1 /* $NetBSD: referral.c,v 1.3 2021/08/14 16:14:58 christos Exp $ */
2
3 /* referral.c - muck with referrals */
4 /* $OpenLDAP$ */
5 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
6 *
7 * Copyright 1998-2021 The OpenLDAP Foundation.
8 * All rights reserved.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted only as authorized by the OpenLDAP
12 * Public License.
13 *
14 * A copy of this license is available in the file LICENSE in the
15 * top-level directory of the distribution or, alternatively, at
16 * <http://www.OpenLDAP.org/license.html>.
17 */
18
19 #include <sys/cdefs.h>
20 __RCSID("$NetBSD: referral.c,v 1.3 2021/08/14 16:14:58 christos Exp $");
21
22 #include "portable.h"
23
24 #include <stdio.h>
25
26 #include <ac/socket.h>
27 #include <ac/errno.h>
28 #include <ac/string.h>
29 #include <ac/ctype.h>
30 #include <ac/time.h>
31 #include <ac/unistd.h>
32
33 #include "slap.h"
34
35 /*
36 * This routine generates the DN appropriate to return in
37 * an LDAP referral.
38 */
referral_dn_muck(const char * refDN,struct berval * baseDN,struct berval * targetDN)39 static char * referral_dn_muck(
40 const char * refDN,
41 struct berval * baseDN,
42 struct berval * targetDN )
43 {
44 int rc;
45 struct berval bvin;
46 struct berval nrefDN = BER_BVNULL;
47 struct berval nbaseDN = BER_BVNULL;
48 struct berval ntargetDN = BER_BVNULL;
49
50 if( !baseDN ) {
51 /* no base, return target */
52 return targetDN ? ch_strdup( targetDN->bv_val ) : NULL;
53 }
54
55 if( refDN ) {
56 bvin.bv_val = (char *)refDN;
57 bvin.bv_len = strlen( refDN );
58
59 rc = dnPretty( NULL, &bvin, &nrefDN, NULL );
60 if( rc != LDAP_SUCCESS ) {
61 /* Invalid refDN */
62 return NULL;
63 }
64 }
65
66 if( !targetDN ) {
67 /* continuation reference
68 * if refDN present return refDN
69 * else return baseDN
70 */
71 return nrefDN.bv_len ? nrefDN.bv_val : ch_strdup( baseDN->bv_val );
72 }
73
74 rc = dnPretty( NULL, targetDN, &ntargetDN, NULL );
75 if( rc != LDAP_SUCCESS ) {
76 /* Invalid targetDN */
77 ch_free( nrefDN.bv_val );
78 return NULL;
79 }
80
81 if( nrefDN.bv_len ) {
82 rc = dnPretty( NULL, baseDN, &nbaseDN, NULL );
83 if( rc != LDAP_SUCCESS ) {
84 /* Invalid baseDN */
85 ch_free( nrefDN.bv_val );
86 ch_free( ntargetDN.bv_val );
87 return NULL;
88 }
89
90 if( dn_match( &nbaseDN, &nrefDN ) ) {
91 ch_free( nrefDN.bv_val );
92 ch_free( nbaseDN.bv_val );
93 return ntargetDN.bv_val;
94 }
95
96 {
97 struct berval muck;
98
99 if( ntargetDN.bv_len < nbaseDN.bv_len ) {
100 ch_free( nrefDN.bv_val );
101 ch_free( nbaseDN.bv_val );
102 return ntargetDN.bv_val;
103 }
104
105 rc = strcasecmp(
106 &ntargetDN.bv_val[ntargetDN.bv_len-nbaseDN.bv_len],
107 nbaseDN.bv_val );
108 if( rc ) {
109 /* target not subordinate to base */
110 ch_free( nrefDN.bv_val );
111 ch_free( nbaseDN.bv_val );
112 return ntargetDN.bv_val;
113 }
114
115 muck.bv_len = ntargetDN.bv_len + nrefDN.bv_len - nbaseDN.bv_len;
116 muck.bv_val = ch_malloc( muck.bv_len + 1 );
117
118 strncpy( muck.bv_val, ntargetDN.bv_val,
119 ntargetDN.bv_len-nbaseDN.bv_len );
120 strcpy( &muck.bv_val[ntargetDN.bv_len-nbaseDN.bv_len],
121 nrefDN.bv_val );
122
123 ch_free( nrefDN.bv_val );
124 ch_free( nbaseDN.bv_val );
125 ch_free( ntargetDN.bv_val );
126
127 return muck.bv_val;
128 }
129 }
130
131 ch_free( nrefDN.bv_val );
132 return ntargetDN.bv_val;
133 }
134
135
136 /* validate URL for global referral use
137 * LDAP URLs must not have:
138 * DN, attrs, scope, nor filter
139 * Any non-LDAP URL is okay
140 *
141 * XXYYZ: should return an error string
142 */
validate_global_referral(const char * url)143 int validate_global_referral( const char *url )
144 {
145 int rc;
146 LDAPURLDesc *lurl;
147
148 rc = ldap_url_parse_ext( url, &lurl, LDAP_PVT_URL_PARSE_NONE );
149
150 switch( rc ) {
151 case LDAP_URL_SUCCESS:
152 break;
153
154 case LDAP_URL_ERR_BADSCHEME:
155 /* not LDAP hence valid */
156 Debug( LDAP_DEBUG_CONFIG, "referral \"%s\": not LDAP.\n", url );
157 return 0;
158
159 default:
160 /* other error, bail */
161 Debug( LDAP_DEBUG_ANY,
162 "referral: invalid URL (%s): %s (%d)\n",
163 url, "" /* ldap_url_error2str(rc) */, rc );
164 return 1;
165 }
166
167 rc = 0;
168
169 if( lurl->lud_dn && *lurl->lud_dn ) {
170 Debug( LDAP_DEBUG_ANY,
171 "referral: URL (%s): contains DN\n",
172 url );
173 rc = 1;
174
175 } else if( lurl->lud_attrs ) {
176 Debug( LDAP_DEBUG_ANY,
177 "referral: URL (%s): requests attributes\n",
178 url );
179 rc = 1;
180
181 } else if( lurl->lud_scope != LDAP_SCOPE_DEFAULT ) {
182 Debug( LDAP_DEBUG_ANY,
183 "referral: URL (%s): contains explicit scope\n",
184 url );
185 rc = 1;
186
187 } else if( lurl->lud_filter ) {
188 Debug( LDAP_DEBUG_ANY,
189 "referral: URL (%s): contains explicit filter\n",
190 url );
191 rc = 1;
192 }
193
194 ldap_free_urldesc( lurl );
195 return rc;
196 }
197
referral_rewrite(BerVarray in,struct berval * base,struct berval * target,int scope)198 BerVarray referral_rewrite(
199 BerVarray in,
200 struct berval *base,
201 struct berval *target,
202 int scope )
203 {
204 int i;
205 BerVarray refs;
206 struct berval *iv, *jv;
207
208 if ( in == NULL ) {
209 return NULL;
210 }
211
212 for ( i = 0; !BER_BVISNULL( &in[i] ); i++ ) {
213 /* just count them */
214 }
215
216 if ( i < 1 ) {
217 return NULL;
218 }
219
220 refs = ch_malloc( ( i + 1 ) * sizeof( struct berval ) );
221
222 for ( iv = in, jv = refs; !BER_BVISNULL( iv ); iv++ ) {
223 LDAPURLDesc *url;
224 char *dn;
225 int rc;
226
227 rc = ldap_url_parse_ext( iv->bv_val, &url, LDAP_PVT_URL_PARSE_NONE );
228 if ( rc == LDAP_URL_ERR_BADSCHEME ) {
229 ber_dupbv( jv++, iv );
230 continue;
231
232 } else if ( rc != LDAP_URL_SUCCESS ) {
233 continue;
234 }
235
236 dn = url->lud_dn;
237 url->lud_dn = referral_dn_muck( ( dn && *dn ) ? dn : NULL,
238 base, target );
239 ldap_memfree( dn );
240
241 if ( url->lud_scope == LDAP_SCOPE_DEFAULT ) {
242 url->lud_scope = scope;
243 }
244
245 jv->bv_val = ldap_url_desc2str( url );
246 if ( jv->bv_val != NULL ) {
247 jv->bv_len = strlen( jv->bv_val );
248
249 } else {
250 ber_dupbv( jv, iv );
251 }
252 jv++;
253
254 ldap_free_urldesc( url );
255 }
256
257 if ( jv == refs ) {
258 ch_free( refs );
259 refs = NULL;
260
261 } else {
262 BER_BVZERO( jv );
263 }
264
265 return refs;
266 }
267
268
get_entry_referrals(Operation * op,Entry * e)269 BerVarray get_entry_referrals(
270 Operation *op,
271 Entry *e )
272 {
273 Attribute *attr;
274 BerVarray refs;
275 unsigned i;
276 struct berval *iv, *jv;
277
278 AttributeDescription *ad_ref = slap_schema.si_ad_ref;
279
280 attr = attr_find( e->e_attrs, ad_ref );
281
282 if( attr == NULL ) return NULL;
283
284 for( i=0; attr->a_vals[i].bv_val != NULL; i++ ) {
285 /* count references */
286 }
287
288 if( i < 1 ) return NULL;
289
290 refs = ch_malloc( (i + 1) * sizeof(struct berval));
291
292 for( iv=attr->a_vals, jv=refs; iv->bv_val != NULL; iv++ ) {
293 unsigned k;
294 ber_dupbv( jv, iv );
295
296 /* trim the label */
297 for( k=0; k<jv->bv_len; k++ ) {
298 if( isspace( (unsigned char) jv->bv_val[k] ) ) {
299 jv->bv_val[k] = '\0';
300 jv->bv_len = k;
301 break;
302 }
303 }
304
305 if( jv->bv_len > 0 ) {
306 jv++;
307 } else {
308 free( jv->bv_val );
309 }
310 }
311
312 if( jv == refs ) {
313 free( refs );
314 refs = NULL;
315
316 } else {
317 jv->bv_val = NULL;
318 }
319
320 /* we should check that a referral value exists... */
321 return refs;
322 }
323
324
get_alias_dn(Entry * e,struct berval * ndn,int * err,const char ** text)325 int get_alias_dn(
326 Entry *e,
327 struct berval *ndn,
328 int *err,
329 const char **text )
330 {
331 Attribute *a;
332 AttributeDescription *aliasedObjectName
333 = slap_schema.si_ad_aliasedObjectName;
334
335 a = attr_find( e->e_attrs, aliasedObjectName );
336
337 if( a == NULL ) {
338 /*
339 * there was an aliasedobjectname defined but no data.
340 */
341 *err = LDAP_ALIAS_PROBLEM;
342 *text = "alias missing aliasedObjectName attribute";
343 return -1;
344 }
345
346 /*
347 * aliasedObjectName should be SINGLE-VALUED with a single value.
348 */
349 if ( a->a_vals[0].bv_val == NULL ) {
350 /*
351 * there was an aliasedobjectname defined but no data.
352 */
353 *err = LDAP_ALIAS_PROBLEM;
354 *text = "alias missing aliasedObjectName value";
355 return -1;
356 }
357
358 if( a->a_nvals[1].bv_val != NULL ) {
359 *err = LDAP_ALIAS_PROBLEM;
360 *text = "alias has multivalued aliasedObjectName";
361 return -1;
362 }
363
364 *ndn = a->a_nvals[0];
365
366 return 0;
367 }
368
369