X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fbconfig.c;h=6efd2d2df6aeacb80cdbee6ba6c32f8ddfa3cd7f;hb=7684514535dbe9f407b420bab76f06861ad7587d;hp=1c8af46e89ba6bd030b554a24b34e1af04de8088;hpb=4ebed09d81ec07faeb78b5da8946624cc825257f;p=openldap diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c index 1c8af46e89..6efd2d2df6 100644 --- a/servers/slapd/bconfig.c +++ b/servers/slapd/bconfig.c @@ -2,7 +2,7 @@ /* $OpenLDAP$ */ /* This work is part of OpenLDAP Software . * - * Copyright 2005 The OpenLDAP Foundation. + * Copyright 2005-2006 The OpenLDAP Foundation. * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -37,10 +37,13 @@ #include "config.h" -static struct berval config_rdn = BER_BVC("cn=config"); -static struct berval schema_rdn = BER_BVC("cn=schema"); +#define CONFIG_RDN "cn=config" +#define SCHEMA_RDN "cn=schema" -#define IFMT "{%d}" +static struct berval config_rdn = BER_BVC(CONFIG_RDN); +static struct berval schema_rdn = BER_BVC(SCHEMA_RDN); + +extern int slap_DN_strict; /* dn.c */ #ifdef SLAPD_MODULES typedef struct modpath_s { @@ -71,11 +74,7 @@ typedef struct { int cb_use_ldif; } CfBackInfo; -/* These do nothing in slapd, they're kept only to make them - * editable here. - */ -static char *replica_pidFile, *replica_argsFile; -static int replicationInterval; +static CfBackInfo cfBackInfo; static char *passwd_salt; static char *logfileName; @@ -87,14 +86,24 @@ static struct berval cfdir; /* Private state */ static AttributeDescription *cfAd_backend, *cfAd_database, *cfAd_overlay, - *cfAd_include; + *cfAd_include, *cfAd_attr, *cfAd_oc, *cfAd_om; static ConfigFile *cfn; static Avlnode *CfOcTree; +/* System schema state */ +extern AttributeType *at_sys_tail; /* at.c */ +extern ObjectClass *oc_sys_tail; /* oc.c */ +extern OidMacro *om_sys_tail; /* oidm.c */ +static AttributeType *cf_at_tail; +static ObjectClass *cf_oc_tail; +static OidMacro *cf_om_tail; + static int config_add_internal( CfBackInfo *cfb, Entry *e, ConfigArgs *ca, - SlapReply *rs, int *renumber ); + SlapReply *rs, int *renumber, Operation *op ); + +static int config_check_schema( CfBackInfo *cfb ); static ConfigDriver config_fname; static ConfigDriver config_cfdir; @@ -151,6 +160,9 @@ enum { CFG_DIT, CFG_ATTR, CFG_ATOPT, + CFG_REPLICA_ARGSFILE, + CFG_REPLICA_PIDFILE, + CFG_REPLICATIONINTERVAL, CFG_REPLOG, CFG_ROOTDSE, CFG_LOGFILE, @@ -164,6 +176,9 @@ enum { CFG_SSTR_IF_MAX, CFG_SSTR_IF_MIN, CFG_TTHREADS, + CFG_MIRRORMODE, + CFG_HIDDEN, + CFG_MONITORING, CFG_LAST }; @@ -186,19 +201,43 @@ static OidRec OidMacros[] = { { "OLcfgDbOc", "OLcfgOc:2" }, { "OLcfgOvOc", "OLcfgOc:3" }, { "OMsyn", "1.3.6.1.4.1.1466.115.121.1" }, - { "OMsInteger", "OMsyn:27" }, { "OMsBoolean", "OMsyn:7" }, { "OMsDN", "OMsyn:12" }, { "OMsDirectoryString", "OMsyn:15" }, + { "OMsInteger", "OMsyn:27" }, + { "OMsOID", "OMsyn:38" }, { "OMsOctetString", "OMsyn:40" }, { NULL, NULL } }; /* + * Backend/Database registry + * * OLcfg{Bk|Db}{Oc|At}:0 -> common - * OLcfg{Bk|Db}{Oc|At}:1 -> bdb - * OLcfg{Bk|Db}{Oc|At}:2 -> ldif - * OLcfg{Bk|Db}{Oc|At}:3 -> ldap? + * OLcfg{Bk|Db}{Oc|At}:1 -> back-bdb(/back-hdb) + * OLcfg{Bk|Db}{Oc|At}:2 -> back-ldif + * OLcfg{Bk|Db}{Oc|At}:3 -> back-ldap + */ + +/* + * Overlay registry + * + * OLcfgOv{Oc|At}:1 -> syncprov + * OLcfgOv{Oc|At}:2 -> pcache + * OLcfgOv{Oc|At}:3 -> chain + * OLcfgOv{Oc|At}:4 -> accesslog + * OLcfgOv{Oc|At}:5 -> valsort + * (FIXME: separate arc for contribware?) + * OLcfgOv{Oc|At}:6 -> smbk5pwd + * OLcfgOv{Oc|At}:7 -> distproc + * OLcfgOv{Oc|At}:8 -> dynlist + * OLcfgOv{Oc|At}:9 -> dds + * OLcfgOv{Oc|At}:10 -> unique + * OLcfgOv{Oc|At}:11 -> refint + * OLcfgOv{Oc|At}:12 -> ppolicy + * OLcfgOv{Oc|At}:13 -> constraint + * OLcfgOv{Oc|At}:14 -> translucent + * OLcfgOv{Oc|At}:15 -> auditlog */ /* alphabetical ordering */ @@ -234,8 +273,8 @@ static ConfigTable config_back_cf_table[] = { &config_generic, "( OLcfgGlAt:5 NAME 'olcAttributeOptions' " "EQUALITY caseIgnoreMatch " "SYNTAX OMsDirectoryString )", NULL, NULL }, - { "attribute", "attribute", 2, 0, 9, - ARG_PAREN|ARG_MAGIC|CFG_ATTR|ARG_NO_DELETE|ARG_NO_INSERT, + { "attribute", "attribute", 2, 0, STRLENOF( "attribute" ), + ARG_PAREN|ARG_MAGIC|CFG_ATTR, &config_generic, "( OLcfgGlAt:4 NAME 'olcAttributeTypes' " "DESC 'OpenLDAP attributeTypes' " "EQUALITY caseIgnoreMatch " @@ -298,6 +337,9 @@ static ConfigTable config_back_cf_table[] = { #endif "( OLcfgGlAt:17 NAME 'olcGentleHUP' " "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL }, + { "hidden", "on|off", 2, 2, 0, ARG_DB|ARG_ON_OFF|ARG_MAGIC|CFG_HIDDEN, + &config_generic, "( OLcfgDbAt:0.17 NAME 'olcHidden' " + "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL }, { "idletimeout", "timeout", 2, 2, 0, ARG_INT, &global_idletimeout, "( OLcfgGlAt:18 NAME 'olcIdleTimeout' " "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL }, @@ -321,6 +363,7 @@ static ConfigTable config_back_cf_table[] = { "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL }, { "limits", "limits", 2, 0, 0, ARG_DB|ARG_MAGIC|CFG_LIMITS, &config_generic, "( OLcfgDbAt:0.5 NAME 'olcLimits' " + "EQUALITY caseIgnoreMatch " "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL }, { "localSSF", "ssf", 2, 2, 0, ARG_INT, &local_ssf, "( OLcfgGlAt:26 NAME 'olcLocalSSF' " @@ -330,10 +373,14 @@ static ConfigTable config_back_cf_table[] = { "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, { "loglevel", "level", 2, 0, 0, ARG_MAGIC, &config_loglevel, "( OLcfgGlAt:28 NAME 'olcLogLevel' " + "EQUALITY caseIgnoreMatch " "SYNTAX OMsDirectoryString )", NULL, NULL }, { "maxDerefDepth", "depth", 2, 2, 0, ARG_DB|ARG_INT|ARG_MAGIC|CFG_DEPTH, &config_generic, "( OLcfgDbAt:0.6 NAME 'olcMaxDerefDepth' " "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL }, + { "mirrormode", "on|off", 2, 2, 0, ARG_DB|ARG_ON_OFF|ARG_MAGIC|CFG_MIRRORMODE, + &config_generic, "( OLcfgDbAt:0.16 NAME 'olcMirrorMode' " + "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL }, { "moduleload", "file", 2, 0, 0, #ifdef SLAPD_MODULES ARG_MAGIC|CFG_MODLOAD, &config_generic, @@ -341,6 +388,7 @@ static ConfigTable config_back_cf_table[] = { ARG_IGNORED, NULL, #endif "( OLcfgGlAt:30 NAME 'olcModuleLoad' " + "EQUALITY caseIgnoreMatch " "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL }, { "modulepath", "path", 2, 2, 0, #ifdef SLAPD_MODULES @@ -350,14 +398,19 @@ static ConfigTable config_back_cf_table[] = { #endif "( OLcfgGlAt:31 NAME 'olcModulePath' " "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, - { "objectclass", "objectclass", 2, 0, 0, ARG_PAREN|ARG_MAGIC|CFG_OC|ARG_NO_DELETE|ARG_NO_INSERT, + { "monitoring", "TRUE|FALSE", 2, 2, 0, + ARG_MAGIC|CFG_MONITORING|ARG_DB|ARG_ON_OFF, &config_generic, + "( OLcfgDbAt:0.18 NAME 'olcMonitoring' " + "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL }, + { "objectclass", "objectclass", 2, 0, 0, ARG_PAREN|ARG_MAGIC|CFG_OC, &config_generic, "( OLcfgGlAt:32 NAME 'olcObjectClasses' " "DESC 'OpenLDAP object classes' " "EQUALITY caseIgnoreMatch " "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL }, - { "objectidentifier", NULL, 0, 0, 0, ARG_MAGIC|CFG_OID, + { "objectidentifier", "name> op == SLAP_CONFIG_EMIT ) { @@ -721,9 +789,16 @@ config_generic(ConfigArgs *c) { int i; for ( i=0; c->be->be_limits[i]; i++ ) { - bv.bv_len = sprintf( buf, IFMT, i ); - bv.bv_val = buf+bv.bv_len; - limits_unparse( c->be->be_limits[i], &bv ); + bv.bv_len = snprintf( buf, sizeof( buf ), SLAP_X_ORDERED_FMT, i ); + if ( bv.bv_len >= sizeof( buf ) ) { + ber_bvarray_free_x( c->rvalue_vals, NULL ); + c->rvalue_vals = NULL; + rc = 1; + break; + } + bv.bv_val = buf + bv.bv_len; + limits_unparse( c->be->be_limits[i], &bv, + sizeof( buf ) - ( bv.bv_val - buf ) ); bv.bv_len += bv.bv_val - buf; bv.bv_val = buf; value_add_one( &c->rvalue_vals, &bv ); @@ -757,6 +832,13 @@ config_generic(ConfigArgs *c) { case CFG_DEPTH: c->value_int = c->be->be_max_deref_depth; break; + case CFG_HIDDEN: + if ( SLAP_DBHIDDEN( c->be )) { + c->value_int = 1; + } else { + rc = 1; + } + break; case CFG_OID: { ConfigFile *cf = c->private; if ( !cf ) @@ -768,6 +850,9 @@ config_generic(ConfigArgs *c) { rc = 1; } break; + case CFG_ATOPT: + ad_unparse_options( &c->rvalue_vals ); + break; case CFG_OC: { ConfigFile *cf = c->private; if ( !cf ) @@ -807,13 +892,19 @@ config_generic(ConfigArgs *c) { char *src, *dst, ibuf[11]; struct berval bv, abv; for (i=0, a=c->be->be_acl; a; i++,a=a->acl_next) { - abv.bv_len = sprintf( ibuf, IFMT, i ); + abv.bv_len = snprintf( ibuf, sizeof( ibuf ), SLAP_X_ORDERED_FMT, i ); + if ( abv.bv_len >= sizeof( ibuf ) ) { + ber_bvarray_free_x( c->rvalue_vals, NULL ); + c->rvalue_vals = NULL; + i = 0; + break; + } acl_unparse( a, &bv ); abv.bv_val = ch_malloc( abv.bv_len + bv.bv_len + 1 ); AC_MEMCPY( abv.bv_val, ibuf, abv.bv_len ); /* Turn TAB / EOL into plain space */ for (src=bv.bv_val,dst=abv.bv_val+abv.bv_len; *src; src++) { - if (isspace(*src)) *dst++ = ' '; + if (isspace((unsigned char)*src)) *dst++ = ' '; else *dst++ = *src; } *dst = '\0'; @@ -827,6 +918,21 @@ config_generic(ConfigArgs *c) { rc = (!i); break; } + case CFG_REPLICA_ARGSFILE: + if ( c->be->be_replica_argsfile ) + c->value_string = ch_strdup( c->be->be_replica_argsfile ); + break; + case CFG_REPLICA_PIDFILE: + if ( c->be->be_replica_pidfile ) + c->value_string = ch_strdup( c->be->be_replica_pidfile ); + break; + case CFG_REPLICATIONINTERVAL: + if ( c->be->be_replicationinterval > 0 ) { + c->value_int = c->be->be_replicationinterval; + } else { + rc = 1; + } + break; case CFG_REPLOG: if ( c->be->be_replogfile ) c->value_string = ch_strdup( c->be->be_replogfile ); @@ -849,6 +955,15 @@ config_generic(ConfigArgs *c) { case CFG_LASTMOD: c->value_int = (SLAP_NOLASTMOD(c->be) == 0); break; + case CFG_MIRRORMODE: + if ( SLAP_SHADOW(c->be)) + c->value_int = (SLAP_SINGLE_SHADOW(c->be) == 0); + else + rc = 1; + break; + case CFG_MONITORING: + c->value_int = (SLAP_DBMONITORING(c->be) != 0); + break; case CFG_SSTR_IF_MAX: c->value_int = index_substr_if_maxlen; break; @@ -863,8 +978,14 @@ config_generic(ConfigArgs *c) { for (i=0; !BER_BVISNULL(&mp->mp_loads[i]); i++) { struct berval bv; bv.bv_val = c->log; - bv.bv_len = sprintf( bv.bv_val, IFMT "%s", i, + bv.bv_len = snprintf( bv.bv_val, sizeof( c->log ), + SLAP_X_ORDERED_FMT "%s", i, mp->mp_loads[i].bv_val ); + if ( bv.bv_len >= sizeof( c->log ) ) { + ber_bvarray_free_x( c->rvalue_vals, NULL ); + c->rvalue_vals = NULL; + break; + } value_add_one( &c->rvalue_vals, &bv ); } } @@ -896,11 +1017,18 @@ config_generic(ConfigArgs *c) { idx.bv_val = ibuf; for ( i=0; !BER_BVISNULL( &authz_rewrites[i] ); i++ ) { - idx.bv_len = sprintf( idx.bv_val, IFMT, i ); + idx.bv_len = snprintf( idx.bv_val, sizeof( ibuf ), SLAP_X_ORDERED_FMT, i ); + if ( idx.bv_len >= sizeof( ibuf ) ) { + ber_bvarray_free_x( c->rvalue_vals, NULL ); + c->rvalue_vals = NULL; + break; + } bv.bv_len = idx.bv_len + authz_rewrites[i].bv_len; bv.bv_val = ch_malloc( bv.bv_len + 1 ); - strcpy( bv.bv_val, idx.bv_val ); - strcpy( bv.bv_val+idx.bv_len, authz_rewrites[i].bv_val ); + AC_MEMCPY( bv.bv_val, idx.bv_val, idx.bv_len ); + AC_MEMCPY( &bv.bv_val[ idx.bv_len ], + authz_rewrites[i].bv_val, + authz_rewrites[i].bv_len + 1 ); ber_bvarray_add( &c->rvalue_vals, &bv ); } } @@ -922,6 +1050,8 @@ config_generic(ConfigArgs *c) { case CFG_AZPOLICY: case CFG_DEPTH: case CFG_LASTMOD: + case CFG_MIRRORMODE: + case CFG_MONITORING: case CFG_SASLSECP: case CFG_SSTR_IF_MAX: case CFG_SSTR_IF_MIN: @@ -932,7 +1062,7 @@ config_generic(ConfigArgs *c) { case CFG_MODLOAD: case CFG_AZREGEXP: case CFG_REWRITE: - sprintf(c->log, "change requires slapd restart"); + snprintf(c->log, sizeof( c->log ), "change requires slapd restart"); break; case CFG_SALT: @@ -940,6 +1070,20 @@ config_generic(ConfigArgs *c) { passwd_salt = NULL; break; + case CFG_REPLICA_ARGSFILE: + ch_free( c->be->be_replica_argsfile ); + c->be->be_replica_argsfile = NULL; + break; + + case CFG_REPLICA_PIDFILE: + ch_free( c->be->be_replica_pidfile ); + c->be->be_replica_pidfile = NULL; + break; + + case CFG_REPLICATIONINTERVAL: + c->be->be_replicationinterval = 0; + break; + case CFG_REPLOG: ch_free( c->be->be_replogfile ); c->be->be_replogfile = NULL; @@ -950,6 +1094,10 @@ config_generic(ConfigArgs *c) { logfileName = NULL; break; + case CFG_HIDDEN: + c->be->be_flags &= ~SLAP_DBFLAG_HIDDEN; + break; + case CFG_ACL: if ( c->valx < 0 ) { AccessControl *end; @@ -958,6 +1106,8 @@ config_generic(ConfigArgs *c) { else end = frontendDB->be_acl; acl_destroy( c->be->be_acl, end ); + c->be->be_acl = end; + } else { AccessControl **prev, *a; int i; @@ -972,6 +1122,76 @@ config_generic(ConfigArgs *c) { } break; + case CFG_OC: { + CfEntryInfo *ce = c->ca_entry->e_private; + /* can't modify the hardcoded schema */ + if ( ce->ce_parent->ce_type == Cft_Global ) + return 1; + } + cfn = c->private; + if ( c->valx < 0 ) { + ObjectClass *oc; + + for( oc = cfn->c_oc_head; oc; oc_next( &oc )) { + oc_delete( oc ); + if ( oc == cfn->c_oc_tail ) + break; + } + cfn->c_oc_head = cfn->c_oc_tail = NULL; + } else { + ObjectClass *oc, *prev = NULL; + int i; + + for ( i=0, oc=cfn->c_oc_head; ivalx; i++) { + prev = oc; + oc_next( &oc ); + } + oc_delete( oc ); + if ( cfn->c_oc_tail == oc ) { + cfn->c_oc_tail = prev; + } + if ( cfn->c_oc_head == oc ) { + oc_next( &oc ); + cfn->c_oc_head = oc; + } + } + break; + + case CFG_ATTR: { + CfEntryInfo *ce = c->ca_entry->e_private; + /* can't modify the hardcoded schema */ + if ( ce->ce_parent->ce_type == Cft_Global ) + return 1; + } + cfn = c->private; + if ( c->valx < 0 ) { + AttributeType *at; + + for( at = cfn->c_at_head; at; at_next( &at )) { + at_delete( at ); + if ( at == cfn->c_at_tail ) + break; + } + cfn->c_at_head = cfn->c_at_tail = NULL; + } else { + AttributeType *at, *prev = NULL; + int i; + + for ( i=0, at=cfn->c_at_head; ivalx; i++) { + prev = at; + at_next( &at ); + } + at_delete( at ); + if ( cfn->c_at_tail == at ) { + cfn->c_at_tail = prev; + } + if ( cfn->c_at_head == at ) { + at_next( &at ); + cfn->c_at_head = at; + } + } + break; + case CFG_LIMITS: /* FIXME: there is no limits_free function */ case CFG_ATOPT: @@ -980,9 +1200,7 @@ config_generic(ConfigArgs *c) { /* FIXME: there is no way to remove attributes added by a DSE file */ case CFG_OID: - case CFG_OC: case CFG_DIT: - case CFG_ATTR: case CFG_MODPATH: default: rc = 1; @@ -991,12 +1209,10 @@ config_generic(ConfigArgs *c) { return rc; } - p = strchr(c->line,'(' /*')'*/); - switch(c->type) { case CFG_BACKEND: if(!(c->bi = backend_info(c->argv[1]))) { - sprintf( c->msg, "<%s> failed init", c->argv[0] ); + snprintf( c->msg, sizeof( c->msg ), "<%s> failed init", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s (%s)!\n", c->log, c->msg, c->argv[1] ); return(1); @@ -1012,9 +1228,9 @@ config_generic(ConfigArgs *c) { } else if ( !strcasecmp( c->argv[1], "frontend" )) { c->be = frontendDB; } else { - c->be = backend_db_init(c->argv[1]); + c->be = backend_db_init(c->argv[1], NULL); if ( !c->be ) { - sprintf( c->msg, "<%s> failed init", c->argv[0] ); + snprintf( c->msg, sizeof( c->msg ), "<%s> failed init", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s (%s)!\n", c->log, c->msg, c->argv[1] ); return(1); @@ -1027,12 +1243,29 @@ config_generic(ConfigArgs *c) { break; case CFG_THREADS: - ldap_pvt_thread_pool_maxthreads(&connection_pool, c->value_int); + if ( c->value_int < 2 ) { + snprintf( c->msg, sizeof( c->msg ), + "threads=%d smaller than minimum value 2", + c->value_int ); + Debug(LDAP_DEBUG_ANY, "%s: %s.\n", + c->log, c->msg, 0 ); + return 1; + + } else if ( c->value_int > 2 * SLAP_MAX_WORKER_THREADS ) { + snprintf( c->msg, sizeof( c->msg ), + "warning, threads=%d larger than twice the default (2*%d=%d); YMMV", + c->value_int, SLAP_MAX_WORKER_THREADS, 2 * SLAP_MAX_WORKER_THREADS ); + Debug(LDAP_DEBUG_ANY, "%s: %s.\n", + c->log, c->msg, 0 ); + } + if ( slapMode & SLAP_SERVER_MODE ) + ldap_pvt_thread_pool_maxthreads(&connection_pool, c->value_int); connection_pool_max = c->value_int; /* save for reference */ break; case CFG_TTHREADS: - ldap_pvt_thread_pool_maxthreads(&connection_pool, c->value_int); + if ( slapMode & SLAP_TOOL_MODE ) + ldap_pvt_thread_pool_maxthreads(&connection_pool, c->value_int); slap_tool_thread_max = c->value_int; /* save for reference */ break; @@ -1057,7 +1290,7 @@ config_generic(ConfigArgs *c) { case CFG_AZPOLICY: ch_free(c->value_string); if (slap_sasl_setpolicy( c->argv[1] )) { - sprintf( c->msg, "<%s> unable to parse value", c->argv[0] ); + snprintf( c->msg, sizeof( c->msg ), "<%s> unable to parse value", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s \"%s\"\n", c->log, c->msg, c->argv[1] ); return(1); @@ -1090,7 +1323,9 @@ config_generic(ConfigArgs *c) { case CFG_OID: { OidMacro *om; - if(parse_oidm(c->fname, c->lineno, c->argc, c->argv, 1, &om)) + if ( c->op == LDAP_MOD_ADD && c->private && cfn != c->private ) + cfn = c->private; + if(parse_oidm(c, 1, &om)) return(1); if (!cfn->c_om_head) cfn->c_om_head = om; cfn->c_om_tail = om; @@ -1098,29 +1333,77 @@ config_generic(ConfigArgs *c) { break; case CFG_OC: { - ObjectClass *oc; + ObjectClass *oc, *prev; - if(parse_oc(c->fname, c->lineno, p, c->argv, &oc)) return(1); + if ( c->op == LDAP_MOD_ADD && c->private && cfn != c->private ) + cfn = c->private; + if ( c->valx < 0 ) { + prev = cfn->c_oc_tail; + } else { + prev = NULL; + /* If adding anything after the first, prev is easy */ + if ( c->valx ) { + int i; + for (i=0, oc = cfn->c_oc_head; ivalx; i++) { + prev = oc; + oc_next( &oc ); + } + } else + /* If adding the first, and head exists, find its prev */ + if (cfn->c_oc_head) { + for ( oc_start( &oc ); oc != cfn->c_oc_head; ) { + prev = oc; + oc_next( &oc ); + } + } + /* else prev is NULL, append to end of global list */ + } + if(parse_oc(c, &oc, prev)) return(1); if (!cfn->c_oc_head) cfn->c_oc_head = oc; - cfn->c_oc_tail = oc; + if (cfn->c_oc_tail == prev) cfn->c_oc_tail = oc; } break; - case CFG_DIT: { - ContentRule *cr; + case CFG_ATTR: { + AttributeType *at, *prev; - if(parse_cr(c->fname, c->lineno, p, c->argv, &cr)) return(1); - if (!cfn->c_cr_head) cfn->c_cr_head = cr; - cfn->c_cr_tail = cr; + if ( c->op == LDAP_MOD_ADD && c->private && cfn != c->private ) + cfn = c->private; + if ( c->valx < 0 ) { + prev = cfn->c_at_tail; + } else { + prev = NULL; + /* If adding anything after the first, prev is easy */ + if ( c->valx ) { + int i; + for (i=0, at = cfn->c_at_head; ivalx; i++) { + prev = at; + at_next( &at ); + } + } else + /* If adding the first, and head exists, find its prev */ + if (cfn->c_at_head) { + for ( at_start( &at ); at != cfn->c_at_head; ) { + prev = at; + at_next( &at ); + } + } + /* else prev is NULL, append to end of global list */ + } + if(parse_at(c, &at, prev)) return(1); + if (!cfn->c_at_head) cfn->c_at_head = at; + if (cfn->c_at_tail == prev) cfn->c_at_tail = at; } break; - case CFG_ATTR: { - AttributeType *at; + case CFG_DIT: { + ContentRule *cr; - if(parse_at(c->fname, c->lineno, p, c->argv, &at)) return(1); - if (!cfn->c_at_head) cfn->c_at_head = at; - cfn->c_at_tail = at; + if ( c->op == LDAP_MOD_ADD && c->private && cfn != c->private ) + cfn = c->private; + if(parse_cr(c, &cr)) return(1); + if (!cfn->c_cr_head) cfn->c_cr_head = cr; + cfn->c_cr_tail = cr; } break; @@ -1132,7 +1415,75 @@ config_generic(ConfigArgs *c) { break; case CFG_ACL: - parse_acl(c->be, c->fname, c->lineno, c->argc, c->argv, c->valx); + /* Don't append to the global ACL if we're on a specific DB */ + i = c->valx; + if ( c->be != frontendDB && frontendDB->be_acl && c->valx == -1 ) { + AccessControl *a; + i = 0; + for ( a=c->be->be_acl; a && a != frontendDB->be_acl; + a = a->acl_next ) + i++; + } + if ( parse_acl(c->be, c->fname, c->lineno, c->argc, c->argv, i ) ) { + return 1; + } + break; + + case CFG_REPLICA_ARGSFILE: + if(SLAP_MONITOR(c->be)) { + Debug(LDAP_DEBUG_ANY, "%s: " + "\"replica-argsfile\" should not be used " + "inside monitor database\n", + c->log, 0, 0); + /* FIXME: should this be an error? */ + return(0); + } + + if ( c->be->be_replica_argsfile != NULL ) { + /* FIXME: error? */ + Debug(LDAP_DEBUG_ANY, "%s: " + "\"replica-argsfile\" already provided; " + "replacing \"%s\" with \"%s\".\n", + c->log, c->be->be_replica_argsfile, c->value_string ); + ch_free( c->be->be_replica_argsfile ); + } + + c->be->be_replica_argsfile = c->value_string; + break; + + case CFG_REPLICA_PIDFILE: + if(SLAP_MONITOR(c->be)) { + Debug(LDAP_DEBUG_ANY, "%s: " + "\"replica-pidfile\" should not be used " + "inside monitor database\n", + c->log, 0, 0); + /* FIXME: should this be an error? */ + return(0); + } + + if ( c->be->be_replica_pidfile != NULL ) { + /* FIXME: error? */ + Debug(LDAP_DEBUG_ANY, "%s: " + "\"replica-pidfile\" already provided; " + "replacing \"%s\" with \"%s\".\n", + c->log, c->be->be_replica_pidfile, c->value_string ); + ch_free( c->be->be_replica_pidfile ); + } + + c->be->be_replica_pidfile = c->value_string; + break; + + case CFG_REPLICATIONINTERVAL: + if(SLAP_MONITOR(c->be)) { + Debug(LDAP_DEBUG_ANY, "%s: " + "\"replicationinterval\" should not be used " + "inside monitor database\n", + c->log, 0, 0); + /* FIXME: should this be an error? */ + return(0); + } + + c->be->be_replicationinterval = c->value_int; break; case CFG_REPLOG: @@ -1141,7 +1492,17 @@ config_generic(ConfigArgs *c) { "\"replogfile\" should not be used " "inside monitor database\n", c->log, 0, 0); - return(0); /* FIXME: should this be an error? */ + /* FIXME: should this be an error? */ + return(0); + } + + if ( c->be->be_replogfile != NULL ) { + /* FIXME: error? */ + Debug(LDAP_DEBUG_ANY, "%s: " + "\"replogfile\" already provided; " + "replacing \"%s\" with \"%s\".\n", + c->log, c->be->be_replogfile, c->value_string ); + ch_free( c->be->be_replogfile ); } c->be->be_replogfile = c->value_string; @@ -1149,7 +1510,7 @@ config_generic(ConfigArgs *c) { case CFG_ROOTDSE: if(read_root_dse_file(c->argv[1])) { - sprintf( c->msg, "<%s> could not read file", c->argv[0] ); + snprintf( c->msg, sizeof( c->msg ), "<%s> could not read file", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s %s\n", c->log, c->msg, c->argv[1] ); return(1); @@ -1157,6 +1518,8 @@ config_generic(ConfigArgs *c) { { struct berval bv; ber_str2bv( c->argv[1], 0, 1, &bv ); + if ( c->op == LDAP_MOD_ADD && c->private && cfn != c->private ) + cfn = c->private; ber_bvarray_add( &cfn->c_dseFiles, &bv ); } break; @@ -1171,7 +1534,7 @@ config_generic(ConfigArgs *c) { case CFG_LASTMOD: if(SLAP_NOLASTMODCMD(c->be)) { - sprintf( c->msg, "<%s> not available for %s database", + snprintf( c->msg, sizeof( c->msg ), "<%s> not available for %s database", c->argv[0], c->be->bd_info->bi_type ); Debug(LDAP_DEBUG_ANY, "%s: %s\n", c->log, c->msg, 0 ); @@ -1183,9 +1546,37 @@ config_generic(ConfigArgs *c) { SLAP_DBFLAGS(c->be) |= SLAP_DBFLAG_NOLASTMOD; break; + case CFG_MIRRORMODE: + if(!SLAP_SHADOW(c->be)) { + snprintf( c->msg, sizeof( c->msg ), "<%s> database is not a shadow", + c->argv[0] ); + Debug(LDAP_DEBUG_ANY, "%s: %s\n", + c->log, c->msg, 0 ); + return(1); + } + if(c->value_int) + SLAP_DBFLAGS(c->be) &= ~SLAP_DBFLAG_SINGLE_SHADOW; + else + SLAP_DBFLAGS(c->be) |= SLAP_DBFLAG_SINGLE_SHADOW; + break; + + case CFG_MONITORING: + if(c->value_int) + SLAP_DBFLAGS(c->be) |= SLAP_DBFLAG_MONITORING; + else + SLAP_DBFLAGS(c->be) &= ~SLAP_DBFLAG_MONITORING; + break; + + case CFG_HIDDEN: + if (c->value_int) + SLAP_DBFLAGS(c->be) |= SLAP_DBFLAG_HIDDEN; + else + SLAP_DBFLAGS(c->be) &= ~SLAP_DBFLAG_HIDDEN; + break; + case CFG_SSTR_IF_MAX: if (c->value_int < index_substr_if_minlen) { - sprintf( c->msg, "<%s> invalid value", c->argv[0] ); + snprintf( c->msg, sizeof( c->msg ), "<%s> invalid value", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s (%d)\n", c->log, c->msg, c->value_int ); return(1); @@ -1195,7 +1586,7 @@ config_generic(ConfigArgs *c) { case CFG_SSTR_IF_MIN: if (c->value_int > index_substr_if_maxlen) { - sprintf( c->msg, "<%s> invalid value", c->argv[0] ); + snprintf( c->msg, sizeof( c->msg ), "<%s> invalid value", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s (%d)\n", c->log, c->msg, c->value_int ); return(1); @@ -1212,7 +1603,7 @@ config_generic(ConfigArgs *c) { modcur = c->private; /* This should never fail */ if ( module_path( modcur->mp_path.bv_val )) { - sprintf( c->msg, "<%s> module path no longer valid", + snprintf( c->msg, sizeof( c->msg ), "<%s> module path no longer valid", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s (%s)\n", c->log, c->msg, modcur->mp_path.bv_val ); @@ -1227,14 +1618,18 @@ config_generic(ConfigArgs *c) { char *ptr; if ( c->op == SLAP_CONFIG_ADD ) { ptr = c->line + STRLENOF("moduleload"); - while (!isspace(*ptr)) ptr++; - while (isspace(*ptr)) ptr++; + while (!isspace((unsigned char) *ptr)) ptr++; + while (isspace((unsigned char) *ptr)) ptr++; } else { ptr = c->line; } ber_str2bv(ptr, 0, 1, &bv); ber_bvarray_add( &modcur->mp_loads, &bv ); } + /* Check for any new hardcoded schema */ + if ( c->op == LDAP_MOD_ADD && CONFIG_ONLINE_ADD( c )) { + config_check_schema( &cfBackInfo ); + } break; case CFG_MODPATH: @@ -1282,7 +1677,7 @@ config_generic(ConfigArgs *c) { /* quote all args but the first */ line = ldap_charray2str( c->argv, "\" \"" ); ber_str2bv( line, 0, 0, &bv ); - s = strchr( bv.bv_val, '"' ); + s = ber_bvchr( &bv, '"' ); assert( s != NULL ); /* move the trailing quote of argv[0] to the end */ AC_MEMCPY( s, s + 1, bv.bv_len - ( s - bv.bv_val ) ); @@ -1299,13 +1694,10 @@ config_generic(ConfigArgs *c) { default: - Debug( SLAPD_DEBUG_CONFIG_ERROR, - "%s: unknown CFG_TYPE %d" - SLAPD_CONF_UNKNOWN_IGNORED ".\n", + Debug( LDAP_DEBUG_ANY, + "%s: unknown CFG_TYPE %d.\n", c->log, c->type, 0 ); -#ifdef SLAPD_CONF_UNKNOWN_BAILOUT return 1; -#endif /* SLAPD_CONF_UNKNOWN_BAILOUT */ } return(0); @@ -1402,14 +1794,14 @@ config_passwd_hash(ConfigArgs *c) { } for(i = 1; i < c->argc; i++) { if(!lutil_passwd_scheme(c->argv[i])) { - sprintf( c->msg, "<%s> scheme not available", c->argv[0] ); + snprintf( c->msg, sizeof( c->msg ), "<%s> scheme not available", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s (%s)\n", c->log, c->msg, c->argv[i]); } else { ldap_charray_add(&default_passwd_hash, c->argv[i]); } if(!default_passwd_hash) { - sprintf( c->msg, "<%s> no valid hashes found", c->argv[0] ); + snprintf( c->msg, sizeof( c->msg ), "<%s> no valid hashes found", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s\n", c->log, c->msg, 0 ); return(1); @@ -1445,14 +1837,13 @@ config_schema_dn(ConfigArgs *c) { static int config_sizelimit(ConfigArgs *c) { int i, rc = 0; - char *next; struct slap_limits_set *lim = &c->be->be_def_limit; if (c->op == SLAP_CONFIG_EMIT) { char buf[8192]; struct berval bv; bv.bv_val = buf; bv.bv_len = 0; - limits_unparse_one( lim, SLAP_LIMIT_SIZE, &bv ); + limits_unparse_one( lim, SLAP_LIMIT_SIZE, &bv, sizeof( buf ) ); if ( !BER_BVISEMPTY( &bv )) value_add_one( &c->rvalue_vals, &bv ); else @@ -1472,7 +1863,7 @@ config_sizelimit(ConfigArgs *c) { if(!strncasecmp(c->argv[i], "size", 4)) { rc = limits_parse_one(c->argv[i], lim); if ( rc ) { - sprintf( c->msg, "<%s> unable to parse value", c->argv[0] ); + snprintf( c->msg, sizeof( c->msg ), "<%s> unable to parse value", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s \"%s\"\n", c->log, c->msg, c->argv[i]); return(1); @@ -1481,20 +1872,11 @@ config_sizelimit(ConfigArgs *c) { if(!strcasecmp(c->argv[i], "unlimited")) { lim->lms_s_soft = -1; } else { - lim->lms_s_soft = strtol(c->argv[i], &next, 0); - if(next == c->argv[i]) { - sprintf( c->msg, "<%s> unable to parse limit", c->argv[0]); + if ( lutil_atoix( &lim->lms_s_soft, c->argv[i], 0 ) != 0 ) { + snprintf( c->msg, sizeof( c->msg ), "<%s> unable to parse limit", c->argv[0]); Debug(LDAP_DEBUG_ANY, "%s: %s \"%s\"\n", c->log, c->msg, c->argv[i]); return(1); - } else if(next[0] != '\0') { - Debug( SLAPD_DEBUG_CONFIG_ERROR, "%s: " - "trailing chars \"%s\" in \"sizelimit \" line" - SLAPD_CONF_UNKNOWN_IGNORED ".\n", - c->log, next, 0); -#ifdef SLAPD_CONF_UNKNOWN_BAILOUT - return 1; -#endif /* SLAPD_CONF_UNKNOWN_BAILOUT */ } } lim->lms_s_hard = 0; @@ -1506,14 +1888,13 @@ config_sizelimit(ConfigArgs *c) { static int config_timelimit(ConfigArgs *c) { int i, rc = 0; - char *next; struct slap_limits_set *lim = &c->be->be_def_limit; if (c->op == SLAP_CONFIG_EMIT) { char buf[8192]; struct berval bv; bv.bv_val = buf; bv.bv_len = 0; - limits_unparse_one( lim, SLAP_LIMIT_TIME, &bv ); + limits_unparse_one( lim, SLAP_LIMIT_TIME, &bv, sizeof( buf ) ); if ( !BER_BVISEMPTY( &bv )) value_add_one( &c->rvalue_vals, &bv ); else @@ -1529,7 +1910,7 @@ config_timelimit(ConfigArgs *c) { if(!strncasecmp(c->argv[i], "time", 4)) { rc = limits_parse_one(c->argv[i], lim); if ( rc ) { - sprintf( c->msg, "<%s> unable to parse value", c->argv[0] ); + snprintf( c->msg, sizeof( c->msg ), "<%s> unable to parse value", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s \"%s\"\n", c->log, c->msg, c->argv[i]); return(1); @@ -1538,20 +1919,11 @@ config_timelimit(ConfigArgs *c) { if(!strcasecmp(c->argv[i], "unlimited")) { lim->lms_t_soft = -1; } else { - lim->lms_t_soft = strtol(c->argv[i], &next, 0); - if(next == c->argv[i]) { - sprintf( c->msg, "<%s> unable to parse limit", c->argv[0]); + if ( lutil_atoix( &lim->lms_t_soft, c->argv[i], 0 ) != 0 ) { + snprintf( c->msg, sizeof( c->msg ), "<%s> unable to parse limit", c->argv[0]); Debug(LDAP_DEBUG_ANY, "%s: %s \"%s\"\n", c->log, c->msg, c->argv[i]); return(1); - } else if(next[0] != '\0') { - Debug( SLAPD_DEBUG_CONFIG_ERROR, "%s: " - "trailing chars \"%s\" in \"timelimit \" line" - SLAPD_CONF_UNKNOWN_IGNORED ".\n", - c->log, next, 0); -#ifdef SLAPD_CONF_UNKNOWN_BAILOUT - return 1; -#endif /* SLAPD_CONF_UNKNOWN_BAILOUT */ } } lim->lms_t_hard = 0; @@ -1570,12 +1942,10 @@ config_overlay(ConfigArgs *c) { } if(c->argv[1][0] == '-' && overlay_config(c->be, &c->argv[1][1])) { /* log error */ - Debug( SLAPD_DEBUG_CONFIG_ERROR, "%s: (optional) %s overlay \"%s\" configuration failed" - SLAPD_CONF_UNKNOWN_IGNORED ".\n", + Debug( LDAP_DEBUG_ANY, + "%s: (optional) %s overlay \"%s\" configuration failed.\n", c->log, c->be == frontendDB ? "global " : "", &c->argv[1][1]); -#ifdef SLAPD_CONF_UNKNOWN_BAILOUT return 1; -#endif /* SLAPD_CONF_UNKNOWN_BAILOUT */ } else if(overlay_config(c->be, c->argv[1])) { return(1); } @@ -1694,17 +2064,18 @@ config_suffix(ConfigArgs *c) int i = c->valx; ch_free( c->be->be_suffix[i].bv_val ); ch_free( c->be->be_nsuffix[i].bv_val ); - for (; c->be->be_suffix[i].bv_val; i++) { + do { c->be->be_suffix[i] = c->be->be_suffix[i+1]; c->be->be_nsuffix[i] = c->be->be_nsuffix[i+1]; - } + i++; + } while ( !BER_BVISNULL( &c->be->be_suffix[i] ) ); } return 0; } #ifdef SLAPD_MONITOR_DN if(!strcasecmp(c->argv[1], SLAPD_MONITOR_DN)) { - sprintf( c->msg, "<%s> DN is reserved for monitoring slapd", + snprintf( c->msg, sizeof( c->msg ), "<%s> DN is reserved for monitoring slapd", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s (%s)\n", c->log, c->msg, SLAPD_MONITOR_DN); @@ -1714,15 +2085,14 @@ config_suffix(ConfigArgs *c) pdn = c->value_dn; ndn = c->value_ndn; - tbe = select_backend(&ndn, 0, 0); + if (SLAP_DBHIDDEN( c->be )) + tbe = NULL; + else + tbe = select_backend(&ndn, 0, 0); if(tbe == c->be) { - Debug( SLAPD_DEBUG_CONFIG_ERROR, - "%s: suffix already served by this backend!" - SLAPD_CONF_UNKNOWN_IGNORED ".\n", + Debug( LDAP_DEBUG_ANY, "%s: suffix already served by this backend!.\n", c->log, 0, 0); -#ifdef SLAPD_CONF_UNKNOWN_BAILOUT return 1; -#endif /* SLAPD_CONF_UNKNOWN_BAILOUT */ free(pdn.bv_val); free(ndn.bv_val); } else if(tbe) { @@ -1733,7 +2103,7 @@ config_suffix(ConfigArgs *c) type = oi->oi_orig->bi_type; } - sprintf( c->msg, "<%s> namingContext \"%s\" already served by " + snprintf( c->msg, sizeof( c->msg ), "<%s> namingContext \"%s\" already served by " "a preceding %s database serving namingContext", c->argv[0], pdn.bv_val, type ); Debug(LDAP_DEBUG_ANY, "%s: %s \"%s\"\n", @@ -1797,7 +2167,7 @@ config_rootpw(ConfigArgs *c) { tbe = select_backend(&c->be->be_rootndn, 0, 0); if(tbe != c->be) { - sprintf( c->msg, "<%s> can only be set when rootdn is under suffix", + snprintf( c->msg, sizeof( c->msg ), "<%s> can only be set when rootdn is under suffix", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s\n", c->log, c->msg, 0); @@ -1821,14 +2191,15 @@ config_restrict(ConfigArgs *c) { { BER_BVC("modrdn"), 0 }, { BER_BVC("delete"), SLAP_RESTRICT_OP_DELETE }, { BER_BVC("search"), SLAP_RESTRICT_OP_SEARCH }, - { BER_BVC("compare"), SLAP_RESTRICT_OP_COMPARE }, + { BER_BVC("compare"), SLAP_RESTRICT_OP_COMPARE }, { BER_BVC("read"), SLAP_RESTRICT_OP_READS }, { BER_BVC("write"), SLAP_RESTRICT_OP_WRITES }, - { BER_BVC("extended"), SLAP_RESTRICT_OP_EXTENDED }, + { BER_BVC("extended"), SLAP_RESTRICT_OP_EXTENDED }, { BER_BVC("extended=" LDAP_EXOP_START_TLS ), SLAP_RESTRICT_EXOP_START_TLS }, { BER_BVC("extended=" LDAP_EXOP_MODIFY_PASSWD ), SLAP_RESTRICT_EXOP_MODIFY_PASSWD }, { BER_BVC("extended=" LDAP_EXOP_X_WHO_AM_I ), SLAP_RESTRICT_EXOP_WHOAMI }, { BER_BVC("extended=" LDAP_EXOP_X_CANCEL ), SLAP_RESTRICT_EXOP_CANCEL }, + { BER_BVC("all"), SLAP_RESTRICT_OP_ALL }, { BER_BVNULL, 0 } }; @@ -1846,7 +2217,7 @@ config_restrict(ConfigArgs *c) { } i = verbs_to_mask( c->argc, c->argv, restrictable_ops, &restrictops ); if ( i ) { - sprintf( c->msg, "<%s> unknown operation", c->argv[0] ); + snprintf( c->msg, sizeof( c->msg ), "<%s> unknown operation", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s %s\n", c->log, c->msg, c->argv[i]); return(1); @@ -1866,6 +2237,7 @@ config_allows(ConfigArgs *c) { { BER_BVC("bind_anon_cred"), SLAP_ALLOW_BIND_ANON_CRED }, { BER_BVC("bind_anon_dn"), SLAP_ALLOW_BIND_ANON_DN }, { BER_BVC("update_anon"), SLAP_ALLOW_UPDATE_ANON }, + { BER_BVC("proxy_authz_anon"), SLAP_ALLOW_PROXY_AUTHZ_ANON }, { BER_BVNULL, 0 } }; if (c->op == SLAP_CONFIG_EMIT) { @@ -1881,7 +2253,7 @@ config_allows(ConfigArgs *c) { } i = verbs_to_mask(c->argc, c->argv, allowable_ops, &allows); if ( i ) { - sprintf( c->msg, "<%s> unknown feature", c->argv[0] ); + snprintf( c->msg, sizeof( c->msg ), "<%s> unknown feature", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s %s\n", c->log, c->msg, c->argv[i]); return(1); @@ -1915,7 +2287,7 @@ config_disallows(ConfigArgs *c) { } i = verbs_to_mask(c->argc, c->argv, disallowable_ops, &disallows); if ( i ) { - sprintf( c->msg, "<%s> unknown feature", c->argv[0] ); + snprintf( c->msg, sizeof( c->msg ), "<%s> unknown feature", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s %s\n", c->log, c->msg, c->argv[i]); return(1); @@ -1926,8 +2298,10 @@ config_disallows(ConfigArgs *c) { static int config_requires(ConfigArgs *c) { - slap_mask_t requires = 0; - int i; + slap_mask_t requires = frontendDB->be_requires; + int i, argc = c->argc; + char **argv = c->argv; + slap_verbmasks requires_ops[] = { { BER_BVC("bind"), SLAP_REQUIRE_BIND }, { BER_BVC("LDAPv3"), SLAP_REQUIRE_LDAP_V3 }, @@ -1947,11 +2321,23 @@ config_requires(ConfigArgs *c) { } return 0; } - i = verbs_to_mask(c->argc, c->argv, requires_ops, &requires); + /* "none" can only be first, to wipe out default/global values */ + if ( strcasecmp( c->argv[ 1 ], "none" ) == 0 ) { + argv++; + argc--; + requires = 0; + } + i = verbs_to_mask(argc, argv, requires_ops, &requires); if ( i ) { - sprintf( c->msg, "<%s> unknown feature", c->argv[0] ); - Debug(LDAP_DEBUG_ANY, "%s: %s %s\n", - c->log, c->msg, c->argv[i]); + if (strcasecmp( c->argv[ i ], "none" ) == 0 ) { + snprintf( c->msg, sizeof( c->msg ), "<%s> \"none\" (#%d) must be listed first", c->argv[0], i - 1 ); + Debug(LDAP_DEBUG_ANY, "%s: %s\n", + c->log, c->msg, 0); + } else { + snprintf( c->msg, sizeof( c->msg ), "<%s> unknown feature #%d", c->argv[0], i - 1 ); + Debug(LDAP_DEBUG_ANY, "%s: %s \"%s\"\n", + c->log, c->msg, c->argv[i]); + } return(1); } c->be->be_requires = requires; @@ -1977,10 +2363,13 @@ loglevel_init( void ) { BER_BVC("Stats2"), LDAP_DEBUG_STATS2 }, { BER_BVC("Shell"), LDAP_DEBUG_SHELL }, { BER_BVC("Parse"), LDAP_DEBUG_PARSE }, +#if 0 /* no longer used (nor supported) */ { BER_BVC("Cache"), LDAP_DEBUG_CACHE }, { BER_BVC("Index"), LDAP_DEBUG_INDEX }, +#endif { BER_BVC("Sync"), LDAP_DEBUG_SYNC }, - { BER_BVNULL, 0 } + { BER_BVC("None"), LDAP_DEBUG_NONE }, + { BER_BVNULL, 0 } }; return slap_verbmasks_init( &loglevel_ops, lo ); @@ -2016,6 +2405,43 @@ slap_loglevel_register( slap_mask_t m, struct berval *s ) return rc; } +int +slap_loglevel_get( struct berval *s, int *l ) +{ + int rc; + unsigned long i; + slap_mask_t m; + + if ( loglevel_ops == NULL ) { + loglevel_init(); + } + + for ( m = 0, i = 1; !BER_BVISNULL( &loglevel_ops[ i ].word ); i++ ) { + m |= loglevel_ops[ i ].mask; + } + + m = ~m; + + for ( i = 1; i <= ( 1 << ( sizeof( int ) * 8 - 1 ) ) && !( m & i ); i <<= 1 ) + ; + + if ( !( m & i ) ) { + return -1; + } + + rc = slap_verbmasks_append( &loglevel_ops, i, s, loglevel_ignore ); + + if ( rc != 0 ) { + Debug( LDAP_DEBUG_ANY, "slap_loglevel_get(%lu, \"%s\") failed\n", + i, s->bv_val, 0 ); + + } else { + *l = i; + } + + return rc; +} + int str2loglevel( const char *s, int *l ) { @@ -2027,7 +2453,7 @@ str2loglevel( const char *s, int *l ) i = verb_to_mask( s, loglevel_ops ); - if ( BER_BVISNULL( &loglevel_ops[ i ].word) ) { + if ( BER_BVISNULL( &loglevel_ops[ i ].word ) ) { return -1; } @@ -2068,12 +2494,33 @@ loglevel2bvarray( int l, BerVarray *bva ) return mask_to_verbs( loglevel_ops, l, bva ); } +int +loglevel_print( FILE *out ) +{ + int i; + + if ( loglevel_ops == NULL ) { + loglevel_init(); + } + + fprintf( out, "Installed log subsystems:\n\n" ); + for ( i = 0; !BER_BVISNULL( &loglevel_ops[ i ].word ); i++ ) { + fprintf( out, "\t%-30s (%lu)\n", + loglevel_ops[ i ].word.bv_val, + loglevel_ops[ i ].mask ); + } + + fprintf( out, "\nNOTE: custom log subsystems may be later installed " + "by specific code\n\n" ); + + return 0; +} + static int config_syslog; static int config_loglevel(ConfigArgs *c) { int i; - char *next; if ( loglevel_ops == NULL ) { loglevel_init(); @@ -2103,17 +2550,16 @@ config_loglevel(ConfigArgs *c) { for( i=1; i < c->argc; i++ ) { int level; - if ( isdigit( c->argv[i][0] ) || c->argv[i][0] == '-' ) { - level = strtol( c->argv[i], &next, 10 ); - if ( next == NULL || next[0] != '\0' ) { - sprintf( c->msg, "<%s> unable to parse level", c->argv[0] ); + if ( isdigit((unsigned char)c->argv[i][0]) || c->argv[i][0] == '-' ) { + if( lutil_atoi( &level, c->argv[i] ) != 0 ) { + snprintf( c->msg, sizeof( c->msg ), "<%s> unable to parse level", c->argv[0] ); Debug( LDAP_DEBUG_ANY, "%s: %s \"%s\"\n", c->log, c->msg, c->argv[i]); return( 1 ); } } else { if ( str2loglevel( c->argv[i], &level ) ) { - sprintf( c->msg, "<%s> unknown level", c->argv[0] ); + snprintf( c->msg, sizeof( c->msg ), "<%s> unknown level", c->argv[0] ); Debug( LDAP_DEBUG_ANY, "%s: %s \"%s\"\n", c->log, c->msg, c->argv[i]); return( 1 ); @@ -2150,7 +2596,7 @@ config_referral(ConfigArgs *c) { return 0; } if(validate_global_referral(c->argv[1])) { - sprintf( c->msg, "<%s> invalid URL", c->argv[0] ); + snprintf( c->msg, sizeof( c->msg ), "<%s> invalid URL", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s (%s)\n", c->log, c->msg, c->argv[1]); return(1); @@ -2192,7 +2638,13 @@ config_security(ConfigArgs *c) { tgt = (slap_ssf_t *)((char *)set + sec_keys[i].off); if ( *tgt ) { rc = 0; - bv.bv_len = sprintf( numbuf, "%u", *tgt ); + bv.bv_len = snprintf( numbuf, sizeof( numbuf ), "%u", *tgt ); + if ( bv.bv_len >= sizeof( numbuf ) ) { + ber_bvarray_free_x( c->rvalue_vals, NULL ); + c->rvalue_vals = NULL; + rc = 1; + break; + } bv.bv_len += sec_keys[i].key.bv_len; bv.bv_val = ch_malloc( bv.bv_len + 1); next = lutil_strcopy( bv.bv_val, sec_keys[i].key.bv_val ); @@ -2204,7 +2656,7 @@ config_security(ConfigArgs *c) { } for(i = 1; i < c->argc; i++) { slap_ssf_t *tgt = NULL; - char *src; + char *src = NULL; for ( j=0; !BER_BVISNULL( &sec_keys[j].key ); j++ ) { if(!strncasecmp(c->argv[i], sec_keys[j].key.bv_val, sec_keys[j].key.bv_len)) { @@ -2214,15 +2666,14 @@ config_security(ConfigArgs *c) { } } if ( !tgt ) { - sprintf( c->msg, "<%s> unknown factor", c->argv[0] ); + snprintf( c->msg, sizeof( c->msg ), "<%s> unknown factor", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s %s\n", c->log, c->msg, c->argv[i]); return(1); } - *tgt = strtol(src, &next, 10); - if(next == NULL || next[0] != '\0' ) { - sprintf( c->msg, "<%s> unable to parse factor", c->argv[0] ); + if ( lutil_atou( tgt, src ) != 0 ) { + snprintf( c->msg, sizeof( c->msg ), "<%s> unable to parse factor", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s \"%s\"\n", c->log, c->msg, c->argv[i]); return(1); @@ -2232,10 +2683,14 @@ config_security(ConfigArgs *c) { } char * -anlist_unparse( AttributeName *an, char *ptr ) { +anlist_unparse( AttributeName *an, char *ptr, ber_len_t buflen ) { int comma = 0; + char *start = ptr; for (; !BER_BVISNULL( &an->an_name ); an++) { + /* if buflen == 0, assume the buffer size has been + * already checked otherwise */ + if ( buflen > 0 && buflen - ( ptr - start ) < comma + an->an_name.bv_len ) return NULL; if ( comma ) *ptr++ = ','; ptr = lutil_strcopy( ptr, an->an_name.bv_val ); comma = 1; @@ -2251,16 +2706,23 @@ replica_unparse( struct slap_replica_info *ri, int i, struct berval *bv ) struct berval bc = BER_BVNULL; char numbuf[32]; - len = sprintf(numbuf, IFMT, i ); + assert( !BER_BVISNULL( &ri->ri_bindconf.sb_uri ) ); + + BER_BVZERO( bv ); + + len = snprintf(numbuf, sizeof( numbuf ), SLAP_X_ORDERED_FMT, i ); + if ( len >= sizeof( numbuf ) ) { + /* FIXME: how can indicate error? */ + return; + } - len += strlen( ri->ri_uri ) + STRLENOF("uri="); if ( ri->ri_nsuffix ) { for (i=0; !BER_BVISNULL( &ri->ri_nsuffix[i] ); i++) { len += ri->ri_nsuffix[i].bv_len + STRLENOF(" suffix=\"\""); } } if ( ri->ri_attrs ) { - len += STRLENOF("attr"); + len += STRLENOF(" attrs"); if ( ri->ri_exclude ) len++; for (i=0; !BER_BVISNULL( &ri->ri_attrs[i].an_name ); i++) { len += 1 + ri->ri_attrs[i].an_name.bv_len; @@ -2273,8 +2735,13 @@ replica_unparse( struct slap_replica_info *ri, int i, struct berval *bv ) bv->bv_len = len; ptr = lutil_strcopy( bv->bv_val, numbuf ); - ptr = lutil_strcopy( ptr, "uri=" ); - ptr = lutil_strcopy( ptr, ri->ri_uri ); + + /* start with URI from bindconf */ + assert( !BER_BVISNULL( &bc ) ); + if ( bc.bv_val ) { + strcpy( ptr, bc.bv_val ); + ch_free( bc.bv_val ); + } if ( ri->ri_nsuffix ) { for (i=0; !BER_BVISNULL( &ri->ri_nsuffix[i] ); i++) { @@ -2284,21 +2751,17 @@ replica_unparse( struct slap_replica_info *ri, int i, struct berval *bv ) } } if ( ri->ri_attrs ) { - ptr = lutil_strcopy( ptr, "attr" ); + ptr = lutil_strcopy( ptr, " attrs" ); if ( ri->ri_exclude ) *ptr++ = '!'; *ptr++ = '='; - ptr = anlist_unparse( ri->ri_attrs, ptr ); - } - if ( bc.bv_val ) { - strcpy( ptr, bc.bv_val ); - ch_free( bc.bv_val ); + ptr = anlist_unparse( ri->ri_attrs, ptr, 0 ); } } static int config_replica(ConfigArgs *c) { - int i, nr = -1, len; - char *replicahost, *replicauri; + int i, nr = -1; + char *replicahost = NULL, *replicauri = NULL; LDAPURLDesc *ludp; if (c->op == SLAP_CONFIG_EMIT) { @@ -2326,70 +2789,117 @@ config_replica(ConfigArgs *c) { for(i = 1; i < c->argc; i++) { if(!strncasecmp(c->argv[i], "host=", STRLENOF("host="))) { + ber_len_t len; + + if ( replicauri ) { + snprintf( c->msg, sizeof( c->msg ), "<%s> replica host/URI already specified", c->argv[0] ); + Debug(LDAP_DEBUG_ANY, "%s: %s \"%s\"\n", c->log, c->msg, replicauri ); + return(1); + } + replicahost = c->argv[i] + STRLENOF("host="); - len = strlen( replicahost ); - replicauri = ch_malloc( len + STRLENOF("ldap://") + 1 ); - sprintf( replicauri, "ldap://%s", replicahost ); + len = strlen( replicahost ) + STRLENOF("ldap://"); + replicauri = ch_malloc( len + 1 ); + snprintf( replicauri, len + 1, "ldap://%s", replicahost ); replicahost = replicauri + STRLENOF( "ldap://"); nr = add_replica_info(c->be, replicauri, replicahost); break; } else if(!strncasecmp(c->argv[i], "uri=", STRLENOF("uri="))) { + ber_len_t len; + + if ( replicauri ) { + snprintf( c->msg, sizeof( c->msg ), "<%s> replica host/URI already specified", c->argv[0] ); + Debug(LDAP_DEBUG_ANY, "%s: %s \"%s\"\n", c->log, c->msg, replicauri ); + return(1); + } + if(ldap_url_parse(c->argv[i] + STRLENOF("uri="), &ludp) != LDAP_SUCCESS) { - sprintf( c->msg, "<%s> invalid uri", c->argv[0] ); + snprintf( c->msg, sizeof( c->msg ), "<%s> invalid uri", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s\n", c->log, c->msg, 0 ); return(1); } if(!ludp->lud_host) { ldap_free_urldesc(ludp); - sprintf( c->msg, "<%s> invalid uri - missing hostname", + snprintf( c->msg, sizeof( c->msg ), "<%s> invalid uri - missing hostname", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s\n", c->log, c->msg, 0 ); return(1); } + + len = strlen(ludp->lud_scheme) + strlen(ludp->lud_host) + + STRLENOF("://") + 1; + if (ludp->lud_port != LDAP_PORT) { + if (ludp->lud_port < 1 || ludp->lud_port > 65535) { + ldap_free_urldesc(ludp); + snprintf( c->msg, sizeof( c->msg ), "<%s> invalid port", + c->argv[0] ); + Debug(LDAP_DEBUG_ANY, "%s: %s\n", c->log, c->msg, 0 ); + return(1); + } + len += STRLENOF(":65535"); + } + replicauri = ch_malloc( len ); + replicahost = lutil_strcopy( replicauri, ludp->lud_scheme ); + replicahost = lutil_strcopy( replicahost, "://" ); + if (ludp->lud_port == LDAP_PORT) { + strcpy( replicahost, ludp->lud_host ); + } else { + sprintf( replicahost, "%s:%d",ludp->lud_host,ludp->lud_port ); + } ldap_free_urldesc(ludp); - replicauri = c->argv[i] + STRLENOF("uri="); - replicauri = ch_strdup( replicauri ); - replicahost = strchr( replicauri, '/' ); - replicahost += 2; nr = add_replica_info(c->be, replicauri, replicahost); break; } } if(i == c->argc) { - sprintf( c->msg, "<%s> missing host or uri", c->argv[0] ); + snprintf( c->msg, sizeof( c->msg ), "<%s> missing host or uri", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s\n", c->log, c->msg, 0 ); return(1); } else if(nr == -1) { - sprintf( c->msg, "<%s> unable to add replica", c->argv[0] ); - Debug(LDAP_DEBUG_ANY, "%s: %s \"%s\"\n", c->log, c->msg, replicauri ); + snprintf( c->msg, sizeof( c->msg ), "<%s> unable to add replica", c->argv[0] ); + Debug(LDAP_DEBUG_ANY, "%s: %s \"%s\"\n", c->log, c->msg, + replicauri ? replicauri : "" ); return(1); } else { for(i = 1; i < c->argc; i++) { - if(!strncasecmp(c->argv[i], "suffix=", STRLENOF( "suffix="))) { + if(!strncasecmp(c->argv[i], "uri=", STRLENOF("uri="))) { + /* dealt with separately; don't let it get to bindconf */ + ; + + } else if(!strncasecmp(c->argv[i], "host=", STRLENOF("host="))) { + /* dealt with separately; don't let it get to bindconf */ + ; + + } else if(!strncasecmp(c->argv[i], "suffix=", STRLENOF( "suffix="))) { switch(add_replica_suffix(c->be, nr, c->argv[i] + STRLENOF("suffix="))) { case 1: - Debug( SLAPD_DEBUG_CONFIG_ERROR, "%s: " - "suffix \"%s\" in \"replica\" line is not valid for backend" - SLAPD_CONF_UNKNOWN_IGNORED ".\n", - c->log, c->argv[i] + STRLENOF("suffix="), 0); -#ifdef SLAPD_CONF_UNKNOWN_BAILOUT + Debug( LDAP_DEBUG_ANY, "%s: " + "suffix \"%s\" in \"replica\" line is not valid for backend.\n", + c->log, c->argv[i] + STRLENOF("suffix="), 0); return 1; -#endif /* SLAPD_CONF_UNKNOWN_BAILOUT */ break; case 2: - Debug( SLAPD_DEBUG_CONFIG_ERROR, "%s: " - "unable to normalize suffix in \"replica\" line" - SLAPD_CONF_UNKNOWN_IGNORED ".\n", - c->log, 0, 0); -#ifdef SLAPD_CONF_UNKNOWN_BAILOUT + Debug( LDAP_DEBUG_ANY, "%s: " + "unable to normalize suffix in \"replica\" line.\n", + c->log, 0, 0); return 1; -#endif /* SLAPD_CONF_UNKNOWN_BAILOUT */ break; } - } else if(!strncasecmp(c->argv[i], "attr", STRLENOF("attr"))) { + } else if (!strncasecmp(c->argv[i], "attr", STRLENOF("attr")) + || !strncasecmp(c->argv[i], "attrs", STRLENOF("attrs"))) + { int exclude = 0; char *arg = c->argv[i] + STRLENOF("attr"); + if (arg[0] == 's') { + arg++; + } else { + Debug( LDAP_DEBUG_ANY, + "%s: \"attr\" " + "is deprecated (and undocumented); " + "use \"attrs\" instead.\n", + c->log, 0, 0 ); + } if(arg[0] == '!') { arg++; exclude = 1; @@ -2398,7 +2908,7 @@ config_replica(ConfigArgs *c) { continue; } if(add_replica_attrs(c->be, nr, arg + 1, exclude)) { - sprintf( c->msg, "<%s> unknown attribute", c->argv[0] ); + snprintf( c->msg, sizeof( c->msg ), "<%s> unknown attribute", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s \"%s\"\n", c->log, c->msg, arg + 1); return(1); @@ -2428,7 +2938,7 @@ config_updatedn(ConfigArgs *c) { return 0; } if(SLAP_SHADOW(c->be)) { - sprintf( c->msg, "<%s> database already shadowed", c->argv[0] ); + snprintf( c->msg, sizeof( c->msg ), "<%s> database already shadowed", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s\n", c->log, c->msg, 0); return(1); @@ -2442,8 +2952,32 @@ config_updatedn(ConfigArgs *c) { BER_BVZERO( &c->value_dn ); BER_BVZERO( &c->value_ndn ); - SLAP_DBFLAGS(c->be) |= (SLAP_DBFLAG_SHADOW | SLAP_DBFLAG_SLURP_SHADOW); - return(0); + return config_slurp_shadow( c ); +} + +int +config_shadow( ConfigArgs *c, int flag ) +{ + char *notallowed = NULL; + + if ( c->be == frontendDB ) { + notallowed = "frontend"; + + } else if ( SLAP_MONITOR(c->be) ) { + notallowed = "monitor"; + + } else if ( SLAP_CONFIG(c->be) ) { + notallowed = "config"; + } + + if ( notallowed != NULL ) { + Debug( LDAP_DEBUG_ANY, "%s: %s database cannot be shadow.\n", c->log, notallowed, 0 ); + return 1; + } + + SLAP_DBFLAGS(c->be) |= (SLAP_DBFLAG_SHADOW | SLAP_DBFLAG_SINGLE_SHADOW | flag); + + return 0; } static int @@ -2469,7 +3003,7 @@ config_updateref(ConfigArgs *c) { return 0; } if(!SLAP_SHADOW(c->be)) { - sprintf( c->msg, "<%s> must appear after syncrepl or updatedn", + snprintf( c->msg, sizeof( c->msg ), "<%s> must appear after syncrepl or updatedn", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s\n", c->log, c->msg, 0); @@ -2477,7 +3011,7 @@ config_updateref(ConfigArgs *c) { } if(validate_global_referral(c->argv[1])) { - sprintf( c->msg, "<%s> invalid URL", c->argv[0] ); + snprintf( c->msg, sizeof( c->msg ), "<%s> invalid URL", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s (%s)\n", c->log, c->msg, c->argv[1]); return(1); @@ -2530,8 +3064,9 @@ config_include(ConfigArgs *c) { static int config_tls_option(ConfigArgs *c) { int flag; + LDAP *ld = slap_tls_ld; switch(c->type) { - case CFG_TLS_RAND: flag = LDAP_OPT_X_TLS_RANDOM_FILE; break; + case CFG_TLS_RAND: flag = LDAP_OPT_X_TLS_RANDOM_FILE; ld = NULL; break; case CFG_TLS_CIPHER: flag = LDAP_OPT_X_TLS_CIPHER_SUITE; break; case CFG_TLS_CERT_FILE: flag = LDAP_OPT_X_TLS_CERTFILE; break; case CFG_TLS_CERT_KEY: flag = LDAP_OPT_X_TLS_KEYFILE; break; @@ -2541,14 +3076,15 @@ config_tls_option(ConfigArgs *c) { default: Debug(LDAP_DEBUG_ANY, "%s: " "unknown tls_option <0x%x>\n", c->log, c->type, 0); + return 1; } if (c->op == SLAP_CONFIG_EMIT) { - return ldap_pvt_tls_get_option( NULL, flag, &c->value_string ); + return ldap_pvt_tls_get_option( ld, flag, &c->value_string ); } else if ( c->op == LDAP_MOD_DELETE ) { - return ldap_pvt_tls_set_option( NULL, flag, NULL ); + return ldap_pvt_tls_set_option( ld, flag, NULL ); } ch_free(c->value_string); - return(ldap_pvt_tls_set_option(NULL, flag, c->argv[1])); + return(ldap_pvt_tls_set_option(ld, flag, c->argv[1])); } /* FIXME: this ought to be provided by libldap */ @@ -2575,9 +3111,10 @@ config_tls_config(ConfigArgs *c) { Debug(LDAP_DEBUG_ANY, "%s: " "unknown tls_option <0x%x>\n", c->log, c->type, 0); + return 1; } if (c->op == SLAP_CONFIG_EMIT) { - ldap_pvt_tls_get_option( NULL, flag, &c->value_int ); + ldap_pvt_tls_get_option( slap_tls_ld, flag, &c->value_int ); for (i=0; !BER_BVISNULL(&keys[i].word); i++) { if (keys[i].mask == c->value_int) { c->value_string = ch_strdup( keys[i].word.bv_val ); @@ -2587,14 +3124,19 @@ config_tls_config(ConfigArgs *c) { return 1; } else if ( c->op == LDAP_MOD_DELETE ) { int i = 0; - return ldap_pvt_tls_set_option( NULL, flag, &i ); + return ldap_pvt_tls_set_option( slap_tls_ld, flag, &i ); } ch_free( c->value_string ); - if(isdigit((unsigned char)c->argv[1][0])) { - i = atoi(c->argv[1]); - return(ldap_pvt_tls_set_option(NULL, flag, &i)); + if ( isdigit( (unsigned char)c->argv[1][0] ) ) { + if ( lutil_atoi( &i, c->argv[1] ) != 0 ) { + Debug(LDAP_DEBUG_ANY, "%s: " + "unable to parse %s \"%s\"\n", + c->log, c->argv[0], c->argv[1] ); + return 1; + } + return(ldap_pvt_tls_set_option(slap_tls_ld, flag, &i)); } else { - return(ldap_int_tls_config(NULL, flag, c->argv[1])); + return(ldap_int_tls_config(slap_tls_ld, flag, c->argv[1])); } } #endif @@ -2641,6 +3183,10 @@ config_find_base( CfEntryInfo *root, struct berval *dn, CfEntryInfo **last ) typedef struct setup_cookie { CfBackInfo *cfb; ConfigArgs *ca; + Entry *frontend; + Entry *config; + int got_frontend; + int got_config; } setup_cookie; static int @@ -2650,7 +3196,57 @@ config_ldif_resp( Operation *op, SlapReply *rs ) setup_cookie *sc = op->o_callback->sc_private; sc->cfb->cb_got_ldif = 1; - rs->sr_err = config_add_internal( sc->cfb, rs->sr_entry, sc->ca, NULL, NULL ); + /* Does the frontend exist? */ + if ( !sc->got_frontend ) { + if ( !strncmp( rs->sr_entry->e_nname.bv_val, + "olcDatabase", STRLENOF( "olcDatabase" ))) { + if ( strncmp( rs->sr_entry->e_nname.bv_val + + STRLENOF( "olcDatabase" ), "={-1}frontend", + STRLENOF( "={-1}frontend" ))) { + struct berval rdn; + int i = op->o_noop; + sc->ca->be = frontendDB; + sc->ca->bi = frontendDB->bd_info; + frontendDB->be_cf_ocs = &CFOC_FRONTEND; + rdn.bv_val = sc->ca->log; + rdn.bv_len = snprintf(rdn.bv_val, sizeof( sc->ca->log ), + "%s=" SLAP_X_ORDERED_FMT "%s", + cfAd_database->ad_cname.bv_val, -1, + sc->ca->bi->bi_type); + op->o_noop = 1; + sc->frontend = config_build_entry( op, rs, + sc->cfb->cb_root, sc->ca, &rdn, &CFOC_DATABASE, + sc->ca->be->be_cf_ocs ); + op->o_noop = i; + } + sc->got_frontend++; + } + } + /* Does the configDB exist? */ + if ( sc->got_frontend && !sc->got_config && + !strncmp( rs->sr_entry->e_nname.bv_val, + "olcDatabase", STRLENOF( "olcDatabase" ))) { + if ( strncmp( rs->sr_entry->e_nname.bv_val + + STRLENOF( "olcDatabase" ), "={0}config", + STRLENOF( "={0}config" ))) { + struct berval rdn; + int i = op->o_noop; + sc->ca->be = LDAP_STAILQ_FIRST( &backendDB ); + sc->ca->bi = sc->ca->be->bd_info; + rdn.bv_val = sc->ca->log; + rdn.bv_len = snprintf(rdn.bv_val, sizeof( sc->ca->log ), + "%s=" SLAP_X_ORDERED_FMT "%s", + cfAd_database->ad_cname.bv_val, 0, + sc->ca->bi->bi_type); + op->o_noop = 1; + sc->config = config_build_entry( op, rs, sc->cfb->cb_root, + sc->ca, &rdn, &CFOC_DATABASE, sc->ca->be->be_cf_ocs ); + op->o_noop = i; + } + sc->got_config++; + } + + rs->sr_err = config_add_internal( sc->cfb, rs->sr_entry, sc->ca, NULL, NULL, NULL ); if ( rs->sr_err != LDAP_SUCCESS ) { Debug( LDAP_DEBUG_ANY, "config error processing %s: %s\n", rs->sr_entry->e_name.bv_val, sc->ca->msg, 0 ); @@ -2689,15 +3285,17 @@ config_setup_ldif( BackendDB *be, const char *dir, int readit ) { if ( !cfb->cb_db.bd_info ) return 0; /* FIXME: eventually this will be a fatal error */ - if ( cfb->cb_db.bd_info->bi_db_init( &cfb->cb_db )) return 1; - - /* Mark that back-ldif type is in use */ - cfb->cb_db.bd_info->bi_nDB++; + if ( backend_db_init( "ldif", &cfb->cb_db ) == NULL ) + return 1; cfb->cb_db.be_suffix = be->be_suffix; cfb->cb_db.be_nsuffix = be->be_nsuffix; - cfb->cb_db.be_rootdn = be->be_rootdn; - cfb->cb_db.be_rootndn = be->be_rootndn; + + /* The suffix is always "cn=config". The underlying DB's rootdn + * is always the same as the suffix. + */ + cfb->cb_db.be_rootdn = be->be_suffix[0]; + cfb->cb_db.be_rootndn = be->be_nsuffix[0]; ber_str2bv( dir, 0, 1, &cfdir ); @@ -2721,6 +3319,7 @@ config_setup_ldif( BackendDB *be, const char *dir, int readit ) { if ( readit ) { void *thrctx = ldap_pvt_thread_pool_context(); + int prev_DN_strict; op = (Operation *) &opbuf; connection_fake_init( &conn, op, thrctx ); @@ -2733,8 +3332,8 @@ config_setup_ldif( BackendDB *be, const char *dir, int readit ) { op->ors_filterstr = filterstr; op->ors_scope = LDAP_SCOPE_SUBTREE; - op->o_dn = be->be_rootdn; - op->o_ndn = be->be_rootndn; + op->o_dn = c.be->be_rootdn; + op->o_ndn = c.be->be_rootndn; op->o_req_dn = be->be_suffix[0]; op->o_req_ndn = be->be_nsuffix[0]; @@ -2749,14 +3348,37 @@ config_setup_ldif( BackendDB *be, const char *dir, int readit ) { sc.cfb = cfb; sc.ca = &c; cb.sc_private = ≻ + sc.got_frontend = 0; + sc.got_config = 0; + sc.frontend = NULL; + sc.config = NULL; op->o_bd = &cfb->cb_db; + + /* Allow unknown attrs in DNs */ + prev_DN_strict = slap_DN_strict; + slap_DN_strict = 0; + rc = op->o_bd->be_search( op, &rs ); + /* Restore normal DN validation */ + slap_DN_strict = prev_DN_strict; + + op->o_tag = LDAP_REQ_ADD; + if ( rc == LDAP_SUCCESS && sc.frontend ) { + op->ora_e = sc.frontend; + rc = op->o_bd->be_add( op, &rs ); + } + if ( rc == LDAP_SUCCESS && sc.config ) { + op->ora_e = sc.config; + rc = op->o_bd->be_add( op, &rs ); + } ldap_pvt_thread_pool_context_reset( thrctx ); } - cfb->cb_use_ldif = 1; + /* ITS#4194 - only use if it's present, or we're converting. */ + if ( !readit || rc == LDAP_SUCCESS ) + cfb->cb_use_ldif = 1; return rc; } @@ -2799,11 +3421,12 @@ read_config(const char *fname, const char *dir) { int rc; /* Setup the config backend */ - be = backend_db_init( "config" ); + be = backend_db_init( "config", NULL ); if ( !be ) return 1; cfb = be->be_private; + be->be_dfltaccess = ACL_NONE; /* If no .conf, or a dir was specified, setup the dir */ if ( !fname || dir ) { @@ -2824,9 +3447,24 @@ read_config(const char *fname, const char *dir) { /* if fname is defaulted, try reading .d */ rc = config_setup_ldif( be, cfdir, !fname ); - /* It's OK if the base object doesn't exist yet */ - if ( rc && rc != LDAP_NO_SUCH_OBJECT ) - return 1; + if ( rc ) { + /* It may be OK if the base object doesn't exist yet. */ + if ( rc != LDAP_NO_SUCH_OBJECT ) + return 1; + /* ITS#4194: But if dir was specified and no fname, + * then we were supposed to read the dir. Unless we're + * trying to slapadd the dir... + */ + if ( dir && !fname ) { + if ( slapMode & (SLAP_SERVER_MODE|SLAP_TOOL_READMAIN|SLAP_TOOL_READONLY)) + return 1; + /* Assume it's slapadd with a config dir, let it continue */ + rc = 0; + cfb->cb_got_ldif = 1; + cfb->cb_use_ldif = 1; + goto done; + } + } /* If we read the config from back-ldif, nothing to do here */ if ( cfb->cb_got_ldif ) { @@ -2845,25 +3483,6 @@ read_config(const char *fname, const char *dir) { if ( rc == 0 ) ber_str2bv( cfname, 0, 1, &cfb->cb_config->c_file ); - /* If we got this far and failed, it may be a serious problem. In server - * mode, we should never come to this. However, it may be alright if we're - * using slapadd to create the conf dir. - */ - while ( rc ) { - if ( slapMode & (SLAP_SERVER_MODE|SLAP_TOOL_READMAIN|SLAP_TOOL_READONLY)) - break; - /* If a config file was explicitly given, fail */ - if ( fname ) - break; - - /* Seems to be slapadd with a config dir, let it continue */ - if ( cfb->cb_use_ldif ) { - rc = 0; - cfb->cb_got_ldif = 1; - } - break; - } - done: if ( rc == 0 && BER_BVISNULL( &frontendDB->be_schemadn ) ) { ber_str2bv( SLAPD_SCHEMA_DN, STRLENOF( SLAPD_SCHEMA_DN ), 1, @@ -2904,6 +3523,7 @@ config_send( Operation *op, SlapReply *rs, CfEntryInfo *ce, int depth ) { rs->sr_attrs = op->ors_attrs; rs->sr_entry = ce->ce_entry; + rs->sr_flags = 0; rc = send_search_entry( op, rs ); } if ( op->ors_scope == LDAP_SCOPE_SUBTREE ) { @@ -2999,7 +3619,7 @@ check_vals( ConfigTable *ct, ConfigArgs *ca, void *ptr, int isAttr ) AttributeDescription *ad; BerVarray vals; - int i, rc = 0, sort = 0; + int i, rc = 0; if ( isAttr ) { a = ptr; @@ -3012,17 +3632,17 @@ check_vals( ConfigTable *ct, ConfigArgs *ca, void *ptr, int isAttr ) } if ( a && ( ad->ad_type->sat_flags & SLAP_AT_ORDERED_VAL )) { - sort = 1; rc = ordered_value_sort( a, 1 ); if ( rc ) { - sprintf(ca->msg, "ordered_value_sort failed on attr %s\n", + snprintf(ca->msg, sizeof( ca->msg ), "ordered_value_sort failed on attr %s\n", ad->ad_cname.bv_val ); return rc; } } for ( i=0; vals[i].bv_val; i++ ) { ca->line = vals[i].bv_val; - if ( sort ) { + if (( ad->ad_type->sat_flags & SLAP_AT_ORDERED_VAL ) && + ca->line[0] == '{' ) { char *idx = strchr( ca->line, '}' ); if ( idx ) ca->line = idx+1; } @@ -3041,7 +3661,7 @@ check_name_index( CfEntryInfo *parent, ConfigType ce_type, Entry *e, CfEntryInfo *ce; int index = -1, gotindex = 0, nsibs; int renumber = 0, tailindex = 0; - char *ptr1, *ptr2; + char *ptr1, *ptr2 = NULL; struct berval rdn; if ( renum ) *renum = 0; @@ -3055,15 +3675,19 @@ check_name_index( CfEntryInfo *parent, ConfigType ce_type, Entry *e, /* See if the rdn has an index already */ dnRdn( &e->e_name, &rdn ); - ptr1 = strchr( e->e_name.bv_val, '{' ); + ptr1 = ber_bvchr( &e->e_name, '{' ); if ( ptr1 && ptr1 - e->e_name.bv_val < rdn.bv_len ) { + char *next; ptr2 = strchr( ptr1, '}' ); if (!ptr2 || ptr2 - e->e_name.bv_val > rdn.bv_len) return LDAP_NAMING_VIOLATION; if ( ptr2-ptr1 == 1) return LDAP_NAMING_VIOLATION; gotindex = 1; - index = atoi(ptr1+1); + index = strtol( ptr1 + 1, &next, 10 ); + if ( next == ptr1 + 1 || next[ 0 ] != '}' ) { + return LDAP_NAMING_VIOLATION; + } if ( index < 0 ) { /* Special case, we allow -1 for the frontendDB */ if ( index != -1 || ce_type != Cft_Database || @@ -3105,7 +3729,10 @@ check_name_index( CfEntryInfo *parent, ConfigType ce_type, Entry *e, if (!a ) return LDAP_NAMING_VIOLATION; ival.bv_val = ibuf; - ival.bv_len = sprintf( ibuf, IFMT, nsibs ); + ival.bv_len = snprintf( ibuf, sizeof( ibuf ), SLAP_X_ORDERED_FMT, nsibs ); + if ( ival.bv_len >= sizeof( ibuf ) ) { + return LDAP_NAMING_VIOLATION; + } newrdn.bv_len = rdn.bv_len + ival.bv_len; newrdn.bv_val = ch_malloc( newrdn.bv_len+1 ); @@ -3264,7 +3891,8 @@ cfAddOverlay( CfEntryInfo *p, Entry *e, struct config_args_s *ca ) /* Parse an LDAP entry into config directives */ static int -config_add_internal( CfBackInfo *cfb, Entry *e, ConfigArgs *ca, SlapReply *rs, int *renum ) +config_add_internal( CfBackInfo *cfb, Entry *e, ConfigArgs *ca, SlapReply *rs, + int *renum, Operation *op ) { CfEntryInfo *ce, *last; ConfigOCs **colst; @@ -3290,6 +3918,15 @@ config_add_internal( CfBackInfo *cfb, Entry *e, ConfigArgs *ca, SlapReply *rs, i return LDAP_NO_SUCH_OBJECT; } + if ( op ) { + /* No parent, must be root. This will never happen... */ + if ( !last && !be_isroot( op ) && !be_shadow_update( op )) + return LDAP_NO_SUCH_OBJECT; + if ( last && !access_allowed( op, last->ce_entry, + slap_schema.si_ad_children, NULL, ACL_WADD, NULL )) + return LDAP_INSUFFICIENT_ACCESS; + } + oc_at = attr_find( e->e_attrs, slap_schema.si_ad_objectClass ); if ( !oc_at ) return LDAP_OBJECT_CLASS_VIOLATION; @@ -3357,9 +3994,19 @@ config_add_internal( CfBackInfo *cfb, Entry *e, ConfigArgs *ca, SlapReply *rs, i * These entries can have auto-assigned indexes (appended to the end) * but only the other types support auto-renumbering of siblings. */ - rc = check_name_index( last, colst[0]->co_type, e, rs, renum ); - if ( rc ) - goto done; + { + int renumber = renum ? *renum : 0; + rc = check_name_index( last, colst[0]->co_type, e, rs, renum ); + if ( rc ) { + goto done; + } + if ( renum && *renum && renumber == -1 ) { + snprintf( ca->msg, sizeof( ca->msg ), + "operation requires sibling renumbering" ); + rc = LDAP_UNWILLING_TO_PERFORM; + goto done; + } + } init_config_argv( ca ); @@ -3386,7 +4033,7 @@ config_add_internal( CfBackInfo *cfb, Entry *e, ConfigArgs *ca, SlapReply *rs, i if ( ptr ) ca->line = ptr+1; } ca->valx = i; - rc = config_parse_add( ct, ca ); + rc = config_parse_add( ct, ca, i ); if ( rc ) { rc = LDAP_OTHER; goto done; @@ -3408,7 +4055,7 @@ ok: } } if ( rc ) { - sprintf( ca->msg, "<%s> failed startup", ca->argv[0] ); + snprintf( ca->msg, sizeof( ca->msg ), "<%s> failed startup", ca->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s (%s)!\n", ca->log, ca->msg, ca->argv[1] ); rc = LDAP_OTHER; @@ -3461,7 +4108,8 @@ config_back_add( Operation *op, SlapReply *rs ) int renumber; ConfigArgs ca; - if ( !be_isroot( op ) ) { + if ( !access_allowed( op, op->ora_e, slap_schema.si_ad_entry, + NULL, ACL_WADD, NULL )) { rs->sr_err = LDAP_INSUFFICIENT_ACCESS; goto out; } @@ -3477,30 +4125,44 @@ config_back_add( Operation *op, SlapReply *rs ) * 4) store entry in underlying database * 5) perform any necessary renumbering */ - rs->sr_err = config_add_internal( cfb, op->ora_e, &ca, rs, &renumber ); + /* NOTE: by now we do not accept adds that require renumbering */ + renumber = -1; + rs->sr_err = config_add_internal( cfb, op->ora_e, &ca, rs, &renumber, op ); if ( rs->sr_err != LDAP_SUCCESS ) { rs->sr_text = ca.msg; - } else if ( cfb->cb_use_ldif ) { + goto out2; + } + + if ( cfb->cb_use_ldif ) { BackendDB *be = op->o_bd; slap_callback sc = { NULL, slap_null_cb, NULL, NULL }; + struct berval dn, ndn; + op->o_bd = &cfb->cb_db; - /* FIXME: there must be a better way. */ - if ( ber_bvcmp( &op->o_bd->be_rootndn, &be->be_rootndn )) { - op->o_bd->be_rootdn = be->be_rootdn; - op->o_bd->be_rootndn= be->be_rootndn; - } + + /* Save current rootdn; use the underlying DB's rootdn */ + dn = op->o_dn; + ndn = op->o_ndn; + op->o_dn = op->o_bd->be_rootdn; + op->o_ndn = op->o_bd->be_rootndn; + sc.sc_next = op->o_callback; op->o_callback = ≻ op->o_bd->be_add( op, rs ); op->o_bd = be; op->o_callback = sc.sc_next; + op->o_dn = dn; + op->o_ndn = ndn; } + if ( renumber ) { + /* TODO */ } +out2:; ldap_pvt_thread_pool_resume( &connection_pool ); -out: +out:; send_ldap_result( op, rs ); return rs->sr_err; } @@ -3537,6 +4199,7 @@ config_modify_internal( CfEntryInfo *ce, Operation *op, SlapReply *rs, ca->bi = ce->ce_bi; ca->private = ce->ce_private; ca->ca_entry = e; + ca->fname = "slapd"; strcpy( ca->log, "back-config" ); for (ml = op->orm_modlist; ml; ml=ml->sml_next) { @@ -3544,7 +4207,7 @@ config_modify_internal( CfEntryInfo *ce, Operation *op, SlapReply *rs, switch (ml->sml_op) { case LDAP_MOD_DELETE: case LDAP_MOD_REPLACE: { - BerVarray vals = NULL, nvals; + BerVarray vals = NULL, nvals = NULL; int *idx = NULL; if ( ct && ( ct->arg_type & ARG_NO_DELETE )) { rc = LDAP_OTHER; @@ -3602,9 +4265,13 @@ config_modify_internal( CfEntryInfo *ce, Operation *op, SlapReply *rs, } for ( i=0; !BER_BVISNULL( &ml->sml_values[i] ); i++ ) { if ( ml->sml_values[i].bv_val[0] == '{' && - navals >= 0 ) { - int j = strtol( ml->sml_values[i].bv_val+1, NULL, 0 ); - if ( j < navals ) { + navals >= 0 ) + { + char *next, *val = ml->sml_values[i].bv_val + 1; + int j; + + j = strtol( val, &next, 0 ); + if ( next == val || next[ 0 ] != '}' || j < navals ) { rc = LDAP_OTHER; snprintf(ca->msg, sizeof(ca->msg), "cannot insert %s", ml->sml_desc->ad_cname.bv_val ); @@ -3643,7 +4310,7 @@ config_modify_internal( CfEntryInfo *ce, Operation *op, SlapReply *rs, if(rc == LDAP_SUCCESS) { /* check that the entry still obeys the schema */ - rc = entry_schema_check(op, e, NULL, 0, + rc = entry_schema_check(op, e, NULL, 0, 0, &rs->sr_text, ca->msg, sizeof(ca->msg) ); } if ( rc == LDAP_SUCCESS ) { @@ -3655,9 +4322,9 @@ config_modify_internal( CfEntryInfo *ce, Operation *op, SlapReply *rs, switch (ml->sml_op) { case LDAP_MOD_DELETE: case LDAP_MOD_REPLACE: { - BerVarray vals = NULL, nvals; + BerVarray vals = NULL, nvals = NULL; Attribute *a; - delrec *d; + delrec *d = NULL; a = attr_find( e->e_attrs, ml->sml_desc ); @@ -3705,8 +4372,9 @@ config_modify_internal( CfEntryInfo *ce, Operation *op, SlapReply *rs, if ( rc ) rc = LDAP_OTHER; } if ( ml->sml_values ) { + d = d->next; ch_free( dels ); - dels = d->next; + dels = d; } if ( ml->sml_op == LDAP_MOD_REPLACE ) { ml->sml_values = vals; @@ -3722,14 +4390,21 @@ config_modify_internal( CfEntryInfo *ce, Operation *op, SlapReply *rs, ca->line = ml->sml_values[i].bv_val; ca->valx = -1; if ( ml->sml_desc->ad_type->sat_flags & SLAP_AT_ORDERED && - ca->line[0] == '{' ) { - ptr = strchr( ca->line, '}' ); + ca->line[0] == '{' ) + { + ptr = strchr( ca->line + 1, '}' ); if ( ptr ) { - ca->valx = strtol( ca->line+1, NULL, 0 ); + char *next; + + ca->valx = strtol( ca->line + 1, &next, 0 ); + if ( next == ca->line + 1 || next[ 0 ] != '}' ) { + rc = LDAP_OTHER; + goto out; + } ca->line = ptr+1; } } - rc = config_parse_add( ct, ca ); + rc = config_parse_add( ct, ca, i ); if ( rc ) { rc = LDAP_OTHER; goto out; @@ -3752,6 +4427,11 @@ out: } ch_free( ca->argv ); if ( colst ) ch_free( colst ); + while( dels ) { + deltail = dels->next; + ch_free( dels ); + dels = deltail; + } return rc; } @@ -3767,11 +4447,6 @@ config_back_modify( Operation *op, SlapReply *rs ) char *ptr; AttributeDescription *rad = NULL; - if ( !be_isroot( op ) ) { - rs->sr_err = LDAP_INSUFFICIENT_ACCESS; - goto out; - } - cfb = (CfBackInfo *)op->o_bd->be_private; ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last ); @@ -3782,6 +4457,11 @@ config_back_modify( Operation *op, SlapReply *rs ) goto out; } + if ( !acl_check_modlist( op, ce->ce_entry, op->orm_modlist )) { + rs->sr_err = LDAP_INSUFFICIENT_ACCESS; + goto out; + } + /* Get type of RDN */ rdn = ce->ce_entry->e_nname; ptr = strchr( rdn.bv_val, '=' ); @@ -3812,16 +4492,22 @@ config_back_modify( Operation *op, SlapReply *rs ) } else if ( cfb->cb_use_ldif ) { BackendDB *be = op->o_bd; slap_callback sc = { NULL, slap_null_cb, NULL, NULL }; + struct berval dn, ndn; + op->o_bd = &cfb->cb_db; - if ( ber_bvcmp( &op->o_bd->be_rootndn, &be->be_rootndn )) { - op->o_bd->be_rootdn = be->be_rootdn; - op->o_bd->be_rootndn= be->be_rootndn; - } + + dn = op->o_dn; + ndn = op->o_ndn; + op->o_dn = op->o_bd->be_rootdn; + op->o_ndn = op->o_bd->be_rootndn; + sc.sc_next = op->o_callback; op->o_callback = ≻ op->o_bd->be_modify( op, rs ); op->o_bd = be; op->o_callback = sc.sc_next; + op->o_dn = dn; + op->o_ndn = ndn; } ldap_pvt_thread_pool_resume( &connection_pool ); @@ -3836,11 +4522,6 @@ config_back_modrdn( Operation *op, SlapReply *rs ) CfBackInfo *cfb; CfEntryInfo *ce, *last; - if ( !be_isroot( op ) ) { - rs->sr_err = LDAP_INSUFFICIENT_ACCESS; - goto out; - } - cfb = (CfBackInfo *)op->o_bd->be_private; ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last ); @@ -3850,6 +4531,22 @@ config_back_modrdn( Operation *op, SlapReply *rs ) rs->sr_err = LDAP_NO_SUCH_OBJECT; goto out; } + if ( !access_allowed( op, ce->ce_entry, slap_schema.si_ad_entry, + NULL, ACL_WRITE, NULL )) { + rs->sr_err = LDAP_INSUFFICIENT_ACCESS; + goto out; + } + { Entry *parent; + if ( ce->ce_parent ) + parent = ce->ce_parent->ce_entry; + else + parent = (Entry *)&slap_entry_root; + if ( !access_allowed( op, parent, slap_schema.si_ad_children, + NULL, ACL_WRITE, NULL )) { + rs->sr_err = LDAP_INSUFFICIENT_ACCESS; + goto out; + } + } /* We don't allow moving objects to new parents. * Generally we only allow reordering a set of ordered entries. @@ -3860,6 +4557,9 @@ config_back_modrdn( Operation *op, SlapReply *rs ) } ldap_pvt_thread_pool_pause( &connection_pool ); + rs->sr_err = LDAP_UNWILLING_TO_PERFORM; + rs->sr_text = "renaming not implemented yet within naming context"; + ldap_pvt_thread_pool_resume( &connection_pool ); out: send_ldap_result( op, rs ); @@ -3871,11 +4571,7 @@ config_back_search( Operation *op, SlapReply *rs ) { CfBackInfo *cfb; CfEntryInfo *ce, *last; - - if ( !be_isroot( op ) ) { - rs->sr_err = LDAP_INSUFFICIENT_ACCESS; - goto out; - } + slap_mask_t mask; cfb = (CfBackInfo *)op->o_bd->be_private; @@ -3886,6 +4582,16 @@ config_back_search( Operation *op, SlapReply *rs ) rs->sr_err = LDAP_NO_SUCH_OBJECT; goto out; } + if ( !access_allowed_mask( op, ce->ce_entry, slap_schema.si_ad_entry, NULL, + ACL_SEARCH, NULL, &mask )) + { + if ( !ACL_GRANT( mask, ACL_DISCLOSE )) { + rs->sr_err = LDAP_NO_SUCH_OBJECT; + } else { + rs->sr_err = LDAP_INSUFFICIENT_ACCESS; + } + goto out; + } switch ( op->ors_scope ) { case LDAP_SCOPE_BASE: case LDAP_SCOPE_SUBTREE: @@ -3918,7 +4624,9 @@ config_build_attrs( Entry *e, AttributeType **at, AttributeDescription *ad, for (i=0;ct[i].name;i++) { if (ct[i].ad == (*at)->sat_ad) { rc = config_get_vals(&ct[i], c); - if (rc == LDAP_SUCCESS) { + /* NOTE: tolerate that config_get_vals() + * returns success with no values */ + if (rc == LDAP_SUCCESS && c->rvalue_vals != NULL ) { if ( c->rvalue_nvals ) attr_merge(e, ct[i].ad, c->rvalue_vals, c->rvalue_nvals); @@ -3938,7 +4646,7 @@ Entry * config_build_entry( Operation *op, SlapReply *rs, CfEntryInfo *parent, ConfigArgs *c, struct berval *rdn, ConfigOCs *main, ConfigOCs *extra ) { - Entry *e = ch_calloc( 1, sizeof(Entry) ); + Entry *e = entry_alloc(); CfEntryInfo *ce = ch_calloc( 1, sizeof(CfEntryInfo) ); struct berval val; struct berval ad_name; @@ -3951,6 +4659,7 @@ config_build_entry( Operation *op, SlapReply *rs, CfEntryInfo *parent, ObjectClass *oc; CfEntryInfo *ceprev = NULL; + Debug( LDAP_DEBUG_TRACE, "config_build_entry: \"%s\"\n", rdn->bv_val, 0, 0); e->e_private = ce; ce->ce_entry = e; ce->ce_parent = parent; @@ -4004,12 +4713,16 @@ config_build_entry( Operation *op, SlapReply *rs, CfEntryInfo *parent, } oc_at = attr_find( e->e_attrs, slap_schema.si_ad_objectClass ); - rc = structural_class(oc_at->a_vals, &val, NULL, &text, c->msg, - sizeof(c->msg)); - attr_merge_normalize_one(e, slap_schema.si_ad_structuralObjectClass, &val, NULL ); - if ( op ) { + rc = structural_class(oc_at->a_vals, &oc, NULL, &text, c->msg, + sizeof(c->msg), op->o_tmpmemctx ); + attr_merge_normalize_one(e, slap_schema.si_ad_structuralObjectClass, &oc->soc_cname, NULL ); + if ( !op->o_noop ) { op->ora_e = e; op->o_bd->be_add( op, rs ); + if ( ( rs->sr_err != LDAP_SUCCESS ) + && (rs->sr_err != LDAP_ALREADY_EXISTS) ) { + return NULL; + } } if ( ceprev ) { ceprev->ce_sibs = ce; @@ -4020,7 +4733,7 @@ config_build_entry( Operation *op, SlapReply *rs, CfEntryInfo *parent, return e; } -static void +static int config_build_schema_inc( ConfigArgs *c, CfEntryInfo *ceparent, Operation *op, SlapReply *rs ) { @@ -4041,7 +4754,11 @@ config_build_schema_inc( ConfigArgs *c, CfEntryInfo *ceparent, ptr = strchr( bv.bv_val, '.' ); if ( ptr ) bv.bv_len = ptr - bv.bv_val; - c->value_dn.bv_len = sprintf(c->value_dn.bv_val, "cn=" IFMT, c->depth); + c->value_dn.bv_len = snprintf(c->value_dn.bv_val, sizeof( c->log ), "cn=" SLAP_X_ORDERED_FMT, c->depth); + if ( c->value_dn.bv_len >= sizeof( c->log ) ) { + /* FIXME: how can indicate error? */ + return -1; + } strncpy( c->value_dn.bv_val + c->value_dn.bv_len, bv.bv_val, bv.bv_len ); c->value_dn.bv_len += bv.bv_len; @@ -4050,14 +4767,17 @@ config_build_schema_inc( ConfigArgs *c, CfEntryInfo *ceparent, c->private = cf; e = config_build_entry( op, rs, ceparent, c, &c->value_dn, &CFOC_SCHEMA, NULL ); - if ( e && cf->c_kids ) { + if ( !e ) { + return -1; + } else if ( e && cf->c_kids ) { c->private = cf->c_kids; config_build_schema_inc( c, e->e_private, op, rs ); } } + return 0; } -static void +static int config_build_includes( ConfigArgs *c, CfEntryInfo *ceparent, Operation *op, SlapReply *rs ) { @@ -4067,20 +4787,27 @@ config_build_includes( ConfigArgs *c, CfEntryInfo *ceparent, for (i=0; cf; cf=cf->c_sibs, i++) { c->value_dn.bv_val = c->log; - c->value_dn.bv_len = sprintf(c->value_dn.bv_val, "cn=include" IFMT, i); + c->value_dn.bv_len = snprintf(c->value_dn.bv_val, sizeof( c->log ), "cn=include" SLAP_X_ORDERED_FMT, i); + if ( c->value_dn.bv_len >= sizeof( c->log ) ) { + /* FIXME: how can indicate error? */ + return -1; + } c->private = cf; e = config_build_entry( op, rs, ceparent, c, &c->value_dn, &CFOC_INCLUDE, NULL ); - if ( e && cf->c_kids ) { + if ( ! e ) { + return -1; + } else if ( e && cf->c_kids ) { c->private = cf->c_kids; config_build_includes( c, e->e_private, op, rs ); } } + return 0; } #ifdef SLAPD_MODULES -static void +static int config_build_modules( ConfigArgs *c, CfEntryInfo *ceparent, Operation *op, SlapReply *rs ) { @@ -4091,14 +4818,105 @@ config_build_modules( ConfigArgs *c, CfEntryInfo *ceparent, if ( BER_BVISNULL( &mp->mp_path ) && !mp->mp_loads ) continue; c->value_dn.bv_val = c->log; - c->value_dn.bv_len = sprintf(c->value_dn.bv_val, "cn=module" IFMT, i); + c->value_dn.bv_len = snprintf(c->value_dn.bv_val, sizeof( c->log ), "cn=module" SLAP_X_ORDERED_FMT, i); + if ( c->value_dn.bv_len >= sizeof( c->log ) ) { + /* FIXME: how can indicate error? */ + return -1; + } c->private = mp; - config_build_entry( op, rs, ceparent, c, &c->value_dn, - &CFOC_MODULE, NULL ); + if ( ! config_build_entry( op, rs, ceparent, c, &c->value_dn, &CFOC_MODULE, NULL )) { + return -1; + } } + return 0; } #endif +static int +config_check_schema(CfBackInfo *cfb) +{ + struct berval schema_dn = BER_BVC(SCHEMA_RDN "," CONFIG_RDN); + ConfigArgs c = {0}; + ConfigFile *cf = cfb->cb_config; + CfEntryInfo *ce, *last; + Entry *e; + + /* If there's no root entry, we must be in the midst of converting */ + if ( !cfb->cb_root ) + return 0; + + /* Make sure the main schema entry exists */ + ce = config_find_base( cfb->cb_root, &schema_dn, &last ); + if ( ce ) { + Attribute *a; + struct berval *bv; + + e = ce->ce_entry; + + /* Make sure it's up to date */ + if ( cf_om_tail != om_sys_tail ) { + a = attr_find( e->e_attrs, cfAd_om ); + if ( a ) { + if ( a->a_nvals != a->a_vals ) + ber_bvarray_free( a->a_nvals ); + ber_bvarray_free( a->a_vals ); + a->a_vals = NULL; + a->a_nvals = NULL; + } + oidm_unparse( &bv, NULL, NULL, 1 ); + attr_merge_normalize( e, cfAd_om, bv, NULL ); + ber_bvarray_free( bv ); + cf_om_tail = om_sys_tail; + } + if ( cf_at_tail != at_sys_tail ) { + a = attr_find( e->e_attrs, cfAd_attr ); + if ( a ) { + if ( a->a_nvals != a->a_vals ) + ber_bvarray_free( a->a_nvals ); + ber_bvarray_free( a->a_vals ); + a->a_vals = NULL; + a->a_nvals = NULL; + } + at_unparse( &bv, NULL, NULL, 1 ); + attr_merge_normalize( e, cfAd_attr, bv, NULL ); + ber_bvarray_free( bv ); + cf_at_tail = at_sys_tail; + } + if ( cf_oc_tail != oc_sys_tail ) { + a = attr_find( e->e_attrs, cfAd_oc ); + if ( a ) { + if ( a->a_nvals != a->a_vals ) + ber_bvarray_free( a->a_nvals ); + ber_bvarray_free( a->a_vals ); + a->a_vals = NULL; + a->a_nvals = NULL; + } + oc_unparse( &bv, NULL, NULL, 1 ); + attr_merge_normalize( e, cfAd_oc, bv, NULL ); + ber_bvarray_free( bv ); + cf_oc_tail = oc_sys_tail; + } + } else { + SlapReply rs = {REP_RESULT}; + c.private = NULL; + e = config_build_entry( NULL, &rs, cfb->cb_root, &c, &schema_rdn, + &CFOC_SCHEMA, NULL ); + if ( !e ) { + return -1; + } + ce = e->e_private; + ce->ce_private = cfb->cb_config; + cf_at_tail = at_sys_tail; + cf_oc_tail = oc_sys_tail; + cf_om_tail = om_sys_tail; + } + return 0; +} + +static const char *defacl[] = { + NULL, "to", "*", "by", "*", "none", NULL +}; + static int config_back_db_open( BackendDB *be ) { @@ -4106,7 +4924,7 @@ config_back_db_open( BackendDB *be ) struct berval rdn; Entry *e, *parent; CfEntryInfo *ce, *ceparent; - int i; + int i, unsupp = 0; BackendInfo *bi; ConfigArgs c; Connection conn = {0}; @@ -4116,23 +4934,32 @@ config_back_db_open( BackendDB *be ) SlapReply rs = {REP_RESULT}; void *thrctx = NULL; - /* If we read the config from back-ldif, nothing to do here */ - if ( cfb->cb_got_ldif ) - return 0; + Debug( LDAP_DEBUG_TRACE, "config_back_db_open\n", 0, 0, 0); - if ( cfb->cb_use_ldif ) { - thrctx = ldap_pvt_thread_pool_context(); - op = (Operation *) &opbuf; - connection_fake_init( &conn, op, thrctx ); + /* If we have no explicitly configured ACLs, don't just use + * the global ACLs. Explicitly deny access to everything. + */ + if ( frontendDB->be_acl && be->be_acl == frontendDB->be_acl ) { + parse_acl(be, "config_back_db_open", 0, 6, (char **)defacl, 0 ); + } - op->o_dn = be->be_rootdn; - op->o_ndn = be->be_rootndn; + /* If we read the config from back-ldif, do some quick sanity checks */ + if ( cfb->cb_got_ldif ) { + return config_check_schema( cfb ); + } - op->o_tag = LDAP_REQ_ADD; - op->o_callback = &cb; - op->o_bd = &cfb->cb_db; - } else { - op = NULL; + thrctx = ldap_pvt_thread_pool_context(); + op = (Operation *) &opbuf; + connection_fake_init( &conn, op, thrctx ); + + op->o_tag = LDAP_REQ_ADD; + op->o_callback = &cb; + op->o_bd = &cfb->cb_db; + op->o_dn = op->o_bd->be_rootdn; + op->o_ndn = op->o_bd->be_rootndn; + + if ( !cfb->cb_use_ldif ) { + op->o_noop = 1; } /* create root of tree */ @@ -4140,6 +4967,9 @@ config_back_db_open( BackendDB *be ) c.private = cfb->cb_config; c.be = frontendDB; e = config_build_entry( op, &rs, NULL, &c, &rdn, &CFOC_GLOBAL, NULL ); + if ( !e ) { + return -1; + } ce = e->e_private; cfb->cb_root = ce; @@ -4150,13 +4980,17 @@ config_back_db_open( BackendDB *be ) if ( cfb->cb_config->c_kids ) { c.depth = 0; c.private = cfb->cb_config->c_kids; - config_build_includes( &c, ceparent, op, &rs ); + if ( config_build_includes( &c, ceparent, op, &rs ) ) { + return -1; + } } #ifdef SLAPD_MODULES /* Create Module nodes... */ if ( modpaths.mp_loads ) { - config_build_modules( &c, ceparent, op, &rs ); + if ( config_build_modules( &c, ceparent, op, &rs ) ){ + return -1; + } } #endif @@ -4167,13 +5001,22 @@ config_back_db_open( BackendDB *be ) rdn = schema_rdn; c.private = NULL; e = config_build_entry( op, &rs, ceparent, &c, &rdn, &CFOC_SCHEMA, NULL ); + if ( !e ) { + return -1; + } ce = e->e_private; + ce->ce_private = cfb->cb_config; + cf_at_tail = at_sys_tail; + cf_oc_tail = oc_sys_tail; + cf_om_tail = om_sys_tail; /* Create schema nodes for included schema... */ if ( cfb->cb_config->c_kids ) { c.depth = 0; c.private = cfb->cb_config->c_kids; - config_build_schema_inc( &c, ce, op, &rs ); + if (config_build_schema_inc( &c, ce, op, &rs )) { + return -1; + } } /* Create backend nodes. Skip if they don't provide a cf_table. @@ -4182,14 +5025,30 @@ config_back_db_open( BackendDB *be ) c.line = 0; LDAP_STAILQ_FOREACH( bi, &backendInfo, bi_next) { - if (!bi->bi_cf_ocs) continue; + if (!bi->bi_cf_ocs) { + /* If it only supports the old config mech, complain. */ + if ( bi->bi_config ) { + Debug( LDAP_DEBUG_ANY, + "WARNING: No dynamic config support for backend %s.\n", + bi->bi_type, 0, 0 ); + unsupp++; + } + continue; + } if (!bi->bi_private) continue; rdn.bv_val = c.log; - rdn.bv_len = sprintf(rdn.bv_val, "%s=%s", cfAd_backend->ad_cname.bv_val, bi->bi_type); + rdn.bv_len = snprintf(rdn.bv_val, sizeof( c.log ), + "%s=%s", cfAd_backend->ad_cname.bv_val, bi->bi_type); + if ( rdn.bv_len >= sizeof( c.log ) ) { + /* FIXME: holler ... */ ; + } c.bi = bi; e = config_build_entry( op, &rs, ceparent, &c, &rdn, &CFOC_BACKEND, bi->bi_cf_ocs ); + if ( !e ) { + return -1; + } } /* Create database nodes... */ @@ -4205,13 +5064,30 @@ config_back_db_open( BackendDB *be ) } else { bi = be->bd_info; } + + /* If this backend supports the old config mechanism, but not + * the new mech, complain. + */ + if ( !be->be_cf_ocs && bi->bi_db_config ) { + Debug( LDAP_DEBUG_ANY, + "WARNING: No dynamic config support for database %s.\n", + bi->bi_type, 0, 0 ); + unsupp++; + } rdn.bv_val = c.log; - rdn.bv_len = sprintf(rdn.bv_val, "%s=" IFMT "%s", cfAd_database->ad_cname.bv_val, + rdn.bv_len = snprintf(rdn.bv_val, sizeof( c.log ), + "%s=" SLAP_X_ORDERED_FMT "%s", cfAd_database->ad_cname.bv_val, i, bi->bi_type); + if ( rdn.bv_len >= sizeof( c.log ) ) { + /* FIXME: holler ... */ ; + } c.be = be; c.bi = bi; e = config_build_entry( op, &rs, ceparent, &c, &rdn, &CFOC_DATABASE, be->be_cf_ocs ); + if ( !e ) { + return -1; + } ce = e->e_private; if ( be->be_cf_ocs && be->be_cf_ocs->co_cfadd ) be->be_cf_ocs->co_cfadd( op, &rs, e, &c ); @@ -4222,13 +5098,26 @@ config_back_db_open( BackendDB *be ) int j; for (j=0,on=oi->oi_list; on; j++,on=on->on_next) { + if ( on->on_bi.bi_db_config && !on->on_bi.bi_cf_ocs ) { + Debug( LDAP_DEBUG_ANY, + "WARNING: No dynamic config support for overlay %s.\n", + on->on_bi.bi_type, 0, 0 ); + unsupp++; + } rdn.bv_val = c.log; - rdn.bv_len = sprintf(rdn.bv_val, "%s=" IFMT "%s", + rdn.bv_len = snprintf(rdn.bv_val, sizeof( c.log ), + "%s=" SLAP_X_ORDERED_FMT "%s", cfAd_overlay->ad_cname.bv_val, j, on->on_bi.bi_type ); + if ( rdn.bv_len >= sizeof( c.log ) ) { + /* FIXME: holler ... */ ; + } c.be = be; c.bi = &on->on_bi; oe = config_build_entry( op, &rs, ce, &c, &rdn, &CFOC_OVERLAY, c.bi->bi_cf_ocs ); + if ( !oe ) { + return -1; + } if ( c.bi->bi_cf_ocs && c.bi->bi_cf_ocs->co_cfadd ) c.bi->bi_cf_ocs->co_cfadd( op, &rs, oe, &c ); } @@ -4237,6 +5126,11 @@ config_back_db_open( BackendDB *be ) if ( thrctx ) ldap_pvt_thread_pool_context_reset( thrctx ); + if ( unsupp && cfb->cb_use_ldif ) { + Debug( LDAP_DEBUG_ANY, "\nWARNING: The converted cn=config " + "directory is incomplete and may not work.\n\n", 0, 0, 0 ); + } + return 0; } @@ -4305,8 +5199,6 @@ config_back_db_destroy( BackendDB *be ) backend_destroy_one( &cfb->cb_db, 0 ); } - free( be->be_private ); - loglevel_destroy(); return 0; @@ -4318,7 +5210,7 @@ config_back_db_init( BackendDB *be ) struct berval dn; CfBackInfo *cfb; - cfb = ch_calloc( 1, sizeof(CfBackInfo)); + cfb = &cfBackInfo; cfb->cb_config = ch_calloc( 1, sizeof(ConfigFile)); cfn = cfb->cb_config; be->be_private = cfb; @@ -4412,7 +5304,7 @@ config_tool_entry_put( BackendDB *be, Entry *e, struct berval *text ) ConfigArgs ca; if ( bi && bi->bi_tool_entry_put && - config_add_internal( cfb, e, &ca, NULL, NULL ) == 0 ) + config_add_internal( cfb, e, &ca, NULL, NULL, NULL ) == 0 ) return bi->bi_tool_entry_put( &cfb->cb_db, e, text ); else return NOID; @@ -4422,9 +5314,12 @@ static struct { char *name; AttributeDescription **desc; } ads[] = { + { "attribute", &cfAd_attr }, { "backend", &cfAd_backend }, { "database", &cfAd_database }, { "include", &cfAd_include }, + { "objectclass", &cfAd_oc }, + { "objectidentifier", &cfAd_om }, { "overlay", &cfAd_overlay }, { NULL, NULL } }; @@ -4456,6 +5351,7 @@ int config_back_initialize( BackendInfo *bi ) { ConfigTable *ct = config_back_cf_table; + ConfigArgs ca; char *argv[4]; int i; AttributeDescription *ad = NULL; @@ -4465,6 +5361,9 @@ config_back_initialize( BackendInfo *bi ) NULL }; + /* Make sure we don't exceed the bits reserved for userland */ + config_check_userland( CFG_LAST ); + bi->bi_controls = controls; bi->bi_open = 0; @@ -4492,9 +5391,7 @@ config_back_initialize( BackendInfo *bi ) bi->bi_chk_referrals = 0; -#ifdef SLAP_OVERLAY_ACCESS - bi->bi_access_allowed = slap_access_always_allowed; -#endif /* SLAP_OVERLAY_ACCESS */ + bi->bi_access_allowed = slap_access_allowed; bi->bi_connection_init = 0; bi->bi_connection_destroy = 0; @@ -4506,14 +5403,17 @@ config_back_initialize( BackendInfo *bi ) bi->bi_tool_entry_get = config_tool_entry_get; bi->bi_tool_entry_put = config_tool_entry_put; - /* Make sure we don't exceed the bits reserved for userland */ - assert( ( ( CFG_LAST - 1 ) & ARGS_USERLAND ) == ( CFG_LAST - 1 ) ); + ca.argv = argv; + argv[ 0 ] = "slapd"; + ca.argv = argv; + ca.argc = 3; + ca.fname = argv[0]; argv[3] = NULL; for (i=0; OidMacros[i].name; i++ ) { argv[1] = OidMacros[i].name; argv[2] = OidMacros[i].oid; - parse_oidm( "slapd", i, 3, argv, 0, NULL ); + parse_oidm( &ca, 0, NULL ); } bi->bi_cf_ocs = cf_ocs;