Blame SOURCES/autofs-5.0.8-amd-lookup-update-lookup-ldap-to-handle-amd-keys.patch

306fa1
autofs-5.0.8 - amd lookup update lookup ldap to handle amd keys
306fa1
306fa1
From: Ian Kent <raven@themaw.net>
306fa1
306fa1
306fa1
---
306fa1
 include/lookup_ldap.h |    3 
306fa1
 modules/lookup_ldap.c |  707 +++++++++++++++++++++++++++++++++++++++++++++-----
306fa1
 2 files changed, 651 insertions(+), 59 deletions(-)
306fa1
306fa1
--- autofs-5.0.7.orig/include/lookup_ldap.h
306fa1
+++ autofs-5.0.7/include/lookup_ldap.h
306fa1
@@ -36,6 +36,7 @@ struct ldap_searchdn {
306fa1
 
306fa1
 struct lookup_context {
306fa1
 	char *mapname;
306fa1
+	unsigned int format;
306fa1
 
306fa1
 	char *server;
306fa1
 	int port;
306fa1
@@ -43,6 +44,8 @@ struct lookup_context {
306fa1
 	char *qdn;
306fa1
 	unsigned int timeout;
306fa1
 	unsigned int network_timeout;
306fa1
+	unsigned long timestamp;
306fa1
+	unsigned int check_defaults;
306fa1
 
306fa1
 	/* LDAP version 2 or 3 */
306fa1
 	int version;
306fa1
--- autofs-5.0.7.orig/modules/lookup_ldap.c
306fa1
+++ autofs-5.0.7/modules/lookup_ldap.c
306fa1
@@ -29,6 +29,7 @@
306fa1
 #include <resolv.h>
306fa1
 #include <lber.h>
306fa1
 #include <libxml/tree.h>
306fa1
+#include <stdlib.h>
306fa1
 
306fa1
 #define MODULE_LOOKUP
306fa1
 #include "automount.h"
306fa1
@@ -52,6 +53,14 @@ static struct ldap_schema common_schema[
306fa1
 };
306fa1
 static unsigned int common_schema_count = sizeof(common_schema)/sizeof(struct ldap_schema);
306fa1
 
306fa1
+static struct ldap_schema amd_timestamp = {
306fa1
+	"madmap", "amdmapName", "amdmapTimestamp", NULL, "amdmapTimestamp"
306fa1
+};
306fa1
+
306fa1
+static struct ldap_schema amd_schema = {
306fa1
+	"amdmap", "amdmapName", "amdmap", "amdmapKey", "amdmapValue"
306fa1
+};
306fa1
+
306fa1
 /*
306fa1
  * Initialization and de-initialization of LDAP and OpenSSL must be
306fa1
  * always serialized to avoid corruption of context structures inside
306fa1
@@ -62,6 +71,7 @@ pthread_mutex_t ldapinit_mutex = PTHREAD
306fa1
 struct ldap_search_params {
306fa1
 	struct autofs_point *ap;
306fa1
 	LDAP *ldap;
306fa1
+	char *base;
306fa1
 	char *query, **attrs;
306fa1
 	struct berval *cookie;
306fa1
 	ber_int_t pageSize;
306fa1
@@ -531,6 +541,16 @@ static int find_query_dn(unsigned logopt
306fa1
 	if (ctxt->schema)
306fa1
 		return 0;
306fa1
 
306fa1
+	if (ctxt->format & MAP_FLAG_FORMAT_AMD) {
306fa1
+		schema = alloc_common_schema(&amd_schema);
306fa1
+		if (!schema) {
306fa1
+			error(logopt, MODPREFIX "failed to allocate schema");
306fa1
+			return 0;
306fa1
+		}
306fa1
+		ctxt->schema = schema;
306fa1
+		return 1;
306fa1
+	}
306fa1
+
306fa1
 	for (i = 0; i < common_schema_count; i++) {
306fa1
 		const char *class = common_schema[i].map_class;
306fa1
 		const char *key = common_schema[i].map_attr;
306fa1
@@ -587,8 +607,10 @@ static int do_bind(unsigned logopt, LDAP
306fa1
 
306fa1
 	if (!ctxt->cur_host) {
306fa1
 		ctxt->cur_host = nhost;
306fa1
-		/* Check if schema defined in conf first time only */
306fa1
-		ctxt->schema = defaults_get_schema();
306fa1
+		if (!(ctxt->format & MAP_FLAG_FORMAT_AMD)) {
306fa1
+			/* Check if schema defined in conf first time only */
306fa1
+			ctxt->schema = defaults_get_schema();
306fa1
+		}
306fa1
 	} else {
306fa1
 		/* If connection host has changed update */
306fa1
 		if (strcmp(ctxt->cur_host, nhost)) {
306fa1
@@ -614,7 +636,7 @@ static int do_bind(unsigned logopt, LDAP
306fa1
 			      MODPREFIX "failed to find valid query dn");
306fa1
 			return 0;
306fa1
 		}
306fa1
-	} else {
306fa1
+	} else if (!(ctxt->format & MAP_FLAG_FORMAT_AMD)) {
306fa1
 		const char *class = ctxt->schema->map_class;
306fa1
 		const char *key = ctxt->schema->map_attr;
306fa1
 		if (!get_query_dn(logopt, ldap, ctxt, class, key)) {
306fa1
@@ -648,6 +670,126 @@ static LDAP *do_connect(unsigned logopt,
306fa1
 	return ldap;
306fa1
 }
306fa1
 
306fa1
+static unsigned long get_amd_timestamp(struct lookup_context *ctxt)
306fa1
+{
306fa1
+	LDAP *ldap;
306fa1
+	LDAPMessage *result = NULL, *e;
306fa1
+	char *query;
306fa1
+	int scope = LDAP_SCOPE_SUBTREE;
306fa1
+	char *map, *class, *value;
306fa1
+	char *attrs[2];
306fa1
+	struct berval **bvValues;
306fa1
+	unsigned long timestamp = 0;
306fa1
+	int rv, l, ql;
306fa1
+
306fa1
+	ldap = do_connect(LOGOPT_ANY, ctxt->server, ctxt);
306fa1
+	if (!ldap)
306fa1
+		return 0;
306fa1
+
306fa1
+	map = amd_timestamp.map_attr;
306fa1
+	class = amd_timestamp.entry_class;
306fa1
+	value = amd_timestamp.value_attr;
306fa1
+
306fa1
+	attrs[0] = value;
306fa1
+	attrs[1] = NULL;
306fa1
+
306fa1
+	/* Build a query string. */
306fa1
+	l = strlen(class) +
306fa1
+	    strlen(map) + strlen(ctxt->mapname) + 21;
306fa1
+
306fa1
+	query = malloc(l);
306fa1
+	if (query == NULL) {
306fa1
+		char buf[MAX_ERR_BUF];
306fa1
+		char *estr = strerror_r(errno, buf, sizeof(buf));
306fa1
+		crit(LOGOPT_ANY, MODPREFIX "malloc: %s", estr);
306fa1
+		return 0;
306fa1
+	}
306fa1
+
306fa1
+	/*
306fa1
+	 * Look for an entry in class under ctxt-base
306fa1
+	 * whose entry is equal to qKey.
306fa1
+	 */
306fa1
+	ql = sprintf(query, "(&(objectclass=%s)(%s=%s))",
306fa1
+		     class, map, ctxt->mapname);
306fa1
+	if (ql >= l) {
306fa1
+		error(LOGOPT_ANY,
306fa1
+		      MODPREFIX "error forming query string");
306fa1
+		free(query);
306fa1
+		return 0;
306fa1
+	}
306fa1
+
306fa1
+	rv = ldap_search_s(ldap, ctxt->base, scope, query, attrs, 0, &result);
306fa1
+	if ((rv != LDAP_SUCCESS) || !result) {
306fa1
+		crit(LOGOPT_ANY, MODPREFIX "timestamp query failed %s", query);
306fa1
+		unbind_ldap_connection(LOGOPT_ANY, ldap, ctxt);
306fa1
+		if (result)
306fa1
+			ldap_msgfree(result);
306fa1
+		free(query);
306fa1
+		return 0;
306fa1
+	}
306fa1
+
306fa1
+	e = ldap_first_entry(ldap, result);
306fa1
+	if (!e) {
306fa1
+		debug(LOGOPT_ANY,
306fa1
+		     MODPREFIX "got answer, but no entry for timestamp");
306fa1
+		ldap_msgfree(result);
306fa1
+		unbind_ldap_connection(LOGOPT_ANY, ldap, ctxt);
306fa1
+		free(query);
306fa1
+		return CHE_MISSING;
306fa1
+	}
306fa1
+
306fa1
+	while (e) {
306fa1
+		char *v_val;
306fa1
+		char *endptr;
306fa1
+
306fa1
+		bvValues = ldap_get_values_len(ldap, e, value);
306fa1
+		if (!bvValues || !*bvValues) {
306fa1
+			debug(LOGOPT_ANY,
306fa1
+			      MODPREFIX "no value found in timestamp");
306fa1
+			goto next;
306fa1
+		}
306fa1
+
306fa1
+		/* There should be one value for a timestamp */
306fa1
+		v_val = bvValues[0]->bv_val;
306fa1
+
306fa1
+		timestamp = strtol(v_val, &endptr, 0);
306fa1
+		if ((errno == ERANGE &&
306fa1
+		    (timestamp == LONG_MAX || timestamp == LONG_MIN)) ||
306fa1
+		    (errno != 0 && timestamp == 0)) {
306fa1
+			debug(LOGOPT_ANY,
306fa1
+			      MODPREFIX "invalid value in timestamp");
306fa1
+			free(query);
306fa1
+			return 0;
306fa1
+		}
306fa1
+
306fa1
+		if (endptr == v_val) {
306fa1
+			debug(LOGOPT_ANY,
306fa1
+			      MODPREFIX "no digits found in timestamp");
306fa1
+			free(query);
306fa1
+			return 0;
306fa1
+		}
306fa1
+
306fa1
+		if (*endptr != '\0') {
306fa1
+			warn(LOGOPT_ANY, MODPREFIX
306fa1
+			     "characters found after number: %s", endptr);
306fa1
+			warn(LOGOPT_ANY,
306fa1
+			     MODPREFIX "timestamp may be invalid");
306fa1
+		}
306fa1
+
306fa1
+		ldap_value_free_len(bvValues);
306fa1
+		break;
306fa1
+next:
306fa1
+		ldap_value_free_len(bvValues);
306fa1
+		e = ldap_next_entry(ldap, e);
306fa1
+	}
306fa1
+
306fa1
+	ldap_msgfree(result);
306fa1
+	unbind_ldap_connection(LOGOPT_ANY, ldap, ctxt);
306fa1
+	free(query);
306fa1
+
306fa1
+	return timestamp;
306fa1
+}
306fa1
+
306fa1
 static LDAP *connect_to_server(unsigned logopt, const char *uri, struct lookup_context *ctxt)
306fa1
 {
306fa1
 	LDAP *ldap;
306fa1
@@ -1215,7 +1357,7 @@ static int parse_server_string(unsigned
306fa1
 		const char *q = NULL;
306fa1
 
306fa1
 		/* Isolate the server(s). */
306fa1
-		if ((q = strchr(s, '/'))) {
306fa1
+		if ((q = strchr(s, '/')) || (q = strchr(s, '\0'))) {
306fa1
 			l = q - s;
306fa1
 			if (*proto) {
306fa1
 				al_len = l + strlen(proto) + 2;
306fa1
@@ -1318,8 +1460,7 @@ static int parse_server_string(unsigned
306fa1
 		ptr += l + 1;
306fa1
 	}
306fa1
 
306fa1
-	/* TODO: why did I do this - how can the map name "and" base dn be missing? */
306fa1
-	if (!ptr)
306fa1
+	if (!ptr || ctxt->format & MAP_FLAG_FORMAT_AMD)
306fa1
 		goto done;
306fa1
 
306fa1
 	/*
306fa1
@@ -1505,36 +1646,83 @@ int lookup_init(const char *mapfmt, int
306fa1
 	/* If a map type isn't explicitly given, parse it like sun entries. */
306fa1
 	if (mapfmt == NULL)
306fa1
 		mapfmt = MAPFMT_DEFAULT;
306fa1
-
306fa1
-	/*
306fa1
-	 * Parse out the server name and base dn, and fill them
306fa1
-	 * into the proper places in the lookup context structure.
306fa1
-	 */
306fa1
-	if (!parse_server_string(LOGOPT_NONE, argv[0], ctxt)) {
306fa1
-		error(LOGOPT_ANY, MODPREFIX "cannot parse server string");
306fa1
-		free_context(ctxt);
306fa1
-		return 1;
306fa1
+	if (!strcmp(mapfmt, "amd")) {
306fa1
+		ctxt->format = MAP_FLAG_FORMAT_AMD;
306fa1
+		ctxt->check_defaults = 1;
306fa1
 	}
306fa1
 
306fa1
-	if (!ctxt->base)
306fa1
-		ctxt->sdns = defaults_get_searchdns();
306fa1
-
306fa1
 	ctxt->timeout = defaults_get_ldap_timeout();
306fa1
 	ctxt->network_timeout = defaults_get_ldap_network_timeout();
306fa1
 
306fa1
-	if (!ctxt->server) {
306fa1
-		struct list_head *uris = defaults_get_uris();
306fa1
-		if (uris) {
306fa1
-			validate_uris(uris);
306fa1
-			if (!list_empty(uris))
306fa1
-				ctxt->uris = uris;
306fa1
-			else {
306fa1
-				error(LOGOPT_ANY,
306fa1
-				      "no valid uris found in config list"
306fa1
-				      ", using default system config");
306fa1
-				free(uris);
306fa1
+	if (!(ctxt->format & MAP_FLAG_FORMAT_AMD)) {
306fa1
+		/*
306fa1
+		 * Parse out the server name and base dn, and fill them
306fa1
+		 * into the proper places in the lookup context structure.
306fa1
+		 */
306fa1
+		if (!parse_server_string(LOGOPT_NONE, argv[0], ctxt)) {
306fa1
+			error(LOGOPT_ANY, MODPREFIX "cannot parse server string");
306fa1
+			free_context(ctxt);
306fa1
+			return 1;
306fa1
+		}
306fa1
+
306fa1
+		if (!ctxt->base)
306fa1
+			ctxt->sdns = defaults_get_searchdns();
306fa1
+
306fa1
+		if (!ctxt->server) {
306fa1
+			struct list_head *uris = defaults_get_uris();
306fa1
+			if (uris) {
306fa1
+				validate_uris(uris);
306fa1
+				if (!list_empty(uris))
306fa1
+					ctxt->uris = uris;
306fa1
+				else {
306fa1
+					error(LOGOPT_ANY, MODPREFIX
306fa1
+					    "no valid uris found in config list"
306fa1
+					    ", using default system config");
306fa1
+					free(uris);
306fa1
+				}
306fa1
 			}
306fa1
 		}
306fa1
+	} else {
306fa1
+		char *tmp = conf_amd_get_ldap_base();
306fa1
+		if (!tmp) {
306fa1
+			error(LOGOPT_ANY, MODPREFIX "failed to get base dn");
306fa1
+			free_context(ctxt);
306fa1
+			return 1;
306fa1
+		}
306fa1
+		ctxt->base = tmp;
306fa1
+
306fa1
+		tmp = conf_amd_get_ldap_hostports();
306fa1
+		if (!tmp) {
306fa1
+			error(LOGOPT_ANY,
306fa1
+			      MODPREFIX "failed to get ldap_hostports");
306fa1
+			free_context(ctxt);
306fa1
+			return 1;
306fa1
+		}
306fa1
+
306fa1
+		/*
306fa1
+		 * Parse out the server name and port, and save them in
306fa1
+		 * the proper places in the lookup context structure.
306fa1
+		 */
306fa1
+		if (!parse_server_string(LOGOPT_NONE, tmp, ctxt)) {
306fa1
+			error(LOGOPT_ANY, MODPREFIX "cannot parse server string");
306fa1
+			free_context(ctxt);
306fa1
+			return 1;
306fa1
+		}
306fa1
+		free(tmp);
306fa1
+
306fa1
+		if (!ctxt->server) {
306fa1
+			error(LOGOPT_ANY, MODPREFIX "ldap_hostports not valid");
306fa1
+			free_context(ctxt);
306fa1
+			return 1;
306fa1
+		}
306fa1
+
306fa1
+		tmp = strdup(argv[0]);
306fa1
+		if (!tmp) {
306fa1
+			error(LOGOPT_ANY, MODPREFIX "failed to set mapname");
306fa1
+			free_context(ctxt);
306fa1
+			return 1;
306fa1
+		}
306fa1
+		ctxt->mapname = tmp;
306fa1
 	}
306fa1
 
306fa1
 	/*
306fa1
@@ -1558,6 +1746,8 @@ int lookup_init(const char *mapfmt, int
306fa1
 	}
306fa1
 #endif
306fa1
 
306fa1
+	ctxt->timestamp = get_amd_timestamp(ctxt);
306fa1
+
306fa1
 	/* Open the parser, if we can. */
306fa1
 	ctxt->parse = open_parse(mapfmt, MODPREFIX, argc - 1, argv + 1);
306fa1
 	if (!ctxt->parse) {
306fa1
@@ -2029,7 +2219,7 @@ static int do_paged_query(struct ldap_se
306fa1
 	if (sp->morePages == TRUE)
306fa1
 		goto do_paged;
306fa1
 
306fa1
-	rv = ldap_search_s(sp->ldap, ctxt->qdn, scope, sp->query, sp->attrs, 0, &sp->result);
306fa1
+	rv = ldap_search_s(sp->ldap, sp->base, scope, sp->query, sp->attrs, 0, &sp->result);
306fa1
 	if ((rv != LDAP_SUCCESS) || !sp->result) {
306fa1
 		/*
306fa1
  		 * Check for Size Limit exceeded and force run through loop
306fa1
@@ -2063,7 +2253,7 @@ do_paged:
306fa1
 
306fa1
 	/* Search for entries in the directory using the parmeters. */
306fa1
 	rv = ldap_search_ext_s(sp->ldap,
306fa1
-			       ctxt->qdn, scope, sp->query, sp->attrs,
306fa1
+			       sp->base, scope, sp->query, sp->attrs,
306fa1
 			       0, controls, NULL, NULL, 0, &sp->result);
306fa1
 	if ((rv != LDAP_SUCCESS) && (rv != LDAP_PARTIAL_RESULTS)) {
306fa1
 		ldap_control_free(pageControl);
306fa1
@@ -2364,6 +2554,115 @@ next:
306fa1
 	return LDAP_SUCCESS;
306fa1
 }
306fa1
 
306fa1
+static int do_get_amd_entries(struct ldap_search_params *sp,
306fa1
+			      struct map_source *source,
306fa1
+			      struct lookup_context *ctxt)
306fa1
+{
306fa1
+	struct autofs_point *ap = sp->ap;
306fa1
+	struct mapent_cache *mc = source->mc;
306fa1
+	struct berval **bvKey;
306fa1
+	struct berval **bvValues;
306fa1
+	LDAPMessage *e;
306fa1
+	char *entry, *value;
306fa1
+	int rv, ret, count;
306fa1
+
306fa1
+	entry = ctxt->schema->entry_attr;
306fa1
+	value = ctxt->schema->value_attr;
306fa1
+
306fa1
+	e = ldap_first_entry(sp->ldap, sp->result);
306fa1
+	if (!e) {
306fa1
+		debug(ap->logopt,
306fa1
+		      MODPREFIX "query succeeded, no matches for %s",
306fa1
+		      sp->query);
306fa1
+		ret = ldap_parse_result(sp->ldap, sp->result,
306fa1
+					&rv, NULL, NULL, NULL, NULL, 0);
306fa1
+		if (ret == LDAP_SUCCESS)
306fa1
+			return rv;
306fa1
+		else
306fa1
+			return LDAP_OPERATIONS_ERROR;
306fa1
+	} else
306fa1
+		debug(ap->logopt, MODPREFIX "examining entries");
306fa1
+
306fa1
+	while (e) {
306fa1
+		char *k_val, *v_val;
306fa1
+		ber_len_t k_len;
306fa1
+		char *s_key;
306fa1
+
306fa1
+		bvKey = ldap_get_values_len(sp->ldap, e, entry);
306fa1
+		if (!bvKey || !*bvKey) {
306fa1
+			e = ldap_next_entry(sp->ldap, e);
306fa1
+			if (!e) {
306fa1
+				debug(ap->logopt, MODPREFIX
306fa1
+				      "failed to get next entry for query %s",
306fa1
+				      sp->query);
306fa1
+				ret = ldap_parse_result(sp->ldap,
306fa1
+							sp->result, &rv,
306fa1
+							NULL, NULL, NULL, NULL, 0);
306fa1
+				if (ret == LDAP_SUCCESS)
306fa1
+					return rv;
306fa1
+				else
306fa1
+					return LDAP_OPERATIONS_ERROR;
306fa1
+			}
306fa1
+			continue;
306fa1
+		}
306fa1
+
306fa1
+		/* By definition keys should be unique within each map entry */
306fa1
+		k_val = NULL;
306fa1
+		k_len = 0;
306fa1
+
306fa1
+		count = ldap_count_values_len(bvKey);
306fa1
+		if (count > 1)
306fa1
+			warn(ap->logopt, MODPREFIX
306fa1
+			     "more than one %s, using first", entry);
306fa1
+
306fa1
+		k_val = bvKey[0]->bv_val;
306fa1
+		k_len = bvKey[0]->bv_len;
306fa1
+
306fa1
+		bvValues = ldap_get_values_len(sp->ldap, e, value);
306fa1
+		if (!bvValues || !*bvValues) {
306fa1
+			debug(ap->logopt,
306fa1
+			      MODPREFIX "no %s defined for %s",
306fa1
+			      value, sp->query);
306fa1
+			goto next;
306fa1
+		}
306fa1
+
306fa1
+		count = ldap_count_values_len(bvValues);
306fa1
+		if (count > 1)
306fa1
+			warn(ap->logopt, MODPREFIX
306fa1
+			     "more than one %s, using first", value);
306fa1
+
306fa1
+		v_val = bvValues[0]->bv_val;
306fa1
+
306fa1
+		/* Don't fail on "/" in key => type == 0 */
306fa1
+		s_key = sanitize_path(k_val, k_len, 0, ap->logopt);
306fa1
+		if (!s_key)
306fa1
+			goto next;
306fa1
+
306fa1
+		cache_writelock(mc);
306fa1
+		cache_update(mc, source, s_key, v_val, sp->age);
306fa1
+		cache_unlock(mc);
306fa1
+
306fa1
+		free(s_key);
306fa1
+next:
306fa1
+		ldap_value_free_len(bvValues);
306fa1
+		ldap_value_free_len(bvKey);
306fa1
+		e = ldap_next_entry(sp->ldap, e);
306fa1
+		if (!e) {
306fa1
+			debug(ap->logopt, MODPREFIX
306fa1
+			      "failed to get next entry for query %s",
306fa1
+			      sp->query);
306fa1
+			ret = ldap_parse_result(sp->ldap,
306fa1
+						sp->result, &rv,
306fa1
+						NULL, NULL, NULL, NULL, 0);
306fa1
+			if (ret == LDAP_SUCCESS)
306fa1
+				return rv;
306fa1
+			else
306fa1
+				return LDAP_OPERATIONS_ERROR;
306fa1
+		}
306fa1
+	}
306fa1
+
306fa1
+	return LDAP_SUCCESS;
306fa1
+}
306fa1
 
306fa1
 static int read_one_map(struct autofs_point *ap,
306fa1
 			struct map_source *source,
306fa1
@@ -2419,9 +2718,14 @@ static int read_one_map(struct autofs_po
306fa1
 		return NSS_STATUS_UNAVAIL;
306fa1
 	}
306fa1
 
306fa1
+	if (ctxt->format & MAP_FLAG_FORMAT_AMD)
306fa1
+		sp.base = ctxt->base;
306fa1
+	else
306fa1
+		sp.base = ctxt->qdn;
306fa1
+
306fa1
 	/* Look around. */
306fa1
 	debug(ap->logopt,
306fa1
-	      MODPREFIX "searching for \"%s\" under \"%s\"", sp.query, ctxt->qdn);
306fa1
+	      MODPREFIX "searching for \"%s\" under \"%s\"", sp.query, sp.base);
306fa1
 
306fa1
 	sp.cookie = NULL;
306fa1
 	sp.pageSize = 2000;
306fa1
@@ -2465,7 +2769,10 @@ static int read_one_map(struct autofs_po
306fa1
 			return NSS_STATUS_UNAVAIL;
306fa1
 		}
306fa1
 
306fa1
-		rv = do_get_entries(&sp, source, ctxt);
306fa1
+		if (source->flags & MAP_FLAG_FORMAT_AMD)
306fa1
+			rv = do_get_amd_entries(&sp, source, ctxt);
306fa1
+		else
306fa1
+			rv = do_get_entries(&sp, source, ctxt);
306fa1
 		if (rv != LDAP_SUCCESS) {
306fa1
 			ldap_msgfree(sp.result);
306fa1
 			unbind_ldap_connection(ap->logopt, sp.ldap, ctxt);
306fa1
@@ -2874,6 +3181,219 @@ next:
306fa1
 	return ret;
306fa1
 }
306fa1
 
306fa1
+static int lookup_one_amd(struct autofs_point *ap,
306fa1
+			  struct map_source *source,
306fa1
+			  char *qKey, int qKey_len,
306fa1
+			  struct lookup_context *ctxt)
306fa1
+{
306fa1
+	struct mapent_cache *mc = source->mc;
306fa1
+	LDAP *ldap;
306fa1
+	LDAPMessage *result = NULL, *e;
306fa1
+	char *query;
306fa1
+	int scope = LDAP_SCOPE_SUBTREE;
306fa1
+	char *map, *class, *entry, *value;
306fa1
+	char *attrs[3];
306fa1
+	struct berval **bvKey;
306fa1
+	struct berval **bvValues;
306fa1
+	char buf[MAX_ERR_BUF];
306fa1
+	time_t age = time(NULL);
306fa1
+	int rv, l, ql, count;
306fa1
+	int ret = CHE_MISSING;
306fa1
+
306fa1
+	if (ctxt == NULL) {
306fa1
+		crit(ap->logopt, MODPREFIX "context was NULL");
306fa1
+		return CHE_FAIL;
306fa1
+	}
306fa1
+
306fa1
+	/* Initialize the LDAP context. */
306fa1
+	ldap = do_reconnect(ap->logopt, ctxt);
306fa1
+	if (!ldap)
306fa1
+		return CHE_UNAVAIL;
306fa1
+
306fa1
+	map = ctxt->schema->map_attr;
306fa1
+	class = ctxt->schema->entry_class;
306fa1
+	entry = ctxt->schema->entry_attr;
306fa1
+	value = ctxt->schema->value_attr;
306fa1
+
306fa1
+	attrs[0] = entry;
306fa1
+	attrs[1] = value;
306fa1
+	attrs[2] = NULL;
306fa1
+
306fa1
+	/* Build a query string. */
306fa1
+	l = strlen(class) +
306fa1
+	    strlen(map) + strlen(ctxt->mapname) +
306fa1
+	    strlen(entry) + strlen(qKey) + 24;
306fa1
+
306fa1
+	query = malloc(l);
306fa1
+	if (query == NULL) {
306fa1
+		char *estr = strerror_r(errno, buf, sizeof(buf));
306fa1
+		crit(ap->logopt, MODPREFIX "malloc: %s", estr);
306fa1
+		return CHE_FAIL;
306fa1
+	}
306fa1
+
306fa1
+	/*
306fa1
+	 * Look for an entry in class under ctxt-base
306fa1
+	 * whose entry is equal to qKey.
306fa1
+	 */
306fa1
+	ql = sprintf(query, "(&(objectclass=%s)(%s=%s)(%s=%s))",
306fa1
+		     class, map, ctxt->mapname, entry, qKey);
306fa1
+	if (ql >= l) {
306fa1
+		error(ap->logopt,
306fa1
+		      MODPREFIX "error forming query string");
306fa1
+		free(query);
306fa1
+		return CHE_FAIL;
306fa1
+	}
306fa1
+
306fa1
+	debug(ap->logopt,
306fa1
+	      MODPREFIX "searching for \"%s\" under \"%s\"", query, ctxt->base);
306fa1
+
306fa1
+	rv = ldap_search_s(ldap, ctxt->base, scope, query, attrs, 0, &result);
306fa1
+	if ((rv != LDAP_SUCCESS) || !result) {
306fa1
+		crit(ap->logopt, MODPREFIX "query failed for %s", query);
306fa1
+		unbind_ldap_connection(ap->logopt, ldap, ctxt);
306fa1
+		if (result)
306fa1
+			ldap_msgfree(result);
306fa1
+		free(query);
306fa1
+		return CHE_FAIL;
306fa1
+	}
306fa1
+
306fa1
+	debug(ap->logopt,
306fa1
+	      MODPREFIX "getting first entry for %s=\"%s\"", entry, qKey);
306fa1
+
306fa1
+	e = ldap_first_entry(ldap, result);
306fa1
+	if (!e) {
306fa1
+		debug(ap->logopt,
306fa1
+		     MODPREFIX "got answer, but no entry for %s", query);
306fa1
+		ldap_msgfree(result);
306fa1
+		unbind_ldap_connection(ap->logopt, ldap, ctxt);
306fa1
+		free(query);
306fa1
+		return CHE_MISSING;
306fa1
+	}
306fa1
+
306fa1
+	while (e) {
306fa1
+		char *k_val, *v_val;
306fa1
+		ber_len_t k_len;
306fa1
+		char *s_key;
306fa1
+
306fa1
+		bvKey = ldap_get_values_len(ldap, e, entry);
306fa1
+		if (!bvKey || !*bvKey) {
306fa1
+			e = ldap_next_entry(ldap, e);
306fa1
+			continue;
306fa1
+		}
306fa1
+
306fa1
+		/* By definition keys should be unique within each map entry */
306fa1
+		k_val = NULL;
306fa1
+		k_len = 0;
306fa1
+
306fa1
+		count = ldap_count_values_len(bvKey);
306fa1
+		if (count > 1)
306fa1
+			warn(ap->logopt, MODPREFIX
306fa1
+			     "more than one %s, using first", entry);
306fa1
+
306fa1
+		k_val = bvKey[0]->bv_val;
306fa1
+		k_len = bvKey[0]->bv_len;
306fa1
+
306fa1
+		debug(ap->logopt, MODPREFIX "examining first entry");
306fa1
+
306fa1
+		bvValues = ldap_get_values_len(ldap, e, value);
306fa1
+		if (!bvValues || !*bvValues) {
306fa1
+			debug(ap->logopt,
306fa1
+			      MODPREFIX "no %s defined for %s", value, query);
306fa1
+			goto next;
306fa1
+		}
306fa1
+
306fa1
+		count = ldap_count_values_len(bvValues);
306fa1
+		if (count > 1)
306fa1
+			warn(ap->logopt, MODPREFIX
306fa1
+			     "more than one %s, using first", value);
306fa1
+
306fa1
+		/* There should be one value for a key, use first value */
306fa1
+		v_val = bvValues[0]->bv_val;
306fa1
+
306fa1
+		/* Don't fail on "/" in key => type == 0 */
306fa1
+		s_key = sanitize_path(k_val, k_len, 0, ap->logopt);
306fa1
+		if (!s_key)
306fa1
+			goto next;
306fa1
+
306fa1
+		cache_writelock(mc);
306fa1
+		ret = cache_update(mc, source, s_key, v_val, age);
306fa1
+		cache_unlock(mc);
306fa1
+
306fa1
+		free(s_key);
306fa1
+next:
306fa1
+		ldap_value_free_len(bvValues);
306fa1
+		ldap_value_free_len(bvKey);
306fa1
+		e = ldap_next_entry(ldap, e);
306fa1
+	}
306fa1
+
306fa1
+	ldap_msgfree(result);
306fa1
+	unbind_ldap_connection(ap->logopt, ldap, ctxt);
306fa1
+	free(query);
306fa1
+
306fa1
+	return ret;
306fa1
+}
306fa1
+
306fa1
+static int match_key(struct autofs_point *ap,
306fa1
+		     struct map_source *source,
306fa1
+		     char *key, int key_len,
306fa1
+		     struct lookup_context *ctxt)
306fa1
+{
306fa1
+	unsigned int is_amd_format = source->flags & MAP_FLAG_FORMAT_AMD;
306fa1
+	char buf[MAX_ERR_BUF];
306fa1
+	char *lkp_key;
306fa1
+	char *prefix;
306fa1
+	int ret;
306fa1
+
306fa1
+	if (is_amd_format)
306fa1
+		ret = lookup_one_amd(ap, source, key, key_len, ctxt);
306fa1
+	else
306fa1
+		ret = lookup_one(ap, source, key, key_len, ctxt);
306fa1
+
306fa1
+	if (ret == CHE_OK || ret == CHE_UPDATED)
306fa1
+		return ret;
306fa1
+
306fa1
+	if (!is_amd_format)
306fa1
+		return CHE_FAIL;
306fa1
+
306fa1
+	lkp_key = strdup(key);
306fa1
+	if (!lkp_key) {
306fa1
+		char *estr = strerror_r(errno, buf, MAX_ERR_BUF);
306fa1
+		error(ap->logopt, MODPREFIX "strdup: %s", estr);
306fa1
+		return CHE_FAIL;
306fa1
+	}
306fa1
+
306fa1
+	ret = CHE_MISSING;
306fa1
+
306fa1
+	/*
306fa1
+	 * Now strip successive directory components and try a
306fa1
+	 * match against map entries ending with a wildcard and
306fa1
+	 * finally try the wilcard entry itself.
306fa1
+	 */
306fa1
+	while ((prefix = strrchr(lkp_key, '/'))) {
306fa1
+		char *match;
306fa1
+		size_t len;
306fa1
+		*prefix = '\0';
306fa1
+		len = strlen(lkp_key + 3);
306fa1
+		match = malloc(len);
306fa1
+		if (!match) {
306fa1
+			char *estr = strerror_r(errno, buf, MAX_ERR_BUF);
306fa1
+			error(ap->logopt, MODPREFIX "malloc: %s", estr);
306fa1
+			ret = CHE_FAIL;
306fa1
+			goto done;
306fa1
+		}
306fa1
+		len--;
306fa1
+		strcpy(match, lkp_key);
306fa1
+		strcat(match, "/*");
306fa1
+		ret = lookup_one_amd(ap, source, match, len, ctxt);
306fa1
+		free(match);
306fa1
+		if (ret == CHE_OK || ret == CHE_UPDATED)
306fa1
+			goto done;
306fa1
+	}
306fa1
+done:
306fa1
+	free(lkp_key);
306fa1
+	return ret;
306fa1
+}
306fa1
+
306fa1
 static int check_map_indirect(struct autofs_point *ap,
306fa1
 			      struct map_source *source,
306fa1
 			      char *key, int key_len,
306fa1
@@ -2888,16 +3408,43 @@ static int check_map_indirect(struct aut
306fa1
 	mc = source->mc;
306fa1
 
306fa1
 	pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cur_state);
306fa1
-	ret = lookup_one(ap, source, key, key_len, ctxt);
306fa1
+
306fa1
+	pthread_mutex_lock(&ap->entry->current_mutex);
306fa1
+	if (source->flags & MAP_FLAG_FORMAT_AMD) {
306fa1
+		unsigned long timestamp = get_amd_timestamp(ctxt);
306fa1
+		if (timestamp > ctxt->timestamp) {
306fa1
+			ctxt->timestamp = timestamp;
306fa1
+			source->stale = 1;
306fa1
+			ctxt->check_defaults = 1;
306fa1
+		}
306fa1
+
306fa1
+		if (ctxt->check_defaults) {
306fa1
+			/* Check for a /defaults entry */
306fa1
+			ret = lookup_one_amd(ap, source, "/defaults", 9, ctxt);
306fa1
+			if (ret == CHE_FAIL) {
306fa1
+				warn(ap->logopt, MODPREFIX
306fa1
+				     "error getting /defaults from map %s",
306fa1
+				     ctxt->mapname);
306fa1
+			} else
306fa1
+				ctxt->check_defaults = 0;
306fa1
+		}
306fa1
+	}
306fa1
+	pthread_mutex_unlock(&ap->entry->current_mutex);
306fa1
+
306fa1
+	ret = match_key(ap, source, key, key_len, ctxt);
306fa1
 	if (ret == CHE_FAIL) {
306fa1
 		pthread_setcancelstate(cur_state, NULL);
306fa1
 		return NSS_STATUS_NOTFOUND;
306fa1
 	} else if (ret == CHE_UNAVAIL) {
306fa1
+		struct mapent *exists;
306fa1
 		/*
306fa1
 		 * If the server is down and the entry exists in the cache
306fa1
 		 * and belongs to this map return success and use the entry.
306fa1
 		 */
306fa1
-		struct mapent *exists = cache_lookup(mc, key);
306fa1
+		if (source->flags & MAP_FLAG_FORMAT_AMD)
306fa1
+			exists = match_cached_key(ap, MODPREFIX, source, key);
306fa1
+		else
306fa1
+			exists = cache_lookup(mc, key);
306fa1
 		if (exists && exists->source == source) {
306fa1
 			pthread_setcancelstate(cur_state, NULL);
306fa1
 			return NSS_STATUS_SUCCESS;
306fa1
@@ -2910,24 +3457,28 @@ static int check_map_indirect(struct aut
306fa1
 	}
306fa1
 	pthread_setcancelstate(cur_state, NULL);
306fa1
 
306fa1
-	/*
306fa1
-	 * Check for map change and update as needed for
306fa1
-	 * following cache lookup.
306fa1
-	 */
306fa1
-	cache_readlock(mc);
306fa1
-	t_last_read = ap->exp_runfreq + 1;
306fa1
-	me = cache_lookup_first(mc);
306fa1
-	while (me) {
306fa1
-		if (me->source == source) {
306fa1
-			t_last_read = now - me->age;
306fa1
-			break;
306fa1
+	if (!(source->flags & MAP_FLAG_FORMAT_AMD)) {
306fa1
+		/*
306fa1
+		 * Check for map change and update as needed for
306fa1
+		 * following cache lookup.
306fa1
+		 */
306fa1
+		cache_readlock(mc);
306fa1
+		t_last_read = ap->exp_runfreq + 1;
306fa1
+		me = cache_lookup_first(mc);
306fa1
+		while (me) {
306fa1
+			if (me->source == source) {
306fa1
+				t_last_read = now - me->age;
306fa1
+				break;
306fa1
+			}
306fa1
+			me = cache_lookup_next(mc, me);
306fa1
 		}
306fa1
-		me = cache_lookup_next(mc, me);
306fa1
-	}
306fa1
-	cache_unlock(mc);
306fa1
+		cache_unlock(mc);
306fa1
 
306fa1
-	if (t_last_read > ap->exp_runfreq && ret & CHE_UPDATED)
306fa1
-		source->stale = 1;
306fa1
+		pthread_mutex_lock(&ap->entry->current_mutex);
306fa1
+		if (t_last_read > ap->exp_runfreq && ret & CHE_UPDATED)
306fa1
+			source->stale = 1;
306fa1
+		pthread_mutex_unlock(&ap->entry->current_mutex);
306fa1
+	}
306fa1
 
306fa1
 	cache_readlock(mc);
306fa1
 	me = cache_lookup_distinct(mc, "*");
306fa1
@@ -2948,8 +3499,10 @@ int lookup_mount(struct autofs_point *ap
306fa1
 	struct mapent *me;
306fa1
 	char key[KEY_MAX_LEN + 1];
306fa1
 	int key_len;
306fa1
+	char *lkp_key;
306fa1
 	char *mapent = NULL;
306fa1
 	char mapent_buf[MAPENT_MAX_LEN + 1];
306fa1
+	char buf[MAX_ERR_BUF];
306fa1
 	int status = 0;
306fa1
 	int ret = 1;
306fa1
 
306fa1
@@ -2961,9 +3514,18 @@ int lookup_mount(struct autofs_point *ap
306fa1
 
306fa1
 	debug(ap->logopt, MODPREFIX "looking up %s", name);
306fa1
 
306fa1
-	key_len = snprintf(key, KEY_MAX_LEN + 1, "%s", name);
306fa1
-	if (key_len > KEY_MAX_LEN)
306fa1
-		return NSS_STATUS_NOTFOUND;
306fa1
+	if (!(source->flags & MAP_FLAG_FORMAT_AMD)) {
306fa1
+		key_len = snprintf(key, KEY_MAX_LEN + 1, "%s", name);
306fa1
+		if (key_len > KEY_MAX_LEN)
306fa1
+			return NSS_STATUS_NOTFOUND;
306fa1
+	} else {
306fa1
+		key_len = expandamdent(name, NULL, NULL);
306fa1
+		if (key_len > KEY_MAX_LEN)
306fa1
+			return NSS_STATUS_NOTFOUND;
306fa1
+		expandamdent(name, key, NULL);
306fa1
+		key[key_len] = '\0';
306fa1
+		debug(ap->logopt, MODPREFIX "expanded key: \"%s\"", key);
306fa1
+	}
306fa1
 
306fa1
 	/* Check if we recorded a mount fail for this key anywhere */
306fa1
 	me = lookup_source_mapent(ap, key, LKP_DISTINCT);
306fa1
@@ -2997,18 +3559,26 @@ int lookup_mount(struct autofs_point *ap
306fa1
 	 * we never know about it.
306fa1
 	 */
306fa1
 	if (ap->type == LKP_INDIRECT && *key != '/') {
306fa1
-		char *lkp_key;
306fa1
-
306fa1
 		cache_readlock(mc);
306fa1
 		me = cache_lookup_distinct(mc, key);
306fa1
 		if (me && me->multi)
306fa1
 			lkp_key = strdup(me->multi->key);
306fa1
-		else
306fa1
+		else if (!ap->pref)
306fa1
 			lkp_key = strdup(key);
306fa1
+		else {
306fa1
+			lkp_key = malloc(strlen(ap->pref) + strlen(key) + 1);
306fa1
+			if (lkp_key) {
306fa1
+				strcpy(lkp_key, ap->pref);
306fa1
+				strcat(lkp_key, key);
306fa1
+			}
306fa1
+		}
306fa1
 		cache_unlock(mc);
306fa1
 
306fa1
-		if (!lkp_key)
306fa1
+		if (!lkp_key) {
306fa1
+			char *estr = strerror_r(errno, buf, MAX_ERR_BUF);
306fa1
+			error(ap->logopt, MODPREFIX "malloc: %s", estr);
306fa1
 			return NSS_STATUS_UNKNOWN;
306fa1
+		}
306fa1
 
306fa1
 		status = check_map_indirect(ap, source,
306fa1
 					    lkp_key, strlen(lkp_key), ctxt);
306fa1
@@ -3029,7 +3599,25 @@ int lookup_mount(struct autofs_point *ap
306fa1
 		cache_readlock(mc);
306fa1
 	else
306fa1
 		cache_writelock(mc);
306fa1
-	me = cache_lookup(mc, key);
306fa1
+
306fa1
+	if (!ap->pref)
306fa1
+		lkp_key = strdup(key);
306fa1
+	else {
306fa1
+		lkp_key = malloc(strlen(ap->pref) + strlen(key) + 1);
306fa1
+		if (lkp_key) {
306fa1
+			strcpy(lkp_key, ap->pref);
306fa1
+			strcat(lkp_key, key);
306fa1
+		}
306fa1
+	}
306fa1
+
306fa1
+	if (!lkp_key) {
306fa1
+		char *estr = strerror_r(errno, buf, MAX_ERR_BUF);
306fa1
+		error(ap->logopt, MODPREFIX "malloc: %s", estr);
306fa1
+		cache_unlock(mc);
306fa1
+		return NSS_STATUS_UNKNOWN;
306fa1
+	}
306fa1
+
306fa1
+	me = match_cached_key(ap, MODPREFIX, source, lkp_key);
306fa1
 	/* Stale mapent => check for entry in alternate source or wildcard */
306fa1
 	if (me && !me->mapent) {
306fa1
 		while ((me = cache_lookup_key_next(me)))
306fa1
@@ -3055,6 +3643,7 @@ int lookup_mount(struct autofs_point *ap
306fa1
 		}
306fa1
 	}
306fa1
 	cache_unlock(mc);
306fa1
+	free(lkp_key);
306fa1
 
306fa1
 	if (!mapent)
306fa1
 		return NSS_STATUS_TRYAGAIN;