ITS#7746 fix for cert with NULL issuerDN

[openldap] / servers / slapd / schema_init.c

diff --git a/servers/slapd/schema_init.c b/servers/slapd/schema_init.c
index 080bd6a7add89b4e5a645c9ed8efa091d455e3c8..d4f5024b305be56a9a5f9be15f162fe580727455 100644 (file)
--- a/servers/slapd/schema_init.c
+++ b/servers/slapd/schema_init.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2012 The OpenLDAP Foundation.
+ * Copyright 1998-2013 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -105,12 +105,57 @@
 
 #include "lutil.h"
 #include "lutil_hash.h"
+
+#ifdef LUTIL_HASH64_BYTES
+#define HASH_BYTES                             LUTIL_HASH64_BYTES
+#define HASH_LEN       hashlen
+static void (*hashinit)(lutil_HASH_CTX *ctx) = lutil_HASHInit;
+static void (*hashupdate)(lutil_HASH_CTX *ctx,unsigned char const *buf, ber_len_t len) = lutil_HASHUpdate;
+static void (*hashfinal)(unsigned char digest[HASH_BYTES], lutil_HASH_CTX *ctx) = lutil_HASHFinal;
+static int hashlen = LUTIL_HASH_BYTES;
+#define HASH_Init(c)                   hashinit(c)
+#define HASH_Update(c,buf,len) hashupdate(c,buf,len)
+#define HASH_Final(d,c)                        hashfinal(d,c)
+
+/* Toggle between 32 and 64 bit hashing, default to 32 for compatibility
+   -1 to query, returns 1 if 64 bit, 0 if 32.
+   0/1 to set 32/64, returns 0 on success, -1 on failure */
+int slap_hash64( int onoff )
+{
+       if ( onoff < 0 ) {
+               return hashlen == LUTIL_HASH64_BYTES;
+       } else if ( onoff ) {
+               hashinit = lutil_HASH64Init;
+               hashupdate = lutil_HASH64Update;
+               hashfinal = lutil_HASH64Final;
+               hashlen = LUTIL_HASH64_BYTES;
+       } else {
+               hashinit = lutil_HASHInit;
+               hashupdate = lutil_HASHUpdate;
+               hashfinal = lutil_HASHFinal;
+               hashlen = LUTIL_HASH_BYTES;
+       }
+       return 0;
+}
+
+#else
 #define HASH_BYTES                             LUTIL_HASH_BYTES
-#define HASH_CONTEXT                   lutil_HASH_CTX
+#define HASH_LEN                               HASH_BYTES
 #define HASH_Init(c)                   lutil_HASHInit(c)
 #define HASH_Update(c,buf,len) lutil_HASHUpdate(c,buf,len)
 #define HASH_Final(d,c)                        lutil_HASHFinal(d,c)
 
+int slap_has64( int onoff )
+{
+       if ( onoff < 0 )
+               return 0;
+       else
+               return onoff ? -1 : 0;
+}
+
+#endif
+#define HASH_CONTEXT                   lutil_HASH_CTX
+
 /* approx matching rules */
 #define directoryStringApproxMatchOID  "1.3.6.1.4.1.4203.666.4.4"
 #define directoryStringApproxMatch             approxMatch
@@ -647,7 +692,7 @@ int octetStringIndexer(
        unsigned char HASHdigest[HASH_BYTES];
        struct berval digest;
        digest.bv_val = (char *)HASHdigest;
-       digest.bv_len = sizeof(HASHdigest);
+       digest.bv_len = HASH_LEN;
 
        for( i=0; !BER_BVISNULL( &values[i] ); i++ ) {
                /* just count them */
@@ -693,7 +738,7 @@ int octetStringFilter(
        struct berval *value = (struct berval *) assertedValue;
        struct berval digest;
        digest.bv_val = (char *)HASHdigest;
-       digest.bv_len = sizeof(HASHdigest);
+       digest.bv_len = HASH_LEN;
 
        slen = syntax->ssyn_oidlen;
        mlen = mr->smr_oidlen;
@@ -856,7 +901,7 @@ octetStringSubstringsIndexer(
        unsigned char HASHdigest[HASH_BYTES];
        struct berval digest;
        digest.bv_val = (char *)HASHdigest;
-       digest.bv_len = sizeof(HASHdigest);
+       digest.bv_len = HASH_LEN;
 
        nkeys = 0;
 
@@ -1021,7 +1066,7 @@ octetStringSubstringsFilter (
        }
 
        digest.bv_val = (char *)HASHdigest;
-       digest.bv_len = sizeof(HASHdigest);
+       digest.bv_len = HASH_LEN;
 
        slen = syntax->ssyn_oidlen;
        mlen = mr->smr_oidlen;
@@ -3668,12 +3713,14 @@ certificateExactNormalize(
        tag = ber_skip_tag( ber, &len );        /* SignatureAlg */
        ber_skip_data( ber, len );
        tag = ber_peek_tag( ber, &len );        /* IssuerDN */
-       len = ber_ptrlen( ber );
-       bvdn.bv_val = val->bv_val + len;
-       bvdn.bv_len = val->bv_len - len;
+       if ( len ) {
+               len = ber_ptrlen( ber );
+               bvdn.bv_val = val->bv_val + len;
+               bvdn.bv_len = val->bv_len - len;
 
-       rc = dnX509normalize( &bvdn, &issuer_dn );
-       if ( rc != LDAP_SUCCESS ) goto done;
+               rc = dnX509normalize( &bvdn, &issuer_dn );
+               if ( rc != LDAP_SUCCESS ) goto done;
+       }
 
        normalized->bv_len = STRLENOF( "{ serialNumber , issuer rdnSequence:\"\" }" )
                + sn2.bv_len + issuer_dn.bv_len;
@@ -6339,7 +6386,9 @@ char *componentFilterMatchSyntaxes[] = {
 #endif
 
 char *directoryStringSyntaxes[] = {
+       "1.3.6.1.4.1.1466.115.121.1.11" /* countryString */,
        "1.3.6.1.4.1.1466.115.121.1.44" /* printableString */,
+       "1.3.6.1.4.1.1466.115.121.1.50" /* telephoneNumber */,
        NULL
 };
 char *integerFirstComponentMatchSyntaxes[] = {