check for ee == NULL

[openldap] / servers / slapd / overlays / ppolicy.c

diff --git a/servers/slapd/overlays/ppolicy.c b/servers/slapd/overlays/ppolicy.c
index e10cdac62b3b624e84a10267ed1bbd34d95feec1..e126598055cc1fd3e186c8091899474709639bce 100644 (file)
--- a/servers/slapd/overlays/ppolicy.c
+++ b/servers/slapd/overlays/ppolicy.c
@@ -31,7 +31,7 @@
 #include <ldap.h>
 #include "lutil.h"
 #include "slap.h"
-#if SLAPD_MODULES
+#ifdef SLAPD_MODULES
 #define LIBLTDL_DLL_IMPORT     /* Win32: don't re-export libltdl's symbols */
 #include <ltdl.h>
 #endif
@@ -61,6 +61,7 @@ typedef struct pw_conn {
 
 static pw_conn *pwcons;
 static int ppolicy_cid;
+static int ov_count;
 
 typedef struct pass_policy {
        AttributeDescription *ad; /* attribute to which the policy applies */
@@ -358,6 +359,8 @@ account_locked( Operation *op, Entry *e,
 #define PPOLICY_EXPIRE 0x80L   /* primitive + 0 */
 #define PPOLICY_GRACE  0x81L   /* primitive + 1 */
 
+static const char ppolicy_ctrl_oid[] = LDAP_CONTROL_PASSWORDPOLICYRESPONSE;
+
 static LDAPControl *
 create_passcontrol( int exptime, int grace, LDAPPasswordPolicyError err )
 {
@@ -370,7 +373,7 @@ create_passcontrol( int exptime, int grace, LDAPPasswordPolicyError err )
        if ( c == NULL ) {
                return NULL;
        }
-       c->ldctl_oid = LDAP_CONTROL_PASSWORDPOLICYRESPONSE;
+       c->ldctl_oid = (char *)ppolicy_ctrl_oid;
        c->ldctl_iscritical = 0;
        BER_BVZERO( &c->ldctl_value );
 
@@ -618,7 +621,7 @@ check_password_quality( struct berval *cred, PassPolicy *pp, LDAPPasswordPolicyE
        rc = LDAP_SUCCESS;
 
        if (pp->pwdCheckModule[0]) {
-#if SLAPD_MODULES
+#ifdef SLAPD_MODULES
                lt_dlhandle mod;
                const char *err;
                
@@ -850,7 +853,7 @@ ctrls_cleanup( Operation *op, SlapReply *rs, LDAPControl **oldctrls )
        assert( rs->sr_ctrls[0] != NULL );
 
        for ( n = 0; rs->sr_ctrls[n]; n++ ) {
-               if ( !strcmp( rs->sr_ctrls[n]->ldctl_oid, LDAP_CONTROL_PASSWORDPOLICYRESPONSE) ) {
+               if ( rs->sr_ctrls[n]->ldctl_oid == ppolicy_ctrl_oid ) {
                        ch_free( rs->sr_ctrls[n]->ldctl_value.bv_val );
                        ch_free( rs->sr_ctrls[n] );
                        rs->sr_ctrls[n] = (LDAPControl *)(-1);
@@ -918,6 +921,7 @@ ppolicy_bind_response( Operation *op, SlapReply *rs )
                m->sml_flags = 0;
                m->sml_type = ad_pwdFailureTime->ad_cname;
                m->sml_desc = ad_pwdFailureTime;
+               m->sml_numvals = 1;
                m->sml_values = ch_calloc( sizeof(struct berval), 2 );
                m->sml_nvalues = ch_calloc( sizeof(struct berval), 2 );
 
@@ -967,6 +971,7 @@ ppolicy_bind_response( Operation *op, SlapReply *rs )
                        m->sml_flags = 0;
                        m->sml_type = ad_pwdAccountLockedTime->ad_cname;
                        m->sml_desc = ad_pwdAccountLockedTime;
+                       m->sml_numvals = 1;
                        m->sml_values = ch_calloc( sizeof(struct berval), 2 );
                        m->sml_nvalues = ch_calloc( sizeof(struct berval), 2 );
                        ber_dupbv( &m->sml_values[0], &timestamp );
@@ -1059,6 +1064,7 @@ grace:
                m->sml_flags = 0;
                m->sml_type = ad_pwdGraceUseTime->ad_cname;
                m->sml_desc = ad_pwdGraceUseTime;
+               m->sml_numvals = 1;
                m->sml_values = ch_calloc( sizeof(struct berval), 2 );
                m->sml_nvalues = ch_calloc( sizeof(struct berval), 2 );
                ber_dupbv( &m->sml_values[0], &timestamp );
@@ -1466,6 +1472,7 @@ ppolicy_modify( Operation *op, SlapReply *rs )
                                ml->sml_flags = SLAP_MOD_INTERNAL;
                                ml->sml_type.bv_val = NULL;
                                ml->sml_desc = ad_pwdGraceUseTime;
+                               ml->sml_numvals = 0;
                                ml->sml_values = NULL;
                                ml->sml_nvalues = NULL;
                                ml->sml_next = NULL;
@@ -1478,6 +1485,7 @@ ppolicy_modify( Operation *op, SlapReply *rs )
                                ml->sml_flags = SLAP_MOD_INTERNAL;
                                ml->sml_type.bv_val = NULL;
                                ml->sml_desc = ad_pwdAccountLockedTime;
+                               ml->sml_numvals = 0;
                                ml->sml_values = NULL;
                                ml->sml_nvalues = NULL;
                                ml->sml_next = NULL;
@@ -1489,6 +1497,7 @@ ppolicy_modify( Operation *op, SlapReply *rs )
                                ml->sml_flags = SLAP_MOD_INTERNAL;
                                ml->sml_type.bv_val = NULL;
                                ml->sml_desc = ad_pwdFailureTime;
+                               ml->sml_numvals = 0;
                                ml->sml_values = NULL;
                                ml->sml_nvalues = NULL;
                                ml->sml_next = NULL;
@@ -1668,6 +1677,7 @@ ppolicy_modify( Operation *op, SlapReply *rs )
                ml->sml_flags = SLAP_MOD_INTERNAL;
                ml->sml_desc = pp.ad;
                ml->sml_type = pp.ad->ad_cname;
+               ml->sml_numvals = 1;
                ml->sml_values = (BerVarray) ch_malloc( 2 * sizeof( struct berval ) );
                ber_dupbv( &ml->sml_values[0], &oldpw );
                BER_BVZERO( &ml->sml_values[1] );
@@ -1694,7 +1704,10 @@ ppolicy_modify( Operation *op, SlapReply *rs )
                goto return_results;
        }
 
-       if (pp.pwdMinAge > 0) {
+       /* Check age, but only if pwdReset is not TRUE */
+       pa = attr_find( e->e_attrs, ad_pwdReset );
+       if ((!pa || !bvmatch( &pa->a_nvals[0], &slap_true_bv )) &&
+               pp.pwdMinAge > 0) {
                time_t pwtime = (time_t)-1, now;
                int age;
 
@@ -1832,6 +1845,7 @@ do_modify:
                mods->sml_desc = ad_pwdChangedTime;
                if (pwmop != LDAP_MOD_DELETE) {
                        mods->sml_op = LDAP_MOD_REPLACE;
+                       mods->sml_numvals = 1;
                        mods->sml_values = (BerVarray) ch_malloc( 2 * sizeof( struct berval ) );
                        ber_dupbv( &mods->sml_values[0], &timestamp );
                        BER_BVZERO( &mods->sml_values[1] );
@@ -1908,6 +1922,7 @@ do_modify:
                                mods->sml_op = LDAP_MOD_DELETE;
                                mods->sml_flags = SLAP_MOD_INTERNAL;
                                mods->sml_desc = ad_pwdHistory;
+                               mods->sml_numvals = hsize - pp.pwdInHistory + 1;
                                mods->sml_values = ch_calloc( sizeof( struct berval ),
                                        hsize - pp.pwdInHistory + 2 );
                                BER_BVZERO( &mods->sml_values[ hsize - pp.pwdInHistory + 1 ] );
@@ -1939,6 +1954,7 @@ do_modify:
                                mods->sml_type.bv_val = NULL;
                                mods->sml_desc = ad_pwdHistory;
                                mods->sml_nvalues = NULL;
+                               mods->sml_numvals = 1;
                                mods->sml_values = ch_calloc( sizeof( struct berval ), 2 );
                                mods->sml_values[ 1 ].bv_val = NULL;
                                mods->sml_values[ 1 ].bv_len = 0;
@@ -2069,7 +2085,8 @@ attrNormalize(
 
 static int
 ppolicy_db_init(
-       BackendDB *be
+       BackendDB *be,
+       ConfigReply *cr
 )
 {
        slap_overinst *on = (slap_overinst *) be->bd_info;
@@ -2112,21 +2129,29 @@ ppolicy_db_init(
 
 static int
 ppolicy_db_open(
-    BackendDB *be
+       BackendDB *be,
+       ConfigReply *cr
 )
 {
+       ov_count++;
        return overlay_register_control( be, LDAP_CONTROL_PASSWORDPOLICYREQUEST );
 }
 
 static int
 ppolicy_close(
-       BackendDB *be
+       BackendDB *be,
+       ConfigReply *cr
 )
 {
        slap_overinst *on = (slap_overinst *) be->bd_info;
        pp_info *pi = on->on_bi.bi_private;
-       
-       free( pwcons );
+
+       /* Perhaps backover should provide bi_destroy hooks... */
+       ov_count--;
+       if ( ov_count <=0 && pwcons ) {
+               free( pwcons );
+               pwcons = NULL;
+       }
        free( pi->def_policy.bv_val );
        free( pi );