lastmod.c

ldap服务器源码

/* lastmod.c - returns last modification info */
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
 *
 * Copyright 2004-2007 The OpenLDAP Foundation.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted only as authorized by the OpenLDAP
 * Public License.
 *
 * A copy of this license is available in the file LICENSE in the
 * top-level directory of the distribution or, alternatively, at
 * <http://www.OpenLDAP.org/license.html>.
 */
/* ACKNOWLEDGEMENTS:
 * This work was initially developed by Pierangelo Masarati for inclusion in
 * OpenLDAP Software.
 */

#include "portable.h"

#ifdef SLAPD_OVER_LASTMOD

#include <stdio.h>

#include <ac/string.h>
#include <ac/socket.h>

#include "slap.h"
#include "lutil.h"

typedef struct lastmod_info_t {
	struct berval		lmi_rdnvalue;
	Entry			*lmi_e;
	ldap_pvt_thread_mutex_t	lmi_entry_mutex;
	int			lmi_enabled;
} lastmod_info_t;

struct lastmod_schema_t {
	ObjectClass		*lms_oc_lastmod;
	AttributeDescription	*lms_ad_lastmodDN;
	AttributeDescription	*lms_ad_lastmodType;
	AttributeDescription	*lms_ad_lastmodEnabled;
} lastmod_schema;

enum lastmodType_e {
	LASTMOD_ADD = 0,
	LASTMOD_DELETE,
	LASTMOD_EXOP,
	LASTMOD_MODIFY,
	LASTMOD_MODRDN,
	LASTMOD_UNKNOWN
};

struct berval lastmodType[] = {
	BER_BVC( "add" ),
	BER_BVC( "delete" ),
	BER_BVC( "exop" ),
	BER_BVC( "modify" ),
	BER_BVC( "modrdn" ),
	BER_BVC( "unknown" ),
	BER_BVNULL
};

static struct m_s {
	char			*name;
	char			*schema;
	slap_mask_t 		flags;
	int			offset;
} moc[] = {
	{ "lastmod", "( 1.3.6.1.4.1.4203.666.3.13"
		"NAME 'lastmod' "
		"DESC 'OpenLDAP per-database last modification monitoring' "
		"STRUCTURAL "
		"SUP top "
		"MUST cn "
		"MAY ( "
			"lastmodDN "
			"$ lastmodType "
			"$ description "
			"$ seeAlso "
		") )", SLAP_OC_OPERATIONAL|SLAP_OC_HIDE,
		offsetof( struct lastmod_schema_t, lms_oc_lastmod ) },
	{ NULL }
}, mat[] = {
	{ "lastmodDN", "( 1.3.6.1.4.1.4203.666.1.28"
		"NAME 'lastmodDN' "
		"DESC 'DN of last modification' "
		"EQUALITY distinguishedNameMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 "
		"NO-USER-MODIFICATION "
		"USAGE directoryOperation )", SLAP_AT_HIDE,
		offsetof( struct lastmod_schema_t, lms_ad_lastmodDN ) },
	{ "lastmodType", "( 1.3.6.1.4.1.4203.666.1.29"
		"NAME 'lastmodType' "
		"DESC 'Type of last modification' "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 "
		"EQUALITY caseIgnoreMatch "
		"SINGLE-VALUE "
		"NO-USER-MODIFICATION "
		"USAGE directoryOperation )", SLAP_AT_HIDE,
		offsetof( struct lastmod_schema_t, lms_ad_lastmodType ) },
	{ "lastmodEnabled", "( 1.3.6.1.4.1.4203.666.1.30"
		"NAME 'lastmodEnabled' "
		"DESC 'Lastmod overlay state' "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 "
		"EQUALITY booleanMatch "
		"SINGLE-VALUE )", 0,
		offsetof( struct lastmod_schema_t, lms_ad_lastmodEnabled ) },
	{ NULL }

	/* FIXME: what about UUID of last modified entry? */
};

static int
lastmod_search( Operation *op, SlapReply *rs )
{
	slap_overinst		*on = (slap_overinst *)op->o_bd->bd_info;
	lastmod_info_t		*lmi = (lastmod_info_t *)on->on_bi.bi_private;
	int			rc;

	/* if we get here, it must be a success */
	rs->sr_err = LDAP_SUCCESS;

	ldap_pvt_thread_mutex_lock( &lmi->lmi_entry_mutex );

	rc = test_filter( op, lmi->lmi_e, op->oq_search.rs_filter );
	if ( rc == LDAP_COMPARE_TRUE ) {
		rs->sr_attrs = op->ors_attrs;
		rs->sr_flags = 0;
		rs->sr_entry = lmi->lmi_e;
		rs->sr_err = send_search_entry( op, rs );
		rs->sr_entry = NULL;
		rs->sr_flags = 0;
		rs->sr_attrs = NULL;
	}

	ldap_pvt_thread_mutex_unlock( &lmi->lmi_entry_mutex );

	send_ldap_result( op, rs );

	return 0;
}

static int
lastmod_compare( Operation *op, SlapReply *rs )
{
	slap_overinst		*on = (slap_overinst *)op->o_bd->bd_info;
	lastmod_info_t		*lmi = (lastmod_info_t *)on->on_bi.bi_private;
	Attribute		*a;

	ldap_pvt_thread_mutex_lock( &lmi->lmi_entry_mutex );

	if ( get_assert( op ) &&
		( test_filter( op, lmi->lmi_e, get_assertion( op ) ) != LDAP_COMPARE_TRUE ) )
	{
		rs->sr_err = LDAP_ASSERTION_FAILED;
		goto return_results;
	}

	rs->sr_err = access_allowed( op, lmi->lmi_e, op->oq_compare.rs_ava->aa_desc,
		&op->oq_compare.rs_ava->aa_value, ACL_COMPARE, NULL );
	if ( ! rs->sr_err ) {
		rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
		goto return_results;
	}

	rs->sr_err = LDAP_NO_SUCH_ATTRIBUTE;

	for ( a = attr_find( lmi->lmi_e->e_attrs, op->oq_compare.rs_ava->aa_desc );
		a != NULL;
		a = attr_find( a->a_next, op->oq_compare.rs_ava->aa_desc ) )
	{
		rs->sr_err = LDAP_COMPARE_FALSE;

		if ( value_find_ex( op->oq_compare.rs_ava->aa_desc,
			SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH |
				SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH,
			a->a_nvals, &op->oq_compare.rs_ava->aa_value, op->o_tmpmemctx ) == 0 )
		{
			rs->sr_err = LDAP_COMPARE_TRUE;
			break;
		}
	}

return_results:;

	ldap_pvt_thread_mutex_unlock( &lmi->lmi_entry_mutex );

	send_ldap_result( op, rs );

	if( rs->sr_err == LDAP_COMPARE_FALSE || rs->sr_err == LDAP_COMPARE_TRUE ) {
		rs->sr_err = LDAP_SUCCESS;
	}

	return rs->sr_err;
}

static int
lastmod_exop( Operation *op, SlapReply *rs )
{
	slap_overinst		*on = (slap_overinst *)op->o_bd->bd_info;

	/* Temporary */

	op->o_bd->bd_info = (BackendInfo *)on->on_info;
	rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
	rs->sr_text = "not allowed within namingContext";
	send_ldap_result( op, rs );
	rs->sr_text = NULL;
	
	return -1;
}

static int
lastmod_modify( Operation *op, SlapReply *rs )
{
	slap_overinst		*on = (slap_overinst *)op->o_bd->bd_info;
	lastmod_info_t		*lmi = (lastmod_info_t *)on->on_bi.bi_private;
	Modifications		*ml;

	ldap_pvt_thread_mutex_lock( &lmi->lmi_entry_mutex );

	if ( !acl_check_modlist( op, lmi->lmi_e, op->orm_modlist ) ) {
		rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
		goto cleanup;
	}

	for ( ml = op->orm_modlist; ml; ml = ml->sml_next ) {
		Attribute	*a;

		if ( ml->sml_desc != lastmod_schema.lms_ad_lastmodEnabled ) {
			continue;
		}

		if ( ml->sml_op != LDAP_MOD_REPLACE ) {
			rs->sr_text = "unsupported mod type";
			rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
			goto cleanup;
		}
		
		a = attr_find( lmi->lmi_e->e_attrs, ml->sml_desc );

		if ( a == NULL ) {
			rs->sr_text = "lastmod overlay internal error";
			rs->sr_err = LDAP_OTHER;
			goto cleanup;
		}

		ch_free( a->a_vals[ 0 ].bv_val );
		ber_dupbv( &a->a_vals[ 0 ], &ml->sml_values[ 0 ] );
		if ( a->a_nvals ) {
			ch_free( a->a_nvals[ 0 ].bv_val );
			if ( ml->sml_nvalues && !BER_BVISNULL( &ml->sml_nvalues[ 0 ] ) ) {
				ber_dupbv( &a->a_nvals[ 0 ], &ml->sml_nvalues[ 0 ] );
			} else {
				ber_dupbv( &a->a_nvals[ 0 ], &ml->sml_values[ 0 ] );
			}
		}

		if ( strcmp( ml->sml_values[ 0 ].bv_val, "TRUE" ) == 0 ) {
			lmi->lmi_enabled = 1;
		} else if ( strcmp( ml->sml_values[ 0 ].bv_val, "FALSE" ) == 0 ) {
			lmi->lmi_enabled = 0;
		} else {
			assert( 0 );
		}
	}

	rs->sr_err = LDAP_SUCCESS;

cleanup:;
	ldap_pvt_thread_mutex_unlock( &lmi->lmi_entry_mutex );

	send_ldap_result( op, rs );
	rs->sr_text = NULL;

	return rs->sr_err;
}

static int
lastmod_op_func( Operation *op, SlapReply *rs )
{
	slap_overinst		*on = (slap_overinst *)op->o_bd->bd_info;
	lastmod_info_t		*lmi = (lastmod_info_t *)on->on_bi.bi_private;
	Modifications		*ml;

	if ( dn_match( &op->o_req_ndn, &lmi->lmi_e->e_nname ) ) {
		switch ( op->o_tag ) {
		case LDAP_REQ_SEARCH:
			if ( op->ors_scope != LDAP_SCOPE_BASE ) {
				goto return_referral;
			}
			/* process */
			return lastmod_search( op, rs );

		case LDAP_REQ_COMPARE:
			return lastmod_compare( op, rs );

		case LDAP_REQ_EXTENDED:
			/* if write, reject; otherwise process */
			if ( exop_is_write( op )) {
				rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
				rs->sr_text = "not allowed within namingContext";
				goto return_error;
			}
			return lastmod_exop( op, rs );

		case LDAP_REQ_MODIFY:
			/* allow only changes to overlay status */
			for ( ml = op->orm_modlist; ml; ml = ml->sml_next ) {
				if ( ad_cmp( ml->sml_desc, slap_schema.si_ad_modifiersName ) != 0
						&& ad_cmp( ml->sml_desc, slap_schema.si_ad_modifyTimestamp ) != 0
						&& ad_cmp( ml->sml_desc, slap_schema.si_ad_entryCSN ) != 0
						&& ad_cmp( ml->sml_desc, lastmod_schema.lms_ad_lastmodEnabled ) != 0 )
				{
					rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
					rs->sr_text = "not allowed within namingContext";
					goto return_error;
				}
			}
			return lastmod_modify( op, rs );

		default:
			rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
			rs->sr_text = "not allowed within namingContext";
			goto return_error;
		}
	}

	if ( dnIsSuffix( &op->o_req_ndn, &lmi->lmi_e->e_nname ) ) {
		goto return_referral;
	}

	return SLAP_CB_CONTINUE;

return_referral:;
	op->o_bd->bd_info = (BackendInfo *)on->on_info;
	rs->sr_ref = referral_rewrite( default_referral,
			NULL, &op->o_req_dn, op->ors_scope );

	if ( !rs->sr_ref ) {
		rs->sr_ref = default_referral;
	}
	rs->sr_err = LDAP_REFERRAL;
	send_ldap_result( op, rs );

	if ( rs->sr_ref != default_referral ) {
		ber_bvarray_free( rs->sr_ref );
	}
	rs->sr_ref = NULL;

	return -1;

return_error:;
	op->o_bd->bd_info = (BackendInfo *)on->on_info;
	send_ldap_result( op, rs );
	rs->sr_text = NULL;

	return -1;
}

static int
best_guess( Operation *op,
		struct berval *bv_entryCSN, struct berval *bv_nentryCSN,
		struct berval *bv_modifyTimestamp, struct berval *bv_nmodifyTimestamp,
		struct berval *bv_modifiersName, struct berval *bv_nmodifiersName )
{
	if ( bv_entryCSN ) {
		char		csnbuf[ LDAP_LUTIL_CSNSTR_BUFSIZE ];
		struct berval	entryCSN;
	
		entryCSN.bv_val = csnbuf;
		entryCSN.bv_len = sizeof( csnbuf );
		slap_get_csn( NULL, &entryCSN, 0 );

		ber_dupbv( bv_entryCSN, &entryCSN );
		ber_dupbv( bv_nentryCSN, &entryCSN );
	}

	if ( bv_modifyTimestamp ) {
		char		tmbuf[ LDAP_LUTIL_GENTIME_BUFSIZE ];
		struct berval timestamp;
		time_t		currtime;

		/* best guess */
#if 0
		currtime = slap_get_time();
#endif
		/* maybe we better use the time the operation was initiated */
		currtime = op->o_time;

		timestamp.bv_val = tmbuf;
		timestamp.bv_len = sizeof(tmbuf);
		slap_timestamp( &currtime, &timestamp );

		ber_dupbv( bv_modifyTimestamp, &timestamp );
		ber_dupbv( bv_nmodifyTimestamp, bv_modifyTimestamp );
	}

	if ( bv_modifiersName ) {
		/* best guess */
		ber_dupbv( bv_modifiersName, &op->o_dn );
		ber_dupbv( bv_nmodifiersName, &op->o_ndn );
	}

	return 0;
}

static int
lastmod_update( Operation *op, SlapReply *rs )
{
	slap_overinst		*on = (slap_overinst *)op->o_bd->bd_info;
	lastmod_info_t		*lmi = (lastmod_info_t *)on->on_bi.bi_private;
	Attribute		*a;
	Modifications		*ml = NULL;
	struct berval		bv_entryCSN = BER_BVNULL,
				bv_nentryCSN = BER_BVNULL,
				bv_modifyTimestamp = BER_BVNULL,
				bv_nmodifyTimestamp = BER_BVNULL,
				bv_modifiersName = BER_BVNULL,
				bv_nmodifiersName = BER_BVNULL,
				bv_name = BER_BVNULL,
				bv_nname = BER_BVNULL;
	enum lastmodType_e	lmt = LASTMOD_UNKNOWN;
	Entry			*e = NULL;
	int			rc = -1;

	/* FIXME: timestamp? modifier? */
	switch ( op->o_tag ) {
	case LDAP_REQ_ADD:
		lmt = LASTMOD_ADD;
		e = op->ora_e;
		a = attr_find( e->e_attrs, slap_schema.si_ad_entryCSN );
		if ( a != NULL ) {
			ber_dupbv( &bv_entryCSN, &a->a_vals[0] );
			if ( a->a_nvals && !BER_BVISNULL( &a->a_nvals[0] ) ) {
				ber_dupbv( &bv_nentryCSN, &a->a_nvals[0] );
			} else {
				ber_dupbv( &bv_nentryCSN, &a->a_vals[0] );
			}
		}
		a = attr_find( e->e_attrs, slap_schema.si_ad_modifyTimestamp );
		if ( a != NULL ) {
			ber_dupbv( &bv_modifyTimestamp, &a->a_vals[0] );
			if ( a->a_nvals && !BER_BVISNULL( &a->a_nvals[0] ) ) {
				ber_dupbv( &bv_nmodifyTimestamp, &a->a_nvals[0] );
			} else {
				ber_dupbv( &bv_nmodifyTimestamp, &a->a_vals[0] );
			}
		}
		a = attr_find( e->e_attrs, slap_schema.si_ad_modifiersName );
		if ( a != NULL ) {
			ber_dupbv( &bv_modifiersName, &a->a_vals[0] );
			ber_dupbv( &bv_nmodifiersName, &a->a_nvals[0] );
		}
		ber_dupbv( &bv_name, &e->e_name );
		ber_dupbv( &bv_nname, &e->e_nname );
		break;

	case LDAP_REQ_DELETE:
		lmt = LASTMOD_DELETE;

		best_guess( op, &bv_entryCSN, &bv_nentryCSN,
				&bv_modifyTimestamp, &bv_nmodifyTimestamp,
				&bv_modifiersName, &bv_nmodifiersName );

		ber_dupbv( &bv_name, &op->o_req_dn );
		ber_dupbv( &bv_nname, &op->o_req_ndn );
		break;

	case LDAP_REQ_EXTENDED:
		lmt = LASTMOD_EXOP;

		/* actually, password change is wrapped around a backend 
		 * call to modify, so it never shows up as an exop... */
		best_guess( op, &bv_entryCSN, &bv_nentryCSN,
				&bv_modifyTimestamp, &bv_nmodifyTimestamp,
				&bv_modifiersName, &bv_nmodifiersName );

		ber_dupbv( &bv_name, &op->o_req_dn );
		ber_dupbv( &bv_nname, &op->o_req_ndn );
		break;

	case LDAP_REQ_MODIFY:
		lmt = LASTMOD_MODIFY;
		rc = 3;

		for ( ml = op->orm_modlist; ml; ml = ml->sml_next ) {
			if ( ad_cmp( ml->sml_desc , slap_schema.si_ad_modifiersName ) == 0 ) {
				ber_dupbv( &bv_modifiersName, &ml->sml_values[0] );
				ber_dupbv( &bv_nmodifiersName, &ml->sml_nvalues[0] );

				rc--;
				if ( !rc ) {
					break;
				}

			} else if ( ad_cmp( ml->sml_desc, slap_schema.si_ad_entryCSN ) == 0 ) {
				ber_dupbv( &bv_entryCSN, &ml->sml_values[0] );
				if ( ml->sml_nvalues && !BER_BVISNULL( &ml->sml_nvalues[0] ) ) {
					ber_dupbv( &bv_nentryCSN, &ml->sml_nvalues[0] );
				} else {
					ber_dupbv( &bv_nentryCSN, &ml->sml_values[0] );
				}

				rc --;
				if ( !rc ) {
					break;
				}

			} else if ( ad_cmp( ml->sml_desc, slap_schema.si_ad_modifyTimestamp ) == 0 ) {
				ber_dupbv( &bv_modifyTimestamp, &ml->sml_values[0] );
				if ( ml->sml_nvalues && !BER_BVISNULL( &ml->sml_nvalues[0] ) ) {