From: Pierangelo Masarati <ando@openldap.org>
Date: Sun, 28 Jan 2007 00:24:10 +0000 (+0000)
Subject: fix more spurious return stuff; split quarantine in: detection, exploitation, recover... 
X-Git-Tag: OPENLDAP_REL_ENG_2_4_4ALPHA~8^2~114
X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=e07dc8c7576f1165a33d8e921ae7d8ea20167389;p=openldap

fix more spurious return stuff; split quarantine in: detection, exploitation, recovery; describe failure reasons
---

diff --git a/servers/slapd/back-ldap/back-ldap.h b/servers/slapd/back-ldap/back-ldap.h
index e0c6b62d41..442869861d 100644
--- a/servers/slapd/back-ldap/back-ldap.h
+++ b/servers/slapd/back-ldap/back-ldap.h
@@ -308,6 +308,8 @@ typedef struct ldapinfo_t {
 #define	LDAP_BACK_F_CANCEL_MASK		(LDAP_BACK_F_CANCEL_IGNORE|LDAP_BACK_F_CANCEL_EXOP)
 #define	LDAP_BACK_F_CANCEL_MASK2	(LDAP_BACK_F_CANCEL_MASK|LDAP_BACK_F_CANCEL_EXOP_DISCOVER)
 
+#define	LDAP_BACK_F_QUARANTINE		(0x00010000U)
+
 #define	LDAP_BACK_ISSET_F(ff,f)		( ( (ff) & (f) ) == (f) )
 #define	LDAP_BACK_ISMASK_F(ff,m,f)	( ( (ff) & (m) ) == (f) )
 
@@ -339,6 +341,8 @@ typedef struct ldapinfo_t {
 #define	LDAP_BACK_CANCEL(li)		LDAP_BACK_ISMASK( (li), LDAP_BACK_F_CANCEL_MASK, LDAP_BACK_F_CANCEL_EXOP )
 #define	LDAP_BACK_CANCEL_DISCOVER(li)	LDAP_BACK_ISMASK( (li), LDAP_BACK_F_CANCEL_MASK2, LDAP_BACK_F_CANCEL_EXOP_DISCOVER )
 
+#define	LDAP_BACK_QUARANTINE(li)	LDAP_BACK_ISSET( (li), LDAP_BACK_F_QUARANTINE )
+
 	int			li_version;
 
 	/* cached connections; 
@@ -363,7 +367,6 @@ typedef struct ldapinfo_t {
 #define	LDAP_BACK_FQ_RETRYING	(2)
 
 	slap_retry_info_t	li_quarantine;
-#define	LDAP_BACK_QUARANTINE(li)	( (li)->li_quarantine.ri_num != NULL )
 	ldap_pvt_thread_mutex_t	li_quarantine_mutex;
 	ldap_back_quarantine_f	li_quarantine_f;
 	void			*li_quarantine_p;
diff --git a/servers/slapd/back-ldap/bind.c b/servers/slapd/back-ldap/bind.c
index e500353076..2247405128 100644
--- a/servers/slapd/back-ldap/bind.c
+++ b/servers/slapd/back-ldap/bind.c
@@ -665,6 +665,7 @@ ldap_back_prepare_conn( ldapconn_t *lc, Operation *op, SlapReply *rs, ldap_back_
 	ldap_pvt_thread_mutex_unlock( &li->li_uri_mutex );
 	if ( rs->sr_err != LDAP_SUCCESS ) {
 		ldap_unbind_ext( ld, NULL, NULL );
+		rs->sr_text = "Start TLS failed";
 		goto error_return;
 
 	} else if ( li->li_idle_timeout ) {
@@ -691,10 +692,9 @@ error_return:;
 		rs->sr_err = slap_map_api2result( rs );
 		if ( sendok & LDAP_BACK_SENDERR ) {
 			if ( rs->sr_text == NULL ) {
-				rs->sr_text = "ldap_initialize() failed";
+				rs->sr_text = "Proxy connection initialization failed";
 			}
 			send_ldap_result( op, rs );
-			rs->sr_text = NULL;
 		}
 
 	} else {
@@ -747,6 +747,7 @@ ldap_back_getconn(
 		if ( dont_retry ) {
 			rs->sr_err = LDAP_UNAVAILABLE;
 			if ( op->o_conn && ( sendok & LDAP_BACK_SENDERR ) ) {
+				rs->sr_text = "Target is quarantined";
 				send_ldap_result( op, rs );
 			}
 			return NULL;
@@ -1040,10 +1041,9 @@ retry_lock:
 				LDAP_BACK_CONN_CACHED_CLEAR( lc );
 				ldap_back_conn_free( lc );
 				rs->sr_err = LDAP_OTHER;
-				rs->sr_text = "proxy bind collision";
+				rs->sr_text = "Proxy bind collision";
 				if ( op->o_conn && ( sendok & LDAP_BACK_SENDERR ) ) {
 					send_ldap_result( op, rs );
-					rs->sr_text = NULL;
 				}
 				return NULL;
 			}
@@ -1371,6 +1371,7 @@ retry:;
 				/* lc here must be the regular lc, reset and ready for init */
 				rs->sr_err = ldap_back_prepare_conn( lc, op, rs, sendok );
 				if ( rs->sr_err != LDAP_SUCCESS ) {
+					sendok &= ~LDAP_BACK_SENDERR;
 					lc->lc_refcnt = 0;
 				}
 			}
@@ -1400,6 +1401,7 @@ retry:;
 		if ( rs->sr_err != LDAP_SUCCESS &&
 			( sendok & LDAP_BACK_SENDERR ) )
 		{
+			rs->sr_text = "Internal proxy bind failure";
 			send_ldap_result( op, rs );
 		}
 
@@ -1407,7 +1409,7 @@ retry:;
 	}
 
 	rc = ldap_back_op_result( lc, op, rs, msgid,
-		-1, (sendok|LDAP_BACK_BINDING) );
+		-1, ( sendok | LDAP_BACK_BINDING ) );
 	if ( rc == LDAP_SUCCESS ) {
 		LDAP_BACK_CONN_ISBOUND_SET( lc );
 	}
@@ -1711,6 +1713,7 @@ retry:;
 				ldap_back_quarantine( op, rs );
 			}
 			if ( op->o_conn && ( sendok & LDAP_BACK_SENDERR ) ) {
+				if ( rs->sr_text == NULL ) rs->sr_text = "Proxy operation retry failed";
 				send_ldap_result( op, rs );
 			}
 		}
@@ -1756,8 +1759,7 @@ int
 ldap_back_retry( ldapconn_t **lcp, Operation *op, SlapReply *rs, ldap_back_send_t sendok )
 {
 	ldapinfo_t	*li = (ldapinfo_t *)op->o_bd->be_private;
-	int		rc = 0,
-			binding;
+	int		rc = 0;
 
 	assert( lcp != NULL );
 	assert( *lcp != NULL );
@@ -1765,7 +1767,7 @@ ldap_back_retry( ldapconn_t **lcp, Operation *op, SlapReply *rs, ldap_back_send_
 	ldap_pvt_thread_mutex_lock( &li->li_conninfo.lai_mutex );
 
 	if ( (*lcp)->lc_refcnt == 1 ) {
-		binding = LDAP_BACK_CONN_BINDING( *lcp );
+		int binding = LDAP_BACK_CONN_BINDING( *lcp );
 
 		ldap_pvt_thread_mutex_lock( &li->li_uri_mutex );
 		Debug( LDAP_DEBUG_ANY,
@@ -1814,9 +1816,9 @@ ldap_back_retry( ldapconn_t **lcp, Operation *op, SlapReply *rs, ldap_back_send_
 		ldap_back_release_conn_lock( li, lcp, 0 );
 		assert( *lcp == NULL );
 
-		if ( sendok ) {
+		if ( sendok & LDAP_BACK_SENDERR ) {
 			rs->sr_err = LDAP_UNAVAILABLE;
-			rs->sr_text = "unable to retry";
+			rs->sr_text = "Unable to retry";
 			send_ldap_result( op, rs );
 		}
 	}
@@ -2061,7 +2063,7 @@ ldap_back_proxy_authz_bind(
 				binddn->bv_val, LDAP_SASL_SIMPLE,
 				bindcred, NULL, NULL, &msgid );
 		rc = ldap_back_op_result( lc, op, rs, msgid,
-			-1, (sendok|LDAP_BACK_BINDING) );
+			-1, ( sendok | LDAP_BACK_BINDING ) );
 		break;
 
 	default: