389-ds-base/ldap/servers/slapd/extendop.c

/** BEGIN COPYRIGHT BLOCK
 * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission.
 * Copyright (C) 2005 Red Hat, Inc.
 * All rights reserved.
 *
 * License: GPL (version 3 or any later version).
 * See LICENSE for details. 
 * END COPYRIGHT BLOCK **/

#ifdef HAVE_CONFIG_H
#  include <config.h>
#endif

/* extendedop.c - handle an LDAPv3 extended operation */

#include <stdio.h>
#include "slap.h"

static const char *extended_op_oid2string( const char *oid );


/********** this stuff should probably be moved when it's done **********/

static void extop_handle_import_start(Slapi_PBlock *pb, char *extoid,
                                      struct berval *extval)
{
    char *orig = NULL;
    const char *suffix = NULL;
    Slapi_DN *sdn = NULL;
    Slapi_Backend *be = NULL;
    struct berval bv;
    int ret;

    if (extval == NULL || extval->bv_val == NULL) {
        LDAPDebug(LDAP_DEBUG_ANY,
                  "extop_handle_import_start: no data supplied\n", 0, 0, 0);
        send_ldap_result(pb, LDAP_OPERATIONS_ERROR, NULL, 
                         "no data supplied", 0, NULL);
        return;
    }
    orig = slapi_ch_malloc(extval->bv_len+1);
    strncpy(orig, extval->bv_val, extval->bv_len);
    orig[extval->bv_len] = 0;
    /* Check if we should be performing strict validation. */
    if (config_get_dn_validate_strict()) {
        /* check that the dn is formatted correctly */
        ret = slapi_dn_syntax_check(pb, orig, 1);
        if (ret) { /* syntax check failed */
            LDAPDebug1Arg(LDAP_DEBUG_ANY,
                          "extop_handle_import_start: strict: invalid suffix\n",
                          orig);
            send_ldap_result(pb, LDAP_INVALID_DN_SYNTAX, NULL,
                             "invalid suffix", 0, NULL);
            return;
        }
    }
    sdn = slapi_sdn_new_dn_passin(orig);
    if (!sdn) {
        LDAPDebug(LDAP_DEBUG_ANY,
                  "extop_handle_import_start: out of memory\n", 0, 0, 0);
        send_ldap_result(pb, LDAP_OPERATIONS_ERROR, NULL, NULL, 0, NULL);
        return;
    }
    suffix = slapi_sdn_get_dn(sdn);
    /*    be = slapi_be_select(sdn); */
    be = slapi_mapping_tree_find_backend_for_sdn(sdn);
    if (be == NULL || be == defbackend_get_backend()) {
        /* might be instance name instead of suffix */
        be = slapi_be_select_by_instance_name(suffix);
    }
    if (be == NULL || be == defbackend_get_backend()) {
        LDAPDebug(LDAP_DEBUG_ANY,
                  "bulk import: invalid suffix or instance name '%s'\n",
                  suffix, 0, 0);
        send_ldap_result(pb, LDAP_NO_SUCH_OBJECT, NULL, 
                         "invalid suffix or instance name", 0, NULL);
        goto out;
    }

    slapi_pblock_set(pb, SLAPI_BACKEND, be);
	slapi_pblock_set( pb, SLAPI_REQUESTOR_ISROOT, &pb->pb_op->o_isroot );
	
	{
		/* Access Control Check to see if the client is
		 *  allowed to use task import
		 */
		char *dummyAttr = "dummy#attr";
		char *dummyAttrs[2] = { NULL, NULL };
		int rc = 0;
		char dn[128];
		Slapi_Entry *feature;

		/* slapi_str2entry modify its dn parameter so we must copy
		 * this string each time we call it !
		 */
		/* This dn is no need to be normalized. */
		PR_snprintf(dn, sizeof(dn), "dn: oid=%s,cn=features,cn=config",
			EXTOP_BULK_IMPORT_START_OID);

		dummyAttrs[0] = dummyAttr;
		feature = slapi_str2entry(dn, 0);
		rc = plugin_call_acl_plugin (pb, feature, dummyAttrs, NULL,
			 SLAPI_ACL_WRITE, ACLPLUGIN_ACCESS_DEFAULT, NULL);
		slapi_entry_free(feature);
		if (rc != LDAP_SUCCESS)
		{
			/* Client isn't allowed to do this. */
			send_ldap_result(pb, rc, NULL, NULL, 0, NULL);
			goto out;
		}
	}

    if (be->be_wire_import == NULL) {
        /* not supported by this backend */
        LDAPDebug(LDAP_DEBUG_ANY,
                  "bulk import attempted on '%s' (not supported)\n",
                  suffix, 0, 0);
        send_ldap_result(pb, LDAP_NOT_SUPPORTED, NULL, NULL, 0, NULL);
        goto out;
    }

    ret = SLAPI_UNIQUEID_GENERATE_TIME_BASED;
    slapi_pblock_set(pb, SLAPI_LDIF2DB_GENERATE_UNIQUEID, &ret);
    ret = SLAPI_BI_STATE_START;
    slapi_pblock_set(pb, SLAPI_BULK_IMPORT_STATE, &ret);
    ret = (*be->be_wire_import)(pb);
    if (ret != 0) {
        LDAPDebug(LDAP_DEBUG_ANY,
                  "extop_handle_import_start: error starting import (%d)\n",
                  ret, 0, 0);
        send_ldap_result(pb, LDAP_OPERATIONS_ERROR, NULL, NULL, 0, NULL);
        goto out;
    }

    /* okay, the import is starting now -- save the backend in the
     * connection block & mark this connection as belonging to a bulk import
     */
    PR_EnterMonitor(pb->pb_conn->c_mutex);
    pb->pb_conn->c_flags |= CONN_FLAG_IMPORT;
    pb->pb_conn->c_bi_backend = be;
    PR_ExitMonitor(pb->pb_conn->c_mutex);

    slapi_pblock_set(pb, SLAPI_EXT_OP_RET_OID, EXTOP_BULK_IMPORT_START_OID);
    bv.bv_val = NULL;
    bv.bv_len = 0;
    slapi_pblock_set(pb, SLAPI_EXT_OP_RET_VALUE, &bv);
    send_ldap_result(pb, LDAP_SUCCESS, NULL, NULL, 0, NULL);
    LDAPDebug(LDAP_DEBUG_ANY,
              "Bulk import: begin import on '%s'.\n", suffix, 0, 0);

out:
    slapi_sdn_free(&sdn);
    return;
}

static void extop_handle_import_done(Slapi_PBlock *pb, char *extoid,
                                     struct berval *extval)
{
    Slapi_Backend *be;
    struct berval bv;
    int ret;

    PR_EnterMonitor(pb->pb_conn->c_mutex);
    pb->pb_conn->c_flags &= ~CONN_FLAG_IMPORT;
    be = pb->pb_conn->c_bi_backend;
    pb->pb_conn->c_bi_backend = NULL;
    PR_ExitMonitor(pb->pb_conn->c_mutex);

    if ((be == NULL) || (be->be_wire_import == NULL)) {
        /* can this even happen? */
        LDAPDebug(LDAP_DEBUG_ANY,
                  "extop_handle_import_done: backend not supported\n",
                  0, 0, 0);
        send_ldap_result(pb, LDAP_NOT_SUPPORTED, NULL, NULL, 0, NULL);
        return;
    }

    /* signal "done" to the backend */
    slapi_pblock_set(pb, SLAPI_BACKEND, be);
    slapi_pblock_set(pb, SLAPI_BULK_IMPORT_ENTRY, NULL);
    ret = SLAPI_BI_STATE_DONE;
    slapi_pblock_set(pb, SLAPI_BULK_IMPORT_STATE, &ret);
    ret = (*be->be_wire_import)(pb);
    if (ret != 0) {
        LDAPDebug(LDAP_DEBUG_ANY,
                  "bulk import: error ending import (%d)\n",
                  ret, 0, 0);
        send_ldap_result(pb, LDAP_OPERATIONS_ERROR, NULL, NULL, 0, NULL);
        return;
    }

    /* more goofiness */
    slapi_pblock_set(pb, SLAPI_EXT_OP_RET_OID, EXTOP_BULK_IMPORT_DONE_OID);
    bv.bv_val = NULL;
    bv.bv_len = 0;
    slapi_pblock_set(pb, SLAPI_EXT_OP_RET_VALUE, &bv);
    send_ldap_result(pb, LDAP_SUCCESS, NULL, NULL, 0, NULL);
    LDAPDebug(LDAP_DEBUG_ANY,
              "Bulk import completed successfully.\n", 0, 0, 0);
    return;
}


void
do_extended( Slapi_PBlock *pb )
{
	char		*extoid = NULL,	*errmsg;
	struct berval	extval = {0};
	int		lderr, rc;
	ber_len_t	len;
	ber_tag_t	tag;
	const char	*name;

	LDAPDebug( LDAP_DEBUG_TRACE, "do_extended\n", 0, 0, 0 );

	/*
	 * Parse the extended request. It looks like this:
	 *
	 *	ExtendedRequest := [APPLICATION 23] SEQUENCE {
	 *		requestName	[0]	LDAPOID,
	 *		requestValue	[1]	OCTET STRING OPTIONAL
	 *	}
	 */

	if ( ber_scanf( pb->pb_op->o_ber, "{a", &extoid )
	    == LBER_ERROR ) {
		LDAPDebug( LDAP_DEBUG_ANY,
		    "ber_scanf failed (op=extended; params=OID)\n",
		    0, 0, 0 );
		op_shared_log_error_access (pb, "EXT", "???", "decoding error: fail to get extension OID");
		send_ldap_result( pb, LDAP_PROTOCOL_ERROR, NULL, "decoding error", 0,
		    NULL );
		goto free_and_return;
	}
	tag = ber_peek_tag(pb->pb_op->o_ber, &len);

	if (tag == LDAP_TAG_EXOP_REQ_VALUE) {
		if ( ber_scanf( pb->pb_op->o_ber, "o}", &extval ) == LBER_ERROR ) {
			op_shared_log_error_access (pb, "EXT", "???", "decoding error: fail to get extension value");
			send_ldap_result( pb, LDAP_PROTOCOL_ERROR, NULL, "decoding error", 0,
							  NULL );
			goto free_and_return;
		}
	} else {
		if ( ber_scanf( pb->pb_op->o_ber, "}") == LBER_ERROR ) {
			op_shared_log_error_access (pb, "EXT", "???", "decoding error"); 
			send_ldap_result( pb, LDAP_PROTOCOL_ERROR, NULL, "decoding error", 0,
							  NULL );
			goto free_and_return;
		}
	}
	if ( NULL == ( name = extended_op_oid2string( extoid ))) {
		LDAPDebug( LDAP_DEBUG_ARGS, "do_extended: oid (%s)\n", extoid, 0, 0 );

		slapi_log_access( LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " op=%d EXT oid=\"%s\"\n",
				pb->pb_conn->c_connid, pb->pb_op->o_opid, extoid );
	} else {
		LDAPDebug( LDAP_DEBUG_ARGS, "do_extended: oid (%s-%s)\n",
				extoid, name, 0 );

		slapi_log_access( LDAP_DEBUG_STATS,
			"conn=%" NSPRIu64 " op=%d EXT oid=\"%s\" name=\"%s\"\n",
			pb->pb_conn->c_connid, pb->pb_op->o_opid, extoid, name );
	}

	/* during a bulk import, only BULK_IMPORT_DONE is allowed! 
	 * (and this is the only time it's allowed)
	 */
	if (pb->pb_conn->c_flags & CONN_FLAG_IMPORT) {
		if (strcmp(extoid, EXTOP_BULK_IMPORT_DONE_OID) != 0) {
			send_ldap_result(pb, LDAP_PROTOCOL_ERROR, NULL, NULL, 0, NULL);
			goto free_and_return;
		}
		extop_handle_import_done(pb, extoid, &extval);
		goto free_and_return;
	}
	
	if (strcmp(extoid, EXTOP_BULK_IMPORT_START_OID) == 0) {
		extop_handle_import_start(pb, extoid, &extval);
		goto free_and_return;
	}

	if (strcmp(extoid, START_TLS_OID) != 0) {
		int minssf = config_get_minssf();

		/* If anonymous access is disabled and we haven't
		 * authenticated yet, only allow startTLS. */
		if ((config_get_anon_access_switch() != SLAPD_ANON_ACCESS_ON) && ((pb->pb_op->o_authtype == NULL) ||
    		        (strcasecmp(pb->pb_op->o_authtype, SLAPD_AUTH_NONE) == 0))) {
			send_ldap_result( pb, LDAP_INAPPROPRIATE_AUTH, NULL,
				"Anonymous access is not allowed.", 0, NULL );
			goto free_and_return;
		}

		/* If the minssf is not met, only allow startTLS. */
		if ((pb->pb_conn->c_sasl_ssf < minssf) && (pb->pb_conn->c_ssl_ssf < minssf) &&
		    (pb->pb_conn->c_local_ssf < minssf)) {
			send_ldap_result( pb, LDAP_UNWILLING_TO_PERFORM, NULL,
				"Minimum SSF not met.", 0, NULL );
			goto free_and_return;
		}
	}

	/* If a password change is required, only allow the password
	 * modify extended operation */
	if (!pb->pb_conn->c_isreplication_session &&
                pb->pb_conn->c_needpw && (strcmp(extoid, EXTOP_PASSWD_OID) != 0))
	{
		char *dn = NULL;
		slapi_pblock_get(pb, SLAPI_CONN_DN, &dn);

		(void)slapi_add_pwd_control ( pb, LDAP_CONTROL_PWEXPIRED, 0);
		op_shared_log_error_access (pb, "EXT", dn ? dn : "", "need new password");
		send_ldap_result( pb, LDAP_UNWILLING_TO_PERFORM, NULL, NULL, 0, NULL );

		slapi_ch_free_string(&dn);
		goto free_and_return;
	}

	/* decode the optional controls - put them in the pblock */
	if ( (lderr = get_ldapmessage_controls( pb, pb->pb_op->o_ber, NULL )) != 0 )
	{
		char *dn = NULL;
		slapi_pblock_get(pb, SLAPI_CONN_DN, &dn);

		op_shared_log_error_access (pb, "EXT", dn ? dn : "", "failed to decode LDAP controls");
		send_ldap_result( pb, lderr, NULL, NULL, 0, NULL );

		slapi_ch_free_string(&dn);
		goto free_and_return;
	}

	slapi_pblock_set( pb, SLAPI_EXT_OP_REQ_OID, extoid );
	slapi_pblock_set( pb, SLAPI_EXT_OP_REQ_VALUE, &extval );
	slapi_pblock_set( pb, SLAPI_REQUESTOR_ISROOT, &pb->pb_op->o_isroot);

    /* wibrown 201603 I want to rewrite this to get plugin p, and use that 
     * rather than all these plugin_call_, that loop over the plugin lists
     * We do "get plugin (oid).
     * then we just hand *p into the call functions.
     * much more efficient! :)
     */
	
    slapi_log_error(SLAPI_LOG_TRACE, NULL, "extendop.c calling plugins ... \n");

	rc = plugin_call_exop_plugins( pb, extoid, SLAPI_PLUGIN_EXTENDEDOP);

    slapi_log_error(SLAPI_LOG_TRACE, NULL, "extendop.c called exop, got %d \n", rc);

    if (rc == SLAPI_PLUGIN_EXTENDED_NOT_HANDLED) {
        slapi_log_error(SLAPI_LOG_TRACE, NULL, "extendop.c calling betxn plugins ... \n");
        /* Look up the correct backend to use. */
        Slapi_Backend *be = plugin_extended_op_getbackend( pb, extoid );

        if ( be == NULL ) {
            slapi_log_error(SLAPI_LOG_FATAL, NULL, "extendop.c plugin_extended_op_getbackend was unable to retrieve a backend!!!\n");
            rc = SLAPI_PLUGIN_EXTENDED_NO_BACKEND_AVAILABLE;
        } else {
            /* We need to make a new be pb here because when you set SLAPI_BACKEND
             * you overwrite the plg parts of the pb. So if we re-use pb
             * you actually nuke the request, and everything hangs. (╯°□°)╯︵ ┻━┻
             */
            Slapi_PBlock *be_pb = NULL;
            be_pb = slapi_pblock_new();
            slapi_pblock_set(be_pb, SLAPI_BACKEND, be);

            int txn_rc = slapi_back_transaction_begin(be_pb);
            if (txn_rc) {
                slapi_log_error(SLAPI_LOG_FATAL, NULL, "exendop.c Failed to start be_txn for plugin_call_exop_plugins %d\n", txn_rc);
            } else {
                rc = plugin_call_exop_plugins( pb, extoid, SLAPI_PLUGIN_BETXNEXTENDEDOP);
                slapi_log_error(SLAPI_LOG_TRACE, NULL, "extendop.c called betxn exop, got %d \n", rc);
                if (rc == LDAP_SUCCESS || rc == SLAPI_PLUGIN_EXTENDED_SENT_RESULT) {
                    /* commit */
                    txn_rc = slapi_back_transaction_commit(be_pb);
                    if (txn_rc == 0) {
                        slapi_log_error(SLAPI_LOG_TRACE, NULL, "extendop.c commit with result %d \n", txn_rc);
                    } else {
                        slapi_log_error(SLAPI_LOG_FATAL, NULL, "extendop.c Unable to commit commit with result %d \n", txn_rc);
                    }
                } else {
                    /* abort */
                    txn_rc = slapi_back_transaction_abort(be_pb);
                    slapi_log_error(SLAPI_LOG_FATAL, NULL, "extendop.c abort with result %d \n", txn_rc);
                }
            } /* txn_rc */
            if (be_pb != NULL) {
                slapi_pblock_destroy(be_pb); /* Clean up after ourselves */
            }
            slapi_log_error(SLAPI_LOG_TRACE, NULL, "exendop.c plugin_call_exop_plugins rc final %d\n", rc);
        } /* if be */
    }

	if ( SLAPI_PLUGIN_EXTENDED_SENT_RESULT != rc ) {
		if ( SLAPI_PLUGIN_EXTENDED_NOT_HANDLED == rc ) {
			lderr = LDAP_PROTOCOL_ERROR;	/* no plugin handled the op */
			errmsg = "unsupported extended operation";
		} else {
			errmsg = NULL;
			lderr = rc;
		}
		send_ldap_result( pb, lderr, NULL, errmsg, 0, NULL );
	}
free_and_return:
	if (extoid)
		slapi_ch_free((void **)&extoid);
	if (extval.bv_val)
		slapi_ch_free((void **)&extval.bv_val);
	return;
}


static const char *
extended_op_oid2string( const char *oid )
{
	const char *rval = NULL;

	if ( 0 == strcmp(oid, EXTOP_BULK_IMPORT_START_OID)) {
		rval = "Bulk Import Start";
	} else if ( 0 == strcmp(oid, EXTOP_BULK_IMPORT_DONE_OID)) {
		rval = "Bulk Import End";
	} else {
		rval = plugin_extended_op_oid2string( oid );
	}

	return( rval );
}