git.sur5r.net Git - openldap/blob - servers/slapd/bconfig.c

   1 /* bconfig.c - the config backend */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 2005 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* ACKNOWLEDGEMENTS:
  17  * This work was originally developed by Howard Chu for inclusion
  18  * in OpenLDAP Software.
  19  */
  20
  21 #include "portable.h"
  22
  23 #include <stdio.h>
  24 #include <ac/string.h>
  25 #include <ac/ctype.h>
  26 #include <ac/errno.h>
  27
  28 #include "slap.h"
  29
  30 #ifdef LDAP_SLAPI
  31 #include "slapi/slapi.h"
  32 #endif
  33
  34 #include <lutil.h>
  35
  36 #include "config.h"
  37
  38 static struct berval config_rdn = BER_BVC("cn=config");
  39
  40 #ifdef SLAPD_MODULES
  41 typedef struct modpath_s {
  42         struct modpath_s *mp_next;
  43         struct berval mp_path;
  44         BerVarray mp_loads;
  45 } ModPaths;
  46 #endif
  47
  48 typedef struct ConfigFile {
  49         struct ConfigFile *c_sibs;
  50         struct ConfigFile *c_kids;
  51         struct berval c_file;
  52 #ifdef SLAPD_MODULES
  53         ModPaths c_modpaths;
  54         ModPaths *c_modlast;
  55 #endif
  56         BerVarray c_dseFiles;
  57 } ConfigFile;
  58
  59 typedef struct CfOcInfo {
  60         struct berval *co_name;
  61         ConfigTable *co_table;
  62         ConfigType co_type;
  63 } CfOcInfo;
  64
  65 typedef struct CfEntryInfo {
  66         struct CfEntryInfo *ce_sibs;
  67         struct CfEntryInfo *ce_kids;
  68         Entry *ce_entry;
  69         ConfigType ce_type;
  70         BackendInfo *ce_bi;
  71         BackendDB *ce_be;
  72 } CfEntryInfo;
  73
  74 typedef struct {
  75         ConfigFile *cb_config;
  76         CfEntryInfo *cb_root;
  77         BackendDB       *cb_be; /* config backend */
  78         BackendDB       cb_db;  /* underlying database */
  79         int             cb_got_ldif;
  80 } CfBackInfo;
  81
  82 /* These do nothing in slapd, they're kept only to make them
  83  * editable here.
  84  */
  85 static char *replica_pidFile, *replica_argsFile;
  86 static int replicationInterval;
  87
  88 static char     *passwd_salt;
  89 static char     *logfileName;
  90 static BerVarray authz_rewrites;
  91
  92 static struct berval cfdir;
  93
  94 /* Private state */
  95 static AttributeDescription *cfAd_backend, *cfAd_database, *cfAd_overlay,
  96         *cfAd_include;
  97
  98 static ObjectClass *cfOc_schema, *cfOc_global, *cfOc_backend, *cfOc_database,
  99         *cfOc_include, *cfOc_overlay;
 100
 101 static ConfigFile cf_prv, *cfn = &cf_prv;
 102
 103 static Avlnode *CfOcTree;
 104
 105 static int add_syncrepl LDAP_P(( Backend *, char **, int ));
 106 static int parse_syncrepl_line LDAP_P(( char **, int, syncinfo_t *));
 107 static void syncrepl_unparse LDAP_P (( syncinfo_t *, struct berval *));
 108 static int config_add_internal( CfBackInfo *cfb, Entry *e, SlapReply *rs );
 109
 110 static ConfigDriver config_fname;
 111 static ConfigDriver config_cfdir;
 112 static ConfigDriver config_generic;
 113 static ConfigDriver config_search_base;
 114 static ConfigDriver config_passwd_hash;
 115 static ConfigDriver config_schema_dn;
 116 static ConfigDriver config_sizelimit;
 117 static ConfigDriver config_timelimit;
 118 static ConfigDriver config_limits;
 119 static ConfigDriver config_overlay;
 120 static ConfigDriver config_suffix;
 121 static ConfigDriver config_deref_depth;
 122 static ConfigDriver config_rootdn;
 123 static ConfigDriver config_rootpw;
 124 static ConfigDriver config_restrict;
 125 static ConfigDriver config_allows;
 126 static ConfigDriver config_disallows;
 127 static ConfigDriver config_requires;
 128 static ConfigDriver config_security;
 129 static ConfigDriver config_referral;
 130 static ConfigDriver config_loglevel;
 131 static ConfigDriver config_syncrepl;
 132 static ConfigDriver config_replica;
 133 static ConfigDriver config_updatedn;
 134 static ConfigDriver config_updateref;
 135 static ConfigDriver config_include;
 136 #ifdef HAVE_TLS
 137 static ConfigDriver config_tls_option;
 138 static ConfigDriver config_tls_config;
 139 #endif
 140
 141 enum {
 142         CFG_ACL = 1,
 143         CFG_BACKEND,
 144         CFG_DATABASE,
 145         CFG_TLS_RAND,
 146         CFG_TLS_CIPHER,
 147         CFG_TLS_CERT_FILE,
 148         CFG_TLS_CERT_KEY,
 149         CFG_TLS_CA_PATH,
 150         CFG_TLS_CA_FILE,
 151         CFG_TLS_VERIFY,
 152         CFG_TLS_CRLCHECK,
 153         CFG_SIZE,
 154         CFG_TIME,
 155         CFG_CONCUR,
 156         CFG_THREADS,
 157         CFG_SALT,
 158         CFG_LIMITS,
 159         CFG_RO,
 160         CFG_REWRITE,
 161         CFG_DEPTH,
 162         CFG_OID,
 163         CFG_OC,
 164         CFG_DIT,
 165         CFG_ATTR,
 166         CFG_ATOPT,
 167         CFG_CHECK,
 168         CFG_AUDITLOG,
 169         CFG_REPLOG,
 170         CFG_ROOTDSE,
 171         CFG_LOGFILE,
 172         CFG_PLUGIN,
 173         CFG_MODLOAD,
 174         CFG_MODPATH,
 175         CFG_LASTMOD,
 176         CFG_AZPOLICY,
 177         CFG_AZREGEXP,
 178         CFG_SASLSECP,
 179         CFG_SSTR_IF_MAX,
 180         CFG_SSTR_IF_MIN,
 181 };
 182
 183 typedef struct {
 184         char *name, *oid;
 185 } OidRec;
 186
 187 static OidRec OidMacros[] = {
 188         /* OpenLDAProot:666.11.1 */
 189         { "OLcfg", "1.3.6.1.4.1.4203.666.11.1" },
 190         { "OLcfgAt", "OLcfg:3" },
 191         { "OLcfgOc", "OLcfg:4" },
 192         { "OMsyn", "1.3.6.1.4.1.1466.115.121.1" },
 193         { "OMsInteger", "OMsyn:2" },
 194         { "OMsBoolean", "OMsyn:7" },
 195         { "OMsDN", "OMsyn:12" },
 196         { "OMsDirectoryString", "OMsyn:15" },
 197         { "OMsOctetString", "OMsyn:40" },
 198         { NULL, NULL }
 199 };
 200
 201 /* alphabetical ordering */
 202
 203 ConfigTable config_back_cf_table[] = {
 204         /* This attr is read-only */
 205         { "", "", 0, 0, 0, ARG_MAGIC,
 206                 &config_fname, "( OLcfgAt:78 NAME 'olcConfigFile' "
 207                         "DESC 'File for slapd configuration directives' "
 208                         "EQUALITY caseIgnoreMatch "
 209                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 210         { "", "", 0, 0, 0, ARG_MAGIC,
 211                 &config_cfdir, "( OLcfgAt:79 NAME 'olcConfigDir' "
 212                         "DESC 'Directory for slapd configuration backend' "
 213                         "EQUALITY caseIgnoreMatch "
 214                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 215         { "access",     NULL, 0, 0, 0, ARG_MAY_DB|ARG_MAGIC|CFG_ACL,
 216                 &config_generic, "( OLcfgAt:1 NAME 'olcAccess' "
 217                         "DESC 'Access Control List' "
 218                         "EQUALITY caseIgnoreMatch "
 219                         "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL },
 220         { "allows",     "features", 2, 0, 5, ARG_PRE_DB|ARG_MAGIC,
 221                 &config_allows, "( OLcfgAt:2 NAME 'olcAllows' "
 222                         "DESC 'Allowed set of deprecated features' "
 223                         "EQUALITY caseIgnoreMatch "
 224                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 225         { "argsfile", "file", 2, 2, 0, ARG_STRING,
 226                 &slapd_args_file, "( OLcfgAt:3 NAME 'olcArgsFile' "
 227                         "DESC 'File for slapd command line options' "
 228                         "EQUALITY caseIgnoreMatch "
 229                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 230         /* Use standard 'attributeTypes' attr */
 231         { "attribute",  "attribute", 2, 0, 9, ARG_PAREN|ARG_MAGIC|CFG_ATTR,
 232                 &config_generic, NULL, NULL, NULL },
 233         { "attributeoptions", NULL, 0, 0, 0, ARG_MAGIC|CFG_ATOPT,
 234                 &config_generic, "( OLcfgAt:5 NAME 'olcAttributeOptions' "
 235                         "EQUALITY caseIgnoreMatch "
 236                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 237         { "authid-rewrite", NULL, 2, 0, 0,
 238 #ifdef SLAP_AUTH_REWRITE
 239                 ARG_MAGIC|CFG_REWRITE, &config_generic,
 240 #else
 241                 ARG_IGNORED, NULL,
 242 #endif
 243                  "( OLcfgAt:6 NAME 'olcAuthIDRewrite' "
 244                         "EQUALITY caseIgnoreMatch "
 245                         "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL },
 246         { "authz-policy", "policy", 2, 2, 0, ARG_STRING|ARG_MAGIC|CFG_AZPOLICY,
 247                 &config_generic, "( OLcfgAt:7 NAME 'olcAuthzPolicy' "
 248                         "EQUALITY caseIgnoreMatch "
 249                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 250         { "authz-regexp", NULL, 3, 3, 0, ARG_MAGIC|CFG_AZREGEXP,
 251                 &config_generic, "( OLcfgAt:8 NAME 'olcAuthzRegexp' "
 252                         "EQUALITY caseIgnoreMatch "
 253                         "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL },
 254         { "backend", "type", 2, 2, 0, ARG_PRE_DB|ARG_MAGIC|CFG_BACKEND,
 255                 &config_generic, "( OLcfgAt:9 NAME 'olcBackend' "
 256                         "DESC 'A type of backend' "
 257                         "EQUALITY caseIgnoreMatch "
 258                         "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL },
 259         { "concurrency", "level", 2, 2, 0, ARG_INT|ARG_MAGIC|CFG_CONCUR,
 260                 &config_generic, "( OLcfgAt:10 NAME 'olcConcurrency' "
 261                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 262         { "conn_max_pending", "max", 2, 2, 0, ARG_INT,
 263                 &slap_conn_max_pending, "( OLcfgAt:11 NAME 'olcConnMaxPending' "
 264                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 265         { "conn_max_pending_auth", "max", 2, 2, 0, ARG_INT,
 266                 &slap_conn_max_pending_auth, "( OLcfgAt:12 NAME 'olcConnMaxPendingAuth' "
 267                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 268         { "database", "type", 2, 2, 0, ARG_MAGIC|CFG_DATABASE,
 269                 &config_generic, "( OLcfgAt:13 NAME 'olcDatabase' "
 270                         "DESC 'The backend type for a database instance' "
 271                         "SUP olcBackend X-ORDERED 'VALUES' )", NULL, NULL },
 272         { "defaultSearchBase", "dn", 2, 2, 0, ARG_PRE_BI|ARG_PRE_DB|ARG_DN|ARG_MAGIC,
 273                 &config_search_base, "( OLcfgAt:14 NAME 'olcDefaultSearchBase' "
 274                         "SYNTAX OMsDN SINGLE-VALUE )", NULL, NULL },
 275         { "disallows", "features", 2, 0, 8, ARG_PRE_DB|ARG_MAGIC,
 276                 &config_disallows, "( OLcfgAt:15 NAME 'olcDisallows' "
 277                         "EQUALITY caseIgnoreMatch "
 278                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 279         /* use standard schema */
 280         { "ditcontentrule",     NULL, 0, 0, 0, ARG_MAGIC|CFG_DIT,
 281                 &config_generic, NULL, NULL, NULL },
 282         { "gentlehup", "on|off", 2, 2, 0,
 283 #ifdef SIGHUP
 284                 ARG_ON_OFF, &global_gentlehup,
 285 #else
 286                 ARG_IGNORED, NULL,
 287 #endif
 288                 "( OLcfgAt:17 NAME 'olcGentleHUP' "
 289                         "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
 290         { "idletimeout", "timeout", 2, 2, 0, ARG_INT,
 291                 &global_idletimeout, "( OLcfgAt:18 NAME 'olcIdleTimeout' "
 292                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 293 /* XXX -- special case? */
 294         { "include", "file", 2, 2, 0, ARG_MAGIC,
 295                 &config_include, "( OLcfgAt:19 NAME 'olcInclude' "
 296                         "SUP labeledURI )", NULL, NULL },
 297         { "index_substr_if_minlen", "min", 2, 2, 0, ARG_INT|ARG_NONZERO|ARG_MAGIC|CFG_SSTR_IF_MIN,
 298                 &config_generic, "( OLcfgAt:20 NAME 'olcIndexSubstrIfMinLen' "
 299                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 300         { "index_substr_if_maxlen", "max", 2, 2, 0, ARG_INT|ARG_NONZERO|ARG_MAGIC|CFG_SSTR_IF_MAX,
 301                 &config_generic, "( OLcfgAt:21 NAME 'olcIndexSubstrIfMaxLen' "
 302                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 303         { "index_substr_any_len", "len", 2, 2, 0, ARG_INT|ARG_NONZERO,
 304                 &index_substr_any_len, "( OLcfgAt:22 NAME 'olcIndexSubstrAnyLen' "
 305                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 306         { "index_substr_step", "step", 2, 2, 0, ARG_INT|ARG_NONZERO,
 307                 &index_substr_any_step, "( OLcfgAt:23 NAME 'olcIndexSubstrAnyStep' "
 308                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 309         { "lastmod", "on|off", 2, 2, 0, ARG_DB|ARG_ON_OFF|ARG_MAGIC|CFG_LASTMOD,
 310                 &config_generic, "( OLcfgAt:24 NAME 'olcLastMod' "
 311                         "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
 312         { "limits", "limits", 2, 0, 0, ARG_DB|ARG_MAGIC|CFG_LIMITS,
 313                 &config_generic, "( OLcfgAt:25 NAME 'olcLimits' "
 314                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 315         { "localSSF", "ssf", 2, 2, 0, ARG_INT,
 316                 &local_ssf, "( OLcfgAt:26 NAME 'olcLocalSSF' "
 317                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 318         { "logfile", "file", 2, 2, 0, ARG_STRING|ARG_MAGIC|CFG_LOGFILE,
 319                 &config_generic, "( OLcfgAt:27 NAME 'olcLogFile' "
 320                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 321         { "loglevel", "level", 2, 0, 0, ARG_MAGIC,
 322                 &config_loglevel, "( OLcfgAt:28 NAME 'olcLogLevel' "
 323                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 324         { "maxDerefDepth", "depth", 2, 2, 0, ARG_DB|ARG_INT|ARG_MAGIC|CFG_DEPTH,
 325                 &config_generic, "( OLcfgAt:29 NAME 'olcMaxDerefDepth' "
 326                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 327         { "moduleload", "file", 2, 0, 0,
 328 #ifdef SLAPD_MODULES
 329                 ARG_MAGIC|CFG_MODLOAD, &config_generic,
 330 #else
 331                 ARG_IGNORED, NULL,
 332 #endif
 333                 "( OLcfgAt:30 NAME 'olcModuleLoad' "
 334                         "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL },
 335         { "modulepath", "path", 2, 2, 0,
 336 #ifdef SLAPD_MODULES
 337                 ARG_MAGIC|CFG_MODPATH, &config_generic,
 338 #else
 339                 ARG_IGNORED, NULL,
 340 #endif
 341                 "( OLcfgAt:31 NAME 'olcModulePath' "
 342                         "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL },
 343         /* use standard schema */
 344         { "objectclass", "objectclass", 2, 0, 0, ARG_PAREN|ARG_MAGIC|CFG_OC,
 345                 &config_generic, NULL, NULL, NULL },
 346         { "objectidentifier", NULL,     0, 0, 0, ARG_MAGIC|CFG_OID,
 347                 &config_generic, "( OLcfgAt:33 NAME 'olcObjectIdentifier' "
 348                         "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL },
 349         { "overlay", "overlay", 2, 2, 0, ARG_MAGIC,
 350                 &config_overlay, "( OLcfgAt:34 NAME 'olcOverlay' "
 351                         "SUP olcDatabase X-ORDERED 'VALUES' )", NULL, NULL },
 352         { "password-crypt-salt-format", "salt", 2, 2, 0, ARG_STRING|ARG_MAGIC|CFG_SALT,
 353                 &config_generic, "( OLcfgAt:35 NAME 'olcPasswordCryptSaltFormat' "
 354                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 355         { "password-hash", "hash", 2, 2, 0, ARG_MAGIC,
 356                 &config_passwd_hash, "( OLcfgAt:36 NAME 'olcPasswordHash' "
 357                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 358         { "pidfile", "file", 2, 2, 0, ARG_STRING,
 359                 &slapd_pid_file, "( OLcfgAt:37 NAME 'olcPidFile' "
 360                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 361         { "plugin", NULL, 0, 0, 0,
 362 #ifdef LDAP_SLAPI
 363                 ARG_MAGIC|CFG_PLUGIN, &config_generic,
 364 #else
 365                 ARG_IGNORED, NULL,
 366 #endif
 367                 "( OLcfgAt:38 NAME 'olcPlugin' "
 368                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 369         { "pluginlog", "filename", 2, 2, 0,
 370 #ifdef LDAP_SLAPI
 371                 ARG_STRING, &slapi_log_file,
 372 #else
 373                 ARG_IGNORED, NULL,
 374 #endif
 375                 "( OLcfgAt:39 NAME 'olcPluginLogFile' "
 376                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 377         { "readonly", "on|off", 2, 2, 0, ARG_MAY_DB|ARG_ON_OFF|ARG_MAGIC|CFG_RO,
 378                 &config_generic, "( OLcfgAt:40 NAME 'olcReadOnly' "
 379                         "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
 380         { "referral", "url", 2, 2, 0, ARG_MAGIC,
 381                 &config_referral, "( OLcfgAt:41 NAME 'olcReferral' "
 382                         "SUP labeledURI SINGLE-VALUE )", NULL, NULL },
 383         { "replica", "host or uri", 2, 0, 0, ARG_DB|ARG_MAGIC,
 384                 &config_replica, "( OLcfgAt:42 NAME 'olcReplica' "
 385                         "SUP labeledURI )", NULL, NULL },
 386         { "replica-argsfile", NULL, 0, 0, 0, ARG_STRING,
 387                 &replica_argsFile, "( OLcfgAt:43 NAME 'olcReplicaArgsFile' "
 388                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 389         { "replica-pidfile", NULL, 0, 0, 0, ARG_STRING,
 390                 &replica_pidFile, "( OLcfgAt:44 NAME 'olcReplicaPidFile' "
 391                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 392         { "replicationInterval", NULL, 0, 0, 0, ARG_INT,
 393                 &replicationInterval, "( OLcfgAt:45 NAME 'olcReplicationInterval' "
 394                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 395         { "replogfile", "filename", 2, 2, 0, ARG_MAY_DB|ARG_MAGIC|ARG_STRING|CFG_REPLOG,
 396                 &config_generic, "( OLcfgAt:46 NAME 'olcReplogFile' "
 397                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 398         { "require", "features", 2, 0, 7, ARG_MAY_DB|ARG_MAGIC,
 399                 &config_requires, "( OLcfgAt:47 NAME 'olcRequires' "
 400                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 401         { "restrict", "op_list", 2, 0, 0, ARG_MAY_DB|ARG_MAGIC,
 402                 &config_restrict, "( OLcfgAt:48 NAME 'olcRestrict' "
 403                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 404         { "reverse-lookup", "on|off", 2, 2, 0,
 405 #ifdef SLAPD_RLOOKUPS
 406                 ARG_ON_OFF, &use_reverse_lookup,
 407 #else
 408                 ARG_IGNORED, NULL,
 409 #endif
 410                 "( OLcfgAt:49 NAME 'olcReverseLookup' "
 411                         "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
 412         { "rootdn", "dn", 2, 2, 0, ARG_DB|ARG_DN|ARG_MAGIC,
 413                 &config_rootdn, "( OLcfgAt:50 NAME 'olcRootDN' "
 414                         "SYNTAX OMsDN SINGLE-VALUE )", NULL, NULL },
 415         { "rootDSE", "file", 2, 2, 0, ARG_MAGIC|CFG_ROOTDSE,
 416                 &config_generic, "( OLcfgAt:51 NAME 'olcRootDSE' "
 417                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 418         { "rootpw", "password", 2, 2, 0, ARG_BERVAL|ARG_DB|ARG_MAGIC,
 419                 &config_rootpw, "( OLcfgAt:52 NAME 'olcRootPW' "
 420                         "SYNTAX OMsOctetString SINGLE-VALUE )", NULL, NULL },
 421         { "sasl-authz-policy", NULL, 2, 2, 0, ARG_MAGIC|CFG_AZPOLICY,
 422                 &config_generic, NULL, NULL, NULL },
 423         { "sasl-host", "host", 2, 2, 0,
 424 #ifdef HAVE_CYRUS_SASL
 425                 ARG_STRING|ARG_UNIQUE, &global_host,
 426 #else
 427                 ARG_IGNORED, NULL,
 428 #endif
 429                 "( OLcfgAt:53 NAME 'olcSaslHost' "
 430                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 431         { "sasl-realm", "realm", 2, 2, 0,
 432 #ifdef HAVE_CYRUS_SASL
 433                 ARG_STRING|ARG_UNIQUE, &global_realm,
 434 #else
 435                 ARG_IGNORED, NULL,
 436 #endif
 437                 "( OLcfgAt:54 NAME 'olcSaslRealm' "
 438                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 439         { "sasl-regexp", NULL, 3, 3, 0, ARG_MAGIC|CFG_AZREGEXP,
 440                 &config_generic, NULL, NULL, NULL },
 441         { "sasl-secprops", "properties", 2, 2, 0,
 442 #ifdef HAVE_CYRUS_SASL
 443                 ARG_MAGIC|CFG_SASLSECP, &config_generic,
 444 #else
 445                 ARG_IGNORED, NULL,
 446 #endif
 447                 "( OLcfgAt:56 NAME 'olcSaslSecProps' "
 448                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 449         { "saslRegexp", NULL, 3, 3, 0, ARG_MAGIC|CFG_AZREGEXP,
 450                 &config_generic, NULL, NULL, NULL },
 451         { "schemacheck", "on|off", 2, 2, 0, ARG_ON_OFF|ARG_MAGIC|CFG_CHECK,
 452                 &config_generic, "( OLcfgAt:57 NAME 'olcSchemaCheck' "
 453                         "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
 454         { "schemadn", "dn", 2, 2, 0, ARG_MAY_DB|ARG_DN|ARG_MAGIC,
 455                 &config_schema_dn, "( OLcfgAt:58 NAME 'olcSchemaDN' "
 456                         "SYNTAX OMsDN SINGLE-VALUE )", NULL, NULL },
 457         { "security", "factors", 2, 0, 0, ARG_MAY_DB|ARG_MAGIC,
 458                 &config_security, "( OLcfgAt:59 NAME 'olcSecurity' "
 459                         "SYNTAX OMsDirectoryString )", NULL, NULL },
 460         { "sizelimit", "limit", 2, 0, 0, ARG_MAY_DB|ARG_MAGIC|CFG_SIZE,
 461                 &config_sizelimit, "( OLcfgAt:60 NAME 'olcSizeLimit' "
 462                         "SYNTAX OMsInteger )", NULL, NULL },
 463         { "sockbuf_max_incoming", "max", 2, 2, 0, ARG_BER_LEN_T,
 464                 &sockbuf_max_incoming, "( OLcfgAt:61 NAME 'olcSockbufMaxIncoming' "
 465                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 466         { "sockbuf_max_incoming_auth", "max", 2, 2, 0, ARG_BER_LEN_T,
 467                 &sockbuf_max_incoming_auth, "( OLcfgAt:62 NAME 'olcSockbufMaxIncomingAuth' "
 468                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 469         { "srvtab", "file", 2, 2, 0,
 470 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
 471                 ARG_STRING, &ldap_srvtab,
 472 #else
 473                 ARG_IGNORED, NULL,
 474 #endif
 475                 "( OLcfgAt:63 NAME 'olcSrvtab' "
 476                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 477         { "suffix",     "suffix", 2, 2, 0, ARG_DB|ARG_DN|ARG_MAGIC,
 478                 &config_suffix, "( OLcfgAt:64 NAME 'olcSuffix' "
 479                         "SYNTAX OMsDN )", NULL, NULL },
 480         { "syncrepl", NULL, 0, 0, 0, ARG_DB|ARG_MAGIC,
 481                 &config_syncrepl, "( OLcfgAt:65 NAME 'olcSyncrepl' "
 482                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 483         { "threads", "count", 2, 2, 0, ARG_INT|ARG_MAGIC|CFG_THREADS,
 484                 &config_generic, "( OLcfgAt:66 NAME 'olcThreads' "
 485                         "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
 486         { "timelimit", "limit", 2, 0, 0, ARG_MAY_DB|ARG_MAGIC|CFG_TIME,
 487                 &config_timelimit, "( OLcfgAt:67 NAME 'olcTimeLimit' "
 488                         "SYNTAX OMsInteger )", NULL, NULL },
 489         { "TLSCACertificateFile", NULL, 0, 0, 0,
 490 #ifdef HAVE_TLS
 491                 CFG_TLS_CA_FILE|ARG_STRING|ARG_MAGIC, &config_tls_option,
 492 #else
 493                 ARG_IGNORED, NULL,
 494 #endif
 495                 "( OLcfgAt:68 NAME 'olcTLSCACertificateFile' "
 496                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 497         { "TLSCACertificatePath", NULL, 0, 0, 0,
 498 #ifdef HAVE_TLS
 499                 CFG_TLS_CA_PATH|ARG_STRING|ARG_MAGIC, &config_tls_option,
 500 #else
 501                 ARG_IGNORED, NULL,
 502 #endif
 503                 "( OLcfgAt:69 NAME 'olcTLSCACertificatePath' "
 504                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 505         { "TLSCertificateFile", NULL, 0, 0, 0,
 506 #ifdef HAVE_TLS
 507                 CFG_TLS_CERT_FILE|ARG_STRING|ARG_MAGIC, &config_tls_option,
 508 #else
 509                 ARG_IGNORED, NULL,
 510 #endif
 511                 "( OLcfgAt:70 NAME 'olcTLSCertificateFile' "
 512                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 513         { "TLSCertificateKeyFile", NULL, 0, 0, 0,
 514 #ifdef HAVE_TLS
 515                 CFG_TLS_CERT_KEY|ARG_STRING|ARG_MAGIC, &config_tls_option,
 516 #else
 517                 ARG_IGNORED, NULL,
 518 #endif
 519                 "( OLcfgAt:71 NAME 'olcTLSCertificateKeyFile' "
 520                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 521         { "TLSCipherSuite",     NULL, 0, 0, 0,
 522 #ifdef HAVE_TLS
 523                 CFG_TLS_CIPHER|ARG_STRING|ARG_MAGIC, &config_tls_option,
 524 #else
 525                 ARG_IGNORED, NULL,
 526 #endif
 527                 "( OLcfgAt:72 NAME 'olcTLSCipherSuite' "
 528                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 529         { "TLSCRLCheck", NULL, 0, 0, 0,
 530 #ifdef HAVE_TLS
 531                 CFG_TLS_CRLCHECK|ARG_STRING|ARG_MAGIC, &config_tls_config,
 532 #else
 533                 ARG_IGNORED, NULL,
 534 #endif
 535                 "( OLcfgAt:73 NAME 'olcTLSCRLCheck' "
 536                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 537         { "TLSRandFile", NULL, 0, 0, 0,
 538 #ifdef HAVE_TLS
 539                 CFG_TLS_RAND|ARG_STRING|ARG_MAGIC, &config_tls_option,
 540 #else
 541                 ARG_IGNORED, NULL,
 542 #endif
 543                 "( OLcfgAt:74 NAME 'olcTLSRandFile' "
 544                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 545         { "TLSVerifyClient", NULL, 0, 0, 0,
 546 #ifdef HAVE_TLS
 547                 CFG_TLS_VERIFY|ARG_STRING|ARG_MAGIC, &config_tls_config,
 548 #else
 549                 ARG_IGNORED, NULL,
 550 #endif
 551                 "( OLcfgAt:75 NAME 'olcTLSVerifyClient' "
 552                         "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
 553         { "ucdata-path", "path", 2, 2, 0, ARG_IGNORED,
 554                 NULL, NULL, NULL, NULL },
 555         { "updatedn", "dn", 2, 2, 0, ARG_DB|ARG_MAGIC,
 556                 &config_updatedn, "( OLcfgAt:76 NAME 'olcUpdateDN' "
 557                         "SYNTAX OMsDN SINGLE-VALUE )", NULL, NULL },
 558         { "updateref", "url", 2, 2, 0, ARG_DB|ARG_MAGIC,
 559                 &config_updateref, "( OLcfgAt:77 NAME 'olcUpdateRef' "
 560                         "SUP labeledURI )", NULL, NULL },
 561         { NULL, NULL, 0, 0, 0, ARG_IGNORED,
 562                 NULL, NULL, NULL, NULL }
 563 };
 564
 565 static ConfigOCs cf_ocs[] = {
 566         { "( OLcfgOc:1 "
 567                 "NAME 'olcConfig' "
 568                 "DESC 'OpenLDAP configuration object' "
 569                 "ABSTRACT SUP top "
 570                 "MAY ( cn $ olcConfigFile ) )", Cft_Abstract, NULL },
 571         { "( OLcfgOc:2 "
 572                 "NAME 'olcGlobal' "
 573                 "DESC 'OpenLDAP Global configuration options' "
 574                 "SUP olcConfig STRUCTURAL "
 575                 "MAY ( olcConfigDir $ olcAllows $ olcArgsFile $ olcAttributeOptions $ "
 576                  "olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ "
 577                  "olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ "
 578                  "olcDefaultSearchBase $ olcDisallows $ olcGentleHUP $ "
 579                  "olcIdleTimeout $ olcIndexSubstrIfMaxLen $ olcIndexSubstrIfMinLen $ "
 580                  "olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcLocalSSF $ "
 581                  "olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectIdentifier $ "
 582                  "olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ "
 583                  "olcPlugin $ olcPluginLogFile $ olcReadOnly $ olcReferral $ "
 584                  "olcReplicaPidFile $ olcReplicaArgsFile $ olcReplicationInterval $ "
 585                  "olcReplogFile $ olcRequires $ olcRestrict $ olcReverseLookup $ "
 586                  "olcRootDSE $ olcRootPW $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ "
 587                  "olcSchemaCheck $ olcSchemaDN $ olcSecurity $ olcSizeLimit $ "
 588                  "olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcSrvtab $ "
 589                  "olcThreads $ olcTimeLimit $ olcTLSCACertificateFile $ "
 590                  "olcTLSCACertificatePath $ olcTLSCertificateFile $ "
 591                  "olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ "
 592                  "olcTLSRandFile $ olcTLSVerifyClient ) )", Cft_Global, &cfOc_global },
 593         { "( OLcfgOc:3 "
 594                 "NAME 'olcSchemaConfig' "
 595                 "DESC 'OpenLDAP schema object' "
 596                 "SUP olcConfig STRUCTURAL "
 597                 "MAY ( olcObjectIdentifier $ attributeTypes $ objectClasses $ "
 598                  "ditContentRules ) )", Cft_Schema, &cfOc_schema },
 599         { "( OLcfgOc:4 "
 600                 "NAME 'olcBackendConfig' "
 601                 "DESC 'OpenLDAP Backend-specific options' "
 602                 "SUP olcConfig STRUCTURAL "
 603                 "MAY ( olcBackend ) )", Cft_Backend, &cfOc_backend },
 604         { "( OLcfgOc:5 "
 605                 "NAME 'olcDatabaseConfig' "
 606                 "DESC 'OpenLDAP Database-specific options' "
 607                 "SUP olcConfig STRUCTURAL "
 608                 "MAY ( olcDatabase $ olcAccess $ olcLastMod $ olcLimits $ "
 609                  "olcMaxDerefDepth $ olcPlugin $ olcReadOnly $ olcReplica $ "
 610                  "olcReplogFile $ olcRequires $ olcRestrict $ olcRootDN $ olcRootPW $ "
 611                  "olcSchemaDN $ olcSecurity $ olcSizeLimit $ olcSuffix $ olcSyncrepl $ "
 612                  "olcTimeLimit $ olcUpdateDN $ olcUpdateRef ) )",
 613                         Cft_Database, &cfOc_database },
 614         { "( OLcfgOc:6 "
 615                 "NAME 'olcOverlayConfig' "
 616                 "DESC 'OpenLDAP Overlay-specific options' "
 617                 "SUP olcConfig STRUCTURAL "
 618                 "MAY ( olcOverlay ) )", Cft_Overlay, &cfOc_overlay },
 619         { "( OLcfgOc:7 "
 620                 "NAME 'olcIncludeFile' "
 621                 "DESC 'OpenLDAP configuration include file' "
 622                 "SUP olcConfig STRUCTURAL "
 623                 "MAY ( olcInclude $ olcModuleLoad $ olcModulePath $ olcRootDSE ) )",
 624                 Cft_Include, &cfOc_include },
 625         { NULL, 0, NULL }
 626 };
 627
 628 static int
 629 config_generic(ConfigArgs *c) {
 630         char *p;
 631         int i;
 632
 633         if ( c->op == SLAP_CONFIG_EMIT ) {
 634                 int rc = 0;
 635                 switch(c->type) {
 636                 case CFG_CONCUR:
 637                         c->value_int = ldap_pvt_thread_get_concurrency();
 638                         break;
 639                 case CFG_THREADS:
 640                         c->value_int = connection_pool_max;
 641                         break;
 642                 case CFG_SALT:
 643                         if ( passwd_salt )
 644                                 c->value_string = ch_strdup( passwd_salt );
 645                         else
 646                                 rc = 1;
 647                         break;
 648                 case CFG_LIMITS:
 649                         if ( c->be->be_limits ) {
 650                                 char buf[4096*3];
 651                                 struct berval bv;
 652                                 int i;
 653
 654                                 for ( i=0; c->be->be_limits[i]; i++ ) {
 655                                         bv.bv_len = sprintf( buf, "{%d}", i );
 656                                         bv.bv_val = buf+bv.bv_len;
 657                                         limits_unparse( c->be->be_limits[i], &bv );
 658                                         bv.bv_len += bv.bv_val - buf;
 659                                         bv.bv_val = buf;
 660                                         value_add_one( &c->rvalue_vals, &bv );
 661                                 }
 662                         }
 663                         if ( !c->rvalue_vals ) rc = 1;
 664                         break;
 665                 case CFG_RO:
 666                         c->value_int = (c->be->be_restrictops & SLAP_RESTRICT_OP_WRITES) != 0;
 667                         break;
 668                 case CFG_AZPOLICY:
 669                         c->value_string = ch_strdup( slap_sasl_getpolicy());
 670                         break;
 671                 case CFG_AZREGEXP:
 672                         slap_sasl_regexp_unparse( &c->rvalue_vals );
 673                         if ( !c->rvalue_vals ) rc = 1;
 674                         break;
 675 #ifdef HAVE_CYRUS_SASL
 676                 case CFG_SASLSECP: {
 677                         struct berval bv = BER_BVNULL;
 678                         slap_sasl_secprops_unparse( &bv );
 679                         if ( !BER_BVISNULL( &bv )) {
 680                                 ber_bvarray_add( &c->rvalue_vals, &bv );
 681                         } else {
 682                                 rc = 1;
 683                         }
 684                         }
 685                         break;
 686 #endif
 687                 case CFG_DEPTH:
 688                         c->value_int = c->be->be_max_deref_depth;
 689                         break;
 690                 case CFG_OID:
 691                         oidm_unparse( &c->rvalue_vals );
 692                         if ( !c->rvalue_vals )
 693                                 rc = 1;
 694                         break;
 695                 case CFG_CHECK:
 696                         c->value_int = global_schemacheck;
 697                         break;
 698                 case CFG_ACL: {
 699                         AccessControl *a;
 700                         char *src, *dst, ibuf[11];
 701                         struct berval bv, abv;
 702                         for (i=0, a=c->be->be_acl; a; i++,a=a->acl_next) {
 703                                 abv.bv_len = sprintf( ibuf, "{%x}", i );
 704                                 acl_unparse( a, &bv );
 705                                 abv.bv_val = ch_malloc( abv.bv_len + bv.bv_len + 1 );
 706                                 AC_MEMCPY( abv.bv_val, ibuf, abv.bv_len );
 707                                 /* Turn TAB / EOL into plain space */
 708                                 for (src=bv.bv_val,dst=abv.bv_val+abv.bv_len; *src; src++) {
 709                                         if (isspace(*src)) *dst++ = ' ';
 710                                         else *dst++ = *src;
 711                                 }
 712                                 *dst = '\0';
 713                                 if (dst[-1] == ' ') {
 714                                         dst--;
 715                                         *dst = '\0';
 716                                 }
 717                                 abv.bv_len = dst - abv.bv_val;
 718                                 ber_bvarray_add( &c->rvalue_vals, &abv );
 719                         }
 720                         rc = (!i);
 721                         break;
 722                 }
 723                 case CFG_REPLOG:
 724                         if ( c->be->be_replogfile )
 725                                 c->value_string = ch_strdup( c->be->be_replogfile );
 726                         break;
 727                 case CFG_ROOTDSE: {
 728                         ConfigFile *cf = (ConfigFile *)c->line;
 729                         if ( cf->c_dseFiles ) {
 730                                 value_add( &c->rvalue_vals, cf->c_dseFiles );
 731                         } else {
 732                                 rc = 1;
 733                         }
 734                         }
 735                         break;
 736                 case CFG_LOGFILE:
 737                         if ( logfileName )
 738                                 c->value_string = ch_strdup( logfileName );
 739                         else
 740                                 rc = 1;
 741                         break;
 742                 case CFG_LASTMOD:
 743                         c->value_int = (SLAP_NOLASTMOD(c->be) == 0);
 744                         break;
 745                 case CFG_SSTR_IF_MAX:
 746                         c->value_int = index_substr_if_maxlen;
 747                         break;
 748                 case CFG_SSTR_IF_MIN:
 749                         c->value_int = index_substr_if_minlen;
 750                         break;
 751 #ifdef SLAPD_MODULES
 752                 case CFG_MODLOAD: {
 753                         ConfigFile *cf = (ConfigFile *)c->line;
 754                         ModPaths *mp;
 755                         for (i=0, mp=&cf->c_modpaths; mp; mp=mp->mp_next, i++) {
 756                                 int j;
 757                                 if (!mp->mp_loads) continue;
 758                                 for (j=0; !BER_BVISNULL(&mp->mp_loads[j]); j++) {
 759                                         struct berval bv;
 760                                         bv.bv_val = c->log;
 761                                         bv.bv_len = sprintf( bv.bv_val, "{%d}{%d}%s", i, j,
 762                                                 mp->mp_loads[j].bv_val );
 763                                         value_add_one( &c->rvalue_vals, &bv );
 764                                 }
 765                         }
 766                         rc = c->rvalue_vals ? 0 : 1;
 767                         }
 768                         break;
 769                 case CFG_MODPATH: {
 770                         ConfigFile *cf = (ConfigFile *)c->line;
 771                         ModPaths *mp;
 772                         for (i=0, mp=&cf->c_modpaths; mp; mp=mp->mp_next, i++) {
 773                                 struct berval bv;
 774                                 if ( BER_BVISNULL( &mp->mp_path ) && !mp->mp_loads )
 775                                         continue;
 776                                 bv.bv_val = c->log;
 777                                 bv.bv_len = sprintf( bv.bv_val, "{%d}%s", i,
 778                                         mp->mp_path.bv_val );
 779                                 value_add_one( &c->rvalue_vals, &bv );
 780                         }
 781                         rc = c->rvalue_vals ? 0 : 1;
 782                         }
 783                         break;
 784 #endif
 785 #ifdef LDAP_SLAPI
 786                 case CFG_PLUGIN:
 787                         slapi_int_plugin_unparse( c->be, &c->rvalue_vals );
 788                         if ( !c->rvalue_vals ) rc = 1;
 789                         break;
 790 #endif
 791 #ifdef SLAP_AUTH_REWRITE
 792                 case CFG_REWRITE:
 793                         if ( authz_rewrites ) {
 794                                 struct berval bv, idx;
 795                                 char ibuf[32];
 796                                 int i;
 797
 798                                 idx.bv_val = ibuf;
 799                                 for ( i=0; !BER_BVISNULL( &authz_rewrites[i] ); i++ ) {
 800                                         idx.bv_len = sprintf( idx.bv_val, "{%d}", i );
 801                                         bv.bv_len = idx.bv_len + authz_rewrites[i].bv_len;
 802                                         bv.bv_val = ch_malloc( bv.bv_len + 1 );
 803                                         strcpy( bv.bv_val, idx.bv_val );
 804                                         strcpy( bv.bv_val+idx.bv_len, authz_rewrites[i].bv_val );
 805                                         ber_bvarray_add( &c->rvalue_vals, &bv );
 806                                 }
 807                         }
 808                         if ( !c->rvalue_vals ) rc = 1;
 809                         break;
 810 #endif
 811                 default:
 812                         rc = 1;
 813                 }
 814                 return rc;
 815         }
 816
 817         p = strchr(c->line,'(' /*')'*/);
 818         switch(c->type) {
 819                 case CFG_BACKEND:
 820                         if(!(c->bi = backend_info(c->argv[1]))) {
 821                                 Debug(LDAP_DEBUG_ANY, "%s: "
 822                                         "backend %s failed init!\n", c->log, c->argv[1], 0);
 823                                 return(1);
 824                         }
 825                         break;
 826
 827                 case CFG_DATABASE:
 828                         c->bi = NULL;
 829                         /* NOTE: config is always the first backend!
 830                          */
 831                         if ( !strcasecmp( c->argv[1], "config" )) {
 832                                 c->be = backendDB;
 833                         } else if ( !strcasecmp( c->argv[1], "frontend" )) {
 834                                 c->be = frontendDB;
 835                         } else if(!(c->be = backend_db_init(c->argv[1]))) {
 836                                 Debug(LDAP_DEBUG_ANY, "%s: "
 837                                         "database %s failed init!\n", c->log, c->argv[1], 0);
 838                                 return(1);
 839                         }
 840                         break;
 841
 842                 case CFG_CONCUR:
 843                         ldap_pvt_thread_set_concurrency(c->value_int);
 844                         break;
 845
 846                 case CFG_THREADS:
 847                         ldap_pvt_thread_pool_maxthreads(&connection_pool, c->value_int);
 848                         connection_pool_max = c->value_int;     /* save for reference */
 849                         break;
 850
 851                 case CFG_SALT:
 852                         if ( passwd_salt ) ch_free( passwd_salt );
 853                         passwd_salt = c->value_string;
 854                         lutil_salt_format(passwd_salt);
 855                         break;
 856
 857                 case CFG_LIMITS:
 858                         if(limits_parse(c->be, c->fname, c->lineno, c->argc, c->argv))
 859                                 return(1);
 860                         break;
 861
 862                 case CFG_RO:
 863                         if(c->value_int)
 864                                 c->be->be_restrictops |= SLAP_RESTRICT_OP_WRITES;
 865                         else
 866                                 c->be->be_restrictops &= ~SLAP_RESTRICT_OP_WRITES;
 867                         break;
 868
 869                 case CFG_AZPOLICY:
 870                         ch_free(c->value_string);
 871                         if (slap_sasl_setpolicy( c->argv[1] )) {
 872                                 Debug(LDAP_DEBUG_ANY, "%s: unable to parse value \"%s\" in"
 873                                         " \"authz-policy <policy>\"\n",
 874                                         c->log, c->argv[1], 0 );
 875                                 return(1);
 876                         }
 877                         break;
 878
 879                 case CFG_AZREGEXP:
 880                         if (slap_sasl_regexp_config( c->argv[1], c->argv[2] ))
 881                                 return(1);
 882                         break;
 883
 884 #ifdef HAVE_CYRUS_SASL
 885                 case CFG_SASLSECP:
 886                         {
 887                         char *txt = slap_sasl_secprops( c->argv[1] );
 888                         if ( txt ) {
 889                                 Debug(LDAP_DEBUG_ANY, "%s: sasl-secprops: %s\n",
 890                                         c->log, txt, 0 );
 891                                 return(1);
 892                         }
 893                         break;
 894                         }
 895 #endif
 896
 897                 case CFG_DEPTH:
 898                         c->be->be_max_deref_depth = c->value_int;
 899                         break;
 900
 901                 case CFG_OID:
 902                         if(parse_oidm(c->fname, c->lineno, c->argc, c->argv)) return(0);
 903                         break;
 904
 905                 case CFG_OC:
 906                         if(parse_oc(c->fname, c->lineno, p, c->argv)) return(1);
 907                         break;
 908
 909                 case CFG_DIT:
 910                         if(parse_cr(c->fname, c->lineno, p, c->argv)) return(1);
 911                         break;
 912
 913                 case CFG_ATTR:
 914                         if(parse_at(c->fname, c->lineno, p, c->argv)) return(1);
 915                         break;
 916
 917                 case CFG_ATOPT:
 918                         ad_define_option(NULL, NULL, 0);
 919                         for(i = 1; i < c->argc; i++)
 920                                 if(ad_define_option(c->argv[i], c->fname, c->lineno))
 921                                         return(1);
 922                         break;
 923
 924                 case CFG_CHECK:
 925                         global_schemacheck = c->value_int;
 926                         if(!global_schemacheck) Debug(LDAP_DEBUG_ANY, "%s: "
 927                                 "schema checking disabled! your mileage may vary!\n",
 928                                 c->log, 0, 0);
 929                         break;
 930
 931                 case CFG_ACL:
 932                         parse_acl(c->be, c->fname, c->lineno, c->argc, c->argv);
 933                         break;
 934
 935                 case CFG_REPLOG:
 936                         if(SLAP_MONITOR(c->be)) {
 937                                 Debug(LDAP_DEBUG_ANY, "%s: "
 938                                         "\"replogfile\" should not be used "
 939                                         "inside monitor database\n",
 940                                         c->log, 0, 0);
 941                                 return(0);      /* FIXME: should this be an error? */
 942                         }
 943
 944                         c->be->be_replogfile = c->value_string;
 945                         break;
 946
 947                 case CFG_ROOTDSE:
 948                         if(read_root_dse_file(c->argv[1])) {
 949                                 Debug(LDAP_DEBUG_ANY, "%s: "
 950                                         "could not read \"rootDSE <filename>\" line\n",
 951                                         c->log, 0, 0);
 952                                 return(1);
 953                         }
 954                         {
 955                                 struct berval bv;
 956                                 ber_str2bv( c->argv[1], 0, 1, &bv );
 957                                 ber_bvarray_add( &cfn->c_dseFiles, &bv );
 958                         }
 959                         break;
 960
 961                 case CFG_LOGFILE: {
 962                                 FILE *logfile;
 963                                 if ( logfileName ) ch_free( logfileName );
 964                                 logfileName = c->value_string;
 965                                 logfile = fopen(logfileName, "w");
 966                                 if(logfile) lutil_debug_file(logfile);
 967                         } break;
 968
 969                 case CFG_LASTMOD:
 970                         if(SLAP_NOLASTMODCMD(c->be)) {
 971                                 Debug(LDAP_DEBUG_ANY, "%s: "
 972                                         "lastmod not available for %s databases\n",
 973                                         c->log, c->be->bd_info->bi_type, 0);
 974                                 return(1);
 975                         }
 976                         if(c->value_int)
 977                                 SLAP_DBFLAGS(c->be) &= ~SLAP_DBFLAG_NOLASTMOD;
 978                         else
 979                                 SLAP_DBFLAGS(c->be) |= SLAP_DBFLAG_NOLASTMOD;
 980                         break;
 981
 982                 case CFG_SSTR_IF_MAX:
 983                         if (c->value_int < index_substr_if_minlen) {
 984                                 Debug(LDAP_DEBUG_ANY, "%s: "
 985                                         "invalid max value (%d)\n",
 986                                         c->log, c->value_int, 0 );
 987                                 return(1);
 988                         }
 989                         index_substr_if_maxlen = c->value_int;
 990                         break;
 991
 992                 case CFG_SSTR_IF_MIN:
 993                         if (c->value_int > index_substr_if_maxlen) {
 994                                 Debug(LDAP_DEBUG_ANY, "%s: "
 995                                         "invalid min value (%d)\n",
 996                                         c->log, c->value_int, 0 );
 997                                 return(1);
 998                         }
 999                         index_substr_if_minlen = c->value_int;
1000                         break;
1001
1002 #ifdef SLAPD_MODULES
1003                 case CFG_MODLOAD:
1004                         if(module_load(c->argv[1], c->argc - 2, (c->argc > 2) ? c->argv + 2 : NULL))
1005                                 return(1);
1006                         /* Record this load on the current path */
1007                         {
1008                                 struct berval bv;
1009                                 ber_str2bv(c->line, 0, 1, &bv);
1010                                 ber_bvarray_add( &cfn->c_modlast->mp_loads, &bv );
1011                         }
1012                         break;
1013
1014                 case CFG_MODPATH:
1015                         if(module_path(c->argv[1])) return(1);
1016                         /* Record which path was used with each module */
1017                         {
1018                                 ModPaths *mp;
1019
1020                                 if (!cfn->c_modpaths.mp_loads) {
1021                                         mp = &cfn->c_modpaths;
1022                                 } else {
1023                                         mp = ch_malloc( sizeof( ModPaths ));
1024                                         cfn->c_modlast->mp_next = mp;
1025                                 }
1026                                 ber_str2bv(c->argv[1], 0, 1, &mp->mp_path);
1027                                 mp->mp_next = NULL;
1028                                 mp->mp_loads = NULL;
1029                                 cfn->c_modlast = mp;
1030                         }
1031
1032                         break;
1033 #endif
1034
1035 #ifdef LDAP_SLAPI
1036                 case CFG_PLUGIN:
1037                         if(slapi_int_read_config(c->be, c->fname, c->lineno, c->argc, c->argv) != LDAP_SUCCESS)
1038                                 return(1);
1039                         slapi_plugins_used++;
1040                         break;
1041 #endif
1042
1043 #ifdef SLAP_AUTH_REWRITE
1044                 case CFG_REWRITE: {
1045                         struct berval bv;
1046                         if(slap_sasl_rewrite_config(c->fname, c->lineno, c->argc, c->argv))
1047                                 return(1);
1048                         ber_str2bv( c->line, 0, 1, &bv );
1049                         ber_bvarray_add( &authz_rewrites, &bv );
1050                         }
1051                         break;
1052 #endif
1053
1054
1055                 default:
1056                         Debug(LDAP_DEBUG_ANY, "%s: unknown CFG_TYPE %d"
1057                                 "(ignored)\n", c->log, c->type, 0);
1058
1059         }
1060         return(0);
1061 }
1062
1063
1064 static int
1065 config_fname(ConfigArgs *c) {
1066         if(c->op == SLAP_CONFIG_EMIT) {
1067                 if (c->line) {
1068                         ConfigFile *cf = (ConfigFile *)c->line;
1069                         value_add_one( &c->rvalue_vals, &cf->c_file );
1070                         return 0;
1071                 }
1072                 return 1;
1073         }
1074         return(0);
1075 }
1076
1077 static int
1078 config_cfdir(ConfigArgs *c) {
1079         if(c->op == SLAP_CONFIG_EMIT) {
1080                 value_add_one( &c->rvalue_vals, &cfdir );
1081                 return 0;
1082         }
1083         return(0);
1084 }
1085
1086 static int
1087 config_search_base(ConfigArgs *c) {
1088         struct berval dn;
1089
1090         if(c->op == SLAP_CONFIG_EMIT) {
1091                 int rc = 1;
1092                 if (!BER_BVISEMPTY(&default_search_base)) {
1093                         value_add_one(&c->rvalue_vals, &default_search_base);
1094                         value_add_one(&c->rvalue_nvals, &default_search_nbase);
1095                         rc = 0;
1096                 }
1097                 return rc;
1098         }
1099
1100         if(c->bi || c->be != frontendDB) {
1101                 Debug(LDAP_DEBUG_ANY, "%s: defaultSearchBase line must appear "
1102                         "prior to any backend or database definition\n",
1103                         c->log, 0, 0);
1104                 return(1);
1105         }
1106
1107         if(default_search_nbase.bv_len) {
1108                 Debug(LDAP_DEBUG_ANY, "%s: "
1109                         "default search base \"%s\" already defined "
1110                         "(discarding old)\n",
1111                         c->log, default_search_base.bv_val, 0);
1112                 free(default_search_base.bv_val);
1113                 free(default_search_nbase.bv_val);
1114         }
1115
1116         default_search_base = c->value_dn;
1117         default_search_nbase = c->value_ndn;
1118         return(0);
1119 }
1120
1121 static int
1122 config_passwd_hash(ConfigArgs *c) {
1123         int i;
1124         if (c->op == SLAP_CONFIG_EMIT) {
1125                 struct berval bv;
1126                 for (i=0; default_passwd_hash && default_passwd_hash[i]; i++) {
1127                         ber_str2bv(default_passwd_hash[i], 0, 0, &bv);
1128                         value_add_one(&c->rvalue_vals, &bv);
1129                 }
1130                 return i ? 0 : 1;
1131         }
1132         if(default_passwd_hash) {
1133                 Debug(LDAP_DEBUG_ANY, "%s: "
1134                         "already set default password_hash\n",
1135                         c->log, 0, 0);
1136                 return(1);
1137         }
1138         for(i = 1; i < c->argc; i++) {
1139                 if(!lutil_passwd_scheme(c->argv[i])) {
1140                         Debug(LDAP_DEBUG_ANY, "%s: "
1141                                 "password scheme \"%s\" not available\n",
1142                                 c->log, c->argv[i], 0);
1143                 } else {
1144                         ldap_charray_add(&default_passwd_hash, c->argv[i]);
1145                 }
1146                 if(!default_passwd_hash) {
1147                         Debug(LDAP_DEBUG_ANY, "%s: no valid hashes found\n",
1148                                 c->log, 0, 0 );
1149                         return(1);
1150                 }
1151         }
1152         return(0);
1153 }
1154
1155 static int
1156 config_schema_dn(ConfigArgs *c) {
1157         if ( c->op == SLAP_CONFIG_EMIT ) {
1158                 int rc = 1;
1159                 if ( !BER_BVISEMPTY( &c->be->be_schemadn )) {
1160                         value_add_one(&c->rvalue_vals, &c->be->be_schemadn);
1161                         value_add_one(&c->rvalue_nvals, &c->be->be_schemandn);
1162                         rc = 0;
1163                 }
1164                 return rc;
1165         }
1166         c->be->be_schemadn = c->value_dn;
1167         c->be->be_schemandn = c->value_ndn;
1168         return(0);
1169 }
1170
1171 static int
1172 config_sizelimit(ConfigArgs *c) {
1173         int i, rc = 0;
1174         char *next;
1175         struct slap_limits_set *lim = &c->be->be_def_limit;
1176         if (c->op == SLAP_CONFIG_EMIT) {
1177                 char buf[8192];
1178                 struct berval bv;
1179                 bv.bv_val = buf;
1180                 bv.bv_len = 0;
1181                 limits_unparse_one( lim, SLAP_LIMIT_SIZE, &bv );
1182                 if ( !BER_BVISEMPTY( &bv ))
1183                         value_add_one( &c->rvalue_vals, &bv );
1184                 else
1185                         rc = 1;
1186                 return rc;
1187         }
1188         for(i = 1; i < c->argc; i++) {
1189                 if(!strncasecmp(c->argv[i], "size", 4)) {
1190                         rc = limits_parse_one(c->argv[i], lim);
1191                         if ( rc ) {
1192                                 Debug(LDAP_DEBUG_ANY, "%s: "
1193                                         "unable to parse value \"%s\" in \"sizelimit <limit>\" line\n",
1194                                         c->log, c->argv[i], 0);
1195                                 return(1);
1196                         }
1197                 } else {
1198                         if(!strcasecmp(c->argv[i], "unlimited")) {
1199                                 lim->lms_s_soft = -1;
1200                         } else {
1201                                 lim->lms_s_soft = strtol(c->argv[i], &next, 0);
1202                                 if(next == c->argv[i]) {
1203                                         Debug(LDAP_DEBUG_ANY, "%s: "
1204                                                 "unable to parse limit \"%s\" in \"sizelimit <limit>\" line\n",
1205                                                 c->log, c->argv[i], 0);
1206                                         return(1);
1207                                 } else if(next[0] != '\0') {
1208                                         Debug(LDAP_DEBUG_ANY, "%s: "
1209                                                 "trailing chars \"%s\" in \"sizelimit <limit>\" line (ignored)\n",
1210                                                 c->log, next, 0);
1211                                 }
1212                         }
1213                         lim->lms_s_hard = 0;
1214                 }
1215         }
1216         return(0);
1217 }
1218
1219 static int
1220 config_timelimit(ConfigArgs *c) {
1221         int i, rc = 0;
1222         char *next;
1223         struct slap_limits_set *lim = &c->be->be_def_limit;
1224         if (c->op == SLAP_CONFIG_EMIT) {
1225                 char buf[8192];
1226                 struct berval bv;
1227                 bv.bv_val = buf;
1228                 bv.bv_len = 0;
1229                 limits_unparse_one( lim, SLAP_LIMIT_TIME, &bv );
1230                 if ( !BER_BVISEMPTY( &bv ))
1231                         value_add_one( &c->rvalue_vals, &bv );
1232                 else
1233                         rc = 1;
1234                 return rc;
1235         }
1236         for(i = 1; i < c->argc; i++) {
1237                 if(!strncasecmp(c->argv[i], "time", 4)) {
1238                         rc = limits_parse_one(c->argv[i], lim);
1239                         if ( rc ) {
1240                                 Debug(LDAP_DEBUG_ANY, "%s: "
1241                                         "unable to parse value \"%s\" in \"timelimit <limit>\" line\n",
1242                                         c->log, c->argv[i], 0);
1243                                 return(1);
1244                         }
1245                 } else {
1246                         if(!strcasecmp(c->argv[i], "unlimited")) {
1247                                 lim->lms_t_soft = -1;
1248                         } else {
1249                                 lim->lms_t_soft = strtol(c->argv[i], &next, 0);
1250                                 if(next == c->argv[i]) {
1251                                         Debug(LDAP_DEBUG_ANY, "%s: "
1252                                                 "unable to parse limit \"%s\" in \"timelimit <limit>\" line\n",
1253                                                 c->log, c->argv[i], 0);
1254                                         return(1);
1255                                 } else if(next[0] != '\0') {
1256                                         Debug(LDAP_DEBUG_ANY, "%s: "
1257                                                 "trailing chars \"%s\" in \"timelimit <limit>\" line (ignored)\n",
1258                                                 c->log, next, 0);
1259                                 }
1260                         }
1261                         lim->lms_t_hard = 0;
1262                 }
1263         }
1264         return(0);
1265 }
1266
1267 static int
1268 config_overlay(ConfigArgs *c) {
1269         if (c->op == SLAP_CONFIG_EMIT) {
1270                 return 1;
1271         }
1272         if(c->argv[1][0] == '-' && overlay_config(c->be, &c->argv[1][1])) {
1273                 /* log error */
1274                 Debug(LDAP_DEBUG_ANY, "%s: (optional) %s overlay \"%s\" configuration failed (ignored)\n",
1275                         c->log, c->be == frontendDB ? "global " : "", c->argv[1][1]);
1276         } else if(overlay_config(c->be, c->argv[1])) {
1277                 return(1);
1278         }
1279         return(0);
1280 }
1281
1282 static int
1283 config_suffix(ConfigArgs *c) {
1284         Backend *tbe;
1285         struct berval pdn, ndn;
1286         int rc;
1287
1288         if (c->be == frontendDB) return 1;
1289
1290         if (c->op == SLAP_CONFIG_EMIT) {
1291                 if (!BER_BVISNULL( &c->be->be_suffix[0] )) {
1292                         value_add( &c->rvalue_vals, c->be->be_suffix );
1293                         value_add( &c->rvalue_nvals, c->be->be_nsuffix );
1294                         return 0;
1295                 } else {
1296                         return 1;
1297                 }
1298         }
1299 #ifdef SLAPD_MONITOR_DN
1300         if(!strcasecmp(c->argv[1], SLAPD_MONITOR_DN)) {
1301                 Debug(LDAP_DEBUG_ANY, "%s: "
1302                         "\"%s\" is reserved for monitoring slapd\n",
1303                         c->log, SLAPD_MONITOR_DN, 0);
1304                 return(1);
1305         }
1306 #endif
1307
1308         pdn = c->value_dn;
1309         ndn = c->value_ndn;
1310         tbe = select_backend(&ndn, 0, 0);
1311         if(tbe == c->be) {
1312                 Debug(LDAP_DEBUG_ANY, "%s: suffix already served by this backend! (ignored)\n",
1313                         c->log, 0, 0);
1314                 free(pdn.bv_val);
1315                 free(ndn.bv_val);
1316         } else if(tbe) {
1317                 Debug(LDAP_DEBUG_ANY, "%s: suffix already served by a preceding backend \"%s\"\n",
1318                         c->log, tbe->be_suffix[0].bv_val, 0);
1319                 free(pdn.bv_val);
1320                 free(ndn.bv_val);
1321                 return(1);
1322         } else if(pdn.bv_len == 0 && default_search_nbase.bv_len) {
1323                 Debug(LDAP_DEBUG_ANY, "%s: suffix DN empty and default search "
1324                         "base provided \"%s\" (assuming okay)\n",
1325                         c->log, default_search_base.bv_val, 0);
1326         }
1327         ber_bvarray_add(&c->be->be_suffix, &pdn);
1328         ber_bvarray_add(&c->be->be_nsuffix, &ndn);
1329         return(0);
1330 }
1331
1332 static int
1333 config_rootdn(ConfigArgs *c) {
1334         if (c->op == SLAP_CONFIG_EMIT) {
1335                 if ( !BER_BVISNULL( &c->be->be_rootdn )) {
1336                         value_add_one(&c->rvalue_vals, &c->be->be_rootdn);
1337                         value_add_one(&c->rvalue_nvals, &c->be->be_rootndn);
1338                         return 0;
1339                 } else {
1340                         return 1;
1341                 }
1342         }
1343         c->be->be_rootdn = c->value_dn;
1344         c->be->be_rootndn = c->value_ndn;
1345         return(0);
1346 }
1347
1348 static int
1349 config_rootpw(ConfigArgs *c) {
1350         Backend *tbe;
1351         if (c->op == SLAP_CONFIG_EMIT) {
1352                 if (!BER_BVISEMPTY(&c->be->be_rootpw)) {
1353                         ber_dupbv( &c->value_bv, &c->be->be_rootpw);
1354                         return 0;
1355                 }
1356                 return 1;
1357         }
1358
1359         tbe = select_backend(&c->be->be_rootndn, 0, 0);
1360         if(tbe != c->be) {
1361                 Debug(LDAP_DEBUG_ANY, "%s: "
1362                         "rootpw can only be set when rootdn is under suffix\n",
1363                         c->log, 0, 0);
1364                 return(1);
1365         }
1366         c->be->be_rootpw = c->value_bv;
1367         return(0);
1368 }
1369
1370 static int
1371 config_restrict(ConfigArgs *c) {
1372         slap_mask_t restrictops = 0;
1373         int i;
1374         slap_verbmasks restrictable_ops[] = {
1375                 { BER_BVC("bind"),              SLAP_RESTRICT_OP_BIND },
1376                 { BER_BVC("add"),               SLAP_RESTRICT_OP_ADD },
1377                 { BER_BVC("modify"),            SLAP_RESTRICT_OP_MODIFY },
1378                 { BER_BVC("rename"),            SLAP_RESTRICT_OP_RENAME },
1379                 { BER_BVC("modrdn"),            0 },
1380                 { BER_BVC("delete"),            SLAP_RESTRICT_OP_DELETE },
1381                 { BER_BVC("search"),            SLAP_RESTRICT_OP_SEARCH },
1382                 { BER_BVC("compare"),   SLAP_RESTRICT_OP_COMPARE },
1383                 { BER_BVC("read"),              SLAP_RESTRICT_OP_READS },
1384                 { BER_BVC("write"),             SLAP_RESTRICT_OP_WRITES },
1385                 { BER_BVC("extended"),  SLAP_RESTRICT_OP_EXTENDED },
1386                 { BER_BVC("extended=" LDAP_EXOP_START_TLS ),            SLAP_RESTRICT_EXOP_START_TLS },
1387                 { BER_BVC("extended=" LDAP_EXOP_MODIFY_PASSWD ),        SLAP_RESTRICT_EXOP_MODIFY_PASSWD },
1388                 { BER_BVC("extended=" LDAP_EXOP_X_WHO_AM_I ),           SLAP_RESTRICT_EXOP_WHOAMI },
1389                 { BER_BVC("extended=" LDAP_EXOP_X_CANCEL ),             SLAP_RESTRICT_EXOP_CANCEL },
1390                 { BER_BVNULL,   0 }
1391         };
1392
1393         if (c->op == SLAP_CONFIG_EMIT) {
1394                 return mask_to_verbs( restrictable_ops, c->be->be_restrictops,
1395                         &c->rvalue_vals );
1396         }
1397         i = verbs_to_mask( c->argc, c->argv, restrictable_ops, &restrictops );
1398         if ( i ) {
1399                 Debug(LDAP_DEBUG_ANY, "%s: "
1400                         "unknown operation %s in \"restrict <features>\" line\n",
1401                         c->log, c->argv[i], 0);
1402                 return(1);
1403         }
1404         if ( restrictops & SLAP_RESTRICT_OP_EXTENDED )
1405                 restrictops &= ~SLAP_RESTRICT_EXOP_MASK;
1406         c->be->be_restrictops |= restrictops;
1407         return(0);
1408 }
1409
1410 static int
1411 config_allows(ConfigArgs *c) {
1412         slap_mask_t allows = 0;
1413         int i;
1414         slap_verbmasks allowable_ops[] = {
1415                 { BER_BVC("bind_v2"),           SLAP_ALLOW_BIND_V2 },
1416                 { BER_BVC("bind_anon_cred"),    SLAP_ALLOW_BIND_ANON_CRED },
1417                 { BER_BVC("bind_anon_dn"),      SLAP_ALLOW_BIND_ANON_DN },
1418                 { BER_BVC("update_anon"),       SLAP_ALLOW_UPDATE_ANON },
1419                 { BER_BVNULL,   0 }
1420         };
1421         if (c->op == SLAP_CONFIG_EMIT) {
1422                 return mask_to_verbs( allowable_ops, global_allows, &c->rvalue_vals );
1423         }
1424         i = verbs_to_mask(c->argc, c->argv, allowable_ops, &allows);
1425         if ( i ) {
1426                 Debug(LDAP_DEBUG_ANY, "%s: "
1427                         "unknown feature %s in \"allow <features>\" line\n",
1428                         c->log, c->argv[i], 0);
1429                 return(1);
1430         }
1431         global_allows |= allows;
1432         return(0);
1433 }
1434
1435 static int
1436 config_disallows(ConfigArgs *c) {
1437         slap_mask_t disallows = 0;
1438         int i;
1439         slap_verbmasks disallowable_ops[] = {
1440                 { BER_BVC("bind_anon"),         SLAP_DISALLOW_BIND_ANON },
1441                 { BER_BVC("bind_simple"),       SLAP_DISALLOW_BIND_SIMPLE },
1442                 { BER_BVC("bind_krb4"),         SLAP_DISALLOW_BIND_KRBV4 },
1443                 { BER_BVC("tls_2_anon"),                SLAP_DISALLOW_TLS_2_ANON },
1444                 { BER_BVC("tls_authc"),         SLAP_DISALLOW_TLS_AUTHC },
1445                 { BER_BVNULL, 0 }
1446         };
1447         if (c->op == SLAP_CONFIG_EMIT) {
1448                 return mask_to_verbs( disallowable_ops, global_disallows, &c->rvalue_vals );
1449         }
1450         i = verbs_to_mask(c->argc, c->argv, disallowable_ops, &disallows);
1451         if ( i ) {
1452                 Debug(LDAP_DEBUG_ANY, "%s: "
1453                         "unknown feature %s in \"disallow <features>\" line\n",
1454                         c->log, c->argv[i], 0);
1455                 return(1);
1456         }
1457         global_disallows |= disallows;
1458         return(0);
1459 }
1460
1461 static int
1462 config_requires(ConfigArgs *c) {
1463         slap_mask_t requires = 0;
1464         int i;
1465         slap_verbmasks requires_ops[] = {
1466                 { BER_BVC("bind"),              SLAP_REQUIRE_BIND },
1467                 { BER_BVC("LDAPv3"),            SLAP_REQUIRE_LDAP_V3 },
1468                 { BER_BVC("authc"),             SLAP_REQUIRE_AUTHC },
1469                 { BER_BVC("sasl"),              SLAP_REQUIRE_SASL },
1470                 { BER_BVC("strong"),            SLAP_REQUIRE_STRONG },
1471                 { BER_BVNULL, 0 }
1472         };
1473         if (c->op == SLAP_CONFIG_EMIT) {
1474                 return mask_to_verbs( requires_ops, c->be->be_requires, &c->rvalue_vals );
1475         }
1476         i = verbs_to_mask(c->argc, c->argv, requires_ops, &requires);
1477         if ( i ) {
1478                 Debug(LDAP_DEBUG_ANY, "%s: "
1479                         "unknown feature %s in \"require <features>\" line\n",
1480                         c->log, c->argv[i], 0);
1481                 return(1);
1482         }
1483         c->be->be_requires = requires;
1484         return(0);
1485 }
1486
1487 static int
1488 config_loglevel(ConfigArgs *c) {
1489         int i;
1490         char *next;
1491         slap_verbmasks loglevel_ops[] = {
1492                 { BER_BVC("Trace"),     LDAP_DEBUG_TRACE },
1493                 { BER_BVC("Packets"),   LDAP_DEBUG_PACKETS },
1494                 { BER_BVC("Args"),      LDAP_DEBUG_ARGS },
1495                 { BER_BVC("Conns"),     LDAP_DEBUG_CONNS },
1496                 { BER_BVC("BER"),       LDAP_DEBUG_BER },
1497                 { BER_BVC("Filter"),    LDAP_DEBUG_FILTER },
1498                 { BER_BVC("Config"),    LDAP_DEBUG_CONFIG },
1499                 { BER_BVC("ACL"),       LDAP_DEBUG_ACL },
1500                 { BER_BVC("Stats"),     LDAP_DEBUG_STATS },
1501                 { BER_BVC("Stats2"),    LDAP_DEBUG_STATS2 },
1502                 { BER_BVC("Shell"),     LDAP_DEBUG_SHELL },
1503                 { BER_BVC("Parse"),     LDAP_DEBUG_PARSE },
1504                 { BER_BVC("Cache"),     LDAP_DEBUG_CACHE },
1505                 { BER_BVC("Index"),     LDAP_DEBUG_INDEX },
1506                 { BER_BVC("Any"),       -1 },
1507                 { BER_BVNULL,   0 }
1508         };
1509
1510         if (c->op == SLAP_CONFIG_EMIT) {
1511                 return mask_to_verbs( loglevel_ops, ldap_syslog, &c->rvalue_vals );
1512         }
1513
1514         ldap_syslog = 0;
1515
1516         for( i=1; i < c->argc; i++ ) {
1517                 int     level;
1518
1519                 if ( isdigit( c->argv[i][0] ) ) {
1520                         level = strtol( c->argv[i], &next, 10 );
1521                         if ( next == NULL || next[0] != '\0' ) {
1522                                 Debug( LDAP_DEBUG_ANY,
1523                                         "%s: unable to parse level \"%s\" "
1524                                         "in \"loglevel <level> [...]\" line.\n",
1525                                         c->log, c->argv[i], 0);
1526                                 return( 1 );
1527                         }
1528                 } else {
1529                         int j = verb_to_mask(c->argv[i], loglevel_ops);
1530                         if(BER_BVISNULL(&loglevel_ops[j].word)) {
1531                                 Debug( LDAP_DEBUG_ANY,
1532                                         "%s: unknown level \"%s\" "
1533                                         "in \"loglevel <level> [...]\" line.\n",
1534                                         c->log, c->argv[i], 0);
1535                                 return( 1 );
1536                         }
1537                         level = loglevel_ops[j].mask;
1538                 }
1539                 ldap_syslog |= level;
1540         }
1541         return(0);
1542 }
1543
1544 static int
1545 config_syncrepl(ConfigArgs *c) {
1546         if (c->op == SLAP_CONFIG_EMIT) {
1547                 if ( c->be->be_syncinfo ) {
1548                         struct berval bv;
1549                         syncrepl_unparse( c->be->be_syncinfo, &bv );
1550                         ber_bvarray_add( &c->rvalue_vals, &bv );
1551                         return 0;
1552                 }
1553                 return 1;
1554         }
1555         if(SLAP_SHADOW(c->be)) {
1556                 Debug(LDAP_DEBUG_ANY, "%s: "
1557                         "syncrepl: database already shadowed.\n",
1558                         c->log, 0, 0);
1559                 return(1);
1560         } else if(add_syncrepl(c->be, c->argv, c->argc)) {
1561                 return(1);
1562         }
1563         SLAP_DBFLAGS(c->be) |= (SLAP_DBFLAG_SHADOW | SLAP_DBFLAG_SYNC_SHADOW);
1564         return(0);
1565 }
1566
1567 static int
1568 config_referral(ConfigArgs *c) {
1569         struct berval vals[2];
1570         if (c->op == SLAP_CONFIG_EMIT) {
1571                 if ( default_referral ) {
1572                         value_add( &c->rvalue_vals, default_referral );
1573                         return 0;
1574                 } else {
1575                         return 1;
1576                 }
1577         }
1578         if(validate_global_referral(c->argv[1])) {
1579                 Debug(LDAP_DEBUG_ANY, "%s: "
1580                         "invalid URL (%s) in \"referral\" line.\n",
1581                         c->log, c->argv[1], 0);
1582                 return(1);
1583         }
1584
1585         ber_str2bv(c->argv[1], 0, 0, &vals[0]);
1586         vals[1].bv_val = NULL; vals[1].bv_len = 0;
1587         if(value_add(&default_referral, vals)) return(LDAP_OTHER);
1588         return(0);
1589 }
1590
1591 static struct {
1592         struct berval key;
1593         int off;
1594 } sec_keys[] = {
1595         { BER_BVC("ssf="), offsetof(slap_ssf_set_t, sss_ssf) },
1596         { BER_BVC("transport="), offsetof(slap_ssf_set_t, sss_transport) },
1597         { BER_BVC("tls="), offsetof(slap_ssf_set_t, sss_tls) },
1598         { BER_BVC("sasl="), offsetof(slap_ssf_set_t, sss_sasl) },
1599         { BER_BVC("update_ssf="), offsetof(slap_ssf_set_t, sss_update_ssf) },
1600         { BER_BVC("update_transport="), offsetof(slap_ssf_set_t, sss_update_transport) },
1601         { BER_BVC("update_tls="), offsetof(slap_ssf_set_t, sss_update_tls) },
1602         { BER_BVC("update_sasl="), offsetof(slap_ssf_set_t, sss_update_sasl) },
1603         { BER_BVC("simple_bind="), offsetof(slap_ssf_set_t, sss_simple_bind) },
1604         { BER_BVNULL, 0 }
1605 };
1606
1607 static int
1608 config_security(ConfigArgs *c) {
1609         slap_ssf_set_t *set = &c->be->be_ssf_set;
1610         char *next;
1611         int i, j;
1612         if (c->op == SLAP_CONFIG_EMIT) {
1613                 char numbuf[32];
1614                 struct berval bv;
1615                 slap_ssf_t *tgt;
1616                 int rc = 1;
1617
1618                 for (i=0; !BER_BVISNULL( &sec_keys[i].key ); i++) {
1619                         tgt = (slap_ssf_t *)((char *)set + sec_keys[i].off);
1620                         if ( *tgt ) {
1621                                 rc = 0;
1622                                 bv.bv_len = sprintf( numbuf, "%u", *tgt );
1623                                 bv.bv_len += sec_keys[i].key.bv_len;
1624                                 bv.bv_val = ch_malloc( bv.bv_len + 1);
1625                                 next = lutil_strcopy( bv.bv_val, sec_keys[i].key.bv_val );
1626                                 strcpy( next, numbuf );
1627                                 ber_bvarray_add( &c->rvalue_vals, &bv );
1628                         }
1629                 }
1630                 return rc;
1631         }
1632         for(i = 1; i < c->argc; i++) {
1633                 slap_ssf_t *tgt = NULL;
1634                 char *src;
1635                 for ( j=0; !BER_BVISNULL( &sec_keys[j].key ); j++ ) {
1636                         if(!strncasecmp(c->argv[i], sec_keys[j].key.bv_val,
1637                                 sec_keys[j].key.bv_len)) {
1638                                 src = c->argv[i] + sec_keys[j].key.bv_len;
1639                                 tgt = (slap_ssf_t *)((char *)set + sec_keys[j].off);
1640                                 break;
1641                         }
1642                 }
1643                 if ( !tgt ) {
1644                         Debug(LDAP_DEBUG_ANY, "%s: "
1645                                 "unknown factor %s in \"security <factors>\" line\n",
1646                                 c->log, c->argv[i], 0);
1647                         return(1);
1648                 }
1649
1650                 *tgt = strtol(src, &next, 10);
1651                 if(next == NULL || next[0] != '\0' ) {
1652                         Debug(LDAP_DEBUG_ANY, "%s: "
1653                                 "unable to parse factor \"%s\" in \"security <factors>\" line\n",
1654                                 c->log, c->argv[i], 0);
1655                         return(1);
1656                 }
1657         }
1658         return(0);
1659 }
1660
1661 static char *
1662 anlist_unparse( AttributeName *an, char *ptr ) {
1663         int comma = 0;
1664
1665         for (; !BER_BVISNULL( &an->an_name ); an++) {
1666                 if ( comma ) *ptr++ = ',';
1667                 ptr = lutil_strcopy( ptr, an->an_name.bv_val );
1668                 comma = 1;
1669         }
1670         return ptr;
1671 }
1672
1673 static void
1674 replica_unparse( struct slap_replica_info *ri, int i, struct berval *bv )
1675 {
1676         int len;
1677         char *ptr;
1678         struct berval bc = {0};
1679         char numbuf[32];
1680
1681         len = sprintf(numbuf, "{%d}", i );
1682
1683         len += strlen( ri->ri_uri ) + STRLENOF("uri=");
1684         if ( ri->ri_nsuffix ) {
1685                 for (i=0; !BER_BVISNULL( &ri->ri_nsuffix[i] ); i++) {
1686                         len += ri->ri_nsuffix[i].bv_len + STRLENOF(" suffix=\"\"");
1687                 }
1688         }
1689         if ( ri->ri_attrs ) {
1690                 len += STRLENOF("attr");
1691                 if ( ri->ri_exclude ) len++;
1692                 for (i=0; !BER_BVISNULL( &ri->ri_attrs[i].an_name ); i++) {
1693                         len += 1 + ri->ri_attrs[i].an_name.bv_len;
1694                 }
1695         }
1696         bindconf_unparse( &ri->ri_bindconf, &bc );
1697         len += bc.bv_len;
1698
1699         bv->bv_val = ch_malloc(len + 1);
1700         bv->bv_len = len;
1701
1702         ptr = lutil_strcopy( bv->bv_val, numbuf );
1703         ptr = lutil_strcopy( ptr, "uri=" );
1704         ptr = lutil_strcopy( ptr, ri->ri_uri );
1705
1706         if ( ri->ri_nsuffix ) {
1707                 for (i=0; !BER_BVISNULL( &ri->ri_nsuffix[i] ); i++) {
1708                         ptr = lutil_strcopy( ptr, " suffix=\"" );
1709                         ptr = lutil_strcopy( ptr, ri->ri_nsuffix[i].bv_val );
1710                         *ptr++ = '"';
1711                 }
1712         }
1713         if ( ri->ri_attrs ) {
1714                 ptr = lutil_strcopy( ptr, "attr" );
1715                 if ( ri->ri_exclude ) *ptr++ = '!';
1716                 *ptr++ = '=';
1717                 ptr = anlist_unparse( ri->ri_attrs, ptr );
1718         }
1719         if ( bc.bv_val ) {
1720                 strcpy( ptr, bc.bv_val );
1721                 ch_free( bc.bv_val );
1722         }
1723 }
1724
1725 static int
1726 config_replica(ConfigArgs *c) {
1727         int i, nr = -1, len;
1728         char *replicahost, *replicauri;
1729         LDAPURLDesc *ludp;
1730
1731         if (c->op == SLAP_CONFIG_EMIT) {
1732                 if (c->be->be_replica) {
1733                         struct berval bv;
1734                         for (i=0;c->be->be_replica[i]; i++) {
1735                                 replica_unparse( c->be->be_replica[i], i, &bv );
1736                                 ber_bvarray_add( &c->rvalue_vals, &bv );
1737                         }
1738                         return 0;
1739                 }
1740                 return 1;
1741         }
1742         if(SLAP_MONITOR(c->be)) {
1743                 Debug(LDAP_DEBUG_ANY, "%s: "
1744                         "\"replica\" should not be used inside monitor database\n",
1745                         c->log, 0, 0);
1746                 return(0);      /* FIXME: should this be an error? */
1747         }
1748
1749         for(i = 1; i < c->argc; i++) {
1750                 if(!strncasecmp(c->argv[i], "host=", STRLENOF("host="))) {
1751                         replicahost = c->argv[i] + STRLENOF("host=");
1752                         len = strlen( replicahost );
1753                         replicauri = ch_malloc( len + STRLENOF("ldap://") + 1 );
1754                         sprintf( replicauri, "ldap://%s", replicahost );
1755                         replicahost = replicauri + STRLENOF( "ldap://");
1756                         nr = add_replica_info(c->be, replicauri, replicahost);
1757                         break;
1758                 } else if(!strncasecmp(c->argv[i], "uri=", STRLENOF("uri="))) {
1759                         if(ldap_url_parse(c->argv[i] + STRLENOF("uri="), &ludp) != LDAP_SUCCESS) {
1760                                 Debug(LDAP_DEBUG_ANY, "%s: "
1761                                         "replica line contains invalid "
1762                                         "uri definition.\n", c->log, 0, 0);
1763                                 return(1);
1764                         }
1765                         if(!ludp->lud_host) {
1766                                 Debug(LDAP_DEBUG_ANY, "%s: "
1767                                         "replica line contains invalid "
1768                                         "uri definition - missing hostname.\n",
1769                                         c->log, 0, 0);
1770                                 return(1);
1771                         }
1772                         ldap_free_urldesc(ludp);
1773                         replicauri = c->argv[i] + STRLENOF("uri=");
1774                         replicauri = ch_strdup( replicauri );
1775                         replicahost = strchr( replicauri, '/' );
1776                         replicahost += 2;
1777                         nr = add_replica_info(c->be, replicauri, replicahost);
1778                         break;
1779                 }
1780         }
1781         if(i == c->argc) {
1782                 Debug(LDAP_DEBUG_ANY, "%s: "
1783                         "missing host or uri in \"replica\" line\n",
1784                         c->log, 0, 0);
1785                 return(1);
1786         } else if(nr == -1) {
1787                 Debug(LDAP_DEBUG_ANY, "%s: "
1788                         "unable to add replica \"%s\"\n",
1789                         c->log, replicauri, 0);
1790                 return(1);
1791         } else {
1792                 for(i = 1; i < c->argc; i++) {
1793                         if(!strncasecmp(c->argv[i], "suffix=", STRLENOF( "suffix="))) {
1794                                 switch(add_replica_suffix(c->be, nr, c->argv[i] + STRLENOF("suffix="))) {
1795                                         case 1:
1796                                                 Debug(LDAP_DEBUG_ANY, "%s: "
1797                                                 "suffix \"%s\" in \"replica\" line is not valid for backend (ignored)\n",
1798                                                 c->log, c->argv[i] + STRLENOF("suffix="), 0);
1799                                                 break;
1800                                         case 2:
1801                                                 Debug(LDAP_DEBUG_ANY, "%s: "
1802                                                 "unable to normalize suffix in \"replica\" line (ignored)\n",
1803                                                 c->log, 0, 0);
1804                                                 break;
1805                                 }
1806
1807                         } else if(!strncasecmp(c->argv[i], "attr", STRLENOF("attr"))) {
1808                                 int exclude = 0;
1809                                 char *arg = c->argv[i] + STRLENOF("attr");
1810                                 if(arg[0] == '!') {
1811                                         arg++;
1812                                         exclude = 1;
1813                                 }
1814                                 if(arg[0] != '=') {
1815                                         continue;
1816                                 }
1817                                 if(add_replica_attrs(c->be, nr, arg + 1, exclude)) {
1818                                         Debug(LDAP_DEBUG_ANY, "%s: "
1819                                                 "attribute \"%s\" in \"replica\" line is unknown\n",
1820                                                 c->log, arg + 1, 0);
1821                                         return(1);
1822                                 }
1823                         } else if ( bindconf_parse( c->argv[i],
1824                                         &c->be->be_replica[nr]->ri_bindconf ) ) {
1825                                 return(1);
1826                         }
1827                 }
1828         }
1829         return(0);
1830 }
1831
1832 static int
1833 config_updatedn(ConfigArgs *c) {
1834         struct berval dn;
1835         int rc;
1836         if (c->op == SLAP_CONFIG_EMIT) {
1837                 if (!BER_BVISEMPTY(&c->be->be_update_ndn)) {
1838                         value_add_one(&c->rvalue_vals, &c->be->be_update_ndn);
1839                         value_add_one(&c->rvalue_nvals, &c->be->be_update_ndn);
1840                         return 0;
1841                 }
1842                 return 1;
1843         }
1844         if(SLAP_SHADOW(c->be)) {
1845                 Debug(LDAP_DEBUG_ANY, "%s: "
1846                         "updatedn: database already shadowed.\n",
1847                         c->log, 0, 0);
1848                 return(1);
1849         }
1850
1851         ber_str2bv(c->argv[1], 0, 0, &dn);
1852
1853         rc = dnNormalize(0, NULL, NULL, &dn, &c->be->be_update_ndn, NULL);
1854
1855         if(rc != LDAP_SUCCESS) {
1856                 Debug(LDAP_DEBUG_ANY, "%s: "
1857                         "updatedn DN is invalid: %d (%s)\n",
1858                         c->log, rc, ldap_err2string( rc ));
1859                 return(1);
1860         }
1861
1862         SLAP_DBFLAGS(c->be) |= (SLAP_DBFLAG_SHADOW | SLAP_DBFLAG_SLURP_SHADOW);
1863         return(0);
1864 }
1865
1866 static int
1867 config_updateref(ConfigArgs *c) {
1868         struct berval vals[2];
1869         if (c->op == SLAP_CONFIG_EMIT) {
1870                 if ( c->be->be_update_refs ) {
1871                         value_add( &c->rvalue_vals, c->be->be_update_refs );
1872                         return 0;
1873                 } else {
1874                         return 1;
1875                 }
1876         }
1877         if(!SLAP_SHADOW(c->be)) {
1878                 Debug(LDAP_DEBUG_ANY, "%s: "
1879                         "updateref line must come after syncrepl or updatedn.\n",
1880                         c->log, 0, 0);
1881                 return(1);
1882         }
1883
1884         if(validate_global_referral(c->argv[1])) {
1885                 Debug(LDAP_DEBUG_ANY, "%s: "
1886                         "invalid URL (%s) in \"updateref\" line.\n",
1887                         c->log, c->argv[1], 0);
1888                 return(1);
1889         }
1890         ber_str2bv(c->argv[1], 0, 0, &vals[0]);
1891         vals[1].bv_val = NULL;
1892         if(value_add(&c->be->be_update_refs, vals)) return(LDAP_OTHER);
1893         return(0);
1894 }
1895
1896 static int
1897 config_include(ConfigArgs *c) {
1898         unsigned long savelineno = c->lineno;
1899         int rc;
1900         ConfigFile *cf;
1901         ConfigFile *cfsave = cfn;
1902         ConfigFile *cf2 = NULL;
1903         if (c->op == SLAP_CONFIG_EMIT) {
1904                 return 1;
1905         }
1906         cf = ch_calloc( 1, sizeof(ConfigFile));
1907 #ifdef SLAPD_MODULES
1908         cf->c_modlast = &cf->c_modpaths;
1909 #endif
1910         if ( cfn->c_kids ) {
1911                 for (cf2=cfn->c_kids; cf2 && cf2->c_sibs; cf2=cf2->c_sibs) ;
1912                 cf2->c_sibs = cf;
1913         } else {
1914                 cfn->c_kids = cf;
1915         }
1916         cfn = cf;
1917         ber_str2bv( c->argv[1], 0, 1, &cf->c_file );
1918         rc = read_config_file(c->argv[1], c->depth + 1, c);
1919         c->lineno = savelineno - 1;
1920         cfn = cfsave;
1921         if ( rc ) {
1922                 if ( cf2 ) cf2->c_sibs = NULL;
1923                 else cfn->c_kids = NULL;
1924                 ch_free( cf->c_file.bv_val );
1925                 ch_free( cf );
1926         }
1927         return(rc);
1928 }
1929
1930 #ifdef HAVE_TLS
1931 static int
1932 config_tls_option(ConfigArgs *c) {
1933         int flag;
1934         switch(c->type) {
1935         case CFG_TLS_RAND:              flag = LDAP_OPT_X_TLS_RANDOM_FILE;      break;
1936         case CFG_TLS_CIPHER:    flag = LDAP_OPT_X_TLS_CIPHER_SUITE;     break;
1937         case CFG_TLS_CERT_FILE: flag = LDAP_OPT_X_TLS_CERTFILE;         break;
1938         case CFG_TLS_CERT_KEY:  flag = LDAP_OPT_X_TLS_KEYFILE;          break;
1939         case CFG_TLS_CA_PATH:   flag = LDAP_OPT_X_TLS_CACERTDIR;        break;
1940         case CFG_TLS_CA_FILE:   flag = LDAP_OPT_X_TLS_CACERTFILE;       break;
1941         default:                Debug(LDAP_DEBUG_ANY, "%s: "
1942                                         "unknown tls_option <%x>\n",
1943                                         c->log, c->type, 0);
1944         }
1945         if (c->op == SLAP_CONFIG_EMIT) {
1946                 return ldap_pvt_tls_get_option( NULL, flag, &c->value_string );
1947         }
1948         ch_free(c->value_string);
1949         return(ldap_pvt_tls_set_option(NULL, flag, c->argv[1]));
1950 }
1951
1952 /* FIXME: this ought to be provided by libldap */
1953 static int
1954 config_tls_config(ConfigArgs *c) {
1955         int i, flag;
1956         slap_verbmasks crlkeys[] = {
1957                 { BER_BVC("none"),      LDAP_OPT_X_TLS_CRL_NONE },
1958                 { BER_BVC("peer"),      LDAP_OPT_X_TLS_CRL_PEER },
1959                 { BER_BVC("all"),       LDAP_OPT_X_TLS_CRL_ALL },
1960                 { BER_BVNULL, 0 }
1961         };
1962         slap_verbmasks vfykeys[] = {
1963                 { BER_BVC("never"),     LDAP_OPT_X_TLS_NEVER },
1964                 { BER_BVC("demand"),    LDAP_OPT_X_TLS_DEMAND },
1965                 { BER_BVC("try"),       LDAP_OPT_X_TLS_TRY },
1966                 { BER_BVC("hard"),      LDAP_OPT_X_TLS_HARD },
1967                 { BER_BVNULL, 0 }
1968         }, *keys;
1969         switch(c->type) {
1970 #ifdef HAVE_OPENSSL_CRL
1971         case CFG_TLS_CRLCHECK:  flag = LDAP_OPT_X_TLS_CRLCHECK; keys = crlkeys;
1972                 break;
1973 #endif
1974         case CFG_TLS_VERIFY:    flag = LDAP_OPT_X_TLS_REQUIRE_CERT; keys = vfykeys;
1975                 break;
1976         default:                Debug(LDAP_DEBUG_ANY, "%s: "
1977                                         "unknown tls_option <%x>\n",
1978                                         c->log, c->type, 0);
1979         }
1980         if (c->op == SLAP_CONFIG_EMIT) {
1981                 ldap_pvt_tls_get_option( NULL, flag, &c->value_int );
1982                 for (i=0; !BER_BVISNULL(&keys[i].word); i++) {
1983                         if (keys[i].mask == c->value_int) {
1984                                 c->value_string = ch_strdup( keys[i].word.bv_val );
1985                                 return 0;
1986                         }
1987                 }
1988                 return 1;
1989         }
1990         ch_free( c->value_string );
1991         if(isdigit((unsigned char)c->argv[1][0])) {
1992                 i = atoi(c->argv[1]);
1993                 return(ldap_pvt_tls_set_option(NULL, flag, &i));
1994         } else {
1995                 return(ldap_int_tls_config(NULL, flag, c->argv[1]));
1996         }
1997 }
1998 #endif
1999
2000 static int
2001 add_syncrepl(
2002         Backend *be,
2003         char    **cargv,
2004         int     cargc
2005 )
2006 {
2007         syncinfo_t *si;
2008         int     rc = 0;
2009
2010         si = (syncinfo_t *) ch_calloc( 1, sizeof( syncinfo_t ) );
2011
2012         if ( si == NULL ) {
2013                 Debug( LDAP_DEBUG_ANY, "out of memory in add_syncrepl\n", 0, 0, 0 );
2014                 return 1;
2015         }
2016
2017         si->si_bindconf.sb_tls = SB_TLS_OFF;
2018         si->si_bindconf.sb_method = LDAP_AUTH_SIMPLE;
2019         si->si_schemachecking = 0;
2020         ber_str2bv( "(objectclass=*)", STRLENOF("(objectclass=*)"), 1,
2021                 &si->si_filterstr );
2022         si->si_base.bv_val = NULL;
2023         si->si_scope = LDAP_SCOPE_SUBTREE;
2024         si->si_attrsonly = 0;
2025         si->si_anlist = (AttributeName *) ch_calloc( 1, sizeof( AttributeName ));
2026         si->si_exanlist = (AttributeName *) ch_calloc( 1, sizeof( AttributeName ));
2027         si->si_attrs = NULL;
2028         si->si_allattrs = 0;
2029         si->si_allopattrs = 0;
2030         si->si_exattrs = NULL;
2031         si->si_type = LDAP_SYNC_REFRESH_ONLY;
2032         si->si_interval = 86400;
2033         si->si_retryinterval = NULL;
2034         si->si_retrynum_init = NULL;
2035         si->si_retrynum = NULL;
2036         si->si_manageDSAit = 0;
2037         si->si_tlimit = 0;
2038         si->si_slimit = 0;
2039
2040         si->si_presentlist = NULL;
2041         LDAP_LIST_INIT( &si->si_nonpresentlist );
2042         ldap_pvt_thread_mutex_init( &si->si_mutex );
2043
2044         rc = parse_syncrepl_line( cargv, cargc, si );
2045
2046         if ( rc < 0 ) {
2047                 Debug( LDAP_DEBUG_ANY, "failed to add syncinfo\n", 0, 0, 0 );
2048                 syncinfo_free( si );
2049                 return 1;
2050         } else {
2051                 Debug( LDAP_DEBUG_CONFIG,
2052                         "Config: ** successfully added syncrepl \"%s\"\n",
2053                         BER_BVISNULL( &si->si_provideruri ) ?
2054                         "(null)" : si->si_provideruri.bv_val, 0, 0 );
2055                 if ( !si->si_schemachecking ) {
2056                         SLAP_DBFLAGS(be) |= SLAP_DBFLAG_NO_SCHEMA_CHECK;
2057                 }
2058                 si->si_be = be;
2059                 be->be_syncinfo = si;
2060                 return 0;
2061         }
2062 }
2063
2064 /* NOTE: used & documented in slapd.conf(5) */
2065 #define IDSTR                   "rid"
2066 #define PROVIDERSTR             "provider"
2067 #define TYPESTR                 "type"
2068 #define INTERVALSTR             "interval"
2069 #define SEARCHBASESTR           "searchbase"
2070 #define FILTERSTR               "filter"
2071 #define SCOPESTR                "scope"
2072 #define ATTRSSTR                "attrs"
2073 #define ATTRSONLYSTR            "attrsonly"
2074 #define SLIMITSTR               "sizelimit"
2075 #define TLIMITSTR               "timelimit"
2076 #define SCHEMASTR               "schemachecking"
2077
2078 /* FIXME: undocumented */
2079 #define OLDAUTHCSTR             "bindprincipal"
2080 #define EXATTRSSTR              "exattrs"
2081 #define RETRYSTR                "retry"
2082
2083 /* FIXME: unused */
2084 #define LASTMODSTR              "lastmod"
2085 #define LMGENSTR                "gen"
2086 #define LMNOSTR                 "no"
2087 #define LMREQSTR                "req"
2088 #define SRVTABSTR               "srvtab"
2089 #define SUFFIXSTR               "suffix"
2090 #define MANAGEDSAITSTR          "manageDSAit"
2091
2092 /* mandatory */
2093 #define GOT_ID                  0x0001
2094 #define GOT_PROVIDER            0x0002
2095
2096 /* check */
2097 #define GOT_ALL                 (GOT_ID|GOT_PROVIDER)
2098
2099 static struct {
2100         struct berval key;
2101         int val;
2102 } scopes[] = {
2103         { BER_BVC("base"), LDAP_SCOPE_BASE },
2104         { BER_BVC("one"), LDAP_SCOPE_ONELEVEL },
2105 #ifdef LDAP_SCOPE_SUBORDINATE
2106         { BER_BVC("children"), LDAP_SCOPE_SUBORDINATE },
2107         { BER_BVC("subordinate"), 0 },
2108 #endif
2109         { BER_BVC("sub"), LDAP_SCOPE_SUBTREE },
2110         { BER_BVNULL, 0 }
2111 };
2112
2113 static int
2114 parse_syncrepl_line(
2115         char            **cargv,
2116         int             cargc,
2117         syncinfo_t      *si
2118 )
2119 {
2120         int     gots = 0;
2121         int     i;
2122         char    *val;
2123
2124         for ( i = 1; i < cargc; i++ ) {
2125                 if ( !strncasecmp( cargv[ i ], IDSTR "=",
2126                                         STRLENOF( IDSTR "=" ) ) )
2127                 {
2128                         int tmp;
2129                         /* '\0' string terminator accounts for '=' */
2130                         val = cargv[ i ] + STRLENOF( IDSTR "=" );
2131                         tmp= atoi( val );
2132                         if ( tmp >= 1000 || tmp < 0 ) {
2133                                 fprintf( stderr, "Error: parse_syncrepl_line: "
2134                                          "syncrepl id %d is out of range [0..999]\n", tmp );
2135                                 return -1;
2136                         }
2137                         si->si_rid = tmp;
2138                         gots |= GOT_ID;
2139                 } else if ( !strncasecmp( cargv[ i ], PROVIDERSTR "=",
2140                                         STRLENOF( PROVIDERSTR "=" ) ) )
2141                 {
2142                         val = cargv[ i ] + STRLENOF( PROVIDERSTR "=" );
2143                         ber_str2bv( val, 0, 1, &si->si_provideruri );
2144                         gots |= GOT_PROVIDER;
2145                 } else if ( !strncasecmp( cargv[ i ], SCHEMASTR "=",
2146                                         STRLENOF( SCHEMASTR "=" ) ) )
2147                 {
2148                         val = cargv[ i ] + STRLENOF( SCHEMASTR "=" );
2149                         if ( !strncasecmp( val, "on", STRLENOF( "on" ) )) {
2150                                 si->si_schemachecking = 1;
2151                         } else if ( !strncasecmp( val, "off", STRLENOF( "off" ) ) ) {
2152                                 si->si_schemachecking = 0;
2153                         } else {
2154                                 si->si_schemachecking = 1;
2155                         }
2156                 } else if ( !strncasecmp( cargv[ i ], FILTERSTR "=",
2157                                         STRLENOF( FILTERSTR "=" ) ) )
2158                 {
2159                         val = cargv[ i ] + STRLENOF( FILTERSTR "=" );
2160                         ber_str2bv( val, 0, 1, &si->si_filterstr );
2161                 } else if ( !strncasecmp( cargv[ i ], SEARCHBASESTR "=",
2162                                         STRLENOF( SEARCHBASESTR "=" ) ) )
2163                 {
2164                         struct berval   bv;
2165                         int             rc;
2166
2167                         val = cargv[ i ] + STRLENOF( SEARCHBASESTR "=" );
2168                         if ( si->si_base.bv_val ) {
2169                                 ch_free( si->si_base.bv_val );
2170                         }
2171                         ber_str2bv( val, 0, 0, &bv );
2172                         rc = dnNormalize( 0, NULL, NULL, &bv, &si->si_base, NULL );
2173                         if ( rc != LDAP_SUCCESS ) {
2174                                 fprintf( stderr, "Invalid base DN \"%s\": %d (%s)\n",
2175                                         val, rc, ldap_err2string( rc ) );
2176                                 return -1;
2177                         }
2178                 } else if ( !strncasecmp( cargv[ i ], SCOPESTR "=",
2179                                         STRLENOF( SCOPESTR "=" ) ) )
2180                 {
2181                         int j;
2182                         val = cargv[ i ] + STRLENOF( SCOPESTR "=" );
2183                         for ( j=0; !BER_BVISNULL(&scopes[j].key); j++ ) {
2184                                 if (!strncasecmp( val, scopes[j].key.bv_val,
2185                                         scopes[j].key.bv_len )) {
2186                                         while (!scopes[j].val) j--;
2187                                         si->si_scope = scopes[j].val;
2188                                         break;
2189                                 }
2190                         }
2191                         if ( BER_BVISNULL(&scopes[j].key) ) {
2192                                 fprintf( stderr, "Error: parse_syncrepl_line: "
2193                                         "unknown scope \"%s\"\n", val);
2194                                 return -1;
2195                         }
2196                 } else if ( !strncasecmp( cargv[ i ], ATTRSONLYSTR "=",
2197                                         STRLENOF( ATTRSONLYSTR "=" ) ) )
2198                 {
2199                         si->si_attrsonly = 1;
2200                 } else if ( !strncasecmp( cargv[ i ], ATTRSSTR "=",
2201                                         STRLENOF( ATTRSSTR "=" ) ) )
2202                 {
2203                         val = cargv[ i ] + STRLENOF( ATTRSSTR "=" );
2204                         if ( !strncasecmp( val, ":include:", STRLENOF(":include:") ) ) {
2205                                 char *attr_fname;
2206                                 attr_fname = ch_strdup( val + STRLENOF(":include:") );
2207                                 si->si_anlist = file2anlist( si->si_anlist, attr_fname, " ,\t" );
2208                                 if ( si->si_anlist == NULL ) {
2209                                         ch_free( attr_fname );
2210                                         return -1;
2211                                 }
2212                                 si->si_anfile = attr_fname;
2213                         } else {
2214                                 char *str, *s, *next;
2215                                 char delimstr[] = " ,\t";
2216                                 str = ch_strdup( val );
2217                                 for ( s = ldap_pvt_strtok( str, delimstr, &next );
2218                                                 s != NULL;
2219                                                 s = ldap_pvt_strtok( NULL, delimstr, &next ) )
2220                                 {
2221                                         if ( strlen(s) == 1 && *s == '*' ) {
2222                                                 si->si_allattrs = 1;
2223                                                 *(val + ( s - str )) = delimstr[0];
2224                                         }
2225                                         if ( strlen(s) == 1 && *s == '+' ) {
2226                                                 si->si_allopattrs = 1;
2227                                                 *(val + ( s - str )) = delimstr[0];
2228                                         }
2229                                 }
2230                                 ch_free( str );
2231                                 si->si_anlist = str2anlist( si->si_anlist, val, " ,\t" );
2232                                 if ( si->si_anlist == NULL ) {
2233                                         return -1;
2234                                 }
2235                         }
2236                 } else if ( !strncasecmp( cargv[ i ], EXATTRSSTR "=",
2237                                         STRLENOF( EXATTRSSTR "=" ) ) )
2238                 {
2239                         val = cargv[ i ] + STRLENOF( EXATTRSSTR "=" );
2240                         if ( !strncasecmp( val, ":include:", STRLENOF(":include:") )) {
2241                                 char *attr_fname;
2242                                 attr_fname = ch_strdup( val + STRLENOF(":include:") );
2243                                 si->si_exanlist = file2anlist(
2244                                                                         si->si_exanlist, attr_fname, " ,\t" );
2245                                 if ( si->si_exanlist == NULL ) {
2246                                         ch_free( attr_fname );
2247                                         return -1;
2248                                 }
2249                                 ch_free( attr_fname );
2250                         } else {
2251                                 si->si_exanlist = str2anlist( si->si_exanlist, val, " ,\t" );
2252                                 if ( si->si_exanlist == NULL ) {
2253                                         return -1;
2254                                 }
2255                         }
2256                 } else if ( !strncasecmp( cargv[ i ], TYPESTR "=",
2257                                         STRLENOF( TYPESTR "=" ) ) )
2258                 {
2259                         val = cargv[ i ] + STRLENOF( TYPESTR "=" );
2260                         if ( !strncasecmp( val, "refreshOnly",
2261                                                 STRLENOF("refreshOnly") ))
2262                         {
2263                                 si->si_type = LDAP_SYNC_REFRESH_ONLY;
2264                         } else if ( !strncasecmp( val, "refreshAndPersist",
2265                                                 STRLENOF("refreshAndPersist") ))
2266                         {
2267                                 si->si_type = LDAP_SYNC_REFRESH_AND_PERSIST;
2268                                 si->si_interval = 60;
2269                         } else {
2270                                 fprintf( stderr, "Error: parse_syncrepl_line: "
2271                                         "unknown sync type \"%s\"\n", val);
2272                                 return -1;
2273                         }
2274                 } else if ( !strncasecmp( cargv[ i ], INTERVALSTR "=",
2275                                         STRLENOF( INTERVALSTR "=" ) ) )
2276                 {
2277                         val = cargv[ i ] + STRLENOF( INTERVALSTR "=" );
2278                         if ( si->si_type == LDAP_SYNC_REFRESH_AND_PERSIST ) {
2279                                 si->si_interval = 0;
2280                         } else {
2281                                 char *hstr;
2282                                 char *mstr;
2283                                 char *dstr;
2284                                 char *sstr;
2285                                 int dd, hh, mm, ss;
2286                                 dstr = val;
2287                                 hstr = strchr( dstr, ':' );
2288                                 if ( hstr == NULL ) {
2289                                         fprintf( stderr, "Error: parse_syncrepl_line: "
2290                                                 "invalid interval \"%s\"\n", val );
2291                                         return -1;
2292                                 }
2293                                 *hstr++ = '\0';
2294                                 mstr = strchr( hstr, ':' );
2295                                 if ( mstr == NULL ) {
2296                                         fprintf( stderr, "Error: parse_syncrepl_line: "
2297                                                 "invalid interval \"%s\"\n", val );
2298                                         return -1;
2299                                 }
2300                                 *mstr++ = '\0';
2301                                 sstr = strchr( mstr, ':' );
2302                                 if ( sstr == NULL ) {
2303                                         fprintf( stderr, "Error: parse_syncrepl_line: "
2304                                                 "invalid interval \"%s\"\n", val );
2305                                         return -1;
2306                                 }
2307                                 *sstr++ = '\0';
2308
2309                                 dd = atoi( dstr );
2310                                 hh = atoi( hstr );
2311                                 mm = atoi( mstr );
2312                                 ss = atoi( sstr );
2313                                 if (( hh > 24 ) || ( hh < 0 ) ||
2314                                         ( mm > 60 ) || ( mm < 0 ) ||
2315                                         ( ss > 60 ) || ( ss < 0 ) || ( dd < 0 )) {
2316                                         fprintf( stderr, "Error: parse_syncrepl_line: "
2317                                                 "invalid interval \"%s\"\n", val );
2318                                         return -1;
2319                                 }
2320                                 si->si_interval = (( dd * 24 + hh ) * 60 + mm ) * 60 + ss;
2321                         }
2322                         if ( si->si_interval < 0 ) {
2323                                 fprintf( stderr, "Error: parse_syncrepl_line: "
2324                                         "invalid interval \"%ld\"\n",
2325                                         (long) si->si_interval);
2326                                 return -1;
2327                         }
2328                 } else if ( !strncasecmp( cargv[ i ], RETRYSTR "=",
2329                                         STRLENOF( RETRYSTR "=" ) ) )
2330                 {
2331                         char **retry_list;
2332                         int j, k, n;
2333
2334                         val = cargv[ i ] + STRLENOF( RETRYSTR "=" );
2335                         retry_list = (char **) ch_calloc( 1, sizeof( char * ));
2336                         retry_list[0] = NULL;
2337
2338                         slap_str2clist( &retry_list, val, " ,\t" );
2339
2340                         for ( k = 0; retry_list && retry_list[k]; k++ ) ;
2341                         n = k / 2;
2342                         if ( k % 2 ) {
2343                                 fprintf( stderr,
2344                                                 "Error: incomplete syncrepl retry list\n" );
2345                                 for ( k = 0; retry_list && retry_list[k]; k++ ) {
2346                                         ch_free( retry_list[k] );
2347                                 }
2348                                 ch_free( retry_list );
2349                                 exit( EXIT_FAILURE );
2350                         }
2351                         si->si_retryinterval = (time_t *) ch_calloc( n + 1, sizeof( time_t ));
2352                         si->si_retrynum = (int *) ch_calloc( n + 1, sizeof( int ));
2353                         si->si_retrynum_init = (int *) ch_calloc( n + 1, sizeof( int ));
2354                         for ( j = 0; j < n; j++ ) {
2355                                 si->si_retryinterval[j] = atoi( retry_list[j*2] );
2356                                 if ( *retry_list[j*2+1] == '+' ) {
2357                                         si->si_retrynum_init[j] = -1;
2358                                         si->si_retrynum[j] = -1;
2359                                         j++;
2360                                         break;
2361                                 } else {
2362                                         si->si_retrynum_init[j] = atoi( retry_list[j*2+1] );
2363                                         si->si_retrynum[j] = atoi( retry_list[j*2+1] );
2364                                 }
2365                         }
2366                         si->si_retrynum_init[j] = -2;
2367                         si->si_retrynum[j] = -2;
2368                         si->si_retryinterval[j] = 0;
2369
2370                         for ( k = 0; retry_list && retry_list[k]; k++ ) {
2371                                 ch_free( retry_list[k] );
2372                         }
2373                         ch_free( retry_list );
2374                 } else if ( !strncasecmp( cargv[ i ], MANAGEDSAITSTR "=",
2375                                         STRLENOF( MANAGEDSAITSTR "=" ) ) )
2376                 {
2377                         val = cargv[ i ] + STRLENOF( MANAGEDSAITSTR "=" );
2378                         si->si_manageDSAit = atoi( val );
2379                 } else if ( !strncasecmp( cargv[ i ], SLIMITSTR "=",
2380                                         STRLENOF( SLIMITSTR "=") ) )
2381                 {
2382                         val = cargv[ i ] + STRLENOF( SLIMITSTR "=" );
2383                         si->si_slimit = atoi( val );
2384                 } else if ( !strncasecmp( cargv[ i ], TLIMITSTR "=",
2385                                         STRLENOF( TLIMITSTR "=" ) ) )
2386                 {
2387                         val = cargv[ i ] + STRLENOF( TLIMITSTR "=" );
2388                         si->si_tlimit = atoi( val );
2389                 } else if ( bindconf_parse( cargv[i], &si->si_bindconf )) {
2390                         fprintf( stderr, "Error: parse_syncrepl_line: "
2391                                 "unknown keyword \"%s\"\n", cargv[ i ] );
2392                         return -1;
2393                 }
2394         }
2395
2396         if ( gots != GOT_ALL ) {
2397                 fprintf( stderr,
2398                         "Error: Malformed \"syncrepl\" line in slapd config file" );
2399                 return -1;
2400         }
2401
2402         return 0;
2403 }
2404
2405 static void
2406 syncrepl_unparse( syncinfo_t *si, struct berval *bv )
2407 {
2408         struct berval bc;
2409         char buf[BUFSIZ*2], *ptr;
2410         int i, len;
2411
2412         bindconf_unparse( &si->si_bindconf, &bc );
2413         ptr = buf;
2414         ptr += sprintf( ptr, IDSTR "=%03d " PROVIDERSTR "=%s",
2415                 si->si_rid, si->si_provideruri.bv_val );
2416         if ( !BER_BVISNULL( &bc )) {
2417                 ptr = lutil_strcopy( ptr, bc.bv_val );
2418                 free( bc.bv_val );
2419         }
2420         if ( !BER_BVISEMPTY( &si->si_filterstr )) {
2421                 ptr = lutil_strcopy( ptr, " " FILTERSTR "=\"" );
2422                 ptr = lutil_strcopy( ptr, si->si_filterstr.bv_val );
2423                 *ptr++ = '"';
2424         }
2425         if ( !BER_BVISNULL( &si->si_base )) {
2426                 ptr = lutil_strcopy( ptr, " " SEARCHBASESTR "=\"" );
2427                 ptr = lutil_strcopy( ptr, si->si_base.bv_val );
2428                 *ptr++ = '"';
2429         }
2430         for (i=0; !BER_BVISNULL(&scopes[i].key);i++) {
2431                 if ( si->si_scope == scopes[i].val ) {
2432                         ptr = lutil_strcopy( ptr, " " SCOPESTR "=" );
2433                         ptr = lutil_strcopy( ptr, scopes[i].key.bv_val );
2434                         break;
2435                 }
2436         }
2437         if ( si->si_attrsonly ) {
2438                 ptr = lutil_strcopy( ptr, " " ATTRSONLYSTR "=yes" );
2439         }
2440         if ( si->si_anfile ) {
2441                 ptr = lutil_strcopy( ptr, " " ATTRSSTR "=:include:" );
2442                 ptr = lutil_strcopy( ptr, si->si_anfile );
2443         } else if ( si->si_allattrs || si->si_allopattrs ||
2444                 ( si->si_anlist && !BER_BVISNULL(&si->si_anlist[0].an_name) )) {
2445                 char *old;
2446                 ptr = lutil_strcopy( ptr, " " ATTRSSTR "=\"" );
2447                 old = ptr;
2448                 ptr = anlist_unparse( si->si_anlist, ptr );
2449                 if ( si->si_allattrs ) {
2450                         if ( old != ptr ) *ptr++ = ',';
2451                         *ptr++ = '*';
2452                 }
2453                 if ( si->si_allopattrs ) {
2454                         if ( old != ptr ) *ptr++ = ',';
2455                         *ptr++ = '+';
2456                 }
2457                 *ptr++ = '"';
2458         }
2459         if ( si->si_exanlist && !BER_BVISNULL(&si->si_exanlist[0].an_name) ) {
2460                 ptr = lutil_strcopy( ptr, " " EXATTRSSTR "=" );
2461                 ptr = anlist_unparse( si->si_exanlist, ptr );
2462         }
2463         ptr = lutil_strcopy( ptr, " " SCHEMASTR "=" );
2464         ptr = lutil_strcopy( ptr, si->si_schemachecking ? "on" : "off" );
2465
2466         ptr = lutil_strcopy( ptr, " " TYPESTR "=" );
2467         ptr = lutil_strcopy( ptr, si->si_type == LDAP_SYNC_REFRESH_AND_PERSIST ?
2468                 "refreshAndPersist" : "refreshOnly" );
2469
2470         if ( si->si_type == LDAP_SYNC_REFRESH_ONLY ) {
2471                 int dd, hh, mm, ss;
2472
2473                 dd = si->si_interval;
2474                 ss = dd % 60;
2475                 dd /= 60;
2476                 mm = dd % 60;
2477                 dd /= 60;
2478                 hh = dd % 24;
2479                 dd /= 24;
2480                 ptr = lutil_strcopy( ptr, " " INTERVALSTR "=" );
2481                 ptr += sprintf( ptr, "%02d:%02d:%02d:%02d", dd, hh, mm, ss );
2482         } else if ( si->si_retryinterval ) {
2483                 int space=0;
2484                 ptr = lutil_strcopy( ptr, " " RETRYSTR "=\"" );
2485                 for (i=0; si->si_retryinterval[i]; i++) {
2486                         if ( space ) *ptr++ = ' ';
2487                         space = 1;
2488                         ptr += sprintf( ptr, "%d", si->si_retryinterval[i] );
2489                         if ( si->si_retrynum_init[i] == -1 )
2490                                 *ptr++ = '+';
2491                         else
2492                                 ptr += sprintf( ptr, "%d", si->si_retrynum_init );
2493                 }
2494                 *ptr++ = '"';
2495         }
2496
2497 #if 0 /* FIXME: unused in syncrepl.c, should remove it */
2498         ptr = lutil_strcopy( ptr, " " MANAGEDSAITSTR "=" );
2499         ptr += sprintf( ptr, "%d", si->si_manageDSAit );
2500 #endif
2501
2502         if ( si->si_slimit ) {
2503                 ptr = lutil_strcopy( ptr, " " SLIMITSTR "=" );
2504                 ptr += sprintf( ptr, "%d", si->si_slimit );
2505         }
2506
2507         if ( si->si_tlimit ) {
2508                 ptr = lutil_strcopy( ptr, " " TLIMITSTR "=" );
2509                 ptr += sprintf( ptr, "%d", si->si_tlimit );
2510         }
2511         bc.bv_len = ptr - buf;
2512         bc.bv_val = buf;
2513         ber_dupbv( bv, &bc );
2514 }
2515
2516 static CfEntryInfo *
2517 config_find_base( CfEntryInfo *root, struct berval *dn, CfEntryInfo **last )
2518 {
2519         struct berval cdn;
2520         char *c;
2521
2522         if ( !root ) {
2523                 *last = NULL;
2524                 return NULL;
2525         }
2526
2527         if ( dn_match( &root->ce_entry->e_nname, dn ))
2528                 return root;
2529
2530         c = dn->bv_val+dn->bv_len;
2531         for (;*c != ',';c--);
2532
2533         while(root) {
2534                 *last = root;
2535                 for (--c;c>dn->bv_val && *c != ',';c--);
2536                 if ( *c == ',' )
2537                         c++;
2538                 cdn.bv_val = c;
2539                 cdn.bv_len = dn->bv_len - (c-dn->bv_val);
2540
2541                 root = root->ce_kids;
2542
2543                 for (;root;root=root->ce_sibs) {
2544                         if ( dn_match( &root->ce_entry->e_nname, &cdn )) {
2545                                 if ( cdn.bv_val == dn->bv_val ) {
2546                                         return root;
2547                                 }
2548                                 break;
2549                         }
2550                 }
2551         }
2552         return root;
2553 }
2554
2555 static int
2556 config_ldif_resp( Operation *op, SlapReply *rs )
2557 {
2558         if ( rs->sr_type == REP_SEARCH ) {
2559                 CfBackInfo *cfb = op->o_callback->sc_private;
2560
2561                 cfb->cb_got_ldif = 1;
2562                 rs->sr_err = config_add_internal( cfb, rs->sr_entry, NULL );
2563         }
2564         return rs->sr_err;
2565 }
2566
2567 /* Configure and read the underlying back-ldif store */
2568 static int
2569 config_setup_ldif( BackendDB *be, const char *dir ) {
2570         CfBackInfo *cfb = be->be_private;
2571         ConfigArgs c = {0};
2572         ConfigTable *ct;
2573         char *argv[3];
2574         int rc;
2575         slap_callback cb = { NULL, config_ldif_resp, NULL, NULL };
2576         Connection conn = {0};
2577         char opbuf[OPERATION_BUFFER_SIZE];
2578         Operation *op;
2579         SlapReply rs = {REP_RESULT};
2580         Filter filter = { LDAP_FILTER_PRESENT };
2581         struct berval filterstr = BER_BVC("(objectclass=*)");
2582
2583         cfb->cb_db.bd_info = backend_info( "ldif" );
2584         if ( !cfb->cb_db.bd_info )
2585                 return 0;       /* FIXME: eventually this will be a fatal error */
2586
2587         if ( cfb->cb_db.bd_info->bi_db_init( &cfb->cb_db )) return 1;
2588
2589         /* Mark that back-ldif type is in use */
2590         cfb->cb_db.bd_info->bi_nDB++;
2591
2592         cfb->cb_db.be_suffix = be->be_suffix;
2593         cfb->cb_db.be_nsuffix = be->be_nsuffix;
2594         cfb->cb_db.be_rootdn = be->be_rootdn;
2595         cfb->cb_db.be_rootndn = be->be_rootndn;
2596
2597         ber_str2bv( dir, 0, 1, &cfdir );
2598
2599         c.be = &cfb->cb_db;
2600         c.fname = "slapd";
2601         c.argc = 2;
2602         argv[0] = "directory";
2603         argv[1] = (char *)dir;
2604         argv[2] = NULL;
2605         c.argv = argv;
2606
2607         ct = config_find_keyword( c.be->be_cf_table, &c );
2608         if ( !ct )
2609                 return 1;
2610
2611         if ( config_add_vals( ct, &c ))
2612                 return 1;
2613
2614         if ( backend_startup_one( &cfb->cb_db ))
2615                 return 1;
2616
2617         op = (Operation *)opbuf;
2618         connection_fake_init( &conn, op, cfb );
2619
2620         filter.f_desc = slap_schema.si_ad_objectClass;
2621
2622         op->o_tag = LDAP_REQ_SEARCH;
2623
2624         op->ors_filter = &filter;
2625         op->ors_filterstr = filterstr;
2626         op->ors_scope = LDAP_SCOPE_SUBTREE;
2627
2628         op->o_dn = be->be_rootdn;
2629         op->o_ndn = be->be_rootndn;
2630
2631         op->o_req_dn = be->be_suffix[0];
2632         op->o_req_ndn = be->be_nsuffix[0];
2633
2634         op->ors_tlimit = SLAP_NO_LIMIT;
2635         op->ors_slimit = SLAP_NO_LIMIT;
2636
2637         op->ors_attrs = slap_anlist_all_attributes;
2638         op->ors_attrsonly = 0;
2639
2640         op->o_callback = &cb;
2641         cb.sc_private = cfb;
2642
2643         op->o_bd = &cfb->cb_db;
2644         op->o_bd->be_search( op, &rs );
2645
2646         return 0;
2647 }
2648
2649 static int
2650 CfOcInfo_cmp( const void *c1, const void *c2 ) {
2651         const CfOcInfo *co1 = c1;
2652         const CfOcInfo *co2 = c2;
2653
2654         return ber_bvcmp( co1->co_name, co2->co_name );
2655 }
2656
2657 int
2658 config_register_schema(ConfigTable *ct, ConfigOCs *ocs) {
2659         int i;
2660         CfOcInfo *co;
2661
2662         i = init_config_attrs( ct );
2663         if ( i ) return i;
2664
2665         /* set up the objectclasses */
2666         i = init_config_ocs( ocs );
2667         if ( i ) return i;
2668
2669         for (i=0; ocs[i].def; i++) {
2670                 if ( ocs[i].oc ) {
2671                         co = ch_malloc( sizeof(CfOcInfo) );
2672                         co->co_name = &(*ocs[i].oc)->soc_cname;
2673                         co->co_table = ct;
2674                         co->co_type = ocs[i].cft;
2675                         avl_insert( &CfOcTree, co, CfOcInfo_cmp, avl_dup_error );
2676                 }
2677         }
2678         return 0;
2679 }
2680
2681 int
2682 read_config(const char *fname, const char *dir) {
2683         BackendDB *be;
2684         CfBackInfo *cfb;
2685
2686         /* Setup the config backend */
2687         be = backend_db_init( "config" );
2688         if ( !be )
2689                 return 1;
2690
2691         /* Setup the underlying back-ldif backend */
2692         if ( config_setup_ldif( be, dir ))
2693                 return 1;
2694
2695 #if 0   /* not yet
2696         /* If we read the config from back-ldif, nothing to do here */
2697         cfb = be->be_private;
2698         if ( cfb->cb_got_ldif )
2699                 return 0;
2700 #endif
2701         ber_str2bv( fname, 0, 1, &cf_prv.c_file );
2702
2703         return read_config_file(fname, 0, NULL);
2704 }
2705
2706 static int
2707 config_back_bind( Operation *op, SlapReply *rs )
2708 {
2709         if ( op->orb_method == LDAP_AUTH_SIMPLE && be_isroot_pw( op )) {
2710                 ber_dupbv( &op->orb_edn, be_root_dn( op->o_bd ));
2711                 /* frontend sends result */
2712                 return LDAP_SUCCESS;
2713         }
2714
2715         rs->sr_err = LDAP_INVALID_CREDENTIALS;
2716         send_ldap_result( op, rs );
2717
2718         return rs->sr_err;
2719 }
2720
2721 static int
2722 config_send( Operation *op, SlapReply *rs, CfEntryInfo *ce, int depth )
2723 {
2724         int rc = 0;
2725
2726         if ( test_filter( op, ce->ce_entry, op->ors_filter ) == LDAP_COMPARE_TRUE )
2727         {
2728                 rs->sr_attrs = op->ors_attrs;
2729                 rs->sr_entry = ce->ce_entry;
2730                 rc = send_search_entry( op, rs );
2731         }
2732         if ( op->ors_scope == LDAP_SCOPE_SUBTREE ) {
2733                 if ( ce->ce_kids ) {
2734                         rc = config_send( op, rs, ce->ce_kids, 1 );
2735                         if ( rc ) return rc;
2736                 }
2737                 if ( depth ) {
2738                         for (ce=ce->ce_sibs; ce; ce=ce->ce_sibs) {
2739                                 rc = config_send( op, rs, ce, 0 );
2740                                 if ( rc ) break;
2741                         }
2742                 }
2743         }
2744         return rc;
2745 }
2746
2747 static ConfigTable *
2748 config_find_table( CfOcInfo *co, AttributeDescription *ad )
2749 {
2750         int i;
2751
2752         for (i=0; co->co_table[i].name; i++)
2753                 if ( co->co_table[i].ad == ad )
2754                         return &co->co_table[i];
2755         return NULL;
2756 }
2757
2758 /* Sort the values in an X-ORDERED attribute.
2759  * If the values have no index, leave them in their given order.
2760  * If the values have indexes, sort them and then strip the index.
2761  * If some are indexed and some are not, return Error.
2762  *
2763  * FIXME: This function probably belongs in the frontend somewhere,
2764  * like slap_mods_check.
2765  */
2766 static int
2767 sort_vals( Attribute *a )
2768 {
2769         int i;
2770         int index = 0, noindex = 0;
2771
2772         /* count attrs, look for index */
2773         for (i=0; a->a_vals[i].bv_val; i++) {
2774                 if ( a->a_vals[i].bv_val[0] == '{' ) {
2775                         char *ptr;
2776                         index = 1;
2777                         ptr = strchr( a->a_vals[i].bv_val, '}' );
2778                         if ( !ptr || !ptr[1] )
2779                                 return LDAP_INVALID_SYNTAX;
2780                         if ( noindex )
2781                                 return LDAP_INVALID_SYNTAX;
2782                 } else {
2783                         noindex = 1;
2784                         if ( index )
2785                                 return LDAP_INVALID_SYNTAX;
2786                 }
2787         }
2788
2789         if ( index ) {
2790                 int vals = i, *indexes, j, idx;
2791                 struct berval tmp, ntmp;
2792                 char *ptr;
2793
2794                 /* Strip index from normalized values */
2795                 if ( !a->a_nvals || a->a_vals == a->a_nvals ) {
2796                         a->a_nvals = ch_malloc( (vals+1)*sizeof(struct berval));
2797                         for ( i=0; i<vals; i++ ) {
2798                                 ptr = strchr(a->a_vals[i].bv_val, '}') + 1;
2799                                 a->a_nvals[i].bv_len = a->a_vals[i].bv_len -
2800                                         (ptr - a->a_vals[i].bv_val);
2801                                 a->a_nvals[i].bv_val = ch_malloc( a->a_nvals[i].bv_len + 1);
2802                                 strcpy(a->a_nvals[i].bv_val, ptr );
2803                         }
2804                 } else {
2805                         for ( i=0; i<vals; i++ ) {
2806                                 ptr = strchr(a->a_nvals[i].bv_val, '}') + 1;
2807                                 a->a_nvals[i].bv_len -= ptr - a->a_nvals[i].bv_val;
2808                                 strcpy(a->a_nvals[i].bv_val, ptr);
2809                         }
2810                 }
2811
2812                 indexes = ch_malloc( vals * sizeof(int) );
2813                 for ( i=0; i<vals; i++)
2814                         indexes[i] = atoi(a->a_vals[i].bv_val+1);
2815
2816                 /* Insertion sort */
2817                 for ( i=1; i<vals; i++ ) {
2818                         idx = indexes[i];
2819                         tmp = a->a_vals[i];
2820                         ntmp = a->a_nvals[i];
2821                         j = i;
2822                         while ((j > 0) && (indexes[j-1] > idx)) {
2823                                 indexes[j] = indexes[j-1];
2824                                 a->a_vals[j] = a->a_vals[j-1];
2825                                 a->a_nvals[j] = a->a_nvals[j-1];
2826                                 j--;
2827                         }
2828                         indexes[j] = idx;
2829                         a->a_vals[j] = tmp;
2830                         a->a_nvals[j] = ntmp;
2831                 }
2832         }
2833         return 0;
2834 }
2835
2836 static int
2837 check_attr( ConfigTable *ct, ConfigArgs *ca, Attribute *a )
2838 {
2839         int i, rc = 0;
2840
2841         if ( a->a_desc->ad_type->sat_flags & SLAP_AT_ORDERED ) {
2842                 rc = sort_vals( a );
2843                 if ( rc )
2844                         return rc;
2845         }
2846         for ( i=0; a->a_nvals[i].bv_val; i++ ) {
2847                 ca->line = a->a_nvals[i].bv_val;
2848                 rc = config_parse_vals( ct, ca, i );
2849                 if ( rc )
2850                         break;
2851         }
2852         return rc;
2853 }
2854
2855 /* Parse an LDAP entry into config directives */
2856 static int
2857 config_add_internal( CfBackInfo *cfb, Entry *e, SlapReply *rs )
2858 {
2859         CfEntryInfo *ce, *last;
2860         CfOcInfo co, *coptr, **colst = NULL;
2861         Attribute *a, *oc_at, *type_attr;
2862         AttributeDescription *type_ad = NULL;
2863         int i, j, nocs, rc;
2864         ConfigArgs ca = {0};
2865         struct berval pdn;
2866         Entry *xe = NULL;
2867         ConfigTable *ct, *type_ct = NULL;
2868
2869         /* Make sure parent exists and entry does not */
2870         ce = config_find_base( cfb->cb_root, &e->e_nname, &last );
2871         if ( ce )
2872                 return LDAP_ALREADY_EXISTS;
2873
2874         dnParent( &e->e_nname, &pdn );
2875
2876         /* If last is NULL, the new entry is the root/suffix entry,
2877          * otherwise last should be the parent.
2878          */
2879         if ( last && !dn_match( &last->ce_entry->e_nname, &pdn )) {
2880                 if ( rs )
2881                         rs->sr_matched = last->ce_entry->e_name.bv_val;
2882                 return LDAP_NO_SUCH_OBJECT;
2883         }
2884
2885         oc_at = attr_find( e->e_attrs, slap_schema.si_ad_objectClass );
2886         if ( !oc_at ) return LDAP_OBJECT_CLASS_VIOLATION;
2887
2888         /* count the objectclasses */
2889         for ( i=0; oc_at->a_nvals[i].bv_val; i++ );
2890         nocs = i;
2891         colst = (CfOcInfo **)ch_malloc( nocs * sizeof(CfOcInfo *));
2892
2893         for ( i=0, j=0; i<nocs; i++) {
2894                 co.co_name = &oc_at->a_nvals[i];
2895                 coptr = avl_find( CfOcTree, &co, CfOcInfo_cmp );
2896
2897                 /* ignore non-config objectclasses. probably should be
2898                  * an error, general data doesn't belong here.
2899                  */
2900                 if ( !coptr ) continue;
2901
2902                 /* Ignore the root objectclass, it has no implementation.
2903                  */
2904                 if ( coptr->co_type == Cft_Abstract ) continue;
2905                 colst[j++] = coptr;
2906         }
2907         nocs = j;
2908
2909         /* Only the root can be Cft_Global, everything else must
2910          * have a parent. Only limited nesting arrangements are allowed.
2911          */
2912         switch( colst[0]->co_type ) {
2913         case Cft_Global:
2914                 if ( last )  {
2915                         rc = LDAP_CONSTRAINT_VIOLATION;
2916                         goto leave;
2917                 }
2918                 break;
2919         case Cft_Schema:
2920         case Cft_Backend:
2921         case Cft_Database:
2922         case Cft_Include:
2923                 if ( !last || ( last->ce_type != Cft_Global &&
2924                         last->ce_type != colst[0]->co_type )) {
2925                         rc = LDAP_CONSTRAINT_VIOLATION;
2926                         goto leave;
2927                 }
2928                 break;
2929         case Cft_Overlay:
2930                 if ( !last || ( last->ce_type != Cft_Global &&
2931                         last->ce_type != Cft_Database &&
2932                         last->ce_type != colst[0]->co_type )) {
2933                         rc = LDAP_CONSTRAINT_VIOLATION;
2934                         goto leave;
2935                 }
2936                 break;
2937         }
2938
2939         /* Parse all the values and check for simple syntax errors before
2940          * performing any set actions.
2941          */
2942         switch (colst[0]->co_type) {
2943         case Cft_Global:        /* */
2944         case Cft_Schema:
2945                 ca.be = cfb->cb_be;
2946                 break;
2947         case Cft_Backend:
2948                 if ( last->ce_type == Cft_Backend )
2949                         ca.bi = last->ce_bi;
2950                 else
2951                         type_ad = cfAd_backend;
2952                 break;
2953         case Cft_Database:
2954                 if ( last->ce_type == Cft_Database ) {
2955                         ca.be = last->ce_be;
2956                 } else {
2957                         type_ad = cfAd_database;
2958                         /* dummy, just to get past check_attr */
2959                         ca.be = frontendDB;
2960                 }
2961                 break;
2962
2963         case Cft_Overlay:
2964                 ca.be = last->ce_be;
2965                 type_ad = cfAd_overlay;
2966
2967         case Cft_Include:
2968                 if ( !rs )      /* ignored */
2969                         break;
2970                 type_ad = cfAd_include;
2971         }
2972         init_config_argv( &ca );
2973         if ( type_ad ) {
2974                 type_attr = attr_find( e->e_attrs, type_ad );
2975                 if ( !type_attr ) {
2976                         rc = LDAP_OBJECT_CLASS_VIOLATION;
2977                         goto leave;
2978                 }
2979                 for ( i=0; i<nocs; i++ ) {
2980                         type_ct = config_find_table( colst[i], type_ad );
2981                         if ( type_ct ) break;
2982                 }
2983                 if ( !type_ct ) {
2984                         rc = LDAP_OBJECT_CLASS_VIOLATION;
2985                         goto leave;
2986                 }
2987                 rc = check_attr( type_ct, &ca, type_attr );
2988                 if ( rc ) goto leave;
2989         }
2990         for ( a=e->e_attrs; a; a=a->a_next ) {
2991                 if ( a == type_attr || a == oc_at ) continue;
2992                 ct = NULL;
2993                 for ( i=0; i<nocs; i++ ) {
2994                         ct = config_find_table( colst[i], a->a_desc );
2995                         if ( ct ) break;
2996                 }
2997                 if ( !ct ) continue;    /* user data? */
2998                 rc = check_attr( ct, &ca, a );
2999                 if ( rc ) goto leave;
3000         }
3001
3002         /* Basic syntax checks are OK. Do the actual settings. */
3003         if ( type_ct ) {
3004                 ca.line = type_attr->a_nvals[0].bv_val;
3005                 rc = config_parse_add( type_ct, &ca, 0 );
3006                 if ( rc ) goto leave;
3007         }
3008         for ( a=e->e_attrs; a; a=a->a_next ) {
3009                 if ( a == type_attr || a == oc_at ) continue;
3010                 ct = NULL;
3011                 for ( i=0; i<nocs; i++ ) {
3012                         ct = config_find_table( colst[i], a->a_desc );
3013                         if ( ct ) break;
3014                 }
3015                 if ( !ct ) continue;    /* user data? */
3016                 for (i=0; a->a_nvals[i].bv_val; i++) {
3017                         ca.line = a->a_nvals[i].bv_val;
3018                         rc = config_parse_add( ct, &ca, i );
3019                         if ( rc ) goto leave;
3020                 }
3021         }
3022         ce = ch_calloc( 1, sizeof(CfEntryInfo) );
3023         ce->ce_entry = entry_dup( e );
3024         ce->ce_entry->e_private = ce;
3025         ce->ce_type = colst[0]->co_type;
3026         if ( !last ) {
3027                 cfb->cb_root = ce;
3028         } else if ( last->ce_kids ) {
3029                 CfEntryInfo *c2;
3030
3031                 for (c2=last->ce_kids; c2 && c2->ce_sibs; c2 = c2->ce_sibs);
3032                 c2->ce_sibs = ce;
3033         } else {
3034                 last->ce_kids = ce;
3035         }
3036
3037 leave:
3038         ch_free( ca.argv );
3039         if ( colst ) ch_free( colst );
3040         return rc;
3041 }
3042
3043 /* Parse an LDAP entry into config directives, then store in underlying
3044  * database.
3045  */
3046 static int
3047 config_back_add( Operation *op, SlapReply *rs )
3048 {
3049         CfBackInfo *cfb;
3050         CfEntryInfo *ce, *last;
3051
3052         if ( !be_isroot( op ) ) {
3053                 rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
3054                 send_ldap_result( op, rs );
3055         }
3056
3057         cfb = (CfBackInfo *)op->o_bd->be_private;
3058
3059         ldap_pvt_thread_pool_pause( &connection_pool );
3060
3061         /* Strategy:
3062          * 1) check for existence of entry
3063          * 2) perform internal add
3064          * 3) store entry in underlying database
3065          */
3066
3067         ldap_pvt_thread_pool_resume( &connection_pool );
3068
3069 out:
3070         send_ldap_result( op, rs );
3071         return rs->sr_err;
3072 }
3073
3074 static int
3075 config_back_modify( Operation *op, SlapReply *rs )
3076 {
3077         CfBackInfo *cfb;
3078         CfEntryInfo *ce, *last;
3079
3080         if ( !be_isroot( op ) ) {
3081                 rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
3082                 send_ldap_result( op, rs );
3083         }
3084
3085         cfb = (CfBackInfo *)op->o_bd->be_private;
3086
3087         ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last );
3088         if ( !ce ) {
3089                 if ( last )
3090                         rs->sr_matched = last->ce_entry->e_name.bv_val;
3091                 rs->sr_err = LDAP_NO_SUCH_OBJECT;
3092                 goto out;
3093         }
3094         ldap_pvt_thread_pool_pause( &connection_pool );
3095
3096         /* Strategy:
3097          * 1) perform the Modify on the cached Entry.
3098          * 2) verify that the Entry still satisfies the schema.
3099          * 3) perform the individual config operations.
3100          * 4) store Modified entry in underlying LDIF backend.
3101          */
3102         ldap_pvt_thread_pool_resume( &connection_pool );
3103 out:
3104         send_ldap_result( op, rs );
3105         return rs->sr_err;
3106 }
3107
3108 static int
3109 config_back_search( Operation *op, SlapReply *rs )
3110 {
3111         CfBackInfo *cfb;
3112         CfEntryInfo *ce, *last;
3113         int rc;
3114
3115         if ( !be_isroot( op ) ) {
3116                 rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
3117                 send_ldap_result( op, rs );
3118         }
3119
3120         cfb = (CfBackInfo *)op->o_bd->be_private;
3121
3122         ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last );
3123         if ( !ce ) {
3124                 if ( last )
3125                         rs->sr_matched = last->ce_entry->e_name.bv_val;
3126                 rs->sr_err = LDAP_NO_SUCH_OBJECT;
3127                 goto out;
3128         }
3129         switch ( op->ors_scope ) {
3130         case LDAP_SCOPE_BASE:
3131         case LDAP_SCOPE_SUBTREE:
3132                 config_send( op, rs, ce, 0 );
3133                 break;
3134
3135         case LDAP_SCOPE_ONELEVEL:
3136                 for (ce = ce->ce_kids; ce; ce=ce->ce_sibs) {
3137                         config_send( op, rs, ce, 1 );
3138                 }
3139                 break;
3140         }
3141
3142         rs->sr_err = LDAP_SUCCESS;
3143 out:
3144         send_ldap_result( op, rs );
3145         return 0;
3146 }
3147
3148 static Entry *
3149 config_alloc_entry( struct berval *pdn, struct berval *rdn )
3150 {
3151         Entry *e = ch_calloc( 1, sizeof(Entry) );
3152         CfEntryInfo *ce = ch_calloc( 1, sizeof(CfEntryInfo) );
3153         e->e_private = ce;
3154         ce->ce_entry = e;
3155         build_new_dn( &e->e_name, pdn, rdn, NULL );
3156         ber_dupbv( &e->e_nname, &e->e_name );
3157         return e;
3158 }
3159
3160 #define NO_TABLE        0
3161 #define BI_TABLE        1
3162 #define BE_TABLE        2
3163
3164 static int
3165 config_build_entry( ConfigArgs *c, Entry *e, ObjectClass *oc,
3166          struct berval *rdn, ConfigTable *ct, int table )
3167 {
3168         struct berval vals[2];
3169         struct berval ad_name;
3170         AttributeDescription *ad = NULL;
3171         int rc, i;
3172         char *ptr;
3173         const char *text;
3174         char textbuf[SLAP_TEXT_BUFLEN];
3175         size_t textlen = sizeof(textbuf);
3176         AttributeType **at;
3177         Attribute *oc_at;
3178
3179         BER_BVZERO( &vals[1] );
3180
3181         vals[0] = oc->soc_cname;
3182         attr_merge(e, slap_schema.si_ad_objectClass, vals, NULL );
3183         ptr = strchr(rdn->bv_val, '=');
3184         ad_name.bv_val = rdn->bv_val;
3185         ad_name.bv_len = ptr - rdn->bv_val;
3186         rc = slap_bv2ad( &ad_name, &ad, &text );
3187         if ( rc ) {
3188                 return rc;
3189         }
3190         vals[0].bv_val = ptr+1;
3191         vals[0].bv_len = rdn->bv_len - (vals[0].bv_val - rdn->bv_val);
3192         attr_merge(e, ad, vals, NULL );
3193
3194         for (at=oc->soc_required; at && *at; at++) {
3195                 /* Skip the naming attr */
3196                 if ((*at)->sat_ad == ad || (*at)->sat_ad == slap_schema.si_ad_cn )
3197                         continue;
3198                 for (i=0;ct[i].name;i++) {
3199                         if (ct[i].ad == (*at)->sat_ad) {
3200                                 rc = config_get_vals(&ct[i], c);
3201                                 if (rc == LDAP_SUCCESS) {
3202                                         attr_merge(e, ct[i].ad, c->rvalue_vals, c->rvalue_nvals);
3203                                         ber_bvarray_free( c->rvalue_nvals );
3204                                         ber_bvarray_free( c->rvalue_vals );
3205                                 }
3206                                 break;
3207                         }
3208                 }
3209         }
3210
3211         for (at=oc->soc_allowed; at && *at; at++) {
3212                 /* Skip the naming attr */
3213                 if ((*at)->sat_ad == ad || (*at)->sat_ad == slap_schema.si_ad_cn )
3214                         continue;
3215                 for (i=0;ct[i].name;i++) {
3216                         if (ct[i].ad == (*at)->sat_ad) {
3217                                 rc = config_get_vals(&ct[i], c);
3218                                 if (rc == LDAP_SUCCESS) {
3219                                         attr_merge(e, ct[i].ad, c->rvalue_vals, c->rvalue_nvals);
3220                                         ber_bvarray_free( c->rvalue_nvals );
3221                                         ber_bvarray_free( c->rvalue_vals );
3222                                 }
3223                                 break;
3224                         }
3225                 }
3226         }
3227
3228         if ( table ) {
3229                 if ( table == BI_TABLE )
3230                         ct = c->bi->bi_cf_table;
3231                 else
3232                         ct = c->be->be_cf_table;
3233                 for (;ct && ct->name;ct++) {
3234                         if (!ct->ad) continue;
3235                         rc = config_get_vals(ct, c);
3236                         if (rc == LDAP_SUCCESS) {
3237                                 attr_merge(e, ct->ad, c->rvalue_vals, c->rvalue_nvals);
3238                         }
3239                 }
3240         }
3241         oc_at = attr_find( e->e_attrs, slap_schema.si_ad_objectClass );
3242         rc = structural_class(oc_at->a_vals, vals, NULL, &text, textbuf, textlen);
3243         BER_BVZERO( &vals[1] );
3244         attr_merge(e, slap_schema.si_ad_structuralObjectClass, vals, NULL );
3245
3246         return 0;
3247 }
3248
3249 static CfEntryInfo *
3250 config_build_includes( ConfigArgs *c, Entry *parent,
3251         Operation *op, SlapReply *rs )
3252 {
3253         Entry *e;
3254         int i;
3255         ConfigFile *cf = (ConfigFile *)c->line;
3256         CfEntryInfo *ce, *ceparent, *ceprev;
3257
3258         ceparent = parent->e_private;
3259
3260         for (i=0; cf; cf=cf->c_sibs, i++) {
3261                 c->value_dn.bv_val = c->log;
3262                 c->value_dn.bv_len = sprintf(c->value_dn.bv_val, "cn=include{%d}", i);
3263                 e = config_alloc_entry( &parent->e_nname, &c->value_dn );
3264                 c->line = (char *)cf;
3265                 config_build_entry( c, e, cfOc_include, &c->value_dn,
3266                         c->bi->bi_cf_table, NO_TABLE );
3267                 op->ora_e = e;
3268                 op->o_bd->be_add( op, rs );
3269                 ce = e->e_private;
3270                 ce->ce_type = Cft_Include;
3271                 ce->ce_bi = c->bi;
3272                 if ( !ceparent->ce_kids ) {
3273                         ceparent->ce_kids = ce;
3274                 } else {
3275                         ceprev->ce_sibs = ce;
3276                 }
3277                 ceprev = ce;
3278                 if ( cf->c_kids ) {
3279                         c->line = (char *)cf->c_kids;
3280                         config_build_includes( c, e, op, rs );
3281                 }
3282         }
3283         return ce;
3284 }
3285
3286 static int
3287 config_back_db_open( BackendDB *be )
3288 {
3289         CfBackInfo *cfb = be->be_private;
3290         struct berval rdn;
3291         Entry *e, *parent;
3292         CfEntryInfo *ce, *ceparent, *ceprev;
3293         int i, rc;
3294         BackendInfo *bi;
3295         BackendDB *bptr;
3296         ConfigArgs c;
3297         ConfigTable *ct;
3298         Connection conn = {0};
3299         char opbuf[OPERATION_BUFFER_SIZE];
3300         Operation *op;
3301         slap_callback cb = { NULL, slap_null_cb, NULL, NULL };
3302         SlapReply rs = {REP_RESULT};
3303
3304         /* If we read the config from back-ldif, nothing to do here */
3305         if ( cfb->cb_got_ldif )
3306                 return 0;
3307
3308         op = (Operation *)opbuf;
3309         connection_fake_init( &conn, op, cfb );
3310
3311         op->o_dn = be->be_rootdn;
3312         op->o_ndn = be->be_rootndn;
3313
3314         op->o_tag = LDAP_REQ_ADD;
3315         op->o_callback = &cb;
3316         op->o_bd = &cfb->cb_db;
3317
3318         /* create root of tree */
3319         rdn = config_rdn;
3320         e = config_alloc_entry( NULL, &rdn );
3321         ce = e->e_private;
3322         cfb->cb_root = ce;
3323         c.be = be;
3324         c.bi = be->bd_info;
3325         c.line = (char *)cfb->cb_config;
3326         ct = c.bi->bi_cf_table;
3327         config_build_entry( &c, e, cfOc_global, &rdn, ct, NO_TABLE );
3328         op->ora_e = e;
3329         op->o_bd->be_add( op, &rs );
3330         ce->ce_type = Cft_Global;
3331         ce->ce_bi = c.bi;
3332
3333         parent = e;
3334         ceparent = ce;
3335
3336         /* Create schema nodes... cn=schema will contain the hardcoded core
3337          * schema, read-only. Child objects will contain runtime loaded schema
3338          * files.  FIXME
3339          */
3340
3341         /* Create includeFile nodes... */
3342         if ( cfb->cb_config->c_kids ) {
3343                 c.line = (char *)cfb->cb_config->c_kids;
3344                 ceprev = config_build_includes( &c, parent, op, &rs );
3345         }
3346
3347         /* Create backend nodes. Skip if they don't provide a cf_table.
3348          * There usually aren't any of these.
3349          */
3350
3351         c.line = 0;
3352         bi = backendInfo;
3353         for (i=0; i<nBackendInfo; i++, bi++) {
3354                 if (!bi->bi_cf_table) continue;
3355                 if (!bi->bi_private) continue;
3356
3357                 rdn.bv_val = c.log;
3358                 rdn.bv_len = sprintf(rdn.bv_val, "%s=%s", cfAd_backend->ad_cname.bv_val, bi->bi_type);
3359                 e = config_alloc_entry( &parent->e_nname, &rdn );
3360                 ce = e->e_private;
3361                 ce->ce_type = Cft_Backend;
3362                 ce->ce_bi = bi;
3363                 c.bi = bi;
3364                 config_build_entry( &c, e, cfOc_backend, &rdn, ct, BI_TABLE );
3365                 op->ora_e = e;
3366                 op->o_bd->be_add( op, &rs );
3367                 if ( !ceparent->ce_kids ) {
3368                         ceparent->ce_kids = ce;
3369                 } else {
3370                         ceprev->ce_sibs = ce;
3371                 }
3372                 ceprev = ce;
3373         }
3374
3375         /* Create database nodes... */
3376         for (i=0; i<nBackendDB; i++) {
3377                 slap_overinfo *oi = NULL;
3378                 if ( i == 0 ) {
3379                         bptr = frontendDB;
3380                 } else {
3381                         bptr = &backendDB[i];
3382                 }
3383                 if ( overlay_is_over( bptr )) {
3384                         oi = bptr->bd_info->bi_private;
3385                         bi = oi->oi_orig;
3386                 } else {
3387                         bi = bptr->bd_info;
3388                 }
3389                 rdn.bv_val = c.log;
3390                 rdn.bv_len = sprintf(rdn.bv_val, "%s={%0x}%s", cfAd_database->ad_cname.bv_val,
3391                         i, bi->bi_type);
3392                 e = config_alloc_entry( &parent->e_nname, &rdn );
3393                 ce = e->e_private;
3394                 c.be = bptr;
3395                 c.bi = bi;
3396                 ce->ce_type = Cft_Database;
3397                 ce->ce_be = c.be;
3398                 ce->ce_bi = c.bi;
3399                 config_build_entry( &c, e, cfOc_database, &rdn, ct, BE_TABLE );
3400                 op->ora_e = e;
3401                 op->o_bd->be_add( op, &rs );
3402                 if ( !ceparent->ce_kids ) {
3403                         ceparent->ce_kids = ce;
3404                 } else {
3405                         ceprev->ce_sibs = ce;
3406                 }
3407                 ceprev = ce;
3408                 /* Iterate through overlays */
3409                 if ( oi ) {
3410                         slap_overinst *on;
3411                         Entry *oe;
3412                         CfEntryInfo *opar = ce, *oprev = NULL;
3413                         int j;
3414
3415                         for (j=0,on=oi->oi_list; on; j++,on=on->on_next) {
3416                                 rdn.bv_val = c.log;
3417                                 rdn.bv_len = sprintf(rdn.bv_val, "%s={%0x}%s",
3418                                         cfAd_overlay->ad_cname.bv_val, j, on->on_bi.bi_type );
3419                                 oe = config_alloc_entry( &e->e_nname, &rdn );
3420                                 ce = oe->e_private;
3421                                 c.be = bptr;
3422                                 c.bi = &on->on_bi;
3423                                 ce->ce_type = Cft_Overlay;
3424                                 ce->ce_be = c.be;
3425                                 ce->ce_bi = c.bi;
3426                                 config_build_entry( &c, oe, cfOc_overlay, &rdn, ct, BI_TABLE );
3427                                 op->ora_e = oe;
3428                                 op->o_bd->be_add( op, &rs );
3429                                 if ( !opar->ce_kids ) {
3430                                         opar->ce_kids = ce;
3431                                 } else {
3432                                         oprev->ce_sibs = ce;
3433                                 }
3434                                 oprev = ce;
3435                         }
3436                 }
3437         }
3438
3439         return 0;
3440 }
3441
3442 static int
3443 config_back_db_destroy( Backend *be )
3444 {
3445         free( be->be_private );
3446         return 0;
3447 }
3448
3449 static int
3450 config_back_db_init( Backend *be )
3451 {
3452         struct berval dn;
3453         CfBackInfo *cfb;
3454
3455         cfb = ch_calloc( 1, sizeof(CfBackInfo));
3456         cfb->cb_config = &cf_prv;
3457         cfb->cb_be = be;
3458         be->be_private = cfb;
3459
3460         ber_dupbv( &be->be_rootdn, &config_rdn );
3461         ber_dupbv( &be->be_rootndn, &be->be_rootdn );
3462         ber_dupbv( &dn, &be->be_rootdn );
3463         ber_bvarray_add( &be->be_suffix, &dn );
3464         ber_dupbv( &dn, &be->be_rootdn );
3465         ber_bvarray_add( &be->be_nsuffix, &dn );
3466
3467         /* Hide from namingContexts */
3468         SLAP_BFLAGS(be) |= SLAP_BFLAG_CONFIG;
3469
3470         return 0;
3471 }
3472
3473 static struct {
3474         char *name;
3475         AttributeDescription **desc;
3476         AttributeDescription *sub;
3477 } ads[] = {
3478         { "attribute", NULL, NULL },
3479         { "backend", &cfAd_backend, NULL },
3480         { "database", &cfAd_database, NULL },
3481         { "ditcontentrule", NULL, NULL },
3482         { "include", &cfAd_include, NULL },
3483         { "objectclass", NULL, NULL },
3484         { "overlay", &cfAd_overlay, NULL },
3485         { NULL, NULL, NULL }
3486 };
3487
3488 /* Notes:
3489  *   add / delete: all types that may be added or deleted must use an
3490  * X-ORDERED attributeType for their RDN. Adding and deleting entries
3491  * should automatically renumber the index of any siblings as needed,
3492  * so that no gaps in the numbering sequence exist after the add/delete
3493  * is completed.
3494  *   What can be added:
3495  *     schema objects
3496  *     backend objects for backend-specific config directives
3497  *     database objects
3498  *     overlay objects
3499  *
3500  *   delete: probably no support this time around.
3501  *
3502  *   modrdn: generally not done. Will be invoked automatically by add/
3503  * delete to update numbering sequence. Perform as an explicit operation
3504  * so that the renumbering effect may be replicated. Subtree rename must
3505  * be supported, since renumbering a database will affect all its child
3506  * overlays.
3507  *
3508  *  modify: must be fully supported.
3509  */
3510
3511 int
3512 config_back_initialize( BackendInfo *bi )
3513 {
3514         ConfigTable *ct = config_back_cf_table;
3515         char *argv[4];
3516         int i;
3517
3518         bi->bi_open = 0;
3519         bi->bi_close = 0;
3520         bi->bi_config = 0;
3521         bi->bi_destroy = 0;
3522
3523         bi->bi_db_init = config_back_db_init;
3524         bi->bi_db_config = 0;
3525         bi->bi_db_open = config_back_db_open;
3526         bi->bi_db_close = 0;
3527         bi->bi_db_destroy = config_back_db_destroy;
3528
3529         bi->bi_op_bind = config_back_bind;
3530         bi->bi_op_unbind = 0;
3531         bi->bi_op_search = config_back_search;
3532         bi->bi_op_compare = 0;
3533         bi->bi_op_modify = config_back_modify;
3534         bi->bi_op_modrdn = 0;
3535         bi->bi_op_add = 0;
3536         bi->bi_op_delete = 0;
3537         bi->bi_op_abandon = 0;
3538
3539         bi->bi_extended = 0;
3540
3541         bi->bi_chk_referrals = 0;
3542
3543         bi->bi_connection_init = 0;
3544         bi->bi_connection_destroy = 0;
3545
3546         argv[3] = NULL;
3547         for (i=0; OidMacros[i].name; i++ ) {
3548                 argv[1] = OidMacros[i].name;
3549                 argv[2] = OidMacros[i].oid;
3550                 parse_oidm( "slapd", i, 3, argv );
3551         }
3552
3553         bi->bi_cf_table = ct;
3554
3555         i = config_register_schema( ct, cf_ocs );
3556         if ( i ) return i;
3557
3558         /* set up the notable AttributeDescriptions */
3559         ads[0].sub = slap_schema.si_ad_attributeTypes;
3560         ads[3].sub = slap_schema.si_ad_ditContentRules;
3561         ads[5].sub = slap_schema.si_ad_objectClasses;
3562
3563         i = 0;
3564         for (;ct->name;ct++) {
3565                 if (strcmp(ct->name, ads[i].name)) continue;
3566                 if (ads[i].sub) {
3567                         ct->ad = ads[i].sub;
3568                 } else {
3569                         *ads[i].desc = ct->ad;
3570                 }
3571                 i++;
3572                 if (!ads[i].name) break;
3573         }
3574
3575         return 0;
3576 }
3577