git.sur5r.net Git - openldap/blob - servers/slapd/bconfig.c

   1 /* bconfig.c - the config backend */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 2005 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* ACKNOWLEDGEMENTS:
  17  * This work was originally developed by Howard Chu for inclusion
  18  * in OpenLDAP Software.
  19  */
  20
  21 #include "portable.h"
  22
  23 #include <stdio.h>
  24 #include <ac/string.h>
  25 #include <ac/ctype.h>
  26 #include <ac/errno.h>
  27 #include <sys/stat.h>
  28
  29 #include "slap.h"
  30
  31 #ifdef LDAP_SLAPI
  32 #include "slapi/slapi.h"
  33 #endif
  34
  35 #include <lutil.h>
  36
  37 #include "config.h"
  38
  39 static struct berval config_rdn = BER_BVC("cn=config");
  40 static struct berval schema_rdn = BER_BVC("cn=schema");
  41
  42 #define IFMT    "{%d}"
  43
  44 #ifdef SLAPD_MODULES
  45 typedef struct modpath_s {
  46         struct modpath_s *mp_next;
  47         struct berval mp_path;
  48         BerVarray mp_loads;
  49 } ModPaths;
  50
  51 static ModPaths modpaths, *modlast = &modpaths, *modcur = &modpaths;
  52 #endif
  53
  54 typedef struct ConfigFile {
  55         struct ConfigFile *c_sibs;
  56         struct ConfigFile *c_kids;
  57         struct berval c_file;
  58         AttributeType *c_at_head, *c_at_tail;
  59         ContentRule *c_cr_head, *c_cr_tail;
  60         ObjectClass *c_oc_head, *c_oc_tail;
  61         OidMacro *c_om_head, *c_om_tail;
  62         BerVarray c_dseFiles;
  63 } ConfigFile;
  64
  65 typedef struct CfOcInfo {
  66         struct berval *co_name;
  67         ConfigTable *co_table;
  68         ConfigType co_type;
  69         ObjectClass *co_oc;
  70 } CfOcInfo;
  71
  72 typedef struct CfEntryInfo {
  73         struct CfEntryInfo *ce_parent;
  74         struct CfEntryInfo *ce_sibs;
  75         struct CfEntryInfo *ce_kids;
  76         Entry *ce_entry;
  77         ConfigType ce_type;
  78         BackendInfo *ce_bi;
  79         BackendDB *ce_be;
  80 } CfEntryInfo;
  81
  82 typedef struct {
  83         ConfigFile *cb_config;
  84         CfEntryInfo *cb_root;
  85         BackendDB       cb_db;  /* underlying database */
  86         int             cb_got_ldif;
  87         int             cb_use_ldif;
  88 } CfBackInfo;
  89
  90 /* These do nothing in slapd, they're kept only to make them
  91  * editable here.
  92  */
  93 static char *replica_pidFile, *replica_argsFile;
  94 static int replicationInterval;
  95
  96 static char     *passwd_salt;
  97 static char     *logfileName;
  98 static BerVarray authz_rewrites;
  99
 100 static struct berval cfdir;
 101
 102 /* Private state */
 103 static AttributeDescription *cfAd_backend, *cfAd_database, *cfAd_overlay,
 104         *cfAd_include;
 105
 106 static ObjectClass *cfOc_schema, *cfOc_global, *cfOc_backend, *cfOc_database,
 107         *cfOc_include, *cfOc_overlay, *cfOc_module;
 108
 109 static ConfigFile cf_prv, *cfn = &cf_prv;
 110
 111 static Avlnode *CfOcTree;
 112
 113 static int config_add_internal( CfBackInfo *cfb, Entry *e, SlapReply *rs,
 114         int *renumber );
 115
 116 static ConfigDriver config_fname;
 117 static ConfigDriver config_cfdir;
 118 static ConfigDriver config_generic;
 119 static ConfigDriver config_search_base;
 120 static ConfigDriver config_passwd_hash;
 121 static ConfigDriver config_schema_dn;
 122 static ConfigDriver config_sizelimit;
 123 static ConfigDriver config_timelimit;
 124 static ConfigDriver config_limits;
 125 static ConfigDriver config_overlay;
 126 static ConfigDriver config_suffix;
 127 static ConfigDriver config_deref_depth;
 128 static ConfigDriver config_rootdn;
 129 static ConfigDriver config_rootpw;
 130 static ConfigDriver config_restrict;
 131 static ConfigDriver config_allows;
 132 static ConfigDriver config_disallows;
 133 static ConfigDriver config_requires;
 134 static ConfigDriver config_security;
 135 static ConfigDriver config_referral;
 136 static ConfigDriver config_loglevel;
 137 static ConfigDriver config_replica;
 138 static ConfigDriver config_updatedn;
 139 static ConfigDriver config_updateref;
 140 static ConfigDriver config_include;
 141 #ifdef HAVE_TLS
 142 static ConfigDriver config_tls_option;
 143 static ConfigDriver config_tls_config;
 144 #endif
 145 extern ConfigDriver syncrepl_config;
 146
 147 enum {
 148         CFG_ACL = 1,
 149         CFG_BACKEND,
 150         CFG_DATABASE,
 151         CFG_TLS_RAND,
 152         CFG_TLS_CIPHER,
 153         CFG_TLS_CERT_FILE,
 154         CFG_TLS_CERT_KEY,
 155         CFG_TLS_CA_PATH,
 156         CFG_TLS_CA_FILE,
 157         CFG_TLS_VERIFY,
 158         CFG_TLS_CRLCHECK,
 159         CFG_CONCUR,
 160         CFG_THREADS,
 161         CFG_SALT,
 162         CFG_LIMITS,
 163         CFG_RO,
 164         CFG_REWRITE,
 165         CFG_DEPTH,
 166         CFG_OID,
 167         CFG_OC,
 168         CFG_DIT,
 169         CFG_ATTR,
 170         CFG_ATOPT,
 171         CFG_CHECK,
 172         CFG_REPLOG,
 173         CFG_ROOTDSE,
 174         CFG_LOGFILE,
 175         CFG_PLUGIN,
 176         CFG_MODLOAD,
 177         CFG_MODPATH,
 178         CFG_LASTMOD,
 179         CFG_AZPOLICY,
 180         CFG_AZREGEXP,
 181         CFG_SASLSECP,
 182         CFG_SSTR_IF_MAX,
 183         CFG_SSTR_IF_MIN,
 184 };
 185
 186 typedef struct {
 187         char *name, *oid;
 188 } OidRec;
 189
 190 static OidRec OidMacros[] = {
 191         /* OpenLDAProot:666.11.1 */
 192         { "OLcfg", "1.3.6.1.4.1.4203.666.11.1" },
 193         { "OLcfgAt", "OLcfg:3" },
 194         { "OLcfgGlAt", "OLcfgAt:0" },
 195         { "OLcfgBkAt", "OLcfgAt:1" },
 196         { "OLcfgDbAt", "OLcfgAt:2" },
 197         { "OLcfgOvAt", "OLcfgAt:3" },
 198         { "OLcfgOc", "OLcfg:4" },
 199         { "OLcfgGlOc", "OLcfgOc:0" },
 200         { "OLcfgBkOc", "OLcfgOc:1" },
 201         { "OLcfgDbOc", "OLcfgOc:2" },
 202         { "OLcfgOvOc", "OLcfgOc:3" },
 203         { "OMsyn", "1.3.6.1.4.1.1466.115.121.1" },
 204         { "OMsInteger", "OMsyn:27" },
 205         { "OMsBoolean", "OMsyn:7" },
 206         { "OMsDN", "OMsyn:12" },
 207         { "OMsDirectoryString", "OMsyn:15" },
 208         { "OMsOctetString", "OMsyn:40" },
 209         { NULL, NULL }
 210 };
 211
 212 /*
 213  * OLcfg{Bk|Db}{Oc|At}:0                -> common
 214  * OLcfg{Bk|Db}{Oc|At}:1                -> bdb
 215  * OLcfg{Bk|Db}{Oc|At}:2                -> ldif
 216  * OLcfg{Bk|Db}{Oc|At}:3                -> ldap?
 217  */
 218
 219 /* alphabetical ordering */
 220
 221 ConfigTable config_back_cf_table[] = {
 222         /* This attr is read-only */
 223         { "", "", 0, 0, 0, ARG_MAGIC,
 224                 &config_fname, "( OLcfgGlAt:78 NAME 'olcConfigFile' "
 225                         "DESC 'File for slapd configuration directives' "
 226                         "EQUALITY caseIgnoreMatch "
 227                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 228         { "", "", 0, 0, 0, ARG_MAGIC,
 229                 &config_cfdir, "( OLcfgGlAt:79 NAME 'olcConfigDir' "
 230                         "DESC 'Directory for slapd configuration backend' "
 231                         "EQUALITY caseIgnoreMatch "
 232                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 233         { "access",     NULL, 0, 0, 0, ARG_MAY_DB|ARG_MAGIC|CFG_ACL,
 234                 &config_generic, "( OLcfgGlAt:1 NAME 'olcAccess' "
 235                         "DESC 'Access Control List' "
 236                         "EQUALITY caseIgnoreMatch "
 237                         "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL },
 238         { "allows",     "features", 2, 0, 5, ARG_PRE_DB|ARG_MAGIC,
 239                 &config_allows, "( OLcfgGlAt:2 NAME 'olcAllows' "
 240                         "DESC 'Allowed set of deprecated features' "
 241                         "EQUALITY caseIgnoreMatch "
 242                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 243         { "argsfile", "file", 2, 2, 0, ARG_STRING,
 244                 &slapd_args_file, "( OLcfgGlAt:3 NAME 'olcArgsFile' "
 245                         "DESC 'File for slapd command line options' "
 246                         "EQUALITY caseIgnoreMatch "
 247                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 248         { "attribute",  "attribute", 2, 0, 9,
 249                 ARG_PAREN|ARG_MAGIC|CFG_ATTR|ARG_NO_DELETE|ARG_NO_INSERT,
 250                 &config_generic, "( OLcfgGlAt:4 NAME 'olcAttributeTypes' "
 251                         "DESC 'OpenLDAP attributeTypes' "
 252                         "EQUALITY caseIgnoreMatch "
 253                         "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )",
 254                                 NULL, NULL },
 255         { "attributeoptions", NULL, 0, 0, 0, ARG_MAGIC|CFG_ATOPT,
 256                 &config_generic, "( OLcfgGlAt:5 NAME 'olcAttributeOptions' "
 257                         "EQUALITY caseIgnoreMatch "
 258                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 259         { "authid-rewrite", NULL, 2, 0, 0,
 260 #ifdef SLAP_AUTH_REWRITE
 261                 ARG_MAGIC|CFG_REWRITE|ARG_NO_INSERT, &config_generic,
 262 #else
 263                 ARG_IGNORED, NULL,
 264 #endif
 265                  "( OLcfgGlAt:6 NAME 'olcAuthIDRewrite' "
 266                         "EQUALITY caseIgnoreMatch "
 267                         "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL },
 268         { "authz-policy", "policy", 2, 2, 0, ARG_STRING|ARG_MAGIC|CFG_AZPOLICY,
 269                 &config_generic, "( OLcfgGlAt:7 NAME 'olcAuthzPolicy' "
 270                         "EQUALITY caseIgnoreMatch "
 271                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 272         { "authz-regexp", NULL, 3, 3, 0, ARG_MAGIC|CFG_AZREGEXP|ARG_NO_INSERT,
 273                 &config_generic, "( OLcfgGlAt:8 NAME 'olcAuthzRegexp' "
 274                         "EQUALITY caseIgnoreMatch "
 275                         "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL },
 276         { "backend", "type", 2, 2, 0, ARG_PRE_DB|ARG_MAGIC|CFG_BACKEND,
 277                 &config_generic, "( OLcfgGlAt:9 NAME 'olcBackend' "
 278                         "DESC 'A type of backend' "
 279                         "EQUALITY caseIgnoreMatch "
 280                         "SYNTAX OMsDirectoryString SINGLE-VALUE X-ORDERED 'SIBLINGS' )",
 281                                 NULL, NULL },
 282         { "concurrency", "level", 2, 2, 0, ARG_INT|ARG_MAGIC|CFG_CONCUR,
 283                 &config_generic, "( OLcfgGlAt:10 NAME 'olcConcurrency' "
 284                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 285         { "conn_max_pending", "max", 2, 2, 0, ARG_INT,
 286                 &slap_conn_max_pending, "( OLcfgGlAt:11 NAME 'olcConnMaxPending' "
 287                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 288         { "conn_max_pending_auth", "max", 2, 2, 0, ARG_INT,
 289                 &slap_conn_max_pending_auth, "( OLcfgGlAt:12 NAME 'olcConnMaxPendingAuth' "
 290                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 291         { "database", "type", 2, 2, 0, ARG_MAGIC|CFG_DATABASE,
 292                 &config_generic, "( OLcfgGlAt:13 NAME 'olcDatabase' "
 293                         "DESC 'The backend type for a database instance' "
 294                         "SUP olcBackend SINGLE-VALUE X-ORDERED 'SIBLINGS' )", NULL, NULL },
 295         { "defaultSearchBase", "dn", 2, 2, 0, ARG_PRE_BI|ARG_PRE_DB|ARG_DN|ARG_MAGIC,
 296                 &config_search_base, "( OLcfgGlAt:14 NAME 'olcDefaultSearchBase' "
 297                         "SYNTAX OMsDN SINGLE-VALUE )", NULL, NULL },
 298         { "disallows", "features", 2, 0, 8, ARG_PRE_DB|ARG_MAGIC,
 299                 &config_disallows, "( OLcfgGlAt:15 NAME 'olcDisallows' "
 300                         "EQUALITY caseIgnoreMatch "
 301                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 302         { "ditcontentrule",     NULL, 0, 0, 0, ARG_MAGIC|CFG_DIT|ARG_NO_DELETE|ARG_NO_INSERT,
 303                 &config_generic, "( OLcfgGlAt:16 NAME 'olcDitContentRules' "
 304                         "DESC 'OpenLDAP DIT content rules' "
 305                         "EQUALITY caseIgnoreMatch "
 306                         "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )",
 307                         NULL, NULL },
 308         { "gentlehup", "on|off", 2, 2, 0,
 309 #ifdef SIGHUP
 310                 ARG_ON_OFF, &global_gentlehup,
 311 #else
 312                 ARG_IGNORED, NULL,
 313 #endif
 314                 "( OLcfgGlAt:17 NAME 'olcGentleHUP' "
 315                         "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
 316         { "idletimeout", "timeout", 2, 2, 0, ARG_INT,
 317                 &global_idletimeout, "( OLcfgGlAt:18 NAME 'olcIdleTimeout' "
 318                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 319         { "include", "file", 2, 2, 0, ARG_MAGIC,
 320                 &config_include, "( OLcfgGlAt:19 NAME 'olcInclude' "
 321                         "SUP labeledURI )", NULL, NULL },
 322         { "index_substr_if_minlen", "min", 2, 2, 0, ARG_INT|ARG_NONZERO|ARG_MAGIC|CFG_SSTR_IF_MIN,
 323                 &config_generic, "( OLcfgGlAt:20 NAME 'olcIndexSubstrIfMinLen' "
 324                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 325         { "index_substr_if_maxlen", "max", 2, 2, 0, ARG_INT|ARG_NONZERO|ARG_MAGIC|CFG_SSTR_IF_MAX,
 326                 &config_generic, "( OLcfgGlAt:21 NAME 'olcIndexSubstrIfMaxLen' "
 327                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 328         { "index_substr_any_len", "len", 2, 2, 0, ARG_INT|ARG_NONZERO,
 329                 &index_substr_any_len, "( OLcfgGlAt:22 NAME 'olcIndexSubstrAnyLen' "
 330                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 331         { "index_substr_step", "step", 2, 2, 0, ARG_INT|ARG_NONZERO,
 332                 &index_substr_any_step, "( OLcfgGlAt:23 NAME 'olcIndexSubstrAnyStep' "
 333                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 334         { "lastmod", "on|off", 2, 2, 0, ARG_DB|ARG_ON_OFF|ARG_MAGIC|CFG_LASTMOD,
 335                 &config_generic, "( OLcfgDbAt:0.4 NAME 'olcLastMod' "
 336                         "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
 337         { "limits", "limits", 2, 0, 0, ARG_DB|ARG_MAGIC|CFG_LIMITS,
 338                 &config_generic, "( OLcfgDbAt:0.5 NAME 'olcLimits' "
 339                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 340         { "localSSF", "ssf", 2, 2, 0, ARG_INT,
 341                 &local_ssf, "( OLcfgGlAt:26 NAME 'olcLocalSSF' "
 342                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 343         { "logfile", "file", 2, 2, 0, ARG_STRING|ARG_MAGIC|CFG_LOGFILE,
 344                 &config_generic, "( OLcfgGlAt:27 NAME 'olcLogFile' "
 345                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 346         { "loglevel", "level", 2, 0, 0, ARG_MAGIC,
 347                 &config_loglevel, "( OLcfgGlAt:28 NAME 'olcLogLevel' "
 348                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 349         { "maxDerefDepth", "depth", 2, 2, 0, ARG_DB|ARG_INT|ARG_MAGIC|CFG_DEPTH,
 350                 &config_generic, "( OLcfgDbAt:0.6 NAME 'olcMaxDerefDepth' "
 351                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 352         { "moduleload", "file", 2, 0, 0,
 353 #ifdef SLAPD_MODULES
 354                 ARG_MAGIC|CFG_MODLOAD, &config_generic,
 355 #else
 356                 ARG_IGNORED, NULL,
 357 #endif
 358                 "( OLcfgGlAt:30 NAME 'olcModuleLoad' "
 359                         "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL },
 360         { "modulepath", "path", 2, 2, 0,
 361 #ifdef SLAPD_MODULES
 362                 ARG_MAGIC|CFG_MODPATH|ARG_NO_DELETE|ARG_NO_INSERT, &config_generic,
 363 #else
 364                 ARG_IGNORED, NULL,
 365 #endif
 366                 "( OLcfgGlAt:31 NAME 'olcModulePath' "
 367                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 368         { "objectclass", "objectclass", 2, 0, 0, ARG_PAREN|ARG_MAGIC|CFG_OC|ARG_NO_DELETE|ARG_NO_INSERT,
 369                 &config_generic, "( OLcfgGlAt:32 NAME 'olcObjectClasses' "
 370                 "DESC 'OpenLDAP object classes' "
 371                 "EQUALITY caseIgnoreMatch "
 372                 "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )",
 373                         NULL, NULL },
 374         { "objectidentifier", NULL,     0, 0, 0, ARG_MAGIC|CFG_OID,
 375                 &config_generic, "( OLcfgGlAt:33 NAME 'olcObjectIdentifier' "
 376                         "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL },
 377         { "overlay", "overlay", 2, 2, 0, ARG_MAGIC,
 378                 &config_overlay, "( OLcfgGlAt:34 NAME 'olcOverlay' "
 379                         "SUP olcDatabase SINGLE-VALUE X-ORDERED 'SIBLINGS' )", NULL, NULL },
 380         { "password-crypt-salt-format", "salt", 2, 2, 0, ARG_STRING|ARG_MAGIC|CFG_SALT,
 381                 &config_generic, "( OLcfgGlAt:35 NAME 'olcPasswordCryptSaltFormat' "
 382                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 383         { "password-hash", "hash", 2, 2, 0, ARG_MAGIC,
 384                 &config_passwd_hash, "( OLcfgGlAt:36 NAME 'olcPasswordHash' "
 385                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 386         { "pidfile", "file", 2, 2, 0, ARG_STRING,
 387                 &slapd_pid_file, "( OLcfgGlAt:37 NAME 'olcPidFile' "
 388                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 389         { "plugin", NULL, 0, 0, 0,
 390 #ifdef LDAP_SLAPI
 391                 ARG_MAGIC|CFG_PLUGIN, &config_generic,
 392 #else
 393                 ARG_IGNORED, NULL,
 394 #endif
 395                 "( OLcfgGlAt:38 NAME 'olcPlugin' "
 396                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 397         { "pluginlog", "filename", 2, 2, 0,
 398 #ifdef LDAP_SLAPI
 399                 ARG_STRING, &slapi_log_file,
 400 #else
 401                 ARG_IGNORED, NULL,
 402 #endif
 403                 "( OLcfgGlAt:39 NAME 'olcPluginLogFile' "
 404                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 405         { "readonly", "on|off", 2, 2, 0, ARG_MAY_DB|ARG_ON_OFF|ARG_MAGIC|CFG_RO,
 406                 &config_generic, "( OLcfgGlAt:40 NAME 'olcReadOnly' "
 407                         "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
 408         { "referral", "url", 2, 2, 0, ARG_MAGIC,
 409                 &config_referral, "( OLcfgGlAt:41 NAME 'olcReferral' "
 410                         "SUP labeledURI SINGLE-VALUE )", NULL, NULL },
 411         { "replica", "host or uri", 2, 0, 0, ARG_DB|ARG_MAGIC,
 412                 &config_replica, "( OLcfgDbAt:0.7 NAME 'olcReplica' "
 413                         "SUP labeledURI )", NULL, NULL },
 414         { "replica-argsfile", NULL, 0, 0, 0, ARG_STRING,
 415                 &replica_argsFile, "( OLcfgGlAt:43 NAME 'olcReplicaArgsFile' "
 416                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 417         { "replica-pidfile", NULL, 0, 0, 0, ARG_STRING,
 418                 &replica_pidFile, "( OLcfgGlAt:44 NAME 'olcReplicaPidFile' "
 419                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 420         { "replicationInterval", NULL, 0, 0, 0, ARG_INT,
 421                 &replicationInterval, "( OLcfgGlAt:45 NAME 'olcReplicationInterval' "
 422                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 423         { "replogfile", "filename", 2, 2, 0, ARG_MAY_DB|ARG_MAGIC|ARG_STRING|CFG_REPLOG,
 424                 &config_generic, "( OLcfgGlAt:46 NAME 'olcReplogFile' "
 425                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 426         { "require", "features", 2, 0, 7, ARG_MAY_DB|ARG_MAGIC,
 427                 &config_requires, "( OLcfgGlAt:47 NAME 'olcRequires' "
 428                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 429         { "restrict", "op_list", 2, 0, 0, ARG_MAY_DB|ARG_MAGIC,
 430                 &config_restrict, "( OLcfgGlAt:48 NAME 'olcRestrict' "
 431                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 432         { "reverse-lookup", "on|off", 2, 2, 0,
 433 #ifdef SLAPD_RLOOKUPS
 434                 ARG_ON_OFF, &use_reverse_lookup,
 435 #else
 436                 ARG_IGNORED, NULL,
 437 #endif
 438                 "( OLcfgGlAt:49 NAME 'olcReverseLookup' "
 439                         "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
 440         { "rootdn", "dn", 2, 2, 0, ARG_DB|ARG_DN|ARG_MAGIC,
 441                 &config_rootdn, "( OLcfgDbAt:0.8 NAME 'olcRootDN' "
 442                         "SYNTAX OMsDN SINGLE-VALUE )", NULL, NULL },
 443         { "rootDSE", "file", 2, 2, 0, ARG_MAGIC|CFG_ROOTDSE,
 444                 &config_generic, "( OLcfgGlAt:51 NAME 'olcRootDSE' "
 445                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 446         { "rootpw", "password", 2, 2, 0, ARG_BERVAL|ARG_DB|ARG_MAGIC,
 447                 &config_rootpw, "( OLcfgDbAt:0.9 NAME 'olcRootPW' "
 448                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 449         { "sasl-authz-policy", NULL, 2, 2, 0, ARG_MAGIC|CFG_AZPOLICY,
 450                 &config_generic, NULL, NULL, NULL },
 451         { "sasl-host", "host", 2, 2, 0,
 452 #ifdef HAVE_CYRUS_SASL
 453                 ARG_STRING|ARG_UNIQUE, &global_host,
 454 #else
 455                 ARG_IGNORED, NULL,
 456 #endif
 457                 "( OLcfgGlAt:53 NAME 'olcSaslHost' "
 458                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 459         { "sasl-realm", "realm", 2, 2, 0,
 460 #ifdef HAVE_CYRUS_SASL
 461                 ARG_STRING|ARG_UNIQUE, &global_realm,
 462 #else
 463                 ARG_IGNORED, NULL,
 464 #endif
 465                 "( OLcfgGlAt:54 NAME 'olcSaslRealm' "
 466                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 467         { "sasl-regexp", NULL, 3, 3, 0, ARG_MAGIC|CFG_AZREGEXP,
 468                 &config_generic, NULL, NULL, NULL },
 469         { "sasl-secprops", "properties", 2, 2, 0,
 470 #ifdef HAVE_CYRUS_SASL
 471                 ARG_MAGIC|CFG_SASLSECP, &config_generic,
 472 #else
 473                 ARG_IGNORED, NULL,
 474 #endif
 475                 "( OLcfgGlAt:56 NAME 'olcSaslSecProps' "
 476                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 477         { "saslRegexp", NULL, 3, 3, 0, ARG_MAGIC|CFG_AZREGEXP,
 478                 &config_generic, NULL, NULL, NULL },
 479         { "schemacheck", "on|off", 2, 2, 0, ARG_ON_OFF|ARG_MAGIC|CFG_CHECK,
 480                 &config_generic, "( OLcfgGlAt:57 NAME 'olcSchemaCheck' "
 481                         "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
 482         { "schemadn", "dn", 2, 2, 0, ARG_MAY_DB|ARG_DN|ARG_MAGIC,
 483                 &config_schema_dn, "( OLcfgGlAt:58 NAME 'olcSchemaDN' "
 484                         "SYNTAX OMsDN SINGLE-VALUE )", NULL, NULL },
 485         { "security", "factors", 2, 0, 0, ARG_MAY_DB|ARG_MAGIC,
 486                 &config_security, "( OLcfgGlAt:59 NAME 'olcSecurity' "
 487                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 488         { "sizelimit", "limit", 2, 0, 0, ARG_MAY_DB|ARG_MAGIC,
 489                 &config_sizelimit, "( OLcfgGlAt:60 NAME 'olcSizeLimit' "
 490                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 491         { "sockbuf_max_incoming", "max", 2, 2, 0, ARG_BER_LEN_T,
 492                 &sockbuf_max_incoming, "( OLcfgGlAt:61 NAME 'olcSockbufMaxIncoming' "
 493                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 494         { "sockbuf_max_incoming_auth", "max", 2, 2, 0, ARG_BER_LEN_T,
 495                 &sockbuf_max_incoming_auth, "( OLcfgGlAt:62 NAME 'olcSockbufMaxIncomingAuth' "
 496                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 497         { "srvtab", "file", 2, 2, 0,
 498 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
 499                 ARG_STRING, &ldap_srvtab,
 500 #else
 501                 ARG_IGNORED, NULL,
 502 #endif
 503                 "( OLcfgGlAt:63 NAME 'olcSrvtab' "
 504                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 505         { "suffix",     "suffix", 2, 2, 0, ARG_DB|ARG_DN|ARG_MAGIC,
 506                 &config_suffix, "( OLcfgDbAt:0.10 NAME 'olcSuffix' "
 507                         "SYNTAX OMsDN )", NULL, NULL },
 508         { "syncrepl", NULL, 0, 0, 0, ARG_DB|ARG_MAGIC,
 509                 &syncrepl_config, "( OLcfgDbAt:0.11 NAME 'olcSyncrepl' "
 510                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 511         { "threads", "count", 2, 2, 0, ARG_INT|ARG_MAGIC|CFG_THREADS,
 512                 &config_generic, "( OLcfgGlAt:66 NAME 'olcThreads' "
 513                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 514         { "timelimit", "limit", 2, 0, 0, ARG_MAY_DB|ARG_MAGIC,
 515                 &config_timelimit, "( OLcfgGlAt:67 NAME 'olcTimeLimit' "
 516                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 517         { "TLSCACertificateFile", NULL, 0, 0, 0,
 518 #ifdef HAVE_TLS
 519                 CFG_TLS_CA_FILE|ARG_STRING|ARG_MAGIC, &config_tls_option,
 520 #else
 521                 ARG_IGNORED, NULL,
 522 #endif
 523                 "( OLcfgGlAt:68 NAME 'olcTLSCACertificateFile' "
 524                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 525         { "TLSCACertificatePath", NULL, 0, 0, 0,
 526 #ifdef HAVE_TLS
 527                 CFG_TLS_CA_PATH|ARG_STRING|ARG_MAGIC, &config_tls_option,
 528 #else
 529                 ARG_IGNORED, NULL,
 530 #endif
 531                 "( OLcfgGlAt:69 NAME 'olcTLSCACertificatePath' "
 532                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 533         { "TLSCertificateFile", NULL, 0, 0, 0,
 534 #ifdef HAVE_TLS
 535                 CFG_TLS_CERT_FILE|ARG_STRING|ARG_MAGIC, &config_tls_option,
 536 #else
 537                 ARG_IGNORED, NULL,
 538 #endif
 539                 "( OLcfgGlAt:70 NAME 'olcTLSCertificateFile' "
 540                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 541         { "TLSCertificateKeyFile", NULL, 0, 0, 0,
 542 #ifdef HAVE_TLS
 543                 CFG_TLS_CERT_KEY|ARG_STRING|ARG_MAGIC, &config_tls_option,
 544 #else
 545                 ARG_IGNORED, NULL,
 546 #endif
 547                 "( OLcfgGlAt:71 NAME 'olcTLSCertificateKeyFile' "
 548                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 549         { "TLSCipherSuite",     NULL, 0, 0, 0,
 550 #ifdef HAVE_TLS
 551                 CFG_TLS_CIPHER|ARG_STRING|ARG_MAGIC, &config_tls_option,
 552 #else
 553                 ARG_IGNORED, NULL,
 554 #endif
 555                 "( OLcfgGlAt:72 NAME 'olcTLSCipherSuite' "
 556                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 557         { "TLSCRLCheck", NULL, 0, 0, 0,
 558 #if defined(HAVE_TLS) && defined(HAVE_OPENSSL_CRL)
 559                 CFG_TLS_CRLCHECK|ARG_STRING|ARG_MAGIC, &config_tls_config,
 560 #else
 561                 ARG_IGNORED, NULL,
 562 #endif
 563                 "( OLcfgGlAt:73 NAME 'olcTLSCRLCheck' "
 564                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 565         { "TLSRandFile", NULL, 0, 0, 0,
 566 #ifdef HAVE_TLS
 567                 CFG_TLS_RAND|ARG_STRING|ARG_MAGIC, &config_tls_option,
 568 #else
 569                 ARG_IGNORED, NULL,
 570 #endif
 571                 "( OLcfgGlAt:74 NAME 'olcTLSRandFile' "
 572                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 573         { "TLSVerifyClient", NULL, 0, 0, 0,
 574 #ifdef HAVE_TLS
 575                 CFG_TLS_VERIFY|ARG_STRING|ARG_MAGIC, &config_tls_config,
 576 #else
 577                 ARG_IGNORED, NULL,
 578 #endif
 579                 "( OLcfgGlAt:75 NAME 'olcTLSVerifyClient' "
 580                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 581         { "ucdata-path", "path", 2, 2, 0, ARG_IGNORED,
 582                 NULL, NULL, NULL, NULL },
 583         { "updatedn", "dn", 2, 2, 0, ARG_DB|ARG_MAGIC,
 584                 &config_updatedn, "( OLcfgDbAt:0.12 NAME 'olcUpdateDN' "
 585                         "SYNTAX OMsDN SINGLE-VALUE )", NULL, NULL },
 586         { "updateref", "url", 2, 2, 0, ARG_DB|ARG_MAGIC,
 587                 &config_updateref, "( OLcfgDbAt:0.13 NAME 'olcUpdateRef' "
 588                         "SUP labeledURI )", NULL, NULL },
 589         { NULL, NULL, 0, 0, 0, ARG_IGNORED,
 590                 NULL, NULL, NULL, NULL }
 591 };
 592
 593 static ConfigOCs cf_ocs[] = {
 594         { "( OLcfgGlOc:1 "
 595                 "NAME 'olcConfig' "
 596                 "DESC 'OpenLDAP configuration object' "
 597                 "ABSTRACT SUP top )", Cft_Abstract, NULL },
 598         { "( OLcfgGlOc:2 "
 599                 "NAME 'olcGlobal' "
 600                 "DESC 'OpenLDAP Global configuration options' "
 601                 "SUP olcConfig STRUCTURAL "
 602                 "MAY ( cn $ olcConfigFile $ olcConfigDir $ olcAllows $ olcArgsFile $ "
 603                  "olcAttributeOptions $ olcAuthIDRewrite $ "
 604                  "olcAuthzPolicy $ olcAuthzRegexp $ olcConcurrency $ "
 605                  "olcConnMaxPending $ olcConnMaxPendingAuth $ olcDefaultSearchBase $ "
 606                  "olcDisallows $ olcGentleHUP $ olcIdleTimeout $ "
 607                  "olcIndexSubstrIfMaxLen $ olcIndexSubstrIfMinLen $ "
 608                  "olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcLocalSSF $ "
 609                  "olcLogLevel $ "
 610                  "olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ "
 611                  "olcPluginLogFile $ olcReadOnly $ olcReferral $ "
 612                  "olcReplicaPidFile $ olcReplicaArgsFile $ olcReplicationInterval $ "
 613                  "olcReplogFile $ olcRequires $ olcRestrict $ olcReverseLookup $ "
 614                  "olcRootDSE $ olcRootPW $ "
 615                  "olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ "
 616                  "olcSchemaCheck $ olcSecurity $ olcSizeLimit $ "
 617                  "olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcSrvtab $ "
 618                  "olcThreads $ olcTimeLimit $ olcTLSCACertificateFile $ "
 619                  "olcTLSCACertificatePath $ olcTLSCertificateFile $ "
 620                  "olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ "
 621                  "olcTLSRandFile $ olcTLSVerifyClient $ "
 622                  "olcObjectIdentifier $ olcAttributeTypes $ olcObjectClasses $ "
 623                  "olcDitContentRules ) )", Cft_Global, &cfOc_global },
 624         { "( OLcfgGlOc:3 "
 625                 "NAME 'olcSchemaConfig' "
 626                 "DESC 'OpenLDAP schema object' "
 627                 "SUP olcConfig STRUCTURAL "
 628                 "MAY ( cn $ olcObjectIdentifier $ olcAttributeTypes $ "
 629                  "olcObjectClasses $ olcDitContentRules ) )",
 630                         Cft_Schema, &cfOc_schema },
 631         { "( OLcfgGlOc:4 "
 632                 "NAME 'olcBackendConfig' "
 633                 "DESC 'OpenLDAP Backend-specific options' "
 634                 "SUP olcConfig STRUCTURAL "
 635                 "MUST olcBackend )", Cft_Backend, &cfOc_backend },
 636         { "( OLcfgGlOc:5 "
 637                 "NAME 'olcDatabaseConfig' "
 638                 "DESC 'OpenLDAP Database-specific options' "
 639                 "SUP olcConfig STRUCTURAL "
 640                 "MUST olcDatabase "
 641                 "MAY ( olcSuffix $ olcAccess $ olcLastMod $ olcLimits $ "
 642                  "olcMaxDerefDepth $ olcPlugin $ olcReadOnly $ olcReplica $ "
 643                  "olcReplogFile $ olcRequires $ olcRestrict $ olcRootDN $ olcRootPW $ "
 644                  "olcSchemaDN $ olcSecurity $ olcSizeLimit $ olcSyncrepl $ "
 645                  "olcTimeLimit $ olcUpdateDN $ olcUpdateRef ) )",
 646                         Cft_Database, &cfOc_database },
 647         { "( OLcfgGlOc:6 "
 648                 "NAME 'olcOverlayConfig' "
 649                 "DESC 'OpenLDAP Overlay-specific options' "
 650                 "SUP olcConfig STRUCTURAL "
 651                 "MUST olcOverlay )", Cft_Overlay, &cfOc_overlay },
 652         { "( OLcfgGlOc:7 "
 653                 "NAME 'olcIncludeFile' "
 654                 "DESC 'OpenLDAP configuration include file' "
 655                 "SUP olcConfig STRUCTURAL "
 656                 "MUST olcInclude "
 657                 "MAY ( cn $ olcRootDSE ) )",
 658                 Cft_Include, &cfOc_include },
 659 #ifdef SLAPD_MODULES
 660         { "( OLcfgGlOc:8 "
 661                 "NAME 'olcModuleList' "
 662                 "DESC 'OpenLDAP dynamic module info' "
 663                 "SUP olcConfig STRUCTURAL "
 664                 "MUST ( olcModulePath $ olcModuleLoad ) "
 665                 "MAY cn )", Cft_Module, &cfOc_module },
 666 #endif
 667         { NULL, 0, NULL }
 668 };
 669
 670 static int
 671 config_generic(ConfigArgs *c) {
 672         char *p;
 673         int i;
 674
 675         if ( c->op == SLAP_CONFIG_EMIT ) {
 676                 int rc = 0;
 677                 switch(c->type) {
 678                 case CFG_CONCUR:
 679                         c->value_int = ldap_pvt_thread_get_concurrency();
 680                         break;
 681                 case CFG_THREADS:
 682                         c->value_int = connection_pool_max;
 683                         break;
 684                 case CFG_SALT:
 685                         if ( passwd_salt )
 686                                 c->value_string = ch_strdup( passwd_salt );
 687                         else
 688                                 rc = 1;
 689                         break;
 690                 case CFG_LIMITS:
 691                         if ( c->be->be_limits ) {
 692                                 char buf[4096*3];
 693                                 struct berval bv;
 694                                 int i;
 695
 696                                 for ( i=0; c->be->be_limits[i]; i++ ) {
 697                                         bv.bv_len = sprintf( buf, IFMT, i );
 698                                         bv.bv_val = buf+bv.bv_len;
 699                                         limits_unparse( c->be->be_limits[i], &bv );
 700                                         bv.bv_len += bv.bv_val - buf;
 701                                         bv.bv_val = buf;
 702                                         value_add_one( &c->rvalue_vals, &bv );
 703                                 }
 704                         }
 705                         if ( !c->rvalue_vals ) rc = 1;
 706                         break;
 707                 case CFG_RO:
 708                         c->value_int = (c->be->be_restrictops & SLAP_RESTRICT_OP_WRITES) != 0;
 709                         break;
 710                 case CFG_AZPOLICY:
 711                         c->value_string = ch_strdup( slap_sasl_getpolicy());
 712                         break;
 713                 case CFG_AZREGEXP:
 714                         slap_sasl_regexp_unparse( &c->rvalue_vals );
 715                         if ( !c->rvalue_vals ) rc = 1;
 716                         break;
 717 #ifdef HAVE_CYRUS_SASL
 718                 case CFG_SASLSECP: {
 719                         struct berval bv = BER_BVNULL;
 720                         slap_sasl_secprops_unparse( &bv );
 721                         if ( !BER_BVISNULL( &bv )) {
 722                                 ber_bvarray_add( &c->rvalue_vals, &bv );
 723                         } else {
 724                                 rc = 1;
 725                         }
 726                         }
 727                         break;
 728 #endif
 729                 case CFG_DEPTH:
 730                         c->value_int = c->be->be_max_deref_depth;
 731                         break;
 732                 case CFG_OID: {
 733                         ConfigFile *cf = c->private;
 734                         if ( !cf )
 735                                 oidm_unparse( &c->rvalue_vals, NULL, NULL, 1 );
 736                         else if ( cf->c_om_head )
 737                                 oidm_unparse( &c->rvalue_vals, cf->c_om_head,
 738                                         cf->c_om_tail, 0 );
 739                         if ( !c->rvalue_vals )
 740                                 rc = 1;
 741                         }
 742                         break;
 743                 case CFG_OC: {
 744                         ConfigFile *cf = c->private;
 745                         if ( !cf )
 746                                 oc_unparse( &c->rvalue_vals, NULL, NULL, 1 );
 747                         else if ( cf->c_oc_head )
 748                                 oc_unparse( &c->rvalue_vals, cf->c_oc_head,
 749                                         cf->c_oc_tail, 0 );
 750                         if ( !c->rvalue_vals )
 751                                 rc = 1;
 752                         }
 753                         break;
 754                 case CFG_ATTR: {
 755                         ConfigFile *cf = c->private;
 756                         if ( !cf )
 757                                 at_unparse( &c->rvalue_vals, NULL, NULL, 1 );
 758                         else if ( cf->c_at_head )
 759                                 at_unparse( &c->rvalue_vals, cf->c_at_head,
 760                                         cf->c_at_tail, 0 );
 761                         if ( !c->rvalue_vals )
 762                                 rc = 1;
 763                         }
 764                         break;
 765                 case CFG_DIT: {
 766                         ConfigFile *cf = c->private;
 767                         if ( !cf )
 768                                 cr_unparse( &c->rvalue_vals, NULL, NULL, 1 );
 769                         else if ( cf->c_cr_head )
 770                                 cr_unparse( &c->rvalue_vals, cf->c_cr_head,
 771                                         cf->c_cr_tail, 0 );
 772                         if ( !c->rvalue_vals )
 773                                 rc = 1;
 774                         }
 775                         break;
 776
 777                 case CFG_CHECK:
 778                         c->value_int = global_schemacheck;
 779                         break;
 780                 case CFG_ACL: {
 781                         AccessControl *a;
 782                         char *src, *dst, ibuf[11];
 783                         struct berval bv, abv;
 784                         for (i=0, a=c->be->be_acl; a; i++,a=a->acl_next) {
 785                                 abv.bv_len = sprintf( ibuf, IFMT, i );
 786                                 acl_unparse( a, &bv );
 787                                 abv.bv_val = ch_malloc( abv.bv_len + bv.bv_len + 1 );
 788                                 AC_MEMCPY( abv.bv_val, ibuf, abv.bv_len );
 789                                 /* Turn TAB / EOL into plain space */
 790                                 for (src=bv.bv_val,dst=abv.bv_val+abv.bv_len; *src; src++) {
 791                                         if (isspace(*src)) *dst++ = ' ';
 792                                         else *dst++ = *src;
 793                                 }
 794                                 *dst = '\0';
 795                                 if (dst[-1] == ' ') {
 796                                         dst--;
 797                                         *dst = '\0';
 798                                 }
 799                                 abv.bv_len = dst - abv.bv_val;
 800                                 ber_bvarray_add( &c->rvalue_vals, &abv );
 801                         }
 802                         rc = (!i);
 803                         break;
 804                 }
 805                 case CFG_REPLOG:
 806                         if ( c->be->be_replogfile )
 807                                 c->value_string = ch_strdup( c->be->be_replogfile );
 808                         break;
 809                 case CFG_ROOTDSE: {
 810                         ConfigFile *cf = c->private;
 811                         if ( cf->c_dseFiles ) {
 812                                 value_add( &c->rvalue_vals, cf->c_dseFiles );
 813                         } else {
 814                                 rc = 1;
 815                         }
 816                         }
 817                         break;
 818                 case CFG_LOGFILE:
 819                         if ( logfileName )
 820                                 c->value_string = ch_strdup( logfileName );
 821                         else
 822                                 rc = 1;
 823                         break;
 824                 case CFG_LASTMOD:
 825                         c->value_int = (SLAP_NOLASTMOD(c->be) == 0);
 826                         break;
 827                 case CFG_SSTR_IF_MAX:
 828                         c->value_int = index_substr_if_maxlen;
 829                         break;
 830                 case CFG_SSTR_IF_MIN:
 831                         c->value_int = index_substr_if_minlen;
 832                         break;
 833 #ifdef SLAPD_MODULES
 834                 case CFG_MODLOAD: {
 835                         ModPaths *mp = c->private;
 836                         if (mp->mp_loads) {
 837                                 int i;
 838                                 for (i=0; !BER_BVISNULL(&mp->mp_loads[i]); i++) {
 839                                         struct berval bv;
 840                                         bv.bv_val = c->log;
 841                                         bv.bv_len = sprintf( bv.bv_val, IFMT "%s", i,
 842                                                 mp->mp_loads[i].bv_val );
 843                                         value_add_one( &c->rvalue_vals, &bv );
 844                                 }
 845                         }
 846
 847                         rc = c->rvalue_vals ? 0 : 1;
 848                         }
 849                         break;
 850                 case CFG_MODPATH: {
 851                         ModPaths *mp = c->private;
 852                         value_add_one( &c->rvalue_vals, &mp->mp_path );
 853
 854                         rc = c->rvalue_vals ? 0 : 1;
 855                         }
 856                         break;
 857 #endif
 858 #ifdef LDAP_SLAPI
 859                 case CFG_PLUGIN:
 860                         slapi_int_plugin_unparse( c->be, &c->rvalue_vals );
 861                         if ( !c->rvalue_vals ) rc = 1;
 862                         break;
 863 #endif
 864 #ifdef SLAP_AUTH_REWRITE
 865                 case CFG_REWRITE:
 866                         if ( authz_rewrites ) {
 867                                 struct berval bv, idx;
 868                                 char ibuf[32];
 869                                 int i;
 870
 871                                 idx.bv_val = ibuf;
 872                                 for ( i=0; !BER_BVISNULL( &authz_rewrites[i] ); i++ ) {
 873                                         idx.bv_len = sprintf( idx.bv_val, IFMT, i );
 874                                         bv.bv_len = idx.bv_len + authz_rewrites[i].bv_len;
 875                                         bv.bv_val = ch_malloc( bv.bv_len + 1 );
 876                                         strcpy( bv.bv_val, idx.bv_val );
 877                                         strcpy( bv.bv_val+idx.bv_len, authz_rewrites[i].bv_val );
 878                                         ber_bvarray_add( &c->rvalue_vals, &bv );
 879                                 }
 880                         }
 881                         if ( !c->rvalue_vals ) rc = 1;
 882                         break;
 883 #endif
 884                 default:
 885                         rc = 1;
 886                 }
 887                 return rc;
 888         } else if ( c->op == LDAP_MOD_DELETE ) {
 889                 int rc = 0;
 890                 switch(c->type) {
 891                 /* single-valued attrs, no-ops */
 892                 case CFG_CONCUR:
 893                 case CFG_THREADS:
 894                 case CFG_RO:
 895                 case CFG_AZPOLICY:
 896                 case CFG_DEPTH:
 897                 case CFG_CHECK:
 898                 case CFG_LASTMOD:
 899                 case CFG_SASLSECP:
 900                 case CFG_SSTR_IF_MAX:
 901                 case CFG_SSTR_IF_MIN:
 902                         break;
 903
 904                 /* no-ops, requires slapd restart */
 905                 case CFG_PLUGIN:
 906                 case CFG_MODLOAD:
 907                 case CFG_AZREGEXP:
 908                 case CFG_REWRITE:
 909                         sprintf(c->log, "change requires slapd restart");
 910                         break;
 911
 912                 case CFG_SALT:
 913                         ch_free( passwd_salt );
 914                         passwd_salt = NULL;
 915                         break;
 916
 917                 case CFG_REPLOG:
 918                         ch_free( c->be->be_replogfile );
 919                         c->be->be_replogfile = NULL;
 920                         break;
 921
 922                 case CFG_LOGFILE:
 923                         ch_free( logfileName );
 924                         logfileName = NULL;
 925                         break;
 926
 927                 case CFG_ACL:
 928                         if ( c->valx < 0 ) {
 929                                 AccessControl *end;
 930                                 if ( c->be == frontendDB )
 931                                         end = NULL;
 932                                 else
 933                                         end = frontendDB->be_acl;
 934                                 acl_destroy( c->be->be_acl, end );
 935                         } else {
 936                                 AccessControl **prev, *a;
 937                                 int i;
 938                                 for (i=0, prev = &c->be->be_acl; i < c->valx;
 939                                         i++ ) {
 940                                         a = *prev;
 941                                         prev = &a->acl_next;
 942                                 }
 943                                 a = *prev;
 944                                 *prev = a->acl_next;
 945                                 acl_free( a );
 946                         }
 947                         break;
 948
 949                 case CFG_LIMITS:
 950                         /* FIXME: there is no limits_free function */
 951                 case CFG_ATOPT:
 952                         /* FIXME: there is no ad_option_free function */
 953                 case CFG_ROOTDSE:
 954                         /* FIXME: there is no way to remove attributes added by
 955                                 a DSE file */
 956                 case CFG_OID:
 957                 case CFG_OC:
 958                 case CFG_DIT:
 959                 case CFG_ATTR:
 960                 case CFG_MODPATH:
 961                 default:
 962                         rc = 1;
 963                         break;
 964                 }
 965                 return rc;
 966         }
 967
 968         p = strchr(c->line,'(' /*')'*/);
 969
 970         switch(c->type) {
 971                 case CFG_BACKEND:
 972                         if(!(c->bi = backend_info(c->argv[1]))) {
 973                                 Debug(LDAP_DEBUG_ANY, "%s: "
 974                                         "backend %s failed init!\n", c->log, c->argv[1], 0);
 975                                 return(1);
 976                         }
 977                         break;
 978
 979                 case CFG_DATABASE:
 980                         c->bi = NULL;
 981                         /* NOTE: config is always the first backend!
 982                          */
 983                         if ( !strcasecmp( c->argv[1], "config" )) {
 984                                 c->be = LDAP_STAILQ_FIRST(&backendDB);
 985                         } else if ( !strcasecmp( c->argv[1], "frontend" )) {
 986                                 c->be = frontendDB;
 987                         } else if(!(c->be = backend_db_init(c->argv[1]))) {
 988                                 Debug(LDAP_DEBUG_ANY, "%s: "
 989                                         "database %s failed init!\n", c->log, c->argv[1], 0);
 990                                 return(1);
 991                         }
 992                         break;
 993
 994                 case CFG_CONCUR:
 995                         ldap_pvt_thread_set_concurrency(c->value_int);
 996                         break;
 997
 998                 case CFG_THREADS:
 999                         ldap_pvt_thread_pool_maxthreads(&connection_pool, c->value_int);
1000                         connection_pool_max = c->value_int;     /* save for reference */
1001                         break;
1002
1003                 case CFG_SALT:
1004                         if ( passwd_salt ) ch_free( passwd_salt );
1005                         passwd_salt = c->value_string;
1006                         lutil_salt_format(passwd_salt);
1007                         break;
1008
1009                 case CFG_LIMITS:
1010                         if(limits_parse(c->be, c->fname, c->lineno, c->argc, c->argv))
1011                                 return(1);
1012                         break;
1013
1014                 case CFG_RO:
1015                         if(c->value_int)
1016                                 c->be->be_restrictops |= SLAP_RESTRICT_OP_WRITES;
1017                         else
1018                                 c->be->be_restrictops &= ~SLAP_RESTRICT_OP_WRITES;
1019                         break;
1020
1021                 case CFG_AZPOLICY:
1022                         ch_free(c->value_string);
1023                         if (slap_sasl_setpolicy( c->argv[1] )) {
1024                                 Debug(LDAP_DEBUG_ANY, "%s: unable to parse value \"%s\" in"
1025                                         " \"authz-policy <policy>\"\n",
1026                                         c->log, c->argv[1], 0 );
1027                                 return(1);
1028                         }
1029                         break;
1030
1031                 case CFG_AZREGEXP:
1032                         if (slap_sasl_regexp_config( c->argv[1], c->argv[2] ))
1033                                 return(1);
1034                         break;
1035
1036 #ifdef HAVE_CYRUS_SASL
1037                 case CFG_SASLSECP:
1038                         {
1039                         char *txt = slap_sasl_secprops( c->argv[1] );
1040                         if ( txt ) {
1041                                 Debug(LDAP_DEBUG_ANY, "%s: sasl-secprops: %s\n",
1042                                         c->log, txt, 0 );
1043                                 return(1);
1044                         }
1045                         break;
1046                         }
1047 #endif
1048
1049                 case CFG_DEPTH:
1050                         c->be->be_max_deref_depth = c->value_int;
1051                         break;
1052
1053                 case CFG_OID: {
1054                         OidMacro *om;
1055
1056                         if(parse_oidm(c->fname, c->lineno, c->argc, c->argv, 1, &om))
1057                                 return(1);
1058                         if (!cfn->c_om_head) cfn->c_om_head = om;
1059                         cfn->c_om_tail = om;
1060                         }
1061                         break;
1062
1063                 case CFG_OC: {
1064                         ObjectClass *oc;
1065
1066                         if(parse_oc(c->fname, c->lineno, p, c->argv, &oc)) return(1);
1067                         if (!cfn->c_oc_head) cfn->c_oc_head = oc;
1068                         cfn->c_oc_tail = oc;
1069                         }
1070                         break;
1071
1072                 case CFG_DIT: {
1073                         ContentRule *cr;
1074
1075                         if(parse_cr(c->fname, c->lineno, p, c->argv, &cr)) return(1);
1076                         if (!cfn->c_cr_head) cfn->c_cr_head = cr;
1077                         cfn->c_cr_tail = cr;
1078                         }
1079                         break;
1080
1081                 case CFG_ATTR: {
1082                         AttributeType *at;
1083
1084                         if(parse_at(c->fname, c->lineno, p, c->argv, &at)) return(1);
1085                         if (!cfn->c_at_head) cfn->c_at_head = at;
1086                         cfn->c_at_tail = at;
1087                         }
1088                         break;
1089
1090                 case CFG_ATOPT:
1091                         ad_define_option(NULL, NULL, 0);
1092                         for(i = 1; i < c->argc; i++)
1093                                 if(ad_define_option(c->argv[i], c->fname, c->lineno))
1094                                         return(1);
1095                         break;
1096
1097                 case CFG_CHECK:
1098                         global_schemacheck = c->value_int;
1099                         if(!global_schemacheck) Debug(LDAP_DEBUG_ANY, "%s: "
1100                                 "schema checking disabled! your mileage may vary!\n",
1101                                 c->log, 0, 0);
1102                         break;
1103
1104                 case CFG_ACL:
1105                         parse_acl(c->be, c->fname, c->lineno, c->argc, c->argv, c->valx);
1106                         break;
1107
1108                 case CFG_REPLOG:
1109                         if(SLAP_MONITOR(c->be)) {
1110                                 Debug(LDAP_DEBUG_ANY, "%s: "
1111                                         "\"replogfile\" should not be used "
1112                                         "inside monitor database\n",
1113                                         c->log, 0, 0);
1114                                 return(0);      /* FIXME: should this be an error? */
1115                         }
1116
1117                         c->be->be_replogfile = c->value_string;
1118                         break;
1119
1120                 case CFG_ROOTDSE:
1121                         if(read_root_dse_file(c->argv[1])) {
1122                                 Debug(LDAP_DEBUG_ANY, "%s: "
1123                                         "could not read \"rootDSE <filename>\" line\n",
1124                                         c->log, 0, 0);
1125                                 return(1);
1126                         }
1127                         {
1128                                 struct berval bv;
1129                                 ber_str2bv( c->argv[1], 0, 1, &bv );
1130                                 ber_bvarray_add( &cfn->c_dseFiles, &bv );
1131                         }
1132                         break;
1133
1134                 case CFG_LOGFILE: {
1135                                 FILE *logfile;
1136                                 if ( logfileName ) ch_free( logfileName );
1137                                 logfileName = c->value_string;
1138                                 logfile = fopen(logfileName, "w");
1139                                 if(logfile) lutil_debug_file(logfile);
1140                         } break;
1141
1142                 case CFG_LASTMOD:
1143                         if(SLAP_NOLASTMODCMD(c->be)) {
1144                                 Debug(LDAP_DEBUG_ANY, "%s: "
1145                                         "lastmod not available for %s databases\n",
1146                                         c->log, c->be->bd_info->bi_type, 0);
1147                                 return(1);
1148                         }
1149                         if(c->value_int)
1150                                 SLAP_DBFLAGS(c->be) &= ~SLAP_DBFLAG_NOLASTMOD;
1151                         else
1152                                 SLAP_DBFLAGS(c->be) |= SLAP_DBFLAG_NOLASTMOD;
1153                         break;
1154
1155                 case CFG_SSTR_IF_MAX:
1156                         if (c->value_int < index_substr_if_minlen) {
1157                                 Debug(LDAP_DEBUG_ANY, "%s: "
1158                                         "invalid max value (%d)\n",
1159                                         c->log, c->value_int, 0 );
1160                                 return(1);
1161                         }
1162                         index_substr_if_maxlen = c->value_int;
1163                         break;
1164
1165                 case CFG_SSTR_IF_MIN:
1166                         if (c->value_int > index_substr_if_maxlen) {
1167                                 Debug(LDAP_DEBUG_ANY, "%s: "
1168                                         "invalid min value (%d)\n",
1169                                         c->log, c->value_int, 0 );
1170                                 return(1);
1171                         }
1172                         index_substr_if_minlen = c->value_int;
1173                         break;
1174
1175 #ifdef SLAPD_MODULES
1176                 case CFG_MODLOAD:
1177                         if(module_load(c->argv[1], c->argc - 2, (c->argc > 2) ? c->argv + 2 : NULL))
1178                                 return(1);
1179                         /* Record this load on the current path */
1180                         {
1181                                 struct berval bv;
1182                                 char *ptr = c->line + STRLENOF("moduleload");
1183                                 while (!isspace(*ptr)) ptr++;
1184                                 while (isspace(*ptr)) ptr++;
1185                                 ber_str2bv(ptr, 0, 1, &bv);
1186                                 ber_bvarray_add( &modcur->mp_loads, &bv );
1187                         }
1188                         break;
1189
1190                 case CFG_MODPATH:
1191                         if(module_path(c->argv[1])) return(1);
1192                         /* Record which path was used with each module */
1193                         {
1194                                 ModPaths *mp;
1195
1196                                 if (!modpaths.mp_loads) {
1197                                         mp = &modpaths;
1198                                 } else {
1199                                         mp = ch_malloc( sizeof( ModPaths ));
1200                                         modlast->mp_next = mp;
1201                                 }
1202                                 ber_str2bv(c->argv[1], 0, 1, &mp->mp_path);
1203                                 mp->mp_next = NULL;
1204                                 mp->mp_loads = NULL;
1205                                 modlast = mp;
1206                                 if ( c->op == SLAP_CONFIG_ADD )
1207                                         modcur = mp;
1208                         }
1209
1210                         break;
1211 #endif
1212
1213 #ifdef LDAP_SLAPI
1214                 case CFG_PLUGIN:
1215                         if(slapi_int_read_config(c->be, c->fname, c->lineno, c->argc, c->argv) != LDAP_SUCCESS)
1216                                 return(1);
1217                         slapi_plugins_used++;
1218                         break;
1219 #endif
1220
1221 #ifdef SLAP_AUTH_REWRITE
1222                 case CFG_REWRITE: {
1223                         struct berval bv;
1224                         if(slap_sasl_rewrite_config(c->fname, c->lineno, c->argc, c->argv))
1225                                 return(1);
1226                         ber_str2bv( c->line, 0, 1, &bv );
1227                         ber_bvarray_add( &authz_rewrites, &bv );
1228                         }
1229                         break;
1230 #endif
1231
1232
1233                 default:
1234                         Debug(LDAP_DEBUG_ANY, "%s: unknown CFG_TYPE %d"
1235                                 "(ignored)\n", c->log, c->type, 0);
1236
1237         }
1238         return(0);
1239 }
1240
1241
1242 static int
1243 config_fname(ConfigArgs *c) {
1244         if(c->op == SLAP_CONFIG_EMIT) {
1245                 if (c->private) {
1246                         ConfigFile *cf = c->private;
1247                         value_add_one( &c->rvalue_vals, &cf->c_file );
1248                         return 0;
1249                 }
1250                 return 1;
1251         }
1252         return(0);
1253 }
1254
1255 static int
1256 config_cfdir(ConfigArgs *c) {
1257         if(c->op == SLAP_CONFIG_EMIT) {
1258                 value_add_one( &c->rvalue_vals, &cfdir );
1259                 return 0;
1260         }
1261         return(0);
1262 }
1263
1264 static int
1265 config_search_base(ConfigArgs *c) {
1266         struct berval dn;
1267
1268         if(c->op == SLAP_CONFIG_EMIT) {
1269                 int rc = 1;
1270                 if (!BER_BVISEMPTY(&default_search_base)) {
1271                         value_add_one(&c->rvalue_vals, &default_search_base);
1272                         value_add_one(&c->rvalue_nvals, &default_search_nbase);
1273                         rc = 0;
1274                 }
1275                 return rc;
1276         } else if( c->op == LDAP_MOD_DELETE ) {
1277                 ch_free( default_search_base.bv_val );
1278                 ch_free( default_search_nbase.bv_val );
1279                 BER_BVZERO( &default_search_base );
1280                 BER_BVZERO( &default_search_nbase );
1281                 return 0;
1282         }
1283
1284         if(c->bi || c->be != frontendDB) {
1285                 Debug(LDAP_DEBUG_ANY, "%s: defaultSearchBase line must appear "
1286                         "prior to any backend or database definition\n",
1287                         c->log, 0, 0);
1288                 return(1);
1289         }
1290
1291         if(default_search_nbase.bv_len) {
1292                 Debug(LDAP_DEBUG_ANY, "%s: "
1293                         "default search base \"%s\" already defined "
1294                         "(discarding old)\n",
1295                         c->log, default_search_base.bv_val, 0);
1296                 free(default_search_base.bv_val);
1297                 free(default_search_nbase.bv_val);
1298         }
1299
1300         default_search_base = c->value_dn;
1301         default_search_nbase = c->value_ndn;
1302         return(0);
1303 }
1304
1305 static int
1306 config_passwd_hash(ConfigArgs *c) {
1307         int i;
1308         if (c->op == SLAP_CONFIG_EMIT) {
1309                 struct berval bv;
1310                 for (i=0; default_passwd_hash && default_passwd_hash[i]; i++) {
1311                         ber_str2bv(default_passwd_hash[i], 0, 0, &bv);
1312                         value_add_one(&c->rvalue_vals, &bv);
1313                 }
1314                 return i ? 0 : 1;
1315         } else if ( c->op == LDAP_MOD_DELETE ) {
1316                 if ( c->valx < 0 ) {
1317                         ldap_charray_free( default_passwd_hash );
1318                         default_passwd_hash = NULL;
1319                 } else {
1320                         i = c->valx;
1321                         ch_free( default_passwd_hash[i] );
1322                         for (; default_passwd_hash[i]; i++ )
1323                                 default_passwd_hash[i] = default_passwd_hash[i+1];
1324                 }
1325                 return 0;
1326         }
1327         if(default_passwd_hash) {
1328                 Debug(LDAP_DEBUG_ANY, "%s: "
1329                         "already set default password_hash\n",
1330                         c->log, 0, 0);
1331                 return(1);
1332         }
1333         for(i = 1; i < c->argc; i++) {
1334                 if(!lutil_passwd_scheme(c->argv[i])) {
1335                         Debug(LDAP_DEBUG_ANY, "%s: "
1336                                 "password scheme \"%s\" not available\n",
1337                                 c->log, c->argv[i], 0);
1338                 } else {
1339                         ldap_charray_add(&default_passwd_hash, c->argv[i]);
1340                 }
1341                 if(!default_passwd_hash) {
1342                         Debug(LDAP_DEBUG_ANY, "%s: no valid hashes found\n",
1343                                 c->log, 0, 0 );
1344                         return(1);
1345                 }
1346         }
1347         return(0);
1348 }
1349
1350 static int
1351 config_schema_dn(ConfigArgs *c) {
1352         if ( c->op == SLAP_CONFIG_EMIT ) {
1353                 int rc = 1;
1354                 if ( !BER_BVISEMPTY( &c->be->be_schemadn )) {
1355                         value_add_one(&c->rvalue_vals, &c->be->be_schemadn);
1356                         value_add_one(&c->rvalue_nvals, &c->be->be_schemandn);
1357                         rc = 0;
1358                 }
1359                 return rc;
1360         } else if ( c->op == LDAP_MOD_DELETE ) {
1361                 ch_free( c->be->be_schemadn.bv_val );
1362                 ch_free( c->be->be_schemandn.bv_val );
1363                 BER_BVZERO( &c->be->be_schemadn );
1364                 BER_BVZERO( &c->be->be_schemandn );
1365                 return 0;
1366         }
1367         ch_free( c->be->be_schemadn.bv_val );
1368         ch_free( c->be->be_schemandn.bv_val );
1369         c->be->be_schemadn = c->value_dn;
1370         c->be->be_schemandn = c->value_ndn;
1371         return(0);
1372 }
1373
1374 static int
1375 config_sizelimit(ConfigArgs *c) {
1376         int i, rc = 0;
1377         char *next;
1378         struct slap_limits_set *lim = &c->be->be_def_limit;
1379         if (c->op == SLAP_CONFIG_EMIT) {
1380                 char buf[8192];
1381                 struct berval bv;
1382                 bv.bv_val = buf;
1383                 bv.bv_len = 0;
1384                 limits_unparse_one( lim, SLAP_LIMIT_SIZE, &bv );
1385                 if ( !BER_BVISEMPTY( &bv ))
1386                         value_add_one( &c->rvalue_vals, &bv );
1387                 else
1388                         rc = 1;
1389                 return rc;
1390         } else if ( c->op == LDAP_MOD_DELETE ) {
1391                 /* Reset to defaults */
1392                 lim->lms_s_soft = SLAPD_DEFAULT_SIZELIMIT;
1393                 lim->lms_s_hard = 0;
1394                 lim->lms_s_unchecked = -1;
1395                 lim->lms_s_pr = 0;
1396                 lim->lms_s_pr_hide = 0;
1397                 lim->lms_s_pr_total = 0;
1398                 return 0;
1399         }
1400         for(i = 1; i < c->argc; i++) {
1401                 if(!strncasecmp(c->argv[i], "size", 4)) {
1402                         rc = limits_parse_one(c->argv[i], lim);
1403                         if ( rc ) {
1404                                 Debug(LDAP_DEBUG_ANY, "%s: "
1405                                         "unable to parse value \"%s\" in \"sizelimit <limit>\" line\n",
1406                                         c->log, c->argv[i], 0);
1407                                 return(1);
1408                         }
1409                 } else {
1410                         if(!strcasecmp(c->argv[i], "unlimited")) {
1411                                 lim->lms_s_soft = -1;
1412                         } else {
1413                                 lim->lms_s_soft = strtol(c->argv[i], &next, 0);
1414                                 if(next == c->argv[i]) {
1415                                         Debug(LDAP_DEBUG_ANY, "%s: "
1416                                                 "unable to parse limit \"%s\" in \"sizelimit <limit>\" line\n",
1417                                                 c->log, c->argv[i], 0);
1418                                         return(1);
1419                                 } else if(next[0] != '\0') {
1420                                         Debug(LDAP_DEBUG_ANY, "%s: "
1421                                                 "trailing chars \"%s\" in \"sizelimit <limit>\" line (ignored)\n",
1422                                                 c->log, next, 0);
1423                                 }
1424                         }
1425                         lim->lms_s_hard = 0;
1426                 }
1427         }
1428         return(0);
1429 }
1430
1431 static int
1432 config_timelimit(ConfigArgs *c) {
1433         int i, rc = 0;
1434         char *next;
1435         struct slap_limits_set *lim = &c->be->be_def_limit;
1436         if (c->op == SLAP_CONFIG_EMIT) {
1437                 char buf[8192];
1438                 struct berval bv;
1439                 bv.bv_val = buf;
1440                 bv.bv_len = 0;
1441                 limits_unparse_one( lim, SLAP_LIMIT_TIME, &bv );
1442                 if ( !BER_BVISEMPTY( &bv ))
1443                         value_add_one( &c->rvalue_vals, &bv );
1444                 else
1445                         rc = 1;
1446                 return rc;
1447         } else if ( c->op == LDAP_MOD_DELETE ) {
1448                 /* Reset to defaults */
1449                 lim->lms_t_soft = SLAPD_DEFAULT_TIMELIMIT;
1450                 lim->lms_t_hard = 0;
1451                 return 0;
1452         }
1453         for(i = 1; i < c->argc; i++) {
1454                 if(!strncasecmp(c->argv[i], "time", 4)) {
1455                         rc = limits_parse_one(c->argv[i], lim);
1456                         if ( rc ) {
1457                                 Debug(LDAP_DEBUG_ANY, "%s: "
1458                                         "unable to parse value \"%s\" in \"timelimit <limit>\" line\n",
1459                                         c->log, c->argv[i], 0);
1460                                 return(1);
1461                         }
1462                 } else {
1463                         if(!strcasecmp(c->argv[i], "unlimited")) {
1464                                 lim->lms_t_soft = -1;
1465                         } else {
1466                                 lim->lms_t_soft = strtol(c->argv[i], &next, 0);
1467                                 if(next == c->argv[i]) {
1468                                         Debug(LDAP_DEBUG_ANY, "%s: "
1469                                                 "unable to parse limit \"%s\" in \"timelimit <limit>\" line\n",
1470                                                 c->log, c->argv[i], 0);
1471                                         return(1);
1472                                 } else if(next[0] != '\0') {
1473                                         Debug(LDAP_DEBUG_ANY, "%s: "
1474                                                 "trailing chars \"%s\" in \"timelimit <limit>\" line (ignored)\n",
1475                                                 c->log, next, 0);
1476                                 }
1477                         }
1478                         lim->lms_t_hard = 0;
1479                 }
1480         }
1481         return(0);
1482 }
1483
1484 static int
1485 config_overlay(ConfigArgs *c) {
1486         if (c->op == SLAP_CONFIG_EMIT) {
1487                 return 1;
1488         } else if ( c->op == LDAP_MOD_DELETE ) {
1489                 assert(0);
1490         }
1491         if(c->argv[1][0] == '-' && overlay_config(c->be, &c->argv[1][1])) {
1492                 /* log error */
1493                 Debug(LDAP_DEBUG_ANY, "%s: (optional) %s overlay \"%s\" configuration failed (ignored)\n",
1494                         c->log, c->be == frontendDB ? "global " : "", c->argv[1][1]);
1495         } else if(overlay_config(c->be, c->argv[1])) {
1496                 return(1);
1497         }
1498         return(0);
1499 }
1500
1501 static int
1502 config_suffix(ConfigArgs *c) {
1503         Backend *tbe;
1504         struct berval pdn, ndn;
1505         int rc;
1506
1507         if (c->be == frontendDB || SLAP_MONITOR(c->be) ||
1508                 SLAP_CONFIG(c->be)) return 1;
1509
1510         if (c->op == SLAP_CONFIG_EMIT) {
1511                 if ( c->be->be_suffix == NULL
1512                                 || BER_BVISNULL( &c->be->be_suffix[0] ) )
1513                 {
1514                         return 1;
1515                 } else {
1516                         value_add( &c->rvalue_vals, c->be->be_suffix );
1517                         value_add( &c->rvalue_nvals, c->be->be_nsuffix );
1518                         return 0;
1519                 }
1520         } else if ( c->op == LDAP_MOD_DELETE ) {
1521                 if ( c->valx < 0 ) {
1522                         ber_bvarray_free( c->be->be_suffix );
1523                         ber_bvarray_free( c->be->be_nsuffix );
1524                         c->be->be_suffix = NULL;
1525                         c->be->be_nsuffix = NULL;
1526                 } else {
1527                         int i = c->valx;
1528                         ch_free( c->be->be_suffix[i].bv_val );
1529                         ch_free( c->be->be_nsuffix[i].bv_val );
1530                         for (; c->be->be_suffix[i].bv_val; i++) {
1531                                 c->be->be_suffix[i] = c->be->be_suffix[i+1];
1532                                 c->be->be_nsuffix[i] = c->be->be_nsuffix[i+1];
1533                         }
1534                 }
1535                 return 0;
1536         }
1537 #ifdef SLAPD_MONITOR_DN
1538         if(!strcasecmp(c->argv[1], SLAPD_MONITOR_DN)) {
1539                 Debug(LDAP_DEBUG_ANY, "%s: "
1540                         "\"%s\" is reserved for monitoring slapd\n",
1541                         c->log, SLAPD_MONITOR_DN, 0);
1542                 return(1);
1543         }
1544 #endif
1545
1546         pdn = c->value_dn;
1547         ndn = c->value_ndn;
1548         tbe = select_backend(&ndn, 0, 0);
1549         if(tbe == c->be) {
1550                 Debug(LDAP_DEBUG_ANY, "%s: suffix already served by this backend! (ignored)\n",
1551                         c->log, 0, 0);
1552                 free(pdn.bv_val);
1553                 free(ndn.bv_val);
1554         } else if(tbe) {
1555                 Debug(LDAP_DEBUG_ANY, "%s: suffix already served by a preceding backend \"%s\"\n",
1556                         c->log, tbe->be_suffix[0].bv_val, 0);
1557                 free(pdn.bv_val);
1558                 free(ndn.bv_val);
1559                 return(1);
1560         } else if(pdn.bv_len == 0 && default_search_nbase.bv_len) {
1561                 Debug(LDAP_DEBUG_ANY, "%s: suffix DN empty and default search "
1562                         "base provided \"%s\" (assuming okay)\n",
1563                         c->log, default_search_base.bv_val, 0);
1564         }
1565         ber_bvarray_add(&c->be->be_suffix, &pdn);
1566         ber_bvarray_add(&c->be->be_nsuffix, &ndn);
1567         return(0);
1568 }
1569
1570 static int
1571 config_rootdn(ConfigArgs *c) {
1572         if (c->op == SLAP_CONFIG_EMIT) {
1573                 if ( !BER_BVISNULL( &c->be->be_rootdn )) {
1574                         value_add_one(&c->rvalue_vals, &c->be->be_rootdn);
1575                         value_add_one(&c->rvalue_nvals, &c->be->be_rootndn);
1576                         return 0;
1577                 } else {
1578                         return 1;
1579                 }
1580         } else if ( c->op == LDAP_MOD_DELETE ) {
1581                 ch_free( c->be->be_rootdn.bv_val );
1582                 ch_free( c->be->be_rootndn.bv_val );
1583                 BER_BVZERO( &c->be->be_rootdn );
1584                 BER_BVZERO( &c->be->be_rootndn );
1585                 return 0;
1586         }
1587         if ( !BER_BVISNULL( &c->be->be_rootdn )) {
1588                 ch_free( c->be->be_rootdn.bv_val );
1589                 ch_free( c->be->be_rootndn.bv_val );
1590         }
1591         c->be->be_rootdn = c->value_dn;
1592         c->be->be_rootndn = c->value_ndn;
1593         return(0);
1594 }
1595
1596 static int
1597 config_rootpw(ConfigArgs *c) {
1598         Backend *tbe;
1599         if (c->op == SLAP_CONFIG_EMIT) {
1600                 if (!BER_BVISEMPTY(&c->be->be_rootpw)) {
1601                         ber_dupbv( &c->value_bv, &c->be->be_rootpw);
1602                         return 0;
1603                 }
1604                 return 1;
1605         } else if ( c->op == LDAP_MOD_DELETE ) {
1606                 ch_free( c->be->be_rootpw.bv_val );
1607                 BER_BVZERO( &c->be->be_rootpw );
1608                 return 0;
1609         }
1610
1611         tbe = select_backend(&c->be->be_rootndn, 0, 0);
1612         if(tbe != c->be) {
1613                 Debug(LDAP_DEBUG_ANY, "%s: "
1614                         "rootpw can only be set when rootdn is under suffix\n",
1615                         c->log, 0, 0);
1616                 return(1);
1617         }
1618         if ( !BER_BVISNULL( &c->be->be_rootpw ))
1619                 ch_free( c->be->be_rootpw.bv_val );
1620         c->be->be_rootpw = c->value_bv;
1621         return(0);
1622 }
1623
1624 static int
1625 config_restrict(ConfigArgs *c) {
1626         slap_mask_t restrictops = 0;
1627         int i;
1628         slap_verbmasks restrictable_ops[] = {
1629                 { BER_BVC("bind"),              SLAP_RESTRICT_OP_BIND },
1630                 { BER_BVC("add"),               SLAP_RESTRICT_OP_ADD },
1631                 { BER_BVC("modify"),            SLAP_RESTRICT_OP_MODIFY },
1632                 { BER_BVC("rename"),            SLAP_RESTRICT_OP_RENAME },
1633                 { BER_BVC("modrdn"),            0 },
1634                 { BER_BVC("delete"),            SLAP_RESTRICT_OP_DELETE },
1635                 { BER_BVC("search"),            SLAP_RESTRICT_OP_SEARCH },
1636                 { BER_BVC("compare"),   SLAP_RESTRICT_OP_COMPARE },
1637                 { BER_BVC("read"),              SLAP_RESTRICT_OP_READS },
1638                 { BER_BVC("write"),             SLAP_RESTRICT_OP_WRITES },
1639                 { BER_BVC("extended"),  SLAP_RESTRICT_OP_EXTENDED },
1640                 { BER_BVC("extended=" LDAP_EXOP_START_TLS ),            SLAP_RESTRICT_EXOP_START_TLS },
1641                 { BER_BVC("extended=" LDAP_EXOP_MODIFY_PASSWD ),        SLAP_RESTRICT_EXOP_MODIFY_PASSWD },
1642                 { BER_BVC("extended=" LDAP_EXOP_X_WHO_AM_I ),           SLAP_RESTRICT_EXOP_WHOAMI },
1643                 { BER_BVC("extended=" LDAP_EXOP_X_CANCEL ),             SLAP_RESTRICT_EXOP_CANCEL },
1644                 { BER_BVNULL,   0 }
1645         };
1646
1647         if (c->op == SLAP_CONFIG_EMIT) {
1648                 return mask_to_verbs( restrictable_ops, c->be->be_restrictops,
1649                         &c->rvalue_vals );
1650         } else if ( c->op == LDAP_MOD_DELETE ) {
1651                 if ( !c->line ) {
1652                         c->be->be_restrictops = 0;
1653                 } else {
1654                         restrictops = verb_to_mask( c->line, restrictable_ops );
1655                         c->be->be_restrictops ^= restrictops;
1656                 }
1657                 return 0;
1658         }
1659         i = verbs_to_mask( c->argc, c->argv, restrictable_ops, &restrictops );
1660         if ( i ) {
1661                 Debug(LDAP_DEBUG_ANY, "%s: "
1662                         "unknown operation %s in \"restrict <features>\" line\n",
1663                         c->log, c->argv[i], 0);
1664                 return(1);
1665         }
1666         if ( restrictops & SLAP_RESTRICT_OP_EXTENDED )
1667                 restrictops &= ~SLAP_RESTRICT_EXOP_MASK;
1668         c->be->be_restrictops |= restrictops;
1669         return(0);
1670 }
1671
1672 static int
1673 config_allows(ConfigArgs *c) {
1674         slap_mask_t allows = 0;
1675         int i;
1676         slap_verbmasks allowable_ops[] = {
1677                 { BER_BVC("bind_v2"),           SLAP_ALLOW_BIND_V2 },
1678                 { BER_BVC("bind_anon_cred"),    SLAP_ALLOW_BIND_ANON_CRED },
1679                 { BER_BVC("bind_anon_dn"),      SLAP_ALLOW_BIND_ANON_DN },
1680                 { BER_BVC("update_anon"),       SLAP_ALLOW_UPDATE_ANON },
1681                 { BER_BVNULL,   0 }
1682         };
1683         if (c->op == SLAP_CONFIG_EMIT) {
1684                 return mask_to_verbs( allowable_ops, global_allows, &c->rvalue_vals );
1685         } else if ( c->op == LDAP_MOD_DELETE ) {
1686                 if ( !c->line ) {
1687                         global_allows = 0;
1688                 } else {
1689                         allows = verb_to_mask( c->line, allowable_ops );
1690                         global_allows ^= allows;
1691                 }
1692                 return 0;
1693         }
1694         i = verbs_to_mask(c->argc, c->argv, allowable_ops, &allows);
1695         if ( i ) {
1696                 Debug(LDAP_DEBUG_ANY, "%s: "
1697                         "unknown feature %s in \"allow <features>\" line\n",
1698                         c->log, c->argv[i], 0);
1699                 return(1);
1700         }
1701         global_allows |= allows;
1702         return(0);
1703 }
1704
1705 static int
1706 config_disallows(ConfigArgs *c) {
1707         slap_mask_t disallows = 0;
1708         int i;
1709         slap_verbmasks disallowable_ops[] = {
1710                 { BER_BVC("bind_anon"),         SLAP_DISALLOW_BIND_ANON },
1711                 { BER_BVC("bind_simple"),       SLAP_DISALLOW_BIND_SIMPLE },
1712                 { BER_BVC("bind_krb4"),         SLAP_DISALLOW_BIND_KRBV4 },
1713                 { BER_BVC("tls_2_anon"),                SLAP_DISALLOW_TLS_2_ANON },
1714                 { BER_BVC("tls_authc"),         SLAP_DISALLOW_TLS_AUTHC },
1715                 { BER_BVNULL, 0 }
1716         };
1717         if (c->op == SLAP_CONFIG_EMIT) {
1718                 return mask_to_verbs( disallowable_ops, global_disallows, &c->rvalue_vals );
1719         } else if ( c->op == LDAP_MOD_DELETE ) {
1720                 if ( !c->line ) {
1721                         global_disallows = 0;
1722                 } else {
1723                         disallows = verb_to_mask( c->line, disallowable_ops );
1724                         global_disallows ^= disallows;
1725                 }
1726                 return 0;
1727         }
1728         i = verbs_to_mask(c->argc, c->argv, disallowable_ops, &disallows);
1729         if ( i ) {
1730                 Debug(LDAP_DEBUG_ANY, "%s: "
1731                         "unknown feature %s in \"disallow <features>\" line\n",
1732                         c->log, c->argv[i], 0);
1733                 return(1);
1734         }
1735         global_disallows |= disallows;
1736         return(0);
1737 }
1738
1739 static int
1740 config_requires(ConfigArgs *c) {
1741         slap_mask_t requires = 0;
1742         int i;
1743         slap_verbmasks requires_ops[] = {
1744                 { BER_BVC("bind"),              SLAP_REQUIRE_BIND },
1745                 { BER_BVC("LDAPv3"),            SLAP_REQUIRE_LDAP_V3 },
1746                 { BER_BVC("authc"),             SLAP_REQUIRE_AUTHC },
1747                 { BER_BVC("sasl"),              SLAP_REQUIRE_SASL },
1748                 { BER_BVC("strong"),            SLAP_REQUIRE_STRONG },
1749                 { BER_BVNULL, 0 }
1750         };
1751         if (c->op == SLAP_CONFIG_EMIT) {
1752                 return mask_to_verbs( requires_ops, c->be->be_requires, &c->rvalue_vals );
1753         } else if ( c->op == LDAP_MOD_DELETE ) {
1754                 if ( !c->line ) {
1755                         c->be->be_requires = 0;
1756                 } else {
1757                         requires = verb_to_mask( c->line, requires_ops );
1758                         c->be->be_requires ^= requires;
1759                 }
1760                 return 0;
1761         }
1762         i = verbs_to_mask(c->argc, c->argv, requires_ops, &requires);
1763         if ( i ) {
1764                 Debug(LDAP_DEBUG_ANY, "%s: "
1765                         "unknown feature %s in \"require <features>\" line\n",
1766                         c->log, c->argv[i], 0);
1767                 return(1);
1768         }
1769         c->be->be_requires = requires;
1770         return(0);
1771 }
1772
1773 static int
1774 config_loglevel(ConfigArgs *c) {
1775         int i;
1776         char *next;
1777         slap_verbmasks loglevel_ops[] = {
1778                 { BER_BVC("Trace"),     LDAP_DEBUG_TRACE },
1779                 { BER_BVC("Packets"),   LDAP_DEBUG_PACKETS },
1780                 { BER_BVC("Args"),      LDAP_DEBUG_ARGS },
1781                 { BER_BVC("Conns"),     LDAP_DEBUG_CONNS },
1782                 { BER_BVC("BER"),       LDAP_DEBUG_BER },
1783                 { BER_BVC("Filter"),    LDAP_DEBUG_FILTER },
1784                 { BER_BVC("Config"),    LDAP_DEBUG_CONFIG },
1785                 { BER_BVC("ACL"),       LDAP_DEBUG_ACL },
1786                 { BER_BVC("Stats"),     LDAP_DEBUG_STATS },
1787                 { BER_BVC("Stats2"),    LDAP_DEBUG_STATS2 },
1788                 { BER_BVC("Shell"),     LDAP_DEBUG_SHELL },
1789                 { BER_BVC("Parse"),     LDAP_DEBUG_PARSE },
1790                 { BER_BVC("Cache"),     LDAP_DEBUG_CACHE },
1791                 { BER_BVC("Index"),     LDAP_DEBUG_INDEX },
1792                 { BER_BVC("Any"),       -1 },
1793                 { BER_BVNULL,   0 }
1794         };
1795
1796         if (c->op == SLAP_CONFIG_EMIT) {
1797                 return mask_to_verbs( loglevel_ops, ldap_syslog, &c->rvalue_vals );
1798         } else if ( c->op == LDAP_MOD_DELETE ) {
1799                 if ( !c->line ) {
1800                         ldap_syslog = 0;
1801                 } else {
1802                         int level = verb_to_mask( c->line, loglevel_ops );
1803                         ldap_syslog ^= level;
1804                 }
1805                 return 0;
1806         }
1807
1808         ldap_syslog = 0;
1809
1810         for( i=1; i < c->argc; i++ ) {
1811                 int     level;
1812
1813                 if ( isdigit( c->argv[i][0] ) ) {
1814                         level = strtol( c->argv[i], &next, 10 );
1815                         if ( next == NULL || next[0] != '\0' ) {
1816                                 Debug( LDAP_DEBUG_ANY,
1817                                         "%s: unable to parse level \"%s\" "
1818                                         "in \"loglevel <level> [...]\" line.\n",
1819                                         c->log, c->argv[i], 0);
1820                                 return( 1 );
1821                         }
1822                 } else {
1823                         int j = verb_to_mask(c->argv[i], loglevel_ops);
1824                         if(BER_BVISNULL(&loglevel_ops[j].word)) {
1825                                 Debug( LDAP_DEBUG_ANY,
1826                                         "%s: unknown level \"%s\" "
1827                                         "in \"loglevel <level> [...]\" line.\n",
1828                                         c->log, c->argv[i], 0);
1829                                 return( 1 );
1830                         }
1831                         level = loglevel_ops[j].mask;
1832                 }
1833                 ldap_syslog |= level;
1834         }
1835         return(0);
1836 }
1837
1838 static int
1839 config_referral(ConfigArgs *c) {
1840         struct berval val;
1841         if (c->op == SLAP_CONFIG_EMIT) {
1842                 if ( default_referral ) {
1843                         value_add( &c->rvalue_vals, default_referral );
1844                         return 0;
1845                 } else {
1846                         return 1;
1847                 }
1848         } else if ( c->op == LDAP_MOD_DELETE ) {
1849                 if ( c->valx < 0 ) {
1850                         ber_bvarray_free( default_referral );
1851                         default_referral = NULL;
1852                 } else {
1853                         int i = c->valx;
1854                         ch_free( default_referral[i].bv_val );
1855                         for (; default_referral[i].bv_val; i++ )
1856                                 default_referral[i] = default_referral[i+1];
1857                 }
1858                 return 0;
1859         }
1860         if(validate_global_referral(c->argv[1])) {
1861                 Debug(LDAP_DEBUG_ANY, "%s: "
1862                         "invalid URL (%s) in \"referral\" line.\n",
1863                         c->log, c->argv[1], 0);
1864                 return(1);
1865         }
1866
1867         ber_str2bv(c->argv[1], 0, 0, &val);
1868         if(value_add_one(&default_referral, &val)) return(LDAP_OTHER);
1869         return(0);
1870 }
1871
1872 static struct {
1873         struct berval key;
1874         int off;
1875 } sec_keys[] = {
1876         { BER_BVC("ssf="), offsetof(slap_ssf_set_t, sss_ssf) },
1877         { BER_BVC("transport="), offsetof(slap_ssf_set_t, sss_transport) },
1878         { BER_BVC("tls="), offsetof(slap_ssf_set_t, sss_tls) },
1879         { BER_BVC("sasl="), offsetof(slap_ssf_set_t, sss_sasl) },
1880         { BER_BVC("update_ssf="), offsetof(slap_ssf_set_t, sss_update_ssf) },
1881         { BER_BVC("update_transport="), offsetof(slap_ssf_set_t, sss_update_transport) },
1882         { BER_BVC("update_tls="), offsetof(slap_ssf_set_t, sss_update_tls) },
1883         { BER_BVC("update_sasl="), offsetof(slap_ssf_set_t, sss_update_sasl) },
1884         { BER_BVC("simple_bind="), offsetof(slap_ssf_set_t, sss_simple_bind) },
1885         { BER_BVNULL, 0 }
1886 };
1887
1888 static int
1889 config_security(ConfigArgs *c) {
1890         slap_ssf_set_t *set = &c->be->be_ssf_set;
1891         char *next;
1892         int i, j;
1893         if (c->op == SLAP_CONFIG_EMIT) {
1894                 char numbuf[32];
1895                 struct berval bv;
1896                 slap_ssf_t *tgt;
1897                 int rc = 1;
1898
1899                 for (i=0; !BER_BVISNULL( &sec_keys[i].key ); i++) {
1900                         tgt = (slap_ssf_t *)((char *)set + sec_keys[i].off);
1901                         if ( *tgt ) {
1902                                 rc = 0;
1903                                 bv.bv_len = sprintf( numbuf, "%u", *tgt );
1904                                 bv.bv_len += sec_keys[i].key.bv_len;
1905                                 bv.bv_val = ch_malloc( bv.bv_len + 1);
1906                                 next = lutil_strcopy( bv.bv_val, sec_keys[i].key.bv_val );
1907                                 strcpy( next, numbuf );
1908                                 ber_bvarray_add( &c->rvalue_vals, &bv );
1909                         }
1910                 }
1911                 return rc;
1912         }
1913         for(i = 1; i < c->argc; i++) {
1914                 slap_ssf_t *tgt = NULL;
1915                 char *src;
1916                 for ( j=0; !BER_BVISNULL( &sec_keys[j].key ); j++ ) {
1917                         if(!strncasecmp(c->argv[i], sec_keys[j].key.bv_val,
1918                                 sec_keys[j].key.bv_len)) {
1919                                 src = c->argv[i] + sec_keys[j].key.bv_len;
1920                                 tgt = (slap_ssf_t *)((char *)set + sec_keys[j].off);
1921                                 break;
1922                         }
1923                 }
1924                 if ( !tgt ) {
1925                         Debug(LDAP_DEBUG_ANY, "%s: "
1926                                 "unknown factor %s in \"security <factors>\" line\n",
1927                                 c->log, c->argv[i], 0);
1928                         return(1);
1929                 }
1930
1931                 *tgt = strtol(src, &next, 10);
1932                 if(next == NULL || next[0] != '\0' ) {
1933                         Debug(LDAP_DEBUG_ANY, "%s: "
1934                                 "unable to parse factor \"%s\" in \"security <factors>\" line\n",
1935                                 c->log, c->argv[i], 0);
1936                         return(1);
1937                 }
1938         }
1939         return(0);
1940 }
1941
1942 char *
1943 anlist_unparse( AttributeName *an, char *ptr ) {
1944         int comma = 0;
1945
1946         for (; !BER_BVISNULL( &an->an_name ); an++) {
1947                 if ( comma ) *ptr++ = ',';
1948                 ptr = lutil_strcopy( ptr, an->an_name.bv_val );
1949                 comma = 1;
1950         }
1951         return ptr;
1952 }
1953
1954 static void
1955 replica_unparse( struct slap_replica_info *ri, int i, struct berval *bv )
1956 {
1957         int len;
1958         char *ptr;
1959         struct berval bc = {0};
1960         char numbuf[32];
1961
1962         len = sprintf(numbuf, IFMT, i );
1963
1964         len += strlen( ri->ri_uri ) + STRLENOF("uri=");
1965         if ( ri->ri_nsuffix ) {
1966                 for (i=0; !BER_BVISNULL( &ri->ri_nsuffix[i] ); i++) {
1967                         len += ri->ri_nsuffix[i].bv_len + STRLENOF(" suffix=\"\"");
1968                 }
1969         }
1970         if ( ri->ri_attrs ) {
1971                 len += STRLENOF("attr");
1972                 if ( ri->ri_exclude ) len++;
1973                 for (i=0; !BER_BVISNULL( &ri->ri_attrs[i].an_name ); i++) {
1974                         len += 1 + ri->ri_attrs[i].an_name.bv_len;
1975                 }
1976         }
1977         bindconf_unparse( &ri->ri_bindconf, &bc );
1978         len += bc.bv_len;
1979
1980         bv->bv_val = ch_malloc(len + 1);
1981         bv->bv_len = len;
1982
1983         ptr = lutil_strcopy( bv->bv_val, numbuf );
1984         ptr = lutil_strcopy( ptr, "uri=" );
1985         ptr = lutil_strcopy( ptr, ri->ri_uri );
1986
1987         if ( ri->ri_nsuffix ) {
1988                 for (i=0; !BER_BVISNULL( &ri->ri_nsuffix[i] ); i++) {
1989                         ptr = lutil_strcopy( ptr, " suffix=\"" );
1990                         ptr = lutil_strcopy( ptr, ri->ri_nsuffix[i].bv_val );
1991                         *ptr++ = '"';
1992                 }
1993         }
1994         if ( ri->ri_attrs ) {
1995                 ptr = lutil_strcopy( ptr, "attr" );
1996                 if ( ri->ri_exclude ) *ptr++ = '!';
1997                 *ptr++ = '=';
1998                 ptr = anlist_unparse( ri->ri_attrs, ptr );
1999         }
2000         if ( bc.bv_val ) {
2001                 strcpy( ptr, bc.bv_val );
2002                 ch_free( bc.bv_val );
2003         }
2004 }
2005
2006 static int
2007 config_replica(ConfigArgs *c) {
2008         int i, nr = -1, len;
2009         char *replicahost, *replicauri;
2010         LDAPURLDesc *ludp;
2011
2012         if (c->op == SLAP_CONFIG_EMIT) {
2013                 if (c->be->be_replica) {
2014                         struct berval bv;
2015                         for (i=0;c->be->be_replica[i]; i++) {
2016                                 replica_unparse( c->be->be_replica[i], i, &bv );
2017                                 ber_bvarray_add( &c->rvalue_vals, &bv );
2018                         }
2019                         return 0;
2020                 }
2021                 return 1;
2022         } else if ( c->op == LDAP_MOD_DELETE ) {
2023                 /* FIXME: there is no replica_free function */
2024                 if ( c->valx < 0 ) {
2025                 } else {
2026                 }
2027         }
2028         if(SLAP_MONITOR(c->be)) {
2029                 Debug(LDAP_DEBUG_ANY, "%s: "
2030                         "\"replica\" should not be used inside monitor database\n",
2031                         c->log, 0, 0);
2032                 return(0);      /* FIXME: should this be an error? */
2033         }
2034
2035         for(i = 1; i < c->argc; i++) {
2036                 if(!strncasecmp(c->argv[i], "host=", STRLENOF("host="))) {
2037                         replicahost = c->argv[i] + STRLENOF("host=");
2038                         len = strlen( replicahost );
2039                         replicauri = ch_malloc( len + STRLENOF("ldap://") + 1 );
2040                         sprintf( replicauri, "ldap://%s", replicahost );
2041                         replicahost = replicauri + STRLENOF( "ldap://");
2042                         nr = add_replica_info(c->be, replicauri, replicahost);
2043                         break;
2044                 } else if(!strncasecmp(c->argv[i], "uri=", STRLENOF("uri="))) {
2045                         if(ldap_url_parse(c->argv[i] + STRLENOF("uri="), &ludp) != LDAP_SUCCESS) {
2046                                 Debug(LDAP_DEBUG_ANY, "%s: "
2047                                         "replica line contains invalid "
2048                                         "uri definition.\n", c->log, 0, 0);
2049                                 return(1);
2050                         }
2051                         if(!ludp->lud_host) {
2052                                 Debug(LDAP_DEBUG_ANY, "%s: "
2053                                         "replica line contains invalid "
2054                                         "uri definition - missing hostname.\n",
2055                                         c->log, 0, 0);
2056                                 return(1);
2057                         }
2058                         ldap_free_urldesc(ludp);
2059                         replicauri = c->argv[i] + STRLENOF("uri=");
2060                         replicauri = ch_strdup( replicauri );
2061                         replicahost = strchr( replicauri, '/' );
2062                         replicahost += 2;
2063                         nr = add_replica_info(c->be, replicauri, replicahost);
2064                         break;
2065                 }
2066         }
2067         if(i == c->argc) {
2068                 Debug(LDAP_DEBUG_ANY, "%s: "
2069                         "missing host or uri in \"replica\" line\n",
2070                         c->log, 0, 0);
2071                 return(1);
2072         } else if(nr == -1) {
2073                 Debug(LDAP_DEBUG_ANY, "%s: "
2074                         "unable to add replica \"%s\"\n",
2075                         c->log, replicauri, 0);
2076                 return(1);
2077         } else {
2078                 for(i = 1; i < c->argc; i++) {
2079                         if(!strncasecmp(c->argv[i], "suffix=", STRLENOF( "suffix="))) {
2080                                 switch(add_replica_suffix(c->be, nr, c->argv[i] + STRLENOF("suffix="))) {
2081                                         case 1:
2082                                                 Debug(LDAP_DEBUG_ANY, "%s: "
2083                                                 "suffix \"%s\" in \"replica\" line is not valid for backend (ignored)\n",
2084                                                 c->log, c->argv[i] + STRLENOF("suffix="), 0);
2085                                                 break;
2086                                         case 2:
2087                                                 Debug(LDAP_DEBUG_ANY, "%s: "
2088                                                 "unable to normalize suffix in \"replica\" line (ignored)\n",
2089                                                 c->log, 0, 0);
2090                                                 break;
2091                                 }
2092
2093                         } else if(!strncasecmp(c->argv[i], "attr", STRLENOF("attr"))) {
2094                                 int exclude = 0;
2095                                 char *arg = c->argv[i] + STRLENOF("attr");
2096                                 if(arg[0] == '!') {
2097                                         arg++;
2098                                         exclude = 1;
2099                                 }
2100                                 if(arg[0] != '=') {
2101                                         continue;
2102                                 }
2103                                 if(add_replica_attrs(c->be, nr, arg + 1, exclude)) {
2104                                         Debug(LDAP_DEBUG_ANY, "%s: "
2105                                                 "attribute \"%s\" in \"replica\" line is unknown\n",
2106                                                 c->log, arg + 1, 0);
2107                                         return(1);
2108                                 }
2109                         } else if ( bindconf_parse( c->argv[i],
2110                                         &c->be->be_replica[nr]->ri_bindconf ) ) {
2111                                 return(1);
2112                         }
2113                 }
2114         }
2115         return(0);
2116 }
2117
2118 static int
2119 config_updatedn(ConfigArgs *c) {
2120         struct berval dn;
2121         int rc;
2122         if (c->op == SLAP_CONFIG_EMIT) {
2123                 if (!BER_BVISEMPTY(&c->be->be_update_ndn)) {
2124                         value_add_one(&c->rvalue_vals, &c->be->be_update_ndn);
2125                         value_add_one(&c->rvalue_nvals, &c->be->be_update_ndn);
2126                         return 0;
2127                 }
2128                 return 1;
2129         } else if ( c->op == LDAP_MOD_DELETE ) {
2130                 ch_free( c->be->be_update_ndn.bv_val );
2131                 c->be->be_update_ndn.bv_val = NULL;
2132                 SLAP_DBFLAGS(c->be) ^= (SLAP_DBFLAG_SHADOW | SLAP_DBFLAG_SLURP_SHADOW);
2133                 return 0;
2134         }
2135         if(SLAP_SHADOW(c->be)) {
2136                 Debug(LDAP_DEBUG_ANY, "%s: "
2137                         "updatedn: database already shadowed.\n",
2138                         c->log, 0, 0);
2139                 return(1);
2140         }
2141
2142         ber_str2bv(c->argv[1], 0, 0, &dn);
2143
2144         rc = dnNormalize(0, NULL, NULL, &dn, &c->be->be_update_ndn, NULL);
2145
2146         if(rc != LDAP_SUCCESS) {
2147                 Debug(LDAP_DEBUG_ANY, "%s: "
2148                         "updatedn DN is invalid: %d (%s)\n",
2149                         c->log, rc, ldap_err2string( rc ));
2150                 return(1);
2151         }
2152
2153         SLAP_DBFLAGS(c->be) |= (SLAP_DBFLAG_SHADOW | SLAP_DBFLAG_SLURP_SHADOW);
2154         return(0);
2155 }
2156
2157 static int
2158 config_updateref(ConfigArgs *c) {
2159         struct berval val;
2160         if (c->op == SLAP_CONFIG_EMIT) {
2161                 if ( c->be->be_update_refs ) {
2162                         value_add( &c->rvalue_vals, c->be->be_update_refs );
2163                         return 0;
2164                 } else {
2165                         return 1;
2166                 }
2167         } else if ( c->op == LDAP_MOD_DELETE ) {
2168                 if ( c->valx < 0 ) {
2169                         ber_bvarray_free( c->be->be_update_refs );
2170                         c->be->be_update_refs = NULL;
2171                 } else {
2172                         int i = c->valx;
2173                         ch_free( c->be->be_update_refs[i].bv_val );
2174                         for (; c->be->be_update_refs[i].bv_val; i++)
2175                                 c->be->be_update_refs[i] = c->be->be_update_refs[i+1];
2176                 }
2177                 return 0;
2178         }
2179         if(!SLAP_SHADOW(c->be)) {
2180                 Debug(LDAP_DEBUG_ANY, "%s: "
2181                         "updateref line must come after syncrepl or updatedn.\n",
2182                         c->log, 0, 0);
2183                 return(1);
2184         }
2185
2186         if(validate_global_referral(c->argv[1])) {
2187                 Debug(LDAP_DEBUG_ANY, "%s: "
2188                         "invalid URL (%s) in \"updateref\" line.\n",
2189                         c->log, c->argv[1], 0);
2190                 return(1);
2191         }
2192         ber_str2bv(c->argv[1], 0, 0, &val);
2193         if(value_add_one(&c->be->be_update_refs, &val)) return(LDAP_OTHER);
2194         return(0);
2195 }
2196
2197 static int
2198 config_include(ConfigArgs *c) {
2199         unsigned long savelineno = c->lineno;
2200         int rc;
2201         ConfigFile *cf;
2202         ConfigFile *cfsave = cfn;
2203         ConfigFile *cf2 = NULL;
2204         if (c->op == SLAP_CONFIG_EMIT) {
2205                 if (c->private) {
2206                         ConfigFile *cf = c->private;
2207                         value_add_one( &c->rvalue_vals, &cf->c_file );
2208                         return 0;
2209                 }
2210                 return 1;
2211         } else if ( c->op == LDAP_MOD_DELETE ) {
2212         }
2213         cf = ch_calloc( 1, sizeof(ConfigFile));
2214         if ( cfn->c_kids ) {
2215                 for (cf2=cfn->c_kids; cf2 && cf2->c_sibs; cf2=cf2->c_sibs) ;
2216                 cf2->c_sibs = cf;
2217         } else {
2218                 cfn->c_kids = cf;
2219         }
2220         cfn = cf;
2221         ber_str2bv( c->argv[1], 0, 1, &cf->c_file );
2222         rc = read_config_file(c->argv[1], c->depth + 1, c);
2223         c->lineno = savelineno - 1;
2224         cfn = cfsave;
2225         if ( rc ) {
2226                 if ( cf2 ) cf2->c_sibs = NULL;
2227                 else cfn->c_kids = NULL;
2228                 ch_free( cf->c_file.bv_val );
2229                 ch_free( cf );
2230         }
2231         return(rc);
2232 }
2233
2234 #ifdef HAVE_TLS
2235 static int
2236 config_tls_option(ConfigArgs *c) {
2237         int flag;
2238         switch(c->type) {
2239         case CFG_TLS_RAND:      flag = LDAP_OPT_X_TLS_RANDOM_FILE;      break;
2240         case CFG_TLS_CIPHER:    flag = LDAP_OPT_X_TLS_CIPHER_SUITE;     break;
2241         case CFG_TLS_CERT_FILE: flag = LDAP_OPT_X_TLS_CERTFILE;         break;
2242         case CFG_TLS_CERT_KEY:  flag = LDAP_OPT_X_TLS_KEYFILE;          break;
2243         case CFG_TLS_CA_PATH:   flag = LDAP_OPT_X_TLS_CACERTDIR;        break;
2244         case CFG_TLS_CA_FILE:   flag = LDAP_OPT_X_TLS_CACERTFILE;       break;
2245         default:                Debug(LDAP_DEBUG_ANY, "%s: "
2246                                         "unknown tls_option <0x%x>\n",
2247                                         c->log, c->type, 0);
2248         }
2249         if (c->op == SLAP_CONFIG_EMIT) {
2250                 return ldap_pvt_tls_get_option( NULL, flag, &c->value_string );
2251         } else if ( c->op == LDAP_MOD_DELETE ) {
2252                 return ldap_pvt_tls_set_option( NULL, flag, NULL );
2253         }
2254         ch_free(c->value_string);
2255         return(ldap_pvt_tls_set_option(NULL, flag, c->argv[1]));
2256 }
2257
2258 /* FIXME: this ought to be provided by libldap */
2259 static int
2260 config_tls_config(ConfigArgs *c) {
2261         int i, flag;
2262         slap_verbmasks crlkeys[] = {
2263                 { BER_BVC("none"),      LDAP_OPT_X_TLS_CRL_NONE },
2264                 { BER_BVC("peer"),      LDAP_OPT_X_TLS_CRL_PEER },
2265                 { BER_BVC("all"),       LDAP_OPT_X_TLS_CRL_ALL },
2266                 { BER_BVNULL, 0 }
2267         };
2268         slap_verbmasks vfykeys[] = {
2269                 { BER_BVC("never"),     LDAP_OPT_X_TLS_NEVER },
2270                 { BER_BVC("demand"),    LDAP_OPT_X_TLS_DEMAND },
2271                 { BER_BVC("try"),       LDAP_OPT_X_TLS_TRY },
2272                 { BER_BVC("hard"),      LDAP_OPT_X_TLS_HARD },
2273                 { BER_BVNULL, 0 }
2274         }, *keys;
2275         switch(c->type) {
2276         case CFG_TLS_CRLCHECK:  flag = LDAP_OPT_X_TLS_CRLCHECK;         keys = crlkeys; break;
2277         case CFG_TLS_VERIFY:    flag = LDAP_OPT_X_TLS_REQUIRE_CERT;     keys = vfykeys; break;
2278         default:
2279                 Debug(LDAP_DEBUG_ANY, "%s: "
2280                                 "unknown tls_option <0x%x>\n",
2281                                 c->log, c->type, 0);
2282         }
2283         if (c->op == SLAP_CONFIG_EMIT) {
2284                 ldap_pvt_tls_get_option( NULL, flag, &c->value_int );
2285                 for (i=0; !BER_BVISNULL(&keys[i].word); i++) {
2286                         if (keys[i].mask == c->value_int) {
2287                                 c->value_string = ch_strdup( keys[i].word.bv_val );
2288                                 return 0;
2289                         }
2290                 }
2291                 return 1;
2292         } else if ( c->op == LDAP_MOD_DELETE ) {
2293                 int i = 0;
2294                 return ldap_pvt_tls_set_option( NULL, flag, &i );
2295         }
2296         ch_free( c->value_string );
2297         if(isdigit((unsigned char)c->argv[1][0])) {
2298                 i = atoi(c->argv[1]);
2299                 return(ldap_pvt_tls_set_option(NULL, flag, &i));
2300         } else {
2301                 return(ldap_int_tls_config(NULL, flag, c->argv[1]));
2302         }
2303 }
2304 #endif
2305
2306 static CfEntryInfo *
2307 config_find_base( CfEntryInfo *root, struct berval *dn, CfEntryInfo **last )
2308 {
2309         struct berval cdn;
2310         char *c;
2311
2312         if ( !root ) {
2313                 *last = NULL;
2314                 return NULL;
2315         }
2316
2317         if ( dn_match( &root->ce_entry->e_nname, dn ))
2318                 return root;
2319
2320         c = dn->bv_val+dn->bv_len;
2321         for (;*c != ',';c--);
2322
2323         while(root) {
2324                 *last = root;
2325                 for (--c;c>dn->bv_val && *c != ',';c--);
2326                 cdn.bv_val = c;
2327                 if ( *c == ',' )
2328                         cdn.bv_val++;
2329                 cdn.bv_len = dn->bv_len - (cdn.bv_val - dn->bv_val);
2330
2331                 root = root->ce_kids;
2332
2333                 for (;root;root=root->ce_sibs) {
2334                         if ( dn_match( &root->ce_entry->e_nname, &cdn )) {
2335                                 if ( cdn.bv_val == dn->bv_val ) {
2336                                         return root;
2337                                 }
2338                                 break;
2339                         }
2340                 }
2341         }
2342         return root;
2343 }
2344
2345 static int
2346 config_ldif_resp( Operation *op, SlapReply *rs )
2347 {
2348         if ( rs->sr_type == REP_SEARCH ) {
2349                 CfBackInfo *cfb = op->o_callback->sc_private;
2350
2351                 cfb->cb_got_ldif = 1;
2352                 rs->sr_err = config_add_internal( cfb, rs->sr_entry, NULL, NULL );
2353         }
2354         return rs->sr_err;
2355 }
2356
2357 /* Configure and read the underlying back-ldif store */
2358 static int
2359 config_setup_ldif( BackendDB *be, const char *dir ) {
2360         CfBackInfo *cfb = be->be_private;
2361         ConfigArgs c = {0};
2362         ConfigTable *ct;
2363         char *argv[3];
2364         int rc;
2365         slap_callback cb = { NULL, config_ldif_resp, NULL, NULL };
2366         Connection conn = {0};
2367         char opbuf[OPERATION_BUFFER_SIZE];
2368         Operation *op;
2369         SlapReply rs = {REP_RESULT};
2370         Filter filter = { LDAP_FILTER_PRESENT };
2371         struct berval filterstr = BER_BVC("(objectclass=*)");
2372         struct stat st;
2373
2374         /* Is the config directory available? */
2375         if ( stat( dir, &st ) < 0 ) {
2376                 /* No, so don't bother using the backing store.
2377                  * All changes will be in-memory only.
2378                  */
2379                 return 0;
2380         }
2381
2382         cfb->cb_db.bd_info = backend_info( "ldif" );
2383         if ( !cfb->cb_db.bd_info )
2384                 return 0;       /* FIXME: eventually this will be a fatal error */
2385
2386         if ( cfb->cb_db.bd_info->bi_db_init( &cfb->cb_db )) return 1;
2387
2388         /* Mark that back-ldif type is in use */
2389         cfb->cb_db.bd_info->bi_nDB++;
2390
2391         cfb->cb_db.be_suffix = be->be_suffix;
2392         cfb->cb_db.be_nsuffix = be->be_nsuffix;
2393         cfb->cb_db.be_rootdn = be->be_rootdn;
2394         cfb->cb_db.be_rootndn = be->be_rootndn;
2395
2396         ber_str2bv( dir, 0, 1, &cfdir );
2397
2398         c.be = &cfb->cb_db;
2399         c.fname = "slapd";
2400         c.argc = 2;
2401         argv[0] = "directory";
2402         argv[1] = (char *)dir;
2403         argv[2] = NULL;
2404         c.argv = argv;
2405
2406         ct = config_find_keyword( c.be->be_cf_table, &c );
2407         if ( !ct )
2408                 return 1;
2409
2410         if ( config_add_vals( ct, &c ))
2411                 return 1;
2412
2413         if ( backend_startup_one( &cfb->cb_db ))
2414                 return 1;
2415
2416         op = (Operation *)opbuf;
2417         connection_fake_init( &conn, op, cfb );
2418
2419         filter.f_desc = slap_schema.si_ad_objectClass;
2420
2421         op->o_tag = LDAP_REQ_SEARCH;
2422
2423         op->ors_filter = &filter;
2424         op->ors_filterstr = filterstr;
2425         op->ors_scope = LDAP_SCOPE_SUBTREE;
2426
2427         op->o_dn = be->be_rootdn;
2428         op->o_ndn = be->be_rootndn;
2429
2430         op->o_req_dn = be->be_suffix[0];
2431         op->o_req_ndn = be->be_nsuffix[0];
2432
2433         op->ors_tlimit = SLAP_NO_LIMIT;
2434         op->ors_slimit = SLAP_NO_LIMIT;
2435
2436         op->ors_attrs = slap_anlist_all_attributes;
2437         op->ors_attrsonly = 0;
2438
2439         op->o_callback = &cb;
2440         cb.sc_private = cfb;
2441
2442         op->o_bd = &cfb->cb_db;
2443         op->o_bd->be_search( op, &rs );
2444
2445         cfb->cb_use_ldif = 1;
2446
2447         return 0;
2448 }
2449
2450 static int
2451 CfOcInfo_cmp( const void *c1, const void *c2 ) {
2452         const CfOcInfo *co1 = c1;
2453         const CfOcInfo *co2 = c2;
2454
2455         return ber_bvcmp( co1->co_name, co2->co_name );
2456 }
2457
2458 int
2459 config_register_schema(ConfigTable *ct, ConfigOCs *ocs) {
2460         int i;
2461         CfOcInfo *co;
2462
2463         i = init_config_attrs( ct );
2464         if ( i ) return i;
2465
2466         /* set up the objectclasses */
2467         i = init_config_ocs( ocs );
2468         if ( i ) return i;
2469
2470         for (i=0; ocs[i].def; i++) {
2471                 if ( ocs[i].oc ) {
2472                         co = ch_malloc( sizeof(CfOcInfo) );
2473                         co->co_oc = *ocs[i].oc;
2474                         co->co_name = &co->co_oc->soc_cname;
2475                         co->co_table = ct;
2476                         co->co_type = ocs[i].cft;
2477                         avl_insert( &CfOcTree, co, CfOcInfo_cmp, avl_dup_error );
2478                 }
2479         }
2480         return 0;
2481 }
2482
2483 int
2484 read_config(const char *fname, const char *dir) {
2485         BackendDB *be;
2486         CfBackInfo *cfb;
2487
2488         /* Setup the config backend */
2489         be = backend_db_init( "config" );
2490         if ( !be )
2491                 return 1;
2492
2493         cfb = be->be_private;
2494
2495         /* Setup the underlying back-ldif backend */
2496         if ( config_setup_ldif( be, dir ))
2497                 return 1;
2498
2499 #ifdef  SLAP_USE_CONFDIR
2500         /* If we read the config from back-ldif, nothing to do here */
2501         if ( cfb->cb_got_ldif )
2502                 return 0;
2503 #endif
2504         ber_str2bv( fname, 0, 1, &cf_prv.c_file );
2505
2506         return read_config_file(fname, 0, NULL);
2507 }
2508
2509 static int
2510 config_back_bind( Operation *op, SlapReply *rs )
2511 {
2512         if ( op->orb_method == LDAP_AUTH_SIMPLE && be_isroot_pw( op )) {
2513                 ber_dupbv( &op->orb_edn, be_root_dn( op->o_bd ));
2514                 /* frontend sends result */
2515                 return LDAP_SUCCESS;
2516         }
2517
2518         rs->sr_err = LDAP_INVALID_CREDENTIALS;
2519         send_ldap_result( op, rs );
2520
2521         return rs->sr_err;
2522 }
2523
2524 static int
2525 config_send( Operation *op, SlapReply *rs, CfEntryInfo *ce, int depth )
2526 {
2527         int rc = 0;
2528
2529         if ( test_filter( op, ce->ce_entry, op->ors_filter ) == LDAP_COMPARE_TRUE )
2530         {
2531                 rs->sr_attrs = op->ors_attrs;
2532                 rs->sr_entry = ce->ce_entry;
2533                 rc = send_search_entry( op, rs );
2534         }
2535         if ( op->ors_scope == LDAP_SCOPE_SUBTREE ) {
2536                 if ( ce->ce_kids ) {
2537                         rc = config_send( op, rs, ce->ce_kids, 1 );
2538                         if ( rc ) return rc;
2539                 }
2540                 if ( depth ) {
2541                         for (ce=ce->ce_sibs; ce; ce=ce->ce_sibs) {
2542                                 rc = config_send( op, rs, ce, 0 );
2543                                 if ( rc ) break;
2544                         }
2545                 }
2546         }
2547         return rc;
2548 }
2549
2550 static ConfigTable *
2551 config_find_table( CfOcInfo **colst, int nocs, AttributeDescription *ad )
2552 {
2553         int i, j;
2554
2555         for (j=0; j<nocs; j++) {
2556                 for (i=0; colst[j]->co_table[i].name; i++)
2557                         if ( colst[j]->co_table[i].ad == ad )
2558                                 return &colst[j]->co_table[i];
2559         }
2560         return NULL;
2561 }
2562
2563 /* Sort the attributes of the entry according to the order defined
2564  * in the objectclass, with required attributes occurring before
2565  * allowed attributes. For any attributes with sequencing dependencies
2566  * (e.g., rootDN must be defined after suffix) the objectclass must
2567  * list the attributes in the desired sequence.
2568  */
2569 static void
2570 sort_attrs( Entry *e, CfOcInfo **colst, int nocs )
2571 {
2572         Attribute *a, *head = NULL, *tail = NULL, **prev;
2573         int i, j;
2574
2575         for (i=0; i<nocs; i++) {
2576                 if ( colst[i]->co_oc->soc_required ) {
2577                         AttributeType **at = colst[i]->co_oc->soc_required;
2578                         for (j=0; at[j]; j++) {
2579                                 for (a=e->e_attrs, prev=&e->e_attrs; a;
2580                                         prev = &(*prev)->a_next, a=a->a_next) {
2581                                         if ( a->a_desc == at[j]->sat_ad ) {
2582                                                 *prev = a->a_next;
2583                                                 if (!head) {
2584                                                         head = a;
2585                                                         tail = a;
2586                                                 } else {
2587                                                         tail->a_next = a;
2588                                                         tail = a;
2589                                                 }
2590                                                 break;
2591                                         }
2592                                 }
2593                         }
2594                 }
2595                 if ( colst[i]->co_oc->soc_allowed ) {
2596                         AttributeType **at = colst[i]->co_oc->soc_allowed;
2597                         for (j=0; at[j]; j++) {
2598                                 for (a=e->e_attrs, prev=&e->e_attrs; a;
2599                                         prev = &(*prev)->a_next, a=a->a_next) {
2600                                         if ( a->a_desc == at[j]->sat_ad ) {
2601                                                 *prev = a->a_next;
2602                                                 if (!head) {
2603                                                         head = a;
2604                                                         tail = a;
2605                                                 } else {
2606                                                         tail->a_next = a;
2607                                                         tail = a;
2608                                                 }
2609                                                 break;
2610                                         }
2611                                 }
2612                         }
2613                 }
2614         }
2615         if ( tail ) {
2616                 tail->a_next = e->e_attrs;
2617                 e->e_attrs = head;
2618         }
2619 }
2620
2621 static int
2622 check_vals( ConfigTable *ct, ConfigArgs *ca, void *ptr, int isAttr )
2623 {
2624         Attribute *a = NULL;
2625         AttributeDescription *ad;
2626         BerVarray vals;
2627
2628         int i, rc = 0, sort = 0;
2629
2630         if ( isAttr ) {
2631                 a = ptr;
2632                 ad = a->a_desc;
2633                 vals = a->a_vals;
2634         } else {
2635                 Modifications *ml = ptr;
2636                 ad = ml->sml_desc;
2637                 vals = ml->sml_values;
2638         }
2639
2640         if ( a && ( ad->ad_type->sat_flags & SLAP_AT_ORDERED_VAL )) {
2641                 sort = 1;
2642                 rc = ordered_value_sort( a, 1 );
2643                 if ( rc )
2644                         return rc;
2645         }
2646         for ( i=0; vals[i].bv_val; i++ ) {
2647                 ca->line = vals[i].bv_val;
2648                 if ( sort ) {
2649                         char *idx = strchr( ca->line, '}' );
2650                         if ( idx ) ca->line = idx+1;
2651                 }
2652                 rc = config_parse_vals( ct, ca, i );
2653                 if ( rc )
2654                         break;
2655         }
2656         return rc;
2657 }
2658
2659 static int
2660 check_name_index( CfEntryInfo *parent, ConfigType ce_type, Entry *e,
2661         SlapReply *rs, int *renum )
2662 {
2663         CfEntryInfo *ce;
2664         int index = -1, gotindex = 0, nsibs;
2665         int renumber = 0, tailindex = 0;
2666         char *ptr1, *ptr2;
2667         struct berval rdn;
2668
2669         if ( renum ) *renum = 0;
2670
2671         /* These entries don't get indexed/renumbered */
2672         if ( ce_type == Cft_Global ) return 0;
2673         if ( ce_type == Cft_Schema && parent->ce_type == Cft_Global ) return 0;
2674
2675         if ( ce_type == Cft_Include || ce_type == Cft_Module )
2676                 tailindex = 1;
2677
2678         /* See if the rdn has an index already */
2679         dnRdn( &e->e_name, &rdn );
2680         ptr1 = strchr( e->e_name.bv_val, '{' );
2681         if ( ptr1 && ptr1 - e->e_name.bv_val < rdn.bv_len ) {
2682                 ptr2 = strchr( ptr1, '}' );
2683                 if (!ptr2 || ptr2 - e->e_name.bv_val > rdn.bv_len)
2684                         return LDAP_NAMING_VIOLATION;
2685                 if ( ptr2-ptr1 == 1)
2686                         return LDAP_NAMING_VIOLATION;
2687                 gotindex = 1;
2688                 index = atoi(ptr1+1);
2689                 if ( index < 0 )
2690                         return LDAP_NAMING_VIOLATION;
2691         }
2692
2693         /* count related kids */
2694         for (nsibs=0, ce=parent->ce_kids; ce; ce=ce->ce_sibs) {
2695                 if ( ce->ce_type == ce_type ) nsibs++;
2696         }
2697
2698         if ( index != nsibs ) {
2699                 if ( gotindex ) {
2700                         if ( index < nsibs ) {
2701                                 if ( tailindex ) return LDAP_NAMING_VIOLATION;
2702                                 /* Siblings need to be renumbered */
2703                                 renumber = 1;
2704                         }
2705                 }
2706                 if ( !renumber ) {
2707                         struct berval ival, newrdn, nnewrdn;
2708                         struct berval rtype, rval;
2709                         Attribute *a;
2710                         AttributeDescription *ad = NULL;
2711                         char ibuf[32];
2712                         const char *text;
2713
2714                         rval.bv_val = strchr(rdn.bv_val, '=' ) + 1;
2715                         rval.bv_len = rdn.bv_len - (rval.bv_val - rdn.bv_val);
2716                         rtype.bv_val = rdn.bv_val;
2717                         rtype.bv_len = rval.bv_val - rtype.bv_val - 1;
2718
2719                         /* Find attr */
2720                         slap_bv2ad( &rtype, &ad, &text );
2721                         a = attr_find( e->e_attrs, ad );
2722                         if (!a ) return LDAP_NAMING_VIOLATION;
2723
2724                         ival.bv_val = ibuf;
2725                         ival.bv_len = sprintf( ibuf, IFMT, nsibs );
2726
2727                         newrdn.bv_len = rdn.bv_len + ival.bv_len;
2728                         newrdn.bv_val = ch_malloc( newrdn.bv_len+1 );
2729
2730                         if ( tailindex ) {
2731                                 ptr1 = lutil_strncopy( newrdn.bv_val, rdn.bv_val, rdn.bv_len );
2732                                 ptr1 = lutil_strcopy( ptr1, ival.bv_val );
2733                         } else {
2734                                 int xlen;
2735                                 if ( !gotindex ) {
2736                                         ptr2 = rval.bv_val;
2737                                         xlen = rval.bv_len;
2738                                 } else {
2739                                         xlen = rdn.bv_len - (ptr2 - rdn.bv_val);
2740                                 }
2741                                 ptr1 = lutil_strncopy( newrdn.bv_val, rtype.bv_val,
2742                                         rtype.bv_len );
2743                                 *ptr1++ = '=';
2744                                 ptr1 = lutil_strcopy( ptr1, ival.bv_val );
2745                                 ptr1 = lutil_strncopy( ptr1, ptr2, xlen );
2746                                 *ptr1 = '\0';
2747                         }
2748
2749                         /* Do the equivalent of ModRDN */
2750                         /* Replace DN / NDN */
2751                         newrdn.bv_len = ptr1 - newrdn.bv_val;
2752                         rdnNormalize( 0, NULL, NULL, &newrdn, &nnewrdn, NULL );
2753                         free( e->e_name.bv_val );
2754                         build_new_dn( &e->e_name, &parent->ce_entry->e_name,
2755                                 &newrdn, NULL );
2756                         free( e->e_nname.bv_val );
2757                         build_new_dn( &e->e_nname, &parent->ce_entry->e_nname,
2758                                 &nnewrdn, NULL );
2759
2760                         /* Replace attr */
2761                         free( a->a_vals[0].bv_val );
2762                         ptr1 = strchr( newrdn.bv_val, '=' ) + 1;
2763                         a->a_vals[0].bv_len = newrdn.bv_len - (ptr1 - newrdn.bv_val);
2764                         a->a_vals[0].bv_val = ch_malloc( a->a_vals[0].bv_len + 1 );
2765                         strcpy( a->a_vals[0].bv_val, ptr1 );
2766
2767                         if ( a->a_nvals != a->a_vals ) {
2768                                 free( a->a_nvals[0].bv_val );
2769                                 ptr1 = strchr( nnewrdn.bv_val, '=' ) + 1;
2770                                 a->a_nvals[0].bv_len = nnewrdn.bv_len - (ptr1 - nnewrdn.bv_val);
2771                                 a->a_nvals[0].bv_val = ch_malloc( a->a_nvals[0].bv_len + 1 );
2772                                 strcpy( a->a_nvals[0].bv_val, ptr1 );
2773                         }
2774                         free( nnewrdn.bv_val );
2775                         free( newrdn.bv_val );
2776                 }
2777         }
2778         if ( renum ) *renum = renumber;
2779         return 0;
2780 }
2781
2782 static CfOcInfo **
2783 count_ocs( Attribute *oc_at, int *nocs )
2784 {
2785         int i, j, n;
2786         CfOcInfo co, *coptr, **colst;
2787
2788         /* count the objectclasses */
2789         for ( i=0; oc_at->a_nvals[i].bv_val; i++ );
2790         n = i;
2791         colst = (CfOcInfo **)ch_malloc( n * sizeof(CfOcInfo *));
2792
2793         for ( i=0, j=0; i<n; i++) {
2794                 co.co_name = &oc_at->a_nvals[i];
2795                 coptr = avl_find( CfOcTree, &co, CfOcInfo_cmp );
2796
2797                 /* ignore non-config objectclasses. probably should be
2798                  * an error, general data doesn't belong here.
2799                  */
2800                 if ( !coptr ) continue;
2801
2802                 /* Ignore the root objectclass, it has no implementation.
2803                  */
2804                 if ( coptr->co_type == Cft_Abstract ) continue;
2805                 colst[j++] = coptr;
2806         }
2807         *nocs = j;
2808         return colst;
2809 }
2810
2811 /* Parse an LDAP entry into config directives */
2812 static int
2813 config_add_internal( CfBackInfo *cfb, Entry *e, SlapReply *rs, int *renum )
2814 {
2815         CfEntryInfo *ce, *last;
2816         CfOcInfo **colst;
2817         Attribute *a, *oc_at, *type_attr;
2818         AttributeDescription *type_ad = NULL;
2819         int i, j, nocs, rc;
2820         ConfigArgs ca = {0};
2821         struct berval pdn;
2822         ConfigTable *ct, *type_ct = NULL;
2823         char *ptr;
2824
2825         /* Make sure parent exists and entry does not */
2826         ce = config_find_base( cfb->cb_root, &e->e_nname, &last );
2827         if ( ce )
2828                 return LDAP_ALREADY_EXISTS;
2829
2830         dnParent( &e->e_nname, &pdn );
2831
2832         /* If last is NULL, the new entry is the root/suffix entry,
2833          * otherwise last should be the parent.
2834          */
2835         if ( last && !dn_match( &last->ce_entry->e_nname, &pdn )) {
2836                 if ( rs )
2837                         rs->sr_matched = last->ce_entry->e_name.bv_val;
2838                 return LDAP_NO_SUCH_OBJECT;
2839         }
2840
2841         oc_at = attr_find( e->e_attrs, slap_schema.si_ad_objectClass );
2842         if ( !oc_at ) return LDAP_OBJECT_CLASS_VIOLATION;
2843
2844         colst = count_ocs( oc_at, &nocs );
2845
2846         /* Only the root can be Cft_Global, everything else must
2847          * have a parent. Only limited nesting arrangements are allowed.
2848          */
2849         switch( colst[0]->co_type ) {
2850         case Cft_Global:
2851                 if ( last )  {
2852                         rc = LDAP_CONSTRAINT_VIOLATION;
2853                         goto leave;
2854                 }
2855                 break;
2856         case Cft_Schema:
2857         case Cft_Backend:
2858         case Cft_Database:
2859         case Cft_Include:
2860                 if ( !last || ( last->ce_type != Cft_Global &&
2861                         last->ce_type != colst[0]->co_type )) {
2862                         rc = LDAP_CONSTRAINT_VIOLATION;
2863                         goto leave;
2864                 }
2865                 break;
2866         case Cft_Overlay:
2867                 if ( !last || ( last->ce_type != Cft_Global &&
2868                         last->ce_type != Cft_Database &&
2869                         last->ce_type != colst[0]->co_type )) {
2870                         rc = LDAP_CONSTRAINT_VIOLATION;
2871                         goto leave;
2872                 }
2873                 break;
2874 #ifdef SLAPD_MODULES
2875         case Cft_Module:
2876                 if ( !last || last->ce_type != Cft_Global ) {
2877                         rc = LDAP_CONSTRAINT_VIOLATION;
2878                         goto leave;
2879                 }
2880 #endif
2881                 break;
2882         }
2883
2884         sort_attrs( e, colst, nocs );
2885
2886         /* Parse all the values and check for simple syntax errors before
2887          * performing any set actions.
2888          */
2889         switch (colst[0]->co_type) {
2890         case Cft_Schema:
2891                 /* The cn=schema entry is all hardcoded, so never reparse it */
2892                 if (last->ce_type == Cft_Global )
2893                         goto ok;
2894                 /* FALLTHRU */
2895         case Cft_Global:
2896                 ca.be = LDAP_STAILQ_FIRST(&backendDB);
2897                 break;
2898
2899         case Cft_Backend:
2900                 if ( last->ce_type == Cft_Backend )
2901                         ca.bi = last->ce_bi;
2902                 else
2903                         type_ad = cfAd_backend;
2904                 break;
2905         case Cft_Database:
2906                 if ( last->ce_type == Cft_Database ) {
2907                         ca.be = last->ce_be;
2908                 } else {
2909                         type_ad = cfAd_database;
2910                         /* dummy, just to get past check_attr */
2911                         ca.be = frontendDB;
2912                 }
2913                 break;
2914
2915         case Cft_Overlay:
2916                 ca.be = last->ce_be;
2917                 type_ad = cfAd_overlay;
2918                 break;
2919
2920         case Cft_Include:
2921                 if ( !rs ) {
2922                         nocs = 0; /* ignored */
2923                         break;
2924                 }
2925                 type_ad = cfAd_include;
2926                 break;
2927 #ifdef SLAPD_MODULES
2928         case Cft_Module: {
2929                 ModPaths *mp;
2930                 char *ptr;
2931                 ptr = strchr( e->e_name.bv_val, '{' );
2932                 if ( !ptr ) {
2933                         rc = LDAP_NAMING_VIOLATION;
2934                         goto leave;
2935                 }
2936                 j = atoi(ptr+1);
2937                 for (i=0, mp=&modpaths; mp && i<j; mp=mp->mp_next);
2938                 /* There is no corresponding modpath for this load? */
2939                 if ( i != j ) {
2940                         rc = LDAP_NAMING_VIOLATION;
2941                         goto leave;
2942                 }
2943                 module_path( mp->mp_path.bv_val );
2944                 ca.private = mp;
2945                 }
2946                 break;
2947 #endif
2948         }
2949
2950         /* If doing an LDAPadd, check for indexed names and any necessary
2951          * renaming/renumbering. Entries that don't need indexed names are
2952          * ignored. Entries that need an indexed name and arrive without one
2953          * are assigned to the end. Entries that arrive with an index may
2954          * cause the following entries to be renumbered/bumped down.
2955          *
2956          * Note that "pseudo-indexed" entries (cn=Include{xx}, cn=Module{xx})
2957          * don't allow Adding an entry with an index that's already in use.
2958          * This is flagged as an error (LDAP_ALREADY_EXISTS) up above.
2959          *
2960          * These entries can have auto-assigned indexes (appended to the end)
2961          * but only the other types support auto-renumbering of siblings.
2962          */
2963         rc = check_name_index( last, colst[0]->co_type, e, rs, renum );
2964         if ( rc )
2965                 goto leave;
2966
2967         init_config_argv( &ca );
2968         if ( type_ad ) {
2969                 type_attr = attr_find( e->e_attrs, type_ad );
2970                 if ( !type_attr ) {
2971                         rc = LDAP_OBJECT_CLASS_VIOLATION;
2972                         goto leave;
2973                 }
2974                 type_ct = config_find_table( colst, nocs, type_ad );
2975                 if ( !type_ct ) {
2976                         rc = LDAP_OBJECT_CLASS_VIOLATION;
2977                         goto leave;
2978                 }
2979                 rc = check_vals( type_ct, &ca, type_attr, 1);
2980                 if ( rc ) goto leave;
2981         }
2982         for ( a=e->e_attrs; a; a=a->a_next ) {
2983                 if ( a == type_attr || a == oc_at ) continue;
2984                 ct = config_find_table( colst, nocs, a->a_desc );
2985                 if ( !ct ) continue;    /* user data? */
2986                 rc = check_vals( ct, &ca, a, 1 );
2987                 if ( rc ) goto leave;
2988         }
2989
2990         /* Basic syntax checks are OK. Do the actual settings. */
2991         if ( type_ct ) {
2992                 ca.line = type_attr->a_vals[0].bv_val;
2993                 if ( type_ad->ad_type->sat_flags & SLAP_AT_ORDERED ) {
2994                         ptr = strchr( ca.line, '}' );
2995                         if ( ptr ) ca.line = ptr+1;
2996                 }
2997                 ca.valx = 0;
2998                 rc = config_parse_add( type_ct, &ca );
2999                 if ( rc ) {
3000                         rc = LDAP_OTHER;
3001                         goto leave;
3002                 }
3003         }
3004         for ( a=e->e_attrs; a; a=a->a_next ) {
3005                 if ( a == type_attr || a == oc_at ) continue;
3006                 ct = config_find_table( colst, nocs, a->a_desc );
3007                 if ( !ct ) continue;    /* user data? */
3008                 for (i=0; a->a_vals[i].bv_val; i++) {
3009                         ca.line = a->a_vals[i].bv_val;
3010                         if ( a->a_desc->ad_type->sat_flags & SLAP_AT_ORDERED ) {
3011                                 ptr = strchr( ca.line, '}' );
3012                                 if ( ptr ) ca.line = ptr+1;
3013                         }
3014                         ca.valx = i;
3015                         rc = config_parse_add( ct, &ca );
3016                         if ( rc ) {
3017                                 rc = LDAP_OTHER;
3018                                 goto leave;
3019                         }
3020                 }
3021         }
3022 ok:
3023         ce = ch_calloc( 1, sizeof(CfEntryInfo) );
3024         ce->ce_parent = last;
3025         ce->ce_entry = entry_dup( e );
3026         ce->ce_entry->e_private = ce;
3027         ce->ce_type = colst[0]->co_type;
3028         ce->ce_be = ca.be;
3029         ce->ce_bi = ca.bi;
3030         if ( !last ) {
3031                 cfb->cb_root = ce;
3032         } else if ( last->ce_kids ) {
3033                 CfEntryInfo *c2;
3034
3035                 for (c2=last->ce_kids; c2 && c2->ce_sibs; c2 = c2->ce_sibs);
3036
3037                 c2->ce_sibs = ce;
3038         } else {
3039                 last->ce_kids = ce;
3040         }
3041
3042 leave:
3043         ch_free( ca.argv );
3044         if ( colst ) ch_free( colst );
3045         return rc;
3046 }
3047
3048 /* Parse an LDAP entry into config directives, then store in underlying
3049  * database.
3050  */
3051 static int
3052 config_back_add( Operation *op, SlapReply *rs )
3053 {
3054         CfBackInfo *cfb;
3055         CfEntryInfo *ce, *last;
3056         int renumber;
3057
3058         if ( !be_isroot( op ) ) {
3059                 rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
3060                 goto out;
3061         }
3062
3063         cfb = (CfBackInfo *)op->o_bd->be_private;
3064
3065         ldap_pvt_thread_pool_pause( &connection_pool );
3066
3067         /* Strategy:
3068          * 1) check for existence of entry
3069          * 2) check for sibling renumbering
3070          * 3) perform internal add
3071          * 4) store entry in underlying database
3072          * 5) perform any necessary renumbering
3073          */
3074         rs->sr_err = config_add_internal( cfb, op->ora_e, rs, &renumber );
3075         if ( rs->sr_err == LDAP_SUCCESS && cfb->cb_use_ldif ) {
3076                 BackendDB *be = op->o_bd;
3077                 slap_callback sc = { NULL, slap_null_cb, NULL, NULL };
3078                 op->o_bd = &cfb->cb_db;
3079                 sc.sc_next = op->o_callback;
3080                 op->o_callback = &sc;
3081                 op->o_bd->be_add( op, rs );
3082                 op->o_bd = be;
3083                 op->o_callback = sc.sc_next;
3084         }
3085         if ( renumber ) {
3086         }
3087
3088         ldap_pvt_thread_pool_resume( &connection_pool );
3089
3090 out:
3091         send_ldap_result( op, rs );
3092         return rs->sr_err;
3093 }
3094
3095 typedef struct delrec {
3096         struct delrec *next;
3097         int nidx;
3098         int idx[0];
3099 } delrec;
3100
3101 static int
3102 config_modify_internal( CfEntryInfo *ce, Operation *op, SlapReply *rs,
3103         char *textbuf, int textsize )
3104 {
3105         CfBackInfo *cfb = (CfBackInfo *)op->o_bd->be_private;
3106         int rc = LDAP_UNWILLING_TO_PERFORM;
3107         Modifications *ml;
3108         Entry *e = ce->ce_entry;
3109         Attribute *save_attrs = e->e_attrs, *oc_at;
3110         ConfigArgs ca = {0};
3111         ConfigTable *ct;
3112         CfOcInfo **colst;
3113         int i, nocs;
3114         char *ptr;
3115         delrec *dels = NULL, *deltail = NULL;
3116
3117         oc_at = attr_find( e->e_attrs, slap_schema.si_ad_objectClass );
3118         if ( !oc_at ) return LDAP_OBJECT_CLASS_VIOLATION;
3119
3120         colst = count_ocs( oc_at, &nocs );
3121
3122         e->e_attrs = attrs_dup( e->e_attrs );
3123
3124         init_config_argv( &ca );
3125         ca.be = ce->ce_be;
3126         ca.bi = ce->ce_bi;
3127
3128         for (ml = op->orm_modlist; ml; ml=ml->sml_next) {
3129                 ct = config_find_table( colst, nocs, ml->sml_desc );
3130                 switch (ml->sml_op) {
3131                 case LDAP_MOD_DELETE:
3132                 case LDAP_MOD_REPLACE: {
3133                         BerVarray vals = NULL, nvals;
3134                         int *idx = NULL;
3135                         if ( ct && ( ct->arg_type & ARG_NO_DELETE )) {
3136                                 rc = LDAP_UNWILLING_TO_PERFORM;
3137                                 snprintf(textbuf, textsize, "cannot delete %s",
3138                                         ml->sml_desc );
3139                                 rs->sr_text = textbuf;
3140                                 goto out;
3141                         }
3142                         if ( ml->sml_op == LDAP_MOD_REPLACE ) {
3143                                 vals = ml->sml_values;
3144                                 nvals = ml->sml_nvalues;
3145                                 ml->sml_values = NULL;
3146                                 ml->sml_nvalues = NULL;
3147                         }
3148                         /* If we're deleting by values, remember the indexes of the
3149                          * values we deleted.
3150                          */
3151                         if ( ct && ml->sml_values ) {
3152                                 delrec *d;
3153                                 for (i=0; ml->sml_values[i].bv_val; i++);
3154                                 d = ch_malloc( sizeof(delrec) + i * sizeof(int));
3155                                 d->nidx = i;
3156                                 d->next = NULL;
3157                                 if ( dels ) {
3158                                         deltail->next = d;
3159                                 } else {
3160                                         dels = d;
3161                                 }
3162                                 deltail = d;
3163                                 idx = d->idx;
3164                         }
3165                         rc = modify_delete_vindex(e, &ml->sml_mod,
3166                                 get_permissiveModify(op),
3167                                 &rs->sr_text, textbuf, textsize, idx );
3168                         if ( ml->sml_op == LDAP_MOD_REPLACE ) {
3169                                 ml->sml_values = vals;
3170                                 ml->sml_nvalues = nvals;
3171                         }
3172                         if ( !vals )
3173                                 break;
3174                         }
3175                         /* FALLTHRU: LDAP_MOD_REPLACE && vals */
3176
3177                 case LDAP_MOD_ADD:
3178                 case SLAP_MOD_SOFTADD: {
3179                         int mop = ml->sml_op;
3180                         int navals = -1;
3181                         ml->sml_op = LDAP_MOD_ADD;
3182                         if ( ct ) {
3183                                 if ( ct->arg_type & ARG_NO_INSERT ) {
3184                                         Attribute *a = attr_find( e->e_attrs, ml->sml_desc );
3185                                         if ( a ) {
3186                                                 for (i = 0; a->a_vals[i].bv_val; i++ );
3187                                                 navals = i;
3188                                         }
3189                                 }
3190                                 for ( i=0; !BER_BVISNULL( &ml->sml_values[i] ); i++ ) {
3191                                         if ( ml->sml_values[i].bv_val[0] == '{' &&
3192                                                 navals >= 0 ) {
3193                                                 int j = strtol( ml->sml_values[i].bv_val+1, NULL, 0 );
3194                                                 if ( j < navals ) {
3195                                                         rc = LDAP_UNWILLING_TO_PERFORM;
3196                                                         snprintf(textbuf, textsize, "cannot insert %s",
3197                                                                 ml->sml_desc );
3198                                                         rs->sr_text = textbuf;
3199                                                         goto out;
3200                                                 }
3201                                         }
3202                                         rc = check_vals( ct, &ca, ml, 0 );
3203                                         if ( rc ) goto out;
3204                                 }
3205                         }
3206                         rc = modify_add_values(e, &ml->sml_mod,
3207                                    get_permissiveModify(op),
3208                                    &rs->sr_text, textbuf, textsize );
3209
3210                         /* If value already exists, show success here
3211                          * and ignore this operation down below.
3212                          */
3213                         if ( mop == SLAP_MOD_SOFTADD ) {
3214                                 if ( rc == LDAP_TYPE_OR_VALUE_EXISTS )
3215                                         rc = LDAP_SUCCESS;
3216                                 else
3217                                         mop = LDAP_MOD_ADD;
3218                         }
3219                         ml->sml_op = mop;
3220                         break;
3221                         }
3222
3223                         break;
3224                 case LDAP_MOD_INCREMENT:        /* FIXME */
3225                         break;
3226                 default:
3227                         break;
3228                 }
3229                 if(rc != LDAP_SUCCESS) break;
3230         }
3231
3232         if(rc == LDAP_SUCCESS) {
3233                 /* check that the entry still obeys the schema */
3234                 rc = entry_schema_check(op->o_bd, e, NULL,
3235                                   &rs->sr_text, textbuf, textsize );
3236         }
3237         if ( rc == LDAP_SUCCESS ) {
3238                 /* Basic syntax checks are OK. Do the actual settings. */
3239                 for ( ml = op->orm_modlist; ml; ml = ml->sml_next ) {
3240                         ct = config_find_table( colst, nocs, ml->sml_desc );
3241                         if ( !ct ) continue;
3242
3243                         switch (ml->sml_op) {
3244                         case LDAP_MOD_DELETE:
3245                         case LDAP_MOD_REPLACE: {
3246                                 BerVarray vals = NULL, nvals;
3247                                 Attribute *a;
3248                                 delrec *d;
3249
3250                                 a = attr_find( e->e_attrs, ml->sml_desc );
3251
3252                                 if ( ml->sml_op == LDAP_MOD_REPLACE ) {
3253                                         vals = ml->sml_values;
3254                                         nvals = ml->sml_nvalues;
3255                                         ml->sml_values = NULL;
3256                                         ml->sml_nvalues = NULL;
3257                                 }
3258
3259                                 if ( ml->sml_values )
3260                                         d = dels;
3261
3262                                 /* If we didn't delete the whole attribute */
3263                                 if ( ml->sml_values && a ) {
3264                                         struct berval *mvals;
3265                                         int j;
3266
3267                                         if ( ml->sml_nvalues )
3268                                                 mvals = ml->sml_nvalues;
3269                                         else
3270                                                 mvals = ml->sml_values;
3271
3272                                         /* use the indexes we saved up above */
3273                                         for (i=0; i < d->nidx; i++) {
3274                                                 struct berval bv = *mvals++;
3275                                                 if ( a->a_desc->ad_type->sat_flags & SLAP_AT_ORDERED &&
3276                                                         bv.bv_val[0] == '{' ) {
3277                                                         ptr = strchr( bv.bv_val, '}' ) + 1;
3278                                                         bv.bv_len -= ptr - bv.bv_val;
3279                                                         bv.bv_val = ptr;
3280                                                 }
3281                                                 ca.line = bv.bv_val;
3282                                                 ca.valx = d->idx[i];
3283                                                 rc = config_del_vals( ct, &ca );
3284                                                 if ( rc != LDAP_SUCCESS ) break;
3285                                                 for (j=i+1; j < d->nidx; j++)
3286                                                         if ( d->idx[j] >d->idx[i] )
3287                                                                 d->idx[j]--;
3288                                         }
3289                                 } else {
3290                                         ca.valx = -1;
3291                                         ca.line = NULL;
3292                                         rc = config_del_vals( ct, &ca );
3293                                 }
3294                                 if ( ml->sml_values ) {
3295                                         ch_free( dels );
3296                                         dels = d->next;
3297                                 }
3298                                 if ( ml->sml_op == LDAP_MOD_REPLACE ) {
3299                                         ml->sml_values = vals;
3300                                         ml->sml_nvalues = nvals;
3301                                 }
3302                                 if ( !vals || rc != LDAP_SUCCESS )
3303                                         break;
3304                                 }
3305                                 /* FALLTHRU: LDAP_MOD_REPLACE && vals */
3306
3307                         case LDAP_MOD_ADD:
3308                                 for (i=0; ml->sml_values[i].bv_val; i++) {
3309                                         ca.line = ml->sml_values[i].bv_val;
3310                                         ca.valx = -1;
3311                                         if ( ml->sml_desc->ad_type->sat_flags & SLAP_AT_ORDERED &&
3312                                                 ca.line[0] == '{' ) {
3313                                                 ptr = strchr( ca.line, '}' );
3314                                                 if ( ptr ) {
3315                                                         ca.valx = strtol( ca.line+1, NULL, 0 );
3316                                                         ca.line = ptr+1;
3317                                                 }
3318                                         }
3319                                         rc = config_parse_add( ct, &ca );
3320                                         if ( rc ) {
3321                                                 rc = LDAP_OTHER;
3322                                                 goto out;
3323                                         }
3324                                 }
3325
3326                                 break;
3327                         }
3328                 }
3329         }
3330
3331 out:
3332         if ( ca.cleanup )
3333                 ca.cleanup( &ca );
3334         if ( rc == LDAP_SUCCESS ) {
3335                 attrs_free( save_attrs );
3336         } else {
3337                 attrs_free( e->e_attrs );
3338                 e->e_attrs = save_attrs;
3339         }
3340         ch_free( ca.argv );
3341         if ( colst ) ch_free( colst );
3342
3343         return rc;
3344 }
3345
3346 static int
3347 config_back_modify( Operation *op, SlapReply *rs )
3348 {
3349         CfBackInfo *cfb;
3350         CfEntryInfo *ce, *last;
3351         Modifications *ml;
3352         char textbuf[SLAP_TEXT_BUFLEN];
3353         struct berval rdn;
3354         char *ptr;
3355         AttributeDescription *rad = NULL;
3356
3357         if ( !be_isroot( op ) ) {
3358                 rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
3359                 goto out;
3360         }
3361
3362         cfb = (CfBackInfo *)op->o_bd->be_private;
3363
3364         ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last );
3365         if ( !ce ) {
3366                 if ( last )
3367                         rs->sr_matched = last->ce_entry->e_name.bv_val;
3368                 rs->sr_err = LDAP_NO_SUCH_OBJECT;
3369                 goto out;
3370         }
3371
3372         /* Get type of RDN */
3373         rdn = ce->ce_entry->e_nname;
3374         ptr = strchr( rdn.bv_val, '=' );
3375         rdn.bv_len = ptr - rdn.bv_val;
3376         slap_bv2ad( &rdn, &rad, &rs->sr_text );
3377
3378         /* Some basic validation... */
3379         for ( ml = op->orm_modlist; ml; ml = ml->sml_next ) {
3380                 /* Don't allow Modify of RDN; must use ModRdn for that. */
3381                 if ( ml->sml_desc == rad ) {
3382                         rs->sr_err = LDAP_NOT_ALLOWED_ON_RDN;
3383                         rs->sr_text = "Use modrdn to change the entry name";
3384                         goto out;
3385                 }
3386         }
3387
3388         ldap_pvt_thread_pool_pause( &connection_pool );
3389
3390         /* Strategy:
3391          * 1) perform the Modify on the cached Entry.
3392          * 2) verify that the Entry still satisfies the schema.
3393          * 3) perform the individual config operations.
3394          * 4) store Modified entry in underlying LDIF backend.
3395          */
3396         rs->sr_err = config_modify_internal( ce, op, rs, textbuf, sizeof(textbuf) );
3397         if ( rs->sr_err == LDAP_SUCCESS && cfb->cb_use_ldif ) {
3398                 BackendDB *be = op->o_bd;
3399                 slap_callback sc = { NULL, slap_null_cb, NULL, NULL };
3400                 op->o_bd = &cfb->cb_db;
3401                 sc.sc_next = op->o_callback;
3402                 op->o_callback = &sc;
3403                 op->o_bd->be_modify( op, rs );
3404                 op->o_bd = be;
3405                 op->o_callback = sc.sc_next;
3406         }
3407
3408         ldap_pvt_thread_pool_resume( &connection_pool );
3409 out:
3410         send_ldap_result( op, rs );
3411         return rs->sr_err;
3412 }
3413
3414 static int
3415 config_back_modrdn( Operation *op, SlapReply *rs )
3416 {
3417         CfBackInfo *cfb;
3418         CfEntryInfo *ce, *last;
3419
3420         if ( !be_isroot( op ) ) {
3421                 rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
3422                 goto out;
3423         }
3424
3425         cfb = (CfBackInfo *)op->o_bd->be_private;
3426
3427         ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last );
3428         if ( !ce ) {
3429                 if ( last )
3430                         rs->sr_matched = last->ce_entry->e_name.bv_val;
3431                 rs->sr_err = LDAP_NO_SUCH_OBJECT;
3432                 goto out;
3433         }
3434
3435         /* We don't allow moving objects to new parents.
3436          * Generally we only allow reordering a set of ordered entries.
3437          */
3438         if ( op->orr_newSup ) {
3439                 rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
3440                 goto out;
3441         }
3442         ldap_pvt_thread_pool_pause( &connection_pool );
3443
3444         ldap_pvt_thread_pool_resume( &connection_pool );
3445 out:
3446         send_ldap_result( op, rs );
3447         return rs->sr_err;
3448 }
3449
3450 static int
3451 config_back_search( Operation *op, SlapReply *rs )
3452 {
3453         CfBackInfo *cfb;
3454         CfEntryInfo *ce, *last;
3455         int rc;
3456
3457         if ( !be_isroot( op ) ) {
3458                 rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
3459                 goto out;
3460         }
3461
3462         cfb = (CfBackInfo *)op->o_bd->be_private;
3463
3464         ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last );
3465         if ( !ce ) {
3466                 if ( last )
3467                         rs->sr_matched = last->ce_entry->e_name.bv_val;
3468                 rs->sr_err = LDAP_NO_SUCH_OBJECT;
3469                 goto out;
3470         }
3471         switch ( op->ors_scope ) {
3472         case LDAP_SCOPE_BASE:
3473         case LDAP_SCOPE_SUBTREE:
3474                 config_send( op, rs, ce, 0 );
3475                 break;
3476
3477         case LDAP_SCOPE_ONELEVEL:
3478                 for (ce = ce->ce_kids; ce; ce=ce->ce_sibs) {
3479                         config_send( op, rs, ce, 1 );
3480                 }
3481                 break;
3482         }
3483
3484         rs->sr_err = LDAP_SUCCESS;
3485 out:
3486         send_ldap_result( op, rs );
3487         return 0;
3488 }
3489
3490 static Entry *
3491 config_alloc_entry( CfEntryInfo *parent, struct berval *rdn )
3492 {
3493         Entry *e = ch_calloc( 1, sizeof(Entry) );
3494         CfEntryInfo *ce = ch_calloc( 1, sizeof(CfEntryInfo) );
3495         struct berval pdn;
3496
3497         e->e_private = ce;
3498         ce->ce_entry = e;
3499         ce->ce_parent = parent;
3500         if ( parent ) {
3501                 pdn = parent->ce_entry->e_nname;
3502         } else {
3503                 BER_BVZERO( &pdn );
3504         }
3505
3506         build_new_dn( &e->e_name, &pdn, rdn, NULL );
3507         ber_dupbv( &e->e_nname, &e->e_name );
3508         return e;
3509 }
3510
3511 #define NO_TABLE        0
3512 #define BI_TABLE        1
3513 #define BE_TABLE        2
3514
3515 static int
3516 config_build_entry( ConfigArgs *c, Entry *e, ObjectClass *oc,
3517          struct berval *rdn, ConfigTable *ct, int table )
3518 {
3519         struct berval val;
3520         struct berval ad_name;
3521         AttributeDescription *ad = NULL;
3522         int rc, i;
3523         char *ptr;
3524         const char *text;
3525         char textbuf[SLAP_TEXT_BUFLEN];
3526         size_t textlen = sizeof(textbuf);
3527         AttributeType **at;
3528         Attribute *oc_at;
3529
3530         val = oc->soc_cname;
3531         attr_merge_normalize_one(e, slap_schema.si_ad_objectClass, &val, NULL );
3532         ptr = strchr(rdn->bv_val, '=');
3533         ad_name.bv_val = rdn->bv_val;
3534         ad_name.bv_len = ptr - rdn->bv_val;
3535         rc = slap_bv2ad( &ad_name, &ad, &text );
3536         if ( rc ) {
3537                 return rc;
3538         }
3539         val.bv_val = ptr+1;
3540         val.bv_len = rdn->bv_len - (val.bv_val - rdn->bv_val);
3541         attr_merge_normalize_one(e, ad, &val, NULL );
3542
3543         for (at=oc->soc_required; at && *at; at++) {
3544                 /* Skip the naming attr */
3545                 if ((*at)->sat_ad == ad || (*at)->sat_ad == slap_schema.si_ad_cn )
3546                         continue;
3547                 for (i=0;ct[i].name;i++) {
3548                         if (ct[i].ad == (*at)->sat_ad) {
3549                                 rc = config_get_vals(&ct[i], c);
3550                                 if (rc == LDAP_SUCCESS) {
3551                                         if ( c->rvalue_nvals )
3552                                                 attr_merge(e, ct[i].ad, c->rvalue_vals,
3553                                                         c->rvalue_nvals);
3554                                         else
3555                                                 attr_merge_normalize(e, ct[i].ad,
3556                                                         c->rvalue_vals, NULL);
3557                                         ber_bvarray_free( c->rvalue_nvals );
3558                                         ber_bvarray_free( c->rvalue_vals );
3559                                 }
3560                                 break;
3561                         }
3562                 }
3563         }
3564
3565         for (at=oc->soc_allowed; at && *at; at++) {
3566                 /* Skip the naming attr */
3567                 if ((*at)->sat_ad == ad || (*at)->sat_ad == slap_schema.si_ad_cn )
3568                         continue;
3569                 for (i=0;ct[i].name;i++) {
3570                         if (ct[i].ad == (*at)->sat_ad) {
3571                                 rc = config_get_vals(&ct[i], c);
3572                                 if (rc == LDAP_SUCCESS) {
3573                                         if ( c->rvalue_nvals )
3574                                                 attr_merge(e, ct[i].ad, c->rvalue_vals, c->rvalue_nvals);
3575                                         else
3576                                                 attr_merge_normalize(e, ct[i].ad, c->rvalue_vals, NULL);
3577                                         ber_bvarray_free( c->rvalue_nvals );
3578                                         ber_bvarray_free( c->rvalue_vals );
3579                                 }
3580                                 break;
3581                         }
3582                 }
3583         }
3584
3585         if ( table ) {
3586                 if ( table == BI_TABLE )
3587                         ct = c->bi->bi_cf_table;
3588                 else
3589                         ct = c->be->be_cf_table;
3590                 for (;ct && ct->name;ct++) {
3591                         if (!ct->ad) continue;
3592                         rc = config_get_vals(ct, c);
3593                         if (rc == LDAP_SUCCESS) {
3594                                 if ( c->rvalue_nvals )
3595                                         attr_merge(e, ct->ad, c->rvalue_vals, c->rvalue_nvals);
3596                                 else
3597                                         attr_merge_normalize(e, ct->ad, c->rvalue_vals, NULL);
3598                         }
3599                 }
3600         }
3601         oc_at = attr_find( e->e_attrs, slap_schema.si_ad_objectClass );
3602         rc = structural_class(oc_at->a_vals, &val, NULL, &text, textbuf, textlen);
3603         attr_merge_normalize_one(e, slap_schema.si_ad_structuralObjectClass, &val, NULL );
3604
3605         return 0;
3606 }
3607
3608 static void
3609 config_build_schema_inc( ConfigArgs *c, CfEntryInfo *ceparent,
3610         Operation *op, SlapReply *rs )
3611 {
3612         Entry *e;
3613         ConfigFile *cf = c->private;
3614         CfEntryInfo *ce, *ceprev;
3615         char *ptr;
3616         struct berval bv;
3617
3618         if ( ceparent->ce_kids ) {
3619                 for ( ceprev = ceparent->ce_kids; ceprev->ce_sibs;
3620                         ceprev = ceprev->ce_sibs );
3621         }
3622
3623         for (; cf; cf=cf->c_sibs, c->depth++) {
3624                 c->value_dn.bv_val = c->log;
3625                 bv.bv_val = strrchr(cf->c_file.bv_val, LDAP_DIRSEP[0]);
3626                 if ( !bv.bv_val ) {
3627                         bv = cf->c_file;
3628                 } else {
3629                         bv.bv_val++;
3630                         bv.bv_len = cf->c_file.bv_len - (bv.bv_val - cf->c_file.bv_val);
3631                 }
3632                 ptr = strchr( bv.bv_val, '.' );
3633                 if ( ptr )
3634                         bv.bv_len = ptr - bv.bv_val;
3635                 c->value_dn.bv_len = sprintf(c->value_dn.bv_val, "cn=" IFMT, c->depth);
3636                 strncpy( c->value_dn.bv_val + c->value_dn.bv_len, bv.bv_val,
3637                         bv.bv_len );
3638                 c->value_dn.bv_len += bv.bv_len;
3639                 c->value_dn.bv_val[c->value_dn.bv_len] ='\0';
3640
3641                 e = config_alloc_entry( ceparent, &c->value_dn );
3642                 c->private = cf;
3643                 config_build_entry( c, e, cfOc_schema, &c->value_dn,
3644                         c->bi->bi_cf_table, NO_TABLE );
3645                 ce = e->e_private;
3646                 ce->ce_type = Cft_Schema;
3647                 if ( op ) {
3648                         op->ora_e = e;
3649                         op->o_bd->be_add( op, rs );
3650                 }
3651                 ce->ce_bi = c->bi;
3652                 if ( !ceparent->ce_kids ) {
3653                         ceparent->ce_kids = ce;
3654                 } else {
3655                         ceprev->ce_sibs = ce;
3656                 }
3657                 ceprev = ce;
3658                 if ( cf->c_kids ) {
3659                         c->private = cf->c_kids;
3660                         config_build_schema_inc( c, ceparent, op, rs );
3661                 }
3662         }
3663 }
3664
3665 static CfEntryInfo *
3666 config_build_includes( ConfigArgs *c, CfEntryInfo *ceparent,
3667         Operation *op, SlapReply *rs )
3668 {
3669         Entry *e;
3670         int i;
3671         ConfigFile *cf = c->private;
3672         CfEntryInfo *ce, *ceprev;
3673
3674         if ( ceparent->ce_kids ) {
3675                 for ( ceprev = ceparent->ce_kids; ceprev->ce_sibs;
3676                         ceprev = ceprev->ce_sibs );
3677         }
3678
3679         for (i=0; cf; cf=cf->c_sibs, i++) {
3680                 c->value_dn.bv_val = c->log;
3681                 c->value_dn.bv_len = sprintf(c->value_dn.bv_val, "cn=include" IFMT, i);
3682                 e = config_alloc_entry( ceparent, &c->value_dn );
3683                 c->private = cf;
3684                 config_build_entry( c, e, cfOc_include, &c->value_dn,
3685                         c->bi->bi_cf_table, NO_TABLE );
3686                 if ( op ) {
3687                         op->ora_e = e;
3688                         op->o_bd->be_add( op, rs );
3689                 }
3690                 ce = e->e_private;
3691                 ce->ce_type = Cft_Include;
3692                 ce->ce_bi = c->bi;
3693                 if ( !ceparent->ce_kids ) {
3694                         ceparent->ce_kids = ce;
3695                 } else {
3696                         ceprev->ce_sibs = ce;
3697                 }
3698                 ceprev = ce;
3699                 if ( cf->c_kids ) {
3700                         c->private = cf->c_kids;
3701                         config_build_includes( c, ce, op, rs );
3702                 }
3703         }
3704         return ce;
3705 }
3706
3707 #ifdef SLAPD_MODULES
3708
3709 static CfEntryInfo *
3710 config_build_modules( ConfigArgs *c, CfEntryInfo *ceparent,
3711         Operation *op, SlapReply *rs )
3712 {
3713         Entry *e;
3714         int i;
3715         CfEntryInfo *ce, *ceprev;
3716         ModPaths *mp;
3717
3718         if ( ceparent->ce_kids ) {
3719                 for ( ceprev = ceparent->ce_kids; ceprev->ce_sibs;
3720                         ceprev = ceprev->ce_sibs );
3721         }
3722
3723         for (i=0, mp=&modpaths; mp; mp=mp->mp_next, i++) {
3724                 if ( BER_BVISNULL( &mp->mp_path ) && !mp->mp_loads )
3725                         continue;
3726                 c->value_dn.bv_val = c->log;
3727                 c->value_dn.bv_len = sprintf(c->value_dn.bv_val, "cn=module" IFMT, i);
3728                 e = config_alloc_entry( ceparent, &c->value_dn );
3729                 ce = e->e_private;
3730                 ce->ce_type = Cft_Include;
3731                 c->private = mp;
3732                 config_build_entry( c, e, cfOc_module, &c->value_dn,
3733                         c->bi->bi_cf_table, NO_TABLE );
3734                 if ( op ) {
3735                         op->ora_e = e;
3736                         op->o_bd->be_add( op, rs );
3737                 }
3738                 ce->ce_bi = c->bi;
3739                 if ( !ceparent->ce_kids ) {
3740                         ceparent->ce_kids = ce;
3741                 } else {
3742                         ceprev->ce_sibs = ce;
3743                 }
3744                 ceprev = ce;
3745         }
3746         return ce;
3747 }
3748 #endif
3749
3750 static int
3751 config_back_db_open( BackendDB *be )
3752 {
3753         CfBackInfo *cfb = be->be_private;
3754         struct berval rdn;
3755         Entry *e, *parent;
3756         CfEntryInfo *ce, *ceparent, *ceprev;
3757         int i, rc;
3758         BackendInfo *bi;
3759         BackendDB *bptr;
3760         ConfigArgs c;
3761         ConfigTable *ct;
3762         Connection conn = {0};
3763         char opbuf[OPERATION_BUFFER_SIZE];
3764         Operation *op;
3765         slap_callback cb = { NULL, slap_null_cb, NULL, NULL };
3766         SlapReply rs = {REP_RESULT};
3767
3768         /* If we read the config from back-ldif, nothing to do here */
3769         if ( cfb->cb_got_ldif )
3770                 return 0;
3771
3772         if ( cfb->cb_use_ldif ) {
3773                 op = (Operation *)opbuf;
3774                 connection_fake_init( &conn, op, cfb );
3775
3776                 op->o_dn = be->be_rootdn;
3777                 op->o_ndn = be->be_rootndn;
3778
3779                 op->o_tag = LDAP_REQ_ADD;
3780                 op->o_callback = &cb;
3781                 op->o_bd = &cfb->cb_db;
3782         } else {
3783                 op = NULL;
3784         }
3785
3786         /* create root of tree */
3787         rdn = config_rdn;
3788         e = config_alloc_entry( NULL, &rdn );
3789         ce = e->e_private;
3790         ce->ce_type = Cft_Global;
3791         cfb->cb_root = ce;
3792         c.be = be;
3793         c.bi = be->bd_info;
3794         c.private = cfb->cb_config;
3795         ct = c.bi->bi_cf_table;
3796         config_build_entry( &c, e, cfOc_global, &rdn, ct, NO_TABLE );
3797         if ( op ) {
3798                 op->ora_e = e;
3799                 op->o_bd->be_add( op, &rs );
3800         }
3801         ce->ce_bi = c.bi;
3802
3803         parent = e;
3804         ceparent = ce;
3805
3806         /* Create schema nodes... cn=schema will contain the hardcoded core
3807          * schema, read-only. Child objects will contain runtime loaded schema
3808          * files.
3809          */
3810         rdn = schema_rdn;
3811         e = config_alloc_entry( ceparent, &rdn );
3812         ce = e->e_private;
3813         ce->ce_type = Cft_Schema;
3814         c.private = NULL;
3815         config_build_entry( &c, e, cfOc_schema, &rdn, ct, NO_TABLE );
3816         if ( op ) {
3817                 op->ora_e = e;
3818                 op->o_bd->be_add( op, &rs );
3819         }
3820         if ( !ceparent->ce_kids ) {
3821                 ceparent->ce_kids = ce;
3822         } else {
3823                 ceprev->ce_sibs = ce;
3824         }
3825         ceprev = ce;
3826
3827         /* Create includeFile nodes and schema nodes for included schema... */
3828         if ( cfb->cb_config->c_kids ) {
3829                 c.depth = 0;
3830                 c.private = cfb->cb_config->c_kids;
3831                 config_build_schema_inc( &c, ce, op, &rs );
3832                 c.private = cfb->cb_config->c_kids;
3833                 ceprev = config_build_includes( &c, ceparent, op, &rs );
3834         }
3835
3836 #ifdef SLAPD_MODULES
3837         /* Create Module nodes... */
3838         if ( modpaths.mp_loads ) {
3839                 ceprev = config_build_modules( &c, ceparent, op, &rs );
3840         }
3841 #endif
3842
3843         /* Create backend nodes. Skip if they don't provide a cf_table.
3844          * There usually aren't any of these.
3845          */
3846
3847         c.line = 0;
3848         LDAP_STAILQ_FOREACH( bi, &backendInfo, bi_next) {
3849                 if (!bi->bi_cf_table) continue;
3850                 if (!bi->bi_private) continue;
3851
3852                 rdn.bv_val = c.log;
3853                 rdn.bv_len = sprintf(rdn.bv_val, "%s=%s", cfAd_backend->ad_cname.bv_val, bi->bi_type);
3854                 e = config_alloc_entry( ceparent, &rdn );
3855                 ce = e->e_private;
3856                 ce->ce_type = Cft_Backend;
3857                 ce->ce_bi = bi;
3858                 c.bi = bi;
3859                 config_build_entry( &c, e, cfOc_backend, &rdn, ct, BI_TABLE );
3860                 if ( op ) {
3861                         op->ora_e = e;
3862                         op->o_bd->be_add( op, &rs );
3863                 }
3864                 if ( !ceparent->ce_kids ) {
3865                         ceparent->ce_kids = ce;
3866                 } else {
3867                         ceprev->ce_sibs = ce;
3868                 }
3869                 ceprev = ce;
3870         }
3871
3872         /* Create database nodes... */
3873         i = -1;
3874         LDAP_STAILQ_FOREACH( be, &backendDB, be_next ) {
3875                 slap_overinfo *oi = NULL;
3876                 i++;
3877                 if ( i == 0 ) {
3878                         bptr = frontendDB;
3879                 } else {
3880                         bptr = be;
3881                 }
3882                 if ( overlay_is_over( bptr )) {
3883                         oi = bptr->bd_info->bi_private;
3884                         bi = oi->oi_orig;
3885                 } else {
3886                         bi = bptr->bd_info;
3887                 }
3888                 rdn.bv_val = c.log;
3889                 rdn.bv_len = sprintf(rdn.bv_val, "%s=" IFMT "%s", cfAd_database->ad_cname.bv_val,
3890                         i, bi->bi_type);
3891                 e = config_alloc_entry( ceparent, &rdn );
3892                 ce = e->e_private;
3893                 c.be = bptr;
3894                 c.bi = bi;
3895                 ce->ce_type = Cft_Database;
3896                 ce->ce_be = c.be;
3897                 ce->ce_bi = c.bi;
3898                 config_build_entry( &c, e, cfOc_database, &rdn, ct, BE_TABLE );
3899                 if ( op ) {
3900                         op->ora_e = e;
3901                         op->o_bd->be_add( op, &rs );
3902                 }
3903                 if ( !ceparent->ce_kids ) {
3904                         ceparent->ce_kids = ce;
3905                 } else {
3906                         ceprev->ce_sibs = ce;
3907                 }
3908                 ceprev = ce;
3909                 /* Iterate through overlays */
3910                 if ( oi ) {
3911                         slap_overinst *on;
3912                         Entry *oe;
3913                         CfEntryInfo *opar = ce, *oprev = NULL;
3914                         int j;
3915
3916                         for (j=0,on=oi->oi_list; on; j++,on=on->on_next) {
3917                                 rdn.bv_val = c.log;
3918                                 rdn.bv_len = sprintf(rdn.bv_val, "%s=" IFMT "%s",
3919                                         cfAd_overlay->ad_cname.bv_val, j, on->on_bi.bi_type );
3920                                 oe = config_alloc_entry( opar, &rdn );
3921                                 ce = oe->e_private;
3922                                 c.be = bptr;
3923                                 c.bi = &on->on_bi;
3924                                 ce->ce_type = Cft_Overlay;
3925                                 ce->ce_be = c.be;
3926                                 ce->ce_bi = c.bi;
3927                                 config_build_entry( &c, oe, cfOc_overlay, &rdn, ct, BI_TABLE );
3928                                 if ( op ) {
3929                                         op->ora_e = oe;
3930                                         op->o_bd->be_add( op, &rs );
3931                                 }
3932                                 if ( !opar->ce_kids ) {
3933                                         opar->ce_kids = ce;
3934                                 } else {
3935                                         oprev->ce_sibs = ce;
3936                                 }
3937                                 oprev = ce;
3938                         }
3939                 }
3940         }
3941
3942         return 0;
3943 }
3944
3945 static int
3946 config_back_db_destroy( Backend *be )
3947 {
3948         free( be->be_private );
3949         return 0;
3950 }
3951
3952 static int
3953 config_back_db_init( Backend *be )
3954 {
3955         struct berval dn;
3956         CfBackInfo *cfb;
3957
3958         cfb = ch_calloc( 1, sizeof(CfBackInfo));
3959         cfb->cb_config = &cf_prv;
3960         be->be_private = cfb;
3961
3962         ber_dupbv( &be->be_rootdn, &config_rdn );
3963         ber_dupbv( &be->be_rootndn, &be->be_rootdn );
3964         ber_dupbv( &dn, &be->be_rootdn );
3965         ber_bvarray_add( &be->be_suffix, &dn );
3966         ber_dupbv( &dn, &be->be_rootdn );
3967         ber_bvarray_add( &be->be_nsuffix, &dn );
3968
3969         /* Hide from namingContexts */
3970         SLAP_BFLAGS(be) |= SLAP_BFLAG_CONFIG;
3971
3972         return 0;
3973 }
3974
3975 static int
3976 config_back_destroy( BackendInfo *bi )
3977 {
3978         ldif_must_b64_encode_release();
3979         return 0;
3980 }
3981
3982 static struct {
3983         char *name;
3984         AttributeDescription **desc;
3985 } ads[] = {
3986         { "backend", &cfAd_backend },
3987         { "database", &cfAd_database },
3988         { "include", &cfAd_include },
3989         { "overlay", &cfAd_overlay },
3990         { NULL, NULL }
3991 };
3992
3993 /* Notes:
3994  *   add / delete: all types that may be added or deleted must use an
3995  * X-ORDERED attributeType for their RDN. Adding and deleting entries
3996  * should automatically renumber the index of any siblings as needed,
3997  * so that no gaps in the numbering sequence exist after the add/delete
3998  * is completed.
3999  *   What can be added:
4000  *     schema objects
4001  *     backend objects for backend-specific config directives
4002  *     database objects
4003  *     overlay objects
4004  *
4005  *   delete: probably no support this time around.
4006  *
4007  *   modrdn: generally not done. Will be invoked automatically by add/
4008  * delete to update numbering sequence. Perform as an explicit operation
4009  * so that the renumbering effect may be replicated. Subtree rename must
4010  * be supported, since renumbering a database will affect all its child
4011  * overlays.
4012  *
4013  *  modify: must be fully supported.
4014  */
4015
4016 int
4017 config_back_initialize( BackendInfo *bi )
4018 {
4019         ConfigTable             *ct = config_back_cf_table;
4020         char                    *argv[4];
4021         int                     i;
4022         AttributeDescription    *ad = NULL;
4023         const char              *text;
4024         static char             *controls[] = {
4025                 LDAP_CONTROL_MANAGEDSAIT,
4026                 NULL
4027         };
4028
4029         bi->bi_controls = controls;
4030
4031         bi->bi_open = 0;
4032         bi->bi_close = 0;
4033         bi->bi_config = 0;
4034         bi->bi_destroy = config_back_destroy;
4035
4036         bi->bi_db_init = config_back_db_init;
4037         bi->bi_db_config = 0;
4038         bi->bi_db_open = config_back_db_open;
4039         bi->bi_db_close = 0;
4040         bi->bi_db_destroy = config_back_db_destroy;
4041
4042         bi->bi_op_bind = config_back_bind;
4043         bi->bi_op_unbind = 0;
4044         bi->bi_op_search = config_back_search;
4045         bi->bi_op_compare = 0;
4046         bi->bi_op_modify = config_back_modify;
4047         bi->bi_op_modrdn = config_back_modrdn;
4048         bi->bi_op_add = config_back_add;
4049         bi->bi_op_delete = 0;
4050         bi->bi_op_abandon = 0;
4051
4052         bi->bi_extended = 0;
4053
4054         bi->bi_chk_referrals = 0;
4055
4056 #ifdef SLAP_OVERLAY_ACCESS
4057         bi->bi_access_allowed = slap_access_always_allowed;
4058 #endif /* SLAP_OVERLAY_ACCESS */
4059
4060         bi->bi_connection_init = 0;
4061         bi->bi_connection_destroy = 0;
4062
4063         argv[3] = NULL;
4064         for (i=0; OidMacros[i].name; i++ ) {
4065                 argv[1] = OidMacros[i].name;
4066                 argv[2] = OidMacros[i].oid;
4067                 parse_oidm( "slapd", i, 3, argv, 0, NULL );
4068         }
4069
4070         bi->bi_cf_table = ct;
4071
4072         i = config_register_schema( ct, cf_ocs );
4073         if ( i ) return i;
4074
4075         /* setup olcRootPW to be base64-encoded when written in LDIF form;
4076          * basically, we don't care if it fails */
4077         i = slap_str2ad( "olcRootPW", &ad, &text );
4078         if ( i ) {
4079                 Debug( LDAP_DEBUG_ANY, "config_back_initialize: "
4080                         "warning, unable to get \"olcRootPW\" "
4081                         "attribute description: %d: %s\n",
4082                         i, text, 0 );
4083         } else {
4084                 (void)ldif_must_b64_encode_register( ad->ad_cname.bv_val,
4085                         ad->ad_type->sat_oid );
4086         }
4087
4088         /* set up the notable AttributeDescriptions */
4089         i = 0;
4090         for (;ct->name;ct++) {
4091                 if (strcmp(ct->name, ads[i].name)) continue;
4092                 *ads[i].desc = ct->ad;
4093                 i++;
4094                 if (!ads[i].name) break;
4095         }
4096
4097         return 0;
4098 }
4099