git.sur5r.net Git - openldap/blob - servers/slapd/config.c

   1 /* config.c - configuration file handling routines */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 1998-2004 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
  17  * All rights reserved.
  18  *
  19  * Redistribution and use in source and binary forms are permitted
  20  * provided that this notice is preserved and that due credit is given
  21  * to the University of Michigan at Ann Arbor. The name of the University
  22  * may not be used to endorse or promote products derived from this
  23  * software without specific prior written permission. This software
  24  * is provided ``as is'' without express or implied warranty.
  25  */
  26
  27 #include "portable.h"
  28
  29 #include <stdio.h>
  30
  31 #include <ac/string.h>
  32 #include <ac/ctype.h>
  33 #include <ac/signal.h>
  34 #include <ac/socket.h>
  35 #include <ac/errno.h>
  36
  37 #include "slap.h"
  38 #ifdef LDAP_SLAPI
  39 #include "slapi/slapi.h"
  40 #endif
  41 #include "lutil.h"
  42 #include "config.h"
  43
  44 #define ARGS_STEP       512
  45
  46 /*
  47  * defaults for various global variables
  48  */
  49 slap_mask_t             global_allows = 0;
  50 slap_mask_t             global_disallows = 0;
  51 int             global_gentlehup = 0;
  52 int             global_idletimeout = 0;
  53 char    *global_host = NULL;
  54 char    *global_realm = NULL;
  55 char            *ldap_srvtab = "";
  56 char            **default_passwd_hash = NULL;
  57 struct berval default_search_base = BER_BVNULL;
  58 struct berval default_search_nbase = BER_BVNULL;
  59 unsigned                num_subordinates = 0;
  60
  61 ber_len_t sockbuf_max_incoming = SLAP_SB_MAX_INCOMING_DEFAULT;
  62 ber_len_t sockbuf_max_incoming_auth= SLAP_SB_MAX_INCOMING_AUTH;
  63
  64 int     slap_conn_max_pending = SLAP_CONN_MAX_PENDING_DEFAULT;
  65 int     slap_conn_max_pending_auth = SLAP_CONN_MAX_PENDING_AUTH;
  66
  67 char   *slapd_pid_file  = NULL;
  68 char   *slapd_args_file = NULL;
  69
  70 char   *strtok_quote_ptr;
  71
  72 int use_reverse_lookup = 0;
  73
  74 #ifdef LDAP_SLAPI
  75 int slapi_plugins_used = 0;
  76 #endif
  77
  78 static int fp_getline(FILE *fp, ConfigArgs *c);
  79 static void fp_getline_init(ConfigArgs *c);
  80 static int fp_parse_line(ConfigArgs *c);
  81
  82 static char     *strtok_quote(char *line, char *sep);
  83 #if 0
  84 static int load_ucdata(char *path);
  85 #endif
  86
  87 int read_config_file(const char *fname, int depth, ConfigArgs *cf);
  88
  89 static int add_syncrepl LDAP_P(( Backend *, char **, int ));
  90 static int parse_syncrepl_line LDAP_P(( char **, int, syncinfo_t *));
  91
  92 int config_generic(ConfigArgs *c);
  93 int config_search_base(ConfigArgs *c);
  94 int config_passwd_hash(ConfigArgs *c);
  95 int config_schema_dn(ConfigArgs *c);
  96 int config_sizelimit(ConfigArgs *c);
  97 int config_timelimit(ConfigArgs *c);
  98 int config_limits(ConfigArgs *c);
  99 int config_overlay(ConfigArgs *c);
 100 int config_suffix(ConfigArgs *c);
 101 int config_deref_depth(ConfigArgs *c);
 102 int config_rootdn(ConfigArgs *c);
 103 int config_rootpw(ConfigArgs *c);
 104 int config_restrict(ConfigArgs *c);
 105 int config_allows(ConfigArgs *c);
 106 int config_disallows(ConfigArgs *c);
 107 int config_requires(ConfigArgs *c);
 108 int config_security(ConfigArgs *c);
 109 int config_referral(ConfigArgs *c);
 110 int config_loglevel(ConfigArgs *c);
 111 int config_syncrepl(ConfigArgs *c);
 112 int config_replica(ConfigArgs *c);
 113 int config_updatedn(ConfigArgs *c);
 114 int config_updateref(ConfigArgs *c);
 115 int config_include(ConfigArgs *c);
 116 #ifdef HAVE_TLS
 117 int config_tls_option(ConfigArgs *c);
 118 int config_tls_verify(ConfigArgs *c);
 119 #endif
 120 #ifdef LDAP_SLAPI
 121 int config_plugin(ConfigArgs *c);
 122 #endif
 123 int config_pluginlog(ConfigArgs *c);
 124
 125 enum {
 126         CFG_DATABASE = 1,
 127         CFG_BACKEND,
 128         CFG_TLS_RAND,
 129         CFG_TLS_CIPHER,
 130         CFG_TLS_CERT_FILE,
 131         CFG_TLS_CERT_KEY,
 132         CFG_TLS_CERT_PATH,
 133         CFG_TLS_CA_FILE,
 134         CFG_TLS_VERIFY,
 135         CFG_TLS_CRLCHECK,
 136         CFG_SIZE,
 137         CFG_TIME,
 138         CFG_CONCUR,
 139         CFG_THREADS,
 140         CFG_SALT,
 141         CFG_LIMITS,
 142         CFG_RO,
 143         CFG_SUB,
 144         CFG_SASLOPT,
 145         CFG_REWRITE,
 146         CFG_DEPTH,
 147         CFG_OID,
 148         CFG_OC,
 149         CFG_DIT,
 150         CFG_ATTR,
 151         CFG_ATOPT,
 152         CFG_CHECK,
 153         CFG_ACL,
 154         CFG_AUDITLOG,
 155         CFG_REPLOG,
 156         CFG_ROOTDSE,
 157         CFG_LOGFILE,
 158         CFG_PLUGIN,
 159         CFG_MODLOAD,
 160         CFG_MODPATH,
 161         CFG_LASTMOD
 162 };
 163
 164 /* original config.c ordering */
 165
 166 ConfigTable SystemConfiguration[] = {
 167   { "backend",                  2,  2,  0,  "type",     ARG_PRE_DB|ARG_MAGIC|CFG_BACKEND, &config_generic,      NULL, NULL, NULL },
 168   { "database",                 2,  2,  0,  "type",     ARG_MAGIC|CFG_DATABASE, &config_generic,                NULL, NULL, NULL },
 169   { "localSSF",                 2,  2,  0,  "ssf",      ARG_LONG,               &local_ssf,                     NULL, NULL, NULL },
 170   { "concurrency",              2,  2,  0,  "level",    ARG_LONG|ARG_NONZERO|ARG_MAGIC|CFG_CONCUR, &config_generic, NULL, NULL, NULL },
 171   { "index_substr_if_minlen",   2,  2,  0,  "min",      ARG_INT|ARG_NONZERO,    &index_substr_if_minlen,        NULL, NULL, NULL },
 172   { "index_substr_if_maxlen",   2,  2,  0,  "max",      ARG_INT|ARG_NONZERO|ARG_SPECIAL, &index_substr_if_maxlen, NULL, NULL, NULL },
 173   { "index_substr_any_len",     2,  2,  0,  "len",      ARG_INT|ARG_NONZERO,    &index_substr_any_len,          NULL, NULL, NULL },
 174   { "index_substr_step",        2,  2,  0,  "step",     ARG_INT|ARG_NONZERO,    &index_substr_any_step,         NULL, NULL, NULL },
 175   { "sockbuf_max_incoming",     2,  2,  0,  "max",      ARG_LONG,               &sockbuf_max_incoming,          NULL, NULL, NULL },
 176   { "sockbuf_max_incoming_auth",2,  2,  0,  "max",      ARG_LONG,               &sockbuf_max_incoming_auth,     NULL, NULL, NULL },
 177   { "conn_max_pending",         2,  2,  0,  "max",      ARG_LONG,               &slap_conn_max_pending,         NULL, NULL, NULL },
 178   { "conn_max_pending_auth",    2,  2,  0,  "max",      ARG_LONG,               &slap_conn_max_pending_auth,    NULL, NULL, NULL },
 179   { "defaultSearchBase",        2,  2,  0,  "dn",       ARG_MAGIC,              &config_search_base,            NULL, NULL, NULL },
 180   { "threads",                  2,  2,  0,  "count",    ARG_INT|ARG_MAGIC|CFG_THREADS, &config_generic,         NULL, NULL, NULL },
 181   { "pidfile",                  2,  2,  0,  "file",     ARG_STRING,             &slapd_pid_file,                NULL, NULL, NULL },
 182   { "argsfile",                 2,  2,  0,  "file",     ARG_STRING,             &slapd_args_file,               NULL, NULL, NULL },
 183   { "password-hash",            2,  2,  0,  "hash",     ARG_MAGIC,              &config_passwd_hash,            NULL, NULL, NULL },
 184   { "password-crypt-salt-format",2, 2,  0,  "salt",     ARG_MAGIC|CFG_SALT,     &config_generic,                NULL, NULL, NULL },
 185 #ifdef SLAP_AUTH_REWRITE
 186   { "auth-rewrite",             2,  2, 14,  NULL,       ARG_MAGIC|CFG_REWRITE,  &config_generic,                NULL, NULL, NULL },
 187 #endif
 188   { "sasl",                     2,  0,  4,  NULL,       ARG_MAGIC|CFG_SASLOPT,  &config_generic,                NULL, NULL, NULL },     /* XXX */
 189   { "auth",                     2,  2,  4,  NULL,       ARG_MAGIC|CFG_SASLOPT,  &config_generic,                NULL, NULL, NULL },
 190   { "schemadn",                 2,  2,  0,  "dn",       ARG_MAGIC,              &config_schema_dn,              NULL, NULL, NULL },
 191   { "ucdata-path",              2,  2,  0,  "path",     ARG_IGNORED,            NULL,                           NULL, NULL, NULL },
 192   { "sizelimit",                2,  2,  0,  "limit",    ARG_MAGIC|CFG_SIZE,     &config_sizelimit,              NULL, NULL, NULL },
 193   { "timelimit",                2,  2,  0,  "limit",    ARG_MAGIC|CFG_TIME,     &config_timelimit,              NULL, NULL, NULL },
 194   { "limits",                   2,  2,  0,  "limits",   ARG_DB|ARG_MAGIC|CFG_LIMITS, &config_generic,           NULL, NULL, NULL },
 195   { "subordinate",              1,  1,  0,  "sub",      ARG_DB|ARG_MAGIC|CFG_SUB, &config_generic,              NULL, NULL, NULL },
 196   { "overlay",                  2,  2,  0,  "overlay",  ARG_DB|ARG_MAGIC,       &config_overlay,                NULL, NULL, NULL },
 197   { "suffix",                   2,  2,  0,  "suffix",   ARG_DB|ARG_MAGIC,       &config_suffix,                 NULL, NULL, NULL },
 198   { "maxDerefDepth",            2,  2,  0,  "depth",    ARG_DB|ARG_INT|ARG_MAGIC|CFG_DEPTH, &config_generic,    NULL, NULL, NULL },
 199   { "rootdn",                   2,  2,  0,  "dn",       ARG_DB|ARG_MAGIC,       &config_rootdn,                 NULL, NULL, NULL },
 200   { "rootpw",                   2,  2,  0,  "password", ARG_DB|ARG_MAGIC,       &config_rootpw,                 NULL, NULL, NULL },
 201   { "readonly",                 2,  2,  0,  "on|off",   ARG_ON_OFF|ARG_MAGIC|CFG_RO, &config_generic,           NULL, NULL, NULL },
 202   { "restrict",                 2,  0,  0,  "op_list",  ARG_MAGIC,              &config_restrict,               NULL, NULL, NULL },
 203   { "allows",                   2,  0,  5,  "features", ARG_PRE_DB|ARG_MAGIC,   &config_allows,                 NULL, NULL, NULL },
 204   { "disallows",                2,  0,  8,  "features", ARG_PRE_DB|ARG_MAGIC,   &config_disallows,              NULL, NULL, NULL },
 205   { "require",                  2,  0,  7,  "features", ARG_MAGIC,              &config_requires,               NULL, NULL, NULL },
 206   { "security",                 2,  0,  0,  "factors",  ARG_MAGIC,              &config_security,               NULL, NULL, NULL },
 207   { "referral",                 2,  2,  0,  "url",      ARG_MAGIC,              &config_referral,               NULL, NULL, NULL },
 208   { "logfile",                  2,  2,  0,  "file",     ARG_MAGIC|CFG_LOGFILE,  &config_generic,                NULL, NULL, NULL },
 209   { "objectidentifier",         0,  0,  0,  NULL,       ARG_MAGIC|CFG_OID,      &config_generic,                NULL, NULL, NULL },
 210   { "objectclass",              2,  0,  0,  "objectclass", ARG_PAREN|ARG_MAGIC|CFG_OC, &config_generic,         NULL, NULL, NULL },
 211   { "ditcontentrule",           0,  0,  0,  NULL,       ARG_MAGIC|CFG_DIT,      &config_generic,                NULL, NULL, NULL },
 212   { "attribute",                2,  0,  9,  "attribute", ARG_PAREN|ARG_MAGIC|CFG_ATTR, &config_generic,         NULL, NULL, NULL },
 213   { "attributeoptions",         0,  0,  0,  NULL,       ARG_MAGIC|CFG_ATOPT,    &config_generic,                NULL, NULL, NULL },
 214   { "schemacheck",              2,  2,  0,  "on|off",   ARG_ON_OFF|ARG_MAGIC|CFG_CHECK, &config_generic,        NULL, NULL, NULL },
 215   { "access",                   0,  0,  0,  NULL,       ARG_MAGIC|CFG_ACL,      &config_generic,                NULL, NULL, NULL },
 216   { "loglevel",                 2,  0,  0,  "level",    ARG_MAGIC,              &config_loglevel,               NULL, NULL, NULL },
 217   { "syncrepl",                 0,  0,  0,  NULL,       ARG_DB|ARG_MAGIC,       &config_syncrepl,               NULL, NULL, NULL },
 218   { "replica",                  2,  0,  0,  "host or uri", ARG_DB|ARG_MAGIC,    &config_replica,                NULL, NULL, NULL },
 219   { "replicationInterval",      0,  0,  0,  NULL,       ARG_IGNORED,            NULL,                           NULL, NULL, NULL },
 220   { "updatedn",                 2,  2,  0,  "dn",       ARG_DB|ARG_MAGIC,       &config_updatedn,               NULL, NULL, NULL },
 221   { "updateref",                2,  2,  0,  "url",      ARG_DB|ARG_MAGIC,       &config_updateref,              NULL, NULL, NULL },
 222   { "replogfile",               2,  2,  0,  "filename", ARG_MAGIC|ARG_STRING|CFG_REPLOG,        &config_generic,                NULL, NULL, NULL },
 223   { "rootDSE",                  2,  2,  0,  "filename", ARG_MAGIC|CFG_ROOTDSE,  &config_generic,                NULL, NULL, NULL },
 224   { "lastmod",                  2,  2,  0,  "on|off",   ARG_DB|ARG_ON_OFF|ARG_MAGIC|CFG_LASTMOD, &config_generic, NULL, NULL, NULL },
 225 #ifdef SIGHUP
 226   { "gentlehup",                2,  2,  0,  "on|off",   ARG_ON_OFF,             &global_gentlehup,              NULL, NULL, NULL },
 227 #else
 228   { "gentlehup",                2,  2,  0,  NULL,       ARG_IGNORED,            NULL,                           NULL, NULL, NULL },
 229 #endif
 230   { "idletimeout",              2,  2,  0,  "timeout",  ARG_INT,                &global_idletimeout,            NULL, NULL, NULL },
 231 /* XXX -- special case? */
 232   { "include",                  2,  2,  0,  "filename", ARG_MAGIC,              &config_include,                NULL, NULL, NULL },
 233   { "srvtab",                   2,  2,  0,  "filename", ARG_STRING,             &ldap_srvtab,                   NULL, NULL, NULL },
 234 #ifdef SLAPD_MODULES
 235   { "moduleload",               2,  2,  0,  "filename", ARG_MAGIC|CFG_MODLOAD,  &config_generic,                NULL, NULL, NULL },
 236   { "modulepath",               2,  2,  0,  "path",     ARG_MAGIC|CFG_MODPATH,  &config_generic,                NULL, NULL, NULL },
 237 #endif
 238 #ifdef HAVE_TLS
 239   { "TLSRandFile",              0,  0,  0,  NULL,       CFG_TLS_RAND|ARG_MAGIC,         &config_tls_option,     NULL, NULL, NULL },
 240   { "TLSCipherSuite",           0,  0,  0,  NULL,       CFG_TLS_CIPHER|ARG_MAGIC,       &config_tls_option,     NULL, NULL, NULL },
 241   { "TLSCertificateFile",       0,  0,  0,  NULL,       CFG_TLS_CERT_FILE|ARG_MAGIC,    &config_tls_option,     NULL, NULL, NULL },
 242   { "TLSCertificateKeyFile",    0,  0,  0,  NULL,       CFG_TLS_CERT_KEY|ARG_MAGIC,     &config_tls_option,     NULL, NULL, NULL },
 243   { "TLSCertificatePath",       0,  0,  0,  NULL,       CFG_TLS_CERT_PATH|ARG_MAGIC,    &config_tls_option,     NULL, NULL, NULL },
 244   { "TLSCACertificateFile",     0,  0,  0,  NULL,       CFG_TLS_CA_FILE|ARG_MAGIC,      &config_tls_option,     NULL, NULL, NULL },
 245 #ifdef HAVE_OPENSSL_CRL
 246   { "TLSCRLCheck",              0,  0,  0,  NULL,       CFG_TLS_CRLCHECK|ARG_MAGIC,     &config_tls_option,     NULL, NULL, NULL },
 247 #else
 248   { "TLSCRLCheck",              0,  0,  0,  NULL,       ARG_IGNORED,            NULL,                           NULL, NULL, NULL },
 249 #endif
 250   { "TLSVerifyClient",          0,  0,  0,  NULL,       CFG_TLS_VERIFY|ARG_MAGIC,       &config_tls_verify,     NULL, NULL, NULL },
 251 #endif
 252 #ifdef SLAPD_RLOOKUPS
 253   { "reverse-lookup",           2,  2,  0,  "on|off",   ARG_ON_OFF,             &use_reverse_lookup,            NULL, NULL, NULL },
 254 #else
 255   { "reverse-lookup",           2,  2,  0,  NULL,       ARG_IGNORED,            NULL,                           NULL, NULL, NULL },
 256 #endif
 257 #ifdef LDAP_SLAPI
 258   { "plugin",                   0,  0,  0,  NULL,       ARG_MAGIC|CFG_PLUGIN,   &config_generic,                NULL, NULL, NULL },
 259   { "pluginlog",                2,  2,  0,  "filename", ARG_STRING,             &slapi_log_file,                NULL, NULL, NULL },
 260 #else
 261   { "plugin",                   0,  0,  0,  NULL,       ARG_IGNORED,            NULL,                           NULL, NULL, NULL },
 262   { "pluginlog",                0,  0,  0,  NULL,       ARG_IGNORED,            NULL,                           NULL, NULL, NULL },
 263 #endif
 264   { "replica-pidfile",          0,  0,  0,  NULL,       ARG_IGNORED,            NULL,                           NULL, NULL, NULL },
 265   { "replica-argsfile",         0,  0,  0,  NULL,       ARG_IGNORED,            NULL,                           NULL, NULL, NULL },
 266   { NULL,                       0,  0,  0,  NULL,       ARG_IGNORED,            NULL,                           NULL, NULL, NULL }
 267 };
 268
 269
 270 ConfigArgs *
 271 new_config_args( BackendDB *be, const char *fname, int lineno, int argc, char **argv )
 272 {
 273         ConfigArgs *c;
 274         c = ch_calloc( 1, sizeof( ConfigArgs ) );
 275         if ( c == NULL ) return(NULL);
 276         c->be     = be;
 277         c->fname  = fname;
 278         c->argc   = argc;
 279         c->argv   = argv;
 280         c->lineno = lineno;
 281         return(c);
 282 }
 283
 284 int parse_config_table(ConfigTable *Conf, ConfigArgs *c) {
 285         int i, rc, arg_user, arg_type, iarg;
 286         long larg;
 287         ber_len_t barg;
 288         for(i = 0; Conf[i].name; i++)
 289                 if( (Conf[i].length && (!strncasecmp(c->argv[0], Conf[i].name, Conf[i].length))) ||
 290                         (!strcasecmp(c->argv[0], Conf[i].name)) ) break;
 291         if(!Conf[i].name) return(ARG_UNKNOWN);
 292         arg_type = Conf[i].arg_type;
 293         if(arg_type == ARG_IGNORED) {
 294                 Debug(LDAP_DEBUG_CONFIG, "%s: line %lu: keyword <%s> ignored\n",
 295                         c->fname, c->lineno, Conf[i].name);
 296                 return(0);
 297         }
 298         if(Conf[i].min_args && (c->argc < Conf[i].min_args)) {
 299                 Debug(LDAP_DEBUG_CONFIG, "%s: line %lu: ", c->fname, c->lineno, 0);
 300                 Debug(LDAP_DEBUG_CONFIG, "keyword <%s> missing <%s> argument\n", Conf[i].name, Conf[i].what, 0);
 301                 return(ARG_BAD_CONF);
 302         }
 303         if(Conf[i].max_args && (c->argc > Conf[i].max_args)) {
 304                 Debug(LDAP_DEBUG_CONFIG, "%s: line %lu: ", c->fname, c->lineno, 0);
 305                 Debug(LDAP_DEBUG_CONFIG, "extra cruft after <%s> in <%s> line (ignored)\n", Conf[i].what, Conf[i].name, 0);
 306         }
 307         if((arg_type & ARG_DB) && !c->be) {
 308                 Debug(LDAP_DEBUG_CONFIG, "%s: line %lu: keyword <%s> allowed only within database declaration\n",
 309                         c->fname, c->lineno, Conf[i].name);
 310                 return(ARG_BAD_CONF);
 311         }
 312         if((arg_type & ARG_PRE_DB) && c->be) {
 313                 Debug(LDAP_DEBUG_CONFIG, "%s: line %lu: keyword <%s> must appear before any database declaration\n",
 314                         c->fname, c->lineno, Conf[i].name);
 315                 return(ARG_BAD_CONF);
 316         }
 317         if((arg_type & ARG_PAREN) && *c->argv[1] != '(' /*')'*/) {
 318                 Debug(LDAP_DEBUG_CONFIG, "%s: line %lu: old <%s> format not supported\n", c->fname, c->lineno, Conf[i].name);
 319                 return(ARG_BAD_CONF);
 320         }
 321         if((arg_type & ARGS_POINTER) && !Conf[i].arg_item) {
 322                 Debug(LDAP_DEBUG_CONFIG, "%s: line %lu: null arg_item for <%s>\n", c->fname, c->lineno, Conf[i].name);
 323                 return(ARG_BAD_CONF);
 324         }
 325         c->type = arg_user = (arg_type & ARGS_USERLAND);
 326         c->value_int = c->value_long = c->value_ber_t = 0;
 327         c->value_string = NULL;
 328         if(arg_type & ARGS_NUMERIC) {
 329                 int j;
 330                 iarg = 0; larg = 0; barg = 0;
 331                 switch(arg_type & ARGS_NUMERIC) {
 332                         case ARG_INT:           iarg = atoi(c->argv[1]);                break;
 333                         case ARG_LONG:          larg = atol(c->argv[1]);                break;
 334                         case ARG_BER_LEN_T:     barg = (ber_len_t)atol(c->argv[1]);     break;
 335                         case ARG_ON_OFF:
 336                                 if(!strcasecmp(c->argv[1], "on")) {
 337                                         iarg = 1;
 338                                 } else if(!strcasecmp(c->argv[1], "off")) {
 339                                         iarg = 0;
 340                                 } else {
 341                                         Debug(LDAP_DEBUG_CONFIG, "%s: line %lu: ignoring ", c->fname, c->lineno, 0);
 342                                         Debug(LDAP_DEBUG_CONFIG, "invalid %s value (%s) in <%s> line\n",
 343                                                 Conf[i].what, c->argv[1], Conf[i].name);
 344                                         return(0);
 345                                 }
 346                                 break;
 347                 }
 348                 j = (arg_type & ARG_NONZERO) ? 1 : 0;
 349                 rc = (Conf == SystemConfiguration) ? ((arg_type & ARG_SPECIAL) && (larg < index_substr_if_maxlen)) : 0;
 350                 if(iarg < j || larg < j || barg < j || rc) {
 351                         larg = larg ? larg : (barg ? barg : iarg);
 352                         Debug(LDAP_DEBUG_CONFIG, "%s: line %lu: " , c->fname, c->lineno, 0);
 353                         Debug(LDAP_DEBUG_CONFIG, "invalid %s value (%ld) in <%s> line\n", Conf[i].what, larg, Conf[i].name);
 354                         return(ARG_BAD_CONF);
 355                 }
 356                 c->value_int = iarg;
 357                 c->value_long = larg;
 358                 c->value_ber_t = barg;
 359         }
 360         if(arg_type & ARG_STRING) c->value_string = ch_strdup(c->argv[1]);
 361         if(arg_type & ARG_MAGIC) {
 362                 if(!c->be) c->be = frontendDB;
 363                 rc = (*((ConfigDriver*)Conf[i].arg_item))(c);
 364                 if(c->be == frontendDB) c->be = NULL;
 365                 if(rc) {
 366                         Debug(LDAP_DEBUG_CONFIG, "%s: line %lu: ", c->fname, c->lineno, 0);
 367                         Debug(LDAP_DEBUG_CONFIG, "handler for <%s> exited with %d!", Conf[i].name, rc, 0);
 368                         return(ARG_BAD_CONF);
 369                 }
 370                 return(0);
 371         }
 372         if(arg_type & ARGS_POINTER) switch(arg_type & ARGS_POINTER) {
 373                         case ARG_ON_OFF:
 374                         case ARG_INT:           *((int*)Conf[i].arg_item)               = iarg;                 break;
 375                         case ARG_LONG:          *((long*)Conf[i].arg_item)              = larg;                 break;
 376                         case ARG_BER_LEN_T:     *((ber_len_t*)Conf[i].arg_item)         = barg;                 break;
 377                         case ARG_STRING: {
 378                                 char *cc = *((char**)Conf[i].arg_item);
 379                                 if(cc) ch_free(cc);     /* potential memory leak */
 380                                 *(char **)Conf[i].arg_item = c->value_string;
 381                                 break;
 382                                 }
 383         }
 384         return(arg_user);
 385 }
 386
 387 int
 388 read_config(const char *fname, int depth) {
 389         return read_config_file(fname, depth, NULL);
 390 }
 391
 392 int
 393 read_config_file(const char *fname, int depth, ConfigArgs *cf)
 394 {
 395         FILE *fp;
 396         ConfigArgs *c;
 397         int rc;
 398
 399         c = ch_calloc( 1, sizeof( ConfigArgs ) );
 400         if ( c == NULL ) {
 401                 return 1;
 402         }
 403
 404         if ( depth ) {
 405                 memcpy( c, cf, sizeof( ConfigArgs ) );
 406         } else {
 407                 c->depth = depth; /* XXX */
 408                 c->bi = NULL;
 409                 c->be = NULL;
 410         }
 411
 412         c->fname = fname;
 413         c->argv = ch_calloc( ARGS_STEP + 1, sizeof( *c->argv ) );
 414         c->argv_size = ARGS_STEP + 1;
 415
 416         fp = fopen( fname, "r" );
 417         if ( fp == NULL ) {
 418                 ldap_syslog = 1;
 419                 Debug(LDAP_DEBUG_ANY,
 420                     "could not open config file \"%s\": %s (%d)\n",
 421                     fname, strerror(errno), errno);
 422                 return(1);
 423         }
 424
 425         Debug(LDAP_DEBUG_CONFIG, "reading config file %s\n", fname, 0, 0);
 426
 427         fp_getline_init(c);
 428
 429         while ( fp_getline( fp, c ) ) {
 430                 /* skip comments and blank lines */
 431                 if ( c->line[0] == '#' || c->line[0] == '\0' ) {
 432                         continue;
 433                 }
 434                 if ( fp_parse_line( c ) ) {
 435                         goto badline;
 436                 }
 437
 438                 if ( c->argc < 1 ) {
 439                         Debug(LDAP_DEBUG_CONFIG, "%s: line %lu: bad config line (ignored)\n", fname, c->lineno, 0);
 440                         continue;
 441                 }
 442
 443                 rc = parse_config_table( SystemConfiguration, c );
 444                 if ( !rc ) {
 445                         continue;
 446                 }
 447                 if ( rc & ARGS_USERLAND ) {
 448                         switch(rc) {    /* XXX a usertype would be opaque here */
 449                         default:
 450                                 Debug(LDAP_DEBUG_CONFIG, "%s: line %lu: unknown user type <%d>\n",
 451                                         c->fname, c->lineno, *c->argv);
 452                                 goto badline;
 453                         }
 454
 455                 } else if ( rc == ARG_BAD_CONF || rc != ARG_UNKNOWN ) {
 456                         goto badline;
 457
 458                 } else if ( c->bi && c->bi->bi_config ) {               /* XXX to check: could both be/bi_config? oops */
 459                         rc = (*c->bi->bi_config)(c->bi, c->fname, c->lineno, c->argc, c->argv);
 460                         if ( rc ) {
 461                                 switch(rc) {
 462                                 case SLAP_CONF_UNKNOWN:
 463                                         Debug(LDAP_DEBUG_CONFIG, "%s: line %lu: "
 464                                                 "unknown directive <%s> inside backend info definition (ignored)\n",
 465                                                 c->fname, c->lineno, *c->argv);
 466                                         continue;
 467                                 default:
 468                                         goto badline;
 469                                 }
 470                         }
 471
 472                 } else if ( c->be && c->be->be_config ) {
 473                         rc = (*c->be->be_config)(c->be, c->fname, c->lineno, c->argc, c->argv);
 474                         if ( rc ) {
 475                                 switch(rc) {
 476                                 case SLAP_CONF_UNKNOWN:
 477                                         Debug( LDAP_DEBUG_CONFIG, "%s: line %lu: "
 478                                                 "unknown directive <%s> inside backend database definition (ignored)\n",
 479                                                 c->fname, c->lineno, *c->argv);
 480                                         continue;
 481                                 default:
 482                                         goto badline;
 483                                 }
 484                         }
 485
 486                 } else if ( frontendDB->be_config ) {
 487                         rc = (*frontendDB->be_config)(frontendDB, c->fname, (int)c->lineno, c->argc, c->argv);
 488                         if ( rc ) {
 489                                 switch(rc) {
 490                                 case SLAP_CONF_UNKNOWN:
 491                                         Debug( LDAP_DEBUG_CONFIG, "%s: line %lu: "
 492                                                 "%s: line %lu: unknown directive <%s> inside global database definition (ignored)\n",
 493                                                 c->fname, c->lineno, *c->argv);
 494                                         continue;
 495                                 default:
 496                                         goto badline;
 497                                 }
 498                         }
 499
 500                 } else {
 501                         Debug(LDAP_DEBUG_CONFIG, "%s: line %lu: "
 502                                 "unknown directive <%s> outside backend info and database definitions (ignored)\n",
 503                                 c->fname, c->lineno, *c->argv);
 504                         continue;
 505
 506                 }
 507         }
 508
 509         fclose(fp);
 510
 511         if ( BER_BVISNULL( &frontendDB->be_schemadn ) ) {
 512                 ber_str2bv( SLAPD_SCHEMA_DN, STRLENOF( SLAPD_SCHEMA_DN ), 1,
 513                         &frontendDB->be_schemadn );
 514                 dnNormalize( 0, NULL, NULL, &frontendDB->be_schemadn, &frontendDB->be_schemandn, NULL );
 515         }
 516
 517         ch_free(c->argv);
 518         ch_free(c);
 519         return(0);
 520
 521 badline:
 522         fclose(fp);
 523         ch_free(c->argv);
 524         ch_free(c);
 525         return(1);
 526 }
 527
 528 int
 529 config_generic(ConfigArgs *c) {
 530         char *p = strchr(c->line,'(' /*')'*/);
 531         int i;
 532
 533         switch(c->type) {
 534                 case CFG_BACKEND:
 535                         if(!(c->bi = backend_info(c->argv[1]))) {
 536                                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
 537                                         "backend %s failed init!\n", c->fname, c->lineno, c->argv[1]);
 538                                 return(1);
 539                         }
 540                         break;
 541
 542                 case CFG_DATABASE:
 543                         c->bi = NULL;
 544                         if(!(c->be = backend_db_init(c->argv[1]))) {
 545                                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
 546                                         "database %s failed init!\n", c->fname, c->lineno, c->argv[1]);
 547                                 return(1);
 548                         }
 549                         break;
 550
 551                 case CFG_CONCUR:
 552                         ldap_pvt_thread_set_concurrency(c->value_long);
 553                         break;
 554
 555                 case CFG_THREADS:
 556                         ldap_pvt_thread_pool_maxthreads(&connection_pool, c->value_int);
 557                         connection_pool_max = c->value_int;     /* save for reference */
 558                         break;
 559
 560                 case CFG_SALT:
 561                         lutil_salt_format(c->argv[1]);
 562                         break;
 563
 564                 case CFG_LIMITS:
 565                         if(limits_parse(c->be, c->fname, c->lineno, c->argc, c->argv))
 566                                 return(1);
 567                         break;
 568
 569                 case CFG_RO:
 570                         if(c->value_int)
 571                                 c->be->be_restrictops |= SLAP_RESTRICT_OP_WRITES;
 572                         else
 573                                 c->be->be_restrictops &= ~SLAP_RESTRICT_OP_WRITES;
 574                         break;
 575
 576                 case CFG_SUB:
 577                         SLAP_DBFLAGS(c->be) |= SLAP_DBFLAG_GLUE_SUBORDINATE;
 578                         num_subordinates++;
 579                         break;
 580
 581                 case CFG_SASLOPT:
 582                         /* XXX slap_sasl_config doesn't actually use the line argument */
 583                         if(slap_sasl_config(c->argc, c->argv, c->line, c->fname, c->lineno))
 584                                 return(1);
 585                         break;
 586
 587                 case CFG_DEPTH:
 588                         c->be->be_max_deref_depth = c->value_int;
 589                         break;
 590
 591                 case CFG_OID:
 592                         if(parse_oidm(c->fname, c->lineno, c->argc, c->argv)) return(1);
 593                         break;
 594
 595                 case CFG_OC:
 596                         if(parse_oc(c->fname, c->lineno, p, c->argv)) return(1);
 597                         break;
 598
 599                 case CFG_DIT:
 600                         if(parse_cr(c->fname, c->lineno, p, c->argv)) return(1);
 601                         break;
 602
 603                 case CFG_ATTR:
 604                         if(parse_at(c->fname, c->lineno, p, c->argv)) return(1);
 605                         break;
 606
 607                 case CFG_ATOPT:
 608                         ad_define_option(NULL, NULL, 0);
 609                         for(i = 1; i < c->argc; i++)
 610                                 if(ad_define_option(c->argv[i], c->fname, c->lineno))
 611                                         return(1);
 612                         break;
 613
 614                 case CFG_CHECK:
 615                         global_schemacheck = c->value_int;
 616                         if(!global_schemacheck) Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
 617                                 "schema checking disabled! your mileage may vary!\n",
 618                                 c->fname, c->lineno, 0);
 619                         break;
 620
 621                 case CFG_ACL:
 622                         parse_acl(c->be, c->fname, c->lineno, c->argc, c->argv);
 623                         break;
 624
 625 #if 0
 626                 case CFG_AUDITLOG:
 627                         c->be->be_auditlogfile = c->value_string;
 628                         break;
 629 #endif
 630
 631                 case CFG_REPLOG:
 632                         if(SLAP_MONITOR(c->be)) {
 633                                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
 634                                         "\"replogfile\" should not be used "
 635                                         "inside monitor database\n",
 636                                         c->fname, c->lineno, 0);
 637                                 return(0);      /* FIXME: should this be an error? */
 638                         }
 639
 640                         c->be->be_replogfile = c->value_string;
 641                         break;
 642
 643                 case CFG_ROOTDSE:
 644                         if(read_root_dse_file(c->argv[1])) {
 645                                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
 646                                         "could not read \"rootDSE <filename>\" line\n",
 647                                         c->fname, c->lineno, 0);
 648                                 return(1);
 649                         }
 650                         break;
 651
 652                 case CFG_LOGFILE: {
 653                         FILE *logfile = fopen(c->argv[1], "w");
 654                         if(logfile) lutil_debug_file(logfile);
 655                         break;
 656                         }
 657
 658                 case CFG_LASTMOD:
 659                         if(SLAP_NOLASTMODCMD(c->be)) {
 660                                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
 661                                         "lastmod not available for %s databases\n",
 662                                         c->fname, c->lineno, c->be->bd_info->bi_type);
 663                                 return(1);
 664                         }
 665                         if(c->value_int)
 666                                 SLAP_DBFLAGS(c->be) &= ~SLAP_DBFLAG_NOLASTMOD;
 667                         else
 668                                 SLAP_DBFLAGS(c->be) |= SLAP_DBFLAG_NOLASTMOD;
 669                         break;
 670
 671 #ifdef SLAPD_MODULES
 672                 case CFG_MODLOAD:
 673                         if(module_load(c->argv[1], c->argc - 2, (c->argc > 2) ? c->argv + 2 : NULL))
 674                                 return(1);
 675                         break;
 676
 677                 case CFG_MODPATH:
 678                         if(module_path(c->argv[1])) return(1);
 679                         break;
 680 #endif
 681
 682 #ifdef LDAP_SLAPI
 683                 case CFG_PLUGIN:
 684                         if(slapi_int_read_config(c->be, c->fname, c->lineno, c->argc, c->argv) != LDAP_SUCCESS)
 685                                 return(1);
 686                         slapi_plugins_used++;
 687                         break;
 688 #endif
 689
 690 #ifdef SLAP_AUTH_REWRITE
 691                 case CFG_REWRITE:
 692                         if(slap_sasl_rewrite_config(c->fname, c->lineno, c->argc, c->argv))
 693                                 return(1);
 694                         break;
 695 #endif
 696
 697
 698                 default:
 699                         Debug(LDAP_DEBUG_ANY, "%s: line %lu: unknown CFG_TYPE %d"
 700                                 "(ignored)\n", c->fname, c->lineno, c->type);
 701
 702         }
 703         return(0);
 704 }
 705
 706
 707 int
 708 config_search_base(ConfigArgs *c) {
 709         struct berval dn;
 710         int rc;
 711         if(c->bi || c->be) {
 712                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: defaultSearchBase line must appear "
 713                         "prior to any backend or database definition\n",
 714                         c->fname, c->lineno, 0);
 715                 return(1);
 716         }
 717
 718         if(default_search_nbase.bv_len) {
 719                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
 720                         "default search base \"%s\" already defined "
 721                         "(discarding old)\n",
 722                         c->fname, c->lineno, default_search_base.bv_val);
 723                 free(default_search_base.bv_val);
 724                 free(default_search_nbase.bv_val);
 725         }
 726
 727         ber_str2bv(c->argv[1], 0, 1, &dn);
 728         rc = dnPrettyNormal(NULL, &dn, &default_search_base, &default_search_nbase, NULL);
 729
 730         if(rc != LDAP_SUCCESS) {
 731                 Debug(LDAP_DEBUG_ANY,
 732                         "%s: line %lu: defaultSearchBase DN is invalid\n",
 733                         c->fname, c->lineno, 0 );
 734                 return(1);
 735         }
 736         return(0);
 737 }
 738
 739 int
 740 config_passwd_hash(ConfigArgs *c) {
 741         int i;
 742         if(default_passwd_hash) {
 743                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
 744                         "already set default password_hash\n",
 745                         c->fname, c->lineno, 0);
 746                 return(1);
 747         }
 748         for(i = 1; i < c->argc; i++) {
 749                 if(!lutil_passwd_scheme(c->argv[i])) {
 750                         Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
 751                                 "password scheme \"%s\" not available\n",
 752                                 c->fname, c->lineno, c->argv[i] );
 753                 } else {
 754                         ldap_charray_add(&default_passwd_hash, c->argv[i]);
 755                 }
 756                 if(!default_passwd_hash) {
 757                         Debug(LDAP_DEBUG_ANY, "%s: line %lu: no valid hashes found\n",
 758                                 c->fname, c->lineno, 0 );
 759                         return(1);
 760                 }
 761         }
 762         return(0);
 763 }
 764
 765 int
 766 config_schema_dn(ConfigArgs *c) {
 767         struct berval dn;
 768         int rc;
 769         ber_str2bv(c->argv[1], 0, 1, &dn);
 770         rc = dnPrettyNormal(NULL, &dn, &c->be->be_schemadn, &c->be->be_schemandn, NULL);
 771         if(rc != LDAP_SUCCESS) {
 772                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
 773                         "schema DN is invalid\n", c->fname, c->lineno, 0);
 774                 return(1);
 775         }
 776         return(0);
 777 }
 778
 779 int
 780 config_sizelimit(ConfigArgs *c) {
 781         int i, rc = 0;
 782         char *next;
 783         struct slap_limits_set *lim = &c->be->be_def_limit;
 784         for(i = 1; i < c->argc; i++) {
 785                 if(!strncasecmp(c->argv[i], "size", 4)) {
 786                         rc = limits_parse_one(c->argv[i], lim);
 787                         if ( rc ) {
 788                                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
 789                                         "unable to parse value \"%s\" in \"sizelimit <limit>\" line\n",
 790                                         c->fname, c->lineno, c->argv[i]);
 791                                 return(1);
 792                         }
 793                 } else {
 794                         if(!strcasecmp(c->argv[i], "unlimited")) {
 795                                 lim->lms_s_soft = -1;
 796                         } else {
 797                                 lim->lms_s_soft = strtol(c->argv[i], &next, 0);
 798                                 if(next == c->argv[i]) {
 799                                         Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
 800                                                 "unable to parse limit \"%s\" in \"sizelimit <limit>\" line\n",
 801                                                 c->fname, c->lineno, c->argv[i]);
 802                                         return(1);
 803                                 } else if(next[0] != '\0') {
 804                                         Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
 805                                                 "trailing chars \"%s\" in \"sizelimit <limit>\" line (ignored)\n",
 806                                                 c->fname, c->lineno, next);
 807                                 }
 808                         }
 809                         lim->lms_s_hard = 0;
 810                 }
 811         }
 812         return(0);
 813 }
 814
 815 int
 816 config_timelimit(ConfigArgs *c) {
 817         int i, rc = 0;
 818         char *next;
 819         struct slap_limits_set *lim = &c->be->be_def_limit;
 820         for(i = 1; i < c->argc; i++) {
 821                 if(!strncasecmp(c->argv[i], "time", 4)) {
 822                         rc = limits_parse_one(c->argv[i], lim);
 823                         if ( rc ) {
 824                                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
 825                                         "unable to parse value \"%s\" in \"timelimit <limit>\" line\n",
 826                                         c->fname, c->lineno, c->argv[i]);
 827                                 return(1);
 828                         }
 829                 } else {
 830                         if(!strcasecmp(c->argv[i], "unlimited")) {
 831                                 lim->lms_t_soft = -1;
 832                         } else {
 833                                 lim->lms_t_soft = strtol(c->argv[i], &next, 0);
 834                                 if(next == c->argv[i]) {
 835                                         Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
 836                                                 "unable to parse limit \"%s\" in \"timelimit <limit>\" line\n",
 837                                                 c->fname, c->lineno, c->argv[i]);
 838                                         return(1);
 839                                 } else if(next[0] != '\0') {
 840                                         Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
 841                                                 "trailing chars \"%s\" in \"timelimit <limit>\" line (ignored)\n",
 842                                                 c->fname, c->lineno, next);
 843                                 }
 844                         }
 845                         lim->lms_t_hard = 0;
 846                 }
 847         }
 848         return(0);
 849 }
 850
 851 int
 852 config_overlay(ConfigArgs *c) {
 853         if(c->argv[1][0] == '-' && overlay_config(c->be, &c->argv[1][1])) {
 854                 /* log error */
 855                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: (optional) %s",
 856                         c->fname, c->lineno, c->be == frontendDB ? "global " : "");
 857                 Debug(LDAP_DEBUG_ANY, "overlay \"%s\" configuration "
 858                         "failed (ignored)\n", c->argv[1][1], 0, 0);
 859         } else if(overlay_config(c->be, c->argv[1])) {
 860                 return(1);
 861         }
 862         return(0);
 863 }
 864
 865 int
 866 config_suffix(ConfigArgs *c) {
 867         Backend *tbe;
 868         struct berval dn, pdn, ndn;
 869         int rc;
 870 #ifdef SLAPD_MONITOR_DN
 871         if(!strcasecmp(c->argv[1], SLAPD_MONITOR_DN)) {
 872                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
 873                         "%s\" is reserved for monitoring slapd\n",
 874                         c->fname, c->lineno, SLAPD_MONITOR_DN);
 875                 return(1);
 876         }
 877 #endif
 878         ber_str2bv(c->argv[1], 0, 1, &dn);
 879
 880         rc = dnPrettyNormal(NULL, &dn, &pdn, &ndn, NULL);
 881         if(rc != LDAP_SUCCESS) {
 882                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: suffix DN is invalid\n",
 883                         c->fname, c->lineno, 0);
 884                 return(1);
 885         }
 886         tbe = select_backend(&ndn, 0, 0);
 887         if(tbe == c->be) {
 888                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: suffix already served by this backend! (ignored)\n",
 889                         c->fname, c->lineno, 0);
 890                 free(pdn.bv_val);
 891                 free(ndn.bv_val);
 892         } else if(tbe) {
 893                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: suffix already served by a preceding backend \"%s\"\n",
 894                         c->fname, c->lineno, tbe->be_suffix[0].bv_val);
 895                 free(pdn.bv_val);
 896                 free(ndn.bv_val);
 897                 return(1);
 898         } else if(pdn.bv_len == 0 && default_search_nbase.bv_len) {
 899                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: suffix DN empty and default search "
 900                         "base provided \"%s\" (assuming okay)\n",
 901                         c->fname, c->lineno, default_search_base.bv_val);
 902         }
 903         ber_bvarray_add(&c->be->be_suffix, &pdn);
 904         ber_bvarray_add(&c->be->be_nsuffix, &ndn);
 905         return(0);
 906 }
 907
 908 int
 909 config_rootdn(ConfigArgs *c) {
 910         struct berval dn;
 911         int rc;
 912
 913         ber_str2bv(c->argv[1], 0, 1, &dn);
 914
 915         rc = dnPrettyNormal(NULL, &dn, &c->be->be_rootdn, &c->be->be_rootndn, NULL);
 916
 917         if(rc != LDAP_SUCCESS) {
 918                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
 919                         "rootdn DN is invalid\n", c->fname, c->lineno, 0);
 920                 return(1);
 921         }
 922         return(0);
 923 }
 924
 925 int
 926 config_rootpw(ConfigArgs *c) {
 927         Backend *tbe = select_backend(&c->be->be_rootndn, 0, 0);
 928         if(tbe != c->be) {
 929                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
 930                         "rootpw can only be set when rootdn is under suffix\n",
 931                         c->fname, c->lineno, 0);
 932                 return(1);
 933         }
 934         ber_str2bv(c->argv[1], 0, 1, &c->be->be_rootpw);
 935         return(0);
 936 }
 937
 938 /* restrictops, allows, disallows, requires, loglevel */
 939
 940 struct verb_mask_list { char *word; int mask; };
 941
 942 int
 943 verb_to_mask(ConfigArgs *c, struct verb_mask_list *v, int word) {
 944         int j;
 945         for(j = 0; v[j].word; j++)
 946                 if(!strcasecmp(c->argv[word], v[j].word))
 947                         break;
 948         return(j);
 949 }
 950
 951 int
 952 verbs_to_mask(ConfigArgs *c, struct verb_mask_list *v, slap_mask_t *m) {
 953         int i, j;
 954         for(i = 1; i < c->argc; i++) {
 955                 j = verb_to_mask(c, v, i);
 956                 if(!v[j].word) return(1);
 957                 *m |= v[j].mask;
 958         }
 959         return(0);
 960 }
 961
 962 int
 963 config_restrict(ConfigArgs *c) {
 964         slap_mask_t restrictops = 0;
 965         int i, j;
 966         struct verb_mask_list restrictable_exops[] = {
 967                 { LDAP_EXOP_START_TLS,          SLAP_RESTRICT_EXOP_START_TLS },
 968                 { LDAP_EXOP_MODIFY_PASSWD,      SLAP_RESTRICT_EXOP_MODIFY_PASSWD },
 969                 { LDAP_EXOP_X_WHO_AM_I,         SLAP_RESTRICT_EXOP_WHOAMI },
 970                 { LDAP_EXOP_X_CANCEL,           SLAP_RESTRICT_EXOP_CANCEL },
 971                 { NULL, 0 }
 972         };
 973         struct verb_mask_list restrictable_ops[] = {
 974                 { "bind",               SLAP_RESTRICT_OP_BIND },
 975                 { "add",                SLAP_RESTRICT_OP_ADD },
 976                 { "modify",             SLAP_RESTRICT_OP_MODIFY },
 977                 { "modrdn",             SLAP_RESTRICT_OP_RENAME },
 978                 { "rename",             SLAP_RESTRICT_OP_RENAME },
 979                 { "delete",             SLAP_RESTRICT_OP_DELETE },
 980                 { "search",             SLAP_RESTRICT_OP_SEARCH },
 981                 { "compare",            SLAP_RESTRICT_OP_COMPARE },
 982                 { "read",               SLAP_RESTRICT_OP_READS },
 983                 { "write",              SLAP_RESTRICT_OP_WRITES },
 984                 { NULL, 0 }
 985         };
 986
 987         for(i = 1; i < c->argc; i++) {
 988                 j = verb_to_mask(c, restrictable_ops, i);
 989                 if(restrictable_ops[j].word) {
 990                         restrictops |= restrictable_ops[j].mask;
 991                         continue;
 992                 } else if(!strncasecmp(c->argv[i], "extended", STRLENOF("extended"))) {
 993                         char *e = c->argv[i] + STRLENOF("extended");
 994                         if(e[0] == '=') {
 995                                 int k = verb_to_mask(c, restrictable_exops, e[1]);
 996                                 if(restrictable_exops[k].word) {
 997                                         restrictops |= restrictable_exops[k].mask;
 998                                         continue;
 999                                 } else break;
1000                         } else if(!e[0]) {
1001                                 restrictops &= ~SLAP_RESTRICT_EXOP_MASK;
1002                                 restrictops |= SLAP_RESTRICT_OP_EXTENDED;
1003                         } else break;
1004                 }
1005         }
1006         if(i < c->argc) {
1007                 c->be->be_restrictops |= restrictops;
1008                 return(0);
1009         }
1010         Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
1011                 "unknown operation %s in \"restrict <features>\" line\n",
1012                 c->fname, c->lineno, c->argv[i]);
1013         return(1);
1014 }
1015
1016 int
1017 config_allows(ConfigArgs *c) {
1018         slap_mask_t allows = 0;
1019         int i;
1020         struct verb_mask_list allowable_ops[] = {
1021                 { "bind_v2",            SLAP_ALLOW_BIND_V2 },
1022                 { "bind_anon_cred",     SLAP_ALLOW_BIND_ANON_CRED },
1023                 { "bind_anon_dn",       SLAP_ALLOW_BIND_ANON_DN },
1024                 { "update_anon",        SLAP_ALLOW_UPDATE_ANON },
1025                 { NULL, 0 }
1026         };
1027         i = verbs_to_mask(c, allowable_ops, &allows);
1028         if ( i ) {
1029                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
1030                         "unknown feature %s in \"allow <features>\" line\n",
1031                         c->fname, c->lineno, c->argv[i]);
1032                 return(1);
1033         }
1034         global_allows |= allows;
1035         return(0);
1036 }
1037
1038 int
1039 config_disallows(ConfigArgs *c) {
1040         slap_mask_t disallows = 0;
1041         int i;
1042         struct verb_mask_list disallowable_ops[] = {
1043                 { "bind_anon",          SLAP_DISALLOW_BIND_ANON },
1044                 { "bind_simple",        SLAP_DISALLOW_BIND_SIMPLE },
1045                 { "bind_krb4",          SLAP_DISALLOW_BIND_KRBV4 },
1046                 { "tls_2_anon",         SLAP_DISALLOW_TLS_2_ANON },
1047                 { "tls_authc",          SLAP_DISALLOW_TLS_AUTHC },
1048                 { NULL, 0 }
1049         };
1050         i = verbs_to_mask(c, disallowable_ops, &disallows);
1051         if ( i ) {
1052                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
1053                         "unknown feature %s in \"disallow <features>\" line\n",
1054                         c->fname, c->lineno, c->argv[i]);
1055                 return(1);
1056         }
1057         global_disallows |= disallows;
1058         return(0);
1059 }
1060
1061 int
1062 config_requires(ConfigArgs *c) {
1063         slap_mask_t requires = 0;
1064         int i;
1065         struct verb_mask_list requires_ops[] = {
1066                 { "bind",               SLAP_REQUIRE_BIND },
1067                 { "LDAPv3",             SLAP_REQUIRE_LDAP_V3 },
1068                 { "authc",              SLAP_REQUIRE_AUTHC },
1069                 { "sasl",               SLAP_REQUIRE_SASL },
1070                 { "strong",             SLAP_REQUIRE_STRONG },
1071                 { NULL, 0 }
1072         };
1073         i = verbs_to_mask(c, requires_ops, &requires);
1074         if ( i ) {
1075                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
1076                         "unknown feature %s in \"require <features>\" line\n",
1077                         c->fname, c->lineno, c->argv[i]);
1078                 return(1);
1079         }
1080         c->be->be_requires = requires;
1081         return(0);
1082 }
1083
1084 int
1085 config_loglevel(ConfigArgs *c) {
1086         int i;
1087         char *next;
1088         struct verb_mask_list loglevel_ops[] = {
1089                 { "Trace",      LDAP_DEBUG_TRACE },
1090                 { "Packets",    LDAP_DEBUG_PACKETS },
1091                 { "Args",       LDAP_DEBUG_ARGS },
1092                 { "Conns",      LDAP_DEBUG_CONNS },
1093                 { "BER",        LDAP_DEBUG_BER },
1094                 { "Filter",     LDAP_DEBUG_FILTER },
1095                 { "Config",     LDAP_DEBUG_CONFIG },
1096                 { "ACL",        LDAP_DEBUG_ACL },
1097                 { "Stats",      LDAP_DEBUG_STATS },
1098                 { "Stats2",     LDAP_DEBUG_STATS2 },
1099                 { "Shell",      LDAP_DEBUG_SHELL },
1100                 { "Parse",      LDAP_DEBUG_PARSE },
1101                 { "Cache",      LDAP_DEBUG_CACHE },
1102                 { "Index",      LDAP_DEBUG_INDEX },
1103                 { "Any",        -1 },
1104                 { NULL, 0 }
1105         };
1106         ldap_syslog = 0;
1107
1108         for( i=1; i < c->argc; i++ ) {
1109                 int     level;
1110
1111                 if ( isdigit( c->argv[i][0] ) ) {
1112                         level = strtol( c->argv[i], &next, 10 );
1113                         if ( next == NULL || next[0] != '\0' ) {
1114                                 Debug( LDAP_DEBUG_ANY,
1115                                         "%s: line %lu: unable to parse level \"%s\" "
1116                                         "in \"loglevel <level> [...]\" line.\n",
1117                                         c->fname, c->lineno , c->argv[i] );
1118                                 return( 1 );
1119                         }
1120                 } else {
1121                         int j = verb_to_mask(c, loglevel_ops, c->argv[i][0]);
1122                         if(!loglevel_ops[j].word) {
1123                                 Debug( LDAP_DEBUG_ANY,
1124                                         "%s: line %lu: unknown level \"%s\" "
1125                                         "in \"loglevel <level> [...]\" line.\n",
1126                                         c->fname, c->lineno , c->argv[i] );
1127                                 return( 1 );
1128                         }
1129                         level = loglevel_ops[j].mask;
1130                 }
1131                 ldap_syslog |= level;
1132         }
1133         return(0);
1134 }
1135
1136 int
1137 config_syncrepl(ConfigArgs *c) {
1138         if(SLAP_SHADOW(c->be)) {
1139                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
1140                         "syncrepl: database already shadowed.\n",
1141                         c->fname, c->lineno, 0);
1142                 return(1);
1143         } else if(add_syncrepl(c->be, c->argv, c->argc)) {
1144                 return(1);
1145         }
1146         SLAP_DBFLAGS(c->be) |= (SLAP_DBFLAG_SHADOW | SLAP_DBFLAG_SYNC_SHADOW);
1147         return(0);
1148 }
1149
1150 int
1151 config_referral(ConfigArgs *c) {
1152         struct berval vals[2];
1153         if(validate_global_referral(c->argv[1])) {
1154                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
1155                         "invalid URL (%s) in \"referral\" line.\n",
1156                         c->fname, c->lineno, c->argv[1] );
1157                 return(1);
1158         }
1159
1160         ber_str2bv(c->argv[1], 0, 1, &vals[0]);
1161         vals[1].bv_val = NULL; vals[1].bv_len = 0;
1162         if(value_add(&default_referral, vals)) return(LDAP_OTHER);
1163         return(0);
1164 }
1165
1166 int
1167 config_security(ConfigArgs *c) {
1168         slap_ssf_set_t *set = &c->be->be_ssf_set;
1169         char *next;
1170         int i;
1171         for(i = 1; i < c->argc; i++) {
1172                 slap_ssf_t *tgt;
1173                 char *src;
1174                 if(!strncasecmp(c->argv[i], "ssf=", 4)) {
1175                         tgt = &set->sss_ssf;
1176                         src = &c->argv[i][4];
1177                 } else if(!strncasecmp(c->argv[i], "transport=", 10)) {
1178                         tgt = &set->sss_transport;
1179                         src = &c->argv[i][10];
1180                 } else if(!strncasecmp(c->argv[i], "tls=", 4)) {
1181                         tgt = &set->sss_tls;
1182                         src = &c->argv[i][4];
1183                 } else if(!strncasecmp(c->argv[i], "sasl=", 5)) {
1184                         tgt = &set->sss_sasl;
1185                         src = &c->argv[i][5];
1186                 } else if(!strncasecmp(c->argv[i], "update_ssf=", 11)) {
1187                         tgt = &set->sss_update_ssf;
1188                         src = &c->argv[i][11];
1189                 } else if(!strncasecmp(c->argv[i], "update_transport=", 17)) {
1190                         tgt = &set->sss_update_transport;
1191                         src = &c->argv[i][17];
1192                 } else if(!strncasecmp(c->argv[i], "update_tls=", 11)) {
1193                         tgt = &set->sss_update_tls;
1194                         src = &c->argv[i][11];
1195                 } else if(!strncasecmp(c->argv[i], "update_sasl=", 12)) {
1196                         tgt = &set->sss_update_sasl;
1197                         src = &c->argv[i][12];
1198                 } else if(!strncasecmp(c->argv[i], "simple_bind=", 12)) {
1199                         tgt = &set->sss_simple_bind;
1200                         src = &c->argv[i][12];
1201                 } else {
1202                         Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
1203                                 "unknown factor %s in \"security <factors>\" line\n",
1204                                 c->fname, c->lineno, c->argv[i]);
1205                         return(1);
1206                 }
1207
1208                 *tgt = strtol(src, &next, 10);
1209                 if(next == NULL || next[0] != '\0' ) {
1210                         Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
1211                                 "unable to parse factor \"%s\" in \"security <factors>\" line\n",
1212                                 c->fname, c->lineno, c->argv[i]);
1213                         return(1);
1214                 }
1215         }
1216         return(0);
1217 }
1218
1219 int
1220 config_replica(ConfigArgs *c) {
1221         int i, nr = -1;
1222         char *replicahost;
1223         LDAPURLDesc *ludp;
1224
1225         if(SLAP_MONITOR(c->be)) {
1226                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
1227                         "\"replica\" should not be used inside monitor database\n",
1228                         c->fname, c->lineno, 0);
1229                 return(0);      /* FIXME: should this be an error? */
1230         }
1231
1232         for(i = 1; i < c->argc; i++) {
1233                 if(!strncasecmp(c->argv[i], "host=", 5)) {
1234                         nr = add_replica_info(c->be, c->argv[i] + 5);
1235                         break;
1236                 } else if(!strncasecmp(c->argv[i], "uri=", 4)) {
1237                         if(ldap_url_parse(c->argv[i] + 4, &ludp) != LDAP_SUCCESS) {
1238                                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
1239                                         "replica line contains invalid "
1240                                         "uri definition.\n", c->fname, c->lineno, 0);
1241                                 return(1);
1242                         }
1243                         if(!ludp->lud_host) {
1244                                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
1245                                         "replica line contains invalid "
1246                                         "uri definition - missing hostname.\n", c->fname, c->lineno, 0);
1247                                 return(1);
1248                         }
1249                         replicahost = ch_malloc(strlen(c->argv[i]));
1250                         if(!replicahost) {
1251                                 Debug(LDAP_DEBUG_ANY,
1252                                         "out of memory in read_config\n", 0, 0, 0);
1253                                 ldap_free_urldesc(ludp);
1254                                 exit(EXIT_FAILURE);
1255                         }
1256                         sprintf(replicahost, "%s:%d", ludp->lud_host, ludp->lud_port);
1257                         nr = add_replica_info(c->be, replicahost);
1258                         ldap_free_urldesc(ludp);
1259                         ch_free(replicahost);
1260                         break;
1261                 }
1262         }
1263         if(i == c->argc) {
1264                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
1265                         "missing host or uri in \"replica\" line\n",
1266                         c->fname, c->lineno, 0);
1267                 return(1);
1268         } else if(nr == -1) {
1269                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
1270                         "unable to add replica \"%s\"\n",
1271                         c->fname, c->lineno, c->argv[i] + 5);
1272                 return(1);
1273         } else {
1274                 for(i = 1; i < c->argc; i++) {
1275                         if(!strncasecmp(c->argv[i], "suffix=", 7)) {
1276                                 switch(add_replica_suffix(c->be, nr, c->argv[i] + 7)) {
1277                                         case 1:
1278                                                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
1279                                                 "suffix \"%s\" in \"replica\" line is not valid for backend (ignored)\n",
1280                                                 c->fname, c->lineno, c->argv[i] + 7);
1281                                                 break;
1282                                         case 2:
1283                                                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
1284                                                 "unable to normalize suffix in \"replica\" line (ignored)\n",
1285                                                 c->fname, c->lineno, 0);
1286                                                 break;
1287                                 }
1288
1289                         } else if(!strncasecmp(c->argv[i], "attr", 4)) {
1290                                 int exclude = 0;
1291                                 char *arg = c->argv[i] + 4;
1292                                 if(arg[0] == '!') {
1293                                         arg++;
1294                                         exclude = 1;
1295                                 }
1296                                 if(arg[0] != '=') {
1297                                         continue;
1298                                 }
1299                                 if(add_replica_attrs(c->be, nr, arg + 1, exclude)) {
1300                                         Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
1301                                                 "attribute \"%s\" in \"replica\" line is unknown\n",
1302                                                 c->fname, c->lineno, arg + 1);
1303                                         return(1);
1304                                 }
1305                         }
1306                 }
1307         }
1308         return(0);
1309 }
1310
1311 int
1312 config_updatedn(ConfigArgs *c) {
1313         struct berval dn;
1314         int rc;
1315         if(SLAP_SHADOW(c->be)) {
1316                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
1317                         "updatedn: database already shadowed.\n",
1318                         c->fname, c->lineno, 0);
1319                 return(1);
1320         }
1321
1322         ber_str2bv(c->argv[1], 0, 0, &dn);
1323
1324         rc = dnNormalize(0, NULL, NULL, &dn, &c->be->be_update_ndn, NULL);
1325
1326         if(rc != LDAP_SUCCESS) {
1327                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
1328                         "updatedn DN is invalid\n", c->fname, c->lineno, 0);
1329                 return(1);
1330         }
1331
1332         SLAP_DBFLAGS(c->be) |= (SLAP_DBFLAG_SHADOW | SLAP_DBFLAG_SLURP_SHADOW);
1333         return(0);
1334 }
1335
1336 int
1337 config_updateref(ConfigArgs *c) {
1338         struct berval vals[2];
1339         if(!SLAP_SHADOW(c->be)) {
1340                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
1341                         "updateref line must after syncrepl or updatedn.\n",
1342                         c->fname, c->lineno, 0);
1343                 return(1);
1344         }
1345
1346         if(validate_global_referral(c->argv[1])) {
1347                 Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
1348                         "invalid URL (%s) in \"updateref\" line.\n",
1349                         c->fname, c->lineno, c->argv[1]);
1350                 return(1);
1351         }
1352         ber_str2bv(c->argv[1], 0, 0, &vals[0]);
1353         vals[1].bv_val = NULL;
1354         if(value_add(&c->be->be_update_refs, vals)) return(LDAP_OTHER);
1355         return(0);
1356 }
1357
1358 /* XXX meaningless in ldif */
1359
1360 int
1361 config_include(ConfigArgs *c) {
1362         char *savefname = ch_strdup(c->argv[1]);
1363         unsigned long savelineno = c->lineno;
1364         int rc;
1365         rc = read_config_file(savefname, c->depth + 1, c);
1366         free(savefname);
1367         c->lineno = savelineno - 1;
1368         return(rc);
1369 }
1370
1371 #ifdef HAVE_TLS
1372 int
1373 config_tls_option(ConfigArgs *c) {
1374         int flag;
1375         switch(c->type) {
1376         case CFG_TLS_RAND:              flag = LDAP_OPT_X_TLS_RANDOM_FILE;      break;
1377         case CFG_TLS_CIPHER:            flag = LDAP_OPT_X_TLS_CIPHER_SUITE;     break;
1378         case CFG_TLS_CERT_FILE: flag = LDAP_OPT_X_TLS_CERTFILE;         break;
1379         case CFG_TLS_CERT_KEY:  flag = LDAP_OPT_X_TLS_KEYFILE;          break;
1380         case CFG_TLS_CERT_PATH: flag = LDAP_OPT_X_TLS_CACERTDIR;        break;
1381         case CFG_TLS_CA_FILE:   flag = LDAP_OPT_X_TLS_CACERTFILE;       break;
1382 #ifdef HAVE_OPENSSL_CRL
1383         case CFG_TLS_CRLCHECK:  flag = LDAP_OPT_X_TLS_CRLCHECK;         break;
1384 #endif
1385                 default:                Debug(LDAP_DEBUG_ANY, "%s: line %lu: "
1386                                                 "unknown tls_option <%x>\n",
1387                                                 c->fname, c->lineno, c->type);
1388         }
1389         return(ldap_pvt_tls_set_option(NULL, flag, c->argv[1]));
1390 }
1391
1392 int
1393 config_tls_verify(ConfigArgs *c) {
1394         int i;
1395         if(isdigit((unsigned char)c->argv[1][0])) {
1396                 i = atoi(c->argv[1]);
1397                 return(ldap_pvt_tls_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &i));
1398         } else {
1399                 return(ldap_int_tls_config(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, c->argv[1]));
1400         }
1401 }
1402 #endif
1403
1404 /* -------------------------------------- */
1405
1406
1407 static char *
1408 strtok_quote( char *line, char *sep )
1409 {
1410         int             inquote;
1411         char            *tmp;
1412         static char     *next;
1413
1414         strtok_quote_ptr = NULL;
1415         if ( line != NULL ) {
1416                 next = line;
1417         }
1418         while ( *next && strchr( sep, *next ) ) {
1419                 next++;
1420         }
1421
1422         if ( *next == '\0' ) {
1423                 next = NULL;
1424                 return( NULL );
1425         }
1426         tmp = next;
1427
1428         for ( inquote = 0; *next; ) {
1429                 switch ( *next ) {
1430                 case '"':
1431                         if ( inquote ) {
1432                                 inquote = 0;
1433                         } else {
1434                                 inquote = 1;
1435                         }
1436                         AC_MEMCPY( next, next + 1, strlen( next + 1 ) + 1 );
1437                         break;
1438
1439                 case '\\':
1440                         if ( next[1] )
1441                                 AC_MEMCPY( next,
1442                                             next + 1, strlen( next + 1 ) + 1 );
1443                         next++;         /* dont parse the escaped character */
1444                         break;
1445
1446                 default:
1447                         if ( ! inquote ) {
1448                                 if ( strchr( sep, *next ) != NULL ) {
1449                                         strtok_quote_ptr = next;
1450                                         *next++ = '\0';
1451                                         return( tmp );
1452                                 }
1453                         }
1454                         next++;
1455                         break;
1456                 }
1457         }
1458
1459         return( tmp );
1460 }
1461
1462 static char     buf[BUFSIZ];
1463 static char     *line;
1464 static size_t lmax, lcur;
1465
1466 #define CATLINE( buf ) \
1467         do { \
1468                 size_t len = strlen( buf ); \
1469                 while ( lcur + len + 1 > lmax ) { \
1470                         lmax += BUFSIZ; \
1471                         line = (char *) ch_realloc( line, lmax ); \
1472                 } \
1473                 strcpy( line + lcur, buf ); \
1474                 lcur += len; \
1475         } while( 0 )
1476
1477 static void
1478 fp_getline_init(ConfigArgs *c) {
1479         c->lineno = -1;
1480         buf[0] = '\0';
1481 }
1482
1483 static int
1484 fp_getline( FILE *fp, ConfigArgs *c )
1485 {
1486         char    *p;
1487
1488         lcur = 0;
1489         CATLINE(buf);
1490         c->lineno++;
1491
1492         /* avoid stack of bufs */
1493         if ( strncasecmp( line, "include", STRLENOF( "include" ) ) == 0 ) {
1494                 buf[0] = '\0';
1495                 c->line = line;
1496                 return(1);
1497         }
1498
1499         while ( fgets( buf, sizeof( buf ), fp ) ) {
1500                 p = strchr( buf, '\n' );
1501                 if ( p ) {
1502                         if ( p > buf && p[-1] == '\r' ) {
1503                                 --p;
1504                         }
1505                         *p = '\0';
1506                 }
1507                 /* XXX ugly */
1508                 c->line = line;
1509                 if ( line[0]
1510                                 && ( p = line + strlen( line ) - 1 )[0] == '\\'
1511                                 && p[-1] != '\\' )
1512                 {
1513                         p[0] = '\0';
1514                         lcur--;
1515
1516                 } else {
1517                         if ( !isspace( (unsigned char)buf[0] ) ) {
1518                                 return(1);
1519                         }
1520                         buf[0] = ' ';
1521                 }
1522                 CATLINE(buf);
1523                 c->lineno++;
1524         }
1525
1526         buf[0] = '\0';
1527         c->line = line;
1528         return(line[0] ? 1 : 0);
1529 }
1530
1531 static int
1532 fp_parse_line(ConfigArgs *c)
1533 {
1534         char *token;
1535         char *tline = ch_strdup(c->line);
1536         char *hide[] = { "rootpw", "replica", "bindpw", "pseudorootpw", "dbpasswd", '\0' };
1537         int i;
1538
1539         c->argc = 0;
1540         token = strtok_quote(tline, " \t");
1541
1542         if(token) for(i = 0; hide[i]; i++) if(!strcasecmp(token, hide[i])) break;
1543         if(strtok_quote_ptr) *strtok_quote_ptr = ' ';
1544         Debug(LDAP_DEBUG_CONFIG, "line %lu (%s%s)\n", c->lineno, hide[i] ? hide[i] : c->line, hide[i] ? " ***" : "");
1545         if(strtok_quote_ptr) *strtok_quote_ptr = '\0';
1546
1547         for(; token; token = strtok_quote(NULL, " \t")) {
1548                 if(c->argc == c->argv_size - 1) {
1549                         char **tmp;
1550                         tmp = ch_realloc(c->argv, (c->argv_size + ARGS_STEP) * sizeof(*c->argv));
1551                         if(!tmp) {
1552                                 Debug(LDAP_DEBUG_ANY, "line %lu: out of memory\n", c->lineno, 0, 0);
1553                                 return -1;
1554                         }
1555                         c->argv = tmp;
1556                         c->argv_size += ARGS_STEP;
1557                 }
1558                 c->argv[c->argc++] = token;
1559         }
1560         c->argv[c->argc] = NULL;
1561         return(0);
1562 }
1563
1564
1565 #if 0
1566 /* Loads ucdata, returns 1 if loading, 0 if already loaded, -1 on error */
1567 static int
1568 load_ucdata( char *path )
1569 {
1570 #if 0
1571         static int loaded = 0;
1572         int err;
1573
1574         if ( loaded ) {
1575                 return( 0 );
1576         }
1577         err = ucdata_load( path ? path : SLAPD_DEFAULT_UCDATA, UCDATA_ALL );
1578         if ( err ) {
1579                 Debug( LDAP_DEBUG_ANY, "error loading ucdata (error %d)\n",
1580                        err, 0, 0 );
1581
1582                 return( -1 );
1583         }
1584         loaded = 1;
1585         return( 1 );
1586 #else
1587         /* ucdata is now hardcoded */
1588         return( 0 );
1589 #endif
1590 }
1591 #endif
1592
1593 void
1594 config_destroy( )
1595 {
1596         ucdata_unload( UCDATA_ALL );
1597         if ( frontendDB ) {
1598                 /* NOTE: in case of early exit, frontendDB can be NULL */
1599                 if ( frontendDB->be_schemandn.bv_val )
1600                         free( frontendDB->be_schemandn.bv_val );
1601                 if ( frontendDB->be_schemadn.bv_val )
1602                         free( frontendDB->be_schemadn.bv_val );
1603                 if ( frontendDB->be_acl )
1604                         acl_destroy( frontendDB->be_acl, NULL );
1605         }
1606         free( line );
1607         if ( slapd_args_file )
1608                 free ( slapd_args_file );
1609         if ( slapd_pid_file )
1610                 free ( slapd_pid_file );
1611         if ( default_passwd_hash )
1612                 ldap_charray_free( default_passwd_hash );
1613 }
1614
1615 static int
1616 add_syncrepl(
1617         Backend *be,
1618         char    **cargv,
1619         int     cargc
1620 )
1621 {
1622         syncinfo_t *si;
1623         syncinfo_t *si_entry;
1624         int     rc = 0;
1625         int duplicated_replica_id = 0;
1626
1627         si = (syncinfo_t *) ch_calloc( 1, sizeof( syncinfo_t ) );
1628
1629         if ( si == NULL ) {
1630                 Debug( LDAP_DEBUG_ANY, "out of memory in add_syncrepl\n", 0, 0, 0 );
1631                 return 1;
1632         }
1633
1634         si->si_tls = SYNCINFO_TLS_OFF;
1635         if ( be->be_rootndn.bv_val ) {
1636                 ber_dupbv( &si->si_updatedn, &be->be_rootndn );
1637         }
1638         si->si_bindmethod = LDAP_AUTH_SIMPLE;
1639         si->si_schemachecking = 0;
1640         ber_str2bv( "(objectclass=*)", STRLENOF("(objectclass=*)"), 1,
1641                 &si->si_filterstr );
1642         si->si_base.bv_val = NULL;
1643         si->si_scope = LDAP_SCOPE_SUBTREE;
1644         si->si_attrsonly = 0;
1645         si->si_anlist = (AttributeName *) ch_calloc( 1, sizeof( AttributeName ));
1646         si->si_exanlist = (AttributeName *) ch_calloc( 1, sizeof( AttributeName ));
1647         si->si_attrs = NULL;
1648         si->si_allattrs = 0;
1649         si->si_allopattrs = 0;
1650         si->si_exattrs = NULL;
1651         si->si_type = LDAP_SYNC_REFRESH_ONLY;
1652         si->si_interval = 86400;
1653         si->si_retryinterval = NULL;
1654         si->si_retrynum_init = NULL;
1655         si->si_retrynum = NULL;
1656         si->si_syncCookie.ctxcsn = NULL;
1657         si->si_syncCookie.octet_str = NULL;
1658         si->si_syncCookie.sid = -1;
1659         si->si_manageDSAit = 0;
1660         si->si_tlimit = 0;
1661         si->si_slimit = 0;
1662
1663         si->si_presentlist = NULL;
1664         LDAP_LIST_INIT( &si->si_nonpresentlist );
1665
1666         rc = parse_syncrepl_line( cargv, cargc, si );
1667
1668         LDAP_STAILQ_FOREACH( si_entry, &be->be_syncinfo, si_next ) {
1669                 if ( si->si_rid == si_entry->si_rid ) {
1670                         Debug( LDAP_DEBUG_ANY,
1671                                 "add_syncrepl: duplicated replica id\n",0, 0, 0 );
1672                         duplicated_replica_id = 1;
1673                         break;
1674                 }
1675         }
1676
1677         if ( rc < 0 || duplicated_replica_id ) {
1678                 Debug( LDAP_DEBUG_ANY, "failed to add syncinfo\n", 0, 0, 0 );
1679                 syncinfo_free( si );
1680                 return 1;
1681         } else {
1682                 Debug( LDAP_DEBUG_CONFIG,
1683                         "Config: ** successfully added syncrepl \"%s\"\n",
1684                         si->si_provideruri == NULL ? "(null)" : si->si_provideruri, 0, 0 );
1685                 if ( !si->si_schemachecking ) {
1686                         SLAP_DBFLAGS(be) |= SLAP_DBFLAG_NO_SCHEMA_CHECK;
1687                 }
1688                 si->si_be = be;
1689                 LDAP_STAILQ_INSERT_TAIL( &be->be_syncinfo, si, si_next );
1690                 return 0;
1691         }
1692 }
1693
1694 /* NOTE: used & documented in slapd.conf(5) */
1695 #define IDSTR                   "rid"
1696 #define PROVIDERSTR             "provider"
1697 #define TYPESTR                 "type"
1698 #define INTERVALSTR             "interval"
1699 #define SEARCHBASESTR           "searchbase"
1700 #define FILTERSTR               "filter"
1701 #define SCOPESTR                "scope"
1702 #define ATTRSSTR                "attrs"
1703 #define ATTRSONLYSTR            "attrsonly"
1704 #define SLIMITSTR               "sizelimit"
1705 #define TLIMITSTR               "timelimit"
1706 #define SCHEMASTR               "schemachecking"
1707 #define UPDATEDNSTR             "updatedn"
1708 #define BINDMETHSTR             "bindmethod"
1709 #define SIMPLESTR                       "simple"
1710 #define SASLSTR                         "sasl"
1711 #define BINDDNSTR               "binddn"
1712 #define SASLMECHSTR             "saslmech"
1713 #define AUTHCSTR                "authcID"
1714 #define AUTHZSTR                "authzID"
1715 #define CREDSTR                 "credentials"
1716 #define REALMSTR                "realm"
1717 #define SECPROPSSTR             "secprops"
1718
1719 /* FIXME: undocumented */
1720 #define OLDAUTHCSTR             "bindprincipal"
1721 #define STARTTLSSTR             "starttls"
1722 #define CRITICALSTR                     "critical"
1723 #define EXATTRSSTR              "exattrs"
1724 #define MANAGEDSAITSTR          "manageDSAit"
1725 #define RETRYSTR                "retry"
1726
1727 /* FIXME: unused */
1728 #define LASTMODSTR              "lastmod"
1729 #define LMGENSTR                "gen"
1730 #define LMNOSTR                 "no"
1731 #define LMREQSTR                "req"
1732 #define SRVTABSTR               "srvtab"
1733 #define SUFFIXSTR               "suffix"
1734
1735 /* mandatory */
1736 #define GOT_ID                  0x0001
1737 #define GOT_PROVIDER            0x0002
1738 #define GOT_METHOD              0x0004
1739
1740 /* check */
1741 #define GOT_ALL                 (GOT_ID|GOT_PROVIDER|GOT_METHOD)
1742
1743 static int
1744 parse_syncrepl_line(
1745         char            **cargv,
1746         int             cargc,
1747         syncinfo_t      *si
1748 )
1749 {
1750         int     gots = 0;
1751         int     i;
1752         char    *val;
1753
1754         for ( i = 1; i < cargc; i++ ) {
1755                 if ( !strncasecmp( cargv[ i ], IDSTR "=",
1756                                         STRLENOF( IDSTR "=" ) ) )
1757                 {
1758                         int tmp;
1759                         /* '\0' string terminator accounts for '=' */
1760                         val = cargv[ i ] + STRLENOF( IDSTR "=" );
1761                         tmp= atoi( val );
1762                         if ( tmp >= 1000 || tmp < 0 ) {
1763                                 fprintf( stderr, "Error: parse_syncrepl_line: "
1764                                          "syncrepl id %d is out of range [0..999]\n", tmp );
1765                                 return -1;
1766                         }
1767                         si->si_rid = tmp;
1768                         gots |= GOT_ID;
1769                 } else if ( !strncasecmp( cargv[ i ], PROVIDERSTR "=",
1770                                         STRLENOF( PROVIDERSTR "=" ) ) )
1771                 {
1772                         val = cargv[ i ] + STRLENOF( PROVIDERSTR "=" );
1773                         si->si_provideruri = ch_strdup( val );
1774                         si->si_provideruri_bv = (BerVarray)
1775                                 ch_calloc( 2, sizeof( struct berval ));
1776                         ber_str2bv( si->si_provideruri, strlen( si->si_provideruri ),
1777                                 1, &si->si_provideruri_bv[0] );
1778                         si->si_provideruri_bv[1].bv_len = 0;
1779                         si->si_provideruri_bv[1].bv_val = NULL;
1780                         gots |= GOT_PROVIDER;
1781                 } else if ( !strncasecmp( cargv[ i ], STARTTLSSTR "=",
1782                                         STRLENOF(STARTTLSSTR "=") ) )
1783                 {
1784                         val = cargv[ i ] + STRLENOF( STARTTLSSTR "=" );
1785                         if( !strcasecmp( val, CRITICALSTR ) ) {
1786                                 si->si_tls = SYNCINFO_TLS_CRITICAL;
1787                         } else {
1788                                 si->si_tls = SYNCINFO_TLS_ON;
1789                         }
1790                 } else if ( !strncasecmp( cargv[ i ], UPDATEDNSTR "=",
1791                                         STRLENOF( UPDATEDNSTR "=" ) ) )
1792                 {
1793                         struct berval updatedn = BER_BVNULL;
1794
1795                         val = cargv[ i ] + STRLENOF( UPDATEDNSTR "=" );
1796                         ber_str2bv( val, 0, 0, &updatedn );
1797                         ch_free( si->si_updatedn.bv_val );
1798                         dnNormalize( 0, NULL, NULL, &updatedn, &si->si_updatedn, NULL );
1799                 } else if ( !strncasecmp( cargv[ i ], BINDMETHSTR "=",
1800                                 STRLENOF( BINDMETHSTR "=" ) ) )
1801                 {
1802                         val = cargv[ i ] + STRLENOF( BINDMETHSTR "=" );
1803                         if ( !strcasecmp( val, SIMPLESTR )) {
1804                                 si->si_bindmethod = LDAP_AUTH_SIMPLE;
1805                                 gots |= GOT_METHOD;
1806                         } else if ( !strcasecmp( val, SASLSTR )) {
1807 #ifdef HAVE_CYRUS_SASL
1808                                 si->si_bindmethod = LDAP_AUTH_SASL;
1809                                 gots |= GOT_METHOD;
1810 #else /* HAVE_CYRUS_SASL */
1811                                 fprintf( stderr, "Error: parse_syncrepl_line: "
1812                                         "not compiled with SASL support\n" );
1813                                 return -1;
1814 #endif /* HAVE_CYRUS_SASL */
1815                         } else {
1816                                 si->si_bindmethod = -1;
1817                         }
1818                 } else if ( !strncasecmp( cargv[ i ], BINDDNSTR "=",
1819                                         STRLENOF( BINDDNSTR "=" ) ) )
1820                 {
1821                         val = cargv[ i ] + STRLENOF( BINDDNSTR "=" );
1822                         si->si_binddn = ch_strdup( val );
1823                 } else if ( !strncasecmp( cargv[ i ], CREDSTR "=",
1824                                         STRLENOF( CREDSTR "=" ) ) )
1825                 {
1826                         val = cargv[ i ] + STRLENOF( CREDSTR "=" );
1827                         si->si_passwd = ch_strdup( val );
1828                 } else if ( !strncasecmp( cargv[ i ], SASLMECHSTR "=",
1829                                         STRLENOF( SASLMECHSTR "=" ) ) )
1830                 {
1831                         val = cargv[ i ] + STRLENOF( SASLMECHSTR "=" );
1832                         si->si_saslmech = ch_strdup( val );
1833                 } else if ( !strncasecmp( cargv[ i ], SECPROPSSTR "=",
1834                                         STRLENOF( SECPROPSSTR "=" ) ) )
1835                 {
1836                         val = cargv[ i ] + STRLENOF( SECPROPSSTR "=" );
1837                         si->si_secprops = ch_strdup( val );
1838                 } else if ( !strncasecmp( cargv[ i ], REALMSTR "=",
1839                                         STRLENOF( REALMSTR "=" ) ) )
1840                 {
1841                         val = cargv[ i ] + STRLENOF( REALMSTR "=" );
1842                         si->si_realm = ch_strdup( val );
1843                 } else if ( !strncasecmp( cargv[ i ], AUTHCSTR "=",
1844                                         STRLENOF( AUTHCSTR "=" ) ) )
1845                 {
1846                         val = cargv[ i ] + STRLENOF( AUTHCSTR "=" );
1847                         if ( si->si_authcId )
1848                                 ch_free( si->si_authcId );
1849                         si->si_authcId = ch_strdup( val );
1850                 } else if ( !strncasecmp( cargv[ i ], OLDAUTHCSTR "=",
1851                                         STRLENOF( OLDAUTHCSTR "=" ) ) )
1852                 {
1853                         /* Old authcID is provided for some backwards compatibility */
1854                         val = cargv[ i ] + STRLENOF( OLDAUTHCSTR "=" );
1855                         if ( si->si_authcId )
1856                                 ch_free( si->si_authcId );
1857                         si->si_authcId = ch_strdup( val );
1858                 } else if ( !strncasecmp( cargv[ i ], AUTHZSTR "=",
1859                                         STRLENOF( AUTHZSTR "=" ) ) )
1860                 {
1861                         val = cargv[ i ] + STRLENOF( AUTHZSTR "=" );
1862                         si->si_authzId = ch_strdup( val );
1863                 } else if ( !strncasecmp( cargv[ i ], SCHEMASTR "=",
1864                                         STRLENOF( SCHEMASTR "=" ) ) )
1865                 {
1866                         val = cargv[ i ] + STRLENOF( SCHEMASTR "=" );
1867                         if ( !strncasecmp( val, "on", STRLENOF( "on" ) )) {
1868                                 si->si_schemachecking = 1;
1869                         } else if ( !strncasecmp( val, "off", STRLENOF( "off" ) ) ) {
1870                                 si->si_schemachecking = 0;
1871                         } else {
1872                                 si->si_schemachecking = 1;
1873                         }
1874                 } else if ( !strncasecmp( cargv[ i ], FILTERSTR "=",
1875                                         STRLENOF( FILTERSTR "=" ) ) )
1876                 {
1877                         val = cargv[ i ] + STRLENOF( FILTERSTR "=" );
1878                         ber_str2bv( val, 0, 1, &si->si_filterstr );
1879                 } else if ( !strncasecmp( cargv[ i ], SEARCHBASESTR "=",
1880                                         STRLENOF( SEARCHBASESTR "=" ) ) )
1881                 {
1882                         struct berval bv;
1883                         val = cargv[ i ] + STRLENOF( SEARCHBASESTR "=" );
1884                         if ( si->si_base.bv_val ) {
1885                                 ch_free( si->si_base.bv_val );
1886                         }
1887                         ber_str2bv( val, 0, 0, &bv );
1888                         if ( dnNormalize( 0, NULL, NULL, &bv, &si->si_base, NULL )) {
1889                                 fprintf( stderr, "Invalid base DN \"%s\"\n", val );
1890                                 return -1;
1891                         }
1892                 } else if ( !strncasecmp( cargv[ i ], SCOPESTR "=",
1893                                         STRLENOF( SCOPESTR "=" ) ) )
1894                 {
1895                         val = cargv[ i ] + STRLENOF( SCOPESTR "=" );
1896                         if ( !strncasecmp( val, "base", STRLENOF( "base" ) )) {
1897                                 si->si_scope = LDAP_SCOPE_BASE;
1898                         } else if ( !strncasecmp( val, "one", STRLENOF( "one" ) )) {
1899                                 si->si_scope = LDAP_SCOPE_ONELEVEL;
1900 #ifdef LDAP_SCOPE_SUBORDINATE
1901                         } else if ( !strcasecmp( val, "subordinate" ) ||
1902                                 !strcasecmp( val, "children" ))
1903                         {
1904                                 si->si_scope = LDAP_SCOPE_SUBORDINATE;
1905 #endif
1906                         } else if ( !strncasecmp( val, "sub", STRLENOF( "sub" ) )) {
1907                                 si->si_scope = LDAP_SCOPE_SUBTREE;
1908                         } else {
1909                                 fprintf( stderr, "Error: parse_syncrepl_line: "
1910                                         "unknown scope \"%s\"\n", val);
1911                                 return -1;
1912                         }
1913                 } else if ( !strncasecmp( cargv[ i ], ATTRSONLYSTR "=",
1914                                         STRLENOF( ATTRSONLYSTR "=" ) ) )
1915                 {
1916                         si->si_attrsonly = 1;
1917                 } else if ( !strncasecmp( cargv[ i ], ATTRSSTR "=",
1918                                         STRLENOF( ATTRSSTR "=" ) ) )
1919                 {
1920                         val = cargv[ i ] + STRLENOF( ATTRSSTR "=" );
1921                         if ( !strncasecmp( val, ":include:", STRLENOF(":include:") ) ) {
1922                                 char *attr_fname;
1923                                 attr_fname = ch_strdup( val + STRLENOF(":include:") );
1924                                 si->si_anlist = file2anlist( si->si_anlist, attr_fname, " ,\t" );
1925                                 if ( si->si_anlist == NULL ) {
1926                                         ch_free( attr_fname );
1927                                         return -1;
1928                                 }
1929                                 ch_free( attr_fname );
1930                         } else {
1931                                 char *str, *s, *next;
1932                                 char delimstr[] = " ,\t";
1933                                 str = ch_strdup( val );
1934                                 for ( s = ldap_pvt_strtok( str, delimstr, &next );
1935                                                 s != NULL;
1936                                                 s = ldap_pvt_strtok( NULL, delimstr, &next ) )
1937                                 {
1938                                         if ( strlen(s) == 1 && *s == '*' ) {
1939                                                 si->si_allattrs = 1;
1940                                                 *(val + ( s - str )) = delimstr[0];
1941                                         }
1942                                         if ( strlen(s) == 1 && *s == '+' ) {
1943                                                 si->si_allopattrs = 1;
1944                                                 *(val + ( s - str )) = delimstr[0];
1945                                         }
1946                                 }
1947                                 ch_free( str );
1948                                 si->si_anlist = str2anlist( si->si_anlist, val, " ,\t" );
1949                                 if ( si->si_anlist == NULL ) {
1950                                         return -1;
1951                                 }
1952                         }
1953                 } else if ( !strncasecmp( cargv[ i ], EXATTRSSTR "=",
1954                                         STRLENOF( EXATTRSSTR "=" ) ) )
1955                 {
1956                         val = cargv[ i ] + STRLENOF( EXATTRSSTR "=" );
1957                         if ( !strncasecmp( val, ":include:", STRLENOF(":include:") )) {
1958                                 char *attr_fname;
1959                                 attr_fname = ch_strdup( val + STRLENOF(":include:") );
1960                                 si->si_exanlist = file2anlist(
1961                                                                         si->si_exanlist, attr_fname, " ,\t" );
1962                                 if ( si->si_exanlist == NULL ) {
1963                                         ch_free( attr_fname );
1964                                         return -1;
1965                                 }
1966                                 ch_free( attr_fname );
1967                         } else {
1968                                 si->si_exanlist = str2anlist( si->si_exanlist, val, " ,\t" );
1969                                 if ( si->si_exanlist == NULL ) {
1970                                         return -1;
1971                                 }
1972                         }
1973                 } else if ( !strncasecmp( cargv[ i ], TYPESTR "=",
1974                                         STRLENOF( TYPESTR "=" ) ) )
1975                 {
1976                         val = cargv[ i ] + STRLENOF( TYPESTR "=" );
1977                         if ( !strncasecmp( val, "refreshOnly",
1978                                                 STRLENOF("refreshOnly") ))
1979                         {
1980                                 si->si_type = LDAP_SYNC_REFRESH_ONLY;
1981                         } else if ( !strncasecmp( val, "refreshAndPersist",
1982                                                 STRLENOF("refreshAndPersist") ))
1983                         {
1984                                 si->si_type = LDAP_SYNC_REFRESH_AND_PERSIST;
1985                                 si->si_interval = 60;
1986                         } else {
1987                                 fprintf( stderr, "Error: parse_syncrepl_line: "
1988                                         "unknown sync type \"%s\"\n", val);
1989                                 return -1;
1990                         }
1991                 } else if ( !strncasecmp( cargv[ i ], INTERVALSTR "=",
1992                                         STRLENOF( INTERVALSTR "=" ) ) )
1993                 {
1994                         val = cargv[ i ] + STRLENOF( INTERVALSTR "=" );
1995                         if ( si->si_type == LDAP_SYNC_REFRESH_AND_PERSIST ) {
1996                                 si->si_interval = 0;
1997                         } else {
1998                                 char *hstr;
1999                                 char *mstr;
2000                                 char *dstr;
2001                                 char *sstr;
2002                                 int dd, hh, mm, ss;
2003                                 dstr = val;
2004                                 hstr = strchr( dstr, ':' );
2005                                 if ( hstr == NULL ) {
2006                                         fprintf( stderr, "Error: parse_syncrepl_line: "
2007                                                 "invalid interval \"%s\"\n", val );
2008                                         return -1;
2009                                 }
2010                                 *hstr++ = '\0';
2011                                 mstr = strchr( hstr, ':' );
2012                                 if ( mstr == NULL ) {
2013                                         fprintf( stderr, "Error: parse_syncrepl_line: "
2014                                                 "invalid interval \"%s\"\n", val );
2015                                         return -1;
2016                                 }
2017                                 *mstr++ = '\0';
2018                                 sstr = strchr( mstr, ':' );
2019                                 if ( sstr == NULL ) {
2020                                         fprintf( stderr, "Error: parse_syncrepl_line: "
2021                                                 "invalid interval \"%s\"\n", val );
2022                                         return -1;
2023                                 }
2024                                 *sstr++ = '\0';
2025
2026                                 dd = atoi( dstr );
2027                                 hh = atoi( hstr );
2028                                 mm = atoi( mstr );
2029                                 ss = atoi( sstr );
2030                                 if (( hh > 24 ) || ( hh < 0 ) ||
2031                                         ( mm > 60 ) || ( mm < 0 ) ||
2032                                         ( ss > 60 ) || ( ss < 0 ) || ( dd < 0 )) {
2033                                         fprintf( stderr, "Error: parse_syncrepl_line: "
2034                                                 "invalid interval \"%s\"\n", val );
2035                                         return -1;
2036                                 }
2037                                 si->si_interval = (( dd * 24 + hh ) * 60 + mm ) * 60 + ss;
2038                         }
2039                         if ( si->si_interval < 0 ) {
2040                                 fprintf( stderr, "Error: parse_syncrepl_line: "
2041                                         "invalid interval \"%ld\"\n",
2042                                         (long) si->si_interval);
2043                                 return -1;
2044                         }
2045                 } else if ( !strncasecmp( cargv[ i ], RETRYSTR "=",
2046                                         STRLENOF( RETRYSTR "=" ) ) )
2047                 {
2048                         char **retry_list;
2049                         int j, k, n;
2050
2051                         val = cargv[ i ] + STRLENOF( RETRYSTR "=" );
2052                         retry_list = (char **) ch_calloc( 1, sizeof( char * ));
2053                         retry_list[0] = NULL;
2054
2055                         slap_str2clist( &retry_list, val, " ,\t" );
2056
2057                         for ( k = 0; retry_list && retry_list[k]; k++ ) ;
2058                         n = k / 2;
2059                         if ( k % 2 ) {
2060                                 fprintf( stderr,
2061                                                 "Error: incomplete syncrepl retry list\n" );
2062                                 for ( k = 0; retry_list && retry_list[k]; k++ ) {
2063                                         ch_free( retry_list[k] );
2064                                 }
2065                                 ch_free( retry_list );
2066                                 exit( EXIT_FAILURE );
2067                         }
2068                         si->si_retryinterval = (time_t *) ch_calloc( n + 1, sizeof( time_t ));
2069                         si->si_retrynum = (int *) ch_calloc( n + 1, sizeof( int ));
2070                         si->si_retrynum_init = (int *) ch_calloc( n + 1, sizeof( int ));
2071                         for ( j = 0; j < n; j++ ) {
2072                                 si->si_retryinterval[j] = atoi( retry_list[j*2] );
2073                                 if ( *retry_list[j*2+1] == '+' ) {
2074                                         si->si_retrynum_init[j] = -1;
2075                                         si->si_retrynum[j] = -1;
2076                                         j++;
2077                                         break;
2078                                 } else {
2079                                         si->si_retrynum_init[j] = atoi( retry_list[j*2+1] );
2080                                         si->si_retrynum[j] = atoi( retry_list[j*2+1] );
2081                                 }
2082                         }
2083                         si->si_retrynum_init[j] = -2;
2084                         si->si_retrynum[j] = -2;
2085                         si->si_retryinterval[j] = 0;
2086
2087                         for ( k = 0; retry_list && retry_list[k]; k++ ) {
2088                                 ch_free( retry_list[k] );
2089                         }
2090                         ch_free( retry_list );
2091                 } else if ( !strncasecmp( cargv[ i ], MANAGEDSAITSTR "=",
2092                                         STRLENOF( MANAGEDSAITSTR "=" ) ) )
2093                 {
2094                         val = cargv[ i ] + STRLENOF( MANAGEDSAITSTR "=" );
2095                         si->si_manageDSAit = atoi( val );
2096                 } else if ( !strncasecmp( cargv[ i ], SLIMITSTR "=",
2097                                         STRLENOF( SLIMITSTR "=") ) )
2098                 {
2099                         val = cargv[ i ] + STRLENOF( SLIMITSTR "=" );
2100                         si->si_slimit = atoi( val );
2101                 } else if ( !strncasecmp( cargv[ i ], TLIMITSTR "=",
2102                                         STRLENOF( TLIMITSTR "=" ) ) )
2103                 {
2104                         val = cargv[ i ] + STRLENOF( TLIMITSTR "=" );
2105                         si->si_tlimit = atoi( val );
2106                 } else {
2107                         fprintf( stderr, "Error: parse_syncrepl_line: "
2108                                 "unknown keyword \"%s\"\n", cargv[ i ] );
2109                         return -1;
2110                 }
2111         }
2112
2113         if ( gots != GOT_ALL ) {
2114                 fprintf( stderr,
2115                         "Error: Malformed \"syncrepl\" line in slapd config file" );
2116                 return -1;
2117         }
2118
2119         return 0;
2120 }
2121
2122 char **
2123 slap_str2clist( char ***out, char *in, const char *brkstr )
2124 {
2125         char    *str;
2126         char    *s;
2127         char    *lasts;
2128         int     i, j;
2129         char    **new;
2130
2131         /* find last element in list */
2132         for (i = 0; *out && (*out)[i]; i++);
2133
2134         /* protect the input string from strtok */
2135         str = ch_strdup( in );
2136
2137         if ( *str == '\0' ) {
2138                 free( str );
2139                 return( *out );
2140         }
2141
2142         /* Count words in string */
2143         j=1;
2144         for ( s = str; *s; s++ ) {
2145                 if ( strchr( brkstr, *s ) != NULL ) {
2146                         j++;
2147                 }
2148         }
2149
2150         *out = ch_realloc( *out, ( i + j + 1 ) * sizeof( char * ) );
2151         new = *out + i;
2152         for ( s = ldap_pvt_strtok( str, brkstr, &lasts );
2153                 s != NULL;
2154                 s = ldap_pvt_strtok( NULL, brkstr, &lasts ) )
2155         {
2156                 *new = ch_strdup( s );
2157                 new++;
2158         }
2159
2160         *new = NULL;
2161         free( str );
2162         return( *out );
2163 }