git.sur5r.net Git - openldap/blob - servers/slapd/back-meta/config.c

   1 /* $OpenLDAP$ */
   2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   3  *
   4  * Copyright 1999-2013 The OpenLDAP Foundation.
   5  * Portions Copyright 2001-2003 Pierangelo Masarati.
   6  * Portions Copyright 1999-2003 Howard Chu.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted only as authorized by the OpenLDAP
  11  * Public License.
  12  *
  13  * A copy of this license is available in the file LICENSE in the
  14  * top-level directory of the distribution or, alternatively, at
  15  * <http://www.OpenLDAP.org/license.html>.
  16  */
  17 /* ACKNOWLEDGEMENTS:
  18  * This work was initially developed by the Howard Chu for inclusion
  19  * in OpenLDAP Software and subsequently enhanced by Pierangelo
  20  * Masarati.
  21  */
  22
  23 #include "portable.h"
  24
  25 #include <stdio.h>
  26
  27 #include <ac/string.h>
  28 #include <ac/socket.h>
  29
  30 #include "slap.h"
  31 #include "config.h"
  32 #include "lutil.h"
  33 #include "../back-ldap/back-ldap.h"
  34 #include "back-meta.h"
  35
  36 #ifdef LDAP_DEVEL
  37 #define SLAP_AUTH_DN    1
  38 #endif
  39
  40 static ConfigDriver meta_back_cf_gen;
  41 static ConfigLDAPadd meta_ldadd;
  42 static ConfigCfAdd meta_cfadd;
  43
  44 static int ldap_back_map_config(
  45         ConfigArgs *c,
  46         struct ldapmap  *oc_map,
  47         struct ldapmap  *at_map );
  48
  49 /* Three sets of enums:
  50  *      1) attrs that are only valid in the base config
  51  *      2) attrs that are valid in base or target
  52  *      3) attrs that are only valid in a target
  53  */
  54
  55 /* Base attrs */
  56 enum {
  57         LDAP_BACK_CFG_CONN_TTL = 1,
  58         LDAP_BACK_CFG_DNCACHE_TTL,
  59         LDAP_BACK_CFG_IDLE_TIMEOUT,
  60         LDAP_BACK_CFG_ONERR,
  61         LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
  62         LDAP_BACK_CFG_SINGLECONN,
  63         LDAP_BACK_CFG_USETEMP,
  64         LDAP_BACK_CFG_CONNPOOLMAX,
  65         LDAP_BACK_CFG_LAST_BASE
  66 };
  67
  68 /* Base or target */
  69 enum {
  70         LDAP_BACK_CFG_BIND_TIMEOUT = LDAP_BACK_CFG_LAST_BASE,
  71         LDAP_BACK_CFG_CANCEL,
  72         LDAP_BACK_CFG_CHASE,
  73         LDAP_BACK_CFG_CLIENT_PR,
  74         LDAP_BACK_CFG_DEFAULT_T,
  75         LDAP_BACK_CFG_NETWORK_TIMEOUT,
  76         LDAP_BACK_CFG_NOREFS,
  77         LDAP_BACK_CFG_NOUNDEFFILTER,
  78         LDAP_BACK_CFG_NRETRIES,
  79         LDAP_BACK_CFG_QUARANTINE,
  80         LDAP_BACK_CFG_REBIND,
  81         LDAP_BACK_CFG_TIMEOUT,
  82         LDAP_BACK_CFG_VERSION,
  83         LDAP_BACK_CFG_ST_REQUEST,
  84         LDAP_BACK_CFG_T_F,
  85         LDAP_BACK_CFG_TLS,
  86         LDAP_BACK_CFG_LAST_BOTH
  87 };
  88
  89 /* Target attrs */
  90 enum {
  91         LDAP_BACK_CFG_URI = LDAP_BACK_CFG_LAST_BOTH,
  92         LDAP_BACK_CFG_ACL_AUTHCDN,
  93         LDAP_BACK_CFG_ACL_PASSWD,
  94         LDAP_BACK_CFG_IDASSERT_AUTHZFROM,
  95         LDAP_BACK_CFG_IDASSERT_BIND,
  96         LDAP_BACK_CFG_REWRITE,
  97         LDAP_BACK_CFG_SUFFIXM,
  98         LDAP_BACK_CFG_MAP,
  99         LDAP_BACK_CFG_SUBTREE_EX,
 100         LDAP_BACK_CFG_SUBTREE_IN,
 101         LDAP_BACK_CFG_PSEUDOROOTDN,
 102         LDAP_BACK_CFG_PSEUDOROOTPW,
 103
 104         LDAP_BACK_CFG_LAST
 105 };
 106
 107 static ConfigTable metacfg[] = {
 108         { "uri", "uri", 2, 0, 0,
 109                 ARG_MAGIC|LDAP_BACK_CFG_URI,
 110                 meta_back_cf_gen, "( OLcfgDbAt:0.14 "
 111                         "NAME 'olcDbURI' "
 112                         "DESC 'URI (list) for remote DSA' "
 113                         "SYNTAX OMsDirectoryString "
 114                         "SINGLE-VALUE )",
 115                 NULL, NULL },
 116         { "tls", "what", 2, 0, 0,
 117                 ARG_MAGIC|LDAP_BACK_CFG_TLS,
 118                 meta_back_cf_gen, "( OLcfgDbAt:3.1 "
 119                         "NAME 'olcDbStartTLS' "
 120                         "DESC 'StartTLS' "
 121                         "SYNTAX OMsDirectoryString "
 122                         "SINGLE-VALUE )",
 123                 NULL, NULL },
 124         { "acl-authcDN", "DN", 2, 2, 0,
 125                 ARG_DN|ARG_MAGIC|LDAP_BACK_CFG_ACL_AUTHCDN,
 126                 meta_back_cf_gen, "( OLcfgDbAt:3.2 "
 127                         "NAME 'olcDbACLAuthcDn' "
 128                         "DESC 'Remote ACL administrative identity' "
 129                         "OBSOLETE "
 130                         "SYNTAX OMsDN "
 131                         "SINGLE-VALUE )",
 132                 NULL, NULL },
 133         /* deprecated, will be removed; aliases "acl-authcDN" */
 134         { "binddn", "DN", 2, 2, 0,
 135                 ARG_DN|ARG_MAGIC|LDAP_BACK_CFG_ACL_AUTHCDN,
 136                 meta_back_cf_gen, NULL, NULL, NULL },
 137         { "acl-passwd", "cred", 2, 2, 0,
 138                 ARG_MAGIC|LDAP_BACK_CFG_ACL_PASSWD,
 139                 meta_back_cf_gen, "( OLcfgDbAt:3.3 "
 140                         "NAME 'olcDbACLPasswd' "
 141                         "DESC 'Remote ACL administrative identity credentials' "
 142                         "OBSOLETE "
 143                         "SYNTAX OMsDirectoryString "
 144                         "SINGLE-VALUE )",
 145                 NULL, NULL },
 146         /* deprecated, will be removed; aliases "acl-passwd" */
 147         { "bindpw", "cred", 2, 2, 0,
 148                 ARG_MAGIC|LDAP_BACK_CFG_ACL_PASSWD,
 149                 meta_back_cf_gen, NULL, NULL, NULL },
 150         { "idassert-bind", "args", 2, 0, 0,
 151                 ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_BIND,
 152                 meta_back_cf_gen, "( OLcfgDbAt:3.7 "
 153                         "NAME 'olcDbIDAssertBind' "
 154                         "DESC 'Remote Identity Assertion administrative identity auth bind configuration' "
 155                         "SYNTAX OMsDirectoryString "
 156                         "SINGLE-VALUE )",
 157                 NULL, NULL },
 158         { "idassert-authzFrom", "authzRule", 2, 2, 0,
 159                 ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_AUTHZFROM,
 160                 meta_back_cf_gen, "( OLcfgDbAt:3.9 "
 161                         "NAME 'olcDbIDAssertAuthzFrom' "
 162                         "DESC 'Remote Identity Assertion authz rules' "
 163                         "EQUALITY caseIgnoreMatch "
 164                         "SYNTAX OMsDirectoryString "
 165                         "X-ORDERED 'VALUES' )",
 166                 NULL, NULL },
 167         { "rebind-as-user", "true|FALSE", 1, 2, 0,
 168                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_REBIND,
 169                 meta_back_cf_gen, "( OLcfgDbAt:3.10 "
 170                         "NAME 'olcDbRebindAsUser' "
 171                         "DESC 'Rebind as user' "
 172                         "SYNTAX OMsBoolean "
 173                         "SINGLE-VALUE )",
 174                 NULL, NULL },
 175         { "chase-referrals", "true|FALSE", 2, 2, 0,
 176                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_CHASE,
 177                 meta_back_cf_gen, "( OLcfgDbAt:3.11 "
 178                         "NAME 'olcDbChaseReferrals' "
 179                         "DESC 'Chase referrals' "
 180                         "SYNTAX OMsBoolean "
 181                         "SINGLE-VALUE )",
 182                 NULL, NULL },
 183         { "t-f-support", "true|FALSE|discover", 2, 2, 0,
 184                 ARG_MAGIC|LDAP_BACK_CFG_T_F,
 185                 meta_back_cf_gen, "( OLcfgDbAt:3.12 "
 186                         "NAME 'olcDbTFSupport' "
 187                         "DESC 'Absolute filters support' "
 188                         "SYNTAX OMsDirectoryString "
 189                         "SINGLE-VALUE )",
 190                 NULL, NULL },
 191         { "timeout", "timeout(list)", 2, 0, 0,
 192                 ARG_MAGIC|LDAP_BACK_CFG_TIMEOUT,
 193                 meta_back_cf_gen, "( OLcfgDbAt:3.14 "
 194                         "NAME 'olcDbTimeout' "
 195                         "DESC 'Per-operation timeouts' "
 196                         "SYNTAX OMsDirectoryString "
 197                         "SINGLE-VALUE )",
 198                 NULL, NULL },
 199         { "idle-timeout", "timeout", 2, 2, 0,
 200                 ARG_MAGIC|LDAP_BACK_CFG_IDLE_TIMEOUT,
 201                 meta_back_cf_gen, "( OLcfgDbAt:3.15 "
 202                         "NAME 'olcDbIdleTimeout' "
 203                         "DESC 'connection idle timeout' "
 204                         "SYNTAX OMsDirectoryString "
 205                         "SINGLE-VALUE )",
 206                 NULL, NULL },
 207         { "conn-ttl", "ttl", 2, 2, 0,
 208                 ARG_MAGIC|LDAP_BACK_CFG_CONN_TTL,
 209                 meta_back_cf_gen, "( OLcfgDbAt:3.16 "
 210                         "NAME 'olcDbConnTtl' "
 211                         "DESC 'connection ttl' "
 212                         "SYNTAX OMsDirectoryString "
 213                         "SINGLE-VALUE )",
 214                 NULL, NULL },
 215         { "network-timeout", "timeout", 2, 2, 0,
 216                 ARG_MAGIC|LDAP_BACK_CFG_NETWORK_TIMEOUT,
 217                 meta_back_cf_gen, "( OLcfgDbAt:3.17 "
 218                         "NAME 'olcDbNetworkTimeout' "
 219                         "DESC 'connection network timeout' "
 220                         "SYNTAX OMsDirectoryString "
 221                         "SINGLE-VALUE )",
 222                 NULL, NULL },
 223         { "protocol-version", "version", 2, 2, 0,
 224                 ARG_MAGIC|ARG_INT|LDAP_BACK_CFG_VERSION,
 225                 meta_back_cf_gen, "( OLcfgDbAt:3.18 "
 226                         "NAME 'olcDbProtocolVersion' "
 227                         "DESC 'protocol version' "
 228                         "SYNTAX OMsInteger "
 229                         "SINGLE-VALUE )",
 230                 NULL, NULL },
 231         { "single-conn", "true|FALSE", 2, 2, 0,
 232                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_SINGLECONN,
 233                 meta_back_cf_gen, "( OLcfgDbAt:3.19 "
 234                         "NAME 'olcDbSingleConn' "
 235                         "DESC 'cache a single connection per identity' "
 236                         "SYNTAX OMsBoolean "
 237                         "SINGLE-VALUE )",
 238                 NULL, NULL },
 239         { "cancel", "ABANDON|ignore|exop", 2, 2, 0,
 240                 ARG_MAGIC|LDAP_BACK_CFG_CANCEL,
 241                 meta_back_cf_gen, "( OLcfgDbAt:3.20 "
 242                         "NAME 'olcDbCancel' "
 243                         "DESC 'abandon/ignore/exop operations when appropriate' "
 244                         "SYNTAX OMsDirectoryString "
 245                         "SINGLE-VALUE )",
 246                 NULL, NULL },
 247         { "quarantine", "retrylist", 2, 2, 0,
 248                 ARG_MAGIC|LDAP_BACK_CFG_QUARANTINE,
 249                 meta_back_cf_gen, "( OLcfgDbAt:3.21 "
 250                         "NAME 'olcDbQuarantine' "
 251                         "DESC 'Quarantine database if connection fails and retry according to rule' "
 252                         "SYNTAX OMsDirectoryString "
 253                         "SINGLE-VALUE )",
 254                 NULL, NULL },
 255         { "use-temporary-conn", "true|FALSE", 2, 2, 0,
 256                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_USETEMP,
 257                 meta_back_cf_gen, "( OLcfgDbAt:3.22 "
 258                         "NAME 'olcDbUseTemporaryConn' "
 259                         "DESC 'Use temporary connections if the cached one is busy' "
 260                         "SYNTAX OMsBoolean "
 261                         "SINGLE-VALUE )",
 262                 NULL, NULL },
 263         { "conn-pool-max", "<n>", 2, 2, 0,
 264                 ARG_MAGIC|ARG_INT|LDAP_BACK_CFG_CONNPOOLMAX,
 265                 meta_back_cf_gen, "( OLcfgDbAt:3.23 "
 266                         "NAME 'olcDbConnectionPoolMax' "
 267                         "DESC 'Max size of privileged connections pool' "
 268                         "SYNTAX OMsInteger "
 269                         "SINGLE-VALUE )",
 270                 NULL, NULL },
 271 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
 272         { "session-tracking-request", "true|FALSE", 2, 2, 0,
 273                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_ST_REQUEST,
 274                 meta_back_cf_gen, "( OLcfgDbAt:3.24 "
 275                         "NAME 'olcDbSessionTrackingRequest' "
 276                         "DESC 'Add session tracking control to proxied requests' "
 277                         "SYNTAX OMsBoolean "
 278                         "SINGLE-VALUE )",
 279                 NULL, NULL },
 280 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
 281         { "norefs", "true|FALSE", 2, 2, 0,
 282                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_NOREFS,
 283                 meta_back_cf_gen, "( OLcfgDbAt:3.25 "
 284                         "NAME 'olcDbNoRefs' "
 285                         "DESC 'Do not return search reference responses' "
 286                         "SYNTAX OMsBoolean "
 287                         "SINGLE-VALUE )",
 288                 NULL, NULL },
 289         { "noundeffilter", "true|FALSE", 2, 2, 0,
 290                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_NOUNDEFFILTER,
 291                 meta_back_cf_gen, "( OLcfgDbAt:3.26 "
 292                         "NAME 'olcDbNoUndefFilter' "
 293                         "DESC 'Do not propagate undefined search filters' "
 294                         "SYNTAX OMsBoolean "
 295                         "SINGLE-VALUE )",
 296                 NULL, NULL },
 297
 298         { "rewrite", "arglist", 2, 0, STRLENOF( "rewrite" ),
 299                 ARG_MAGIC|LDAP_BACK_CFG_REWRITE,
 300                 meta_back_cf_gen, "( OLcfgDbAt:3.101 "
 301                         "NAME 'olcDbRewrite' "
 302                         "DESC 'DN rewriting rules' "
 303                         "EQUALITY caseIgnoreMatch "
 304                         "SYNTAX OMsDirectoryString "
 305                         "X-ORDERED 'VALUES' )",
 306                 NULL, NULL },
 307         { "suffixmassage", "virtual> <real", 2, 3, 0,
 308                 ARG_MAGIC|LDAP_BACK_CFG_SUFFIXM,
 309                 meta_back_cf_gen, NULL, NULL, NULL },
 310
 311         { "map", "attribute|objectClass> [*|<local>] *|<remote", 3, 4, 0,
 312                 ARG_MAGIC|LDAP_BACK_CFG_MAP,
 313                 meta_back_cf_gen, "( OLcfgDbAt:3.102 "
 314                         "NAME 'olcDbMap' "
 315                         "DESC 'Map attribute and objectclass names' "
 316                         "EQUALITY caseIgnoreMatch "
 317                         "SYNTAX OMsDirectoryString "
 318                         "X-ORDERED 'VALUES' )",
 319                 NULL, NULL },
 320
 321         { "subtree-exclude", "pattern", 2, 2, 0,
 322                 ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_SUBTREE_EX,
 323                 meta_back_cf_gen, "( OLcfgDbAt:3.103 "
 324                         "NAME 'olcDbSubtreeExclude' "
 325                         "DESC 'DN of subtree to exclude from target' "
 326                         "EQUALITY caseIgnoreMatch "
 327                         "SYNTAX OMsDirectoryString )",
 328                 NULL, NULL },
 329         { "subtree-include", "pattern", 2, 2, 0,
 330                 ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_SUBTREE_IN,
 331                 meta_back_cf_gen, "( OLcfgDbAt:3.104 "
 332                         "NAME 'olcDbSubtreeInclude' "
 333                         "DESC 'DN of subtree to include in target' "
 334                         "EQUALITY caseIgnoreMatch "
 335                         "SYNTAX OMsDirectoryString )",
 336                 NULL, NULL },
 337         { "default-target", "[none|<target ID>]", 1, 2, 0,
 338                 ARG_MAGIC|LDAP_BACK_CFG_DEFAULT_T,
 339                 meta_back_cf_gen, "( OLcfgDbAt:3.105 "
 340                         "NAME 'olcDbDefaultTarget' "
 341                         "DESC 'Specify the default target' "
 342                         "SYNTAX OMsDirectoryString "
 343                         "SINGLE-VALUE )",
 344                 NULL, NULL },
 345         { "dncache-ttl", "ttl", 2, 2, 0,
 346                 ARG_MAGIC|LDAP_BACK_CFG_DNCACHE_TTL,
 347                 meta_back_cf_gen, "( OLcfgDbAt:3.106 "
 348                         "NAME 'olcDbDnCacheTtl' "
 349                         "DESC 'dncache ttl' "
 350                         "SYNTAX OMsDirectoryString "
 351                         "SINGLE-VALUE )",
 352                 NULL, NULL },
 353         { "bind-timeout", "microseconds", 2, 2, 0,
 354                 ARG_MAGIC|ARG_ULONG|LDAP_BACK_CFG_BIND_TIMEOUT,
 355                 meta_back_cf_gen, "( OLcfgDbAt:3.107 "
 356                         "NAME 'olcDbBindTimeout' "
 357                         "DESC 'bind timeout' "
 358                         "SYNTAX OMsDirectoryString "
 359                         "SINGLE-VALUE )",
 360                 NULL, NULL },
 361         { "onerr", "CONTINUE|report|stop", 2, 2, 0,
 362                 ARG_MAGIC|LDAP_BACK_CFG_ONERR,
 363                 meta_back_cf_gen, "( OLcfgDbAt:3.108 "
 364                         "NAME 'olcDbOnErr' "
 365                         "DESC 'error handling' "
 366                         "SYNTAX OMsDirectoryString "
 367                         "SINGLE-VALUE )",
 368                 NULL, NULL },
 369         { "pseudoroot-bind-defer", "TRUE|false", 2, 2, 0,
 370                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
 371                 meta_back_cf_gen, "( OLcfgDbAt:3.109 "
 372                         "NAME 'olcDbPseudoRootBindDefer' "
 373                         "DESC 'error handling' "
 374                         "SYNTAX OMsBoolean "
 375                         "SINGLE-VALUE )",
 376                 NULL, NULL },
 377         { "root-bind-defer", "TRUE|false", 2, 2, 0,
 378                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
 379                 meta_back_cf_gen, NULL, NULL, NULL },
 380         { "pseudorootdn", "dn", 2, 2, 0,
 381                 ARG_MAGIC|ARG_DN|LDAP_BACK_CFG_PSEUDOROOTDN,
 382                 meta_back_cf_gen, NULL, NULL, NULL },
 383         { "pseudorootpw", "password", 2, 2, 0,
 384                 ARG_MAGIC|ARG_STRING|LDAP_BACK_CFG_PSEUDOROOTDN,
 385                 meta_back_cf_gen, NULL, NULL, NULL },
 386         { "nretries", "NEVER|forever|<number>", 2, 2, 0,
 387                 ARG_MAGIC|LDAP_BACK_CFG_NRETRIES,
 388                 meta_back_cf_gen, "( OLcfgDbAt:3.110 "
 389                         "NAME 'olcDbNretries' "
 390                         "DESC 'retry handling' "
 391                         "SYNTAX OMsDirectoryString "
 392                         "SINGLE-VALUE )",
 393                 NULL, NULL },
 394         { "client-pr", "accept-unsolicited|disable|<size>", 2, 2, 0,
 395                 ARG_MAGIC|LDAP_BACK_CFG_CLIENT_PR,
 396                 meta_back_cf_gen, "( OLcfgDbAt:3.111 "
 397                         "NAME 'olcDbClientPr' "
 398                         "DESC 'PagedResults handling' "
 399                         "SYNTAX OMsDirectoryString "
 400                         "SINGLE-VALUE )",
 401                 NULL, NULL },
 402
 403         { "", "", 0, 0, 0, ARG_IGNORED,
 404                 NULL, "( OLcfgDbAt:3.100 NAME 'olcMetaSub' "
 405                         "DESC 'Placeholder to name a Target entry' "
 406                         "EQUALITY caseIgnoreMatch "
 407                         "SYNTAX OMsDirectoryString "
 408                         "SINGLE-VALUE X-ORDERED 'SIBLINGS' )", NULL, NULL },
 409
 410         { NULL, NULL, 0, 0, 0, ARG_IGNORED,
 411                 NULL, NULL, NULL, NULL }
 412 };
 413
 414 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
 415 #define ST_ATTR "$ olcDbSessionTrackingRequest "
 416 #else
 417 #define ST_ATTR ""
 418 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
 419
 420 #define COMMON_ATTRS    \
 421                         "$ olcDbBindTimeout " \
 422                         "$ olcDbCancel " \
 423                         "$ olcDbChaseReferrals " \
 424                         "$ olcDbClientPr " \
 425                         "$ olcDbDefaultTarget " \
 426                         "$ olcDbNetworkTimeout " \
 427                         "$ olcDbNoRefs " \
 428                         "$ olcDbNoUndefFilter " \
 429                         "$ olcDbNretries " \
 430                         "$ olcDbProtocolVersion " \
 431                         "$ olcDbQuarantine " \
 432                         "$ olcDbRebindAsUser " \
 433                         ST_ATTR \
 434                         "$ olcDbStartTLS " \
 435                         "$ olcDbTFSupport "
 436
 437 static ConfigOCs metaocs[] = {
 438         { "( OLcfgDbOc:3.2 "
 439                 "NAME 'olcMetaConfig' "
 440                 "DESC 'Meta backend configuration' "
 441                 "SUP olcDatabaseConfig "
 442                 "MAY ( olcDbConnTtl "
 443                         "$ olcDbDnCacheTtl "
 444                         "$ olcDbIdleTimeout "
 445                         "$ olcDbOnErr "
 446                         "$ olcDbPseudoRootBindDefer "
 447                         "$ olcDbSingleConn "
 448                         "$ olcDbUseTemporaryConn "
 449                         "$ olcDbConnectionPoolMax "
 450
 451                         /* defaults, may be overridden per-target */
 452                         COMMON_ATTRS
 453                 ") )",
 454                         Cft_Database, metacfg, NULL, meta_cfadd },
 455         { "( OLcfgDbOc:3.3 "
 456                 "NAME 'olcMetaTargetConfig' "
 457                 "DESC 'Meta target configuration' "
 458                 "SUP olcConfig STRUCTURAL "
 459                 "MUST ( olcMetaSub $ olcDbURI ) "
 460                 "MAY ( olcDbACLAuthcDn "
 461                         "$ olcDbACLPasswd "
 462                         "$ olcDbIDAssertAuthzFrom "
 463                         "$ olcDbIDAssertBind "
 464                         "$ olcDbMap "
 465                         "$ olcDbRewrite "
 466                         "$ olcDbSubtreeExclude "
 467                         "$ olcDbSubtreeInclude "
 468                         "$ olcDbTimeout "
 469
 470                         /* defaults may be inherited */
 471                         COMMON_ATTRS
 472                 ") )",
 473                         Cft_Misc, metacfg, meta_ldadd },
 474         { NULL, 0, NULL }
 475 };
 476
 477 static int
 478 meta_ldadd( CfEntryInfo *p, Entry *e, ConfigArgs *c )
 479 {
 480         if ( p->ce_type != Cft_Database || !p->ce_be ||
 481                 p->ce_be->be_cf_ocs != metaocs )
 482                 return LDAP_CONSTRAINT_VIOLATION;
 483
 484         c->be = p->ce_be;
 485         return LDAP_SUCCESS;
 486 }
 487
 488 static int
 489 meta_cfadd( Operation *op, SlapReply *rs, Entry *p, ConfigArgs *c )
 490 {
 491         metainfo_t      *mi = ( metainfo_t * )c->be->be_private;
 492         struct berval bv;
 493         int i;
 494
 495         bv.bv_val = c->cr_msg;
 496         for ( i=0; i<mi->mi_ntargets; i++ ) {
 497                 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg),
 498                         "olcMetaSub=" SLAP_X_ORDERED_FMT "uri", i );
 499                 c->ca_private = mi->mi_targets[i];
 500                 c->valx = i;
 501                 config_build_entry( op, rs, p->e_private, c,
 502                         &bv, &metaocs[1], NULL );
 503         }
 504
 505         return LDAP_SUCCESS;
 506 }
 507
 508 static int
 509 meta_rwi_init( struct rewrite_info **rwm_rw )
 510 {
 511         char                    *rargv[ 3 ];
 512
 513         *rwm_rw = rewrite_info_init( REWRITE_MODE_USE_DEFAULT );
 514         if ( *rwm_rw == NULL ) {
 515                 return -1;
 516         }
 517         /*
 518          * the filter rewrite as a string must be disabled
 519          * by default; it can be re-enabled by adding rules;
 520          * this creates an empty rewriteContext
 521          */
 522         rargv[ 0 ] = "rewriteContext";
 523         rargv[ 1 ] = "searchFilter";
 524         rargv[ 2 ] = NULL;
 525         rewrite_parse( *rwm_rw, "<suffix massage>", 1, 2, rargv );
 526
 527         rargv[ 0 ] = "rewriteContext";
 528         rargv[ 1 ] = "default";
 529         rargv[ 2 ] = NULL;
 530         rewrite_parse( *rwm_rw, "<suffix massage>", 1, 2, rargv );
 531
 532         return 0;
 533 }
 534
 535 static int
 536 meta_back_new_target(
 537         metatarget_t    **mtp )
 538 {
 539         metatarget_t            *mt;
 540
 541         *mtp = NULL;
 542
 543         mt = ch_calloc( sizeof( metatarget_t ), 1 );
 544
 545         if ( meta_rwi_init( &mt->mt_rwmap.rwm_rw )) {
 546                 ch_free( mt );
 547                 return -1;
 548         }
 549
 550         ldap_pvt_thread_mutex_init( &mt->mt_uri_mutex );
 551
 552         mt->mt_idassert_mode = LDAP_BACK_IDASSERT_LEGACY;
 553         mt->mt_idassert_authmethod = LDAP_AUTH_NONE;
 554         mt->mt_idassert_tls = SB_TLS_DEFAULT;
 555
 556         /* by default, use proxyAuthz control on each operation */
 557         mt->mt_idassert_flags = LDAP_BACK_AUTH_PRESCRIPTIVE;
 558
 559         *mtp = mt;
 560
 561         return 0;
 562 }
 563
 564 /* Validation for suffixmassage_config */
 565 static int
 566 meta_suffixm_config(
 567         ConfigArgs *c,
 568         int argc,
 569         char **argv,
 570         metatarget_t *mt
 571 )
 572 {
 573         BackendDB       *tmp_bd;
 574         struct berval   dn, nvnc, pvnc, nrnc, prnc;
 575         int j, rc;
 576
 577         /*
 578          * syntax:
 579          *
 580          *      suffixmassage <suffix> <massaged suffix>
 581          *
 582          * the <suffix> field must be defined as a valid suffix
 583          * (or suffixAlias?) for the current database;
 584          * the <massaged suffix> shouldn't have already been
 585          * defined as a valid suffix or suffixAlias for the
 586          * current server
 587          */
 588
 589         ber_str2bv( argv[ 1 ], 0, 0, &dn );
 590         if ( dnPrettyNormal( NULL, &dn, &pvnc, &nvnc, NULL ) != LDAP_SUCCESS ) {
 591                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
 592                         "suffix \"%s\" is invalid",
 593                         argv[1] );
 594                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
 595                 return 1;
 596         }
 597
 598         for ( j = 0; !BER_BVISNULL( &c->be->be_nsuffix[ j ] ); j++ ) {
 599                 if ( dnIsSuffix( &nvnc, &c->be->be_nsuffix[ 0 ] ) ) {
 600                         break;
 601                 }
 602         }
 603
 604         if ( BER_BVISNULL( &c->be->be_nsuffix[ j ] ) ) {
 605                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
 606                         "suffix \"%s\" must be within the database naming context",
 607                         argv[1] );
 608                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
 609                 free( pvnc.bv_val );
 610                 free( nvnc.bv_val );
 611                 return 1;
 612         }
 613
 614         ber_str2bv( argv[ 2 ], 0, 0, &dn );
 615         if ( dnPrettyNormal( NULL, &dn, &prnc, &nrnc, NULL ) != LDAP_SUCCESS ) {
 616                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
 617                         "massaged suffix \"%s\" is invalid",
 618                         argv[2] );
 619                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
 620                 free( pvnc.bv_val );
 621                 free( nvnc.bv_val );
 622                 return 1;
 623         }
 624
 625         tmp_bd = select_backend( &nrnc, 0 );
 626         if ( tmp_bd != NULL && tmp_bd->be_private == c->be->be_private ) {
 627                 Debug( LDAP_DEBUG_ANY,
 628         "%s: warning: <massaged suffix> \"%s\" resolves to this database, in "
 629         "\"suffixMassage <suffix> <massaged suffix>\"\n",
 630                         c->log, prnc.bv_val, 0 );
 631         }
 632
 633         /*
 634          * The suffix massaging is emulated by means of the
 635          * rewrite capabilities
 636          */
 637         rc = suffix_massage_config( mt->mt_rwmap.rwm_rw,
 638                         &pvnc, &nvnc, &prnc, &nrnc );
 639
 640         free( pvnc.bv_val );
 641         free( nvnc.bv_val );
 642         free( prnc.bv_val );
 643         free( nrnc.bv_val );
 644
 645         return rc;
 646 }
 647
 648 static int
 649 slap_bv_x_ordered_unparse( BerVarray in, BerVarray *out )
 650 {
 651         int             i;
 652         BerVarray       bva = NULL;
 653         char            ibuf[32], *ptr;
 654         struct berval   idx;
 655
 656         assert( in != NULL );
 657
 658         for ( i = 0; !BER_BVISNULL( &in[i] ); i++ )
 659                 /* count'em */ ;
 660
 661         if ( i == 0 ) {
 662                 return 1;
 663         }
 664
 665         idx.bv_val = ibuf;
 666
 667         bva = ch_malloc( ( i + 1 ) * sizeof(struct berval) );
 668         BER_BVZERO( &bva[ 0 ] );
 669
 670         for ( i = 0; !BER_BVISNULL( &in[i] ); i++ ) {
 671                 idx.bv_len = snprintf( idx.bv_val, sizeof( ibuf ), SLAP_X_ORDERED_FMT, i );
 672                 if ( idx.bv_len >= sizeof( ibuf ) ) {
 673                         ber_bvarray_free( bva );
 674                         return 1;
 675                 }
 676
 677                 bva[i].bv_len = idx.bv_len + in[i].bv_len;
 678                 bva[i].bv_val = ch_malloc( bva[i].bv_len + 1 );
 679                 ptr = lutil_strcopy( bva[i].bv_val, ibuf );
 680                 ptr = lutil_strcopy( ptr, in[i].bv_val );
 681                 *ptr = '\0';
 682                 BER_BVZERO( &bva[ i + 1 ] );
 683         }
 684
 685         *out = bva;
 686         return 0;
 687 }
 688
 689 int
 690 meta_subtree_free( metasubtree_t *ms )
 691 {
 692         switch ( ms->ms_type ) {
 693         case META_ST_SUBTREE:
 694         case META_ST_SUBORDINATE:
 695                 ber_memfree( ms->ms_dn.bv_val );
 696                 break;
 697
 698         case META_ST_REGEX:
 699                 regfree( &ms->ms_regex );
 700                 ber_memfree( ms->ms_regex_pattern.bv_val );
 701                 break;
 702
 703         default:
 704                 return -1;
 705         }
 706
 707         ch_free( ms );
 708         return 0;
 709 }
 710
 711 int
 712 meta_subtree_destroy( metasubtree_t *ms )
 713 {
 714         if ( ms->ms_next ) {
 715                 meta_subtree_destroy( ms->ms_next );
 716         }
 717
 718         return meta_subtree_free( ms );
 719 }
 720
 721 static struct berval st_styles[] = {
 722         BER_BVC("subtree"),
 723         BER_BVC("children"),
 724         BER_BVC("regex")
 725 };
 726
 727 static int
 728 meta_subtree_unparse(
 729         ConfigArgs *c,
 730         metatarget_t *mt )
 731 {
 732         metasubtree_t   *ms;
 733         struct berval bv, *style;
 734
 735         if ( !mt->mt_subtree )
 736                 return 1;
 737
 738         /* can only be one of exclude or include */
 739         if (( c->type == LDAP_BACK_CFG_SUBTREE_EX ) ^ mt->mt_subtree_exclude )
 740                 return 1;
 741
 742         bv.bv_val = c->cr_msg;
 743         for ( ms=mt->mt_subtree; ms; ms=ms->ms_next ) {
 744                 if (ms->ms_type == META_ST_SUBTREE)
 745                         style = &st_styles[0];
 746                 else if ( ms->ms_type == META_ST_SUBORDINATE )
 747                         style = &st_styles[1];
 748                 else if ( ms->ms_type == META_ST_REGEX )
 749                         style = &st_styles[2];
 750                 else {
 751                         assert(0);
 752                         continue;
 753                 }
 754                 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg),
 755                         "dn.%s:%s", style->bv_val, ms->ms_dn.bv_val );
 756                 value_add_one( &c->rvalue_vals, &bv );
 757         }
 758         return 0;
 759 }
 760
 761 static int
 762 meta_subtree_config(
 763         metatarget_t *mt,
 764         ConfigArgs *c )
 765 {
 766         meta_st_t       type = META_ST_SUBTREE;
 767         char            *pattern;
 768         struct berval   ndn = BER_BVNULL;
 769         metasubtree_t   *ms = NULL;
 770
 771         if ( c->type == LDAP_BACK_CFG_SUBTREE_EX ) {
 772                 if ( mt->mt_subtree && !mt->mt_subtree_exclude ) {
 773                         snprintf( c->cr_msg, sizeof(c->cr_msg),
 774                                 "\"subtree-exclude\" incompatible with previous \"subtree-include\" directives" );
 775                         return 1;
 776                 }
 777
 778                 mt->mt_subtree_exclude = 1;
 779
 780         } else {
 781                 if ( mt->mt_subtree && mt->mt_subtree_exclude ) {
 782                         snprintf( c->cr_msg, sizeof(c->cr_msg),
 783                                 "\"subtree-include\" incompatible with previous \"subtree-exclude\" directives" );
 784                         return 1;
 785                 }
 786         }
 787
 788         pattern = c->argv[1];
 789         if ( strncasecmp( pattern, "dn", STRLENOF( "dn" ) ) == 0 ) {
 790                 char *style;
 791
 792                 pattern = &pattern[STRLENOF( "dn")];
 793
 794                 if ( pattern[0] == '.' ) {
 795                         style = &pattern[1];
 796
 797                         if ( strncasecmp( style, "subtree", STRLENOF( "subtree" ) ) == 0 ) {
 798                                 type = META_ST_SUBTREE;
 799                                 pattern = &style[STRLENOF( "subtree" )];
 800
 801                         } else if ( strncasecmp( style, "children", STRLENOF( "children" ) ) == 0 ) {
 802                                 type = META_ST_SUBORDINATE;
 803                                 pattern = &style[STRLENOF( "children" )];
 804
 805                         } else if ( strncasecmp( style, "sub", STRLENOF( "sub" ) ) == 0 ) {
 806                                 type = META_ST_SUBTREE;
 807                                 pattern = &style[STRLENOF( "sub" )];
 808
 809                         } else if ( strncasecmp( style, "regex", STRLENOF( "regex" ) ) == 0 ) {
 810                                 type = META_ST_REGEX;
 811                                 pattern = &style[STRLENOF( "regex" )];
 812
 813                         } else {
 814                                 snprintf( c->cr_msg, sizeof(c->cr_msg), "unknown style in \"dn.<style>\"" );
 815                                 return 1;
 816                         }
 817                 }
 818
 819                 if ( pattern[0] != ':' ) {
 820                         snprintf( c->cr_msg, sizeof(c->cr_msg), "missing colon after \"dn.<style>\"" );
 821                         return 1;
 822                 }
 823                 pattern++;
 824         }
 825
 826         switch ( type ) {
 827         case META_ST_SUBTREE:
 828         case META_ST_SUBORDINATE: {
 829                 struct berval dn;
 830
 831                 ber_str2bv( pattern, 0, 0, &dn );
 832                 if ( dnNormalize( 0, NULL, NULL, &dn, &ndn, NULL )
 833                         != LDAP_SUCCESS )
 834                 {
 835                         snprintf( c->cr_msg, sizeof(c->cr_msg), "DN=\"%s\" is invalid", pattern );
 836                         return 1;
 837                 }
 838
 839                 if ( !dnIsSuffix( &ndn, &mt->mt_nsuffix ) ) {
 840                         snprintf( c->cr_msg, sizeof(c->cr_msg),
 841                                 "DN=\"%s\" is not a subtree of target \"%s\"",
 842                                 pattern, mt->mt_nsuffix.bv_val );
 843                         ber_memfree( ndn.bv_val );
 844                         return( 1 );
 845                 }
 846                 } break;
 847
 848         default:
 849                 /* silence warnings */
 850                 break;
 851         }
 852
 853         ms = ch_calloc( sizeof( metasubtree_t ), 1 );
 854         ms->ms_type = type;
 855
 856         switch ( ms->ms_type ) {
 857         case META_ST_SUBTREE:
 858         case META_ST_SUBORDINATE:
 859                 ms->ms_dn = ndn;
 860                 break;
 861
 862         case META_ST_REGEX: {
 863                 int rc;
 864
 865                 rc = regcomp( &ms->ms_regex, pattern, REG_EXTENDED|REG_ICASE );
 866                 if ( rc != 0 ) {
 867                         char regerr[ SLAP_TEXT_BUFLEN ];
 868
 869                         regerror( rc, &ms->ms_regex, regerr, sizeof(regerr) );
 870
 871                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
 872                                 "regular expression \"%s\" bad because of %s",
 873                                 pattern, regerr );
 874                         ch_free( ms );
 875                         return 1;
 876                 }
 877                 ber_str2bv( pattern, 0, 1, &ms->ms_regex_pattern );
 878                 } break;
 879         }
 880
 881         if ( mt->mt_subtree == NULL ) {
 882                  mt->mt_subtree = ms;
 883
 884         } else {
 885                 metasubtree_t **msp;
 886
 887                 for ( msp = &mt->mt_subtree; *msp; ) {
 888                         switch ( ms->ms_type ) {
 889                         case META_ST_SUBTREE:
 890                                 switch ( (*msp)->ms_type ) {
 891                                 case META_ST_SUBTREE:
 892                                         if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
 893                                                 metasubtree_t *tmp = *msp;
 894                                                 Debug( LDAP_DEBUG_CONFIG,
 895                                                         "%s: previous rule \"dn.subtree:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
 896                                                         c->log, pattern, (*msp)->ms_dn.bv_val );
 897                                                 *msp = (*msp)->ms_next;
 898                                                 tmp->ms_next = NULL;
 899                                                 meta_subtree_destroy( tmp );
 900                                                 continue;
 901
 902                                         } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) ) {
 903                                                 Debug( LDAP_DEBUG_CONFIG,
 904                                                         "%s: previous rule \"dn.subtree:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
 905                                                         c->log, (*msp)->ms_dn.bv_val, pattern );
 906                                                 meta_subtree_destroy( ms );
 907                                                 ms = NULL;
 908                                                 return( 0 );
 909                                         }
 910                                         break;
 911
 912                                 case META_ST_SUBORDINATE:
 913                                         if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
 914                                                 metasubtree_t *tmp = *msp;
 915                                                 Debug( LDAP_DEBUG_CONFIG,
 916                                                         "%s: previous rule \"dn.children:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
 917                                                         c->log, pattern, (*msp)->ms_dn.bv_val );
 918                                                 *msp = (*msp)->ms_next;
 919                                                 tmp->ms_next = NULL;
 920                                                 meta_subtree_destroy( tmp );
 921                                                 continue;
 922
 923                                         } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) && ms->ms_dn.bv_len > (*msp)->ms_dn.bv_len ) {
 924                                                 Debug( LDAP_DEBUG_CONFIG,
 925                                                         "%s: previous rule \"dn.children:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
 926                                                         c->log, (*msp)->ms_dn.bv_val, pattern );
 927                                                 meta_subtree_destroy( ms );
 928                                                 ms = NULL;
 929                                                 return( 0 );
 930                                         }
 931                                         break;
 932
 933                                 case META_ST_REGEX:
 934                                         if ( regexec( &(*msp)->ms_regex, ms->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
 935                                                 Debug( LDAP_DEBUG_CONFIG,
 936                                                         "%s: previous rule \"dn.regex:%s\" may contain rule \"dn.subtree:%s\"\n",
 937                                                         c->log, (*msp)->ms_regex_pattern.bv_val, ms->ms_dn.bv_val );
 938                                         }
 939                                         break;
 940                                 }
 941                                 break;
 942
 943                         case META_ST_SUBORDINATE:
 944                                 switch ( (*msp)->ms_type ) {
 945                                 case META_ST_SUBTREE:
 946                                         if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
 947                                                 metasubtree_t *tmp = *msp;
 948                                                 Debug( LDAP_DEBUG_CONFIG,
 949                                                         "%s: previous rule \"dn.children:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
 950                                                         c->log, pattern, (*msp)->ms_dn.bv_val );
 951                                                 *msp = (*msp)->ms_next;
 952                                                 tmp->ms_next = NULL;
 953                                                 meta_subtree_destroy( tmp );
 954                                                 continue;
 955
 956                                         } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) && ms->ms_dn.bv_len > (*msp)->ms_dn.bv_len ) {
 957                                                 Debug( LDAP_DEBUG_CONFIG,
 958                                                         "%s: previous rule \"dn.children:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
 959                                                         c->log, (*msp)->ms_dn.bv_val, pattern );
 960                                                 meta_subtree_destroy( ms );
 961                                                 ms = NULL;
 962                                                 return( 0 );
 963                                         }
 964                                         break;
 965
 966                                 case META_ST_SUBORDINATE:
 967                                         if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
 968                                                 metasubtree_t *tmp = *msp;
 969                                                 Debug( LDAP_DEBUG_CONFIG,
 970                                                         "%s: previous rule \"dn.children:%s\" is contained in rule \"dn.children:%s\" (replaced)\n",
 971                                                         c->log, pattern, (*msp)->ms_dn.bv_val );
 972                                                 *msp = (*msp)->ms_next;
 973                                                 tmp->ms_next = NULL;
 974                                                 meta_subtree_destroy( tmp );
 975                                                 continue;
 976
 977                                         } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) ) {
 978                                                 Debug( LDAP_DEBUG_CONFIG,
 979                                                         "%s: previous rule \"dn.children:%s\" contains rule \"dn.children:%s\" (ignored)\n",
 980                                                         c->log, (*msp)->ms_dn.bv_val, pattern );
 981                                                 meta_subtree_destroy( ms );
 982                                                 ms = NULL;
 983                                                 return( 0 );
 984                                         }
 985                                         break;
 986
 987                                 case META_ST_REGEX:
 988                                         if ( regexec( &(*msp)->ms_regex, ms->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
 989                                                 Debug( LDAP_DEBUG_CONFIG,
 990                                                         "%s: previous rule \"dn.regex:%s\" may contain rule \"dn.subtree:%s\"\n",
 991                                                         c->log, (*msp)->ms_regex_pattern.bv_val, ms->ms_dn.bv_val );
 992                                         }
 993                                         break;
 994                                 }
 995                                 break;
 996
 997                         case META_ST_REGEX:
 998                                 switch ( (*msp)->ms_type ) {
 999                                 case META_ST_SUBTREE:
1000                                 case META_ST_SUBORDINATE:
1001                                         if ( regexec( &ms->ms_regex, (*msp)->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
1002                                                 Debug( LDAP_DEBUG_CONFIG,
1003                                                         "%s: previous rule \"dn.subtree:%s\" may be contained in rule \"dn.regex:%s\"\n",
1004                                                         c->log, (*msp)->ms_dn.bv_val, ms->ms_regex_pattern.bv_val );
1005                                         }
1006                                         break;
1007
1008                                 case META_ST_REGEX:
1009                                         /* no check possible */
1010                                         break;
1011                                 }
1012                                 break;
1013                         }
1014
1015                         msp = &(*msp)->ms_next;
1016                 }
1017
1018                 *msp = ms;
1019         }
1020
1021         return 0;
1022 }
1023
1024 static slap_verbmasks idassert_mode[] = {
1025         { BER_BVC("self"),              LDAP_BACK_IDASSERT_SELF },
1026         { BER_BVC("anonymous"),         LDAP_BACK_IDASSERT_ANONYMOUS },
1027         { BER_BVC("none"),              LDAP_BACK_IDASSERT_NOASSERT },
1028         { BER_BVC("legacy"),            LDAP_BACK_IDASSERT_LEGACY },
1029         { BER_BVNULL,                   0 }
1030 };
1031
1032 static slap_verbmasks tls_mode[] = {
1033         { BER_BVC( "propagate" ),       LDAP_BACK_F_TLS_PROPAGATE_MASK },
1034         { BER_BVC( "try-propagate" ),   LDAP_BACK_F_PROPAGATE_TLS },
1035         { BER_BVC( "start" ),           LDAP_BACK_F_TLS_USE_MASK },
1036         { BER_BVC( "try-start" ),       LDAP_BACK_F_USE_TLS },
1037         { BER_BVC( "ldaps" ),           LDAP_BACK_F_TLS_LDAPS },
1038         { BER_BVC( "none" ),            LDAP_BACK_F_NONE },
1039         { BER_BVNULL,                   0 }
1040 };
1041
1042 static slap_verbmasks t_f_mode[] = {
1043         { BER_BVC( "yes" ),             LDAP_BACK_F_T_F },
1044         { BER_BVC( "discover" ),        LDAP_BACK_F_T_F_DISCOVER },
1045         { BER_BVC( "no" ),              LDAP_BACK_F_NONE },
1046         { BER_BVNULL,                   0 }
1047 };
1048
1049 static slap_verbmasks cancel_mode[] = {
1050         { BER_BVC( "ignore" ),          LDAP_BACK_F_CANCEL_IGNORE },
1051         { BER_BVC( "exop" ),            LDAP_BACK_F_CANCEL_EXOP },
1052         { BER_BVC( "exop-discover" ),   LDAP_BACK_F_CANCEL_EXOP_DISCOVER },
1053         { BER_BVC( "abandon" ),         LDAP_BACK_F_CANCEL_ABANDON },
1054         { BER_BVNULL,                   0 }
1055 };
1056
1057 static slap_verbmasks onerr_mode[] = {
1058         { BER_BVC( "stop" ),            META_BACK_F_ONERR_STOP },
1059         { BER_BVC( "report" ),  META_BACK_F_ONERR_REPORT },
1060         { BER_BVC( "continue" ),                LDAP_BACK_F_NONE },
1061         { BER_BVNULL,                   0 }
1062 };
1063
1064 /* see enum in slap.h */
1065 static slap_cf_aux_table timeout_table[] = {
1066         { BER_BVC("bind="),     SLAP_OP_BIND * sizeof( time_t ),        'u', 0, NULL },
1067         /* unbind makes no sense */
1068         { BER_BVC("add="),      SLAP_OP_ADD * sizeof( time_t ),         'u', 0, NULL },
1069         { BER_BVC("delete="),   SLAP_OP_DELETE * sizeof( time_t ),      'u', 0, NULL },
1070         { BER_BVC("modrdn="),   SLAP_OP_MODRDN * sizeof( time_t ),      'u', 0, NULL },
1071         { BER_BVC("modify="),   SLAP_OP_MODIFY * sizeof( time_t ),      'u', 0, NULL },
1072         { BER_BVC("compare="),  SLAP_OP_COMPARE * sizeof( time_t ),     'u', 0, NULL },
1073         { BER_BVC("search="),   SLAP_OP_SEARCH * sizeof( time_t ),      'u', 0, NULL },
1074         /* abandon makes little sense */
1075 #if 0   /* not implemented yet */
1076         { BER_BVC("extended="), SLAP_OP_EXTENDED * sizeof( time_t ),    'u', 0, NULL },
1077 #endif
1078         { BER_BVNULL, 0, 0, 0, NULL }
1079 };
1080
1081 static int
1082 meta_back_cf_gen( ConfigArgs *c )
1083 {
1084         metainfo_t      *mi = ( metainfo_t * )c->be->be_private;
1085         metatarget_t    *mt;
1086         metacommon_t    *mc;
1087
1088         int i, rc = 0;
1089
1090         assert( mi != NULL );
1091
1092         if ( c->op == SLAP_CONFIG_EMIT ) {
1093                 struct berval bv = BER_BVNULL;
1094
1095                 if ( !mi )
1096                         return 1;
1097
1098                 if ( c->table == Cft_Database ) {
1099                         mt = NULL;
1100                         mc = &mi->mi_mc;
1101                 } else {
1102                         mt = c->ca_private;
1103                         mc = &mt->mt_mc;
1104                 }
1105
1106                 switch( c->type ) {
1107                 /* Base attrs */
1108                 case LDAP_BACK_CFG_CONN_TTL:
1109                         if ( mi->mi_conn_ttl == 0 ) {
1110                                 return 1;
1111                         } else {
1112                                 char    buf[ SLAP_TEXT_BUFLEN ];
1113
1114                                 lutil_unparse_time( buf, sizeof( buf ), mi->mi_conn_ttl );
1115                                 ber_str2bv( buf, 0, 0, &bv );
1116                                 value_add_one( &c->rvalue_vals, &bv );
1117                         }
1118                         break;
1119
1120                 case LDAP_BACK_CFG_DNCACHE_TTL:
1121                         if ( mi->mi_cache.ttl == META_DNCACHE_DISABLED ) {
1122                                 return 1;
1123                         } else if ( mi->mi_cache.ttl == META_DNCACHE_FOREVER ) {
1124                                 BER_BVSTR( &bv, "forever" );
1125                         } else {
1126                                 char    buf[ SLAP_TEXT_BUFLEN ];
1127
1128                                 lutil_unparse_time( buf, sizeof( buf ), mi->mi_cache.ttl );
1129                                 ber_str2bv( buf, 0, 0, &bv );
1130                         }
1131                         value_add_one( &c->rvalue_vals, &bv );
1132                         break;
1133
1134                 case LDAP_BACK_CFG_IDLE_TIMEOUT:
1135                         if ( mi->mi_idle_timeout == 0 ) {
1136                                 return 1;
1137                         } else {
1138                                 char    buf[ SLAP_TEXT_BUFLEN ];
1139
1140                                 lutil_unparse_time( buf, sizeof( buf ), mi->mi_idle_timeout );
1141                                 ber_str2bv( buf, 0, 0, &bv );
1142                                 value_add_one( &c->rvalue_vals, &bv );
1143                         }
1144                         break;
1145
1146                 case LDAP_BACK_CFG_ONERR:
1147                         enum_to_verb( onerr_mode, mi->mi_flags & META_BACK_F_ONERR_MASK, &bv );
1148                         if ( BER_BVISNULL( &bv )) {
1149                                 rc = 1;
1150                         } else {
1151                                 value_add_one( &c->rvalue_vals, &bv );
1152                         }
1153                         break;
1154
1155                 case LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER:
1156                         c->value_int = META_BACK_DEFER_ROOTDN_BIND( mi );
1157                         break;
1158
1159                 case LDAP_BACK_CFG_SINGLECONN:
1160                         c->value_int = LDAP_BACK_SINGLECONN( mi );
1161                         break;
1162
1163                 case LDAP_BACK_CFG_USETEMP:
1164                         c->value_int = LDAP_BACK_USE_TEMPORARIES( mi );
1165                         break;
1166
1167                 case LDAP_BACK_CFG_CONNPOOLMAX:
1168                         c->value_int = mi->mi_conn_priv_max;
1169                         break;
1170
1171                 /* common attrs */
1172                 case LDAP_BACK_CFG_BIND_TIMEOUT:
1173                         if ( mc->mc_bind_timeout.tv_sec == 0 &&
1174                                 mc->mc_bind_timeout.tv_usec == 0 ) {
1175                                 return 1;
1176                         } else {
1177                                 c->value_ulong = mc->mc_bind_timeout.tv_sec * 1000000UL +
1178                                         mc->mc_bind_timeout.tv_usec;
1179                         }
1180                         break;
1181
1182                 case LDAP_BACK_CFG_CANCEL: {
1183                         slap_mask_t     mask = LDAP_BACK_F_CANCEL_MASK2;
1184
1185                         if ( mt && META_BACK_TGT_CANCEL_DISCOVER( mt ) ) {
1186                                 mask &= ~LDAP_BACK_F_CANCEL_EXOP;
1187                         }
1188                         enum_to_verb( cancel_mode, (mc->mc_flags & mask), &bv );
1189                         if ( BER_BVISNULL( &bv ) ) {
1190                                 /* there's something wrong... */
1191                                 assert( 0 );
1192                                 rc = 1;
1193
1194                         } else {
1195                                 value_add_one( &c->rvalue_vals, &bv );
1196                         }
1197                         } break;
1198
1199                 case LDAP_BACK_CFG_CHASE:
1200                         c->value_int = META_BACK_CMN_CHASE_REFERRALS(mc);
1201                         break;
1202
1203 #ifdef SLAPD_META_CLIENT_PR
1204                 case LDAP_BACK_CFG_CLIENT_PR:
1205                         if ( mc->mc_ps == META_CLIENT_PR_DISABLE ) {
1206                                 return 1;
1207                         } else if ( mc->mc_ps == META_CLIENT_PR_ACCEPT_UNSOLICITED ) {
1208                                 BER_BVSTR( &bv, "accept-unsolicited" );
1209                         } else {
1210                                 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d", mc->mc_ps );
1211                                 bv.bv_val = c->cr_msg;
1212                         }
1213                         value_add_one( &c->rvalue_vals, &bv );
1214                         break;
1215 #endif /* SLAPD_META_CLIENT_PR */
1216
1217                 case LDAP_BACK_CFG_DEFAULT_T:
1218                         if ( mt || mi->mi_defaulttarget == META_DEFAULT_TARGET_NONE )
1219                                 return 1;
1220                         bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d", mi->mi_defaulttarget );
1221                         bv.bv_val = c->cr_msg;
1222                         value_add_one( &c->rvalue_vals, &bv );
1223                         break;
1224
1225                 case LDAP_BACK_CFG_NETWORK_TIMEOUT:
1226                         if ( mc->mc_network_timeout == 0 ) {
1227                                 return 1;
1228                         }
1229                         bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%ld",
1230                                 mc->mc_network_timeout );
1231                         bv.bv_val = c->cr_msg;
1232                         value_add_one( &c->rvalue_vals, &bv );
1233                         break;
1234
1235                 case LDAP_BACK_CFG_NOREFS:
1236                         c->value_int = META_BACK_CMN_NOREFS(mc);
1237                         break;
1238
1239                 case LDAP_BACK_CFG_NOUNDEFFILTER:
1240                         c->value_int = META_BACK_CMN_NOUNDEFFILTER(mc);
1241                         break;
1242
1243                 case LDAP_BACK_CFG_NRETRIES:
1244                         if ( mc->mc_nretries == META_RETRY_FOREVER ) {
1245                                 BER_BVSTR( &bv, "forever" );
1246                         } else if ( mc->mc_nretries == META_RETRY_NEVER ) {
1247                                 BER_BVSTR( &bv, "never" );
1248                         } else {
1249                                 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d",
1250                                         mc->mc_nretries );
1251                                 bv.bv_val = c->cr_msg;
1252                         }
1253                         value_add_one( &c->rvalue_vals, &bv );
1254                         break;
1255
1256                 case LDAP_BACK_CFG_QUARANTINE:
1257                         if ( !META_BACK_CMN_QUARANTINE( mc )) {
1258                                 rc = 1;
1259                                 break;
1260                         }
1261                         rc = mi->mi_ldap_extra->retry_info_unparse( &mc->mc_quarantine, &bv );
1262                         if ( rc == 0 ) {
1263                                 ber_bvarray_add( &c->rvalue_vals, &bv );
1264                         }
1265                         break;
1266
1267                 case LDAP_BACK_CFG_REBIND:
1268                         c->value_int = META_BACK_CMN_SAVECRED(mc);
1269                         break;
1270
1271                 case LDAP_BACK_CFG_TIMEOUT:
1272                         for ( i = 0; i < SLAP_OP_LAST; i++ ) {
1273                                 if ( mc->mc_timeout[ i ] != 0 ) {
1274                                         break;
1275                                 }
1276                         }
1277
1278                         if ( i == SLAP_OP_LAST ) {
1279                                 return 1;
1280                         }
1281
1282                         BER_BVZERO( &bv );
1283                         slap_cf_aux_table_unparse( mc->mc_timeout, &bv, timeout_table );
1284
1285                         if ( BER_BVISNULL( &bv ) ) {
1286                                 return 1;
1287                         }
1288
1289                         for ( i = 0; isspace( (unsigned char) bv.bv_val[ i ] ); i++ )
1290                                 /* count spaces */ ;
1291
1292                         if ( i ) {
1293                                 bv.bv_len -= i;
1294                                 AC_MEMCPY( bv.bv_val, &bv.bv_val[ i ],
1295                                         bv.bv_len + 1 );
1296                         }
1297
1298                         ber_bvarray_add( &c->rvalue_vals, &bv );
1299                         break;
1300
1301                 case LDAP_BACK_CFG_VERSION:
1302                         if ( mc->mc_version == 0 )
1303                                 return 1;
1304                         c->value_int = mc->mc_version;
1305                         break;
1306
1307 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
1308                 case LDAP_BACK_CFG_ST_REQUEST:
1309                         c->value_int = META_BACK_CMN_ST_REQUEST( mc );
1310                         break;
1311 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
1312
1313                 case LDAP_BACK_CFG_T_F:
1314                         enum_to_verb( t_f_mode, (mc->mc_flags & LDAP_BACK_F_T_F_MASK2), &bv );
1315                         if ( BER_BVISNULL( &bv ) ) {
1316                                 /* there's something wrong... */
1317                                 assert( 0 );
1318                                 rc = 1;
1319
1320                         } else {
1321                                 value_add_one( &c->rvalue_vals, &bv );
1322                         }
1323                         break;
1324
1325                 case LDAP_BACK_CFG_TLS: {
1326                         struct berval bc = BER_BVNULL, bv2;
1327
1328                         if (( mc->mc_flags & LDAP_BACK_F_TLS_MASK ) == LDAP_BACK_F_NONE ) {
1329                                 rc = 1;
1330                                 break;
1331                         }
1332                         enum_to_verb( tls_mode, ( mc->mc_flags & LDAP_BACK_F_TLS_MASK ), &bv );
1333                         assert( !BER_BVISNULL( &bv ) );
1334
1335                         if ( mt ) {
1336                                 bindconf_tls_unparse( &mt->mt_tls, &bc );
1337                         }
1338
1339                         if ( !BER_BVISEMPTY( &bc )) {
1340                                 bv2.bv_len = bv.bv_len + bc.bv_len + 1;
1341                                 bv2.bv_val = ch_malloc( bv2.bv_len + 1 );
1342                                 strcpy( bv2.bv_val, bv.bv_val );
1343                                 bv2.bv_val[bv.bv_len] = ' ';
1344                                 strcpy( &bv2.bv_val[bv.bv_len + 1], bc.bv_val );
1345                                 ber_memfree( bc.bv_val );
1346                                 ber_bvarray_add( &c->rvalue_vals, &bv2 );
1347                         } else {
1348                                 value_add_one( &c->rvalue_vals, &bv );
1349                         }
1350                         } break;
1351
1352                 /* target attrs */
1353                 case LDAP_BACK_CFG_URI: {
1354                         char *p2, *p1 = strchr( mt->mt_uri, ' ' );
1355                         bv.bv_len = strlen( mt->mt_uri ) + 3 + mt->mt_psuffix.bv_len;
1356                         bv.bv_val = ch_malloc( bv.bv_len + 1 );
1357                         p2 = bv.bv_val;
1358                         *p2++ = '"';
1359                         if ( p1 ) {
1360                                 p2 = lutil_strncopy( p2, mt->mt_uri, p1 - mt->mt_uri );
1361                         } else {
1362                                 p2 = lutil_strcopy( p2, mt->mt_uri );
1363                         }
1364                         *p2++ = '/';
1365                         p2 = lutil_strcopy( p2, mt->mt_psuffix.bv_val );
1366                         *p2++ = '"';
1367                         if ( p1 ) {
1368                                 strcpy( p2, p1 );
1369                         }
1370                         ber_bvarray_add( &c->rvalue_vals, &bv );
1371                         } break;
1372
1373                 case LDAP_BACK_CFG_ACL_AUTHCDN:
1374                 case LDAP_BACK_CFG_ACL_PASSWD:
1375                         /* FIXME no point here, there is no code implementing
1376                          * their features. Was this supposed to implement
1377                          * acl-bind like back-ldap?
1378                          */
1379                         rc = 1;
1380                         break;
1381
1382                 case LDAP_BACK_CFG_IDASSERT_AUTHZFROM: {
1383                         BerVarray       *bvp;
1384                         int             i;
1385                         struct berval   bv = BER_BVNULL;
1386                         char            buf[SLAP_TEXT_BUFLEN];
1387
1388                         bvp = &mt->mt_idassert_authz;
1389                         if ( *bvp == NULL ) {
1390                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_AUTHZ_ALL )
1391                                 {
1392                                         BER_BVSTR( &bv, "*" );
1393                                         value_add_one( &c->rvalue_vals, &bv );
1394
1395                                 } else {
1396                                         rc = 1;
1397                                 }
1398                                 break;
1399                         }
1400
1401                         for ( i = 0; !BER_BVISNULL( &((*bvp)[ i ]) ); i++ ) {
1402                                 char *ptr;
1403                                 int len = snprintf( buf, sizeof( buf ), SLAP_X_ORDERED_FMT, i );
1404                                 bv.bv_len = ((*bvp)[ i ]).bv_len + len;
1405                                 bv.bv_val = ber_memrealloc( bv.bv_val, bv.bv_len + 1 );
1406                                 ptr = bv.bv_val;
1407                                 ptr = lutil_strcopy( ptr, buf );
1408                                 ptr = lutil_strncopy( ptr, ((*bvp)[ i ]).bv_val, ((*bvp)[ i ]).bv_len );
1409                                 value_add_one( &c->rvalue_vals, &bv );
1410                         }
1411                         if ( bv.bv_val ) {
1412                                 ber_memfree( bv.bv_val );
1413                         }
1414                         break;
1415                 }
1416
1417                 case LDAP_BACK_CFG_IDASSERT_BIND: {
1418                         int             i;
1419                         struct berval   bc = BER_BVNULL;
1420                         char            *ptr;
1421
1422                         if ( mt->mt_idassert_authmethod == LDAP_AUTH_NONE ) {
1423                                 return 1;
1424                         } else {
1425                                 ber_len_t       len;
1426
1427                                 switch ( mt->mt_idassert_mode ) {
1428                                 case LDAP_BACK_IDASSERT_OTHERID:
1429                                 case LDAP_BACK_IDASSERT_OTHERDN:
1430                                         break;
1431
1432                                 default: {
1433                                         struct berval   mode = BER_BVNULL;
1434
1435                                         enum_to_verb( idassert_mode, mt->mt_idassert_mode, &mode );
1436                                         if ( BER_BVISNULL( &mode ) ) {
1437                                                 /* there's something wrong... */
1438                                                 assert( 0 );
1439                                                 rc = 1;
1440
1441                                         } else {
1442                                                 bv.bv_len = STRLENOF( "mode=" ) + mode.bv_len;
1443                                                 bv.bv_val = ch_malloc( bv.bv_len + 1 );
1444
1445                                                 ptr = lutil_strcopy( bv.bv_val, "mode=" );
1446                                                 ptr = lutil_strcopy( ptr, mode.bv_val );
1447                                         }
1448                                         break;
1449                                 }
1450                                 }
1451
1452                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_NATIVE_AUTHZ ) {
1453                                         len = bv.bv_len + STRLENOF( "authz=native" );
1454
1455                                         if ( !BER_BVISEMPTY( &bv ) ) {
1456                                                 len += STRLENOF( " " );
1457                                         }
1458
1459                                         bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
1460
1461                                         ptr = &bv.bv_val[ bv.bv_len ];
1462
1463                                         if ( !BER_BVISEMPTY( &bv ) ) {
1464                                                 ptr = lutil_strcopy( ptr, " " );
1465                                         }
1466
1467                                         (void)lutil_strcopy( ptr, "authz=native" );
1468                                 }
1469
1470                                 len = bv.bv_len + STRLENOF( "flags=non-prescriptive,override,obsolete-encoding-workaround,proxy-authz-non-critical,dn-authzid" );
1471                                 /* flags */
1472                                 if ( !BER_BVISEMPTY( &bv ) ) {
1473                                         len += STRLENOF( " " );
1474                                 }
1475
1476                                 bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
1477
1478                                 ptr = &bv.bv_val[ bv.bv_len ];
1479
1480                                 if ( !BER_BVISEMPTY( &bv ) ) {
1481                                         ptr = lutil_strcopy( ptr, " " );
1482                                 }
1483
1484                                 ptr = lutil_strcopy( ptr, "flags=" );
1485
1486                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_PRESCRIPTIVE ) {
1487                                         ptr = lutil_strcopy( ptr, "prescriptive" );
1488                                 } else {
1489                                         ptr = lutil_strcopy( ptr, "non-prescriptive" );
1490                                 }
1491
1492                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OVERRIDE ) {
1493                                         ptr = lutil_strcopy( ptr, ",override" );
1494                                 }
1495
1496                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_PROXY_AUTHZ ) {
1497                                         ptr = lutil_strcopy( ptr, ",obsolete-proxy-authz" );
1498
1499                                 } else if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_ENCODING_WORKAROUND ) {
1500                                         ptr = lutil_strcopy( ptr, ",obsolete-encoding-workaround" );
1501                                 }
1502
1503                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_PROXYAUTHZ_CRITICAL ) {
1504                                         ptr = lutil_strcopy( ptr, ",proxy-authz-critical" );
1505
1506                                 } else {
1507                                         ptr = lutil_strcopy( ptr, ",proxy-authz-non-critical" );
1508                                 }
1509
1510 #ifdef SLAP_AUTH_DN
1511                                 switch ( mt->mt_idassert_flags & LDAP_BACK_AUTH_DN_MASK ) {
1512                                 case LDAP_BACK_AUTH_DN_AUTHZID:
1513                                         ptr = lutil_strcopy( ptr, ",dn-authzid" );
1514                                         break;
1515
1516                                 case LDAP_BACK_AUTH_DN_WHOAMI:
1517                                         ptr = lutil_strcopy( ptr, ",dn-whoami" );
1518                                         break;
1519
1520                                 default:
1521 #if 0 /* implicit */
1522                                         ptr = lutil_strcopy( ptr, ",dn-none" );
1523 #endif
1524                                         break;
1525                                 }
1526 #endif
1527
1528                                 bv.bv_len = ( ptr - bv.bv_val );
1529                                 /* end-of-flags */
1530                         }
1531
1532                         bindconf_unparse( &mt->mt_idassert.si_bc, &bc );
1533
1534                         if ( !BER_BVISNULL( &bv ) ) {
1535                                 ber_len_t       len = bv.bv_len + bc.bv_len;
1536
1537                                 bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
1538
1539                                 assert( bc.bv_val[ 0 ] == ' ' );
1540
1541                                 ptr = lutil_strcopy( &bv.bv_val[ bv.bv_len ], bc.bv_val );
1542                                 free( bc.bv_val );
1543                                 bv.bv_len = ptr - bv.bv_val;
1544
1545                         } else {
1546                                 for ( i = 0; isspace( (unsigned char) bc.bv_val[ i ] ); i++ )
1547                                         /* count spaces */ ;
1548
1549                                 if ( i ) {
1550                                         bc.bv_len -= i;
1551                                         AC_MEMCPY( bc.bv_val, &bc.bv_val[ i ], bc.bv_len + 1 );
1552                                 }
1553
1554                                 bv = bc;
1555                         }
1556
1557                         ber_bvarray_add( &c->rvalue_vals, &bv );
1558
1559                         break;
1560                 }
1561
1562                 case LDAP_BACK_CFG_SUFFIXM:     /* unused */
1563                 case LDAP_BACK_CFG_REWRITE:
1564                         if ( mt->mt_rwmap.rwm_bva_rewrite == NULL ) {
1565                                 rc = 1;
1566                         } else {
1567                                 rc = slap_bv_x_ordered_unparse( mt->mt_rwmap.rwm_bva_rewrite, &c->rvalue_vals );
1568                         }
1569                         break;
1570
1571                 case LDAP_BACK_CFG_MAP:
1572                         if ( mt->mt_rwmap.rwm_bva_map == NULL ) {
1573                                 rc = 1;
1574                         } else {
1575                                 rc = slap_bv_x_ordered_unparse( mt->mt_rwmap.rwm_bva_map, &c->rvalue_vals );
1576                         }
1577                         break;
1578
1579                 case LDAP_BACK_CFG_SUBTREE_EX:
1580                 case LDAP_BACK_CFG_SUBTREE_IN:
1581                         rc = meta_subtree_unparse( c, mt );
1582                         break;
1583
1584                 /* replaced by idassert */
1585                 case LDAP_BACK_CFG_PSEUDOROOTDN:
1586                 case LDAP_BACK_CFG_PSEUDOROOTPW:
1587                         rc = 1;
1588                         break;
1589
1590                 default:
1591                         rc = 1;
1592                 }
1593                 return rc;
1594         } else if ( c->op == LDAP_MOD_DELETE ) {
1595                 switch( c->type ) {
1596                 /* Base attrs */
1597                 case LDAP_BACK_CFG_CONN_TTL:
1598                         mi->mi_conn_ttl = 0;
1599                         break;
1600
1601                 case LDAP_BACK_CFG_DNCACHE_TTL:
1602                         mi->mi_cache.ttl = META_DNCACHE_DISABLED;
1603                         break;
1604
1605                 case LDAP_BACK_CFG_IDLE_TIMEOUT:
1606                         mi->mi_idle_timeout = 0;
1607                         break;
1608
1609                 case LDAP_BACK_CFG_ONERR:
1610                         mi->mi_flags &= ~META_BACK_F_ONERR_MASK;
1611                         break;
1612
1613                 case LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER:
1614                         mi->mi_flags &= ~META_BACK_F_DEFER_ROOTDN_BIND;
1615                         break;
1616
1617                 case LDAP_BACK_CFG_SINGLECONN:
1618                         mi->mi_flags &= ~LDAP_BACK_F_SINGLECONN;
1619                         break;
1620
1621                 case LDAP_BACK_CFG_USETEMP:
1622                         mi->mi_flags &= ~LDAP_BACK_F_USE_TEMPORARIES;
1623                         break;
1624
1625                 case LDAP_BACK_CFG_CONNPOOLMAX:
1626                         mi->mi_conn_priv_max = LDAP_BACK_CONN_PRIV_MIN;
1627                         break;
1628
1629                 /* common attrs */
1630                 case LDAP_BACK_CFG_BIND_TIMEOUT:
1631                         mc->mc_bind_timeout.tv_sec = 0;
1632                         mc->mc_bind_timeout.tv_usec = 0;
1633                         break;
1634
1635                 case LDAP_BACK_CFG_CANCEL:
1636                         mc->mc_flags &= ~LDAP_BACK_F_CANCEL_MASK2;
1637                         break;
1638
1639                 case LDAP_BACK_CFG_CHASE:
1640                         mc->mc_flags &= ~LDAP_BACK_F_CHASE_REFERRALS;
1641                         break;
1642
1643 #ifdef SLAPD_META_CLIENT_PR
1644                 case LDAP_BACK_CFG_CLIENT_PR:
1645                         mc->mc_ps == META_CLIENT_PR_DISABLE;
1646                         break;
1647 #endif /* SLAPD_META_CLIENT_PR */
1648
1649                 case LDAP_BACK_CFG_DEFAULT_T:
1650                         mi->mi_defaulttarget = META_DEFAULT_TARGET_NONE;
1651                         break;
1652
1653                 case LDAP_BACK_CFG_NETWORK_TIMEOUT:
1654                         mc->mc_network_timeout = 0;
1655                         break;
1656
1657                 case LDAP_BACK_CFG_NOREFS:
1658                         mc->mc_flags &= ~LDAP_BACK_F_NOREFS;
1659                         break;
1660
1661                 case LDAP_BACK_CFG_NOUNDEFFILTER:
1662                         mc->mc_flags &= ~LDAP_BACK_F_NOUNDEFFILTER;
1663                         break;
1664
1665                 case LDAP_BACK_CFG_NRETRIES:
1666                         mc->mc_nretries == META_RETRY_DEFAULT;
1667                         break;
1668
1669                 case LDAP_BACK_CFG_QUARANTINE:
1670                         if ( META_BACK_CMN_QUARANTINE( mc )) {
1671                                 mi->mi_ldap_extra->retry_info_destroy( &mc->mc_quarantine );
1672                                 mc->mc_flags &= ~LDAP_BACK_F_QUARANTINE;
1673                                 if ( mc == &mt->mt_mc ) {
1674                                         ldap_pvt_thread_mutex_destroy( &mt->mt_quarantine_mutex );
1675                                         mt->mt_isquarantined = 0;
1676                                 }
1677                         }
1678                         break;
1679
1680                 case LDAP_BACK_CFG_REBIND:
1681                         mc->mc_flags &= ~LDAP_BACK_F_SAVECRED;
1682                         break;
1683
1684                 case LDAP_BACK_CFG_TIMEOUT:
1685                         for ( i = 0; i < SLAP_OP_LAST; i++ ) {
1686                                 mc->mc_timeout[ i ] = 0;
1687                         }
1688                         break;
1689
1690                 case LDAP_BACK_CFG_VERSION:
1691                         mc->mc_version = 0;
1692                         break;
1693
1694 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
1695                 case LDAP_BACK_CFG_ST_REQUEST:
1696                         mc->mc_flags &= ~LDAP_BACK_F_ST_REQUEST;
1697                         break;
1698 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
1699
1700                 case LDAP_BACK_CFG_T_F:
1701                         mc->mc_flags &= ~LDAP_BACK_F_T_F_MASK2;
1702                         break;
1703
1704                 case LDAP_BACK_CFG_TLS:
1705                         mc->mc_flags &= ~LDAP_BACK_F_TLS_MASK;
1706                         if ( mt )
1707                                 bindconf_free( &mt->mt_tls );
1708                         break;
1709
1710                 /* target attrs */
1711                 case LDAP_BACK_CFG_URI:
1712                         if ( mt->mt_uri ) {
1713                                 ch_free( mt->mt_uri );
1714                                 mt->mt_uri = NULL;
1715                         }
1716                         /* FIXME: should have a way to close all cached
1717                          * connections associated with this target.
1718                          */
1719                         break;
1720
1721                 case LDAP_BACK_CFG_IDASSERT_AUTHZFROM: {
1722                         BerVarray *bvp;
1723
1724                         bvp = &mt->mt_idassert_authz; break;
1725                         if ( c->valx < 0 ) {
1726                                 if ( *bvp != NULL ) {
1727                                         ber_bvarray_free( *bvp );
1728                                         *bvp = NULL;
1729                                 }
1730
1731                         } else {
1732                                 if ( *bvp == NULL ) {
1733                                         rc = 1;
1734                                         break;
1735                                 }
1736
1737                                 for ( i = 0; !BER_BVISNULL( &((*bvp)[ i ]) ); i++ )
1738                                         ;
1739
1740                                 if ( i >= c->valx ) {
1741                                         rc = 1;
1742                                         break;
1743                                 }
1744                                 ber_memfree( ((*bvp)[ c->valx ]).bv_val );
1745                                 for ( i = c->valx; !BER_BVISNULL( &((*bvp)[ i + 1 ]) ); i++ ) {
1746                                         (*bvp)[ i ] = (*bvp)[ i + 1 ];
1747                                 }
1748                                 BER_BVZERO( &((*bvp)[ i ]) );
1749                         }
1750                         } break;
1751
1752                 case LDAP_BACK_CFG_IDASSERT_BIND:
1753                         bindconf_free( &mt->mt_idassert.si_bc );
1754                         memset( &mt->mt_idassert, 0, sizeof( slap_idassert_t ) );
1755                         break;
1756
1757                 case LDAP_BACK_CFG_SUFFIXM:     /* unused */
1758                 case LDAP_BACK_CFG_REWRITE:
1759                         if ( mt->mt_rwmap.rwm_bva_rewrite ) {
1760                                 ber_bvarray_free( mt->mt_rwmap.rwm_bva_rewrite );
1761                                 mt->mt_rwmap.rwm_bva_rewrite = NULL;
1762                         }
1763                         if ( mt->mt_rwmap.rwm_rw )
1764                                 rewrite_info_delete( &mt->mt_rwmap.rwm_rw );
1765                         break;
1766
1767                 case LDAP_BACK_CFG_MAP:
1768                         if ( mt->mt_rwmap.rwm_bva_map ) {
1769                                 ber_bvarray_free( mt->mt_rwmap.rwm_bva_map );
1770                                 mt->mt_rwmap.rwm_bva_map = NULL;
1771                         }
1772                         meta_back_map_free( &mt->mt_rwmap.rwm_oc );
1773                         meta_back_map_free( &mt->mt_rwmap.rwm_at );
1774                         mt->mt_rwmap.rwm_oc.drop_missing = 0;
1775                         mt->mt_rwmap.rwm_at.drop_missing = 0;
1776                         break;
1777
1778                 case LDAP_BACK_CFG_SUBTREE_EX:
1779                 case LDAP_BACK_CFG_SUBTREE_IN:
1780                         /* can only be one of exclude or include */
1781                         if (( c->type == LDAP_BACK_CFG_SUBTREE_EX ) ^ mt->mt_subtree_exclude ) {
1782                                 rc = 1;
1783                                 break;
1784                         }
1785                         if ( c->valx < 0 ) {
1786                                 meta_subtree_destroy( mt->mt_subtree );
1787                                 mt->mt_subtree = NULL;
1788                         } else {
1789                                 metasubtree_t *ms, **mprev;
1790                                 for (i=0, mprev = &mt->mt_subtree, ms = *mprev; ms; ms = *mprev) {
1791                                         if ( i == c->valx ) {
1792                                                 *mprev = ms->ms_next;
1793                                                 meta_subtree_free( ms );
1794                                                 break;
1795                                         }
1796                                         i++;
1797                                         mprev = &ms->ms_next;
1798                                 }
1799                                 if ( i != c->valx )
1800                                         rc = 1;
1801                         }
1802                         break;
1803
1804                 default:
1805                         rc = 1;
1806                         break;
1807                 }
1808
1809                 return rc;
1810         }
1811
1812         if ( c->op == SLAP_CONFIG_ADD ) {
1813                 if ( c->type >= LDAP_BACK_CFG_LAST_BASE ) {
1814                         /* exclude CFG_URI from this check */
1815                         if ( c->type > LDAP_BACK_CFG_LAST_BOTH ) {
1816                                 if ( !mi->mi_ntargets ) {
1817                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1818                                                 "need \"uri\" directive first" );
1819                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1820                                         return 1;
1821                                 }
1822                         }
1823                         if ( mi->mi_ntargets ) {
1824                                 mt = mi->mi_targets[ mi->mi_ntargets-1 ];
1825                                 mc = &mt->mt_mc;
1826                         } else {
1827                                 mt = NULL;
1828                                 mc = &mi->mi_mc;
1829                         }
1830                 }
1831         } else {
1832                 if ( c->table == Cft_Database ) {
1833                         mt = NULL;
1834                         mc = &mi->mi_mc;
1835                 } else {
1836                         mt = c->ca_private;
1837                         if ( mt )
1838                                 mc = &mt->mt_mc;
1839                         else
1840                                 mc = NULL;
1841                 }
1842         }
1843
1844         switch( c->type ) {
1845         case LDAP_BACK_CFG_URI: {
1846                 LDAPURLDesc     *ludp;
1847                 struct berval   dn;
1848                 int             j;
1849
1850                 char            **uris = NULL;
1851
1852                 if ( c->be->be_nsuffix == NULL ) {
1853                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1854                                 "the suffix must be defined before any target" );
1855                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1856                         return 1;
1857                 }
1858
1859                 i = mi->mi_ntargets++;
1860
1861                 mi->mi_targets = ( metatarget_t ** )ch_realloc( mi->mi_targets,
1862                         sizeof( metatarget_t * ) * mi->mi_ntargets );
1863                 if ( mi->mi_targets == NULL ) {
1864                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1865                                 "out of memory while storing server name"
1866                                 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1867                                 c->argv[0] );
1868                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1869                         return 1;
1870                 }
1871
1872                 if ( meta_back_new_target( &mi->mi_targets[ i ] ) != 0 ) {
1873                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1874                                 "unable to init server"
1875                                 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1876                                 c->argv[0] );
1877                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1878                         return 1;
1879                 }
1880
1881                 mt = mi->mi_targets[ i ];
1882
1883                 mt->mt_rebind_f = mi->mi_rebind_f;
1884                 mt->mt_urllist_f = mi->mi_urllist_f;
1885                 mt->mt_urllist_p = mt;
1886
1887                 if ( META_BACK_QUARANTINE( mi ) ) {
1888                         ldap_pvt_thread_mutex_init( &mt->mt_quarantine_mutex );
1889                 }
1890                 mt->mt_mc = mi->mi_mc;
1891
1892                 for ( j = 1; j < c->argc; j++ ) {
1893                         char    **tmpuris = ldap_str2charray( c->argv[ j ], "\t" );
1894
1895                         if ( tmpuris == NULL ) {
1896                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1897                                         "unable to parse URIs #%d"
1898                                         " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1899                                         j-1, c->argv[0] );
1900                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1901                                 return 1;
1902                         }
1903
1904                         if ( j == 1 ) {
1905                                 uris = tmpuris;
1906
1907                         } else {
1908                                 ldap_charray_merge( &uris, tmpuris );
1909                                 ldap_charray_free( tmpuris );
1910                         }
1911                 }
1912
1913                 for ( j = 0; uris[ j ] != NULL; j++ ) {
1914                         char *tmpuri = NULL;
1915
1916                         /*
1917                          * uri MUST be legal!
1918                          */
1919                         if ( ldap_url_parselist_ext( &ludp, uris[ j ], "\t",
1920                                         LDAP_PVT_URL_PARSE_NONE ) != LDAP_SUCCESS
1921                                 || ludp->lud_next != NULL )
1922                         {
1923                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1924                                         "unable to parse URI #%d"
1925                                         " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1926                                         j-1, c->argv[0] );
1927                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1928                                 ldap_charray_free( uris );
1929                                 return 1;
1930                         }
1931
1932                         if ( j == 0 ) {
1933
1934                                 /*
1935                                  * uri MUST have the <dn> part!
1936                                  */
1937                                 if ( ludp->lud_dn == NULL ) {
1938                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1939                                                 "missing <naming context> "
1940                                                 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1941                                                 c->argv[0] );
1942                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1943                                         ldap_free_urllist( ludp );
1944                                         ldap_charray_free( uris );
1945                                         return 1;
1946                                 }
1947
1948                                 /*
1949                                  * copies and stores uri and suffix
1950                                  */
1951                                 ber_str2bv( ludp->lud_dn, 0, 0, &dn );
1952                                 rc = dnPrettyNormal( NULL, &dn, &mt->mt_psuffix,
1953                                         &mt->mt_nsuffix, NULL );
1954                                 if ( rc != LDAP_SUCCESS ) {
1955                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1956                                                 "target DN is invalid \"%s\"",
1957                                                 c->argv[1] );
1958                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1959                                         ldap_free_urllist( ludp );
1960                                         ldap_charray_free( uris );
1961                                         return( 1 );
1962                                 }
1963
1964                                 ludp->lud_dn[ 0 ] = '\0';
1965
1966                                 switch ( ludp->lud_scope ) {
1967                                 case LDAP_SCOPE_DEFAULT:
1968                                         mt->mt_scope = LDAP_SCOPE_SUBTREE;
1969                                         break;
1970
1971                                 case LDAP_SCOPE_SUBTREE:
1972                                 case LDAP_SCOPE_SUBORDINATE:
1973                                         mt->mt_scope = ludp->lud_scope;
1974                                         break;
1975
1976                                 default:
1977                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1978                                                 "invalid scope for target \"%s\"",
1979                                                 c->argv[1] );
1980                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1981                                         ldap_free_urllist( ludp );
1982                                         ldap_charray_free( uris );
1983                                         return( 1 );
1984                                 }
1985
1986                         } else {
1987                                 /* check all, to apply the scope check on the first one */
1988                                 if ( ludp->lud_dn != NULL && ludp->lud_dn[ 0 ] != '\0' ) {
1989                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1990                                                 "multiple URIs must have no DN part" );
1991                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1992                                         ldap_free_urllist( ludp );
1993                                         ldap_charray_free( uris );
1994                                         return( 1 );
1995
1996                                 }
1997                         }
1998
1999                         tmpuri = ldap_url_list2urls( ludp );
2000                         ldap_free_urllist( ludp );
2001                         if ( tmpuri == NULL ) {
2002                                 snprintf( c->cr_msg, sizeof( c->cr_msg ), "no memory?" );
2003                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2004                                 ldap_charray_free( uris );
2005                                 return( 1 );
2006                         }
2007                         ldap_memfree( uris[ j ] );
2008                         uris[ j ] = tmpuri;
2009                 }
2010
2011                 mt->mt_uri = ldap_charray2str( uris, " " );
2012                 ldap_charray_free( uris );
2013                 if ( mt->mt_uri == NULL) {
2014                         snprintf( c->cr_msg, sizeof( c->cr_msg ), "no memory?" );
2015                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2016                         return( 1 );
2017                 }
2018
2019                 /*
2020                  * uri MUST be a branch of suffix!
2021                  */
2022                 for ( j = 0; !BER_BVISNULL( &c->be->be_nsuffix[ j ] ); j++ ) {
2023                         if ( dnIsSuffix( &mt->mt_nsuffix, &c->be->be_nsuffix[ j ] ) ) {
2024                                 break;
2025                         }
2026                 }
2027
2028                 if ( BER_BVISNULL( &c->be->be_nsuffix[ j ] ) ) {
2029                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2030                                 "<naming context> of URI must be within the naming context of this database." );
2031                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2032                         return 1;
2033                 }
2034                 c->ca_private = mt;
2035         } break;
2036         case LDAP_BACK_CFG_SUBTREE_EX:
2037         case LDAP_BACK_CFG_SUBTREE_IN:
2038         /* subtree-exclude */
2039                 if ( meta_subtree_config( mt, c )) {
2040                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2041                         return 1;
2042                 }
2043                 break;
2044
2045         case LDAP_BACK_CFG_DEFAULT_T:
2046         /* default target directive */
2047                 i = mi->mi_ntargets - 1;
2048
2049                 if ( c->argc == 1 ) {
2050                         if ( i < 0 ) {
2051                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2052                                         "\"%s\" alone must be inside a \"uri\" directive",
2053                                         c->argv[0] );
2054                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2055                                 return 1;
2056                         }
2057                         mi->mi_defaulttarget = i;
2058
2059                 } else {
2060                         if ( strcasecmp( c->argv[ 1 ], "none" ) == 0 ) {
2061                                 if ( i >= 0 ) {
2062                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2063                                                 "\"%s none\" should go before uri definitions",
2064                                                 c->argv[0] );
2065                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2066                                 }
2067                                 mi->mi_defaulttarget = META_DEFAULT_TARGET_NONE;
2068
2069                         } else {
2070
2071                                 if ( lutil_atoi( &mi->mi_defaulttarget, c->argv[ 1 ] ) != 0
2072                                         || mi->mi_defaulttarget < 0
2073                                         || mi->mi_defaulttarget >= i - 1 )
2074                                 {
2075                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2076                                                 "illegal target number %d",
2077                                                 mi->mi_defaulttarget );
2078                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2079                                         return 1;
2080                                 }
2081                         }
2082                 }
2083                 break;
2084
2085         case LDAP_BACK_CFG_DNCACHE_TTL:
2086         /* ttl of dn cache */
2087                 if ( strcasecmp( c->argv[ 1 ], "forever" ) == 0 ) {
2088                         mi->mi_cache.ttl = META_DNCACHE_FOREVER;
2089
2090                 } else if ( strcasecmp( c->argv[ 1 ], "disabled" ) == 0 ) {
2091                         mi->mi_cache.ttl = META_DNCACHE_DISABLED;
2092
2093                 } else {
2094                         unsigned long   t;
2095
2096                         if ( lutil_parse_time( c->argv[ 1 ], &t ) != 0 ) {
2097                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2098                                         "unable to parse dncache ttl \"%s\"",
2099                                         c->argv[ 1 ] );
2100                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2101                                 return 1;
2102                         }
2103                         mi->mi_cache.ttl = (time_t)t;
2104                 }
2105                 break;
2106
2107         case LDAP_BACK_CFG_NETWORK_TIMEOUT: {
2108         /* network timeout when connecting to ldap servers */
2109                 unsigned long t;
2110
2111                 if ( lutil_parse_time( c->argv[ 1 ], &t ) ) {
2112                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2113                                 "unable to parse network timeout \"%s\"",
2114                                 c->argv[ 1 ] );
2115                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2116                         return 1;
2117                 }
2118                 mc->mc_network_timeout = (time_t)t;
2119                 } break;
2120
2121         case LDAP_BACK_CFG_IDLE_TIMEOUT: {
2122         /* idle timeout when connecting to ldap servers */
2123                 unsigned long   t;
2124
2125                 if ( lutil_parse_time( c->argv[ 1 ], &t ) ) {
2126                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2127                                 "unable to parse idle timeout \"%s\"",
2128                                 c->argv[ 1 ] );
2129                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2130                         return 1;
2131
2132                 }
2133                 mi->mi_idle_timeout = (time_t)t;
2134                 } break;
2135
2136         case LDAP_BACK_CFG_CONN_TTL: {
2137         /* conn ttl */
2138                 unsigned long   t;
2139
2140                 if ( lutil_parse_time( c->argv[ 1 ], &t ) ) {
2141                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2142                                 "unable to parse conn ttl \"%s\"",
2143                                 c->argv[ 1 ] );
2144                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2145                         return 1;
2146
2147                 }
2148                 mi->mi_conn_ttl = (time_t)t;
2149                 } break;
2150
2151         case LDAP_BACK_CFG_BIND_TIMEOUT:
2152         /* bind timeout when connecting to ldap servers */
2153                 mc->mc_bind_timeout.tv_sec = c->value_ulong/1000000;
2154                 mc->mc_bind_timeout.tv_usec = c->value_ulong%1000000;
2155                 break;
2156
2157         case LDAP_BACK_CFG_ACL_AUTHCDN:
2158         /* name to use for meta_back_group */
2159                 if ( strcasecmp( c->argv[ 0 ], "binddn" ) == 0 ) {
2160                         Debug( LDAP_DEBUG_ANY, "%s: "
2161                                 "\"binddn\" statement is deprecated; "
2162                                 "use \"acl-authcDN\" instead\n",
2163                                 c->log, 0, 0 );
2164                         /* FIXME: some day we'll need to throw an error */
2165                 }
2166
2167                 ber_memfree_x( c->value_dn.bv_val, NULL );
2168                 mt->mt_binddn = c->value_ndn;
2169                 BER_BVZERO( &c->value_dn );
2170                 BER_BVZERO( &c->value_ndn );
2171                 break;
2172
2173         case LDAP_BACK_CFG_ACL_PASSWD:
2174         /* password to use for meta_back_group */
2175                 if ( strcasecmp( c->argv[ 0 ], "bindpw" ) == 0 ) {
2176                         Debug( LDAP_DEBUG_ANY, "%s "
2177                                 "\"bindpw\" statement is deprecated; "
2178                                 "use \"acl-passwd\" instead\n",
2179                                 c->log, 0, 0 );
2180                         /* FIXME: some day we'll need to throw an error */
2181                 }
2182
2183                 ber_str2bv( c->argv[ 1 ], 0L, 1, &mt->mt_bindpw );
2184                 break;
2185
2186         case LDAP_BACK_CFG_REBIND:
2187         /* save bind creds for referral rebinds? */
2188                 if ( c->argc == 1 || c->value_int ) {
2189                         mc->mc_flags |= LDAP_BACK_F_SAVECRED;
2190                 } else {
2191                         mc->mc_flags &= ~LDAP_BACK_F_SAVECRED;
2192                 }
2193                 break;
2194
2195         case LDAP_BACK_CFG_CHASE:
2196                 if ( c->argc == 1 || c->value_int ) {
2197                         mc->mc_flags |= LDAP_BACK_F_CHASE_REFERRALS;
2198                 } else {
2199                         mc->mc_flags &= ~LDAP_BACK_F_CHASE_REFERRALS;
2200                 }
2201                 break;
2202
2203         case LDAP_BACK_CFG_TLS:
2204                 i = verb_to_mask( c->argv[1], tls_mode );
2205                 if ( BER_BVISNULL( &tls_mode[i].word ) ) {
2206                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2207                                 "%s unknown argument \"%s\"",
2208                                 c->argv[0], c->argv[1] );
2209                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2210                         return 1;
2211                 }
2212                 mc->mc_flags &= ~LDAP_BACK_F_TLS_MASK;
2213                 mc->mc_flags |= tls_mode[i].mask;
2214
2215                 if ( c->argc > 2 ) {
2216                         if ( c->op == SLAP_CONFIG_ADD && mi->mi_ntargets == 0 ) {
2217                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2218                                         "need \"uri\" directive first" );
2219                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2220                                 return 1;
2221                         }
2222
2223                         for ( i = 2; i < c->argc; i++ ) {
2224                                 if ( bindconf_tls_parse( c->argv[i], &mt->mt_tls ))
2225                                         return 1;
2226                         }
2227                         bindconf_tls_defaults( &mt->mt_tls );
2228                 }
2229                 break;
2230
2231         case LDAP_BACK_CFG_T_F:
2232                 i = verb_to_mask( c->argv[1], t_f_mode );
2233                 if ( BER_BVISNULL( &t_f_mode[i].word ) ) {
2234                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2235                                 "%s unknown argument \"%s\"",
2236                                 c->argv[0], c->argv[1] );
2237                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2238                         return 1;
2239                 }
2240                 mc->mc_flags &= ~LDAP_BACK_F_T_F_MASK2;
2241                 mc->mc_flags |= t_f_mode[i].mask;
2242                 break;
2243
2244         case LDAP_BACK_CFG_ONERR:
2245         /* onerr? */
2246                 i = verb_to_mask( c->argv[1], onerr_mode );
2247                 if ( BER_BVISNULL( &onerr_mode[i].word ) ) {
2248                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2249                                 "%s unknown argument \"%s\"",
2250                                 c->argv[0], c->argv[1] );
2251                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2252                         return 1;
2253                 }
2254                 mi->mi_flags &= ~META_BACK_F_ONERR_MASK;
2255                 mi->mi_flags |= onerr_mode[i].mask;
2256                 break;
2257
2258         case LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER:
2259         /* bind-defer? */
2260                 if ( c->argc == 1 || c->value_int ) {
2261                         mi->mi_flags |= META_BACK_F_DEFER_ROOTDN_BIND;
2262                 } else {
2263                         mi->mi_flags &= ~META_BACK_F_DEFER_ROOTDN_BIND;
2264                 }
2265                 break;
2266
2267         case LDAP_BACK_CFG_SINGLECONN:
2268         /* single-conn? */
2269                 if ( mi->mi_ntargets > 0 ) {
2270                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2271                                 "\"%s\" must appear before target definitions",
2272                                 c->argv[0] );
2273                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2274                         return( 1 );
2275                 }
2276                 if ( c->value_int ) {
2277                         mi->mi_flags |= LDAP_BACK_F_SINGLECONN;
2278                 } else {
2279                         mi->mi_flags &= ~LDAP_BACK_F_SINGLECONN;
2280                 }
2281                 break;
2282
2283         case LDAP_BACK_CFG_USETEMP:
2284         /* use-temporaries? */
2285                 if ( mi->mi_ntargets > 0 ) {
2286                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2287                                 "\"%s\" must appear before target definitions",
2288                                 c->argv[0] );
2289                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2290                         return( 1 );
2291                 }
2292                 if ( c->value_int ) {
2293                         mi->mi_flags |= LDAP_BACK_F_USE_TEMPORARIES;
2294                 } else {
2295                         mi->mi_flags &= ~LDAP_BACK_F_USE_TEMPORARIES;
2296                 }
2297                 break;
2298
2299         case LDAP_BACK_CFG_CONNPOOLMAX:
2300         /* privileged connections pool max size ? */
2301                 if ( mi->mi_ntargets > 0 ) {
2302                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2303                                 "\"%s\" must appear before target definitions",
2304                                 c->argv[0] );
2305                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2306                         return( 1 );
2307                 }
2308
2309                 if ( c->value_int < LDAP_BACK_CONN_PRIV_MIN
2310                         || c->value_int > LDAP_BACK_CONN_PRIV_MAX )
2311                 {
2312                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2313                                 "invalid max size " "of privileged "
2314                                 "connections pool \"%s\" "
2315                                 "in \"conn-pool-max <n> "
2316                                 "(must be between %d and %d)\"",
2317                                 c->argv[ 1 ],
2318                                 LDAP_BACK_CONN_PRIV_MIN,
2319                                 LDAP_BACK_CONN_PRIV_MAX );
2320                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2321                         return 1;
2322                 }
2323                 mi->mi_conn_priv_max = c->value_int;
2324                 break;
2325
2326         case LDAP_BACK_CFG_CANCEL:
2327                 i = verb_to_mask( c->argv[1], cancel_mode );
2328                 if ( BER_BVISNULL( &cancel_mode[i].word ) ) {
2329                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2330                                 "%s unknown argument \"%s\"",
2331                                 c->argv[0], c->argv[1] );
2332                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2333                         return 1;
2334                 }
2335                 mc->mc_flags &= ~LDAP_BACK_F_CANCEL_MASK2;
2336                 mc->mc_flags |= t_f_mode[i].mask;
2337                 break;
2338
2339         case LDAP_BACK_CFG_TIMEOUT:
2340                 for ( i = 1; i < c->argc; i++ ) {
2341                         if ( isdigit( (unsigned char) c->argv[ i ][ 0 ] ) ) {
2342                                 int             j;
2343                                 unsigned        u;
2344
2345                                 if ( lutil_atoux( &u, c->argv[ i ], 0 ) != 0 ) {
2346                                         snprintf( c->cr_msg, sizeof( c->cr_msg),
2347                                                 "unable to parse timeout \"%s\"",
2348                                                 c->argv[ i ] );
2349                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2350                                         return 1;
2351                                 }
2352
2353                                 for ( j = 0; j < SLAP_OP_LAST; j++ ) {
2354                                         mc->mc_timeout[ j ] = u;
2355                                 }
2356
2357                                 continue;
2358                         }
2359
2360                         if ( slap_cf_aux_table_parse( c->argv[ i ], mc->mc_timeout, timeout_table, "slapd-meta timeout" ) ) {
2361                                 snprintf( c->cr_msg, sizeof( c->cr_msg),
2362                                         "unable to parse timeout \"%s\"",
2363                                         c->argv[ i ] );
2364                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2365                                 return 1;
2366                         }
2367                 }
2368                 break;
2369
2370         case LDAP_BACK_CFG_PSEUDOROOTDN:
2371         /* name to use as pseudo-root dn */
2372                 /*
2373                  * exact replacement:
2374                  *
2375
2376 idassert-bind   bindmethod=simple
2377                 binddn=<pseudorootdn>
2378                 credentials=<pseudorootpw>
2379                 mode=none
2380                 flags=non-prescriptive
2381 idassert-authzFrom      "dn:<rootdn>"
2382
2383                  * so that only when authc'd as <rootdn> the proxying occurs
2384                  * rebinding as the <pseudorootdn> without proxyAuthz.
2385                  */
2386
2387                 Debug( LDAP_DEBUG_ANY,
2388                         "%s: \"pseudorootdn\", \"pseudorootpw\" are no longer supported; "
2389                         "use \"idassert-bind\" and \"idassert-authzFrom\" instead.\n",
2390                         c->log, 0, 0 );
2391
2392                 {
2393                         char    binddn[ SLAP_TEXT_BUFLEN ];
2394                         char    *cargv[] = {
2395                                 "idassert-bind",
2396                                 "bindmethod=simple",
2397                                 NULL,
2398                                 "mode=none",
2399                                 "flags=non-prescriptive",
2400                                 NULL
2401                         };
2402                         char **oargv;
2403                         int oargc;
2404                         int     cargc = 5;
2405                         int     rc;
2406
2407
2408                         if ( BER_BVISNULL( &c->be->be_rootndn ) ) {
2409                                 Debug( LDAP_DEBUG_ANY, "%s: \"pseudorootpw\": \"rootdn\" must be defined first.\n",
2410                                         c->log, 0, 0 );
2411                                 return 1;
2412                         }
2413
2414                         if ( sizeof( binddn ) <= (unsigned) snprintf( binddn,
2415                                         sizeof( binddn ), "binddn=%s", c->argv[ 1 ] ))
2416                         {
2417                                 Debug( LDAP_DEBUG_ANY, "%s: \"pseudorootdn\" too long.\n",
2418                                         c->log, 0, 0 );
2419                                 return 1;
2420                         }
2421                         cargv[ 2 ] = binddn;
2422
2423                         oargv = c->argv;
2424                         oargc = c->argc;
2425                         c->argv = cargv;
2426                         c->argc = cargc;
2427                         rc = mi->mi_ldap_extra->idassert_parse( c, &mt->mt_idassert );
2428                         c->argv = oargv;
2429                         c->argc = oargc;
2430                         if ( rc == 0 ) {
2431                                 struct berval   bv;
2432
2433                                 if ( mt->mt_idassert_authz != NULL ) {
2434                                         Debug( LDAP_DEBUG_ANY, "%s: \"idassert-authzFrom\" already defined (discarded).\n",
2435                                                 c->log, 0, 0 );
2436                                         ber_bvarray_free( mt->mt_idassert_authz );
2437                                         mt->mt_idassert_authz = NULL;
2438                                 }
2439
2440                                 assert( !BER_BVISNULL( &mt->mt_idassert_authcDN ) );
2441
2442                                 bv.bv_len = STRLENOF( "dn:" ) + c->be->be_rootndn.bv_len;
2443                                 bv.bv_val = ber_memalloc( bv.bv_len + 1 );
2444                                 AC_MEMCPY( bv.bv_val, "dn:", STRLENOF( "dn:" ) );
2445                                 AC_MEMCPY( &bv.bv_val[ STRLENOF( "dn:" ) ], c->be->be_rootndn.bv_val, c->be->be_rootndn.bv_len + 1 );
2446
2447                                 ber_bvarray_add( &mt->mt_idassert_authz, &bv );
2448                         }
2449
2450                         return rc;
2451                 }
2452                 break;
2453
2454         case LDAP_BACK_CFG_PSEUDOROOTPW:
2455         /* password to use as pseudo-root */
2456                 Debug( LDAP_DEBUG_ANY,
2457                         "%s: \"pseudorootdn\", \"pseudorootpw\" are no longer supported; "
2458                         "use \"idassert-bind\" and \"idassert-authzFrom\" instead.\n",
2459                         c->log, 0, 0 );
2460
2461                 if ( BER_BVISNULL( &mt->mt_idassert_authcDN ) ) {
2462                         Debug( LDAP_DEBUG_ANY, "%s: \"pseudorootpw\": \"pseudorootdn\" must be defined first.\n",
2463                                 c->log, 0, 0 );
2464                         return 1;
2465                 }
2466
2467                 if ( !BER_BVISNULL( &mt->mt_idassert_passwd ) ) {
2468                         memset( mt->mt_idassert_passwd.bv_val, 0,
2469                                 mt->mt_idassert_passwd.bv_len );
2470                         ber_memfree( mt->mt_idassert_passwd.bv_val );
2471                 }
2472                 ber_str2bv( c->argv[ 1 ], 0, 1, &mt->mt_idassert_passwd );
2473                 break;
2474
2475         case LDAP_BACK_CFG_IDASSERT_BIND:
2476         /* idassert-bind */
2477                 rc = mi->mi_ldap_extra->idassert_parse( c, &mt->mt_idassert );
2478                 break;
2479
2480         case LDAP_BACK_CFG_IDASSERT_AUTHZFROM:
2481         /* idassert-authzFrom */
2482                 rc = mi->mi_ldap_extra->idassert_authzfrom_parse( c, &mt->mt_idassert );
2483                 break;
2484
2485         case LDAP_BACK_CFG_QUARANTINE:
2486         /* quarantine */
2487                 if ( META_BACK_CMN_QUARANTINE( mc ) )
2488                 {
2489                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2490                                 "quarantine already defined" );
2491                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2492                         return 1;
2493                 }
2494
2495                 if ( mt ) {
2496                         mc->mc_quarantine.ri_interval = NULL;
2497                         mc->mc_quarantine.ri_num = NULL;
2498                         if ( !META_BACK_QUARANTINE( mi ) ) {
2499                                 ldap_pvt_thread_mutex_init( &mt->mt_quarantine_mutex );
2500                         }
2501                 }
2502
2503                 if ( mi->mi_ldap_extra->retry_info_parse( c->argv[ 1 ], &mc->mc_quarantine, c->cr_msg, sizeof( c->cr_msg ) ) ) {
2504                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2505                         return 1;
2506                 }
2507
2508                 mc->mc_flags |= LDAP_BACK_F_QUARANTINE;
2509                 break;
2510
2511 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
2512         case LDAP_BACK_CFG_ST_REQUEST:
2513         /* session tracking request */
2514                 if ( c->value_int ) {
2515                         mc->mc_flags |= LDAP_BACK_F_ST_REQUEST;
2516                 } else {
2517                         mc->mc_flags &= ~LDAP_BACK_F_ST_REQUEST;
2518                 }
2519                 break;
2520 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
2521
2522         case LDAP_BACK_CFG_SUFFIXM:     /* FALLTHRU */
2523         case LDAP_BACK_CFG_REWRITE: {
2524         /* rewrite stuff ... */
2525                 ConfigArgs ca = { 0 };
2526                 char *line, **argv;
2527                 struct rewrite_info *rwi;
2528                 int cnt = 0, argc, ix = c->valx;
2529
2530                 if ( mt->mt_rwmap.rwm_bva_rewrite ) {
2531                         for ( ; !BER_BVISNULL( &mt->mt_rwmap.rwm_bva_rewrite[ cnt ] ); cnt++ )
2532                                 /* count */ ;
2533                 }
2534
2535                 if ( ix >= cnt || ix < 0 ) {
2536                         ix = cnt;
2537                 } else {
2538                         rwi = mt->mt_rwmap.rwm_rw;
2539
2540                         mt->mt_rwmap.rwm_rw = NULL;
2541                         rc = meta_rwi_init( &mt->mt_rwmap.rwm_rw );
2542
2543                         /* re-parse all rewrite rules, up to the one
2544                          * that needs to be added */
2545                         ca.fname = c->fname;
2546                         ca.lineno = c->lineno;
2547                         for ( i = 0; i < ix; i++ ) {
2548                                 ca.line = mt->mt_rwmap.rwm_bva_rewrite[ i ].bv_val;
2549                                 ca.argc = 0;
2550                                 config_fp_parse_line( &ca );
2551
2552                                 if ( !strcasecmp( ca.argv[0], "suffixmassage" )) {
2553                                         rc = meta_suffixm_config( &ca, ca.argc, ca.argv, mt );
2554                                 } else {
2555                                         rc = rewrite_parse( mt->mt_rwmap.rwm_rw,
2556                                                 c->fname, c->lineno, ca.argc, ca.argv );
2557                                 }
2558                                 assert( rc == 0 );
2559                                 ch_free( ca.argv );
2560                                 ch_free( ca.tline );
2561                         }
2562                 }
2563                 argc = c->argc;
2564                 argv = c->argv;
2565                 if ( c->op != SLAP_CONFIG_ADD ) {
2566                         argc--;
2567                         argv++;
2568                 }
2569                 /* add the new rule */
2570                 if ( !strcasecmp( argv[0], "suffixmassage" )) {
2571                         rc = meta_suffixm_config( c, argc, argv, mt );
2572                 } else {
2573                         rc = rewrite_parse( mt->mt_rwmap.rwm_rw,
2574                                                 c->fname, c->lineno, argc, argv );
2575                 }
2576                 if ( rc ) {
2577                         if ( ix < cnt ) {
2578                                 rewrite_info_delete( &mt->mt_rwmap.rwm_rw );
2579                                 mt->mt_rwmap.rwm_rw = rwi;
2580                         }
2581                         return 1;
2582                 }
2583                 if ( ix < cnt ) {
2584                         for ( ; i < cnt; i++ ) {
2585                                 ca.line = mt->mt_rwmap.rwm_bva_rewrite[ i ].bv_val;
2586                                 ca.argc = 0;
2587                                 config_fp_parse_line( &ca );
2588
2589                                 if ( !strcasecmp( ca.argv[0], "suffixmassage" )) {
2590                                         rc = meta_suffixm_config( &ca, ca.argc, ca.argv, mt );
2591                                 } else {
2592                                         rc = rewrite_parse( mt->mt_rwmap.rwm_rw,
2593                                                 c->fname, c->lineno, ca.argc, argv );
2594                                 }
2595                                 assert( rc == 0 );
2596                                 ch_free( ca.argv );
2597                                 ch_free( ca.tline );
2598                         }
2599                 }
2600
2601                 /* save the rule info */
2602                 line = ldap_charray2str( argv, "\" \"" );
2603                 if ( line != NULL ) {
2604                         struct berval bv;
2605                         int len = strlen( argv[ 0 ] );
2606
2607                         ber_str2bv( line, 0, 0, &bv );
2608                         AC_MEMCPY( &bv.bv_val[ len ], &bv.bv_val[ len + 1 ],
2609                                 bv.bv_len - ( len + 1 ));
2610                         bv.bv_val[ bv.bv_len - 1] = '"';
2611                         ber_bvarray_add( &mt->mt_rwmap.rwm_bva_rewrite, &bv );
2612                         /* move it to the right slot */
2613                         if ( ix < cnt ) {
2614                                 for ( i=cnt; i>ix; i-- )
2615                                         mt->mt_rwmap.rwm_bva_rewrite[i+1] = mt->mt_rwmap.rwm_bva_rewrite[i];
2616                                 mt->mt_rwmap.rwm_bva_rewrite[i] = bv;
2617
2618                                 /* destroy old rules */
2619                                 rewrite_info_delete( &rwi );
2620                         }
2621                 }
2622                 } break;
2623
2624         case LDAP_BACK_CFG_MAP: {
2625         /* objectclass/attribute mapping */
2626                 ConfigArgs ca = { 0 };
2627                 char *argv[5];
2628                 struct ldapmap rwm_oc;
2629                 struct ldapmap rwm_at;
2630                 int cnt = 0, ix = c->valx;
2631
2632                 if ( mt->mt_rwmap.rwm_bva_map ) {
2633                         for ( ; !BER_BVISNULL( &mt->mt_rwmap.rwm_bva_map[ cnt ] ); cnt++ )
2634                                 /* count */ ;
2635                 }
2636
2637                 if ( ix >= cnt || ix < 0 ) {
2638                         ix = cnt;
2639                 } else {
2640                         rwm_oc = mt->mt_rwmap.rwm_oc;
2641                         rwm_at = mt->mt_rwmap.rwm_at;
2642
2643                         memset( &mt->mt_rwmap.rwm_oc, 0, sizeof( mt->mt_rwmap.rwm_oc ) );
2644                         memset( &mt->mt_rwmap.rwm_at, 0, sizeof( mt->mt_rwmap.rwm_at ) );
2645
2646                         /* re-parse all mappings, up to the one
2647                          * that needs to be added */
2648                         argv[0] = c->argv[0];
2649                         ca.fname = c->fname;
2650                         ca.lineno = c->lineno;
2651                         for ( i = 0; i < ix; i++ ) {
2652                                 ca.line = mt->mt_rwmap.rwm_bva_map[ i ].bv_val;
2653                                 ca.argc = 0;
2654                                 config_fp_parse_line( &ca );
2655
2656                                 argv[1] = ca.argv[0];
2657                                 argv[2] = ca.argv[1];
2658                                 argv[3] = ca.argv[2];
2659                                 argv[4] = ca.argv[3];
2660                                 ch_free( ca.argv );
2661                                 ca.argv = argv;
2662                                 ca.argc++;
2663                                 rc = ldap_back_map_config( &ca, &mt->mt_rwmap.rwm_oc,
2664                                         &mt->mt_rwmap.rwm_at );
2665
2666                                 ch_free( ca.tline );
2667                                 ca.tline = NULL;
2668                                 ca.argv = NULL;
2669
2670                                 /* in case of failure, restore
2671                                  * the existing mapping */
2672                                 if ( rc ) {
2673                                         goto map_fail;
2674                                 }
2675                         }
2676                 }
2677                 /* add the new mapping */
2678                 rc = ldap_back_map_config( c, &mt->mt_rwmap.rwm_oc,
2679                                         &mt->mt_rwmap.rwm_at );
2680                 if ( rc ) {
2681                         goto map_fail;
2682                 }
2683
2684                 if ( ix < cnt ) {
2685                         for ( ; i<cnt ; cnt++ ) {
2686                                 ca.line = mt->mt_rwmap.rwm_bva_map[ i ].bv_val;
2687                                 ca.argc = 0;
2688                                 config_fp_parse_line( &ca );
2689
2690                                 argv[1] = ca.argv[0];
2691                                 argv[2] = ca.argv[1];
2692                                 argv[3] = ca.argv[2];
2693                                 argv[4] = ca.argv[3];
2694
2695                                 ch_free( ca.argv );
2696                                 ca.argv = argv;
2697                                 ca.argc++;
2698                                 rc = ldap_back_map_config( &ca, &mt->mt_rwmap.rwm_oc,
2699                                         &mt->mt_rwmap.rwm_at );
2700
2701                                 ch_free( ca.tline );
2702                                 ca.tline = NULL;
2703                                 ca.argv = NULL;
2704
2705                                 /* in case of failure, restore
2706                                  * the existing mapping */
2707                                 if ( rc ) {
2708                                         goto map_fail;
2709                                 }
2710                         }
2711                 }
2712
2713                 /* save the map info */
2714                 argv[0] = ldap_charray2str( &c->argv[ 1 ], " " );
2715                 if ( argv[0] != NULL ) {
2716                         struct berval bv;
2717                         ber_str2bv( argv[0], 0, 0, &bv );
2718                         ber_bvarray_add( &mt->mt_rwmap.rwm_bva_map, &bv );
2719                         /* move it to the right slot */
2720                         if ( ix < cnt ) {
2721                                 for ( i=cnt; i>ix; i-- )
2722                                         mt->mt_rwmap.rwm_bva_map[i+1] = mt->mt_rwmap.rwm_bva_map[i];
2723                                 mt->mt_rwmap.rwm_bva_map[i] = bv;
2724
2725                                 /* destroy old mapping */
2726                                 meta_back_map_free( &rwm_oc );
2727                                 meta_back_map_free( &rwm_at );
2728                         }
2729                 }
2730                 break;
2731
2732 map_fail:;
2733                 if ( ix < cnt ) {
2734                         meta_back_map_free( &mt->mt_rwmap.rwm_oc );
2735                         meta_back_map_free( &mt->mt_rwmap.rwm_at );
2736                         mt->mt_rwmap.rwm_oc = rwm_oc;
2737                         mt->mt_rwmap.rwm_at = rwm_at;
2738                 }
2739                 } break;
2740
2741         case LDAP_BACK_CFG_NRETRIES: {
2742                 int             nretries = META_RETRY_UNDEFINED;
2743
2744                 if ( strcasecmp( c->argv[ 1 ], "forever" ) == 0 ) {
2745                         nretries = META_RETRY_FOREVER;
2746
2747                 } else if ( strcasecmp( c->argv[ 1 ], "never" ) == 0 ) {
2748                         nretries = META_RETRY_NEVER;
2749
2750                 } else {
2751                         if ( lutil_atoi( &nretries, c->argv[ 1 ] ) != 0 ) {
2752                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2753                                         "unable to parse nretries {never|forever|<retries>}: \"%s\"",
2754                                         c->argv[ 1 ] );
2755                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2756                                 return 1;
2757                         }
2758                 }
2759
2760                 mc->mc_nretries = nretries;
2761                 } break;
2762
2763         case LDAP_BACK_CFG_VERSION:
2764                 if ( c->value_int != 0 && ( c->value_int < LDAP_VERSION_MIN || c->value_int > LDAP_VERSION_MAX ) ) {
2765                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2766                                 "unsupported protocol version \"%s\"",
2767                                 c->argv[ 1 ] );
2768                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2769                         return 1;
2770                 }
2771                 mc->mc_version = c->value_int;
2772                 break;
2773
2774         case LDAP_BACK_CFG_NOREFS:
2775         /* do not return search references */
2776                 if ( c->value_int ) {
2777                         mc->mc_flags |= LDAP_BACK_F_NOREFS;
2778                 } else {
2779                         mc->mc_flags &= ~LDAP_BACK_F_NOREFS;
2780                 }
2781                 break;
2782
2783         case LDAP_BACK_CFG_NOUNDEFFILTER:
2784         /* do not propagate undefined search filters */
2785                 if ( c->value_int ) {
2786                         mc->mc_flags |= LDAP_BACK_F_NOUNDEFFILTER;
2787                 } else {
2788                         mc->mc_flags &= ~LDAP_BACK_F_NOUNDEFFILTER;
2789                 }
2790                 break;
2791
2792 #ifdef SLAPD_META_CLIENT_PR
2793         case LDAP_BACK_CFG_CLIENT_PR:
2794                 if ( strcasecmp( c->argv[ 1 ], "accept-unsolicited" ) == 0 ) {
2795                         mc->mc_ps = META_CLIENT_PR_ACCEPT_UNSOLICITED;
2796
2797                 } else if ( strcasecmp( c->argv[ 1 ], "disable" ) == 0 ) {
2798                         mc->mc_ps = META_CLIENT_PR_DISABLE;
2799
2800                 } else if ( lutil_atoi( &mc->mc_ps, c->argv[ 1 ] ) || mc->mc_ps < -1 ) {
2801                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2802                                 "unable to parse client-pr {accept-unsolicited|disable|<size>}: \"%s\"",
2803                                 c->argv[ 1 ] );
2804                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2805                         return( 1 );
2806                 }
2807                 break;
2808 #endif /* SLAPD_META_CLIENT_PR */
2809
2810         /* anything else */
2811         default:
2812                 return SLAP_CONF_UNKNOWN;
2813         }
2814
2815         return rc;
2816 }
2817
2818 int
2819 meta_back_init_cf( BackendInfo *bi )
2820 {
2821         int                     rc;
2822         AttributeDescription    *ad = NULL;
2823         const char              *text;
2824
2825         /* Make sure we don't exceed the bits reserved for userland */
2826         config_check_userland( LDAP_BACK_CFG_LAST );
2827
2828         bi->bi_cf_ocs = metaocs;
2829
2830         rc = config_register_schema( metacfg, metaocs );
2831         if ( rc ) {
2832                 return rc;
2833         }
2834
2835         /* setup olcDbAclPasswd and olcDbIDAssertPasswd
2836          * to be base64-encoded when written in LDIF form;
2837          * basically, we don't care if it fails */
2838         rc = slap_str2ad( "olcDbACLPasswd", &ad, &text );
2839         if ( rc ) {
2840                 Debug( LDAP_DEBUG_ANY, "config_back_initialize: "
2841                         "warning, unable to get \"olcDbACLPasswd\" "
2842                         "attribute description: %d: %s\n",
2843                         rc, text, 0 );
2844         } else {
2845                 (void)ldif_must_b64_encode_register( ad->ad_cname.bv_val,
2846                         ad->ad_type->sat_oid );
2847         }
2848
2849         ad = NULL;
2850         rc = slap_str2ad( "olcDbIDAssertPasswd", &ad, &text );
2851         if ( rc ) {
2852                 Debug( LDAP_DEBUG_ANY, "config_back_initialize: "
2853                         "warning, unable to get \"olcDbIDAssertPasswd\" "
2854                         "attribute description: %d: %s\n",
2855                         rc, text, 0 );
2856         } else {
2857                 (void)ldif_must_b64_encode_register( ad->ad_cname.bv_val,
2858                         ad->ad_type->sat_oid );
2859         }
2860
2861         return 0;
2862 }
2863
2864 static int
2865 ldap_back_map_config(
2866                 ConfigArgs *c,
2867                 struct ldapmap  *oc_map,
2868                 struct ldapmap  *at_map )
2869 {
2870         struct ldapmap          *map;
2871         struct ldapmapping      *mapping;
2872         char                    *src, *dst;
2873         int                     is_oc = 0;
2874
2875         if ( strcasecmp( c->argv[ 1 ], "objectclass" ) == 0 ) {
2876                 map = oc_map;
2877                 is_oc = 1;
2878
2879         } else if ( strcasecmp( c->argv[ 1 ], "attribute" ) == 0 ) {
2880                 map = at_map;
2881
2882         } else {
2883                 snprintf( c->cr_msg, sizeof(c->cr_msg),
2884                         "%s unknown argument \"%s\"",
2885                         c->argv[0], c->argv[1] );
2886                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2887                 return 1;
2888         }
2889
2890         if ( !is_oc && map->map == NULL ) {
2891                 /* only init if required */
2892                 ldap_back_map_init( map, &mapping );
2893         }
2894
2895         if ( strcmp( c->argv[ 2 ], "*" ) == 0 ) {
2896                 if ( c->argc < 4 || strcmp( c->argv[ 3 ], "*" ) == 0 ) {
2897                         map->drop_missing = ( c->argc < 4 );
2898                         goto success_return;
2899                 }
2900                 src = dst = c->argv[ 3 ];
2901
2902         } else if ( c->argc < 4 ) {
2903                 src = "";
2904                 dst = c->argv[ 2 ];
2905
2906         } else {
2907                 src = c->argv[ 2 ];
2908                 dst = ( strcmp( c->argv[ 3 ], "*" ) == 0 ? src : c->argv[ 3 ] );
2909         }
2910
2911         if ( ( map == at_map )
2912                 && ( strcasecmp( src, "objectclass" ) == 0
2913                         || strcasecmp( dst, "objectclass" ) == 0 ) )
2914         {
2915                 snprintf( c->cr_msg, sizeof(c->cr_msg),
2916                         "objectclass attribute cannot be mapped" );
2917                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2918                 return 1;
2919         }
2920
2921         mapping = (struct ldapmapping *)ch_calloc( 2,
2922                 sizeof(struct ldapmapping) );
2923         if ( mapping == NULL ) {
2924                 snprintf( c->cr_msg, sizeof(c->cr_msg),
2925                         "out of memory" );
2926                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2927                 return 1;
2928         }
2929         ber_str2bv( src, 0, 1, &mapping[ 0 ].src );
2930         ber_str2bv( dst, 0, 1, &mapping[ 0 ].dst );
2931         mapping[ 1 ].src = mapping[ 0 ].dst;
2932         mapping[ 1 ].dst = mapping[ 0 ].src;
2933
2934         /*
2935          * schema check
2936          */
2937         if ( is_oc ) {
2938                 if ( src[ 0 ] != '\0' ) {
2939                         if ( oc_bvfind( &mapping[ 0 ].src ) == NULL ) {
2940                                 Debug( LDAP_DEBUG_ANY,
2941         "warning, source objectClass '%s' should be defined in schema\n",
2942                                         c->log, src, 0 );
2943
2944                                 /*
2945                                  * FIXME: this should become an err
2946                                  */
2947                                 goto error_return;
2948                         }
2949                 }
2950
2951                 if ( oc_bvfind( &mapping[ 0 ].dst ) == NULL ) {
2952                         Debug( LDAP_DEBUG_ANY,
2953         "warning, destination objectClass '%s' is not defined in schema\n",
2954                                 c->log, dst, 0 );
2955                 }
2956         } else {
2957                 int                     rc;
2958                 const char              *text = NULL;
2959                 AttributeDescription    *ad = NULL;
2960
2961                 if ( src[ 0 ] != '\0' ) {
2962                         rc = slap_bv2ad( &mapping[ 0 ].src, &ad, &text );
2963                         if ( rc != LDAP_SUCCESS ) {
2964                                 Debug( LDAP_DEBUG_ANY,
2965         "warning, source attributeType '%s' should be defined in schema\n",
2966                                         c->log, src, 0 );
2967
2968                                 /*
2969                                  * FIXME: this should become an err
2970                                  */
2971                                 /*
2972                                  * we create a fake "proxied" ad
2973                                  * and add it here.
2974                                  */
2975
2976                                 rc = slap_bv2undef_ad( &mapping[ 0 ].src,
2977                                                 &ad, &text, SLAP_AD_PROXIED );
2978                                 if ( rc != LDAP_SUCCESS ) {
2979                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2980                                                 "source attributeType \"%s\": %d (%s)",
2981                                                 src, rc, text ? text : "" );
2982                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2983                                         goto error_return;
2984                                 }
2985                         }
2986
2987                         ad = NULL;
2988                 }
2989
2990                 rc = slap_bv2ad( &mapping[ 0 ].dst, &ad, &text );
2991                 if ( rc != LDAP_SUCCESS ) {
2992                         Debug( LDAP_DEBUG_ANY,
2993         "warning, destination attributeType '%s' is not defined in schema\n",
2994                                 c->log, dst, 0 );
2995
2996                         /*
2997                          * we create a fake "proxied" ad
2998                          * and add it here.
2999                          */
3000
3001                         rc = slap_bv2undef_ad( &mapping[ 0 ].dst,
3002                                         &ad, &text, SLAP_AD_PROXIED );
3003                         if ( rc != LDAP_SUCCESS ) {
3004                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
3005                                         "destination attributeType \"%s\": %d (%s)\n",
3006                                         dst, rc, text ? text : "" );
3007                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
3008                                 return 1;
3009                         }
3010                 }
3011         }
3012
3013         if ( (src[ 0 ] != '\0' && avl_find( map->map, (caddr_t)&mapping[ 0 ], mapping_cmp ) != NULL)
3014                         || avl_find( map->remap, (caddr_t)&mapping[ 1 ], mapping_cmp ) != NULL)
3015         {
3016                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
3017                         "duplicate mapping found." );
3018                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
3019                 goto error_return;
3020         }
3021
3022         if ( src[ 0 ] != '\0' ) {
3023                 avl_insert( &map->map, (caddr_t)&mapping[ 0 ],
3024                                         mapping_cmp, mapping_dup );
3025         }
3026         avl_insert( &map->remap, (caddr_t)&mapping[ 1 ],
3027                                 mapping_cmp, mapping_dup );
3028
3029 success_return:;
3030         return 0;
3031
3032 error_return:;
3033         if ( mapping ) {
3034                 ch_free( mapping[ 0 ].src.bv_val );
3035                 ch_free( mapping[ 0 ].dst.bv_val );
3036                 ch_free( mapping );
3037         }
3038
3039         return 1;
3040 }
3041
3042
3043 #ifdef ENABLE_REWRITE
3044 static char *
3045 suffix_massage_regexize( const char *s )
3046 {
3047         char *res, *ptr;
3048         const char *p, *r;
3049         int i;
3050
3051         if ( s[ 0 ] == '\0' ) {
3052                 return ch_strdup( "^(.+)$" );
3053         }
3054
3055         for ( i = 0, p = s;
3056                         ( r = strchr( p, ',' ) ) != NULL;
3057                         p = r + 1, i++ )
3058                 ;
3059
3060         res = ch_calloc( sizeof( char ),
3061                         strlen( s )
3062                         + STRLENOF( "((.+),)?" )
3063                         + STRLENOF( "[ ]?" ) * i
3064                         + STRLENOF( "$" ) + 1 );
3065
3066         ptr = lutil_strcopy( res, "((.+),)?" );
3067         for ( i = 0, p = s;
3068                         ( r = strchr( p, ',' ) ) != NULL;
3069                         p = r + 1 , i++ ) {
3070                 ptr = lutil_strncopy( ptr, p, r - p + 1 );
3071                 ptr = lutil_strcopy( ptr, "[ ]?" );
3072
3073                 if ( r[ 1 ] == ' ' ) {
3074                         r++;
3075                 }
3076         }
3077         ptr = lutil_strcopy( ptr, p );
3078         ptr[ 0 ] = '$';
3079         ptr++;
3080         ptr[ 0 ] = '\0';
3081
3082         return res;
3083 }
3084
3085 static char *
3086 suffix_massage_patternize( const char *s, const char *p )
3087 {
3088         ber_len_t       len;
3089         char            *res, *ptr;
3090
3091         len = strlen( p );
3092
3093         if ( s[ 0 ] == '\0' ) {
3094                 len++;
3095         }
3096
3097         res = ch_calloc( sizeof( char ), len + STRLENOF( "%1" ) + 1 );
3098         if ( res == NULL ) {
3099                 return NULL;
3100         }
3101
3102         ptr = lutil_strcopy( res, ( p[ 0 ] == '\0' ? "%2" : "%1" ) );
3103         if ( s[ 0 ] == '\0' ) {
3104                 ptr[ 0 ] = ',';
3105                 ptr++;
3106         }
3107         lutil_strcopy( ptr, p );
3108
3109         return res;
3110 }
3111
3112 int
3113 suffix_massage_config(
3114                 struct rewrite_info *info,
3115                 struct berval *pvnc,
3116                 struct berval *nvnc,
3117                 struct berval *prnc,
3118                 struct berval *nrnc
3119 )
3120 {
3121         char *rargv[ 5 ];
3122         int line = 0;
3123
3124         rargv[ 0 ] = "rewriteEngine";
3125         rargv[ 1 ] = "on";
3126         rargv[ 2 ] = NULL;
3127         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3128
3129         rargv[ 0 ] = "rewriteContext";
3130         rargv[ 1 ] = "default";
3131         rargv[ 2 ] = NULL;
3132         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3133
3134         rargv[ 0 ] = "rewriteRule";
3135         rargv[ 1 ] = suffix_massage_regexize( pvnc->bv_val );
3136         rargv[ 2 ] = suffix_massage_patternize( pvnc->bv_val, prnc->bv_val );
3137         rargv[ 3 ] = ":";
3138         rargv[ 4 ] = NULL;
3139         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3140         ch_free( rargv[ 1 ] );
3141         ch_free( rargv[ 2 ] );
3142
3143         if ( BER_BVISEMPTY( pvnc ) ) {
3144                 rargv[ 0 ] = "rewriteRule";
3145                 rargv[ 1 ] = "^$";
3146                 rargv[ 2 ] = prnc->bv_val;
3147                 rargv[ 3 ] = ":";
3148                 rargv[ 4 ] = NULL;
3149                 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3150         }
3151
3152         rargv[ 0 ] = "rewriteContext";
3153         rargv[ 1 ] = "searchEntryDN";
3154         rargv[ 2 ] = NULL;
3155         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3156
3157         rargv[ 0 ] = "rewriteRule";
3158         rargv[ 1 ] = suffix_massage_regexize( prnc->bv_val );
3159         rargv[ 2 ] = suffix_massage_patternize( prnc->bv_val, pvnc->bv_val );
3160         rargv[ 3 ] = ":";
3161         rargv[ 4 ] = NULL;
3162         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3163         ch_free( rargv[ 1 ] );
3164         ch_free( rargv[ 2 ] );
3165
3166         if ( BER_BVISEMPTY( prnc ) ) {
3167                 rargv[ 0 ] = "rewriteRule";
3168                 rargv[ 1 ] = "^$";
3169                 rargv[ 2 ] = pvnc->bv_val;
3170                 rargv[ 3 ] = ":";
3171                 rargv[ 4 ] = NULL;
3172                 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3173         }
3174
3175         /* backward compatibility */
3176         rargv[ 0 ] = "rewriteContext";
3177         rargv[ 1 ] = "searchResult";
3178         rargv[ 2 ] = "alias";
3179         rargv[ 3 ] = "searchEntryDN";
3180         rargv[ 4 ] = NULL;
3181         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3182
3183         rargv[ 0 ] = "rewriteContext";
3184         rargv[ 1 ] = "matchedDN";
3185         rargv[ 2 ] = "alias";
3186         rargv[ 3 ] = "searchEntryDN";
3187         rargv[ 4 ] = NULL;
3188         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3189
3190         rargv[ 0 ] = "rewriteContext";
3191         rargv[ 1 ] = "searchAttrDN";
3192         rargv[ 2 ] = "alias";
3193         rargv[ 3 ] = "searchEntryDN";
3194         rargv[ 4 ] = NULL;
3195         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3196
3197         /* NOTE: this corresponds to #undef'ining RWM_REFERRAL_REWRITE;
3198          * see servers/slapd/overlays/rwm.h for details */
3199         rargv[ 0 ] = "rewriteContext";
3200         rargv[ 1 ] = "referralAttrDN";
3201         rargv[ 2 ] = NULL;
3202         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3203
3204         rargv[ 0 ] = "rewriteContext";
3205         rargv[ 1 ] = "referralDN";
3206         rargv[ 2 ] = NULL;
3207         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3208
3209         return 0;
3210 }
3211 #endif /* ENABLE_REWRITE */
3212