Commit 2e53c5ab authored by Kurt Zeilenga's avatar Kurt Zeilenga
Browse files

Merge in recent changes to HEAD

parent a394cbd2
......@@ -539,6 +539,7 @@ parse_acl(
{
free( a->acl_dn_pat.bv_val );
BER_BVZERO( &a->acl_dn_pat );
a->acl_dn_style = ACL_STYLE_REGEX;
}
if ( !BER_BVISEMPTY( &a->acl_dn_pat ) ||
......
......@@ -214,6 +214,8 @@ fe_op_add( Operation *op, SlapReply *rs )
Modifications **modtail = &modlist;
int rc = 0;
BackendDB *op_be;
char textbuf[ SLAP_TEXT_BUFLEN ];
size_t textlen = sizeof( textbuf );
manageDSAit = get_manageDSAit( op );
......@@ -262,6 +264,14 @@ fe_op_add( Operation *op, SlapReply *rs )
goto done;
}
rs->sr_err = slap_mods_obsolete_check( op, modlist,
&rs->sr_text, textbuf, textlen );
if ( rs->sr_err != LDAP_SUCCESS ) {
send_ldap_result( op, rs );
goto done;
}
#ifdef LDAP_SLAPI
if ( op->o_pb ) init_add_pblock( op, &op->o_req_dn, op->ora_e, manageDSAit );
#endif /* LDAP_SLAPI */
......@@ -280,16 +290,13 @@ fe_op_add( Operation *op, SlapReply *rs )
#endif
{
int update = !BER_BVISEMPTY( &op->o_bd->be_update_ndn );
char textbuf[ SLAP_TEXT_BUFLEN ];
size_t textlen = sizeof( textbuf );
slap_callback cb = { NULL, slap_replog_cb, NULL, NULL };
op->o_bd = op_be;
if ( !update ) {
rs->sr_err = slap_mods_no_update_check( modlist,
&rs->sr_text,
textbuf, textlen );
rs->sr_err = slap_mods_no_user_mod_check( op, modlist,
&rs->sr_text, textbuf, textlen );
if ( rs->sr_err != LDAP_SUCCESS ) {
send_ldap_result( op, rs );
......
......@@ -46,6 +46,10 @@ attr_free( Attribute *a )
if ( a->a_nvals && a->a_nvals != a->a_vals ) {
ber_bvarray_free( a->a_nvals );
}
/* a_vals may be equal to slap_dummy_bv, a static empty berval;
* this is used as a placeholder for attributes that do not carry
* values, e.g. when proxying search entries with the "attrsonly"
* bit set. */
if ( a->a_vals != &slap_dummy_bv ) {
ber_bvarray_free( a->a_vals );
}
......
......@@ -52,8 +52,8 @@ bdb_add(Operation *op, SlapReply *rs )
ctrls[num_ctrls] = 0;
/* check entry's schema */
rs->sr_err = entry_schema_check( op->o_bd, op->oq_add.rs_e,
NULL, &rs->sr_text, textbuf, textlen );
rs->sr_err = entry_schema_check( op->o_bd, op->oq_add.rs_e, NULL,
get_manageDIT(op), &rs->sr_text, textbuf, textlen );
if ( rs->sr_err != LDAP_SUCCESS ) {
Debug( LDAP_DEBUG_TRACE,
LDAP_XSTRING(bdb_add) ": entry failed schema check: "
......@@ -191,8 +191,8 @@ retry: /* transaction retry */
}
Debug( LDAP_DEBUG_TRACE,
LDAP_XSTRING(bdb_add) ": no write access "
"to parent\n", 0, 0, 0 );
LDAP_XSTRING(bdb_add) ": no write access to parent\n",
0, 0, 0 );
rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
rs->sr_text = "no write access to parent";
goto return_results;;
......
......@@ -196,7 +196,8 @@ int bdb_modify_internal(
}
/* check that the entry still obeys the schema */
rc = entry_schema_check( op->o_bd, e, save_attrs, text, textbuf, textlen );
rc = entry_schema_check( op->o_bd, e, save_attrs, get_manageDIT(op),
text, textbuf, textlen );
if ( rc != LDAP_SUCCESS || op->o_noop ) {
attrs_free( e->e_attrs );
/* clear the indexing flags */
......
......@@ -45,7 +45,7 @@ struct ldapconn {
* identity assertion modes
*/
enum {
LDAP_BACK_IDASSERT_LEGACY,
LDAP_BACK_IDASSERT_LEGACY = 1,
LDAP_BACK_IDASSERT_NOASSERT,
LDAP_BACK_IDASSERT_ANONYMOUS,
LDAP_BACK_IDASSERT_SELF,
......@@ -57,26 +57,28 @@ struct ldapinfo {
char *url;
LDAPURLDesc *lud;
slap_bindconf acl_la;
#define acl_authcID acl_la.sb_authcId
#define acl_authcDN acl_la.sb_binddn
#define acl_passwd acl_la.sb_cred
#define acl_authzID acl_la.sb_authzId
#define acl_authmethod acl_la.sb_method
#define acl_sasl_mech acl_la.sb_saslmech
#define acl_sasl_realm acl_la.sb_realm
slap_bindconf acl_sb;
#define acl_authcID acl_sb.sb_authcId
#define acl_authcDN acl_sb.sb_binddn
#define acl_passwd acl_sb.sb_cred
#define acl_authzID acl_sb.sb_authzId
#define acl_authmethod acl_sb.sb_method
#define acl_sasl_mech acl_sb.sb_saslmech
#define acl_sasl_realm acl_sb.sb_realm
#define acl_secprops acl_sb.sb_secprops
/* ID assert stuff */
int idassert_mode;
slap_bindconf idassert_la;
#define idassert_authcID idassert_la.sb_authcId
#define idassert_authcDN idassert_la.sb_binddn
#define idassert_passwd idassert_la.sb_cred
#define idassert_authzID idassert_la.sb_authzId
#define idassert_authmethod idassert_la.sb_method
#define idassert_sasl_mech idassert_la.sb_saslmech
#define idassert_sasl_realm idassert_la.sb_realm
slap_bindconf idassert_sb;
#define idassert_authcID idassert_sb.sb_authcId
#define idassert_authcDN idassert_sb.sb_binddn
#define idassert_passwd idassert_sb.sb_cred
#define idassert_authzID idassert_sb.sb_authzId
#define idassert_authmethod idassert_sb.sb_method
#define idassert_sasl_mech idassert_sb.sb_saslmech
#define idassert_sasl_realm idassert_sb.sb_realm
#define idassert_secprops idassert_sb.sb_secprops
unsigned idassert_flags;
#define LDAP_BACK_AUTH_NONE 0x00U
......@@ -93,11 +95,15 @@ struct ldapinfo {
#define LDAP_BACK_F_USE_TLS 0x02U
#define LDAP_BACK_F_PROPAGATE_TLS 0x04U
#define LDAP_BACK_F_TLS_CRITICAL 0x08U
#define LDAP_BACK_F_TLS_MASK (LDAP_BACK_F_USE_TLS|LDAP_BACK_F_PROPAGATE_TLS|LDAP_BACK_F_TLS_CRITICAL)
#define LDAP_BACK_F_TLS_USE_MASK (LDAP_BACK_F_USE_TLS|LDAP_BACK_F_TLS_CRITICAL)
#define LDAP_BACK_F_TLS_PROPAGATE_MASK (LDAP_BACK_F_PROPAGATE_TLS|LDAP_BACK_F_TLS_CRITICAL)
#define LDAP_BACK_F_TLS_MASK (LDAP_BACK_F_TLS_USE_MASK|LDAP_BACK_F_TLS_PROPAGATE_MASK)
#define LDAP_BACK_F_CHASE_REFERRALS 0x10U
#define LDAP_BACK_F_PROXY_WHOAMI 0x20U
#define LDAP_BACK_F_SUPPORT_T_F 0x80U
#define LDAP_BACK_F_SUPPORT_T_F_DISCOVER 0x40U
#define LDAP_BACK_F_SUPPORT_T_F_MASK (LDAP_BACK_F_SUPPORT_T_F|LDAP_BACK_F_SUPPORT_T_F_DISCOVER)
#define LDAP_BACK_SAVECRED(li) ( (li)->flags & LDAP_BACK_F_SAVECRED )
#define LDAP_BACK_USE_TLS(li) ( (li)->flags & LDAP_BACK_F_USE_TLS )
......
......@@ -510,14 +510,15 @@ ldap_back_dobind_int(
if ( lc->lc_ispriv && li->acl_authmethod == LDAP_AUTH_SASL ) {
void *defaults = NULL;
#if 0 /* will deal with this later... */
if ( sasl_secprops != NULL ) {
rs->sr_err = ldap_set_option( lc->lc_ld, LDAP_OPT_X_SASL_SECPROPS,
(void *) sasl_secprops );
if ( rs->sr_err != LDAP_OPT_SUCCESS ) {
send_ldap_result( op, rs );
lc->lc_bound = 0;
#if 1 /* will deal with this later... */
if ( li->acl_secprops != NULL ) {
rc = ldap_set_option( lc->lc_ld,
LDAP_OPT_X_SASL_SECPROPS, li->acl_secprops);
if( rc != LDAP_OPT_SUCCESS ) {
Debug( LDAP_DEBUG_ANY, "Error: ldap_set_option "
"(%s,SECPROPS,\"%s\") failed!\n",
li->url, li->acl_secprops, 0 );
goto done;
}
}
......
......@@ -29,6 +29,8 @@
#include "slap.h"
#include "back-ldap.h"
#include "config.h"
#ifdef LDAP_CONTROL_X_CHAINING_BEHAVIOR
#define SLAP_CHAINING_DEFAULT LDAP_CHAINING_PREFERRED
#define SLAP_CH_RESOLVE_SHIFT SLAP_CONTROL_SHIFT
......@@ -673,20 +675,277 @@ str2chain( const char *s )
}
#endif /* LDAP_CONTROL_X_CHAINING_BEHAVIOR */
enum {
PC_CHAINING = 1
};
static ConfigDriver chain_cf_gen;
static ConfigLDAPadd chain_ldadd;
static ConfigCfAdd chain_cfadd;
static ConfigTable chaincfg[] = {
#ifdef LDAP_CONTROL_X_CHAINING_BEHAVIOR
{ "chain-chaining", "args",
2, 4, 0, ARG_MAGIC|ARG_BERVAL|PC_CHAINING, chain_cf_gen,
"( OLcfgOvAt:3.1 NAME 'olcChainingBehavior' "
"DESC 'Chaining behavior control parameters (draft-sermersheim-ldap-chaining)' "
"SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
#endif /* LDAP_CONTROL_X_CHAINING_BEHAVIOR */
{ NULL, NULL, 0, 0, 0, ARG_IGNORED }
};
static ConfigOCs chainocs[] = {
{ "( OLcfgOvOc:3.1 "
"NAME 'olcChainConfig' "
"DESC 'Chain configuration' "
"SUP olcOverlayConfig "
"MAY olcChainingBehavior )", Cft_Overlay, chaincfg, NULL, chain_cfadd },
{ "( OLcfgOvOc:3.2 "
"NAME 'olcChainDatabase' "
"DESC 'Chain remote server configuration' "
"AUXILIARY )", Cft_Misc, chaincfg, chain_ldadd },
{ NULL, 0, NULL }
};
static int
chain_ldadd( CfEntryInfo *p, Entry *e, ConfigArgs *ca )
{
if ( p->ce_type != Cft_Overlay || !p->ce_bi ||
p->ce_bi->bi_cf_ocs != chainocs )
return LDAP_CONSTRAINT_VIOLATION;
return LDAP_SUCCESS;
}
static int
chain_cfadd( Operation *op, SlapReply *rs, Entry *p, ConfigArgs *ca )
{
CfEntryInfo *pe = p->e_private;
slap_overinst *on = (slap_overinst *)pe->ce_bi;
ldap_chain_t *lc = (ldap_chain_t *)on->on_bi.bi_private;
void *priv = (void *)ca->be->be_private;
struct berval bv;
/* FIXME: should not hardcode "olcDatabase" here */
bv.bv_len = sprintf( ca->msg, "olcDatabase=%s", lback->bi_type );
bv.bv_val = ca->msg;
/* We can only create this entry if the database is table-driven */
if ( lback->bi_cf_ocs ) {
ca->be->be_private = (void *)lc->lc_li;
config_build_entry( op, rs, pe, ca, &bv, lback->bi_cf_ocs, &chainocs[1] );
ca->be->be_private = priv;
}
return 0;
}
#ifdef LDAP_CONTROL_X_CHAINING_BEHAVIOR
static slap_verbmasks chaining_mode[] = {
{ BER_BVC("referralsRequired"), LDAP_REFERRALS_REQUIRED },
{ BER_BVC("referralsPreferred"), LDAP_REFERRALS_PREFERRED },
{ BER_BVC("chainingRequired"), LDAP_CHAINING_REQUIRED },
{ BER_BVC("chainingPreferred"), LDAP_CHAINING_PREFERRED },
{ BER_BVNULL, 0 }
};
#endif
static int
chain_cf_gen( ConfigArgs *c )
{
slap_overinst *on = (slap_overinst *)c->bi;
ldap_chain_t *lc = (ldap_chain_t *)on->on_bi.bi_private;
int rc = 0;
if ( c->op == SLAP_CONFIG_EMIT ) {
switch( c->type ) {
#ifdef LDAP_CONTROL_X_CHAINING_BEHAVIOR
case PC_CHAINING: {
struct berval resolve = BER_BVNULL,
continuation = BER_BVNULL;
if ( !( lc->lc_flags & LDAP_CHAIN_F_CHAINING ) ) {
return 1;
}
enum_to_verb( chaining_mode, ( ( lc->lc_chaining_ctrlflag & SLAP_CH_RESOLVE_MASK ) >> SLAP_CH_RESOLVE_SHIFT ), &resolve );
enum_to_verb( chaining_mode, ( ( lc->lc_chaining_ctrlflag & SLAP_CH_CONTINUATION_MASK ) >> SLAP_CH_CONTINUATION_SHIFT ), &continuation );
c->value_bv.bv_len = STRLENOF( "resolve=" ) + resolve.bv_len
+ STRLENOF( " " )
+ STRLENOF( "continuation=" ) + continuation.bv_len;
c->value_bv.bv_val = ch_malloc( c->value_bv.bv_len + 1 );
snprintf( c->value_bv.bv_val, c->value_bv.bv_len + 1,
"resolve=%s continuation=%s",
resolve.bv_val, continuation.bv_val );
if ( lc->lc_chaining_ctrl.ldctl_iscritical ) {
c->value_bv.bv_val = ch_realloc( c->value_bv.bv_val,
c->value_bv.bv_len + STRLENOF( " critical" ) + 1 );
AC_MEMCPY( &c->value_bv.bv_val[ c->value_bv.bv_len ],
" critical", STRLENOF( " critical" ) + 1 );
c->value_bv.bv_len += STRLENOF( " critical" );
}
break;
}
#endif /* LDAP_CONTROL_X_CHAINING_BEHAVIOR */
default:
assert( 0 );
rc = 1;
}
return rc;
} else if ( c->op == LDAP_MOD_DELETE ) {
return 1; /* FIXME */
#if 0
switch( c->type ) {
case PC_ATTR:
case PC_TEMP:
}
return rc;
#endif
}
switch( c->type ) {
#ifdef LDAP_CONTROL_X_CHAINING_BEHAVIOR
case PC_CHAINING: {
char **argv = c->argv;
int argc = c->argc;
BerElementBuffer berbuf;
BerElement *ber = (BerElement *)&berbuf;
int resolve = -1,
continuation = -1,
iscritical = 0;
Operation op = { 0 };
SlapReply rs = { 0 };
lc->lc_chaining_ctrlflag = 0;
for ( argc--, argv++; argc > 0; argc--, argv++ ) {
if ( strncasecmp( argv[ 0 ], "resolve=", STRLENOF( "resolve=" ) ) == 0 ) {
resolve = str2chain( argv[ 0 ] + STRLENOF( "resolve=" ) );
if ( resolve == -1 ) {
fprintf( stderr, "%s line %d: "
"illegal <resolve> value %s "
"in \"chain-chaining>\"\n",
c->fname, c->lineno, argv[ 0 ] );
return 1;
}
} else if ( strncasecmp( argv[ 0 ], "continuation=", STRLENOF( "continuation=" ) ) == 0 ) {
continuation = str2chain( argv[ 0 ] + STRLENOF( "continuation=" ) );
if ( continuation == -1 ) {
fprintf( stderr, "%s line %d: "
"illegal <continuation> value %s "
"in \"chain-chaining\"\n",
c->fname, c->lineno, argv[ 0 ] );
return 1;
}
} else if ( strcasecmp( argv[ 0 ], "critical" ) == 0 ) {
iscritical = 1;
} else {
fprintf( stderr, "%s line %d: "
"unknown option in \"chain-chaining\"\n",
c->fname, c->lineno );
return 1;
}
}
if ( resolve != -1 || continuation != -1 ) {
int err;
if ( resolve == -1 ) {
/* default */
resolve = SLAP_CHAINING_DEFAULT;
}
ber_init2( ber, NULL, LBER_USE_DER );
err = ber_printf( ber, "{e" /* } */, resolve );
if ( err == -1 ) {
ber_free( ber, 1 );
fprintf( stderr, "%s line %d: "
"chaining behavior control encoding error!\n",
c->fname, c->lineno );
return 1;
}
if ( continuation > -1 ) {
err = ber_printf( ber, "e", continuation );
if ( err == -1 ) {
ber_free( ber, 1 );
fprintf( stderr, "%s line %d: "
"chaining behavior control encoding error!\n",
c->fname, c->lineno );
return 1;
}
}
err = ber_printf( ber, /* { */ "N}" );
if ( err == -1 ) {
ber_free( ber, 1 );
fprintf( stderr, "%s line %d: "
"chaining behavior control encoding error!\n",
c->fname, c->lineno );
return 1;
}
if ( ber_flatten2( ber, &lc->lc_chaining_ctrl.ldctl_value, 0 ) == -1 ) {
exit( EXIT_FAILURE );
}
} else {
BER_BVZERO( &lc->lc_chaining_ctrl.ldctl_value );
}
lc->lc_chaining_ctrl.ldctl_oid = LDAP_CONTROL_X_CHAINING_BEHAVIOR;
lc->lc_chaining_ctrl.ldctl_iscritical = iscritical;
if ( ldap_chain_parse_ctrl( &op, &rs, &lc->lc_chaining_ctrl ) != LDAP_SUCCESS )
{
fprintf( stderr, "%s line %d: "
"unable to parse chaining control%s%s\n",
c->fname, c->lineno,
rs.sr_text ? ": " : "",
rs.sr_text ? rs.sr_text : "" );
return 1;
}
lc->lc_chaining_ctrlflag = op.o_chaining;
lc->lc_flags |= LDAP_CHAIN_F_CHAINING;
rc = 0;
break;
}
#endif /* LDAP_CONTROL_X_CHAINING_BEHAVIOR */
default:
assert( 0 );
return 1;
}
return rc;
}
static int
ldap_chain_db_config(
BackendDB *be,
const char *fname,
int lineno,
int argc,
char **argv
)
char **argv )
{
slap_overinst *on = (slap_overinst *) be->bd_info;
ldap_chain_t *lc = (ldap_chain_t *)on->on_bi.bi_private;
void *private = be->be_private;
char *argv0 = NULL;
int rc;
BackendDB db = *be;
if ( strncasecmp( argv[ 0 ], "chain-", STRLENOF( "chain-" ) ) == 0 ) {
argv0 = argv[ 0 ];
......@@ -807,10 +1066,9 @@ ldap_chain_db_config(
#endif /* LDAP_CONTROL_X_CHAINING_BEHAVIOR */
}
be->be_private = lc->lc_li;
rc = lback->bi_db_config( be, fname, lineno, argc, argv );
be->be_private = private;
db.be_cf_ocs = lback->bi_cf_ocs;
db.be_private = lc->lc_li;
rc = lback->bi_db_config( &db, fname, lineno, argc, argv );
done:;
if ( argv0 ) {
......@@ -822,8 +1080,7 @@ done:;
static int
ldap_chain_db_init(
BackendDB *be
)
BackendDB *be )
{
slap_overinst *on = (slap_overinst *)be->bd_info;
ldap_chain_t *lc = NULL;
......@@ -1033,9 +1290,9 @@ static slap_overinst ldapchain;
int
chain_init( void )
{
#ifdef LDAP_CONTROL_X_CHAINING_BEHAVIOR
int rc;
#ifdef LDAP_CONTROL_X_CHAINING_BEHAVIOR
rc = register_supported_control( LDAP_CONTROL_X_CHAINING_BEHAVIOR,
/* SLAP_CTRL_GLOBAL| */ SLAP_CTRL_ACCESS|SLAP_CTRL_HIDE, NULL,
ldap_chain_parse_ctrl, &sc_chainingBehavior );
......@@ -1066,6 +1323,13 @@ chain_init( void )
ldapchain.on_response = ldap_chain_response;
ldapchain.on_bi.bi_cf_ocs = chainocs;
rc = config_register_schema( chaincfg, chainocs );
if ( rc ) {
return rc;
}
return overlay_register( &ldapchain );
}
This diff is collapsed.
......@@ -275,8 +275,8 @@ fail:;
rs->sr_operational_attrs = NULL;
rs->sr_flags = 0;
abort = send_search_entry( op, rs );
if ( !BER_BVISNULL( &ent.e_name ) && ( ent.e_name.bv_val != bdn.bv_val ) )
{
if ( !BER_BVISNULL( &ent.e_name ) ) {
assert( ent.e_name.bv_val != bdn.bv_val );
free( ent.e_name.bv_val );
BER_BVZERO( &ent.e_name );
}
......
......@@ -46,7 +46,7 @@ ldbm_back_add(
op->o_req_dn.bv_val, 0, 0);
rs->sr_err = entry_schema_check( op->o_bd, op->oq_add.rs_e, NULL,
&rs->sr_text, textbuf, textlen );
get_manageDIT(op), &rs->sr_text, textbuf, textlen );
if ( rs->sr_err != LDAP_SUCCESS ) {
Debug( LDAP_DEBUG_TRACE, "entry failed schema check: %s\n",
......
......@@ -164,8 +164,8 @@ int ldbm_modify_internal(
}
/* check that the entry still obeys the schema */
rc = entry_schema_check( op->o_bd, e, save_attrs, text, textbuf, textlen );
rc = entry_schema_check( op->o_bd, e, save_attrs, get_manageDIT(op),
text, textbuf, textlen );
if ( rc != LDAP_SUCCESS ) {
Debug( LDAP_DEBUG_ANY, "entry failed schema check: %s\n",
*text, 0, 0 );
......
......@@ -332,11 +332,12 @@ static int r_enum_tree(enumCookie *ck, struct berval *path,
ck->op->oq_search.rs_scope == LDAP_SCOPE_ONELEVEL
? LDAP_SCOPE_BASE : LDAP_SCOPE_SUBTREE );
ck->rs->sr_entry = e;
rc = send_search_reference( ck->op, ck->rs );
ber_bvarray_free( ck->rs->sr_ref );
ber_bvarray_free( erefs );
ck->rs->sr_ref = NULL;
ck->rs->sr_entry = NULL;
} else if ( test_filter( ck->op, e, ck->op->ors_filter ) == LDAP_COMPARE_TRUE )
{
......@@ -344,6 +345,7 @@ static int r_enum_tree(enumCookie *ck, struct berval *path,
ck->rs->sr_attrs = ck->op->ors_attrs;
ck->rs->sr_flags = REP_ENTRY_MODIFIABLE;
rc = send_search_entry(ck->op, ck->rs);
ck->rs->sr_entry = NULL;
}
fd = 1;
if ( rc )
......@@ -553,8 +555,8 @@ static int apply_modify_to_entry(Entry * entry,
entry->e_ocflags = 0;
}
/* check that the entry still obeys the schema */
rc = entry_schema_check(op->o_bd, entry, NULL,
&rs->sr_text, textbuf, sizeof( textbuf ) );
rc = entry_schema_check(op->o_bd, entry, NULL, 0,
&rs->sr_text, textbuf, sizeof( textbuf ) );
}
return rc;
}
......@@ -760,8 +762,8 @@ static int ldif_back_add(Operation *op, SlapReply *rs) {
int statres;
char textbuf[SLAP_TEXT_BUFLEN];
rs->sr_err = entry_schema_check(op->o_bd, e,
NULL, &rs->sr_text, textbuf, sizeof( textbuf ) );
rs->sr_err = entry_schema_check(op->o_bd, e, NULL, 0,
&rs->sr_text, textbuf, sizeof( textbuf ) );