Resync with HEAD

doc/man/man3/ldap_schema.3

+.TH LDAP_SCHEMA 3 "4 June 2000" "OpenLDAP LDVERSION"
+.\" $OpenLDAP$
+.\" Copyright 2000-2002 The OpenLDAP Foundation All Rights Reserved.
+.\" Copying restrictions apply.  See COPYRIGHT/LICENSE.
+.SH NAME
+ldap_str2syntax, ldap_syntax2str, ldap_syntax2name, ldap_syntax_free,
+ldap_str2matchingrule, ldap_matchingrule2str, ldap_matchingrule2name,
+ldap_matchingrule_free,
+ldap_str2attributetype, ldap_attributetype2str,
+ldap_attributetype2name, ldap_attributetype_free,
+ldap_str2objectclass, ldap_objectclass2str, ldap_objectclass2name,
+ldap_objectclass_free,
+ldap_scherr2str \- Schema definition handling routines
+.SH SYNOPSIS
+.nf
+.ft B
+#include <ldap.h>
+#include <ldap_schema.h>
+.LP
+.ft B
+LDAPSyntax * ldap_str2syntax(s, code, errp, flags)
+.ft
+const char * s;
+int * code;
+const char ** errp;
+const int flags;
+.LP
+.ft B
+char * ldap_syntax2str(syn)
+.ft
+const LDAPSyntax * syn;
+.LP
+.ft B
+const char * ldap_syntax2name(syn)
+.ft
+LDAPSyntax * syn;
+.LP
+.ft B
+ldap_syntax_free(syn)
+.ft
+LDAPSyntax * syn;
+.LP
+.ft B
+LDAPMatchingRule * ldap_str2matchingrule(s, code, errp, flags)
+.ft
+const char * s;
+int * code;
+const char ** errp;
+const int flags;
+.LP
+.ft B
+char * ldap_matchingrule2str(mr);
+.ft
+const LDAPMatchingRule * mr;
+.LP
+.ft B
+const char * ldap_matchingrule2name(mr)
+.ft
+LDAPMatchingRule * mr;
+.LP
+.ft B
+ldap_matchingrule_free(mr)
+.ft
+LDAPMatchingRule * mr;
+.LP
+.ft B
+LDAPAttributeType * ldap_str2attributetype(s, code, errp, flags)
+.ft
+const char * s;
+int * code;
+const char ** errp;
+const int flags;
+.LP
+.ft B
+char * ldap_attributetype2str(at)
+.ft
+const LDAPAttributeType * at;
+.LP
+.ft B
+const char * ldap_attributetype2name(at)
+.ft
+LDAPAttributeType * at;
+.LP
+.ft B
+ldap_attributetype_free(at)
+.ft
+LDAPAttributeType * at;
+.LP
+.ft B
+LDAPObjectClass * ldap_str2objectclass(s, code, errp, flags)
+.ft
+const char * s;
+int * code;
+const char ** errp;
+const int flags;
+.LP
+.ft B
+char * ldap_objectclass2str(oc)
+.ft
+const LDAPObjectClass * oc;
+.LP
+.ft B
+const char * ldap_objectclass2name(oc)
+.ft
+LDAPObjectClass * oc;
+.LP
+.ft B
+ldap_objectclass_free(oc)
+.ft
+LDAPObjectClass * oc;
+.LP
+.ft B
+char * ldap_scherr2str(code)
+.ft
+int code;
+.SH DESCRIPTION
+These routines are used to parse schema definitions in the syntax
+defined in RFC 2252 into structs and handle these structs.  These
+routines handle four kinds of definitions: syntaxes, matching rules,
+attribute types and objectclasses.  For each definition kind, four
+routines are provided.
+.LP
+.B ldap_str2xxx()
+takes a definition in RFC 2252 format in argument
+.IR s
+as a NUL-terminated string and returns, if possible, a pointer to a
+newly allocated struct of the appropriate kind.  The caller is
+responsible for freeing the struct by calling
+.B ldap_xxx_free()
+when not needed any longer.  The routine returns NULL if some problem
+happened.  In this case, the integer pointed at by argument
+.IR code
+will receive an error code (see below the description of
+.B ldap_scherr2str()
+for an explanation of the values) and a pointer to a NUL-terminated
+string will be placed where requested by argument
+.IR errp
+, indicating where in argument
+.IR s
+the error happened, so it must not be freed by the caller.  Argument
+.IR flags
+is a bit mask of parsing options controlling the relaxation of the
+syntax recognized.  The following values are defined:
+.TP
+.B LDAP_SCHEMA_ALLOW_NONE
+strict parsing according to RFC 2252.
+.TP
+.B LDAP_SCHEMA_ALLOW_NO_OID
+permit definitions that do not contain an initial OID.
+.TP
+.B LDAP_SCHEMA_ALLOW_QUOTED
+permit quotes around some items that should not have them.
+.TP
+.B LDAP_SCHEMA_ALLOW_DESCR
+permit a
+.B descr
+instead of a numeric OID in places where the syntax expect the latter.
+.TP
+.B LDAP_SCHEMA_ALLOW_DESCR_PREFIX
+permit that the initial numeric OID contains a prefix in
+.B descr
+format.
+.TP
+.B LDAP_SCHEMA_ALLOW_ALL
+be very liberal, include all options.
+.LP
+The structures returned are as follows:
+.sp
+.RS
+.nf
+.ne 7
+.ta 8n 16n 32n
+typedef struct ldap_schema_extension_item {
+	char *lsei_name;	/* Extension name */
+	char **lsei_values;	/* Extension values */
+} LDAPSchemaExtensionItem;
+
+typedef struct ldap_syntax {
+	char *syn_oid;		/* OID */
+	char **syn_names;	/* Names */
+	char *syn_desc;		/* Description */
+	LDAPSchemaExtensionItem **syn_extensions; /* Extension */
+} LDAPSyntax;
+
+typedef struct ldap_matchingrule {
+	char *mr_oid;		/* OID */
+	char **mr_names;	/* Names */
+	char *mr_desc;		/* Description */
+	int  mr_obsolete;	/* Is obsolete? */
+	char *mr_syntax_oid;	/* Syntax of asserted values */
+	LDAPSchemaExtensionItem **mr_extensions; /* Extensions */
+} LDAPMatchingRule;
+
+typedef struct ldap_attributetype {
+	char *at_oid;		/* OID */
+	char **at_names;	/* Names */
+	char *at_desc;		/* Description */
+	int  at_obsolete;	/* Is obsolete? */
+	char *at_sup_oid;	/* OID of superior type */
+	char *at_equality_oid;	/* OID of equality matching rule */
+	char *at_ordering_oid;	/* OID of ordering matching rule */
+	char *at_substr_oid;	/* OID of substrings matching rule */
+	char *at_syntax_oid;	/* OID of syntax of values */
+	int  at_syntax_len;	/* Suggested minimum maximum length */
+	int  at_single_value;	/* Is single-valued?  */
+	int  at_collective;	/* Is collective? */
+	int  at_no_user_mod;	/* Are changes forbidden through LDAP? */
+	int  at_usage;		/* Usage, see below */
+	LDAPSchemaExtensionItem **at_extensions; /* Extensions */
+} LDAPAttributeType;
+
+typedef struct ldap_objectclass {
+	char *oc_oid;		/* OID */
+	char **oc_names;	/* Names */
+	char *oc_desc;		/* Description */
+	int  oc_obsolete;	/* Is obsolete? */
+	char **oc_sup_oids;	/* OIDs of superior classes */
+	int  oc_kind;		/* Kind, see below */
+	char **oc_at_oids_must;	/* OIDs of required attribute types */
+	char **oc_at_oids_may;	/* OIDs of optional attribute types */
+	LDAPSchemaExtensionItem **oc_extensions; /* Extensions */
+} LDAPObjectClass;
+.ta
+.fi
+.RE
+.PP
+Some integer fields (those described with a question mark) have a
+truth value, for these fields the possible values are:
+.TP
+.B LDAP_SCHEMA_NO
+The answer to the question is no.
+.TP
+.B LDAP_SCHEMA_YES
+The answer to the question is yes.
+.LP
+For attribute types, the following usages are possible:
+.TP
+.B LDAP_SCHEMA_USER_APPLICATIONS
+the attribute type is non-operational.
+.TP
+.B LDAP_SCHEMA_DIRECTORY_OPERATION
+the attribute type is operational and is pertinent to the directory
+itself, i.e. it has the same value on all servers that master the
+entry containing this attribute type.
+.TP
+.B LDAP_SCHEMA_DISTRIBUTED_OPERATION
+the attribute type is operational and is pertinent to replication,
+shadowing or other distributed directory aspect.  TBC.
+.TP
+.B LDAP_SCHEMA_DSA_OPERATION
+the attribute type is operational and is pertinent to the directory
+server itself, i.e. it may have different values for the same entry
+when retrieved from different servers that master the entry.
+.LP
+Object classes can be of three kinds:
+.TP
+.B LDAP_SCHEMA_ABSTRACT
+the object class is abstract, i.e. there cannot be entries of this
+class alone.
+.TP
+.B LDAP_SCHEMA_STRUCTURAL
+the object class is structural, i.e. it describes the main role of the
+entry.  On some servers, once the entry is created the set of
+structural object classes assigned cannot be changed: none of those
+present can be removed and none other can be added.
+.TP
+.B LDAP_SCHEMA_AUXILIARY
+the object class is auxiliary, i.e. it is intended to go with other,
+structural, object classes.  These can be added or removed at any time
+if attribute types are added or removed at the same time as needed by
+the set of object classes resulting from the operation.
+.LP
+Routines
+.B ldap_xxx2name()
+return a canonical name for the definition.
+.LP
+Routines
+.B ldap_xxx2str()
+return a string representation in the format described by RFC 2252 of
+the struct passed in the argument.  The string is a newly allocated
+string that must be freed by the caller.  These routines may return
+NULL if no memory can be allocated for the string.
+.LP
+.B ldap_scherr2str()
+returns a NUL-terminated string with a text description of the error
+found.  This is a pointer to a static area, so it must not be freed by
+the caller.  The argument
+.IR code
+comes from one of the parsing routines and can adopt the following
+values:
+.TP
+.B LDAP_SCHERR_OUTOFMEM
+Out of memory.
+.TP
+.B LDAP_SCHERR_UNEXPTOKEN
+Unexpected token.
+.TP
+.B LDAP_SCHERR_NOLEFTPAREN
+Missing opening parenthesis.
+.TP
+.B LDAP_SCHERR_NORIGHTPAREN
+Missing closing parenthesis.
+.TP
+.B LDAP_SCHERR_NODIGIT
+Expecting digit.
+.TP
+.B LDAP_SCHERR_BADNAME
+Expecting a name.
+.TP
+.B LDAP_SCHERR_BADDESC
+Bad description.
+.TP
+.B LDAP_SCHERR_BADSUP
+Bad superiors.
+.TP
+.B LDAP_SCHERR_DUPOPT
+Duplicate option.
+.TP
+.B LDAP_SCHERR_EMPTY
+Unexpected end of data.
+
+.SH SEE ALSO
+.BR ldap (3),
+.SH ACKNOWLEDGEMENTS
+.B	OpenLDAP
+is developed and maintained by The OpenLDAP Project (http://www.openldap.org/).
+.B	OpenLDAP
+is derived from University of Michigan LDAP 3.3 Release.  
+

doc/man/man8/slapd.8

@@ -6,12 +6,12 @@
 slapd \- Stand-alone LDAP Daemon
 .SH SYNOPSIS
 .B LIBEXECDIR/slapd 
+.B [\-d debug\-level]
 .B [\-f slapd\-config\-file]
 .B [\-h URLs]
-.B [\-d debug\-level]
 .B [\-n service\-name] [\-s syslog\-level] [\-l syslog\-local\-user]
 .B [\-r directory]
-.B [\-u user] [\-g group]
+.B [\-u user] [\-g group] [\-t]
 .B 
 .SH DESCRIPTION
 .LP
@@ -144,6 +144,12 @@ will run with the specified group name or id.
 Note that on some systems, running as a non-privileged user will prevent
 passwd back-ends from accessing the encrypted passwords.  Note also that
 any shell back-ends will run as the specified non-privileged user.
+.TP
+.BI \-t
+.B slapd
+will read the configuration file (the default if none is given with the 
+\fI\-f\fP switch) and check its syntax, without opening any listener 
+or database.
 .SH EXAMPLES
 To start 
 .I slapd
@@ -167,6 +173,14 @@ on voluminous debugging which will be printed on standard error, type:
 .ft
 .fi
 .LP
+To test whether the configuration file is correct or not, type:
+.LP
+.nf
+.ft tt
+	LIBEXECDIR/slapd -t
+.ft
+.fi
+.LP
 .SH "SEE ALSO"
 .BR ldap (3),
 .BR slapd.conf (5),

libraries/liblber/bprint.c

@@ -285,7 +285,7 @@ int ber_output_dump(
         
         off = BP_GRAPH + n + ((n >= 8)?1:0);
         
-        if ( isprint( data[i] )) {
+        if ( isprint( (unsigned char) data[i] )) {
             line[ BP_GRAPH + n ] = data[i];
         } else {
             line[ BP_GRAPH + n ] = '.';

libraries/libldap/cyrus.c

@@ -846,7 +846,7 @@ int ldap_pvt_sasl_secprops(
 		} else if( !strncasecmp(props[i],
 			"minssf=", sizeof("minssf")) )
 		{
-			if( isdigit( props[i][sizeof("minssf")] ) ) {
+			if( isdigit( (unsigned char) props[i][sizeof("minssf")] ) ) {
 				got_min_ssf++;
 				min_ssf = atoi( &props[i][sizeof("minssf")] );
 			} else {
@@ -856,7 +856,7 @@ int ldap_pvt_sasl_secprops(
 		} else if( !strncasecmp(props[i],
 			"maxssf=", sizeof("maxssf")) )
 		{
-			if( isdigit( props[i][sizeof("maxssf")] ) ) {
+			if( isdigit( (unsigned char) props[i][sizeof("maxssf")] ) ) {
 				got_max_ssf++;
 				max_ssf = atoi( &props[i][sizeof("maxssf")] );
 			} else {
@@ -866,7 +866,7 @@ int ldap_pvt_sasl_secprops(
 		} else if( !strncasecmp(props[i],
 			"maxbufsize=", sizeof("maxbufsize")) )
 		{
-			if( isdigit( props[i][sizeof("maxbufsize")] ) ) {
+			if( isdigit( (unsigned char) props[i][sizeof("maxbufsize")] ) ) {
 				got_maxbufsize++;
 				maxbufsize = atoi( &props[i][sizeof("maxbufsize")] );
 			} else {

libraries/libldap/result.c

@@ -647,7 +647,8 @@ try_read1msg(
 		{
 			tmpber = *ber;	/* struct copy */
 			if ( v3ref == 1 ) {
-				; /* V3 search reference or V3 referral sucessfully chased */
+				/* V3 search reference or V3 referral successfully chased */
+				refer_cnt = 0;
 			} else if ( ber_scanf( &tmpber, "{iaa}", &lderr,
 			    &lr->lr_res_matched, &lr->lr_res_error )
 			    != LBER_ERROR ) {

libraries/liblunicode/ucstr.c

@@ -167,7 +167,7 @@ struct berval * UTF8bvnormalize(
 		i = 0;
 	}
 
-	p = ucs = (long *) malloc( len * sizeof(*ucs) );
+	p = ucs = malloc( len * sizeof(*ucs) );
 	if ( ucs == NULL ) {
 		free(out);
 		return NULL;
@@ -342,7 +342,7 @@ int UTF8bvnormcmp(
 	 * proper normalized form.
 	 */
 
-	ucs = (long *) malloc( ( ( norm1 || l1 > l2 ) ? l1 : l2 ) * sizeof(*ucs) );
+	ucs = malloc( ( ( norm1 || l1 > l2 ) ? l1 : l2 ) * sizeof(*ucs) );
 	if ( ucs == NULL ) {
 		return l1 > l2 ? 1 : -1; /* what to do??? */
 	}
@@ -365,7 +365,7 @@ int UTF8bvnormcmp(
 	if ( norm1 ) {
 		ucsout1 = ucs;
 		l1 = ulen;
-		ucs = (long *) malloc( l2 * sizeof(*ucs) );
+		ucs = malloc( l2 * sizeof(*ucs) );
 		if ( ucs == NULL ) {
 			return l1 > l2 ? 1 : -1; /* what to do??? */
 		}

libraries/liblutil/passwd.c

@@ -28,7 +28,11 @@
 #endif /* SLAPD_LMHASH */
 
 #ifdef SLAPD_SPASSWD
-#	include <sasl.h>
+#	ifdef HAVE_SASL_SASL_H
+#		include <sasl/sasl.h>
+#	else
+#		include <sasl.h>
+#	endif
 #endif
 
 #ifdef SLAPD_KPASSWD
@@ -659,14 +663,18 @@ static int chk_sasl(
 
 #ifdef HAVE_CYRUS_SASL
 	if( lutil_passwd_sasl_conn != NULL ) {
-		const char *errstr = NULL;
 		int sc;
-
+# if SASL_VERSION_MAJOR < 2
+		const char *errstr = NULL;
 		sc = sasl_checkpass( lutil_passwd_sasl_conn,
 			passwd->bv_val, passwd->bv_len,
 			cred->bv_val, cred->bv_len,
 			&errstr );
-
+# else
+		sc = sasl_checkpass( lutil_passwd_sasl_conn,
+			passwd->bv_val, passwd->bv_len,
+			cred->bv_val, cred->bv_len );
+# endif
 		rtn = ( sc != SASL_OK );
 	}
 #endif

libraries/librewrite/map.c

@@ -245,19 +245,20 @@ rewrite_map_parse(
 	for ( p = string, cnt = 1; p[ 0 ] != '\0' && cnt > 0; p++ ) {
 		if ( p[ 0 ] == REWRITE_SUBMATCH_ESCAPE ) {
 			/*
-			 * '\' marks the beginning of a new map
+			 * '%' marks the beginning of a new map
 			 */
 			if ( p[ 1 ] == '{' ) {
 				cnt++;
 			/*
-			 * '\' followed by a digit may mark the beginning
+			 * '%' followed by a digit may mark the beginning
 			 * of an old map
 			 */
 			} else if ( isdigit( (unsigned char) p[ 1 ] ) && p[ 2 ] == '{' ) {
 				cnt++;
 				p++;
 			}
-			p++;
+			if ( p[ 1 ] != '\0' )
+				p++;
 		} else if ( p[ 0 ] == '}' ) {
 			cnt--;
 		}

libraries/librewrite/parse.c

@@ -45,7 +45,7 @@ parse_line(
 	}
 	
 	for ( begin = p;  p[ 0 ] != '\0'; p++ ) {
-		if ( p[ 0 ] == '\\' ) {
+		if ( p[ 0 ] == '\\' && p[ 1 ] != '\0' ) {
 			p++;
 		} else if ( p[ 0 ] == '\'' || p[ 0 ] == '\"') {
 			if ( in_quoted_field && p[ 0 ] == quote ) {

libraries/librewrite/subst.c

@@ -53,7 +53,7 @@ rewrite_subst_compile(
 	for ( p = begin = result, subs_len = 0; p[ 0 ] != '\0'; p++ ) {
 		
 		/*
-		 * Keep only single escapes '\'
+		 * Keep only single escapes '%'
 		 */
 		if ( p[ 0 ] != REWRITE_SUBMATCH_ESCAPE ) {
 			continue;

servers/slapd/aclparse.c

@@ -22,14 +22,14 @@ static void		split(char *line, int splitchar, char **left, char **right);
 static void		access_append(Access **l, Access *a);
 static void		acl_usage(void) LDAP_GCCATTR((noreturn));
 
-static void 		acl_regex_normalized_dn(struct berval *pattern);
+static void		acl_regex_normalized_dn(const char *src, struct berval *pat);
 
 #ifdef LDAP_DEBUG
 static void		print_acl(Backend *be, AccessControl *a);
 static void		print_access(Access *b);
 #endif
 
-static int
+static void
 regtest(const char *fname, int lineno, char *pat) {
 	int e;
 	regex_t re;
@@ -79,10 +79,8 @@ regtest(const char *fname, int lineno, char *pat) {
 			"%s: line %d: regular expression \"%s\" bad because of %s\n",
 			fname, lineno, pat, error );
 		acl_usage();
-		return(0);
 	}
 	regfree(&re);
-	return(1);
 }
 
 void
@@ -166,7 +164,7 @@ parse_acl(
 							|| strcmp(right, ".*") == 0 
 							|| strcmp(right, ".*$") == 0 
 							|| strcmp(right, "^.*") == 0 
-							|| strcmp(right, "^.*$$") == 0
+							|| strcmp(right, "^.*$") == 0
 							|| strcmp(right, ".*$$") == 0 
 							|| strcmp(right, "^.*$$") == 0 )
 						{
@@ -174,8 +172,7 @@ parse_acl(
 							a->acl_dn_pat.bv_len = sizeof("*")-1;
 
 						} else {
-							a->acl_dn_pat.bv_val = right;
-							acl_regex_normalized_dn( &a->acl_dn_pat );
+							acl_regex_normalized_dn( right, &a->acl_dn_pat );
 						}
 					} else if ( strcasecmp( style, "base" ) == 0 ) {
 						a->acl_dn_style = ACL_STYLE_BASE;
@@ -236,7 +233,13 @@ parse_acl(
 			if( a->acl_dn_pat.bv_len != 0 ) {
 				if ( a->acl_dn_style != ACL_STYLE_REGEX ) {
 					struct berval bv;
-					dnNormalize2( NULL, &a->acl_dn_pat, &bv);
+					rc = dnNormalize2( NULL, &a->acl_dn_pat, &bv);
+					if ( rc != LDAP_SUCCESS ) {
+						fprintf( stderr,
+							"%s: line %d: bad DN \"%s\"\n",
+							fname, lineno, a->acl_dn_pat.bv_val );
+						acl_usage();
+					}
 					free( a->acl_dn_pat.bv_val );
 					a->acl_dn_pat = bv;
 				} else {
@@ -373,8 +376,7 @@ parse_acl(
 								1, &bv);
 
 						} else {
-							bv.bv_val = right;
-							acl_regex_normalized_dn( &bv );
+							acl_regex_normalized_dn( right, &bv );
 							if ( !ber_bvccmp( &bv, '*' ) ) {
 								regtest(fname, lineno, bv.bv_val);
 							}
@@ -402,7 +404,13 @@ parse_acl(
 					}
 
 					if ( sty != ACL_STYLE_REGEX && expand == 0 ) {
-						dnNormalize2(NULL, &bv, &b->a_dn_pat);
+						rc = dnNormalize2(NULL, &bv, &b->a_dn_pat);
+						if ( rc != LDAP_SUCCESS ) {
+							fprintf( stderr,
+								"%s: line %d: bad DN \"%s\"\n",
+								fname, lineno, bv.bv_val );
+							acl_usage();
+						}
 						free(bv.bv_val);
 					} else {
 						b->a_dn_pat = bv;
@@ -490,15 +498,20 @@ parse_acl(
 
 					b->a_group_style = sty;
 					if (sty == ACL_STYLE_REGEX) {
-						bv.bv_val = right;
-						acl_regex_normalized_dn( &bv );
+						acl_regex_normalized_dn( right, &bv );
 						if ( !ber_bvccmp( &bv, '*' ) ) {
 							regtest(fname, lineno, bv.bv_val);
 						}
 						b->a_group_pat = bv;
 					} else {
 						ber_str2bv( right, 0, 0, &bv );