/* $OpenLDAP$ */
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
*
- * Copyright 1998-2007 The OpenLDAP Foundation.
+ * Copyright 1998-2009 The OpenLDAP Foundation.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
slap_mask_t global_disallows = 0;
int global_gentlehup = 0;
int global_idletimeout = 0;
+int global_writetimeout = 0;
char *global_host = NULL;
+struct berval global_host_bv = BER_BVNULL;
char *global_realm = NULL;
+char *sasl_host = NULL;
char **default_passwd_hash = NULL;
struct berval default_search_base = BER_BVNULL;
struct berval default_search_nbase = BER_BVNULL;
static int fp_getline(FILE *fp, ConfigArgs *c);
static void fp_getline_init(ConfigArgs *c);
-static int fp_parse_line(ConfigArgs *c);
static char *strtok_quote(char *line, char *sep, char **quote_ptr);
static char *strtok_quote_ldif(char **line);
ch_free( c->value_ndn.bv_val );
ch_free( c->value_dn.bv_val );
}
+ } else if(arg_type == ARG_ATDESC) {
+ const char *text = NULL;
+ c->value_ad = NULL;
+ rc = slap_str2ad( c->argv[1], &c->value_ad, &text );
+ if ( rc != LDAP_SUCCESS ) {
+ snprintf( c->cr_msg, sizeof( c->cr_msg ), "<%s> invalid AttributeDescription %d (%s)",
+ c->argv[0], rc, text );
+ Debug(LDAP_DEBUG_CONFIG|LDAP_DEBUG_NONE, "%s: %s\n" , c->log, c->cr_msg, 0);
+ return(ARG_BAD_CONF);
+ }
} else { /* all numeric */
int j;
iarg = 0; larg = 0; barg = 0;
case ARG_BERVAL:
*(struct berval *)ptr = c->value_bv;
break;
+ case ARG_ATDESC:
+ *(AttributeDescription **)ptr = c->value_ad;
+ break;
}
return(0);
}
break;
case ARG_BERVAL:
ber_dupbv( &c->value_bv, (struct berval *)ptr ); break;
+ case ARG_ATDESC:
+ c->value_ad = *(AttributeDescription **)ptr; break;
}
}
if ( cf->arg_type & ARGS_TYPES) {
return 1;
}
break;
+ case ARG_ATDESC:
+ if ( c->value_ad ) {
+ bv = c->value_ad->ad_cname;
+ } else {
+ return 1;
+ }
+ break;
default:
bv.bv_val = NULL;
break;
fprintf( stderr, "init_config_attrs: register_at failed\n" );
return code;
}
-#ifndef LDAP_DEVEL
- ct[i].ad->ad_type->sat_flags |= SLAP_AT_HIDE;
-#endif
}
return 0;
fprintf( stderr, "init_config_ocs: register_oc failed\n" );
return code;
}
-#ifndef LDAP_DEVEL
- ocs[i].co_oc->soc_flags |= SLAP_OC_HIDE;
-#endif
}
return 0;
}
c->argc = 0;
ch_free( c->tline );
- if ( fp_parse_line( c ) ) {
+ if ( config_fp_parse_line( c ) ) {
rc = 1;
goto done;
}
rc = 0;
done:
+ if ( cf ) {
+ cf->be = c->be;
+ cf->bi = c->bi;
+ }
ch_free(c->tline);
fclose(fp);
ch_free(c->argv);
return -1;
}
+/* register a new verbmask */
+static int
+slap_verbmask_register( slap_verbmasks *vm_, slap_verbmasks **vmp, struct berval *bv, int mask )
+{
+ slap_verbmasks *vm = *vmp;
+ int i;
+
+ /* check for duplicate word */
+ /* NOTE: we accept duplicate codes; the first occurrence will be used
+ * when mapping from mask to verb */
+ i = verb_to_mask( bv->bv_val, vm );
+ if ( !BER_BVISNULL( &vm[ i ].word ) ) {
+ return -1;
+ }
+
+ for ( i = 0; !BER_BVISNULL( &vm[ i ].word ); i++ )
+ ;
+
+ if ( vm == vm_ ) {
+ /* first time: duplicate array */
+ vm = ch_calloc( i + 2, sizeof( slap_verbmasks ) );
+ for ( i = 0; !BER_BVISNULL( &vm_[ i ].word ); i++ )
+ {
+ ber_dupbv( &vm[ i ].word, &vm_[ i ].word );
+ *((slap_mask_t*)&vm[ i ].mask) = vm_[ i ].mask;
+ }
+
+ } else {
+ vm = ch_realloc( vm, (i + 2) * sizeof( slap_verbmasks ) );
+ }
+
+ ber_dupbv( &vm[ i ].word, bv );
+ *((slap_mask_t*)&vm[ i ].mask) = mask;
+
+ BER_BVZERO( &vm[ i+1 ].word );
+
+ *vmp = vm;
+
+ return i;
+}
+
+static slap_verbmasks slap_ldap_response_code_[] = {
+ { BER_BVC("success"), LDAP_SUCCESS },
+
+ { BER_BVC("operationsError"), LDAP_OPERATIONS_ERROR },
+ { BER_BVC("protocolError"), LDAP_PROTOCOL_ERROR },
+ { BER_BVC("timelimitExceeded"), LDAP_TIMELIMIT_EXCEEDED },
+ { BER_BVC("sizelimitExceeded"), LDAP_SIZELIMIT_EXCEEDED },
+ { BER_BVC("compareFalse"), LDAP_COMPARE_FALSE },
+ { BER_BVC("compareTrue"), LDAP_COMPARE_TRUE },
+
+ { BER_BVC("authMethodNotSupported"), LDAP_AUTH_METHOD_NOT_SUPPORTED },
+ { BER_BVC("strongAuthNotSupported"), LDAP_STRONG_AUTH_NOT_SUPPORTED },
+ { BER_BVC("strongAuthRequired"), LDAP_STRONG_AUTH_REQUIRED },
+ { BER_BVC("strongerAuthRequired"), LDAP_STRONGER_AUTH_REQUIRED },
+#if 0 /* not LDAPv3 */
+ { BER_BVC("partialResults"), LDAP_PARTIAL_RESULTS },
+#endif
+
+ { BER_BVC("referral"), LDAP_REFERRAL },
+ { BER_BVC("adminlimitExceeded"), LDAP_ADMINLIMIT_EXCEEDED },
+ { BER_BVC("unavailableCriticalExtension"), LDAP_UNAVAILABLE_CRITICAL_EXTENSION },
+ { BER_BVC("confidentialityRequired"), LDAP_CONFIDENTIALITY_REQUIRED },
+ { BER_BVC("saslBindInProgress"), LDAP_SASL_BIND_IN_PROGRESS },
+
+ { BER_BVC("noSuchAttribute"), LDAP_NO_SUCH_ATTRIBUTE },
+ { BER_BVC("undefinedType"), LDAP_UNDEFINED_TYPE },
+ { BER_BVC("inappropriateMatching"), LDAP_INAPPROPRIATE_MATCHING },
+ { BER_BVC("constraintViolation"), LDAP_CONSTRAINT_VIOLATION },
+ { BER_BVC("typeOrValueExists"), LDAP_TYPE_OR_VALUE_EXISTS },
+ { BER_BVC("invalidSyntax"), LDAP_INVALID_SYNTAX },
+
+ { BER_BVC("noSuchObject"), LDAP_NO_SUCH_OBJECT },
+ { BER_BVC("aliasProblem"), LDAP_ALIAS_PROBLEM },
+ { BER_BVC("invalidDnSyntax"), LDAP_INVALID_DN_SYNTAX },
+#if 0 /* not LDAPv3 */
+ { BER_BVC("isLeaf"), LDAP_IS_LEAF },
+#endif
+ { BER_BVC("aliasDerefProblem"), LDAP_ALIAS_DEREF_PROBLEM },
+
+ { BER_BVC("proxyAuthzFailure"), LDAP_X_PROXY_AUTHZ_FAILURE },
+ { BER_BVC("inappropriateAuth"), LDAP_INAPPROPRIATE_AUTH },
+ { BER_BVC("invalidCredentials"), LDAP_INVALID_CREDENTIALS },
+ { BER_BVC("insufficientAccess"), LDAP_INSUFFICIENT_ACCESS },
+
+ { BER_BVC("busy"), LDAP_BUSY },
+ { BER_BVC("unavailable"), LDAP_UNAVAILABLE },
+ { BER_BVC("unwillingToPerform"), LDAP_UNWILLING_TO_PERFORM },
+ { BER_BVC("loopDetect"), LDAP_LOOP_DETECT },
+
+ { BER_BVC("namingViolation"), LDAP_NAMING_VIOLATION },
+ { BER_BVC("objectClassViolation"), LDAP_OBJECT_CLASS_VIOLATION },
+ { BER_BVC("notAllowedOnNonleaf"), LDAP_NOT_ALLOWED_ON_NONLEAF },
+ { BER_BVC("notAllowedOnRdn"), LDAP_NOT_ALLOWED_ON_RDN },
+ { BER_BVC("alreadyExists"), LDAP_ALREADY_EXISTS },
+ { BER_BVC("noObjectClassMods"), LDAP_NO_OBJECT_CLASS_MODS },
+ { BER_BVC("resultsTooLarge"), LDAP_RESULTS_TOO_LARGE },
+ { BER_BVC("affectsMultipleDsas"), LDAP_AFFECTS_MULTIPLE_DSAS },
+
+ { BER_BVC("other"), LDAP_OTHER },
+
+ /* extension-specific */
+
+ { BER_BVC("cupResourcesExhausted"), LDAP_CUP_RESOURCES_EXHAUSTED },
+ { BER_BVC("cupSecurityViolation"), LDAP_CUP_SECURITY_VIOLATION },
+ { BER_BVC("cupInvalidData"), LDAP_CUP_INVALID_DATA },
+ { BER_BVC("cupUnsupportedScheme"), LDAP_CUP_UNSUPPORTED_SCHEME },
+ { BER_BVC("cupReloadRequired"), LDAP_CUP_RELOAD_REQUIRED },
+
+ { BER_BVC("cancelled"), LDAP_CANCELLED },
+ { BER_BVC("noSuchOperation"), LDAP_NO_SUCH_OPERATION },
+ { BER_BVC("tooLate"), LDAP_TOO_LATE },
+ { BER_BVC("cannotCancel"), LDAP_CANNOT_CANCEL },
+
+ { BER_BVC("assertionFailed"), LDAP_ASSERTION_FAILED },
+
+ { BER_BVC("proxiedAuthorizationDenied"), LDAP_PROXIED_AUTHORIZATION_DENIED },
+
+ { BER_BVC("syncRefreshRequired"), LDAP_SYNC_REFRESH_REQUIRED },
+
+ { BER_BVC("noOperation"), LDAP_X_NO_OPERATION },
+
+ { BER_BVNULL, 0 }
+};
+
+slap_verbmasks *slap_ldap_response_code = slap_ldap_response_code_;
+
+int
+slap_ldap_response_code_register( struct berval *bv, int err )
+{
+ return slap_verbmask_register( slap_ldap_response_code_,
+ &slap_ldap_response_code, bv, err );
+}
+
#ifdef HAVE_TLS
static slap_verbmasks tlskey[] = {
{ BER_BVC("no"), SB_TLS_OFF },
{ BER_BVC("tls_cacertdir="), offsetof(slap_bindconf, sb_tls_cacertdir), 's', 1, NULL },
{ BER_BVC("tls_reqcert="), offsetof(slap_bindconf, sb_tls_reqcert), 's', 1, NULL },
{ BER_BVC("tls_cipher_suite="), offsetof(slap_bindconf, sb_tls_cipher_suite), 's', 1, NULL },
+ { BER_BVC("tls_protocol_min="), offsetof(slap_bindconf, sb_tls_protocol_min), 's', 1, NULL },
#ifdef HAVE_OPENSSL_CRL
{ BER_BVC("tls_crlcheck="), offsetof(slap_bindconf, sb_tls_crlcheck), 's', 1, NULL },
#endif
int
slap_tls_get_config( LDAP *ld, int opt, char **val )
{
+#ifdef HAVE_TLS
slap_verbmasks *keys;
int i, ival;
*val = NULL;
switch( opt ) {
-#ifdef HAVE_TLS
case LDAP_OPT_X_TLS_CRLCHECK:
keys = crlkeys;
break;
case LDAP_OPT_X_TLS_REQUIRE_CERT:
keys = vfykeys;
break;
-#endif
+ case LDAP_OPT_X_TLS_PROTOCOL_MIN: {
+ char buf[8];
+ ldap_pvt_tls_get_option( ld, opt, &ival );
+ snprintf( buf, sizeof( buf ), "%d.%d",
+ ( ival >> 8 ) & 0xff, ival & 0xff );
+ *val = ch_strdup( buf );
+ return 0;
+ }
default:
return -1;
}
return 0;
}
}
+#endif
return -1;
}
ch_free( bc->sb_tls_cipher_suite );
bc->sb_tls_cipher_suite = NULL;
}
+ if ( bc->sb_tls_protocol_min ) {
+ ch_free( bc->sb_tls_protocol_min );
+ bc->sb_tls_protocol_min = NULL;
+ }
#ifdef HAVE_OPENSSL_CRL
if ( bc->sb_tls_crlcheck ) {
ch_free( bc->sb_tls_crlcheck );
{ "tls_cacert", offsetof(slap_bindconf, sb_tls_cacert), LDAP_OPT_X_TLS_CACERTFILE },
{ "tls_cacertdir", offsetof(slap_bindconf, sb_tls_cacertdir), LDAP_OPT_X_TLS_CACERTDIR },
{ "tls_cipher_suite", offsetof(slap_bindconf, sb_tls_cipher_suite), LDAP_OPT_X_TLS_CIPHER_SUITE },
+ { "tls_protocol_min", offsetof(slap_bindconf, sb_tls_protocol_min), LDAP_OPT_X_TLS_PROTOCOL_MIN },
{0, 0}
};
}
}
if ( bc->sb_tls_reqcert ) {
- rc = ldap_int_tls_config( ld, LDAP_OPT_X_TLS_REQUIRE_CERT,
+ rc = ldap_pvt_tls_config( ld, LDAP_OPT_X_TLS_REQUIRE_CERT,
bc->sb_tls_reqcert );
if ( rc ) {
Debug( LDAP_DEBUG_ANY,
} else
newctx = 1;
}
+ if ( bc->sb_tls_protocol_min ) {
+ rc = ldap_pvt_tls_config( ld, LDAP_OPT_X_TLS_PROTOCOL_MIN,
+ bc->sb_tls_protocol_min );
+ if ( rc ) {
+ Debug( LDAP_DEBUG_ANY,
+ "bindconf_tls_set: failed to set tls_protocol_min to %s\n",
+ bc->sb_tls_protocol_min, 0, 0 );
+ res = -1;
+ } else
+ newctx = 1;
+ }
#ifdef HAVE_OPENSSL_CRL
if ( bc->sb_tls_crlcheck ) {
- rc = ldap_int_tls_config( ld, LDAP_OPT_X_TLS_CRLCHECK,
+ rc = ldap_pvt_tls_config( ld, LDAP_OPT_X_TLS_CRLCHECK,
bc->sb_tls_crlcheck );
if ( rc ) {
Debug( LDAP_DEBUG_ANY,
return(line[0] ? 1 : 0);
}
-static int
-fp_parse_line(ConfigArgs *c)
+int
+config_fp_parse_line(ConfigArgs *c)
{
char *token;
static char *const hide[] = {
if ( frontendDB->be_schemadn.bv_val )
free( frontendDB->be_schemadn.bv_val );
if ( frontendDB->be_acl )
- acl_destroy( frontendDB->be_acl, NULL );
+ acl_destroy( frontendDB->be_acl );
}
free( line );
if ( slapd_args_file )
projects / openldap / blobdiff