git.sur5r.net Git - openldap/blob - servers/slapd/back-meta/config.c

   1 /* $OpenLDAP$ */
   2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   3  *
   4  * Copyright 1999-2013 The OpenLDAP Foundation.
   5  * Portions Copyright 2001-2003 Pierangelo Masarati.
   6  * Portions Copyright 1999-2003 Howard Chu.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted only as authorized by the OpenLDAP
  11  * Public License.
  12  *
  13  * A copy of this license is available in the file LICENSE in the
  14  * top-level directory of the distribution or, alternatively, at
  15  * <http://www.OpenLDAP.org/license.html>.
  16  */
  17 /* ACKNOWLEDGEMENTS:
  18  * This work was initially developed by the Howard Chu for inclusion
  19  * in OpenLDAP Software and subsequently enhanced by Pierangelo
  20  * Masarati.
  21  */
  22
  23 #include "portable.h"
  24
  25 #include <stdio.h>
  26
  27 #include <ac/string.h>
  28 #include <ac/socket.h>
  29
  30 #include "slap.h"
  31 #include "config.h"
  32 #include "lutil.h"
  33 #include "../back-ldap/back-ldap.h"
  34 #include "back-meta.h"
  35
  36 #ifdef LDAP_DEVEL
  37 #define SLAP_AUTH_DN    1
  38 #endif
  39
  40 static ConfigDriver meta_back_cf_gen;
  41 static ConfigLDAPadd meta_ldadd;
  42 static ConfigCfAdd meta_cfadd;
  43
  44 static int ldap_back_map_config(
  45         ConfigArgs *c,
  46         struct ldapmap  *oc_map,
  47         struct ldapmap  *at_map );
  48
  49 /* Three sets of enums:
  50  *      1) attrs that are only valid in the base config
  51  *      2) attrs that are valid in base or target
  52  *      3) attrs that are only valid in a target
  53  */
  54
  55 /* Base attrs */
  56 enum {
  57         LDAP_BACK_CFG_CONN_TTL = 1,
  58         LDAP_BACK_CFG_DNCACHE_TTL,
  59         LDAP_BACK_CFG_IDLE_TIMEOUT,
  60         LDAP_BACK_CFG_ONERR,
  61         LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
  62         LDAP_BACK_CFG_SINGLECONN,
  63         LDAP_BACK_CFG_USETEMP,
  64         LDAP_BACK_CFG_CONNPOOLMAX,
  65         LDAP_BACK_CFG_LAST_BASE
  66 };
  67
  68 /* Base or target */
  69 enum {
  70         LDAP_BACK_CFG_BIND_TIMEOUT = LDAP_BACK_CFG_LAST_BASE,
  71         LDAP_BACK_CFG_CANCEL,
  72         LDAP_BACK_CFG_CHASE,
  73         LDAP_BACK_CFG_CLIENT_PR,
  74         LDAP_BACK_CFG_DEFAULT_T,
  75         LDAP_BACK_CFG_NETWORK_TIMEOUT,
  76         LDAP_BACK_CFG_NOREFS,
  77         LDAP_BACK_CFG_NOUNDEFFILTER,
  78         LDAP_BACK_CFG_NRETRIES,
  79         LDAP_BACK_CFG_QUARANTINE,
  80         LDAP_BACK_CFG_REBIND,
  81         LDAP_BACK_CFG_TIMEOUT,
  82         LDAP_BACK_CFG_VERSION,
  83         LDAP_BACK_CFG_ST_REQUEST,
  84         LDAP_BACK_CFG_T_F,
  85         LDAP_BACK_CFG_TLS,
  86         LDAP_BACK_CFG_LAST_BOTH
  87 };
  88
  89 /* Target attrs */
  90 enum {
  91         LDAP_BACK_CFG_URI = LDAP_BACK_CFG_LAST_BOTH,
  92         LDAP_BACK_CFG_ACL_AUTHCDN,
  93         LDAP_BACK_CFG_ACL_PASSWD,
  94         LDAP_BACK_CFG_IDASSERT_AUTHZFROM,
  95         LDAP_BACK_CFG_IDASSERT_BIND,
  96         LDAP_BACK_CFG_REWRITE,
  97         LDAP_BACK_CFG_SUFFIXM,
  98         LDAP_BACK_CFG_MAP,
  99         LDAP_BACK_CFG_SUBTREE_EX,
 100         LDAP_BACK_CFG_SUBTREE_IN,
 101         LDAP_BACK_CFG_PSEUDOROOTDN,
 102         LDAP_BACK_CFG_PSEUDOROOTPW,
 103
 104         LDAP_BACK_CFG_LAST
 105 };
 106
 107 static ConfigTable metacfg[] = {
 108         { "uri", "uri", 2, 0, 0,
 109                 ARG_MAGIC|LDAP_BACK_CFG_URI,
 110                 meta_back_cf_gen, "( OLcfgDbAt:0.14 "
 111                         "NAME 'olcDbURI' "
 112                         "DESC 'URI (list) for remote DSA' "
 113                         "SYNTAX OMsDirectoryString "
 114                         "SINGLE-VALUE )",
 115                 NULL, NULL },
 116         { "tls", "what", 2, 0, 0,
 117                 ARG_MAGIC|LDAP_BACK_CFG_TLS,
 118                 meta_back_cf_gen, "( OLcfgDbAt:3.1 "
 119                         "NAME 'olcDbStartTLS' "
 120                         "DESC 'StartTLS' "
 121                         "SYNTAX OMsDirectoryString "
 122                         "SINGLE-VALUE )",
 123                 NULL, NULL },
 124         { "acl-authcDN", "DN", 2, 2, 0,
 125                 ARG_DN|ARG_MAGIC|LDAP_BACK_CFG_ACL_AUTHCDN,
 126                 meta_back_cf_gen, "( OLcfgDbAt:3.2 "
 127                         "NAME 'olcDbACLAuthcDn' "
 128                         "DESC 'Remote ACL administrative identity' "
 129                         "OBSOLETE "
 130                         "SYNTAX OMsDN "
 131                         "SINGLE-VALUE )",
 132                 NULL, NULL },
 133         /* deprecated, will be removed; aliases "acl-authcDN" */
 134         { "binddn", "DN", 2, 2, 0,
 135                 ARG_DN|ARG_MAGIC|LDAP_BACK_CFG_ACL_AUTHCDN,
 136                 meta_back_cf_gen, NULL, NULL, NULL },
 137         { "acl-passwd", "cred", 2, 2, 0,
 138                 ARG_MAGIC|LDAP_BACK_CFG_ACL_PASSWD,
 139                 meta_back_cf_gen, "( OLcfgDbAt:3.3 "
 140                         "NAME 'olcDbACLPasswd' "
 141                         "DESC 'Remote ACL administrative identity credentials' "
 142                         "OBSOLETE "
 143                         "SYNTAX OMsDirectoryString "
 144                         "SINGLE-VALUE )",
 145                 NULL, NULL },
 146         /* deprecated, will be removed; aliases "acl-passwd" */
 147         { "bindpw", "cred", 2, 2, 0,
 148                 ARG_MAGIC|LDAP_BACK_CFG_ACL_PASSWD,
 149                 meta_back_cf_gen, NULL, NULL, NULL },
 150         { "idassert-bind", "args", 2, 0, 0,
 151                 ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_BIND,
 152                 meta_back_cf_gen, "( OLcfgDbAt:3.7 "
 153                         "NAME 'olcDbIDAssertBind' "
 154                         "DESC 'Remote Identity Assertion administrative identity auth bind configuration' "
 155                         "SYNTAX OMsDirectoryString "
 156                         "SINGLE-VALUE )",
 157                 NULL, NULL },
 158         { "idassert-authzFrom", "authzRule", 2, 2, 0,
 159                 ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_AUTHZFROM,
 160                 meta_back_cf_gen, "( OLcfgDbAt:3.9 "
 161                         "NAME 'olcDbIDAssertAuthzFrom' "
 162                         "DESC 'Remote Identity Assertion authz rules' "
 163                         "EQUALITY caseIgnoreMatch "
 164                         "SYNTAX OMsDirectoryString "
 165                         "X-ORDERED 'VALUES' )",
 166                 NULL, NULL },
 167         { "rebind-as-user", "true|FALSE", 1, 2, 0,
 168                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_REBIND,
 169                 meta_back_cf_gen, "( OLcfgDbAt:3.10 "
 170                         "NAME 'olcDbRebindAsUser' "
 171                         "DESC 'Rebind as user' "
 172                         "SYNTAX OMsBoolean "
 173                         "SINGLE-VALUE )",
 174                 NULL, NULL },
 175         { "chase-referrals", "true|FALSE", 2, 2, 0,
 176                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_CHASE,
 177                 meta_back_cf_gen, "( OLcfgDbAt:3.11 "
 178                         "NAME 'olcDbChaseReferrals' "
 179                         "DESC 'Chase referrals' "
 180                         "SYNTAX OMsBoolean "
 181                         "SINGLE-VALUE )",
 182                 NULL, NULL },
 183         { "t-f-support", "true|FALSE|discover", 2, 2, 0,
 184                 ARG_MAGIC|LDAP_BACK_CFG_T_F,
 185                 meta_back_cf_gen, "( OLcfgDbAt:3.12 "
 186                         "NAME 'olcDbTFSupport' "
 187                         "DESC 'Absolute filters support' "
 188                         "SYNTAX OMsDirectoryString "
 189                         "SINGLE-VALUE )",
 190                 NULL, NULL },
 191         { "timeout", "timeout(list)", 2, 0, 0,
 192                 ARG_MAGIC|LDAP_BACK_CFG_TIMEOUT,
 193                 meta_back_cf_gen, "( OLcfgDbAt:3.14 "
 194                         "NAME 'olcDbTimeout' "
 195                         "DESC 'Per-operation timeouts' "
 196                         "SYNTAX OMsDirectoryString "
 197                         "SINGLE-VALUE )",
 198                 NULL, NULL },
 199         { "idle-timeout", "timeout", 2, 2, 0,
 200                 ARG_MAGIC|LDAP_BACK_CFG_IDLE_TIMEOUT,
 201                 meta_back_cf_gen, "( OLcfgDbAt:3.15 "
 202                         "NAME 'olcDbIdleTimeout' "
 203                         "DESC 'connection idle timeout' "
 204                         "SYNTAX OMsDirectoryString "
 205                         "SINGLE-VALUE )",
 206                 NULL, NULL },
 207         { "conn-ttl", "ttl", 2, 2, 0,
 208                 ARG_MAGIC|LDAP_BACK_CFG_CONN_TTL,
 209                 meta_back_cf_gen, "( OLcfgDbAt:3.16 "
 210                         "NAME 'olcDbConnTtl' "
 211                         "DESC 'connection ttl' "
 212                         "SYNTAX OMsDirectoryString "
 213                         "SINGLE-VALUE )",
 214                 NULL, NULL },
 215         { "network-timeout", "timeout", 2, 2, 0,
 216                 ARG_MAGIC|LDAP_BACK_CFG_NETWORK_TIMEOUT,
 217                 meta_back_cf_gen, "( OLcfgDbAt:3.17 "
 218                         "NAME 'olcDbNetworkTimeout' "
 219                         "DESC 'connection network timeout' "
 220                         "SYNTAX OMsDirectoryString "
 221                         "SINGLE-VALUE )",
 222                 NULL, NULL },
 223         { "protocol-version", "version", 2, 2, 0,
 224                 ARG_MAGIC|ARG_INT|LDAP_BACK_CFG_VERSION,
 225                 meta_back_cf_gen, "( OLcfgDbAt:3.18 "
 226                         "NAME 'olcDbProtocolVersion' "
 227                         "DESC 'protocol version' "
 228                         "SYNTAX OMsInteger "
 229                         "SINGLE-VALUE )",
 230                 NULL, NULL },
 231         { "single-conn", "true|FALSE", 2, 2, 0,
 232                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_SINGLECONN,
 233                 meta_back_cf_gen, "( OLcfgDbAt:3.19 "
 234                         "NAME 'olcDbSingleConn' "
 235                         "DESC 'cache a single connection per identity' "
 236                         "SYNTAX OMsBoolean "
 237                         "SINGLE-VALUE )",
 238                 NULL, NULL },
 239         { "cancel", "ABANDON|ignore|exop", 2, 2, 0,
 240                 ARG_MAGIC|LDAP_BACK_CFG_CANCEL,
 241                 meta_back_cf_gen, "( OLcfgDbAt:3.20 "
 242                         "NAME 'olcDbCancel' "
 243                         "DESC 'abandon/ignore/exop operations when appropriate' "
 244                         "SYNTAX OMsDirectoryString "
 245                         "SINGLE-VALUE )",
 246                 NULL, NULL },
 247         { "quarantine", "retrylist", 2, 2, 0,
 248                 ARG_MAGIC|LDAP_BACK_CFG_QUARANTINE,
 249                 meta_back_cf_gen, "( OLcfgDbAt:3.21 "
 250                         "NAME 'olcDbQuarantine' "
 251                         "DESC 'Quarantine database if connection fails and retry according to rule' "
 252                         "SYNTAX OMsDirectoryString "
 253                         "SINGLE-VALUE )",
 254                 NULL, NULL },
 255         { "use-temporary-conn", "true|FALSE", 2, 2, 0,
 256                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_USETEMP,
 257                 meta_back_cf_gen, "( OLcfgDbAt:3.22 "
 258                         "NAME 'olcDbUseTemporaryConn' "
 259                         "DESC 'Use temporary connections if the cached one is busy' "
 260                         "SYNTAX OMsBoolean "
 261                         "SINGLE-VALUE )",
 262                 NULL, NULL },
 263         { "conn-pool-max", "<n>", 2, 2, 0,
 264                 ARG_MAGIC|ARG_INT|LDAP_BACK_CFG_CONNPOOLMAX,
 265                 meta_back_cf_gen, "( OLcfgDbAt:3.23 "
 266                         "NAME 'olcDbConnectionPoolMax' "
 267                         "DESC 'Max size of privileged connections pool' "
 268                         "SYNTAX OMsInteger "
 269                         "SINGLE-VALUE )",
 270                 NULL, NULL },
 271 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
 272         { "session-tracking-request", "true|FALSE", 2, 2, 0,
 273                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_ST_REQUEST,
 274                 meta_back_cf_gen, "( OLcfgDbAt:3.24 "
 275                         "NAME 'olcDbSessionTrackingRequest' "
 276                         "DESC 'Add session tracking control to proxied requests' "
 277                         "SYNTAX OMsBoolean "
 278                         "SINGLE-VALUE )",
 279                 NULL, NULL },
 280 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
 281         { "norefs", "true|FALSE", 2, 2, 0,
 282                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_NOREFS,
 283                 meta_back_cf_gen, "( OLcfgDbAt:3.25 "
 284                         "NAME 'olcDbNoRefs' "
 285                         "DESC 'Do not return search reference responses' "
 286                         "SYNTAX OMsBoolean "
 287                         "SINGLE-VALUE )",
 288                 NULL, NULL },
 289         { "noundeffilter", "true|FALSE", 2, 2, 0,
 290                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_NOUNDEFFILTER,
 291                 meta_back_cf_gen, "( OLcfgDbAt:3.26 "
 292                         "NAME 'olcDbNoUndefFilter' "
 293                         "DESC 'Do not propagate undefined search filters' "
 294                         "SYNTAX OMsBoolean "
 295                         "SINGLE-VALUE )",
 296                 NULL, NULL },
 297
 298         { "rewrite", "arglist", 2, 0, STRLENOF( "rewrite" ),
 299                 ARG_MAGIC|LDAP_BACK_CFG_REWRITE,
 300                 meta_back_cf_gen, "( OLcfgDbAt:3.101 "
 301                         "NAME 'olcDbRewrite' "
 302                         "DESC 'DN rewriting rules' "
 303                         "EQUALITY caseIgnoreMatch "
 304                         "SYNTAX OMsDirectoryString "
 305                         "X-ORDERED 'VALUES' )",
 306                 NULL, NULL },
 307         { "suffixmassage", "virtual> <real", 2, 3, 0,
 308                 ARG_MAGIC|LDAP_BACK_CFG_SUFFIXM,
 309                 meta_back_cf_gen, NULL, NULL, NULL },
 310
 311         { "map", "attribute|objectClass> [*|<local>] *|<remote", 3, 4, 0,
 312                 ARG_MAGIC|LDAP_BACK_CFG_MAP,
 313                 meta_back_cf_gen, "( OLcfgDbAt:3.102 "
 314                         "NAME 'olcDbMap' "
 315                         "DESC 'Map attribute and objectclass names' "
 316                         "EQUALITY caseIgnoreMatch "
 317                         "SYNTAX OMsDirectoryString "
 318                         "X-ORDERED 'VALUES' )",
 319                 NULL, NULL },
 320
 321         { "subtree-exclude", "pattern", 2, 2, 0,
 322                 ARG_MAGIC|LDAP_BACK_CFG_SUBTREE_EX,
 323                 meta_back_cf_gen, "( OLcfgDbAt:3.103 "
 324                         "NAME 'olcDbSubtreeExclude' "
 325                         "DESC 'DN of subtree to exclude from target' "
 326                         "EQUALITY caseIgnoreMatch "
 327                         "SYNTAX OMsDirectoryString )",
 328                 NULL, NULL },
 329         { "subtree-include", "pattern", 2, 2, 0,
 330                 ARG_MAGIC|LDAP_BACK_CFG_SUBTREE_IN,
 331                 meta_back_cf_gen, "( OLcfgDbAt:3.104 "
 332                         "NAME 'olcDbSubtreeInclude' "
 333                         "DESC 'DN of subtree to include in target' "
 334                         "EQUALITY caseIgnoreMatch "
 335                         "SYNTAX OMsDirectoryString )",
 336                 NULL, NULL },
 337         { "default-target", "[none|<target ID>]", 1, 2, 0,
 338                 ARG_MAGIC|LDAP_BACK_CFG_DEFAULT_T,
 339                 meta_back_cf_gen, "( OLcfgDbAt:3.105 "
 340                         "NAME 'olcDbDefaultTarget' "
 341                         "DESC 'Specify the default target' "
 342                         "SYNTAX OMsDirectoryString "
 343                         "SINGLE-VALUE )",
 344                 NULL, NULL },
 345         { "dncache-ttl", "ttl", 2, 2, 0,
 346                 ARG_MAGIC|LDAP_BACK_CFG_DNCACHE_TTL,
 347                 meta_back_cf_gen, "( OLcfgDbAt:3.106 "
 348                         "NAME 'olcDbDnCacheTtl' "
 349                         "DESC 'dncache ttl' "
 350                         "SYNTAX OMsDirectoryString "
 351                         "SINGLE-VALUE )",
 352                 NULL, NULL },
 353         { "bind-timeout", "microseconds", 2, 2, 0,
 354                 ARG_MAGIC|ARG_ULONG|LDAP_BACK_CFG_BIND_TIMEOUT,
 355                 meta_back_cf_gen, "( OLcfgDbAt:3.107 "
 356                         "NAME 'olcDbBindTimeout' "
 357                         "DESC 'bind timeout' "
 358                         "SYNTAX OMsDirectoryString "
 359                         "SINGLE-VALUE )",
 360                 NULL, NULL },
 361         { "onerr", "CONTINUE|report|stop", 2, 2, 0,
 362                 ARG_MAGIC|LDAP_BACK_CFG_ONERR,
 363                 meta_back_cf_gen, "( OLcfgDbAt:3.108 "
 364                         "NAME 'olcDbOnErr' "
 365                         "DESC 'error handling' "
 366                         "SYNTAX OMsDirectoryString "
 367                         "SINGLE-VALUE )",
 368                 NULL, NULL },
 369         { "pseudoroot-bind-defer", "TRUE|false", 2, 2, 0,
 370                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
 371                 meta_back_cf_gen, "( OLcfgDbAt:3.109 "
 372                         "NAME 'olcDbPseudoRootBindDefer' "
 373                         "DESC 'error handling' "
 374                         "SYNTAX OMsBoolean "
 375                         "SINGLE-VALUE )",
 376                 NULL, NULL },
 377         { "root-bind-defer", "TRUE|false", 2, 2, 0,
 378                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
 379                 meta_back_cf_gen, NULL, NULL, NULL },
 380         { "pseudorootdn", "dn", 2, 2, 0,
 381                 ARG_MAGIC|ARG_DN|LDAP_BACK_CFG_PSEUDOROOTDN,
 382                 meta_back_cf_gen, NULL, NULL, NULL },
 383         { "pseudorootpw", "password", 2, 2, 0,
 384                 ARG_MAGIC|ARG_STRING|LDAP_BACK_CFG_PSEUDOROOTDN,
 385                 meta_back_cf_gen, NULL, NULL, NULL },
 386         { "nretries", "NEVER|forever|<number>", 2, 2, 0,
 387                 ARG_MAGIC|LDAP_BACK_CFG_NRETRIES,
 388                 meta_back_cf_gen, "( OLcfgDbAt:3.110 "
 389                         "NAME 'olcDbNretries' "
 390                         "DESC 'retry handling' "
 391                         "SYNTAX OMsDirectoryString "
 392                         "SINGLE-VALUE )",
 393                 NULL, NULL },
 394         { "client-pr", "accept-unsolicited|disable|<size>", 2, 2, 0,
 395                 ARG_MAGIC|LDAP_BACK_CFG_CLIENT_PR,
 396                 meta_back_cf_gen, "( OLcfgDbAt:3.111 "
 397                         "NAME 'olcDbClientPr' "
 398                         "DESC 'PagedResults handling' "
 399                         "SYNTAX OMsDirectoryString "
 400                         "SINGLE-VALUE )",
 401                 NULL, NULL },
 402
 403         { "", "", 0, 0, 0, ARG_IGNORED,
 404                 NULL, "( OLcfgDbAt:3.100 NAME 'olcMetaSub' "
 405                         "DESC 'Placeholder to name a Target entry' "
 406                         "EQUALITY caseIgnoreMatch "
 407                         "SYNTAX OMsDirectoryString "
 408                         "SINGLE-VALUE X-ORDERED 'SIBLINGS' )", NULL, NULL },
 409
 410         { NULL, NULL, 0, 0, 0, ARG_IGNORED,
 411                 NULL, NULL, NULL, NULL }
 412 };
 413
 414 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
 415 #define ST_ATTR "$ olcDbSessionTrackingRequest "
 416 #else
 417 #define ST_ATTR ""
 418 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
 419
 420 #define COMMON_ATTRS    \
 421                         "$ olcDbBindTimeout " \
 422                         "$ olcDbCancel " \
 423                         "$ olcDbChaseReferrals " \
 424                         "$ olcDbClientPr " \
 425                         "$ olcDbDefaultTarget " \
 426                         "$ olcDbNetworkTimeout " \
 427                         "$ olcDbNoRefs " \
 428                         "$ olcDbNoUndefFilter " \
 429                         "$ olcDbNretries " \
 430                         "$ olcDbProtocolVersion " \
 431                         "$ olcDbQuarantine " \
 432                         "$ olcDbRebindAsUser " \
 433                         ST_ATTR \
 434                         "$ olcDbStartTLS " \
 435                         "$ olcDbTFSupport "
 436
 437 static ConfigOCs metaocs[] = {
 438         { "( OLcfgDbOc:3.2 "
 439                 "NAME 'olcMetaConfig' "
 440                 "DESC 'Meta backend configuration' "
 441                 "SUP olcDatabaseConfig "
 442                 "MAY ( olcDbConnTtl "
 443                         "$ olcDbDnCacheTtl "
 444                         "$ olcDbIdleTimeout "
 445                         "$ olcDbOnErr "
 446                         "$ olcDbPseudoRootBindDefer "
 447                         "$ olcDbSingleConn "
 448                         "$ olcDbUseTemporaryConn "
 449                         "$ olcDbConnectionPoolMax "
 450
 451                         /* defaults, may be overridden per-target */
 452                         COMMON_ATTRS
 453                 ") )",
 454                         Cft_Database, metacfg, NULL, meta_cfadd },
 455         { "( OLcfgDbOc:3.3 "
 456                 "NAME 'olcMetaTargetConfig' "
 457                 "DESC 'Meta target configuration' "
 458                 "SUP olcConfig STRUCTURAL "
 459                 "MUST ( olcMetaSub $ olcDbURI ) "
 460                 "MAY ( olcDbACLAuthcDn "
 461                         "$ olcDbACLPasswd "
 462                         "$ olcDbIDAssertAuthzFrom "
 463                         "$ olcDbIDAssertBind "
 464                         "$ olcDbMap "
 465                         "$ olcDbRewrite "
 466                         "$ olcDbSubtreeExclude "
 467                         "$ olcDbSubtreeInclude "
 468                         "$ olcDbTimeout "
 469
 470                         /* defaults may be inherited */
 471                         COMMON_ATTRS
 472                 ") )",
 473                         Cft_Misc, metacfg, meta_ldadd },
 474         { NULL, 0, NULL }
 475 };
 476
 477 static int
 478 meta_ldadd( CfEntryInfo *p, Entry *e, ConfigArgs *c )
 479 {
 480         if ( p->ce_type != Cft_Database || !p->ce_be ||
 481                 p->ce_be->be_cf_ocs != metaocs )
 482                 return LDAP_CONSTRAINT_VIOLATION;
 483
 484         c->be = p->ce_be;
 485         return LDAP_SUCCESS;
 486 }
 487
 488 static int
 489 meta_cfadd( Operation *op, SlapReply *rs, Entry *p, ConfigArgs *c )
 490 {
 491         metainfo_t      *mi = ( metainfo_t * )c->be->be_private;
 492         struct berval bv;
 493         int i;
 494
 495         bv.bv_val = c->cr_msg;
 496         for ( i=0; i<mi->mi_ntargets; i++ ) {
 497                 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg),
 498                         "olcMetaSub=" SLAP_X_ORDERED_FMT "uri", i );
 499                 c->ca_private = mi->mi_targets[i];
 500                 c->valx = i;
 501                 config_build_entry( op, rs, p->e_private, c,
 502                         &bv, &metaocs[1], NULL );
 503         }
 504
 505         return LDAP_SUCCESS;
 506 }
 507
 508 static int
 509 meta_rwi_init( struct rewrite_info **rwm_rw )
 510 {
 511         char                    *rargv[ 3 ];
 512
 513         *rwm_rw = rewrite_info_init( REWRITE_MODE_USE_DEFAULT );
 514         if ( *rwm_rw == NULL ) {
 515                 return -1;
 516         }
 517         /*
 518          * the filter rewrite as a string must be disabled
 519          * by default; it can be re-enabled by adding rules;
 520          * this creates an empty rewriteContext
 521          */
 522         rargv[ 0 ] = "rewriteContext";
 523         rargv[ 1 ] = "searchFilter";
 524         rargv[ 2 ] = NULL;
 525         rewrite_parse( *rwm_rw, "<suffix massage>", 1, 2, rargv );
 526
 527         rargv[ 0 ] = "rewriteContext";
 528         rargv[ 1 ] = "default";
 529         rargv[ 2 ] = NULL;
 530         rewrite_parse( *rwm_rw, "<suffix massage>", 1, 2, rargv );
 531
 532         return 0;
 533 }
 534
 535 static int
 536 meta_back_new_target(
 537         metatarget_t    **mtp )
 538 {
 539         metatarget_t            *mt;
 540
 541         *mtp = NULL;
 542
 543         mt = ch_calloc( sizeof( metatarget_t ), 1 );
 544
 545         if ( meta_rwi_init( &mt->mt_rwmap.rwm_rw )) {
 546                 ch_free( mt );
 547                 return -1;
 548         }
 549
 550         ldap_pvt_thread_mutex_init( &mt->mt_uri_mutex );
 551
 552         mt->mt_idassert_mode = LDAP_BACK_IDASSERT_LEGACY;
 553         mt->mt_idassert_authmethod = LDAP_AUTH_NONE;
 554         mt->mt_idassert_tls = SB_TLS_DEFAULT;
 555
 556         /* by default, use proxyAuthz control on each operation */
 557         mt->mt_idassert_flags = LDAP_BACK_AUTH_PRESCRIPTIVE;
 558
 559         *mtp = mt;
 560
 561         return 0;
 562 }
 563
 564 /* Validation for suffixmassage_config */
 565 static int
 566 meta_suffixm_config(
 567         ConfigArgs *c,
 568         int argc,
 569         char **argv,
 570         metatarget_t *mt
 571 )
 572 {
 573         BackendDB       *tmp_bd;
 574         struct berval   dn, nvnc, pvnc, nrnc, prnc;
 575         int j, rc;
 576
 577         /*
 578          * syntax:
 579          *
 580          *      suffixmassage <suffix> <massaged suffix>
 581          *
 582          * the <suffix> field must be defined as a valid suffix
 583          * (or suffixAlias?) for the current database;
 584          * the <massaged suffix> shouldn't have already been
 585          * defined as a valid suffix or suffixAlias for the
 586          * current server
 587          */
 588
 589         ber_str2bv( argv[ 1 ], 0, 0, &dn );
 590         if ( dnPrettyNormal( NULL, &dn, &pvnc, &nvnc, NULL ) != LDAP_SUCCESS ) {
 591                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
 592                         "suffix \"%s\" is invalid",
 593                         argv[1] );
 594                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
 595                 return 1;
 596         }
 597
 598         for ( j = 0; !BER_BVISNULL( &c->be->be_nsuffix[ j ] ); j++ ) {
 599                 if ( dnIsSuffix( &nvnc, &c->be->be_nsuffix[ 0 ] ) ) {
 600                         break;
 601                 }
 602         }
 603
 604         if ( BER_BVISNULL( &c->be->be_nsuffix[ j ] ) ) {
 605                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
 606                         "suffix \"%s\" must be within the database naming context",
 607                         argv[1] );
 608                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
 609                 free( pvnc.bv_val );
 610                 free( nvnc.bv_val );
 611                 return 1;
 612         }
 613
 614         ber_str2bv( argv[ 2 ], 0, 0, &dn );
 615         if ( dnPrettyNormal( NULL, &dn, &prnc, &nrnc, NULL ) != LDAP_SUCCESS ) {
 616                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
 617                         "massaged suffix \"%s\" is invalid",
 618                         argv[2] );
 619                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
 620                 free( pvnc.bv_val );
 621                 free( nvnc.bv_val );
 622                 return 1;
 623         }
 624
 625         tmp_bd = select_backend( &nrnc, 0 );
 626         if ( tmp_bd != NULL && tmp_bd->be_private == c->be->be_private ) {
 627                 Debug( LDAP_DEBUG_ANY,
 628         "%s: warning: <massaged suffix> \"%s\" resolves to this database, in "
 629         "\"suffixMassage <suffix> <massaged suffix>\"\n",
 630                         c->log, prnc.bv_val, 0 );
 631         }
 632
 633         /*
 634          * The suffix massaging is emulated by means of the
 635          * rewrite capabilities
 636          */
 637         rc = suffix_massage_config( mt->mt_rwmap.rwm_rw,
 638                         &pvnc, &nvnc, &prnc, &nrnc );
 639
 640         free( pvnc.bv_val );
 641         free( nvnc.bv_val );
 642         free( prnc.bv_val );
 643         free( nrnc.bv_val );
 644
 645         return rc;
 646 }
 647
 648 static int
 649 slap_bv_x_ordered_unparse( BerVarray in, BerVarray *out )
 650 {
 651         int             i;
 652         BerVarray       bva = NULL;
 653         char            ibuf[32], *ptr;
 654         struct berval   idx;
 655
 656         assert( in != NULL );
 657
 658         for ( i = 0; !BER_BVISNULL( &in[i] ); i++ )
 659                 /* count'em */ ;
 660
 661         if ( i == 0 ) {
 662                 return 1;
 663         }
 664
 665         idx.bv_val = ibuf;
 666
 667         bva = ch_malloc( ( i + 1 ) * sizeof(struct berval) );
 668         BER_BVZERO( &bva[ 0 ] );
 669
 670         for ( i = 0; !BER_BVISNULL( &in[i] ); i++ ) {
 671                 idx.bv_len = snprintf( idx.bv_val, sizeof( ibuf ), SLAP_X_ORDERED_FMT, i );
 672                 if ( idx.bv_len >= sizeof( ibuf ) ) {
 673                         ber_bvarray_free( bva );
 674                         return 1;
 675                 }
 676
 677                 bva[i].bv_len = idx.bv_len + in[i].bv_len;
 678                 bva[i].bv_val = ch_malloc( bva[i].bv_len + 1 );
 679                 ptr = lutil_strcopy( bva[i].bv_val, ibuf );
 680                 ptr = lutil_strcopy( ptr, in[i].bv_val );
 681                 *ptr = '\0';
 682                 BER_BVZERO( &bva[ i + 1 ] );
 683         }
 684
 685         *out = bva;
 686         return 0;
 687 }
 688
 689 int
 690 meta_subtree_free( metasubtree_t *ms )
 691 {
 692         switch ( ms->ms_type ) {
 693         case META_ST_SUBTREE:
 694         case META_ST_SUBORDINATE:
 695                 ber_memfree( ms->ms_dn.bv_val );
 696                 break;
 697
 698         case META_ST_REGEX:
 699                 regfree( &ms->ms_regex );
 700                 ber_memfree( ms->ms_regex_pattern.bv_val );
 701                 break;
 702
 703         default:
 704                 return -1;
 705         }
 706
 707         ch_free( ms );
 708         return 0;
 709 }
 710
 711 int
 712 meta_subtree_destroy( metasubtree_t *ms )
 713 {
 714         if ( ms->ms_next ) {
 715                 meta_subtree_destroy( ms->ms_next );
 716         }
 717
 718         return meta_subtree_free( ms );
 719 }
 720
 721 static struct berval st_styles[] = {
 722         BER_BVC("subtree"),
 723         BER_BVC("children"),
 724         BER_BVC("regex")
 725 };
 726
 727 static int
 728 meta_subtree_unparse(
 729         ConfigArgs *c,
 730         metatarget_t *mt )
 731 {
 732         metasubtree_t   *ms;
 733         struct berval bv, *style;
 734
 735         if ( !mt->mt_subtree )
 736                 return 1;
 737
 738         /* can only be one of exclude or include */
 739         if (( c->type == LDAP_BACK_CFG_SUBTREE_EX ) ^ mt->mt_subtree_exclude )
 740                 return 1;
 741
 742         bv.bv_val = c->cr_msg;
 743         for ( ms=mt->mt_subtree; ms; ms=ms->ms_next ) {
 744                 if (ms->ms_type == META_ST_SUBTREE)
 745                         style = &st_styles[0];
 746                 else if ( ms->ms_type == META_ST_SUBORDINATE )
 747                         style = &st_styles[1];
 748                 else if ( ms->ms_type == META_ST_REGEX )
 749                         style = &st_styles[2];
 750                 else {
 751                         assert(0);
 752                         continue;
 753                 }
 754                 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg),
 755                         "dn.%s:%s", style->bv_val, ms->ms_dn.bv_val );
 756                 value_add_one( &c->rvalue_vals, &bv );
 757         }
 758         return 0;
 759 }
 760
 761 static int
 762 meta_subtree_config(
 763         metatarget_t *mt,
 764         ConfigArgs *c )
 765 {
 766         meta_st_t       type = META_ST_SUBTREE;
 767         char            *pattern;
 768         struct berval   ndn = BER_BVNULL;
 769         metasubtree_t   *ms = NULL;
 770
 771         if ( c->type == LDAP_BACK_CFG_SUBTREE_EX ) {
 772                 if ( mt->mt_subtree && !mt->mt_subtree_exclude ) {
 773                         snprintf( c->cr_msg, sizeof(c->cr_msg),
 774                                 "\"subtree-exclude\" incompatible with previous \"subtree-include\" directives" );
 775                         return 1;
 776                 }
 777
 778                 mt->mt_subtree_exclude = 1;
 779
 780         } else {
 781                 if ( mt->mt_subtree && mt->mt_subtree_exclude ) {
 782                         snprintf( c->cr_msg, sizeof(c->cr_msg),
 783                                 "\"subtree-include\" incompatible with previous \"subtree-exclude\" directives" );
 784                         return 1;
 785                 }
 786         }
 787
 788         pattern = c->argv[1];
 789         if ( strncasecmp( pattern, "dn", STRLENOF( "dn" ) ) == 0 ) {
 790                 char *style;
 791
 792                 pattern = &pattern[STRLENOF( "dn")];
 793
 794                 if ( pattern[0] == '.' ) {
 795                         style = &pattern[1];
 796
 797                         if ( strncasecmp( style, "subtree", STRLENOF( "subtree" ) ) == 0 ) {
 798                                 type = META_ST_SUBTREE;
 799                                 pattern = &style[STRLENOF( "subtree" )];
 800
 801                         } else if ( strncasecmp( style, "children", STRLENOF( "children" ) ) == 0 ) {
 802                                 type = META_ST_SUBORDINATE;
 803                                 pattern = &style[STRLENOF( "children" )];
 804
 805                         } else if ( strncasecmp( style, "sub", STRLENOF( "sub" ) ) == 0 ) {
 806                                 type = META_ST_SUBTREE;
 807                                 pattern = &style[STRLENOF( "sub" )];
 808
 809                         } else if ( strncasecmp( style, "regex", STRLENOF( "regex" ) ) == 0 ) {
 810                                 type = META_ST_REGEX;
 811                                 pattern = &style[STRLENOF( "regex" )];
 812
 813                         } else {
 814                                 snprintf( c->cr_msg, sizeof(c->cr_msg), "unknown style in \"dn.<style>\"" );
 815                                 return 1;
 816                         }
 817                 }
 818
 819                 if ( pattern[0] != ':' ) {
 820                         snprintf( c->cr_msg, sizeof(c->cr_msg), "missing colon after \"dn.<style>\"" );
 821                         return 1;
 822                 }
 823                 pattern++;
 824         }
 825
 826         switch ( type ) {
 827         case META_ST_SUBTREE:
 828         case META_ST_SUBORDINATE: {
 829                 struct berval dn;
 830
 831                 ber_str2bv( pattern, 0, 0, &dn );
 832                 if ( dnNormalize( 0, NULL, NULL, &dn, &ndn, NULL )
 833                         != LDAP_SUCCESS )
 834                 {
 835                         snprintf( c->cr_msg, sizeof(c->cr_msg), "DN=\"%s\" is invalid", pattern );
 836                         return 1;
 837                 }
 838
 839                 if ( !dnIsSuffix( &ndn, &mt->mt_nsuffix ) ) {
 840                         snprintf( c->cr_msg, sizeof(c->cr_msg),
 841                                 "DN=\"%s\" is not a subtree of target \"%s\"",
 842                                 pattern, mt->mt_nsuffix.bv_val );
 843                         ber_memfree( ndn.bv_val );
 844                         return( 1 );
 845                 }
 846                 } break;
 847
 848         default:
 849                 /* silence warnings */
 850                 break;
 851         }
 852
 853         ms = ch_calloc( sizeof( metasubtree_t ), 1 );
 854         ms->ms_type = type;
 855
 856         switch ( ms->ms_type ) {
 857         case META_ST_SUBTREE:
 858         case META_ST_SUBORDINATE:
 859                 ms->ms_dn = ndn;
 860                 break;
 861
 862         case META_ST_REGEX: {
 863                 int rc;
 864
 865                 rc = regcomp( &ms->ms_regex, pattern, REG_EXTENDED|REG_ICASE );
 866                 if ( rc != 0 ) {
 867                         char regerr[ SLAP_TEXT_BUFLEN ];
 868
 869                         regerror( rc, &ms->ms_regex, regerr, sizeof(regerr) );
 870
 871                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
 872                                 "regular expression \"%s\" bad because of %s",
 873                                 pattern, regerr );
 874                         ch_free( ms );
 875                         return 1;
 876                 }
 877                 ber_str2bv( pattern, 0, 1, &ms->ms_regex_pattern );
 878                 } break;
 879         }
 880
 881         if ( mt->mt_subtree == NULL ) {
 882                  mt->mt_subtree = ms;
 883
 884         } else {
 885                 metasubtree_t **msp;
 886
 887                 for ( msp = &mt->mt_subtree; *msp; ) {
 888                         switch ( ms->ms_type ) {
 889                         case META_ST_SUBTREE:
 890                                 switch ( (*msp)->ms_type ) {
 891                                 case META_ST_SUBTREE:
 892                                         if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
 893                                                 metasubtree_t *tmp = *msp;
 894                                                 Debug( LDAP_DEBUG_CONFIG,
 895                                                         "%s: previous rule \"dn.subtree:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
 896                                                         c->log, pattern, (*msp)->ms_dn.bv_val );
 897                                                 *msp = (*msp)->ms_next;
 898                                                 tmp->ms_next = NULL;
 899                                                 meta_subtree_destroy( tmp );
 900                                                 continue;
 901
 902                                         } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) ) {
 903                                                 Debug( LDAP_DEBUG_CONFIG,
 904                                                         "%s: previous rule \"dn.subtree:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
 905                                                         c->log, (*msp)->ms_dn.bv_val, pattern );
 906                                                 meta_subtree_destroy( ms );
 907                                                 ms = NULL;
 908                                                 return( 0 );
 909                                         }
 910                                         break;
 911
 912                                 case META_ST_SUBORDINATE:
 913                                         if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
 914                                                 metasubtree_t *tmp = *msp;
 915                                                 Debug( LDAP_DEBUG_CONFIG,
 916                                                         "%s: previous rule \"dn.children:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
 917                                                         c->log, pattern, (*msp)->ms_dn.bv_val );
 918                                                 *msp = (*msp)->ms_next;
 919                                                 tmp->ms_next = NULL;
 920                                                 meta_subtree_destroy( tmp );
 921                                                 continue;
 922
 923                                         } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) && ms->ms_dn.bv_len > (*msp)->ms_dn.bv_len ) {
 924                                                 Debug( LDAP_DEBUG_CONFIG,
 925                                                         "%s: previous rule \"dn.children:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
 926                                                         c->log, (*msp)->ms_dn.bv_val, pattern );
 927                                                 meta_subtree_destroy( ms );
 928                                                 ms = NULL;
 929                                                 return( 0 );
 930                                         }
 931                                         break;
 932
 933                                 case META_ST_REGEX:
 934                                         if ( regexec( &(*msp)->ms_regex, ms->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
 935                                                 Debug( LDAP_DEBUG_CONFIG,
 936                                                         "%s: previous rule \"dn.regex:%s\" may contain rule \"dn.subtree:%s\"\n",
 937                                                         c->log, (*msp)->ms_regex_pattern.bv_val, ms->ms_dn.bv_val );
 938                                         }
 939                                         break;
 940                                 }
 941                                 break;
 942
 943                         case META_ST_SUBORDINATE:
 944                                 switch ( (*msp)->ms_type ) {
 945                                 case META_ST_SUBTREE:
 946                                         if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
 947                                                 metasubtree_t *tmp = *msp;
 948                                                 Debug( LDAP_DEBUG_CONFIG,
 949                                                         "%s: previous rule \"dn.children:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
 950                                                         c->log, pattern, (*msp)->ms_dn.bv_val );
 951                                                 *msp = (*msp)->ms_next;
 952                                                 tmp->ms_next = NULL;
 953                                                 meta_subtree_destroy( tmp );
 954                                                 continue;
 955
 956                                         } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) && ms->ms_dn.bv_len > (*msp)->ms_dn.bv_len ) {
 957                                                 Debug( LDAP_DEBUG_CONFIG,
 958                                                         "%s: previous rule \"dn.children:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
 959                                                         c->log, (*msp)->ms_dn.bv_val, pattern );
 960                                                 meta_subtree_destroy( ms );
 961                                                 ms = NULL;
 962                                                 return( 0 );
 963                                         }
 964                                         break;
 965
 966                                 case META_ST_SUBORDINATE:
 967                                         if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
 968                                                 metasubtree_t *tmp = *msp;
 969                                                 Debug( LDAP_DEBUG_CONFIG,
 970                                                         "%s: previous rule \"dn.children:%s\" is contained in rule \"dn.children:%s\" (replaced)\n",
 971                                                         c->log, pattern, (*msp)->ms_dn.bv_val );
 972                                                 *msp = (*msp)->ms_next;
 973                                                 tmp->ms_next = NULL;
 974                                                 meta_subtree_destroy( tmp );
 975                                                 continue;
 976
 977                                         } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) ) {
 978                                                 Debug( LDAP_DEBUG_CONFIG,
 979                                                         "%s: previous rule \"dn.children:%s\" contains rule \"dn.children:%s\" (ignored)\n",
 980                                                         c->log, (*msp)->ms_dn.bv_val, pattern );
 981                                                 meta_subtree_destroy( ms );
 982                                                 ms = NULL;
 983                                                 return( 0 );
 984                                         }
 985                                         break;
 986
 987                                 case META_ST_REGEX:
 988                                         if ( regexec( &(*msp)->ms_regex, ms->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
 989                                                 Debug( LDAP_DEBUG_CONFIG,
 990                                                         "%s: previous rule \"dn.regex:%s\" may contain rule \"dn.subtree:%s\"\n",
 991                                                         c->log, (*msp)->ms_regex_pattern.bv_val, ms->ms_dn.bv_val );
 992                                         }
 993                                         break;
 994                                 }
 995                                 break;
 996
 997                         case META_ST_REGEX:
 998                                 switch ( (*msp)->ms_type ) {
 999                                 case META_ST_SUBTREE:
1000                                 case META_ST_SUBORDINATE:
1001                                         if ( regexec( &ms->ms_regex, (*msp)->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
1002                                                 Debug( LDAP_DEBUG_CONFIG,
1003                                                         "%s: previous rule \"dn.subtree:%s\" may be contained in rule \"dn.regex:%s\"\n",
1004                                                         c->log, (*msp)->ms_dn.bv_val, ms->ms_regex_pattern.bv_val );
1005                                         }
1006                                         break;
1007
1008                                 case META_ST_REGEX:
1009                                         /* no check possible */
1010                                         break;
1011                                 }
1012                                 break;
1013                         }
1014
1015                         msp = &(*msp)->ms_next;
1016                 }
1017
1018                 *msp = ms;
1019         }
1020
1021         return 0;
1022 }
1023
1024 static slap_verbmasks idassert_mode[] = {
1025         { BER_BVC("self"),              LDAP_BACK_IDASSERT_SELF },
1026         { BER_BVC("anonymous"),         LDAP_BACK_IDASSERT_ANONYMOUS },
1027         { BER_BVC("none"),              LDAP_BACK_IDASSERT_NOASSERT },
1028         { BER_BVC("legacy"),            LDAP_BACK_IDASSERT_LEGACY },
1029         { BER_BVNULL,                   0 }
1030 };
1031
1032 static slap_verbmasks tls_mode[] = {
1033         { BER_BVC( "propagate" ),       LDAP_BACK_F_TLS_PROPAGATE_MASK },
1034         { BER_BVC( "try-propagate" ),   LDAP_BACK_F_PROPAGATE_TLS },
1035         { BER_BVC( "start" ),           LDAP_BACK_F_TLS_USE_MASK },
1036         { BER_BVC( "try-start" ),       LDAP_BACK_F_USE_TLS },
1037         { BER_BVC( "ldaps" ),           LDAP_BACK_F_TLS_LDAPS },
1038         { BER_BVC( "none" ),            LDAP_BACK_F_NONE },
1039         { BER_BVNULL,                   0 }
1040 };
1041
1042 static slap_verbmasks t_f_mode[] = {
1043         { BER_BVC( "yes" ),             LDAP_BACK_F_T_F },
1044         { BER_BVC( "discover" ),        LDAP_BACK_F_T_F_DISCOVER },
1045         { BER_BVC( "no" ),              LDAP_BACK_F_NONE },
1046         { BER_BVNULL,                   0 }
1047 };
1048
1049 static slap_verbmasks cancel_mode[] = {
1050         { BER_BVC( "ignore" ),          LDAP_BACK_F_CANCEL_IGNORE },
1051         { BER_BVC( "exop" ),            LDAP_BACK_F_CANCEL_EXOP },
1052         { BER_BVC( "exop-discover" ),   LDAP_BACK_F_CANCEL_EXOP_DISCOVER },
1053         { BER_BVC( "abandon" ),         LDAP_BACK_F_CANCEL_ABANDON },
1054         { BER_BVNULL,                   0 }
1055 };
1056
1057 static slap_verbmasks onerr_mode[] = {
1058         { BER_BVC( "stop" ),            META_BACK_F_ONERR_STOP },
1059         { BER_BVC( "report" ),  META_BACK_F_ONERR_REPORT },
1060         { BER_BVC( "continue" ),                LDAP_BACK_F_NONE },
1061         { BER_BVNULL,                   0 }
1062 };
1063
1064 /* see enum in slap.h */
1065 static slap_cf_aux_table timeout_table[] = {
1066         { BER_BVC("bind="),     SLAP_OP_BIND * sizeof( time_t ),        'u', 0, NULL },
1067         /* unbind makes no sense */
1068         { BER_BVC("add="),      SLAP_OP_ADD * sizeof( time_t ),         'u', 0, NULL },
1069         { BER_BVC("delete="),   SLAP_OP_DELETE * sizeof( time_t ),      'u', 0, NULL },
1070         { BER_BVC("modrdn="),   SLAP_OP_MODRDN * sizeof( time_t ),      'u', 0, NULL },
1071         { BER_BVC("modify="),   SLAP_OP_MODIFY * sizeof( time_t ),      'u', 0, NULL },
1072         { BER_BVC("compare="),  SLAP_OP_COMPARE * sizeof( time_t ),     'u', 0, NULL },
1073         { BER_BVC("search="),   SLAP_OP_SEARCH * sizeof( time_t ),      'u', 0, NULL },
1074         /* abandon makes little sense */
1075 #if 0   /* not implemented yet */
1076         { BER_BVC("extended="), SLAP_OP_EXTENDED * sizeof( time_t ),    'u', 0, NULL },
1077 #endif
1078         { BER_BVNULL, 0, 0, 0, NULL }
1079 };
1080
1081 static int
1082 meta_back_cf_gen( ConfigArgs *c )
1083 {
1084         metainfo_t      *mi = ( metainfo_t * )c->be->be_private;
1085         metatarget_t    *mt;
1086         metacommon_t    *mc;
1087
1088         int i, rc = 0;
1089
1090         assert( mi != NULL );
1091
1092         if ( c->op == SLAP_CONFIG_EMIT || c->op == LDAP_MOD_DELETE ) {
1093                 if ( !mi )
1094                         return 1;
1095
1096                 if ( c->table == Cft_Database ) {
1097                         mt = NULL;
1098                         mc = &mi->mi_mc;
1099                 } else {
1100                         mt = c->ca_private;
1101                         mc = &mt->mt_mc;
1102                 }
1103         }
1104
1105         if ( c->op == SLAP_CONFIG_EMIT ) {
1106                 struct berval bv = BER_BVNULL;
1107
1108                 switch( c->type ) {
1109                 /* Base attrs */
1110                 case LDAP_BACK_CFG_CONN_TTL:
1111                         if ( mi->mi_conn_ttl == 0 ) {
1112                                 return 1;
1113                         } else {
1114                                 char    buf[ SLAP_TEXT_BUFLEN ];
1115
1116                                 lutil_unparse_time( buf, sizeof( buf ), mi->mi_conn_ttl );
1117                                 ber_str2bv( buf, 0, 0, &bv );
1118                                 value_add_one( &c->rvalue_vals, &bv );
1119                         }
1120                         break;
1121
1122                 case LDAP_BACK_CFG_DNCACHE_TTL:
1123                         if ( mi->mi_cache.ttl == META_DNCACHE_DISABLED ) {
1124                                 return 1;
1125                         } else if ( mi->mi_cache.ttl == META_DNCACHE_FOREVER ) {
1126                                 BER_BVSTR( &bv, "forever" );
1127                         } else {
1128                                 char    buf[ SLAP_TEXT_BUFLEN ];
1129
1130                                 lutil_unparse_time( buf, sizeof( buf ), mi->mi_cache.ttl );
1131                                 ber_str2bv( buf, 0, 0, &bv );
1132                         }
1133                         value_add_one( &c->rvalue_vals, &bv );
1134                         break;
1135
1136                 case LDAP_BACK_CFG_IDLE_TIMEOUT:
1137                         if ( mi->mi_idle_timeout == 0 ) {
1138                                 return 1;
1139                         } else {
1140                                 char    buf[ SLAP_TEXT_BUFLEN ];
1141
1142                                 lutil_unparse_time( buf, sizeof( buf ), mi->mi_idle_timeout );
1143                                 ber_str2bv( buf, 0, 0, &bv );
1144                                 value_add_one( &c->rvalue_vals, &bv );
1145                         }
1146                         break;
1147
1148                 case LDAP_BACK_CFG_ONERR:
1149                         enum_to_verb( onerr_mode, mi->mi_flags & META_BACK_F_ONERR_MASK, &bv );
1150                         if ( BER_BVISNULL( &bv )) {
1151                                 rc = 1;
1152                         } else {
1153                                 value_add_one( &c->rvalue_vals, &bv );
1154                         }
1155                         break;
1156
1157                 case LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER:
1158                         c->value_int = META_BACK_DEFER_ROOTDN_BIND( mi );
1159                         break;
1160
1161                 case LDAP_BACK_CFG_SINGLECONN:
1162                         c->value_int = LDAP_BACK_SINGLECONN( mi );
1163                         break;
1164
1165                 case LDAP_BACK_CFG_USETEMP:
1166                         c->value_int = LDAP_BACK_USE_TEMPORARIES( mi );
1167                         break;
1168
1169                 case LDAP_BACK_CFG_CONNPOOLMAX:
1170                         c->value_int = mi->mi_conn_priv_max;
1171                         break;
1172
1173                 /* common attrs */
1174                 case LDAP_BACK_CFG_BIND_TIMEOUT:
1175                         if ( mc->mc_bind_timeout.tv_sec == 0 &&
1176                                 mc->mc_bind_timeout.tv_usec == 0 ) {
1177                                 return 1;
1178                         } else {
1179                                 c->value_ulong = mc->mc_bind_timeout.tv_sec * 1000000UL +
1180                                         mc->mc_bind_timeout.tv_usec;
1181                         }
1182                         break;
1183
1184                 case LDAP_BACK_CFG_CANCEL: {
1185                         slap_mask_t     mask = LDAP_BACK_F_CANCEL_MASK2;
1186
1187                         if ( mt && META_BACK_TGT_CANCEL_DISCOVER( mt ) ) {
1188                                 mask &= ~LDAP_BACK_F_CANCEL_EXOP;
1189                         }
1190                         enum_to_verb( cancel_mode, (mc->mc_flags & mask), &bv );
1191                         if ( BER_BVISNULL( &bv ) ) {
1192                                 /* there's something wrong... */
1193                                 assert( 0 );
1194                                 rc = 1;
1195
1196                         } else {
1197                                 value_add_one( &c->rvalue_vals, &bv );
1198                         }
1199                         } break;
1200
1201                 case LDAP_BACK_CFG_CHASE:
1202                         c->value_int = META_BACK_CMN_CHASE_REFERRALS(mc);
1203                         break;
1204
1205 #ifdef SLAPD_META_CLIENT_PR
1206                 case LDAP_BACK_CFG_CLIENT_PR:
1207                         if ( mc->mc_ps == META_CLIENT_PR_DISABLE ) {
1208                                 return 1;
1209                         } else if ( mc->mc_ps == META_CLIENT_PR_ACCEPT_UNSOLICITED ) {
1210                                 BER_BVSTR( &bv, "accept-unsolicited" );
1211                         } else {
1212                                 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d", mc->mc_ps );
1213                                 bv.bv_val = c->cr_msg;
1214                         }
1215                         value_add_one( &c->rvalue_vals, &bv );
1216                         break;
1217 #endif /* SLAPD_META_CLIENT_PR */
1218
1219                 case LDAP_BACK_CFG_DEFAULT_T:
1220                         if ( mt || mi->mi_defaulttarget == META_DEFAULT_TARGET_NONE )
1221                                 return 1;
1222                         bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d", mi->mi_defaulttarget );
1223                         bv.bv_val = c->cr_msg;
1224                         value_add_one( &c->rvalue_vals, &bv );
1225                         break;
1226
1227                 case LDAP_BACK_CFG_NETWORK_TIMEOUT:
1228                         if ( mc->mc_network_timeout == 0 ) {
1229                                 return 1;
1230                         }
1231                         bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%ld",
1232                                 mc->mc_network_timeout );
1233                         bv.bv_val = c->cr_msg;
1234                         value_add_one( &c->rvalue_vals, &bv );
1235                         break;
1236
1237                 case LDAP_BACK_CFG_NOREFS:
1238                         c->value_int = META_BACK_CMN_NOREFS(mc);
1239                         break;
1240
1241                 case LDAP_BACK_CFG_NOUNDEFFILTER:
1242                         c->value_int = META_BACK_CMN_NOUNDEFFILTER(mc);
1243                         break;
1244
1245                 case LDAP_BACK_CFG_NRETRIES:
1246                         if ( mc->mc_nretries == META_RETRY_FOREVER ) {
1247                                 BER_BVSTR( &bv, "forever" );
1248                         } else if ( mc->mc_nretries == META_RETRY_NEVER ) {
1249                                 BER_BVSTR( &bv, "never" );
1250                         } else {
1251                                 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d",
1252                                         mc->mc_nretries );
1253                                 bv.bv_val = c->cr_msg;
1254                         }
1255                         value_add_one( &c->rvalue_vals, &bv );
1256                         break;
1257
1258                 case LDAP_BACK_CFG_QUARANTINE:
1259                         if ( !META_BACK_CMN_QUARANTINE( mc )) {
1260                                 rc = 1;
1261                                 break;
1262                         }
1263                         rc = mi->mi_ldap_extra->retry_info_unparse( &mc->mc_quarantine, &bv );
1264                         if ( rc == 0 ) {
1265                                 ber_bvarray_add( &c->rvalue_vals, &bv );
1266                         }
1267                         break;
1268
1269                 case LDAP_BACK_CFG_REBIND:
1270                         c->value_int = META_BACK_CMN_SAVECRED(mc);
1271                         break;
1272
1273                 case LDAP_BACK_CFG_TIMEOUT:
1274                         for ( i = 0; i < SLAP_OP_LAST; i++ ) {
1275                                 if ( mc->mc_timeout[ i ] != 0 ) {
1276                                         break;
1277                                 }
1278                         }
1279
1280                         if ( i == SLAP_OP_LAST ) {
1281                                 return 1;
1282                         }
1283
1284                         BER_BVZERO( &bv );
1285                         slap_cf_aux_table_unparse( mc->mc_timeout, &bv, timeout_table );
1286
1287                         if ( BER_BVISNULL( &bv ) ) {
1288                                 return 1;
1289                         }
1290
1291                         for ( i = 0; isspace( (unsigned char) bv.bv_val[ i ] ); i++ )
1292                                 /* count spaces */ ;
1293
1294                         if ( i ) {
1295                                 bv.bv_len -= i;
1296                                 AC_MEMCPY( bv.bv_val, &bv.bv_val[ i ],
1297                                         bv.bv_len + 1 );
1298                         }
1299
1300                         ber_bvarray_add( &c->rvalue_vals, &bv );
1301                         break;
1302
1303                 case LDAP_BACK_CFG_VERSION:
1304                         if ( mc->mc_version == 0 )
1305                                 return 1;
1306                         c->value_int = mc->mc_version;
1307                         break;
1308
1309 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
1310                 case LDAP_BACK_CFG_ST_REQUEST:
1311                         c->value_int = META_BACK_CMN_ST_REQUEST( mc );
1312                         break;
1313 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
1314
1315                 case LDAP_BACK_CFG_T_F:
1316                         enum_to_verb( t_f_mode, (mc->mc_flags & LDAP_BACK_F_T_F_MASK2), &bv );
1317                         if ( BER_BVISNULL( &bv ) ) {
1318                                 /* there's something wrong... */
1319                                 assert( 0 );
1320                                 rc = 1;
1321
1322                         } else {
1323                                 value_add_one( &c->rvalue_vals, &bv );
1324                         }
1325                         break;
1326
1327                 case LDAP_BACK_CFG_TLS: {
1328                         struct berval bc = BER_BVNULL, bv2;
1329
1330                         if (( mc->mc_flags & LDAP_BACK_F_TLS_MASK ) == LDAP_BACK_F_NONE ) {
1331                                 rc = 1;
1332                                 break;
1333                         }
1334                         enum_to_verb( tls_mode, ( mc->mc_flags & LDAP_BACK_F_TLS_MASK ), &bv );
1335                         assert( !BER_BVISNULL( &bv ) );
1336
1337                         if ( mt ) {
1338                                 bindconf_tls_unparse( &mt->mt_tls, &bc );
1339                         }
1340
1341                         if ( !BER_BVISEMPTY( &bc )) {
1342                                 bv2.bv_len = bv.bv_len + bc.bv_len + 1;
1343                                 bv2.bv_val = ch_malloc( bv2.bv_len + 1 );
1344                                 strcpy( bv2.bv_val, bv.bv_val );
1345                                 bv2.bv_val[bv.bv_len] = ' ';
1346                                 strcpy( &bv2.bv_val[bv.bv_len + 1], bc.bv_val );
1347                                 ber_memfree( bc.bv_val );
1348                                 ber_bvarray_add( &c->rvalue_vals, &bv2 );
1349                         } else {
1350                                 value_add_one( &c->rvalue_vals, &bv );
1351                         }
1352                         } break;
1353
1354                 /* target attrs */
1355                 case LDAP_BACK_CFG_URI: {
1356                         char *p2, *p1 = strchr( mt->mt_uri, ' ' );
1357                         bv.bv_len = strlen( mt->mt_uri ) + 3 + mt->mt_psuffix.bv_len;
1358                         bv.bv_val = ch_malloc( bv.bv_len + 1 );
1359                         p2 = bv.bv_val;
1360                         *p2++ = '"';
1361                         if ( p1 ) {
1362                                 p2 = lutil_strncopy( p2, mt->mt_uri, p1 - mt->mt_uri );
1363                         } else {
1364                                 p2 = lutil_strcopy( p2, mt->mt_uri );
1365                         }
1366                         *p2++ = '/';
1367                         p2 = lutil_strcopy( p2, mt->mt_psuffix.bv_val );
1368                         *p2++ = '"';
1369                         if ( p1 ) {
1370                                 strcpy( p2, p1 );
1371                         }
1372                         ber_bvarray_add( &c->rvalue_vals, &bv );
1373                         } break;
1374
1375                 case LDAP_BACK_CFG_ACL_AUTHCDN:
1376                 case LDAP_BACK_CFG_ACL_PASSWD:
1377                         /* FIXME no point here, there is no code implementing
1378                          * their features. Was this supposed to implement
1379                          * acl-bind like back-ldap?
1380                          */
1381                         rc = 1;
1382                         break;
1383
1384                 case LDAP_BACK_CFG_IDASSERT_AUTHZFROM: {
1385                         BerVarray       *bvp;
1386                         int             i;
1387                         struct berval   bv = BER_BVNULL;
1388                         char            buf[SLAP_TEXT_BUFLEN];
1389
1390                         bvp = &mt->mt_idassert_authz;
1391                         if ( *bvp == NULL ) {
1392                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_AUTHZ_ALL )
1393                                 {
1394                                         BER_BVSTR( &bv, "*" );
1395                                         value_add_one( &c->rvalue_vals, &bv );
1396
1397                                 } else {
1398                                         rc = 1;
1399                                 }
1400                                 break;
1401                         }
1402
1403                         for ( i = 0; !BER_BVISNULL( &((*bvp)[ i ]) ); i++ ) {
1404                                 char *ptr;
1405                                 int len = snprintf( buf, sizeof( buf ), SLAP_X_ORDERED_FMT, i );
1406                                 bv.bv_len = ((*bvp)[ i ]).bv_len + len;
1407                                 bv.bv_val = ber_memrealloc( bv.bv_val, bv.bv_len + 1 );
1408                                 ptr = bv.bv_val;
1409                                 ptr = lutil_strcopy( ptr, buf );
1410                                 ptr = lutil_strncopy( ptr, ((*bvp)[ i ]).bv_val, ((*bvp)[ i ]).bv_len );
1411                                 value_add_one( &c->rvalue_vals, &bv );
1412                         }
1413                         if ( bv.bv_val ) {
1414                                 ber_memfree( bv.bv_val );
1415                         }
1416                         break;
1417                 }
1418
1419                 case LDAP_BACK_CFG_IDASSERT_BIND: {
1420                         int             i;
1421                         struct berval   bc = BER_BVNULL;
1422                         char            *ptr;
1423
1424                         if ( mt->mt_idassert_authmethod == LDAP_AUTH_NONE ) {
1425                                 return 1;
1426                         } else {
1427                                 ber_len_t       len;
1428
1429                                 switch ( mt->mt_idassert_mode ) {
1430                                 case LDAP_BACK_IDASSERT_OTHERID:
1431                                 case LDAP_BACK_IDASSERT_OTHERDN:
1432                                         break;
1433
1434                                 default: {
1435                                         struct berval   mode = BER_BVNULL;
1436
1437                                         enum_to_verb( idassert_mode, mt->mt_idassert_mode, &mode );
1438                                         if ( BER_BVISNULL( &mode ) ) {
1439                                                 /* there's something wrong... */
1440                                                 assert( 0 );
1441                                                 rc = 1;
1442
1443                                         } else {
1444                                                 bv.bv_len = STRLENOF( "mode=" ) + mode.bv_len;
1445                                                 bv.bv_val = ch_malloc( bv.bv_len + 1 );
1446
1447                                                 ptr = lutil_strcopy( bv.bv_val, "mode=" );
1448                                                 ptr = lutil_strcopy( ptr, mode.bv_val );
1449                                         }
1450                                         break;
1451                                 }
1452                                 }
1453
1454                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_NATIVE_AUTHZ ) {
1455                                         len = bv.bv_len + STRLENOF( "authz=native" );
1456
1457                                         if ( !BER_BVISEMPTY( &bv ) ) {
1458                                                 len += STRLENOF( " " );
1459                                         }
1460
1461                                         bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
1462
1463                                         ptr = &bv.bv_val[ bv.bv_len ];
1464
1465                                         if ( !BER_BVISEMPTY( &bv ) ) {
1466                                                 ptr = lutil_strcopy( ptr, " " );
1467                                         }
1468
1469                                         (void)lutil_strcopy( ptr, "authz=native" );
1470                                 }
1471
1472                                 len = bv.bv_len + STRLENOF( "flags=non-prescriptive,override,obsolete-encoding-workaround,proxy-authz-non-critical,dn-authzid" );
1473                                 /* flags */
1474                                 if ( !BER_BVISEMPTY( &bv ) ) {
1475                                         len += STRLENOF( " " );
1476                                 }
1477
1478                                 bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
1479
1480                                 ptr = &bv.bv_val[ bv.bv_len ];
1481
1482                                 if ( !BER_BVISEMPTY( &bv ) ) {
1483                                         ptr = lutil_strcopy( ptr, " " );
1484                                 }
1485
1486                                 ptr = lutil_strcopy( ptr, "flags=" );
1487
1488                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_PRESCRIPTIVE ) {
1489                                         ptr = lutil_strcopy( ptr, "prescriptive" );
1490                                 } else {
1491                                         ptr = lutil_strcopy( ptr, "non-prescriptive" );
1492                                 }
1493
1494                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OVERRIDE ) {
1495                                         ptr = lutil_strcopy( ptr, ",override" );
1496                                 }
1497
1498                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_PROXY_AUTHZ ) {
1499                                         ptr = lutil_strcopy( ptr, ",obsolete-proxy-authz" );
1500
1501                                 } else if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_ENCODING_WORKAROUND ) {
1502                                         ptr = lutil_strcopy( ptr, ",obsolete-encoding-workaround" );
1503                                 }
1504
1505                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_PROXYAUTHZ_CRITICAL ) {
1506                                         ptr = lutil_strcopy( ptr, ",proxy-authz-critical" );
1507
1508                                 } else {
1509                                         ptr = lutil_strcopy( ptr, ",proxy-authz-non-critical" );
1510                                 }
1511
1512 #ifdef SLAP_AUTH_DN
1513                                 switch ( mt->mt_idassert_flags & LDAP_BACK_AUTH_DN_MASK ) {
1514                                 case LDAP_BACK_AUTH_DN_AUTHZID:
1515                                         ptr = lutil_strcopy( ptr, ",dn-authzid" );
1516                                         break;
1517
1518                                 case LDAP_BACK_AUTH_DN_WHOAMI:
1519                                         ptr = lutil_strcopy( ptr, ",dn-whoami" );
1520                                         break;
1521
1522                                 default:
1523 #if 0 /* implicit */
1524                                         ptr = lutil_strcopy( ptr, ",dn-none" );
1525 #endif
1526                                         break;
1527                                 }
1528 #endif
1529
1530                                 bv.bv_len = ( ptr - bv.bv_val );
1531                                 /* end-of-flags */
1532                         }
1533
1534                         bindconf_unparse( &mt->mt_idassert.si_bc, &bc );
1535
1536                         if ( !BER_BVISNULL( &bv ) ) {
1537                                 ber_len_t       len = bv.bv_len + bc.bv_len;
1538
1539                                 bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
1540
1541                                 assert( bc.bv_val[ 0 ] == ' ' );
1542
1543                                 ptr = lutil_strcopy( &bv.bv_val[ bv.bv_len ], bc.bv_val );
1544                                 free( bc.bv_val );
1545                                 bv.bv_len = ptr - bv.bv_val;
1546
1547                         } else {
1548                                 for ( i = 0; isspace( (unsigned char) bc.bv_val[ i ] ); i++ )
1549                                         /* count spaces */ ;
1550
1551                                 if ( i ) {
1552                                         bc.bv_len -= i;
1553                                         AC_MEMCPY( bc.bv_val, &bc.bv_val[ i ], bc.bv_len + 1 );
1554                                 }
1555
1556                                 bv = bc;
1557                         }
1558
1559                         ber_bvarray_add( &c->rvalue_vals, &bv );
1560
1561                         break;
1562                 }
1563
1564                 case LDAP_BACK_CFG_SUFFIXM:     /* unused */
1565                 case LDAP_BACK_CFG_REWRITE:
1566                         if ( mt->mt_rwmap.rwm_bva_rewrite == NULL ) {
1567                                 rc = 1;
1568                         } else {
1569                                 rc = slap_bv_x_ordered_unparse( mt->mt_rwmap.rwm_bva_rewrite, &c->rvalue_vals );
1570                         }
1571                         break;
1572
1573                 case LDAP_BACK_CFG_MAP:
1574                         if ( mt->mt_rwmap.rwm_bva_map == NULL ) {
1575                                 rc = 1;
1576                         } else {
1577                                 rc = slap_bv_x_ordered_unparse( mt->mt_rwmap.rwm_bva_map, &c->rvalue_vals );
1578                         }
1579                         break;
1580
1581                 case LDAP_BACK_CFG_SUBTREE_EX:
1582                 case LDAP_BACK_CFG_SUBTREE_IN:
1583                         rc = meta_subtree_unparse( c, mt );
1584                         break;
1585
1586                 /* replaced by idassert */
1587                 case LDAP_BACK_CFG_PSEUDOROOTDN:
1588                 case LDAP_BACK_CFG_PSEUDOROOTPW:
1589                         rc = 1;
1590                         break;
1591
1592                 default:
1593                         rc = 1;
1594                 }
1595                 return rc;
1596         } else if ( c->op == LDAP_MOD_DELETE ) {
1597                 switch( c->type ) {
1598                 /* Base attrs */
1599                 case LDAP_BACK_CFG_CONN_TTL:
1600                         mi->mi_conn_ttl = 0;
1601                         break;
1602
1603                 case LDAP_BACK_CFG_DNCACHE_TTL:
1604                         mi->mi_cache.ttl = META_DNCACHE_DISABLED;
1605                         break;
1606
1607                 case LDAP_BACK_CFG_IDLE_TIMEOUT:
1608                         mi->mi_idle_timeout = 0;
1609                         break;
1610
1611                 case LDAP_BACK_CFG_ONERR:
1612                         mi->mi_flags &= ~META_BACK_F_ONERR_MASK;
1613                         break;
1614
1615                 case LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER:
1616                         mi->mi_flags &= ~META_BACK_F_DEFER_ROOTDN_BIND;
1617                         break;
1618
1619                 case LDAP_BACK_CFG_SINGLECONN:
1620                         mi->mi_flags &= ~LDAP_BACK_F_SINGLECONN;
1621                         break;
1622
1623                 case LDAP_BACK_CFG_USETEMP:
1624                         mi->mi_flags &= ~LDAP_BACK_F_USE_TEMPORARIES;
1625                         break;
1626
1627                 case LDAP_BACK_CFG_CONNPOOLMAX:
1628                         mi->mi_conn_priv_max = LDAP_BACK_CONN_PRIV_MIN;
1629                         break;
1630
1631                 /* common attrs */
1632                 case LDAP_BACK_CFG_BIND_TIMEOUT:
1633                         mc->mc_bind_timeout.tv_sec = 0;
1634                         mc->mc_bind_timeout.tv_usec = 0;
1635                         break;
1636
1637                 case LDAP_BACK_CFG_CANCEL:
1638                         mc->mc_flags &= ~LDAP_BACK_F_CANCEL_MASK2;
1639                         break;
1640
1641                 case LDAP_BACK_CFG_CHASE:
1642                         mc->mc_flags &= ~LDAP_BACK_F_CHASE_REFERRALS;
1643                         break;
1644
1645 #ifdef SLAPD_META_CLIENT_PR
1646                 case LDAP_BACK_CFG_CLIENT_PR:
1647                         mc->mc_ps == META_CLIENT_PR_DISABLE;
1648                         break;
1649 #endif /* SLAPD_META_CLIENT_PR */
1650
1651                 case LDAP_BACK_CFG_DEFAULT_T:
1652                         mi->mi_defaulttarget = META_DEFAULT_TARGET_NONE;
1653                         break;
1654
1655                 case LDAP_BACK_CFG_NETWORK_TIMEOUT:
1656                         mc->mc_network_timeout = 0;
1657                         break;
1658
1659                 case LDAP_BACK_CFG_NOREFS:
1660                         mc->mc_flags &= ~LDAP_BACK_F_NOREFS;
1661                         break;
1662
1663                 case LDAP_BACK_CFG_NOUNDEFFILTER:
1664                         mc->mc_flags &= ~LDAP_BACK_F_NOUNDEFFILTER;
1665                         break;
1666
1667                 case LDAP_BACK_CFG_NRETRIES:
1668                         mc->mc_nretries == META_RETRY_DEFAULT;
1669                         break;
1670
1671                 case LDAP_BACK_CFG_QUARANTINE:
1672                         if ( META_BACK_CMN_QUARANTINE( mc )) {
1673                                 mi->mi_ldap_extra->retry_info_destroy( &mc->mc_quarantine );
1674                                 mc->mc_flags &= ~LDAP_BACK_F_QUARANTINE;
1675                                 if ( mc == &mt->mt_mc ) {
1676                                         ldap_pvt_thread_mutex_destroy( &mt->mt_quarantine_mutex );
1677                                         mt->mt_isquarantined = 0;
1678                                 }
1679                         }
1680                         break;
1681
1682                 case LDAP_BACK_CFG_REBIND:
1683                         mc->mc_flags &= ~LDAP_BACK_F_SAVECRED;
1684                         break;
1685
1686                 case LDAP_BACK_CFG_TIMEOUT:
1687                         for ( i = 0; i < SLAP_OP_LAST; i++ ) {
1688                                 mc->mc_timeout[ i ] = 0;
1689                         }
1690                         break;
1691
1692                 case LDAP_BACK_CFG_VERSION:
1693                         mc->mc_version = 0;
1694                         break;
1695
1696 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
1697                 case LDAP_BACK_CFG_ST_REQUEST:
1698                         mc->mc_flags &= ~LDAP_BACK_F_ST_REQUEST;
1699                         break;
1700 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
1701
1702                 case LDAP_BACK_CFG_T_F:
1703                         mc->mc_flags &= ~LDAP_BACK_F_T_F_MASK2;
1704                         break;
1705
1706                 case LDAP_BACK_CFG_TLS:
1707                         mc->mc_flags &= ~LDAP_BACK_F_TLS_MASK;
1708                         if ( mt )
1709                                 bindconf_free( &mt->mt_tls );
1710                         break;
1711
1712                 /* target attrs */
1713                 case LDAP_BACK_CFG_URI:
1714                         if ( mt->mt_uri ) {
1715                                 ch_free( mt->mt_uri );
1716                                 mt->mt_uri = NULL;
1717                         }
1718                         /* FIXME: should have a way to close all cached
1719                          * connections associated with this target.
1720                          */
1721                         break;
1722
1723                 case LDAP_BACK_CFG_IDASSERT_AUTHZFROM: {
1724                         BerVarray *bvp;
1725
1726                         bvp = &mt->mt_idassert_authz; break;
1727                         if ( c->valx < 0 ) {
1728                                 if ( *bvp != NULL ) {
1729                                         ber_bvarray_free( *bvp );
1730                                         *bvp = NULL;
1731                                 }
1732
1733                         } else {
1734                                 if ( *bvp == NULL ) {
1735                                         rc = 1;
1736                                         break;
1737                                 }
1738
1739                                 for ( i = 0; !BER_BVISNULL( &((*bvp)[ i ]) ); i++ )
1740                                         ;
1741
1742                                 if ( i >= c->valx ) {
1743                                         rc = 1;
1744                                         break;
1745                                 }
1746                                 ber_memfree( ((*bvp)[ c->valx ]).bv_val );
1747                                 for ( i = c->valx; !BER_BVISNULL( &((*bvp)[ i + 1 ]) ); i++ ) {
1748                                         (*bvp)[ i ] = (*bvp)[ i + 1 ];
1749                                 }
1750                                 BER_BVZERO( &((*bvp)[ i ]) );
1751                         }
1752                         } break;
1753
1754                 case LDAP_BACK_CFG_IDASSERT_BIND:
1755                         bindconf_free( &mt->mt_idassert.si_bc );
1756                         memset( &mt->mt_idassert, 0, sizeof( slap_idassert_t ) );
1757                         break;
1758
1759                 case LDAP_BACK_CFG_SUFFIXM:     /* unused */
1760                 case LDAP_BACK_CFG_REWRITE:
1761                         if ( mt->mt_rwmap.rwm_bva_rewrite ) {
1762                                 ber_bvarray_free( mt->mt_rwmap.rwm_bva_rewrite );
1763                                 mt->mt_rwmap.rwm_bva_rewrite = NULL;
1764                         }
1765                         if ( mt->mt_rwmap.rwm_rw )
1766                                 rewrite_info_delete( &mt->mt_rwmap.rwm_rw );
1767                         break;
1768
1769                 case LDAP_BACK_CFG_MAP:
1770                         if ( mt->mt_rwmap.rwm_bva_map ) {
1771                                 ber_bvarray_free( mt->mt_rwmap.rwm_bva_map );
1772                                 mt->mt_rwmap.rwm_bva_map = NULL;
1773                         }
1774                         meta_back_map_free( &mt->mt_rwmap.rwm_oc );
1775                         meta_back_map_free( &mt->mt_rwmap.rwm_at );
1776                         mt->mt_rwmap.rwm_oc.drop_missing = 0;
1777                         mt->mt_rwmap.rwm_at.drop_missing = 0;
1778                         break;
1779
1780                 case LDAP_BACK_CFG_SUBTREE_EX:
1781                 case LDAP_BACK_CFG_SUBTREE_IN:
1782                         /* can only be one of exclude or include */
1783                         if (( c->type == LDAP_BACK_CFG_SUBTREE_EX ) ^ mt->mt_subtree_exclude ) {
1784                                 rc = 1;
1785                                 break;
1786                         }
1787                         if ( c->valx < 0 ) {
1788                                 meta_subtree_destroy( mt->mt_subtree );
1789                                 mt->mt_subtree = NULL;
1790                         } else {
1791                                 metasubtree_t *ms, **mprev;
1792                                 for (i=0, mprev = &mt->mt_subtree, ms = *mprev; ms; ms = *mprev) {
1793                                         if ( i == c->valx ) {
1794                                                 *mprev = ms->ms_next;
1795                                                 meta_subtree_free( ms );
1796                                                 break;
1797                                         }
1798                                         i++;
1799                                         mprev = &ms->ms_next;
1800                                 }
1801                                 if ( i != c->valx )
1802                                         rc = 1;
1803                         }
1804                         break;
1805
1806                 default:
1807                         rc = 1;
1808                         break;
1809                 }
1810
1811                 return rc;
1812         }
1813
1814         if ( c->op == SLAP_CONFIG_ADD ) {
1815                 if ( c->type >= LDAP_BACK_CFG_LAST_BASE ) {
1816                         /* exclude CFG_URI from this check */
1817                         if ( c->type > LDAP_BACK_CFG_LAST_BOTH ) {
1818                                 if ( !mi->mi_ntargets ) {
1819                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1820                                                 "need \"uri\" directive first" );
1821                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1822                                         return 1;
1823                                 }
1824                         }
1825                         if ( mi->mi_ntargets ) {
1826                                 mt = mi->mi_targets[ mi->mi_ntargets-1 ];
1827                                 mc = &mt->mt_mc;
1828                         } else {
1829                                 mt = NULL;
1830                                 mc = &mi->mi_mc;
1831                         }
1832                 }
1833         } else {
1834                 if ( c->table == Cft_Database ) {
1835                         mt = NULL;
1836                         mc = &mi->mi_mc;
1837                 } else {
1838                         mt = c->ca_private;
1839                         if ( mt )
1840                                 mc = &mt->mt_mc;
1841                         else
1842                                 mc = NULL;
1843                 }
1844         }
1845
1846         switch( c->type ) {
1847         case LDAP_BACK_CFG_URI: {
1848                 LDAPURLDesc     *ludp;
1849                 struct berval   dn;
1850                 int             j;
1851
1852                 char            **uris = NULL;
1853
1854                 if ( c->be->be_nsuffix == NULL ) {
1855                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1856                                 "the suffix must be defined before any target" );
1857                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1858                         return 1;
1859                 }
1860
1861                 i = mi->mi_ntargets++;
1862
1863                 mi->mi_targets = ( metatarget_t ** )ch_realloc( mi->mi_targets,
1864                         sizeof( metatarget_t * ) * mi->mi_ntargets );
1865                 if ( mi->mi_targets == NULL ) {
1866                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1867                                 "out of memory while storing server name"
1868                                 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1869                                 c->argv[0] );
1870                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1871                         return 1;
1872                 }
1873
1874                 if ( meta_back_new_target( &mi->mi_targets[ i ] ) != 0 ) {
1875                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1876                                 "unable to init server"
1877                                 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1878                                 c->argv[0] );
1879                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1880                         return 1;
1881                 }
1882
1883                 mt = mi->mi_targets[ i ];
1884
1885                 mt->mt_rebind_f = mi->mi_rebind_f;
1886                 mt->mt_urllist_f = mi->mi_urllist_f;
1887                 mt->mt_urllist_p = mt;
1888
1889                 if ( META_BACK_QUARANTINE( mi ) ) {
1890                         ldap_pvt_thread_mutex_init( &mt->mt_quarantine_mutex );
1891                 }
1892                 mt->mt_mc = mi->mi_mc;
1893
1894                 for ( j = 1; j < c->argc; j++ ) {
1895                         char    **tmpuris = ldap_str2charray( c->argv[ j ], "\t" );
1896
1897                         if ( tmpuris == NULL ) {
1898                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1899                                         "unable to parse URIs #%d"
1900                                         " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1901                                         j-1, c->argv[0] );
1902                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1903                                 return 1;
1904                         }
1905
1906                         if ( j == 1 ) {
1907                                 uris = tmpuris;
1908
1909                         } else {
1910                                 ldap_charray_merge( &uris, tmpuris );
1911                                 ldap_charray_free( tmpuris );
1912                         }
1913                 }
1914
1915                 for ( j = 0; uris[ j ] != NULL; j++ ) {
1916                         char *tmpuri = NULL;
1917
1918                         /*
1919                          * uri MUST be legal!
1920                          */
1921                         if ( ldap_url_parselist_ext( &ludp, uris[ j ], "\t",
1922                                         LDAP_PVT_URL_PARSE_NONE ) != LDAP_SUCCESS
1923                                 || ludp->lud_next != NULL )
1924                         {
1925                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1926                                         "unable to parse URI #%d"
1927                                         " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1928                                         j-1, c->argv[0] );
1929                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1930                                 ldap_charray_free( uris );
1931                                 return 1;
1932                         }
1933
1934                         if ( j == 0 ) {
1935
1936                                 /*
1937                                  * uri MUST have the <dn> part!
1938                                  */
1939                                 if ( ludp->lud_dn == NULL ) {
1940                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1941                                                 "missing <naming context> "
1942                                                 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1943                                                 c->argv[0] );
1944                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1945                                         ldap_free_urllist( ludp );
1946                                         ldap_charray_free( uris );
1947                                         return 1;
1948                                 }
1949
1950                                 /*
1951                                  * copies and stores uri and suffix
1952                                  */
1953                                 ber_str2bv( ludp->lud_dn, 0, 0, &dn );
1954                                 rc = dnPrettyNormal( NULL, &dn, &mt->mt_psuffix,
1955                                         &mt->mt_nsuffix, NULL );
1956                                 if ( rc != LDAP_SUCCESS ) {
1957                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1958                                                 "target DN is invalid \"%s\"",
1959                                                 c->argv[1] );
1960                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1961                                         ldap_free_urllist( ludp );
1962                                         ldap_charray_free( uris );
1963                                         return( 1 );
1964                                 }
1965
1966                                 ludp->lud_dn[ 0 ] = '\0';
1967
1968                                 switch ( ludp->lud_scope ) {
1969                                 case LDAP_SCOPE_DEFAULT:
1970                                         mt->mt_scope = LDAP_SCOPE_SUBTREE;
1971                                         break;
1972
1973                                 case LDAP_SCOPE_SUBTREE:
1974                                 case LDAP_SCOPE_SUBORDINATE:
1975                                         mt->mt_scope = ludp->lud_scope;
1976                                         break;
1977
1978                                 default:
1979                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1980                                                 "invalid scope for target \"%s\"",
1981                                                 c->argv[1] );
1982                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1983                                         ldap_free_urllist( ludp );
1984                                         ldap_charray_free( uris );
1985                                         return( 1 );
1986                                 }
1987
1988                         } else {
1989                                 /* check all, to apply the scope check on the first one */
1990                                 if ( ludp->lud_dn != NULL && ludp->lud_dn[ 0 ] != '\0' ) {
1991                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1992                                                 "multiple URIs must have no DN part" );
1993                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1994                                         ldap_free_urllist( ludp );
1995                                         ldap_charray_free( uris );
1996                                         return( 1 );
1997
1998                                 }
1999                         }
2000
2001                         tmpuri = ldap_url_list2urls( ludp );
2002                         ldap_free_urllist( ludp );
2003                         if ( tmpuri == NULL ) {
2004                                 snprintf( c->cr_msg, sizeof( c->cr_msg ), "no memory?" );
2005                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2006                                 ldap_charray_free( uris );
2007                                 return( 1 );
2008                         }
2009                         ldap_memfree( uris[ j ] );
2010                         uris[ j ] = tmpuri;
2011                 }
2012
2013                 mt->mt_uri = ldap_charray2str( uris, " " );
2014                 ldap_charray_free( uris );
2015                 if ( mt->mt_uri == NULL) {
2016                         snprintf( c->cr_msg, sizeof( c->cr_msg ), "no memory?" );
2017                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2018                         return( 1 );
2019                 }
2020
2021                 /*
2022                  * uri MUST be a branch of suffix!
2023                  */
2024                 for ( j = 0; !BER_BVISNULL( &c->be->be_nsuffix[ j ] ); j++ ) {
2025                         if ( dnIsSuffix( &mt->mt_nsuffix, &c->be->be_nsuffix[ j ] ) ) {
2026                                 break;
2027                         }
2028                 }
2029
2030                 if ( BER_BVISNULL( &c->be->be_nsuffix[ j ] ) ) {
2031                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2032                                 "<naming context> of URI must be within the naming context of this database." );
2033                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2034                         return 1;
2035                 }
2036                 c->ca_private = mt;
2037         } break;
2038         case LDAP_BACK_CFG_SUBTREE_EX:
2039         case LDAP_BACK_CFG_SUBTREE_IN:
2040         /* subtree-exclude */
2041                 if ( meta_subtree_config( mt, c )) {
2042                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2043                         return 1;
2044                 }
2045                 break;
2046
2047         case LDAP_BACK_CFG_DEFAULT_T:
2048         /* default target directive */
2049                 i = mi->mi_ntargets - 1;
2050
2051                 if ( c->argc == 1 ) {
2052                         if ( i < 0 ) {
2053                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2054                                         "\"%s\" alone must be inside a \"uri\" directive",
2055                                         c->argv[0] );
2056                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2057                                 return 1;
2058                         }
2059                         mi->mi_defaulttarget = i;
2060
2061                 } else {
2062                         if ( strcasecmp( c->argv[ 1 ], "none" ) == 0 ) {
2063                                 if ( i >= 0 ) {
2064                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2065                                                 "\"%s none\" should go before uri definitions",
2066                                                 c->argv[0] );
2067                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2068                                 }
2069                                 mi->mi_defaulttarget = META_DEFAULT_TARGET_NONE;
2070
2071                         } else {
2072
2073                                 if ( lutil_atoi( &mi->mi_defaulttarget, c->argv[ 1 ] ) != 0
2074                                         || mi->mi_defaulttarget < 0
2075                                         || mi->mi_defaulttarget >= i - 1 )
2076                                 {
2077                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2078                                                 "illegal target number %d",
2079                                                 mi->mi_defaulttarget );
2080                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2081                                         return 1;
2082                                 }
2083                         }
2084                 }
2085                 break;
2086
2087         case LDAP_BACK_CFG_DNCACHE_TTL:
2088         /* ttl of dn cache */
2089                 if ( strcasecmp( c->argv[ 1 ], "forever" ) == 0 ) {
2090                         mi->mi_cache.ttl = META_DNCACHE_FOREVER;
2091
2092                 } else if ( strcasecmp( c->argv[ 1 ], "disabled" ) == 0 ) {
2093                         mi->mi_cache.ttl = META_DNCACHE_DISABLED;
2094
2095                 } else {
2096                         unsigned long   t;
2097
2098                         if ( lutil_parse_time( c->argv[ 1 ], &t ) != 0 ) {
2099                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2100                                         "unable to parse dncache ttl \"%s\"",
2101                                         c->argv[ 1 ] );
2102                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2103                                 return 1;
2104                         }
2105                         mi->mi_cache.ttl = (time_t)t;
2106                 }
2107                 break;
2108
2109         case LDAP_BACK_CFG_NETWORK_TIMEOUT: {
2110         /* network timeout when connecting to ldap servers */
2111                 unsigned long t;
2112
2113                 if ( lutil_parse_time( c->argv[ 1 ], &t ) ) {
2114                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2115                                 "unable to parse network timeout \"%s\"",
2116                                 c->argv[ 1 ] );
2117                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2118                         return 1;
2119                 }
2120                 mc->mc_network_timeout = (time_t)t;
2121                 } break;
2122
2123         case LDAP_BACK_CFG_IDLE_TIMEOUT: {
2124         /* idle timeout when connecting to ldap servers */
2125                 unsigned long   t;
2126
2127                 if ( lutil_parse_time( c->argv[ 1 ], &t ) ) {
2128                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2129                                 "unable to parse idle timeout \"%s\"",
2130                                 c->argv[ 1 ] );
2131                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2132                         return 1;
2133
2134                 }
2135                 mi->mi_idle_timeout = (time_t)t;
2136                 } break;
2137
2138         case LDAP_BACK_CFG_CONN_TTL: {
2139         /* conn ttl */
2140                 unsigned long   t;
2141
2142                 if ( lutil_parse_time( c->argv[ 1 ], &t ) ) {
2143                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2144                                 "unable to parse conn ttl \"%s\"",
2145                                 c->argv[ 1 ] );
2146                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2147                         return 1;
2148
2149                 }
2150                 mi->mi_conn_ttl = (time_t)t;
2151                 } break;
2152
2153         case LDAP_BACK_CFG_BIND_TIMEOUT:
2154         /* bind timeout when connecting to ldap servers */
2155                 mc->mc_bind_timeout.tv_sec = c->value_ulong/1000000;
2156                 mc->mc_bind_timeout.tv_usec = c->value_ulong%1000000;
2157                 break;
2158
2159         case LDAP_BACK_CFG_ACL_AUTHCDN:
2160         /* name to use for meta_back_group */
2161                 if ( strcasecmp( c->argv[ 0 ], "binddn" ) == 0 ) {
2162                         Debug( LDAP_DEBUG_ANY, "%s: "
2163                                 "\"binddn\" statement is deprecated; "
2164                                 "use \"acl-authcDN\" instead\n",
2165                                 c->log, 0, 0 );
2166                         /* FIXME: some day we'll need to throw an error */
2167                 }
2168
2169                 ber_memfree_x( c->value_dn.bv_val, NULL );
2170                 mt->mt_binddn = c->value_ndn;
2171                 BER_BVZERO( &c->value_dn );
2172                 BER_BVZERO( &c->value_ndn );
2173                 break;
2174
2175         case LDAP_BACK_CFG_ACL_PASSWD:
2176         /* password to use for meta_back_group */
2177                 if ( strcasecmp( c->argv[ 0 ], "bindpw" ) == 0 ) {
2178                         Debug( LDAP_DEBUG_ANY, "%s "
2179                                 "\"bindpw\" statement is deprecated; "
2180                                 "use \"acl-passwd\" instead\n",
2181                                 c->log, 0, 0 );
2182                         /* FIXME: some day we'll need to throw an error */
2183                 }
2184
2185                 ber_str2bv( c->argv[ 1 ], 0L, 1, &mt->mt_bindpw );
2186                 break;
2187
2188         case LDAP_BACK_CFG_REBIND:
2189         /* save bind creds for referral rebinds? */
2190                 if ( c->argc == 1 || c->value_int ) {
2191                         mc->mc_flags |= LDAP_BACK_F_SAVECRED;
2192                 } else {
2193                         mc->mc_flags &= ~LDAP_BACK_F_SAVECRED;
2194                 }
2195                 break;
2196
2197         case LDAP_BACK_CFG_CHASE:
2198                 if ( c->argc == 1 || c->value_int ) {
2199                         mc->mc_flags |= LDAP_BACK_F_CHASE_REFERRALS;
2200                 } else {
2201                         mc->mc_flags &= ~LDAP_BACK_F_CHASE_REFERRALS;
2202                 }
2203                 break;
2204
2205         case LDAP_BACK_CFG_TLS:
2206                 i = verb_to_mask( c->argv[1], tls_mode );
2207                 if ( BER_BVISNULL( &tls_mode[i].word ) ) {
2208                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2209                                 "%s unknown argument \"%s\"",
2210                                 c->argv[0], c->argv[1] );
2211                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2212                         return 1;
2213                 }
2214                 mc->mc_flags &= ~LDAP_BACK_F_TLS_MASK;
2215                 mc->mc_flags |= tls_mode[i].mask;
2216
2217                 if ( c->argc > 2 ) {
2218                         if ( c->op == SLAP_CONFIG_ADD && mi->mi_ntargets == 0 ) {
2219                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2220                                         "need \"uri\" directive first" );
2221                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2222                                 return 1;
2223                         }
2224
2225                         for ( i = 2; i < c->argc; i++ ) {
2226                                 if ( bindconf_tls_parse( c->argv[i], &mt->mt_tls ))
2227                                         return 1;
2228                         }
2229                         bindconf_tls_defaults( &mt->mt_tls );
2230                 }
2231                 break;
2232
2233         case LDAP_BACK_CFG_T_F:
2234                 i = verb_to_mask( c->argv[1], t_f_mode );
2235                 if ( BER_BVISNULL( &t_f_mode[i].word ) ) {
2236                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2237                                 "%s unknown argument \"%s\"",
2238                                 c->argv[0], c->argv[1] );
2239                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2240                         return 1;
2241                 }
2242                 mc->mc_flags &= ~LDAP_BACK_F_T_F_MASK2;
2243                 mc->mc_flags |= t_f_mode[i].mask;
2244                 break;
2245
2246         case LDAP_BACK_CFG_ONERR:
2247         /* onerr? */
2248                 i = verb_to_mask( c->argv[1], onerr_mode );
2249                 if ( BER_BVISNULL( &onerr_mode[i].word ) ) {
2250                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2251                                 "%s unknown argument \"%s\"",
2252                                 c->argv[0], c->argv[1] );
2253                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2254                         return 1;
2255                 }
2256                 mi->mi_flags &= ~META_BACK_F_ONERR_MASK;
2257                 mi->mi_flags |= onerr_mode[i].mask;
2258                 break;
2259
2260         case LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER:
2261         /* bind-defer? */
2262                 if ( c->argc == 1 || c->value_int ) {
2263                         mi->mi_flags |= META_BACK_F_DEFER_ROOTDN_BIND;
2264                 } else {
2265                         mi->mi_flags &= ~META_BACK_F_DEFER_ROOTDN_BIND;
2266                 }
2267                 break;
2268
2269         case LDAP_BACK_CFG_SINGLECONN:
2270         /* single-conn? */
2271                 if ( mi->mi_ntargets > 0 ) {
2272                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2273                                 "\"%s\" must appear before target definitions",
2274                                 c->argv[0] );
2275                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2276                         return( 1 );
2277                 }
2278                 if ( c->value_int ) {
2279                         mi->mi_flags |= LDAP_BACK_F_SINGLECONN;
2280                 } else {
2281                         mi->mi_flags &= ~LDAP_BACK_F_SINGLECONN;
2282                 }
2283                 break;
2284
2285         case LDAP_BACK_CFG_USETEMP:
2286         /* use-temporaries? */
2287                 if ( mi->mi_ntargets > 0 ) {
2288                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2289                                 "\"%s\" must appear before target definitions",
2290                                 c->argv[0] );
2291                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2292                         return( 1 );
2293                 }
2294                 if ( c->value_int ) {
2295                         mi->mi_flags |= LDAP_BACK_F_USE_TEMPORARIES;
2296                 } else {
2297                         mi->mi_flags &= ~LDAP_BACK_F_USE_TEMPORARIES;
2298                 }
2299                 break;
2300
2301         case LDAP_BACK_CFG_CONNPOOLMAX:
2302         /* privileged connections pool max size ? */
2303                 if ( mi->mi_ntargets > 0 ) {
2304                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2305                                 "\"%s\" must appear before target definitions",
2306                                 c->argv[0] );
2307                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2308                         return( 1 );
2309                 }
2310
2311                 if ( c->value_int < LDAP_BACK_CONN_PRIV_MIN
2312                         || c->value_int > LDAP_BACK_CONN_PRIV_MAX )
2313                 {
2314                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2315                                 "invalid max size " "of privileged "
2316                                 "connections pool \"%s\" "
2317                                 "in \"conn-pool-max <n> "
2318                                 "(must be between %d and %d)\"",
2319                                 c->argv[ 1 ],
2320                                 LDAP_BACK_CONN_PRIV_MIN,
2321                                 LDAP_BACK_CONN_PRIV_MAX );
2322                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2323                         return 1;
2324                 }
2325                 mi->mi_conn_priv_max = c->value_int;
2326                 break;
2327
2328         case LDAP_BACK_CFG_CANCEL:
2329                 i = verb_to_mask( c->argv[1], cancel_mode );
2330                 if ( BER_BVISNULL( &cancel_mode[i].word ) ) {
2331                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2332                                 "%s unknown argument \"%s\"",
2333                                 c->argv[0], c->argv[1] );
2334                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2335                         return 1;
2336                 }
2337                 mc->mc_flags &= ~LDAP_BACK_F_CANCEL_MASK2;
2338                 mc->mc_flags |= t_f_mode[i].mask;
2339                 break;
2340
2341         case LDAP_BACK_CFG_TIMEOUT:
2342                 for ( i = 1; i < c->argc; i++ ) {
2343                         if ( isdigit( (unsigned char) c->argv[ i ][ 0 ] ) ) {
2344                                 int             j;
2345                                 unsigned        u;
2346
2347                                 if ( lutil_atoux( &u, c->argv[ i ], 0 ) != 0 ) {
2348                                         snprintf( c->cr_msg, sizeof( c->cr_msg),
2349                                                 "unable to parse timeout \"%s\"",
2350                                                 c->argv[ i ] );
2351                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2352                                         return 1;
2353                                 }
2354
2355                                 for ( j = 0; j < SLAP_OP_LAST; j++ ) {
2356                                         mc->mc_timeout[ j ] = u;
2357                                 }
2358
2359                                 continue;
2360                         }
2361
2362                         if ( slap_cf_aux_table_parse( c->argv[ i ], mc->mc_timeout, timeout_table, "slapd-meta timeout" ) ) {
2363                                 snprintf( c->cr_msg, sizeof( c->cr_msg),
2364                                         "unable to parse timeout \"%s\"",
2365                                         c->argv[ i ] );
2366                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2367                                 return 1;
2368                         }
2369                 }
2370                 break;
2371
2372         case LDAP_BACK_CFG_PSEUDOROOTDN:
2373         /* name to use as pseudo-root dn */
2374                 /*
2375                  * exact replacement:
2376                  *
2377
2378 idassert-bind   bindmethod=simple
2379                 binddn=<pseudorootdn>
2380                 credentials=<pseudorootpw>
2381                 mode=none
2382                 flags=non-prescriptive
2383 idassert-authzFrom      "dn:<rootdn>"
2384
2385                  * so that only when authc'd as <rootdn> the proxying occurs
2386                  * rebinding as the <pseudorootdn> without proxyAuthz.
2387                  */
2388
2389                 Debug( LDAP_DEBUG_ANY,
2390                         "%s: \"pseudorootdn\", \"pseudorootpw\" are no longer supported; "
2391                         "use \"idassert-bind\" and \"idassert-authzFrom\" instead.\n",
2392                         c->log, 0, 0 );
2393
2394                 {
2395                         char    binddn[ SLAP_TEXT_BUFLEN ];
2396                         char    *cargv[] = {
2397                                 "idassert-bind",
2398                                 "bindmethod=simple",
2399                                 NULL,
2400                                 "mode=none",
2401                                 "flags=non-prescriptive",
2402                                 NULL
2403                         };
2404                         char **oargv;
2405                         int oargc;
2406                         int     cargc = 5;
2407                         int     rc;
2408
2409
2410                         if ( BER_BVISNULL( &c->be->be_rootndn ) ) {
2411                                 Debug( LDAP_DEBUG_ANY, "%s: \"pseudorootpw\": \"rootdn\" must be defined first.\n",
2412                                         c->log, 0, 0 );
2413                                 return 1;
2414                         }
2415
2416                         if ( sizeof( binddn ) <= (unsigned) snprintf( binddn,
2417                                         sizeof( binddn ), "binddn=%s", c->argv[ 1 ] ))
2418                         {
2419                                 Debug( LDAP_DEBUG_ANY, "%s: \"pseudorootdn\" too long.\n",
2420                                         c->log, 0, 0 );
2421                                 return 1;
2422                         }
2423                         cargv[ 2 ] = binddn;
2424
2425                         oargv = c->argv;
2426                         oargc = c->argc;
2427                         c->argv = cargv;
2428                         c->argc = cargc;
2429                         rc = mi->mi_ldap_extra->idassert_parse( c, &mt->mt_idassert );
2430                         c->argv = oargv;
2431                         c->argc = oargc;
2432                         if ( rc == 0 ) {
2433                                 struct berval   bv;
2434
2435                                 if ( mt->mt_idassert_authz != NULL ) {
2436                                         Debug( LDAP_DEBUG_ANY, "%s: \"idassert-authzFrom\" already defined (discarded).\n",
2437                                                 c->log, 0, 0 );
2438                                         ber_bvarray_free( mt->mt_idassert_authz );
2439                                         mt->mt_idassert_authz = NULL;
2440                                 }
2441
2442                                 assert( !BER_BVISNULL( &mt->mt_idassert_authcDN ) );
2443
2444                                 bv.bv_len = STRLENOF( "dn:" ) + c->be->be_rootndn.bv_len;
2445                                 bv.bv_val = ber_memalloc( bv.bv_len + 1 );
2446                                 AC_MEMCPY( bv.bv_val, "dn:", STRLENOF( "dn:" ) );
2447                                 AC_MEMCPY( &bv.bv_val[ STRLENOF( "dn:" ) ], c->be->be_rootndn.bv_val, c->be->be_rootndn.bv_len + 1 );
2448
2449                                 ber_bvarray_add( &mt->mt_idassert_authz, &bv );
2450                         }
2451
2452                         return rc;
2453                 }
2454                 break;
2455
2456         case LDAP_BACK_CFG_PSEUDOROOTPW:
2457         /* password to use as pseudo-root */
2458                 Debug( LDAP_DEBUG_ANY,
2459                         "%s: \"pseudorootdn\", \"pseudorootpw\" are no longer supported; "
2460                         "use \"idassert-bind\" and \"idassert-authzFrom\" instead.\n",
2461                         c->log, 0, 0 );
2462
2463                 if ( BER_BVISNULL( &mt->mt_idassert_authcDN ) ) {
2464                         Debug( LDAP_DEBUG_ANY, "%s: \"pseudorootpw\": \"pseudorootdn\" must be defined first.\n",
2465                                 c->log, 0, 0 );
2466                         return 1;
2467                 }
2468
2469                 if ( !BER_BVISNULL( &mt->mt_idassert_passwd ) ) {
2470                         memset( mt->mt_idassert_passwd.bv_val, 0,
2471                                 mt->mt_idassert_passwd.bv_len );
2472                         ber_memfree( mt->mt_idassert_passwd.bv_val );
2473                 }
2474                 ber_str2bv( c->argv[ 1 ], 0, 1, &mt->mt_idassert_passwd );
2475                 break;
2476
2477         case LDAP_BACK_CFG_IDASSERT_BIND:
2478         /* idassert-bind */
2479                 rc = mi->mi_ldap_extra->idassert_parse( c, &mt->mt_idassert );
2480                 break;
2481
2482         case LDAP_BACK_CFG_IDASSERT_AUTHZFROM:
2483         /* idassert-authzFrom */
2484                 rc = mi->mi_ldap_extra->idassert_authzfrom_parse( c, &mt->mt_idassert );
2485                 break;
2486
2487         case LDAP_BACK_CFG_QUARANTINE:
2488         /* quarantine */
2489                 if ( META_BACK_CMN_QUARANTINE( mc ) )
2490                 {
2491                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2492                                 "quarantine already defined" );
2493                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2494                         return 1;
2495                 }
2496
2497                 if ( mt ) {
2498                         mc->mc_quarantine.ri_interval = NULL;
2499                         mc->mc_quarantine.ri_num = NULL;
2500                         if ( !META_BACK_QUARANTINE( mi ) ) {
2501                                 ldap_pvt_thread_mutex_init( &mt->mt_quarantine_mutex );
2502                         }
2503                 }
2504
2505                 if ( mi->mi_ldap_extra->retry_info_parse( c->argv[ 1 ], &mc->mc_quarantine, c->cr_msg, sizeof( c->cr_msg ) ) ) {
2506                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2507                         return 1;
2508                 }
2509
2510                 mc->mc_flags |= LDAP_BACK_F_QUARANTINE;
2511                 break;
2512
2513 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
2514         case LDAP_BACK_CFG_ST_REQUEST:
2515         /* session tracking request */
2516                 if ( c->value_int ) {
2517                         mc->mc_flags |= LDAP_BACK_F_ST_REQUEST;
2518                 } else {
2519                         mc->mc_flags &= ~LDAP_BACK_F_ST_REQUEST;
2520                 }
2521                 break;
2522 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
2523
2524         case LDAP_BACK_CFG_SUFFIXM:     /* FALLTHRU */
2525         case LDAP_BACK_CFG_REWRITE: {
2526         /* rewrite stuff ... */
2527                 ConfigArgs ca = { 0 };
2528                 char *line, **argv;
2529                 struct rewrite_info *rwi;
2530                 int cnt = 0, argc, ix = c->valx;
2531
2532                 if ( mt->mt_rwmap.rwm_bva_rewrite ) {
2533                         for ( ; !BER_BVISNULL( &mt->mt_rwmap.rwm_bva_rewrite[ cnt ] ); cnt++ )
2534                                 /* count */ ;
2535                 }
2536
2537                 if ( ix >= cnt || ix < 0 ) {
2538                         ix = cnt;
2539                 } else {
2540                         rwi = mt->mt_rwmap.rwm_rw;
2541
2542                         mt->mt_rwmap.rwm_rw = NULL;
2543                         rc = meta_rwi_init( &mt->mt_rwmap.rwm_rw );
2544
2545                         /* re-parse all rewrite rules, up to the one
2546                          * that needs to be added */
2547                         ca.fname = c->fname;
2548                         ca.lineno = c->lineno;
2549                         for ( i = 0; i < ix; i++ ) {
2550                                 ca.line = mt->mt_rwmap.rwm_bva_rewrite[ i ].bv_val;
2551                                 ca.argc = 0;
2552                                 config_fp_parse_line( &ca );
2553
2554                                 if ( !strcasecmp( ca.argv[0], "suffixmassage" )) {
2555                                         rc = meta_suffixm_config( &ca, ca.argc, ca.argv, mt );
2556                                 } else {
2557                                         rc = rewrite_parse( mt->mt_rwmap.rwm_rw,
2558                                                 c->fname, c->lineno, ca.argc, ca.argv );
2559                                 }
2560                                 assert( rc == 0 );
2561                                 ch_free( ca.argv );
2562                                 ch_free( ca.tline );
2563                         }
2564                 }
2565                 argc = c->argc;
2566                 argv = c->argv;
2567                 if ( c->op != SLAP_CONFIG_ADD ) {
2568                         argc--;
2569                         argv++;
2570                 }
2571                 /* add the new rule */
2572                 if ( !strcasecmp( argv[0], "suffixmassage" )) {
2573                         rc = meta_suffixm_config( c, argc, argv, mt );
2574                 } else {
2575                         rc = rewrite_parse( mt->mt_rwmap.rwm_rw,
2576                                                 c->fname, c->lineno, argc, argv );
2577                 }
2578                 if ( rc ) {
2579                         if ( ix < cnt ) {
2580                                 rewrite_info_delete( &mt->mt_rwmap.rwm_rw );
2581                                 mt->mt_rwmap.rwm_rw = rwi;
2582                         }
2583                         return 1;
2584                 }
2585                 if ( ix < cnt ) {
2586                         for ( ; i < cnt; i++ ) {
2587                                 ca.line = mt->mt_rwmap.rwm_bva_rewrite[ i ].bv_val;
2588                                 ca.argc = 0;
2589                                 config_fp_parse_line( &ca );
2590
2591                                 if ( !strcasecmp( ca.argv[0], "suffixmassage" )) {
2592                                         rc = meta_suffixm_config( &ca, ca.argc, ca.argv, mt );
2593                                 } else {
2594                                         rc = rewrite_parse( mt->mt_rwmap.rwm_rw,
2595                                                 c->fname, c->lineno, ca.argc, argv );
2596                                 }
2597                                 assert( rc == 0 );
2598                                 ch_free( ca.argv );
2599                                 ch_free( ca.tline );
2600                         }
2601                 }
2602
2603                 /* save the rule info */
2604                 line = ldap_charray2str( argv, "\" \"" );
2605                 if ( line != NULL ) {
2606                         struct berval bv;
2607                         int len = strlen( argv[ 0 ] );
2608
2609                         ber_str2bv( line, 0, 0, &bv );
2610                         AC_MEMCPY( &bv.bv_val[ len ], &bv.bv_val[ len + 1 ],
2611                                 bv.bv_len - ( len + 1 ));
2612                         bv.bv_val[ bv.bv_len - 1] = '"';
2613                         ber_bvarray_add( &mt->mt_rwmap.rwm_bva_rewrite, &bv );
2614                         /* move it to the right slot */
2615                         if ( ix < cnt ) {
2616                                 for ( i=cnt; i>ix; i-- )
2617                                         mt->mt_rwmap.rwm_bva_rewrite[i+1] = mt->mt_rwmap.rwm_bva_rewrite[i];
2618                                 mt->mt_rwmap.rwm_bva_rewrite[i] = bv;
2619
2620                                 /* destroy old rules */
2621                                 rewrite_info_delete( &rwi );
2622                         }
2623                 }
2624                 } break;
2625
2626         case LDAP_BACK_CFG_MAP: {
2627         /* objectclass/attribute mapping */
2628                 ConfigArgs ca = { 0 };
2629                 char *argv[5];
2630                 struct ldapmap rwm_oc;
2631                 struct ldapmap rwm_at;
2632                 int cnt = 0, ix = c->valx;
2633
2634                 if ( mt->mt_rwmap.rwm_bva_map ) {
2635                         for ( ; !BER_BVISNULL( &mt->mt_rwmap.rwm_bva_map[ cnt ] ); cnt++ )
2636                                 /* count */ ;
2637                 }
2638
2639                 if ( ix >= cnt || ix < 0 ) {
2640                         ix = cnt;
2641                 } else {
2642                         rwm_oc = mt->mt_rwmap.rwm_oc;
2643                         rwm_at = mt->mt_rwmap.rwm_at;
2644
2645                         memset( &mt->mt_rwmap.rwm_oc, 0, sizeof( mt->mt_rwmap.rwm_oc ) );
2646                         memset( &mt->mt_rwmap.rwm_at, 0, sizeof( mt->mt_rwmap.rwm_at ) );
2647
2648                         /* re-parse all mappings, up to the one
2649                          * that needs to be added */
2650                         argv[0] = c->argv[0];
2651                         ca.fname = c->fname;
2652                         ca.lineno = c->lineno;
2653                         for ( i = 0; i < ix; i++ ) {
2654                                 ca.line = mt->mt_rwmap.rwm_bva_map[ i ].bv_val;
2655                                 ca.argc = 0;
2656                                 config_fp_parse_line( &ca );
2657
2658                                 argv[1] = ca.argv[0];
2659                                 argv[2] = ca.argv[1];
2660                                 argv[3] = ca.argv[2];
2661                                 argv[4] = ca.argv[3];
2662                                 ch_free( ca.argv );
2663                                 ca.argv = argv;
2664                                 ca.argc++;
2665                                 rc = ldap_back_map_config( &ca, &mt->mt_rwmap.rwm_oc,
2666                                         &mt->mt_rwmap.rwm_at );
2667
2668                                 ch_free( ca.tline );
2669                                 ca.tline = NULL;
2670                                 ca.argv = NULL;
2671
2672                                 /* in case of failure, restore
2673                                  * the existing mapping */
2674                                 if ( rc ) {
2675                                         goto map_fail;
2676                                 }
2677                         }
2678                 }
2679                 /* add the new mapping */
2680                 rc = ldap_back_map_config( c, &mt->mt_rwmap.rwm_oc,
2681                                         &mt->mt_rwmap.rwm_at );
2682                 if ( rc ) {
2683                         goto map_fail;
2684                 }
2685
2686                 if ( ix < cnt ) {
2687                         for ( ; i<cnt ; cnt++ ) {
2688                                 ca.line = mt->mt_rwmap.rwm_bva_map[ i ].bv_val;
2689                                 ca.argc = 0;
2690                                 config_fp_parse_line( &ca );
2691
2692                                 argv[1] = ca.argv[0];
2693                                 argv[2] = ca.argv[1];
2694                                 argv[3] = ca.argv[2];
2695                                 argv[4] = ca.argv[3];
2696
2697                                 ch_free( ca.argv );
2698                                 ca.argv = argv;
2699                                 ca.argc++;
2700                                 rc = ldap_back_map_config( &ca, &mt->mt_rwmap.rwm_oc,
2701                                         &mt->mt_rwmap.rwm_at );
2702
2703                                 ch_free( ca.tline );
2704                                 ca.tline = NULL;
2705                                 ca.argv = NULL;
2706
2707                                 /* in case of failure, restore
2708                                  * the existing mapping */
2709                                 if ( rc ) {
2710                                         goto map_fail;
2711                                 }
2712                         }
2713                 }
2714
2715                 /* save the map info */
2716                 argv[0] = ldap_charray2str( &c->argv[ 1 ], " " );
2717                 if ( argv[0] != NULL ) {
2718                         struct berval bv;
2719                         ber_str2bv( argv[0], 0, 0, &bv );
2720                         ber_bvarray_add( &mt->mt_rwmap.rwm_bva_map, &bv );
2721                         /* move it to the right slot */
2722                         if ( ix < cnt ) {
2723                                 for ( i=cnt; i>ix; i-- )
2724                                         mt->mt_rwmap.rwm_bva_map[i+1] = mt->mt_rwmap.rwm_bva_map[i];
2725                                 mt->mt_rwmap.rwm_bva_map[i] = bv;
2726
2727                                 /* destroy old mapping */
2728                                 meta_back_map_free( &rwm_oc );
2729                                 meta_back_map_free( &rwm_at );
2730                         }
2731                 }
2732                 break;
2733
2734 map_fail:;
2735                 if ( ix < cnt ) {
2736                         meta_back_map_free( &mt->mt_rwmap.rwm_oc );
2737                         meta_back_map_free( &mt->mt_rwmap.rwm_at );
2738                         mt->mt_rwmap.rwm_oc = rwm_oc;
2739                         mt->mt_rwmap.rwm_at = rwm_at;
2740                 }
2741                 } break;
2742
2743         case LDAP_BACK_CFG_NRETRIES: {
2744                 int             nretries = META_RETRY_UNDEFINED;
2745
2746                 if ( strcasecmp( c->argv[ 1 ], "forever" ) == 0 ) {
2747                         nretries = META_RETRY_FOREVER;
2748
2749                 } else if ( strcasecmp( c->argv[ 1 ], "never" ) == 0 ) {
2750                         nretries = META_RETRY_NEVER;
2751
2752                 } else {
2753                         if ( lutil_atoi( &nretries, c->argv[ 1 ] ) != 0 ) {
2754                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2755                                         "unable to parse nretries {never|forever|<retries>}: \"%s\"",
2756                                         c->argv[ 1 ] );
2757                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2758                                 return 1;
2759                         }
2760                 }
2761
2762                 mc->mc_nretries = nretries;
2763                 } break;
2764
2765         case LDAP_BACK_CFG_VERSION:
2766                 if ( c->value_int != 0 && ( c->value_int < LDAP_VERSION_MIN || c->value_int > LDAP_VERSION_MAX ) ) {
2767                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2768                                 "unsupported protocol version \"%s\"",
2769                                 c->argv[ 1 ] );
2770                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2771                         return 1;
2772                 }
2773                 mc->mc_version = c->value_int;
2774                 break;
2775
2776         case LDAP_BACK_CFG_NOREFS:
2777         /* do not return search references */
2778                 if ( c->value_int ) {
2779                         mc->mc_flags |= LDAP_BACK_F_NOREFS;
2780                 } else {
2781                         mc->mc_flags &= ~LDAP_BACK_F_NOREFS;
2782                 }
2783                 break;
2784
2785         case LDAP_BACK_CFG_NOUNDEFFILTER:
2786         /* do not propagate undefined search filters */
2787                 if ( c->value_int ) {
2788                         mc->mc_flags |= LDAP_BACK_F_NOUNDEFFILTER;
2789                 } else {
2790                         mc->mc_flags &= ~LDAP_BACK_F_NOUNDEFFILTER;
2791                 }
2792                 break;
2793
2794 #ifdef SLAPD_META_CLIENT_PR
2795         case LDAP_BACK_CFG_CLIENT_PR:
2796                 if ( strcasecmp( c->argv[ 1 ], "accept-unsolicited" ) == 0 ) {
2797                         mc->mc_ps = META_CLIENT_PR_ACCEPT_UNSOLICITED;
2798
2799                 } else if ( strcasecmp( c->argv[ 1 ], "disable" ) == 0 ) {
2800                         mc->mc_ps = META_CLIENT_PR_DISABLE;
2801
2802                 } else if ( lutil_atoi( &mc->mc_ps, c->argv[ 1 ] ) || mc->mc_ps < -1 ) {
2803                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2804                                 "unable to parse client-pr {accept-unsolicited|disable|<size>}: \"%s\"",
2805                                 c->argv[ 1 ] );
2806                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2807                         return( 1 );
2808                 }
2809                 break;
2810 #endif /* SLAPD_META_CLIENT_PR */
2811
2812         /* anything else */
2813         default:
2814                 return SLAP_CONF_UNKNOWN;
2815         }
2816
2817         return rc;
2818 }
2819
2820 int
2821 meta_back_init_cf( BackendInfo *bi )
2822 {
2823         int                     rc;
2824         AttributeDescription    *ad = NULL;
2825         const char              *text;
2826
2827         /* Make sure we don't exceed the bits reserved for userland */
2828         config_check_userland( LDAP_BACK_CFG_LAST );
2829
2830         bi->bi_cf_ocs = metaocs;
2831
2832         rc = config_register_schema( metacfg, metaocs );
2833         if ( rc ) {
2834                 return rc;
2835         }
2836
2837         /* setup olcDbAclPasswd and olcDbIDAssertPasswd
2838          * to be base64-encoded when written in LDIF form;
2839          * basically, we don't care if it fails */
2840         rc = slap_str2ad( "olcDbACLPasswd", &ad, &text );
2841         if ( rc ) {
2842                 Debug( LDAP_DEBUG_ANY, "config_back_initialize: "
2843                         "warning, unable to get \"olcDbACLPasswd\" "
2844                         "attribute description: %d: %s\n",
2845                         rc, text, 0 );
2846         } else {
2847                 (void)ldif_must_b64_encode_register( ad->ad_cname.bv_val,
2848                         ad->ad_type->sat_oid );
2849         }
2850
2851         ad = NULL;
2852         rc = slap_str2ad( "olcDbIDAssertPasswd", &ad, &text );
2853         if ( rc ) {
2854                 Debug( LDAP_DEBUG_ANY, "config_back_initialize: "
2855                         "warning, unable to get \"olcDbIDAssertPasswd\" "
2856                         "attribute description: %d: %s\n",
2857                         rc, text, 0 );
2858         } else {
2859                 (void)ldif_must_b64_encode_register( ad->ad_cname.bv_val,
2860                         ad->ad_type->sat_oid );
2861         }
2862
2863         return 0;
2864 }
2865
2866 static int
2867 ldap_back_map_config(
2868                 ConfigArgs *c,
2869                 struct ldapmap  *oc_map,
2870                 struct ldapmap  *at_map )
2871 {
2872         struct ldapmap          *map;
2873         struct ldapmapping      *mapping;
2874         char                    *src, *dst;
2875         int                     is_oc = 0;
2876
2877         if ( strcasecmp( c->argv[ 1 ], "objectclass" ) == 0 ) {
2878                 map = oc_map;
2879                 is_oc = 1;
2880
2881         } else if ( strcasecmp( c->argv[ 1 ], "attribute" ) == 0 ) {
2882                 map = at_map;
2883
2884         } else {
2885                 snprintf( c->cr_msg, sizeof(c->cr_msg),
2886                         "%s unknown argument \"%s\"",
2887                         c->argv[0], c->argv[1] );
2888                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2889                 return 1;
2890         }
2891
2892         if ( !is_oc && map->map == NULL ) {
2893                 /* only init if required */
2894                 ldap_back_map_init( map, &mapping );
2895         }
2896
2897         if ( strcmp( c->argv[ 2 ], "*" ) == 0 ) {
2898                 if ( c->argc < 4 || strcmp( c->argv[ 3 ], "*" ) == 0 ) {
2899                         map->drop_missing = ( c->argc < 4 );
2900                         goto success_return;
2901                 }
2902                 src = dst = c->argv[ 3 ];
2903
2904         } else if ( c->argc < 4 ) {
2905                 src = "";
2906                 dst = c->argv[ 2 ];
2907
2908         } else {
2909                 src = c->argv[ 2 ];
2910                 dst = ( strcmp( c->argv[ 3 ], "*" ) == 0 ? src : c->argv[ 3 ] );
2911         }
2912
2913         if ( ( map == at_map )
2914                 && ( strcasecmp( src, "objectclass" ) == 0
2915                         || strcasecmp( dst, "objectclass" ) == 0 ) )
2916         {
2917                 snprintf( c->cr_msg, sizeof(c->cr_msg),
2918                         "objectclass attribute cannot be mapped" );
2919                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2920                 return 1;
2921         }
2922
2923         mapping = (struct ldapmapping *)ch_calloc( 2,
2924                 sizeof(struct ldapmapping) );
2925         if ( mapping == NULL ) {
2926                 snprintf( c->cr_msg, sizeof(c->cr_msg),
2927                         "out of memory" );
2928                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2929                 return 1;
2930         }
2931         ber_str2bv( src, 0, 1, &mapping[ 0 ].src );
2932         ber_str2bv( dst, 0, 1, &mapping[ 0 ].dst );
2933         mapping[ 1 ].src = mapping[ 0 ].dst;
2934         mapping[ 1 ].dst = mapping[ 0 ].src;
2935
2936         /*
2937          * schema check
2938          */
2939         if ( is_oc ) {
2940                 if ( src[ 0 ] != '\0' ) {
2941                         if ( oc_bvfind( &mapping[ 0 ].src ) == NULL ) {
2942                                 Debug( LDAP_DEBUG_ANY,
2943         "warning, source objectClass '%s' should be defined in schema\n",
2944                                         c->log, src, 0 );
2945
2946                                 /*
2947                                  * FIXME: this should become an err
2948                                  */
2949                                 goto error_return;
2950                         }
2951                 }
2952
2953                 if ( oc_bvfind( &mapping[ 0 ].dst ) == NULL ) {
2954                         Debug( LDAP_DEBUG_ANY,
2955         "warning, destination objectClass '%s' is not defined in schema\n",
2956                                 c->log, dst, 0 );
2957                 }
2958         } else {
2959                 int                     rc;
2960                 const char              *text = NULL;
2961                 AttributeDescription    *ad = NULL;
2962
2963                 if ( src[ 0 ] != '\0' ) {
2964                         rc = slap_bv2ad( &mapping[ 0 ].src, &ad, &text );
2965                         if ( rc != LDAP_SUCCESS ) {
2966                                 Debug( LDAP_DEBUG_ANY,
2967         "warning, source attributeType '%s' should be defined in schema\n",
2968                                         c->log, src, 0 );
2969
2970                                 /*
2971                                  * FIXME: this should become an err
2972                                  */
2973                                 /*
2974                                  * we create a fake "proxied" ad
2975                                  * and add it here.
2976                                  */
2977
2978                                 rc = slap_bv2undef_ad( &mapping[ 0 ].src,
2979                                                 &ad, &text, SLAP_AD_PROXIED );
2980                                 if ( rc != LDAP_SUCCESS ) {
2981                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2982                                                 "source attributeType \"%s\": %d (%s)",
2983                                                 src, rc, text ? text : "" );
2984                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2985                                         goto error_return;
2986                                 }
2987                         }
2988
2989                         ad = NULL;
2990                 }
2991
2992                 rc = slap_bv2ad( &mapping[ 0 ].dst, &ad, &text );
2993                 if ( rc != LDAP_SUCCESS ) {
2994                         Debug( LDAP_DEBUG_ANY,
2995         "warning, destination attributeType '%s' is not defined in schema\n",
2996                                 c->log, dst, 0 );
2997
2998                         /*
2999                          * we create a fake "proxied" ad
3000                          * and add it here.
3001                          */
3002
3003                         rc = slap_bv2undef_ad( &mapping[ 0 ].dst,
3004                                         &ad, &text, SLAP_AD_PROXIED );
3005                         if ( rc != LDAP_SUCCESS ) {
3006                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
3007                                         "destination attributeType \"%s\": %d (%s)\n",
3008                                         dst, rc, text ? text : "" );
3009                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
3010                                 return 1;
3011                         }
3012                 }
3013         }
3014
3015         if ( (src[ 0 ] != '\0' && avl_find( map->map, (caddr_t)&mapping[ 0 ], mapping_cmp ) != NULL)
3016                         || avl_find( map->remap, (caddr_t)&mapping[ 1 ], mapping_cmp ) != NULL)
3017         {
3018                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
3019                         "duplicate mapping found." );
3020                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
3021                 goto error_return;
3022         }
3023
3024         if ( src[ 0 ] != '\0' ) {
3025                 avl_insert( &map->map, (caddr_t)&mapping[ 0 ],
3026                                         mapping_cmp, mapping_dup );
3027         }
3028         avl_insert( &map->remap, (caddr_t)&mapping[ 1 ],
3029                                 mapping_cmp, mapping_dup );
3030
3031 success_return:;
3032         return 0;
3033
3034 error_return:;
3035         if ( mapping ) {
3036                 ch_free( mapping[ 0 ].src.bv_val );
3037                 ch_free( mapping[ 0 ].dst.bv_val );
3038                 ch_free( mapping );
3039         }
3040
3041         return 1;
3042 }
3043
3044
3045 #ifdef ENABLE_REWRITE
3046 static char *
3047 suffix_massage_regexize( const char *s )
3048 {
3049         char *res, *ptr;
3050         const char *p, *r;
3051         int i;
3052
3053         if ( s[ 0 ] == '\0' ) {
3054                 return ch_strdup( "^(.+)$" );
3055         }
3056
3057         for ( i = 0, p = s;
3058                         ( r = strchr( p, ',' ) ) != NULL;
3059                         p = r + 1, i++ )
3060                 ;
3061
3062         res = ch_calloc( sizeof( char ),
3063                         strlen( s )
3064                         + STRLENOF( "((.+),)?" )
3065                         + STRLENOF( "[ ]?" ) * i
3066                         + STRLENOF( "$" ) + 1 );
3067
3068         ptr = lutil_strcopy( res, "((.+),)?" );
3069         for ( i = 0, p = s;
3070                         ( r = strchr( p, ',' ) ) != NULL;
3071                         p = r + 1 , i++ ) {
3072                 ptr = lutil_strncopy( ptr, p, r - p + 1 );
3073                 ptr = lutil_strcopy( ptr, "[ ]?" );
3074
3075                 if ( r[ 1 ] == ' ' ) {
3076                         r++;
3077                 }
3078         }
3079         ptr = lutil_strcopy( ptr, p );
3080         ptr[ 0 ] = '$';
3081         ptr++;
3082         ptr[ 0 ] = '\0';
3083
3084         return res;
3085 }
3086
3087 static char *
3088 suffix_massage_patternize( const char *s, const char *p )
3089 {
3090         ber_len_t       len;
3091         char            *res, *ptr;
3092
3093         len = strlen( p );
3094
3095         if ( s[ 0 ] == '\0' ) {
3096                 len++;
3097         }
3098
3099         res = ch_calloc( sizeof( char ), len + STRLENOF( "%1" ) + 1 );
3100         if ( res == NULL ) {
3101                 return NULL;
3102         }
3103
3104         ptr = lutil_strcopy( res, ( p[ 0 ] == '\0' ? "%2" : "%1" ) );
3105         if ( s[ 0 ] == '\0' ) {
3106                 ptr[ 0 ] = ',';
3107                 ptr++;
3108         }
3109         lutil_strcopy( ptr, p );
3110
3111         return res;
3112 }
3113
3114 int
3115 suffix_massage_config(
3116                 struct rewrite_info *info,
3117                 struct berval *pvnc,
3118                 struct berval *nvnc,
3119                 struct berval *prnc,
3120                 struct berval *nrnc
3121 )
3122 {
3123         char *rargv[ 5 ];
3124         int line = 0;
3125
3126         rargv[ 0 ] = "rewriteEngine";
3127         rargv[ 1 ] = "on";
3128         rargv[ 2 ] = NULL;
3129         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3130
3131         rargv[ 0 ] = "rewriteContext";
3132         rargv[ 1 ] = "default";
3133         rargv[ 2 ] = NULL;
3134         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3135
3136         rargv[ 0 ] = "rewriteRule";
3137         rargv[ 1 ] = suffix_massage_regexize( pvnc->bv_val );
3138         rargv[ 2 ] = suffix_massage_patternize( pvnc->bv_val, prnc->bv_val );
3139         rargv[ 3 ] = ":";
3140         rargv[ 4 ] = NULL;
3141         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3142         ch_free( rargv[ 1 ] );
3143         ch_free( rargv[ 2 ] );
3144
3145         if ( BER_BVISEMPTY( pvnc ) ) {
3146                 rargv[ 0 ] = "rewriteRule";
3147                 rargv[ 1 ] = "^$";
3148                 rargv[ 2 ] = prnc->bv_val;
3149                 rargv[ 3 ] = ":";
3150                 rargv[ 4 ] = NULL;
3151                 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3152         }
3153
3154         rargv[ 0 ] = "rewriteContext";
3155         rargv[ 1 ] = "searchEntryDN";
3156         rargv[ 2 ] = NULL;
3157         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3158
3159         rargv[ 0 ] = "rewriteRule";
3160         rargv[ 1 ] = suffix_massage_regexize( prnc->bv_val );
3161         rargv[ 2 ] = suffix_massage_patternize( prnc->bv_val, pvnc->bv_val );
3162         rargv[ 3 ] = ":";
3163         rargv[ 4 ] = NULL;
3164         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3165         ch_free( rargv[ 1 ] );
3166         ch_free( rargv[ 2 ] );
3167
3168         if ( BER_BVISEMPTY( prnc ) ) {
3169                 rargv[ 0 ] = "rewriteRule";
3170                 rargv[ 1 ] = "^$";
3171                 rargv[ 2 ] = pvnc->bv_val;
3172                 rargv[ 3 ] = ":";
3173                 rargv[ 4 ] = NULL;
3174                 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3175         }
3176
3177         /* backward compatibility */
3178         rargv[ 0 ] = "rewriteContext";
3179         rargv[ 1 ] = "searchResult";
3180         rargv[ 2 ] = "alias";
3181         rargv[ 3 ] = "searchEntryDN";
3182         rargv[ 4 ] = NULL;
3183         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3184
3185         rargv[ 0 ] = "rewriteContext";
3186         rargv[ 1 ] = "matchedDN";
3187         rargv[ 2 ] = "alias";
3188         rargv[ 3 ] = "searchEntryDN";
3189         rargv[ 4 ] = NULL;
3190         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3191
3192         rargv[ 0 ] = "rewriteContext";
3193         rargv[ 1 ] = "searchAttrDN";
3194         rargv[ 2 ] = "alias";
3195         rargv[ 3 ] = "searchEntryDN";
3196         rargv[ 4 ] = NULL;
3197         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3198
3199         /* NOTE: this corresponds to #undef'ining RWM_REFERRAL_REWRITE;
3200          * see servers/slapd/overlays/rwm.h for details */
3201         rargv[ 0 ] = "rewriteContext";
3202         rargv[ 1 ] = "referralAttrDN";
3203         rargv[ 2 ] = NULL;
3204         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3205
3206         rargv[ 0 ] = "rewriteContext";
3207         rargv[ 1 ] = "referralDN";
3208         rargv[ 2 ] = NULL;
3209         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3210
3211         return 0;
3212 }
3213 #endif /* ENABLE_REWRITE */
3214