git.sur5r.net Git - openldap/blob - servers/slapd/back-meta/config.c

   1 /* $OpenLDAP$ */
   2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   3  *
   4  * Copyright 1999-2012 The OpenLDAP Foundation.
   5  * Portions Copyright 2001-2003 Pierangelo Masarati.
   6  * Portions Copyright 1999-2003 Howard Chu.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted only as authorized by the OpenLDAP
  11  * Public License.
  12  *
  13  * A copy of this license is available in the file LICENSE in the
  14  * top-level directory of the distribution or, alternatively, at
  15  * <http://www.OpenLDAP.org/license.html>.
  16  */
  17 /* ACKNOWLEDGEMENTS:
  18  * This work was initially developed by the Howard Chu for inclusion
  19  * in OpenLDAP Software and subsequently enhanced by Pierangelo
  20  * Masarati.
  21  */
  22
  23 #include "portable.h"
  24
  25 #include <stdio.h>
  26
  27 #include <ac/string.h>
  28 #include <ac/socket.h>
  29
  30 #include "slap.h"
  31 #include "config.h"
  32 #include "lutil.h"
  33 #include "../back-ldap/back-ldap.h"
  34 #include "back-meta.h"
  35
  36 static ConfigDriver meta_back_cf_gen;
  37 static ConfigLDAPadd meta_ldadd;
  38 static ConfigCfAdd meta_cfadd;
  39
  40 static int ldap_back_map_config(
  41         ConfigArgs *c,
  42         struct ldapmap  *oc_map,
  43         struct ldapmap  *at_map );
  44
  45 /* Three sets of enums:
  46  *      1) attrs that are only valid in the base config
  47  *      2) attrs that are valid in base or target
  48  *      3) attrs that are only valid in a target
  49  */
  50
  51 /* Base attrs */
  52 enum {
  53         LDAP_BACK_CFG_CONN_TTL = 1,
  54         LDAP_BACK_CFG_DNCACHE_TTL,
  55         LDAP_BACK_CFG_IDLE_TIMEOUT,
  56         LDAP_BACK_CFG_ONERR,
  57         LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
  58         LDAP_BACK_CFG_SINGLECONN,
  59         LDAP_BACK_CFG_USETEMP,
  60         LDAP_BACK_CFG_CONNPOOLMAX,
  61         LDAP_BACK_CFG_LAST_BASE
  62 };
  63
  64 /* Base or target */
  65 enum {
  66         LDAP_BACK_CFG_BIND_TIMEOUT = LDAP_BACK_CFG_LAST_BASE,
  67         LDAP_BACK_CFG_CANCEL,
  68         LDAP_BACK_CFG_CHASE,
  69         LDAP_BACK_CFG_CLIENT_PR,
  70         LDAP_BACK_CFG_DEFAULT_T,
  71         LDAP_BACK_CFG_NETWORK_TIMEOUT,
  72         LDAP_BACK_CFG_NOREFS,
  73         LDAP_BACK_CFG_NOUNDEFFILTER,
  74         LDAP_BACK_CFG_NRETRIES,
  75         LDAP_BACK_CFG_QUARANTINE,
  76         LDAP_BACK_CFG_REBIND,
  77         LDAP_BACK_CFG_TIMEOUT,
  78         LDAP_BACK_CFG_VERSION,
  79         LDAP_BACK_CFG_ST_REQUEST,
  80         LDAP_BACK_CFG_T_F,
  81         LDAP_BACK_CFG_TLS,
  82         LDAP_BACK_CFG_LAST_BOTH
  83 };
  84
  85 /* Target attrs */
  86 enum {
  87         LDAP_BACK_CFG_URI = LDAP_BACK_CFG_LAST_BOTH,
  88         LDAP_BACK_CFG_ACL_AUTHCDN,
  89         LDAP_BACK_CFG_ACL_PASSWD,
  90         LDAP_BACK_CFG_IDASSERT_AUTHZFROM,
  91         LDAP_BACK_CFG_IDASSERT_BIND,
  92         LDAP_BACK_CFG_REWRITE,
  93         LDAP_BACK_CFG_SUFFIXM,
  94         LDAP_BACK_CFG_MAP,
  95         LDAP_BACK_CFG_SUBTREE_EX,
  96         LDAP_BACK_CFG_SUBTREE_IN,
  97         LDAP_BACK_CFG_PSEUDOROOTDN,
  98         LDAP_BACK_CFG_PSEUDOROOTPW,
  99
 100         LDAP_BACK_CFG_LAST
 101 };
 102
 103 static ConfigTable metacfg[] = {
 104         { "uri", "uri", 2, 2, 0,
 105                 ARG_MAGIC|LDAP_BACK_CFG_URI,
 106                 meta_back_cf_gen, "( OLcfgDbAt:0.14 "
 107                         "NAME 'olcDbURI' "
 108                         "DESC 'URI (list) for remote DSA' "
 109                         "SYNTAX OMsDirectoryString "
 110                         "SINGLE-VALUE )",
 111                 NULL, NULL },
 112         { "tls", "what", 2, 0, 0,
 113                 ARG_MAGIC|LDAP_BACK_CFG_TLS,
 114                 meta_back_cf_gen, "( OLcfgDbAt:3.1 "
 115                         "NAME 'olcDbStartTLS' "
 116                         "DESC 'StartTLS' "
 117                         "SYNTAX OMsDirectoryString "
 118                         "SINGLE-VALUE )",
 119                 NULL, NULL },
 120         { "acl-authcDN", "DN", 2, 2, 0,
 121                 ARG_DN|ARG_MAGIC|LDAP_BACK_CFG_ACL_AUTHCDN,
 122                 meta_back_cf_gen, "( OLcfgDbAt:3.2 "
 123                         "NAME 'olcDbACLAuthcDn' "
 124                         "DESC 'Remote ACL administrative identity' "
 125                         "OBSOLETE "
 126                         "SYNTAX OMsDN "
 127                         "SINGLE-VALUE )",
 128                 NULL, NULL },
 129         /* deprecated, will be removed; aliases "acl-authcDN" */
 130         { "binddn", "DN", 2, 2, 0,
 131                 ARG_DN|ARG_MAGIC|LDAP_BACK_CFG_ACL_AUTHCDN,
 132                 meta_back_cf_gen, NULL, NULL, NULL },
 133         { "acl-passwd", "cred", 2, 2, 0,
 134                 ARG_MAGIC|LDAP_BACK_CFG_ACL_PASSWD,
 135                 meta_back_cf_gen, "( OLcfgDbAt:3.3 "
 136                         "NAME 'olcDbACLPasswd' "
 137                         "DESC 'Remote ACL administrative identity credentials' "
 138                         "OBSOLETE "
 139                         "SYNTAX OMsDirectoryString "
 140                         "SINGLE-VALUE )",
 141                 NULL, NULL },
 142         /* deprecated, will be removed; aliases "acl-passwd" */
 143         { "bindpw", "cred", 2, 2, 0,
 144                 ARG_MAGIC|LDAP_BACK_CFG_ACL_PASSWD,
 145                 meta_back_cf_gen, NULL, NULL, NULL },
 146         { "idassert-bind", "args", 2, 0, 0,
 147                 ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_BIND,
 148                 meta_back_cf_gen, "( OLcfgDbAt:3.7 "
 149                         "NAME 'olcDbIDAssertBind' "
 150                         "DESC 'Remote Identity Assertion administrative identity auth bind configuration' "
 151                         "SYNTAX OMsDirectoryString "
 152                         "SINGLE-VALUE )",
 153                 NULL, NULL },
 154         { "idassert-authzFrom", "authzRule", 2, 2, 0,
 155                 ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_AUTHZFROM,
 156                 meta_back_cf_gen, "( OLcfgDbAt:3.9 "
 157                         "NAME 'olcDbIDAssertAuthzFrom' "
 158                         "DESC 'Remote Identity Assertion authz rules' "
 159                         "EQUALITY caseIgnoreMatch "
 160                         "SYNTAX OMsDirectoryString "
 161                         "X-ORDERED 'VALUES' )",
 162                 NULL, NULL },
 163         { "rebind-as-user", "true|FALSE", 1, 2, 0,
 164                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_REBIND,
 165                 meta_back_cf_gen, "( OLcfgDbAt:3.10 "
 166                         "NAME 'olcDbRebindAsUser' "
 167                         "DESC 'Rebind as user' "
 168                         "SYNTAX OMsBoolean "
 169                         "SINGLE-VALUE )",
 170                 NULL, NULL },
 171         { "chase-referrals", "true|FALSE", 2, 2, 0,
 172                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_CHASE,
 173                 meta_back_cf_gen, "( OLcfgDbAt:3.11 "
 174                         "NAME 'olcDbChaseReferrals' "
 175                         "DESC 'Chase referrals' "
 176                         "SYNTAX OMsBoolean "
 177                         "SINGLE-VALUE )",
 178                 NULL, NULL },
 179         { "t-f-support", "true|FALSE|discover", 2, 2, 0,
 180                 ARG_MAGIC|LDAP_BACK_CFG_T_F,
 181                 meta_back_cf_gen, "( OLcfgDbAt:3.12 "
 182                         "NAME 'olcDbTFSupport' "
 183                         "DESC 'Absolute filters support' "
 184                         "SYNTAX OMsDirectoryString "
 185                         "SINGLE-VALUE )",
 186                 NULL, NULL },
 187         { "timeout", "timeout(list)", 2, 0, 0,
 188                 ARG_MAGIC|LDAP_BACK_CFG_TIMEOUT,
 189                 meta_back_cf_gen, "( OLcfgDbAt:3.14 "
 190                         "NAME 'olcDbTimeout' "
 191                         "DESC 'Per-operation timeouts' "
 192                         "SYNTAX OMsDirectoryString "
 193                         "SINGLE-VALUE )",
 194                 NULL, NULL },
 195         { "idle-timeout", "timeout", 2, 2, 0,
 196                 ARG_MAGIC|LDAP_BACK_CFG_IDLE_TIMEOUT,
 197                 meta_back_cf_gen, "( OLcfgDbAt:3.15 "
 198                         "NAME 'olcDbIdleTimeout' "
 199                         "DESC 'connection idle timeout' "
 200                         "SYNTAX OMsDirectoryString "
 201                         "SINGLE-VALUE )",
 202                 NULL, NULL },
 203         { "conn-ttl", "ttl", 2, 2, 0,
 204                 ARG_MAGIC|LDAP_BACK_CFG_CONN_TTL,
 205                 meta_back_cf_gen, "( OLcfgDbAt:3.16 "
 206                         "NAME 'olcDbConnTtl' "
 207                         "DESC 'connection ttl' "
 208                         "SYNTAX OMsDirectoryString "
 209                         "SINGLE-VALUE )",
 210                 NULL, NULL },
 211         { "network-timeout", "timeout", 2, 2, 0,
 212                 ARG_MAGIC|LDAP_BACK_CFG_NETWORK_TIMEOUT,
 213                 meta_back_cf_gen, "( OLcfgDbAt:3.17 "
 214                         "NAME 'olcDbNetworkTimeout' "
 215                         "DESC 'connection network timeout' "
 216                         "SYNTAX OMsDirectoryString "
 217                         "SINGLE-VALUE )",
 218                 NULL, NULL },
 219         { "protocol-version", "version", 2, 2, 0,
 220                 ARG_MAGIC|ARG_INT|LDAP_BACK_CFG_VERSION,
 221                 meta_back_cf_gen, "( OLcfgDbAt:3.18 "
 222                         "NAME 'olcDbProtocolVersion' "
 223                         "DESC 'protocol version' "
 224                         "SYNTAX OMsInteger "
 225                         "SINGLE-VALUE )",
 226                 NULL, NULL },
 227         { "single-conn", "true|FALSE", 2, 2, 0,
 228                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_SINGLECONN,
 229                 meta_back_cf_gen, "( OLcfgDbAt:3.19 "
 230                         "NAME 'olcDbSingleConn' "
 231                         "DESC 'cache a single connection per identity' "
 232                         "SYNTAX OMsBoolean "
 233                         "SINGLE-VALUE )",
 234                 NULL, NULL },
 235         { "cancel", "ABANDON|ignore|exop", 2, 2, 0,
 236                 ARG_MAGIC|LDAP_BACK_CFG_CANCEL,
 237                 meta_back_cf_gen, "( OLcfgDbAt:3.20 "
 238                         "NAME 'olcDbCancel' "
 239                         "DESC 'abandon/ignore/exop operations when appropriate' "
 240                         "SYNTAX OMsDirectoryString "
 241                         "SINGLE-VALUE )",
 242                 NULL, NULL },
 243         { "quarantine", "retrylist", 2, 2, 0,
 244                 ARG_MAGIC|LDAP_BACK_CFG_QUARANTINE,
 245                 meta_back_cf_gen, "( OLcfgDbAt:3.21 "
 246                         "NAME 'olcDbQuarantine' "
 247                         "DESC 'Quarantine database if connection fails and retry according to rule' "
 248                         "SYNTAX OMsDirectoryString "
 249                         "SINGLE-VALUE )",
 250                 NULL, NULL },
 251         { "use-temporary-conn", "true|FALSE", 2, 2, 0,
 252                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_USETEMP,
 253                 meta_back_cf_gen, "( OLcfgDbAt:3.22 "
 254                         "NAME 'olcDbUseTemporaryConn' "
 255                         "DESC 'Use temporary connections if the cached one is busy' "
 256                         "SYNTAX OMsBoolean "
 257                         "SINGLE-VALUE )",
 258                 NULL, NULL },
 259         { "conn-pool-max", "<n>", 2, 2, 0,
 260                 ARG_MAGIC|ARG_INT|LDAP_BACK_CFG_CONNPOOLMAX,
 261                 meta_back_cf_gen, "( OLcfgDbAt:3.23 "
 262                         "NAME 'olcDbConnectionPoolMax' "
 263                         "DESC 'Max size of privileged connections pool' "
 264                         "SYNTAX OMsInteger "
 265                         "SINGLE-VALUE )",
 266                 NULL, NULL },
 267 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
 268         { "session-tracking-request", "true|FALSE", 2, 2, 0,
 269                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_ST_REQUEST,
 270                 meta_back_cf_gen, "( OLcfgDbAt:3.24 "
 271                         "NAME 'olcDbSessionTrackingRequest' "
 272                         "DESC 'Add session tracking control to proxied requests' "
 273                         "SYNTAX OMsBoolean "
 274                         "SINGLE-VALUE )",
 275                 NULL, NULL },
 276 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
 277         { "norefs", "true|FALSE", 2, 2, 0,
 278                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_NOREFS,
 279                 meta_back_cf_gen, "( OLcfgDbAt:3.25 "
 280                         "NAME 'olcDbNoRefs' "
 281                         "DESC 'Do not return search reference responses' "
 282                         "SYNTAX OMsBoolean "
 283                         "SINGLE-VALUE )",
 284                 NULL, NULL },
 285         { "noundeffilter", "true|FALSE", 2, 2, 0,
 286                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_NOUNDEFFILTER,
 287                 meta_back_cf_gen, "( OLcfgDbAt:3.26 "
 288                         "NAME 'olcDbNoUndefFilter' "
 289                         "DESC 'Do not propagate undefined search filters' "
 290                         "SYNTAX OMsBoolean "
 291                         "SINGLE-VALUE )",
 292                 NULL, NULL },
 293
 294         { "rewrite", "arglist", 2, 0, STRLENOF( "rewrite" ),
 295                 ARG_MAGIC|LDAP_BACK_CFG_REWRITE,
 296                 meta_back_cf_gen, "( OLcfgDbAt:3.101 "
 297                         "NAME 'olcDbRewrite' "
 298                         "DESC 'DN rewriting rules' "
 299                         "EQUALITY caseIgnoreMatch "
 300                         "SYNTAX OMsDirectoryString "
 301                         "X-ORDERED 'VALUES' )",
 302                 NULL, NULL },
 303         { "suffixmassage", "virtual> <real", 2, 3, 0,
 304                 ARG_MAGIC|LDAP_BACK_CFG_SUFFIXM,
 305                 meta_back_cf_gen, NULL, NULL, NULL },
 306
 307         { "map", "attribute|objectClass> [*|<local>] *|<remote", 3, 4, 0,
 308                 ARG_MAGIC|LDAP_BACK_CFG_MAP,
 309                 meta_back_cf_gen, "( OLcfgDbAt:3.102 "
 310                         "NAME 'olcDbMap' "
 311                         "DESC 'Map attribute and objectclass names' "
 312                         "EQUALITY caseIgnoreMatch "
 313                         "SYNTAX OMsDirectoryString "
 314                         "X-ORDERED 'VALUES' )",
 315                 NULL, NULL },
 316
 317         { "subtree-exclude", "pattern", 2, 2, 0,
 318                 ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_SUBTREE_EX,
 319                 meta_back_cf_gen, "( OLcfgDbAt:3.103 "
 320                         "NAME 'olcDbSubtreeExclude' "
 321                         "DESC 'DN of subtree to exclude from target' "
 322                         "EQUALITY caseIgnoreMatch "
 323                         "SYNTAX OMsDirectoryString )",
 324                 NULL, NULL },
 325         { "subtree-include", "pattern", 2, 2, 0,
 326                 ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_SUBTREE_IN,
 327                 meta_back_cf_gen, "( OLcfgDbAt:3.104 "
 328                         "NAME 'olcDbSubtreeInclude' "
 329                         "DESC 'DN of subtree to include in target' "
 330                         "EQUALITY caseIgnoreMatch "
 331                         "SYNTAX OMsDirectoryString )",
 332                 NULL, NULL },
 333         { "default-target", "[none|<target ID>]", 1, 2, 0,
 334                 ARG_MAGIC|LDAP_BACK_CFG_DEFAULT_T,
 335                 meta_back_cf_gen, "( OLcfgDbAt:3.105 "
 336                         "NAME 'olcDbDefaultTarget' "
 337                         "DESC 'Specify the default target' "
 338                         "SYNTAX OMsDirectoryString "
 339                         "SINGLE-VALUE )",
 340                 NULL, NULL },
 341         { "dncache-ttl", "ttl", 2, 2, 0,
 342                 ARG_MAGIC|LDAP_BACK_CFG_DNCACHE_TTL,
 343                 meta_back_cf_gen, "( OLcfgDbAt:3.106 "
 344                         "NAME 'olcDbDnCacheTtl' "
 345                         "DESC 'dncache ttl' "
 346                         "SYNTAX OMsDirectoryString "
 347                         "SINGLE-VALUE )",
 348                 NULL, NULL },
 349         { "bind-timeout", "microseconds", 2, 2, 0,
 350                 ARG_MAGIC|ARG_ULONG|LDAP_BACK_CFG_BIND_TIMEOUT,
 351                 meta_back_cf_gen, "( OLcfgDbAt:3.107 "
 352                         "NAME 'olcDbBindTimeout' "
 353                         "DESC 'bind timeout' "
 354                         "SYNTAX OMsDirectoryString "
 355                         "SINGLE-VALUE )",
 356                 NULL, NULL },
 357         { "onerr", "CONTINUE|report|stop", 2, 2, 0,
 358                 ARG_MAGIC|LDAP_BACK_CFG_ONERR,
 359                 meta_back_cf_gen, "( OLcfgDbAt:3.108 "
 360                         "NAME 'olcDbOnErr' "
 361                         "DESC 'error handling' "
 362                         "SYNTAX OMsDirectoryString "
 363                         "SINGLE-VALUE )",
 364                 NULL, NULL },
 365         { "pseudoroot-bind-defer", "TRUE|false", 2, 2, 0,
 366                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
 367                 meta_back_cf_gen, "( OLcfgDbAt:3.109 "
 368                         "NAME 'olcDbPseudoRootBindDefer' "
 369                         "DESC 'error handling' "
 370                         "SYNTAX OMsBoolean "
 371                         "SINGLE-VALUE )",
 372                 NULL, NULL },
 373         { "root-bind-defer", "TRUE|false", 2, 2, 0,
 374                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
 375                 meta_back_cf_gen, NULL, NULL, NULL },
 376         { "pseudorootdn", "dn", 2, 2, 0,
 377                 ARG_MAGIC|ARG_DN|LDAP_BACK_CFG_PSEUDOROOTDN,
 378                 meta_back_cf_gen, NULL, NULL, NULL },
 379         { "pseudorootpw", "password", 2, 2, 0,
 380                 ARG_MAGIC|ARG_STRING|LDAP_BACK_CFG_PSEUDOROOTDN,
 381                 meta_back_cf_gen, NULL, NULL, NULL },
 382         { "nretries", "NEVER|forever|<number>", 2, 2, 0,
 383                 ARG_MAGIC|LDAP_BACK_CFG_NRETRIES,
 384                 meta_back_cf_gen, "( OLcfgDbAt:3.110 "
 385                         "NAME 'olcDbNretries' "
 386                         "DESC 'retry handling' "
 387                         "SYNTAX OMsDirectoryString "
 388                         "SINGLE-VALUE )",
 389                 NULL, NULL },
 390         { "client-pr", "accept-unsolicited|disable|<size>", 2, 2, 0,
 391                 ARG_MAGIC|LDAP_BACK_CFG_CLIENT_PR,
 392                 meta_back_cf_gen, "( OLcfgDbAt:3.111 "
 393                         "NAME 'olcDbClientPr' "
 394                         "DESC 'PagedResults handling' "
 395                         "SYNTAX OMsDirectoryString "
 396                         "SINGLE-VALUE )",
 397                 NULL, NULL },
 398
 399         { "", "", 0, 0, 0, ARG_IGNORED,
 400                 NULL, "( OLcfgDbAt:3.100 NAME 'olcMetaSub' "
 401                         "DESC 'Placeholder to name a Target entry' "
 402                         "EQUALITY caseIgnoreMatch "
 403                         "SYNTAX OMsDirectoryString "
 404                         "SINGLE-VALUE X-ORDERED 'SIBLINGS' )", NULL, NULL },
 405
 406         { NULL, NULL, 0, 0, 0, ARG_IGNORED,
 407                 NULL, NULL, NULL, NULL }
 408 };
 409
 410 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
 411 #define ST_ATTR "$ olcDbSessionTrackingRequest "
 412 #else
 413 #define ST_ATTR ""
 414 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
 415
 416 #define COMMON_ATTRS    \
 417                         "$ olcDbBindTimeout " \
 418                         "$ olcDbCancel " \
 419                         "$ olcDbChaseReferrals " \
 420                         "$ olcDbClientPr " \
 421                         "$ olcDbDefaultTarget " \
 422                         "$ olcDbNetworkTimeout " \
 423                         "$ olcDbNoRefs " \
 424                         "$ olcDbNoUndefFilter " \
 425                         "$ olcDbNretries " \
 426                         "$ olcDbProtocolVersion " \
 427                         "$ olcDbQuarantine " \
 428                         "$ olcDbRebindAsUser " \
 429                         ST_ATTR \
 430                         "$ olcDbStartTLS " \
 431                         "$ olcDbTFSupport "
 432
 433 static ConfigOCs metaocs[] = {
 434         { "( OLcfgDbOc:3.2 "
 435                 "NAME 'olcMetaConfig' "
 436                 "DESC 'Meta backend configuration' "
 437                 "SUP olcDatabaseConfig "
 438                 "MAY ( olcDbConnTtl "
 439                         "$ olcDbDnCacheTtl "
 440                         "$ olcDbIdleTimeout "
 441                         "$ olcDbOnErr "
 442                         "$ olcDbPseudoRootBindDefer "
 443                         "$ olcDbSingleConn "
 444                         "$ olcDbUseTemporaryConn "
 445                         "$ olcDbConnectionPoolMax "
 446
 447                         /* defaults, may be overridden per-target */
 448                         COMMON_ATTRS
 449                 ") )",
 450                         Cft_Database, metacfg, NULL, meta_cfadd },
 451         { "( OLcfgDbOc:3.3 "
 452                 "NAME 'olcMetaTargetConfig' "
 453                 "DESC 'Meta target configuration' "
 454                 "SUP olcConfig STRUCTURAL "
 455                 "MUST ( olcMetaSub $ olcDbURI ) "
 456                 "MAY ( olcDbACLAuthcDn "
 457                         "$ olcDbACLPasswd "
 458                         "$ olcDbIDAssertAuthzFrom "
 459                         "$ olcDbIDAssertBind "
 460                         "$ olcDbMap "
 461                         "$ olcDbRewrite "
 462                         "$ olcDbSubtreeExclude "
 463                         "$ olcDbSubtreeInclude "
 464                         "$ olcDbTimeout "
 465
 466                         /* defaults may be inherited */
 467                         COMMON_ATTRS
 468                 ") )",
 469                         Cft_Misc, metacfg, meta_ldadd },
 470         { NULL, 0, NULL }
 471 };
 472
 473 static int
 474 meta_ldadd( CfEntryInfo *p, Entry *e, ConfigArgs *c )
 475 {
 476         if ( p->ce_type != Cft_Database || !p->ce_bi ||
 477                 p->ce_bi->bi_cf_ocs != metaocs )
 478                 return LDAP_CONSTRAINT_VIOLATION;
 479
 480         return LDAP_SUCCESS;
 481 }
 482
 483 static int
 484 meta_cfadd( Operation *op, SlapReply *rs, Entry *p, ConfigArgs *c )
 485 {
 486         metainfo_t      *mi = ( metainfo_t * )c->be->be_private;
 487         struct berval bv;
 488         int i;
 489
 490         bv.bv_val = c->cr_msg;
 491         for ( i=0; i<mi->mi_ntargets; i++ ) {
 492                 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg),
 493                         "olcMetaSub=" SLAP_X_ORDERED_FMT "uri", i );
 494                 c->ca_private = mi->mi_targets[i];
 495                 c->valx = i;
 496                 config_build_entry( op, rs, p->e_private, c,
 497                         &bv, &metaocs[1], NULL );
 498         }
 499
 500         return LDAP_SUCCESS;
 501 }
 502
 503 static int
 504 meta_rwi_init( struct rewrite_info **rwm_rw )
 505 {
 506         char                    *rargv[ 3 ];
 507
 508         *rwm_rw = rewrite_info_init( REWRITE_MODE_USE_DEFAULT );
 509         if ( *rwm_rw == NULL ) {
 510                 return -1;
 511         }
 512         /*
 513          * the filter rewrite as a string must be disabled
 514          * by default; it can be re-enabled by adding rules;
 515          * this creates an empty rewriteContext
 516          */
 517         rargv[ 0 ] = "rewriteContext";
 518         rargv[ 1 ] = "searchFilter";
 519         rargv[ 2 ] = NULL;
 520         rewrite_parse( *rwm_rw, "<suffix massage>", 1, 2, rargv );
 521
 522         rargv[ 0 ] = "rewriteContext";
 523         rargv[ 1 ] = "default";
 524         rargv[ 2 ] = NULL;
 525         rewrite_parse( *rwm_rw, "<suffix massage>", 1, 2, rargv );
 526
 527         return 0;
 528 }
 529
 530 static int
 531 meta_back_new_target(
 532         metatarget_t    **mtp )
 533 {
 534         metatarget_t            *mt;
 535
 536         *mtp = NULL;
 537
 538         mt = ch_calloc( sizeof( metatarget_t ), 1 );
 539
 540         if ( meta_rwi_init( &mt->mt_rwmap.rwm_rw )) {
 541                 ch_free( mt );
 542                 return -1;
 543         }
 544
 545         ldap_pvt_thread_mutex_init( &mt->mt_uri_mutex );
 546
 547         mt->mt_idassert_mode = LDAP_BACK_IDASSERT_LEGACY;
 548         mt->mt_idassert_authmethod = LDAP_AUTH_NONE;
 549         mt->mt_idassert_tls = SB_TLS_DEFAULT;
 550
 551         /* by default, use proxyAuthz control on each operation */
 552         mt->mt_idassert_flags = LDAP_BACK_AUTH_PRESCRIPTIVE;
 553
 554         *mtp = mt;
 555
 556         return 0;
 557 }
 558
 559 /* Validation for suffixmassage_config */
 560 static int
 561 meta_suffixm_config(
 562         ConfigArgs *c,
 563         metatarget_t *mt
 564 )
 565 {
 566         BackendDB       *tmp_bd;
 567         struct berval   dn, nvnc, pvnc, nrnc, prnc;
 568         int j, rc;
 569
 570         /*
 571          * syntax:
 572          *
 573          *      suffixmassage <suffix> <massaged suffix>
 574          *
 575          * the <suffix> field must be defined as a valid suffix
 576          * (or suffixAlias?) for the current database;
 577          * the <massaged suffix> shouldn't have already been
 578          * defined as a valid suffix or suffixAlias for the
 579          * current server
 580          */
 581
 582         ber_str2bv( c->argv[ 1 ], 0, 0, &dn );
 583         if ( dnPrettyNormal( NULL, &dn, &pvnc, &nvnc, NULL ) != LDAP_SUCCESS ) {
 584                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
 585                         "suffix \"%s\" is invalid",
 586                         c->argv[1] );
 587                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
 588                 return 1;
 589         }
 590
 591         for ( j = 0; !BER_BVISNULL( &c->be->be_nsuffix[ j ] ); j++ ) {
 592                 if ( dnIsSuffix( &nvnc, &c->be->be_nsuffix[ 0 ] ) ) {
 593                         break;
 594                 }
 595         }
 596
 597         if ( BER_BVISNULL( &c->be->be_nsuffix[ j ] ) ) {
 598                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
 599                         "suffix \"%s\" must be within the database naming context",
 600                         c->argv[1] );
 601                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
 602                 free( pvnc.bv_val );
 603                 free( nvnc.bv_val );
 604                 return 1;
 605         }
 606
 607         ber_str2bv( c->argv[ 2 ], 0, 0, &dn );
 608         if ( dnPrettyNormal( NULL, &dn, &prnc, &nrnc, NULL ) != LDAP_SUCCESS ) {
 609                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
 610                         "massaged suffix \"%s\" is invalid",
 611                         c->argv[2] );
 612                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
 613                 free( pvnc.bv_val );
 614                 free( nvnc.bv_val );
 615                 return 1;
 616         }
 617
 618         tmp_bd = select_backend( &nrnc, 0 );
 619         if ( tmp_bd != NULL && tmp_bd->be_private == c->be->be_private ) {
 620                 Debug( LDAP_DEBUG_ANY,
 621         "%s: warning: <massaged suffix> \"%s\" resolves to this database, in "
 622         "\"suffixMassage <suffix> <massaged suffix>\"\n",
 623                         c->log, prnc.bv_val, 0 );
 624         }
 625
 626         /*
 627          * The suffix massaging is emulated by means of the
 628          * rewrite capabilities
 629          */
 630         rc = suffix_massage_config( mt->mt_rwmap.rwm_rw,
 631                         &pvnc, &nvnc, &prnc, &nrnc );
 632
 633         free( pvnc.bv_val );
 634         free( nvnc.bv_val );
 635         free( prnc.bv_val );
 636         free( nrnc.bv_val );
 637
 638         return rc;
 639 }
 640
 641 static int
 642 slap_bv_x_ordered_unparse( BerVarray in, BerVarray *out )
 643 {
 644         int             i;
 645         BerVarray       bva = NULL;
 646         char            ibuf[32], *ptr;
 647         struct berval   idx;
 648
 649         assert( in != NULL );
 650
 651         for ( i = 0; !BER_BVISNULL( &in[i] ); i++ )
 652                 /* count'em */ ;
 653
 654         if ( i == 0 ) {
 655                 return 1;
 656         }
 657
 658         idx.bv_val = ibuf;
 659
 660         bva = ch_malloc( ( i + 1 ) * sizeof(struct berval) );
 661         BER_BVZERO( &bva[ 0 ] );
 662
 663         for ( i = 0; !BER_BVISNULL( &in[i] ); i++ ) {
 664                 idx.bv_len = snprintf( idx.bv_val, sizeof( ibuf ), SLAP_X_ORDERED_FMT, i );
 665                 if ( idx.bv_len >= sizeof( ibuf ) ) {
 666                         ber_bvarray_free( bva );
 667                         return 1;
 668                 }
 669
 670                 bva[i].bv_len = idx.bv_len + in[i].bv_len;
 671                 bva[i].bv_val = ch_malloc( bva[i].bv_len + 1 );
 672                 ptr = lutil_strcopy( bva[i].bv_val, ibuf );
 673                 ptr = lutil_strcopy( ptr, in[i].bv_val );
 674                 *ptr = '\0';
 675                 BER_BVZERO( &bva[ i + 1 ] );
 676         }
 677
 678         *out = bva;
 679         return 0;
 680 }
 681
 682 int
 683 meta_subtree_destroy( metasubtree_t *ms )
 684 {
 685         if ( ms->ms_next ) {
 686                 meta_subtree_destroy( ms->ms_next );
 687         }
 688
 689         switch ( ms->ms_type ) {
 690         case META_ST_SUBTREE:
 691         case META_ST_SUBORDINATE:
 692                 ber_memfree( ms->ms_dn.bv_val );
 693                 break;
 694
 695         case META_ST_REGEX:
 696                 regfree( &ms->ms_regex );
 697                 ber_memfree( ms->ms_regex_pattern.bv_val );
 698                 break;
 699
 700         default:
 701                 return -1;
 702         }
 703
 704         ch_free( ms );
 705
 706         return 0;
 707 }
 708
 709 static struct berval st_styles[] = {
 710         BER_BVC("subtree"),
 711         BER_BVC("children"),
 712         BER_BVC("regex")
 713 };
 714
 715 static int
 716 meta_subtree_unparse(
 717         ConfigArgs *c,
 718         metatarget_t *mt )
 719 {
 720         metasubtree_t   *ms;
 721         struct berval bv, *style;
 722
 723         if ( !mt->mt_subtree )
 724                 return 1;
 725
 726         /* can only be one of exclude or include */
 727         if (( c->type == LDAP_BACK_CFG_SUBTREE_EX ) ^ mt->mt_subtree_exclude )
 728                 return 1;
 729
 730         bv.bv_val = c->cr_msg;
 731         for ( ms=mt->mt_subtree; ms; ms=ms->ms_next ) {
 732                 if (ms->ms_type == META_ST_SUBTREE)
 733                         style = &st_styles[0];
 734                 else if ( ms->ms_type == META_ST_SUBORDINATE )
 735                         style = &st_styles[1];
 736                 else if ( ms->ms_type == META_ST_REGEX )
 737                         style = &st_styles[2];
 738                 else {
 739                         assert(0);
 740                         continue;
 741                 }
 742                 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg),
 743                         "dn.%s:%s", style->bv_val, ms->ms_dn.bv_val );
 744                 value_add_one( &c->rvalue_vals, &bv );
 745         }
 746         return 0;
 747 }
 748
 749 static int
 750 meta_subtree_config(
 751         metatarget_t *mt,
 752         ConfigArgs *c )
 753 {
 754         meta_st_t       type = META_ST_SUBTREE;
 755         char            *pattern;
 756         struct berval   ndn = BER_BVNULL;
 757         metasubtree_t   *ms = NULL;
 758
 759         if ( c->type == LDAP_BACK_CFG_SUBTREE_EX ) {
 760                 if ( mt->mt_subtree && !mt->mt_subtree_exclude ) {
 761                         snprintf( c->cr_msg, sizeof(c->cr_msg),
 762                                 "\"subtree-exclude\" incompatible with previous \"subtree-include\" directives" );
 763                         return 1;
 764                 }
 765
 766                 mt->mt_subtree_exclude = 1;
 767
 768         } else {
 769                 if ( mt->mt_subtree && mt->mt_subtree_exclude ) {
 770                         snprintf( c->cr_msg, sizeof(c->cr_msg),
 771                                 "\"subtree-include\" incompatible with previous \"subtree-exclude\" directives" );
 772                         return 1;
 773                 }
 774         }
 775
 776         pattern = c->argv[1];
 777         if ( strncasecmp( pattern, "dn", STRLENOF( "dn" ) ) == 0 ) {
 778                 char *style;
 779
 780                 pattern = &pattern[STRLENOF( "dn")];
 781
 782                 if ( pattern[0] == '.' ) {
 783                         style = &pattern[1];
 784
 785                         if ( strncasecmp( style, "subtree", STRLENOF( "subtree" ) ) == 0 ) {
 786                                 type = META_ST_SUBTREE;
 787                                 pattern = &style[STRLENOF( "subtree" )];
 788
 789                         } else if ( strncasecmp( style, "children", STRLENOF( "children" ) ) == 0 ) {
 790                                 type = META_ST_SUBORDINATE;
 791                                 pattern = &style[STRLENOF( "children" )];
 792
 793                         } else if ( strncasecmp( style, "sub", STRLENOF( "sub" ) ) == 0 ) {
 794                                 type = META_ST_SUBTREE;
 795                                 pattern = &style[STRLENOF( "sub" )];
 796
 797                         } else if ( strncasecmp( style, "regex", STRLENOF( "regex" ) ) == 0 ) {
 798                                 type = META_ST_REGEX;
 799                                 pattern = &style[STRLENOF( "regex" )];
 800
 801                         } else {
 802                                 snprintf( c->cr_msg, sizeof(c->cr_msg), "unknown style in \"dn.<style>\"" );
 803                                 return 1;
 804                         }
 805                 }
 806
 807                 if ( pattern[0] != ':' ) {
 808                         snprintf( c->cr_msg, sizeof(c->cr_msg), "missing colon after \"dn.<style>\"" );
 809                         return 1;
 810                 }
 811                 pattern++;
 812         }
 813
 814         switch ( type ) {
 815         case META_ST_SUBTREE:
 816         case META_ST_SUBORDINATE: {
 817                 struct berval dn;
 818
 819                 ber_str2bv( pattern, 0, 0, &dn );
 820                 if ( dnNormalize( 0, NULL, NULL, &dn, &ndn, NULL )
 821                         != LDAP_SUCCESS )
 822                 {
 823                         snprintf( c->cr_msg, sizeof(c->cr_msg), "DN=\"%s\" is invalid", pattern );
 824                         return 1;
 825                 }
 826
 827                 if ( !dnIsSuffix( &ndn, &mt->mt_nsuffix ) ) {
 828                         snprintf( c->cr_msg, sizeof(c->cr_msg),
 829                                 "DN=\"%s\" is not a subtree of target \"%s\"",
 830                                 pattern, mt->mt_nsuffix.bv_val );
 831                         ber_memfree( ndn.bv_val );
 832                         return( 1 );
 833                 }
 834                 } break;
 835
 836         default:
 837                 /* silence warnings */
 838                 break;
 839         }
 840
 841         ms = ch_calloc( sizeof( metasubtree_t ), 1 );
 842         ms->ms_type = type;
 843
 844         switch ( ms->ms_type ) {
 845         case META_ST_SUBTREE:
 846         case META_ST_SUBORDINATE:
 847                 ms->ms_dn = ndn;
 848                 break;
 849
 850         case META_ST_REGEX: {
 851                 int rc;
 852
 853                 rc = regcomp( &ms->ms_regex, pattern, REG_EXTENDED|REG_ICASE );
 854                 if ( rc != 0 ) {
 855                         char regerr[ SLAP_TEXT_BUFLEN ];
 856
 857                         regerror( rc, &ms->ms_regex, regerr, sizeof(regerr) );
 858
 859                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
 860                                 "regular expression \"%s\" bad because of %s",
 861                                 pattern, regerr );
 862                         ch_free( ms );
 863                         return 1;
 864                 }
 865                 ber_str2bv( pattern, 0, 1, &ms->ms_regex_pattern );
 866                 } break;
 867         }
 868
 869         if ( mt->mt_subtree == NULL ) {
 870                  mt->mt_subtree = ms;
 871
 872         } else {
 873                 metasubtree_t **msp;
 874
 875                 for ( msp = &mt->mt_subtree; *msp; ) {
 876                         switch ( ms->ms_type ) {
 877                         case META_ST_SUBTREE:
 878                                 switch ( (*msp)->ms_type ) {
 879                                 case META_ST_SUBTREE:
 880                                         if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
 881                                                 metasubtree_t *tmp = *msp;
 882                                                 Debug( LDAP_DEBUG_CONFIG,
 883                                                         "%s: previous rule \"dn.subtree:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
 884                                                         c->log, pattern, (*msp)->ms_dn.bv_val );
 885                                                 *msp = (*msp)->ms_next;
 886                                                 tmp->ms_next = NULL;
 887                                                 meta_subtree_destroy( tmp );
 888                                                 continue;
 889
 890                                         } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) ) {
 891                                                 Debug( LDAP_DEBUG_CONFIG,
 892                                                         "%s: previous rule \"dn.subtree:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
 893                                                         c->log, (*msp)->ms_dn.bv_val, pattern );
 894                                                 meta_subtree_destroy( ms );
 895                                                 ms = NULL;
 896                                                 return( 0 );
 897                                         }
 898                                         break;
 899
 900                                 case META_ST_SUBORDINATE:
 901                                         if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
 902                                                 metasubtree_t *tmp = *msp;
 903                                                 Debug( LDAP_DEBUG_CONFIG,
 904                                                         "%s: previous rule \"dn.children:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
 905                                                         c->log, pattern, (*msp)->ms_dn.bv_val );
 906                                                 *msp = (*msp)->ms_next;
 907                                                 tmp->ms_next = NULL;
 908                                                 meta_subtree_destroy( tmp );
 909                                                 continue;
 910
 911                                         } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) && ms->ms_dn.bv_len > (*msp)->ms_dn.bv_len ) {
 912                                                 Debug( LDAP_DEBUG_CONFIG,
 913                                                         "%s: previous rule \"dn.children:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
 914                                                         c->log, (*msp)->ms_dn.bv_val, pattern );
 915                                                 meta_subtree_destroy( ms );
 916                                                 ms = NULL;
 917                                                 return( 0 );
 918                                         }
 919                                         break;
 920
 921                                 case META_ST_REGEX:
 922                                         if ( regexec( &(*msp)->ms_regex, ms->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
 923                                                 Debug( LDAP_DEBUG_CONFIG,
 924                                                         "%s: previous rule \"dn.regex:%s\" may contain rule \"dn.subtree:%s\"\n",
 925                                                         c->log, (*msp)->ms_regex_pattern.bv_val, ms->ms_dn.bv_val );
 926                                         }
 927                                         break;
 928                                 }
 929                                 break;
 930
 931                         case META_ST_SUBORDINATE:
 932                                 switch ( (*msp)->ms_type ) {
 933                                 case META_ST_SUBTREE:
 934                                         if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
 935                                                 metasubtree_t *tmp = *msp;
 936                                                 Debug( LDAP_DEBUG_CONFIG,
 937                                                         "%s: previous rule \"dn.children:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
 938                                                         c->log, pattern, (*msp)->ms_dn.bv_val );
 939                                                 *msp = (*msp)->ms_next;
 940                                                 tmp->ms_next = NULL;
 941                                                 meta_subtree_destroy( tmp );
 942                                                 continue;
 943
 944                                         } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) && ms->ms_dn.bv_len > (*msp)->ms_dn.bv_len ) {
 945                                                 Debug( LDAP_DEBUG_CONFIG,
 946                                                         "%s: previous rule \"dn.children:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
 947                                                         c->log, (*msp)->ms_dn.bv_val, pattern );
 948                                                 meta_subtree_destroy( ms );
 949                                                 ms = NULL;
 950                                                 return( 0 );
 951                                         }
 952                                         break;
 953
 954                                 case META_ST_SUBORDINATE:
 955                                         if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
 956                                                 metasubtree_t *tmp = *msp;
 957                                                 Debug( LDAP_DEBUG_CONFIG,
 958                                                         "%s: previous rule \"dn.children:%s\" is contained in rule \"dn.children:%s\" (replaced)\n",
 959                                                         c->log, pattern, (*msp)->ms_dn.bv_val );
 960                                                 *msp = (*msp)->ms_next;
 961                                                 tmp->ms_next = NULL;
 962                                                 meta_subtree_destroy( tmp );
 963                                                 continue;
 964
 965                                         } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) ) {
 966                                                 Debug( LDAP_DEBUG_CONFIG,
 967                                                         "%s: previous rule \"dn.children:%s\" contains rule \"dn.children:%s\" (ignored)\n",
 968                                                         c->log, (*msp)->ms_dn.bv_val, pattern );
 969                                                 meta_subtree_destroy( ms );
 970                                                 ms = NULL;
 971                                                 return( 0 );
 972                                         }
 973                                         break;
 974
 975                                 case META_ST_REGEX:
 976                                         if ( regexec( &(*msp)->ms_regex, ms->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
 977                                                 Debug( LDAP_DEBUG_CONFIG,
 978                                                         "%s: previous rule \"dn.regex:%s\" may contain rule \"dn.subtree:%s\"\n",
 979                                                         c->log, (*msp)->ms_regex_pattern.bv_val, ms->ms_dn.bv_val );
 980                                         }
 981                                         break;
 982                                 }
 983                                 break;
 984
 985                         case META_ST_REGEX:
 986                                 switch ( (*msp)->ms_type ) {
 987                                 case META_ST_SUBTREE:
 988                                 case META_ST_SUBORDINATE:
 989                                         if ( regexec( &ms->ms_regex, (*msp)->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
 990                                                 Debug( LDAP_DEBUG_CONFIG,
 991                                                         "%s: previous rule \"dn.subtree:%s\" may be contained in rule \"dn.regex:%s\"\n",
 992                                                         c->log, (*msp)->ms_dn.bv_val, ms->ms_regex_pattern.bv_val );
 993                                         }
 994                                         break;
 995
 996                                 case META_ST_REGEX:
 997                                         /* no check possible */
 998                                         break;
 999                                 }
1000                                 break;
1001                         }
1002
1003                         msp = &(*msp)->ms_next;
1004                 }
1005
1006                 *msp = ms;
1007         }
1008
1009         return 0;
1010 }
1011
1012 static slap_verbmasks idassert_mode[] = {
1013         { BER_BVC("self"),              LDAP_BACK_IDASSERT_SELF },
1014         { BER_BVC("anonymous"),         LDAP_BACK_IDASSERT_ANONYMOUS },
1015         { BER_BVC("none"),              LDAP_BACK_IDASSERT_NOASSERT },
1016         { BER_BVC("legacy"),            LDAP_BACK_IDASSERT_LEGACY },
1017         { BER_BVNULL,                   0 }
1018 };
1019
1020 static slap_verbmasks tls_mode[] = {
1021         { BER_BVC( "propagate" ),       LDAP_BACK_F_TLS_PROPAGATE_MASK },
1022         { BER_BVC( "try-propagate" ),   LDAP_BACK_F_PROPAGATE_TLS },
1023         { BER_BVC( "start" ),           LDAP_BACK_F_TLS_USE_MASK },
1024         { BER_BVC( "try-start" ),       LDAP_BACK_F_USE_TLS },
1025         { BER_BVC( "ldaps" ),           LDAP_BACK_F_TLS_LDAPS },
1026         { BER_BVC( "none" ),            LDAP_BACK_F_NONE },
1027         { BER_BVNULL,                   0 }
1028 };
1029
1030 static slap_verbmasks t_f_mode[] = {
1031         { BER_BVC( "yes" ),             LDAP_BACK_F_T_F },
1032         { BER_BVC( "discover" ),        LDAP_BACK_F_T_F_DISCOVER },
1033         { BER_BVC( "no" ),              LDAP_BACK_F_NONE },
1034         { BER_BVNULL,                   0 }
1035 };
1036
1037 static slap_verbmasks cancel_mode[] = {
1038         { BER_BVC( "ignore" ),          LDAP_BACK_F_CANCEL_IGNORE },
1039         { BER_BVC( "exop" ),            LDAP_BACK_F_CANCEL_EXOP },
1040         { BER_BVC( "exop-discover" ),   LDAP_BACK_F_CANCEL_EXOP_DISCOVER },
1041         { BER_BVC( "abandon" ),         LDAP_BACK_F_CANCEL_ABANDON },
1042         { BER_BVNULL,                   0 }
1043 };
1044
1045 static slap_verbmasks onerr_mode[] = {
1046         { BER_BVC( "stop" ),            META_BACK_F_ONERR_STOP },
1047         { BER_BVC( "report" ),  META_BACK_F_ONERR_REPORT },
1048         { BER_BVC( "continue" ),                LDAP_BACK_F_NONE },
1049         { BER_BVNULL,                   0 }
1050 };
1051
1052 /* see enum in slap.h */
1053 static slap_cf_aux_table timeout_table[] = {
1054         { BER_BVC("bind="),     SLAP_OP_BIND * sizeof( time_t ),        'u', 0, NULL },
1055         /* unbind makes no sense */
1056         { BER_BVC("add="),      SLAP_OP_ADD * sizeof( time_t ),         'u', 0, NULL },
1057         { BER_BVC("delete="),   SLAP_OP_DELETE * sizeof( time_t ),      'u', 0, NULL },
1058         { BER_BVC("modrdn="),   SLAP_OP_MODRDN * sizeof( time_t ),      'u', 0, NULL },
1059         { BER_BVC("modify="),   SLAP_OP_MODIFY * sizeof( time_t ),      'u', 0, NULL },
1060         { BER_BVC("compare="),  SLAP_OP_COMPARE * sizeof( time_t ),     'u', 0, NULL },
1061         { BER_BVC("search="),   SLAP_OP_SEARCH * sizeof( time_t ),      'u', 0, NULL },
1062         /* abandon makes little sense */
1063 #if 0   /* not implemented yet */
1064         { BER_BVC("extended="), SLAP_OP_EXTENDED * sizeof( time_t ),    'u', 0, NULL },
1065 #endif
1066         { BER_BVNULL, 0, 0, 0, NULL }
1067 };
1068
1069 static int
1070 meta_back_cf_gen( ConfigArgs *c )
1071 {
1072         metainfo_t      *mi = ( metainfo_t * )c->be->be_private;
1073         metatarget_t    *mt;
1074         metacommon_t    *mc;
1075
1076         int i, rc = 0;
1077
1078         assert( mi != NULL );
1079
1080         if ( c->op == SLAP_CONFIG_EMIT ) {
1081                 struct berval bv = BER_BVNULL;
1082
1083                 if ( !mi )
1084                         return 1;
1085
1086                 if ( c->table == Cft_Database ) {
1087                         mt = NULL;
1088                         mc = &mi->mi_mc;
1089                 } else {
1090                         mt = c->ca_private;
1091                         mc = &mt->mt_mc;
1092                 }
1093
1094                 switch( c->type ) {
1095                 /* Base attrs */
1096                 case LDAP_BACK_CFG_CONN_TTL:
1097                         if ( mi->mi_conn_ttl == 0 ) {
1098                                 return 1;
1099                         } else {
1100                                 char    buf[ SLAP_TEXT_BUFLEN ];
1101
1102                                 lutil_unparse_time( buf, sizeof( buf ), mi->mi_conn_ttl );
1103                                 ber_str2bv( buf, 0, 0, &bv );
1104                                 value_add_one( &c->rvalue_vals, &bv );
1105                         }
1106                         break;
1107
1108                 case LDAP_BACK_CFG_DNCACHE_TTL:
1109                         if ( mi->mi_cache.ttl == META_DNCACHE_DISABLED ) {
1110                                 return 1;
1111                         } else if ( mi->mi_cache.ttl == META_DNCACHE_FOREVER ) {
1112                                 BER_BVSTR( &bv, "forever" );
1113                         } else {
1114                                 char    buf[ SLAP_TEXT_BUFLEN ];
1115
1116                                 lutil_unparse_time( buf, sizeof( buf ), mi->mi_cache.ttl );
1117                                 ber_str2bv( buf, 0, 0, &bv );
1118                         }
1119                         value_add_one( &c->rvalue_vals, &bv );
1120                         break;
1121
1122                 case LDAP_BACK_CFG_IDLE_TIMEOUT:
1123                         if ( mi->mi_idle_timeout == 0 ) {
1124                                 return 1;
1125                         } else {
1126                                 char    buf[ SLAP_TEXT_BUFLEN ];
1127
1128                                 lutil_unparse_time( buf, sizeof( buf ), mi->mi_idle_timeout );
1129                                 ber_str2bv( buf, 0, 0, &bv );
1130                                 value_add_one( &c->rvalue_vals, &bv );
1131                         }
1132                         break;
1133
1134                 case LDAP_BACK_CFG_ONERR:
1135                         enum_to_verb( onerr_mode, mi->mi_flags & META_BACK_F_ONERR_MASK, &bv );
1136                         if ( BER_BVISNULL( &bv )) {
1137                                 rc = 1;
1138                         } else {
1139                                 value_add_one( &c->rvalue_vals, &bv );
1140                         }
1141                         break;
1142
1143                 case LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER:
1144                         c->value_int = META_BACK_DEFER_ROOTDN_BIND( mi );
1145                         break;
1146
1147                 case LDAP_BACK_CFG_SINGLECONN:
1148                         c->value_int = LDAP_BACK_SINGLECONN( mi );
1149                         break;
1150
1151                 case LDAP_BACK_CFG_USETEMP:
1152                         c->value_int = LDAP_BACK_USE_TEMPORARIES( mi );
1153                         break;
1154
1155                 case LDAP_BACK_CFG_CONNPOOLMAX:
1156                         c->value_int = mi->mi_conn_priv_max;
1157                         break;
1158
1159                 /* common attrs */
1160                 case LDAP_BACK_CFG_BIND_TIMEOUT:
1161                         if ( mc->mc_bind_timeout.tv_sec == 0 &&
1162                                 mc->mc_bind_timeout.tv_usec == 0 ) {
1163                                 return 1;
1164                         } else {
1165                                 c->value_ulong = mc->mc_bind_timeout.tv_sec * 1000000UL +
1166                                         mc->mc_bind_timeout.tv_usec;
1167                         }
1168                         break;
1169
1170                 case LDAP_BACK_CFG_CANCEL: {
1171                         slap_mask_t     mask = LDAP_BACK_F_CANCEL_MASK2;
1172
1173                         if ( mt && META_BACK_TGT_CANCEL_DISCOVER( mt ) ) {
1174                                 mask &= ~LDAP_BACK_F_CANCEL_EXOP;
1175                         }
1176                         enum_to_verb( cancel_mode, (mc->mc_flags & mask), &bv );
1177                         if ( BER_BVISNULL( &bv ) ) {
1178                                 /* there's something wrong... */
1179                                 assert( 0 );
1180                                 rc = 1;
1181
1182                         } else {
1183                                 value_add_one( &c->rvalue_vals, &bv );
1184                         }
1185                         } break;
1186
1187                 case LDAP_BACK_CFG_CHASE:
1188                         c->value_int = META_BACK_CMN_CHASE_REFERRALS(mc);
1189                         break;
1190
1191 #ifdef SLAPD_META_CLIENT_PR
1192                 case LDAP_BACK_CFG_CLIENT_PR:
1193                         if ( mc->mc_ps == META_CLIENT_PR_DISABLE ) {
1194                                 return 1;
1195                         } else if ( mc->mc_ps == META_CLIENT_PR_ACCEPT_UNSOLICITED ) {
1196                                 BER_BVSTR( &bv, "accept-unsolicited" );
1197                         } else {
1198                                 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d", mc->mc_ps );
1199                                 bv.bv_val = c->cr_msg;
1200                         }
1201                         value_add_one( &c->rvalue_vals, &bv );
1202                         break;
1203 #endif /* SLAPD_META_CLIENT_PR */
1204
1205                 case LDAP_BACK_CFG_DEFAULT_T:
1206                         if ( mt || mi->mi_defaulttarget == META_DEFAULT_TARGET_NONE )
1207                                 return 1;
1208                         bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d", mi->mi_defaulttarget );
1209                         bv.bv_val = c->cr_msg;
1210                         value_add_one( &c->rvalue_vals, &bv );
1211                         break;
1212
1213                 case LDAP_BACK_CFG_NETWORK_TIMEOUT:
1214                         if ( mc->mc_network_timeout == 0 ) {
1215                                 return 1;
1216                         }
1217                         bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%ld",
1218                                 mc->mc_network_timeout );
1219                         bv.bv_val = c->cr_msg;
1220                         value_add_one( &c->rvalue_vals, &bv );
1221                         break;
1222
1223                 case LDAP_BACK_CFG_NOREFS:
1224                         c->value_int = META_BACK_CMN_NOREFS(mc);
1225                         break;
1226
1227                 case LDAP_BACK_CFG_NOUNDEFFILTER:
1228                         c->value_int = META_BACK_CMN_NOUNDEFFILTER(mc);
1229                         break;
1230
1231                 case LDAP_BACK_CFG_NRETRIES:
1232                         if ( mc->mc_nretries == META_RETRY_FOREVER ) {
1233                                 BER_BVSTR( &bv, "forever" );
1234                         } else if ( mc->mc_nretries == META_RETRY_NEVER ) {
1235                                 BER_BVSTR( &bv, "never" );
1236                         } else {
1237                                 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d",
1238                                         mc->mc_nretries );
1239                                 bv.bv_val = c->cr_msg;
1240                         }
1241                         value_add_one( &c->rvalue_vals, &bv );
1242                         break;
1243
1244                 case LDAP_BACK_CFG_QUARANTINE:
1245                         if ( !META_BACK_CMN_QUARANTINE( mc )) {
1246                                 rc = 1;
1247                                 break;
1248                         }
1249                         rc = mi->mi_ldap_extra->retry_info_unparse( &mc->mc_quarantine, &bv );
1250                         if ( rc == 0 ) {
1251                                 ber_bvarray_add( &c->rvalue_vals, &bv );
1252                         }
1253                         break;
1254
1255                 case LDAP_BACK_CFG_REBIND:
1256                         c->value_int = META_BACK_CMN_SAVECRED(mc);
1257                         break;
1258
1259                 case LDAP_BACK_CFG_TIMEOUT:
1260                         for ( i = 0; i < SLAP_OP_LAST; i++ ) {
1261                                 if ( mc->mc_timeout[ i ] != 0 ) {
1262                                         break;
1263                                 }
1264                         }
1265
1266                         if ( i == SLAP_OP_LAST ) {
1267                                 return 1;
1268                         }
1269
1270                         BER_BVZERO( &bv );
1271                         slap_cf_aux_table_unparse( mc->mc_timeout, &bv, timeout_table );
1272
1273                         if ( BER_BVISNULL( &bv ) ) {
1274                                 return 1;
1275                         }
1276
1277                         for ( i = 0; isspace( (unsigned char) bv.bv_val[ i ] ); i++ )
1278                                 /* count spaces */ ;
1279
1280                         if ( i ) {
1281                                 bv.bv_len -= i;
1282                                 AC_MEMCPY( bv.bv_val, &bv.bv_val[ i ],
1283                                         bv.bv_len + 1 );
1284                         }
1285
1286                         ber_bvarray_add( &c->rvalue_vals, &bv );
1287                         break;
1288
1289                 case LDAP_BACK_CFG_VERSION:
1290                         if ( mc->mc_version == 0 )
1291                                 return 1;
1292                         c->value_int = mc->mc_version;
1293                         break;
1294
1295 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
1296                 case LDAP_BACK_CFG_ST_REQUEST:
1297                         c->value_int = META_BACK_CMN_ST_REQUEST( mc );
1298                         break;
1299 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
1300
1301                 case LDAP_BACK_CFG_T_F:
1302                         enum_to_verb( t_f_mode, (mc->mc_flags & LDAP_BACK_F_T_F_MASK2), &bv );
1303                         if ( BER_BVISNULL( &bv ) ) {
1304                                 /* there's something wrong... */
1305                                 assert( 0 );
1306                                 rc = 1;
1307
1308                         } else {
1309                                 value_add_one( &c->rvalue_vals, &bv );
1310                         }
1311                         break;
1312
1313                 case LDAP_BACK_CFG_TLS: {
1314                         struct berval bc = BER_BVNULL, bv2;
1315
1316                         if (( mc->mc_flags & LDAP_BACK_F_TLS_MASK ) == LDAP_BACK_F_NONE ) {
1317                                 rc = 1;
1318                                 break;
1319                         }
1320                         enum_to_verb( tls_mode, ( mc->mc_flags & LDAP_BACK_F_TLS_MASK ), &bv );
1321                         assert( !BER_BVISNULL( &bv ) );
1322
1323                         if ( mt ) {
1324                                 bindconf_tls_unparse( &mt->mt_tls, &bc );
1325                         }
1326
1327                         if ( !BER_BVISEMPTY( &bc )) {
1328                                 bv2.bv_len = bv.bv_len + bc.bv_len + 1;
1329                                 bv2.bv_val = ch_malloc( bv2.bv_len + 1 );
1330                                 strcpy( bv2.bv_val, bv.bv_val );
1331                                 bv2.bv_val[bv.bv_len] = ' ';
1332                                 strcpy( &bv2.bv_val[bv.bv_len + 1], bc.bv_val );
1333                                 ber_memfree( bc.bv_val );
1334                                 ber_bvarray_add( &c->rvalue_vals, &bv2 );
1335                         } else {
1336                                 value_add_one( &c->rvalue_vals, &bv );
1337                         }
1338                         } break;
1339
1340                 /* target attrs */
1341                 case LDAP_BACK_CFG_URI: {
1342                         char *p2, *p1 = strchr( mt->mt_uri, ' ' );
1343                         bv.bv_len = strlen( mt->mt_uri ) + 1 + mt->mt_psuffix.bv_len;
1344                         bv.bv_val = ch_malloc( bv.bv_len + 1 );
1345                         if ( p1 ) {
1346                                 p2 = lutil_strncopy( bv.bv_val, mt->mt_uri, p1 - mt->mt_uri );
1347                         } else {
1348                                 p2 = lutil_strcopy( bv.bv_val, mt->mt_uri );
1349                         }
1350                         *p2++ = '/';
1351                         p2 = lutil_strcopy( p2, mt->mt_psuffix.bv_val );
1352                         if ( p1 ) {
1353                                 strcpy( p2, p1 );
1354                         }
1355                         value_add_one( &c->rvalue_vals, &bv );
1356                         } break;
1357
1358                 case LDAP_BACK_CFG_ACL_AUTHCDN:
1359                 case LDAP_BACK_CFG_ACL_PASSWD:
1360                         /* FIXME no point here, there is no code implementing
1361                          * their features. Was this supposed to implement
1362                          * acl-bind like back-ldap?
1363                          */
1364                         rc = 1;
1365                         break;
1366
1367                 case LDAP_BACK_CFG_IDASSERT_AUTHZFROM: {
1368                         BerVarray       *bvp;
1369                         int             i;
1370                         struct berval   bv = BER_BVNULL;
1371                         char            buf[SLAP_TEXT_BUFLEN];
1372
1373                         bvp = &mt->mt_idassert_authz;
1374                         if ( *bvp == NULL ) {
1375                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_AUTHZ_ALL )
1376                                 {
1377                                         BER_BVSTR( &bv, "*" );
1378                                         value_add_one( &c->rvalue_vals, &bv );
1379
1380                                 } else {
1381                                         rc = 1;
1382                                 }
1383                                 break;
1384                         }
1385
1386                         for ( i = 0; !BER_BVISNULL( &((*bvp)[ i ]) ); i++ ) {
1387                                 char *ptr;
1388                                 int len = snprintf( buf, sizeof( buf ), SLAP_X_ORDERED_FMT, i );
1389                                 bv.bv_len = ((*bvp)[ i ]).bv_len + len;
1390                                 bv.bv_val = ber_memrealloc( bv.bv_val, bv.bv_len + 1 );
1391                                 ptr = bv.bv_val;
1392                                 ptr = lutil_strcopy( ptr, buf );
1393                                 ptr = lutil_strncopy( ptr, ((*bvp)[ i ]).bv_val, ((*bvp)[ i ]).bv_len );
1394                                 value_add_one( &c->rvalue_vals, &bv );
1395                         }
1396                         if ( bv.bv_val ) {
1397                                 ber_memfree( bv.bv_val );
1398                         }
1399                         break;
1400                 }
1401
1402                 case LDAP_BACK_CFG_IDASSERT_BIND: {
1403                         int             i;
1404                         struct berval   bc = BER_BVNULL;
1405                         char            *ptr;
1406
1407                         if ( mt->mt_idassert_authmethod == LDAP_AUTH_NONE ) {
1408                                 return 1;
1409                         } else {
1410                                 ber_len_t       len;
1411
1412                                 switch ( mt->mt_idassert_mode ) {
1413                                 case LDAP_BACK_IDASSERT_OTHERID:
1414                                 case LDAP_BACK_IDASSERT_OTHERDN:
1415                                         break;
1416
1417                                 default: {
1418                                         struct berval   mode = BER_BVNULL;
1419
1420                                         enum_to_verb( idassert_mode, mt->mt_idassert_mode, &mode );
1421                                         if ( BER_BVISNULL( &mode ) ) {
1422                                                 /* there's something wrong... */
1423                                                 assert( 0 );
1424                                                 rc = 1;
1425
1426                                         } else {
1427                                                 bv.bv_len = STRLENOF( "mode=" ) + mode.bv_len;
1428                                                 bv.bv_val = ch_malloc( bv.bv_len + 1 );
1429
1430                                                 ptr = lutil_strcopy( bv.bv_val, "mode=" );
1431                                                 ptr = lutil_strcopy( ptr, mode.bv_val );
1432                                         }
1433                                         break;
1434                                 }
1435                                 }
1436
1437                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_NATIVE_AUTHZ ) {
1438                                         len = bv.bv_len + STRLENOF( "authz=native" );
1439
1440                                         if ( !BER_BVISEMPTY( &bv ) ) {
1441                                                 len += STRLENOF( " " );
1442                                         }
1443
1444                                         bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
1445
1446                                         ptr = &bv.bv_val[ bv.bv_len ];
1447
1448                                         if ( !BER_BVISEMPTY( &bv ) ) {
1449                                                 ptr = lutil_strcopy( ptr, " " );
1450                                         }
1451
1452                                         (void)lutil_strcopy( ptr, "authz=native" );
1453                                 }
1454
1455                                 len = bv.bv_len + STRLENOF( "flags=non-prescriptive,override,obsolete-encoding-workaround,proxy-authz-non-critical,dn-authzid" );
1456                                 /* flags */
1457                                 if ( !BER_BVISEMPTY( &bv ) ) {
1458                                         len += STRLENOF( " " );
1459                                 }
1460
1461                                 bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
1462
1463                                 ptr = &bv.bv_val[ bv.bv_len ];
1464
1465                                 if ( !BER_BVISEMPTY( &bv ) ) {
1466                                         ptr = lutil_strcopy( ptr, " " );
1467                                 }
1468
1469                                 ptr = lutil_strcopy( ptr, "flags=" );
1470
1471                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_PRESCRIPTIVE ) {
1472                                         ptr = lutil_strcopy( ptr, "prescriptive" );
1473                                 } else {
1474                                         ptr = lutil_strcopy( ptr, "non-prescriptive" );
1475                                 }
1476
1477                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OVERRIDE ) {
1478                                         ptr = lutil_strcopy( ptr, ",override" );
1479                                 }
1480
1481                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_PROXY_AUTHZ ) {
1482                                         ptr = lutil_strcopy( ptr, ",obsolete-proxy-authz" );
1483
1484                                 } else if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_ENCODING_WORKAROUND ) {
1485                                         ptr = lutil_strcopy( ptr, ",obsolete-encoding-workaround" );
1486                                 }
1487
1488                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_PROXYAUTHZ_CRITICAL ) {
1489                                         ptr = lutil_strcopy( ptr, ",proxy-authz-critical" );
1490
1491                                 } else {
1492                                         ptr = lutil_strcopy( ptr, ",proxy-authz-non-critical" );
1493                                 }
1494
1495                                 switch ( mt->mt_idassert_flags & LDAP_BACK_AUTH_DN_MASK ) {
1496                                 case LDAP_BACK_AUTH_DN_AUTHZID:
1497                                         ptr = lutil_strcopy( ptr, ",dn-authzid" );
1498                                         break;
1499
1500                                 case LDAP_BACK_AUTH_DN_WHOAMI:
1501                                         ptr = lutil_strcopy( ptr, ",dn-whoami" );
1502                                         break;
1503
1504                                 default:
1505 #if 0 /* implicit */
1506                                         ptr = lutil_strcopy( ptr, ",dn-none" );
1507 #endif
1508                                         break;
1509                                 }
1510
1511                                 bv.bv_len = ( ptr - bv.bv_val );
1512                                 /* end-of-flags */
1513                         }
1514
1515                         bindconf_unparse( &mt->mt_idassert.si_bc, &bc );
1516
1517                         if ( !BER_BVISNULL( &bv ) ) {
1518                                 ber_len_t       len = bv.bv_len + bc.bv_len;
1519
1520                                 bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
1521
1522                                 assert( bc.bv_val[ 0 ] == ' ' );
1523
1524                                 ptr = lutil_strcopy( &bv.bv_val[ bv.bv_len ], bc.bv_val );
1525                                 free( bc.bv_val );
1526                                 bv.bv_len = ptr - bv.bv_val;
1527
1528                         } else {
1529                                 for ( i = 0; isspace( (unsigned char) bc.bv_val[ i ] ); i++ )
1530                                         /* count spaces */ ;
1531
1532                                 if ( i ) {
1533                                         bc.bv_len -= i;
1534                                         AC_MEMCPY( bc.bv_val, &bc.bv_val[ i ], bc.bv_len + 1 );
1535                                 }
1536
1537                                 bv = bc;
1538                         }
1539
1540                         ber_bvarray_add( &c->rvalue_vals, &bv );
1541
1542                         break;
1543                 }
1544
1545                 case LDAP_BACK_CFG_SUFFIXM:     /* unused */
1546                 case LDAP_BACK_CFG_REWRITE:
1547                         if ( mt->mt_rwmap.rwm_bva_rewrite == NULL ) {
1548                                 rc = 1;
1549                         } else {
1550                                 rc = slap_bv_x_ordered_unparse( mt->mt_rwmap.rwm_bva_rewrite, &c->rvalue_vals );
1551                         }
1552                         break;
1553
1554                 case LDAP_BACK_CFG_MAP:
1555                         if ( mt->mt_rwmap.rwm_bva_map == NULL ) {
1556                                 rc = 1;
1557                         } else {
1558                                 rc = slap_bv_x_ordered_unparse( mt->mt_rwmap.rwm_bva_map, &c->rvalue_vals );
1559                         }
1560                         break;
1561
1562                 case LDAP_BACK_CFG_SUBTREE_EX:
1563                 case LDAP_BACK_CFG_SUBTREE_IN:
1564                         rc = meta_subtree_unparse( c, mt );
1565                         break;
1566
1567                 /* replaced by idassert */
1568                 case LDAP_BACK_CFG_PSEUDOROOTDN:
1569                 case LDAP_BACK_CFG_PSEUDOROOTPW:
1570                         rc = 1;
1571                         break;
1572
1573                 default:
1574                         rc = 1;
1575                 }
1576                 return rc;
1577         } else if ( c->op == LDAP_MOD_DELETE ) {
1578                 return 1;
1579         }
1580
1581         if ( c->op == SLAP_CONFIG_ADD ) {
1582                 if ( c->type >= LDAP_BACK_CFG_LAST_BASE ) {
1583                         /* exclude CFG_URI from this check */
1584                         if ( c->type > LDAP_BACK_CFG_LAST_BOTH ) {
1585                                 if ( !mi->mi_ntargets ) {
1586                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1587                                                 "need \"uri\" directive first" );
1588                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1589                                         return 1;
1590                                 }
1591                         }
1592                         if ( mi->mi_ntargets ) {
1593                                 mt = mi->mi_targets[ mi->mi_ntargets-1 ];
1594                                 mc = &mt->mt_mc;
1595                         } else {
1596                                 mt = NULL;
1597                                 mc = &mi->mi_mc;
1598                         }
1599                 }
1600         } else {
1601                 if ( c->table == Cft_Database ) {
1602                         mt = NULL;
1603                         mc = &mi->mi_mc;
1604                 } else {
1605                         mt = c->ca_private;
1606                         if ( mt )
1607                                 mc = &mt->mt_mc;
1608                         else
1609                                 mc = NULL;
1610                 }
1611         }
1612
1613         switch( c->type ) {
1614         case LDAP_BACK_CFG_URI: {
1615                 LDAPURLDesc     *ludp;
1616                 struct berval   dn;
1617                 int             j;
1618
1619                 char            **uris = NULL;
1620
1621                 if ( c->be->be_nsuffix == NULL ) {
1622                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1623                                 "the suffix must be defined before any target" );
1624                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1625                         return 1;
1626                 }
1627
1628                 i = mi->mi_ntargets++;
1629
1630                 mi->mi_targets = ( metatarget_t ** )ch_realloc( mi->mi_targets,
1631                         sizeof( metatarget_t * ) * mi->mi_ntargets );
1632                 if ( mi->mi_targets == NULL ) {
1633                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1634                                 "out of memory while storing server name"
1635                                 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1636                                 c->argv[0] );
1637                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1638                         return 1;
1639                 }
1640
1641                 if ( meta_back_new_target( &mi->mi_targets[ i ] ) != 0 ) {
1642                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1643                                 "unable to init server"
1644                                 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1645                                 c->argv[0] );
1646                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1647                         return 1;
1648                 }
1649
1650                 mt = mi->mi_targets[ i ];
1651
1652                 mt->mt_rebind_f = mi->mi_rebind_f;
1653                 mt->mt_urllist_f = mi->mi_urllist_f;
1654                 mt->mt_urllist_p = mt;
1655
1656                 if ( META_BACK_QUARANTINE( mi ) ) {
1657                         ldap_pvt_thread_mutex_init( &mt->mt_quarantine_mutex );
1658                 }
1659                 mt->mt_mc = mi->mi_mc;
1660
1661                 for ( j = 1; j < c->argc; j++ ) {
1662                         char    **tmpuris = ldap_str2charray( c->argv[ j ], "\t" );
1663
1664                         if ( tmpuris == NULL ) {
1665                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1666                                         "unable to parse URIs #%d"
1667                                         " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1668                                         j-1, c->argv[0] );
1669                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1670                                 return 1;
1671                         }
1672
1673                         if ( j == 0 ) {
1674                                 uris = tmpuris;
1675
1676                         } else {
1677                                 ldap_charray_merge( &uris, tmpuris );
1678                                 ldap_charray_free( tmpuris );
1679                         }
1680                 }
1681
1682                 for ( j = 0; uris[ j ] != NULL; j++ ) {
1683                         char *tmpuri = NULL;
1684
1685                         /*
1686                          * uri MUST be legal!
1687                          */
1688                         if ( ldap_url_parselist_ext( &ludp, uris[ j ], "\t",
1689                                         LDAP_PVT_URL_PARSE_NONE ) != LDAP_SUCCESS
1690                                 || ludp->lud_next != NULL )
1691                         {
1692                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1693                                         "unable to parse URI #%d"
1694                                         " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1695                                         j-1, c->argv[0] );
1696                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1697                                 ldap_charray_free( uris );
1698                                 return 1;
1699                         }
1700
1701                         if ( j == 0 ) {
1702
1703                                 /*
1704                                  * uri MUST have the <dn> part!
1705                                  */
1706                                 if ( ludp->lud_dn == NULL ) {
1707                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1708                                                 "missing <naming context> "
1709                                                 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1710                                                 c->argv[0] );
1711                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1712                                         ldap_free_urllist( ludp );
1713                                         ldap_charray_free( uris );
1714                                         return 1;
1715                                 }
1716
1717                                 /*
1718                                  * copies and stores uri and suffix
1719                                  */
1720                                 ber_str2bv( ludp->lud_dn, 0, 0, &dn );
1721                                 rc = dnPrettyNormal( NULL, &dn, &mt->mt_psuffix,
1722                                         &mt->mt_nsuffix, NULL );
1723                                 if ( rc != LDAP_SUCCESS ) {
1724                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1725                                                 "target DN is invalid \"%s\"",
1726                                                 c->argv[1] );
1727                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1728                                         ldap_free_urllist( ludp );
1729                                         ldap_charray_free( uris );
1730                                         return( 1 );
1731                                 }
1732
1733                                 ludp->lud_dn[ 0 ] = '\0';
1734
1735                                 switch ( ludp->lud_scope ) {
1736                                 case LDAP_SCOPE_DEFAULT:
1737                                         mt->mt_scope = LDAP_SCOPE_SUBTREE;
1738                                         break;
1739
1740                                 case LDAP_SCOPE_SUBTREE:
1741                                 case LDAP_SCOPE_SUBORDINATE:
1742                                         mt->mt_scope = ludp->lud_scope;
1743                                         break;
1744
1745                                 default:
1746                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1747                                                 "invalid scope for target \"%s\"",
1748                                                 c->argv[1] );
1749                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1750                                         ldap_free_urllist( ludp );
1751                                         ldap_charray_free( uris );
1752                                         return( 1 );
1753                                 }
1754
1755                         } else {
1756                                 /* check all, to apply the scope check on the first one */
1757                                 if ( ludp->lud_dn != NULL && ludp->lud_dn[ 0 ] != '\0' ) {
1758                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1759                                                 "multiple URIs must have no DN part" );
1760                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1761                                         ldap_free_urllist( ludp );
1762                                         ldap_charray_free( uris );
1763                                         return( 1 );
1764
1765                                 }
1766                         }
1767
1768                         tmpuri = ldap_url_list2urls( ludp );
1769                         ldap_free_urllist( ludp );
1770                         if ( tmpuri == NULL ) {
1771                                 snprintf( c->cr_msg, sizeof( c->cr_msg ), "no memory?" );
1772                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1773                                 ldap_charray_free( uris );
1774                                 return( 1 );
1775                         }
1776                         ldap_memfree( uris[ j ] );
1777                         uris[ j ] = tmpuri;
1778                 }
1779
1780                 mt->mt_uri = ldap_charray2str( uris, " " );
1781                 ldap_charray_free( uris );
1782                 if ( mt->mt_uri == NULL) {
1783                         snprintf( c->cr_msg, sizeof( c->cr_msg ), "no memory?" );
1784                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1785                         return( 1 );
1786                 }
1787
1788                 /*
1789                  * uri MUST be a branch of suffix!
1790                  */
1791                 for ( j = 0; !BER_BVISNULL( &c->be->be_nsuffix[ j ] ); j++ ) {
1792                         if ( dnIsSuffix( &mt->mt_nsuffix, &c->be->be_nsuffix[ j ] ) ) {
1793                                 break;
1794                         }
1795                 }
1796
1797                 if ( BER_BVISNULL( &c->be->be_nsuffix[ j ] ) ) {
1798                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1799                                 "<naming context> of URI must be within the naming context of this database." );
1800                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1801                         return 1;
1802                 }
1803                 c->ca_private = mt;
1804         } break;
1805         case LDAP_BACK_CFG_SUBTREE_EX:
1806         case LDAP_BACK_CFG_SUBTREE_IN:
1807         /* subtree-exclude */
1808                 if ( meta_subtree_config( mt, c )) {
1809                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1810                         return 1;
1811                 }
1812                 break;
1813
1814         case LDAP_BACK_CFG_DEFAULT_T:
1815         /* default target directive */
1816                 i = mi->mi_ntargets - 1;
1817
1818                 if ( c->argc == 1 ) {
1819                         if ( i < 0 ) {
1820                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1821                                         "\"%s\" alone must be inside a \"uri\" directive",
1822                                         c->argv[0] );
1823                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1824                                 return 1;
1825                         }
1826                         mi->mi_defaulttarget = i;
1827
1828                 } else {
1829                         if ( strcasecmp( c->argv[ 1 ], "none" ) == 0 ) {
1830                                 if ( i >= 0 ) {
1831                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1832                                                 "\"%s none\" should go before uri definitions",
1833                                                 c->argv[0] );
1834                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1835                                 }
1836                                 mi->mi_defaulttarget = META_DEFAULT_TARGET_NONE;
1837
1838                         } else {
1839
1840                                 if ( lutil_atoi( &mi->mi_defaulttarget, c->argv[ 1 ] ) != 0
1841                                         || mi->mi_defaulttarget < 0
1842                                         || mi->mi_defaulttarget >= i - 1 )
1843                                 {
1844                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1845                                                 "illegal target number %d",
1846                                                 mi->mi_defaulttarget );
1847                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1848                                         return 1;
1849                                 }
1850                         }
1851                 }
1852                 break;
1853
1854         case LDAP_BACK_CFG_DNCACHE_TTL:
1855         /* ttl of dn cache */
1856                 if ( strcasecmp( c->argv[ 1 ], "forever" ) == 0 ) {
1857                         mi->mi_cache.ttl = META_DNCACHE_FOREVER;
1858
1859                 } else if ( strcasecmp( c->argv[ 1 ], "disabled" ) == 0 ) {
1860                         mi->mi_cache.ttl = META_DNCACHE_DISABLED;
1861
1862                 } else {
1863                         unsigned long   t;
1864
1865                         if ( lutil_parse_time( c->argv[ 1 ], &t ) != 0 ) {
1866                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1867                                         "unable to parse dncache ttl \"%s\"",
1868                                         c->argv[ 1 ] );
1869                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1870                                 return 1;
1871                         }
1872                         mi->mi_cache.ttl = (time_t)t;
1873                 }
1874                 break;
1875
1876         case LDAP_BACK_CFG_NETWORK_TIMEOUT: {
1877         /* network timeout when connecting to ldap servers */
1878                 unsigned long t;
1879
1880                 if ( lutil_parse_time( c->argv[ 1 ], &t ) ) {
1881                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1882                                 "unable to parse network timeout \"%s\"",
1883                                 c->argv[ 1 ] );
1884                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1885                         return 1;
1886                 }
1887                 mc->mc_network_timeout = (time_t)t;
1888                 } break;
1889
1890         case LDAP_BACK_CFG_IDLE_TIMEOUT: {
1891         /* idle timeout when connecting to ldap servers */
1892                 unsigned long   t;
1893
1894                 if ( lutil_parse_time( c->argv[ 1 ], &t ) ) {
1895                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1896                                 "unable to parse idle timeout \"%s\"",
1897                                 c->argv[ 1 ] );
1898                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1899                         return 1;
1900
1901                 }
1902                 mi->mi_idle_timeout = (time_t)t;
1903                 } break;
1904
1905         case LDAP_BACK_CFG_CONN_TTL: {
1906         /* conn ttl */
1907                 unsigned long   t;
1908
1909                 if ( lutil_parse_time( c->argv[ 1 ], &t ) ) {
1910                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1911                                 "unable to parse conn ttl \"%s\"",
1912                                 c->argv[ 1 ] );
1913                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1914                         return 1;
1915
1916                 }
1917                 mi->mi_conn_ttl = (time_t)t;
1918                 } break;
1919
1920         case LDAP_BACK_CFG_BIND_TIMEOUT:
1921         /* bind timeout when connecting to ldap servers */
1922                 mc->mc_bind_timeout.tv_sec = c->value_ulong/1000000;
1923                 mc->mc_bind_timeout.tv_usec = c->value_ulong%1000000;
1924                 break;
1925
1926         case LDAP_BACK_CFG_ACL_AUTHCDN:
1927         /* name to use for meta_back_group */
1928                 if ( strcasecmp( c->argv[ 0 ], "binddn" ) == 0 ) {
1929                         Debug( LDAP_DEBUG_ANY, "%s: "
1930                                 "\"binddn\" statement is deprecated; "
1931                                 "use \"acl-authcDN\" instead\n",
1932                                 c->log, 0, 0 );
1933                         /* FIXME: some day we'll need to throw an error */
1934                 }
1935
1936                 ber_memfree_x( c->value_dn.bv_val, NULL );
1937                 mt->mt_binddn = c->value_ndn;
1938                 BER_BVZERO( &c->value_dn );
1939                 BER_BVZERO( &c->value_ndn );
1940                 break;
1941
1942         case LDAP_BACK_CFG_ACL_PASSWD:
1943         /* password to use for meta_back_group */
1944                 if ( strcasecmp( c->argv[ 0 ], "bindpw" ) == 0 ) {
1945                         Debug( LDAP_DEBUG_ANY, "%s "
1946                                 "\"bindpw\" statement is deprecated; "
1947                                 "use \"acl-passwd\" instead\n",
1948                                 c->log, 0, 0 );
1949                         /* FIXME: some day we'll need to throw an error */
1950                 }
1951
1952                 ber_str2bv( c->argv[ 1 ], 0L, 1, &mt->mt_bindpw );
1953                 break;
1954
1955         case LDAP_BACK_CFG_REBIND:
1956         /* save bind creds for referral rebinds? */
1957                 if ( c->argc == 1 || c->value_int ) {
1958                         mc->mc_flags |= LDAP_BACK_F_SAVECRED;
1959                 } else {
1960                         mc->mc_flags &= ~LDAP_BACK_F_SAVECRED;
1961                 }
1962                 break;
1963
1964         case LDAP_BACK_CFG_CHASE:
1965                 if ( c->argc == 1 || c->value_int ) {
1966                         mc->mc_flags |= LDAP_BACK_F_CHASE_REFERRALS;
1967                 } else {
1968                         mc->mc_flags &= ~LDAP_BACK_F_CHASE_REFERRALS;
1969                 }
1970                 break;
1971
1972         case LDAP_BACK_CFG_TLS:
1973                 i = verb_to_mask( c->argv[1], tls_mode );
1974                 if ( BER_BVISNULL( &tls_mode[i].word ) ) {
1975                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1976                                 "%s unknown argument \"%s\"",
1977                                 c->argv[0], c->argv[1] );
1978                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1979                         return 1;
1980                 }
1981                 mc->mc_flags &= ~LDAP_BACK_F_TLS_MASK;
1982                 mc->mc_flags |= tls_mode[i].mask;
1983
1984                 if ( c->argc > 2 ) {
1985                         if ( c->op == SLAP_CONFIG_ADD && mi->mi_ntargets == 0 ) {
1986                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1987                                         "need \"uri\" directive first" );
1988                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1989                                 return 1;
1990                         }
1991
1992                         for ( i = 2; i < c->argc; i++ ) {
1993                                 if ( bindconf_tls_parse( c->argv[i], &mt->mt_tls ))
1994                                         return 1;
1995                         }
1996                         bindconf_tls_defaults( &mt->mt_tls );
1997                 }
1998                 break;
1999
2000         case LDAP_BACK_CFG_T_F:
2001                 i = verb_to_mask( c->argv[1], t_f_mode );
2002                 if ( BER_BVISNULL( &t_f_mode[i].word ) ) {
2003                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2004                                 "%s unknown argument \"%s\"",
2005                                 c->argv[0], c->argv[1] );
2006                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2007                         return 1;
2008                 }
2009                 mc->mc_flags &= ~LDAP_BACK_F_T_F_MASK2;
2010                 mc->mc_flags |= t_f_mode[i].mask;
2011                 break;
2012
2013         case LDAP_BACK_CFG_ONERR:
2014         /* onerr? */
2015                 i = verb_to_mask( c->argv[1], onerr_mode );
2016                 if ( BER_BVISNULL( &onerr_mode[i].word ) ) {
2017                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2018                                 "%s unknown argument \"%s\"",
2019                                 c->argv[0], c->argv[1] );
2020                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2021                         return 1;
2022                 }
2023                 mi->mi_flags &= ~META_BACK_F_ONERR_MASK;
2024                 mi->mi_flags |= onerr_mode[i].mask;
2025                 break;
2026
2027         case LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER:
2028         /* bind-defer? */
2029                 if ( c->argc == 1 || c->value_int ) {
2030                         mi->mi_flags |= META_BACK_F_DEFER_ROOTDN_BIND;
2031                 } else {
2032                         mi->mi_flags &= ~META_BACK_F_DEFER_ROOTDN_BIND;
2033                 }
2034                 break;
2035
2036         case LDAP_BACK_CFG_SINGLECONN:
2037         /* single-conn? */
2038                 if ( mi->mi_ntargets > 0 ) {
2039                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2040                                 "\"%s\" must appear before target definitions",
2041                                 c->argv[0] );
2042                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2043                         return( 1 );
2044                 }
2045                 if ( c->value_int ) {
2046                         mi->mi_flags |= LDAP_BACK_F_SINGLECONN;
2047                 } else {
2048                         mi->mi_flags &= ~LDAP_BACK_F_SINGLECONN;
2049                 }
2050                 break;
2051
2052         case LDAP_BACK_CFG_USETEMP:
2053         /* use-temporaries? */
2054                 if ( mi->mi_ntargets > 0 ) {
2055                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2056                                 "\"%s\" must appear before target definitions",
2057                                 c->argv[0] );
2058                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2059                         return( 1 );
2060                 }
2061                 if ( c->value_int ) {
2062                         mi->mi_flags |= LDAP_BACK_F_USE_TEMPORARIES;
2063                 } else {
2064                         mi->mi_flags &= ~LDAP_BACK_F_USE_TEMPORARIES;
2065                 }
2066                 break;
2067
2068         case LDAP_BACK_CFG_CONNPOOLMAX:
2069         /* privileged connections pool max size ? */
2070                 if ( mi->mi_ntargets > 0 ) {
2071                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2072                                 "\"%s\" must appear before target definitions",
2073                                 c->argv[0] );
2074                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2075                         return( 1 );
2076                 }
2077
2078                 if ( c->value_int < LDAP_BACK_CONN_PRIV_MIN
2079                         || c->value_int > LDAP_BACK_CONN_PRIV_MAX )
2080                 {
2081                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2082                                 "invalid max size " "of privileged "
2083                                 "connections pool \"%s\" "
2084                                 "in \"conn-pool-max <n> "
2085                                 "(must be between %d and %d)\"",
2086                                 c->argv[ 1 ],
2087                                 LDAP_BACK_CONN_PRIV_MIN,
2088                                 LDAP_BACK_CONN_PRIV_MAX );
2089                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2090                         return 1;
2091                 }
2092                 mi->mi_conn_priv_max = c->value_int;
2093                 break;
2094
2095         case LDAP_BACK_CFG_CANCEL:
2096                 i = verb_to_mask( c->argv[1], cancel_mode );
2097                 if ( BER_BVISNULL( &cancel_mode[i].word ) ) {
2098                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2099                                 "%s unknown argument \"%s\"",
2100                                 c->argv[0], c->argv[1] );
2101                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2102                         return 1;
2103                 }
2104                 mc->mc_flags &= ~LDAP_BACK_F_CANCEL_MASK2;
2105                 mc->mc_flags |= t_f_mode[i].mask;
2106                 break;
2107
2108         case LDAP_BACK_CFG_TIMEOUT:
2109                 for ( i = 1; i < c->argc; i++ ) {
2110                         if ( isdigit( (unsigned char) c->argv[ i ][ 0 ] ) ) {
2111                                 int             j;
2112                                 unsigned        u;
2113
2114                                 if ( lutil_atoux( &u, c->argv[ i ], 0 ) != 0 ) {
2115                                         snprintf( c->cr_msg, sizeof( c->cr_msg),
2116                                                 "unable to parse timeout \"%s\"",
2117                                                 c->argv[ i ] );
2118                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2119                                         return 1;
2120                                 }
2121
2122                                 for ( j = 0; j < SLAP_OP_LAST; j++ ) {
2123                                         mc->mc_timeout[ j ] = u;
2124                                 }
2125
2126                                 continue;
2127                         }
2128
2129                         if ( slap_cf_aux_table_parse( c->argv[ i ], mc->mc_timeout, timeout_table, "slapd-meta timeout" ) ) {
2130                                 snprintf( c->cr_msg, sizeof( c->cr_msg),
2131                                         "unable to parse timeout \"%s\"",
2132                                         c->argv[ i ] );
2133                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2134                                 return 1;
2135                         }
2136                 }
2137                 break;
2138
2139         case LDAP_BACK_CFG_PSEUDOROOTDN:
2140         /* name to use as pseudo-root dn */
2141                 /*
2142                  * exact replacement:
2143                  *
2144
2145 idassert-bind   bindmethod=simple
2146                 binddn=<pseudorootdn>
2147                 credentials=<pseudorootpw>
2148                 mode=none
2149                 flags=non-prescriptive
2150 idassert-authzFrom      "dn:<rootdn>"
2151
2152                  * so that only when authc'd as <rootdn> the proxying occurs
2153                  * rebinding as the <pseudorootdn> without proxyAuthz.
2154                  */
2155
2156                 Debug( LDAP_DEBUG_ANY,
2157                         "%s: \"pseudorootdn\", \"pseudorootpw\" are no longer supported; "
2158                         "use \"idassert-bind\" and \"idassert-authzFrom\" instead.\n",
2159                         c->log, 0, 0 );
2160
2161                 {
2162                         char    binddn[ SLAP_TEXT_BUFLEN ];
2163                         char    *cargv[] = {
2164                                 "idassert-bind",
2165                                 "bindmethod=simple",
2166                                 NULL,
2167                                 "mode=none",
2168                                 "flags=non-prescriptive",
2169                                 NULL
2170                         };
2171                         char **oargv;
2172                         int oargc;
2173                         int     cargc = 5;
2174                         int     rc;
2175
2176
2177                         if ( BER_BVISNULL( &c->be->be_rootndn ) ) {
2178                                 Debug( LDAP_DEBUG_ANY, "%s: \"pseudorootpw\": \"rootdn\" must be defined first.\n",
2179                                         c->log, 0, 0 );
2180                                 return 1;
2181                         }
2182
2183                         if ( sizeof( binddn ) <= (unsigned) snprintf( binddn,
2184                                         sizeof( binddn ), "binddn=%s", c->argv[ 1 ] ))
2185                         {
2186                                 Debug( LDAP_DEBUG_ANY, "%s: \"pseudorootdn\" too long.\n",
2187                                         c->log, 0, 0 );
2188                                 return 1;
2189                         }
2190                         cargv[ 2 ] = binddn;
2191
2192                         oargv = c->argv;
2193                         oargc = c->argc;
2194                         c->argv = cargv;
2195                         c->argc = cargc;
2196                         rc = mi->mi_ldap_extra->idassert_parse( c, &mt->mt_idassert );
2197                         c->argv = oargv;
2198                         c->argc = oargc;
2199                         if ( rc == 0 ) {
2200                                 struct berval   bv;
2201
2202                                 if ( mt->mt_idassert_authz != NULL ) {
2203                                         Debug( LDAP_DEBUG_ANY, "%s: \"idassert-authzFrom\" already defined (discarded).\n",
2204                                                 c->log, 0, 0 );
2205                                         ber_bvarray_free( mt->mt_idassert_authz );
2206                                         mt->mt_idassert_authz = NULL;
2207                                 }
2208
2209                                 assert( !BER_BVISNULL( &mt->mt_idassert_authcDN ) );
2210
2211                                 bv.bv_len = STRLENOF( "dn:" ) + c->be->be_rootndn.bv_len;
2212                                 bv.bv_val = ber_memalloc( bv.bv_len + 1 );
2213                                 AC_MEMCPY( bv.bv_val, "dn:", STRLENOF( "dn:" ) );
2214                                 AC_MEMCPY( &bv.bv_val[ STRLENOF( "dn:" ) ], c->be->be_rootndn.bv_val, c->be->be_rootndn.bv_len + 1 );
2215
2216                                 ber_bvarray_add( &mt->mt_idassert_authz, &bv );
2217                         }
2218
2219                         return rc;
2220                 }
2221                 break;
2222
2223         case LDAP_BACK_CFG_PSEUDOROOTPW:
2224         /* password to use as pseudo-root */
2225                 Debug( LDAP_DEBUG_ANY,
2226                         "%s: \"pseudorootdn\", \"pseudorootpw\" are no longer supported; "
2227                         "use \"idassert-bind\" and \"idassert-authzFrom\" instead.\n",
2228                         c->log, 0, 0 );
2229
2230                 if ( BER_BVISNULL( &mt->mt_idassert_authcDN ) ) {
2231                         Debug( LDAP_DEBUG_ANY, "%s: \"pseudorootpw\": \"pseudorootdn\" must be defined first.\n",
2232                                 c->log, 0, 0 );
2233                         return 1;
2234                 }
2235
2236                 if ( !BER_BVISNULL( &mt->mt_idassert_passwd ) ) {
2237                         memset( mt->mt_idassert_passwd.bv_val, 0,
2238                                 mt->mt_idassert_passwd.bv_len );
2239                         ber_memfree( mt->mt_idassert_passwd.bv_val );
2240                 }
2241                 ber_str2bv( c->argv[ 1 ], 0, 1, &mt->mt_idassert_passwd );
2242                 break;
2243
2244         case LDAP_BACK_CFG_IDASSERT_BIND:
2245         /* idassert-bind */
2246                 rc = mi->mi_ldap_extra->idassert_parse( c, &mt->mt_idassert );
2247                 break;
2248
2249         case LDAP_BACK_CFG_IDASSERT_AUTHZFROM:
2250         /* idassert-authzFrom */
2251                 rc = mi->mi_ldap_extra->idassert_authzfrom_parse( c, &mt->mt_idassert );
2252                 break;
2253
2254         case LDAP_BACK_CFG_QUARANTINE:
2255         /* quarantine */
2256                 if ( META_BACK_CMN_QUARANTINE( mc ) )
2257                 {
2258                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2259                                 "quarantine already defined" );
2260                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2261                         return 1;
2262                 }
2263
2264                 if ( mt ) {
2265                         mc->mc_quarantine.ri_interval = NULL;
2266                         mc->mc_quarantine.ri_num = NULL;
2267                         if ( !META_BACK_QUARANTINE( mi ) ) {
2268                                 ldap_pvt_thread_mutex_init( &mt->mt_quarantine_mutex );
2269                         }
2270                 }
2271
2272                 if ( mi->mi_ldap_extra->retry_info_parse( c->argv[ 1 ], &mc->mc_quarantine, c->cr_msg, sizeof( c->cr_msg ) ) ) {
2273                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2274                         return 1;
2275                 }
2276
2277                 mc->mc_flags |= LDAP_BACK_F_QUARANTINE;
2278                 break;
2279
2280 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
2281         case LDAP_BACK_CFG_ST_REQUEST:
2282         /* session tracking request */
2283                 if ( c->value_int ) {
2284                         mc->mc_flags |= LDAP_BACK_F_ST_REQUEST;
2285                 } else {
2286                         mc->mc_flags &= ~LDAP_BACK_F_ST_REQUEST;
2287                 }
2288                 break;
2289 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
2290
2291         case LDAP_BACK_CFG_SUFFIXM:     /* FALLTHRU */
2292         case LDAP_BACK_CFG_REWRITE: {
2293         /* rewrite stuff ... */
2294                 ConfigArgs ca = { 0 };
2295                 char *line, **argv;
2296                 struct rewrite_info *rwi;
2297                 int cnt = 0, argc, ix = c->valx;
2298
2299                 if ( mt->mt_rwmap.rwm_bva_rewrite ) {
2300                         for ( ; !BER_BVISNULL( &mt->mt_rwmap.rwm_bva_rewrite[ cnt ] ); cnt++ )
2301                                 /* count */ ;
2302                 }
2303
2304                 if ( ix >= cnt || ix < 0 ) {
2305                         ix = cnt;
2306                 } else {
2307                         rwi = mt->mt_rwmap.rwm_rw;
2308
2309                         mt->mt_rwmap.rwm_rw = NULL;
2310                         rc = meta_rwi_init( &mt->mt_rwmap.rwm_rw );
2311
2312                         /* re-parse all rewrite rules, up to the one
2313                          * that needs to be added */
2314                         ca.fname = c->fname;
2315                         ca.lineno = c->lineno;
2316                         for ( i = 0; i < ix; i++ ) {
2317                                 ca.line = mt->mt_rwmap.rwm_bva_rewrite[ i ].bv_val;
2318                                 ca.argc = 0;
2319                                 config_fp_parse_line( &ca );
2320
2321                                 if ( !strcasecmp( ca.argv[0], "suffixmassage" )) {
2322                                         rc = meta_suffixm_config( &ca, mt );
2323                                 } else {
2324                                         rc = rewrite_parse( mt->mt_rwmap.rwm_rw,
2325                                                 c->fname, c->lineno, ca.argc, argv );
2326                                 }
2327                                 assert( rc == 0 );
2328                                 ch_free( ca.argv );
2329                                 ch_free( ca.tline );
2330                         }
2331                 }
2332                 argc = c->argc;
2333                 argv = c->argv;
2334                 /* add the new rule */
2335                 if ( c->type == LDAP_BACK_CFG_SUFFIXM ) {
2336                         rc = meta_suffixm_config( c, mt );
2337                 } else {
2338                         if ( c->op != SLAP_CONFIG_ADD ) {
2339                                 argc--;
2340                                 argv++;
2341                         }
2342                         rc = rewrite_parse( mt->mt_rwmap.rwm_rw,
2343                                                 c->fname, c->lineno, argc, argv );
2344                 }
2345                 if ( rc ) {
2346                         if ( ix < cnt ) {
2347                                 rewrite_info_delete( &mt->mt_rwmap.rwm_rw );
2348                                 mt->mt_rwmap.rwm_rw = rwi;
2349                         }
2350                         return 1;
2351                 }
2352                 if ( ix < cnt ) {
2353                         for ( ; i < cnt; i++ ) {
2354                                 ca.line = mt->mt_rwmap.rwm_bva_rewrite[ i ].bv_val;
2355                                 ca.argc = 0;
2356                                 config_fp_parse_line( &ca );
2357
2358                                 if ( !strcasecmp( ca.argv[0], "suffixmassage" )) {
2359                                         rc = meta_suffixm_config( &ca, mt );
2360                                 } else {
2361                                         rc = rewrite_parse( mt->mt_rwmap.rwm_rw,
2362                                                 c->fname, c->lineno, ca.argc, argv );
2363                                 }
2364                                 assert( rc == 0 );
2365                                 ch_free( ca.argv );
2366                                 ch_free( ca.tline );
2367                         }
2368                 }
2369
2370                 /* save the rule info */
2371                 line = ldap_charray2str( argv, "\" \"" );
2372                 if ( line != NULL ) {
2373                         struct berval bv;
2374                         int len = strlen( argv[ 0 ] );
2375
2376                         ber_str2bv( line, 0, 0, &bv );
2377                         AC_MEMCPY( &bv.bv_val[ len ], &bv.bv_val[ len + 1 ],
2378                                 bv.bv_len - ( len + 1 ));
2379                         bv.bv_val[ bv.bv_len - 1] = '"';
2380                         ber_bvarray_add( &mt->mt_rwmap.rwm_bva_rewrite, &bv );
2381                         /* move it to the right slot */
2382                         if ( ix < cnt ) {
2383                                 for ( i=cnt; i>ix; i-- )
2384                                         mt->mt_rwmap.rwm_bva_rewrite[i+1] = mt->mt_rwmap.rwm_bva_rewrite[i];
2385                                 mt->mt_rwmap.rwm_bva_rewrite[i] = bv;
2386
2387                                 /* destroy old rules */
2388                                 rewrite_info_delete( &rwi );
2389                         }
2390                 }
2391                 } break;
2392
2393         case LDAP_BACK_CFG_MAP: {
2394         /* objectclass/attribute mapping */
2395                 ConfigArgs ca = { 0 };
2396                 char *argv[5];
2397                 struct ldapmap rwm_oc;
2398                 struct ldapmap rwm_at;
2399                 int cnt = 0, ix = c->valx;
2400
2401                 if ( mt->mt_rwmap.rwm_bva_map ) {
2402                         for ( ; !BER_BVISNULL( &mt->mt_rwmap.rwm_bva_map[ cnt ] ); cnt++ )
2403                                 /* count */ ;
2404                 }
2405
2406                 if ( ix >= cnt || ix < 0 ) {
2407                         ix = cnt;
2408                 } else {
2409                         rwm_oc = mt->mt_rwmap.rwm_oc;
2410                         rwm_at = mt->mt_rwmap.rwm_at;
2411
2412                         memset( &mt->mt_rwmap.rwm_oc, 0, sizeof( mt->mt_rwmap.rwm_oc ) );
2413                         memset( &mt->mt_rwmap.rwm_at, 0, sizeof( mt->mt_rwmap.rwm_at ) );
2414
2415                         /* re-parse all mappings, up to the one
2416                          * that needs to be added */
2417                         argv[0] = c->argv[0];
2418                         ca.fname = c->fname;
2419                         ca.lineno = c->lineno;
2420                         for ( i = 0; i < ix; i++ ) {
2421                                 ca.line = mt->mt_rwmap.rwm_bva_map[ i ].bv_val;
2422                                 ca.argc = 0;
2423                                 config_fp_parse_line( &ca );
2424
2425                                 argv[1] = ca.argv[0];
2426                                 argv[2] = ca.argv[1];
2427                                 argv[3] = ca.argv[2];
2428                                 argv[4] = ca.argv[3];
2429                                 ch_free( ca.argv );
2430                                 ca.argv = argv;
2431                                 ca.argc++;
2432                                 rc = ldap_back_map_config( &ca, &mt->mt_rwmap.rwm_oc,
2433                                         &mt->mt_rwmap.rwm_at );
2434
2435                                 ch_free( ca.tline );
2436                                 ca.tline = NULL;
2437                                 ca.argv = NULL;
2438
2439                                 /* in case of failure, restore
2440                                  * the existing mapping */
2441                                 if ( rc ) {
2442                                         goto map_fail;
2443                                 }
2444                         }
2445                 }
2446                 /* add the new mapping */
2447                 rc = ldap_back_map_config( c, &mt->mt_rwmap.rwm_oc,
2448                                         &mt->mt_rwmap.rwm_at );
2449                 if ( rc ) {
2450                         goto map_fail;
2451                 }
2452
2453                 if ( ix < cnt ) {
2454                         for ( ; i<cnt ; cnt++ ) {
2455                                 ca.line = mt->mt_rwmap.rwm_bva_map[ i ].bv_val;
2456                                 ca.argc = 0;
2457                                 config_fp_parse_line( &ca );
2458
2459                                 argv[1] = ca.argv[0];
2460                                 argv[2] = ca.argv[1];
2461                                 argv[3] = ca.argv[2];
2462                                 argv[4] = ca.argv[3];
2463
2464                                 ch_free( ca.argv );
2465                                 ca.argv = argv;
2466                                 ca.argc++;
2467                                 rc = ldap_back_map_config( &ca, &mt->mt_rwmap.rwm_oc,
2468                                         &mt->mt_rwmap.rwm_at );
2469
2470                                 ch_free( ca.tline );
2471                                 ca.tline = NULL;
2472                                 ca.argv = NULL;
2473
2474                                 /* in case of failure, restore
2475                                  * the existing mapping */
2476                                 if ( rc ) {
2477                                         goto map_fail;
2478                                 }
2479                         }
2480                 }
2481
2482                 /* save the map info */
2483                 argv[0] = ldap_charray2str( &c->argv[ 1 ], " " );
2484                 if ( argv[0] != NULL ) {
2485                         struct berval bv;
2486                         ber_str2bv( argv[0], 0, 0, &bv );
2487                         ber_bvarray_add( &mt->mt_rwmap.rwm_bva_map, &bv );
2488                         /* move it to the right slot */
2489                         if ( ix < cnt ) {
2490                                 for ( i=cnt; i>ix; i-- )
2491                                         mt->mt_rwmap.rwm_bva_map[i+1] = mt->mt_rwmap.rwm_bva_map[i];
2492                                 mt->mt_rwmap.rwm_bva_map[i] = bv;
2493
2494                                 /* destroy old mapping */
2495                                 meta_back_map_free( &rwm_oc );
2496                                 meta_back_map_free( &rwm_at );
2497                         }
2498                 }
2499                 break;
2500
2501 map_fail:;
2502                 if ( ix < cnt ) {
2503                         meta_back_map_free( &mt->mt_rwmap.rwm_oc );
2504                         meta_back_map_free( &mt->mt_rwmap.rwm_at );
2505                         mt->mt_rwmap.rwm_oc = rwm_oc;
2506                         mt->mt_rwmap.rwm_at = rwm_at;
2507                 }
2508                 } break;
2509
2510         case LDAP_BACK_CFG_NRETRIES: {
2511                 int             nretries = META_RETRY_UNDEFINED;
2512
2513                 if ( strcasecmp( c->argv[ 1 ], "forever" ) == 0 ) {
2514                         nretries = META_RETRY_FOREVER;
2515
2516                 } else if ( strcasecmp( c->argv[ 1 ], "never" ) == 0 ) {
2517                         nretries = META_RETRY_NEVER;
2518
2519                 } else {
2520                         if ( lutil_atoi( &nretries, c->argv[ 1 ] ) != 0 ) {
2521                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2522                                         "unable to parse nretries {never|forever|<retries>}: \"%s\"",
2523                                         c->argv[ 1 ] );
2524                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2525                                 return 1;
2526                         }
2527                 }
2528
2529                 mc->mc_nretries = nretries;
2530                 } break;
2531
2532         case LDAP_BACK_CFG_VERSION:
2533                 if ( c->value_int != 0 && ( c->value_int < LDAP_VERSION_MIN || c->value_int > LDAP_VERSION_MAX ) ) {
2534                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2535                                 "unsupported protocol version \"%s\"",
2536                                 c->argv[ 1 ] );
2537                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2538                         return 1;
2539                 }
2540                 mc->mc_version = c->value_int;
2541                 break;
2542
2543         case LDAP_BACK_CFG_NOREFS:
2544         /* do not return search references */
2545                 if ( c->value_int ) {
2546                         mc->mc_flags |= LDAP_BACK_F_NOREFS;
2547                 } else {
2548                         mc->mc_flags &= ~LDAP_BACK_F_NOREFS;
2549                 }
2550                 break;
2551
2552         case LDAP_BACK_CFG_NOUNDEFFILTER:
2553         /* do not propagate undefined search filters */
2554                 if ( c->value_int ) {
2555                         mc->mc_flags |= LDAP_BACK_F_NOUNDEFFILTER;
2556                 } else {
2557                         mc->mc_flags &= ~LDAP_BACK_F_NOUNDEFFILTER;
2558                 }
2559                 break;
2560
2561 #ifdef SLAPD_META_CLIENT_PR
2562         case LDAP_BACK_CFG_CLIENT_PR:
2563                 if ( strcasecmp( c->argv[ 1 ], "accept-unsolicited" ) == 0 ) {
2564                         mc->mc_ps = META_CLIENT_PR_ACCEPT_UNSOLICITED;
2565
2566                 } else if ( strcasecmp( c->argv[ 1 ], "disable" ) == 0 ) {
2567                         mc->mc_ps = META_CLIENT_PR_DISABLE;
2568
2569                 } else if ( lutil_atoi( &mc->mc_ps, c->argv[ 1 ] ) || mc->mc_ps < -1 ) {
2570                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2571                                 "unable to parse client-pr {accept-unsolicited|disable|<size>}: \"%s\"",
2572                                 c->argv[ 1 ] );
2573                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2574                         return( 1 );
2575                 }
2576                 break;
2577 #endif /* SLAPD_META_CLIENT_PR */
2578
2579         /* anything else */
2580         default:
2581                 return SLAP_CONF_UNKNOWN;
2582         }
2583
2584         return rc;
2585 }
2586
2587 int
2588 meta_back_init_cf( BackendInfo *bi )
2589 {
2590         int                     rc;
2591         AttributeDescription    *ad = NULL;
2592         const char              *text;
2593
2594         /* Make sure we don't exceed the bits reserved for userland */
2595         config_check_userland( LDAP_BACK_CFG_LAST );
2596
2597         bi->bi_cf_ocs = metaocs;
2598
2599         rc = config_register_schema( metacfg, metaocs );
2600         if ( rc ) {
2601                 return rc;
2602         }
2603
2604         /* setup olcDbAclPasswd and olcDbIDAssertPasswd
2605          * to be base64-encoded when written in LDIF form;
2606          * basically, we don't care if it fails */
2607         rc = slap_str2ad( "olcDbACLPasswd", &ad, &text );
2608         if ( rc ) {
2609                 Debug( LDAP_DEBUG_ANY, "config_back_initialize: "
2610                         "warning, unable to get \"olcDbACLPasswd\" "
2611                         "attribute description: %d: %s\n",
2612                         rc, text, 0 );
2613         } else {
2614                 (void)ldif_must_b64_encode_register( ad->ad_cname.bv_val,
2615                         ad->ad_type->sat_oid );
2616         }
2617
2618         ad = NULL;
2619         rc = slap_str2ad( "olcDbIDAssertPasswd", &ad, &text );
2620         if ( rc ) {
2621                 Debug( LDAP_DEBUG_ANY, "config_back_initialize: "
2622                         "warning, unable to get \"olcDbIDAssertPasswd\" "
2623                         "attribute description: %d: %s\n",
2624                         rc, text, 0 );
2625         } else {
2626                 (void)ldif_must_b64_encode_register( ad->ad_cname.bv_val,
2627                         ad->ad_type->sat_oid );
2628         }
2629
2630         return 0;
2631 }
2632
2633 static int
2634 ldap_back_map_config(
2635                 ConfigArgs *c,
2636                 struct ldapmap  *oc_map,
2637                 struct ldapmap  *at_map )
2638 {
2639         struct ldapmap          *map;
2640         struct ldapmapping      *mapping;
2641         char                    *src, *dst;
2642         int                     is_oc = 0;
2643
2644         if ( strcasecmp( c->argv[ 1 ], "objectclass" ) == 0 ) {
2645                 map = oc_map;
2646                 is_oc = 1;
2647
2648         } else if ( strcasecmp( c->argv[ 1 ], "attribute" ) == 0 ) {
2649                 map = at_map;
2650
2651         } else {
2652                 snprintf( c->cr_msg, sizeof(c->cr_msg),
2653                         "%s unknown argument \"%s\"",
2654                         c->argv[0], c->argv[1] );
2655                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2656                 return 1;
2657         }
2658
2659         if ( !is_oc && map->map == NULL ) {
2660                 /* only init if required */
2661                 ldap_back_map_init( map, &mapping );
2662         }
2663
2664         if ( strcmp( c->argv[ 2 ], "*" ) == 0 ) {
2665                 if ( c->argc < 4 || strcmp( c->argv[ 3 ], "*" ) == 0 ) {
2666                         map->drop_missing = ( c->argc < 4 );
2667                         goto success_return;
2668                 }
2669                 src = dst = c->argv[ 3 ];
2670
2671         } else if ( c->argc < 4 ) {
2672                 src = "";
2673                 dst = c->argv[ 2 ];
2674
2675         } else {
2676                 src = c->argv[ 2 ];
2677                 dst = ( strcmp( c->argv[ 3 ], "*" ) == 0 ? src : c->argv[ 3 ] );
2678         }
2679
2680         if ( ( map == at_map )
2681                 && ( strcasecmp( src, "objectclass" ) == 0
2682                         || strcasecmp( dst, "objectclass" ) == 0 ) )
2683         {
2684                 snprintf( c->cr_msg, sizeof(c->cr_msg),
2685                         "objectclass attribute cannot be mapped" );
2686                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2687                 return 1;
2688         }
2689
2690         mapping = (struct ldapmapping *)ch_calloc( 2,
2691                 sizeof(struct ldapmapping) );
2692         if ( mapping == NULL ) {
2693                 snprintf( c->cr_msg, sizeof(c->cr_msg),
2694                         "out of memory" );
2695                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2696                 return 1;
2697         }
2698         ber_str2bv( src, 0, 1, &mapping[ 0 ].src );
2699         ber_str2bv( dst, 0, 1, &mapping[ 0 ].dst );
2700         mapping[ 1 ].src = mapping[ 0 ].dst;
2701         mapping[ 1 ].dst = mapping[ 0 ].src;
2702
2703         /*
2704          * schema check
2705          */
2706         if ( is_oc ) {
2707                 if ( src[ 0 ] != '\0' ) {
2708                         if ( oc_bvfind( &mapping[ 0 ].src ) == NULL ) {
2709                                 Debug( LDAP_DEBUG_ANY,
2710         "warning, source objectClass '%s' should be defined in schema\n",
2711                                         c->log, src, 0 );
2712
2713                                 /*
2714                                  * FIXME: this should become an err
2715                                  */
2716                                 goto error_return;
2717                         }
2718                 }
2719
2720                 if ( oc_bvfind( &mapping[ 0 ].dst ) == NULL ) {
2721                         Debug( LDAP_DEBUG_ANY,
2722         "warning, destination objectClass '%s' is not defined in schema\n",
2723                                 c->log, dst, 0 );
2724                 }
2725         } else {
2726                 int                     rc;
2727                 const char              *text = NULL;
2728                 AttributeDescription    *ad = NULL;
2729
2730                 if ( src[ 0 ] != '\0' ) {
2731                         rc = slap_bv2ad( &mapping[ 0 ].src, &ad, &text );
2732                         if ( rc != LDAP_SUCCESS ) {
2733                                 Debug( LDAP_DEBUG_ANY,
2734         "warning, source attributeType '%s' should be defined in schema\n",
2735                                         c->log, src, 0 );
2736
2737                                 /*
2738                                  * FIXME: this should become an err
2739                                  */
2740                                 /*
2741                                  * we create a fake "proxied" ad
2742                                  * and add it here.
2743                                  */
2744
2745                                 rc = slap_bv2undef_ad( &mapping[ 0 ].src,
2746                                                 &ad, &text, SLAP_AD_PROXIED );
2747                                 if ( rc != LDAP_SUCCESS ) {
2748                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2749                                                 "source attributeType \"%s\": %d (%s)",
2750                                                 src, rc, text ? text : "" );
2751                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2752                                         goto error_return;
2753                                 }
2754                         }
2755
2756                         ad = NULL;
2757                 }
2758
2759                 rc = slap_bv2ad( &mapping[ 0 ].dst, &ad, &text );
2760                 if ( rc != LDAP_SUCCESS ) {
2761                         Debug( LDAP_DEBUG_ANY,
2762         "warning, destination attributeType '%s' is not defined in schema\n",
2763                                 c->log, dst, 0 );
2764
2765                         /*
2766                          * we create a fake "proxied" ad
2767                          * and add it here.
2768                          */
2769
2770                         rc = slap_bv2undef_ad( &mapping[ 0 ].dst,
2771                                         &ad, &text, SLAP_AD_PROXIED );
2772                         if ( rc != LDAP_SUCCESS ) {
2773                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2774                                         "destination attributeType \"%s\": %d (%s)\n",
2775                                         dst, rc, text ? text : "" );
2776                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2777                                 return 1;
2778                         }
2779                 }
2780         }
2781
2782         if ( (src[ 0 ] != '\0' && avl_find( map->map, (caddr_t)&mapping[ 0 ], mapping_cmp ) != NULL)
2783                         || avl_find( map->remap, (caddr_t)&mapping[ 1 ], mapping_cmp ) != NULL)
2784         {
2785                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2786                         "duplicate mapping found." );
2787                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2788                 goto error_return;
2789         }
2790
2791         if ( src[ 0 ] != '\0' ) {
2792                 avl_insert( &map->map, (caddr_t)&mapping[ 0 ],
2793                                         mapping_cmp, mapping_dup );
2794         }
2795         avl_insert( &map->remap, (caddr_t)&mapping[ 1 ],
2796                                 mapping_cmp, mapping_dup );
2797
2798 success_return:;
2799         return 0;
2800
2801 error_return:;
2802         if ( mapping ) {
2803                 ch_free( mapping[ 0 ].src.bv_val );
2804                 ch_free( mapping[ 0 ].dst.bv_val );
2805                 ch_free( mapping );
2806         }
2807
2808         return 1;
2809 }
2810
2811
2812 #ifdef ENABLE_REWRITE
2813 static char *
2814 suffix_massage_regexize( const char *s )
2815 {
2816         char *res, *ptr;
2817         const char *p, *r;
2818         int i;
2819
2820         if ( s[ 0 ] == '\0' ) {
2821                 return ch_strdup( "^(.+)$" );
2822         }
2823
2824         for ( i = 0, p = s;
2825                         ( r = strchr( p, ',' ) ) != NULL;
2826                         p = r + 1, i++ )
2827                 ;
2828
2829         res = ch_calloc( sizeof( char ),
2830                         strlen( s )
2831                         + STRLENOF( "((.+),)?" )
2832                         + STRLENOF( "[ ]?" ) * i
2833                         + STRLENOF( "$" ) + 1 );
2834
2835         ptr = lutil_strcopy( res, "((.+),)?" );
2836         for ( i = 0, p = s;
2837                         ( r = strchr( p, ',' ) ) != NULL;
2838                         p = r + 1 , i++ ) {
2839                 ptr = lutil_strncopy( ptr, p, r - p + 1 );
2840                 ptr = lutil_strcopy( ptr, "[ ]?" );
2841
2842                 if ( r[ 1 ] == ' ' ) {
2843                         r++;
2844                 }
2845         }
2846         ptr = lutil_strcopy( ptr, p );
2847         ptr[ 0 ] = '$';
2848         ptr++;
2849         ptr[ 0 ] = '\0';
2850
2851         return res;
2852 }
2853
2854 static char *
2855 suffix_massage_patternize( const char *s, const char *p )
2856 {
2857         ber_len_t       len;
2858         char            *res, *ptr;
2859
2860         len = strlen( p );
2861
2862         if ( s[ 0 ] == '\0' ) {
2863                 len++;
2864         }
2865
2866         res = ch_calloc( sizeof( char ), len + STRLENOF( "%1" ) + 1 );
2867         if ( res == NULL ) {
2868                 return NULL;
2869         }
2870
2871         ptr = lutil_strcopy( res, ( p[ 0 ] == '\0' ? "%2" : "%1" ) );
2872         if ( s[ 0 ] == '\0' ) {
2873                 ptr[ 0 ] = ',';
2874                 ptr++;
2875         }
2876         lutil_strcopy( ptr, p );
2877
2878         return res;
2879 }
2880
2881 int
2882 suffix_massage_config(
2883                 struct rewrite_info *info,
2884                 struct berval *pvnc,
2885                 struct berval *nvnc,
2886                 struct berval *prnc,
2887                 struct berval *nrnc
2888 )
2889 {
2890         char *rargv[ 5 ];
2891         int line = 0;
2892
2893         rargv[ 0 ] = "rewriteEngine";
2894         rargv[ 1 ] = "on";
2895         rargv[ 2 ] = NULL;
2896         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
2897
2898         rargv[ 0 ] = "rewriteContext";
2899         rargv[ 1 ] = "default";
2900         rargv[ 2 ] = NULL;
2901         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
2902
2903         rargv[ 0 ] = "rewriteRule";
2904         rargv[ 1 ] = suffix_massage_regexize( pvnc->bv_val );
2905         rargv[ 2 ] = suffix_massage_patternize( pvnc->bv_val, prnc->bv_val );
2906         rargv[ 3 ] = ":";
2907         rargv[ 4 ] = NULL;
2908         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
2909         ch_free( rargv[ 1 ] );
2910         ch_free( rargv[ 2 ] );
2911
2912         if ( BER_BVISEMPTY( pvnc ) ) {
2913                 rargv[ 0 ] = "rewriteRule";
2914                 rargv[ 1 ] = "^$";
2915                 rargv[ 2 ] = prnc->bv_val;
2916                 rargv[ 3 ] = ":";
2917                 rargv[ 4 ] = NULL;
2918                 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
2919         }
2920
2921         rargv[ 0 ] = "rewriteContext";
2922         rargv[ 1 ] = "searchEntryDN";
2923         rargv[ 2 ] = NULL;
2924         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
2925
2926         rargv[ 0 ] = "rewriteRule";
2927         rargv[ 1 ] = suffix_massage_regexize( prnc->bv_val );
2928         rargv[ 2 ] = suffix_massage_patternize( prnc->bv_val, pvnc->bv_val );
2929         rargv[ 3 ] = ":";
2930         rargv[ 4 ] = NULL;
2931         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
2932         ch_free( rargv[ 1 ] );
2933         ch_free( rargv[ 2 ] );
2934
2935         if ( BER_BVISEMPTY( prnc ) ) {
2936                 rargv[ 0 ] = "rewriteRule";
2937                 rargv[ 1 ] = "^$";
2938                 rargv[ 2 ] = pvnc->bv_val;
2939                 rargv[ 3 ] = ":";
2940                 rargv[ 4 ] = NULL;
2941                 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
2942         }
2943
2944         /* backward compatibility */
2945         rargv[ 0 ] = "rewriteContext";
2946         rargv[ 1 ] = "searchResult";
2947         rargv[ 2 ] = "alias";
2948         rargv[ 3 ] = "searchEntryDN";
2949         rargv[ 4 ] = NULL;
2950         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
2951
2952         rargv[ 0 ] = "rewriteContext";
2953         rargv[ 1 ] = "matchedDN";
2954         rargv[ 2 ] = "alias";
2955         rargv[ 3 ] = "searchEntryDN";
2956         rargv[ 4 ] = NULL;
2957         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
2958
2959         rargv[ 0 ] = "rewriteContext";
2960         rargv[ 1 ] = "searchAttrDN";
2961         rargv[ 2 ] = "alias";
2962         rargv[ 3 ] = "searchEntryDN";
2963         rargv[ 4 ] = NULL;
2964         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
2965
2966         /* NOTE: this corresponds to #undef'ining RWM_REFERRAL_REWRITE;
2967          * see servers/slapd/overlays/rwm.h for details */
2968         rargv[ 0 ] = "rewriteContext";
2969         rargv[ 1 ] = "referralAttrDN";
2970         rargv[ 2 ] = NULL;
2971         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
2972
2973         rargv[ 0 ] = "rewriteContext";
2974         rargv[ 1 ] = "referralDN";
2975         rargv[ 2 ] = NULL;
2976         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
2977
2978         return 0;
2979 }
2980 #endif /* ENABLE_REWRITE */
2981