Add a sample ACL

[openldap] / servers / slapd / modify.c

diff --git a/servers/slapd/modify.c b/servers/slapd/modify.c
index 25eaa421d6630bc1e4e4e2df4612b3f84379e051..a00e54dc674491d6e5d75ef7ac8027f64274458a 100644 (file)
--- a/servers/slapd/modify.c
+++ b/servers/slapd/modify.c
@@ -54,7 +54,6 @@ do_modify(
        Debug( LDAP_DEBUG_TRACE, "do_modify\n", 0, 0, 0 );
 #endif
 
-
        /*
         * Parse the modify request.  It looks like this:
         *
@@ -190,7 +189,7 @@ do_modify(
                goto cleanup;
        }
 
-       if( ndn == '\0' ) {
+       if( *ndn == '\0' ) {
 #ifdef NEW_LOGGING
                LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
                           "do_modify: attempt to modify root DSE.\n" ));
@@ -279,7 +278,11 @@ do_modify(
                {
                        int update = be->be_update_ndn != NULL;
                        const char *text;
-                       rc = slap_modlist2mods( modlist, update, &mods, &text );
+                       char textbuf[SLAP_TEXT_BUFLEN];
+                       size_t textlen = sizeof textbuf;
+
+                       rc = slap_modlist2mods( modlist, update, &mods, &text,
+                               textbuf, textlen );
 
                        if( rc != LDAP_SUCCESS ) {
                                send_ldap_result( conn, op, rc,
@@ -347,7 +350,9 @@ int slap_modlist2mods(
        LDAPModList *ml,
        int update,
        Modifications **mods,
-       const char **text )
+       const char **text,
+       char *textbuf,
+       size_t textlen )
 {
        int rc;
        Modifications **modtail = mods;
@@ -367,6 +372,9 @@ int slap_modlist2mods(
 
                if( rc != LDAP_SUCCESS ) {
                        slap_mods_free( mod );
+                       snprintf( textbuf, textlen, "%s: %s",
+                               ml->ml_type, *text );
+                       *text = textbuf;
                        return rc;
                }
 
@@ -377,7 +385,11 @@ int slap_modlist2mods(
                {
                        /* attribute requires binary transfer */
                        slap_mods_free( mod );
-                       *text = "attribute requires ;binary transfer";
+
+                       snprintf( textbuf, textlen,
+                               "%s: requires ;binary transfer",
+                               ml->ml_type );
+                       *text = textbuf;
                        return LDAP_UNDEFINED_TYPE;
                }
 
@@ -386,14 +398,35 @@ int slap_modlist2mods(
                {
                        /* attribute requires binary transfer */
                        slap_mods_free( mod );
-                       *text = "attribute disallows ;binary transfer";
+                       snprintf( textbuf, textlen,
+                               "%s: disallows ;binary transfer",
+                               ml->ml_type );
+                       *text = textbuf;
                        return LDAP_UNDEFINED_TYPE;
                }
 
                if (!update && is_at_no_user_mod( ad->ad_type )) {
                        /* user modification disallowed */
                        slap_mods_free( mod );
-                       *text = "no user modification allowed";
+                       snprintf( textbuf, textlen,
+                               "%s: no user modification allowed",
+                               ml->ml_type );
+                       *text = textbuf;
+                       return LDAP_CONSTRAINT_VIOLATION;
+               }
+
+               if ( is_at_obsolete( ad->ad_type ) &&
+                       ( mod->sml_op == LDAP_MOD_ADD || ml->ml_bvalues != NULL ) )
+               {
+                       /*
+                        * attribute is obsolete,
+                        * only allow replace/delete with no values
+                        */
+                       slap_mods_free( mod );
+                       snprintf( textbuf, textlen,
+                               "%s: attribute is obsolete",
+                               ml->ml_type );
+                       *text = textbuf;
                        return LDAP_CONSTRAINT_VIOLATION;
                }
 
@@ -406,18 +439,13 @@ int slap_modlist2mods(
                                ad->ad_type->sat_syntax->ssyn_validate;
 
                        if( !validate ) {
-#ifdef NEW_LOGGING
-                               LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                                          "modlist2mods: no validator for syntax %S\n",
-                                          ad->ad_type->sat_syntax->ssyn_oid ));
-#else
-                               Debug( LDAP_DEBUG_TRACE,
-                                       "modlist2mods: no validator for syntax %s\n",
-                                       ad->ad_type->sat_syntax->ssyn_oid, 0, 0 );
-#endif
-
                                slap_mods_free( mod );
                                *text = "no validator for syntax";
+                               snprintf( textbuf, textlen,
+                                       "%s: no validator for syntax %s",
+                                       ml->ml_type,
+                                       ad->ad_type->sat_syntax->ssyn_oid );
+                               *text = textbuf;
                                return LDAP_INVALID_SYNTAX;
                        }
 
@@ -429,7 +457,10 @@ int slap_modlist2mods(
 
                                if( rc != 0 ) {
                                        slap_mods_free( mod );
-                                       *text = "value contains invalid data";
+                                       snprintf( textbuf, textlen,
+                                               "%s: value #%ld invalid per syntax",
+                                               ml->ml_type, (long) nvals );
+                                       *text = textbuf;
                                        return LDAP_INVALID_SYNTAX;
                                }
                        }
@@ -442,8 +473,11 @@ int slap_modlist2mods(
                                && nvals > 1 && is_at_single_value( ad->ad_type ))
                        {
                                slap_mods_free( mod );
-                               *text = "multiple values provided";
-                               return LDAP_INVALID_SYNTAX;
+                               snprintf( textbuf, textlen,
+                                       "%s: multiple value provided",
+                                       ml->ml_type );
+                               *text = textbuf;
+                               return LDAP_CONSTRAINT_VIOLATION;
                        }
                }
 
@@ -531,53 +565,3 @@ int slap_mods_opattrs(
        return LDAP_SUCCESS;
 }
 
-
-void
-slap_mod_free(
-       Modification    *mod,
-       int                             freeit
-)
-{
-       ad_free( mod->sm_desc, 1 );
-
-       if ( mod->sm_bvalues != NULL )
-               ber_bvecfree( mod->sm_bvalues );
-
-       if( freeit )
-               free( mod );
-}
-
-void
-slap_mods_free(
-    Modifications      *ml
-)
-{
-       Modifications *next;
-
-       for ( ; ml != NULL; ml = next ) {
-               next = ml->sml_next;
-
-               slap_mod_free( &ml->sml_mod, 0 );
-               free( ml );
-       }
-}
-
-void
-slap_modlist_free(
-    LDAPModList        *ml
-)
-{
-       LDAPModList *next;
-
-       for ( ; ml != NULL; ml = next ) {
-               next = ml->ml_next;
-
-               if (ml->ml_type)
-                       free( ml->ml_type );
-
-               if ( ml->ml_bvalues != NULL )
-                       ber_bvecfree( ml->ml_bvalues );
-
-               free( ml );
-       }
-}