/* $OpenLDAP$ */
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
*
- * Copyright 2005-2008 The OpenLDAP Foundation.
+ * Copyright 2005-2009 The OpenLDAP Foundation.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
CFG_DATABASE,
CFG_TLS_RAND,
CFG_TLS_CIPHER,
+ CFG_TLS_PROTOCOL_MIN,
CFG_TLS_CERT_FILE,
CFG_TLS_CERT_KEY,
CFG_TLS_CA_PATH,
CFG_SORTVALS,
CFG_IX_INTLEN,
CFG_SYNTAX,
+ CFG_ACL_ADD,
CFG_LAST
};
* OLcfgOv{Oc|At}:18 -> memberof
* OLcfgOv{Oc|At}:19 -> collect
* OLcfgOv{Oc|At}:20 -> retcode
+ * OLcfgOv{Oc|At}:21 -> sssvlv
*/
/* alphabetical ordering */
"DESC 'Access Control List' "
"EQUALITY caseIgnoreMatch "
"SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL },
+ { "add_content_acl", NULL, 0, 0, 0, ARG_MAY_DB|ARG_ON_OFF|ARG_MAGIC|CFG_ACL_ADD,
+ &config_generic, "( OLcfgGlAt:86 NAME 'olcAddContentAcl' "
+ "DESC 'Check ACLs against content of Add ops' "
+ "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
{ "allows", "features", 2, 0, 5, ARG_PRE_DB|ARG_MAGIC,
&config_allows, "( OLcfgGlAt:2 NAME 'olcAllows' "
"DESC 'Allowed set of deprecated features' "
&config_generic, "( OLcfgGlAt:7 NAME 'olcAuthzPolicy' "
"EQUALITY caseIgnoreMatch "
"SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
- { "authz-regexp", NULL, 3, 3, 0, ARG_MAGIC|CFG_AZREGEXP|ARG_NO_INSERT,
+ { "authz-regexp", "regexp> <DN", 3, 3, 0, ARG_MAGIC|CFG_AZREGEXP|ARG_NO_INSERT,
&config_generic, "( OLcfgGlAt:8 NAME 'olcAuthzRegexp' "
"EQUALITY caseIgnoreMatch "
"SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL },
{ "password-crypt-salt-format", "salt", 2, 2, 0, ARG_STRING|ARG_MAGIC|CFG_SALT,
&config_generic, "( OLcfgGlAt:35 NAME 'olcPasswordCryptSaltFormat' "
"SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
- { "password-hash", "hash", 2, 2, 0, ARG_MAGIC,
+ { "password-hash", "hash", 2, 0, 0, ARG_MAGIC,
&config_passwd_hash, "( OLcfgGlAt:36 NAME 'olcPasswordHash' "
"EQUALITY caseIgnoreMatch "
"SYNTAX OMsDirectoryString )", NULL, NULL },
"SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
{ "sasl-authz-policy", NULL, 2, 2, 0, ARG_MAGIC|CFG_AZPOLICY,
&config_generic, NULL, NULL, NULL },
+ { "sasl-auxprops", NULL, 2, 0, 0,
+#ifdef HAVE_CYRUS_SASL
+ ARG_STRING|ARG_UNIQUE, &slap_sasl_auxprops,
+#else
+ ARG_IGNORED, NULL,
+#endif
+ "( OLcfgGlAt:89 NAME 'olcSaslAuxprops' "
+ "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
{ "sasl-host", "host", 2, 2, 0,
#ifdef HAVE_CYRUS_SASL
ARG_STRING|ARG_UNIQUE, &sasl_host,
#endif
"( OLcfgGlAt:77 NAME 'olcTLSDHParamFile' "
"SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
+ { "TLSProtocolMin", NULL, 0, 0, 0,
+#ifdef HAVE_TLS
+ CFG_TLS_PROTOCOL_MIN|ARG_STRING|ARG_MAGIC, &config_tls_config,
+#else
+ ARG_IGNORED, NULL,
+#endif
+ "( OLcfgGlAt:87 NAME 'olcTLSProtocolMin' "
+ "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
{ "tool-threads", "count", 2, 2, 0, ARG_INT|ARG_MAGIC|CFG_TTHREADS,
&config_generic, "( OLcfgGlAt:80 NAME 'olcToolThreads' "
"SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
&config_updateref, "( OLcfgDbAt:0.13 NAME 'olcUpdateRef' "
"EQUALITY caseIgnoreMatch "
"SUP labeledURI )", NULL, NULL },
+ { "writetimeout", "timeout", 2, 2, 0, ARG_INT,
+ &global_writetimeout, "( OLcfgGlAt:88 NAME 'olcWriteTimeout' "
+ "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
{ NULL, NULL, 0, 0, 0, ARG_IGNORED,
NULL, NULL, NULL, NULL }
};
+/* Need to no-op this keyword for dynamic config */
+ConfigTable olcDatabaseDummy[] = {
+ { "", "", 0, 0, 0, ARG_IGNORED,
+ NULL, "( OLcfgGlAt:13 NAME 'olcDatabase' "
+ "DESC 'The backend type for a database instance' "
+ "SUP olcBackend SINGLE-VALUE X-ORDERED 'SIBLINGS' )", NULL, NULL },
+ { NULL, NULL, 0, 0, 0, ARG_IGNORED }
+};
+
/* Routines to check if a child can be added to this type */
static ConfigLDAPadd cfAddSchema, cfAddInclude, cfAddDatabase,
cfAddBackend, cfAddModule, cfAddOverlay;
"olcDisallows $ olcGentleHUP $ olcIdleTimeout $ "
"olcIndexSubstrIfMaxLen $ olcIndexSubstrIfMinLen $ "
"olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ "
- "olcLocalSSF $ olcLogLevel $ "
+ "olcLocalSSF $ olcLogFile $ olcLogLevel $ "
"olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ "
"olcPluginLogFile $ olcReadOnly $ olcReferral $ "
"olcReplogFile $ olcRequires $ olcRestrict $ olcReverseLookup $ "
"olcRootDSE $ "
- "olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ "
+ "olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ "
"olcSecurity $ olcServerID $ olcSizeLimit $ "
"olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ "
"olcThreads $ olcTimeLimit $ olcTLSCACertificateFile $ "
"olcTLSCACertificatePath $ olcTLSCertificateFile $ "
"olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ "
"olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ "
- "olcTLSCRLFile $ olcToolThreads $ "
+ "olcTLSCRLFile $ olcToolThreads $ olcWriteTimeout $ "
"olcObjectIdentifier $ olcAttributeTypes $ olcObjectClasses $ "
"olcDitContentRules $ olcLdapSyntaxes ) )", Cft_Global },
{ "( OLcfgGlOc:2 "
"SUP olcConfig STRUCTURAL "
"MUST olcDatabase "
"MAY ( olcHidden $ olcSuffix $ olcSubordinate $ olcAccess $ "
- "olcLastMod $ olcLimits $ "
+ "olcAddContentAcl $ olcLastMod $ olcLimits $ "
"olcMaxDerefDepth $ olcPlugin $ olcReadOnly $ olcReplica $ "
"olcReplicaArgsFile $ olcReplicaPidFile $ olcReplicationInterval $ "
"olcReplogFile $ olcRequires $ olcRestrict $ olcRootDN $ olcRootPW $ "
if ( !c->rvalue_vals ) rc = 1;
break;
case CFG_RO:
- c->value_int = (c->be->be_restrictops & SLAP_RESTRICT_OP_WRITES) ==
- SLAP_RESTRICT_OP_WRITES;
+ c->value_int = (c->be->be_restrictops & SLAP_RESTRICT_READONLY);
break;
case CFG_AZPOLICY:
c->value_string = ch_strdup( slap_sasl_getpolicy());
AccessControl *a;
char *src, *dst, ibuf[11];
struct berval bv, abv;
- AccessControl *end;
- if ( c->be == frontendDB )
- end = NULL;
- else
- end = frontendDB->be_acl;
- for (i=0, a=c->be->be_acl; a && a != end; i++,a=a->acl_next) {
+ for (i=0, a=c->be->be_acl; a; i++,a=a->acl_next) {
abv.bv_len = snprintf( ibuf, sizeof( ibuf ), SLAP_X_ORDERED_FMT, i );
if ( abv.bv_len >= sizeof( ibuf ) ) {
ber_bvarray_free_x( c->rvalue_vals, NULL );
rc = (!i);
break;
}
+ case CFG_ACL_ADD:
+ c->value_int = (SLAP_DBACL_ADD(c->be) != 0);
+ break;
case CFG_ROOTDSE: {
ConfigFile *cf = c->ca_private;
if ( cf->c_dseFiles ) {
if ( !BER_BVISEMPTY( &si->si_url )) {
bv.bv_len = si->si_url.bv_len + 6;
bv.bv_val = ch_malloc( bv.bv_len );
- sprintf( bv.bv_val, "%d %s", si->si_num,
+ bv.bv_len = sprintf( bv.bv_val, "%d %s", si->si_num,
si->si_url.bv_val );
ber_bvarray_add( &c->rvalue_vals, &bv );
} else {
case CFG_SASLSECP:
case CFG_SSTR_IF_MAX:
case CFG_SSTR_IF_MIN:
+ case CFG_ACL_ADD:
break;
/* no-ops, requires slapd restart */
case CFG_ACL:
if ( c->valx < 0 ) {
- AccessControl *end;
- if ( c->be == frontendDB )
- end = NULL;
- else
- end = frontendDB->be_acl;
- acl_destroy( c->be->be_acl, end );
- c->be->be_acl = end;
+ acl_destroy( c->be->be_acl );
+ c->be->be_acl = NULL;
} else {
AccessControl **prev, *a;
case CFG_LIMITS:
/* FIXME: there is no limits_free function */
+ if ( c->valx < 0 ) {
+ limits_destroy( c->be->be_limits );
+ c->be->be_limits = NULL;
+
+ } else {
+ int cnt, num = -1;
+
+ if ( c->be->be_limits ) {
+ for ( num = 0; c->be->be_limits[ num ]; num++ )
+ /* just count */ ;
+ }
+
+ if ( c->valx >= num ) {
+ return 1;
+ }
+
+ if ( num == 1 ) {
+ limits_destroy( c->be->be_limits );
+ c->be->be_limits = NULL;
+
+ } else {
+ limits_free_one( c->be->be_limits[ c->valx ] );
+
+ for ( cnt = c->valx; cnt < num; cnt++ ) {
+ c->be->be_limits[ cnt ] = c->be->be_limits[ cnt + 1 ];
+ }
+ }
+ }
+ break;
+
case CFG_ATOPT:
/* FIXME: there is no ad_option_free function */
case CFG_ROOTDSE:
case CFG_RO:
if(c->value_int)
- c->be->be_restrictops |= SLAP_RESTRICT_OP_WRITES;
+ c->be->be_restrictops |= SLAP_RESTRICT_READONLY;
else
- c->be->be_restrictops &= ~SLAP_RESTRICT_OP_WRITES;
+ c->be->be_restrictops &= ~SLAP_RESTRICT_READONLY;
break;
case CFG_AZPOLICY:
case CFG_ACL:
/* Don't append to the global ACL if we're on a specific DB */
i = c->valx;
- if ( c->be != frontendDB && frontendDB->be_acl && c->valx == -1 ) {
+ if ( c->valx == -1 ) {
AccessControl *a;
i = 0;
- for ( a=c->be->be_acl; a && a != frontendDB->be_acl;
- a = a->acl_next )
+ for ( a=c->be->be_acl; a; a = a->acl_next )
i++;
}
if ( parse_acl(c->be, c->fname, c->lineno, c->argc, c->argv, i ) ) {
}
break;
+ case CFG_ACL_ADD:
+ if(c->value_int)
+ SLAP_DBFLAGS(c->be) |= SLAP_DBFLAG_ACL_ADD;
+ else
+ SLAP_DBFLAGS(c->be) &= ~SLAP_DBFLAG_ACL_ADD;
+ break;
+
case CFG_ROOTDSE:
if(root_dse_read_file(c->argv[1])) {
snprintf( c->cr_msg, sizeof( c->cr_msg ), "<%s> could not read file", c->argv[0] );
*sip = si;
if (( slapMode & SLAP_SERVER_MODE ) && c->argc > 2 ) {
- /* If hostname is empty, or is localhost, or matches
- * our hostname, this serverID refers to this host.
- * Compare it against listeners and ports.
- */
- if ( !lud->lud_host || !lud->lud_host[0] ||
- !strncasecmp("localhost", lud->lud_host,
- STRLENOF("localhost")) ||
- !strcasecmp( global_host, lud->lud_host )) {
- Listener **l = slapd_get_listeners();
- int i;
-
- for ( i=0; l && l[i]; i++ ) {
- LDAPURLDesc *lu2;
- int isMe = 0;
- ldap_url_parse( l[i]->sl_url.bv_val, &lu2 );
- do {
- if ( strcasecmp( lud->lud_scheme,
- lu2->lud_scheme ))
- break;
- if ( lud->lud_port != lu2->lud_port )
- break;
- /* Listener on ANY address */
- if ( !lu2->lud_host || !lu2->lud_host[0] ) {
- isMe = 1;
- break;
- }
- /* URL on ANY address */
- if ( !lud->lud_host || !lud->lud_host[0] ) {
- isMe = 1;
- break;
- }
- /* Listener has specific host, must
- * match it
- */
- if ( !strcasecmp( lud->lud_host,
- lu2->lud_host )) {
- isMe = 1;
- break;
- }
- } while(0);
- ldap_free_urldesc( lu2 );
- if ( isMe ) {
- slap_serverID = si->si_num;
- Debug( LDAP_DEBUG_CONFIG,
- "%s: SID=%d (listener=%s)\n",
- c->log, slap_serverID,
- l[i]->sl_url.bv_val );
- break;
- }
- }
+ Listener *l = config_check_my_url( c->argv[2], lud );
+ if ( l ) {
+ slap_serverID = si->si_num;
+ Debug( LDAP_DEBUG_CONFIG,
+ "%s: SID=%d (listener=%s)\n",
+ c->log, slap_serverID,
+ l->sl_url.bv_val );
}
}
if ( c->argc > 2 )
break;
case CFG_MIRRORMODE:
- if(!SLAP_SHADOW(c->be)) {
+ if(c->value_int && !SLAP_SHADOW(c->be)) {
snprintf( c->cr_msg, sizeof( c->cr_msg ), "<%s> database is not a shadow",
c->argv[0] );
Debug(LDAP_DEBUG_ANY, "%s: %s\n",
config_subordinate(ConfigArgs *c)
{
int rc = 1;
- int advertise;
+ int advertise = 0;
switch( c->op ) {
case SLAP_CONFIG_EMIT:
break;
case LDAP_MOD_ADD:
case SLAP_CONFIG_ADD:
- advertise = ( c->argc == 2 && !strcasecmp( c->argv[1], "advertise" ));
+ if ( c->be->be_nsuffix == NULL ) {
+ /* log error */
+ snprintf( c->cr_msg, sizeof( c->cr_msg),
+ "subordinate configuration needs a suffix" );
+ Debug( LDAP_DEBUG_ANY,
+ "%s: %s.\n",
+ c->log, c->cr_msg, 0 );
+ rc = 1;
+ break;
+ }
+
+ if ( c->argc == 2 ) {
+ if ( strcasecmp( c->argv[1], "advertise" ) == 0 ) {
+ advertise = 1;
+
+ } else if ( strcasecmp( c->argv[1], "TRUE" ) != 0 ) {
+ /* log error */
+ snprintf( c->cr_msg, sizeof( c->cr_msg),
+ "subordinate must be \"TRUE\" or \"advertise\"" );
+ Debug( LDAP_DEBUG_ANY,
+ "%s: suffix \"%s\": %s.\n",
+ c->log, c->be->be_suffix[0].bv_val, c->cr_msg );
+ rc = 1;
+ break;
+ }
+ }
+
rc = glue_sub_add( c->be, advertise, CONFIG_ONLINE_ADD( c ));
break;
}
+
return rc;
}
{ BER_BVC("bind_simple"), SLAP_DISALLOW_BIND_SIMPLE },
{ BER_BVC("tls_2_anon"), SLAP_DISALLOW_TLS_2_ANON },
{ BER_BVC("tls_authc"), SLAP_DISALLOW_TLS_AUTHC },
+ { BER_BVC("proxy_authz_non_critical"), SLAP_DISALLOW_PROXY_AUTHZ_N_CRIT },
+ { BER_BVC("dontusecopy_non_critical"), SLAP_DISALLOW_DONTUSECOPY_N_CRIT },
{ BER_BVNULL, 0 }
};
if (c->op == SLAP_CONFIG_EMIT) {
int level;
if ( isdigit((unsigned char)c->argv[i][0]) || c->argv[i][0] == '-' ) {
- if( lutil_atoi( &level, c->argv[i] ) != 0 ) {
+ if( lutil_atoix( &level, c->argv[i], 0 ) != 0 ) {
snprintf( c->cr_msg, sizeof( c->cr_msg ), "<%s> unable to parse level", c->argv[0] );
Debug( LDAP_DEBUG_ANY, "%s: %s \"%s\"\n",
c->log, c->cr_msg, c->argv[i]);
return 1;
}
- SLAP_DBFLAGS(c->be) |= (SLAP_DBFLAG_SHADOW | SLAP_DBFLAG_SINGLE_SHADOW | flag);
+ if ( SLAP_SHADOW(c->be) ) {
+ /* if already shadow, only check consistency */
+ if ( ( SLAP_DBFLAGS(c->be) & flag ) != flag ) {
+ Debug( LDAP_DEBUG_ANY, "%s: inconsistent shadow flag 0x%x.\n", c->log, flag, 0 );
+ return 1;
+ }
+
+ } else {
+ SLAP_DBFLAGS(c->be) |= (SLAP_DBFLAG_SHADOW | SLAP_DBFLAG_SINGLE_SHADOW | flag);
+ }
return 0;
}
}
#ifdef HAVE_TLS
+static int
+config_tls_cleanup(ConfigArgs *c) {
+ int rc = 0;
+
+ if ( slap_tls_ld ) {
+ int opt = 1;
+
+ ldap_pvt_tls_ctx_free( slap_tls_ctx );
+
+ /* Force new ctx to be created */
+ rc = ldap_pvt_tls_set_option( slap_tls_ld, LDAP_OPT_X_TLS_NEWCTX, &opt );
+ if( rc == 0 ) {
+ /* The ctx's refcount is bumped up here */
+ ldap_pvt_tls_get_option( slap_tls_ld, LDAP_OPT_X_TLS_CTX, &slap_tls_ctx );
+ /* This is a no-op if it's already loaded */
+ load_extop( &slap_EXOP_START_TLS, 0, starttls_extop );
+ }
+ }
+ return rc;
+}
+
static int
config_tls_option(ConfigArgs *c) {
int flag;
if (c->op == SLAP_CONFIG_EMIT) {
return ldap_pvt_tls_get_option( ld, flag, &c->value_string );
} else if ( c->op == LDAP_MOD_DELETE ) {
+ c->cleanup = config_tls_cleanup;
return ldap_pvt_tls_set_option( ld, flag, NULL );
}
ch_free(c->value_string);
+ c->cleanup = config_tls_cleanup;
return(ldap_pvt_tls_set_option(ld, flag, c->argv[1]));
}
switch(c->type) {
case CFG_TLS_CRLCHECK: flag = LDAP_OPT_X_TLS_CRLCHECK; break;
case CFG_TLS_VERIFY: flag = LDAP_OPT_X_TLS_REQUIRE_CERT; break;
+ case CFG_TLS_PROTOCOL_MIN: flag = LDAP_OPT_X_TLS_PROTOCOL_MIN; break;
default:
Debug(LDAP_DEBUG_ANY, "%s: "
"unknown tls_option <0x%x>\n",
return slap_tls_get_config( slap_tls_ld, flag, &c->value_string );
} else if ( c->op == LDAP_MOD_DELETE ) {
int i = 0;
+ c->cleanup = config_tls_cleanup;
return ldap_pvt_tls_set_option( slap_tls_ld, flag, &i );
}
ch_free( c->value_string );
+ c->cleanup = config_tls_cleanup;
if ( isdigit( (unsigned char)c->argv[1][0] ) ) {
if ( lutil_atoi( &i, c->argv[1] ) != 0 ) {
Debug(LDAP_DEBUG_ANY, "%s: "
}
return(ldap_pvt_tls_set_option(slap_tls_ld, flag, &i));
} else {
- return(ldap_int_tls_config(slap_tls_ld, flag, c->argv[1]));
+ return(ldap_pvt_tls_config(slap_tls_ld, flag, c->argv[1]));
}
}
#endif
rs->sr_entry = ce->ce_entry;
rs->sr_flags = 0;
rc = send_search_entry( op, rs );
+ if ( rc != LDAP_SUCCESS ) {
+ return rc;
+ }
}
if ( op->ors_scope == LDAP_SCOPE_SUBTREE ) {
if ( ce->ce_kids ) {
struct berval rdn, nrdn;
for (ce2 = ce->ce_kids; ce2; ce2 = ce2->ce_sibs) {
+ struct berval newdn, newndn;
dnRdn ( &ce2->ce_entry->e_name, &rdn );
dnRdn ( &ce2->ce_entry->e_nname, &nrdn );
+ build_new_dn( &newdn, &ce->ce_entry->e_name, &rdn, NULL );
+ build_new_dn( &newndn, &ce->ce_entry->e_nname, &nrdn, NULL );
free( ce2->ce_entry->e_name.bv_val );
free( ce2->ce_entry->e_nname.bv_val );
- build_new_dn( &ce2->ce_entry->e_name, &ce->ce_entry->e_name,
- &rdn, NULL );
- build_new_dn( &ce2->ce_entry->e_nname, &ce->ce_entry->e_nname,
- &nrdn, NULL );
+ ce2->ce_entry->e_name = newdn;
+ ce2->ce_entry->e_nname = newndn;
config_rename_kids( ce2 );
}
}
isconfig = 1;
}
ptr1 = ber_bvchr( &e->e_name, '{' );
- if ( ptr1 && ptr1 - e->e_name.bv_val < rdn.bv_len ) {
+ if ( ptr1 && ptr1 < &e->e_name.bv_val[ rdn.bv_len ] ) {
char *next;
ptr2 = strchr( ptr1, '}' );
- if (!ptr2 || ptr2 - e->e_name.bv_val > rdn.bv_len)
+ if ( !ptr2 || ptr2 > &e->e_name.bv_val[ rdn.bv_len ] )
return LDAP_NAMING_VIOLATION;
if ( ptr2-ptr1 == 1)
return LDAP_NAMING_VIOLATION;
if ( !ct ) continue; /* user data? */
for (i=0; a->a_vals[i].bv_val; i++) {
char *iptr = NULL;
+ ca->valx = -1;
ca->line = a->a_vals[i].bv_val;
if ( a->a_desc->ad_type->sat_flags & SLAP_AT_ORDERED ) {
ptr = strchr( ca->line, '}' );
if ( a->a_desc->ad_type->sat_flags & SLAP_AT_ORDERED_SIB ) {
if ( iptr ) {
ca->valx = strtol( iptr+1, NULL, 0 );
- } else {
- ca->valx = -1;
}
} else {
ca->valx = i;
{
char textbuf[SLAP_TEXT_BUFLEN];
size_t textlen = sizeof textbuf;
- rs->sr_err = entry_schema_check(op, op->ora_e, NULL, 0, 1,
+ rs->sr_err = entry_schema_check(op, op->ora_e, NULL, 0, 1, NULL,
&rs->sr_text, textbuf, sizeof( textbuf ) );
if ( rs->sr_err != LDAP_SUCCESS )
goto out;
}
}
+ if ( op->o_abandon ) {
+ rs->sr_err = SLAPD_ABANDON;
+ goto out;
+ }
ldap_pvt_thread_pool_pause( &connection_pool );
/* Strategy:
{
int rc;
+ ca->valx = -1;
if (ad->ad_type->sat_flags & SLAP_AT_ORDERED &&
ca->line[0] == '{' )
{
if ( rc == LDAP_SUCCESS) {
/* check that the entry still obeys the schema */
- rc = entry_schema_check(op, e, NULL, 0, 0,
+ rc = entry_schema_check(op, e, NULL, 0, 0, NULL,
&rs->sr_text, ca->cr_msg, sizeof(ca->cr_msg) );
}
if ( rc ) goto out_noop;
slap_mods_opattrs( op, &op->orm_modlist, 1 );
- if ( do_pause )
+ if ( do_pause ) {
+ if ( op->o_abandon ) {
+ rs->sr_err = SLAPD_ABANDON;
+ goto out;
+ }
ldap_pvt_thread_pool_pause( &connection_pool );
+ }
/* Strategy:
* 1) perform the Modify on the cached Entry.
goto out;
}
+ if ( op->o_abandon ) {
+ rs->sr_err = SLAPD_ABANDON;
+ goto out;
+ }
ldap_pvt_thread_pool_pause( &connection_pool );
if ( ce->ce_type == Cft_Schema ) {
rs->sr_err = LDAP_NO_SUCH_OBJECT;
} else if ( ce->ce_kids ) {
rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
+ } else if ( op->o_abandon ) {
+ rs->sr_err = SLAPD_ABANDON;
} else if ( ce->ce_type == Cft_Overlay || ce->ce_type == Cft_Database ){
char *iptr;
int count, ixold;
switch ( op->ors_scope ) {
case LDAP_SCOPE_BASE:
case LDAP_SCOPE_SUBTREE:
- config_send( op, rs, ce, 0 );
+ rs->sr_err = config_send( op, rs, ce, 0 );
break;
case LDAP_SCOPE_ONELEVEL:
for (ce = ce->ce_kids; ce; ce=ce->ce_sibs) {
- config_send( op, rs, ce, 1 );
+ rs->sr_err = config_send( op, rs, ce, 1 );
+ if ( rs->sr_err ) {
+ break;
+ }
}
break;
}
-
- rs->sr_err = LDAP_SUCCESS;
+
out:
send_ldap_result( op, rs );
- return 0;
+ return rs->sr_err;
}
/* no-op, we never free entries */
return rc;
}
-static void
+static int
config_build_attrs( Entry *e, AttributeType **at, AttributeDescription *ad,
ConfigTable *ct, ConfigArgs *c )
{
* returns success with no values */
if (rc == LDAP_SUCCESS && c->rvalue_vals != NULL ) {
if ( c->rvalue_nvals )
- attr_merge(e, ct[i].ad, c->rvalue_vals,
+ rc = attr_merge(e, ct[i].ad, c->rvalue_vals,
c->rvalue_nvals);
- else
- attr_merge_normalize(e, ct[i].ad,
+ else {
+ slap_syntax_validate_func *validate =
+ ct[i].ad->ad_type->sat_syntax->ssyn_validate;
+ if ( validate ) {
+ int j;
+ for ( j=0; c->rvalue_vals[j].bv_val; j++ ) {
+ rc = ordered_value_validate( ct[i].ad,
+ &c->rvalue_vals[j], LDAP_MOD_ADD );
+ if ( rc ) {
+ Debug( LDAP_DEBUG_ANY,
+ "config_build_attrs: error %d on %s value #%d\n",
+ rc, ct[i].ad->ad_cname.bv_val, j );
+ return rc;
+ }
+ }
+ }
+
+ rc = attr_merge_normalize(e, ct[i].ad,
c->rvalue_vals, NULL);
+ }
ber_bvarray_free( c->rvalue_nvals );
ber_bvarray_free( c->rvalue_vals );
+ if ( rc ) {
+ Debug( LDAP_DEBUG_ANY,
+ "config_build_attrs: error %d on %s\n",
+ rc, ct[i].ad->ad_cname.bv_val, 0 );
+ return rc;
+ }
}
break;
}
}
}
+ return 0;
}
Entry *
AttributeDescription *ad = NULL;
int rc;
char *ptr;
- const char *text;
+ const char *text = "";
Attribute *oc_at;
struct berval pdn;
ObjectClass *oc;
ad_name.bv_len = ptr - rdn->bv_val;
rc = slap_bv2ad( &ad_name, &ad, &text );
if ( rc ) {
- return NULL;
+ goto fail;
}
val.bv_val = ptr+1;
val.bv_len = rdn->bv_len - (val.bv_val - rdn->bv_val);
oc = main->co_oc;
c->table = main->co_type;
- if ( oc->soc_required )
- config_build_attrs( e, oc->soc_required, ad, main->co_table, c );
+ if ( oc->soc_required ) {
+ rc = config_build_attrs( e, oc->soc_required, ad, main->co_table, c );
+ if ( rc ) goto fail;
+ }
- if ( oc->soc_allowed )
- config_build_attrs( e, oc->soc_allowed, ad, main->co_table, c );
+ if ( oc->soc_allowed ) {
+ rc = config_build_attrs( e, oc->soc_allowed, ad, main->co_table, c );
+ if ( rc ) goto fail;
+ }
if ( extra ) {
oc = extra->co_oc;
c->table = extra->co_type;
- if ( oc->soc_required )
- config_build_attrs( e, oc->soc_required, ad, extra->co_table, c );
+ if ( oc->soc_required ) {
+ rc = config_build_attrs( e, oc->soc_required, ad, extra->co_table, c );
+ if ( rc ) goto fail;
+ }
- if ( oc->soc_allowed )
- config_build_attrs( e, oc->soc_allowed, ad, extra->co_table, c );
+ if ( oc->soc_allowed ) {
+ rc = config_build_attrs( e, oc->soc_allowed, ad, extra->co_table, c );
+ if ( rc ) goto fail;
+ }
}
oc_at = attr_find( e->e_attrs, slap_schema.si_ad_objectClass );
rc = structural_class(oc_at->a_vals, &oc, NULL, &text, c->cr_msg,
sizeof(c->cr_msg), op ? op->o_tmpmemctx : NULL );
if ( rc != LDAP_SUCCESS ) {
+fail:
Debug( LDAP_DEBUG_ANY,
"config_build_entry: build \"%s\" failed: \"%s\"\n",
rdn->bv_val, text, 0);
op->o_bd->be_add( op, rs );
if ( ( rs->sr_err != LDAP_SUCCESS )
&& (rs->sr_err != LDAP_ALREADY_EXISTS) ) {
- return NULL;
+ goto fail;
}
}
}
Entry *e;
ConfigFile *cf = c->ca_private;
char *ptr;
- struct berval bv;
+ struct berval bv, rdn;
for (; cf; cf=cf->c_sibs, c->depth++) {
if ( !cf->c_at_head && !cf->c_cr_head && !cf->c_oc_head &&
bv.bv_len );
c->value_dn.bv_len += bv.bv_len;
c->value_dn.bv_val[c->value_dn.bv_len] ='\0';
+ rdn = c->value_dn;
c->ca_private = cf;
- e = config_build_entry( op, rs, ceparent, c, &c->value_dn,
+ e = config_build_entry( op, rs, ceparent, c, &rdn,
&CFOC_SCHEMA, NULL );
if ( !e ) {
return -1;
/* If we have no explicitly configured ACLs, don't just use
* the global ACLs. Explicitly deny access to everything.
*/
- if ( frontendDB->be_acl && be->be_acl == frontendDB->be_acl ) {
+ if ( !be->be_acl ) {
parse_acl(be, "config_back_db_open", 0, 6, (char **)defacl, 0 );
}
/* Hide from namingContexts */
SLAP_BFLAGS(be) |= SLAP_BFLAG_CONFIG;
+ /* Check ACLs on content of Adds by default */
+ SLAP_DBFLAGS(be) |= SLAP_DBFLAG_ACL_ADD;
+
return 0;
}
i = config_register_schema( ct, cf_ocs );
if ( i ) return i;
+ i = slap_str2ad( "olcDatabase", &olcDatabaseDummy[0].ad, &text );
+ if ( i ) return i;
+
/* setup olcRootPW to be base64-encoded when written in LDIF form;
* basically, we don't care if it fails */
i = slap_str2ad( "olcRootPW", &ad, &text );
return 0;
}
-
projects / openldap / blobdiff