build entry's pretty DN from parent's (ITS#5326)

[openldap] / servers / slapd / bconfig.c

diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c
index 9f68fdbc02769aa4673afc9a3a034ad1f4b33b75..26f1e5a71edcafe7baded459be317f1758187348 100644 (file)
--- a/servers/slapd/bconfig.c
+++ b/servers/slapd/bconfig.c
@@ -84,6 +84,7 @@ static char   *logfileName;
 #ifdef SLAP_AUTH_REWRITE
 static BerVarray authz_rewrites;
 #endif
+static AccessControl *defacl_parsed = NULL;
 
 static struct berval cfdir;
 
@@ -242,9 +243,13 @@ static OidRec OidMacros[] = {
  * OLcfg{Bk|Db}{Oc|At}:3               -> back-ldap
  * OLcfg{Bk|Db}{Oc|At}:4               -> back-monitor
  * OLcfg{Bk|Db}{Oc|At}:5               -> back-relay
- * OLcfg{Bk|Db}{Oc|At}:6               -> back-sql
+ * OLcfg{Bk|Db}{Oc|At}:6               -> back-sql(/back-ndb)
  * OLcfg{Bk|Db}{Oc|At}:7               -> back-sock
  * OLcfg{Bk|Db}{Oc|At}:8               -> back-null
+ * OLcfg{Bk|Db}{Oc|At}:9               -> back-passwd
+ * OLcfg{Bk|Db}{Oc|At}:10              -> back-shell
+ * OLcfg{Bk|Db}{Oc|At}:11              -> back-perl
+ * OLcfg{Bk|Db}{Oc|At}:12              -> back-mdb
  */
 
 /*
@@ -822,8 +827,8 @@ static ConfigOCs cf_ocs[] = {
                "NAME 'olcSchemaConfig' "
                "DESC 'OpenLDAP schema object' "
                "SUP olcConfig STRUCTURAL "
-               "MAY ( cn $ olcObjectIdentifier $ olcAttributeTypes $ "
-                "olcObjectClasses $ olcDitContentRules $ olcLdapSyntaxes ) )",
+               "MAY ( cn $ olcObjectIdentifier $ olcLdapSyntaxes $ "
+                "olcAttributeTypes $ olcObjectClasses $ olcDitContentRules ) )",
                        Cft_Schema, NULL, cfAddSchema },
        { "( OLcfgGlOc:3 "
                "NAME 'olcBackendConfig' "
@@ -1297,6 +1302,12 @@ config_generic(ConfigArgs *c) {
                                *prev = a->acl_next;
                                acl_free( a );
                        }
+                       if ( SLAP_CONFIG( c->be ) && !c->be->be_acl ) {
+                               Debug( LDAP_DEBUG_CONFIG, "config_generic (CFG_ACL): "
+                                               "Last explicit ACL for back-config removed. "
+                                               "Using hardcoded default\n", 0, 0, 0 );
+                               c->be->be_acl = defacl_parsed;
+                       }
                        break;
 
                case CFG_OC: {
@@ -1792,6 +1803,9 @@ sortval_reject:
                        break;
 
                case CFG_ACL:
+                       if ( SLAP_CONFIG( c->be ) && c->be->be_acl == defacl_parsed) {
+                               c->be->be_acl = NULL;
+                       }
                        /* Don't append to the global ACL if we're on a specific DB */
                        i = c->valx;
                        if ( c->valx == -1 ) {
@@ -1801,6 +1815,9 @@ sortval_reject:
                                        i++;
                        }
                        if ( parse_acl(c->be, c->fname, c->lineno, c->argc, c->argv, i ) ) {
+                               if ( SLAP_CONFIG( c->be ) && !c->be->be_acl) {
+                                       c->be->be_acl = defacl_parsed;
+                               }
                                return 1;
                        }
                        break;
@@ -5669,6 +5686,8 @@ config_modify_internal( CfEntryInfo *ce, Operation *op, SlapReply *rs,
                        /* FALLTHRU: LDAP_MOD_REPLACE && vals */
 
                case LDAP_MOD_ADD:
+                       if ( !a )
+                               break;
                        for (i=0; ml->sml_values[i].bv_val; i++) {
                                ca->line = ml->sml_values[i].bv_val;
                                ca->valx = -1;
@@ -6227,35 +6246,6 @@ int config_back_entry_get(
        return rc;
 }
 
-static AccessControl *defacl_parsed = NULL;
-
-int config_back_access_allowed(
-       Operation               *op,
-       Entry                   *e,
-       AttributeDescription    *desc,
-       struct berval           *val,
-       slap_access_t           access,
-       AccessControlState      *state,
-       slap_mask_t             *maskp )
-{
-       int result;
-       BackendDB *be_orig = op->o_bd, db = *op->o_bd;
-
-       /* If we have no explicitly configured ACLs, don't just use
-        * the global ACLs. Explicitly deny access to everything.
-        */
-       if ( ! db.be_acl ) {
-               Debug( LDAP_DEBUG_ACL, "=> config_back_access_allowed: "
-                               "No explicit ACL for back-config configured, "
-                               "using hardcoded default\n", 0, 0, 0 );
-               db.be_acl = defacl_parsed;
-               op->o_bd = &db;
-       }
-       result = slap_access_allowed( op, e , desc, val, access, state, maskp );
-       op->o_bd = be_orig;
-       return result;
-}
-
 static int
 config_build_attrs( Entry *e, AttributeType **at, AttributeDescription *ad,
        ConfigTable *ct, ConfigArgs *c )
@@ -6630,14 +6620,20 @@ config_back_db_open( BackendDB *be, ConfigReply *cr )
 
        Debug( LDAP_DEBUG_TRACE, "config_back_db_open\n", 0, 0, 0);
 
-       /* prepare a hardcoded default ACL which is used when no
-        * explicit ACL is defined for this database. See also:
-        * config_back_access_allowed() */
+       /* If we have no explicitly configured ACLs, don't just use
+        * the global ACLs. Explicitly deny access to everything.
+        */
        save_access = be->bd_self->be_acl;
        be->bd_self->be_acl = NULL;
        parse_acl(be->bd_self, "config_back_db_open", 0, 6, (char **)defacl, 0 );
        defacl_parsed = be->bd_self->be_acl;
-       be->bd_self->be_acl = save_access;
+       if ( save_access ) {
+               be->bd_self->be_acl = save_access;
+       } else {
+               Debug( LDAP_DEBUG_CONFIG, "config_back_db_open: "
+                               "No explicit ACL for back-config configured. "
+                               "Using hardcoded default\n", 0, 0, 0 );
+       }
 
        thrctx = ldap_pvt_thread_pool_context();
        connection_fake_init( &conn, &opbuf, thrctx );
@@ -6881,7 +6877,7 @@ config_back_db_close( BackendDB *be, ConfigReply *cr )
                backend_shutdown( &cfb->cb_db );
        }
 
-       if ( defacl_parsed ) {
+       if ( defacl_parsed && be->be_acl != defacl_parsed ) {
                acl_free( defacl_parsed );
                defacl_parsed = NULL;
        }
@@ -7281,7 +7277,7 @@ config_back_initialize( BackendInfo *bi )
 
        bi->bi_chk_referrals = 0;
 
-       bi->bi_access_allowed = config_back_access_allowed;
+       bi->bi_access_allowed = slap_access_allowed;
 
        bi->bi_connection_init = 0;
        bi->bi_connection_destroy = 0;