git.sur5r.net Git - openldap/blob - servers/slapd/bconfig.c

   1 /* bconfig.c - the config backend */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 2005 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* ACKNOWLEDGEMENTS:
  17  * This work was originally developed by Howard Chu for inclusion
  18  * in OpenLDAP Software.
  19  */
  20
  21 #include "portable.h"
  22
  23 #include <stdio.h>
  24 #include <ac/string.h>
  25 #include <ac/ctype.h>
  26 #include <ac/errno.h>
  27 #include <sys/stat.h>
  28
  29 #include "slap.h"
  30
  31 #ifdef LDAP_SLAPI
  32 #include "slapi/slapi.h"
  33 #endif
  34
  35 #include <lutil.h>
  36 #include <ldap_rq.h>
  37
  38 #include "config.h"
  39
  40 static struct berval config_rdn = BER_BVC("cn=config");
  41 static struct berval schema_rdn = BER_BVC("cn=schema");
  42
  43 #define IFMT    "{%d}"
  44
  45 #ifdef SLAPD_MODULES
  46 typedef struct modpath_s {
  47         struct modpath_s *mp_next;
  48         struct berval mp_path;
  49         BerVarray mp_loads;
  50 } ModPaths;
  51
  52 static ModPaths modpaths, *modlast = &modpaths, *modcur = &modpaths;
  53 #endif
  54
  55 typedef struct ConfigFile {
  56         struct ConfigFile *c_sibs;
  57         struct ConfigFile *c_kids;
  58         struct berval c_file;
  59         AttributeType *c_at_head, *c_at_tail;
  60         ContentRule *c_cr_head, *c_cr_tail;
  61         ObjectClass *c_oc_head, *c_oc_tail;
  62         OidMacro *c_om_head, *c_om_tail;
  63         BerVarray c_dseFiles;
  64 } ConfigFile;
  65
  66 typedef struct CfOcInfo {
  67         struct berval *co_name;
  68         ConfigTable *co_table;
  69         ConfigType co_type;
  70         ObjectClass *co_oc;
  71 } CfOcInfo;
  72
  73 typedef struct CfEntryInfo {
  74         struct CfEntryInfo *ce_parent;
  75         struct CfEntryInfo *ce_sibs;
  76         struct CfEntryInfo *ce_kids;
  77         Entry *ce_entry;
  78         ConfigType ce_type;
  79         BackendInfo *ce_bi;
  80         BackendDB *ce_be;
  81 } CfEntryInfo;
  82
  83 typedef struct {
  84         ConfigFile *cb_config;
  85         CfEntryInfo *cb_root;
  86         BackendDB       cb_db;  /* underlying database */
  87         int             cb_got_ldif;
  88         int             cb_use_ldif;
  89 } CfBackInfo;
  90
  91 /* These do nothing in slapd, they're kept only to make them
  92  * editable here.
  93  */
  94 static char *replica_pidFile, *replica_argsFile;
  95 static int replicationInterval;
  96
  97 static char     *passwd_salt;
  98 static char     *logfileName;
  99 static BerVarray authz_rewrites;
 100
 101 static struct berval cfdir;
 102
 103 /* Private state */
 104 static AttributeDescription *cfAd_backend, *cfAd_database, *cfAd_overlay,
 105         *cfAd_include;
 106
 107 static ObjectClass *cfOc_schema, *cfOc_global, *cfOc_backend, *cfOc_database,
 108         *cfOc_include, *cfOc_overlay, *cfOc_module;
 109
 110 static ConfigFile cf_prv, *cfn = &cf_prv;
 111
 112 static Avlnode *CfOcTree;
 113
 114 static int add_syncrepl LDAP_P(( Backend *, char **, int ));
 115 static int parse_syncrepl_line LDAP_P(( char **, int, syncinfo_t *));
 116 static void syncrepl_unparse LDAP_P (( syncinfo_t *, struct berval *));
 117 static int config_add_internal( CfBackInfo *cfb, Entry *e, SlapReply *rs,
 118         int *renumber );
 119
 120 static ConfigDriver config_fname;
 121 static ConfigDriver config_cfdir;
 122 static ConfigDriver config_generic;
 123 static ConfigDriver config_search_base;
 124 static ConfigDriver config_passwd_hash;
 125 static ConfigDriver config_schema_dn;
 126 static ConfigDriver config_sizelimit;
 127 static ConfigDriver config_timelimit;
 128 static ConfigDriver config_limits;
 129 static ConfigDriver config_overlay;
 130 static ConfigDriver config_suffix;
 131 static ConfigDriver config_deref_depth;
 132 static ConfigDriver config_rootdn;
 133 static ConfigDriver config_rootpw;
 134 static ConfigDriver config_restrict;
 135 static ConfigDriver config_allows;
 136 static ConfigDriver config_disallows;
 137 static ConfigDriver config_requires;
 138 static ConfigDriver config_security;
 139 static ConfigDriver config_referral;
 140 static ConfigDriver config_loglevel;
 141 static ConfigDriver config_syncrepl;
 142 static ConfigDriver config_replica;
 143 static ConfigDriver config_updatedn;
 144 static ConfigDriver config_updateref;
 145 static ConfigDriver config_include;
 146 #ifdef HAVE_TLS
 147 static ConfigDriver config_tls_option;
 148 static ConfigDriver config_tls_config;
 149 #endif
 150
 151 enum {
 152         CFG_ACL = 1,
 153         CFG_BACKEND,
 154         CFG_DATABASE,
 155         CFG_TLS_RAND,
 156         CFG_TLS_CIPHER,
 157         CFG_TLS_CERT_FILE,
 158         CFG_TLS_CERT_KEY,
 159         CFG_TLS_CA_PATH,
 160         CFG_TLS_CA_FILE,
 161         CFG_TLS_VERIFY,
 162         CFG_TLS_CRLCHECK,
 163         CFG_SIZE,
 164         CFG_TIME,
 165         CFG_CONCUR,
 166         CFG_THREADS,
 167         CFG_SALT,
 168         CFG_LIMITS,
 169         CFG_RO,
 170         CFG_REWRITE,
 171         CFG_DEPTH,
 172         CFG_OID,
 173         CFG_OC,
 174         CFG_DIT,
 175         CFG_ATTR,
 176         CFG_ATOPT,
 177         CFG_CHECK,
 178         CFG_AUDITLOG,
 179         CFG_REPLOG,
 180         CFG_ROOTDSE,
 181         CFG_LOGFILE,
 182         CFG_PLUGIN,
 183         CFG_MODLOAD,
 184         CFG_MODPATH,
 185         CFG_LASTMOD,
 186         CFG_AZPOLICY,
 187         CFG_AZREGEXP,
 188         CFG_SASLSECP,
 189         CFG_SSTR_IF_MAX,
 190         CFG_SSTR_IF_MIN,
 191 };
 192
 193 typedef struct {
 194         char *name, *oid;
 195 } OidRec;
 196
 197 static OidRec OidMacros[] = {
 198         /* OpenLDAProot:666.11.1 */
 199         { "OLcfg", "1.3.6.1.4.1.4203.666.11.1" },
 200         { "OLcfgAt", "OLcfg:3" },
 201         { "OLcfgGlAt", "OLcfgAt:0" },
 202         { "OLcfgBkAt", "OLcfgAt:1" },
 203         { "OLcfgDbAt", "OLcfgAt:2" },
 204         { "OLcfgOvAt", "OLcfgAt:3" },
 205         { "OLcfgOc", "OLcfg:4" },
 206         { "OLcfgGlOc", "OLcfgOc:0" },
 207         { "OLcfgBkOc", "OLcfgOc:1" },
 208         { "OLcfgDbOc", "OLcfgOc:2" },
 209         { "OLcfgOvOc", "OLcfgOc:3" },
 210         { "OMsyn", "1.3.6.1.4.1.1466.115.121.1" },
 211         { "OMsInteger", "OMsyn:27" },
 212         { "OMsBoolean", "OMsyn:7" },
 213         { "OMsDN", "OMsyn:12" },
 214         { "OMsDirectoryString", "OMsyn:15" },
 215         { "OMsOctetString", "OMsyn:40" },
 216         { NULL, NULL }
 217 };
 218
 219 /*
 220  * OLcfg{Bk|Db}{Oc|At}:0                -> common
 221  * OLcfg{Bk|Db}{Oc|At}:1                -> bdb
 222  * OLcfg{Bk|Db}{Oc|At}:2                -> ldif
 223  * OLcfg{Bk|Db}{Oc|At}:3                -> ldap?
 224  */
 225
 226 /* alphabetical ordering */
 227
 228 ConfigTable config_back_cf_table[] = {
 229         /* This attr is read-only */
 230         { "", "", 0, 0, 0, ARG_MAGIC,
 231                 &config_fname, "( OLcfgGlAt:78 NAME 'olcConfigFile' "
 232                         "DESC 'File for slapd configuration directives' "
 233                         "EQUALITY caseIgnoreMatch "
 234                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 235         { "", "", 0, 0, 0, ARG_MAGIC,
 236                 &config_cfdir, "( OLcfgGlAt:79 NAME 'olcConfigDir' "
 237                         "DESC 'Directory for slapd configuration backend' "
 238                         "EQUALITY caseIgnoreMatch "
 239                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 240         { "access",     NULL, 0, 0, 0, ARG_MAY_DB|ARG_MAGIC|CFG_ACL,
 241                 &config_generic, "( OLcfgGlAt:1 NAME 'olcAccess' "
 242                         "DESC 'Access Control List' "
 243                         "EQUALITY caseIgnoreMatch "
 244                         "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL },
 245         { "allows",     "features", 2, 0, 5, ARG_PRE_DB|ARG_MAGIC,
 246                 &config_allows, "( OLcfgGlAt:2 NAME 'olcAllows' "
 247                         "DESC 'Allowed set of deprecated features' "
 248                         "EQUALITY caseIgnoreMatch "
 249                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 250         { "argsfile", "file", 2, 2, 0, ARG_STRING,
 251                 &slapd_args_file, "( OLcfgGlAt:3 NAME 'olcArgsFile' "
 252                         "DESC 'File for slapd command line options' "
 253                         "EQUALITY caseIgnoreMatch "
 254                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 255         { "attribute",  "attribute", 2, 0, 9, ARG_PAREN|ARG_MAGIC|CFG_ATTR,
 256                 &config_generic, "( OLcfgGlAt:4 NAME 'olcAttributeTypes' "
 257                         "DESC 'OpenLDAP attributeTypes' "
 258                         "EQUALITY caseIgnoreMatch "
 259                         "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )",
 260                                 NULL, NULL },
 261         { "attributeoptions", NULL, 0, 0, 0, ARG_MAGIC|CFG_ATOPT,
 262                 &config_generic, "( OLcfgGlAt:5 NAME 'olcAttributeOptions' "
 263                         "EQUALITY caseIgnoreMatch "
 264                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 265         { "authid-rewrite", NULL, 2, 0, 0,
 266 #ifdef SLAP_AUTH_REWRITE
 267                 ARG_MAGIC|CFG_REWRITE|ARG_NO_DELETE|ARG_NO_INSERT, &config_generic,
 268 #else
 269                 ARG_IGNORED, NULL,
 270 #endif
 271                  "( OLcfgGlAt:6 NAME 'olcAuthIDRewrite' "
 272                         "EQUALITY caseIgnoreMatch "
 273                         "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL },
 274         { "authz-policy", "policy", 2, 2, 0, ARG_STRING|ARG_MAGIC|CFG_AZPOLICY,
 275                 &config_generic, "( OLcfgGlAt:7 NAME 'olcAuthzPolicy' "
 276                         "EQUALITY caseIgnoreMatch "
 277                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 278         { "authz-regexp", NULL, 3, 3, 0, ARG_MAGIC|CFG_AZREGEXP|ARG_NO_DELETE|ARG_NO_INSERT,
 279                 &config_generic, "( OLcfgGlAt:8 NAME 'olcAuthzRegexp' "
 280                         "EQUALITY caseIgnoreMatch "
 281                         "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL },
 282         { "backend", "type", 2, 2, 0, ARG_PRE_DB|ARG_MAGIC|CFG_BACKEND,
 283                 &config_generic, "( OLcfgGlAt:9 NAME 'olcBackend' "
 284                         "DESC 'A type of backend' "
 285                         "EQUALITY caseIgnoreMatch "
 286                         "SYNTAX OMsDirectoryString SINGLE-VALUE X-ORDERED 'SIBLINGS' )",
 287                                 NULL, NULL },
 288         { "concurrency", "level", 2, 2, 0, ARG_INT|ARG_MAGIC|CFG_CONCUR,
 289                 &config_generic, "( OLcfgGlAt:10 NAME 'olcConcurrency' "
 290                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 291         { "conn_max_pending", "max", 2, 2, 0, ARG_INT,
 292                 &slap_conn_max_pending, "( OLcfgGlAt:11 NAME 'olcConnMaxPending' "
 293                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 294         { "conn_max_pending_auth", "max", 2, 2, 0, ARG_INT,
 295                 &slap_conn_max_pending_auth, "( OLcfgGlAt:12 NAME 'olcConnMaxPendingAuth' "
 296                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 297         { "database", "type", 2, 2, 0, ARG_MAGIC|CFG_DATABASE,
 298                 &config_generic, "( OLcfgGlAt:13 NAME 'olcDatabase' "
 299                         "DESC 'The backend type for a database instance' "
 300                         "SUP olcBackend SINGLE-VALUE X-ORDERED 'SIBLINGS' )", NULL, NULL },
 301         { "defaultSearchBase", "dn", 2, 2, 0, ARG_PRE_BI|ARG_PRE_DB|ARG_DN|ARG_MAGIC,
 302                 &config_search_base, "( OLcfgGlAt:14 NAME 'olcDefaultSearchBase' "
 303                         "SYNTAX OMsDN SINGLE-VALUE )", NULL, NULL },
 304         { "disallows", "features", 2, 0, 8, ARG_PRE_DB|ARG_MAGIC,
 305                 &config_disallows, "( OLcfgGlAt:15 NAME 'olcDisallows' "
 306                         "EQUALITY caseIgnoreMatch "
 307                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 308         { "ditcontentrule",     NULL, 0, 0, 0, ARG_MAGIC|CFG_DIT,
 309                 &config_generic, "( OLcfgGlAt:16 NAME 'olcDitContentRules' "
 310                         "DESC 'OpenLDAP DIT content rules' "
 311                         "EQUALITY caseIgnoreMatch "
 312                         "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )",
 313                         NULL, NULL },
 314         { "gentlehup", "on|off", 2, 2, 0,
 315 #ifdef SIGHUP
 316                 ARG_ON_OFF, &global_gentlehup,
 317 #else
 318                 ARG_IGNORED, NULL,
 319 #endif
 320                 "( OLcfgGlAt:17 NAME 'olcGentleHUP' "
 321                         "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
 322         { "idletimeout", "timeout", 2, 2, 0, ARG_INT,
 323                 &global_idletimeout, "( OLcfgGlAt:18 NAME 'olcIdleTimeout' "
 324                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 325         { "include", "file", 2, 2, 0, ARG_MAGIC,
 326                 &config_include, "( OLcfgGlAt:19 NAME 'olcInclude' "
 327                         "SUP labeledURI )", NULL, NULL },
 328         { "index_substr_if_minlen", "min", 2, 2, 0, ARG_INT|ARG_NONZERO|ARG_MAGIC|CFG_SSTR_IF_MIN,
 329                 &config_generic, "( OLcfgGlAt:20 NAME 'olcIndexSubstrIfMinLen' "
 330                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 331         { "index_substr_if_maxlen", "max", 2, 2, 0, ARG_INT|ARG_NONZERO|ARG_MAGIC|CFG_SSTR_IF_MAX,
 332                 &config_generic, "( OLcfgGlAt:21 NAME 'olcIndexSubstrIfMaxLen' "
 333                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 334         { "index_substr_any_len", "len", 2, 2, 0, ARG_INT|ARG_NONZERO,
 335                 &index_substr_any_len, "( OLcfgGlAt:22 NAME 'olcIndexSubstrAnyLen' "
 336                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 337         { "index_substr_step", "step", 2, 2, 0, ARG_INT|ARG_NONZERO,
 338                 &index_substr_any_step, "( OLcfgGlAt:23 NAME 'olcIndexSubstrAnyStep' "
 339                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 340         { "lastmod", "on|off", 2, 2, 0, ARG_DB|ARG_ON_OFF|ARG_MAGIC|CFG_LASTMOD,
 341                 &config_generic, "( OLcfgDbAt:0.4 NAME 'olcLastMod' "
 342                         "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
 343         { "limits", "limits", 2, 0, 0, ARG_DB|ARG_MAGIC|CFG_LIMITS,
 344                 &config_generic, "( OLcfgDbAt:0.5 NAME 'olcLimits' "
 345                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 346         { "localSSF", "ssf", 2, 2, 0, ARG_INT,
 347                 &local_ssf, "( OLcfgGlAt:26 NAME 'olcLocalSSF' "
 348                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 349         { "logfile", "file", 2, 2, 0, ARG_STRING|ARG_MAGIC|CFG_LOGFILE,
 350                 &config_generic, "( OLcfgGlAt:27 NAME 'olcLogFile' "
 351                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 352         { "loglevel", "level", 2, 0, 0, ARG_MAGIC,
 353                 &config_loglevel, "( OLcfgGlAt:28 NAME 'olcLogLevel' "
 354                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 355         { "maxDerefDepth", "depth", 2, 2, 0, ARG_DB|ARG_INT|ARG_MAGIC|CFG_DEPTH,
 356                 &config_generic, "( OLcfgDbAt:0.6 NAME 'olcMaxDerefDepth' "
 357                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 358         { "moduleload", "file", 2, 0, 0,
 359 #ifdef SLAPD_MODULES
 360                 ARG_MAGIC|CFG_MODLOAD, &config_generic,
 361 #else
 362                 ARG_IGNORED, NULL,
 363 #endif
 364                 "( OLcfgGlAt:30 NAME 'olcModuleLoad' "
 365                         "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL },
 366         { "modulepath", "path", 2, 2, 0,
 367 #ifdef SLAPD_MODULES
 368                 ARG_MAGIC|CFG_MODPATH, &config_generic,
 369 #else
 370                 ARG_IGNORED, NULL,
 371 #endif
 372                 "( OLcfgGlAt:31 NAME 'olcModulePath' "
 373                         "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL },
 374         { "objectclass", "objectclass", 2, 0, 0, ARG_PAREN|ARG_MAGIC|CFG_OC,
 375                 &config_generic, "( OLcfgGlAt:32 NAME 'olcObjectClasses' "
 376                 "DESC 'OpenLDAP object classes' "
 377                 "EQUALITY caseIgnoreMatch "
 378                 "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )",
 379                         NULL, NULL },
 380         { "objectidentifier", NULL,     0, 0, 0, ARG_MAGIC|CFG_OID,
 381                 &config_generic, "( OLcfgGlAt:33 NAME 'olcObjectIdentifier' "
 382                         "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL },
 383         { "overlay", "overlay", 2, 2, 0, ARG_MAGIC,
 384                 &config_overlay, "( OLcfgGlAt:34 NAME 'olcOverlay' "
 385                         "SUP olcDatabase SINGLE-VALUE X-ORDERED 'SIBLINGS' )", NULL, NULL },
 386         { "password-crypt-salt-format", "salt", 2, 2, 0, ARG_STRING|ARG_MAGIC|CFG_SALT,
 387                 &config_generic, "( OLcfgGlAt:35 NAME 'olcPasswordCryptSaltFormat' "
 388                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 389         { "password-hash", "hash", 2, 2, 0, ARG_MAGIC,
 390                 &config_passwd_hash, "( OLcfgGlAt:36 NAME 'olcPasswordHash' "
 391                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 392         { "pidfile", "file", 2, 2, 0, ARG_STRING,
 393                 &slapd_pid_file, "( OLcfgGlAt:37 NAME 'olcPidFile' "
 394                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 395         { "plugin", NULL, 0, 0, 0,
 396 #ifdef LDAP_SLAPI
 397                 ARG_MAGIC|CFG_PLUGIN, &config_generic,
 398 #else
 399                 ARG_IGNORED, NULL,
 400 #endif
 401                 "( OLcfgGlAt:38 NAME 'olcPlugin' "
 402                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 403         { "pluginlog", "filename", 2, 2, 0,
 404 #ifdef LDAP_SLAPI
 405                 ARG_STRING, &slapi_log_file,
 406 #else
 407                 ARG_IGNORED, NULL,
 408 #endif
 409                 "( OLcfgGlAt:39 NAME 'olcPluginLogFile' "
 410                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 411         { "readonly", "on|off", 2, 2, 0, ARG_MAY_DB|ARG_ON_OFF|ARG_MAGIC|CFG_RO,
 412                 &config_generic, "( OLcfgGlAt:40 NAME 'olcReadOnly' "
 413                         "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
 414         { "referral", "url", 2, 2, 0, ARG_MAGIC,
 415                 &config_referral, "( OLcfgGlAt:41 NAME 'olcReferral' "
 416                         "SUP labeledURI SINGLE-VALUE )", NULL, NULL },
 417         { "replica", "host or uri", 2, 0, 0, ARG_DB|ARG_MAGIC,
 418                 &config_replica, "( OLcfgDbAt:0.7 NAME 'olcReplica' "
 419                         "SUP labeledURI )", NULL, NULL },
 420         { "replica-argsfile", NULL, 0, 0, 0, ARG_STRING,
 421                 &replica_argsFile, "( OLcfgGlAt:43 NAME 'olcReplicaArgsFile' "
 422                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 423         { "replica-pidfile", NULL, 0, 0, 0, ARG_STRING,
 424                 &replica_pidFile, "( OLcfgGlAt:44 NAME 'olcReplicaPidFile' "
 425                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 426         { "replicationInterval", NULL, 0, 0, 0, ARG_INT,
 427                 &replicationInterval, "( OLcfgGlAt:45 NAME 'olcReplicationInterval' "
 428                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 429         { "replogfile", "filename", 2, 2, 0, ARG_MAY_DB|ARG_MAGIC|ARG_STRING|CFG_REPLOG,
 430                 &config_generic, "( OLcfgGlAt:46 NAME 'olcReplogFile' "
 431                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 432         { "require", "features", 2, 0, 7, ARG_MAY_DB|ARG_MAGIC,
 433                 &config_requires, "( OLcfgGlAt:47 NAME 'olcRequires' "
 434                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 435         { "restrict", "op_list", 2, 0, 0, ARG_MAY_DB|ARG_MAGIC,
 436                 &config_restrict, "( OLcfgGlAt:48 NAME 'olcRestrict' "
 437                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 438         { "reverse-lookup", "on|off", 2, 2, 0,
 439 #ifdef SLAPD_RLOOKUPS
 440                 ARG_ON_OFF, &use_reverse_lookup,
 441 #else
 442                 ARG_IGNORED, NULL,
 443 #endif
 444                 "( OLcfgGlAt:49 NAME 'olcReverseLookup' "
 445                         "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
 446         { "rootdn", "dn", 2, 2, 0, ARG_DB|ARG_DN|ARG_MAGIC,
 447                 &config_rootdn, "( OLcfgDbAt:0.8 NAME 'olcRootDN' "
 448                         "SYNTAX OMsDN SINGLE-VALUE )", NULL, NULL },
 449         { "rootDSE", "file", 2, 2, 0, ARG_MAGIC|CFG_ROOTDSE,
 450                 &config_generic, "( OLcfgGlAt:51 NAME 'olcRootDSE' "
 451                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 452         { "rootpw", "password", 2, 2, 0, ARG_BERVAL|ARG_DB|ARG_MAGIC,
 453                 &config_rootpw, "( OLcfgDbAt:0.9 NAME 'olcRootPW' "
 454                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 455         { "sasl-authz-policy", NULL, 2, 2, 0, ARG_MAGIC|CFG_AZPOLICY,
 456                 &config_generic, NULL, NULL, NULL },
 457         { "sasl-host", "host", 2, 2, 0,
 458 #ifdef HAVE_CYRUS_SASL
 459                 ARG_STRING|ARG_UNIQUE, &global_host,
 460 #else
 461                 ARG_IGNORED, NULL,
 462 #endif
 463                 "( OLcfgGlAt:53 NAME 'olcSaslHost' "
 464                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 465         { "sasl-realm", "realm", 2, 2, 0,
 466 #ifdef HAVE_CYRUS_SASL
 467                 ARG_STRING|ARG_UNIQUE, &global_realm,
 468 #else
 469                 ARG_IGNORED, NULL,
 470 #endif
 471                 "( OLcfgGlAt:54 NAME 'olcSaslRealm' "
 472                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 473         { "sasl-regexp", NULL, 3, 3, 0, ARG_MAGIC|CFG_AZREGEXP,
 474                 &config_generic, NULL, NULL, NULL },
 475         { "sasl-secprops", "properties", 2, 2, 0,
 476 #ifdef HAVE_CYRUS_SASL
 477                 ARG_MAGIC|CFG_SASLSECP, &config_generic,
 478 #else
 479                 ARG_IGNORED, NULL,
 480 #endif
 481                 "( OLcfgGlAt:56 NAME 'olcSaslSecProps' "
 482                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 483         { "saslRegexp", NULL, 3, 3, 0, ARG_MAGIC|CFG_AZREGEXP,
 484                 &config_generic, NULL, NULL, NULL },
 485         { "schemacheck", "on|off", 2, 2, 0, ARG_ON_OFF|ARG_MAGIC|CFG_CHECK,
 486                 &config_generic, "( OLcfgGlAt:57 NAME 'olcSchemaCheck' "
 487                         "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
 488         { "schemadn", "dn", 2, 2, 0, ARG_MAY_DB|ARG_DN|ARG_MAGIC,
 489                 &config_schema_dn, "( OLcfgGlAt:58 NAME 'olcSchemaDN' "
 490                         "SYNTAX OMsDN SINGLE-VALUE )", NULL, NULL },
 491         { "security", "factors", 2, 0, 0, ARG_MAY_DB|ARG_MAGIC,
 492                 &config_security, "( OLcfgGlAt:59 NAME 'olcSecurity' "
 493                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 494         { "sizelimit", "limit", 2, 0, 0, ARG_MAY_DB|ARG_MAGIC|CFG_SIZE,
 495                 &config_sizelimit, "( OLcfgGlAt:60 NAME 'olcSizeLimit' "
 496                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 497         { "sockbuf_max_incoming", "max", 2, 2, 0, ARG_BER_LEN_T,
 498                 &sockbuf_max_incoming, "( OLcfgGlAt:61 NAME 'olcSockbufMaxIncoming' "
 499                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 500         { "sockbuf_max_incoming_auth", "max", 2, 2, 0, ARG_BER_LEN_T,
 501                 &sockbuf_max_incoming_auth, "( OLcfgGlAt:62 NAME 'olcSockbufMaxIncomingAuth' "
 502                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 503         { "srvtab", "file", 2, 2, 0,
 504 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
 505                 ARG_STRING, &ldap_srvtab,
 506 #else
 507                 ARG_IGNORED, NULL,
 508 #endif
 509                 "( OLcfgGlAt:63 NAME 'olcSrvtab' "
 510                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 511         { "suffix",     "suffix", 2, 2, 0, ARG_DB|ARG_DN|ARG_MAGIC,
 512                 &config_suffix, "( OLcfgDbAt:0.10 NAME 'olcSuffix' "
 513                         "SYNTAX OMsDN )", NULL, NULL },
 514         { "syncrepl", NULL, 0, 0, 0, ARG_DB|ARG_MAGIC,
 515                 &config_syncrepl, "( OLcfgDbAt:0.11 NAME 'olcSyncrepl' "
 516                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 517         { "threads", "count", 2, 2, 0, ARG_INT|ARG_MAGIC|CFG_THREADS,
 518                 &config_generic, "( OLcfgGlAt:66 NAME 'olcThreads' "
 519                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 520         { "timelimit", "limit", 2, 0, 0, ARG_MAY_DB|ARG_MAGIC|CFG_TIME,
 521                 &config_timelimit, "( OLcfgGlAt:67 NAME 'olcTimeLimit' "
 522                         "SYNTAX OMsInteger )", NULL, NULL },
 523         { "TLSCACertificateFile", NULL, 0, 0, 0,
 524 #ifdef HAVE_TLS
 525                 CFG_TLS_CA_FILE|ARG_STRING|ARG_MAGIC, &config_tls_option,
 526 #else
 527                 ARG_IGNORED, NULL,
 528 #endif
 529                 "( OLcfgGlAt:68 NAME 'olcTLSCACertificateFile' "
 530                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 531         { "TLSCACertificatePath", NULL, 0, 0, 0,
 532 #ifdef HAVE_TLS
 533                 CFG_TLS_CA_PATH|ARG_STRING|ARG_MAGIC, &config_tls_option,
 534 #else
 535                 ARG_IGNORED, NULL,
 536 #endif
 537                 "( OLcfgGlAt:69 NAME 'olcTLSCACertificatePath' "
 538                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 539         { "TLSCertificateFile", NULL, 0, 0, 0,
 540 #ifdef HAVE_TLS
 541                 CFG_TLS_CERT_FILE|ARG_STRING|ARG_MAGIC, &config_tls_option,
 542 #else
 543                 ARG_IGNORED, NULL,
 544 #endif
 545                 "( OLcfgGlAt:70 NAME 'olcTLSCertificateFile' "
 546                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 547         { "TLSCertificateKeyFile", NULL, 0, 0, 0,
 548 #ifdef HAVE_TLS
 549                 CFG_TLS_CERT_KEY|ARG_STRING|ARG_MAGIC, &config_tls_option,
 550 #else
 551                 ARG_IGNORED, NULL,
 552 #endif
 553                 "( OLcfgGlAt:71 NAME 'olcTLSCertificateKeyFile' "
 554                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 555         { "TLSCipherSuite",     NULL, 0, 0, 0,
 556 #ifdef HAVE_TLS
 557                 CFG_TLS_CIPHER|ARG_STRING|ARG_MAGIC, &config_tls_option,
 558 #else
 559                 ARG_IGNORED, NULL,
 560 #endif
 561                 "( OLcfgGlAt:72 NAME 'olcTLSCipherSuite' "
 562                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 563         { "TLSCRLCheck", NULL, 0, 0, 0,
 564 #if defined(HAVE_TLS) && defined(HAVE_OPENSSL_CRL)
 565                 CFG_TLS_CRLCHECK|ARG_STRING|ARG_MAGIC, &config_tls_config,
 566 #else
 567                 ARG_IGNORED, NULL,
 568 #endif
 569                 "( OLcfgGlAt:73 NAME 'olcTLSCRLCheck' "
 570                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 571         { "TLSRandFile", NULL, 0, 0, 0,
 572 #ifdef HAVE_TLS
 573                 CFG_TLS_RAND|ARG_STRING|ARG_MAGIC, &config_tls_option,
 574 #else
 575                 ARG_IGNORED, NULL,
 576 #endif
 577                 "( OLcfgGlAt:74 NAME 'olcTLSRandFile' "
 578                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 579         { "TLSVerifyClient", NULL, 0, 0, 0,
 580 #ifdef HAVE_TLS
 581                 CFG_TLS_VERIFY|ARG_STRING|ARG_MAGIC, &config_tls_config,
 582 #else
 583                 ARG_IGNORED, NULL,
 584 #endif
 585                 "( OLcfgGlAt:75 NAME 'olcTLSVerifyClient' "
 586                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 587         { "ucdata-path", "path", 2, 2, 0, ARG_IGNORED,
 588                 NULL, NULL, NULL, NULL },
 589         { "updatedn", "dn", 2, 2, 0, ARG_DB|ARG_MAGIC,
 590                 &config_updatedn, "( OLcfgDbAt:0.12 NAME 'olcUpdateDN' "
 591                         "SYNTAX OMsDN SINGLE-VALUE )", NULL, NULL },
 592         { "updateref", "url", 2, 2, 0, ARG_DB|ARG_MAGIC,
 593                 &config_updateref, "( OLcfgDbAt:0.13 NAME 'olcUpdateRef' "
 594                         "SUP labeledURI )", NULL, NULL },
 595         { NULL, NULL, 0, 0, 0, ARG_IGNORED,
 596                 NULL, NULL, NULL, NULL }
 597 };
 598
 599 static ConfigOCs cf_ocs[] = {
 600         { "( OLcfgGlOc:1 "
 601                 "NAME 'olcConfig' "
 602                 "DESC 'OpenLDAP configuration object' "
 603                 "ABSTRACT SUP top )", Cft_Abstract, NULL },
 604         { "( OLcfgGlOc:2 "
 605                 "NAME 'olcGlobal' "
 606                 "DESC 'OpenLDAP Global configuration options' "
 607                 "SUP olcConfig STRUCTURAL "
 608                 "MAY ( cn $ olcConfigFile $ olcConfigDir $ olcAllows $ olcArgsFile $ "
 609                  "olcAttributeOptions $ olcAuthIDRewrite $ "
 610                  "olcAuthzPolicy $ olcAuthzRegexp $ olcConcurrency $ "
 611                  "olcConnMaxPending $ olcConnMaxPendingAuth $ olcDefaultSearchBase $ "
 612                  "olcDisallows $ olcGentleHUP $ olcIdleTimeout $ "
 613                  "olcIndexSubstrIfMaxLen $ olcIndexSubstrIfMinLen $ "
 614                  "olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcLocalSSF $ "
 615                  "olcLogLevel $ olcModulePath $ "
 616                  "olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ "
 617                  "olcPluginLogFile $ olcReadOnly $ olcReferral $ "
 618                  "olcReplicaPidFile $ olcReplicaArgsFile $ olcReplicationInterval $ "
 619                  "olcReplogFile $ olcRequires $ olcRestrict $ olcReverseLookup $ "
 620                  "olcRootDSE $ olcRootPW $ "
 621                  "olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ "
 622                  "olcSchemaCheck $ olcSecurity $ olcSizeLimit $ "
 623                  "olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcSrvtab $ "
 624                  "olcThreads $ olcTimeLimit $ olcTLSCACertificateFile $ "
 625                  "olcTLSCACertificatePath $ olcTLSCertificateFile $ "
 626                  "olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ "
 627                  "olcTLSRandFile $ olcTLSVerifyClient $ "
 628                  "olcObjectIdentifier $ olcAttributeTypes $ olcObjectClasses $ "
 629                  "olcDitContentRules ) )", Cft_Global, &cfOc_global },
 630         { "( OLcfgGlOc:3 "
 631                 "NAME 'olcSchemaConfig' "
 632                 "DESC 'OpenLDAP schema object' "
 633                 "SUP olcConfig STRUCTURAL "
 634                 "MAY ( cn $ olcObjectIdentifier $ olcAttributeTypes $ "
 635                  "olcObjectClasses $ olcDitContentRules ) )",
 636                         Cft_Schema, &cfOc_schema },
 637         { "( OLcfgGlOc:4 "
 638                 "NAME 'olcBackendConfig' "
 639                 "DESC 'OpenLDAP Backend-specific options' "
 640                 "SUP olcConfig STRUCTURAL "
 641                 "MUST olcBackend )", Cft_Backend, &cfOc_backend },
 642         { "( OLcfgGlOc:5 "
 643                 "NAME 'olcDatabaseConfig' "
 644                 "DESC 'OpenLDAP Database-specific options' "
 645                 "SUP olcConfig STRUCTURAL "
 646                 "MUST olcDatabase "
 647                 "MAY ( olcSuffix $ olcAccess $ olcLastMod $ olcLimits $ "
 648                  "olcMaxDerefDepth $ olcPlugin $ olcReadOnly $ olcReplica $ "
 649                  "olcReplogFile $ olcRequires $ olcRestrict $ olcRootDN $ olcRootPW $ "
 650                  "olcSchemaDN $ olcSecurity $ olcSizeLimit $ olcSyncrepl $ "
 651                  "olcTimeLimit $ olcUpdateDN $ olcUpdateRef ) )",
 652                         Cft_Database, &cfOc_database },
 653         { "( OLcfgGlOc:6 "
 654                 "NAME 'olcOverlayConfig' "
 655                 "DESC 'OpenLDAP Overlay-specific options' "
 656                 "SUP olcConfig STRUCTURAL "
 657                 "MUST olcOverlay )", Cft_Overlay, &cfOc_overlay },
 658         { "( OLcfgGlOc:7 "
 659                 "NAME 'olcIncludeFile' "
 660                 "DESC 'OpenLDAP configuration include file' "
 661                 "SUP olcConfig STRUCTURAL "
 662                 "MUST olcInclude "
 663                 "MAY ( cn $ olcRootDSE ) )",
 664                 Cft_Include, &cfOc_include },
 665 #ifdef SLAPD_MODULES
 666         { "( OLcfgGlOc:8 "
 667                 "NAME 'olcModuleList' "
 668                 "DESC 'OpenLDAP dynamic module info' "
 669                 "SUP olcConfig STRUCTURAL "
 670                 "MUST olcModuleLoad "
 671                 "MAY cn )", Cft_Module, &cfOc_module },
 672 #endif
 673         { NULL, 0, NULL }
 674 };
 675
 676 static int
 677 config_generic(ConfigArgs *c) {
 678         char *p;
 679         int i;
 680
 681         if ( c->op == SLAP_CONFIG_EMIT ) {
 682                 int rc = 0;
 683                 switch(c->type) {
 684                 case CFG_CONCUR:
 685                         c->value_int = ldap_pvt_thread_get_concurrency();
 686                         break;
 687                 case CFG_THREADS:
 688                         c->value_int = connection_pool_max;
 689                         break;
 690                 case CFG_SALT:
 691                         if ( passwd_salt )
 692                                 c->value_string = ch_strdup( passwd_salt );
 693                         else
 694                                 rc = 1;
 695                         break;
 696                 case CFG_LIMITS:
 697                         if ( c->be->be_limits ) {
 698                                 char buf[4096*3];
 699                                 struct berval bv;
 700                                 int i;
 701
 702                                 for ( i=0; c->be->be_limits[i]; i++ ) {
 703                                         bv.bv_len = sprintf( buf, IFMT, i );
 704                                         bv.bv_val = buf+bv.bv_len;
 705                                         limits_unparse( c->be->be_limits[i], &bv );
 706                                         bv.bv_len += bv.bv_val - buf;
 707                                         bv.bv_val = buf;
 708                                         value_add_one( &c->rvalue_vals, &bv );
 709                                 }
 710                         }
 711                         if ( !c->rvalue_vals ) rc = 1;
 712                         break;
 713                 case CFG_RO:
 714                         c->value_int = (c->be->be_restrictops & SLAP_RESTRICT_OP_WRITES) != 0;
 715                         break;
 716                 case CFG_AZPOLICY:
 717                         c->value_string = ch_strdup( slap_sasl_getpolicy());
 718                         break;
 719                 case CFG_AZREGEXP:
 720                         slap_sasl_regexp_unparse( &c->rvalue_vals );
 721                         if ( !c->rvalue_vals ) rc = 1;
 722                         break;
 723 #ifdef HAVE_CYRUS_SASL
 724                 case CFG_SASLSECP: {
 725                         struct berval bv = BER_BVNULL;
 726                         slap_sasl_secprops_unparse( &bv );
 727                         if ( !BER_BVISNULL( &bv )) {
 728                                 ber_bvarray_add( &c->rvalue_vals, &bv );
 729                         } else {
 730                                 rc = 1;
 731                         }
 732                         }
 733                         break;
 734 #endif
 735                 case CFG_DEPTH:
 736                         c->value_int = c->be->be_max_deref_depth;
 737                         break;
 738                 case CFG_OID: {
 739                         ConfigFile *cf = c->private;
 740                         if ( !cf )
 741                                 oidm_unparse( &c->rvalue_vals, NULL, NULL, 1 );
 742                         else if ( cf->c_om_head )
 743                                 oidm_unparse( &c->rvalue_vals, cf->c_om_head,
 744                                         cf->c_om_tail, 0 );
 745                         if ( !c->rvalue_vals )
 746                                 rc = 1;
 747                         }
 748                         break;
 749                 case CFG_OC: {
 750                         ConfigFile *cf = c->private;
 751                         if ( !cf )
 752                                 oc_unparse( &c->rvalue_vals, NULL, NULL, 1 );
 753                         else if ( cf->c_oc_head )
 754                                 oc_unparse( &c->rvalue_vals, cf->c_oc_head,
 755                                         cf->c_oc_tail, 0 );
 756                         if ( !c->rvalue_vals )
 757                                 rc = 1;
 758                         }
 759                         break;
 760                 case CFG_ATTR: {
 761                         ConfigFile *cf = c->private;
 762                         if ( !cf )
 763                                 at_unparse( &c->rvalue_vals, NULL, NULL, 1 );
 764                         else if ( cf->c_at_head )
 765                                 at_unparse( &c->rvalue_vals, cf->c_at_head,
 766                                         cf->c_at_tail, 0 );
 767                         if ( !c->rvalue_vals )
 768                                 rc = 1;
 769                         }
 770                         break;
 771                 case CFG_DIT: {
 772                         ConfigFile *cf = c->private;
 773                         if ( !cf )
 774                                 cr_unparse( &c->rvalue_vals, NULL, NULL, 1 );
 775                         else if ( cf->c_cr_head )
 776                                 cr_unparse( &c->rvalue_vals, cf->c_cr_head,
 777                                         cf->c_cr_tail, 0 );
 778                         if ( !c->rvalue_vals )
 779                                 rc = 1;
 780                         }
 781                         break;
 782
 783                 case CFG_CHECK:
 784                         c->value_int = global_schemacheck;
 785                         break;
 786                 case CFG_ACL: {
 787                         AccessControl *a;
 788                         char *src, *dst, ibuf[11];
 789                         struct berval bv, abv;
 790                         for (i=0, a=c->be->be_acl; a; i++,a=a->acl_next) {
 791                                 abv.bv_len = sprintf( ibuf, IFMT, i );
 792                                 acl_unparse( a, &bv );
 793                                 abv.bv_val = ch_malloc( abv.bv_len + bv.bv_len + 1 );
 794                                 AC_MEMCPY( abv.bv_val, ibuf, abv.bv_len );
 795                                 /* Turn TAB / EOL into plain space */
 796                                 for (src=bv.bv_val,dst=abv.bv_val+abv.bv_len; *src; src++) {
 797                                         if (isspace(*src)) *dst++ = ' ';
 798                                         else *dst++ = *src;
 799                                 }
 800                                 *dst = '\0';
 801                                 if (dst[-1] == ' ') {
 802                                         dst--;
 803                                         *dst = '\0';
 804                                 }
 805                                 abv.bv_len = dst - abv.bv_val;
 806                                 ber_bvarray_add( &c->rvalue_vals, &abv );
 807                         }
 808                         rc = (!i);
 809                         break;
 810                 }
 811                 case CFG_REPLOG:
 812                         if ( c->be->be_replogfile )
 813                                 c->value_string = ch_strdup( c->be->be_replogfile );
 814                         break;
 815                 case CFG_ROOTDSE: {
 816                         ConfigFile *cf = c->private;
 817                         if ( cf->c_dseFiles ) {
 818                                 value_add( &c->rvalue_vals, cf->c_dseFiles );
 819                         } else {
 820                                 rc = 1;
 821                         }
 822                         }
 823                         break;
 824                 case CFG_LOGFILE:
 825                         if ( logfileName )
 826                                 c->value_string = ch_strdup( logfileName );
 827                         else
 828                                 rc = 1;
 829                         break;
 830                 case CFG_LASTMOD:
 831                         c->value_int = (SLAP_NOLASTMOD(c->be) == 0);
 832                         break;
 833                 case CFG_SSTR_IF_MAX:
 834                         c->value_int = index_substr_if_maxlen;
 835                         break;
 836                 case CFG_SSTR_IF_MIN:
 837                         c->value_int = index_substr_if_minlen;
 838                         break;
 839 #ifdef SLAPD_MODULES
 840                 case CFG_MODLOAD: {
 841                         ModPaths *mp = c->private;
 842                         if (mp->mp_loads) {
 843                                 int i;
 844                                 for (i=0; !BER_BVISNULL(&mp->mp_loads[i]); i++) {
 845                                         struct berval bv;
 846                                         bv.bv_val = c->log;
 847                                         bv.bv_len = sprintf( bv.bv_val, IFMT "%s", i,
 848                                                 mp->mp_loads[i].bv_val );
 849                                         value_add_one( &c->rvalue_vals, &bv );
 850                                 }
 851                         }
 852
 853                         rc = c->rvalue_vals ? 0 : 1;
 854                         }
 855                         break;
 856                 case CFG_MODPATH: {
 857                         ModPaths *mp;
 858                         for (i=0, mp=&modpaths; mp; mp=mp->mp_next, i++) {
 859                                 struct berval bv;
 860                                 if ( BER_BVISNULL( &mp->mp_path ) && !mp->mp_loads )
 861                                         continue;
 862                                 bv.bv_val = c->log;
 863                                 bv.bv_len = sprintf( bv.bv_val, IFMT "%s", i,
 864                                         mp->mp_path.bv_val );
 865                                 value_add_one( &c->rvalue_vals, &bv );
 866                         }
 867                         rc = c->rvalue_vals ? 0 : 1;
 868                         }
 869                         break;
 870 #endif
 871 #ifdef LDAP_SLAPI
 872                 case CFG_PLUGIN:
 873                         slapi_int_plugin_unparse( c->be, &c->rvalue_vals );
 874                         if ( !c->rvalue_vals ) rc = 1;
 875                         break;
 876 #endif
 877 #ifdef SLAP_AUTH_REWRITE
 878                 case CFG_REWRITE:
 879                         if ( authz_rewrites ) {
 880                                 struct berval bv, idx;
 881                                 char ibuf[32];
 882                                 int i;
 883
 884                                 idx.bv_val = ibuf;
 885                                 for ( i=0; !BER_BVISNULL( &authz_rewrites[i] ); i++ ) {
 886                                         idx.bv_len = sprintf( idx.bv_val, IFMT, i );
 887                                         bv.bv_len = idx.bv_len + authz_rewrites[i].bv_len;
 888                                         bv.bv_val = ch_malloc( bv.bv_len + 1 );
 889                                         strcpy( bv.bv_val, idx.bv_val );
 890                                         strcpy( bv.bv_val+idx.bv_len, authz_rewrites[i].bv_val );
 891                                         ber_bvarray_add( &c->rvalue_vals, &bv );
 892                                 }
 893                         }
 894                         if ( !c->rvalue_vals ) rc = 1;
 895                         break;
 896 #endif
 897                 default:
 898                         rc = 1;
 899                 }
 900                 return rc;
 901         } else if ( c->op == LDAP_MOD_DELETE ) {
 902                 int rc = 0;
 903                 switch(c->type) {
 904                 /* single-valued attrs, no-ops */
 905                 case CFG_CONCUR:
 906                 case CFG_THREADS:
 907                 case CFG_RO:
 908                 case CFG_AZPOLICY:
 909                 case CFG_DEPTH:
 910                 case CFG_CHECK:
 911                 case CFG_LASTMOD:
 912                 case CFG_SSTR_IF_MAX:
 913                 case CFG_SSTR_IF_MIN:
 914                         break;
 915
 916                 case CFG_SALT:
 917                         ch_free( passwd_salt );
 918                         passwd_salt = NULL;
 919                         break;
 920
 921                 case CFG_REPLOG:
 922                         ch_free( c->be->be_replogfile );
 923                         c->be->be_replogfile = NULL;
 924                         break;
 925
 926                 case CFG_LOGFILE:
 927                         ch_free( logfileName );
 928                         logfileName = NULL;
 929                         break;
 930
 931                 case CFG_ACL:
 932                         if ( c->valx < 0 ) {
 933                                 AccessControl *end;
 934                                 if ( c->be == frontendDB )
 935                                         end = NULL;
 936                                 else
 937                                         end = frontendDB->be_acl;
 938                                 acl_destroy( c->be->be_acl, end );
 939                         } else {
 940                                 AccessControl **prev, *a;
 941                                 int i;
 942                                 for (i=0, prev = &c->be->be_acl; i < c->valx;
 943                                         i++ ) {
 944                                         a = *prev;
 945                                         prev = &a->acl_next;
 946                                 }
 947                                 a = *prev;
 948                                 *prev = a->acl_next;
 949                                 acl_free( a );
 950                         }
 951                         break;
 952                 default:
 953                         rc = 1;
 954                         break;
 955                 }
 956                 return rc;
 957         }
 958
 959         p = strchr(c->line,'(' /*')'*/);
 960
 961         switch(c->type) {
 962                 case CFG_BACKEND:
 963                         if(!(c->bi = backend_info(c->argv[1]))) {
 964                                 Debug(LDAP_DEBUG_ANY, "%s: "
 965                                         "backend %s failed init!\n", c->log, c->argv[1], 0);
 966                                 return(1);
 967                         }
 968                         break;
 969
 970                 case CFG_DATABASE:
 971                         c->bi = NULL;
 972                         /* NOTE: config is always the first backend!
 973                          */
 974                         if ( !strcasecmp( c->argv[1], "config" )) {
 975                                 c->be = LDAP_STAILQ_FIRST(&backendDB);
 976                         } else if ( !strcasecmp( c->argv[1], "frontend" )) {
 977                                 c->be = frontendDB;
 978                         } else if(!(c->be = backend_db_init(c->argv[1]))) {
 979                                 Debug(LDAP_DEBUG_ANY, "%s: "
 980                                         "database %s failed init!\n", c->log, c->argv[1], 0);
 981                                 return(1);
 982                         }
 983                         break;
 984
 985                 case CFG_CONCUR:
 986                         ldap_pvt_thread_set_concurrency(c->value_int);
 987                         break;
 988
 989                 case CFG_THREADS:
 990                         ldap_pvt_thread_pool_maxthreads(&connection_pool, c->value_int);
 991                         connection_pool_max = c->value_int;     /* save for reference */
 992                         break;
 993
 994                 case CFG_SALT:
 995                         if ( passwd_salt ) ch_free( passwd_salt );
 996                         passwd_salt = c->value_string;
 997                         lutil_salt_format(passwd_salt);
 998                         break;
 999
1000                 case CFG_LIMITS:
1001                         if(limits_parse(c->be, c->fname, c->lineno, c->argc, c->argv))
1002                                 return(1);
1003                         break;
1004
1005                 case CFG_RO:
1006                         if(c->value_int)
1007                                 c->be->be_restrictops |= SLAP_RESTRICT_OP_WRITES;
1008                         else
1009                                 c->be->be_restrictops &= ~SLAP_RESTRICT_OP_WRITES;
1010                         break;
1011
1012                 case CFG_AZPOLICY:
1013                         ch_free(c->value_string);
1014                         if (slap_sasl_setpolicy( c->argv[1] )) {
1015                                 Debug(LDAP_DEBUG_ANY, "%s: unable to parse value \"%s\" in"
1016                                         " \"authz-policy <policy>\"\n",
1017                                         c->log, c->argv[1], 0 );
1018                                 return(1);
1019                         }
1020                         break;
1021
1022                 case CFG_AZREGEXP:
1023                         if (slap_sasl_regexp_config( c->argv[1], c->argv[2] ))
1024                                 return(1);
1025                         break;
1026
1027 #ifdef HAVE_CYRUS_SASL
1028                 case CFG_SASLSECP:
1029                         {
1030                         char *txt = slap_sasl_secprops( c->argv[1] );
1031                         if ( txt ) {
1032                                 Debug(LDAP_DEBUG_ANY, "%s: sasl-secprops: %s\n",
1033                                         c->log, txt, 0 );
1034                                 return(1);
1035                         }
1036                         break;
1037                         }
1038 #endif
1039
1040                 case CFG_DEPTH:
1041                         c->be->be_max_deref_depth = c->value_int;
1042                         break;
1043
1044                 case CFG_OID: {
1045                         OidMacro *om;
1046
1047                         if(parse_oidm(c->fname, c->lineno, c->argc, c->argv, 1, &om))
1048                                 return(1);
1049                         if (!cfn->c_om_head) cfn->c_om_head = om;
1050                         cfn->c_om_tail = om;
1051                         }
1052                         break;
1053
1054                 case CFG_OC: {
1055                         ObjectClass *oc;
1056
1057                         if(parse_oc(c->fname, c->lineno, p, c->argv, &oc)) return(1);
1058                         if (!cfn->c_oc_head) cfn->c_oc_head = oc;
1059                         cfn->c_oc_tail = oc;
1060                         }
1061                         break;
1062
1063                 case CFG_DIT: {
1064                         ContentRule *cr;
1065
1066                         if(parse_cr(c->fname, c->lineno, p, c->argv, &cr)) return(1);
1067                         if (!cfn->c_cr_head) cfn->c_cr_head = cr;
1068                         cfn->c_cr_tail = cr;
1069                         }
1070                         break;
1071
1072                 case CFG_ATTR: {
1073                         AttributeType *at;
1074
1075                         if(parse_at(c->fname, c->lineno, p, c->argv, &at)) return(1);
1076                         if (!cfn->c_at_head) cfn->c_at_head = at;
1077                         cfn->c_at_tail = at;
1078                         }
1079                         break;
1080
1081                 case CFG_ATOPT:
1082                         ad_define_option(NULL, NULL, 0);
1083                         for(i = 1; i < c->argc; i++)
1084                                 if(ad_define_option(c->argv[i], c->fname, c->lineno))
1085                                         return(1);
1086                         break;
1087
1088                 case CFG_CHECK:
1089                         global_schemacheck = c->value_int;
1090                         if(!global_schemacheck) Debug(LDAP_DEBUG_ANY, "%s: "
1091                                 "schema checking disabled! your mileage may vary!\n",
1092                                 c->log, 0, 0);
1093                         break;
1094
1095                 case CFG_ACL:
1096                         parse_acl(c->be, c->fname, c->lineno, c->argc, c->argv, c->valx);
1097                         break;
1098
1099                 case CFG_REPLOG:
1100                         if(SLAP_MONITOR(c->be)) {
1101                                 Debug(LDAP_DEBUG_ANY, "%s: "
1102                                         "\"replogfile\" should not be used "
1103                                         "inside monitor database\n",
1104                                         c->log, 0, 0);
1105                                 return(0);      /* FIXME: should this be an error? */
1106                         }
1107
1108                         c->be->be_replogfile = c->value_string;
1109                         break;
1110
1111                 case CFG_ROOTDSE:
1112                         if(read_root_dse_file(c->argv[1])) {
1113                                 Debug(LDAP_DEBUG_ANY, "%s: "
1114                                         "could not read \"rootDSE <filename>\" line\n",
1115                                         c->log, 0, 0);
1116                                 return(1);
1117                         }
1118                         {
1119                                 struct berval bv;
1120                                 ber_str2bv( c->argv[1], 0, 1, &bv );
1121                                 ber_bvarray_add( &cfn->c_dseFiles, &bv );
1122                         }
1123                         break;
1124
1125                 case CFG_LOGFILE: {
1126                                 FILE *logfile;
1127                                 if ( logfileName ) ch_free( logfileName );
1128                                 logfileName = c->value_string;
1129                                 logfile = fopen(logfileName, "w");
1130                                 if(logfile) lutil_debug_file(logfile);
1131                         } break;
1132
1133                 case CFG_LASTMOD:
1134                         if(SLAP_NOLASTMODCMD(c->be)) {
1135                                 Debug(LDAP_DEBUG_ANY, "%s: "
1136                                         "lastmod not available for %s databases\n",
1137                                         c->log, c->be->bd_info->bi_type, 0);
1138                                 return(1);
1139                         }
1140                         if(c->value_int)
1141                                 SLAP_DBFLAGS(c->be) &= ~SLAP_DBFLAG_NOLASTMOD;
1142                         else
1143                                 SLAP_DBFLAGS(c->be) |= SLAP_DBFLAG_NOLASTMOD;
1144                         break;
1145
1146                 case CFG_SSTR_IF_MAX:
1147                         if (c->value_int < index_substr_if_minlen) {
1148                                 Debug(LDAP_DEBUG_ANY, "%s: "
1149                                         "invalid max value (%d)\n",
1150                                         c->log, c->value_int, 0 );
1151                                 return(1);
1152                         }
1153                         index_substr_if_maxlen = c->value_int;
1154                         break;
1155
1156                 case CFG_SSTR_IF_MIN:
1157                         if (c->value_int > index_substr_if_maxlen) {
1158                                 Debug(LDAP_DEBUG_ANY, "%s: "
1159                                         "invalid min value (%d)\n",
1160                                         c->log, c->value_int, 0 );
1161                                 return(1);
1162                         }
1163                         index_substr_if_minlen = c->value_int;
1164                         break;
1165
1166 #ifdef SLAPD_MODULES
1167                 case CFG_MODLOAD:
1168                         if(module_load(c->argv[1], c->argc - 2, (c->argc > 2) ? c->argv + 2 : NULL))
1169                                 return(1);
1170                         /* Record this load on the current path */
1171                         {
1172                                 struct berval bv;
1173                                 char *ptr = c->line + STRLENOF("moduleload");
1174                                 while (!isspace(*ptr)) ptr++;
1175                                 while (isspace(*ptr)) ptr++;
1176                                 ber_str2bv(ptr, 0, 1, &bv);
1177                                 ber_bvarray_add( &modcur->mp_loads, &bv );
1178                         }
1179                         break;
1180
1181                 case CFG_MODPATH:
1182                         if(module_path(c->argv[1])) return(1);
1183                         /* Record which path was used with each module */
1184                         {
1185                                 ModPaths *mp;
1186
1187                                 if (!modpaths.mp_loads) {
1188                                         mp = &modpaths;
1189                                 } else {
1190                                         mp = ch_malloc( sizeof( ModPaths ));
1191                                         modlast->mp_next = mp;
1192                                 }
1193                                 ber_str2bv(c->argv[1], 0, 1, &mp->mp_path);
1194                                 mp->mp_next = NULL;
1195                                 mp->mp_loads = NULL;
1196                                 modlast = mp;
1197                                 if ( c->op == SLAP_CONFIG_ADD )
1198                                         modcur = mp;
1199                         }
1200
1201                         break;
1202 #endif
1203
1204 #ifdef LDAP_SLAPI
1205                 case CFG_PLUGIN:
1206                         if(slapi_int_read_config(c->be, c->fname, c->lineno, c->argc, c->argv) != LDAP_SUCCESS)
1207                                 return(1);
1208                         slapi_plugins_used++;
1209                         break;
1210 #endif
1211
1212 #ifdef SLAP_AUTH_REWRITE
1213                 case CFG_REWRITE: {
1214                         struct berval bv;
1215                         if(slap_sasl_rewrite_config(c->fname, c->lineno, c->argc, c->argv))
1216                                 return(1);
1217                         ber_str2bv( c->line, 0, 1, &bv );
1218                         ber_bvarray_add( &authz_rewrites, &bv );
1219                         }
1220                         break;
1221 #endif
1222
1223
1224                 default:
1225                         Debug(LDAP_DEBUG_ANY, "%s: unknown CFG_TYPE %d"
1226                                 "(ignored)\n", c->log, c->type, 0);
1227
1228         }
1229         return(0);
1230 }
1231
1232
1233 static int
1234 config_fname(ConfigArgs *c) {
1235         if(c->op == SLAP_CONFIG_EMIT) {
1236                 if (c->private) {
1237                         ConfigFile *cf = c->private;
1238                         value_add_one( &c->rvalue_vals, &cf->c_file );
1239                         return 0;
1240                 }
1241                 return 1;
1242         }
1243         return(0);
1244 }
1245
1246 static int
1247 config_cfdir(ConfigArgs *c) {
1248         if(c->op == SLAP_CONFIG_EMIT) {
1249                 value_add_one( &c->rvalue_vals, &cfdir );
1250                 return 0;
1251         }
1252         return(0);
1253 }
1254
1255 static int
1256 config_search_base(ConfigArgs *c) {
1257         struct berval dn;
1258
1259         if(c->op == SLAP_CONFIG_EMIT) {
1260                 int rc = 1;
1261                 if (!BER_BVISEMPTY(&default_search_base)) {
1262                         value_add_one(&c->rvalue_vals, &default_search_base);
1263                         value_add_one(&c->rvalue_nvals, &default_search_nbase);
1264                         rc = 0;
1265                 }
1266                 return rc;
1267         } else if( c->op == LDAP_MOD_DELETE ) {
1268                 ch_free( default_search_base.bv_val );
1269                 ch_free( default_search_nbase.bv_val );
1270                 BER_BVZERO( &default_search_base );
1271                 BER_BVZERO( &default_search_nbase );
1272                 return 0;
1273         }
1274
1275         if(c->bi || c->be != frontendDB) {
1276                 Debug(LDAP_DEBUG_ANY, "%s: defaultSearchBase line must appear "
1277                         "prior to any backend or database definition\n",
1278                         c->log, 0, 0);
1279                 return(1);
1280         }
1281
1282         if(default_search_nbase.bv_len) {
1283                 Debug(LDAP_DEBUG_ANY, "%s: "
1284                         "default search base \"%s\" already defined "
1285                         "(discarding old)\n",
1286                         c->log, default_search_base.bv_val, 0);
1287                 free(default_search_base.bv_val);
1288                 free(default_search_nbase.bv_val);
1289         }
1290
1291         default_search_base = c->value_dn;
1292         default_search_nbase = c->value_ndn;
1293         return(0);
1294 }
1295
1296 static int
1297 config_passwd_hash(ConfigArgs *c) {
1298         int i;
1299         if (c->op == SLAP_CONFIG_EMIT) {
1300                 struct berval bv;
1301                 for (i=0; default_passwd_hash && default_passwd_hash[i]; i++) {
1302                         ber_str2bv(default_passwd_hash[i], 0, 0, &bv);
1303                         value_add_one(&c->rvalue_vals, &bv);
1304                 }
1305                 return i ? 0 : 1;
1306         } else if ( c->op == LDAP_MOD_DELETE ) {
1307                 if ( c->valx < 0 ) {
1308                         ldap_charray_free( default_passwd_hash );
1309                         default_passwd_hash = NULL;
1310                 } else {
1311                         i = c->valx;
1312                         ch_free( default_passwd_hash[i] );
1313                         for (; default_passwd_hash[i]; i++ )
1314                                 default_passwd_hash[i] = default_passwd_hash[i+1];
1315                 }
1316                 return 0;
1317         }
1318         if(default_passwd_hash) {
1319                 Debug(LDAP_DEBUG_ANY, "%s: "
1320                         "already set default password_hash\n",
1321                         c->log, 0, 0);
1322                 return(1);
1323         }
1324         for(i = 1; i < c->argc; i++) {
1325                 if(!lutil_passwd_scheme(c->argv[i])) {
1326                         Debug(LDAP_DEBUG_ANY, "%s: "
1327                                 "password scheme \"%s\" not available\n",
1328                                 c->log, c->argv[i], 0);
1329                 } else {
1330                         ldap_charray_add(&default_passwd_hash, c->argv[i]);
1331                 }
1332                 if(!default_passwd_hash) {
1333                         Debug(LDAP_DEBUG_ANY, "%s: no valid hashes found\n",
1334                                 c->log, 0, 0 );
1335                         return(1);
1336                 }
1337         }
1338         return(0);
1339 }
1340
1341 static int
1342 config_schema_dn(ConfigArgs *c) {
1343         if ( c->op == SLAP_CONFIG_EMIT ) {
1344                 int rc = 1;
1345                 if ( !BER_BVISEMPTY( &c->be->be_schemadn )) {
1346                         value_add_one(&c->rvalue_vals, &c->be->be_schemadn);
1347                         value_add_one(&c->rvalue_nvals, &c->be->be_schemandn);
1348                         rc = 0;
1349                 }
1350                 return rc;
1351         } else if ( c->op == LDAP_MOD_DELETE ) {
1352                 ch_free( c->be->be_schemadn.bv_val );
1353                 ch_free( c->be->be_schemandn.bv_val );
1354                 BER_BVZERO( &c->be->be_schemadn );
1355                 BER_BVZERO( &c->be->be_schemandn );
1356                 return 0;
1357         }
1358         ch_free( c->be->be_schemadn.bv_val );
1359         ch_free( c->be->be_schemandn.bv_val );
1360         c->be->be_schemadn = c->value_dn;
1361         c->be->be_schemandn = c->value_ndn;
1362         return(0);
1363 }
1364
1365 static int
1366 config_sizelimit(ConfigArgs *c) {
1367         int i, rc = 0;
1368         char *next;
1369         struct slap_limits_set *lim = &c->be->be_def_limit;
1370         if (c->op == SLAP_CONFIG_EMIT) {
1371                 char buf[8192];
1372                 struct berval bv;
1373                 bv.bv_val = buf;
1374                 bv.bv_len = 0;
1375                 limits_unparse_one( lim, SLAP_LIMIT_SIZE, &bv );
1376                 if ( !BER_BVISEMPTY( &bv ))
1377                         value_add_one( &c->rvalue_vals, &bv );
1378                 else
1379                         rc = 1;
1380                 return rc;
1381         } else if ( c->op == LDAP_MOD_DELETE ) {
1382                 /* Reset to defaults */
1383                 lim->lms_s_soft = SLAPD_DEFAULT_SIZELIMIT;
1384                 lim->lms_s_hard = 0;
1385                 lim->lms_s_unchecked = -1;
1386                 lim->lms_s_pr = 0;
1387                 lim->lms_s_pr_hide = 0;
1388                 lim->lms_s_pr_total = 0;
1389                 return 0;
1390         }
1391         for(i = 1; i < c->argc; i++) {
1392                 if(!strncasecmp(c->argv[i], "size", 4)) {
1393                         rc = limits_parse_one(c->argv[i], lim);
1394                         if ( rc ) {
1395                                 Debug(LDAP_DEBUG_ANY, "%s: "
1396                                         "unable to parse value \"%s\" in \"sizelimit <limit>\" line\n",
1397                                         c->log, c->argv[i], 0);
1398                                 return(1);
1399                         }
1400                 } else {
1401                         if(!strcasecmp(c->argv[i], "unlimited")) {
1402                                 lim->lms_s_soft = -1;
1403                         } else {
1404                                 lim->lms_s_soft = strtol(c->argv[i], &next, 0);
1405                                 if(next == c->argv[i]) {
1406                                         Debug(LDAP_DEBUG_ANY, "%s: "
1407                                                 "unable to parse limit \"%s\" in \"sizelimit <limit>\" line\n",
1408                                                 c->log, c->argv[i], 0);
1409                                         return(1);
1410                                 } else if(next[0] != '\0') {
1411                                         Debug(LDAP_DEBUG_ANY, "%s: "
1412                                                 "trailing chars \"%s\" in \"sizelimit <limit>\" line (ignored)\n",
1413                                                 c->log, next, 0);
1414                                 }
1415                         }
1416                         lim->lms_s_hard = 0;
1417                 }
1418         }
1419         return(0);
1420 }
1421
1422 static int
1423 config_timelimit(ConfigArgs *c) {
1424         int i, rc = 0;
1425         char *next;
1426         struct slap_limits_set *lim = &c->be->be_def_limit;
1427         if (c->op == SLAP_CONFIG_EMIT) {
1428                 char buf[8192];
1429                 struct berval bv;
1430                 bv.bv_val = buf;
1431                 bv.bv_len = 0;
1432                 limits_unparse_one( lim, SLAP_LIMIT_TIME, &bv );
1433                 if ( !BER_BVISEMPTY( &bv ))
1434                         value_add_one( &c->rvalue_vals, &bv );
1435                 else
1436                         rc = 1;
1437                 return rc;
1438         } else if ( c->op == LDAP_MOD_DELETE ) {
1439                 /* Reset to defaults */
1440                 lim->lms_t_soft = SLAPD_DEFAULT_TIMELIMIT;
1441                 lim->lms_t_hard = 0;
1442                 return 0;
1443         }
1444         for(i = 1; i < c->argc; i++) {
1445                 if(!strncasecmp(c->argv[i], "time", 4)) {
1446                         rc = limits_parse_one(c->argv[i], lim);
1447                         if ( rc ) {
1448                                 Debug(LDAP_DEBUG_ANY, "%s: "
1449                                         "unable to parse value \"%s\" in \"timelimit <limit>\" line\n",
1450                                         c->log, c->argv[i], 0);
1451                                 return(1);
1452                         }
1453                 } else {
1454                         if(!strcasecmp(c->argv[i], "unlimited")) {
1455                                 lim->lms_t_soft = -1;
1456                         } else {
1457                                 lim->lms_t_soft = strtol(c->argv[i], &next, 0);
1458                                 if(next == c->argv[i]) {
1459                                         Debug(LDAP_DEBUG_ANY, "%s: "
1460                                                 "unable to parse limit \"%s\" in \"timelimit <limit>\" line\n",
1461                                                 c->log, c->argv[i], 0);
1462                                         return(1);
1463                                 } else if(next[0] != '\0') {
1464                                         Debug(LDAP_DEBUG_ANY, "%s: "
1465                                                 "trailing chars \"%s\" in \"timelimit <limit>\" line (ignored)\n",
1466                                                 c->log, next, 0);
1467                                 }
1468                         }
1469                         lim->lms_t_hard = 0;
1470                 }
1471         }
1472         return(0);
1473 }
1474
1475 static int
1476 config_overlay(ConfigArgs *c) {
1477         if (c->op == SLAP_CONFIG_EMIT) {
1478                 return 1;
1479         } else if ( c->op == LDAP_MOD_DELETE ) {
1480                 assert(0);
1481         }
1482         if(c->argv[1][0] == '-' && overlay_config(c->be, &c->argv[1][1])) {
1483                 /* log error */
1484                 Debug(LDAP_DEBUG_ANY, "%s: (optional) %s overlay \"%s\" configuration failed (ignored)\n",
1485                         c->log, c->be == frontendDB ? "global " : "", c->argv[1][1]);
1486         } else if(overlay_config(c->be, c->argv[1])) {
1487                 return(1);
1488         }
1489         return(0);
1490 }
1491
1492 static int
1493 config_suffix(ConfigArgs *c) {
1494         Backend *tbe;
1495         struct berval pdn, ndn;
1496         int rc;
1497
1498         if (c->be == frontendDB || SLAP_MONITOR(c->be) ||
1499                 SLAP_CONFIG(c->be)) return 1;
1500
1501         if (c->op == SLAP_CONFIG_EMIT) {
1502                 if ( c->be->be_suffix == NULL
1503                                 || BER_BVISNULL( &c->be->be_suffix[0] ) )
1504                 {
1505                         return 1;
1506                 } else {
1507                         value_add( &c->rvalue_vals, c->be->be_suffix );
1508                         value_add( &c->rvalue_nvals, c->be->be_nsuffix );
1509                         return 0;
1510                 }
1511         } else if ( c->op == LDAP_MOD_DELETE ) {
1512                 if ( c->valx < 0 ) {
1513                         ber_bvarray_free( c->be->be_suffix );
1514                         ber_bvarray_free( c->be->be_nsuffix );
1515                         c->be->be_suffix = NULL;
1516                         c->be->be_nsuffix = NULL;
1517                 } else {
1518                         int i = c->valx;
1519                         ch_free( c->be->be_suffix[i].bv_val );
1520                         ch_free( c->be->be_nsuffix[i].bv_val );
1521                         for (; c->be->be_suffix[i].bv_val; i++) {
1522                                 c->be->be_suffix[i] = c->be->be_suffix[i+1];
1523                                 c->be->be_nsuffix[i] = c->be->be_nsuffix[i+1];
1524                         }
1525                 }
1526                 return 0;
1527         }
1528 #ifdef SLAPD_MONITOR_DN
1529         if(!strcasecmp(c->argv[1], SLAPD_MONITOR_DN)) {
1530                 Debug(LDAP_DEBUG_ANY, "%s: "
1531                         "\"%s\" is reserved for monitoring slapd\n",
1532                         c->log, SLAPD_MONITOR_DN, 0);
1533                 return(1);
1534         }
1535 #endif
1536
1537         pdn = c->value_dn;
1538         ndn = c->value_ndn;
1539         tbe = select_backend(&ndn, 0, 0);
1540         if(tbe == c->be) {
1541                 Debug(LDAP_DEBUG_ANY, "%s: suffix already served by this backend! (ignored)\n",
1542                         c->log, 0, 0);
1543                 free(pdn.bv_val);
1544                 free(ndn.bv_val);
1545         } else if(tbe) {
1546                 Debug(LDAP_DEBUG_ANY, "%s: suffix already served by a preceding backend \"%s\"\n",
1547                         c->log, tbe->be_suffix[0].bv_val, 0);
1548                 free(pdn.bv_val);
1549                 free(ndn.bv_val);
1550                 return(1);
1551         } else if(pdn.bv_len == 0 && default_search_nbase.bv_len) {
1552                 Debug(LDAP_DEBUG_ANY, "%s: suffix DN empty and default search "
1553                         "base provided \"%s\" (assuming okay)\n",
1554                         c->log, default_search_base.bv_val, 0);
1555         }
1556         ber_bvarray_add(&c->be->be_suffix, &pdn);
1557         ber_bvarray_add(&c->be->be_nsuffix, &ndn);
1558         return(0);
1559 }
1560
1561 static int
1562 config_rootdn(ConfigArgs *c) {
1563         if (c->op == SLAP_CONFIG_EMIT) {
1564                 if ( !BER_BVISNULL( &c->be->be_rootdn )) {
1565                         value_add_one(&c->rvalue_vals, &c->be->be_rootdn);
1566                         value_add_one(&c->rvalue_nvals, &c->be->be_rootndn);
1567                         return 0;
1568                 } else {
1569                         return 1;
1570                 }
1571         } else if ( c->op == LDAP_MOD_DELETE ) {
1572                 ch_free( c->be->be_rootdn.bv_val );
1573                 ch_free( c->be->be_rootndn.bv_val );
1574                 BER_BVZERO( &c->be->be_rootdn );
1575                 BER_BVZERO( &c->be->be_rootndn );
1576                 return 0;
1577         }
1578         if ( !BER_BVISNULL( &c->be->be_rootdn )) {
1579                 ch_free( c->be->be_rootdn.bv_val );
1580                 ch_free( c->be->be_rootndn.bv_val );
1581         }
1582         c->be->be_rootdn = c->value_dn;
1583         c->be->be_rootndn = c->value_ndn;
1584         return(0);
1585 }
1586
1587 static int
1588 config_rootpw(ConfigArgs *c) {
1589         Backend *tbe;
1590         if (c->op == SLAP_CONFIG_EMIT) {
1591                 if (!BER_BVISEMPTY(&c->be->be_rootpw)) {
1592                         ber_dupbv( &c->value_bv, &c->be->be_rootpw);
1593                         return 0;
1594                 }
1595                 return 1;
1596         } else if ( c->op == LDAP_MOD_DELETE ) {
1597                 ch_free( c->be->be_rootpw.bv_val );
1598                 BER_BVZERO( &c->be->be_rootpw );
1599                 return 0;
1600         }
1601
1602         tbe = select_backend(&c->be->be_rootndn, 0, 0);
1603         if(tbe != c->be) {
1604                 Debug(LDAP_DEBUG_ANY, "%s: "
1605                         "rootpw can only be set when rootdn is under suffix\n",
1606                         c->log, 0, 0);
1607                 return(1);
1608         }
1609         if ( !BER_BVISNULL( &c->be->be_rootpw ))
1610                 ch_free( c->be->be_rootpw.bv_val );
1611         c->be->be_rootpw = c->value_bv;
1612         return(0);
1613 }
1614
1615 static int
1616 config_restrict(ConfigArgs *c) {
1617         slap_mask_t restrictops = 0;
1618         int i;
1619         slap_verbmasks restrictable_ops[] = {
1620                 { BER_BVC("bind"),              SLAP_RESTRICT_OP_BIND },
1621                 { BER_BVC("add"),               SLAP_RESTRICT_OP_ADD },
1622                 { BER_BVC("modify"),            SLAP_RESTRICT_OP_MODIFY },
1623                 { BER_BVC("rename"),            SLAP_RESTRICT_OP_RENAME },
1624                 { BER_BVC("modrdn"),            0 },
1625                 { BER_BVC("delete"),            SLAP_RESTRICT_OP_DELETE },
1626                 { BER_BVC("search"),            SLAP_RESTRICT_OP_SEARCH },
1627                 { BER_BVC("compare"),   SLAP_RESTRICT_OP_COMPARE },
1628                 { BER_BVC("read"),              SLAP_RESTRICT_OP_READS },
1629                 { BER_BVC("write"),             SLAP_RESTRICT_OP_WRITES },
1630                 { BER_BVC("extended"),  SLAP_RESTRICT_OP_EXTENDED },
1631                 { BER_BVC("extended=" LDAP_EXOP_START_TLS ),            SLAP_RESTRICT_EXOP_START_TLS },
1632                 { BER_BVC("extended=" LDAP_EXOP_MODIFY_PASSWD ),        SLAP_RESTRICT_EXOP_MODIFY_PASSWD },
1633                 { BER_BVC("extended=" LDAP_EXOP_X_WHO_AM_I ),           SLAP_RESTRICT_EXOP_WHOAMI },
1634                 { BER_BVC("extended=" LDAP_EXOP_X_CANCEL ),             SLAP_RESTRICT_EXOP_CANCEL },
1635                 { BER_BVNULL,   0 }
1636         };
1637
1638         if (c->op == SLAP_CONFIG_EMIT) {
1639                 return mask_to_verbs( restrictable_ops, c->be->be_restrictops,
1640                         &c->rvalue_vals );
1641         } else if ( c->op == LDAP_MOD_DELETE ) {
1642                 if ( !c->line ) {
1643                         c->be->be_restrictops = 0;
1644                 } else {
1645                         restrictops = verb_to_mask( c->line, restrictable_ops );
1646                         c->be->be_restrictops ^= restrictops;
1647                 }
1648                 return 0;
1649         }
1650         i = verbs_to_mask( c->argc, c->argv, restrictable_ops, &restrictops );
1651         if ( i ) {
1652                 Debug(LDAP_DEBUG_ANY, "%s: "
1653                         "unknown operation %s in \"restrict <features>\" line\n",
1654                         c->log, c->argv[i], 0);
1655                 return(1);
1656         }
1657         if ( restrictops & SLAP_RESTRICT_OP_EXTENDED )
1658                 restrictops &= ~SLAP_RESTRICT_EXOP_MASK;
1659         c->be->be_restrictops |= restrictops;
1660         return(0);
1661 }
1662
1663 static int
1664 config_allows(ConfigArgs *c) {
1665         slap_mask_t allows = 0;
1666         int i;
1667         slap_verbmasks allowable_ops[] = {
1668                 { BER_BVC("bind_v2"),           SLAP_ALLOW_BIND_V2 },
1669                 { BER_BVC("bind_anon_cred"),    SLAP_ALLOW_BIND_ANON_CRED },
1670                 { BER_BVC("bind_anon_dn"),      SLAP_ALLOW_BIND_ANON_DN },
1671                 { BER_BVC("update_anon"),       SLAP_ALLOW_UPDATE_ANON },
1672                 { BER_BVNULL,   0 }
1673         };
1674         if (c->op == SLAP_CONFIG_EMIT) {
1675                 return mask_to_verbs( allowable_ops, global_allows, &c->rvalue_vals );
1676         } else if ( c->op == LDAP_MOD_DELETE ) {
1677                 if ( !c->line ) {
1678                         global_allows = 0;
1679                 } else {
1680                         allows = verb_to_mask( c->line, allowable_ops );
1681                         global_allows ^= allows;
1682                 }
1683                 return 0;
1684         }
1685         i = verbs_to_mask(c->argc, c->argv, allowable_ops, &allows);
1686         if ( i ) {
1687                 Debug(LDAP_DEBUG_ANY, "%s: "
1688                         "unknown feature %s in \"allow <features>\" line\n",
1689                         c->log, c->argv[i], 0);
1690                 return(1);
1691         }
1692         global_allows |= allows;
1693         return(0);
1694 }
1695
1696 static int
1697 config_disallows(ConfigArgs *c) {
1698         slap_mask_t disallows = 0;
1699         int i;
1700         slap_verbmasks disallowable_ops[] = {
1701                 { BER_BVC("bind_anon"),         SLAP_DISALLOW_BIND_ANON },
1702                 { BER_BVC("bind_simple"),       SLAP_DISALLOW_BIND_SIMPLE },
1703                 { BER_BVC("bind_krb4"),         SLAP_DISALLOW_BIND_KRBV4 },
1704                 { BER_BVC("tls_2_anon"),                SLAP_DISALLOW_TLS_2_ANON },
1705                 { BER_BVC("tls_authc"),         SLAP_DISALLOW_TLS_AUTHC },
1706                 { BER_BVNULL, 0 }
1707         };
1708         if (c->op == SLAP_CONFIG_EMIT) {
1709                 return mask_to_verbs( disallowable_ops, global_disallows, &c->rvalue_vals );
1710         } else if ( c->op == LDAP_MOD_DELETE ) {
1711                 if ( !c->line ) {
1712                         global_disallows = 0;
1713                 } else {
1714                         disallows = verb_to_mask( c->line, disallowable_ops );
1715                         global_disallows ^= disallows;
1716                 }
1717                 return 0;
1718         }
1719         i = verbs_to_mask(c->argc, c->argv, disallowable_ops, &disallows);
1720         if ( i ) {
1721                 Debug(LDAP_DEBUG_ANY, "%s: "
1722                         "unknown feature %s in \"disallow <features>\" line\n",
1723                         c->log, c->argv[i], 0);
1724                 return(1);
1725         }
1726         global_disallows |= disallows;
1727         return(0);
1728 }
1729
1730 static int
1731 config_requires(ConfigArgs *c) {
1732         slap_mask_t requires = 0;
1733         int i;
1734         slap_verbmasks requires_ops[] = {
1735                 { BER_BVC("bind"),              SLAP_REQUIRE_BIND },
1736                 { BER_BVC("LDAPv3"),            SLAP_REQUIRE_LDAP_V3 },
1737                 { BER_BVC("authc"),             SLAP_REQUIRE_AUTHC },
1738                 { BER_BVC("sasl"),              SLAP_REQUIRE_SASL },
1739                 { BER_BVC("strong"),            SLAP_REQUIRE_STRONG },
1740                 { BER_BVNULL, 0 }
1741         };
1742         if (c->op == SLAP_CONFIG_EMIT) {
1743                 return mask_to_verbs( requires_ops, c->be->be_requires, &c->rvalue_vals );
1744         } else if ( c->op == LDAP_MOD_DELETE ) {
1745                 if ( !c->line ) {
1746                         c->be->be_requires = 0;
1747                 } else {
1748                         requires = verb_to_mask( c->line, requires_ops );
1749                         c->be->be_requires ^= requires;
1750                 }
1751                 return 0;
1752         }
1753         i = verbs_to_mask(c->argc, c->argv, requires_ops, &requires);
1754         if ( i ) {
1755                 Debug(LDAP_DEBUG_ANY, "%s: "
1756                         "unknown feature %s in \"require <features>\" line\n",
1757                         c->log, c->argv[i], 0);
1758                 return(1);
1759         }
1760         c->be->be_requires = requires;
1761         return(0);
1762 }
1763
1764 static int
1765 config_loglevel(ConfigArgs *c) {
1766         int i;
1767         char *next;
1768         slap_verbmasks loglevel_ops[] = {
1769                 { BER_BVC("Trace"),     LDAP_DEBUG_TRACE },
1770                 { BER_BVC("Packets"),   LDAP_DEBUG_PACKETS },
1771                 { BER_BVC("Args"),      LDAP_DEBUG_ARGS },
1772                 { BER_BVC("Conns"),     LDAP_DEBUG_CONNS },
1773                 { BER_BVC("BER"),       LDAP_DEBUG_BER },
1774                 { BER_BVC("Filter"),    LDAP_DEBUG_FILTER },
1775                 { BER_BVC("Config"),    LDAP_DEBUG_CONFIG },
1776                 { BER_BVC("ACL"),       LDAP_DEBUG_ACL },
1777                 { BER_BVC("Stats"),     LDAP_DEBUG_STATS },
1778                 { BER_BVC("Stats2"),    LDAP_DEBUG_STATS2 },
1779                 { BER_BVC("Shell"),     LDAP_DEBUG_SHELL },
1780                 { BER_BVC("Parse"),     LDAP_DEBUG_PARSE },
1781                 { BER_BVC("Cache"),     LDAP_DEBUG_CACHE },
1782                 { BER_BVC("Index"),     LDAP_DEBUG_INDEX },
1783                 { BER_BVC("Any"),       -1 },
1784                 { BER_BVNULL,   0 }
1785         };
1786
1787         if (c->op == SLAP_CONFIG_EMIT) {
1788                 return mask_to_verbs( loglevel_ops, ldap_syslog, &c->rvalue_vals );
1789         } else if ( c->op == LDAP_MOD_DELETE ) {
1790                 if ( !c->line ) {
1791                         ldap_syslog = 0;
1792                 } else {
1793                         int level = verb_to_mask( c->line, loglevel_ops );
1794                         ldap_syslog ^= level;
1795                 }
1796                 return 0;
1797         }
1798
1799         ldap_syslog = 0;
1800
1801         for( i=1; i < c->argc; i++ ) {
1802                 int     level;
1803
1804                 if ( isdigit( c->argv[i][0] ) ) {
1805                         level = strtol( c->argv[i], &next, 10 );
1806                         if ( next == NULL || next[0] != '\0' ) {
1807                                 Debug( LDAP_DEBUG_ANY,
1808                                         "%s: unable to parse level \"%s\" "
1809                                         "in \"loglevel <level> [...]\" line.\n",
1810                                         c->log, c->argv[i], 0);
1811                                 return( 1 );
1812                         }
1813                 } else {
1814                         int j = verb_to_mask(c->argv[i], loglevel_ops);
1815                         if(BER_BVISNULL(&loglevel_ops[j].word)) {
1816                                 Debug( LDAP_DEBUG_ANY,
1817                                         "%s: unknown level \"%s\" "
1818                                         "in \"loglevel <level> [...]\" line.\n",
1819                                         c->log, c->argv[i], 0);
1820                                 return( 1 );
1821                         }
1822                         level = loglevel_ops[j].mask;
1823                 }
1824                 ldap_syslog |= level;
1825         }
1826         return(0);
1827 }
1828
1829 static int
1830 config_syncrepl(ConfigArgs *c) {
1831         if (c->op == SLAP_CONFIG_EMIT) {
1832                 if ( c->be->be_syncinfo ) {
1833                         struct berval bv;
1834                         syncrepl_unparse( c->be->be_syncinfo, &bv );
1835                         ber_bvarray_add( &c->rvalue_vals, &bv );
1836                         return 0;
1837                 }
1838                 return 1;
1839         } else if ( c->op == LDAP_MOD_DELETE ) {
1840                 struct re_s *re;
1841
1842                 if ( c->be->be_syncinfo ) {
1843                         re = ldap_pvt_runqueue_find( &slapd_rq, do_syncrepl, c->be->be_syncinfo );
1844                         if ( re ) {
1845                                 if ( ldap_pvt_runqueue_isrunning( &slapd_rq, re ))
1846                                         ldap_pvt_runqueue_stoptask( &slapd_rq, re );
1847                                 ldap_pvt_runqueue_remove( &slapd_rq, re );
1848                         }
1849                         syncinfo_free( c->be->be_syncinfo );
1850                         c->be->be_syncinfo = NULL;
1851                 }
1852                 return 0;
1853         }
1854         if(SLAP_SHADOW(c->be)) {
1855                 Debug(LDAP_DEBUG_ANY, "%s: "
1856                         "syncrepl: database already shadowed.\n",
1857                         c->log, 0, 0);
1858                 return(1);
1859         } else if(add_syncrepl(c->be, c->argv, c->argc)) {
1860                 return(1);
1861         }
1862         SLAP_DBFLAGS(c->be) |= (SLAP_DBFLAG_SHADOW | SLAP_DBFLAG_SYNC_SHADOW);
1863         return(0);
1864 }
1865
1866 static int
1867 config_referral(ConfigArgs *c) {
1868         struct berval vals[2];
1869         if (c->op == SLAP_CONFIG_EMIT) {
1870                 if ( default_referral ) {
1871                         value_add( &c->rvalue_vals, default_referral );
1872                         return 0;
1873                 } else {
1874                         return 1;
1875                 }
1876         } else if ( c->op == LDAP_MOD_DELETE ) {
1877                 if ( c->valx < 0 ) {
1878                         ber_bvarray_free( default_referral );
1879                         default_referral = NULL;
1880                 } else {
1881                         int i = c->valx;
1882                         ch_free( default_referral[i].bv_val );
1883                         for (; default_referral[i].bv_val; i++ )
1884                                 default_referral[i] = default_referral[i+1];
1885                 }
1886                 return 0;
1887         }
1888         if(validate_global_referral(c->argv[1])) {
1889                 Debug(LDAP_DEBUG_ANY, "%s: "
1890                         "invalid URL (%s) in \"referral\" line.\n",
1891                         c->log, c->argv[1], 0);
1892                 return(1);
1893         }
1894
1895         ber_str2bv(c->argv[1], 0, 0, &vals[0]);
1896         vals[1].bv_val = NULL; vals[1].bv_len = 0;
1897         if(value_add(&default_referral, vals)) return(LDAP_OTHER);
1898         return(0);
1899 }
1900
1901 static struct {
1902         struct berval key;
1903         int off;
1904 } sec_keys[] = {
1905         { BER_BVC("ssf="), offsetof(slap_ssf_set_t, sss_ssf) },
1906         { BER_BVC("transport="), offsetof(slap_ssf_set_t, sss_transport) },
1907         { BER_BVC("tls="), offsetof(slap_ssf_set_t, sss_tls) },
1908         { BER_BVC("sasl="), offsetof(slap_ssf_set_t, sss_sasl) },
1909         { BER_BVC("update_ssf="), offsetof(slap_ssf_set_t, sss_update_ssf) },
1910         { BER_BVC("update_transport="), offsetof(slap_ssf_set_t, sss_update_transport) },
1911         { BER_BVC("update_tls="), offsetof(slap_ssf_set_t, sss_update_tls) },
1912         { BER_BVC("update_sasl="), offsetof(slap_ssf_set_t, sss_update_sasl) },
1913         { BER_BVC("simple_bind="), offsetof(slap_ssf_set_t, sss_simple_bind) },
1914         { BER_BVNULL, 0 }
1915 };
1916
1917 static int
1918 config_security(ConfigArgs *c) {
1919         slap_ssf_set_t *set = &c->be->be_ssf_set;
1920         char *next;
1921         int i, j;
1922         if (c->op == SLAP_CONFIG_EMIT) {
1923                 char numbuf[32];
1924                 struct berval bv;
1925                 slap_ssf_t *tgt;
1926                 int rc = 1;
1927
1928                 for (i=0; !BER_BVISNULL( &sec_keys[i].key ); i++) {
1929                         tgt = (slap_ssf_t *)((char *)set + sec_keys[i].off);
1930                         if ( *tgt ) {
1931                                 rc = 0;
1932                                 bv.bv_len = sprintf( numbuf, "%u", *tgt );
1933                                 bv.bv_len += sec_keys[i].key.bv_len;
1934                                 bv.bv_val = ch_malloc( bv.bv_len + 1);
1935                                 next = lutil_strcopy( bv.bv_val, sec_keys[i].key.bv_val );
1936                                 strcpy( next, numbuf );
1937                                 ber_bvarray_add( &c->rvalue_vals, &bv );
1938                         }
1939                 }
1940                 return rc;
1941         }
1942         for(i = 1; i < c->argc; i++) {
1943                 slap_ssf_t *tgt = NULL;
1944                 char *src;
1945                 for ( j=0; !BER_BVISNULL( &sec_keys[j].key ); j++ ) {
1946                         if(!strncasecmp(c->argv[i], sec_keys[j].key.bv_val,
1947                                 sec_keys[j].key.bv_len)) {
1948                                 src = c->argv[i] + sec_keys[j].key.bv_len;
1949                                 tgt = (slap_ssf_t *)((char *)set + sec_keys[j].off);
1950                                 break;
1951                         }
1952                 }
1953                 if ( !tgt ) {
1954                         Debug(LDAP_DEBUG_ANY, "%s: "
1955                                 "unknown factor %s in \"security <factors>\" line\n",
1956                                 c->log, c->argv[i], 0);
1957                         return(1);
1958                 }
1959
1960                 *tgt = strtol(src, &next, 10);
1961                 if(next == NULL || next[0] != '\0' ) {
1962                         Debug(LDAP_DEBUG_ANY, "%s: "
1963                                 "unable to parse factor \"%s\" in \"security <factors>\" line\n",
1964                                 c->log, c->argv[i], 0);
1965                         return(1);
1966                 }
1967         }
1968         return(0);
1969 }
1970
1971 static char *
1972 anlist_unparse( AttributeName *an, char *ptr ) {
1973         int comma = 0;
1974
1975         for (; !BER_BVISNULL( &an->an_name ); an++) {
1976                 if ( comma ) *ptr++ = ',';
1977                 ptr = lutil_strcopy( ptr, an->an_name.bv_val );
1978                 comma = 1;
1979         }
1980         return ptr;
1981 }
1982
1983 static void
1984 replica_unparse( struct slap_replica_info *ri, int i, struct berval *bv )
1985 {
1986         int len;
1987         char *ptr;
1988         struct berval bc = {0};
1989         char numbuf[32];
1990
1991         len = sprintf(numbuf, IFMT, i );
1992
1993         len += strlen( ri->ri_uri ) + STRLENOF("uri=");
1994         if ( ri->ri_nsuffix ) {
1995                 for (i=0; !BER_BVISNULL( &ri->ri_nsuffix[i] ); i++) {
1996                         len += ri->ri_nsuffix[i].bv_len + STRLENOF(" suffix=\"\"");
1997                 }
1998         }
1999         if ( ri->ri_attrs ) {
2000                 len += STRLENOF("attr");
2001                 if ( ri->ri_exclude ) len++;
2002                 for (i=0; !BER_BVISNULL( &ri->ri_attrs[i].an_name ); i++) {
2003                         len += 1 + ri->ri_attrs[i].an_name.bv_len;
2004                 }
2005         }
2006         bindconf_unparse( &ri->ri_bindconf, &bc );
2007         len += bc.bv_len;
2008
2009         bv->bv_val = ch_malloc(len + 1);
2010         bv->bv_len = len;
2011
2012         ptr = lutil_strcopy( bv->bv_val, numbuf );
2013         ptr = lutil_strcopy( ptr, "uri=" );
2014         ptr = lutil_strcopy( ptr, ri->ri_uri );
2015
2016         if ( ri->ri_nsuffix ) {
2017                 for (i=0; !BER_BVISNULL( &ri->ri_nsuffix[i] ); i++) {
2018                         ptr = lutil_strcopy( ptr, " suffix=\"" );
2019                         ptr = lutil_strcopy( ptr, ri->ri_nsuffix[i].bv_val );
2020                         *ptr++ = '"';
2021                 }
2022         }
2023         if ( ri->ri_attrs ) {
2024                 ptr = lutil_strcopy( ptr, "attr" );
2025                 if ( ri->ri_exclude ) *ptr++ = '!';
2026                 *ptr++ = '=';
2027                 ptr = anlist_unparse( ri->ri_attrs, ptr );
2028         }
2029         if ( bc.bv_val ) {
2030                 strcpy( ptr, bc.bv_val );
2031                 ch_free( bc.bv_val );
2032         }
2033 }
2034
2035 static int
2036 config_replica(ConfigArgs *c) {
2037         int i, nr = -1, len;
2038         char *replicahost, *replicauri;
2039         LDAPURLDesc *ludp;
2040
2041         if (c->op == SLAP_CONFIG_EMIT) {
2042                 if (c->be->be_replica) {
2043                         struct berval bv;
2044                         for (i=0;c->be->be_replica[i]; i++) {
2045                                 replica_unparse( c->be->be_replica[i], i, &bv );
2046                                 ber_bvarray_add( &c->rvalue_vals, &bv );
2047                         }
2048                         return 0;
2049                 }
2050                 return 1;
2051         } else if ( c->op == LDAP_MOD_DELETE ) {
2052                 if ( c->valx < 0 ) {
2053                 } else {
2054                 }
2055         }
2056         if(SLAP_MONITOR(c->be)) {
2057                 Debug(LDAP_DEBUG_ANY, "%s: "
2058                         "\"replica\" should not be used inside monitor database\n",
2059                         c->log, 0, 0);
2060                 return(0);      /* FIXME: should this be an error? */
2061         }
2062
2063         for(i = 1; i < c->argc; i++) {
2064                 if(!strncasecmp(c->argv[i], "host=", STRLENOF("host="))) {
2065                         replicahost = c->argv[i] + STRLENOF("host=");
2066                         len = strlen( replicahost );
2067                         replicauri = ch_malloc( len + STRLENOF("ldap://") + 1 );
2068                         sprintf( replicauri, "ldap://%s", replicahost );
2069                         replicahost = replicauri + STRLENOF( "ldap://");
2070                         nr = add_replica_info(c->be, replicauri, replicahost);
2071                         break;
2072                 } else if(!strncasecmp(c->argv[i], "uri=", STRLENOF("uri="))) {
2073                         if(ldap_url_parse(c->argv[i] + STRLENOF("uri="), &ludp) != LDAP_SUCCESS) {
2074                                 Debug(LDAP_DEBUG_ANY, "%s: "
2075                                         "replica line contains invalid "
2076                                         "uri definition.\n", c->log, 0, 0);
2077                                 return(1);
2078                         }
2079                         if(!ludp->lud_host) {
2080                                 Debug(LDAP_DEBUG_ANY, "%s: "
2081                                         "replica line contains invalid "
2082                                         "uri definition - missing hostname.\n",
2083                                         c->log, 0, 0);
2084                                 return(1);
2085                         }
2086                         ldap_free_urldesc(ludp);
2087                         replicauri = c->argv[i] + STRLENOF("uri=");
2088                         replicauri = ch_strdup( replicauri );
2089                         replicahost = strchr( replicauri, '/' );
2090                         replicahost += 2;
2091                         nr = add_replica_info(c->be, replicauri, replicahost);
2092                         break;
2093                 }
2094         }
2095         if(i == c->argc) {
2096                 Debug(LDAP_DEBUG_ANY, "%s: "
2097                         "missing host or uri in \"replica\" line\n",
2098                         c->log, 0, 0);
2099                 return(1);
2100         } else if(nr == -1) {
2101                 Debug(LDAP_DEBUG_ANY, "%s: "
2102                         "unable to add replica \"%s\"\n",
2103                         c->log, replicauri, 0);
2104                 return(1);
2105         } else {
2106                 for(i = 1; i < c->argc; i++) {
2107                         if(!strncasecmp(c->argv[i], "suffix=", STRLENOF( "suffix="))) {
2108                                 switch(add_replica_suffix(c->be, nr, c->argv[i] + STRLENOF("suffix="))) {
2109                                         case 1:
2110                                                 Debug(LDAP_DEBUG_ANY, "%s: "
2111                                                 "suffix \"%s\" in \"replica\" line is not valid for backend (ignored)\n",
2112                                                 c->log, c->argv[i] + STRLENOF("suffix="), 0);
2113                                                 break;
2114                                         case 2:
2115                                                 Debug(LDAP_DEBUG_ANY, "%s: "
2116                                                 "unable to normalize suffix in \"replica\" line (ignored)\n",
2117                                                 c->log, 0, 0);
2118                                                 break;
2119                                 }
2120
2121                         } else if(!strncasecmp(c->argv[i], "attr", STRLENOF("attr"))) {
2122                                 int exclude = 0;
2123                                 char *arg = c->argv[i] + STRLENOF("attr");
2124                                 if(arg[0] == '!') {
2125                                         arg++;
2126                                         exclude = 1;
2127                                 }
2128                                 if(arg[0] != '=') {
2129                                         continue;
2130                                 }
2131                                 if(add_replica_attrs(c->be, nr, arg + 1, exclude)) {
2132                                         Debug(LDAP_DEBUG_ANY, "%s: "
2133                                                 "attribute \"%s\" in \"replica\" line is unknown\n",
2134                                                 c->log, arg + 1, 0);
2135                                         return(1);
2136                                 }
2137                         } else if ( bindconf_parse( c->argv[i],
2138                                         &c->be->be_replica[nr]->ri_bindconf ) ) {
2139                                 return(1);
2140                         }
2141                 }
2142         }
2143         return(0);
2144 }
2145
2146 static int
2147 config_updatedn(ConfigArgs *c) {
2148         struct berval dn;
2149         int rc;
2150         if (c->op == SLAP_CONFIG_EMIT) {
2151                 if (!BER_BVISEMPTY(&c->be->be_update_ndn)) {
2152                         value_add_one(&c->rvalue_vals, &c->be->be_update_ndn);
2153                         value_add_one(&c->rvalue_nvals, &c->be->be_update_ndn);
2154                         return 0;
2155                 }
2156                 return 1;
2157         } else if ( c->op == LDAP_MOD_DELETE ) {
2158                 ch_free( c->be->be_update_ndn.bv_val );
2159                 c->be->be_update_ndn.bv_val = NULL;
2160                 SLAP_DBFLAGS(c->be) ^= (SLAP_DBFLAG_SHADOW | SLAP_DBFLAG_SLURP_SHADOW);
2161                 return 0;
2162         }
2163         if(SLAP_SHADOW(c->be)) {
2164                 Debug(LDAP_DEBUG_ANY, "%s: "
2165                         "updatedn: database already shadowed.\n",
2166                         c->log, 0, 0);
2167                 return(1);
2168         }
2169
2170         ber_str2bv(c->argv[1], 0, 0, &dn);
2171
2172         rc = dnNormalize(0, NULL, NULL, &dn, &c->be->be_update_ndn, NULL);
2173
2174         if(rc != LDAP_SUCCESS) {
2175                 Debug(LDAP_DEBUG_ANY, "%s: "
2176                         "updatedn DN is invalid: %d (%s)\n",
2177                         c->log, rc, ldap_err2string( rc ));
2178                 return(1);
2179         }
2180
2181         SLAP_DBFLAGS(c->be) |= (SLAP_DBFLAG_SHADOW | SLAP_DBFLAG_SLURP_SHADOW);
2182         return(0);
2183 }
2184
2185 static int
2186 config_updateref(ConfigArgs *c) {
2187         struct berval vals[2];
2188         if (c->op == SLAP_CONFIG_EMIT) {
2189                 if ( c->be->be_update_refs ) {
2190                         value_add( &c->rvalue_vals, c->be->be_update_refs );
2191                         return 0;
2192                 } else {
2193                         return 1;
2194                 }
2195         } else if ( c->op == LDAP_MOD_DELETE ) {
2196                 if ( c->valx < 0 ) {
2197                         ber_bvarray_free( c->be->be_update_refs );
2198                         c->be->be_update_refs = NULL;
2199                 } else {
2200                         int i = c->valx;
2201                         ch_free( c->be->be_update_refs[i].bv_val );
2202                         for (; c->be->be_update_refs[i].bv_val; i++)
2203                                 c->be->be_update_refs[i] = c->be->be_update_refs[i+1];
2204                 }
2205                 return 0;
2206         }
2207         if(!SLAP_SHADOW(c->be)) {
2208                 Debug(LDAP_DEBUG_ANY, "%s: "
2209                         "updateref line must come after syncrepl or updatedn.\n",
2210                         c->log, 0, 0);
2211                 return(1);
2212         }
2213
2214         if(validate_global_referral(c->argv[1])) {
2215                 Debug(LDAP_DEBUG_ANY, "%s: "
2216                         "invalid URL (%s) in \"updateref\" line.\n",
2217                         c->log, c->argv[1], 0);
2218                 return(1);
2219         }
2220         ber_str2bv(c->argv[1], 0, 0, &vals[0]);
2221         vals[1].bv_val = NULL;
2222         if(value_add(&c->be->be_update_refs, vals)) return(LDAP_OTHER);
2223         return(0);
2224 }
2225
2226 static int
2227 config_include(ConfigArgs *c) {
2228         unsigned long savelineno = c->lineno;
2229         int rc;
2230         ConfigFile *cf;
2231         ConfigFile *cfsave = cfn;
2232         ConfigFile *cf2 = NULL;
2233         if (c->op == SLAP_CONFIG_EMIT) {
2234                 if (c->private) {
2235                         ConfigFile *cf = c->private;
2236                         value_add_one( &c->rvalue_vals, &cf->c_file );
2237                         return 0;
2238                 }
2239                 return 1;
2240         } else if ( c->op == LDAP_MOD_DELETE ) {
2241         }
2242         cf = ch_calloc( 1, sizeof(ConfigFile));
2243         if ( cfn->c_kids ) {
2244                 for (cf2=cfn->c_kids; cf2 && cf2->c_sibs; cf2=cf2->c_sibs) ;
2245                 cf2->c_sibs = cf;
2246         } else {
2247                 cfn->c_kids = cf;
2248         }
2249         cfn = cf;
2250         ber_str2bv( c->argv[1], 0, 1, &cf->c_file );
2251         rc = read_config_file(c->argv[1], c->depth + 1, c);
2252         c->lineno = savelineno - 1;
2253         cfn = cfsave;
2254         if ( rc ) {
2255                 if ( cf2 ) cf2->c_sibs = NULL;
2256                 else cfn->c_kids = NULL;
2257                 ch_free( cf->c_file.bv_val );
2258                 ch_free( cf );
2259         }
2260         return(rc);
2261 }
2262
2263 #ifdef HAVE_TLS
2264 static int
2265 config_tls_option(ConfigArgs *c) {
2266         int flag;
2267         switch(c->type) {
2268         case CFG_TLS_RAND:      flag = LDAP_OPT_X_TLS_RANDOM_FILE;      break;
2269         case CFG_TLS_CIPHER:    flag = LDAP_OPT_X_TLS_CIPHER_SUITE;     break;
2270         case CFG_TLS_CERT_FILE: flag = LDAP_OPT_X_TLS_CERTFILE;         break;
2271         case CFG_TLS_CERT_KEY:  flag = LDAP_OPT_X_TLS_KEYFILE;          break;
2272         case CFG_TLS_CA_PATH:   flag = LDAP_OPT_X_TLS_CACERTDIR;        break;
2273         case CFG_TLS_CA_FILE:   flag = LDAP_OPT_X_TLS_CACERTFILE;       break;
2274         default:                Debug(LDAP_DEBUG_ANY, "%s: "
2275                                         "unknown tls_option <0x%x>\n",
2276                                         c->log, c->type, 0);
2277         }
2278         if (c->op == SLAP_CONFIG_EMIT) {
2279                 return ldap_pvt_tls_get_option( NULL, flag, &c->value_string );
2280         } else if ( c->op == LDAP_MOD_DELETE ) {
2281                 return ldap_pvt_tls_set_option( NULL, flag, NULL );
2282         }
2283         ch_free(c->value_string);
2284         return(ldap_pvt_tls_set_option(NULL, flag, c->argv[1]));
2285 }
2286
2287 /* FIXME: this ought to be provided by libldap */
2288 static int
2289 config_tls_config(ConfigArgs *c) {
2290         int i, flag;
2291         slap_verbmasks crlkeys[] = {
2292                 { BER_BVC("none"),      LDAP_OPT_X_TLS_CRL_NONE },
2293                 { BER_BVC("peer"),      LDAP_OPT_X_TLS_CRL_PEER },
2294                 { BER_BVC("all"),       LDAP_OPT_X_TLS_CRL_ALL },
2295                 { BER_BVNULL, 0 }
2296         };
2297         slap_verbmasks vfykeys[] = {
2298                 { BER_BVC("never"),     LDAP_OPT_X_TLS_NEVER },
2299                 { BER_BVC("demand"),    LDAP_OPT_X_TLS_DEMAND },
2300                 { BER_BVC("try"),       LDAP_OPT_X_TLS_TRY },
2301                 { BER_BVC("hard"),      LDAP_OPT_X_TLS_HARD },
2302                 { BER_BVNULL, 0 }
2303         }, *keys;
2304         switch(c->type) {
2305         case CFG_TLS_CRLCHECK:  flag = LDAP_OPT_X_TLS_CRLCHECK;         keys = crlkeys; break;
2306         case CFG_TLS_VERIFY:    flag = LDAP_OPT_X_TLS_REQUIRE_CERT;     keys = vfykeys; break;
2307         default:
2308                 Debug(LDAP_DEBUG_ANY, "%s: "
2309                                 "unknown tls_option <0x%x>\n",
2310                                 c->log, c->type, 0);
2311         }
2312         if (c->op == SLAP_CONFIG_EMIT) {
2313                 ldap_pvt_tls_get_option( NULL, flag, &c->value_int );
2314                 for (i=0; !BER_BVISNULL(&keys[i].word); i++) {
2315                         if (keys[i].mask == c->value_int) {
2316                                 c->value_string = ch_strdup( keys[i].word.bv_val );
2317                                 return 0;
2318                         }
2319                 }
2320                 return 1;
2321         } else if ( c->op == LDAP_MOD_DELETE ) {
2322                 int i = 0;
2323                 return ldap_pvt_tls_set_option( NULL, flag, &i );
2324         }
2325         ch_free( c->value_string );
2326         if(isdigit((unsigned char)c->argv[1][0])) {
2327                 i = atoi(c->argv[1]);
2328                 return(ldap_pvt_tls_set_option(NULL, flag, &i));
2329         } else {
2330                 return(ldap_int_tls_config(NULL, flag, c->argv[1]));
2331         }
2332 }
2333 #endif
2334
2335 static int
2336 add_syncrepl(
2337         Backend *be,
2338         char    **cargv,
2339         int     cargc
2340 )
2341 {
2342         syncinfo_t *si;
2343         int     rc = 0;
2344
2345         if ( !( be->be_search && be->be_add && be->be_modify && be->be_delete )) {
2346                 Debug( LDAP_DEBUG_ANY, "database %s does not support operations "
2347                         "required for syncrepl\n", be->be_type, 0, 0 );
2348                 return 1;
2349         }
2350         si = (syncinfo_t *) ch_calloc( 1, sizeof( syncinfo_t ) );
2351
2352         if ( si == NULL ) {
2353                 Debug( LDAP_DEBUG_ANY, "out of memory in add_syncrepl\n", 0, 0, 0 );
2354                 return 1;
2355         }
2356
2357         si->si_bindconf.sb_tls = SB_TLS_OFF;
2358         si->si_bindconf.sb_method = LDAP_AUTH_SIMPLE;
2359         si->si_schemachecking = 0;
2360         ber_str2bv( "(objectclass=*)", STRLENOF("(objectclass=*)"), 1,
2361                 &si->si_filterstr );
2362         si->si_base.bv_val = NULL;
2363         si->si_scope = LDAP_SCOPE_SUBTREE;
2364         si->si_attrsonly = 0;
2365         si->si_anlist = (AttributeName *) ch_calloc( 1, sizeof( AttributeName ));
2366         si->si_exanlist = (AttributeName *) ch_calloc( 1, sizeof( AttributeName ));
2367         si->si_attrs = NULL;
2368         si->si_allattrs = 0;
2369         si->si_allopattrs = 0;
2370         si->si_exattrs = NULL;
2371         si->si_type = LDAP_SYNC_REFRESH_ONLY;
2372         si->si_interval = 86400;
2373         si->si_retryinterval = NULL;
2374         si->si_retrynum_init = NULL;
2375         si->si_retrynum = NULL;
2376         si->si_manageDSAit = 0;
2377         si->si_tlimit = 0;
2378         si->si_slimit = 0;
2379
2380         si->si_presentlist = NULL;
2381         LDAP_LIST_INIT( &si->si_nonpresentlist );
2382         ldap_pvt_thread_mutex_init( &si->si_mutex );
2383
2384         rc = parse_syncrepl_line( cargv, cargc, si );
2385
2386         if ( rc < 0 ) {
2387                 Debug( LDAP_DEBUG_ANY, "failed to add syncinfo\n", 0, 0, 0 );
2388                 syncinfo_free( si );
2389                 return 1;
2390         } else {
2391                 Debug( LDAP_DEBUG_CONFIG,
2392                         "Config: ** successfully added syncrepl \"%s\"\n",
2393                         BER_BVISNULL( &si->si_provideruri ) ?
2394                         "(null)" : si->si_provideruri.bv_val, 0, 0 );
2395                 if ( !si->si_schemachecking ) {
2396                         SLAP_DBFLAGS(be) |= SLAP_DBFLAG_NO_SCHEMA_CHECK;
2397                 }
2398                 si->si_be = be;
2399                 be->be_syncinfo = si;
2400                 init_syncrepl( si );
2401                 ldap_pvt_runqueue_insert( &slapd_rq,si->si_interval,do_syncrepl,si );
2402                 return 0;
2403         }
2404 }
2405
2406 /* NOTE: used & documented in slapd.conf(5) */
2407 #define IDSTR                   "rid"
2408 #define PROVIDERSTR             "provider"
2409 #define TYPESTR                 "type"
2410 #define INTERVALSTR             "interval"
2411 #define SEARCHBASESTR           "searchbase"
2412 #define FILTERSTR               "filter"
2413 #define SCOPESTR                "scope"
2414 #define ATTRSSTR                "attrs"
2415 #define ATTRSONLYSTR            "attrsonly"
2416 #define SLIMITSTR               "sizelimit"
2417 #define TLIMITSTR               "timelimit"
2418 #define SCHEMASTR               "schemachecking"
2419
2420 /* FIXME: undocumented */
2421 #define OLDAUTHCSTR             "bindprincipal"
2422 #define EXATTRSSTR              "exattrs"
2423 #define RETRYSTR                "retry"
2424
2425 /* FIXME: unused */
2426 #define LASTMODSTR              "lastmod"
2427 #define LMGENSTR                "gen"
2428 #define LMNOSTR                 "no"
2429 #define LMREQSTR                "req"
2430 #define SRVTABSTR               "srvtab"
2431 #define SUFFIXSTR               "suffix"
2432 #define MANAGEDSAITSTR          "manageDSAit"
2433
2434 /* mandatory */
2435 #define GOT_ID                  0x0001
2436 #define GOT_PROVIDER            0x0002
2437
2438 /* check */
2439 #define GOT_ALL                 (GOT_ID|GOT_PROVIDER)
2440
2441 static struct {
2442         struct berval key;
2443         int val;
2444 } scopes[] = {
2445         { BER_BVC("base"), LDAP_SCOPE_BASE },
2446         { BER_BVC("one"), LDAP_SCOPE_ONELEVEL },
2447 #ifdef LDAP_SCOPE_SUBORDINATE
2448         { BER_BVC("children"), LDAP_SCOPE_SUBORDINATE },
2449         { BER_BVC("subordinate"), 0 },
2450 #endif
2451         { BER_BVC("sub"), LDAP_SCOPE_SUBTREE },
2452         { BER_BVNULL, 0 }
2453 };
2454
2455 static int
2456 parse_syncrepl_line(
2457         char            **cargv,
2458         int             cargc,
2459         syncinfo_t      *si
2460 )
2461 {
2462         int     gots = 0;
2463         int     i;
2464         char    *val;
2465
2466         for ( i = 1; i < cargc; i++ ) {
2467                 if ( !strncasecmp( cargv[ i ], IDSTR "=",
2468                                         STRLENOF( IDSTR "=" ) ) )
2469                 {
2470                         int tmp;
2471                         /* '\0' string terminator accounts for '=' */
2472                         val = cargv[ i ] + STRLENOF( IDSTR "=" );
2473                         tmp= atoi( val );
2474                         if ( tmp >= 1000 || tmp < 0 ) {
2475                                 fprintf( stderr, "Error: parse_syncrepl_line: "
2476                                          "syncrepl id %d is out of range [0..999]\n", tmp );
2477                                 return -1;
2478                         }
2479                         si->si_rid = tmp;
2480                         gots |= GOT_ID;
2481                 } else if ( !strncasecmp( cargv[ i ], PROVIDERSTR "=",
2482                                         STRLENOF( PROVIDERSTR "=" ) ) )
2483                 {
2484                         val = cargv[ i ] + STRLENOF( PROVIDERSTR "=" );
2485                         ber_str2bv( val, 0, 1, &si->si_provideruri );
2486                         gots |= GOT_PROVIDER;
2487                 } else if ( !strncasecmp( cargv[ i ], SCHEMASTR "=",
2488                                         STRLENOF( SCHEMASTR "=" ) ) )
2489                 {
2490                         val = cargv[ i ] + STRLENOF( SCHEMASTR "=" );
2491                         if ( !strncasecmp( val, "on", STRLENOF( "on" ) )) {
2492                                 si->si_schemachecking = 1;
2493                         } else if ( !strncasecmp( val, "off", STRLENOF( "off" ) ) ) {
2494                                 si->si_schemachecking = 0;
2495                         } else {
2496                                 si->si_schemachecking = 1;
2497                         }
2498                 } else if ( !strncasecmp( cargv[ i ], FILTERSTR "=",
2499                                         STRLENOF( FILTERSTR "=" ) ) )
2500                 {
2501                         val = cargv[ i ] + STRLENOF( FILTERSTR "=" );
2502                         ber_str2bv( val, 0, 1, &si->si_filterstr );
2503                 } else if ( !strncasecmp( cargv[ i ], SEARCHBASESTR "=",
2504                                         STRLENOF( SEARCHBASESTR "=" ) ) )
2505                 {
2506                         struct berval   bv;
2507                         int             rc;
2508
2509                         val = cargv[ i ] + STRLENOF( SEARCHBASESTR "=" );
2510                         if ( si->si_base.bv_val ) {
2511                                 ch_free( si->si_base.bv_val );
2512                         }
2513                         ber_str2bv( val, 0, 0, &bv );
2514                         rc = dnNormalize( 0, NULL, NULL, &bv, &si->si_base, NULL );
2515                         if ( rc != LDAP_SUCCESS ) {
2516                                 fprintf( stderr, "Invalid base DN \"%s\": %d (%s)\n",
2517                                         val, rc, ldap_err2string( rc ) );
2518                                 return -1;
2519                         }
2520                 } else if ( !strncasecmp( cargv[ i ], SCOPESTR "=",
2521                                         STRLENOF( SCOPESTR "=" ) ) )
2522                 {
2523                         int j;
2524                         val = cargv[ i ] + STRLENOF( SCOPESTR "=" );
2525                         for ( j=0; !BER_BVISNULL(&scopes[j].key); j++ ) {
2526                                 if (!strncasecmp( val, scopes[j].key.bv_val,
2527                                         scopes[j].key.bv_len )) {
2528                                         while (!scopes[j].val) j--;
2529                                         si->si_scope = scopes[j].val;
2530                                         break;
2531                                 }
2532                         }
2533                         if ( BER_BVISNULL(&scopes[j].key) ) {
2534                                 fprintf( stderr, "Error: parse_syncrepl_line: "
2535                                         "unknown scope \"%s\"\n", val);
2536                                 return -1;
2537                         }
2538                 } else if ( !strncasecmp( cargv[ i ], ATTRSONLYSTR "=",
2539                                         STRLENOF( ATTRSONLYSTR "=" ) ) )
2540                 {
2541                         si->si_attrsonly = 1;
2542                 } else if ( !strncasecmp( cargv[ i ], ATTRSSTR "=",
2543                                         STRLENOF( ATTRSSTR "=" ) ) )
2544                 {
2545                         val = cargv[ i ] + STRLENOF( ATTRSSTR "=" );
2546                         if ( !strncasecmp( val, ":include:", STRLENOF(":include:") ) ) {
2547                                 char *attr_fname;
2548                                 attr_fname = ch_strdup( val + STRLENOF(":include:") );
2549                                 si->si_anlist = file2anlist( si->si_anlist, attr_fname, " ,\t" );
2550                                 if ( si->si_anlist == NULL ) {
2551                                         ch_free( attr_fname );
2552                                         return -1;
2553                                 }
2554                                 si->si_anfile = attr_fname;
2555                         } else {
2556                                 char *str, *s, *next;
2557                                 char delimstr[] = " ,\t";
2558                                 str = ch_strdup( val );
2559                                 for ( s = ldap_pvt_strtok( str, delimstr, &next );
2560                                                 s != NULL;
2561                                                 s = ldap_pvt_strtok( NULL, delimstr, &next ) )
2562                                 {
2563                                         if ( strlen(s) == 1 && *s == '*' ) {
2564                                                 si->si_allattrs = 1;
2565                                                 *(val + ( s - str )) = delimstr[0];
2566                                         }
2567                                         if ( strlen(s) == 1 && *s == '+' ) {
2568                                                 si->si_allopattrs = 1;
2569                                                 *(val + ( s - str )) = delimstr[0];
2570                                         }
2571                                 }
2572                                 ch_free( str );
2573                                 si->si_anlist = str2anlist( si->si_anlist, val, " ,\t" );
2574                                 if ( si->si_anlist == NULL ) {
2575                                         return -1;
2576                                 }
2577                         }
2578                 } else if ( !strncasecmp( cargv[ i ], EXATTRSSTR "=",
2579                                         STRLENOF( EXATTRSSTR "=" ) ) )
2580                 {
2581                         val = cargv[ i ] + STRLENOF( EXATTRSSTR "=" );
2582                         if ( !strncasecmp( val, ":include:", STRLENOF(":include:") )) {
2583                                 char *attr_fname;
2584                                 attr_fname = ch_strdup( val + STRLENOF(":include:") );
2585                                 si->si_exanlist = file2anlist(
2586                                                                         si->si_exanlist, attr_fname, " ,\t" );
2587                                 if ( si->si_exanlist == NULL ) {
2588                                         ch_free( attr_fname );
2589                                         return -1;
2590                                 }
2591                                 ch_free( attr_fname );
2592                         } else {
2593                                 si->si_exanlist = str2anlist( si->si_exanlist, val, " ,\t" );
2594                                 if ( si->si_exanlist == NULL ) {
2595                                         return -1;
2596                                 }
2597                         }
2598                 } else if ( !strncasecmp( cargv[ i ], TYPESTR "=",
2599                                         STRLENOF( TYPESTR "=" ) ) )
2600                 {
2601                         val = cargv[ i ] + STRLENOF( TYPESTR "=" );
2602                         if ( !strncasecmp( val, "refreshOnly",
2603                                                 STRLENOF("refreshOnly") ))
2604                         {
2605                                 si->si_type = LDAP_SYNC_REFRESH_ONLY;
2606                         } else if ( !strncasecmp( val, "refreshAndPersist",
2607                                                 STRLENOF("refreshAndPersist") ))
2608                         {
2609                                 si->si_type = LDAP_SYNC_REFRESH_AND_PERSIST;
2610                                 si->si_interval = 60;
2611                         } else {
2612                                 fprintf( stderr, "Error: parse_syncrepl_line: "
2613                                         "unknown sync type \"%s\"\n", val);
2614                                 return -1;
2615                         }
2616                 } else if ( !strncasecmp( cargv[ i ], INTERVALSTR "=",
2617                                         STRLENOF( INTERVALSTR "=" ) ) )
2618                 {
2619                         val = cargv[ i ] + STRLENOF( INTERVALSTR "=" );
2620                         if ( si->si_type == LDAP_SYNC_REFRESH_AND_PERSIST ) {
2621                                 si->si_interval = 0;
2622                         } else {
2623                                 char *hstr;
2624                                 char *mstr;
2625                                 char *dstr;
2626                                 char *sstr;
2627                                 int dd, hh, mm, ss;
2628                                 dstr = val;
2629                                 hstr = strchr( dstr, ':' );
2630                                 if ( hstr == NULL ) {
2631                                         fprintf( stderr, "Error: parse_syncrepl_line: "
2632                                                 "invalid interval \"%s\"\n", val );
2633                                         return -1;
2634                                 }
2635                                 *hstr++ = '\0';
2636                                 mstr = strchr( hstr, ':' );
2637                                 if ( mstr == NULL ) {
2638                                         fprintf( stderr, "Error: parse_syncrepl_line: "
2639                                                 "invalid interval \"%s\"\n", val );
2640                                         return -1;
2641                                 }
2642                                 *mstr++ = '\0';
2643                                 sstr = strchr( mstr, ':' );
2644                                 if ( sstr == NULL ) {
2645                                         fprintf( stderr, "Error: parse_syncrepl_line: "
2646                                                 "invalid interval \"%s\"\n", val );
2647                                         return -1;
2648                                 }
2649                                 *sstr++ = '\0';
2650
2651                                 dd = atoi( dstr );
2652                                 hh = atoi( hstr );
2653                                 mm = atoi( mstr );
2654                                 ss = atoi( sstr );
2655                                 if (( hh > 24 ) || ( hh < 0 ) ||
2656                                         ( mm > 60 ) || ( mm < 0 ) ||
2657                                         ( ss > 60 ) || ( ss < 0 ) || ( dd < 0 )) {
2658                                         fprintf( stderr, "Error: parse_syncrepl_line: "
2659                                                 "invalid interval \"%s\"\n", val );
2660                                         return -1;
2661                                 }
2662                                 si->si_interval = (( dd * 24 + hh ) * 60 + mm ) * 60 + ss;
2663                         }
2664                         if ( si->si_interval < 0 ) {
2665                                 fprintf( stderr, "Error: parse_syncrepl_line: "
2666                                         "invalid interval \"%ld\"\n",
2667                                         (long) si->si_interval);
2668                                 return -1;
2669                         }
2670                 } else if ( !strncasecmp( cargv[ i ], RETRYSTR "=",
2671                                         STRLENOF( RETRYSTR "=" ) ) )
2672                 {
2673                         char **retry_list;
2674                         int j, k, n;
2675
2676                         val = cargv[ i ] + STRLENOF( RETRYSTR "=" );
2677                         retry_list = (char **) ch_calloc( 1, sizeof( char * ));
2678                         retry_list[0] = NULL;
2679
2680                         slap_str2clist( &retry_list, val, " ,\t" );
2681
2682                         for ( k = 0; retry_list && retry_list[k]; k++ ) ;
2683                         n = k / 2;
2684                         if ( k % 2 ) {
2685                                 fprintf( stderr,
2686                                                 "Error: incomplete syncrepl retry list\n" );
2687                                 for ( k = 0; retry_list && retry_list[k]; k++ ) {
2688                                         ch_free( retry_list[k] );
2689                                 }
2690                                 ch_free( retry_list );
2691                                 exit( EXIT_FAILURE );
2692                         }
2693                         si->si_retryinterval = (time_t *) ch_calloc( n + 1, sizeof( time_t ));
2694                         si->si_retrynum = (int *) ch_calloc( n + 1, sizeof( int ));
2695                         si->si_retrynum_init = (int *) ch_calloc( n + 1, sizeof( int ));
2696                         for ( j = 0; j < n; j++ ) {
2697                                 si->si_retryinterval[j] = atoi( retry_list[j*2] );
2698                                 if ( *retry_list[j*2+1] == '+' ) {
2699                                         si->si_retrynum_init[j] = -1;
2700                                         si->si_retrynum[j] = -1;
2701                                         j++;
2702                                         break;
2703                                 } else {
2704                                         si->si_retrynum_init[j] = atoi( retry_list[j*2+1] );
2705                                         si->si_retrynum[j] = atoi( retry_list[j*2+1] );
2706                                 }
2707                         }
2708                         si->si_retrynum_init[j] = -2;
2709                         si->si_retrynum[j] = -2;
2710                         si->si_retryinterval[j] = 0;
2711
2712                         for ( k = 0; retry_list && retry_list[k]; k++ ) {
2713                                 ch_free( retry_list[k] );
2714                         }
2715                         ch_free( retry_list );
2716                 } else if ( !strncasecmp( cargv[ i ], MANAGEDSAITSTR "=",
2717                                         STRLENOF( MANAGEDSAITSTR "=" ) ) )
2718                 {
2719                         val = cargv[ i ] + STRLENOF( MANAGEDSAITSTR "=" );
2720                         si->si_manageDSAit = atoi( val );
2721                 } else if ( !strncasecmp( cargv[ i ], SLIMITSTR "=",
2722                                         STRLENOF( SLIMITSTR "=") ) )
2723                 {
2724                         val = cargv[ i ] + STRLENOF( SLIMITSTR "=" );
2725                         si->si_slimit = atoi( val );
2726                 } else if ( !strncasecmp( cargv[ i ], TLIMITSTR "=",
2727                                         STRLENOF( TLIMITSTR "=" ) ) )
2728                 {
2729                         val = cargv[ i ] + STRLENOF( TLIMITSTR "=" );
2730                         si->si_tlimit = atoi( val );
2731                 } else if ( bindconf_parse( cargv[i], &si->si_bindconf )) {
2732                         fprintf( stderr, "Error: parse_syncrepl_line: "
2733                                 "unknown keyword \"%s\"\n", cargv[ i ] );
2734                         return -1;
2735                 }
2736         }
2737
2738         if ( gots != GOT_ALL ) {
2739                 fprintf( stderr,
2740                         "Error: Malformed \"syncrepl\" line in slapd config file" );
2741                 return -1;
2742         }
2743
2744         return 0;
2745 }
2746
2747 static void
2748 syncrepl_unparse( syncinfo_t *si, struct berval *bv )
2749 {
2750         struct berval bc;
2751         char buf[BUFSIZ*2], *ptr;
2752         int i, len;
2753
2754         bindconf_unparse( &si->si_bindconf, &bc );
2755         ptr = buf;
2756         ptr += sprintf( ptr, IDSTR "=%03d " PROVIDERSTR "=%s",
2757                 si->si_rid, si->si_provideruri.bv_val );
2758         if ( !BER_BVISNULL( &bc )) {
2759                 ptr = lutil_strcopy( ptr, bc.bv_val );
2760                 free( bc.bv_val );
2761         }
2762         if ( !BER_BVISEMPTY( &si->si_filterstr )) {
2763                 ptr = lutil_strcopy( ptr, " " FILTERSTR "=\"" );
2764                 ptr = lutil_strcopy( ptr, si->si_filterstr.bv_val );
2765                 *ptr++ = '"';
2766         }
2767         if ( !BER_BVISNULL( &si->si_base )) {
2768                 ptr = lutil_strcopy( ptr, " " SEARCHBASESTR "=\"" );
2769                 ptr = lutil_strcopy( ptr, si->si_base.bv_val );
2770                 *ptr++ = '"';
2771         }
2772         for (i=0; !BER_BVISNULL(&scopes[i].key);i++) {
2773                 if ( si->si_scope == scopes[i].val ) {
2774                         ptr = lutil_strcopy( ptr, " " SCOPESTR "=" );
2775                         ptr = lutil_strcopy( ptr, scopes[i].key.bv_val );
2776                         break;
2777                 }
2778         }
2779         if ( si->si_attrsonly ) {
2780                 ptr = lutil_strcopy( ptr, " " ATTRSONLYSTR "=yes" );
2781         }
2782         if ( si->si_anfile ) {
2783                 ptr = lutil_strcopy( ptr, " " ATTRSSTR "=:include:" );
2784                 ptr = lutil_strcopy( ptr, si->si_anfile );
2785         } else if ( si->si_allattrs || si->si_allopattrs ||
2786                 ( si->si_anlist && !BER_BVISNULL(&si->si_anlist[0].an_name) )) {
2787                 char *old;
2788                 ptr = lutil_strcopy( ptr, " " ATTRSSTR "=\"" );
2789                 old = ptr;
2790                 ptr = anlist_unparse( si->si_anlist, ptr );
2791                 if ( si->si_allattrs ) {
2792                         if ( old != ptr ) *ptr++ = ',';
2793                         *ptr++ = '*';
2794                 }
2795                 if ( si->si_allopattrs ) {
2796                         if ( old != ptr ) *ptr++ = ',';
2797                         *ptr++ = '+';
2798                 }
2799                 *ptr++ = '"';
2800         }
2801         if ( si->si_exanlist && !BER_BVISNULL(&si->si_exanlist[0].an_name) ) {
2802                 ptr = lutil_strcopy( ptr, " " EXATTRSSTR "=" );
2803                 ptr = anlist_unparse( si->si_exanlist, ptr );
2804         }
2805         ptr = lutil_strcopy( ptr, " " SCHEMASTR "=" );
2806         ptr = lutil_strcopy( ptr, si->si_schemachecking ? "on" : "off" );
2807
2808         ptr = lutil_strcopy( ptr, " " TYPESTR "=" );
2809         ptr = lutil_strcopy( ptr, si->si_type == LDAP_SYNC_REFRESH_AND_PERSIST ?
2810                 "refreshAndPersist" : "refreshOnly" );
2811
2812         if ( si->si_type == LDAP_SYNC_REFRESH_ONLY ) {
2813                 int dd, hh, mm, ss;
2814
2815                 dd = si->si_interval;
2816                 ss = dd % 60;
2817                 dd /= 60;
2818                 mm = dd % 60;
2819                 dd /= 60;
2820                 hh = dd % 24;
2821                 dd /= 24;
2822                 ptr = lutil_strcopy( ptr, " " INTERVALSTR "=" );
2823                 ptr += sprintf( ptr, "%02d:%02d:%02d:%02d", dd, hh, mm, ss );
2824         } else if ( si->si_retryinterval ) {
2825                 int space=0;
2826                 ptr = lutil_strcopy( ptr, " " RETRYSTR "=\"" );
2827                 for (i=0; si->si_retryinterval[i]; i++) {
2828                         if ( space ) *ptr++ = ' ';
2829                         space = 1;
2830                         ptr += sprintf( ptr, "%d", si->si_retryinterval[i] );
2831                         if ( si->si_retrynum_init[i] == -1 )
2832                                 *ptr++ = '+';
2833                         else
2834                                 ptr += sprintf( ptr, "%d", si->si_retrynum_init );
2835                 }
2836                 *ptr++ = '"';
2837         }
2838
2839 #if 0 /* FIXME: unused in syncrepl.c, should remove it */
2840         ptr = lutil_strcopy( ptr, " " MANAGEDSAITSTR "=" );
2841         ptr += sprintf( ptr, "%d", si->si_manageDSAit );
2842 #endif
2843
2844         if ( si->si_slimit ) {
2845                 ptr = lutil_strcopy( ptr, " " SLIMITSTR "=" );
2846                 ptr += sprintf( ptr, "%d", si->si_slimit );
2847         }
2848
2849         if ( si->si_tlimit ) {
2850                 ptr = lutil_strcopy( ptr, " " TLIMITSTR "=" );
2851                 ptr += sprintf( ptr, "%d", si->si_tlimit );
2852         }
2853         bc.bv_len = ptr - buf;
2854         bc.bv_val = buf;
2855         ber_dupbv( bv, &bc );
2856 }
2857
2858 static CfEntryInfo *
2859 config_find_base( CfEntryInfo *root, struct berval *dn, CfEntryInfo **last )
2860 {
2861         struct berval cdn;
2862         char *c;
2863
2864         if ( !root ) {
2865                 *last = NULL;
2866                 return NULL;
2867         }
2868
2869         if ( dn_match( &root->ce_entry->e_nname, dn ))
2870                 return root;
2871
2872         c = dn->bv_val+dn->bv_len;
2873         for (;*c != ',';c--);
2874
2875         while(root) {
2876                 *last = root;
2877                 for (--c;c>dn->bv_val && *c != ',';c--);
2878                 cdn.bv_val = c;
2879                 if ( *c == ',' )
2880                         cdn.bv_val++;
2881                 cdn.bv_len = dn->bv_len - (cdn.bv_val - dn->bv_val);
2882
2883                 root = root->ce_kids;
2884
2885                 for (;root;root=root->ce_sibs) {
2886                         if ( dn_match( &root->ce_entry->e_nname, &cdn )) {
2887                                 if ( cdn.bv_val == dn->bv_val ) {
2888                                         return root;
2889                                 }
2890                                 break;
2891                         }
2892                 }
2893         }
2894         return root;
2895 }
2896
2897 static int
2898 config_ldif_resp( Operation *op, SlapReply *rs )
2899 {
2900         if ( rs->sr_type == REP_SEARCH ) {
2901                 CfBackInfo *cfb = op->o_callback->sc_private;
2902
2903                 cfb->cb_got_ldif = 1;
2904                 rs->sr_err = config_add_internal( cfb, rs->sr_entry, NULL, NULL );
2905         }
2906         return rs->sr_err;
2907 }
2908
2909 /* Configure and read the underlying back-ldif store */
2910 static int
2911 config_setup_ldif( BackendDB *be, const char *dir ) {
2912         CfBackInfo *cfb = be->be_private;
2913         ConfigArgs c = {0};
2914         ConfigTable *ct;
2915         char *argv[3];
2916         int rc;
2917         slap_callback cb = { NULL, config_ldif_resp, NULL, NULL };
2918         Connection conn = {0};
2919         char opbuf[OPERATION_BUFFER_SIZE];
2920         Operation *op;
2921         SlapReply rs = {REP_RESULT};
2922         Filter filter = { LDAP_FILTER_PRESENT };
2923         struct berval filterstr = BER_BVC("(objectclass=*)");
2924         struct stat st;
2925
2926         /* Is the config directory available? */
2927         if ( stat( dir, &st ) < 0 ) {
2928                 /* No, so don't bother using the backing store.
2929                  * All changes will be in-memory only.
2930                  */
2931                 return 0;
2932         }
2933
2934         cfb->cb_db.bd_info = backend_info( "ldif" );
2935         if ( !cfb->cb_db.bd_info )
2936                 return 0;       /* FIXME: eventually this will be a fatal error */
2937
2938         if ( cfb->cb_db.bd_info->bi_db_init( &cfb->cb_db )) return 1;
2939
2940         /* Mark that back-ldif type is in use */
2941         cfb->cb_db.bd_info->bi_nDB++;
2942
2943         cfb->cb_db.be_suffix = be->be_suffix;
2944         cfb->cb_db.be_nsuffix = be->be_nsuffix;
2945         cfb->cb_db.be_rootdn = be->be_rootdn;
2946         cfb->cb_db.be_rootndn = be->be_rootndn;
2947
2948         ber_str2bv( dir, 0, 1, &cfdir );
2949
2950         c.be = &cfb->cb_db;
2951         c.fname = "slapd";
2952         c.argc = 2;
2953         argv[0] = "directory";
2954         argv[1] = (char *)dir;
2955         argv[2] = NULL;
2956         c.argv = argv;
2957
2958         ct = config_find_keyword( c.be->be_cf_table, &c );
2959         if ( !ct )
2960                 return 1;
2961
2962         if ( config_add_vals( ct, &c ))
2963                 return 1;
2964
2965         if ( backend_startup_one( &cfb->cb_db ))
2966                 return 1;
2967
2968         op = (Operation *)opbuf;
2969         connection_fake_init( &conn, op, cfb );
2970
2971         filter.f_desc = slap_schema.si_ad_objectClass;
2972
2973         op->o_tag = LDAP_REQ_SEARCH;
2974
2975         op->ors_filter = &filter;
2976         op->ors_filterstr = filterstr;
2977         op->ors_scope = LDAP_SCOPE_SUBTREE;
2978
2979         op->o_dn = be->be_rootdn;
2980         op->o_ndn = be->be_rootndn;
2981
2982         op->o_req_dn = be->be_suffix[0];
2983         op->o_req_ndn = be->be_nsuffix[0];
2984
2985         op->ors_tlimit = SLAP_NO_LIMIT;
2986         op->ors_slimit = SLAP_NO_LIMIT;
2987
2988         op->ors_attrs = slap_anlist_all_attributes;
2989         op->ors_attrsonly = 0;
2990
2991         op->o_callback = &cb;
2992         cb.sc_private = cfb;
2993
2994         op->o_bd = &cfb->cb_db;
2995         op->o_bd->be_search( op, &rs );
2996
2997         cfb->cb_use_ldif = 1;
2998
2999         return 0;
3000 }
3001
3002 static int
3003 CfOcInfo_cmp( const void *c1, const void *c2 ) {
3004         const CfOcInfo *co1 = c1;
3005         const CfOcInfo *co2 = c2;
3006
3007         return ber_bvcmp( co1->co_name, co2->co_name );
3008 }
3009
3010 int
3011 config_register_schema(ConfigTable *ct, ConfigOCs *ocs) {
3012         int i;
3013         CfOcInfo *co;
3014
3015         i = init_config_attrs( ct );
3016         if ( i ) return i;
3017
3018         /* set up the objectclasses */
3019         i = init_config_ocs( ocs );
3020         if ( i ) return i;
3021
3022         for (i=0; ocs[i].def; i++) {
3023                 if ( ocs[i].oc ) {
3024                         co = ch_malloc( sizeof(CfOcInfo) );
3025                         co->co_oc = *ocs[i].oc;
3026                         co->co_name = &co->co_oc->soc_cname;
3027                         co->co_table = ct;
3028                         co->co_type = ocs[i].cft;
3029                         avl_insert( &CfOcTree, co, CfOcInfo_cmp, avl_dup_error );
3030                 }
3031         }
3032         return 0;
3033 }
3034
3035 int
3036 read_config(const char *fname, const char *dir) {
3037         BackendDB *be;
3038         CfBackInfo *cfb;
3039
3040         /* Setup the config backend */
3041         be = backend_db_init( "config" );
3042         if ( !be )
3043                 return 1;
3044
3045         cfb = be->be_private;
3046
3047         /* Setup the underlying back-ldif backend */
3048         if ( config_setup_ldif( be, dir ))
3049                 return 1;
3050
3051 #ifdef  SLAP_USE_CONFDIR
3052         /* If we read the config from back-ldif, nothing to do here */
3053         if ( cfb->cb_got_ldif )
3054                 return 0;
3055 #endif
3056         ber_str2bv( fname, 0, 1, &cf_prv.c_file );
3057
3058         return read_config_file(fname, 0, NULL);
3059 }
3060
3061 static int
3062 config_back_bind( Operation *op, SlapReply *rs )
3063 {
3064         if ( op->orb_method == LDAP_AUTH_SIMPLE && be_isroot_pw( op )) {
3065                 ber_dupbv( &op->orb_edn, be_root_dn( op->o_bd ));
3066                 /* frontend sends result */
3067                 return LDAP_SUCCESS;
3068         }
3069
3070         rs->sr_err = LDAP_INVALID_CREDENTIALS;
3071         send_ldap_result( op, rs );
3072
3073         return rs->sr_err;
3074 }
3075
3076 static int
3077 config_send( Operation *op, SlapReply *rs, CfEntryInfo *ce, int depth )
3078 {
3079         int rc = 0;
3080
3081         if ( test_filter( op, ce->ce_entry, op->ors_filter ) == LDAP_COMPARE_TRUE )
3082         {
3083                 rs->sr_attrs = op->ors_attrs;
3084                 rs->sr_entry = ce->ce_entry;
3085                 rc = send_search_entry( op, rs );
3086         }
3087         if ( op->ors_scope == LDAP_SCOPE_SUBTREE ) {
3088                 if ( ce->ce_kids ) {
3089                         rc = config_send( op, rs, ce->ce_kids, 1 );
3090                         if ( rc ) return rc;
3091                 }
3092                 if ( depth ) {
3093                         for (ce=ce->ce_sibs; ce; ce=ce->ce_sibs) {
3094                                 rc = config_send( op, rs, ce, 0 );
3095                                 if ( rc ) break;
3096                         }
3097                 }
3098         }
3099         return rc;
3100 }
3101
3102 static ConfigTable *
3103 config_find_table( CfOcInfo **colst, int nocs, AttributeDescription *ad )
3104 {
3105         int i, j;
3106
3107         for (j=0; j<nocs; j++) {
3108                 for (i=0; colst[j]->co_table[i].name; i++)
3109                         if ( colst[j]->co_table[i].ad == ad )
3110                                 return &colst[j]->co_table[i];
3111         }
3112         return NULL;
3113 }
3114
3115 /* Sort the attributes of the entry according to the order defined
3116  * in the objectclass, with required attributes occurring before
3117  * allowed attributes. For any attributes with sequencing dependencies
3118  * (e.g., rootDN must be defined after suffix) the objectclass must
3119  * list the attributes in the desired sequence.
3120  */
3121 static void
3122 sort_attrs( Entry *e, CfOcInfo **colst, int nocs )
3123 {
3124         Attribute *a, *head = NULL, *tail = NULL, **prev;
3125         int i, j;
3126
3127         for (i=0; i<nocs; i++) {
3128                 if ( colst[i]->co_oc->soc_required ) {
3129                         AttributeType **at = colst[i]->co_oc->soc_required;
3130                         for (j=0; at[j]; j++) {
3131                                 for (a=e->e_attrs, prev=&e->e_attrs; a;
3132                                         prev = &(*prev)->a_next, a=a->a_next) {
3133                                         if ( a->a_desc == at[j]->sat_ad ) {
3134                                                 *prev = a->a_next;
3135                                                 if (!head) {
3136                                                         head = a;
3137                                                         tail = a;
3138                                                 } else {
3139                                                         tail->a_next = a;
3140                                                         tail = a;
3141                                                 }
3142                                                 break;
3143                                         }
3144                                 }
3145                         }
3146                 }
3147                 if ( colst[i]->co_oc->soc_allowed ) {
3148                         AttributeType **at = colst[i]->co_oc->soc_allowed;
3149                         for (j=0; at[j]; j++) {
3150                                 for (a=e->e_attrs, prev=&e->e_attrs; a;
3151                                         prev = &(*prev)->a_next, a=a->a_next) {
3152                                         if ( a->a_desc == at[j]->sat_ad ) {
3153                                                 *prev = a->a_next;
3154                                                 if (!head) {
3155                                                         head = a;
3156                                                         tail = a;
3157                                                 } else {
3158                                                         tail->a_next = a;
3159                                                         tail = a;
3160                                                 }
3161                                                 break;
3162                                         }
3163                                 }
3164                         }
3165                 }
3166         }
3167         if ( tail ) {
3168                 tail->a_next = e->e_attrs;
3169                 e->e_attrs = head;
3170         }
3171 }
3172
3173 static int
3174 check_vals( ConfigTable *ct, ConfigArgs *ca, void *ptr, int isAttr )
3175 {
3176         Attribute *a = NULL;
3177         AttributeDescription *ad;
3178         BerVarray vals;
3179
3180         int i, rc = 0, sort = 0;
3181
3182         if ( isAttr ) {
3183                 a = ptr;
3184                 ad = a->a_desc;
3185                 vals = a->a_vals;
3186         } else {
3187                 Modifications *ml = ptr;
3188                 ad = ml->sml_desc;
3189                 vals = ml->sml_values;
3190         }
3191
3192         if ( a && ( ad->ad_type->sat_flags & SLAP_AT_ORDERED_VAL )) {
3193                 sort = 1;
3194                 rc = ordered_value_sort( a, 1 );
3195                 if ( rc )
3196                         return rc;
3197         }
3198         for ( i=0; vals[i].bv_val; i++ ) {
3199                 ca->line = vals[i].bv_val;
3200                 if ( sort ) {
3201                         char *idx = strchr( ca->line, '}' );
3202                         if ( idx ) ca->line = idx+1;
3203                 }
3204                 rc = config_parse_vals( ct, ca, i );
3205                 if ( rc )
3206                         break;
3207         }
3208         return rc;
3209 }
3210
3211 static int
3212 check_name_index( CfEntryInfo *parent, ConfigType ce_type, Entry *e,
3213         SlapReply *rs, int *renum )
3214 {
3215         CfEntryInfo *ce;
3216         int index = -1, gotindex = 0, nsibs;
3217         int renumber = 0, tailindex = 0;
3218         char *ptr1, *ptr2;
3219         struct berval rdn;
3220
3221         if ( renum ) *renum = 0;
3222
3223         /* These entries don't get indexed/renumbered */
3224         if ( ce_type == Cft_Global ) return 0;
3225         if ( ce_type == Cft_Schema && parent->ce_type == Cft_Global ) return 0;
3226
3227         if ( ce_type == Cft_Include || ce_type == Cft_Module )
3228                 tailindex = 1;
3229
3230         /* See if the rdn has an index already */
3231         dnRdn( &e->e_name, &rdn );
3232         ptr1 = strchr( e->e_name.bv_val, '{' );
3233         if ( ptr1 && ptr1 - e->e_name.bv_val < rdn.bv_len ) {
3234                 ptr2 = strchr( ptr1, '}' );
3235                 if (!ptr2 || ptr2 - e->e_name.bv_val > rdn.bv_len)
3236                         return LDAP_NAMING_VIOLATION;
3237                 if ( ptr2-ptr1 == 1)
3238                         return LDAP_NAMING_VIOLATION;
3239                 gotindex = 1;
3240                 index = atoi(ptr1+1);
3241                 if ( index < 0 )
3242                         return LDAP_NAMING_VIOLATION;
3243         }
3244
3245         /* count related kids */
3246         for (nsibs=0, ce=parent->ce_kids; ce; ce=ce->ce_sibs) {
3247                 if ( ce->ce_type == ce_type ) nsibs++;
3248         }
3249
3250         if ( index != nsibs ) {
3251                 if ( gotindex ) {
3252                         if ( index < nsibs ) {
3253                                 if ( tailindex ) return LDAP_NAMING_VIOLATION;
3254                                 /* Siblings need to be renumbered */
3255                                 renumber = 1;
3256                         }
3257                 }
3258                 if ( !renumber ) {
3259                         struct berval ival, newrdn, nnewrdn;
3260                         struct berval rtype, rval;
3261                         Attribute *a;
3262                         AttributeDescription *ad = NULL;
3263                         char ibuf[32];
3264                         const char *text;
3265
3266                         rval.bv_val = strchr(rdn.bv_val, '=' ) + 1;
3267                         rval.bv_len = rdn.bv_len - (rval.bv_val - rdn.bv_val);
3268                         rtype.bv_val = rdn.bv_val;
3269                         rtype.bv_len = rval.bv_val - rtype.bv_val - 1;
3270
3271                         /* Find attr */
3272                         slap_bv2ad( &rtype, &ad, &text );
3273                         a = attr_find( e->e_attrs, ad );
3274                         if (!a ) return LDAP_NAMING_VIOLATION;
3275
3276                         ival.bv_val = ibuf;
3277                         ival.bv_len = sprintf( ibuf, IFMT, nsibs );
3278
3279                         newrdn.bv_len = rdn.bv_len + ival.bv_len;
3280                         newrdn.bv_val = ch_malloc( newrdn.bv_len+1 );
3281
3282                         if ( tailindex ) {
3283                                 ptr1 = lutil_strncopy( newrdn.bv_val, rdn.bv_val, rdn.bv_len );
3284                                 ptr1 = lutil_strcopy( ptr1, ival.bv_val );
3285                         } else {
3286                                 int xlen;
3287                                 if ( !gotindex ) {
3288                                         ptr2 = rval.bv_val;
3289                                         xlen = rval.bv_len;
3290                                 } else {
3291                                         xlen = rdn.bv_len - (ptr2 - rdn.bv_val);
3292                                 }
3293                                 ptr1 = lutil_strncopy( newrdn.bv_val, rtype.bv_val,
3294                                         rtype.bv_len );
3295                                 *ptr1++ = '=';
3296                                 ptr1 = lutil_strcopy( ptr1, ival.bv_val );
3297                                 ptr1 = lutil_strncopy( ptr1, ptr2, xlen );
3298                                 *ptr1 = '\0';
3299                         }
3300
3301                         /* Do the equivalent of ModRDN */
3302                         /* Replace DN / NDN */
3303                         newrdn.bv_len = ptr1 - newrdn.bv_val;
3304                         rdnNormalize( 0, NULL, NULL, &newrdn, &nnewrdn, NULL );
3305                         free( e->e_name.bv_val );
3306                         build_new_dn( &e->e_name, &parent->ce_entry->e_name,
3307                                 &newrdn, NULL );
3308                         free( e->e_nname.bv_val );
3309                         build_new_dn( &e->e_nname, &parent->ce_entry->e_nname,
3310                                 &nnewrdn, NULL );
3311
3312                         /* Replace attr */
3313                         free( a->a_vals[0].bv_val );
3314                         ptr1 = strchr( newrdn.bv_val, '=' ) + 1;
3315                         a->a_vals[0].bv_len = newrdn.bv_len - (ptr1 - newrdn.bv_val);
3316                         a->a_vals[0].bv_val = ch_malloc( a->a_vals[0].bv_len + 1 );
3317                         strcpy( a->a_vals[0].bv_val, ptr1 );
3318
3319                         if ( a->a_nvals != a->a_vals ) {
3320                                 free( a->a_nvals[0].bv_val );
3321                                 ptr1 = strchr( nnewrdn.bv_val, '=' ) + 1;
3322                                 a->a_nvals[0].bv_len = nnewrdn.bv_len - (ptr1 - nnewrdn.bv_val);
3323                                 a->a_nvals[0].bv_val = ch_malloc( a->a_nvals[0].bv_len + 1 );
3324                                 strcpy( a->a_nvals[0].bv_val, ptr1 );
3325                         }
3326                         free( nnewrdn.bv_val );
3327                         free( newrdn.bv_val );
3328                 }
3329         }
3330         if ( renum ) *renum = renumber;
3331         return 0;
3332 }
3333
3334 static CfOcInfo **
3335 count_ocs( Attribute *oc_at, int *nocs )
3336 {
3337         int i, j, n;
3338         CfOcInfo co, *coptr, **colst;
3339
3340         /* count the objectclasses */
3341         for ( i=0; oc_at->a_nvals[i].bv_val; i++ );
3342         n = i;
3343         colst = (CfOcInfo **)ch_malloc( n * sizeof(CfOcInfo *));
3344
3345         for ( i=0, j=0; i<n; i++) {
3346                 co.co_name = &oc_at->a_nvals[i];
3347                 coptr = avl_find( CfOcTree, &co, CfOcInfo_cmp );
3348
3349                 /* ignore non-config objectclasses. probably should be
3350                  * an error, general data doesn't belong here.
3351                  */
3352                 if ( !coptr ) continue;
3353
3354                 /* Ignore the root objectclass, it has no implementation.
3355                  */
3356                 if ( coptr->co_type == Cft_Abstract ) continue;
3357                 colst[j++] = coptr;
3358         }
3359         *nocs = j;
3360         return colst;
3361 }
3362
3363         /* Only the root can be Cft_Global, everything else must
3364 /* Parse an LDAP entry into config directives */
3365 static int
3366 config_add_internal( CfBackInfo *cfb, Entry *e, SlapReply *rs, int *renum )
3367 {
3368         CfEntryInfo *ce, *last;
3369         CfOcInfo **colst;
3370         Attribute *a, *oc_at, *type_attr;
3371         AttributeDescription *type_ad = NULL;
3372         int i, j, nocs, rc;
3373         ConfigArgs ca = {0};
3374         struct berval pdn;
3375         ConfigTable *ct, *type_ct = NULL;
3376         char *ptr;
3377
3378         /* Make sure parent exists and entry does not */
3379         ce = config_find_base( cfb->cb_root, &e->e_nname, &last );
3380         if ( ce )
3381                 return LDAP_ALREADY_EXISTS;
3382
3383         dnParent( &e->e_nname, &pdn );
3384
3385         /* If last is NULL, the new entry is the root/suffix entry,
3386          * otherwise last should be the parent.
3387          */
3388         if ( last && !dn_match( &last->ce_entry->e_nname, &pdn )) {
3389                 if ( rs )
3390                         rs->sr_matched = last->ce_entry->e_name.bv_val;
3391                 return LDAP_NO_SUCH_OBJECT;
3392         }
3393
3394         oc_at = attr_find( e->e_attrs, slap_schema.si_ad_objectClass );
3395         if ( !oc_at ) return LDAP_OBJECT_CLASS_VIOLATION;
3396
3397         colst = count_ocs( oc_at, &nocs );
3398
3399         /* Only the root can be Cft_Global, everything else must
3400          * have a parent. Only limited nesting arrangements are allowed.
3401          */
3402         switch( colst[0]->co_type ) {
3403         case Cft_Global:
3404                 if ( last )  {
3405                         rc = LDAP_CONSTRAINT_VIOLATION;
3406                         goto leave;
3407                 }
3408                 break;
3409         case Cft_Schema:
3410         case Cft_Backend:
3411         case Cft_Database:
3412         case Cft_Include:
3413                 if ( !last || ( last->ce_type != Cft_Global &&
3414                         last->ce_type != colst[0]->co_type )) {
3415                         rc = LDAP_CONSTRAINT_VIOLATION;
3416                         goto leave;
3417                 }
3418                 break;
3419         case Cft_Overlay:
3420                 if ( !last || ( last->ce_type != Cft_Global &&
3421                         last->ce_type != Cft_Database &&
3422                         last->ce_type != colst[0]->co_type )) {
3423                         rc = LDAP_CONSTRAINT_VIOLATION;
3424                         goto leave;
3425                 }
3426                 break;
3427 #ifdef SLAPD_MODULES
3428         case Cft_Module:
3429                 if ( !last || last->ce_type != Cft_Global ) {
3430                         rc = LDAP_CONSTRAINT_VIOLATION;
3431                         goto leave;
3432                 }
3433 #endif
3434                 break;
3435         }
3436
3437         sort_attrs( e, colst, nocs );
3438
3439         /* Parse all the values and check for simple syntax errors before
3440          * performing any set actions.
3441          */
3442         switch (colst[0]->co_type) {
3443         case Cft_Schema:
3444                 /* The cn=schema entry is all hardcoded, so never reparse it */
3445                 if (last->ce_type == Cft_Global )
3446                         goto ok;
3447                 /* FALLTHRU */
3448         case Cft_Global:
3449                 ca.be = LDAP_STAILQ_FIRST(&backendDB);
3450                 break;
3451
3452         case Cft_Backend:
3453                 if ( last->ce_type == Cft_Backend )
3454                         ca.bi = last->ce_bi;
3455                 else
3456                         type_ad = cfAd_backend;
3457                 break;
3458         case Cft_Database:
3459                 if ( last->ce_type == Cft_Database ) {
3460                         ca.be = last->ce_be;
3461                 } else {
3462                         type_ad = cfAd_database;
3463                         /* dummy, just to get past check_attr */
3464                         ca.be = frontendDB;
3465                 }
3466                 break;
3467
3468         case Cft_Overlay:
3469                 ca.be = last->ce_be;
3470                 type_ad = cfAd_overlay;
3471                 break;
3472
3473         case Cft_Include:
3474                 if ( !rs ) {
3475                         nocs = 0; /* ignored */
3476                         break;
3477                 }
3478                 type_ad = cfAd_include;
3479                 break;
3480 #ifdef SLAPD_MODULES
3481         case Cft_Module: {
3482                 ModPaths *mp;
3483                 char *ptr;
3484                 ptr = strchr( e->e_name.bv_val, '{' );
3485                 if ( !ptr ) {
3486                         rc = LDAP_NAMING_VIOLATION;
3487                         goto leave;
3488                 }
3489                 j = atoi(ptr+1);
3490                 for (i=0, mp=&modpaths; mp && i<j; mp=mp->mp_next);
3491                 /* There is no corresponding modpath for this load? */
3492                 if ( i != j ) {
3493                         rc = LDAP_NAMING_VIOLATION;
3494                         goto leave;
3495                 }
3496                 module_path( mp->mp_path.bv_val );
3497                 ca.private = mp;
3498                 }
3499                 break;
3500 #endif
3501         }
3502
3503         /* If doing an LDAPadd, check for indexed names and any necessary
3504          * renaming/renumbering. Entries that don't need indexed names are
3505          * ignored. Entries that need an indexed name and arrive without one
3506          * are assigned to the end. Entries that arrive with an index may
3507          * cause the following entries to be renumbered/bumped down.
3508          *
3509          * Note that "pseudo-indexed" entries (cn=Include{xx}, cn=Module{xx})
3510          * don't allow Adding an entry with an index that's already in use.
3511          * This is flagged as an error (LDAP_ALREADY_EXISTS) up above.
3512          *
3513          * These entries can have auto-assigned indexes (appended to the end)
3514          * but only the other types support auto-renumbering of siblings.
3515          */
3516         rc = check_name_index( last, colst[0]->co_type, e, rs, renum );
3517         if ( rc )
3518                 goto leave;
3519
3520         init_config_argv( &ca );
3521         if ( type_ad ) {
3522                 type_attr = attr_find( e->e_attrs, type_ad );
3523                 if ( !type_attr ) {
3524                         rc = LDAP_OBJECT_CLASS_VIOLATION;
3525                         goto leave;
3526                 }
3527                 type_ct = config_find_table( colst, nocs, type_ad );
3528                 if ( !type_ct ) {
3529                         rc = LDAP_OBJECT_CLASS_VIOLATION;
3530                         goto leave;
3531                 }
3532                 rc = check_vals( type_ct, &ca, type_attr, 1);
3533                 if ( rc ) goto leave;
3534         }
3535         for ( a=e->e_attrs; a; a=a->a_next ) {
3536                 if ( a == type_attr || a == oc_at ) continue;
3537                 ct = config_find_table( colst, nocs, a->a_desc );
3538                 if ( !ct ) continue;    /* user data? */
3539                 rc = check_vals( ct, &ca, a, 1 );
3540                 if ( rc ) goto leave;
3541         }
3542
3543         /* Basic syntax checks are OK. Do the actual settings. */
3544         if ( type_ct ) {
3545                 ca.line = type_attr->a_vals[0].bv_val;
3546                 if ( type_ad->ad_type->sat_flags & SLAP_AT_ORDERED ) {
3547                         ptr = strchr( ca.line, '}' );
3548                         if ( ptr ) ca.line = ptr+1;
3549                 }
3550                 ca.valx = 0;
3551                 rc = config_parse_add( type_ct, &ca );
3552                 if ( rc ) {
3553                         rc = LDAP_OTHER;
3554                         goto leave;
3555                 }
3556         }
3557         for ( a=e->e_attrs; a; a=a->a_next ) {
3558                 if ( a == type_attr || a == oc_at ) continue;
3559                 ct = config_find_table( colst, nocs, a->a_desc );
3560                 if ( !ct ) continue;    /* user data? */
3561                 for (i=0; a->a_vals[i].bv_val; i++) {
3562                         ca.line = a->a_vals[i].bv_val;
3563                         if ( a->a_desc->ad_type->sat_flags & SLAP_AT_ORDERED ) {
3564                                 ptr = strchr( ca.line, '}' );
3565                                 if ( ptr ) ca.line = ptr+1;
3566                         }
3567                         ca.valx = i;
3568                         rc = config_parse_add( ct, &ca );
3569                         if ( rc ) {
3570                                 rc = LDAP_OTHER;
3571                                 goto leave;
3572                         }
3573                 }
3574         }
3575 ok:
3576         ce = ch_calloc( 1, sizeof(CfEntryInfo) );
3577         ce->ce_parent = last;
3578         ce->ce_entry = entry_dup( e );
3579         ce->ce_entry->e_private = ce;
3580         ce->ce_type = colst[0]->co_type;
3581         ce->ce_be = ca.be;
3582         ce->ce_bi = ca.bi;
3583         if ( !last ) {
3584                 cfb->cb_root = ce;
3585         } else if ( last->ce_kids ) {
3586                 CfEntryInfo *c2;
3587
3588                 for (c2=last->ce_kids; c2 && c2->ce_sibs; c2 = c2->ce_sibs);
3589
3590                 c2->ce_sibs = ce;
3591         } else {
3592                 last->ce_kids = ce;
3593         }
3594
3595 leave:
3596         ch_free( ca.argv );
3597         if ( colst ) ch_free( colst );
3598         return rc;
3599 }
3600
3601 /* Parse an LDAP entry into config directives, then store in underlying
3602  * database.
3603  */
3604 static int
3605 config_back_add( Operation *op, SlapReply *rs )
3606 {
3607         CfBackInfo *cfb;
3608         CfEntryInfo *ce, *last;
3609         int renumber;
3610
3611         if ( !be_isroot( op ) ) {
3612                 rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
3613                 goto out;
3614         }
3615
3616         cfb = (CfBackInfo *)op->o_bd->be_private;
3617
3618         ldap_pvt_thread_pool_pause( &connection_pool );
3619
3620         /* Strategy:
3621          * 1) check for existence of entry
3622          * 2) check for sibling renumbering
3623          * 3) perform internal add
3624          * 4) store entry in underlying database
3625          * 5) perform any necessary renumbering
3626          */
3627         rs->sr_err = config_add_internal( cfb, op->ora_e, rs, &renumber );
3628         if ( rs->sr_err == LDAP_SUCCESS && cfb->cb_use_ldif ) {
3629                 BackendDB *be = op->o_bd;
3630                 slap_callback sc = { NULL, slap_null_cb, NULL, NULL };
3631                 op->o_bd = &cfb->cb_db;
3632                 sc.sc_next = op->o_callback;
3633                 op->o_callback = &sc;
3634                 op->o_bd->be_add( op, rs );
3635                 op->o_bd = be;
3636                 op->o_callback = sc.sc_next;
3637         }
3638         if ( renumber ) {
3639         }
3640
3641         ldap_pvt_thread_pool_resume( &connection_pool );
3642
3643 out:
3644         send_ldap_result( op, rs );
3645         return rs->sr_err;
3646 }
3647
3648 typedef struct delrec {
3649         struct delrec *next;
3650         int nidx;
3651         int idx[0];
3652 } delrec;
3653
3654 static int
3655 config_modify_internal( CfEntryInfo *ce, Operation *op, SlapReply *rs,
3656         char *textbuf, int textsize )
3657 {
3658         CfBackInfo *cfb = (CfBackInfo *)op->o_bd->be_private;
3659         int rc = LDAP_UNWILLING_TO_PERFORM;
3660         Modifications *ml;
3661         Entry *e = ce->ce_entry;
3662         Attribute *save_attrs = e->e_attrs, *oc_at;
3663         ConfigArgs ca = {0};
3664         ConfigTable *ct;
3665         CfOcInfo **colst;
3666         int i, nocs;
3667         char *ptr;
3668         delrec *dels = NULL, *deltail = NULL;
3669
3670         oc_at = attr_find( e->e_attrs, slap_schema.si_ad_objectClass );
3671         if ( !oc_at ) return LDAP_OBJECT_CLASS_VIOLATION;
3672
3673         colst = count_ocs( oc_at, &nocs );
3674
3675         e->e_attrs = attrs_dup( e->e_attrs );
3676
3677         init_config_argv( &ca );
3678         ca.be = ce->ce_be;
3679         ca.bi = ce->ce_bi;
3680
3681         for (ml = op->orm_modlist; ml; ml=ml->sml_next) {
3682                 ct = config_find_table( colst, nocs, ml->sml_desc );
3683                 switch (ml->sml_op) {
3684                 case LDAP_MOD_DELETE:
3685                 case LDAP_MOD_REPLACE: {
3686                         BerVarray vals = NULL, nvals;
3687                         int *idx = NULL;
3688                         if ( ct && ( ct->arg_type & ARG_NO_DELETE )) {
3689                                 rc = LDAP_UNWILLING_TO_PERFORM;
3690                                 snprintf(textbuf, textsize, "cannot delete %s",
3691                                         ml->sml_desc );
3692                                 rs->sr_text = textbuf;
3693                                 goto out;
3694                         }
3695                         if ( ml->sml_op == LDAP_MOD_REPLACE ) {
3696                                 vals = ml->sml_values;
3697                                 nvals = ml->sml_nvalues;
3698                                 ml->sml_values = NULL;
3699                                 ml->sml_nvalues = NULL;
3700                         }
3701                         /* If we're deleting by values, remember the indexes of the
3702                          * values we deleted.
3703                          */
3704                         if ( ct && ml->sml_values ) {
3705                                 delrec *d;
3706                                 for (i=0; ml->sml_values[i].bv_val; i++);
3707                                 d = ch_malloc( sizeof(delrec) + i * sizeof(int));
3708                                 d->nidx = i;
3709                                 d->next = NULL;
3710                                 if ( dels ) {
3711                                         deltail->next = d;
3712                                 } else {
3713                                         dels = d;
3714                                 }
3715                                 deltail = d;
3716                                 idx = d->idx;
3717                         }
3718                         rc = modify_delete_vindex(e, &ml->sml_mod,
3719                                 get_permissiveModify(op),
3720                                 &rs->sr_text, textbuf, textsize, idx );
3721                         if ( ml->sml_op == LDAP_MOD_REPLACE ) {
3722                                 ml->sml_values = vals;
3723                                 ml->sml_nvalues = nvals;
3724                         }
3725                         if ( !vals )
3726                                 break;
3727                         }
3728                         /* FALLTHRU: LDAP_MOD_REPLACE && vals */
3729
3730                 case LDAP_MOD_ADD:
3731                 case SLAP_MOD_SOFTADD: {
3732                         int mop = ml->sml_op;
3733                         int navals = -1;
3734                         ml->sml_op = LDAP_MOD_ADD;
3735                         if ( ct ) {
3736                                 if ( ct->arg_type & ARG_NO_INSERT ) {
3737                                         Attribute *a = attr_find( e->e_attrs, ml->sml_desc );
3738                                         if ( a ) {
3739                                                 for (i = 0; a->a_vals[i].bv_val; i++ );
3740                                                 navals = i;
3741                                         }
3742                                 }
3743                                 for ( i=0; !BER_BVISNULL( &ml->sml_values[i] ); i++ ) {
3744                                         if ( ml->sml_values[i].bv_val[0] == '{' &&
3745                                                 navals >= 0 ) {
3746                                                 int j = strtol( ml->sml_values[i].bv_val+1, NULL, 0 );
3747                                                 if ( j < navals ) {
3748                                                         rc = LDAP_UNWILLING_TO_PERFORM;
3749                                                         snprintf(textbuf, textsize, "cannot insert %s",
3750                                                                 ml->sml_desc );
3751                                                         rs->sr_text = textbuf;
3752                                                         goto out;
3753                                                 }
3754                                         }
3755                                         rc = check_vals( ct, &ca, ml, 0 );
3756                                         if ( rc ) goto out;
3757                                 }
3758                         }
3759                         rc = modify_add_values(e, &ml->sml_mod,
3760                                    get_permissiveModify(op),
3761                                    &rs->sr_text, textbuf, textsize );
3762
3763                         /* If value already exists, show success here
3764                          * and ignore this operation down below.
3765                          */
3766                         if ( mop == SLAP_MOD_SOFTADD ) {
3767                                 if ( rc == LDAP_TYPE_OR_VALUE_EXISTS )
3768                                         rc = LDAP_SUCCESS;
3769                                 else
3770                                         mop = LDAP_MOD_ADD;
3771                         }
3772                         ml->sml_op = mop;
3773                         break;
3774                         }
3775
3776                         break;
3777                 case LDAP_MOD_INCREMENT:        /* FIXME */
3778                         break;
3779                 default:
3780                         break;
3781                 }
3782                 if(rc != LDAP_SUCCESS) break;
3783         }
3784
3785         if(rc == LDAP_SUCCESS) {
3786                 /* check that the entry still obeys the schema */
3787                 rc = entry_schema_check(op->o_bd, e, NULL,
3788                                   &rs->sr_text, textbuf, textsize );
3789         }
3790         if ( rc == LDAP_SUCCESS ) {
3791                 /* Basic syntax checks are OK. Do the actual settings. */
3792                 for ( ml = op->orm_modlist; ml; ml = ml->sml_next ) {
3793                         ct = config_find_table( colst, nocs, ml->sml_desc );
3794                         if ( !ct ) continue;
3795
3796                         switch (ml->sml_op) {
3797                         case LDAP_MOD_DELETE:
3798                         case LDAP_MOD_REPLACE: {
3799                                 BerVarray vals = NULL, nvals;
3800                                 Attribute *a;
3801                                 delrec *d = dels;
3802
3803                                 a = attr_find( e->e_attrs, ml->sml_desc );
3804
3805                                 if ( ml->sml_op == LDAP_MOD_REPLACE ) {
3806                                         vals = ml->sml_values;
3807                                         nvals = ml->sml_nvalues;
3808                                         ml->sml_values = NULL;
3809                                         ml->sml_nvalues = NULL;
3810                                 }
3811                                 /* If we didn't delete the whole attribute */
3812                                 if ( ml->sml_values && a ) {
3813                                         struct berval *mvals;
3814                                         int j;
3815
3816                                         if ( ml->sml_nvalues )
3817                                                 mvals = ml->sml_nvalues;
3818                                         else
3819                                                 mvals = ml->sml_values;
3820
3821                                         /* use the indexes we saved up above */
3822                                         for (i=0; i < d->nidx; i++) {
3823                                                 struct berval bv = *mvals++;
3824                                                 if ( a->a_desc->ad_type->sat_flags & SLAP_AT_ORDERED &&
3825                                                         bv.bv_val[0] == '{' ) {
3826                                                         ptr = strchr( bv.bv_val, '}' ) + 1;
3827                                                         bv.bv_len -= ptr - bv.bv_val;
3828                                                         bv.bv_val = ptr;
3829                                                 }
3830                                                 ca.line = bv.bv_val;
3831                                                 ca.valx = d->idx[i];
3832                                                 rc = config_del_vals( ct, &ca );
3833                                                 if ( rc != LDAP_SUCCESS ) break;
3834                                                 for (j=i+1; j < d->nidx; j++)
3835                                                         if ( d->idx[j] >d->idx[i] )
3836                                                                 d->idx[j]--;
3837                                         }
3838                                 } else {
3839                                         ca.valx = -1;
3840                                         ca.line = NULL;
3841                                         rc = config_del_vals( ct, &ca );
3842                                 }
3843                                 ch_free( dels );
3844                                 dels = d->next;
3845                                 if ( ml->sml_op == LDAP_MOD_REPLACE ) {
3846                                         ml->sml_values = vals;
3847                                         ml->sml_nvalues = nvals;
3848                                 }
3849                                 if ( !vals || rc != LDAP_SUCCESS )
3850                                         break;
3851                                 }
3852                                 /* FALLTHRU: LDAP_MOD_REPLACE && vals */
3853
3854                         case LDAP_MOD_ADD:
3855                                 for (i=0; ml->sml_values[i].bv_val; i++) {
3856                                         ca.line = ml->sml_values[i].bv_val;
3857                                         ca.valx = -1;
3858                                         if ( ml->sml_desc->ad_type->sat_flags & SLAP_AT_ORDERED &&
3859                                                 ca.line[0] == '{' ) {
3860                                                 ptr = strchr( ca.line, '}' );
3861                                                 if ( ptr ) {
3862                                                         ca.valx = strtol( ca.line+1, NULL, 0 );
3863                                                         ca.line = ptr+1;
3864                                                 }
3865                                         }
3866                                         rc = config_parse_add( ct, &ca );
3867                                         if ( rc ) {
3868                                                 rc = LDAP_OTHER;
3869                                                 goto out;
3870                                         }
3871                                 }
3872
3873                                 break;
3874                         }
3875                 }
3876         }
3877
3878 out:
3879         if ( rc == LDAP_SUCCESS ) {
3880                 attrs_free( save_attrs );
3881         } else {
3882                 attrs_free( e->e_attrs );
3883                 e->e_attrs = save_attrs;
3884         }
3885         ch_free( ca.argv );
3886         if ( colst ) ch_free( colst );
3887
3888         return rc;
3889 }
3890
3891 static int
3892 config_back_modify( Operation *op, SlapReply *rs )
3893 {
3894         CfBackInfo *cfb;
3895         CfEntryInfo *ce, *last;
3896         Modifications *ml;
3897         char textbuf[SLAP_TEXT_BUFLEN];
3898         struct berval rdn;
3899         char *ptr;
3900         AttributeDescription *rad = NULL;
3901
3902         if ( !be_isroot( op ) ) {
3903                 rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
3904                 goto out;
3905         }
3906
3907         cfb = (CfBackInfo *)op->o_bd->be_private;
3908
3909         ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last );
3910         if ( !ce ) {
3911                 if ( last )
3912                         rs->sr_matched = last->ce_entry->e_name.bv_val;
3913                 rs->sr_err = LDAP_NO_SUCH_OBJECT;
3914                 goto out;
3915         }
3916
3917         /* Get type of RDN */
3918         rdn = ce->ce_entry->e_nname;
3919         ptr = strchr( rdn.bv_val, '=' );
3920         rdn.bv_len = ptr - rdn.bv_val;
3921         slap_bv2ad( &rdn, &rad, &rs->sr_text );
3922
3923         /* Some basic validation... */
3924         for ( ml = op->orm_modlist; ml; ml = ml->sml_next ) {
3925                 /* Don't allow Modify of RDN; must use ModRdn for that. */
3926                 if ( ml->sml_desc == rad ) {
3927                         rs->sr_err = LDAP_NOT_ALLOWED_ON_RDN;
3928                         rs->sr_text = "Use modrdn to change the entry name";
3929                         goto out;
3930                 }
3931         }
3932
3933         ldap_pvt_thread_pool_pause( &connection_pool );
3934
3935         /* Strategy:
3936          * 1) perform the Modify on the cached Entry.
3937          * 2) verify that the Entry still satisfies the schema.
3938          * 3) perform the individual config operations.
3939          * 4) store Modified entry in underlying LDIF backend.
3940          */
3941         rs->sr_err = config_modify_internal( ce, op, rs, textbuf, sizeof(textbuf) );
3942         if ( rs->sr_err == LDAP_SUCCESS && cfb->cb_use_ldif ) {
3943                 BackendDB *be = op->o_bd;
3944                 slap_callback sc = { NULL, slap_null_cb, NULL, NULL };
3945                 op->o_bd = &cfb->cb_db;
3946                 sc.sc_next = op->o_callback;
3947                 op->o_callback = &sc;
3948                 op->o_bd->be_modify( op, rs );
3949                 op->o_bd = be;
3950                 op->o_callback = sc.sc_next;
3951         }
3952
3953         ldap_pvt_thread_pool_resume( &connection_pool );
3954 out:
3955         send_ldap_result( op, rs );
3956         return rs->sr_err;
3957 }
3958
3959 static int
3960 config_back_modrdn( Operation *op, SlapReply *rs )
3961 {
3962         CfBackInfo *cfb;
3963         CfEntryInfo *ce, *last;
3964
3965         if ( !be_isroot( op ) ) {
3966                 rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
3967                 goto out;
3968         }
3969
3970         cfb = (CfBackInfo *)op->o_bd->be_private;
3971
3972         ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last );
3973         if ( !ce ) {
3974                 if ( last )
3975                         rs->sr_matched = last->ce_entry->e_name.bv_val;
3976                 rs->sr_err = LDAP_NO_SUCH_OBJECT;
3977                 goto out;
3978         }
3979
3980         /* We don't allow moving objects to new parents.
3981          * Generally we only allow reordering a set of ordered entries.
3982          */
3983         if ( op->orr_newSup ) {
3984                 rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
3985                 goto out;
3986         }
3987         ldap_pvt_thread_pool_pause( &connection_pool );
3988
3989         ldap_pvt_thread_pool_resume( &connection_pool );
3990 out:
3991         send_ldap_result( op, rs );
3992         return rs->sr_err;
3993 }
3994
3995 static int
3996 config_back_search( Operation *op, SlapReply *rs )
3997 {
3998         CfBackInfo *cfb;
3999         CfEntryInfo *ce, *last;
4000         int rc;
4001
4002         if ( !be_isroot( op ) ) {
4003                 rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
4004                 goto out;
4005         }
4006
4007         cfb = (CfBackInfo *)op->o_bd->be_private;
4008
4009         ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last );
4010         if ( !ce ) {
4011                 if ( last )
4012                         rs->sr_matched = last->ce_entry->e_name.bv_val;
4013                 rs->sr_err = LDAP_NO_SUCH_OBJECT;
4014                 goto out;
4015         }
4016         switch ( op->ors_scope ) {
4017         case LDAP_SCOPE_BASE:
4018         case LDAP_SCOPE_SUBTREE:
4019                 config_send( op, rs, ce, 0 );
4020                 break;
4021
4022         case LDAP_SCOPE_ONELEVEL:
4023                 for (ce = ce->ce_kids; ce; ce=ce->ce_sibs) {
4024                         config_send( op, rs, ce, 1 );
4025                 }
4026                 break;
4027         }
4028
4029         rs->sr_err = LDAP_SUCCESS;
4030 out:
4031         send_ldap_result( op, rs );
4032         return 0;
4033 }
4034
4035 static Entry *
4036 config_alloc_entry( CfEntryInfo *parent, struct berval *rdn )
4037 {
4038         Entry *e = ch_calloc( 1, sizeof(Entry) );
4039         CfEntryInfo *ce = ch_calloc( 1, sizeof(CfEntryInfo) );
4040         struct berval pdn;
4041
4042         e->e_private = ce;
4043         ce->ce_entry = e;
4044         ce->ce_parent = parent;
4045         if ( parent ) {
4046                 pdn = parent->ce_entry->e_nname;
4047         } else {
4048                 BER_BVZERO( &pdn );
4049         }
4050
4051         build_new_dn( &e->e_name, &pdn, rdn, NULL );
4052         ber_dupbv( &e->e_nname, &e->e_name );
4053         return e;
4054 }
4055
4056 #define NO_TABLE        0
4057 #define BI_TABLE        1
4058 #define BE_TABLE        2
4059
4060 static int
4061 config_build_entry( ConfigArgs *c, Entry *e, ObjectClass *oc,
4062          struct berval *rdn, ConfigTable *ct, int table )
4063 {
4064         struct berval vals[2];
4065         struct berval ad_name;
4066         AttributeDescription *ad = NULL;
4067         int rc, i;
4068         char *ptr;
4069         const char *text;
4070         char textbuf[SLAP_TEXT_BUFLEN];
4071         size_t textlen = sizeof(textbuf);
4072         AttributeType **at;
4073         Attribute *oc_at;
4074
4075         BER_BVZERO( &vals[1] );
4076
4077         vals[0] = oc->soc_cname;
4078         attr_merge_normalize(e, slap_schema.si_ad_objectClass, vals, NULL );
4079         ptr = strchr(rdn->bv_val, '=');
4080         ad_name.bv_val = rdn->bv_val;
4081         ad_name.bv_len = ptr - rdn->bv_val;
4082         rc = slap_bv2ad( &ad_name, &ad, &text );
4083         if ( rc ) {
4084                 return rc;
4085         }
4086         vals[0].bv_val = ptr+1;
4087         vals[0].bv_len = rdn->bv_len - (vals[0].bv_val - rdn->bv_val);
4088         attr_merge_normalize(e, ad, vals, NULL );
4089
4090         for (at=oc->soc_required; at && *at; at++) {
4091                 /* Skip the naming attr */
4092                 if ((*at)->sat_ad == ad || (*at)->sat_ad == slap_schema.si_ad_cn )
4093                         continue;
4094                 for (i=0;ct[i].name;i++) {
4095                         if (ct[i].ad == (*at)->sat_ad) {
4096                                 rc = config_get_vals(&ct[i], c);
4097                                 if (rc == LDAP_SUCCESS) {
4098                                         if ( c->rvalue_nvals )
4099                                                 attr_merge(e, ct[i].ad, c->rvalue_vals,
4100                                                         c->rvalue_nvals);
4101                                         else
4102                                                 attr_merge_normalize(e, ct[i].ad,
4103                                                         c->rvalue_vals, NULL);
4104                                         ber_bvarray_free( c->rvalue_nvals );
4105                                         ber_bvarray_free( c->rvalue_vals );
4106                                 }
4107                                 break;
4108                         }
4109                 }
4110         }
4111
4112         for (at=oc->soc_allowed; at && *at; at++) {
4113                 /* Skip the naming attr */
4114                 if ((*at)->sat_ad == ad || (*at)->sat_ad == slap_schema.si_ad_cn )
4115                         continue;
4116                 for (i=0;ct[i].name;i++) {
4117                         if (ct[i].ad == (*at)->sat_ad) {
4118                                 rc = config_get_vals(&ct[i], c);
4119                                 if (rc == LDAP_SUCCESS) {
4120                                         if ( c->rvalue_nvals )
4121                                                 attr_merge(e, ct[i].ad, c->rvalue_vals, c->rvalue_nvals);
4122                                         else
4123                                                 attr_merge_normalize(e, ct[i].ad, c->rvalue_vals, NULL);
4124                                         ber_bvarray_free( c->rvalue_nvals );
4125                                         ber_bvarray_free( c->rvalue_vals );
4126                                 }
4127                                 break;
4128                         }
4129                 }
4130         }
4131
4132         if ( table ) {
4133                 if ( table == BI_TABLE )
4134                         ct = c->bi->bi_cf_table;
4135                 else
4136                         ct = c->be->be_cf_table;
4137                 for (;ct && ct->name;ct++) {
4138                         if (!ct->ad) continue;
4139                         rc = config_get_vals(ct, c);
4140                         if (rc == LDAP_SUCCESS) {
4141                                 if ( c->rvalue_nvals )
4142                                         attr_merge(e, ct->ad, c->rvalue_vals, c->rvalue_nvals);
4143                                 else
4144                                         attr_merge_normalize(e, ct->ad, c->rvalue_vals, NULL);
4145                         }
4146                 }
4147         }
4148         oc_at = attr_find( e->e_attrs, slap_schema.si_ad_objectClass );
4149         rc = structural_class(oc_at->a_vals, vals, NULL, &text, textbuf, textlen);
4150         BER_BVZERO( &vals[1] );
4151         attr_merge_normalize(e, slap_schema.si_ad_structuralObjectClass, vals, NULL );
4152
4153         return 0;
4154 }
4155
4156 static void
4157 config_build_schema_inc( ConfigArgs *c, CfEntryInfo *ceparent,
4158         Operation *op, SlapReply *rs )
4159 {
4160         Entry *e;
4161         ConfigFile *cf = c->private;
4162         CfEntryInfo *ce, *ceprev;
4163         char *ptr;
4164         struct berval bv;
4165
4166         if ( ceparent->ce_kids ) {
4167                 for ( ceprev = ceparent->ce_kids; ceprev->ce_sibs;
4168                         ceprev = ceprev->ce_sibs );
4169         }
4170
4171         for (; cf; cf=cf->c_sibs, c->depth++) {
4172                 c->value_dn.bv_val = c->log;
4173                 bv.bv_val = strrchr(cf->c_file.bv_val, LDAP_DIRSEP[0]);
4174                 if ( !bv.bv_val ) {
4175                         bv = cf->c_file;
4176                 } else {
4177                         bv.bv_val++;
4178                         bv.bv_len = cf->c_file.bv_len - (bv.bv_val - cf->c_file.bv_val);
4179                 }
4180                 ptr = strchr( bv.bv_val, '.' );
4181                 if ( ptr )
4182                         bv.bv_len = ptr - bv.bv_val;
4183                 c->value_dn.bv_len = sprintf(c->value_dn.bv_val, "cn=" IFMT, c->depth);
4184                 strncpy( c->value_dn.bv_val + c->value_dn.bv_len, bv.bv_val,
4185                         bv.bv_len );
4186                 c->value_dn.bv_len += bv.bv_len;
4187                 c->value_dn.bv_val[c->value_dn.bv_len] ='\0';
4188
4189                 e = config_alloc_entry( ceparent, &c->value_dn );
4190                 c->private = cf;
4191                 config_build_entry( c, e, cfOc_schema, &c->value_dn,
4192                         c->bi->bi_cf_table, NO_TABLE );
4193                 ce = e->e_private;
4194                 ce->ce_type = Cft_Schema;
4195                 if ( op ) {
4196                         op->ora_e = e;
4197                         op->o_bd->be_add( op, rs );
4198                 }
4199                 ce->ce_bi = c->bi;
4200                 if ( !ceparent->ce_kids ) {
4201                         ceparent->ce_kids = ce;
4202                 } else {
4203                         ceprev->ce_sibs = ce;
4204                 }
4205                 ceprev = ce;
4206                 if ( cf->c_kids ) {
4207                         c->private = cf->c_kids;
4208                         config_build_schema_inc( c, ceparent, op, rs );
4209                 }
4210         }
4211 }
4212
4213 static CfEntryInfo *
4214 config_build_includes( ConfigArgs *c, CfEntryInfo *ceparent,
4215         Operation *op, SlapReply *rs )
4216 {
4217         Entry *e;
4218         int i;
4219         ConfigFile *cf = c->private;
4220         CfEntryInfo *ce, *ceprev;
4221
4222         if ( ceparent->ce_kids ) {
4223                 for ( ceprev = ceparent->ce_kids; ceprev->ce_sibs;
4224                         ceprev = ceprev->ce_sibs );
4225         }
4226
4227         for (i=0; cf; cf=cf->c_sibs, i++) {
4228                 c->value_dn.bv_val = c->log;
4229                 c->value_dn.bv_len = sprintf(c->value_dn.bv_val, "cn=include" IFMT, i);
4230                 e = config_alloc_entry( ceparent, &c->value_dn );
4231                 c->private = cf;
4232                 config_build_entry( c, e, cfOc_include, &c->value_dn,
4233                         c->bi->bi_cf_table, NO_TABLE );
4234                 if ( op ) {
4235                         op->ora_e = e;
4236                         op->o_bd->be_add( op, rs );
4237                 }
4238                 ce = e->e_private;
4239                 ce->ce_type = Cft_Include;
4240                 ce->ce_bi = c->bi;
4241                 if ( !ceparent->ce_kids ) {
4242                         ceparent->ce_kids = ce;
4243                 } else {
4244                         ceprev->ce_sibs = ce;
4245                 }
4246                 ceprev = ce;
4247                 if ( cf->c_kids ) {
4248                         c->private = cf->c_kids;
4249                         config_build_includes( c, ce, op, rs );
4250                 }
4251         }
4252         return ce;
4253 }
4254
4255 #ifdef SLAPD_MODULES
4256
4257 static CfEntryInfo *
4258 config_build_modules( ConfigArgs *c, CfEntryInfo *ceparent,
4259         Operation *op, SlapReply *rs )
4260 {
4261         Entry *e;
4262         int i;
4263         CfEntryInfo *ce, *ceprev;
4264         ModPaths *mp;
4265
4266         if ( ceparent->ce_kids ) {
4267                 for ( ceprev = ceparent->ce_kids; ceprev->ce_sibs;
4268                         ceprev = ceprev->ce_sibs );
4269         }
4270
4271         for (i=0, mp=&modpaths; mp; mp=mp->mp_next, i++) {
4272                 if ( BER_BVISNULL( &mp->mp_path ) && !mp->mp_loads )
4273                         continue;
4274                 c->value_dn.bv_val = c->log;
4275                 c->value_dn.bv_len = sprintf(c->value_dn.bv_val, "cn=module" IFMT, i);
4276                 e = config_alloc_entry( ceparent, &c->value_dn );
4277                 ce = e->e_private;
4278                 ce->ce_type = Cft_Include;
4279                 c->private = mp;
4280                 config_build_entry( c, e, cfOc_module, &c->value_dn,
4281                         c->bi->bi_cf_table, NO_TABLE );
4282                 if ( op ) {
4283                         op->ora_e = e;
4284                         op->o_bd->be_add( op, rs );
4285                 }
4286                 ce->ce_bi = c->bi;
4287                 if ( !ceparent->ce_kids ) {
4288                         ceparent->ce_kids = ce;
4289                 } else {
4290                         ceprev->ce_sibs = ce;
4291                 }
4292                 ceprev = ce;
4293         }
4294         return ce;
4295 }
4296 #endif
4297
4298 static int
4299 config_back_db_open( BackendDB *be )
4300 {
4301         CfBackInfo *cfb = be->be_private;
4302         struct berval rdn;
4303         Entry *e, *parent;
4304         CfEntryInfo *ce, *ceparent, *ceprev;
4305         int i, rc;
4306         BackendInfo *bi;
4307         BackendDB *bptr;
4308         ConfigArgs c;
4309         ConfigTable *ct;
4310         Connection conn = {0};
4311         char opbuf[OPERATION_BUFFER_SIZE];
4312         Operation *op;
4313         slap_callback cb = { NULL, slap_null_cb, NULL, NULL };
4314         SlapReply rs = {REP_RESULT};
4315
4316         /* If we read the config from back-ldif, nothing to do here */
4317         if ( cfb->cb_got_ldif )
4318                 return 0;
4319
4320         if ( cfb->cb_use_ldif ) {
4321                 op = (Operation *)opbuf;
4322                 connection_fake_init( &conn, op, cfb );
4323
4324                 op->o_dn = be->be_rootdn;
4325                 op->o_ndn = be->be_rootndn;
4326
4327                 op->o_tag = LDAP_REQ_ADD;
4328                 op->o_callback = &cb;
4329                 op->o_bd = &cfb->cb_db;
4330         } else {
4331                 op = NULL;
4332         }
4333
4334         /* create root of tree */
4335         rdn = config_rdn;
4336         e = config_alloc_entry( NULL, &rdn );
4337         ce = e->e_private;
4338         ce->ce_type = Cft_Global;
4339         cfb->cb_root = ce;
4340         c.be = be;
4341         c.bi = be->bd_info;
4342         c.private = cfb->cb_config;
4343         ct = c.bi->bi_cf_table;
4344         config_build_entry( &c, e, cfOc_global, &rdn, ct, NO_TABLE );
4345         if ( op ) {
4346                 op->ora_e = e;
4347                 op->o_bd->be_add( op, &rs );
4348         }
4349         ce->ce_bi = c.bi;
4350
4351         parent = e;
4352         ceparent = ce;
4353
4354         /* Create schema nodes... cn=schema will contain the hardcoded core
4355          * schema, read-only. Child objects will contain runtime loaded schema
4356          * files.
4357          */
4358         rdn = schema_rdn;
4359         e = config_alloc_entry( ceparent, &rdn );
4360         ce = e->e_private;
4361         ce->ce_type = Cft_Schema;
4362         c.private = NULL;
4363         config_build_entry( &c, e, cfOc_schema, &rdn, ct, NO_TABLE );
4364         if ( op ) {
4365                 op->ora_e = e;
4366                 op->o_bd->be_add( op, &rs );
4367         }
4368         if ( !ceparent->ce_kids ) {
4369                 ceparent->ce_kids = ce;
4370         } else {
4371                 ceprev->ce_sibs = ce;
4372         }
4373         ceprev = ce;
4374
4375         /* Create includeFile nodes and schema nodes for included schema... */
4376         if ( cfb->cb_config->c_kids ) {
4377                 c.depth = 0;
4378                 c.private = cfb->cb_config->c_kids;
4379                 config_build_schema_inc( &c, ce, op, &rs );
4380                 c.private = cfb->cb_config->c_kids;
4381                 ceprev = config_build_includes( &c, ceparent, op, &rs );
4382         }
4383
4384 #ifdef SLAPD_MODULES
4385         /* Create Module nodes... */
4386         if ( modpaths.mp_loads ) {
4387                 ceprev = config_build_modules( &c, ceparent, op, &rs );
4388         }
4389 #endif
4390
4391         /* Create backend nodes. Skip if they don't provide a cf_table.
4392          * There usually aren't any of these.
4393          */
4394
4395         c.line = 0;
4396         LDAP_STAILQ_FOREACH( bi, &backendInfo, bi_next) {
4397                 if (!bi->bi_cf_table) continue;
4398                 if (!bi->bi_private) continue;
4399
4400                 rdn.bv_val = c.log;
4401                 rdn.bv_len = sprintf(rdn.bv_val, "%s=%s", cfAd_backend->ad_cname.bv_val, bi->bi_type);
4402                 e = config_alloc_entry( ceparent, &rdn );
4403                 ce = e->e_private;
4404                 ce->ce_type = Cft_Backend;
4405                 ce->ce_bi = bi;
4406                 c.bi = bi;
4407                 config_build_entry( &c, e, cfOc_backend, &rdn, ct, BI_TABLE );
4408                 if ( op ) {
4409                         op->ora_e = e;
4410                         op->o_bd->be_add( op, &rs );
4411                 }
4412                 if ( !ceparent->ce_kids ) {
4413                         ceparent->ce_kids = ce;
4414                 } else {
4415                         ceprev->ce_sibs = ce;
4416                 }
4417                 ceprev = ce;
4418         }
4419
4420         /* Create database nodes... */
4421         i = -1;
4422         LDAP_STAILQ_FOREACH( be, &backendDB, be_next ) {
4423                 slap_overinfo *oi = NULL;
4424                 i++;
4425                 if ( i == 0 ) {
4426                         bptr = frontendDB;
4427                 } else {
4428                         bptr = be;
4429                 }
4430                 if ( overlay_is_over( bptr )) {
4431                         oi = bptr->bd_info->bi_private;
4432                         bi = oi->oi_orig;
4433                 } else {
4434                         bi = bptr->bd_info;
4435                 }
4436                 rdn.bv_val = c.log;
4437                 rdn.bv_len = sprintf(rdn.bv_val, "%s=" IFMT "%s", cfAd_database->ad_cname.bv_val,
4438                         i, bi->bi_type);
4439                 e = config_alloc_entry( ceparent, &rdn );
4440                 ce = e->e_private;
4441                 c.be = bptr;
4442                 c.bi = bi;
4443                 ce->ce_type = Cft_Database;
4444                 ce->ce_be = c.be;
4445                 ce->ce_bi = c.bi;
4446                 config_build_entry( &c, e, cfOc_database, &rdn, ct, BE_TABLE );
4447                 if ( op ) {
4448                         op->ora_e = e;
4449                         op->o_bd->be_add( op, &rs );
4450                 }
4451                 if ( !ceparent->ce_kids ) {
4452                         ceparent->ce_kids = ce;
4453                 } else {
4454                         ceprev->ce_sibs = ce;
4455                 }
4456                 ceprev = ce;
4457                 /* Iterate through overlays */
4458                 if ( oi ) {
4459                         slap_overinst *on;
4460                         Entry *oe;
4461                         CfEntryInfo *opar = ce, *oprev = NULL;
4462                         int j;
4463
4464                         for (j=0,on=oi->oi_list; on; j++,on=on->on_next) {
4465                                 rdn.bv_val = c.log;
4466                                 rdn.bv_len = sprintf(rdn.bv_val, "%s=" IFMT "%s",
4467                                         cfAd_overlay->ad_cname.bv_val, j, on->on_bi.bi_type );
4468                                 oe = config_alloc_entry( opar, &rdn );
4469                                 ce = oe->e_private;
4470                                 c.be = bptr;
4471                                 c.bi = &on->on_bi;
4472                                 ce->ce_type = Cft_Overlay;
4473                                 ce->ce_be = c.be;
4474                                 ce->ce_bi = c.bi;
4475                                 config_build_entry( &c, oe, cfOc_overlay, &rdn, ct, BI_TABLE );
4476                                 if ( op ) {
4477                                         op->ora_e = oe;
4478                                         op->o_bd->be_add( op, &rs );
4479                                 }
4480                                 if ( !opar->ce_kids ) {
4481                                         opar->ce_kids = ce;
4482                                 } else {
4483                                         oprev->ce_sibs = ce;
4484                                 }
4485                                 oprev = ce;
4486                         }
4487                 }
4488         }
4489
4490         return 0;
4491 }
4492
4493 static int
4494 config_back_db_destroy( Backend *be )
4495 {
4496         free( be->be_private );
4497         return 0;
4498 }
4499
4500 static int
4501 config_back_db_init( Backend *be )
4502 {
4503         struct berval dn;
4504         CfBackInfo *cfb;
4505
4506         cfb = ch_calloc( 1, sizeof(CfBackInfo));
4507         cfb->cb_config = &cf_prv;
4508         be->be_private = cfb;
4509
4510         ber_dupbv( &be->be_rootdn, &config_rdn );
4511         ber_dupbv( &be->be_rootndn, &be->be_rootdn );
4512         ber_dupbv( &dn, &be->be_rootdn );
4513         ber_bvarray_add( &be->be_suffix, &dn );
4514         ber_dupbv( &dn, &be->be_rootdn );
4515         ber_bvarray_add( &be->be_nsuffix, &dn );
4516
4517         /* Hide from namingContexts */
4518         SLAP_BFLAGS(be) |= SLAP_BFLAG_CONFIG;
4519
4520         return 0;
4521 }
4522
4523 static int
4524 config_back_destroy( BackendInfo *bi )
4525 {
4526         ldif_must_b64_encode_release();
4527         return 0;
4528 }
4529
4530 static struct {
4531         char *name;
4532         AttributeDescription **desc;
4533 } ads[] = {
4534         { "backend", &cfAd_backend },
4535         { "database", &cfAd_database },
4536         { "include", &cfAd_include },
4537         { "overlay", &cfAd_overlay },
4538         { NULL, NULL }
4539 };
4540
4541 /* Notes:
4542  *   add / delete: all types that may be added or deleted must use an
4543  * X-ORDERED attributeType for their RDN. Adding and deleting entries
4544  * should automatically renumber the index of any siblings as needed,
4545  * so that no gaps in the numbering sequence exist after the add/delete
4546  * is completed.
4547  *   What can be added:
4548  *     schema objects
4549  *     backend objects for backend-specific config directives
4550  *     database objects
4551  *     overlay objects
4552  *
4553  *   delete: probably no support this time around.
4554  *
4555  *   modrdn: generally not done. Will be invoked automatically by add/
4556  * delete to update numbering sequence. Perform as an explicit operation
4557  * so that the renumbering effect may be replicated. Subtree rename must
4558  * be supported, since renumbering a database will affect all its child
4559  * overlays.
4560  *
4561  *  modify: must be fully supported.
4562  */
4563
4564 int
4565 config_back_initialize( BackendInfo *bi )
4566 {
4567         ConfigTable             *ct = config_back_cf_table;
4568         char                    *argv[4];
4569         int                     i;
4570         AttributeDescription    *ad = NULL;
4571         const char              *text;
4572         static char             *controls[] = {
4573                 LDAP_CONTROL_MANAGEDSAIT,
4574                 NULL
4575         };
4576
4577         bi->bi_controls = controls;
4578
4579         bi->bi_open = 0;
4580         bi->bi_close = 0;
4581         bi->bi_config = 0;
4582         bi->bi_destroy = config_back_destroy;
4583
4584         bi->bi_db_init = config_back_db_init;
4585         bi->bi_db_config = 0;
4586         bi->bi_db_open = config_back_db_open;
4587         bi->bi_db_close = 0;
4588         bi->bi_db_destroy = config_back_db_destroy;
4589
4590         bi->bi_op_bind = config_back_bind;
4591         bi->bi_op_unbind = 0;
4592         bi->bi_op_search = config_back_search;
4593         bi->bi_op_compare = 0;
4594         bi->bi_op_modify = config_back_modify;
4595         bi->bi_op_modrdn = config_back_modrdn;
4596         bi->bi_op_add = config_back_add;
4597         bi->bi_op_delete = 0;
4598         bi->bi_op_abandon = 0;
4599
4600         bi->bi_extended = 0;
4601
4602         bi->bi_chk_referrals = 0;
4603
4604 #ifdef SLAP_OVERLAY_ACCESS
4605         bi->bi_access_allowed = slap_access_always_allowed;
4606 #endif /* SLAP_OVERLAY_ACCESS */
4607
4608         bi->bi_connection_init = 0;
4609         bi->bi_connection_destroy = 0;
4610
4611         argv[3] = NULL;
4612         for (i=0; OidMacros[i].name; i++ ) {
4613                 argv[1] = OidMacros[i].name;
4614                 argv[2] = OidMacros[i].oid;
4615                 parse_oidm( "slapd", i, 3, argv, 0, NULL );
4616         }
4617
4618         bi->bi_cf_table = ct;
4619
4620         i = config_register_schema( ct, cf_ocs );
4621         if ( i ) return i;
4622
4623         /* setup olcRootPW to be base64-encoded when written in LDIF form;
4624          * basically, we don't care if it fails */
4625         i = slap_str2ad( "olcRootPW", &ad, &text );
4626         if ( i ) {
4627                 Debug( LDAP_DEBUG_ANY, "config_back_initialize: "
4628                         "warning, unable to get \"olcRootPW\" "
4629                         "attribute description: %d: %s\n",
4630                         i, text, 0 );
4631         } else {
4632                 (void)ldif_must_b64_encode_register( ad->ad_cname.bv_val,
4633                         ad->ad_type->sat_oid );
4634         }
4635
4636         /* set up the notable AttributeDescriptions */
4637         i = 0;
4638         for (;ct->name;ct++) {
4639                 if (strcmp(ct->name, ads[i].name)) continue;
4640                 *ads[i].desc = ct->ad;
4641                 i++;
4642                 if (!ads[i].name) break;
4643         }
4644
4645         return 0;
4646 }
4647