/* schema_init.c - init builtin schema */
/* $OpenLDAP$ */
-/*
- * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
- * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
+/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
+ *
+ * Copyright 1998-2004 The OpenLDAP Foundation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted only as authorized by the OpenLDAP
+ * Public License.
+ *
+ * A copy of this license is available in the file LICENSE in the
+ * top-level directory of the distribution or, alternatively, at
+ * <http://www.OpenLDAP.org/license.html>.
*/
#include "portable.h"
#include "ldap_utf8.h"
+#ifdef HAVE_TLS
+#include <openssl/x509.h>
+#include <openssl/err.h>
+#include <openssl/rsa.h>
+#include <openssl/crypto.h>
+#include <openssl/pem.h>
+#include <openssl/bio.h>
+#include <openssl/asn1.h>
+#include <openssl/x509v3.h>
+#include <openssl/ssl.h>
+#endif
+
#include "lutil_hash.h"
#define HASH_BYTES LUTIL_HASH_BYTES
#define HASH_CONTEXT lutil_HASH_CTX
#define berValidate blobValidate
+static int
+sequenceValidate(
+ Syntax *syntax,
+ struct berval *in )
+{
+ if ( in->bv_len < 2 ) return LDAP_INVALID_SYNTAX;
+ if ( in->bv_val[0] != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
+
+ return LDAP_SUCCESS;
+}
+
+
+#ifdef HAVE_TLS
+static int certificateValidate( Syntax *syntax, struct berval *in )
+{
+ X509 *xcert=NULL;
+ unsigned char *p = (unsigned char *)in->bv_val;
+
+ xcert = d2i_X509(NULL, &p, in->bv_len);
+ if ( !xcert ) return LDAP_INVALID_SYNTAX;
+ X509_free(xcert);
+ return LDAP_SUCCESS;
+}
+#else
+#define certificateValidate sequenceValidate
+#endif
+
static int
octetStringMatch(
int *matchp,
HASH_CONTEXT HASHcontext;
unsigned char HASHdigest[HASH_BYTES];
struct berval digest;
- digest.bv_val = HASHdigest;
+ digest.bv_val = (char *)HASHdigest;
digest.bv_len = sizeof(HASHdigest);
for( i=0; values[i].bv_val != NULL; i++ ) {
/* we should have at least one value at this point */
assert( i > 0 );
- keys = sl_malloc( sizeof( struct berval ) * (i+1), ctx );
+ keys = slap_sl_malloc( sizeof( struct berval ) * (i+1), ctx );
slen = syntax->ssyn_oidlen;
mlen = mr->smr_oidlen;
HASH_Init( &HASHcontext );
if( prefix != NULL && prefix->bv_len > 0 ) {
HASH_Update( &HASHcontext,
- prefix->bv_val, prefix->bv_len );
+ (unsigned char *)prefix->bv_val,
+ prefix->bv_len );
}
HASH_Update( &HASHcontext,
- syntax->ssyn_oid, slen );
+ (unsigned char *)syntax->ssyn_oid, slen );
HASH_Update( &HASHcontext,
- mr->smr_oid, mlen );
+ (unsigned char *)mr->smr_oid, mlen );
HASH_Update( &HASHcontext,
- values[i].bv_val, values[i].bv_len );
+ (unsigned char *)values[i].bv_val, values[i].bv_len );
HASH_Final( HASHdigest, &HASHcontext );
ber_dupbv_x( &keys[i], &digest, ctx );
unsigned char HASHdigest[HASH_BYTES];
struct berval *value = (struct berval *) assertedValue;
struct berval digest;
- digest.bv_val = HASHdigest;
+ digest.bv_val = (char *)HASHdigest;
digest.bv_len = sizeof(HASHdigest);
slen = syntax->ssyn_oidlen;
mlen = mr->smr_oidlen;
- keys = sl_malloc( sizeof( struct berval ) * 2, ctx );
+ keys = slap_sl_malloc( sizeof( struct berval ) * 2, ctx );
HASH_Init( &HASHcontext );
if( prefix != NULL && prefix->bv_len > 0 ) {
HASH_Update( &HASHcontext,
- prefix->bv_val, prefix->bv_len );
+ (unsigned char *)prefix->bv_val, prefix->bv_len );
}
HASH_Update( &HASHcontext,
- syntax->ssyn_oid, slen );
+ (unsigned char *)syntax->ssyn_oid, slen );
HASH_Update( &HASHcontext,
- mr->smr_oid, mlen );
+ (unsigned char *)mr->smr_oid, mlen );
HASH_Update( &HASHcontext,
- value->bv_val, value->bv_len );
+ (unsigned char *)value->bv_val, value->bv_len );
HASH_Final( HASHdigest, &HASHcontext );
ber_dupbv_x( keys, &digest, ctx );
HASH_CONTEXT HASHcontext;
unsigned char HASHdigest[HASH_BYTES];
struct berval digest;
- digest.bv_val = HASHdigest;
+ digest.bv_val = (char *)HASHdigest;
digest.bv_len = sizeof(HASHdigest);
nkeys=0;
return LDAP_SUCCESS;
}
- keys = sl_malloc( sizeof( struct berval ) * (nkeys+1), ctx );
+ keys = slap_sl_malloc( sizeof( struct berval ) * (nkeys+1), ctx );
slen = syntax->ssyn_oidlen;
mlen = mr->smr_oidlen;
HASH_Init( &HASHcontext );
if( prefix != NULL && prefix->bv_len > 0 ) {
HASH_Update( &HASHcontext,
- prefix->bv_val, prefix->bv_len );
+ (unsigned char *)prefix->bv_val, prefix->bv_len );
}
HASH_Update( &HASHcontext,
- &pre, sizeof( pre ) );
+ (unsigned char *)&pre, sizeof( pre ) );
HASH_Update( &HASHcontext,
- syntax->ssyn_oid, slen );
+ (unsigned char *)syntax->ssyn_oid, slen );
HASH_Update( &HASHcontext,
- mr->smr_oid, mlen );
+ (unsigned char *)mr->smr_oid, mlen );
HASH_Update( &HASHcontext,
- &values[i].bv_val[j],
+ (unsigned char *)&values[i].bv_val[j],
SLAP_INDEX_SUBSTR_MAXLEN );
HASH_Final( HASHdigest, &HASHcontext );
HASH_Init( &HASHcontext );
if( prefix != NULL && prefix->bv_len > 0 ) {
HASH_Update( &HASHcontext,
- prefix->bv_val, prefix->bv_len );
+ (unsigned char *)prefix->bv_val, prefix->bv_len );
}
HASH_Update( &HASHcontext,
- &pre, sizeof( pre ) );
+ (unsigned char *)&pre, sizeof( pre ) );
HASH_Update( &HASHcontext,
- syntax->ssyn_oid, slen );
+ (unsigned char *)syntax->ssyn_oid, slen );
HASH_Update( &HASHcontext,
- mr->smr_oid, mlen );
+ (unsigned char *)mr->smr_oid, mlen );
HASH_Update( &HASHcontext,
- values[i].bv_val, j );
+ (unsigned char *)values[i].bv_val, j );
HASH_Final( HASHdigest, &HASHcontext );
ber_dupbv_x( &keys[nkeys++], &digest, ctx );
HASH_Init( &HASHcontext );
if( prefix != NULL && prefix->bv_len > 0 ) {
HASH_Update( &HASHcontext,
- prefix->bv_val, prefix->bv_len );
+ (unsigned char *)prefix->bv_val, prefix->bv_len );
}
HASH_Update( &HASHcontext,
- &pre, sizeof( pre ) );
+ (unsigned char *)&pre, sizeof( pre ) );
HASH_Update( &HASHcontext,
- syntax->ssyn_oid, slen );
+ (unsigned char *)syntax->ssyn_oid, slen );
HASH_Update( &HASHcontext,
- mr->smr_oid, mlen );
+ (unsigned char *)mr->smr_oid, mlen );
HASH_Update( &HASHcontext,
- &values[i].bv_val[values[i].bv_len-j], j );
+ (unsigned char *)&values[i].bv_val[values[i].bv_len-j], j );
HASH_Final( HASHdigest, &HASHcontext );
ber_dupbv_x( &keys[nkeys++], &digest, ctx );
return LDAP_SUCCESS;
}
- digest.bv_val = HASHdigest;
+ digest.bv_val = (char *)HASHdigest;
digest.bv_len = sizeof(HASHdigest);
slen = syntax->ssyn_oidlen;
mlen = mr->smr_oidlen;
- keys = sl_malloc( sizeof( struct berval ) * (nkeys+1), ctx );
+ keys = slap_sl_malloc( sizeof( struct berval ) * (nkeys+1), ctx );
nkeys = 0;
if( flags & SLAP_INDEX_SUBSTR_INITIAL && sa->sa_initial.bv_val != NULL &&
HASH_Init( &HASHcontext );
if( prefix != NULL && prefix->bv_len > 0 ) {
HASH_Update( &HASHcontext,
- prefix->bv_val, prefix->bv_len );
+ (unsigned char *)prefix->bv_val, prefix->bv_len );
}
HASH_Update( &HASHcontext,
- &pre, sizeof( pre ) );
+ (unsigned char *)&pre, sizeof( pre ) );
HASH_Update( &HASHcontext,
- syntax->ssyn_oid, slen );
+ (unsigned char *)syntax->ssyn_oid, slen );
HASH_Update( &HASHcontext,
- mr->smr_oid, mlen );
+ (unsigned char *)mr->smr_oid, mlen );
HASH_Update( &HASHcontext,
- value->bv_val, klen );
+ (unsigned char *)value->bv_val, klen );
HASH_Final( HASHdigest, &HASHcontext );
ber_dupbv_x( &keys[nkeys++], &digest, ctx );
HASH_Init( &HASHcontext );
if( prefix != NULL && prefix->bv_len > 0 ) {
HASH_Update( &HASHcontext,
- prefix->bv_val, prefix->bv_len );
+ (unsigned char *)prefix->bv_val, prefix->bv_len );
}
HASH_Update( &HASHcontext,
- &pre, sizeof( pre ) );
+ (unsigned char *)&pre, sizeof( pre ) );
HASH_Update( &HASHcontext,
- syntax->ssyn_oid, slen );
+ (unsigned char *)syntax->ssyn_oid, slen );
HASH_Update( &HASHcontext,
- mr->smr_oid, mlen );
+ (unsigned char *)mr->smr_oid, mlen );
HASH_Update( &HASHcontext,
- &value->bv_val[j], klen );
+ (unsigned char *)&value->bv_val[j], klen );
HASH_Final( HASHdigest, &HASHcontext );
ber_dupbv_x( &keys[nkeys++], &digest, ctx );
HASH_Init( &HASHcontext );
if( prefix != NULL && prefix->bv_len > 0 ) {
HASH_Update( &HASHcontext,
- prefix->bv_val, prefix->bv_len );
+ (unsigned char *)prefix->bv_val, prefix->bv_len );
}
HASH_Update( &HASHcontext,
- &pre, sizeof( pre ) );
+ (unsigned char *)&pre, sizeof( pre ) );
HASH_Update( &HASHcontext,
- syntax->ssyn_oid, slen );
+ (unsigned char *)syntax->ssyn_oid, slen );
HASH_Update( &HASHcontext,
- mr->smr_oid, mlen );
+ (unsigned char *)mr->smr_oid, mlen );
HASH_Update( &HASHcontext,
- &value->bv_val[value->bv_len-klen], klen );
+ (unsigned char *)&value->bv_val[value->bv_len-klen], klen );
HASH_Final( HASHdigest, &HASHcontext );
ber_dupbv_x( &keys[nkeys++], &digest, ctx );
} else {
int rc;
struct berval dnval = *val;
- struct berval uidval = { 0, NULL };
+ struct berval uidval = BER_BVNULL;
if( val->bv_val[val->bv_len-1] == 'B'
&& val->bv_val[val->bv_len-2] == '\'' )
if( rc != LDAP_SUCCESS ) return rc;
if( uidval.bv_val ) {
- char *tmp = sl_realloc( out->bv_val, out->bv_len + uidval.bv_len + 2, ctx );
+ char *tmp = slap_sl_realloc( out->bv_val, out->bv_len + uidval.bv_len + 2, ctx );
int i, c, got1;
if( tmp == NULL ) {
ber_memfree_x( out->bv_val, ctx );
struct berval out;
int rc;
+ assert( SLAP_MR_IS_VALUE_OF_SYNTAX( usage ));
+
ber_dupbv( &out, val );
if( out.bv_len != 0 ) {
- struct berval uid = { 0, NULL };
+ struct berval uid = BER_BVNULL;
if( out.bv_val[out.bv_len-1] == 'B'
&& out.bv_val[out.bv_len-2] == '\'' )
{
int match;
struct berval *asserted = (struct berval *) assertedValue;
- struct berval assertedDN = { 0, NULL };
- struct berval assertedUID = { 0, NULL };
- struct berval valueDN = { 0, NULL };
- struct berval valueUID = { 0, NULL };
+ struct berval assertedDN = BER_BVNULL;
+ struct berval assertedUID = BER_BVNULL;
+ struct berval valueDN = BER_BVNULL;
+ struct berval valueUID = BER_BVNULL;
if( asserted->bv_len != 0 ) {
assertedDN = *asserted;
{
ber_len_t count;
int len;
- unsigned char *u = in->bv_val;
+ unsigned char *u = (unsigned char *)in->bv_val;
if( in->bv_len == 0 && syntax == slap_schema.si_syn_directoryString ) {
/* directory strings cannot be empty */
/* make sure len corresponds with the offset
to the next character */
- if( LDAP_UTF8_OFFSET( u ) != len ) return LDAP_INVALID_SYNTAX;
+ if( LDAP_UTF8_OFFSET( (char *)u ) != len ) return LDAP_INVALID_SYNTAX;
}
if( count != 0 ) {
int flags;
int i, wasspace;
+ assert( SLAP_MR_IS_VALUE_OF_SYNTAX( use ));
+
if( val->bv_val == NULL ) {
/* assume we're dealing with a syntax (e.g., UTF8String)
* which allows empty strings
BerVarray keys=NULL;
for( j=0; values[j].bv_val != NULL; j++ ) {
- struct berval val = { 0, NULL };
+ struct berval val = BER_BVNULL;
/* Yes, this is necessary */
UTF8bvnormalize( &values[j], &val, LDAP_UTF8_APPROX, NULL );
assert( val.bv_val != NULL );
{
char *p, *q;
+ assert( SLAP_MR_IS_VALUE_OF_SYNTAX( usage ));
+
/* validator should have refused an empty string */
assert( val->bv_len );
- q = normalized->bv_val = sl_malloc( val->bv_len + 1, ctx );
+ q = normalized->bv_val = slap_sl_malloc( val->bv_len + 1, ctx );
for( p = val->bv_val; *p; p++ ) {
if ( ! ( ASCII_SPACE( *p ) || *p == '-' )) {
normalized->bv_len = q - normalized->bv_val;
if( normalized->bv_len == 0 ) {
- sl_free( normalized->bv_val, ctx );
+ slap_sl_free( normalized->bv_val, ctx );
normalized->bv_val = NULL;
return LDAP_INVALID_SYNTAX;
}
return LDAP_SUCCESS;
}
-static int
+int
numericoidValidate(
Syntax *syntax,
struct berval *in )
void *ctx )
{
char *p, *q;
- int casefold = SLAP_MR_ASSOCIATED(mr, slap_schema.si_mr_caseExactIA5Match);
+ int casefold = !SLAP_MR_ASSOCIATED(mr, slap_schema.si_mr_caseExactIA5Match);
assert( val->bv_len );
+ assert( SLAP_MR_IS_VALUE_OF_SYNTAX( use ));
+
p = val->bv_val;
/* Ignore initial whitespace */
normalized->bv_len = q - normalized->bv_val;
if( normalized->bv_len == 0 ) {
- normalized->bv_val = sl_realloc( normalized->bv_val, 2, ctx );
+ normalized->bv_val = slap_sl_realloc( normalized->bv_val, 2, ctx );
normalized->bv_val[0] = ' ';
normalized->bv_val[1] = '\0';
normalized->bv_len = 1;
return LDAP_SUCCESS;
}
+static int
+UUIDValidate(
+ Syntax *syntax,
+ struct berval *in )
+{
+ int i;
+ if( in->bv_len != 36 ) {
+ assert(0);
+ return LDAP_INVALID_SYNTAX;
+ }
+
+ for( i=0; i<36; i++ ) {
+ switch(i) {
+ case 8:
+ case 13:
+ case 18:
+ case 23:
+ if( in->bv_val[i] != '-' ) {
+ return LDAP_INVALID_SYNTAX;
+ }
+ break;
+ default:
+ if( !ASCII_HEX( in->bv_val[i]) ) {
+ return LDAP_INVALID_SYNTAX;
+ }
+ }
+ }
+
+ return LDAP_SUCCESS;
+}
+
+static int
+UUIDNormalize(
+ slap_mask_t usage,
+ Syntax *syntax,
+ MatchingRule *mr,
+ struct berval *val,
+ struct berval *normalized,
+ void *ctx )
+{
+ unsigned char octet = '\0';
+ int i;
+ int j;
+ normalized->bv_len = 16;
+ normalized->bv_val = slap_sl_malloc( normalized->bv_len+1, ctx );
+
+ for( i=0, j=0; i<36; i++ ) {
+ unsigned char nibble;
+ if( val->bv_val[i] == '-' ) {
+ continue;
+
+ } else if( ASCII_DIGIT( val->bv_val[i] ) ) {
+ nibble = val->bv_val[i] - '0';
+
+ } else if( ASCII_HEXLOWER( val->bv_val[i] ) ) {
+ nibble = val->bv_val[i] - ('a'-10);
+
+ } else if( ASCII_HEXUPPER( val->bv_val[i] ) ) {
+ nibble = val->bv_val[i] - ('A'-10);
+
+ } else {
+ slap_sl_free( normalized->bv_val, ctx );
+ return LDAP_INVALID_SYNTAX;
+ }
+
+ if( j & 1 ) {
+ octet |= nibble;
+ normalized->bv_val[j>>1] = octet;
+ } else {
+ octet = nibble << 4;
+ }
+ j++;
+ }
+
+ normalized->bv_val[normalized->bv_len] = 0;
+ return LDAP_SUCCESS;
+}
+
+
+
static int
numericStringValidate(
Syntax *syntax,
assert( val->bv_len );
- normalized->bv_val = sl_malloc( val->bv_len + 1, ctx );
+ normalized->bv_val = slap_sl_malloc( val->bv_len + 1, ctx );
p = val->bv_val;
q = normalized->bv_val;
normalized->bv_len = q - normalized->bv_val;
if( normalized->bv_len == 0 ) {
- normalized->bv_val = sl_realloc( normalized->bv_val, 2, ctx );
+ normalized->bv_val = slap_sl_realloc( normalized->bv_val, 2, ctx );
normalized->bv_val[0] = ' ';
normalized->bv_val[1] = '\0';
normalized->bv_len = 1;
* Integer conversion macros that will use the largest available
* type.
*/
-#if defined(HAVE_STRTOLL) && defined(LLONG_MAX) && defined(LLONG_MIN)
+#if defined(HAVE_STRTOLL) && defined(LLONG_MAX) && defined(LLONG_MIN) && defined(HAVE_LONG_LONG)
# define SLAP_STRTOL(n,e,b) strtoll(n,e,b)
# define SLAP_LONG_MAX LLONG_MAX
# define SLAP_LONG_MIN LLONG_MIN
Syntax *syntax,
struct berval *in )
{
- int rc = LDAP_INVALID_SYNTAX;
- struct berval serialNumber, issuer;
+ int rc;
+ int state;
+ ber_len_t n;
+ struct berval sn, i;
+ if( in->bv_len < 3 ) return LDAP_INVALID_SYNTAX;
- serialNumber.bv_val = in->bv_val;
- for( serialNumber.bv_len = 0;
- serialNumber.bv_len < in->bv_len;
- serialNumber.bv_len++ )
- {
- if ( serialNumber.bv_val[serialNumber.bv_len] == '$' ) {
- issuer.bv_val = &serialNumber.bv_val[serialNumber.bv_len+1];
- issuer.bv_len = in->bv_len - (serialNumber.bv_len+1);
+ i.bv_val = strchr( in->bv_val, '$' );
+ if( i.bv_val == NULL ) return LDAP_INVALID_SYNTAX;
- if( serialNumber.bv_len == 0 || issuer.bv_len == 0 ) break;
+ sn.bv_val = in->bv_val;
+ sn.bv_len = i.bv_val - in->bv_val;
- rc = integerValidate( NULL, &serialNumber );
- if( rc ) break;
+ i.bv_val++;
+ i.bv_len = in->bv_len - (sn.bv_len + 1);
- rc = dnValidate( NULL, &issuer );
- break;
+ /* validate serial number (strict for now) */
+ for( n=0; n < sn.bv_len; n++ ) {
+ if( !ASCII_DIGIT(sn.bv_val[n]) ) {
+ return LDAP_INVALID_SYNTAX;
}
}
- return rc;
+ /* validate DN */
+ rc = dnValidate( NULL, &i );
+ if( rc ) return LDAP_INVALID_SYNTAX;
+
+ return LDAP_SUCCESS;
}
-static int
-serialNumberAndIssuerNormalize(
- slap_mask_t usage,
+int
+serialNumberAndIssuerPretty(
Syntax *syntax,
- MatchingRule *mr,
struct berval *val,
- struct berval *normalized,
+ struct berval *out,
void *ctx )
{
- int rc = LDAP_INVALID_SYNTAX;
- struct berval serialNumber, issuer, nissuer;
-
- serialNumber.bv_val = val->bv_val;
- for( serialNumber.bv_len = 0;
- serialNumber.bv_len < val->bv_len;
- serialNumber.bv_len++ )
- {
- if ( serialNumber.bv_val[serialNumber.bv_len] == '$' ) {
- issuer.bv_val = &serialNumber.bv_val[serialNumber.bv_len+1];
- issuer.bv_len = val->bv_len - (serialNumber.bv_len+1);
-
- if( serialNumber.bv_len == 0 || issuer.bv_len == 0 ) break;
-
- rc = dnNormalize( usage, syntax, mr, &issuer, &nissuer, ctx );
- if( rc ) break;
+ int rc;
+ int state;
+ ber_len_t n;
+ struct berval sn, i, newi;
- normalized->bv_len = serialNumber.bv_len + 1 + nissuer.bv_len;
- normalized->bv_val = ch_malloc( normalized->bv_len + 1);
+ assert( val );
+ assert( out );
- AC_MEMCPY( normalized->bv_val,
- serialNumber.bv_val, serialNumber.bv_len );
- normalized->bv_val[serialNumber.bv_len] = '$';
- AC_MEMCPY( &normalized->bv_val[serialNumber.bv_len+1],
- nissuer.bv_val, nissuer.bv_len );
- normalized->bv_val[normalized->bv_len] = '\0';
- break;
- }
- }
+#ifdef NEW_LOGGING
+ LDAP_LOG( OPERATION, ARGS, ">>> serialNumberAndIssuerPretty: <%s>\n",
+ val->bv_val, 0, 0 );
+#else
+ Debug( LDAP_DEBUG_TRACE, ">>> serialNumberAndIssuerPretty: <%s>\n",
+ val->bv_val, 0, 0 );
+#endif
- return rc;
-}
+ if( val->bv_len < 3 ) return LDAP_INVALID_SYNTAX;
-#ifdef HAVE_TLS
-#include <openssl/x509.h>
-#include <openssl/err.h>
+ i.bv_val = strchr( val->bv_val, '$' );
+ if( i.bv_val == NULL ) return LDAP_INVALID_SYNTAX;
-/*
- * Next function returns a string representation of a ASN1_INTEGER.
- * It works for unlimited lengths.
- */
+ sn.bv_val = val->bv_val;
+ sn.bv_len = i.bv_val - val->bv_val;
-static struct berval *
-asn1_integer2str(ASN1_INTEGER *a, struct berval *bv)
-{
- char buf[256];
- char *p;
- static char digit[] = "0123456789";
-
- /* We work backwards, make it fill from the end of buf */
- p = buf + sizeof(buf) - 1;
- *p = '\0';
+ i.bv_val++;
+ i.bv_len = val->bv_len - (sn.bv_len + 1);
- if ( a == NULL || a->length == 0 ) {
- *--p = '0';
- } else {
- int i;
- int n = a->length;
- int base = 0;
- unsigned int *copy;
+ /* eat leading zeros */
+ for( n=0; n < (sn.bv_len-1); n++ ) {
+ if( sn.bv_val[n] != '0' ) break;
+ }
+ sn.bv_val += n;
+ sn.bv_len -= n;
- /* We want to preserve the original */
- copy = ch_malloc(n*sizeof(unsigned int));
- for (i = 0; i<n; i++) {
- copy[i] = a->data[i];
+ for( n=0; n < sn.bv_len; n++ ) {
+ if( !ASCII_DIGIT(sn.bv_val[n]) ) {
+ return LDAP_INVALID_SYNTAX;
}
+ }
- /*
- * base indicates the index of the most significant
- * byte that might be nonzero. When it goes off the
- * end, we now there is nothing left to do.
- */
- while (base < n) {
- unsigned int carry;
-
- carry = 0;
- for (i = base; i<n; i++ ) {
- copy[i] += carry*256;
- carry = copy[i] % 10;
- copy[i] /= 10;
- }
- if (p <= buf+1) {
- /*
- * Way too large, we need to leave
- * room for sign if negative
- */
- free(copy);
- return NULL;
- }
- *--p = digit[carry];
+ /* pretty DN */
+ rc = dnPretty( syntax, &i, &newi, ctx );
+ if( rc ) return LDAP_INVALID_SYNTAX;
- if (copy[base] == 0) base++;
- }
- free(copy);
- }
+ /* make room from sn + "$" */
+ out->bv_len = sn.bv_len + newi.bv_len + 1;
+ out->bv_val = slap_sl_realloc( newi.bv_val, out->bv_len + 1, ctx );
- if ( a->type == V_ASN1_NEG_INTEGER ) {
- *--p = '-';
+ if( out->bv_val == NULL ) {
+ slap_sl_free( newi.bv_val, ctx );
+ return LDAP_OTHER;
}
- return ber_str2bv( p, 0, 1, bv );
+ /* push issuer over */
+ AC_MEMCPY( &out->bv_val[sn.bv_len+1], newi.bv_val, newi.bv_len );
+ /* insert sn and "$" */
+ AC_MEMCPY( out->bv_val, sn.bv_val, sn.bv_len );
+ out->bv_val[sn.bv_len] = '$';
+ /* terminate */
+ out->bv_val[out->bv_len] = '\0';
+
+#ifdef NEW_LOGGING
+ LDAP_LOG( OPERATION, ARGS, "<<< serialNumberAndIssuerPretty: <%s>\n",
+ out->bv_val, 0, 0 );
+#else
+ Debug( LDAP_DEBUG_TRACE, "<<< serialNumberAndIssuerPretty: <%s>\n",
+ out->bv_val, 0, 0 );
+#endif
+
+ return LDAP_SUCCESS;
}
/*
- * Given a certificate in DER format, extract the corresponding
- * assertion value for certificateExactMatch
+ * This routine is called by certificateExactNormalize when
+ * certificateExactNormalize receives a search string instead of
+ * a certificate. This routine checks if the search value is valid
+ * and then returns the normalized value
*/
static int
-certificateExactConvert(
- struct berval * in,
- struct berval * out )
+serialNumberAndIssuerNormalize(
+ slap_mask_t usage,
+ Syntax *syntax,
+ MatchingRule *mr,
+ struct berval *val,
+ struct berval *out,
+ void *ctx )
{
int rc;
- X509 *xcert;
- unsigned char *p = in->bv_val;
- struct berval serial;
- struct berval issuer_dn;
+ int state;
+ ber_len_t n;
+ struct berval sn, i, newi;
+
+ assert( val );
+ assert( out );
- xcert = d2i_X509(NULL, &p, in->bv_len);
- if ( !xcert ) {
#ifdef NEW_LOGGING
- LDAP_LOG( CONFIG, ENTRY,
- "certificateExactConvert: error parsing cert: %s\n",
- ERR_error_string(ERR_get_error(),NULL), 0, 0 );
+ LDAP_LOG( OPERATION, ARGS, ">>> serialNumberAndIssuerNormalize: <%s>\n",
+ val->bv_val, 0, 0 );
#else
- Debug( LDAP_DEBUG_ARGS, "certificateExactConvert: "
- "error parsing cert: %s\n",
- ERR_error_string(ERR_get_error(),NULL), NULL, NULL );
+ Debug( LDAP_DEBUG_TRACE, ">>> serialNumberAndIssuerNormalize: <%s>\n",
+ val->bv_val, 0, 0 );
#endif
- return LDAP_INVALID_SYNTAX;
- }
- if ( !asn1_integer2str(xcert->cert_info->serialNumber, &serial) ) {
- X509_free(xcert);
- return LDAP_INVALID_SYNTAX;
+ if( val->bv_len < 3 ) return LDAP_INVALID_SYNTAX;
+
+ i.bv_val = strchr( val->bv_val, '$' );
+ if( i.bv_val == NULL ) return LDAP_INVALID_SYNTAX;
+
+ sn.bv_val = val->bv_val;
+ sn.bv_len = i.bv_val - val->bv_val;
+
+ i.bv_val++;
+ i.bv_len = val->bv_len - (sn.bv_len + 1);
+
+ /* eat leading zeros */
+ for( n=0; n < (sn.bv_len-1); n++ ) {
+ if( sn.bv_val[n] != '0' ) break;
}
+ sn.bv_val += n;
+ sn.bv_len -= n;
- rc = dnX509normalize( X509_get_issuer_name(xcert), &issuer_dn );
- if( rc != LDAP_SUCCESS ) {
- X509_free(xcert);
- ber_memfree(serial.bv_val);
- return LDAP_INVALID_SYNTAX;
+ for( n=0; n < sn.bv_len; n++ ) {
+ if( !ASCII_DIGIT(sn.bv_val[n]) ) {
+ return LDAP_INVALID_SYNTAX;
+ }
}
- X509_free(xcert);
+ /* pretty DN */
+ rc = dnNormalize( usage, syntax, mr, &i, &newi, ctx );
+ if( rc ) return LDAP_INVALID_SYNTAX;
- out->bv_len = serial.bv_len + issuer_dn.bv_len + sizeof(" $ ");
- out->bv_val = ch_malloc(out->bv_len);
- p = out->bv_val;
- AC_MEMCPY(p, serial.bv_val, serial.bv_len);
- p += serial.bv_len;
- AC_MEMCPY(p, " $ ", sizeof(" $ ")-1);
- p += 3;
- AC_MEMCPY(p, issuer_dn.bv_val, issuer_dn.bv_len);
- p += issuer_dn.bv_len;
- *p++ = '\0';
+ /* make room from sn + "$" */
+ out->bv_len = sn.bv_len + newi.bv_len + 1;
+ out->bv_val = slap_sl_realloc( newi.bv_val, out->bv_len + 1, ctx );
+
+ if( out->bv_val == NULL ) {
+ slap_sl_free( newi.bv_val, ctx );
+ return LDAP_OTHER;
+ }
+
+ /* push issuer over */
+ AC_MEMCPY( &out->bv_val[sn.bv_len+1], newi.bv_val, newi.bv_len );
+ /* insert sn and "$" */
+ AC_MEMCPY( out->bv_val, sn.bv_val, sn.bv_len );
+ out->bv_val[sn.bv_len] = '$';
+ /* terminate */
+ out->bv_val[out->bv_len] = '\0';
#ifdef NEW_LOGGING
- LDAP_LOG( CONFIG, ARGS, "certificateExactConvert: %s\n",
+ LDAP_LOG( OPERATION, ARGS, "<<< serialNumberAndIssuerNormalize: <%s>\n",
out->bv_val, 0, 0 );
#else
- Debug( LDAP_DEBUG_ARGS, "certificateExactConvert: %s\n",
- out->bv_val, NULL, NULL );
+ Debug( LDAP_DEBUG_TRACE, "<<< serialNumberAndIssuerNormalize: <%s>\n",
+ out->bv_val, 0, 0 );
#endif
- ber_memfree(serial.bv_val);
- ber_memfree(issuer_dn.bv_val);
-
- return LDAP_SUCCESS;
+ return rc;
}
+#ifdef HAVE_TLS
static int
certificateExactNormalize(
slap_mask_t usage,
struct berval *normalized,
void *ctx )
{
- int rc;
+ int rc = LDAP_INVALID_SYNTAX;
+ unsigned char *p;
+ char *serial = NULL;
+ ber_len_t seriallen;
+ struct berval issuer_dn = BER_BVNULL;
+ X509_NAME *name = NULL;
+ ASN1_INTEGER *sn = NULL;
+ X509 *xcert = NULL;
+
+ if( val->bv_len == 0 ) goto done;
+
+ if( SLAP_MR_IS_VALUE_OF_ASSERTION_SYNTAX(usage) ) {
+ return serialNumberAndIssuerNormalize(0,NULL,NULL,val,normalized,ctx);
+ }
+
+ assert( SLAP_MR_IS_VALUE_OF_ATTRIBUTE_SYNTAX(usage) );
+
+ p = (unsigned char *)val->bv_val;
+ xcert = d2i_X509( NULL, &p, val->bv_len);
+ if( xcert == NULL ) goto done;
+
+ sn=X509_get_serialNumber(xcert);
+ if ( sn == NULL ) goto done;
+ serial=i2s_ASN1_INTEGER(0, sn );
+ if( serial == NULL ) goto done;
+ seriallen=strlen(serial);
+
+ name=X509_get_issuer_name(xcert);
+ if( name == NULL ) goto done;
+ rc = dnX509normalize( name, &issuer_dn );
+ if( rc != LDAP_SUCCESS ) goto done;
+
+ normalized->bv_len = seriallen + issuer_dn.bv_len + 1;
+ normalized->bv_val = ch_malloc(normalized->bv_len+1);
+ p = (unsigned char *)normalized->bv_val;
+ AC_MEMCPY(p, serial, seriallen);
+ p += seriallen;
+ *p++ = '$';
+ AC_MEMCPY(p, issuer_dn.bv_val, issuer_dn.bv_len);
+ p += issuer_dn.bv_len;
+ *p = '\0';
- if( SLAP_MR_IS_VALUE_OF_ASSERTION_SYNTAX( usage ) ) {
- rc = serialNumberAndIssuerNormalize( usage, syntax, mr,
- val, normalized, ctx );
+#ifdef NEW_LOGGING
+ LDAP_LOG( CONFIG, ARGS, "certificateExactNormalize: %s\n",
+ normalized->bv_val, 0, 0 );
+#else
+ Debug( LDAP_DEBUG_TRACE, "certificateExactNormalize: %s\n",
+ normalized->bv_val, NULL, NULL );
+#endif
- } else {
- rc = certificateExactConvert( val, normalized );
- }
+done:
+ if (xcert) X509_free(xcert);
+ if (serial) ch_free(serial);
+ if (issuer_dn.bv_val) ber_memfree(issuer_dn.bv_val);
return rc;
}
}
len = sizeof("YYYYmmddHHMMSSZ")-1 + fraction.bv_len;
- normalized->bv_val = sl_malloc( len + 1, ctx );
+ normalized->bv_val = slap_sl_malloc( len + 1, ctx );
if ( normalized->bv_val == NULL ) {
return LBER_ERROR_MEMORY;
}
return LDAP_SUCCESS;
}
+static int
+deliveryMethodValidate(
+ Syntax *syntax,
+ struct berval *val )
+{
+#undef LENOF
+#define LENOF(s) (sizeof(s)-1)
+ struct berval tmp = *val;
+ /*
+ * DeliveryMethod = pdm *( WSP DOLLAR WSP DeliveryMethod )
+ * pdm = "any" / "mhs" / "physical" / "telex" / "teletex" /
+ * "g3fax" / "g4fax" / "ia5" / "videotex" / "telephone"
+ */
+again:
+ if( tmp.bv_len < 3 ) return LDAP_INVALID_SYNTAX;
+
+ switch( tmp.bv_val[0] ) {
+ case 'a':
+ case 'A':
+ if(( tmp.bv_len >= LENOF("any") ) &&
+ ( strncasecmp(tmp.bv_val, "any", LENOF("any")) == 0 ))
+ {
+ tmp.bv_len -= LENOF("any");
+ tmp.bv_val += LENOF("any");
+ break;
+ }
+ return LDAP_INVALID_SYNTAX;
+
+ case 'm':
+ case 'M':
+ if(( tmp.bv_len >= LENOF("mhs") ) &&
+ ( strncasecmp(tmp.bv_val, "mhs", LENOF("mhs")) == 0 ))
+ {
+ tmp.bv_len -= LENOF("mhs");
+ tmp.bv_val += LENOF("mhs");
+ break;
+ }
+ return LDAP_INVALID_SYNTAX;
+
+ case 'p':
+ case 'P':
+ if(( tmp.bv_len >= LENOF("physical") ) &&
+ ( strncasecmp(tmp.bv_val, "physical", LENOF("physical")) == 0 ))
+ {
+ tmp.bv_len -= LENOF("physical");
+ tmp.bv_val += LENOF("physical");
+ break;
+ }
+ return LDAP_INVALID_SYNTAX;
+
+ case 't':
+ case 'T': /* telex or teletex or telephone */
+ if(( tmp.bv_len >= LENOF("telex") ) &&
+ ( strncasecmp(tmp.bv_val, "telex", LENOF("telex")) == 0 ))
+ {
+ tmp.bv_len -= LENOF("telex");
+ tmp.bv_val += LENOF("telex");
+ break;
+ }
+ if(( tmp.bv_len >= LENOF("teletex") ) &&
+ ( strncasecmp(tmp.bv_val, "teletex", LENOF("teletex")) == 0 ))
+ {
+ tmp.bv_len -= LENOF("teletex");
+ tmp.bv_val += LENOF("teletex");
+ break;
+ }
+ if(( tmp.bv_len >= LENOF("telephone") ) &&
+ ( strncasecmp(tmp.bv_val, "telephone", LENOF("telephone")) == 0 ))
+ {
+ tmp.bv_len -= LENOF("telephone");
+ tmp.bv_val += LENOF("telephone");
+ break;
+ }
+ return LDAP_INVALID_SYNTAX;
+
+ case 'g':
+ case 'G': /* g3fax or g4fax */
+ if(( tmp.bv_len >= LENOF("g3fax") ) && (
+ ( strncasecmp(tmp.bv_val, "g3fax", LENOF("g3fax")) == 0 ) ||
+ ( strncasecmp(tmp.bv_val, "g4fax", LENOF("g4fax")) == 0 )))
+ {
+ tmp.bv_len -= LENOF("g3fax");
+ tmp.bv_val += LENOF("g3fax");
+ break;
+ }
+ return LDAP_INVALID_SYNTAX;
+
+ case 'i':
+ case 'I':
+ if(( tmp.bv_len >= LENOF("ia5") ) &&
+ ( strncasecmp(tmp.bv_val, "ia5", LENOF("ia5")) == 0 ))
+ {
+ tmp.bv_len -= LENOF("ia5");
+ tmp.bv_val += LENOF("ia5");
+ break;
+ }
+ return LDAP_INVALID_SYNTAX;
+
+ case 'v':
+ case 'V':
+ if(( tmp.bv_len >= LENOF("videotex") ) &&
+ ( strncasecmp(tmp.bv_val, "videotex", LENOF("videotex")) == 0 ))
+ {
+ tmp.bv_len -= LENOF("videotex");
+ tmp.bv_val += LENOF("videotex");
+ break;
+ }
+ return LDAP_INVALID_SYNTAX;
+
+ default:
+ return LDAP_INVALID_SYNTAX;
+ }
+
+ if( tmp.bv_len == 0 ) return LDAP_SUCCESS;
+
+ while( tmp.bv_len && ( tmp.bv_val[0] == ' ' )) {
+ tmp.bv_len++;
+ tmp.bv_val--;
+ }
+ if( tmp.bv_len && ( tmp.bv_val[0] == '$' )) {
+ tmp.bv_len++;
+ tmp.bv_val--;
+ } else {
+ return LDAP_INVALID_SYNTAX;
+ }
+ while( tmp.bv_len && ( tmp.bv_val[0] == ' ' )) {
+ tmp.bv_len++;
+ tmp.bv_val--;
+ }
+
+ goto again;
+}
+
static int
nisNetgroupTripleValidate(
Syntax *syntax,
0, booleanValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.8 DESC 'Certificate' "
X_BINARY X_NOT_H_R ")",
- SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, berValidate, NULL},
+ SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, certificateValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.9 DESC 'Certificate List' "
X_BINARY X_NOT_H_R ")",
- SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, berValidate, NULL},
+ SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, sequenceValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.10 DESC 'Certificate Pair' "
X_BINARY X_NOT_H_R ")",
- SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, berValidate, NULL},
+ SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, sequenceValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.11 DESC 'Country String' )",
0, countryStringValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.12 DESC 'Distinguished Name' )",
{"( 1.3.6.1.4.1.1466.115.121.1.13 DESC 'Data Quality' )",
0, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.14 DESC 'Delivery Method' )",
- 0, NULL, NULL},
+ 0, deliveryMethodValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.15 DESC 'Directory String' )",
0, UTF8StringValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.16 DESC 'DIT Content Rule Description' )",
{"( 1.3.6.1.1.1.0.1 DESC 'RFC2307 Boot Parameter' )",
0, bootParameterValidate, NULL},
- /* From PKIX */
- /* These OIDs are not published yet, but will be in the next
- * I-D for PKIX LDAPv3 schema as have been advanced by David
- * Chadwick in private mail.
- */
- {"( 1.2.826.0.1.3344810.7.1 DESC 'Serial Number and Issuer' )",
- 0, serialNumberAndIssuerValidate, NULL},
+ /* From PKIX *//* This OID is not published yet. */
+ {"( 1.2.826.0.1.3344810.7.1 DESC 'Certificate Serial Number and Issuer' )",
+ SLAP_SYNTAX_HIDE,
+ serialNumberAndIssuerValidate,
+ serialNumberAndIssuerPretty},
- /* OpenLDAP Experimental Syntaxes */
#ifdef SLAPD_ACI_ENABLED
+ /* OpenLDAP Experimental Syntaxes */
{"( 1.3.6.1.4.1.4203.666.2.1 DESC 'OpenLDAP Experimental ACI' )",
SLAP_SYNTAX_HIDE,
UTF8StringValidate /* THIS WILL CHANGE FOR NEW ACI SYNTAX */,
SLAP_SYNTAX_HIDE, NULL, NULL},
#endif
+ {"( 1.3.6.1.4.1.4203.666.2.6 DESC 'UUID' )",
+ SLAP_SYNTAX_HIDE, UUIDValidate, NULL},
+
/* OpenLDAP Void Syntax */
{"( 1.3.6.1.4.1.4203.1.1.1 DESC 'OpenLDAP void' )" ,
SLAP_SYNTAX_HIDE, inValidate, NULL},
{NULL, 0, NULL, NULL}
};
-#ifdef HAVE_TLS
char *certificateExactMatchSyntaxes[] = {
"1.3.6.1.4.1.1466.115.121.1.8" /* certificate */,
NULL
};
-#endif
char *directoryStringSyntaxes[] = {
"1.3.6.1.4.1.1466.115.121.1.44" /* printableString */,
NULL
/*
* Other matching rules in X.520 that we do not use (yet):
*
- * 2.5.13.9 numericStringOrderingMatch
* 2.5.13.25 uTCTimeMatch
* 2.5.13.26 uTCTimeOrderingMatch
- * 2.5.13.31 directoryStringFirstComponentMatch
- * 2.5.13.32 wordMatch
- * 2.5.13.33 keywordMatch
- * 2.5.13.35 certificateMatch
+ * 2.5.13.31* directoryStringFirstComponentMatch
+ * 2.5.13.32* wordMatch
+ * 2.5.13.33* keywordMatch
* 2.5.13.36 certificatePairExactMatch
* 2.5.13.37 certificatePairMatch
* 2.5.13.38 certificateListExactMatch
* 2.5.13.39 certificateListMatch
* 2.5.13.40 algorithmIdentifierMatch
- * 2.5.13.41 storedPrefixMatch
+ * 2.5.13.41* storedPrefixMatch
* 2.5.13.42 attributeCertificateMatch
* 2.5.13.43 readerAndKeyIDMatch
* 2.5.13.44 attributeIntegrityMatch
+ *
+ * (*) described in RFC 3698 (LDAP: Additional Matching Rules)
*/
static slap_mrule_defs_rec mrule_defs[] = {
/*
{"( 2.5.13.4 NAME 'caseIgnoreSubstringsMatch' "
"SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )",
- SLAP_MR_SUBSTR, NULL,
+ SLAP_MR_SUBSTR, directoryStringSyntaxes,
NULL, UTF8StringNormalize, octetStringSubstringsMatch,
octetStringSubstringsIndexer, octetStringSubstringsFilter,
"caseIgnoreMatch" },
{"( 2.5.13.8 NAME 'numericStringMatch' "
"SYNTAX 1.3.6.1.4.1.1466.115.121.1.36 )",
SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
- NULL, numericStringNormalize, octetStringSubstringsMatch,
- octetStringSubstringsIndexer, octetStringSubstringsFilter,
+ NULL, numericStringNormalize, octetStringMatch,
+ octetStringIndexer, octetStringFilter,
NULL },
+ {"( 2.5.13.9 NAME 'numericStringOrderingMatch' "
+ "SYNTAX 1.3.6.1.4.1.1466.115.121.1.36 )",
+ SLAP_MR_ORDERING, NULL,
+ NULL, numericStringNormalize, octetStringOrderingMatch,
+ NULL, NULL,
+ "numericStringMatch" },
+
{"( 2.5.13.10 NAME 'numericStringSubstringsMatch' "
"SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )",
SLAP_MR_SUBSTR, NULL,
octetStringIndexer, octetStringFilter,
NULL },
-#ifdef HAVE_TLS
{"( 2.5.13.34 NAME 'certificateExactMatch' "
"SYNTAX 1.2.826.0.1.3344810.7.1 )",
SLAP_MR_EQUALITY | SLAP_MR_EXT, certificateExactMatchSyntaxes,
+#ifdef HAVE_TLS
NULL, certificateExactNormalize, octetStringMatch,
octetStringIndexer, octetStringFilter,
+#else
+ NULL, NULL, NULL, NULL, NULL,
+#endif
NULL },
+
+ {"( 2.5.13.35 NAME 'certificateMatch' "
+ "SYNTAX 1.3.6.1.4.1.1466.115.121.1.8 )",
+ SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
+#ifdef HAVE_TLS
+ NULL, NULL, octetStringMatch,
+ octetStringIndexer, octetStringFilter,
+#else
+ NULL, NULL, NULL, NULL, NULL,
#endif
+ NULL },
{"( 1.3.6.1.4.1.1466.109.114.1 NAME 'caseExactIA5Match' "
"SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )",
NULL, NULL,
"integerMatch" },
+ {"( 1.3.6.1.4.1.4203.666.4.6 NAME 'UUIDMatch' "
+ "SYNTAX 1.3.6.1.4.1.4203.666.2.6 )",
+ SLAP_MR_HIDE | SLAP_MR_EQUALITY, NULL,
+ NULL, UUIDNormalize, octetStringMatch,
+ octetStringIndexer, octetStringFilter,
+ NULL},
+
+ {"( 1.3.6.1.4.1.4203.666.4.7 NAME 'UUIDOrderingMatch' "
+ "SYNTAX 1.3.6.1.4.1.4203.666.2.6 )",
+ SLAP_MR_HIDE | SLAP_MR_ORDERING, NULL,
+ NULL, UUIDNormalize, octetStringOrderingMatch,
+ octetStringIndexer, octetStringFilter,
+ "UUIDMatch"},
+
{NULL, SLAP_MR_NONE, NULL,
NULL, NULL, NULL, NULL, NULL,
NULL }