2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
4 * Copyright 1999-2012 The OpenLDAP Foundation.
5 * Portions Copyright 2001-2003 Pierangelo Masarati.
6 * Portions Copyright 1999-2003 Howard Chu.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted only as authorized by the OpenLDAP
13 * A copy of this license is available in the file LICENSE in the
14 * top-level directory of the distribution or, alternatively, at
15 * <http://www.OpenLDAP.org/license.html>.
18 * This work was initially developed by the Howard Chu for inclusion
19 * in OpenLDAP Software and subsequently enhanced by Pierangelo
27 #include <ac/string.h>
28 #include <ac/socket.h>
33 #include "../back-ldap/back-ldap.h"
34 #include "back-meta.h"
36 static ConfigDriver meta_back_cf_gen;
37 static ConfigLDAPadd meta_ldadd;
38 static ConfigCfAdd meta_cfadd;
40 static int ldap_back_map_config(
42 struct ldapmap *oc_map,
43 struct ldapmap *at_map );
45 /* Three sets of enums:
46 * 1) attrs that are only valid in the base config
47 * 2) attrs that are valid in base or target
48 * 3) attrs that are only valid in a target
53 LDAP_BACK_CFG_CONN_TTL = 1,
54 LDAP_BACK_CFG_DNCACHE_TTL,
55 LDAP_BACK_CFG_IDLE_TIMEOUT,
57 LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
58 LDAP_BACK_CFG_SINGLECONN,
59 LDAP_BACK_CFG_USETEMP,
60 LDAP_BACK_CFG_CONNPOOLMAX,
61 LDAP_BACK_CFG_LAST_BASE
66 LDAP_BACK_CFG_BIND_TIMEOUT = LDAP_BACK_CFG_LAST_BASE,
69 LDAP_BACK_CFG_CLIENT_PR,
70 LDAP_BACK_CFG_DEFAULT_T,
71 LDAP_BACK_CFG_NETWORK_TIMEOUT,
73 LDAP_BACK_CFG_NOUNDEFFILTER,
74 LDAP_BACK_CFG_NRETRIES,
75 LDAP_BACK_CFG_QUARANTINE,
77 LDAP_BACK_CFG_TIMEOUT,
78 LDAP_BACK_CFG_VERSION,
79 LDAP_BACK_CFG_ST_REQUEST,
82 LDAP_BACK_CFG_LAST_BOTH
87 LDAP_BACK_CFG_URI = LDAP_BACK_CFG_LAST_BOTH,
88 LDAP_BACK_CFG_ACL_AUTHCDN,
89 LDAP_BACK_CFG_ACL_PASSWD,
90 LDAP_BACK_CFG_IDASSERT_AUTHZFROM,
91 LDAP_BACK_CFG_IDASSERT_BIND,
92 LDAP_BACK_CFG_REWRITE,
93 LDAP_BACK_CFG_SUFFIXM,
95 LDAP_BACK_CFG_SUBTREE_EX,
96 LDAP_BACK_CFG_SUBTREE_IN,
97 LDAP_BACK_CFG_PSEUDOROOTDN,
98 LDAP_BACK_CFG_PSEUDOROOTPW,
103 static ConfigTable metacfg[] = {
104 { "uri", "uri", 2, 2, 0,
105 ARG_MAGIC|LDAP_BACK_CFG_URI,
106 meta_back_cf_gen, "( OLcfgDbAt:0.14 "
108 "DESC 'URI (list) for remote DSA' "
109 "SYNTAX OMsDirectoryString "
112 { "tls", "what", 2, 0, 0,
113 ARG_MAGIC|LDAP_BACK_CFG_TLS,
114 meta_back_cf_gen, "( OLcfgDbAt:3.1 "
115 "NAME 'olcDbStartTLS' "
117 "SYNTAX OMsDirectoryString "
120 { "acl-authcDN", "DN", 2, 2, 0,
121 ARG_DN|ARG_MAGIC|LDAP_BACK_CFG_ACL_AUTHCDN,
122 meta_back_cf_gen, "( OLcfgDbAt:3.2 "
123 "NAME 'olcDbACLAuthcDn' "
124 "DESC 'Remote ACL administrative identity' "
129 /* deprecated, will be removed; aliases "acl-authcDN" */
130 { "binddn", "DN", 2, 2, 0,
131 ARG_DN|ARG_MAGIC|LDAP_BACK_CFG_ACL_AUTHCDN,
132 meta_back_cf_gen, NULL, NULL, NULL },
133 { "acl-passwd", "cred", 2, 2, 0,
134 ARG_MAGIC|LDAP_BACK_CFG_ACL_PASSWD,
135 meta_back_cf_gen, "( OLcfgDbAt:3.3 "
136 "NAME 'olcDbACLPasswd' "
137 "DESC 'Remote ACL administrative identity credentials' "
139 "SYNTAX OMsDirectoryString "
142 /* deprecated, will be removed; aliases "acl-passwd" */
143 { "bindpw", "cred", 2, 2, 0,
144 ARG_MAGIC|LDAP_BACK_CFG_ACL_PASSWD,
145 meta_back_cf_gen, NULL, NULL, NULL },
146 { "idassert-bind", "args", 2, 0, 0,
147 ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_BIND,
148 meta_back_cf_gen, "( OLcfgDbAt:3.7 "
149 "NAME 'olcDbIDAssertBind' "
150 "DESC 'Remote Identity Assertion administrative identity auth bind configuration' "
151 "SYNTAX OMsDirectoryString "
154 { "idassert-authzFrom", "authzRule", 2, 2, 0,
155 ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_AUTHZFROM,
156 meta_back_cf_gen, "( OLcfgDbAt:3.9 "
157 "NAME 'olcDbIDAssertAuthzFrom' "
158 "DESC 'Remote Identity Assertion authz rules' "
159 "EQUALITY caseIgnoreMatch "
160 "SYNTAX OMsDirectoryString "
161 "X-ORDERED 'VALUES' )",
163 { "rebind-as-user", "true|FALSE", 1, 2, 0,
164 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_REBIND,
165 meta_back_cf_gen, "( OLcfgDbAt:3.10 "
166 "NAME 'olcDbRebindAsUser' "
167 "DESC 'Rebind as user' "
171 { "chase-referrals", "true|FALSE", 2, 2, 0,
172 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_CHASE,
173 meta_back_cf_gen, "( OLcfgDbAt:3.11 "
174 "NAME 'olcDbChaseReferrals' "
175 "DESC 'Chase referrals' "
179 { "t-f-support", "true|FALSE|discover", 2, 2, 0,
180 ARG_MAGIC|LDAP_BACK_CFG_T_F,
181 meta_back_cf_gen, "( OLcfgDbAt:3.12 "
182 "NAME 'olcDbTFSupport' "
183 "DESC 'Absolute filters support' "
184 "SYNTAX OMsDirectoryString "
187 { "timeout", "timeout(list)", 2, 0, 0,
188 ARG_MAGIC|LDAP_BACK_CFG_TIMEOUT,
189 meta_back_cf_gen, "( OLcfgDbAt:3.14 "
190 "NAME 'olcDbTimeout' "
191 "DESC 'Per-operation timeouts' "
192 "SYNTAX OMsDirectoryString "
195 { "idle-timeout", "timeout", 2, 2, 0,
196 ARG_MAGIC|LDAP_BACK_CFG_IDLE_TIMEOUT,
197 meta_back_cf_gen, "( OLcfgDbAt:3.15 "
198 "NAME 'olcDbIdleTimeout' "
199 "DESC 'connection idle timeout' "
200 "SYNTAX OMsDirectoryString "
203 { "conn-ttl", "ttl", 2, 2, 0,
204 ARG_MAGIC|LDAP_BACK_CFG_CONN_TTL,
205 meta_back_cf_gen, "( OLcfgDbAt:3.16 "
206 "NAME 'olcDbConnTtl' "
207 "DESC 'connection ttl' "
208 "SYNTAX OMsDirectoryString "
211 { "network-timeout", "timeout", 2, 2, 0,
212 ARG_MAGIC|LDAP_BACK_CFG_NETWORK_TIMEOUT,
213 meta_back_cf_gen, "( OLcfgDbAt:3.17 "
214 "NAME 'olcDbNetworkTimeout' "
215 "DESC 'connection network timeout' "
216 "SYNTAX OMsDirectoryString "
219 { "protocol-version", "version", 2, 2, 0,
220 ARG_MAGIC|ARG_INT|LDAP_BACK_CFG_VERSION,
221 meta_back_cf_gen, "( OLcfgDbAt:3.18 "
222 "NAME 'olcDbProtocolVersion' "
223 "DESC 'protocol version' "
227 { "single-conn", "true|FALSE", 2, 2, 0,
228 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_SINGLECONN,
229 meta_back_cf_gen, "( OLcfgDbAt:3.19 "
230 "NAME 'olcDbSingleConn' "
231 "DESC 'cache a single connection per identity' "
235 { "cancel", "ABANDON|ignore|exop", 2, 2, 0,
236 ARG_MAGIC|LDAP_BACK_CFG_CANCEL,
237 meta_back_cf_gen, "( OLcfgDbAt:3.20 "
238 "NAME 'olcDbCancel' "
239 "DESC 'abandon/ignore/exop operations when appropriate' "
240 "SYNTAX OMsDirectoryString "
243 { "quarantine", "retrylist", 2, 2, 0,
244 ARG_MAGIC|LDAP_BACK_CFG_QUARANTINE,
245 meta_back_cf_gen, "( OLcfgDbAt:3.21 "
246 "NAME 'olcDbQuarantine' "
247 "DESC 'Quarantine database if connection fails and retry according to rule' "
248 "SYNTAX OMsDirectoryString "
251 { "use-temporary-conn", "true|FALSE", 2, 2, 0,
252 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_USETEMP,
253 meta_back_cf_gen, "( OLcfgDbAt:3.22 "
254 "NAME 'olcDbUseTemporaryConn' "
255 "DESC 'Use temporary connections if the cached one is busy' "
259 { "conn-pool-max", "<n>", 2, 2, 0,
260 ARG_MAGIC|ARG_INT|LDAP_BACK_CFG_CONNPOOLMAX,
261 meta_back_cf_gen, "( OLcfgDbAt:3.23 "
262 "NAME 'olcDbConnectionPoolMax' "
263 "DESC 'Max size of privileged connections pool' "
267 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
268 { "session-tracking-request", "true|FALSE", 2, 2, 0,
269 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_ST_REQUEST,
270 meta_back_cf_gen, "( OLcfgDbAt:3.24 "
271 "NAME 'olcDbSessionTrackingRequest' "
272 "DESC 'Add session tracking control to proxied requests' "
276 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
277 { "norefs", "true|FALSE", 2, 2, 0,
278 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_NOREFS,
279 meta_back_cf_gen, "( OLcfgDbAt:3.25 "
280 "NAME 'olcDbNoRefs' "
281 "DESC 'Do not return search reference responses' "
285 { "noundeffilter", "true|FALSE", 2, 2, 0,
286 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_NOUNDEFFILTER,
287 meta_back_cf_gen, "( OLcfgDbAt:3.26 "
288 "NAME 'olcDbNoUndefFilter' "
289 "DESC 'Do not propagate undefined search filters' "
294 { "rewrite", "arglist", 2, 0, STRLENOF( "rewrite" ),
295 ARG_MAGIC|LDAP_BACK_CFG_REWRITE,
296 meta_back_cf_gen, "( OLcfgDbAt:3.101 "
297 "NAME 'olcDbRewrite' "
298 "DESC 'DN rewriting rules' "
299 "EQUALITY caseIgnoreMatch "
300 "SYNTAX OMsDirectoryString "
301 "X-ORDERED 'VALUES' )",
303 { "suffixmassage", "virtual> <real", 2, 3, 0,
304 ARG_MAGIC|LDAP_BACK_CFG_SUFFIXM,
305 meta_back_cf_gen, NULL, NULL, NULL },
307 { "map", "attribute|objectClass> [*|<local>] *|<remote", 3, 4, 0,
308 ARG_MAGIC|LDAP_BACK_CFG_MAP,
309 meta_back_cf_gen, "( OLcfgDbAt:3.102 "
311 "DESC 'Map attribute and objectclass names' "
312 "EQUALITY caseIgnoreMatch "
313 "SYNTAX OMsDirectoryString "
314 "X-ORDERED 'VALUES' )",
317 { "subtree-exclude", "pattern", 2, 2, 0,
318 ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_SUBTREE_EX,
319 meta_back_cf_gen, "( OLcfgDbAt:3.103 "
320 "NAME 'olcDbSubtreeExclude' "
321 "DESC 'DN of subtree to exclude from target' "
322 "EQUALITY caseIgnoreMatch "
323 "SYNTAX OMsDirectoryString )",
325 { "subtree-include", "pattern", 2, 2, 0,
326 ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_SUBTREE_IN,
327 meta_back_cf_gen, "( OLcfgDbAt:3.104 "
328 "NAME 'olcDbSubtreeInclude' "
329 "DESC 'DN of subtree to include in target' "
330 "EQUALITY caseIgnoreMatch "
331 "SYNTAX OMsDirectoryString )",
333 { "default-target", "[none|<target ID>]", 1, 2, 0,
334 ARG_MAGIC|LDAP_BACK_CFG_DEFAULT_T,
335 meta_back_cf_gen, "( OLcfgDbAt:3.105 "
336 "NAME 'olcDbDefaultTarget' "
337 "DESC 'Specify the default target' "
338 "SYNTAX OMsDirectoryString "
341 { "dncache-ttl", "ttl", 2, 2, 0,
342 ARG_MAGIC|LDAP_BACK_CFG_DNCACHE_TTL,
343 meta_back_cf_gen, "( OLcfgDbAt:3.106 "
344 "NAME 'olcDbDnCacheTtl' "
345 "DESC 'dncache ttl' "
346 "SYNTAX OMsDirectoryString "
349 { "bind-timeout", "microseconds", 2, 2, 0,
350 ARG_MAGIC|ARG_ULONG|LDAP_BACK_CFG_BIND_TIMEOUT,
351 meta_back_cf_gen, "( OLcfgDbAt:3.107 "
352 "NAME 'olcDbBindTimeout' "
353 "DESC 'bind timeout' "
354 "SYNTAX OMsDirectoryString "
357 { "onerr", "CONTINUE|report|stop", 2, 2, 0,
358 ARG_MAGIC|LDAP_BACK_CFG_ONERR,
359 meta_back_cf_gen, "( OLcfgDbAt:3.108 "
361 "DESC 'error handling' "
362 "SYNTAX OMsDirectoryString "
365 { "pseudoroot-bind-defer", "TRUE|false", 2, 2, 0,
366 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
367 meta_back_cf_gen, "( OLcfgDbAt:3.109 "
368 "NAME 'olcDbPseudoRootBindDefer' "
369 "DESC 'error handling' "
373 { "root-bind-defer", "TRUE|false", 2, 2, 0,
374 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
375 meta_back_cf_gen, NULL, NULL, NULL },
376 { "pseudorootdn", "dn", 2, 2, 0,
377 ARG_MAGIC|ARG_DN|LDAP_BACK_CFG_PSEUDOROOTDN,
378 meta_back_cf_gen, NULL, NULL, NULL },
379 { "pseudorootpw", "password", 2, 2, 0,
380 ARG_MAGIC|ARG_STRING|LDAP_BACK_CFG_PSEUDOROOTDN,
381 meta_back_cf_gen, NULL, NULL, NULL },
382 { "nretries", "NEVER|forever|<number>", 2, 2, 0,
383 ARG_MAGIC|LDAP_BACK_CFG_NRETRIES,
384 meta_back_cf_gen, "( OLcfgDbAt:3.110 "
385 "NAME 'olcDbNretries' "
386 "DESC 'retry handling' "
387 "SYNTAX OMsDirectoryString "
390 { "client-pr", "accept-unsolicited|disable|<size>", 2, 2, 0,
391 ARG_MAGIC|LDAP_BACK_CFG_CLIENT_PR,
392 meta_back_cf_gen, "( OLcfgDbAt:3.111 "
393 "NAME 'olcDbClientPr' "
394 "DESC 'PagedResults handling' "
395 "SYNTAX OMsDirectoryString "
399 { "", "", 0, 0, 0, ARG_IGNORED,
400 NULL, "( OLcfgDbAt:3.100 NAME 'olcMetaSub' "
401 "DESC 'Placeholder to name a Target entry' "
402 "EQUALITY caseIgnoreMatch "
403 "SYNTAX OMsDirectoryString "
404 "SINGLE-VALUE X-ORDERED 'SIBLINGS' )", NULL, NULL },
406 { NULL, NULL, 0, 0, 0, ARG_IGNORED,
407 NULL, NULL, NULL, NULL }
410 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
411 #define ST_ATTR "$ olcDbSessionTrackingRequest "
414 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
416 #define COMMON_ATTRS \
417 "$ olcDbBindTimeout " \
419 "$ olcDbChaseReferrals " \
421 "$ olcDbDefaultTarget " \
422 "$ olcDbNetworkTimeout " \
424 "$ olcDbNoUndefFilter " \
426 "$ olcDbProtocolVersion " \
427 "$ olcDbQuarantine " \
428 "$ olcDbRebindAsUser " \
433 static ConfigOCs metaocs[] = {
435 "NAME 'olcMetaConfig' "
436 "DESC 'Meta backend configuration' "
437 "SUP olcDatabaseConfig "
438 "MAY ( olcDbConnTtl "
440 "$ olcDbIdleTimeout "
442 "$ olcDbPseudoRootBindDefer "
444 "$ olcDbUseTemporaryConn "
445 "$ olcDbConnectionPoolMax "
447 /* defaults, may be overridden per-target */
450 Cft_Database, metacfg, NULL, meta_cfadd },
452 "NAME 'olcMetaTargetConfig' "
453 "DESC 'Meta target configuration' "
454 "SUP olcConfig STRUCTURAL "
455 "MUST ( olcMetaSub $ olcDbURI ) "
456 "MAY ( olcDbACLAuthcDn "
458 "$ olcDbIDAssertAuthzFrom "
459 "$ olcDbIDAssertBind "
462 "$ olcDbSubtreeExclude "
463 "$ olcDbSubtreeInclude "
466 /* defaults may be inherited */
469 Cft_Misc, metacfg, meta_ldadd },
474 meta_ldadd( CfEntryInfo *p, Entry *e, ConfigArgs *c )
476 if ( p->ce_type != Cft_Database || !p->ce_be ||
477 p->ce_be->be_cf_ocs != metaocs )
478 return LDAP_CONSTRAINT_VIOLATION;
485 meta_cfadd( Operation *op, SlapReply *rs, Entry *p, ConfigArgs *c )
487 metainfo_t *mi = ( metainfo_t * )c->be->be_private;
491 bv.bv_val = c->cr_msg;
492 for ( i=0; i<mi->mi_ntargets; i++ ) {
493 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg),
494 "olcMetaSub=" SLAP_X_ORDERED_FMT "uri", i );
495 c->ca_private = mi->mi_targets[i];
497 config_build_entry( op, rs, p->e_private, c,
498 &bv, &metaocs[1], NULL );
505 meta_rwi_init( struct rewrite_info **rwm_rw )
509 *rwm_rw = rewrite_info_init( REWRITE_MODE_USE_DEFAULT );
510 if ( *rwm_rw == NULL ) {
514 * the filter rewrite as a string must be disabled
515 * by default; it can be re-enabled by adding rules;
516 * this creates an empty rewriteContext
518 rargv[ 0 ] = "rewriteContext";
519 rargv[ 1 ] = "searchFilter";
521 rewrite_parse( *rwm_rw, "<suffix massage>", 1, 2, rargv );
523 rargv[ 0 ] = "rewriteContext";
524 rargv[ 1 ] = "default";
526 rewrite_parse( *rwm_rw, "<suffix massage>", 1, 2, rargv );
532 meta_back_new_target(
539 mt = ch_calloc( sizeof( metatarget_t ), 1 );
541 if ( meta_rwi_init( &mt->mt_rwmap.rwm_rw )) {
546 ldap_pvt_thread_mutex_init( &mt->mt_uri_mutex );
548 mt->mt_idassert_mode = LDAP_BACK_IDASSERT_LEGACY;
549 mt->mt_idassert_authmethod = LDAP_AUTH_NONE;
550 mt->mt_idassert_tls = SB_TLS_DEFAULT;
552 /* by default, use proxyAuthz control on each operation */
553 mt->mt_idassert_flags = LDAP_BACK_AUTH_PRESCRIPTIVE;
560 /* Validation for suffixmassage_config */
570 struct berval dn, nvnc, pvnc, nrnc, prnc;
576 * suffixmassage <suffix> <massaged suffix>
578 * the <suffix> field must be defined as a valid suffix
579 * (or suffixAlias?) for the current database;
580 * the <massaged suffix> shouldn't have already been
581 * defined as a valid suffix or suffixAlias for the
585 ber_str2bv( argv[ 1 ], 0, 0, &dn );
586 if ( dnPrettyNormal( NULL, &dn, &pvnc, &nvnc, NULL ) != LDAP_SUCCESS ) {
587 snprintf( c->cr_msg, sizeof( c->cr_msg ),
588 "suffix \"%s\" is invalid",
590 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
594 for ( j = 0; !BER_BVISNULL( &c->be->be_nsuffix[ j ] ); j++ ) {
595 if ( dnIsSuffix( &nvnc, &c->be->be_nsuffix[ 0 ] ) ) {
600 if ( BER_BVISNULL( &c->be->be_nsuffix[ j ] ) ) {
601 snprintf( c->cr_msg, sizeof( c->cr_msg ),
602 "suffix \"%s\" must be within the database naming context",
604 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
610 ber_str2bv( argv[ 2 ], 0, 0, &dn );
611 if ( dnPrettyNormal( NULL, &dn, &prnc, &nrnc, NULL ) != LDAP_SUCCESS ) {
612 snprintf( c->cr_msg, sizeof( c->cr_msg ),
613 "massaged suffix \"%s\" is invalid",
615 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
621 tmp_bd = select_backend( &nrnc, 0 );
622 if ( tmp_bd != NULL && tmp_bd->be_private == c->be->be_private ) {
623 Debug( LDAP_DEBUG_ANY,
624 "%s: warning: <massaged suffix> \"%s\" resolves to this database, in "
625 "\"suffixMassage <suffix> <massaged suffix>\"\n",
626 c->log, prnc.bv_val, 0 );
630 * The suffix massaging is emulated by means of the
631 * rewrite capabilities
633 rc = suffix_massage_config( mt->mt_rwmap.rwm_rw,
634 &pvnc, &nvnc, &prnc, &nrnc );
645 slap_bv_x_ordered_unparse( BerVarray in, BerVarray *out )
648 BerVarray bva = NULL;
652 assert( in != NULL );
654 for ( i = 0; !BER_BVISNULL( &in[i] ); i++ )
663 bva = ch_malloc( ( i + 1 ) * sizeof(struct berval) );
664 BER_BVZERO( &bva[ 0 ] );
666 for ( i = 0; !BER_BVISNULL( &in[i] ); i++ ) {
667 idx.bv_len = snprintf( idx.bv_val, sizeof( ibuf ), SLAP_X_ORDERED_FMT, i );
668 if ( idx.bv_len >= sizeof( ibuf ) ) {
669 ber_bvarray_free( bva );
673 bva[i].bv_len = idx.bv_len + in[i].bv_len;
674 bva[i].bv_val = ch_malloc( bva[i].bv_len + 1 );
675 ptr = lutil_strcopy( bva[i].bv_val, ibuf );
676 ptr = lutil_strcopy( ptr, in[i].bv_val );
678 BER_BVZERO( &bva[ i + 1 ] );
686 meta_subtree_free( metasubtree_t *ms )
688 switch ( ms->ms_type ) {
689 case META_ST_SUBTREE:
690 case META_ST_SUBORDINATE:
691 ber_memfree( ms->ms_dn.bv_val );
695 regfree( &ms->ms_regex );
696 ber_memfree( ms->ms_regex_pattern.bv_val );
708 meta_subtree_destroy( metasubtree_t *ms )
711 meta_subtree_destroy( ms->ms_next );
714 return meta_subtree_free( ms );
717 static struct berval st_styles[] = {
724 meta_subtree_unparse(
729 struct berval bv, *style;
731 if ( !mt->mt_subtree )
734 /* can only be one of exclude or include */
735 if (( c->type == LDAP_BACK_CFG_SUBTREE_EX ) ^ mt->mt_subtree_exclude )
738 bv.bv_val = c->cr_msg;
739 for ( ms=mt->mt_subtree; ms; ms=ms->ms_next ) {
740 if (ms->ms_type == META_ST_SUBTREE)
741 style = &st_styles[0];
742 else if ( ms->ms_type == META_ST_SUBORDINATE )
743 style = &st_styles[1];
744 else if ( ms->ms_type == META_ST_REGEX )
745 style = &st_styles[2];
750 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg),
751 "dn.%s:%s", style->bv_val, ms->ms_dn.bv_val );
752 value_add_one( &c->rvalue_vals, &bv );
762 meta_st_t type = META_ST_SUBTREE;
764 struct berval ndn = BER_BVNULL;
765 metasubtree_t *ms = NULL;
767 if ( c->type == LDAP_BACK_CFG_SUBTREE_EX ) {
768 if ( mt->mt_subtree && !mt->mt_subtree_exclude ) {
769 snprintf( c->cr_msg, sizeof(c->cr_msg),
770 "\"subtree-exclude\" incompatible with previous \"subtree-include\" directives" );
774 mt->mt_subtree_exclude = 1;
777 if ( mt->mt_subtree && mt->mt_subtree_exclude ) {
778 snprintf( c->cr_msg, sizeof(c->cr_msg),
779 "\"subtree-include\" incompatible with previous \"subtree-exclude\" directives" );
784 pattern = c->argv[1];
785 if ( strncasecmp( pattern, "dn", STRLENOF( "dn" ) ) == 0 ) {
788 pattern = &pattern[STRLENOF( "dn")];
790 if ( pattern[0] == '.' ) {
793 if ( strncasecmp( style, "subtree", STRLENOF( "subtree" ) ) == 0 ) {
794 type = META_ST_SUBTREE;
795 pattern = &style[STRLENOF( "subtree" )];
797 } else if ( strncasecmp( style, "children", STRLENOF( "children" ) ) == 0 ) {
798 type = META_ST_SUBORDINATE;
799 pattern = &style[STRLENOF( "children" )];
801 } else if ( strncasecmp( style, "sub", STRLENOF( "sub" ) ) == 0 ) {
802 type = META_ST_SUBTREE;
803 pattern = &style[STRLENOF( "sub" )];
805 } else if ( strncasecmp( style, "regex", STRLENOF( "regex" ) ) == 0 ) {
806 type = META_ST_REGEX;
807 pattern = &style[STRLENOF( "regex" )];
810 snprintf( c->cr_msg, sizeof(c->cr_msg), "unknown style in \"dn.<style>\"" );
815 if ( pattern[0] != ':' ) {
816 snprintf( c->cr_msg, sizeof(c->cr_msg), "missing colon after \"dn.<style>\"" );
823 case META_ST_SUBTREE:
824 case META_ST_SUBORDINATE: {
827 ber_str2bv( pattern, 0, 0, &dn );
828 if ( dnNormalize( 0, NULL, NULL, &dn, &ndn, NULL )
831 snprintf( c->cr_msg, sizeof(c->cr_msg), "DN=\"%s\" is invalid", pattern );
835 if ( !dnIsSuffix( &ndn, &mt->mt_nsuffix ) ) {
836 snprintf( c->cr_msg, sizeof(c->cr_msg),
837 "DN=\"%s\" is not a subtree of target \"%s\"",
838 pattern, mt->mt_nsuffix.bv_val );
839 ber_memfree( ndn.bv_val );
845 /* silence warnings */
849 ms = ch_calloc( sizeof( metasubtree_t ), 1 );
852 switch ( ms->ms_type ) {
853 case META_ST_SUBTREE:
854 case META_ST_SUBORDINATE:
858 case META_ST_REGEX: {
861 rc = regcomp( &ms->ms_regex, pattern, REG_EXTENDED|REG_ICASE );
863 char regerr[ SLAP_TEXT_BUFLEN ];
865 regerror( rc, &ms->ms_regex, regerr, sizeof(regerr) );
867 snprintf( c->cr_msg, sizeof( c->cr_msg ),
868 "regular expression \"%s\" bad because of %s",
873 ber_str2bv( pattern, 0, 1, &ms->ms_regex_pattern );
877 if ( mt->mt_subtree == NULL ) {
883 for ( msp = &mt->mt_subtree; *msp; ) {
884 switch ( ms->ms_type ) {
885 case META_ST_SUBTREE:
886 switch ( (*msp)->ms_type ) {
887 case META_ST_SUBTREE:
888 if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
889 metasubtree_t *tmp = *msp;
890 Debug( LDAP_DEBUG_CONFIG,
891 "%s: previous rule \"dn.subtree:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
892 c->log, pattern, (*msp)->ms_dn.bv_val );
893 *msp = (*msp)->ms_next;
895 meta_subtree_destroy( tmp );
898 } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) ) {
899 Debug( LDAP_DEBUG_CONFIG,
900 "%s: previous rule \"dn.subtree:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
901 c->log, (*msp)->ms_dn.bv_val, pattern );
902 meta_subtree_destroy( ms );
908 case META_ST_SUBORDINATE:
909 if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
910 metasubtree_t *tmp = *msp;
911 Debug( LDAP_DEBUG_CONFIG,
912 "%s: previous rule \"dn.children:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
913 c->log, pattern, (*msp)->ms_dn.bv_val );
914 *msp = (*msp)->ms_next;
916 meta_subtree_destroy( tmp );
919 } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) && ms->ms_dn.bv_len > (*msp)->ms_dn.bv_len ) {
920 Debug( LDAP_DEBUG_CONFIG,
921 "%s: previous rule \"dn.children:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
922 c->log, (*msp)->ms_dn.bv_val, pattern );
923 meta_subtree_destroy( ms );
930 if ( regexec( &(*msp)->ms_regex, ms->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
931 Debug( LDAP_DEBUG_CONFIG,
932 "%s: previous rule \"dn.regex:%s\" may contain rule \"dn.subtree:%s\"\n",
933 c->log, (*msp)->ms_regex_pattern.bv_val, ms->ms_dn.bv_val );
939 case META_ST_SUBORDINATE:
940 switch ( (*msp)->ms_type ) {
941 case META_ST_SUBTREE:
942 if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
943 metasubtree_t *tmp = *msp;
944 Debug( LDAP_DEBUG_CONFIG,
945 "%s: previous rule \"dn.children:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
946 c->log, pattern, (*msp)->ms_dn.bv_val );
947 *msp = (*msp)->ms_next;
949 meta_subtree_destroy( tmp );
952 } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) && ms->ms_dn.bv_len > (*msp)->ms_dn.bv_len ) {
953 Debug( LDAP_DEBUG_CONFIG,
954 "%s: previous rule \"dn.children:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
955 c->log, (*msp)->ms_dn.bv_val, pattern );
956 meta_subtree_destroy( ms );
962 case META_ST_SUBORDINATE:
963 if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
964 metasubtree_t *tmp = *msp;
965 Debug( LDAP_DEBUG_CONFIG,
966 "%s: previous rule \"dn.children:%s\" is contained in rule \"dn.children:%s\" (replaced)\n",
967 c->log, pattern, (*msp)->ms_dn.bv_val );
968 *msp = (*msp)->ms_next;
970 meta_subtree_destroy( tmp );
973 } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) ) {
974 Debug( LDAP_DEBUG_CONFIG,
975 "%s: previous rule \"dn.children:%s\" contains rule \"dn.children:%s\" (ignored)\n",
976 c->log, (*msp)->ms_dn.bv_val, pattern );
977 meta_subtree_destroy( ms );
984 if ( regexec( &(*msp)->ms_regex, ms->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
985 Debug( LDAP_DEBUG_CONFIG,
986 "%s: previous rule \"dn.regex:%s\" may contain rule \"dn.subtree:%s\"\n",
987 c->log, (*msp)->ms_regex_pattern.bv_val, ms->ms_dn.bv_val );
994 switch ( (*msp)->ms_type ) {
995 case META_ST_SUBTREE:
996 case META_ST_SUBORDINATE:
997 if ( regexec( &ms->ms_regex, (*msp)->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
998 Debug( LDAP_DEBUG_CONFIG,
999 "%s: previous rule \"dn.subtree:%s\" may be contained in rule \"dn.regex:%s\"\n",
1000 c->log, (*msp)->ms_dn.bv_val, ms->ms_regex_pattern.bv_val );
1005 /* no check possible */
1011 msp = &(*msp)->ms_next;
1020 static slap_verbmasks idassert_mode[] = {
1021 { BER_BVC("self"), LDAP_BACK_IDASSERT_SELF },
1022 { BER_BVC("anonymous"), LDAP_BACK_IDASSERT_ANONYMOUS },
1023 { BER_BVC("none"), LDAP_BACK_IDASSERT_NOASSERT },
1024 { BER_BVC("legacy"), LDAP_BACK_IDASSERT_LEGACY },
1028 static slap_verbmasks tls_mode[] = {
1029 { BER_BVC( "propagate" ), LDAP_BACK_F_TLS_PROPAGATE_MASK },
1030 { BER_BVC( "try-propagate" ), LDAP_BACK_F_PROPAGATE_TLS },
1031 { BER_BVC( "start" ), LDAP_BACK_F_TLS_USE_MASK },
1032 { BER_BVC( "try-start" ), LDAP_BACK_F_USE_TLS },
1033 { BER_BVC( "ldaps" ), LDAP_BACK_F_TLS_LDAPS },
1034 { BER_BVC( "none" ), LDAP_BACK_F_NONE },
1038 static slap_verbmasks t_f_mode[] = {
1039 { BER_BVC( "yes" ), LDAP_BACK_F_T_F },
1040 { BER_BVC( "discover" ), LDAP_BACK_F_T_F_DISCOVER },
1041 { BER_BVC( "no" ), LDAP_BACK_F_NONE },
1045 static slap_verbmasks cancel_mode[] = {
1046 { BER_BVC( "ignore" ), LDAP_BACK_F_CANCEL_IGNORE },
1047 { BER_BVC( "exop" ), LDAP_BACK_F_CANCEL_EXOP },
1048 { BER_BVC( "exop-discover" ), LDAP_BACK_F_CANCEL_EXOP_DISCOVER },
1049 { BER_BVC( "abandon" ), LDAP_BACK_F_CANCEL_ABANDON },
1053 static slap_verbmasks onerr_mode[] = {
1054 { BER_BVC( "stop" ), META_BACK_F_ONERR_STOP },
1055 { BER_BVC( "report" ), META_BACK_F_ONERR_REPORT },
1056 { BER_BVC( "continue" ), LDAP_BACK_F_NONE },
1060 /* see enum in slap.h */
1061 static slap_cf_aux_table timeout_table[] = {
1062 { BER_BVC("bind="), SLAP_OP_BIND * sizeof( time_t ), 'u', 0, NULL },
1063 /* unbind makes no sense */
1064 { BER_BVC("add="), SLAP_OP_ADD * sizeof( time_t ), 'u', 0, NULL },
1065 { BER_BVC("delete="), SLAP_OP_DELETE * sizeof( time_t ), 'u', 0, NULL },
1066 { BER_BVC("modrdn="), SLAP_OP_MODRDN * sizeof( time_t ), 'u', 0, NULL },
1067 { BER_BVC("modify="), SLAP_OP_MODIFY * sizeof( time_t ), 'u', 0, NULL },
1068 { BER_BVC("compare="), SLAP_OP_COMPARE * sizeof( time_t ), 'u', 0, NULL },
1069 { BER_BVC("search="), SLAP_OP_SEARCH * sizeof( time_t ), 'u', 0, NULL },
1070 /* abandon makes little sense */
1071 #if 0 /* not implemented yet */
1072 { BER_BVC("extended="), SLAP_OP_EXTENDED * sizeof( time_t ), 'u', 0, NULL },
1074 { BER_BVNULL, 0, 0, 0, NULL }
1078 meta_back_cf_gen( ConfigArgs *c )
1080 metainfo_t *mi = ( metainfo_t * )c->be->be_private;
1086 assert( mi != NULL );
1088 if ( c->op == SLAP_CONFIG_EMIT ) {
1089 struct berval bv = BER_BVNULL;
1094 if ( c->table == Cft_Database ) {
1104 case LDAP_BACK_CFG_CONN_TTL:
1105 if ( mi->mi_conn_ttl == 0 ) {
1108 char buf[ SLAP_TEXT_BUFLEN ];
1110 lutil_unparse_time( buf, sizeof( buf ), mi->mi_conn_ttl );
1111 ber_str2bv( buf, 0, 0, &bv );
1112 value_add_one( &c->rvalue_vals, &bv );
1116 case LDAP_BACK_CFG_DNCACHE_TTL:
1117 if ( mi->mi_cache.ttl == META_DNCACHE_DISABLED ) {
1119 } else if ( mi->mi_cache.ttl == META_DNCACHE_FOREVER ) {
1120 BER_BVSTR( &bv, "forever" );
1122 char buf[ SLAP_TEXT_BUFLEN ];
1124 lutil_unparse_time( buf, sizeof( buf ), mi->mi_cache.ttl );
1125 ber_str2bv( buf, 0, 0, &bv );
1127 value_add_one( &c->rvalue_vals, &bv );
1130 case LDAP_BACK_CFG_IDLE_TIMEOUT:
1131 if ( mi->mi_idle_timeout == 0 ) {
1134 char buf[ SLAP_TEXT_BUFLEN ];
1136 lutil_unparse_time( buf, sizeof( buf ), mi->mi_idle_timeout );
1137 ber_str2bv( buf, 0, 0, &bv );
1138 value_add_one( &c->rvalue_vals, &bv );
1142 case LDAP_BACK_CFG_ONERR:
1143 enum_to_verb( onerr_mode, mi->mi_flags & META_BACK_F_ONERR_MASK, &bv );
1144 if ( BER_BVISNULL( &bv )) {
1147 value_add_one( &c->rvalue_vals, &bv );
1151 case LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER:
1152 c->value_int = META_BACK_DEFER_ROOTDN_BIND( mi );
1155 case LDAP_BACK_CFG_SINGLECONN:
1156 c->value_int = LDAP_BACK_SINGLECONN( mi );
1159 case LDAP_BACK_CFG_USETEMP:
1160 c->value_int = LDAP_BACK_USE_TEMPORARIES( mi );
1163 case LDAP_BACK_CFG_CONNPOOLMAX:
1164 c->value_int = mi->mi_conn_priv_max;
1168 case LDAP_BACK_CFG_BIND_TIMEOUT:
1169 if ( mc->mc_bind_timeout.tv_sec == 0 &&
1170 mc->mc_bind_timeout.tv_usec == 0 ) {
1173 c->value_ulong = mc->mc_bind_timeout.tv_sec * 1000000UL +
1174 mc->mc_bind_timeout.tv_usec;
1178 case LDAP_BACK_CFG_CANCEL: {
1179 slap_mask_t mask = LDAP_BACK_F_CANCEL_MASK2;
1181 if ( mt && META_BACK_TGT_CANCEL_DISCOVER( mt ) ) {
1182 mask &= ~LDAP_BACK_F_CANCEL_EXOP;
1184 enum_to_verb( cancel_mode, (mc->mc_flags & mask), &bv );
1185 if ( BER_BVISNULL( &bv ) ) {
1186 /* there's something wrong... */
1191 value_add_one( &c->rvalue_vals, &bv );
1195 case LDAP_BACK_CFG_CHASE:
1196 c->value_int = META_BACK_CMN_CHASE_REFERRALS(mc);
1199 #ifdef SLAPD_META_CLIENT_PR
1200 case LDAP_BACK_CFG_CLIENT_PR:
1201 if ( mc->mc_ps == META_CLIENT_PR_DISABLE ) {
1203 } else if ( mc->mc_ps == META_CLIENT_PR_ACCEPT_UNSOLICITED ) {
1204 BER_BVSTR( &bv, "accept-unsolicited" );
1206 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d", mc->mc_ps );
1207 bv.bv_val = c->cr_msg;
1209 value_add_one( &c->rvalue_vals, &bv );
1211 #endif /* SLAPD_META_CLIENT_PR */
1213 case LDAP_BACK_CFG_DEFAULT_T:
1214 if ( mt || mi->mi_defaulttarget == META_DEFAULT_TARGET_NONE )
1216 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d", mi->mi_defaulttarget );
1217 bv.bv_val = c->cr_msg;
1218 value_add_one( &c->rvalue_vals, &bv );
1221 case LDAP_BACK_CFG_NETWORK_TIMEOUT:
1222 if ( mc->mc_network_timeout == 0 ) {
1225 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%ld",
1226 mc->mc_network_timeout );
1227 bv.bv_val = c->cr_msg;
1228 value_add_one( &c->rvalue_vals, &bv );
1231 case LDAP_BACK_CFG_NOREFS:
1232 c->value_int = META_BACK_CMN_NOREFS(mc);
1235 case LDAP_BACK_CFG_NOUNDEFFILTER:
1236 c->value_int = META_BACK_CMN_NOUNDEFFILTER(mc);
1239 case LDAP_BACK_CFG_NRETRIES:
1240 if ( mc->mc_nretries == META_RETRY_FOREVER ) {
1241 BER_BVSTR( &bv, "forever" );
1242 } else if ( mc->mc_nretries == META_RETRY_NEVER ) {
1243 BER_BVSTR( &bv, "never" );
1245 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d",
1247 bv.bv_val = c->cr_msg;
1249 value_add_one( &c->rvalue_vals, &bv );
1252 case LDAP_BACK_CFG_QUARANTINE:
1253 if ( !META_BACK_CMN_QUARANTINE( mc )) {
1257 rc = mi->mi_ldap_extra->retry_info_unparse( &mc->mc_quarantine, &bv );
1259 ber_bvarray_add( &c->rvalue_vals, &bv );
1263 case LDAP_BACK_CFG_REBIND:
1264 c->value_int = META_BACK_CMN_SAVECRED(mc);
1267 case LDAP_BACK_CFG_TIMEOUT:
1268 for ( i = 0; i < SLAP_OP_LAST; i++ ) {
1269 if ( mc->mc_timeout[ i ] != 0 ) {
1274 if ( i == SLAP_OP_LAST ) {
1279 slap_cf_aux_table_unparse( mc->mc_timeout, &bv, timeout_table );
1281 if ( BER_BVISNULL( &bv ) ) {
1285 for ( i = 0; isspace( (unsigned char) bv.bv_val[ i ] ); i++ )
1286 /* count spaces */ ;
1290 AC_MEMCPY( bv.bv_val, &bv.bv_val[ i ],
1294 ber_bvarray_add( &c->rvalue_vals, &bv );
1297 case LDAP_BACK_CFG_VERSION:
1298 if ( mc->mc_version == 0 )
1300 c->value_int = mc->mc_version;
1303 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
1304 case LDAP_BACK_CFG_ST_REQUEST:
1305 c->value_int = META_BACK_CMN_ST_REQUEST( mc );
1307 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
1309 case LDAP_BACK_CFG_T_F:
1310 enum_to_verb( t_f_mode, (mc->mc_flags & LDAP_BACK_F_T_F_MASK2), &bv );
1311 if ( BER_BVISNULL( &bv ) ) {
1312 /* there's something wrong... */
1317 value_add_one( &c->rvalue_vals, &bv );
1321 case LDAP_BACK_CFG_TLS: {
1322 struct berval bc = BER_BVNULL, bv2;
1324 if (( mc->mc_flags & LDAP_BACK_F_TLS_MASK ) == LDAP_BACK_F_NONE ) {
1328 enum_to_verb( tls_mode, ( mc->mc_flags & LDAP_BACK_F_TLS_MASK ), &bv );
1329 assert( !BER_BVISNULL( &bv ) );
1332 bindconf_tls_unparse( &mt->mt_tls, &bc );
1335 if ( !BER_BVISEMPTY( &bc )) {
1336 bv2.bv_len = bv.bv_len + bc.bv_len + 1;
1337 bv2.bv_val = ch_malloc( bv2.bv_len + 1 );
1338 strcpy( bv2.bv_val, bv.bv_val );
1339 bv2.bv_val[bv.bv_len] = ' ';
1340 strcpy( &bv2.bv_val[bv.bv_len + 1], bc.bv_val );
1341 ber_memfree( bc.bv_val );
1342 ber_bvarray_add( &c->rvalue_vals, &bv2 );
1344 value_add_one( &c->rvalue_vals, &bv );
1349 case LDAP_BACK_CFG_URI: {
1350 char *p2, *p1 = strchr( mt->mt_uri, ' ' );
1351 bv.bv_len = strlen( mt->mt_uri ) + 1 + mt->mt_psuffix.bv_len;
1352 bv.bv_val = ch_malloc( bv.bv_len + 1 );
1354 p2 = lutil_strncopy( bv.bv_val, mt->mt_uri, p1 - mt->mt_uri );
1356 p2 = lutil_strcopy( bv.bv_val, mt->mt_uri );
1359 p2 = lutil_strcopy( p2, mt->mt_psuffix.bv_val );
1363 value_add_one( &c->rvalue_vals, &bv );
1366 case LDAP_BACK_CFG_ACL_AUTHCDN:
1367 case LDAP_BACK_CFG_ACL_PASSWD:
1368 /* FIXME no point here, there is no code implementing
1369 * their features. Was this supposed to implement
1370 * acl-bind like back-ldap?
1375 case LDAP_BACK_CFG_IDASSERT_AUTHZFROM: {
1378 struct berval bv = BER_BVNULL;
1379 char buf[SLAP_TEXT_BUFLEN];
1381 bvp = &mt->mt_idassert_authz;
1382 if ( *bvp == NULL ) {
1383 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_AUTHZ_ALL )
1385 BER_BVSTR( &bv, "*" );
1386 value_add_one( &c->rvalue_vals, &bv );
1394 for ( i = 0; !BER_BVISNULL( &((*bvp)[ i ]) ); i++ ) {
1396 int len = snprintf( buf, sizeof( buf ), SLAP_X_ORDERED_FMT, i );
1397 bv.bv_len = ((*bvp)[ i ]).bv_len + len;
1398 bv.bv_val = ber_memrealloc( bv.bv_val, bv.bv_len + 1 );
1400 ptr = lutil_strcopy( ptr, buf );
1401 ptr = lutil_strncopy( ptr, ((*bvp)[ i ]).bv_val, ((*bvp)[ i ]).bv_len );
1402 value_add_one( &c->rvalue_vals, &bv );
1405 ber_memfree( bv.bv_val );
1410 case LDAP_BACK_CFG_IDASSERT_BIND: {
1412 struct berval bc = BER_BVNULL;
1415 if ( mt->mt_idassert_authmethod == LDAP_AUTH_NONE ) {
1420 switch ( mt->mt_idassert_mode ) {
1421 case LDAP_BACK_IDASSERT_OTHERID:
1422 case LDAP_BACK_IDASSERT_OTHERDN:
1426 struct berval mode = BER_BVNULL;
1428 enum_to_verb( idassert_mode, mt->mt_idassert_mode, &mode );
1429 if ( BER_BVISNULL( &mode ) ) {
1430 /* there's something wrong... */
1435 bv.bv_len = STRLENOF( "mode=" ) + mode.bv_len;
1436 bv.bv_val = ch_malloc( bv.bv_len + 1 );
1438 ptr = lutil_strcopy( bv.bv_val, "mode=" );
1439 ptr = lutil_strcopy( ptr, mode.bv_val );
1445 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_NATIVE_AUTHZ ) {
1446 len = bv.bv_len + STRLENOF( "authz=native" );
1448 if ( !BER_BVISEMPTY( &bv ) ) {
1449 len += STRLENOF( " " );
1452 bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
1454 ptr = &bv.bv_val[ bv.bv_len ];
1456 if ( !BER_BVISEMPTY( &bv ) ) {
1457 ptr = lutil_strcopy( ptr, " " );
1460 (void)lutil_strcopy( ptr, "authz=native" );
1463 len = bv.bv_len + STRLENOF( "flags=non-prescriptive,override,obsolete-encoding-workaround,proxy-authz-non-critical,dn-authzid" );
1465 if ( !BER_BVISEMPTY( &bv ) ) {
1466 len += STRLENOF( " " );
1469 bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
1471 ptr = &bv.bv_val[ bv.bv_len ];
1473 if ( !BER_BVISEMPTY( &bv ) ) {
1474 ptr = lutil_strcopy( ptr, " " );
1477 ptr = lutil_strcopy( ptr, "flags=" );
1479 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_PRESCRIPTIVE ) {
1480 ptr = lutil_strcopy( ptr, "prescriptive" );
1482 ptr = lutil_strcopy( ptr, "non-prescriptive" );
1485 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OVERRIDE ) {
1486 ptr = lutil_strcopy( ptr, ",override" );
1489 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_PROXY_AUTHZ ) {
1490 ptr = lutil_strcopy( ptr, ",obsolete-proxy-authz" );
1492 } else if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_ENCODING_WORKAROUND ) {
1493 ptr = lutil_strcopy( ptr, ",obsolete-encoding-workaround" );
1496 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_PROXYAUTHZ_CRITICAL ) {
1497 ptr = lutil_strcopy( ptr, ",proxy-authz-critical" );
1500 ptr = lutil_strcopy( ptr, ",proxy-authz-non-critical" );
1503 switch ( mt->mt_idassert_flags & LDAP_BACK_AUTH_DN_MASK ) {
1504 case LDAP_BACK_AUTH_DN_AUTHZID:
1505 ptr = lutil_strcopy( ptr, ",dn-authzid" );
1508 case LDAP_BACK_AUTH_DN_WHOAMI:
1509 ptr = lutil_strcopy( ptr, ",dn-whoami" );
1513 #if 0 /* implicit */
1514 ptr = lutil_strcopy( ptr, ",dn-none" );
1519 bv.bv_len = ( ptr - bv.bv_val );
1523 bindconf_unparse( &mt->mt_idassert.si_bc, &bc );
1525 if ( !BER_BVISNULL( &bv ) ) {
1526 ber_len_t len = bv.bv_len + bc.bv_len;
1528 bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
1530 assert( bc.bv_val[ 0 ] == ' ' );
1532 ptr = lutil_strcopy( &bv.bv_val[ bv.bv_len ], bc.bv_val );
1534 bv.bv_len = ptr - bv.bv_val;
1537 for ( i = 0; isspace( (unsigned char) bc.bv_val[ i ] ); i++ )
1538 /* count spaces */ ;
1542 AC_MEMCPY( bc.bv_val, &bc.bv_val[ i ], bc.bv_len + 1 );
1548 ber_bvarray_add( &c->rvalue_vals, &bv );
1553 case LDAP_BACK_CFG_SUFFIXM: /* unused */
1554 case LDAP_BACK_CFG_REWRITE:
1555 if ( mt->mt_rwmap.rwm_bva_rewrite == NULL ) {
1558 rc = slap_bv_x_ordered_unparse( mt->mt_rwmap.rwm_bva_rewrite, &c->rvalue_vals );
1562 case LDAP_BACK_CFG_MAP:
1563 if ( mt->mt_rwmap.rwm_bva_map == NULL ) {
1566 rc = slap_bv_x_ordered_unparse( mt->mt_rwmap.rwm_bva_map, &c->rvalue_vals );
1570 case LDAP_BACK_CFG_SUBTREE_EX:
1571 case LDAP_BACK_CFG_SUBTREE_IN:
1572 rc = meta_subtree_unparse( c, mt );
1575 /* replaced by idassert */
1576 case LDAP_BACK_CFG_PSEUDOROOTDN:
1577 case LDAP_BACK_CFG_PSEUDOROOTPW:
1585 } else if ( c->op == LDAP_MOD_DELETE ) {
1588 case LDAP_BACK_CFG_CONN_TTL:
1589 mi->mi_conn_ttl = 0;
1592 case LDAP_BACK_CFG_DNCACHE_TTL:
1593 mi->mi_cache.ttl = META_DNCACHE_DISABLED;
1596 case LDAP_BACK_CFG_IDLE_TIMEOUT:
1597 mi->mi_idle_timeout = 0;
1600 case LDAP_BACK_CFG_ONERR:
1601 mi->mi_flags &= ~META_BACK_F_ONERR_MASK;
1604 case LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER:
1605 mi->mi_flags &= ~META_BACK_F_DEFER_ROOTDN_BIND;
1608 case LDAP_BACK_CFG_SINGLECONN:
1609 mi->mi_flags &= ~LDAP_BACK_F_SINGLECONN;
1612 case LDAP_BACK_CFG_USETEMP:
1613 mi->mi_flags &= ~LDAP_BACK_F_USE_TEMPORARIES;
1616 case LDAP_BACK_CFG_CONNPOOLMAX:
1617 mi->mi_conn_priv_max = LDAP_BACK_CONN_PRIV_MIN;
1621 case LDAP_BACK_CFG_BIND_TIMEOUT:
1622 mc->mc_bind_timeout.tv_sec = 0;
1623 mc->mc_bind_timeout.tv_usec = 0;
1626 case LDAP_BACK_CFG_CANCEL:
1627 mc->mc_flags &= ~LDAP_BACK_F_CANCEL_MASK2;
1630 case LDAP_BACK_CFG_CHASE:
1631 mc->mc_flags &= ~LDAP_BACK_F_CHASE_REFERRALS;
1634 #ifdef SLAPD_META_CLIENT_PR
1635 case LDAP_BACK_CFG_CLIENT_PR:
1636 mc->mc_ps == META_CLIENT_PR_DISABLE;
1638 #endif /* SLAPD_META_CLIENT_PR */
1640 case LDAP_BACK_CFG_DEFAULT_T:
1641 mi->mi_defaulttarget = META_DEFAULT_TARGET_NONE;
1644 case LDAP_BACK_CFG_NETWORK_TIMEOUT:
1645 mc->mc_network_timeout = 0;
1648 case LDAP_BACK_CFG_NOREFS:
1649 mc->mc_flags &= ~LDAP_BACK_F_NOREFS;
1652 case LDAP_BACK_CFG_NOUNDEFFILTER:
1653 mc->mc_flags &= ~LDAP_BACK_F_NOUNDEFFILTER;
1656 case LDAP_BACK_CFG_NRETRIES:
1657 mc->mc_nretries == META_RETRY_DEFAULT;
1660 case LDAP_BACK_CFG_QUARANTINE:
1661 if ( META_BACK_CMN_QUARANTINE( mc )) {
1662 mi->mi_ldap_extra->retry_info_destroy( &mc->mc_quarantine );
1663 mc->mc_flags &= ~LDAP_BACK_F_QUARANTINE;
1664 if ( mc == &mt->mt_mc ) {
1665 ldap_pvt_thread_mutex_destroy( &mt->mt_quarantine_mutex );
1666 mt->mt_isquarantined = 0;
1671 case LDAP_BACK_CFG_REBIND:
1672 mc->mc_flags &= ~LDAP_BACK_F_SAVECRED;
1675 case LDAP_BACK_CFG_TIMEOUT:
1676 for ( i = 0; i < SLAP_OP_LAST; i++ ) {
1677 mc->mc_timeout[ i ] = 0;
1681 case LDAP_BACK_CFG_VERSION:
1685 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
1686 case LDAP_BACK_CFG_ST_REQUEST:
1687 mc->mc_flags &= ~LDAP_BACK_F_ST_REQUEST;
1689 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
1691 case LDAP_BACK_CFG_T_F:
1692 mc->mc_flags &= ~LDAP_BACK_F_T_F_MASK2;
1695 case LDAP_BACK_CFG_TLS:
1696 mc->mc_flags &= ~LDAP_BACK_F_TLS_MASK;
1698 bindconf_free( &mt->mt_tls );
1702 case LDAP_BACK_CFG_URI:
1704 ch_free( mt->mt_uri );
1707 /* FIXME: should have a way to close all cached
1708 * connections associated with this target.
1712 case LDAP_BACK_CFG_IDASSERT_AUTHZFROM: {
1715 bvp = &mt->mt_idassert_authz; break;
1716 if ( c->valx < 0 ) {
1717 if ( *bvp != NULL ) {
1718 ber_bvarray_free( *bvp );
1723 if ( *bvp == NULL ) {
1728 for ( i = 0; !BER_BVISNULL( &((*bvp)[ i ]) ); i++ )
1731 if ( i >= c->valx ) {
1735 ber_memfree( ((*bvp)[ c->valx ]).bv_val );
1736 for ( i = c->valx; !BER_BVISNULL( &((*bvp)[ i + 1 ]) ); i++ ) {
1737 (*bvp)[ i ] = (*bvp)[ i + 1 ];
1739 BER_BVZERO( &((*bvp)[ i ]) );
1743 case LDAP_BACK_CFG_IDASSERT_BIND:
1744 bindconf_free( &mt->mt_idassert.si_bc );
1745 memset( &mt->mt_idassert, 0, sizeof( slap_idassert_t ) );
1748 case LDAP_BACK_CFG_SUFFIXM: /* unused */
1749 case LDAP_BACK_CFG_REWRITE:
1750 if ( mt->mt_rwmap.rwm_bva_rewrite ) {
1751 ber_bvarray_free( mt->mt_rwmap.rwm_bva_rewrite );
1752 mt->mt_rwmap.rwm_bva_rewrite = NULL;
1754 if ( mt->mt_rwmap.rwm_rw )
1755 rewrite_info_delete( &mt->mt_rwmap.rwm_rw );
1758 case LDAP_BACK_CFG_MAP:
1759 if ( mt->mt_rwmap.rwm_bva_map ) {
1760 ber_bvarray_free( mt->mt_rwmap.rwm_bva_map );
1761 mt->mt_rwmap.rwm_bva_map = NULL;
1763 meta_back_map_free( &mt->mt_rwmap.rwm_oc );
1764 meta_back_map_free( &mt->mt_rwmap.rwm_at );
1765 mt->mt_rwmap.rwm_oc.drop_missing = 0;
1766 mt->mt_rwmap.rwm_at.drop_missing = 0;
1769 case LDAP_BACK_CFG_SUBTREE_EX:
1770 case LDAP_BACK_CFG_SUBTREE_IN:
1771 /* can only be one of exclude or include */
1772 if (( c->type == LDAP_BACK_CFG_SUBTREE_EX ) ^ mt->mt_subtree_exclude ) {
1776 if ( c->valx < 0 ) {
1777 meta_subtree_destroy( mt->mt_subtree );
1778 mt->mt_subtree = NULL;
1780 metasubtree_t *ms, **mprev;
1781 for (i=0, mprev = &mt->mt_subtree, ms = *mprev; ms; ms = *mprev) {
1782 if ( i == c->valx ) {
1783 *mprev = ms->ms_next;
1784 meta_subtree_free( ms );
1788 mprev = &ms->ms_next;
1803 if ( c->op == SLAP_CONFIG_ADD ) {
1804 if ( c->type >= LDAP_BACK_CFG_LAST_BASE ) {
1805 /* exclude CFG_URI from this check */
1806 if ( c->type > LDAP_BACK_CFG_LAST_BOTH ) {
1807 if ( !mi->mi_ntargets ) {
1808 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1809 "need \"uri\" directive first" );
1810 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1814 if ( mi->mi_ntargets ) {
1815 mt = mi->mi_targets[ mi->mi_ntargets-1 ];
1823 if ( c->table == Cft_Database ) {
1836 case LDAP_BACK_CFG_URI: {
1843 if ( c->be->be_nsuffix == NULL ) {
1844 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1845 "the suffix must be defined before any target" );
1846 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1850 i = mi->mi_ntargets++;
1852 mi->mi_targets = ( metatarget_t ** )ch_realloc( mi->mi_targets,
1853 sizeof( metatarget_t * ) * mi->mi_ntargets );
1854 if ( mi->mi_targets == NULL ) {
1855 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1856 "out of memory while storing server name"
1857 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1859 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1863 if ( meta_back_new_target( &mi->mi_targets[ i ] ) != 0 ) {
1864 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1865 "unable to init server"
1866 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1868 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1872 mt = mi->mi_targets[ i ];
1874 mt->mt_rebind_f = mi->mi_rebind_f;
1875 mt->mt_urllist_f = mi->mi_urllist_f;
1876 mt->mt_urllist_p = mt;
1878 if ( META_BACK_QUARANTINE( mi ) ) {
1879 ldap_pvt_thread_mutex_init( &mt->mt_quarantine_mutex );
1881 mt->mt_mc = mi->mi_mc;
1883 for ( j = 1; j < c->argc; j++ ) {
1884 char **tmpuris = ldap_str2charray( c->argv[ j ], "\t" );
1886 if ( tmpuris == NULL ) {
1887 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1888 "unable to parse URIs #%d"
1889 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1891 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1899 ldap_charray_merge( &uris, tmpuris );
1900 ldap_charray_free( tmpuris );
1904 for ( j = 0; uris[ j ] != NULL; j++ ) {
1905 char *tmpuri = NULL;
1908 * uri MUST be legal!
1910 if ( ldap_url_parselist_ext( &ludp, uris[ j ], "\t",
1911 LDAP_PVT_URL_PARSE_NONE ) != LDAP_SUCCESS
1912 || ludp->lud_next != NULL )
1914 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1915 "unable to parse URI #%d"
1916 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1918 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1919 ldap_charray_free( uris );
1926 * uri MUST have the <dn> part!
1928 if ( ludp->lud_dn == NULL ) {
1929 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1930 "missing <naming context> "
1931 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1933 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1934 ldap_free_urllist( ludp );
1935 ldap_charray_free( uris );
1940 * copies and stores uri and suffix
1942 ber_str2bv( ludp->lud_dn, 0, 0, &dn );
1943 rc = dnPrettyNormal( NULL, &dn, &mt->mt_psuffix,
1944 &mt->mt_nsuffix, NULL );
1945 if ( rc != LDAP_SUCCESS ) {
1946 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1947 "target DN is invalid \"%s\"",
1949 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1950 ldap_free_urllist( ludp );
1951 ldap_charray_free( uris );
1955 ludp->lud_dn[ 0 ] = '\0';
1957 switch ( ludp->lud_scope ) {
1958 case LDAP_SCOPE_DEFAULT:
1959 mt->mt_scope = LDAP_SCOPE_SUBTREE;
1962 case LDAP_SCOPE_SUBTREE:
1963 case LDAP_SCOPE_SUBORDINATE:
1964 mt->mt_scope = ludp->lud_scope;
1968 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1969 "invalid scope for target \"%s\"",
1971 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1972 ldap_free_urllist( ludp );
1973 ldap_charray_free( uris );
1978 /* check all, to apply the scope check on the first one */
1979 if ( ludp->lud_dn != NULL && ludp->lud_dn[ 0 ] != '\0' ) {
1980 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1981 "multiple URIs must have no DN part" );
1982 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1983 ldap_free_urllist( ludp );
1984 ldap_charray_free( uris );
1990 tmpuri = ldap_url_list2urls( ludp );
1991 ldap_free_urllist( ludp );
1992 if ( tmpuri == NULL ) {
1993 snprintf( c->cr_msg, sizeof( c->cr_msg ), "no memory?" );
1994 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1995 ldap_charray_free( uris );
1998 ldap_memfree( uris[ j ] );
2002 mt->mt_uri = ldap_charray2str( uris, " " );
2003 ldap_charray_free( uris );
2004 if ( mt->mt_uri == NULL) {
2005 snprintf( c->cr_msg, sizeof( c->cr_msg ), "no memory?" );
2006 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2011 * uri MUST be a branch of suffix!
2013 for ( j = 0; !BER_BVISNULL( &c->be->be_nsuffix[ j ] ); j++ ) {
2014 if ( dnIsSuffix( &mt->mt_nsuffix, &c->be->be_nsuffix[ j ] ) ) {
2019 if ( BER_BVISNULL( &c->be->be_nsuffix[ j ] ) ) {
2020 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2021 "<naming context> of URI must be within the naming context of this database." );
2022 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2027 case LDAP_BACK_CFG_SUBTREE_EX:
2028 case LDAP_BACK_CFG_SUBTREE_IN:
2029 /* subtree-exclude */
2030 if ( meta_subtree_config( mt, c )) {
2031 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2036 case LDAP_BACK_CFG_DEFAULT_T:
2037 /* default target directive */
2038 i = mi->mi_ntargets - 1;
2040 if ( c->argc == 1 ) {
2042 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2043 "\"%s\" alone must be inside a \"uri\" directive",
2045 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2048 mi->mi_defaulttarget = i;
2051 if ( strcasecmp( c->argv[ 1 ], "none" ) == 0 ) {
2053 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2054 "\"%s none\" should go before uri definitions",
2056 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2058 mi->mi_defaulttarget = META_DEFAULT_TARGET_NONE;
2062 if ( lutil_atoi( &mi->mi_defaulttarget, c->argv[ 1 ] ) != 0
2063 || mi->mi_defaulttarget < 0
2064 || mi->mi_defaulttarget >= i - 1 )
2066 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2067 "illegal target number %d",
2068 mi->mi_defaulttarget );
2069 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2076 case LDAP_BACK_CFG_DNCACHE_TTL:
2077 /* ttl of dn cache */
2078 if ( strcasecmp( c->argv[ 1 ], "forever" ) == 0 ) {
2079 mi->mi_cache.ttl = META_DNCACHE_FOREVER;
2081 } else if ( strcasecmp( c->argv[ 1 ], "disabled" ) == 0 ) {
2082 mi->mi_cache.ttl = META_DNCACHE_DISABLED;
2087 if ( lutil_parse_time( c->argv[ 1 ], &t ) != 0 ) {
2088 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2089 "unable to parse dncache ttl \"%s\"",
2091 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2094 mi->mi_cache.ttl = (time_t)t;
2098 case LDAP_BACK_CFG_NETWORK_TIMEOUT: {
2099 /* network timeout when connecting to ldap servers */
2102 if ( lutil_parse_time( c->argv[ 1 ], &t ) ) {
2103 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2104 "unable to parse network timeout \"%s\"",
2106 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2109 mc->mc_network_timeout = (time_t)t;
2112 case LDAP_BACK_CFG_IDLE_TIMEOUT: {
2113 /* idle timeout when connecting to ldap servers */
2116 if ( lutil_parse_time( c->argv[ 1 ], &t ) ) {
2117 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2118 "unable to parse idle timeout \"%s\"",
2120 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2124 mi->mi_idle_timeout = (time_t)t;
2127 case LDAP_BACK_CFG_CONN_TTL: {
2131 if ( lutil_parse_time( c->argv[ 1 ], &t ) ) {
2132 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2133 "unable to parse conn ttl \"%s\"",
2135 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2139 mi->mi_conn_ttl = (time_t)t;
2142 case LDAP_BACK_CFG_BIND_TIMEOUT:
2143 /* bind timeout when connecting to ldap servers */
2144 mc->mc_bind_timeout.tv_sec = c->value_ulong/1000000;
2145 mc->mc_bind_timeout.tv_usec = c->value_ulong%1000000;
2148 case LDAP_BACK_CFG_ACL_AUTHCDN:
2149 /* name to use for meta_back_group */
2150 if ( strcasecmp( c->argv[ 0 ], "binddn" ) == 0 ) {
2151 Debug( LDAP_DEBUG_ANY, "%s: "
2152 "\"binddn\" statement is deprecated; "
2153 "use \"acl-authcDN\" instead\n",
2155 /* FIXME: some day we'll need to throw an error */
2158 ber_memfree_x( c->value_dn.bv_val, NULL );
2159 mt->mt_binddn = c->value_ndn;
2160 BER_BVZERO( &c->value_dn );
2161 BER_BVZERO( &c->value_ndn );
2164 case LDAP_BACK_CFG_ACL_PASSWD:
2165 /* password to use for meta_back_group */
2166 if ( strcasecmp( c->argv[ 0 ], "bindpw" ) == 0 ) {
2167 Debug( LDAP_DEBUG_ANY, "%s "
2168 "\"bindpw\" statement is deprecated; "
2169 "use \"acl-passwd\" instead\n",
2171 /* FIXME: some day we'll need to throw an error */
2174 ber_str2bv( c->argv[ 1 ], 0L, 1, &mt->mt_bindpw );
2177 case LDAP_BACK_CFG_REBIND:
2178 /* save bind creds for referral rebinds? */
2179 if ( c->argc == 1 || c->value_int ) {
2180 mc->mc_flags |= LDAP_BACK_F_SAVECRED;
2182 mc->mc_flags &= ~LDAP_BACK_F_SAVECRED;
2186 case LDAP_BACK_CFG_CHASE:
2187 if ( c->argc == 1 || c->value_int ) {
2188 mc->mc_flags |= LDAP_BACK_F_CHASE_REFERRALS;
2190 mc->mc_flags &= ~LDAP_BACK_F_CHASE_REFERRALS;
2194 case LDAP_BACK_CFG_TLS:
2195 i = verb_to_mask( c->argv[1], tls_mode );
2196 if ( BER_BVISNULL( &tls_mode[i].word ) ) {
2197 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2198 "%s unknown argument \"%s\"",
2199 c->argv[0], c->argv[1] );
2200 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2203 mc->mc_flags &= ~LDAP_BACK_F_TLS_MASK;
2204 mc->mc_flags |= tls_mode[i].mask;
2206 if ( c->argc > 2 ) {
2207 if ( c->op == SLAP_CONFIG_ADD && mi->mi_ntargets == 0 ) {
2208 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2209 "need \"uri\" directive first" );
2210 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2214 for ( i = 2; i < c->argc; i++ ) {
2215 if ( bindconf_tls_parse( c->argv[i], &mt->mt_tls ))
2218 bindconf_tls_defaults( &mt->mt_tls );
2222 case LDAP_BACK_CFG_T_F:
2223 i = verb_to_mask( c->argv[1], t_f_mode );
2224 if ( BER_BVISNULL( &t_f_mode[i].word ) ) {
2225 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2226 "%s unknown argument \"%s\"",
2227 c->argv[0], c->argv[1] );
2228 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2231 mc->mc_flags &= ~LDAP_BACK_F_T_F_MASK2;
2232 mc->mc_flags |= t_f_mode[i].mask;
2235 case LDAP_BACK_CFG_ONERR:
2237 i = verb_to_mask( c->argv[1], onerr_mode );
2238 if ( BER_BVISNULL( &onerr_mode[i].word ) ) {
2239 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2240 "%s unknown argument \"%s\"",
2241 c->argv[0], c->argv[1] );
2242 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2245 mi->mi_flags &= ~META_BACK_F_ONERR_MASK;
2246 mi->mi_flags |= onerr_mode[i].mask;
2249 case LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER:
2251 if ( c->argc == 1 || c->value_int ) {
2252 mi->mi_flags |= META_BACK_F_DEFER_ROOTDN_BIND;
2254 mi->mi_flags &= ~META_BACK_F_DEFER_ROOTDN_BIND;
2258 case LDAP_BACK_CFG_SINGLECONN:
2260 if ( mi->mi_ntargets > 0 ) {
2261 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2262 "\"%s\" must appear before target definitions",
2264 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2267 if ( c->value_int ) {
2268 mi->mi_flags |= LDAP_BACK_F_SINGLECONN;
2270 mi->mi_flags &= ~LDAP_BACK_F_SINGLECONN;
2274 case LDAP_BACK_CFG_USETEMP:
2275 /* use-temporaries? */
2276 if ( mi->mi_ntargets > 0 ) {
2277 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2278 "\"%s\" must appear before target definitions",
2280 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2283 if ( c->value_int ) {
2284 mi->mi_flags |= LDAP_BACK_F_USE_TEMPORARIES;
2286 mi->mi_flags &= ~LDAP_BACK_F_USE_TEMPORARIES;
2290 case LDAP_BACK_CFG_CONNPOOLMAX:
2291 /* privileged connections pool max size ? */
2292 if ( mi->mi_ntargets > 0 ) {
2293 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2294 "\"%s\" must appear before target definitions",
2296 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2300 if ( c->value_int < LDAP_BACK_CONN_PRIV_MIN
2301 || c->value_int > LDAP_BACK_CONN_PRIV_MAX )
2303 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2304 "invalid max size " "of privileged "
2305 "connections pool \"%s\" "
2306 "in \"conn-pool-max <n> "
2307 "(must be between %d and %d)\"",
2309 LDAP_BACK_CONN_PRIV_MIN,
2310 LDAP_BACK_CONN_PRIV_MAX );
2311 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2314 mi->mi_conn_priv_max = c->value_int;
2317 case LDAP_BACK_CFG_CANCEL:
2318 i = verb_to_mask( c->argv[1], cancel_mode );
2319 if ( BER_BVISNULL( &cancel_mode[i].word ) ) {
2320 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2321 "%s unknown argument \"%s\"",
2322 c->argv[0], c->argv[1] );
2323 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2326 mc->mc_flags &= ~LDAP_BACK_F_CANCEL_MASK2;
2327 mc->mc_flags |= t_f_mode[i].mask;
2330 case LDAP_BACK_CFG_TIMEOUT:
2331 for ( i = 1; i < c->argc; i++ ) {
2332 if ( isdigit( (unsigned char) c->argv[ i ][ 0 ] ) ) {
2336 if ( lutil_atoux( &u, c->argv[ i ], 0 ) != 0 ) {
2337 snprintf( c->cr_msg, sizeof( c->cr_msg),
2338 "unable to parse timeout \"%s\"",
2340 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2344 for ( j = 0; j < SLAP_OP_LAST; j++ ) {
2345 mc->mc_timeout[ j ] = u;
2351 if ( slap_cf_aux_table_parse( c->argv[ i ], mc->mc_timeout, timeout_table, "slapd-meta timeout" ) ) {
2352 snprintf( c->cr_msg, sizeof( c->cr_msg),
2353 "unable to parse timeout \"%s\"",
2355 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2361 case LDAP_BACK_CFG_PSEUDOROOTDN:
2362 /* name to use as pseudo-root dn */
2364 * exact replacement:
2367 idassert-bind bindmethod=simple
2368 binddn=<pseudorootdn>
2369 credentials=<pseudorootpw>
2371 flags=non-prescriptive
2372 idassert-authzFrom "dn:<rootdn>"
2374 * so that only when authc'd as <rootdn> the proxying occurs
2375 * rebinding as the <pseudorootdn> without proxyAuthz.
2378 Debug( LDAP_DEBUG_ANY,
2379 "%s: \"pseudorootdn\", \"pseudorootpw\" are no longer supported; "
2380 "use \"idassert-bind\" and \"idassert-authzFrom\" instead.\n",
2384 char binddn[ SLAP_TEXT_BUFLEN ];
2387 "bindmethod=simple",
2390 "flags=non-prescriptive",
2399 if ( BER_BVISNULL( &c->be->be_rootndn ) ) {
2400 Debug( LDAP_DEBUG_ANY, "%s: \"pseudorootpw\": \"rootdn\" must be defined first.\n",
2405 if ( sizeof( binddn ) <= (unsigned) snprintf( binddn,
2406 sizeof( binddn ), "binddn=%s", c->argv[ 1 ] ))
2408 Debug( LDAP_DEBUG_ANY, "%s: \"pseudorootdn\" too long.\n",
2412 cargv[ 2 ] = binddn;
2418 rc = mi->mi_ldap_extra->idassert_parse( c, &mt->mt_idassert );
2424 if ( mt->mt_idassert_authz != NULL ) {
2425 Debug( LDAP_DEBUG_ANY, "%s: \"idassert-authzFrom\" already defined (discarded).\n",
2427 ber_bvarray_free( mt->mt_idassert_authz );
2428 mt->mt_idassert_authz = NULL;
2431 assert( !BER_BVISNULL( &mt->mt_idassert_authcDN ) );
2433 bv.bv_len = STRLENOF( "dn:" ) + c->be->be_rootndn.bv_len;
2434 bv.bv_val = ber_memalloc( bv.bv_len + 1 );
2435 AC_MEMCPY( bv.bv_val, "dn:", STRLENOF( "dn:" ) );
2436 AC_MEMCPY( &bv.bv_val[ STRLENOF( "dn:" ) ], c->be->be_rootndn.bv_val, c->be->be_rootndn.bv_len + 1 );
2438 ber_bvarray_add( &mt->mt_idassert_authz, &bv );
2445 case LDAP_BACK_CFG_PSEUDOROOTPW:
2446 /* password to use as pseudo-root */
2447 Debug( LDAP_DEBUG_ANY,
2448 "%s: \"pseudorootdn\", \"pseudorootpw\" are no longer supported; "
2449 "use \"idassert-bind\" and \"idassert-authzFrom\" instead.\n",
2452 if ( BER_BVISNULL( &mt->mt_idassert_authcDN ) ) {
2453 Debug( LDAP_DEBUG_ANY, "%s: \"pseudorootpw\": \"pseudorootdn\" must be defined first.\n",
2458 if ( !BER_BVISNULL( &mt->mt_idassert_passwd ) ) {
2459 memset( mt->mt_idassert_passwd.bv_val, 0,
2460 mt->mt_idassert_passwd.bv_len );
2461 ber_memfree( mt->mt_idassert_passwd.bv_val );
2463 ber_str2bv( c->argv[ 1 ], 0, 1, &mt->mt_idassert_passwd );
2466 case LDAP_BACK_CFG_IDASSERT_BIND:
2468 rc = mi->mi_ldap_extra->idassert_parse( c, &mt->mt_idassert );
2471 case LDAP_BACK_CFG_IDASSERT_AUTHZFROM:
2472 /* idassert-authzFrom */
2473 rc = mi->mi_ldap_extra->idassert_authzfrom_parse( c, &mt->mt_idassert );
2476 case LDAP_BACK_CFG_QUARANTINE:
2478 if ( META_BACK_CMN_QUARANTINE( mc ) )
2480 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2481 "quarantine already defined" );
2482 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2487 mc->mc_quarantine.ri_interval = NULL;
2488 mc->mc_quarantine.ri_num = NULL;
2489 if ( !META_BACK_QUARANTINE( mi ) ) {
2490 ldap_pvt_thread_mutex_init( &mt->mt_quarantine_mutex );
2494 if ( mi->mi_ldap_extra->retry_info_parse( c->argv[ 1 ], &mc->mc_quarantine, c->cr_msg, sizeof( c->cr_msg ) ) ) {
2495 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2499 mc->mc_flags |= LDAP_BACK_F_QUARANTINE;
2502 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
2503 case LDAP_BACK_CFG_ST_REQUEST:
2504 /* session tracking request */
2505 if ( c->value_int ) {
2506 mc->mc_flags |= LDAP_BACK_F_ST_REQUEST;
2508 mc->mc_flags &= ~LDAP_BACK_F_ST_REQUEST;
2511 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
2513 case LDAP_BACK_CFG_SUFFIXM: /* FALLTHRU */
2514 case LDAP_BACK_CFG_REWRITE: {
2515 /* rewrite stuff ... */
2516 ConfigArgs ca = { 0 };
2518 struct rewrite_info *rwi;
2519 int cnt = 0, argc, ix = c->valx;
2521 if ( mt->mt_rwmap.rwm_bva_rewrite ) {
2522 for ( ; !BER_BVISNULL( &mt->mt_rwmap.rwm_bva_rewrite[ cnt ] ); cnt++ )
2526 if ( ix >= cnt || ix < 0 ) {
2529 rwi = mt->mt_rwmap.rwm_rw;
2531 mt->mt_rwmap.rwm_rw = NULL;
2532 rc = meta_rwi_init( &mt->mt_rwmap.rwm_rw );
2534 /* re-parse all rewrite rules, up to the one
2535 * that needs to be added */
2536 ca.fname = c->fname;
2537 ca.lineno = c->lineno;
2538 for ( i = 0; i < ix; i++ ) {
2539 ca.line = mt->mt_rwmap.rwm_bva_rewrite[ i ].bv_val;
2541 config_fp_parse_line( &ca );
2543 if ( !strcasecmp( ca.argv[0], "suffixmassage" )) {
2544 rc = meta_suffixm_config( &ca, ca.argc, ca.argv, mt );
2546 rc = rewrite_parse( mt->mt_rwmap.rwm_rw,
2547 c->fname, c->lineno, ca.argc, ca.argv );
2551 ch_free( ca.tline );
2556 if ( c->op != SLAP_CONFIG_ADD ) {
2560 /* add the new rule */
2561 if ( !strcasecmp( argv[0], "suffixmassage" )) {
2562 rc = meta_suffixm_config( c, argc, argv, mt );
2564 rc = rewrite_parse( mt->mt_rwmap.rwm_rw,
2565 c->fname, c->lineno, argc, argv );
2569 rewrite_info_delete( &mt->mt_rwmap.rwm_rw );
2570 mt->mt_rwmap.rwm_rw = rwi;
2575 for ( ; i < cnt; i++ ) {
2576 ca.line = mt->mt_rwmap.rwm_bva_rewrite[ i ].bv_val;
2578 config_fp_parse_line( &ca );
2580 if ( !strcasecmp( ca.argv[0], "suffixmassage" )) {
2581 rc = meta_suffixm_config( &ca, ca.argc, ca.argv, mt );
2583 rc = rewrite_parse( mt->mt_rwmap.rwm_rw,
2584 c->fname, c->lineno, ca.argc, argv );
2588 ch_free( ca.tline );
2592 /* save the rule info */
2593 line = ldap_charray2str( argv, "\" \"" );
2594 if ( line != NULL ) {
2596 int len = strlen( argv[ 0 ] );
2598 ber_str2bv( line, 0, 0, &bv );
2599 AC_MEMCPY( &bv.bv_val[ len ], &bv.bv_val[ len + 1 ],
2600 bv.bv_len - ( len + 1 ));
2601 bv.bv_val[ bv.bv_len - 1] = '"';
2602 ber_bvarray_add( &mt->mt_rwmap.rwm_bva_rewrite, &bv );
2603 /* move it to the right slot */
2605 for ( i=cnt; i>ix; i-- )
2606 mt->mt_rwmap.rwm_bva_rewrite[i+1] = mt->mt_rwmap.rwm_bva_rewrite[i];
2607 mt->mt_rwmap.rwm_bva_rewrite[i] = bv;
2609 /* destroy old rules */
2610 rewrite_info_delete( &rwi );
2615 case LDAP_BACK_CFG_MAP: {
2616 /* objectclass/attribute mapping */
2617 ConfigArgs ca = { 0 };
2619 struct ldapmap rwm_oc;
2620 struct ldapmap rwm_at;
2621 int cnt = 0, ix = c->valx;
2623 if ( mt->mt_rwmap.rwm_bva_map ) {
2624 for ( ; !BER_BVISNULL( &mt->mt_rwmap.rwm_bva_map[ cnt ] ); cnt++ )
2628 if ( ix >= cnt || ix < 0 ) {
2631 rwm_oc = mt->mt_rwmap.rwm_oc;
2632 rwm_at = mt->mt_rwmap.rwm_at;
2634 memset( &mt->mt_rwmap.rwm_oc, 0, sizeof( mt->mt_rwmap.rwm_oc ) );
2635 memset( &mt->mt_rwmap.rwm_at, 0, sizeof( mt->mt_rwmap.rwm_at ) );
2637 /* re-parse all mappings, up to the one
2638 * that needs to be added */
2639 argv[0] = c->argv[0];
2640 ca.fname = c->fname;
2641 ca.lineno = c->lineno;
2642 for ( i = 0; i < ix; i++ ) {
2643 ca.line = mt->mt_rwmap.rwm_bva_map[ i ].bv_val;
2645 config_fp_parse_line( &ca );
2647 argv[1] = ca.argv[0];
2648 argv[2] = ca.argv[1];
2649 argv[3] = ca.argv[2];
2650 argv[4] = ca.argv[3];
2654 rc = ldap_back_map_config( &ca, &mt->mt_rwmap.rwm_oc,
2655 &mt->mt_rwmap.rwm_at );
2657 ch_free( ca.tline );
2661 /* in case of failure, restore
2662 * the existing mapping */
2668 /* add the new mapping */
2669 rc = ldap_back_map_config( c, &mt->mt_rwmap.rwm_oc,
2670 &mt->mt_rwmap.rwm_at );
2676 for ( ; i<cnt ; cnt++ ) {
2677 ca.line = mt->mt_rwmap.rwm_bva_map[ i ].bv_val;
2679 config_fp_parse_line( &ca );
2681 argv[1] = ca.argv[0];
2682 argv[2] = ca.argv[1];
2683 argv[3] = ca.argv[2];
2684 argv[4] = ca.argv[3];
2689 rc = ldap_back_map_config( &ca, &mt->mt_rwmap.rwm_oc,
2690 &mt->mt_rwmap.rwm_at );
2692 ch_free( ca.tline );
2696 /* in case of failure, restore
2697 * the existing mapping */
2704 /* save the map info */
2705 argv[0] = ldap_charray2str( &c->argv[ 1 ], " " );
2706 if ( argv[0] != NULL ) {
2708 ber_str2bv( argv[0], 0, 0, &bv );
2709 ber_bvarray_add( &mt->mt_rwmap.rwm_bva_map, &bv );
2710 /* move it to the right slot */
2712 for ( i=cnt; i>ix; i-- )
2713 mt->mt_rwmap.rwm_bva_map[i+1] = mt->mt_rwmap.rwm_bva_map[i];
2714 mt->mt_rwmap.rwm_bva_map[i] = bv;
2716 /* destroy old mapping */
2717 meta_back_map_free( &rwm_oc );
2718 meta_back_map_free( &rwm_at );
2725 meta_back_map_free( &mt->mt_rwmap.rwm_oc );
2726 meta_back_map_free( &mt->mt_rwmap.rwm_at );
2727 mt->mt_rwmap.rwm_oc = rwm_oc;
2728 mt->mt_rwmap.rwm_at = rwm_at;
2732 case LDAP_BACK_CFG_NRETRIES: {
2733 int nretries = META_RETRY_UNDEFINED;
2735 if ( strcasecmp( c->argv[ 1 ], "forever" ) == 0 ) {
2736 nretries = META_RETRY_FOREVER;
2738 } else if ( strcasecmp( c->argv[ 1 ], "never" ) == 0 ) {
2739 nretries = META_RETRY_NEVER;
2742 if ( lutil_atoi( &nretries, c->argv[ 1 ] ) != 0 ) {
2743 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2744 "unable to parse nretries {never|forever|<retries>}: \"%s\"",
2746 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2751 mc->mc_nretries = nretries;
2754 case LDAP_BACK_CFG_VERSION:
2755 if ( c->value_int != 0 && ( c->value_int < LDAP_VERSION_MIN || c->value_int > LDAP_VERSION_MAX ) ) {
2756 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2757 "unsupported protocol version \"%s\"",
2759 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2762 mc->mc_version = c->value_int;
2765 case LDAP_BACK_CFG_NOREFS:
2766 /* do not return search references */
2767 if ( c->value_int ) {
2768 mc->mc_flags |= LDAP_BACK_F_NOREFS;
2770 mc->mc_flags &= ~LDAP_BACK_F_NOREFS;
2774 case LDAP_BACK_CFG_NOUNDEFFILTER:
2775 /* do not propagate undefined search filters */
2776 if ( c->value_int ) {
2777 mc->mc_flags |= LDAP_BACK_F_NOUNDEFFILTER;
2779 mc->mc_flags &= ~LDAP_BACK_F_NOUNDEFFILTER;
2783 #ifdef SLAPD_META_CLIENT_PR
2784 case LDAP_BACK_CFG_CLIENT_PR:
2785 if ( strcasecmp( c->argv[ 1 ], "accept-unsolicited" ) == 0 ) {
2786 mc->mc_ps = META_CLIENT_PR_ACCEPT_UNSOLICITED;
2788 } else if ( strcasecmp( c->argv[ 1 ], "disable" ) == 0 ) {
2789 mc->mc_ps = META_CLIENT_PR_DISABLE;
2791 } else if ( lutil_atoi( &mc->mc_ps, c->argv[ 1 ] ) || mc->mc_ps < -1 ) {
2792 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2793 "unable to parse client-pr {accept-unsolicited|disable|<size>}: \"%s\"",
2795 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2799 #endif /* SLAPD_META_CLIENT_PR */
2803 return SLAP_CONF_UNKNOWN;
2810 meta_back_init_cf( BackendInfo *bi )
2813 AttributeDescription *ad = NULL;
2816 /* Make sure we don't exceed the bits reserved for userland */
2817 config_check_userland( LDAP_BACK_CFG_LAST );
2819 bi->bi_cf_ocs = metaocs;
2821 rc = config_register_schema( metacfg, metaocs );
2826 /* setup olcDbAclPasswd and olcDbIDAssertPasswd
2827 * to be base64-encoded when written in LDIF form;
2828 * basically, we don't care if it fails */
2829 rc = slap_str2ad( "olcDbACLPasswd", &ad, &text );
2831 Debug( LDAP_DEBUG_ANY, "config_back_initialize: "
2832 "warning, unable to get \"olcDbACLPasswd\" "
2833 "attribute description: %d: %s\n",
2836 (void)ldif_must_b64_encode_register( ad->ad_cname.bv_val,
2837 ad->ad_type->sat_oid );
2841 rc = slap_str2ad( "olcDbIDAssertPasswd", &ad, &text );
2843 Debug( LDAP_DEBUG_ANY, "config_back_initialize: "
2844 "warning, unable to get \"olcDbIDAssertPasswd\" "
2845 "attribute description: %d: %s\n",
2848 (void)ldif_must_b64_encode_register( ad->ad_cname.bv_val,
2849 ad->ad_type->sat_oid );
2856 ldap_back_map_config(
2858 struct ldapmap *oc_map,
2859 struct ldapmap *at_map )
2861 struct ldapmap *map;
2862 struct ldapmapping *mapping;
2866 if ( strcasecmp( c->argv[ 1 ], "objectclass" ) == 0 ) {
2870 } else if ( strcasecmp( c->argv[ 1 ], "attribute" ) == 0 ) {
2874 snprintf( c->cr_msg, sizeof(c->cr_msg),
2875 "%s unknown argument \"%s\"",
2876 c->argv[0], c->argv[1] );
2877 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2881 if ( !is_oc && map->map == NULL ) {
2882 /* only init if required */
2883 ldap_back_map_init( map, &mapping );
2886 if ( strcmp( c->argv[ 2 ], "*" ) == 0 ) {
2887 if ( c->argc < 4 || strcmp( c->argv[ 3 ], "*" ) == 0 ) {
2888 map->drop_missing = ( c->argc < 4 );
2889 goto success_return;
2891 src = dst = c->argv[ 3 ];
2893 } else if ( c->argc < 4 ) {
2899 dst = ( strcmp( c->argv[ 3 ], "*" ) == 0 ? src : c->argv[ 3 ] );
2902 if ( ( map == at_map )
2903 && ( strcasecmp( src, "objectclass" ) == 0
2904 || strcasecmp( dst, "objectclass" ) == 0 ) )
2906 snprintf( c->cr_msg, sizeof(c->cr_msg),
2907 "objectclass attribute cannot be mapped" );
2908 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2912 mapping = (struct ldapmapping *)ch_calloc( 2,
2913 sizeof(struct ldapmapping) );
2914 if ( mapping == NULL ) {
2915 snprintf( c->cr_msg, sizeof(c->cr_msg),
2917 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2920 ber_str2bv( src, 0, 1, &mapping[ 0 ].src );
2921 ber_str2bv( dst, 0, 1, &mapping[ 0 ].dst );
2922 mapping[ 1 ].src = mapping[ 0 ].dst;
2923 mapping[ 1 ].dst = mapping[ 0 ].src;
2929 if ( src[ 0 ] != '\0' ) {
2930 if ( oc_bvfind( &mapping[ 0 ].src ) == NULL ) {
2931 Debug( LDAP_DEBUG_ANY,
2932 "warning, source objectClass '%s' should be defined in schema\n",
2936 * FIXME: this should become an err
2942 if ( oc_bvfind( &mapping[ 0 ].dst ) == NULL ) {
2943 Debug( LDAP_DEBUG_ANY,
2944 "warning, destination objectClass '%s' is not defined in schema\n",
2949 const char *text = NULL;
2950 AttributeDescription *ad = NULL;
2952 if ( src[ 0 ] != '\0' ) {
2953 rc = slap_bv2ad( &mapping[ 0 ].src, &ad, &text );
2954 if ( rc != LDAP_SUCCESS ) {
2955 Debug( LDAP_DEBUG_ANY,
2956 "warning, source attributeType '%s' should be defined in schema\n",
2960 * FIXME: this should become an err
2963 * we create a fake "proxied" ad
2967 rc = slap_bv2undef_ad( &mapping[ 0 ].src,
2968 &ad, &text, SLAP_AD_PROXIED );
2969 if ( rc != LDAP_SUCCESS ) {
2970 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2971 "source attributeType \"%s\": %d (%s)",
2972 src, rc, text ? text : "" );
2973 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2981 rc = slap_bv2ad( &mapping[ 0 ].dst, &ad, &text );
2982 if ( rc != LDAP_SUCCESS ) {
2983 Debug( LDAP_DEBUG_ANY,
2984 "warning, destination attributeType '%s' is not defined in schema\n",
2988 * we create a fake "proxied" ad
2992 rc = slap_bv2undef_ad( &mapping[ 0 ].dst,
2993 &ad, &text, SLAP_AD_PROXIED );
2994 if ( rc != LDAP_SUCCESS ) {
2995 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2996 "destination attributeType \"%s\": %d (%s)\n",
2997 dst, rc, text ? text : "" );
2998 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
3004 if ( (src[ 0 ] != '\0' && avl_find( map->map, (caddr_t)&mapping[ 0 ], mapping_cmp ) != NULL)
3005 || avl_find( map->remap, (caddr_t)&mapping[ 1 ], mapping_cmp ) != NULL)
3007 snprintf( c->cr_msg, sizeof( c->cr_msg ),
3008 "duplicate mapping found." );
3009 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
3013 if ( src[ 0 ] != '\0' ) {
3014 avl_insert( &map->map, (caddr_t)&mapping[ 0 ],
3015 mapping_cmp, mapping_dup );
3017 avl_insert( &map->remap, (caddr_t)&mapping[ 1 ],
3018 mapping_cmp, mapping_dup );
3025 ch_free( mapping[ 0 ].src.bv_val );
3026 ch_free( mapping[ 0 ].dst.bv_val );
3034 #ifdef ENABLE_REWRITE
3036 suffix_massage_regexize( const char *s )
3042 if ( s[ 0 ] == '\0' ) {
3043 return ch_strdup( "^(.+)$" );
3047 ( r = strchr( p, ',' ) ) != NULL;
3051 res = ch_calloc( sizeof( char ),
3053 + STRLENOF( "((.+),)?" )
3054 + STRLENOF( "[ ]?" ) * i
3055 + STRLENOF( "$" ) + 1 );
3057 ptr = lutil_strcopy( res, "((.+),)?" );
3059 ( r = strchr( p, ',' ) ) != NULL;
3061 ptr = lutil_strncopy( ptr, p, r - p + 1 );
3062 ptr = lutil_strcopy( ptr, "[ ]?" );
3064 if ( r[ 1 ] == ' ' ) {
3068 ptr = lutil_strcopy( ptr, p );
3077 suffix_massage_patternize( const char *s, const char *p )
3084 if ( s[ 0 ] == '\0' ) {
3088 res = ch_calloc( sizeof( char ), len + STRLENOF( "%1" ) + 1 );
3089 if ( res == NULL ) {
3093 ptr = lutil_strcopy( res, ( p[ 0 ] == '\0' ? "%2" : "%1" ) );
3094 if ( s[ 0 ] == '\0' ) {
3098 lutil_strcopy( ptr, p );
3104 suffix_massage_config(
3105 struct rewrite_info *info,
3106 struct berval *pvnc,
3107 struct berval *nvnc,
3108 struct berval *prnc,
3115 rargv[ 0 ] = "rewriteEngine";
3118 rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3120 rargv[ 0 ] = "rewriteContext";
3121 rargv[ 1 ] = "default";
3123 rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3125 rargv[ 0 ] = "rewriteRule";
3126 rargv[ 1 ] = suffix_massage_regexize( pvnc->bv_val );
3127 rargv[ 2 ] = suffix_massage_patternize( pvnc->bv_val, prnc->bv_val );
3130 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3131 ch_free( rargv[ 1 ] );
3132 ch_free( rargv[ 2 ] );
3134 if ( BER_BVISEMPTY( pvnc ) ) {
3135 rargv[ 0 ] = "rewriteRule";
3137 rargv[ 2 ] = prnc->bv_val;
3140 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3143 rargv[ 0 ] = "rewriteContext";
3144 rargv[ 1 ] = "searchEntryDN";
3146 rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3148 rargv[ 0 ] = "rewriteRule";
3149 rargv[ 1 ] = suffix_massage_regexize( prnc->bv_val );
3150 rargv[ 2 ] = suffix_massage_patternize( prnc->bv_val, pvnc->bv_val );
3153 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3154 ch_free( rargv[ 1 ] );
3155 ch_free( rargv[ 2 ] );
3157 if ( BER_BVISEMPTY( prnc ) ) {
3158 rargv[ 0 ] = "rewriteRule";
3160 rargv[ 2 ] = pvnc->bv_val;
3163 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3166 /* backward compatibility */
3167 rargv[ 0 ] = "rewriteContext";
3168 rargv[ 1 ] = "searchResult";
3169 rargv[ 2 ] = "alias";
3170 rargv[ 3 ] = "searchEntryDN";
3172 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3174 rargv[ 0 ] = "rewriteContext";
3175 rargv[ 1 ] = "matchedDN";
3176 rargv[ 2 ] = "alias";
3177 rargv[ 3 ] = "searchEntryDN";
3179 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3181 rargv[ 0 ] = "rewriteContext";
3182 rargv[ 1 ] = "searchAttrDN";
3183 rargv[ 2 ] = "alias";
3184 rargv[ 3 ] = "searchEntryDN";
3186 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3188 /* NOTE: this corresponds to #undef'ining RWM_REFERRAL_REWRITE;
3189 * see servers/slapd/overlays/rwm.h for details */
3190 rargv[ 0 ] = "rewriteContext";
3191 rargv[ 1 ] = "referralAttrDN";
3193 rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3195 rargv[ 0 ] = "rewriteContext";
3196 rargv[ 1 ] = "referralDN";
3198 rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3202 #endif /* ENABLE_REWRITE */