diff --git a/CHANGES b/CHANGES index 7229afe7eb06189d8f27a263739054e92a0279a4..f4048642f7acf62f2cd2e39bc27221e100014d6a 100644 --- a/CHANGES +++ b/CHANGES @@ -2,6 +2,7 @@ OpenLDAP 2.4 Change Log OpenLDAP 2.4.15 Engineering Fixed slapd corrupt contextCSN (ITS#5947) + Fixed slapo-rwm objectClass preservation (ITS#5760) OpenLDAP 2.4.14 Release (2009/02/14) Added libldap option to disable SASL host canonicalization (ITS#5812) diff --git a/include/ldap.h b/include/ldap.h index 19e25fb7a7c2824396586efa23622248b071d5e2..17f48982fafcd9325b6607afdcdc1f682b8333a2 100644 --- a/include/ldap.h +++ b/include/ldap.h @@ -1345,6 +1345,22 @@ ldap_perror LDAP_P(( /* deprecated, use ldap_err2string */ #endif +/* + * gssapi.c: + */ +LDAP_F( int ) +ldap_gssapi_bind LDAP_P(( + LDAP *ld, + LDAP_CONST char *dn, + LDAP_CONST char *creds )); + +LDAP_F( int ) +ldap_gssapi_bind_s LDAP_P(( + LDAP *ld, + LDAP_CONST char *dn, + LDAP_CONST char *creds )); + + /* * in modify.c: */ diff --git a/include/ldap_pvt.h b/include/ldap_pvt.h index a75bc3edd5b55da8a5668d695616d421bad950bd..49138125636c5125f68f24ca706c6612606e48b7 100644 --- a/include/ldap_pvt.h +++ b/include/ldap_pvt.h @@ -286,6 +286,11 @@ LDAP_F (int) ldap_open_internal_connection LDAP_P(( LDAP_F (int) ldap_init_fd LDAP_P(( ber_socket_t fd, int proto, LDAP_CONST char *url, struct ldap **ldp )); +/* sasl.c */ +LDAP_F (int) ldap_pvt_sasl_generic_install LDAP_P(( Sockbuf *sb, + struct sb_sasl_generic_install *install_arg )); +LDAP_F (void) ldap_pvt_sasl_generic_remove LDAP_P(( Sockbuf *sb )); + /* search.c */ LDAP_F( int ) ldap_pvt_put_filter LDAP_P(( BerElement *ber, diff --git a/servers/slapd/ad.c b/servers/slapd/ad.c index e1dab72b3e9c67fb118c453743add7c11ba270b0..c881612799f6492f5782efa83204fb7df14e71ed 100644 --- a/servers/slapd/ad.c +++ b/servers/slapd/ad.c @@ -27,6 +27,10 @@ #include "slap.h" #include "lutil.h" +static struct berval bv_no_attrs = BER_BVC( LDAP_NO_ATTRS ); +static struct berval bv_all_user_attrs = BER_BVC( "*" ); +static struct berval bv_all_operational_attrs = BER_BVC( "+" ); + static AttributeName anlist_no_attrs[] = { { BER_BVC( LDAP_NO_ATTRS ), NULL, 0, NULL }, { BER_BVNULL, NULL, 0, NULL } @@ -53,6 +57,10 @@ AttributeName *slap_anlist_all_user_attributes = anlist_all_user_attributes; AttributeName *slap_anlist_all_operational_attributes = anlist_all_operational_attributes; AttributeName *slap_anlist_all_attributes = anlist_all_attributes; +struct berval * slap_bv_no_attrs = &bv_no_attrs; +struct berval * slap_bv_all_user_attrs = &bv_all_user_attrs; +struct berval * slap_bv_all_operational_attrs = &bv_all_operational_attrs; + typedef struct Attr_option { struct berval name; /* option name or prefix */ int prefix; /* NAME is a tag and range prefix */ diff --git a/servers/slapd/back-meta/back-meta.h b/servers/slapd/back-meta/back-meta.h index 2eb1e05e51531f24e9c93711276c8a3ad8455e6b..3c0395200e3e62778174fb4f0f5945cf6f27a2ed 100644 --- a/servers/slapd/back-meta/back-meta.h +++ b/servers/slapd/back-meta/back-meta.h @@ -318,6 +318,8 @@ typedef struct metatarget_t { #define META_BACK_TGT_NOREFS(mt) META_BACK_TGT_ISSET( (mt), LDAP_BACK_F_NOREFS ) #define META_BACK_TGT_NOUNDEFFILTER(mt) META_BACK_TGT_ISSET( (mt), LDAP_BACK_F_NOUNDEFFILTER ) + slap_mask_t mt_rep_flags; + int mt_version; time_t mt_network_timeout; struct timeval mt_bind_timeout; diff --git a/servers/slapd/back-meta/init.c b/servers/slapd/back-meta/init.c index ab9df5687be2730d564b0ce2830640fc8c7241b9..f5cb37935c25e4bfd6a14b719755dcb528ccc800 100644 --- a/servers/slapd/back-meta/init.c +++ b/servers/slapd/back-meta/init.c @@ -170,6 +170,8 @@ meta_back_db_open( slap_bindconf sb = { BER_BVNULL }; metatarget_t *mt = mi->mi_targets[ i ]; + struct berval mapped; + ber_str2bv( mt->mt_uri, 0, 0, &sb.sb_uri ); sb.sb_version = mt->mt_version; sb.sb_method = LDAP_AUTH_SIMPLE; @@ -224,6 +226,22 @@ meta_back_db_open( not_always_anon_non_prescriptive = 1; } } + + BER_BVZERO( &mapped ); + ldap_back_map( &mt->mt_rwmap.rwm_at, + &slap_schema.si_ad_entryDN->ad_cname, &mapped, + BACKLDAP_REMAP ); + if ( BER_BVISNULL( &mapped ) || mapped.bv_val[0] == '\0' ) { + mt->mt_rep_flags |= REP_NO_ENTRYDN; + } + + BER_BVZERO( &mapped ); + ldap_back_map( &mt->mt_rwmap.rwm_at, + &slap_schema.si_ad_subschemaSubentry->ad_cname, &mapped, + BACKLDAP_REMAP ); + if ( BER_BVISNULL( &mapped ) || mapped.bv_val[0] == '\0' ) { + mt->mt_rep_flags |= REP_NO_SUBSCHEMA; + } } if ( not_always == 0 ) { diff --git a/servers/slapd/back-meta/map.c b/servers/slapd/back-meta/map.c index 4ceaebd1743f3e74a2b622ee369d9d082eb35ff9..9044c1ffc748295776414d8667ca5241f95796a9 100644 --- a/servers/slapd/back-meta/map.c +++ b/servers/slapd/back-meta/map.c @@ -119,6 +119,15 @@ ldap_back_mapping ( struct ldapmap *map, struct berval *s, struct ldapmapping ** assert( m != NULL ); + /* let special attrnames slip through (ITS#5760) */ + if ( bvmatch( s, slap_bv_no_attrs ) + || bvmatch( s, slap_bv_all_user_attrs ) + || bvmatch( s, slap_bv_all_operational_attrs ) ) + { + *m = NULL; + return 0; + } + if ( remap == BACKLDAP_REMAP ) { tree = map->remap; @@ -140,6 +149,7 @@ ldap_back_map ( struct ldapmap *map, struct berval *s, struct berval *bv, int remap ) { struct ldapmapping *mapping; + int drop_missing; /* map->map may be NULL when mapping is configured, * but map->remap can't */ @@ -149,7 +159,7 @@ ldap_back_map ( struct ldapmap *map, struct berval *s, struct berval *bv, } BER_BVZERO( bv ); - ( void )ldap_back_mapping( map, s, &mapping, remap ); + drop_missing = ldap_back_mapping( map, s, &mapping, remap ); if ( mapping != NULL ) { if ( !BER_BVISNULL( &mapping->dst ) ) { *bv = mapping->dst; @@ -157,7 +167,7 @@ ldap_back_map ( struct ldapmap *map, struct berval *s, struct berval *bv, return; } - if ( !map->drop_missing ) { + if ( !drop_missing ) { *bv = *s; } } diff --git a/servers/slapd/back-meta/search.c b/servers/slapd/back-meta/search.c index ff723aecc0ddac4ef4ed78ad07483056f8b90d7d..27bac0e438b02466fbaa007577ffbebac740a4bd 100644 --- a/servers/slapd/back-meta/search.c +++ b/servers/slapd/back-meta/search.c @@ -2147,7 +2147,7 @@ next_attr:; rs->sr_entry = &ent; rs->sr_attrs = op->ors_attrs; rs->sr_operational_attrs = NULL; - rs->sr_flags = 0; + rs->sr_flags = mi->mi_targets[ target ]->mt_rep_flags; rs->sr_err = LDAP_SUCCESS; rc = send_search_entry( op, rs ); switch ( rc ) { diff --git a/servers/slapd/back-sql/entry-id.c b/servers/slapd/back-sql/entry-id.c index 5ad9eb874b1ca595861d45d97075bc9b38c8c2fe..e1351b996728e409c3ebb679c34a7a3844c2fb2e 100644 --- a/servers/slapd/back-sql/entry-id.c +++ b/servers/slapd/back-sql/entry-id.c @@ -1042,7 +1042,7 @@ next:; } if ( ( bsi->bsi_flags & BSQL_SF_ALL_OPER ) - || an_find( bsi->bsi_attrs, &AllOper ) + || an_find( bsi->bsi_attrs, slap_bv_all_operational_attrs ) || an_find( bsi->bsi_attrs, &slap_schema.si_ad_structuralObjectClass->ad_cname ) ) { ObjectClass *soc = NULL; diff --git a/servers/slapd/back-sql/search.c b/servers/slapd/back-sql/search.c index 1f8cbb3f6d1dc987251f777090f8f942df52a7c7..a65ffcf027388734073696f83078dd9a92eb739f 100644 --- a/servers/slapd/back-sql/search.c +++ b/servers/slapd/back-sql/search.c @@ -184,7 +184,7 @@ backsql_init_search( BER_BVZERO( &bsi->bsi_attrs[ 0 ].an_name ); for ( p = attrs; !BER_BVISNULL( &p->an_name ); p++ ) { - if ( BACKSQL_NCMP( &p->an_name, &AllUser ) == 0 ) { + if ( BACKSQL_NCMP( &p->an_name, slap_bv_all_user_attrs ) == 0 ) { /* handle "*" */ bsi->bsi_flags |= BSQL_SF_ALL_USER; @@ -198,7 +198,7 @@ backsql_init_search( } continue; - } else if ( BACKSQL_NCMP( &p->an_name, &AllOper ) == 0 ) { + } else if ( BACKSQL_NCMP( &p->an_name, slap_bv_all_operational_attrs ) == 0 ) { /* handle "+" */ bsi->bsi_flags |= BSQL_SF_ALL_OPER; @@ -212,7 +212,7 @@ backsql_init_search( } continue; - } else if ( BACKSQL_NCMP( &p->an_name, &NoAttrs ) == 0 ) { + } else if ( BACKSQL_NCMP( &p->an_name, slap_bv_no_attrs ) == 0 ) { /* ignore "1.1" */ continue; @@ -237,7 +237,7 @@ backsql_init_search( /* use hints if available */ for ( p = bi->sql_anlist; !BER_BVISNULL( &p->an_name ); p++ ) { - if ( BACKSQL_NCMP( &p->an_name, &AllUser ) == 0 ) { + if ( BACKSQL_NCMP( &p->an_name, slap_bv_all_user_attrs ) == 0 ) { /* handle "*" */ bsi->bsi_flags |= BSQL_SF_ALL_USER; @@ -251,7 +251,7 @@ backsql_init_search( } continue; - } else if ( BACKSQL_NCMP( &p->an_name, &AllOper ) == 0 ) { + } else if ( BACKSQL_NCMP( &p->an_name, slap_bv_all_operational_attrs ) == 0 ) { /* handle "+" */ bsi->bsi_flags |= BSQL_SF_ALL_OPER; diff --git a/servers/slapd/init.c b/servers/slapd/init.c index 27734d4bd9d1174f9a99fcecc96e4020435eb07d..ae15d0515a099ef5b145cbec94f6adf9d428017a 100644 --- a/servers/slapd/init.c +++ b/servers/slapd/init.c @@ -55,10 +55,6 @@ int ldap_syslog_level = LOG_DEBUG; BerVarray default_referral = NULL; -struct berval AllUser = BER_BVC( LDAP_ALL_USER_ATTRIBUTES ); -struct berval AllOper = BER_BVC( LDAP_ALL_OPERATIONAL_ATTRIBUTES ); -struct berval NoAttrs = BER_BVC( LDAP_NO_ATTRS ); - /* * global variables that need mutex protection */ diff --git a/servers/slapd/overlays/dynlist.c b/servers/slapd/overlays/dynlist.c index 1210b6582a61d67de7eac416cd27328711fe3854..736e641a471c3f48f248447da7d061eadca5763f 100644 --- a/servers/slapd/overlays/dynlist.c +++ b/servers/slapd/overlays/dynlist.c @@ -266,8 +266,8 @@ dynlist_sc_update( Operation *op, SlapReply *rs ) } #ifndef SLAP_OPATTRS - opattrs = ( rs->sr_attrs == NULL ) ? 0 : an_find( rs->sr_attrs, &AllOper ); - userattrs = ( rs->sr_attrs == NULL ) ? 1 : an_find( rs->sr_attrs, &AllUser ); + opattrs = ( rs->sr_attrs == NULL ) ? 0 : an_find( rs->sr_attrs, slap_bv_operational_attrs ); + userattrs = ( rs->sr_attrs == NULL ) ? 1 : an_find( rs->sr_attrs, slap_bv_user_attrs ); #else /* SLAP_OPATTRS */ opattrs = SLAP_OPATTRS( rs->sr_attr_flags ); userattrs = SLAP_USERATTRS( rs->sr_attr_flags ); @@ -416,8 +416,8 @@ dynlist_prepare_entry( Operation *op, SlapReply *rs, dynlist_info_t *dli ) } #ifndef SLAP_OPATTRS - opattrs = ( rs->sr_attrs == NULL ) ? 0 : an_find( rs->sr_attrs, &AllOper ); - userattrs = ( rs->sr_attrs == NULL ) ? 1 : an_find( rs->sr_attrs, &AllUser ); + opattrs = ( rs->sr_attrs == NULL ) ? 0 : an_find( rs->sr_attrs, slap_bv_operational_attrs ); + userattrs = ( rs->sr_attrs == NULL ) ? 1 : an_find( rs->sr_attrs, slap_bv_user_attrs ); #else /* SLAP_OPATTRS */ opattrs = SLAP_OPATTRS( rs->sr_attr_flags ); userattrs = SLAP_USERATTRS( rs->sr_attr_flags ); diff --git a/servers/slapd/overlays/pcache.c b/servers/slapd/overlays/pcache.c index 235d0f9c2aa006ee20f913f03032299b49450bb2..3f317cfc0ce91cf40cfb7ec7d41b30f3677b6a66 100644 --- a/servers/slapd/overlays/pcache.c +++ b/servers/slapd/overlays/pcache.c @@ -2168,8 +2168,8 @@ add_filter_attrs( (*new_attrs)[i].an_desc = attrs->attrs[i].an_desc; } BER_BVZERO( &(*new_attrs)[i].an_name ); - alluser = an_find(*new_attrs, &AllUser); - allop = an_find(*new_attrs, &AllOper); + alluser = an_find( *new_attrs, slap_bv_all_user_attrs ); + allop = an_find( *new_attrs, slap_bv_all_operational_attrs ); j = i; for ( i=0; i<fattr_cnt; i++ ) { diff --git a/servers/slapd/overlays/rwm.c b/servers/slapd/overlays/rwm.c index b07b7e18a4d056f660c12582f3f97ea4dee55885..f0d93ed27ab5410e268d7587f4305a17314335b6 100644 --- a/servers/slapd/overlays/rwm.c +++ b/servers/slapd/overlays/rwm.c @@ -1197,76 +1197,70 @@ rwm_attrs( Operation *op, SlapReply *rs, Attribute** a_first, int stripEntryDN ) int last = -1; Attribute *a; - if ( SLAP_OPATTRS( rs->sr_attr_flags ) && is_at_operational( (*ap)->a_desc->ad_type ) ) + if ( op->ors_attrs != NULL && + !SLAP_USERATTRS( rs->sr_attr_flags ) && + !ad_inlist( (*ap)->a_desc, op->ors_attrs ) ) { - /* go on */ ; - - } else { - if ( op->ors_attrs != NULL && - !SLAP_USERATTRS( rs->sr_attr_flags ) && - !ad_inlist( (*ap)->a_desc, op->ors_attrs ) ) - { - goto cleanup_attr; - } + goto cleanup_attr; + } - drop_missing = rwm_mapping( &rwmap->rwm_at, - &(*ap)->a_desc->ad_cname, &mapping, RWM_REMAP ); - if ( drop_missing || ( mapping != NULL && BER_BVISEMPTY( &mapping->m_dst ) ) ) - { - goto cleanup_attr; - } - if ( mapping != NULL ) { - assert( mapping->m_dst_ad != NULL ); + drop_missing = rwm_mapping( &rwmap->rwm_at, + &(*ap)->a_desc->ad_cname, &mapping, RWM_REMAP ); + if ( drop_missing || ( mapping != NULL && BER_BVISEMPTY( &mapping->m_dst ) ) ) + { + goto cleanup_attr; + } + if ( mapping != NULL ) { + assert( mapping->m_dst_ad != NULL ); - /* try to normalize mapped Attributes if the original - * AttributeType was not normalized */ - if ( (!(*ap)->a_desc->ad_type->sat_equality || - !(*ap)->a_desc->ad_type->sat_equality->smr_normalize) && - mapping->m_dst_ad->ad_type->sat_equality && - mapping->m_dst_ad->ad_type->sat_equality->smr_normalize ) + /* try to normalize mapped Attributes if the original + * AttributeType was not normalized */ + if ( (!(*ap)->a_desc->ad_type->sat_equality || + !(*ap)->a_desc->ad_type->sat_equality->smr_normalize) && + mapping->m_dst_ad->ad_type->sat_equality && + mapping->m_dst_ad->ad_type->sat_equality->smr_normalize ) + { + if ((rwmap->rwm_flags & RWM_F_NORMALIZE_MAPPED_ATTRS)) { - if ((rwmap->rwm_flags & RWM_F_NORMALIZE_MAPPED_ATTRS)) + int i = 0; + + last = (*ap)->a_numvals; + if ( last ) { - int i = 0; - - last = (*ap)->a_numvals; - if ( last ) - { - (*ap)->a_nvals = ch_malloc( (last+1) * sizeof(struct berval) ); - - for ( i = 0; !BER_BVISNULL( &(*ap)->a_vals[i]); i++ ) { - int rc; - /* - * check that each value is valid per syntax - * and pretty if appropriate - */ - rc = mapping->m_dst_ad->ad_type->sat_equality->smr_normalize( - SLAP_MR_VALUE_OF_ATTRIBUTE_SYNTAX, - mapping->m_dst_ad->ad_type->sat_syntax, - mapping->m_dst_ad->ad_type->sat_equality, - &(*ap)->a_vals[i], &(*ap)->a_nvals[i], - NULL ); - - if ( rc != LDAP_SUCCESS ) { - BER_BVZERO( &(*ap)->a_nvals[i] ); - } + (*ap)->a_nvals = ch_malloc( (last+1) * sizeof(struct berval) ); + + for ( i = 0; !BER_BVISNULL( &(*ap)->a_vals[i]); i++ ) { + int rc; + /* + * check that each value is valid per syntax + * and pretty if appropriate + */ + rc = mapping->m_dst_ad->ad_type->sat_equality->smr_normalize( + SLAP_MR_VALUE_OF_ATTRIBUTE_SYNTAX, + mapping->m_dst_ad->ad_type->sat_syntax, + mapping->m_dst_ad->ad_type->sat_equality, + &(*ap)->a_vals[i], &(*ap)->a_nvals[i], + NULL ); + + if ( rc != LDAP_SUCCESS ) { + BER_BVZERO( &(*ap)->a_nvals[i] ); } - BER_BVZERO( &(*ap)->a_nvals[i] ); } - - } else { - assert( (*ap)->a_nvals == (*ap)->a_vals ); - (*ap)->a_nvals = NULL; - ber_bvarray_dup_x( &(*ap)->a_nvals, (*ap)->a_vals, NULL ); + BER_BVZERO( &(*ap)->a_nvals[i] ); } + + } else { + assert( (*ap)->a_nvals == (*ap)->a_vals ); + (*ap)->a_nvals = NULL; + ber_bvarray_dup_x( &(*ap)->a_nvals, (*ap)->a_vals, NULL ); } + } - /* rewrite the attribute description */ - (*ap)->a_desc = mapping->m_dst_ad; + /* rewrite the attribute description */ + (*ap)->a_desc = mapping->m_dst_ad; - /* will need to check for duplicate attrs */ - check_duplicate_attrs++; - } + /* will need to check for duplicate attrs */ + check_duplicate_attrs++; } if ( (*ap)->a_desc == slap_schema.si_ad_entryDN ) { @@ -1951,7 +1945,7 @@ static int rwm_bva_rewrite_add( struct ldaprwmap *rwmap, int idx, - const char *argv[] ) + char **argv ) { char *line; struct berval bv; diff --git a/servers/slapd/overlays/rwmmap.c b/servers/slapd/overlays/rwmmap.c index 67655c3068e95187125da1c7d33e56faccf48eaf..95eec2f92229c7e92ca114740b7b5fca98773546 100644 --- a/servers/slapd/overlays/rwmmap.c +++ b/servers/slapd/overlays/rwmmap.c @@ -121,6 +121,15 @@ rwm_mapping( struct ldapmap *map, struct berval *s, struct ldapmapping **m, int assert( m != NULL ); + /* let special attrnames slip through (ITS#5760) */ + if ( bvmatch( s, slap_bv_no_attrs ) + || bvmatch( s, slap_bv_all_user_attrs ) + || bvmatch( s, slap_bv_all_operational_attrs ) ) + { + *m = NULL; + return 0; + } + if ( remap == RWM_REMAP ) { tree = map->remap; @@ -312,7 +321,7 @@ rwm_map_attrnames( if ( j == 0 && i != 0 ) { memset( &(*anp)[0], 0, sizeof( AttributeName ) ); - BER_BVSTR( &(*anp)[0].an_name, LDAP_NO_ATTRS ); + (*anp)[0].an_name = *slap_bv_no_attrs; j = 1; } memset( &(*anp)[j], 0, sizeof( AttributeName ) ); diff --git a/servers/slapd/proto-slap.h b/servers/slapd/proto-slap.h index f6a3478c7cb006b97b8f787c0e04bed41afc78e0..3b2899b68ca4033e098c7e94ccb69ccd5b162b98 100644 --- a/servers/slapd/proto-slap.h +++ b/servers/slapd/proto-slap.h @@ -191,6 +191,15 @@ LDAP_SLAPD_V( AttributeName * ) slap_anlist_all_user_attributes; LDAP_SLAPD_V( AttributeName * ) slap_anlist_all_operational_attributes; LDAP_SLAPD_V( AttributeName * ) slap_anlist_all_attributes; +LDAP_SLAPD_V( struct berval * ) slap_bv_no_attrs; +LDAP_SLAPD_V( struct berval * ) slap_bv_all_user_attrs; +LDAP_SLAPD_V( struct berval * ) slap_bv_all_operational_attrs; + +/* deprecated; only defined for backward compatibility */ +#define NoAttrs (*slap_bv_no_attrs) +#define AllUser (*slap_bv_all_user_attrs) +#define AllOper (*slap_bv_all_operational_attrs) + /* * add.c */ @@ -1954,10 +1963,6 @@ LDAP_SLAPD_V (ber_socket_t) dtblsize; LDAP_SLAPD_V (int) use_reverse_lookup; -LDAP_SLAPD_V (struct berval) AllUser; -LDAP_SLAPD_V (struct berval) AllOper; -LDAP_SLAPD_V (struct berval) NoAttrs; - /* * operations */ diff --git a/servers/slapd/result.c b/servers/slapd/result.c index 9dc2dd5362086c82ba8f33938c6784d1fd3ab0b0..0756260de04ab20c39dbb424b25379e2748c2ef1 100644 --- a/servers/slapd/result.c +++ b/servers/slapd/result.c @@ -1656,9 +1656,9 @@ slap_attr_flags( AttributeName *an ) flags |= ( SLAP_OPATTRS_NO | SLAP_USERATTRS_YES ); } else { - flags |= an_find( an, &AllOper ) + flags |= an_find( an, slap_bv_all_operational_attrs ) ? SLAP_OPATTRS_YES : SLAP_OPATTRS_NO; - flags |= an_find( an, &AllUser ) + flags |= an_find( an, slap_bv_all_user_attrs ) ? SLAP_USERATTRS_YES : SLAP_USERATTRS_NO; }