1 /* $NetBSD: init.c,v 1.1.1.7 2018/02/06 01:53:17 christos Exp $ */ 2 3 /* $OpenLDAP$ */ 4 /* This work is part of OpenLDAP Software <http://www.openldap.org/>. 5 * 6 * Copyright 1999-2017 The OpenLDAP Foundation. 7 * Portions Copyright 2001-2003 Pierangelo Masarati. 8 * Portions Copyright 1999-2003 Howard Chu. 9 * All rights reserved. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted only as authorized by the OpenLDAP 13 * Public License. 14 * 15 * A copy of this license is available in the file LICENSE in the 16 * top-level directory of the distribution or, alternatively, at 17 * <http://www.OpenLDAP.org/license.html>. 18 */ 19 20 #include <sys/cdefs.h> 21 __RCSID("$NetBSD: init.c,v 1.1.1.7 2018/02/06 01:53:17 christos Exp $"); 22 23 #include "portable.h" 24 25 #include <stdio.h> 26 27 #include <ac/string.h> 28 #include <ac/socket.h> 29 30 #include "slap.h" 31 #include "config.h" 32 #include "../back-ldap/back-ldap.h" 33 #include "back-meta.h" 34 35 int 36 meta_back_open( 37 BackendInfo *bi ) 38 { 39 /* FIXME: need to remove the pagedResults, and likely more... */ 40 bi->bi_controls = slap_known_controls; 41 42 return 0; 43 } 44 45 int 46 meta_back_initialize( 47 BackendInfo *bi ) 48 { 49 bi->bi_flags = 50 #if 0 51 /* this is not (yet) set essentially because back-meta does not 52 * directly support extended operations... */ 53 #ifdef LDAP_DYNAMIC_OBJECTS 54 /* this is set because all the support a proxy has to provide 55 * is the capability to forward the refresh exop, and to 56 * pass thru entries that contain the dynamicObject class 57 * and the entryTtl attribute */ 58 SLAP_BFLAG_DYNAMIC | 59 #endif /* LDAP_DYNAMIC_OBJECTS */ 60 #endif 61 62 /* back-meta recognizes RFC4525 increment; 63 * let the remote server complain, if needed (ITS#5912) */ 64 SLAP_BFLAG_INCREMENT; 65 66 bi->bi_open = meta_back_open; 67 bi->bi_config = 0; 68 bi->bi_close = 0; 69 bi->bi_destroy = 0; 70 71 bi->bi_db_init = meta_back_db_init; 72 bi->bi_db_config = config_generic_wrapper; 73 bi->bi_db_open = meta_back_db_open; 74 bi->bi_db_close = 0; 75 bi->bi_db_destroy = meta_back_db_destroy; 76 77 bi->bi_op_bind = meta_back_bind; 78 bi->bi_op_unbind = 0; 79 bi->bi_op_search = meta_back_search; 80 bi->bi_op_compare = meta_back_compare; 81 bi->bi_op_modify = meta_back_modify; 82 bi->bi_op_modrdn = meta_back_modrdn; 83 bi->bi_op_add = meta_back_add; 84 bi->bi_op_delete = meta_back_delete; 85 bi->bi_op_abandon = 0; 86 87 bi->bi_extended = 0; 88 89 bi->bi_chk_referrals = 0; 90 91 bi->bi_connection_init = 0; 92 bi->bi_connection_destroy = meta_back_conn_destroy; 93 94 return meta_back_init_cf( bi ); 95 } 96 97 int 98 meta_back_db_init( 99 Backend *be, 100 ConfigReply *cr) 101 { 102 metainfo_t *mi; 103 int i; 104 BackendInfo *bi; 105 106 bi = backend_info( "ldap" ); 107 if ( !bi || !bi->bi_extra ) { 108 Debug( LDAP_DEBUG_ANY, 109 "meta_back_db_init: needs back-ldap\n", 110 0, 0, 0 ); 111 return 1; 112 } 113 114 mi = ch_calloc( 1, sizeof( metainfo_t ) ); 115 if ( mi == NULL ) { 116 return -1; 117 } 118 119 /* set default flags */ 120 mi->mi_flags = 121 META_BACK_F_DEFER_ROOTDN_BIND 122 | META_BACK_F_PROXYAUTHZ_ALWAYS 123 | META_BACK_F_PROXYAUTHZ_ANON 124 | META_BACK_F_PROXYAUTHZ_NOANON; 125 126 /* 127 * At present the default is no default target; 128 * this may change 129 */ 130 mi->mi_defaulttarget = META_DEFAULT_TARGET_NONE; 131 mi->mi_bind_timeout.tv_sec = 0; 132 mi->mi_bind_timeout.tv_usec = META_BIND_TIMEOUT; 133 134 mi->mi_rebind_f = meta_back_default_rebind; 135 mi->mi_urllist_f = meta_back_default_urllist; 136 137 ldap_pvt_thread_mutex_init( &mi->mi_conninfo.lai_mutex ); 138 ldap_pvt_thread_mutex_init( &mi->mi_cache.mutex ); 139 140 /* safe default */ 141 mi->mi_nretries = META_RETRY_DEFAULT; 142 mi->mi_version = LDAP_VERSION3; 143 144 for ( i = LDAP_BACK_PCONN_FIRST; i < LDAP_BACK_PCONN_LAST; i++ ) { 145 mi->mi_conn_priv[ i ].mic_num = 0; 146 LDAP_TAILQ_INIT( &mi->mi_conn_priv[ i ].mic_priv ); 147 } 148 mi->mi_conn_priv_max = LDAP_BACK_CONN_PRIV_DEFAULT; 149 150 mi->mi_ldap_extra = (ldap_extra_t *)bi->bi_extra; 151 152 be->be_private = mi; 153 be->be_cf_ocs = be->bd_info->bi_cf_ocs; 154 155 return 0; 156 } 157 158 int 159 meta_target_finish( 160 metainfo_t *mi, 161 metatarget_t *mt, 162 const char *log, 163 char *msg, 164 size_t msize 165 ) 166 { 167 slap_bindconf sb = { BER_BVNULL }; 168 struct berval mapped; 169 int rc; 170 171 ber_str2bv( mt->mt_uri, 0, 0, &sb.sb_uri ); 172 sb.sb_version = mt->mt_version; 173 sb.sb_method = LDAP_AUTH_SIMPLE; 174 BER_BVSTR( &sb.sb_binddn, "" ); 175 176 if ( META_BACK_TGT_T_F_DISCOVER( mt ) ) { 177 rc = slap_discover_feature( &sb, 178 slap_schema.si_ad_supportedFeatures->ad_cname.bv_val, 179 LDAP_FEATURE_ABSOLUTE_FILTERS ); 180 if ( rc == LDAP_COMPARE_TRUE ) { 181 mt->mt_flags |= LDAP_BACK_F_T_F; 182 } 183 } 184 185 if ( META_BACK_TGT_CANCEL_DISCOVER( mt ) ) { 186 rc = slap_discover_feature( &sb, 187 slap_schema.si_ad_supportedExtension->ad_cname.bv_val, 188 LDAP_EXOP_CANCEL ); 189 if ( rc == LDAP_COMPARE_TRUE ) { 190 mt->mt_flags |= LDAP_BACK_F_CANCEL_EXOP; 191 } 192 } 193 194 if ( !( mt->mt_idassert_flags & LDAP_BACK_AUTH_OVERRIDE ) 195 || mt->mt_idassert_authz != NULL ) 196 { 197 mi->mi_flags &= ~META_BACK_F_PROXYAUTHZ_ALWAYS; 198 } 199 200 if ( ( mt->mt_idassert_flags & LDAP_BACK_AUTH_AUTHZ_ALL ) 201 && !( mt->mt_idassert_flags & LDAP_BACK_AUTH_PRESCRIPTIVE ) ) 202 { 203 snprintf( msg, msize, 204 "%s: inconsistent idassert configuration " 205 "(likely authz=\"*\" used with \"non-prescriptive\" flag)", 206 log ); 207 Debug( LDAP_DEBUG_ANY, "%s (target %s)\n", 208 msg, mt->mt_uri, 0 ); 209 return 1; 210 } 211 212 if ( !( mt->mt_idassert_flags & LDAP_BACK_AUTH_AUTHZ_ALL ) ) 213 { 214 mi->mi_flags &= ~META_BACK_F_PROXYAUTHZ_ANON; 215 } 216 217 if ( ( mt->mt_idassert_flags & LDAP_BACK_AUTH_PRESCRIPTIVE ) ) 218 { 219 mi->mi_flags &= ~META_BACK_F_PROXYAUTHZ_NOANON; 220 } 221 222 BER_BVZERO( &mapped ); 223 ldap_back_map( &mt->mt_rwmap.rwm_at, 224 &slap_schema.si_ad_entryDN->ad_cname, &mapped, 225 BACKLDAP_REMAP ); 226 if ( BER_BVISNULL( &mapped ) || mapped.bv_val[0] == '\0' ) { 227 mt->mt_rep_flags |= REP_NO_ENTRYDN; 228 } 229 230 BER_BVZERO( &mapped ); 231 ldap_back_map( &mt->mt_rwmap.rwm_at, 232 &slap_schema.si_ad_subschemaSubentry->ad_cname, &mapped, 233 BACKLDAP_REMAP ); 234 if ( BER_BVISNULL( &mapped ) || mapped.bv_val[0] == '\0' ) { 235 mt->mt_rep_flags |= REP_NO_SUBSCHEMA; 236 } 237 238 return 0; 239 } 240 241 int 242 meta_back_db_open( 243 Backend *be, 244 ConfigReply *cr ) 245 { 246 metainfo_t *mi = (metainfo_t *)be->be_private; 247 char msg[SLAP_TEXT_BUFLEN]; 248 249 int i, rc; 250 251 if ( mi->mi_ntargets == 0 ) { 252 /* Dynamically added, nothing to check here until 253 * some targets get added 254 */ 255 if ( slapMode & SLAP_SERVER_RUNNING ) 256 return 0; 257 258 Debug( LDAP_DEBUG_ANY, 259 "meta_back_db_open: no targets defined\n", 260 0, 0, 0 ); 261 return 1; 262 } 263 264 for ( i = 0; i < mi->mi_ntargets; i++ ) { 265 metatarget_t *mt = mi->mi_targets[ i ]; 266 267 if ( meta_target_finish( mi, mt, 268 "meta_back_db_open", msg, sizeof( msg ))) 269 return 1; 270 } 271 272 return 0; 273 } 274 275 /* 276 * meta_back_conn_free() 277 * 278 * actually frees a connection; the reference count must be 0, 279 * and it must not (or no longer) be in the cache. 280 */ 281 void 282 meta_back_conn_free( 283 void *v_mc ) 284 { 285 metaconn_t *mc = v_mc; 286 int ntargets; 287 288 assert( mc != NULL ); 289 assert( mc->mc_refcnt == 0 ); 290 291 /* at least one must be present... */ 292 ntargets = mc->mc_info->mi_ntargets; 293 assert( ntargets > 0 ); 294 295 for ( ; ntargets--; ) { 296 (void)meta_clear_one_candidate( NULL, mc, ntargets ); 297 } 298 299 if ( !BER_BVISNULL( &mc->mc_local_ndn ) ) { 300 free( mc->mc_local_ndn.bv_val ); 301 } 302 303 free( mc ); 304 } 305 306 static void 307 mapping_free( 308 void *v_mapping ) 309 { 310 struct ldapmapping *mapping = v_mapping; 311 ch_free( mapping->src.bv_val ); 312 ch_free( mapping->dst.bv_val ); 313 ch_free( mapping ); 314 } 315 316 static void 317 mapping_dst_free( 318 void *v_mapping ) 319 { 320 struct ldapmapping *mapping = v_mapping; 321 322 if ( BER_BVISEMPTY( &mapping->dst ) ) { 323 mapping_free( &mapping[ -1 ] ); 324 } 325 } 326 327 void 328 meta_back_map_free( struct ldapmap *lm ) 329 { 330 avl_free( lm->remap, mapping_dst_free ); 331 avl_free( lm->map, mapping_free ); 332 lm->remap = NULL; 333 lm->map = NULL; 334 } 335 336 static void 337 target_free( 338 metatarget_t *mt ) 339 { 340 if ( mt->mt_uri ) { 341 free( mt->mt_uri ); 342 ldap_pvt_thread_mutex_destroy( &mt->mt_uri_mutex ); 343 } 344 if ( mt->mt_subtree ) { 345 meta_subtree_destroy( mt->mt_subtree ); 346 mt->mt_subtree = NULL; 347 } 348 if ( mt->mt_filter ) { 349 meta_filter_destroy( mt->mt_filter ); 350 mt->mt_filter = NULL; 351 } 352 if ( !BER_BVISNULL( &mt->mt_psuffix ) ) { 353 free( mt->mt_psuffix.bv_val ); 354 } 355 if ( !BER_BVISNULL( &mt->mt_nsuffix ) ) { 356 free( mt->mt_nsuffix.bv_val ); 357 } 358 if ( !BER_BVISNULL( &mt->mt_binddn ) ) { 359 free( mt->mt_binddn.bv_val ); 360 } 361 if ( !BER_BVISNULL( &mt->mt_bindpw ) ) { 362 free( mt->mt_bindpw.bv_val ); 363 } 364 if ( !BER_BVISNULL( &mt->mt_idassert_authcID ) ) { 365 ch_free( mt->mt_idassert_authcID.bv_val ); 366 } 367 if ( !BER_BVISNULL( &mt->mt_idassert_authcDN ) ) { 368 ch_free( mt->mt_idassert_authcDN.bv_val ); 369 } 370 if ( !BER_BVISNULL( &mt->mt_idassert_passwd ) ) { 371 ch_free( mt->mt_idassert_passwd.bv_val ); 372 } 373 if ( !BER_BVISNULL( &mt->mt_idassert_authzID ) ) { 374 ch_free( mt->mt_idassert_authzID.bv_val ); 375 } 376 if ( !BER_BVISNULL( &mt->mt_idassert_sasl_mech ) ) { 377 ch_free( mt->mt_idassert_sasl_mech.bv_val ); 378 } 379 if ( !BER_BVISNULL( &mt->mt_idassert_sasl_realm ) ) { 380 ch_free( mt->mt_idassert_sasl_realm.bv_val ); 381 } 382 if ( mt->mt_idassert_authz != NULL ) { 383 ber_bvarray_free( mt->mt_idassert_authz ); 384 } 385 if ( mt->mt_rwmap.rwm_rw ) { 386 rewrite_info_delete( &mt->mt_rwmap.rwm_rw ); 387 if ( mt->mt_rwmap.rwm_bva_rewrite ) 388 ber_bvarray_free( mt->mt_rwmap.rwm_bva_rewrite ); 389 } 390 meta_back_map_free( &mt->mt_rwmap.rwm_oc ); 391 meta_back_map_free( &mt->mt_rwmap.rwm_at ); 392 ber_bvarray_free( mt->mt_rwmap.rwm_bva_map ); 393 394 free( mt ); 395 } 396 397 int 398 meta_back_db_destroy( 399 Backend *be, 400 ConfigReply *cr ) 401 { 402 metainfo_t *mi; 403 404 if ( be->be_private ) { 405 int i; 406 407 mi = ( metainfo_t * )be->be_private; 408 409 /* 410 * Destroy the connection tree 411 */ 412 ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex ); 413 414 if ( mi->mi_conninfo.lai_tree ) { 415 avl_free( mi->mi_conninfo.lai_tree, meta_back_conn_free ); 416 } 417 for ( i = LDAP_BACK_PCONN_FIRST; i < LDAP_BACK_PCONN_LAST; i++ ) { 418 while ( !LDAP_TAILQ_EMPTY( &mi->mi_conn_priv[ i ].mic_priv ) ) { 419 metaconn_t *mc = LDAP_TAILQ_FIRST( &mi->mi_conn_priv[ i ].mic_priv ); 420 421 LDAP_TAILQ_REMOVE( &mi->mi_conn_priv[ i ].mic_priv, mc, mc_q ); 422 meta_back_conn_free( mc ); 423 } 424 } 425 426 /* 427 * Destroy the per-target stuff (assuming there's at 428 * least one ...) 429 */ 430 if ( mi->mi_targets != NULL ) { 431 for ( i = 0; i < mi->mi_ntargets; i++ ) { 432 metatarget_t *mt = mi->mi_targets[ i ]; 433 434 if ( META_BACK_TGT_QUARANTINE( mt ) ) { 435 if ( mt->mt_quarantine.ri_num != mi->mi_quarantine.ri_num ) 436 { 437 mi->mi_ldap_extra->retry_info_destroy( &mt->mt_quarantine ); 438 } 439 440 ldap_pvt_thread_mutex_destroy( &mt->mt_quarantine_mutex ); 441 } 442 443 target_free( mt ); 444 } 445 446 free( mi->mi_targets ); 447 } 448 449 ldap_pvt_thread_mutex_lock( &mi->mi_cache.mutex ); 450 if ( mi->mi_cache.tree ) { 451 avl_free( mi->mi_cache.tree, meta_dncache_free ); 452 } 453 454 ldap_pvt_thread_mutex_unlock( &mi->mi_cache.mutex ); 455 ldap_pvt_thread_mutex_destroy( &mi->mi_cache.mutex ); 456 457 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex ); 458 ldap_pvt_thread_mutex_destroy( &mi->mi_conninfo.lai_mutex ); 459 460 if ( mi->mi_candidates != NULL ) { 461 ber_memfree_x( mi->mi_candidates, NULL ); 462 } 463 464 if ( META_BACK_QUARANTINE( mi ) ) { 465 mi->mi_ldap_extra->retry_info_destroy( &mi->mi_quarantine ); 466 } 467 } 468 469 free( be->be_private ); 470 return 0; 471 } 472 473 #if SLAPD_META == SLAPD_MOD_DYNAMIC 474 475 /* conditionally define the init_module() function */ 476 SLAP_BACKEND_INIT_MODULE( meta ) 477 478 #endif /* SLAPD_META == SLAPD_MOD_DYNAMIC */ 479 480 481