mirror/openldap
2
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2025-01-06 10:46:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix more spurious return stuff; split quarantine in: detection, exploitation, recovery; describe failure reasons

Browse Source
This commit is contained in:
Pierangelo Masarati 2007-01-28 00:24:10 +00:00
parent fd71fdf83e
commit e07dc8c757
2 changed files with 17 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
servers/slapd/back-ldap/back-ldap.h
View File

@ -308,6 +308,8 @@ typedef struct ldapinfo_t {
#define LDAP_BACK_F_CANCEL_MASK (LDAP_BACK_F_CANCEL_IGNORE|LDAP_BACK_F_CANCEL_EXOP) #define LDAP_BACK_F_CANCEL_MASK (LDAP_BACK_F_CANCEL_IGNORE|LDAP_BACK_F_CANCEL_EXOP)
#define LDAP_BACK_F_CANCEL_MASK2 (LDAP_BACK_F_CANCEL_MASK|LDAP_BACK_F_CANCEL_EXOP_DISCOVER) #define LDAP_BACK_F_CANCEL_MASK2 (LDAP_BACK_F_CANCEL_MASK|LDAP_BACK_F_CANCEL_EXOP_DISCOVER)
#define LDAP_BACK_F_QUARANTINE (0x00010000U)
#define LDAP_BACK_ISSET_F(ff,f) ( ( (ff) & (f) ) == (f) ) #define LDAP_BACK_ISSET_F(ff,f) ( ( (ff) & (f) ) == (f) )
#define LDAP_BACK_ISMASK_F(ff,m,f) ( ( (ff) & (m) ) == (f) ) #define LDAP_BACK_ISMASK_F(ff,m,f) ( ( (ff) & (m) ) == (f) )
@ -339,6 +341,8 @@ typedef struct ldapinfo_t {
#define LDAP_BACK_CANCEL(li) LDAP_BACK_ISMASK( (li), LDAP_BACK_F_CANCEL_MASK, LDAP_BACK_F_CANCEL_EXOP ) #define LDAP_BACK_CANCEL(li) LDAP_BACK_ISMASK( (li), LDAP_BACK_F_CANCEL_MASK, LDAP_BACK_F_CANCEL_EXOP )
#define LDAP_BACK_CANCEL_DISCOVER(li) LDAP_BACK_ISMASK( (li), LDAP_BACK_F_CANCEL_MASK2, LDAP_BACK_F_CANCEL_EXOP_DISCOVER ) #define LDAP_BACK_CANCEL_DISCOVER(li) LDAP_BACK_ISMASK( (li), LDAP_BACK_F_CANCEL_MASK2, LDAP_BACK_F_CANCEL_EXOP_DISCOVER )
#define LDAP_BACK_QUARANTINE(li) LDAP_BACK_ISSET( (li), LDAP_BACK_F_QUARANTINE )
int li_version; int li_version;
/* cached connections; /* cached connections;
@ -363,7 +367,6 @@ typedef struct ldapinfo_t {
#define LDAP_BACK_FQ_RETRYING (2) #define LDAP_BACK_FQ_RETRYING (2)
slap_retry_info_t li_quarantine; slap_retry_info_t li_quarantine;
#define LDAP_BACK_QUARANTINE(li) ( (li)->li_quarantine.ri_num != NULL )
ldap_pvt_thread_mutex_t li_quarantine_mutex; ldap_pvt_thread_mutex_t li_quarantine_mutex;
ldap_back_quarantine_f li_quarantine_f; ldap_back_quarantine_f li_quarantine_f;
void *li_quarantine_p; void *li_quarantine_p;

24
servers/slapd/back-ldap/bind.c
View File

@ -665,6 +665,7 @@ ldap_back_prepare_conn( ldapconn_t *lc, Operation *op, SlapReply *rs, ldap_back_
ldap_pvt_thread_mutex_unlock( &li->li_uri_mutex ); ldap_pvt_thread_mutex_unlock( &li->li_uri_mutex );
if ( rs->sr_err != LDAP_SUCCESS ) { if ( rs->sr_err != LDAP_SUCCESS ) {
ldap_unbind_ext( ld, NULL, NULL ); ldap_unbind_ext( ld, NULL, NULL );
rs->sr_text = "Start TLS failed";
goto error_return; goto error_return;
} else if ( li->li_idle_timeout ) { } else if ( li->li_idle_timeout ) {
@ -691,10 +692,9 @@ error_return:;
rs->sr_err = slap_map_api2result( rs ); rs->sr_err = slap_map_api2result( rs );
if ( sendok & LDAP_BACK_SENDERR ) { if ( sendok & LDAP_BACK_SENDERR ) {
if ( rs->sr_text == NULL ) { if ( rs->sr_text == NULL ) {
rs->sr_text = "ldap_initialize() failed"; rs->sr_text = "Proxy connection initialization failed";
} }
send_ldap_result( op, rs ); send_ldap_result( op, rs );
rs->sr_text = NULL;
} }
} else { } else {
@ -747,6 +747,7 @@ ldap_back_getconn(
if ( dont_retry ) { if ( dont_retry ) {
rs->sr_err = LDAP_UNAVAILABLE; rs->sr_err = LDAP_UNAVAILABLE;
if ( op->o_conn && ( sendok & LDAP_BACK_SENDERR ) ) { if ( op->o_conn && ( sendok & LDAP_BACK_SENDERR ) ) {
rs->sr_text = "Target is quarantined";
send_ldap_result( op, rs ); send_ldap_result( op, rs );
} }
return NULL; return NULL;
@ -1040,10 +1041,9 @@ retry_lock:
LDAP_BACK_CONN_CACHED_CLEAR( lc ); LDAP_BACK_CONN_CACHED_CLEAR( lc );
ldap_back_conn_free( lc ); ldap_back_conn_free( lc );
rs->sr_err = LDAP_OTHER; rs->sr_err = LDAP_OTHER;
rs->sr_text = "proxy bind collision"; rs->sr_text = "Proxy bind collision";
if ( op->o_conn && ( sendok & LDAP_BACK_SENDERR ) ) { if ( op->o_conn && ( sendok & LDAP_BACK_SENDERR ) ) {
send_ldap_result( op, rs ); send_ldap_result( op, rs );
rs->sr_text = NULL;
} }
return NULL; return NULL;
} }
@ -1371,6 +1371,7 @@ retry:;
/* lc here must be the regular lc, reset and ready for init */ /* lc here must be the regular lc, reset and ready for init */
rs->sr_err = ldap_back_prepare_conn( lc, op, rs, sendok ); rs->sr_err = ldap_back_prepare_conn( lc, op, rs, sendok );
if ( rs->sr_err != LDAP_SUCCESS ) { if ( rs->sr_err != LDAP_SUCCESS ) {
sendok &= ~LDAP_BACK_SENDERR;
lc->lc_refcnt = 0; lc->lc_refcnt = 0;
} }
} }
@ -1400,6 +1401,7 @@ retry:;
if ( rs->sr_err != LDAP_SUCCESS && if ( rs->sr_err != LDAP_SUCCESS &&
( sendok & LDAP_BACK_SENDERR ) ) ( sendok & LDAP_BACK_SENDERR ) )
{ {
rs->sr_text = "Internal proxy bind failure";
send_ldap_result( op, rs ); send_ldap_result( op, rs );
} }
@ -1407,7 +1409,7 @@ retry:;
} }
rc = ldap_back_op_result( lc, op, rs, msgid, rc = ldap_back_op_result( lc, op, rs, msgid,
-1, (sendok|LDAP_BACK_BINDING) ); -1, ( sendok | LDAP_BACK_BINDING ) );
if ( rc == LDAP_SUCCESS ) { if ( rc == LDAP_SUCCESS ) {
LDAP_BACK_CONN_ISBOUND_SET( lc ); LDAP_BACK_CONN_ISBOUND_SET( lc );
} }
@ -1711,6 +1713,7 @@ retry:;
ldap_back_quarantine( op, rs ); ldap_back_quarantine( op, rs );
} }
if ( op->o_conn && ( sendok & LDAP_BACK_SENDERR ) ) { if ( op->o_conn && ( sendok & LDAP_BACK_SENDERR ) ) {
if ( rs->sr_text == NULL ) rs->sr_text = "Proxy operation retry failed";
send_ldap_result( op, rs ); send_ldap_result( op, rs );
} }
} }
@ -1756,8 +1759,7 @@ int
ldap_back_retry( ldapconn_t **lcp, Operation *op, SlapReply *rs, ldap_back_send_t sendok ) ldap_back_retry( ldapconn_t **lcp, Operation *op, SlapReply *rs, ldap_back_send_t sendok )
{ {
ldapinfo_t *li = (ldapinfo_t *)op->o_bd->be_private; ldapinfo_t *li = (ldapinfo_t *)op->o_bd->be_private;
int rc = 0, int rc = 0;
binding;
assert( lcp != NULL ); assert( lcp != NULL );
assert( *lcp != NULL ); assert( *lcp != NULL );
@ -1765,7 +1767,7 @@ ldap_back_retry( ldapconn_t **lcp, Operation *op, SlapReply *rs, ldap_back_send_
ldap_pvt_thread_mutex_lock( &li->li_conninfo.lai_mutex ); ldap_pvt_thread_mutex_lock( &li->li_conninfo.lai_mutex );
if ( (*lcp)->lc_refcnt == 1 ) { if ( (*lcp)->lc_refcnt == 1 ) {
binding = LDAP_BACK_CONN_BINDING( *lcp ); int binding = LDAP_BACK_CONN_BINDING( *lcp );
ldap_pvt_thread_mutex_lock( &li->li_uri_mutex ); ldap_pvt_thread_mutex_lock( &li->li_uri_mutex );
Debug( LDAP_DEBUG_ANY, Debug( LDAP_DEBUG_ANY,
@ -1814,9 +1816,9 @@ ldap_back_retry( ldapconn_t **lcp, Operation *op, SlapReply *rs, ldap_back_send_
ldap_back_release_conn_lock( li, lcp, 0 ); ldap_back_release_conn_lock( li, lcp, 0 );
assert( *lcp == NULL ); assert( *lcp == NULL );
if ( sendok ) { if ( sendok & LDAP_BACK_SENDERR ) {
rs->sr_err = LDAP_UNAVAILABLE; rs->sr_err = LDAP_UNAVAILABLE;
rs->sr_text = "unable to retry"; rs->sr_text = "Unable to retry";
send_ldap_result( op, rs ); send_ldap_result( op, rs );
} }
} }
@ -2061,7 +2063,7 @@ ldap_back_proxy_authz_bind(
binddn->bv_val, LDAP_SASL_SIMPLE, binddn->bv_val, LDAP_SASL_SIMPLE,
bindcred, NULL, NULL, &msgid ); bindcred, NULL, NULL, &msgid );
rc = ldap_back_op_result( lc, op, rs, msgid, rc = ldap_back_op_result( lc, op, rs, msgid,
-1, (sendok|LDAP_BACK_BINDING) ); -1, ( sendok | LDAP_BACK_BINDING ) );
break; break;
default: default: