git.sur5r.net Git - openldap/blob - servers/slapd/config.c

   1 /* config.c - configuration file handling routines */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
   5  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   6  */
   7
   8 #include "portable.h"
   9
  10 #include <stdio.h>
  11
  12 #include <ac/string.h>
  13 #include <ac/ctype.h>
  14 #include <ac/socket.h>
  15 #include <ac/errno.h>
  16
  17 #include "lutil.h"
  18 #include "ldap_pvt.h"
  19 #include "slap.h"
  20
  21 #define MAXARGS 500
  22
  23 /*
  24  * defaults for various global variables
  25  */
  26 struct slap_limits_set deflimit = {
  27         SLAPD_DEFAULT_TIMELIMIT,        /* backward compatible limits */
  28         0,
  29
  30         SLAPD_DEFAULT_SIZELIMIT,        /* backward compatible limits */
  31         0,
  32         -1                              /* no limit on unchecked size */
  33 };
  34
  35 AccessControl   *global_acl = NULL;
  36 slap_access_t           global_default_access = ACL_READ;
  37 slap_mask_t             global_restrictops = 0;
  38 slap_mask_t             global_allows = 0;
  39 slap_mask_t             global_disallows = 0;
  40 slap_mask_t             global_requires = 0;
  41 slap_ssf_set_t  global_ssf_set;
  42 char            *replogfile;
  43 int             global_lastmod = ON;
  44 int             global_idletimeout = 0;
  45 char    *global_host = NULL;
  46 char    *global_realm = NULL;
  47 char            *ldap_srvtab = "";
  48 char            *default_passwd_hash;
  49 char            *default_search_base = NULL;
  50 char            *default_search_nbase = NULL;
  51
  52 ber_len_t sockbuf_max_incoming = SLAP_SB_MAX_INCOMING_DEFAULT;
  53 ber_len_t sockbuf_max_incoming_auth= SLAP_SB_MAX_INCOMING_AUTH;
  54
  55 char   *slapd_pid_file  = NULL;
  56 char   *slapd_args_file = NULL;
  57
  58 int nSaslRegexp = 0;
  59 SaslRegexp_t *SaslRegexp = NULL;
  60 int sasl_external_x509dn_convert;
  61
  62 static char     *fp_getline(FILE *fp, int *lineno);
  63 static void     fp_getline_init(int *lineno);
  64 static int      fp_parse_line(char *line, int *argcp, char **argv);
  65
  66 static char     *strtok_quote(char *line, char *sep);
  67 static int      load_ucdata(char *path);
  68
  69 int
  70 read_config( const char *fname )
  71 {
  72         FILE    *fp;
  73         char    *line, *savefname, *saveline;
  74         int     cargc, savelineno;
  75         char    *cargv[MAXARGS+1];
  76         int     lineno, i;
  77         int rc;
  78         struct berval *vals[2];
  79         struct berval val;
  80
  81         static BackendInfo *bi = NULL;
  82         static BackendDB        *be = NULL;
  83
  84         vals[0] = &val;
  85         vals[1] = NULL;
  86
  87         if ( (fp = fopen( fname, "r" )) == NULL ) {
  88                 ldap_syslog = 1;
  89 #ifdef NEW_LOGGING
  90                 LDAP_LOG(( "config", LDAP_LEVEL_ENTRY, "read_config: "
  91                         "could not open config file \"%s\": %s (%d)\n",
  92                     fname, strerror(errno), errno ));
  93 #else
  94                 Debug( LDAP_DEBUG_ANY,
  95                     "could not open config file \"%s\": %s (%d)\n",
  96                     fname, strerror(errno), errno );
  97 #endif
  98                 return 1;
  99         }
 100
 101 #ifdef NEW_LOGGING
 102         LDAP_LOG(( "config", LDAP_LEVEL_ENTRY,
 103                 "read_config: reading config file %s\n", fname ));
 104 #else
 105         Debug( LDAP_DEBUG_CONFIG, "reading config file %s\n", fname, 0, 0 );
 106 #endif
 107
 108
 109         fp_getline_init( &lineno );
 110
 111         while ( (line = fp_getline( fp, &lineno )) != NULL ) {
 112                 /* skip comments and blank lines */
 113                 if ( line[0] == '#' || line[0] == '\0' ) {
 114                         continue;
 115                 }
 116
 117 #ifdef NEW_LOGGING
 118                 LDAP_LOG(( "config", LDAP_LEVEL_DETAIL1,
 119                            "line %d (%s)\n", lineno, line ));
 120 #else
 121                 Debug( LDAP_DEBUG_CONFIG, "line %d (%s)\n", lineno, line, 0 );
 122 #endif
 123
 124
 125                 /* fp_parse_line is destructive, we save a copy */
 126                 saveline = ch_strdup( line );
 127
 128                 if ( fp_parse_line( line, &cargc, cargv ) != 0 ) {
 129                         return( 1 );
 130                 }
 131
 132                 if ( cargc < 1 ) {
 133 #ifdef NEW_LOGGING
 134                         LDAP_LOG(( "config", LDAP_LEVEL_INFO,
 135                                    "%s: line %d: bad config line (ignored)\n",
 136                                    fname, lineno ));
 137 #else
 138                         Debug( LDAP_DEBUG_ANY,
 139                             "%s: line %d: bad config line (ignored)\n",
 140                             fname, lineno, 0 );
 141 #endif
 142
 143                         continue;
 144                 }
 145
 146                 if ( strcasecmp( cargv[0], "backend" ) == 0 ) {
 147                         if ( cargc < 2 ) {
 148 #ifdef NEW_LOGGING
 149                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 150                                            "%s : line %d: missing type in \"backend\" line.\n",
 151                                            fname, lineno ));
 152 #else
 153                                 Debug( LDAP_DEBUG_ANY,
 154                 "%s: line %d: missing type in \"backend <type>\" line\n",
 155                                     fname, lineno, 0 );
 156 #endif
 157
 158                                 return( 1 );
 159                         }
 160
 161                         if( be != NULL ) {
 162 #ifdef NEW_LOGGING
 163                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 164                                            "%s: line %d: backend line must appear before any "
 165                                            "database definition.\n", fname, lineno ));
 166 #else
 167                                 Debug( LDAP_DEBUG_ANY,
 168 "%s: line %d: backend line must appear before any database definition\n",
 169                                     fname, lineno, 0 );
 170 #endif
 171
 172                                 return( 1 );
 173                         }
 174
 175                         bi = backend_info( cargv[1] );
 176
 177                         if( bi == NULL ) {
 178 #ifdef NEW_LOGGING
 179                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 180                                            "read_config: backend %s initialization failed.\n",
 181                                            cargv[1] ));
 182 #else
 183                                 Debug( LDAP_DEBUG_ANY,
 184                                         "backend %s initialization failed.\n",
 185                                     cargv[1], 0, 0 );
 186 #endif
 187
 188                                 return( 1 );
 189                         }
 190                 } else if ( strcasecmp( cargv[0], "database" ) == 0 ) {
 191                         if ( cargc < 2 ) {
 192 #ifdef NEW_LOGGING
 193                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 194                                            "%s: line %d: missing type in \"database <type>\" line\n",
 195                                            fname, lineno ));
 196 #else
 197                                 Debug( LDAP_DEBUG_ANY,
 198                 "%s: line %d: missing type in \"database <type>\" line\n",
 199                                     fname, lineno, 0 );
 200 #endif
 201
 202                                 return( 1 );
 203                         }
 204
 205                         bi = NULL;
 206                         be = backend_db_init( cargv[1] );
 207
 208                         if( be == NULL ) {
 209 #ifdef NEW_LOGGING
 210                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 211                                            "database %s initialization failed.\n",
 212                                            cargv[1] ));
 213 #else
 214                                 Debug( LDAP_DEBUG_ANY,
 215                                         "database %s initialization failed.\n",
 216                                     cargv[1], 0, 0 );
 217 #endif
 218
 219                                 return( 1 );
 220                         }
 221
 222                 /* set thread concurrency */
 223                 } else if ( strcasecmp( cargv[0], "concurrency" ) == 0 ) {
 224                         int c;
 225                         if ( cargc < 2 ) {
 226 #ifdef NEW_LOGGING
 227                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 228                                            "%s: line %d: missing level in \"concurrency <level\" line\n",
 229                                            fname, lineno ));
 230 #else
 231                                 Debug( LDAP_DEBUG_ANY,
 232             "%s: line %d: missing level in \"concurrency <level>\" line\n",
 233                                     fname, lineno, 0 );
 234 #endif
 235
 236                                 return( 1 );
 237                         }
 238
 239                         c = atoi( cargv[1] );
 240
 241                         if( c < 1 ) {
 242 #ifdef NEW_LOGGING
 243                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 244                                            "%s: line %d: invalid level (%d) in "
 245                                            "\"concurrency <level>\" line.\n",
 246                                            fname, lineno, c ));
 247 #else
 248                                 Debug( LDAP_DEBUG_ANY,
 249             "%s: line %d: invalid level (%d) in \"concurrency <level>\" line\n",
 250                                     fname, lineno, c );
 251 #endif
 252
 253                                 return( 1 );
 254                         }
 255
 256                         ldap_pvt_thread_set_concurrency( c );
 257
 258                 /* set sockbuf max */
 259                 } else if ( strcasecmp( cargv[0], "sockbuf_max_incoming" ) == 0 ) {
 260                         long max;
 261                         if ( cargc < 2 ) {
 262 #ifdef NEW_LOGGING
 263                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 264                                            "%s: line %d: missing max in \"sockbuf_max_incoming <bytes\" line\n",
 265                                            fname, lineno ));
 266 #else
 267                                 Debug( LDAP_DEBUG_ANY,
 268                                            "%s: line %d: missing max in \"sockbuf_max_incoming <bytes\" line\n",
 269                                     fname, lineno, 0 );
 270 #endif
 271
 272                                 return( 1 );
 273                         }
 274
 275                         max = atol( cargv[1] );
 276
 277                         if( max < 0 ) {
 278 #ifdef NEW_LOGGING
 279                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 280                                            "%s: line %d: invalid max value (%ld) in "
 281                                            "\"sockbuf_max_incoming <bytes>\" line.\n",
 282                                            fname, lineno, max ));
 283 #else
 284                                 Debug( LDAP_DEBUG_ANY,
 285                                         "%s: line %d: invalid max value (%ld) in "
 286                                         "\"sockbuf_max_incoming <bytes>\" line.\n",
 287                                     fname, lineno, max );
 288 #endif
 289
 290                                 return( 1 );
 291                         }
 292
 293                         sockbuf_max_incoming = max;
 294
 295                 /* set sockbuf max authenticated */
 296                 } else if ( strcasecmp( cargv[0], "sockbuf_max_incoming_auth" ) == 0 ) {
 297                         long max;
 298                         if ( cargc < 2 ) {
 299 #ifdef NEW_LOGGING
 300                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 301                                            "%s: line %d: missing max in \"sockbuf_max_incoming_auth <bytes>\" line\n",
 302                                            fname, lineno ));
 303 #else
 304                                 Debug( LDAP_DEBUG_ANY,
 305                                            "%s: line %d: missing max in \"sockbuf_max_incoming_auth <bytes>\" line\n",
 306                                     fname, lineno, 0 );
 307 #endif
 308
 309                                 return( 1 );
 310                         }
 311
 312                         max = atol( cargv[1] );
 313
 314                         if( max < 0 ) {
 315 #ifdef NEW_LOGGING
 316                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 317                                            "%s: line %d: invalid max value (%ld) in "
 318                                            "\"sockbuf_max_incoming_auth <bytes>\" line.\n",
 319                                            fname, lineno, max ));
 320 #else
 321                                 Debug( LDAP_DEBUG_ANY,
 322                                         "%s: line %d: invalid max value (%ld) in "
 323                                         "\"sockbuf_max_incoming_auth <bytes>\" line.\n",
 324                                     fname, lineno, max );
 325 #endif
 326
 327                                 return( 1 );
 328                         }
 329
 330                         sockbuf_max_incoming_auth = max;
 331
 332                 /* default search base */
 333                 } else if ( strcasecmp( cargv[0], "defaultSearchBase" ) == 0 ) {
 334                         if ( cargc < 2 ) {
 335 #ifdef NEW_LOGGING
 336                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 337                                            "%s: line %d: missing dn in \"defaultSearchBase <dn\" "
 338                                            "line\n", fname, lineno ));
 339 #else
 340                                 Debug( LDAP_DEBUG_ANY, "%s: line %d: "
 341                                         "missing dn in \"defaultSearchBase <dn>\" line\n",
 342                                         fname, lineno, 0 );
 343 #endif
 344
 345                                 return 1;
 346
 347                         } else if ( cargc > 2 ) {
 348 #ifdef NEW_LOGGING
 349                                 LDAP_LOG(( "config", LDAP_LEVEL_INFO,
 350                                            "%s: line %d: extra cruft after <dn> in "
 351                                            "\"defaultSearchBase %s\" line (ignored)\n",
 352                                            fname, lineno, cargv[1] ));
 353 #else
 354                                 Debug( LDAP_DEBUG_ANY, "%s: line %d: "
 355                                         "extra cruft after <dn> in \"defaultSearchBase %s\", "
 356                                         "line (ignored)\n",
 357                                         fname, lineno, cargv[1] );
 358 #endif
 359
 360                         }
 361
 362                         if ( bi != NULL || be != NULL ) {
 363 #ifdef NEW_LOGGING
 364                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 365                                            "%s: line %d: defaultSearchBase line must appear "
 366                                            "prior to any backend or database definitions\n",
 367                                            fname, lineno ));
 368 #else
 369                                 Debug( LDAP_DEBUG_ANY, "%s: line %d: "
 370                                         "defaultSearchBaase line must appear prior to "
 371                                         "any backend or database definition\n",
 372                                     fname, lineno, 0 );
 373 #endif
 374
 375                                 return 1;
 376                         }
 377
 378                         if ( default_search_nbase != NULL ) {
 379 #ifdef NEW_LOGGING
 380                                 LDAP_LOG(( "config", LDAP_LEVEL_INFO,
 381                                            "%s: line %d: default search base \"%s\" already defined "
 382                                            "(discarding old)\n", fname, lineno, default_search_base ));
 383 #else
 384                                 Debug( LDAP_DEBUG_ANY, "%s: line %d: "
 385                                         "default search base \"%s\" already defined "
 386                                         "(discarding old)\n",
 387                                         fname, lineno, default_search_base );
 388 #endif
 389
 390                                 free( default_search_base );
 391                                 free( default_search_nbase );
 392                         }
 393
 394                         default_search_base = ch_strdup( cargv[1] );
 395                         default_search_nbase = ch_strdup( cargv[1] );
 396
 397                         if ( load_ucdata( NULL ) < 0 ) {
 398                                 return( 1 );
 399                         }
 400                         if( dn_normalize( default_search_nbase ) == NULL ) {
 401 #ifdef NEW_LOGGING
 402                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 403                                            "%s:  %d: invalid default search base \"%s\"\n",
 404                                            fname, lineno, default_search_base ));
 405 #else
 406                                 Debug( LDAP_DEBUG_ANY, "%s: line %d: "
 407                                         "invalid default search base \"%s\"\n",
 408                                         fname, lineno, default_search_base );
 409 #endif
 410
 411                                 return 1;
 412                         }
 413
 414                 /* set maximum threads in thread pool */
 415                 } else if ( strcasecmp( cargv[0], "threads" ) == 0 ) {
 416                         int c;
 417                         if ( cargc < 2 ) {
 418 #ifdef NEW_LOGGING
 419                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 420                                            "%s: line %d: missing count in \"threads <count>\" line\n",
 421                                            fname, lineno ));
 422 #else
 423                                 Debug( LDAP_DEBUG_ANY,
 424             "%s: line %d: missing count in \"threads <count>\" line\n",
 425                                     fname, lineno, 0 );
 426 #endif
 427
 428                                 return( 1 );
 429                         }
 430
 431                         c = atoi( cargv[1] );
 432
 433                         if( c < 0 ) {
 434 #ifdef NEW_LOGGING
 435                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 436                                            "%s: line %d: invalid level (%d) in \"threads <count>\""
 437                                            "line\n",fname, lineno, c ));
 438 #else
 439                                 Debug( LDAP_DEBUG_ANY,
 440             "%s: line %d: invalid level (%d) in \"threads <count>\" line\n",
 441                                     fname, lineno, c );
 442 #endif
 443
 444                                 return( 1 );
 445                         }
 446
 447                         ldap_pvt_thread_pool_maxthreads( &connection_pool, c );
 448
 449                 /* get pid file name */
 450                 } else if ( strcasecmp( cargv[0], "pidfile" ) == 0 ) {
 451                         if ( cargc < 2 ) {
 452 #ifdef NEW_LOGGING
 453                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 454                                            "%s: line %d missing file name in \"pidfile <file>\" line.\n",
 455                                            fname, lineno ));
 456 #else
 457                                 Debug( LDAP_DEBUG_ANY,
 458             "%s: line %d: missing file name in \"pidfile <file>\" line\n",
 459                                     fname, lineno, 0 );
 460 #endif
 461
 462                                 return( 1 );
 463                         }
 464
 465                         slapd_pid_file = ch_strdup( cargv[1] );
 466
 467                 /* get args file name */
 468                 } else if ( strcasecmp( cargv[0], "argsfile" ) == 0 ) {
 469                         if ( cargc < 2 ) {
 470 #ifdef NEW_LOGGING
 471                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 472                                            "%s: %d: missing file name in "
 473                                            "\"argsfile <file>\" line.\n",
 474                                            fname, lineno ));
 475 #else
 476                                 Debug( LDAP_DEBUG_ANY,
 477             "%s: line %d: missing file name in \"argsfile <file>\" line\n",
 478                                     fname, lineno, 0 );
 479 #endif
 480
 481                                 return( 1 );
 482                         }
 483
 484                         slapd_args_file = ch_strdup( cargv[1] );
 485
 486                 /* default password hash */
 487                 } else if ( strcasecmp( cargv[0], "password-hash" ) == 0 ) {
 488                         if ( cargc < 2 ) {
 489 #ifdef NEW_LOGGING
 490                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 491                                            "%s: line %d: missing hash in "
 492                                            "\"password-hash <hash>\" line.\n",
 493                                            fname, lineno ));
 494 #else
 495                                 Debug( LDAP_DEBUG_ANY,
 496             "%s: line %d: missing hash in \"password-hash <hash>\" line\n",
 497                                     fname, lineno, 0 );
 498 #endif
 499
 500                                 return( 1 );
 501                         }
 502                         if ( default_passwd_hash != NULL ) {
 503 #ifdef NEW_LOGGING
 504                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 505                                            "%s: line %d: already set default password_hash!\n",
 506                                            fname, lineno ));
 507 #else
 508                                 Debug( LDAP_DEBUG_ANY,
 509                                         "%s: line %d: already set default password_hash!\n",
 510                                         fname, lineno, 0 );
 511 #endif
 512
 513                                 return 1;
 514
 515                         } else {
 516                                 default_passwd_hash = ch_strdup( cargv[1] );
 517                         }
 518
 519                 } else if ( strcasecmp( cargv[0], "password-crypt-salt-format" ) == 0 )
 520                 {
 521                         if ( cargc < 2 ) {
 522 #ifdef NEW_LOGGING
 523                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 524                                         "%s: line %d: missing format in "
 525                                         "\"password-crypt-salt-format <format>\" line\n",
 526                                         fname, lineno ));
 527 #else
 528                                 Debug( LDAP_DEBUG_ANY, "%s: line %d: missing format in "
 529                                         "\"password-crypt-salt-format <format>\" line\n",
 530                                     fname, lineno, 0 );
 531 #endif
 532
 533                                 return 1;
 534                         }
 535
 536                         lutil_salt_format( cargv[1] );
 537
 538                 /* set SASL host */
 539                 } else if ( strcasecmp( cargv[0], "sasl-host" ) == 0 ) {
 540                         if ( cargc < 2 ) {
 541 #ifdef NEW_LOGGING
 542                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 543                                            "%s: line %d: missing host in \"sasl-host <host>\" line\n",
 544                                            fname, lineno ));
 545 #else
 546                                 Debug( LDAP_DEBUG_ANY,
 547             "%s: line %d: missing host in \"sasl-host <host>\" line\n",
 548                                     fname, lineno, 0 );
 549 #endif
 550
 551                                 return( 1 );
 552                         }
 553
 554                         if ( global_host != NULL ) {
 555 #ifdef NEW_LOGGING
 556                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 557                                            "%s: line %d: already set sasl-host!\n",
 558                                            fname, lineno ));
 559 #else
 560                                 Debug( LDAP_DEBUG_ANY,
 561                                         "%s: line %d: already set sasl-host!\n",
 562                                         fname, lineno, 0 );
 563 #endif
 564
 565                                 return 1;
 566
 567                         } else {
 568                                 global_host = ch_strdup( cargv[1] );
 569                         }
 570
 571                 /* set SASL realm */
 572                 } else if ( strcasecmp( cargv[0], "sasl-realm" ) == 0 ) {
 573                         if ( cargc < 2 ) {
 574 #ifdef NEW_LOGGING
 575                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 576                                            "%s: line %d: missing realm in \"sasl-realm <realm>\" line.\n",
 577                                            fname, lineno ));
 578 #else
 579                                 Debug( LDAP_DEBUG_ANY,
 580             "%s: line %d: missing realm in \"sasl-realm <realm>\" line\n",
 581                                     fname, lineno, 0 );
 582 #endif
 583
 584                                 return( 1 );
 585                         }
 586
 587                         if ( global_realm != NULL ) {
 588 #ifdef NEW_LOGGING
 589                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 590                                            "%s: line %d: already set sasl-realm!\n",
 591                                            fname, lineno ));
 592 #else
 593                                 Debug( LDAP_DEBUG_ANY,
 594                                         "%s: line %d: already set sasl-realm!\n",
 595                                         fname, lineno, 0 );
 596 #endif
 597
 598                                 return 1;
 599
 600                         } else {
 601                                 global_realm = ch_strdup( cargv[1] );
 602                         }
 603
 604                 } else if ( !strcasecmp( cargv[0], "sasl-regexp" )
 605                         || !strcasecmp( cargv[0], "saslregexp" ) )
 606                 {
 607                         int rc;
 608                         if ( cargc != 3 ) {
 609 #ifdef NEW_LOGGING
 610                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 611                                            "%s: line %d: need 2 args in "
 612                                            "\"saslregexp <match> <replace>\"\n",
 613                                            fname, lineno ));
 614 #else
 615                                 Debug( LDAP_DEBUG_ANY,
 616                                 "%s: line %d: need 2 args in \"saslregexp <match> <replace>\"\n",
 617                                     fname, lineno, 0 );
 618 #endif
 619
 620                                 return( 1 );
 621                         }
 622                         rc = slap_sasl_regexp_config( cargv[1], cargv[2] );
 623                         if ( rc ) {
 624                                 return rc;
 625                         }
 626
 627                 /* SASL security properties */
 628                 } else if ( strcasecmp( cargv[0], "sasl-secprops" ) == 0 ) {
 629                         char *txt;
 630
 631                         if ( cargc < 2 ) {
 632 #ifdef NEW_LOGGING
 633                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 634                                            "%s: line %d: missing flags in "
 635                                            "\"sasl-secprops <properties>\" line\n",
 636                                            fname, lineno ));
 637 #else
 638                                 Debug( LDAP_DEBUG_ANY,
 639             "%s: line %d: missing flags in \"sasl-secprops <properties>\" line\n",
 640                                     fname, lineno, 0 );
 641 #endif
 642
 643                                 return 1;
 644                         }
 645
 646                         txt = slap_sasl_secprops( cargv[1] );
 647                         if ( txt != NULL ) {
 648 #ifdef NEW_LOGGING
 649                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 650                                            "%s: line %d sas-secprops: %s\n",
 651                                            fname, lineno, txt ));
 652 #else
 653                                 Debug( LDAP_DEBUG_ANY,
 654             "%s: line %d: sasl-secprops: %s\n",
 655                                     fname, lineno, txt );
 656 #endif
 657
 658                                 return 1;
 659                         }
 660
 661                 } else if ( strcasecmp( cargv[0], "sasl-external-x509dn-convert" ) == 0 ) {
 662                         sasl_external_x509dn_convert++;
 663
 664                 /* set UCDATA path */
 665                 } else if ( strcasecmp( cargv[0], "ucdata-path" ) == 0 ) {
 666                         int err;
 667                         if ( cargc < 2 ) {
 668 #ifdef NEW_LOGGING
 669                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 670                                            "%s: line %d: missing path in "
 671                                            "\"ucdata-path <path>\" line.\n",
 672                                            fname, lineno ));
 673 #else
 674                                 Debug( LDAP_DEBUG_ANY,
 675             "%s: line %d: missing path in \"ucdata-path <path>\" line\n",
 676                                     fname, lineno, 0 );
 677 #endif
 678
 679                                 return( 1 );
 680                         }
 681
 682                         err = load_ucdata( cargv[1] );
 683                         if ( err <= 0 ) {
 684                                 if ( err == 0 ) {
 685 #ifdef NEW_LOGGING
 686                                         LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 687                                                    "%s: line %d: ucdata already loaded, ucdata-path "
 688                                                    "must be set earlier in the file and/or be "
 689                                                    "specified only once!\n",
 690                                                    fname, lineno ));
 691 #else
 692                                         Debug( LDAP_DEBUG_ANY,
 693                                                "%s: line %d: ucdata already loaded, ucdata-path must be set earlier in the file and/or be specified only once!\n",
 694                                                fname, lineno, 0 );
 695 #endif
 696
 697                                 }
 698                                 return( 1 );
 699                         }
 700
 701                 /* set size limit */
 702                 } else if ( strcasecmp( cargv[0], "sizelimit" ) == 0 ) {
 703                         int rc = 0, i;
 704                         struct slap_limits_set *lim;
 705
 706                         if ( cargc < 2 ) {
 707 #ifdef NEW_LOGGING
 708                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 709                                            "%s: line %d: missing limit in \"sizelimit <limit>\" line.\n",
 710                                            fname, lineno ));
 711 #else
 712                                 Debug( LDAP_DEBUG_ANY,
 713             "%s: line %d: missing limit in \"sizelimit <limit>\" line\n",
 714                                     fname, lineno, 0 );
 715 #endif
 716
 717                                 return( 1 );
 718                         }
 719
 720                         if ( be == NULL ) {
 721                                 lim = &deflimit;
 722                         } else {
 723                                 lim = &be->be_def_limit;
 724                         }
 725
 726                         for ( i = 1; i < cargc; i++ ) {
 727                                 if ( strncasecmp( cargv[i], "size", 4 ) == 0 ) {
 728                                         rc = parse_limit( cargv[i], lim );
 729                                 } else {
 730                                         lim->lms_s_soft = atoi( cargv[i] );
 731                                         lim->lms_s_hard = 0;
 732                                 }
 733
 734                                 if ( rc ) {
 735 #ifdef NEW_LOGGING
 736                                         LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 737                                                    "%s: line %d: unable "
 738                                                    "to parse value \"%s\" "
 739                                                    "in \"sizelimit "
 740                                                    "<limit>\" line.\n",
 741                                                    fname, lineno, cargv[i] ));
 742 #else
 743                                         Debug( LDAP_DEBUG_ANY,
 744                                                 "%s: line %d: unable "
 745                                                 "to parse value \"%s\" "
 746                                                 "in \"sizelimit "
 747                                                 "<limit>\" line\n",
 748                                                 fname, lineno, cargv[i] );
 749 #endif
 750                                 }
 751                         }
 752
 753                 /* set time limit */
 754                 } else if ( strcasecmp( cargv[0], "timelimit" ) == 0 ) {
 755                         int rc = 0, i;
 756                         struct slap_limits_set *lim;
 757
 758                         if ( cargc < 2 ) {
 759 #ifdef NEW_LOGGING
 760                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 761                                            "%s: line %d missing limit in \"timelimit <limit>\" line.\n",
 762                                            fname, lineno ));
 763 #else
 764                                 Debug( LDAP_DEBUG_ANY,
 765             "%s: line %d: missing limit in \"timelimit <limit>\" line\n",
 766                                     fname, lineno, 0 );
 767 #endif
 768
 769                                 return( 1 );
 770                         }
 771
 772                         if ( be == NULL ) {
 773                                 lim = &deflimit;
 774                         } else {
 775                                 lim = &be->be_def_limit;
 776                         }
 777
 778                         for ( i = 1; i < cargc; i++ ) {
 779                                 if ( strncasecmp( cargv[i], "time", 4 ) == 0 ) {
 780                                         rc = parse_limit( cargv[i], lim );
 781                                 } else {
 782                                         lim->lms_t_soft = atoi( cargv[i] );
 783                                         lim->lms_t_hard = 0;
 784                                 }
 785
 786                                 if ( rc ) {
 787 #ifdef NEW_LOGGING
 788                                         LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 789                                                    "%s: line %d: unable "
 790                                                    "to parse value \"%s\" "
 791                                                    "in \"timelimit "
 792                                                    "<limit>\" line.\n",
 793                                                    fname, lineno, cargv[i] ));
 794 #else
 795                                         Debug( LDAP_DEBUG_ANY,
 796                                                 "%s: line %d: unable "
 797                                                 "to parse value \"%s\" "
 798                                                 "in \"timelimit "
 799                                                 "<limit>\" line\n",
 800                                                 fname, lineno, cargv[i] );
 801 #endif
 802                                 }
 803                         }
 804
 805                 /* set regex-based limits */
 806                 } else if ( strcasecmp( cargv[0], "limits" ) == 0 ) {
 807                         if ( be == NULL ) {
 808 #ifdef NEW_LOGGING
 809                                 LDAP_LOG(( "config", LDAP_LEVEL_WARNING,
 810                                            "%s: line %d \"limits\" allowed only in database environment.\n",
 811                                            fname, lineno ));
 812 #else
 813                                 Debug( LDAP_DEBUG_ANY,
 814         "%s: line %d \"limits\" allowed only in database environment.\n%s",
 815                                         fname, lineno, "" );
 816 #endif
 817                                 return( 1 );
 818                         }
 819
 820                         if ( parse_limits( be, fname, lineno, cargc, cargv ) ) {
 821                                 return( 1 );
 822                         }
 823
 824                 /* set database suffix */
 825                 } else if ( strcasecmp( cargv[0], "suffix" ) == 0 ) {
 826                         Backend *tmp_be;
 827                         if ( cargc < 2 ) {
 828 #ifdef NEW_LOGGING
 829                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 830                                            "%s: line %d: missing dn in \"suffix <dn>\" line.\n",
 831                                            fname, lineno ));
 832 #else
 833                                 Debug( LDAP_DEBUG_ANY,
 834                     "%s: line %d: missing dn in \"suffix <dn>\" line\n",
 835                                     fname, lineno, 0 );
 836 #endif
 837
 838                                 return( 1 );
 839                         } else if ( cargc > 2 ) {
 840 #ifdef NEW_LOGGING
 841                                 LDAP_LOG(( "config", LDAP_LEVEL_INFO,
 842                                            "%s: line %d: extra cruft after <dn> in \"suffix %s\""
 843                                            " line (ignored).\n", fname, lineno, cargv[1] ));
 844 #else
 845                                 Debug( LDAP_DEBUG_ANY,
 846     "%s: line %d: extra cruft after <dn> in \"suffix %s\" line (ignored)\n",
 847                                     fname, lineno, cargv[1] );
 848 #endif
 849
 850                         }
 851                         if ( be == NULL ) {
 852 #ifdef NEW_LOGGING
 853                                 LDAP_LOG(( "config", LDAP_LEVEL_INFO,
 854                                            "%s: line %d: suffix line must appear inside a database "
 855                                            "definition (ignored).\n", fname, lineno ));
 856 #else
 857                                 Debug( LDAP_DEBUG_ANY,
 858 "%s: line %d: suffix line must appear inside a database definition (ignored)\n",
 859                                     fname, lineno, 0 );
 860 #endif
 861
 862 #if defined(SLAPD_MONITOR_DN)
 863                         /* "cn=Monitor" is reserved for monitoring slap */
 864                         } else if ( strcasecmp( cargv[1], SLAPD_MONITOR_DN ) == 0 ) {
 865 #ifdef NEW_LOGGING
 866                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 867 "%s: line %d: \"%s\" is reserved for monitoring slapd\n",
 868                                         SLAPD_MONITOR_DN, fname, lineno ));
 869 #else
 870                                 Debug( LDAP_DEBUG_ANY,
 871 "%s: line %d: \"%s\" is reserved for monitoring slapd\n",
 872                                         SLAPD_MONITOR_DN, fname, lineno );
 873 #endif
 874                                 return( 1 );
 875 #endif /* SLAPD_MONITOR_DN */
 876
 877                         } else if ( ( tmp_be = select_backend( cargv[1], 0 ) ) == be ) {
 878 #ifdef NEW_LOGGING
 879                                 LDAP_LOG(( "config", LDAP_LEVEL_INFO,
 880                                            "%s: line %d: suffix already served by this backend "
 881                                            "(ignored)\n", fname, lineno ));
 882 #else
 883                                 Debug( LDAP_DEBUG_ANY,
 884 "%s: line %d: suffix already served by this backend (ignored)\n",
 885                                     fname, lineno, 0 );
 886 #endif
 887
 888                         } else if ( tmp_be  != NULL ) {
 889 #ifdef NEW_LOGGING
 890                                 LDAP_LOG(( "config", LDAP_LEVEL_INFO,
 891                                            "%s: line %d: suffix already served by a preceding "
 892                                            "backend \"%s\" (ignored)\n", fname, lineno,
 893                                            tmp_be->be_suffix[0] ));
 894 #else
 895                                 Debug( LDAP_DEBUG_ANY,
 896 "%s: line %d: suffix already served by a preceeding backend \"%s\" (ignored)\n",
 897                                     fname, lineno, tmp_be->be_suffix[0] );
 898 #endif
 899
 900                         } else {
 901                                 char *dn = ch_strdup( cargv[1] );
 902                                 if ( load_ucdata( NULL ) < 0 ) {
 903                                         return( 1 );
 904                                 }
 905                                 if( dn_validate( dn ) == NULL ) {
 906 #ifdef NEW_LOGGING
 907                                         LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 908                                                    "%s: line %d: suffix DN invalid\"%s\"\n",
 909                                                    fname, lineno, cargv[1] ));
 910 #else
 911                                         Debug( LDAP_DEBUG_ANY, "%s: line %d: "
 912                                                 "suffix DN invalid \"%s\"\n",
 913                                         fname, lineno, cargv[1] );
 914 #endif
 915
 916                                         return 1;
 917
 918                                 } else if( *dn == '\0' && default_search_nbase != NULL ) {
 919 #ifdef NEW_LOGGING
 920                                         LDAP_LOG(( "config", LDAP_LEVEL_INFO,
 921                                                    "%s: line %d: suffix DN empty and default search "
 922                                                    "base provided \"%s\" (assuming okay).\n",
 923                                                    fname, lineno, default_search_base ));
 924 #else
 925                                         Debug( LDAP_DEBUG_ANY, "%s: line %d: "
 926                                                 "suffix DN empty and default "
 927                                                 "search base provided \"%s\" (assuming okay)\n",
 928                                         fname, lineno, default_search_base );
 929 #endif
 930
 931                                 }
 932                                 charray_add( &be->be_suffix, dn );
 933                                 (void) ldap_pvt_str2upper( dn );
 934                                 charray_add( &be->be_nsuffix, dn );
 935                                 free( dn );
 936                         }
 937
 938                 /* set database suffixAlias */
 939                 } else if ( strcasecmp( cargv[0], "suffixAlias" ) == 0 ) {
 940                         Backend *tmp_be;
 941                         if ( cargc < 2 ) {
 942 #ifdef NEW_LOGGING
 943                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 944                                            "%s: line %d: missing alias and aliased_dn in "
 945                                            "\"suffixAlias <alias> <aliased_dn>\" line.\n",
 946                                            fname, lineno ));
 947 #else
 948                                 Debug( LDAP_DEBUG_ANY,
 949 "%s: line %d: missing alias and aliased_dn in \"suffixAlias <alias> <aliased_dn>\" line\n",
 950                                         fname, lineno, 0 );
 951 #endif
 952
 953                                 return( 1 );
 954                         } else if ( cargc < 3 ) {
 955 #ifdef NEW_LOGGING
 956                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 957                                            "%s: line %d: missing aliased_dn in "
 958                                            "\"suffixAlias <alias> <aliased_dn>\" line\n",
 959                                            fname, lineno ));
 960 #else
 961                                 Debug( LDAP_DEBUG_ANY,
 962 "%s: line %d: missing aliased_dn in \"suffixAlias <alias> <aliased_dn>\" line\n",
 963                                 fname, lineno, 0 );
 964 #endif
 965
 966                                 return( 1 );
 967                         } else if ( cargc > 3 ) {
 968 #ifdef NEW_LOGGING
 969                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
 970                                            "%s: line %d: extra cruft in suffixAlias line (ignored)\n",
 971                                            fname, lineno ));
 972 #else
 973                                 Debug( LDAP_DEBUG_ANY,
 974                                         "%s: line %d: extra cruft in suffixAlias line (ignored)\n",
 975                                 fname, lineno, 0 );
 976 #endif
 977
 978                         }
 979
 980                         if ( be == NULL ) {
 981 #ifdef NEW_LOGGING
 982                                 LDAP_LOG(( "config", LDAP_LEVEL_INFO,
 983                                            "%s: line %d: suffixAlias line must appear inside a "
 984                                            "database definition (ignored).\n", fname, lineno ));
 985 #else
 986                                 Debug( LDAP_DEBUG_ANY,
 987                                         "%s: line %d: suffixAlias line"
 988                                         " must appear inside a database definition (ignored)\n",
 989                                         fname, lineno, 0 );
 990 #endif
 991
 992                         } else if ( (tmp_be = select_backend( cargv[1], 0 )) != NULL ) {
 993 #ifdef NEW_LOGGING
 994                                 LDAP_LOG(( "config", LDAP_LEVEL_INFO,
 995                                            "%s: line %d: suffixAlias served by a preceeding "
 996                                            "backend \"%s\" (ignored).\n", fname, lineno,
 997                                            tmp_be->be_suffix[0] ));
 998 #else
 999                                 Debug( LDAP_DEBUG_ANY,
1000                                         "%s: line %d: suffixAlias served by"
1001                                         "  a preceeding backend \"%s\" (ignored)\n",
1002                                         fname, lineno, tmp_be->be_suffix[0] );
1003 #endif
1004
1005
1006                         } else if ( (tmp_be = select_backend( cargv[2], 0 )) != NULL ) {
1007 #ifdef NEW_LOGGING
1008                                 LDAP_LOG(( "config", LDAP_LEVEL_INFO,
1009                                            "%s: line %d: suffixAlias derefs to a different backend "
1010                                            "a preceeding backend \"%s\" (ignored)\n",
1011                                            fname, lineno, tmp_be->be_suffix[0] ));
1012 #else
1013                                 Debug( LDAP_DEBUG_ANY,
1014                                         "%s: line %d: suffixAlias derefs to differnet backend"
1015                                         "  a preceeding backend \"%s\" (ignored)\n",
1016                                         fname, lineno, tmp_be->be_suffix[0] );
1017 #endif
1018
1019
1020                         } else {
1021                                 char *alias, *aliased_dn;
1022
1023                                 alias = ch_strdup( cargv[1] );
1024                                 if ( load_ucdata( NULL ) < 0 ) {
1025                                         return( 1 );
1026                                 }
1027                                 (void) dn_normalize( alias );
1028
1029                                 aliased_dn = ch_strdup( cargv[2] );
1030                                 (void) dn_normalize( aliased_dn );
1031
1032                                 charray_add( &be->be_suffixAlias, alias );
1033                                 charray_add( &be->be_suffixAlias, aliased_dn );
1034
1035                                 free(alias);
1036                                 free(aliased_dn);
1037                         }
1038
1039                /* set max deref depth */
1040                } else if ( strcasecmp( cargv[0], "maxDerefDepth" ) == 0 ) {
1041                                         int i;
1042                        if ( cargc < 2 ) {
1043 #ifdef NEW_LOGGING
1044                                LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1045                                           "%s: line %d: missing depth in \"maxDerefDepth <depth>\""
1046                                           " line\n", fname, lineno ));
1047 #else
1048                                Debug( LDAP_DEBUG_ANY,
1049                    "%s: line %d: missing depth in \"maxDerefDepth <depth>\" line\n",
1050                                    fname, lineno, 0 );
1051 #endif
1052
1053                                return( 1 );
1054                        }
1055                        if ( be == NULL ) {
1056 #ifdef NEW_LOGGING
1057                                LDAP_LOG(( "config", LDAP_LEVEL_INFO,
1058                                           "%s: line %d: depth line must appear inside a database "
1059                                           "definition (ignored)\n", fname, lineno ));
1060 #else
1061                                Debug( LDAP_DEBUG_ANY,
1062 "%s: line %d: depth line must appear inside a database definition (ignored)\n",
1063                                    fname, lineno, 0 );
1064 #endif
1065
1066                        } else if ((i = atoi(cargv[1])) < 0) {
1067 #ifdef NEW_LOGGING
1068                                LDAP_LOG(( "config", LDAP_LEVEL_INFO,
1069                                           "%s: line %d: depth must be positive (ignored).\n",
1070                                           fname, lineno ));
1071 #else
1072                                Debug( LDAP_DEBUG_ANY,
1073 "%s: line %d: depth must be positive (ignored)\n",
1074                                    fname, lineno, 0 );
1075 #endif
1076
1077
1078                        } else {
1079                            be->be_max_deref_depth = i;
1080                                            }
1081
1082
1083                 /* set magic "root" dn for this database */
1084                 } else if ( strcasecmp( cargv[0], "rootdn" ) == 0 ) {
1085                         if ( cargc < 2 ) {
1086 #ifdef NEW_LOGGING
1087                                 LDAP_LOG(( "config", LDAP_LEVEL_INFO,
1088                                            "%s: line %d: missing dn in \"rootdn <dn>\" line.\n",
1089                                            fname, lineno ));
1090 #else
1091                                 Debug( LDAP_DEBUG_ANY,
1092                     "%s: line %d: missing dn in \"rootdn <dn>\" line\n",
1093                                     fname, lineno, 0 );
1094 #endif
1095
1096                                 return( 1 );
1097                         }
1098                         if ( be == NULL ) {
1099 #ifdef NEW_LOGGING
1100                                 LDAP_LOG(( "config", LDAP_LEVEL_INFO,
1101                                            "%s: line %d: rootdn line must appear inside a database "
1102                                            "definition (ignored).\n", fname, lineno ));
1103 #else
1104                                 Debug( LDAP_DEBUG_ANY,
1105 "%s: line %d: rootdn line must appear inside a database definition (ignored)\n",
1106                                     fname, lineno, 0 );
1107 #endif
1108
1109                         } else {
1110                                 be->be_root_dn = ch_strdup( cargv[1] );
1111                                 be->be_root_ndn = ch_strdup( cargv[1] );
1112
1113                                 if ( load_ucdata( NULL ) < 0 ) {
1114                                         return( 1 );
1115                                 }
1116                                 if( dn_normalize( be->be_root_ndn ) == NULL ) {
1117                                         free( be->be_root_dn );
1118                                         free( be->be_root_ndn );
1119 #ifdef NEW_LOGGING
1120                                         LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1121                                                    "%s: line %d: rootdn DN is invalid.\n",
1122                                                    fname, lineno ));
1123 #else
1124                                         Debug( LDAP_DEBUG_ANY,
1125 "%s: line %d: rootdn DN is invalid\n",
1126                                            fname, lineno, 0 );
1127 #endif
1128
1129                                         return( 1 );
1130                                 }
1131                         }
1132
1133                 /* set super-secret magic database password */
1134                 } else if ( strcasecmp( cargv[0], "rootpw" ) == 0 ) {
1135                         if ( cargc < 2 ) {
1136 #ifdef NEW_LOGGING
1137                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1138                                            "%s: line %d: missing passwd in \"rootpw <passwd>\""
1139                                            " line\n", fname, lineno ));
1140 #else
1141                                 Debug( LDAP_DEBUG_ANY,
1142             "%s: line %d: missing passwd in \"rootpw <passwd>\" line\n",
1143                                     fname, lineno, 0 );
1144 #endif
1145
1146                                 return( 1 );
1147                         }
1148                         if ( be == NULL ) {
1149 #ifdef NEW_LOGGING
1150                                 LDAP_LOG(( "config", LDAP_LEVEL_INFO,
1151                                            "%s: line %d: rootpw line must appear inside a database "
1152                                            "definition (ignored)\n", fname, lineno ));
1153 #else
1154                                 Debug( LDAP_DEBUG_ANY,
1155 "%s: line %d: rootpw line must appear inside a database definition (ignored)\n",
1156                                     fname, lineno, 0 );
1157 #endif
1158
1159                         } else {
1160                                 be->be_root_pw.bv_val = ch_strdup( cargv[1] );
1161                                 be->be_root_pw.bv_len = strlen( be->be_root_pw.bv_val );
1162                         }
1163
1164                 /* make this database read-only */
1165                 } else if ( strcasecmp( cargv[0], "readonly" ) == 0 ) {
1166                         if ( cargc < 2 ) {
1167 #ifdef NEW_LOGGING
1168                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1169                                            "%s: line %d: missing on|off in \"readonly <on|off>\" line.\n",
1170                                            fname, lineno ));
1171 #else
1172                                 Debug( LDAP_DEBUG_ANY,
1173             "%s: line %d: missing on|off in \"readonly <on|off>\" line\n",
1174                                     fname, lineno, 0 );
1175 #endif
1176
1177                                 return( 1 );
1178                         }
1179                         if ( be == NULL ) {
1180                                 if ( strcasecmp( cargv[1], "on" ) == 0 ) {
1181                                         global_restrictops |= SLAP_RESTRICT_OP_WRITES;
1182                                 } else {
1183                                         global_restrictops &= ~SLAP_RESTRICT_OP_WRITES;
1184                                 }
1185                         } else {
1186                                 if ( strcasecmp( cargv[1], "on" ) == 0 ) {
1187                                         be->be_restrictops |= SLAP_RESTRICT_OP_WRITES;
1188                                 } else {
1189                                         be->be_restrictops &= ~SLAP_RESTRICT_OP_WRITES;
1190                                 }
1191                         }
1192
1193
1194                 /* allow these features */
1195                 } else if ( strcasecmp( cargv[0], "allows" ) == 0 ||
1196                         strcasecmp( cargv[0], "allow" ) == 0 )
1197                 {
1198                         slap_mask_t     allows;
1199
1200                         if ( be != NULL ) {
1201 #ifdef NEW_LOGGING
1202                                 LDAP_LOG(( "config", LDAP_LEVEL_INFO,
1203                                            "%s: line %d: allow line must appear prior to "
1204                                            "database definitions.\n", fname, lineno ));
1205 #else
1206                                 Debug( LDAP_DEBUG_ANY,
1207 "%s: line %d: allow line must appear prior to database definitions\n",
1208                                     fname, lineno, 0 );
1209 #endif
1210
1211                         }
1212
1213                         if ( cargc < 2 ) {
1214 #ifdef NEW_LOGGING
1215                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1216                                            "%s: line %d: missing feature(s) in \"allow <features>\""
1217                                            " line\n", fname, lineno ));
1218 #else
1219                                 Debug( LDAP_DEBUG_ANY,
1220             "%s: line %d: missing feature(s) in \"allow <features>\" line\n",
1221                                     fname, lineno, 0 );
1222 #endif
1223
1224                                 return( 1 );
1225                         }
1226
1227                         allows = 0;
1228
1229                         for( i=1; i < cargc; i++ ) {
1230                                 if( strcasecmp( cargv[i], "tls_2_anon" ) == 0 ) {
1231                                         allows |= SLAP_ALLOW_TLS_2_ANON;
1232
1233                                 } else if( strcasecmp( cargv[i], "none" ) != 0 ) {
1234 #ifdef NEW_LOGGING
1235                                         LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1236                                                    "%s: line %d: unknown feature %s in "
1237                                                    "\"allow <features>\" line.\n",
1238                                                    fname, lineno, cargv[1] ));
1239 #else
1240                                         Debug( LDAP_DEBUG_ANY,
1241                     "%s: line %d: unknown feature %s in \"allow <features>\" line\n",
1242                                             fname, lineno, cargv[i] );
1243 #endif
1244
1245                                         return( 1 );
1246                                 }
1247                         }
1248
1249                         global_allows = allows;
1250
1251                 /* disallow these features */
1252                 } else if ( strcasecmp( cargv[0], "disallows" ) == 0 ||
1253                         strcasecmp( cargv[0], "disallow" ) == 0 )
1254                 {
1255                         slap_mask_t     disallows;
1256
1257                         if ( be != NULL ) {
1258 #ifdef NEW_LOGGING
1259                                 LDAP_LOG(( "config", LDAP_LEVEL_INFO,
1260                                            "%s: line %d: disallow line must appear prior to "
1261                                            "database definitions.\n", fname, lineno ));
1262 #else
1263                                 Debug( LDAP_DEBUG_ANY,
1264 "%s: line %d: disallow line must appear prior to database definitions\n",
1265                                     fname, lineno, 0 );
1266 #endif
1267
1268                         }
1269
1270                         if ( cargc < 2 ) {
1271 #ifdef NEW_LOGGING
1272                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1273                                            "%s: line %d: missing feature(s) in \"disallow <features>\""
1274                                            " line.\n", fname, lineno ));
1275 #else
1276                                 Debug( LDAP_DEBUG_ANY,
1277             "%s: line %d: missing feature(s) in \"disallow <features>\" line\n",
1278                                     fname, lineno, 0 );
1279 #endif
1280
1281                                 return( 1 );
1282                         }
1283
1284                         disallows = 0;
1285
1286                         for( i=1; i < cargc; i++ ) {
1287                                 if( strcasecmp( cargv[i], "bind_v2" ) == 0 ) {
1288                                         disallows |= SLAP_DISALLOW_BIND_V2;
1289
1290                                 } else if( strcasecmp( cargv[i], "bind_anon" ) == 0 ) {
1291                                         disallows |= SLAP_DISALLOW_BIND_ANON;
1292
1293                                 } else if( strcasecmp( cargv[i], "bind_anon_cred" ) == 0 ) {
1294                                         disallows |= SLAP_DISALLOW_BIND_ANON_CRED;
1295
1296                                 } else if( strcasecmp( cargv[i], "bind_anon_dn" ) == 0 ) {
1297                                         disallows |= SLAP_DISALLOW_BIND_ANON_DN;
1298
1299                                 } else if( strcasecmp( cargv[i], "bind_simple" ) == 0 ) {
1300                                         disallows |= SLAP_DISALLOW_BIND_SIMPLE;
1301
1302                                 } else if( strcasecmp( cargv[i], "bind_krbv4" ) == 0 ) {
1303                                         disallows |= SLAP_DISALLOW_BIND_KRBV4;
1304
1305                                 } else if( strcasecmp( cargv[i], "tls_authc" ) == 0 ) {
1306                                         disallows |= SLAP_DISALLOW_TLS_AUTHC;
1307
1308                                 } else if( strcasecmp( cargv[i], "none" ) != 0 ) {
1309 #ifdef NEW_LOGGING
1310                                         LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1311                                                 "%s: line %d: unknown feature %s in "
1312                                                 "\"disallow <features>\" line.\n",
1313                                                 fname, lineno, cargv[i] ));
1314 #else
1315                                         Debug( LDAP_DEBUG_ANY,
1316                     "%s: line %d: unknown feature %s in \"disallow <features>\" line\n",
1317                                             fname, lineno, cargv[i] );
1318 #endif
1319
1320                                         return( 1 );
1321                                 }
1322                         }
1323
1324                         global_disallows = disallows;
1325
1326                 /* require these features */
1327                 } else if ( strcasecmp( cargv[0], "requires" ) == 0 ||
1328                         strcasecmp( cargv[0], "require" ) == 0 )
1329                 {
1330                         slap_mask_t     requires;
1331
1332                         if ( cargc < 2 ) {
1333 #ifdef NEW_LOGGING
1334                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1335                                            "%s: line %d: missing feature(s) in "
1336                                            "\"require <features>\" line.\n", fname, lineno ));
1337 #else
1338                                 Debug( LDAP_DEBUG_ANY,
1339             "%s: line %d: missing feature(s) in \"require <features>\" line\n",
1340                                     fname, lineno, 0 );
1341 #endif
1342
1343                                 return( 1 );
1344                         }
1345
1346                         requires = 0;
1347
1348                         for( i=1; i < cargc; i++ ) {
1349                                 if( strcasecmp( cargv[i], "bind" ) == 0 ) {
1350                                         requires |= SLAP_REQUIRE_BIND;
1351
1352                                 } else if( strcasecmp( cargv[i], "LDAPv3" ) == 0 ) {
1353                                         requires |= SLAP_REQUIRE_LDAP_V3;
1354
1355                                 } else if( strcasecmp( cargv[i], "authc" ) == 0 ) {
1356                                         requires |= SLAP_REQUIRE_AUTHC;
1357
1358                                 } else if( strcasecmp( cargv[i], "SASL" ) == 0 ) {
1359                                         requires |= SLAP_REQUIRE_SASL;
1360
1361                                 } else if( strcasecmp( cargv[i], "strong" ) == 0 ) {
1362                                         requires |= SLAP_REQUIRE_STRONG;
1363
1364                                 } else if( strcasecmp( cargv[i], "none" ) != 0 ) {
1365 #ifdef NEW_LOGGING
1366                                         LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1367                                                    "%s: line %d: unknown feature %s in "
1368                                                    "\"require <features>\" line.\n",
1369                                                    fname, lineno ));
1370 #else
1371                                         Debug( LDAP_DEBUG_ANY,
1372                     "%s: line %d: unknown feature %s in \"require <features>\" line\n",
1373                                             fname, lineno, cargv[i] );
1374 #endif
1375
1376                                         return( 1 );
1377                                 }
1378                         }
1379
1380                         if ( be == NULL ) {
1381                                 global_requires = requires;
1382                         } else {
1383                                 be->be_requires = requires;
1384                         }
1385
1386                 /* required security factors */
1387                 } else if ( strcasecmp( cargv[0], "security" ) == 0 ) {
1388                         slap_ssf_set_t *set;
1389
1390                         if ( cargc < 2 ) {
1391 #ifdef NEW_LOGGING
1392                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1393                                            "%s: line %d: missing factor(s) in \"security <factors>\""
1394                                            " line.\n", fname, lineno ));
1395 #else
1396                                 Debug( LDAP_DEBUG_ANY,
1397             "%s: line %d: missing factor(s) in \"security <factors>\" line\n",
1398                                     fname, lineno, 0 );
1399 #endif
1400
1401                                 return( 1 );
1402                         }
1403
1404                         if ( be == NULL ) {
1405                                 set = &global_ssf_set;
1406                         } else {
1407                                 set = &be->be_ssf_set;
1408                         }
1409
1410                         for( i=1; i < cargc; i++ ) {
1411                                 if( strncasecmp( cargv[i], "ssf=",
1412                                         sizeof("ssf") ) == 0 )
1413                                 {
1414                                         set->sss_ssf =
1415                                                 atoi( &cargv[i][sizeof("ssf")] );
1416
1417                                 } else if( strncasecmp( cargv[i], "transport=",
1418                                         sizeof("transport") ) == 0 )
1419                                 {
1420                                         set->sss_transport =
1421                                                 atoi( &cargv[i][sizeof("transport")] );
1422
1423                                 } else if( strncasecmp( cargv[i], "tls=",
1424                                         sizeof("tls") ) == 0 )
1425                                 {
1426                                         set->sss_tls =
1427                                                 atoi( &cargv[i][sizeof("tls")] );
1428
1429                                 } else if( strncasecmp( cargv[i], "sasl=",
1430                                         sizeof("sasl") ) == 0 )
1431                                 {
1432                                         set->sss_sasl =
1433                                                 atoi( &cargv[i][sizeof("sasl")] );
1434
1435                                 } else if( strncasecmp( cargv[i], "update_ssf=",
1436                                         sizeof("update_ssf") ) == 0 )
1437                                 {
1438                                         set->sss_update_ssf =
1439                                                 atoi( &cargv[i][sizeof("update_ssf")] );
1440
1441                                 } else if( strncasecmp( cargv[i], "update_transport=",
1442                                         sizeof("update_transport") ) == 0 )
1443                                 {
1444                                         set->sss_update_transport =
1445                                                 atoi( &cargv[i][sizeof("update_transport")] );
1446
1447                                 } else if( strncasecmp( cargv[i], "update_tls=",
1448                                         sizeof("update_tls") ) == 0 )
1449                                 {
1450                                         set->sss_update_tls =
1451                                                 atoi( &cargv[i][sizeof("update_tls")] );
1452
1453                                 } else if( strncasecmp( cargv[i], "update_sasl=",
1454                                         sizeof("update_sasl") ) == 0 )
1455                                 {
1456                                         set->sss_update_sasl =
1457                                                 atoi( &cargv[i][sizeof("update_sasl")] );
1458
1459                                 } else {
1460 #ifdef NEW_LOGGING
1461                                         LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1462                                                    "%s: line %d: unknown factor %S in "
1463                                                    "\"security <factors>\" line.\n",
1464                                                    fname, lineno, cargv[1] ));
1465 #else
1466                                         Debug( LDAP_DEBUG_ANY,
1467                     "%s: line %d: unknown factor %s in \"security <factors>\" line\n",
1468                                             fname, lineno, cargv[i] );
1469 #endif
1470
1471                                         return( 1 );
1472                                 }
1473                         }
1474                 /* where to send clients when we don't hold it */
1475                 } else if ( strcasecmp( cargv[0], "referral" ) == 0 ) {
1476                         if ( cargc < 2 ) {
1477 #ifdef NEW_LOGGING
1478                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1479                                            "%s: line %d: missing URL in \"referral <URL>\""
1480                                            " line.\n", fname, lineno ));
1481 #else
1482                                 Debug( LDAP_DEBUG_ANY,
1483                     "%s: line %d: missing URL in \"referral <URL>\" line\n",
1484                                     fname, lineno, 0 );
1485 #endif
1486
1487                                 return( 1 );
1488                         }
1489
1490                         vals[0]->bv_val = cargv[1];
1491                         vals[0]->bv_len = strlen( vals[0]->bv_val );
1492                         value_add( &default_referral, vals );
1493
1494 #ifdef NEW_LOGGING
1495                 } else if ( strcasecmp( cargv[0], "logfile" ) == 0 ) {
1496                         FILE *logfile;
1497                         if ( cargc < 2 ) {
1498 #ifdef NEW_LOGGING
1499                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1500                                            "%s: line %d: Error in logfile directive, "
1501                                            "\"logfile <filename>\"\n", fname, lineno ));
1502 #else
1503                                 Debug( LDAP_DEBUG_ANY,
1504                                        "%s: line %d: Error in logfile directive, \"logfile filename\"\n",
1505                                        fname, lineno, 0 );
1506 #endif
1507
1508                                 return( 1 );
1509                         }
1510                         logfile = fopen( cargv[1], "w" );
1511                         if ( logfile != NULL ) lutil_debug_file( logfile );
1512
1513 #endif
1514                 /* start of a new database definition */
1515                 } else if ( strcasecmp( cargv[0], "debug" ) == 0 ) {
1516                         int level;
1517                         if ( cargc < 3 ) {
1518 #ifdef NEW_LOGGING
1519                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1520                                            "%s: line %d: Error in debug directive, "
1521                                            "\"debug <subsys> <level>\"\n", fname, lineno ));
1522 #else
1523                                 Debug( LDAP_DEBUG_ANY,
1524                                         "%s: line %d: Error in debug directive, \"debug subsys level\"\n",
1525                                         fname, lineno, 0 );
1526 #endif
1527
1528                                 return( 1 );
1529                         }
1530                         level = atoi( cargv[2] );
1531                         if ( level <= 0 ) level = lutil_mnem2level( cargv[2] );
1532                         lutil_set_debug_level( cargv[1], level );
1533                 /* specify an Object Identifier macro */
1534                 } else if ( strcasecmp( cargv[0], "objectidentifier" ) == 0 ) {
1535                         rc = parse_oidm( fname, lineno, cargc, cargv );
1536                         if( rc ) return rc;
1537
1538                 /* specify an objectclass */
1539                 } else if ( strcasecmp( cargv[0], "objectclass" ) == 0 ) {
1540                         if ( *cargv[1] == '(' ) {
1541                                 char * p;
1542                                 p = strchr(saveline,'(');
1543                                 rc = parse_oc( fname, lineno, p, cargv );
1544                                 if( rc ) return rc;
1545
1546                         } else {
1547 #ifdef NEW_LOGGING
1548                                 LDAP_LOG(( "config", LDAP_LEVEL_INFO,
1549                                            "%s: line %d: old objectclass format not supported\n",
1550                                            fname, lineno ));
1551 #else
1552                                 Debug( LDAP_DEBUG_ANY,
1553                                        "%s: line %d: old objectclass format not supported.\n",
1554                                        fname, lineno, 0 );
1555 #endif
1556
1557                         }
1558
1559                 /* specify an attribute type */
1560                 } else if (( strcasecmp( cargv[0], "attributetype" ) == 0 )
1561                         || ( strcasecmp( cargv[0], "attribute" ) == 0 ))
1562                 {
1563                         if ( *cargv[1] == '(' ) {
1564                                 char * p;
1565                                 p = strchr(saveline,'(');
1566                                 rc = parse_at( fname, lineno, p, cargv );
1567                                 if( rc ) return rc;
1568
1569                         } else {
1570 #ifdef NEW_LOGGING
1571                                 LDAP_LOG(( "config", LDAP_LEVEL_INFO,
1572                                            "%s: line %d: old attribute type format not supported.\n",
1573                                            fname, lineno ));
1574 #else
1575                                 Debug( LDAP_DEBUG_ANY,
1576     "%s: line %d: old attribute type format not supported.\n",
1577                                     fname, lineno, 0 );
1578 #endif
1579
1580                         }
1581
1582                 /* turn on/off schema checking */
1583                 } else if ( strcasecmp( cargv[0], "schemacheck" ) == 0 ) {
1584                         if ( cargc < 2 ) {
1585 #ifdef NEW_LOGGING
1586                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1587                                            "%s: line %d: missing on|off in "
1588                                            "\"schemacheck <on|off>\" line.\n",
1589                                            fname, lineno ));
1590 #else
1591                                 Debug( LDAP_DEBUG_ANY,
1592     "%s: line %d: missing on|off in \"schemacheck <on|off>\" line\n",
1593                                     fname, lineno, 0 );
1594 #endif
1595
1596                                 return( 1 );
1597                         }
1598                         if ( strcasecmp( cargv[1], "off" ) == 0 ) {
1599                                 global_schemacheck = 0;
1600                         } else {
1601                                 global_schemacheck = 1;
1602                         }
1603
1604                 /* specify access control info */
1605                 } else if ( strcasecmp( cargv[0], "access" ) == 0 ) {
1606                         parse_acl( be, fname, lineno, cargc, cargv );
1607
1608                 /* debug level to log things to syslog */
1609                 } else if ( strcasecmp( cargv[0], "loglevel" ) == 0 ) {
1610                         if ( cargc < 2 ) {
1611 #ifdef NEW_LOGGING
1612                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1613                                            "%s: line %d: missing level in \"loglevel <level>\""
1614                                            " line.\n", fname, lineno ));
1615 #else
1616                                 Debug( LDAP_DEBUG_ANY,
1617                     "%s: line %d: missing level in \"loglevel <level>\" line\n",
1618                                     fname, lineno, 0 );
1619 #endif
1620
1621                                 return( 1 );
1622                         }
1623
1624                         ldap_syslog = 0;
1625
1626                         for( i=1; i < cargc; i++ ) {
1627                                 ldap_syslog += atoi( cargv[1] );
1628                         }
1629
1630                 /* list of replicas of the data in this backend (master only) */
1631                 } else if ( strcasecmp( cargv[0], "replica" ) == 0 ) {
1632                         if ( cargc < 2 ) {
1633 #ifdef NEW_LOGGING
1634                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1635                                            "%s: line %d: missing host in \"replica "
1636                                            " <host[:port]\" line\n", fname, lineno ));
1637 #else
1638                                 Debug( LDAP_DEBUG_ANY,
1639             "%s: line %d: missing host in \"replica <host[:port]>\" line\n",
1640                                     fname, lineno, 0 );
1641 #endif
1642
1643                                 return( 1 );
1644                         }
1645                         if ( be == NULL ) {
1646 #ifdef NEW_LOGGING
1647                                 LDAP_LOG(( "config", LDAP_LEVEL_INFO,
1648                                            "%s: line %d: replica line must appear inside "
1649                                            "a database definition (ignored).\n", fname, lineno ));
1650 #else
1651                                 Debug( LDAP_DEBUG_ANY,
1652 "%s: line %d: replica line must appear inside a database definition (ignored)\n",
1653                                     fname, lineno, 0 );
1654 #endif
1655
1656                         } else {
1657                                 int nr = -1;
1658
1659                                 for ( i = 1; i < cargc; i++ ) {
1660                                         if ( strncasecmp( cargv[i], "host=", 5 )
1661                                             == 0 ) {
1662                                                 nr = add_replica_info( be,
1663                                                         cargv[i] + 5 );
1664                                                 break;
1665                                         }
1666                                 }
1667                                 if ( i == cargc ) {
1668 #ifdef NEW_LOGGING
1669                                         LDAP_LOG(( "config", LDAP_LEVEL_INFO,
1670                                                    "%s: line %d: missing host in \"replica\" "
1671                                                    "line (ignored)\n", fname, lineno ));
1672 #else
1673                                         Debug( LDAP_DEBUG_ANY,
1674                     "%s: line %d: missing host in \"replica\" line (ignored)\n",
1675                                             fname, lineno, 0 );
1676 #endif
1677
1678                                 } else if ( nr == -1 ) {
1679 #ifdef NEW_LOGGING
1680                                         LDAP_LOG(( "config", LDAP_LEVEL_INFO,
1681                                                    "%s: line %d: unable to add"
1682                                                    " replica \"%s\""
1683                                                    " (ignored)\n",
1684                                                    fname, lineno,
1685                                                    cargv[i] + 5 ));
1686 #else
1687                                         Debug( LDAP_DEBUG_ANY,
1688                 "%s: line %d: unable to add replica \"%s\" (ignored)\n",
1689                                                 fname, lineno, cargv[i] + 5 );
1690 #endif
1691                                 } else {
1692                                         for ( i = 1; i < cargc; i++ ) {
1693                                                 if ( strncasecmp( cargv[i], "suffix=", 7 ) == 0 ) {
1694                                                         char *nsuffix = ch_strdup( cargv[i] + 7 );
1695                                                         if ( dn_normalize( nsuffix ) != NULL ) {
1696                                                                 if ( select_backend( nsuffix, 0 ) == be ) {
1697                                                                         charray_add( &be->be_replica[nr]->ri_nsuffix, nsuffix );
1698                                                                 } else {
1699 #ifdef NEW_LOGGING
1700                                                                         LDAP_LOG(( "config", LDAP_LEVEL_INFO,
1701                                                                                                 "%s: line %d: suffix \"%s\" in \"replica\" line is not valid for backend (ignored)\n",
1702                                                                                                 fname, lineno, cargv[i] + 7 ));
1703 #else
1704                                                                         Debug( LDAP_DEBUG_ANY,
1705                                                                                         "%s: line %d: suffix \"%s\" in \"replica\" line is not valid for backend (ignored)\n",
1706                                                                                         fname, lineno, cargv[i] + 7 );
1707 #endif
1708                                                                 }
1709                                                         } else {
1710 #ifdef NEW_LOGGING
1711                                                                 LDAP_LOG(( "config", LDAP_LEVEL_INFO,
1712                                                                                         "%s: line %d: unable to normalize suffix in \"replica\" line (ignored)\n",
1713                                                                                         fname, lineno ));
1714 #else
1715                                                                 Debug( LDAP_DEBUG_ANY,
1716                                                                                  "%s: line %d: unable to normalize suffix in \"replica\" line (ignored)\n",
1717                                                                                  fname, lineno, 0 );
1718 #endif
1719                                                         }
1720                                                         free( nsuffix );
1721                                                 }
1722                                         }
1723                                 }
1724                         }
1725
1726                 /* dn of master entity allowed to write to replica */
1727                 } else if ( strcasecmp( cargv[0], "updatedn" ) == 0 ) {
1728                         if ( cargc < 2 ) {
1729 #ifdef NEW_LOGGING
1730                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1731                                            "%s: line %d: missing dn in \"updatedn <dn>\""
1732                                            " line.\n", fname, lineno ));
1733 #else
1734                                 Debug( LDAP_DEBUG_ANY,
1735                     "%s: line %d: missing dn in \"updatedn <dn>\" line\n",
1736                                     fname, lineno, 0 );
1737 #endif
1738
1739                                 return( 1 );
1740                         }
1741                         if ( be == NULL ) {
1742 #ifdef NEW_LOGGING
1743                                 LDAP_LOG(( "config", LDAP_LEVEL_INFO,
1744                                            "%s: line %d: updatedn line must appear inside "
1745                                            "a database definition (ignored)\n",
1746                                            fname, lineno ));
1747 #else
1748                                 Debug( LDAP_DEBUG_ANY,
1749 "%s: line %d: updatedn line must appear inside a database definition (ignored)\n",
1750                                     fname, lineno, 0 );
1751 #endif
1752
1753                         } else {
1754                                 be->be_update_ndn = ch_strdup( cargv[1] );
1755                                 if ( load_ucdata( NULL ) < 0 ) {
1756                                         return( 1 );
1757                                 }
1758                                 if( dn_normalize( be->be_update_ndn ) == NULL ) {
1759 #ifdef NEW_LOGGING
1760                                         LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1761                                                    "%s: line %d: updatedn DN is invalid.\n",
1762                                                    fname, lineno ));
1763 #else
1764                                         Debug( LDAP_DEBUG_ANY,
1765 "%s: line %d: updatedn DN is invalid\n",
1766                                             fname, lineno, 0 );
1767 #endif
1768
1769                                         return 1;
1770                                 }
1771                         }
1772
1773                 } else if ( strcasecmp( cargv[0], "updateref" ) == 0 ) {
1774                         if ( cargc < 2 ) {
1775 #ifdef NEW_LOGGING
1776                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1777                                            "%s: line %d: missing dn in \"updateref <ldapurl>\" "
1778                                            "line.\n", fname, lineno ));
1779 #else
1780                                 Debug( LDAP_DEBUG_ANY,
1781                     "%s: line %d: missing dn in \"updateref <ldapurl>\" line\n",
1782                                     fname, lineno, 0 );
1783 #endif
1784
1785                                 return( 1 );
1786                         }
1787                         if ( be == NULL ) {
1788 #ifdef NEW_LOGGING
1789                                 LDAP_LOG(( "config", LDAP_LEVEL_INFO,
1790                                            "%s: line %d: updateref line must appear inside "
1791                                            "a database definition (ignored)\n", fname, lineno ));
1792 #else
1793                                 Debug( LDAP_DEBUG_ANY,
1794 "%s: line %d: updateref line must appear inside a database definition (ignored)\n",
1795                                     fname, lineno, 0 );
1796 #endif
1797
1798                         } else if ( be->be_update_ndn == NULL ) {
1799 #ifdef NEW_LOGGING
1800                                 LDAP_LOG(( "config", LDAP_LEVEL_INFO,
1801                                            "%s: line %d: updateref line must come after updatedn "
1802                                            "(ignored).\n", fname, lineno ));
1803 #else
1804                                 Debug( LDAP_DEBUG_ANY,
1805 "%s: line %d: updateref line must after updatedn (ignored)\n",
1806                                     fname, lineno, 0 );
1807 #endif
1808
1809                         } else {
1810                                 vals[0]->bv_val = cargv[1];
1811                                 vals[0]->bv_len = strlen( vals[0]->bv_val );
1812                                 value_add( &be->be_update_refs, vals );
1813                         }
1814
1815                 /* replication log file to which changes are appended */
1816                 } else if ( strcasecmp( cargv[0], "replogfile" ) == 0 ) {
1817                         if ( cargc < 2 ) {
1818 #ifdef NEW_LOGGING
1819                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1820                                            "%s: line %d: missing filename in \"replogfile <filename>\""
1821                                            " line.\n", fname, lineno ));
1822 #else
1823                                 Debug( LDAP_DEBUG_ANY,
1824             "%s: line %d: missing dn in \"replogfile <filename>\" line\n",
1825                                     fname, lineno, 0 );
1826 #endif
1827
1828                                 return( 1 );
1829                         }
1830                         if ( be ) {
1831                                 be->be_replogfile = ch_strdup( cargv[1] );
1832                         } else {
1833                                 replogfile = ch_strdup( cargv[1] );
1834                         }
1835
1836                 /* maintain lastmodified{by,time} attributes */
1837                 } else if ( strcasecmp( cargv[0], "lastmod" ) == 0 ) {
1838                         if ( cargc < 2 ) {
1839 #ifdef NEW_LOGGING
1840                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1841                                            "%s: line %d: missing on|off in \"lastmod <on|off>\""
1842                                            " line.\n", fname, lineno ));
1843 #else
1844                                 Debug( LDAP_DEBUG_ANY,
1845             "%s: line %d: missing on|off in \"lastmod <on|off>\" line\n",
1846                                     fname, lineno, 0 );
1847 #endif
1848
1849                                 return( 1 );
1850                         }
1851                         if ( strcasecmp( cargv[1], "on" ) == 0 ) {
1852                                 if ( be )
1853                                         be->be_lastmod = ON;
1854                                 else
1855                                         global_lastmod = ON;
1856                         } else {
1857                                 if ( be )
1858                                         be->be_lastmod = OFF;
1859                                 else
1860                                         global_lastmod = OFF;
1861                         }
1862
1863                 /* set idle timeout value */
1864                 } else if ( strcasecmp( cargv[0], "idletimeout" ) == 0 ) {
1865                         int i;
1866                         if ( cargc < 2 ) {
1867 #ifdef NEW_LOGGING
1868                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1869                                            "%s: line %d: missing timeout value in "
1870                                            "\"idletimeout <seconds>\" line.\n", fname, lineno ));
1871 #else
1872                                 Debug( LDAP_DEBUG_ANY,
1873             "%s: line %d: missing timeout value in \"idletimeout <seconds>\" line\n",
1874                                     fname, lineno, 0 );
1875 #endif
1876
1877                                 return( 1 );
1878                         }
1879
1880                         i = atoi( cargv[1] );
1881
1882                         if( i < 0 ) {
1883 #ifdef NEW_LOGGING
1884                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1885                                            "%s: line %d: timeout value (%d) invalid "
1886                                            "\"idletimeout <seconds>\" line.\n",
1887                                            fname, lineno, i ));
1888 #else
1889                                 Debug( LDAP_DEBUG_ANY,
1890             "%s: line %d: timeout value (%d) invalid \"idletimeout <seconds>\" line\n",
1891                                     fname, lineno, i );
1892 #endif
1893
1894                                 return( 1 );
1895                         }
1896
1897                         global_idletimeout = i;
1898
1899                 /* include another config file */
1900                 } else if ( strcasecmp( cargv[0], "include" ) == 0 ) {
1901                         if ( cargc < 2 ) {
1902 #ifdef NEW_LOGGING
1903                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1904                                            "%s: line %d: missing filename in \"include "
1905                                            "<filename>\" line.\n", fname, lineno ));
1906 #else
1907                                 Debug( LDAP_DEBUG_ANY,
1908     "%s: line %d: missing filename in \"include <filename>\" line\n",
1909                                     fname, lineno, 0 );
1910 #endif
1911
1912                                 return( 1 );
1913                         }
1914                         savefname = ch_strdup( cargv[1] );
1915                         savelineno = lineno;
1916
1917                         if ( read_config( savefname ) != 0 ) {
1918                                 return( 1 );
1919                         }
1920
1921                         free( savefname );
1922                         lineno = savelineno - 1;
1923
1924                 /* location of kerberos srvtab file */
1925                 } else if ( strcasecmp( cargv[0], "srvtab" ) == 0 ) {
1926                         if ( cargc < 2 ) {
1927 #ifdef NEW_LOGGING
1928                                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1929                                            "%s: line %d: missing filename in \"srvtab "
1930                                            "<filename>\" line.\n", fname, lineno ));
1931 #else
1932                                 Debug( LDAP_DEBUG_ANY,
1933             "%s: line %d: missing filename in \"srvtab <filename>\" line\n",
1934                                     fname, lineno, 0 );
1935 #endif
1936
1937                                 return( 1 );
1938                         }
1939                         ldap_srvtab = ch_strdup( cargv[1] );
1940
1941 #ifdef SLAPD_MODULES
1942                 } else if (strcasecmp( cargv[0], "moduleload") == 0 ) {
1943                    if ( cargc < 2 ) {
1944 #ifdef NEW_LOGGING
1945                            LDAP_LOG(( "config", LDAP_LEVEL_INFO,
1946                                       "%s: line %d: missing filename in \"moduleload "
1947                                       "<filename>\" line.\n", fname, lineno ));
1948 #else
1949                       Debug( LDAP_DEBUG_ANY,
1950                              "%s: line %d: missing filename in \"moduleload <filename>\" line\n",
1951                              fname, lineno, 0 );
1952 #endif
1953
1954                       exit( EXIT_FAILURE );
1955                    }
1956                    if (module_load(cargv[1], cargc - 2, (cargc > 2) ? cargv + 2 : NULL)) {
1957 #ifdef NEW_LOGGING
1958                            LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
1959                                       "%s: line %d: failed to load or initialize module %s\n"<
1960                                       fname, lineno, cargv[1] ));
1961 #else
1962                       Debug( LDAP_DEBUG_ANY,
1963                              "%s: line %d: failed to load or initialize module %s\n",
1964                              fname, lineno, cargv[1]);
1965 #endif
1966
1967                       exit( EXIT_FAILURE );
1968                    }
1969                 } else if (strcasecmp( cargv[0], "modulepath") == 0 ) {
1970                    if ( cargc != 2 ) {
1971 #ifdef NEW_LOGGING
1972                            LDAP_LOG(( "config", LDAP_LEVEL_INFO,
1973                                       "%s: line %d: missing path in \"modulepath <path>\""
1974                                       " line\n", fname, lineno ));
1975 #else
1976                       Debug( LDAP_DEBUG_ANY,
1977                              "%s: line %d: missing path in \"modulepath <path>\" line\n",
1978                              fname, lineno, 0 );
1979 #endif
1980
1981                       exit( EXIT_FAILURE );
1982                    }
1983                    if (module_path( cargv[1] )) {
1984 #ifdef NEW_LOGGING
1985                            LDAP_LOG(( "cofig", LDAP_LEVEL_CRIT,
1986                                       "%s: line %d: failed to set module search path to %s.\n",
1987                                       fname, lineno, cargv[1] ));
1988 #else
1989                            Debug( LDAP_DEBUG_ANY,
1990                                   "%s: line %d: failed to set module search path to %s\n",
1991                                   fname, lineno, cargv[1]);
1992 #endif
1993
1994                       exit( EXIT_FAILURE );
1995                    }
1996
1997 #endif /*SLAPD_MODULES*/
1998
1999 #ifdef HAVE_TLS
2000                 } else if ( !strcasecmp( cargv[0], "TLSRandFile" ) ) {
2001                         rc = ldap_pvt_tls_set_option( NULL,
2002                                                       LDAP_OPT_X_TLS_RANDOM_FILE,
2003                                                       cargv[1] );
2004                         if ( rc )
2005                                 return rc;
2006
2007                 } else if ( !strcasecmp( cargv[0], "TLSCipherSuite" ) ) {
2008                         rc = ldap_pvt_tls_set_option( NULL,
2009                                                       LDAP_OPT_X_TLS_CIPHER_SUITE,
2010                                                       cargv[1] );
2011                         if ( rc )
2012                                 return rc;
2013
2014                 } else if ( !strcasecmp( cargv[0], "TLSCertificateFile" ) ) {
2015                         rc = ldap_pvt_tls_set_option( NULL,
2016                                                       LDAP_OPT_X_TLS_CERTFILE,
2017                                                       cargv[1] );
2018                         if ( rc )
2019                                 return rc;
2020
2021                 } else if ( !strcasecmp( cargv[0], "TLSCertificateKeyFile" ) ) {
2022                         rc = ldap_pvt_tls_set_option( NULL,
2023                                                       LDAP_OPT_X_TLS_KEYFILE,
2024                                                       cargv[1] );
2025                         if ( rc )
2026                                 return rc;
2027
2028                 } else if ( !strcasecmp( cargv[0], "TLSCACertificatePath" ) ) {
2029                         rc = ldap_pvt_tls_set_option( NULL,
2030                                                       LDAP_OPT_X_TLS_CACERTDIR,
2031                                                       cargv[1] );
2032                         if ( rc )
2033                                 return rc;
2034
2035                 } else if ( !strcasecmp( cargv[0], "TLSCACertificateFile" ) ) {
2036                         rc = ldap_pvt_tls_set_option( NULL,
2037                                                       LDAP_OPT_X_TLS_CACERTFILE,
2038                                                       cargv[1] );
2039                         if ( rc )
2040                                 return rc;
2041                 } else if ( !strcasecmp( cargv[0], "TLSVerifyClient" ) ) {
2042                         i = atoi(cargv[1]);
2043                         rc = ldap_pvt_tls_set_option( NULL,
2044                                                       LDAP_OPT_X_TLS_REQUIRE_CERT,
2045                                                       &i );
2046                         if ( rc )
2047                                 return rc;
2048
2049 #endif
2050
2051                 /* pass anything else to the current backend info/db config routine */
2052                 } else {
2053                         if ( bi != NULL ) {
2054                                 if ( bi->bi_config == 0 ) {
2055 #ifdef NEW_LOGGING
2056                                         LDAP_LOG(( "config", LDAP_LEVEL_INFO,
2057                                                    "%s: line %d: unknown directive \"%s\" inside "
2058                                                    "backend info definition (ignored).\n",
2059                                                    fname, lineno, cargv[0] ));
2060 #else
2061                                         Debug( LDAP_DEBUG_ANY,
2062 "%s: line %d: unknown directive \"%s\" inside backend info definition (ignored)\n",
2063                                                 fname, lineno, cargv[0] );
2064 #endif
2065
2066                                 } else {
2067                                         if ( (*bi->bi_config)( bi, fname, lineno, cargc, cargv )
2068                                                 != 0 )
2069                                         {
2070                                                 return( 1 );
2071                                         }
2072                                 }
2073                         } else if ( be != NULL ) {
2074                                 if ( be->be_config == 0 ) {
2075 #ifdef NEW_LOGGING
2076                                         LDAP_LOG(( "config", LDAP_LEVEL_INFO,
2077                                                    "%s: line %d: uknown directive \"%s\" inside "
2078                                                    "backend database definition (ignored).\n",
2079                                                    fname, lineno, cargv[0] ));
2080 #else
2081                                         Debug( LDAP_DEBUG_ANY,
2082 "%s: line %d: unknown directive \"%s\" inside backend database definition (ignored)\n",
2083                                         fname, lineno, cargv[0] );
2084 #endif
2085
2086                                 } else {
2087                                         if ( (*be->be_config)( be, fname, lineno, cargc, cargv )
2088                                                 != 0 )
2089                                         {
2090                                                 return( 1 );
2091                                         }
2092                                 }
2093                         } else {
2094 #ifdef NEW_LOGGING
2095                                 LDAP_LOG(( "config", LDAP_LEVEL_INFO,
2096                                            "%s: line %d: unknown directive \"%s\" outside backend "
2097                                            "info and database definitions (ignored).\n",
2098                                            fname, lineno, cargv[0] ));
2099 #else
2100                                 Debug( LDAP_DEBUG_ANY,
2101 "%s: line %d: unknown directive \"%s\" outside backend info and database definitions (ignored)\n",
2102                                     fname, lineno, cargv[0] );
2103 #endif
2104
2105                         }
2106                 }
2107                 free( saveline );
2108         }
2109         fclose( fp );
2110         if ( load_ucdata( NULL ) < 0 ) {
2111                 return( 1 );
2112         }
2113         return( 0 );
2114 }
2115
2116 static int
2117 fp_parse_line(
2118     char        *line,
2119     int         *argcp,
2120     char        **argv
2121 )
2122 {
2123         char *  token;
2124
2125         *argcp = 0;
2126         for ( token = strtok_quote( line, " \t" ); token != NULL;
2127             token = strtok_quote( NULL, " \t" ) ) {
2128                 if ( *argcp == MAXARGS ) {
2129 #ifdef NEW_LOGGING
2130                         LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
2131                                    "fp_parse_line: too many tokens (%d max).\n",
2132                                    MAXARGS ));
2133 #else
2134                         Debug( LDAP_DEBUG_ANY, "Too many tokens (max %d)\n",
2135                             MAXARGS, 0, 0 );
2136 #endif
2137
2138                         return( 1 );
2139                 }
2140                 argv[(*argcp)++] = token;
2141         }
2142         argv[*argcp] = NULL;
2143         return 0;
2144 }
2145
2146 static char *
2147 strtok_quote( char *line, char *sep )
2148 {
2149         int             inquote;
2150         char            *tmp;
2151         static char     *next;
2152
2153         if ( line != NULL ) {
2154                 next = line;
2155         }
2156         while ( *next && strchr( sep, *next ) ) {
2157                 next++;
2158         }
2159
2160         if ( *next == '\0' ) {
2161                 next = NULL;
2162                 return( NULL );
2163         }
2164         tmp = next;
2165
2166         for ( inquote = 0; *next; ) {
2167                 switch ( *next ) {
2168                 case '"':
2169                         if ( inquote ) {
2170                                 inquote = 0;
2171                         } else {
2172                                 inquote = 1;
2173                         }
2174                         AC_MEMCPY( next, next + 1, strlen( next + 1 ) + 1 );
2175                         break;
2176
2177                 case '\\':
2178                         if ( next[1] )
2179                                 AC_MEMCPY( next,
2180                                             next + 1, strlen( next + 1 ) + 1 );
2181                         next++;         /* dont parse the escaped character */
2182                         break;
2183
2184                 default:
2185                         if ( ! inquote ) {
2186                                 if ( strchr( sep, *next ) != NULL ) {
2187                                         *next++ = '\0';
2188                                         return( tmp );
2189                                 }
2190                         }
2191                         next++;
2192                         break;
2193                 }
2194         }
2195
2196         return( tmp );
2197 }
2198
2199 static char     buf[BUFSIZ];
2200 static char     *line;
2201 static int      lmax, lcur;
2202
2203 #define CATLINE( buf )  { \
2204         int     len; \
2205         len = strlen( buf ); \
2206         while ( lcur + len + 1 > lmax ) { \
2207                 lmax += BUFSIZ; \
2208                 line = (char *) ch_realloc( line, lmax ); \
2209         } \
2210         strcpy( line + lcur, buf ); \
2211         lcur += len; \
2212 }
2213
2214 static char *
2215 fp_getline( FILE *fp, int *lineno )
2216 {
2217         char            *p;
2218
2219         lcur = 0;
2220         CATLINE( buf );
2221         (*lineno)++;
2222
2223         /* hack attack - keeps us from having to keep a stack of bufs... */
2224         if ( strncasecmp( line, "include", 7 ) == 0 ) {
2225                 buf[0] = '\0';
2226                 return( line );
2227         }
2228
2229         while ( fgets( buf, sizeof(buf), fp ) != NULL ) {
2230                 /* trim off \r\n or \n */
2231                 if ( (p = strchr( buf, '\n' )) != NULL ) {
2232                         if( p > buf && p[-1] == '\r' ) --p;
2233                         *p = '\0';
2234                 }
2235                 if ( ! isspace( (unsigned char) buf[0] ) ) {
2236                         return( line );
2237                 }
2238
2239                 /* change leading whitespace to a space */
2240                 buf[0] = ' ';
2241
2242                 CATLINE( buf );
2243                 (*lineno)++;
2244         }
2245         buf[0] = '\0';
2246
2247         return( line[0] ? line : NULL );
2248 }
2249
2250 static void
2251 fp_getline_init( int *lineno )
2252 {
2253         *lineno = -1;
2254         buf[0] = '\0';
2255 }
2256
2257 /* Loads ucdata, returns 1 if loading, 0 if already loaded, -1 on error */
2258 static int
2259 load_ucdata( char *path )
2260 {
2261         static int loaded = 0;
2262         int err;
2263
2264         if ( loaded ) {
2265                 return( 0 );
2266         }
2267         err = ucdata_load( path ? path : SLAPD_DEFAULT_UCDATA, UCDATA_ALL );
2268         if ( err ) {
2269 #ifdef NEW_LOGGING
2270                 LDAP_LOG(( "config", LDAP_LEVEL_CRIT,
2271                            "load_ucdata: Error %d loading ucdata.\n", err ));
2272 #else
2273                 Debug( LDAP_DEBUG_ANY, "error loading ucdata (error %d)\n",
2274                        err, 0, 0 );
2275 #endif
2276
2277                 return( -1 );
2278         }
2279         loaded = 1;
2280         return( 1 );
2281 }