRL_UNBIND 0x00000100U - -#define SLAP_CTRL_INTROGATE (SLAP_CTRL_COMPARE|SLAP_CTRL_SEARCH) -#define SLAP_CTRL_UPDATE \ - (SLAP_CTRL_ADD|SLAP_CTRL_DELETE|SLAP_CTRL_MODIFY|SLAP_CTRL_RENAME) -#define SLAP_CTRL_ACCESS (SLAP_CTRL_INTROGATE|SLAP_CTRL_UPDATE) - -typedef int (SLAP_CTRL_PARSE_FN) LDAP_P(( - Connection *conn, - Operation *op, - LDAPControl *ctrl, - const char **text )); - +static SLAP_CTRL_PARSE_FN parseAssert; +static SLAP_CTRL_PARSE_FN parsePreRead; +static SLAP_CTRL_PARSE_FN parsePostRead; static SLAP_CTRL_PARSE_FN parseProxyAuthz; +#ifdef LDAP_DEVEL +static SLAP_CTRL_PARSE_FN parseManageDIT; +#endif static SLAP_CTRL_PARSE_FN parseManageDSAit; +static SLAP_CTRL_PARSE_FN parseModifyIncrement; static SLAP_CTRL_PARSE_FN parseNoOp; static SLAP_CTRL_PARSE_FN parsePagedResults; +#ifdef LDAP_DEVEL +static SLAP_CTRL_PARSE_FN parseSortedResults; +#endif static SLAP_CTRL_PARSE_FN parseValuesReturnFilter; - -#ifdef LDAP_CONTROL_SUBENTRIES +static SLAP_CTRL_PARSE_FN parsePermissiveModify; +static SLAP_CTRL_PARSE_FN parseDomainScope; +static SLAP_CTRL_PARSE_FN parseTreeDelete; +static SLAP_CTRL_PARSE_FN parseSearchOptions; static SLAP_CTRL_PARSE_FN parseSubentries; -#endif -#ifdef LDAP_CLIENT_UPDATE -static SLAP_CTRL_PARSE_FN parseClientUpdate; -#endif #undef sc_mask /* avoid conflict with Irix 6.5 */ -static char *proxy_authz_extops[] = { - LDAP_EXOP_MODIFY_PASSWD, - LDAP_EXOP_X_WHO_AM_I, - NULL -}; +const struct berval slap_pre_read_bv = BER_BVC(LDAP_CONTROL_PRE_READ); +const struct berval slap_post_read_bv = BER_BVC(LDAP_CONTROL_POST_READ); -static struct slap_control { +struct slap_control_ids slap_cids; + +struct slap_control { + /* Control OID */ char *sc_oid; + + /* The controlID for this control */ + int sc_cid; + + /* Operations supported by control */ slap_mask_t sc_mask; + + /* Extended operations supported by control */ char **sc_extendedops; + + /* Control parsing callback */ SLAP_CTRL_PARSE_FN *sc_parse; -} supportedControls[] = { - { LDAP_CONTROL_PROXY_AUTHZ, - SLAP_CTRL_FRONTEND|SLAP_CTRL_ACCESS, proxy_authz_extops, - parseProxyAuthz }, - { LDAP_CONTROL_MANAGEDSAIT, - SLAP_CTRL_ACCESS, NULL, - parseManageDSAit }, - { LDAP_CONTROL_NOOP, - SLAP_CTRL_ACCESS, NULL, - parseNoOp }, + LDAP_SLIST_ENTRY(slap_control) sc_next; +}; + +static LDAP_SLIST_HEAD(ControlsList, slap_control) controls_list + = LDAP_SLIST_HEAD_INITIALIZER(&controls_list); + +/* + * all known request control OIDs should be added to this list + */ +/* + * NOTE: initialize num_known_controls to 1 so that cid = 0 always + * addresses an undefined control; this allows to safely test for + * well known controls even if they are not registered, e.g. if + * they get moved to modules. An example is sc_LDAPsync, which + * is implemented in the syncprov overlay and thus, if configured + * as dynamic module, may not be registered. One side effect is that + * slap_known_controls[0] == NULL, so it should always be used + * starting from 1. + * FIXME: should we define the "undefined control" oid? + */ +char *slap_known_controls[SLAP_MAX_CIDS+1]; +static int num_known_controls = 1; + +static char *proxy_authz_extops[] = { + LDAP_EXOP_MODIFY_PASSWD, + LDAP_EXOP_X_WHO_AM_I, + NULL +}; + +static struct slap_control control_defs[] = { + { LDAP_CONTROL_ASSERT, + (int)offsetof(struct slap_control_ids, sc_assert), + SLAP_CTRL_HIDE|SLAP_CTRL_ACCESS, NULL, + parseAssert, LDAP_SLIST_ENTRY_INITIALIZER(next) }, + { LDAP_CONTROL_PRE_READ, + (int)offsetof(struct slap_control_ids, sc_preRead), + SLAP_CTRL_HIDE|SLAP_CTRL_DELETE|SLAP_CTRL_MODIFY|SLAP_CTRL_RENAME, NULL, + parsePreRead, LDAP_SLIST_ENTRY_INITIALIZER(next) }, + { LDAP_CONTROL_POST_READ, + (int)offsetof(struct slap_control_ids, sc_postRead), + SLAP_CTRL_HIDE|SLAP_CTRL_ADD|SLAP_CTRL_MODIFY|SLAP_CTRL_RENAME, NULL, + parsePostRead, LDAP_SLIST_ENTRY_INITIALIZER(next) }, + { LDAP_CONTROL_VALUESRETURNFILTER, + (int)offsetof(struct slap_control_ids, sc_valuesReturnFilter), + SLAP_CTRL_GLOBAL|SLAP_CTRL_SEARCH, NULL, + parseValuesReturnFilter, LDAP_SLIST_ENTRY_INITIALIZER(next) }, { LDAP_CONTROL_PAGEDRESULTS, + (int)offsetof(struct slap_control_ids, sc_pagedResults), SLAP_CTRL_SEARCH, NULL, - parsePagedResults }, - { LDAP_CONTROL_VALUESRETURNFILTER, - SLAP_CTRL_SEARCH, NULL, - parseValuesReturnFilter }, + parsePagedResults, LDAP_SLIST_ENTRY_INITIALIZER(next) }, +#ifdef LDAP_DEVEL + { LDAP_CONTROL_SORTREQUEST, + (int)offsetof(struct slap_control_ids, sc_sortedResults), + SLAP_CTRL_GLOBAL|SLAP_CTRL_SEARCH|SLAP_CTRL_HIDE, NULL, + parseSortedResults, LDAP_SLIST_ENTRY_INITIALIZER(next) }, +#endif +#ifdef LDAP_CONTROL_X_DOMAIN_SCOPE + { LDAP_CONTROL_X_DOMAIN_SCOPE, + (int)offsetof(struct slap_control_ids, sc_domainScope), + SLAP_CTRL_GLOBAL|SLAP_CTRL_SEARCH, NULL, + parseDomainScope, LDAP_SLIST_ENTRY_INITIALIZER(next) }, +#endif +#ifdef LDAP_CONTROL_X_PERMISSIVE_MODIFY + { LDAP_CONTROL_X_PERMISSIVE_MODIFY, + (int)offsetof(struct slap_control_ids, sc_permissiveModify), + SLAP_CTRL_MODIFY, NULL, + parsePermissiveModify, LDAP_SLIST_ENTRY_INITIALIZER(next) }, +#endif +#ifdef SLAP_CONTROL_X_TREE_DELETE + { LDAP_CONTROL_X_TREE_DELETE, + (int)offsetof(struct slap_control_ids, sc_treeDelete), + SLAP_CTRL_HIDE|SLAP_CTRL_DELETE, NULL, + parseTreeDelete, LDAP_SLIST_ENTRY_INITIALIZER(next) }, +#endif +#ifdef LDAP_CONTROL_X_SEARCH_OPTIONS + { LDAP_CONTROL_X_SEARCH_OPTIONS, + (int)offsetof(struct slap_control_ids, sc_searchOptions), + SLAP_CTRL_GLOBAL|SLAP_CTRL_SEARCH, NULL, + parseSearchOptions, LDAP_SLIST_ENTRY_INITIALIZER(next) }, +#endif #ifdef LDAP_CONTROL_SUBENTRIES { LDAP_CONTROL_SUBENTRIES, + (int)offsetof(struct slap_control_ids, sc_subentries), SLAP_CTRL_SEARCH, NULL, - parseSubentries }, + parseSubentries, LDAP_SLIST_ENTRY_INITIALIZER(next) }, #endif -#ifdef LDAP_CLIENT_UPDATE - { LDAP_CONTROL_CLIENT_UPDATE, - SLAP_CTRL_SEARCH, NULL, - parseClientUpdate }, -#endif /* LDAP_CLIENT_UPDATE */ - { NULL } + { LDAP_CONTROL_NOOP, + (int)offsetof(struct slap_control_ids, sc_noOp), + SLAP_CTRL_HIDE|SLAP_CTRL_ACCESS, NULL, + parseNoOp, LDAP_SLIST_ENTRY_INITIALIZER(next) }, +#ifdef LDAP_CONTROL_MODIFY_INCREMENT + { LDAP_CONTROL_MODIFY_INCREMENT, + (int)offsetof(struct slap_control_ids, sc_modifyIncrement), + SLAP_CTRL_HIDE|SLAP_CTRL_MODIFY, NULL, + parseModifyIncrement, LDAP_SLIST_ENTRY_INITIALIZER(next) }, +#endif +#ifdef LDAP_DEVEL + { LDAP_CONTROL_MANAGEDIT, + (int)offsetof(struct slap_control_ids, sc_manageDIT), + SLAP_CTRL_GLOBAL|SLAP_CTRL_UPDATE, NULL, + parseManageDIT, LDAP_SLIST_ENTRY_INITIALIZER(next) }, +#endif + { LDAP_CONTROL_MANAGEDSAIT, + (int)offsetof(struct slap_control_ids, sc_manageDSAit), + SLAP_CTRL_ACCESS, NULL, + parseManageDSAit, LDAP_SLIST_ENTRY_INITIALIZER(next) }, + { LDAP_CONTROL_PROXY_AUTHZ, + (int)offsetof(struct slap_control_ids, sc_proxyAuthz), + SLAP_CTRL_GLOBAL|SLAP_CTRL_ACCESS, proxy_authz_extops, + parseProxyAuthz, LDAP_SLIST_ENTRY_INITIALIZER(next) }, + { NULL, 0, 0, NULL, 0, LDAP_SLIST_ENTRY_INITIALIZER(next) } }; -char * -get_supported_ctrl(int index) +/* + * Register a supported control. + * + * This can be called by an OpenLDAP plugin or, indirectly, by a + * SLAPI plugin calling slapi_register_supported_control(). + */ +int +register_supported_control(const char *controloid, + slap_mask_t controlmask, + char **controlexops, + SLAP_CTRL_PARSE_FN *controlparsefn, + int *controlcid) +{ + struct slap_control *sc; + int i; + + if ( num_known_controls >= SLAP_MAX_CIDS ) { + Debug( LDAP_DEBUG_ANY, "Too many controls registered." + " Recompile slapd with SLAP_MAX_CIDS defined > %d\n", + SLAP_MAX_CIDS, 0, 0 ); + return LDAP_OTHER; + } + + if ( controloid == NULL ) return LDAP_PARAM_ERROR; + + /* sanity check - should never happen */ + for ( i = 0; slap_known_controls[ i ]; i++ ) { + if ( strcmp( controloid, slap_known_controls[ i ] ) == 0 ) { + Debug( LDAP_DEBUG_ANY, + "Control %s already registered.\n", + controloid, 0, 0 ); + return LDAP_PARAM_ERROR; + } + } + + sc = (struct slap_control *)SLAP_MALLOC( sizeof( *sc ) ); + if ( sc == NULL ) return LDAP_NO_MEMORY; + + sc->sc_oid = ch_strdup( controloid ); + sc->sc_mask = controlmask; + if ( controlexops != NULL ) { + sc->sc_extendedops = ldap_charray_dup( controlexops ); + if ( sc->sc_extendedops == NULL ) { + ch_free( sc ); + return LDAP_NO_MEMORY; + } + } else { + sc->sc_extendedops = NULL; + } + sc->sc_parse = controlparsefn; + + if ( controlcid ) *controlcid = num_known_controls; + sc->sc_cid = num_known_controls; + + /* Update slap_known_controls, too. */ + slap_known_controls[num_known_controls-1] = sc->sc_oid; + slap_known_controls[num_known_controls++] = NULL; + + LDAP_SLIST_NEXT( sc, sc_next ) = NULL; + LDAP_SLIST_INSERT_HEAD( &controls_list, sc, sc_next ); + return LDAP_SUCCESS; +} + +/* + * One-time initialization of internal controls. + */ +int +slap_controls_init( void ) +{ + int i, rc; + struct slap_control *sc; + + rc = LDAP_SUCCESS; + + for ( i = 0; control_defs[i].sc_oid != NULL; i++ ) { + int *cid = (int *)(((char *)&slap_cids) + control_defs[i].sc_cid ); + rc = register_supported_control( control_defs[i].sc_oid, + control_defs[i].sc_mask, control_defs[i].sc_extendedops, + control_defs[i].sc_parse, cid ); + if ( rc != LDAP_SUCCESS ) break; + } + + return rc; +} + +/* + * Free memory associated with list of supported controls. + */ +void +controls_destroy( void ) { - return supportedControls[index].sc_oid; + struct slap_control *sc; + + while ( !LDAP_SLIST_EMPTY(&controls_list) ) { + sc = LDAP_SLIST_FIRST(&controls_list); + LDAP_SLIST_REMOVE_HEAD(&controls_list, sc_next); + + ch_free( sc->sc_oid ); + if ( sc->sc_extendedops != NULL ) { + ldap_charray_free( sc->sc_extendedops ); + } + ch_free( sc ); + } } -slap_mask_t -get_supported_ctrl_mask(int index) +/* + * Format the supportedControl attribute of the root DSE, + * detailing which controls are supported by the directory + * server. + */ +int +controls_root_dse_info( Entry *e ) { - return supportedControls[index].sc_mask; + AttributeDescription *ad_supportedControl + = slap_schema.si_ad_supportedControl; + struct berval vals[2]; + struct slap_control *sc; + + vals[1].bv_val = NULL; + vals[1].bv_len = 0; + + LDAP_SLIST_FOREACH( sc, &controls_list, sc_next ) { + if( sc->sc_mask & SLAP_CTRL_HIDE ) continue; + + vals[0].bv_val = sc->sc_oid; + vals[0].bv_len = strlen( sc->sc_oid ); + + if ( attr_merge( e, ad_supportedControl, vals, NULL ) ) { + return -1; + } + } + + return 0; } +/* + * Return a list of OIDs and operation masks for supported + * controls. Used by SLAPI. + */ +int +get_supported_controls(char ***ctrloidsp, + slap_mask_t **ctrlmasks) +{ + int i, n; + char **oids; + slap_mask_t *masks; + int rc; + struct slap_control *sc; + + n = 0; + + LDAP_SLIST_FOREACH( sc, &controls_list, sc_next ) { + n++; + } + + if ( n == 0 ) { + *ctrloidsp = NULL; + *ctrlmasks = NULL; + return LDAP_SUCCESS; + } + + oids = (char **)SLAP_MALLOC( (n + 1) * sizeof(char *) ); + if ( oids == NULL ) { + return LDAP_NO_MEMORY; + } + masks = (slap_mask_t *)SLAP_MALLOC( (n + 1) * sizeof(slap_mask_t) ); + if ( masks == NULL ) { + ch_free( oids ); + return LDAP_NO_MEMORY; + } + + n = 0; + + LDAP_SLIST_FOREACH( sc, &controls_list, sc_next ) { + oids[n] = ch_strdup( sc->sc_oid ); + masks[n] = sc->sc_mask; + n++; + } + oids[n] = NULL; + masks[n] = 0; + + *ctrloidsp = oids; + *ctrlmasks = masks; + + return LDAP_SUCCESS; +} + +/* + * Find a control given its OID. + */ static struct slap_control * find_ctrl( const char *oid ) { - int i; - for( i=0; supportedControls[i].sc_oid; i++ ) { - if( strcmp( oid, supportedControls[i].sc_oid ) == 0 ) { - return &supportedControls[i]; + struct slap_control *sc; + + LDAP_SLIST_FOREACH( sc, &controls_list, sc_next ) { + if ( strcmp( oid, sc->sc_oid ) == 0 ) { + return sc; } } + return NULL; } +int +slap_find_control_id( + const char *oid, + int *cid ) +{ + struct slap_control *ctrl = find_ctrl( oid ); + if ( ctrl ) { + if ( cid ) *cid = ctrl->sc_cid; + return LDAP_SUCCESS; + } + return LDAP_CONTROL_NOT_FOUND; +} + +int +slap_global_control( Operation *op, const char *oid, int *cid ) +{ + struct slap_control *ctrl = find_ctrl( oid ); + + if ( ctrl == NULL ) { + /* should not be reachable */ + Debug( LDAP_DEBUG_ANY, + "slap_global_control: unrecognized control: %s\n", + oid, 0, 0 ); + return LDAP_CONTROL_NOT_FOUND; + } + + if ( cid ) *cid = ctrl->sc_cid; + + if ( ( ctrl->sc_mask & SLAP_CTRL_GLOBAL ) || + ( ( op->o_tag & LDAP_REQ_SEARCH ) && + ( ctrl->sc_mask & SLAP_CTRL_GLOBAL_SEARCH ) ) ) + { + return LDAP_COMPARE_TRUE; + } + + Debug( LDAP_DEBUG_TRACE, + "slap_global_control: unavailable control: %s\n", + oid, 0, 0 ); + + return LDAP_COMPARE_FALSE; +} + +void slap_free_ctrls( + Operation *op, + LDAPControl **ctrls ) +{ + int i; + + for (i=0; ctrls[i]; i++) { + op->o_tmpfree(ctrls[i], op->o_tmpmemctx ); + } + op->o_tmpfree( ctrls, op->o_tmpmemctx ); +} + int get_ctrls( - Connection *conn, Operation *op, + SlapReply *rs, int sendres ) { int nctrls = 0; @@ -135,44 +450,41 @@ int get_ctrls( char *opaque; BerElement *ber = op->o_ber; struct slap_control *sc; - int rc = LDAP_SUCCESS; - const char *errmsg = NULL; + struct berval bv; len = ber_pvt_ber_remaining(ber); if( len == 0) { /* no controls */ - rc = LDAP_SUCCESS; - return rc; + rs->sr_err = LDAP_SUCCESS; + return rs->sr_err; } if(( tag = ber_peek_tag( ber, &len )) != LDAP_TAG_CONTROLS ) { if( tag == LBER_ERROR ) { - rc = SLAPD_DISCONNECT; - errmsg = "unexpected data in PDU"; + rs->sr_err = SLAPD_DISCONNECT; + rs->sr_text = "unexpected data in PDU"; } goto return_results; } -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, ENTRY, "get_ctrls: conn %lu\n", conn->c_connid, 0, 0 ); -#else - Debug( LDAP_DEBUG_TRACE, "=> get_ctrls\n", 0, 0, 0 ); -#endif + Debug( LDAP_DEBUG_TRACE, + "=> get_ctrls\n", 0, 0, 0 ); + if( op->o_protocol < LDAP_VERSION3 ) { - rc = SLAPD_DISCONNECT; - errmsg = "controls require LDAPv3"; + rs->sr_err = SLAPD_DISCONNECT; + rs->sr_text = "controls require LDAPv3"; goto return_results; } /* one for first control, one for termination */ - op->o_ctrls = ch_malloc( 2 * sizeof(LDAPControl *) ); + op->o_ctrls = op->o_tmpalloc( 2 * sizeof(LDAPControl *), op->o_tmpmemctx ); #if 0 if( op->ctrls == NULL ) { - rc = LDAP_NO_MEMORY; - errmsg = "no memory"; + rs->sr_err = LDAP_NO_MEMORY; + rs->sr_text = "no memory"; goto return_results; } #endif @@ -187,24 +499,14 @@ int get_ctrls( LDAPControl *c; LDAPControl **tctrls; - c = ch_calloc( 1, sizeof(LDAPControl) ); - -#if 0 - if( c == NULL ) { - ldap_controls_free(op->o_ctrls); - op->o_ctrls = NULL; - - rc = LDAP_NO_MEMORY; - errmsg = "no memory"; - goto return_results; - } -#endif + c = op->o_tmpalloc( sizeof(LDAPControl), op->o_tmpmemctx ); + memset(c, 0, sizeof(LDAPControl)); /* allocate pointer space for current controls (nctrls) * + this control + extra NULL */ - tctrls = ch_realloc( op->o_ctrls, - (nctrls+2) * sizeof(LDAPControl *)); + tctrls = op->o_tmprealloc( op->o_ctrls, + (nctrls+2) * sizeof(LDAPControl *), op->o_tmpmemctx ); #if 0 if( tctrls == NULL ) { @@ -212,8 +514,8 @@ int get_ctrls( ldap_controls_free(op->o_ctrls); op->o_ctrls = NULL; - rc = LDAP_NO_MEMORY; - errmsg = "no memory"; + rs->sr_err = LDAP_NO_MEMORY; + rs->sr_text = "no memory"; goto return_results; } #endif @@ -222,20 +524,28 @@ int get_ctrls( op->o_ctrls[nctrls++] = c; op->o_ctrls[nctrls] = NULL; - tag = ber_scanf( ber, "{a" /*}*/, &c->ldctl_oid ); + tag = ber_scanf( ber, "{m" /*}*/, &bv ); + c->ldctl_oid = bv.bv_val; if( tag == LBER_ERROR ) { -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, INFO, "get_ctrls: conn %lu get OID failed.\n", - conn->c_connid, 0, 0 ); -#else Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: get oid failed.\n", 0, 0, 0 ); -#endif - ldap_controls_free( op->o_ctrls ); + + slap_free_ctrls( op, op->o_ctrls ); op->o_ctrls = NULL; - rc = SLAPD_DISCONNECT; - errmsg = "decoding controls error"; + rs->sr_err = SLAPD_DISCONNECT; + rs->sr_text = "decoding controls error"; + goto return_results; + + } else if( c->ldctl_oid == NULL ) { + Debug( LDAP_DEBUG_TRACE, + "get_ctrls: conn %lu got emtpy OID.\n", + op->o_connid, 0, 0 ); + + slap_free_ctrls( op, op->o_ctrls ); + op->o_ctrls = NULL; + rs->sr_err = LDAP_PROTOCOL_ERROR; + rs->sr_text = "OID field is empty"; goto return_results; } @@ -246,18 +556,12 @@ int get_ctrls( tag = ber_scanf( ber, "b", &crit ); if( tag == LBER_ERROR ) { -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, INFO, - "get_ctrls: conn %lu get crit failed.\n", - conn->c_connid, 0, 0 ); -#else Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: get crit failed.\n", 0, 0, 0 ); -#endif - ldap_controls_free( op->o_ctrls ); + slap_free_ctrls( op, op->o_ctrls ); op->o_ctrls = NULL; - rc = SLAPD_DISCONNECT; - errmsg = "decoding controls error"; + rs->sr_err = SLAPD_DISCONNECT; + rs->sr_text = "decoding controls error"; goto return_results; } @@ -266,40 +570,24 @@ int get_ctrls( } if( tag == LBER_OCTETSTRING ) { - tag = ber_scanf( ber, "o", &c->ldctl_value ); + tag = ber_scanf( ber, "m", &c->ldctl_value ); if( tag == LBER_ERROR ) { -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, INFO, "get_ctrls: conn %lu: " - "%s (%scritical): get value failed.\n", - conn->c_connid, c->ldctl_oid ? c->ldctl_oid : "(NULL)", - c->ldctl_iscritical ? "" : "non" ); -#else Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: conn %lu: " "%s (%scritical): get value failed.\n", - conn->c_connid, - c->ldctl_oid ? c->ldctl_oid : "(NULL)", + op->o_connid, c->ldctl_oid, c->ldctl_iscritical ? "" : "non" ); -#endif - ldap_controls_free( op->o_ctrls ); + slap_free_ctrls( op, op->o_ctrls ); op->o_ctrls = NULL; - rc = SLAPD_DISCONNECT; - errmsg = "decoding controls error"; + rs->sr_err = SLAPD_DISCONNECT; + rs->sr_text = "decoding controls error"; goto return_results; } } -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, INFO, - "get_ctrls: conn %lu oid=\"%s\" (%scritical)\n", - conn->c_connid, c->ldctl_oid ? c->ldctl_oid : "(NULL)", - c->ldctl_iscritical ? "" : "non" ); -#else - Debug( LDAP_DEBUG_TRACE, "=> get_ctrls: oid=\"%s\" (%scritical)\n", - c->ldctl_oid ? c->ldctl_oid : "(NULL)", - c->ldctl_iscritical ? "" : "non", - 0 ); -#endif + Debug( LDAP_DEBUG_TRACE, + "=> get_ctrls: oid=\"%s\" (%scritical)\n", + c->ldctl_oid, c->ldctl_iscritical ? "" : "non", 0 ); sc = find_ctrl( c->ldctl_oid ); if( sc != NULL ) { @@ -335,12 +623,12 @@ int get_ctrls( break; case LDAP_REQ_EXTENDED: tagmask=~0L; - assert( op->o_extendedop != NULL ); + assert( op->ore_reqoid.bv_val != NULL ); if( sc->sc_extendedops != NULL ) { int i; for( i=0; sc->sc_extendedops[i] != NULL; i++ ) { - if( strcmp( op->o_extendedop, sc->sc_extendedops[i] ) - == 0 ) + if( strcmp( op->ore_reqoid.bv_val, + sc->sc_extendedops[i] ) == 0 ) { tagmask=0L; break; @@ -349,231 +637,255 @@ int get_ctrls( } break; default: - rc = LDAP_OTHER; - errmsg = "controls internal error"; + rs->sr_err = LDAP_OTHER; + rs->sr_text = "controls internal error"; goto return_results; } if (( sc->sc_mask & tagmask ) == tagmask ) { /* available extension */ + int rc; if( !sc->sc_parse ) { - rc = LDAP_OTHER; - errmsg = "not yet implemented"; + rs->sr_err = LDAP_OTHER; + rs->sr_text = "not yet implemented"; goto return_results; } - rc = sc->sc_parse( conn, op, c, &errmsg ); - - if( rc != LDAP_SUCCESS ) goto return_results; - - if ( sc->sc_mask & SLAP_CTRL_FRONTEND ) { - /* kludge to disable backend_control() check */ - c->ldctl_iscritical = 0; - - } else if ( tagmask == SLAP_CTRL_SEARCH && - sc->sc_mask & SLAP_CTRL_FRONTEND_SEARCH ) - { - /* kludge to disable backend_control() check */ - c->ldctl_iscritical = 0; + rc = sc->sc_parse( op, rs, c ); + if ( rc ) { + assert( rc != LDAP_UNAVAILABLE_CRITICAL_EXTENSION ); + rs->sr_err = rc; + goto return_results; } } else if( c->ldctl_iscritical ) { /* unavailable CRITICAL control */ - rc = LDAP_UNAVAILABLE_CRITICAL_EXTENSION; - errmsg = "critical extension is unavailable"; + rs->sr_err = LDAP_UNAVAILABLE_CRITICAL_EXTENSION; + rs->sr_text = "critical extension is unavailable"; goto return_results; } } else if( c->ldctl_iscritical ) { /* unrecognized CRITICAL control */ - rc = LDAP_UNAVAILABLE_CRITICAL_EXTENSION; - errmsg = "critical extension is not recognized"; + rs->sr_err = LDAP_UNAVAILABLE_CRITICAL_EXTENSION; + rs->sr_text = "critical extension is not recognized"; goto return_results; } +next_ctrl:; } return_results: -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, RESULTS, - "get_ctrls: n=%d rc=%d err=\"%s\"\n", - nctrls, rc, errmsg ? errmsg : "" ); -#else Debug( LDAP_DEBUG_TRACE, "<= get_ctrls: n=%d rc=%d err=\"%s\"\n", - nctrls, rc, errmsg ? errmsg : ""); -#endif + nctrls, rs->sr_err, rs->sr_text ? rs->sr_text : ""); - if( sendres && rc != LDAP_SUCCESS ) { - if( rc == SLAPD_DISCONNECT ) { - send_ldap_disconnect( conn, op, LDAP_PROTOCOL_ERROR, errmsg ); + if( sendres && rs->sr_err != LDAP_SUCCESS ) { + if( rs->sr_err == SLAPD_DISCONNECT ) { + rs->sr_err = LDAP_PROTOCOL_ERROR; + send_ldap_disconnect( op, rs ); + rs->sr_err = SLAPD_DISCONNECT; } else { - send_ldap_result( conn, op, rc, - NULL, errmsg, NULL, NULL ); + send_ldap_result( op, rs ); } } - return rc; + return rs->sr_err; +} + +static int parseModifyIncrement ( + Operation *op, + SlapReply *rs, + LDAPControl *ctrl ) +{ +#if 0 + if ( op->o_modifyIncrement != SLAP_CONTROL_NONE ) { + rs->sr_text = "modifyIncrement control specified multiple times"; + return LDAP_PROTOCOL_ERROR; + } +#endif + + if ( ctrl->ldctl_value.bv_len ) { + rs->sr_text = "modifyIncrement control value not empty"; + return LDAP_PROTOCOL_ERROR; + } + +#if 0 + op->o_modifyIncrement = ctrl->ldctl_iscritical + ? SLAP_CONTROL_CRITICAL + : SLAP_CONTROL_NONCRITICAL; +#endif + + return LDAP_SUCCESS; +} + +#ifdef LDAP_DEVEL +static int parseManageDIT ( + Operation *op, + SlapReply *rs, + LDAPControl *ctrl ) +{ + if ( op->o_managedit != SLAP_CONTROL_NONE ) { + rs->sr_text = "manageDIT control specified multiple times"; + return LDAP_PROTOCOL_ERROR; + } + + if ( ctrl->ldctl_value.bv_len ) { + rs->sr_text = "manageDIT control value not empty"; + return LDAP_PROTOCOL_ERROR; + } + + op->o_managedit = ctrl->ldctl_iscritical + ? SLAP_CONTROL_CRITICAL + : SLAP_CONTROL_NONCRITICAL; + + return LDAP_SUCCESS; } +#endif static int parseManageDSAit ( - Connection *conn, Operation *op, - LDAPControl *ctrl, - const char **text ) + SlapReply *rs, + LDAPControl *ctrl ) { - if ( op->o_managedsait != SLAP_NO_CONTROL ) { - *text = "manageDSAit control specified multiple times"; + if ( op->o_managedsait != SLAP_CONTROL_NONE ) { + rs->sr_text = "manageDSAit control specified multiple times"; return LDAP_PROTOCOL_ERROR; } if ( ctrl->ldctl_value.bv_len ) { - *text = "manageDSAit control value not empty"; + rs->sr_text = "manageDSAit control value not empty"; return LDAP_PROTOCOL_ERROR; } op->o_managedsait = ctrl->ldctl_iscritical - ? SLAP_CRITICAL_CONTROL - : SLAP_NONCRITICAL_CONTROL; + ? SLAP_CONTROL_CRITICAL + : SLAP_CONTROL_NONCRITICAL; return LDAP_SUCCESS; } static int parseProxyAuthz ( - Connection *conn, Operation *op, - LDAPControl *ctrl, - const char **text ) + SlapReply *rs, + LDAPControl *ctrl ) { - int rc; - struct berval dn; + int rc; + struct berval dn = BER_BVNULL; - if ( op->o_proxy_authz != SLAP_NO_CONTROL ) { - *text = "proxy authorization control specified multiple times"; + if ( op->o_proxy_authz != SLAP_CONTROL_NONE ) { + rs->sr_text = "proxy authorization control specified multiple times"; return LDAP_PROTOCOL_ERROR; } op->o_proxy_authz = ctrl->ldctl_iscritical - ? SLAP_CRITICAL_CONTROL - : SLAP_NONCRITICAL_CONTROL; + ? SLAP_CONTROL_CRITICAL + : SLAP_CONTROL_NONCRITICAL; -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, ARGS, - "parseProxyAuthz: conn %d authzid=\"%s\"\n", - conn->c_connid, - ctrl->ldctl_value.bv_len ? ctrl->ldctl_value.bv_val : "anonymous", - 0 ); -#else Debug( LDAP_DEBUG_ARGS, - "parseProxyAuthz: conn %d authzid=\"%s\"\n", - conn->c_connid, + "parseProxyAuthz: conn %lu authzid=\"%s\"\n", + op->o_connid, ctrl->ldctl_value.bv_len ? ctrl->ldctl_value.bv_val : "anonymous", 0 ); -#endif - if( ctrl->ldctl_value.bv_len == 0 ) { -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, RESULTS, - "parseProxyAuthz: conn=%d anonymous\n", - conn->c_connid, 0, 0 ); -#else + if ( ctrl->ldctl_value.bv_len == 0 ) { Debug( LDAP_DEBUG_TRACE, - "parseProxyAuthz: conn=%d anonymous\n", - conn->c_connid, 0, 0 ); -#endif + "parseProxyAuthz: conn=%lu anonymous\n", + op->o_connid, 0, 0 ); /* anonymous */ - free( op->o_dn.bv_val ); - op->o_dn.bv_len = 0; - op->o_dn.bv_val = ch_strdup( "" ); - - free( op->o_ndn.bv_val ); + op->o_ndn.bv_val[ 0 ] = '\0'; op->o_ndn.bv_len = 0; - op->o_ndn.bv_val = ch_strdup( "" ); + + op->o_dn.bv_val[ 0 ] = '\0'; + op->o_dn.bv_len = 0; return LDAP_SUCCESS; } - rc = slap_sasl_getdn( conn, - ctrl->ldctl_value.bv_val, ctrl->ldctl_value.bv_len, - NULL, &dn, SLAP_GETDN_AUTHZID ); + rc = slap_sasl_getdn( op->o_conn, op, &ctrl->ldctl_value, + NULL, &dn, SLAP_GETDN_AUTHZID ); - if( rc != LDAP_SUCCESS || !dn.bv_len ) { - *text = "authzId mapping failed"; + /* FIXME: empty DN in proxyAuthz control should be legal... */ + if( rc != LDAP_SUCCESS /* || !dn.bv_len */ ) { + if ( dn.bv_val ) { + ch_free( dn.bv_val ); + } + rs->sr_text = "authzId mapping failed"; return LDAP_PROXY_AUTHZ_FAILURE; } -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, RESULTS, - "parseProxyAuthz: conn=%d \"%s\"\n", - conn->c_connid, - dn.bv_len ? dn.bv_val : "(NULL)", 0 ); -#else Debug( LDAP_DEBUG_TRACE, - "parseProxyAuthz: conn=%d \"%s\"\n", - conn->c_connid, + "parseProxyAuthz: conn=%lu \"%s\"\n", + op->o_connid, dn.bv_len ? dn.bv_val : "(NULL)", 0 ); -#endif - rc = slap_sasl_authorized( conn, &op->o_ndn, &dn ); + rc = slap_sasl_authorized( op, &op->o_ndn, &dn ); - if( rc ) { + if ( rc ) { ch_free( dn.bv_val ); - *text = "not authorized to assume identity"; + rs->sr_text = "not authorized to assume identity"; return LDAP_PROXY_AUTHZ_FAILURE; } - ch_free( op->o_dn.bv_val ); ch_free( op->o_ndn.bv_val ); + ch_free( op->o_dn.bv_val ); - op->o_dn.bv_val = NULL; + /* + * NOTE: since slap_sasl_getdn() returns a normalized dn, + * from now on op->o_dn is normalized + */ op->o_ndn = dn; ber_dupbv( &op->o_dn, &dn ); + + Statslog( LDAP_DEBUG_STATS, "%s PROXYAUTHZ dn=\"%s\"\n", + op->o_log_prefix, dn.bv_val, 0, 0, 0 ); + return LDAP_SUCCESS; } static int parseNoOp ( - Connection *conn, Operation *op, - LDAPControl *ctrl, - const char **text ) + SlapReply *rs, + LDAPControl *ctrl ) { - if ( op->o_noop != SLAP_NO_CONTROL ) { - *text = "noop control specified multiple times"; + if ( op->o_noop != SLAP_CONTROL_NONE ) { + rs->sr_text = "noop control specified multiple times"; return LDAP_PROTOCOL_ERROR; } if ( ctrl->ldctl_value.bv_len ) { - *text = "noop control value not empty"; + rs->sr_text = "noop control value not empty"; return LDAP_PROTOCOL_ERROR; } op->o_noop = ctrl->ldctl_iscritical - ? SLAP_CRITICAL_CONTROL - : SLAP_NONCRITICAL_CONTROL; + ? SLAP_CONTROL_CRITICAL + : SLAP_CONTROL_NONCRITICAL; return LDAP_SUCCESS; } static int parsePagedResults ( - Connection *conn, Operation *op, - LDAPControl *ctrl, - const char **text ) + SlapReply *rs, + LDAPControl *ctrl ) { - ber_tag_t tag; - ber_int_t size; - BerElement *ber; - struct berval cookie = { 0, NULL }; + int rc = LDAP_SUCCESS; + ber_tag_t tag; + ber_int_t size; + BerElement *ber; + struct berval cookie = BER_BVNULL; + PagedResultsState *ps; - if ( op->o_pagedresults != SLAP_NO_CONTROL ) { - *text = "paged results control specified multiple times"; + if ( op->o_pagedresults != SLAP_CONTROL_NONE ) { + rs->sr_text = "paged results control specified multiple times"; return LDAP_PROTOCOL_ERROR; } - if ( ctrl->ldctl_value.bv_len == 0 ) { - *text = "paged results control value is empty (or absent)"; + if ( BER_BVISEMPTY( &ctrl->ldctl_value ) ) { + rs->sr_text = "paged results control value is empty (or absent)"; return LDAP_PROTOCOL_ERROR; } @@ -583,272 +895,510 @@ static int parsePagedResults ( * -- requested page size from client * -- result set size estimate from server * cookie OCTET STRING + * } */ ber = ber_init( &ctrl->ldctl_value ); - if( ber == NULL ) { - *text = "internal error"; + if ( ber == NULL ) { + rs->sr_text = "internal error"; return LDAP_OTHER; } tag = ber_scanf( ber, "{im}", &size, &cookie ); - (void) ber_free( ber, 1 ); - if( tag == LBER_ERROR ) { - *text = "paged results control could not be decoded"; - return LDAP_PROTOCOL_ERROR; + if ( tag == LBER_ERROR ) { + rs->sr_text = "paged results control could not be decoded"; + rc = LDAP_PROTOCOL_ERROR; + goto done; } - if( size < 0 ) { - *text = "paged results control size invalid"; - return LDAP_PROTOCOL_ERROR; + if ( size < 0 ) { + rs->sr_text = "paged results control size invalid"; + rc = LDAP_PROTOCOL_ERROR; + goto done; } - if( cookie.bv_len ) { +#if 0 + /* defer cookie decoding/checks to backend... */ + if ( cookie.bv_len ) { PagedResultsCookie reqcookie; if( cookie.bv_len != sizeof( reqcookie ) ) { /* bad cookie */ - *text = "paged results cookie is invalid"; - return LDAP_PROTOCOL_ERROR; + rs->sr_text = "paged results cookie is invalid"; + rc = LDAP_PROTOCOL_ERROR; + goto done; } AC_MEMCPY( &reqcookie, cookie.bv_val, sizeof( reqcookie )); - if( reqcookie > op->o_pagedresults_state.ps_cookie ) { + if ( reqcookie > op->o_pagedresults_state.ps_cookie ) { /* bad cookie */ - *text = "paged results cookie is invalid"; - return LDAP_PROTOCOL_ERROR; - - } else if( reqcookie < op->o_pagedresults_state.ps_cookie ) { - *text = "paged results cookie is invalid or old"; - return LDAP_UNWILLING_TO_PERFORM; + rs->sr_text = "paged results cookie is invalid"; + rc = LDAP_PROTOCOL_ERROR; + goto done; + + } else if ( reqcookie < op->o_pagedresults_state.ps_cookie ) { + rs->sr_text = "paged results cookie is invalid or old"; + rc = LDAP_UNWILLING_TO_PERFORM; + goto done; } + } else { /* Initial request. Initialize state. */ +#if 0 + if ( op->o_conn->c_pagedresults_state.ps_cookie != 0 ) { + /* There's another pagedResults control on the + * same connection; reject new pagedResults controls + * (allowed by RFC2696) */ + rs->sr_text = "paged results cookie unavailable; try later"; + rc = LDAP_UNWILLING_TO_PERFORM; + goto done; + } +#endif op->o_pagedresults_state.ps_cookie = 0; - op->o_pagedresults_state.ps_id = NOID; + op->o_pagedresults_state.ps_count = 0; + } +#endif + + ps = op->o_tmpalloc( sizeof(PagedResultsState), op->o_tmpmemctx ); + *ps = op->o_conn->c_pagedresults_state; + ps->ps_size = size; + op->o_pagedresults_state = ps; + + /* NOTE: according to RFC 2696 3.: + + If the page size is greater than or equal to the sizeLimit value, the + server should ignore the control as the request can be satisfied in a + single page. + + * NOTE: this assumes that the op->ors_slimit be set + * before the controls are parsed. + */ + + if ( op->ors_slimit > 0 && size >= op->ors_slimit ) { + op->o_pagedresults = SLAP_CONTROL_IGNORED; + + } else if ( ctrl->ldctl_iscritical ) { + op->o_pagedresults = SLAP_CONTROL_CRITICAL; + + } else { + op->o_pagedresults = SLAP_CONTROL_NONCRITICAL; + } + +done:; + (void)ber_free( ber, 1 ); + return rc; +} + +#ifdef LDAP_DEVEL +static int parseSortedResults ( + Operation *op, + SlapReply *rs, + LDAPControl *ctrl ) +{ + int rc = LDAP_SUCCESS; + + if ( op->o_sortedresults != SLAP_CONTROL_NONE ) { + rs->sr_text = "sorted results control specified multiple times"; + return LDAP_PROTOCOL_ERROR; + } + + if ( BER_BVISEMPTY( &ctrl->ldctl_value ) ) { + rs->sr_text = "sorted results control value is empty (or absent)"; + return LDAP_PROTOCOL_ERROR; + } + + /* blow off parsing the value */ + + op->o_sortedresults = ctrl->ldctl_iscritical + ? SLAP_CONTROL_CRITICAL + : SLAP_CONTROL_NONCRITICAL; + + return rc; +} +#endif + +static int parseAssert ( + Operation *op, + SlapReply *rs, + LDAPControl *ctrl ) +{ + BerElement *ber; + struct berval fstr = BER_BVNULL; + const char *err_msg = ""; + + if ( op->o_assert != SLAP_CONTROL_NONE ) { + rs->sr_text = "assert control specified multiple times"; + return LDAP_PROTOCOL_ERROR; + } + + if ( ctrl->ldctl_value.bv_len == 0 ) { + rs->sr_text = "assert control value is empty (or absent)"; + return LDAP_PROTOCOL_ERROR; + } + + ber = ber_init( &(ctrl->ldctl_value) ); + if (ber == NULL) { + rs->sr_text = "assert control: internal error"; + return LDAP_OTHER; + } + + rs->sr_err = get_filter( op, ber, (Filter **)&(op->o_assertion), &rs->sr_text); + + if( rs->sr_err != LDAP_SUCCESS ) { + if( rs->sr_err == SLAPD_DISCONNECT ) { + rs->sr_err = LDAP_PROTOCOL_ERROR; + send_ldap_disconnect( op, rs ); + rs->sr_err = SLAPD_DISCONNECT; + } else { + send_ldap_result( op, rs ); + } + if( op->o_assertion != NULL ) { + filter_free_x( op, op->o_assertion ); + } + return rs->sr_err; + } + +#ifdef LDAP_DEBUG + filter2bv_x( op, op->o_assertion, &fstr ); + + Debug( LDAP_DEBUG_ARGS, "parseAssert: conn %ld assert: %s\n", + op->o_connid, fstr.bv_len ? fstr.bv_val : "empty" , 0 ); + op->o_tmpfree( fstr.bv_val, op->o_tmpmemctx ); +#endif + + op->o_assert = ctrl->ldctl_iscritical + ? SLAP_CONTROL_CRITICAL + : SLAP_CONTROL_NONCRITICAL; + + rs->sr_err = LDAP_SUCCESS; + return LDAP_SUCCESS; +} + +static int parsePreRead ( + Operation *op, + SlapReply *rs, + LDAPControl *ctrl ) +{ + ber_len_t siz, off, i; + AttributeName *an = NULL; + BerElement *ber; + + if ( op->o_preread != SLAP_CONTROL_NONE ) { + rs->sr_text = "preread control specified multiple times"; + return LDAP_PROTOCOL_ERROR; + } + + if ( ctrl->ldctl_value.bv_len == 0 ) { + rs->sr_text = "preread control value is empty (or absent)"; + return LDAP_PROTOCOL_ERROR; } - op->o_pagedresults_size = size; + ber = ber_init( &(ctrl->ldctl_value) ); + if (ber == NULL) { + rs->sr_text = "preread control: internal error"; + return LDAP_OTHER; + } + + siz = sizeof( AttributeName ); + off = offsetof( AttributeName, an_name ); + if ( ber_scanf( ber, "{M}", &an, &siz, off ) == LBER_ERROR ) { + rs->sr_text = "preread control: decoding error"; + return LDAP_PROTOCOL_ERROR; + } + + for( i=0; ildctl_iscritical ) { + rs->sr_text = dummy + ? dummy + : "postread control: unknown attributeType"; + return rc; + } + } + + op->o_preread = ctrl->ldctl_iscritical + ? SLAP_CONTROL_CRITICAL + : SLAP_CONTROL_NONCRITICAL; + + op->o_preread_attrs = an; + + rs->sr_err = LDAP_SUCCESS; + return LDAP_SUCCESS; +} + +static int parsePostRead ( + Operation *op, + SlapReply *rs, + LDAPControl *ctrl ) +{ + ber_len_t siz, off, i; + AttributeName *an = NULL; + BerElement *ber; + + if ( op->o_postread != SLAP_CONTROL_NONE ) { + rs->sr_text = "postread control specified multiple times"; + return LDAP_PROTOCOL_ERROR; + } + + if ( ctrl->ldctl_value.bv_len == 0 ) { + rs->sr_text = "postread control value is empty (or absent)"; + return LDAP_PROTOCOL_ERROR; + } - op->o_pagedresults = ctrl->ldctl_iscritical - ? SLAP_CRITICAL_CONTROL - : SLAP_NONCRITICAL_CONTROL; + ber = ber_init( &(ctrl->ldctl_value) ); + if (ber == NULL) { + rs->sr_text = "postread control: internal error"; + return LDAP_OTHER; + } + + siz = sizeof( AttributeName ); + off = offsetof( AttributeName, an_name ); + if ( ber_scanf( ber, "{M}", &an, &siz, off ) == LBER_ERROR ) { + rs->sr_text = "postread control: decoding error"; + return LDAP_PROTOCOL_ERROR; + } + for( i=0; ildctl_iscritical ) { + rs->sr_text = dummy + ? dummy + : "postread control: unknown attributeType"; + return rc; + } + } + + op->o_postread = ctrl->ldctl_iscritical + ? SLAP_CONTROL_CRITICAL + : SLAP_CONTROL_NONCRITICAL; + + op->o_postread_attrs = an; + + rs->sr_err = LDAP_SUCCESS; return LDAP_SUCCESS; } int parseValuesReturnFilter ( - Connection *conn, Operation *op, - LDAPControl *ctrl, - const char **text ) + SlapReply *rs, + LDAPControl *ctrl ) { - int rc; BerElement *ber; - struct berval fstr = { 0, NULL }; + struct berval fstr = BER_BVNULL; const char *err_msg = ""; - if ( op->o_valuesreturnfilter != SLAP_NO_CONTROL ) { - *text = "valuesReturnFilter control specified multiple times"; + if ( op->o_valuesreturnfilter != SLAP_CONTROL_NONE ) { + rs->sr_text = "valuesReturnFilter control specified multiple times"; return LDAP_PROTOCOL_ERROR; } if ( ctrl->ldctl_value.bv_len == 0 ) { - *text = "valuesReturnFilter control value is empty (or absent)"; + rs->sr_text = "valuesReturnFilter control value is empty (or absent)"; return LDAP_PROTOCOL_ERROR; } ber = ber_init( &(ctrl->ldctl_value) ); if (ber == NULL) { - *text = "internal error"; + rs->sr_text = "internal error"; return LDAP_OTHER; } - rc = get_vrFilter( conn, ber, &(op->vrFilter), &err_msg); + rs->sr_err = get_vrFilter( op, ber, (ValuesReturnFilter **)&(op->o_vrFilter), &rs->sr_text); - if( rc != LDAP_SUCCESS ) { - text = &err_msg; - if( rc == SLAPD_DISCONNECT ) { - send_ldap_disconnect( conn, op, - LDAP_PROTOCOL_ERROR, *text ); + if( rs->sr_err != LDAP_SUCCESS ) { + if( rs->sr_err == SLAPD_DISCONNECT ) { + rs->sr_err = LDAP_PROTOCOL_ERROR; + send_ldap_disconnect( op, rs ); + rs->sr_err = SLAPD_DISCONNECT; } else { - send_ldap_result( conn, op, rc, - NULL, *text, NULL, NULL ); + send_ldap_result( op, rs ); } - if( fstr.bv_val != NULL) free( fstr.bv_val ); - if( op->vrFilter != NULL) vrFilter_free( op->vrFilter ); - - } else { - vrFilter2bv( op->vrFilter, &fstr ); + if( op->o_vrFilter != NULL) vrFilter_free( op, op->o_vrFilter ); + } +#ifdef LDAP_DEBUG + else { + vrFilter2bv( op, op->o_vrFilter, &fstr ); } -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, ARGS, - "parseValuesReturnFilter: conn %d vrFilter: %s\n", - conn->c_connid, fstr.bv_len ? fstr.bv_val : "empty" , 0 ); -#else Debug( LDAP_DEBUG_ARGS, " vrFilter: %s\n", fstr.bv_len ? fstr.bv_val : "empty", 0, 0 ); + op->o_tmpfree( fstr.bv_val, op->o_tmpmemctx ); #endif op->o_valuesreturnfilter = ctrl->ldctl_iscritical - ? SLAP_CRITICAL_CONTROL - : SLAP_NONCRITICAL_CONTROL; + ? SLAP_CONTROL_CRITICAL + : SLAP_CONTROL_NONCRITICAL; + rs->sr_err = LDAP_SUCCESS; return LDAP_SUCCESS; } #ifdef LDAP_CONTROL_SUBENTRIES static int parseSubentries ( - Connection *conn, Operation *op, - LDAPControl *ctrl, - const char **text ) + SlapReply *rs, + LDAPControl *ctrl ) { - if ( op->o_subentries != SLAP_NO_CONTROL ) { - *text = "subentries control specified multiple times"; + if ( op->o_subentries != SLAP_CONTROL_NONE ) { + rs->sr_text = "subentries control specified multiple times"; return LDAP_PROTOCOL_ERROR; } /* FIXME: should use BER library */ if( ( ctrl->ldctl_value.bv_len != 3 ) - && ( ctrl->ldctl_value.bv_val[0] != 0x01 ) - && ( ctrl->ldctl_value.bv_val[1] != 0x01 )) + || ( ctrl->ldctl_value.bv_val[0] != 0x01 ) + || ( ctrl->ldctl_value.bv_val[1] != 0x01 )) { - *text = "subentries control value encoding is bogus"; + rs->sr_text = "subentries control value encoding is bogus"; return LDAP_PROTOCOL_ERROR; } op->o_subentries = ctrl->ldctl_iscritical - ? SLAP_CRITICAL_CONTROL - : SLAP_NONCRITICAL_CONTROL; + ? SLAP_CONTROL_CRITICAL + : SLAP_CONTROL_NONCRITICAL; - op->o_subentries_visibility = (ctrl->ldctl_value.bv_val[2] != 0x00); + if (ctrl->ldctl_value.bv_val[2]) { + set_subentries_visibility( op ); + } return LDAP_SUCCESS; } #endif -#ifdef LDAP_CLIENT_UPDATE -static int parseClientUpdate ( - Connection *conn, +#ifdef LDAP_CONTROL_X_PERMISSIVE_MODIFY +static int parsePermissiveModify ( Operation *op, - LDAPControl *ctrl, - const char **text ) + SlapReply *rs, + LDAPControl *ctrl ) { - ber_tag_t tag; - BerElement *ber; - ber_int_t type; - ber_int_t interval; - ber_len_t len; - struct berval scheme = { 0, NULL }; - struct berval cookie = { 0, NULL }; - - if ( op->o_clientupdate != SLAP_NO_CONTROL ) { - *text = "LCUP client update control specified multiple times"; + if ( op->o_permissive_modify != SLAP_CONTROL_NONE ) { + rs->sr_text = "permissiveModify control specified multiple times"; return LDAP_PROTOCOL_ERROR; } - if ( ctrl->ldctl_value.bv_len == 0 ) { - *text = "LCUP client update control value is empty (or absent)"; + if ( ctrl->ldctl_value.bv_len ) { + rs->sr_text = "permissiveModify control value not empty"; return LDAP_PROTOCOL_ERROR; } - /* Parse the control value - * ClientUpdateControlValue ::= SEQUENCE { - * updateType ENUMERATED { - * synchronizeOnly {0}, - * synchronizeAndPersist {1}, - * persistOnly {2} }, - * sendCookieInterval INTEGER OPTIONAL, - * cookie LCUPCookie OPTIONAL - * } - */ + op->o_permissive_modify = ctrl->ldctl_iscritical + ? SLAP_CONTROL_CRITICAL + : SLAP_CONTROL_NONCRITICAL; - ber = ber_init( &ctrl->ldctl_value ); - if( ber == NULL ) { - *text = "internal error"; - return LDAP_OTHER; - } + return LDAP_SUCCESS; +} +#endif - if ( (tag = ber_scanf( ber, "{i" /*}*/, &type )) == LBER_ERROR ) { - *text = "LCUP client update control : decoding error"; +#ifdef LDAP_CONTROL_X_DOMAIN_SCOPE +static int parseDomainScope ( + Operation *op, + SlapReply *rs, + LDAPControl *ctrl ) +{ + if ( op->o_domain_scope != SLAP_CONTROL_NONE ) { + rs->sr_text = "domainScope control specified multiple times"; return LDAP_PROTOCOL_ERROR; } - switch( type ) { - case LDAP_CUP_SYNC_ONLY: - type = SLAP_LCUP_SYNC; - break; - case LDAP_CUP_SYNC_AND_PERSIST: - type = SLAP_LCUP_SYNC_AND_PERSIST; - break; - case LDAP_CUP_PERSIST_ONLY: - type = SLAP_LCUP_PERSIST; - break; - default: - *text = "LCUP client update control : unknown update type"; + if ( ctrl->ldctl_value.bv_len ) { + rs->sr_text = "domainScope control value not empty"; return LDAP_PROTOCOL_ERROR; } - if ( (tag = ber_peek_tag( ber, &len )) == LBER_DEFAULT ) { - *text = "LCUP client update control : decoding error"; - return LDAP_PROTOCOL_ERROR; - } + op->o_domain_scope = ctrl->ldctl_iscritical + ? SLAP_CONTROL_CRITICAL + : SLAP_CONTROL_NONCRITICAL; - if ( tag == LDAP_TAG_INTERVAL ) { - if ( (tag = ber_scanf( ber, "i", &interval )) == LBER_ERROR ) { - *text = "LCUP client update control : decoding error"; - return LDAP_PROTOCOL_ERROR; - } - - if ( interval <= 0 ) { - /* server chooses interval */ - interval = LDAP_CUP_DEFAULT_SEND_COOKIE_INTERVAL; - } + return LDAP_SUCCESS; +} +#endif - } else { - /* server chooses interval */ - interval = LDAP_CUP_DEFAULT_SEND_COOKIE_INTERVAL; +#ifdef LDAP_CONTROL_X_TREE_DELETE +static int parseTreeDelete ( + Operation *op, + SlapReply *rs, + LDAPControl *ctrl ) +{ + if ( op->o_tree_delete != SLAP_CONTROL_NONE ) { + rs->sr_text = "treeDelete control specified multiple times"; + return LDAP_PROTOCOL_ERROR; } - if ( (tag = ber_peek_tag( ber, &len )) == LBER_DEFAULT ) { - *text = "LCUP client update control : decoding error"; + if ( ctrl->ldctl_value.bv_len ) { + rs->sr_text = "treeDelete control value not empty"; return LDAP_PROTOCOL_ERROR; } - if ( tag == LDAP_TAG_COOKIE ) { - if ( (tag = ber_scanf( ber, /*{*/ "{mm}}", - &scheme, &cookie )) == LBER_ERROR ) { - *text = "LCUP client update control : decoding error"; - return LDAP_PROTOCOL_ERROR; - } - } + op->o_tree_delete = ctrl->ldctl_iscritical + ? SLAP_CONTROL_CRITICAL + : SLAP_CONTROL_NONCRITICAL; - /* TODO : Cookie Scheme Validation */ -#if 0 - if ( lcup_cookie_scheme_validate(scheme) != LDAP_SUCCESS ) { - *text = "Unsupported LCUP cookie scheme"; - return LCUP_UNSUPPORTED_SCHEME; + return LDAP_SUCCESS; +} +#endif + +#ifdef LDAP_CONTROL_X_SEARCH_OPTIONS +static int parseSearchOptions ( + Operation *op, + SlapReply *rs, + LDAPControl *ctrl ) +{ + BerElement *ber; + ber_int_t search_flags; + ber_tag_t tag; + + if ( ctrl->ldctl_value.bv_len == 0 ) { + rs->sr_text = "searchOptions control value not empty"; + return LDAP_PROTOCOL_ERROR; } - if ( lcup_cookie_validate(scheme, cookie) != LDAP_SUCCESS ) { - *text = "Invalid LCUP cookie"; - return LCUP_INVALID_COOKIE; + ber = ber_init( &ctrl->ldctl_value ); + if( ber == NULL ) { + rs->sr_text = "internal error"; + return LDAP_OTHER; } -#endif - ber_dupbv( &op->o_clientupdate_state, &cookie ); + if ( (tag = ber_scanf( ber, "{i}", &search_flags )) == LBER_ERROR ) { + rs->sr_text = "searchOptions control decoding error"; + return LDAP_PROTOCOL_ERROR; + } (void) ber_free( ber, 1 ); - op->o_clientupdate_type = (char) type; - op->o_clientupdate_interval = interval; + if ( search_flags & LDAP_SEARCH_FLAG_DOMAIN_SCOPE ) { + if ( op->o_domain_scope != SLAP_CONTROL_NONE ) { + rs->sr_text = "searchOptions control specified multiple times " + "or with domainScope control"; + return LDAP_PROTOCOL_ERROR; + } - op->o_clientupdate = ctrl->ldctl_iscritical - ? SLAP_CRITICAL_CONTROL - : SLAP_NONCRITICAL_CONTROL; + op->o_domain_scope = ctrl->ldctl_iscritical + ? SLAP_CONTROL_CRITICAL + : SLAP_CONTROL_NONCRITICAL; + } + + if ( search_flags & ~(LDAP_SEARCH_FLAG_DOMAIN_SCOPE) ) { + /* Other search flags not recognised so far, + * including: + * LDAP_SEARCH_FLAG_PHANTOM_ROOM + */ + rs->sr_text = "searchOptions contained unrecongized flag"; + return LDAP_UNWILLING_TO_PERFORM; + } return LDAP_SUCCESS; } -#endif /* LDAP_CLIENT_UPDATE */ +#endif +