git.sur5r.net Git - openldap/blob - servers/slapd/modify.c

   1 /* $OpenLDAP$ */
   2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   3  *
   4  * Copyright 1998-2018 The OpenLDAP Foundation.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted only as authorized by the OpenLDAP
   9  * Public License.
  10  *
  11  * A copy of this license is available in the file LICENSE in the
  12  * top-level directory of the distribution or, alternatively, at
  13  * <http://www.OpenLDAP.org/license.html>.
  14  */
  15 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
  16  * All rights reserved.
  17  *
  18  * Redistribution and use in source and binary forms are permitted
  19  * provided that this notice is preserved and that due credit is given
  20  * to the University of Michigan at Ann Arbor. The name of the University
  21  * may not be used to endorse or promote products derived from this
  22  * software without specific prior written permission. This software
  23  * is provided ``as is'' without express or implied warranty.
  24  */
  25
  26 #include "portable.h"
  27
  28 #include <stdio.h>
  29
  30 #include <ac/socket.h>
  31 #include <ac/string.h>
  32 #include <ac/time.h>
  33
  34 #include "slap.h"
  35 #include "lutil.h"
  36
  37
  38 int
  39 do_modify(
  40     Operation   *op,
  41     SlapReply   *rs )
  42 {
  43         struct berval dn = BER_BVNULL;
  44         char            textbuf[ SLAP_TEXT_BUFLEN ];
  45         size_t          textlen = sizeof( textbuf );
  46 #ifdef LDAP_DEBUG
  47         Modifications   *tmp;
  48 #endif
  49
  50         Debug( LDAP_DEBUG_TRACE, "%s do_modify\n",
  51                 op->o_log_prefix, 0, 0 );
  52         /*
  53          * Parse the modify request.  It looks like this:
  54          *
  55          *      ModifyRequest := [APPLICATION 6] SEQUENCE {
  56          *              name    DistinguishedName,
  57          *              mods    SEQUENCE OF SEQUENCE {
  58          *                      operation       ENUMERATED {
  59          *                              add     (0),
  60          *                              delete  (1),
  61          *                              replace (2)
  62          *                      },
  63          *                      modification    SEQUENCE {
  64          *                              type    AttributeType,
  65          *                              values  SET OF AttributeValue
  66          *                      }
  67          *              }
  68          *      }
  69          */
  70
  71         if ( ber_scanf( op->o_ber, "{m" /*}*/, &dn ) == LBER_ERROR ) {
  72                 Debug( LDAP_DEBUG_ANY, "%s do_modify: ber_scanf failed\n",
  73                         op->o_log_prefix, 0, 0 );
  74                 send_ldap_discon( op, rs, LDAP_PROTOCOL_ERROR, "decoding error" );
  75                 return SLAPD_DISCONNECT;
  76         }
  77
  78         Debug( LDAP_DEBUG_ARGS, "%s do_modify: dn (%s)\n",
  79                 op->o_log_prefix, dn.bv_val, 0 );
  80
  81         rs->sr_err = slap_parse_modlist( op, rs, op->o_ber, &op->oq_modify );
  82         if ( rs->sr_err != LDAP_SUCCESS ) {
  83                 Debug( LDAP_DEBUG_ANY, "%s do_modify: slap_parse_modlist failed err=%d msg=%s\n",
  84                         op->o_log_prefix, rs->sr_err, rs->sr_text );
  85                 send_ldap_result( op, rs );
  86                 goto cleanup;
  87         }
  88
  89         if( get_ctrls( op, rs, 1 ) != LDAP_SUCCESS ) {
  90                 Debug( LDAP_DEBUG_ANY, "%s do_modify: get_ctrls failed\n",
  91                         op->o_log_prefix, 0, 0 );
  92                 /* get_ctrls has sent results.  Now clean up. */
  93                 goto cleanup;
  94         }
  95
  96         rs->sr_err = dnPrettyNormal( NULL, &dn, &op->o_req_dn, &op->o_req_ndn,
  97                 op->o_tmpmemctx );
  98         if( rs->sr_err != LDAP_SUCCESS ) {
  99                 Debug( LDAP_DEBUG_ANY, "%s do_modify: invalid dn (%s)\n",
 100                         op->o_log_prefix, dn.bv_val, 0 );
 101                 send_ldap_error( op, rs, LDAP_INVALID_DN_SYNTAX, "invalid DN" );
 102                 goto cleanup;
 103         }
 104
 105         op->orm_no_opattrs = 0;
 106
 107 #ifdef LDAP_DEBUG
 108         Debug( LDAP_DEBUG_ARGS, "%s modifications:\n",
 109                         op->o_log_prefix, 0, 0 );
 110
 111         for ( tmp = op->orm_modlist; tmp != NULL; tmp = tmp->sml_next ) {
 112                 Debug( LDAP_DEBUG_ARGS, "\t%s: %s\n",
 113                         tmp->sml_op == LDAP_MOD_ADD ? "add" :
 114                                 (tmp->sml_op == LDAP_MOD_INCREMENT ? "increment" :
 115                                 (tmp->sml_op == LDAP_MOD_DELETE ? "delete" :
 116                                         "replace")), tmp->sml_type.bv_val, 0 );
 117
 118                 if ( tmp->sml_values == NULL ) {
 119                         Debug( LDAP_DEBUG_ARGS, "%s\n",
 120                            "\t\tno values", NULL, NULL );
 121                 } else if ( BER_BVISNULL( &tmp->sml_values[ 0 ] ) ) {
 122                         Debug( LDAP_DEBUG_ARGS, "%s\n",
 123                            "\t\tzero values", NULL, NULL );
 124                 } else if ( BER_BVISNULL( &tmp->sml_values[ 1 ] ) ) {
 125                         Debug( LDAP_DEBUG_ARGS, "%s, length %ld\n",
 126                            "\t\tone value", (long) tmp->sml_values[0].bv_len, NULL );
 127                 } else {
 128                         Debug( LDAP_DEBUG_ARGS, "%s\n",
 129                            "\t\tmultiple values", NULL, NULL );
 130                 }
 131         }
 132
 133         if ( StatslogTest( LDAP_DEBUG_STATS ) ) {
 134                 char abuf[BUFSIZ/2], *ptr = abuf;
 135                 int len = 0;
 136
 137                 Statslog( LDAP_DEBUG_STATS, "%s MOD dn=\"%s\"\n",
 138                         op->o_log_prefix, op->o_req_dn.bv_val, 0, 0, 0 );
 139
 140                 for ( tmp = op->orm_modlist; tmp != NULL; tmp = tmp->sml_next ) {
 141                         if (len + 1 + tmp->sml_type.bv_len > sizeof(abuf)) {
 142                                 Statslog( LDAP_DEBUG_STATS, "%s MOD attr=%s\n",
 143                                     op->o_log_prefix, abuf, 0, 0, 0 );
 144
 145                                 len = 0;
 146                                 ptr = abuf;
 147
 148                                 if( 1 + tmp->sml_type.bv_len > sizeof(abuf)) {
 149                                         Statslog( LDAP_DEBUG_STATS, "%s MOD attr=%s\n",
 150                                                 op->o_log_prefix, tmp->sml_type.bv_val, 0, 0, 0 );
 151                                         continue;
 152                                 }
 153                         }
 154                         if (len) {
 155                                 *ptr++ = ' ';
 156                                 len++;
 157                         }
 158                         ptr = lutil_strcopy(ptr, tmp->sml_type.bv_val);
 159                         len += tmp->sml_type.bv_len;
 160                 }
 161                 if (len) {
 162                         Statslog( LDAP_DEBUG_STATS, "%s MOD attr=%s\n",
 163                                 op->o_log_prefix, abuf, 0, 0, 0 );
 164                 }
 165         }
 166 #endif  /* LDAP_DEBUG */
 167
 168         rs->sr_err = slap_mods_check( op, op->orm_modlist,
 169                 &rs->sr_text, textbuf, textlen, NULL );
 170
 171         if ( rs->sr_err != LDAP_SUCCESS ) {
 172                 send_ldap_result( op, rs );
 173                 goto cleanup;
 174         }
 175
 176         op->o_bd = frontendDB;
 177         rs->sr_err = frontendDB->be_modify( op, rs );
 178         if ( rs->sr_err == SLAPD_ASYNCOP ) {
 179                 /* skip cleanup */
 180                 return rs->sr_err;
 181         }
 182
 183 #ifdef LDAP_X_TXN
 184         if( rs->sr_err == LDAP_X_TXN_SPECIFY_OKAY ) {
 185                 /* skip cleanup */
 186                 return rs->sr_err;
 187         }
 188 #endif
 189
 190 cleanup:
 191         op->o_tmpfree( op->o_req_dn.bv_val, op->o_tmpmemctx );
 192         op->o_tmpfree( op->o_req_ndn.bv_val, op->o_tmpmemctx );
 193         if ( op->orm_modlist != NULL ) slap_mods_free( op->orm_modlist, 1 );
 194
 195         return rs->sr_err;
 196 }
 197
 198 int
 199 fe_op_modify( Operation *op, SlapReply *rs )
 200 {
 201         BackendDB       *op_be, *bd = op->o_bd;
 202         char            textbuf[ SLAP_TEXT_BUFLEN ];
 203         size_t          textlen = sizeof( textbuf );
 204
 205         if ( BER_BVISEMPTY( &op->o_req_ndn ) ) {
 206                 Debug( LDAP_DEBUG_ANY, "%s do_modify: root dse!\n",
 207                         op->o_log_prefix, 0, 0 );
 208                 send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
 209                         "modify upon the root DSE not supported" );
 210                 goto cleanup;
 211
 212         } else if ( bvmatch( &op->o_req_ndn, &frontendDB->be_schemandn ) ) {
 213                 Debug( LDAP_DEBUG_ANY, "%s do_modify: subschema subentry!\n",
 214                         op->o_log_prefix, 0, 0 );
 215                 send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
 216                         "modification of subschema subentry not supported" );
 217                 goto cleanup;
 218         }
 219
 220         /*
 221          * We could be serving multiple database backends.  Select the
 222          * appropriate one, or send a referral to our "referral server"
 223          * if we don't hold it.
 224          */
 225         op->o_bd = select_backend( &op->o_req_ndn, 1 );
 226         if ( op->o_bd == NULL ) {
 227                 op->o_bd = bd;
 228                 rs->sr_ref = referral_rewrite( default_referral,
 229                         NULL, &op->o_req_dn, LDAP_SCOPE_DEFAULT );
 230                 if ( !rs->sr_ref ) {
 231                         rs->sr_ref = default_referral;
 232                 }
 233
 234                 if ( rs->sr_ref != NULL ) {
 235                         rs->sr_err = LDAP_REFERRAL;
 236                         send_ldap_result( op, rs );
 237
 238                         if ( rs->sr_ref != default_referral ) {
 239                                 ber_bvarray_free( rs->sr_ref );
 240                         }
 241
 242                 } else {
 243                         send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
 244                                 "no global superior knowledge" );
 245                 }
 246                 goto cleanup;
 247         }
 248
 249         /* If we've got a glued backend, check the real backend */
 250         op_be = op->o_bd;
 251         if ( SLAP_GLUE_INSTANCE( op->o_bd )) {
 252                 op->o_bd = select_backend( &op->o_req_ndn, 0 );
 253         }
 254
 255         /* check restrictions */
 256         if ( backend_check_restrictions( op, rs, NULL ) != LDAP_SUCCESS ) {
 257                 send_ldap_result( op, rs );
 258                 goto cleanup;
 259         }
 260
 261         /* check for referrals */
 262         if ( backend_check_referrals( op, rs ) != LDAP_SUCCESS ) {
 263                 goto cleanup;
 264         }
 265
 266         rs->sr_err = slap_mods_obsolete_check( op, op->orm_modlist,
 267                 &rs->sr_text, textbuf, textlen );
 268         if ( rs->sr_err != LDAP_SUCCESS ) {
 269                 send_ldap_result( op, rs );
 270                 goto cleanup;
 271         }
 272
 273         /* check for modify/increment support */
 274         if ( op->orm_increment && !SLAP_INCREMENT( op->o_bd ) ) {
 275                 send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
 276                         "modify/increment not supported in context" );
 277                 goto cleanup;
 278         }
 279
 280         /*
 281          * do the modify if 1 && (2 || 3)
 282          * 1) there is a modify function implemented in this backend;
 283          * 2) this backend is master for what it holds;
 284          * 3) it's a replica and the dn supplied is the update_ndn.
 285          */
 286         if ( op->o_bd->be_modify ) {
 287                 /* do the update here */
 288                 int repl_user = be_isupdate( op );
 289
 290                 /*
 291                  * Multimaster slapd does not have to check for replicator dn
 292                  * because it accepts each modify request
 293                  */
 294                 if ( !SLAP_SINGLE_SHADOW(op->o_bd) || repl_user ) {
 295                         int update = !BER_BVISEMPTY( &op->o_bd->be_update_ndn );
 296
 297                         op->o_bd = op_be;
 298
 299                         if ( !update ) {
 300                                 rs->sr_err = slap_mods_no_user_mod_check( op, op->orm_modlist,
 301                                         &rs->sr_text, textbuf, textlen );
 302                                 if ( rs->sr_err != LDAP_SUCCESS ) {
 303                                         send_ldap_result( op, rs );
 304                                         goto cleanup;
 305                                 }
 306                         }
 307                         op->o_bd->be_modify( op, rs );
 308
 309                 } else { /* send a referral */
 310                         BerVarray defref = op->o_bd->be_update_refs
 311                                 ? op->o_bd->be_update_refs : default_referral;
 312                         if ( defref != NULL ) {
 313                                 rs->sr_ref = referral_rewrite( defref,
 314                                         NULL, &op->o_req_dn,
 315                                         LDAP_SCOPE_DEFAULT );
 316                                 if ( rs->sr_ref == NULL ) {
 317                                         /* FIXME: must duplicate, because
 318                                          * overlays may muck with it */
 319                                         rs->sr_ref = defref;
 320                                 }
 321                                 rs->sr_err = LDAP_REFERRAL;
 322                                 send_ldap_result( op, rs );
 323                                 if ( rs->sr_ref != defref ) {
 324                                         ber_bvarray_free( rs->sr_ref );
 325                                 }
 326
 327                         } else {
 328                                 send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
 329                                         "shadow context; no update referral" );
 330                         }
 331                 }
 332
 333         } else {
 334                 send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
 335                     "operation not supported within namingContext" );
 336         }
 337
 338 cleanup:;
 339         op->o_bd = bd;
 340         return rs->sr_err;
 341 }
 342
 343 /*
 344  * Obsolete constraint checking.
 345  */
 346 int
 347 slap_mods_obsolete_check(
 348         Operation *op,
 349         Modifications *ml,
 350         const char **text,
 351         char *textbuf,
 352         size_t textlen )
 353 {
 354         if( get_relax( op ) ) return LDAP_SUCCESS;
 355
 356         for ( ; ml != NULL; ml = ml->sml_next ) {
 357                 if ( is_at_obsolete( ml->sml_desc->ad_type ) &&
 358                         (( ml->sml_op != LDAP_MOD_REPLACE &&
 359                                 ml->sml_op != LDAP_MOD_DELETE ) ||
 360                                         ml->sml_values != NULL ))
 361                 {
 362                         /*
 363                          * attribute is obsolete,
 364                          * only allow replace/delete with no values
 365                          */
 366                         snprintf( textbuf, textlen,
 367                                 "%s: attribute is obsolete",
 368                                 ml->sml_type.bv_val );
 369                         *text = textbuf;
 370                         return LDAP_CONSTRAINT_VIOLATION;
 371                 }
 372         }
 373
 374         return LDAP_SUCCESS;
 375 }
 376
 377 /*
 378  * No-user-modification constraint checking.
 379  */
 380 int
 381 slap_mods_no_user_mod_check(
 382         Operation *op,
 383         Modifications *ml,
 384         const char **text,
 385         char *textbuf,
 386         size_t textlen )
 387 {
 388         for ( ; ml != NULL; ml = ml->sml_next ) {
 389                 if ( !is_at_no_user_mod( ml->sml_desc->ad_type ) ) {
 390                         continue;
 391                 }
 392
 393                 if ( ml->sml_flags & SLAP_MOD_INTERNAL ) {
 394                         continue;
 395                 }
 396
 397                 if ( get_relax( op ) ) {
 398                         if ( ml->sml_desc->ad_type->sat_flags & SLAP_AT_MANAGEABLE ) {
 399                                 ml->sml_flags |= SLAP_MOD_MANAGING;
 400                                 continue;
 401                         }
 402
 403                         /* attribute not manageable */
 404                         snprintf( textbuf, textlen,
 405                                 "%s: no-user-modification attribute not manageable",
 406                                 ml->sml_type.bv_val );
 407
 408                 } else {
 409                         /* user modification disallowed */
 410                         snprintf( textbuf, textlen,
 411                                 "%s: no user modification allowed",
 412                                 ml->sml_type.bv_val );
 413                 }
 414
 415                 *text = textbuf;
 416                 return LDAP_CONSTRAINT_VIOLATION;
 417         }
 418
 419         return LDAP_SUCCESS;
 420 }
 421
 422 int
 423 slap_mods_no_repl_user_mod_check(
 424         Operation *op,
 425         Modifications *ml,
 426         const char **text,
 427         char *textbuf,
 428         size_t textlen )
 429 {
 430         Modifications *mods;
 431         Modifications *modp;
 432
 433         for ( mods = ml; mods != NULL; mods = mods->sml_next ) {
 434                 assert( mods->sml_op == LDAP_MOD_ADD );
 435
 436                 /* check doesn't already appear */
 437                 for ( modp = ml; modp != NULL; modp = modp->sml_next ) {
 438                         if ( mods->sml_desc == modp->sml_desc && mods != modp ) {
 439                                 snprintf( textbuf, textlen,
 440                                         "attribute '%s' provided more than once",
 441                                         mods->sml_desc->ad_cname.bv_val );
 442                                 *text = textbuf;
 443                                 return LDAP_TYPE_OR_VALUE_EXISTS;
 444                         }
 445                 }
 446         }
 447
 448         return LDAP_SUCCESS;
 449 }
 450
 451 /*
 452  * Do basic attribute type checking and syntax validation.
 453  */
 454 int slap_mods_check(
 455         Operation *op,
 456         Modifications *ml,
 457         const char **text,
 458         char *textbuf,
 459         size_t textlen,
 460         void *ctx )
 461 {
 462         int rc;
 463
 464         for( ; ml != NULL; ml = ml->sml_next ) {
 465                 AttributeDescription *ad = NULL;
 466
 467                 /* convert to attribute description */
 468                 if ( ml->sml_desc == NULL ) {
 469                         rc = slap_bv2ad( &ml->sml_type, &ml->sml_desc, text );
 470                         if( rc != LDAP_SUCCESS ) {
 471                                 if ( get_no_schema_check( op )) {
 472                                         rc = slap_bv2undef_ad( &ml->sml_type, &ml->sml_desc,
 473                                                 text, 0 );
 474                                 }
 475                         }
 476                         if( rc != LDAP_SUCCESS ) {
 477                                 snprintf( textbuf, textlen, "%s: %s",
 478                                         ml->sml_type.bv_val, *text );
 479                                 *text = textbuf;
 480                                 return rc;
 481                         }
 482                 }
 483
 484                 ad = ml->sml_desc;
 485
 486                 if( slap_syntax_is_binary( ad->ad_type->sat_syntax )
 487                         && !slap_ad_is_binary( ad ))
 488                 {
 489                         /* attribute requires binary transfer */
 490                         snprintf( textbuf, textlen,
 491                                 "%s: requires ;binary transfer",
 492                                 ml->sml_type.bv_val );
 493                         *text = textbuf;
 494                         return LDAP_UNDEFINED_TYPE;
 495                 }
 496
 497                 if( !slap_syntax_is_binary( ad->ad_type->sat_syntax )
 498                         && slap_ad_is_binary( ad ))
 499                 {
 500                         /* attribute does not require binary transfer */
 501                         snprintf( textbuf, textlen,
 502                                 "%s: disallows ;binary transfer",
 503                                 ml->sml_type.bv_val );
 504                         *text = textbuf;
 505                         return LDAP_UNDEFINED_TYPE;
 506                 }
 507
 508                 if( slap_ad_is_tag_range( ad )) {
 509                         /* attribute requires binary transfer */
 510                         snprintf( textbuf, textlen,
 511                                 "%s: inappropriate use of tag range option",
 512                                 ml->sml_type.bv_val );
 513                         *text = textbuf;
 514                         return LDAP_UNDEFINED_TYPE;
 515                 }
 516
 517 #if 0
 518                 if ( is_at_obsolete( ad->ad_type ) &&
 519                         (( ml->sml_op != LDAP_MOD_REPLACE &&
 520                                 ml->sml_op != LDAP_MOD_DELETE ) ||
 521                                         ml->sml_values != NULL ))
 522                 {
 523                         /*
 524                          * attribute is obsolete,
 525                          * only allow replace/delete with no values
 526                          */
 527                         snprintf( textbuf, textlen,
 528                                 "%s: attribute is obsolete",
 529                                 ml->sml_type.bv_val );
 530                         *text = textbuf;
 531                         return LDAP_CONSTRAINT_VIOLATION;
 532                 }
 533 #endif
 534
 535                 if ( ml->sml_op == LDAP_MOD_INCREMENT &&
 536 #ifdef SLAPD_REAL_SYNTAX
 537                         !is_at_syntax( ad->ad_type, SLAPD_REAL_SYNTAX ) &&
 538 #endif
 539                         !is_at_syntax( ad->ad_type, SLAPD_INTEGER_SYNTAX ) )
 540                 {
 541                         /*
 542                          * attribute values must be INTEGER or REAL
 543                          */
 544                         snprintf( textbuf, textlen,
 545                                 "%s: attribute syntax inappropriate for increment",
 546                                 ml->sml_type.bv_val );
 547                         *text = textbuf;
 548                         return LDAP_CONSTRAINT_VIOLATION;
 549                 }
 550
 551                 /*
 552                  * check values
 553                  */
 554                 if( ml->sml_values != NULL ) {
 555                         ber_len_t nvals;
 556                         slap_syntax_validate_func *validate =
 557                                 ad->ad_type->sat_syntax->ssyn_validate;
 558                         slap_syntax_transform_func *pretty =
 559                                 ad->ad_type->sat_syntax->ssyn_pretty;
 560
 561                         if( !pretty && !validate ) {
 562                                 *text = "no validator for syntax";
 563                                 snprintf( textbuf, textlen,
 564                                         "%s: no validator for syntax %s",
 565                                         ml->sml_type.bv_val,
 566                                         ad->ad_type->sat_syntax->ssyn_oid );
 567                                 *text = textbuf;
 568                                 return LDAP_INVALID_SYNTAX;
 569                         }
 570
 571                         /*
 572                          * check that each value is valid per syntax
 573                          *      and pretty if appropriate
 574                          */
 575                         for ( nvals = 0; !BER_BVISNULL( &ml->sml_values[nvals] ); nvals++ ) {
 576                                 struct berval pval;
 577
 578                                 if ( pretty ) {
 579                                         rc = ordered_value_pretty( ad,
 580                                                 &ml->sml_values[nvals], &pval, ctx );
 581                                 } else {
 582                                         rc = ordered_value_validate( ad,
 583                                                 &ml->sml_values[nvals], ml->sml_op );
 584                                 }
 585
 586                                 if( rc != 0 ) {
 587                                         snprintf( textbuf, textlen,
 588                                                 "%s: value #%ld invalid per syntax",
 589                                                 ml->sml_type.bv_val, (long) nvals );
 590                                         *text = textbuf;
 591                                         return LDAP_INVALID_SYNTAX;
 592                                 }
 593
 594                                 if( pretty ) {
 595                                         ber_memfree_x( ml->sml_values[nvals].bv_val, ctx );
 596                                         ml->sml_values[nvals] = pval;
 597                                 }
 598                         }
 599                         ml->sml_values[nvals].bv_len = 0;
 600                         ml->sml_numvals = nvals;
 601
 602                         /*
 603                          * a rough single value check... an additional check is needed
 604                          * to catch add of single value to existing single valued attribute
 605                          */
 606                         if ((ml->sml_op == LDAP_MOD_ADD || ml->sml_op == LDAP_MOD_REPLACE)
 607                                 && nvals > 1 && is_at_single_value( ad->ad_type ))
 608                         {
 609                                 snprintf( textbuf, textlen,
 610                                         "%s: multiple values provided",
 611                                         ml->sml_type.bv_val );
 612                                 *text = textbuf;
 613                                 return LDAP_CONSTRAINT_VIOLATION;
 614                         }
 615
 616                         /* if the type has a normalizer, generate the
 617                          * normalized values. otherwise leave them NULL.
 618                          *
 619                          * this is different from the rule for attributes
 620                          * in an entry - in an attribute list, the normalized
 621                          * value is set equal to the non-normalized value
 622                          * when there is no normalizer.
 623                          */
 624                         if( nvals && ad->ad_type->sat_equality &&
 625                                 ad->ad_type->sat_equality->smr_normalize )
 626                         {
 627                                 ml->sml_nvalues = ber_memalloc_x(
 628                                         (nvals+1)*sizeof(struct berval), ctx );
 629
 630                                 for ( nvals = 0; !BER_BVISNULL( &ml->sml_values[nvals] ); nvals++ ) {
 631                                         rc = ordered_value_normalize(
 632                                                 SLAP_MR_VALUE_OF_ATTRIBUTE_SYNTAX,
 633                                                 ad,
 634                                                 ad->ad_type->sat_equality,
 635                                                 &ml->sml_values[nvals], &ml->sml_nvalues[nvals], ctx );
 636                                         if ( rc ) {
 637                                                 Debug( LDAP_DEBUG_ANY,
 638                                                         "<= str2entry NULL (ssyn_normalize %d)\n",
 639                                                         rc, 0, 0 );
 640                                                 snprintf( textbuf, textlen,
 641                                                         "%s: value #%ld normalization failed",
 642                                                         ml->sml_type.bv_val, (long) nvals );
 643                                                 *text = textbuf;
 644                                                 BER_BVZERO( &ml->sml_nvalues[nvals] );
 645                                                 return rc;
 646                                         }
 647                                 }
 648
 649                                 BER_BVZERO( &ml->sml_nvalues[nvals] );
 650                         }
 651
 652                         /* check for duplicates, but ignore Deletes.
 653                          */
 654                         if( nvals > 1 && ml->sml_op != LDAP_MOD_DELETE ) {
 655                                 int i;
 656                                 rc = slap_sort_vals( ml, text, &i, ctx );
 657                                 if ( rc == LDAP_TYPE_OR_VALUE_EXISTS ) {
 658                                         /* value exists already */
 659                                         snprintf( textbuf, textlen,
 660                                                 "%s: value #%d provided more than once",
 661                                                 ml->sml_desc->ad_cname.bv_val, i );
 662                                         *text = textbuf;
 663                                 }
 664                                 if ( rc )
 665                                         return rc;
 666                         }
 667                 } else {
 668                         ml->sml_numvals = 0;
 669                 }
 670         }
 671
 672         return LDAP_SUCCESS;
 673 }
 674
 675 /* Sort a set of values. An (Attribute *) may be used interchangeably here
 676  * instead of a (Modifications *) structure.
 677  *
 678  * Uses Quicksort + Insertion sort for small arrays
 679  */
 680
 681 int
 682 slap_sort_vals(
 683         Modifications *ml,
 684         const char **text,
 685         int *dup,
 686         void *ctx )
 687 {
 688         AttributeDescription *ad;
 689         MatchingRule *mr;
 690         int istack[sizeof(int)*16];
 691         int i, j, k, l, ir, jstack, match, *ix, itmp, nvals, rc = LDAP_SUCCESS;
 692         int is_norm;
 693         struct berval a, *cv;
 694
 695 #define SMALL   8
 696 #define SWAP(a,b,tmp)   tmp=(a);(a)=(b);(b)=tmp
 697 #define COMP(a,b)       match=0; rc = ordered_value_match( &match, \
 698                                                 ad, mr, SLAP_MR_EQUALITY \
 699                                                                 | SLAP_MR_VALUE_OF_ASSERTION_SYNTAX \
 700                                                                 | SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH \
 701                                                                 | SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH, \
 702                                                                 &(a), &(b), text );
 703
 704 #define IX(x)   ix[x]
 705 #define EXCH(x,y)       SWAP(ix[x],ix[y],itmp)
 706 #define SETA(x) itmp = ix[x]; a = cv[itmp]
 707 #define GETA(x) ix[x] = itmp;
 708 #define SET(x,y)        ix[x] = ix[y]
 709
 710         ad = ml->sml_desc;
 711         nvals = ml->sml_numvals;
 712         if ( nvals <= 1 )
 713                 goto ret;
 714
 715         /* For Modifications, sml_nvalues is NULL if normalization wasn't needed.
 716          * For Attributes, sml_nvalues == sml_values when normalization isn't needed.
 717          */
 718         if ( ml->sml_nvalues && ml->sml_nvalues != ml->sml_values ) {
 719                 cv = ml->sml_nvalues;
 720                 is_norm = 1;
 721         } else {
 722                 cv = ml->sml_values;
 723                 is_norm = 0;
 724         }
 725
 726         if ( ad == slap_schema.si_ad_objectClass )
 727                 mr = NULL;      /* shortcut matching */
 728         else
 729                 mr = ad->ad_type->sat_equality;
 730
 731         /* record indices to preserve input ordering */
 732         ix = slap_sl_malloc( nvals * sizeof(int), ctx );
 733         for (i=0; i<nvals; i++) ix[i] = i;
 734
 735         ir = nvals-1;
 736         l = 0;
 737         jstack = 0;
 738
 739         for(;;) {
 740                 if (ir - l < SMALL) {   /* Insertion sort */
 741                         match=1;
 742                         for (j=l+1;j<=ir;j++) {
 743                                 SETA(j);
 744                                 for (i=j-1;i>=0;i--) {
 745                                         COMP(cv[IX(i)], a);
 746                                         if ( match <= 0 )
 747                                                 break;
 748                                         SET(i+1,i);
 749                                 }
 750                                 GETA(i+1);
 751                                 if ( match == 0 ) goto done;
 752                         }
 753                         if ( jstack == 0 ) break;
 754                         ir = istack[jstack--];
 755                         l = istack[jstack--];
 756                 } else {
 757                         k = (l + ir) >> 1;      /* Choose median of left, center, right */
 758                         EXCH(k, l+1);
 759                         COMP( cv[IX(l)], cv[IX(ir)] );
 760                         if ( match > 0 ) {
 761                                 EXCH(l, ir);
 762                         } else if ( match == 0 ) {
 763                                 i = ir;
 764                                 break;
 765                         }
 766                         COMP( cv[IX(l+1)], cv[IX(ir)] );
 767                         if ( match > 0 ) {
 768                                 EXCH(l+1, ir);
 769                         } else if ( match == 0 ) {
 770                                 i = ir;
 771                                 break;
 772                         }
 773                         COMP( cv[IX(l)], cv[IX(l+1)] );
 774                         if ( match > 0 ) {
 775                                 EXCH(l, l+1);
 776                         } else if ( match == 0 ) {
 777                                 i = l;
 778                                 break;
 779                         }
 780                         i = l+1;
 781                         j = ir;
 782                         a = cv[IX(i)];
 783                         for(;;) {
 784                                 do {
 785                                         i++;
 786                                         COMP( cv[IX(i)], a );
 787                                 } while( match < 0 );
 788                                 while( match > 0 ) {
 789                                         j--;
 790                                         COMP( cv[IX(j)], a );
 791                                 }
 792                                 if (j < i) {
 793                                         match = 1;
 794                                         break;
 795                                 }
 796                                 if ( match == 0 ) {
 797                                         i = l+1;
 798                                         break;
 799                                 }
 800                                 EXCH(i,j);
 801                         }
 802                         if ( match == 0 )
 803                                 break;
 804                         EXCH(l+1,j);
 805                         jstack += 2;
 806                         if (ir-i+1 > j-l) {
 807                                 istack[jstack] = ir;
 808                                 istack[jstack-1] = i;
 809                                 ir = j;
 810                         } else {
 811                                 istack[jstack] = j;
 812                                 istack[jstack-1] = l;
 813                                 l = i;
 814                         }
 815                 }
 816         }
 817         done:
 818         if ( match == 0 && i >= 0 )
 819                 *dup = ix[i];
 820
 821         /* For sorted attributes, put the values in index order */
 822         if ( rc == LDAP_SUCCESS && match &&
 823                 ( ad->ad_type->sat_flags & SLAP_AT_SORTED_VAL )) {
 824                 BerVarray tmpv = slap_sl_malloc( sizeof( struct berval ) * nvals, ctx );
 825                 for ( i = 0; i<nvals; i++ )
 826                         tmpv[i] = cv[ix[i]];
 827                 for ( i = 0; i<nvals; i++ )
 828                         cv[i] = tmpv[i];
 829                 /* Check if the non-normalized array needs to move too */
 830                 if ( is_norm ) {
 831                         cv = ml->sml_values;
 832                         for ( i = 0; i<nvals; i++ )
 833                                 tmpv[i] = cv[ix[i]];
 834                         for ( i = 0; i<nvals; i++ )
 835                                 cv[i] = tmpv[i];
 836                 }
 837                 slap_sl_free( tmpv, ctx );
 838         }
 839
 840         slap_sl_free( ix, ctx );
 841
 842         if ( rc == LDAP_SUCCESS && match == 0 ) {
 843                 /* value exists already */
 844                 assert( i >= 0 );
 845                 assert( i < nvals );
 846                 rc = LDAP_TYPE_OR_VALUE_EXISTS;
 847         }
 848  ret:
 849         return rc;
 850 }
 851
 852 /* Enter with bv->bv_len = sizeof buffer, returns with
 853  * actual length of string
 854  */
 855 void slap_timestamp( time_t *tm, struct berval *bv )
 856 {
 857         struct tm ltm;
 858
 859         ldap_pvt_gmtime( tm, &ltm );
 860
 861         bv->bv_len = lutil_gentime( bv->bv_val, bv->bv_len, &ltm );
 862 }
 863
 864 /* Called for all modify and modrdn ops. If the current op was replicated
 865  * from elsewhere, all of the attrs should already be present.
 866  */
 867 void slap_mods_opattrs(
 868         Operation *op,
 869         Modifications **modsp,
 870         int manage_ctxcsn )
 871 {
 872         struct berval name, timestamp, csn = BER_BVNULL;
 873         struct berval nname;
 874         char timebuf[ LDAP_LUTIL_GENTIME_BUFSIZE ];
 875         char csnbuf[ LDAP_PVT_CSNSTR_BUFSIZE ];
 876         Modifications *mod, **modtail, *modlast;
 877         int gotcsn = 0, gotmname = 0, gotmtime = 0;
 878
 879         if ( SLAP_LASTMOD( op->o_bd ) && !op->orm_no_opattrs ) {
 880                 char *ptr;
 881                 timestamp.bv_val = timebuf;
 882                 for ( modtail = modsp; *modtail; modtail = &(*modtail)->sml_next ) {
 883                         if ( (*modtail)->sml_op != LDAP_MOD_ADD &&
 884                                 (*modtail)->sml_op != SLAP_MOD_SOFTADD &&
 885                                 (*modtail)->sml_op != SLAP_MOD_ADD_IF_NOT_PRESENT &&
 886                                 (*modtail)->sml_op != LDAP_MOD_REPLACE )
 887                         {
 888                                 continue;
 889                         }
 890
 891                         if ( (*modtail)->sml_desc == slap_schema.si_ad_entryCSN )
 892                         {
 893                                 csn = (*modtail)->sml_values[0];
 894                                 gotcsn = 1;
 895
 896                         } else if ( (*modtail)->sml_desc == slap_schema.si_ad_modifiersName )
 897                         {
 898                                 gotmname = 1;
 899
 900                         } else if ( (*modtail)->sml_desc == slap_schema.si_ad_modifyTimestamp )
 901                         {
 902                                 gotmtime = 1;
 903                         }
 904                 }
 905
 906                 if ( BER_BVISEMPTY( &op->o_csn )) {
 907                         if ( !gotcsn ) {
 908                                 csn.bv_val = csnbuf;
 909                                 csn.bv_len = sizeof( csnbuf );
 910                                 slap_get_csn( op, &csn, manage_ctxcsn );
 911
 912                         } else {
 913                                 if ( manage_ctxcsn ) {
 914                                         slap_queue_csn( op, &csn );
 915                                 }
 916                         }
 917
 918                 } else {
 919                         csn = op->o_csn;
 920                 }
 921
 922                 ptr = ber_bvchr( &csn, '#' );
 923                 if ( ptr ) {
 924                         timestamp.bv_len = STRLENOF("YYYYMMDDHHMMSSZ");
 925                         AC_MEMCPY( timebuf, csn.bv_val, timestamp.bv_len );
 926                         timebuf[timestamp.bv_len-1] = 'Z';
 927                         timebuf[timestamp.bv_len] = '\0';
 928
 929                 } else {
 930                         time_t now = slap_get_time();
 931
 932                         timestamp.bv_len = sizeof(timebuf);
 933
 934                         slap_timestamp( &now, &timestamp );
 935                 }
 936
 937                 if ( BER_BVISEMPTY( &op->o_dn ) ) {
 938                         BER_BVSTR( &name, SLAPD_ANONYMOUS );
 939                         nname = name;
 940
 941                 } else {
 942                         name = op->o_dn;
 943                         nname = op->o_ndn;
 944                 }
 945
 946                 if ( !gotcsn ) {
 947                         mod = (Modifications *) ch_malloc( sizeof( Modifications ) );
 948                         mod->sml_op = LDAP_MOD_REPLACE;
 949                         mod->sml_flags = SLAP_MOD_INTERNAL;
 950                         mod->sml_next = NULL;
 951                         BER_BVZERO( &mod->sml_type );
 952                         mod->sml_desc = slap_schema.si_ad_entryCSN;
 953                         mod->sml_numvals = 1;
 954                         mod->sml_values = (BerVarray) ch_malloc( 2 * sizeof( struct berval ) );
 955                         ber_dupbv( &mod->sml_values[0], &csn );
 956                         BER_BVZERO( &mod->sml_values[1] );
 957                         assert( !BER_BVISNULL( &mod->sml_values[0] ) );
 958                         mod->sml_nvalues = NULL;
 959                         *modtail = mod;
 960                         modlast = mod;
 961                         modtail = &mod->sml_next;
 962                 }
 963
 964                 if ( !gotmname ) {
 965                         mod = (Modifications *) ch_malloc( sizeof( Modifications ) );
 966                         mod->sml_op = LDAP_MOD_REPLACE;
 967                         mod->sml_flags = SLAP_MOD_INTERNAL;
 968                         mod->sml_next = NULL;
 969                         BER_BVZERO( &mod->sml_type );
 970                         mod->sml_desc = slap_schema.si_ad_modifiersName;
 971                         mod->sml_numvals = 1;
 972                         mod->sml_values = (BerVarray) ch_malloc( 2 * sizeof( struct berval ) );
 973                         ber_dupbv( &mod->sml_values[0], &name );
 974                         BER_BVZERO( &mod->sml_values[1] );
 975                         assert( !BER_BVISNULL( &mod->sml_values[0] ) );
 976                         mod->sml_nvalues =
 977                                 (BerVarray) ch_malloc( 2 * sizeof( struct berval ) );
 978                         ber_dupbv( &mod->sml_nvalues[0], &nname );
 979                         BER_BVZERO( &mod->sml_nvalues[1] );
 980                         assert( !BER_BVISNULL( &mod->sml_nvalues[0] ) );
 981                         *modtail = mod;
 982                         modtail = &mod->sml_next;
 983                 }
 984
 985                 if ( !gotmtime ) {
 986                         mod = (Modifications *) ch_malloc( sizeof( Modifications ) );
 987                         mod->sml_op = LDAP_MOD_REPLACE;
 988                         mod->sml_flags = SLAP_MOD_INTERNAL;
 989                         mod->sml_next = NULL;
 990                         BER_BVZERO( &mod->sml_type );
 991                         mod->sml_desc = slap_schema.si_ad_modifyTimestamp;
 992                         mod->sml_numvals = 1;
 993                         mod->sml_values = (BerVarray) ch_malloc( 2 * sizeof( struct berval ) );
 994                         ber_dupbv( &mod->sml_values[0], &timestamp );
 995                         BER_BVZERO( &mod->sml_values[1] );
 996                         assert( !BER_BVISNULL( &mod->sml_values[0] ) );
 997                         mod->sml_nvalues = NULL;
 998                         *modtail = mod;
 999                         modtail = &mod->sml_next;
1000                 }
1001         }
1002 }
1003
1004 int
1005 slap_parse_modlist(
1006         Operation *op,
1007         SlapReply *rs,
1008         BerElement *ber,
1009         req_modify_s *ms )
1010 {
1011         ber_tag_t       tag;
1012         ber_len_t       len;
1013         char            *last;
1014         Modifications   **modtail = &ms->rs_mods.rs_modlist;
1015
1016         ms->rs_mods.rs_modlist = NULL;
1017         ms->rs_increment = 0;
1018
1019         rs->sr_err = LDAP_SUCCESS;
1020
1021         /* collect modifications & save for later */
1022         for ( tag = ber_first_element( ber, &len, &last );
1023                 tag != LBER_DEFAULT;
1024                 tag = ber_next_element( ber, &len, last ) )
1025         {
1026                 ber_int_t mop;
1027                 Modifications tmp, *mod;
1028
1029                 tmp.sml_nvalues = NULL;
1030
1031                 if ( ber_scanf( ber, "{e{m[W]}}", &mop,
1032                     &tmp.sml_type, &tmp.sml_values ) == LBER_ERROR )
1033                 {
1034                         rs->sr_text = "decoding modlist error";
1035                         rs->sr_err = LDAP_PROTOCOL_ERROR;
1036                         goto done;
1037                 }
1038
1039                 mod = (Modifications *) ch_malloc( sizeof(Modifications) );
1040                 mod->sml_op = mop;
1041                 mod->sml_flags = 0;
1042                 mod->sml_type = tmp.sml_type;
1043                 mod->sml_values = tmp.sml_values;
1044                 mod->sml_nvalues = NULL;
1045                 mod->sml_desc = NULL;
1046                 mod->sml_next = NULL;
1047                 *modtail = mod;
1048
1049                 switch( mop ) {
1050                 case LDAP_MOD_ADD:
1051                         if ( mod->sml_values == NULL ) {
1052                                 rs->sr_text = "modify/add operation requires values";
1053                                 rs->sr_err = LDAP_PROTOCOL_ERROR;
1054                                 goto done;
1055                         }
1056
1057                         /* fall through */
1058
1059                 case LDAP_MOD_DELETE:
1060                 case LDAP_MOD_REPLACE:
1061                         break;
1062
1063                 case LDAP_MOD_INCREMENT:
1064                         if( op->o_protocol >= LDAP_VERSION3 ) {
1065                                 ms->rs_increment++;
1066                                 if ( mod->sml_values == NULL ) {
1067                                         rs->sr_text = "modify/increment operation requires value";
1068                                         rs->sr_err = LDAP_PROTOCOL_ERROR;
1069                                         goto done;
1070                                 }
1071
1072                                 if ( !BER_BVISNULL( &mod->sml_values[ 1 ] ) ) {
1073                                         rs->sr_text = "modify/increment operation requires single value";
1074                                         rs->sr_err = LDAP_PROTOCOL_ERROR;
1075                                         goto done;
1076                                 }
1077
1078                                 break;
1079                         }
1080                         /* fall thru */
1081
1082                 default:
1083                         rs->sr_text = "unrecognized modify operation";
1084                         rs->sr_err = LDAP_PROTOCOL_ERROR;
1085                         goto done;
1086                 }
1087
1088                 modtail = &mod->sml_next;
1089         }
1090         *modtail = NULL;
1091
1092 done:
1093         if ( rs->sr_err != LDAP_SUCCESS ) {
1094                 slap_mods_free( ms->rs_mods.rs_modlist, 1 );
1095                 ms->rs_mods.rs_modlist = NULL;
1096                 ms->rs_increment = 0;
1097         }
1098
1099         return rs->sr_err;
1100 }
1101