1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2015 Gary Mills 23 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 #include <strings.h> 28 #include <sys/types.h> 29 #include <sys/stat.h> 30 #include <errno.h> 31 #include <stdio.h> 32 #include <rpcsvc/nis.h> 33 #include <rpc/xdr.h> 34 35 #include "ldap_util.h" 36 #include "ldap_attr.h" 37 #include "ldap_ruleval.h" 38 #include "ldap_op.h" 39 #include "ldap_map.h" 40 #include "ldap_glob.h" 41 #include "ldap_xdr.h" 42 #include "ldap_val.h" 43 44 /* From yptol/dit_access_utils.h */ 45 #define N2LKEY "rf_key" 46 #define N2LIPKEY "rf_ipkey" 47 48 __nis_hash_table_mt ldapMappingList = NIS_HASH_TABLE_MT_INIT; 49 extern int yp2ldap; 50 51 52 int 53 setColumnNames(__nis_table_mapping_t *t) { 54 int i, j, nic, noc; 55 char **col; 56 zotypes type; 57 char *myself = "setColumnNames"; 58 59 if (t == 0) 60 return (0); 61 62 type = t->objType; 63 col = t->column; 64 nic = (col != 0) ? t->numColumns : -1; 65 66 t->objType = NIS_BOGUS_OBJ; 67 t->obj = 0; 68 69 /* 70 * If it's a table object, but there are no translation rules, 71 * this mapping is for the table object itself. In that case, 72 * we throw away the column names (if any). 73 */ 74 if (t->objType == NIS_TABLE_OBJ && t->numRulesFromLDAP == 0 && 75 t->numRulesToLDAP == 0) { 76 for (i = 0; i < t->numColumns; i++) 77 sfree(t->column[i]); 78 sfree(t->column); 79 t->column = 0; 80 t->numColumns = 0; 81 noc = 0; 82 } 83 84 /* 85 * Verify that all column names found by the parser 86 * are present in the actual column list. 87 */ 88 if (verbose) { 89 for (i = 0, noc = 0; i < nic; i++) { 90 int found = 0; 91 92 if (col[i] == 0) 93 continue; 94 /* Skip the 'zo_*' special column names */ 95 if (isObjAttrString(col[i])) 96 continue; 97 for (j = 0; j < t->numColumns; j++) { 98 if (strcmp(col[i], t->column[j]) == 0) { 99 noc++; 100 found = 1; 101 break; 102 } 103 } 104 if (!found) { 105 logmsg(MSG_NOTIMECHECK, LOG_WARNING, 106 "%s: No column \"%s\" in \"%s\"", 107 myself, NIL(col[i]), NIL(t->objName)); 108 } 109 } 110 } 111 112 /* Remove any setup by the parser */ 113 for (i = 0; i < nic; i++) { 114 sfree(col[i]); 115 } 116 sfree(col); 117 118 return (0); 119 } 120 121 void 122 freeSingleObjAttr(__nis_obj_attr_t *attr) { 123 if (attr == 0) 124 return; 125 126 sfree(attr->zo_owner); 127 sfree(attr->zo_group); 128 sfree(attr->zo_domain); 129 sfree(attr); 130 } 131 132 void 133 freeObjAttr(__nis_obj_attr_t **attr, int numAttr) { 134 int i; 135 136 if (attr == 0) 137 return; 138 139 for (i = 0; i < numAttr; i++) { 140 freeSingleObjAttr(attr[i]); 141 } 142 143 sfree(attr); 144 } 145 146 __nis_obj_attr_t * 147 cloneObjAttr(__nis_obj_attr_t *old) { 148 __nis_obj_attr_t *new; 149 char *myself = "cloneObjAttr"; 150 151 if (old == 0) 152 return (0); 153 154 new = am(myself, sizeof (*new)); 155 if (new == 0) 156 return (0); 157 158 new->zo_owner = sdup(myself, T, old->zo_owner); 159 if (new->zo_owner == 0 && old->zo_owner != 0) 160 goto cleanup; 161 162 new->zo_group = sdup(myself, T, old->zo_group); 163 if (new->zo_group == 0 && old->zo_group != 0) 164 goto cleanup; 165 166 new->zo_domain = sdup(myself, T, old->zo_domain); 167 if (new->zo_domain == 0 && old->zo_domain != 0) 168 goto cleanup; 169 170 new->zo_access = old->zo_access; 171 new->zo_ttl = old->zo_ttl; 172 173 return (new); 174 175 cleanup: 176 freeSingleObjAttr(new); 177 178 return (0); 179 } 180 181 182 /* 183 * Obtain NIS+ entries (in the form of db_query's) from the supplied table 184 * mapping and db_query. 185 * 186 * If 'qin' is NULL, enumeration is desired. 187 * 188 * On exit, '*numQueries' contains the number of (db_query *)'s in the 189 * return array, '*ldapStat' the LDAP operation status, and '*objAttr' 190 * a pointer to an array (of '*numQueries elements) of object attributes 191 * (zo_owner, etc.). If no object attributes were retrieved, '*objAttr' 192 * is NULL; any and all of the (*objAttr)[i]'s may be NULL. 193 */ 194 db_query ** 195 mapFromLDAP(__nis_table_mapping_t *t, db_query *qin, int *numQueries, 196 char *dbId, int *ldapStat, __nis_obj_attr_t ***objAttr) { 197 __nis_table_mapping_t **tp; 198 db_query **q; 199 __nis_rule_value_t *rv; 200 __nis_ldap_search_t *ls; 201 int n, numVals, numMatches = 0; 202 int stat; 203 __nis_obj_attr_t **attr; 204 char *myself = "mapFromLDAP"; 205 206 if (ldapStat == 0) 207 ldapStat = &stat; 208 209 if (t == 0 || numQueries == 0) { 210 *ldapStat = LDAP_PARAM_ERROR; 211 return (0); 212 } 213 214 /* Select the correct table mapping(s) */ 215 tp = selectTableMapping(t, qin, 0, 0, dbId, &numMatches); 216 if (tp == 0 || numMatches <= 0) { 217 /* 218 * Not really an error; just no matching mapping 219 * for the query. 220 */ 221 *ldapStat = LDAP_SUCCESS; 222 return (0); 223 } 224 225 q = 0; 226 attr = 0; 227 228 /* For each mapping */ 229 for (numVals = 0, n = 0; n < numMatches; n++) { 230 db_query **qt; 231 int i, nqt = 0, filterOnQin, res = 0; 232 233 t = tp[n]; 234 235 if (qin != 0) { 236 rv = buildNisPlusRuleValue(t, qin, 0); 237 if (rv != 0) { 238 /* 239 * Depending on the value of res, we shall 240 * proceed to next table mapping. 241 */ 242 ls = createLdapRequest(t, rv, 0, 1, &res, NULL); 243 } 244 else 245 ls = 0; 246 } else { 247 /* Build enumeration request */ 248 rv = 0; 249 ls = createLdapRequest(t, 0, 0, 1, NULL, NULL); 250 } 251 252 freeRuleValue(rv, 1); 253 254 if (ls == 0) { 255 /* 256 * if the res is NP_LDAP_RULES_NO_VALUE, that means we 257 * have enough NIS+ columns for the rules to produce 258 * values, but none of them did, so continue to the 259 * next table mapping. Otherwise do cleanup and return 260 * error. 261 */ 262 if (res == NP_LDAP_RULES_NO_VALUE) 263 continue; 264 for (i = 0; i < numVals; i++) 265 freeQuery(q[i]); 266 sfree(q); 267 free(tp); 268 *ldapStat = LDAP_OPERATIONS_ERROR; 269 return (0); 270 } 271 272 /* Query LDAP */ 273 nqt = (ls->isDN || qin != 0) ? 0 : -1; 274 rv = ldapSearch(ls, &nqt, 0, ldapStat); 275 276 /* 277 * If qin != 0, then we need to make sure that the 278 * LDAP search is filtered so that only entries that 279 * are compatible with 'qin' are retained. This will 280 * happen automatically if we do a DN search (in which 281 * case, no need to filter on 'qin'). 282 */ 283 if (ls->isDN || qin == 0) 284 filterOnQin = 0; 285 else 286 filterOnQin = 1; 287 288 freeLdapSearch(ls); 289 290 /* Convert rule-values to db_query's */ 291 if (rv != 0 && nqt > 0) { 292 int nrv = nqt; 293 __nis_obj_attr_t **at = 0; 294 295 qt = ruleValue2Query(t, rv, 296 (filterOnQin) ? qin : 0, &at, &nqt); 297 freeRuleValue(rv, nrv); 298 299 if (qt != 0 && q == 0) { 300 q = qt; 301 attr = at; 302 numVals = nqt; 303 } else if (qt != 0) { 304 db_query **tmp; 305 __nis_obj_attr_t **atmp; 306 307 /* Extend the 'q' array */ 308 tmp = realloc(q, 309 (numVals+nqt) * sizeof (q[0])); 310 /* ... and the 'attr' array */ 311 atmp = realloc(attr, 312 (numVals+nqt) * sizeof (attr[0])); 313 if (tmp == 0 || atmp == 0) { 314 logmsg(MSG_NOMEM, LOG_ERR, 315 "%s: realloc(%d) => NULL", 316 myself, 317 (numVals+nqt) * sizeof (q[0])); 318 for (i = 0; i < numVals; i++) 319 freeQuery(q[i]); 320 for (i = 0; i < nqt; i++) 321 freeQuery(qt[i]); 322 sfree(tmp); 323 sfree(atmp); 324 sfree(q); 325 sfree(qt); 326 sfree(tp); 327 freeObjAttr(at, nqt); 328 freeObjAttr(attr, numVals); 329 *ldapStat = LDAP_NO_MEMORY; 330 return (0); 331 } 332 q = tmp; 333 attr = atmp; 334 /* Add the results for this 't' */ 335 (void) memcpy(&q[numVals], qt, 336 nqt * sizeof (qt[0])); 337 (void) memcpy(&attr[numVals], at, 338 nqt * sizeof (at[0])); 339 numVals += nqt; 340 341 sfree(qt); 342 sfree(at); 343 } 344 } 345 } 346 347 *numQueries = numVals; 348 if (objAttr != 0) 349 *objAttr = attr; 350 else 351 freeObjAttr(attr, numVals); 352 sfree(tp); 353 354 return (q); 355 } 356 357 /* 358 * Add the object attributes (zo_owner, etc.) to the rule-value 'rv'. 359 * Returns a pointer to the (possibly newly allocated) rule-value, 360 * or NULL in case of failure. If not returning 'rvIn', the latter 361 * will have been freed. 362 */ 363 __nis_rule_value_t * 364 addObjAttr2RuleValue(nis_object *obj, __nis_rule_value_t *rvIn) { 365 __nis_rule_value_t *rv; 366 char abuf[2 * sizeof (obj->zo_access) + 1]; 367 char tbuf[2 * sizeof (obj->zo_ttl) + 1]; 368 369 if (obj == 0) 370 return (0); 371 372 if (rvIn != 0) { 373 rv = rvIn; 374 } else { 375 rv = initRuleValue(1, 0); 376 if (rv == 0) 377 return (0); 378 } 379 380 if (obj->zo_owner != 0) { 381 if (addSCol2RuleValue("zo_owner", obj->zo_owner, rv) != 0) { 382 freeRuleValue(rv, 1); 383 return (0); 384 } 385 } 386 387 if (obj->zo_group != 0) { 388 if (addSCol2RuleValue("zo_group", obj->zo_group, rv) != 0) { 389 freeRuleValue(rv, 1); 390 return (0); 391 } 392 } 393 394 if (obj->zo_domain != 0) { 395 if (addSCol2RuleValue("zo_domain", obj->zo_domain, rv) != 0) { 396 freeRuleValue(rv, 1); 397 return (0); 398 } 399 } 400 401 (void) memset(abuf, 0, sizeof (abuf)); 402 (void) memset(tbuf, 0, sizeof (tbuf)); 403 404 sprintf(abuf, "%x", obj->zo_access); 405 sprintf(tbuf, "%x", obj->zo_ttl); 406 407 if (addSCol2RuleValue("zo_access", abuf, rv) != 0) { 408 freeRuleValue(rv, 1); 409 return (0); 410 } 411 if (addSCol2RuleValue("zo_ttl", tbuf, rv) != 0) { 412 freeRuleValue(rv, 1); 413 return (0); 414 } 415 416 return (rv); 417 } 418 419 /* 420 * Returns a pointer to (NOT a copy of) the value for the specified 421 * column 'col' in the rule-value 'rv'. 422 */ 423 __nis_value_t * 424 findColValue(char *col, __nis_rule_value_t *rv) { 425 int i; 426 427 if (col == 0 || rv == 0 || rv->numColumns <= 0) 428 return (0); 429 430 for (i = 0; i < rv->numColumns; i++) { 431 if (strcmp(col, rv->colName[i]) == 0) 432 return (&rv->colVal[i]); 433 } 434 435 return (0); 436 } 437 438 /* 439 * Return the NIS+ object attributes (if any) in the rule-value 'rv'. 440 */ 441 __nis_obj_attr_t * 442 ruleValue2ObjAttr(__nis_rule_value_t *rv) { 443 __nis_obj_attr_t *attr; 444 __nis_value_t *val; 445 char *myself = "ruleValue2ObjAttr"; 446 447 if (rv == 0 || rv->numColumns <= 0) 448 return (0); 449 450 attr = am(myself, sizeof (*attr)); 451 452 if ((val = findColValue("zo_owner", rv)) != 0 && 453 val->type == vt_string && val->numVals == 1 && 454 val->val[0].value != 0) { 455 attr->zo_owner = sdup(myself, T, val->val[0].value); 456 if (attr->zo_owner == 0) { 457 freeSingleObjAttr(attr); 458 return (0); 459 } 460 } 461 462 if ((val = findColValue("zo_group", rv)) != 0 && 463 val->type == vt_string && val->numVals == 1 && 464 val->val[0].value != 0) { 465 attr->zo_group = sdup(myself, T, val->val[0].value); 466 if (attr->zo_group == 0) { 467 freeSingleObjAttr(attr); 468 return (0); 469 } 470 } 471 472 if ((val = findColValue("zo_domain", rv)) != 0 && 473 val->type == vt_string && val->numVals == 1 && 474 val->val[0].value != 0) { 475 attr->zo_domain = sdup(myself, T, val->val[0].value); 476 if (attr->zo_domain == 0) { 477 freeSingleObjAttr(attr); 478 return (0); 479 } 480 } 481 482 if ((val = findColValue("zo_access", rv)) != 0 && 483 val->type == vt_string && val->numVals == 1 && 484 val->val[0].value != 0) { 485 if (sscanf(val->val[0].value, "%x", &attr->zo_access) != 1) { 486 freeSingleObjAttr(attr); 487 return (0); 488 } 489 } 490 491 if ((val = findColValue("zo_ttl", rv)) != 0 && 492 val->type == vt_string && val->numVals == 1 && 493 val->val[0].value != 0) { 494 if (sscanf(val->val[0].value, "%x", &attr->zo_ttl) != 1) { 495 freeSingleObjAttr(attr); 496 return (0); 497 } 498 } 499 500 return (attr); 501 } 502 503 /* 504 * If the supplied string is one of the object attributes, return one. 505 * Otherwise, return zero. 506 */ 507 int 508 isObjAttrString(char *str) { 509 if (str == 0) 510 return (0); 511 512 if (strcmp("zo_owner", str) == 0 || 513 strcmp("zo_group", str) == 0 || 514 strcmp("zo_domain", str) == 0 || 515 strcmp("zo_access", str) == 0 || 516 strcmp("zo_ttl", str) == 0) 517 return (1); 518 else 519 return (0); 520 } 521 522 523 /* 524 * If the supplied value is one of the object attribute strings, return 525 * a pointer to the string. Otherwise, return NULL. 526 */ 527 char * 528 isObjAttr(__nis_single_value_t *val) { 529 if (val == 0 || val->length <= 0 || val->value == 0) 530 return (0); 531 532 if (isObjAttrString(val->value)) 533 return (val->value); 534 else 535 return (0); 536 } 537 538 int 539 setObjAttrField(char *attrName, __nis_single_value_t *val, 540 __nis_obj_attr_t **objAttr) { 541 __nis_obj_attr_t *attr; 542 char *myself = "setObjAttrField"; 543 544 if (attrName == 0 || val == 0 || objAttr == 0 || 545 val->value == 0 || val->length <= 0) 546 return (-1); 547 548 if (*objAttr != 0) { 549 attr = *objAttr; 550 } else { 551 attr = am(myself, sizeof (*attr)); 552 if (attr == 0) 553 return (-2); 554 *objAttr = attr; 555 } 556 557 if (strcmp("zo_owner", attrName) == 0) { 558 if (attr->zo_owner == 0) { 559 attr->zo_owner = sdup(myself, T, val->value); 560 if (attr->zo_owner == 0) 561 return (-11); 562 } 563 } else if (strcmp("zo_group", attrName) == 0) { 564 if (attr->zo_group == 0) { 565 attr->zo_group = sdup(myself, T, val->value); 566 if (attr->zo_group == 0) 567 return (-12); 568 } 569 } else if (strcmp("zo_domain", attrName) == 0) { 570 if (attr->zo_domain == 0) { 571 attr->zo_domain = sdup(myself, T, val->value); 572 if (attr->zo_domain == 0) 573 return (-13); 574 } 575 } else if (strcmp("zo_access", attrName) == 0) { 576 if (attr->zo_access == 0) { 577 if (sscanf(val->value, "%x", &attr->zo_access) != 1) 578 return (-14); 579 } 580 } else if (strcmp("zo_ttl", attrName) == 0) { 581 if (attr->zo_ttl == 0) { 582 if (sscanf(val->value, "%x", &attr->zo_ttl) != 1) 583 return (-15); 584 } 585 } 586 587 return (0); 588 } 589 590 /* 591 * Return a DN and rule-value for the supplied mapping, db_query's, and 592 * input rule-value. This function only works on a single mapping. See 593 * mapToLDAP() below for a description of the action depending on the 594 * values of 'old' and 'new'. 595 * 596 * If both 'old' and 'new' are supplied, and the modify would result 597 * in a change to the DN, '*oldDN' will contain the old DN. Otherwise 598 * (and normally), '*oldDN' will be NULL. 599 */ 600 char * 601 map1qToLDAP(__nis_table_mapping_t *t, db_query *old, db_query *new, 602 __nis_rule_value_t *rvIn, __nis_rule_value_t **rvOutP, 603 char **oldDnP) { 604 605 __nis_rule_value_t *rv, *rvt; 606 __nis_ldap_search_t *ls; 607 char *dn = 0, *oldDn = 0; 608 __nis_table_mapping_t del; 609 char *myself = "map1qToLDAP"; 610 611 if (t == 0 || (old == 0 && new == 0) || rvOutP == 0) 612 return (0); 613 614 /* 615 * If entry should be deleted, we look at the delete 616 * policy in the table mapping. Should it specify a 617 * rule set, we use that rule set to build a rule- 618 * value, and the delete actually becomes a modify 619 * operation. 620 */ 621 if (old != 0 && new == 0) { 622 if (t->objectDN->delDisp == dd_perDbId) { 623 /* 624 * The functions that build a rule-value from a 625 * rule set expect a __nis_table_mapping_t, but the 626 * rule set in the __nis_object_dn_t isn't of that 627 * form. So, build a pseudo-__nis_table_mapping_t that 628 * borrows heavily from 't'. 629 */ 630 del = *t; 631 632 del.numRulesToLDAP = del.objectDN->numDbIds; 633 del.ruleToLDAP = del.objectDN->dbId; 634 635 /* 636 * Do a modify with the pseudo-table 637 * mapping, and the 'old' db_query 638 * supplying input to the delete rule 639 * set. 640 */ 641 t = &del; 642 new = old; 643 } else if (t->objectDN->delDisp == dd_always) { 644 645 /* Nothing to do here; all handled below */ 646 647 } else if (t->objectDN->delDisp == dd_never) { 648 649 return (0); 650 651 } else { 652 653 logmsg(MSG_INVALIDDELDISP, LOG_WARNING, 654 "%s: Invalid delete disposition %d for \"%s\"", 655 myself, t->objectDN->delDisp, 656 NIL(t->dbId)); 657 return (0); 658 659 } 660 } 661 662 /* Make a copy of the input rule-value */ 663 if (rvIn != 0) { 664 rv = initRuleValue(1, rvIn); 665 if (rv == 0) 666 return (0); 667 } else { 668 rv = 0; 669 } 670 671 /* First get a rule-value from the supplied NIS+ entry. */ 672 rvt = rv; 673 rv = buildNisPlusRuleValue(t, ((old != 0) ? old : new), rvt); 674 freeRuleValue(rvt, 1); 675 if (rv == 0) { 676 logmsg(MSG_NORULEVALUE, LOG_WARNING, 677 "%s: No in-query rule-value derived for \"%s\"", 678 myself, NIL(t->dbId)); 679 return (0); 680 } 681 682 /* 683 * Create a request (really only care about the DN) from the 684 * supplied NIS+ entry data. 685 */ 686 ls = createLdapRequest(t, rv, &dn, 0, NULL, NULL); 687 if (ls == 0 || dn == 0) { 688 logmsg(MSG_NOTIMECHECK, LOG_ERR, 689 "%s: Unable to create LDAP request for %s: %s", 690 myself, NIL(t->dbId), 691 (dn != 0) ? dn : rvId(rv, mit_nisplus)); 692 sfree(dn); 693 freeLdapSearch(ls); 694 freeRuleValue(rv, 1); 695 return (0); 696 } 697 698 freeLdapSearch(ls); 699 700 if (new != 0) { 701 /* 702 * Create a rule-value from the new NIS+ entry. 703 * Don't want to mix in the rule-value derived 704 * from 'old', so delete it. However, we still 705 * want the owner, group, etc., from 'rvIn'. 706 */ 707 if (old != 0) { 708 freeRuleValue(rv, 1); 709 if (rvIn != 0) { 710 rv = initRuleValue(1, rvIn); 711 if (rv == 0) { 712 sfree(dn); 713 return (0); 714 } 715 } else { 716 rv = 0; 717 } 718 } 719 rvt = rv; 720 rv = buildNisPlusRuleValue(t, new, rvt); 721 freeRuleValue(rvt, 1); 722 if (rv == 0) { 723 logmsg(MSG_NORULEVALUE, LOG_WARNING, 724 "%s: No new rule-value derived for \"%s: %s\"", 725 myself, NIL(t->dbId), dn); 726 sfree(dn); 727 return (0); 728 } 729 /* 730 * Check if the proposed modification would result in a 731 * a change to the DN. 732 */ 733 if (old != 0) { 734 oldDn = dn; 735 dn = 0; 736 ls = createLdapRequest(t, rv, &dn, 0, NULL, NULL); 737 if (ls == 0 || dn == 0) { 738 logmsg(MSG_NOTIMECHECK, LOG_ERR, 739 "%s: Unable to create new DN for \"%s: %s\"", 740 myself, NIL(t->dbId), oldDn); 741 sfree(oldDn); 742 freeLdapSearch(ls); 743 freeRuleValue(rv, 1); 744 return (0); 745 } 746 freeLdapSearch(ls); 747 if (strcasecmp(oldDn, dn) == 0) { 748 sfree(oldDn); 749 oldDn = 0; 750 } 751 } 752 } 753 754 755 *rvOutP = rv; 756 if (oldDnP != 0) 757 *oldDnP = oldDn; 758 759 return (dn); 760 } 761 762 /* 763 * Since the DN hash list is an automatic variable, there's no need for 764 * locking, and we remove the locking overhead by using the libnsl 765 * hash functions. 766 */ 767 #undef NIS_HASH_ITEM 768 #undef NIS_HASH_TABLE 769 770 typedef struct { 771 NIS_HASH_ITEM item; 772 int index; 773 char *oldDn; 774 } __dn_item_t; 775 776 /* 777 * Update LDAP per the supplied table mapping and db_query's. 778 * 779 * 'nq' is the number of elements in the 'old', 'new', and 'rvIn' 780 * arrays. mapToLDAP() generally performs one update for each 781 * element; however, if one or more of the individual queries 782 * produce the same DN, they're merged into a single update. 783 * 784 * There are four cases, depending on the values of 'old[iq]' and 785 * 'new[iq]': 786 * 787 * (1) old[iq] == 0 && new[iq] == 0 788 * No action; skip to next query 789 * 790 * (2) old[iq] == 0 && new[iq] != 0 791 * Attempt to use the 'new' db_query to get a DN, and try to create 792 * the corresponding LDAP entry. 793 * 794 * (3) old[iq] != 0 && new[iq] == 0 795 * Use the 'old' db_query to get a DN, and try to delete the LDAP 796 * entry per the table mapping. 797 * 798 * (4) old[iq] != 0 && new[iq] != 0 799 * Use the 'old' db_query to get a DN, and update (possibly create) 800 * the corresponding LDAP entry per the 'new' db_query. 801 * 802 * If 'rvIn' is non-NULL, it is expected to contain the object attributes 803 * (zo_owner, etc.) to be written to LDAP. 'rvIn' is an array with 'nq' 804 * elements. 805 * 806 * If 'firstOnly' is set, only the first old[iq]/new[iq] pair is used 807 * to perform the actual update. Any additional queries specified will 808 * have their values folded in, but are not used to derive update targets. 809 * This mode is inteded to support the case where multiple NIS+ entries 810 * map to one and the same LDAP entry. Note that 'rvIn' must still be 811 * an array of 'nq' elements, though if 'firstOnly' is set, it should be 812 * OK to leave all but 'rvIn[0]' empty. 813 * 814 * 'dbId' is used to further narow down the selection of mapping candidates 815 * to those matching the 'dbId' value. 816 */ 817 int 818 mapToLDAP(__nis_table_mapping_t *tm, int nq, db_query **old, db_query **new, 819 __nis_rule_value_t *rvIn, int firstOnly, char *dbId) { 820 __nis_table_mapping_t **tp, **tpa; 821 int i, n, rnq, iq, r, ret = LDAP_SUCCESS; 822 int maxMatches, numMatches = 0; 823 __nis_ldap_search_t *ls; 824 char **dn = 0, **odn = 0; 825 __nis_rule_value_t **rv; 826 __dn_item_t *dni; 827 char *myself = "mapToLDAP"; 828 829 830 if (tm == 0 || (old == 0 && new == 0) || nq <= 0) 831 return (LDAP_PARAM_ERROR); 832 833 /* Determine maximum number of table mapping matches */ 834 if (nq == 1) { 835 tp = selectTableMapping(tm, 836 (old != 0 && old[0] != 0) ? old[0] : new[0], 1, 0, 837 dbId, &maxMatches); 838 numMatches = maxMatches; 839 } else { 840 tp = selectTableMapping(tm, 0, 1, 0, dbId, &maxMatches); 841 } 842 843 /* 844 * If no matching mapping, we're not mapping to LDAP in this 845 * particular case. 846 */ 847 if (tp == 0 || maxMatches == 0) { 848 sfree(tp); 849 return (LDAP_SUCCESS); 850 } 851 852 /* 853 * Allocate the 'rv', 'dn', and 'tpa' arrays. Worst case is that 854 * we need nq * maxMatches elements in each array. However, if 855 * 'firstOnly' is set, we only need one element per matching 856 * mapping in each. 857 */ 858 dn = am(myself, (firstOnly ? 1 : nq) * maxMatches * sizeof (dn[0])); 859 odn = am(myself, (firstOnly ? 1 : nq) * maxMatches * sizeof (odn[0])); 860 rv = am(myself, (firstOnly ? 1 : nq) * maxMatches * sizeof (rv[0])); 861 tpa = am(myself, (firstOnly ? 1 : nq) * maxMatches * sizeof (tpa[0])); 862 if (dn == 0 || odn == 0 || rv == 0 || tpa == 0) { 863 sfree(tp); 864 sfree(dn); 865 sfree(odn); 866 sfree(rv); 867 sfree(tpa); 868 return (LDAP_NO_MEMORY); 869 } 870 871 /* Unless nq == 1, we don't need the 'tp' value */ 872 if (nq != 1) 873 sfree(tp); 874 875 logmsg(MSG_NOTIMECHECK, 876 #ifdef NISDB_LDAP_DEBUG 877 LOG_WARNING, 878 #else 879 LOG_INFO, 880 #endif /* NISDB_LDAP_DEBUG */ 881 "%s: %s: %d * %d potential updates", 882 myself, NIL(tm->objName), nq, maxMatches); 883 884 /* 885 * Create DNs, column and attribute values, and merge duplicate DNs. 886 */ 887 for (iq = 0, rnq = 0; iq < nq; iq++) { 888 int idx; 889 890 if ((old == 0 || old[iq] == 0) && 891 (new == 0 || new[iq] == 0)) 892 continue; 893 894 /* 895 * Select matching table mappings; if nq == 1, we've already 896 * got the 'tp' array from above. We expect this to be the 897 * most common case, so it's worth special treatment. 898 */ 899 if (nq != 1) 900 tp = selectTableMapping(tm, 901 (old != 0 && old[iq] != 0) ? old[iq] : new[iq], 1, 0, 902 dbId, &numMatches); 903 if (tp == 0) 904 continue; 905 else if (numMatches <= 0) { 906 sfree(tp); 907 continue; 908 } 909 910 idx = iq * maxMatches; 911 912 if (idx == 0 || !firstOnly) 913 (void) memcpy(&tpa[idx], tp, 914 numMatches * sizeof (tpa[idx])); 915 916 for (n = 0; n < numMatches; n++) { 917 char *dnt, *odnt; 918 __nis_rule_value_t *rvt = 0; 919 920 if (tp[n] == 0) 921 continue; 922 923 dnt = map1qToLDAP(tp[n], 924 (old != 0) ? old[iq] : 0, 925 (new != 0) ? new[iq] : 0, 926 (rvIn != 0) ? &rvIn[iq] : 0, 927 &rvt, &odnt); 928 929 if (dnt == 0) 930 continue; 931 if (rvt == 0) { 932 #ifdef NISDB_LDAP_DEBUG 933 abort(); 934 #else 935 sfree(dnt); 936 sfree(odnt); 937 continue; 938 #endif /* NISDB_LDAP_DEBUG */ 939 } 940 941 /* 942 * Create a request to get a rule-value with 943 * NIS+ data translated to LDAP equivalents. 944 */ 945 ls = createLdapRequest(tp[n], rvt, 0, 0, NULL, NULL); 946 if (ls == 0) { 947 if (ret == LDAP_SUCCESS) 948 ret = LDAP_OPERATIONS_ERROR; 949 logmsg(MSG_NOTIMECHECK, LOG_WARNING, 950 "%s: Unable to map to LDAP attrs for %s:dn=%s", 951 myself, NIL(tp[n]->dbId), dnt); 952 sfree(dnt); 953 freeRuleValue(rvt, 1); 954 continue; 955 } 956 freeLdapSearch(ls); 957 958 /* 959 * If the DN is the same as one we already know 960 * about, merge the rule-values. 961 */ 962 963 if ((iq == 0 || !firstOnly) && dnt != 0) { 964 dni = am(myself, sizeof (*dni)); 965 if (dni != 0) { 966 dni->item.name = dnt; 967 dni->index = idx + n; 968 dni->oldDn = odnt; 969 } else { 970 logmsg(MSG_NOTIMECHECK, LOG_WARNING, 971 "%s: Skipping update for dn=\"%s\"", 972 myself, dnt); 973 sfree(dnt); 974 dnt = 0; 975 } 976 if (dnt != 0) { 977 dn[idx+n] = dnt; 978 odn[idx+n] = odnt; 979 rv[idx+n] = rvt; 980 rnq++; 981 } else { 982 freeRuleValue(rvt, 1); 983 rvt = 0; 984 } 985 } else if (dnt != 0) { 986 sfree(dnt); 987 sfree(odnt); 988 freeRuleValue(rvt, 1); 989 } 990 } 991 sfree(tp); 992 } 993 994 logmsg(MSG_NOTIMECHECK, 995 #ifdef NISDB_LDAP_DEBUG 996 LOG_WARNING, 997 #else 998 LOG_INFO, 999 #endif /* NISDB_LDAP_DEBUG */ 1000 "%s: %s: %d update%s requested", 1001 myself, NIL(tm->objName), rnq, rnq != 1 ? "s" : ""); 1002 1003 /* Perform the updates */ 1004 for (i = rnq = 0; i < (firstOnly ? maxMatches : nq*maxMatches); i++) { 1005 int delPerDbId; 1006 1007 if (dn[i] == 0) 1008 continue; 1009 1010 #ifdef NISDB_LDAP_DEBUG 1011 logmsg(MSG_NOTIMECHECK, LOG_INFO, 1012 "%s: %s %s:dn=%s", 1013 myself, 1014 (new != 0 && new[i/maxMatches] != 0) ? 1015 "modify" : "delete", 1016 NIL(tpa[i]->dbId), dn[i]); 1017 #endif /* NISDB_LDAP_DEBUG */ 1018 1019 delPerDbId = (tpa[i]->objectDN->delDisp == dd_perDbId); 1020 if ((new != 0 && new[i/maxMatches] != 0) || delPerDbId) { 1021 /* 1022 * Try to modify/create the specified DN. First, 1023 * however, if the update changes the DN, make 1024 * that change. 1025 */ 1026 if (odn[i] == 0 || (r = ldapChangeDN(odn[i], dn[i])) == 1027 LDAP_SUCCESS) { 1028 int addFirst; 1029 1030 addFirst = (new != 0 && 1031 new[i/maxMatches] != 0 && 1032 !delPerDbId); 1033 r = ldapModify(dn[i], rv[i], 1034 tpa[i]->objectDN->write.attrs, 1035 addFirst); 1036 } 1037 } else { 1038 /* Try to delete the specified DN */ 1039 r = ldapModify(dn[i], 0, 1040 tpa[i]->objectDN->write.attrs, 0); 1041 } 1042 1043 if (r == LDAP_SUCCESS) { 1044 rnq++; 1045 } else { 1046 if (ret == LDAP_SUCCESS) 1047 ret = r; 1048 logmsg(MSG_NOTIMECHECK, LOG_ERR, 1049 "%s: LDAP %s request error %d for %s:dn=%s", 1050 myself, 1051 (new != 0 && new[i/maxMatches] != 0) ? 1052 "modify" : "delete", 1053 r, NIL(tpa[i]->dbId), dn[i]); 1054 } 1055 1056 sfree(dn[i]); 1057 dn[i] = 0; 1058 freeRuleValue(rv[i], 1); 1059 rv[i] = 0; 1060 } 1061 1062 sfree(dn); 1063 sfree(odn); 1064 sfree(rv); 1065 sfree(tpa); 1066 1067 logmsg(MSG_NOTIMECHECK, 1068 #ifdef NISDB_LDAP_DEBUG 1069 LOG_WARNING, 1070 #else 1071 LOG_INFO, 1072 #endif /* NISDB_LDAP_DEBUG */ 1073 "%s: %s: %d update%s performed", 1074 myself, NIL(tm->objName), rnq, rnq != 1 ? "s" : ""); 1075 1076 return (ret); 1077 } 1078 1079 /* 1080 * In nis+2ldap, check if the query 'q' matches the selector index 'x->index'. 1081 * 1082 * In nis2ldap, if 'name' is provided then check if its value in 'val' 1083 * matches the selector index. If 'name' is NULL, then check if rule-value 'rv' 1084 * matches the index. 1085 * To match the selector index, all fieldspecs in the indexlist should match 1086 * (AND). In nis2ldap, an exception is, if there are multiple fieldspecs with 1087 * the same fieldname then only one of them needs to match (OR). 1088 * Example: 1089 * Indexlist = [host="H*", host="I*", user="U*", domain="D*"] 1090 * Then, 1091 * host = "H1", user="U1", domain="D1" ==> pass 1092 * host = "I1", user="U1", domain="D1" ==> pass 1093 * host = "X1", user="U1", domain="D1" ==> fail 1094 * host = "H1", user="X1", domain="D1" ==> fail 1095 * host = "H1", user="U1" ==> fail 1096 * 1097 * Return 1 in case of a match, 0 otherwise. 1098 */ 1099 int 1100 verifyIndexMatch(__nis_table_mapping_t *x, db_query *q, 1101 __nis_rule_value_t *rv, char *name, char *val) { 1102 int i, j, k, match = 1; 1103 char *myself = "verifyIndexMatch"; 1104 1105 /* 1106 * The pass and fail arrays are used by N2L to keep track of 1107 * index matches. This saves us from having matches in a 1108 * nested loop to decide OR or AND. 1109 */ 1110 int ppos, fpos; 1111 char **pass, **fail; 1112 1113 if (x == 0) 1114 return (0); 1115 1116 /* Trivial match */ 1117 if (x->index.numIndexes <= 0 || (!yp2ldap && q == 0)) 1118 return (1); 1119 1120 if (yp2ldap) { 1121 if (!(pass = am(myself, x->index.numIndexes * sizeof (char *)))) 1122 return (0); 1123 if (!(fail = am(myself, 1124 x->index.numIndexes * sizeof (char *)))) { 1125 sfree(pass); 1126 return (0); 1127 } 1128 ppos = fpos = 0; 1129 } 1130 1131 /* Check each index */ 1132 for (i = 0; i < x->index.numIndexes; i++) { 1133 int len = 0; 1134 char *value = 0; 1135 1136 /* Skip NULL index names */ 1137 if (x->index.name[i] == 0) 1138 continue; 1139 1140 /* Check N2L values */ 1141 if (yp2ldap) { 1142 if (name) { 1143 if (strcasecmp(x->index.name[i], name) == 0) 1144 value = val; 1145 else 1146 continue; 1147 } else if (rv) { 1148 if (strcasecmp(x->index.name[i], N2LKEY) == 0 || 1149 strcasecmp(x->index.name[i], N2LIPKEY) 1150 == 0) 1151 continue; 1152 value = findVal(x->index.name[i], rv, 1153 mit_nisplus); 1154 } 1155 1156 if (value && verifyMappingMatch(x->index.value[i], 1157 value)) 1158 pass[ppos++] = x->index.name[i]; 1159 else 1160 fail[fpos++] = x->index.name[i]; 1161 continue; 1162 } 1163 1164 /* If here, means nis+2ldap */ 1165 1166 /* Is the index name a known column ? */ 1167 for (j = 0; j < x->numColumns; j++) { 1168 if (strcmp(x->index.name[i], x->column[j]) == 0) { 1169 /* 1170 * Do we have a value for the column ? 1171 */ 1172 for (k = 0; k < q->components.components_len; 1173 k++) { 1174 if (q->components.components_val[k]. 1175 which_index == j) { 1176 value = q->components. 1177 components_val[k]. 1178 index_value-> 1179 itemvalue. 1180 itemvalue_val; 1181 len = q->components. 1182 components_val[k]. 1183 index_value-> 1184 itemvalue. 1185 itemvalue_len; 1186 break; 1187 } 1188 } 1189 if (value != 0) 1190 break; 1191 } 1192 } 1193 1194 /* 1195 * If we found a value, check if it matches the 1196 * format. If no value found or no match, this 1197 * mapping is _not_ an alternative. Otherwise, 1198 * we continue checking any other indexes. 1199 */ 1200 if (value == 0 || 1201 !verifyMappingMatch(x->index.value[i], 1202 value)) { 1203 match = 0; 1204 break; 1205 } 1206 } 1207 1208 if (yp2ldap) { 1209 for (--fpos; fpos >= 0; fpos--) { 1210 for (i = 0; i < ppos; i++) { 1211 if (strcmp(pass[i], fail[fpos]) == 0) 1212 break; 1213 } 1214 if (i == ppos) { 1215 match = 0; 1216 break; 1217 } 1218 } 1219 sfree(pass); 1220 sfree(fail); 1221 } 1222 1223 return (match); 1224 } 1225 1226 /* 1227 * Return all table mappings that match the column values in 'q'. 1228 * If there's no match, return those alternative mappings that don't 1229 * have an index; if no such mapping exists, return NULL. 1230 * 1231 * If 'wantWrite' is set, we want mappings for writing (i.e., data 1232 * to LDAP); otherwise, we want mappings for reading. 1233 * 1234 * If 'wantObj' is set, we want object mappings only (i.e., _not_ 1235 * those used to map entries in tables). 1236 * 1237 * If 'dbId' is non-NULL, we select mappings with a matching dbId field. 1238 */ 1239 __nis_table_mapping_t ** 1240 selectTableMapping(__nis_table_mapping_t *t, db_query *q, 1241 int wantWrite, int wantObj, char *dbId, 1242 int *numMatches) { 1243 __nis_table_mapping_t *r, *x, **tp; 1244 int i, nm, numap; 1245 char *myself = "selectTableMapping"; 1246 1247 if (numMatches == 0) 1248 numMatches = &nm; 1249 1250 /* 1251 * Count the number of possible mappings, so that we can 1252 * allocate the 'tp' array up front. 1253 */ 1254 for (numap = 0, x = t; x != 0; numap++, x = x->next); 1255 1256 if (numap == 0) { 1257 *numMatches = 0; 1258 return (0); 1259 } 1260 1261 tp = am(myself, numap * sizeof (tp[0])); 1262 if (tp == 0) { 1263 *numMatches = -1; 1264 return (0); 1265 } 1266 1267 /* 1268 * Special cases: 1269 * 1270 * q == 0 trivially matches any 't' of the correct object type 1271 * 1272 * wantObj != 0 means we ignore 'q' 1273 */ 1274 if (q == 0 || wantObj) { 1275 for (i = 0, x = t, nm = 0; i < numap; i++, x = x->next) { 1276 if (x->objectDN == 0) 1277 continue; 1278 if (wantWrite) { 1279 if (x->objectDN->write.scope == 1280 LDAP_SCOPE_UNKNOWN) 1281 continue; 1282 } else { 1283 if (x->objectDN->read.scope == 1284 LDAP_SCOPE_UNKNOWN) 1285 continue; 1286 } 1287 if (wantObj) { 1288 if (x->numColumns > 0) 1289 continue; 1290 } else { 1291 if (x->numColumns <= 0) 1292 continue; 1293 } 1294 if (dbId != 0 && x->dbId != 0 && 1295 strcmp(dbId, x->dbId) != 0) 1296 continue; 1297 tp[nm] = x; 1298 nm++; 1299 } 1300 *numMatches = nm; 1301 if (nm == 0) { 1302 sfree(tp); 1303 tp = 0; 1304 } 1305 return (tp); 1306 } 1307 1308 /* Scan all mappings, and collect candidates */ 1309 for (nm = 0, r = 0, x = t; x != 0; x = x->next) { 1310 if (x->objectDN == 0) 1311 continue; 1312 if (wantWrite) { 1313 if (x->objectDN->write.scope == LDAP_SCOPE_UNKNOWN) 1314 continue; 1315 } else { 1316 if (x->objectDN->read.scope == LDAP_SCOPE_UNKNOWN) 1317 continue; 1318 } 1319 /* Only want table/entry mappings */ 1320 if (x->numColumns <= 0) 1321 continue; 1322 if (dbId != 0 && x->dbId != 0 && 1323 strcmp(dbId, x->dbId) != 0) 1324 continue; 1325 /* 1326 * It's a match if: there are no indexes, or we actually 1327 * match the query with the indexes. 1328 */ 1329 if (x->index.numIndexes <= 0 || 1330 verifyIndexMatch(x, q, 0, 0, 0)) { 1331 tp[nm] = x; 1332 nm++; 1333 } 1334 } 1335 1336 if (nm == 0) { 1337 free(tp); 1338 tp = 0; 1339 } 1340 1341 *numMatches = nm; 1342 1343 return (tp); 1344 } 1345 1346 /* 1347 * Return 1 if there's an indexed mapping, 0 otherwise. 1348 */ 1349 int 1350 haveIndexedMapping(__nis_table_mapping_t *t) { 1351 __nis_table_mapping_t *x; 1352 1353 for (x = t; x != 0; x = x->next) { 1354 if (x->index.numIndexes > 0) 1355 return (1); 1356 } 1357 1358 return (0); 1359 } 1360 1361 /* 1362 * Given an input string 'attrs' of the form "attr1=val1,attr2=val2,...", 1363 * or a filter, return the value associated with the attribute 'attrName'. 1364 * If no instance of 'attrName' is found, return 'default'. In all cases, 1365 * the return value is a copy, and must be freed by the caller. 1366 * 1367 * Of course, return NULL in case of failure. 1368 */ 1369 static char * 1370 attrVal(char *msg, char *attrName, char *def, char *attrs) { 1371 char *val, *filter, **fc = 0; 1372 int i, nfc; 1373 char *myself = "attrVal"; 1374 1375 if (attrName == 0 || attrs == 0) 1376 return (0); 1377 1378 if (msg == 0) 1379 msg = myself; 1380 1381 val = def; 1382 1383 filter = makeFilter(attrs); 1384 if (filter != 0 && (fc = makeFilterComp(filter, &nfc)) != 0 && 1385 nfc > 0) { 1386 for (i = 0; i < nfc; i++) { 1387 char *name, *value; 1388 1389 name = fc[i]; 1390 /* Skip if not of attr=value form */ 1391 if ((value = strchr(name, '=')) == 0) 1392 continue; 1393 1394 *value = '\0'; 1395 value++; 1396 1397 if (strcasecmp(attrName, name) == 0) { 1398 val = value; 1399 break; 1400 } 1401 } 1402 } 1403 1404 if (val != 0) 1405 val = sdup(msg, T, val); 1406 1407 sfree(filter); 1408 freeFilterComp(fc, nfc); 1409 1410 return (val); 1411 } 1412 1413 extern bool_t xdr_nis_object(register XDR *xdrs, nis_object *objp); 1414 1415 /* 1416 * Copy an XDR:ed version of the NIS+ object 'o' (or the one indicated 1417 * by 't->objName' if 'o' is NULL) to the place indicated by 1418 * 't->objectDN->write'. Return an appropriate LDAP status code. 1419 */ 1420 int 1421 objToLDAP(__nis_table_mapping_t *t, nis_object *o, entry_obj **ea, int numEa) { 1422 __nis_table_mapping_t **tp; 1423 int stat, osize, n, numMatches = 0; 1424 void *buf; 1425 __nis_rule_value_t *rv; 1426 __nis_value_t *val; 1427 __nis_single_value_t *sv; 1428 char **attrName, *dn; 1429 char *myself = "objToLDAP"; 1430 1431 if (t == 0) 1432 return (LDAP_PARAM_ERROR); 1433 1434 logmsg(MSG_NOTIMECHECK, 1435 #ifdef NISDB_LDAP_DEBUG 1436 LOG_WARNING, 1437 #else 1438 LOG_INFO, 1439 #endif /* NISDB_LDAP_DEBUG */ 1440 "%s: %s", myself, NIL(t->objName)); 1441 1442 tp = selectTableMapping(t, 0, 1, 1, 0, &numMatches); 1443 if (tp == 0 || numMatches <= 0) { 1444 sfree(tp); 1445 logmsg(MSG_NOTIMECHECK, 1446 #ifdef NISDB_LDAP_DEBUG 1447 LOG_WARNING, 1448 #else 1449 LOG_INFO, 1450 #endif /* NISDB_LDAP_DEBUG */ 1451 "%s: %s (no mapping)", myself, NIL(t->objName)); 1452 return (LDAP_SUCCESS); 1453 } 1454 1455 for (n = 0; n < numMatches; n++) { 1456 1457 t = tp[n]; 1458 1459 if (o == 0) { 1460 sfree(tp); 1461 return (LDAP_OPERATIONS_ERROR); 1462 } 1463 1464 buf = (char *)xdrNisObject(o, ea, numEa, &osize); 1465 if (buf == 0) { 1466 sfree(tp); 1467 return (LDAP_OPERATIONS_ERROR); 1468 } 1469 1470 /* 1471 * Prepare to build a rule-value containing the XDR:ed 1472 * object 1473 */ 1474 rv = am(myself, sizeof (*rv)); 1475 sv = am(myself, sizeof (*sv)); 1476 val = am(myself, sizeof (*val)); 1477 attrName = am(myself, sizeof (attrName[0])); 1478 if (attrName != 0) 1479 attrName[0] = attrVal(myself, "nisplusObject", 1480 "nisplusObject", 1481 t->objectDN->write.attrs); 1482 if (rv == 0 || sv == 0 || val == 0 || attrName == 0 || 1483 attrName[0] == 0) { 1484 sfree(tp); 1485 sfree(buf); 1486 sfree(rv); 1487 sfree(sv); 1488 sfree(val); 1489 sfree(attrName); 1490 return (LDAP_NO_MEMORY); 1491 } 1492 1493 sv->length = osize; 1494 sv->value = buf; 1495 1496 /* 'vt_ber' just means "not a NUL-terminated string" */ 1497 val->type = vt_ber; 1498 val->repeat = 0; 1499 val->numVals = 1; 1500 val->val = sv; 1501 1502 rv->numAttrs = 1; 1503 rv->attrName = attrName; 1504 rv->attrVal = val; 1505 1506 /* 1507 * The 'write.base' is the actual DN of the entry (and the 1508 * scope had better be 'base', but we don't check that). 1509 */ 1510 dn = t->objectDN->write.base; 1511 1512 stat = ldapModify(dn, rv, t->objectDN->write.attrs, 1); 1513 1514 freeRuleValue(rv, 1); 1515 1516 logmsg(MSG_NOTIMECHECK, 1517 #ifdef NISDB_LDAP_DEBUG 1518 LOG_WARNING, 1519 #else 1520 LOG_INFO, 1521 #endif /* NISDB_LDAP_DEBUG */ 1522 "%s: %s (%s)", myself, NIL(t->objName), ldap_err2string(stat)); 1523 1524 if (stat != LDAP_SUCCESS) 1525 break; 1526 1527 } 1528 1529 sfree(tp); 1530 1531 return (stat); 1532 } 1533 1534 /* 1535 * Retrieve a copy of the 't->objName' object from LDAP, where it's 1536 * stored in XDR:ed form in the place indicated by 't->objectDN->read'. 1537 * Un-XDR the object, and return a pointer to it in '*obj'; it's the 1538 * responsibility of the caller to free the object when it's no 1539 * longer needed. 1540 * 1541 * Returns an appropriate LDAP status. 1542 */ 1543 int 1544 objFromLDAP(__nis_table_mapping_t *t, nis_object **obj, 1545 entry_obj ***eaP, int *numEaP) { 1546 __nis_table_mapping_t **tp; 1547 nis_object *o; 1548 __nis_rule_value_t *rv; 1549 __nis_ldap_search_t *ls; 1550 char *attrs[2], *filter, **fc = 0; 1551 void *buf; 1552 int i, j, nfc, nrv, blen, stat = LDAP_SUCCESS; 1553 int n, numMatches; 1554 char *myself = "objFromLDAP"; 1555 1556 if (t == 0) 1557 return (LDAP_PARAM_ERROR); 1558 1559 /* 1560 * If there's nowhere to store the result, we might as 1561 * well pretend all went well, and return right away. 1562 */ 1563 if (obj == 0) 1564 return (LDAP_SUCCESS); 1565 1566 /* Prepare for the worst */ 1567 *obj = 0; 1568 1569 logmsg(MSG_NOTIMECHECK, 1570 #ifdef NISDB_LDAP_DEBUG 1571 LOG_WARNING, 1572 #else 1573 LOG_INFO, 1574 #endif /* NISDB_LDAP_DEBUG */ 1575 "%s: %s", myself, NIL(t->objName)); 1576 1577 tp = selectTableMapping(t, 0, 0, 1, 0, &numMatches); 1578 if (tp == 0 || numMatches <= 0) { 1579 sfree(tp); 1580 logmsg(MSG_NOTIMECHECK, 1581 #ifdef NISDB_LDAP_DEBUG 1582 LOG_WARNING, 1583 #else 1584 LOG_INFO, 1585 #endif /* NISDB_LDAP_DEBUG */ 1586 "%s: %s (no mapping)", myself, NIL(t->objName)); 1587 return (LDAP_SUCCESS); 1588 } 1589 1590 for (n = 0; n < numMatches; n++) { 1591 1592 t = tp[n]; 1593 1594 filter = makeFilter(t->objectDN->read.attrs); 1595 if (filter == 0 || (fc = makeFilterComp(filter, &nfc)) == 0 || 1596 nfc <= 0) { 1597 sfree(tp); 1598 sfree(filter); 1599 freeFilterComp(fc, nfc); 1600 return ((t->objectDN->read.attrs != 0) ? 1601 LDAP_NO_MEMORY : LDAP_PARAM_ERROR); 1602 } 1603 /* Don't need the filter, just the components */ 1604 sfree(filter); 1605 1606 /* 1607 * Look for a "nisplusObject" attribute, and (if found) copy 1608 * the value to attrs[0]. Also remove the "nisplusObject" 1609 * attribute and value from the filter components. 1610 */ 1611 attrs[0] = sdup(myself, T, "nisplusObject"); 1612 if (attrs[0] == 0) { 1613 sfree(tp); 1614 freeFilterComp(fc, nfc); 1615 return (LDAP_NO_MEMORY); 1616 } 1617 attrs[1] = 0; 1618 for (i = 0; i < nfc; i++) { 1619 char *name, *value; 1620 int compare; 1621 1622 name = fc[i]; 1623 /* Skip if not of attr=value form */ 1624 if ((value = strchr(name, '=')) == 0) 1625 continue; 1626 1627 /* Temporarily overWrite the '=' with a '\0' */ 1628 *value = '\0'; 1629 1630 /* Compare with our target attribute name */ 1631 compare = strcasecmp("nisplusObject", name); 1632 1633 /* Put back the '=' */ 1634 *value = '='; 1635 1636 /* Is it the name we're looking for ? */ 1637 if (compare == 0) { 1638 sfree(attrs[0]); 1639 attrs[0] = sdup(myself, T, value+1); 1640 if (attrs[0] == 0) { 1641 sfree(tp); 1642 freeFilterComp(fc, nfc); 1643 return (LDAP_NO_MEMORY); 1644 } 1645 sfree(fc[i]); 1646 if (i < nfc-1) 1647 (void) memmove(&fc[i], &fc[i+1], 1648 (nfc-1-i) * sizeof (fc[i])); 1649 nfc--; 1650 break; 1651 } 1652 } 1653 1654 ls = buildLdapSearch(t->objectDN->read.base, 1655 t->objectDN->read.scope, 1656 nfc, fc, 0, attrs, 0, 1); 1657 sfree(attrs[0]); 1658 freeFilterComp(fc, nfc); 1659 if (ls == 0) { 1660 sfree(tp); 1661 return (LDAP_OPERATIONS_ERROR); 1662 } 1663 1664 nrv = 0; 1665 rv = ldapSearch(ls, &nrv, 0, &stat); 1666 if (rv == 0) { 1667 sfree(tp); 1668 freeLdapSearch(ls); 1669 return (stat); 1670 } 1671 1672 for (i = 0, buf = 0; i < nrv && buf == 0; i++) { 1673 for (j = 0; j < rv[i].numAttrs; j++) { 1674 if (strcasecmp(ls->attrs[0], 1675 rv[i].attrName[j]) == 0) { 1676 if (rv[i].attrVal[j].numVals <= 0) 1677 continue; 1678 buf = rv[i].attrVal[j].val[0].value; 1679 blen = rv[i].attrVal[j].val[0].length; 1680 break; 1681 } 1682 } 1683 } 1684 1685 if (buf != 0) { 1686 o = unXdrNisObject(buf, blen, eaP, numEaP); 1687 if (o == 0) { 1688 sfree(tp); 1689 freeLdapSearch(ls); 1690 freeRuleValue(rv, nrv); 1691 return (LDAP_OPERATIONS_ERROR); 1692 } 1693 stat = LDAP_SUCCESS; 1694 *obj = o; 1695 } else { 1696 stat = LDAP_NO_SUCH_OBJECT; 1697 } 1698 1699 freeLdapSearch(ls); 1700 freeRuleValue(rv, nrv); 1701 1702 logmsg(MSG_NOTIMECHECK, 1703 #ifdef NISDB_LDAP_DEBUG 1704 LOG_WARNING, 1705 #else 1706 LOG_INFO, 1707 #endif /* NISDB_LDAP_DEBUG */ 1708 "%s: %s (%s)", myself, NIL(t->objName), ldap_err2string(stat)); 1709 1710 if (stat != LDAP_SUCCESS) 1711 break; 1712 1713 } 1714 1715 sfree(tp); 1716 1717 return (stat); 1718 } 1719 1720 int 1721 deleteLDAPobj(__nis_table_mapping_t *t) { 1722 __nis_table_mapping_t **tp; 1723 int n, stat, numMatches = 0; 1724 char *myself = "deleteLDAPobj"; 1725 1726 if (t == 0) 1727 return (LDAP_PARAM_ERROR); 1728 1729 logmsg(MSG_NOTIMECHECK, 1730 #ifdef NISDB_LDAP_DEBUG 1731 LOG_WARNING, 1732 #else 1733 LOG_INFO, 1734 #endif /* NISDB_LDAP_DEBUG */ 1735 "%s: %s", myself, NIL(t->objName)); 1736 1737 tp = selectTableMapping(t, 0, 1, 1, 0, &numMatches); 1738 if (tp == 0 || numMatches <= 0) { 1739 sfree(tp); 1740 logmsg(MSG_NOTIMECHECK, 1741 #ifdef NISDB_LDAP_DEBUG 1742 LOG_WARNING, 1743 #else 1744 LOG_INFO, 1745 #endif /* NISDB_LDAP_DEBUG */ 1746 "%s: %s (no mapping)", myself, NIL(t->objName)); 1747 return (LDAP_SUCCESS); 1748 } 1749 1750 for (n = 0; n < numMatches; n++) { 1751 1752 t = tp[n]; 1753 1754 if (t->objectDN->delDisp == dd_always) { 1755 /* Delete entire entry */ 1756 stat = ldapModify(t->objectDN->write.base, 0, 1757 t->objectDN->write.attrs, 1); 1758 } else if (t->objectDN->delDisp == dd_perDbId) { 1759 /* 1760 * Delete the attribute holding the object. 1761 * First, determine what that attribute is called. 1762 */ 1763 char *attrName = 1764 attrVal(myself, 1765 "nisplusObject", 1766 "nisplusObject", 1767 t->objectDN->write.attrs); 1768 __nis_rule_value_t rv; 1769 __nis_value_t val; 1770 1771 if (attrName == 0) { 1772 sfree(tp); 1773 return (LDAP_NO_MEMORY); 1774 } 1775 1776 /* 1777 * Build a __nis_value_t with 'numVals' < 0 to 1778 * indicate deletion. 1779 */ 1780 val.type = vt_ber; 1781 val.numVals = -1; 1782 val.val = 0; 1783 1784 /* 1785 * Build a rule-value with the name we determined 1786 * above, and the deletion value. 1787 */ 1788 (void) memset(&rv, 0, sizeof (rv)); 1789 rv.numAttrs = 1; 1790 rv.attrName = &attrName; 1791 rv.attrVal = &val; 1792 1793 stat = ldapModify(t->objectDN->write.base, &rv, 1794 t->objectDN->write.attrs, 0); 1795 1796 sfree(attrName); 1797 } else if (t->objectDN->delDisp == dd_never) { 1798 /* Nothing to do, so we're trivially successful */ 1799 stat = LDAP_SUCCESS; 1800 } else { 1801 stat = LDAP_PARAM_ERROR; 1802 } 1803 1804 logmsg(MSG_NOTIMECHECK, 1805 #ifdef NISDB_LDAP_DEBUG 1806 LOG_WARNING, 1807 #else 1808 LOG_INFO, 1809 #endif /* NISDB_LDAP_DEBUG */ 1810 "%s: %s (%s)", myself, NIL(t->objName), ldap_err2string(stat)); 1811 1812 /* If there were no such object, we've trivially succeeded */ 1813 if (stat == LDAP_NO_SUCH_OBJECT) 1814 stat = LDAP_SUCCESS; 1815 1816 if (stat != LDAP_SUCCESS) 1817 break; 1818 1819 } 1820 1821 sfree(tp); 1822 1823 return (stat); 1824 } 1825