usr.sbin/ldapd/search.c

1 /*	$OpenBSD: search.c,v 1.26 2020/01/28 15:51:26 bket Exp $ */
38 				struct search *search);
66 /* Return true if attr should be included in search entry.
69 should_include_attribute(char *adesc, struct search *search, int explicit)
74 	if (search->attrlist->be_sub == NULL ||
75 	    search->attrlist->be_sub->be_encoding == BER_TYPE_EOC) {
81 	for (elm = search->attrlist->be_sub; elm; elm = elm->be_next) {
98     struct search *search)
101 	struct conn		*conn = search->conn;
122 		 * should be included in the search result.  The attribute is
125 		if (authorized(search->conn, search->ns, ACI_READ,
127 		    should_include_attribute(adesc, search, 0)) {
142 	elm = ober_printf_elements(root, "i{txe", search->req->msgid,
149 	    "sending search entry on fd %d", conn->fd);
155 		log_warn("failed to create search-entry response");
168 	log_warn("search result");
176 search_close(struct search *search)
180 	for (dn = RB_MIN(dn_tree, &search->uniqdns); dn; dn = next) {
181 		next = RB_NEXT(dn_tree, &search->uniqdns, dn);
182 		RB_REMOVE(dn_tree, &search->uniqdns, dn);
187 	btree_cursor_close(search->cursor);
188 	btree_txn_abort(search->data_txn);
189 	btree_txn_abort(search->indx_txn);
191 	if (search->req != NULL) {
192 		log_debug("finished search on msgid %lld", search->req->msgid);
193 		request_free(search->req);
195 	TAILQ_REMOVE(&search->conn->searches, search, next);
196 	filter_free(search->plan);
197 	free(search);
218 check_search_entry(struct btval *key, struct btval *val, struct search *search)
225 	if (search->scope == LDAP_SCOPE_ONELEVEL &&
226 	    !is_child_of(key, search->basedn)) {
236 	if (!authorized(search->conn, search->ns, ACI_READ, dn0,
244 	if ((elm = namespace_db2ber(search->ns, val)) == NULL) {
250 	if (ldap_matches_filter(elm, search->plan) != 0) {
255 	rc = search_result(key->data, key->size, elm, search);
259 		search->nmatched++;
265 mk_dup(struct search *search, struct btval *key)
278 	RB_INSERT(dn_tree, &search->uniqdns, udn);
284 is_dup(struct search *search, struct btval *key)
290 	return RB_FIND(dn_tree, &search->uniqdns, &find) != NULL;
294 conn_search(struct search *search)
304 	conn = search->conn;
309 	if (search->plan->indexed)
310 		txn = search->indx_txn;
312 		txn = search->data_txn;
314 	if (!search->init) {
315 		search->cursor = btree_txn_cursor_open(NULL, txn);
316 		if (search->cursor == NULL) {
318 			search_close(search);
322 		if (search->plan->indexed) {
323 			search->cindx = TAILQ_FIRST(&search->plan->indices);
324 			key.data = search->cindx->prefix;
326 			    search->cindx->prefix);
328 			if (*search->basedn)
329 				key.data = search->basedn;
338 		search->init = 1;
342 		rc = btree_cursor_get(search->cursor, &key, &val, op);
345 		if (rc == BT_SUCCESS && search->plan->indexed) {
349 			if (!has_prefix(&key, search->cindx->prefix)) {
351 				    search->cindx->prefix);
360 		    search->plan->indexed > 1) {
361 			search->cindx = TAILQ_NEXT(search->cindx, next);
362 			if (search->cindx != NULL) {
365 				key.data = search->cindx->prefix;
368 				    search->cindx->prefix);
382 		search->nscanned++;
384 		if (search->plan->indexed) {
389 			rc = index_to_dn(search->ns, &ikey, &key);
400 			if (search->scope == LDAP_SCOPE_ONELEVEL &&
401 			    !is_child_of(&key, search->basedn)) {
407 			if (search->plan->indexed > 1 && is_dup(search, &key)) {
410 				search->ndups++;
415 			rc = btree_txn_get(NULL, search->data_txn, &key, &val);
434 		if (!has_suffix(&key, search->basedn)) {
437 			if (search->plan->indexed)
446 		rc = check_search_entry(&key, &val, search);
448 		if (rc == BT_SUCCESS && search->plan->indexed > 1)
449 			rc = mk_dup(search, &key);
454 		if (rc == BT_SUCCESS && search->szlim > 0 &&
455 		    search->nmatched > search->szlim) {
456 			log_debug("search %d/%lld has exceeded size limit (%lld)",
457 			    search->conn->fd, search->req->msgid,
458 			    search->szlim);
466 	if (rc == 0 && search->tmlim > 0 &&
467 	    search->started_at + search->tmlim < now) {
468 		log_debug("search %d/%lld has exceeded time limit (%lld)",
469 		    search->conn->fd, search->req->msgid,
470 		    search->tmlim);
477 		bufferevent_enable(search->conn->bev, EV_WRITE);
480 		    search->nscanned, search->nmatched, search->ndups);
481 		send_ldap_result(conn, search->req->msgid,
484 			log_debug("search failed: %s", strerror(errno));
485 		search_close(search);
490 ldap_search_root_dse(struct search *search)
531 	if ((search->conn->s_flags & F_SECURE) == F_SECURE) {
538 	search_result("", 0, root, search);
540 	send_ldap_result(search->conn, search->req->msgid,
542 	search_close(search);
546 ldap_search_subschema(struct search *search)
579 	if (should_include_attribute("objectClasses", search, 1)) {
593 	if (should_include_attribute("attributeTypes", search, 1)) {
607 	if (should_include_attribute("matchingRules", search, 1)) {
622 	search_result("cn=schema", 9, root, search);
627 	send_ldap_result(search->conn, search->req->msgid,
629 	search_close(search);
810 			log_debug("NOT filter forced unindexed search");
853 	struct search		*search = NULL;
864 	if ((search = calloc(1, sizeof(*search))) == NULL)
866 	search->req = req;
867 	search->conn = req->conn;
868 	search->init = 0;
869 	search->started_at = time(0);
870 	TAILQ_INSERT_HEAD(&req->conn->searches, search, next);
871 	RB_INIT(&search->uniqdns);
874 	    &search->basedn,
875 	    &search->scope,
876 	    &search->deref,
877 	    &search->szlim,
878 	    &search->tmlim,
879 	    &search->typesonly,
880 	    &search->filter,
881 	    &search->attrlist) != 0) {
882 		log_warnx("failed to parse search request");
887 	normalize_dn(search->basedn);
888 	log_debug("base dn = %s, scope = %lld", search->basedn, search->scope);
890 	if (*search->basedn == '\0') {
897 		if (search->scope != LDAP_SCOPE_BASE) {
903 		ldap_search_root_dse(search);
907 	if (strcasecmp(search->basedn, "cn=schema") == 0) {
914 		if (search->scope != LDAP_SCOPE_BASE) {
920 		ldap_search_subschema(search);
924 	if ((search->ns = namespace_for_base(search->basedn)) == NULL) {
925 		refs = namespace_referrals(search->basedn);
927 			ldap_refer(req, search->basedn, search, refs);
928 			search->req = NULL; /* request free'd by ldap_refer */
929 			search_close(search);
933 		    search->basedn);
938 	if (!authorized(req->conn, search->ns, ACI_READ,
939 	    search->basedn, NULL, search->scope)) {
944 	if (namespace_begin_txn(search->ns, &search->data_txn,
945 	    &search->indx_txn, 1) != BT_SUCCESS) {
947 			if (namespace_queue_request(search->ns, req) != 0) {
951 			search->req = NULL;	/* keep the scheduled request */
952 			search_close(search);
959 	if (search->scope == LDAP_SCOPE_BASE) {
964 		key.data = search->basedn;
967 		if (btree_txn_get(NULL, search->data_txn, &key, &val) == 0) {
968 			check_search_entry(&key, &val, search);
978 	if (!namespace_exists(search->ns, search->basedn)) {
983 	search->plan = search_planner(search->ns, search->filter);
984 	if (search->plan == NULL) {
989 	if (search->plan->undefined) {
990 		log_debug("whole search filter is undefined");
995 	if (!search->plan->indexed && search->scope == LDAP_SCOPE_ONELEVEL) {
997 		sz = strlen(search->basedn) - strlen(search->ns->suffix);
998 		if (sz > 0 && search->basedn[sz - 1] == ',')
1000 		add_index(search->plan, "@%.*s,", sz, search->basedn);
1003 	if (!search->plan->indexed)
1011 	if (search)
1012 		search_close(search);