Fix pkiUser

[openldap] / servers / slapd / main.c

diff --git a/servers/slapd/main.c b/servers/slapd/main.c
index fa1bb4916d5b4800840461b1dd2c214628f4278b..cea889cf7adfc9c38a657b481e40f431b4929b54 100644 (file)
--- a/servers/slapd/main.c
+++ b/servers/slapd/main.c
@@ -88,6 +88,7 @@ static int   cnvt_str2int( char *, STRDISP_P, int );
 
 #endif /* LOG_LOCAL4 */
 
+static int check_config = 0;
 
 static void
 usage( char *name )
@@ -95,22 +96,25 @@ usage( char *name )
        fprintf( stderr,
                "usage: %s options\n", name );
        fprintf( stderr,
-               "\t-d level\tDebug Level" "\n"
-               "\t-f filename\tConfiguration File\n"
+               "\t-4\t\tIPv4 only\n"
+               "\t-6\t\tIPv6 only\n"
+               "\t-d level\tDebug level" "\n"
+               "\t-f filename\tConfiguration file\n"
 #if defined(HAVE_SETUID) && defined(HAVE_SETGID)
                "\t-g group\tGroup (id or name) to run as\n"
 #endif
-               "\t-h URLs\tList of URLs to serve\n"
+               "\t-h URLs\t\tList of URLs to serve\n"
 #ifdef LOG_LOCAL4
-               "\t-l sysloguser\tSyslog User (default: LOCAL4)\n"
+               "\t-l facility\tSyslog facility (default: LOCAL4)\n"
 #endif
-               "\t-n serverName\tservice name\n"
+               "\t-n serverName\tService name\n"
 #ifdef HAVE_CHROOT
-               "\t-r directory\n"
+               "\t-r directory\tSandbox directory to chroot to\n"
 #endif
-               "\t-s level\tSyslog Level\n"
+               "\t-s level\tSyslog level\n"
+               "\t-t\t\tCheck configuration file and exit\n"
 #if defined(HAVE_SETUID) && defined(HAVE_SETGID)
-               "\t-u user\tUser (id or name) to run as\n"
+               "\t-u user\t\tUser (id or name) to run as\n"
 #endif
     );
 }
@@ -213,7 +217,10 @@ int main( int argc, char **argv )
 #endif
 
        while ( (i = getopt( argc, argv,
-                            "d:f:h:s:n:"
+                            "d:f:h:s:n:t"
+#if LDAP_PF_INET6
+                               "46"
+#endif
 #ifdef HAVE_CHROOT
                                "r:"
 #endif
@@ -225,6 +232,15 @@ int main( int argc, char **argv )
 #endif
                             )) != EOF ) {
                switch ( i ) {
+#ifdef LDAP_PF_INET6
+               case '4':
+                       slap_inet4or6 = AF_INET;
+                       break;
+               case '6':
+                       slap_inet4or6 = AF_INET6;
+                       break;
+#endif
+
                case 'h':       /* listen URLs */
                        if ( urls != NULL ) free( urls );
                        urls = ch_strdup( optarg );
@@ -280,6 +296,10 @@ int main( int argc, char **argv )
                        serverName = ch_strdup( optarg );
                        break;
 
+               case 't':
+                       check_config++;
+                       break;
+
                default:
                        usage( argv[0] );
                        rc = 1;
@@ -319,7 +339,7 @@ int main( int argc, char **argv )
        openlog( serverName, OPENLOG_OPTIONS );
 #endif
 
-       if( slapd_daemon_init( urls ) != 0 ) {
+       if( !check_config && slapd_daemon_init( urls ) != 0 ) {
                rc = 1;
                SERVICE_EXIT( ERROR_SERVICE_SPECIFIC_ERROR, 16 );
                goto stop;
@@ -375,9 +395,30 @@ int main( int argc, char **argv )
                goto destroy;
        }
 
+#ifdef HAVE_TLS
+       /* Library defaults to full certificate checking. This is correct when
+        * a client is verifying a server because all servers should have a
+        * valid cert. But few clients have valid certs, so we want our default
+        * to be no checking. The config file can override this as usual.
+        */
+       rc = 0;
+       (void) ldap_pvt_tls_set_option( NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &rc );
+#endif
+
        if ( read_config( configfile ) != 0 ) {
                rc = 1;
                SERVICE_EXIT( ERROR_SERVICE_SPECIFIC_ERROR, 19 );
+
+               if ( check_config ) {
+                       fprintf( stderr, "config check failed\n" );
+               }
+
+               goto destroy;
+       }
+
+       if ( check_config ) {
+               rc = 0;
+               fprintf( stderr, "config check succeeded\n" );
                goto destroy;
        }