X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fbconfig.c;h=6efd2d2df6aeacb80cdbee6ba6c32f8ddfa3cd7f;hb=7684514535dbe9f407b420bab76f06861ad7587d;hp=8667d72c528d0dae3698d32cd25810ccddabade1;hpb=194aa68dab3f346ed8453794c1555f3e6dcd6369;p=openldap diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c index 8667d72c52..6efd2d2df6 100644 --- a/servers/slapd/bconfig.c +++ b/servers/slapd/bconfig.c @@ -2,7 +2,7 @@ /* $OpenLDAP$ */ /* This work is part of OpenLDAP Software . * - * Copyright 2005 The OpenLDAP Foundation. + * Copyright 2005-2006 The OpenLDAP Foundation. * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -37,10 +37,13 @@ #include "config.h" -static struct berval config_rdn = BER_BVC("cn=config"); -static struct berval schema_rdn = BER_BVC("cn=schema"); +#define CONFIG_RDN "cn=config" +#define SCHEMA_RDN "cn=schema" -#define SLAP_X_ORDERED_FMT "{%d}" +static struct berval config_rdn = BER_BVC(CONFIG_RDN); +static struct berval schema_rdn = BER_BVC(SCHEMA_RDN); + +extern int slap_DN_strict; /* dn.c */ #ifdef SLAPD_MODULES typedef struct modpath_s { @@ -71,11 +74,7 @@ typedef struct { int cb_use_ldif; } CfBackInfo; -/* These do nothing in slapd, they're kept only to make them - * editable here. - */ -static char *replica_pidFile, *replica_argsFile; -static int replicationInterval; +static CfBackInfo cfBackInfo; static char *passwd_salt; static char *logfileName; @@ -87,14 +86,24 @@ static struct berval cfdir; /* Private state */ static AttributeDescription *cfAd_backend, *cfAd_database, *cfAd_overlay, - *cfAd_include; + *cfAd_include, *cfAd_attr, *cfAd_oc, *cfAd_om; static ConfigFile *cfn; static Avlnode *CfOcTree; +/* System schema state */ +extern AttributeType *at_sys_tail; /* at.c */ +extern ObjectClass *oc_sys_tail; /* oc.c */ +extern OidMacro *om_sys_tail; /* oidm.c */ +static AttributeType *cf_at_tail; +static ObjectClass *cf_oc_tail; +static OidMacro *cf_om_tail; + static int config_add_internal( CfBackInfo *cfb, Entry *e, ConfigArgs *ca, - SlapReply *rs, int *renumber ); + SlapReply *rs, int *renumber, Operation *op ); + +static int config_check_schema( CfBackInfo *cfb ); static ConfigDriver config_fname; static ConfigDriver config_cfdir; @@ -151,6 +160,9 @@ enum { CFG_DIT, CFG_ATTR, CFG_ATOPT, + CFG_REPLICA_ARGSFILE, + CFG_REPLICA_PIDFILE, + CFG_REPLICATIONINTERVAL, CFG_REPLOG, CFG_ROOTDSE, CFG_LOGFILE, @@ -164,6 +176,9 @@ enum { CFG_SSTR_IF_MAX, CFG_SSTR_IF_MIN, CFG_TTHREADS, + CFG_MIRRORMODE, + CFG_HIDDEN, + CFG_MONITORING, CFG_LAST }; @@ -186,10 +201,11 @@ static OidRec OidMacros[] = { { "OLcfgDbOc", "OLcfgOc:2" }, { "OLcfgOvOc", "OLcfgOc:3" }, { "OMsyn", "1.3.6.1.4.1.1466.115.121.1" }, - { "OMsInteger", "OMsyn:27" }, { "OMsBoolean", "OMsyn:7" }, { "OMsDN", "OMsyn:12" }, { "OMsDirectoryString", "OMsyn:15" }, + { "OMsInteger", "OMsyn:27" }, + { "OMsOID", "OMsyn:38" }, { "OMsOctetString", "OMsyn:40" }, { NULL, NULL } }; @@ -198,9 +214,9 @@ static OidRec OidMacros[] = { * Backend/Database registry * * OLcfg{Bk|Db}{Oc|At}:0 -> common - * OLcfg{Bk|Db}{Oc|At}:1 -> bdb - * OLcfg{Bk|Db}{Oc|At}:2 -> ldif - * OLcfg{Bk|Db}{Oc|At}:3 -> ldap? + * OLcfg{Bk|Db}{Oc|At}:1 -> back-bdb(/back-hdb) + * OLcfg{Bk|Db}{Oc|At}:2 -> back-ldif + * OLcfg{Bk|Db}{Oc|At}:3 -> back-ldap */ /* @@ -211,7 +227,17 @@ static OidRec OidMacros[] = { * OLcfgOv{Oc|At}:3 -> chain * OLcfgOv{Oc|At}:4 -> accesslog * OLcfgOv{Oc|At}:5 -> valsort - * OLcfgOv{Oc|At}:6 -> smbk5pwd (use a separate arc for contrib?) + * (FIXME: separate arc for contribware?) + * OLcfgOv{Oc|At}:6 -> smbk5pwd + * OLcfgOv{Oc|At}:7 -> distproc + * OLcfgOv{Oc|At}:8 -> dynlist + * OLcfgOv{Oc|At}:9 -> dds + * OLcfgOv{Oc|At}:10 -> unique + * OLcfgOv{Oc|At}:11 -> refint + * OLcfgOv{Oc|At}:12 -> ppolicy + * OLcfgOv{Oc|At}:13 -> constraint + * OLcfgOv{Oc|At}:14 -> translucent + * OLcfgOv{Oc|At}:15 -> auditlog */ /* alphabetical ordering */ @@ -247,8 +273,8 @@ static ConfigTable config_back_cf_table[] = { &config_generic, "( OLcfgGlAt:5 NAME 'olcAttributeOptions' " "EQUALITY caseIgnoreMatch " "SYNTAX OMsDirectoryString )", NULL, NULL }, - { "attribute", "attribute", 2, 0, 9, - ARG_PAREN|ARG_MAGIC|CFG_ATTR|ARG_NO_DELETE|ARG_NO_INSERT, + { "attribute", "attribute", 2, 0, STRLENOF( "attribute" ), + ARG_PAREN|ARG_MAGIC|CFG_ATTR, &config_generic, "( OLcfgGlAt:4 NAME 'olcAttributeTypes' " "DESC 'OpenLDAP attributeTypes' " "EQUALITY caseIgnoreMatch " @@ -311,6 +337,9 @@ static ConfigTable config_back_cf_table[] = { #endif "( OLcfgGlAt:17 NAME 'olcGentleHUP' " "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL }, + { "hidden", "on|off", 2, 2, 0, ARG_DB|ARG_ON_OFF|ARG_MAGIC|CFG_HIDDEN, + &config_generic, "( OLcfgDbAt:0.17 NAME 'olcHidden' " + "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL }, { "idletimeout", "timeout", 2, 2, 0, ARG_INT, &global_idletimeout, "( OLcfgGlAt:18 NAME 'olcIdleTimeout' " "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL }, @@ -334,6 +363,7 @@ static ConfigTable config_back_cf_table[] = { "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL }, { "limits", "limits", 2, 0, 0, ARG_DB|ARG_MAGIC|CFG_LIMITS, &config_generic, "( OLcfgDbAt:0.5 NAME 'olcLimits' " + "EQUALITY caseIgnoreMatch " "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL }, { "localSSF", "ssf", 2, 2, 0, ARG_INT, &local_ssf, "( OLcfgGlAt:26 NAME 'olcLocalSSF' " @@ -343,10 +373,14 @@ static ConfigTable config_back_cf_table[] = { "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, { "loglevel", "level", 2, 0, 0, ARG_MAGIC, &config_loglevel, "( OLcfgGlAt:28 NAME 'olcLogLevel' " + "EQUALITY caseIgnoreMatch " "SYNTAX OMsDirectoryString )", NULL, NULL }, { "maxDerefDepth", "depth", 2, 2, 0, ARG_DB|ARG_INT|ARG_MAGIC|CFG_DEPTH, &config_generic, "( OLcfgDbAt:0.6 NAME 'olcMaxDerefDepth' " "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL }, + { "mirrormode", "on|off", 2, 2, 0, ARG_DB|ARG_ON_OFF|ARG_MAGIC|CFG_MIRRORMODE, + &config_generic, "( OLcfgDbAt:0.16 NAME 'olcMirrorMode' " + "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL }, { "moduleload", "file", 2, 0, 0, #ifdef SLAPD_MODULES ARG_MAGIC|CFG_MODLOAD, &config_generic, @@ -354,6 +388,7 @@ static ConfigTable config_back_cf_table[] = { ARG_IGNORED, NULL, #endif "( OLcfgGlAt:30 NAME 'olcModuleLoad' " + "EQUALITY caseIgnoreMatch " "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL }, { "modulepath", "path", 2, 2, 0, #ifdef SLAPD_MODULES @@ -363,14 +398,19 @@ static ConfigTable config_back_cf_table[] = { #endif "( OLcfgGlAt:31 NAME 'olcModulePath' " "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, - { "objectclass", "objectclass", 2, 0, 0, ARG_PAREN|ARG_MAGIC|CFG_OC|ARG_NO_DELETE|ARG_NO_INSERT, + { "monitoring", "TRUE|FALSE", 2, 2, 0, + ARG_MAGIC|CFG_MONITORING|ARG_DB|ARG_ON_OFF, &config_generic, + "( OLcfgDbAt:0.18 NAME 'olcMonitoring' " + "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL }, + { "objectclass", "objectclass", 2, 0, 0, ARG_PAREN|ARG_MAGIC|CFG_OC, &config_generic, "( OLcfgGlAt:32 NAME 'olcObjectClasses' " "DESC 'OpenLDAP object classes' " "EQUALITY caseIgnoreMatch " "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )", NULL, NULL }, - { "objectidentifier", NULL, 0, 0, 0, ARG_MAGIC|CFG_OID, + { "objectidentifier", "name> op == SLAP_CONFIG_EMIT ) { @@ -742,7 +797,8 @@ config_generic(ConfigArgs *c) { break; } bv.bv_val = buf + bv.bv_len; - limits_unparse( c->be->be_limits[i], &bv ); + limits_unparse( c->be->be_limits[i], &bv, + sizeof( buf ) - ( bv.bv_val - buf ) ); bv.bv_len += bv.bv_val - buf; bv.bv_val = buf; value_add_one( &c->rvalue_vals, &bv ); @@ -776,6 +832,13 @@ config_generic(ConfigArgs *c) { case CFG_DEPTH: c->value_int = c->be->be_max_deref_depth; break; + case CFG_HIDDEN: + if ( SLAP_DBHIDDEN( c->be )) { + c->value_int = 1; + } else { + rc = 1; + } + break; case CFG_OID: { ConfigFile *cf = c->private; if ( !cf ) @@ -787,6 +850,9 @@ config_generic(ConfigArgs *c) { rc = 1; } break; + case CFG_ATOPT: + ad_unparse_options( &c->rvalue_vals ); + break; case CFG_OC: { ConfigFile *cf = c->private; if ( !cf ) @@ -838,7 +904,7 @@ config_generic(ConfigArgs *c) { AC_MEMCPY( abv.bv_val, ibuf, abv.bv_len ); /* Turn TAB / EOL into plain space */ for (src=bv.bv_val,dst=abv.bv_val+abv.bv_len; *src; src++) { - if (isspace(*src)) *dst++ = ' '; + if (isspace((unsigned char)*src)) *dst++ = ' '; else *dst++ = *src; } *dst = '\0'; @@ -852,6 +918,21 @@ config_generic(ConfigArgs *c) { rc = (!i); break; } + case CFG_REPLICA_ARGSFILE: + if ( c->be->be_replica_argsfile ) + c->value_string = ch_strdup( c->be->be_replica_argsfile ); + break; + case CFG_REPLICA_PIDFILE: + if ( c->be->be_replica_pidfile ) + c->value_string = ch_strdup( c->be->be_replica_pidfile ); + break; + case CFG_REPLICATIONINTERVAL: + if ( c->be->be_replicationinterval > 0 ) { + c->value_int = c->be->be_replicationinterval; + } else { + rc = 1; + } + break; case CFG_REPLOG: if ( c->be->be_replogfile ) c->value_string = ch_strdup( c->be->be_replogfile ); @@ -874,6 +955,15 @@ config_generic(ConfigArgs *c) { case CFG_LASTMOD: c->value_int = (SLAP_NOLASTMOD(c->be) == 0); break; + case CFG_MIRRORMODE: + if ( SLAP_SHADOW(c->be)) + c->value_int = (SLAP_SINGLE_SHADOW(c->be) == 0); + else + rc = 1; + break; + case CFG_MONITORING: + c->value_int = (SLAP_DBMONITORING(c->be) != 0); + break; case CFG_SSTR_IF_MAX: c->value_int = index_substr_if_maxlen; break; @@ -960,6 +1050,8 @@ config_generic(ConfigArgs *c) { case CFG_AZPOLICY: case CFG_DEPTH: case CFG_LASTMOD: + case CFG_MIRRORMODE: + case CFG_MONITORING: case CFG_SASLSECP: case CFG_SSTR_IF_MAX: case CFG_SSTR_IF_MIN: @@ -978,6 +1070,20 @@ config_generic(ConfigArgs *c) { passwd_salt = NULL; break; + case CFG_REPLICA_ARGSFILE: + ch_free( c->be->be_replica_argsfile ); + c->be->be_replica_argsfile = NULL; + break; + + case CFG_REPLICA_PIDFILE: + ch_free( c->be->be_replica_pidfile ); + c->be->be_replica_pidfile = NULL; + break; + + case CFG_REPLICATIONINTERVAL: + c->be->be_replicationinterval = 0; + break; + case CFG_REPLOG: ch_free( c->be->be_replogfile ); c->be->be_replogfile = NULL; @@ -988,6 +1094,10 @@ config_generic(ConfigArgs *c) { logfileName = NULL; break; + case CFG_HIDDEN: + c->be->be_flags &= ~SLAP_DBFLAG_HIDDEN; + break; + case CFG_ACL: if ( c->valx < 0 ) { AccessControl *end; @@ -1012,6 +1122,76 @@ config_generic(ConfigArgs *c) { } break; + case CFG_OC: { + CfEntryInfo *ce = c->ca_entry->e_private; + /* can't modify the hardcoded schema */ + if ( ce->ce_parent->ce_type == Cft_Global ) + return 1; + } + cfn = c->private; + if ( c->valx < 0 ) { + ObjectClass *oc; + + for( oc = cfn->c_oc_head; oc; oc_next( &oc )) { + oc_delete( oc ); + if ( oc == cfn->c_oc_tail ) + break; + } + cfn->c_oc_head = cfn->c_oc_tail = NULL; + } else { + ObjectClass *oc, *prev = NULL; + int i; + + for ( i=0, oc=cfn->c_oc_head; ivalx; i++) { + prev = oc; + oc_next( &oc ); + } + oc_delete( oc ); + if ( cfn->c_oc_tail == oc ) { + cfn->c_oc_tail = prev; + } + if ( cfn->c_oc_head == oc ) { + oc_next( &oc ); + cfn->c_oc_head = oc; + } + } + break; + + case CFG_ATTR: { + CfEntryInfo *ce = c->ca_entry->e_private; + /* can't modify the hardcoded schema */ + if ( ce->ce_parent->ce_type == Cft_Global ) + return 1; + } + cfn = c->private; + if ( c->valx < 0 ) { + AttributeType *at; + + for( at = cfn->c_at_head; at; at_next( &at )) { + at_delete( at ); + if ( at == cfn->c_at_tail ) + break; + } + cfn->c_at_head = cfn->c_at_tail = NULL; + } else { + AttributeType *at, *prev = NULL; + int i; + + for ( i=0, at=cfn->c_at_head; ivalx; i++) { + prev = at; + at_next( &at ); + } + at_delete( at ); + if ( cfn->c_at_tail == at ) { + cfn->c_at_tail = prev; + } + if ( cfn->c_at_head == at ) { + at_next( &at ); + cfn->c_at_head = at; + } + } + break; + case CFG_LIMITS: /* FIXME: there is no limits_free function */ case CFG_ATOPT: @@ -1020,9 +1200,7 @@ config_generic(ConfigArgs *c) { /* FIXME: there is no way to remove attributes added by a DSE file */ case CFG_OID: - case CFG_OC: case CFG_DIT: - case CFG_ATTR: case CFG_MODPATH: default: rc = 1; @@ -1031,8 +1209,6 @@ config_generic(ConfigArgs *c) { return rc; } - p = strchr(c->line,'(' /*')'*/); - switch(c->type) { case CFG_BACKEND: if(!(c->bi = backend_info(c->argv[1]))) { @@ -1067,6 +1243,21 @@ config_generic(ConfigArgs *c) { break; case CFG_THREADS: + if ( c->value_int < 2 ) { + snprintf( c->msg, sizeof( c->msg ), + "threads=%d smaller than minimum value 2", + c->value_int ); + Debug(LDAP_DEBUG_ANY, "%s: %s.\n", + c->log, c->msg, 0 ); + return 1; + + } else if ( c->value_int > 2 * SLAP_MAX_WORKER_THREADS ) { + snprintf( c->msg, sizeof( c->msg ), + "warning, threads=%d larger than twice the default (2*%d=%d); YMMV", + c->value_int, SLAP_MAX_WORKER_THREADS, 2 * SLAP_MAX_WORKER_THREADS ); + Debug(LDAP_DEBUG_ANY, "%s: %s.\n", + c->log, c->msg, 0 ); + } if ( slapMode & SLAP_SERVER_MODE ) ldap_pvt_thread_pool_maxthreads(&connection_pool, c->value_int); connection_pool_max = c->value_int; /* save for reference */ @@ -1132,7 +1323,9 @@ config_generic(ConfigArgs *c) { case CFG_OID: { OidMacro *om; - if(parse_oidm(c->fname, c->lineno, c->argc, c->argv, 1, &om)) + if ( c->op == LDAP_MOD_ADD && c->private && cfn != c->private ) + cfn = c->private; + if(parse_oidm(c, 1, &om)) return(1); if (!cfn->c_om_head) cfn->c_om_head = om; cfn->c_om_tail = om; @@ -1140,29 +1333,77 @@ config_generic(ConfigArgs *c) { break; case CFG_OC: { - ObjectClass *oc; + ObjectClass *oc, *prev; - if(parse_oc(c->fname, c->lineno, p, c->argv, &oc)) return(1); + if ( c->op == LDAP_MOD_ADD && c->private && cfn != c->private ) + cfn = c->private; + if ( c->valx < 0 ) { + prev = cfn->c_oc_tail; + } else { + prev = NULL; + /* If adding anything after the first, prev is easy */ + if ( c->valx ) { + int i; + for (i=0, oc = cfn->c_oc_head; ivalx; i++) { + prev = oc; + oc_next( &oc ); + } + } else + /* If adding the first, and head exists, find its prev */ + if (cfn->c_oc_head) { + for ( oc_start( &oc ); oc != cfn->c_oc_head; ) { + prev = oc; + oc_next( &oc ); + } + } + /* else prev is NULL, append to end of global list */ + } + if(parse_oc(c, &oc, prev)) return(1); if (!cfn->c_oc_head) cfn->c_oc_head = oc; - cfn->c_oc_tail = oc; + if (cfn->c_oc_tail == prev) cfn->c_oc_tail = oc; } break; - case CFG_DIT: { - ContentRule *cr; + case CFG_ATTR: { + AttributeType *at, *prev; - if(parse_cr(c->fname, c->lineno, p, c->argv, &cr)) return(1); - if (!cfn->c_cr_head) cfn->c_cr_head = cr; - cfn->c_cr_tail = cr; + if ( c->op == LDAP_MOD_ADD && c->private && cfn != c->private ) + cfn = c->private; + if ( c->valx < 0 ) { + prev = cfn->c_at_tail; + } else { + prev = NULL; + /* If adding anything after the first, prev is easy */ + if ( c->valx ) { + int i; + for (i=0, at = cfn->c_at_head; ivalx; i++) { + prev = at; + at_next( &at ); + } + } else + /* If adding the first, and head exists, find its prev */ + if (cfn->c_at_head) { + for ( at_start( &at ); at != cfn->c_at_head; ) { + prev = at; + at_next( &at ); + } + } + /* else prev is NULL, append to end of global list */ + } + if(parse_at(c, &at, prev)) return(1); + if (!cfn->c_at_head) cfn->c_at_head = at; + if (cfn->c_at_tail == prev) cfn->c_at_tail = at; } break; - case CFG_ATTR: { - AttributeType *at; + case CFG_DIT: { + ContentRule *cr; - if(parse_at(c->fname, c->lineno, p, c->argv, &at)) return(1); - if (!cfn->c_at_head) cfn->c_at_head = at; - cfn->c_at_tail = at; + if ( c->op == LDAP_MOD_ADD && c->private && cfn != c->private ) + cfn = c->private; + if(parse_cr(c, &cr)) return(1); + if (!cfn->c_cr_head) cfn->c_cr_head = cr; + cfn->c_cr_tail = cr; } break; @@ -1174,18 +1415,94 @@ config_generic(ConfigArgs *c) { break; case CFG_ACL: - if ( parse_acl(c->be, c->fname, c->lineno, c->argc, c->argv, c->valx) ) { + /* Don't append to the global ACL if we're on a specific DB */ + i = c->valx; + if ( c->be != frontendDB && frontendDB->be_acl && c->valx == -1 ) { + AccessControl *a; + i = 0; + for ( a=c->be->be_acl; a && a != frontendDB->be_acl; + a = a->acl_next ) + i++; + } + if ( parse_acl(c->be, c->fname, c->lineno, c->argc, c->argv, i ) ) { return 1; } break; + case CFG_REPLICA_ARGSFILE: + if(SLAP_MONITOR(c->be)) { + Debug(LDAP_DEBUG_ANY, "%s: " + "\"replica-argsfile\" should not be used " + "inside monitor database\n", + c->log, 0, 0); + /* FIXME: should this be an error? */ + return(0); + } + + if ( c->be->be_replica_argsfile != NULL ) { + /* FIXME: error? */ + Debug(LDAP_DEBUG_ANY, "%s: " + "\"replica-argsfile\" already provided; " + "replacing \"%s\" with \"%s\".\n", + c->log, c->be->be_replica_argsfile, c->value_string ); + ch_free( c->be->be_replica_argsfile ); + } + + c->be->be_replica_argsfile = c->value_string; + break; + + case CFG_REPLICA_PIDFILE: + if(SLAP_MONITOR(c->be)) { + Debug(LDAP_DEBUG_ANY, "%s: " + "\"replica-pidfile\" should not be used " + "inside monitor database\n", + c->log, 0, 0); + /* FIXME: should this be an error? */ + return(0); + } + + if ( c->be->be_replica_pidfile != NULL ) { + /* FIXME: error? */ + Debug(LDAP_DEBUG_ANY, "%s: " + "\"replica-pidfile\" already provided; " + "replacing \"%s\" with \"%s\".\n", + c->log, c->be->be_replica_pidfile, c->value_string ); + ch_free( c->be->be_replica_pidfile ); + } + + c->be->be_replica_pidfile = c->value_string; + break; + + case CFG_REPLICATIONINTERVAL: + if(SLAP_MONITOR(c->be)) { + Debug(LDAP_DEBUG_ANY, "%s: " + "\"replicationinterval\" should not be used " + "inside monitor database\n", + c->log, 0, 0); + /* FIXME: should this be an error? */ + return(0); + } + + c->be->be_replicationinterval = c->value_int; + break; + case CFG_REPLOG: if(SLAP_MONITOR(c->be)) { Debug(LDAP_DEBUG_ANY, "%s: " "\"replogfile\" should not be used " "inside monitor database\n", c->log, 0, 0); - return(0); /* FIXME: should this be an error? */ + /* FIXME: should this be an error? */ + return(0); + } + + if ( c->be->be_replogfile != NULL ) { + /* FIXME: error? */ + Debug(LDAP_DEBUG_ANY, "%s: " + "\"replogfile\" already provided; " + "replacing \"%s\" with \"%s\".\n", + c->log, c->be->be_replogfile, c->value_string ); + ch_free( c->be->be_replogfile ); } c->be->be_replogfile = c->value_string; @@ -1201,6 +1518,8 @@ config_generic(ConfigArgs *c) { { struct berval bv; ber_str2bv( c->argv[1], 0, 1, &bv ); + if ( c->op == LDAP_MOD_ADD && c->private && cfn != c->private ) + cfn = c->private; ber_bvarray_add( &cfn->c_dseFiles, &bv ); } break; @@ -1227,6 +1546,34 @@ config_generic(ConfigArgs *c) { SLAP_DBFLAGS(c->be) |= SLAP_DBFLAG_NOLASTMOD; break; + case CFG_MIRRORMODE: + if(!SLAP_SHADOW(c->be)) { + snprintf( c->msg, sizeof( c->msg ), "<%s> database is not a shadow", + c->argv[0] ); + Debug(LDAP_DEBUG_ANY, "%s: %s\n", + c->log, c->msg, 0 ); + return(1); + } + if(c->value_int) + SLAP_DBFLAGS(c->be) &= ~SLAP_DBFLAG_SINGLE_SHADOW; + else + SLAP_DBFLAGS(c->be) |= SLAP_DBFLAG_SINGLE_SHADOW; + break; + + case CFG_MONITORING: + if(c->value_int) + SLAP_DBFLAGS(c->be) |= SLAP_DBFLAG_MONITORING; + else + SLAP_DBFLAGS(c->be) &= ~SLAP_DBFLAG_MONITORING; + break; + + case CFG_HIDDEN: + if (c->value_int) + SLAP_DBFLAGS(c->be) |= SLAP_DBFLAG_HIDDEN; + else + SLAP_DBFLAGS(c->be) &= ~SLAP_DBFLAG_HIDDEN; + break; + case CFG_SSTR_IF_MAX: if (c->value_int < index_substr_if_minlen) { snprintf( c->msg, sizeof( c->msg ), "<%s> invalid value", c->argv[0] ); @@ -1271,14 +1618,18 @@ config_generic(ConfigArgs *c) { char *ptr; if ( c->op == SLAP_CONFIG_ADD ) { ptr = c->line + STRLENOF("moduleload"); - while (!isspace(*ptr)) ptr++; - while (isspace(*ptr)) ptr++; + while (!isspace((unsigned char) *ptr)) ptr++; + while (isspace((unsigned char) *ptr)) ptr++; } else { ptr = c->line; } ber_str2bv(ptr, 0, 1, &bv); ber_bvarray_add( &modcur->mp_loads, &bv ); } + /* Check for any new hardcoded schema */ + if ( c->op == LDAP_MOD_ADD && CONFIG_ONLINE_ADD( c )) { + config_check_schema( &cfBackInfo ); + } break; case CFG_MODPATH: @@ -1343,13 +1694,10 @@ config_generic(ConfigArgs *c) { default: - Debug( SLAPD_DEBUG_CONFIG_ERROR, - "%s: unknown CFG_TYPE %d" - SLAPD_CONF_UNKNOWN_IGNORED ".\n", + Debug( LDAP_DEBUG_ANY, + "%s: unknown CFG_TYPE %d.\n", c->log, c->type, 0 ); -#ifdef SLAPD_CONF_UNKNOWN_BAILOUT return 1; -#endif /* SLAPD_CONF_UNKNOWN_BAILOUT */ } return(0); @@ -1489,14 +1837,13 @@ config_schema_dn(ConfigArgs *c) { static int config_sizelimit(ConfigArgs *c) { int i, rc = 0; - char *next; struct slap_limits_set *lim = &c->be->be_def_limit; if (c->op == SLAP_CONFIG_EMIT) { char buf[8192]; struct berval bv; bv.bv_val = buf; bv.bv_len = 0; - limits_unparse_one( lim, SLAP_LIMIT_SIZE, &bv ); + limits_unparse_one( lim, SLAP_LIMIT_SIZE, &bv, sizeof( buf ) ); if ( !BER_BVISEMPTY( &bv )) value_add_one( &c->rvalue_vals, &bv ); else @@ -1541,14 +1888,13 @@ config_sizelimit(ConfigArgs *c) { static int config_timelimit(ConfigArgs *c) { int i, rc = 0; - char *next; struct slap_limits_set *lim = &c->be->be_def_limit; if (c->op == SLAP_CONFIG_EMIT) { char buf[8192]; struct berval bv; bv.bv_val = buf; bv.bv_len = 0; - limits_unparse_one( lim, SLAP_LIMIT_TIME, &bv ); + limits_unparse_one( lim, SLAP_LIMIT_TIME, &bv, sizeof( buf ) ); if ( !BER_BVISEMPTY( &bv )) value_add_one( &c->rvalue_vals, &bv ); else @@ -1596,12 +1942,10 @@ config_overlay(ConfigArgs *c) { } if(c->argv[1][0] == '-' && overlay_config(c->be, &c->argv[1][1])) { /* log error */ - Debug( SLAPD_DEBUG_CONFIG_ERROR, "%s: (optional) %s overlay \"%s\" configuration failed" - SLAPD_CONF_UNKNOWN_IGNORED ".\n", + Debug( LDAP_DEBUG_ANY, + "%s: (optional) %s overlay \"%s\" configuration failed.\n", c->log, c->be == frontendDB ? "global " : "", &c->argv[1][1]); -#ifdef SLAPD_CONF_UNKNOWN_BAILOUT return 1; -#endif /* SLAPD_CONF_UNKNOWN_BAILOUT */ } else if(overlay_config(c->be, c->argv[1])) { return(1); } @@ -1720,10 +2064,11 @@ config_suffix(ConfigArgs *c) int i = c->valx; ch_free( c->be->be_suffix[i].bv_val ); ch_free( c->be->be_nsuffix[i].bv_val ); - for (; c->be->be_suffix[i].bv_val; i++) { + do { c->be->be_suffix[i] = c->be->be_suffix[i+1]; c->be->be_nsuffix[i] = c->be->be_nsuffix[i+1]; - } + i++; + } while ( !BER_BVISNULL( &c->be->be_suffix[i] ) ); } return 0; } @@ -1740,15 +2085,14 @@ config_suffix(ConfigArgs *c) pdn = c->value_dn; ndn = c->value_ndn; - tbe = select_backend(&ndn, 0, 0); + if (SLAP_DBHIDDEN( c->be )) + tbe = NULL; + else + tbe = select_backend(&ndn, 0, 0); if(tbe == c->be) { - Debug( SLAPD_DEBUG_CONFIG_ERROR, - "%s: suffix already served by this backend!" - SLAPD_CONF_UNKNOWN_IGNORED ".\n", + Debug( LDAP_DEBUG_ANY, "%s: suffix already served by this backend!.\n", c->log, 0, 0); -#ifdef SLAPD_CONF_UNKNOWN_BAILOUT return 1; -#endif /* SLAPD_CONF_UNKNOWN_BAILOUT */ free(pdn.bv_val); free(ndn.bv_val); } else if(tbe) { @@ -1847,14 +2191,15 @@ config_restrict(ConfigArgs *c) { { BER_BVC("modrdn"), 0 }, { BER_BVC("delete"), SLAP_RESTRICT_OP_DELETE }, { BER_BVC("search"), SLAP_RESTRICT_OP_SEARCH }, - { BER_BVC("compare"), SLAP_RESTRICT_OP_COMPARE }, + { BER_BVC("compare"), SLAP_RESTRICT_OP_COMPARE }, { BER_BVC("read"), SLAP_RESTRICT_OP_READS }, { BER_BVC("write"), SLAP_RESTRICT_OP_WRITES }, - { BER_BVC("extended"), SLAP_RESTRICT_OP_EXTENDED }, + { BER_BVC("extended"), SLAP_RESTRICT_OP_EXTENDED }, { BER_BVC("extended=" LDAP_EXOP_START_TLS ), SLAP_RESTRICT_EXOP_START_TLS }, { BER_BVC("extended=" LDAP_EXOP_MODIFY_PASSWD ), SLAP_RESTRICT_EXOP_MODIFY_PASSWD }, { BER_BVC("extended=" LDAP_EXOP_X_WHO_AM_I ), SLAP_RESTRICT_EXOP_WHOAMI }, { BER_BVC("extended=" LDAP_EXOP_X_CANCEL ), SLAP_RESTRICT_EXOP_CANCEL }, + { BER_BVC("all"), SLAP_RESTRICT_OP_ALL }, { BER_BVNULL, 0 } }; @@ -1892,6 +2237,7 @@ config_allows(ConfigArgs *c) { { BER_BVC("bind_anon_cred"), SLAP_ALLOW_BIND_ANON_CRED }, { BER_BVC("bind_anon_dn"), SLAP_ALLOW_BIND_ANON_DN }, { BER_BVC("update_anon"), SLAP_ALLOW_UPDATE_ANON }, + { BER_BVC("proxy_authz_anon"), SLAP_ALLOW_PROXY_AUTHZ_ANON }, { BER_BVNULL, 0 } }; if (c->op == SLAP_CONFIG_EMIT) { @@ -1952,8 +2298,10 @@ config_disallows(ConfigArgs *c) { static int config_requires(ConfigArgs *c) { - slap_mask_t requires = 0; - int i; + slap_mask_t requires = frontendDB->be_requires; + int i, argc = c->argc; + char **argv = c->argv; + slap_verbmasks requires_ops[] = { { BER_BVC("bind"), SLAP_REQUIRE_BIND }, { BER_BVC("LDAPv3"), SLAP_REQUIRE_LDAP_V3 }, @@ -1973,11 +2321,23 @@ config_requires(ConfigArgs *c) { } return 0; } - i = verbs_to_mask(c->argc, c->argv, requires_ops, &requires); + /* "none" can only be first, to wipe out default/global values */ + if ( strcasecmp( c->argv[ 1 ], "none" ) == 0 ) { + argv++; + argc--; + requires = 0; + } + i = verbs_to_mask(argc, argv, requires_ops, &requires); if ( i ) { - snprintf( c->msg, sizeof( c->msg ), "<%s> unknown feature", c->argv[0] ); - Debug(LDAP_DEBUG_ANY, "%s: %s %s\n", - c->log, c->msg, c->argv[i]); + if (strcasecmp( c->argv[ i ], "none" ) == 0 ) { + snprintf( c->msg, sizeof( c->msg ), "<%s> \"none\" (#%d) must be listed first", c->argv[0], i - 1 ); + Debug(LDAP_DEBUG_ANY, "%s: %s\n", + c->log, c->msg, 0); + } else { + snprintf( c->msg, sizeof( c->msg ), "<%s> unknown feature #%d", c->argv[0], i - 1 ); + Debug(LDAP_DEBUG_ANY, "%s: %s \"%s\"\n", + c->log, c->msg, c->argv[i]); + } return(1); } c->be->be_requires = requires; @@ -2003,8 +2363,10 @@ loglevel_init( void ) { BER_BVC("Stats2"), LDAP_DEBUG_STATS2 }, { BER_BVC("Shell"), LDAP_DEBUG_SHELL }, { BER_BVC("Parse"), LDAP_DEBUG_PARSE }, +#if 0 /* no longer used (nor supported) */ { BER_BVC("Cache"), LDAP_DEBUG_CACHE }, { BER_BVC("Index"), LDAP_DEBUG_INDEX }, +#endif { BER_BVC("Sync"), LDAP_DEBUG_SYNC }, { BER_BVC("None"), LDAP_DEBUG_NONE }, { BER_BVNULL, 0 } @@ -2070,7 +2432,7 @@ slap_loglevel_get( struct berval *s, int *l ) rc = slap_verbmasks_append( &loglevel_ops, i, s, loglevel_ignore ); if ( rc != 0 ) { - Debug( LDAP_DEBUG_ANY, "slap_loglevel_register(%lu, \"%s\") failed\n", + Debug( LDAP_DEBUG_ANY, "slap_loglevel_get(%lu, \"%s\") failed\n", i, s->bv_val, 0 ); } else { @@ -2132,12 +2494,33 @@ loglevel2bvarray( int l, BerVarray *bva ) return mask_to_verbs( loglevel_ops, l, bva ); } +int +loglevel_print( FILE *out ) +{ + int i; + + if ( loglevel_ops == NULL ) { + loglevel_init(); + } + + fprintf( out, "Installed log subsystems:\n\n" ); + for ( i = 0; !BER_BVISNULL( &loglevel_ops[ i ].word ); i++ ) { + fprintf( out, "\t%-30s (%lu)\n", + loglevel_ops[ i ].word.bv_val, + loglevel_ops[ i ].mask ); + } + + fprintf( out, "\nNOTE: custom log subsystems may be later installed " + "by specific code\n\n" ); + + return 0; +} + static int config_syslog; static int config_loglevel(ConfigArgs *c) { int i; - char *next; if ( loglevel_ops == NULL ) { loglevel_init(); @@ -2167,7 +2550,7 @@ config_loglevel(ConfigArgs *c) { for( i=1; i < c->argc; i++ ) { int level; - if ( isdigit( c->argv[i][0] ) || c->argv[i][0] == '-' ) { + if ( isdigit((unsigned char)c->argv[i][0]) || c->argv[i][0] == '-' ) { if( lutil_atoi( &level, c->argv[i] ) != 0 ) { snprintf( c->msg, sizeof( c->msg ), "<%s> unable to parse level", c->argv[0] ); Debug( LDAP_DEBUG_ANY, "%s: %s \"%s\"\n", @@ -2273,7 +2656,7 @@ config_security(ConfigArgs *c) { } for(i = 1; i < c->argc; i++) { slap_ssf_t *tgt = NULL; - char *src; + char *src = NULL; for ( j=0; !BER_BVISNULL( &sec_keys[j].key ); j++ ) { if(!strncasecmp(c->argv[i], sec_keys[j].key.bv_val, sec_keys[j].key.bv_len)) { @@ -2300,10 +2683,14 @@ config_security(ConfigArgs *c) { } char * -anlist_unparse( AttributeName *an, char *ptr ) { +anlist_unparse( AttributeName *an, char *ptr, ber_len_t buflen ) { int comma = 0; + char *start = ptr; for (; !BER_BVISNULL( &an->an_name ); an++) { + /* if buflen == 0, assume the buffer size has been + * already checked otherwise */ + if ( buflen > 0 && buflen - ( ptr - start ) < comma + an->an_name.bv_len ) return NULL; if ( comma ) *ptr++ = ','; ptr = lutil_strcopy( ptr, an->an_name.bv_val ); comma = 1; @@ -2367,7 +2754,7 @@ replica_unparse( struct slap_replica_info *ri, int i, struct berval *bv ) ptr = lutil_strcopy( ptr, " attrs" ); if ( ri->ri_exclude ) *ptr++ = '!'; *ptr++ = '='; - ptr = anlist_unparse( ri->ri_attrs, ptr ); + ptr = anlist_unparse( ri->ri_attrs, ptr, 0 ); } } @@ -2418,6 +2805,8 @@ config_replica(ConfigArgs *c) { nr = add_replica_info(c->be, replicauri, replicahost); break; } else if(!strncasecmp(c->argv[i], "uri=", STRLENOF("uri="))) { + ber_len_t len; + if ( replicauri ) { snprintf( c->msg, sizeof( c->msg ), "<%s> replica host/URI already specified", c->argv[0] ); Debug(LDAP_DEBUG_ANY, "%s: %s \"%s\"\n", c->log, c->msg, replicauri ); @@ -2436,11 +2825,28 @@ config_replica(ConfigArgs *c) { Debug(LDAP_DEBUG_ANY, "%s: %s\n", c->log, c->msg, 0 ); return(1); } + + len = strlen(ludp->lud_scheme) + strlen(ludp->lud_host) + + STRLENOF("://") + 1; + if (ludp->lud_port != LDAP_PORT) { + if (ludp->lud_port < 1 || ludp->lud_port > 65535) { + ldap_free_urldesc(ludp); + snprintf( c->msg, sizeof( c->msg ), "<%s> invalid port", + c->argv[0] ); + Debug(LDAP_DEBUG_ANY, "%s: %s\n", c->log, c->msg, 0 ); + return(1); + } + len += STRLENOF(":65535"); + } + replicauri = ch_malloc( len ); + replicahost = lutil_strcopy( replicauri, ludp->lud_scheme ); + replicahost = lutil_strcopy( replicahost, "://" ); + if (ludp->lud_port == LDAP_PORT) { + strcpy( replicahost, ludp->lud_host ); + } else { + sprintf( replicahost, "%s:%d",ludp->lud_host,ludp->lud_port ); + } ldap_free_urldesc(ludp); - replicauri = c->argv[i] + STRLENOF("uri="); - replicauri = ch_strdup( replicauri ); - replicahost = strchr( replicauri, '/' ); - replicahost += 2; nr = add_replica_info(c->be, replicauri, replicahost); break; } @@ -2460,25 +2866,23 @@ config_replica(ConfigArgs *c) { /* dealt with separately; don't let it get to bindconf */ ; + } else if(!strncasecmp(c->argv[i], "host=", STRLENOF("host="))) { + /* dealt with separately; don't let it get to bindconf */ + ; + } else if(!strncasecmp(c->argv[i], "suffix=", STRLENOF( "suffix="))) { switch(add_replica_suffix(c->be, nr, c->argv[i] + STRLENOF("suffix="))) { case 1: - Debug( SLAPD_DEBUG_CONFIG_ERROR, "%s: " - "suffix \"%s\" in \"replica\" line is not valid for backend" - SLAPD_CONF_UNKNOWN_IGNORED ".\n", - c->log, c->argv[i] + STRLENOF("suffix="), 0); -#ifdef SLAPD_CONF_UNKNOWN_BAILOUT + Debug( LDAP_DEBUG_ANY, "%s: " + "suffix \"%s\" in \"replica\" line is not valid for backend.\n", + c->log, c->argv[i] + STRLENOF("suffix="), 0); return 1; -#endif /* SLAPD_CONF_UNKNOWN_BAILOUT */ break; case 2: - Debug( SLAPD_DEBUG_CONFIG_ERROR, "%s: " - "unable to normalize suffix in \"replica\" line" - SLAPD_CONF_UNKNOWN_IGNORED ".\n", - c->log, 0, 0); -#ifdef SLAPD_CONF_UNKNOWN_BAILOUT + Debug( LDAP_DEBUG_ANY, "%s: " + "unable to normalize suffix in \"replica\" line.\n", + c->log, 0, 0); return 1; -#endif /* SLAPD_CONF_UNKNOWN_BAILOUT */ break; } @@ -2548,8 +2952,32 @@ config_updatedn(ConfigArgs *c) { BER_BVZERO( &c->value_dn ); BER_BVZERO( &c->value_ndn ); - SLAP_DBFLAGS(c->be) |= (SLAP_DBFLAG_SHADOW | SLAP_DBFLAG_SLURP_SHADOW); - return(0); + return config_slurp_shadow( c ); +} + +int +config_shadow( ConfigArgs *c, int flag ) +{ + char *notallowed = NULL; + + if ( c->be == frontendDB ) { + notallowed = "frontend"; + + } else if ( SLAP_MONITOR(c->be) ) { + notallowed = "monitor"; + + } else if ( SLAP_CONFIG(c->be) ) { + notallowed = "config"; + } + + if ( notallowed != NULL ) { + Debug( LDAP_DEBUG_ANY, "%s: %s database cannot be shadow.\n", c->log, notallowed, 0 ); + return 1; + } + + SLAP_DBFLAGS(c->be) |= (SLAP_DBFLAG_SHADOW | SLAP_DBFLAG_SINGLE_SHADOW | flag); + + return 0; } static int @@ -2636,8 +3064,9 @@ config_include(ConfigArgs *c) { static int config_tls_option(ConfigArgs *c) { int flag; + LDAP *ld = slap_tls_ld; switch(c->type) { - case CFG_TLS_RAND: flag = LDAP_OPT_X_TLS_RANDOM_FILE; break; + case CFG_TLS_RAND: flag = LDAP_OPT_X_TLS_RANDOM_FILE; ld = NULL; break; case CFG_TLS_CIPHER: flag = LDAP_OPT_X_TLS_CIPHER_SUITE; break; case CFG_TLS_CERT_FILE: flag = LDAP_OPT_X_TLS_CERTFILE; break; case CFG_TLS_CERT_KEY: flag = LDAP_OPT_X_TLS_KEYFILE; break; @@ -2650,12 +3079,12 @@ config_tls_option(ConfigArgs *c) { return 1; } if (c->op == SLAP_CONFIG_EMIT) { - return ldap_pvt_tls_get_option( NULL, flag, &c->value_string ); + return ldap_pvt_tls_get_option( ld, flag, &c->value_string ); } else if ( c->op == LDAP_MOD_DELETE ) { - return ldap_pvt_tls_set_option( NULL, flag, NULL ); + return ldap_pvt_tls_set_option( ld, flag, NULL ); } ch_free(c->value_string); - return(ldap_pvt_tls_set_option(NULL, flag, c->argv[1])); + return(ldap_pvt_tls_set_option(ld, flag, c->argv[1])); } /* FIXME: this ought to be provided by libldap */ @@ -2685,7 +3114,7 @@ config_tls_config(ConfigArgs *c) { return 1; } if (c->op == SLAP_CONFIG_EMIT) { - ldap_pvt_tls_get_option( NULL, flag, &c->value_int ); + ldap_pvt_tls_get_option( slap_tls_ld, flag, &c->value_int ); for (i=0; !BER_BVISNULL(&keys[i].word); i++) { if (keys[i].mask == c->value_int) { c->value_string = ch_strdup( keys[i].word.bv_val ); @@ -2695,7 +3124,7 @@ config_tls_config(ConfigArgs *c) { return 1; } else if ( c->op == LDAP_MOD_DELETE ) { int i = 0; - return ldap_pvt_tls_set_option( NULL, flag, &i ); + return ldap_pvt_tls_set_option( slap_tls_ld, flag, &i ); } ch_free( c->value_string ); if ( isdigit( (unsigned char)c->argv[1][0] ) ) { @@ -2705,9 +3134,9 @@ config_tls_config(ConfigArgs *c) { c->log, c->argv[0], c->argv[1] ); return 1; } - return(ldap_pvt_tls_set_option(NULL, flag, &i)); + return(ldap_pvt_tls_set_option(slap_tls_ld, flag, &i)); } else { - return(ldap_int_tls_config(NULL, flag, c->argv[1])); + return(ldap_int_tls_config(slap_tls_ld, flag, c->argv[1])); } } #endif @@ -2754,6 +3183,10 @@ config_find_base( CfEntryInfo *root, struct berval *dn, CfEntryInfo **last ) typedef struct setup_cookie { CfBackInfo *cfb; ConfigArgs *ca; + Entry *frontend; + Entry *config; + int got_frontend; + int got_config; } setup_cookie; static int @@ -2763,7 +3196,57 @@ config_ldif_resp( Operation *op, SlapReply *rs ) setup_cookie *sc = op->o_callback->sc_private; sc->cfb->cb_got_ldif = 1; - rs->sr_err = config_add_internal( sc->cfb, rs->sr_entry, sc->ca, NULL, NULL ); + /* Does the frontend exist? */ + if ( !sc->got_frontend ) { + if ( !strncmp( rs->sr_entry->e_nname.bv_val, + "olcDatabase", STRLENOF( "olcDatabase" ))) { + if ( strncmp( rs->sr_entry->e_nname.bv_val + + STRLENOF( "olcDatabase" ), "={-1}frontend", + STRLENOF( "={-1}frontend" ))) { + struct berval rdn; + int i = op->o_noop; + sc->ca->be = frontendDB; + sc->ca->bi = frontendDB->bd_info; + frontendDB->be_cf_ocs = &CFOC_FRONTEND; + rdn.bv_val = sc->ca->log; + rdn.bv_len = snprintf(rdn.bv_val, sizeof( sc->ca->log ), + "%s=" SLAP_X_ORDERED_FMT "%s", + cfAd_database->ad_cname.bv_val, -1, + sc->ca->bi->bi_type); + op->o_noop = 1; + sc->frontend = config_build_entry( op, rs, + sc->cfb->cb_root, sc->ca, &rdn, &CFOC_DATABASE, + sc->ca->be->be_cf_ocs ); + op->o_noop = i; + } + sc->got_frontend++; + } + } + /* Does the configDB exist? */ + if ( sc->got_frontend && !sc->got_config && + !strncmp( rs->sr_entry->e_nname.bv_val, + "olcDatabase", STRLENOF( "olcDatabase" ))) { + if ( strncmp( rs->sr_entry->e_nname.bv_val + + STRLENOF( "olcDatabase" ), "={0}config", + STRLENOF( "={0}config" ))) { + struct berval rdn; + int i = op->o_noop; + sc->ca->be = LDAP_STAILQ_FIRST( &backendDB ); + sc->ca->bi = sc->ca->be->bd_info; + rdn.bv_val = sc->ca->log; + rdn.bv_len = snprintf(rdn.bv_val, sizeof( sc->ca->log ), + "%s=" SLAP_X_ORDERED_FMT "%s", + cfAd_database->ad_cname.bv_val, 0, + sc->ca->bi->bi_type); + op->o_noop = 1; + sc->config = config_build_entry( op, rs, sc->cfb->cb_root, + sc->ca, &rdn, &CFOC_DATABASE, sc->ca->be->be_cf_ocs ); + op->o_noop = i; + } + sc->got_config++; + } + + rs->sr_err = config_add_internal( sc->cfb, rs->sr_entry, sc->ca, NULL, NULL, NULL ); if ( rs->sr_err != LDAP_SUCCESS ) { Debug( LDAP_DEBUG_ANY, "config error processing %s: %s\n", rs->sr_entry->e_name.bv_val, sc->ca->msg, 0 ); @@ -2836,6 +3319,7 @@ config_setup_ldif( BackendDB *be, const char *dir, int readit ) { if ( readit ) { void *thrctx = ldap_pvt_thread_pool_context(); + int prev_DN_strict; op = (Operation *) &opbuf; connection_fake_init( &conn, op, thrctx ); @@ -2864,10 +3348,31 @@ config_setup_ldif( BackendDB *be, const char *dir, int readit ) { sc.cfb = cfb; sc.ca = &c; cb.sc_private = ≻ + sc.got_frontend = 0; + sc.got_config = 0; + sc.frontend = NULL; + sc.config = NULL; op->o_bd = &cfb->cb_db; + + /* Allow unknown attrs in DNs */ + prev_DN_strict = slap_DN_strict; + slap_DN_strict = 0; + rc = op->o_bd->be_search( op, &rs ); + /* Restore normal DN validation */ + slap_DN_strict = prev_DN_strict; + + op->o_tag = LDAP_REQ_ADD; + if ( rc == LDAP_SUCCESS && sc.frontend ) { + op->ora_e = sc.frontend; + rc = op->o_bd->be_add( op, &rs ); + } + if ( rc == LDAP_SUCCESS && sc.config ) { + op->ora_e = sc.config; + rc = op->o_bd->be_add( op, &rs ); + } ldap_pvt_thread_pool_context_reset( thrctx ); } @@ -2921,6 +3426,7 @@ read_config(const char *fname, const char *dir) { return 1; cfb = be->be_private; + be->be_dfltaccess = ACL_NONE; /* If no .conf, or a dir was specified, setup the dir */ if ( !fname || dir ) { @@ -2946,10 +3452,18 @@ read_config(const char *fname, const char *dir) { if ( rc != LDAP_NO_SUCH_OBJECT ) return 1; /* ITS#4194: But if dir was specified and no fname, - * then we were supposed to read the dir. + * then we were supposed to read the dir. Unless we're + * trying to slapadd the dir... */ - if ( dir && !fname ) - return 1; + if ( dir && !fname ) { + if ( slapMode & (SLAP_SERVER_MODE|SLAP_TOOL_READMAIN|SLAP_TOOL_READONLY)) + return 1; + /* Assume it's slapadd with a config dir, let it continue */ + rc = 0; + cfb->cb_got_ldif = 1; + cfb->cb_use_ldif = 1; + goto done; + } } /* If we read the config from back-ldif, nothing to do here */ @@ -2969,25 +3483,6 @@ read_config(const char *fname, const char *dir) { if ( rc == 0 ) ber_str2bv( cfname, 0, 1, &cfb->cb_config->c_file ); - /* If we got this far and failed, it may be a serious problem. In server - * mode, we should never come to this. However, it may be alright if we're - * using slapadd to create the conf dir. - */ - while ( rc ) { - if ( slapMode & (SLAP_SERVER_MODE|SLAP_TOOL_READMAIN|SLAP_TOOL_READONLY)) - break; - /* If a config file was explicitly given, fail */ - if ( fname ) - break; - - /* Seems to be slapadd with a config dir, let it continue */ - if ( cfb->cb_use_ldif ) { - rc = 0; - cfb->cb_got_ldif = 1; - } - break; - } - done: if ( rc == 0 && BER_BVISNULL( &frontendDB->be_schemadn ) ) { ber_str2bv( SLAPD_SCHEMA_DN, STRLENOF( SLAPD_SCHEMA_DN ), 1, @@ -3124,7 +3619,7 @@ check_vals( ConfigTable *ct, ConfigArgs *ca, void *ptr, int isAttr ) AttributeDescription *ad; BerVarray vals; - int i, rc = 0, sort = 0; + int i, rc = 0; if ( isAttr ) { a = ptr; @@ -3137,7 +3632,6 @@ check_vals( ConfigTable *ct, ConfigArgs *ca, void *ptr, int isAttr ) } if ( a && ( ad->ad_type->sat_flags & SLAP_AT_ORDERED_VAL )) { - sort = 1; rc = ordered_value_sort( a, 1 ); if ( rc ) { snprintf(ca->msg, sizeof( ca->msg ), "ordered_value_sort failed on attr %s\n", @@ -3147,7 +3641,8 @@ check_vals( ConfigTable *ct, ConfigArgs *ca, void *ptr, int isAttr ) } for ( i=0; vals[i].bv_val; i++ ) { ca->line = vals[i].bv_val; - if ( sort ) { + if (( ad->ad_type->sat_flags & SLAP_AT_ORDERED_VAL ) && + ca->line[0] == '{' ) { char *idx = strchr( ca->line, '}' ); if ( idx ) ca->line = idx+1; } @@ -3182,13 +3677,15 @@ check_name_index( CfEntryInfo *parent, ConfigType ce_type, Entry *e, dnRdn( &e->e_name, &rdn ); ptr1 = ber_bvchr( &e->e_name, '{' ); if ( ptr1 && ptr1 - e->e_name.bv_val < rdn.bv_len ) { + char *next; ptr2 = strchr( ptr1, '}' ); if (!ptr2 || ptr2 - e->e_name.bv_val > rdn.bv_len) return LDAP_NAMING_VIOLATION; if ( ptr2-ptr1 == 1) return LDAP_NAMING_VIOLATION; gotindex = 1; - if ( lutil_atoi( &index, ptr1 + 1 ) != 0 ) { + index = strtol( ptr1 + 1, &next, 10 ); + if ( next == ptr1 + 1 || next[ 0 ] != '}' ) { return LDAP_NAMING_VIOLATION; } if ( index < 0 ) { @@ -3394,7 +3891,8 @@ cfAddOverlay( CfEntryInfo *p, Entry *e, struct config_args_s *ca ) /* Parse an LDAP entry into config directives */ static int -config_add_internal( CfBackInfo *cfb, Entry *e, ConfigArgs *ca, SlapReply *rs, int *renum ) +config_add_internal( CfBackInfo *cfb, Entry *e, ConfigArgs *ca, SlapReply *rs, + int *renum, Operation *op ) { CfEntryInfo *ce, *last; ConfigOCs **colst; @@ -3420,6 +3918,15 @@ config_add_internal( CfBackInfo *cfb, Entry *e, ConfigArgs *ca, SlapReply *rs, i return LDAP_NO_SUCH_OBJECT; } + if ( op ) { + /* No parent, must be root. This will never happen... */ + if ( !last && !be_isroot( op ) && !be_shadow_update( op )) + return LDAP_NO_SUCH_OBJECT; + if ( last && !access_allowed( op, last->ce_entry, + slap_schema.si_ad_children, NULL, ACL_WADD, NULL )) + return LDAP_INSUFFICIENT_ACCESS; + } + oc_at = attr_find( e->e_attrs, slap_schema.si_ad_objectClass ); if ( !oc_at ) return LDAP_OBJECT_CLASS_VIOLATION; @@ -3487,9 +3994,19 @@ config_add_internal( CfBackInfo *cfb, Entry *e, ConfigArgs *ca, SlapReply *rs, i * These entries can have auto-assigned indexes (appended to the end) * but only the other types support auto-renumbering of siblings. */ - rc = check_name_index( last, colst[0]->co_type, e, rs, renum ); - if ( rc ) - goto done; + { + int renumber = renum ? *renum : 0; + rc = check_name_index( last, colst[0]->co_type, e, rs, renum ); + if ( rc ) { + goto done; + } + if ( renum && *renum && renumber == -1 ) { + snprintf( ca->msg, sizeof( ca->msg ), + "operation requires sibling renumbering" ); + rc = LDAP_UNWILLING_TO_PERFORM; + goto done; + } + } init_config_argv( ca ); @@ -3516,7 +4033,7 @@ config_add_internal( CfBackInfo *cfb, Entry *e, ConfigArgs *ca, SlapReply *rs, i if ( ptr ) ca->line = ptr+1; } ca->valx = i; - rc = config_parse_add( ct, ca ); + rc = config_parse_add( ct, ca, i ); if ( rc ) { rc = LDAP_OTHER; goto done; @@ -3591,7 +4108,8 @@ config_back_add( Operation *op, SlapReply *rs ) int renumber; ConfigArgs ca; - if ( !be_isroot( op ) ) { + if ( !access_allowed( op, op->ora_e, slap_schema.si_ad_entry, + NULL, ACL_WADD, NULL )) { rs->sr_err = LDAP_INSUFFICIENT_ACCESS; goto out; } @@ -3607,10 +4125,15 @@ config_back_add( Operation *op, SlapReply *rs ) * 4) store entry in underlying database * 5) perform any necessary renumbering */ - rs->sr_err = config_add_internal( cfb, op->ora_e, &ca, rs, &renumber ); + /* NOTE: by now we do not accept adds that require renumbering */ + renumber = -1; + rs->sr_err = config_add_internal( cfb, op->ora_e, &ca, rs, &renumber, op ); if ( rs->sr_err != LDAP_SUCCESS ) { rs->sr_text = ca.msg; - } else if ( cfb->cb_use_ldif ) { + goto out2; + } + + if ( cfb->cb_use_ldif ) { BackendDB *be = op->o_bd; slap_callback sc = { NULL, slap_null_cb, NULL, NULL }; struct berval dn, ndn; @@ -3631,12 +4154,15 @@ config_back_add( Operation *op, SlapReply *rs ) op->o_dn = dn; op->o_ndn = ndn; } + if ( renumber ) { + /* TODO */ } +out2:; ldap_pvt_thread_pool_resume( &connection_pool ); -out: +out:; send_ldap_result( op, rs ); return rs->sr_err; } @@ -3673,6 +4199,7 @@ config_modify_internal( CfEntryInfo *ce, Operation *op, SlapReply *rs, ca->bi = ce->ce_bi; ca->private = ce->ce_private; ca->ca_entry = e; + ca->fname = "slapd"; strcpy( ca->log, "back-config" ); for (ml = op->orm_modlist; ml; ml=ml->sml_next) { @@ -3783,7 +4310,7 @@ config_modify_internal( CfEntryInfo *ce, Operation *op, SlapReply *rs, if(rc == LDAP_SUCCESS) { /* check that the entry still obeys the schema */ - rc = entry_schema_check(op, e, NULL, 0, + rc = entry_schema_check(op, e, NULL, 0, 0, &rs->sr_text, ca->msg, sizeof(ca->msg) ); } if ( rc == LDAP_SUCCESS ) { @@ -3845,8 +4372,9 @@ config_modify_internal( CfEntryInfo *ce, Operation *op, SlapReply *rs, if ( rc ) rc = LDAP_OTHER; } if ( ml->sml_values ) { + d = d->next; ch_free( dels ); - dels = d->next; + dels = d; } if ( ml->sml_op == LDAP_MOD_REPLACE ) { ml->sml_values = vals; @@ -3876,7 +4404,7 @@ config_modify_internal( CfEntryInfo *ce, Operation *op, SlapReply *rs, ca->line = ptr+1; } } - rc = config_parse_add( ct, ca ); + rc = config_parse_add( ct, ca, i ); if ( rc ) { rc = LDAP_OTHER; goto out; @@ -3899,6 +4427,11 @@ out: } ch_free( ca->argv ); if ( colst ) ch_free( colst ); + while( dels ) { + deltail = dels->next; + ch_free( dels ); + dels = deltail; + } return rc; } @@ -3914,11 +4447,6 @@ config_back_modify( Operation *op, SlapReply *rs ) char *ptr; AttributeDescription *rad = NULL; - if ( !be_isroot( op ) ) { - rs->sr_err = LDAP_INSUFFICIENT_ACCESS; - goto out; - } - cfb = (CfBackInfo *)op->o_bd->be_private; ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last ); @@ -3929,6 +4457,11 @@ config_back_modify( Operation *op, SlapReply *rs ) goto out; } + if ( !acl_check_modlist( op, ce->ce_entry, op->orm_modlist )) { + rs->sr_err = LDAP_INSUFFICIENT_ACCESS; + goto out; + } + /* Get type of RDN */ rdn = ce->ce_entry->e_nname; ptr = strchr( rdn.bv_val, '=' ); @@ -3989,11 +4522,6 @@ config_back_modrdn( Operation *op, SlapReply *rs ) CfBackInfo *cfb; CfEntryInfo *ce, *last; - if ( !be_isroot( op ) ) { - rs->sr_err = LDAP_INSUFFICIENT_ACCESS; - goto out; - } - cfb = (CfBackInfo *)op->o_bd->be_private; ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last ); @@ -4003,6 +4531,22 @@ config_back_modrdn( Operation *op, SlapReply *rs ) rs->sr_err = LDAP_NO_SUCH_OBJECT; goto out; } + if ( !access_allowed( op, ce->ce_entry, slap_schema.si_ad_entry, + NULL, ACL_WRITE, NULL )) { + rs->sr_err = LDAP_INSUFFICIENT_ACCESS; + goto out; + } + { Entry *parent; + if ( ce->ce_parent ) + parent = ce->ce_parent->ce_entry; + else + parent = (Entry *)&slap_entry_root; + if ( !access_allowed( op, parent, slap_schema.si_ad_children, + NULL, ACL_WRITE, NULL )) { + rs->sr_err = LDAP_INSUFFICIENT_ACCESS; + goto out; + } + } /* We don't allow moving objects to new parents. * Generally we only allow reordering a set of ordered entries. @@ -4013,6 +4557,9 @@ config_back_modrdn( Operation *op, SlapReply *rs ) } ldap_pvt_thread_pool_pause( &connection_pool ); + rs->sr_err = LDAP_UNWILLING_TO_PERFORM; + rs->sr_text = "renaming not implemented yet within naming context"; + ldap_pvt_thread_pool_resume( &connection_pool ); out: send_ldap_result( op, rs ); @@ -4024,11 +4571,7 @@ config_back_search( Operation *op, SlapReply *rs ) { CfBackInfo *cfb; CfEntryInfo *ce, *last; - - if ( !be_isroot( op ) ) { - rs->sr_err = LDAP_INSUFFICIENT_ACCESS; - goto out; - } + slap_mask_t mask; cfb = (CfBackInfo *)op->o_bd->be_private; @@ -4039,6 +4582,16 @@ config_back_search( Operation *op, SlapReply *rs ) rs->sr_err = LDAP_NO_SUCH_OBJECT; goto out; } + if ( !access_allowed_mask( op, ce->ce_entry, slap_schema.si_ad_entry, NULL, + ACL_SEARCH, NULL, &mask )) + { + if ( !ACL_GRANT( mask, ACL_DISCLOSE )) { + rs->sr_err = LDAP_NO_SUCH_OBJECT; + } else { + rs->sr_err = LDAP_INSUFFICIENT_ACCESS; + } + goto out; + } switch ( op->ors_scope ) { case LDAP_SCOPE_BASE: case LDAP_SCOPE_SUBTREE: @@ -4071,7 +4624,9 @@ config_build_attrs( Entry *e, AttributeType **at, AttributeDescription *ad, for (i=0;ct[i].name;i++) { if (ct[i].ad == (*at)->sat_ad) { rc = config_get_vals(&ct[i], c); - if (rc == LDAP_SUCCESS) { + /* NOTE: tolerate that config_get_vals() + * returns success with no values */ + if (rc == LDAP_SUCCESS && c->rvalue_vals != NULL ) { if ( c->rvalue_nvals ) attr_merge(e, ct[i].ad, c->rvalue_vals, c->rvalue_nvals); @@ -4091,7 +4646,7 @@ Entry * config_build_entry( Operation *op, SlapReply *rs, CfEntryInfo *parent, ConfigArgs *c, struct berval *rdn, ConfigOCs *main, ConfigOCs *extra ) { - Entry *e = ch_calloc( 1, sizeof(Entry) ); + Entry *e = entry_alloc(); CfEntryInfo *ce = ch_calloc( 1, sizeof(CfEntryInfo) ); struct berval val; struct berval ad_name; @@ -4104,6 +4659,7 @@ config_build_entry( Operation *op, SlapReply *rs, CfEntryInfo *parent, ObjectClass *oc; CfEntryInfo *ceprev = NULL; + Debug( LDAP_DEBUG_TRACE, "config_build_entry: \"%s\"\n", rdn->bv_val, 0, 0); e->e_private = ce; ce->ce_entry = e; ce->ce_parent = parent; @@ -4157,12 +4713,16 @@ config_build_entry( Operation *op, SlapReply *rs, CfEntryInfo *parent, } oc_at = attr_find( e->e_attrs, slap_schema.si_ad_objectClass ); - rc = structural_class(oc_at->a_vals, &val, NULL, &text, c->msg, - sizeof(c->msg)); - attr_merge_normalize_one(e, slap_schema.si_ad_structuralObjectClass, &val, NULL ); - if ( op ) { + rc = structural_class(oc_at->a_vals, &oc, NULL, &text, c->msg, + sizeof(c->msg), op->o_tmpmemctx ); + attr_merge_normalize_one(e, slap_schema.si_ad_structuralObjectClass, &oc->soc_cname, NULL ); + if ( !op->o_noop ) { op->ora_e = e; op->o_bd->be_add( op, rs ); + if ( ( rs->sr_err != LDAP_SUCCESS ) + && (rs->sr_err != LDAP_ALREADY_EXISTS) ) { + return NULL; + } } if ( ceprev ) { ceprev->ce_sibs = ce; @@ -4173,7 +4733,7 @@ config_build_entry( Operation *op, SlapReply *rs, CfEntryInfo *parent, return e; } -static void +static int config_build_schema_inc( ConfigArgs *c, CfEntryInfo *ceparent, Operation *op, SlapReply *rs ) { @@ -4197,7 +4757,7 @@ config_build_schema_inc( ConfigArgs *c, CfEntryInfo *ceparent, c->value_dn.bv_len = snprintf(c->value_dn.bv_val, sizeof( c->log ), "cn=" SLAP_X_ORDERED_FMT, c->depth); if ( c->value_dn.bv_len >= sizeof( c->log ) ) { /* FIXME: how can indicate error? */ - return; + return -1; } strncpy( c->value_dn.bv_val + c->value_dn.bv_len, bv.bv_val, bv.bv_len ); @@ -4207,14 +4767,17 @@ config_build_schema_inc( ConfigArgs *c, CfEntryInfo *ceparent, c->private = cf; e = config_build_entry( op, rs, ceparent, c, &c->value_dn, &CFOC_SCHEMA, NULL ); - if ( e && cf->c_kids ) { + if ( !e ) { + return -1; + } else if ( e && cf->c_kids ) { c->private = cf->c_kids; config_build_schema_inc( c, e->e_private, op, rs ); } } + return 0; } -static void +static int config_build_includes( ConfigArgs *c, CfEntryInfo *ceparent, Operation *op, SlapReply *rs ) { @@ -4227,21 +4790,24 @@ config_build_includes( ConfigArgs *c, CfEntryInfo *ceparent, c->value_dn.bv_len = snprintf(c->value_dn.bv_val, sizeof( c->log ), "cn=include" SLAP_X_ORDERED_FMT, i); if ( c->value_dn.bv_len >= sizeof( c->log ) ) { /* FIXME: how can indicate error? */ - return; + return -1; } c->private = cf; e = config_build_entry( op, rs, ceparent, c, &c->value_dn, &CFOC_INCLUDE, NULL ); - if ( e && cf->c_kids ) { + if ( ! e ) { + return -1; + } else if ( e && cf->c_kids ) { c->private = cf->c_kids; config_build_includes( c, e->e_private, op, rs ); } } + return 0; } #ifdef SLAPD_MODULES -static void +static int config_build_modules( ConfigArgs *c, CfEntryInfo *ceparent, Operation *op, SlapReply *rs ) { @@ -4255,15 +4821,102 @@ config_build_modules( ConfigArgs *c, CfEntryInfo *ceparent, c->value_dn.bv_len = snprintf(c->value_dn.bv_val, sizeof( c->log ), "cn=module" SLAP_X_ORDERED_FMT, i); if ( c->value_dn.bv_len >= sizeof( c->log ) ) { /* FIXME: how can indicate error? */ - return; + return -1; } c->private = mp; - config_build_entry( op, rs, ceparent, c, &c->value_dn, - &CFOC_MODULE, NULL ); + if ( ! config_build_entry( op, rs, ceparent, c, &c->value_dn, &CFOC_MODULE, NULL )) { + return -1; + } } + return 0; } #endif +static int +config_check_schema(CfBackInfo *cfb) +{ + struct berval schema_dn = BER_BVC(SCHEMA_RDN "," CONFIG_RDN); + ConfigArgs c = {0}; + ConfigFile *cf = cfb->cb_config; + CfEntryInfo *ce, *last; + Entry *e; + + /* If there's no root entry, we must be in the midst of converting */ + if ( !cfb->cb_root ) + return 0; + + /* Make sure the main schema entry exists */ + ce = config_find_base( cfb->cb_root, &schema_dn, &last ); + if ( ce ) { + Attribute *a; + struct berval *bv; + + e = ce->ce_entry; + + /* Make sure it's up to date */ + if ( cf_om_tail != om_sys_tail ) { + a = attr_find( e->e_attrs, cfAd_om ); + if ( a ) { + if ( a->a_nvals != a->a_vals ) + ber_bvarray_free( a->a_nvals ); + ber_bvarray_free( a->a_vals ); + a->a_vals = NULL; + a->a_nvals = NULL; + } + oidm_unparse( &bv, NULL, NULL, 1 ); + attr_merge_normalize( e, cfAd_om, bv, NULL ); + ber_bvarray_free( bv ); + cf_om_tail = om_sys_tail; + } + if ( cf_at_tail != at_sys_tail ) { + a = attr_find( e->e_attrs, cfAd_attr ); + if ( a ) { + if ( a->a_nvals != a->a_vals ) + ber_bvarray_free( a->a_nvals ); + ber_bvarray_free( a->a_vals ); + a->a_vals = NULL; + a->a_nvals = NULL; + } + at_unparse( &bv, NULL, NULL, 1 ); + attr_merge_normalize( e, cfAd_attr, bv, NULL ); + ber_bvarray_free( bv ); + cf_at_tail = at_sys_tail; + } + if ( cf_oc_tail != oc_sys_tail ) { + a = attr_find( e->e_attrs, cfAd_oc ); + if ( a ) { + if ( a->a_nvals != a->a_vals ) + ber_bvarray_free( a->a_nvals ); + ber_bvarray_free( a->a_vals ); + a->a_vals = NULL; + a->a_nvals = NULL; + } + oc_unparse( &bv, NULL, NULL, 1 ); + attr_merge_normalize( e, cfAd_oc, bv, NULL ); + ber_bvarray_free( bv ); + cf_oc_tail = oc_sys_tail; + } + } else { + SlapReply rs = {REP_RESULT}; + c.private = NULL; + e = config_build_entry( NULL, &rs, cfb->cb_root, &c, &schema_rdn, + &CFOC_SCHEMA, NULL ); + if ( !e ) { + return -1; + } + ce = e->e_private; + ce->ce_private = cfb->cb_config; + cf_at_tail = at_sys_tail; + cf_oc_tail = oc_sys_tail; + cf_om_tail = om_sys_tail; + } + return 0; +} + +static const char *defacl[] = { + NULL, "to", "*", "by", "*", "none", NULL +}; + static int config_back_db_open( BackendDB *be ) { @@ -4271,7 +4924,7 @@ config_back_db_open( BackendDB *be ) struct berval rdn; Entry *e, *parent; CfEntryInfo *ce, *ceparent; - int i; + int i, unsupp = 0; BackendInfo *bi; ConfigArgs c; Connection conn = {0}; @@ -4281,22 +4934,32 @@ config_back_db_open( BackendDB *be ) SlapReply rs = {REP_RESULT}; void *thrctx = NULL; - /* If we read the config from back-ldif, nothing to do here */ - if ( cfb->cb_got_ldif ) - return 0; + Debug( LDAP_DEBUG_TRACE, "config_back_db_open\n", 0, 0, 0); - if ( cfb->cb_use_ldif ) { - thrctx = ldap_pvt_thread_pool_context(); - op = (Operation *) &opbuf; - connection_fake_init( &conn, op, thrctx ); + /* If we have no explicitly configured ACLs, don't just use + * the global ACLs. Explicitly deny access to everything. + */ + if ( frontendDB->be_acl && be->be_acl == frontendDB->be_acl ) { + parse_acl(be, "config_back_db_open", 0, 6, (char **)defacl, 0 ); + } - op->o_tag = LDAP_REQ_ADD; - op->o_callback = &cb; - op->o_bd = &cfb->cb_db; - op->o_dn = op->o_bd->be_rootdn; - op->o_ndn = op->o_bd->be_rootndn; - } else { - op = NULL; + /* If we read the config from back-ldif, do some quick sanity checks */ + if ( cfb->cb_got_ldif ) { + return config_check_schema( cfb ); + } + + thrctx = ldap_pvt_thread_pool_context(); + op = (Operation *) &opbuf; + connection_fake_init( &conn, op, thrctx ); + + op->o_tag = LDAP_REQ_ADD; + op->o_callback = &cb; + op->o_bd = &cfb->cb_db; + op->o_dn = op->o_bd->be_rootdn; + op->o_ndn = op->o_bd->be_rootndn; + + if ( !cfb->cb_use_ldif ) { + op->o_noop = 1; } /* create root of tree */ @@ -4304,6 +4967,9 @@ config_back_db_open( BackendDB *be ) c.private = cfb->cb_config; c.be = frontendDB; e = config_build_entry( op, &rs, NULL, &c, &rdn, &CFOC_GLOBAL, NULL ); + if ( !e ) { + return -1; + } ce = e->e_private; cfb->cb_root = ce; @@ -4314,13 +4980,17 @@ config_back_db_open( BackendDB *be ) if ( cfb->cb_config->c_kids ) { c.depth = 0; c.private = cfb->cb_config->c_kids; - config_build_includes( &c, ceparent, op, &rs ); + if ( config_build_includes( &c, ceparent, op, &rs ) ) { + return -1; + } } #ifdef SLAPD_MODULES /* Create Module nodes... */ if ( modpaths.mp_loads ) { - config_build_modules( &c, ceparent, op, &rs ); + if ( config_build_modules( &c, ceparent, op, &rs ) ){ + return -1; + } } #endif @@ -4331,13 +5001,22 @@ config_back_db_open( BackendDB *be ) rdn = schema_rdn; c.private = NULL; e = config_build_entry( op, &rs, ceparent, &c, &rdn, &CFOC_SCHEMA, NULL ); + if ( !e ) { + return -1; + } ce = e->e_private; + ce->ce_private = cfb->cb_config; + cf_at_tail = at_sys_tail; + cf_oc_tail = oc_sys_tail; + cf_om_tail = om_sys_tail; /* Create schema nodes for included schema... */ if ( cfb->cb_config->c_kids ) { c.depth = 0; c.private = cfb->cb_config->c_kids; - config_build_schema_inc( &c, ce, op, &rs ); + if (config_build_schema_inc( &c, ce, op, &rs )) { + return -1; + } } /* Create backend nodes. Skip if they don't provide a cf_table. @@ -4346,7 +5025,16 @@ config_back_db_open( BackendDB *be ) c.line = 0; LDAP_STAILQ_FOREACH( bi, &backendInfo, bi_next) { - if (!bi->bi_cf_ocs) continue; + if (!bi->bi_cf_ocs) { + /* If it only supports the old config mech, complain. */ + if ( bi->bi_config ) { + Debug( LDAP_DEBUG_ANY, + "WARNING: No dynamic config support for backend %s.\n", + bi->bi_type, 0, 0 ); + unsupp++; + } + continue; + } if (!bi->bi_private) continue; rdn.bv_val = c.log; @@ -4358,6 +5046,9 @@ config_back_db_open( BackendDB *be ) c.bi = bi; e = config_build_entry( op, &rs, ceparent, &c, &rdn, &CFOC_BACKEND, bi->bi_cf_ocs ); + if ( !e ) { + return -1; + } } /* Create database nodes... */ @@ -4373,6 +5064,16 @@ config_back_db_open( BackendDB *be ) } else { bi = be->bd_info; } + + /* If this backend supports the old config mechanism, but not + * the new mech, complain. + */ + if ( !be->be_cf_ocs && bi->bi_db_config ) { + Debug( LDAP_DEBUG_ANY, + "WARNING: No dynamic config support for database %s.\n", + bi->bi_type, 0, 0 ); + unsupp++; + } rdn.bv_val = c.log; rdn.bv_len = snprintf(rdn.bv_val, sizeof( c.log ), "%s=" SLAP_X_ORDERED_FMT "%s", cfAd_database->ad_cname.bv_val, @@ -4384,6 +5085,9 @@ config_back_db_open( BackendDB *be ) c.bi = bi; e = config_build_entry( op, &rs, ceparent, &c, &rdn, &CFOC_DATABASE, be->be_cf_ocs ); + if ( !e ) { + return -1; + } ce = e->e_private; if ( be->be_cf_ocs && be->be_cf_ocs->co_cfadd ) be->be_cf_ocs->co_cfadd( op, &rs, e, &c ); @@ -4394,6 +5098,12 @@ config_back_db_open( BackendDB *be ) int j; for (j=0,on=oi->oi_list; on; j++,on=on->on_next) { + if ( on->on_bi.bi_db_config && !on->on_bi.bi_cf_ocs ) { + Debug( LDAP_DEBUG_ANY, + "WARNING: No dynamic config support for overlay %s.\n", + on->on_bi.bi_type, 0, 0 ); + unsupp++; + } rdn.bv_val = c.log; rdn.bv_len = snprintf(rdn.bv_val, sizeof( c.log ), "%s=" SLAP_X_ORDERED_FMT "%s", @@ -4405,6 +5115,9 @@ config_back_db_open( BackendDB *be ) c.bi = &on->on_bi; oe = config_build_entry( op, &rs, ce, &c, &rdn, &CFOC_OVERLAY, c.bi->bi_cf_ocs ); + if ( !oe ) { + return -1; + } if ( c.bi->bi_cf_ocs && c.bi->bi_cf_ocs->co_cfadd ) c.bi->bi_cf_ocs->co_cfadd( op, &rs, oe, &c ); } @@ -4413,6 +5126,11 @@ config_back_db_open( BackendDB *be ) if ( thrctx ) ldap_pvt_thread_pool_context_reset( thrctx ); + if ( unsupp && cfb->cb_use_ldif ) { + Debug( LDAP_DEBUG_ANY, "\nWARNING: The converted cn=config " + "directory is incomplete and may not work.\n\n", 0, 0, 0 ); + } + return 0; } @@ -4481,8 +5199,6 @@ config_back_db_destroy( BackendDB *be ) backend_destroy_one( &cfb->cb_db, 0 ); } - free( be->be_private ); - loglevel_destroy(); return 0; @@ -4494,7 +5210,7 @@ config_back_db_init( BackendDB *be ) struct berval dn; CfBackInfo *cfb; - cfb = ch_calloc( 1, sizeof(CfBackInfo)); + cfb = &cfBackInfo; cfb->cb_config = ch_calloc( 1, sizeof(ConfigFile)); cfn = cfb->cb_config; be->be_private = cfb; @@ -4588,7 +5304,7 @@ config_tool_entry_put( BackendDB *be, Entry *e, struct berval *text ) ConfigArgs ca; if ( bi && bi->bi_tool_entry_put && - config_add_internal( cfb, e, &ca, NULL, NULL ) == 0 ) + config_add_internal( cfb, e, &ca, NULL, NULL, NULL ) == 0 ) return bi->bi_tool_entry_put( &cfb->cb_db, e, text ); else return NOID; @@ -4598,9 +5314,12 @@ static struct { char *name; AttributeDescription **desc; } ads[] = { + { "attribute", &cfAd_attr }, { "backend", &cfAd_backend }, { "database", &cfAd_database }, { "include", &cfAd_include }, + { "objectclass", &cfAd_oc }, + { "objectidentifier", &cfAd_om }, { "overlay", &cfAd_overlay }, { NULL, NULL } }; @@ -4632,6 +5351,7 @@ int config_back_initialize( BackendInfo *bi ) { ConfigTable *ct = config_back_cf_table; + ConfigArgs ca; char *argv[4]; int i; AttributeDescription *ad = NULL; @@ -4641,6 +5361,9 @@ config_back_initialize( BackendInfo *bi ) NULL }; + /* Make sure we don't exceed the bits reserved for userland */ + config_check_userland( CFG_LAST ); + bi->bi_controls = controls; bi->bi_open = 0; @@ -4668,9 +5391,7 @@ config_back_initialize( BackendInfo *bi ) bi->bi_chk_referrals = 0; -#ifdef SLAP_OVERLAY_ACCESS - bi->bi_access_allowed = slap_access_always_allowed; -#endif /* SLAP_OVERLAY_ACCESS */ + bi->bi_access_allowed = slap_access_allowed; bi->bi_connection_init = 0; bi->bi_connection_destroy = 0; @@ -4682,14 +5403,17 @@ config_back_initialize( BackendInfo *bi ) bi->bi_tool_entry_get = config_tool_entry_get; bi->bi_tool_entry_put = config_tool_entry_put; - /* Make sure we don't exceed the bits reserved for userland */ - assert( ( ( CFG_LAST - 1 ) & ARGS_USERLAND ) == ( CFG_LAST - 1 ) ); + ca.argv = argv; + argv[ 0 ] = "slapd"; + ca.argv = argv; + ca.argc = 3; + ca.fname = argv[0]; argv[3] = NULL; for (i=0; OidMacros[i].name; i++ ) { argv[1] = OidMacros[i].name; argv[2] = OidMacros[i].oid; - parse_oidm( "slapd", i, 3, argv, 0, NULL ); + parse_oidm( &ca, 0, NULL ); } bi->bi_cf_ocs = cf_ocs;