git.sur5r.net Git - openldap/blob - servers/slapd/dn.c

   1 /* dn.c - routines for dealing with distinguished names */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 1998-2006 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
  17  * All rights reserved.
  18  *
  19  * Redistribution and use in source and binary forms are permitted
  20  * provided that this notice is preserved and that due credit is given
  21  * to the University of Michigan at Ann Arbor. The name of the University
  22  * may not be used to endorse or promote products derived from this
  23  * software without specific prior written permission. This software
  24  * is provided ``as is'' without express or implied warranty.
  25  */
  26
  27 #include "portable.h"
  28
  29 #include <stdio.h>
  30
  31 #include <ac/ctype.h>
  32 #include <ac/socket.h>
  33 #include <ac/string.h>
  34 #include <ac/time.h>
  35
  36 #include "slap.h"
  37 #include "lutil.h"
  38
  39 /*
  40  * The DN syntax-related functions take advantage of the dn representation
  41  * handling functions ldap_str2dn/ldap_dn2str.  The latter are not schema-
  42  * aware, so the attributes and their values need be validated (and possibly
  43  * normalized).  In the current implementation the required validation/nor-
  44  * malization/"pretty"ing are done on newly created DN structural represen-
  45  * tations; however the idea is to move towards DN handling in structural
  46  * representation instead of the current string representation.  To this
  47  * purpose, we need to do only the required operations and keep track of
  48  * what has been done to minimize their impact on performances.
  49  *
  50  * Developers are strongly encouraged to use this feature, to speed-up
  51  * its stabilization.
  52  */
  53
  54 #define AVA_PRIVATE( ava ) ( ( AttributeDescription * )(ava)->la_private )
  55
  56 int slap_DN_strict = SLAP_AD_NOINSERT;
  57
  58 static int
  59 LDAPRDN_validate( LDAPRDN rdn )
  60 {
  61         int             iAVA;
  62         int             rc;
  63
  64         assert( rdn != NULL );
  65
  66         for ( iAVA = 0; rdn[ iAVA ]; iAVA++ ) {
  67                 LDAPAVA                 *ava = rdn[ iAVA ];
  68                 AttributeDescription    *ad;
  69                 slap_syntax_validate_func *validate = NULL;
  70
  71                 assert( ava != NULL );
  72
  73                 if ( ( ad = AVA_PRIVATE( ava ) ) == NULL ) {
  74                         const char      *text = NULL;
  75
  76                         rc = slap_bv2ad( &ava->la_attr, &ad, &text );
  77                         if ( rc != LDAP_SUCCESS ) {
  78                                 rc = slap_bv2undef_ad( &ava->la_attr,
  79                                         &ad, &text,
  80                                         SLAP_AD_PROXIED|slap_DN_strict );
  81                                 if ( rc != LDAP_SUCCESS ) {
  82                                         return LDAP_INVALID_SYNTAX;
  83                                 }
  84                         }
  85
  86                         ava->la_private = ( void * )ad;
  87                 }
  88
  89                 /*
  90                  * Replace attr oid/name with the canonical name
  91                  */
  92                 ava->la_attr = ad->ad_cname;
  93
  94                 validate = ad->ad_type->sat_syntax->ssyn_validate;
  95
  96                 if ( validate ) {
  97                         /*
  98                          * validate value by validate function
  99                          */
 100                         rc = ( *validate )( ad->ad_type->sat_syntax,
 101                                 &ava->la_value );
 102
 103                         if ( rc != LDAP_SUCCESS ) {
 104                                 return LDAP_INVALID_SYNTAX;
 105                         }
 106                 }
 107         }
 108
 109         return LDAP_SUCCESS;
 110 }
 111
 112 /*
 113  * In-place, schema-aware validation of the
 114  * structural representation of a distinguished name.
 115  */
 116 static int
 117 LDAPDN_validate( LDAPDN dn )
 118 {
 119         int             iRDN;
 120         int             rc;
 121
 122         assert( dn != NULL );
 123
 124         for ( iRDN = 0; dn[ iRDN ]; iRDN++ ) {
 125                 LDAPRDN         rdn = dn[ iRDN ];
 126                 int             iAVA;
 127
 128                 assert( rdn != NULL );
 129
 130                 for ( iAVA = 0; rdn[ iAVA ]; iAVA++ ) {
 131                         LDAPAVA                 *ava = rdn[ iAVA ];
 132                         AttributeDescription    *ad;
 133                         slap_syntax_validate_func *validate = NULL;
 134
 135                         assert( ava != NULL );
 136
 137                         if ( ( ad = AVA_PRIVATE( ava ) ) == NULL ) {
 138                                 const char      *text = NULL;
 139
 140                                 rc = slap_bv2ad( &ava->la_attr, &ad, &text );
 141                                 if ( rc != LDAP_SUCCESS ) {
 142                                         rc = slap_bv2undef_ad( &ava->la_attr,
 143                                                 &ad, &text,
 144                                                 SLAP_AD_PROXIED|slap_DN_strict );
 145                                         if ( rc != LDAP_SUCCESS ) {
 146                                                 return LDAP_INVALID_SYNTAX;
 147                                         }
 148                                 }
 149
 150                                 ava->la_private = ( void * )ad;
 151                         }
 152
 153                         /*
 154                          * Replace attr oid/name with the canonical name
 155                          */
 156                         ava->la_attr = ad->ad_cname;
 157
 158                         validate = ad->ad_type->sat_syntax->ssyn_validate;
 159
 160                         if ( validate ) {
 161                                 /*
 162                                  * validate value by validate function
 163                                  */
 164                                 rc = ( *validate )( ad->ad_type->sat_syntax,
 165                                         &ava->la_value );
 166
 167                                 if ( rc != LDAP_SUCCESS ) {
 168                                         return LDAP_INVALID_SYNTAX;
 169                                 }
 170                         }
 171                 }
 172         }
 173
 174         return LDAP_SUCCESS;
 175 }
 176
 177 /*
 178  * dn validate routine
 179  */
 180 int
 181 dnValidate(
 182         Syntax *syntax,
 183         struct berval *in )
 184 {
 185         int             rc;
 186         LDAPDN          dn = NULL;
 187
 188         assert( in != NULL );
 189
 190         if ( in->bv_len == 0 ) {
 191                 return LDAP_SUCCESS;
 192
 193         } else if ( in->bv_len > SLAP_LDAPDN_MAXLEN ) {
 194                 return LDAP_INVALID_SYNTAX;
 195         }
 196
 197         rc = ldap_bv2dn( in, &dn, LDAP_DN_FORMAT_LDAP );
 198         if ( rc != LDAP_SUCCESS ) {
 199                 return LDAP_INVALID_SYNTAX;
 200         }
 201
 202         assert( strlen( in->bv_val ) == in->bv_len );
 203
 204         /*
 205          * Schema-aware validate
 206          */
 207         rc = LDAPDN_validate( dn );
 208         ldap_dnfree( dn );
 209
 210         if ( rc != LDAP_SUCCESS ) {
 211                 return LDAP_INVALID_SYNTAX;
 212         }
 213
 214         return LDAP_SUCCESS;
 215 }
 216
 217 int
 218 rdnValidate(
 219         Syntax *syntax,
 220         struct berval *in )
 221 {
 222         int             rc;
 223         LDAPRDN         rdn;
 224         char*           p;
 225
 226         assert( in != NULL );
 227         if ( in->bv_len == 0 ) {
 228                 return LDAP_SUCCESS;
 229
 230         } else if ( in->bv_len > SLAP_LDAPDN_MAXLEN ) {
 231                 return LDAP_INVALID_SYNTAX;
 232         }
 233
 234         rc = ldap_bv2rdn_x( in , &rdn, (char **) &p,
 235                                 LDAP_DN_FORMAT_LDAP, NULL);
 236         if ( rc != LDAP_SUCCESS ) {
 237                 return LDAP_INVALID_SYNTAX;
 238         }
 239
 240         assert( strlen( in->bv_val ) == in->bv_len );
 241
 242         /*
 243          * Schema-aware validate
 244          */
 245         rc = LDAPRDN_validate( rdn );
 246         ldap_rdnfree( rdn );
 247
 248         if ( rc != LDAP_SUCCESS ) {
 249                 return LDAP_INVALID_SYNTAX;
 250         }
 251
 252         return LDAP_SUCCESS;
 253 }
 254
 255
 256 /*
 257  * AVA sorting inside a RDN
 258  *
 259  * rule: sort attributeTypes in alphabetical order; in case of multiple
 260  * occurrences of the same attributeType, sort values in byte order
 261  * (use memcmp, which implies alphabetical order in case of IA5 value;
 262  * this should guarantee the repeatability of the operation).
 263  *
 264  * Note: the sorting can be slightly improved by sorting first
 265  * by attribute type length, then by alphabetical order.
 266  *
 267  * uses a linear search; should be fine since the number of AVAs in
 268  * a RDN should be limited.
 269  */
 270 static void
 271 AVA_Sort( LDAPRDN rdn, int iAVA )
 272 {
 273         int             i;
 274         LDAPAVA         *ava_in = rdn[ iAVA ];
 275
 276         assert( rdn != NULL );
 277         assert( ava_in != NULL );
 278
 279         for ( i = 0; i < iAVA; i++ ) {
 280                 LDAPAVA         *ava = rdn[ i ];
 281                 int             a, j;
 282
 283                 assert( ava != NULL );
 284
 285                 a = strcmp( ava_in->la_attr.bv_val, ava->la_attr.bv_val );
 286
 287                 if ( a > 0 ) {
 288                         break;
 289                 }
 290
 291                 while ( a == 0 ) {
 292                         int             v, d;
 293
 294                         d = ava_in->la_value.bv_len - ava->la_value.bv_len;
 295
 296                         v = memcmp( ava_in->la_value.bv_val,
 297                                         ava->la_value.bv_val,
 298                                         d <= 0 ? ava_in->la_value.bv_len
 299                                                 : ava->la_value.bv_len );
 300
 301                         if ( v == 0 && d != 0 ) {
 302                                 v = d;
 303                         }
 304
 305                         if ( v <= 0 ) {
 306                                 /*
 307                                  * got it!
 308                                  */
 309                                 break;
 310                         }
 311
 312                         if ( ++i == iAVA ) {
 313                                 /*
 314                                  * already sorted
 315                                  */
 316                                 return;
 317                         }
 318
 319                         ava = rdn[ i ];
 320                         a = strcmp( ava_in->la_attr.bv_val,
 321                                         ava->la_attr.bv_val );
 322                 }
 323
 324                 /*
 325                  * move ahead
 326                  */
 327                 for ( j = iAVA; j > i; j-- ) {
 328                         rdn[ j ] = rdn[ j - 1 ];
 329                 }
 330                 rdn[ i ] = ava_in;
 331
 332                 return;
 333         }
 334 }
 335
 336 static int
 337 LDAPRDN_rewrite( LDAPRDN rdn, unsigned flags, void *ctx )
 338 {
 339
 340         int rc;
 341         int             iAVA;
 342         for ( iAVA = 0; rdn[ iAVA ]; iAVA++ ) {
 343                 LDAPAVA                 *ava = rdn[ iAVA ];
 344                 AttributeDescription    *ad;
 345                 slap_syntax_validate_func *validf = NULL;
 346                 slap_mr_normalize_func *normf = NULL;
 347                 slap_syntax_transform_func *transf = NULL;
 348                 MatchingRule *mr = NULL;
 349                 struct berval           bv = BER_BVNULL;
 350                 int                     do_sort = 0;
 351
 352                 assert( ava != NULL );
 353
 354                 if ( ( ad = AVA_PRIVATE( ava ) ) == NULL ) {
 355                         const char      *text = NULL;
 356
 357                         rc = slap_bv2ad( &ava->la_attr, &ad, &text );
 358                         if ( rc != LDAP_SUCCESS ) {
 359                                 rc = slap_bv2undef_ad( &ava->la_attr,
 360                                         &ad, &text,
 361                                         SLAP_AD_PROXIED|slap_DN_strict );
 362                                 if ( rc != LDAP_SUCCESS ) {
 363                                         return LDAP_INVALID_SYNTAX;
 364                                 }
 365                         }
 366
 367                         ava->la_private = ( void * )ad;
 368                         do_sort = 1;
 369                 }
 370
 371                 /*
 372                  * Replace attr oid/name with the canonical name
 373                  */
 374                 ava->la_attr = ad->ad_cname;
 375
 376                 if( ava->la_flags & LDAP_AVA_BINARY ) {
 377                         if( ava->la_value.bv_len == 0 ) {
 378                                 /* BER encoding is empty */
 379                                 return LDAP_INVALID_SYNTAX;
 380                         }
 381
 382                         /* AVA is binary encoded, don't muck with it */
 383                 } else if( flags & SLAP_LDAPDN_PRETTY ) {
 384                         transf = ad->ad_type->sat_syntax->ssyn_pretty;
 385                         if( !transf ) {
 386                                 validf = ad->ad_type->sat_syntax->ssyn_validate;
 387                         }
 388                 } else { /* normalization */
 389                         validf = ad->ad_type->sat_syntax->ssyn_validate;
 390                         mr = ad->ad_type->sat_equality;
 391                         if( mr && (!( mr->smr_usage & SLAP_MR_MUTATION_NORMALIZER ))) {
 392                                 normf = mr->smr_normalize;
 393                         }
 394                 }
 395
 396                 if ( validf ) {
 397                         /* validate value before normalization */
 398                         rc = ( *validf )( ad->ad_type->sat_syntax,
 399                                 ava->la_value.bv_len
 400                                         ? &ava->la_value
 401                                         : (struct berval *) &slap_empty_bv );
 402
 403                         if ( rc != LDAP_SUCCESS ) {
 404                                 return LDAP_INVALID_SYNTAX;
 405                         }
 406                 }
 407
 408                 if ( transf ) {
 409                         /*
 410                          * transform value by pretty function
 411                          *      if value is empty, use empty_bv
 412                          */
 413                         rc = ( *transf )( ad->ad_type->sat_syntax,
 414                                 ava->la_value.bv_len
 415                                         ? &ava->la_value
 416                                         : (struct berval *) &slap_empty_bv,
 417                                 &bv, ctx );
 418
 419                         if ( rc != LDAP_SUCCESS ) {
 420                                 return LDAP_INVALID_SYNTAX;
 421                         }
 422                 }
 423
 424                 if ( normf ) {
 425                         /*
 426                          * normalize value
 427                          *      if value is empty, use empty_bv
 428                          */
 429                         rc = ( *normf )(
 430                                 SLAP_MR_VALUE_OF_ASSERTION_SYNTAX,
 431                                 ad->ad_type->sat_syntax,
 432                                 mr,
 433                                 ava->la_value.bv_len
 434                                         ? &ava->la_value
 435                                         : (struct berval *) &slap_empty_bv,
 436                                 &bv, ctx );
 437
 438                         if ( rc != LDAP_SUCCESS ) {
 439                                 return LDAP_INVALID_SYNTAX;
 440                         }
 441                 }
 442
 443
 444                 if( bv.bv_val ) {
 445                         if ( ava->la_flags & LDAP_AVA_FREE_VALUE )
 446                                 ber_memfree_x( ava->la_value.bv_val, ctx );
 447                         ava->la_value = bv;
 448                         ava->la_flags |= LDAP_AVA_FREE_VALUE;
 449                 }
 450
 451                 if( do_sort ) AVA_Sort( rdn, iAVA );
 452         }
 453         return LDAP_SUCCESS;
 454 }
 455
 456 /*
 457  * In-place, schema-aware normalization / "pretty"ing of the
 458  * structural representation of a distinguished name.
 459  */
 460 static int
 461 LDAPDN_rewrite( LDAPDN dn, unsigned flags, void *ctx )
 462 {
 463         int             iRDN;
 464         int             rc;
 465
 466         assert( dn != NULL );
 467
 468         for ( iRDN = 0; dn[ iRDN ]; iRDN++ ) {
 469                 LDAPRDN         rdn = dn[ iRDN ];
 470                 int             iAVA;
 471
 472                 assert( rdn != NULL );
 473
 474                 for ( iAVA = 0; rdn[ iAVA ]; iAVA++ ) {
 475                         LDAPAVA                 *ava = rdn[ iAVA ];
 476                         AttributeDescription    *ad;
 477                         slap_syntax_validate_func *validf = NULL;
 478                         slap_mr_normalize_func *normf = NULL;
 479                         slap_syntax_transform_func *transf = NULL;
 480                         MatchingRule *mr = NULL;
 481                         struct berval           bv = BER_BVNULL;
 482                         int                     do_sort = 0;
 483
 484                         assert( ava != NULL );
 485
 486                         if ( ( ad = AVA_PRIVATE( ava ) ) == NULL ) {
 487                                 const char      *text = NULL;
 488
 489                                 rc = slap_bv2ad( &ava->la_attr, &ad, &text );
 490                                 if ( rc != LDAP_SUCCESS ) {
 491                                         rc = slap_bv2undef_ad( &ava->la_attr,
 492                                                 &ad, &text,
 493                                                 SLAP_AD_PROXIED|slap_DN_strict );
 494                                         if ( rc != LDAP_SUCCESS ) {
 495                                                 return LDAP_INVALID_SYNTAX;
 496                                         }
 497                                 }
 498
 499                                 ava->la_private = ( void * )ad;
 500                                 do_sort = 1;
 501                         }
 502
 503                         /*
 504                          * Replace attr oid/name with the canonical name
 505                          */
 506                         ava->la_attr = ad->ad_cname;
 507
 508                         if( ava->la_flags & LDAP_AVA_BINARY ) {
 509                                 if( ava->la_value.bv_len == 0 ) {
 510                                         /* BER encoding is empty */
 511                                         return LDAP_INVALID_SYNTAX;
 512                                 }
 513
 514                                 /* AVA is binary encoded, don't muck with it */
 515                         } else if( flags & SLAP_LDAPDN_PRETTY ) {
 516                                 transf = ad->ad_type->sat_syntax->ssyn_pretty;
 517                                 if( !transf ) {
 518                                         validf = ad->ad_type->sat_syntax->ssyn_validate;
 519                                 }
 520                         } else { /* normalization */
 521                                 validf = ad->ad_type->sat_syntax->ssyn_validate;
 522                                 mr = ad->ad_type->sat_equality;
 523                                 if( mr && (!( mr->smr_usage & SLAP_MR_MUTATION_NORMALIZER ))) {
 524                                         normf = mr->smr_normalize;
 525                                 }
 526                         }
 527
 528                         if ( validf ) {
 529                                 /* validate value before normalization */
 530                                 rc = ( *validf )( ad->ad_type->sat_syntax,
 531                                         ava->la_value.bv_len
 532                                                 ? &ava->la_value
 533                                                 : (struct berval *) &slap_empty_bv );
 534
 535                                 if ( rc != LDAP_SUCCESS ) {
 536                                         return LDAP_INVALID_SYNTAX;
 537                                 }
 538                         }
 539
 540                         if ( transf ) {
 541                                 /*
 542                                  * transform value by pretty function
 543                                  *      if value is empty, use empty_bv
 544                                  */
 545                                 rc = ( *transf )( ad->ad_type->sat_syntax,
 546                                         ava->la_value.bv_len
 547                                                 ? &ava->la_value
 548                                                 : (struct berval *) &slap_empty_bv,
 549                                         &bv, ctx );
 550
 551                                 if ( rc != LDAP_SUCCESS ) {
 552                                         return LDAP_INVALID_SYNTAX;
 553                                 }
 554                         }
 555
 556                         if ( normf ) {
 557                                 /*
 558                                  * normalize value
 559                                  *      if value is empty, use empty_bv
 560                                  */
 561                                 rc = ( *normf )(
 562                                         SLAP_MR_VALUE_OF_ASSERTION_SYNTAX,
 563                                         ad->ad_type->sat_syntax,
 564                                         mr,
 565                                         ava->la_value.bv_len
 566                                                 ? &ava->la_value
 567                                                 : (struct berval *) &slap_empty_bv,
 568                                         &bv, ctx );
 569
 570                                 if ( rc != LDAP_SUCCESS ) {
 571                                         return LDAP_INVALID_SYNTAX;
 572                                 }
 573                         }
 574
 575
 576                         if( bv.bv_val ) {
 577                                 if ( ava->la_flags & LDAP_AVA_FREE_VALUE )
 578                                         ber_memfree_x( ava->la_value.bv_val, ctx );
 579                                 ava->la_value = bv;
 580                                 ava->la_flags |= LDAP_AVA_FREE_VALUE;
 581                         }
 582
 583                         if( do_sort ) AVA_Sort( rdn, iAVA );
 584                 }
 585         }
 586
 587         return LDAP_SUCCESS;
 588 }
 589
 590 int
 591 dnNormalize(
 592     slap_mask_t use,
 593     Syntax *syntax,
 594     MatchingRule *mr,
 595     struct berval *val,
 596     struct berval *out,
 597     void *ctx)
 598 {
 599         assert( val != NULL );
 600         assert( out != NULL );
 601
 602         Debug( LDAP_DEBUG_TRACE, ">>> dnNormalize: <%s>\n", val->bv_val, 0, 0 );
 603
 604         if ( val->bv_len != 0 ) {
 605                 LDAPDN          dn = NULL;
 606                 int             rc;
 607
 608                 /*
 609                  * Go to structural representation
 610                  */
 611                 rc = ldap_bv2dn_x( val, &dn, LDAP_DN_FORMAT_LDAP, ctx );
 612                 if ( rc != LDAP_SUCCESS ) {
 613                         return LDAP_INVALID_SYNTAX;
 614                 }
 615
 616                 assert( strlen( val->bv_val ) == val->bv_len );
 617
 618                 /*
 619                  * Schema-aware rewrite
 620                  */
 621                 if ( LDAPDN_rewrite( dn, 0, ctx ) != LDAP_SUCCESS ) {
 622                         ldap_dnfree_x( dn, ctx );
 623                         return LDAP_INVALID_SYNTAX;
 624                 }
 625
 626                 /*
 627                  * Back to string representation
 628                  */
 629                 rc = ldap_dn2bv_x( dn, out,
 630                         LDAP_DN_FORMAT_LDAPV3 | LDAP_DN_PRETTY, ctx );
 631
 632                 ldap_dnfree_x( dn, ctx );
 633
 634                 if ( rc != LDAP_SUCCESS ) {
 635                         return LDAP_INVALID_SYNTAX;
 636                 }
 637         } else {
 638                 ber_dupbv_x( out, val, ctx );
 639         }
 640
 641         Debug( LDAP_DEBUG_TRACE, "<<< dnNormalize: <%s>\n", out->bv_val, 0, 0 );
 642
 643         return LDAP_SUCCESS;
 644 }
 645
 646 int
 647 rdnNormalize(
 648     slap_mask_t use,
 649     Syntax *syntax,
 650     MatchingRule *mr,
 651     struct berval *val,
 652     struct berval *out,
 653     void *ctx)
 654 {
 655         assert( val != NULL );
 656         assert( out != NULL );
 657
 658         Debug( LDAP_DEBUG_TRACE, ">>> dnNormalize: <%s>\n", val->bv_val, 0, 0 );
 659         if ( val->bv_len != 0 ) {
 660                 LDAPRDN         rdn = NULL;
 661                 int             rc;
 662                 char*           p;
 663
 664                 /*
 665                  * Go to structural representation
 666                  */
 667                 rc = ldap_bv2rdn_x( val , &rdn, (char **) &p,
 668                                         LDAP_DN_FORMAT_LDAP, ctx);
 669
 670                 if ( rc != LDAP_SUCCESS ) {
 671                         return LDAP_INVALID_SYNTAX;
 672                 }
 673
 674                 assert( strlen( val->bv_val ) == val->bv_len );
 675
 676                 /*
 677                  * Schema-aware rewrite
 678                  */
 679                 if ( LDAPRDN_rewrite( rdn, 0, ctx ) != LDAP_SUCCESS ) {
 680                         ldap_rdnfree_x( rdn, ctx );
 681                         return LDAP_INVALID_SYNTAX;
 682                 }
 683
 684                 /*
 685                  * Back to string representation
 686                  */
 687                 rc = ldap_rdn2bv_x( rdn, out,
 688                         LDAP_DN_FORMAT_LDAPV3 | LDAP_DN_PRETTY, ctx );
 689
 690                 ldap_rdnfree_x( rdn, ctx );
 691
 692                 if ( rc != LDAP_SUCCESS ) {
 693                         return LDAP_INVALID_SYNTAX;
 694                 }
 695         } else {
 696                 ber_dupbv_x( out, val, ctx );
 697         }
 698
 699         Debug( LDAP_DEBUG_TRACE, "<<< dnNormalize: <%s>\n", out->bv_val, 0, 0 );
 700
 701         return LDAP_SUCCESS;
 702 }
 703
 704 int
 705 dnPretty(
 706         Syntax *syntax,
 707         struct berval *val,
 708         struct berval *out,
 709         void *ctx)
 710 {
 711         assert( val != NULL );
 712         assert( out != NULL );
 713
 714         Debug( LDAP_DEBUG_TRACE, ">>> dnPretty: <%s>\n", val->bv_val, 0, 0 );
 715
 716         if ( val->bv_len == 0 ) {
 717                 ber_dupbv_x( out, val, ctx );
 718
 719         } else if ( val->bv_len > SLAP_LDAPDN_MAXLEN ) {
 720                 return LDAP_INVALID_SYNTAX;
 721
 722         } else {
 723                 LDAPDN          dn = NULL;
 724                 int             rc;
 725
 726                 /* FIXME: should be liberal in what we accept */
 727                 rc = ldap_bv2dn_x( val, &dn, LDAP_DN_FORMAT_LDAP, ctx );
 728                 if ( rc != LDAP_SUCCESS ) {
 729                         return LDAP_INVALID_SYNTAX;
 730                 }
 731
 732                 assert( strlen( val->bv_val ) == val->bv_len );
 733
 734                 /*
 735                  * Schema-aware rewrite
 736                  */
 737                 if ( LDAPDN_rewrite( dn, SLAP_LDAPDN_PRETTY, ctx ) != LDAP_SUCCESS ) {
 738                         ldap_dnfree_x( dn, ctx );
 739                         return LDAP_INVALID_SYNTAX;
 740                 }
 741
 742                 /* FIXME: not sure why the default isn't pretty */
 743                 /* RE: the default is the form that is used as
 744                  * an internal representation; the pretty form
 745                  * is a variant */
 746                 rc = ldap_dn2bv_x( dn, out,
 747                         LDAP_DN_FORMAT_LDAPV3 | LDAP_DN_PRETTY, ctx );
 748
 749                 ldap_dnfree_x( dn, ctx );
 750
 751                 if ( rc != LDAP_SUCCESS ) {
 752                         return LDAP_INVALID_SYNTAX;
 753                 }
 754         }
 755
 756         Debug( LDAP_DEBUG_TRACE, "<<< dnPretty: <%s>\n", out->bv_val, 0, 0 );
 757
 758         return LDAP_SUCCESS;
 759 }
 760
 761 int
 762 rdnPretty(
 763         Syntax *syntax,
 764         struct berval *val,
 765         struct berval *out,
 766         void *ctx)
 767 {
 768         assert( val != NULL );
 769         assert( out != NULL );
 770
 771         Debug( LDAP_DEBUG_TRACE, ">>> dnPretty: <%s>\n", val->bv_val, 0, 0 );
 772
 773         if ( val->bv_len == 0 ) {
 774                 ber_dupbv_x( out, val, ctx );
 775
 776         } else if ( val->bv_len > SLAP_LDAPDN_MAXLEN ) {
 777                 return LDAP_INVALID_SYNTAX;
 778
 779         } else {
 780                 LDAPRDN         rdn = NULL;
 781                 int             rc;
 782                 char*           p;
 783
 784                 /* FIXME: should be liberal in what we accept */
 785                 rc = ldap_bv2rdn_x( val , &rdn, (char **) &p,
 786                                         LDAP_DN_FORMAT_LDAP, ctx);
 787                 if ( rc != LDAP_SUCCESS ) {
 788                         return LDAP_INVALID_SYNTAX;
 789                 }
 790
 791                 assert( strlen( val->bv_val ) == val->bv_len );
 792
 793                 /*
 794                  * Schema-aware rewrite
 795                  */
 796                 if ( LDAPRDN_rewrite( rdn, SLAP_LDAPDN_PRETTY, ctx ) != LDAP_SUCCESS ) {
 797                         ldap_rdnfree_x( rdn, ctx );
 798                         return LDAP_INVALID_SYNTAX;
 799                 }
 800
 801                 /* FIXME: not sure why the default isn't pretty */
 802                 /* RE: the default is the form that is used as
 803                  * an internal representation; the pretty form
 804                  * is a variant */
 805                 rc = ldap_rdn2bv_x( rdn, out,
 806                         LDAP_DN_FORMAT_LDAPV3 | LDAP_DN_PRETTY, ctx );
 807
 808                 ldap_rdnfree_x( rdn, ctx );
 809
 810                 if ( rc != LDAP_SUCCESS ) {
 811                         return LDAP_INVALID_SYNTAX;
 812                 }
 813         }
 814
 815         Debug( LDAP_DEBUG_TRACE, "<<< dnPretty: <%s>\n", out->bv_val, 0, 0 );
 816
 817         return LDAP_SUCCESS;
 818 }
 819
 820
 821 int
 822 dnPrettyNormalDN(
 823         Syntax *syntax,
 824         struct berval *val,
 825         LDAPDN *dn,
 826         int flags,
 827         void *ctx )
 828 {
 829         assert( val != NULL );
 830         assert( dn != NULL );
 831
 832         Debug( LDAP_DEBUG_TRACE, ">>> dn%sDN: <%s>\n",
 833                         flags == SLAP_LDAPDN_PRETTY ? "Pretty" : "Normal",
 834                         val->bv_val, 0 );
 835
 836         if ( val->bv_len == 0 ) {
 837                 return LDAP_SUCCESS;
 838
 839         } else if ( val->bv_len > SLAP_LDAPDN_MAXLEN ) {
 840                 return LDAP_INVALID_SYNTAX;
 841
 842         } else {
 843                 int             rc;
 844
 845                 /* FIXME: should be liberal in what we accept */
 846                 rc = ldap_bv2dn_x( val, dn, LDAP_DN_FORMAT_LDAP, ctx );
 847                 if ( rc != LDAP_SUCCESS ) {
 848                         return LDAP_INVALID_SYNTAX;
 849                 }
 850
 851                 assert( strlen( val->bv_val ) == val->bv_len );
 852
 853                 /*
 854                  * Schema-aware rewrite
 855                  */
 856                 if ( LDAPDN_rewrite( *dn, flags, ctx ) != LDAP_SUCCESS ) {
 857                         ldap_dnfree_x( *dn, ctx );
 858                         *dn = NULL;
 859                         return LDAP_INVALID_SYNTAX;
 860                 }
 861         }
 862
 863         Debug( LDAP_DEBUG_TRACE, "<<< dn%sDN\n",
 864                         flags == SLAP_LDAPDN_PRETTY ? "Pretty" : "Normal",
 865                         0, 0 );
 866
 867         return LDAP_SUCCESS;
 868 }
 869
 870 /*
 871  * Combination of both dnPretty and dnNormalize
 872  */
 873 int
 874 dnPrettyNormal(
 875         Syntax *syntax,
 876         struct berval *val,
 877         struct berval *pretty,
 878         struct berval *normal,
 879         void *ctx)
 880 {
 881         Debug( LDAP_DEBUG_TRACE, ">>> dnPrettyNormal: <%s>\n", val->bv_val, 0, 0 );
 882
 883         assert( val != NULL );
 884         assert( pretty != NULL );
 885         assert( normal != NULL );
 886
 887         if ( val->bv_len == 0 ) {
 888                 ber_dupbv_x( pretty, val, ctx );
 889                 ber_dupbv_x( normal, val, ctx );
 890
 891         } else if ( val->bv_len > SLAP_LDAPDN_MAXLEN ) {
 892                 /* too big */
 893                 return LDAP_INVALID_SYNTAX;
 894
 895         } else {
 896                 LDAPDN          dn = NULL;
 897                 int             rc;
 898
 899                 pretty->bv_val = NULL;
 900                 normal->bv_val = NULL;
 901                 pretty->bv_len = 0;
 902                 normal->bv_len = 0;
 903
 904                 /* FIXME: should be liberal in what we accept */
 905                 rc = ldap_bv2dn_x( val, &dn, LDAP_DN_FORMAT_LDAP, ctx );
 906                 if ( rc != LDAP_SUCCESS ) {
 907                         return LDAP_INVALID_SYNTAX;
 908                 }
 909
 910                 assert( strlen( val->bv_val ) == val->bv_len );
 911
 912                 /*
 913                  * Schema-aware rewrite
 914                  */
 915                 if ( LDAPDN_rewrite( dn, SLAP_LDAPDN_PRETTY, ctx ) != LDAP_SUCCESS ) {
 916                         ldap_dnfree_x( dn, ctx );
 917                         return LDAP_INVALID_SYNTAX;
 918                 }
 919
 920                 rc = ldap_dn2bv_x( dn, pretty,
 921                         LDAP_DN_FORMAT_LDAPV3 | LDAP_DN_PRETTY, ctx );
 922
 923                 if ( rc != LDAP_SUCCESS ) {
 924                         ldap_dnfree_x( dn, ctx );
 925                         return LDAP_INVALID_SYNTAX;
 926                 }
 927
 928                 if ( LDAPDN_rewrite( dn, 0, ctx ) != LDAP_SUCCESS ) {
 929                         ldap_dnfree_x( dn, ctx );
 930                         ber_memfree_x( pretty->bv_val, ctx );
 931                         pretty->bv_val = NULL;
 932                         pretty->bv_len = 0;
 933                         return LDAP_INVALID_SYNTAX;
 934                 }
 935
 936                 rc = ldap_dn2bv_x( dn, normal,
 937                         LDAP_DN_FORMAT_LDAPV3 | LDAP_DN_PRETTY, ctx );
 938
 939                 ldap_dnfree_x( dn, ctx );
 940                 if ( rc != LDAP_SUCCESS ) {
 941                         ber_memfree_x( pretty->bv_val, ctx );
 942                         pretty->bv_val = NULL;
 943                         pretty->bv_len = 0;
 944                         return LDAP_INVALID_SYNTAX;
 945                 }
 946         }
 947
 948         Debug( LDAP_DEBUG_TRACE, "<<< dnPrettyNormal: <%s>, <%s>\n",
 949                 pretty->bv_val, normal->bv_val, 0 );
 950
 951         return LDAP_SUCCESS;
 952 }
 953
 954 /*
 955  * dnMatch routine
 956  */
 957 int
 958 dnMatch(
 959         int *matchp,
 960         slap_mask_t flags,
 961         Syntax *syntax,
 962         MatchingRule *mr,
 963         struct berval *value,
 964         void *assertedValue )
 965 {
 966         int match;
 967         struct berval *asserted = (struct berval *) assertedValue;
 968
 969         assert( matchp != NULL );
 970         assert( value != NULL );
 971         assert( assertedValue != NULL );
 972         assert( !BER_BVISNULL( value ) );
 973         assert( !BER_BVISNULL( asserted ) );
 974
 975         match = value->bv_len - asserted->bv_len;
 976
 977         if ( match == 0 ) {
 978                 match = memcmp( value->bv_val, asserted->bv_val,
 979                                 value->bv_len );
 980         }
 981
 982         Debug( LDAP_DEBUG_ARGS, "dnMatch %d\n\t\"%s\"\n\t\"%s\"\n",
 983                 match, value->bv_val, asserted->bv_val );
 984
 985         *matchp = match;
 986         return LDAP_SUCCESS;
 987 }
 988
 989 /*
 990  * dnRelativeMatch routine
 991  */
 992 int
 993 dnRelativeMatch(
 994         int *matchp,
 995         slap_mask_t flags,
 996         Syntax *syntax,
 997         MatchingRule *mr,
 998         struct berval *value,
 999         void *assertedValue )
1000 {
1001         int match;
1002         struct berval *asserted = (struct berval *) assertedValue;
1003
1004         assert( matchp != NULL );
1005         assert( value != NULL );
1006         assert( assertedValue != NULL );
1007         assert( !BER_BVISNULL( value ) );
1008         assert( !BER_BVISNULL( asserted ) );
1009
1010         if( mr == slap_schema.si_mr_dnSubtreeMatch ) {
1011                 if( asserted->bv_len > value->bv_len ) {
1012                         match = -1;
1013                 } else if ( asserted->bv_len == value->bv_len ) {
1014                         match = memcmp( value->bv_val, asserted->bv_val,
1015                                 value->bv_len );
1016                 } else {
1017                         if( DN_SEPARATOR(
1018                                 value->bv_val[value->bv_len - asserted->bv_len - 1] ))
1019                         {
1020                                 match = memcmp(
1021                                         &value->bv_val[value->bv_len - asserted->bv_len],
1022                                         asserted->bv_val,
1023                                         asserted->bv_len );
1024                         } else {
1025                                 match = 1;
1026                         }
1027                 }
1028
1029                 *matchp = match;
1030                 return LDAP_SUCCESS;
1031         }
1032
1033         if( mr == slap_schema.si_mr_dnSuperiorMatch ) {
1034                 asserted = value;
1035                 value = (struct berval *) assertedValue;
1036                 mr = slap_schema.si_mr_dnSubordinateMatch;
1037         }
1038
1039         if( mr == slap_schema.si_mr_dnSubordinateMatch ) {
1040                 if( asserted->bv_len >= value->bv_len ) {
1041                         match = -1;
1042                 } else {
1043                         if( DN_SEPARATOR(
1044                                 value->bv_val[value->bv_len - asserted->bv_len - 1] ))
1045                         {
1046                                 match = memcmp(
1047                                         &value->bv_val[value->bv_len - asserted->bv_len],
1048                                         asserted->bv_val,
1049                                         asserted->bv_len );
1050                         } else {
1051                                 match = 1;
1052                         }
1053                 }
1054
1055                 *matchp = match;
1056                 return LDAP_SUCCESS;
1057         }
1058
1059         if( mr == slap_schema.si_mr_dnOneLevelMatch ) {
1060                 if( asserted->bv_len >= value->bv_len ) {
1061                         match = -1;
1062                 } else {
1063                         if( DN_SEPARATOR(
1064                                 value->bv_val[value->bv_len - asserted->bv_len - 1] ))
1065                         {
1066                                 match = memcmp(
1067                                         &value->bv_val[value->bv_len - asserted->bv_len],
1068                                         asserted->bv_val,
1069                                         asserted->bv_len );
1070
1071                                 if( !match ) {
1072                                         struct berval rdn;
1073                                         rdn.bv_val = value->bv_val;
1074                                         rdn.bv_len = value->bv_len - asserted->bv_len - 1;
1075                                         match = dnIsOneLevelRDN( &rdn ) ? 0 : 1;
1076                                 }
1077                         } else {
1078                                 match = 1;
1079                         }
1080                 }
1081
1082                 *matchp = match;
1083                 return LDAP_SUCCESS;
1084         }
1085
1086         /* should not be reachable */
1087         assert( 0 );
1088         return LDAP_OTHER;
1089 }
1090
1091 int
1092 rdnMatch(
1093         int *matchp,
1094         slap_mask_t flags,
1095         Syntax *syntax,
1096         MatchingRule *mr,
1097         struct berval *value,
1098         void *assertedValue )
1099 {
1100         int match;
1101         struct berval *asserted = (struct berval *) assertedValue;
1102
1103         assert( matchp != NULL );
1104         assert( value != NULL );
1105         assert( assertedValue != NULL );
1106
1107         match = value->bv_len - asserted->bv_len;
1108
1109         if ( match == 0 ) {
1110                 match = memcmp( value->bv_val, asserted->bv_val,
1111                                 value->bv_len );
1112         }
1113
1114         Debug( LDAP_DEBUG_ARGS, "rdnMatch %d\n\t\"%s\"\n\t\"%s\"\n",
1115                 match, value->bv_val, asserted->bv_val );
1116
1117         *matchp = match;
1118         return LDAP_SUCCESS;
1119 }
1120
1121
1122 /*
1123  * dnParent - dn's parent, in-place
1124  * note: the incoming dn is assumed to be normalized/prettyfied,
1125  * so that escaped rdn/ava separators are in '\'+hexpair form
1126  *
1127  * note: "dn" and "pdn" can point to the same berval;
1128  * beware that, in this case, the pointer to the original buffer
1129  * will get lost.
1130  */
1131 void
1132 dnParent(
1133         struct berval   *dn,
1134         struct berval   *pdn )
1135 {
1136         char    *p;
1137
1138         p = ber_bvchr( dn, ',' );
1139
1140         /* one-level dn */
1141         if ( p == NULL ) {
1142                 pdn->bv_len = 0;
1143                 pdn->bv_val = dn->bv_val + dn->bv_len;
1144                 return;
1145         }
1146
1147         assert( DN_SEPARATOR( p[ 0 ] ) );
1148         p++;
1149
1150         assert( ATTR_LEADCHAR( p[ 0 ] ) );
1151         pdn->bv_len = dn->bv_len - (p - dn->bv_val);
1152         pdn->bv_val = p;
1153
1154         return;
1155 }
1156
1157 /*
1158  * dnRdn - dn's rdn, in-place
1159  * note: the incoming dn is assumed to be normalized/prettyfied,
1160  * so that escaped rdn/ava separators are in '\'+hexpair form
1161  */
1162 void
1163 dnRdn(
1164         struct berval   *dn,
1165         struct berval   *rdn )
1166 {
1167         char    *p;
1168
1169         *rdn = *dn;
1170         p = ber_bvchr( dn, ',' );
1171
1172         /* one-level dn */
1173         if ( p == NULL ) {
1174                 return;
1175         }
1176
1177         assert( DN_SEPARATOR( p[ 0 ] ) );
1178         assert( ATTR_LEADCHAR( p[ 1 ] ) );
1179         rdn->bv_len = p - dn->bv_val;
1180
1181         return;
1182 }
1183
1184 int
1185 dnExtractRdn(
1186         struct berval   *dn,
1187         struct berval   *rdn,
1188         void *ctx )
1189 {
1190         LDAPRDN         tmpRDN;
1191         const char      *p;
1192         int             rc;
1193
1194         assert( dn != NULL );
1195         assert( rdn != NULL );
1196
1197         if( dn->bv_len == 0 ) {
1198                 return LDAP_OTHER;
1199         }
1200
1201         rc = ldap_bv2rdn_x( dn, &tmpRDN, (char **)&p, LDAP_DN_FORMAT_LDAP, ctx );
1202         if ( rc != LDAP_SUCCESS ) {
1203                 return rc;
1204         }
1205
1206         rc = ldap_rdn2bv_x( tmpRDN, rdn, LDAP_DN_FORMAT_LDAPV3 | LDAP_DN_PRETTY,
1207                 ctx );
1208
1209         ldap_rdnfree_x( tmpRDN, ctx );
1210         return rc;
1211 }
1212
1213 /*
1214  * We can assume the input is a prettied or normalized DN
1215  */
1216 ber_len_t
1217 dn_rdnlen(
1218         Backend         *be,
1219         struct berval   *dn_in )
1220 {
1221         const char      *p;
1222
1223         assert( dn_in != NULL );
1224
1225         if ( dn_in == NULL ) {
1226                 return 0;
1227         }
1228
1229         if ( !dn_in->bv_len ) {
1230                 return 0;
1231         }
1232
1233         if ( be != NULL && be_issuffix( be, dn_in ) ) {
1234                 return 0;
1235         }
1236
1237         p = ber_bvchr( dn_in, ',' );
1238
1239         return p ? p - dn_in->bv_val : dn_in->bv_len;
1240 }
1241
1242
1243 /* rdnValidate:
1244  *
1245  * LDAP_SUCCESS if rdn is a legal rdn;
1246  * LDAP_INVALID_SYNTAX otherwise (including a sequence of rdns)
1247  */
1248 int
1249 rdn_validate( struct berval *rdn )
1250 {
1251 #if 1
1252         /* Major cheat!
1253          * input is a pretty or normalized DN
1254          * hence, we can just search for ','
1255          */
1256         if( rdn == NULL || rdn->bv_len == 0 ||
1257                 rdn->bv_len > SLAP_LDAPDN_MAXLEN )
1258         {
1259                 return LDAP_INVALID_SYNTAX;
1260         }
1261         return ber_bvchr( rdn, ',' ) == NULL
1262                 ? LDAP_SUCCESS : LDAP_INVALID_SYNTAX;
1263
1264 #else
1265         LDAPRDN         *RDN, **DN[ 2 ] = { &RDN, NULL };
1266         const char      *p;
1267         int             rc;
1268
1269         /*
1270          * must be non-empty
1271          */
1272         if ( rdn == NULL || rdn == '\0' ) {
1273                 return 0;
1274         }
1275
1276         /*
1277          * must be parsable
1278          */
1279         rc = ldap_bv2rdn( rdn, &RDN, (char **)&p, LDAP_DN_FORMAT_LDAP );
1280         if ( rc != LDAP_SUCCESS ) {
1281                 return 0;
1282         }
1283
1284         /*
1285          * Must be one-level
1286          */
1287         if ( p[ 0 ] != '\0' ) {
1288                 return 0;
1289         }
1290
1291         /*
1292          * Schema-aware validate
1293          */
1294         if ( rc == LDAP_SUCCESS ) {
1295                 rc = LDAPDN_validate( DN );
1296         }
1297         ldap_rdnfree( RDN );
1298
1299         /*
1300          * Must validate (there's a repeated parsing ...)
1301          */
1302         return ( rc == LDAP_SUCCESS );
1303 #endif
1304 }
1305
1306
1307 /* build_new_dn:
1308  *
1309  * Used by back-bdb back_modrdn to create the new dn of entries being
1310  * renamed.
1311  *
1312  * new_dn = parent (p_dn) + separator + rdn (newrdn) + null.
1313  */
1314
1315 void
1316 build_new_dn( struct berval * new_dn,
1317         struct berval * parent_dn,
1318         struct berval * newrdn,
1319         void *memctx )
1320 {
1321         char *ptr;
1322
1323         if ( parent_dn == NULL || parent_dn->bv_len == 0 ) {
1324                 ber_dupbv_x( new_dn, newrdn, memctx );
1325                 return;
1326         }
1327
1328         new_dn->bv_len = parent_dn->bv_len + newrdn->bv_len + 1;
1329         new_dn->bv_val = (char *) slap_sl_malloc( new_dn->bv_len + 1, memctx );
1330
1331         ptr = lutil_strncopy( new_dn->bv_val, newrdn->bv_val, newrdn->bv_len );
1332         *ptr++ = ',';
1333         strcpy( ptr, parent_dn->bv_val );
1334 }
1335
1336
1337 /*
1338  * dnIsSuffix - tells whether suffix is a suffix of dn.
1339  * Both dn and suffix must be normalized.
1340  */
1341 int
1342 dnIsSuffix(
1343         const struct berval *dn,
1344         const struct berval *suffix )
1345 {
1346         int     d = dn->bv_len - suffix->bv_len;
1347
1348         assert( dn != NULL );
1349         assert( suffix != NULL );
1350
1351         /* empty suffix matches any dn */
1352         if ( suffix->bv_len == 0 ) {
1353                 return 1;
1354         }
1355
1356         /* suffix longer than dn */
1357         if ( d < 0 ) {
1358                 return 0;
1359         }
1360
1361         /* no rdn separator or escaped rdn separator */
1362         if ( d > 1 && !DN_SEPARATOR( dn->bv_val[ d - 1 ] ) ) {
1363                 return 0;
1364         }
1365
1366         /* no possible match or malformed dn */
1367         if ( d == 1 ) {
1368                 return 0;
1369         }
1370
1371         /* compare */
1372         return( strcmp( dn->bv_val + d, suffix->bv_val ) == 0 );
1373 }
1374
1375 int
1376 dnIsOneLevelRDN( struct berval *rdn )
1377 {
1378         ber_len_t       len = rdn->bv_len;
1379         for ( ; len--; ) {
1380                 if ( DN_SEPARATOR( rdn->bv_val[ len ] ) ) {
1381                         return 0;
1382                 }
1383         }
1384
1385         return 1;
1386 }
1387
1388 #ifdef HAVE_TLS
1389 static SLAP_CERT_MAP_FN *DNX509PeerNormalizeCertMap = NULL;
1390 #endif
1391
1392 int register_certificate_map_function(SLAP_CERT_MAP_FN *fn)
1393 {
1394 #ifdef HAVE_TLS
1395         if ( DNX509PeerNormalizeCertMap == NULL ) {
1396                 DNX509PeerNormalizeCertMap = fn;
1397                 return 0;
1398         }
1399 #endif
1400
1401         return -1;
1402 }
1403
1404 #ifdef HAVE_TLS
1405 /*
1406  * Convert an X.509 DN into a normalized LDAP DN
1407  */
1408 int
1409 dnX509normalize( void *x509_name, struct berval *out )
1410 {
1411         /* Invoke the LDAP library's converter with our schema-rewriter */
1412         int rc = ldap_X509dn2bv( x509_name, out, LDAPDN_rewrite, 0 );
1413
1414         Debug( LDAP_DEBUG_TRACE,
1415                 "dnX509Normalize: <%s>\n", out->bv_val, 0, 0 );
1416
1417         return rc;
1418 }
1419
1420 /*
1421  * Get the TLS session's peer's DN into a normalized LDAP DN
1422  */
1423 int
1424 dnX509peerNormalize( void *ssl, struct berval *dn )
1425 {
1426         int rc = LDAP_INVALID_CREDENTIALS;
1427
1428         if ( DNX509PeerNormalizeCertMap != NULL )
1429                 rc = (*DNX509PeerNormalizeCertMap)( ssl, dn );
1430
1431         if ( rc != LDAP_SUCCESS ) {
1432                 rc = ldap_pvt_tls_get_peer_dn( ssl, dn,
1433                         (LDAPDN_rewrite_dummy *)LDAPDN_rewrite, 0 );
1434         }
1435
1436         return rc;
1437 }
1438 #endif