Patch: ACL #access-id#<invalid-DN> granted access to everyone (ITS#2006)

[openldap] / servers / slapd / at.c

diff --git a/servers/slapd/at.c b/servers/slapd/at.c
index 8925dd1984de0b56fe47ce27e99211cee2786631..911c46f8702d5a993233951d8e443d1abbd2d1c8 100644 (file)
--- a/servers/slapd/at.c
+++ b/servers/slapd/at.c
@@ -1,6 +1,6 @@
 /* $OpenLDAP$ */
 /*
- * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
+ * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
  */
 /* at.c - routines for dealing with attribute types */
@@ -204,7 +204,8 @@ at_destroy( void )
                ldap_pvt_thread_mutex_destroy(&a->sat_ad_mutex);
                ldap_attributetype_free((LDAPAttributeType *)a);
        }
-       ad_destroy(slap_schema.si_at_undefined->sat_ad);
+       if ( slap_schema.si_at_undefined )
+               ad_destroy(slap_schema.si_at_undefined->sat_ad);
 }
 
 static int
@@ -234,7 +235,7 @@ at_insert(
                                 (AVL_DUP) avl_dup_error ) ) {
                        *err = sat->sat_oid;
                        ldap_memfree(air);
-                       return SLAP_SCHERR_DUP_ATTR;
+                       return SLAP_SCHERR_ATTR_DUP;
                }
                /* FIX: temporal consistency check */
                at_bvfind(&air->air_name);
@@ -252,7 +253,7 @@ at_insert(
                                         (AVL_DUP) avl_dup_error ) ) {
                                *err = *names;
                                ldap_memfree(air);
-                               return SLAP_SCHERR_DUP_ATTR;
+                               return SLAP_SCHERR_ATTR_DUP;
                        }
                        /* FIX: temporal consistency check */
                        at_bvfind(&air->air_name);
@@ -273,13 +274,42 @@ at_add(
        MatchingRule    *mr;
        Syntax          *syn;
        int             code;
-       char                    *cname;
+       char    *cname;
+       char    *oid;
+
+       if ( !OID_LEADCHAR( at->at_oid[0] )) {
+               /* Expand OID macros */
+               oid = oidm_find( at->at_oid );
+               if ( !oid ) {
+                       *err = at->at_oid;
+                       return SLAP_SCHERR_OIDM;
+               }
+               if ( oid != at->at_oid ) {
+                       ldap_memfree( at->at_oid );
+                       at->at_oid = oid;
+               }
+       }
+
+       if ( at->at_syntax_oid && !OID_LEADCHAR( at->at_syntax_oid[0] )) {
+               /* Expand OID macros */
+               oid = oidm_find( at->at_syntax_oid );
+               if ( !oid ) {
+                       *err = at->at_syntax_oid;
+                       return SLAP_SCHERR_OIDM;
+               }
+               if ( oid != at->at_syntax_oid ) {
+                       ldap_memfree( at->at_syntax_oid );
+                       at->at_syntax_oid = oid;
+               }
+
+       }
 
        if ( at->at_names && at->at_names[0] ) {
                int i;
 
                for( i=0; at->at_names[i]; i++ ) {
                        if( !slap_valid_descr( at->at_names[i] ) ) {
+                               *err = at->at_names[i];
                                return SLAP_SCHERR_BAD_DESCR;
                        }
                }
@@ -288,12 +318,29 @@ at_add(
 
        } else if ( at->at_oid ) {
                cname = at->at_oid;
+
        } else {
+               *err = "";
                return SLAP_SCHERR_ATTR_INCOMPLETE;
        }
 
+       *err = cname;
+
+       if ( !at->at_usage && at->at_no_user_mod ) {
+               /* user attribute must be modifable */
+               return SLAP_SCHERR_ATTR_BAD_USAGE;
+       }
+
        if ( at->at_collective ) {
-               return SLAP_SCHERR_NOT_SUPPORTED;
+               if( at->at_usage ) {
+                       /* collective attributes cannot be operational */
+                       return SLAP_SCHERR_ATTR_BAD_USAGE;
+               }
+
+               if( at->at_single_value ) {
+                       /* collective attributes cannot be single-valued */
+                       return SLAP_SCHERR_ATTR_BAD_USAGE;
+               }
        }
 
        sat = (AttributeType *) ch_calloc( 1, sizeof(AttributeType) );
@@ -314,9 +361,18 @@ at_add(
                sat->sat_sup = supsat;
 
                if ( at_append_to_list(sat, &supsat->sat_subtypes) ) {
-                       *err = cname;
                        return SLAP_SCHERR_OUTOFMEM;
                }
+
+               if ( sat->sat_usage != supsat->sat_usage ) {
+                       /* subtypes must have same usage as their SUP */
+                       return SLAP_SCHERR_ATTR_BAD_USAGE;
+               }
+
+               if ( sat->sat_flags & SLAP_AT_FINAL ) {
+                       /* cannot subtype a "final" attribute type */
+                       return SLAP_SCHERR_ATTR_BAD_SUP;
+               }
        }
 
        /*
@@ -402,25 +458,26 @@ at_index_print( void )
 int
 at_schema_info( Entry *e )
 {
-       struct berval   val;
-       struct berval   *vals[2];
+       struct berval   vals[2];
        AttributeType   *at;
 
        AttributeDescription *ad_attributeTypes = slap_schema.si_ad_attributeTypes;
 
-       vals[0] = &val;
-       vals[1] = NULL;
+       vals[1].bv_val = NULL;
 
        for ( at = attr_list; at; at = at->sat_next ) {
-               if ( ldap_attributetype2bv( &at->sat_atype, &val ) == NULL ) {
+               if ( ldap_attributetype2bv( &at->sat_atype, vals ) == NULL ) {
                        return -1;
                }
+
+               if( at->sat_flags & SLAP_AT_HIDE ) continue;
+
 #if 0
                Debug( LDAP_DEBUG_TRACE, "Merging at [%ld] %s\n",
-                      (long) val.bv_len, val.bv_val, 0 );
+                      (long) vals[0].bv_len, vals[0].bv_val, 0 );
 #endif
                attr_merge( e, ad_attributeTypes, vals );
-               ldap_memfree( val.bv_val );
+               ldap_memfree( vals[0].bv_val );
        }
        return 0;
 }