ITS#6132

[openldap] / servers / slapd / bconfig.c

diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c
index a2c90144c7a7300ad5746a2fe41b911eacb30b73..37c4ff6f3cbb5cb3089a62cc4b77a2572a3b5aff 100644 (file)
--- a/servers/slapd/bconfig.c
+++ b/servers/slapd/bconfig.c
@@ -320,7 +320,7 @@ static ConfigTable config_back_cf_table[] = {
                &config_generic, "( OLcfgGlAt:7 NAME 'olcAuthzPolicy' "
                        "EQUALITY caseIgnoreMatch "
                        "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
-       { "authz-regexp", NULL, 3, 3, 0, ARG_MAGIC|CFG_AZREGEXP|ARG_NO_INSERT,
+       { "authz-regexp", "regexp> <DN", 3, 3, 0, ARG_MAGIC|CFG_AZREGEXP|ARG_NO_INSERT,
                &config_generic, "( OLcfgGlAt:8 NAME 'olcAuthzRegexp' "
                        "EQUALITY caseIgnoreMatch "
                        "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL },
@@ -455,7 +455,7 @@ static ConfigTable config_back_cf_table[] = {
        { "password-crypt-salt-format", "salt", 2, 2, 0, ARG_STRING|ARG_MAGIC|CFG_SALT,
                &config_generic, "( OLcfgGlAt:35 NAME 'olcPasswordCryptSaltFormat' "
                        "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
-       { "password-hash", "hash", 2, 2, 0, ARG_MAGIC,
+       { "password-hash", "hash", 2, 0, 0, ARG_MAGIC,
                &config_passwd_hash, "( OLcfgGlAt:36 NAME 'olcPasswordHash' "
                        "EQUALITY caseIgnoreMatch "
                        "SYNTAX OMsDirectoryString )", NULL, NULL },
@@ -530,6 +530,14 @@ static ConfigTable config_back_cf_table[] = {
                        "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
        { "sasl-authz-policy", NULL, 2, 2, 0, ARG_MAGIC|CFG_AZPOLICY,
                &config_generic, NULL, NULL, NULL },
+       { "sasl-auxprops", NULL, 2, 0, 0,
+#ifdef HAVE_CYRUS_SASL
+               ARG_STRING|ARG_UNIQUE, &slap_sasl_auxprops,
+#else
+               ARG_IGNORED, NULL,
+#endif
+               "( OLcfgGlAt:89 NAME 'olcSaslAuxprops' "
+                       "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
        { "sasl-host", "host", 2, 2, 0,
 #ifdef HAVE_CYRUS_SASL
                ARG_STRING|ARG_UNIQUE, &sasl_host,
@@ -757,7 +765,7 @@ static ConfigOCs cf_ocs[] = {
                 "olcPluginLogFile $ olcReadOnly $ olcReferral $ "
                 "olcReplogFile $ olcRequires $ olcRestrict $ olcReverseLookup $ "
                 "olcRootDSE $ "
-                "olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ "
+                "olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ "
                 "olcSecurity $ olcServerID $ olcSizeLimit $ "
                 "olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ "
                 "olcThreads $ olcTimeLimit $ olcTLSCACertificateFile $ "
@@ -893,8 +901,7 @@ config_generic(ConfigArgs *c) {
                        if ( !c->rvalue_vals ) rc = 1;
                        break;
                case CFG_RO:
-                       c->value_int = (c->be->be_restrictops & SLAP_RESTRICT_OP_WRITES) ==
-                               SLAP_RESTRICT_OP_WRITES;
+                       c->value_int = (c->be->be_restrictops & SLAP_RESTRICT_READONLY);
                        break;
                case CFG_AZPOLICY:
                        c->value_string = ch_strdup( slap_sasl_getpolicy());
@@ -1378,6 +1385,36 @@ config_generic(ConfigArgs *c) {
 
                case CFG_LIMITS:
                        /* FIXME: there is no limits_free function */
+                       if ( c->valx < 0 ) {
+                               limits_destroy( c->be->be_limits );
+                               c->be->be_limits = NULL;
+
+                       } else {
+                               int cnt, num = -1;
+
+                               if ( c->be->be_limits ) {
+                                       for ( num = 0; c->be->be_limits[ num ]; num++ )
+                                               /* just count */ ;
+                               }
+
+                               if ( c->valx >= num ) {
+                                       return 1;
+                               }
+
+                               if ( num == 1 ) {
+                                       limits_destroy( c->be->be_limits );
+                                       c->be->be_limits = NULL;
+
+                               } else {
+                                       limits_free_one( c->be->be_limits[ c->valx ] );
+
+                                       for ( cnt = c->valx; cnt < num; cnt++ ) {
+                                               c->be->be_limits[ cnt ] = c->be->be_limits[ cnt + 1 ];
+                                       }
+                               }
+                       }
+                       break;
+
                case CFG_ATOPT:
                        /* FIXME: there is no ad_option_free function */
                case CFG_ROOTDSE:
@@ -1466,9 +1503,9 @@ config_generic(ConfigArgs *c) {
 
                case CFG_RO:
                        if(c->value_int)
-                               c->be->be_restrictops |= SLAP_RESTRICT_OP_WRITES;
+                               c->be->be_restrictops |= SLAP_RESTRICT_READONLY;
                        else
-                               c->be->be_restrictops &= ~SLAP_RESTRICT_OP_WRITES;
+                               c->be->be_restrictops &= ~SLAP_RESTRICT_READONLY;
                        break;
 
                case CFG_AZPOLICY:
@@ -3190,6 +3227,27 @@ config_include(ConfigArgs *c) {
 }
 
 #ifdef HAVE_TLS
+static int
+config_tls_cleanup(ConfigArgs *c) {
+       int rc = 0;
+
+       if ( slap_tls_ld ) {
+               int opt = 1;
+
+               ldap_pvt_tls_ctx_free( slap_tls_ctx );
+
+               /* Force new ctx to be created */
+               rc = ldap_pvt_tls_set_option( slap_tls_ld, LDAP_OPT_X_TLS_NEWCTX, &opt );
+               if( rc == 0 ) {
+                       /* The ctx's refcount is bumped up here */
+                       ldap_pvt_tls_get_option( slap_tls_ld, LDAP_OPT_X_TLS_CTX, &slap_tls_ctx );
+                       /* This is a no-op if it's already loaded */
+                       load_extop( &slap_EXOP_START_TLS, 0, starttls_extop );
+               }
+       }
+       return rc;
+}
+
 static int
 config_tls_option(ConfigArgs *c) {
        int flag;
@@ -3213,9 +3271,11 @@ config_tls_option(ConfigArgs *c) {
        if (c->op == SLAP_CONFIG_EMIT) {
                return ldap_pvt_tls_get_option( ld, flag, &c->value_string );
        } else if ( c->op == LDAP_MOD_DELETE ) {
+               c->cleanup = config_tls_cleanup;
                return ldap_pvt_tls_set_option( ld, flag, NULL );
        }
        ch_free(c->value_string);
+       c->cleanup = config_tls_cleanup;
        return(ldap_pvt_tls_set_option(ld, flag, c->argv[1]));
 }
 
@@ -3237,9 +3297,11 @@ config_tls_config(ConfigArgs *c) {
                return slap_tls_get_config( slap_tls_ld, flag, &c->value_string );
        } else if ( c->op == LDAP_MOD_DELETE ) {
                int i = 0;
+               c->cleanup = config_tls_cleanup;
                return ldap_pvt_tls_set_option( slap_tls_ld, flag, &i );
        }
        ch_free( c->value_string );
+       c->cleanup = config_tls_cleanup;
        if ( isdigit( (unsigned char)c->argv[1][0] ) ) {
                if ( lutil_atoi( &i, c->argv[1] ) != 0 ) {
                        Debug(LDAP_DEBUG_ANY, "%s: "
@@ -4488,6 +4550,7 @@ config_add_internal( CfBackInfo *cfb, Entry *e, ConfigArgs *ca, SlapReply *rs,
                if ( !ct ) continue;    /* user data? */
                for (i=0; a->a_vals[i].bv_val; i++) {
                        char *iptr = NULL;
+                       ca->valx = -1;
                        ca->line = a->a_vals[i].bv_val;
                        if ( a->a_desc->ad_type->sat_flags & SLAP_AT_ORDERED ) {
                                ptr = strchr( ca->line, '}' );
@@ -4499,8 +4562,6 @@ config_add_internal( CfBackInfo *cfb, Entry *e, ConfigArgs *ca, SlapReply *rs,
                        if ( a->a_desc->ad_type->sat_flags & SLAP_AT_ORDERED_SIB ) {
                                if ( iptr ) {
                                        ca->valx = strtol( iptr+1, NULL, 0 );
-                               } else {
-                                       ca->valx = -1;
                                }
                        } else {
                                ca->valx = i;
@@ -4789,6 +4850,7 @@ config_modify_add( ConfigTable *ct, ConfigArgs *ca, AttributeDescription *ad,
 {
        int rc;
 
+       ca->valx = -1;
        if (ad->ad_type->sat_flags & SLAP_AT_ORDERED &&
                ca->line[0] == '{' )
        {