X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fdn.c;h=151d6d35cee0ee66e37c2791952ef72408d0be63;hb=9c550e7235830af9d031d8d7ba86b87f36dcc99f;hp=c8d08680419631d1742c39d86047c2bb6eced7b9;hpb=e7792353919a1d36f0f8efac25cf537f029d9ebb;p=openldap diff --git a/servers/slapd/dn.c b/servers/slapd/dn.c index c8d0868041..151d6d35ce 100644 --- a/servers/slapd/dn.c +++ b/servers/slapd/dn.c @@ -34,7 +34,6 @@ #include #include "slap.h" -#include "ldap_pvt.h" /* must be after slap.h, to get ldap_bv2dn_x() & co */ #include "lutil.h" /* @@ -686,11 +685,7 @@ dnPretty( assert( val ); assert( out ); -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, ARGS, ">>> dnPretty: <%s>\n", val->bv_val, 0, 0 ); -#else Debug( LDAP_DEBUG_TRACE, ">>> dnPretty: <%s>\n", val->bv_val, 0, 0 ); -#endif if ( val->bv_len == 0 ) { ber_dupbv_x( out, val, ctx ); @@ -732,11 +727,7 @@ dnPretty( } } -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, ARGS, "<<< dnPretty: <%s>\n", out->bv_val, 0, 0 ); -#else Debug( LDAP_DEBUG_TRACE, "<<< dnPretty: <%s>\n", out->bv_val, 0, 0 ); -#endif return LDAP_SUCCESS; } @@ -751,11 +742,7 @@ rdnPretty( assert( val ); assert( out ); -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, ARGS, ">>> dnPretty: <%s>\n", val->bv_val, 0, 0 ); -#else Debug( LDAP_DEBUG_TRACE, ">>> dnPretty: <%s>\n", val->bv_val, 0, 0 ); -#endif if ( val->bv_len == 0 ) { ber_dupbv_x( out, val, ctx ); @@ -799,11 +786,7 @@ rdnPretty( } } -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, ARGS, "<<< dnPretty: <%s>\n", out->bv_val, 0, 0 ); -#else Debug( LDAP_DEBUG_TRACE, "<<< dnPretty: <%s>\n", out->bv_val, 0, 0 ); -#endif return LDAP_SUCCESS; } @@ -820,15 +803,9 @@ dnPrettyNormalDN( assert( val ); assert( dn ); -#ifdef NEW_LOGGING - LDAP_LOG( OPERATION, ARGS, ">>> dn%sDN: <%s>\n", - flags == SLAP_LDAPDN_PRETTY ? "Pretty" : "Normal", - val->bv_val, 0 ); -#else Debug( LDAP_DEBUG_TRACE, ">>> dn%sDN: <%s>\n", flags == SLAP_LDAPDN_PRETTY ? "Pretty" : "Normal", val->bv_val, 0 ); -#endif if ( val->bv_len == 0 ) { return LDAP_SUCCESS; @@ -875,11 +852,7 @@ dnPrettyNormal( struct berval *normal, void *ctx) { -#ifdef NEW_LOGGING - LDAP_LOG ( OPERATION, ENTRY, ">>> dnPrettyNormal: <%s>\n", val->bv_val, 0, 0 ); -#else Debug( LDAP_DEBUG_TRACE, ">>> dnPrettyNormal: <%s>\n", val->bv_val, 0, 0 ); -#endif assert( val ); assert( pretty ); @@ -946,13 +919,8 @@ dnPrettyNormal( } } -#ifdef NEW_LOGGING - LDAP_LOG (OPERATION, RESULTS, "<<< dnPrettyNormal: <%s>, <%s>\n", - pretty->bv_val, normal->bv_val, 0 ); -#else Debug( LDAP_DEBUG_TRACE, "<<< dnPrettyNormal: <%s>, <%s>\n", pretty->bv_val, normal->bv_val, 0 ); -#endif return LDAP_SUCCESS; } @@ -975,6 +943,8 @@ dnMatch( assert( matchp ); assert( value ); assert( assertedValue ); + assert( !BER_BVISNULL( value ) ); + assert( !BER_BVISNULL( asserted ) ); match = value->bv_len - asserted->bv_len; @@ -983,16 +953,114 @@ dnMatch( value->bv_len ); } -#ifdef NEW_LOGGING - LDAP_LOG( CONFIG, ENTRY, "dnMatch: %d\n %s\n %s\n", - match, value->bv_val, asserted->bv_val ); -#else Debug( LDAP_DEBUG_ARGS, "dnMatch %d\n\t\"%s\"\n\t\"%s\"\n", match, value->bv_val, asserted->bv_val ); -#endif *matchp = match; - return( LDAP_SUCCESS ); + return LDAP_SUCCESS; +} + +/* + * dnRelativeMatch routine + */ +int +dnRelativeMatch( + int *matchp, + slap_mask_t flags, + Syntax *syntax, + MatchingRule *mr, + struct berval *value, + void *assertedValue ) +{ + int match; + struct berval *asserted = (struct berval *) assertedValue; + + assert( matchp ); + assert( value ); + assert( assertedValue ); + assert( !BER_BVISNULL( value ) ); + assert( !BER_BVISNULL( asserted ) ); + + if( mr == slap_schema.si_mr_dnSubtreeMatch ) { + if( asserted->bv_len > value->bv_len ) { + match = -1; + } else if ( asserted->bv_len == value->bv_len ) { + match = memcmp( value->bv_val, asserted->bv_val, + value->bv_len ); + } else { + if( DN_SEPARATOR( + value->bv_val[value->bv_len - asserted->bv_len - 1] )) + { + match = memcmp( + &value->bv_val[value->bv_len - asserted->bv_len], + asserted->bv_val, + asserted->bv_len ); + } else { + return 1; + } + } + + *matchp = match; + return LDAP_SUCCESS; + + } + + if( mr == slap_schema.si_mr_dnSuperiorMatch ) { + asserted = value; + value = (struct berval *) assertedValue; + mr = slap_schema.si_mr_dnSubordinateMatch; + } + + if( mr == slap_schema.si_mr_dnSubordinateMatch ) { + if( asserted->bv_len >= value->bv_len ) { + match = -1; + } else { + if( DN_SEPARATOR( + value->bv_val[value->bv_len - asserted->bv_len - 1] )) + { + match = memcmp( + &value->bv_val[value->bv_len - asserted->bv_len], + asserted->bv_val, + asserted->bv_len ); + } else { + return 1; + } + } + + *matchp = match; + return LDAP_SUCCESS; + } + + if( mr == slap_schema.si_mr_dnOneLevelMatch ) { + if( asserted->bv_len >= value->bv_len ) { + match = -1; + } else { + if( DN_SEPARATOR( + value->bv_val[value->bv_len - asserted->bv_len - 1] )) + { + match = memcmp( + &value->bv_val[value->bv_len - asserted->bv_len], + asserted->bv_val, + asserted->bv_len ); + + if( !match ) { + struct berval rdn; + rdn.bv_val = value->bv_val; + rdn.bv_len = value->bv_len - asserted->bv_len - 1; + match = dnIsOneLevelRDN( &rdn ) ? 0 : 1; + } + } else { + return 1; + } + } + + *matchp = match; + return LDAP_SUCCESS; + } + + /* should not be reachable */ + assert( 0 ); + return LDAP_OTHER; } int @@ -1018,17 +1086,11 @@ rdnMatch( value->bv_len ); } -#ifdef NEW_LOGGING - LDAP_LOG( CONFIG, ENTRY, "rdnMatch: %d\n %s\n %s\n", - match, value->bv_val, asserted->bv_val ); -#else Debug( LDAP_DEBUG_ARGS, "rdnMatch %d\n\t\"%s\"\n\t\"%s\"\n", match, value->bv_val, asserted->bv_val ); -#endif *matchp = match; - - return( LDAP_SUCCESS ); + return LDAP_SUCCESS; } @@ -1063,6 +1125,33 @@ dnParent( return; } +/* + * dnRdn - dn's rdn, in-place + * note: the incoming dn is assumed to be normalized/prettyfied, + * so that escaped rdn/ava separators are in '\'+hexpair form + */ +void +dnRdn( + struct berval *dn, + struct berval *rdn ) +{ + char *p; + + *rdn = *dn; + p = strchr( dn->bv_val, ',' ); + + /* one-level dn */ + if ( p == NULL ) { + return; + } + + assert( DN_SEPARATOR( p[ 0 ] ) ); + assert( ATTR_LEADCHAR( p[ 1 ] ) ); + rdn->bv_len = p - dn->bv_val; + + return; +} + int dnExtractRdn( struct berval *dn, @@ -1085,14 +1174,11 @@ dnExtractRdn( return rc; } - rc = ldap_rdn2bv_x( tmpRDN, rdn, LDAP_DN_FORMAT_LDAPV3 | LDAP_DN_PRETTY, ctx ); + rc = ldap_rdn2bv_x( tmpRDN, rdn, LDAP_DN_FORMAT_LDAPV3 | LDAP_DN_PRETTY, + ctx ); ldap_rdnfree_x( tmpRDN, ctx ); - if ( rc != LDAP_SUCCESS ) { - return rc; - } - - return LDAP_SUCCESS; + return rc; } /* @@ -1257,6 +1343,35 @@ dnIsSuffix( return( strcmp( dn->bv_val + d, suffix->bv_val ) == 0 ); } +int +dnIsOneLevelRDN( struct berval *rdn ) +{ + ber_len_t len = rdn->bv_len; + for ( ; len--; ) { + if ( DN_SEPARATOR( rdn->bv_val[ len ] ) ) { + return 0; + } + } + + return 1; +} + +#ifdef HAVE_TLS +static SLAP_CERT_MAP_FN *DNX509PeerNormalizeCertMap = NULL; +#endif + +int register_certificate_map_function(SLAP_CERT_MAP_FN *fn) +{ +#ifdef HAVE_TLS + if ( DNX509PeerNormalizeCertMap == NULL ) { + DNX509PeerNormalizeCertMap = fn; + return 0; + } +#endif + + return -1; +} + #ifdef HAVE_TLS /* * Convert an X.509 DN into a normalized LDAP DN @@ -1279,8 +1394,16 @@ dnX509normalize( void *x509_name, struct berval *out ) int dnX509peerNormalize( void *ssl, struct berval *dn ) { + int rc = LDAP_INVALID_CREDENTIALS; - return ldap_pvt_tls_get_peer_dn( ssl, dn, - (LDAPDN_rewrite_dummy *)LDAPDN_rewrite, 0 ); + if ( DNX509PeerNormalizeCertMap != NULL ) + rc = (*DNX509PeerNormalizeCertMap)( ssl, dn ); + + if ( rc != LDAP_SUCCESS ) { + rc = ldap_pvt_tls_get_peer_dn( ssl, dn, + (LDAPDN_rewrite_dummy *)LDAPDN_rewrite, 0 ); + } + + return rc; } #endif