1 /* dn.c - routines for dealing with distinguished names */
4 * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
5 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
13 #include <ac/socket.h>
14 #include <ac/string.h>
21 #define SLAP_LDAPDN_PRETTY 0x1
24 * The DN syntax-related functions take advantage of the dn representation
25 * handling functions ldap_str2dn/ldap_dn2str. The latter are not schema-
26 * aware, so the attributes and their values need be validated (and possibly
27 * normalized). In the current implementation the required validation/nor-
28 * malization/"pretty"ing are done on newly created DN structural represen-
29 * tations; however the idea is to move towards DN handling in structural
30 * representation instead of the current string representation. To this
31 * purpose, we need to do only the required operations and keep track of
32 * what has been done to minimize their impact on performances.
34 * Developers are strongly encouraged to use this feature, to speed-up
38 #define AVA_PRIVATE( ava ) ( ( AttributeDescription * )(ava)->la_private )
41 * In-place, schema-aware validation of the
42 * structural representation of a distinguished name.
45 LDAPDN_validate( LDAPDN *dn )
52 for ( iRDN = 0; dn[ 0 ][ iRDN ]; iRDN++ ) {
53 LDAPRDN *rdn = dn[ 0 ][ iRDN ];
58 for ( iAVA = 0; rdn[ 0 ][ iAVA ]; iAVA++ ) {
59 LDAPAVA *ava = rdn[ 0 ][ iAVA ];
60 AttributeDescription *ad;
61 slap_syntax_validate_func *validate = NULL;
65 if ( ( ad = AVA_PRIVATE( ava ) ) == NULL ) {
66 const char *text = NULL;
68 rc = slap_bv2ad( &ava->la_attr, &ad, &text );
69 if ( rc != LDAP_SUCCESS ) {
70 return LDAP_INVALID_SYNTAX;
73 ava->la_private = ( void * )ad;
77 * Replace attr oid/name with the canonical name
79 ava->la_attr = ad->ad_cname;
81 validate = ad->ad_type->sat_syntax->ssyn_validate;
85 * validate value by validate function
87 rc = ( *validate )( ad->ad_type->sat_syntax,
90 if ( rc != LDAP_SUCCESS ) {
91 return LDAP_INVALID_SYNTAX;
101 * dn validate routine
113 if ( in->bv_len == 0 ) {
114 return( LDAP_SUCCESS );
117 rc = ldap_str2dn( in->bv_val, &dn, LDAP_DN_FORMAT_LDAP );
120 * Schema-aware validate
122 if ( rc == LDAP_SUCCESS ) {
123 rc = LDAPDN_validate( dn );
127 if ( rc != LDAP_SUCCESS ) {
128 return( LDAP_INVALID_SYNTAX );
131 return( LDAP_SUCCESS );
135 * AVA sorting inside a RDN
137 * rule: sort attributeTypes in alphabetical order; in case of multiple
138 * occurrences of the same attributeType, sort values in byte order
139 * (use memcmp, which implies alphabetical order in case of IA5 value;
140 * this should guarantee the repeatability of the operation).
142 * uses a linear search; should be fine since the number of AVAs in
143 * a RDN should be limited.
146 AVA_Sort( LDAPRDN *rdn, int iAVA )
149 LDAPAVA *ava_in = rdn[ 0 ][ iAVA ];
154 for ( i = 0; i < iAVA; i++ ) {
155 LDAPAVA *ava = rdn[ 0 ][ i ];
160 a = strcmp( ava_in->la_attr.bv_val, ava->la_attr.bv_val );
169 d = ava_in->la_value.bv_len - ava->la_value.bv_len;
171 v = memcmp( ava_in->la_value.bv_val,
172 ava->la_value.bv_val,
173 d <= 0 ? ava_in->la_value.bv_len
174 : ava->la_value.bv_len );
176 if ( v == 0 && d != 0 ) {
195 a = strcmp( ava_in->la_value.bv_val,
196 ava->la_value.bv_val );
202 for ( j = iAVA; j > i; j-- ) {
203 rdn[ 0 ][ j ] = rdn[ 0 ][ j - 1 ];
205 rdn[ 0 ][ i ] = ava_in;
212 * In-place, schema-aware normalization / "pretty"ing of the
213 * structural representation of a distinguished name.
216 LDAPDN_rewrite( LDAPDN *dn, unsigned flags )
223 for ( iRDN = 0; dn[ 0 ][ iRDN ]; iRDN++ ) {
224 LDAPRDN *rdn = dn[ 0 ][ iRDN ];
229 for ( iAVA = 0; rdn[ 0 ][ iAVA ]; iAVA++ ) {
230 LDAPAVA *ava = rdn[ 0 ][ iAVA ];
231 AttributeDescription *ad;
232 slap_syntax_transform_func *transf = NULL;
234 struct berval bv = { 0, NULL };
238 if ( ( ad = AVA_PRIVATE( ava ) ) == NULL ) {
239 const char *text = NULL;
241 rc = slap_bv2ad( &ava->la_attr, &ad, &text );
242 if ( rc != LDAP_SUCCESS ) {
243 return LDAP_INVALID_SYNTAX;
246 ava->la_private = ( void * )ad;
250 * Replace attr oid/name with the canonical name
252 ava->la_attr = ad->ad_cname;
254 if( flags & SLAP_LDAPDN_PRETTY ) {
255 transf = ad->ad_type->sat_syntax->ssyn_pretty;
258 transf = ad->ad_type->sat_syntax->ssyn_normalize;
259 mr = ad->ad_type->sat_equality;
264 * transform value by normalize/pretty function
266 rc = ( *transf )( ad->ad_type->sat_syntax,
267 &ava->la_value, &bv );
269 if ( rc != LDAP_SUCCESS ) {
270 return LDAP_INVALID_SYNTAX;
274 if( mr && ( mr->smr_usage & SLAP_MR_DN_FOLD ) ) {
277 ber_str2bv( UTF8normalize( bv.bv_val ? &bv
278 : &ava->la_value, UTF8_CASEFOLD ),
284 free( ava->la_value.bv_val );
288 AVA_Sort( rdn, iAVA );
296 * dn normalize routine
302 struct berval **normalized )
307 assert( normalized && *normalized == NULL );
309 out = ch_malloc( sizeof( struct berval ) );
310 rc = dnNormalize2( syntax, val, out );
311 if ( rc != LDAP_SUCCESS )
327 Debug( LDAP_DEBUG_TRACE, ">>> dnNormalize: <%s>\n", val->bv_val, 0, 0 );
329 if ( val->bv_len != 0 ) {
334 * Go to structural representation
336 rc = ldap_str2dn( val->bv_val, &dn, LDAP_DN_FORMAT_LDAP );
337 if ( rc != LDAP_SUCCESS ) {
338 return LDAP_INVALID_SYNTAX;
342 * Schema-aware rewrite
344 if ( LDAPDN_rewrite( dn, 0 ) != LDAP_SUCCESS ) {
346 return LDAP_INVALID_SYNTAX;
350 * Back to string representation
352 rc = ldap_dn2bv( dn, out, LDAP_DN_FORMAT_LDAPV3 );
356 if ( rc != LDAP_SUCCESS ) {
357 return LDAP_INVALID_SYNTAX;
360 ber_dupbv( out, val );
363 Debug( LDAP_DEBUG_TRACE, "<<< dnNormalize: <%s>\n", out->bv_val, 0, 0 );
369 * dn "pretty"ing routine
375 struct berval **pretty)
380 assert( pretty && *pretty == NULL );
382 out = ch_malloc( sizeof( struct berval ) );
383 rc = dnPretty2( syntax, val, out );
384 if ( rc != LDAP_SUCCESS )
400 Debug( LDAP_DEBUG_TRACE, ">>> dnPretty: <%s>\n", val->bv_val, 0, 0 );
402 if ( val->bv_len != 0 ) {
406 /* FIXME: should be liberal in what we accept */
407 rc = ldap_str2dn( val->bv_val, &dn, LDAP_DN_FORMAT_LDAP );
408 if ( rc != LDAP_SUCCESS ) {
409 return LDAP_INVALID_SYNTAX;
413 * Schema-aware rewrite
415 if ( LDAPDN_rewrite( dn, SLAP_LDAPDN_PRETTY ) != LDAP_SUCCESS ) {
417 return LDAP_INVALID_SYNTAX;
420 /* FIXME: not sure why the default isn't pretty */
421 /* RE: the default is the form that is used as
422 * an internal representation; the pretty form
424 rc = ldap_dn2bv( dn, out,
425 LDAP_DN_FORMAT_LDAPV3 | LDAP_DN_PRETTY );
429 if ( rc != LDAP_SUCCESS ) {
430 return LDAP_INVALID_SYNTAX;
433 ber_dupbv( out, val );
436 Debug( LDAP_DEBUG_TRACE, "<<< dnPretty: <%s>\n", out->bv_val, 0, 0 );
442 * Combination of both dnPretty and dnNormalize
448 struct berval *pretty,
449 struct berval *normal)
451 Debug( LDAP_DEBUG_TRACE, ">>> dnPrettyNormal: <%s>\n", val->bv_val, 0, 0 );
457 if ( val->bv_len != 0 ) {
461 pretty->bv_val = NULL;
462 normal->bv_val = NULL;
466 /* FIXME: should be liberal in what we accept */
467 rc = ldap_str2dn( val->bv_val, &dn, LDAP_DN_FORMAT_LDAP );
468 if ( rc != LDAP_SUCCESS ) {
469 return LDAP_INVALID_SYNTAX;
473 * Schema-aware rewrite
475 if ( LDAPDN_rewrite( dn, SLAP_LDAPDN_PRETTY ) != LDAP_SUCCESS ) {
477 return LDAP_INVALID_SYNTAX;
480 rc = ldap_dn2bv( dn, pretty,
481 LDAP_DN_FORMAT_LDAPV3 | LDAP_DN_PRETTY );
483 if ( rc != LDAP_SUCCESS ) {
485 return LDAP_INVALID_SYNTAX;
488 if ( LDAPDN_rewrite( dn, 0 ) != LDAP_SUCCESS ) {
490 free( pretty->bv_val );
491 pretty->bv_val = NULL;
493 return LDAP_INVALID_SYNTAX;
496 rc = ldap_dn2bv( dn, normal, LDAP_DN_FORMAT_LDAPV3 );
499 if ( rc != LDAP_SUCCESS ) {
500 free( pretty->bv_val );
501 pretty->bv_val = NULL;
503 return LDAP_INVALID_SYNTAX;
506 ber_dupbv( pretty, val );
507 ber_dupbv( normal, val );
510 Debug( LDAP_DEBUG_TRACE, "<<< dnPrettyNormal: <%s>, <%s>\n",
511 pretty->bv_val, normal->bv_val, 0 );
525 struct berval *value,
526 void *assertedValue )
529 struct berval *asserted = (struct berval *) assertedValue;
533 assert( assertedValue );
535 match = value->bv_len - asserted->bv_len;
538 match = strcmp( value->bv_val, asserted->bv_val );
542 LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY,
543 "dnMatch: %d\n %s\n %s\n", match,
544 value->bv_val, asserted->bv_val ));
546 Debug( LDAP_DEBUG_ARGS, "dnMatch %d\n\t\"%s\"\n\t\"%s\"\n",
547 match, value->bv_val, asserted->bv_val );
551 return( LDAP_SUCCESS );
554 #ifdef SLAP_DN_MIGRATION
556 * these routines are provided for migration purposes only!
557 * dn_validate is deprecated in favor of dnValidate
558 * dn_normalize is deprecated in favor of dnNormalize
559 * strcmp/strcasecmp for DNs is deprecated in favor of dnMatch
561 * other routines are likewise deprecated but may not yet have
562 * replacement functions.
566 * dn_validate - validate and compress dn. the dn is
567 * compressed in place are returned if valid.
568 * Deprecated in favor of dnValidate()
571 dn_validate( char *dn )
574 struct berval *pretty = NULL;
577 if ( dn == NULL || dn[0] == '\0' ) {
582 val.bv_len = strlen( dn );
584 rc = dnPretty( NULL, &val, &pretty );
585 if ( rc != LDAP_SUCCESS ) {
589 if ( val.bv_len < pretty->bv_len ) {
590 ber_bvfree( pretty );
594 AC_MEMCPY( dn, pretty->bv_val, pretty->bv_len + 1 );
595 ber_bvfree( pretty );
601 * dn_normalize - put dn into a canonical form suitable for storing
602 * in a hash database. this involves normalizing the case as well as
603 * the format. the dn is normalized in place as well as returned if valid.
604 * Deprecated in favor of dnNormalize()
607 dn_normalize( char *dn )
610 struct berval *normalized = NULL;
613 if ( dn == NULL || dn[0] == '\0' ) {
618 val.bv_len = strlen( dn );
620 rc = dnNormalize( NULL, &val, &normalized );
621 if ( rc != LDAP_SUCCESS ) {
625 if ( val.bv_len < normalized->bv_len ) {
626 ber_bvfree( normalized );
630 AC_MEMCPY( dn, normalized->bv_val, normalized->bv_len + 1 );
631 ber_bvfree( normalized );
637 * dnParent - dn's parent, in-place
647 rc = ldap_str2rdn( dn, NULL, &p, LDAP_DN_FORMAT_LDAP | LDAP_DN_SKIP );
648 if ( rc != LDAP_SUCCESS ) {
652 assert( DN_SEPARATOR( p[ 0 ] ) );
655 while ( ASCII_SPACE( p[ 0 ] ) ) {
665 * dn_parent - return the dn's parent, in-place
666 * FIXME: should be replaced by dnParent()
679 while ( dn[ 0 ] != '\0' && ASCII_SPACE( dn[ 0 ] ) ) {
683 if ( dn[ 0 ] == '\0' ) {
687 if ( be != NULL && be_issuffix( be, dn ) ) {
691 if ( dnParent( dn, &pdn ) != LDAP_SUCCESS ) {
695 return ( char * )pdn;
710 if( dn->bv_len == 0 ) {
714 rc = ldap_str2rdn( dn->bv_val, &tmpRDN, &p, LDAP_DN_FORMAT_LDAP );
715 if ( rc != LDAP_SUCCESS ) {
719 rc = ldap_rdn2bv( tmpRDN, rdn, LDAP_DN_FORMAT_LDAPV3 );
720 ldap_rdnfree( tmpRDN );
721 if ( rc != LDAP_SUCCESS ) {
729 * FIXME: should be replaced by dnExtractRdn() (together with dn_rdn)
734 struct berval *dn_in )
741 if ( dn_in == NULL ) {
745 if ( !dn_in->bv_len ) {
749 if ( be != NULL && be_issuffix( be, dn_in->bv_val ) ) {
753 rc = ldap_str2rdn( dn_in->bv_val, NULL, &p,
754 LDAP_DN_FORMAT_LDAP | LDAP_DN_SKIP );
755 if ( rc != LDAP_SUCCESS ) {
759 return p - dn_in->bv_val;
763 * FIXME: should be replaced by dnExtractRdn() (together with dn_rdnlen)
767 struct berval *dn_in )
773 if ( dn_in == NULL ) {
777 if ( !dn_in->bv_len ) {
781 if ( be != NULL && be_issuffix( be, dn_in->bv_val ) ) {
785 if ( dnExtractRdn( dn_in, &rdn ) != LDAP_SUCCESS ) {
793 * dn_issuffix - tells whether suffix is a suffix of dn.
794 * Both dn and suffix must be normalized.
795 * deprecated in favor of dnIsSuffix()
803 struct berval bvdn, bvsuffix;
808 bvdn.bv_val = (char *) dn;
809 bvdn.bv_len = strlen( dn );
810 bvsuffix.bv_val = (char *) suffix;
811 bvsuffix.bv_len = strlen( suffix );
813 return dnIsSuffix( &bvdn, &bvsuffix );
818 * Given a string (i.e. an rdn) of the form:
819 * "attribute_type = attribute_value"
820 * this function returns the type of an attribute, that is the
821 * string "attribute_type" which is placed in newly allocated
822 * memory. The returned string will be null-terminated.
827 char * rdn_attr_type( const char * s )
829 char **attrs = NULL, **values = NULL, *retval;
831 if ( rdn_attrs( s, &attrs, &values ) != LDAP_SUCCESS ) {
835 retval = ch_strdup( attrs[ 0 ] );
837 charray_free( attrs );
838 charray_free( values );
846 * Given a string (i.e. an rdn) of the form:
847 * "attribute_type = attribute_value"
848 * this function returns "attribute_type" which is placed in newly allocated
849 * memory. The returned string will be null-terminated and may contain
850 * spaces (i.e. "John Doe\0").
856 rdn_attr_value( const char * rdn )
858 char **values = NULL, *retval;
860 if ( rdn_attrs( rdn, NULL, &values ) != LDAP_SUCCESS ) {
864 retval = ch_strdup( values[ 0 ] );
866 charray_free( values );
874 * Given a string (i.e. an rdn) of the form:
875 * "attribute_type=attribute_value[+attribute_type=attribute_value[...]]"
876 * this function stores the types of the attributes in ptypes, that is the
877 * array of strings "attribute_type" which is placed in newly allocated
878 * memory, and the values of the attributes in pvalues, that is the
879 * array of strings "attribute_value" which is placed in newly allocated
880 * memory. Returns 0 on success, -1 on failure.
882 * note: got part of the code from dn_validate
884 * Deprecated; directly use LDAPRDN from ldap_str2rdn
887 rdn_attrs( const char * rdn, char ***types, char ***values)
896 assert( *values == NULL );
897 assert( types == NULL || *types == NULL );
899 rc = ldap_str2rdn( rdn, &tmpRDN, &p, LDAP_DN_FORMAT_LDAP );
900 if ( rc != LDAP_SUCCESS ) {
906 * FIXME: should we complain if the rdn is actually a dn?
908 if ( p[ 0 ] != '\0' ) {
909 ldap_rdnfree( tmpRDN );
910 return LDAP_INVALID_DN_SYNTAX;
914 for ( iAVA = 0; tmpRDN[ 0 ][ iAVA ]; iAVA++ ) {
915 LDAPAVA *ava = tmpRDN[ 0 ][ iAVA ];
918 assert( ava->la_attr.bv_val );
919 assert( ava->la_value.bv_val );
922 charray_add_n( types, ava->la_attr.bv_val,
923 ava->la_attr.bv_len );
925 charray_add_n( values, ava->la_value.bv_val,
926 ava->la_value.bv_len );
929 ldap_rdnfree( tmpRDN );
937 * LDAP_SUCCESS if rdn is a legal rdn;
938 * LDAP_INVALID_SYNTAX otherwise (including a sequence of rdns)
941 rdnValidate( struct berval *rdn )
945 * input is a pretty or normalized DN
946 * hence, we can just search for ','
948 if( rdn == NULL || rdn->bv_len == 0 ) {
949 return LDAP_INVALID_SYNTAX;
952 return strchr( rdn->bv_val, ',' ) == NULL
953 ? LDAP_SUCCESS : LDAP_INVALID_SYNTAX;
956 LDAPRDN *RDN, **DN[ 2 ] = { &RDN, NULL };
963 if ( rdn == NULL || rdn == '\0' ) {
970 rc = ldap_str2rdn( rdn, &RDN, &p, LDAP_DN_FORMAT_LDAP );
971 if ( rc != LDAP_SUCCESS ) {
978 if ( p[ 0 ] != '\0' ) {
983 * Schema-aware validate
985 if ( rc == LDAP_SUCCESS ) {
986 rc = LDAPDN_validate( DN );
991 * Must validate (there's a repeated parsing ...)
993 return ( rc == LDAP_SUCCESS );
1000 * Used by ldbm/bdb2 back_modrdn to create the new dn of entries being
1003 * new_dn = parent (p_dn) + separator + rdn (newrdn) + null.
1007 build_new_dn( struct berval * new_dn,
1008 struct berval * parent_dn,
1009 struct berval * newrdn )
1013 if ( parent_dn == NULL ) {
1014 ber_dupbv( new_dn, newrdn );
1018 new_dn->bv_len = parent_dn->bv_len + newrdn->bv_len + 1;
1019 new_dn->bv_val = (char *) ch_malloc( new_dn->bv_len + 1 );
1021 ptr = slap_strcopy( new_dn->bv_val, newrdn->bv_val );
1023 strcpy( ptr, parent_dn->bv_val );
1026 #endif /* SLAP_DN_MIGRATION */
1029 * dnIsSuffix - tells whether suffix is a suffix of dn.
1030 * Both dn and suffix must be normalized.
1034 const struct berval *dn,
1035 const struct berval *suffix )
1037 int d = dn->bv_len - suffix->bv_len;
1042 /* empty suffix matches any dn */
1043 if ( suffix->bv_len == 0 ) {
1047 /* suffix longer than dn */
1052 /* no rdn separator or escaped rdn separator */
1053 if ( d > 1 && ( !DN_SEPARATOR( dn->bv_val[ d - 1 ] )
1054 || DN_ESCAPE( dn->bv_val[ d - 2 ] ) ) ) {
1058 /* no possible match or malformed dn */
1064 return( strcmp( dn->bv_val + d, suffix->bv_val ) == 0 );