X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fconfig.c;h=f5041fe0070dc9dca5c9761f122ab85e1cbb9a21;hb=2ece0ee378a47df99a05a0dd0db3763bdf9bb125;hp=7243135fbd837e2766ceabeb90dec019ab8c761b;hpb=ae481022f91b73caee0453daf5d58815b9c5c9b6;p=openldap diff --git a/servers/slapd/config.c b/servers/slapd/config.c index 7243135fbd..f5041fe007 100644 --- a/servers/slapd/config.c +++ b/servers/slapd/config.c @@ -1,17 +1,19 @@ /* config.c - configuration file handling routines */ +/* $OpenLDAP$ */ +/* + * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved. + * COPYING RESTRICTIONS APPLY, see COPYRIGHT file + */ #include "portable.h" #include -#ifdef HAVE_LOCALE_H -#include -#endif #include #include #include -#include "ldapconfig.h" +#include "ldap_pvt.h" #include "slap.h" #define MAXARGS 100 @@ -21,11 +23,15 @@ */ int defsize = SLAPD_DEFAULT_SIZELIMIT; int deftime = SLAPD_DEFAULT_TIMELIMIT; -struct acl *global_acl = NULL; -int global_default_access = ACL_READ; +AccessControl *global_acl = NULL; +slap_access_t global_default_access = ACL_READ; +int global_readonly = 0; char *replogfile; -int global_lastmod; +int global_lastmod = ON; +int global_idletimeout = 0; +char *global_realm = NULL; char *ldap_srvtab = ""; +char *default_passwd_hash; char *slapd_pid_file = NULL; char *slapd_args_file = NULL; @@ -37,17 +43,25 @@ static int fp_parse_line(char *line, int *argcp, char **argv); static char *strtok_quote(char *line, char *sep); int -read_config( char *fname ) +read_config( const char *fname ) { FILE *fp; char *line, *savefname, *saveline; int cargc, savelineno; char *cargv[MAXARGS]; int lineno, i; +#ifdef HAVE_TLS + int rc; +#endif + struct berval *vals[2]; + struct berval val; static BackendInfo *bi = NULL; static BackendDB *be = NULL; + vals[0] = &val; + vals[1] = NULL; + if ( (fp = fopen( fname, "r" )) == NULL ) { ldap_syslog = 1; Debug( LDAP_DEBUG_ANY, @@ -100,6 +114,13 @@ read_config( char *fname ) bi = backend_info( cargv[1] ); + if( bi == NULL ) { + Debug( LDAP_DEBUG_ANY, + "backend %s initialization failed.n", + cargv[1], 0, 0 ); + return( 1 ); + } + /* start of a new database definition */ } else if ( strcasecmp( cargv[0], "database" ) == 0 ) { if ( cargc < 2 ) { @@ -108,11 +129,37 @@ read_config( char *fname ) fname, lineno, 0 ); return( 1 ); } + bi = NULL; be = backend_db_init( cargv[1] ); - /* assign a default depth limit for alias deref */ - be->be_maxDerefDepth = SLAPD_DEFAULT_MAXDEREFDEPTH; + if( be == NULL ) { + Debug( LDAP_DEBUG_ANY, + "database %s initialization failed.n", + cargv[1], 0, 0 ); + return( 1 ); + } + + /* set thread concurrency */ + } else if ( strcasecmp( cargv[0], "concurrency" ) == 0 ) { + int c; + if ( cargc < 2 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: missing level in \"concurrency \" line\n", + fname, lineno, 0 ); + return( 1 ); + } + + c = atoi( cargv[1] ); + + if( c < 1 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: invalid level (%d) in \"concurrency \" line\n", + fname, lineno, c ); + return( 1 ); + } + + ldap_pvt_thread_set_concurrency( c ); /* get pid file name */ } else if ( strcasecmp( cargv[0], "pidfile" ) == 0 ) { @@ -136,7 +183,46 @@ read_config( char *fname ) slapd_args_file = ch_strdup( cargv[1] ); - /* set size limit */ + /* default password hash */ + } else if ( strcasecmp( cargv[0], "password-hash" ) == 0 ) { + if ( cargc < 2 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: missing realm in \"password-hash \" line\n", + fname, lineno, 0 ); + return( 1 ); + } + if ( default_passwd_hash != NULL ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: already set default password_hash!\n", + fname, lineno, 0 ); + return 1; + + } else { + default_passwd_hash = ch_strdup( cargv[1] ); + } + + /* set DIGEST realm */ + } else if ( strcasecmp( cargv[0], "digest-realm" ) == 0 ) { + if ( cargc < 2 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: missing realm in \"digest-realm \" line\n", + fname, lineno, 0 ); + return( 1 ); + } + if ( be != NULL ) { + be->be_realm = ch_strdup( cargv[1] ); + + } else if ( global_realm != NULL ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: already set global realm!\n", + fname, lineno, 0 ); + return 1; + + } else { + global_realm = ch_strdup( cargv[1] ); + } + + /* set time limit */ } else if ( strcasecmp( cargv[0], "sizelimit" ) == 0 ) { if ( cargc < 2 ) { Debug( LDAP_DEBUG_ANY, @@ -166,6 +252,7 @@ read_config( char *fname ) /* set database suffix */ } else if ( strcasecmp( cargv[0], "suffix" ) == 0 ) { + Backend *tmp_be; if ( cargc < 2 ) { Debug( LDAP_DEBUG_ANY, "%s: line %d: missing dn in \"suffix \" line\n", @@ -180,63 +267,78 @@ read_config( char *fname ) Debug( LDAP_DEBUG_ANY, "%s: line %d: suffix line must appear inside a database definition (ignored)\n", fname, lineno, 0 ); + } else if ( ( tmp_be = select_backend( cargv[1] ) ) == be ) { + Debug( LDAP_DEBUG_ANY, +"%s: line %d: suffix already served by this backend (ignored)\n", + fname, lineno, 0 ); + } else if ( tmp_be != NULL ) { + Debug( LDAP_DEBUG_ANY, +"%s: line %d: suffix already served by a preceeding backend \"%s\" (ignored)\n", + fname, lineno, tmp_be->be_suffix[0] ); } else { char *dn = ch_strdup( cargv[1] ); - (void) dn_normalize( dn ); + (void) dn_validate( dn ); charray_add( &be->be_suffix, dn ); - (void) dn_upcase( dn ); + (void) ldap_pvt_str2upper( dn ); charray_add( &be->be_nsuffix, dn ); free( dn ); } - /* set database suffixAlias */ - } else if ( strcasecmp( cargv[0], "suffixAlias" ) == 0 ) { - if ( cargc < 2 ) { - Debug( LDAP_DEBUG_ANY, - "%s: line %d: missing alias and aliased_dn in \"suffixAlias \" line\n", - fname, lineno, 0 ); - return( 1 ); - } else if ( cargc < 3 ) { - Debug( LDAP_DEBUG_ANY, - "%s: line %d: missing aliased_dn in \"suffixAlias \" line\n", - fname, lineno, 0 ); - return( 1 ); - } else if ( cargc > 3 ) { - Debug( LDAP_DEBUG_ANY, - "%s: line %d: extra cruft in suffixAlias line (ignored)\n", - fname, lineno, 0 ); - } - if ( be == NULL ) { - Debug( LDAP_DEBUG_ANY, -"%s: line %d: suffixAlias line must appear inside a database definition (ignored)\n", - fname, lineno, 0 ); - } else { - char *alias, *aliased_dn; - - alias = ch_strdup( cargv[1] ); - (void) dn_normalize( alias ); - - aliased_dn = ch_strdup( cargv[2] ); - (void) dn_normalize( aliased_dn ); - - - if ( strcasecmp( alias, aliased_dn) == 0 ) { - Debug( LDAP_DEBUG_ANY, -"%s: line %d: suffixAlias %s is not different from aliased dn (ignored)\n", - fname, lineno, alias ); - } else { - (void) dn_normalize_case( alias ); - (void) dn_normalize_case( aliased_dn ); - charray_add( &be->be_suffixAlias, alias ); - charray_add( &be->be_suffixAlias, aliased_dn ); - } - - free(alias); - free(aliased_dn); - } + /* set database suffixAlias */ + } else if ( strcasecmp( cargv[0], "suffixAlias" ) == 0 ) { + Backend *tmp_be; + if ( cargc < 2 ) { + Debug( LDAP_DEBUG_ANY, +"%s: line %d: missing alias and aliased_dn in \"suffixAlias \" line\n", + fname, lineno, 0 ); + return( 1 ); + } else if ( cargc < 3 ) { + Debug( LDAP_DEBUG_ANY, +"%s: line %d: missing aliased_dn in \"suffixAlias \" line\n", + fname, lineno, 0 ); + return( 1 ); + } else if ( cargc > 3 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: extra cruft in suffixAlias line (ignored)\n", + fname, lineno, 0 ); + } + + if ( be == NULL ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: suffixAlias line" + " must appear inside a database definition (ignored)\n", + fname, lineno, 0 ); + } else if ( (tmp_be = select_backend( cargv[1] )) != NULL ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: suffixAlias served by" + " a preceeding backend \"%s\" (ignored)\n", + fname, lineno, tmp_be->be_suffix[0] ); + + } else if ( (tmp_be = select_backend( cargv[2] )) != NULL ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: suffixAlias derefs to differnet backend" + " a preceeding backend \"%s\" (ignored)\n", + fname, lineno, tmp_be->be_suffix[0] ); + + } else { + char *alias, *aliased_dn; + + alias = ch_strdup( cargv[1] ); + (void) dn_normalize( alias ); + + aliased_dn = ch_strdup( cargv[2] ); + (void) dn_normalize( aliased_dn ); + + charray_add( &be->be_suffixAlias, alias ); + charray_add( &be->be_suffixAlias, aliased_dn ); + + free(alias); + free(aliased_dn); + } /* set max deref depth */ } else if ( strcasecmp( cargv[0], "maxDerefDepth" ) == 0 ) { + int i; if ( cargc < 2 ) { Debug( LDAP_DEBUG_ANY, "%s: line %d: missing depth in \"maxDerefDepth \" line\n", @@ -247,9 +349,14 @@ read_config( char *fname ) Debug( LDAP_DEBUG_ANY, "%s: line %d: depth line must appear inside a database definition (ignored)\n", fname, lineno, 0 ); + } else if ((i = atoi(cargv[1])) < 0) { + Debug( LDAP_DEBUG_ANY, +"%s: line %d: depth must be positive (ignored)\n", + fname, lineno, 0 ); + } else { - be->be_maxDerefDepth = atoi (cargv[1]); - } + be->be_max_deref_depth = i; + } /* set magic "root" dn for this database */ @@ -266,7 +373,16 @@ read_config( char *fname ) fname, lineno, 0 ); } else { be->be_root_dn = ch_strdup( cargv[1] ); - be->be_root_ndn = dn_normalize_case( ch_strdup( cargv[1] ) ); + be->be_root_ndn = ch_strdup( cargv[1] ); + + if( dn_normalize( be->be_root_ndn ) == NULL ) { + free( be->be_root_dn ); + free( be->be_root_ndn ); + Debug( LDAP_DEBUG_ANY, +"%s: line %d: rootdn DN is invalid\n", + fname, lineno, 0 ); + return( 1 ); + } } /* set super-secret magic database password */ @@ -282,7 +398,8 @@ read_config( char *fname ) "%s: line %d: rootpw line must appear inside a database definition (ignored)\n", fname, lineno, 0 ); } else { - be->be_root_pw = ch_strdup( cargv[1] ); + be->be_root_pw.bv_val = ch_strdup( cargv[1] ); + be->be_root_pw.bv_len = strlen( be->be_root_pw.bv_val ); } /* make this database read-only */ @@ -294,9 +411,7 @@ read_config( char *fname ) return( 1 ); } if ( be == NULL ) { - Debug( LDAP_DEBUG_ANY, -"%s: line %d: readonly line must appear inside a database definition (ignored)\n", - fname, lineno, 0 ); + global_readonly = (strcasecmp( cargv[1], "on" ) == 0); } else { if ( strcasecmp( cargv[1], "on" ) == 0 ) { be->be_readonly = 1; @@ -313,59 +428,39 @@ read_config( char *fname ) fname, lineno, 0 ); return( 1 ); } - default_referral = (char *) ch_malloc( strlen( cargv[1] ) - + sizeof("Referral:\n") + 1 ); - strcpy( default_referral, "Referral:\n" ); - strcat( default_referral, cargv[1] ); - /* specify locale */ - } else if ( strcasecmp( cargv[0], "locale" ) == 0 ) { -#ifdef HAVE_LOCALE_H - char *locale; - if ( cargc < 2 ) { - Debug( LDAP_DEBUG_ANY, - "%s: line %d: missing locale in \"locale \" line\n", - fname, lineno, 0 ); - return( 1 ); - } + vals[0]->bv_val = cargv[1]; + vals[0]->bv_len = strlen( vals[0]->bv_val ); + value_add( &default_referral, vals ); - locale = (strcasecmp( cargv[1], "on" ) == 0 ? "" - : strcasecmp( cargv[1], "off" ) == 0 ? "C" - : ch_strdup( cargv[1] ) ); + /* specify an Object Identifier macro */ + } else if ( strcasecmp( cargv[0], "objectidentifier" ) == 0 ) { + parse_oidm( fname, lineno, cargc, cargv ); - if ( setlocale( LC_CTYPE, locale ) == 0 ) { - Debug( LDAP_DEBUG_ANY, - (*locale - ? "%s: line %d: bad locale \"%s\"\n" - : "%s: line %d: bad locale\n"), - fname, lineno, locale ); - return( 1 ); - } -#else - Debug( LDAP_DEBUG_ANY, - "%s: line %d: \"locale\" unsupported\n", - fname, lineno, 0 ); - return( 1 ); -#endif /* specify an objectclass */ } else if ( strcasecmp( cargv[0], "objectclass" ) == 0 ) { if ( *cargv[1] == '(' ) { char * p; p = strchr(saveline,'('); - parse_oc( fname, lineno, p ); + parse_oc( fname, lineno, p, cargv ); } else { - parse_oc_old( be, fname, lineno, cargc, cargv ); + Debug( LDAP_DEBUG_ANY, + "%s: line %d: old objectclass format not supported.\n", + fname, lineno, 0 ); } - /* specify an attribute */ - } else if ( strcasecmp( cargv[0], "attribute" ) == 0 ) { + /* specify an attribute type */ + } else if (( strcasecmp( cargv[0], "attributetype" ) == 0 ) + || ( strcasecmp( cargv[0], "attribute" ) == 0 )) + { if ( *cargv[1] == '(' ) { char * p; p = strchr(saveline,'('); - parse_at( fname, lineno, p ); + parse_at( fname, lineno, p, cargv ); } else { - attr_syntax_config( fname, lineno, cargc - 1, - &cargv[1] ); + Debug( LDAP_DEBUG_ANY, + "%s: line %d: old attribute type format not supported.\n", + fname, lineno, 0 ); } /* turn on/off schema checking */ @@ -388,28 +483,29 @@ read_config( char *fname ) /* specify default access control info */ } else if ( strcasecmp( cargv[0], "defaultaccess" ) == 0 ) { + slap_access_t access; + if ( cargc < 2 ) { Debug( LDAP_DEBUG_ANY, "%s: line %d: missing limit in \"defaultaccess \" line\n", fname, lineno, 0 ); return( 1 ); } + + access = str2access( cargv[1] ); + + if ( access == ACL_INVALID_ACCESS ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: bad access level \"%s\", " + "expecting none|auth|compare|search|read|write\n", + fname, lineno, cargv[1] ); + return( 1 ); + } + if ( be == NULL ) { - if ( (global_default_access = - str2access( cargv[1] )) == -1 ) { - Debug( LDAP_DEBUG_ANY, -"%s: line %d: bad access \"%s\" expecting [self]{none|compare|read|write}\n", - fname, lineno, cargv[1] ); - return( 1 ); - } + global_default_access = access; } else { - if ( (be->be_dfltaccess = - str2access( cargv[1] )) == -1 ) { - Debug( LDAP_DEBUG_ANY, -"%s: line %d: bad access \"%s\" expecting [self]{none|compare|read|write}\n", - fname, lineno, cargv[1] ); - return( 1 ); - } + be->be_dfltaccess = access; } /* debug level to log things to syslog */ @@ -464,7 +560,33 @@ read_config( char *fname ) fname, lineno, 0 ); } else { be->be_update_ndn = ch_strdup( cargv[1] ); - (void) dn_normalize_case( be->be_update_ndn ); + if( dn_normalize( be->be_update_ndn ) == NULL ) { + Debug( LDAP_DEBUG_ANY, +"%s: line %d: updatedn DN is invalid\n", + fname, lineno, 0 ); + return 1; + } + } + + } else if ( strcasecmp( cargv[0], "updateref" ) == 0 ) { + if ( cargc < 2 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: missing dn in \"updateref \" line\n", + fname, lineno, 0 ); + return( 1 ); + } + if ( be == NULL ) { + Debug( LDAP_DEBUG_ANY, +"%s: line %d: updateref line must appear inside a database definition (ignored)\n", + fname, lineno, 0 ); + } else if ( be->be_update_ndn == NULL ) { + Debug( LDAP_DEBUG_ANY, +"%s: line %d: updateref line must after updatedn (ignored)\n", + fname, lineno, 0 ); + } else { + vals[0]->bv_val = cargv[1]; + vals[0]->bv_len = strlen( vals[0]->bv_val ); + value_add( &be->be_update_refs, vals ); } /* replication log file to which changes are appended */ @@ -501,6 +623,27 @@ read_config( char *fname ) global_lastmod = OFF; } + /* set idle timeout value */ + } else if ( strcasecmp( cargv[0], "idletimeout" ) == 0 ) { + int i; + if ( cargc < 2 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: missing timeout value in \"idletimeout \" line\n", + fname, lineno, 0 ); + return( 1 ); + } + + i = atoi( cargv[1] ); + + if( i < 0 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: timeout value (%d) invalid \"idletimeout \" line\n", + fname, lineno, i ); + return( 1 ); + } + + global_idletimeout = i; + /* include another config file */ } else if ( strcasecmp( cargv[0], "include" ) == 0 ) { if ( cargc < 2 ) { @@ -529,6 +672,87 @@ read_config( char *fname ) } ldap_srvtab = ch_strdup( cargv[1] ); +#ifdef SLAPD_MODULES + } else if (strcasecmp( cargv[0], "moduleload") == 0 ) { + if ( cargc < 2 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: missing filename in \"moduleload \" line\n", + fname, lineno, 0 ); + exit( EXIT_FAILURE ); + } + if (module_load(cargv[1], cargc - 2, (cargc > 2) ? cargv + 2 : NULL)) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: failed to load or initialize module %s\n", + fname, lineno, cargv[1]); + exit( EXIT_FAILURE ); + } + } else if (strcasecmp( cargv[0], "modulepath") == 0 ) { + if ( cargc != 2 ) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: missing path in \"modulepath \" line\n", + fname, lineno, 0 ); + exit( EXIT_FAILURE ); + } + if (module_path( cargv[1] )) { + Debug( LDAP_DEBUG_ANY, + "%s: line %d: failed to set module search path to %s\n", + fname, lineno, cargv[1]); + exit( EXIT_FAILURE ); + } + +#endif /*SLAPD_MODULES*/ + +#ifdef HAVE_TLS + } else if ( !strcasecmp( cargv[0], "TLSProtocol" ) ) { + rc = ldap_pvt_tls_set_option( NULL, + LDAP_OPT_X_TLS_PROTOCOL, + cargv[1] ); + if ( rc ) + return rc; + + } else if ( !strcasecmp( cargv[0], "TLSCipherSuite" ) ) { + rc = ldap_pvt_tls_set_option( NULL, + LDAP_OPT_X_TLS_CIPHER_SUITE, + cargv[1] ); + if ( rc ) + return rc; + + } else if ( !strcasecmp( cargv[0], "TLSCertificateFile" ) ) { + rc = ldap_pvt_tls_set_option( NULL, + LDAP_OPT_X_TLS_CERTFILE, + cargv[1] ); + if ( rc ) + return rc; + + } else if ( !strcasecmp( cargv[0], "TLSCertificateKeyFile" ) ) { + rc = ldap_pvt_tls_set_option( NULL, + LDAP_OPT_X_TLS_KEYFILE, + cargv[1] ); + if ( rc ) + return rc; + + } else if ( !strcasecmp( cargv[0], "TLSCACertificatePath" ) ) { + rc = ldap_pvt_tls_set_option( NULL, + LDAP_OPT_X_TLS_CACERTDIR, + cargv[1] ); + if ( rc ) + return rc; + + } else if ( !strcasecmp( cargv[0], "TLSCACertificateFile" ) ) { + rc = ldap_pvt_tls_set_option( NULL, + LDAP_OPT_X_TLS_CACERTFILE, + cargv[1] ); + if ( rc ) + return rc; + } else if ( !strcasecmp( cargv[0], "TLSVerifyClient" ) ) { + rc = ldap_pvt_tls_set_option( NULL, + LDAP_OPT_X_TLS_REQUIRE_CERT, + cargv[1] ); + if ( rc ) + return rc; + +#endif + /* pass anything else to the current backend info/db config routine */ } else { if ( bi != NULL ) {