From be1063e322e30a587159a83b5b797d532206b0eb Mon Sep 17 00:00:00 2001 From: Pierangelo Masarati Date: Sun, 28 Jan 2007 00:56:43 +0000 Subject: [PATCH] import back-ldap/back-meta improvements from HEAD --- CHANGES | 1 + servers/slapd/back-ldap/back-ldap.h | 11 ++-- servers/slapd/back-ldap/bind.c | 39 ++++++++---- servers/slapd/back-ldap/config.c | 4 +- servers/slapd/back-ldap/search.c | 35 ++++++++++- servers/slapd/back-meta/back-meta.h | 6 +- servers/slapd/back-meta/bind.c | 23 +++---- servers/slapd/back-meta/config.c | 9 ++- servers/slapd/back-meta/conn.c | 95 ++++++++++++++++------------- servers/slapd/back-meta/search.c | 33 +++++++++- 10 files changed, 172 insertions(+), 84 deletions(-) diff --git a/CHANGES b/CHANGES index b5dca8ed0c..18bd0efc0e 100644 --- a/CHANGES +++ b/CHANGES @@ -6,6 +6,7 @@ OpenLDAP 2.3.34 Engineering Fixed slapadd LDIF parsing (ITS#4817) Fixed slapd syncrepl memory leaks (ITS#4805) Fixed slapd-bdb/hdb be_entry_get with aliases/referrals (ITS#4810) + Fixed slapd-ldap more response handling bugs (ITS#4782) Fixed slapd-ldap C-API code tests (ITS#4808) Fixed slapd-monitor NULL printf (ITS#4811) Fixed slapo-syncprov presence list (ITS#4813) diff --git a/servers/slapd/back-ldap/back-ldap.h b/servers/slapd/back-ldap/back-ldap.h index c248e71e1b..f47ceea21d 100644 --- a/servers/slapd/back-ldap/back-ldap.h +++ b/servers/slapd/back-ldap/back-ldap.h @@ -63,11 +63,11 @@ typedef struct ldapconn_t { ( -1 - (long)(lc)->lc_conn ) : (lc)->lc_conn->c_connid ) #ifdef HAVE_TLS #define LDAP_BACK_PCONN_ROOTDN_SET(lc, op) \ - ((lc)->lc_conn = (void *)((op)->o_conn->c_is_tls ? LDAP_BACK_PCONN_ROOTDN_TLS : LDAP_BACK_PCONN_ROOTDN)) + ((lc)->lc_conn = (void *)((op)->o_conn->c_is_tls ? (void *) LDAP_BACK_PCONN_ROOTDN_TLS : (void *) LDAP_BACK_PCONN_ROOTDN)) #define LDAP_BACK_PCONN_ANON_SET(lc, op) \ - ((lc)->lc_conn = (void *)((op)->o_conn->c_is_tls ? LDAP_BACK_PCONN_ANON_TLS : LDAP_BACK_PCONN_ANON)) + ((lc)->lc_conn = (void *)((op)->o_conn->c_is_tls ? (void *) LDAP_BACK_PCONN_ANON_TLS : (void *) LDAP_BACK_PCONN_ANON)) #define LDAP_BACK_PCONN_BIND_SET(lc, op) \ - ((lc)->lc_conn = (void *)((op)->o_conn->c_is_tls ? LDAP_BACK_PCONN_BIND_TLS : LDAP_BACK_PCONN_BIND)) + ((lc)->lc_conn = (void *)((op)->o_conn->c_is_tls ? (void *) LDAP_BACK_PCONN_BIND_TLS : (void *) LDAP_BACK_PCONN_BIND)) #else /* ! HAVE_TLS */ #define LDAP_BACK_PCONN_ROOTDN_SET(lc, op) \ ((lc)->lc_conn = (void *)LDAP_BACK_PCONN_ROOTDN) @@ -288,6 +288,8 @@ typedef struct ldapinfo_t { #define LDAP_BACK_F_CANCEL_MASK (LDAP_BACK_F_CANCEL_IGNORE|LDAP_BACK_F_CANCEL_EXOP) #define LDAP_BACK_F_CANCEL_MASK2 (LDAP_BACK_F_CANCEL_MASK|LDAP_BACK_F_CANCEL_EXOP_DISCOVER) +#define LDAP_BACK_F_QUARANTINE (0x00010000U) + #define LDAP_BACK_ISSET_F(ff,f) ( ( (ff) & (f) ) == (f) ) #define LDAP_BACK_ISMASK_F(ff,m,f) ( ( (ff) & (m) ) == (f) ) @@ -319,6 +321,8 @@ typedef struct ldapinfo_t { #define LDAP_BACK_CANCEL(li) LDAP_BACK_ISMASK( (li), LDAP_BACK_F_CANCEL_MASK, LDAP_BACK_F_CANCEL_EXOP ) #define LDAP_BACK_CANCEL_DISCOVER(li) LDAP_BACK_ISMASK( (li), LDAP_BACK_F_CANCEL_MASK2, LDAP_BACK_F_CANCEL_EXOP_DISCOVER ) +#define LDAP_BACK_QUARANTINE(li) LDAP_BACK_ISSET( (li), LDAP_BACK_F_QUARANTINE ) + int li_version; /* cached connections; @@ -341,7 +345,6 @@ typedef struct ldapinfo_t { #define LDAP_BACK_FQ_RETRYING (2) slap_retry_info_t li_quarantine; -#define LDAP_BACK_QUARANTINE(li) ( (li)->li_quarantine.ri_num != NULL ) ldap_pvt_thread_mutex_t li_quarantine_mutex; ldap_back_quarantine_f li_quarantine_f; void *li_quarantine_p; diff --git a/servers/slapd/back-ldap/bind.c b/servers/slapd/back-ldap/bind.c index b4f4529887..c9d8ecbadb 100644 --- a/servers/slapd/back-ldap/bind.c +++ b/servers/slapd/back-ldap/bind.c @@ -644,6 +644,7 @@ ldap_back_prepare_conn( ldapconn_t *lc, Operation *op, SlapReply *rs, ldap_back_ ldap_pvt_thread_mutex_unlock( &li->li_uri_mutex ); if ( rs->sr_err != LDAP_SUCCESS ) { ldap_unbind_ext( ld, NULL, NULL ); + rs->sr_text = "Start TLS failed"; goto error_return; } else if ( li->li_idle_timeout ) { @@ -670,10 +671,9 @@ error_return:; rs->sr_err = slap_map_api2result( rs ); if ( sendok & LDAP_BACK_SENDERR ) { if ( rs->sr_text == NULL ) { - rs->sr_text = "ldap_initialize() failed"; + rs->sr_text = "Proxy connection initialization failed"; } send_ldap_result( op, rs ); - rs->sr_text = NULL; } } else { @@ -726,6 +726,7 @@ ldap_back_getconn( if ( dont_retry ) { rs->sr_err = LDAP_UNAVAILABLE; if ( op->o_conn && ( sendok & LDAP_BACK_SENDERR ) ) { + rs->sr_text = "Target is quarantined"; send_ldap_result( op, rs ); } return NULL; @@ -1019,10 +1020,9 @@ retry_lock: LDAP_BACK_CONN_CACHED_CLEAR( lc ); ldap_back_conn_free( lc ); rs->sr_err = LDAP_OTHER; - rs->sr_text = "proxy bind collision"; + rs->sr_text = "Proxy bind collision"; if ( op->o_conn && ( sendok & LDAP_BACK_SENDERR ) ) { send_ldap_result( op, rs ); - rs->sr_text = NULL; } return NULL; } @@ -1350,6 +1350,7 @@ retry:; /* lc here must be the regular lc, reset and ready for init */ rs->sr_err = ldap_back_prepare_conn( lc, op, rs, sendok ); if ( rs->sr_err != LDAP_SUCCESS ) { + sendok &= ~LDAP_BACK_SENDERR; lc->lc_refcnt = 0; } } @@ -1379,6 +1380,7 @@ retry:; if ( rs->sr_err != LDAP_SUCCESS && ( sendok & LDAP_BACK_SENDERR ) ) { + rs->sr_text = "Internal proxy bind failure"; send_ldap_result( op, rs ); } @@ -1386,7 +1388,7 @@ retry:; } rc = ldap_back_op_result( lc, op, rs, msgid, - -1, (sendok|LDAP_BACK_BINDING) ); + -1, ( sendok | LDAP_BACK_BINDING ) ); if ( rc == LDAP_SUCCESS ) { LDAP_BACK_CONN_ISBOUND_SET( lc ); } @@ -1559,8 +1561,23 @@ retry:; if ( sendok & LDAP_BACK_BINDING ) { ldap_unbind_ext( lc->lc_ld, NULL, NULL ); lc->lc_ld = NULL; + + /* let it be used, but taint/delete it so that + * no-one else can look it up any further */ + ldap_pvt_thread_mutex_lock( &li->li_conninfo.lai_mutex ); + +#if LDAP_BACK_PRINT_CONNTREE > 0 + ldap_back_print_conntree( li, ">>> ldap_back_getconn(timeout)" ); +#endif /* LDAP_BACK_PRINT_CONNTREE */ + + (void)ldap_back_conn_delete( li, lc ); LDAP_BACK_CONN_TAINTED_SET( lc ); +#if LDAP_BACK_PRINT_CONNTREE > 0 + ldap_back_print_conntree( li, "<<< ldap_back_getconn(timeout)" ); +#endif /* LDAP_BACK_PRINT_CONNTREE */ + ldap_pvt_thread_mutex_unlock( &li->li_conninfo.lai_mutex ); + } else { (void)ldap_back_cancel( lc, op, rs, msgid, sendok ); } @@ -1636,6 +1653,7 @@ retry:; ldap_back_quarantine( op, rs ); } if ( op->o_conn && ( sendok & LDAP_BACK_SENDERR ) ) { + if ( rs->sr_text == NULL ) rs->sr_text = "Proxy operation retry failed"; send_ldap_result( op, rs ); } } @@ -1681,8 +1699,7 @@ int ldap_back_retry( ldapconn_t **lcp, Operation *op, SlapReply *rs, ldap_back_send_t sendok ) { ldapinfo_t *li = (ldapinfo_t *)op->o_bd->be_private; - int rc = 0, - binding; + int rc = 0; assert( lcp != NULL ); assert( *lcp != NULL ); @@ -1690,7 +1707,7 @@ ldap_back_retry( ldapconn_t **lcp, Operation *op, SlapReply *rs, ldap_back_send_ ldap_pvt_thread_mutex_lock( &li->li_conninfo.lai_mutex ); if ( (*lcp)->lc_refcnt == 1 ) { - binding = LDAP_BACK_CONN_BINDING( *lcp ); + int binding = LDAP_BACK_CONN_BINDING( *lcp ); ldap_pvt_thread_mutex_lock( &li->li_uri_mutex ); Debug( LDAP_DEBUG_ANY, @@ -1739,9 +1756,9 @@ ldap_back_retry( ldapconn_t **lcp, Operation *op, SlapReply *rs, ldap_back_send_ ldap_back_release_conn_lock( li, lcp, 0 ); assert( *lcp == NULL ); - if ( sendok ) { + if ( sendok & LDAP_BACK_SENDERR ) { rs->sr_err = LDAP_UNAVAILABLE; - rs->sr_text = "unable to retry"; + rs->sr_text = "Unable to retry"; send_ldap_result( op, rs ); } } @@ -1986,7 +2003,7 @@ ldap_back_proxy_authz_bind( binddn->bv_val, LDAP_SASL_SIMPLE, bindcred, NULL, NULL, &msgid ); rc = ldap_back_op_result( lc, op, rs, msgid, - -1, (sendok|LDAP_BACK_BINDING) ); + -1, ( sendok | LDAP_BACK_BINDING ) ); break; default: diff --git a/servers/slapd/back-ldap/config.c b/servers/slapd/back-ldap/config.c index 3f68a3294d..83e842abe6 100644 --- a/servers/slapd/back-ldap/config.c +++ b/servers/slapd/back-ldap/config.c @@ -382,9 +382,7 @@ static slap_cf_aux_table timeout_table[] = { { BER_BVC("modrdn="), SLAP_OP_MODRDN * sizeof( time_t ), 'u', 0, NULL }, { BER_BVC("modify="), SLAP_OP_MODIFY * sizeof( time_t ), 'u', 0, NULL }, { BER_BVC("compare="), SLAP_OP_COMPARE * sizeof( time_t ), 'u', 0, NULL }, -#if 0 /* uses timelimit instead */ { BER_BVC("search="), SLAP_OP_SEARCH * sizeof( time_t ), 'u', 0, NULL }, -#endif /* abandon makes little sense */ #if 0 /* not implemented yet */ { BER_BVC("extended="), SLAP_OP_EXTENDED * sizeof( time_t ), 'u', 0, NULL }, @@ -1224,6 +1222,7 @@ ldap_back_cf_gen( ConfigArgs *c ) slap_retry_info_destroy( &li->li_quarantine ); ldap_pvt_thread_mutex_destroy( &li->li_quarantine_mutex ); li->li_isquarantined = 0; + li->li_flags &= ~LDAP_BACK_F_QUARANTINE; break; default: @@ -1835,6 +1834,7 @@ done_url:; /* give it a chance to retry if the pattern gets reset * via back-config */ li->li_isquarantined = 0; + li->li_flags |= LDAP_BACK_F_QUARANTINE; } break; diff --git a/servers/slapd/back-ldap/search.c b/servers/slapd/back-ldap/search.c index 75bceebbf8..3c7c9a3421 100644 --- a/servers/slapd/back-ldap/search.c +++ b/servers/slapd/back-ldap/search.c @@ -256,12 +256,20 @@ retry: } } + /* if needed, initialize timeout */ + if ( li->li_timeout[ SLAP_OP_SEARCH ] ) { + if ( tv.tv_sec == 0 || tv.tv_sec > li->li_timeout[ SLAP_OP_SEARCH ] ) { + tv.tv_sec = li->li_timeout[ SLAP_OP_SEARCH ]; + tv.tv_usec = 0; + } + } + /* We pull apart the ber result, stuff it into a slapd entry, and * let send_search_entry stuff it back into ber format. Slow & ugly, * but this is necessary for version matching, and for ACL processing. */ - for ( rc = 0; rc != -1; rc = ldap_result( lc->lc_ld, msgid, LDAP_MSG_ONE, &tv, &res ) ) + for ( rc = -2; rc != -1; rc = ldap_result( lc->lc_ld, msgid, LDAP_MSG_ONE, &tv, &res ) ) { /* check for abandon */ if ( op->o_abandon || LDAP_BACK_CONN_ABANDON( lc ) ) { @@ -273,10 +281,23 @@ retry: goto finish; } - if ( rc == 0 ) { - LDAP_BACK_TV_SET( &tv ); + if ( rc == 0 || rc == -2 ) { ldap_pvt_thread_yield(); + /* check timeout */ + if ( li->li_timeout[ SLAP_OP_SEARCH ] ) { + if ( rc == 0 ) { + (void)ldap_back_cancel( lc, op, rs, msgid, LDAP_BACK_DONTSEND ); + rs->sr_text = "Operation timed out"; + rc = rs->sr_err = op->o_protocol >= LDAP_VERSION3 ? + LDAP_ADMINLIMIT_EXCEEDED : LDAP_OTHER; + goto finish; + } + + } else { + LDAP_BACK_TV_SET( &tv ); + } + /* check time limit */ if ( op->ors_tlimit != SLAP_NO_LIMIT && slap_get_time() > stoptime ) @@ -451,6 +472,14 @@ retry: rc = 0; break; } + + /* if needed, restore timeout */ + if ( li->li_timeout[ SLAP_OP_SEARCH ] ) { + if ( tv.tv_sec == 0 || tv.tv_sec > li->li_timeout[ SLAP_OP_SEARCH ] ) { + tv.tv_sec = li->li_timeout[ SLAP_OP_SEARCH ]; + tv.tv_usec = 0; + } + } } if ( rc == -1 && dont_retry == 0 ) { diff --git a/servers/slapd/back-meta/back-meta.h b/servers/slapd/back-meta/back-meta.h index 4841e1e69f..a45b2fc869 100644 --- a/servers/slapd/back-meta/back-meta.h +++ b/servers/slapd/back-meta/back-meta.h @@ -297,7 +297,6 @@ typedef struct metatarget_t { sig_atomic_t mt_isquarantined; slap_retry_info_t mt_quarantine; ldap_pvt_thread_mutex_t mt_quarantine_mutex; -#define META_BACK_TGT_QUARANTINE(mt) ( (mt)->mt_quarantine.ri_num != NULL ) unsigned mt_flags; #define META_BACK_TGT_ISSET(mt,f) ( ( (mt)->mt_flags & (f) ) == (f) ) @@ -310,6 +309,7 @@ typedef struct metatarget_t { #define META_BACK_TGT_IGNORE(mt) META_BACK_TGT_ISMASK( (mt), LDAP_BACK_F_CANCEL_MASK, LDAP_BACK_F_CANCEL_IGNORE ) #define META_BACK_TGT_CANCEL(mt) META_BACK_TGT_ISMASK( (mt), LDAP_BACK_F_CANCEL_MASK, LDAP_BACK_F_CANCEL_EXOP ) #define META_BACK_TGT_CANCEL_DISCOVER(mt) META_BACK_TGT_ISMASK( (mt), LDAP_BACK_F_CANCEL_MASK2, LDAP_BACK_F_CANCEL_EXOP_DISCOVER ) +#define META_BACK_TGT_QUARANTINE(mt) META_BACK_TGT_ISSET( (mt), LDAP_BACK_F_QUARANTINE ) int mt_version; time_t mt_network_timeout; @@ -361,8 +361,6 @@ typedef struct metainfo_t { /* NOTE: quarantine uses the connection mutex */ slap_retry_info_t mi_quarantine; - -#define META_BACK_QUARANTINE(mi) ( (mi)->mi_quarantine.ri_num != NULL ) meta_back_quarantine_f mi_quarantine_f; void *mi_quarantine_p; @@ -386,6 +384,8 @@ typedef struct metainfo_t { #define META_BACK_PROXYAUTHZ_ANON(mi) LDAP_BACK_ISSET( (mi), META_BACK_F_PROXYAUTHZ_ANON ) #define META_BACK_PROXYAUTHZ_NOANON(mi) LDAP_BACK_ISSET( (mi), META_BACK_F_PROXYAUTHZ_NOANON ) +#define META_BACK_QUARANTINE(mi) LDAP_BACK_ISSET( (mi), LDAP_BACK_F_QUARANTINE ) + int mi_version; time_t mi_network_timeout; time_t mi_conn_ttl; diff --git a/servers/slapd/back-meta/bind.c b/servers/slapd/back-meta/bind.c index 219bef4442..f5cb6206a2 100644 --- a/servers/slapd/back-meta/bind.c +++ b/servers/slapd/back-meta/bind.c @@ -1237,15 +1237,14 @@ meta_back_proxy_authz_cred( send_ldap_result( op, rs ); } LDAP_BACK_CONN_ISBOUND_CLEAR( msc ); + goto done; - } else { - rs->sr_err = LDAP_SUCCESS; - *binddn = slap_empty_bv; - *bindcred = slap_empty_bv; - break; } - goto done; + rs->sr_err = LDAP_SUCCESS; + *binddn = slap_empty_bv; + *bindcred = slap_empty_bv; + break; } else if ( mt->mt_idassert_authz && !be_isroot( op ) ) { struct berval authcDN; @@ -1264,15 +1263,13 @@ meta_back_proxy_authz_cred( send_ldap_result( op, rs ); } LDAP_BACK_CONN_ISBOUND_CLEAR( msc ); - - } else { - rs->sr_err = LDAP_SUCCESS; - *binddn = slap_empty_bv; - *bindcred = slap_empty_bv; - break; + goto done; } - goto done; + rs->sr_err = LDAP_SUCCESS; + *binddn = slap_empty_bv; + *bindcred = slap_empty_bv; + break; } } diff --git a/servers/slapd/back-meta/config.c b/servers/slapd/back-meta/config.c index 56ca9dcc6f..6a00b5a99a 100644 --- a/servers/slapd/back-meta/config.c +++ b/servers/slapd/back-meta/config.c @@ -973,10 +973,8 @@ meta_back_db_config( t = &tv[ SLAP_OP_MODIFY ]; } else if ( strncasecmp( argv[ c ], "compare", len ) == 0 ) { t = &tv[ SLAP_OP_COMPARE ]; -#if 0 /* uses timelimit instead */ } else if ( strncasecmp( argv[ c ], "search", len ) == 0 ) { t = &tv[ SLAP_OP_SEARCH ]; -#endif /* abandon makes little sense */ #if 0 /* not implemented yet */ } else if ( strncasecmp( argv[ c ], "extended", len ) == 0 ) { @@ -1230,6 +1228,13 @@ idassert-authzFrom "dn:" fname, lineno, buf ); return 1; } + + if ( mi->mi_ntargets ) { + mi->mi_flags |= LDAP_BACK_F_QUARANTINE; + + } else { + mi->mi_targets[ mi->mi_ntargets - 1 ]->mt_flags |= LDAP_BACK_F_QUARANTINE; + } /* dn massaging */ } else if ( strcasecmp( argv[ 0 ], "suffixmassage" ) == 0 ) { diff --git a/servers/slapd/back-meta/conn.c b/servers/slapd/back-meta/conn.c index 6c2ff11abc..8a585948dc 100644 --- a/servers/slapd/back-meta/conn.c +++ b/servers/slapd/back-meta/conn.c @@ -279,28 +279,33 @@ meta_back_init_one_conn( slap_retry_info_t *ri = &mt->mt_quarantine; int dont_retry = 1; - if ( mt->mt_isquarantined == LDAP_BACK_FQ_YES ) { - dont_retry = ( ri->ri_num[ ri->ri_idx ] == SLAP_RETRYNUM_TAIL - || slap_get_time() < ri->ri_last + ri->ri_interval[ ri->ri_idx ] ); - if ( !dont_retry ) { - if ( StatslogTest( LDAP_DEBUG_ANY ) ) { - char buf[ SLAP_TEXT_BUFLEN ]; - - snprintf( buf, sizeof( buf ), - "meta_back_init_one_conn[%d]: quarantine " - "retry block #%d try #%d", - candidate, ri->ri_idx, ri->ri_count ); - Debug( LDAP_DEBUG_ANY, "%s %s.\n", - op->o_log_prefix, buf, 0 ); + if ( mt->mt_quarantine.ri_interval ) { + ldap_pvt_thread_mutex_lock( &mt->mt_quarantine_mutex ); + if ( mt->mt_isquarantined == LDAP_BACK_FQ_YES ) { + dont_retry = ( ri->ri_num[ ri->ri_idx ] == SLAP_RETRYNUM_TAIL + || slap_get_time() < ri->ri_last + ri->ri_interval[ ri->ri_idx ] ); + if ( !dont_retry ) { + if ( StatslogTest( LDAP_DEBUG_ANY ) ) { + char buf[ SLAP_TEXT_BUFLEN ]; + + snprintf( buf, sizeof( buf ), + "meta_back_init_one_conn[%d]: quarantine " + "retry block #%d try #%d", + candidate, ri->ri_idx, ri->ri_count ); + Debug( LDAP_DEBUG_ANY, "%s %s.\n", + op->o_log_prefix, buf, 0 ); + } } mt->mt_isquarantined = LDAP_BACK_FQ_RETRYING; } + ldap_pvt_thread_mutex_unlock( &mt->mt_quarantine_mutex ); } if ( dont_retry ) { rs->sr_err = LDAP_UNAVAILABLE; if ( op->o_conn && ( sendok & LDAP_BACK_SENDERR ) ) { + rs->sr_text = "Target is quarantined"; send_ldap_result( op, rs ); } return rs->sr_err; @@ -336,6 +341,7 @@ retry_lock:; /* sounds more appropriate */ rs->sr_err = LDAP_BUSY; + rs->sr_text = "No connections to target are available"; do_return = 1; } else if ( META_BACK_CONN_INITED( msc ) ) { @@ -355,7 +361,10 @@ retry_lock:; } if ( do_return ) { - if ( rs->sr_err != LDAP_SUCCESS && op->o_conn && ( sendok & LDAP_BACK_SENDERR ) ) { + if ( rs->sr_err != LDAP_SUCCESS + && op->o_conn + && ( sendok & LDAP_BACK_SENDERR ) ) + { send_ldap_result( op, rs ); } @@ -398,8 +407,10 @@ retry_lock:; #ifdef HAVE_TLS /* start TLS ("tls [try-]{start|propagate}" statement) */ - if ( ( LDAP_BACK_USE_TLS( mi ) || ( op->o_conn->c_is_tls && LDAP_BACK_PROPAGATE_TLS( mi ) ) ) - && !is_ldaps ) + if ( ( LDAP_BACK_USE_TLS( mi ) + || ( op->o_conn->c_is_tls + && LDAP_BACK_PROPAGATE_TLS( mi ) ) ) + && !is_ldaps ) { #ifdef SLAP_STARTTLS_ASYNCHRONOUS /* @@ -446,14 +457,14 @@ retry:; struct berval *data = NULL; /* NOTE: right now, data is unused, so don't get it */ - rs->sr_err = ldap_parse_extended_result( msc->msc_ld, res, - NULL, NULL /* &data */ , 0 ); + rs->sr_err = ldap_parse_extended_result( msc->msc_ld, + res, NULL, NULL /* &data */ , 0 ); if ( rs->sr_err == LDAP_SUCCESS ) { int err; /* FIXME: matched? referrals? response controls? */ - rs->sr_err = ldap_parse_result( msc->msc_ld, res, - &err, NULL, NULL, NULL, NULL, 1 ); + rs->sr_err = ldap_parse_result( msc->msc_ld, + res, &err, NULL, NULL, NULL, NULL, 1 ); res = NULL; if ( rs->sr_err == LDAP_SUCCESS ) { @@ -470,14 +481,12 @@ retry:; } else if ( rs->sr_err == LDAP_REFERRAL ) { /* FIXME: LDAP_OPERATIONS_ERROR? */ rs->sr_err = LDAP_OTHER; - rs->sr_text = "unwilling to chase referral returned by Start TLS exop"; + rs->sr_text = "Unwilling to chase referral " + "returned by Start TLS exop"; } if ( data ) { - if ( data->bv_val ) { - ber_memfree( data->bv_val ); - } - ber_memfree( data ); + ber_bvfree( data ); } } @@ -501,12 +510,16 @@ retry:; * of misconfiguration, but also when used in the chain * overlay, where the "uri" can be parsed out of a referral */ if ( rs->sr_err == LDAP_SERVER_DOWN - || ( rs->sr_err != LDAP_SUCCESS && LDAP_BACK_TLS_CRITICAL( mi ) ) ) + || ( rs->sr_err != LDAP_SUCCESS + && LDAP_BACK_TLS_CRITICAL( mi ) ) ) { #ifdef DEBUG_205 - Debug( LDAP_DEBUG_ANY, "### %s meta_back_init_one_conn(TLS) ldap_unbind_ext[%d] ld=%p\n", - op->o_log_prefix, candidate, (void *)msc->msc_ld ); + Debug( LDAP_DEBUG_ANY, + "### %s meta_back_init_one_conn(TLS) " + "ldap_unbind_ext[%d] ld=%p\n", + op->o_log_prefix, candidate, + (void *)msc->msc_ld ); #endif /* DEBUG_205 */ /* need to trash a failed Start TLS */ @@ -575,8 +588,11 @@ retry:; { #ifdef DEBUG_205 - Debug( LDAP_DEBUG_ANY, "### %s meta_back_init_one_conn(rewrite) ldap_unbind_ext[%d] ld=%p\n", - op->o_log_prefix, candidate, (void *)msc->msc_ld ); + Debug( LDAP_DEBUG_ANY, + "### %s meta_back_init_one_conn(rewrite) " + "ldap_unbind_ext[%d] ld=%p\n", + op->o_log_prefix, candidate, + (void *)msc->msc_ld ); #endif /* DEBUG_205 */ /* need to trash a connection not fully established */ @@ -618,7 +634,6 @@ error_return:; rs->sr_err = slap_map_api2result( rs ); if ( sendok & LDAP_BACK_SENDERR ) { send_ldap_result( op, rs ); - rs->sr_text = NULL; } } @@ -771,7 +786,7 @@ meta_back_retry( if ( sendok & LDAP_BACK_SENDERR ) { rs->sr_err = rc; - rs->sr_text = NULL; + rs->sr_text = "Unable to retry"; send_ldap_result( op, rs ); } } @@ -830,7 +845,7 @@ meta_back_get_candidate( */ if ( candidate == META_TARGET_NONE ) { rs->sr_err = LDAP_NO_SUCH_OBJECT; - rs->sr_text = "no suitable candidate target found"; + rs->sr_text = "No suitable candidate target found"; } else if ( candidate == META_TARGET_MULTIPLE ) { Filter f = { 0 }; @@ -883,7 +898,7 @@ meta_back_get_candidate( } else { rs->sr_err = LDAP_UNWILLING_TO_PERFORM; - rs->sr_text = "cannot select unique candidate target"; + rs->sr_text = "Unable to select unique candidate target"; } break; } @@ -1259,7 +1274,6 @@ retry_lock:; rs->sr_matched = op->o_bd->be_suffix[ 0 ].bv_val; } send_ldap_result( op, rs ); - rs->sr_text = NULL; rs->sr_matched = NULL; } @@ -1307,7 +1321,6 @@ retry_lock:; rs->sr_matched = op->o_bd->be_suffix[ 0 ].bv_val; } send_ldap_result( op, rs ); - rs->sr_text = NULL; rs->sr_matched = NULL; } @@ -1322,10 +1335,9 @@ retry_lock:; } rs->sr_err = LDAP_UNWILLING_TO_PERFORM; - rs->sr_text = "cross-target rename not supported"; + rs->sr_text = "Cross-target rename not supported"; if ( sendok & LDAP_BACK_SENDERR ) { send_ldap_result( op, rs ); - rs->sr_text = NULL; } return NULL; @@ -1503,7 +1515,6 @@ retry_lock2:; if ( META_BACK_ONERR_STOP( mi ) ) { if ( sendok & LDAP_BACK_SENDERR ) { send_ldap_result( op, rs ); - rs->sr_text = NULL; } if ( new_conn ) { mc->mc_refcnt = 0; @@ -1516,7 +1527,6 @@ retry_lock2:; return NULL; } - rs->sr_text = NULL; continue; } @@ -1546,7 +1556,6 @@ retry_lock2:; rs->sr_matched = op->o_bd->be_suffix[ 0 ].bv_val; } send_ldap_result( op, rs ); - rs->sr_text = NULL; rs->sr_matched = NULL; } @@ -1632,10 +1641,9 @@ done:; meta_back_conn_free( mc ); rs->sr_err = LDAP_OTHER; - rs->sr_text = "proxy bind collision"; + rs->sr_text = "Proxy bind collision"; if ( sendok & LDAP_BACK_SENDERR ) { send_ldap_result( op, rs ); - rs->sr_text = NULL; } return NULL; } @@ -1698,6 +1706,7 @@ meta_back_release_conn_lock( tmpmc = avl_delete( &mi->mi_conninfo.lai_tree, ( caddr_t )mc, meta_back_conndnmc_cmp ); + /* Overparanoid, but useful... */ assert( tmpmc == NULL || tmpmc == mc ); } diff --git a/servers/slapd/back-meta/search.c b/servers/slapd/back-meta/search.c index 184d798ef8..86efcbeea7 100644 --- a/servers/slapd/back-meta/search.c +++ b/servers/slapd/back-meta/search.c @@ -649,7 +649,9 @@ meta_back_search( Operation *op, SlapReply *rs ) metaconn_t *mc; struct timeval save_tv = { 0, 0 }, tv; - time_t stoptime = (time_t)-1; + time_t stoptime = (time_t)(-1), + lastres_time = slap_get_time(), + timeout = 0; int rc = 0, sres = LDAP_SUCCESS; char *matched = NULL; int last = 0, ncandidates = 0, @@ -700,6 +702,13 @@ getconn:; candidates[ i ].sr_text = NULL; candidates[ i ].sr_ref = NULL; candidates[ i ].sr_ctrls = NULL; + + /* get largest timeout among candidates */ + if ( mi->mi_targets[ i ]->mt_timeout[ SLAP_OP_SEARCH ] + && mi->mi_targets[ i ]->mt_timeout[ SLAP_OP_SEARCH ] > timeout ) + { + timeout = mi->mi_targets[ i ]->mt_timeout[ SLAP_OP_SEARCH ]; + } } for ( i = 0; i < mi->mi_ntargets; i++ ) { @@ -844,6 +853,22 @@ getconn:; int gotit = 0, doabandon = 0, alreadybound = ncandidates; + time_t curr_time = 0; + + /* check timeout */ + if ( timeout && lastres_time > 0 + && ( slap_get_time() - lastres_time ) > timeout ) + { + doabandon = 1; + rs->sr_text = "Operation timed out"; + rc = rs->sr_err = op->o_protocol >= LDAP_VERSION3 ? + LDAP_ADMINLIMIT_EXCEEDED : LDAP_OTHER; + savepriv = op->o_private; + op->o_private = (void *)i; + send_ldap_result( op, rs ); + op->o_private = savepriv; + goto finish; + } /* check time limit */ if ( op->ors_tlimit != SLAP_NO_LIMIT @@ -1051,9 +1076,11 @@ really_bad:; continue; default: + lastres_time = slap_get_time(); + /* only touch when activity actually took place... */ - if ( mi->mi_idle_timeout != 0 && msc->msc_time < op->o_time ) { - msc->msc_time = op->o_time; + if ( mi->mi_idle_timeout != 0 && msc->msc_time < lastres_time ) { + msc->msc_time = lastres_time; } break; } -- 2.47.2