1 /* schema_init.c - init builtin schema */
3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
5 * Copyright 1998-2013 The OpenLDAP Foundation.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted only as authorized by the OpenLDAP
12 * A copy of this license is available in the file LICENSE in the
13 * top-level directory of the distribution or, alternatively, at
14 * <http://www.OpenLDAP.org/license.html>.
18 * Syntaxes - implementation notes:
20 * Validate function(syntax, value):
21 * Called before the other functions here to check if the value
22 * is valid according to the syntax.
24 * Pretty function(syntax, input value, output prettified...):
25 * If it exists, maps different notations of the same value to a
26 * unique representation which can be stored in the directory and
27 * possibly be passed to the Match/Indexer/Filter() functions.
29 * E.g. DN "2.5.4.3 = foo\,bar, o = BAZ" -> "cn=foo\2Cbar,o=BAZ",
30 * but unlike DN normalization, "BAZ" is not mapped to "baz".
34 * Matching rules - implementation notes:
36 * Matching rules match an attribute value (often from the directory)
37 * against an asserted value (e.g. from a filter).
39 * Invoked with validated and commonly pretty/normalized arguments, thus
40 * a number of matching rules can simply use the octetString functions.
42 * Normalize function(...input value, output normalized...):
43 * If it exists, maps matching values to a unique representation
44 * which is passed to the Match/Indexer/Filter() functions.
46 * Different matching rules can normalize values of the same syntax
47 * differently. E.g. caseIgnore rules normalize to lowercase,
48 * caseExact rules do not.
50 * Match function(*output matchp, ...value, asserted value):
51 * On success, set *matchp. 0 means match. For ORDERING/most EQUALITY,
52 * less/greater than 0 means value less/greater than asserted. However:
54 * In extensible match filters, ORDERING rules match if value<asserted.
56 * EQUALITY rules may order values differently than ORDERING rules for
57 * speed, since EQUALITY ordering is only used for SLAP_AT_SORTED_VAL.
58 * Some EQUALITY rules do not order values (ITS#6722).
60 * Indexer function(...attribute values, *output keysp,...):
61 * Generates index keys for the attribute values. Backends can store
62 * them in an index, a {key->entry ID set} mapping, for the attribute.
64 * A search can look up the DN/scope and asserted values in the
65 * indexes, if any, to narrow down the number of entires to check
66 * against the search criteria.
68 * Filter function(...asserted value, *output keysp,...):
69 * Generates index key(s) for the asserted value, to be looked up in
70 * the index from the Indexer function. *keysp is an array because
71 * substring matching rules can generate multiple lookup keys.
74 * A key is usually a hash of match type, attribute value and schema
75 * info, because one index can contain keys for many filtering types.
77 * Some indexes instead have EQUALITY keys ordered so that if
78 * key(val1) < key(val2), then val1 < val2 by the ORDERING rule.
79 * That way the ORDERING rule can use the EQUALITY index.
82 * This chops the attribute values up in small chunks and indexes all
83 * possible chunks of certain sizes. Substring filtering looks up
84 * SOME of the asserted value's chunks, and the caller uses the
85 * intersection of the resulting entry ID sets.
86 * See the index_substr_* keywords in slapd.conf(5).
98 #include <ac/string.h>
99 #include <ac/socket.h>
102 #include "../../libraries/liblber/lber-int.h" /* get ber_ptrlen() */
104 #include "ldap_utf8.h"
107 #include "lutil_hash.h"
109 #ifdef LUTIL_HASH64_BYTES
110 #define HASH_BYTES LUTIL_HASH64_BYTES
111 #define HASH_LEN hashlen
112 static void (*hashinit)(lutil_HASH_CTX *ctx) = lutil_HASHInit;
113 static void (*hashupdate)(lutil_HASH_CTX *ctx,unsigned char const *buf, ber_len_t len) = lutil_HASHUpdate;
114 static void (*hashfinal)(unsigned char digest[HASH_BYTES], lutil_HASH_CTX *ctx) = lutil_HASHFinal;
115 static int hashlen = LUTIL_HASH_BYTES;
116 #define HASH_Init(c) hashinit(c)
117 #define HASH_Update(c,buf,len) hashupdate(c,buf,len)
118 #define HASH_Final(d,c) hashfinal(d,c)
120 /* Toggle between 32 and 64 bit hashing, default to 32 for compatibility
121 -1 to query, returns 1 if 64 bit, 0 if 32.
122 0/1 to set 32/64, returns 0 on success, -1 on failure */
123 int slap_hash64( int onoff )
126 return hashlen == LUTIL_HASH64_BYTES;
127 } else if ( onoff ) {
128 hashinit = lutil_HASH64Init;
129 hashupdate = lutil_HASH64Update;
130 hashfinal = lutil_HASH64Final;
131 hashlen = LUTIL_HASH64_BYTES;
133 hashinit = lutil_HASHInit;
134 hashupdate = lutil_HASHUpdate;
135 hashfinal = lutil_HASHFinal;
136 hashlen = LUTIL_HASH_BYTES;
142 #define HASH_BYTES LUTIL_HASH_BYTES
143 #define HASH_LEN HASH_BYTES
144 #define HASH_Init(c) lutil_HASHInit(c)
145 #define HASH_Update(c,buf,len) lutil_HASHUpdate(c,buf,len)
146 #define HASH_Final(d,c) lutil_HASHFinal(d,c)
148 int slap_has64( int onoff )
153 return onoff ? -1 : 0;
157 #define HASH_CONTEXT lutil_HASH_CTX
159 /* approx matching rules */
160 #define directoryStringApproxMatchOID "1.3.6.1.4.1.4203.666.4.4"
161 #define directoryStringApproxMatch approxMatch
162 #define directoryStringApproxIndexer approxIndexer
163 #define directoryStringApproxFilter approxFilter
164 #define IA5StringApproxMatchOID "1.3.6.1.4.1.4203.666.4.5"
165 #define IA5StringApproxMatch approxMatch
166 #define IA5StringApproxIndexer approxIndexer
167 #define IA5StringApproxFilter approxFilter
169 /* Change Sequence Number (CSN) - much of this will change */
170 #define csnMatch octetStringMatch
171 #define csnOrderingMatch octetStringOrderingMatch
172 #define csnIndexer generalizedTimeIndexer
173 #define csnFilter generalizedTimeFilter
175 #define authzMatch octetStringMatch
177 /* X.509 PMI ldapSyntaxes */
178 /* FIXME: need to create temporary OIDs under OpenLDAP's arc;
179 * these are currently hijacked
181 * 1.3.6.1.4.1.4203.666 OpenLDAP
182 * 1.3.6.1.4.1.4203.666.11 self-contained works
183 * 1.3.6.1.4.1.4203.666.11.10 X.509 PMI
184 * 1.3.6.1.4.1.4203.666.11.10.2 X.509 PMI ldapSyntaxes
185 * 1.3.6.1.4.1.4203.666.11.10.2.1 AttributeCertificate (supported)
186 * 1.3.6.1.4.1.4203.666.11.10.2.2 AttributeCertificateExactAssertion (supported)
187 * 1.3.6.1.4.1.4203.666.11.10.2.3 AttributeCertificateAssertion (not supported)
188 * 1.3.6.1.4.1.4203.666.11.10.2.4 AttCertPath (X-SUBST'ed right now in pmi.schema)
189 * 1.3.6.1.4.1.4203.666.11.10.2.5 PolicySyntax (X-SUBST'ed right now in pmi.schema)
190 * 1.3.6.1.4.1.4203.666.11.10.2.6 RoleSyntax (X-SUBST'ed right now in pmi.schema)
192 #if 0 /* from <draft-ietf-pkix-ldap-schema-02.txt> (expired) */
193 #define attributeCertificateSyntaxOID "1.2.826.0.1.3344810.7.5"
194 #define attributeCertificateExactAssertionSyntaxOID "1.2.826.0.1.3344810.7.6"
195 #define attributeCertificateAssertionSyntaxOID "1.2.826.0.1.3344810.7.7"
196 #else /* from OpenLDAP's experimental oid arc */
197 #define X509_PMI_SyntaxOID "1.3.6.1.4.1.4203.666.11.10.2"
198 #define attributeCertificateSyntaxOID X509_PMI_SyntaxOID ".1"
199 #define attributeCertificateExactAssertionSyntaxOID X509_PMI_SyntaxOID ".2"
200 #define attributeCertificateAssertionSyntaxOID X509_PMI_SyntaxOID ".3"
203 unsigned int index_substr_if_minlen = SLAP_INDEX_SUBSTR_IF_MINLEN_DEFAULT;
204 unsigned int index_substr_if_maxlen = SLAP_INDEX_SUBSTR_IF_MAXLEN_DEFAULT;
205 unsigned int index_substr_any_len = SLAP_INDEX_SUBSTR_ANY_LEN_DEFAULT;
206 unsigned int index_substr_any_step = SLAP_INDEX_SUBSTR_ANY_STEP_DEFAULT;
208 unsigned int index_intlen = SLAP_INDEX_INTLEN_DEFAULT;
209 unsigned int index_intlen_strlen = SLAP_INDEX_INTLEN_STRLEN(
210 SLAP_INDEX_INTLEN_DEFAULT );
212 ldap_pvt_thread_mutex_t ad_index_mutex;
213 ldap_pvt_thread_mutex_t ad_undef_mutex;
214 ldap_pvt_thread_mutex_t oc_undef_mutex;
217 generalizedTimeValidate(
221 #ifdef SUPPORT_OBSOLETE_UTC_SYNTAX
226 #endif /* SUPPORT_OBSOLETE_UTC_SYNTAX */
233 /* no value allowed */
234 return LDAP_INVALID_SYNTAX;
242 /* any value allowed */
246 #define berValidate blobValidate
253 if ( in->bv_len < 2 ) return LDAP_INVALID_SYNTAX;
254 if ( in->bv_val[0] != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
259 /* X.509 related stuff */
268 SLAP_TAG_UTCTIME = 0x17U,
269 SLAP_TAG_GENERALIZEDTIME = 0x18U
273 #define SLAP_X509_OPTION (LBER_CLASS_CONTEXT|LBER_CONSTRUCTED)
276 SLAP_X509_OPT_C_VERSION = SLAP_X509_OPTION + 0,
277 SLAP_X509_OPT_C_ISSUERUNIQUEID = LBER_CLASS_CONTEXT + 1,
278 SLAP_X509_OPT_C_SUBJECTUNIQUEID = LBER_CLASS_CONTEXT + 2,
279 SLAP_X509_OPT_C_EXTENSIONS = SLAP_X509_OPTION + 3
283 SLAP_X509_OPT_CL_CRLEXTENSIONS = SLAP_X509_OPTION + 0
287 GeneralName ::= CHOICE {
288 otherName [0] INSTANCE OF OTHER-NAME,
289 rfc822Name [1] IA5String,
290 dNSName [2] IA5String,
291 x400Address [3] ORAddress,
292 directoryName [4] Name,
293 ediPartyName [5] EDIPartyName,
294 uniformResourceIdentifier [6] IA5String,
295 iPAddress [7] OCTET STRING,
296 registeredID [8] OBJECT IDENTIFIER }
299 SLAP_X509_GN_OTHERNAME = SLAP_X509_OPTION + 0,
300 SLAP_X509_GN_RFC822NAME = SLAP_X509_OPTION + 1,
301 SLAP_X509_GN_DNSNAME = SLAP_X509_OPTION + 2,
302 SLAP_X509_GN_X400ADDRESS = SLAP_X509_OPTION + 3,
303 SLAP_X509_GN_DIRECTORYNAME = SLAP_X509_OPTION + 4,
304 SLAP_X509_GN_EDIPARTYNAME = SLAP_X509_OPTION + 5,
305 SLAP_X509_GN_URI = SLAP_X509_OPTION + 6,
306 SLAP_X509_GN_IPADDRESS = SLAP_X509_OPTION + 7,
307 SLAP_X509_GN_REGISTEREDID = SLAP_X509_OPTION + 8
310 /* X.509 PMI related stuff */
317 SLAP_X509AC_ISSUER = SLAP_X509_OPTION + 0
320 /* X.509 certificate validation */
322 certificateValidate( Syntax *syntax, struct berval *in )
324 BerElementBuffer berbuf;
325 BerElement *ber = (BerElement *)&berbuf;
328 ber_int_t version = SLAP_X509_V1;
330 ber_init2( ber, in, LBER_USE_DER );
331 tag = ber_skip_tag( ber, &len ); /* Signed wrapper */
332 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
333 tag = ber_skip_tag( ber, &len ); /* Sequence */
334 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
335 tag = ber_peek_tag( ber, &len );
336 /* Optional version */
337 if ( tag == SLAP_X509_OPT_C_VERSION ) {
338 tag = ber_skip_tag( ber, &len );
339 tag = ber_get_int( ber, &version );
340 if ( tag != LBER_INTEGER ) return LDAP_INVALID_SYNTAX;
342 /* NOTE: don't try to parse Serial, because it might be longer
343 * than sizeof(ber_int_t); deferred to certificateExactNormalize() */
344 tag = ber_skip_tag( ber, &len ); /* Serial */
345 if ( tag != LBER_INTEGER ) return LDAP_INVALID_SYNTAX;
346 ber_skip_data( ber, len );
347 tag = ber_skip_tag( ber, &len ); /* Signature Algorithm */
348 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
349 ber_skip_data( ber, len );
350 tag = ber_skip_tag( ber, &len ); /* Issuer DN */
351 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
352 ber_skip_data( ber, len );
353 tag = ber_skip_tag( ber, &len ); /* Validity */
354 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
355 ber_skip_data( ber, len );
356 tag = ber_skip_tag( ber, &len ); /* Subject DN */
357 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
358 ber_skip_data( ber, len );
359 tag = ber_skip_tag( ber, &len ); /* Subject PublicKeyInfo */
360 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
361 ber_skip_data( ber, len );
362 tag = ber_skip_tag( ber, &len );
363 if ( tag == SLAP_X509_OPT_C_ISSUERUNIQUEID ) { /* issuerUniqueID */
364 if ( version < SLAP_X509_V2 ) return LDAP_INVALID_SYNTAX;
365 ber_skip_data( ber, len );
366 tag = ber_skip_tag( ber, &len );
368 if ( tag == SLAP_X509_OPT_C_SUBJECTUNIQUEID ) { /* subjectUniqueID */
369 if ( version < SLAP_X509_V2 ) return LDAP_INVALID_SYNTAX;
370 ber_skip_data( ber, len );
371 tag = ber_skip_tag( ber, &len );
373 if ( tag == SLAP_X509_OPT_C_EXTENSIONS ) { /* Extensions */
374 if ( version < SLAP_X509_V3 ) return LDAP_INVALID_SYNTAX;
375 tag = ber_skip_tag( ber, &len );
376 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
377 ber_skip_data( ber, len );
378 tag = ber_skip_tag( ber, &len );
380 /* signatureAlgorithm */
381 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
382 ber_skip_data( ber, len );
383 tag = ber_skip_tag( ber, &len );
385 if ( tag != LBER_BITSTRING ) return LDAP_INVALID_SYNTAX;
386 ber_skip_data( ber, len );
387 tag = ber_skip_tag( ber, &len );
388 /* Must be at end now */
389 if ( len || tag != LBER_DEFAULT ) return LDAP_INVALID_SYNTAX;
393 /* X.509 certificate list validation */
395 checkTime( struct berval *in, struct berval *out );
398 certificateListValidate( Syntax *syntax, struct berval *in )
400 BerElementBuffer berbuf;
401 BerElement *ber = (BerElement *)&berbuf;
403 ber_len_t len, wrapper_len;
406 ber_int_t version = SLAP_X509_V1;
407 struct berval bvdn, bvtu;
409 ber_init2( ber, in, LBER_USE_DER );
410 tag = ber_skip_tag( ber, &wrapper_len ); /* Signed wrapper */
411 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
412 wrapper_start = ber->ber_ptr;
413 tag = ber_skip_tag( ber, &len ); /* Sequence */
414 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
415 tag = ber_peek_tag( ber, &len );
416 /* Optional version */
417 if ( tag == LBER_INTEGER ) {
418 tag = ber_get_int( ber, &version );
419 assert( tag == LBER_INTEGER );
420 if ( version != SLAP_X509_V2 ) return LDAP_INVALID_SYNTAX;
422 tag = ber_skip_tag( ber, &len ); /* Signature Algorithm */
423 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
424 ber_skip_data( ber, len );
425 tag = ber_peek_tag( ber, &len ); /* Issuer DN */
426 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
427 len = ber_ptrlen( ber );
428 bvdn.bv_val = in->bv_val + len;
429 bvdn.bv_len = in->bv_len - len;
430 tag = ber_skip_tag( ber, &len );
431 ber_skip_data( ber, len );
432 tag = ber_skip_tag( ber, &len ); /* thisUpdate */
433 /* Time is a CHOICE { UTCTime, GeneralizedTime } */
434 if ( tag != SLAP_TAG_UTCTIME && tag != SLAP_TAG_GENERALIZEDTIME ) return LDAP_INVALID_SYNTAX;
435 bvtu.bv_val = (char *)ber->ber_ptr;
437 ber_skip_data( ber, len );
438 /* Optional nextUpdate */
439 tag = ber_skip_tag( ber, &len );
440 if ( tag == SLAP_TAG_UTCTIME || tag == SLAP_TAG_GENERALIZEDTIME ) {
441 ber_skip_data( ber, len );
442 tag = ber_skip_tag( ber, &len );
444 /* revokedCertificates - Sequence of Sequence, Optional */
445 if ( tag == LBER_SEQUENCE ) {
448 stag = ber_peek_tag( ber, &seqlen );
449 if ( stag == LBER_SEQUENCE || !len ) {
450 /* RFC5280 requires non-empty, but X.509(2005) allows empty. */
452 ber_skip_data( ber, len );
453 tag = ber_skip_tag( ber, &len );
456 /* Optional Extensions - Sequence of Sequence */
457 if ( tag == SLAP_X509_OPT_CL_CRLEXTENSIONS ) { /* ? */
459 if ( version != SLAP_X509_V2 ) return LDAP_INVALID_SYNTAX;
460 tag = ber_peek_tag( ber, &seqlen );
461 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
462 ber_skip_data( ber, len );
463 tag = ber_skip_tag( ber, &len );
465 /* signatureAlgorithm */
466 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
467 ber_skip_data( ber, len );
468 tag = ber_skip_tag( ber, &len );
470 if ( tag != LBER_BITSTRING ) return LDAP_INVALID_SYNTAX;
471 ber_skip_data( ber, len );
472 if ( ber->ber_ptr == wrapper_start + wrapper_len ) wrapper_ok = 1;
473 tag = ber_skip_tag( ber, &len );
474 /* Must be at end now */
475 /* NOTE: OpenSSL tolerates CL with garbage past the end */
476 if ( len || tag != LBER_DEFAULT ) {
477 struct berval issuer_dn = BER_BVNULL, thisUpdate;
478 char tubuf[STRLENOF("YYYYmmddHHMMSSZ") + 1];
481 if ( ! wrapper_ok ) {
482 return LDAP_INVALID_SYNTAX;
485 rc = dnX509normalize( &bvdn, &issuer_dn );
486 if ( rc != LDAP_SUCCESS ) {
487 rc = LDAP_INVALID_SYNTAX;
491 thisUpdate.bv_val = tubuf;
492 thisUpdate.bv_len = sizeof(tubuf);
493 if ( checkTime( &bvtu, &thisUpdate ) ) {
494 rc = LDAP_INVALID_SYNTAX;
498 Debug( LDAP_DEBUG_ANY,
499 "certificateListValidate issuer=\"%s\", thisUpdate=%s: extra cruft past end of certificateList\n",
500 issuer_dn.bv_val, thisUpdate.bv_val, 0 );
503 if ( ! BER_BVISNULL( &issuer_dn ) ) {
504 ber_memfree( issuer_dn.bv_val );
513 /* X.509 PMI Attribute Certificate Validate */
515 attributeCertificateValidate( Syntax *syntax, struct berval *in )
517 BerElementBuffer berbuf;
518 BerElement *ber = (BerElement *)&berbuf;
524 ber_init2( ber, in, LBER_USE_DER );
526 tag = ber_skip_tag( ber, &len ); /* Signed wrapper */
527 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
529 tag = ber_skip_tag( ber, &len ); /* Sequence */
530 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
532 tag = ber_peek_tag( ber, &len ); /* Version */
533 if ( tag != LBER_INTEGER ) return LDAP_INVALID_SYNTAX;
534 tag = ber_get_int( ber, &version ); /* X.509 only allows v2 */
535 if ( version != SLAP_X509AC_V2 ) return LDAP_INVALID_SYNTAX;
537 tag = ber_skip_tag( ber, &len ); /* Holder */
538 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
539 ber_skip_data( ber, len );
541 tag = ber_skip_tag( ber, &len ); /* Issuer */
542 if ( tag != SLAP_X509AC_ISSUER ) return LDAP_INVALID_SYNTAX;
543 ber_skip_data( ber, len );
545 tag = ber_skip_tag( ber, &len ); /* Signature */
546 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
547 ber_skip_data( ber, len );
549 tag = ber_skip_tag( ber, &len ); /* Serial number */
550 if ( tag != LBER_INTEGER ) return LDAP_INVALID_SYNTAX;
551 ber_skip_data( ber, len );
553 tag = ber_skip_tag( ber, &len ); /* AttCertValidityPeriod */
554 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
555 ber_skip_data( ber, len );
557 tag = ber_skip_tag( ber, &len ); /* Attributes */
558 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
559 ber_skip_data( ber, len );
561 tag = ber_peek_tag( ber, &len );
563 if ( tag == LBER_BITSTRING ) { /* issuerUniqueID */
564 tag = ber_skip_tag( ber, &len );
565 ber_skip_data( ber, len );
566 tag = ber_peek_tag( ber, &len );
569 if ( tag == LBER_SEQUENCE ) { /* extensions or signatureAlgorithm */
570 tag = ber_skip_tag( ber, &len );
571 ber_skip_data( ber, len );
573 tag = ber_peek_tag( ber, &len );
576 if ( tag == LBER_SEQUENCE ) { /* signatureAlgorithm */
577 tag = ber_skip_tag( ber, &len );
578 ber_skip_data( ber, len );
580 tag = ber_peek_tag( ber, &len );
583 if ( tag == LBER_BITSTRING ) { /* Signature */
584 tag = ber_skip_tag( ber, &len );
585 ber_skip_data( ber, len );
587 tag = ber_peek_tag( ber, &len );
590 /* Must be at end now */
591 if ( len != 0 || tag != LBER_DEFAULT || cont < 2 ) return LDAP_INVALID_SYNTAX;
602 struct berval *value,
603 void *assertedValue )
605 struct berval *asserted = (struct berval *) assertedValue;
606 ber_slen_t d = (ber_slen_t) value->bv_len - (ber_slen_t) asserted->bv_len;
608 /* For speed, order first by length, then by contents */
609 *matchp = d ? (sizeof(d) == sizeof(int) ? d : d < 0 ? -1 : 1)
610 : memcmp( value->bv_val, asserted->bv_val, value->bv_len );
616 octetStringOrderingMatch(
621 struct berval *value,
622 void *assertedValue )
624 struct berval *asserted = (struct berval *) assertedValue;
625 ber_len_t v_len = value->bv_len;
626 ber_len_t av_len = asserted->bv_len;
628 int match = memcmp( value->bv_val, asserted->bv_val,
629 (v_len < av_len ? v_len : av_len) );
632 match = sizeof(v_len) == sizeof(int)
633 ? (int) v_len - (int) av_len
634 : v_len < av_len ? -1 : v_len > av_len;
636 /* If used in extensible match filter, match if value < asserted */
637 if ( flags & SLAP_MR_EXT )
638 match = (match >= 0);
644 /* Initialize HASHcontext from match type and schema info */
647 HASH_CONTEXT *HASHcontext,
648 struct berval *prefix,
653 HASH_Init(HASHcontext);
654 if(prefix && prefix->bv_len > 0) {
655 HASH_Update(HASHcontext,
656 (unsigned char *)prefix->bv_val, prefix->bv_len);
658 if(pre) HASH_Update(HASHcontext, (unsigned char*)&pre, sizeof(pre));
659 HASH_Update(HASHcontext, (unsigned char*)syntax->ssyn_oid, syntax->ssyn_oidlen);
660 HASH_Update(HASHcontext, (unsigned char*)mr->smr_oid, mr->smr_oidlen);
664 /* Set HASHdigest from HASHcontext and value:len */
667 HASH_CONTEXT *HASHcontext,
668 unsigned char *HASHdigest,
669 unsigned char *value,
672 HASH_CONTEXT ctx = *HASHcontext;
673 HASH_Update( &ctx, value, len );
674 HASH_Final( HASHdigest, &ctx );
677 /* Index generation function: Attribute values -> index hash keys */
678 int octetStringIndexer(
683 struct berval *prefix,
691 HASH_CONTEXT HASHcontext;
692 unsigned char HASHdigest[HASH_BYTES];
693 struct berval digest;
694 digest.bv_val = (char *)HASHdigest;
695 digest.bv_len = HASH_LEN;
697 for( i=0; !BER_BVISNULL( &values[i] ); i++ ) {
698 /* just count them */
701 /* we should have at least one value at this point */
704 keys = slap_sl_malloc( sizeof( struct berval ) * (i+1), ctx );
706 slen = syntax->ssyn_oidlen;
707 mlen = mr->smr_oidlen;
709 hashPreset( &HASHcontext, prefix, 0, syntax, mr);
710 for( i=0; !BER_BVISNULL( &values[i] ); i++ ) {
711 hashIter( &HASHcontext, HASHdigest,
712 (unsigned char *)values[i].bv_val, values[i].bv_len );
713 ber_dupbv_x( &keys[i], &digest, ctx );
716 BER_BVZERO( &keys[i] );
723 /* Index generation function: Asserted value -> index hash key */
724 int octetStringFilter(
729 struct berval *prefix,
730 void * assertedValue,
736 HASH_CONTEXT HASHcontext;
737 unsigned char HASHdigest[HASH_BYTES];
738 struct berval *value = (struct berval *) assertedValue;
739 struct berval digest;
740 digest.bv_val = (char *)HASHdigest;
741 digest.bv_len = HASH_LEN;
743 slen = syntax->ssyn_oidlen;
744 mlen = mr->smr_oidlen;
746 keys = slap_sl_malloc( sizeof( struct berval ) * 2, ctx );
748 hashPreset( &HASHcontext, prefix, 0, syntax, mr );
749 hashIter( &HASHcontext, HASHdigest,
750 (unsigned char *)value->bv_val, value->bv_len );
752 ber_dupbv_x( keys, &digest, ctx );
753 BER_BVZERO( &keys[1] );
761 octetStringSubstringsMatch(
766 struct berval *value,
767 void *assertedValue )
770 SubstringsAssertion *sub = assertedValue;
771 struct berval left = *value;
775 /* Add up asserted input length */
776 if ( !BER_BVISNULL( &sub->sa_initial ) ) {
777 inlen += sub->sa_initial.bv_len;
780 for ( i = 0; !BER_BVISNULL( &sub->sa_any[i] ); i++ ) {
781 inlen += sub->sa_any[i].bv_len;
784 if ( !BER_BVISNULL( &sub->sa_final ) ) {
785 inlen += sub->sa_final.bv_len;
788 if ( !BER_BVISNULL( &sub->sa_initial ) ) {
789 if ( inlen > left.bv_len ) {
794 match = memcmp( sub->sa_initial.bv_val, left.bv_val,
795 sub->sa_initial.bv_len );
801 left.bv_val += sub->sa_initial.bv_len;
802 left.bv_len -= sub->sa_initial.bv_len;
803 inlen -= sub->sa_initial.bv_len;
806 if ( !BER_BVISNULL( &sub->sa_final ) ) {
807 if ( inlen > left.bv_len ) {
812 match = memcmp( sub->sa_final.bv_val,
813 &left.bv_val[left.bv_len - sub->sa_final.bv_len],
814 sub->sa_final.bv_len );
820 left.bv_len -= sub->sa_final.bv_len;
821 inlen -= sub->sa_final.bv_len;
825 for ( i = 0; !BER_BVISNULL( &sub->sa_any[i] ); i++ ) {
830 if ( inlen > left.bv_len ) {
831 /* not enough length */
836 if ( BER_BVISEMPTY( &sub->sa_any[i] ) ) {
840 p = memchr( left.bv_val, *sub->sa_any[i].bv_val, left.bv_len );
847 idx = p - left.bv_val;
849 if ( idx >= left.bv_len ) {
850 /* this shouldn't happen */
857 if ( sub->sa_any[i].bv_len > left.bv_len ) {
858 /* not enough left */
863 match = memcmp( left.bv_val,
864 sub->sa_any[i].bv_val,
865 sub->sa_any[i].bv_len );
873 left.bv_val += sub->sa_any[i].bv_len;
874 left.bv_len -= sub->sa_any[i].bv_len;
875 inlen -= sub->sa_any[i].bv_len;
884 /* Substring index generation function: Attribute values -> index hash keys */
886 octetStringSubstringsIndexer(
891 struct berval *prefix,
900 HASH_CONTEXT HCany, HCini, HCfin;
901 unsigned char HASHdigest[HASH_BYTES];
902 struct berval digest;
903 digest.bv_val = (char *)HASHdigest;
904 digest.bv_len = HASH_LEN;
908 for ( i = 0; !BER_BVISNULL( &values[i] ); i++ ) {
909 /* count number of indices to generate */
910 if( flags & SLAP_INDEX_SUBSTR_INITIAL ) {
911 if( values[i].bv_len >= index_substr_if_maxlen ) {
912 nkeys += index_substr_if_maxlen -
913 (index_substr_if_minlen - 1);
914 } else if( values[i].bv_len >= index_substr_if_minlen ) {
915 nkeys += values[i].bv_len - (index_substr_if_minlen - 1);
919 if( flags & SLAP_INDEX_SUBSTR_ANY ) {
920 if( values[i].bv_len >= index_substr_any_len ) {
921 nkeys += values[i].bv_len - (index_substr_any_len - 1);
925 if( flags & SLAP_INDEX_SUBSTR_FINAL ) {
926 if( values[i].bv_len >= index_substr_if_maxlen ) {
927 nkeys += index_substr_if_maxlen -
928 (index_substr_if_minlen - 1);
929 } else if( values[i].bv_len >= index_substr_if_minlen ) {
930 nkeys += values[i].bv_len - (index_substr_if_minlen - 1);
936 /* no keys to generate */
941 keys = slap_sl_malloc( sizeof( struct berval ) * (nkeys+1), ctx );
943 slen = syntax->ssyn_oidlen;
944 mlen = mr->smr_oidlen;
946 if ( flags & SLAP_INDEX_SUBSTR_ANY )
947 hashPreset( &HCany, prefix, SLAP_INDEX_SUBSTR_PREFIX, syntax, mr );
948 if( flags & SLAP_INDEX_SUBSTR_INITIAL )
949 hashPreset( &HCini, prefix, SLAP_INDEX_SUBSTR_INITIAL_PREFIX, syntax, mr );
950 if( flags & SLAP_INDEX_SUBSTR_FINAL )
951 hashPreset( &HCfin, prefix, SLAP_INDEX_SUBSTR_FINAL_PREFIX, syntax, mr );
954 for ( i = 0; !BER_BVISNULL( &values[i] ); i++ ) {
957 if( ( flags & SLAP_INDEX_SUBSTR_ANY ) &&
958 ( values[i].bv_len >= index_substr_any_len ) )
960 max = values[i].bv_len - (index_substr_any_len - 1);
962 for( j=0; j<max; j++ ) {
963 hashIter( &HCany, HASHdigest,
964 (unsigned char *)&values[i].bv_val[j],
965 index_substr_any_len );
966 ber_dupbv_x( &keys[nkeys++], &digest, ctx );
970 /* skip if too short */
971 if( values[i].bv_len < index_substr_if_minlen ) continue;
973 max = index_substr_if_maxlen < values[i].bv_len
974 ? index_substr_if_maxlen : values[i].bv_len;
976 for( j=index_substr_if_minlen; j<=max; j++ ) {
978 if( flags & SLAP_INDEX_SUBSTR_INITIAL ) {
979 hashIter( &HCini, HASHdigest,
980 (unsigned char *)values[i].bv_val, j );
981 ber_dupbv_x( &keys[nkeys++], &digest, ctx );
984 if( flags & SLAP_INDEX_SUBSTR_FINAL ) {
985 hashIter( &HCfin, HASHdigest,
986 (unsigned char *)&values[i].bv_val[values[i].bv_len-j], j );
987 ber_dupbv_x( &keys[nkeys++], &digest, ctx );
994 BER_BVZERO( &keys[nkeys] );
1001 return LDAP_SUCCESS;
1004 /* Substring index generation function: Assertion value -> index hash keys */
1006 octetStringSubstringsFilter (
1011 struct berval *prefix,
1012 void * assertedValue,
1016 SubstringsAssertion *sa;
1018 ber_len_t nkeys = 0;
1019 size_t slen, mlen, klen;
1021 HASH_CONTEXT HASHcontext;
1022 unsigned char HASHdigest[HASH_BYTES];
1023 struct berval *value;
1024 struct berval digest;
1026 sa = (SubstringsAssertion *) assertedValue;
1028 if( flags & SLAP_INDEX_SUBSTR_INITIAL &&
1029 !BER_BVISNULL( &sa->sa_initial ) &&
1030 sa->sa_initial.bv_len >= index_substr_if_minlen )
1033 if ( sa->sa_initial.bv_len > index_substr_if_maxlen &&
1034 ( flags & SLAP_INDEX_SUBSTR_ANY ))
1036 nkeys += 1 + (sa->sa_initial.bv_len - index_substr_if_maxlen) / index_substr_any_step;
1040 if ( flags & SLAP_INDEX_SUBSTR_ANY && sa->sa_any != NULL ) {
1042 for( i=0; !BER_BVISNULL( &sa->sa_any[i] ); i++ ) {
1043 if( sa->sa_any[i].bv_len >= index_substr_any_len ) {
1044 /* don't bother accounting with stepping */
1045 nkeys += sa->sa_any[i].bv_len -
1046 ( index_substr_any_len - 1 );
1051 if( flags & SLAP_INDEX_SUBSTR_FINAL &&
1052 !BER_BVISNULL( &sa->sa_final ) &&
1053 sa->sa_final.bv_len >= index_substr_if_minlen )
1056 if ( sa->sa_final.bv_len > index_substr_if_maxlen &&
1057 ( flags & SLAP_INDEX_SUBSTR_ANY ))
1059 nkeys += 1 + (sa->sa_final.bv_len - index_substr_if_maxlen) / index_substr_any_step;
1065 return LDAP_SUCCESS;
1068 digest.bv_val = (char *)HASHdigest;
1069 digest.bv_len = HASH_LEN;
1071 slen = syntax->ssyn_oidlen;
1072 mlen = mr->smr_oidlen;
1074 keys = slap_sl_malloc( sizeof( struct berval ) * (nkeys+1), ctx );
1077 if( flags & SLAP_INDEX_SUBSTR_INITIAL &&
1078 !BER_BVISNULL( &sa->sa_initial ) &&
1079 sa->sa_initial.bv_len >= index_substr_if_minlen )
1081 pre = SLAP_INDEX_SUBSTR_INITIAL_PREFIX;
1082 value = &sa->sa_initial;
1084 klen = index_substr_if_maxlen < value->bv_len
1085 ? index_substr_if_maxlen : value->bv_len;
1087 hashPreset( &HASHcontext, prefix, pre, syntax, mr );
1088 hashIter( &HASHcontext, HASHdigest,
1089 (unsigned char *)value->bv_val, klen );
1090 ber_dupbv_x( &keys[nkeys++], &digest, ctx );
1092 /* If initial is too long and we have subany indexed, use it
1093 * to match the excess...
1095 if (value->bv_len > index_substr_if_maxlen && (flags & SLAP_INDEX_SUBSTR_ANY))
1098 pre = SLAP_INDEX_SUBSTR_PREFIX;
1099 hashPreset( &HASHcontext, prefix, pre, syntax, mr);
1100 for ( j=index_substr_if_maxlen-1; j <= value->bv_len - index_substr_any_len; j+=index_substr_any_step )
1102 hashIter( &HASHcontext, HASHdigest,
1103 (unsigned char *)&value->bv_val[j], index_substr_any_len );
1104 ber_dupbv_x( &keys[nkeys++], &digest, ctx );
1109 if( flags & SLAP_INDEX_SUBSTR_ANY && sa->sa_any != NULL ) {
1111 pre = SLAP_INDEX_SUBSTR_PREFIX;
1112 klen = index_substr_any_len;
1114 for( i=0; !BER_BVISNULL( &sa->sa_any[i] ); i++ ) {
1115 if( sa->sa_any[i].bv_len < index_substr_any_len ) {
1119 value = &sa->sa_any[i];
1121 hashPreset( &HASHcontext, prefix, pre, syntax, mr);
1123 j <= value->bv_len - index_substr_any_len;
1124 j += index_substr_any_step )
1126 hashIter( &HASHcontext, HASHdigest,
1127 (unsigned char *)&value->bv_val[j], klen );
1128 ber_dupbv_x( &keys[nkeys++], &digest, ctx );
1133 if( flags & SLAP_INDEX_SUBSTR_FINAL &&
1134 !BER_BVISNULL( &sa->sa_final ) &&
1135 sa->sa_final.bv_len >= index_substr_if_minlen )
1137 pre = SLAP_INDEX_SUBSTR_FINAL_PREFIX;
1138 value = &sa->sa_final;
1140 klen = index_substr_if_maxlen < value->bv_len
1141 ? index_substr_if_maxlen : value->bv_len;
1143 hashPreset( &HASHcontext, prefix, pre, syntax, mr );
1144 hashIter( &HASHcontext, HASHdigest,
1145 (unsigned char *)&value->bv_val[value->bv_len-klen], klen );
1146 ber_dupbv_x( &keys[nkeys++], &digest, ctx );
1148 /* If final is too long and we have subany indexed, use it
1149 * to match the excess...
1151 if (value->bv_len > index_substr_if_maxlen && (flags & SLAP_INDEX_SUBSTR_ANY))
1154 pre = SLAP_INDEX_SUBSTR_PREFIX;
1155 hashPreset( &HASHcontext, prefix, pre, syntax, mr);
1156 for ( j=0; j <= value->bv_len - index_substr_if_maxlen; j+=index_substr_any_step )
1158 hashIter( &HASHcontext, HASHdigest,
1159 (unsigned char *)&value->bv_val[j], index_substr_any_len );
1160 ber_dupbv_x( &keys[nkeys++], &digest, ctx );
1166 BER_BVZERO( &keys[nkeys] );
1173 return LDAP_SUCCESS;
1183 /* very unforgiving validation, requires no normalization
1184 * before simplistic matching
1186 if( in->bv_len < 3 ) {
1187 return LDAP_INVALID_SYNTAX;
1190 /* RFC 4517 Section 3.3.2 Bit String:
1191 * BitString = SQUOTE *binary-digit SQUOTE "B"
1192 * binary-digit = "0" / "1"
1194 * where SQUOTE [RFC4512] is
1195 * SQUOTE = %x27 ; single quote ("'")
1197 * Example: '0101111101'B
1200 if( in->bv_val[0] != '\'' ||
1201 in->bv_val[in->bv_len - 2] != '\'' ||
1202 in->bv_val[in->bv_len - 1] != 'B' )
1204 return LDAP_INVALID_SYNTAX;
1207 for( i = in->bv_len - 3; i > 0; i-- ) {
1208 if( in->bv_val[i] != '0' && in->bv_val[i] != '1' ) {
1209 return LDAP_INVALID_SYNTAX;
1213 return LDAP_SUCCESS;
1217 * Syntaxes from RFC 4517
1222 A value of the Bit String syntax is a sequence of binary digits. The
1223 LDAP-specific encoding of a value of this syntax is defined by the
1226 BitString = SQUOTE *binary-digit SQUOTE "B"
1228 binary-digit = "0" / "1"
1230 The <SQUOTE> rule is defined in [MODELS].
1235 The LDAP definition for the Bit String syntax is:
1237 ( 1.3.6.1.4.1.1466.115.121.1.6 DESC 'Bit String' )
1239 This syntax corresponds to the BIT STRING ASN.1 type from [ASN.1].
1243 3.3.21. Name and Optional UID
1245 A value of the Name and Optional UID syntax is the distinguished name
1246 [MODELS] of an entity optionally accompanied by a unique identifier
1247 that serves to differentiate the entity from others with an identical
1250 The LDAP-specific encoding of a value of this syntax is defined by
1253 NameAndOptionalUID = distinguishedName [ SHARP BitString ]
1255 The <BitString> rule is defined in Section 3.3.2. The
1256 <distinguishedName> rule is defined in [LDAPDN]. The <SHARP> rule is
1257 defined in [MODELS].
1259 Note that although the '#' character may occur in the string
1260 representation of a distinguished name, no additional escaping of
1261 this character is performed when a <distinguishedName> is encoded in
1262 a <NameAndOptionalUID>.
1265 1.3.6.1.4.1.1466.0=#04024869,O=Test,C=GB#'0101'B
1267 The LDAP definition for the Name and Optional UID syntax is:
1269 ( 1.3.6.1.4.1.1466.115.121.1.34 DESC 'Name And Optional UID' )
1271 This syntax corresponds to the NameAndOptionalUID ASN.1 type from
1278 1.4. Common ABNF Productions
1281 SHARP = %x23 ; octothorpe (or sharp sign) ("#")
1283 SQUOTE = %x27 ; single quote ("'")
1288 * RFC 4514 clarifies that SHARP, i.e. "#", doesn't have to
1289 * be escaped except when at the beginning of a value, the
1290 * definition of Name and Optional UID appears to be flawed,
1291 * because there is no clear means to determine whether the
1292 * UID part is present or not.
1296 * cn=Someone,dc=example,dc=com#'1'B
1298 * could be either a NameAndOptionalUID with trailing UID, i.e.
1300 * DN = "cn=Someone,dc=example,dc=com"
1303 * or a NameAndOptionalUID with no trailing UID, and the AVA
1304 * in the last RDN made of
1306 * attributeType = dc
1307 * attributeValue = com#'1'B
1309 * in fact "com#'1'B" is a valid IA5 string.
1311 * As a consequence, current slapd code takes the presence of
1312 * #<valid BitString> at the end of the string representation
1313 * of a NameAndOptionalUID to mean this is indeed a BitString.
1314 * This is quite arbitrary - it has changed the past and might
1315 * change in the future.
1325 struct berval dn, uid;
1327 if( BER_BVISEMPTY( in ) ) return LDAP_SUCCESS;
1329 ber_dupbv( &dn, in );
1330 if( !dn.bv_val ) return LDAP_OTHER;
1332 /* if there's a "#", try bitStringValidate()... */
1333 uid.bv_val = strrchr( dn.bv_val, '#' );
1334 if ( !BER_BVISNULL( &uid ) ) {
1336 uid.bv_len = dn.bv_len - ( uid.bv_val - dn.bv_val );
1338 rc = bitStringValidate( NULL, &uid );
1339 if ( rc == LDAP_SUCCESS ) {
1340 /* in case of success, trim the UID,
1341 * otherwise treat it as part of the DN */
1342 dn.bv_len -= uid.bv_len + 1;
1343 uid.bv_val[-1] = '\0';
1347 rc = dnValidate( NULL, &dn );
1349 ber_memfree( dn.bv_val );
1360 assert( val != NULL );
1361 assert( out != NULL );
1364 Debug( LDAP_DEBUG_TRACE, ">>> nameUIDPretty: <%s>\n", val->bv_val, 0, 0 );
1366 if( BER_BVISEMPTY( val ) ) {
1367 ber_dupbv_x( out, val, ctx );
1369 } else if ( val->bv_len > SLAP_LDAPDN_MAXLEN ) {
1370 return LDAP_INVALID_SYNTAX;
1374 struct berval dnval = *val;
1375 struct berval uidval = BER_BVNULL;
1377 uidval.bv_val = strrchr( val->bv_val, '#' );
1378 if ( !BER_BVISNULL( &uidval ) ) {
1380 uidval.bv_len = val->bv_len - ( uidval.bv_val - val->bv_val );
1382 rc = bitStringValidate( NULL, &uidval );
1384 if ( rc == LDAP_SUCCESS ) {
1385 ber_dupbv_x( &dnval, val, ctx );
1387 dnval.bv_len -= ++uidval.bv_len;
1388 dnval.bv_val[dnval.bv_len] = '\0';
1391 BER_BVZERO( &uidval );
1395 rc = dnPretty( syntax, &dnval, out, ctx );
1396 if ( dnval.bv_val != val->bv_val ) {
1397 slap_sl_free( dnval.bv_val, ctx );
1399 if( rc != LDAP_SUCCESS ) {
1403 if( !BER_BVISNULL( &uidval ) ) {
1406 tmp = slap_sl_realloc( out->bv_val, out->bv_len
1407 + uidval.bv_len + 1,
1410 ber_memfree_x( out->bv_val, ctx );
1414 memcpy( out->bv_val + out->bv_len, uidval.bv_val, uidval.bv_len );
1415 out->bv_len += uidval.bv_len;
1416 out->bv_val[out->bv_len] = '\0';
1420 Debug( LDAP_DEBUG_TRACE, "<<< nameUIDPretty: <%s>\n", out->bv_val, 0, 0 );
1422 return LDAP_SUCCESS;
1426 uniqueMemberNormalize(
1431 struct berval *normalized,
1437 assert( SLAP_MR_IS_VALUE_OF_SYNTAX( usage ) != 0 );
1439 ber_dupbv_x( &out, val, ctx );
1440 if ( BER_BVISEMPTY( &out ) ) {
1444 struct berval uid = BER_BVNULL;
1446 uid.bv_val = strrchr( out.bv_val, '#' );
1447 if ( !BER_BVISNULL( &uid ) ) {
1449 uid.bv_len = out.bv_len - ( uid.bv_val - out.bv_val );
1451 rc = bitStringValidate( NULL, &uid );
1452 if ( rc == LDAP_SUCCESS ) {
1453 uid.bv_val[-1] = '\0';
1454 out.bv_len -= uid.bv_len + 1;
1460 rc = dnNormalize( 0, NULL, NULL, &out, normalized, ctx );
1462 if( rc != LDAP_SUCCESS ) {
1463 slap_sl_free( out.bv_val, ctx );
1464 return LDAP_INVALID_SYNTAX;
1467 if( !BER_BVISNULL( &uid ) ) {
1470 tmp = ch_realloc( normalized->bv_val,
1471 normalized->bv_len + uid.bv_len
1472 + STRLENOF("#") + 1 );
1473 if ( tmp == NULL ) {
1474 ber_memfree_x( normalized->bv_val, ctx );
1478 normalized->bv_val = tmp;
1480 /* insert the separator */
1481 normalized->bv_val[normalized->bv_len++] = '#';
1483 /* append the UID */
1484 AC_MEMCPY( &normalized->bv_val[normalized->bv_len],
1485 uid.bv_val, uid.bv_len );
1486 normalized->bv_len += uid.bv_len;
1489 normalized->bv_val[normalized->bv_len] = '\0';
1492 slap_sl_free( out.bv_val, ctx );
1495 return LDAP_SUCCESS;
1504 struct berval *value,
1505 void *assertedValue )
1508 struct berval *asserted = (struct berval *) assertedValue;
1509 struct berval assertedDN = *asserted;
1510 struct berval assertedUID = BER_BVNULL;
1511 struct berval valueDN = *value;
1512 struct berval valueUID = BER_BVNULL;
1513 int approx = ((flags & SLAP_MR_EQUALITY_APPROX) == SLAP_MR_EQUALITY_APPROX);
1515 if ( !BER_BVISEMPTY( asserted ) ) {
1516 assertedUID.bv_val = strrchr( assertedDN.bv_val, '#' );
1517 if ( !BER_BVISNULL( &assertedUID ) ) {
1518 assertedUID.bv_val++;
1519 assertedUID.bv_len = assertedDN.bv_len
1520 - ( assertedUID.bv_val - assertedDN.bv_val );
1522 if ( bitStringValidate( NULL, &assertedUID ) == LDAP_SUCCESS ) {
1523 assertedDN.bv_len -= assertedUID.bv_len + 1;
1526 BER_BVZERO( &assertedUID );
1531 if ( !BER_BVISEMPTY( value ) ) {
1533 valueUID.bv_val = strrchr( valueDN.bv_val, '#' );
1534 if ( !BER_BVISNULL( &valueUID ) ) {
1536 valueUID.bv_len = valueDN.bv_len
1537 - ( valueUID.bv_val - valueDN.bv_val );
1539 if ( bitStringValidate( NULL, &valueUID ) == LDAP_SUCCESS ) {
1540 valueDN.bv_len -= valueUID.bv_len + 1;
1543 BER_BVZERO( &valueUID );
1548 if( valueUID.bv_len && assertedUID.bv_len ) {
1550 d = (ber_slen_t) valueUID.bv_len - (ber_slen_t) assertedUID.bv_len;
1552 *matchp = sizeof(d) == sizeof(int) ? d : d < 0 ? -1 : 1;
1553 return LDAP_SUCCESS;
1556 match = memcmp( valueUID.bv_val, assertedUID.bv_val, valueUID.bv_len );
1559 return LDAP_SUCCESS;
1562 } else if ( !approx && valueUID.bv_len ) {
1565 return LDAP_SUCCESS;
1567 } else if ( !approx && assertedUID.bv_len ) {
1570 return LDAP_SUCCESS;
1573 return dnMatch( matchp, flags, syntax, mr, &valueDN, &assertedDN );
1577 uniqueMemberIndexer(
1582 struct berval *prefix,
1590 for( i=0; !BER_BVISNULL( &values[i] ); i++ ) {
1591 /* just count them */
1595 dnvalues = slap_sl_malloc( sizeof( struct berval ) * (i+1), ctx );
1597 for( i=0; !BER_BVISNULL( &values[i] ); i++ ) {
1598 struct berval assertedDN = values[i];
1599 struct berval assertedUID = BER_BVNULL;
1601 if ( !BER_BVISEMPTY( &assertedDN ) ) {
1602 assertedUID.bv_val = strrchr( assertedDN.bv_val, '#' );
1603 if ( !BER_BVISNULL( &assertedUID ) ) {
1604 assertedUID.bv_val++;
1605 assertedUID.bv_len = assertedDN.bv_len
1606 - ( assertedUID.bv_val - assertedDN.bv_val );
1608 if ( bitStringValidate( NULL, &assertedUID ) == LDAP_SUCCESS ) {
1609 assertedDN.bv_len -= assertedUID.bv_len + 1;
1612 BER_BVZERO( &assertedUID );
1617 dnvalues[i] = assertedDN;
1619 BER_BVZERO( &dnvalues[i] );
1621 rc = octetStringIndexer( use, flags, syntax, mr, prefix,
1622 dnvalues, keysp, ctx );
1624 slap_sl_free( dnvalues, ctx );
1634 struct berval *prefix,
1635 void * assertedValue,
1639 struct berval *asserted = (struct berval *) assertedValue;
1640 struct berval assertedDN = *asserted;
1641 struct berval assertedUID = BER_BVNULL;
1643 if ( !BER_BVISEMPTY( asserted ) ) {
1644 assertedUID.bv_val = strrchr( assertedDN.bv_val, '#' );
1645 if ( !BER_BVISNULL( &assertedUID ) ) {
1646 assertedUID.bv_val++;
1647 assertedUID.bv_len = assertedDN.bv_len
1648 - ( assertedUID.bv_val - assertedDN.bv_val );
1650 if ( bitStringValidate( NULL, &assertedUID ) == LDAP_SUCCESS ) {
1651 assertedDN.bv_len -= assertedUID.bv_len + 1;
1654 BER_BVZERO( &assertedUID );
1659 return octetStringFilter( use, flags, syntax, mr, prefix,
1660 &assertedDN, keysp, ctx );
1665 * Handling boolean syntax and matching is quite rigid.
1666 * A more flexible approach would be to allow a variety
1667 * of strings to be normalized and prettied into TRUE
1675 /* very unforgiving validation, requires no normalization
1676 * before simplistic matching
1679 if( in->bv_len == 4 ) {
1680 if( bvmatch( in, &slap_true_bv ) ) {
1681 return LDAP_SUCCESS;
1683 } else if( in->bv_len == 5 ) {
1684 if( bvmatch( in, &slap_false_bv ) ) {
1685 return LDAP_SUCCESS;
1689 return LDAP_INVALID_SYNTAX;
1698 struct berval *value,
1699 void *assertedValue )
1701 /* simplistic matching allowed by rigid validation */
1702 struct berval *asserted = (struct berval *) assertedValue;
1703 *matchp = (int) asserted->bv_len - (int) value->bv_len;
1704 return LDAP_SUCCESS;
1707 /*-------------------------------------------------------------------
1708 LDAP/X.500 string syntax / matching rules have a few oddities. This
1709 comment attempts to detail how slapd(8) treats them.
1712 StringSyntax X.500 LDAP Matching/Comments
1713 DirectoryString CHOICE UTF8 i/e + ignore insignificant spaces
1714 PrintableString subset subset i/e + ignore insignificant spaces
1715 PrintableString subset subset i/e + ignore insignificant spaces
1716 NumericString subset subset ignore all spaces
1717 IA5String ASCII ASCII i/e + ignore insignificant spaces
1718 TeletexString T.61 T.61 i/e + ignore insignificant spaces
1720 TelephoneNumber subset subset i + ignore all spaces and "-"
1722 See RFC 4518 for details.
1726 In X.500(93), a directory string can be either a PrintableString,
1727 a bmpString, or a UniversalString (e.g., UCS (a subset of Unicode)).
1728 In later versions, more CHOICEs were added. In all cases the string
1731 In LDAPv3, a directory string is a UTF-8 encoded UCS string.
1732 A directory string cannot be zero length.
1734 For matching, there are both case ignore and exact rules. Both
1735 also require that "insignificant" spaces be ignored.
1736 spaces before the first non-space are ignored;
1737 spaces after the last non-space are ignored;
1738 spaces after a space are ignored.
1739 Note: by these rules (and as clarified in X.520), a string of only
1740 spaces is to be treated as if held one space, not empty (which
1741 would be a syntax error).
1744 In ASN.1, numeric string is just a string of digits and spaces
1745 and could be empty. However, in X.500, all attribute values of
1746 numeric string carry a non-empty constraint. For example:
1748 internationalISDNNumber ATTRIBUTE ::= {
1749 WITH SYNTAX InternationalISDNNumber
1750 EQUALITY MATCHING RULE numericStringMatch
1751 SUBSTRINGS MATCHING RULE numericStringSubstringsMatch
1752 ID id-at-internationalISDNNumber }
1753 InternationalISDNNumber ::=
1754 NumericString (SIZE(1..ub-international-isdn-number))
1756 Unforunately, some assertion values are don't carry the same
1757 constraint (but its unclear how such an assertion could ever
1758 be true). In LDAP, there is one syntax (numericString) not two
1759 (numericString with constraint, numericString without constraint).
1760 This should be treated as numericString with non-empty constraint.
1761 Note that while someone may have no ISDN number, there are no ISDN
1762 numbers which are zero length.
1764 In matching, spaces are ignored.
1767 In ASN.1, Printable string is just a string of printable characters
1768 and can be empty. In X.500, semantics much like NumericString (see
1769 serialNumber for a like example) excepting uses insignificant space
1770 handling instead of ignore all spaces. They must be non-empty.
1773 Basically same as PrintableString. There are no examples in X.500,
1774 but same logic applies. Empty strings are allowed.
1776 -------------------------------------------------------------------*/
1785 unsigned char *u = (unsigned char *)in->bv_val;
1787 if( BER_BVISEMPTY( in ) && syntax == slap_schema.si_syn_directoryString ) {
1788 /* directory strings cannot be empty */
1789 return LDAP_INVALID_SYNTAX;
1792 for( count = in->bv_len; count > 0; count -= len, u += len ) {
1793 /* get the length indicated by the first byte */
1794 len = LDAP_UTF8_CHARLEN2( u, len );
1796 /* very basic checks */
1799 if( (u[5] & 0xC0) != 0x80 ) {
1800 return LDAP_INVALID_SYNTAX;
1803 if( (u[4] & 0xC0) != 0x80 ) {
1804 return LDAP_INVALID_SYNTAX;
1807 if( (u[3] & 0xC0) != 0x80 ) {
1808 return LDAP_INVALID_SYNTAX;
1811 if( (u[2] & 0xC0 )!= 0x80 ) {
1812 return LDAP_INVALID_SYNTAX;
1815 if( (u[1] & 0xC0) != 0x80 ) {
1816 return LDAP_INVALID_SYNTAX;
1819 /* CHARLEN already validated it */
1822 return LDAP_INVALID_SYNTAX;
1825 /* make sure len corresponds with the offset
1826 to the next character */
1827 if( LDAP_UTF8_OFFSET( (char *)u ) != len ) return LDAP_INVALID_SYNTAX;
1831 return LDAP_INVALID_SYNTAX;
1834 return LDAP_SUCCESS;
1838 UTF8StringNormalize(
1843 struct berval *normalized,
1846 struct berval tmp, nvalue;
1847 int flags, wasspace;
1850 assert( SLAP_MR_IS_VALUE_OF_SYNTAX( use ) != 0 );
1852 if( BER_BVISNULL( val ) ) {
1853 /* assume we're dealing with a syntax (e.g., UTF8String)
1854 * which allows empty strings
1856 BER_BVZERO( normalized );
1857 return LDAP_SUCCESS;
1860 flags = SLAP_MR_ASSOCIATED( mr, slap_schema.si_mr_caseExactMatch )
1861 ? LDAP_UTF8_NOCASEFOLD : LDAP_UTF8_CASEFOLD;
1862 flags |= ( ( use & SLAP_MR_EQUALITY_APPROX ) == SLAP_MR_EQUALITY_APPROX )
1863 ? LDAP_UTF8_APPROX : 0;
1865 val = UTF8bvnormalize( val, &tmp, flags, ctx );
1866 /* out of memory or syntax error, the former is unlikely */
1868 return LDAP_INVALID_SYNTAX;
1871 /* collapse spaces (in place) */
1873 nvalue.bv_val = tmp.bv_val;
1875 /* trim leading spaces? */
1876 wasspace = !((( use & SLAP_MR_SUBSTR_ANY ) == SLAP_MR_SUBSTR_ANY ) ||
1877 (( use & SLAP_MR_SUBSTR_FINAL ) == SLAP_MR_SUBSTR_FINAL ));
1879 for( i = 0; i < tmp.bv_len; i++) {
1880 if ( ASCII_SPACE( tmp.bv_val[i] )) {
1881 if( wasspace++ == 0 ) {
1882 /* trim repeated spaces */
1883 nvalue.bv_val[nvalue.bv_len++] = tmp.bv_val[i];
1887 nvalue.bv_val[nvalue.bv_len++] = tmp.bv_val[i];
1891 if( !BER_BVISEMPTY( &nvalue ) ) {
1892 /* trim trailing space? */
1894 (( use & SLAP_MR_SUBSTR_INITIAL ) != SLAP_MR_SUBSTR_INITIAL ) &&
1895 ( use & SLAP_MR_SUBSTR_ANY ) != SLAP_MR_SUBSTR_ANY ))
1899 nvalue.bv_val[nvalue.bv_len] = '\0';
1901 } else if ( tmp.bv_len ) {
1902 /* string of all spaces is treated as one space */
1903 nvalue.bv_val[0] = ' ';
1904 nvalue.bv_val[1] = '\0';
1906 } /* should never be entered with 0-length val */
1908 *normalized = nvalue;
1909 return LDAP_SUCCESS;
1913 directoryStringSubstringsMatch(
1918 struct berval *value,
1919 void *assertedValue )
1922 SubstringsAssertion *sub = assertedValue;
1923 struct berval left = *value;
1927 if ( !BER_BVISNULL( &sub->sa_initial ) ) {
1928 if ( sub->sa_initial.bv_len > left.bv_len ) {
1929 /* not enough left */
1934 match = memcmp( sub->sa_initial.bv_val, left.bv_val,
1935 sub->sa_initial.bv_len );
1941 left.bv_val += sub->sa_initial.bv_len;
1942 left.bv_len -= sub->sa_initial.bv_len;
1944 priorspace = ASCII_SPACE(
1945 sub->sa_initial.bv_val[sub->sa_initial.bv_len] );
1948 if ( sub->sa_any ) {
1949 for ( i = 0; !BER_BVISNULL( &sub->sa_any[i] ); i++ ) {
1953 if( priorspace && !BER_BVISEMPTY( &sub->sa_any[i] )
1954 && ASCII_SPACE( sub->sa_any[i].bv_val[0] ))
1956 /* allow next space to match */
1963 if ( BER_BVISEMPTY( &sub->sa_any[i] ) ) {
1967 if ( sub->sa_any[i].bv_len > left.bv_len ) {
1968 /* not enough left */
1973 p = memchr( left.bv_val, *sub->sa_any[i].bv_val, left.bv_len );
1980 idx = p - left.bv_val;
1982 if ( idx >= left.bv_len ) {
1983 /* this shouldn't happen */
1990 if ( sub->sa_any[i].bv_len > left.bv_len ) {
1991 /* not enough left */
1996 match = memcmp( left.bv_val,
1997 sub->sa_any[i].bv_val,
1998 sub->sa_any[i].bv_len );
2006 left.bv_val += sub->sa_any[i].bv_len;
2007 left.bv_len -= sub->sa_any[i].bv_len;
2009 priorspace = ASCII_SPACE(
2010 sub->sa_any[i].bv_val[sub->sa_any[i].bv_len] );
2014 if ( !BER_BVISNULL( &sub->sa_final ) ) {
2015 if( priorspace && !BER_BVISEMPTY( &sub->sa_final )
2016 && ASCII_SPACE( sub->sa_final.bv_val[0] ))
2018 /* allow next space to match */
2023 if ( sub->sa_final.bv_len > left.bv_len ) {
2024 /* not enough left */
2029 match = memcmp( sub->sa_final.bv_val,
2030 &left.bv_val[left.bv_len - sub->sa_final.bv_len],
2031 sub->sa_final.bv_len );
2040 return LDAP_SUCCESS;
2043 #if defined(SLAPD_APPROX_INITIALS)
2044 # define SLAPD_APPROX_DELIMITER "._ "
2045 # define SLAPD_APPROX_WORDLEN 2
2047 # define SLAPD_APPROX_DELIMITER " "
2048 # define SLAPD_APPROX_WORDLEN 1
2057 struct berval *value,
2058 void *assertedValue )
2060 struct berval *nval, *assertv;
2061 char *val, **values, **words, *c;
2062 int i, count, len, nextchunk=0, nextavail=0;
2064 /* Yes, this is necessary */
2065 nval = UTF8bvnormalize( value, NULL, LDAP_UTF8_APPROX, NULL );
2066 if( nval == NULL ) {
2068 return LDAP_SUCCESS;
2071 /* Yes, this is necessary */
2072 assertv = UTF8bvnormalize( ((struct berval *)assertedValue),
2073 NULL, LDAP_UTF8_APPROX, NULL );
2074 if( assertv == NULL ) {
2077 return LDAP_SUCCESS;
2080 /* Isolate how many words there are */
2081 for ( c = nval->bv_val, count = 1; *c; c++ ) {
2082 c = strpbrk( c, SLAPD_APPROX_DELIMITER );
2083 if ( c == NULL ) break;
2088 /* Get a phonetic copy of each word */
2089 words = (char **)ch_malloc( count * sizeof(char *) );
2090 values = (char **)ch_malloc( count * sizeof(char *) );
2091 for ( c = nval->bv_val, i = 0; i < count; i++, c += strlen(c) + 1 ) {
2093 values[i] = phonetic(c);
2096 /* Work through the asserted value's words, to see if at least some
2097 * of the words are there, in the same order. */
2099 while ( (ber_len_t) nextchunk < assertv->bv_len ) {
2100 len = strcspn( assertv->bv_val + nextchunk, SLAPD_APPROX_DELIMITER);
2105 #if defined(SLAPD_APPROX_INITIALS)
2106 else if( len == 1 ) {
2107 /* Single letter words need to at least match one word's initial */
2108 for( i=nextavail; i<count; i++ )
2109 if( !strncasecmp( assertv->bv_val + nextchunk, words[i], 1 )) {
2116 /* Isolate the next word in the asserted value and phonetic it */
2117 assertv->bv_val[nextchunk+len] = '\0';
2118 val = phonetic( assertv->bv_val + nextchunk );
2120 /* See if this phonetic chunk is in the remaining words of *value */
2121 for( i=nextavail; i<count; i++ ){
2122 if( !strcmp( val, values[i] ) ){
2130 /* This chunk in the asserted value was NOT within the *value. */
2136 /* Go on to the next word in the asserted value */
2140 /* If some of the words were seen, call it a match */
2141 if( nextavail > 0 ) {
2148 /* Cleanup allocs */
2149 ber_bvfree( assertv );
2150 for( i=0; i<count; i++ ) {
2151 ch_free( values[i] );
2157 return LDAP_SUCCESS;
2166 struct berval *prefix,
2172 int i,j, len, wordcount, keycount=0;
2173 struct berval *newkeys;
2174 BerVarray keys=NULL;
2176 for( j = 0; !BER_BVISNULL( &values[j] ); j++ ) {
2177 struct berval val = BER_BVNULL;
2178 /* Yes, this is necessary */
2179 UTF8bvnormalize( &values[j], &val, LDAP_UTF8_APPROX, NULL );
2180 assert( !BER_BVISNULL( &val ) );
2182 /* Isolate how many words there are. There will be a key for each */
2183 for( wordcount = 0, c = val.bv_val; *c; c++) {
2184 len = strcspn(c, SLAPD_APPROX_DELIMITER);
2185 if( len >= SLAPD_APPROX_WORDLEN ) wordcount++;
2187 if (*c == '\0') break;
2191 /* Allocate/increase storage to account for new keys */
2192 newkeys = (struct berval *)ch_malloc( (keycount + wordcount + 1)
2193 * sizeof(struct berval) );
2194 AC_MEMCPY( newkeys, keys, keycount * sizeof(struct berval) );
2195 if( keys ) ch_free( keys );
2198 /* Get a phonetic copy of each word */
2199 for( c = val.bv_val, i = 0; i < wordcount; c += len + 1 ) {
2201 if( len < SLAPD_APPROX_WORDLEN ) continue;
2202 ber_str2bv( phonetic( c ), 0, 0, &keys[keycount] );
2203 if( keys[keycount].bv_len ) {
2206 ch_free( keys[keycount].bv_val );
2211 ber_memfree( val.bv_val );
2213 BER_BVZERO( &keys[keycount] );
2216 return LDAP_SUCCESS;
2225 struct berval *prefix,
2226 void * assertedValue,
2235 /* Yes, this is necessary */
2236 val = UTF8bvnormalize( ((struct berval *)assertedValue),
2237 NULL, LDAP_UTF8_APPROX, NULL );
2238 if( val == NULL || BER_BVISNULL( val ) ) {
2239 keys = (struct berval *)ch_malloc( sizeof(struct berval) );
2240 BER_BVZERO( &keys[0] );
2243 return LDAP_SUCCESS;
2246 /* Isolate how many words there are. There will be a key for each */
2247 for( count = 0,c = val->bv_val; *c; c++) {
2248 len = strcspn(c, SLAPD_APPROX_DELIMITER);
2249 if( len >= SLAPD_APPROX_WORDLEN ) count++;
2251 if (*c == '\0') break;
2255 /* Allocate storage for new keys */
2256 keys = (struct berval *)ch_malloc( (count + 1) * sizeof(struct berval) );
2258 /* Get a phonetic copy of each word */
2259 for( c = val->bv_val, i = 0; i < count; c += len + 1 ) {
2261 if( len < SLAPD_APPROX_WORDLEN ) continue;
2262 ber_str2bv( phonetic( c ), 0, 0, &keys[i] );
2268 BER_BVZERO( &keys[count] );
2271 return LDAP_SUCCESS;
2274 /* Remove all spaces and '-' characters */
2276 telephoneNumberNormalize(
2281 struct berval *normalized,
2286 assert( SLAP_MR_IS_VALUE_OF_SYNTAX( usage ) != 0 );
2288 /* validator should have refused an empty string */
2289 assert( !BER_BVISEMPTY( val ) );
2291 q = normalized->bv_val = slap_sl_malloc( val->bv_len + 1, ctx );
2293 for( p = val->bv_val; *p; p++ ) {
2294 if ( ! ( ASCII_SPACE( *p ) || *p == '-' )) {
2300 normalized->bv_len = q - normalized->bv_val;
2302 if( BER_BVISEMPTY( normalized ) ) {
2303 slap_sl_free( normalized->bv_val, ctx );
2304 BER_BVZERO( normalized );
2305 return LDAP_INVALID_SYNTAX;
2308 return LDAP_SUCCESS;
2312 postalAddressValidate(
2316 struct berval bv = *in;
2319 for ( c = 0; c < in->bv_len; c++ ) {
2320 if ( in->bv_val[c] == '\\' ) {
2322 if ( strncasecmp( &in->bv_val[c], "24", STRLENOF( "24" ) ) != 0
2323 && strncasecmp( &in->bv_val[c], "5C", STRLENOF( "5C" ) ) != 0 )
2325 return LDAP_INVALID_SYNTAX;
2330 if ( in->bv_val[c] == '$' ) {
2331 bv.bv_len = &in->bv_val[c] - bv.bv_val;
2332 if ( UTF8StringValidate( NULL, &bv ) != LDAP_SUCCESS ) {
2333 return LDAP_INVALID_SYNTAX;
2335 bv.bv_val = &in->bv_val[c] + 1;
2339 bv.bv_len = &in->bv_val[c] - bv.bv_val;
2340 return UTF8StringValidate( NULL, &bv );
2344 postalAddressNormalize(
2349 struct berval *normalized,
2352 BerVarray lines = NULL, nlines = NULL;
2354 int rc = LDAP_SUCCESS;
2355 MatchingRule *xmr = NULL;
2358 if ( SLAP_MR_ASSOCIATED( mr, slap_schema.si_mr_caseIgnoreListMatch ) ) {
2359 xmr = slap_schema.si_mr_caseIgnoreMatch;
2362 xmr = slap_schema.si_mr_caseExactMatch;
2365 for ( l = 0, c = 0; c < val->bv_len; c++ ) {
2366 if ( val->bv_val[c] == '$' ) {
2371 lines = slap_sl_calloc( sizeof( struct berval ), 2 * ( l + 2 ), ctx );
2372 nlines = &lines[l + 2];
2374 lines[0].bv_val = val->bv_val;
2375 for ( l = 0, c = 0; c < val->bv_len; c++ ) {
2376 if ( val->bv_val[c] == '$' ) {
2377 lines[l].bv_len = &val->bv_val[c] - lines[l].bv_val;
2379 lines[l].bv_val = &val->bv_val[c + 1];
2382 lines[l].bv_len = &val->bv_val[c] - lines[l].bv_val;
2384 normalized->bv_len = c = l;
2386 for ( l = 0; l <= c; l++ ) {
2387 /* NOTE: we directly normalize each line,
2388 * without unescaping the values, since the special
2389 * values '\24' ('$') and '\5C' ('\') are not affected
2390 * by normalization */
2391 if ( !lines[l].bv_len ) {
2392 nlines[l].bv_len = 0;
2393 nlines[l].bv_val = NULL;
2396 rc = UTF8StringNormalize( usage, NULL, xmr, &lines[l], &nlines[l], ctx );
2397 if ( rc != LDAP_SUCCESS ) {
2398 rc = LDAP_INVALID_SYNTAX;
2402 normalized->bv_len += nlines[l].bv_len;
2405 normalized->bv_val = slap_sl_malloc( normalized->bv_len + 1, ctx );
2407 p = normalized->bv_val;
2408 for ( l = 0; l <= c ; l++ ) {
2409 p = lutil_strbvcopy( p, &nlines[l] );
2414 assert( p == &normalized->bv_val[normalized->bv_len] );
2417 if ( nlines != NULL ) {
2418 for ( l = 0; !BER_BVISNULL( &nlines[ l ] ); l++ ) {
2419 slap_sl_free( nlines[l].bv_val, ctx );
2422 slap_sl_free( lines, ctx );
2433 struct berval val = *in;
2435 if( BER_BVISEMPTY( &val ) ) {
2436 /* disallow empty strings */
2437 return LDAP_INVALID_SYNTAX;
2440 while( OID_LEADCHAR( val.bv_val[0] ) ) {
2441 if ( val.bv_len == 1 ) {
2442 return LDAP_SUCCESS;
2445 if ( val.bv_val[0] == '0' && !OID_SEPARATOR( val.bv_val[1] )) {
2452 while ( OID_LEADCHAR( val.bv_val[0] )) {
2456 if ( val.bv_len == 0 ) {
2457 return LDAP_SUCCESS;
2461 if( !OID_SEPARATOR( val.bv_val[0] )) {
2469 return LDAP_INVALID_SYNTAX;
2478 struct berval val = *in;
2480 if ( BER_BVISEMPTY( &val ) ) return LDAP_INVALID_SYNTAX;
2482 if ( val.bv_val[0] == '-' ) {
2486 if( BER_BVISEMPTY( &val ) ) { /* bare "-" */
2487 return LDAP_INVALID_SYNTAX;
2490 if( val.bv_val[0] == '0' ) { /* "-0" */
2491 return LDAP_INVALID_SYNTAX;
2494 } else if ( val.bv_val[0] == '0' ) {
2495 if( val.bv_len > 1 ) { /* "0<more>" */
2496 return LDAP_INVALID_SYNTAX;
2499 return LDAP_SUCCESS;
2502 for( i=0; i < val.bv_len; i++ ) {
2503 if( !ASCII_DIGIT(val.bv_val[i]) ) {
2504 return LDAP_INVALID_SYNTAX;
2508 return LDAP_SUCCESS;
2517 struct berval *value,
2518 void *assertedValue )
2520 struct berval *asserted = (struct berval *) assertedValue;
2521 int vsign = 1, asign = 1; /* default sign = '+' */
2526 if( v.bv_val[0] == '-' ) {
2532 if( BER_BVISEMPTY( &v ) ) vsign = 0;
2535 if( a.bv_val[0] == '-' ) {
2541 if( BER_BVISEMPTY( &a ) ) vsign = 0;
2543 match = vsign - asign;
2545 match = ( v.bv_len != a.bv_len
2546 ? ( v.bv_len < a.bv_len ? -1 : 1 )
2547 : memcmp( v.bv_val, a.bv_val, v.bv_len ));
2548 if( vsign < 0 ) match = -match;
2551 /* Ordering rule used in extensible match filter? */
2552 if ( (flags & SLAP_MR_EXT) && (mr->smr_usage & SLAP_MR_ORDERING) )
2553 match = (match >= 0);
2556 return LDAP_SUCCESS;
2559 /* 10**Chop < 256**Chopbytes and Chop > Chopbytes<<1 (for sign bit and itmp) */
2560 #define INDEX_INTLEN_CHOP 7
2561 #define INDEX_INTLEN_CHOPBYTES 3
2570 /* Integer index key format, designed for memcmp to collate correctly:
2571 * if too large: one's complement sign*<approx exponent=chopped bytes>,
2572 * two's complement value (sign-extended or chopped as needed),
2573 * however in first byte above, the top <number of exponent-bytes + 1>
2574 * bits are the inverse sign and next bit is the sign as delimiter.
2576 ber_slen_t k = index_intlen_strlen;
2578 unsigned signmask = ~0x7fU;
2579 unsigned char lenbuf[sizeof(k) + 2], *lenp, neg = 0xff;
2580 struct berval val = *in, itmp = *tmp;
2582 if ( val.bv_val[0] != '-' ) {
2587 /* Chop least significant digits, increase length instead */
2588 if ( val.bv_len > (ber_len_t) k ) {
2589 chop = (val.bv_len-k+2)/INDEX_INTLEN_CHOP; /* 2 fewer digits */
2590 val.bv_len -= chop * INDEX_INTLEN_CHOP; /* #digits chopped */
2591 chop *= INDEX_INTLEN_CHOPBYTES; /* #bytes added */
2594 if ( lutil_str2bin( &val, &itmp, ctx )) {
2595 return LDAP_INVALID_SYNTAX;
2598 /* Omit leading sign byte */
2599 if ( itmp.bv_val[0] == neg ) {
2604 k = (ber_slen_t) index_intlen - (ber_slen_t) (itmp.bv_len + chop);
2606 assert( chop == 0 );
2607 memset( key->bv_val, neg, k ); /* sign-extend */
2608 } else if ( k != 0 || ((itmp.bv_val[0] ^ neg) & 0xc0) ) {
2609 /* Got exponent -k, or no room for 2 sign bits */
2610 lenp = lenbuf + sizeof(lenbuf);
2611 chop = - (ber_len_t) k;
2613 *--lenp = ((unsigned char) chop & 0xff) ^ neg;
2615 } while ( (chop >>= 8) != 0 || (signmask >> 1) & (*lenp ^ neg) );
2616 /* With n bytes in lenbuf, the top n+1 bits of (signmask&0xff)
2617 * are 1, and the top n+2 bits of lenp[0] are the sign bit. */
2618 k = (lenbuf + sizeof(lenbuf)) - lenp;
2619 if ( k > (ber_slen_t) index_intlen )
2621 memcpy( key->bv_val, lenp, k );
2622 itmp.bv_len = index_intlen - k;
2624 memcpy( key->bv_val + k, itmp.bv_val, itmp.bv_len );
2625 key->bv_val[0] ^= (unsigned char) signmask & 0xff; /* invert sign */
2629 /* Index generation function: Ordered index */
2636 struct berval *prefix,
2646 unsigned maxstrlen = index_intlen_strlen + INDEX_INTLEN_CHOP-1;
2648 /* count the values and find max needed length */
2650 for( i = 0; !BER_BVISNULL( &values[i] ); i++ ) {
2651 if ( vlen < values[i].bv_len )
2652 vlen = values[i].bv_len;
2654 if ( vlen > maxstrlen )
2657 /* we should have at least one value at this point */
2660 keys = slap_sl_malloc( sizeof( struct berval ) * (i+1), ctx );
2661 for ( i = 0; !BER_BVISNULL( &values[i] ); i++ ) {
2662 keys[i].bv_len = index_intlen;
2663 keys[i].bv_val = slap_sl_malloc( index_intlen, ctx );
2666 keys[i].bv_val = NULL;
2668 if ( vlen > sizeof(ibuf) ) {
2669 itmp.bv_val = slap_sl_malloc( vlen, ctx );
2673 itmp.bv_len = sizeof(ibuf);
2675 for ( i=0; !BER_BVISNULL( &values[i] ); i++ ) {
2676 if ( itmp.bv_val != ibuf ) {
2677 itmp.bv_len = values[i].bv_len;
2678 if ( itmp.bv_len <= sizeof(ibuf) )
2679 itmp.bv_len = sizeof(ibuf);
2680 else if ( itmp.bv_len > maxstrlen )
2681 itmp.bv_len = maxstrlen;
2683 rc = integerVal2Key( &values[i], &keys[i], &itmp, ctx );
2689 if ( itmp.bv_val != ibuf ) {
2690 slap_sl_free( itmp.bv_val, ctx );
2695 /* Index generation function: Ordered index */
2702 struct berval *prefix,
2703 void * assertedValue,
2710 struct berval *value;
2713 value = (struct berval *) assertedValue;
2715 keys = slap_sl_malloc( sizeof( struct berval ) * 2, ctx );
2717 keys[0].bv_len = index_intlen;
2718 keys[0].bv_val = slap_sl_malloc( index_intlen, ctx );
2720 keys[1].bv_val = NULL;
2722 iv.bv_len = value->bv_len < index_intlen_strlen + INDEX_INTLEN_CHOP-1
2723 ? value->bv_len : index_intlen_strlen + INDEX_INTLEN_CHOP-1;
2724 if ( iv.bv_len > (int) sizeof(ibuf) ) {
2725 iv.bv_val = slap_sl_malloc( iv.bv_len, ctx );
2728 iv.bv_len = sizeof(ibuf);
2731 rc = integerVal2Key( value, keys, &iv, ctx );
2735 if ( iv.bv_val != ibuf ) {
2736 slap_sl_free( iv.bv_val, ctx );
2742 countryStringValidate(
2744 struct berval *val )
2746 if( val->bv_len != 2 ) return LDAP_INVALID_SYNTAX;
2748 if( !SLAP_PRINTABLE(val->bv_val[0]) ) {
2749 return LDAP_INVALID_SYNTAX;
2751 if( !SLAP_PRINTABLE(val->bv_val[1]) ) {
2752 return LDAP_INVALID_SYNTAX;
2755 return LDAP_SUCCESS;
2759 printableStringValidate(
2761 struct berval *val )
2765 if( BER_BVISEMPTY( val ) ) return LDAP_INVALID_SYNTAX;
2767 for(i=0; i < val->bv_len; i++) {
2768 if( !SLAP_PRINTABLE(val->bv_val[i]) ) {
2769 return LDAP_INVALID_SYNTAX;
2773 return LDAP_SUCCESS;
2777 printablesStringValidate(
2779 struct berval *val )
2783 if( BER_BVISEMPTY( val ) ) return LDAP_INVALID_SYNTAX;
2785 for(i=0,len=0; i < val->bv_len; i++) {
2786 int c = val->bv_val[i];
2790 return LDAP_INVALID_SYNTAX;
2794 } else if ( SLAP_PRINTABLE(c) ) {
2797 return LDAP_INVALID_SYNTAX;
2802 return LDAP_INVALID_SYNTAX;
2805 return LDAP_SUCCESS;
2811 struct berval *val )
2815 for(i=0; i < val->bv_len; i++) {
2816 if( !LDAP_ASCII(val->bv_val[i]) ) {
2817 return LDAP_INVALID_SYNTAX;
2821 return LDAP_SUCCESS;
2830 struct berval *normalized,
2834 int casefold = !SLAP_MR_ASSOCIATED( mr,
2835 slap_schema.si_mr_caseExactIA5Match );
2837 assert( SLAP_MR_IS_VALUE_OF_SYNTAX( use ) != 0 );
2841 /* Ignore initial whitespace */
2842 while ( ASCII_SPACE( *p ) ) p++;
2844 normalized->bv_len = val->bv_len - ( p - val->bv_val );
2845 normalized->bv_val = slap_sl_malloc( normalized->bv_len + 1, ctx );
2846 AC_MEMCPY( normalized->bv_val, p, normalized->bv_len );
2847 normalized->bv_val[normalized->bv_len] = '\0';
2849 p = q = normalized->bv_val;
2852 if ( ASCII_SPACE( *p ) ) {
2855 /* Ignore the extra whitespace */
2856 while ( ASCII_SPACE( *p ) ) {
2860 } else if ( casefold ) {
2861 /* Most IA5 rules require casefolding */
2862 *q++ = TOLOWER(*p); p++;
2869 assert( normalized->bv_val <= p );
2873 * If the string ended in space, backup the pointer one
2874 * position. One is enough because the above loop collapsed
2875 * all whitespace to a single space.
2877 if ( q > normalized->bv_val && ASCII_SPACE( q[-1] ) ) --q;
2879 /* null terminate */
2882 normalized->bv_len = q - normalized->bv_val;
2884 return LDAP_SUCCESS;
2893 if( in->bv_len != 36 ) {
2894 return LDAP_INVALID_SYNTAX;
2897 for( i=0; i<36; i++ ) {
2903 if( in->bv_val[i] != '-' ) {
2904 return LDAP_INVALID_SYNTAX;
2908 if( !ASCII_HEX( in->bv_val[i]) ) {
2909 return LDAP_INVALID_SYNTAX;
2914 return LDAP_SUCCESS;
2925 int rc=LDAP_INVALID_SYNTAX;
2927 assert( in != NULL );
2928 assert( out != NULL );
2930 if( in->bv_len != 36 ) return LDAP_INVALID_SYNTAX;
2933 out->bv_val = slap_sl_malloc( out->bv_len + 1, ctx );
2935 for( i=0; i<36; i++ ) {
2941 if( in->bv_val[i] != '-' ) {
2944 out->bv_val[i] = '-';
2948 if( !ASCII_HEX( in->bv_val[i]) ) {
2951 out->bv_val[i] = TOLOWER( in->bv_val[i] );
2956 out->bv_val[ out->bv_len ] = '\0';
2960 slap_sl_free( out->bv_val, ctx );
2973 struct berval *normalized,
2976 unsigned char octet = '\0';
2980 if ( SLAP_MR_IS_DENORMALIZE( usage ) ) {
2981 /* NOTE: must be a normalized UUID */
2982 assert( val->bv_len == 16 );
2984 normalized->bv_val = slap_sl_malloc( LDAP_LUTIL_UUIDSTR_BUFSIZE, ctx );
2985 normalized->bv_len = lutil_uuidstr_from_normalized( val->bv_val,
2986 val->bv_len, normalized->bv_val, LDAP_LUTIL_UUIDSTR_BUFSIZE );
2987 assert( normalized->bv_len == STRLENOF( "BADBADBA-DBAD-0123-4567-BADBADBADBAD" ) );
2989 return LDAP_SUCCESS;
2992 normalized->bv_len = 16;
2993 normalized->bv_val = slap_sl_malloc( normalized->bv_len + 1, ctx );
2995 for( i=0, j=0; i<36; i++ ) {
2996 unsigned char nibble;
2997 if( val->bv_val[i] == '-' ) {
3000 } else if( ASCII_DIGIT( val->bv_val[i] ) ) {
3001 nibble = val->bv_val[i] - '0';
3003 } else if( ASCII_HEXLOWER( val->bv_val[i] ) ) {
3004 nibble = val->bv_val[i] - ('a'-10);
3006 } else if( ASCII_HEXUPPER( val->bv_val[i] ) ) {
3007 nibble = val->bv_val[i] - ('A'-10);
3010 slap_sl_free( normalized->bv_val, ctx );
3011 BER_BVZERO( normalized );
3012 return LDAP_INVALID_SYNTAX;
3017 normalized->bv_val[j>>1] = octet;
3019 octet = nibble << 4;
3024 normalized->bv_val[normalized->bv_len] = 0;
3025 return LDAP_SUCCESS;
3031 numericStringValidate(
3037 if( BER_BVISEMPTY( in ) ) return LDAP_INVALID_SYNTAX;
3039 for(i=0; i < in->bv_len; i++) {
3040 if( !SLAP_NUMERIC(in->bv_val[i]) ) {
3041 return LDAP_INVALID_SYNTAX;
3045 return LDAP_SUCCESS;
3049 numericStringNormalize(
3054 struct berval *normalized,
3057 /* removal all spaces */
3060 assert( !BER_BVISEMPTY( val ) );
3062 normalized->bv_val = slap_sl_malloc( val->bv_len + 1, ctx );
3065 q = normalized->bv_val;
3068 if ( ASCII_SPACE( *p ) ) {
3069 /* Ignore whitespace */
3076 /* we should have copied no more than is in val */
3077 assert( (q - normalized->bv_val) <= (p - val->bv_val) );
3079 /* null terminate */
3082 normalized->bv_len = q - normalized->bv_val;
3084 if( BER_BVISEMPTY( normalized ) ) {
3085 normalized->bv_val = slap_sl_realloc( normalized->bv_val, 2, ctx );
3086 normalized->bv_val[0] = ' ';
3087 normalized->bv_val[1] = '\0';
3088 normalized->bv_len = 1;
3091 return LDAP_SUCCESS;
3095 * Integer conversion macros that will use the largest available
3098 #if defined(HAVE_STRTOLL) && defined(HAVE_LONG_LONG)
3099 # define SLAP_STRTOL(n,e,b) strtoll(n,e,b)
3100 # define SLAP_LONG long long
3102 # define SLAP_STRTOL(n,e,b) strtol(n,e,b)
3103 # define SLAP_LONG long
3104 #endif /* HAVE_STRTOLL ... */
3112 struct berval *value,
3113 void *assertedValue )
3115 SLAP_LONG lValue, lAssertedValue;
3118 /* safe to assume integers are NUL terminated? */
3119 lValue = SLAP_STRTOL(value->bv_val, NULL, 10);
3120 if( errno == ERANGE )
3122 return LDAP_CONSTRAINT_VIOLATION;
3125 lAssertedValue = SLAP_STRTOL(((struct berval *)assertedValue)->bv_val,
3127 if( errno == ERANGE )
3129 return LDAP_CONSTRAINT_VIOLATION;
3132 *matchp = ((lValue & lAssertedValue) == lAssertedValue) ? 0 : 1;
3133 return LDAP_SUCCESS;
3142 struct berval *value,
3143 void *assertedValue )
3145 SLAP_LONG lValue, lAssertedValue;
3148 /* safe to assume integers are NUL terminated? */
3149 lValue = SLAP_STRTOL(value->bv_val, NULL, 10);
3150 if( errno == ERANGE )
3152 return LDAP_CONSTRAINT_VIOLATION;
3155 lAssertedValue = SLAP_STRTOL( ((struct berval *)assertedValue)->bv_val,
3157 if( errno == ERANGE )
3159 return LDAP_CONSTRAINT_VIOLATION;
3162 *matchp = ((lValue & lAssertedValue) != 0) ? 0 : -1;
3163 return LDAP_SUCCESS;
3167 checkNum( struct berval *in, struct berval *out )
3169 /* parse serialNumber */
3170 ber_len_t neg = 0, extra = 0;
3173 out->bv_val = in->bv_val;
3176 if ( out->bv_val[0] == '-' ) {
3181 if ( strncasecmp( out->bv_val, "0x", STRLENOF("0x") ) == 0 ) {
3182 first = out->bv_val[2];
3185 out->bv_len += STRLENOF("0x");
3186 for ( ; out->bv_len < in->bv_len; out->bv_len++ ) {
3187 if ( !ASCII_HEX( out->bv_val[out->bv_len] ) ) break;
3190 } else if ( out->bv_val[0] == '\'' ) {
3191 first = out->bv_val[1];
3194 out->bv_len += STRLENOF("'");
3196 for ( ; out->bv_len < in->bv_len; out->bv_len++ ) {
3197 if ( !ASCII_HEX( out->bv_val[out->bv_len] ) ) break;
3199 if ( strncmp( &out->bv_val[out->bv_len], "'H", STRLENOF("'H") ) != 0 ) {
3202 out->bv_len += STRLENOF("'H");
3205 first = out->bv_val[0];
3206 for ( ; out->bv_len < in->bv_len; out->bv_len++ ) {
3207 if ( !ASCII_DIGIT( out->bv_val[out->bv_len] ) ) break;
3211 if ( !( out->bv_len > neg ) ) {
3215 if ( ( out->bv_len > extra + 1 + neg ) && ( first == '0' ) ) {
3223 serialNumberAndIssuerCheck(
3231 if( in->bv_len < 3 ) return LDAP_INVALID_SYNTAX;
3233 if( in->bv_val[0] != '{' && in->bv_val[in->bv_len-1] != '}' ) {
3234 /* Parse old format */
3235 is->bv_val = ber_bvchr( in, '$' );
3236 if( BER_BVISNULL( is ) ) return LDAP_INVALID_SYNTAX;
3238 sn->bv_val = in->bv_val;
3239 sn->bv_len = is->bv_val - in->bv_val;
3242 is->bv_len = in->bv_len - (sn->bv_len + 1);
3244 /* eat leading zeros */
3245 for( n=0; n < (sn->bv_len-1); n++ ) {
3246 if( sn->bv_val[n] != '0' ) break;
3251 for( n=0; n < sn->bv_len; n++ ) {
3252 if( !ASCII_DIGIT(sn->bv_val[n]) ) return LDAP_INVALID_SYNTAX;
3256 /* Parse GSER format */
3261 HAVE_ALL = ( HAVE_ISSUER | HAVE_SN )
3265 struct berval x = *in;
3271 /* eat leading spaces */
3272 for ( ; (x.bv_val[0] == ' ') && x.bv_len; x.bv_val++, x.bv_len-- ) {
3276 /* should be at issuer or serialNumber NamedValue */
3277 if ( strncasecmp( x.bv_val, "issuer", STRLENOF("issuer") ) == 0 ) {
3278 if ( have & HAVE_ISSUER ) return LDAP_INVALID_SYNTAX;
3281 x.bv_val += STRLENOF("issuer");
3282 x.bv_len -= STRLENOF("issuer");
3284 if ( x.bv_val[0] != ' ' ) return LDAP_INVALID_SYNTAX;
3288 /* eat leading spaces */
3289 for ( ; (x.bv_val[0] == ' ') && x.bv_len; x.bv_val++, x.bv_len-- ) {
3293 /* For backward compatibility, this part is optional */
3294 if ( strncasecmp( x.bv_val, "rdnSequence:", STRLENOF("rdnSequence:") ) == 0 ) {
3295 x.bv_val += STRLENOF("rdnSequence:");
3296 x.bv_len -= STRLENOF("rdnSequence:");
3299 if ( x.bv_val[0] != '"' ) return LDAP_INVALID_SYNTAX;
3303 is->bv_val = x.bv_val;
3306 for ( ; is->bv_len < x.bv_len; ) {
3307 if ( is->bv_val[is->bv_len] != '"' ) {
3311 if ( is->bv_val[is->bv_len+1] == '"' ) {
3318 x.bv_val += is->bv_len + 1;
3319 x.bv_len -= is->bv_len + 1;
3321 have |= HAVE_ISSUER;
3323 } else if ( strncasecmp( x.bv_val, "serialNumber", STRLENOF("serialNumber") ) == 0 )
3325 if ( have & HAVE_SN ) return LDAP_INVALID_SYNTAX;
3327 /* parse serialNumber */
3328 x.bv_val += STRLENOF("serialNumber");
3329 x.bv_len -= STRLENOF("serialNumber");
3331 if ( x.bv_val[0] != ' ' ) return LDAP_INVALID_SYNTAX;
3335 /* eat leading spaces */
3336 for ( ; (x.bv_val[0] == ' ') && x.bv_len; x.bv_val++, x.bv_len-- ) {
3340 if ( checkNum( &x, sn ) ) {
3341 return LDAP_INVALID_SYNTAX;
3344 x.bv_val += sn->bv_len;
3345 x.bv_len -= sn->bv_len;
3350 return LDAP_INVALID_SYNTAX;
3353 /* eat leading spaces */
3354 for ( ; (x.bv_val[0] == ' ') && x.bv_len; x.bv_val++, x.bv_len-- ) {
3358 if ( have == HAVE_ALL ) {
3362 if ( x.bv_val[0] != ',' ) {
3363 return LDAP_INVALID_SYNTAX;
3370 /* should have no characters left... */
3371 if ( x.bv_len ) return LDAP_INVALID_SYNTAX;
3373 if ( numdquotes == 0 ) {
3374 ber_dupbv_x( &ni, is, ctx );
3379 ni.bv_len = is->bv_len - numdquotes;
3380 ni.bv_val = ber_memalloc_x( ni.bv_len + 1, ctx );
3381 for ( src = 0, dst = 0; src < is->bv_len; src++, dst++ ) {
3382 if ( is->bv_val[src] == '"' ) {
3385 ni.bv_val[dst] = is->bv_val[src];
3387 ni.bv_val[dst] = '\0';
3397 serialNumberAndIssuerValidate(
3402 struct berval sn, i;
3404 Debug( LDAP_DEBUG_TRACE, ">>> serialNumberAndIssuerValidate: <%s>\n",
3407 rc = serialNumberAndIssuerCheck( in, &sn, &i, NULL );
3412 /* validate DN -- doesn't handle double dquote */
3413 rc = dnValidate( NULL, &i );
3415 rc = LDAP_INVALID_SYNTAX;
3418 if ( in->bv_val[0] == '{' && in->bv_val[in->bv_len-1] == '}' ) {
3419 slap_sl_free( i.bv_val, NULL );
3422 Debug( LDAP_DEBUG_TRACE, "<<< serialNumberAndIssuerValidate: <%s> err=%d\n",
3423 in->bv_val, rc, 0 );
3430 serialNumberAndIssuerPretty(
3437 struct berval sn, i, ni = BER_BVNULL;
3440 assert( in != NULL );
3441 assert( out != NULL );
3445 Debug( LDAP_DEBUG_TRACE, ">>> serialNumberAndIssuerPretty: <%s>\n",
3448 rc = serialNumberAndIssuerCheck( in, &sn, &i, ctx );
3453 rc = dnPretty( syntax, &i, &ni, ctx );
3455 if ( in->bv_val[0] == '{' && in->bv_val[in->bv_len-1] == '}' ) {
3456 slap_sl_free( i.bv_val, ctx );
3460 rc = LDAP_INVALID_SYNTAX;
3464 /* make room from sn + "$" */
3465 out->bv_len = STRLENOF("{ serialNumber , issuer rdnSequence:\"\" }")
3466 + sn.bv_len + ni.bv_len;
3467 out->bv_val = slap_sl_malloc( out->bv_len + 1, ctx );
3469 if ( out->bv_val == NULL ) {
3476 p = lutil_strcopy( p, "{ serialNumber " /*}*/ );
3477 p = lutil_strbvcopy( p, &sn );
3478 p = lutil_strcopy( p, ", issuer rdnSequence:\"" );
3479 p = lutil_strbvcopy( p, &ni );
3480 p = lutil_strcopy( p, /*{*/ "\" }" );
3482 assert( p == &out->bv_val[out->bv_len] );
3485 Debug( LDAP_DEBUG_TRACE, "<<< serialNumberAndIssuerPretty: <%s> => <%s>\n",
3486 in->bv_val, rc == LDAP_SUCCESS ? out->bv_val : "(err)", 0 );
3488 slap_sl_free( ni.bv_val, ctx );
3490 return LDAP_SUCCESS;
3500 /* Use hex format. '123456789abcdef'H */
3501 unsigned char *ptr, zero = '\0';
3504 ber_len_t i, len, nlen;
3506 assert( in != NULL );
3507 assert( !BER_BVISNULL( in ) );
3508 assert( out != NULL );
3509 assert( !BER_BVISNULL( out ) );
3511 ptr = (unsigned char *)in->bv_val;
3514 /* Check for minimal encodings */
3516 if ( ptr[0] & 0x80 ) {
3517 if ( ( ptr[0] == 0xff ) && ( ptr[1] & 0x80 ) ) {
3521 } else if ( ptr[0] == 0 ) {
3522 if ( !( ptr[1] & 0x80 ) ) {
3529 } else if ( len == 0 ) {
3530 /* FIXME: this should not be possible,
3531 * since a value of zero would have length 1 */
3536 first = !( ptr[0] & 0xf0U );
3537 nlen = len * 2 - first + STRLENOF("''H"); /* quotes, H */
3538 if ( nlen >= out->bv_len ) {
3539 out->bv_val = slap_sl_malloc( nlen + 1, ctx );
3545 sprintf( sptr, "%01X", ( ptr[0] & 0x0fU ) );
3549 for ( ; i < len; i++ ) {
3550 sprintf( sptr, "%02X", ptr[i] );
3557 assert( sptr == &out->bv_val[nlen] );
3564 #define SLAP_SN_BUFLEN (64)
3567 * This routine is called by certificateExactNormalize when
3568 * certificateExactNormalize receives a search string instead of
3569 * a certificate. This routine checks if the search value is valid
3570 * and then returns the normalized value
3573 serialNumberAndIssuerNormalize(
3581 struct berval sn, sn2, sn3, i, ni;
3582 char sbuf2[SLAP_SN_BUFLEN];
3583 char sbuf3[SLAP_SN_BUFLEN];
3587 assert( in != NULL );
3588 assert( out != NULL );
3590 Debug( LDAP_DEBUG_TRACE, ">>> serialNumberAndIssuerNormalize: <%s>\n",
3593 rc = serialNumberAndIssuerCheck( in, &sn, &i, ctx );
3598 rc = dnNormalize( usage, syntax, mr, &i, &ni, ctx );
3600 if ( in->bv_val[0] == '{' && in->bv_val[in->bv_len-1] == '}' ) {
3601 slap_sl_free( i.bv_val, ctx );
3605 return LDAP_INVALID_SYNTAX;
3608 /* Convert sn to canonical hex */
3610 if ( sn.bv_len > sizeof( sbuf2 ) ) {
3611 sn2.bv_val = slap_sl_malloc( sn.bv_len, ctx );
3613 sn2.bv_len = sn.bv_len;
3615 sn3.bv_len = sizeof(sbuf3);
3616 if ( lutil_str2bin( &sn, &sn2, ctx ) || slap_bin2hex( &sn2, &sn3, ctx ) ) {
3617 rc = LDAP_INVALID_SYNTAX;
3621 out->bv_len = STRLENOF( "{ serialNumber , issuer rdnSequence:\"\" }" )
3622 + sn3.bv_len + ni.bv_len;
3623 out->bv_val = slap_sl_malloc( out->bv_len + 1, ctx );
3624 if ( out->bv_val == NULL ) {
3632 p = lutil_strcopy( p, "{ serialNumber " /*}*/ );
3633 p = lutil_strbvcopy( p, &sn3 );
3634 p = lutil_strcopy( p, ", issuer rdnSequence:\"" );
3635 p = lutil_strbvcopy( p, &ni );
3636 p = lutil_strcopy( p, /*{*/ "\" }" );
3638 assert( p == &out->bv_val[out->bv_len] );
3641 Debug( LDAP_DEBUG_TRACE, "<<< serialNumberAndIssuerNormalize: <%s> => <%s>\n",
3642 in->bv_val, rc == LDAP_SUCCESS ? out->bv_val : "(err)", 0 );
3644 if ( sn2.bv_val != sbuf2 ) {
3645 slap_sl_free( sn2.bv_val, ctx );
3648 if ( sn3.bv_val != sbuf3 ) {
3649 slap_sl_free( sn3.bv_val, ctx );
3652 slap_sl_free( ni.bv_val, ctx );
3658 certificateExactNormalize(
3663 struct berval *normalized,
3666 BerElementBuffer berbuf;
3667 BerElement *ber = (BerElement *)&berbuf;
3671 char serialbuf2[SLAP_SN_BUFLEN];
3672 struct berval sn, sn2 = BER_BVNULL;
3673 struct berval issuer_dn = BER_BVNULL, bvdn;
3675 int rc = LDAP_INVALID_SYNTAX;
3677 assert( val != NULL );
3679 Debug( LDAP_DEBUG_TRACE, ">>> certificateExactNormalize: <%p, %lu>\n",
3680 val->bv_val, val->bv_len, 0 );
3682 if ( BER_BVISEMPTY( val ) ) goto done;
3684 if ( SLAP_MR_IS_VALUE_OF_ASSERTION_SYNTAX(usage) ) {
3685 return serialNumberAndIssuerNormalize( 0, NULL, NULL, val, normalized, ctx );
3688 assert( SLAP_MR_IS_VALUE_OF_ATTRIBUTE_SYNTAX(usage) != 0 );
3690 ber_init2( ber, val, LBER_USE_DER );
3691 tag = ber_skip_tag( ber, &len ); /* Signed Sequence */
3692 tag = ber_skip_tag( ber, &len ); /* Sequence */
3693 tag = ber_peek_tag( ber, &len ); /* Optional version? */
3694 if ( tag == SLAP_X509_OPT_C_VERSION ) {
3695 tag = ber_skip_tag( ber, &len );
3696 tag = ber_get_int( ber, &i ); /* version */
3699 /* NOTE: move the test here from certificateValidate,
3700 * so that we can validate certs with serial longer
3701 * than sizeof(ber_int_t) */
3702 tag = ber_skip_tag( ber, &len ); /* serial */
3704 sn.bv_val = (char *)ber->ber_ptr;
3705 sn2.bv_val = serialbuf2;
3706 sn2.bv_len = sizeof(serialbuf2);
3707 if ( slap_bin2hex( &sn, &sn2, ctx ) ) {
3708 rc = LDAP_INVALID_SYNTAX;
3711 ber_skip_data( ber, len );
3713 tag = ber_skip_tag( ber, &len ); /* SignatureAlg */
3714 ber_skip_data( ber, len );
3715 tag = ber_peek_tag( ber, &len ); /* IssuerDN */
3716 len = ber_ptrlen( ber );
3717 bvdn.bv_val = val->bv_val + len;
3718 bvdn.bv_len = val->bv_len - len;
3720 rc = dnX509normalize( &bvdn, &issuer_dn );
3721 if ( rc != LDAP_SUCCESS ) goto done;
3723 normalized->bv_len = STRLENOF( "{ serialNumber , issuer rdnSequence:\"\" }" )
3724 + sn2.bv_len + issuer_dn.bv_len;
3725 normalized->bv_val = ch_malloc( normalized->bv_len + 1 );
3727 p = normalized->bv_val;
3729 p = lutil_strcopy( p, "{ serialNumber " /*}*/ );
3730 p = lutil_strbvcopy( p, &sn2 );
3731 p = lutil_strcopy( p, ", issuer rdnSequence:\"" );
3732 p = lutil_strbvcopy( p, &issuer_dn );
3733 p = lutil_strcopy( p, /*{*/ "\" }" );
3738 Debug( LDAP_DEBUG_TRACE, "<<< certificateExactNormalize: <%p, %lu> => <%s>\n",
3739 val->bv_val, val->bv_len, rc == LDAP_SUCCESS ? normalized->bv_val : "(err)" );
3741 if ( issuer_dn.bv_val ) ber_memfree( issuer_dn.bv_val );
3742 if ( sn2.bv_val != serialbuf2 ) ber_memfree_x( sn2.bv_val, ctx );
3747 /* X.509 PKI certificateList stuff */
3749 checkTime( struct berval *in, struct berval *out )
3753 char buf[STRLENOF("YYYYmmddHHMMSSZ") + 1];
3756 assert( in != NULL );
3757 assert( !BER_BVISNULL( in ) );
3758 assert( !BER_BVISEMPTY( in ) );
3760 if ( in->bv_len < STRLENOF( "YYmmddHHMMSSZ" ) ) {
3764 if ( out != NULL ) {
3765 assert( !BER_BVISNULL( out ) );
3766 assert( out->bv_len >= sizeof( buf ) );
3767 bv.bv_val = out->bv_val;
3773 for ( i = 0; i < STRLENOF( "YYYYmmddHHMMSS" ); i++ ) {
3774 if ( !ASCII_DIGIT( in->bv_val[i] ) ) break;
3777 if ( in->bv_val[i] != 'Z' ) {
3782 if ( i != in->bv_len ) {
3786 if ( i == STRLENOF( "YYYYmmddHHMMSSZ" ) ) {
3787 lutil_strncopy( bv.bv_val, in->bv_val, i );
3790 } else if ( i == STRLENOF( "YYmmddHHMMSSZ" ) ) {
3791 char *p = bv.bv_val;
3792 if ( in->bv_val[0] < '7' ) {
3793 p = lutil_strcopy( p, "20" );
3796 p = lutil_strcopy( p, "19" );
3798 lutil_strncopy( p, in->bv_val, i );
3805 rc = generalizedTimeValidate( NULL, &bv );
3806 if ( rc == LDAP_SUCCESS && out != NULL ) {
3807 if ( out->bv_len > bv.bv_len ) {
3808 out->bv_val[ bv.bv_len ] = '\0';
3810 out->bv_len = bv.bv_len;
3813 return rc != LDAP_SUCCESS;
3817 issuerAndThisUpdateCheck(
3824 struct berval x = *in;
3825 struct berval ni = BER_BVNULL;
3826 /* Parse GSER format */
3830 HAVE_THISUPDATE = 0x2,
3831 HAVE_ALL = ( HAVE_ISSUER | HAVE_THISUPDATE )
3835 if ( in->bv_len < STRLENOF( "{issuer \"\",thisUpdate \"YYMMDDhhmmssZ\"}" ) ) return LDAP_INVALID_SYNTAX;
3837 if ( in->bv_val[0] != '{' && in->bv_val[in->bv_len-1] != '}' ) {
3838 return LDAP_INVALID_SYNTAX;
3842 x.bv_len -= STRLENOF("{}");
3845 /* eat leading spaces */
3846 for ( ; (x.bv_val[0] == ' ') && x.bv_len; x.bv_val++, x.bv_len-- ) {
3850 /* should be at issuer or thisUpdate */
3851 if ( strncasecmp( x.bv_val, "issuer", STRLENOF("issuer") ) == 0 ) {
3852 if ( have & HAVE_ISSUER ) return LDAP_INVALID_SYNTAX;
3855 x.bv_val += STRLENOF("issuer");
3856 x.bv_len -= STRLENOF("issuer");
3858 if ( x.bv_val[0] != ' ' ) return LDAP_INVALID_SYNTAX;
3862 /* eat leading spaces */
3863 for ( ; (x.bv_val[0] == ' ') && x.bv_len; x.bv_val++, x.bv_len-- ) {
3867 /* For backward compatibility, this part is optional */
3868 if ( strncasecmp( x.bv_val, "rdnSequence:", STRLENOF("rdnSequence:") ) != 0 ) {
3869 return LDAP_INVALID_SYNTAX;
3871 x.bv_val += STRLENOF("rdnSequence:");
3872 x.bv_len -= STRLENOF("rdnSequence:");
3874 if ( x.bv_val[0] != '"' ) return LDAP_INVALID_SYNTAX;
3878 is->bv_val = x.bv_val;
3881 for ( ; is->bv_len < x.bv_len; ) {
3882 if ( is->bv_val[is->bv_len] != '"' ) {
3886 if ( is->bv_val[is->bv_len+1] == '"' ) {
3893 x.bv_val += is->bv_len + 1;
3894 x.bv_len -= is->bv_len + 1;
3896 have |= HAVE_ISSUER;
3898 } else if ( strncasecmp( x.bv_val, "thisUpdate", STRLENOF("thisUpdate") ) == 0 )
3900 if ( have & HAVE_THISUPDATE ) return LDAP_INVALID_SYNTAX;
3902 /* parse thisUpdate */
3903 x.bv_val += STRLENOF("thisUpdate");
3904 x.bv_len -= STRLENOF("thisUpdate");
3906 if ( x.bv_val[0] != ' ' ) return LDAP_INVALID_SYNTAX;
3910 /* eat leading spaces */
3911 for ( ; (x.bv_val[0] == ' ') && x.bv_len; x.bv_val++, x.bv_len-- ) {
3915 if ( x.bv_val[0] != '"' ) return LDAP_INVALID_SYNTAX;
3919 tu->bv_val = x.bv_val;
3922 for ( ; tu->bv_len < x.bv_len; tu->bv_len++ ) {
3923 if ( tu->bv_val[tu->bv_len] == '"' ) {
3927 x.bv_val += tu->bv_len + 1;
3928 x.bv_len -= tu->bv_len + 1;
3930 have |= HAVE_THISUPDATE;
3933 return LDAP_INVALID_SYNTAX;
3936 /* eat leading spaces */
3937 for ( ; (x.bv_val[0] == ' ') && x.bv_len; x.bv_val++, x.bv_len-- ) {
3941 if ( have == HAVE_ALL ) {
3945 if ( x.bv_val[0] != ',' ) {
3946 return LDAP_INVALID_SYNTAX;
3953 /* should have no characters left... */
3954 if ( x.bv_len ) return LDAP_INVALID_SYNTAX;
3956 if ( numdquotes == 0 ) {
3957 ber_dupbv_x( &ni, is, ctx );
3962 ni.bv_len = is->bv_len - numdquotes;
3963 ni.bv_val = ber_memalloc_x( ni.bv_len + 1, ctx );
3964 for ( src = 0, dst = 0; src < is->bv_len; src++, dst++ ) {
3965 if ( is->bv_val[src] == '"' ) {
3968 ni.bv_val[dst] = is->bv_val[src];
3970 ni.bv_val[dst] = '\0';
3979 issuerAndThisUpdateValidate(
3984 struct berval i, tu;
3986 Debug( LDAP_DEBUG_TRACE, ">>> issuerAndThisUpdateValidate: <%s>\n",
3989 rc = issuerAndThisUpdateCheck( in, &i, &tu, NULL );
3994 /* validate DN -- doesn't handle double dquote */
3995 rc = dnValidate( NULL, &i );
3997 rc = LDAP_INVALID_SYNTAX;
3999 } else if ( checkTime( &tu, NULL ) ) {
4000 rc = LDAP_INVALID_SYNTAX;
4003 if ( in->bv_val[0] == '{' && in->bv_val[in->bv_len-1] == '}' ) {
4004 slap_sl_free( i.bv_val, NULL );
4007 Debug( LDAP_DEBUG_TRACE, "<<< issuerAndThisUpdateValidate: <%s> err=%d\n",
4008 in->bv_val, rc, 0 );
4015 issuerAndThisUpdatePretty(
4022 struct berval i, tu, ni = BER_BVNULL;
4025 assert( in != NULL );
4026 assert( out != NULL );
4030 Debug( LDAP_DEBUG_TRACE, ">>> issuerAndThisUpdatePretty: <%s>\n",
4033 rc = issuerAndThisUpdateCheck( in, &i, &tu, ctx );
4038 rc = dnPretty( syntax, &i, &ni, ctx );
4040 if ( in->bv_val[0] == '{' && in->bv_val[in->bv_len-1] == '}' ) {
4041 slap_sl_free( i.bv_val, ctx );
4044 if ( rc || checkTime( &tu, NULL ) ) {
4045 rc = LDAP_INVALID_SYNTAX;
4050 out->bv_len = STRLENOF("{ issuer rdnSequence:\"\", thisUpdate \"\" }")
4051 + ni.bv_len + tu.bv_len;
4052 out->bv_val = slap_sl_malloc( out->bv_len + 1, ctx );
4054 if ( out->bv_val == NULL ) {
4061 p = lutil_strcopy( p, "{ issuer rdnSequence:\"" /*}*/ );
4062 p = lutil_strbvcopy( p, &ni );
4063 p = lutil_strcopy( p, "\", thisUpdate \"" );
4064 p = lutil_strbvcopy( p, &tu );
4065 p = lutil_strcopy( p, /*{*/ "\" }" );
4067 assert( p == &out->bv_val[out->bv_len] );
4070 Debug( LDAP_DEBUG_TRACE, "<<< issuerAndThisUpdatePretty: <%s> => <%s>\n",
4071 in->bv_val, rc == LDAP_SUCCESS ? out->bv_val : "(err)", 0 );
4073 slap_sl_free( ni.bv_val, ctx );
4079 issuerAndThisUpdateNormalize(
4087 struct berval i, ni, tu, tu2;
4088 char sbuf[STRLENOF("YYYYmmddHHMMSSZ") + 1];
4092 assert( in != NULL );
4093 assert( out != NULL );
4095 Debug( LDAP_DEBUG_TRACE, ">>> issuerAndThisUpdateNormalize: <%s>\n",
4098 rc = issuerAndThisUpdateCheck( in, &i, &tu, ctx );
4103 rc = dnNormalize( usage, syntax, mr, &i, &ni, ctx );
4105 if ( in->bv_val[0] == '{' && in->bv_val[in->bv_len-1] == '}' ) {
4106 slap_sl_free( i.bv_val, ctx );
4110 tu2.bv_len = sizeof( sbuf );
4111 if ( rc || checkTime( &tu, &tu2 ) ) {
4112 return LDAP_INVALID_SYNTAX;
4115 out->bv_len = STRLENOF( "{ issuer rdnSequence:\"\", thisUpdate \"\" }" )
4116 + ni.bv_len + tu2.bv_len;
4117 out->bv_val = slap_sl_malloc( out->bv_len + 1, ctx );
4119 if ( out->bv_val == NULL ) {
4127 p = lutil_strcopy( p, "{ issuer rdnSequence:\"" /*}*/ );
4128 p = lutil_strbvcopy( p, &ni );
4129 p = lutil_strcopy( p, "\", thisUpdate \"" );
4130 p = lutil_strbvcopy( p, &tu2 );
4131 p = lutil_strcopy( p, /*{*/ "\" }" );
4133 assert( p == &out->bv_val[out->bv_len] );
4136 Debug( LDAP_DEBUG_TRACE, "<<< issuerAndThisUpdateNormalize: <%s> => <%s>\n",
4137 in->bv_val, rc == LDAP_SUCCESS ? out->bv_val : "(err)", 0 );
4139 slap_sl_free( ni.bv_val, ctx );
4145 certificateListExactNormalize(
4150 struct berval *normalized,
4153 BerElementBuffer berbuf;
4154 BerElement *ber = (BerElement *)&berbuf;
4158 struct berval issuer_dn = BER_BVNULL, bvdn,
4160 char *p, tubuf[STRLENOF("YYYYmmddHHMMSSZ") + 1];
4161 int rc = LDAP_INVALID_SYNTAX;
4163 assert( val != NULL );
4165 Debug( LDAP_DEBUG_TRACE, ">>> certificateListExactNormalize: <%p, %lu>\n",
4166 val->bv_val, val->bv_len, 0 );
4168 if ( BER_BVISEMPTY( val ) ) goto done;
4170 if ( SLAP_MR_IS_VALUE_OF_ASSERTION_SYNTAX(usage) ) {
4171 return issuerAndThisUpdateNormalize( 0, NULL, NULL, val, normalized, ctx );
4174 assert( SLAP_MR_IS_VALUE_OF_ATTRIBUTE_SYNTAX(usage) != 0 );
4176 ber_init2( ber, val, LBER_USE_DER );
4177 tag = ber_skip_tag( ber, &len ); /* Signed wrapper */
4178 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
4179 tag = ber_skip_tag( ber, &len ); /* Sequence */
4180 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
4181 tag = ber_peek_tag( ber, &len );
4182 /* Optional version */
4183 if ( tag == LBER_INTEGER ) {
4184 tag = ber_get_int( ber, &version );
4185 assert( tag == LBER_INTEGER );
4186 if ( version != SLAP_X509_V2 ) return LDAP_INVALID_SYNTAX;
4188 tag = ber_skip_tag( ber, &len ); /* Signature Algorithm */
4189 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
4190 ber_skip_data( ber, len );
4192 tag = ber_peek_tag( ber, &len ); /* IssuerDN */
4193 if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
4194 len = ber_ptrlen( ber );
4195 bvdn.bv_val = val->bv_val + len;
4196 bvdn.bv_len = val->bv_len - len;
4197 tag = ber_skip_tag( ber, &len );
4198 ber_skip_data( ber, len );
4200 tag = ber_skip_tag( ber, &len ); /* thisUpdate */
4201 /* Time is a CHOICE { UTCTime, GeneralizedTime } */
4202 if ( tag != SLAP_TAG_UTCTIME && tag != SLAP_TAG_GENERALIZEDTIME ) return LDAP_INVALID_SYNTAX;
4203 bvtu.bv_val = (char *)ber->ber_ptr;
4206 rc = dnX509normalize( &bvdn, &issuer_dn );
4207 if ( rc != LDAP_SUCCESS ) goto done;
4209 thisUpdate.bv_val = tubuf;
4210 thisUpdate.bv_len = sizeof(tubuf);
4211 if ( checkTime( &bvtu, &thisUpdate ) ) {
4212 rc = LDAP_INVALID_SYNTAX;
4216 normalized->bv_len = STRLENOF( "{ issuer rdnSequence:\"\", thisUpdate \"\" }" )
4217 + issuer_dn.bv_len + thisUpdate.bv_len;
4218 normalized->bv_val = ch_malloc( normalized->bv_len + 1 );
4220 p = normalized->bv_val;
4222 p = lutil_strcopy( p, "{ issuer rdnSequence:\"" );
4223 p = lutil_strbvcopy( p, &issuer_dn );
4224 p = lutil_strcopy( p, "\", thisUpdate \"" );
4225 p = lutil_strbvcopy( p, &thisUpdate );
4226 p = lutil_strcopy( p, /*{*/ "\" }" );
4231 Debug( LDAP_DEBUG_TRACE, "<<< certificateListExactNormalize: <%p, %lu> => <%s>\n",
4232 val->bv_val, val->bv_len, rc == LDAP_SUCCESS ? normalized->bv_val : "(err)" );
4234 if ( issuer_dn.bv_val ) ber_memfree( issuer_dn.bv_val );
4239 /* X.509 PMI serialNumberAndIssuerSerialCheck
4241 AttributeCertificateExactAssertion ::= SEQUENCE {
4242 serialNumber CertificateSerialNumber,
4243 issuer AttCertIssuer }
4245 CertificateSerialNumber ::= INTEGER
4247 AttCertIssuer ::= [0] SEQUENCE {
4248 issuerName GeneralNames OPTIONAL,
4249 baseCertificateID [0] IssuerSerial OPTIONAL,
4250 objectDigestInfo [1] ObjectDigestInfo OPTIONAL }
4251 -- At least one component shall be present
4253 GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
4255 GeneralName ::= CHOICE {
4256 otherName [0] INSTANCE OF OTHER-NAME,
4257 rfc822Name [1] IA5String,
4258 dNSName [2] IA5String,
4259 x400Address [3] ORAddress,
4260 directoryName [4] Name,
4261 ediPartyName [5] EDIPartyName,
4262 uniformResourceIdentifier [6] IA5String,
4263 iPAddress [7] OCTET STRING,
4264 registeredID [8] OBJECT IDENTIFIER }
4266 IssuerSerial ::= SEQUENCE {
4267 issuer GeneralNames,
4268 serial CertificateSerialNumber,
4269 issuerUID UniqueIdentifier OPTIONAL }
4271 ObjectDigestInfo ::= SEQUENCE {
4272 digestedObjectType ENUMERATED {
4275 otherObjectTypes (2) },
4276 otherObjectTypeID OBJECT IDENTIFIER OPTIONAL,
4277 digestAlgorithm AlgorithmIdentifier,
4278 objectDigest BIT STRING }
4280 * The way I interpret it, an assertion should look like
4282 { serialNumber 'dd'H,
4283 issuer { issuerName { directoryName:rdnSequence:"cn=yyy" }, -- optional
4284 baseCertificateID { serial '1d'H,
4285 issuer { directoryName:rdnSequence:"cn=zzz" },
4286 issuerUID <value> -- optional
4288 objectDigestInfo { ... } -- optional
4292 * with issuerName, baseCertificateID and objectDigestInfo optional,
4293 * at least one present; the way it's currently implemented, it is
4295 { serialNumber 'dd'H,
4296 issuer { baseCertificateID { serial '1d'H,
4297 issuer { directoryName:rdnSequence:"cn=zzz" }
4302 * with all the above parts mandatory.
4305 serialNumberAndIssuerSerialCheck(
4309 struct berval *i_sn, /* contain serial of baseCertificateID */
4312 /* Parse GSER format */
4317 HAVE_ALL = ( HAVE_SN | HAVE_ISSUER )
4318 } have = HAVE_NONE, have2 = HAVE_NONE;
4320 struct berval x = *in;
4323 if ( in->bv_len < 3 ) return LDAP_INVALID_SYNTAX;
4326 if ( in->bv_val[0] != '{' && in->bv_val[in->bv_len-1] != '}' ) return LDAP_INVALID_SYNTAX;
4333 /* eat leading spaces */
4334 for ( ; (x.bv_val[0] == ' ') && x.bv_len; x.bv_val++, x.bv_len-- ) {
4338 /* should be at issuer or serialNumber NamedValue */
4339 if ( strncasecmp( x.bv_val, "issuer", STRLENOF("issuer") ) == 0 ) {
4340 if ( have & HAVE_ISSUER ) {
4341 return LDAP_INVALID_SYNTAX;
4344 /* parse IssuerSerial */
4345 x.bv_val += STRLENOF("issuer");
4346 x.bv_len -= STRLENOF("issuer");
4348 if ( x.bv_val[0] != ' ' ) return LDAP_INVALID_SYNTAX;
4352 /* eat leading spaces */
4353 for ( ; (x.bv_val[0] == ' ') && x.bv_len; x.bv_val++, x.bv_len-- ) {
4357 if ( x.bv_val[0] != '{' /*}*/ ) return LDAP_INVALID_SYNTAX;
4361 /* eat leading spaces */
4362 for ( ; (x.bv_val[0] == ' ') && x.bv_len; x.bv_val++, x.bv_len-- ) {
4366 if ( strncasecmp( x.bv_val, "baseCertificateID ", STRLENOF("baseCertificateID ") ) != 0 ) {
4367 return LDAP_INVALID_SYNTAX;
4369 x.bv_val += STRLENOF("baseCertificateID ");
4370 x.bv_len -= STRLENOF("baseCertificateID ");
4372 /* eat leading spaces */
4373 for ( ; (x.bv_val[0] == ' ') && x.bv_len; x.bv_val++, x.bv_len-- ) {
4377 if ( x.bv_val[0] != '{' /*}*/ ) return LDAP_INVALID_SYNTAX;
4382 /* eat leading spaces */
4383 for ( ; (x.bv_val[0] == ' ') && x.bv_len; x.bv_val++, x.bv_len-- ) {
4387 /* parse issuer of baseCertificateID */
4388 if ( strncasecmp( x.bv_val, "issuer ", STRLENOF("issuer ") ) == 0 ) {
4389 if ( have2 & HAVE_ISSUER ) {
4390 return LDAP_INVALID_SYNTAX;
4393 x.bv_val += STRLENOF("issuer ");
4394 x.bv_len -= STRLENOF("issuer ");
4396 /* eat leading spaces */
4397 for ( ; (x.bv_val[0] == ' ') && x.bv_len; x.bv_val++, x.bv_len-- ) {
4401 if ( x.bv_val[0] != '{' /*}*/ ) return LDAP_INVALID_SYNTAX;
4405 /* eat leading spaces */
4406 for ( ; (x.bv_val[0] == ' ') && x.bv_len; x.bv_val++, x.bv_len-- ) {
4410 if ( strncasecmp( x.bv_val, "directoryName:rdnSequence:", STRLENOF("directoryName:rdnSequence:") ) != 0 ) {
4411 return LDAP_INVALID_SYNTAX;
4413 x.bv_val += STRLENOF("directoryName:rdnSequence:");
4414 x.bv_len -= STRLENOF("directoryName:rdnSequence:");
4416 if ( x.bv_val[0] != '"' ) return LDAP_INVALID_SYNTAX;
4420 is->bv_val = x.bv_val;
4423 for ( ; is->bv_len < x.bv_len; ) {
4424 if ( is->bv_val[is->bv_len] != '"' ) {
4428 if ( is->bv_val[is->bv_len + 1] == '"' ) {
4435 x.bv_val += is->bv_len + 1;
4436 x.bv_len -= is->bv_len + 1;
4438 /* eat leading spaces */
4439 for ( ; (x.bv_val[0] == ' ') && x.bv_len; x.bv_val++, x.bv_len-- ) {
4443 if ( x.bv_val[0] != /*{*/ '}' ) return LDAP_INVALID_SYNTAX;
4447 have2 |= HAVE_ISSUER;
4449 } else if ( strncasecmp( x.bv_val, "serial ", STRLENOF("serial ") ) == 0 ) {
4450 if ( have2 & HAVE_SN ) {
4451 return LDAP_INVALID_SYNTAX;
4454 x.bv_val += STRLENOF("serial ");
4455 x.bv_len -= STRLENOF("serial ");
4457 /* eat leading spaces */
4458 for ( ; (x.bv_val[0] == ' ') && x.bv_len; x.bv_val++, x.bv_len--) {
4462 if ( checkNum( &x, i_sn ) ) {
4463 return LDAP_INVALID_SYNTAX;
4466 x.bv_val += i_sn->bv_len;
4467 x.bv_len -= i_sn->bv_len;
4472 return LDAP_INVALID_SYNTAX;
4475 /* eat leading spaces */
4476 for ( ; (x.bv_val[0] == ' ') && x.bv_len; x.bv_val++, x.bv_len-- ) {
4480 if ( have2 == HAVE_ALL ) {
4484 if ( x.bv_val[0] != ',' ) return LDAP_INVALID_SYNTAX;
4489 if ( x.bv_val[0] != /*{*/ '}' ) return LDAP_INVALID_SYNTAX;
4493 /* eat leading spaces */
4494 for ( ; (x.bv_val[0] == ' ') && x.bv_len; x.bv_val++, x.bv_len-- ) {
4498 if ( x.bv_val[0] != /*{*/ '}' ) return LDAP_INVALID_SYNTAX;
4502 have |= HAVE_ISSUER;
4504 } else if ( strncasecmp( x.bv_val, "serialNumber", STRLENOF("serialNumber") ) == 0 ) {
4505 if ( have & HAVE_SN ) {
4506 return LDAP_INVALID_SYNTAX;
4509 /* parse serialNumber */
4510 x.bv_val += STRLENOF("serialNumber");
4511 x.bv_len -= STRLENOF("serialNumber");
4513 if ( x.bv_val[0] != ' ' ) return LDAP_INVALID_SYNTAX;
4517 /* eat leading spaces */
4518 for ( ; (x.bv_val[0] == ' ') && x.bv_len; x.bv_val++, x.bv_len-- ) {
4522 if ( checkNum( &x, sn ) ) {
4523 return LDAP_INVALID_SYNTAX;
4526 x.bv_val += sn->bv_len;
4527 x.bv_len -= sn->bv_len;
4532 return LDAP_INVALID_SYNTAX;
4536 for ( ; (x.bv_val[0] == ' ') && x.bv_len; x.bv_val++, x.bv_len-- ) {
4540 if ( have == HAVE_ALL ) {
4544 if ( x.bv_val[0] != ',' ) {
4545 return LDAP_INVALID_SYNTAX;
4551 /* should have no characters left... */
4552 if( x.bv_len ) return LDAP_INVALID_SYNTAX;
4554 if ( numdquotes == 0 ) {
4555 ber_dupbv_x( &ni, is, ctx );
4560 ni.bv_len = is->bv_len - numdquotes;
4561 ni.bv_val = ber_memalloc_x( ni.bv_len + 1, ctx );
4562 for ( src = 0, dst = 0; src < is->bv_len; src++, dst++ ) {
4563 if ( is->bv_val[src] == '"' ) {
4566 ni.bv_val[dst] = is->bv_val[src];
4568 ni.bv_val[dst] = '\0';
4573 /* need to handle double dquotes here */
4577 /* X.509 PMI serialNumberAndIssuerSerialValidate */
4579 serialNumberAndIssuerSerialValidate(
4584 struct berval sn, i, i_sn;
4586 Debug( LDAP_DEBUG_TRACE, ">>> serialNumberAndIssuerSerialValidate: <%s>\n",
4589 rc = serialNumberAndIssuerSerialCheck( in, &sn, &i, &i_sn, NULL );
4594 /* validate DN -- doesn't handle double dquote */
4595 rc = dnValidate( NULL, &i );
4597 rc = LDAP_INVALID_SYNTAX;
4600 if ( in->bv_val[0] == '{' && in->bv_val[in->bv_len-1] == '}' ) {
4601 slap_sl_free( i.bv_val, NULL );
4605 Debug( LDAP_DEBUG_TRACE, "<<< serialNumberAndIssuerSerialValidate: <%s> err=%d\n",
4606 in->bv_val, rc, 0 );
4611 /* X.509 PMI serialNumberAndIssuerSerialPretty */
4613 serialNumberAndIssuerSerialPretty(
4619 struct berval sn, i, i_sn, ni = BER_BVNULL;
4623 assert( in != NULL );
4624 assert( out != NULL );
4626 Debug( LDAP_DEBUG_TRACE, ">>> serialNumberAndIssuerSerialPretty: <%s>\n",
4629 rc = serialNumberAndIssuerSerialCheck( in, &sn, &i, &i_sn, ctx );
4634 rc = dnPretty( syntax, &i, &ni, ctx );
4636 if ( in->bv_val[0] == '{' && in->bv_val[in->bv_len-1] == '}' ) {
4637 slap_sl_free( i.bv_val, ctx );
4641 rc = LDAP_INVALID_SYNTAX;
4645 /* make room from sn + "$" */
4646 out->bv_len = STRLENOF("{ serialNumber , issuer { baseCertificateID { issuer { directoryName:rdnSequence:\"\" }, serial } } }")
4647 + sn.bv_len + ni.bv_len + i_sn.bv_len;
4648 out->bv_val = slap_sl_malloc( out->bv_len + 1, ctx );
4650 if ( out->bv_val == NULL ) {
4657 p = lutil_strcopy( p, "{ serialNumber " );
4658 p = lutil_strbvcopy( p, &sn );
4659 p = lutil_strcopy( p, ", issuer { baseCertificateID { issuer { directoryName:rdnSequence:\"" );
4660 p = lutil_strbvcopy( p, &ni );
4661 p = lutil_strcopy( p, "\" }, serial " );
4662 p = lutil_strbvcopy( p, &i_sn );
4663 p = lutil_strcopy( p, " } } }" );
4665 assert( p == &out->bv_val[out->bv_len] );
4668 Debug( LDAP_DEBUG_TRACE, "<<< serialNumberAndIssuerSerialPretty: <%s> => <%s>\n",
4669 in->bv_val, rc == LDAP_SUCCESS ? out->bv_val : "(err)", 0 );
4671 slap_sl_free( ni.bv_val, ctx );
4676 /* X.509 PMI serialNumberAndIssuerSerialNormalize */
4678 * This routine is called by attributeCertificateExactNormalize
4679 * when attributeCertificateExactNormalize receives a search
4680 * string instead of a attribute certificate. This routine
4681 * checks if the search value is valid and then returns the
4685 serialNumberAndIssuerSerialNormalize(
4693 struct berval i, ni = BER_BVNULL,
4694 sn, sn2 = BER_BVNULL, sn3 = BER_BVNULL,
4695 i_sn, i_sn2 = BER_BVNULL, i_sn3 = BER_BVNULL;
4696 char sbuf2[SLAP_SN_BUFLEN], i_sbuf2[SLAP_SN_BUFLEN],
4697 sbuf3[SLAP_SN_BUFLEN], i_sbuf3[SLAP_SN_BUFLEN];
4701 assert( in != NULL );
4702 assert( out != NULL );
4704 Debug( LDAP_DEBUG_TRACE, ">>> serialNumberAndIssuerSerialNormalize: <%s>\n",
4707 rc = serialNumberAndIssuerSerialCheck( in, &sn, &i, &i_sn, ctx );
4712 rc = dnNormalize( usage, syntax, mr, &i, &ni, ctx );
4714 if ( in->bv_val[0] == '{' && in->bv_val[in->bv_len-1] == '}' ) {
4715 slap_sl_free( i.bv_val, ctx );
4719 rc = LDAP_INVALID_SYNTAX;
4723 /* Convert sn to canonical hex */
4725 sn2.bv_len = sn.bv_len;
4726 if ( sn.bv_len > sizeof( sbuf2 ) ) {
4727 sn2.bv_val = slap_sl_malloc( sn.bv_len, ctx );
4729 if ( lutil_str2bin( &sn, &sn2, ctx ) ) {
4730 rc = LDAP_INVALID_SYNTAX;
4734 /* Convert i_sn to canonical hex */
4735 i_sn2.bv_val = i_sbuf2;
4736 i_sn2.bv_len = i_sn.bv_len;
4737 if ( i_sn.bv_len > sizeof( i_sbuf2 ) ) {
4738 i_sn2.bv_val = slap_sl_malloc( i_sn.bv_len, ctx );
4740 if ( lutil_str2bin( &i_sn, &i_sn2, ctx ) ) {
4741 rc = LDAP_INVALID_SYNTAX;
4746 sn3.bv_len = sizeof(sbuf3);
4747 if ( slap_bin2hex( &sn2, &sn3, ctx ) ) {
4748 rc = LDAP_INVALID_SYNTAX;
4752 i_sn3.bv_val = i_sbuf3;
4753 i_sn3.bv_len = sizeof(i_sbuf3);
4754 if ( slap_bin2hex( &i_sn2, &i_sn3, ctx ) ) {
4755 rc = LDAP_INVALID_SYNTAX;
4759 out->bv_len = STRLENOF("{ serialNumber , issuer { baseCertificateID { issuer { directoryName:rdnSequence:\"\" }, serial } } }")
4760 + sn3.bv_len + ni.bv_len + i_sn3.bv_len;
4761 out->bv_val = slap_sl_malloc( out->bv_len + 1, ctx );
4763 if ( out->bv_val == NULL ) {
4771 p = lutil_strcopy( p, "{ serialNumber " );
4772 p = lutil_strbvcopy( p, &sn3 );
4773 p = lutil_strcopy( p, ", issuer { baseCertificateID { issuer { directoryName:rdnSequence:\"" );
4774 p = lutil_strbvcopy( p, &ni );
4775 p = lutil_strcopy( p, "\" }, serial " );
4776 p = lutil_strbvcopy( p, &i_sn3 );
4777 p = lutil_strcopy( p, " } } }" );
4779 assert( p == &out->bv_val[out->bv_len] );
4782 Debug( LDAP_DEBUG_TRACE, "<<< serialNumberAndIssuerSerialNormalize: <%s> => <%s>\n",
4783 in->bv_val, rc == LDAP_SUCCESS ? out->bv_val : "(err)", 0 );
4785 if ( sn2.bv_val != sbuf2 ) {
4786 slap_sl_free( sn2.bv_val, ctx );
4789 if ( i_sn2.bv_val != i_sbuf2 ) {
4790 slap_sl_free( i_sn2.bv_val, ctx );
4793 if ( sn3.bv_val != sbuf3 ) {
4794 slap_sl_free( sn3.bv_val, ctx );
4797 if ( i_sn3.bv_val != i_sbuf3 ) {
4798 slap_sl_free( i_sn3.bv_val, ctx );
4801 slap_sl_free( ni.bv_val, ctx );
4806 /* X.509 PMI attributeCertificateExactNormalize */
4808 attributeCertificateExactNormalize(
4813 struct berval *normalized,
4816 BerElementBuffer berbuf;
4817 BerElement *ber = (BerElement *)&berbuf;
4820 char issuer_serialbuf[SLAP_SN_BUFLEN], serialbuf[SLAP_SN_BUFLEN];
4821 struct berval sn, i_sn, sn2 = BER_BVNULL, i_sn2 = BER_BVNULL;
4822 struct berval issuer_dn = BER_BVNULL, bvdn;
4824 int rc = LDAP_INVALID_SYNTAX;
4826 if ( BER_BVISEMPTY( val ) ) {
4830 if ( SLAP_MR_IS_VALUE_OF_ASSERTION_SYNTAX(usage) ) {
4831 return serialNumberAndIssuerSerialNormalize( 0, NULL, NULL, val, normalized, ctx );
4834 assert( SLAP_MR_IS_VALUE_OF_ATTRIBUTE_SYNTAX(usage) != 0 );
4836 ber_init2( ber, val, LBER_USE_DER );
4837 tag = ber_skip_tag( ber, &len ); /* Signed Sequence */
4838 tag = ber_skip_tag( ber, &len ); /* Sequence */
4839 tag = ber_skip_tag( ber, &len ); /* (Mandatory) version; must be v2(1) */
4840 ber_skip_data( ber, len );
4841 tag = ber_skip_tag( ber, &len ); /* Holder Sequence */
4842 ber_skip_data( ber, len );
4845 tag = ber_skip_tag( ber, &len ); /* Sequence */
4846 /* issuerName (GeneralNames sequence; optional)? */
4847 tag = ber_skip_tag( ber, &len ); /* baseCertificateID (sequence; optional)? */
4848 tag = ber_skip_tag( ber, &len ); /* GeneralNames (sequence) */
4849 tag = ber_skip_tag( ber, &len ); /* directoryName (we only accept this form of GeneralName) */
4850 if ( tag != SLAP_X509_GN_DIRECTORYNAME ) {
4851 return LDAP_INVALID_SYNTAX;
4853 tag = ber_peek_tag( ber, &len ); /* sequence of RDN */
4854 len = ber_ptrlen( ber );
4855 bvdn.bv_val = val->bv_val + len;
4856 bvdn.bv_len = val->bv_len - len;
4857 rc = dnX509normalize( &bvdn, &issuer_dn );
4858 if ( rc != LDAP_SUCCESS ) goto done;
4860 tag = ber_skip_tag( ber, &len ); /* sequence of RDN */
4861 ber_skip_data( ber, len );
4862 tag = ber_skip_tag( ber, &len ); /* serial number */
4863 if ( tag != LBER_INTEGER ) {
4864 rc = LDAP_INVALID_SYNTAX;
4867 i_sn.bv_val = (char *)ber->ber_ptr;
4869 i_sn2.bv_val = issuer_serialbuf;
4870 i_sn2.bv_len = sizeof(issuer_serialbuf);
4871 if ( slap_bin2hex( &i_sn, &i_sn2, ctx ) ) {
4872 rc = LDAP_INVALID_SYNTAX;
4875 ber_skip_data( ber, len );
4877 /* issuerUID (bitstring; optional)? */
4878 /* objectDigestInfo (sequence; optional)? */
4880 tag = ber_skip_tag( ber, &len ); /* Signature (sequence) */
4881 ber_skip_data( ber, len );
4882 tag = ber_skip_tag( ber, &len ); /* serial number */
4883 if ( tag != LBER_INTEGER ) {
4884 rc = LDAP_INVALID_SYNTAX;
4887 sn.bv_val = (char *)ber->ber_ptr;
4889 sn2.bv_val = serialbuf;
4890 sn2.bv_len = sizeof(serialbuf);
4891 if ( slap_bin2hex( &sn, &sn2, ctx ) ) {
4892 rc = LDAP_INVALID_SYNTAX;
4895 ber_skip_data( ber, len );
4897 normalized->bv_len = STRLENOF( "{ serialNumber , issuer { baseCertificateID { issuer { directoryName:rdnSequence:\"\" }, serial } } }" )
4898 + sn2.bv_len + issuer_dn.bv_len + i_sn2.bv_len;
4899 normalized->bv_val = ch_malloc( normalized->bv_len + 1 );
4901 p = normalized->bv_val;
4903 p = lutil_strcopy( p, "{ serialNumber " );
4904 p = lutil_strbvcopy( p, &sn2 );
4905 p = lutil_strcopy( p, ", issuer { baseCertificateID { issuer { directoryName:rdnSequence:\"" );
4906 p = lutil_strbvcopy( p, &issuer_dn );
4907 p = lutil_strcopy( p, "\" }, serial " );
4908 p = lutil_strbvcopy( p, &i_sn2 );
4909 p = lutil_strcopy( p, " } } }" );
4911 Debug( LDAP_DEBUG_TRACE, "attributeCertificateExactNormalize: %s\n",
4912 normalized->bv_val, NULL, NULL );
4917 if ( issuer_dn.bv_val ) ber_memfree( issuer_dn.bv_val );
4918 if ( i_sn2.bv_val != issuer_serialbuf ) ber_memfree_x( i_sn2.bv_val, ctx );
4919 if ( sn2.bv_val != serialbuf ) ber_memfree_x( sn2.bv_val, ctx );
4932 assert( in != NULL );
4933 assert( !BER_BVISNULL( in ) );
4935 for ( i = 0; i < in->bv_len; i++ ) {
4936 if ( !ASCII_HEX( in->bv_val[ i ] ) ) {
4937 return LDAP_INVALID_SYNTAX;
4941 return LDAP_SUCCESS;
4944 /* Normalize a SID as used inside a CSN:
4945 * three-digit numeric string */
4952 struct berval *normalized,
4957 assert( val != NULL );
4958 assert( normalized != NULL );
4960 ber_dupbv_x( normalized, val, ctx );
4962 for ( i = 0; i < normalized->bv_len; i++ ) {
4963 if ( !ASCII_HEX( normalized->bv_val[ i ] ) ) {
4964 ber_memfree_x( normalized->bv_val, ctx );
4965 BER_BVZERO( normalized );
4966 return LDAP_INVALID_SYNTAX;
4969 normalized->bv_val[ i ] = TOLOWER( normalized->bv_val[ i ] );
4972 return LDAP_SUCCESS;
4980 assert( in != NULL );
4981 assert( !BER_BVISNULL( in ) );
4983 if ( in->bv_len != 3 ) {
4984 return LDAP_INVALID_SYNTAX;
4987 return hexValidate( NULL, in );
4990 /* Normalize a SID as used inside a CSN:
4991 * three-digit numeric string */
4998 struct berval *normalized,
5001 if ( val->bv_len != 3 ) {
5002 return LDAP_INVALID_SYNTAX;
5005 return hexNormalize( 0, NULL, NULL, val, normalized, ctx );
5015 return sidNormalize( SLAP_MR_VALUE_OF_SYNTAX, NULL, NULL, val, out, ctx );
5018 /* Normalize a SID as used inside a CSN, either as-is
5019 * (assertion value) or extracted from the CSN
5020 * (attribute value) */
5027 struct berval *normalized,
5035 if ( BER_BVISEMPTY( val ) ) {
5036 return LDAP_INVALID_SYNTAX;
5039 if ( SLAP_MR_IS_VALUE_OF_ASSERTION_SYNTAX(usage) ) {
5040 return sidNormalize( 0, NULL, NULL, val, normalized, ctx );
5043 assert( SLAP_MR_IS_VALUE_OF_ATTRIBUTE_SYNTAX(usage) != 0 );
5045 ptr = ber_bvchr( val, '#' );
5046 if ( ptr == NULL || ptr == &val->bv_val[val->bv_len] ) {
5047 return LDAP_INVALID_SYNTAX;
5050 bv.bv_val = ptr + 1;
5051 bv.bv_len = val->bv_len - ( ptr + 1 - val->bv_val );
5053 ptr = ber_bvchr( &bv, '#' );
5054 if ( ptr == NULL || ptr == &val->bv_val[val->bv_len] ) {
5055 return LDAP_INVALID_SYNTAX;
5058 bv.bv_val = ptr + 1;
5059 bv.bv_len = val->bv_len - ( ptr + 1 - val->bv_val );
5061 ptr = ber_bvchr( &bv, '#' );
5062 if ( ptr == NULL || ptr == &val->bv_val[val->bv_len] ) {
5063 return LDAP_INVALID_SYNTAX;
5066 bv.bv_len = ptr - bv.bv_val;
5068 if ( bv.bv_len == 2 ) {
5069 /* OpenLDAP 2.3 SID */
5071 buf[ 1 ] = bv.bv_val[ 0 ];
5072 buf[ 2 ] = bv.bv_val[ 1 ];
5079 return sidNormalize( 0, NULL, NULL, &bv, normalized, ctx );
5091 assert( in != NULL );
5092 assert( !BER_BVISNULL( in ) );
5094 if ( BER_BVISEMPTY( in ) ) {
5095 return LDAP_INVALID_SYNTAX;
5100 ptr = ber_bvchr( &bv, '#' );
5101 if ( ptr == NULL || ptr == &bv.bv_val[bv.bv_len] ) {
5102 return LDAP_INVALID_SYNTAX;
5105 bv.bv_len = ptr - bv.bv_val;
5106 if ( bv.bv_len != STRLENOF( "YYYYmmddHHMMSS.uuuuuuZ" ) &&
5107 bv.bv_len != STRLENOF( "YYYYmmddHHMMSSZ" ) )
5109 return LDAP_INVALID_SYNTAX;
5112 rc = generalizedTimeValidate( NULL, &bv );
5113 if ( rc != LDAP_SUCCESS ) {
5117 bv.bv_val = ptr + 1;
5118 bv.bv_len = in->bv_len - ( bv.bv_val - in->bv_val );
5120 ptr = ber_bvchr( &bv, '#' );
5121 if ( ptr == NULL || ptr == &in->bv_val[in->bv_len] ) {
5122 return LDAP_INVALID_SYNTAX;
5125 bv.bv_len = ptr - bv.bv_val;
5126 if ( bv.bv_len != 6 ) {
5127 return LDAP_INVALID_SYNTAX;
5130 rc = hexValidate( NULL, &bv );
5131 if ( rc != LDAP_SUCCESS ) {
5135 bv.bv_val = ptr + 1;
5136 bv.bv_len = in->bv_len - ( bv.bv_val - in->bv_val );
5138 ptr = ber_bvchr( &bv, '#' );
5139 if ( ptr == NULL || ptr == &in->bv_val[in->bv_len] ) {
5140 return LDAP_INVALID_SYNTAX;
5143 bv.bv_len = ptr - bv.bv_val;
5144 if ( bv.bv_len == 2 ) {
5145 /* tolerate old 2-digit replica-id */
5146 rc = hexValidate( NULL, &bv );
5149 rc = sidValidate( NULL, &bv );
5151 if ( rc != LDAP_SUCCESS ) {
5155 bv.bv_val = ptr + 1;
5156 bv.bv_len = in->bv_len - ( bv.bv_val - in->bv_val );
5158 if ( bv.bv_len != 6 ) {
5159 return LDAP_INVALID_SYNTAX;
5162 return hexValidate( NULL, &bv );
5165 /* Normalize a CSN in OpenLDAP 2.1 format */
5172 struct berval *normalized,
5175 struct berval gt, cnt, sid, mod;
5177 char buf[ STRLENOF( "YYYYmmddHHMMSS.uuuuuuZ#SSSSSS#SID#ssssss" ) + 1 ];
5181 assert( SLAP_MR_IS_VALUE_OF_SYNTAX( usage ) != 0 );
5182 assert( !BER_BVISEMPTY( val ) );
5186 ptr = ber_bvchr( >, '#' );
5187 if ( ptr == NULL || ptr == >.bv_val[gt.bv_len] ) {
5188 return LDAP_INVALID_SYNTAX;
5191 gt.bv_len = ptr - gt.bv_val;
5192 if ( gt.bv_len != STRLENOF( "YYYYmmddHH:MM:SSZ" ) ) {
5193 return LDAP_INVALID_SYNTAX;
5196 if ( gt.bv_val[ 10 ] != ':' || gt.bv_val[ 13 ] != ':' ) {
5197 return LDAP_INVALID_SYNTAX;
5200 cnt.bv_val = ptr + 1;
5201 cnt.bv_len = val->bv_len - ( cnt.bv_val - val->bv_val );
5203 ptr = ber_bvchr( &cnt, '#' );
5204 if ( ptr == NULL || ptr == &val->bv_val[val->bv_len] ) {
5205 return LDAP_INVALID_SYNTAX;
5208 cnt.bv_len = ptr - cnt.bv_val;
5209 if ( cnt.bv_len != STRLENOF( "0x0000" ) ) {
5210 return LDAP_INVALID_SYNTAX;
5213 if ( strncmp( cnt.bv_val, "0x", STRLENOF( "0x" ) ) != 0 ) {
5214 return LDAP_INVALID_SYNTAX;
5217 cnt.bv_val += STRLENOF( "0x" );
5218 cnt.bv_len -= STRLENOF( "0x" );
5220 sid.bv_val = ptr + 1;
5221 sid.bv_len = val->bv_len - ( sid.bv_val - val->bv_val );
5223 ptr = ber_bvchr( &sid, '#' );
5224 if ( ptr == NULL || ptr == &val->bv_val[val->bv_len] ) {
5225 return LDAP_INVALID_SYNTAX;
5228 sid.bv_len = ptr - sid.bv_val;
5229 if ( sid.bv_len != STRLENOF( "0" ) ) {
5230 return LDAP_INVALID_SYNTAX;
5233 mod.bv_val = ptr + 1;
5234 mod.bv_len = val->bv_len - ( mod.bv_val - val->bv_val );
5235 if ( mod.bv_len != STRLENOF( "0000" ) ) {
5236 return LDAP_INVALID_SYNTAX;
5239 bv.bv_len = STRLENOF( "YYYYmmddHHMMSS.uuuuuuZ#SSSSSS#SID#ssssss" );
5243 ptr = lutil_strncopy( ptr, gt.bv_val, STRLENOF( "YYYYmmddHH" ) );
5244 ptr = lutil_strncopy( ptr, >.bv_val[ STRLENOF( "YYYYmmddHH:" ) ],
5246 ptr = lutil_strncopy( ptr, >.bv_val[ STRLENOF( "YYYYmmddHH:MM:" ) ],
5248 ptr = lutil_strcopy( ptr, ".000000Z#00" );
5249 ptr = lutil_strbvcopy( ptr, &cnt );
5253 *ptr++ = sid.bv_val[ 0 ];
5257 for ( i = 0; i < mod.bv_len; i++ ) {
5258 *ptr++ = TOLOWER( mod.bv_val[ i ] );
5262 assert( ptr == &bv.bv_val[bv.bv_len] );
5264 if ( csnValidate( syntax, &bv ) != LDAP_SUCCESS ) {
5265 return LDAP_INVALID_SYNTAX;
5268 ber_dupbv_x( normalized, &bv, ctx );
5270 return LDAP_SUCCESS;
5273 /* Normalize a CSN in OpenLDAP 2.3 format */
5280 struct berval *normalized,
5283 struct berval gt, cnt, sid, mod;
5285 char buf[ STRLENOF( "YYYYmmddHHMMSS.uuuuuuZ#SSSSSS#SID#ssssss" ) + 1 ];
5289 assert( SLAP_MR_IS_VALUE_OF_SYNTAX( usage ) != 0 );
5290 assert( !BER_BVISEMPTY( val ) );
5294 ptr = ber_bvchr( >, '#' );
5295 if ( ptr == NULL || ptr == >.bv_val[gt.bv_len] ) {
5296 return LDAP_INVALID_SYNTAX;
5299 gt.bv_len = ptr - gt.bv_val;
5300 if ( gt.bv_len != STRLENOF( "YYYYmmddHHMMSSZ" ) ) {
5301 return LDAP_INVALID_SYNTAX;
5304 cnt.bv_val = ptr + 1;
5305 cnt.bv_len = val->bv_len - ( cnt.bv_val - val->bv_val );
5307 ptr = ber_bvchr( &cnt, '#' );
5308 if ( ptr == NULL || ptr == &val->bv_val[val->bv_len] ) {
5309 return LDAP_INVALID_SYNTAX;
5312 cnt.bv_len = ptr - cnt.bv_val;
5313 if ( cnt.bv_len != STRLENOF( "000000" ) ) {
5314 return LDAP_INVALID_SYNTAX;
5317 sid.bv_val = ptr + 1;
5318 sid.bv_len = val->bv_len - ( sid.bv_val - val->bv_val );
5320 ptr = ber_bvchr( &sid, '#' );
5321 if ( ptr == NULL || ptr == &val->bv_val[val->bv_len] ) {
5322 return LDAP_INVALID_SYNTAX;
5325 sid.bv_len = ptr - sid.bv_val;
5326 if ( sid.bv_len != STRLENOF( "00" ) ) {
5327 return LDAP_INVALID_SYNTAX;
5330 mod.bv_val = ptr + 1;
5331 mod.bv_len = val->bv_len - ( mod.bv_val - val->bv_val );
5332 if ( mod.bv_len != STRLENOF( "000000" ) ) {
5333 return LDAP_INVALID_SYNTAX;
5336 bv.bv_len = STRLENOF( "YYYYmmddHHMMSS.uuuuuuZ#SSSSSS#SID#ssssss" );
5340 ptr = lutil_strncopy( ptr, gt.bv_val, gt.bv_len - 1 );
5341 ptr = lutil_strcopy( ptr, ".000000Z#" );
5342 ptr = lutil_strbvcopy( ptr, &cnt );
5345 for ( i = 0; i < sid.bv_len; i++ ) {
5346 *ptr++ = TOLOWER( sid.bv_val[ i ] );
5349 for ( i = 0; i < mod.bv_len; i++ ) {
5350 *ptr++ = TOLOWER( mod.bv_val[ i ] );
5354 assert( ptr == &bv.bv_val[bv.bv_len] );
5355 if ( csnValidate( syntax, &bv ) != LDAP_SUCCESS ) {
5356 return LDAP_INVALID_SYNTAX;
5359 ber_dupbv_x( normalized, &bv, ctx );
5361 return LDAP_SUCCESS;
5364 /* Normalize a CSN */
5371 struct berval *normalized,
5374 struct berval cnt, sid, mod;
5378 assert( val != NULL );
5379 assert( normalized != NULL );
5381 assert( SLAP_MR_IS_VALUE_OF_SYNTAX( usage ) != 0 );
5383 if ( BER_BVISEMPTY( val ) ) {
5384 return LDAP_INVALID_SYNTAX;
5387 if ( val->bv_len == STRLENOF( "YYYYmmddHHMMSSZ#SSSSSS#ID#ssssss" ) ) {
5388 /* Openldap <= 2.3 */
5390 return csnNormalize23( usage, syntax, mr, val, normalized, ctx );
5393 if ( val->bv_len == STRLENOF( "YYYYmmddHH:MM:SSZ#0xSSSS#I#ssss" ) ) {
5396 return csnNormalize21( usage, syntax, mr, val, normalized, ctx );
5399 if ( val->bv_len != STRLENOF( "YYYYmmddHHMMSS.uuuuuuZ#SSSSSS#SID#ssssss" ) ) {
5400 return LDAP_INVALID_SYNTAX;
5403 ptr = ber_bvchr( val, '#' );
5404 if ( ptr == NULL || ptr == &val->bv_val[val->bv_len] ) {
5405 return LDAP_INVALID_SYNTAX;
5408 if ( ptr - val->bv_val != STRLENOF( "YYYYmmddHHMMSS.uuuuuuZ" ) ) {
5409 return LDAP_INVALID_SYNTAX;
5412 cnt.bv_val = ptr + 1;
5413 cnt.bv_len = val->bv_len - ( cnt.bv_val - val->bv_val );
5415 ptr = ber_bvchr( &cnt, '#' );
5416 if ( ptr == NULL || ptr == &val->bv_val[val->bv_len] ) {
5417 return LDAP_INVALID_SYNTAX;
5420 if ( ptr - cnt.bv_val != STRLENOF( "000000" ) ) {
5421 return LDAP_INVALID_SYNTAX;
5424 sid.bv_val = ptr + 1;
5425 sid.bv_len = val->bv_len - ( sid.bv_val - val->bv_val );
5427 ptr = ber_bvchr( &sid, '#' );
5428 if ( ptr == NULL || ptr == &val->bv_val[val->bv_len] ) {
5429 return LDAP_INVALID_SYNTAX;
5432 sid.bv_len = ptr - sid.bv_val;
5433 if ( sid.bv_len != STRLENOF( "000" ) ) {
5434 return LDAP_INVALID_SYNTAX;
5437 mod.bv_val = ptr + 1;
5438 mod.bv_len = val->bv_len - ( mod.bv_val - val->bv_val );
5440 if ( mod.bv_len != STRLENOF( "000000" ) ) {
5441 return LDAP_INVALID_SYNTAX;
5444 ber_dupbv_x( normalized, val, ctx );
5446 for ( i = STRLENOF( "YYYYmmddHHMMSS.uuuuuuZ#SSSSSS#" );
5447 i < normalized->bv_len; i++ )
5449 /* assume it's already validated that's all hex digits */
5450 normalized->bv_val[ i ] = TOLOWER( normalized->bv_val[ i ] );
5453 return LDAP_SUCCESS;
5463 return csnNormalize( SLAP_MR_VALUE_OF_SYNTAX, NULL, NULL, val, out, ctx );
5466 #ifndef SUPPORT_OBSOLETE_UTC_SYNTAX
5467 /* slight optimization - does not need the start parameter */
5468 #define check_time_syntax(v, start, p, f) (check_time_syntax)(v, p, f)
5473 check_time_syntax (struct berval *val,
5476 struct berval *fraction)
5479 * start=0 GeneralizedTime YYYYmmddHH[MM[SS]][(./,)d...](Z|(+/-)HH[MM])
5480 * start=1 UTCTime YYmmddHHMM[SS][Z|(+/-)HHMM]
5481 * GeneralizedTime supports leap seconds, UTCTime does not.
5483 static const int ceiling[9] = { 100, 100, 12, 31, 24, 60, 60, 24, 60 };
5484 static const int mdays[2][12] = {
5485 /* non-leap years */
5486 { 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 },
5488 { 31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 }
5491 int part, c, c1, c2, tzoffset, leapyear = 0;
5494 e = p + val->bv_len;
5496 #ifdef SUPPORT_OBSOLETE_UTC_SYNTAX
5497 parts[0] = 20; /* century - any multiple of 4 from 04 to 96 */
5499 for (part = start; part < 7 && p < e; part++) {
5501 if (!ASCII_DIGIT(c1)) {
5506 return LDAP_INVALID_SYNTAX;
5509 if (!ASCII_DIGIT(c)) {
5510 return LDAP_INVALID_SYNTAX;
5512 c += c1 * 10 - '0' * 11;
5513 if ((part | 1) == 3) {
5516 return LDAP_INVALID_SYNTAX;
5519 if (c >= ceiling[part]) {
5520 if (! (c == 60 && part == 6 && start == 0))
5521 return LDAP_INVALID_SYNTAX;
5525 if (part < 5 + start) {
5526 return LDAP_INVALID_SYNTAX;
5528 for (; part < 9; part++) {
5532 /* leapyear check for the Gregorian calendar (year>1581) */
5533 if (parts[parts[1] == 0 ? 0 : 1] % 4 == 0) {
5537 if (parts[3] >= mdays[leapyear][parts[2]]) {
5538 return LDAP_INVALID_SYNTAX;
5542 fraction->bv_val = p;
5543 fraction->bv_len = 0;
5544 if (p < e && (*p == '.' || *p == ',')) {
5546 while (++p < e && ASCII_DIGIT(*p)) {
5549 if (p - fraction->bv_val == 1) {
5550 return LDAP_INVALID_SYNTAX;
5552 for (end_num = p; end_num[-1] == '0'; --end_num) {
5555 c = end_num - fraction->bv_val;
5556 if (c != 1) fraction->bv_len = c;
5562 return start == 0 ? LDAP_INVALID_SYNTAX : LDAP_SUCCESS;
5568 return LDAP_INVALID_SYNTAX;
5574 for (part = 7; part < 9 && p < e; part++) {
5576 if (!ASCII_DIGIT(c1)) {
5581 return LDAP_INVALID_SYNTAX;
5584 if (!ASCII_DIGIT(c2)) {
5585 return LDAP_INVALID_SYNTAX;
5587 parts[part] = c1 * 10 + c2 - '0' * 11;
5588 if (parts[part] >= ceiling[part]) {
5589 return LDAP_INVALID_SYNTAX;
5592 if (part < 8 + start) {
5593 return LDAP_INVALID_SYNTAX;
5596 if (tzoffset == '-') {
5597 /* negative offset to UTC, ie west of Greenwich */
5598 parts[4] += parts[7];
5599 parts[5] += parts[8];
5600 /* offset is just hhmm, no seconds */
5601 for (part = 6; --part >= 0; ) {
5605 c = mdays[leapyear][parts[2]];
5607 if (parts[part] >= c) {
5609 return LDAP_INVALID_SYNTAX;
5614 } else if (part != 5) {
5619 /* positive offset to UTC, ie east of Greenwich */
5620 parts[4] -= parts[7];
5621 parts[5] -= parts[8];
5622 for (part = 6; --part >= 0; ) {
5623 if (parts[part] < 0) {
5625 return LDAP_INVALID_SYNTAX;
5630 /* make first arg to % non-negative */
5631 c = mdays[leapyear][(parts[2] - 1 + 12) % 12];
5636 } else if (part != 5) {
5643 return p != e ? LDAP_INVALID_SYNTAX : LDAP_SUCCESS;
5646 #ifdef SUPPORT_OBSOLETE_UTC_SYNTAX
5653 struct berval *normalized )
5657 rc = check_time_syntax(val, 1, parts, NULL);
5658 if (rc != LDAP_SUCCESS) {
5662 normalized->bv_val = ch_malloc( 14 );
5663 if ( normalized->bv_val == NULL ) {
5664 return LBER_ERROR_MEMORY;
5667 sprintf( normalized->bv_val, "%02d%02d%02d%02d%02d%02dZ",
5668 parts[1], parts[2] + 1, parts[3] + 1,
5669 parts[4], parts[5], parts[6] );
5670 normalized->bv_len = 13;
5672 return LDAP_SUCCESS;
5682 return check_time_syntax(in, 1, parts, NULL);
5685 #endif /* SUPPORT_OBSOLETE_UTC_SYNTAX */
5688 generalizedTimeValidate(
5693 struct berval fraction;
5694 return check_time_syntax(in, 0, parts, &fraction);
5698 generalizedTimeNormalize(
5703 struct berval *normalized,
5708 struct berval fraction;
5710 rc = check_time_syntax(val, 0, parts, &fraction);
5711 if (rc != LDAP_SUCCESS) {
5715 len = STRLENOF("YYYYmmddHHMMSSZ") + fraction.bv_len;
5716 normalized->bv_val = slap_sl_malloc( len + 1, ctx );
5717 if ( BER_BVISNULL( normalized ) ) {
5718 return LBER_ERROR_MEMORY;
5721 sprintf( normalized->bv_val, "%02d%02d%02d%02d%02d%02d%02d",
5722 parts[0], parts[1], parts[2] + 1, parts[3] + 1,
5723 parts[4], parts[5], parts[6] );
5724 if ( !BER_BVISEMPTY( &fraction ) ) {
5725 memcpy( normalized->bv_val + STRLENOF("YYYYmmddHHMMSSZ")-1,
5726 fraction.bv_val, fraction.bv_len );
5727 normalized->bv_val[STRLENOF("YYYYmmddHHMMSSZ")-1] = '.';
5729 strcpy( normalized->bv_val + len-1, "Z" );
5730 normalized->bv_len = len;
5732 return LDAP_SUCCESS;
5736 generalizedTimeOrderingMatch(
5741 struct berval *value,
5742 void *assertedValue )
5744 struct berval *asserted = (struct berval *) assertedValue;
5745 ber_len_t v_len = value->bv_len;
5746 ber_len_t av_len = asserted->bv_len;
5748 /* ignore trailing 'Z' when comparing */
5749 int match = memcmp( value->bv_val, asserted->bv_val,
5750 (v_len < av_len ? v_len : av_len) - 1 );
5751 if ( match == 0 ) match = v_len - av_len;
5753 /* If used in extensible match filter, match if value < asserted */
5754 if ( flags & SLAP_MR_EXT )
5755 match = (match >= 0);
5758 return LDAP_SUCCESS;
5761 /* Index generation function: Ordered index */
5762 int generalizedTimeIndexer(
5767 struct berval *prefix,
5775 BerValue bvtmp; /* 40 bit index */
5777 struct lutil_timet tt;
5779 bvtmp.bv_len = sizeof(tmp);
5781 for( i=0; values[i].bv_val != NULL; i++ ) {
5782 /* just count them */
5785 /* we should have at least one value at this point */
5788 keys = slap_sl_malloc( sizeof( struct berval ) * (i+1), ctx );
5790 /* GeneralizedTime YYYYmmddHH[MM[SS]][(./,)d...](Z|(+/-)HH[MM]) */
5791 for( i=0, j=0; values[i].bv_val != NULL; i++ ) {
5792 assert(values[i].bv_val != NULL && values[i].bv_len >= 10);
5793 /* Use 40 bits of time for key */
5794 if ( lutil_parsetime( values[i].bv_val, &tm ) == 0 ) {
5795 lutil_tm2time( &tm, &tt );
5796 tmp[0] = tt.tt_gsec & 0xff;
5797 tmp[4] = tt.tt_sec & 0xff;
5799 tmp[3] = tt.tt_sec & 0xff;
5801 tmp[2] = tt.tt_sec & 0xff;
5803 tmp[1] = tt.tt_sec & 0xff;
5805 ber_dupbv_x(&keys[j++], &bvtmp, ctx );
5809 keys[j].bv_val = NULL;
5814 return LDAP_SUCCESS;
5817 /* Index generation function: Ordered index */
5818 int generalizedTimeFilter(
5823 struct berval *prefix,
5824 void * assertedValue,
5830 BerValue bvtmp; /* 40 bit index */
5831 BerValue *value = (BerValue *) assertedValue;
5833 struct lutil_timet tt;
5835 bvtmp.bv_len = sizeof(tmp);
5837 /* GeneralizedTime YYYYmmddHH[MM[SS]][(./,)d...](Z|(+/-)HH[MM]) */
5838 /* Use 40 bits of time for key */
5839 if ( value->bv_val && value->bv_len >= 10 &&
5840 lutil_parsetime( value->bv_val, &tm ) == 0 ) {
5842 lutil_tm2time( &tm, &tt );
5843 tmp[0] = tt.tt_gsec & 0xff;
5844 tmp[4] = tt.tt_sec & 0xff;
5846 tmp[3] = tt.tt_sec & 0xff;
5848 tmp[2] = tt.tt_sec & 0xff;
5850 tmp[1] = tt.tt_sec & 0xff;
5852 keys = slap_sl_malloc( sizeof( struct berval ) * 2, ctx );
5853 ber_dupbv_x(keys, &bvtmp, ctx );
5854 keys[1].bv_val = NULL;
5862 return LDAP_SUCCESS;
5866 deliveryMethodValidate(
5868 struct berval *val )
5871 #define LENOF(s) (sizeof(s)-1)
5872 struct berval tmp = *val;
5874 * DeliveryMethod = pdm *( WSP DOLLAR WSP DeliveryMethod )
5875 * pdm = "any" / "mhs" / "physical" / "telex" / "teletex" /
5876 * "g3fax" / "g4fax" / "ia5" / "videotex" / "telephone"
5879 if( tmp.bv_len < 3 ) return LDAP_INVALID_SYNTAX;
5881 switch( tmp.bv_val[0] ) {
5884 if(( tmp.bv_len >= LENOF("any") ) &&
5885 ( strncasecmp(tmp.bv_val, "any", LENOF("any")) == 0 ))
5887 tmp.bv_len -= LENOF("any");
5888 tmp.bv_val += LENOF("any");
5891 return LDAP_INVALID_SYNTAX;
5895 if(( tmp.bv_len >= LENOF("mhs") ) &&
5896 ( strncasecmp(tmp.bv_val, "mhs", LENOF("mhs")) == 0 ))
5898 tmp.bv_len -= LENOF("mhs");
5899 tmp.bv_val += LENOF("mhs");
5902 return LDAP_INVALID_SYNTAX;
5906 if(( tmp.bv_len >= LENOF("physical") ) &&
5907 ( strncasecmp(tmp.bv_val, "physical", LENOF("physical")) == 0 ))
5909 tmp.bv_len -= LENOF("physical");
5910 tmp.bv_val += LENOF("physical");
5913 return LDAP_INVALID_SYNTAX;
5916 case 'T': /* telex or teletex or telephone */
5917 if(( tmp.bv_len >= LENOF("telex") ) &&
5918 ( strncasecmp(tmp.bv_val, "telex", LENOF("telex")) == 0 ))
5920 tmp.bv_len -= LENOF("telex");
5921 tmp.bv_val += LENOF("telex");
5924 if(( tmp.bv_len >= LENOF("teletex") ) &&
5925 ( strncasecmp(tmp.bv_val, "teletex", LENOF("teletex")) == 0 ))
5927 tmp.bv_len -= LENOF("teletex");
5928 tmp.bv_val += LENOF("teletex");
5931 if(( tmp.bv_len >= LENOF("telephone") ) &&
5932 ( strncasecmp(tmp.bv_val, "telephone", LENOF("telephone")) == 0 ))
5934 tmp.bv_len -= LENOF("telephone");
5935 tmp.bv_val += LENOF("telephone");
5938 return LDAP_INVALID_SYNTAX;
5941 case 'G': /* g3fax or g4fax */
5942 if(( tmp.bv_len >= LENOF("g3fax") ) && (
5943 ( strncasecmp(tmp.bv_val, "g3fax", LENOF("g3fax")) == 0 ) ||
5944 ( strncasecmp(tmp.bv_val, "g4fax", LENOF("g4fax")) == 0 )))
5946 tmp.bv_len -= LENOF("g3fax");
5947 tmp.bv_val += LENOF("g3fax");
5950 return LDAP_INVALID_SYNTAX;
5954 if(( tmp.bv_len >= LENOF("ia5") ) &&
5955 ( strncasecmp(tmp.bv_val, "ia5", LENOF("ia5")) == 0 ))
5957 tmp.bv_len -= LENOF("ia5");
5958 tmp.bv_val += LENOF("ia5");
5961 return LDAP_INVALID_SYNTAX;
5965 if(( tmp.bv_len >= LENOF("videotex") ) &&
5966 ( strncasecmp(tmp.bv_val, "videotex", LENOF("videotex")) == 0 ))
5968 tmp.bv_len -= LENOF("videotex");
5969 tmp.bv_val += LENOF("videotex");
5972 return LDAP_INVALID_SYNTAX;
5975 return LDAP_INVALID_SYNTAX;
5978 if( BER_BVISEMPTY( &tmp ) ) return LDAP_SUCCESS;
5980 while( !BER_BVISEMPTY( &tmp ) && ( tmp.bv_val[0] == ' ' ) ) {
5984 if( !BER_BVISEMPTY( &tmp ) && ( tmp.bv_val[0] == '$' ) ) {
5988 return LDAP_INVALID_SYNTAX;
5990 while( !BER_BVISEMPTY( &tmp ) && ( tmp.bv_val[0] == ' ' ) ) {
5999 nisNetgroupTripleValidate(
6001 struct berval *val )
6006 if ( BER_BVISEMPTY( val ) ) {
6007 return LDAP_INVALID_SYNTAX;
6010 p = (char *)val->bv_val;
6011 e = p + val->bv_len;
6013 if ( *p != '(' /*')'*/ ) {
6014 return LDAP_INVALID_SYNTAX;
6017 for ( p++; ( p < e ) && ( *p != /*'('*/ ')' ); p++ ) {
6021 return LDAP_INVALID_SYNTAX;
6024 } else if ( !AD_CHAR( *p ) ) {
6025 return LDAP_INVALID_SYNTAX;
6029 if ( ( commas != 2 ) || ( *p != /*'('*/ ')' ) ) {
6030 return LDAP_INVALID_SYNTAX;
6036 return LDAP_INVALID_SYNTAX;
6039 return LDAP_SUCCESS;
6043 bootParameterValidate(
6045 struct berval *val )
6049 if ( BER_BVISEMPTY( val ) ) {
6050 return LDAP_INVALID_SYNTAX;
6053 p = (char *)val->bv_val;
6054 e = p + val->bv_len;
6057 for (; ( p < e ) && ( *p != '=' ); p++ ) {
6058 if ( !AD_CHAR( *p ) ) {
6059 return LDAP_INVALID_SYNTAX;
6064 return LDAP_INVALID_SYNTAX;
6068 for ( p++; ( p < e ) && ( *p != ':' ); p++ ) {
6069 if ( !AD_CHAR( *p ) ) {
6070 return LDAP_INVALID_SYNTAX;
6075 return LDAP_INVALID_SYNTAX;
6079 for ( p++; p < e; p++ ) {
6080 if ( !SLAP_PRINTABLE( *p ) ) {
6081 return LDAP_INVALID_SYNTAX;
6085 return LDAP_SUCCESS;
6089 firstComponentNormalize(
6094 struct berval *normalized,
6101 if( SLAP_MR_IS_VALUE_OF_ASSERTION_SYNTAX( usage )) {
6102 ber_dupbv_x( normalized, val, ctx );
6103 return LDAP_SUCCESS;
6106 if( val->bv_len < 3 ) return LDAP_INVALID_SYNTAX;
6108 if( ! ( val->bv_val[0] == '(' /*')'*/
6109 && val->bv_val[val->bv_len - 1] == /*'('*/ ')' )
6110 && ! ( val->bv_val[0] == '{' /*'}'*/
6111 && val->bv_val[val->bv_len - 1] == /*'('*/ '}' ) )
6113 return LDAP_INVALID_SYNTAX;
6116 /* trim leading white space */
6118 len < val->bv_len && ASCII_SPACE(val->bv_val[len]);
6124 /* grab next word */
6125 comp.bv_val = &val->bv_val[len];
6126 len = val->bv_len - len - STRLENOF(/*"{"*/ "}");
6127 for( comp.bv_len = 0;
6128 !ASCII_SPACE(comp.bv_val[comp.bv_len]) && comp.bv_len < len;
6134 if( mr == slap_schema.si_mr_objectIdentifierFirstComponentMatch ) {
6135 rc = numericoidValidate( NULL, &comp );
6136 } else if( mr == slap_schema.si_mr_integerFirstComponentMatch ) {
6137 rc = integerValidate( NULL, &comp );
6139 rc = LDAP_INVALID_SYNTAX;
6143 if( rc == LDAP_SUCCESS ) {
6144 ber_dupbv_x( normalized, &comp, ctx );
6150 static char *country_gen_syn[] = {
6151 "1.3.6.1.4.1.1466.115.121.1.15", /* Directory String */
6152 "1.3.6.1.4.1.1466.115.121.1.26", /* IA5 String */
6153 "1.3.6.1.4.1.1466.115.121.1.44", /* Printable String */
6157 #define X_BINARY "X-BINARY-TRANSFER-REQUIRED 'TRUE' "
6158 #define X_NOT_H_R "X-NOT-HUMAN-READABLE 'TRUE' "
6160 static slap_syntax_defs_rec syntax_defs[] = {
6161 {"( 1.3.6.1.4.1.1466.115.121.1.1 DESC 'ACI Item' "
6162 X_BINARY X_NOT_H_R ")",
6163 SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, NULL, NULL, NULL},
6164 {"( 1.3.6.1.4.1.1466.115.121.1.2 DESC 'Access Point' " X_NOT_H_R ")",
6165 0, NULL, NULL, NULL},
6166 {"( 1.3.6.1.4.1.1466.115.121.1.3 DESC 'Attribute Type Description' )",
6167 0, NULL, NULL, NULL},
6168 {"( 1.3.6.1.4.1.1466.115.121.1.4 DESC 'Audio' "
6170 SLAP_SYNTAX_BLOB, NULL, blobValidate, NULL},
6171 {"( 1.3.6.1.4.1.1466.115.121.1.5 DESC 'Binary' "
6173 SLAP_SYNTAX_BER, NULL, berValidate, NULL},
6174 {"( 1.3.6.1.4.1.1466.115.121.1.6 DESC 'Bit String' )",
6175 0, NULL, bitStringValidate, NULL },
6176 {"( 1.3.6.1.4.1.1466.115.121.1.7 DESC 'Boolean' )",
6177 0, NULL, booleanValidate, NULL},
6178 {"( 1.3.6.1.4.1.1466.115.121.1.8 DESC 'Certificate' "
6179 X_BINARY X_NOT_H_R ")",
6180 SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER,
6181 NULL, certificateValidate, NULL},
6182 {"( 1.3.6.1.4.1.1466.115.121.1.9 DESC 'Certificate List' "
6183 X_BINARY X_NOT_H_R ")",
6184 SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER,
6185 NULL, certificateListValidate, NULL},
6186 {"( 1.3.6.1.4.1.1466.115.121.1.10 DESC 'Certificate Pair' "
6187 X_BINARY X_NOT_H_R ")",
6188 SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER,
6189 NULL, sequenceValidate, NULL},
6190 {"( " attributeCertificateSyntaxOID " DESC 'X.509 AttributeCertificate' "
6191 X_BINARY X_NOT_H_R ")",
6192 SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER,
6193 NULL, attributeCertificateValidate, NULL},
6194 #if 0 /* need to go __after__ printableString */
6195 {"( 1.3.6.1.4.1.1466.115.121.1.11 DESC 'Country String' )",
6196 0, "1.3.6.1.4.1.1466.115.121.1.44",
6197 countryStringValidate, NULL},
6199 {"( 1.3.6.1.4.1.1466.115.121.1.12 DESC 'Distinguished Name' )",
6200 SLAP_SYNTAX_DN, NULL, dnValidate, dnPretty},
6201 {"( 1.2.36.79672281.1.5.0 DESC 'RDN' )",
6202 0, NULL, rdnValidate, rdnPretty},
6203 #ifdef LDAP_COMP_MATCH
6204 {"( 1.2.36.79672281.1.5.3 DESC 'allComponents' )",
6205 0, NULL, allComponentsValidate, NULL},
6206 {"( 1.2.36.79672281.1.5.2 DESC 'componentFilterMatch assertion') ",
6207 0, NULL, componentFilterValidate, NULL},
6209 {"( 1.3.6.1.4.1.1466.115.121.1.13 DESC 'Data Quality' )",
6210 0, NULL, NULL, NULL},
6211 {"( 1.3.6.1.4.1.1466.115.121.1.14 DESC 'Delivery Method' )",
6212 0, NULL, deliveryMethodValidate, NULL},
6213 {"( 1.3.6.1.4.1.1466.115.121.1.15 DESC 'Directory String' )",
6214 0, NULL, UTF8StringValidate, NULL},
6215 {"( 1.3.6.1.4.1.1466.115.121.1.16 DESC 'DIT Content Rule Description' )",
6216 0, NULL, NULL, NULL},
6217 {"( 1.3.6.1.4.1.1466.115.121.1.17 DESC 'DIT Structure Rule Description' )",
6218 0, NULL, NULL, NULL},
6219 {"( 1.3.6.1.4.1.1466.115.121.1.19 DESC 'DSA Quality' )",
6220 0, NULL, NULL, NULL},
6221 {"( 1.3.6.1.4.1.1466.115.121.1.20 DESC 'DSE Type' )",
6222 0, NULL, NULL, NULL},
6223 {"( 1.3.6.1.4.1.1466.115.121.1.21 DESC 'Enhanced Guide' )",
6224 0, NULL, NULL, NULL},
6225 {"( 1.3.6.1.4.1.1466.115.121.1.22 DESC 'Facsimile Telephone Number' )",
6226 0, NULL, printablesStringValidate, NULL},
6227 {"( 1.3.6.1.4.1.1466.115.121.1.23 DESC 'Fax' " X_NOT_H_R ")",
6228 SLAP_SYNTAX_BLOB, NULL, NULL, NULL},
6229 {"( 1.3.6.1.4.1.1466.115.121.1.24 DESC 'Generalized Time' )",
6230 0, NULL, generalizedTimeValidate, NULL},
6231 {"( 1.3.6.1.4.1.1466.115.121.1.25 DESC 'Guide' )",
6232 0, NULL, NULL, NULL},
6233 {"( 1.3.6.1.4.1.1466.115.121.1.26 DESC 'IA5 String' )",
6234 0, NULL, IA5StringValidate, NULL},
6235 {"( 1.3.6.1.4.1.1466.115.121.1.27 DESC 'Integer' )",
6236 0, NULL, integerValidate, NULL},
6237 {"( 1.3.6.1.4.1.1466.115.121.1.28 DESC 'JPEG' " X_NOT_H_R ")",
6238 SLAP_SYNTAX_BLOB, NULL, blobValidate, NULL},
6239 {"( 1.3.6.1.4.1.1466.115.121.1.29 DESC 'Master And Shadow Access Points' )",
6240 0, NULL, NULL, NULL},
6241 {"( 1.3.6.1.4.1.1466.115.121.1.30 DESC 'Matching Rule Description' )",
6242 0, NULL, NULL, NULL},
6243 {"( 1.3.6.1.4.1.1466.115.121.1.31 DESC 'Matching Rule Use Description' )",
6244 0, NULL, NULL, NULL},
6245 {"( 1.3.6.1.4.1.1466.115.121.1.32 DESC 'Mail Preference' )",
6246 0, NULL, NULL, NULL},
6247 {"( 1.3.6.1.4.1.1466.115.121.1.33 DESC 'MHS OR Address' )",
6248 0, NULL, NULL, NULL},
6249 {"( 1.3.6.1.4.1.1466.115.121.1.34 DESC 'Name And Optional UID' )",
6250 SLAP_SYNTAX_DN, NULL, nameUIDValidate, nameUIDPretty },
6251 {"( 1.3.6.1.4.1.1466.115.121.1.35 DESC 'Name Form Description' )",
6252 0, NULL, NULL, NULL},
6253 {"( 1.3.6.1.4.1.1466.115.121.1.36 DESC 'Numeric String' )",
6254 0, NULL, numericStringValidate, NULL},
6255 {"( 1.3.6.1.4.1.1466.115.121.1.37 DESC 'Object Class Description' )",
6256 0, NULL, NULL, NULL},
6257 {"( 1.3.6.1.4.1.1466.115.121.1.38 DESC 'OID' )",
6258 0, NULL, numericoidValidate, NULL},
6259 {"( 1.3.6.1.4.1.1466.115.121.1.39 DESC 'Other Mailbox' )",
6260 0, NULL, IA5StringValidate, NULL},
6261 {"( 1.3.6.1.4.1.1466.115.121.1.40 DESC 'Octet String' )",
6262 0, NULL, blobValidate, NULL},
6263 {"( 1.3.6.1.4.1.1466.115.121.1.41 DESC 'Postal Address' )",
6264 0, NULL, postalAddressValidate, NULL},
6265 {"( 1.3.6.1.4.1.1466.115.121.1.42 DESC 'Protocol Information' )",
6266 0, NULL, NULL, NULL},
6267 {"( 1.3.6.1.4.1.1466.115.121.1.43 DESC 'Presentation Address' )",
6268 0, NULL, NULL, NULL},
6269 {"( 1.3.6.1.4.1.1466.115.121.1.44 DESC 'Printable String' )",
6270 0, NULL, printableStringValidate, NULL},
6271 /* moved here because now depends on Directory String, IA5 String
6272 * and Printable String */
6273 {"( 1.3.6.1.4.1.1466.115.121.1.11 DESC 'Country String' )",
6274 0, country_gen_syn, countryStringValidate, NULL},
6275 {"( 1.3.6.1.4.1.1466.115.121.1.45 DESC 'SubtreeSpecification' )",
6276 #define subtreeSpecificationValidate UTF8StringValidate /* FIXME */
6277 0, NULL, subtreeSpecificationValidate, NULL},
6278 {"( 1.3.6.1.4.1.1466.115.121.1.49 DESC 'Supported Algorithm' "
6279 X_BINARY X_NOT_H_R ")",
6280 SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, NULL, berValidate, NULL},
6281 {"( 1.3.6.1.4.1.1466.115.121.1.50 DESC 'Telephone Number' )",
6282 0, NULL, printableStringValidate, NULL},
6283 {"( 1.3.6.1.4.1.1466.115.121.1.51 DESC 'Teletex Terminal Identifier' )",
6284 0, NULL, NULL, NULL},
6285 {"( 1.3.6.1.4.1.1466.115.121.1.52 DESC 'Telex Number' )",
6286 0, NULL, printablesStringValidate, NULL},
6287 #ifdef SUPPORT_OBSOLETE_UTC_SYNTAX
6288 {"( 1.3.6.1.4.1.1466.115.121.1.53 DESC 'UTC Time' )",
6289 0, NULL, utcTimeValidate, NULL},
6291 {"( 1.3.6.1.4.1.1466.115.121.1.54 DESC 'LDAP Syntax Description' )",
6292 0, NULL, NULL, NULL},
6293 {"( 1.3.6.1.4.1.1466.115.121.1.55 DESC 'Modify Rights' )",
6294 0, NULL, NULL, NULL},
6295 {"( 1.3.6.1.4.1.1466.115.121.1.56 DESC 'LDAP Schema Definition' )",
6296 0, NULL, NULL, NULL},
6297 {"( 1.3.6.1.4.1.1466.115.121.1.57 DESC 'LDAP Schema Description' )",
6298 0, NULL, NULL, NULL},
6299 {"( 1.3.6.1.4.1.1466.115.121.1.58 DESC 'Substring Assertion' )",
6300 0, NULL, NULL, NULL},
6302 /* RFC 2307 NIS Syntaxes */
6303 {"( 1.3.6.1.1.1.0.0 DESC 'RFC2307 NIS Netgroup Triple' )",
6304 0, NULL, nisNetgroupTripleValidate, NULL},
6305 {"( 1.3.6.1.1.1.0.1 DESC 'RFC2307 Boot Parameter' )",
6306 0, NULL, bootParameterValidate, NULL},
6308 /* draft-zeilenga-ldap-x509 */
6309 {"( 1.3.6.1.1.15.1 DESC 'Certificate Exact Assertion' )",
6310 SLAP_SYNTAX_HIDE, NULL,
6311 serialNumberAndIssuerValidate,
6312 serialNumberAndIssuerPretty},
6313 {"( 1.3.6.1.1.15.2 DESC 'Certificate Assertion' )",
6314 SLAP_SYNTAX_HIDE, NULL, NULL, NULL},
6315 {"( 1.3.6.1.1.15.3 DESC 'Certificate Pair Exact Assertion' )",
6316 SLAP_SYNTAX_HIDE, NULL, NULL, NULL},
6317 {"( 1.3.6.1.1.15.4 DESC 'Certificate Pair Assertion' )",
6318 SLAP_SYNTAX_HIDE, NULL, NULL, NULL},
6319 {"( 1.3.6.1.1.15.5 DESC 'Certificate List Exact Assertion' )",
6320 SLAP_SYNTAX_HIDE, NULL,
6321 issuerAndThisUpdateValidate,
6322 issuerAndThisUpdatePretty},
6323 {"( 1.3.6.1.1.15.6 DESC 'Certificate List Assertion' )",
6324 SLAP_SYNTAX_HIDE, NULL, NULL, NULL},
6325 {"( 1.3.6.1.1.15.7 DESC 'Algorithm Identifier' )",
6326 SLAP_SYNTAX_HIDE, NULL, NULL, NULL},
6327 {"( " attributeCertificateExactAssertionSyntaxOID " DESC 'AttributeCertificate Exact Assertion' )",
6328 SLAP_SYNTAX_HIDE, NULL,
6329 serialNumberAndIssuerSerialValidate,
6330 serialNumberAndIssuerSerialPretty},
6331 {"( " attributeCertificateAssertionSyntaxOID " DESC 'AttributeCertificate Assertion' )",
6332 SLAP_SYNTAX_HIDE, NULL, NULL, NULL},
6334 #ifdef SLAPD_AUTHPASSWD
6335 /* needs updating */
6336 {"( 1.3.6.1.4.1.4203.666.2.2 DESC 'OpenLDAP authPassword' )",
6337 SLAP_SYNTAX_HIDE, NULL, NULL, NULL},
6340 {"( 1.3.6.1.1.16.1 DESC 'UUID' )",
6341 0, NULL, UUIDValidate, UUIDPretty},
6343 {"( 1.3.6.1.4.1.4203.666.11.2.1 DESC 'CSN' )",
6344 SLAP_SYNTAX_HIDE, NULL, csnValidate, csnPretty },
6346 {"( 1.3.6.1.4.1.4203.666.11.2.4 DESC 'CSN SID' )",
6347 SLAP_SYNTAX_HIDE, NULL, sidValidate, sidPretty },
6349 /* OpenLDAP Void Syntax */
6350 {"( 1.3.6.1.4.1.4203.1.1.1 DESC 'OpenLDAP void' )" ,
6351 SLAP_SYNTAX_HIDE, NULL, inValidate, NULL},
6353 /* FIXME: OID is unused, but not registered yet */
6354 {"( 1.3.6.1.4.1.4203.666.2.7 DESC 'OpenLDAP authz' )",
6355 SLAP_SYNTAX_HIDE, NULL, authzValidate, authzPretty},
6357 {NULL, 0, NULL, NULL, NULL}
6360 char *csnSIDMatchSyntaxes[] = {
6361 "1.3.6.1.4.1.4203.666.11.2.1" /* csn */,
6364 char *certificateExactMatchSyntaxes[] = {
6365 "1.3.6.1.4.1.1466.115.121.1.8" /* certificate */,
6368 char *certificateListExactMatchSyntaxes[] = {
6369 "1.3.6.1.4.1.1466.115.121.1.9" /* certificateList */,
6372 char *attributeCertificateExactMatchSyntaxes[] = {
6373 attributeCertificateSyntaxOID /* attributeCertificate */,
6377 #ifdef LDAP_COMP_MATCH
6378 char *componentFilterMatchSyntaxes[] = {
6379 "1.3.6.1.4.1.1466.115.121.1.8" /* certificate */,
6380 "1.3.6.1.4.1.1466.115.121.1.9" /* certificateList */,
6381 attributeCertificateSyntaxOID /* attributeCertificate */,
6386 char *directoryStringSyntaxes[] = {
6387 "1.3.6.1.4.1.1466.115.121.1.11" /* countryString */,
6388 "1.3.6.1.4.1.1466.115.121.1.44" /* printableString */,
6389 "1.3.6.1.4.1.1466.115.121.1.50" /* telephoneNumber */,
6392 char *integerFirstComponentMatchSyntaxes[] = {
6393 "1.3.6.1.4.1.1466.115.121.1.27" /* INTEGER */,
6394 "1.3.6.1.4.1.1466.115.121.1.17" /* dITStructureRuleDescription */,
6397 char *objectIdentifierFirstComponentMatchSyntaxes[] = {
6398 "1.3.6.1.4.1.1466.115.121.1.38" /* OID */,
6399 "1.3.6.1.4.1.1466.115.121.1.3" /* attributeTypeDescription */,
6400 "1.3.6.1.4.1.1466.115.121.1.16" /* dITContentRuleDescription */,
6401 "1.3.6.1.4.1.1466.115.121.1.54" /* ldapSyntaxDescription */,
6402 "1.3.6.1.4.1.1466.115.121.1.30" /* matchingRuleDescription */,
6403 "1.3.6.1.4.1.1466.115.121.1.31" /* matchingRuleUseDescription */,
6404 "1.3.6.1.4.1.1466.115.121.1.35" /* nameFormDescription */,
6405 "1.3.6.1.4.1.1466.115.121.1.37" /* objectClassDescription */,
6410 * Other matching rules in X.520 that we do not use (yet):
6412 * 2.5.13.25 uTCTimeMatch
6413 * 2.5.13.26 uTCTimeOrderingMatch
6414 * 2.5.13.31* directoryStringFirstComponentMatch
6415 * 2.5.13.32* wordMatch
6416 * 2.5.13.33* keywordMatch
6417 * 2.5.13.36+ certificatePairExactMatch
6418 * 2.5.13.37+ certificatePairMatch
6419 * 2.5.13.40+ algorithmIdentifierMatch
6420 * 2.5.13.41* storedPrefixMatch
6421 * 2.5.13.42 attributeCertificateMatch
6422 * 2.5.13.43 readerAndKeyIDMatch
6423 * 2.5.13.44 attributeIntegrityMatch
6425 * (*) described in RFC 3698 (LDAP: Additional Matching Rules)
6426 * (+) described in draft-zeilenga-ldap-x509
6428 static slap_mrule_defs_rec mrule_defs[] = {
6430 * EQUALITY matching rules must be listed after associated APPROX
6431 * matching rules. So, we list all APPROX matching rules first.
6433 {"( " directoryStringApproxMatchOID " NAME 'directoryStringApproxMatch' "
6434 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )",
6435 SLAP_MR_HIDE | SLAP_MR_EQUALITY_APPROX | SLAP_MR_EXT, NULL,
6436 NULL, NULL, directoryStringApproxMatch,
6437 directoryStringApproxIndexer, directoryStringApproxFilter,
6440 {"( " IA5StringApproxMatchOID " NAME 'IA5StringApproxMatch' "
6441 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )",
6442 SLAP_MR_HIDE | SLAP_MR_EQUALITY_APPROX | SLAP_MR_EXT, NULL,
6443 NULL, NULL, IA5StringApproxMatch,
6444 IA5StringApproxIndexer, IA5StringApproxFilter,
6448 * Other matching rules
6451 {"( 2.5.13.0 NAME 'objectIdentifierMatch' "
6452 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )",
6453 SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
6454 NULL, NULL, octetStringMatch,
6455 octetStringIndexer, octetStringFilter,
6458 {"( 2.5.13.1 NAME 'distinguishedNameMatch' "
6459 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )",
6460 SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
6461 NULL, dnNormalize, dnMatch,
6462 octetStringIndexer, octetStringFilter,
6465 {"( 1.3.6.1.4.1.4203.666.4.9 NAME 'dnSubtreeMatch' "
6466 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )",
6467 SLAP_MR_HIDE | SLAP_MR_EXT, NULL,
6468 NULL, dnNormalize, dnRelativeMatch,
6472 {"( 1.3.6.1.4.1.4203.666.4.8 NAME 'dnOneLevelMatch' "
6473 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )",
6474 SLAP_MR_HIDE | SLAP_MR_EXT, NULL,
6475 NULL, dnNormalize, dnRelativeMatch,
6479 {"( 1.3.6.1.4.1.4203.666.4.10 NAME 'dnSubordinateMatch' "
6480 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )",
6481 SLAP_MR_HIDE | SLAP_MR_EXT, NULL,
6482 NULL, dnNormalize, dnRelativeMatch,
6486 {"( 1.3.6.1.4.1.4203.666.4.11 NAME 'dnSuperiorMatch' "
6487 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )",
6488 SLAP_MR_HIDE | SLAP_MR_EXT, NULL,
6489 NULL, dnNormalize, dnRelativeMatch,
6493 {"( 1.2.36.79672281.1.13.3 NAME 'rdnMatch' "
6494 "SYNTAX 1.2.36.79672281.1.5.0 )",
6495 SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
6496 NULL, rdnNormalize, rdnMatch,
6497 octetStringIndexer, octetStringFilter,
6500 #ifdef LDAP_COMP_MATCH
6501 {"( 1.2.36.79672281.1.13.2 NAME 'componentFilterMatch' "
6502 "SYNTAX 1.2.36.79672281.1.5.2 )", /* componentFilterMatch assertion */
6503 SLAP_MR_EXT|SLAP_MR_COMPONENT, componentFilterMatchSyntaxes,
6504 NULL, NULL , componentFilterMatch,
6505 octetStringIndexer, octetStringFilter,
6508 {"( 1.2.36.79672281.1.13.6 NAME 'allComponentsMatch' "
6509 "SYNTAX 1.2.36.79672281.1.5.3 )", /* allComponents */
6510 SLAP_MR_EQUALITY|SLAP_MR_EXT|SLAP_MR_COMPONENT, NULL,
6511 NULL, NULL , allComponentsMatch,
6512 octetStringIndexer, octetStringFilter,
6515 {"( 1.2.36.79672281.1.13.7 NAME 'directoryComponentsMatch' "
6516 "SYNTAX 1.2.36.79672281.1.5.3 )", /* allComponents */
6517 SLAP_MR_EQUALITY|SLAP_MR_EXT|SLAP_MR_COMPONENT, NULL,
6518 NULL, NULL , directoryComponentsMatch,
6519 octetStringIndexer, octetStringFilter,
6523 {"( 2.5.13.2 NAME 'caseIgnoreMatch' "
6524 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )",
6525 SLAP_MR_EQUALITY | SLAP_MR_EXT, directoryStringSyntaxes,
6526 NULL, UTF8StringNormalize, octetStringMatch,
6527 octetStringIndexer, octetStringFilter,
6528 directoryStringApproxMatchOID },
6530 {"( 2.5.13.3 NAME 'caseIgnoreOrderingMatch' "
6531 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )",
6532 SLAP_MR_ORDERING | SLAP_MR_EXT, directoryStringSyntaxes,
6533 NULL, UTF8StringNormalize, octetStringOrderingMatch,
6535 "caseIgnoreMatch" },
6537 {"( 2.5.13.4 NAME 'caseIgnoreSubstringsMatch' "
6538 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )", /* Substring Assertion */
6539 SLAP_MR_SUBSTR, directoryStringSyntaxes,
6540 NULL, UTF8StringNormalize, directoryStringSubstringsMatch,
6541 octetStringSubstringsIndexer, octetStringSubstringsFilter,
6542 "caseIgnoreMatch" },
6544 {"( 2.5.13.5 NAME 'caseExactMatch' "
6545 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )",
6546 SLAP_MR_EQUALITY | SLAP_MR_EXT, directoryStringSyntaxes,
6547 NULL, UTF8StringNormalize, octetStringMatch,
6548 octetStringIndexer, octetStringFilter,
6549 directoryStringApproxMatchOID },
6551 {"( 2.5.13.6 NAME 'caseExactOrderingMatch' "
6552 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )",
6553 SLAP_MR_ORDERING | SLAP_MR_EXT, directoryStringSyntaxes,
6554 NULL, UTF8StringNormalize, octetStringOrderingMatch,
6558 {"( 2.5.13.7 NAME 'caseExactSubstringsMatch' "
6559 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )", /* Substring Assertion */
6560 SLAP_MR_SUBSTR, directoryStringSyntaxes,
6561 NULL, UTF8StringNormalize, directoryStringSubstringsMatch,
6562 octetStringSubstringsIndexer, octetStringSubstringsFilter,
6565 {"( 2.5.13.8 NAME 'numericStringMatch' "
6566 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.36 )",
6567 SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
6568 NULL, numericStringNormalize, octetStringMatch,
6569 octetStringIndexer, octetStringFilter,
6572 {"( 2.5.13.9 NAME 'numericStringOrderingMatch' "
6573 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.36 )",
6574 SLAP_MR_ORDERING | SLAP_MR_EXT, NULL,
6575 NULL, numericStringNormalize, octetStringOrderingMatch,
6577 "numericStringMatch" },
6579 {"( 2.5.13.10 NAME 'numericStringSubstringsMatch' "
6580 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )", /* Substring Assertion */
6581 SLAP_MR_SUBSTR, NULL,
6582 NULL, numericStringNormalize, octetStringSubstringsMatch,
6583 octetStringSubstringsIndexer, octetStringSubstringsFilter,
6584 "numericStringMatch" },
6586 {"( 2.5.13.11 NAME 'caseIgnoreListMatch' "
6587 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 )", /* Postal Address */
6588 SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
6589 NULL, postalAddressNormalize, octetStringMatch,
6590 octetStringIndexer, octetStringFilter,
6593 {"( 2.5.13.12 NAME 'caseIgnoreListSubstringsMatch' "
6594 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )", /* Substring Assertion */
6595 SLAP_MR_SUBSTR, NULL,
6596 NULL, NULL, NULL, NULL, NULL,
6597 "caseIgnoreListMatch" },
6599 {"( 2.5.13.13 NAME 'booleanMatch' "
6600 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 )",
6601 SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
6602 NULL, NULL, booleanMatch,
6603 octetStringIndexer, octetStringFilter,
6606 {"( 2.5.13.14 NAME 'integerMatch' "
6607 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )",
6608 SLAP_MR_EQUALITY | SLAP_MR_EXT | SLAP_MR_ORDERED_INDEX, NULL,
6609 NULL, NULL, integerMatch,
6610 integerIndexer, integerFilter,
6613 {"( 2.5.13.15 NAME 'integerOrderingMatch' "
6614 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )",
6615 SLAP_MR_ORDERING | SLAP_MR_EXT | SLAP_MR_ORDERED_INDEX, NULL,
6616 NULL, NULL, integerMatch,
6620 {"( 2.5.13.16 NAME 'bitStringMatch' "
6621 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.6 )",
6622 SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
6623 NULL, NULL, octetStringMatch,
6624 octetStringIndexer, octetStringFilter,
6627 {"( 2.5.13.17 NAME 'octetStringMatch' "
6628 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )",
6629 SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
6630 NULL, NULL, octetStringMatch,
6631 octetStringIndexer, octetStringFilter,
6634 {"( 2.5.13.18 NAME 'octetStringOrderingMatch' "
6635 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )",
6636 SLAP_MR_ORDERING | SLAP_MR_EXT, NULL,
6637 NULL, NULL, octetStringOrderingMatch,
6639 "octetStringMatch" },
6641 {"( 2.5.13.19 NAME 'octetStringSubstringsMatch' "
6642 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )",
6643 SLAP_MR_SUBSTR, NULL,
6644 NULL, NULL, octetStringSubstringsMatch,
6645 octetStringSubstringsIndexer, octetStringSubstringsFilter,
6646 "octetStringMatch" },
6648 {"( 2.5.13.20 NAME 'telephoneNumberMatch' "
6649 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.50 )",
6650 SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
6652 telephoneNumberNormalize, octetStringMatch,
6653 octetStringIndexer, octetStringFilter,
6656 {"( 2.5.13.21 NAME 'telephoneNumberSubstringsMatch' "
6657 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )", /* Substring Assertion */
6658 SLAP_MR_SUBSTR, NULL,
6659 NULL, telephoneNumberNormalize, octetStringSubstringsMatch,
6660 octetStringSubstringsIndexer, octetStringSubstringsFilter,
6661 "telephoneNumberMatch" },
6663 {"( 2.5.13.22 NAME 'presentationAddressMatch' "
6664 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.43 )",
6665 SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
6666 NULL, NULL, NULL, NULL, NULL, NULL },
6668 {"( 2.5.13.23 NAME 'uniqueMemberMatch' "
6669 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.34 )", /* Name And Optional UID */
6670 SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
6671 NULL, uniqueMemberNormalize, uniqueMemberMatch,
6672 uniqueMemberIndexer, uniqueMemberFilter,
6675 {"( 2.5.13.24 NAME 'protocolInformationMatch' "
6676 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.42 )",
6677 SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
6678 NULL, NULL, NULL, NULL, NULL, NULL },
6680 {"( 2.5.13.27 NAME 'generalizedTimeMatch' "
6681 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )",
6682 SLAP_MR_EQUALITY | SLAP_MR_EXT | SLAP_MR_ORDERED_INDEX, NULL,
6683 NULL, generalizedTimeNormalize, octetStringMatch,
6684 generalizedTimeIndexer, generalizedTimeFilter,
6687 {"( 2.5.13.28 NAME 'generalizedTimeOrderingMatch' "
6688 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )",
6689 SLAP_MR_ORDERING | SLAP_MR_EXT | SLAP_MR_ORDERED_INDEX, NULL,
6690 NULL, generalizedTimeNormalize, generalizedTimeOrderingMatch,
6692 "generalizedTimeMatch" },
6694 {"( 2.5.13.29 NAME 'integerFirstComponentMatch' "
6695 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )", /* Integer */
6696 SLAP_MR_EQUALITY | SLAP_MR_EXT,
6697 integerFirstComponentMatchSyntaxes,
6698 NULL, firstComponentNormalize, integerMatch,
6699 octetStringIndexer, octetStringFilter,
6702 {"( 2.5.13.30 NAME 'objectIdentifierFirstComponentMatch' "
6703 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )", /* OID */
6704 SLAP_MR_EQUALITY | SLAP_MR_EXT,
6705 objectIdentifierFirstComponentMatchSyntaxes,
6706 NULL, firstComponentNormalize, octetStringMatch,
6707 octetStringIndexer, octetStringFilter,
6710 {"( 2.5.13.34 NAME 'certificateExactMatch' "
6711 "SYNTAX 1.3.6.1.1.15.1 )", /* Certificate Exact Assertion */
6712 SLAP_MR_EQUALITY | SLAP_MR_EXT, certificateExactMatchSyntaxes,
6713 NULL, certificateExactNormalize, octetStringMatch,
6714 octetStringIndexer, octetStringFilter,
6717 {"( 2.5.13.35 NAME 'certificateMatch' "
6718 "SYNTAX 1.3.6.1.1.15.2 )", /* Certificate Assertion */
6719 SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
6720 NULL, NULL, NULL, NULL, NULL,
6723 {"( 2.5.13.38 NAME 'certificateListExactMatch' "
6724 "SYNTAX 1.3.6.1.1.15.5 )", /* Certificate List Exact Assertion */
6725 SLAP_MR_EQUALITY | SLAP_MR_EXT, certificateListExactMatchSyntaxes,
6726 NULL, certificateListExactNormalize, octetStringMatch,
6727 octetStringIndexer, octetStringFilter,
6730 {"( 2.5.13.39 NAME 'certificateListMatch' "
6731 "SYNTAX 1.3.6.1.1.15.6 )", /* Certificate List Assertion */
6732 SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
6733 NULL, NULL, NULL, NULL, NULL,
6736 {"( 2.5.13.45 NAME 'attributeCertificateExactMatch' "
6737 "SYNTAX " attributeCertificateExactAssertionSyntaxOID " )",
6738 SLAP_MR_EQUALITY | SLAP_MR_EXT | SLAP_MR_HIDE, attributeCertificateExactMatchSyntaxes,
6739 NULL, attributeCertificateExactNormalize, octetStringMatch,
6740 octetStringIndexer, octetStringFilter,
6743 {"( 2.5.13.46 NAME 'attributeCertificateMatch' "
6744 "SYNTAX " attributeCertificateAssertionSyntaxOID " )",
6745 SLAP_MR_EQUALITY | SLAP_MR_EXT | SLAP_MR_HIDE, NULL,
6746 NULL, NULL, NULL, NULL, NULL,
6749 {"( 1.3.6.1.4.1.1466.109.114.1 NAME 'caseExactIA5Match' "
6750 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )",
6751 SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
6752 NULL, IA5StringNormalize, octetStringMatch,
6753 octetStringIndexer, octetStringFilter,
6754 IA5StringApproxMatchOID },
6756 {"( 1.3.6.1.4.1.1466.109.114.2 NAME 'caseIgnoreIA5Match' "
6757 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )",
6758 SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
6759 NULL, IA5StringNormalize, octetStringMatch,
6760 octetStringIndexer, octetStringFilter,
6761 IA5StringApproxMatchOID },
6763 {"( 1.3.6.1.4.1.1466.109.114.3 NAME 'caseIgnoreIA5SubstringsMatch' "
6764 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )",
6765 SLAP_MR_SUBSTR, NULL,
6766 NULL, IA5StringNormalize, directoryStringSubstringsMatch,
6767 octetStringSubstringsIndexer, octetStringSubstringsFilter,
6768 "caseIgnoreIA5Match" },
6770 {"( 1.3.6.1.4.1.4203.1.2.1 NAME 'caseExactIA5SubstringsMatch' "
6771 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )",
6772 SLAP_MR_SUBSTR, NULL,
6773 NULL, IA5StringNormalize, directoryStringSubstringsMatch,
6774 octetStringSubstringsIndexer, octetStringSubstringsFilter,
6775 "caseExactIA5Match" },
6777 #ifdef SLAPD_AUTHPASSWD
6778 /* needs updating */
6779 {"( 1.3.6.1.4.1.4203.666.4.1 NAME 'authPasswordMatch' "
6780 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )", /* Octet String */
6781 SLAP_MR_HIDE | SLAP_MR_EQUALITY, NULL,
6782 NULL, NULL, authPasswordMatch,
6787 {"( 1.2.840.113556.1.4.803 NAME 'integerBitAndMatch' "
6788 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )", /* Integer */
6790 NULL, NULL, integerBitAndMatch,
6794 {"( 1.2.840.113556.1.4.804 NAME 'integerBitOrMatch' "
6795 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )", /* Integer */
6797 NULL, NULL, integerBitOrMatch,
6801 {"( 1.3.6.1.1.16.2 NAME 'UUIDMatch' "
6802 "SYNTAX 1.3.6.1.1.16.1 )",
6803 SLAP_MR_EQUALITY | SLAP_MR_MUTATION_NORMALIZER, NULL,
6804 NULL, UUIDNormalize, octetStringMatch,
6805 octetStringIndexer, octetStringFilter,
6808 {"( 1.3.6.1.1.16.3 NAME 'UUIDOrderingMatch' "
6809 "SYNTAX 1.3.6.1.1.16.1 )",
6810 SLAP_MR_ORDERING | SLAP_MR_MUTATION_NORMALIZER, NULL,
6811 NULL, UUIDNormalize, octetStringOrderingMatch,
6812 octetStringIndexer, octetStringFilter,
6815 {"( 1.3.6.1.4.1.4203.666.11.2.2 NAME 'CSNMatch' "
6816 "SYNTAX 1.3.6.1.4.1.4203.666.11.2.1 )",
6817 SLAP_MR_HIDE | SLAP_MR_EQUALITY | SLAP_MR_ORDERED_INDEX, NULL,
6818 NULL, csnNormalize, csnMatch,
6819 csnIndexer, csnFilter,
6822 {"( 1.3.6.1.4.1.4203.666.11.2.3 NAME 'CSNOrderingMatch' "
6823 "SYNTAX 1.3.6.1.4.1.4203.666.11.2.1 )",
6824 SLAP_MR_HIDE | SLAP_MR_ORDERING | SLAP_MR_EXT | SLAP_MR_ORDERED_INDEX, NULL,
6825 NULL, csnNormalize, csnOrderingMatch,
6829 {"( 1.3.6.1.4.1.4203.666.11.2.5 NAME 'CSNSIDMatch' "
6830 "SYNTAX 1.3.6.1.4.1.4203.666.11.2.4 )",
6831 SLAP_MR_HIDE | SLAP_MR_EQUALITY | SLAP_MR_EXT, csnSIDMatchSyntaxes,
6832 NULL, csnSidNormalize, octetStringMatch,
6833 octetStringIndexer, octetStringFilter,
6836 /* FIXME: OID is unused, but not registered yet */
6837 {"( 1.3.6.1.4.1.4203.666.4.12 NAME 'authzMatch' "
6838 "SYNTAX 1.3.6.1.4.1.4203.666.2.7 )", /* OpenLDAP authz */
6839 SLAP_MR_HIDE | SLAP_MR_EQUALITY, NULL,
6840 NULL, authzNormalize, authzMatch,
6844 {NULL, SLAP_MR_NONE, NULL,
6845 NULL, NULL, NULL, NULL, NULL,
6850 slap_schema_init( void )
6855 /* we should only be called once (from main) */
6856 assert( schema_init_done == 0 );
6858 for ( i=0; syntax_defs[i].sd_desc != NULL; i++ ) {
6859 res = register_syntax( &syntax_defs[i] );
6862 fprintf( stderr, "slap_schema_init: Error registering syntax %s\n",
6863 syntax_defs[i].sd_desc );
6868 for ( i=0; mrule_defs[i].mrd_desc != NULL; i++ ) {
6869 if( mrule_defs[i].mrd_usage == SLAP_MR_NONE &&
6870 mrule_defs[i].mrd_compat_syntaxes == NULL )
6873 "slap_schema_init: Ignoring unusable matching rule %s\n",
6874 mrule_defs[i].mrd_desc );
6878 res = register_matching_rule( &mrule_defs[i] );
6882 "slap_schema_init: Error registering matching rule %s\n",
6883 mrule_defs[i].mrd_desc );
6888 res = slap_schema_load();
6889 schema_init_done = 1;
6894 schema_destroy( void )
6903 if( schema_init_done ) {
6904 ldap_pvt_thread_mutex_destroy( &ad_index_mutex );
6905 ldap_pvt_thread_mutex_destroy( &ad_undef_mutex );
6906 ldap_pvt_thread_mutex_destroy( &oc_undef_mutex );