X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fconfig.c;h=90923bd989a7321e91c8b90890cad735daf60ca7;hb=d531a20f5216c803a7839488e3e33f32b88c5d87;hp=f05fd086916cf01fa49ed3ec74e2f07de255831d;hpb=288a28a762d29dba347df29c88938d47a6fe08e3;p=openldap diff --git a/servers/slapd/config.c b/servers/slapd/config.c index f05fd08691..90923bd989 100644 --- a/servers/slapd/config.c +++ b/servers/slapd/config.c @@ -1,20 +1,23 @@ /* config.c - configuration file handling routines */ +/* $OpenLDAP$ */ +/* + * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved. + * COPYING RESTRICTIONS APPLY, see COPYRIGHT file + */ #include "portable.h" #include -#ifdef HAVE_LOCALE_H -#include -#endif #include #include #include -#include "ldap_defaults.h" +#include "lutil.h" +#include "ldap_pvt.h" #include "slap.h" -#define MAXARGS 100 +#define MAXARGS 200 /* * defaults for various global variables @@ -22,29 +25,42 @@ int defsize = SLAPD_DEFAULT_SIZELIMIT; int deftime = SLAPD_DEFAULT_TIMELIMIT; AccessControl *global_acl = NULL; -int global_default_access = ACL_READ; +slap_access_t global_default_access = ACL_READ; +slap_mask_t global_restrictops = 0; +slap_mask_t global_allows = 0; +slap_mask_t global_disallows = 0; +slap_mask_t global_requires = 0; +slap_ssf_set_t global_ssf_set; char *replogfile; -int global_lastmod; +int global_lastmod = ON; int global_idletimeout = 0; +char *global_host = NULL; char *global_realm = NULL; char *ldap_srvtab = ""; +char *default_passwd_hash; +char *default_search_base = NULL; +char *default_search_nbase = NULL; char *slapd_pid_file = NULL; char *slapd_args_file = NULL; +int nSaslRegexp = 0; +SaslRegexp_t *SaslRegexp = NULL; + static char *fp_getline(FILE *fp, int *lineno); static void fp_getline_init(int *lineno); static int fp_parse_line(char *line, int *argcp, char **argv); static char *strtok_quote(char *line, char *sep); +static int load_ucdata(char *path); int -read_config( char *fname ) +read_config( const char *fname ) { FILE *fp; char *line, *savefname, *saveline; int cargc, savelineno; - char *cargv[MAXARGS]; + char *cargv[MAXARGS+1]; int lineno, i; #ifdef HAVE_TLS int rc; @@ -69,13 +85,6 @@ read_config( char *fname ) Debug( LDAP_DEBUG_CONFIG, "reading config file %s\n", fname, 0, 0 ); - if ( schema_init( ) != 0 ) { - Debug( LDAP_DEBUG_ANY, - "error initializing the schema\n", - 0, 0, 0 ); - return( 1 ); - } - fp_getline_init( &lineno ); while ( (line = fp_getline( fp, &lineno )) != NULL ) { @@ -117,7 +126,12 @@ read_config( char *fname ) bi = backend_info( cargv[1] ); - /* start of a new database definition */ + if( bi == NULL ) { + Debug( LDAP_DEBUG_ANY, + "backend %s initialization failed.\n", + cargv[1], 0, 0 ); + return( 1 ); + } } else if ( strcasecmp( cargv[0], "database" ) == 0 ) { if ( cargc < 2 ) { Debug( LDAP_DEBUG_ANY, @@ -125,11 +139,103 @@ read_config( char *fname ) fname, lineno, 0 ); return( 1 ); } + bi = NULL; be = backend_db_init( cargv[1] ); - /* assign a default depth limit for alias deref */ - be->be_max_deref_depth = SLAPD_DEFAULT_MAXDEREFDEPTH; + if( be == NULL ) { + Debug( LDAP_DEBUG_ANY, + "database %s initialization failed.\n", + cargv[1], 0, 0 ); + return( 1 ); + } + + /* set thread concurrency */ + } else if ( strcasecmp( cargv[0], "concurrency" ) == 0 ) { + int c; + if ( cargc < 2 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: missing level in \"concurrency \" line\n", + fname, lineno, 0 ); + return( 1 ); + } + + c = atoi( cargv[1] ); + + if( c < 1 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: invalid level (%d) in \"concurrency \" line\n", + fname, lineno, c ); + return( 1 ); + } + + ldap_pvt_thread_set_concurrency( c ); + + /* default search base */ + } else if ( strcasecmp( cargv[0], "defaultSearchBase" ) == 0 ) { + if ( cargc < 2 ) { + Debug( LDAP_DEBUG_ANY, "%s: line %d: " + "missing dn in \"defaultSearchBase \" line\n", + fname, lineno, 0 ); + return 1; + + } else if ( cargc > 2 ) { + Debug( LDAP_DEBUG_ANY, "%s: line %d: " + "extra cruft after in \"defaultSearchBase %s\", " + "line (ignored)\n", + fname, lineno, cargv[1] ); + } + + if ( bi != NULL || be != NULL ) { + Debug( LDAP_DEBUG_ANY, "%s: line %d: " + "defaultSearchBaase line must appear prior to " + "any backend or database definition\n", + fname, lineno, 0 ); + return 1; + } + + if ( default_search_nbase != NULL ) { + Debug( LDAP_DEBUG_ANY, "%s: line %d: " + "default search base \"%s\" already defined " + "(discarding old)\n", + fname, lineno, default_search_base ); + free( default_search_base ); + free( default_search_nbase ); + } + + default_search_base = ch_strdup( cargv[1] ); + default_search_nbase = ch_strdup( cargv[1] ); + + if ( load_ucdata( NULL ) < 0 ) { + return( 1 ); + } + if( dn_normalize( default_search_nbase ) == NULL ) { + Debug( LDAP_DEBUG_ANY, "%s: line %d: " + "invalid default search base \"%s\"\n", + fname, lineno, default_search_base ); + return 1; + } + + /* set maximum threads in thread pool */ + } else if ( strcasecmp( cargv[0], "threads" ) == 0 ) { + int c; + if ( cargc < 2 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: missing count in \"threads \" line\n", + fname, lineno, 0 ); + return( 1 ); + } + + c = atoi( cargv[1] ); + + if( c < 0 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: invalid level (%d) in \"threads \" line\n", + fname, lineno, c ); + return( 1 ); + } + + ldap_pvt_thread_pool_maxthreads( &connection_pool, c ); /* get pid file name */ } else if ( strcasecmp( cargv[0], "pidfile" ) == 0 ) { @@ -153,20 +259,55 @@ read_config( char *fname ) slapd_args_file = ch_strdup( cargv[1] ); - /* set DIGEST realm */ - } else if ( strcasecmp( cargv[0], "digest-realm" ) == 0 ) { + /* default password hash */ + } else if ( strcasecmp( cargv[0], "password-hash" ) == 0 ) { if ( cargc < 2 ) { Debug( LDAP_DEBUG_ANY, - "%s: line %d: missing realm in \"digest-realm \" line\n", + "%s: line %d: missing hash in \"password-hash \" line\n", fname, lineno, 0 ); return( 1 ); } - if ( be != NULL ) { - be->be_realm = ch_strdup( cargv[1] ); + if ( default_passwd_hash != NULL ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: already set default password_hash!\n", + fname, lineno, 0 ); + return 1; + + } else { + default_passwd_hash = ch_strdup( cargv[1] ); + } + + /* set SASL host */ + } else if ( strcasecmp( cargv[0], "sasl-host" ) == 0 ) { + if ( cargc < 2 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: missing host in \"sasl-host \" line\n", + fname, lineno, 0 ); + return( 1 ); + } + + if ( global_host != NULL ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: already set sasl-host!\n", + fname, lineno, 0 ); + return 1; + + } else { + global_host = ch_strdup( cargv[1] ); + } - } else if ( global_realm != NULL ) { + /* set SASL realm */ + } else if ( strcasecmp( cargv[0], "sasl-realm" ) == 0 ) { + if ( cargc < 2 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: missing realm in \"sasl-realm \" line\n", + fname, lineno, 0 ); + return( 1 ); + } + + if ( global_realm != NULL ) { Debug( LDAP_DEBUG_ANY, - "%s: line %d: already set global realm!\n", + "%s: line %d: already set sasl-realm!\n", fname, lineno, 0 ); return 1; @@ -174,6 +315,60 @@ read_config( char *fname ) global_realm = ch_strdup( cargv[1] ); } + } else if ( !strcasecmp( cargv[0], "sasl-regexp" ) + || !strcasecmp( cargv[0], "saslregexp" ) ) + { + int rc; + if ( cargc != 3 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: need 2 args in \"saslregexp \"\n", + fname, lineno, 0 ); + return( 1 ); + } + rc = slap_sasl_regexp_config( cargv[1], cargv[2] ); + if ( rc ) { + return rc; + } + + /* SASL security properties */ + } else if ( strcasecmp( cargv[0], "sasl-secprops" ) == 0 ) { + char *txt; + + if ( cargc < 2 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: missing flags in \"sasl-secprops \" line\n", + fname, lineno, 0 ); + return 1; + } + + txt = slap_sasl_secprops( cargv[1] ); + if ( txt != NULL ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: sasl-secprops: %s\n", + fname, lineno, txt ); + return 1; + } + + /* set UCDATA path */ + } else if ( strcasecmp( cargv[0], "ucdata-path" ) == 0 ) { + int err; + if ( cargc < 2 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: missing path in \"ucdata-path \" line\n", + fname, lineno, 0 ); + return( 1 ); + } + + err = load_ucdata( cargv[1] ); + if ( err <= 0 ) { + if ( err == 0 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: ucdata already loaded, ucdata-path must be set earlier in the file and/or be specified only once!\n", + fname, lineno, 0 ); + } + return( 1 ); + } + /* set time limit */ } else if ( strcasecmp( cargv[0], "sizelimit" ) == 0 ) { if ( cargc < 2 ) { @@ -204,6 +399,7 @@ read_config( char *fname ) /* set database suffix */ } else if ( strcasecmp( cargv[0], "suffix" ) == 0 ) { + Backend *tmp_be; if ( cargc < 2 ) { Debug( LDAP_DEBUG_ANY, "%s: line %d: missing dn in \"suffix \" line\n", @@ -218,15 +414,92 @@ read_config( char *fname ) Debug( LDAP_DEBUG_ANY, "%s: line %d: suffix line must appear inside a database definition (ignored)\n", fname, lineno, 0 ); + } else if ( ( tmp_be = select_backend( cargv[1], 0 ) ) == be ) { + Debug( LDAP_DEBUG_ANY, +"%s: line %d: suffix already served by this backend (ignored)\n", + fname, lineno, 0 ); + } else if ( tmp_be != NULL ) { + Debug( LDAP_DEBUG_ANY, +"%s: line %d: suffix already served by a preceeding backend \"%s\" (ignored)\n", + fname, lineno, tmp_be->be_suffix[0] ); } else { char *dn = ch_strdup( cargv[1] ); - (void) dn_normalize( dn ); + if ( load_ucdata( NULL ) < 0 ) { + return( 1 ); + } + if( dn_validate( dn ) == NULL ) { + Debug( LDAP_DEBUG_ANY, "%s: line %d: " + "suffix DN invalid \"%s\"\n", + fname, lineno, cargv[1] ); + return 1; + + } else if( *dn == '\0' && default_search_nbase != NULL ) { + Debug( LDAP_DEBUG_ANY, "%s: line %d: " + "suffix DN empty and default " + "search base provided \"%s\" (assuming okay)\n", + fname, lineno, default_search_base ); + } charray_add( &be->be_suffix, dn ); - (void) dn_upcase( dn ); + (void) ldap_pvt_str2upper( dn ); charray_add( &be->be_nsuffix, dn ); free( dn ); } + /* set database suffixAlias */ + } else if ( strcasecmp( cargv[0], "suffixAlias" ) == 0 ) { + Backend *tmp_be; + if ( cargc < 2 ) { + Debug( LDAP_DEBUG_ANY, +"%s: line %d: missing alias and aliased_dn in \"suffixAlias \" line\n", + fname, lineno, 0 ); + return( 1 ); + } else if ( cargc < 3 ) { + Debug( LDAP_DEBUG_ANY, +"%s: line %d: missing aliased_dn in \"suffixAlias \" line\n", + fname, lineno, 0 ); + return( 1 ); + } else if ( cargc > 3 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: extra cruft in suffixAlias line (ignored)\n", + fname, lineno, 0 ); + } + + if ( be == NULL ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: suffixAlias line" + " must appear inside a database definition (ignored)\n", + fname, lineno, 0 ); + } else if ( (tmp_be = select_backend( cargv[1], 0 )) != NULL ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: suffixAlias served by" + " a preceeding backend \"%s\" (ignored)\n", + fname, lineno, tmp_be->be_suffix[0] ); + + } else if ( (tmp_be = select_backend( cargv[2], 0 )) != NULL ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: suffixAlias derefs to differnet backend" + " a preceeding backend \"%s\" (ignored)\n", + fname, lineno, tmp_be->be_suffix[0] ); + + } else { + char *alias, *aliased_dn; + + alias = ch_strdup( cargv[1] ); + if ( load_ucdata( NULL ) < 0 ) { + return( 1 ); + } + (void) dn_normalize( alias ); + + aliased_dn = ch_strdup( cargv[2] ); + (void) dn_normalize( aliased_dn ); + + charray_add( &be->be_suffixAlias, alias ); + charray_add( &be->be_suffixAlias, aliased_dn ); + + free(alias); + free(aliased_dn); + } + /* set max deref depth */ } else if ( strcasecmp( cargv[0], "maxDerefDepth" ) == 0 ) { int i; @@ -240,7 +513,7 @@ read_config( char *fname ) Debug( LDAP_DEBUG_ANY, "%s: line %d: depth line must appear inside a database definition (ignored)\n", fname, lineno, 0 ); - } else if ((i = atoi(cargv[i])) < 0) { + } else if ((i = atoi(cargv[1])) < 0) { Debug( LDAP_DEBUG_ANY, "%s: line %d: depth must be positive (ignored)\n", fname, lineno, 0 ); @@ -264,7 +537,19 @@ read_config( char *fname ) fname, lineno, 0 ); } else { be->be_root_dn = ch_strdup( cargv[1] ); - be->be_root_ndn = dn_normalize_case( ch_strdup( cargv[1] ) ); + be->be_root_ndn = ch_strdup( cargv[1] ); + + if ( load_ucdata( NULL ) < 0 ) { + return( 1 ); + } + if( dn_normalize( be->be_root_ndn ) == NULL ) { + free( be->be_root_dn ); + free( be->be_root_ndn ); + Debug( LDAP_DEBUG_ANY, +"%s: line %d: rootdn DN is invalid\n", + fname, lineno, 0 ); + return( 1 ); + } } /* set super-secret magic database password */ @@ -280,7 +565,8 @@ read_config( char *fname ) "%s: line %d: rootpw line must appear inside a database definition (ignored)\n", fname, lineno, 0 ); } else { - be->be_root_pw = ch_strdup( cargv[1] ); + be->be_root_pw.bv_val = ch_strdup( cargv[1] ); + be->be_root_pw.bv_len = strlen( be->be_root_pw.bv_val ); } /* make this database read-only */ @@ -292,78 +578,292 @@ read_config( char *fname ) return( 1 ); } if ( be == NULL ) { - Debug( LDAP_DEBUG_ANY, -"%s: line %d: readonly line must appear inside a database definition (ignored)\n", - fname, lineno, 0 ); + if ( strcasecmp( cargv[1], "on" ) == 0 ) { + global_restrictops |= SLAP_RESTRICT_OP_WRITES; + } else { + global_restrictops &= ~SLAP_RESTRICT_OP_WRITES; + } } else { if ( strcasecmp( cargv[1], "on" ) == 0 ) { - be->be_readonly = 1; + be->be_restrictops |= SLAP_RESTRICT_OP_WRITES; } else { - be->be_readonly = 0; + be->be_restrictops &= ~SLAP_RESTRICT_OP_WRITES; } } - /* where to send clients when we don't hold it */ - } else if ( strcasecmp( cargv[0], "referral" ) == 0 ) { + + /* allow these features */ + } else if ( strcasecmp( cargv[0], "allows" ) == 0 || + strcasecmp( cargv[0], "allow" ) == 0 ) + { + slap_mask_t allows; + + if ( be != NULL ) { + Debug( LDAP_DEBUG_ANY, +"%s: line %d: allow line must appear prior to database definitions\n", + fname, lineno, 0 ); + } + if ( cargc < 2 ) { Debug( LDAP_DEBUG_ANY, - "%s: line %d: missing URL in \"referral \" line\n", + "%s: line %d: missing feature(s) in \"allow \" line\n", fname, lineno, 0 ); return( 1 ); } - vals[0]->bv_val = cargv[1]; - vals[0]->bv_len = strlen( vals[0]->bv_val ); - value_add( &default_referral, vals ); + allows = 0; + + for( i=1; i < cargc; i++ ) { + if( strcasecmp( cargv[i], "tls_2_anon" ) == 0 ) { + allows |= SLAP_ALLOW_TLS_2_ANON; + + } else if( strcasecmp( cargv[i], "none" ) != 0 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: unknown feature %s in \"allow \" line\n", + fname, lineno, cargv[i] ); + return( 1 ); + } + } + + global_allows = allows; + + /* disallow these features */ + } else if ( strcasecmp( cargv[0], "disallows" ) == 0 || + strcasecmp( cargv[0], "disallow" ) == 0 ) + { + slap_mask_t disallows; + + if ( be != NULL ) { + Debug( LDAP_DEBUG_ANY, +"%s: line %d: disallow line must appear prior to database definitions\n", + fname, lineno, 0 ); + } + + if ( cargc < 2 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: missing feature(s) in \"disallow \" line\n", + fname, lineno, 0 ); + return( 1 ); + } + + disallows = 0; + + for( i=1; i < cargc; i++ ) { + if( strcasecmp( cargv[i], "bind_v2" ) == 0 ) { + disallows |= SLAP_DISALLOW_BIND_V2; + + } else if( strcasecmp( cargv[i], "bind_anon" ) == 0 ) { + disallows |= SLAP_DISALLOW_BIND_ANON; + + } else if( strcasecmp( cargv[i], "bind_anon_cred" ) == 0 ) { + disallows |= SLAP_DISALLOW_BIND_ANON_CRED; + + } else if( strcasecmp( cargv[i], "bind_anon_dn" ) == 0 ) { + disallows |= SLAP_DISALLOW_BIND_ANON_DN; + + } else if( strcasecmp( cargv[i], "bind_simple" ) == 0 ) { + disallows |= SLAP_DISALLOW_BIND_SIMPLE; + + } else if( strcasecmp( cargv[i], "bind_krbv4" ) == 0 ) { + disallows |= SLAP_DISALLOW_BIND_KRBV4; + + } else if( strcasecmp( cargv[i], "tls_authc" ) == 0 ) { + disallows |= SLAP_DISALLOW_TLS_AUTHC; + + } else if( strcasecmp( cargv[i], "none" ) != 0 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: unknown feature %s in \"disallow \" line\n", + fname, lineno, cargv[i] ); + return( 1 ); + } + } + + global_disallows = disallows; + + /* require these features */ + } else if ( strcasecmp( cargv[0], "requires" ) == 0 || + strcasecmp( cargv[0], "require" ) == 0 ) + { + slap_mask_t requires; - /* specify locale */ - } else if ( strcasecmp( cargv[0], "locale" ) == 0 ) { -#ifdef HAVE_LOCALE_H - char *locale; if ( cargc < 2 ) { Debug( LDAP_DEBUG_ANY, - "%s: line %d: missing locale in \"locale \" line\n", - fname, lineno, 0 ); + "%s: line %d: missing feature(s) in \"require \" line\n", + fname, lineno, 0 ); return( 1 ); } - locale = (strcasecmp( cargv[1], "on" ) == 0 ? "" - : strcasecmp( cargv[1], "off" ) == 0 ? "C" - : ch_strdup( cargv[1] ) ); + requires = 0; + + for( i=1; i < cargc; i++ ) { + if( strcasecmp( cargv[i], "bind" ) == 0 ) { + requires |= SLAP_REQUIRE_BIND; + + } else if( strcasecmp( cargv[i], "LDAPv3" ) == 0 ) { + requires |= SLAP_REQUIRE_LDAP_V3; + + } else if( strcasecmp( cargv[i], "authc" ) == 0 ) { + requires |= SLAP_REQUIRE_AUTHC; - if ( setlocale( LC_CTYPE, locale ) == 0 ) { + } else if( strcasecmp( cargv[i], "SASL" ) == 0 ) { + requires |= SLAP_REQUIRE_SASL; + + } else if( strcasecmp( cargv[i], "strong" ) == 0 ) { + requires |= SLAP_REQUIRE_STRONG; + + } else if( strcasecmp( cargv[i], "none" ) != 0 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: unknown feature %s in \"require \" line\n", + fname, lineno, cargv[i] ); + return( 1 ); + } + } + + if ( be == NULL ) { + global_requires = requires; + } else { + be->be_requires = requires; + } + + /* required security factors */ + } else if ( strcasecmp( cargv[0], "security" ) == 0 ) { + slap_ssf_set_t *set; + + if ( cargc < 2 ) { Debug( LDAP_DEBUG_ANY, - (*locale - ? "%s: line %d: bad locale \"%s\"\n" - : "%s: line %d: bad locale\n"), - fname, lineno, locale ); + "%s: line %d: missing factor(s) in \"security \" line\n", + fname, lineno, 0 ); return( 1 ); } -#else - Debug( LDAP_DEBUG_ANY, - "%s: line %d: \"locale\" unsupported\n", - fname, lineno, 0 ); - return( 1 ); + + if ( be == NULL ) { + set = &global_ssf_set; + } else { + set = &be->be_ssf_set; + } + + for( i=1; i < cargc; i++ ) { + if( strncasecmp( cargv[i], "ssf=", + sizeof("ssf") ) == 0 ) + { + set->sss_ssf = + atoi( &cargv[i][sizeof("ssf")] ); + + } else if( strncasecmp( cargv[i], "transport=", + sizeof("transport") ) == 0 ) + { + set->sss_transport = + atoi( &cargv[i][sizeof("transport")] ); + + } else if( strncasecmp( cargv[i], "tls=", + sizeof("tls") ) == 0 ) + { + set->sss_tls = + atoi( &cargv[i][sizeof("tls")] ); + + } else if( strncasecmp( cargv[i], "sasl=", + sizeof("sasl") ) == 0 ) + { + set->sss_sasl = + atoi( &cargv[i][sizeof("sasl")] ); + + } else if( strncasecmp( cargv[i], "update_ssf=", + sizeof("update_ssf") ) == 0 ) + { + set->sss_update_ssf = + atoi( &cargv[i][sizeof("update_ssf")] ); + + } else if( strncasecmp( cargv[i], "update_transport=", + sizeof("update_transport") ) == 0 ) + { + set->sss_update_transport = + atoi( &cargv[i][sizeof("update_transport")] ); + + } else if( strncasecmp( cargv[i], "update_tls=", + sizeof("update_tls") ) == 0 ) + { + set->sss_update_tls = + atoi( &cargv[i][sizeof("update_tls")] ); + + } else if( strncasecmp( cargv[i], "update_sasl=", + sizeof("update_sasl") ) == 0 ) + { + set->sss_update_sasl = + atoi( &cargv[i][sizeof("update_sasl")] ); + + } else { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: unknown factor %s in \"security \" line\n", + fname, lineno, cargv[i] ); + return( 1 ); + } + } + /* where to send clients when we don't hold it */ + } else if ( strcasecmp( cargv[0], "referral" ) == 0 ) { + if ( cargc < 2 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: missing URL in \"referral \" line\n", + fname, lineno, 0 ); + return( 1 ); + } + + vals[0]->bv_val = cargv[1]; + vals[0]->bv_len = strlen( vals[0]->bv_val ); + value_add( &default_referral, vals ); + +#ifdef NEW_LOGGING + } else if ( strcasecmp( cargv[0], "logfile" ) == 0 ) { + FILE *logfile; + if ( cargc < 2 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: Error in logfile directive, \"logfile filename\"\n", + fname, lineno, 0 ); + return( 1 ); + } + logfile = fopen( cargv[1], "w" ); + if ( logfile != NULL ) lutil_debug_file( logfile ); + #endif + /* start of a new database definition */ + } else if ( strcasecmp( cargv[0], "debug" ) == 0 ) { + int level; + if ( cargc < 3 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: Error in debug directive, \"debug subsys level\"\n", + fname, lineno, 0 ); + return( 1 ); + } + level = atoi( cargv[2] ); + if ( level <= 0 ) level = lutil_mnem2level( cargv[2] ); + lutil_set_debug_level( cargv[1], level ); + /* specify an Object Identifier macro */ + } else if ( strcasecmp( cargv[0], "objectidentifier" ) == 0 ) { + parse_oidm( fname, lineno, cargc, cargv ); + /* specify an objectclass */ } else if ( strcasecmp( cargv[0], "objectclass" ) == 0 ) { if ( *cargv[1] == '(' ) { char * p; p = strchr(saveline,'('); - parse_oc( fname, lineno, p ); + parse_oc( fname, lineno, p, cargv ); } else { - parse_oc_old( be, fname, lineno, cargc, cargv ); + Debug( LDAP_DEBUG_ANY, + "%s: line %d: old objectclass format not supported.\n", + fname, lineno, 0 ); } - /* specify an attribute */ - } else if ( strcasecmp( cargv[0], "attribute" ) == 0 ) { + /* specify an attribute type */ + } else if (( strcasecmp( cargv[0], "attributetype" ) == 0 ) + || ( strcasecmp( cargv[0], "attribute" ) == 0 )) + { if ( *cargv[1] == '(' ) { char * p; p = strchr(saveline,'('); - parse_at( fname, lineno, p ); + parse_at( fname, lineno, p, cargv ); } else { - attr_syntax_config( fname, lineno, cargc - 1, - &cargv[1] ); + Debug( LDAP_DEBUG_ANY, + "%s: line %d: old attribute type format not supported.\n", + fname, lineno, 0 ); } /* turn on/off schema checking */ @@ -384,35 +884,6 @@ read_config( char *fname ) } else if ( strcasecmp( cargv[0], "access" ) == 0 ) { parse_acl( be, fname, lineno, cargc, cargv ); - /* specify default access control info */ - } else if ( strcasecmp( cargv[0], "defaultaccess" ) == 0 ) { - if ( cargc < 2 ) { - Debug( LDAP_DEBUG_ANY, - "%s: line %d: missing limit in \"defaultaccess \" line\n", - fname, lineno, 0 ); - return( 1 ); - } - if ( be == NULL ) { - if ( ACL_IS_INVALID(ACL_SET(global_default_access, - str2access(cargv[1]))) ) - { - Debug( LDAP_DEBUG_ANY, -"%s: line %d: bad access \"%s\" expecting [self]{none|compare|read|write}\n", - fname, lineno, cargv[1] ); - return( 1 ); - } - } else { - if ( ACL_IS_INVALID(ACL_SET(be->be_dfltaccess, - str2access(cargv[1]))) ) - { - Debug( LDAP_DEBUG_ANY, - "%s: line %d: bad access \"%s\", " - "expecting [self]{none|compare|search|read|write}\n", - fname, lineno, cargv[1] ); - return( 1 ); - } - } - /* debug level to log things to syslog */ } else if ( strcasecmp( cargv[0], "loglevel" ) == 0 ) { if ( cargc < 2 ) { @@ -421,7 +892,12 @@ read_config( char *fname ) fname, lineno, 0 ); return( 1 ); } - ldap_syslog = atoi( cargv[1] ); + + ldap_syslog = 0; + + for( i=1; i < cargc; i++ ) { + ldap_syslog += atoi( cargv[1] ); + } /* list of replicas of the data in this backend (master only) */ } else if ( strcasecmp( cargv[0], "replica" ) == 0 ) { @@ -465,7 +941,15 @@ read_config( char *fname ) fname, lineno, 0 ); } else { be->be_update_ndn = ch_strdup( cargv[1] ); - (void) dn_normalize_case( be->be_update_ndn ); + if ( load_ucdata( NULL ) < 0 ) { + return( 1 ); + } + if( dn_normalize( be->be_update_ndn ) == NULL ) { + Debug( LDAP_DEBUG_ANY, +"%s: line %d: updatedn DN is invalid\n", + fname, lineno, 0 ); + return 1; + } } } else if ( strcasecmp( cargv[0], "updateref" ) == 0 ) { @@ -573,18 +1057,31 @@ read_config( char *fname ) ldap_srvtab = ch_strdup( cargv[1] ); #ifdef SLAPD_MODULES - } else if (strcasecmp( cargv[0], "loadmodule") == 0 ) { + } else if (strcasecmp( cargv[0], "moduleload") == 0 ) { if ( cargc < 2 ) { Debug( LDAP_DEBUG_ANY, - "%s: line %d: missing filename in \"loadmodule \" line\n", + "%s: line %d: missing filename in \"moduleload \" line\n", fname, lineno, 0 ); - exit( 1 ); + exit( EXIT_FAILURE ); } - if (!load_module(cargv[1], cargc - 2, (cargc > 2) ? cargv + 2 : NULL)) { + if (module_load(cargv[1], cargc - 2, (cargc > 2) ? cargv + 2 : NULL)) { Debug( LDAP_DEBUG_ANY, "%s: line %d: failed to load or initialize module %s\n", fname, lineno, cargv[1]); - exit( 1 ); + exit( EXIT_FAILURE ); + } + } else if (strcasecmp( cargv[0], "modulepath") == 0 ) { + if ( cargc != 2 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: missing path in \"modulepath \" line\n", + fname, lineno, 0 ); + exit( EXIT_FAILURE ); + } + if (module_path( cargv[1] )) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: failed to set module search path to %s\n", + fname, lineno, cargv[1]); + exit( EXIT_FAILURE ); } #endif /*SLAPD_MODULES*/ @@ -632,9 +1129,10 @@ read_config( char *fname ) if ( rc ) return rc; } else if ( !strcasecmp( cargv[0], "TLSVerifyClient" ) ) { + i = atoi(cargv[1]); rc = ldap_pvt_tls_set_option( NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, - cargv[1] ); + &i ); if ( rc ) return rc; @@ -675,6 +1173,9 @@ read_config( char *fname ) free( saveline ); } fclose( fp ); + if ( load_ucdata( NULL ) < 0 ) { + return( 1 ); + } return( 0 ); } @@ -729,12 +1230,12 @@ strtok_quote( char *line, char *sep ) } else { inquote = 1; } - SAFEMEMCPY( next, next + 1, strlen( next + 1 ) + 1 ); + AC_MEMCPY( next, next + 1, strlen( next + 1 ) + 1 ); break; case '\\': if ( next[1] ) - SAFEMEMCPY( next, + AC_MEMCPY( next, next + 1, strlen( next + 1 ) + 1 ); next++; /* dont parse the escaped character */ break; @@ -806,3 +1307,24 @@ fp_getline_init( int *lineno ) *lineno = -1; buf[0] = '\0'; } + +/* Loads ucdata, returns 1 if loading, 0 if already loaded, -1 on error */ +static int +load_ucdata( char *path ) +{ + static int loaded = 0; + int err; + + if ( loaded ) { + return( 0 ); + } + err = ucdata_load( path ? path : SLAPD_DEFAULT_UCDATA, + UCDATA_CASE|UCDATA_CTYPE|UCDATA_NUM ); + if ( err ) { + Debug( LDAP_DEBUG_ANY, "error loading ucdata (error %d)\n", + err, 0, 0 ); + return( -1 ); + } + loaded = 1; + return( 1 ); +}