cleanup version parsing

[openldap] / servers / slapd / back-ldap / config.c

diff --git a/servers/slapd/back-ldap/config.c b/servers/slapd/back-ldap/config.c
index 8462ad7746f66745a15badea6730036167d2b33e..c0123fe8ebc20e915492f5a9b614d5c6b521ba42 100644 (file)
--- a/servers/slapd/back-ldap/config.c
+++ b/servers/slapd/back-ldap/config.c
@@ -63,6 +63,7 @@ enum {
        LDAP_BACK_CFG_IDLE_TIMEOUT,
        LDAP_BACK_CFG_CONN_TTL,
        LDAP_BACK_CFG_NETWORK_TIMEOUT,
+       LDAP_BACK_CFG_VERSION,
        LDAP_BACK_CFG_REWRITE,
 
        LDAP_BACK_CFG_LAST
@@ -241,6 +242,14 @@ static ConfigTable ldapcfg[] = {
                        "SYNTAX OMsDirectoryString "
                        "SINGLE-VALUE )",
                NULL, NULL },
+       { "protocol-version", "version", 2, 0, 0,
+               ARG_MAGIC|ARG_INT|LDAP_BACK_CFG_VERSION,
+               ldap_back_cf_gen, "( OLcfgDbAt:3.18 "
+                       "NAME 'olcDbProtocolVersion' "
+                       "DESC 'protocol version' "
+                       "SYNTAX OMsInteger "
+                       "SINGLE-VALUE )",
+               NULL, NULL },
        { "suffixmassage", "[virtual]> <real", 2, 3, 0,
                ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_REWRITE,
                ldap_back_cf_gen, NULL, NULL, NULL },
@@ -453,7 +462,7 @@ ldap_back_cf_gen( ConfigArgs *c )
                                        (void)lutil_strcopy( ptr, "authz=native" );
                                }
 
-                               len = bv.bv_len + STRLENOF( "flags=non-prescriptive,override" );
+                               len = bv.bv_len + STRLENOF( "flags=non-prescriptive,override,obsolete-encoding-workaround" );
                                /* flags */
                                if ( !BER_BVISEMPTY( &bv ) ) {
                                        len += STRLENOF( " " );
@@ -479,6 +488,13 @@ ldap_back_cf_gen( ConfigArgs *c )
                                        ptr = lutil_strcopy( ptr, ",override" );
                                }
 
+                               if ( li->li_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_PROXY_AUTHZ ) {
+                                       ptr = lutil_strcopy( ptr, ",obsolete-proxy-authz" );
+
+                               } else if ( li->li_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_ENCODING_WORKAROUND ) {
+                                       ptr = lutil_strcopy( ptr, ",obsolete-encoding-workaround" );
+                               }
+
                                bv.bv_len = ( ptr - bv.bv_val );
                                /* end-of-flags */
                        }
@@ -605,6 +621,14 @@ ldap_back_cf_gen( ConfigArgs *c )
                        value_add_one( &c->rvalue_vals, &bv );
                        } break;
 
+               case LDAP_BACK_CFG_VERSION:
+                       if ( li->li_version == 0 ) {
+                               return 1;
+                       }
+
+                       c->value_int = li->li_version;
+                       break;
+
                default:
                        /* FIXME: we need to handle all... */
                        assert( 0 );
@@ -691,7 +715,11 @@ ldap_back_cf_gen( ConfigArgs *c )
                        break;
 
                case LDAP_BACK_CFG_NETWORK_TIMEOUT:
-                       li->li_network_timeout;
+                       li->li_network_timeout = 0;
+                       break;
+
+               case LDAP_BACK_CFG_VERSION:
+                       li->li_version = 0;
                        break;
 
                default:
@@ -967,6 +995,28 @@ done_url:;
                                } else if ( strcasecmp( c->argv[ i ], "non-prescriptive" ) == 0 ) {
                                        li->li_idassert_flags &= ( ~LDAP_BACK_AUTH_PRESCRIPTIVE );
 
+                               } else if ( strcasecmp( c->argv[ i ], "obsolete-proxy-authz" ) == 0 ) {
+                                       if ( li->li_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_ENCODING_WORKAROUND ) {
+                                               Debug( LDAP_DEBUG_ANY,
+                                                               "%s: line %d: \"obsolete-proxy-authz\" flag "
+                                                       "in \"idassert-mode <args>\" "
+                                                       "incompatible with previously issued \"obsolete-encoding-workaround\" flag.\n",
+                                                       c->fname, c->lineno, 0 );
+                                               return 1;
+                                       }
+                                       li->li_idassert_flags |= LDAP_BACK_AUTH_OBSOLETE_PROXY_AUTHZ;
+
+                               } else if ( strcasecmp( c->argv[ i ], "obsolete-encoding-workaround" ) == 0 ) {
+                                       if ( li->li_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_PROXY_AUTHZ ) {
+                                               Debug( LDAP_DEBUG_ANY,
+                                                               "%s: line %d: \"obsolete-encoding-workaround\" flag "
+                                                       "in \"idassert-mode <args>\" "
+                                                       "incompatible with previously issued \"obsolete-proxy-authz\" flag.\n",
+                                                       c->fname, c->lineno, 0 );
+                                               return 1;
+                                       }
+                                       li->li_idassert_flags |= LDAP_BACK_AUTH_OBSOLETE_ENCODING_WORKAROUND;
+
                                } else {
                                        Debug( LDAP_DEBUG_ANY,
                                                "%s: line %d: unknown flag #%d "
@@ -1030,7 +1080,6 @@ done_url:;
 
        case LDAP_BACK_CFG_IDASSERT_AUTHZFROM: {
                struct berval   bv;
-#ifdef SLAP_AUTHZ_SYNTAX
                struct berval   in;
                int             rc;
 
@@ -1043,9 +1092,6 @@ done_url:;
                        Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
                        return 1;
                }
-#else /* !SLAP_AUTHZ_SYNTAX */
-               ber_str2bv( c->argv[ 1 ], 0, 1, &bv );
-#endif /* !SLAP_AUTHZ_SYNTAX */
                ber_bvarray_add( &li->li_idassert_authz, &bv );
                } break;
 
@@ -1104,7 +1150,7 @@ done_url:;
                        } else if ( strncasecmp( c->argv[ i ], "flags=", STRLENOF( "flags=" ) ) == 0 ) {
                                char    *argvi = c->argv[ i ] + STRLENOF( "flags=" );
                                char    **flags = ldap_str2charray( argvi, "," );
-                               int     j;
+                               int     j, err = 0;
 
                                if ( flags == NULL ) {
                                        snprintf( c->msg, sizeof( c->msg ),
@@ -1116,6 +1162,7 @@ done_url:;
                                }
 
                                for ( j = 0; flags[ j ] != NULL; j++ ) {
+
                                        if ( strcasecmp( flags[ j ], "override" ) == 0 ) {
                                                li->li_idassert_flags |= LDAP_BACK_AUTH_OVERRIDE;
 
@@ -1125,18 +1172,49 @@ done_url:;
                                        } else if ( strcasecmp( flags[ j ], "non-prescriptive" ) == 0 ) {
                                                li->li_idassert_flags &= ( ~LDAP_BACK_AUTH_PRESCRIPTIVE );
 
+                                       } else if ( strcasecmp( flags[ j ], "obsolete-proxy-authz" ) == 0 ) {
+                                               if ( li->li_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_ENCODING_WORKAROUND ) {
+                                                       Debug( LDAP_DEBUG_ANY,
+                                                                       "%s: line %d: \"obsolete-proxy-authz\" flag "
+                                                                       "in \"idassert-mode <args>\" "
+                                                                       "incompatible with previously issued \"obsolete-encoding-workaround\" flag.\n",
+                                                                       c->fname, c->lineno, 0 );
+                                                       err = 1;
+                                                       break;
+
+                                               } else {
+                                                       li->li_idassert_flags |= LDAP_BACK_AUTH_OBSOLETE_PROXY_AUTHZ;
+                                               }
+
+                                       } else if ( strcasecmp( flags[ j ], "obsolete-encoding-workaround" ) == 0 ) {
+                                               if ( li->li_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_PROXY_AUTHZ ) {
+                                                       Debug( LDAP_DEBUG_ANY,
+                                                                       "%s: line %d: \"obsolete-encoding-workaround\" flag "
+                                                               "in \"idassert-mode <args>\" "
+                                                               "incompatible with previously issued \"obsolete-proxy-authz\" flag.\n",
+                                                               c->fname, c->lineno, 0 );
+                                                       err = 1;
+                                                       break;
+
+                                               } else {
+                                                       li->li_idassert_flags |= LDAP_BACK_AUTH_OBSOLETE_ENCODING_WORKAROUND;
+                                               }
+
                                        } else {
                                                snprintf( c->msg, sizeof( c->msg ),
                                                        "\"idassert-bind <args>\": "
                                                        "unknown flag \"%s\"",
                                                        flags[ j ] );
                                                Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
-                                               ldap_charray_free( flags );
-                                               return 1;
+                                               err = 1;
+                                               break;
                                        }
                                }
 
                                ldap_charray_free( flags );
+                               if ( err ) {
+                                       return 1;
+                               }
 
                        } else if ( bindconf_parse( c->argv[ i ], &li->li_idassert ) ) {
                                return 1;
@@ -1244,6 +1322,19 @@ done_url:;
                li->li_network_timeout = (time_t)t;
                } break;
 
+       case LDAP_BACK_CFG_VERSION:
+               if ( c->value_int != 0 && ( c->value_int < LDAP_VERSION_MIN || c->value_int > LDAP_VERSION_MAX ) ) {
+                       snprintf( c->msg, sizeof( c->msg ),
+                               "unsupported version \"%s\" "
+                               "in \"protocol-version <version>\"",
+                               c->argv[ 1 ] );
+                       Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
+                       return 1;
+               }
+
+               li->li_version = c->value_int;
+               break;
+
        case LDAP_BACK_CFG_REWRITE:
                snprintf( c->msg, sizeof( c->msg ),
                        "rewrite/remap capabilities have been moved "