git.sur5r.net Git - openldap/blob - servers/slapd/dn.c

   1 /* dn.c - routines for dealing with distinguished names */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 1998-2005 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
  17  * All rights reserved.
  18  *
  19  * Redistribution and use in source and binary forms are permitted
  20  * provided that this notice is preserved and that due credit is given
  21  * to the University of Michigan at Ann Arbor. The name of the University
  22  * may not be used to endorse or promote products derived from this
  23  * software without specific prior written permission. This software
  24  * is provided ``as is'' without express or implied warranty.
  25  */
  26
  27 #include "portable.h"
  28
  29 #include <stdio.h>
  30
  31 #include <ac/ctype.h>
  32 #include <ac/socket.h>
  33 #include <ac/string.h>
  34 #include <ac/time.h>
  35
  36 #include "slap.h"
  37 #include "lutil.h"
  38
  39 /*
  40  * The DN syntax-related functions take advantage of the dn representation
  41  * handling functions ldap_str2dn/ldap_dn2str.  The latter are not schema-
  42  * aware, so the attributes and their values need be validated (and possibly
  43  * normalized).  In the current implementation the required validation/nor-
  44  * malization/"pretty"ing are done on newly created DN structural represen-
  45  * tations; however the idea is to move towards DN handling in structural
  46  * representation instead of the current string representation.  To this
  47  * purpose, we need to do only the required operations and keep track of
  48  * what has been done to minimize their impact on performances.
  49  *
  50  * Developers are strongly encouraged to use this feature, to speed-up
  51  * its stabilization.
  52  */
  53
  54 #define AVA_PRIVATE( ava ) ( ( AttributeDescription * )(ava)->la_private )
  55
  56 static int
  57 LDAPRDN_validate( LDAPRDN rdn )
  58 {
  59         int             iAVA;
  60         int             rc;
  61
  62         assert( rdn != NULL );
  63
  64         for ( iAVA = 0; rdn[ iAVA ]; iAVA++ ) {
  65                 LDAPAVA                 *ava = rdn[ iAVA ];
  66                 AttributeDescription    *ad;
  67                 slap_syntax_validate_func *validate = NULL;
  68
  69                 assert( ava != NULL );
  70
  71                 if ( ( ad = AVA_PRIVATE( ava ) ) == NULL ) {
  72                         const char      *text = NULL;
  73
  74                         rc = slap_bv2ad( &ava->la_attr, &ad, &text );
  75                         if ( rc != LDAP_SUCCESS ) {
  76                                 rc = slap_bv2undef_ad( &ava->la_attr,
  77                                         &ad, &text,
  78                                         SLAP_AD_PROXIED|SLAP_AD_NOINSERT );
  79                                 if ( rc != LDAP_SUCCESS ) {
  80                                         return LDAP_INVALID_SYNTAX;
  81                                 }
  82                         }
  83
  84                         ava->la_private = ( void * )ad;
  85                 }
  86
  87                 /*
  88                  * Replace attr oid/name with the canonical name
  89                  */
  90                 ava->la_attr = ad->ad_cname;
  91
  92                 validate = ad->ad_type->sat_syntax->ssyn_validate;
  93
  94                 if ( validate ) {
  95                         /*
  96                          * validate value by validate function
  97                          */
  98                         rc = ( *validate )( ad->ad_type->sat_syntax,
  99                                 &ava->la_value );
 100
 101                         if ( rc != LDAP_SUCCESS ) {
 102                                 return LDAP_INVALID_SYNTAX;
 103                         }
 104                 }
 105         }
 106
 107         return LDAP_SUCCESS;
 108 }
 109
 110 /*
 111  * In-place, schema-aware validation of the
 112  * structural representation of a distinguished name.
 113  */
 114 static int
 115 LDAPDN_validate( LDAPDN dn )
 116 {
 117         int             iRDN;
 118         int             rc;
 119
 120         assert( dn != NULL );
 121
 122         for ( iRDN = 0; dn[ iRDN ]; iRDN++ ) {
 123                 LDAPRDN         rdn = dn[ iRDN ];
 124                 int             iAVA;
 125
 126                 assert( rdn != NULL );
 127
 128                 for ( iAVA = 0; rdn[ iAVA ]; iAVA++ ) {
 129                         LDAPAVA                 *ava = rdn[ iAVA ];
 130                         AttributeDescription    *ad;
 131                         slap_syntax_validate_func *validate = NULL;
 132
 133                         assert( ava != NULL );
 134
 135                         if ( ( ad = AVA_PRIVATE( ava ) ) == NULL ) {
 136                                 const char      *text = NULL;
 137
 138                                 rc = slap_bv2ad( &ava->la_attr, &ad, &text );
 139                                 if ( rc != LDAP_SUCCESS ) {
 140                                         rc = slap_bv2undef_ad( &ava->la_attr,
 141                                                 &ad, &text,
 142                                                 SLAP_AD_PROXIED|SLAP_AD_NOINSERT );
 143                                         if ( rc != LDAP_SUCCESS ) {
 144                                                 return LDAP_INVALID_SYNTAX;
 145                                         }
 146                                 }
 147
 148                                 ava->la_private = ( void * )ad;
 149                         }
 150
 151                         /*
 152                          * Replace attr oid/name with the canonical name
 153                          */
 154                         ava->la_attr = ad->ad_cname;
 155
 156                         validate = ad->ad_type->sat_syntax->ssyn_validate;
 157
 158                         if ( validate ) {
 159                                 /*
 160                                  * validate value by validate function
 161                                  */
 162                                 rc = ( *validate )( ad->ad_type->sat_syntax,
 163                                         &ava->la_value );
 164
 165                                 if ( rc != LDAP_SUCCESS ) {
 166                                         return LDAP_INVALID_SYNTAX;
 167                                 }
 168                         }
 169                 }
 170         }
 171
 172         return LDAP_SUCCESS;
 173 }
 174
 175 /*
 176  * dn validate routine
 177  */
 178 int
 179 dnValidate(
 180         Syntax *syntax,
 181         struct berval *in )
 182 {
 183         int             rc;
 184         LDAPDN          dn = NULL;
 185
 186         assert( in != NULL );
 187
 188         if ( in->bv_len == 0 ) {
 189                 return LDAP_SUCCESS;
 190
 191         } else if ( in->bv_len > SLAP_LDAPDN_MAXLEN ) {
 192                 return LDAP_INVALID_SYNTAX;
 193         }
 194
 195         rc = ldap_bv2dn( in, &dn, LDAP_DN_FORMAT_LDAP );
 196         if ( rc != LDAP_SUCCESS ) {
 197                 return LDAP_INVALID_SYNTAX;
 198         }
 199
 200         assert( strlen( in->bv_val ) == in->bv_len );
 201
 202         /*
 203          * Schema-aware validate
 204          */
 205         rc = LDAPDN_validate( dn );
 206         ldap_dnfree( dn );
 207
 208         if ( rc != LDAP_SUCCESS ) {
 209                 return LDAP_INVALID_SYNTAX;
 210         }
 211
 212         return LDAP_SUCCESS;
 213 }
 214
 215 int
 216 rdnValidate(
 217         Syntax *syntax,
 218         struct berval *in )
 219 {
 220         int             rc;
 221         LDAPRDN         rdn;
 222         char*           p;
 223
 224         assert( in != NULL );
 225         if ( in->bv_len == 0 ) {
 226                 return LDAP_SUCCESS;
 227
 228         } else if ( in->bv_len > SLAP_LDAPDN_MAXLEN ) {
 229                 return LDAP_INVALID_SYNTAX;
 230         }
 231
 232         rc = ldap_bv2rdn_x( in , &rdn, (char **) &p,
 233                                 LDAP_DN_FORMAT_LDAP, NULL);
 234         if ( rc != LDAP_SUCCESS ) {
 235                 return LDAP_INVALID_SYNTAX;
 236         }
 237
 238         assert( strlen( in->bv_val ) == in->bv_len );
 239
 240         /*
 241          * Schema-aware validate
 242          */
 243         rc = LDAPRDN_validate( rdn );
 244         ldap_rdnfree( rdn );
 245
 246         if ( rc != LDAP_SUCCESS ) {
 247                 return LDAP_INVALID_SYNTAX;
 248         }
 249
 250         return LDAP_SUCCESS;
 251 }
 252
 253
 254 /*
 255  * AVA sorting inside a RDN
 256  *
 257  * rule: sort attributeTypes in alphabetical order; in case of multiple
 258  * occurrences of the same attributeType, sort values in byte order
 259  * (use memcmp, which implies alphabetical order in case of IA5 value;
 260  * this should guarantee the repeatability of the operation).
 261  *
 262  * Note: the sorting can be slightly improved by sorting first
 263  * by attribute type length, then by alphabetical order.
 264  *
 265  * uses a linear search; should be fine since the number of AVAs in
 266  * a RDN should be limited.
 267  */
 268 static void
 269 AVA_Sort( LDAPRDN rdn, int iAVA )
 270 {
 271         int             i;
 272         LDAPAVA         *ava_in = rdn[ iAVA ];
 273
 274         assert( rdn != NULL );
 275         assert( ava_in != NULL );
 276
 277         for ( i = 0; i < iAVA; i++ ) {
 278                 LDAPAVA         *ava = rdn[ i ];
 279                 int             a, j;
 280
 281                 assert( ava != NULL );
 282
 283                 a = strcmp( ava_in->la_attr.bv_val, ava->la_attr.bv_val );
 284
 285                 if ( a > 0 ) {
 286                         break;
 287                 }
 288
 289                 while ( a == 0 ) {
 290                         int             v, d;
 291
 292                         d = ava_in->la_value.bv_len - ava->la_value.bv_len;
 293
 294                         v = memcmp( ava_in->la_value.bv_val,
 295                                         ava->la_value.bv_val,
 296                                         d <= 0 ? ava_in->la_value.bv_len
 297                                                 : ava->la_value.bv_len );
 298
 299                         if ( v == 0 && d != 0 ) {
 300                                 v = d;
 301                         }
 302
 303                         if ( v <= 0 ) {
 304                                 /*
 305                                  * got it!
 306                                  */
 307                                 break;
 308                         }
 309
 310                         if ( ++i == iAVA ) {
 311                                 /*
 312                                  * already sorted
 313                                  */
 314                                 return;
 315                         }
 316
 317                         ava = rdn[ i ];
 318                         a = strcmp( ava_in->la_attr.bv_val,
 319                                         ava->la_attr.bv_val );
 320                 }
 321
 322                 /*
 323                  * move ahead
 324                  */
 325                 for ( j = iAVA; j > i; j-- ) {
 326                         rdn[ j ] = rdn[ j - 1 ];
 327                 }
 328                 rdn[ i ] = ava_in;
 329
 330                 return;
 331         }
 332 }
 333
 334 static int
 335 LDAPRDN_rewrite( LDAPRDN rdn, unsigned flags, void *ctx )
 336 {
 337
 338         int rc;
 339         int             iAVA;
 340         for ( iAVA = 0; rdn[ iAVA ]; iAVA++ ) {
 341                 LDAPAVA                 *ava = rdn[ iAVA ];
 342                 AttributeDescription    *ad;
 343                 slap_syntax_validate_func *validf = NULL;
 344                 slap_mr_normalize_func *normf = NULL;
 345                 slap_syntax_transform_func *transf = NULL;
 346                 MatchingRule *mr = NULL;
 347                 struct berval           bv = BER_BVNULL;
 348                 int                     do_sort = 0;
 349
 350                 assert( ava != NULL );
 351
 352                 if ( ( ad = AVA_PRIVATE( ava ) ) == NULL ) {
 353                         const char      *text = NULL;
 354
 355                         rc = slap_bv2ad( &ava->la_attr, &ad, &text );
 356                         if ( rc != LDAP_SUCCESS ) {
 357                                 rc = slap_bv2undef_ad( &ava->la_attr,
 358                                         &ad, &text,
 359                                         SLAP_AD_PROXIED|SLAP_AD_NOINSERT );
 360                                 if ( rc != LDAP_SUCCESS ) {
 361                                         return LDAP_INVALID_SYNTAX;
 362                                 }
 363                         }
 364
 365                         ava->la_private = ( void * )ad;
 366                         do_sort = 1;
 367                 }
 368
 369                 /*
 370                  * Replace attr oid/name with the canonical name
 371                  */
 372                 ava->la_attr = ad->ad_cname;
 373
 374                 if( ava->la_flags & LDAP_AVA_BINARY ) {
 375                         if( ava->la_value.bv_len == 0 ) {
 376                                 /* BER encoding is empty */
 377                                 return LDAP_INVALID_SYNTAX;
 378                         }
 379
 380                         /* AVA is binary encoded, don't muck with it */
 381                 } else if( flags & SLAP_LDAPDN_PRETTY ) {
 382                         transf = ad->ad_type->sat_syntax->ssyn_pretty;
 383                         if( !transf ) {
 384                                 validf = ad->ad_type->sat_syntax->ssyn_validate;
 385                         }
 386                 } else { /* normalization */
 387                         validf = ad->ad_type->sat_syntax->ssyn_validate;
 388                         mr = ad->ad_type->sat_equality;
 389                         if( mr ) normf = mr->smr_normalize;
 390                 }
 391
 392                 if ( validf ) {
 393                         /* validate value before normalization */
 394                         rc = ( *validf )( ad->ad_type->sat_syntax,
 395                                 ava->la_value.bv_len
 396                                         ? &ava->la_value
 397                                         : (struct berval *) &slap_empty_bv );
 398
 399                         if ( rc != LDAP_SUCCESS ) {
 400                                 return LDAP_INVALID_SYNTAX;
 401                         }
 402                 }
 403
 404                 if ( transf ) {
 405                         /*
 406                          * transform value by pretty function
 407                          *      if value is empty, use empty_bv
 408                          */
 409                         rc = ( *transf )( ad->ad_type->sat_syntax,
 410                                 ava->la_value.bv_len
 411                                         ? &ava->la_value
 412                                         : (struct berval *) &slap_empty_bv,
 413                                 &bv, ctx );
 414
 415                         if ( rc != LDAP_SUCCESS ) {
 416                                 return LDAP_INVALID_SYNTAX;
 417                         }
 418                 }
 419
 420                 if ( normf ) {
 421                         /*
 422                          * normalize value
 423                          *      if value is empty, use empty_bv
 424                          */
 425                         rc = ( *normf )(
 426                                 SLAP_MR_VALUE_OF_ASSERTION_SYNTAX,
 427                                 ad->ad_type->sat_syntax,
 428                                 mr,
 429                                 ava->la_value.bv_len
 430                                         ? &ava->la_value
 431                                         : (struct berval *) &slap_empty_bv,
 432                                 &bv, ctx );
 433
 434                         if ( rc != LDAP_SUCCESS ) {
 435                                 return LDAP_INVALID_SYNTAX;
 436                         }
 437                 }
 438
 439
 440                 if( bv.bv_val ) {
 441                         if ( ava->la_flags & LDAP_AVA_FREE_VALUE )
 442                                 ber_memfree_x( ava->la_value.bv_val, ctx );
 443                         ava->la_value = bv;
 444                         ava->la_flags |= LDAP_AVA_FREE_VALUE;
 445                 }
 446
 447                 if( do_sort ) AVA_Sort( rdn, iAVA );
 448         }
 449         return LDAP_SUCCESS;
 450 }
 451
 452 /*
 453  * In-place, schema-aware normalization / "pretty"ing of the
 454  * structural representation of a distinguished name.
 455  */
 456 static int
 457 LDAPDN_rewrite( LDAPDN dn, unsigned flags, void *ctx )
 458 {
 459         int             iRDN;
 460         int             rc;
 461
 462         assert( dn != NULL );
 463
 464         for ( iRDN = 0; dn[ iRDN ]; iRDN++ ) {
 465                 LDAPRDN         rdn = dn[ iRDN ];
 466                 int             iAVA;
 467
 468                 assert( rdn != NULL );
 469
 470                 for ( iAVA = 0; rdn[ iAVA ]; iAVA++ ) {
 471                         LDAPAVA                 *ava = rdn[ iAVA ];
 472                         AttributeDescription    *ad;
 473                         slap_syntax_validate_func *validf = NULL;
 474                         slap_mr_normalize_func *normf = NULL;
 475                         slap_syntax_transform_func *transf = NULL;
 476                         MatchingRule *mr = NULL;
 477                         struct berval           bv = BER_BVNULL;
 478                         int                     do_sort = 0;
 479
 480                         assert( ava != NULL );
 481
 482                         if ( ( ad = AVA_PRIVATE( ava ) ) == NULL ) {
 483                                 const char      *text = NULL;
 484
 485                                 rc = slap_bv2ad( &ava->la_attr, &ad, &text );
 486                                 if ( rc != LDAP_SUCCESS ) {
 487                                         rc = slap_bv2undef_ad( &ava->la_attr,
 488                                                 &ad, &text,
 489                                                 SLAP_AD_PROXIED|SLAP_AD_NOINSERT );
 490                                         if ( rc != LDAP_SUCCESS ) {
 491                                                 return LDAP_INVALID_SYNTAX;
 492                                         }
 493                                 }
 494
 495                                 ava->la_private = ( void * )ad;
 496                                 do_sort = 1;
 497                         }
 498
 499                         /*
 500                          * Replace attr oid/name with the canonical name
 501                          */
 502                         ava->la_attr = ad->ad_cname;
 503
 504                         if( ava->la_flags & LDAP_AVA_BINARY ) {
 505                                 if( ava->la_value.bv_len == 0 ) {
 506                                         /* BER encoding is empty */
 507                                         return LDAP_INVALID_SYNTAX;
 508                                 }
 509
 510                                 /* AVA is binary encoded, don't muck with it */
 511                         } else if( flags & SLAP_LDAPDN_PRETTY ) {
 512                                 transf = ad->ad_type->sat_syntax->ssyn_pretty;
 513                                 if( !transf ) {
 514                                         validf = ad->ad_type->sat_syntax->ssyn_validate;
 515                                 }
 516                         } else { /* normalization */
 517                                 validf = ad->ad_type->sat_syntax->ssyn_validate;
 518                                 mr = ad->ad_type->sat_equality;
 519                                 if( mr ) normf = mr->smr_normalize;
 520                         }
 521
 522                         if ( validf ) {
 523                                 /* validate value before normalization */
 524                                 rc = ( *validf )( ad->ad_type->sat_syntax,
 525                                         ava->la_value.bv_len
 526                                                 ? &ava->la_value
 527                                                 : (struct berval *) &slap_empty_bv );
 528
 529                                 if ( rc != LDAP_SUCCESS ) {
 530                                         return LDAP_INVALID_SYNTAX;
 531                                 }
 532                         }
 533
 534                         if ( transf ) {
 535                                 /*
 536                                  * transform value by pretty function
 537                                  *      if value is empty, use empty_bv
 538                                  */
 539                                 rc = ( *transf )( ad->ad_type->sat_syntax,
 540                                         ava->la_value.bv_len
 541                                                 ? &ava->la_value
 542                                                 : (struct berval *) &slap_empty_bv,
 543                                         &bv, ctx );
 544
 545                                 if ( rc != LDAP_SUCCESS ) {
 546                                         return LDAP_INVALID_SYNTAX;
 547                                 }
 548                         }
 549
 550                         if ( normf ) {
 551                                 /*
 552                                  * normalize value
 553                                  *      if value is empty, use empty_bv
 554                                  */
 555                                 rc = ( *normf )(
 556                                         SLAP_MR_VALUE_OF_ASSERTION_SYNTAX,
 557                                         ad->ad_type->sat_syntax,
 558                                         mr,
 559                                         ava->la_value.bv_len
 560                                                 ? &ava->la_value
 561                                                 : (struct berval *) &slap_empty_bv,
 562                                         &bv, ctx );
 563
 564                                 if ( rc != LDAP_SUCCESS ) {
 565                                         return LDAP_INVALID_SYNTAX;
 566                                 }
 567                         }
 568
 569
 570                         if( bv.bv_val ) {
 571                                 if ( ava->la_flags & LDAP_AVA_FREE_VALUE )
 572                                         ber_memfree_x( ava->la_value.bv_val, ctx );
 573                                 ava->la_value = bv;
 574                                 ava->la_flags |= LDAP_AVA_FREE_VALUE;
 575                         }
 576
 577                         if( do_sort ) AVA_Sort( rdn, iAVA );
 578                 }
 579         }
 580
 581         return LDAP_SUCCESS;
 582 }
 583
 584 int
 585 dnNormalize(
 586     slap_mask_t use,
 587     Syntax *syntax,
 588     MatchingRule *mr,
 589     struct berval *val,
 590     struct berval *out,
 591     void *ctx)
 592 {
 593         assert( val != NULL );
 594         assert( out != NULL );
 595
 596         Debug( LDAP_DEBUG_TRACE, ">>> dnNormalize: <%s>\n", val->bv_val, 0, 0 );
 597
 598         if ( val->bv_len != 0 ) {
 599                 LDAPDN          dn = NULL;
 600                 int             rc;
 601
 602                 /*
 603                  * Go to structural representation
 604                  */
 605                 rc = ldap_bv2dn_x( val, &dn, LDAP_DN_FORMAT_LDAP, ctx );
 606                 if ( rc != LDAP_SUCCESS ) {
 607                         return LDAP_INVALID_SYNTAX;
 608                 }
 609
 610                 assert( strlen( val->bv_val ) == val->bv_len );
 611
 612                 /*
 613                  * Schema-aware rewrite
 614                  */
 615                 if ( LDAPDN_rewrite( dn, 0, ctx ) != LDAP_SUCCESS ) {
 616                         ldap_dnfree_x( dn, ctx );
 617                         return LDAP_INVALID_SYNTAX;
 618                 }
 619
 620                 /*
 621                  * Back to string representation
 622                  */
 623                 rc = ldap_dn2bv_x( dn, out,
 624                         LDAP_DN_FORMAT_LDAPV3 | LDAP_DN_PRETTY, ctx );
 625
 626                 ldap_dnfree_x( dn, ctx );
 627
 628                 if ( rc != LDAP_SUCCESS ) {
 629                         return LDAP_INVALID_SYNTAX;
 630                 }
 631         } else {
 632                 ber_dupbv_x( out, val, ctx );
 633         }
 634
 635         Debug( LDAP_DEBUG_TRACE, "<<< dnNormalize: <%s>\n", out->bv_val, 0, 0 );
 636
 637         return LDAP_SUCCESS;
 638 }
 639
 640 int
 641 rdnNormalize(
 642     slap_mask_t use,
 643     Syntax *syntax,
 644     MatchingRule *mr,
 645     struct berval *val,
 646     struct berval *out,
 647     void *ctx)
 648 {
 649         assert( val != NULL );
 650         assert( out != NULL );
 651
 652         Debug( LDAP_DEBUG_TRACE, ">>> dnNormalize: <%s>\n", val->bv_val, 0, 0 );
 653         if ( val->bv_len != 0 ) {
 654                 LDAPRDN         rdn = NULL;
 655                 int             rc;
 656                 char*           p;
 657
 658                 /*
 659                  * Go to structural representation
 660                  */
 661                 rc = ldap_bv2rdn_x( val , &rdn, (char **) &p,
 662                                         LDAP_DN_FORMAT_LDAP, ctx);
 663
 664                 if ( rc != LDAP_SUCCESS ) {
 665                         return LDAP_INVALID_SYNTAX;
 666                 }
 667
 668                 assert( strlen( val->bv_val ) == val->bv_len );
 669
 670                 /*
 671                  * Schema-aware rewrite
 672                  */
 673                 if ( LDAPRDN_rewrite( rdn, 0, ctx ) != LDAP_SUCCESS ) {
 674                         ldap_rdnfree_x( rdn, ctx );
 675                         return LDAP_INVALID_SYNTAX;
 676                 }
 677
 678                 /*
 679                  * Back to string representation
 680                  */
 681                 rc = ldap_rdn2bv_x( rdn, out,
 682                         LDAP_DN_FORMAT_LDAPV3 | LDAP_DN_PRETTY, ctx );
 683
 684                 ldap_rdnfree_x( rdn, ctx );
 685
 686                 if ( rc != LDAP_SUCCESS ) {
 687                         return LDAP_INVALID_SYNTAX;
 688                 }
 689         } else {
 690                 ber_dupbv_x( out, val, ctx );
 691         }
 692
 693         Debug( LDAP_DEBUG_TRACE, "<<< dnNormalize: <%s>\n", out->bv_val, 0, 0 );
 694
 695         return LDAP_SUCCESS;
 696 }
 697
 698 int
 699 dnPretty(
 700         Syntax *syntax,
 701         struct berval *val,
 702         struct berval *out,
 703         void *ctx)
 704 {
 705         assert( val != NULL );
 706         assert( out != NULL );
 707
 708         Debug( LDAP_DEBUG_TRACE, ">>> dnPretty: <%s>\n", val->bv_val, 0, 0 );
 709
 710         if ( val->bv_len == 0 ) {
 711                 ber_dupbv_x( out, val, ctx );
 712
 713         } else if ( val->bv_len > SLAP_LDAPDN_MAXLEN ) {
 714                 return LDAP_INVALID_SYNTAX;
 715
 716         } else {
 717                 LDAPDN          dn = NULL;
 718                 int             rc;
 719
 720                 /* FIXME: should be liberal in what we accept */
 721                 rc = ldap_bv2dn_x( val, &dn, LDAP_DN_FORMAT_LDAP, ctx );
 722                 if ( rc != LDAP_SUCCESS ) {
 723                         return LDAP_INVALID_SYNTAX;
 724                 }
 725
 726                 assert( strlen( val->bv_val ) == val->bv_len );
 727
 728                 /*
 729                  * Schema-aware rewrite
 730                  */
 731                 if ( LDAPDN_rewrite( dn, SLAP_LDAPDN_PRETTY, ctx ) != LDAP_SUCCESS ) {
 732                         ldap_dnfree_x( dn, ctx );
 733                         return LDAP_INVALID_SYNTAX;
 734                 }
 735
 736                 /* FIXME: not sure why the default isn't pretty */
 737                 /* RE: the default is the form that is used as
 738                  * an internal representation; the pretty form
 739                  * is a variant */
 740                 rc = ldap_dn2bv_x( dn, out,
 741                         LDAP_DN_FORMAT_LDAPV3 | LDAP_DN_PRETTY, ctx );
 742
 743                 ldap_dnfree_x( dn, ctx );
 744
 745                 if ( rc != LDAP_SUCCESS ) {
 746                         return LDAP_INVALID_SYNTAX;
 747                 }
 748         }
 749
 750         Debug( LDAP_DEBUG_TRACE, "<<< dnPretty: <%s>\n", out->bv_val, 0, 0 );
 751
 752         return LDAP_SUCCESS;
 753 }
 754
 755 int
 756 rdnPretty(
 757         Syntax *syntax,
 758         struct berval *val,
 759         struct berval *out,
 760         void *ctx)
 761 {
 762         assert( val != NULL );
 763         assert( out != NULL );
 764
 765         Debug( LDAP_DEBUG_TRACE, ">>> dnPretty: <%s>\n", val->bv_val, 0, 0 );
 766
 767         if ( val->bv_len == 0 ) {
 768                 ber_dupbv_x( out, val, ctx );
 769
 770         } else if ( val->bv_len > SLAP_LDAPDN_MAXLEN ) {
 771                 return LDAP_INVALID_SYNTAX;
 772
 773         } else {
 774                 LDAPRDN         rdn = NULL;
 775                 int             rc;
 776                 char*           p;
 777
 778                 /* FIXME: should be liberal in what we accept */
 779                 rc = ldap_bv2rdn_x( val , &rdn, (char **) &p,
 780                                         LDAP_DN_FORMAT_LDAP, ctx);
 781                 if ( rc != LDAP_SUCCESS ) {
 782                         return LDAP_INVALID_SYNTAX;
 783                 }
 784
 785                 assert( strlen( val->bv_val ) == val->bv_len );
 786
 787                 /*
 788                  * Schema-aware rewrite
 789                  */
 790                 if ( LDAPRDN_rewrite( rdn, SLAP_LDAPDN_PRETTY, ctx ) != LDAP_SUCCESS ) {
 791                         ldap_rdnfree_x( rdn, ctx );
 792                         return LDAP_INVALID_SYNTAX;
 793                 }
 794
 795                 /* FIXME: not sure why the default isn't pretty */
 796                 /* RE: the default is the form that is used as
 797                  * an internal representation; the pretty form
 798                  * is a variant */
 799                 rc = ldap_rdn2bv_x( rdn, out,
 800                         LDAP_DN_FORMAT_LDAPV3 | LDAP_DN_PRETTY, ctx );
 801
 802                 ldap_rdnfree_x( rdn, ctx );
 803
 804                 if ( rc != LDAP_SUCCESS ) {
 805                         return LDAP_INVALID_SYNTAX;
 806                 }
 807         }
 808
 809         Debug( LDAP_DEBUG_TRACE, "<<< dnPretty: <%s>\n", out->bv_val, 0, 0 );
 810
 811         return LDAP_SUCCESS;
 812 }
 813
 814
 815 int
 816 dnPrettyNormalDN(
 817         Syntax *syntax,
 818         struct berval *val,
 819         LDAPDN *dn,
 820         int flags,
 821         void *ctx )
 822 {
 823         assert( val != NULL );
 824         assert( dn != NULL );
 825
 826         Debug( LDAP_DEBUG_TRACE, ">>> dn%sDN: <%s>\n",
 827                         flags == SLAP_LDAPDN_PRETTY ? "Pretty" : "Normal",
 828                         val->bv_val, 0 );
 829
 830         if ( val->bv_len == 0 ) {
 831                 return LDAP_SUCCESS;
 832
 833         } else if ( val->bv_len > SLAP_LDAPDN_MAXLEN ) {
 834                 return LDAP_INVALID_SYNTAX;
 835
 836         } else {
 837                 int             rc;
 838
 839                 /* FIXME: should be liberal in what we accept */
 840                 rc = ldap_bv2dn_x( val, dn, LDAP_DN_FORMAT_LDAP, ctx );
 841                 if ( rc != LDAP_SUCCESS ) {
 842                         return LDAP_INVALID_SYNTAX;
 843                 }
 844
 845                 assert( strlen( val->bv_val ) == val->bv_len );
 846
 847                 /*
 848                  * Schema-aware rewrite
 849                  */
 850                 if ( LDAPDN_rewrite( *dn, flags, ctx ) != LDAP_SUCCESS ) {
 851                         ldap_dnfree_x( *dn, ctx );
 852                         *dn = NULL;
 853                         return LDAP_INVALID_SYNTAX;
 854                 }
 855         }
 856
 857         Debug( LDAP_DEBUG_TRACE, "<<< dn%sDN\n",
 858                         flags == SLAP_LDAPDN_PRETTY ? "Pretty" : "Normal",
 859                         0, 0 );
 860
 861         return LDAP_SUCCESS;
 862 }
 863
 864 /*
 865  * Combination of both dnPretty and dnNormalize
 866  */
 867 int
 868 dnPrettyNormal(
 869         Syntax *syntax,
 870         struct berval *val,
 871         struct berval *pretty,
 872         struct berval *normal,
 873         void *ctx)
 874 {
 875         Debug( LDAP_DEBUG_TRACE, ">>> dnPrettyNormal: <%s>\n", val->bv_val, 0, 0 );
 876
 877         assert( val != NULL );
 878         assert( pretty != NULL );
 879         assert( normal != NULL );
 880
 881         if ( val->bv_len == 0 ) {
 882                 ber_dupbv_x( pretty, val, ctx );
 883                 ber_dupbv_x( normal, val, ctx );
 884
 885         } else if ( val->bv_len > SLAP_LDAPDN_MAXLEN ) {
 886                 /* too big */
 887                 return LDAP_INVALID_SYNTAX;
 888
 889         } else {
 890                 LDAPDN          dn = NULL;
 891                 int             rc;
 892
 893                 pretty->bv_val = NULL;
 894                 normal->bv_val = NULL;
 895                 pretty->bv_len = 0;
 896                 normal->bv_len = 0;
 897
 898                 /* FIXME: should be liberal in what we accept */
 899                 rc = ldap_bv2dn_x( val, &dn, LDAP_DN_FORMAT_LDAP, ctx );
 900                 if ( rc != LDAP_SUCCESS ) {
 901                         return LDAP_INVALID_SYNTAX;
 902                 }
 903
 904                 assert( strlen( val->bv_val ) == val->bv_len );
 905
 906                 /*
 907                  * Schema-aware rewrite
 908                  */
 909                 if ( LDAPDN_rewrite( dn, SLAP_LDAPDN_PRETTY, ctx ) != LDAP_SUCCESS ) {
 910                         ldap_dnfree_x( dn, ctx );
 911                         return LDAP_INVALID_SYNTAX;
 912                 }
 913
 914                 rc = ldap_dn2bv_x( dn, pretty,
 915                         LDAP_DN_FORMAT_LDAPV3 | LDAP_DN_PRETTY, ctx );
 916
 917                 if ( rc != LDAP_SUCCESS ) {
 918                         ldap_dnfree_x( dn, ctx );
 919                         return LDAP_INVALID_SYNTAX;
 920                 }
 921
 922                 if ( LDAPDN_rewrite( dn, 0, ctx ) != LDAP_SUCCESS ) {
 923                         ldap_dnfree_x( dn, ctx );
 924                         ber_memfree_x( pretty->bv_val, ctx );
 925                         pretty->bv_val = NULL;
 926                         pretty->bv_len = 0;
 927                         return LDAP_INVALID_SYNTAX;
 928                 }
 929
 930                 rc = ldap_dn2bv_x( dn, normal,
 931                         LDAP_DN_FORMAT_LDAPV3 | LDAP_DN_PRETTY, ctx );
 932
 933                 ldap_dnfree_x( dn, ctx );
 934                 if ( rc != LDAP_SUCCESS ) {
 935                         ber_memfree_x( pretty->bv_val, ctx );
 936                         pretty->bv_val = NULL;
 937                         pretty->bv_len = 0;
 938                         return LDAP_INVALID_SYNTAX;
 939                 }
 940         }
 941
 942         Debug( LDAP_DEBUG_TRACE, "<<< dnPrettyNormal: <%s>, <%s>\n",
 943                 pretty->bv_val, normal->bv_val, 0 );
 944
 945         return LDAP_SUCCESS;
 946 }
 947
 948 /*
 949  * dnMatch routine
 950  */
 951 int
 952 dnMatch(
 953         int *matchp,
 954         slap_mask_t flags,
 955         Syntax *syntax,
 956         MatchingRule *mr,
 957         struct berval *value,
 958         void *assertedValue )
 959 {
 960         int match;
 961         struct berval *asserted = (struct berval *) assertedValue;
 962
 963         assert( matchp != NULL );
 964         assert( value != NULL );
 965         assert( assertedValue != NULL );
 966         assert( !BER_BVISNULL( value ) );
 967         assert( !BER_BVISNULL( asserted ) );
 968
 969         match = value->bv_len - asserted->bv_len;
 970
 971         if ( match == 0 ) {
 972                 match = memcmp( value->bv_val, asserted->bv_val,
 973                                 value->bv_len );
 974         }
 975
 976         Debug( LDAP_DEBUG_ARGS, "dnMatch %d\n\t\"%s\"\n\t\"%s\"\n",
 977                 match, value->bv_val, asserted->bv_val );
 978
 979         *matchp = match;
 980         return LDAP_SUCCESS;
 981 }
 982
 983 /*
 984  * dnRelativeMatch routine
 985  */
 986 int
 987 dnRelativeMatch(
 988         int *matchp,
 989         slap_mask_t flags,
 990         Syntax *syntax,
 991         MatchingRule *mr,
 992         struct berval *value,
 993         void *assertedValue )
 994 {
 995         int match;
 996         struct berval *asserted = (struct berval *) assertedValue;
 997
 998         assert( matchp != NULL );
 999         assert( value != NULL );
1000         assert( assertedValue != NULL );
1001         assert( !BER_BVISNULL( value ) );
1002         assert( !BER_BVISNULL( asserted ) );
1003
1004         if( mr == slap_schema.si_mr_dnSubtreeMatch ) {
1005                 if( asserted->bv_len > value->bv_len ) {
1006                         match = -1;
1007                 } else if ( asserted->bv_len == value->bv_len ) {
1008                         match = memcmp( value->bv_val, asserted->bv_val,
1009                                 value->bv_len );
1010                 } else {
1011                         if( DN_SEPARATOR(
1012                                 value->bv_val[value->bv_len - asserted->bv_len - 1] ))
1013                         {
1014                                 match = memcmp(
1015                                         &value->bv_val[value->bv_len - asserted->bv_len],
1016                                         asserted->bv_val,
1017                                         asserted->bv_len );
1018                         } else {
1019                                 match = 1;
1020                         }
1021                 }
1022
1023                 *matchp = match;
1024                 return LDAP_SUCCESS;
1025         }
1026
1027         if( mr == slap_schema.si_mr_dnSuperiorMatch ) {
1028                 asserted = value;
1029                 value = (struct berval *) assertedValue;
1030                 mr = slap_schema.si_mr_dnSubordinateMatch;
1031         }
1032
1033         if( mr == slap_schema.si_mr_dnSubordinateMatch ) {
1034                 if( asserted->bv_len >= value->bv_len ) {
1035                         match = -1;
1036                 } else {
1037                         if( DN_SEPARATOR(
1038                                 value->bv_val[value->bv_len - asserted->bv_len - 1] ))
1039                         {
1040                                 match = memcmp(
1041                                         &value->bv_val[value->bv_len - asserted->bv_len],
1042                                         asserted->bv_val,
1043                                         asserted->bv_len );
1044                         } else {
1045                                 match = 1;
1046                         }
1047                 }
1048
1049                 *matchp = match;
1050                 return LDAP_SUCCESS;
1051         }
1052
1053         if( mr == slap_schema.si_mr_dnOneLevelMatch ) {
1054                 if( asserted->bv_len >= value->bv_len ) {
1055                         match = -1;
1056                 } else {
1057                         if( DN_SEPARATOR(
1058                                 value->bv_val[value->bv_len - asserted->bv_len - 1] ))
1059                         {
1060                                 match = memcmp(
1061                                         &value->bv_val[value->bv_len - asserted->bv_len],
1062                                         asserted->bv_val,
1063                                         asserted->bv_len );
1064
1065                                 if( !match ) {
1066                                         struct berval rdn;
1067                                         rdn.bv_val = value->bv_val;
1068                                         rdn.bv_len = value->bv_len - asserted->bv_len - 1;
1069                                         match = dnIsOneLevelRDN( &rdn ) ? 0 : 1;
1070                                 }
1071                         } else {
1072                                 match = 1;
1073                         }
1074                 }
1075
1076                 *matchp = match;
1077                 return LDAP_SUCCESS;
1078         }
1079
1080         /* should not be reachable */
1081         assert( 0 );
1082         return LDAP_OTHER;
1083 }
1084
1085 int
1086 rdnMatch(
1087         int *matchp,
1088         slap_mask_t flags,
1089         Syntax *syntax,
1090         MatchingRule *mr,
1091         struct berval *value,
1092         void *assertedValue )
1093 {
1094         int match;
1095         struct berval *asserted = (struct berval *) assertedValue;
1096
1097         assert( matchp != NULL );
1098         assert( value != NULL );
1099         assert( assertedValue != NULL );
1100
1101         match = value->bv_len - asserted->bv_len;
1102
1103         if ( match == 0 ) {
1104                 match = memcmp( value->bv_val, asserted->bv_val,
1105                                 value->bv_len );
1106         }
1107
1108         Debug( LDAP_DEBUG_ARGS, "rdnMatch %d\n\t\"%s\"\n\t\"%s\"\n",
1109                 match, value->bv_val, asserted->bv_val );
1110
1111         *matchp = match;
1112         return LDAP_SUCCESS;
1113 }
1114
1115
1116 /*
1117  * dnParent - dn's parent, in-place
1118  * note: the incoming dn is assumed to be normalized/prettyfied,
1119  * so that escaped rdn/ava separators are in '\'+hexpair form
1120  *
1121  * note: "dn" and "pdn" can point to the same berval;
1122  * beware that, in this case, the pointer to the original buffer
1123  * will get lost.
1124  */
1125 void
1126 dnParent(
1127         struct berval   *dn,
1128         struct berval   *pdn )
1129 {
1130         char    *p;
1131
1132         p = strchr( dn->bv_val, ',' );
1133
1134         /* one-level dn */
1135         if ( p == NULL ) {
1136                 pdn->bv_len = 0;
1137                 pdn->bv_val = dn->bv_val + dn->bv_len;
1138                 return;
1139         }
1140
1141         assert( DN_SEPARATOR( p[ 0 ] ) );
1142         p++;
1143
1144         assert( ATTR_LEADCHAR( p[ 0 ] ) );
1145         pdn->bv_len = dn->bv_len - (p - dn->bv_val);
1146         pdn->bv_val = p;
1147
1148         return;
1149 }
1150
1151 /*
1152  * dnRdn - dn's rdn, in-place
1153  * note: the incoming dn is assumed to be normalized/prettyfied,
1154  * so that escaped rdn/ava separators are in '\'+hexpair form
1155  */
1156 void
1157 dnRdn(
1158         struct berval   *dn,
1159         struct berval   *rdn )
1160 {
1161         char    *p;
1162
1163         *rdn = *dn;
1164         p = strchr( dn->bv_val, ',' );
1165
1166         /* one-level dn */
1167         if ( p == NULL ) {
1168                 return;
1169         }
1170
1171         assert( DN_SEPARATOR( p[ 0 ] ) );
1172         assert( ATTR_LEADCHAR( p[ 1 ] ) );
1173         rdn->bv_len = p - dn->bv_val;
1174
1175         return;
1176 }
1177
1178 int
1179 dnExtractRdn(
1180         struct berval   *dn,
1181         struct berval   *rdn,
1182         void *ctx )
1183 {
1184         LDAPRDN         tmpRDN;
1185         const char      *p;
1186         int             rc;
1187
1188         assert( dn != NULL );
1189         assert( rdn != NULL );
1190
1191         if( dn->bv_len == 0 ) {
1192                 return LDAP_OTHER;
1193         }
1194
1195         rc = ldap_bv2rdn_x( dn, &tmpRDN, (char **)&p, LDAP_DN_FORMAT_LDAP, ctx );
1196         if ( rc != LDAP_SUCCESS ) {
1197                 return rc;
1198         }
1199
1200         rc = ldap_rdn2bv_x( tmpRDN, rdn, LDAP_DN_FORMAT_LDAPV3 | LDAP_DN_PRETTY,
1201                 ctx );
1202
1203         ldap_rdnfree_x( tmpRDN, ctx );
1204         return rc;
1205 }
1206
1207 /*
1208  * We can assume the input is a prettied or normalized DN
1209  */
1210 ber_len_t
1211 dn_rdnlen(
1212         Backend         *be,
1213         struct berval   *dn_in )
1214 {
1215         const char      *p;
1216
1217         assert( dn_in != NULL );
1218
1219         if ( dn_in == NULL ) {
1220                 return 0;
1221         }
1222
1223         if ( !dn_in->bv_len ) {
1224                 return 0;
1225         }
1226
1227         if ( be != NULL && be_issuffix( be, dn_in ) ) {
1228                 return 0;
1229         }
1230
1231         p = strchr( dn_in->bv_val, ',' );
1232
1233         return p ? p - dn_in->bv_val : dn_in->bv_len;
1234 }
1235
1236
1237 /* rdnValidate:
1238  *
1239  * LDAP_SUCCESS if rdn is a legal rdn;
1240  * LDAP_INVALID_SYNTAX otherwise (including a sequence of rdns)
1241  */
1242 int
1243 rdn_validate( struct berval *rdn )
1244 {
1245 #if 1
1246         /* Major cheat!
1247          * input is a pretty or normalized DN
1248          * hence, we can just search for ','
1249          */
1250         if( rdn == NULL || rdn->bv_len == 0 ||
1251                 rdn->bv_len > SLAP_LDAPDN_MAXLEN )
1252         {
1253                 return LDAP_INVALID_SYNTAX;
1254         }
1255         return strchr( rdn->bv_val, ',' ) == NULL
1256                 ? LDAP_SUCCESS : LDAP_INVALID_SYNTAX;
1257
1258 #else
1259         LDAPRDN         *RDN, **DN[ 2 ] = { &RDN, NULL };
1260         const char      *p;
1261         int             rc;
1262
1263         /*
1264          * must be non-empty
1265          */
1266         if ( rdn == NULL || rdn == '\0' ) {
1267                 return 0;
1268         }
1269
1270         /*
1271          * must be parsable
1272          */
1273         rc = ldap_bv2rdn( rdn, &RDN, (char **)&p, LDAP_DN_FORMAT_LDAP );
1274         if ( rc != LDAP_SUCCESS ) {
1275                 return 0;
1276         }
1277
1278         /*
1279          * Must be one-level
1280          */
1281         if ( p[ 0 ] != '\0' ) {
1282                 return 0;
1283         }
1284
1285         /*
1286          * Schema-aware validate
1287          */
1288         if ( rc == LDAP_SUCCESS ) {
1289                 rc = LDAPDN_validate( DN );
1290         }
1291         ldap_rdnfree( RDN );
1292
1293         /*
1294          * Must validate (there's a repeated parsing ...)
1295          */
1296         return ( rc == LDAP_SUCCESS );
1297 #endif
1298 }
1299
1300
1301 /* build_new_dn:
1302  *
1303  * Used by ldbm/bdb2 back_modrdn to create the new dn of entries being
1304  * renamed.
1305  *
1306  * new_dn = parent (p_dn) + separator + rdn (newrdn) + null.
1307  */
1308
1309 void
1310 build_new_dn( struct berval * new_dn,
1311         struct berval * parent_dn,
1312         struct berval * newrdn,
1313         void *memctx )
1314 {
1315         char *ptr;
1316
1317         if ( parent_dn == NULL || parent_dn->bv_len == 0 ) {
1318                 ber_dupbv( new_dn, newrdn );
1319                 return;
1320         }
1321
1322         new_dn->bv_len = parent_dn->bv_len + newrdn->bv_len + 1;
1323         new_dn->bv_val = (char *) slap_sl_malloc( new_dn->bv_len + 1, memctx );
1324
1325         ptr = lutil_strncopy( new_dn->bv_val, newrdn->bv_val, newrdn->bv_len );
1326         *ptr++ = ',';
1327         strcpy( ptr, parent_dn->bv_val );
1328 }
1329
1330
1331 /*
1332  * dnIsSuffix - tells whether suffix is a suffix of dn.
1333  * Both dn and suffix must be normalized.
1334  */
1335 int
1336 dnIsSuffix(
1337         const struct berval *dn,
1338         const struct berval *suffix )
1339 {
1340         int     d = dn->bv_len - suffix->bv_len;
1341
1342         assert( dn != NULL );
1343         assert( suffix != NULL );
1344
1345         /* empty suffix matches any dn */
1346         if ( suffix->bv_len == 0 ) {
1347                 return 1;
1348         }
1349
1350         /* suffix longer than dn */
1351         if ( d < 0 ) {
1352                 return 0;
1353         }
1354
1355         /* no rdn separator or escaped rdn separator */
1356         if ( d > 1 && !DN_SEPARATOR( dn->bv_val[ d - 1 ] ) ) {
1357                 return 0;
1358         }
1359
1360         /* no possible match or malformed dn */
1361         if ( d == 1 ) {
1362                 return 0;
1363         }
1364
1365         /* compare */
1366         return( strcmp( dn->bv_val + d, suffix->bv_val ) == 0 );
1367 }
1368
1369 int
1370 dnIsOneLevelRDN( struct berval *rdn )
1371 {
1372         ber_len_t       len = rdn->bv_len;
1373         for ( ; len--; ) {
1374                 if ( DN_SEPARATOR( rdn->bv_val[ len ] ) ) {
1375                         return 0;
1376                 }
1377         }
1378
1379         return 1;
1380 }
1381
1382 #ifdef HAVE_TLS
1383 static SLAP_CERT_MAP_FN *DNX509PeerNormalizeCertMap = NULL;
1384 #endif
1385
1386 int register_certificate_map_function(SLAP_CERT_MAP_FN *fn)
1387 {
1388 #ifdef HAVE_TLS
1389         if ( DNX509PeerNormalizeCertMap == NULL ) {
1390                 DNX509PeerNormalizeCertMap = fn;
1391                 return 0;
1392         }
1393 #endif
1394
1395         return -1;
1396 }
1397
1398 #ifdef HAVE_TLS
1399 /*
1400  * Convert an X.509 DN into a normalized LDAP DN
1401  */
1402 int
1403 dnX509normalize( void *x509_name, struct berval *out )
1404 {
1405         /* Invoke the LDAP library's converter with our schema-rewriter */
1406         int rc = ldap_X509dn2bv( x509_name, out, LDAPDN_rewrite, 0 );
1407
1408         Debug( LDAP_DEBUG_TRACE,
1409                 "dnX509Normalize: <%s>\n", out->bv_val, 0, 0 );
1410
1411         return rc;
1412 }
1413
1414 /*
1415  * Get the TLS session's peer's DN into a normalized LDAP DN
1416  */
1417 int
1418 dnX509peerNormalize( void *ssl, struct berval *dn )
1419 {
1420         int rc = LDAP_INVALID_CREDENTIALS;
1421
1422         if ( DNX509PeerNormalizeCertMap != NULL )
1423                 rc = (*DNX509PeerNormalizeCertMap)( ssl, dn );
1424
1425         if ( rc != LDAP_SUCCESS ) {
1426                 rc = ldap_pvt_tls_get_peer_dn( ssl, dn,
1427                         (LDAPDN_rewrite_dummy *)LDAPDN_rewrite, 0 );
1428         }
1429
1430         return rc;
1431 }
1432 #endif