2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
4 * Copyright 1999-2013 The OpenLDAP Foundation.
5 * Portions Copyright 2001-2003 Pierangelo Masarati.
6 * Portions Copyright 1999-2003 Howard Chu.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted only as authorized by the OpenLDAP
13 * A copy of this license is available in the file LICENSE in the
14 * top-level directory of the distribution or, alternatively, at
15 * <http://www.OpenLDAP.org/license.html>.
18 * This work was initially developed by the Howard Chu for inclusion
19 * in OpenLDAP Software and subsequently enhanced by Pierangelo
27 #include <ac/string.h>
28 #include <ac/socket.h>
33 #include "../back-ldap/back-ldap.h"
34 #include "back-meta.h"
37 #define SLAP_AUTH_DN 1
40 static ConfigDriver meta_back_cf_gen;
41 static ConfigLDAPadd meta_ldadd;
42 static ConfigCfAdd meta_cfadd;
44 static int ldap_back_map_config(
46 struct ldapmap *oc_map,
47 struct ldapmap *at_map );
49 /* Three sets of enums:
50 * 1) attrs that are only valid in the base config
51 * 2) attrs that are valid in base or target
52 * 3) attrs that are only valid in a target
57 LDAP_BACK_CFG_CONN_TTL = 1,
58 LDAP_BACK_CFG_DNCACHE_TTL,
59 LDAP_BACK_CFG_IDLE_TIMEOUT,
61 LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
62 LDAP_BACK_CFG_SINGLECONN,
63 LDAP_BACK_CFG_USETEMP,
64 LDAP_BACK_CFG_CONNPOOLMAX,
65 LDAP_BACK_CFG_LAST_BASE
70 LDAP_BACK_CFG_BIND_TIMEOUT = LDAP_BACK_CFG_LAST_BASE,
73 LDAP_BACK_CFG_CLIENT_PR,
74 LDAP_BACK_CFG_DEFAULT_T,
75 LDAP_BACK_CFG_NETWORK_TIMEOUT,
77 LDAP_BACK_CFG_NOUNDEFFILTER,
78 LDAP_BACK_CFG_NRETRIES,
79 LDAP_BACK_CFG_QUARANTINE,
81 LDAP_BACK_CFG_TIMEOUT,
82 LDAP_BACK_CFG_VERSION,
83 LDAP_BACK_CFG_ST_REQUEST,
86 LDAP_BACK_CFG_LAST_BOTH
91 LDAP_BACK_CFG_URI = LDAP_BACK_CFG_LAST_BOTH,
92 LDAP_BACK_CFG_ACL_AUTHCDN,
93 LDAP_BACK_CFG_ACL_PASSWD,
94 LDAP_BACK_CFG_IDASSERT_AUTHZFROM,
95 LDAP_BACK_CFG_IDASSERT_BIND,
96 LDAP_BACK_CFG_REWRITE,
97 LDAP_BACK_CFG_SUFFIXM,
99 LDAP_BACK_CFG_SUBTREE_EX,
100 LDAP_BACK_CFG_SUBTREE_IN,
101 LDAP_BACK_CFG_PSEUDOROOTDN,
102 LDAP_BACK_CFG_PSEUDOROOTPW,
107 static ConfigTable metacfg[] = {
108 { "uri", "uri", 2, 0, 0,
109 ARG_MAGIC|LDAP_BACK_CFG_URI,
110 meta_back_cf_gen, "( OLcfgDbAt:0.14 "
112 "DESC 'URI (list) for remote DSA' "
113 "SYNTAX OMsDirectoryString "
116 { "tls", "what", 2, 0, 0,
117 ARG_MAGIC|LDAP_BACK_CFG_TLS,
118 meta_back_cf_gen, "( OLcfgDbAt:3.1 "
119 "NAME 'olcDbStartTLS' "
121 "SYNTAX OMsDirectoryString "
124 { "acl-authcDN", "DN", 2, 2, 0,
125 ARG_DN|ARG_MAGIC|LDAP_BACK_CFG_ACL_AUTHCDN,
126 meta_back_cf_gen, "( OLcfgDbAt:3.2 "
127 "NAME 'olcDbACLAuthcDn' "
128 "DESC 'Remote ACL administrative identity' "
133 /* deprecated, will be removed; aliases "acl-authcDN" */
134 { "binddn", "DN", 2, 2, 0,
135 ARG_DN|ARG_MAGIC|LDAP_BACK_CFG_ACL_AUTHCDN,
136 meta_back_cf_gen, NULL, NULL, NULL },
137 { "acl-passwd", "cred", 2, 2, 0,
138 ARG_MAGIC|LDAP_BACK_CFG_ACL_PASSWD,
139 meta_back_cf_gen, "( OLcfgDbAt:3.3 "
140 "NAME 'olcDbACLPasswd' "
141 "DESC 'Remote ACL administrative identity credentials' "
143 "SYNTAX OMsDirectoryString "
146 /* deprecated, will be removed; aliases "acl-passwd" */
147 { "bindpw", "cred", 2, 2, 0,
148 ARG_MAGIC|LDAP_BACK_CFG_ACL_PASSWD,
149 meta_back_cf_gen, NULL, NULL, NULL },
150 { "idassert-bind", "args", 2, 0, 0,
151 ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_BIND,
152 meta_back_cf_gen, "( OLcfgDbAt:3.7 "
153 "NAME 'olcDbIDAssertBind' "
154 "DESC 'Remote Identity Assertion administrative identity auth bind configuration' "
155 "SYNTAX OMsDirectoryString "
158 { "idassert-authzFrom", "authzRule", 2, 2, 0,
159 ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_AUTHZFROM,
160 meta_back_cf_gen, "( OLcfgDbAt:3.9 "
161 "NAME 'olcDbIDAssertAuthzFrom' "
162 "DESC 'Remote Identity Assertion authz rules' "
163 "EQUALITY caseIgnoreMatch "
164 "SYNTAX OMsDirectoryString "
165 "X-ORDERED 'VALUES' )",
167 { "rebind-as-user", "true|FALSE", 1, 2, 0,
168 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_REBIND,
169 meta_back_cf_gen, "( OLcfgDbAt:3.10 "
170 "NAME 'olcDbRebindAsUser' "
171 "DESC 'Rebind as user' "
175 { "chase-referrals", "true|FALSE", 2, 2, 0,
176 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_CHASE,
177 meta_back_cf_gen, "( OLcfgDbAt:3.11 "
178 "NAME 'olcDbChaseReferrals' "
179 "DESC 'Chase referrals' "
183 { "t-f-support", "true|FALSE|discover", 2, 2, 0,
184 ARG_MAGIC|LDAP_BACK_CFG_T_F,
185 meta_back_cf_gen, "( OLcfgDbAt:3.12 "
186 "NAME 'olcDbTFSupport' "
187 "DESC 'Absolute filters support' "
188 "SYNTAX OMsDirectoryString "
191 { "timeout", "timeout(list)", 2, 0, 0,
192 ARG_MAGIC|LDAP_BACK_CFG_TIMEOUT,
193 meta_back_cf_gen, "( OLcfgDbAt:3.14 "
194 "NAME 'olcDbTimeout' "
195 "DESC 'Per-operation timeouts' "
196 "SYNTAX OMsDirectoryString "
199 { "idle-timeout", "timeout", 2, 2, 0,
200 ARG_MAGIC|LDAP_BACK_CFG_IDLE_TIMEOUT,
201 meta_back_cf_gen, "( OLcfgDbAt:3.15 "
202 "NAME 'olcDbIdleTimeout' "
203 "DESC 'connection idle timeout' "
204 "SYNTAX OMsDirectoryString "
207 { "conn-ttl", "ttl", 2, 2, 0,
208 ARG_MAGIC|LDAP_BACK_CFG_CONN_TTL,
209 meta_back_cf_gen, "( OLcfgDbAt:3.16 "
210 "NAME 'olcDbConnTtl' "
211 "DESC 'connection ttl' "
212 "SYNTAX OMsDirectoryString "
215 { "network-timeout", "timeout", 2, 2, 0,
216 ARG_MAGIC|LDAP_BACK_CFG_NETWORK_TIMEOUT,
217 meta_back_cf_gen, "( OLcfgDbAt:3.17 "
218 "NAME 'olcDbNetworkTimeout' "
219 "DESC 'connection network timeout' "
220 "SYNTAX OMsDirectoryString "
223 { "protocol-version", "version", 2, 2, 0,
224 ARG_MAGIC|ARG_INT|LDAP_BACK_CFG_VERSION,
225 meta_back_cf_gen, "( OLcfgDbAt:3.18 "
226 "NAME 'olcDbProtocolVersion' "
227 "DESC 'protocol version' "
231 { "single-conn", "true|FALSE", 2, 2, 0,
232 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_SINGLECONN,
233 meta_back_cf_gen, "( OLcfgDbAt:3.19 "
234 "NAME 'olcDbSingleConn' "
235 "DESC 'cache a single connection per identity' "
239 { "cancel", "ABANDON|ignore|exop", 2, 2, 0,
240 ARG_MAGIC|LDAP_BACK_CFG_CANCEL,
241 meta_back_cf_gen, "( OLcfgDbAt:3.20 "
242 "NAME 'olcDbCancel' "
243 "DESC 'abandon/ignore/exop operations when appropriate' "
244 "SYNTAX OMsDirectoryString "
247 { "quarantine", "retrylist", 2, 2, 0,
248 ARG_MAGIC|LDAP_BACK_CFG_QUARANTINE,
249 meta_back_cf_gen, "( OLcfgDbAt:3.21 "
250 "NAME 'olcDbQuarantine' "
251 "DESC 'Quarantine database if connection fails and retry according to rule' "
252 "SYNTAX OMsDirectoryString "
255 { "use-temporary-conn", "true|FALSE", 2, 2, 0,
256 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_USETEMP,
257 meta_back_cf_gen, "( OLcfgDbAt:3.22 "
258 "NAME 'olcDbUseTemporaryConn' "
259 "DESC 'Use temporary connections if the cached one is busy' "
263 { "conn-pool-max", "<n>", 2, 2, 0,
264 ARG_MAGIC|ARG_INT|LDAP_BACK_CFG_CONNPOOLMAX,
265 meta_back_cf_gen, "( OLcfgDbAt:3.23 "
266 "NAME 'olcDbConnectionPoolMax' "
267 "DESC 'Max size of privileged connections pool' "
271 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
272 { "session-tracking-request", "true|FALSE", 2, 2, 0,
273 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_ST_REQUEST,
274 meta_back_cf_gen, "( OLcfgDbAt:3.24 "
275 "NAME 'olcDbSessionTrackingRequest' "
276 "DESC 'Add session tracking control to proxied requests' "
280 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
281 { "norefs", "true|FALSE", 2, 2, 0,
282 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_NOREFS,
283 meta_back_cf_gen, "( OLcfgDbAt:3.25 "
284 "NAME 'olcDbNoRefs' "
285 "DESC 'Do not return search reference responses' "
289 { "noundeffilter", "true|FALSE", 2, 2, 0,
290 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_NOUNDEFFILTER,
291 meta_back_cf_gen, "( OLcfgDbAt:3.26 "
292 "NAME 'olcDbNoUndefFilter' "
293 "DESC 'Do not propagate undefined search filters' "
298 { "rewrite", "arglist", 2, 0, STRLENOF( "rewrite" ),
299 ARG_MAGIC|LDAP_BACK_CFG_REWRITE,
300 meta_back_cf_gen, "( OLcfgDbAt:3.101 "
301 "NAME 'olcDbRewrite' "
302 "DESC 'DN rewriting rules' "
303 "EQUALITY caseIgnoreMatch "
304 "SYNTAX OMsDirectoryString "
305 "X-ORDERED 'VALUES' )",
307 { "suffixmassage", "virtual> <real", 2, 3, 0,
308 ARG_MAGIC|LDAP_BACK_CFG_SUFFIXM,
309 meta_back_cf_gen, NULL, NULL, NULL },
311 { "map", "attribute|objectClass> [*|<local>] *|<remote", 3, 4, 0,
312 ARG_MAGIC|LDAP_BACK_CFG_MAP,
313 meta_back_cf_gen, "( OLcfgDbAt:3.102 "
315 "DESC 'Map attribute and objectclass names' "
316 "EQUALITY caseIgnoreMatch "
317 "SYNTAX OMsDirectoryString "
318 "X-ORDERED 'VALUES' )",
321 { "subtree-exclude", "pattern", 2, 2, 0,
322 ARG_MAGIC|LDAP_BACK_CFG_SUBTREE_EX,
323 meta_back_cf_gen, "( OLcfgDbAt:3.103 "
324 "NAME 'olcDbSubtreeExclude' "
325 "DESC 'DN of subtree to exclude from target' "
326 "EQUALITY caseIgnoreMatch "
327 "SYNTAX OMsDirectoryString )",
329 { "subtree-include", "pattern", 2, 2, 0,
330 ARG_MAGIC|LDAP_BACK_CFG_SUBTREE_IN,
331 meta_back_cf_gen, "( OLcfgDbAt:3.104 "
332 "NAME 'olcDbSubtreeInclude' "
333 "DESC 'DN of subtree to include in target' "
334 "EQUALITY caseIgnoreMatch "
335 "SYNTAX OMsDirectoryString )",
337 { "default-target", "[none|<target ID>]", 1, 2, 0,
338 ARG_MAGIC|LDAP_BACK_CFG_DEFAULT_T,
339 meta_back_cf_gen, "( OLcfgDbAt:3.105 "
340 "NAME 'olcDbDefaultTarget' "
341 "DESC 'Specify the default target' "
342 "SYNTAX OMsDirectoryString "
345 { "dncache-ttl", "ttl", 2, 2, 0,
346 ARG_MAGIC|LDAP_BACK_CFG_DNCACHE_TTL,
347 meta_back_cf_gen, "( OLcfgDbAt:3.106 "
348 "NAME 'olcDbDnCacheTtl' "
349 "DESC 'dncache ttl' "
350 "SYNTAX OMsDirectoryString "
353 { "bind-timeout", "microseconds", 2, 2, 0,
354 ARG_MAGIC|ARG_ULONG|LDAP_BACK_CFG_BIND_TIMEOUT,
355 meta_back_cf_gen, "( OLcfgDbAt:3.107 "
356 "NAME 'olcDbBindTimeout' "
357 "DESC 'bind timeout' "
358 "SYNTAX OMsDirectoryString "
361 { "onerr", "CONTINUE|report|stop", 2, 2, 0,
362 ARG_MAGIC|LDAP_BACK_CFG_ONERR,
363 meta_back_cf_gen, "( OLcfgDbAt:3.108 "
365 "DESC 'error handling' "
366 "SYNTAX OMsDirectoryString "
369 { "pseudoroot-bind-defer", "TRUE|false", 2, 2, 0,
370 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
371 meta_back_cf_gen, "( OLcfgDbAt:3.109 "
372 "NAME 'olcDbPseudoRootBindDefer' "
373 "DESC 'error handling' "
377 { "root-bind-defer", "TRUE|false", 2, 2, 0,
378 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
379 meta_back_cf_gen, NULL, NULL, NULL },
380 { "pseudorootdn", "dn", 2, 2, 0,
381 ARG_MAGIC|ARG_DN|LDAP_BACK_CFG_PSEUDOROOTDN,
382 meta_back_cf_gen, NULL, NULL, NULL },
383 { "pseudorootpw", "password", 2, 2, 0,
384 ARG_MAGIC|ARG_STRING|LDAP_BACK_CFG_PSEUDOROOTDN,
385 meta_back_cf_gen, NULL, NULL, NULL },
386 { "nretries", "NEVER|forever|<number>", 2, 2, 0,
387 ARG_MAGIC|LDAP_BACK_CFG_NRETRIES,
388 meta_back_cf_gen, "( OLcfgDbAt:3.110 "
389 "NAME 'olcDbNretries' "
390 "DESC 'retry handling' "
391 "SYNTAX OMsDirectoryString "
394 { "client-pr", "accept-unsolicited|disable|<size>", 2, 2, 0,
395 ARG_MAGIC|LDAP_BACK_CFG_CLIENT_PR,
396 meta_back_cf_gen, "( OLcfgDbAt:3.111 "
397 "NAME 'olcDbClientPr' "
398 "DESC 'PagedResults handling' "
399 "SYNTAX OMsDirectoryString "
403 { "", "", 0, 0, 0, ARG_IGNORED,
404 NULL, "( OLcfgDbAt:3.100 NAME 'olcMetaSub' "
405 "DESC 'Placeholder to name a Target entry' "
406 "EQUALITY caseIgnoreMatch "
407 "SYNTAX OMsDirectoryString "
408 "SINGLE-VALUE X-ORDERED 'SIBLINGS' )", NULL, NULL },
410 { NULL, NULL, 0, 0, 0, ARG_IGNORED,
411 NULL, NULL, NULL, NULL }
414 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
415 #define ST_ATTR "$ olcDbSessionTrackingRequest "
418 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
420 #define COMMON_ATTRS \
421 "$ olcDbBindTimeout " \
423 "$ olcDbChaseReferrals " \
425 "$ olcDbDefaultTarget " \
426 "$ olcDbNetworkTimeout " \
428 "$ olcDbNoUndefFilter " \
430 "$ olcDbProtocolVersion " \
431 "$ olcDbQuarantine " \
432 "$ olcDbRebindAsUser " \
437 static ConfigOCs metaocs[] = {
439 "NAME 'olcMetaConfig' "
440 "DESC 'Meta backend configuration' "
441 "SUP olcDatabaseConfig "
442 "MAY ( olcDbConnTtl "
444 "$ olcDbIdleTimeout "
446 "$ olcDbPseudoRootBindDefer "
448 "$ olcDbUseTemporaryConn "
449 "$ olcDbConnectionPoolMax "
451 /* defaults, may be overridden per-target */
454 Cft_Database, metacfg, NULL, meta_cfadd },
456 "NAME 'olcMetaTargetConfig' "
457 "DESC 'Meta target configuration' "
458 "SUP olcConfig STRUCTURAL "
459 "MUST ( olcMetaSub $ olcDbURI ) "
460 "MAY ( olcDbACLAuthcDn "
462 "$ olcDbIDAssertAuthzFrom "
463 "$ olcDbIDAssertBind "
466 "$ olcDbSubtreeExclude "
467 "$ olcDbSubtreeInclude "
470 /* defaults may be inherited */
473 Cft_Misc, metacfg, meta_ldadd },
478 meta_ldadd( CfEntryInfo *p, Entry *e, ConfigArgs *c )
480 if ( p->ce_type != Cft_Database || !p->ce_be ||
481 p->ce_be->be_cf_ocs != metaocs )
482 return LDAP_CONSTRAINT_VIOLATION;
489 meta_cfadd( Operation *op, SlapReply *rs, Entry *p, ConfigArgs *c )
491 metainfo_t *mi = ( metainfo_t * )c->be->be_private;
495 bv.bv_val = c->cr_msg;
496 for ( i=0; i<mi->mi_ntargets; i++ ) {
497 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg),
498 "olcMetaSub=" SLAP_X_ORDERED_FMT "uri", i );
499 c->ca_private = mi->mi_targets[i];
501 config_build_entry( op, rs, p->e_private, c,
502 &bv, &metaocs[1], NULL );
509 meta_rwi_init( struct rewrite_info **rwm_rw )
513 *rwm_rw = rewrite_info_init( REWRITE_MODE_USE_DEFAULT );
514 if ( *rwm_rw == NULL ) {
518 * the filter rewrite as a string must be disabled
519 * by default; it can be re-enabled by adding rules;
520 * this creates an empty rewriteContext
522 rargv[ 0 ] = "rewriteContext";
523 rargv[ 1 ] = "searchFilter";
525 rewrite_parse( *rwm_rw, "<suffix massage>", 1, 2, rargv );
527 rargv[ 0 ] = "rewriteContext";
528 rargv[ 1 ] = "default";
530 rewrite_parse( *rwm_rw, "<suffix massage>", 1, 2, rargv );
536 meta_back_new_target(
543 mt = ch_calloc( sizeof( metatarget_t ), 1 );
545 if ( meta_rwi_init( &mt->mt_rwmap.rwm_rw )) {
550 ldap_pvt_thread_mutex_init( &mt->mt_uri_mutex );
552 mt->mt_idassert_mode = LDAP_BACK_IDASSERT_LEGACY;
553 mt->mt_idassert_authmethod = LDAP_AUTH_NONE;
554 mt->mt_idassert_tls = SB_TLS_DEFAULT;
556 /* by default, use proxyAuthz control on each operation */
557 mt->mt_idassert_flags = LDAP_BACK_AUTH_PRESCRIPTIVE;
564 /* Validation for suffixmassage_config */
574 struct berval dn, nvnc, pvnc, nrnc, prnc;
580 * suffixmassage <suffix> <massaged suffix>
582 * the <suffix> field must be defined as a valid suffix
583 * (or suffixAlias?) for the current database;
584 * the <massaged suffix> shouldn't have already been
585 * defined as a valid suffix or suffixAlias for the
589 ber_str2bv( argv[ 1 ], 0, 0, &dn );
590 if ( dnPrettyNormal( NULL, &dn, &pvnc, &nvnc, NULL ) != LDAP_SUCCESS ) {
591 snprintf( c->cr_msg, sizeof( c->cr_msg ),
592 "suffix \"%s\" is invalid",
594 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
598 for ( j = 0; !BER_BVISNULL( &c->be->be_nsuffix[ j ] ); j++ ) {
599 if ( dnIsSuffix( &nvnc, &c->be->be_nsuffix[ 0 ] ) ) {
604 if ( BER_BVISNULL( &c->be->be_nsuffix[ j ] ) ) {
605 snprintf( c->cr_msg, sizeof( c->cr_msg ),
606 "suffix \"%s\" must be within the database naming context",
608 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
614 ber_str2bv( argv[ 2 ], 0, 0, &dn );
615 if ( dnPrettyNormal( NULL, &dn, &prnc, &nrnc, NULL ) != LDAP_SUCCESS ) {
616 snprintf( c->cr_msg, sizeof( c->cr_msg ),
617 "massaged suffix \"%s\" is invalid",
619 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
625 tmp_bd = select_backend( &nrnc, 0 );
626 if ( tmp_bd != NULL && tmp_bd->be_private == c->be->be_private ) {
627 Debug( LDAP_DEBUG_ANY,
628 "%s: warning: <massaged suffix> \"%s\" resolves to this database, in "
629 "\"suffixMassage <suffix> <massaged suffix>\"\n",
630 c->log, prnc.bv_val, 0 );
634 * The suffix massaging is emulated by means of the
635 * rewrite capabilities
637 rc = suffix_massage_config( mt->mt_rwmap.rwm_rw,
638 &pvnc, &nvnc, &prnc, &nrnc );
649 slap_bv_x_ordered_unparse( BerVarray in, BerVarray *out )
652 BerVarray bva = NULL;
656 assert( in != NULL );
658 for ( i = 0; !BER_BVISNULL( &in[i] ); i++ )
667 bva = ch_malloc( ( i + 1 ) * sizeof(struct berval) );
668 BER_BVZERO( &bva[ 0 ] );
670 for ( i = 0; !BER_BVISNULL( &in[i] ); i++ ) {
671 idx.bv_len = snprintf( idx.bv_val, sizeof( ibuf ), SLAP_X_ORDERED_FMT, i );
672 if ( idx.bv_len >= sizeof( ibuf ) ) {
673 ber_bvarray_free( bva );
677 bva[i].bv_len = idx.bv_len + in[i].bv_len;
678 bva[i].bv_val = ch_malloc( bva[i].bv_len + 1 );
679 ptr = lutil_strcopy( bva[i].bv_val, ibuf );
680 ptr = lutil_strcopy( ptr, in[i].bv_val );
682 BER_BVZERO( &bva[ i + 1 ] );
690 meta_subtree_free( metasubtree_t *ms )
692 switch ( ms->ms_type ) {
693 case META_ST_SUBTREE:
694 case META_ST_SUBORDINATE:
695 ber_memfree( ms->ms_dn.bv_val );
699 regfree( &ms->ms_regex );
700 ber_memfree( ms->ms_regex_pattern.bv_val );
712 meta_subtree_destroy( metasubtree_t *ms )
715 meta_subtree_destroy( ms->ms_next );
718 return meta_subtree_free( ms );
721 static struct berval st_styles[] = {
728 meta_subtree_unparse(
733 struct berval bv, *style;
735 if ( !mt->mt_subtree )
738 /* can only be one of exclude or include */
739 if (( c->type == LDAP_BACK_CFG_SUBTREE_EX ) ^ mt->mt_subtree_exclude )
742 bv.bv_val = c->cr_msg;
743 for ( ms=mt->mt_subtree; ms; ms=ms->ms_next ) {
744 if (ms->ms_type == META_ST_SUBTREE)
745 style = &st_styles[0];
746 else if ( ms->ms_type == META_ST_SUBORDINATE )
747 style = &st_styles[1];
748 else if ( ms->ms_type == META_ST_REGEX )
749 style = &st_styles[2];
754 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg),
755 "dn.%s:%s", style->bv_val, ms->ms_dn.bv_val );
756 value_add_one( &c->rvalue_vals, &bv );
766 meta_st_t type = META_ST_SUBTREE;
768 struct berval ndn = BER_BVNULL;
769 metasubtree_t *ms = NULL;
771 if ( c->type == LDAP_BACK_CFG_SUBTREE_EX ) {
772 if ( mt->mt_subtree && !mt->mt_subtree_exclude ) {
773 snprintf( c->cr_msg, sizeof(c->cr_msg),
774 "\"subtree-exclude\" incompatible with previous \"subtree-include\" directives" );
778 mt->mt_subtree_exclude = 1;
781 if ( mt->mt_subtree && mt->mt_subtree_exclude ) {
782 snprintf( c->cr_msg, sizeof(c->cr_msg),
783 "\"subtree-include\" incompatible with previous \"subtree-exclude\" directives" );
788 pattern = c->argv[1];
789 if ( strncasecmp( pattern, "dn", STRLENOF( "dn" ) ) == 0 ) {
792 pattern = &pattern[STRLENOF( "dn")];
794 if ( pattern[0] == '.' ) {
797 if ( strncasecmp( style, "subtree", STRLENOF( "subtree" ) ) == 0 ) {
798 type = META_ST_SUBTREE;
799 pattern = &style[STRLENOF( "subtree" )];
801 } else if ( strncasecmp( style, "children", STRLENOF( "children" ) ) == 0 ) {
802 type = META_ST_SUBORDINATE;
803 pattern = &style[STRLENOF( "children" )];
805 } else if ( strncasecmp( style, "sub", STRLENOF( "sub" ) ) == 0 ) {
806 type = META_ST_SUBTREE;
807 pattern = &style[STRLENOF( "sub" )];
809 } else if ( strncasecmp( style, "regex", STRLENOF( "regex" ) ) == 0 ) {
810 type = META_ST_REGEX;
811 pattern = &style[STRLENOF( "regex" )];
814 snprintf( c->cr_msg, sizeof(c->cr_msg), "unknown style in \"dn.<style>\"" );
819 if ( pattern[0] != ':' ) {
820 snprintf( c->cr_msg, sizeof(c->cr_msg), "missing colon after \"dn.<style>\"" );
827 case META_ST_SUBTREE:
828 case META_ST_SUBORDINATE: {
831 ber_str2bv( pattern, 0, 0, &dn );
832 if ( dnNormalize( 0, NULL, NULL, &dn, &ndn, NULL )
835 snprintf( c->cr_msg, sizeof(c->cr_msg), "DN=\"%s\" is invalid", pattern );
839 if ( !dnIsSuffix( &ndn, &mt->mt_nsuffix ) ) {
840 snprintf( c->cr_msg, sizeof(c->cr_msg),
841 "DN=\"%s\" is not a subtree of target \"%s\"",
842 pattern, mt->mt_nsuffix.bv_val );
843 ber_memfree( ndn.bv_val );
849 /* silence warnings */
853 ms = ch_calloc( sizeof( metasubtree_t ), 1 );
856 switch ( ms->ms_type ) {
857 case META_ST_SUBTREE:
858 case META_ST_SUBORDINATE:
862 case META_ST_REGEX: {
865 rc = regcomp( &ms->ms_regex, pattern, REG_EXTENDED|REG_ICASE );
867 char regerr[ SLAP_TEXT_BUFLEN ];
869 regerror( rc, &ms->ms_regex, regerr, sizeof(regerr) );
871 snprintf( c->cr_msg, sizeof( c->cr_msg ),
872 "regular expression \"%s\" bad because of %s",
877 ber_str2bv( pattern, 0, 1, &ms->ms_regex_pattern );
881 if ( mt->mt_subtree == NULL ) {
887 for ( msp = &mt->mt_subtree; *msp; ) {
888 switch ( ms->ms_type ) {
889 case META_ST_SUBTREE:
890 switch ( (*msp)->ms_type ) {
891 case META_ST_SUBTREE:
892 if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
893 metasubtree_t *tmp = *msp;
894 Debug( LDAP_DEBUG_CONFIG,
895 "%s: previous rule \"dn.subtree:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
896 c->log, pattern, (*msp)->ms_dn.bv_val );
897 *msp = (*msp)->ms_next;
899 meta_subtree_destroy( tmp );
902 } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) ) {
903 Debug( LDAP_DEBUG_CONFIG,
904 "%s: previous rule \"dn.subtree:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
905 c->log, (*msp)->ms_dn.bv_val, pattern );
906 meta_subtree_destroy( ms );
912 case META_ST_SUBORDINATE:
913 if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
914 metasubtree_t *tmp = *msp;
915 Debug( LDAP_DEBUG_CONFIG,
916 "%s: previous rule \"dn.children:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
917 c->log, pattern, (*msp)->ms_dn.bv_val );
918 *msp = (*msp)->ms_next;
920 meta_subtree_destroy( tmp );
923 } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) && ms->ms_dn.bv_len > (*msp)->ms_dn.bv_len ) {
924 Debug( LDAP_DEBUG_CONFIG,
925 "%s: previous rule \"dn.children:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
926 c->log, (*msp)->ms_dn.bv_val, pattern );
927 meta_subtree_destroy( ms );
934 if ( regexec( &(*msp)->ms_regex, ms->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
935 Debug( LDAP_DEBUG_CONFIG,
936 "%s: previous rule \"dn.regex:%s\" may contain rule \"dn.subtree:%s\"\n",
937 c->log, (*msp)->ms_regex_pattern.bv_val, ms->ms_dn.bv_val );
943 case META_ST_SUBORDINATE:
944 switch ( (*msp)->ms_type ) {
945 case META_ST_SUBTREE:
946 if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
947 metasubtree_t *tmp = *msp;
948 Debug( LDAP_DEBUG_CONFIG,
949 "%s: previous rule \"dn.children:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
950 c->log, pattern, (*msp)->ms_dn.bv_val );
951 *msp = (*msp)->ms_next;
953 meta_subtree_destroy( tmp );
956 } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) && ms->ms_dn.bv_len > (*msp)->ms_dn.bv_len ) {
957 Debug( LDAP_DEBUG_CONFIG,
958 "%s: previous rule \"dn.children:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
959 c->log, (*msp)->ms_dn.bv_val, pattern );
960 meta_subtree_destroy( ms );
966 case META_ST_SUBORDINATE:
967 if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
968 metasubtree_t *tmp = *msp;
969 Debug( LDAP_DEBUG_CONFIG,
970 "%s: previous rule \"dn.children:%s\" is contained in rule \"dn.children:%s\" (replaced)\n",
971 c->log, pattern, (*msp)->ms_dn.bv_val );
972 *msp = (*msp)->ms_next;
974 meta_subtree_destroy( tmp );
977 } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) ) {
978 Debug( LDAP_DEBUG_CONFIG,
979 "%s: previous rule \"dn.children:%s\" contains rule \"dn.children:%s\" (ignored)\n",
980 c->log, (*msp)->ms_dn.bv_val, pattern );
981 meta_subtree_destroy( ms );
988 if ( regexec( &(*msp)->ms_regex, ms->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
989 Debug( LDAP_DEBUG_CONFIG,
990 "%s: previous rule \"dn.regex:%s\" may contain rule \"dn.subtree:%s\"\n",
991 c->log, (*msp)->ms_regex_pattern.bv_val, ms->ms_dn.bv_val );
998 switch ( (*msp)->ms_type ) {
999 case META_ST_SUBTREE:
1000 case META_ST_SUBORDINATE:
1001 if ( regexec( &ms->ms_regex, (*msp)->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
1002 Debug( LDAP_DEBUG_CONFIG,
1003 "%s: previous rule \"dn.subtree:%s\" may be contained in rule \"dn.regex:%s\"\n",
1004 c->log, (*msp)->ms_dn.bv_val, ms->ms_regex_pattern.bv_val );
1009 /* no check possible */
1015 msp = &(*msp)->ms_next;
1024 static slap_verbmasks idassert_mode[] = {
1025 { BER_BVC("self"), LDAP_BACK_IDASSERT_SELF },
1026 { BER_BVC("anonymous"), LDAP_BACK_IDASSERT_ANONYMOUS },
1027 { BER_BVC("none"), LDAP_BACK_IDASSERT_NOASSERT },
1028 { BER_BVC("legacy"), LDAP_BACK_IDASSERT_LEGACY },
1032 static slap_verbmasks tls_mode[] = {
1033 { BER_BVC( "propagate" ), LDAP_BACK_F_TLS_PROPAGATE_MASK },
1034 { BER_BVC( "try-propagate" ), LDAP_BACK_F_PROPAGATE_TLS },
1035 { BER_BVC( "start" ), LDAP_BACK_F_TLS_USE_MASK },
1036 { BER_BVC( "try-start" ), LDAP_BACK_F_USE_TLS },
1037 { BER_BVC( "ldaps" ), LDAP_BACK_F_TLS_LDAPS },
1038 { BER_BVC( "none" ), LDAP_BACK_F_NONE },
1042 static slap_verbmasks t_f_mode[] = {
1043 { BER_BVC( "yes" ), LDAP_BACK_F_T_F },
1044 { BER_BVC( "discover" ), LDAP_BACK_F_T_F_DISCOVER },
1045 { BER_BVC( "no" ), LDAP_BACK_F_NONE },
1049 static slap_verbmasks cancel_mode[] = {
1050 { BER_BVC( "ignore" ), LDAP_BACK_F_CANCEL_IGNORE },
1051 { BER_BVC( "exop" ), LDAP_BACK_F_CANCEL_EXOP },
1052 { BER_BVC( "exop-discover" ), LDAP_BACK_F_CANCEL_EXOP_DISCOVER },
1053 { BER_BVC( "abandon" ), LDAP_BACK_F_CANCEL_ABANDON },
1057 static slap_verbmasks onerr_mode[] = {
1058 { BER_BVC( "stop" ), META_BACK_F_ONERR_STOP },
1059 { BER_BVC( "report" ), META_BACK_F_ONERR_REPORT },
1060 { BER_BVC( "continue" ), LDAP_BACK_F_NONE },
1064 /* see enum in slap.h */
1065 static slap_cf_aux_table timeout_table[] = {
1066 { BER_BVC("bind="), SLAP_OP_BIND * sizeof( time_t ), 'u', 0, NULL },
1067 /* unbind makes no sense */
1068 { BER_BVC("add="), SLAP_OP_ADD * sizeof( time_t ), 'u', 0, NULL },
1069 { BER_BVC("delete="), SLAP_OP_DELETE * sizeof( time_t ), 'u', 0, NULL },
1070 { BER_BVC("modrdn="), SLAP_OP_MODRDN * sizeof( time_t ), 'u', 0, NULL },
1071 { BER_BVC("modify="), SLAP_OP_MODIFY * sizeof( time_t ), 'u', 0, NULL },
1072 { BER_BVC("compare="), SLAP_OP_COMPARE * sizeof( time_t ), 'u', 0, NULL },
1073 { BER_BVC("search="), SLAP_OP_SEARCH * sizeof( time_t ), 'u', 0, NULL },
1074 /* abandon makes little sense */
1075 #if 0 /* not implemented yet */
1076 { BER_BVC("extended="), SLAP_OP_EXTENDED * sizeof( time_t ), 'u', 0, NULL },
1078 { BER_BVNULL, 0, 0, 0, NULL }
1082 meta_back_cf_gen( ConfigArgs *c )
1084 metainfo_t *mi = ( metainfo_t * )c->be->be_private;
1090 assert( mi != NULL );
1092 if ( c->op == SLAP_CONFIG_EMIT || c->op == LDAP_MOD_DELETE ) {
1096 if ( c->table == Cft_Database ) {
1105 if ( c->op == SLAP_CONFIG_EMIT ) {
1106 struct berval bv = BER_BVNULL;
1110 case LDAP_BACK_CFG_CONN_TTL:
1111 if ( mi->mi_conn_ttl == 0 ) {
1114 char buf[ SLAP_TEXT_BUFLEN ];
1116 lutil_unparse_time( buf, sizeof( buf ), mi->mi_conn_ttl );
1117 ber_str2bv( buf, 0, 0, &bv );
1118 value_add_one( &c->rvalue_vals, &bv );
1122 case LDAP_BACK_CFG_DNCACHE_TTL:
1123 if ( mi->mi_cache.ttl == META_DNCACHE_DISABLED ) {
1125 } else if ( mi->mi_cache.ttl == META_DNCACHE_FOREVER ) {
1126 BER_BVSTR( &bv, "forever" );
1128 char buf[ SLAP_TEXT_BUFLEN ];
1130 lutil_unparse_time( buf, sizeof( buf ), mi->mi_cache.ttl );
1131 ber_str2bv( buf, 0, 0, &bv );
1133 value_add_one( &c->rvalue_vals, &bv );
1136 case LDAP_BACK_CFG_IDLE_TIMEOUT:
1137 if ( mi->mi_idle_timeout == 0 ) {
1140 char buf[ SLAP_TEXT_BUFLEN ];
1142 lutil_unparse_time( buf, sizeof( buf ), mi->mi_idle_timeout );
1143 ber_str2bv( buf, 0, 0, &bv );
1144 value_add_one( &c->rvalue_vals, &bv );
1148 case LDAP_BACK_CFG_ONERR:
1149 enum_to_verb( onerr_mode, mi->mi_flags & META_BACK_F_ONERR_MASK, &bv );
1150 if ( BER_BVISNULL( &bv )) {
1153 value_add_one( &c->rvalue_vals, &bv );
1157 case LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER:
1158 c->value_int = META_BACK_DEFER_ROOTDN_BIND( mi );
1161 case LDAP_BACK_CFG_SINGLECONN:
1162 c->value_int = LDAP_BACK_SINGLECONN( mi );
1165 case LDAP_BACK_CFG_USETEMP:
1166 c->value_int = LDAP_BACK_USE_TEMPORARIES( mi );
1169 case LDAP_BACK_CFG_CONNPOOLMAX:
1170 c->value_int = mi->mi_conn_priv_max;
1174 case LDAP_BACK_CFG_BIND_TIMEOUT:
1175 if ( mc->mc_bind_timeout.tv_sec == 0 &&
1176 mc->mc_bind_timeout.tv_usec == 0 ) {
1179 c->value_ulong = mc->mc_bind_timeout.tv_sec * 1000000UL +
1180 mc->mc_bind_timeout.tv_usec;
1184 case LDAP_BACK_CFG_CANCEL: {
1185 slap_mask_t mask = LDAP_BACK_F_CANCEL_MASK2;
1187 if ( mt && META_BACK_TGT_CANCEL_DISCOVER( mt ) ) {
1188 mask &= ~LDAP_BACK_F_CANCEL_EXOP;
1190 enum_to_verb( cancel_mode, (mc->mc_flags & mask), &bv );
1191 if ( BER_BVISNULL( &bv ) ) {
1192 /* there's something wrong... */
1197 value_add_one( &c->rvalue_vals, &bv );
1201 case LDAP_BACK_CFG_CHASE:
1202 c->value_int = META_BACK_CMN_CHASE_REFERRALS(mc);
1205 #ifdef SLAPD_META_CLIENT_PR
1206 case LDAP_BACK_CFG_CLIENT_PR:
1207 if ( mc->mc_ps == META_CLIENT_PR_DISABLE ) {
1209 } else if ( mc->mc_ps == META_CLIENT_PR_ACCEPT_UNSOLICITED ) {
1210 BER_BVSTR( &bv, "accept-unsolicited" );
1212 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d", mc->mc_ps );
1213 bv.bv_val = c->cr_msg;
1215 value_add_one( &c->rvalue_vals, &bv );
1217 #endif /* SLAPD_META_CLIENT_PR */
1219 case LDAP_BACK_CFG_DEFAULT_T:
1220 if ( mt || mi->mi_defaulttarget == META_DEFAULT_TARGET_NONE )
1222 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d", mi->mi_defaulttarget );
1223 bv.bv_val = c->cr_msg;
1224 value_add_one( &c->rvalue_vals, &bv );
1227 case LDAP_BACK_CFG_NETWORK_TIMEOUT:
1228 if ( mc->mc_network_timeout == 0 ) {
1231 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%ld",
1232 mc->mc_network_timeout );
1233 bv.bv_val = c->cr_msg;
1234 value_add_one( &c->rvalue_vals, &bv );
1237 case LDAP_BACK_CFG_NOREFS:
1238 c->value_int = META_BACK_CMN_NOREFS(mc);
1241 case LDAP_BACK_CFG_NOUNDEFFILTER:
1242 c->value_int = META_BACK_CMN_NOUNDEFFILTER(mc);
1245 case LDAP_BACK_CFG_NRETRIES:
1246 if ( mc->mc_nretries == META_RETRY_FOREVER ) {
1247 BER_BVSTR( &bv, "forever" );
1248 } else if ( mc->mc_nretries == META_RETRY_NEVER ) {
1249 BER_BVSTR( &bv, "never" );
1251 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d",
1253 bv.bv_val = c->cr_msg;
1255 value_add_one( &c->rvalue_vals, &bv );
1258 case LDAP_BACK_CFG_QUARANTINE:
1259 if ( !META_BACK_CMN_QUARANTINE( mc )) {
1263 rc = mi->mi_ldap_extra->retry_info_unparse( &mc->mc_quarantine, &bv );
1265 ber_bvarray_add( &c->rvalue_vals, &bv );
1269 case LDAP_BACK_CFG_REBIND:
1270 c->value_int = META_BACK_CMN_SAVECRED(mc);
1273 case LDAP_BACK_CFG_TIMEOUT:
1274 for ( i = 0; i < SLAP_OP_LAST; i++ ) {
1275 if ( mc->mc_timeout[ i ] != 0 ) {
1280 if ( i == SLAP_OP_LAST ) {
1285 slap_cf_aux_table_unparse( mc->mc_timeout, &bv, timeout_table );
1287 if ( BER_BVISNULL( &bv ) ) {
1291 for ( i = 0; isspace( (unsigned char) bv.bv_val[ i ] ); i++ )
1292 /* count spaces */ ;
1296 AC_MEMCPY( bv.bv_val, &bv.bv_val[ i ],
1300 ber_bvarray_add( &c->rvalue_vals, &bv );
1303 case LDAP_BACK_CFG_VERSION:
1304 if ( mc->mc_version == 0 )
1306 c->value_int = mc->mc_version;
1309 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
1310 case LDAP_BACK_CFG_ST_REQUEST:
1311 c->value_int = META_BACK_CMN_ST_REQUEST( mc );
1313 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
1315 case LDAP_BACK_CFG_T_F:
1316 enum_to_verb( t_f_mode, (mc->mc_flags & LDAP_BACK_F_T_F_MASK2), &bv );
1317 if ( BER_BVISNULL( &bv ) ) {
1318 /* there's something wrong... */
1323 value_add_one( &c->rvalue_vals, &bv );
1327 case LDAP_BACK_CFG_TLS: {
1328 struct berval bc = BER_BVNULL, bv2;
1330 if (( mc->mc_flags & LDAP_BACK_F_TLS_MASK ) == LDAP_BACK_F_NONE ) {
1334 enum_to_verb( tls_mode, ( mc->mc_flags & LDAP_BACK_F_TLS_MASK ), &bv );
1335 assert( !BER_BVISNULL( &bv ) );
1338 bindconf_tls_unparse( &mt->mt_tls, &bc );
1341 if ( !BER_BVISEMPTY( &bc )) {
1342 bv2.bv_len = bv.bv_len + bc.bv_len + 1;
1343 bv2.bv_val = ch_malloc( bv2.bv_len + 1 );
1344 strcpy( bv2.bv_val, bv.bv_val );
1345 bv2.bv_val[bv.bv_len] = ' ';
1346 strcpy( &bv2.bv_val[bv.bv_len + 1], bc.bv_val );
1347 ber_memfree( bc.bv_val );
1348 ber_bvarray_add( &c->rvalue_vals, &bv2 );
1350 value_add_one( &c->rvalue_vals, &bv );
1355 case LDAP_BACK_CFG_URI: {
1356 char *p2, *p1 = strchr( mt->mt_uri, ' ' );
1357 bv.bv_len = strlen( mt->mt_uri ) + 3 + mt->mt_psuffix.bv_len;
1358 bv.bv_val = ch_malloc( bv.bv_len + 1 );
1362 p2 = lutil_strncopy( p2, mt->mt_uri, p1 - mt->mt_uri );
1364 p2 = lutil_strcopy( p2, mt->mt_uri );
1367 p2 = lutil_strcopy( p2, mt->mt_psuffix.bv_val );
1372 ber_bvarray_add( &c->rvalue_vals, &bv );
1375 case LDAP_BACK_CFG_ACL_AUTHCDN:
1376 case LDAP_BACK_CFG_ACL_PASSWD:
1377 /* FIXME no point here, there is no code implementing
1378 * their features. Was this supposed to implement
1379 * acl-bind like back-ldap?
1384 case LDAP_BACK_CFG_IDASSERT_AUTHZFROM: {
1387 struct berval bv = BER_BVNULL;
1388 char buf[SLAP_TEXT_BUFLEN];
1390 bvp = &mt->mt_idassert_authz;
1391 if ( *bvp == NULL ) {
1392 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_AUTHZ_ALL )
1394 BER_BVSTR( &bv, "*" );
1395 value_add_one( &c->rvalue_vals, &bv );
1403 for ( i = 0; !BER_BVISNULL( &((*bvp)[ i ]) ); i++ ) {
1405 int len = snprintf( buf, sizeof( buf ), SLAP_X_ORDERED_FMT, i );
1406 bv.bv_len = ((*bvp)[ i ]).bv_len + len;
1407 bv.bv_val = ber_memrealloc( bv.bv_val, bv.bv_len + 1 );
1409 ptr = lutil_strcopy( ptr, buf );
1410 ptr = lutil_strncopy( ptr, ((*bvp)[ i ]).bv_val, ((*bvp)[ i ]).bv_len );
1411 value_add_one( &c->rvalue_vals, &bv );
1414 ber_memfree( bv.bv_val );
1419 case LDAP_BACK_CFG_IDASSERT_BIND: {
1421 struct berval bc = BER_BVNULL;
1424 if ( mt->mt_idassert_authmethod == LDAP_AUTH_NONE ) {
1429 switch ( mt->mt_idassert_mode ) {
1430 case LDAP_BACK_IDASSERT_OTHERID:
1431 case LDAP_BACK_IDASSERT_OTHERDN:
1435 struct berval mode = BER_BVNULL;
1437 enum_to_verb( idassert_mode, mt->mt_idassert_mode, &mode );
1438 if ( BER_BVISNULL( &mode ) ) {
1439 /* there's something wrong... */
1444 bv.bv_len = STRLENOF( "mode=" ) + mode.bv_len;
1445 bv.bv_val = ch_malloc( bv.bv_len + 1 );
1447 ptr = lutil_strcopy( bv.bv_val, "mode=" );
1448 ptr = lutil_strcopy( ptr, mode.bv_val );
1454 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_NATIVE_AUTHZ ) {
1455 len = bv.bv_len + STRLENOF( "authz=native" );
1457 if ( !BER_BVISEMPTY( &bv ) ) {
1458 len += STRLENOF( " " );
1461 bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
1463 ptr = &bv.bv_val[ bv.bv_len ];
1465 if ( !BER_BVISEMPTY( &bv ) ) {
1466 ptr = lutil_strcopy( ptr, " " );
1469 (void)lutil_strcopy( ptr, "authz=native" );
1472 len = bv.bv_len + STRLENOF( "flags=non-prescriptive,override,obsolete-encoding-workaround,proxy-authz-non-critical,dn-authzid" );
1474 if ( !BER_BVISEMPTY( &bv ) ) {
1475 len += STRLENOF( " " );
1478 bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
1480 ptr = &bv.bv_val[ bv.bv_len ];
1482 if ( !BER_BVISEMPTY( &bv ) ) {
1483 ptr = lutil_strcopy( ptr, " " );
1486 ptr = lutil_strcopy( ptr, "flags=" );
1488 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_PRESCRIPTIVE ) {
1489 ptr = lutil_strcopy( ptr, "prescriptive" );
1491 ptr = lutil_strcopy( ptr, "non-prescriptive" );
1494 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OVERRIDE ) {
1495 ptr = lutil_strcopy( ptr, ",override" );
1498 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_PROXY_AUTHZ ) {
1499 ptr = lutil_strcopy( ptr, ",obsolete-proxy-authz" );
1501 } else if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_ENCODING_WORKAROUND ) {
1502 ptr = lutil_strcopy( ptr, ",obsolete-encoding-workaround" );
1505 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_PROXYAUTHZ_CRITICAL ) {
1506 ptr = lutil_strcopy( ptr, ",proxy-authz-critical" );
1509 ptr = lutil_strcopy( ptr, ",proxy-authz-non-critical" );
1513 switch ( mt->mt_idassert_flags & LDAP_BACK_AUTH_DN_MASK ) {
1514 case LDAP_BACK_AUTH_DN_AUTHZID:
1515 ptr = lutil_strcopy( ptr, ",dn-authzid" );
1518 case LDAP_BACK_AUTH_DN_WHOAMI:
1519 ptr = lutil_strcopy( ptr, ",dn-whoami" );
1523 #if 0 /* implicit */
1524 ptr = lutil_strcopy( ptr, ",dn-none" );
1530 bv.bv_len = ( ptr - bv.bv_val );
1534 bindconf_unparse( &mt->mt_idassert.si_bc, &bc );
1536 if ( !BER_BVISNULL( &bv ) ) {
1537 ber_len_t len = bv.bv_len + bc.bv_len;
1539 bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
1541 assert( bc.bv_val[ 0 ] == ' ' );
1543 ptr = lutil_strcopy( &bv.bv_val[ bv.bv_len ], bc.bv_val );
1545 bv.bv_len = ptr - bv.bv_val;
1548 for ( i = 0; isspace( (unsigned char) bc.bv_val[ i ] ); i++ )
1549 /* count spaces */ ;
1553 AC_MEMCPY( bc.bv_val, &bc.bv_val[ i ], bc.bv_len + 1 );
1559 ber_bvarray_add( &c->rvalue_vals, &bv );
1564 case LDAP_BACK_CFG_SUFFIXM: /* unused */
1565 case LDAP_BACK_CFG_REWRITE:
1566 if ( mt->mt_rwmap.rwm_bva_rewrite == NULL ) {
1569 rc = slap_bv_x_ordered_unparse( mt->mt_rwmap.rwm_bva_rewrite, &c->rvalue_vals );
1573 case LDAP_BACK_CFG_MAP:
1574 if ( mt->mt_rwmap.rwm_bva_map == NULL ) {
1577 rc = slap_bv_x_ordered_unparse( mt->mt_rwmap.rwm_bva_map, &c->rvalue_vals );
1581 case LDAP_BACK_CFG_SUBTREE_EX:
1582 case LDAP_BACK_CFG_SUBTREE_IN:
1583 rc = meta_subtree_unparse( c, mt );
1586 /* replaced by idassert */
1587 case LDAP_BACK_CFG_PSEUDOROOTDN:
1588 case LDAP_BACK_CFG_PSEUDOROOTPW:
1596 } else if ( c->op == LDAP_MOD_DELETE ) {
1599 case LDAP_BACK_CFG_CONN_TTL:
1600 mi->mi_conn_ttl = 0;
1603 case LDAP_BACK_CFG_DNCACHE_TTL:
1604 mi->mi_cache.ttl = META_DNCACHE_DISABLED;
1607 case LDAP_BACK_CFG_IDLE_TIMEOUT:
1608 mi->mi_idle_timeout = 0;
1611 case LDAP_BACK_CFG_ONERR:
1612 mi->mi_flags &= ~META_BACK_F_ONERR_MASK;
1615 case LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER:
1616 mi->mi_flags &= ~META_BACK_F_DEFER_ROOTDN_BIND;
1619 case LDAP_BACK_CFG_SINGLECONN:
1620 mi->mi_flags &= ~LDAP_BACK_F_SINGLECONN;
1623 case LDAP_BACK_CFG_USETEMP:
1624 mi->mi_flags &= ~LDAP_BACK_F_USE_TEMPORARIES;
1627 case LDAP_BACK_CFG_CONNPOOLMAX:
1628 mi->mi_conn_priv_max = LDAP_BACK_CONN_PRIV_MIN;
1632 case LDAP_BACK_CFG_BIND_TIMEOUT:
1633 mc->mc_bind_timeout.tv_sec = 0;
1634 mc->mc_bind_timeout.tv_usec = 0;
1637 case LDAP_BACK_CFG_CANCEL:
1638 mc->mc_flags &= ~LDAP_BACK_F_CANCEL_MASK2;
1641 case LDAP_BACK_CFG_CHASE:
1642 mc->mc_flags &= ~LDAP_BACK_F_CHASE_REFERRALS;
1645 #ifdef SLAPD_META_CLIENT_PR
1646 case LDAP_BACK_CFG_CLIENT_PR:
1647 mc->mc_ps == META_CLIENT_PR_DISABLE;
1649 #endif /* SLAPD_META_CLIENT_PR */
1651 case LDAP_BACK_CFG_DEFAULT_T:
1652 mi->mi_defaulttarget = META_DEFAULT_TARGET_NONE;
1655 case LDAP_BACK_CFG_NETWORK_TIMEOUT:
1656 mc->mc_network_timeout = 0;
1659 case LDAP_BACK_CFG_NOREFS:
1660 mc->mc_flags &= ~LDAP_BACK_F_NOREFS;
1663 case LDAP_BACK_CFG_NOUNDEFFILTER:
1664 mc->mc_flags &= ~LDAP_BACK_F_NOUNDEFFILTER;
1667 case LDAP_BACK_CFG_NRETRIES:
1668 mc->mc_nretries == META_RETRY_DEFAULT;
1671 case LDAP_BACK_CFG_QUARANTINE:
1672 if ( META_BACK_CMN_QUARANTINE( mc )) {
1673 mi->mi_ldap_extra->retry_info_destroy( &mc->mc_quarantine );
1674 mc->mc_flags &= ~LDAP_BACK_F_QUARANTINE;
1675 if ( mc == &mt->mt_mc ) {
1676 ldap_pvt_thread_mutex_destroy( &mt->mt_quarantine_mutex );
1677 mt->mt_isquarantined = 0;
1682 case LDAP_BACK_CFG_REBIND:
1683 mc->mc_flags &= ~LDAP_BACK_F_SAVECRED;
1686 case LDAP_BACK_CFG_TIMEOUT:
1687 for ( i = 0; i < SLAP_OP_LAST; i++ ) {
1688 mc->mc_timeout[ i ] = 0;
1692 case LDAP_BACK_CFG_VERSION:
1696 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
1697 case LDAP_BACK_CFG_ST_REQUEST:
1698 mc->mc_flags &= ~LDAP_BACK_F_ST_REQUEST;
1700 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
1702 case LDAP_BACK_CFG_T_F:
1703 mc->mc_flags &= ~LDAP_BACK_F_T_F_MASK2;
1706 case LDAP_BACK_CFG_TLS:
1707 mc->mc_flags &= ~LDAP_BACK_F_TLS_MASK;
1709 bindconf_free( &mt->mt_tls );
1713 case LDAP_BACK_CFG_URI:
1715 ch_free( mt->mt_uri );
1718 /* FIXME: should have a way to close all cached
1719 * connections associated with this target.
1723 case LDAP_BACK_CFG_IDASSERT_AUTHZFROM: {
1726 bvp = &mt->mt_idassert_authz; break;
1727 if ( c->valx < 0 ) {
1728 if ( *bvp != NULL ) {
1729 ber_bvarray_free( *bvp );
1734 if ( *bvp == NULL ) {
1739 for ( i = 0; !BER_BVISNULL( &((*bvp)[ i ]) ); i++ )
1742 if ( i >= c->valx ) {
1746 ber_memfree( ((*bvp)[ c->valx ]).bv_val );
1747 for ( i = c->valx; !BER_BVISNULL( &((*bvp)[ i + 1 ]) ); i++ ) {
1748 (*bvp)[ i ] = (*bvp)[ i + 1 ];
1750 BER_BVZERO( &((*bvp)[ i ]) );
1754 case LDAP_BACK_CFG_IDASSERT_BIND:
1755 bindconf_free( &mt->mt_idassert.si_bc );
1756 memset( &mt->mt_idassert, 0, sizeof( slap_idassert_t ) );
1759 case LDAP_BACK_CFG_SUFFIXM: /* unused */
1760 case LDAP_BACK_CFG_REWRITE:
1761 if ( mt->mt_rwmap.rwm_bva_rewrite ) {
1762 ber_bvarray_free( mt->mt_rwmap.rwm_bva_rewrite );
1763 mt->mt_rwmap.rwm_bva_rewrite = NULL;
1765 if ( mt->mt_rwmap.rwm_rw )
1766 rewrite_info_delete( &mt->mt_rwmap.rwm_rw );
1769 case LDAP_BACK_CFG_MAP:
1770 if ( mt->mt_rwmap.rwm_bva_map ) {
1771 ber_bvarray_free( mt->mt_rwmap.rwm_bva_map );
1772 mt->mt_rwmap.rwm_bva_map = NULL;
1774 meta_back_map_free( &mt->mt_rwmap.rwm_oc );
1775 meta_back_map_free( &mt->mt_rwmap.rwm_at );
1776 mt->mt_rwmap.rwm_oc.drop_missing = 0;
1777 mt->mt_rwmap.rwm_at.drop_missing = 0;
1780 case LDAP_BACK_CFG_SUBTREE_EX:
1781 case LDAP_BACK_CFG_SUBTREE_IN:
1782 /* can only be one of exclude or include */
1783 if (( c->type == LDAP_BACK_CFG_SUBTREE_EX ) ^ mt->mt_subtree_exclude ) {
1787 if ( c->valx < 0 ) {
1788 meta_subtree_destroy( mt->mt_subtree );
1789 mt->mt_subtree = NULL;
1791 metasubtree_t *ms, **mprev;
1792 for (i=0, mprev = &mt->mt_subtree, ms = *mprev; ms; ms = *mprev) {
1793 if ( i == c->valx ) {
1794 *mprev = ms->ms_next;
1795 meta_subtree_free( ms );
1799 mprev = &ms->ms_next;
1814 if ( c->op == SLAP_CONFIG_ADD ) {
1815 if ( c->type >= LDAP_BACK_CFG_LAST_BASE ) {
1816 /* exclude CFG_URI from this check */
1817 if ( c->type > LDAP_BACK_CFG_LAST_BOTH ) {
1818 if ( !mi->mi_ntargets ) {
1819 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1820 "need \"uri\" directive first" );
1821 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1825 if ( mi->mi_ntargets ) {
1826 mt = mi->mi_targets[ mi->mi_ntargets-1 ];
1834 if ( c->table == Cft_Database ) {
1847 case LDAP_BACK_CFG_URI: {
1854 if ( c->be->be_nsuffix == NULL ) {
1855 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1856 "the suffix must be defined before any target" );
1857 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1861 i = mi->mi_ntargets++;
1863 mi->mi_targets = ( metatarget_t ** )ch_realloc( mi->mi_targets,
1864 sizeof( metatarget_t * ) * mi->mi_ntargets );
1865 if ( mi->mi_targets == NULL ) {
1866 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1867 "out of memory while storing server name"
1868 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1870 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1874 if ( meta_back_new_target( &mi->mi_targets[ i ] ) != 0 ) {
1875 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1876 "unable to init server"
1877 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1879 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1883 mt = mi->mi_targets[ i ];
1885 mt->mt_rebind_f = mi->mi_rebind_f;
1886 mt->mt_urllist_f = mi->mi_urllist_f;
1887 mt->mt_urllist_p = mt;
1889 if ( META_BACK_QUARANTINE( mi ) ) {
1890 ldap_pvt_thread_mutex_init( &mt->mt_quarantine_mutex );
1892 mt->mt_mc = mi->mi_mc;
1894 for ( j = 1; j < c->argc; j++ ) {
1895 char **tmpuris = ldap_str2charray( c->argv[ j ], "\t" );
1897 if ( tmpuris == NULL ) {
1898 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1899 "unable to parse URIs #%d"
1900 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1902 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1910 ldap_charray_merge( &uris, tmpuris );
1911 ldap_charray_free( tmpuris );
1915 for ( j = 0; uris[ j ] != NULL; j++ ) {
1916 char *tmpuri = NULL;
1919 * uri MUST be legal!
1921 if ( ldap_url_parselist_ext( &ludp, uris[ j ], "\t",
1922 LDAP_PVT_URL_PARSE_NONE ) != LDAP_SUCCESS
1923 || ludp->lud_next != NULL )
1925 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1926 "unable to parse URI #%d"
1927 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1929 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1930 ldap_charray_free( uris );
1937 * uri MUST have the <dn> part!
1939 if ( ludp->lud_dn == NULL ) {
1940 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1941 "missing <naming context> "
1942 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1944 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1945 ldap_free_urllist( ludp );
1946 ldap_charray_free( uris );
1951 * copies and stores uri and suffix
1953 ber_str2bv( ludp->lud_dn, 0, 0, &dn );
1954 rc = dnPrettyNormal( NULL, &dn, &mt->mt_psuffix,
1955 &mt->mt_nsuffix, NULL );
1956 if ( rc != LDAP_SUCCESS ) {
1957 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1958 "target DN is invalid \"%s\"",
1960 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1961 ldap_free_urllist( ludp );
1962 ldap_charray_free( uris );
1966 ludp->lud_dn[ 0 ] = '\0';
1968 switch ( ludp->lud_scope ) {
1969 case LDAP_SCOPE_DEFAULT:
1970 mt->mt_scope = LDAP_SCOPE_SUBTREE;
1973 case LDAP_SCOPE_SUBTREE:
1974 case LDAP_SCOPE_SUBORDINATE:
1975 mt->mt_scope = ludp->lud_scope;
1979 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1980 "invalid scope for target \"%s\"",
1982 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1983 ldap_free_urllist( ludp );
1984 ldap_charray_free( uris );
1989 /* check all, to apply the scope check on the first one */
1990 if ( ludp->lud_dn != NULL && ludp->lud_dn[ 0 ] != '\0' ) {
1991 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1992 "multiple URIs must have no DN part" );
1993 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1994 ldap_free_urllist( ludp );
1995 ldap_charray_free( uris );
2001 tmpuri = ldap_url_list2urls( ludp );
2002 ldap_free_urllist( ludp );
2003 if ( tmpuri == NULL ) {
2004 snprintf( c->cr_msg, sizeof( c->cr_msg ), "no memory?" );
2005 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2006 ldap_charray_free( uris );
2009 ldap_memfree( uris[ j ] );
2013 mt->mt_uri = ldap_charray2str( uris, " " );
2014 ldap_charray_free( uris );
2015 if ( mt->mt_uri == NULL) {
2016 snprintf( c->cr_msg, sizeof( c->cr_msg ), "no memory?" );
2017 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2022 * uri MUST be a branch of suffix!
2024 for ( j = 0; !BER_BVISNULL( &c->be->be_nsuffix[ j ] ); j++ ) {
2025 if ( dnIsSuffix( &mt->mt_nsuffix, &c->be->be_nsuffix[ j ] ) ) {
2030 if ( BER_BVISNULL( &c->be->be_nsuffix[ j ] ) ) {
2031 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2032 "<naming context> of URI must be within the naming context of this database." );
2033 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2038 case LDAP_BACK_CFG_SUBTREE_EX:
2039 case LDAP_BACK_CFG_SUBTREE_IN:
2040 /* subtree-exclude */
2041 if ( meta_subtree_config( mt, c )) {
2042 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2047 case LDAP_BACK_CFG_DEFAULT_T:
2048 /* default target directive */
2049 i = mi->mi_ntargets - 1;
2051 if ( c->argc == 1 ) {
2053 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2054 "\"%s\" alone must be inside a \"uri\" directive",
2056 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2059 mi->mi_defaulttarget = i;
2062 if ( strcasecmp( c->argv[ 1 ], "none" ) == 0 ) {
2064 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2065 "\"%s none\" should go before uri definitions",
2067 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2069 mi->mi_defaulttarget = META_DEFAULT_TARGET_NONE;
2073 if ( lutil_atoi( &mi->mi_defaulttarget, c->argv[ 1 ] ) != 0
2074 || mi->mi_defaulttarget < 0
2075 || mi->mi_defaulttarget >= i - 1 )
2077 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2078 "illegal target number %d",
2079 mi->mi_defaulttarget );
2080 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2087 case LDAP_BACK_CFG_DNCACHE_TTL:
2088 /* ttl of dn cache */
2089 if ( strcasecmp( c->argv[ 1 ], "forever" ) == 0 ) {
2090 mi->mi_cache.ttl = META_DNCACHE_FOREVER;
2092 } else if ( strcasecmp( c->argv[ 1 ], "disabled" ) == 0 ) {
2093 mi->mi_cache.ttl = META_DNCACHE_DISABLED;
2098 if ( lutil_parse_time( c->argv[ 1 ], &t ) != 0 ) {
2099 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2100 "unable to parse dncache ttl \"%s\"",
2102 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2105 mi->mi_cache.ttl = (time_t)t;
2109 case LDAP_BACK_CFG_NETWORK_TIMEOUT: {
2110 /* network timeout when connecting to ldap servers */
2113 if ( lutil_parse_time( c->argv[ 1 ], &t ) ) {
2114 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2115 "unable to parse network timeout \"%s\"",
2117 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2120 mc->mc_network_timeout = (time_t)t;
2123 case LDAP_BACK_CFG_IDLE_TIMEOUT: {
2124 /* idle timeout when connecting to ldap servers */
2127 if ( lutil_parse_time( c->argv[ 1 ], &t ) ) {
2128 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2129 "unable to parse idle timeout \"%s\"",
2131 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2135 mi->mi_idle_timeout = (time_t)t;
2138 case LDAP_BACK_CFG_CONN_TTL: {
2142 if ( lutil_parse_time( c->argv[ 1 ], &t ) ) {
2143 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2144 "unable to parse conn ttl \"%s\"",
2146 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2150 mi->mi_conn_ttl = (time_t)t;
2153 case LDAP_BACK_CFG_BIND_TIMEOUT:
2154 /* bind timeout when connecting to ldap servers */
2155 mc->mc_bind_timeout.tv_sec = c->value_ulong/1000000;
2156 mc->mc_bind_timeout.tv_usec = c->value_ulong%1000000;
2159 case LDAP_BACK_CFG_ACL_AUTHCDN:
2160 /* name to use for meta_back_group */
2161 if ( strcasecmp( c->argv[ 0 ], "binddn" ) == 0 ) {
2162 Debug( LDAP_DEBUG_ANY, "%s: "
2163 "\"binddn\" statement is deprecated; "
2164 "use \"acl-authcDN\" instead\n",
2166 /* FIXME: some day we'll need to throw an error */
2169 ber_memfree_x( c->value_dn.bv_val, NULL );
2170 mt->mt_binddn = c->value_ndn;
2171 BER_BVZERO( &c->value_dn );
2172 BER_BVZERO( &c->value_ndn );
2175 case LDAP_BACK_CFG_ACL_PASSWD:
2176 /* password to use for meta_back_group */
2177 if ( strcasecmp( c->argv[ 0 ], "bindpw" ) == 0 ) {
2178 Debug( LDAP_DEBUG_ANY, "%s "
2179 "\"bindpw\" statement is deprecated; "
2180 "use \"acl-passwd\" instead\n",
2182 /* FIXME: some day we'll need to throw an error */
2185 ber_str2bv( c->argv[ 1 ], 0L, 1, &mt->mt_bindpw );
2188 case LDAP_BACK_CFG_REBIND:
2189 /* save bind creds for referral rebinds? */
2190 if ( c->argc == 1 || c->value_int ) {
2191 mc->mc_flags |= LDAP_BACK_F_SAVECRED;
2193 mc->mc_flags &= ~LDAP_BACK_F_SAVECRED;
2197 case LDAP_BACK_CFG_CHASE:
2198 if ( c->argc == 1 || c->value_int ) {
2199 mc->mc_flags |= LDAP_BACK_F_CHASE_REFERRALS;
2201 mc->mc_flags &= ~LDAP_BACK_F_CHASE_REFERRALS;
2205 case LDAP_BACK_CFG_TLS:
2206 i = verb_to_mask( c->argv[1], tls_mode );
2207 if ( BER_BVISNULL( &tls_mode[i].word ) ) {
2208 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2209 "%s unknown argument \"%s\"",
2210 c->argv[0], c->argv[1] );
2211 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2214 mc->mc_flags &= ~LDAP_BACK_F_TLS_MASK;
2215 mc->mc_flags |= tls_mode[i].mask;
2217 if ( c->argc > 2 ) {
2218 if ( c->op == SLAP_CONFIG_ADD && mi->mi_ntargets == 0 ) {
2219 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2220 "need \"uri\" directive first" );
2221 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2225 for ( i = 2; i < c->argc; i++ ) {
2226 if ( bindconf_tls_parse( c->argv[i], &mt->mt_tls ))
2229 bindconf_tls_defaults( &mt->mt_tls );
2233 case LDAP_BACK_CFG_T_F:
2234 i = verb_to_mask( c->argv[1], t_f_mode );
2235 if ( BER_BVISNULL( &t_f_mode[i].word ) ) {
2236 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2237 "%s unknown argument \"%s\"",
2238 c->argv[0], c->argv[1] );
2239 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2242 mc->mc_flags &= ~LDAP_BACK_F_T_F_MASK2;
2243 mc->mc_flags |= t_f_mode[i].mask;
2246 case LDAP_BACK_CFG_ONERR:
2248 i = verb_to_mask( c->argv[1], onerr_mode );
2249 if ( BER_BVISNULL( &onerr_mode[i].word ) ) {
2250 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2251 "%s unknown argument \"%s\"",
2252 c->argv[0], c->argv[1] );
2253 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2256 mi->mi_flags &= ~META_BACK_F_ONERR_MASK;
2257 mi->mi_flags |= onerr_mode[i].mask;
2260 case LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER:
2262 if ( c->argc == 1 || c->value_int ) {
2263 mi->mi_flags |= META_BACK_F_DEFER_ROOTDN_BIND;
2265 mi->mi_flags &= ~META_BACK_F_DEFER_ROOTDN_BIND;
2269 case LDAP_BACK_CFG_SINGLECONN:
2271 if ( mi->mi_ntargets > 0 ) {
2272 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2273 "\"%s\" must appear before target definitions",
2275 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2278 if ( c->value_int ) {
2279 mi->mi_flags |= LDAP_BACK_F_SINGLECONN;
2281 mi->mi_flags &= ~LDAP_BACK_F_SINGLECONN;
2285 case LDAP_BACK_CFG_USETEMP:
2286 /* use-temporaries? */
2287 if ( mi->mi_ntargets > 0 ) {
2288 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2289 "\"%s\" must appear before target definitions",
2291 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2294 if ( c->value_int ) {
2295 mi->mi_flags |= LDAP_BACK_F_USE_TEMPORARIES;
2297 mi->mi_flags &= ~LDAP_BACK_F_USE_TEMPORARIES;
2301 case LDAP_BACK_CFG_CONNPOOLMAX:
2302 /* privileged connections pool max size ? */
2303 if ( mi->mi_ntargets > 0 ) {
2304 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2305 "\"%s\" must appear before target definitions",
2307 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2311 if ( c->value_int < LDAP_BACK_CONN_PRIV_MIN
2312 || c->value_int > LDAP_BACK_CONN_PRIV_MAX )
2314 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2315 "invalid max size " "of privileged "
2316 "connections pool \"%s\" "
2317 "in \"conn-pool-max <n> "
2318 "(must be between %d and %d)\"",
2320 LDAP_BACK_CONN_PRIV_MIN,
2321 LDAP_BACK_CONN_PRIV_MAX );
2322 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2325 mi->mi_conn_priv_max = c->value_int;
2328 case LDAP_BACK_CFG_CANCEL:
2329 i = verb_to_mask( c->argv[1], cancel_mode );
2330 if ( BER_BVISNULL( &cancel_mode[i].word ) ) {
2331 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2332 "%s unknown argument \"%s\"",
2333 c->argv[0], c->argv[1] );
2334 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2337 mc->mc_flags &= ~LDAP_BACK_F_CANCEL_MASK2;
2338 mc->mc_flags |= t_f_mode[i].mask;
2341 case LDAP_BACK_CFG_TIMEOUT:
2342 for ( i = 1; i < c->argc; i++ ) {
2343 if ( isdigit( (unsigned char) c->argv[ i ][ 0 ] ) ) {
2347 if ( lutil_atoux( &u, c->argv[ i ], 0 ) != 0 ) {
2348 snprintf( c->cr_msg, sizeof( c->cr_msg),
2349 "unable to parse timeout \"%s\"",
2351 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2355 for ( j = 0; j < SLAP_OP_LAST; j++ ) {
2356 mc->mc_timeout[ j ] = u;
2362 if ( slap_cf_aux_table_parse( c->argv[ i ], mc->mc_timeout, timeout_table, "slapd-meta timeout" ) ) {
2363 snprintf( c->cr_msg, sizeof( c->cr_msg),
2364 "unable to parse timeout \"%s\"",
2366 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2372 case LDAP_BACK_CFG_PSEUDOROOTDN:
2373 /* name to use as pseudo-root dn */
2375 * exact replacement:
2378 idassert-bind bindmethod=simple
2379 binddn=<pseudorootdn>
2380 credentials=<pseudorootpw>
2382 flags=non-prescriptive
2383 idassert-authzFrom "dn:<rootdn>"
2385 * so that only when authc'd as <rootdn> the proxying occurs
2386 * rebinding as the <pseudorootdn> without proxyAuthz.
2389 Debug( LDAP_DEBUG_ANY,
2390 "%s: \"pseudorootdn\", \"pseudorootpw\" are no longer supported; "
2391 "use \"idassert-bind\" and \"idassert-authzFrom\" instead.\n",
2395 char binddn[ SLAP_TEXT_BUFLEN ];
2398 "bindmethod=simple",
2401 "flags=non-prescriptive",
2410 if ( BER_BVISNULL( &c->be->be_rootndn ) ) {
2411 Debug( LDAP_DEBUG_ANY, "%s: \"pseudorootpw\": \"rootdn\" must be defined first.\n",
2416 if ( sizeof( binddn ) <= (unsigned) snprintf( binddn,
2417 sizeof( binddn ), "binddn=%s", c->argv[ 1 ] ))
2419 Debug( LDAP_DEBUG_ANY, "%s: \"pseudorootdn\" too long.\n",
2423 cargv[ 2 ] = binddn;
2429 rc = mi->mi_ldap_extra->idassert_parse( c, &mt->mt_idassert );
2435 if ( mt->mt_idassert_authz != NULL ) {
2436 Debug( LDAP_DEBUG_ANY, "%s: \"idassert-authzFrom\" already defined (discarded).\n",
2438 ber_bvarray_free( mt->mt_idassert_authz );
2439 mt->mt_idassert_authz = NULL;
2442 assert( !BER_BVISNULL( &mt->mt_idassert_authcDN ) );
2444 bv.bv_len = STRLENOF( "dn:" ) + c->be->be_rootndn.bv_len;
2445 bv.bv_val = ber_memalloc( bv.bv_len + 1 );
2446 AC_MEMCPY( bv.bv_val, "dn:", STRLENOF( "dn:" ) );
2447 AC_MEMCPY( &bv.bv_val[ STRLENOF( "dn:" ) ], c->be->be_rootndn.bv_val, c->be->be_rootndn.bv_len + 1 );
2449 ber_bvarray_add( &mt->mt_idassert_authz, &bv );
2456 case LDAP_BACK_CFG_PSEUDOROOTPW:
2457 /* password to use as pseudo-root */
2458 Debug( LDAP_DEBUG_ANY,
2459 "%s: \"pseudorootdn\", \"pseudorootpw\" are no longer supported; "
2460 "use \"idassert-bind\" and \"idassert-authzFrom\" instead.\n",
2463 if ( BER_BVISNULL( &mt->mt_idassert_authcDN ) ) {
2464 Debug( LDAP_DEBUG_ANY, "%s: \"pseudorootpw\": \"pseudorootdn\" must be defined first.\n",
2469 if ( !BER_BVISNULL( &mt->mt_idassert_passwd ) ) {
2470 memset( mt->mt_idassert_passwd.bv_val, 0,
2471 mt->mt_idassert_passwd.bv_len );
2472 ber_memfree( mt->mt_idassert_passwd.bv_val );
2474 ber_str2bv( c->argv[ 1 ], 0, 1, &mt->mt_idassert_passwd );
2477 case LDAP_BACK_CFG_IDASSERT_BIND:
2479 rc = mi->mi_ldap_extra->idassert_parse( c, &mt->mt_idassert );
2482 case LDAP_BACK_CFG_IDASSERT_AUTHZFROM:
2483 /* idassert-authzFrom */
2484 rc = mi->mi_ldap_extra->idassert_authzfrom_parse( c, &mt->mt_idassert );
2487 case LDAP_BACK_CFG_QUARANTINE:
2489 if ( META_BACK_CMN_QUARANTINE( mc ) )
2491 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2492 "quarantine already defined" );
2493 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2498 mc->mc_quarantine.ri_interval = NULL;
2499 mc->mc_quarantine.ri_num = NULL;
2500 if ( !META_BACK_QUARANTINE( mi ) ) {
2501 ldap_pvt_thread_mutex_init( &mt->mt_quarantine_mutex );
2505 if ( mi->mi_ldap_extra->retry_info_parse( c->argv[ 1 ], &mc->mc_quarantine, c->cr_msg, sizeof( c->cr_msg ) ) ) {
2506 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2510 mc->mc_flags |= LDAP_BACK_F_QUARANTINE;
2513 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
2514 case LDAP_BACK_CFG_ST_REQUEST:
2515 /* session tracking request */
2516 if ( c->value_int ) {
2517 mc->mc_flags |= LDAP_BACK_F_ST_REQUEST;
2519 mc->mc_flags &= ~LDAP_BACK_F_ST_REQUEST;
2522 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
2524 case LDAP_BACK_CFG_SUFFIXM: /* FALLTHRU */
2525 case LDAP_BACK_CFG_REWRITE: {
2526 /* rewrite stuff ... */
2527 ConfigArgs ca = { 0 };
2529 struct rewrite_info *rwi;
2530 int cnt = 0, argc, ix = c->valx;
2532 if ( mt->mt_rwmap.rwm_bva_rewrite ) {
2533 for ( ; !BER_BVISNULL( &mt->mt_rwmap.rwm_bva_rewrite[ cnt ] ); cnt++ )
2537 if ( ix >= cnt || ix < 0 ) {
2540 rwi = mt->mt_rwmap.rwm_rw;
2542 mt->mt_rwmap.rwm_rw = NULL;
2543 rc = meta_rwi_init( &mt->mt_rwmap.rwm_rw );
2545 /* re-parse all rewrite rules, up to the one
2546 * that needs to be added */
2547 ca.fname = c->fname;
2548 ca.lineno = c->lineno;
2549 for ( i = 0; i < ix; i++ ) {
2550 ca.line = mt->mt_rwmap.rwm_bva_rewrite[ i ].bv_val;
2552 config_fp_parse_line( &ca );
2554 if ( !strcasecmp( ca.argv[0], "suffixmassage" )) {
2555 rc = meta_suffixm_config( &ca, ca.argc, ca.argv, mt );
2557 rc = rewrite_parse( mt->mt_rwmap.rwm_rw,
2558 c->fname, c->lineno, ca.argc, ca.argv );
2562 ch_free( ca.tline );
2567 if ( c->op != SLAP_CONFIG_ADD ) {
2571 /* add the new rule */
2572 if ( !strcasecmp( argv[0], "suffixmassage" )) {
2573 rc = meta_suffixm_config( c, argc, argv, mt );
2575 rc = rewrite_parse( mt->mt_rwmap.rwm_rw,
2576 c->fname, c->lineno, argc, argv );
2580 rewrite_info_delete( &mt->mt_rwmap.rwm_rw );
2581 mt->mt_rwmap.rwm_rw = rwi;
2586 for ( ; i < cnt; i++ ) {
2587 ca.line = mt->mt_rwmap.rwm_bva_rewrite[ i ].bv_val;
2589 config_fp_parse_line( &ca );
2591 if ( !strcasecmp( ca.argv[0], "suffixmassage" )) {
2592 rc = meta_suffixm_config( &ca, ca.argc, ca.argv, mt );
2594 rc = rewrite_parse( mt->mt_rwmap.rwm_rw,
2595 c->fname, c->lineno, ca.argc, argv );
2599 ch_free( ca.tline );
2603 /* save the rule info */
2604 line = ldap_charray2str( argv, "\" \"" );
2605 if ( line != NULL ) {
2607 int len = strlen( argv[ 0 ] );
2609 ber_str2bv( line, 0, 0, &bv );
2610 AC_MEMCPY( &bv.bv_val[ len ], &bv.bv_val[ len + 1 ],
2611 bv.bv_len - ( len + 1 ));
2612 bv.bv_val[ bv.bv_len - 1] = '"';
2613 ber_bvarray_add( &mt->mt_rwmap.rwm_bva_rewrite, &bv );
2614 /* move it to the right slot */
2616 for ( i=cnt; i>ix; i-- )
2617 mt->mt_rwmap.rwm_bva_rewrite[i+1] = mt->mt_rwmap.rwm_bva_rewrite[i];
2618 mt->mt_rwmap.rwm_bva_rewrite[i] = bv;
2620 /* destroy old rules */
2621 rewrite_info_delete( &rwi );
2626 case LDAP_BACK_CFG_MAP: {
2627 /* objectclass/attribute mapping */
2628 ConfigArgs ca = { 0 };
2630 struct ldapmap rwm_oc;
2631 struct ldapmap rwm_at;
2632 int cnt = 0, ix = c->valx;
2634 if ( mt->mt_rwmap.rwm_bva_map ) {
2635 for ( ; !BER_BVISNULL( &mt->mt_rwmap.rwm_bva_map[ cnt ] ); cnt++ )
2639 if ( ix >= cnt || ix < 0 ) {
2642 rwm_oc = mt->mt_rwmap.rwm_oc;
2643 rwm_at = mt->mt_rwmap.rwm_at;
2645 memset( &mt->mt_rwmap.rwm_oc, 0, sizeof( mt->mt_rwmap.rwm_oc ) );
2646 memset( &mt->mt_rwmap.rwm_at, 0, sizeof( mt->mt_rwmap.rwm_at ) );
2648 /* re-parse all mappings, up to the one
2649 * that needs to be added */
2650 argv[0] = c->argv[0];
2651 ca.fname = c->fname;
2652 ca.lineno = c->lineno;
2653 for ( i = 0; i < ix; i++ ) {
2654 ca.line = mt->mt_rwmap.rwm_bva_map[ i ].bv_val;
2656 config_fp_parse_line( &ca );
2658 argv[1] = ca.argv[0];
2659 argv[2] = ca.argv[1];
2660 argv[3] = ca.argv[2];
2661 argv[4] = ca.argv[3];
2665 rc = ldap_back_map_config( &ca, &mt->mt_rwmap.rwm_oc,
2666 &mt->mt_rwmap.rwm_at );
2668 ch_free( ca.tline );
2672 /* in case of failure, restore
2673 * the existing mapping */
2679 /* add the new mapping */
2680 rc = ldap_back_map_config( c, &mt->mt_rwmap.rwm_oc,
2681 &mt->mt_rwmap.rwm_at );
2687 for ( ; i<cnt ; cnt++ ) {
2688 ca.line = mt->mt_rwmap.rwm_bva_map[ i ].bv_val;
2690 config_fp_parse_line( &ca );
2692 argv[1] = ca.argv[0];
2693 argv[2] = ca.argv[1];
2694 argv[3] = ca.argv[2];
2695 argv[4] = ca.argv[3];
2700 rc = ldap_back_map_config( &ca, &mt->mt_rwmap.rwm_oc,
2701 &mt->mt_rwmap.rwm_at );
2703 ch_free( ca.tline );
2707 /* in case of failure, restore
2708 * the existing mapping */
2715 /* save the map info */
2716 argv[0] = ldap_charray2str( &c->argv[ 1 ], " " );
2717 if ( argv[0] != NULL ) {
2719 ber_str2bv( argv[0], 0, 0, &bv );
2720 ber_bvarray_add( &mt->mt_rwmap.rwm_bva_map, &bv );
2721 /* move it to the right slot */
2723 for ( i=cnt; i>ix; i-- )
2724 mt->mt_rwmap.rwm_bva_map[i+1] = mt->mt_rwmap.rwm_bva_map[i];
2725 mt->mt_rwmap.rwm_bva_map[i] = bv;
2727 /* destroy old mapping */
2728 meta_back_map_free( &rwm_oc );
2729 meta_back_map_free( &rwm_at );
2736 meta_back_map_free( &mt->mt_rwmap.rwm_oc );
2737 meta_back_map_free( &mt->mt_rwmap.rwm_at );
2738 mt->mt_rwmap.rwm_oc = rwm_oc;
2739 mt->mt_rwmap.rwm_at = rwm_at;
2743 case LDAP_BACK_CFG_NRETRIES: {
2744 int nretries = META_RETRY_UNDEFINED;
2746 if ( strcasecmp( c->argv[ 1 ], "forever" ) == 0 ) {
2747 nretries = META_RETRY_FOREVER;
2749 } else if ( strcasecmp( c->argv[ 1 ], "never" ) == 0 ) {
2750 nretries = META_RETRY_NEVER;
2753 if ( lutil_atoi( &nretries, c->argv[ 1 ] ) != 0 ) {
2754 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2755 "unable to parse nretries {never|forever|<retries>}: \"%s\"",
2757 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2762 mc->mc_nretries = nretries;
2765 case LDAP_BACK_CFG_VERSION:
2766 if ( c->value_int != 0 && ( c->value_int < LDAP_VERSION_MIN || c->value_int > LDAP_VERSION_MAX ) ) {
2767 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2768 "unsupported protocol version \"%s\"",
2770 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2773 mc->mc_version = c->value_int;
2776 case LDAP_BACK_CFG_NOREFS:
2777 /* do not return search references */
2778 if ( c->value_int ) {
2779 mc->mc_flags |= LDAP_BACK_F_NOREFS;
2781 mc->mc_flags &= ~LDAP_BACK_F_NOREFS;
2785 case LDAP_BACK_CFG_NOUNDEFFILTER:
2786 /* do not propagate undefined search filters */
2787 if ( c->value_int ) {
2788 mc->mc_flags |= LDAP_BACK_F_NOUNDEFFILTER;
2790 mc->mc_flags &= ~LDAP_BACK_F_NOUNDEFFILTER;
2794 #ifdef SLAPD_META_CLIENT_PR
2795 case LDAP_BACK_CFG_CLIENT_PR:
2796 if ( strcasecmp( c->argv[ 1 ], "accept-unsolicited" ) == 0 ) {
2797 mc->mc_ps = META_CLIENT_PR_ACCEPT_UNSOLICITED;
2799 } else if ( strcasecmp( c->argv[ 1 ], "disable" ) == 0 ) {
2800 mc->mc_ps = META_CLIENT_PR_DISABLE;
2802 } else if ( lutil_atoi( &mc->mc_ps, c->argv[ 1 ] ) || mc->mc_ps < -1 ) {
2803 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2804 "unable to parse client-pr {accept-unsolicited|disable|<size>}: \"%s\"",
2806 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2810 #endif /* SLAPD_META_CLIENT_PR */
2814 return SLAP_CONF_UNKNOWN;
2821 meta_back_init_cf( BackendInfo *bi )
2824 AttributeDescription *ad = NULL;
2827 /* Make sure we don't exceed the bits reserved for userland */
2828 config_check_userland( LDAP_BACK_CFG_LAST );
2830 bi->bi_cf_ocs = metaocs;
2832 rc = config_register_schema( metacfg, metaocs );
2837 /* setup olcDbAclPasswd and olcDbIDAssertPasswd
2838 * to be base64-encoded when written in LDIF form;
2839 * basically, we don't care if it fails */
2840 rc = slap_str2ad( "olcDbACLPasswd", &ad, &text );
2842 Debug( LDAP_DEBUG_ANY, "config_back_initialize: "
2843 "warning, unable to get \"olcDbACLPasswd\" "
2844 "attribute description: %d: %s\n",
2847 (void)ldif_must_b64_encode_register( ad->ad_cname.bv_val,
2848 ad->ad_type->sat_oid );
2852 rc = slap_str2ad( "olcDbIDAssertPasswd", &ad, &text );
2854 Debug( LDAP_DEBUG_ANY, "config_back_initialize: "
2855 "warning, unable to get \"olcDbIDAssertPasswd\" "
2856 "attribute description: %d: %s\n",
2859 (void)ldif_must_b64_encode_register( ad->ad_cname.bv_val,
2860 ad->ad_type->sat_oid );
2867 ldap_back_map_config(
2869 struct ldapmap *oc_map,
2870 struct ldapmap *at_map )
2872 struct ldapmap *map;
2873 struct ldapmapping *mapping;
2877 if ( strcasecmp( c->argv[ 1 ], "objectclass" ) == 0 ) {
2881 } else if ( strcasecmp( c->argv[ 1 ], "attribute" ) == 0 ) {
2885 snprintf( c->cr_msg, sizeof(c->cr_msg),
2886 "%s unknown argument \"%s\"",
2887 c->argv[0], c->argv[1] );
2888 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2892 if ( !is_oc && map->map == NULL ) {
2893 /* only init if required */
2894 ldap_back_map_init( map, &mapping );
2897 if ( strcmp( c->argv[ 2 ], "*" ) == 0 ) {
2898 if ( c->argc < 4 || strcmp( c->argv[ 3 ], "*" ) == 0 ) {
2899 map->drop_missing = ( c->argc < 4 );
2900 goto success_return;
2902 src = dst = c->argv[ 3 ];
2904 } else if ( c->argc < 4 ) {
2910 dst = ( strcmp( c->argv[ 3 ], "*" ) == 0 ? src : c->argv[ 3 ] );
2913 if ( ( map == at_map )
2914 && ( strcasecmp( src, "objectclass" ) == 0
2915 || strcasecmp( dst, "objectclass" ) == 0 ) )
2917 snprintf( c->cr_msg, sizeof(c->cr_msg),
2918 "objectclass attribute cannot be mapped" );
2919 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2923 mapping = (struct ldapmapping *)ch_calloc( 2,
2924 sizeof(struct ldapmapping) );
2925 if ( mapping == NULL ) {
2926 snprintf( c->cr_msg, sizeof(c->cr_msg),
2928 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2931 ber_str2bv( src, 0, 1, &mapping[ 0 ].src );
2932 ber_str2bv( dst, 0, 1, &mapping[ 0 ].dst );
2933 mapping[ 1 ].src = mapping[ 0 ].dst;
2934 mapping[ 1 ].dst = mapping[ 0 ].src;
2940 if ( src[ 0 ] != '\0' ) {
2941 if ( oc_bvfind( &mapping[ 0 ].src ) == NULL ) {
2942 Debug( LDAP_DEBUG_ANY,
2943 "warning, source objectClass '%s' should be defined in schema\n",
2947 * FIXME: this should become an err
2953 if ( oc_bvfind( &mapping[ 0 ].dst ) == NULL ) {
2954 Debug( LDAP_DEBUG_ANY,
2955 "warning, destination objectClass '%s' is not defined in schema\n",
2960 const char *text = NULL;
2961 AttributeDescription *ad = NULL;
2963 if ( src[ 0 ] != '\0' ) {
2964 rc = slap_bv2ad( &mapping[ 0 ].src, &ad, &text );
2965 if ( rc != LDAP_SUCCESS ) {
2966 Debug( LDAP_DEBUG_ANY,
2967 "warning, source attributeType '%s' should be defined in schema\n",
2971 * FIXME: this should become an err
2974 * we create a fake "proxied" ad
2978 rc = slap_bv2undef_ad( &mapping[ 0 ].src,
2979 &ad, &text, SLAP_AD_PROXIED );
2980 if ( rc != LDAP_SUCCESS ) {
2981 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2982 "source attributeType \"%s\": %d (%s)",
2983 src, rc, text ? text : "" );
2984 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2992 rc = slap_bv2ad( &mapping[ 0 ].dst, &ad, &text );
2993 if ( rc != LDAP_SUCCESS ) {
2994 Debug( LDAP_DEBUG_ANY,
2995 "warning, destination attributeType '%s' is not defined in schema\n",
2999 * we create a fake "proxied" ad
3003 rc = slap_bv2undef_ad( &mapping[ 0 ].dst,
3004 &ad, &text, SLAP_AD_PROXIED );
3005 if ( rc != LDAP_SUCCESS ) {
3006 snprintf( c->cr_msg, sizeof( c->cr_msg ),
3007 "destination attributeType \"%s\": %d (%s)\n",
3008 dst, rc, text ? text : "" );
3009 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
3015 if ( (src[ 0 ] != '\0' && avl_find( map->map, (caddr_t)&mapping[ 0 ], mapping_cmp ) != NULL)
3016 || avl_find( map->remap, (caddr_t)&mapping[ 1 ], mapping_cmp ) != NULL)
3018 snprintf( c->cr_msg, sizeof( c->cr_msg ),
3019 "duplicate mapping found." );
3020 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
3024 if ( src[ 0 ] != '\0' ) {
3025 avl_insert( &map->map, (caddr_t)&mapping[ 0 ],
3026 mapping_cmp, mapping_dup );
3028 avl_insert( &map->remap, (caddr_t)&mapping[ 1 ],
3029 mapping_cmp, mapping_dup );
3036 ch_free( mapping[ 0 ].src.bv_val );
3037 ch_free( mapping[ 0 ].dst.bv_val );
3045 #ifdef ENABLE_REWRITE
3047 suffix_massage_regexize( const char *s )
3053 if ( s[ 0 ] == '\0' ) {
3054 return ch_strdup( "^(.+)$" );
3058 ( r = strchr( p, ',' ) ) != NULL;
3062 res = ch_calloc( sizeof( char ),
3064 + STRLENOF( "((.+),)?" )
3065 + STRLENOF( "[ ]?" ) * i
3066 + STRLENOF( "$" ) + 1 );
3068 ptr = lutil_strcopy( res, "((.+),)?" );
3070 ( r = strchr( p, ',' ) ) != NULL;
3072 ptr = lutil_strncopy( ptr, p, r - p + 1 );
3073 ptr = lutil_strcopy( ptr, "[ ]?" );
3075 if ( r[ 1 ] == ' ' ) {
3079 ptr = lutil_strcopy( ptr, p );
3088 suffix_massage_patternize( const char *s, const char *p )
3095 if ( s[ 0 ] == '\0' ) {
3099 res = ch_calloc( sizeof( char ), len + STRLENOF( "%1" ) + 1 );
3100 if ( res == NULL ) {
3104 ptr = lutil_strcopy( res, ( p[ 0 ] == '\0' ? "%2" : "%1" ) );
3105 if ( s[ 0 ] == '\0' ) {
3109 lutil_strcopy( ptr, p );
3115 suffix_massage_config(
3116 struct rewrite_info *info,
3117 struct berval *pvnc,
3118 struct berval *nvnc,
3119 struct berval *prnc,
3126 rargv[ 0 ] = "rewriteEngine";
3129 rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3131 rargv[ 0 ] = "rewriteContext";
3132 rargv[ 1 ] = "default";
3134 rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3136 rargv[ 0 ] = "rewriteRule";
3137 rargv[ 1 ] = suffix_massage_regexize( pvnc->bv_val );
3138 rargv[ 2 ] = suffix_massage_patternize( pvnc->bv_val, prnc->bv_val );
3141 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3142 ch_free( rargv[ 1 ] );
3143 ch_free( rargv[ 2 ] );
3145 if ( BER_BVISEMPTY( pvnc ) ) {
3146 rargv[ 0 ] = "rewriteRule";
3148 rargv[ 2 ] = prnc->bv_val;
3151 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3154 rargv[ 0 ] = "rewriteContext";
3155 rargv[ 1 ] = "searchEntryDN";
3157 rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3159 rargv[ 0 ] = "rewriteRule";
3160 rargv[ 1 ] = suffix_massage_regexize( prnc->bv_val );
3161 rargv[ 2 ] = suffix_massage_patternize( prnc->bv_val, pvnc->bv_val );
3164 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3165 ch_free( rargv[ 1 ] );
3166 ch_free( rargv[ 2 ] );
3168 if ( BER_BVISEMPTY( prnc ) ) {
3169 rargv[ 0 ] = "rewriteRule";
3171 rargv[ 2 ] = pvnc->bv_val;
3174 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3177 /* backward compatibility */
3178 rargv[ 0 ] = "rewriteContext";
3179 rargv[ 1 ] = "searchResult";
3180 rargv[ 2 ] = "alias";
3181 rargv[ 3 ] = "searchEntryDN";
3183 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3185 rargv[ 0 ] = "rewriteContext";
3186 rargv[ 1 ] = "matchedDN";
3187 rargv[ 2 ] = "alias";
3188 rargv[ 3 ] = "searchEntryDN";
3190 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3192 rargv[ 0 ] = "rewriteContext";
3193 rargv[ 1 ] = "searchAttrDN";
3194 rargv[ 2 ] = "alias";
3195 rargv[ 3 ] = "searchEntryDN";
3197 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3199 /* NOTE: this corresponds to #undef'ining RWM_REFERRAL_REWRITE;
3200 * see servers/slapd/overlays/rwm.h for details */
3201 rargv[ 0 ] = "rewriteContext";
3202 rargv[ 1 ] = "referralAttrDN";
3204 rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3206 rargv[ 0 ] = "rewriteContext";
3207 rargv[ 1 ] = "referralDN";
3209 rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3213 #endif /* ENABLE_REWRITE */