/* $OpenLDAP$ */
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
*
- * Copyright 1998-2006 The OpenLDAP Foundation.
+ * Copyright 1998-2007 The OpenLDAP Foundation.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
#include "ldap_utf8.h"
-#ifdef HAVE_TLS
-#include <openssl/x509.h>
-#include <openssl/err.h>
-#include <openssl/rsa.h>
-#include <openssl/crypto.h>
-#include <openssl/pem.h>
-#include <openssl/bio.h>
-#include <openssl/asn1.h>
-#include <openssl/x509v3.h>
-#include <openssl/ssl.h>
-#endif
-
#include "lutil.h"
#include "lutil_hash.h"
#define HASH_BYTES LUTIL_HASH_BYTES
#define csnIndexer generalizedTimeIndexer
#define csnFilter generalizedTimeFilter
-#ifdef SLAP_AUTHZ_SYNTAX
/* FIXME: temporary */
#define authzMatch octetStringMatch
-#endif /* SLAP_AUTHZ_SYNTAX */
unsigned int index_substr_if_minlen = SLAP_INDEX_SUBSTR_IF_MINLEN_DEFAULT;
unsigned int index_substr_if_maxlen = SLAP_INDEX_SUBSTR_IF_MAXLEN_DEFAULT;
return LDAP_SUCCESS;
}
-
-#ifdef HAVE_TLS
+/* X.509 certificate validation */
static int certificateValidate( Syntax *syntax, struct berval *in )
{
- X509 *xcert=NULL;
- unsigned char *p = (unsigned char *)in->bv_val;
-
- xcert = d2i_X509(NULL, &p, in->bv_len);
- if ( !xcert ) return LDAP_INVALID_SYNTAX;
- X509_free(xcert);
+ BerElementBuffer berbuf;
+ BerElement *ber = (BerElement *)&berbuf;
+ ber_tag_t tag;
+ ber_len_t len;
+ ber_int_t i, version = 0;
+
+ ber_init2( ber, in, LBER_USE_DER );
+ tag = ber_skip_tag( ber, &len ); /* Signed wrapper */
+ if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
+ tag = ber_skip_tag( ber, &len ); /* Sequence */
+ if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
+ tag = ber_skip_tag( ber, &len );
+ if ( tag == 0xa0 ) { /* Optional version */
+ tag = ber_get_int( ber, &version );
+ if ( tag != LBER_INTEGER ) return LDAP_INVALID_SYNTAX;
+ }
+ tag = ber_get_int( ber, &i ); /* Serial */
+ if ( tag != LBER_INTEGER ) return LDAP_INVALID_SYNTAX;
+ tag = ber_skip_tag( ber, &len ); /* Signature Algorithm */
+ if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
+ ber_skip_data( ber, len );
+ tag = ber_skip_tag( ber, &len ); /* Issuer DN */
+ if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
+ ber_skip_data( ber, len );
+ tag = ber_skip_tag( ber, &len ); /* Validity */
+ if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
+ ber_skip_data( ber, len );
+ tag = ber_skip_tag( ber, &len ); /* Subject DN */
+ if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
+ ber_skip_data( ber, len );
+ tag = ber_skip_tag( ber, &len ); /* Subject PublicKeyInfo */
+ if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
+ ber_skip_data( ber, len );
+ tag = ber_skip_tag( ber, &len );
+ if ( tag == 0xa1 ) { /* issuerUniqueID */
+ if ( version < 1 ) return LDAP_INVALID_SYNTAX;
+ ber_skip_data( ber, len );
+ tag = ber_skip_tag( ber, &len );
+ }
+ if ( tag == 0xa2 ) { /* subjectUniqueID */
+ if ( version < 1 ) return LDAP_INVALID_SYNTAX;
+ ber_skip_data( ber, len );
+ tag = ber_skip_tag( ber, &len );
+ }
+ if ( tag == 0xa3 ) { /* Extensions */
+ if ( version < 2 ) return LDAP_INVALID_SYNTAX;
+ tag = ber_skip_tag( ber, &len );
+ if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
+ ber_skip_data( ber, len );
+ tag = ber_skip_tag( ber, &len );
+ }
+ /* signatureAlgorithm */
+ if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
+ ber_skip_data( ber, len );
+ tag = ber_skip_tag( ber, &len );
+ /* Signature */
+ if ( tag != LBER_BITSTRING ) return LDAP_INVALID_SYNTAX;
+ ber_skip_data( ber, len );
+ tag = ber_skip_tag( ber, &len );
+ /* Must be at end now */
+ if ( len || tag != LBER_DEFAULT ) return LDAP_INVALID_SYNTAX;
return LDAP_SUCCESS;
}
-#else
-#define certificateValidate sequenceValidate
-#endif
int
octetStringMatch(
return LDAP_INVALID_SYNTAX;
}
- /*
- * RFC 2252 section 6.3 Bit String
- * bitstring = "'" *binary-digit "'B"
- * binary-digit = "0" / "1"
- * example: '0101111101'B
+ /* RFC 4517 Section 3.3.2 Bit String:
+ * BitString = SQUOTE *binary-digit SQUOTE "B"
+ * binary-digit = "0" / "1"
+ *
+ * where SQUOTE [RFC4512] is
+ * SQUOTE = %x27 ; single quote ("'")
+ *
+ * Example: '0101111101'B
*/
if( in->bv_val[0] != '\'' ||
}
/*
- * Syntax is [RFC2252]:
- *
-
-6.3. Bit String
-
- ( 1.3.6.1.4.1.1466.115.121.1.6 DESC 'Bit String' )
-
- Values in this syntax are encoded according to the following BNF:
-
- bitstring = "'" *binary-digit "'B"
-
- binary-digit = "0" / "1"
-
- ...
-
-6.21. Name And Optional UID
-
- ( 1.3.6.1.4.1.1466.115.121.1.34 DESC 'Name And Optional UID' )
-
- Values in this syntax are encoded according to the following BNF:
-
- NameAndOptionalUID = DistinguishedName [ "#" bitstring ]
-
- Although the '#' character may occur in a string representation of a
- distinguished name, no additional special quoting is done. This
- syntax has been added subsequent to RFC 1778.
-
- Example:
-
- 1.3.6.1.4.1.1466.0=#04024869,O=Test,C=GB#'0101'B
-
- *
- * draft-ietf-ldapbis-syntaxes-xx.txt says:
+ * Syntaxes from RFC 4517
*
3.3.2. Bit String
[X.520].
*
- * draft-ietf-ldapbis-models-xx.txt [MODELS] says:
+ * RFC 4512 says:
*
1.4. Common ABNF Productions
*
* 1.3.6.1.4.1.1466.0=#04024869,o=test,c=gb#'101'B
*
- * Since draft-ietf-ldapbis-dn-xx.txt clarifies that SHARP,
- * i.e. "#", doesn't have to be escaped except when at the
- * beginning of a value, the definition of Name and Optional
- * UID appears to be flawed, because there is no clear means
- * to determine whether the UID part is present or not.
+ * RFC 4514 clarifies that SHARP, i.e. "#", doesn't have to
+ * be escaped except when at the beginning of a value, the
+ * definition of Name and Optional UID appears to be flawed,
+ * because there is no clear means to determine whether the
+ * UID part is present or not.
*
* Example:
*
struct berval out;
int rc;
- assert( SLAP_MR_IS_VALUE_OF_SYNTAX( usage ));
+ assert( SLAP_MR_IS_VALUE_OF_SYNTAX( usage ) != 0 );
ber_dupbv_x( &out, val, ctx );
if ( BER_BVISEMPTY( &out ) ) {
TelephoneNumber subset subset i + ignore all spaces and "-"
- See draft-ietf-ldapbis-strpro for details (once published).
+ See RFC 4518 for details.
Directory String -
int flags;
int i, wasspace;
- assert( SLAP_MR_IS_VALUE_OF_SYNTAX( use ));
+ assert( SLAP_MR_IS_VALUE_OF_SYNTAX( use ) != 0 );
if( BER_BVISNULL( val ) ) {
/* assume we're dealing with a syntax (e.g., UTF8String)
{
char *p, *q;
- assert( SLAP_MR_IS_VALUE_OF_SYNTAX( usage ));
+ assert( SLAP_MR_IS_VALUE_OF_SYNTAX( usage ) != 0 );
/* validator should have refused an empty string */
assert( !BER_BVISEMPTY( val ) );
{
ber_len_t i;
- if( BER_BVISEMPTY( val ) ) return LDAP_INVALID_SYNTAX;
-
for(i=0; i < val->bv_len; i++) {
if( !LDAP_ASCII(val->bv_val[i]) ) {
return LDAP_INVALID_SYNTAX;
int casefold = !SLAP_MR_ASSOCIATED( mr,
slap_schema.si_mr_caseExactIA5Match );
- assert( !BER_BVISEMPTY( val ) );
-
- assert( SLAP_MR_IS_VALUE_OF_SYNTAX( use ));
+ assert( SLAP_MR_IS_VALUE_OF_SYNTAX( use ) != 0 );
p = val->bv_val;
/* Ignore initial whitespace */
while ( ASCII_SPACE( *p ) ) p++;
- normalized->bv_val = ber_strdup_x( p, ctx );
+ normalized->bv_len = val->bv_len - ( p - val->bv_val );
+ normalized->bv_val = slap_sl_malloc( normalized->bv_len + 1, ctx );
+ AC_MEMCPY( normalized->bv_val, p, normalized->bv_len );
+ normalized->bv_val[normalized->bv_len] = '\0';
+
p = q = normalized->bv_val;
while ( *p ) {
* position. One is enough because the above loop collapsed
* all whitespace to a single space.
*/
- if ( ASCII_SPACE( q[-1] ) ) --q;
+ if ( q > normalized->bv_val && ASCII_SPACE( q[-1] ) ) --q;
/* null terminate */
*q = '\0';
normalized->bv_len = q - normalized->bv_val;
- if( BER_BVISEMPTY( normalized ) ) {
- normalized->bv_val = slap_sl_realloc( normalized->bv_val, 2, ctx );
- normalized->bv_val[0] = ' ';
- normalized->bv_val[1] = '\0';
- normalized->bv_len = 1;
- }
return LDAP_SUCCESS;
}
* Integer conversion macros that will use the largest available
* type.
*/
-#if defined(HAVE_STRTOLL) && defined(LLONG_MAX) \
- && defined(LLONG_MIN) && defined(HAVE_LONG_LONG)
+#if defined(HAVE_STRTOLL) && defined(HAVE_LONG_LONG)
# define SLAP_STRTOL(n,e,b) strtoll(n,e,b)
-# define SLAP_LONG_MAX LLONG_MAX
-# define SLAP_LONG_MIN LLONG_MIN
# define SLAP_LONG long long
#else
# define SLAP_STRTOL(n,e,b) strtol(n,e,b)
-# define SLAP_LONG_MAX LONG_MAX
-# define SLAP_LONG_MIN LONG_MIN
# define SLAP_LONG long
#endif /* HAVE_STRTOLL ... */
{
SLAP_LONG lValue, lAssertedValue;
+ errno = 0;
/* safe to assume integers are NUL terminated? */
lValue = SLAP_STRTOL(value->bv_val, NULL, 10);
- if(( lValue == SLAP_LONG_MIN || lValue == SLAP_LONG_MAX) &&
- errno == ERANGE )
+ if( errno == ERANGE )
{
return LDAP_CONSTRAINT_VIOLATION;
}
lAssertedValue = SLAP_STRTOL(((struct berval *)assertedValue)->bv_val,
NULL, 10);
- if(( lAssertedValue == SLAP_LONG_MIN || lAssertedValue == SLAP_LONG_MAX ) &&
- errno == ERANGE )
+ if( errno == ERANGE )
{
return LDAP_CONSTRAINT_VIOLATION;
}
{
SLAP_LONG lValue, lAssertedValue;
+ errno = 0;
/* safe to assume integers are NUL terminated? */
lValue = SLAP_STRTOL(value->bv_val, NULL, 10);
- if(( lValue == SLAP_LONG_MIN || lValue == SLAP_LONG_MAX ) &&
- errno == ERANGE )
+ if( errno == ERANGE )
{
return LDAP_CONSTRAINT_VIOLATION;
}
lAssertedValue = SLAP_STRTOL( ((struct berval *)assertedValue)->bv_val,
NULL, 10);
- if(( lAssertedValue == SLAP_LONG_MIN || lAssertedValue == SLAP_LONG_MAX ) &&
- errno == ERANGE )
+ if( errno == ERANGE )
{
return LDAP_CONSTRAINT_VIOLATION;
}
return LDAP_SUCCESS;
}
-#ifdef HAVE_TLS
static int
certificateExactNormalize(
slap_mask_t usage,
struct berval *normalized,
void *ctx )
{
- int rc = LDAP_INVALID_SYNTAX;
- unsigned char *p;
- char *serial = NULL;
+ BerElementBuffer berbuf;
+ BerElement *ber = (BerElement *)&berbuf;
+ ber_tag_t tag;
+ ber_len_t len;
+ ber_int_t i;
+ char serial[64];
ber_len_t seriallen;
- struct berval issuer_dn = BER_BVNULL;
- X509_NAME *name = NULL;
- ASN1_INTEGER *sn = NULL;
- X509 *xcert = NULL;
+ struct berval issuer_dn = BER_BVNULL, bvdn;
+ unsigned char *p;
+ int rc = LDAP_INVALID_SYNTAX;
if( BER_BVISEMPTY( val ) ) goto done;
return serialNumberAndIssuerNormalize(0,NULL,NULL,val,normalized,ctx);
}
- assert( SLAP_MR_IS_VALUE_OF_ATTRIBUTE_SYNTAX(usage) );
+ assert( SLAP_MR_IS_VALUE_OF_ATTRIBUTE_SYNTAX(usage) != 0 );
- p = (unsigned char *)val->bv_val;
- xcert = d2i_X509( NULL, &p, val->bv_len);
- if( xcert == NULL ) goto done;
+ ber_init2( ber, val, LBER_USE_DER );
+ tag = ber_skip_tag( ber, &len ); /* Signed Sequence */
+ tag = ber_skip_tag( ber, &len ); /* Sequence */
+ tag = ber_skip_tag( ber, &len ); /* Optional version? */
+ if ( tag == 0xa0 )
+ tag = ber_get_int( ber, &i ); /* version */
+ ber_get_int( ber, &i ); /* serial */
- sn=X509_get_serialNumber(xcert);
- if ( sn == NULL ) goto done;
- serial=i2s_ASN1_INTEGER(0, sn );
- if( serial == NULL ) goto done;
- seriallen=strlen(serial);
+ seriallen = snprintf( serial, sizeof(serial), "%d", i );
+ tag = ber_skip_tag( ber, &len ); /* SignatureAlg */
+ ber_skip_data( ber, len );
+ tag = ber_peek_tag( ber, &len ); /* IssuerDN */
+ len = ber_ptrlen( ber );
+ bvdn.bv_val = val->bv_val + len;
+ bvdn.bv_len = val->bv_len - len;
- name=X509_get_issuer_name(xcert);
- if( name == NULL ) goto done;
- rc = dnX509normalize( name, &issuer_dn );
+ rc = dnX509normalize( &bvdn, &issuer_dn );
if( rc != LDAP_SUCCESS ) goto done;
normalized->bv_len = STRLENOF( "{ serialNumber , issuer \"\" }" )
rc = LDAP_SUCCESS;
done:
- if (xcert) X509_free(xcert);
- if (serial) ch_free(serial);
if (issuer_dn.bv_val) ber_memfree(issuer_dn.bv_val);
return rc;
}
-#endif /* HAVE_TLS */
#ifndef SUPPORT_OBSOLETE_UTC_SYNTAX
return rc;
}
+static char *country_gen_syn[] = {
+ "1.3.6.1.4.1.1466.115.121.1.15",
+ "1.3.6.1.4.1.1466.115.121.1.26",
+ "1.3.6.1.4.1.1466.115.121.1.44",
+ NULL
+};
#define X_BINARY "X-BINARY-TRANSFER-REQUIRED 'TRUE' "
#define X_NOT_H_R "X-NOT-HUMAN-READABLE 'TRUE' "
static slap_syntax_defs_rec syntax_defs[] = {
{"( 1.3.6.1.4.1.1466.115.121.1.1 DESC 'ACI Item' "
X_BINARY X_NOT_H_R ")",
- SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, NULL, NULL},
+ SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.2 DESC 'Access Point' " X_NOT_H_R ")",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.3 DESC 'Attribute Type Description' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.4 DESC 'Audio' "
X_NOT_H_R ")",
- SLAP_SYNTAX_BLOB, blobValidate, NULL},
+ SLAP_SYNTAX_BLOB, NULL, blobValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.5 DESC 'Binary' "
X_NOT_H_R ")",
- SLAP_SYNTAX_BER, berValidate, NULL},
+ SLAP_SYNTAX_BER, NULL, berValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.6 DESC 'Bit String' )",
- 0, bitStringValidate, NULL },
+ 0, NULL, bitStringValidate, NULL },
{"( 1.3.6.1.4.1.1466.115.121.1.7 DESC 'Boolean' )",
- 0, booleanValidate, NULL},
+ 0, NULL, booleanValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.8 DESC 'Certificate' "
X_BINARY X_NOT_H_R ")",
- SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, certificateValidate, NULL},
+ SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER,
+ NULL, certificateValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.9 DESC 'Certificate List' "
X_BINARY X_NOT_H_R ")",
- SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, sequenceValidate, NULL},
+ SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER,
+ NULL, sequenceValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.10 DESC 'Certificate Pair' "
X_BINARY X_NOT_H_R ")",
- SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, sequenceValidate, NULL},
+ SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER,
+ NULL, sequenceValidate, NULL},
+#if 0 /* need to go __after__ printableString */
{"( 1.3.6.1.4.1.1466.115.121.1.11 DESC 'Country String' )",
- 0, countryStringValidate, NULL},
+ 0, "1.3.6.1.4.1.1466.115.121.1.44",
+ countryStringValidate, NULL},
+#endif
{"( 1.3.6.1.4.1.1466.115.121.1.12 DESC 'Distinguished Name' )",
- 0, dnValidate, dnPretty},
+ 0, NULL, dnValidate, dnPretty},
{"( 1.2.36.79672281.1.5.0 DESC 'RDN' )",
- 0, rdnValidate, rdnPretty},
+ 0, NULL, rdnValidate, rdnPretty},
#ifdef LDAP_COMP_MATCH
{"( 1.2.36.79672281.1.5.3 DESC 'allComponents' )",
- 0, allComponentsValidate, NULL},
+ 0, NULL, allComponentsValidate, NULL},
{"( 1.2.36.79672281.1.5.2 DESC 'componentFilterMatch assertion') ",
- 0, componentFilterValidate, NULL},
+ 0, NULL, componentFilterValidate, NULL},
#endif
{"( 1.3.6.1.4.1.1466.115.121.1.13 DESC 'Data Quality' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.14 DESC 'Delivery Method' )",
- 0, deliveryMethodValidate, NULL},
+ 0, NULL, deliveryMethodValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.15 DESC 'Directory String' )",
- 0, UTF8StringValidate, NULL},
+ 0, NULL, UTF8StringValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.16 DESC 'DIT Content Rule Description' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.17 DESC 'DIT Structure Rule Description' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.19 DESC 'DSA Quality' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.20 DESC 'DSE Type' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.21 DESC 'Enhanced Guide' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.22 DESC 'Facsimile Telephone Number' )",
- 0, printablesStringValidate, NULL},
+ 0, NULL, printablesStringValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.23 DESC 'Fax' " X_NOT_H_R ")",
- SLAP_SYNTAX_BLOB, NULL, NULL},
+ SLAP_SYNTAX_BLOB, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.24 DESC 'Generalized Time' )",
- 0, generalizedTimeValidate, NULL},
+ 0, NULL, generalizedTimeValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.25 DESC 'Guide' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.26 DESC 'IA5 String' )",
- 0, IA5StringValidate, NULL},
+ 0, NULL, IA5StringValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.27 DESC 'Integer' )",
- 0, integerValidate, NULL},
+ 0, NULL, integerValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.28 DESC 'JPEG' " X_NOT_H_R ")",
- SLAP_SYNTAX_BLOB, blobValidate, NULL},
+ SLAP_SYNTAX_BLOB, NULL, blobValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.29 DESC 'Master And Shadow Access Points' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.30 DESC 'Matching Rule Description' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.31 DESC 'Matching Rule Use Description' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.32 DESC 'Mail Preference' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.33 DESC 'MHS OR Address' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.34 DESC 'Name And Optional UID' )",
- 0, nameUIDValidate, nameUIDPretty },
+ 0, NULL, nameUIDValidate, nameUIDPretty },
{"( 1.3.6.1.4.1.1466.115.121.1.35 DESC 'Name Form Description' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.36 DESC 'Numeric String' )",
- 0, numericStringValidate, NULL},
+ 0, NULL, numericStringValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.37 DESC 'Object Class Description' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.38 DESC 'OID' )",
- 0, numericoidValidate, NULL},
+ 0, NULL, numericoidValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.39 DESC 'Other Mailbox' )",
- 0, IA5StringValidate, NULL},
+ 0, NULL, IA5StringValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.40 DESC 'Octet String' )",
- 0, blobValidate, NULL},
+ 0, NULL, blobValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.41 DESC 'Postal Address' )",
- 0, UTF8StringValidate, NULL},
+ 0, NULL, UTF8StringValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.42 DESC 'Protocol Information' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.43 DESC 'Presentation Address' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.44 DESC 'Printable String' )",
- 0, printableStringValidate, NULL},
+ 0, NULL, printableStringValidate, NULL},
+ /* moved here because now depends on Directory String, IA5 String
+ * and Printable String */
+ {"( 1.3.6.1.4.1.1466.115.121.1.11 DESC 'Country String' )",
+ 0, country_gen_syn, countryStringValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.45 DESC 'SubtreeSpecification' )",
#define subtreeSpecificationValidate UTF8StringValidate /* FIXME */
- 0, subtreeSpecificationValidate, NULL},
+ 0, NULL, subtreeSpecificationValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.49 DESC 'Supported Algorithm' "
X_BINARY X_NOT_H_R ")",
- SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, berValidate, NULL},
+ SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, NULL, berValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.50 DESC 'Telephone Number' )",
- 0, printableStringValidate, NULL},
+ 0, NULL, printableStringValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.51 DESC 'Teletex Terminal Identifier' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.52 DESC 'Telex Number' )",
- 0, printablesStringValidate, NULL},
+ 0, NULL, printablesStringValidate, NULL},
#ifdef SUPPORT_OBSOLETE_UTC_SYNTAX
{"( 1.3.6.1.4.1.1466.115.121.1.53 DESC 'UTC Time' )",
- 0, utcTimeValidate, NULL},
+ 0, NULL, utcTimeValidate, NULL},
#endif
{"( 1.3.6.1.4.1.1466.115.121.1.54 DESC 'LDAP Syntax Description' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.55 DESC 'Modify Rights' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.56 DESC 'LDAP Schema Definition' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.57 DESC 'LDAP Schema Description' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.58 DESC 'Substring Assertion' )",
- 0, NULL, NULL},
+ 0, NULL, NULL, NULL},
/* RFC 2307 NIS Syntaxes */
{"( 1.3.6.1.1.1.0.0 DESC 'RFC2307 NIS Netgroup Triple' )",
- 0, nisNetgroupTripleValidate, NULL},
+ 0, NULL, nisNetgroupTripleValidate, NULL},
{"( 1.3.6.1.1.1.0.1 DESC 'RFC2307 Boot Parameter' )",
- 0, bootParameterValidate, NULL},
+ 0, NULL, bootParameterValidate, NULL},
- /* From PKIX *//* This OID is not published yet. */
- {"( 1.2.826.0.1.3344810.7.1 DESC 'Certificate Serial Number and Issuer' )",
- SLAP_SYNTAX_HIDE,
+ /* draft-zeilenga-ldap-x509 */
+ {"( 1.3.6.1.1.15.1 DESC 'Certificate Exact Assertion' )",
+ SLAP_SYNTAX_HIDE, NULL,
serialNumberAndIssuerValidate,
serialNumberAndIssuerPretty},
+ {"( 1.3.6.1.1.15.2 DESC 'Certificate Assertion' )",
+ SLAP_SYNTAX_HIDE, NULL, NULL, NULL},
+ {"( 1.3.6.1.1.15.3 DESC 'Certificate Pair Exact Assertion' )",
+ SLAP_SYNTAX_HIDE, NULL, NULL, NULL},
+ {"( 1.3.6.1.1.15.4 DESC 'Certificate Pair Assertion' )",
+ SLAP_SYNTAX_HIDE, NULL, NULL, NULL},
+ {"( 1.3.6.1.1.15.5 DESC 'Certificate List Exact Assertion' )",
+ SLAP_SYNTAX_HIDE, NULL, NULL, NULL},
+ {"( 1.3.6.1.1.15.6 DESC 'Certificate List Assertion' )",
+ SLAP_SYNTAX_HIDE, NULL, NULL, NULL},
+ {"( 1.3.6.1.1.15.7 DESC 'Algorithm Identifier' )",
+ SLAP_SYNTAX_HIDE, NULL, NULL, NULL},
#ifdef SLAPD_AUTHPASSWD
/* needs updating */
{"( 1.3.6.1.4.1.4203.666.2.2 DESC 'OpenLDAP authPassword' )",
- SLAP_SYNTAX_HIDE, NULL, NULL},
+ SLAP_SYNTAX_HIDE, NULL, NULL, NULL},
#endif
{"( 1.3.6.1.1.16.1 DESC 'UUID' )",
- 0, UUIDValidate, UUIDPretty},
+ 0, NULL, UUIDValidate, UUIDPretty},
{"( 1.3.6.1.4.1.4203.666.11.2.1 DESC 'CSN' )",
- SLAP_SYNTAX_HIDE, csnValidate, NULL},
+ SLAP_SYNTAX_HIDE, NULL, csnValidate, NULL},
/* OpenLDAP Void Syntax */
{"( 1.3.6.1.4.1.4203.1.1.1 DESC 'OpenLDAP void' )" ,
- SLAP_SYNTAX_HIDE, inValidate, NULL},
+ SLAP_SYNTAX_HIDE, NULL, inValidate, NULL},
-#ifdef SLAP_AUTHZ_SYNTAX
/* FIXME: OID is unused, but not registered yet */
{"( 1.3.6.1.4.1.4203.666.2.7 DESC 'OpenLDAP authz' )",
- SLAP_SYNTAX_HIDE, authzValidate, authzPretty},
-#endif /* SLAP_AUTHZ_SYNTAX */
+ SLAP_SYNTAX_HIDE, NULL, authzValidate, authzPretty},
- {NULL, 0, NULL, NULL}
+ {NULL, 0, NULL, NULL, NULL}
};
char *certificateExactMatchSyntaxes[] = {
};
char *integerFirstComponentMatchSyntaxes[] = {
"1.3.6.1.4.1.1466.115.121.1.27" /* INTEGER */,
- "1.3.6.1.4.1.1466.115.121.1.17" /* ditStructureRuleDescription */,
+ "1.3.6.1.4.1.1466.115.121.1.17" /* dITStructureRuleDescription */,
NULL
};
char *objectIdentifierFirstComponentMatchSyntaxes[] = {
"1.3.6.1.4.1.1466.115.121.1.38" /* OID */,
"1.3.6.1.4.1.1466.115.121.1.3" /* attributeTypeDescription */,
- "1.3.6.1.4.1.1466.115.121.1.16" /* ditContentRuleDescription */,
+ "1.3.6.1.4.1.1466.115.121.1.16" /* dITContentRuleDescription */,
"1.3.6.1.4.1.1466.115.121.1.54" /* ldapSyntaxDescription */,
"1.3.6.1.4.1.1466.115.121.1.30" /* matchingRuleDescription */,
"1.3.6.1.4.1.1466.115.121.1.31" /* matchingRuleUseDescription */,
* 2.5.13.31* directoryStringFirstComponentMatch
* 2.5.13.32* wordMatch
* 2.5.13.33* keywordMatch
- * 2.5.13.36 certificatePairExactMatch
- * 2.5.13.37 certificatePairMatch
- * 2.5.13.38 certificateListExactMatch
- * 2.5.13.39 certificateListMatch
- * 2.5.13.40 algorithmIdentifierMatch
+ * 2.5.13.36+ certificatePairExactMatch
+ * 2.5.13.37+ certificatePairMatch
+ * 2.5.13.38+ certificateListExactMatch
+ * 2.5.13.39+ certificateListMatch
+ * 2.5.13.40+ algorithmIdentifierMatch
* 2.5.13.41* storedPrefixMatch
* 2.5.13.42 attributeCertificateMatch
* 2.5.13.43 readerAndKeyIDMatch
* 2.5.13.44 attributeIntegrityMatch
*
* (*) described in RFC 3698 (LDAP: Additional Matching Rules)
+ * (+) described in draft-zeilenga-ldap-x509
*/
static slap_mrule_defs_rec mrule_defs[] = {
/*
NULL },
{"( 2.5.13.34 NAME 'certificateExactMatch' "
- "SYNTAX 1.2.826.0.1.3344810.7.1 )",
+ "SYNTAX 1.3.6.1.1.15.1 )",
SLAP_MR_EQUALITY | SLAP_MR_EXT, certificateExactMatchSyntaxes,
#ifdef HAVE_TLS
NULL, certificateExactNormalize, octetStringMatch,
NULL },
{"( 2.5.13.35 NAME 'certificateMatch' "
- "SYNTAX 1.3.6.1.4.1.1466.115.121.1.8 )",
+ "SYNTAX 1.3.6.1.1.15.2 )",
SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
NULL, NULL, NULL, NULL, NULL,
NULL },
NULL, NULL,
"CSNMatch" },
-#ifdef SLAP_AUTHZ_SYNTAX
/* FIXME: OID is unused, but not registered yet */
{"( 1.3.6.1.4.1.4203.666.4.12 NAME 'authzMatch' "
"SYNTAX 1.3.6.1.4.1.4203.666.2.7 )",
NULL, authzNormalize, authzMatch,
NULL, NULL,
NULL},
-#endif /* SLAP_AUTHZ_SYNTAX */
{NULL, SLAP_MR_NONE, NULL,
NULL, NULL, NULL, NULL, NULL,
mru_destroy();
syn_destroy();
- ldap_pvt_thread_mutex_destroy( &ad_undef_mutex );
- ldap_pvt_thread_mutex_destroy( &oc_undef_mutex );
+ if( schema_init_done ) {
+ ldap_pvt_thread_mutex_destroy( &ad_undef_mutex );
+ ldap_pvt_thread_mutex_destroy( &oc_undef_mutex );
+ }
}
projects / openldap / blobdiff