ns_standalone.c revision ca190d8debe6672d99069a376a987adee0765d6c
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * CDDL HEADER START
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * The contents of this file are subject to the terms of the
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * Common Development and Distribution License (the "License").
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * You may not use this file except in compliance with the License.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * See the License for the specific language governing permissions
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * and limitations under the License.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * When distributing Covered Code, include this CDDL HEADER in each
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * If applicable, add the following below this CDDL HEADER, with the
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * fields enclosed by brackets "[]" replaced with your own identifying
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * information: Portions Copyright [yyyy] [name of copyright owner]
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * CDDL HEADER END
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * Use is subject to license terms.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth#pragma ident "%Z%%M% %I% %E% SMI"
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57ethtypedef enum {
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57ethtypedef enum {
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57ethtypedef struct dir_server {
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57ethtypedef struct dir_server_list {
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* The local list of the directory servers' root DSEs. */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* The flag indicating if libsldap is in the 'Standalone' mode. */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * The mutex ensuring that only one thread performs
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * the initialization of the list.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * A flag indicating that a particular thread is
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * in the 'ldap_cachemgr' mode. It is stored by thread as
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * a thread specific data.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * A thread specific key storing
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * the the 'ldap_cachemgr' mode indicator.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57ethtypedef struct switchDatabase {
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth/* INET6_ADDRSTRLEN + ":" + <5-digit port> + some round-up */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth switch_database_t *localData = (switch_database_t *)data;
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * This function initializes an indication that a thread obtaining a root DSE
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * will be switched to the 'ldap_cachemgr' mode. Within the thread libsldap
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * will not invoke the __s_api_requestServer function. Instead, the library
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * will establish a connection to the server specified by
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * the __ns_ldap_getRootDSE function.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * Since ldap_cachmgr can obtain a DUAProfile and root DSEs at the same time
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * and we do not want to affect a thread obtaining a DUAProfile,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * the 'ldap_cachemgr' mode is thread private.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * In addition, this function creates a key holding temporary configuration
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * for the "hosts" and "ipnodes" databases which is used by the "SKIPDB"
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * mechanism (__s_api_ip2hostname() & _s_api_hostname2ip()).
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth if (thr_keycreate(&dir_servers.standaloneInitKey, NULL) != 0) {
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth syslog(LOG_ERR, gettext("libsldap: unable to create a thread "
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth "key needed for sharing ldap connections"));
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth if (thr_keycreate(&switchConfigKey, switch_conf_disposer) != 0) {
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth syslog(LOG_ERR, gettext("libsldap: unable to create a thread "
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth "key containing current nsswitch configuration"));
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * This function sets the 'ldap_cachemgr' mode indication.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * This function unset the 'ldap_cachemgr' mode indication.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth (void) thr_setspecific(dir_servers.standaloneInitKey, NULL);
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * This function checks if the 'ldap_cachemgr' mode indication is set.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth (void) thr_getspecific(dir_servers.standaloneInitKey, (void **) &flag);
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * This function checks if the process runs in the 'Standalone' mode.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * In this mode libsldap will check the local, process private list of root DSEs
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * instead of requesting them via a door call to ldap_cachemgr.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth int i = 0;
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth return (0);
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* Copy up to one space from source. */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* If not "ldap", just copy. */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* At the end of string? */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth return (1);
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* Copy up to one space from source. */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* Copy also the criteria section */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* Shouln't happen if format is right */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth return (1);
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* If next part is ldap, skip over it ... */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * See comment above about
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * correct format.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth return (1);
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth return (1);
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth syslog(LOG_WARNING, gettext("libsldap: can not read %s"),
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth "is missing from %s"),
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth (void) thr_getspecific(switchConfigKey, (void **) &hostService);
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * In a long-living process threads can perform several
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * getXbyY requests. And the windows between those requests
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * can be long. The nsswitch configuration can change from time
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * to time. So instead of allocating/freeing memory every time
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * the API is called, reallocate memory only when the current
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * configuration for the database being used is longer than
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * the previous one.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth if (remove_ldap(hostService->conf, linep, hostService->alloced))
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * This function is an analog of the standard gethostbyaddr_r()
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * function with an exception that it removes the 'ldap' back-end
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * (if any) from the host/ipnodes nsswitch's databases and then
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * looks up using remaining back-ends.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth_filter_gethostbyaddr_r(const char *addr, int len, int type,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth switch (type) {
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * This routine is an analog of gethostbyaddr_r().
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * But in addition __s_api_hostname2ip() performs the "LDAP SKIPDB" activity
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * prior to querying the name services.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * If the buffer is not big enough to accommodate a returning data,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * NULL is returned and h_errnop is set to TRY_AGAIN.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth sizeof (struct in_addr) +
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth sizeof (char *));
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth result->h_aliases = (char **)ROUND_UP(result->h_addr_list,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth sizeof (char *));
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth sizeof (struct in_addr));
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth sizeof (struct in_addr);
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth sizeof (struct in6_addr) +
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth sizeof (char *));
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth result->h_aliases = (char **)ROUND_UP(result->h_addr_list,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth sizeof (char *));
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth sizeof (struct in6_addr));
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth sizeof (struct in6_addr);
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth NSS_XbyY_INIT(&arg, result, buffer, buflen, str2hostent);
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * Convert an IP to a host name.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * Assume it's [ipv6]:port
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * Extract ipv6 IP
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* extract port */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* assume it's ipv4:port */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* No port */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* IPv4 */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* hostname + '\0' */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* ':' + port */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* IPv6 */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* hostname + '\0' */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* ':' + port */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * A hostname
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * Return it as is
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * This function obtains data returned by an LDAP search request and puts it
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * in a string in the ldap_cachmgr(1) door call format.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * ld - a pointer to an LDAP structure used for a search operation,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * result_msg - a pointer to an LDAPMessage returned by the search,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * include_names - if set to INCLUDE_ATTR_NAMES, the output buffer will
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * contain attribute names.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * Otherwise, only values will be return.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * a buffer containing server info in the following format:
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * [<attribute name>=]value [DOORLINESEP [<attribute name>=]value ]...]
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * Should be free'ed by the caller.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth char *a, **vals;
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* calculate length of received data */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* copy the data */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* add 1 for the last '\0' */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* make it an empty string first */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth while (a != NULL) {
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * If we're processing DUAConfigProfile, we need to make
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * sure we put objectclass attribute first.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * __s_api_create_config_door_str depends on that.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* Skip objectclass now. */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* Skip all but objectclass first. */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth "%s=%s%s",
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* Rewind */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth if (e != result_msg) {
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * This function looks up the base DN of a directory serving
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * a specified domain name.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * ld - a pointer to an LDAP structure used for the search operation,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * domain_name - the name of a domain.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * a buffer containing a directory's base DN found.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * Should be free'ed by the caller.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57ethgetDirBaseDN(LDAP *ld, const char *domain_name, char **dir_base_dn)
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* Get the whole list of naming contexts residing on the server */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth ldap_rc = ldap_search_ext_s(ld, "", LDAP_SCOPE_BASE, "(objectclass=*)",
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* If successful, the root DSE was found. */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * If the root DSE was not found, the server does
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * not comply with the LDAP v3 protocol.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * For each context try to find a NIS domain object
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * which 'nisdomain' attribute's value matches the domain name
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth "(&(objectclass=nisDomainObject)"
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth "(nisdomain=%s))",
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * This function parses the results of a search operation
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * requesting a DUAProfile.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * ld - a pointer to an LDAP structure used for the search operation,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * dir_base_dn - the name of a directory's base DN,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * profile_name - the name of a DUAProfile to be obtained.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * a buffer containing the DUAProfile in the following format:
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * [<attribute name>=]value [DOORLINESEP [<attribute name>=]value ]...]
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * Should be free'ed by the caller.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth const char *dir_base_dn,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth const char *profile_name,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth (void) snprintf(searchBaseDN, BUFSIZ, "ou=profile,%s", dir_base_dn);
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* If successful, the DUA profile was found. */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * If the root DSE was not found, the server does
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * not comply with the LDAP v3 protocol.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * This function derives the directory's base DN from a provided domain name.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * domain_name - the name of a domain to be converted into a base DN,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * buffer - contains the derived base DN,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * buf_len - the length of the buffer.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * The function returns the address of the buffer or NULL.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57ethdomainname2baseDN(char *domain_name, char *buffer, uint16_t buf_len)
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* Simply replace dots with "dc=" */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth if (i < length) {
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * The end of the domain name
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * has not been reached yet
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * This function obtains the directory's base DN and a DUAProfile
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * from a specified server.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * server - a structure describing a server to connect to and
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * a DUAProfile to be obtained from the server,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * cred - credentials to be used during establishing connections to
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * the server.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * dua_profile - a buffer containing the DUAProfile in the following format:
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * [<attribute name>=]value [DOORLINESEP [<attribute name>=]value ]...]
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * dir_base_dn - a buffer containing the base DN,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * errorp - an error object describing an error, if any.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * All the output data structures should be free'ed by the caller.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth__ns_ldap_getConnectionInfoFromDUA(const ns_dir_server_t *server,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * If no credentials are specified, try to establish a connection
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * as anonymous.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* Now create a default LDAP configuration */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth if (__ns_ldap_setParamValue(config_struct, NS_LDAP_SERVERS_P, buffer,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* Put together the address and the port specified by the user app. */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * There is no default value for the 'Default Search Base DN' attribute.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * Derive one from the domain name to make __s_api_crosscheck() happy.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth if (__ns_ldap_setParamValue(config_struct, NS_LDAP_SEARCH_BASEDN_P,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth if (__s_api_crosscheck(config_struct, errmsg, B_FALSE) != NS_SUCCESS) {
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth "nisDomainObject for domain %s\n"),
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * And here obtain a DUAProfile which will be used
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * as a real configuration.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth "%s DUAProfile\n"),
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * This function obtains the root DSE from a specified server.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * server_addr - an adress of a server to be connected to.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * root_dse - a buffer containing the root DSE in the following format:
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * [<attribute name>=]value [DOORLINESEP [<attribute name>=]value ]...]
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * For example: ( here | used as DOORLINESEP for visual purposes)
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * supportedControl=1.1.1.1|supportedSASLmechanisms=EXTERNAL
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * Should be free'ed by the caller.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * All the credentials will be taken from the current
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * libsldap configuration.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* Fallback to anonymous mode is disabled. Stop. */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth " the %s server: %s. "
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth "Falling back to anonymous disabled.\n"),
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * Fallback to anonymous, non-SSL mode for backward
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * compatibility reasons. This mode should only be used when
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * this function (__ns_ldap_getRootDSE) is called from
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * ldap_cachemgr(1M).
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth " mode for __ns_ldap_getRootDSE. %s\n"),
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* Setup the anon credential for anonymous connection. */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* get search timeout value */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth (void) __ns_ldap_getParam(NS_LDAP_SEARCH_TIME_P, ¶mVal, errorp);
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* Get root DSE from the server specified by the caller. */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth "(objectclass=*)",
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * If the root DSE was not found, the server does
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * not comply with the LDAP v3 protocol.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth "for server %s returned."),
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * This function destroys the local list of root DSEs. The input parameter is
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * a pointer to the list to be erased.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * The type of the pointer passed to this function should be
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * (dir_server_list_t *).
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth dir_server_list_t *old_list = (dir_server_list_t *)param;
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth long i = 0, j;
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* Destroy the old list */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * All the structures pointed by old_list->nsServers were allocated
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * in one chunck. The nsServers[0] pointer points to the beginning
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * of that chunck.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * This function cancels the Standalone mode and destroys the list of root DSEs.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * We call this function in non anon-fallback mode because we
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * want the whole procedure to fail as soon as possible to
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * indicate there are problems with connecting to the server.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * If the root DSE can not be obtained, log an error and keep the
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth "can not obtain the root DSE from %s. %s"),
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* Get the first attribute of the root DSE. */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth "the root DSE from %s is empty or corrupted."),
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth server->controls = (char **)calloc(CHUNK_SIZE, sizeof (char *));
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth server->saslMech = (char **)calloc(CHUNK_SIZE, sizeof (char *));
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth if (server->controls == NULL || server->saslMech == NULL) {
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth sizeof (char *));
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth sizeof (char *),
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth sizeof (char *) -
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth sizeof (char *));
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth sizeof (char *));
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth sizeof (char *),
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth sizeof (char *) -
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth sizeof (char *));
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * This function creates a new local list of root DSEs from all the servers
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * mentioned in the DUAProfile (or local NS BEC) and returns
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * a pointer to the list.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth for (i = 0; serverList[i]; ++i) {
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth (void) rwlock_init(&(*new_list)->listDestroyLock, USYNC_THREAD, NULL);
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth (*new_list)->nsServers = (dir_server_t **)calloc(srvListLength + 1,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth sizeof (dir_server_t *));
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * Allocate a set of dir_server_t structures as an array,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * with one alloc call and then initialize the nsServers pointers
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * with the addresses of the array's members.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth for (i = 0; i < srvListLength; ++i) {
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth (void) mutex_init(&(*new_list)->nsServers[i]->updateStatus,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth (*new_list)->nsServers[i]->status = INFO_SERVER_CONNECTING;
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth for (i = 0; i < srvListLength; ++i) {
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth if (thrPool[i] != 0 &&
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * Some memory allocation problems occured. Just
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * ignore the server and hope there will be some
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * other good ones.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * This functions replaces the local list of root DSEs with a new one and starts
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * a thread destroying the old list. There is no need for other threads to wait
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * until the old list will be destroyed.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * Since it is possible that more than one thread can start creating the list,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * this function should be protected by mutexes to be sure that only one thread
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * performs the initialization.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * This function "informs" libsldap that a client application has specified
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * a directory to use. The function obtains a DUAProfile, credentials,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * and naming context. During all further operations on behalf
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * of the application requested a standalone schema libsldap will use
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * the information obtained by __ns_ldap_initStandalone() instead of
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * door_call(3C)ing ldap_cachemgr(1M).
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * sa_conf - a structure describing where and in which way to obtain all
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * the configuration describing how to communicate to
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * a choosen LDAP directory,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * errorp - an error object describing an error occured.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth__ns_ldap_initStandalone(const ns_standalone_conf_t *sa_conf,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth if (sa_conf->SA_BIND_DN == NULL && sa_conf->SA_BIND_PWD != NULL ||
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth sa_conf->SA_BIND_DN != NULL && sa_conf->SA_BIND_PWD == NULL) {
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth " must both be provided\n"));
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth cfg = __s_api_create_config_door_str(dua_profile, errorp);
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth default: /* Version 2 */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * The received DUAProfile specifies
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * sasl/GSSAPI as an auth. mechanism.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * The bind DN and password will be
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * ignored.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth "used as an authentication method. "
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth "The bind DN and password will "
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth "be ignored.\n"));
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth default: /* NS_CACHEMGR */
ca190d8debe6672d99069a376a987adee0765d6cmichen /* Connection management should use the new config now. */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * serverAddr is the address of a server and
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * request is one of the following:
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * NS_CACHE_NEW: get a new server address, addr is ignored.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * NS_CACHE_NORESP: get the next one, remove addr from list.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * NS_CACHE_NEXT: get the next one, keep addr on list.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * NS_CACHE_WRITE: get a non-replica server, if possible, if not, same
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * as NS_CACHE_NEXT.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * addrType:
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * NS_CACHE_ADDR_IP: return server address as is, this is default.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * NS_CACHE_ADDR_HOSTNAME: return server addess as FQDN format, only
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * self credential case requires such format.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * a structure of type ns_server_info_t containing the server address
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * or name, server controls and supported SASL mechanisms.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * NOTE: Caller should allocate space for the structure and free
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * all the space allocated by the function for the information contained
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * in the structure.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * error - an error object describing an error, if any.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth const char *serverAddr,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth const char *addrType,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth long i = 0;
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth "the Standalone mode was not properly initialized"));
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * The code below is mostly the clone of the
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * ldap_cachemgr::cachemgr_getldap.c::getldap_get_serverInfo() function.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * Currently we have two different server lists: one is maintained
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * by libsldap ('standalone' mode), the other is in ldap_cachemgr
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * (a part of its standard functionality).
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * If NS_CACHE_NEW, or the server info is new,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * starts from the beginning of the list.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth (void) mutex_lock(¤t_list->nsServers[0]->updateStatus);
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth (void) mutex_unlock(¤t_list->nsServers[i]->updateStatus);
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * Lock the updateStatus mutex to
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * make sure the server status stays the same
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * while the data is being processed.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * if the server has already been removed,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * don't bother.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * if the information is new,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * give this server one more chance.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * it is recommended that
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * before removing the
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * server from the list,
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * the server should be
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * contacted one more time
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * to make sure that it is
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * really unavailable.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * For now, just trust the client
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * (i.e., the sldap library)
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * that it knows what it is
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * doing and would not try
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * to mess up the server
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * req == NS_CACHE_NEXT or NS_CACHE_WRITE
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * ldap_cachemgr checks here if the server
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * is not a non-replica server (a server
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * of type INFO_RW_WRITEABLE). But currently
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * it considers all the servers in its list
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * as those.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth ret_code = __s_api_ip2hostname(server->ip, &ret->serverFQDN);
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth "can not be resolved into "
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth "a host name. Returning "
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth "the address as it is."),
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth ret->saslMechanisms = __s_api_cp2dArray(server->saslMech);
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * This function iterates through the list of the configured LDAP servers
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * and "pings" those which are marked as removed or if any error occurred
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * during the previous receiving of the server's root DSE. If the
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * function is able to reach such a server and get its root DSE, it
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * marks the server as on-line. Otherwise, the server's status is set
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * to "Error".
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * For each server the function tries to connect to, it fires up
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * a separate thread and then waits until all the treads finish.
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * The function returns NS_LDAP_INTERNAL if the Standalone mode was not
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * initialized or was canceled prior to an invocation of
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth * __ns_ldap_pingOfflineServers().
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth long srvListLength, i = 0;
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth for (i = 0; i < srvListLength; ++i) {
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth if (current_list->nsServers[i]->status != INFO_SERVER_REMOVED &&
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth current_list->nsServers[i]->status != INFO_SERVER_ERROR) {
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth current_list->nsServers[i]->status = INFO_SERVER_CONNECTING;
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth __s_api_free2dArray(current_list->nsServers[i]->controls);
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth __s_api_free2dArray(current_list->nsServers[i]->saslMech);
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth /* A memory allocation error has occured */
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth for (i = 0; i < srvListLength; ++i) {
e1dd0a2f3a26050d1f183c1cafae42c4e3a0b57eth if (thrPool[i] != 0 &&