From 73ca57cfefc5b7cba615979422824d485bf63f99 Mon Sep 17 00:00:00 2001 From: Pierangelo Masarati Date: Sat, 5 Feb 2005 15:55:27 +0000 Subject: [PATCH] import selected improvements from back-ldap: use asynchronous Start TLS exop; allow propagating TLS if used in the original connection; minor cleanup --- servers/slapd/back-meta/add.c | 8 +- servers/slapd/back-meta/back-meta.h | 6 +- servers/slapd/back-meta/bind.c | 6 +- servers/slapd/back-meta/compare.c | 13 +--- servers/slapd/back-meta/config.c | 45 +++++++++++ servers/slapd/back-meta/conn.c | 115 +++++++++++++++++++++++----- servers/slapd/back-meta/delete.c | 17 ++-- servers/slapd/back-meta/modify.c | 19 ++--- servers/slapd/back-meta/modrdn.c | 21 +++-- servers/slapd/back-meta/search.c | 13 +--- 10 files changed, 175 insertions(+), 88 deletions(-) diff --git a/servers/slapd/back-meta/add.c b/servers/slapd/back-meta/add.c index fe9af550d4..857ce7ec5f 100644 --- a/servers/slapd/back-meta/add.c +++ b/servers/slapd/back-meta/add.c @@ -51,14 +51,12 @@ meta_back_add( Operation *op, SlapReply *rs ) * get the current connection */ lc = meta_back_getconn( op, rs, META_OP_REQUIRE_SINGLE, - &op->o_req_ndn, &candidate ); - if ( !lc ) { - send_ldap_result( op, rs ); + &op->o_req_ndn, &candidate, LDAP_BACK_SENDERR ); + if ( !lc || !meta_back_dobind( lc, op, LDAP_BACK_SENDERR ) ) { return rs->sr_err; } - if ( !meta_back_dobind( lc, op ) - || !meta_back_is_valid( lc, candidate ) ) { + if ( !meta_back_is_valid( lc, candidate ) ) { rs->sr_err = LDAP_UNAVAILABLE; send_ldap_result( op, rs ); return rs->sr_err; diff --git a/servers/slapd/back-meta/back-meta.h b/servers/slapd/back-meta/back-meta.h index 8ec1005383..6df5a58e5c 100644 --- a/servers/slapd/back-meta/back-meta.h +++ b/servers/slapd/back-meta/back-meta.h @@ -234,13 +234,15 @@ meta_back_getconn( SlapReply *rs, int op_type, struct berval *dn, - int *candidate + int *candidate, + ldap_back_send_t sendok ); extern int meta_back_dobind( struct metaconn *lc, - Operation *op + Operation *op, + ldap_back_send_t sendok ); extern int diff --git a/servers/slapd/back-meta/bind.c b/servers/slapd/back-meta/bind.c index 01e6a8612e..69fe2ea995 100644 --- a/servers/slapd/back-meta/bind.c +++ b/servers/slapd/back-meta/bind.c @@ -63,7 +63,7 @@ meta_back_bind( Operation *op, SlapReply *rs ) op_type = META_OP_REQUIRE_ALL; } lc = meta_back_getconn( op, rs, op_type, - &op->o_req_ndn, NULL ); + &op->o_req_ndn, NULL, LDAP_BACK_SENDERR ); if ( !lc ) { Debug( LDAP_DEBUG_ANY, "meta_back_bind: no target for dn %s.\n%s%s", @@ -248,7 +248,7 @@ retry:; lsc->msc_bound = META_BOUND; lc->mc_bound_target = candidate; - if ( li->flags & LDAP_BACK_F_SAVECRED ) { + if ( LDAP_BACK_SAVECRED( li ) ) { if ( !BER_BVISNULL( &lsc->msc_cred ) ) { /* destroy sensitive data */ memset( lsc->msc_cred.bv_val, 0, lsc->msc_cred.bv_len ); @@ -277,7 +277,7 @@ return_results:; * meta_back_dobind */ int -meta_back_dobind( struct metaconn *lc, Operation *op ) +meta_back_dobind( struct metaconn *lc, Operation *op, ldap_back_send_t sendok ) { struct metasingleconn *lsc; int bound = 0, i; diff --git a/servers/slapd/back-meta/compare.c b/servers/slapd/back-meta/compare.c index 3418717f7e..ee15d1495d 100644 --- a/servers/slapd/back-meta/compare.c +++ b/servers/slapd/back-meta/compare.c @@ -51,18 +51,11 @@ meta_back_compare( Operation *op, SlapReply *rs ) dncookie dc; lc = meta_back_getconn( op, rs, META_OP_ALLOW_MULTIPLE, - &op->o_req_ndn, NULL ); - if ( !lc ) { - send_ldap_result( op, rs ); - return -1; + &op->o_req_ndn, NULL, LDAP_BACK_SENDERR ); + if ( !lc || !meta_back_dobind( lc, op, LDAP_BACK_SENDERR ) ) { + return rs->sr_err; } - if ( !meta_back_dobind( lc, op ) ) { - rs->sr_err = LDAP_UNAVAILABLE; - send_ldap_result( op, rs ); - return -1; - } - msgid = ch_calloc( sizeof( int ), li->ntargets ); if ( msgid == NULL ) { return -1; diff --git a/servers/slapd/back-meta/config.c b/servers/slapd/back-meta/config.c index a5ce0d2e34..a7a6fa1805 100644 --- a/servers/slapd/back-meta/config.c +++ b/servers/slapd/back-meta/config.c @@ -407,6 +407,51 @@ meta_back_db_config( li->flags &= ~LDAP_BACK_F_CHASE_REFERRALS; + } else if ( strncasecmp( argv[0], "tls-", STRLENOF( "tls-" ) ) == 0 ) { + + /* start tls */ + if ( strcasecmp( argv[0], "tls-start" ) == 0 ) { + if ( argc != 1 ) { + fprintf( stderr, + "%s: line %d: tls-start takes no arguments\n", + fname, lineno ); + return( 1 ); + } + li->flags |= ( LDAP_BACK_F_USE_TLS | LDAP_BACK_F_TLS_CRITICAL ); + + /* try start tls */ + } else if ( strcasecmp( argv[0], "tls-try-start" ) == 0 ) { + if ( argc != 1 ) { + fprintf( stderr, + "%s: line %d: tls-try-start takes no arguments\n", + fname, lineno ); + return( 1 ); + } + li->flags &= ~LDAP_BACK_F_TLS_CRITICAL; + li->flags |= LDAP_BACK_F_USE_TLS; + + /* propagate start tls */ + } else if ( strcasecmp( argv[0], "tls-propagate" ) == 0 ) { + if ( argc != 1 ) { + fprintf( stderr, + "%s: line %d: tls-propagate takes no arguments\n", + fname, lineno ); + return( 1 ); + } + li->flags |= ( LDAP_BACK_F_PROPAGATE_TLS | LDAP_BACK_F_TLS_CRITICAL ); + + /* try start tls */ + } else if ( strcasecmp( argv[0], "tls-try-propagate" ) == 0 ) { + if ( argc != 1 ) { + fprintf( stderr, + "%s: line %d: tls-try-propagate takes no arguments\n", + fname, lineno ); + return( 1 ); + } + li->flags &= ~LDAP_BACK_F_TLS_CRITICAL; + li->flags |= LDAP_BACK_F_PROPAGATE_TLS; + } + /* name to use as pseudo-root dn */ } else if ( strcasecmp( argv[ 0 ], "pseudorootdn" ) == 0 ) { int i = li->ntargets-1; diff --git a/servers/slapd/back-meta/conn.c b/servers/slapd/back-meta/conn.c index 7a97797ce4..1e8a9f09f4 100644 --- a/servers/slapd/back-meta/conn.c +++ b/servers/slapd/back-meta/conn.c @@ -186,8 +186,8 @@ init_one_conn( Operation *op, SlapReply *rs, struct metatarget *lt, - struct metasingleconn *lsc - ) + struct metasingleconn *lsc, + ldap_back_send_t sendok ) { struct metainfo *li = ( struct metainfo * )op->o_bd->be_private; int vers; @@ -205,7 +205,7 @@ init_one_conn( */ rs->sr_err = ldap_initialize( &lsc->msc_ld, lt->mt_uri ); if ( rs->sr_err != LDAP_SUCCESS ) { - return slap_map_api2result( rs ); + goto error_return; } /* @@ -216,10 +216,71 @@ init_one_conn( ldap_set_option( lsc->msc_ld, LDAP_OPT_PROTOCOL_VERSION, &vers ); /* automatically chase referrals ("chase-referrals"/"dont-chase-referrals" statement) */ - if ( li->flags & LDAP_BACK_F_CHASE_REFERRALS ) { + if ( LDAP_BACK_CHASE_REFERRALS( li ) ) { ldap_set_option( lsc->msc_ld, LDAP_OPT_REFERRALS, LDAP_OPT_ON ); } + /* start TLS ("start-tls"/"try-start-tls" statements) */ + if ( ( LDAP_BACK_USE_TLS( li ) || ( op->o_conn->c_is_tls && LDAP_BACK_PROPAGATE_TLS( li ) ) ) + && !ldap_is_ldaps_url( lt->mt_uri ) ) + { + int rc, msgid; + LDAPMessage *res; + int retries = 1; + +retry:; + rc = ldap_start_tls( lsc->msc_ld, NULL, NULL, &msgid ); + if ( rc == LDAP_SUCCESS ) { + struct timeval tv = { 0, 0 }; + + rc = ldap_result( lsc->msc_ld, msgid, LDAP_MSG_ALL, &tv, &res ); + if ( rc < 0 ) { + rs->sr_err = LDAP_OTHER; + + } else if ( rc == 0 ) { + if ( retries ) { + retries--; + tv.tv_sec = 0; + tv.tv_usec = 100000; + goto retry; + } + rs->sr_err = LDAP_OTHER; + + } else { + if ( rc == LDAP_RES_EXTENDED ) { + rc = ldap_parse_result( lsc->msc_ld, res, + &rs->sr_err, NULL, NULL, NULL, NULL, 1 ); + if ( rc != LDAP_SUCCESS ) { + rs->sr_err = rc; + + /* FIXME: in case a referral + * is returned, should we try + * using it instead of the + * configured URI? */ + } else if ( rs->sr_err == LDAP_REFERRAL ) { + rs->sr_err = LDAP_OTHER; + rs->sr_text = "unwilling to chase referral returned by Start TLS exop"; + } + + } else { + ldap_msgfree( res ); + rs->sr_err = LDAP_OTHER; + } + } + } + + /* if StartTLS is requested, only attempt it if the URL + * is not "ldaps://"; this may occur not only in case + * of misconfiguration, but also when used in the chain + * overlay, where the "uri" can be parsed out of a referral */ + if ( rs->sr_err == LDAP_SERVER_DOWN + || ( rs->sr_err != LDAP_SUCCESS && LDAP_BACK_TLS_CRITICAL( li ) ) ) + { + ldap_unbind_ext_s( lsc->msc_ld, NULL, NULL ); + goto error_return; + } + } + /* * Set the network timeout if set */ @@ -241,7 +302,7 @@ init_one_conn( /* * If the connection DN is not null, an attempt to rewrite it is made */ - if ( op->o_conn->c_dn.bv_len != 0 ) { + if ( !BER_BVISEMPTY( &op->o_conn->c_dn ) ) { dc.rwmap = <->mt_rwmap; dc.conn = op->o_conn; dc.rs = rs; @@ -253,8 +314,7 @@ init_one_conn( if ( ldap_back_dn_massage( &dc, &op->o_conn->c_dn, &lsc->msc_bound_ndn ) ) { - send_ldap_result( op, rs ); - return rs->sr_err; + goto error_return; } /* copy the DN idf needed */ @@ -262,7 +322,7 @@ init_one_conn( ber_dupbv( &lsc->msc_bound_ndn, &op->o_conn->c_dn ); } - assert( lsc->msc_bound_ndn.bv_val ); + assert( !BER_BVISNULL( &lsc->msc_bound_ndn ) ); } else { ber_str2bv( "", 0, 1, &lsc->msc_bound_ndn ); @@ -270,11 +330,23 @@ init_one_conn( lsc->msc_bound = META_UNBOUND; - /* - * The candidate is activated - */ - lsc->msc_candidate = META_CANDIDATE; - return LDAP_SUCCESS; +error_return:; + if ( rs->sr_err != LDAP_SUCCESS ) { + rs->sr_err = slap_map_api2result( rs ); + if ( sendok & LDAP_BACK_SENDERR ) { + send_ldap_result( op, rs ); + rs->sr_text = NULL; + } + + } else { + + /* + * The candidate is activated + */ + lsc->msc_candidate = META_CANDIDATE; + } + + return rs->sr_err; } /* @@ -291,11 +363,12 @@ init_one_conn( */ struct metaconn * meta_back_getconn( - Operation *op, - SlapReply *rs, - int op_type, - struct berval *ndn, - int *candidate ) + Operation *op, + SlapReply *rs, + int op_type, + struct berval *ndn, + int *candidate, + ldap_back_send_t sendok ) { struct metainfo *li = ( struct metainfo * )op->o_bd->be_private; struct metaconn *lc, lc_curr; @@ -329,7 +402,7 @@ meta_back_getconn( * also init'd */ int lerr = init_one_conn( op, rs, li->targets[ i ], - &lc->mc_conns[ i ] ); + &lc->mc_conns[ i ], sendok ); if ( lerr != LDAP_SUCCESS ) { /* @@ -389,7 +462,7 @@ meta_back_getconn( * sends the appropriate result. */ err = init_one_conn( op, rs, li->targets[ i ], - &lc->mc_conns[ i ] ); + &lc->mc_conns[ i ], sendok ); if ( err != LDAP_SUCCESS ) { /* @@ -423,7 +496,7 @@ meta_back_getconn( */ int lerr = init_one_conn( op, rs, li->targets[ i ], - &lc->mc_conns[ i ] ); + &lc->mc_conns[ i ], sendok ); if ( lerr != LDAP_SUCCESS ) { /* diff --git a/servers/slapd/back-meta/delete.c b/servers/slapd/back-meta/delete.c index cd719c08d5..646cbe8de6 100644 --- a/servers/slapd/back-meta/delete.c +++ b/servers/slapd/back-meta/delete.c @@ -41,22 +41,15 @@ meta_back_delete( Operation *op, SlapReply *rs ) dncookie dc; lc = meta_back_getconn( op, rs, META_OP_REQUIRE_SINGLE, - &op->o_req_ndn, &candidate ); - if ( !lc ) { - send_ldap_result( op, rs ); - return -1; + &op->o_req_ndn, &candidate, LDAP_BACK_SENDERR ); + if ( !lc || !meta_back_dobind( lc, op, LDAP_BACK_SENDERR ) ) { + return rs->sr_err; } - - if ( !meta_back_dobind( lc, op ) ) { - rs->sr_err = LDAP_UNAVAILABLE; - } else if ( !meta_back_is_valid( lc, candidate ) ) { + if ( !meta_back_is_valid( lc, candidate ) ) { rs->sr_err = LDAP_OTHER; - } - - if ( rs->sr_err != LDAP_SUCCESS ) { send_ldap_result( op, rs ); - return -1; + return rs->sr_err; } /* diff --git a/servers/slapd/back-meta/modify.c b/servers/slapd/back-meta/modify.c index cd0a3ec00e..e09b9c3566 100644 --- a/servers/slapd/back-meta/modify.c +++ b/servers/slapd/back-meta/modify.c @@ -47,22 +47,15 @@ meta_back_modify( Operation *op, SlapReply *rs ) dncookie dc; lc = meta_back_getconn( op, rs, META_OP_REQUIRE_SINGLE, - &op->o_req_ndn, &candidate ); - if ( !lc ) { - rc = -1; - goto cleanup; + &op->o_req_ndn, &candidate, LDAP_BACK_SENDERR ); + if ( !lc || !meta_back_dobind( lc, op, LDAP_BACK_SENDERR ) ) { + return rs->sr_err; } - if ( !meta_back_dobind( lc, op ) ) { - rs->sr_err = LDAP_UNAVAILABLE; - - } else if ( !meta_back_is_valid( lc, candidate ) ) { + if ( !meta_back_is_valid( lc, candidate ) ) { rs->sr_err = LDAP_OTHER; - } - - if ( rs->sr_err != LDAP_SUCCESS ) { - rc = -1; - goto cleanup; + send_ldap_result( op, rs ); + return rs->sr_err; } /* diff --git a/servers/slapd/back-meta/modrdn.c b/servers/slapd/back-meta/modrdn.c index 756ae36d38..a0d7e408cc 100644 --- a/servers/slapd/back-meta/modrdn.c +++ b/servers/slapd/back-meta/modrdn.c @@ -43,24 +43,21 @@ meta_back_modrdn( Operation *op, SlapReply *rs ) dncookie dc; lc = meta_back_getconn( op, rs, META_OP_REQUIRE_SINGLE, - &op->o_req_ndn, &candidate ); + &op->o_req_ndn, &candidate, LDAP_BACK_SENDERR ); if ( !lc ) { - rc = -1; - goto cleanup; + return rs->sr_err; } assert( candidate != META_TARGET_NONE ); - if ( !meta_back_dobind( lc, op ) ) { - rs->sr_err = LDAP_UNAVAILABLE; - - } else if ( !meta_back_is_valid( lc, candidate ) ) { - rs->sr_err = LDAP_OTHER; + if ( !meta_back_dobind( lc, op, LDAP_BACK_SENDERR ) ) { + return rs->sr_err; } - - if ( rs->sr_err != LDAP_SUCCESS ) { - rc = -1; - goto cleanup; + + if ( !meta_back_is_valid( lc, candidate ) ) { + rs->sr_err = LDAP_OTHER; + send_ldap_result( op, rs ); + return rs->sr_err; } dc.conn = op->o_conn; diff --git a/servers/slapd/back-meta/search.c b/servers/slapd/back-meta/search.c index 6bc693b64b..ae2ce94759 100644 --- a/servers/slapd/back-meta/search.c +++ b/servers/slapd/back-meta/search.c @@ -71,16 +71,9 @@ meta_back_search( Operation *op, SlapReply *rs ) * to map attrs and maybe rewrite value */ lc = meta_back_getconn( op, rs, META_OP_ALLOW_MULTIPLE, - &op->o_req_ndn, NULL ); - if ( !lc ) { - send_ldap_result( op, rs ); - return -1; - } - - if ( !meta_back_dobind( lc, op ) ) { - rs->sr_err = LDAP_UNAVAILABLE; - send_ldap_result( op, rs ); - return -1; + &op->o_req_ndn, NULL, LDAP_BACK_SENDERR ); + if ( !lc || !meta_back_dobind( lc, op, LDAP_BACK_SENDERR ) ) { + return rs->sr_err; } /* -- 2.39.5