git.sur5r.net Git - openldap/blob - servers/slapd/back-meta/config.c

   1 /* $OpenLDAP$ */
   2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   3  *
   4  * Copyright 1999-2012 The OpenLDAP Foundation.
   5  * Portions Copyright 2001-2003 Pierangelo Masarati.
   6  * Portions Copyright 1999-2003 Howard Chu.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted only as authorized by the OpenLDAP
  11  * Public License.
  12  *
  13  * A copy of this license is available in the file LICENSE in the
  14  * top-level directory of the distribution or, alternatively, at
  15  * <http://www.OpenLDAP.org/license.html>.
  16  */
  17 /* ACKNOWLEDGEMENTS:
  18  * This work was initially developed by the Howard Chu for inclusion
  19  * in OpenLDAP Software and subsequently enhanced by Pierangelo
  20  * Masarati.
  21  */
  22
  23 #include "portable.h"
  24
  25 #include <stdio.h>
  26
  27 #include <ac/string.h>
  28 #include <ac/socket.h>
  29
  30 #include "slap.h"
  31 #include "config.h"
  32 #include "lutil.h"
  33 #include "../back-ldap/back-ldap.h"
  34 #include "back-meta.h"
  35
  36 #ifdef LDAP_DEVEL
  37 #define SLAP_AUTH_DN    1
  38 #endif
  39
  40 static ConfigDriver meta_back_cf_gen;
  41 static ConfigLDAPadd meta_ldadd;
  42 static ConfigCfAdd meta_cfadd;
  43
  44 static int ldap_back_map_config(
  45         ConfigArgs *c,
  46         struct ldapmap  *oc_map,
  47         struct ldapmap  *at_map );
  48
  49 /* Three sets of enums:
  50  *      1) attrs that are only valid in the base config
  51  *      2) attrs that are valid in base or target
  52  *      3) attrs that are only valid in a target
  53  */
  54
  55 /* Base attrs */
  56 enum {
  57         LDAP_BACK_CFG_CONN_TTL = 1,
  58         LDAP_BACK_CFG_DNCACHE_TTL,
  59         LDAP_BACK_CFG_IDLE_TIMEOUT,
  60         LDAP_BACK_CFG_ONERR,
  61         LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
  62         LDAP_BACK_CFG_SINGLECONN,
  63         LDAP_BACK_CFG_USETEMP,
  64         LDAP_BACK_CFG_CONNPOOLMAX,
  65         LDAP_BACK_CFG_LAST_BASE
  66 };
  67
  68 /* Base or target */
  69 enum {
  70         LDAP_BACK_CFG_BIND_TIMEOUT = LDAP_BACK_CFG_LAST_BASE,
  71         LDAP_BACK_CFG_CANCEL,
  72         LDAP_BACK_CFG_CHASE,
  73         LDAP_BACK_CFG_CLIENT_PR,
  74         LDAP_BACK_CFG_DEFAULT_T,
  75         LDAP_BACK_CFG_NETWORK_TIMEOUT,
  76         LDAP_BACK_CFG_NOREFS,
  77         LDAP_BACK_CFG_NOUNDEFFILTER,
  78         LDAP_BACK_CFG_NRETRIES,
  79         LDAP_BACK_CFG_QUARANTINE,
  80         LDAP_BACK_CFG_REBIND,
  81         LDAP_BACK_CFG_TIMEOUT,
  82         LDAP_BACK_CFG_VERSION,
  83         LDAP_BACK_CFG_ST_REQUEST,
  84         LDAP_BACK_CFG_T_F,
  85         LDAP_BACK_CFG_TLS,
  86         LDAP_BACK_CFG_LAST_BOTH
  87 };
  88
  89 /* Target attrs */
  90 enum {
  91         LDAP_BACK_CFG_URI = LDAP_BACK_CFG_LAST_BOTH,
  92         LDAP_BACK_CFG_ACL_AUTHCDN,
  93         LDAP_BACK_CFG_ACL_PASSWD,
  94         LDAP_BACK_CFG_IDASSERT_AUTHZFROM,
  95         LDAP_BACK_CFG_IDASSERT_BIND,
  96         LDAP_BACK_CFG_REWRITE,
  97         LDAP_BACK_CFG_SUFFIXM,
  98         LDAP_BACK_CFG_MAP,
  99         LDAP_BACK_CFG_SUBTREE_EX,
 100         LDAP_BACK_CFG_SUBTREE_IN,
 101         LDAP_BACK_CFG_PSEUDOROOTDN,
 102         LDAP_BACK_CFG_PSEUDOROOTPW,
 103
 104         LDAP_BACK_CFG_LAST
 105 };
 106
 107 static ConfigTable metacfg[] = {
 108         { "uri", "uri", 2, 0, 0,
 109                 ARG_MAGIC|LDAP_BACK_CFG_URI,
 110                 meta_back_cf_gen, "( OLcfgDbAt:0.14 "
 111                         "NAME 'olcDbURI' "
 112                         "DESC 'URI (list) for remote DSA' "
 113                         "SYNTAX OMsDirectoryString "
 114                         "SINGLE-VALUE )",
 115                 NULL, NULL },
 116         { "tls", "what", 2, 0, 0,
 117                 ARG_MAGIC|LDAP_BACK_CFG_TLS,
 118                 meta_back_cf_gen, "( OLcfgDbAt:3.1 "
 119                         "NAME 'olcDbStartTLS' "
 120                         "DESC 'StartTLS' "
 121                         "SYNTAX OMsDirectoryString "
 122                         "SINGLE-VALUE )",
 123                 NULL, NULL },
 124         { "acl-authcDN", "DN", 2, 2, 0,
 125                 ARG_DN|ARG_MAGIC|LDAP_BACK_CFG_ACL_AUTHCDN,
 126                 meta_back_cf_gen, "( OLcfgDbAt:3.2 "
 127                         "NAME 'olcDbACLAuthcDn' "
 128                         "DESC 'Remote ACL administrative identity' "
 129                         "OBSOLETE "
 130                         "SYNTAX OMsDN "
 131                         "SINGLE-VALUE )",
 132                 NULL, NULL },
 133         /* deprecated, will be removed; aliases "acl-authcDN" */
 134         { "binddn", "DN", 2, 2, 0,
 135                 ARG_DN|ARG_MAGIC|LDAP_BACK_CFG_ACL_AUTHCDN,
 136                 meta_back_cf_gen, NULL, NULL, NULL },
 137         { "acl-passwd", "cred", 2, 2, 0,
 138                 ARG_MAGIC|LDAP_BACK_CFG_ACL_PASSWD,
 139                 meta_back_cf_gen, "( OLcfgDbAt:3.3 "
 140                         "NAME 'olcDbACLPasswd' "
 141                         "DESC 'Remote ACL administrative identity credentials' "
 142                         "OBSOLETE "
 143                         "SYNTAX OMsDirectoryString "
 144                         "SINGLE-VALUE )",
 145                 NULL, NULL },
 146         /* deprecated, will be removed; aliases "acl-passwd" */
 147         { "bindpw", "cred", 2, 2, 0,
 148                 ARG_MAGIC|LDAP_BACK_CFG_ACL_PASSWD,
 149                 meta_back_cf_gen, NULL, NULL, NULL },
 150         { "idassert-bind", "args", 2, 0, 0,
 151                 ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_BIND,
 152                 meta_back_cf_gen, "( OLcfgDbAt:3.7 "
 153                         "NAME 'olcDbIDAssertBind' "
 154                         "DESC 'Remote Identity Assertion administrative identity auth bind configuration' "
 155                         "SYNTAX OMsDirectoryString "
 156                         "SINGLE-VALUE )",
 157                 NULL, NULL },
 158         { "idassert-authzFrom", "authzRule", 2, 2, 0,
 159                 ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_AUTHZFROM,
 160                 meta_back_cf_gen, "( OLcfgDbAt:3.9 "
 161                         "NAME 'olcDbIDAssertAuthzFrom' "
 162                         "DESC 'Remote Identity Assertion authz rules' "
 163                         "EQUALITY caseIgnoreMatch "
 164                         "SYNTAX OMsDirectoryString "
 165                         "X-ORDERED 'VALUES' )",
 166                 NULL, NULL },
 167         { "rebind-as-user", "true|FALSE", 1, 2, 0,
 168                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_REBIND,
 169                 meta_back_cf_gen, "( OLcfgDbAt:3.10 "
 170                         "NAME 'olcDbRebindAsUser' "
 171                         "DESC 'Rebind as user' "
 172                         "SYNTAX OMsBoolean "
 173                         "SINGLE-VALUE )",
 174                 NULL, NULL },
 175         { "chase-referrals", "true|FALSE", 2, 2, 0,
 176                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_CHASE,
 177                 meta_back_cf_gen, "( OLcfgDbAt:3.11 "
 178                         "NAME 'olcDbChaseReferrals' "
 179                         "DESC 'Chase referrals' "
 180                         "SYNTAX OMsBoolean "
 181                         "SINGLE-VALUE )",
 182                 NULL, NULL },
 183         { "t-f-support", "true|FALSE|discover", 2, 2, 0,
 184                 ARG_MAGIC|LDAP_BACK_CFG_T_F,
 185                 meta_back_cf_gen, "( OLcfgDbAt:3.12 "
 186                         "NAME 'olcDbTFSupport' "
 187                         "DESC 'Absolute filters support' "
 188                         "SYNTAX OMsDirectoryString "
 189                         "SINGLE-VALUE )",
 190                 NULL, NULL },
 191         { "timeout", "timeout(list)", 2, 0, 0,
 192                 ARG_MAGIC|LDAP_BACK_CFG_TIMEOUT,
 193                 meta_back_cf_gen, "( OLcfgDbAt:3.14 "
 194                         "NAME 'olcDbTimeout' "
 195                         "DESC 'Per-operation timeouts' "
 196                         "SYNTAX OMsDirectoryString "
 197                         "SINGLE-VALUE )",
 198                 NULL, NULL },
 199         { "idle-timeout", "timeout", 2, 2, 0,
 200                 ARG_MAGIC|LDAP_BACK_CFG_IDLE_TIMEOUT,
 201                 meta_back_cf_gen, "( OLcfgDbAt:3.15 "
 202                         "NAME 'olcDbIdleTimeout' "
 203                         "DESC 'connection idle timeout' "
 204                         "SYNTAX OMsDirectoryString "
 205                         "SINGLE-VALUE )",
 206                 NULL, NULL },
 207         { "conn-ttl", "ttl", 2, 2, 0,
 208                 ARG_MAGIC|LDAP_BACK_CFG_CONN_TTL,
 209                 meta_back_cf_gen, "( OLcfgDbAt:3.16 "
 210                         "NAME 'olcDbConnTtl' "
 211                         "DESC 'connection ttl' "
 212                         "SYNTAX OMsDirectoryString "
 213                         "SINGLE-VALUE )",
 214                 NULL, NULL },
 215         { "network-timeout", "timeout", 2, 2, 0,
 216                 ARG_MAGIC|LDAP_BACK_CFG_NETWORK_TIMEOUT,
 217                 meta_back_cf_gen, "( OLcfgDbAt:3.17 "
 218                         "NAME 'olcDbNetworkTimeout' "
 219                         "DESC 'connection network timeout' "
 220                         "SYNTAX OMsDirectoryString "
 221                         "SINGLE-VALUE )",
 222                 NULL, NULL },
 223         { "protocol-version", "version", 2, 2, 0,
 224                 ARG_MAGIC|ARG_INT|LDAP_BACK_CFG_VERSION,
 225                 meta_back_cf_gen, "( OLcfgDbAt:3.18 "
 226                         "NAME 'olcDbProtocolVersion' "
 227                         "DESC 'protocol version' "
 228                         "SYNTAX OMsInteger "
 229                         "SINGLE-VALUE )",
 230                 NULL, NULL },
 231         { "single-conn", "true|FALSE", 2, 2, 0,
 232                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_SINGLECONN,
 233                 meta_back_cf_gen, "( OLcfgDbAt:3.19 "
 234                         "NAME 'olcDbSingleConn' "
 235                         "DESC 'cache a single connection per identity' "
 236                         "SYNTAX OMsBoolean "
 237                         "SINGLE-VALUE )",
 238                 NULL, NULL },
 239         { "cancel", "ABANDON|ignore|exop", 2, 2, 0,
 240                 ARG_MAGIC|LDAP_BACK_CFG_CANCEL,
 241                 meta_back_cf_gen, "( OLcfgDbAt:3.20 "
 242                         "NAME 'olcDbCancel' "
 243                         "DESC 'abandon/ignore/exop operations when appropriate' "
 244                         "SYNTAX OMsDirectoryString "
 245                         "SINGLE-VALUE )",
 246                 NULL, NULL },
 247         { "quarantine", "retrylist", 2, 2, 0,
 248                 ARG_MAGIC|LDAP_BACK_CFG_QUARANTINE,
 249                 meta_back_cf_gen, "( OLcfgDbAt:3.21 "
 250                         "NAME 'olcDbQuarantine' "
 251                         "DESC 'Quarantine database if connection fails and retry according to rule' "
 252                         "SYNTAX OMsDirectoryString "
 253                         "SINGLE-VALUE )",
 254                 NULL, NULL },
 255         { "use-temporary-conn", "true|FALSE", 2, 2, 0,
 256                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_USETEMP,
 257                 meta_back_cf_gen, "( OLcfgDbAt:3.22 "
 258                         "NAME 'olcDbUseTemporaryConn' "
 259                         "DESC 'Use temporary connections if the cached one is busy' "
 260                         "SYNTAX OMsBoolean "
 261                         "SINGLE-VALUE )",
 262                 NULL, NULL },
 263         { "conn-pool-max", "<n>", 2, 2, 0,
 264                 ARG_MAGIC|ARG_INT|LDAP_BACK_CFG_CONNPOOLMAX,
 265                 meta_back_cf_gen, "( OLcfgDbAt:3.23 "
 266                         "NAME 'olcDbConnectionPoolMax' "
 267                         "DESC 'Max size of privileged connections pool' "
 268                         "SYNTAX OMsInteger "
 269                         "SINGLE-VALUE )",
 270                 NULL, NULL },
 271 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
 272         { "session-tracking-request", "true|FALSE", 2, 2, 0,
 273                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_ST_REQUEST,
 274                 meta_back_cf_gen, "( OLcfgDbAt:3.24 "
 275                         "NAME 'olcDbSessionTrackingRequest' "
 276                         "DESC 'Add session tracking control to proxied requests' "
 277                         "SYNTAX OMsBoolean "
 278                         "SINGLE-VALUE )",
 279                 NULL, NULL },
 280 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
 281         { "norefs", "true|FALSE", 2, 2, 0,
 282                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_NOREFS,
 283                 meta_back_cf_gen, "( OLcfgDbAt:3.25 "
 284                         "NAME 'olcDbNoRefs' "
 285                         "DESC 'Do not return search reference responses' "
 286                         "SYNTAX OMsBoolean "
 287                         "SINGLE-VALUE )",
 288                 NULL, NULL },
 289         { "noundeffilter", "true|FALSE", 2, 2, 0,
 290                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_NOUNDEFFILTER,
 291                 meta_back_cf_gen, "( OLcfgDbAt:3.26 "
 292                         "NAME 'olcDbNoUndefFilter' "
 293                         "DESC 'Do not propagate undefined search filters' "
 294                         "SYNTAX OMsBoolean "
 295                         "SINGLE-VALUE )",
 296                 NULL, NULL },
 297
 298         { "rewrite", "arglist", 2, 0, STRLENOF( "rewrite" ),
 299                 ARG_MAGIC|LDAP_BACK_CFG_REWRITE,
 300                 meta_back_cf_gen, "( OLcfgDbAt:3.101 "
 301                         "NAME 'olcDbRewrite' "
 302                         "DESC 'DN rewriting rules' "
 303                         "EQUALITY caseIgnoreMatch "
 304                         "SYNTAX OMsDirectoryString "
 305                         "X-ORDERED 'VALUES' )",
 306                 NULL, NULL },
 307         { "suffixmassage", "virtual> <real", 2, 3, 0,
 308                 ARG_MAGIC|LDAP_BACK_CFG_SUFFIXM,
 309                 meta_back_cf_gen, NULL, NULL, NULL },
 310
 311         { "map", "attribute|objectClass> [*|<local>] *|<remote", 3, 4, 0,
 312                 ARG_MAGIC|LDAP_BACK_CFG_MAP,
 313                 meta_back_cf_gen, "( OLcfgDbAt:3.102 "
 314                         "NAME 'olcDbMap' "
 315                         "DESC 'Map attribute and objectclass names' "
 316                         "EQUALITY caseIgnoreMatch "
 317                         "SYNTAX OMsDirectoryString "
 318                         "X-ORDERED 'VALUES' )",
 319                 NULL, NULL },
 320
 321         { "subtree-exclude", "pattern", 2, 2, 0,
 322                 ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_SUBTREE_EX,
 323                 meta_back_cf_gen, "( OLcfgDbAt:3.103 "
 324                         "NAME 'olcDbSubtreeExclude' "
 325                         "DESC 'DN of subtree to exclude from target' "
 326                         "EQUALITY caseIgnoreMatch "
 327                         "SYNTAX OMsDirectoryString )",
 328                 NULL, NULL },
 329         { "subtree-include", "pattern", 2, 2, 0,
 330                 ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_SUBTREE_IN,
 331                 meta_back_cf_gen, "( OLcfgDbAt:3.104 "
 332                         "NAME 'olcDbSubtreeInclude' "
 333                         "DESC 'DN of subtree to include in target' "
 334                         "EQUALITY caseIgnoreMatch "
 335                         "SYNTAX OMsDirectoryString )",
 336                 NULL, NULL },
 337         { "default-target", "[none|<target ID>]", 1, 2, 0,
 338                 ARG_MAGIC|LDAP_BACK_CFG_DEFAULT_T,
 339                 meta_back_cf_gen, "( OLcfgDbAt:3.105 "
 340                         "NAME 'olcDbDefaultTarget' "
 341                         "DESC 'Specify the default target' "
 342                         "SYNTAX OMsDirectoryString "
 343                         "SINGLE-VALUE )",
 344                 NULL, NULL },
 345         { "dncache-ttl", "ttl", 2, 2, 0,
 346                 ARG_MAGIC|LDAP_BACK_CFG_DNCACHE_TTL,
 347                 meta_back_cf_gen, "( OLcfgDbAt:3.106 "
 348                         "NAME 'olcDbDnCacheTtl' "
 349                         "DESC 'dncache ttl' "
 350                         "SYNTAX OMsDirectoryString "
 351                         "SINGLE-VALUE )",
 352                 NULL, NULL },
 353         { "bind-timeout", "microseconds", 2, 2, 0,
 354                 ARG_MAGIC|ARG_ULONG|LDAP_BACK_CFG_BIND_TIMEOUT,
 355                 meta_back_cf_gen, "( OLcfgDbAt:3.107 "
 356                         "NAME 'olcDbBindTimeout' "
 357                         "DESC 'bind timeout' "
 358                         "SYNTAX OMsDirectoryString "
 359                         "SINGLE-VALUE )",
 360                 NULL, NULL },
 361         { "onerr", "CONTINUE|report|stop", 2, 2, 0,
 362                 ARG_MAGIC|LDAP_BACK_CFG_ONERR,
 363                 meta_back_cf_gen, "( OLcfgDbAt:3.108 "
 364                         "NAME 'olcDbOnErr' "
 365                         "DESC 'error handling' "
 366                         "SYNTAX OMsDirectoryString "
 367                         "SINGLE-VALUE )",
 368                 NULL, NULL },
 369         { "pseudoroot-bind-defer", "TRUE|false", 2, 2, 0,
 370                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
 371                 meta_back_cf_gen, "( OLcfgDbAt:3.109 "
 372                         "NAME 'olcDbPseudoRootBindDefer' "
 373                         "DESC 'error handling' "
 374                         "SYNTAX OMsBoolean "
 375                         "SINGLE-VALUE )",
 376                 NULL, NULL },
 377         { "root-bind-defer", "TRUE|false", 2, 2, 0,
 378                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
 379                 meta_back_cf_gen, NULL, NULL, NULL },
 380         { "pseudorootdn", "dn", 2, 2, 0,
 381                 ARG_MAGIC|ARG_DN|LDAP_BACK_CFG_PSEUDOROOTDN,
 382                 meta_back_cf_gen, NULL, NULL, NULL },
 383         { "pseudorootpw", "password", 2, 2, 0,
 384                 ARG_MAGIC|ARG_STRING|LDAP_BACK_CFG_PSEUDOROOTDN,
 385                 meta_back_cf_gen, NULL, NULL, NULL },
 386         { "nretries", "NEVER|forever|<number>", 2, 2, 0,
 387                 ARG_MAGIC|LDAP_BACK_CFG_NRETRIES,
 388                 meta_back_cf_gen, "( OLcfgDbAt:3.110 "
 389                         "NAME 'olcDbNretries' "
 390                         "DESC 'retry handling' "
 391                         "SYNTAX OMsDirectoryString "
 392                         "SINGLE-VALUE )",
 393                 NULL, NULL },
 394         { "client-pr", "accept-unsolicited|disable|<size>", 2, 2, 0,
 395                 ARG_MAGIC|LDAP_BACK_CFG_CLIENT_PR,
 396                 meta_back_cf_gen, "( OLcfgDbAt:3.111 "
 397                         "NAME 'olcDbClientPr' "
 398                         "DESC 'PagedResults handling' "
 399                         "SYNTAX OMsDirectoryString "
 400                         "SINGLE-VALUE )",
 401                 NULL, NULL },
 402
 403         { "", "", 0, 0, 0, ARG_IGNORED,
 404                 NULL, "( OLcfgDbAt:3.100 NAME 'olcMetaSub' "
 405                         "DESC 'Placeholder to name a Target entry' "
 406                         "EQUALITY caseIgnoreMatch "
 407                         "SYNTAX OMsDirectoryString "
 408                         "SINGLE-VALUE X-ORDERED 'SIBLINGS' )", NULL, NULL },
 409
 410         { NULL, NULL, 0, 0, 0, ARG_IGNORED,
 411                 NULL, NULL, NULL, NULL }
 412 };
 413
 414 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
 415 #define ST_ATTR "$ olcDbSessionTrackingRequest "
 416 #else
 417 #define ST_ATTR ""
 418 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
 419
 420 #define COMMON_ATTRS    \
 421                         "$ olcDbBindTimeout " \
 422                         "$ olcDbCancel " \
 423                         "$ olcDbChaseReferrals " \
 424                         "$ olcDbClientPr " \
 425                         "$ olcDbDefaultTarget " \
 426                         "$ olcDbNetworkTimeout " \
 427                         "$ olcDbNoRefs " \
 428                         "$ olcDbNoUndefFilter " \
 429                         "$ olcDbNretries " \
 430                         "$ olcDbProtocolVersion " \
 431                         "$ olcDbQuarantine " \
 432                         "$ olcDbRebindAsUser " \
 433                         ST_ATTR \
 434                         "$ olcDbStartTLS " \
 435                         "$ olcDbTFSupport "
 436
 437 static ConfigOCs metaocs[] = {
 438         { "( OLcfgDbOc:3.2 "
 439                 "NAME 'olcMetaConfig' "
 440                 "DESC 'Meta backend configuration' "
 441                 "SUP olcDatabaseConfig "
 442                 "MAY ( olcDbConnTtl "
 443                         "$ olcDbDnCacheTtl "
 444                         "$ olcDbIdleTimeout "
 445                         "$ olcDbOnErr "
 446                         "$ olcDbPseudoRootBindDefer "
 447                         "$ olcDbSingleConn "
 448                         "$ olcDbUseTemporaryConn "
 449                         "$ olcDbConnectionPoolMax "
 450
 451                         /* defaults, may be overridden per-target */
 452                         COMMON_ATTRS
 453                 ") )",
 454                         Cft_Database, metacfg, NULL, meta_cfadd },
 455         { "( OLcfgDbOc:3.3 "
 456                 "NAME 'olcMetaTargetConfig' "
 457                 "DESC 'Meta target configuration' "
 458                 "SUP olcConfig STRUCTURAL "
 459                 "MUST ( olcMetaSub $ olcDbURI ) "
 460                 "MAY ( olcDbACLAuthcDn "
 461                         "$ olcDbACLPasswd "
 462                         "$ olcDbIDAssertAuthzFrom "
 463                         "$ olcDbIDAssertBind "
 464                         "$ olcDbMap "
 465                         "$ olcDbRewrite "
 466                         "$ olcDbSubtreeExclude "
 467                         "$ olcDbSubtreeInclude "
 468                         "$ olcDbTimeout "
 469
 470                         /* defaults may be inherited */
 471                         COMMON_ATTRS
 472                 ") )",
 473                         Cft_Misc, metacfg, meta_ldadd },
 474         { NULL, 0, NULL }
 475 };
 476
 477 static int
 478 meta_ldadd( CfEntryInfo *p, Entry *e, ConfigArgs *c )
 479 {
 480         if ( p->ce_type != Cft_Database || !p->ce_be ||
 481                 p->ce_be->be_cf_ocs != metaocs )
 482                 return LDAP_CONSTRAINT_VIOLATION;
 483
 484         c->be = p->ce_be;
 485         return LDAP_SUCCESS;
 486 }
 487
 488 static int
 489 meta_cfadd( Operation *op, SlapReply *rs, Entry *p, ConfigArgs *c )
 490 {
 491         metainfo_t      *mi = ( metainfo_t * )c->be->be_private;
 492         struct berval bv;
 493         int i;
 494
 495         bv.bv_val = c->cr_msg;
 496         for ( i=0; i<mi->mi_ntargets; i++ ) {
 497                 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg),
 498                         "olcMetaSub=" SLAP_X_ORDERED_FMT "uri", i );
 499                 c->ca_private = mi->mi_targets[i];
 500                 c->valx = i;
 501                 config_build_entry( op, rs, p->e_private, c,
 502                         &bv, &metaocs[1], NULL );
 503         }
 504
 505         return LDAP_SUCCESS;
 506 }
 507
 508 static int
 509 meta_rwi_init( struct rewrite_info **rwm_rw )
 510 {
 511         char                    *rargv[ 3 ];
 512
 513         *rwm_rw = rewrite_info_init( REWRITE_MODE_USE_DEFAULT );
 514         if ( *rwm_rw == NULL ) {
 515                 return -1;
 516         }
 517         /*
 518          * the filter rewrite as a string must be disabled
 519          * by default; it can be re-enabled by adding rules;
 520          * this creates an empty rewriteContext
 521          */
 522         rargv[ 0 ] = "rewriteContext";
 523         rargv[ 1 ] = "searchFilter";
 524         rargv[ 2 ] = NULL;
 525         rewrite_parse( *rwm_rw, "<suffix massage>", 1, 2, rargv );
 526
 527         rargv[ 0 ] = "rewriteContext";
 528         rargv[ 1 ] = "default";
 529         rargv[ 2 ] = NULL;
 530         rewrite_parse( *rwm_rw, "<suffix massage>", 1, 2, rargv );
 531
 532         return 0;
 533 }
 534
 535 static int
 536 meta_back_new_target(
 537         metatarget_t    **mtp )
 538 {
 539         metatarget_t            *mt;
 540
 541         *mtp = NULL;
 542
 543         mt = ch_calloc( sizeof( metatarget_t ), 1 );
 544
 545         if ( meta_rwi_init( &mt->mt_rwmap.rwm_rw )) {
 546                 ch_free( mt );
 547                 return -1;
 548         }
 549
 550         ldap_pvt_thread_mutex_init( &mt->mt_uri_mutex );
 551
 552         mt->mt_idassert_mode = LDAP_BACK_IDASSERT_LEGACY;
 553         mt->mt_idassert_authmethod = LDAP_AUTH_NONE;
 554         mt->mt_idassert_tls = SB_TLS_DEFAULT;
 555
 556         /* by default, use proxyAuthz control on each operation */
 557         mt->mt_idassert_flags = LDAP_BACK_AUTH_PRESCRIPTIVE;
 558
 559         *mtp = mt;
 560
 561         return 0;
 562 }
 563
 564 /* Validation for suffixmassage_config */
 565 static int
 566 meta_suffixm_config(
 567         ConfigArgs *c,
 568         int argc,
 569         char **argv,
 570         metatarget_t *mt
 571 )
 572 {
 573         BackendDB       *tmp_bd;
 574         struct berval   dn, nvnc, pvnc, nrnc, prnc;
 575         int j, rc;
 576
 577         /*
 578          * syntax:
 579          *
 580          *      suffixmassage <suffix> <massaged suffix>
 581          *
 582          * the <suffix> field must be defined as a valid suffix
 583          * (or suffixAlias?) for the current database;
 584          * the <massaged suffix> shouldn't have already been
 585          * defined as a valid suffix or suffixAlias for the
 586          * current server
 587          */
 588
 589         ber_str2bv( argv[ 1 ], 0, 0, &dn );
 590         if ( dnPrettyNormal( NULL, &dn, &pvnc, &nvnc, NULL ) != LDAP_SUCCESS ) {
 591                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
 592                         "suffix \"%s\" is invalid",
 593                         argv[1] );
 594                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
 595                 return 1;
 596         }
 597
 598         for ( j = 0; !BER_BVISNULL( &c->be->be_nsuffix[ j ] ); j++ ) {
 599                 if ( dnIsSuffix( &nvnc, &c->be->be_nsuffix[ 0 ] ) ) {
 600                         break;
 601                 }
 602         }
 603
 604         if ( BER_BVISNULL( &c->be->be_nsuffix[ j ] ) ) {
 605                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
 606                         "suffix \"%s\" must be within the database naming context",
 607                         argv[1] );
 608                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
 609                 free( pvnc.bv_val );
 610                 free( nvnc.bv_val );
 611                 return 1;
 612         }
 613
 614         ber_str2bv( argv[ 2 ], 0, 0, &dn );
 615         if ( dnPrettyNormal( NULL, &dn, &prnc, &nrnc, NULL ) != LDAP_SUCCESS ) {
 616                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
 617                         "massaged suffix \"%s\" is invalid",
 618                         argv[2] );
 619                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
 620                 free( pvnc.bv_val );
 621                 free( nvnc.bv_val );
 622                 return 1;
 623         }
 624
 625         tmp_bd = select_backend( &nrnc, 0 );
 626         if ( tmp_bd != NULL && tmp_bd->be_private == c->be->be_private ) {
 627                 Debug( LDAP_DEBUG_ANY,
 628         "%s: warning: <massaged suffix> \"%s\" resolves to this database, in "
 629         "\"suffixMassage <suffix> <massaged suffix>\"\n",
 630                         c->log, prnc.bv_val, 0 );
 631         }
 632
 633         /*
 634          * The suffix massaging is emulated by means of the
 635          * rewrite capabilities
 636          */
 637         rc = suffix_massage_config( mt->mt_rwmap.rwm_rw,
 638                         &pvnc, &nvnc, &prnc, &nrnc );
 639
 640         free( pvnc.bv_val );
 641         free( nvnc.bv_val );
 642         free( prnc.bv_val );
 643         free( nrnc.bv_val );
 644
 645         return rc;
 646 }
 647
 648 static int
 649 slap_bv_x_ordered_unparse( BerVarray in, BerVarray *out )
 650 {
 651         int             i;
 652         BerVarray       bva = NULL;
 653         char            ibuf[32], *ptr;
 654         struct berval   idx;
 655
 656         assert( in != NULL );
 657
 658         for ( i = 0; !BER_BVISNULL( &in[i] ); i++ )
 659                 /* count'em */ ;
 660
 661         if ( i == 0 ) {
 662                 return 1;
 663         }
 664
 665         idx.bv_val = ibuf;
 666
 667         bva = ch_malloc( ( i + 1 ) * sizeof(struct berval) );
 668         BER_BVZERO( &bva[ 0 ] );
 669
 670         for ( i = 0; !BER_BVISNULL( &in[i] ); i++ ) {
 671                 idx.bv_len = snprintf( idx.bv_val, sizeof( ibuf ), SLAP_X_ORDERED_FMT, i );
 672                 if ( idx.bv_len >= sizeof( ibuf ) ) {
 673                         ber_bvarray_free( bva );
 674                         return 1;
 675                 }
 676
 677                 bva[i].bv_len = idx.bv_len + in[i].bv_len;
 678                 bva[i].bv_val = ch_malloc( bva[i].bv_len + 1 );
 679                 ptr = lutil_strcopy( bva[i].bv_val, ibuf );
 680                 ptr = lutil_strcopy( ptr, in[i].bv_val );
 681                 *ptr = '\0';
 682                 BER_BVZERO( &bva[ i + 1 ] );
 683         }
 684
 685         *out = bva;
 686         return 0;
 687 }
 688
 689 int
 690 meta_subtree_free( metasubtree_t *ms )
 691 {
 692         switch ( ms->ms_type ) {
 693         case META_ST_SUBTREE:
 694         case META_ST_SUBORDINATE:
 695                 ber_memfree( ms->ms_dn.bv_val );
 696                 break;
 697
 698         case META_ST_REGEX:
 699                 regfree( &ms->ms_regex );
 700                 ber_memfree( ms->ms_regex_pattern.bv_val );
 701                 break;
 702
 703         default:
 704                 return -1;
 705         }
 706
 707         ch_free( ms );
 708         return 0;
 709 }
 710
 711 int
 712 meta_subtree_destroy( metasubtree_t *ms )
 713 {
 714         if ( ms->ms_next ) {
 715                 meta_subtree_destroy( ms->ms_next );
 716         }
 717
 718         return meta_subtree_free( ms );
 719 }
 720
 721 static struct berval st_styles[] = {
 722         BER_BVC("subtree"),
 723         BER_BVC("children"),
 724         BER_BVC("regex")
 725 };
 726
 727 static int
 728 meta_subtree_unparse(
 729         ConfigArgs *c,
 730         metatarget_t *mt )
 731 {
 732         metasubtree_t   *ms;
 733         struct berval bv, *style;
 734
 735         if ( !mt->mt_subtree )
 736                 return 1;
 737
 738         /* can only be one of exclude or include */
 739         if (( c->type == LDAP_BACK_CFG_SUBTREE_EX ) ^ mt->mt_subtree_exclude )
 740                 return 1;
 741
 742         bv.bv_val = c->cr_msg;
 743         for ( ms=mt->mt_subtree; ms; ms=ms->ms_next ) {
 744                 if (ms->ms_type == META_ST_SUBTREE)
 745                         style = &st_styles[0];
 746                 else if ( ms->ms_type == META_ST_SUBORDINATE )
 747                         style = &st_styles[1];
 748                 else if ( ms->ms_type == META_ST_REGEX )
 749                         style = &st_styles[2];
 750                 else {
 751                         assert(0);
 752                         continue;
 753                 }
 754                 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg),
 755                         "dn.%s:%s", style->bv_val, ms->ms_dn.bv_val );
 756                 value_add_one( &c->rvalue_vals, &bv );
 757         }
 758         return 0;
 759 }
 760
 761 static int
 762 meta_subtree_config(
 763         metatarget_t *mt,
 764         ConfigArgs *c )
 765 {
 766         meta_st_t       type = META_ST_SUBTREE;
 767         char            *pattern;
 768         struct berval   ndn = BER_BVNULL;
 769         metasubtree_t   *ms = NULL;
 770
 771         if ( c->type == LDAP_BACK_CFG_SUBTREE_EX ) {
 772                 if ( mt->mt_subtree && !mt->mt_subtree_exclude ) {
 773                         snprintf( c->cr_msg, sizeof(c->cr_msg),
 774                                 "\"subtree-exclude\" incompatible with previous \"subtree-include\" directives" );
 775                         return 1;
 776                 }
 777
 778                 mt->mt_subtree_exclude = 1;
 779
 780         } else {
 781                 if ( mt->mt_subtree && mt->mt_subtree_exclude ) {
 782                         snprintf( c->cr_msg, sizeof(c->cr_msg),
 783                                 "\"subtree-include\" incompatible with previous \"subtree-exclude\" directives" );
 784                         return 1;
 785                 }
 786         }
 787
 788         pattern = c->argv[1];
 789         if ( strncasecmp( pattern, "dn", STRLENOF( "dn" ) ) == 0 ) {
 790                 char *style;
 791
 792                 pattern = &pattern[STRLENOF( "dn")];
 793
 794                 if ( pattern[0] == '.' ) {
 795                         style = &pattern[1];
 796
 797                         if ( strncasecmp( style, "subtree", STRLENOF( "subtree" ) ) == 0 ) {
 798                                 type = META_ST_SUBTREE;
 799                                 pattern = &style[STRLENOF( "subtree" )];
 800
 801                         } else if ( strncasecmp( style, "children", STRLENOF( "children" ) ) == 0 ) {
 802                                 type = META_ST_SUBORDINATE;
 803                                 pattern = &style[STRLENOF( "children" )];
 804
 805                         } else if ( strncasecmp( style, "sub", STRLENOF( "sub" ) ) == 0 ) {
 806                                 type = META_ST_SUBTREE;
 807                                 pattern = &style[STRLENOF( "sub" )];
 808
 809                         } else if ( strncasecmp( style, "regex", STRLENOF( "regex" ) ) == 0 ) {
 810                                 type = META_ST_REGEX;
 811                                 pattern = &style[STRLENOF( "regex" )];
 812
 813                         } else {
 814                                 snprintf( c->cr_msg, sizeof(c->cr_msg), "unknown style in \"dn.<style>\"" );
 815                                 return 1;
 816                         }
 817                 }
 818
 819                 if ( pattern[0] != ':' ) {
 820                         snprintf( c->cr_msg, sizeof(c->cr_msg), "missing colon after \"dn.<style>\"" );
 821                         return 1;
 822                 }
 823                 pattern++;
 824         }
 825
 826         switch ( type ) {
 827         case META_ST_SUBTREE:
 828         case META_ST_SUBORDINATE: {
 829                 struct berval dn;
 830
 831                 ber_str2bv( pattern, 0, 0, &dn );
 832                 if ( dnNormalize( 0, NULL, NULL, &dn, &ndn, NULL )
 833                         != LDAP_SUCCESS )
 834                 {
 835                         snprintf( c->cr_msg, sizeof(c->cr_msg), "DN=\"%s\" is invalid", pattern );
 836                         return 1;
 837                 }
 838
 839                 if ( !dnIsSuffix( &ndn, &mt->mt_nsuffix ) ) {
 840                         snprintf( c->cr_msg, sizeof(c->cr_msg),
 841                                 "DN=\"%s\" is not a subtree of target \"%s\"",
 842                                 pattern, mt->mt_nsuffix.bv_val );
 843                         ber_memfree( ndn.bv_val );
 844                         return( 1 );
 845                 }
 846                 } break;
 847
 848         default:
 849                 /* silence warnings */
 850                 break;
 851         }
 852
 853         ms = ch_calloc( sizeof( metasubtree_t ), 1 );
 854         ms->ms_type = type;
 855
 856         switch ( ms->ms_type ) {
 857         case META_ST_SUBTREE:
 858         case META_ST_SUBORDINATE:
 859                 ms->ms_dn = ndn;
 860                 break;
 861
 862         case META_ST_REGEX: {
 863                 int rc;
 864
 865                 rc = regcomp( &ms->ms_regex, pattern, REG_EXTENDED|REG_ICASE );
 866                 if ( rc != 0 ) {
 867                         char regerr[ SLAP_TEXT_BUFLEN ];
 868
 869                         regerror( rc, &ms->ms_regex, regerr, sizeof(regerr) );
 870
 871                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
 872                                 "regular expression \"%s\" bad because of %s",
 873                                 pattern, regerr );
 874                         ch_free( ms );
 875                         return 1;
 876                 }
 877                 ber_str2bv( pattern, 0, 1, &ms->ms_regex_pattern );
 878                 } break;
 879         }
 880
 881         if ( mt->mt_subtree == NULL ) {
 882                  mt->mt_subtree = ms;
 883
 884         } else {
 885                 metasubtree_t **msp;
 886
 887                 for ( msp = &mt->mt_subtree; *msp; ) {
 888                         switch ( ms->ms_type ) {
 889                         case META_ST_SUBTREE:
 890                                 switch ( (*msp)->ms_type ) {
 891                                 case META_ST_SUBTREE:
 892                                         if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
 893                                                 metasubtree_t *tmp = *msp;
 894                                                 Debug( LDAP_DEBUG_CONFIG,
 895                                                         "%s: previous rule \"dn.subtree:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
 896                                                         c->log, pattern, (*msp)->ms_dn.bv_val );
 897                                                 *msp = (*msp)->ms_next;
 898                                                 tmp->ms_next = NULL;
 899                                                 meta_subtree_destroy( tmp );
 900                                                 continue;
 901
 902                                         } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) ) {
 903                                                 Debug( LDAP_DEBUG_CONFIG,
 904                                                         "%s: previous rule \"dn.subtree:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
 905                                                         c->log, (*msp)->ms_dn.bv_val, pattern );
 906                                                 meta_subtree_destroy( ms );
 907                                                 ms = NULL;
 908                                                 return( 0 );
 909                                         }
 910                                         break;
 911
 912                                 case META_ST_SUBORDINATE:
 913                                         if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
 914                                                 metasubtree_t *tmp = *msp;
 915                                                 Debug( LDAP_DEBUG_CONFIG,
 916                                                         "%s: previous rule \"dn.children:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
 917                                                         c->log, pattern, (*msp)->ms_dn.bv_val );
 918                                                 *msp = (*msp)->ms_next;
 919                                                 tmp->ms_next = NULL;
 920                                                 meta_subtree_destroy( tmp );
 921                                                 continue;
 922
 923                                         } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) && ms->ms_dn.bv_len > (*msp)->ms_dn.bv_len ) {
 924                                                 Debug( LDAP_DEBUG_CONFIG,
 925                                                         "%s: previous rule \"dn.children:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
 926                                                         c->log, (*msp)->ms_dn.bv_val, pattern );
 927                                                 meta_subtree_destroy( ms );
 928                                                 ms = NULL;
 929                                                 return( 0 );
 930                                         }
 931                                         break;
 932
 933                                 case META_ST_REGEX:
 934                                         if ( regexec( &(*msp)->ms_regex, ms->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
 935                                                 Debug( LDAP_DEBUG_CONFIG,
 936                                                         "%s: previous rule \"dn.regex:%s\" may contain rule \"dn.subtree:%s\"\n",
 937                                                         c->log, (*msp)->ms_regex_pattern.bv_val, ms->ms_dn.bv_val );
 938                                         }
 939                                         break;
 940                                 }
 941                                 break;
 942
 943                         case META_ST_SUBORDINATE:
 944                                 switch ( (*msp)->ms_type ) {
 945                                 case META_ST_SUBTREE:
 946                                         if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
 947                                                 metasubtree_t *tmp = *msp;
 948                                                 Debug( LDAP_DEBUG_CONFIG,
 949                                                         "%s: previous rule \"dn.children:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
 950                                                         c->log, pattern, (*msp)->ms_dn.bv_val );
 951                                                 *msp = (*msp)->ms_next;
 952                                                 tmp->ms_next = NULL;
 953                                                 meta_subtree_destroy( tmp );
 954                                                 continue;
 955
 956                                         } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) && ms->ms_dn.bv_len > (*msp)->ms_dn.bv_len ) {
 957                                                 Debug( LDAP_DEBUG_CONFIG,
 958                                                         "%s: previous rule \"dn.children:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
 959                                                         c->log, (*msp)->ms_dn.bv_val, pattern );
 960                                                 meta_subtree_destroy( ms );
 961                                                 ms = NULL;
 962                                                 return( 0 );
 963                                         }
 964                                         break;
 965
 966                                 case META_ST_SUBORDINATE:
 967                                         if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
 968                                                 metasubtree_t *tmp = *msp;
 969                                                 Debug( LDAP_DEBUG_CONFIG,
 970                                                         "%s: previous rule \"dn.children:%s\" is contained in rule \"dn.children:%s\" (replaced)\n",
 971                                                         c->log, pattern, (*msp)->ms_dn.bv_val );
 972                                                 *msp = (*msp)->ms_next;
 973                                                 tmp->ms_next = NULL;
 974                                                 meta_subtree_destroy( tmp );
 975                                                 continue;
 976
 977                                         } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) ) {
 978                                                 Debug( LDAP_DEBUG_CONFIG,
 979                                                         "%s: previous rule \"dn.children:%s\" contains rule \"dn.children:%s\" (ignored)\n",
 980                                                         c->log, (*msp)->ms_dn.bv_val, pattern );
 981                                                 meta_subtree_destroy( ms );
 982                                                 ms = NULL;
 983                                                 return( 0 );
 984                                         }
 985                                         break;
 986
 987                                 case META_ST_REGEX:
 988                                         if ( regexec( &(*msp)->ms_regex, ms->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
 989                                                 Debug( LDAP_DEBUG_CONFIG,
 990                                                         "%s: previous rule \"dn.regex:%s\" may contain rule \"dn.subtree:%s\"\n",
 991                                                         c->log, (*msp)->ms_regex_pattern.bv_val, ms->ms_dn.bv_val );
 992                                         }
 993                                         break;
 994                                 }
 995                                 break;
 996
 997                         case META_ST_REGEX:
 998                                 switch ( (*msp)->ms_type ) {
 999                                 case META_ST_SUBTREE:
1000                                 case META_ST_SUBORDINATE:
1001                                         if ( regexec( &ms->ms_regex, (*msp)->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
1002                                                 Debug( LDAP_DEBUG_CONFIG,
1003                                                         "%s: previous rule \"dn.subtree:%s\" may be contained in rule \"dn.regex:%s\"\n",
1004                                                         c->log, (*msp)->ms_dn.bv_val, ms->ms_regex_pattern.bv_val );
1005                                         }
1006                                         break;
1007
1008                                 case META_ST_REGEX:
1009                                         /* no check possible */
1010                                         break;
1011                                 }
1012                                 break;
1013                         }
1014
1015                         msp = &(*msp)->ms_next;
1016                 }
1017
1018                 *msp = ms;
1019         }
1020
1021         return 0;
1022 }
1023
1024 static slap_verbmasks idassert_mode[] = {
1025         { BER_BVC("self"),              LDAP_BACK_IDASSERT_SELF },
1026         { BER_BVC("anonymous"),         LDAP_BACK_IDASSERT_ANONYMOUS },
1027         { BER_BVC("none"),              LDAP_BACK_IDASSERT_NOASSERT },
1028         { BER_BVC("legacy"),            LDAP_BACK_IDASSERT_LEGACY },
1029         { BER_BVNULL,                   0 }
1030 };
1031
1032 static slap_verbmasks tls_mode[] = {
1033         { BER_BVC( "propagate" ),       LDAP_BACK_F_TLS_PROPAGATE_MASK },
1034         { BER_BVC( "try-propagate" ),   LDAP_BACK_F_PROPAGATE_TLS },
1035         { BER_BVC( "start" ),           LDAP_BACK_F_TLS_USE_MASK },
1036         { BER_BVC( "try-start" ),       LDAP_BACK_F_USE_TLS },
1037         { BER_BVC( "ldaps" ),           LDAP_BACK_F_TLS_LDAPS },
1038         { BER_BVC( "none" ),            LDAP_BACK_F_NONE },
1039         { BER_BVNULL,                   0 }
1040 };
1041
1042 static slap_verbmasks t_f_mode[] = {
1043         { BER_BVC( "yes" ),             LDAP_BACK_F_T_F },
1044         { BER_BVC( "discover" ),        LDAP_BACK_F_T_F_DISCOVER },
1045         { BER_BVC( "no" ),              LDAP_BACK_F_NONE },
1046         { BER_BVNULL,                   0 }
1047 };
1048
1049 static slap_verbmasks cancel_mode[] = {
1050         { BER_BVC( "ignore" ),          LDAP_BACK_F_CANCEL_IGNORE },
1051         { BER_BVC( "exop" ),            LDAP_BACK_F_CANCEL_EXOP },
1052         { BER_BVC( "exop-discover" ),   LDAP_BACK_F_CANCEL_EXOP_DISCOVER },
1053         { BER_BVC( "abandon" ),         LDAP_BACK_F_CANCEL_ABANDON },
1054         { BER_BVNULL,                   0 }
1055 };
1056
1057 static slap_verbmasks onerr_mode[] = {
1058         { BER_BVC( "stop" ),            META_BACK_F_ONERR_STOP },
1059         { BER_BVC( "report" ),  META_BACK_F_ONERR_REPORT },
1060         { BER_BVC( "continue" ),                LDAP_BACK_F_NONE },
1061         { BER_BVNULL,                   0 }
1062 };
1063
1064 /* see enum in slap.h */
1065 static slap_cf_aux_table timeout_table[] = {
1066         { BER_BVC("bind="),     SLAP_OP_BIND * sizeof( time_t ),        'u', 0, NULL },
1067         /* unbind makes no sense */
1068         { BER_BVC("add="),      SLAP_OP_ADD * sizeof( time_t ),         'u', 0, NULL },
1069         { BER_BVC("delete="),   SLAP_OP_DELETE * sizeof( time_t ),      'u', 0, NULL },
1070         { BER_BVC("modrdn="),   SLAP_OP_MODRDN * sizeof( time_t ),      'u', 0, NULL },
1071         { BER_BVC("modify="),   SLAP_OP_MODIFY * sizeof( time_t ),      'u', 0, NULL },
1072         { BER_BVC("compare="),  SLAP_OP_COMPARE * sizeof( time_t ),     'u', 0, NULL },
1073         { BER_BVC("search="),   SLAP_OP_SEARCH * sizeof( time_t ),      'u', 0, NULL },
1074         /* abandon makes little sense */
1075 #if 0   /* not implemented yet */
1076         { BER_BVC("extended="), SLAP_OP_EXTENDED * sizeof( time_t ),    'u', 0, NULL },
1077 #endif
1078         { BER_BVNULL, 0, 0, 0, NULL }
1079 };
1080
1081 static int
1082 meta_back_cf_gen( ConfigArgs *c )
1083 {
1084         metainfo_t      *mi = ( metainfo_t * )c->be->be_private;
1085         metatarget_t    *mt;
1086         metacommon_t    *mc;
1087
1088         int i, rc = 0;
1089
1090         assert( mi != NULL );
1091
1092         if ( c->op == SLAP_CONFIG_EMIT ) {
1093                 struct berval bv = BER_BVNULL;
1094
1095                 if ( !mi )
1096                         return 1;
1097
1098                 if ( c->table == Cft_Database ) {
1099                         mt = NULL;
1100                         mc = &mi->mi_mc;
1101                 } else {
1102                         mt = c->ca_private;
1103                         mc = &mt->mt_mc;
1104                 }
1105
1106                 switch( c->type ) {
1107                 /* Base attrs */
1108                 case LDAP_BACK_CFG_CONN_TTL:
1109                         if ( mi->mi_conn_ttl == 0 ) {
1110                                 return 1;
1111                         } else {
1112                                 char    buf[ SLAP_TEXT_BUFLEN ];
1113
1114                                 lutil_unparse_time( buf, sizeof( buf ), mi->mi_conn_ttl );
1115                                 ber_str2bv( buf, 0, 0, &bv );
1116                                 value_add_one( &c->rvalue_vals, &bv );
1117                         }
1118                         break;
1119
1120                 case LDAP_BACK_CFG_DNCACHE_TTL:
1121                         if ( mi->mi_cache.ttl == META_DNCACHE_DISABLED ) {
1122                                 return 1;
1123                         } else if ( mi->mi_cache.ttl == META_DNCACHE_FOREVER ) {
1124                                 BER_BVSTR( &bv, "forever" );
1125                         } else {
1126                                 char    buf[ SLAP_TEXT_BUFLEN ];
1127
1128                                 lutil_unparse_time( buf, sizeof( buf ), mi->mi_cache.ttl );
1129                                 ber_str2bv( buf, 0, 0, &bv );
1130                         }
1131                         value_add_one( &c->rvalue_vals, &bv );
1132                         break;
1133
1134                 case LDAP_BACK_CFG_IDLE_TIMEOUT:
1135                         if ( mi->mi_idle_timeout == 0 ) {
1136                                 return 1;
1137                         } else {
1138                                 char    buf[ SLAP_TEXT_BUFLEN ];
1139
1140                                 lutil_unparse_time( buf, sizeof( buf ), mi->mi_idle_timeout );
1141                                 ber_str2bv( buf, 0, 0, &bv );
1142                                 value_add_one( &c->rvalue_vals, &bv );
1143                         }
1144                         break;
1145
1146                 case LDAP_BACK_CFG_ONERR:
1147                         enum_to_verb( onerr_mode, mi->mi_flags & META_BACK_F_ONERR_MASK, &bv );
1148                         if ( BER_BVISNULL( &bv )) {
1149                                 rc = 1;
1150                         } else {
1151                                 value_add_one( &c->rvalue_vals, &bv );
1152                         }
1153                         break;
1154
1155                 case LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER:
1156                         c->value_int = META_BACK_DEFER_ROOTDN_BIND( mi );
1157                         break;
1158
1159                 case LDAP_BACK_CFG_SINGLECONN:
1160                         c->value_int = LDAP_BACK_SINGLECONN( mi );
1161                         break;
1162
1163                 case LDAP_BACK_CFG_USETEMP:
1164                         c->value_int = LDAP_BACK_USE_TEMPORARIES( mi );
1165                         break;
1166
1167                 case LDAP_BACK_CFG_CONNPOOLMAX:
1168                         c->value_int = mi->mi_conn_priv_max;
1169                         break;
1170
1171                 /* common attrs */
1172                 case LDAP_BACK_CFG_BIND_TIMEOUT:
1173                         if ( mc->mc_bind_timeout.tv_sec == 0 &&
1174                                 mc->mc_bind_timeout.tv_usec == 0 ) {
1175                                 return 1;
1176                         } else {
1177                                 c->value_ulong = mc->mc_bind_timeout.tv_sec * 1000000UL +
1178                                         mc->mc_bind_timeout.tv_usec;
1179                         }
1180                         break;
1181
1182                 case LDAP_BACK_CFG_CANCEL: {
1183                         slap_mask_t     mask = LDAP_BACK_F_CANCEL_MASK2;
1184
1185                         if ( mt && META_BACK_TGT_CANCEL_DISCOVER( mt ) ) {
1186                                 mask &= ~LDAP_BACK_F_CANCEL_EXOP;
1187                         }
1188                         enum_to_verb( cancel_mode, (mc->mc_flags & mask), &bv );
1189                         if ( BER_BVISNULL( &bv ) ) {
1190                                 /* there's something wrong... */
1191                                 assert( 0 );
1192                                 rc = 1;
1193
1194                         } else {
1195                                 value_add_one( &c->rvalue_vals, &bv );
1196                         }
1197                         } break;
1198
1199                 case LDAP_BACK_CFG_CHASE:
1200                         c->value_int = META_BACK_CMN_CHASE_REFERRALS(mc);
1201                         break;
1202
1203 #ifdef SLAPD_META_CLIENT_PR
1204                 case LDAP_BACK_CFG_CLIENT_PR:
1205                         if ( mc->mc_ps == META_CLIENT_PR_DISABLE ) {
1206                                 return 1;
1207                         } else if ( mc->mc_ps == META_CLIENT_PR_ACCEPT_UNSOLICITED ) {
1208                                 BER_BVSTR( &bv, "accept-unsolicited" );
1209                         } else {
1210                                 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d", mc->mc_ps );
1211                                 bv.bv_val = c->cr_msg;
1212                         }
1213                         value_add_one( &c->rvalue_vals, &bv );
1214                         break;
1215 #endif /* SLAPD_META_CLIENT_PR */
1216
1217                 case LDAP_BACK_CFG_DEFAULT_T:
1218                         if ( mt || mi->mi_defaulttarget == META_DEFAULT_TARGET_NONE )
1219                                 return 1;
1220                         bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d", mi->mi_defaulttarget );
1221                         bv.bv_val = c->cr_msg;
1222                         value_add_one( &c->rvalue_vals, &bv );
1223                         break;
1224
1225                 case LDAP_BACK_CFG_NETWORK_TIMEOUT:
1226                         if ( mc->mc_network_timeout == 0 ) {
1227                                 return 1;
1228                         }
1229                         bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%ld",
1230                                 mc->mc_network_timeout );
1231                         bv.bv_val = c->cr_msg;
1232                         value_add_one( &c->rvalue_vals, &bv );
1233                         break;
1234
1235                 case LDAP_BACK_CFG_NOREFS:
1236                         c->value_int = META_BACK_CMN_NOREFS(mc);
1237                         break;
1238
1239                 case LDAP_BACK_CFG_NOUNDEFFILTER:
1240                         c->value_int = META_BACK_CMN_NOUNDEFFILTER(mc);
1241                         break;
1242
1243                 case LDAP_BACK_CFG_NRETRIES:
1244                         if ( mc->mc_nretries == META_RETRY_FOREVER ) {
1245                                 BER_BVSTR( &bv, "forever" );
1246                         } else if ( mc->mc_nretries == META_RETRY_NEVER ) {
1247                                 BER_BVSTR( &bv, "never" );
1248                         } else {
1249                                 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d",
1250                                         mc->mc_nretries );
1251                                 bv.bv_val = c->cr_msg;
1252                         }
1253                         value_add_one( &c->rvalue_vals, &bv );
1254                         break;
1255
1256                 case LDAP_BACK_CFG_QUARANTINE:
1257                         if ( !META_BACK_CMN_QUARANTINE( mc )) {
1258                                 rc = 1;
1259                                 break;
1260                         }
1261                         rc = mi->mi_ldap_extra->retry_info_unparse( &mc->mc_quarantine, &bv );
1262                         if ( rc == 0 ) {
1263                                 ber_bvarray_add( &c->rvalue_vals, &bv );
1264                         }
1265                         break;
1266
1267                 case LDAP_BACK_CFG_REBIND:
1268                         c->value_int = META_BACK_CMN_SAVECRED(mc);
1269                         break;
1270
1271                 case LDAP_BACK_CFG_TIMEOUT:
1272                         for ( i = 0; i < SLAP_OP_LAST; i++ ) {
1273                                 if ( mc->mc_timeout[ i ] != 0 ) {
1274                                         break;
1275                                 }
1276                         }
1277
1278                         if ( i == SLAP_OP_LAST ) {
1279                                 return 1;
1280                         }
1281
1282                         BER_BVZERO( &bv );
1283                         slap_cf_aux_table_unparse( mc->mc_timeout, &bv, timeout_table );
1284
1285                         if ( BER_BVISNULL( &bv ) ) {
1286                                 return 1;
1287                         }
1288
1289                         for ( i = 0; isspace( (unsigned char) bv.bv_val[ i ] ); i++ )
1290                                 /* count spaces */ ;
1291
1292                         if ( i ) {
1293                                 bv.bv_len -= i;
1294                                 AC_MEMCPY( bv.bv_val, &bv.bv_val[ i ],
1295                                         bv.bv_len + 1 );
1296                         }
1297
1298                         ber_bvarray_add( &c->rvalue_vals, &bv );
1299                         break;
1300
1301                 case LDAP_BACK_CFG_VERSION:
1302                         if ( mc->mc_version == 0 )
1303                                 return 1;
1304                         c->value_int = mc->mc_version;
1305                         break;
1306
1307 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
1308                 case LDAP_BACK_CFG_ST_REQUEST:
1309                         c->value_int = META_BACK_CMN_ST_REQUEST( mc );
1310                         break;
1311 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
1312
1313                 case LDAP_BACK_CFG_T_F:
1314                         enum_to_verb( t_f_mode, (mc->mc_flags & LDAP_BACK_F_T_F_MASK2), &bv );
1315                         if ( BER_BVISNULL( &bv ) ) {
1316                                 /* there's something wrong... */
1317                                 assert( 0 );
1318                                 rc = 1;
1319
1320                         } else {
1321                                 value_add_one( &c->rvalue_vals, &bv );
1322                         }
1323                         break;
1324
1325                 case LDAP_BACK_CFG_TLS: {
1326                         struct berval bc = BER_BVNULL, bv2;
1327
1328                         if (( mc->mc_flags & LDAP_BACK_F_TLS_MASK ) == LDAP_BACK_F_NONE ) {
1329                                 rc = 1;
1330                                 break;
1331                         }
1332                         enum_to_verb( tls_mode, ( mc->mc_flags & LDAP_BACK_F_TLS_MASK ), &bv );
1333                         assert( !BER_BVISNULL( &bv ) );
1334
1335                         if ( mt ) {
1336                                 bindconf_tls_unparse( &mt->mt_tls, &bc );
1337                         }
1338
1339                         if ( !BER_BVISEMPTY( &bc )) {
1340                                 bv2.bv_len = bv.bv_len + bc.bv_len + 1;
1341                                 bv2.bv_val = ch_malloc( bv2.bv_len + 1 );
1342                                 strcpy( bv2.bv_val, bv.bv_val );
1343                                 bv2.bv_val[bv.bv_len] = ' ';
1344                                 strcpy( &bv2.bv_val[bv.bv_len + 1], bc.bv_val );
1345                                 ber_memfree( bc.bv_val );
1346                                 ber_bvarray_add( &c->rvalue_vals, &bv2 );
1347                         } else {
1348                                 value_add_one( &c->rvalue_vals, &bv );
1349                         }
1350                         } break;
1351
1352                 /* target attrs */
1353                 case LDAP_BACK_CFG_URI: {
1354                         char *p2, *p1 = strchr( mt->mt_uri, ' ' );
1355                         bv.bv_len = strlen( mt->mt_uri ) + 1 + mt->mt_psuffix.bv_len;
1356                         bv.bv_val = ch_malloc( bv.bv_len + 1 );
1357                         if ( p1 ) {
1358                                 p2 = lutil_strncopy( bv.bv_val, mt->mt_uri, p1 - mt->mt_uri );
1359                         } else {
1360                                 p2 = lutil_strcopy( bv.bv_val, mt->mt_uri );
1361                         }
1362                         *p2++ = '/';
1363                         p2 = lutil_strcopy( p2, mt->mt_psuffix.bv_val );
1364                         if ( p1 ) {
1365                                 strcpy( p2, p1 );
1366                         }
1367                         ber_bvarray_add( &c->rvalue_vals, &bv );
1368                         } break;
1369
1370                 case LDAP_BACK_CFG_ACL_AUTHCDN:
1371                 case LDAP_BACK_CFG_ACL_PASSWD:
1372                         /* FIXME no point here, there is no code implementing
1373                          * their features. Was this supposed to implement
1374                          * acl-bind like back-ldap?
1375                          */
1376                         rc = 1;
1377                         break;
1378
1379                 case LDAP_BACK_CFG_IDASSERT_AUTHZFROM: {
1380                         BerVarray       *bvp;
1381                         int             i;
1382                         struct berval   bv = BER_BVNULL;
1383                         char            buf[SLAP_TEXT_BUFLEN];
1384
1385                         bvp = &mt->mt_idassert_authz;
1386                         if ( *bvp == NULL ) {
1387                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_AUTHZ_ALL )
1388                                 {
1389                                         BER_BVSTR( &bv, "*" );
1390                                         value_add_one( &c->rvalue_vals, &bv );
1391
1392                                 } else {
1393                                         rc = 1;
1394                                 }
1395                                 break;
1396                         }
1397
1398                         for ( i = 0; !BER_BVISNULL( &((*bvp)[ i ]) ); i++ ) {
1399                                 char *ptr;
1400                                 int len = snprintf( buf, sizeof( buf ), SLAP_X_ORDERED_FMT, i );
1401                                 bv.bv_len = ((*bvp)[ i ]).bv_len + len;
1402                                 bv.bv_val = ber_memrealloc( bv.bv_val, bv.bv_len + 1 );
1403                                 ptr = bv.bv_val;
1404                                 ptr = lutil_strcopy( ptr, buf );
1405                                 ptr = lutil_strncopy( ptr, ((*bvp)[ i ]).bv_val, ((*bvp)[ i ]).bv_len );
1406                                 value_add_one( &c->rvalue_vals, &bv );
1407                         }
1408                         if ( bv.bv_val ) {
1409                                 ber_memfree( bv.bv_val );
1410                         }
1411                         break;
1412                 }
1413
1414                 case LDAP_BACK_CFG_IDASSERT_BIND: {
1415                         int             i;
1416                         struct berval   bc = BER_BVNULL;
1417                         char            *ptr;
1418
1419                         if ( mt->mt_idassert_authmethod == LDAP_AUTH_NONE ) {
1420                                 return 1;
1421                         } else {
1422                                 ber_len_t       len;
1423
1424                                 switch ( mt->mt_idassert_mode ) {
1425                                 case LDAP_BACK_IDASSERT_OTHERID:
1426                                 case LDAP_BACK_IDASSERT_OTHERDN:
1427                                         break;
1428
1429                                 default: {
1430                                         struct berval   mode = BER_BVNULL;
1431
1432                                         enum_to_verb( idassert_mode, mt->mt_idassert_mode, &mode );
1433                                         if ( BER_BVISNULL( &mode ) ) {
1434                                                 /* there's something wrong... */
1435                                                 assert( 0 );
1436                                                 rc = 1;
1437
1438                                         } else {
1439                                                 bv.bv_len = STRLENOF( "mode=" ) + mode.bv_len;
1440                                                 bv.bv_val = ch_malloc( bv.bv_len + 1 );
1441
1442                                                 ptr = lutil_strcopy( bv.bv_val, "mode=" );
1443                                                 ptr = lutil_strcopy( ptr, mode.bv_val );
1444                                         }
1445                                         break;
1446                                 }
1447                                 }
1448
1449                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_NATIVE_AUTHZ ) {
1450                                         len = bv.bv_len + STRLENOF( "authz=native" );
1451
1452                                         if ( !BER_BVISEMPTY( &bv ) ) {
1453                                                 len += STRLENOF( " " );
1454                                         }
1455
1456                                         bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
1457
1458                                         ptr = &bv.bv_val[ bv.bv_len ];
1459
1460                                         if ( !BER_BVISEMPTY( &bv ) ) {
1461                                                 ptr = lutil_strcopy( ptr, " " );
1462                                         }
1463
1464                                         (void)lutil_strcopy( ptr, "authz=native" );
1465                                 }
1466
1467                                 len = bv.bv_len + STRLENOF( "flags=non-prescriptive,override,obsolete-encoding-workaround,proxy-authz-non-critical,dn-authzid" );
1468                                 /* flags */
1469                                 if ( !BER_BVISEMPTY( &bv ) ) {
1470                                         len += STRLENOF( " " );
1471                                 }
1472
1473                                 bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
1474
1475                                 ptr = &bv.bv_val[ bv.bv_len ];
1476
1477                                 if ( !BER_BVISEMPTY( &bv ) ) {
1478                                         ptr = lutil_strcopy( ptr, " " );
1479                                 }
1480
1481                                 ptr = lutil_strcopy( ptr, "flags=" );
1482
1483                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_PRESCRIPTIVE ) {
1484                                         ptr = lutil_strcopy( ptr, "prescriptive" );
1485                                 } else {
1486                                         ptr = lutil_strcopy( ptr, "non-prescriptive" );
1487                                 }
1488
1489                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OVERRIDE ) {
1490                                         ptr = lutil_strcopy( ptr, ",override" );
1491                                 }
1492
1493                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_PROXY_AUTHZ ) {
1494                                         ptr = lutil_strcopy( ptr, ",obsolete-proxy-authz" );
1495
1496                                 } else if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_ENCODING_WORKAROUND ) {
1497                                         ptr = lutil_strcopy( ptr, ",obsolete-encoding-workaround" );
1498                                 }
1499
1500                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_PROXYAUTHZ_CRITICAL ) {
1501                                         ptr = lutil_strcopy( ptr, ",proxy-authz-critical" );
1502
1503                                 } else {
1504                                         ptr = lutil_strcopy( ptr, ",proxy-authz-non-critical" );
1505                                 }
1506
1507 #ifdef SLAP_AUTH_DN
1508                                 switch ( mt->mt_idassert_flags & LDAP_BACK_AUTH_DN_MASK ) {
1509                                 case LDAP_BACK_AUTH_DN_AUTHZID:
1510                                         ptr = lutil_strcopy( ptr, ",dn-authzid" );
1511                                         break;
1512
1513                                 case LDAP_BACK_AUTH_DN_WHOAMI:
1514                                         ptr = lutil_strcopy( ptr, ",dn-whoami" );
1515                                         break;
1516
1517                                 default:
1518 #if 0 /* implicit */
1519                                         ptr = lutil_strcopy( ptr, ",dn-none" );
1520 #endif
1521                                         break;
1522                                 }
1523 #endif
1524
1525                                 bv.bv_len = ( ptr - bv.bv_val );
1526                                 /* end-of-flags */
1527                         }
1528
1529                         bindconf_unparse( &mt->mt_idassert.si_bc, &bc );
1530
1531                         if ( !BER_BVISNULL( &bv ) ) {
1532                                 ber_len_t       len = bv.bv_len + bc.bv_len;
1533
1534                                 bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
1535
1536                                 assert( bc.bv_val[ 0 ] == ' ' );
1537
1538                                 ptr = lutil_strcopy( &bv.bv_val[ bv.bv_len ], bc.bv_val );
1539                                 free( bc.bv_val );
1540                                 bv.bv_len = ptr - bv.bv_val;
1541
1542                         } else {
1543                                 for ( i = 0; isspace( (unsigned char) bc.bv_val[ i ] ); i++ )
1544                                         /* count spaces */ ;
1545
1546                                 if ( i ) {
1547                                         bc.bv_len -= i;
1548                                         AC_MEMCPY( bc.bv_val, &bc.bv_val[ i ], bc.bv_len + 1 );
1549                                 }
1550
1551                                 bv = bc;
1552                         }
1553
1554                         ber_bvarray_add( &c->rvalue_vals, &bv );
1555
1556                         break;
1557                 }
1558
1559                 case LDAP_BACK_CFG_SUFFIXM:     /* unused */
1560                 case LDAP_BACK_CFG_REWRITE:
1561                         if ( mt->mt_rwmap.rwm_bva_rewrite == NULL ) {
1562                                 rc = 1;
1563                         } else {
1564                                 rc = slap_bv_x_ordered_unparse( mt->mt_rwmap.rwm_bva_rewrite, &c->rvalue_vals );
1565                         }
1566                         break;
1567
1568                 case LDAP_BACK_CFG_MAP:
1569                         if ( mt->mt_rwmap.rwm_bva_map == NULL ) {
1570                                 rc = 1;
1571                         } else {
1572                                 rc = slap_bv_x_ordered_unparse( mt->mt_rwmap.rwm_bva_map, &c->rvalue_vals );
1573                         }
1574                         break;
1575
1576                 case LDAP_BACK_CFG_SUBTREE_EX:
1577                 case LDAP_BACK_CFG_SUBTREE_IN:
1578                         rc = meta_subtree_unparse( c, mt );
1579                         break;
1580
1581                 /* replaced by idassert */
1582                 case LDAP_BACK_CFG_PSEUDOROOTDN:
1583                 case LDAP_BACK_CFG_PSEUDOROOTPW:
1584                         rc = 1;
1585                         break;
1586
1587                 default:
1588                         rc = 1;
1589                 }
1590                 return rc;
1591         } else if ( c->op == LDAP_MOD_DELETE ) {
1592                 switch( c->type ) {
1593                 /* Base attrs */
1594                 case LDAP_BACK_CFG_CONN_TTL:
1595                         mi->mi_conn_ttl = 0;
1596                         break;
1597
1598                 case LDAP_BACK_CFG_DNCACHE_TTL:
1599                         mi->mi_cache.ttl = META_DNCACHE_DISABLED;
1600                         break;
1601
1602                 case LDAP_BACK_CFG_IDLE_TIMEOUT:
1603                         mi->mi_idle_timeout = 0;
1604                         break;
1605
1606                 case LDAP_BACK_CFG_ONERR:
1607                         mi->mi_flags &= ~META_BACK_F_ONERR_MASK;
1608                         break;
1609
1610                 case LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER:
1611                         mi->mi_flags &= ~META_BACK_F_DEFER_ROOTDN_BIND;
1612                         break;
1613
1614                 case LDAP_BACK_CFG_SINGLECONN:
1615                         mi->mi_flags &= ~LDAP_BACK_F_SINGLECONN;
1616                         break;
1617
1618                 case LDAP_BACK_CFG_USETEMP:
1619                         mi->mi_flags &= ~LDAP_BACK_F_USE_TEMPORARIES;
1620                         break;
1621
1622                 case LDAP_BACK_CFG_CONNPOOLMAX:
1623                         mi->mi_conn_priv_max = LDAP_BACK_CONN_PRIV_MIN;
1624                         break;
1625
1626                 /* common attrs */
1627                 case LDAP_BACK_CFG_BIND_TIMEOUT:
1628                         mc->mc_bind_timeout.tv_sec = 0;
1629                         mc->mc_bind_timeout.tv_usec = 0;
1630                         break;
1631
1632                 case LDAP_BACK_CFG_CANCEL:
1633                         mc->mc_flags &= ~LDAP_BACK_F_CANCEL_MASK2;
1634                         break;
1635
1636                 case LDAP_BACK_CFG_CHASE:
1637                         mc->mc_flags &= ~LDAP_BACK_F_CHASE_REFERRALS;
1638                         break;
1639
1640 #ifdef SLAPD_META_CLIENT_PR
1641                 case LDAP_BACK_CFG_CLIENT_PR:
1642                         mc->mc_ps == META_CLIENT_PR_DISABLE;
1643                         break;
1644 #endif /* SLAPD_META_CLIENT_PR */
1645
1646                 case LDAP_BACK_CFG_DEFAULT_T:
1647                         mi->mi_defaulttarget = META_DEFAULT_TARGET_NONE;
1648                         break;
1649
1650                 case LDAP_BACK_CFG_NETWORK_TIMEOUT:
1651                         mc->mc_network_timeout = 0;
1652                         break;
1653
1654                 case LDAP_BACK_CFG_NOREFS:
1655                         mc->mc_flags &= ~LDAP_BACK_F_NOREFS;
1656                         break;
1657
1658                 case LDAP_BACK_CFG_NOUNDEFFILTER:
1659                         mc->mc_flags &= ~LDAP_BACK_F_NOUNDEFFILTER;
1660                         break;
1661
1662                 case LDAP_BACK_CFG_NRETRIES:
1663                         mc->mc_nretries == META_RETRY_DEFAULT;
1664                         break;
1665
1666                 case LDAP_BACK_CFG_QUARANTINE:
1667                         if ( META_BACK_CMN_QUARANTINE( mc )) {
1668                                 mi->mi_ldap_extra->retry_info_destroy( &mc->mc_quarantine );
1669                                 mc->mc_flags &= ~LDAP_BACK_F_QUARANTINE;
1670                                 if ( mc == &mt->mt_mc ) {
1671                                         ldap_pvt_thread_mutex_destroy( &mt->mt_quarantine_mutex );
1672                                         mt->mt_isquarantined = 0;
1673                                 }
1674                         }
1675                         break;
1676
1677                 case LDAP_BACK_CFG_REBIND:
1678                         mc->mc_flags &= ~LDAP_BACK_F_SAVECRED;
1679                         break;
1680
1681                 case LDAP_BACK_CFG_TIMEOUT:
1682                         for ( i = 0; i < SLAP_OP_LAST; i++ ) {
1683                                 mc->mc_timeout[ i ] = 0;
1684                         }
1685                         break;
1686
1687                 case LDAP_BACK_CFG_VERSION:
1688                         mc->mc_version = 0;
1689                         break;
1690
1691 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
1692                 case LDAP_BACK_CFG_ST_REQUEST:
1693                         mc->mc_flags &= ~LDAP_BACK_F_ST_REQUEST;
1694                         break;
1695 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
1696
1697                 case LDAP_BACK_CFG_T_F:
1698                         mc->mc_flags &= ~LDAP_BACK_F_T_F_MASK2;
1699                         break;
1700
1701                 case LDAP_BACK_CFG_TLS:
1702                         mc->mc_flags &= ~LDAP_BACK_F_TLS_MASK;
1703                         if ( mt )
1704                                 bindconf_free( &mt->mt_tls );
1705                         break;
1706
1707                 /* target attrs */
1708                 case LDAP_BACK_CFG_URI:
1709                         if ( mt->mt_uri ) {
1710                                 ch_free( mt->mt_uri );
1711                                 mt->mt_uri = NULL;
1712                         }
1713                         /* FIXME: should have a way to close all cached
1714                          * connections associated with this target.
1715                          */
1716                         break;
1717
1718                 case LDAP_BACK_CFG_IDASSERT_AUTHZFROM: {
1719                         BerVarray *bvp;
1720
1721                         bvp = &mt->mt_idassert_authz; break;
1722                         if ( c->valx < 0 ) {
1723                                 if ( *bvp != NULL ) {
1724                                         ber_bvarray_free( *bvp );
1725                                         *bvp = NULL;
1726                                 }
1727
1728                         } else {
1729                                 if ( *bvp == NULL ) {
1730                                         rc = 1;
1731                                         break;
1732                                 }
1733
1734                                 for ( i = 0; !BER_BVISNULL( &((*bvp)[ i ]) ); i++ )
1735                                         ;
1736
1737                                 if ( i >= c->valx ) {
1738                                         rc = 1;
1739                                         break;
1740                                 }
1741                                 ber_memfree( ((*bvp)[ c->valx ]).bv_val );
1742                                 for ( i = c->valx; !BER_BVISNULL( &((*bvp)[ i + 1 ]) ); i++ ) {
1743                                         (*bvp)[ i ] = (*bvp)[ i + 1 ];
1744                                 }
1745                                 BER_BVZERO( &((*bvp)[ i ]) );
1746                         }
1747                         } break;
1748
1749                 case LDAP_BACK_CFG_IDASSERT_BIND:
1750                         bindconf_free( &mt->mt_idassert.si_bc );
1751                         memset( &mt->mt_idassert, 0, sizeof( slap_idassert_t ) );
1752                         break;
1753
1754                 case LDAP_BACK_CFG_SUFFIXM:     /* unused */
1755                 case LDAP_BACK_CFG_REWRITE:
1756                         if ( mt->mt_rwmap.rwm_bva_rewrite ) {
1757                                 ber_bvarray_free( mt->mt_rwmap.rwm_bva_rewrite );
1758                                 mt->mt_rwmap.rwm_bva_rewrite = NULL;
1759                         }
1760                         if ( mt->mt_rwmap.rwm_rw )
1761                                 rewrite_info_delete( &mt->mt_rwmap.rwm_rw );
1762                         break;
1763
1764                 case LDAP_BACK_CFG_MAP:
1765                         if ( mt->mt_rwmap.rwm_bva_map ) {
1766                                 ber_bvarray_free( mt->mt_rwmap.rwm_bva_map );
1767                                 mt->mt_rwmap.rwm_bva_map = NULL;
1768                         }
1769                         meta_back_map_free( &mt->mt_rwmap.rwm_oc );
1770                         meta_back_map_free( &mt->mt_rwmap.rwm_at );
1771                         mt->mt_rwmap.rwm_oc.drop_missing = 0;
1772                         mt->mt_rwmap.rwm_at.drop_missing = 0;
1773                         break;
1774
1775                 case LDAP_BACK_CFG_SUBTREE_EX:
1776                 case LDAP_BACK_CFG_SUBTREE_IN:
1777                         /* can only be one of exclude or include */
1778                         if (( c->type == LDAP_BACK_CFG_SUBTREE_EX ) ^ mt->mt_subtree_exclude ) {
1779                                 rc = 1;
1780                                 break;
1781                         }
1782                         if ( c->valx < 0 ) {
1783                                 meta_subtree_destroy( mt->mt_subtree );
1784                                 mt->mt_subtree = NULL;
1785                         } else {
1786                                 metasubtree_t *ms, **mprev;
1787                                 for (i=0, mprev = &mt->mt_subtree, ms = *mprev; ms; ms = *mprev) {
1788                                         if ( i == c->valx ) {
1789                                                 *mprev = ms->ms_next;
1790                                                 meta_subtree_free( ms );
1791                                                 break;
1792                                         }
1793                                         i++;
1794                                         mprev = &ms->ms_next;
1795                                 }
1796                                 if ( i != c->valx )
1797                                         rc = 1;
1798                         }
1799                         break;
1800
1801                 default:
1802                         rc = 1;
1803                         break;
1804                 }
1805
1806                 return rc;
1807         }
1808
1809         if ( c->op == SLAP_CONFIG_ADD ) {
1810                 if ( c->type >= LDAP_BACK_CFG_LAST_BASE ) {
1811                         /* exclude CFG_URI from this check */
1812                         if ( c->type > LDAP_BACK_CFG_LAST_BOTH ) {
1813                                 if ( !mi->mi_ntargets ) {
1814                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1815                                                 "need \"uri\" directive first" );
1816                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1817                                         return 1;
1818                                 }
1819                         }
1820                         if ( mi->mi_ntargets ) {
1821                                 mt = mi->mi_targets[ mi->mi_ntargets-1 ];
1822                                 mc = &mt->mt_mc;
1823                         } else {
1824                                 mt = NULL;
1825                                 mc = &mi->mi_mc;
1826                         }
1827                 }
1828         } else {
1829                 if ( c->table == Cft_Database ) {
1830                         mt = NULL;
1831                         mc = &mi->mi_mc;
1832                 } else {
1833                         mt = c->ca_private;
1834                         if ( mt )
1835                                 mc = &mt->mt_mc;
1836                         else
1837                                 mc = NULL;
1838                 }
1839         }
1840
1841         switch( c->type ) {
1842         case LDAP_BACK_CFG_URI: {
1843                 LDAPURLDesc     *ludp;
1844                 struct berval   dn;
1845                 int             j;
1846
1847                 char            **uris = NULL;
1848
1849                 if ( c->be->be_nsuffix == NULL ) {
1850                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1851                                 "the suffix must be defined before any target" );
1852                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1853                         return 1;
1854                 }
1855
1856                 i = mi->mi_ntargets++;
1857
1858                 mi->mi_targets = ( metatarget_t ** )ch_realloc( mi->mi_targets,
1859                         sizeof( metatarget_t * ) * mi->mi_ntargets );
1860                 if ( mi->mi_targets == NULL ) {
1861                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1862                                 "out of memory while storing server name"
1863                                 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1864                                 c->argv[0] );
1865                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1866                         return 1;
1867                 }
1868
1869                 if ( meta_back_new_target( &mi->mi_targets[ i ] ) != 0 ) {
1870                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1871                                 "unable to init server"
1872                                 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1873                                 c->argv[0] );
1874                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1875                         return 1;
1876                 }
1877
1878                 mt = mi->mi_targets[ i ];
1879
1880                 mt->mt_rebind_f = mi->mi_rebind_f;
1881                 mt->mt_urllist_f = mi->mi_urllist_f;
1882                 mt->mt_urllist_p = mt;
1883
1884                 if ( META_BACK_QUARANTINE( mi ) ) {
1885                         ldap_pvt_thread_mutex_init( &mt->mt_quarantine_mutex );
1886                 }
1887                 mt->mt_mc = mi->mi_mc;
1888
1889                 for ( j = 1; j < c->argc; j++ ) {
1890                         char    **tmpuris = ldap_str2charray( c->argv[ j ], "\t" );
1891
1892                         if ( tmpuris == NULL ) {
1893                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1894                                         "unable to parse URIs #%d"
1895                                         " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1896                                         j-1, c->argv[0] );
1897                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1898                                 return 1;
1899                         }
1900
1901                         if ( j == 1 ) {
1902                                 uris = tmpuris;
1903
1904                         } else {
1905                                 ldap_charray_merge( &uris, tmpuris );
1906                                 ldap_charray_free( tmpuris );
1907                         }
1908                 }
1909
1910                 for ( j = 0; uris[ j ] != NULL; j++ ) {
1911                         char *tmpuri = NULL;
1912
1913                         /*
1914                          * uri MUST be legal!
1915                          */
1916                         if ( ldap_url_parselist_ext( &ludp, uris[ j ], "\t",
1917                                         LDAP_PVT_URL_PARSE_NONE ) != LDAP_SUCCESS
1918                                 || ludp->lud_next != NULL )
1919                         {
1920                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1921                                         "unable to parse URI #%d"
1922                                         " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1923                                         j-1, c->argv[0] );
1924                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1925                                 ldap_charray_free( uris );
1926                                 return 1;
1927                         }
1928
1929                         if ( j == 0 ) {
1930
1931                                 /*
1932                                  * uri MUST have the <dn> part!
1933                                  */
1934                                 if ( ludp->lud_dn == NULL ) {
1935                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1936                                                 "missing <naming context> "
1937                                                 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1938                                                 c->argv[0] );
1939                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1940                                         ldap_free_urllist( ludp );
1941                                         ldap_charray_free( uris );
1942                                         return 1;
1943                                 }
1944
1945                                 /*
1946                                  * copies and stores uri and suffix
1947                                  */
1948                                 ber_str2bv( ludp->lud_dn, 0, 0, &dn );
1949                                 rc = dnPrettyNormal( NULL, &dn, &mt->mt_psuffix,
1950                                         &mt->mt_nsuffix, NULL );
1951                                 if ( rc != LDAP_SUCCESS ) {
1952                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1953                                                 "target DN is invalid \"%s\"",
1954                                                 c->argv[1] );
1955                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1956                                         ldap_free_urllist( ludp );
1957                                         ldap_charray_free( uris );
1958                                         return( 1 );
1959                                 }
1960
1961                                 ludp->lud_dn[ 0 ] = '\0';
1962
1963                                 switch ( ludp->lud_scope ) {
1964                                 case LDAP_SCOPE_DEFAULT:
1965                                         mt->mt_scope = LDAP_SCOPE_SUBTREE;
1966                                         break;
1967
1968                                 case LDAP_SCOPE_SUBTREE:
1969                                 case LDAP_SCOPE_SUBORDINATE:
1970                                         mt->mt_scope = ludp->lud_scope;
1971                                         break;
1972
1973                                 default:
1974                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1975                                                 "invalid scope for target \"%s\"",
1976                                                 c->argv[1] );
1977                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1978                                         ldap_free_urllist( ludp );
1979                                         ldap_charray_free( uris );
1980                                         return( 1 );
1981                                 }
1982
1983                         } else {
1984                                 /* check all, to apply the scope check on the first one */
1985                                 if ( ludp->lud_dn != NULL && ludp->lud_dn[ 0 ] != '\0' ) {
1986                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1987                                                 "multiple URIs must have no DN part" );
1988                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1989                                         ldap_free_urllist( ludp );
1990                                         ldap_charray_free( uris );
1991                                         return( 1 );
1992
1993                                 }
1994                         }
1995
1996                         tmpuri = ldap_url_list2urls( ludp );
1997                         ldap_free_urllist( ludp );
1998                         if ( tmpuri == NULL ) {
1999                                 snprintf( c->cr_msg, sizeof( c->cr_msg ), "no memory?" );
2000                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2001                                 ldap_charray_free( uris );
2002                                 return( 1 );
2003                         }
2004                         ldap_memfree( uris[ j ] );
2005                         uris[ j ] = tmpuri;
2006                 }
2007
2008                 mt->mt_uri = ldap_charray2str( uris, " " );
2009                 ldap_charray_free( uris );
2010                 if ( mt->mt_uri == NULL) {
2011                         snprintf( c->cr_msg, sizeof( c->cr_msg ), "no memory?" );
2012                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2013                         return( 1 );
2014                 }
2015
2016                 /*
2017                  * uri MUST be a branch of suffix!
2018                  */
2019                 for ( j = 0; !BER_BVISNULL( &c->be->be_nsuffix[ j ] ); j++ ) {
2020                         if ( dnIsSuffix( &mt->mt_nsuffix, &c->be->be_nsuffix[ j ] ) ) {
2021                                 break;
2022                         }
2023                 }
2024
2025                 if ( BER_BVISNULL( &c->be->be_nsuffix[ j ] ) ) {
2026                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2027                                 "<naming context> of URI must be within the naming context of this database." );
2028                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2029                         return 1;
2030                 }
2031                 c->ca_private = mt;
2032         } break;
2033         case LDAP_BACK_CFG_SUBTREE_EX:
2034         case LDAP_BACK_CFG_SUBTREE_IN:
2035         /* subtree-exclude */
2036                 if ( meta_subtree_config( mt, c )) {
2037                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2038                         return 1;
2039                 }
2040                 break;
2041
2042         case LDAP_BACK_CFG_DEFAULT_T:
2043         /* default target directive */
2044                 i = mi->mi_ntargets - 1;
2045
2046                 if ( c->argc == 1 ) {
2047                         if ( i < 0 ) {
2048                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2049                                         "\"%s\" alone must be inside a \"uri\" directive",
2050                                         c->argv[0] );
2051                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2052                                 return 1;
2053                         }
2054                         mi->mi_defaulttarget = i;
2055
2056                 } else {
2057                         if ( strcasecmp( c->argv[ 1 ], "none" ) == 0 ) {
2058                                 if ( i >= 0 ) {
2059                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2060                                                 "\"%s none\" should go before uri definitions",
2061                                                 c->argv[0] );
2062                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2063                                 }
2064                                 mi->mi_defaulttarget = META_DEFAULT_TARGET_NONE;
2065
2066                         } else {
2067
2068                                 if ( lutil_atoi( &mi->mi_defaulttarget, c->argv[ 1 ] ) != 0
2069                                         || mi->mi_defaulttarget < 0
2070                                         || mi->mi_defaulttarget >= i - 1 )
2071                                 {
2072                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2073                                                 "illegal target number %d",
2074                                                 mi->mi_defaulttarget );
2075                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2076                                         return 1;
2077                                 }
2078                         }
2079                 }
2080                 break;
2081
2082         case LDAP_BACK_CFG_DNCACHE_TTL:
2083         /* ttl of dn cache */
2084                 if ( strcasecmp( c->argv[ 1 ], "forever" ) == 0 ) {
2085                         mi->mi_cache.ttl = META_DNCACHE_FOREVER;
2086
2087                 } else if ( strcasecmp( c->argv[ 1 ], "disabled" ) == 0 ) {
2088                         mi->mi_cache.ttl = META_DNCACHE_DISABLED;
2089
2090                 } else {
2091                         unsigned long   t;
2092
2093                         if ( lutil_parse_time( c->argv[ 1 ], &t ) != 0 ) {
2094                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2095                                         "unable to parse dncache ttl \"%s\"",
2096                                         c->argv[ 1 ] );
2097                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2098                                 return 1;
2099                         }
2100                         mi->mi_cache.ttl = (time_t)t;
2101                 }
2102                 break;
2103
2104         case LDAP_BACK_CFG_NETWORK_TIMEOUT: {
2105         /* network timeout when connecting to ldap servers */
2106                 unsigned long t;
2107
2108                 if ( lutil_parse_time( c->argv[ 1 ], &t ) ) {
2109                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2110                                 "unable to parse network timeout \"%s\"",
2111                                 c->argv[ 1 ] );
2112                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2113                         return 1;
2114                 }
2115                 mc->mc_network_timeout = (time_t)t;
2116                 } break;
2117
2118         case LDAP_BACK_CFG_IDLE_TIMEOUT: {
2119         /* idle timeout when connecting to ldap servers */
2120                 unsigned long   t;
2121
2122                 if ( lutil_parse_time( c->argv[ 1 ], &t ) ) {
2123                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2124                                 "unable to parse idle timeout \"%s\"",
2125                                 c->argv[ 1 ] );
2126                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2127                         return 1;
2128
2129                 }
2130                 mi->mi_idle_timeout = (time_t)t;
2131                 } break;
2132
2133         case LDAP_BACK_CFG_CONN_TTL: {
2134         /* conn ttl */
2135                 unsigned long   t;
2136
2137                 if ( lutil_parse_time( c->argv[ 1 ], &t ) ) {
2138                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2139                                 "unable to parse conn ttl \"%s\"",
2140                                 c->argv[ 1 ] );
2141                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2142                         return 1;
2143
2144                 }
2145                 mi->mi_conn_ttl = (time_t)t;
2146                 } break;
2147
2148         case LDAP_BACK_CFG_BIND_TIMEOUT:
2149         /* bind timeout when connecting to ldap servers */
2150                 mc->mc_bind_timeout.tv_sec = c->value_ulong/1000000;
2151                 mc->mc_bind_timeout.tv_usec = c->value_ulong%1000000;
2152                 break;
2153
2154         case LDAP_BACK_CFG_ACL_AUTHCDN:
2155         /* name to use for meta_back_group */
2156                 if ( strcasecmp( c->argv[ 0 ], "binddn" ) == 0 ) {
2157                         Debug( LDAP_DEBUG_ANY, "%s: "
2158                                 "\"binddn\" statement is deprecated; "
2159                                 "use \"acl-authcDN\" instead\n",
2160                                 c->log, 0, 0 );
2161                         /* FIXME: some day we'll need to throw an error */
2162                 }
2163
2164                 ber_memfree_x( c->value_dn.bv_val, NULL );
2165                 mt->mt_binddn = c->value_ndn;
2166                 BER_BVZERO( &c->value_dn );
2167                 BER_BVZERO( &c->value_ndn );
2168                 break;
2169
2170         case LDAP_BACK_CFG_ACL_PASSWD:
2171         /* password to use for meta_back_group */
2172                 if ( strcasecmp( c->argv[ 0 ], "bindpw" ) == 0 ) {
2173                         Debug( LDAP_DEBUG_ANY, "%s "
2174                                 "\"bindpw\" statement is deprecated; "
2175                                 "use \"acl-passwd\" instead\n",
2176                                 c->log, 0, 0 );
2177                         /* FIXME: some day we'll need to throw an error */
2178                 }
2179
2180                 ber_str2bv( c->argv[ 1 ], 0L, 1, &mt->mt_bindpw );
2181                 break;
2182
2183         case LDAP_BACK_CFG_REBIND:
2184         /* save bind creds for referral rebinds? */
2185                 if ( c->argc == 1 || c->value_int ) {
2186                         mc->mc_flags |= LDAP_BACK_F_SAVECRED;
2187                 } else {
2188                         mc->mc_flags &= ~LDAP_BACK_F_SAVECRED;
2189                 }
2190                 break;
2191
2192         case LDAP_BACK_CFG_CHASE:
2193                 if ( c->argc == 1 || c->value_int ) {
2194                         mc->mc_flags |= LDAP_BACK_F_CHASE_REFERRALS;
2195                 } else {
2196                         mc->mc_flags &= ~LDAP_BACK_F_CHASE_REFERRALS;
2197                 }
2198                 break;
2199
2200         case LDAP_BACK_CFG_TLS:
2201                 i = verb_to_mask( c->argv[1], tls_mode );
2202                 if ( BER_BVISNULL( &tls_mode[i].word ) ) {
2203                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2204                                 "%s unknown argument \"%s\"",
2205                                 c->argv[0], c->argv[1] );
2206                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2207                         return 1;
2208                 }
2209                 mc->mc_flags &= ~LDAP_BACK_F_TLS_MASK;
2210                 mc->mc_flags |= tls_mode[i].mask;
2211
2212                 if ( c->argc > 2 ) {
2213                         if ( c->op == SLAP_CONFIG_ADD && mi->mi_ntargets == 0 ) {
2214                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2215                                         "need \"uri\" directive first" );
2216                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2217                                 return 1;
2218                         }
2219
2220                         for ( i = 2; i < c->argc; i++ ) {
2221                                 if ( bindconf_tls_parse( c->argv[i], &mt->mt_tls ))
2222                                         return 1;
2223                         }
2224                         bindconf_tls_defaults( &mt->mt_tls );
2225                 }
2226                 break;
2227
2228         case LDAP_BACK_CFG_T_F:
2229                 i = verb_to_mask( c->argv[1], t_f_mode );
2230                 if ( BER_BVISNULL( &t_f_mode[i].word ) ) {
2231                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2232                                 "%s unknown argument \"%s\"",
2233                                 c->argv[0], c->argv[1] );
2234                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2235                         return 1;
2236                 }
2237                 mc->mc_flags &= ~LDAP_BACK_F_T_F_MASK2;
2238                 mc->mc_flags |= t_f_mode[i].mask;
2239                 break;
2240
2241         case LDAP_BACK_CFG_ONERR:
2242         /* onerr? */
2243                 i = verb_to_mask( c->argv[1], onerr_mode );
2244                 if ( BER_BVISNULL( &onerr_mode[i].word ) ) {
2245                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2246                                 "%s unknown argument \"%s\"",
2247                                 c->argv[0], c->argv[1] );
2248                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2249                         return 1;
2250                 }
2251                 mi->mi_flags &= ~META_BACK_F_ONERR_MASK;
2252                 mi->mi_flags |= onerr_mode[i].mask;
2253                 break;
2254
2255         case LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER:
2256         /* bind-defer? */
2257                 if ( c->argc == 1 || c->value_int ) {
2258                         mi->mi_flags |= META_BACK_F_DEFER_ROOTDN_BIND;
2259                 } else {
2260                         mi->mi_flags &= ~META_BACK_F_DEFER_ROOTDN_BIND;
2261                 }
2262                 break;
2263
2264         case LDAP_BACK_CFG_SINGLECONN:
2265         /* single-conn? */
2266                 if ( mi->mi_ntargets > 0 ) {
2267                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2268                                 "\"%s\" must appear before target definitions",
2269                                 c->argv[0] );
2270                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2271                         return( 1 );
2272                 }
2273                 if ( c->value_int ) {
2274                         mi->mi_flags |= LDAP_BACK_F_SINGLECONN;
2275                 } else {
2276                         mi->mi_flags &= ~LDAP_BACK_F_SINGLECONN;
2277                 }
2278                 break;
2279
2280         case LDAP_BACK_CFG_USETEMP:
2281         /* use-temporaries? */
2282                 if ( mi->mi_ntargets > 0 ) {
2283                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2284                                 "\"%s\" must appear before target definitions",
2285                                 c->argv[0] );
2286                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2287                         return( 1 );
2288                 }
2289                 if ( c->value_int ) {
2290                         mi->mi_flags |= LDAP_BACK_F_USE_TEMPORARIES;
2291                 } else {
2292                         mi->mi_flags &= ~LDAP_BACK_F_USE_TEMPORARIES;
2293                 }
2294                 break;
2295
2296         case LDAP_BACK_CFG_CONNPOOLMAX:
2297         /* privileged connections pool max size ? */
2298                 if ( mi->mi_ntargets > 0 ) {
2299                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2300                                 "\"%s\" must appear before target definitions",
2301                                 c->argv[0] );
2302                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2303                         return( 1 );
2304                 }
2305
2306                 if ( c->value_int < LDAP_BACK_CONN_PRIV_MIN
2307                         || c->value_int > LDAP_BACK_CONN_PRIV_MAX )
2308                 {
2309                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2310                                 "invalid max size " "of privileged "
2311                                 "connections pool \"%s\" "
2312                                 "in \"conn-pool-max <n> "
2313                                 "(must be between %d and %d)\"",
2314                                 c->argv[ 1 ],
2315                                 LDAP_BACK_CONN_PRIV_MIN,
2316                                 LDAP_BACK_CONN_PRIV_MAX );
2317                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2318                         return 1;
2319                 }
2320                 mi->mi_conn_priv_max = c->value_int;
2321                 break;
2322
2323         case LDAP_BACK_CFG_CANCEL:
2324                 i = verb_to_mask( c->argv[1], cancel_mode );
2325                 if ( BER_BVISNULL( &cancel_mode[i].word ) ) {
2326                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2327                                 "%s unknown argument \"%s\"",
2328                                 c->argv[0], c->argv[1] );
2329                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2330                         return 1;
2331                 }
2332                 mc->mc_flags &= ~LDAP_BACK_F_CANCEL_MASK2;
2333                 mc->mc_flags |= t_f_mode[i].mask;
2334                 break;
2335
2336         case LDAP_BACK_CFG_TIMEOUT:
2337                 for ( i = 1; i < c->argc; i++ ) {
2338                         if ( isdigit( (unsigned char) c->argv[ i ][ 0 ] ) ) {
2339                                 int             j;
2340                                 unsigned        u;
2341
2342                                 if ( lutil_atoux( &u, c->argv[ i ], 0 ) != 0 ) {
2343                                         snprintf( c->cr_msg, sizeof( c->cr_msg),
2344                                                 "unable to parse timeout \"%s\"",
2345                                                 c->argv[ i ] );
2346                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2347                                         return 1;
2348                                 }
2349
2350                                 for ( j = 0; j < SLAP_OP_LAST; j++ ) {
2351                                         mc->mc_timeout[ j ] = u;
2352                                 }
2353
2354                                 continue;
2355                         }
2356
2357                         if ( slap_cf_aux_table_parse( c->argv[ i ], mc->mc_timeout, timeout_table, "slapd-meta timeout" ) ) {
2358                                 snprintf( c->cr_msg, sizeof( c->cr_msg),
2359                                         "unable to parse timeout \"%s\"",
2360                                         c->argv[ i ] );
2361                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2362                                 return 1;
2363                         }
2364                 }
2365                 break;
2366
2367         case LDAP_BACK_CFG_PSEUDOROOTDN:
2368         /* name to use as pseudo-root dn */
2369                 /*
2370                  * exact replacement:
2371                  *
2372
2373 idassert-bind   bindmethod=simple
2374                 binddn=<pseudorootdn>
2375                 credentials=<pseudorootpw>
2376                 mode=none
2377                 flags=non-prescriptive
2378 idassert-authzFrom      "dn:<rootdn>"
2379
2380                  * so that only when authc'd as <rootdn> the proxying occurs
2381                  * rebinding as the <pseudorootdn> without proxyAuthz.
2382                  */
2383
2384                 Debug( LDAP_DEBUG_ANY,
2385                         "%s: \"pseudorootdn\", \"pseudorootpw\" are no longer supported; "
2386                         "use \"idassert-bind\" and \"idassert-authzFrom\" instead.\n",
2387                         c->log, 0, 0 );
2388
2389                 {
2390                         char    binddn[ SLAP_TEXT_BUFLEN ];
2391                         char    *cargv[] = {
2392                                 "idassert-bind",
2393                                 "bindmethod=simple",
2394                                 NULL,
2395                                 "mode=none",
2396                                 "flags=non-prescriptive",
2397                                 NULL
2398                         };
2399                         char **oargv;
2400                         int oargc;
2401                         int     cargc = 5;
2402                         int     rc;
2403
2404
2405                         if ( BER_BVISNULL( &c->be->be_rootndn ) ) {
2406                                 Debug( LDAP_DEBUG_ANY, "%s: \"pseudorootpw\": \"rootdn\" must be defined first.\n",
2407                                         c->log, 0, 0 );
2408                                 return 1;
2409                         }
2410
2411                         if ( sizeof( binddn ) <= (unsigned) snprintf( binddn,
2412                                         sizeof( binddn ), "binddn=%s", c->argv[ 1 ] ))
2413                         {
2414                                 Debug( LDAP_DEBUG_ANY, "%s: \"pseudorootdn\" too long.\n",
2415                                         c->log, 0, 0 );
2416                                 return 1;
2417                         }
2418                         cargv[ 2 ] = binddn;
2419
2420                         oargv = c->argv;
2421                         oargc = c->argc;
2422                         c->argv = cargv;
2423                         c->argc = cargc;
2424                         rc = mi->mi_ldap_extra->idassert_parse( c, &mt->mt_idassert );
2425                         c->argv = oargv;
2426                         c->argc = oargc;
2427                         if ( rc == 0 ) {
2428                                 struct berval   bv;
2429
2430                                 if ( mt->mt_idassert_authz != NULL ) {
2431                                         Debug( LDAP_DEBUG_ANY, "%s: \"idassert-authzFrom\" already defined (discarded).\n",
2432                                                 c->log, 0, 0 );
2433                                         ber_bvarray_free( mt->mt_idassert_authz );
2434                                         mt->mt_idassert_authz = NULL;
2435                                 }
2436
2437                                 assert( !BER_BVISNULL( &mt->mt_idassert_authcDN ) );
2438
2439                                 bv.bv_len = STRLENOF( "dn:" ) + c->be->be_rootndn.bv_len;
2440                                 bv.bv_val = ber_memalloc( bv.bv_len + 1 );
2441                                 AC_MEMCPY( bv.bv_val, "dn:", STRLENOF( "dn:" ) );
2442                                 AC_MEMCPY( &bv.bv_val[ STRLENOF( "dn:" ) ], c->be->be_rootndn.bv_val, c->be->be_rootndn.bv_len + 1 );
2443
2444                                 ber_bvarray_add( &mt->mt_idassert_authz, &bv );
2445                         }
2446
2447                         return rc;
2448                 }
2449                 break;
2450
2451         case LDAP_BACK_CFG_PSEUDOROOTPW:
2452         /* password to use as pseudo-root */
2453                 Debug( LDAP_DEBUG_ANY,
2454                         "%s: \"pseudorootdn\", \"pseudorootpw\" are no longer supported; "
2455                         "use \"idassert-bind\" and \"idassert-authzFrom\" instead.\n",
2456                         c->log, 0, 0 );
2457
2458                 if ( BER_BVISNULL( &mt->mt_idassert_authcDN ) ) {
2459                         Debug( LDAP_DEBUG_ANY, "%s: \"pseudorootpw\": \"pseudorootdn\" must be defined first.\n",
2460                                 c->log, 0, 0 );
2461                         return 1;
2462                 }
2463
2464                 if ( !BER_BVISNULL( &mt->mt_idassert_passwd ) ) {
2465                         memset( mt->mt_idassert_passwd.bv_val, 0,
2466                                 mt->mt_idassert_passwd.bv_len );
2467                         ber_memfree( mt->mt_idassert_passwd.bv_val );
2468                 }
2469                 ber_str2bv( c->argv[ 1 ], 0, 1, &mt->mt_idassert_passwd );
2470                 break;
2471
2472         case LDAP_BACK_CFG_IDASSERT_BIND:
2473         /* idassert-bind */
2474                 rc = mi->mi_ldap_extra->idassert_parse( c, &mt->mt_idassert );
2475                 break;
2476
2477         case LDAP_BACK_CFG_IDASSERT_AUTHZFROM:
2478         /* idassert-authzFrom */
2479                 rc = mi->mi_ldap_extra->idassert_authzfrom_parse( c, &mt->mt_idassert );
2480                 break;
2481
2482         case LDAP_BACK_CFG_QUARANTINE:
2483         /* quarantine */
2484                 if ( META_BACK_CMN_QUARANTINE( mc ) )
2485                 {
2486                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2487                                 "quarantine already defined" );
2488                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2489                         return 1;
2490                 }
2491
2492                 if ( mt ) {
2493                         mc->mc_quarantine.ri_interval = NULL;
2494                         mc->mc_quarantine.ri_num = NULL;
2495                         if ( !META_BACK_QUARANTINE( mi ) ) {
2496                                 ldap_pvt_thread_mutex_init( &mt->mt_quarantine_mutex );
2497                         }
2498                 }
2499
2500                 if ( mi->mi_ldap_extra->retry_info_parse( c->argv[ 1 ], &mc->mc_quarantine, c->cr_msg, sizeof( c->cr_msg ) ) ) {
2501                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2502                         return 1;
2503                 }
2504
2505                 mc->mc_flags |= LDAP_BACK_F_QUARANTINE;
2506                 break;
2507
2508 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
2509         case LDAP_BACK_CFG_ST_REQUEST:
2510         /* session tracking request */
2511                 if ( c->value_int ) {
2512                         mc->mc_flags |= LDAP_BACK_F_ST_REQUEST;
2513                 } else {
2514                         mc->mc_flags &= ~LDAP_BACK_F_ST_REQUEST;
2515                 }
2516                 break;
2517 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
2518
2519         case LDAP_BACK_CFG_SUFFIXM:     /* FALLTHRU */
2520         case LDAP_BACK_CFG_REWRITE: {
2521         /* rewrite stuff ... */
2522                 ConfigArgs ca = { 0 };
2523                 char *line, **argv;
2524                 struct rewrite_info *rwi;
2525                 int cnt = 0, argc, ix = c->valx;
2526
2527                 if ( mt->mt_rwmap.rwm_bva_rewrite ) {
2528                         for ( ; !BER_BVISNULL( &mt->mt_rwmap.rwm_bva_rewrite[ cnt ] ); cnt++ )
2529                                 /* count */ ;
2530                 }
2531
2532                 if ( ix >= cnt || ix < 0 ) {
2533                         ix = cnt;
2534                 } else {
2535                         rwi = mt->mt_rwmap.rwm_rw;
2536
2537                         mt->mt_rwmap.rwm_rw = NULL;
2538                         rc = meta_rwi_init( &mt->mt_rwmap.rwm_rw );
2539
2540                         /* re-parse all rewrite rules, up to the one
2541                          * that needs to be added */
2542                         ca.fname = c->fname;
2543                         ca.lineno = c->lineno;
2544                         for ( i = 0; i < ix; i++ ) {
2545                                 ca.line = mt->mt_rwmap.rwm_bva_rewrite[ i ].bv_val;
2546                                 ca.argc = 0;
2547                                 config_fp_parse_line( &ca );
2548
2549                                 if ( !strcasecmp( ca.argv[0], "suffixmassage" )) {
2550                                         rc = meta_suffixm_config( &ca, ca.argc, ca.argv, mt );
2551                                 } else {
2552                                         rc = rewrite_parse( mt->mt_rwmap.rwm_rw,
2553                                                 c->fname, c->lineno, ca.argc, ca.argv );
2554                                 }
2555                                 assert( rc == 0 );
2556                                 ch_free( ca.argv );
2557                                 ch_free( ca.tline );
2558                         }
2559                 }
2560                 argc = c->argc;
2561                 argv = c->argv;
2562                 if ( c->op != SLAP_CONFIG_ADD ) {
2563                         argc--;
2564                         argv++;
2565                 }
2566                 /* add the new rule */
2567                 if ( !strcasecmp( argv[0], "suffixmassage" )) {
2568                         rc = meta_suffixm_config( c, argc, argv, mt );
2569                 } else {
2570                         rc = rewrite_parse( mt->mt_rwmap.rwm_rw,
2571                                                 c->fname, c->lineno, argc, argv );
2572                 }
2573                 if ( rc ) {
2574                         if ( ix < cnt ) {
2575                                 rewrite_info_delete( &mt->mt_rwmap.rwm_rw );
2576                                 mt->mt_rwmap.rwm_rw = rwi;
2577                         }
2578                         return 1;
2579                 }
2580                 if ( ix < cnt ) {
2581                         for ( ; i < cnt; i++ ) {
2582                                 ca.line = mt->mt_rwmap.rwm_bva_rewrite[ i ].bv_val;
2583                                 ca.argc = 0;
2584                                 config_fp_parse_line( &ca );
2585
2586                                 if ( !strcasecmp( ca.argv[0], "suffixmassage" )) {
2587                                         rc = meta_suffixm_config( &ca, ca.argc, ca.argv, mt );
2588                                 } else {
2589                                         rc = rewrite_parse( mt->mt_rwmap.rwm_rw,
2590                                                 c->fname, c->lineno, ca.argc, argv );
2591                                 }
2592                                 assert( rc == 0 );
2593                                 ch_free( ca.argv );
2594                                 ch_free( ca.tline );
2595                         }
2596                 }
2597
2598                 /* save the rule info */
2599                 line = ldap_charray2str( argv, "\" \"" );
2600                 if ( line != NULL ) {
2601                         struct berval bv;
2602                         int len = strlen( argv[ 0 ] );
2603
2604                         ber_str2bv( line, 0, 0, &bv );
2605                         AC_MEMCPY( &bv.bv_val[ len ], &bv.bv_val[ len + 1 ],
2606                                 bv.bv_len - ( len + 1 ));
2607                         bv.bv_val[ bv.bv_len - 1] = '"';
2608                         ber_bvarray_add( &mt->mt_rwmap.rwm_bva_rewrite, &bv );
2609                         /* move it to the right slot */
2610                         if ( ix < cnt ) {
2611                                 for ( i=cnt; i>ix; i-- )
2612                                         mt->mt_rwmap.rwm_bva_rewrite[i+1] = mt->mt_rwmap.rwm_bva_rewrite[i];
2613                                 mt->mt_rwmap.rwm_bva_rewrite[i] = bv;
2614
2615                                 /* destroy old rules */
2616                                 rewrite_info_delete( &rwi );
2617                         }
2618                 }
2619                 } break;
2620
2621         case LDAP_BACK_CFG_MAP: {
2622         /* objectclass/attribute mapping */
2623                 ConfigArgs ca = { 0 };
2624                 char *argv[5];
2625                 struct ldapmap rwm_oc;
2626                 struct ldapmap rwm_at;
2627                 int cnt = 0, ix = c->valx;
2628
2629                 if ( mt->mt_rwmap.rwm_bva_map ) {
2630                         for ( ; !BER_BVISNULL( &mt->mt_rwmap.rwm_bva_map[ cnt ] ); cnt++ )
2631                                 /* count */ ;
2632                 }
2633
2634                 if ( ix >= cnt || ix < 0 ) {
2635                         ix = cnt;
2636                 } else {
2637                         rwm_oc = mt->mt_rwmap.rwm_oc;
2638                         rwm_at = mt->mt_rwmap.rwm_at;
2639
2640                         memset( &mt->mt_rwmap.rwm_oc, 0, sizeof( mt->mt_rwmap.rwm_oc ) );
2641                         memset( &mt->mt_rwmap.rwm_at, 0, sizeof( mt->mt_rwmap.rwm_at ) );
2642
2643                         /* re-parse all mappings, up to the one
2644                          * that needs to be added */
2645                         argv[0] = c->argv[0];
2646                         ca.fname = c->fname;
2647                         ca.lineno = c->lineno;
2648                         for ( i = 0; i < ix; i++ ) {
2649                                 ca.line = mt->mt_rwmap.rwm_bva_map[ i ].bv_val;
2650                                 ca.argc = 0;
2651                                 config_fp_parse_line( &ca );
2652
2653                                 argv[1] = ca.argv[0];
2654                                 argv[2] = ca.argv[1];
2655                                 argv[3] = ca.argv[2];
2656                                 argv[4] = ca.argv[3];
2657                                 ch_free( ca.argv );
2658                                 ca.argv = argv;
2659                                 ca.argc++;
2660                                 rc = ldap_back_map_config( &ca, &mt->mt_rwmap.rwm_oc,
2661                                         &mt->mt_rwmap.rwm_at );
2662
2663                                 ch_free( ca.tline );
2664                                 ca.tline = NULL;
2665                                 ca.argv = NULL;
2666
2667                                 /* in case of failure, restore
2668                                  * the existing mapping */
2669                                 if ( rc ) {
2670                                         goto map_fail;
2671                                 }
2672                         }
2673                 }
2674                 /* add the new mapping */
2675                 rc = ldap_back_map_config( c, &mt->mt_rwmap.rwm_oc,
2676                                         &mt->mt_rwmap.rwm_at );
2677                 if ( rc ) {
2678                         goto map_fail;
2679                 }
2680
2681                 if ( ix < cnt ) {
2682                         for ( ; i<cnt ; cnt++ ) {
2683                                 ca.line = mt->mt_rwmap.rwm_bva_map[ i ].bv_val;
2684                                 ca.argc = 0;
2685                                 config_fp_parse_line( &ca );
2686
2687                                 argv[1] = ca.argv[0];
2688                                 argv[2] = ca.argv[1];
2689                                 argv[3] = ca.argv[2];
2690                                 argv[4] = ca.argv[3];
2691
2692                                 ch_free( ca.argv );
2693                                 ca.argv = argv;
2694                                 ca.argc++;
2695                                 rc = ldap_back_map_config( &ca, &mt->mt_rwmap.rwm_oc,
2696                                         &mt->mt_rwmap.rwm_at );
2697
2698                                 ch_free( ca.tline );
2699                                 ca.tline = NULL;
2700                                 ca.argv = NULL;
2701
2702                                 /* in case of failure, restore
2703                                  * the existing mapping */
2704                                 if ( rc ) {
2705                                         goto map_fail;
2706                                 }
2707                         }
2708                 }
2709
2710                 /* save the map info */
2711                 argv[0] = ldap_charray2str( &c->argv[ 1 ], " " );
2712                 if ( argv[0] != NULL ) {
2713                         struct berval bv;
2714                         ber_str2bv( argv[0], 0, 0, &bv );
2715                         ber_bvarray_add( &mt->mt_rwmap.rwm_bva_map, &bv );
2716                         /* move it to the right slot */
2717                         if ( ix < cnt ) {
2718                                 for ( i=cnt; i>ix; i-- )
2719                                         mt->mt_rwmap.rwm_bva_map[i+1] = mt->mt_rwmap.rwm_bva_map[i];
2720                                 mt->mt_rwmap.rwm_bva_map[i] = bv;
2721
2722                                 /* destroy old mapping */
2723                                 meta_back_map_free( &rwm_oc );
2724                                 meta_back_map_free( &rwm_at );
2725                         }
2726                 }
2727                 break;
2728
2729 map_fail:;
2730                 if ( ix < cnt ) {
2731                         meta_back_map_free( &mt->mt_rwmap.rwm_oc );
2732                         meta_back_map_free( &mt->mt_rwmap.rwm_at );
2733                         mt->mt_rwmap.rwm_oc = rwm_oc;
2734                         mt->mt_rwmap.rwm_at = rwm_at;
2735                 }
2736                 } break;
2737
2738         case LDAP_BACK_CFG_NRETRIES: {
2739                 int             nretries = META_RETRY_UNDEFINED;
2740
2741                 if ( strcasecmp( c->argv[ 1 ], "forever" ) == 0 ) {
2742                         nretries = META_RETRY_FOREVER;
2743
2744                 } else if ( strcasecmp( c->argv[ 1 ], "never" ) == 0 ) {
2745                         nretries = META_RETRY_NEVER;
2746
2747                 } else {
2748                         if ( lutil_atoi( &nretries, c->argv[ 1 ] ) != 0 ) {
2749                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2750                                         "unable to parse nretries {never|forever|<retries>}: \"%s\"",
2751                                         c->argv[ 1 ] );
2752                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2753                                 return 1;
2754                         }
2755                 }
2756
2757                 mc->mc_nretries = nretries;
2758                 } break;
2759
2760         case LDAP_BACK_CFG_VERSION:
2761                 if ( c->value_int != 0 && ( c->value_int < LDAP_VERSION_MIN || c->value_int > LDAP_VERSION_MAX ) ) {
2762                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2763                                 "unsupported protocol version \"%s\"",
2764                                 c->argv[ 1 ] );
2765                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2766                         return 1;
2767                 }
2768                 mc->mc_version = c->value_int;
2769                 break;
2770
2771         case LDAP_BACK_CFG_NOREFS:
2772         /* do not return search references */
2773                 if ( c->value_int ) {
2774                         mc->mc_flags |= LDAP_BACK_F_NOREFS;
2775                 } else {
2776                         mc->mc_flags &= ~LDAP_BACK_F_NOREFS;
2777                 }
2778                 break;
2779
2780         case LDAP_BACK_CFG_NOUNDEFFILTER:
2781         /* do not propagate undefined search filters */
2782                 if ( c->value_int ) {
2783                         mc->mc_flags |= LDAP_BACK_F_NOUNDEFFILTER;
2784                 } else {
2785                         mc->mc_flags &= ~LDAP_BACK_F_NOUNDEFFILTER;
2786                 }
2787                 break;
2788
2789 #ifdef SLAPD_META_CLIENT_PR
2790         case LDAP_BACK_CFG_CLIENT_PR:
2791                 if ( strcasecmp( c->argv[ 1 ], "accept-unsolicited" ) == 0 ) {
2792                         mc->mc_ps = META_CLIENT_PR_ACCEPT_UNSOLICITED;
2793
2794                 } else if ( strcasecmp( c->argv[ 1 ], "disable" ) == 0 ) {
2795                         mc->mc_ps = META_CLIENT_PR_DISABLE;
2796
2797                 } else if ( lutil_atoi( &mc->mc_ps, c->argv[ 1 ] ) || mc->mc_ps < -1 ) {
2798                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2799                                 "unable to parse client-pr {accept-unsolicited|disable|<size>}: \"%s\"",
2800                                 c->argv[ 1 ] );
2801                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2802                         return( 1 );
2803                 }
2804                 break;
2805 #endif /* SLAPD_META_CLIENT_PR */
2806
2807         /* anything else */
2808         default:
2809                 return SLAP_CONF_UNKNOWN;
2810         }
2811
2812         return rc;
2813 }
2814
2815 int
2816 meta_back_init_cf( BackendInfo *bi )
2817 {
2818         int                     rc;
2819         AttributeDescription    *ad = NULL;
2820         const char              *text;
2821
2822         /* Make sure we don't exceed the bits reserved for userland */
2823         config_check_userland( LDAP_BACK_CFG_LAST );
2824
2825         bi->bi_cf_ocs = metaocs;
2826
2827         rc = config_register_schema( metacfg, metaocs );
2828         if ( rc ) {
2829                 return rc;
2830         }
2831
2832         /* setup olcDbAclPasswd and olcDbIDAssertPasswd
2833          * to be base64-encoded when written in LDIF form;
2834          * basically, we don't care if it fails */
2835         rc = slap_str2ad( "olcDbACLPasswd", &ad, &text );
2836         if ( rc ) {
2837                 Debug( LDAP_DEBUG_ANY, "config_back_initialize: "
2838                         "warning, unable to get \"olcDbACLPasswd\" "
2839                         "attribute description: %d: %s\n",
2840                         rc, text, 0 );
2841         } else {
2842                 (void)ldif_must_b64_encode_register( ad->ad_cname.bv_val,
2843                         ad->ad_type->sat_oid );
2844         }
2845
2846         ad = NULL;
2847         rc = slap_str2ad( "olcDbIDAssertPasswd", &ad, &text );
2848         if ( rc ) {
2849                 Debug( LDAP_DEBUG_ANY, "config_back_initialize: "
2850                         "warning, unable to get \"olcDbIDAssertPasswd\" "
2851                         "attribute description: %d: %s\n",
2852                         rc, text, 0 );
2853         } else {
2854                 (void)ldif_must_b64_encode_register( ad->ad_cname.bv_val,
2855                         ad->ad_type->sat_oid );
2856         }
2857
2858         return 0;
2859 }
2860
2861 static int
2862 ldap_back_map_config(
2863                 ConfigArgs *c,
2864                 struct ldapmap  *oc_map,
2865                 struct ldapmap  *at_map )
2866 {
2867         struct ldapmap          *map;
2868         struct ldapmapping      *mapping;
2869         char                    *src, *dst;
2870         int                     is_oc = 0;
2871
2872         if ( strcasecmp( c->argv[ 1 ], "objectclass" ) == 0 ) {
2873                 map = oc_map;
2874                 is_oc = 1;
2875
2876         } else if ( strcasecmp( c->argv[ 1 ], "attribute" ) == 0 ) {
2877                 map = at_map;
2878
2879         } else {
2880                 snprintf( c->cr_msg, sizeof(c->cr_msg),
2881                         "%s unknown argument \"%s\"",
2882                         c->argv[0], c->argv[1] );
2883                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2884                 return 1;
2885         }
2886
2887         if ( !is_oc && map->map == NULL ) {
2888                 /* only init if required */
2889                 ldap_back_map_init( map, &mapping );
2890         }
2891
2892         if ( strcmp( c->argv[ 2 ], "*" ) == 0 ) {
2893                 if ( c->argc < 4 || strcmp( c->argv[ 3 ], "*" ) == 0 ) {
2894                         map->drop_missing = ( c->argc < 4 );
2895                         goto success_return;
2896                 }
2897                 src = dst = c->argv[ 3 ];
2898
2899         } else if ( c->argc < 4 ) {
2900                 src = "";
2901                 dst = c->argv[ 2 ];
2902
2903         } else {
2904                 src = c->argv[ 2 ];
2905                 dst = ( strcmp( c->argv[ 3 ], "*" ) == 0 ? src : c->argv[ 3 ] );
2906         }
2907
2908         if ( ( map == at_map )
2909                 && ( strcasecmp( src, "objectclass" ) == 0
2910                         || strcasecmp( dst, "objectclass" ) == 0 ) )
2911         {
2912                 snprintf( c->cr_msg, sizeof(c->cr_msg),
2913                         "objectclass attribute cannot be mapped" );
2914                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2915                 return 1;
2916         }
2917
2918         mapping = (struct ldapmapping *)ch_calloc( 2,
2919                 sizeof(struct ldapmapping) );
2920         if ( mapping == NULL ) {
2921                 snprintf( c->cr_msg, sizeof(c->cr_msg),
2922                         "out of memory" );
2923                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2924                 return 1;
2925         }
2926         ber_str2bv( src, 0, 1, &mapping[ 0 ].src );
2927         ber_str2bv( dst, 0, 1, &mapping[ 0 ].dst );
2928         mapping[ 1 ].src = mapping[ 0 ].dst;
2929         mapping[ 1 ].dst = mapping[ 0 ].src;
2930
2931         /*
2932          * schema check
2933          */
2934         if ( is_oc ) {
2935                 if ( src[ 0 ] != '\0' ) {
2936                         if ( oc_bvfind( &mapping[ 0 ].src ) == NULL ) {
2937                                 Debug( LDAP_DEBUG_ANY,
2938         "warning, source objectClass '%s' should be defined in schema\n",
2939                                         c->log, src, 0 );
2940
2941                                 /*
2942                                  * FIXME: this should become an err
2943                                  */
2944                                 goto error_return;
2945                         }
2946                 }
2947
2948                 if ( oc_bvfind( &mapping[ 0 ].dst ) == NULL ) {
2949                         Debug( LDAP_DEBUG_ANY,
2950         "warning, destination objectClass '%s' is not defined in schema\n",
2951                                 c->log, dst, 0 );
2952                 }
2953         } else {
2954                 int                     rc;
2955                 const char              *text = NULL;
2956                 AttributeDescription    *ad = NULL;
2957
2958                 if ( src[ 0 ] != '\0' ) {
2959                         rc = slap_bv2ad( &mapping[ 0 ].src, &ad, &text );
2960                         if ( rc != LDAP_SUCCESS ) {
2961                                 Debug( LDAP_DEBUG_ANY,
2962         "warning, source attributeType '%s' should be defined in schema\n",
2963                                         c->log, src, 0 );
2964
2965                                 /*
2966                                  * FIXME: this should become an err
2967                                  */
2968                                 /*
2969                                  * we create a fake "proxied" ad
2970                                  * and add it here.
2971                                  */
2972
2973                                 rc = slap_bv2undef_ad( &mapping[ 0 ].src,
2974                                                 &ad, &text, SLAP_AD_PROXIED );
2975                                 if ( rc != LDAP_SUCCESS ) {
2976                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2977                                                 "source attributeType \"%s\": %d (%s)",
2978                                                 src, rc, text ? text : "" );
2979                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2980                                         goto error_return;
2981                                 }
2982                         }
2983
2984                         ad = NULL;
2985                 }
2986
2987                 rc = slap_bv2ad( &mapping[ 0 ].dst, &ad, &text );
2988                 if ( rc != LDAP_SUCCESS ) {
2989                         Debug( LDAP_DEBUG_ANY,
2990         "warning, destination attributeType '%s' is not defined in schema\n",
2991                                 c->log, dst, 0 );
2992
2993                         /*
2994                          * we create a fake "proxied" ad
2995                          * and add it here.
2996                          */
2997
2998                         rc = slap_bv2undef_ad( &mapping[ 0 ].dst,
2999                                         &ad, &text, SLAP_AD_PROXIED );
3000                         if ( rc != LDAP_SUCCESS ) {
3001                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
3002                                         "destination attributeType \"%s\": %d (%s)\n",
3003                                         dst, rc, text ? text : "" );
3004                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
3005                                 return 1;
3006                         }
3007                 }
3008         }
3009
3010         if ( (src[ 0 ] != '\0' && avl_find( map->map, (caddr_t)&mapping[ 0 ], mapping_cmp ) != NULL)
3011                         || avl_find( map->remap, (caddr_t)&mapping[ 1 ], mapping_cmp ) != NULL)
3012         {
3013                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
3014                         "duplicate mapping found." );
3015                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
3016                 goto error_return;
3017         }
3018
3019         if ( src[ 0 ] != '\0' ) {
3020                 avl_insert( &map->map, (caddr_t)&mapping[ 0 ],
3021                                         mapping_cmp, mapping_dup );
3022         }
3023         avl_insert( &map->remap, (caddr_t)&mapping[ 1 ],
3024                                 mapping_cmp, mapping_dup );
3025
3026 success_return:;
3027         return 0;
3028
3029 error_return:;
3030         if ( mapping ) {
3031                 ch_free( mapping[ 0 ].src.bv_val );
3032                 ch_free( mapping[ 0 ].dst.bv_val );
3033                 ch_free( mapping );
3034         }
3035
3036         return 1;
3037 }
3038
3039
3040 #ifdef ENABLE_REWRITE
3041 static char *
3042 suffix_massage_regexize( const char *s )
3043 {
3044         char *res, *ptr;
3045         const char *p, *r;
3046         int i;
3047
3048         if ( s[ 0 ] == '\0' ) {
3049                 return ch_strdup( "^(.+)$" );
3050         }
3051
3052         for ( i = 0, p = s;
3053                         ( r = strchr( p, ',' ) ) != NULL;
3054                         p = r + 1, i++ )
3055                 ;
3056
3057         res = ch_calloc( sizeof( char ),
3058                         strlen( s )
3059                         + STRLENOF( "((.+),)?" )
3060                         + STRLENOF( "[ ]?" ) * i
3061                         + STRLENOF( "$" ) + 1 );
3062
3063         ptr = lutil_strcopy( res, "((.+),)?" );
3064         for ( i = 0, p = s;
3065                         ( r = strchr( p, ',' ) ) != NULL;
3066                         p = r + 1 , i++ ) {
3067                 ptr = lutil_strncopy( ptr, p, r - p + 1 );
3068                 ptr = lutil_strcopy( ptr, "[ ]?" );
3069
3070                 if ( r[ 1 ] == ' ' ) {
3071                         r++;
3072                 }
3073         }
3074         ptr = lutil_strcopy( ptr, p );
3075         ptr[ 0 ] = '$';
3076         ptr++;
3077         ptr[ 0 ] = '\0';
3078
3079         return res;
3080 }
3081
3082 static char *
3083 suffix_massage_patternize( const char *s, const char *p )
3084 {
3085         ber_len_t       len;
3086         char            *res, *ptr;
3087
3088         len = strlen( p );
3089
3090         if ( s[ 0 ] == '\0' ) {
3091                 len++;
3092         }
3093
3094         res = ch_calloc( sizeof( char ), len + STRLENOF( "%1" ) + 1 );
3095         if ( res == NULL ) {
3096                 return NULL;
3097         }
3098
3099         ptr = lutil_strcopy( res, ( p[ 0 ] == '\0' ? "%2" : "%1" ) );
3100         if ( s[ 0 ] == '\0' ) {
3101                 ptr[ 0 ] = ',';
3102                 ptr++;
3103         }
3104         lutil_strcopy( ptr, p );
3105
3106         return res;
3107 }
3108
3109 int
3110 suffix_massage_config(
3111                 struct rewrite_info *info,
3112                 struct berval *pvnc,
3113                 struct berval *nvnc,
3114                 struct berval *prnc,
3115                 struct berval *nrnc
3116 )
3117 {
3118         char *rargv[ 5 ];
3119         int line = 0;
3120
3121         rargv[ 0 ] = "rewriteEngine";
3122         rargv[ 1 ] = "on";
3123         rargv[ 2 ] = NULL;
3124         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3125
3126         rargv[ 0 ] = "rewriteContext";
3127         rargv[ 1 ] = "default";
3128         rargv[ 2 ] = NULL;
3129         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3130
3131         rargv[ 0 ] = "rewriteRule";
3132         rargv[ 1 ] = suffix_massage_regexize( pvnc->bv_val );
3133         rargv[ 2 ] = suffix_massage_patternize( pvnc->bv_val, prnc->bv_val );
3134         rargv[ 3 ] = ":";
3135         rargv[ 4 ] = NULL;
3136         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3137         ch_free( rargv[ 1 ] );
3138         ch_free( rargv[ 2 ] );
3139
3140         if ( BER_BVISEMPTY( pvnc ) ) {
3141                 rargv[ 0 ] = "rewriteRule";
3142                 rargv[ 1 ] = "^$";
3143                 rargv[ 2 ] = prnc->bv_val;
3144                 rargv[ 3 ] = ":";
3145                 rargv[ 4 ] = NULL;
3146                 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3147         }
3148
3149         rargv[ 0 ] = "rewriteContext";
3150         rargv[ 1 ] = "searchEntryDN";
3151         rargv[ 2 ] = NULL;
3152         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3153
3154         rargv[ 0 ] = "rewriteRule";
3155         rargv[ 1 ] = suffix_massage_regexize( prnc->bv_val );
3156         rargv[ 2 ] = suffix_massage_patternize( prnc->bv_val, pvnc->bv_val );
3157         rargv[ 3 ] = ":";
3158         rargv[ 4 ] = NULL;
3159         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3160         ch_free( rargv[ 1 ] );
3161         ch_free( rargv[ 2 ] );
3162
3163         if ( BER_BVISEMPTY( prnc ) ) {
3164                 rargv[ 0 ] = "rewriteRule";
3165                 rargv[ 1 ] = "^$";
3166                 rargv[ 2 ] = pvnc->bv_val;
3167                 rargv[ 3 ] = ":";
3168                 rargv[ 4 ] = NULL;
3169                 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3170         }
3171
3172         /* backward compatibility */
3173         rargv[ 0 ] = "rewriteContext";
3174         rargv[ 1 ] = "searchResult";
3175         rargv[ 2 ] = "alias";
3176         rargv[ 3 ] = "searchEntryDN";
3177         rargv[ 4 ] = NULL;
3178         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3179
3180         rargv[ 0 ] = "rewriteContext";
3181         rargv[ 1 ] = "matchedDN";
3182         rargv[ 2 ] = "alias";
3183         rargv[ 3 ] = "searchEntryDN";
3184         rargv[ 4 ] = NULL;
3185         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3186
3187         rargv[ 0 ] = "rewriteContext";
3188         rargv[ 1 ] = "searchAttrDN";
3189         rargv[ 2 ] = "alias";
3190         rargv[ 3 ] = "searchEntryDN";
3191         rargv[ 4 ] = NULL;
3192         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3193
3194         /* NOTE: this corresponds to #undef'ining RWM_REFERRAL_REWRITE;
3195          * see servers/slapd/overlays/rwm.h for details */
3196         rargv[ 0 ] = "rewriteContext";
3197         rargv[ 1 ] = "referralAttrDN";
3198         rargv[ 2 ] = NULL;
3199         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3200
3201         rargv[ 0 ] = "rewriteContext";
3202         rargv[ 1 ] = "referralDN";
3203         rargv[ 2 ] = NULL;
3204         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3205
3206         return 0;
3207 }
3208 #endif /* ENABLE_REWRITE */
3209