SLAPD_SCHEMA_NOT_COMPAT: Mostly work modify

diff --git a/servers/slapd/acl.c b/servers/slapd/acl.c
index d44f218676277dc8f8b0a3ac8c2cc866eb92ff0c..d693500da14970d9d1a5512448ca10908867b8c3 100644 (file)
--- a/servers/slapd/acl.c
+++ b/servers/slapd/acl.c
@@ -448,38 +448,34 @@ acl_mask(
                        bv.bv_val = op->o_ndn;
                        bv.bv_len = strlen( bv.bv_val );
 
-                       /* see if asker is listed in dnattr */ 
-                       if ( (at = attr_find( e->e_attrs, b->a_dn_at )) != NULL
+                       /* see if asker is listed in dnattr */
 #ifdef SLAPD_SCHEMA_NOT_COMPAT
-                               /* not yet implemented */
-#else
-                               && value_find( at->a_vals, &bv, at->a_syntax, 3 ) == 0
-#endif
-                       )
+                       for( at = attrs_find( e->e_attrs, b->a_dn_at );
+                               at == NULL;
+                               at = attrs_find( e->e_attrs->a_next, b->a_dn_at ) )
                        {
-                               if ( b->a_dn_self && 
-                                       (val == NULL
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
-                                       /* not yet implemented */
+                               if( value_find( b->a_dn_at, at->a_vals, &bv ) == 0 ) {
+                               }
+                       }
+
 #else
-                                       || value_cmp( &bv, val, at->a_syntax, 2 )
-#endif
-                                       ) )
+                       /* see if asker is listed in dnattr */
+                       if ( (at = attr_find( e->e_attrs, b->a_dn_at )) != NULL &&
+                               value_find( at->a_vals, &bv, at->a_syntax, 3 ) == 0 )
+                       {
+                               if ( b->a_dn_self && (val == NULL
+                                       || value_cmp( &bv, val, at->a_syntax, 2 ) ) )
                                {
                                        continue;
                                }
 
                        /* asker not listed in dnattr - check for self access */
                        } else if ( ! b->a_dn_self || val == NULL
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
-                                       /* not yet implemented */
-#else
-                               || value_cmp( &bv, val, at->a_syntax, 2 ) != 0
-#endif
-                       )
+                               || value_cmp( &bv, val, at->a_syntax, 2 ) != 0 )
                        {
                                continue;
                        }
+#endif
                }
 
                if ( b->a_group_pat != NULL && op->o_ndn != NULL ) {
@@ -695,10 +691,15 @@ acl_check_modlist(
                 * by the user
                 */
 #ifdef SLAPD_SCHEMA_NOT_COMPAT
-               /* not yet implemented */
+               if ( is_at_no_user_mod( mlist->sml_desc->ad_type ) ) {
+                       Debug( LDAP_DEBUG_ACL, "acl: no-user-mod %s:"
+                               " modify access granted\n",
+                               mlist->sml_desc->ad_cname->bv_val, 0, 0 );
+                       continue;
+               }
 #else
                if ( oc_check_op_no_usermod_attr( mlist->sml_type ) ) {
-                       Debug( LDAP_DEBUG_ACL, "NoUserMod Operational attribute:"
+                       Debug( LDAP_DEBUG_ACL, "acl: no-user-mod %s:"
                                " modify access granted\n",
                                mlist->sml_type, 0, 0 );
                        continue;
@@ -984,10 +985,12 @@ aci_group_member (
        char *grpoc;
        char *grpat;
 #ifdef SLAPD_SCHEMA_NOT_COMPAT
-       AttributeDescription *grpad = NULL;
+       ObjectClass *grp_oc = NULL;
+       AttributeDescription *grp_ad = NULL;
        char *text;
 #else
-       char *grpad;
+       char *grp_oc;
+       char *grp_ad;
 #endif
        int rc;
 
@@ -1014,28 +1017,28 @@ aci_group_member (
        }
 
 #ifdef SLAPD_SCHEMA_NOT_COMPAT
-       rc = slap_str2ad( grpat, &grpad, &text );
+       rc = slap_str2ad( grpat, &grp_ad, &text );
        if( rc != LDAP_SUCCESS ) {
                rc = 0;
                goto done;
        }
 #else
-       grpad = grpat;
+       grp_ad = grpat;
 #endif
        rc = 0;
 
        grpdn = (char *)ch_malloc(1024);
 
-       if (grpoc != NULL && grpad != NULL && grpdn != NULL) {
+       if (grp_oc != NULL && grp_ad != NULL && grpdn != NULL) {
                string_expand(grpdn, 1024, subjdn, e->e_ndn, matches);
                if ( dn_normalize(grpdn) != NULL ) {
-                       rc = (backend_group(be, e, grpdn, op->o_ndn, grpoc, grpad) == 0);
+                       rc = (backend_group(be, e, grpdn, op->o_ndn, grp_oc, grp_ad) == 0);
                }
        }
 
-done:
 #ifdef SLAPD_SCHEMA_NOT_COMPAT
-       if( grpad != NULL ) ad_free( grpad, 1 );
+done:
+       if( grp_ad != NULL ) ad_free( grp_ad, 1 );
 #endif
        ch_free(grpdn);
        ch_free(grpat);
@@ -1130,41 +1133,51 @@ aci_mask(
                        return(1);
 
        } else if (aci_strbvcmp( "dnattr", &bv ) == 0) {
-               Attribute *at;
                char *dnattr = aci_bvstrdup(&sdn);
 #ifdef SLAPD_SCHEMA_NOT_COMPAT
-               AttributeDescription *dnad = NULL;
-               char *text;
-               rc = slap_str2ad( dnattr, &dnad, &text );
+               Attribute *at;
+               AttributeDescription *ad = NULL;
+               const char *text;
+
+               rc = slap_str2ad( dnattr, &ad, &text );
                ch_free( dnattr );
 
-               if ( rc == LDAP_SUCCESS ) {
-#else
-                       char *dnad = dnattr;
-#endif
-                       at = attr_find( e->e_attrs, dnad );
-#ifdef SLAPD_SCHEMA_NOT_COMAT
-                       ad_free( dnad, 1 );
-#else
-                       ch_free( dnad );
-#endif
-                       if (at != NULL) {
-                               bv.bv_val = op->o_ndn;
-                               bv.bv_len = strlen( bv.bv_val );
+               if( rc != LDAP_SUCCESS ) {
+                       return 0;
+               }
 
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
-                               /* not yet implemented */
-#else
-                               if (value_find( at->a_vals, &bv, at->a_syntax, 3 ) == 0 )
-                                       return(1);
-#endif
+               rc = 0;
+
+               bv.bv_val = op->o_ndn;
+               bv.bv_len = strlen( bv.bv_val );
+
+               for(at = attrs_find( e->e_attrs, ad );
+                       at != NULL;
+                       at = attrs_find( at->a_next, ad ) )
+               {
+                       if (value_find( ad, at->a_vals, &bv) == 0 ) {
+                               rc = 1;
+                               break;
                        }
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
-               } else {
-                       ad_free( dnad, 1 );
-#endif
                }
 
+               ad_free( ad, 1 );
+               return rc;
+
+#else
+               Attribute *at;
+               at = attr_find( e->e_attrs, dnattr );
+               ch_free( dnattr );
+
+               if (at != NULL) {
+                       bv.bv_val = op->o_ndn;
+                       bv.bv_len = strlen( bv.bv_val );
+
+                       if (value_find( at->a_vals, &bv, at->a_syntax, 3 ) == 0 )
+                               return(1);
+               }
+#endif
+
        } else if (aci_strbvcmp( "group", &bv ) == 0) {
                if (aci_group_member(&sdn, "groupOfNames", "member", be, e, op, matches))
                        return(1);

diff --git a/servers/slapd/aclparse.c b/servers/slapd/aclparse.c
index 946e0e13964c7fe93f6c61d74cbeecc946744d3c..bcd648cfafc426323a93aefa3f9ab7c9d8dfd7ed 100644 (file)
--- a/servers/slapd/aclparse.c
+++ b/servers/slapd/aclparse.c
@@ -384,12 +384,49 @@ parse_acl(
                                        b->a_group_pat = ch_strdup( right );
 
                                        if (value && *value) {
+#ifdef SLAPD_SCHEMA_NOT_COMPAT
+                                               b->a_group_oc = oc_find( value );
+#else
                                                b->a_group_oc = ch_strdup(value);
+#endif
+                                               if( b->a_group_oc == NULL ) {
+                                                       fprintf( stderr,
+                                                               "%s: line %d: group objectclass \"%s\" unknown\n",
+                                                               fname, lineno, value );
+                                                       acl_usage();
+                                               }
+
+#ifdef SLAPD_SCHEMA_NOT_COMPAT
+                                               if( is_object_subclass( b->a_group_oc,
+                                                       slap_schema.si_oc_referral ) )
+                                               {
+                                                       fprintf( stderr,
+                                                               "%s: line %d: group objectclass \"%s\" is subclass of referral\n",
+                                                               fname, lineno, value );
+                                                       acl_usage();
+                                               }
+
+                                               if( is_object_subclass( b->a_group_oc,
+                                                       slap_schema.si_oc_alias ) )
+                                               {
+                                                       fprintf( stderr,
+                                                               "%s: line %d: group objectclass \"%s\" is subclass of alias\n",
+                                                               fname, lineno, value );
+                                                       acl_usage();
+                                               }
+#endif
+
                                                *--value = '/';
+
                                        } else {
+#ifdef SLAPD_SCHEMA_NOT_COMPAT
+                                               b->a_group_oc = slap_schema.si_oc_groupOfNames;
+#else
                                                b->a_group_oc = ch_strdup("groupOfNames");
+#endif
                                        }
 
+
                                        if (name && *name) {
 #ifdef SLAPD_SCHEMA_NOT_COMPAT
                                                rc = slap_str2ad( right, &b->a_group_at, &text );
@@ -430,6 +467,31 @@ parse_acl(
                                                        fname, lineno );
                                                acl_usage();
                                        }
+
+
+                                       {
+                                               int rc;
+                                               struct berval val;
+                                               struct berval *vals[2];
+
+                                               val.bv_val = b->a_group_oc->soc_oid;
+                                               val.bv_len = strlen(val.bv_val);
+                                               vals[0] = &val;
+                                               vals[1] = NULL;
+
+
+                                               rc = oc_check_allowed( b->a_group_at->ad_type, vals );
+
+                                               if( rc != 0 ) {
+                                                       fprintf( stderr,
+                                                               "%s: line %d: group: \"%s\" not allowed by \"%s\"\n",
+                                                               fname, lineno,
+                                                               b->a_group_at->ad_type,
+                                                               b->a_group_oc->soc_oid );
+                                                       acl_usage();
+                                               }
+                                       }
+
 #endif /* SLAPD_SCHEMA_NOT_COMPAT */
                                        continue;
                                }

diff --git a/servers/slapd/back-ldbm/compare.c b/servers/slapd/back-ldbm/compare.c
index cd087aa82fff14dc2c20d891ae7471c067ab8e38..56a7bd4978806b7c3c4197bbc58c38163218b594 100644 (file)
--- a/servers/slapd/back-ldbm/compare.c
+++ b/servers/slapd/back-ldbm/compare.c
@@ -107,7 +107,7 @@ ldbm_back_compare(
                rc = LDAP_COMPARE_FALSE;
 
 #ifdef SLAPD_SCHEMA_NOT_COMPAT
-               /* not yet implemented */
+               if ( value_find( ava->aa_desc, a->a_vals, ava->aa_value ) == 0 )
 #else
                if ( value_find( a->a_vals, &ava->ava_value, a->a_syntax, 1 ) == 0 )
 #endif

diff --git a/servers/slapd/back-ldbm/external.h b/servers/slapd/back-ldbm/external.h
index 65c9fd790f063d9e3fc20b51b5a15573fb7996b5..c0c9ab901b9a976eb4234aacf436fb5c18f2a19e 100644 (file)
--- a/servers/slapd/back-ldbm/external.h
+++ b/servers/slapd/back-ldbm/external.h
@@ -83,14 +83,15 @@ extern int  ldbm_back_abandon LDAP_P(( BackendDB *bd,
 #ifdef SLAPD_SCHEMA_NOT_COMPAT
 extern int     ldbm_back_group LDAP_P(( BackendDB *bd,
        Entry *target,
-       const char* gr_ndn, const char* op_ndn,
-       const char* objectclassValue,
+       const char* gr_ndn,
+       const char* op_ndn,
+       ObjectClass* group_oc,
        AttributeDescription* group_at));
 #else
 extern int     ldbm_back_group LDAP_P(( BackendDB *bd,
        Entry *target,
        const char* gr_ndn, const char* op_ndn,
-       const char* objectclassValue,
+       const char* group_oc,
        const char* group_at));
 #endif
 

diff --git a/servers/slapd/back-ldbm/group.c b/servers/slapd/back-ldbm/group.c
index 5c1973a7db81a61c8fe932ac04b6e4a648aa7aaa..c92998719147c5c0f246ced560cbc00bb250708d 100644 (file)
--- a/servers/slapd/back-ldbm/group.c
+++ b/servers/slapd/back-ldbm/group.c
@@ -27,10 +27,11 @@ ldbm_back_group(
        Entry   *target,
        const char      *gr_ndn,
        const char      *op_ndn,
-       const char      *objectclassValue,
 #ifdef SLAPD_SCHEMA_NOT_COMPAT
+       ObjectClass *group_oc,
        AttributeDescription *group_at
 #else
+       const char      *group_oc,
        const char      *group_at
 #endif
 )
@@ -41,12 +42,20 @@ ldbm_back_group(
        Attribute   *attr;
 
 #ifdef SLAPD_SCHEMA_NOT_COMPAT
-       AttributeDescription *objectClass = slap_schema.si_ad_objectClass;
-       const char *groupattrName = group_at->ad_cname->bv_val;
+       AttributeDescription *ad_objectClass = slap_schema.si_ad_objectClass;
+       const char *group_oc_name = NULL;
+       const char *group_at_name = group_at->ad_cname->bv_val;
+
+       if( group_oc->soc_names && group_oc->soc_names[0] ) {
+               group_oc_name = group_oc->soc_names[0];
+       } else {
+               group_oc_name = group_oc->soc_oid;
+       }
 #else
        struct berval bv;
-       const char *objectClass = "objectclass";
-       const char *groupattrName = group_at;
+       const char *ad_objectClass = "objectclass";
+       const char *group_oc_name = group_oc;
+       const char *group_at_name = group_at;
 #endif
 
        Debug( LDAP_DEBUG_ARGS,
@@ -56,8 +65,8 @@ ldbm_back_group(
                "=> ldbm_back_group: op dn: \"%s\"\n",
                op_ndn, 0, 0 ); 
        Debug( LDAP_DEBUG_ARGS,
-               "=> ldbm_back_group: objectClass: \"%s\" attrName: \"%s\"\n", 
-               objectclassValue, groupattrName, 0 ); 
+               "=> ldbm_back_group: oc: \"%s\" at: \"%s\"\n", 
+               group_oc_name, group_at_name, 0 ); 
 
        Debug( LDAP_DEBUG_ARGS,
                "=> ldbm_back_group: tr dn: \"%s\"\n",
@@ -91,7 +100,7 @@ ldbm_back_group(
         
        rc = 1;
         
-       if ((attr = attr_find(e->e_attrs, objectClass)) == NULL)  {
+       if ((attr = attr_find(e->e_attrs, ad_objectClass)) == NULL)  {
                Debug( LDAP_DEBUG_ACL,
                        "<= ldbm_back_group: failed to find objectClass\n", 0, 0, 0 );
                goto return_results;
@@ -120,26 +129,26 @@ ldbm_back_group(
                goto return_results;
        }
 
-       bv.bv_val = (char *) objectclassValue;
+       bv.bv_val = (char *) group_oc_name;
        bv.bv_len = strlen( bv.bv_val );         
 
        if (value_find(attr->a_vals, &bv, attr->a_syntax, 1) != 0) {
                Debug( LDAP_DEBUG_ACL,
                        "<= ldbm_back_group: failed to find %s in objectClass\n", 
-                               objectclassValue, 0, 0 ); 
+                               group_oc_name, 0, 0 ); 
                goto return_results;
        }
 
        if ((attr = attr_find(e->e_attrs, group_at)) == NULL) {
                Debug( LDAP_DEBUG_ACL,
                        "<= ldbm_back_group: failed to find %s\n",
-                       groupattrName, 0, 0 ); 
+                       group_at_name, 0, 0 ); 
                goto return_results;
        }
 
        Debug( LDAP_DEBUG_ACL,
                "<= ldbm_back_group: found objectClass %s and %s\n",
-               objectclassValue, groupattrName, 0 ); 
+               group_oc_name, group_at_name, 0 ); 
 
        bv.bv_val = (char *) op_ndn;
        bv.bv_len = strlen( op_ndn );         
@@ -148,14 +157,14 @@ ldbm_back_group(
        {
                Debug( LDAP_DEBUG_ACL,
                        "<= ldbm_back_group: \"%s\" not in \"%s\": %s\n", 
-                       op_ndn, gr_ndn, groupattrName ); 
+                       op_ndn, gr_ndn, group_at_name ); 
                goto return_results;
        }
 #endif
 
        Debug( LDAP_DEBUG_ACL,
                "<= ldbm_back_group: \"%s\" is in \"%s\": %s\n", 
-               op_ndn, gr_ndn, groupattrName ); 
+               op_ndn, gr_ndn, group_at_name ); 
 
        rc = 0;
 

diff --git a/servers/slapd/back-ldbm/modify.c b/servers/slapd/back-ldbm/modify.c
index 6c2ac4cd2fd412f8c91d2ae986811239cfe8dc62..892507489d5fe5ea4144ffd6133d25caf8d8219c 100644 (file)
--- a/servers/slapd/back-ldbm/modify.c
+++ b/servers/slapd/back-ldbm/modify.c
@@ -123,13 +123,13 @@ int ldbm_modify_internal(
                switch ( mod->sm_op ) {
                case LDAP_MOD_REPLACE: {
                        /* Need to remove all values from indexes */
+#ifdef SLAPD_SCHEMA_NOT_COMPAT
+                       /* not yet implemented */
+#else
                        Attribute *a = save_attrs
                                ? attr_find( save_attrs, mod->sm_desc )
                                : NULL;
 
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
-                       /* not yet implemented */
-#else
                        if( a != NULL ) {
                                (void) index_change_values( be,
                                        mod->mod_type,
@@ -177,13 +177,13 @@ int ldbm_modify_internal(
 
                case LDAP_MOD_DELETE: {
                        /* Need to add all remaining values */
+#ifdef SLAPD_SCHEMA_NOT_COMPAT
+                       /* not yet implemented */
+#else
                        Attribute *a = e->e_attrs
                                ? attr_find( e->e_attrs, mod->sm_desc )
                                : NULL;
 
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
-                       /* not yet implemented */
-#else
                        if( a != NULL ) {
                                (void) index_change_values( be,
                                        mod->mod_type,
@@ -313,14 +313,14 @@ add_values(
        if ( a != NULL ) {
                for ( i = 0; mod->sm_bvalues[i] != NULL; i++ ) {
 #ifdef SLAPD_SCHEMA_NOT_COMPAT
-                       /* not yet implemented */
+                       if ( value_find( desc, a->a_vals, mod->sm_bvalues[i] ) == 0 )
 #else
                        if ( value_find( a->a_vals, mod->sm_bvalues[i],
                            a->a_syntax, 3 ) == 0 )
+#endif
                        {
                                return( LDAP_TYPE_OR_VALUE_EXISTS );
                        }
-#endif
                }
        }
 
@@ -339,33 +339,45 @@ delete_values(
     char       *dn
 )
 {
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
-       /* not yet implemented */
-#else
        int             i, j, k, found;
        Attribute       *a;
+#ifdef SLAPD_SCHEMA_NOT_COMPAT
+       char *desc = mod->sm_desc->ad_cname->bv_val;
+#else
+       char *desc = mod->mod_type;
+#endif
 
        /* delete the entire attribute */
-       if ( mod->mod_bvalues == NULL ) {
+       if ( mod->sm_bvalues == NULL ) {
                Debug( LDAP_DEBUG_ARGS, "removing entire attribute %s\n",
-                   mod->mod_type, 0, 0 );
-               return( attr_delete( &e->e_attrs, mod->mod_type ) ?
+                   desc, 0, 0 );
+               return( attr_delete( &e->e_attrs, mod->sm_desc ) ?
                    LDAP_NO_SUCH_ATTRIBUTE : LDAP_SUCCESS );
        }
 
        /* delete specific values - find the attribute first */
-       if ( (a = attr_find( e->e_attrs, mod->mod_type )) == NULL ) {
+       if ( (a = attr_find( e->e_attrs, mod->sm_desc )) == NULL ) {
                Debug( LDAP_DEBUG_ARGS, "could not find attribute %s\n",
-                   mod->mod_type, 0, 0 );
+                   desc, 0, 0 );
                return( LDAP_NO_SUCH_ATTRIBUTE );
        }
 
        /* find each value to delete */
-       for ( i = 0; mod->mod_bvalues[i] != NULL; i++ ) {
+       for ( i = 0; mod->sm_bvalues[i] != NULL; i++ ) {
                found = 0;
                for ( j = 0; a->a_vals[j] != NULL; j++ ) {
+#ifdef SLAPD_SCHEMA_NOT_COMPAT
+                       int match;
+                       const char *text;
+                       int rc = value_match( &match, mod->sm_desc, NULL,
+                               mod->sm_bvalues[i], a->a_vals[j], &text );
+
+                       if( rc == LDAP_SUCCESS && match == 0 )
+#else
                        if ( value_cmp( mod->mod_bvalues[i], a->a_vals[j],
-                           a->a_syntax, 3 ) != 0 ) {
+                           a->a_syntax, 3 ) != 0 )
+#endif
+                       {
                                continue;
                        }
                        found = 1;
@@ -381,8 +393,8 @@ delete_values(
                        if ( a->a_vals[0] == NULL) {
                                Debug( LDAP_DEBUG_ARGS,
                                        "removing entire attribute %s\n",
-                                       mod->mod_type, 0, 0 );
-                               if ( attr_delete( &e->e_attrs, mod->mod_type ) ) {
+                                       desc, 0, 0 );
+                               if ( attr_delete( &e->e_attrs, mod->sm_desc ) ) {
                                        return LDAP_NO_SUCH_ATTRIBUTE;
                                }
                        }
@@ -394,11 +406,10 @@ delete_values(
                if ( ! found ) {
                        Debug( LDAP_DEBUG_ARGS,
                            "could not find value for attr %s\n",
-                           mod->mod_type, 0, 0 );
+                           desc, 0, 0 );
                        return LDAP_NO_SUCH_ATTRIBUTE;
                }
        }
-#endif
 
        return( LDAP_SUCCESS );
 }

diff --git a/servers/slapd/back-ldbm/modrdn.c b/servers/slapd/back-ldbm/modrdn.c
index 839a39615725b692335acd3a3deb4a82db39c722..83474d77874926bae740587bf4e390fa497a7f37 100644 (file)
--- a/servers/slapd/back-ldbm/modrdn.c
+++ b/servers/slapd/back-ldbm/modrdn.c
@@ -320,34 +320,28 @@ ldbm_back_modrdn(
        /* Retrieve the old rdn from the entry's dn */
 
        if ( (old_rdn = dn_rdn( be, dn )) == NULL ) {
-
                Debug( LDAP_DEBUG_TRACE,
                       "ldbm_back_modrdn: can't figure out old_rdn from dn\n",
                       0, 0, 0 );
                send_ldap_result( conn, op, LDAP_OTHER,
                        NULL, "could not parse old DN", NULL, NULL );
                goto return_results;            
-
        }
 
        if ( (old_rdn_type = rdn_attr_type( old_rdn )) == NULL ) {
-           
                Debug( LDAP_DEBUG_TRACE,
                       "ldbm_back_modrdn: can't figure out the old_rdn type\n",
                       0, 0, 0 );
                send_ldap_result( conn, op, LDAP_OTHER,
                        NULL, "count parse RDN from old DN", NULL, NULL );
                goto return_results;            
-               
        }
        
        if ( strcasecmp( old_rdn_type, new_rdn_type ) != 0 ) {
-
            /* Not a big deal but we may say something */
            Debug( LDAP_DEBUG_TRACE,
                   "ldbm_back_modrdn: old_rdn_type=%s, new_rdn_type=%s!\n",
                   old_rdn_type, new_rdn_type, 0 );
-           
        }               
 
                Debug( LDAP_DEBUG_TRACE, "ldbm_back_modrdn: DN_X500\n",
@@ -363,13 +357,28 @@ ldbm_back_modrdn(
                add_bv.bv_len = strlen(new_rdn_val);
                
 #ifdef SLAPD_SCHEMA_NOT_COMPAT
-               /* not yet implemented */
+               {
+                       int rc;
+                       const char *text;
+
+                       mod[0].sml_desc = NULL;
+                       rc = slap_str2ad( new_rdn_type, &mod[0].sml_desc, &text );
+
+                       if( rc != LDAP_SUCCESS ) {
+                               Debug( LDAP_DEBUG_TRACE,
+                                       "ldbm_back_modrdn: %s: %s (new)\n",
+                                       text, new_rdn_type, 0 );
+                               send_ldap_result( conn, op, rc,
+                                       NULL, text, NULL, NULL );
+                               goto return_results;            
+                       }
+               }
 #else
-               mod[0].ml_type = new_rdn_type;  
-               mod[0].ml_bvalues = add_bvals;
-               mod[0].ml_op = SLAP_MOD_SOFTADD;
-               mod[0].ml_next = NULL;
+               mod[0].sml_type = new_rdn_type; 
 #endif
+               mod[0].sml_bvalues = add_bvals;
+               mod[0].sml_op = SLAP_MOD_SOFTADD;
+               mod[0].sml_next = NULL;
 
                /* Remove old rdn value if required */
 
@@ -383,7 +392,7 @@ ldbm_back_modrdn(
                                       "ldbm_back_modrdn: can't figure out old_rdn_val from old_rdn\n",
                                       0, 0, 0 );
                                send_ldap_result( conn, op, LDAP_OTHER,
-                                       NULL, "cound not parse value from old RDN", NULL, NULL );
+                                       NULL, "could not parse value from old RDN", NULL, NULL );
                                goto return_results;            
                        }
 
@@ -396,17 +405,29 @@ ldbm_back_modrdn(
                        del_bv.bv_len = strlen(old_rdn_val);
 
 #ifdef SLAPD_SCHEMA_NOT_COMPAT
-                       /* not yet implemented */
+                       {
+                               int rc;
+                               const char *text;
+
+                               mod[1].sml_desc = NULL;
+                               rc = slap_str2ad( old_rdn_type, &mod[0].sml_desc, &text );
+
+                               if( rc != LDAP_SUCCESS ) {
+                                       Debug( LDAP_DEBUG_TRACE,
+                                               "ldbm_back_modrdn: %s: %s (old)\n",
+                                               text, old_rdn_type, 0 );
+                                       send_ldap_result( conn, op, rc,
+                                               NULL, text, NULL, NULL );
+                                       goto return_results;            
+                               }
+                       }
 #else
-                       /* No need to normalize old_rdn_type, delete_values()
-                        * does that for us
-                        */
-                       mod[0].ml_next = &mod[1];
-                       mod[1].ml_type = old_rdn_type;  
-                       mod[1].ml_bvalues = del_bvals;
-                       mod[1].ml_op = LDAP_MOD_DELETE;
-                       mod[1].ml_next = NULL;
+                       mod[1].sml_type = old_rdn_type; 
 #endif
+                       mod[0].sml_next = &mod[1];
+                       mod[1].sml_bvalues = del_bvals;
+                       mod[1].sml_op = LDAP_MOD_DELETE;
+                       mod[1].sml_next = NULL;
 
                        Debug( LDAP_DEBUG_TRACE,
                               "ldbm_back_modrdn: removing old_rdn_val=%s\n",

diff --git a/servers/slapd/backend.c b/servers/slapd/backend.c
index 1baf0748419d7a3c9153d21927961acd71ce2996..e9f4c0e4de910a7aa3f96f547d0a8715f2cddf12 100644 (file)
--- a/servers/slapd/backend.c
+++ b/servers/slapd/backend.c
@@ -635,19 +635,20 @@ backend_group(
        Entry   *target,
        const char      *gr_ndn,
        const char      *op_ndn,
-       const char      *objectclassValue,
 #ifdef SLAPD_SCHEMA_NOT_COMPAT
+       ObjectClass *group_oc,
        AttributeDescription *group_at
 #else
+       const char      *group_oc,
        const char      *group_at
 #endif
 )
 {
        if (be->be_group)
                return( be->be_group(be, target, gr_ndn, op_ndn,
-                       objectclassValue, group_at) );
+                       group_oc, group_at) );
        else
-               return(1);
+               return LDAP_UNWILLING_TO_PERFORM;
 }
 
 #ifdef SLAPD_SCHEMA_DN

diff --git a/servers/slapd/modify.c b/servers/slapd/modify.c
index 394956569d9052bd660ebc92c8ebf367e9c099ae..58e5ba7daa45d949753f84468515785f17e33fa8 100644 (file)
--- a/servers/slapd/modify.c
+++ b/servers/slapd/modify.c
@@ -453,7 +453,7 @@ int slap_mods_opattrs(
 
        mod = (Modifications *) ch_calloc( 1, sizeof( Modifications ) );
        mod->sml_op = mop;
-       mod->sml_desc = slap_schema.si_ad_modifiersName;
+       mod->sml_desc = ad_dup( slap_schema.si_ad_modifiersName );
        mod->sml_bvalues = (struct berval **) malloc( 2 * sizeof( struct berval * ) );
        mod->sml_bvalues[0] = ber_bvdup( &name );
        mod->sml_bvalues[1] = NULL;
@@ -462,7 +462,7 @@ int slap_mods_opattrs(
 
        mod = (Modifications *) ch_calloc( 1, sizeof( Modifications ) );
        mod->sml_op = mop;
-       mod->sml_desc = slap_schema.si_ad_modifyTimestamp;
+       mod->sml_desc = ad_dup( slap_schema.si_ad_modifyTimestamp );
        mod->sml_bvalues = (struct berval **) malloc( 2 * sizeof( struct berval * ) );
        mod->sml_bvalues[0] = ber_bvdup( &timestamp );
        mod->sml_bvalues[1] = NULL;

diff --git a/servers/slapd/oc.c b/servers/slapd/oc.c
index 6fa5dcfa0a3ced7f9bd188fb6c100be2b8d5b95a..136170668753421d9c3e8e055853378790889840 100644 (file)
--- a/servers/slapd/oc.c
+++ b/servers/slapd/oc.c
@@ -16,6 +16,29 @@
 #include "slap.h"
 #include "ldap_pvt.h"
 
+int is_object_subclass(
+       ObjectClass *sub,
+       ObjectClass *sup )
+{
+       int i;
+
+       if( sup == sub ) {
+               return 1;
+       }
+
+       if( sup->soc_sups == NULL ) {
+               return 0;
+       }
+
+       for( i=0; sup->soc_sups[i] != NULL; i++ ) {
+               if( is_object_subclass( sup->soc_sups[i], sup ) ) {
+                       return 1;
+               }
+       }
+
+       return 0;
+}
+
 int is_entry_objectclass(
        Entry*  e,
 #ifdef SLAPD_SCHEMA_NOT_COMPAT

diff --git a/servers/slapd/proto-slap.h b/servers/slapd/proto-slap.h
index f6f6c76fa6ab6fe5fa3135193fbe4ab6c111b57e..c1b268ed22b79158f1fa1f4f05f4feda55ceb6f0 100644 (file)
--- a/servers/slapd/proto-slap.h
+++ b/servers/slapd/proto-slap.h
@@ -197,16 +197,16 @@ LIBSLAPD_F (int) backend_group LDAP_P((Backend *be,
        Entry *target,
        const char *gr_ndn,
        const char *op_ndn,
-       const char *objectclassValue,
-       AttributeDescription *groupAttrType
+       ObjectClass *group_oc,
+       AttributeDescription *group_at
 ));
 #else
 LIBSLAPD_F (int) backend_group LDAP_P((Backend *be,
        Entry *target,
        const char *gr_ndn,
        const char *op_ndn,
-       const char *objectclassValue,
-       const char *groupattrName
+       const char *group_oc,
+       const char *group_at
 ));
 #endif
 
@@ -568,8 +568,17 @@ LIBSLAPD_F (int) oc_check_op_attr LDAP_P(( const char *type ));
 LIBSLAPD_F (int) oc_check_op_usermod_attr LDAP_P(( const char *type ));
 LIBSLAPD_F (int) oc_check_op_no_usermod_attr LDAP_P(( const char *type ));
 #endif
-LIBSLAPD_F (ObjectClass *) oc_find LDAP_P((const char *ocname));
-LIBSLAPD_F (int) oc_add LDAP_P((LDAP_OBJECT_CLASS *oc, const char **err));
+LIBSLAPD_F (ObjectClass *) oc_find LDAP_P((
+       const char *ocname));
+
+LIBSLAPD_F (int) oc_add LDAP_P((
+       LDAP_OBJECT_CLASS *oc,
+       const char **err));
+
+LIBSLAPD_F (int) is_object_subclass LDAP_P((
+       ObjectClass *sub,
+       ObjectClass *sup ));
+
 
 LIBSLAPD_F (Syntax *) syn_find LDAP_P((const char *synname));
 LIBSLAPD_F (Syntax *) syn_find_desc LDAP_P((const char *syndesc, int *slen));
@@ -637,6 +646,11 @@ LIBSLAPD_F (int) is_entry_objectclass LDAP_P((
 /*
  * schema_check.c
  */
+#ifdef SLAPD_SCHEMA_NOT_COMPAT
+int oc_check_allowed(
+       AttributeType *type,
+       struct berval **oclist );
+#endif
 LIBSLAPD_F (int) entry_schema_check LDAP_P((
        Entry *e, Attribute *attrs,
        const char** text ));
@@ -707,10 +721,8 @@ LIBSLAPD_F (int) value_match LDAP_P((
        const char ** text ));
 LIBSLAPD_F (int) value_find LDAP_P((
        AttributeDescription *ad,
-       MatchingRule *mr,
        struct berval **values,
-       struct berval *value,
-       const char ** text ));
+       struct berval *value ));
 #else
 LIBSLAPD_F (int) value_add_fast LDAP_P(( struct berval ***vals, struct berval **addvals, int nvals, int naddvals, int *maxvals ));
 LIBSLAPD_F (void) value_normalize LDAP_P(( char *s, int syntax ));

diff --git a/servers/slapd/schema_check.c b/servers/slapd/schema_check.c
index 5ada57b7bcdfbc0b8bba23e4c54c5bc82670c56b..4f76da0e36bb1d5d7839914b2dbc854559110ad2 100644 (file)
--- a/servers/slapd/schema_check.c
+++ b/servers/slapd/schema_check.c
@@ -16,11 +16,7 @@
 #include "slap.h"
 #include "ldap_pvt.h"
 
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
-static int oc_check_allowed(
-       AttributeType *type,
-       struct berval **oclist );
-#else
+#ifndef SLAPD_SCHEMA_NOT_COMPAT
 static int             oc_check_allowed(char *type, struct berval **oclist);
 #endif
 static char *  oc_check_required(Entry *e, struct berval *ocname);
@@ -181,8 +177,10 @@ oc_check_required( Entry *e, struct berval *ocname )
        return( NULL );
 }
 
-static int
-oc_check_allowed(
+#ifndef SLAPD_SCHEMA_NOT_COMPAT
+static
+#endif
+int oc_check_allowed(
 #ifdef SLAPD_SCHEMA_NOT_COMPAT
        AttributeType *at,
 #else

diff --git a/servers/slapd/schema_prep.c b/servers/slapd/schema_prep.c
index 051c98d5838eb94684e2f2033a0a38aba962e461..c40a086e18b55bec241bf1bbe9843e2c874e4cf4 100644 (file)
--- a/servers/slapd/schema_prep.c
+++ b/servers/slapd/schema_prep.c
@@ -47,9 +47,7 @@ struct slap_schema_oc_map {
        { "LDAProotDSE", offsetof(struct slap_internal_schema, si_oc_rootdse) },
        { "LDAPsubentry", offsetof(struct slap_internal_schema, si_oc_subentry) },
        { "subschema", offsetof(struct slap_internal_schema, si_oc_subschema) },
-#ifdef SLAPD_ACI_ENABLED
        { "groupOfNames", offsetof(struct slap_internal_schema, si_oc_groupOfNames) },
-#endif
        { NULL, 0 }
 };
 

diff --git a/servers/slapd/slap.h b/servers/slapd/slap.h
index a88d38448aad4b1f14c89d4c11e5e4606c6b2301..70f60ecef0de5a87ad641b60e49b2e5dbab3fd83 100644 (file)
--- a/servers/slapd/slap.h
+++ b/servers/slapd/slap.h
@@ -336,9 +336,7 @@ struct slap_internal_schema {
        ObjectClass *si_oc_subentry;
        ObjectClass *si_oc_subschema;
        ObjectClass *si_oc_rootdse;
-#ifdef SLAPD_ACI_ENABLED
        ObjectClass *si_oc_groupOfNames;
-#endif
 
        /* objectClass attribute */
        AttributeDescription *si_ad_objectClass;
@@ -734,10 +732,11 @@ typedef struct slap_access {
 
        /* ACL Groups */
        char            *a_group_pat;
-       char            *a_group_oc;
 #ifdef SLAPD_SCHEMA_NOT_COMPAT
+       ObjectClass                             *a_group_oc;
        AttributeDescription    *a_group_at;
 #else
+       char            *a_group_oc;
        char            *a_group_at;
 #endif
 
@@ -989,12 +988,12 @@ struct slap_backend_info {
 #ifdef SLAPD_SCHEMA_NOT_COMPAT
        int     (*bi_acl_group)  LDAP_P((Backend *bd,
                Entry *e, const char *bdn, const char *edn,
-               const char *objectclassValue,
+               ObjectClass *group_oc,
                AttributeDescription *group_at ));
 #else
        int     (*bi_acl_group)  LDAP_P((Backend *bd,
                Entry *e, const char *bdn, const char *edn,
-               const char *objectclassValue,
+               const char *group_oc,
                const char *group_at ));
 #endif
 

diff --git a/servers/slapd/slapd.conf b/servers/slapd/slapd.conf
index ea9b076b410f383a2964af19d2563b65e50f9c55..a2cc80959921e4b012a2b81f612ac1b3aef4f1e3 100644 (file)
--- a/servers/slapd/slapd.conf
+++ b/servers/slapd/slapd.conf
@@ -39,4 +39,6 @@ rootdn                "cn=Manager, dc=my-domain, dc=com"
 # cleartext passwords, especially for the rootdn, should
 # be avoid.  See slapd.conf(5) for details.
 rootpw         secret
+# this directory MUST exist and be writable by the slapd/tools
+# process before running slapd and/or tools.
 directory      %LOCALSTATEDIR%/openldap-ldbm

diff --git a/servers/slapd/value.c b/servers/slapd/value.c
index 05af2ff085603ac08d4a3c26200e0cdcdde66611..3cc7ba54a3bfbe22f1b89761cfe25f59ba1946a2 100644 (file)
--- a/servers/slapd/value.c
+++ b/servers/slapd/value.c
@@ -274,10 +274,8 @@ value_cmp(
 #ifdef SLAPD_SCHEMA_NOT_COMPAT
 int value_find(
        AttributeDescription *ad,
-       MatchingRule *mr,
        struct berval **vals,
-       struct berval *val,
-       const char ** text )
+       struct berval *val )
 #else
 int
 value_find(
@@ -288,12 +286,20 @@ value_find(
 #endif
 {
        int     i;
+#ifdef SLAPD_SCHEMA_NOT_COMPAT
+       MatchingRule *mr = ad->ad_type->sat_equality;
+
+       if( mr == NULL ) {
+               return LDAP_INAPPROPRIATE_MATCHING;
+       }
+#endif
 
        for ( i = 0; vals[i] != NULL; i++ ) {
 #ifdef SLAPD_SCHEMA_NOT_COMPAT
                int rc;
                int match;
-               rc = value_match( &match, ad, mr, vals[i], val, text );
+               const char *text;
+               rc = value_match( &match, ad, mr, vals[i], val, &text );
 
                if( rc == LDAP_SUCCESS && match == 0 )
 #else