Fix maxDeref directive

[openldap] / servers / slapd / schema.c

diff --git a/servers/slapd/schema.c b/servers/slapd/schema.c
index 746833f796a67027edf244676b1127128244c636..e2e2294d56093413c6d85a73b8ca5a6f34f5737d 100644 (file)
--- a/servers/slapd/schema.c
+++ b/servers/slapd/schema.c
@@ -123,20 +123,78 @@ oc_check_required( Entry *e, char *ocname )
        return( NULL );
 }
 
+static char *oc_usermod_attrs[] = {
+       /*
+        * OpenLDAP doesn't support any user modification of
+        * operational attributes.
+        */
+       NULL
+};
+
+static char *oc_operational_attrs[] = {
+       /*
+        * these are operational attributes that *could* be
+        * modified by users if we supported such.
+        */
+       "objectClasses",
+       "attributeTypes",
+       "matchingRules",
+       "matchingRuleUse",
+       "dITStructureRules",
+       "dITContentRules",
+       "nameForms",
+       "ldapSyntaxes",
+       NULL
+
+};
+
+/* this list should be extensible  */
+static char *oc_no_usermod_attrs[] = {
+       /*
+        * Operational and 'no user modification' attributes
+        */
+
+       /* RFC2252, 3.2.1 */
+       "creatorsName",
+       "createTimestamp",
+       "modifiersName",
+       "modifyTimestamp",
+       "subschemaSubentry",
+
+       NULL
+};
+
+
 /*
  * check to see if attribute is 'operational' or not.
- * this list should be extensible...
  */
 int
-oc_check_operational( char *type )
+oc_check_operational_attr( char *type )
+{
+       return charray_inlist( oc_operational_attrs, type )
+               || charray_inlist( oc_usermod_attrs, type )
+               || charray_inlist( oc_no_usermod_attrs, type );
+}
+
+/*
+ * check to see if attribute can be user modified or not.
+ */
+int
+oc_check_usermod_attr( char *type )
 {
-       return ( strcasecmp( type, "modifiersname" ) == 0 ||
-               strcasecmp( type, "modifytimestamp" ) == 0 ||
-               strcasecmp( type, "creatorsname" ) == 0 ||
-               strcasecmp( type, "createtimestamp" ) == 0 )
-               ? 1 : 0;
+       return charray_inlist( oc_usermod_attrs, type );
 }
 
+/*
+ * check to see if attribute is 'no user modification' or not.
+ */
+int
+oc_check_no_usermod_attr( char *type )
+{
+       return charray_inlist( oc_no_usermod_attrs, type );
+}
+
+
 static int
 oc_check_allowed( char *type, struct berval **ocl )
 {
@@ -153,7 +211,12 @@ oc_check_allowed( char *type, struct berval **ocl )
                return( 0 );
        }
 
-       if ( oc_check_operational( type ) ) {
+       /*
+        * All operational attributions are allowed by schema rules.
+        * However, we only check attributions which are stored in the
+        * the directory regardless if they are user or non-user modified.
+        */
+       if ( oc_check_usermod_attr( type ) || oc_check_no_usermod_attr( type ) ) {
                return( 0 );
        }
 
@@ -1080,8 +1143,10 @@ schema_info( Connection *conn, Operation *op, char **attrs, int attrsonly )
                return;
        }
        
-       send_search_entry( &backends[0], conn, op, e, attrs, attrsonly );
-       send_ldap_search_result( conn, op, LDAP_SUCCESS, NULL, NULL, 1 );
+       send_search_entry( &backends[0], conn, op,
+               e, attrs, attrsonly, 0, NULL );
+       send_search_result( conn, op, LDAP_SUCCESS,
+               NULL, NULL, NULL, NULL, 1 );
 
        entry_free( e );
 }
@@ -1116,3 +1181,35 @@ oc_print( ObjectClass *oc )
 }
 
 #endif
+
+
+int is_entry_objectclass(
+       Entry*  e,
+       char*   oc)
+{
+       Attribute *attr;
+       struct berval bv;
+
+       if( e == NULL || oc == NULL || *oc == '\0' )
+               return 0;
+
+       /*
+        * find objectClass attribute
+        */
+       attr = attr_find(e->e_attrs, "objectclass");
+
+       if( attr == NULL ) {
+               /* no objectClass attribute */
+               return 0;
+       }
+
+       bv.bv_val = oc;
+       bv.bv_len = strlen( bv.bv_val );
+
+       if( value_find(attr->a_vals, &bv, attr->a_syntax, 1) != 0) {
+               /* entry is not of this objectclass */
+               return 0;
+       }
+
+       return 1;
+}
\ No newline at end of file