git.sur5r.net Git - openldap/blob - servers/slapd/back-meta/config.c

   1 /* $OpenLDAP$ */
   2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   3  *
   4  * Copyright 1999-2012 The OpenLDAP Foundation.
   5  * Portions Copyright 2001-2003 Pierangelo Masarati.
   6  * Portions Copyright 1999-2003 Howard Chu.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted only as authorized by the OpenLDAP
  11  * Public License.
  12  *
  13  * A copy of this license is available in the file LICENSE in the
  14  * top-level directory of the distribution or, alternatively, at
  15  * <http://www.OpenLDAP.org/license.html>.
  16  */
  17 /* ACKNOWLEDGEMENTS:
  18  * This work was initially developed by the Howard Chu for inclusion
  19  * in OpenLDAP Software and subsequently enhanced by Pierangelo
  20  * Masarati.
  21  */
  22
  23 #include "portable.h"
  24
  25 #include <stdio.h>
  26
  27 #include <ac/string.h>
  28 #include <ac/socket.h>
  29
  30 #include "slap.h"
  31 #include "config.h"
  32 #include "lutil.h"
  33 #include "../back-ldap/back-ldap.h"
  34 #include "back-meta.h"
  35
  36 static ConfigDriver meta_back_cf_gen;
  37 static ConfigLDAPadd meta_ldadd;
  38 static ConfigCfAdd meta_cfadd;
  39
  40 static int ldap_back_map_config(
  41         ConfigArgs *c,
  42         struct ldapmap  *oc_map,
  43         struct ldapmap  *at_map );
  44
  45 /* Three sets of enums:
  46  *      1) attrs that are only valid in the base config
  47  *      2) attrs that are valid in base or target
  48  *      3) attrs that are only valid in a target
  49  */
  50
  51 /* Base attrs */
  52 enum {
  53         LDAP_BACK_CFG_CONN_TTL = 1,
  54         LDAP_BACK_CFG_DNCACHE_TTL,
  55         LDAP_BACK_CFG_IDLE_TIMEOUT,
  56         LDAP_BACK_CFG_ONERR,
  57         LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
  58         LDAP_BACK_CFG_SINGLECONN,
  59         LDAP_BACK_CFG_USETEMP,
  60         LDAP_BACK_CFG_CONNPOOLMAX,
  61         LDAP_BACK_CFG_LAST_BASE
  62 };
  63
  64 /* Base or target */
  65 enum {
  66         LDAP_BACK_CFG_BIND_TIMEOUT = LDAP_BACK_CFG_LAST_BASE,
  67         LDAP_BACK_CFG_CANCEL,
  68         LDAP_BACK_CFG_CHASE,
  69         LDAP_BACK_CFG_CLIENT_PR,
  70         LDAP_BACK_CFG_DEFAULT_T,
  71         LDAP_BACK_CFG_NETWORK_TIMEOUT,
  72         LDAP_BACK_CFG_NOREFS,
  73         LDAP_BACK_CFG_NOUNDEFFILTER,
  74         LDAP_BACK_CFG_NRETRIES,
  75         LDAP_BACK_CFG_QUARANTINE,
  76         LDAP_BACK_CFG_REBIND,
  77         LDAP_BACK_CFG_TIMEOUT,
  78         LDAP_BACK_CFG_VERSION,
  79         LDAP_BACK_CFG_ST_REQUEST,
  80         LDAP_BACK_CFG_T_F,
  81         LDAP_BACK_CFG_TLS,
  82         LDAP_BACK_CFG_LAST_BOTH
  83 };
  84
  85 /* Target attrs */
  86 enum {
  87         LDAP_BACK_CFG_URI = LDAP_BACK_CFG_LAST_BOTH,
  88         LDAP_BACK_CFG_ACL_AUTHCDN,
  89         LDAP_BACK_CFG_ACL_PASSWD,
  90         LDAP_BACK_CFG_IDASSERT_AUTHZFROM,
  91         LDAP_BACK_CFG_IDASSERT_BIND,
  92         LDAP_BACK_CFG_REWRITE,
  93         LDAP_BACK_CFG_SUFFIXM,
  94         LDAP_BACK_CFG_MAP,
  95         LDAP_BACK_CFG_SUBTREE_EX,
  96         LDAP_BACK_CFG_SUBTREE_IN,
  97         LDAP_BACK_CFG_PSEUDOROOTDN,
  98         LDAP_BACK_CFG_PSEUDOROOTPW,
  99
 100         LDAP_BACK_CFG_LAST
 101 };
 102
 103 static ConfigTable metacfg[] = {
 104         { "uri", "uri", 2, 0, 0,
 105                 ARG_MAGIC|LDAP_BACK_CFG_URI,
 106                 meta_back_cf_gen, "( OLcfgDbAt:0.14 "
 107                         "NAME 'olcDbURI' "
 108                         "DESC 'URI (list) for remote DSA' "
 109                         "SYNTAX OMsDirectoryString "
 110                         "SINGLE-VALUE )",
 111                 NULL, NULL },
 112         { "tls", "what", 2, 0, 0,
 113                 ARG_MAGIC|LDAP_BACK_CFG_TLS,
 114                 meta_back_cf_gen, "( OLcfgDbAt:3.1 "
 115                         "NAME 'olcDbStartTLS' "
 116                         "DESC 'StartTLS' "
 117                         "SYNTAX OMsDirectoryString "
 118                         "SINGLE-VALUE )",
 119                 NULL, NULL },
 120         { "acl-authcDN", "DN", 2, 2, 0,
 121                 ARG_DN|ARG_MAGIC|LDAP_BACK_CFG_ACL_AUTHCDN,
 122                 meta_back_cf_gen, "( OLcfgDbAt:3.2 "
 123                         "NAME 'olcDbACLAuthcDn' "
 124                         "DESC 'Remote ACL administrative identity' "
 125                         "OBSOLETE "
 126                         "SYNTAX OMsDN "
 127                         "SINGLE-VALUE )",
 128                 NULL, NULL },
 129         /* deprecated, will be removed; aliases "acl-authcDN" */
 130         { "binddn", "DN", 2, 2, 0,
 131                 ARG_DN|ARG_MAGIC|LDAP_BACK_CFG_ACL_AUTHCDN,
 132                 meta_back_cf_gen, NULL, NULL, NULL },
 133         { "acl-passwd", "cred", 2, 2, 0,
 134                 ARG_MAGIC|LDAP_BACK_CFG_ACL_PASSWD,
 135                 meta_back_cf_gen, "( OLcfgDbAt:3.3 "
 136                         "NAME 'olcDbACLPasswd' "
 137                         "DESC 'Remote ACL administrative identity credentials' "
 138                         "OBSOLETE "
 139                         "SYNTAX OMsDirectoryString "
 140                         "SINGLE-VALUE )",
 141                 NULL, NULL },
 142         /* deprecated, will be removed; aliases "acl-passwd" */
 143         { "bindpw", "cred", 2, 2, 0,
 144                 ARG_MAGIC|LDAP_BACK_CFG_ACL_PASSWD,
 145                 meta_back_cf_gen, NULL, NULL, NULL },
 146         { "idassert-bind", "args", 2, 0, 0,
 147                 ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_BIND,
 148                 meta_back_cf_gen, "( OLcfgDbAt:3.7 "
 149                         "NAME 'olcDbIDAssertBind' "
 150                         "DESC 'Remote Identity Assertion administrative identity auth bind configuration' "
 151                         "SYNTAX OMsDirectoryString "
 152                         "SINGLE-VALUE )",
 153                 NULL, NULL },
 154         { "idassert-authzFrom", "authzRule", 2, 2, 0,
 155                 ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_AUTHZFROM,
 156                 meta_back_cf_gen, "( OLcfgDbAt:3.9 "
 157                         "NAME 'olcDbIDAssertAuthzFrom' "
 158                         "DESC 'Remote Identity Assertion authz rules' "
 159                         "EQUALITY caseIgnoreMatch "
 160                         "SYNTAX OMsDirectoryString "
 161                         "X-ORDERED 'VALUES' )",
 162                 NULL, NULL },
 163         { "rebind-as-user", "true|FALSE", 1, 2, 0,
 164                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_REBIND,
 165                 meta_back_cf_gen, "( OLcfgDbAt:3.10 "
 166                         "NAME 'olcDbRebindAsUser' "
 167                         "DESC 'Rebind as user' "
 168                         "SYNTAX OMsBoolean "
 169                         "SINGLE-VALUE )",
 170                 NULL, NULL },
 171         { "chase-referrals", "true|FALSE", 2, 2, 0,
 172                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_CHASE,
 173                 meta_back_cf_gen, "( OLcfgDbAt:3.11 "
 174                         "NAME 'olcDbChaseReferrals' "
 175                         "DESC 'Chase referrals' "
 176                         "SYNTAX OMsBoolean "
 177                         "SINGLE-VALUE )",
 178                 NULL, NULL },
 179         { "t-f-support", "true|FALSE|discover", 2, 2, 0,
 180                 ARG_MAGIC|LDAP_BACK_CFG_T_F,
 181                 meta_back_cf_gen, "( OLcfgDbAt:3.12 "
 182                         "NAME 'olcDbTFSupport' "
 183                         "DESC 'Absolute filters support' "
 184                         "SYNTAX OMsDirectoryString "
 185                         "SINGLE-VALUE )",
 186                 NULL, NULL },
 187         { "timeout", "timeout(list)", 2, 0, 0,
 188                 ARG_MAGIC|LDAP_BACK_CFG_TIMEOUT,
 189                 meta_back_cf_gen, "( OLcfgDbAt:3.14 "
 190                         "NAME 'olcDbTimeout' "
 191                         "DESC 'Per-operation timeouts' "
 192                         "SYNTAX OMsDirectoryString "
 193                         "SINGLE-VALUE )",
 194                 NULL, NULL },
 195         { "idle-timeout", "timeout", 2, 2, 0,
 196                 ARG_MAGIC|LDAP_BACK_CFG_IDLE_TIMEOUT,
 197                 meta_back_cf_gen, "( OLcfgDbAt:3.15 "
 198                         "NAME 'olcDbIdleTimeout' "
 199                         "DESC 'connection idle timeout' "
 200                         "SYNTAX OMsDirectoryString "
 201                         "SINGLE-VALUE )",
 202                 NULL, NULL },
 203         { "conn-ttl", "ttl", 2, 2, 0,
 204                 ARG_MAGIC|LDAP_BACK_CFG_CONN_TTL,
 205                 meta_back_cf_gen, "( OLcfgDbAt:3.16 "
 206                         "NAME 'olcDbConnTtl' "
 207                         "DESC 'connection ttl' "
 208                         "SYNTAX OMsDirectoryString "
 209                         "SINGLE-VALUE )",
 210                 NULL, NULL },
 211         { "network-timeout", "timeout", 2, 2, 0,
 212                 ARG_MAGIC|LDAP_BACK_CFG_NETWORK_TIMEOUT,
 213                 meta_back_cf_gen, "( OLcfgDbAt:3.17 "
 214                         "NAME 'olcDbNetworkTimeout' "
 215                         "DESC 'connection network timeout' "
 216                         "SYNTAX OMsDirectoryString "
 217                         "SINGLE-VALUE )",
 218                 NULL, NULL },
 219         { "protocol-version", "version", 2, 2, 0,
 220                 ARG_MAGIC|ARG_INT|LDAP_BACK_CFG_VERSION,
 221                 meta_back_cf_gen, "( OLcfgDbAt:3.18 "
 222                         "NAME 'olcDbProtocolVersion' "
 223                         "DESC 'protocol version' "
 224                         "SYNTAX OMsInteger "
 225                         "SINGLE-VALUE )",
 226                 NULL, NULL },
 227         { "single-conn", "true|FALSE", 2, 2, 0,
 228                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_SINGLECONN,
 229                 meta_back_cf_gen, "( OLcfgDbAt:3.19 "
 230                         "NAME 'olcDbSingleConn' "
 231                         "DESC 'cache a single connection per identity' "
 232                         "SYNTAX OMsBoolean "
 233                         "SINGLE-VALUE )",
 234                 NULL, NULL },
 235         { "cancel", "ABANDON|ignore|exop", 2, 2, 0,
 236                 ARG_MAGIC|LDAP_BACK_CFG_CANCEL,
 237                 meta_back_cf_gen, "( OLcfgDbAt:3.20 "
 238                         "NAME 'olcDbCancel' "
 239                         "DESC 'abandon/ignore/exop operations when appropriate' "
 240                         "SYNTAX OMsDirectoryString "
 241                         "SINGLE-VALUE )",
 242                 NULL, NULL },
 243         { "quarantine", "retrylist", 2, 2, 0,
 244                 ARG_MAGIC|LDAP_BACK_CFG_QUARANTINE,
 245                 meta_back_cf_gen, "( OLcfgDbAt:3.21 "
 246                         "NAME 'olcDbQuarantine' "
 247                         "DESC 'Quarantine database if connection fails and retry according to rule' "
 248                         "SYNTAX OMsDirectoryString "
 249                         "SINGLE-VALUE )",
 250                 NULL, NULL },
 251         { "use-temporary-conn", "true|FALSE", 2, 2, 0,
 252                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_USETEMP,
 253                 meta_back_cf_gen, "( OLcfgDbAt:3.22 "
 254                         "NAME 'olcDbUseTemporaryConn' "
 255                         "DESC 'Use temporary connections if the cached one is busy' "
 256                         "SYNTAX OMsBoolean "
 257                         "SINGLE-VALUE )",
 258                 NULL, NULL },
 259         { "conn-pool-max", "<n>", 2, 2, 0,
 260                 ARG_MAGIC|ARG_INT|LDAP_BACK_CFG_CONNPOOLMAX,
 261                 meta_back_cf_gen, "( OLcfgDbAt:3.23 "
 262                         "NAME 'olcDbConnectionPoolMax' "
 263                         "DESC 'Max size of privileged connections pool' "
 264                         "SYNTAX OMsInteger "
 265                         "SINGLE-VALUE )",
 266                 NULL, NULL },
 267 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
 268         { "session-tracking-request", "true|FALSE", 2, 2, 0,
 269                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_ST_REQUEST,
 270                 meta_back_cf_gen, "( OLcfgDbAt:3.24 "
 271                         "NAME 'olcDbSessionTrackingRequest' "
 272                         "DESC 'Add session tracking control to proxied requests' "
 273                         "SYNTAX OMsBoolean "
 274                         "SINGLE-VALUE )",
 275                 NULL, NULL },
 276 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
 277         { "norefs", "true|FALSE", 2, 2, 0,
 278                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_NOREFS,
 279                 meta_back_cf_gen, "( OLcfgDbAt:3.25 "
 280                         "NAME 'olcDbNoRefs' "
 281                         "DESC 'Do not return search reference responses' "
 282                         "SYNTAX OMsBoolean "
 283                         "SINGLE-VALUE )",
 284                 NULL, NULL },
 285         { "noundeffilter", "true|FALSE", 2, 2, 0,
 286                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_NOUNDEFFILTER,
 287                 meta_back_cf_gen, "( OLcfgDbAt:3.26 "
 288                         "NAME 'olcDbNoUndefFilter' "
 289                         "DESC 'Do not propagate undefined search filters' "
 290                         "SYNTAX OMsBoolean "
 291                         "SINGLE-VALUE )",
 292                 NULL, NULL },
 293
 294         { "rewrite", "arglist", 2, 0, STRLENOF( "rewrite" ),
 295                 ARG_MAGIC|LDAP_BACK_CFG_REWRITE,
 296                 meta_back_cf_gen, "( OLcfgDbAt:3.101 "
 297                         "NAME 'olcDbRewrite' "
 298                         "DESC 'DN rewriting rules' "
 299                         "EQUALITY caseIgnoreMatch "
 300                         "SYNTAX OMsDirectoryString "
 301                         "X-ORDERED 'VALUES' )",
 302                 NULL, NULL },
 303         { "suffixmassage", "virtual> <real", 2, 3, 0,
 304                 ARG_MAGIC|LDAP_BACK_CFG_SUFFIXM,
 305                 meta_back_cf_gen, NULL, NULL, NULL },
 306
 307         { "map", "attribute|objectClass> [*|<local>] *|<remote", 3, 4, 0,
 308                 ARG_MAGIC|LDAP_BACK_CFG_MAP,
 309                 meta_back_cf_gen, "( OLcfgDbAt:3.102 "
 310                         "NAME 'olcDbMap' "
 311                         "DESC 'Map attribute and objectclass names' "
 312                         "EQUALITY caseIgnoreMatch "
 313                         "SYNTAX OMsDirectoryString "
 314                         "X-ORDERED 'VALUES' )",
 315                 NULL, NULL },
 316
 317         { "subtree-exclude", "pattern", 2, 2, 0,
 318                 ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_SUBTREE_EX,
 319                 meta_back_cf_gen, "( OLcfgDbAt:3.103 "
 320                         "NAME 'olcDbSubtreeExclude' "
 321                         "DESC 'DN of subtree to exclude from target' "
 322                         "EQUALITY caseIgnoreMatch "
 323                         "SYNTAX OMsDirectoryString )",
 324                 NULL, NULL },
 325         { "subtree-include", "pattern", 2, 2, 0,
 326                 ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_SUBTREE_IN,
 327                 meta_back_cf_gen, "( OLcfgDbAt:3.104 "
 328                         "NAME 'olcDbSubtreeInclude' "
 329                         "DESC 'DN of subtree to include in target' "
 330                         "EQUALITY caseIgnoreMatch "
 331                         "SYNTAX OMsDirectoryString )",
 332                 NULL, NULL },
 333         { "default-target", "[none|<target ID>]", 1, 2, 0,
 334                 ARG_MAGIC|LDAP_BACK_CFG_DEFAULT_T,
 335                 meta_back_cf_gen, "( OLcfgDbAt:3.105 "
 336                         "NAME 'olcDbDefaultTarget' "
 337                         "DESC 'Specify the default target' "
 338                         "SYNTAX OMsDirectoryString "
 339                         "SINGLE-VALUE )",
 340                 NULL, NULL },
 341         { "dncache-ttl", "ttl", 2, 2, 0,
 342                 ARG_MAGIC|LDAP_BACK_CFG_DNCACHE_TTL,
 343                 meta_back_cf_gen, "( OLcfgDbAt:3.106 "
 344                         "NAME 'olcDbDnCacheTtl' "
 345                         "DESC 'dncache ttl' "
 346                         "SYNTAX OMsDirectoryString "
 347                         "SINGLE-VALUE )",
 348                 NULL, NULL },
 349         { "bind-timeout", "microseconds", 2, 2, 0,
 350                 ARG_MAGIC|ARG_ULONG|LDAP_BACK_CFG_BIND_TIMEOUT,
 351                 meta_back_cf_gen, "( OLcfgDbAt:3.107 "
 352                         "NAME 'olcDbBindTimeout' "
 353                         "DESC 'bind timeout' "
 354                         "SYNTAX OMsDirectoryString "
 355                         "SINGLE-VALUE )",
 356                 NULL, NULL },
 357         { "onerr", "CONTINUE|report|stop", 2, 2, 0,
 358                 ARG_MAGIC|LDAP_BACK_CFG_ONERR,
 359                 meta_back_cf_gen, "( OLcfgDbAt:3.108 "
 360                         "NAME 'olcDbOnErr' "
 361                         "DESC 'error handling' "
 362                         "SYNTAX OMsDirectoryString "
 363                         "SINGLE-VALUE )",
 364                 NULL, NULL },
 365         { "pseudoroot-bind-defer", "TRUE|false", 2, 2, 0,
 366                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
 367                 meta_back_cf_gen, "( OLcfgDbAt:3.109 "
 368                         "NAME 'olcDbPseudoRootBindDefer' "
 369                         "DESC 'error handling' "
 370                         "SYNTAX OMsBoolean "
 371                         "SINGLE-VALUE )",
 372                 NULL, NULL },
 373         { "root-bind-defer", "TRUE|false", 2, 2, 0,
 374                 ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
 375                 meta_back_cf_gen, NULL, NULL, NULL },
 376         { "pseudorootdn", "dn", 2, 2, 0,
 377                 ARG_MAGIC|ARG_DN|LDAP_BACK_CFG_PSEUDOROOTDN,
 378                 meta_back_cf_gen, NULL, NULL, NULL },
 379         { "pseudorootpw", "password", 2, 2, 0,
 380                 ARG_MAGIC|ARG_STRING|LDAP_BACK_CFG_PSEUDOROOTDN,
 381                 meta_back_cf_gen, NULL, NULL, NULL },
 382         { "nretries", "NEVER|forever|<number>", 2, 2, 0,
 383                 ARG_MAGIC|LDAP_BACK_CFG_NRETRIES,
 384                 meta_back_cf_gen, "( OLcfgDbAt:3.110 "
 385                         "NAME 'olcDbNretries' "
 386                         "DESC 'retry handling' "
 387                         "SYNTAX OMsDirectoryString "
 388                         "SINGLE-VALUE )",
 389                 NULL, NULL },
 390         { "client-pr", "accept-unsolicited|disable|<size>", 2, 2, 0,
 391                 ARG_MAGIC|LDAP_BACK_CFG_CLIENT_PR,
 392                 meta_back_cf_gen, "( OLcfgDbAt:3.111 "
 393                         "NAME 'olcDbClientPr' "
 394                         "DESC 'PagedResults handling' "
 395                         "SYNTAX OMsDirectoryString "
 396                         "SINGLE-VALUE )",
 397                 NULL, NULL },
 398
 399         { "", "", 0, 0, 0, ARG_IGNORED,
 400                 NULL, "( OLcfgDbAt:3.100 NAME 'olcMetaSub' "
 401                         "DESC 'Placeholder to name a Target entry' "
 402                         "EQUALITY caseIgnoreMatch "
 403                         "SYNTAX OMsDirectoryString "
 404                         "SINGLE-VALUE X-ORDERED 'SIBLINGS' )", NULL, NULL },
 405
 406         { NULL, NULL, 0, 0, 0, ARG_IGNORED,
 407                 NULL, NULL, NULL, NULL }
 408 };
 409
 410 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
 411 #define ST_ATTR "$ olcDbSessionTrackingRequest "
 412 #else
 413 #define ST_ATTR ""
 414 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
 415
 416 #define COMMON_ATTRS    \
 417                         "$ olcDbBindTimeout " \
 418                         "$ olcDbCancel " \
 419                         "$ olcDbChaseReferrals " \
 420                         "$ olcDbClientPr " \
 421                         "$ olcDbDefaultTarget " \
 422                         "$ olcDbNetworkTimeout " \
 423                         "$ olcDbNoRefs " \
 424                         "$ olcDbNoUndefFilter " \
 425                         "$ olcDbNretries " \
 426                         "$ olcDbProtocolVersion " \
 427                         "$ olcDbQuarantine " \
 428                         "$ olcDbRebindAsUser " \
 429                         ST_ATTR \
 430                         "$ olcDbStartTLS " \
 431                         "$ olcDbTFSupport "
 432
 433 static ConfigOCs metaocs[] = {
 434         { "( OLcfgDbOc:3.2 "
 435                 "NAME 'olcMetaConfig' "
 436                 "DESC 'Meta backend configuration' "
 437                 "SUP olcDatabaseConfig "
 438                 "MAY ( olcDbConnTtl "
 439                         "$ olcDbDnCacheTtl "
 440                         "$ olcDbIdleTimeout "
 441                         "$ olcDbOnErr "
 442                         "$ olcDbPseudoRootBindDefer "
 443                         "$ olcDbSingleConn "
 444                         "$ olcDbUseTemporaryConn "
 445                         "$ olcDbConnectionPoolMax "
 446
 447                         /* defaults, may be overridden per-target */
 448                         COMMON_ATTRS
 449                 ") )",
 450                         Cft_Database, metacfg, NULL, meta_cfadd },
 451         { "( OLcfgDbOc:3.3 "
 452                 "NAME 'olcMetaTargetConfig' "
 453                 "DESC 'Meta target configuration' "
 454                 "SUP olcConfig STRUCTURAL "
 455                 "MUST ( olcMetaSub $ olcDbURI ) "
 456                 "MAY ( olcDbACLAuthcDn "
 457                         "$ olcDbACLPasswd "
 458                         "$ olcDbIDAssertAuthzFrom "
 459                         "$ olcDbIDAssertBind "
 460                         "$ olcDbMap "
 461                         "$ olcDbRewrite "
 462                         "$ olcDbSubtreeExclude "
 463                         "$ olcDbSubtreeInclude "
 464                         "$ olcDbTimeout "
 465
 466                         /* defaults may be inherited */
 467                         COMMON_ATTRS
 468                 ") )",
 469                         Cft_Misc, metacfg, meta_ldadd },
 470         { NULL, 0, NULL }
 471 };
 472
 473 static int
 474 meta_ldadd( CfEntryInfo *p, Entry *e, ConfigArgs *c )
 475 {
 476         if ( p->ce_type != Cft_Database || !p->ce_be ||
 477                 p->ce_be->be_cf_ocs != metaocs )
 478                 return LDAP_CONSTRAINT_VIOLATION;
 479
 480         c->be = p->ce_be;
 481         return LDAP_SUCCESS;
 482 }
 483
 484 static int
 485 meta_cfadd( Operation *op, SlapReply *rs, Entry *p, ConfigArgs *c )
 486 {
 487         metainfo_t      *mi = ( metainfo_t * )c->be->be_private;
 488         struct berval bv;
 489         int i;
 490
 491         bv.bv_val = c->cr_msg;
 492         for ( i=0; i<mi->mi_ntargets; i++ ) {
 493                 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg),
 494                         "olcMetaSub=" SLAP_X_ORDERED_FMT "uri", i );
 495                 c->ca_private = mi->mi_targets[i];
 496                 c->valx = i;
 497                 config_build_entry( op, rs, p->e_private, c,
 498                         &bv, &metaocs[1], NULL );
 499         }
 500
 501         return LDAP_SUCCESS;
 502 }
 503
 504 static int
 505 meta_rwi_init( struct rewrite_info **rwm_rw )
 506 {
 507         char                    *rargv[ 3 ];
 508
 509         *rwm_rw = rewrite_info_init( REWRITE_MODE_USE_DEFAULT );
 510         if ( *rwm_rw == NULL ) {
 511                 return -1;
 512         }
 513         /*
 514          * the filter rewrite as a string must be disabled
 515          * by default; it can be re-enabled by adding rules;
 516          * this creates an empty rewriteContext
 517          */
 518         rargv[ 0 ] = "rewriteContext";
 519         rargv[ 1 ] = "searchFilter";
 520         rargv[ 2 ] = NULL;
 521         rewrite_parse( *rwm_rw, "<suffix massage>", 1, 2, rargv );
 522
 523         rargv[ 0 ] = "rewriteContext";
 524         rargv[ 1 ] = "default";
 525         rargv[ 2 ] = NULL;
 526         rewrite_parse( *rwm_rw, "<suffix massage>", 1, 2, rargv );
 527
 528         return 0;
 529 }
 530
 531 static int
 532 meta_back_new_target(
 533         metatarget_t    **mtp )
 534 {
 535         metatarget_t            *mt;
 536
 537         *mtp = NULL;
 538
 539         mt = ch_calloc( sizeof( metatarget_t ), 1 );
 540
 541         if ( meta_rwi_init( &mt->mt_rwmap.rwm_rw )) {
 542                 ch_free( mt );
 543                 return -1;
 544         }
 545
 546         ldap_pvt_thread_mutex_init( &mt->mt_uri_mutex );
 547
 548         mt->mt_idassert_mode = LDAP_BACK_IDASSERT_LEGACY;
 549         mt->mt_idassert_authmethod = LDAP_AUTH_NONE;
 550         mt->mt_idassert_tls = SB_TLS_DEFAULT;
 551
 552         /* by default, use proxyAuthz control on each operation */
 553         mt->mt_idassert_flags = LDAP_BACK_AUTH_PRESCRIPTIVE;
 554
 555         *mtp = mt;
 556
 557         return 0;
 558 }
 559
 560 /* Validation for suffixmassage_config */
 561 static int
 562 meta_suffixm_config(
 563         ConfigArgs *c,
 564         int argc,
 565         char **argv,
 566         metatarget_t *mt
 567 )
 568 {
 569         BackendDB       *tmp_bd;
 570         struct berval   dn, nvnc, pvnc, nrnc, prnc;
 571         int j, rc;
 572
 573         /*
 574          * syntax:
 575          *
 576          *      suffixmassage <suffix> <massaged suffix>
 577          *
 578          * the <suffix> field must be defined as a valid suffix
 579          * (or suffixAlias?) for the current database;
 580          * the <massaged suffix> shouldn't have already been
 581          * defined as a valid suffix or suffixAlias for the
 582          * current server
 583          */
 584
 585         ber_str2bv( argv[ 1 ], 0, 0, &dn );
 586         if ( dnPrettyNormal( NULL, &dn, &pvnc, &nvnc, NULL ) != LDAP_SUCCESS ) {
 587                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
 588                         "suffix \"%s\" is invalid",
 589                         argv[1] );
 590                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
 591                 return 1;
 592         }
 593
 594         for ( j = 0; !BER_BVISNULL( &c->be->be_nsuffix[ j ] ); j++ ) {
 595                 if ( dnIsSuffix( &nvnc, &c->be->be_nsuffix[ 0 ] ) ) {
 596                         break;
 597                 }
 598         }
 599
 600         if ( BER_BVISNULL( &c->be->be_nsuffix[ j ] ) ) {
 601                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
 602                         "suffix \"%s\" must be within the database naming context",
 603                         argv[1] );
 604                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
 605                 free( pvnc.bv_val );
 606                 free( nvnc.bv_val );
 607                 return 1;
 608         }
 609
 610         ber_str2bv( argv[ 2 ], 0, 0, &dn );
 611         if ( dnPrettyNormal( NULL, &dn, &prnc, &nrnc, NULL ) != LDAP_SUCCESS ) {
 612                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
 613                         "massaged suffix \"%s\" is invalid",
 614                         argv[2] );
 615                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
 616                 free( pvnc.bv_val );
 617                 free( nvnc.bv_val );
 618                 return 1;
 619         }
 620
 621         tmp_bd = select_backend( &nrnc, 0 );
 622         if ( tmp_bd != NULL && tmp_bd->be_private == c->be->be_private ) {
 623                 Debug( LDAP_DEBUG_ANY,
 624         "%s: warning: <massaged suffix> \"%s\" resolves to this database, in "
 625         "\"suffixMassage <suffix> <massaged suffix>\"\n",
 626                         c->log, prnc.bv_val, 0 );
 627         }
 628
 629         /*
 630          * The suffix massaging is emulated by means of the
 631          * rewrite capabilities
 632          */
 633         rc = suffix_massage_config( mt->mt_rwmap.rwm_rw,
 634                         &pvnc, &nvnc, &prnc, &nrnc );
 635
 636         free( pvnc.bv_val );
 637         free( nvnc.bv_val );
 638         free( prnc.bv_val );
 639         free( nrnc.bv_val );
 640
 641         return rc;
 642 }
 643
 644 static int
 645 slap_bv_x_ordered_unparse( BerVarray in, BerVarray *out )
 646 {
 647         int             i;
 648         BerVarray       bva = NULL;
 649         char            ibuf[32], *ptr;
 650         struct berval   idx;
 651
 652         assert( in != NULL );
 653
 654         for ( i = 0; !BER_BVISNULL( &in[i] ); i++ )
 655                 /* count'em */ ;
 656
 657         if ( i == 0 ) {
 658                 return 1;
 659         }
 660
 661         idx.bv_val = ibuf;
 662
 663         bva = ch_malloc( ( i + 1 ) * sizeof(struct berval) );
 664         BER_BVZERO( &bva[ 0 ] );
 665
 666         for ( i = 0; !BER_BVISNULL( &in[i] ); i++ ) {
 667                 idx.bv_len = snprintf( idx.bv_val, sizeof( ibuf ), SLAP_X_ORDERED_FMT, i );
 668                 if ( idx.bv_len >= sizeof( ibuf ) ) {
 669                         ber_bvarray_free( bva );
 670                         return 1;
 671                 }
 672
 673                 bva[i].bv_len = idx.bv_len + in[i].bv_len;
 674                 bva[i].bv_val = ch_malloc( bva[i].bv_len + 1 );
 675                 ptr = lutil_strcopy( bva[i].bv_val, ibuf );
 676                 ptr = lutil_strcopy( ptr, in[i].bv_val );
 677                 *ptr = '\0';
 678                 BER_BVZERO( &bva[ i + 1 ] );
 679         }
 680
 681         *out = bva;
 682         return 0;
 683 }
 684
 685 int
 686 meta_subtree_free( metasubtree_t *ms )
 687 {
 688         switch ( ms->ms_type ) {
 689         case META_ST_SUBTREE:
 690         case META_ST_SUBORDINATE:
 691                 ber_memfree( ms->ms_dn.bv_val );
 692                 break;
 693
 694         case META_ST_REGEX:
 695                 regfree( &ms->ms_regex );
 696                 ber_memfree( ms->ms_regex_pattern.bv_val );
 697                 break;
 698
 699         default:
 700                 return -1;
 701         }
 702
 703         ch_free( ms );
 704         return 0;
 705 }
 706
 707 int
 708 meta_subtree_destroy( metasubtree_t *ms )
 709 {
 710         if ( ms->ms_next ) {
 711                 meta_subtree_destroy( ms->ms_next );
 712         }
 713
 714         return meta_subtree_free( ms );
 715 }
 716
 717 static struct berval st_styles[] = {
 718         BER_BVC("subtree"),
 719         BER_BVC("children"),
 720         BER_BVC("regex")
 721 };
 722
 723 static int
 724 meta_subtree_unparse(
 725         ConfigArgs *c,
 726         metatarget_t *mt )
 727 {
 728         metasubtree_t   *ms;
 729         struct berval bv, *style;
 730
 731         if ( !mt->mt_subtree )
 732                 return 1;
 733
 734         /* can only be one of exclude or include */
 735         if (( c->type == LDAP_BACK_CFG_SUBTREE_EX ) ^ mt->mt_subtree_exclude )
 736                 return 1;
 737
 738         bv.bv_val = c->cr_msg;
 739         for ( ms=mt->mt_subtree; ms; ms=ms->ms_next ) {
 740                 if (ms->ms_type == META_ST_SUBTREE)
 741                         style = &st_styles[0];
 742                 else if ( ms->ms_type == META_ST_SUBORDINATE )
 743                         style = &st_styles[1];
 744                 else if ( ms->ms_type == META_ST_REGEX )
 745                         style = &st_styles[2];
 746                 else {
 747                         assert(0);
 748                         continue;
 749                 }
 750                 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg),
 751                         "dn.%s:%s", style->bv_val, ms->ms_dn.bv_val );
 752                 value_add_one( &c->rvalue_vals, &bv );
 753         }
 754         return 0;
 755 }
 756
 757 static int
 758 meta_subtree_config(
 759         metatarget_t *mt,
 760         ConfigArgs *c )
 761 {
 762         meta_st_t       type = META_ST_SUBTREE;
 763         char            *pattern;
 764         struct berval   ndn = BER_BVNULL;
 765         metasubtree_t   *ms = NULL;
 766
 767         if ( c->type == LDAP_BACK_CFG_SUBTREE_EX ) {
 768                 if ( mt->mt_subtree && !mt->mt_subtree_exclude ) {
 769                         snprintf( c->cr_msg, sizeof(c->cr_msg),
 770                                 "\"subtree-exclude\" incompatible with previous \"subtree-include\" directives" );
 771                         return 1;
 772                 }
 773
 774                 mt->mt_subtree_exclude = 1;
 775
 776         } else {
 777                 if ( mt->mt_subtree && mt->mt_subtree_exclude ) {
 778                         snprintf( c->cr_msg, sizeof(c->cr_msg),
 779                                 "\"subtree-include\" incompatible with previous \"subtree-exclude\" directives" );
 780                         return 1;
 781                 }
 782         }
 783
 784         pattern = c->argv[1];
 785         if ( strncasecmp( pattern, "dn", STRLENOF( "dn" ) ) == 0 ) {
 786                 char *style;
 787
 788                 pattern = &pattern[STRLENOF( "dn")];
 789
 790                 if ( pattern[0] == '.' ) {
 791                         style = &pattern[1];
 792
 793                         if ( strncasecmp( style, "subtree", STRLENOF( "subtree" ) ) == 0 ) {
 794                                 type = META_ST_SUBTREE;
 795                                 pattern = &style[STRLENOF( "subtree" )];
 796
 797                         } else if ( strncasecmp( style, "children", STRLENOF( "children" ) ) == 0 ) {
 798                                 type = META_ST_SUBORDINATE;
 799                                 pattern = &style[STRLENOF( "children" )];
 800
 801                         } else if ( strncasecmp( style, "sub", STRLENOF( "sub" ) ) == 0 ) {
 802                                 type = META_ST_SUBTREE;
 803                                 pattern = &style[STRLENOF( "sub" )];
 804
 805                         } else if ( strncasecmp( style, "regex", STRLENOF( "regex" ) ) == 0 ) {
 806                                 type = META_ST_REGEX;
 807                                 pattern = &style[STRLENOF( "regex" )];
 808
 809                         } else {
 810                                 snprintf( c->cr_msg, sizeof(c->cr_msg), "unknown style in \"dn.<style>\"" );
 811                                 return 1;
 812                         }
 813                 }
 814
 815                 if ( pattern[0] != ':' ) {
 816                         snprintf( c->cr_msg, sizeof(c->cr_msg), "missing colon after \"dn.<style>\"" );
 817                         return 1;
 818                 }
 819                 pattern++;
 820         }
 821
 822         switch ( type ) {
 823         case META_ST_SUBTREE:
 824         case META_ST_SUBORDINATE: {
 825                 struct berval dn;
 826
 827                 ber_str2bv( pattern, 0, 0, &dn );
 828                 if ( dnNormalize( 0, NULL, NULL, &dn, &ndn, NULL )
 829                         != LDAP_SUCCESS )
 830                 {
 831                         snprintf( c->cr_msg, sizeof(c->cr_msg), "DN=\"%s\" is invalid", pattern );
 832                         return 1;
 833                 }
 834
 835                 if ( !dnIsSuffix( &ndn, &mt->mt_nsuffix ) ) {
 836                         snprintf( c->cr_msg, sizeof(c->cr_msg),
 837                                 "DN=\"%s\" is not a subtree of target \"%s\"",
 838                                 pattern, mt->mt_nsuffix.bv_val );
 839                         ber_memfree( ndn.bv_val );
 840                         return( 1 );
 841                 }
 842                 } break;
 843
 844         default:
 845                 /* silence warnings */
 846                 break;
 847         }
 848
 849         ms = ch_calloc( sizeof( metasubtree_t ), 1 );
 850         ms->ms_type = type;
 851
 852         switch ( ms->ms_type ) {
 853         case META_ST_SUBTREE:
 854         case META_ST_SUBORDINATE:
 855                 ms->ms_dn = ndn;
 856                 break;
 857
 858         case META_ST_REGEX: {
 859                 int rc;
 860
 861                 rc = regcomp( &ms->ms_regex, pattern, REG_EXTENDED|REG_ICASE );
 862                 if ( rc != 0 ) {
 863                         char regerr[ SLAP_TEXT_BUFLEN ];
 864
 865                         regerror( rc, &ms->ms_regex, regerr, sizeof(regerr) );
 866
 867                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
 868                                 "regular expression \"%s\" bad because of %s",
 869                                 pattern, regerr );
 870                         ch_free( ms );
 871                         return 1;
 872                 }
 873                 ber_str2bv( pattern, 0, 1, &ms->ms_regex_pattern );
 874                 } break;
 875         }
 876
 877         if ( mt->mt_subtree == NULL ) {
 878                  mt->mt_subtree = ms;
 879
 880         } else {
 881                 metasubtree_t **msp;
 882
 883                 for ( msp = &mt->mt_subtree; *msp; ) {
 884                         switch ( ms->ms_type ) {
 885                         case META_ST_SUBTREE:
 886                                 switch ( (*msp)->ms_type ) {
 887                                 case META_ST_SUBTREE:
 888                                         if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
 889                                                 metasubtree_t *tmp = *msp;
 890                                                 Debug( LDAP_DEBUG_CONFIG,
 891                                                         "%s: previous rule \"dn.subtree:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
 892                                                         c->log, pattern, (*msp)->ms_dn.bv_val );
 893                                                 *msp = (*msp)->ms_next;
 894                                                 tmp->ms_next = NULL;
 895                                                 meta_subtree_destroy( tmp );
 896                                                 continue;
 897
 898                                         } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) ) {
 899                                                 Debug( LDAP_DEBUG_CONFIG,
 900                                                         "%s: previous rule \"dn.subtree:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
 901                                                         c->log, (*msp)->ms_dn.bv_val, pattern );
 902                                                 meta_subtree_destroy( ms );
 903                                                 ms = NULL;
 904                                                 return( 0 );
 905                                         }
 906                                         break;
 907
 908                                 case META_ST_SUBORDINATE:
 909                                         if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
 910                                                 metasubtree_t *tmp = *msp;
 911                                                 Debug( LDAP_DEBUG_CONFIG,
 912                                                         "%s: previous rule \"dn.children:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
 913                                                         c->log, pattern, (*msp)->ms_dn.bv_val );
 914                                                 *msp = (*msp)->ms_next;
 915                                                 tmp->ms_next = NULL;
 916                                                 meta_subtree_destroy( tmp );
 917                                                 continue;
 918
 919                                         } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) && ms->ms_dn.bv_len > (*msp)->ms_dn.bv_len ) {
 920                                                 Debug( LDAP_DEBUG_CONFIG,
 921                                                         "%s: previous rule \"dn.children:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
 922                                                         c->log, (*msp)->ms_dn.bv_val, pattern );
 923                                                 meta_subtree_destroy( ms );
 924                                                 ms = NULL;
 925                                                 return( 0 );
 926                                         }
 927                                         break;
 928
 929                                 case META_ST_REGEX:
 930                                         if ( regexec( &(*msp)->ms_regex, ms->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
 931                                                 Debug( LDAP_DEBUG_CONFIG,
 932                                                         "%s: previous rule \"dn.regex:%s\" may contain rule \"dn.subtree:%s\"\n",
 933                                                         c->log, (*msp)->ms_regex_pattern.bv_val, ms->ms_dn.bv_val );
 934                                         }
 935                                         break;
 936                                 }
 937                                 break;
 938
 939                         case META_ST_SUBORDINATE:
 940                                 switch ( (*msp)->ms_type ) {
 941                                 case META_ST_SUBTREE:
 942                                         if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
 943                                                 metasubtree_t *tmp = *msp;
 944                                                 Debug( LDAP_DEBUG_CONFIG,
 945                                                         "%s: previous rule \"dn.children:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
 946                                                         c->log, pattern, (*msp)->ms_dn.bv_val );
 947                                                 *msp = (*msp)->ms_next;
 948                                                 tmp->ms_next = NULL;
 949                                                 meta_subtree_destroy( tmp );
 950                                                 continue;
 951
 952                                         } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) && ms->ms_dn.bv_len > (*msp)->ms_dn.bv_len ) {
 953                                                 Debug( LDAP_DEBUG_CONFIG,
 954                                                         "%s: previous rule \"dn.children:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
 955                                                         c->log, (*msp)->ms_dn.bv_val, pattern );
 956                                                 meta_subtree_destroy( ms );
 957                                                 ms = NULL;
 958                                                 return( 0 );
 959                                         }
 960                                         break;
 961
 962                                 case META_ST_SUBORDINATE:
 963                                         if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
 964                                                 metasubtree_t *tmp = *msp;
 965                                                 Debug( LDAP_DEBUG_CONFIG,
 966                                                         "%s: previous rule \"dn.children:%s\" is contained in rule \"dn.children:%s\" (replaced)\n",
 967                                                         c->log, pattern, (*msp)->ms_dn.bv_val );
 968                                                 *msp = (*msp)->ms_next;
 969                                                 tmp->ms_next = NULL;
 970                                                 meta_subtree_destroy( tmp );
 971                                                 continue;
 972
 973                                         } else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) ) {
 974                                                 Debug( LDAP_DEBUG_CONFIG,
 975                                                         "%s: previous rule \"dn.children:%s\" contains rule \"dn.children:%s\" (ignored)\n",
 976                                                         c->log, (*msp)->ms_dn.bv_val, pattern );
 977                                                 meta_subtree_destroy( ms );
 978                                                 ms = NULL;
 979                                                 return( 0 );
 980                                         }
 981                                         break;
 982
 983                                 case META_ST_REGEX:
 984                                         if ( regexec( &(*msp)->ms_regex, ms->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
 985                                                 Debug( LDAP_DEBUG_CONFIG,
 986                                                         "%s: previous rule \"dn.regex:%s\" may contain rule \"dn.subtree:%s\"\n",
 987                                                         c->log, (*msp)->ms_regex_pattern.bv_val, ms->ms_dn.bv_val );
 988                                         }
 989                                         break;
 990                                 }
 991                                 break;
 992
 993                         case META_ST_REGEX:
 994                                 switch ( (*msp)->ms_type ) {
 995                                 case META_ST_SUBTREE:
 996                                 case META_ST_SUBORDINATE:
 997                                         if ( regexec( &ms->ms_regex, (*msp)->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
 998                                                 Debug( LDAP_DEBUG_CONFIG,
 999                                                         "%s: previous rule \"dn.subtree:%s\" may be contained in rule \"dn.regex:%s\"\n",
1000                                                         c->log, (*msp)->ms_dn.bv_val, ms->ms_regex_pattern.bv_val );
1001                                         }
1002                                         break;
1003
1004                                 case META_ST_REGEX:
1005                                         /* no check possible */
1006                                         break;
1007                                 }
1008                                 break;
1009                         }
1010
1011                         msp = &(*msp)->ms_next;
1012                 }
1013
1014                 *msp = ms;
1015         }
1016
1017         return 0;
1018 }
1019
1020 static slap_verbmasks idassert_mode[] = {
1021         { BER_BVC("self"),              LDAP_BACK_IDASSERT_SELF },
1022         { BER_BVC("anonymous"),         LDAP_BACK_IDASSERT_ANONYMOUS },
1023         { BER_BVC("none"),              LDAP_BACK_IDASSERT_NOASSERT },
1024         { BER_BVC("legacy"),            LDAP_BACK_IDASSERT_LEGACY },
1025         { BER_BVNULL,                   0 }
1026 };
1027
1028 static slap_verbmasks tls_mode[] = {
1029         { BER_BVC( "propagate" ),       LDAP_BACK_F_TLS_PROPAGATE_MASK },
1030         { BER_BVC( "try-propagate" ),   LDAP_BACK_F_PROPAGATE_TLS },
1031         { BER_BVC( "start" ),           LDAP_BACK_F_TLS_USE_MASK },
1032         { BER_BVC( "try-start" ),       LDAP_BACK_F_USE_TLS },
1033         { BER_BVC( "ldaps" ),           LDAP_BACK_F_TLS_LDAPS },
1034         { BER_BVC( "none" ),            LDAP_BACK_F_NONE },
1035         { BER_BVNULL,                   0 }
1036 };
1037
1038 static slap_verbmasks t_f_mode[] = {
1039         { BER_BVC( "yes" ),             LDAP_BACK_F_T_F },
1040         { BER_BVC( "discover" ),        LDAP_BACK_F_T_F_DISCOVER },
1041         { BER_BVC( "no" ),              LDAP_BACK_F_NONE },
1042         { BER_BVNULL,                   0 }
1043 };
1044
1045 static slap_verbmasks cancel_mode[] = {
1046         { BER_BVC( "ignore" ),          LDAP_BACK_F_CANCEL_IGNORE },
1047         { BER_BVC( "exop" ),            LDAP_BACK_F_CANCEL_EXOP },
1048         { BER_BVC( "exop-discover" ),   LDAP_BACK_F_CANCEL_EXOP_DISCOVER },
1049         { BER_BVC( "abandon" ),         LDAP_BACK_F_CANCEL_ABANDON },
1050         { BER_BVNULL,                   0 }
1051 };
1052
1053 static slap_verbmasks onerr_mode[] = {
1054         { BER_BVC( "stop" ),            META_BACK_F_ONERR_STOP },
1055         { BER_BVC( "report" ),  META_BACK_F_ONERR_REPORT },
1056         { BER_BVC( "continue" ),                LDAP_BACK_F_NONE },
1057         { BER_BVNULL,                   0 }
1058 };
1059
1060 /* see enum in slap.h */
1061 static slap_cf_aux_table timeout_table[] = {
1062         { BER_BVC("bind="),     SLAP_OP_BIND * sizeof( time_t ),        'u', 0, NULL },
1063         /* unbind makes no sense */
1064         { BER_BVC("add="),      SLAP_OP_ADD * sizeof( time_t ),         'u', 0, NULL },
1065         { BER_BVC("delete="),   SLAP_OP_DELETE * sizeof( time_t ),      'u', 0, NULL },
1066         { BER_BVC("modrdn="),   SLAP_OP_MODRDN * sizeof( time_t ),      'u', 0, NULL },
1067         { BER_BVC("modify="),   SLAP_OP_MODIFY * sizeof( time_t ),      'u', 0, NULL },
1068         { BER_BVC("compare="),  SLAP_OP_COMPARE * sizeof( time_t ),     'u', 0, NULL },
1069         { BER_BVC("search="),   SLAP_OP_SEARCH * sizeof( time_t ),      'u', 0, NULL },
1070         /* abandon makes little sense */
1071 #if 0   /* not implemented yet */
1072         { BER_BVC("extended="), SLAP_OP_EXTENDED * sizeof( time_t ),    'u', 0, NULL },
1073 #endif
1074         { BER_BVNULL, 0, 0, 0, NULL }
1075 };
1076
1077 static int
1078 meta_back_cf_gen( ConfigArgs *c )
1079 {
1080         metainfo_t      *mi = ( metainfo_t * )c->be->be_private;
1081         metatarget_t    *mt;
1082         metacommon_t    *mc;
1083
1084         int i, rc = 0;
1085
1086         assert( mi != NULL );
1087
1088         if ( c->op == SLAP_CONFIG_EMIT ) {
1089                 struct berval bv = BER_BVNULL;
1090
1091                 if ( !mi )
1092                         return 1;
1093
1094                 if ( c->table == Cft_Database ) {
1095                         mt = NULL;
1096                         mc = &mi->mi_mc;
1097                 } else {
1098                         mt = c->ca_private;
1099                         mc = &mt->mt_mc;
1100                 }
1101
1102                 switch( c->type ) {
1103                 /* Base attrs */
1104                 case LDAP_BACK_CFG_CONN_TTL:
1105                         if ( mi->mi_conn_ttl == 0 ) {
1106                                 return 1;
1107                         } else {
1108                                 char    buf[ SLAP_TEXT_BUFLEN ];
1109
1110                                 lutil_unparse_time( buf, sizeof( buf ), mi->mi_conn_ttl );
1111                                 ber_str2bv( buf, 0, 0, &bv );
1112                                 value_add_one( &c->rvalue_vals, &bv );
1113                         }
1114                         break;
1115
1116                 case LDAP_BACK_CFG_DNCACHE_TTL:
1117                         if ( mi->mi_cache.ttl == META_DNCACHE_DISABLED ) {
1118                                 return 1;
1119                         } else if ( mi->mi_cache.ttl == META_DNCACHE_FOREVER ) {
1120                                 BER_BVSTR( &bv, "forever" );
1121                         } else {
1122                                 char    buf[ SLAP_TEXT_BUFLEN ];
1123
1124                                 lutil_unparse_time( buf, sizeof( buf ), mi->mi_cache.ttl );
1125                                 ber_str2bv( buf, 0, 0, &bv );
1126                         }
1127                         value_add_one( &c->rvalue_vals, &bv );
1128                         break;
1129
1130                 case LDAP_BACK_CFG_IDLE_TIMEOUT:
1131                         if ( mi->mi_idle_timeout == 0 ) {
1132                                 return 1;
1133                         } else {
1134                                 char    buf[ SLAP_TEXT_BUFLEN ];
1135
1136                                 lutil_unparse_time( buf, sizeof( buf ), mi->mi_idle_timeout );
1137                                 ber_str2bv( buf, 0, 0, &bv );
1138                                 value_add_one( &c->rvalue_vals, &bv );
1139                         }
1140                         break;
1141
1142                 case LDAP_BACK_CFG_ONERR:
1143                         enum_to_verb( onerr_mode, mi->mi_flags & META_BACK_F_ONERR_MASK, &bv );
1144                         if ( BER_BVISNULL( &bv )) {
1145                                 rc = 1;
1146                         } else {
1147                                 value_add_one( &c->rvalue_vals, &bv );
1148                         }
1149                         break;
1150
1151                 case LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER:
1152                         c->value_int = META_BACK_DEFER_ROOTDN_BIND( mi );
1153                         break;
1154
1155                 case LDAP_BACK_CFG_SINGLECONN:
1156                         c->value_int = LDAP_BACK_SINGLECONN( mi );
1157                         break;
1158
1159                 case LDAP_BACK_CFG_USETEMP:
1160                         c->value_int = LDAP_BACK_USE_TEMPORARIES( mi );
1161                         break;
1162
1163                 case LDAP_BACK_CFG_CONNPOOLMAX:
1164                         c->value_int = mi->mi_conn_priv_max;
1165                         break;
1166
1167                 /* common attrs */
1168                 case LDAP_BACK_CFG_BIND_TIMEOUT:
1169                         if ( mc->mc_bind_timeout.tv_sec == 0 &&
1170                                 mc->mc_bind_timeout.tv_usec == 0 ) {
1171                                 return 1;
1172                         } else {
1173                                 c->value_ulong = mc->mc_bind_timeout.tv_sec * 1000000UL +
1174                                         mc->mc_bind_timeout.tv_usec;
1175                         }
1176                         break;
1177
1178                 case LDAP_BACK_CFG_CANCEL: {
1179                         slap_mask_t     mask = LDAP_BACK_F_CANCEL_MASK2;
1180
1181                         if ( mt && META_BACK_TGT_CANCEL_DISCOVER( mt ) ) {
1182                                 mask &= ~LDAP_BACK_F_CANCEL_EXOP;
1183                         }
1184                         enum_to_verb( cancel_mode, (mc->mc_flags & mask), &bv );
1185                         if ( BER_BVISNULL( &bv ) ) {
1186                                 /* there's something wrong... */
1187                                 assert( 0 );
1188                                 rc = 1;
1189
1190                         } else {
1191                                 value_add_one( &c->rvalue_vals, &bv );
1192                         }
1193                         } break;
1194
1195                 case LDAP_BACK_CFG_CHASE:
1196                         c->value_int = META_BACK_CMN_CHASE_REFERRALS(mc);
1197                         break;
1198
1199 #ifdef SLAPD_META_CLIENT_PR
1200                 case LDAP_BACK_CFG_CLIENT_PR:
1201                         if ( mc->mc_ps == META_CLIENT_PR_DISABLE ) {
1202                                 return 1;
1203                         } else if ( mc->mc_ps == META_CLIENT_PR_ACCEPT_UNSOLICITED ) {
1204                                 BER_BVSTR( &bv, "accept-unsolicited" );
1205                         } else {
1206                                 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d", mc->mc_ps );
1207                                 bv.bv_val = c->cr_msg;
1208                         }
1209                         value_add_one( &c->rvalue_vals, &bv );
1210                         break;
1211 #endif /* SLAPD_META_CLIENT_PR */
1212
1213                 case LDAP_BACK_CFG_DEFAULT_T:
1214                         if ( mt || mi->mi_defaulttarget == META_DEFAULT_TARGET_NONE )
1215                                 return 1;
1216                         bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d", mi->mi_defaulttarget );
1217                         bv.bv_val = c->cr_msg;
1218                         value_add_one( &c->rvalue_vals, &bv );
1219                         break;
1220
1221                 case LDAP_BACK_CFG_NETWORK_TIMEOUT:
1222                         if ( mc->mc_network_timeout == 0 ) {
1223                                 return 1;
1224                         }
1225                         bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%ld",
1226                                 mc->mc_network_timeout );
1227                         bv.bv_val = c->cr_msg;
1228                         value_add_one( &c->rvalue_vals, &bv );
1229                         break;
1230
1231                 case LDAP_BACK_CFG_NOREFS:
1232                         c->value_int = META_BACK_CMN_NOREFS(mc);
1233                         break;
1234
1235                 case LDAP_BACK_CFG_NOUNDEFFILTER:
1236                         c->value_int = META_BACK_CMN_NOUNDEFFILTER(mc);
1237                         break;
1238
1239                 case LDAP_BACK_CFG_NRETRIES:
1240                         if ( mc->mc_nretries == META_RETRY_FOREVER ) {
1241                                 BER_BVSTR( &bv, "forever" );
1242                         } else if ( mc->mc_nretries == META_RETRY_NEVER ) {
1243                                 BER_BVSTR( &bv, "never" );
1244                         } else {
1245                                 bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d",
1246                                         mc->mc_nretries );
1247                                 bv.bv_val = c->cr_msg;
1248                         }
1249                         value_add_one( &c->rvalue_vals, &bv );
1250                         break;
1251
1252                 case LDAP_BACK_CFG_QUARANTINE:
1253                         if ( !META_BACK_CMN_QUARANTINE( mc )) {
1254                                 rc = 1;
1255                                 break;
1256                         }
1257                         rc = mi->mi_ldap_extra->retry_info_unparse( &mc->mc_quarantine, &bv );
1258                         if ( rc == 0 ) {
1259                                 ber_bvarray_add( &c->rvalue_vals, &bv );
1260                         }
1261                         break;
1262
1263                 case LDAP_BACK_CFG_REBIND:
1264                         c->value_int = META_BACK_CMN_SAVECRED(mc);
1265                         break;
1266
1267                 case LDAP_BACK_CFG_TIMEOUT:
1268                         for ( i = 0; i < SLAP_OP_LAST; i++ ) {
1269                                 if ( mc->mc_timeout[ i ] != 0 ) {
1270                                         break;
1271                                 }
1272                         }
1273
1274                         if ( i == SLAP_OP_LAST ) {
1275                                 return 1;
1276                         }
1277
1278                         BER_BVZERO( &bv );
1279                         slap_cf_aux_table_unparse( mc->mc_timeout, &bv, timeout_table );
1280
1281                         if ( BER_BVISNULL( &bv ) ) {
1282                                 return 1;
1283                         }
1284
1285                         for ( i = 0; isspace( (unsigned char) bv.bv_val[ i ] ); i++ )
1286                                 /* count spaces */ ;
1287
1288                         if ( i ) {
1289                                 bv.bv_len -= i;
1290                                 AC_MEMCPY( bv.bv_val, &bv.bv_val[ i ],
1291                                         bv.bv_len + 1 );
1292                         }
1293
1294                         ber_bvarray_add( &c->rvalue_vals, &bv );
1295                         break;
1296
1297                 case LDAP_BACK_CFG_VERSION:
1298                         if ( mc->mc_version == 0 )
1299                                 return 1;
1300                         c->value_int = mc->mc_version;
1301                         break;
1302
1303 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
1304                 case LDAP_BACK_CFG_ST_REQUEST:
1305                         c->value_int = META_BACK_CMN_ST_REQUEST( mc );
1306                         break;
1307 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
1308
1309                 case LDAP_BACK_CFG_T_F:
1310                         enum_to_verb( t_f_mode, (mc->mc_flags & LDAP_BACK_F_T_F_MASK2), &bv );
1311                         if ( BER_BVISNULL( &bv ) ) {
1312                                 /* there's something wrong... */
1313                                 assert( 0 );
1314                                 rc = 1;
1315
1316                         } else {
1317                                 value_add_one( &c->rvalue_vals, &bv );
1318                         }
1319                         break;
1320
1321                 case LDAP_BACK_CFG_TLS: {
1322                         struct berval bc = BER_BVNULL, bv2;
1323
1324                         if (( mc->mc_flags & LDAP_BACK_F_TLS_MASK ) == LDAP_BACK_F_NONE ) {
1325                                 rc = 1;
1326                                 break;
1327                         }
1328                         enum_to_verb( tls_mode, ( mc->mc_flags & LDAP_BACK_F_TLS_MASK ), &bv );
1329                         assert( !BER_BVISNULL( &bv ) );
1330
1331                         if ( mt ) {
1332                                 bindconf_tls_unparse( &mt->mt_tls, &bc );
1333                         }
1334
1335                         if ( !BER_BVISEMPTY( &bc )) {
1336                                 bv2.bv_len = bv.bv_len + bc.bv_len + 1;
1337                                 bv2.bv_val = ch_malloc( bv2.bv_len + 1 );
1338                                 strcpy( bv2.bv_val, bv.bv_val );
1339                                 bv2.bv_val[bv.bv_len] = ' ';
1340                                 strcpy( &bv2.bv_val[bv.bv_len + 1], bc.bv_val );
1341                                 ber_memfree( bc.bv_val );
1342                                 ber_bvarray_add( &c->rvalue_vals, &bv2 );
1343                         } else {
1344                                 value_add_one( &c->rvalue_vals, &bv );
1345                         }
1346                         } break;
1347
1348                 /* target attrs */
1349                 case LDAP_BACK_CFG_URI: {
1350                         char *p2, *p1 = strchr( mt->mt_uri, ' ' );
1351                         bv.bv_len = strlen( mt->mt_uri ) + 1 + mt->mt_psuffix.bv_len;
1352                         bv.bv_val = ch_malloc( bv.bv_len + 1 );
1353                         if ( p1 ) {
1354                                 p2 = lutil_strncopy( bv.bv_val, mt->mt_uri, p1 - mt->mt_uri );
1355                         } else {
1356                                 p2 = lutil_strcopy( bv.bv_val, mt->mt_uri );
1357                         }
1358                         *p2++ = '/';
1359                         p2 = lutil_strcopy( p2, mt->mt_psuffix.bv_val );
1360                         if ( p1 ) {
1361                                 strcpy( p2, p1 );
1362                         }
1363                         ber_bvarray_add( &c->rvalue_vals, &bv );
1364                         } break;
1365
1366                 case LDAP_BACK_CFG_ACL_AUTHCDN:
1367                 case LDAP_BACK_CFG_ACL_PASSWD:
1368                         /* FIXME no point here, there is no code implementing
1369                          * their features. Was this supposed to implement
1370                          * acl-bind like back-ldap?
1371                          */
1372                         rc = 1;
1373                         break;
1374
1375                 case LDAP_BACK_CFG_IDASSERT_AUTHZFROM: {
1376                         BerVarray       *bvp;
1377                         int             i;
1378                         struct berval   bv = BER_BVNULL;
1379                         char            buf[SLAP_TEXT_BUFLEN];
1380
1381                         bvp = &mt->mt_idassert_authz;
1382                         if ( *bvp == NULL ) {
1383                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_AUTHZ_ALL )
1384                                 {
1385                                         BER_BVSTR( &bv, "*" );
1386                                         value_add_one( &c->rvalue_vals, &bv );
1387
1388                                 } else {
1389                                         rc = 1;
1390                                 }
1391                                 break;
1392                         }
1393
1394                         for ( i = 0; !BER_BVISNULL( &((*bvp)[ i ]) ); i++ ) {
1395                                 char *ptr;
1396                                 int len = snprintf( buf, sizeof( buf ), SLAP_X_ORDERED_FMT, i );
1397                                 bv.bv_len = ((*bvp)[ i ]).bv_len + len;
1398                                 bv.bv_val = ber_memrealloc( bv.bv_val, bv.bv_len + 1 );
1399                                 ptr = bv.bv_val;
1400                                 ptr = lutil_strcopy( ptr, buf );
1401                                 ptr = lutil_strncopy( ptr, ((*bvp)[ i ]).bv_val, ((*bvp)[ i ]).bv_len );
1402                                 value_add_one( &c->rvalue_vals, &bv );
1403                         }
1404                         if ( bv.bv_val ) {
1405                                 ber_memfree( bv.bv_val );
1406                         }
1407                         break;
1408                 }
1409
1410                 case LDAP_BACK_CFG_IDASSERT_BIND: {
1411                         int             i;
1412                         struct berval   bc = BER_BVNULL;
1413                         char            *ptr;
1414
1415                         if ( mt->mt_idassert_authmethod == LDAP_AUTH_NONE ) {
1416                                 return 1;
1417                         } else {
1418                                 ber_len_t       len;
1419
1420                                 switch ( mt->mt_idassert_mode ) {
1421                                 case LDAP_BACK_IDASSERT_OTHERID:
1422                                 case LDAP_BACK_IDASSERT_OTHERDN:
1423                                         break;
1424
1425                                 default: {
1426                                         struct berval   mode = BER_BVNULL;
1427
1428                                         enum_to_verb( idassert_mode, mt->mt_idassert_mode, &mode );
1429                                         if ( BER_BVISNULL( &mode ) ) {
1430                                                 /* there's something wrong... */
1431                                                 assert( 0 );
1432                                                 rc = 1;
1433
1434                                         } else {
1435                                                 bv.bv_len = STRLENOF( "mode=" ) + mode.bv_len;
1436                                                 bv.bv_val = ch_malloc( bv.bv_len + 1 );
1437
1438                                                 ptr = lutil_strcopy( bv.bv_val, "mode=" );
1439                                                 ptr = lutil_strcopy( ptr, mode.bv_val );
1440                                         }
1441                                         break;
1442                                 }
1443                                 }
1444
1445                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_NATIVE_AUTHZ ) {
1446                                         len = bv.bv_len + STRLENOF( "authz=native" );
1447
1448                                         if ( !BER_BVISEMPTY( &bv ) ) {
1449                                                 len += STRLENOF( " " );
1450                                         }
1451
1452                                         bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
1453
1454                                         ptr = &bv.bv_val[ bv.bv_len ];
1455
1456                                         if ( !BER_BVISEMPTY( &bv ) ) {
1457                                                 ptr = lutil_strcopy( ptr, " " );
1458                                         }
1459
1460                                         (void)lutil_strcopy( ptr, "authz=native" );
1461                                 }
1462
1463                                 len = bv.bv_len + STRLENOF( "flags=non-prescriptive,override,obsolete-encoding-workaround,proxy-authz-non-critical,dn-authzid" );
1464                                 /* flags */
1465                                 if ( !BER_BVISEMPTY( &bv ) ) {
1466                                         len += STRLENOF( " " );
1467                                 }
1468
1469                                 bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
1470
1471                                 ptr = &bv.bv_val[ bv.bv_len ];
1472
1473                                 if ( !BER_BVISEMPTY( &bv ) ) {
1474                                         ptr = lutil_strcopy( ptr, " " );
1475                                 }
1476
1477                                 ptr = lutil_strcopy( ptr, "flags=" );
1478
1479                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_PRESCRIPTIVE ) {
1480                                         ptr = lutil_strcopy( ptr, "prescriptive" );
1481                                 } else {
1482                                         ptr = lutil_strcopy( ptr, "non-prescriptive" );
1483                                 }
1484
1485                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OVERRIDE ) {
1486                                         ptr = lutil_strcopy( ptr, ",override" );
1487                                 }
1488
1489                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_PROXY_AUTHZ ) {
1490                                         ptr = lutil_strcopy( ptr, ",obsolete-proxy-authz" );
1491
1492                                 } else if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_ENCODING_WORKAROUND ) {
1493                                         ptr = lutil_strcopy( ptr, ",obsolete-encoding-workaround" );
1494                                 }
1495
1496                                 if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_PROXYAUTHZ_CRITICAL ) {
1497                                         ptr = lutil_strcopy( ptr, ",proxy-authz-critical" );
1498
1499                                 } else {
1500                                         ptr = lutil_strcopy( ptr, ",proxy-authz-non-critical" );
1501                                 }
1502
1503                                 switch ( mt->mt_idassert_flags & LDAP_BACK_AUTH_DN_MASK ) {
1504                                 case LDAP_BACK_AUTH_DN_AUTHZID:
1505                                         ptr = lutil_strcopy( ptr, ",dn-authzid" );
1506                                         break;
1507
1508                                 case LDAP_BACK_AUTH_DN_WHOAMI:
1509                                         ptr = lutil_strcopy( ptr, ",dn-whoami" );
1510                                         break;
1511
1512                                 default:
1513 #if 0 /* implicit */
1514                                         ptr = lutil_strcopy( ptr, ",dn-none" );
1515 #endif
1516                                         break;
1517                                 }
1518
1519                                 bv.bv_len = ( ptr - bv.bv_val );
1520                                 /* end-of-flags */
1521                         }
1522
1523                         bindconf_unparse( &mt->mt_idassert.si_bc, &bc );
1524
1525                         if ( !BER_BVISNULL( &bv ) ) {
1526                                 ber_len_t       len = bv.bv_len + bc.bv_len;
1527
1528                                 bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
1529
1530                                 assert( bc.bv_val[ 0 ] == ' ' );
1531
1532                                 ptr = lutil_strcopy( &bv.bv_val[ bv.bv_len ], bc.bv_val );
1533                                 free( bc.bv_val );
1534                                 bv.bv_len = ptr - bv.bv_val;
1535
1536                         } else {
1537                                 for ( i = 0; isspace( (unsigned char) bc.bv_val[ i ] ); i++ )
1538                                         /* count spaces */ ;
1539
1540                                 if ( i ) {
1541                                         bc.bv_len -= i;
1542                                         AC_MEMCPY( bc.bv_val, &bc.bv_val[ i ], bc.bv_len + 1 );
1543                                 }
1544
1545                                 bv = bc;
1546                         }
1547
1548                         ber_bvarray_add( &c->rvalue_vals, &bv );
1549
1550                         break;
1551                 }
1552
1553                 case LDAP_BACK_CFG_SUFFIXM:     /* unused */
1554                 case LDAP_BACK_CFG_REWRITE:
1555                         if ( mt->mt_rwmap.rwm_bva_rewrite == NULL ) {
1556                                 rc = 1;
1557                         } else {
1558                                 rc = slap_bv_x_ordered_unparse( mt->mt_rwmap.rwm_bva_rewrite, &c->rvalue_vals );
1559                         }
1560                         break;
1561
1562                 case LDAP_BACK_CFG_MAP:
1563                         if ( mt->mt_rwmap.rwm_bva_map == NULL ) {
1564                                 rc = 1;
1565                         } else {
1566                                 rc = slap_bv_x_ordered_unparse( mt->mt_rwmap.rwm_bva_map, &c->rvalue_vals );
1567                         }
1568                         break;
1569
1570                 case LDAP_BACK_CFG_SUBTREE_EX:
1571                 case LDAP_BACK_CFG_SUBTREE_IN:
1572                         rc = meta_subtree_unparse( c, mt );
1573                         break;
1574
1575                 /* replaced by idassert */
1576                 case LDAP_BACK_CFG_PSEUDOROOTDN:
1577                 case LDAP_BACK_CFG_PSEUDOROOTPW:
1578                         rc = 1;
1579                         break;
1580
1581                 default:
1582                         rc = 1;
1583                 }
1584                 return rc;
1585         } else if ( c->op == LDAP_MOD_DELETE ) {
1586                 switch( c->type ) {
1587                 /* Base attrs */
1588                 case LDAP_BACK_CFG_CONN_TTL:
1589                         mi->mi_conn_ttl = 0;
1590                         break;
1591
1592                 case LDAP_BACK_CFG_DNCACHE_TTL:
1593                         mi->mi_cache.ttl = META_DNCACHE_DISABLED;
1594                         break;
1595
1596                 case LDAP_BACK_CFG_IDLE_TIMEOUT:
1597                         mi->mi_idle_timeout = 0;
1598                         break;
1599
1600                 case LDAP_BACK_CFG_ONERR:
1601                         mi->mi_flags &= ~META_BACK_F_ONERR_MASK;
1602                         break;
1603
1604                 case LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER:
1605                         mi->mi_flags &= ~META_BACK_F_DEFER_ROOTDN_BIND;
1606                         break;
1607
1608                 case LDAP_BACK_CFG_SINGLECONN:
1609                         mi->mi_flags &= ~LDAP_BACK_F_SINGLECONN;
1610                         break;
1611
1612                 case LDAP_BACK_CFG_USETEMP:
1613                         mi->mi_flags &= ~LDAP_BACK_F_USE_TEMPORARIES;
1614                         break;
1615
1616                 case LDAP_BACK_CFG_CONNPOOLMAX:
1617                         mi->mi_conn_priv_max = LDAP_BACK_CONN_PRIV_MIN;
1618                         break;
1619
1620                 /* common attrs */
1621                 case LDAP_BACK_CFG_BIND_TIMEOUT:
1622                         mc->mc_bind_timeout.tv_sec = 0;
1623                         mc->mc_bind_timeout.tv_usec = 0;
1624                         break;
1625
1626                 case LDAP_BACK_CFG_CANCEL:
1627                         mc->mc_flags &= ~LDAP_BACK_F_CANCEL_MASK2;
1628                         break;
1629
1630                 case LDAP_BACK_CFG_CHASE:
1631                         mc->mc_flags &= ~LDAP_BACK_F_CHASE_REFERRALS;
1632                         break;
1633
1634 #ifdef SLAPD_META_CLIENT_PR
1635                 case LDAP_BACK_CFG_CLIENT_PR:
1636                         mc->mc_ps == META_CLIENT_PR_DISABLE;
1637                         break;
1638 #endif /* SLAPD_META_CLIENT_PR */
1639
1640                 case LDAP_BACK_CFG_DEFAULT_T:
1641                         mi->mi_defaulttarget = META_DEFAULT_TARGET_NONE;
1642                         break;
1643
1644                 case LDAP_BACK_CFG_NETWORK_TIMEOUT:
1645                         mc->mc_network_timeout = 0;
1646                         break;
1647
1648                 case LDAP_BACK_CFG_NOREFS:
1649                         mc->mc_flags &= ~LDAP_BACK_F_NOREFS;
1650                         break;
1651
1652                 case LDAP_BACK_CFG_NOUNDEFFILTER:
1653                         mc->mc_flags &= ~LDAP_BACK_F_NOUNDEFFILTER;
1654                         break;
1655
1656                 case LDAP_BACK_CFG_NRETRIES:
1657                         mc->mc_nretries == META_RETRY_DEFAULT;
1658                         break;
1659
1660                 case LDAP_BACK_CFG_QUARANTINE:
1661                         if ( META_BACK_CMN_QUARANTINE( mc )) {
1662                                 mi->mi_ldap_extra->retry_info_destroy( &mc->mc_quarantine );
1663                                 mc->mc_flags &= ~LDAP_BACK_F_QUARANTINE;
1664                                 if ( mc == &mt->mt_mc ) {
1665                                         ldap_pvt_thread_mutex_destroy( &mt->mt_quarantine_mutex );
1666                                         mt->mt_isquarantined = 0;
1667                                 }
1668                         }
1669                         break;
1670
1671                 case LDAP_BACK_CFG_REBIND:
1672                         mc->mc_flags &= ~LDAP_BACK_F_SAVECRED;
1673                         break;
1674
1675                 case LDAP_BACK_CFG_TIMEOUT:
1676                         for ( i = 0; i < SLAP_OP_LAST; i++ ) {
1677                                 mc->mc_timeout[ i ] = 0;
1678                         }
1679                         break;
1680
1681                 case LDAP_BACK_CFG_VERSION:
1682                         mc->mc_version = 0;
1683                         break;
1684
1685 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
1686                 case LDAP_BACK_CFG_ST_REQUEST:
1687                         mc->mc_flags &= ~LDAP_BACK_F_ST_REQUEST;
1688                         break;
1689 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
1690
1691                 case LDAP_BACK_CFG_T_F:
1692                         mc->mc_flags &= ~LDAP_BACK_F_T_F_MASK2;
1693                         break;
1694
1695                 case LDAP_BACK_CFG_TLS:
1696                         mc->mc_flags &= ~LDAP_BACK_F_TLS_MASK;
1697                         if ( mt )
1698                                 bindconf_free( &mt->mt_tls );
1699                         break;
1700
1701                 /* target attrs */
1702                 case LDAP_BACK_CFG_URI:
1703                         if ( mt->mt_uri ) {
1704                                 ch_free( mt->mt_uri );
1705                                 mt->mt_uri = NULL;
1706                         }
1707                         /* FIXME: should have a way to close all cached
1708                          * connections associated with this target.
1709                          */
1710                         break;
1711
1712                 case LDAP_BACK_CFG_IDASSERT_AUTHZFROM: {
1713                         BerVarray *bvp;
1714
1715                         bvp = &mt->mt_idassert_authz; break;
1716                         if ( c->valx < 0 ) {
1717                                 if ( *bvp != NULL ) {
1718                                         ber_bvarray_free( *bvp );
1719                                         *bvp = NULL;
1720                                 }
1721
1722                         } else {
1723                                 if ( *bvp == NULL ) {
1724                                         rc = 1;
1725                                         break;
1726                                 }
1727
1728                                 for ( i = 0; !BER_BVISNULL( &((*bvp)[ i ]) ); i++ )
1729                                         ;
1730
1731                                 if ( i >= c->valx ) {
1732                                         rc = 1;
1733                                         break;
1734                                 }
1735                                 ber_memfree( ((*bvp)[ c->valx ]).bv_val );
1736                                 for ( i = c->valx; !BER_BVISNULL( &((*bvp)[ i + 1 ]) ); i++ ) {
1737                                         (*bvp)[ i ] = (*bvp)[ i + 1 ];
1738                                 }
1739                                 BER_BVZERO( &((*bvp)[ i ]) );
1740                         }
1741                         } break;
1742
1743                 case LDAP_BACK_CFG_IDASSERT_BIND:
1744                         bindconf_free( &mt->mt_idassert.si_bc );
1745                         memset( &mt->mt_idassert, 0, sizeof( slap_idassert_t ) );
1746                         break;
1747
1748                 case LDAP_BACK_CFG_SUFFIXM:     /* unused */
1749                 case LDAP_BACK_CFG_REWRITE:
1750                         if ( mt->mt_rwmap.rwm_bva_rewrite ) {
1751                                 ber_bvarray_free( mt->mt_rwmap.rwm_bva_rewrite );
1752                                 mt->mt_rwmap.rwm_bva_rewrite = NULL;
1753                         }
1754                         if ( mt->mt_rwmap.rwm_rw )
1755                                 rewrite_info_delete( &mt->mt_rwmap.rwm_rw );
1756                         break;
1757
1758                 case LDAP_BACK_CFG_MAP:
1759                         if ( mt->mt_rwmap.rwm_bva_map ) {
1760                                 ber_bvarray_free( mt->mt_rwmap.rwm_bva_map );
1761                                 mt->mt_rwmap.rwm_bva_map = NULL;
1762                         }
1763                         meta_back_map_free( &mt->mt_rwmap.rwm_oc );
1764                         meta_back_map_free( &mt->mt_rwmap.rwm_at );
1765                         mt->mt_rwmap.rwm_oc.drop_missing = 0;
1766                         mt->mt_rwmap.rwm_at.drop_missing = 0;
1767                         break;
1768
1769                 case LDAP_BACK_CFG_SUBTREE_EX:
1770                 case LDAP_BACK_CFG_SUBTREE_IN:
1771                         /* can only be one of exclude or include */
1772                         if (( c->type == LDAP_BACK_CFG_SUBTREE_EX ) ^ mt->mt_subtree_exclude ) {
1773                                 rc = 1;
1774                                 break;
1775                         }
1776                         if ( c->valx < 0 ) {
1777                                 meta_subtree_destroy( mt->mt_subtree );
1778                                 mt->mt_subtree = NULL;
1779                         } else {
1780                                 metasubtree_t *ms, **mprev;
1781                                 for (i=0, mprev = &mt->mt_subtree, ms = *mprev; ms; ms = *mprev) {
1782                                         if ( i == c->valx ) {
1783                                                 *mprev = ms->ms_next;
1784                                                 meta_subtree_free( ms );
1785                                                 break;
1786                                         }
1787                                         i++;
1788                                         mprev = &ms->ms_next;
1789                                 }
1790                                 if ( i != c->valx )
1791                                         rc = 1;
1792                         }
1793                         break;
1794
1795                 default:
1796                         rc = 1;
1797                         break;
1798                 }
1799
1800                 return rc;
1801         }
1802
1803         if ( c->op == SLAP_CONFIG_ADD ) {
1804                 if ( c->type >= LDAP_BACK_CFG_LAST_BASE ) {
1805                         /* exclude CFG_URI from this check */
1806                         if ( c->type > LDAP_BACK_CFG_LAST_BOTH ) {
1807                                 if ( !mi->mi_ntargets ) {
1808                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1809                                                 "need \"uri\" directive first" );
1810                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1811                                         return 1;
1812                                 }
1813                         }
1814                         if ( mi->mi_ntargets ) {
1815                                 mt = mi->mi_targets[ mi->mi_ntargets-1 ];
1816                                 mc = &mt->mt_mc;
1817                         } else {
1818                                 mt = NULL;
1819                                 mc = &mi->mi_mc;
1820                         }
1821                 }
1822         } else {
1823                 if ( c->table == Cft_Database ) {
1824                         mt = NULL;
1825                         mc = &mi->mi_mc;
1826                 } else {
1827                         mt = c->ca_private;
1828                         if ( mt )
1829                                 mc = &mt->mt_mc;
1830                         else
1831                                 mc = NULL;
1832                 }
1833         }
1834
1835         switch( c->type ) {
1836         case LDAP_BACK_CFG_URI: {
1837                 LDAPURLDesc     *ludp;
1838                 struct berval   dn;
1839                 int             j;
1840
1841                 char            **uris = NULL;
1842
1843                 if ( c->be->be_nsuffix == NULL ) {
1844                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1845                                 "the suffix must be defined before any target" );
1846                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1847                         return 1;
1848                 }
1849
1850                 i = mi->mi_ntargets++;
1851
1852                 mi->mi_targets = ( metatarget_t ** )ch_realloc( mi->mi_targets,
1853                         sizeof( metatarget_t * ) * mi->mi_ntargets );
1854                 if ( mi->mi_targets == NULL ) {
1855                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1856                                 "out of memory while storing server name"
1857                                 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1858                                 c->argv[0] );
1859                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1860                         return 1;
1861                 }
1862
1863                 if ( meta_back_new_target( &mi->mi_targets[ i ] ) != 0 ) {
1864                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1865                                 "unable to init server"
1866                                 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1867                                 c->argv[0] );
1868                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1869                         return 1;
1870                 }
1871
1872                 mt = mi->mi_targets[ i ];
1873
1874                 mt->mt_rebind_f = mi->mi_rebind_f;
1875                 mt->mt_urllist_f = mi->mi_urllist_f;
1876                 mt->mt_urllist_p = mt;
1877
1878                 if ( META_BACK_QUARANTINE( mi ) ) {
1879                         ldap_pvt_thread_mutex_init( &mt->mt_quarantine_mutex );
1880                 }
1881                 mt->mt_mc = mi->mi_mc;
1882
1883                 for ( j = 1; j < c->argc; j++ ) {
1884                         char    **tmpuris = ldap_str2charray( c->argv[ j ], "\t" );
1885
1886                         if ( tmpuris == NULL ) {
1887                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1888                                         "unable to parse URIs #%d"
1889                                         " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1890                                         j-1, c->argv[0] );
1891                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1892                                 return 1;
1893                         }
1894
1895                         if ( j == 1 ) {
1896                                 uris = tmpuris;
1897
1898                         } else {
1899                                 ldap_charray_merge( &uris, tmpuris );
1900                                 ldap_charray_free( tmpuris );
1901                         }
1902                 }
1903
1904                 for ( j = 0; uris[ j ] != NULL; j++ ) {
1905                         char *tmpuri = NULL;
1906
1907                         /*
1908                          * uri MUST be legal!
1909                          */
1910                         if ( ldap_url_parselist_ext( &ludp, uris[ j ], "\t",
1911                                         LDAP_PVT_URL_PARSE_NONE ) != LDAP_SUCCESS
1912                                 || ludp->lud_next != NULL )
1913                         {
1914                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
1915                                         "unable to parse URI #%d"
1916                                         " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1917                                         j-1, c->argv[0] );
1918                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1919                                 ldap_charray_free( uris );
1920                                 return 1;
1921                         }
1922
1923                         if ( j == 0 ) {
1924
1925                                 /*
1926                                  * uri MUST have the <dn> part!
1927                                  */
1928                                 if ( ludp->lud_dn == NULL ) {
1929                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1930                                                 "missing <naming context> "
1931                                                 " in \"%s <protocol>://<server>[:port]/<naming context>\"",
1932                                                 c->argv[0] );
1933                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1934                                         ldap_free_urllist( ludp );
1935                                         ldap_charray_free( uris );
1936                                         return 1;
1937                                 }
1938
1939                                 /*
1940                                  * copies and stores uri and suffix
1941                                  */
1942                                 ber_str2bv( ludp->lud_dn, 0, 0, &dn );
1943                                 rc = dnPrettyNormal( NULL, &dn, &mt->mt_psuffix,
1944                                         &mt->mt_nsuffix, NULL );
1945                                 if ( rc != LDAP_SUCCESS ) {
1946                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1947                                                 "target DN is invalid \"%s\"",
1948                                                 c->argv[1] );
1949                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1950                                         ldap_free_urllist( ludp );
1951                                         ldap_charray_free( uris );
1952                                         return( 1 );
1953                                 }
1954
1955                                 ludp->lud_dn[ 0 ] = '\0';
1956
1957                                 switch ( ludp->lud_scope ) {
1958                                 case LDAP_SCOPE_DEFAULT:
1959                                         mt->mt_scope = LDAP_SCOPE_SUBTREE;
1960                                         break;
1961
1962                                 case LDAP_SCOPE_SUBTREE:
1963                                 case LDAP_SCOPE_SUBORDINATE:
1964                                         mt->mt_scope = ludp->lud_scope;
1965                                         break;
1966
1967                                 default:
1968                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1969                                                 "invalid scope for target \"%s\"",
1970                                                 c->argv[1] );
1971                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1972                                         ldap_free_urllist( ludp );
1973                                         ldap_charray_free( uris );
1974                                         return( 1 );
1975                                 }
1976
1977                         } else {
1978                                 /* check all, to apply the scope check on the first one */
1979                                 if ( ludp->lud_dn != NULL && ludp->lud_dn[ 0 ] != '\0' ) {
1980                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
1981                                                 "multiple URIs must have no DN part" );
1982                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1983                                         ldap_free_urllist( ludp );
1984                                         ldap_charray_free( uris );
1985                                         return( 1 );
1986
1987                                 }
1988                         }
1989
1990                         tmpuri = ldap_url_list2urls( ludp );
1991                         ldap_free_urllist( ludp );
1992                         if ( tmpuri == NULL ) {
1993                                 snprintf( c->cr_msg, sizeof( c->cr_msg ), "no memory?" );
1994                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
1995                                 ldap_charray_free( uris );
1996                                 return( 1 );
1997                         }
1998                         ldap_memfree( uris[ j ] );
1999                         uris[ j ] = tmpuri;
2000                 }
2001
2002                 mt->mt_uri = ldap_charray2str( uris, " " );
2003                 ldap_charray_free( uris );
2004                 if ( mt->mt_uri == NULL) {
2005                         snprintf( c->cr_msg, sizeof( c->cr_msg ), "no memory?" );
2006                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2007                         return( 1 );
2008                 }
2009
2010                 /*
2011                  * uri MUST be a branch of suffix!
2012                  */
2013                 for ( j = 0; !BER_BVISNULL( &c->be->be_nsuffix[ j ] ); j++ ) {
2014                         if ( dnIsSuffix( &mt->mt_nsuffix, &c->be->be_nsuffix[ j ] ) ) {
2015                                 break;
2016                         }
2017                 }
2018
2019                 if ( BER_BVISNULL( &c->be->be_nsuffix[ j ] ) ) {
2020                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2021                                 "<naming context> of URI must be within the naming context of this database." );
2022                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2023                         return 1;
2024                 }
2025                 c->ca_private = mt;
2026         } break;
2027         case LDAP_BACK_CFG_SUBTREE_EX:
2028         case LDAP_BACK_CFG_SUBTREE_IN:
2029         /* subtree-exclude */
2030                 if ( meta_subtree_config( mt, c )) {
2031                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2032                         return 1;
2033                 }
2034                 break;
2035
2036         case LDAP_BACK_CFG_DEFAULT_T:
2037         /* default target directive */
2038                 i = mi->mi_ntargets - 1;
2039
2040                 if ( c->argc == 1 ) {
2041                         if ( i < 0 ) {
2042                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2043                                         "\"%s\" alone must be inside a \"uri\" directive",
2044                                         c->argv[0] );
2045                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2046                                 return 1;
2047                         }
2048                         mi->mi_defaulttarget = i;
2049
2050                 } else {
2051                         if ( strcasecmp( c->argv[ 1 ], "none" ) == 0 ) {
2052                                 if ( i >= 0 ) {
2053                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2054                                                 "\"%s none\" should go before uri definitions",
2055                                                 c->argv[0] );
2056                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2057                                 }
2058                                 mi->mi_defaulttarget = META_DEFAULT_TARGET_NONE;
2059
2060                         } else {
2061
2062                                 if ( lutil_atoi( &mi->mi_defaulttarget, c->argv[ 1 ] ) != 0
2063                                         || mi->mi_defaulttarget < 0
2064                                         || mi->mi_defaulttarget >= i - 1 )
2065                                 {
2066                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2067                                                 "illegal target number %d",
2068                                                 mi->mi_defaulttarget );
2069                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2070                                         return 1;
2071                                 }
2072                         }
2073                 }
2074                 break;
2075
2076         case LDAP_BACK_CFG_DNCACHE_TTL:
2077         /* ttl of dn cache */
2078                 if ( strcasecmp( c->argv[ 1 ], "forever" ) == 0 ) {
2079                         mi->mi_cache.ttl = META_DNCACHE_FOREVER;
2080
2081                 } else if ( strcasecmp( c->argv[ 1 ], "disabled" ) == 0 ) {
2082                         mi->mi_cache.ttl = META_DNCACHE_DISABLED;
2083
2084                 } else {
2085                         unsigned long   t;
2086
2087                         if ( lutil_parse_time( c->argv[ 1 ], &t ) != 0 ) {
2088                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2089                                         "unable to parse dncache ttl \"%s\"",
2090                                         c->argv[ 1 ] );
2091                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2092                                 return 1;
2093                         }
2094                         mi->mi_cache.ttl = (time_t)t;
2095                 }
2096                 break;
2097
2098         case LDAP_BACK_CFG_NETWORK_TIMEOUT: {
2099         /* network timeout when connecting to ldap servers */
2100                 unsigned long t;
2101
2102                 if ( lutil_parse_time( c->argv[ 1 ], &t ) ) {
2103                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2104                                 "unable to parse network timeout \"%s\"",
2105                                 c->argv[ 1 ] );
2106                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2107                         return 1;
2108                 }
2109                 mc->mc_network_timeout = (time_t)t;
2110                 } break;
2111
2112         case LDAP_BACK_CFG_IDLE_TIMEOUT: {
2113         /* idle timeout when connecting to ldap servers */
2114                 unsigned long   t;
2115
2116                 if ( lutil_parse_time( c->argv[ 1 ], &t ) ) {
2117                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2118                                 "unable to parse idle timeout \"%s\"",
2119                                 c->argv[ 1 ] );
2120                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2121                         return 1;
2122
2123                 }
2124                 mi->mi_idle_timeout = (time_t)t;
2125                 } break;
2126
2127         case LDAP_BACK_CFG_CONN_TTL: {
2128         /* conn ttl */
2129                 unsigned long   t;
2130
2131                 if ( lutil_parse_time( c->argv[ 1 ], &t ) ) {
2132                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2133                                 "unable to parse conn ttl \"%s\"",
2134                                 c->argv[ 1 ] );
2135                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2136                         return 1;
2137
2138                 }
2139                 mi->mi_conn_ttl = (time_t)t;
2140                 } break;
2141
2142         case LDAP_BACK_CFG_BIND_TIMEOUT:
2143         /* bind timeout when connecting to ldap servers */
2144                 mc->mc_bind_timeout.tv_sec = c->value_ulong/1000000;
2145                 mc->mc_bind_timeout.tv_usec = c->value_ulong%1000000;
2146                 break;
2147
2148         case LDAP_BACK_CFG_ACL_AUTHCDN:
2149         /* name to use for meta_back_group */
2150                 if ( strcasecmp( c->argv[ 0 ], "binddn" ) == 0 ) {
2151                         Debug( LDAP_DEBUG_ANY, "%s: "
2152                                 "\"binddn\" statement is deprecated; "
2153                                 "use \"acl-authcDN\" instead\n",
2154                                 c->log, 0, 0 );
2155                         /* FIXME: some day we'll need to throw an error */
2156                 }
2157
2158                 ber_memfree_x( c->value_dn.bv_val, NULL );
2159                 mt->mt_binddn = c->value_ndn;
2160                 BER_BVZERO( &c->value_dn );
2161                 BER_BVZERO( &c->value_ndn );
2162                 break;
2163
2164         case LDAP_BACK_CFG_ACL_PASSWD:
2165         /* password to use for meta_back_group */
2166                 if ( strcasecmp( c->argv[ 0 ], "bindpw" ) == 0 ) {
2167                         Debug( LDAP_DEBUG_ANY, "%s "
2168                                 "\"bindpw\" statement is deprecated; "
2169                                 "use \"acl-passwd\" instead\n",
2170                                 c->log, 0, 0 );
2171                         /* FIXME: some day we'll need to throw an error */
2172                 }
2173
2174                 ber_str2bv( c->argv[ 1 ], 0L, 1, &mt->mt_bindpw );
2175                 break;
2176
2177         case LDAP_BACK_CFG_REBIND:
2178         /* save bind creds for referral rebinds? */
2179                 if ( c->argc == 1 || c->value_int ) {
2180                         mc->mc_flags |= LDAP_BACK_F_SAVECRED;
2181                 } else {
2182                         mc->mc_flags &= ~LDAP_BACK_F_SAVECRED;
2183                 }
2184                 break;
2185
2186         case LDAP_BACK_CFG_CHASE:
2187                 if ( c->argc == 1 || c->value_int ) {
2188                         mc->mc_flags |= LDAP_BACK_F_CHASE_REFERRALS;
2189                 } else {
2190                         mc->mc_flags &= ~LDAP_BACK_F_CHASE_REFERRALS;
2191                 }
2192                 break;
2193
2194         case LDAP_BACK_CFG_TLS:
2195                 i = verb_to_mask( c->argv[1], tls_mode );
2196                 if ( BER_BVISNULL( &tls_mode[i].word ) ) {
2197                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2198                                 "%s unknown argument \"%s\"",
2199                                 c->argv[0], c->argv[1] );
2200                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2201                         return 1;
2202                 }
2203                 mc->mc_flags &= ~LDAP_BACK_F_TLS_MASK;
2204                 mc->mc_flags |= tls_mode[i].mask;
2205
2206                 if ( c->argc > 2 ) {
2207                         if ( c->op == SLAP_CONFIG_ADD && mi->mi_ntargets == 0 ) {
2208                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2209                                         "need \"uri\" directive first" );
2210                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2211                                 return 1;
2212                         }
2213
2214                         for ( i = 2; i < c->argc; i++ ) {
2215                                 if ( bindconf_tls_parse( c->argv[i], &mt->mt_tls ))
2216                                         return 1;
2217                         }
2218                         bindconf_tls_defaults( &mt->mt_tls );
2219                 }
2220                 break;
2221
2222         case LDAP_BACK_CFG_T_F:
2223                 i = verb_to_mask( c->argv[1], t_f_mode );
2224                 if ( BER_BVISNULL( &t_f_mode[i].word ) ) {
2225                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2226                                 "%s unknown argument \"%s\"",
2227                                 c->argv[0], c->argv[1] );
2228                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2229                         return 1;
2230                 }
2231                 mc->mc_flags &= ~LDAP_BACK_F_T_F_MASK2;
2232                 mc->mc_flags |= t_f_mode[i].mask;
2233                 break;
2234
2235         case LDAP_BACK_CFG_ONERR:
2236         /* onerr? */
2237                 i = verb_to_mask( c->argv[1], onerr_mode );
2238                 if ( BER_BVISNULL( &onerr_mode[i].word ) ) {
2239                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2240                                 "%s unknown argument \"%s\"",
2241                                 c->argv[0], c->argv[1] );
2242                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2243                         return 1;
2244                 }
2245                 mi->mi_flags &= ~META_BACK_F_ONERR_MASK;
2246                 mi->mi_flags |= onerr_mode[i].mask;
2247                 break;
2248
2249         case LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER:
2250         /* bind-defer? */
2251                 if ( c->argc == 1 || c->value_int ) {
2252                         mi->mi_flags |= META_BACK_F_DEFER_ROOTDN_BIND;
2253                 } else {
2254                         mi->mi_flags &= ~META_BACK_F_DEFER_ROOTDN_BIND;
2255                 }
2256                 break;
2257
2258         case LDAP_BACK_CFG_SINGLECONN:
2259         /* single-conn? */
2260                 if ( mi->mi_ntargets > 0 ) {
2261                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2262                                 "\"%s\" must appear before target definitions",
2263                                 c->argv[0] );
2264                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2265                         return( 1 );
2266                 }
2267                 if ( c->value_int ) {
2268                         mi->mi_flags |= LDAP_BACK_F_SINGLECONN;
2269                 } else {
2270                         mi->mi_flags &= ~LDAP_BACK_F_SINGLECONN;
2271                 }
2272                 break;
2273
2274         case LDAP_BACK_CFG_USETEMP:
2275         /* use-temporaries? */
2276                 if ( mi->mi_ntargets > 0 ) {
2277                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2278                                 "\"%s\" must appear before target definitions",
2279                                 c->argv[0] );
2280                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2281                         return( 1 );
2282                 }
2283                 if ( c->value_int ) {
2284                         mi->mi_flags |= LDAP_BACK_F_USE_TEMPORARIES;
2285                 } else {
2286                         mi->mi_flags &= ~LDAP_BACK_F_USE_TEMPORARIES;
2287                 }
2288                 break;
2289
2290         case LDAP_BACK_CFG_CONNPOOLMAX:
2291         /* privileged connections pool max size ? */
2292                 if ( mi->mi_ntargets > 0 ) {
2293                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2294                                 "\"%s\" must appear before target definitions",
2295                                 c->argv[0] );
2296                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2297                         return( 1 );
2298                 }
2299
2300                 if ( c->value_int < LDAP_BACK_CONN_PRIV_MIN
2301                         || c->value_int > LDAP_BACK_CONN_PRIV_MAX )
2302                 {
2303                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2304                                 "invalid max size " "of privileged "
2305                                 "connections pool \"%s\" "
2306                                 "in \"conn-pool-max <n> "
2307                                 "(must be between %d and %d)\"",
2308                                 c->argv[ 1 ],
2309                                 LDAP_BACK_CONN_PRIV_MIN,
2310                                 LDAP_BACK_CONN_PRIV_MAX );
2311                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2312                         return 1;
2313                 }
2314                 mi->mi_conn_priv_max = c->value_int;
2315                 break;
2316
2317         case LDAP_BACK_CFG_CANCEL:
2318                 i = verb_to_mask( c->argv[1], cancel_mode );
2319                 if ( BER_BVISNULL( &cancel_mode[i].word ) ) {
2320                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2321                                 "%s unknown argument \"%s\"",
2322                                 c->argv[0], c->argv[1] );
2323                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2324                         return 1;
2325                 }
2326                 mc->mc_flags &= ~LDAP_BACK_F_CANCEL_MASK2;
2327                 mc->mc_flags |= t_f_mode[i].mask;
2328                 break;
2329
2330         case LDAP_BACK_CFG_TIMEOUT:
2331                 for ( i = 1; i < c->argc; i++ ) {
2332                         if ( isdigit( (unsigned char) c->argv[ i ][ 0 ] ) ) {
2333                                 int             j;
2334                                 unsigned        u;
2335
2336                                 if ( lutil_atoux( &u, c->argv[ i ], 0 ) != 0 ) {
2337                                         snprintf( c->cr_msg, sizeof( c->cr_msg),
2338                                                 "unable to parse timeout \"%s\"",
2339                                                 c->argv[ i ] );
2340                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2341                                         return 1;
2342                                 }
2343
2344                                 for ( j = 0; j < SLAP_OP_LAST; j++ ) {
2345                                         mc->mc_timeout[ j ] = u;
2346                                 }
2347
2348                                 continue;
2349                         }
2350
2351                         if ( slap_cf_aux_table_parse( c->argv[ i ], mc->mc_timeout, timeout_table, "slapd-meta timeout" ) ) {
2352                                 snprintf( c->cr_msg, sizeof( c->cr_msg),
2353                                         "unable to parse timeout \"%s\"",
2354                                         c->argv[ i ] );
2355                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2356                                 return 1;
2357                         }
2358                 }
2359                 break;
2360
2361         case LDAP_BACK_CFG_PSEUDOROOTDN:
2362         /* name to use as pseudo-root dn */
2363                 /*
2364                  * exact replacement:
2365                  *
2366
2367 idassert-bind   bindmethod=simple
2368                 binddn=<pseudorootdn>
2369                 credentials=<pseudorootpw>
2370                 mode=none
2371                 flags=non-prescriptive
2372 idassert-authzFrom      "dn:<rootdn>"
2373
2374                  * so that only when authc'd as <rootdn> the proxying occurs
2375                  * rebinding as the <pseudorootdn> without proxyAuthz.
2376                  */
2377
2378                 Debug( LDAP_DEBUG_ANY,
2379                         "%s: \"pseudorootdn\", \"pseudorootpw\" are no longer supported; "
2380                         "use \"idassert-bind\" and \"idassert-authzFrom\" instead.\n",
2381                         c->log, 0, 0 );
2382
2383                 {
2384                         char    binddn[ SLAP_TEXT_BUFLEN ];
2385                         char    *cargv[] = {
2386                                 "idassert-bind",
2387                                 "bindmethod=simple",
2388                                 NULL,
2389                                 "mode=none",
2390                                 "flags=non-prescriptive",
2391                                 NULL
2392                         };
2393                         char **oargv;
2394                         int oargc;
2395                         int     cargc = 5;
2396                         int     rc;
2397
2398
2399                         if ( BER_BVISNULL( &c->be->be_rootndn ) ) {
2400                                 Debug( LDAP_DEBUG_ANY, "%s: \"pseudorootpw\": \"rootdn\" must be defined first.\n",
2401                                         c->log, 0, 0 );
2402                                 return 1;
2403                         }
2404
2405                         if ( sizeof( binddn ) <= (unsigned) snprintf( binddn,
2406                                         sizeof( binddn ), "binddn=%s", c->argv[ 1 ] ))
2407                         {
2408                                 Debug( LDAP_DEBUG_ANY, "%s: \"pseudorootdn\" too long.\n",
2409                                         c->log, 0, 0 );
2410                                 return 1;
2411                         }
2412                         cargv[ 2 ] = binddn;
2413
2414                         oargv = c->argv;
2415                         oargc = c->argc;
2416                         c->argv = cargv;
2417                         c->argc = cargc;
2418                         rc = mi->mi_ldap_extra->idassert_parse( c, &mt->mt_idassert );
2419                         c->argv = oargv;
2420                         c->argc = oargc;
2421                         if ( rc == 0 ) {
2422                                 struct berval   bv;
2423
2424                                 if ( mt->mt_idassert_authz != NULL ) {
2425                                         Debug( LDAP_DEBUG_ANY, "%s: \"idassert-authzFrom\" already defined (discarded).\n",
2426                                                 c->log, 0, 0 );
2427                                         ber_bvarray_free( mt->mt_idassert_authz );
2428                                         mt->mt_idassert_authz = NULL;
2429                                 }
2430
2431                                 assert( !BER_BVISNULL( &mt->mt_idassert_authcDN ) );
2432
2433                                 bv.bv_len = STRLENOF( "dn:" ) + c->be->be_rootndn.bv_len;
2434                                 bv.bv_val = ber_memalloc( bv.bv_len + 1 );
2435                                 AC_MEMCPY( bv.bv_val, "dn:", STRLENOF( "dn:" ) );
2436                                 AC_MEMCPY( &bv.bv_val[ STRLENOF( "dn:" ) ], c->be->be_rootndn.bv_val, c->be->be_rootndn.bv_len + 1 );
2437
2438                                 ber_bvarray_add( &mt->mt_idassert_authz, &bv );
2439                         }
2440
2441                         return rc;
2442                 }
2443                 break;
2444
2445         case LDAP_BACK_CFG_PSEUDOROOTPW:
2446         /* password to use as pseudo-root */
2447                 Debug( LDAP_DEBUG_ANY,
2448                         "%s: \"pseudorootdn\", \"pseudorootpw\" are no longer supported; "
2449                         "use \"idassert-bind\" and \"idassert-authzFrom\" instead.\n",
2450                         c->log, 0, 0 );
2451
2452                 if ( BER_BVISNULL( &mt->mt_idassert_authcDN ) ) {
2453                         Debug( LDAP_DEBUG_ANY, "%s: \"pseudorootpw\": \"pseudorootdn\" must be defined first.\n",
2454                                 c->log, 0, 0 );
2455                         return 1;
2456                 }
2457
2458                 if ( !BER_BVISNULL( &mt->mt_idassert_passwd ) ) {
2459                         memset( mt->mt_idassert_passwd.bv_val, 0,
2460                                 mt->mt_idassert_passwd.bv_len );
2461                         ber_memfree( mt->mt_idassert_passwd.bv_val );
2462                 }
2463                 ber_str2bv( c->argv[ 1 ], 0, 1, &mt->mt_idassert_passwd );
2464                 break;
2465
2466         case LDAP_BACK_CFG_IDASSERT_BIND:
2467         /* idassert-bind */
2468                 rc = mi->mi_ldap_extra->idassert_parse( c, &mt->mt_idassert );
2469                 break;
2470
2471         case LDAP_BACK_CFG_IDASSERT_AUTHZFROM:
2472         /* idassert-authzFrom */
2473                 rc = mi->mi_ldap_extra->idassert_authzfrom_parse( c, &mt->mt_idassert );
2474                 break;
2475
2476         case LDAP_BACK_CFG_QUARANTINE:
2477         /* quarantine */
2478                 if ( META_BACK_CMN_QUARANTINE( mc ) )
2479                 {
2480                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2481                                 "quarantine already defined" );
2482                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2483                         return 1;
2484                 }
2485
2486                 if ( mt ) {
2487                         mc->mc_quarantine.ri_interval = NULL;
2488                         mc->mc_quarantine.ri_num = NULL;
2489                         if ( !META_BACK_QUARANTINE( mi ) ) {
2490                                 ldap_pvt_thread_mutex_init( &mt->mt_quarantine_mutex );
2491                         }
2492                 }
2493
2494                 if ( mi->mi_ldap_extra->retry_info_parse( c->argv[ 1 ], &mc->mc_quarantine, c->cr_msg, sizeof( c->cr_msg ) ) ) {
2495                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2496                         return 1;
2497                 }
2498
2499                 mc->mc_flags |= LDAP_BACK_F_QUARANTINE;
2500                 break;
2501
2502 #ifdef SLAP_CONTROL_X_SESSION_TRACKING
2503         case LDAP_BACK_CFG_ST_REQUEST:
2504         /* session tracking request */
2505                 if ( c->value_int ) {
2506                         mc->mc_flags |= LDAP_BACK_F_ST_REQUEST;
2507                 } else {
2508                         mc->mc_flags &= ~LDAP_BACK_F_ST_REQUEST;
2509                 }
2510                 break;
2511 #endif /* SLAP_CONTROL_X_SESSION_TRACKING */
2512
2513         case LDAP_BACK_CFG_SUFFIXM:     /* FALLTHRU */
2514         case LDAP_BACK_CFG_REWRITE: {
2515         /* rewrite stuff ... */
2516                 ConfigArgs ca = { 0 };
2517                 char *line, **argv;
2518                 struct rewrite_info *rwi;
2519                 int cnt = 0, argc, ix = c->valx;
2520
2521                 if ( mt->mt_rwmap.rwm_bva_rewrite ) {
2522                         for ( ; !BER_BVISNULL( &mt->mt_rwmap.rwm_bva_rewrite[ cnt ] ); cnt++ )
2523                                 /* count */ ;
2524                 }
2525
2526                 if ( ix >= cnt || ix < 0 ) {
2527                         ix = cnt;
2528                 } else {
2529                         rwi = mt->mt_rwmap.rwm_rw;
2530
2531                         mt->mt_rwmap.rwm_rw = NULL;
2532                         rc = meta_rwi_init( &mt->mt_rwmap.rwm_rw );
2533
2534                         /* re-parse all rewrite rules, up to the one
2535                          * that needs to be added */
2536                         ca.fname = c->fname;
2537                         ca.lineno = c->lineno;
2538                         for ( i = 0; i < ix; i++ ) {
2539                                 ca.line = mt->mt_rwmap.rwm_bva_rewrite[ i ].bv_val;
2540                                 ca.argc = 0;
2541                                 config_fp_parse_line( &ca );
2542
2543                                 if ( !strcasecmp( ca.argv[0], "suffixmassage" )) {
2544                                         rc = meta_suffixm_config( &ca, ca.argc, ca.argv, mt );
2545                                 } else {
2546                                         rc = rewrite_parse( mt->mt_rwmap.rwm_rw,
2547                                                 c->fname, c->lineno, ca.argc, ca.argv );
2548                                 }
2549                                 assert( rc == 0 );
2550                                 ch_free( ca.argv );
2551                                 ch_free( ca.tline );
2552                         }
2553                 }
2554                 argc = c->argc;
2555                 argv = c->argv;
2556                 if ( c->op != SLAP_CONFIG_ADD ) {
2557                         argc--;
2558                         argv++;
2559                 }
2560                 /* add the new rule */
2561                 if ( !strcasecmp( argv[0], "suffixmassage" )) {
2562                         rc = meta_suffixm_config( c, argc, argv, mt );
2563                 } else {
2564                         rc = rewrite_parse( mt->mt_rwmap.rwm_rw,
2565                                                 c->fname, c->lineno, argc, argv );
2566                 }
2567                 if ( rc ) {
2568                         if ( ix < cnt ) {
2569                                 rewrite_info_delete( &mt->mt_rwmap.rwm_rw );
2570                                 mt->mt_rwmap.rwm_rw = rwi;
2571                         }
2572                         return 1;
2573                 }
2574                 if ( ix < cnt ) {
2575                         for ( ; i < cnt; i++ ) {
2576                                 ca.line = mt->mt_rwmap.rwm_bva_rewrite[ i ].bv_val;
2577                                 ca.argc = 0;
2578                                 config_fp_parse_line( &ca );
2579
2580                                 if ( !strcasecmp( ca.argv[0], "suffixmassage" )) {
2581                                         rc = meta_suffixm_config( &ca, ca.argc, ca.argv, mt );
2582                                 } else {
2583                                         rc = rewrite_parse( mt->mt_rwmap.rwm_rw,
2584                                                 c->fname, c->lineno, ca.argc, argv );
2585                                 }
2586                                 assert( rc == 0 );
2587                                 ch_free( ca.argv );
2588                                 ch_free( ca.tline );
2589                         }
2590                 }
2591
2592                 /* save the rule info */
2593                 line = ldap_charray2str( argv, "\" \"" );
2594                 if ( line != NULL ) {
2595                         struct berval bv;
2596                         int len = strlen( argv[ 0 ] );
2597
2598                         ber_str2bv( line, 0, 0, &bv );
2599                         AC_MEMCPY( &bv.bv_val[ len ], &bv.bv_val[ len + 1 ],
2600                                 bv.bv_len - ( len + 1 ));
2601                         bv.bv_val[ bv.bv_len - 1] = '"';
2602                         ber_bvarray_add( &mt->mt_rwmap.rwm_bva_rewrite, &bv );
2603                         /* move it to the right slot */
2604                         if ( ix < cnt ) {
2605                                 for ( i=cnt; i>ix; i-- )
2606                                         mt->mt_rwmap.rwm_bva_rewrite[i+1] = mt->mt_rwmap.rwm_bva_rewrite[i];
2607                                 mt->mt_rwmap.rwm_bva_rewrite[i] = bv;
2608
2609                                 /* destroy old rules */
2610                                 rewrite_info_delete( &rwi );
2611                         }
2612                 }
2613                 } break;
2614
2615         case LDAP_BACK_CFG_MAP: {
2616         /* objectclass/attribute mapping */
2617                 ConfigArgs ca = { 0 };
2618                 char *argv[5];
2619                 struct ldapmap rwm_oc;
2620                 struct ldapmap rwm_at;
2621                 int cnt = 0, ix = c->valx;
2622
2623                 if ( mt->mt_rwmap.rwm_bva_map ) {
2624                         for ( ; !BER_BVISNULL( &mt->mt_rwmap.rwm_bva_map[ cnt ] ); cnt++ )
2625                                 /* count */ ;
2626                 }
2627
2628                 if ( ix >= cnt || ix < 0 ) {
2629                         ix = cnt;
2630                 } else {
2631                         rwm_oc = mt->mt_rwmap.rwm_oc;
2632                         rwm_at = mt->mt_rwmap.rwm_at;
2633
2634                         memset( &mt->mt_rwmap.rwm_oc, 0, sizeof( mt->mt_rwmap.rwm_oc ) );
2635                         memset( &mt->mt_rwmap.rwm_at, 0, sizeof( mt->mt_rwmap.rwm_at ) );
2636
2637                         /* re-parse all mappings, up to the one
2638                          * that needs to be added */
2639                         argv[0] = c->argv[0];
2640                         ca.fname = c->fname;
2641                         ca.lineno = c->lineno;
2642                         for ( i = 0; i < ix; i++ ) {
2643                                 ca.line = mt->mt_rwmap.rwm_bva_map[ i ].bv_val;
2644                                 ca.argc = 0;
2645                                 config_fp_parse_line( &ca );
2646
2647                                 argv[1] = ca.argv[0];
2648                                 argv[2] = ca.argv[1];
2649                                 argv[3] = ca.argv[2];
2650                                 argv[4] = ca.argv[3];
2651                                 ch_free( ca.argv );
2652                                 ca.argv = argv;
2653                                 ca.argc++;
2654                                 rc = ldap_back_map_config( &ca, &mt->mt_rwmap.rwm_oc,
2655                                         &mt->mt_rwmap.rwm_at );
2656
2657                                 ch_free( ca.tline );
2658                                 ca.tline = NULL;
2659                                 ca.argv = NULL;
2660
2661                                 /* in case of failure, restore
2662                                  * the existing mapping */
2663                                 if ( rc ) {
2664                                         goto map_fail;
2665                                 }
2666                         }
2667                 }
2668                 /* add the new mapping */
2669                 rc = ldap_back_map_config( c, &mt->mt_rwmap.rwm_oc,
2670                                         &mt->mt_rwmap.rwm_at );
2671                 if ( rc ) {
2672                         goto map_fail;
2673                 }
2674
2675                 if ( ix < cnt ) {
2676                         for ( ; i<cnt ; cnt++ ) {
2677                                 ca.line = mt->mt_rwmap.rwm_bva_map[ i ].bv_val;
2678                                 ca.argc = 0;
2679                                 config_fp_parse_line( &ca );
2680
2681                                 argv[1] = ca.argv[0];
2682                                 argv[2] = ca.argv[1];
2683                                 argv[3] = ca.argv[2];
2684                                 argv[4] = ca.argv[3];
2685
2686                                 ch_free( ca.argv );
2687                                 ca.argv = argv;
2688                                 ca.argc++;
2689                                 rc = ldap_back_map_config( &ca, &mt->mt_rwmap.rwm_oc,
2690                                         &mt->mt_rwmap.rwm_at );
2691
2692                                 ch_free( ca.tline );
2693                                 ca.tline = NULL;
2694                                 ca.argv = NULL;
2695
2696                                 /* in case of failure, restore
2697                                  * the existing mapping */
2698                                 if ( rc ) {
2699                                         goto map_fail;
2700                                 }
2701                         }
2702                 }
2703
2704                 /* save the map info */
2705                 argv[0] = ldap_charray2str( &c->argv[ 1 ], " " );
2706                 if ( argv[0] != NULL ) {
2707                         struct berval bv;
2708                         ber_str2bv( argv[0], 0, 0, &bv );
2709                         ber_bvarray_add( &mt->mt_rwmap.rwm_bva_map, &bv );
2710                         /* move it to the right slot */
2711                         if ( ix < cnt ) {
2712                                 for ( i=cnt; i>ix; i-- )
2713                                         mt->mt_rwmap.rwm_bva_map[i+1] = mt->mt_rwmap.rwm_bva_map[i];
2714                                 mt->mt_rwmap.rwm_bva_map[i] = bv;
2715
2716                                 /* destroy old mapping */
2717                                 meta_back_map_free( &rwm_oc );
2718                                 meta_back_map_free( &rwm_at );
2719                         }
2720                 }
2721                 break;
2722
2723 map_fail:;
2724                 if ( ix < cnt ) {
2725                         meta_back_map_free( &mt->mt_rwmap.rwm_oc );
2726                         meta_back_map_free( &mt->mt_rwmap.rwm_at );
2727                         mt->mt_rwmap.rwm_oc = rwm_oc;
2728                         mt->mt_rwmap.rwm_at = rwm_at;
2729                 }
2730                 } break;
2731
2732         case LDAP_BACK_CFG_NRETRIES: {
2733                 int             nretries = META_RETRY_UNDEFINED;
2734
2735                 if ( strcasecmp( c->argv[ 1 ], "forever" ) == 0 ) {
2736                         nretries = META_RETRY_FOREVER;
2737
2738                 } else if ( strcasecmp( c->argv[ 1 ], "never" ) == 0 ) {
2739                         nretries = META_RETRY_NEVER;
2740
2741                 } else {
2742                         if ( lutil_atoi( &nretries, c->argv[ 1 ] ) != 0 ) {
2743                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2744                                         "unable to parse nretries {never|forever|<retries>}: \"%s\"",
2745                                         c->argv[ 1 ] );
2746                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2747                                 return 1;
2748                         }
2749                 }
2750
2751                 mc->mc_nretries = nretries;
2752                 } break;
2753
2754         case LDAP_BACK_CFG_VERSION:
2755                 if ( c->value_int != 0 && ( c->value_int < LDAP_VERSION_MIN || c->value_int > LDAP_VERSION_MAX ) ) {
2756                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2757                                 "unsupported protocol version \"%s\"",
2758                                 c->argv[ 1 ] );
2759                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2760                         return 1;
2761                 }
2762                 mc->mc_version = c->value_int;
2763                 break;
2764
2765         case LDAP_BACK_CFG_NOREFS:
2766         /* do not return search references */
2767                 if ( c->value_int ) {
2768                         mc->mc_flags |= LDAP_BACK_F_NOREFS;
2769                 } else {
2770                         mc->mc_flags &= ~LDAP_BACK_F_NOREFS;
2771                 }
2772                 break;
2773
2774         case LDAP_BACK_CFG_NOUNDEFFILTER:
2775         /* do not propagate undefined search filters */
2776                 if ( c->value_int ) {
2777                         mc->mc_flags |= LDAP_BACK_F_NOUNDEFFILTER;
2778                 } else {
2779                         mc->mc_flags &= ~LDAP_BACK_F_NOUNDEFFILTER;
2780                 }
2781                 break;
2782
2783 #ifdef SLAPD_META_CLIENT_PR
2784         case LDAP_BACK_CFG_CLIENT_PR:
2785                 if ( strcasecmp( c->argv[ 1 ], "accept-unsolicited" ) == 0 ) {
2786                         mc->mc_ps = META_CLIENT_PR_ACCEPT_UNSOLICITED;
2787
2788                 } else if ( strcasecmp( c->argv[ 1 ], "disable" ) == 0 ) {
2789                         mc->mc_ps = META_CLIENT_PR_DISABLE;
2790
2791                 } else if ( lutil_atoi( &mc->mc_ps, c->argv[ 1 ] ) || mc->mc_ps < -1 ) {
2792                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2793                                 "unable to parse client-pr {accept-unsolicited|disable|<size>}: \"%s\"",
2794                                 c->argv[ 1 ] );
2795                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2796                         return( 1 );
2797                 }
2798                 break;
2799 #endif /* SLAPD_META_CLIENT_PR */
2800
2801         /* anything else */
2802         default:
2803                 return SLAP_CONF_UNKNOWN;
2804         }
2805
2806         return rc;
2807 }
2808
2809 int
2810 meta_back_init_cf( BackendInfo *bi )
2811 {
2812         int                     rc;
2813         AttributeDescription    *ad = NULL;
2814         const char              *text;
2815
2816         /* Make sure we don't exceed the bits reserved for userland */
2817         config_check_userland( LDAP_BACK_CFG_LAST );
2818
2819         bi->bi_cf_ocs = metaocs;
2820
2821         rc = config_register_schema( metacfg, metaocs );
2822         if ( rc ) {
2823                 return rc;
2824         }
2825
2826         /* setup olcDbAclPasswd and olcDbIDAssertPasswd
2827          * to be base64-encoded when written in LDIF form;
2828          * basically, we don't care if it fails */
2829         rc = slap_str2ad( "olcDbACLPasswd", &ad, &text );
2830         if ( rc ) {
2831                 Debug( LDAP_DEBUG_ANY, "config_back_initialize: "
2832                         "warning, unable to get \"olcDbACLPasswd\" "
2833                         "attribute description: %d: %s\n",
2834                         rc, text, 0 );
2835         } else {
2836                 (void)ldif_must_b64_encode_register( ad->ad_cname.bv_val,
2837                         ad->ad_type->sat_oid );
2838         }
2839
2840         ad = NULL;
2841         rc = slap_str2ad( "olcDbIDAssertPasswd", &ad, &text );
2842         if ( rc ) {
2843                 Debug( LDAP_DEBUG_ANY, "config_back_initialize: "
2844                         "warning, unable to get \"olcDbIDAssertPasswd\" "
2845                         "attribute description: %d: %s\n",
2846                         rc, text, 0 );
2847         } else {
2848                 (void)ldif_must_b64_encode_register( ad->ad_cname.bv_val,
2849                         ad->ad_type->sat_oid );
2850         }
2851
2852         return 0;
2853 }
2854
2855 static int
2856 ldap_back_map_config(
2857                 ConfigArgs *c,
2858                 struct ldapmap  *oc_map,
2859                 struct ldapmap  *at_map )
2860 {
2861         struct ldapmap          *map;
2862         struct ldapmapping      *mapping;
2863         char                    *src, *dst;
2864         int                     is_oc = 0;
2865
2866         if ( strcasecmp( c->argv[ 1 ], "objectclass" ) == 0 ) {
2867                 map = oc_map;
2868                 is_oc = 1;
2869
2870         } else if ( strcasecmp( c->argv[ 1 ], "attribute" ) == 0 ) {
2871                 map = at_map;
2872
2873         } else {
2874                 snprintf( c->cr_msg, sizeof(c->cr_msg),
2875                         "%s unknown argument \"%s\"",
2876                         c->argv[0], c->argv[1] );
2877                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2878                 return 1;
2879         }
2880
2881         if ( !is_oc && map->map == NULL ) {
2882                 /* only init if required */
2883                 ldap_back_map_init( map, &mapping );
2884         }
2885
2886         if ( strcmp( c->argv[ 2 ], "*" ) == 0 ) {
2887                 if ( c->argc < 4 || strcmp( c->argv[ 3 ], "*" ) == 0 ) {
2888                         map->drop_missing = ( c->argc < 4 );
2889                         goto success_return;
2890                 }
2891                 src = dst = c->argv[ 3 ];
2892
2893         } else if ( c->argc < 4 ) {
2894                 src = "";
2895                 dst = c->argv[ 2 ];
2896
2897         } else {
2898                 src = c->argv[ 2 ];
2899                 dst = ( strcmp( c->argv[ 3 ], "*" ) == 0 ? src : c->argv[ 3 ] );
2900         }
2901
2902         if ( ( map == at_map )
2903                 && ( strcasecmp( src, "objectclass" ) == 0
2904                         || strcasecmp( dst, "objectclass" ) == 0 ) )
2905         {
2906                 snprintf( c->cr_msg, sizeof(c->cr_msg),
2907                         "objectclass attribute cannot be mapped" );
2908                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2909                 return 1;
2910         }
2911
2912         mapping = (struct ldapmapping *)ch_calloc( 2,
2913                 sizeof(struct ldapmapping) );
2914         if ( mapping == NULL ) {
2915                 snprintf( c->cr_msg, sizeof(c->cr_msg),
2916                         "out of memory" );
2917                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2918                 return 1;
2919         }
2920         ber_str2bv( src, 0, 1, &mapping[ 0 ].src );
2921         ber_str2bv( dst, 0, 1, &mapping[ 0 ].dst );
2922         mapping[ 1 ].src = mapping[ 0 ].dst;
2923         mapping[ 1 ].dst = mapping[ 0 ].src;
2924
2925         /*
2926          * schema check
2927          */
2928         if ( is_oc ) {
2929                 if ( src[ 0 ] != '\0' ) {
2930                         if ( oc_bvfind( &mapping[ 0 ].src ) == NULL ) {
2931                                 Debug( LDAP_DEBUG_ANY,
2932         "warning, source objectClass '%s' should be defined in schema\n",
2933                                         c->log, src, 0 );
2934
2935                                 /*
2936                                  * FIXME: this should become an err
2937                                  */
2938                                 goto error_return;
2939                         }
2940                 }
2941
2942                 if ( oc_bvfind( &mapping[ 0 ].dst ) == NULL ) {
2943                         Debug( LDAP_DEBUG_ANY,
2944         "warning, destination objectClass '%s' is not defined in schema\n",
2945                                 c->log, dst, 0 );
2946                 }
2947         } else {
2948                 int                     rc;
2949                 const char              *text = NULL;
2950                 AttributeDescription    *ad = NULL;
2951
2952                 if ( src[ 0 ] != '\0' ) {
2953                         rc = slap_bv2ad( &mapping[ 0 ].src, &ad, &text );
2954                         if ( rc != LDAP_SUCCESS ) {
2955                                 Debug( LDAP_DEBUG_ANY,
2956         "warning, source attributeType '%s' should be defined in schema\n",
2957                                         c->log, src, 0 );
2958
2959                                 /*
2960                                  * FIXME: this should become an err
2961                                  */
2962                                 /*
2963                                  * we create a fake "proxied" ad
2964                                  * and add it here.
2965                                  */
2966
2967                                 rc = slap_bv2undef_ad( &mapping[ 0 ].src,
2968                                                 &ad, &text, SLAP_AD_PROXIED );
2969                                 if ( rc != LDAP_SUCCESS ) {
2970                                         snprintf( c->cr_msg, sizeof( c->cr_msg ),
2971                                                 "source attributeType \"%s\": %d (%s)",
2972                                                 src, rc, text ? text : "" );
2973                                         Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2974                                         goto error_return;
2975                                 }
2976                         }
2977
2978                         ad = NULL;
2979                 }
2980
2981                 rc = slap_bv2ad( &mapping[ 0 ].dst, &ad, &text );
2982                 if ( rc != LDAP_SUCCESS ) {
2983                         Debug( LDAP_DEBUG_ANY,
2984         "warning, destination attributeType '%s' is not defined in schema\n",
2985                                 c->log, dst, 0 );
2986
2987                         /*
2988                          * we create a fake "proxied" ad
2989                          * and add it here.
2990                          */
2991
2992                         rc = slap_bv2undef_ad( &mapping[ 0 ].dst,
2993                                         &ad, &text, SLAP_AD_PROXIED );
2994                         if ( rc != LDAP_SUCCESS ) {
2995                                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
2996                                         "destination attributeType \"%s\": %d (%s)\n",
2997                                         dst, rc, text ? text : "" );
2998                                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
2999                                 return 1;
3000                         }
3001                 }
3002         }
3003
3004         if ( (src[ 0 ] != '\0' && avl_find( map->map, (caddr_t)&mapping[ 0 ], mapping_cmp ) != NULL)
3005                         || avl_find( map->remap, (caddr_t)&mapping[ 1 ], mapping_cmp ) != NULL)
3006         {
3007                 snprintf( c->cr_msg, sizeof( c->cr_msg ),
3008                         "duplicate mapping found." );
3009                 Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg, 0 );
3010                 goto error_return;
3011         }
3012
3013         if ( src[ 0 ] != '\0' ) {
3014                 avl_insert( &map->map, (caddr_t)&mapping[ 0 ],
3015                                         mapping_cmp, mapping_dup );
3016         }
3017         avl_insert( &map->remap, (caddr_t)&mapping[ 1 ],
3018                                 mapping_cmp, mapping_dup );
3019
3020 success_return:;
3021         return 0;
3022
3023 error_return:;
3024         if ( mapping ) {
3025                 ch_free( mapping[ 0 ].src.bv_val );
3026                 ch_free( mapping[ 0 ].dst.bv_val );
3027                 ch_free( mapping );
3028         }
3029
3030         return 1;
3031 }
3032
3033
3034 #ifdef ENABLE_REWRITE
3035 static char *
3036 suffix_massage_regexize( const char *s )
3037 {
3038         char *res, *ptr;
3039         const char *p, *r;
3040         int i;
3041
3042         if ( s[ 0 ] == '\0' ) {
3043                 return ch_strdup( "^(.+)$" );
3044         }
3045
3046         for ( i = 0, p = s;
3047                         ( r = strchr( p, ',' ) ) != NULL;
3048                         p = r + 1, i++ )
3049                 ;
3050
3051         res = ch_calloc( sizeof( char ),
3052                         strlen( s )
3053                         + STRLENOF( "((.+),)?" )
3054                         + STRLENOF( "[ ]?" ) * i
3055                         + STRLENOF( "$" ) + 1 );
3056
3057         ptr = lutil_strcopy( res, "((.+),)?" );
3058         for ( i = 0, p = s;
3059                         ( r = strchr( p, ',' ) ) != NULL;
3060                         p = r + 1 , i++ ) {
3061                 ptr = lutil_strncopy( ptr, p, r - p + 1 );
3062                 ptr = lutil_strcopy( ptr, "[ ]?" );
3063
3064                 if ( r[ 1 ] == ' ' ) {
3065                         r++;
3066                 }
3067         }
3068         ptr = lutil_strcopy( ptr, p );
3069         ptr[ 0 ] = '$';
3070         ptr++;
3071         ptr[ 0 ] = '\0';
3072
3073         return res;
3074 }
3075
3076 static char *
3077 suffix_massage_patternize( const char *s, const char *p )
3078 {
3079         ber_len_t       len;
3080         char            *res, *ptr;
3081
3082         len = strlen( p );
3083
3084         if ( s[ 0 ] == '\0' ) {
3085                 len++;
3086         }
3087
3088         res = ch_calloc( sizeof( char ), len + STRLENOF( "%1" ) + 1 );
3089         if ( res == NULL ) {
3090                 return NULL;
3091         }
3092
3093         ptr = lutil_strcopy( res, ( p[ 0 ] == '\0' ? "%2" : "%1" ) );
3094         if ( s[ 0 ] == '\0' ) {
3095                 ptr[ 0 ] = ',';
3096                 ptr++;
3097         }
3098         lutil_strcopy( ptr, p );
3099
3100         return res;
3101 }
3102
3103 int
3104 suffix_massage_config(
3105                 struct rewrite_info *info,
3106                 struct berval *pvnc,
3107                 struct berval *nvnc,
3108                 struct berval *prnc,
3109                 struct berval *nrnc
3110 )
3111 {
3112         char *rargv[ 5 ];
3113         int line = 0;
3114
3115         rargv[ 0 ] = "rewriteEngine";
3116         rargv[ 1 ] = "on";
3117         rargv[ 2 ] = NULL;
3118         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3119
3120         rargv[ 0 ] = "rewriteContext";
3121         rargv[ 1 ] = "default";
3122         rargv[ 2 ] = NULL;
3123         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3124
3125         rargv[ 0 ] = "rewriteRule";
3126         rargv[ 1 ] = suffix_massage_regexize( pvnc->bv_val );
3127         rargv[ 2 ] = suffix_massage_patternize( pvnc->bv_val, prnc->bv_val );
3128         rargv[ 3 ] = ":";
3129         rargv[ 4 ] = NULL;
3130         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3131         ch_free( rargv[ 1 ] );
3132         ch_free( rargv[ 2 ] );
3133
3134         if ( BER_BVISEMPTY( pvnc ) ) {
3135                 rargv[ 0 ] = "rewriteRule";
3136                 rargv[ 1 ] = "^$";
3137                 rargv[ 2 ] = prnc->bv_val;
3138                 rargv[ 3 ] = ":";
3139                 rargv[ 4 ] = NULL;
3140                 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3141         }
3142
3143         rargv[ 0 ] = "rewriteContext";
3144         rargv[ 1 ] = "searchEntryDN";
3145         rargv[ 2 ] = NULL;
3146         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3147
3148         rargv[ 0 ] = "rewriteRule";
3149         rargv[ 1 ] = suffix_massage_regexize( prnc->bv_val );
3150         rargv[ 2 ] = suffix_massage_patternize( prnc->bv_val, pvnc->bv_val );
3151         rargv[ 3 ] = ":";
3152         rargv[ 4 ] = NULL;
3153         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3154         ch_free( rargv[ 1 ] );
3155         ch_free( rargv[ 2 ] );
3156
3157         if ( BER_BVISEMPTY( prnc ) ) {
3158                 rargv[ 0 ] = "rewriteRule";
3159                 rargv[ 1 ] = "^$";
3160                 rargv[ 2 ] = pvnc->bv_val;
3161                 rargv[ 3 ] = ":";
3162                 rargv[ 4 ] = NULL;
3163                 rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3164         }
3165
3166         /* backward compatibility */
3167         rargv[ 0 ] = "rewriteContext";
3168         rargv[ 1 ] = "searchResult";
3169         rargv[ 2 ] = "alias";
3170         rargv[ 3 ] = "searchEntryDN";
3171         rargv[ 4 ] = NULL;
3172         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3173
3174         rargv[ 0 ] = "rewriteContext";
3175         rargv[ 1 ] = "matchedDN";
3176         rargv[ 2 ] = "alias";
3177         rargv[ 3 ] = "searchEntryDN";
3178         rargv[ 4 ] = NULL;
3179         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3180
3181         rargv[ 0 ] = "rewriteContext";
3182         rargv[ 1 ] = "searchAttrDN";
3183         rargv[ 2 ] = "alias";
3184         rargv[ 3 ] = "searchEntryDN";
3185         rargv[ 4 ] = NULL;
3186         rewrite_parse( info, "<suffix massage>", ++line, 4, rargv );
3187
3188         /* NOTE: this corresponds to #undef'ining RWM_REFERRAL_REWRITE;
3189          * see servers/slapd/overlays/rwm.h for details */
3190         rargv[ 0 ] = "rewriteContext";
3191         rargv[ 1 ] = "referralAttrDN";
3192         rargv[ 2 ] = NULL;
3193         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3194
3195         rargv[ 0 ] = "rewriteContext";
3196         rargv[ 1 ] = "referralDN";
3197         rargv[ 2 ] = NULL;
3198         rewrite_parse( info, "<suffix massage>", ++line, 2, rargv );
3199
3200         return 0;
3201 }
3202 #endif /* ENABLE_REWRITE */
3203