Merge remote-tracking branch 'origin/master' into OPENLDAP_REL_ENG_2_5

clients/tools/ldapexop.c

@@ -351,5 +351,5 @@ skip:
 	/* disconnect from server */
 	if ( res )
 		ldap_msgfree( res );
-	tool_exit( ld, code == LDAP_SUCCESS ? EXIT_SUCCESS : EXIT_FAILURE );
+	tool_exit( ld, rc );
 }

doc/man/man5/slapo-dynlist.5

@@ -263,6 +263,11 @@ The
 .BR slapo\-dynlist (5)
 overlay supports dynamic configuration via
 .BR back-config .
+
+.SH BUGS
+Filtering on dynamic groups may return incomplete results if the
+search operation uses the \fIpagedResults\fP control.
+
 .SH ACKNOWLEDGEMENTS
 .P
 This module was written in 2004 by Pierangelo Masarati for SysNet s.n.c.

libraries/libldap/tls2.c

@@ -1499,12 +1499,20 @@ ldap_X509dn2bv( void *x509_name, struct berval *bv, LDAPDN_rewrite_func *func,
 		for ( tag = ber_first_element( ber, &len, &rdn_end );
 			tag == LBER_SEQUENCE;
 			tag = ber_next_element( ber, &len, rdn_end )) {
+			if ( rdn_end > dn_end )
+				return LDAP_DECODING_ERROR;
 			tag = ber_skip_tag( ber, &len );
 			ber_skip_data( ber, len );
 			navas++;
 		}
 	}
 
+	/* Rewind and prepare to extract */
+	ber_rewind( ber );
+	tag = ber_first_element( ber, &len, &dn_end );
+	if ( tag != LBER_SET )
+		return LDAP_DECODING_ERROR;
+
 	/* Allocate the DN/RDN/AVA stuff as a single block */    
 	dnsize = sizeof(LDAPRDN) * (nrdns+1);
 	dnsize += sizeof(LDAPAVA *) * (navas+nrdns);
@@ -1516,16 +1524,12 @@ ldap_X509dn2bv( void *x509_name, struct berval *bv, LDAPDN_rewrite_func *func,
 	} else {
 		newDN = (LDAPDN)(char *)ptrs;
 	}
-	
+
 	newDN[nrdns] = NULL;
 	newRDN = (LDAPRDN)(newDN + nrdns+1);
 	newAVA = (LDAPAVA *)(newRDN + navas + nrdns);
 	baseAVA = newAVA;
 
-	/* Rewind and start extracting */
-	ber_rewind( ber );
-
-	tag = ber_first_element( ber, &len, &dn_end );
 	for ( i = nrdns - 1; i >= 0; i-- ) {
 		newDN[i] = newRDN;
 
@@ -1619,6 +1623,10 @@ allocd:
 				/* X.690 bitString value converted to RFC4517 Bit String */
 				rc = der_to_ldap_BitString( &Val, &newAVA->la_value );
 				goto allocd;
+			case LBER_DEFAULT:
+				/* decode error */
+				rc = LDAP_DECODING_ERROR;
+				goto nomem;
 			default:
 				/* Not a string type at all */
 				newAVA->la_flags = 0;

servers/slapd/back-mdb/config.c

@@ -110,7 +110,8 @@ static ConfigTable mdbcfg[] = {
 		"( OLcfgDbAt:12.5 NAME 'olcDbRtxnSize' "
 		"DESC 'Number of entries to process in one read transaction' "
 		"EQUALITY integerMatch "
-		"SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
+		"SYNTAX OMsInteger SINGLE-VALUE )", NULL,
+		{ .v_uint = DEFAULT_RTXN_SIZE } },
 	{ "searchstack", "depth", 2, 2, 0, ARG_INT|ARG_MAGIC|MDB_SSTACK,
 		mdb_cf_gen, "( OLcfgDbAt:1.9 NAME 'olcDbSearchStack' "
 		"DESC 'Depth of search stack in IDLs' "

servers/slapd/bconfig.c

@@ -424,11 +424,13 @@ static ConfigTable config_back_cf_table[] = {
 	{ "index_substr_any_len", "len", 2, 2, 0, ARG_UINT|ARG_NONZERO,
 		&index_substr_any_len, "( OLcfgGlAt:22 NAME 'olcIndexSubstrAnyLen' "
 			"EQUALITY integerMatch "
-			"SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
+			"SYNTAX OMsInteger SINGLE-VALUE )", NULL,
+			{ .v_uint = SLAP_INDEX_SUBSTR_ANY_LEN_DEFAULT } },
 	{ "index_substr_any_step", "step", 2, 2, 0, ARG_UINT|ARG_NONZERO,
 		&index_substr_any_step, "( OLcfgGlAt:23 NAME 'olcIndexSubstrAnyStep' "
 			"EQUALITY integerMatch "
-			"SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
+			"SYNTAX OMsInteger SINGLE-VALUE )", NULL,
+			{ .v_uint = SLAP_INDEX_SUBSTR_ANY_STEP_DEFAULT } },
 	{ "index_intlen", "len", 2, 2, 0, ARG_UINT|ARG_MAGIC|CFG_IX_INTLEN,
 		&config_generic, "( OLcfgGlAt:84 NAME 'olcIndexIntLen' "
 			"EQUALITY integerMatch "
@@ -461,7 +463,8 @@ static ConfigTable config_back_cf_table[] = {
 	{ "localSSF", "ssf", 2, 2, 0, ARG_INT,
 		&local_ssf, "( OLcfgGlAt:26 NAME 'olcLocalSSF' "
 			"EQUALITY integerMatch "
-			"SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
+			"SYNTAX OMsInteger SINGLE-VALUE )", NULL,
+			{ .v_int = LDAP_PVT_SASL_LOCAL_SSF } },
 	{ "logfile", "file", 2, 2, 0, ARG_STRING|ARG_MAGIC|CFG_LOGFILE,
 		&config_generic, "( OLcfgGlAt:27 NAME 'olcLogFile' "
 			"EQUALITY caseExactMatch "
@@ -686,11 +689,13 @@ static ConfigTable config_back_cf_table[] = {
 	{ "sockbuf_max_incoming", "max", 2, 2, 0, ARG_BER_LEN_T,
 		&sockbuf_max_incoming, "( OLcfgGlAt:61 NAME 'olcSockbufMaxIncoming' "
 			"EQUALITY integerMatch "
-			"SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
+			"SYNTAX OMsInteger SINGLE-VALUE )", NULL,
+			{ .v_ber_t = SLAP_SB_MAX_INCOMING_DEFAULT } },
 	{ "sockbuf_max_incoming_auth", "max", 2, 2, 0, ARG_BER_LEN_T,
 		&sockbuf_max_incoming_auth, "( OLcfgGlAt:62 NAME 'olcSockbufMaxIncomingAuth' "
 			"EQUALITY integerMatch "
-			"SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
+			"SYNTAX OMsInteger SINGLE-VALUE )", NULL,
+			{ .v_ber_t = SLAP_SB_MAX_INCOMING_AUTH } },
 	{ "sortvals", "attr", 2, 0, 0, ARG_MAGIC|CFG_SORTVALS,
 		&config_generic, "( OLcfgGlAt:83 NAME 'olcSortVals' "
 			"DESC 'Attributes whose values will always be sorted' "
@@ -1417,7 +1422,6 @@ config_generic(ConfigArgs *c) {
 		case CFG_THREADQS:
 		case CFG_TTHREADS:
 		case CFG_LTHREADS:
-		case CFG_RO:
 		case CFG_AZPOLICY:
 		case CFG_DEPTH:
 		case CFG_LASTMOD:
@@ -1430,6 +1434,10 @@ config_generic(ConfigArgs *c) {
 		case CFG_SYNC_SUBENTRY:
 			break;
 
+		case CFG_RO:
+			c->be->be_restrictops &= ~SLAP_RESTRICT_READONLY;
+			break;
+
 #ifdef LDAP_SLAPI
 		case CFG_PLUGIN:
 			slapi_int_unregister_plugins(c->be, c->valx);

servers/slapd/component.c

@@ -347,7 +347,7 @@ get_comp_filter( Operation* op, struct berval* bv,
 		return rc;
 	}
 	rc = parse_comp_filter( op, &cav, filt, text );
-	bv->bv_val = cav.cav_ptr;
+	/* bv->bv_val = cav.cav_ptr; */
 
 	return rc;
 }
@@ -905,31 +905,37 @@ strip_cav_str( ComponentAssertionValue* cav, char* str)
 static ber_tag_t
 strip_cav_tag( ComponentAssertionValue* cav )
 {
+	int rc;
 
 	eat_whsp( cav );
 	if ( cav_cur_len( cav ) >= 8 && strncmp( cav->cav_ptr, "item", 4 ) == 0 ) {
-		strip_cav_str( cav , "item:" );
+		if ( strip_cav_str( cav , "item:" ))
+			goto fail;
 		return LDAP_COMP_FILTER_ITEM;
 
 	} else if ( cav_cur_len( cav ) >= 7 &&
 		strncmp( cav->cav_ptr, "and", 3 ) == 0 )
 	{
-		strip_cav_str( cav , "and:" );
+		if ( strip_cav_str( cav , "and:" ))
+			goto fail;
 		return LDAP_COMP_FILTER_AND;
 
 	} else if ( cav_cur_len( cav ) >= 6 &&
 		strncmp( cav->cav_ptr, "or" , 2 ) == 0 )
 	{
-		strip_cav_str( cav , "or:" );
+		if ( strip_cav_str( cav , "or:" ))
+			goto fail;
 		return LDAP_COMP_FILTER_OR;
 
 	} else if ( cav_cur_len( cav ) >= 7 &&
 		strncmp( cav->cav_ptr, "not", 3 ) == 0 )
 	{
-		strip_cav_str( cav , "not:" );
+		if ( strip_cav_str( cav , "not:" ))
+			goto fail;
 		return LDAP_COMP_FILTER_NOT;
 	}
 
+fail:
 	return LBER_ERROR;
 }
 
@@ -1067,7 +1073,7 @@ parse_comp_filter( Operation* op, ComponentAssertionValue* cav,
 	 */
 
 	ber_tag_t	tag;
-	int		err;
+	int		err = LDAP_SUCCESS;
 	ComponentFilter	f;
 	/* TAG : item, and, or, not in RFC 4515 */
 	tag = strip_cav_tag( cav );
@@ -1077,10 +1083,11 @@ parse_comp_filter( Operation* op, ComponentAssertionValue* cav,
 		return LDAP_PROTOCOL_ERROR;
 	}
 
-	if ( tag != LDAP_COMP_FILTER_NOT )
-		strip_cav_str( cav, "{");
-
-	err = LDAP_SUCCESS;
+	if ( tag != LDAP_COMP_FILTER_NOT ) {
+		err = strip_cav_str( cav, "{");
+		if ( err )
+			goto invalid;
+	}
 
 	f.cf_next = NULL;
 	f.cf_choice = tag; 
@@ -1154,13 +1161,14 @@ parse_comp_filter( Operation* op, ComponentAssertionValue* cav,
 		break;
 	}
 
+invalid:
 	if ( err != LDAP_SUCCESS && err != SLAPD_DISCONNECT ) {
 		*text = "Component Filter Syntax Error";
 		return err;
 	}
 
 	if ( tag != LDAP_COMP_FILTER_NOT )
-		strip_cav_str( cav, "}");
+		err = strip_cav_str( cav, "}");
 
 	if ( err == LDAP_SUCCESS ) {
 		if ( op ) {

servers/slapd/config.c

@@ -453,14 +453,61 @@ int
 config_del_vals(ConfigTable *cf, ConfigArgs *c)
 {
 	int rc = 0;
+	void *ptr;
 
-	/* If there is no handler, just ignore it */
 	if ( cf->arg_type & ARG_MAGIC ) {
 		c->argv[0] = cf->ad->ad_cname.bv_val;
 		c->op = LDAP_MOD_DELETE;
 		c->type = cf->arg_type & ARGS_USERLAND;
 		rc = (*((ConfigDriver*)cf->arg_item))(c);
+		return rc;
 	}
+	/* If there is no handler, just zero it */
+	if ( cf->arg_type & ARG_OFFSET ) {
+		if ( c->be && c->table == Cft_Database )
+			ptr = c->be->be_private;
+		else if ( c->bi )
+			ptr = c->bi->bi_private;
+		else {
+			snprintf( c->cr_msg, sizeof( c->cr_msg ), "<%s> offset is missing base pointer",
+				c->argv[0] );
+			Debug( LDAP_DEBUG_CONFIG, "%s: %s!\n",
+				c->log, c->cr_msg );
+			return ARG_BAD_CONF;
+		}
+		ptr = (void *)((char *)ptr + (long)cf->arg_item);
+	} else if ( cf->arg_type & ARGS_TYPES ) {
+		ptr = cf->arg_item;
+	}
+	if ( cf->arg_type & ARGS_TYPES )
+		switch ( cf->arg_type & ARGS_TYPES ) {
+			case ARG_ON_OFF:
+			case ARG_INT:		*(int *)ptr = cf->arg_default.v_int;		break;
+			case ARG_UINT:		*(unsigned *)ptr = cf->arg_default.v_uint;	break;
+			case ARG_LONG:		*(long *)ptr = cf->arg_default.v_long;		break;
+			case ARG_ULONG:		*(size_t *)ptr = cf->arg_default.v_ulong;	break;
+			case ARG_BER_LEN_T:	*(ber_len_t *)ptr = cf->arg_default.v_ber_t;	break;
+			case ARG_STRING:
+				ch_free( *(char**)ptr );
+				if ( cf->arg_default.v_string ) {
+					*(char **)ptr = ch_strdup( cf->arg_default.v_string );
+				} else {
+					*(char **)ptr = NULL;
+				}
+				break;
+			case ARG_BERVAL:
+			case ARG_BINARY:
+				ch_free( ((struct berval *)ptr)->bv_val );
+				if ( !BER_BVISNULL( &cf->arg_default.v_bv ) ) {
+					ber_dupbv( (struct berval *)ptr, &cf->arg_default.v_bv );
+				} else {
+					BER_BVZERO( (struct berval *)ptr );
+				}
+				break;
+			case ARG_ATDESC:
+				*(AttributeDescription **)ptr = cf->arg_default.v_ad;
+				break;
+		}
 	return rc;
 }
 

servers/slapd/config.h

@@ -21,6 +21,23 @@
 
 LDAP_BEGIN_DECL
 
+typedef union config_values_u {
+	/* Drop-in to make existing "notify" initialisers quietly work */
+	void *dummy;
+	int v_int;
+	unsigned v_uint;
+	long v_long;
+	size_t v_ulong;
+	ber_len_t v_ber_t;
+	char *v_string;
+	struct berval v_bv;
+	struct {
+		struct berval vdn_dn;
+		struct berval vdn_ndn;
+	} v_dn;
+	AttributeDescription *v_ad;
+} ConfigValues;
+
 typedef struct ConfigTable {
 	const char *name;
 	const char *what;
@@ -31,7 +48,7 @@ typedef struct ConfigTable {
 	void *arg_item;
 	const char *attribute;
 	AttributeDescription *ad;
-	void *notify;
+	ConfigValues arg_default;
 } ConfigTable;
 
 /* search entries are returned according to this order */
@@ -142,20 +159,7 @@ typedef struct config_args_s {
 	int depth;
 	int valx;	/* multi-valued value index */
 	/* parsed first val for simple cases */
-	union {
-		int v_int;
-		unsigned v_uint;
-		long v_long;
-		size_t v_ulong;
-		ber_len_t v_ber_t;
-		char *v_string;
-		struct berval v_bv;
-		struct {
-			struct berval vdn_dn;
-			struct berval vdn_ndn;
-		} v_dn;
-		AttributeDescription *v_ad;
-	} values;
+	ConfigValues values;
 	/* return values for emit mode */
 	BerVarray rvalue_vals;
 	BerVarray rvalue_nvals;

servers/slapd/dn.c

@@ -233,6 +233,7 @@ AVA_Sort( LDAPRDN rdn, int nAVAs )
 {
 	LDAPAVA	*ava_i;
 	int		i;
+	int		rc = LDAP_SUCCESS;
 
 	assert( rdn != NULL );
 
@@ -250,7 +251,7 @@ AVA_Sort( LDAPRDN rdn, int nAVAs )
 			/* RFC4512 does not allow multiple AVAs
 			 * with the same attribute type in RDN (ITS#5968) */
 			if ( a == 0 )
-				return LDAP_INVALID_DN_SYNTAX;
+				rc = LDAP_INVALID_DN_SYNTAX;
 
 			if ( a > 0 )
 				break;
@@ -259,7 +260,7 @@ AVA_Sort( LDAPRDN rdn, int nAVAs )
 		}
 		rdn[ j+1 ] = ava_i;
 	}
-	return LDAP_SUCCESS;
+	return rc;
 }
 
 static int

servers/slapd/modrdn.c

@@ -385,6 +385,50 @@ cleanup:;
 	return rs->sr_err;
 }
 
+/* extracted from slap_modrdn2mods() */
+static int
+mod_op_add_val(
+	Operation *op,
+	AttributeDescription * const desc,
+	struct berval * const val,
+	short const sm_op )
+{
+	int rv = LDAP_SUCCESS;
+	Modifications *mod_tmp;
+	mod_tmp = ( Modifications * )ch_malloc( sizeof( Modifications ) );
+	mod_tmp->sml_desc = desc;
+	BER_BVZERO( &mod_tmp->sml_type );
+	mod_tmp->sml_numvals = 1;
+	mod_tmp->sml_values = ( BerVarray )ch_malloc( 2 * sizeof( struct berval ) );
+	ber_dupbv( &mod_tmp->sml_values[0], val );
+	mod_tmp->sml_values[1].bv_val = NULL;
+	if( desc->ad_type->sat_equality && desc->ad_type->sat_equality->smr_normalize) {
+		mod_tmp->sml_nvalues = ( BerVarray )ch_malloc( 2 * sizeof( struct berval ) );
+		rv = desc->ad_type->sat_equality->smr_normalize(
+			SLAP_MR_EQUALITY|SLAP_MR_VALUE_OF_ASSERTION_SYNTAX,
+			desc->ad_type->sat_syntax,
+			desc->ad_type->sat_equality,
+			&mod_tmp->sml_values[0],
+			&mod_tmp->sml_nvalues[0], NULL );
+		if (rv != LDAP_SUCCESS) {
+			ch_free(mod_tmp->sml_nvalues);
+			ch_free(mod_tmp->sml_values[0].bv_val);
+			ch_free(mod_tmp->sml_values);
+			ch_free(mod_tmp);
+			goto done;
+		}
+		mod_tmp->sml_nvalues[1].bv_val = NULL;
+	} else {
+		mod_tmp->sml_nvalues = NULL;
+	}
+	mod_tmp->sml_op = sm_op;
+	mod_tmp->sml_flags = 0;
+	mod_tmp->sml_next = op->orr_modlist;
+	op->orr_modlist = mod_tmp;
+done:
+	return rv;
+}
+
 int
 slap_modrdn2mods(
 	Operation	*op,
@@ -427,7 +471,6 @@ slap_modrdn2mods(
 	/* Add new attribute values to the entry */
 	for ( a_cnt = 0; new_rdn[a_cnt]; a_cnt++ ) {
 		AttributeDescription	*desc = NULL;
-		Modifications 		*mod_tmp;
 
 		rs->sr_err = slap_bv2ad( &new_rdn[a_cnt]->la_attr, &desc, &rs->sr_text );
 
@@ -452,43 +495,15 @@ slap_modrdn2mods(
 		}
 
 		/* Apply modification */
-		mod_tmp = ( Modifications * )ch_malloc( sizeof( Modifications ) );
-		mod_tmp->sml_desc = desc;
-		BER_BVZERO( &mod_tmp->sml_type );
-		mod_tmp->sml_numvals = 1;
-		mod_tmp->sml_values = ( BerVarray )ch_malloc( 2 * sizeof( struct berval ) );
-		ber_dupbv( &mod_tmp->sml_values[0], &new_rdn[a_cnt]->la_value );
-		mod_tmp->sml_values[1].bv_val = NULL;
-		if( desc->ad_type->sat_equality->smr_normalize) {
-			mod_tmp->sml_nvalues = ( BerVarray )ch_malloc( 2 * sizeof( struct berval ) );
-			rs->sr_err = desc->ad_type->sat_equality->smr_normalize(
+		rs->sr_err = mod_op_add_val( op, desc, &new_rdn[a_cnt]->la_value, SLAP_MOD_SOFTADD );
+		if (rs->sr_err != LDAP_SUCCESS)
+			goto done;