X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fschema_init.c;h=8a70eaefbb68530ea2a8269412e2726fbccd897c;hb=babc993ef7c95ac05c4f75370da1c9effaa4df37;hp=732b706d7bd5c410ee62941e330f49255282cc5d;hpb=a505d0c1fa8b3cadfa25241c83f9116d56b423da;p=openldap
diff --git a/servers/slapd/schema_init.c b/servers/slapd/schema_init.c
index 732b706d7b..8a70eaefbb 100644
--- a/servers/slapd/schema_init.c
+++ b/servers/slapd/schema_init.c
@@ -1,8 +1,17 @@
/* schema_init.c - init builtin schema */
/* $OpenLDAP$ */
-/*
- * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
- * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
+/* This work is part of OpenLDAP Software .
+ *
+ * Copyright 1998-2003 The OpenLDAP Foundation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted only as authorized by the OpenLDAP
+ * Public License.
+ *
+ * A copy of this license is available in the file LICENSE in the
+ * top-level directory of the distribution or, alternatively, at
+ * .
*/
#include "portable.h"
@@ -21,6 +30,18 @@
#include "ldap_utf8.h"
+#ifdef HAVE_TLS
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#endif
+
#include "lutil_hash.h"
#define HASH_BYTES LUTIL_HASH_BYTES
#define HASH_CONTEXT lutil_HASH_CTX
@@ -28,9 +49,6 @@
#define HASH_Update(c,buf,len) lutil_HASHUpdate(c,buf,len)
#define HASH_Final(d,c) lutil_HASHFinal(d,c)
-/* not yet implemented */
-#define uniqueMemberMatch NULL
-
#define OpenLDAPaciMatch NULL
/* approx matching rules */
@@ -63,6 +81,33 @@ blobValidate(
#define berValidate blobValidate
+static int
+sequenceValidate(
+ Syntax *syntax,
+ struct berval *in )
+{
+ if ( in->bv_len < 2 ) return LDAP_INVALID_SYNTAX;
+ if ( in->bv_val[0] != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
+
+ return LDAP_SUCCESS;
+}
+
+
+#ifdef HAVE_TLS
+static int certificateValidate( Syntax *syntax, struct berval *in )
+{
+ X509 *xcert=NULL;
+ unsigned char *p = (unsigned char *)in->bv_val;
+
+ xcert = d2i_X509(NULL, &p, in->bv_len);
+ if ( !xcert ) return LDAP_INVALID_SYNTAX;
+ X509_free(xcert);
+ return LDAP_SUCCESS;
+}
+#else
+#define certificateValidate sequenceValidate
+#endif
+
static int
octetStringMatch(
int *matchp,
@@ -122,7 +167,7 @@ int octetStringIndexer(
HASH_CONTEXT HASHcontext;
unsigned char HASHdigest[HASH_BYTES];
struct berval digest;
- digest.bv_val = HASHdigest;
+ digest.bv_val = (char *)HASHdigest;
digest.bv_len = sizeof(HASHdigest);
for( i=0; values[i].bv_val != NULL; i++ ) {
@@ -141,14 +186,15 @@ int octetStringIndexer(
HASH_Init( &HASHcontext );
if( prefix != NULL && prefix->bv_len > 0 ) {
HASH_Update( &HASHcontext,
- prefix->bv_val, prefix->bv_len );
+ (unsigned char *)prefix->bv_val,
+ prefix->bv_len );
}
HASH_Update( &HASHcontext,
- syntax->ssyn_oid, slen );
+ (unsigned char *)syntax->ssyn_oid, slen );
HASH_Update( &HASHcontext,
- mr->smr_oid, mlen );
+ (unsigned char *)mr->smr_oid, mlen );
HASH_Update( &HASHcontext,
- values[i].bv_val, values[i].bv_len );
+ (unsigned char *)values[i].bv_val, values[i].bv_len );
HASH_Final( HASHdigest, &HASHcontext );
ber_dupbv_x( &keys[i], &digest, ctx );
@@ -179,7 +225,7 @@ int octetStringFilter(
unsigned char HASHdigest[HASH_BYTES];
struct berval *value = (struct berval *) assertedValue;
struct berval digest;
- digest.bv_val = HASHdigest;
+ digest.bv_val = (char *)HASHdigest;
digest.bv_len = sizeof(HASHdigest);
slen = syntax->ssyn_oidlen;
@@ -190,14 +236,14 @@ int octetStringFilter(
HASH_Init( &HASHcontext );
if( prefix != NULL && prefix->bv_len > 0 ) {
HASH_Update( &HASHcontext,
- prefix->bv_val, prefix->bv_len );
+ (unsigned char *)prefix->bv_val, prefix->bv_len );
}
HASH_Update( &HASHcontext,
- syntax->ssyn_oid, slen );
+ (unsigned char *)syntax->ssyn_oid, slen );
HASH_Update( &HASHcontext,
- mr->smr_oid, mlen );
+ (unsigned char *)mr->smr_oid, mlen );
HASH_Update( &HASHcontext,
- value->bv_val, value->bv_len );
+ (unsigned char *)value->bv_val, value->bv_len );
HASH_Final( HASHdigest, &HASHcontext );
ber_dupbv_x( keys, &digest, ctx );
@@ -352,7 +398,7 @@ octetStringSubstringsIndexer(
HASH_CONTEXT HASHcontext;
unsigned char HASHdigest[HASH_BYTES];
struct berval digest;
- digest.bv_val = HASHdigest;
+ digest.bv_val = (char *)HASHdigest;
digest.bv_len = sizeof(HASHdigest);
nkeys=0;
@@ -415,17 +461,17 @@ octetStringSubstringsIndexer(
HASH_Init( &HASHcontext );
if( prefix != NULL && prefix->bv_len > 0 ) {
HASH_Update( &HASHcontext,
- prefix->bv_val, prefix->bv_len );
+ (unsigned char *)prefix->bv_val, prefix->bv_len );
}
HASH_Update( &HASHcontext,
- &pre, sizeof( pre ) );
+ (unsigned char *)&pre, sizeof( pre ) );
HASH_Update( &HASHcontext,
- syntax->ssyn_oid, slen );
+ (unsigned char *)syntax->ssyn_oid, slen );
HASH_Update( &HASHcontext,
- mr->smr_oid, mlen );
+ (unsigned char *)mr->smr_oid, mlen );
HASH_Update( &HASHcontext,
- &values[i].bv_val[j],
+ (unsigned char *)&values[i].bv_val[j],
SLAP_INDEX_SUBSTR_MAXLEN );
HASH_Final( HASHdigest, &HASHcontext );
@@ -444,16 +490,16 @@ octetStringSubstringsIndexer(
HASH_Init( &HASHcontext );
if( prefix != NULL && prefix->bv_len > 0 ) {
HASH_Update( &HASHcontext,
- prefix->bv_val, prefix->bv_len );
+ (unsigned char *)prefix->bv_val, prefix->bv_len );
}
HASH_Update( &HASHcontext,
- &pre, sizeof( pre ) );
+ (unsigned char *)&pre, sizeof( pre ) );
HASH_Update( &HASHcontext,
- syntax->ssyn_oid, slen );
+ (unsigned char *)syntax->ssyn_oid, slen );
HASH_Update( &HASHcontext,
- mr->smr_oid, mlen );
+ (unsigned char *)mr->smr_oid, mlen );
HASH_Update( &HASHcontext,
- values[i].bv_val, j );
+ (unsigned char *)values[i].bv_val, j );
HASH_Final( HASHdigest, &HASHcontext );
ber_dupbv_x( &keys[nkeys++], &digest, ctx );
@@ -464,16 +510,16 @@ octetStringSubstringsIndexer(
HASH_Init( &HASHcontext );
if( prefix != NULL && prefix->bv_len > 0 ) {
HASH_Update( &HASHcontext,
- prefix->bv_val, prefix->bv_len );
+ (unsigned char *)prefix->bv_val, prefix->bv_len );
}
HASH_Update( &HASHcontext,
- &pre, sizeof( pre ) );
+ (unsigned char *)&pre, sizeof( pre ) );
HASH_Update( &HASHcontext,
- syntax->ssyn_oid, slen );
+ (unsigned char *)syntax->ssyn_oid, slen );
HASH_Update( &HASHcontext,
- mr->smr_oid, mlen );
+ (unsigned char *)mr->smr_oid, mlen );
HASH_Update( &HASHcontext,
- &values[i].bv_val[values[i].bv_len-j], j );
+ (unsigned char *)&values[i].bv_val[values[i].bv_len-j], j );
HASH_Final( HASHdigest, &HASHcontext );
ber_dupbv_x( &keys[nkeys++], &digest, ctx );
@@ -545,7 +591,7 @@ octetStringSubstringsFilter (
return LDAP_SUCCESS;
}
- digest.bv_val = HASHdigest;
+ digest.bv_val = (char *)HASHdigest;
digest.bv_len = sizeof(HASHdigest);
slen = syntax->ssyn_oidlen;
@@ -566,16 +612,16 @@ octetStringSubstringsFilter (
HASH_Init( &HASHcontext );
if( prefix != NULL && prefix->bv_len > 0 ) {
HASH_Update( &HASHcontext,
- prefix->bv_val, prefix->bv_len );
+ (unsigned char *)prefix->bv_val, prefix->bv_len );
}
HASH_Update( &HASHcontext,
- &pre, sizeof( pre ) );
+ (unsigned char *)&pre, sizeof( pre ) );
HASH_Update( &HASHcontext,
- syntax->ssyn_oid, slen );
+ (unsigned char *)syntax->ssyn_oid, slen );
HASH_Update( &HASHcontext,
- mr->smr_oid, mlen );
+ (unsigned char *)mr->smr_oid, mlen );
HASH_Update( &HASHcontext,
- value->bv_val, klen );
+ (unsigned char *)value->bv_val, klen );
HASH_Final( HASHdigest, &HASHcontext );
ber_dupbv_x( &keys[nkeys++], &digest, ctx );
@@ -600,16 +646,16 @@ octetStringSubstringsFilter (
HASH_Init( &HASHcontext );
if( prefix != NULL && prefix->bv_len > 0 ) {
HASH_Update( &HASHcontext,
- prefix->bv_val, prefix->bv_len );
+ (unsigned char *)prefix->bv_val, prefix->bv_len );
}
HASH_Update( &HASHcontext,
- &pre, sizeof( pre ) );
+ (unsigned char *)&pre, sizeof( pre ) );
HASH_Update( &HASHcontext,
- syntax->ssyn_oid, slen );
+ (unsigned char *)syntax->ssyn_oid, slen );
HASH_Update( &HASHcontext,
- mr->smr_oid, mlen );
+ (unsigned char *)mr->smr_oid, mlen );
HASH_Update( &HASHcontext,
- &value->bv_val[j], klen );
+ (unsigned char *)&value->bv_val[j], klen );
HASH_Final( HASHdigest, &HASHcontext );
ber_dupbv_x( &keys[nkeys++], &digest, ctx );
@@ -629,16 +675,16 @@ octetStringSubstringsFilter (
HASH_Init( &HASHcontext );
if( prefix != NULL && prefix->bv_len > 0 ) {
HASH_Update( &HASHcontext,
- prefix->bv_val, prefix->bv_len );
+ (unsigned char *)prefix->bv_val, prefix->bv_len );
}
HASH_Update( &HASHcontext,
- &pre, sizeof( pre ) );
+ (unsigned char *)&pre, sizeof( pre ) );
HASH_Update( &HASHcontext,
- syntax->ssyn_oid, slen );
+ (unsigned char *)syntax->ssyn_oid, slen );
HASH_Update( &HASHcontext,
- mr->smr_oid, mlen );
+ (unsigned char *)mr->smr_oid, mlen );
HASH_Update( &HASHcontext,
- &value->bv_val[value->bv_len-klen], klen );
+ (unsigned char *)&value->bv_val[value->bv_len-klen], klen );
HASH_Final( HASHdigest, &HASHcontext );
ber_dupbv_x( &keys[nkeys++], &digest, ctx );
@@ -732,6 +778,87 @@ nameUIDValidate(
return rc;
}
+int
+nameUIDPretty(
+ Syntax *syntax,
+ struct berval *val,
+ struct berval *out,
+ void *ctx )
+{
+ assert( val );
+ assert( out );
+
+
+#ifdef NEW_LOGGING
+ LDAP_LOG( OPERATION, ARGS, ">>> nameUIDPretty: <%s>\n", val->bv_val, 0, 0 );
+#else
+ Debug( LDAP_DEBUG_TRACE, ">>> nameUIDPretty: <%s>\n", val->bv_val, 0, 0 );
+#endif
+
+ if( val->bv_len == 0 ) {
+ ber_dupbv_x( out, val, ctx );
+
+ } else if ( val->bv_len > SLAP_LDAPDN_MAXLEN ) {
+ return LDAP_INVALID_SYNTAX;
+
+ } else {
+ int rc;
+ struct berval dnval = *val;
+ struct berval uidval = { 0, NULL };
+
+ if( val->bv_val[val->bv_len-1] == 'B'
+ && val->bv_val[val->bv_len-2] == '\'' )
+ {
+ uidval.bv_val=strrchr( val->bv_val, '#' );
+ if( uidval.bv_val ) {
+ dnval.bv_len = uidval.bv_val - dnval.bv_val;
+ uidval.bv_len = val->bv_len - dnval.bv_len;
+
+ uidval.bv_len--;
+ uidval.bv_val++;
+ }
+ }
+
+ rc = dnPretty( syntax, &dnval, out, ctx );
+ if( rc != LDAP_SUCCESS ) return rc;
+
+ if( uidval.bv_val ) {
+ char *tmp = sl_realloc( out->bv_val, out->bv_len + uidval.bv_len + 2, ctx );
+ int i, c, got1;
+ if( tmp == NULL ) {
+ ber_memfree_x( out->bv_val, ctx );
+ return LDAP_OTHER;
+ }
+ out->bv_val = tmp;
+ out->bv_val[out->bv_len++] = '#';
+
+ got1 = uidval.bv_len < sizeof("'0'B");
+ for(i=0; ibv_val[out->bv_len++] = c;
+ break;
+ case '1':
+ got1 = 1;
+ default:
+ out->bv_val[out->bv_len++] = c;
+ }
+ }
+
+ out->bv_val[out->bv_len] = '\0';
+ }
+ }
+
+#ifdef NEW_LOGGING
+ LDAP_LOG( OPERATION, ARGS, "<<< nameUIDPretty: <%s>\n", out->bv_val, 0, 0 );
+#else
+ Debug( LDAP_DEBUG_TRACE, "<<< nameUIDPretty: <%s>\n", out->bv_val, 0, 0 );
+#endif
+
+ return LDAP_SUCCESS;
+}
+
static int
uniqueMemberNormalize(
slap_mask_t usage,
@@ -744,6 +871,8 @@ uniqueMemberNormalize(
struct berval out;
int rc;
+ assert( SLAP_MR_IS_VALUE_OF_SYNTAX( usage ));
+
ber_dupbv( &out, val );
if( out.bv_len != 0 ) {
struct berval uid = { 0, NULL };
@@ -795,6 +924,77 @@ uniqueMemberNormalize(
return LDAP_SUCCESS;
}
+static int
+uniqueMemberMatch(
+ int *matchp,
+ slap_mask_t flags,
+ Syntax *syntax,
+ MatchingRule *mr,
+ struct berval *value,
+ void *assertedValue )
+{
+ int match;
+ struct berval *asserted = (struct berval *) assertedValue;
+ struct berval assertedDN = { 0, NULL };
+ struct berval assertedUID = { 0, NULL };
+ struct berval valueDN = { 0, NULL };
+ struct berval valueUID = { 0, NULL };
+
+ if( asserted->bv_len != 0 ) {
+ assertedDN = *asserted;
+
+ if( assertedDN.bv_val[assertedDN.bv_len-1] == 'B'
+ && assertedDN.bv_val[assertedDN.bv_len-2] == '\'' )
+ {
+ /* assume presence of optional UID */
+ assertedUID.bv_val = strrchr( assertedDN.bv_val, '#' );
+
+ if( assertedUID.bv_val == NULL ) {
+ return LDAP_INVALID_SYNTAX;
+ }
+
+ assertedUID.bv_len = assertedDN.bv_len -
+ (assertedUID.bv_val - assertedDN.bv_val);
+ assertedDN.bv_len -= assertedUID.bv_len--;
+
+ /* trim the separator */
+ assertedUID.bv_val++;
+ }
+ }
+
+ if( value->bv_len != 0 ) {
+ valueDN = *value;
+
+ if( valueDN.bv_val[valueDN.bv_len-1] == 'B'
+ && valueDN.bv_val[valueDN.bv_len-2] == '\'' )
+ {
+ /* assume presence of optional UID */
+ valueUID.bv_val = strrchr( valueDN.bv_val, '#' );
+
+ if( valueUID.bv_val == NULL ) {
+ return LDAP_INVALID_SYNTAX;
+ }
+
+ valueUID.bv_len = valueDN.bv_len -
+ (assertedUID.bv_val - assertedDN.bv_val);
+ valueDN.bv_len -= valueUID.bv_len--;
+
+ /* trim the separator */
+ valueUID.bv_val++;
+ }
+ }
+
+ if( valueUID.bv_len && assertedUID.bv_len ) {
+ match = memcmp( valueUID.bv_val, assertedUID.bv_val, valueUID.bv_len );
+ if( match ) {
+ *matchp = match;
+ return LDAP_SUCCESS;
+ }
+ }
+
+ return dnMatch( matchp, flags, syntax, mr, &valueDN, &assertedDN );
+}
+
/*
* Handling boolean syntax and matching is quite rigid.
* A more flexible approach would be to allow a variety
@@ -917,7 +1117,7 @@ UTF8StringValidate(
{
ber_len_t count;
int len;
- unsigned char *u = in->bv_val;
+ unsigned char *u = (unsigned char *)in->bv_val;
if( in->bv_len == 0 && syntax == slap_schema.si_syn_directoryString ) {
/* directory strings cannot be empty */
@@ -959,7 +1159,7 @@ UTF8StringValidate(
/* make sure len corresponds with the offset
to the next character */
- if( LDAP_UTF8_OFFSET( u ) != len ) return LDAP_INVALID_SYNTAX;
+ if( LDAP_UTF8_OFFSET( (char *)u ) != len ) return LDAP_INVALID_SYNTAX;
}
if( count != 0 ) {
@@ -982,6 +1182,8 @@ UTF8StringNormalize(
int flags;
int i, wasspace;
+ assert( SLAP_MR_IS_VALUE_OF_SYNTAX( use ));
+
if( val->bv_val == NULL ) {
/* assume we're dealing with a syntax (e.g., UTF8String)
* which allows empty strings
@@ -1275,6 +1477,8 @@ telephoneNumberNormalize(
{
char *p, *q;
+ assert( SLAP_MR_IS_VALUE_OF_SYNTAX( usage ));
+
/* validator should have refused an empty string */
assert( val->bv_len );
@@ -1520,10 +1724,12 @@ IA5StringNormalize(
void *ctx )
{
char *p, *q;
- int casefold = SLAP_MR_ASSOCIATED(mr, slap_schema.si_mr_caseExactIA5Match);
+ int casefold = !SLAP_MR_ASSOCIATED(mr, slap_schema.si_mr_caseExactIA5Match);
assert( val->bv_len );
+ assert( SLAP_MR_IS_VALUE_OF_SYNTAX( use ));
+
p = val->bv_val;
/* Ignore initial whitespace */
@@ -1574,6 +1780,86 @@ IA5StringNormalize(
return LDAP_SUCCESS;
}
+static int
+UUIDValidate(
+ Syntax *syntax,
+ struct berval *in )
+{
+ int i;
+ if( in->bv_len != 36 ) {
+ assert(0);
+ return LDAP_INVALID_SYNTAX;
+ }
+
+ for( i=0; i<36; i++ ) {
+ switch(i) {
+ case 8:
+ case 13:
+ case 18:
+ case 23:
+ if( in->bv_val[i] != '-' ) {
+ return LDAP_INVALID_SYNTAX;
+ }
+ break;
+ default:
+ if( !ASCII_HEX( in->bv_val[i]) ) {
+ return LDAP_INVALID_SYNTAX;
+ }
+ }
+ }
+
+ return LDAP_SUCCESS;
+}
+
+static int
+UUIDNormalize(
+ slap_mask_t usage,
+ Syntax *syntax,
+ MatchingRule *mr,
+ struct berval *val,
+ struct berval *normalized,
+ void *ctx )
+{
+ unsigned char octet = '\0';
+ int i;
+ int j;
+ normalized->bv_len = 16;
+ normalized->bv_val = sl_malloc( normalized->bv_len+1, ctx );
+
+ for( i=0, j=0; i<36; i++ ) {
+ unsigned char nibble;
+ if( val->bv_val[i] == '-' ) {
+ continue;
+
+ } else if( ASCII_DIGIT( val->bv_val[i] ) ) {
+ nibble = val->bv_val[i] - '0';
+
+ } else if( ASCII_HEXLOWER( val->bv_val[i] ) ) {
+ nibble = val->bv_val[i] - ('a'-10);
+
+ } else if( ASCII_HEXUPPER( val->bv_val[i] ) ) {
+ nibble = val->bv_val[i] - ('A'-10);
+
+ } else {
+ sl_free( normalized->bv_val, ctx );
+ return LDAP_INVALID_SYNTAX;
+ }
+
+ if( j & 1 ) {
+ octet |= nibble;
+ normalized->bv_val[j>>1] = octet;
+ } else {
+ octet = nibble << 4;
+ }
+ j++;
+ }
+
+ normalized->bv_val[normalized->bv_len] = 0;
+ return LDAP_SUCCESS;
+}
+
+
+
static int
numericStringValidate(
Syntax *syntax,
@@ -1638,6 +1924,22 @@ numericStringNormalize(
return LDAP_SUCCESS;
}
+/*
+ * Integer conversion macros that will use the largest available
+ * type.
+ */
+#if defined(HAVE_STRTOLL) && defined(LLONG_MAX) && defined(LLONG_MIN) && defined(HAVE_LONG_LONG)
+# define SLAP_STRTOL(n,e,b) strtoll(n,e,b)
+# define SLAP_LONG_MAX LLONG_MAX
+# define SLAP_LONG_MIN LLONG_MIN
+# define SLAP_LONG long long
+#else
+# define SLAP_STRTOL(n,e,b) strtol(n,e,b)
+# define SLAP_LONG_MAX LONG_MAX
+# define SLAP_LONG_MIN LONG_MIN
+# define SLAP_LONG long
+#endif /* HAVE_STRTOLL ... */
+
static int
integerBitAndMatch(
int *matchp,
@@ -1647,16 +1949,16 @@ integerBitAndMatch(
struct berval *value,
void *assertedValue )
{
- long lValue, lAssertedValue;
+ SLAP_LONG lValue, lAssertedValue;
/* safe to assume integers are NUL terminated? */
- lValue = strtol(value->bv_val, NULL, 10);
- if(( lValue == LONG_MIN || lValue == LONG_MAX) && errno == ERANGE ) {
+ lValue = SLAP_STRTOL(value->bv_val, NULL, 10);
+ if(( lValue == SLAP_LONG_MIN || lValue == SLAP_LONG_MAX) && errno == ERANGE ) {
return LDAP_CONSTRAINT_VIOLATION;
}
- lAssertedValue = strtol(((struct berval *)assertedValue)->bv_val, NULL, 10);
- if(( lAssertedValue == LONG_MIN || lAssertedValue == LONG_MAX)
+ lAssertedValue = SLAP_STRTOL(((struct berval *)assertedValue)->bv_val, NULL, 10);
+ if(( lAssertedValue == SLAP_LONG_MIN || lAssertedValue == SLAP_LONG_MAX )
&& errno == ERANGE )
{
return LDAP_CONSTRAINT_VIOLATION;
@@ -1675,16 +1977,16 @@ integerBitOrMatch(
struct berval *value,
void *assertedValue )
{
- long lValue, lAssertedValue;
+ SLAP_LONG lValue, lAssertedValue;
/* safe to assume integers are NUL terminated? */
- lValue = strtol(value->bv_val, NULL, 10);
- if(( lValue == LONG_MIN || lValue == LONG_MAX) && errno == ERANGE ) {
+ lValue = SLAP_STRTOL(value->bv_val, NULL, 10);
+ if(( lValue == SLAP_LONG_MIN || lValue == SLAP_LONG_MAX ) && errno == ERANGE ) {
return LDAP_CONSTRAINT_VIOLATION;
}
- lAssertedValue = strtol(((struct berval *)assertedValue)->bv_val, NULL, 10);
- if(( lAssertedValue == LONG_MIN || lAssertedValue == LONG_MAX)
+ lAssertedValue = SLAP_STRTOL(((struct berval *)assertedValue)->bv_val, NULL, 10);
+ if(( lAssertedValue == SLAP_LONG_MIN || lAssertedValue == SLAP_LONG_MAX )
&& errno == ERANGE )
{
return LDAP_CONSTRAINT_VIOLATION;
@@ -1699,211 +2001,202 @@ serialNumberAndIssuerValidate(
Syntax *syntax,
struct berval *in )
{
- int rc = LDAP_INVALID_SYNTAX;
- struct berval serialNumber, issuer;
+ int rc;
+ int state;
+ ber_len_t n;
+ struct berval sn, i;
+ if( in->bv_len < 3 ) return LDAP_INVALID_SYNTAX;
- serialNumber.bv_val = in->bv_val;
- for( serialNumber.bv_len = 0;
- serialNumber.bv_len < in->bv_len;
- serialNumber.bv_len++ )
- {
- if ( serialNumber.bv_val[serialNumber.bv_len] == '$' ) {
- issuer.bv_val = &serialNumber.bv_val[serialNumber.bv_len+1];
- issuer.bv_len = in->bv_len - (serialNumber.bv_len+1);
+ i.bv_val = strchr( in->bv_val, '$' );
+ if( i.bv_val == NULL ) return LDAP_INVALID_SYNTAX;
- if( serialNumber.bv_len == 0 || issuer.bv_len == 0 ) break;
+ sn.bv_val = in->bv_val;
+ sn.bv_len = i.bv_val - in->bv_val;
- rc = integerValidate( NULL, &serialNumber );
- if( rc ) break;
+ i.bv_val++;
+ i.bv_len = in->bv_len - (sn.bv_len + 1);
- rc = dnValidate( NULL, &issuer );
- break;
+ /* validate serial number (strict for now) */
+ for( n=0; n < sn.bv_len; n++ ) {
+ if( !ASCII_DIGIT(sn.bv_val[n]) ) {
+ return LDAP_INVALID_SYNTAX;
}
}
- return rc;
+ /* validate DN */
+ rc = dnValidate( NULL, &i );
+ if( rc ) return LDAP_INVALID_SYNTAX;
+
+ return LDAP_SUCCESS;
}
-static int
-serialNumberAndIssuerNormalize(
- slap_mask_t usage,
+int
+serialNumberAndIssuerPretty(
Syntax *syntax,
- MatchingRule *mr,
struct berval *val,
- struct berval *normalized,
+ struct berval *out,
void *ctx )
{
- int rc = LDAP_INVALID_SYNTAX;
- struct berval serialNumber, issuer, nissuer;
-
- serialNumber.bv_val = val->bv_val;
- for( serialNumber.bv_len = 0;
- serialNumber.bv_len < val->bv_len;
- serialNumber.bv_len++ )
- {
- if ( serialNumber.bv_val[serialNumber.bv_len] == '$' ) {
- issuer.bv_val = &serialNumber.bv_val[serialNumber.bv_len+1];
- issuer.bv_len = val->bv_len - (serialNumber.bv_len+1);
-
- if( serialNumber.bv_len == 0 || issuer.bv_len == 0 ) break;
+ int rc;
+ int state;
+ ber_len_t n;
+ struct berval sn, i, newi;
- rc = dnNormalize( usage, syntax, mr, &issuer, &nissuer, ctx );
- if( rc ) break;
+ assert( val );
+ assert( out );
- normalized->bv_len = serialNumber.bv_len + 1 + nissuer.bv_len;
- normalized->bv_val = ch_malloc( normalized->bv_len + 1);
+#ifdef NEW_LOGGING
+ LDAP_LOG( OPERATION, ARGS, ">>> serialNumberAndIssuerPretty: <%s>\n",
+ val->bv_val, 0, 0 );
+#else
+ Debug( LDAP_DEBUG_TRACE, ">>> serialNumberAndIssuerPretty: <%s>\n",
+ val->bv_val, 0, 0 );
+#endif
- AC_MEMCPY( normalized->bv_val,
- serialNumber.bv_val, serialNumber.bv_len );
- normalized->bv_val[serialNumber.bv_len] = '$';
- AC_MEMCPY( &normalized->bv_val[serialNumber.bv_len+1],
- nissuer.bv_val, nissuer.bv_len );
- normalized->bv_val[normalized->bv_len] = '\0';
- break;
- }
- }
+ if( val->bv_len < 3 ) return LDAP_INVALID_SYNTAX;
- return rc;
-}
+ i.bv_val = strchr( val->bv_val, '$' );
+ if( i.bv_val == NULL ) return LDAP_INVALID_SYNTAX;
-#ifdef HAVE_TLS
-#include
-#include
+ sn.bv_val = val->bv_val;
+ sn.bv_len = i.bv_val - val->bv_val;
-/*
- * Next function returns a string representation of a ASN1_INTEGER.
- * It works for unlimited lengths.
- */
+ i.bv_val++;
+ i.bv_len = val->bv_len - (sn.bv_len + 1);
-static struct berval *
-asn1_integer2str(ASN1_INTEGER *a, struct berval *bv)
-{
- char buf[256];
- char *p;
- static char digit[] = "0123456789";
-
- /* We work backwards, make it fill from the end of buf */
- p = buf + sizeof(buf) - 1;
- *p = '\0';
-
- if ( a == NULL || a->length == 0 ) {
- *--p = '0';
- } else {
- int i;
- int n = a->length;
- int base = 0;
- unsigned int *copy;
+ /* eat leading zeros */
+ for( n=0; n < (sn.bv_len-1); n++ ) {
+ if( sn.bv_val[n] != '0' ) break;
+ }
+ sn.bv_val += n;
+ sn.bv_len -= n;
- /* We want to preserve the original */
- copy = ch_malloc(n*sizeof(unsigned int));
- for (i = 0; idata[i];
+ for( n=0; n < sn.bv_len; n++ ) {
+ if( !ASCII_DIGIT(sn.bv_val[n]) ) {
+ return LDAP_INVALID_SYNTAX;
}
+ }
- /*
- * base indicates the index of the most significant
- * byte that might be nonzero. When it goes off the
- * end, we now there is nothing left to do.
- */
- while (base < n) {
- unsigned int carry;
-
- carry = 0;
- for (i = base; ibv_len = sn.bv_len + newi.bv_len + 1;
+ out->bv_val = sl_realloc( newi.bv_val, out->bv_len + 1, ctx );
- if ( a->type == V_ASN1_NEG_INTEGER ) {
- *--p = '-';
+ if( out->bv_val == NULL ) {
+ sl_free( newi.bv_val, ctx );
+ return LDAP_OTHER;
}
- return ber_str2bv( p, 0, 1, bv );
+ /* push issuer over */
+ AC_MEMCPY( &out->bv_val[sn.bv_len+1], newi.bv_val, newi.bv_len );
+ /* insert sn and "$" */
+ AC_MEMCPY( out->bv_val, sn.bv_val, sn.bv_len );
+ out->bv_val[sn.bv_len] = '$';
+ /* terminate */
+ out->bv_val[out->bv_len] = '\0';
+
+#ifdef NEW_LOGGING
+ LDAP_LOG( OPERATION, ARGS, "<<< serialNumberAndIssuerPretty: <%s>\n",
+ out->bv_val, 0, 0 );
+#else
+ Debug( LDAP_DEBUG_TRACE, "<<< serialNumberAndIssuerPretty: <%s>\n",
+ out->bv_val, 0, 0 );
+#endif
+
+ return LDAP_SUCCESS;
}
/*
- * Given a certificate in DER format, extract the corresponding
- * assertion value for certificateExactMatch
+ * This routine is called by certificateExactNormalize when
+ * certificateExactNormalize receives a search string instead of
+ * a certificate. This routine checks if the search value is valid
+ * and then returns the normalized value
*/
static int
-certificateExactConvert(
- struct berval * in,
- struct berval * out )
+serialNumberAndIssuerNormalize(
+ slap_mask_t usage,
+ Syntax *syntax,
+ MatchingRule *mr,
+ struct berval *val,
+ struct berval *out,
+ void *ctx )
{
int rc;
- X509 *xcert;
- unsigned char *p = in->bv_val;
- struct berval serial;
- struct berval issuer_dn;
+ int state;
+ ber_len_t n;
+ struct berval sn, i, newi;
+
+ assert( val );
+ assert( out );
- xcert = d2i_X509(NULL, &p, in->bv_len);
- if ( !xcert ) {
#ifdef NEW_LOGGING
- LDAP_LOG( CONFIG, ENTRY,
- "certificateExactConvert: error parsing cert: %s\n",
- ERR_error_string(ERR_get_error(),NULL), 0, 0 );
+ LDAP_LOG( OPERATION, ARGS, ">>> serialNumberAndIssuerNormalize: <%s>\n",
+ val->bv_val, 0, 0 );
#else
- Debug( LDAP_DEBUG_ARGS, "certificateExactConvert: "
- "error parsing cert: %s\n",
- ERR_error_string(ERR_get_error(),NULL), NULL, NULL );
+ Debug( LDAP_DEBUG_TRACE, ">>> serialNumberAndIssuerNormalize: <%s>\n",
+ val->bv_val, 0, 0 );
#endif
- return LDAP_INVALID_SYNTAX;
- }
- if ( !asn1_integer2str(xcert->cert_info->serialNumber, &serial) ) {
- X509_free(xcert);
- return LDAP_INVALID_SYNTAX;
+ if( val->bv_len < 3 ) return LDAP_INVALID_SYNTAX;
+
+ i.bv_val = strchr( val->bv_val, '$' );
+ if( i.bv_val == NULL ) return LDAP_INVALID_SYNTAX;
+
+ sn.bv_val = val->bv_val;
+ sn.bv_len = i.bv_val - val->bv_val;
+
+ i.bv_val++;
+ i.bv_len = val->bv_len - (sn.bv_len + 1);
+
+ /* eat leading zeros */
+ for( n=0; n < (sn.bv_len-1); n++ ) {
+ if( sn.bv_val[n] != '0' ) break;
}
+ sn.bv_val += n;
+ sn.bv_len -= n;
- rc = dnX509normalize( X509_get_issuer_name(xcert), &issuer_dn );
- if( rc != LDAP_SUCCESS ) {
- X509_free(xcert);
- ber_memfree(serial.bv_val);
- return LDAP_INVALID_SYNTAX;
+ for( n=0; n < sn.bv_len; n++ ) {
+ if( !ASCII_DIGIT(sn.bv_val[n]) ) {
+ return LDAP_INVALID_SYNTAX;
+ }
}
- X509_free(xcert);
+ /* pretty DN */
+ rc = dnNormalize( usage, syntax, mr, &i, &newi, ctx );
+ if( rc ) return LDAP_INVALID_SYNTAX;
- out->bv_len = serial.bv_len + issuer_dn.bv_len + sizeof(" $ ");
- out->bv_val = ch_malloc(out->bv_len);
- p = out->bv_val;
- AC_MEMCPY(p, serial.bv_val, serial.bv_len);
- p += serial.bv_len;
- AC_MEMCPY(p, " $ ", sizeof(" $ ")-1);
- p += 3;
- AC_MEMCPY(p, issuer_dn.bv_val, issuer_dn.bv_len);
- p += issuer_dn.bv_len;
- *p++ = '\0';
+ /* make room from sn + "$" */
+ out->bv_len = sn.bv_len + newi.bv_len + 1;
+ out->bv_val = sl_realloc( newi.bv_val, out->bv_len + 1, ctx );
+
+ if( out->bv_val == NULL ) {
+ sl_free( newi.bv_val, ctx );
+ return LDAP_OTHER;
+ }
+
+ /* push issuer over */
+ AC_MEMCPY( &out->bv_val[sn.bv_len+1], newi.bv_val, newi.bv_len );
+ /* insert sn and "$" */
+ AC_MEMCPY( out->bv_val, sn.bv_val, sn.bv_len );
+ out->bv_val[sn.bv_len] = '$';
+ /* terminate */
+ out->bv_val[out->bv_len] = '\0';
#ifdef NEW_LOGGING
- LDAP_LOG( CONFIG, ARGS, "certificateExactConvert: %s\n",
+ LDAP_LOG( OPERATION, ARGS, "<<< serialNumberAndIssuerNormalize: <%s>\n",
out->bv_val, 0, 0 );
#else
- Debug( LDAP_DEBUG_ARGS, "certificateExactConvert: %s\n",
- out->bv_val, NULL, NULL );
+ Debug( LDAP_DEBUG_TRACE, "<<< serialNumberAndIssuerNormalize: <%s>\n",
+ out->bv_val, 0, 0 );
#endif
- ber_memfree(serial.bv_val);
- ber_memfree(issuer_dn.bv_val);
-
- return LDAP_SUCCESS;
+ return rc;
}
+#ifdef HAVE_TLS
static int
certificateExactNormalize(
slap_mask_t usage,
@@ -1913,187 +2206,249 @@ certificateExactNormalize(
struct berval *normalized,
void *ctx )
{
- int rc;
+ int rc = LDAP_INVALID_SYNTAX;
+ unsigned char *p;
+ char *serial = NULL;
+ ber_len_t seriallen;
+ struct berval issuer_dn = { 0, NULL };
+ X509_NAME *name = NULL;
+ ASN1_INTEGER *sn = NULL;
+ X509 *xcert = NULL;
+
+ if( val->bv_len == 0 ) goto done;
+
+ if( SLAP_MR_IS_VALUE_OF_ASSERTION_SYNTAX(usage) ) {
+ return serialNumberAndIssuerNormalize(0,NULL,NULL,val,normalized,ctx);
+ }
+
+ assert( SLAP_MR_IS_VALUE_OF_ATTRIBUTE_SYNTAX(usage) );
+
+ p = (unsigned char *)val->bv_val;
+ xcert = d2i_X509( NULL, &p, val->bv_len);
+ if( xcert == NULL ) goto done;
+
+ sn=X509_get_serialNumber(xcert);
+ if ( sn == NULL ) goto done;
+ serial=i2s_ASN1_INTEGER(0, sn );
+ if( serial == NULL ) goto done;
+ seriallen=strlen(serial);
+
+ name=X509_get_issuer_name(xcert);
+ if( name == NULL ) goto done;
+ rc = dnX509normalize( name, &issuer_dn );
+ if( rc != LDAP_SUCCESS ) goto done;
+
+ normalized->bv_len = seriallen + issuer_dn.bv_len + 1;
+ normalized->bv_val = ch_malloc(normalized->bv_len+1);
+ p = (unsigned char *)normalized->bv_val;
+ AC_MEMCPY(p, serial, seriallen);
+ p += seriallen;
+ *p++ = '$';
+ AC_MEMCPY(p, issuer_dn.bv_val, issuer_dn.bv_len);
+ p += issuer_dn.bv_len;
+ *p = '\0';
- if( SLAP_MR_IS_VALUE_OF_ASSERTION_SYNTAX( usage ) ) {
- rc = serialNumberAndIssuerNormalize( usage, syntax, mr,
- val, normalized, ctx );
+#ifdef NEW_LOGGING
+ LDAP_LOG( CONFIG, ARGS, "certificateExactNormalize: %s\n",
+ normalized->bv_val, 0, 0 );
+#else
+ Debug( LDAP_DEBUG_TRACE, "certificateExactNormalize: %s\n",
+ normalized->bv_val, NULL, NULL );
+#endif
- } else {
- rc = certificateExactConvert( val, normalized );
- }
+done:
+ if (xcert) X509_free(xcert);
+ if (serial) ch_free(serial);
+ if (issuer_dn.bv_val) ber_memfree(issuer_dn.bv_val);
return rc;
}
#endif /* HAVE_TLS */
+#ifndef SUPPORT_OBSOLETE_UTC_SYNTAX
+/* slight optimization - does not need the start parameter */
+#define check_time_syntax(v, start, p, f) (check_time_syntax)(v, p, f)
+enum { start = 0 };
+#endif
+
static int
check_time_syntax (struct berval *val,
int start,
- int *parts)
+ int *parts,
+ struct berval *fraction)
{
- static int ceiling[9] = { 99, 99, 11, 30, 23, 59, 59, 12, 59 };
- static int mdays[2][12] = {
+ /*
+ * start=0 GeneralizedTime YYYYmmddHH[MM[SS]][(./,)d...](Z|(+/-)HH[MM])
+ * start=1 UTCTime YYmmddHHMM[SS][Z|(+/-)HHMM]
+ * GeneralizedTime supports leap seconds, UTCTime does not.
+ */
+ static const int ceiling[9] = { 100, 100, 12, 31, 24, 60, 60, 24, 60 };
+ static const int mdays[2][12] = {
/* non-leap years */
- { 30, 27, 30, 29, 30, 29, 30, 30, 29, 30, 29, 30 },
+ { 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 },
/* leap years */
- { 30, 28, 30, 29, 30, 29, 30, 30, 29, 30, 29, 30 }
+ { 31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 }
};
char *p, *e;
- int part, c, tzoffset, leapyear = 0 ;
-
- if( val->bv_len == 0 ) {
- return LDAP_INVALID_SYNTAX;
- }
+ int part, c, c1, c2, tzoffset, leapyear = 0;
- p = (char *)val->bv_val;
+ p = val->bv_val;
e = p + val->bv_len;
- /* Ignore initial whitespace */
- while ( ( p < e ) && ASCII_SPACE( *p ) ) {
- p++;
- }
-
- if (e - p < 13 - (2 * start)) {
- return LDAP_INVALID_SYNTAX;
- }
-
- for (part = 0; part < 9; part++) {
- parts[part] = 0;
- }
-
- for (part = start; part < 7; part++) {
- c = *p;
- if ((part == 6) && (c == 'Z' || c == '+' || c == '-')) {
- part++;
+#ifdef SUPPORT_OBSOLETE_UTC_SYNTAX
+ parts[0] = 20; /* century - any multiple of 4 from 04 to 96 */
+#endif
+ for (part = start; part < 7 && p < e; part++) {
+ c1 = *p;
+ if (!ASCII_DIGIT(c1)) {
break;
}
p++;
- c -= '0';
- if (p == e) {
- return LDAP_INVALID_SYNTAX;
- }
- if (c < 0 || c > 9) {
- return LDAP_INVALID_SYNTAX;
- }
- parts[part] = c;
-
- c = *p++ - '0';
if (p == e) {
return LDAP_INVALID_SYNTAX;
}
- if (c < 0 || c > 9) {
+ c = *p++;
+ if (!ASCII_DIGIT(c)) {
return LDAP_INVALID_SYNTAX;
}
- parts[part] *= 10;
- parts[part] += c;
-
- if (part == 2 || part == 3) {
- parts[part]--;
- }
- if (parts[part] < 0) {
- return LDAP_INVALID_SYNTAX;
+ c += c1 * 10 - '0' * 11;
+ if ((part | 1) == 3) {
+ --c;
+ if (c < 0) {
+ return LDAP_INVALID_SYNTAX;
+ }
}
- if (parts[part] > ceiling[part]) {
- return LDAP_INVALID_SYNTAX;
+ if (c >= ceiling[part]) {
+ if (! (c == 60 && part == 6 && start == 0))
+ return LDAP_INVALID_SYNTAX;
}
+ parts[part] = c;
+ }
+ if (part < 5 + start) {
+ return LDAP_INVALID_SYNTAX;
+ }
+ for (; part < 9; part++) {
+ parts[part] = 0;
}
/* leapyear check for the Gregorian calendar (year>1581) */
- if (((parts[1] % 4 == 0) && (parts[1] != 0)) ||
- ((parts[0] % 4 == 0) && (parts[1] == 0)))
+ if (parts[parts[1] == 0 ? 0 : 1] % 4 == 0)
{
leapyear = 1;
}
- if (parts[3] > mdays[leapyear][parts[2]]) {
+ if (parts[3] >= mdays[leapyear][parts[2]]) {
return LDAP_INVALID_SYNTAX;
}
-
- c = *p++;
- if (c == 'Z') {
- tzoffset = 0; /* UTC */
- } else if (c != '+' && c != '-') {
- return LDAP_INVALID_SYNTAX;
- } else {
- if (c == '-') {
- tzoffset = -1;
- } else /* c == '+' */ {
- tzoffset = 1;
- }
-
- if (p > e - 4) {
- return LDAP_INVALID_SYNTAX;
- }
- for (part = 7; part < 9; part++) {
- c = *p++ - '0';
- if (c < 0 || c > 9) {
- return LDAP_INVALID_SYNTAX;
- }
- parts[part] = c;
-
- c = *p++ - '0';
- if (c < 0 || c > 9) {
- return LDAP_INVALID_SYNTAX;
- }
- parts[part] *= 10;
- parts[part] += c;
- if (parts[part] < 0 || parts[part] > ceiling[part]) {
+ if (start == 0) {
+ fraction->bv_val = p;
+ fraction->bv_len = 0;
+ if (p < e && (*p == '.' || *p == ',')) {
+ char *end_num;
+ while (++p < e && ASCII_DIGIT(*p))
+ ;
+ if (p - fraction->bv_val == 1) {
return LDAP_INVALID_SYNTAX;
}
+ for (end_num = p; end_num[-1] == '0'; --end_num)
+ ;
+ c = end_num - fraction->bv_val;
+ if (c != 1)
+ fraction->bv_len = c;
}
}
- /* Ignore trailing whitespace */
- while ( ( p < e ) && ASCII_SPACE( *p ) ) {
- p++;
- }
- if (p != e) {
- return LDAP_INVALID_SYNTAX;
+ if (p == e) {
+ /* no time zone */
+ return start == 0 ? LDAP_INVALID_SYNTAX : LDAP_SUCCESS;
}
- switch ( tzoffset ) {
- case -1: /* negativ offset to UTC, ie west of Greenwich */
- parts[4] += parts[7];
- parts[5] += parts[8];
- for (part = 6; --part > 0; ) { /* offset is just hhmm, no seconds */
- if (part != 3) {
- c = ceiling[part];
- } else {
- c = mdays[leapyear][parts[2]];
+ tzoffset = *p++;
+ switch (tzoffset) {
+ default:
+ return LDAP_INVALID_SYNTAX;
+ case 'Z':
+ /* UTC */
+ break;
+ case '+':
+ case '-':
+ for (part = 7; part < 9 && p < e; part++) {
+ c1 = *p;
+ if (!ASCII_DIGIT(c1)) {
+ break;
}
- if (parts[part] > c) {
- parts[part] -= c + 1;
- parts[part - 1]++;
+ p++;
+ if (p == e) {
+ return LDAP_INVALID_SYNTAX;
+ }
+ c2 = *p++;
+ if (!ASCII_DIGIT(c2)) {
+ return LDAP_INVALID_SYNTAX;
+ }
+ parts[part] = c1 * 10 + c2 - '0' * 11;
+ if (parts[part] >= ceiling[part]) {
+ return LDAP_INVALID_SYNTAX;
}
}
- break;
- case 1: /* positive offset to UTC, ie east of Greenwich */
- parts[4] -= parts[7];
- parts[5] -= parts[8];
- for (part = 6; --part > 0; ) {
- if (part != 3) {
- c = ceiling[part];
- } else {
- /* first arg to % needs to be non negativ */
- c = mdays[leapyear][(parts[2] - 1 + 12) % 12];
+ if (part < 8 + start) {
+ return LDAP_INVALID_SYNTAX;
+ }
+
+ if (tzoffset == '-') {
+ /* negative offset to UTC, ie west of Greenwich */
+ parts[4] += parts[7];
+ parts[5] += parts[8];
+ /* offset is just hhmm, no seconds */
+ for (part = 6; --part >= 0; ) {
+ if (part != 3) {
+ c = ceiling[part];
+ } else {
+ c = mdays[leapyear][parts[2]];
+ }
+ if (parts[part] >= c) {
+ if (part == 0) {
+ return LDAP_INVALID_SYNTAX;
+ }
+ parts[part] -= c;
+ parts[part - 1]++;
+ continue;
+ } else if (part != 5) {
+ break;
+ }
}
- if (parts[part] < 0) {
- parts[part] += c + 1;
- parts[part - 1]--;
+ } else {
+ /* positive offset to UTC, ie east of Greenwich */
+ parts[4] -= parts[7];
+ parts[5] -= parts[8];
+ for (part = 6; --part >= 0; ) {
+ if (parts[part] < 0) {
+ if (part == 0) {
+ return LDAP_INVALID_SYNTAX;
+ }
+ if (part != 3) {
+ c = ceiling[part];
+ } else {
+ /* make first arg to % non-negative */
+ c = mdays[leapyear][(parts[2] - 1 + 12) % 12];
+ }
+ parts[part] += c;
+ parts[part - 1]--;
+ continue;
+ } else if (part != 5) {
+ break;
+ }
}
}
- break;
- case 0: /* already UTC */
- break;
}
- return LDAP_SUCCESS;
+ return p != e ? LDAP_INVALID_SYNTAX : LDAP_SUCCESS;
}
#ifdef SUPPORT_OBSOLETE_UTC_SYNTAX
+
+#if 0
static int
xutcTimeNormalize(
Syntax *syntax,
@@ -2102,7 +2457,7 @@ xutcTimeNormalize(
{
int parts[9], rc;
- rc = check_time_syntax(val, 1, parts);
+ rc = check_time_syntax(val, 1, parts, NULL);
if (rc != LDAP_SUCCESS) {
return rc;
}
@@ -2119,6 +2474,7 @@ xutcTimeNormalize(
return LDAP_SUCCESS;
}
+#endif /* 0 */
static int
utcTimeValidate(
@@ -2126,9 +2482,10 @@ utcTimeValidate(
struct berval *in )
{
int parts[9];
- return check_time_syntax(in, 1, parts);
+ return check_time_syntax(in, 1, parts, NULL);
}
-#endif
+
+#endif /* SUPPORT_OBSOLETE_UTC_SYNTAX */
static int
generalizedTimeValidate(
@@ -2136,7 +2493,8 @@ generalizedTimeValidate(
struct berval *in )
{
int parts[9];
- return check_time_syntax(in, 0, parts);
+ struct berval fraction;
+ return check_time_syntax(in, 0, parts, &fraction);
}
static int
@@ -2149,25 +2507,56 @@ generalizedTimeNormalize(
void *ctx )
{
int parts[9], rc;
+ unsigned int len;
+ struct berval fraction;
- rc = check_time_syntax(val, 0, parts);
+ rc = check_time_syntax(val, 0, parts, &fraction);
if (rc != LDAP_SUCCESS) {
return rc;
}
- normalized->bv_val = sl_malloc( sizeof("YYYYmmddHHMMSSZ"), ctx );
+ len = sizeof("YYYYmmddHHMMSSZ")-1 + fraction.bv_len;
+ normalized->bv_val = sl_malloc( len + 1, ctx );
if ( normalized->bv_val == NULL ) {
return LBER_ERROR_MEMORY;
}
- sprintf( normalized->bv_val, "%02d%02d%02d%02d%02d%02d%02dZ",
+ sprintf( normalized->bv_val, "%02d%02d%02d%02d%02d%02d%02d",
parts[0], parts[1], parts[2] + 1, parts[3] + 1,
parts[4], parts[5], parts[6] );
- normalized->bv_len = 15;
+ if ( fraction.bv_len ) {
+ memcpy( normalized->bv_val + sizeof("YYYYmmddHHMMSSZ")-2,
+ fraction.bv_val, fraction.bv_len );
+ normalized->bv_val[sizeof("YYYYmmddHHMMSSZ")-2] = '.';
+ }
+ strcpy( normalized->bv_val + len-1, "Z" );
+ normalized->bv_len = len;
return LDAP_SUCCESS;
}
+static int
+generalizedTimeOrderingMatch(
+ int *matchp,
+ slap_mask_t flags,
+ Syntax *syntax,
+ MatchingRule *mr,
+ struct berval *value,
+ void *assertedValue )
+{
+ struct berval *asserted = (struct berval *) assertedValue;
+ ber_len_t v_len = value->bv_len;
+ ber_len_t av_len = asserted->bv_len;
+
+ /* ignore trailing 'Z' when comparing */
+ int match = memcmp( value->bv_val, asserted->bv_val,
+ (v_len < av_len ? v_len : av_len) - 1 );
+ if ( match == 0 ) match = v_len - av_len;
+
+ *matchp = match;
+ return LDAP_SUCCESS;
+}
+
static int
nisNetgroupTripleValidate(
Syntax *syntax,
@@ -2313,6 +2702,7 @@ firstComponentNormalize(
return rc;
}
+
#define X_BINARY "X-BINARY-TRANSFER-REQUIRED 'TRUE' "
#define X_NOT_H_R "X-NOT-HUMAN-READABLE 'TRUE' "
@@ -2336,13 +2726,13 @@ static slap_syntax_defs_rec syntax_defs[] = {
0, booleanValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.8 DESC 'Certificate' "
X_BINARY X_NOT_H_R ")",
- SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, berValidate, NULL},
+ SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, certificateValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.9 DESC 'Certificate List' "
X_BINARY X_NOT_H_R ")",
- SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, berValidate, NULL},
+ SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, sequenceValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.10 DESC 'Certificate Pair' "
X_BINARY X_NOT_H_R ")",
- SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, berValidate, NULL},
+ SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, sequenceValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.11 DESC 'Country String' )",
0, countryStringValidate, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.12 DESC 'Distinguished Name' )",
@@ -2388,7 +2778,7 @@ static slap_syntax_defs_rec syntax_defs[] = {
{"( 1.3.6.1.4.1.1466.115.121.1.33 DESC 'MHS OR Address' )",
0, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.34 DESC 'Name And Optional UID' )",
- 0, nameUIDValidate, NULL},
+ 0, nameUIDValidate, nameUIDPretty },
{"( 1.3.6.1.4.1.1466.115.121.1.35 DESC 'Name Form Description' )",
0, NULL, NULL},
{"( 1.3.6.1.4.1.1466.115.121.1.36 DESC 'Numeric String' )",
@@ -2442,16 +2832,14 @@ static slap_syntax_defs_rec syntax_defs[] = {
{"( 1.3.6.1.1.1.0.1 DESC 'RFC2307 Boot Parameter' )",
0, bootParameterValidate, NULL},
- /* From PKIX */
- /* These OIDs are not published yet, but will be in the next
- * I-D for PKIX LDAPv3 schema as have been advanced by David
- * Chadwick in private mail.
- */
- {"( 1.2.826.0.1.3344810.7.1 DESC 'Serial Number and Issuer' )",
- 0, serialNumberAndIssuerValidate, NULL},
+ /* From PKIX *//* This OID is not published yet. */
+ {"( 1.2.826.0.1.3344810.7.1 DESC 'Certificate Serial Number and Issuer' )",
+ SLAP_SYNTAX_HIDE,
+ serialNumberAndIssuerValidate,
+ serialNumberAndIssuerPretty},
- /* OpenLDAP Experimental Syntaxes */
#ifdef SLAPD_ACI_ENABLED
+ /* OpenLDAP Experimental Syntaxes */
{"( 1.3.6.1.4.1.4203.666.2.1 DESC 'OpenLDAP Experimental ACI' )",
SLAP_SYNTAX_HIDE,
UTF8StringValidate /* THIS WILL CHANGE FOR NEW ACI SYNTAX */,
@@ -2464,18 +2852,19 @@ static slap_syntax_defs_rec syntax_defs[] = {
SLAP_SYNTAX_HIDE, NULL, NULL},
#endif
+ {"( 1.3.6.1.4.1.4203.666.2.6 DESC 'UUID' )",
+ SLAP_SYNTAX_HIDE, UUIDValidate, NULL},
+
/* OpenLDAP Void Syntax */
{"( 1.3.6.1.4.1.4203.1.1.1 DESC 'OpenLDAP void' )" ,
SLAP_SYNTAX_HIDE, inValidate, NULL},
{NULL, 0, NULL, NULL}
};
-#ifdef HAVE_TLS
char *certificateExactMatchSyntaxes[] = {
"1.3.6.1.4.1.1466.115.121.1.8" /* certificate */,
NULL
};
-#endif
char *directoryStringSyntaxes[] = {
"1.3.6.1.4.1.1466.115.121.1.44" /* printableString */,
NULL
@@ -2506,7 +2895,6 @@ char *objectIdentifierFirstComponentMatchSyntaxes[] = {
* 2.5.13.31 directoryStringFirstComponentMatch
* 2.5.13.32 wordMatch
* 2.5.13.33 keywordMatch
- * 2.5.13.35 certificateMatch
* 2.5.13.36 certificatePairExactMatch
* 2.5.13.37 certificatePairMatch
* 2.5.13.38 certificateListExactMatch
@@ -2712,7 +3100,7 @@ static slap_mrule_defs_rec mrule_defs[] = {
{"( 2.5.13.28 NAME 'generalizedTimeOrderingMatch' "
"SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )",
SLAP_MR_ORDERING, NULL,
- NULL, generalizedTimeNormalize, octetStringOrderingMatch,
+ NULL, generalizedTimeNormalize, generalizedTimeOrderingMatch,
NULL, NULL,
"generalizedTimeMatch" },
@@ -2732,14 +3120,27 @@ static slap_mrule_defs_rec mrule_defs[] = {
octetStringIndexer, octetStringFilter,
NULL },
-#ifdef HAVE_TLS
{"( 2.5.13.34 NAME 'certificateExactMatch' "
"SYNTAX 1.2.826.0.1.3344810.7.1 )",
SLAP_MR_EQUALITY | SLAP_MR_EXT, certificateExactMatchSyntaxes,
+#ifdef HAVE_TLS
NULL, certificateExactNormalize, octetStringMatch,
octetStringIndexer, octetStringFilter,
+#else
+ NULL, NULL, NULL, NULL, NULL,
+#endif
NULL },
+
+ {"( 2.5.13.35 NAME 'certificateMatch' "
+ "SYNTAX 1.3.6.1.4.1.1466.115.121.1.8 )",
+ SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
+#ifdef HAVE_TLS
+ NULL, NULL, octetStringMatch,
+ octetStringIndexer, octetStringFilter,
+#else
+ NULL, NULL, NULL, NULL, NULL,
#endif
+ NULL },
{"( 1.3.6.1.4.1.1466.109.114.1 NAME 'caseExactIA5Match' "
"SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )",
@@ -2802,6 +3203,20 @@ static slap_mrule_defs_rec mrule_defs[] = {
NULL, NULL,
"integerMatch" },
+ {"( 1.3.6.1.4.1.4203.666.4.6 NAME 'UUIDMatch' "
+ "SYNTAX 1.3.6.1.4.1.4203.666.2.6 )",
+ SLAP_MR_HIDE | SLAP_MR_EQUALITY, NULL,
+ NULL, UUIDNormalize, octetStringMatch,
+ octetStringIndexer, octetStringFilter,
+ NULL},
+
+ {"( 1.3.6.1.4.1.4203.666.4.7 NAME 'UUIDOrderingMatch' "
+ "SYNTAX 1.3.6.1.4.1.4203.666.2.6 )",
+ SLAP_MR_HIDE | SLAP_MR_ORDERING, NULL,
+ NULL, UUIDNormalize, octetStringOrderingMatch,
+ octetStringIndexer, octetStringFilter,
+ "UUIDMatch"},
+
{NULL, SLAP_MR_NONE, NULL,
NULL, NULL, NULL, NULL, NULL,
NULL }