/* $OpenLDAP$ */
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
*
- * Copyright 2005-2011 The OpenLDAP Foundation.
+ * Copyright 2005-2014 The OpenLDAP Foundation.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
#ifdef SLAP_AUTH_REWRITE
static BerVarray authz_rewrites;
#endif
+static AccessControl *defacl_parsed = NULL;
static struct berval cfdir;
* OLcfg{Bk|Db}{Oc|At}:0 -> common
* OLcfg{Bk|Db}{Oc|At}:1 -> back-bdb(/back-hdb)
* OLcfg{Bk|Db}{Oc|At}:2 -> back-ldif
- * OLcfg{Bk|Db}{Oc|At}:3 -> back-ldap
+ * OLcfg{Bk|Db}{Oc|At}:3 -> back-ldap/meta
* OLcfg{Bk|Db}{Oc|At}:4 -> back-monitor
* OLcfg{Bk|Db}{Oc|At}:5 -> back-relay
- * OLcfg{Bk|Db}{Oc|At}:6 -> back-sql
+ * OLcfg{Bk|Db}{Oc|At}:6 -> back-sql(/back-ndb)
* OLcfg{Bk|Db}{Oc|At}:7 -> back-sock
* OLcfg{Bk|Db}{Oc|At}:8 -> back-null
+ * OLcfg{Bk|Db}{Oc|At}:9 -> back-passwd
+ * OLcfg{Bk|Db}{Oc|At}:10 -> back-shell
+ * OLcfg{Bk|Db}{Oc|At}:11 -> back-perl
+ * OLcfg{Bk|Db}{Oc|At}:12 -> back-mdb
*/
/*
{ "index_substr_if_maxlen", "max", 2, 2, 0, ARG_UINT|ARG_NONZERO|ARG_MAGIC|CFG_SSTR_IF_MAX,
&config_generic, "( OLcfgGlAt:21 NAME 'olcIndexSubstrIfMaxLen' "
"SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
- { "index_substr_any_len", "len", 2, 2, 0, ARG_INT|ARG_NONZERO,
+ { "index_substr_any_len", "len", 2, 2, 0, ARG_UINT|ARG_NONZERO,
&index_substr_any_len, "( OLcfgGlAt:22 NAME 'olcIndexSubstrAnyLen' "
"SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
- { "index_substr_any_step", "step", 2, 2, 0, ARG_INT|ARG_NONZERO,
+ { "index_substr_any_step", "step", 2, 2, 0, ARG_UINT|ARG_NONZERO,
&index_substr_any_step, "( OLcfgGlAt:23 NAME 'olcIndexSubstrAnyStep' "
"SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
- { "index_intlen", "len", 2, 2, 0, ARG_INT|ARG_MAGIC|CFG_IX_INTLEN,
+ { "index_intlen", "len", 2, 2, 0, ARG_UINT|ARG_MAGIC|CFG_IX_INTLEN,
&config_generic, "( OLcfgGlAt:84 NAME 'olcIndexIntLen' "
"SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
{ "lastmod", "on|off", 2, 2, 0, ARG_DB|ARG_ON_OFF|ARG_MAGIC|CFG_LASTMOD,
"olcDisallows $ olcGentleHUP $ olcIdleTimeout $ "
"olcIndexSubstrIfMaxLen $ olcIndexSubstrIfMinLen $ "
"olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ "
- "olcLocalSSF $ olcLogFile $ olcLogLevel $ "
+ "olcListenerThreads $ olcLocalSSF $ olcLogFile $ olcLogLevel $ "
"olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ "
"olcPluginLogFile $ olcReadOnly $ olcReferral $ "
"olcReplogFile $ olcRequires $ olcRestrict $ olcReverseLookup $ "
"olcTLSCACertificatePath $ olcTLSCertificateFile $ "
"olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ "
"olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ "
- "olcTLSCRLFile $ olcToolThreads $ olcWriteTimeout $ "
+ "olcTLSCRLFile $ olcTLSProtocolMin $ olcToolThreads $ olcWriteTimeout $ "
"olcObjectIdentifier $ olcAttributeTypes $ olcObjectClasses $ "
"olcDitContentRules $ olcLdapSyntaxes ) )", Cft_Global },
{ "( OLcfgGlOc:2 "
"NAME 'olcSchemaConfig' "
"DESC 'OpenLDAP schema object' "
"SUP olcConfig STRUCTURAL "
- "MAY ( cn $ olcObjectIdentifier $ olcAttributeTypes $ "
- "olcObjectClasses $ olcDitContentRules $ olcLdapSyntaxes ) )",
+ "MAY ( cn $ olcObjectIdentifier $ olcLdapSyntaxes $ "
+ "olcAttributeTypes $ olcObjectClasses $ olcDitContentRules ) )",
Cft_Schema, NULL, cfAddSchema },
{ "( OLcfgGlOc:3 "
"NAME 'olcBackendConfig' "
} ServerID;
static ServerID *sid_list;
+static ServerID *sid_set;
typedef struct voidList {
struct voidList *vl_next;
break;
case CFG_MIRRORMODE:
if ( SLAP_SHADOW(c->be))
- c->value_int = (SLAP_SINGLE_SHADOW(c->be) == 0);
+ c->value_int = (SLAP_MULTIMASTER(c->be) != 0);
else
rc = 1;
break;
case CFG_AZPOLICY:
case CFG_DEPTH:
case CFG_LASTMOD:
- case CFG_MIRRORMODE:
case CFG_MONITORING:
case CFG_SASLSECP:
case CFG_SSTR_IF_MAX:
snprintf(c->log, sizeof( c->log ), "change requires slapd restart");
break;
+ case CFG_MIRRORMODE:
+ SLAP_DBFLAGS(c->be) &= ~SLAP_DBFLAG_MULTI_SHADOW;
+ if(SLAP_SHADOW(c->be))
+ SLAP_DBFLAGS(c->be) |= SLAP_DBFLAG_SINGLE_SHADOW;
+ break;
+
case CFG_SALT:
ch_free( passwd_salt );
passwd_salt = NULL;
si; si = *sip, i++ ) {
if ( c->valx == -1 || i == c->valx ) {
*sip = si->si_next;
+ if ( sid_set == si )
+ sid_set = NULL;
ch_free( si );
if ( c->valx >= 0 )
break;
*prev = a->acl_next;
acl_free( a );
}
+ if ( SLAP_CONFIG( c->be ) && !c->be->be_acl ) {
+ Debug( LDAP_DEBUG_CONFIG, "config_generic (CFG_ACL): "
+ "Last explicit ACL for back-config removed. "
+ "Using hardcoded default\n", 0, 0, 0 );
+ c->be->be_acl = defacl_parsed;
+ }
break;
case CFG_OC: {
/* else prev is NULL, append to end of global list */
}
if(parse_oc(c, &oc, prev)) return(1);
- if (!cfn->c_oc_head) cfn->c_oc_head = oc;
+ if (!cfn->c_oc_head || !c->valx) cfn->c_oc_head = oc;
if (cfn->c_oc_tail == prev) cfn->c_oc_tail = oc;
}
break;
/* else prev is NULL, append to end of global list */
}
if(parse_at(c, &at, prev)) return(1);
- if (!cfn->c_at_head) cfn->c_at_head = at;
+ if (!cfn->c_at_head || !c->valx) cfn->c_at_head = at;
if (cfn->c_at_tail == prev) cfn->c_at_tail = at;
}
break;
/* else prev is NULL, append to end of global list */
}
if ( parse_syn( c, &syn, prev ) ) return(1);
- if ( !cfn->c_syn_head ) cfn->c_syn_head = syn;
+ if ( !cfn->c_syn_head || !c->valx ) cfn->c_syn_head = syn;
if ( cfn->c_syn_tail == prev ) cfn->c_syn_tail = syn;
}
break;
break;
case CFG_ACL:
+ if ( SLAP_CONFIG( c->be ) && c->be->be_acl == defacl_parsed) {
+ c->be->be_acl = NULL;
+ }
/* Don't append to the global ACL if we're on a specific DB */
i = c->valx;
if ( c->valx == -1 ) {
i++;
}
if ( parse_acl(c->be, c->fname, c->lineno, c->argc, c->argv, i ) ) {
+ if ( SLAP_CONFIG( c->be ) && !c->be->be_acl) {
+ c->be->be_acl = defacl_parsed;
+ }
return 1;
}
break;
Debug( LDAP_DEBUG_CONFIG,
"%s: SID=0x%03x\n",
c->log, slap_serverID, 0 );
+ sid_set = si;
}
si->si_next = NULL;
si->si_num = num;
if (( slapMode & SLAP_SERVER_MODE ) && c->argc > 2 ) {
Listener *l = config_check_my_url( c->argv[2], lud );
if ( l ) {
+ if ( sid_set ) {
+ ldap_free_urldesc( lud );
+ snprintf( c->cr_msg, sizeof( c->cr_msg ),
+ "<%s> multiple server ID URLs matched, only one is allowed", c->argv[0] );
+ Debug(LDAP_DEBUG_ANY, "%s: %s %s\n",
+ c->log, c->cr_msg, c->argv[1] );
+ return 1;
+ }
slap_serverID = si->si_num;
Debug( LDAP_DEBUG_CONFIG,
"%s: SID=0x%03x (listener=%s)\n",
c->log, slap_serverID,
l->sl_url.bv_val );
+ sid_set = si;
}
}
if ( c->argc > 2 )
c->log, c->cr_msg, 0 );
return(1);
}
- if(c->value_int)
+ if(c->value_int) {
SLAP_DBFLAGS(c->be) &= ~SLAP_DBFLAG_SINGLE_SHADOW;
- else
+ SLAP_DBFLAGS(c->be) |= SLAP_DBFLAG_MULTI_SHADOW;
+ } else {
SLAP_DBFLAGS(c->be) |= SLAP_DBFLAG_SINGLE_SHADOW;
+ SLAP_DBFLAGS(c->be) &= ~SLAP_DBFLAG_MULTI_SHADOW;
+ }
break;
case CFG_MONITORING:
}
#endif
- if (SLAP_DB_ONE_SUFFIX( c->be ) && c->be->be_suffix ) {
+ if (SLAP_DB_ONE_SUFFIX( c->be ) && c->be->be_suffix &&
+ !BER_BVISNULL( &c->be->be_suffix[0] )) {
snprintf( c->cr_msg, sizeof( c->cr_msg ), "<%s> Only one suffix is allowed on this %s backend",
c->argv[0], c->be->bd_info->bi_type );
Debug(LDAP_DEBUG_ANY, "%s: %s\n",
if ( !c->line ) {
c->be->be_restrictops = 0;
} else {
- restrictops = verb_to_mask( c->line, restrictable_ops );
- c->be->be_restrictops ^= restrictops;
+ i = verb_to_mask( c->line, restrictable_ops );
+ c->be->be_restrictops &= ~restrictable_ops[i].mask;
}
return 0;
}
if ( !c->line ) {
global_allows = 0;
} else {
- allows = verb_to_mask( c->line, allowable_ops );
- global_allows ^= allows;
+ i = verb_to_mask( c->line, allowable_ops );
+ global_allows &= ~allowable_ops[i].mask;
}
return 0;
}
if ( !c->line ) {
global_disallows = 0;
} else {
- disallows = verb_to_mask( c->line, disallowable_ops );
- global_disallows ^= disallows;
+ i = verb_to_mask( c->line, disallowable_ops );
+ global_disallows &= ~disallowable_ops[i].mask;
}
return 0;
}
if ( !c->line ) {
c->be->be_requires = 0;
} else {
- requires = verb_to_mask( c->line, requires_ops );
- c->be->be_requires ^= requires;
+ i = verb_to_mask( c->line, requires_ops );
+ c->be->be_requires &= ~requires_ops[i].mask;
}
return 0;
}
loglevel_init();
}
+ if ( l == 0 ) {
+ struct berval bv = BER_BVC("0");
+ return value_add_one( bva, &bv );
+ }
+
return mask_to_verbs( loglevel_ops, l, bva );
}
if ( !c->line ) {
config_syslog = 0;
} else {
- int level = verb_to_mask( c->line, loglevel_ops );
- config_syslog ^= level;
+ i = verb_to_mask( c->line, loglevel_ops );
+ config_syslog &= ~loglevel_ops[i].mask;
}
if ( slapMode & SLAP_SERVER_MODE ) {
ldap_syslog = config_syslog;
}
} else {
- SLAP_DBFLAGS(c->be) |= (SLAP_DBFLAG_SHADOW | SLAP_DBFLAG_SINGLE_SHADOW | flag);
+ SLAP_DBFLAGS(c->be) |= (SLAP_DBFLAG_SHADOW | flag);
+ if ( !SLAP_MULTIMASTER( c->be ))
+ SLAP_DBFLAGS(c->be) |= SLAP_DBFLAG_SINGLE_SHADOW;
}
return 0;
int opt = 1;
ldap_pvt_tls_ctx_free( slap_tls_ctx );
+ slap_tls_ctx = NULL;
/* Force new ctx to be created */
rc = ldap_pvt_tls_set_option( slap_tls_ld, LDAP_OPT_X_TLS_NEWCTX, &opt );
ldap_pvt_tls_get_option( slap_tls_ld, LDAP_OPT_X_TLS_CTX, &slap_tls_ctx );
/* This is a no-op if it's already loaded */
load_extop( &slap_EXOP_START_TLS, 0, starttls_extop );
+ } else {
+ if ( rc == LDAP_NOT_SUPPORTED )
+ rc = LDAP_UNWILLING_TO_PERFORM;
+ else
+ rc = LDAP_OTHER;
}
}
return rc;
}
ch_free( c->value_string );
c->cleanup = config_tls_cleanup;
- if ( isdigit( (unsigned char)c->argv[1][0] ) ) {
+ if ( isdigit( (unsigned char)c->argv[1][0] ) && c->type != CFG_TLS_PROTOCOL_MIN ) {
if ( lutil_atoi( &i, c->argv[1] ) != 0 ) {
Debug(LDAP_DEBUG_ANY, "%s: "
"unable to parse %s \"%s\"\n",
assert( 0 );
}
}
+ if ( rc == 0 && ( slapMode & SLAP_SERVER_MODE ) && sid_list ) {
+ if ( !BER_BVISEMPTY( &sid_list->si_url ) && !sid_set ) {
+ Debug(LDAP_DEBUG_ANY, "read_config: no serverID / URL match found. "
+ "Check slapd -h arguments.\n", 0,0,0 );
+ rc = LDAP_OTHER;
+ }
+ }
return rc;
}
}
}
- /* count related kids */
- for (nsibs=0, ce=parent->ce_kids; ce; ce=ce->ce_sibs) {
- if ( ce->ce_type == ce_type ) nsibs++;
+ /* count related kids.
+ * For entries of type Cft_Misc, only count siblings with same RDN type
+ */
+ if ( ce_type == Cft_Misc ) {
+ rdn.bv_val = e->e_nname.bv_val;
+ ptr1 = strchr( rdn.bv_val, '=' );
+ assert( ptr1 != NULL );
+
+ rdn.bv_len = ptr1 - rdn.bv_val;
+
+ for (nsibs=0, ce=parent->ce_kids; ce; ce=ce->ce_sibs) {
+ struct berval rdn2;
+ if ( ce->ce_type != ce_type )
+ continue;
+
+ dnRdn( &ce->ce_entry->e_nname, &rdn2 );
+
+ ptr1 = strchr( rdn2.bv_val, '=' );
+ assert( ptr1 != NULL );
+
+ rdn2.bv_len = ptr1 - rdn2.bv_val;
+ if ( bvmatch( &rdn, &rdn2 ))
+ nsibs++;
+ }
+ } else {
+ for (nsibs=0, ce=parent->ce_kids; ce; ce=ce->ce_sibs) {
+ if ( ce->ce_type == ce_type ) nsibs++;
+ }
}
/* account for -1 frontend */
/* FALLTHRU: LDAP_MOD_REPLACE && vals */
case LDAP_MOD_ADD:
+ if ( !a )
+ break;
for (i=0; ml->sml_values[i].bv_val; i++) {
ca->line = ml->sml_values[i].bv_val;
ca->valx = -1;
ca->reply = msg;
}
- if ( ca->cleanup )
- ca->cleanup( ca );
+ if ( ca->cleanup ) {
+ i = ca->cleanup( ca );
+ if (rc == LDAP_SUCCESS)
+ rc = i;
+ }
out_noop:
if ( rc == LDAP_SUCCESS ) {
attrs_free( save_attrs );
rs->sr_matched = last->ce_entry->e_name.bv_val;
rs->sr_err = LDAP_NO_SUCH_OBJECT;
} else if ( ce->ce_kids ) {
- rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
+ rs->sr_err = LDAP_NOT_ALLOWED_ON_NONLEAF;
} else if ( op->o_abandon ) {
rs->sr_err = SLAPD_ABANDON;
- } else if ( ce->ce_type == Cft_Overlay ){
+ } else if ( ce->ce_type == Cft_Overlay ||
+ ce->ce_type == Cft_Database ||
+ ce->ce_type == Cft_Misc ){
char *iptr;
int count, ixold;
ldap_pvt_thread_pool_pause( &connection_pool );
-
- overlay_remove( ce->ce_be, (slap_overinst *)ce->ce_bi );
+
+ if ( ce->ce_type == Cft_Overlay ){
+ overlay_remove( ce->ce_be, (slap_overinst *)ce->ce_bi, op );
+ } else if ( ce->ce_type == Cft_Misc ) {
+ /*
+ * only Cft_Misc objects that have a co_lddel handler set in
+ * the ConfigOCs struct can be deleted. This code also
+ * assumes that the entry can be only have one objectclass
+ * with co_type == Cft_Misc
+ */
+ ConfigOCs co, *coptr;
+ Attribute *oc_at;
+ int i;
+
+ oc_at = attr_find( ce->ce_entry->e_attrs,
+ slap_schema.si_ad_objectClass );
+ if ( !oc_at ) {
+ rs->sr_err = LDAP_OTHER;
+ rs->sr_text = "objectclass not found";
+ ldap_pvt_thread_pool_resume( &connection_pool );
+ goto out;
+ }
+ for ( i=0; !BER_BVISNULL(&oc_at->a_nvals[i]); i++ ) {
+ co.co_name = &oc_at->a_nvals[i];
+ coptr = avl_find( CfOcTree, &co, CfOc_cmp );
+ if ( coptr == NULL || coptr->co_type != Cft_Misc ) {
+ continue;
+ }
+ if ( ! coptr->co_lddel || coptr->co_lddel( ce, op ) ){
+ rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
+ if ( ! coptr->co_lddel ) {
+ rs->sr_text = "No delete handler found";
+ } else {
+ rs->sr_err = LDAP_OTHER;
+ /* FIXME: We should return a helpful error message
+ * here */
+ }
+ ldap_pvt_thread_pool_resume( &connection_pool );
+ goto out;
+ }
+ break;
+ }
+ } else if (ce->ce_type == Cft_Database ) {
+ if ( ce->ce_be == frontendDB || ce->ce_be == op->o_bd ){
+ rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
+ rs->sr_text = "Cannot delete config or frontend database";
+ ldap_pvt_thread_pool_resume( &connection_pool );
+ goto out;
+ }
+ if ( ce->ce_be->bd_info->bi_db_close ) {
+ ce->ce_be->bd_info->bi_db_close( ce->ce_be, NULL );
+ }
+ backend_destroy_one( ce->ce_be, 1);
+ }
/* remove CfEntryInfo from the siblings list */
if ( ce->ce_parent->ce_kids == ce ) {
} else {
rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
}
+out:
#else
rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
#endif /* SLAP_CONFIG_DELETE */
return rc;
}
-static AccessControl *defacl_parsed = NULL;
-
-int config_back_access_allowed(
- Operation *op,
- Entry *e,
- AttributeDescription *desc,
- struct berval *val,
- slap_access_t access,
- AccessControlState *state,
- slap_mask_t *maskp )
-{
- int result;
- BackendDB *be_orig = op->o_bd, db = *op->o_bd;
-
- /* If we have no explicitly configured ACLs, don't just use
- * the global ACLs. Explicitly deny access to everything.
- */
- if ( ! db.be_acl ) {
- Debug( LDAP_DEBUG_ACL, "=> config_back_access_allowed: "
- "No explicit ACL for back-config configured, "
- "using hardcoded default\n", 0, 0, 0 );
- db.be_acl = defacl_parsed;
- op->o_bd = &db;
- }
- result = slap_access_allowed( op, e , desc, val, access, state, maskp );
- op->o_bd = be_orig;
- return result;
-}
-
static int
config_build_attrs( Entry *e, AttributeType **at, AttributeDescription *ad,
ConfigTable *ct, ConfigArgs *c )
{
Entry *e = entry_alloc();
CfEntryInfo *ce = ch_calloc( 1, sizeof(CfEntryInfo) );
- struct berval val;
- struct berval ad_name;
AttributeDescription *ad = NULL;
int rc;
char *ptr;
struct berval pdn;
ObjectClass *oc;
CfEntryInfo *ceprev = NULL;
+ LDAPRDN srdn = NULL;
Debug( LDAP_DEBUG_TRACE, "config_build_entry: \"%s\"\n", rdn->bv_val, 0, 0);
e->e_private = ce;
if ( extra )
attr_merge_normalize_one(e, slap_schema.si_ad_objectClass,
extra->co_name, NULL );
- ptr = strchr(rdn->bv_val, '=');
- ad_name.bv_val = rdn->bv_val;
- ad_name.bv_len = ptr - rdn->bv_val;
- rc = slap_bv2ad( &ad_name, &ad, &text );
+ if ( ldap_bv2rdn_x( rdn, &srdn, &ptr, LDAP_DN_FORMAT_LDAP, op->o_tmpmemctx ))
+ goto fail;
+
+ rc = slap_bv2ad( &srdn[0]->la_attr, &ad, &text );
if ( rc ) {
+ ldap_rdnfree_x( srdn, op->o_tmpmemctx );
goto fail;
}
- val.bv_val = ptr+1;
- val.bv_len = rdn->bv_len - (val.bv_val - rdn->bv_val);
- attr_merge_normalize_one(e, ad, &val, NULL );
+ attr_merge_normalize_one(e, ad, &srdn[0]->la_value, NULL );
+ ldap_rdnfree_x( srdn, op->o_tmpmemctx );
+ srdn = NULL;
oc = main->co_oc;
c->table = main->co_type;
for (; cf; cf=cf->c_sibs, c->depth++) {
if ( !cf->c_at_head && !cf->c_cr_head && !cf->c_oc_head &&
- !cf->c_om_head && !cf->c_syn_head ) continue;
+ !cf->c_om_head && !cf->c_syn_head && !cf->c_kids ) continue;
c->value_dn.bv_val = c->log;
LUTIL_SLASHPATH( cf->c_file.bv_val );
bv.bv_val = strrchr(cf->c_file.bv_val, LDAP_DIRSEP[0]);
ptr = strchr( bv.bv_val, '.' );
if ( ptr )
bv.bv_len = ptr - bv.bv_val;
- c->value_dn.bv_len = snprintf(c->value_dn.bv_val, sizeof( c->log ), "cn=" SLAP_X_ORDERED_FMT, c->depth);
+ c->value_dn.bv_len = snprintf(c->value_dn.bv_val, sizeof( c->log ), "cn=\"" SLAP_X_ORDERED_FMT, c->depth);
if ( c->value_dn.bv_len >= sizeof( c->log ) ) {
/* FIXME: how can indicate error? */
return -1;
strncpy( c->value_dn.bv_val + c->value_dn.bv_len, bv.bv_val,
bv.bv_len );
c->value_dn.bv_len += bv.bv_len;
+ c->value_dn.bv_val[c->value_dn.bv_len] ='"';
+ c->value_dn.bv_len++;
c->value_dn.bv_val[c->value_dn.bv_len] ='\0';
- rdnNormalize( 0, NULL, NULL, &c->value_dn, &rdn, NULL );
+ if ( rdnNormalize( 0, NULL, NULL, &c->value_dn, &rdn, NULL )) {
+ Debug( LDAP_DEBUG_ANY,
+ "config_build_schema_inc: invalid schema name \"%s\"\n",
+ bv.bv_val, 0, 0 );
+ return -1;
+ }
c->ca_private = cf;
e = config_build_entry( op, rs, ceparent, c, &rdn,
Debug( LDAP_DEBUG_TRACE, "config_back_db_open\n", 0, 0, 0);
- /* prepare a hardcoded default ACL which is used when no
- * explicit ACL is defined for this database. See also:
- * config_back_access_allowed() */
+ /* If we have no explicitly configured ACLs, don't just use
+ * the global ACLs. Explicitly deny access to everything.
+ */
save_access = be->bd_self->be_acl;
be->bd_self->be_acl = NULL;
parse_acl(be->bd_self, "config_back_db_open", 0, 6, (char **)defacl, 0 );
defacl_parsed = be->bd_self->be_acl;
- be->bd_self->be_acl = save_access;
+ if ( save_access ) {
+ be->bd_self->be_acl = save_access;
+ } else {
+ Debug( LDAP_DEBUG_CONFIG, "config_back_db_open: "
+ "No explicit ACL for back-config configured. "
+ "Using hardcoded default\n", 0, 0, 0 );
+ }
thrctx = ldap_pvt_thread_pool_context();
connection_fake_init( &conn, &opbuf, thrctx );
backend_shutdown( &cfb->cb_db );
}
+ if ( defacl_parsed && be->be_acl != defacl_parsed ) {
+ acl_free( defacl_parsed );
+ defacl_parsed = NULL;
+ }
+
return 0;
}
bi->bi_chk_referrals = 0;
- bi->bi_access_allowed = config_back_access_allowed;
+ bi->bi_access_allowed = slap_access_allowed;
bi->bi_connection_init = 0;
bi->bi_connection_destroy = 0;
return 0;
}
-
projects / openldap / blobdiff