config.c 83.5 KB
Newer Older
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1
2
3
/* $OpenLDAP$ */
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
 *
Quanah Gibson-Mount's avatar
Quanah Gibson-Mount committed
4
 * Copyright 1999-2021 The OpenLDAP Foundation.
Kurt Zeilenga's avatar
Kurt Zeilenga committed
5
6
 * Portions Copyright 2001-2003 Pierangelo Masarati.
 * Portions Copyright 1999-2003 Howard Chu.
Kurt Zeilenga's avatar
Kurt Zeilenga committed
7
 * All rights reserved.
Pierangelo Masarati's avatar
Pierangelo Masarati committed
8
 *
Kurt Zeilenga's avatar
Kurt Zeilenga committed
9
10
11
12
13
14
15
16
17
18
19
20
21
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted only as authorized by the OpenLDAP
 * Public License.
 *
 * A copy of this license is available in the file LICENSE in the
 * top-level directory of the distribution or, alternatively, at
 * <http://www.OpenLDAP.org/license.html>.
 */
/* ACKNOWLEDGEMENTS:
 * This work was initially developed by the Howard Chu for inclusion
 * in OpenLDAP Software and subsequently enhanced by Pierangelo
 * Masarati.
 */
Pierangelo Masarati's avatar
Pierangelo Masarati committed
22
23
24
25

#include "portable.h"

#include <stdio.h>
26
#include <ctype.h>
Pierangelo Masarati's avatar
Pierangelo Masarati committed
27
28
29
30
31

#include <ac/string.h>
#include <ac/socket.h>

#include "slap.h"
32
#include "slap-config.h"
33
#include "lutil.h"
34
#include "ldif.h"
Pierangelo Masarati's avatar
Pierangelo Masarati committed
35
36
37
#include "../back-ldap/back-ldap.h"
#include "back-meta.h"

38
#ifdef LDAP_DEVEL
39
#define SLAP_AUTH_DN	1
40
#endif
41

42
static ConfigDriver meta_back_cf_gen;
43
44
static ConfigLDAPadd meta_ldadd;
static ConfigCfAdd meta_cfadd;
45
46
47
48
49
50

static int ldap_back_map_config(
	ConfigArgs *c,
	struct ldapmap	*oc_map,
	struct ldapmap	*at_map );

51
52
53
54
55
56
57
/* Three sets of enums:
 *	1) attrs that are only valid in the base config
 *	2) attrs that are valid in base or target
 *	3) attrs that are only valid in a target
 */

/* Base attrs */
58
enum {
59
60
	LDAP_BACK_CFG_CONN_TTL = 1,
	LDAP_BACK_CFG_DNCACHE_TTL,
61
	LDAP_BACK_CFG_IDLE_TIMEOUT,
62
63
	LDAP_BACK_CFG_ONERR,
	LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
64
65
66
	LDAP_BACK_CFG_SINGLECONN,
	LDAP_BACK_CFG_USETEMP,
	LDAP_BACK_CFG_CONNPOOLMAX,
67
68
69
70
71
72
	LDAP_BACK_CFG_LAST_BASE
};

/* Base or target */
enum {
	LDAP_BACK_CFG_BIND_TIMEOUT = LDAP_BACK_CFG_LAST_BASE,
73
	LDAP_BACK_CFG_CANCEL,
74
75
76
77
	LDAP_BACK_CFG_CHASE,
	LDAP_BACK_CFG_CLIENT_PR,
	LDAP_BACK_CFG_DEFAULT_T,
	LDAP_BACK_CFG_NETWORK_TIMEOUT,
78
79
	LDAP_BACK_CFG_NOREFS,
	LDAP_BACK_CFG_NOUNDEFFILTER,
80
81
82
83
84
85
86
87
88
89
	LDAP_BACK_CFG_NRETRIES,
	LDAP_BACK_CFG_QUARANTINE,
	LDAP_BACK_CFG_REBIND,
	LDAP_BACK_CFG_TIMEOUT,
	LDAP_BACK_CFG_VERSION,
	LDAP_BACK_CFG_ST_REQUEST,
	LDAP_BACK_CFG_T_F,
	LDAP_BACK_CFG_TLS,
	LDAP_BACK_CFG_LAST_BOTH
};
90

91
92
93
94
95
/* Target attrs */
enum {
	LDAP_BACK_CFG_URI = LDAP_BACK_CFG_LAST_BOTH,
	LDAP_BACK_CFG_IDASSERT_AUTHZFROM,
	LDAP_BACK_CFG_IDASSERT_BIND,
96
97
98
99
100
101
102
	LDAP_BACK_CFG_REWRITE,
	LDAP_BACK_CFG_SUFFIXM,
	LDAP_BACK_CFG_MAP,
	LDAP_BACK_CFG_SUBTREE_EX,
	LDAP_BACK_CFG_SUBTREE_IN,
	LDAP_BACK_CFG_PSEUDOROOTDN,
	LDAP_BACK_CFG_PSEUDOROOTPW,
103
	LDAP_BACK_CFG_KEEPALIVE,
104
	LDAP_BACK_CFG_TCP_USER_TIMEOUT,
105
	LDAP_BACK_CFG_FILTER,
106
107
108
109
110

	LDAP_BACK_CFG_LAST
};

static ConfigTable metacfg[] = {
111
	{ "uri", "uri", 2, 0, 0,
112
113
114
115
		ARG_MAGIC|LDAP_BACK_CFG_URI,
		meta_back_cf_gen, "( OLcfgDbAt:0.14 "
			"NAME 'olcDbURI' "
			"DESC 'URI (list) for remote DSA' "
116
			"EQUALITY caseExactMatch "
117
118
119
120
121
122
123
124
			"SYNTAX OMsDirectoryString "
			"SINGLE-VALUE )",
		NULL, NULL },
	{ "tls", "what", 2, 0, 0,
		ARG_MAGIC|LDAP_BACK_CFG_TLS,
		meta_back_cf_gen, "( OLcfgDbAt:3.1 "
			"NAME 'olcDbStartTLS' "
			"DESC 'StartTLS' "
125
			"EQUALITY caseExactMatch "
126
127
128
129
130
131
132
133
			"SYNTAX OMsDirectoryString "
			"SINGLE-VALUE )",
		NULL, NULL },
	{ "idassert-bind", "args", 2, 0, 0,
		ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_BIND,
		meta_back_cf_gen, "( OLcfgDbAt:3.7 "
			"NAME 'olcDbIDAssertBind' "
			"DESC 'Remote Identity Assertion administrative identity auth bind configuration' "
134
			"EQUALITY caseIgnoreMatch "
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
			"SYNTAX OMsDirectoryString "
			"SINGLE-VALUE )",
		NULL, NULL },
	{ "idassert-authzFrom", "authzRule", 2, 2, 0,
		ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_AUTHZFROM,
		meta_back_cf_gen, "( OLcfgDbAt:3.9 "
			"NAME 'olcDbIDAssertAuthzFrom' "
			"DESC 'Remote Identity Assertion authz rules' "
			"EQUALITY caseIgnoreMatch "
			"SYNTAX OMsDirectoryString "
			"X-ORDERED 'VALUES' )",
		NULL, NULL },
	{ "rebind-as-user", "true|FALSE", 1, 2, 0,
		ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_REBIND,
		meta_back_cf_gen, "( OLcfgDbAt:3.10 "
			"NAME 'olcDbRebindAsUser' "
			"DESC 'Rebind as user' "
152
			"EQUALITY booleanMatch "
153
154
155
156
157
158
159
160
			"SYNTAX OMsBoolean "
			"SINGLE-VALUE )",
		NULL, NULL },
	{ "chase-referrals", "true|FALSE", 2, 2, 0,
		ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_CHASE,
		meta_back_cf_gen, "( OLcfgDbAt:3.11 "
			"NAME 'olcDbChaseReferrals' "
			"DESC 'Chase referrals' "
161
			"EQUALITY booleanMatch "
162
163
164
165
166
167
168
169
			"SYNTAX OMsBoolean "
			"SINGLE-VALUE )",
		NULL, NULL },
	{ "t-f-support", "true|FALSE|discover", 2, 2, 0,
		ARG_MAGIC|LDAP_BACK_CFG_T_F,
		meta_back_cf_gen, "( OLcfgDbAt:3.12 "
			"NAME 'olcDbTFSupport' "
			"DESC 'Absolute filters support' "
170
			"EQUALITY caseIgnoreMatch "
171
172
173
174
175
176
177
178
			"SYNTAX OMsDirectoryString "
			"SINGLE-VALUE )",
		NULL, NULL },
	{ "timeout", "timeout(list)", 2, 0, 0,
		ARG_MAGIC|LDAP_BACK_CFG_TIMEOUT,
		meta_back_cf_gen, "( OLcfgDbAt:3.14 "
			"NAME 'olcDbTimeout' "
			"DESC 'Per-operation timeouts' "
179
			"EQUALITY caseIgnoreMatch "
180
181
182
183
184
185
186
187
			"SYNTAX OMsDirectoryString "
			"SINGLE-VALUE )",
		NULL, NULL },
	{ "idle-timeout", "timeout", 2, 2, 0,
		ARG_MAGIC|LDAP_BACK_CFG_IDLE_TIMEOUT,
		meta_back_cf_gen, "( OLcfgDbAt:3.15 "
			"NAME 'olcDbIdleTimeout' "
			"DESC 'connection idle timeout' "
188
			"EQUALITY caseIgnoreMatch "
189
190
191
192
193
194
195
196
			"SYNTAX OMsDirectoryString "
			"SINGLE-VALUE )",
		NULL, NULL },
	{ "conn-ttl", "ttl", 2, 2, 0,
		ARG_MAGIC|LDAP_BACK_CFG_CONN_TTL,
		meta_back_cf_gen, "( OLcfgDbAt:3.16 "
			"NAME 'olcDbConnTtl' "
			"DESC 'connection ttl' "
197
			"EQUALITY caseIgnoreMatch "
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
			"SYNTAX OMsDirectoryString "
			"SINGLE-VALUE )",
		NULL, NULL },
	{ "network-timeout", "timeout", 2, 2, 0,
		ARG_MAGIC|LDAP_BACK_CFG_NETWORK_TIMEOUT,
		meta_back_cf_gen, "( OLcfgDbAt:3.17 "
			"NAME 'olcDbNetworkTimeout' "
			"DESC 'connection network timeout' "
			"SYNTAX OMsDirectoryString "
			"SINGLE-VALUE )",
		NULL, NULL },
	{ "protocol-version", "version", 2, 2, 0,
		ARG_MAGIC|ARG_INT|LDAP_BACK_CFG_VERSION,
		meta_back_cf_gen, "( OLcfgDbAt:3.18 "
			"NAME 'olcDbProtocolVersion' "
			"DESC 'protocol version' "
214
			"EQUALITY integerMatch "
215
216
217
218
219
220
221
222
			"SYNTAX OMsInteger "
			"SINGLE-VALUE )",
		NULL, NULL },
	{ "single-conn", "true|FALSE", 2, 2, 0,
		ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_SINGLECONN,
		meta_back_cf_gen, "( OLcfgDbAt:3.19 "
			"NAME 'olcDbSingleConn' "
			"DESC 'cache a single connection per identity' "
223
			"EQUALITY booleanMatch "
224
225
226
227
228
229
230
231
			"SYNTAX OMsBoolean "
			"SINGLE-VALUE )",
		NULL, NULL },
	{ "cancel", "ABANDON|ignore|exop", 2, 2, 0,
		ARG_MAGIC|LDAP_BACK_CFG_CANCEL,
		meta_back_cf_gen, "( OLcfgDbAt:3.20 "
			"NAME 'olcDbCancel' "
			"DESC 'abandon/ignore/exop operations when appropriate' "
232
			"EQUALITY caseIgnoreMatch "
233
234
235
236
237
238
239
240
			"SYNTAX OMsDirectoryString "
			"SINGLE-VALUE )",
		NULL, NULL },
	{ "quarantine", "retrylist", 2, 2, 0,
		ARG_MAGIC|LDAP_BACK_CFG_QUARANTINE,
		meta_back_cf_gen, "( OLcfgDbAt:3.21 "
			"NAME 'olcDbQuarantine' "
			"DESC 'Quarantine database if connection fails and retry according to rule' "
241
			"EQUALITY caseIgnoreMatch "
242
243
244
245
246
247
248
249
			"SYNTAX OMsDirectoryString "
			"SINGLE-VALUE )",
		NULL, NULL },
	{ "use-temporary-conn", "true|FALSE", 2, 2, 0,
		ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_USETEMP,
		meta_back_cf_gen, "( OLcfgDbAt:3.22 "
			"NAME 'olcDbUseTemporaryConn' "
			"DESC 'Use temporary connections if the cached one is busy' "
250
			"EQUALITY booleanMatch "
251
252
253
254
255
256
257
258
			"SYNTAX OMsBoolean "
			"SINGLE-VALUE )",
		NULL, NULL },
	{ "conn-pool-max", "<n>", 2, 2, 0,
		ARG_MAGIC|ARG_INT|LDAP_BACK_CFG_CONNPOOLMAX,
		meta_back_cf_gen, "( OLcfgDbAt:3.23 "
			"NAME 'olcDbConnectionPoolMax' "
			"DESC 'Max size of privileged connections pool' "
259
			"EQUALITY integerMatch "
260
261
262
263
264
265
266
267
268
			"SYNTAX OMsInteger "
			"SINGLE-VALUE )",
		NULL, NULL },
#ifdef SLAP_CONTROL_X_SESSION_TRACKING
	{ "session-tracking-request", "true|FALSE", 2, 2, 0,
		ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_ST_REQUEST,
		meta_back_cf_gen, "( OLcfgDbAt:3.24 "
			"NAME 'olcDbSessionTrackingRequest' "
			"DESC 'Add session tracking control to proxied requests' "
269
			"EQUALITY booleanMatch "
270
271
272
273
274
275
276
277
278
			"SYNTAX OMsBoolean "
			"SINGLE-VALUE )",
		NULL, NULL },
#endif /* SLAP_CONTROL_X_SESSION_TRACKING */
	{ "norefs", "true|FALSE", 2, 2, 0,
		ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_NOREFS,
		meta_back_cf_gen, "( OLcfgDbAt:3.25 "
			"NAME 'olcDbNoRefs' "
			"DESC 'Do not return search reference responses' "
279
			"EQUALITY booleanMatch "
280
281
282
283
284
285
286
287
			"SYNTAX OMsBoolean "
			"SINGLE-VALUE )",
		NULL, NULL },
	{ "noundeffilter", "true|FALSE", 2, 2, 0,
		ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_NOUNDEFFILTER,
		meta_back_cf_gen, "( OLcfgDbAt:3.26 "
			"NAME 'olcDbNoUndefFilter' "
			"DESC 'Do not propagate undefined search filters' "
288
			"EQUALITY booleanMatch "
289
290
291
292
			"SYNTAX OMsBoolean "
			"SINGLE-VALUE )",
		NULL, NULL },

Howard Chu's avatar
Howard Chu committed
293
294
	{ "rewrite", "arglist", 2, 0, STRLENOF( "rewrite" ),
		ARG_MAGIC|LDAP_BACK_CFG_REWRITE,
295
		meta_back_cf_gen, "( OLcfgDbAt:3.101 "
296
297
			"NAME 'olcDbRewrite' "
			"DESC 'DN rewriting rules' "
Howard Chu's avatar
Howard Chu committed
298
299
300
			"EQUALITY caseIgnoreMatch "
			"SYNTAX OMsDirectoryString "
			"X-ORDERED 'VALUES' )",
301
		NULL, NULL },
Howard Chu's avatar
Howard Chu committed
302
	{ "suffixmassage", "virtual> <real", 2, 3, 0,
303
		ARG_MAGIC|LDAP_BACK_CFG_SUFFIXM,
304
305
		meta_back_cf_gen, NULL, NULL, NULL },

306
307
308
309
310
	{ "map", "attribute|objectClass> [*|<local>] *|<remote", 3, 4, 0,
		ARG_MAGIC|LDAP_BACK_CFG_MAP,
		meta_back_cf_gen, "( OLcfgDbAt:3.102 "
			"NAME 'olcDbMap' "
			"DESC 'Map attribute and objectclass names' "
Howard Chu's avatar
Howard Chu committed
311
312
313
			"EQUALITY caseIgnoreMatch "
			"SYNTAX OMsDirectoryString "
			"X-ORDERED 'VALUES' )",
314
315
316
		NULL, NULL },

	{ "subtree-exclude", "pattern", 2, 2, 0,
Pierangelo Masarati's avatar
Pierangelo Masarati committed
317
		ARG_MAGIC|LDAP_BACK_CFG_SUBTREE_EX,
318
319
320
		meta_back_cf_gen, "( OLcfgDbAt:3.103 "
			"NAME 'olcDbSubtreeExclude' "
			"DESC 'DN of subtree to exclude from target' "
Howard Chu's avatar
Howard Chu committed
321
			"EQUALITY caseIgnoreMatch "
322
323
324
			"SYNTAX OMsDirectoryString )",
		NULL, NULL },
	{ "subtree-include", "pattern", 2, 2, 0,
Pierangelo Masarati's avatar
Pierangelo Masarati committed
325
		ARG_MAGIC|LDAP_BACK_CFG_SUBTREE_IN,
326
327
328
		meta_back_cf_gen, "( OLcfgDbAt:3.104 "
			"NAME 'olcDbSubtreeInclude' "
			"DESC 'DN of subtree to include in target' "
Howard Chu's avatar
Howard Chu committed
329
			"EQUALITY caseIgnoreMatch "
330
331
332
333
334
335
336
			"SYNTAX OMsDirectoryString )",
		NULL, NULL },
	{ "default-target", "[none|<target ID>]", 1, 2, 0,
		ARG_MAGIC|LDAP_BACK_CFG_DEFAULT_T,
		meta_back_cf_gen, "( OLcfgDbAt:3.105 "
			"NAME 'olcDbDefaultTarget' "
			"DESC 'Specify the default target' "
337
			"EQUALITY caseIgnoreMatch "
338
339
340
341
342
343
344
345
			"SYNTAX OMsDirectoryString "
			"SINGLE-VALUE )",
		NULL, NULL },
	{ "dncache-ttl", "ttl", 2, 2, 0,
		ARG_MAGIC|LDAP_BACK_CFG_DNCACHE_TTL,
		meta_back_cf_gen, "( OLcfgDbAt:3.106 "
			"NAME 'olcDbDnCacheTtl' "
			"DESC 'dncache ttl' "
346
			"EQUALITY caseIgnoreMatch "
347
348
349
350
			"SYNTAX OMsDirectoryString "
			"SINGLE-VALUE )",
		NULL, NULL },
	{ "bind-timeout", "microseconds", 2, 2, 0,
Howard Chu's avatar
Howard Chu committed
351
		ARG_MAGIC|ARG_ULONG|LDAP_BACK_CFG_BIND_TIMEOUT,
352
353
354
		meta_back_cf_gen, "( OLcfgDbAt:3.107 "
			"NAME 'olcDbBindTimeout' "
			"DESC 'bind timeout' "
355
356
			"EQUALITY integerMatch "
			"SYNTAX OMsInteger "
357
358
359
360
361
362
363
			"SINGLE-VALUE )",
		NULL, NULL },
	{ "onerr", "CONTINUE|report|stop", 2, 2, 0,
		ARG_MAGIC|LDAP_BACK_CFG_ONERR,
		meta_back_cf_gen, "( OLcfgDbAt:3.108 "
			"NAME 'olcDbOnErr' "
			"DESC 'error handling' "
364
			"EQUALITY caseIgnoreMatch "
365
366
367
368
369
370
371
372
			"SYNTAX OMsDirectoryString "
			"SINGLE-VALUE )",
		NULL, NULL },
	{ "pseudoroot-bind-defer", "TRUE|false", 2, 2, 0,
		ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
		meta_back_cf_gen, "( OLcfgDbAt:3.109 "
			"NAME 'olcDbPseudoRootBindDefer' "
			"DESC 'error handling' "
373
			"EQUALITY booleanMatch "
374
375
376
377
378
379
380
			"SYNTAX OMsBoolean "
			"SINGLE-VALUE )",
		NULL, NULL },
	{ "root-bind-defer", "TRUE|false", 2, 2, 0,
		ARG_MAGIC|ARG_ON_OFF|LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER,
		meta_back_cf_gen, NULL, NULL, NULL },
	{ "pseudorootdn", "dn", 2, 2, 0,
381
		ARG_MAGIC|ARG_DN|ARG_QUOTE|LDAP_BACK_CFG_PSEUDOROOTDN,
382
383
		meta_back_cf_gen, NULL, NULL, NULL },
	{ "pseudorootpw", "password", 2, 2, 0,
384
		ARG_MAGIC|ARG_STRING|LDAP_BACK_CFG_PSEUDOROOTPW,
385
386
		meta_back_cf_gen, NULL, NULL, NULL },
	{ "nretries", "NEVER|forever|<number>", 2, 2, 0,
Howard Chu's avatar
Howard Chu committed
387
		ARG_MAGIC|LDAP_BACK_CFG_NRETRIES,
388
389
390
		meta_back_cf_gen, "( OLcfgDbAt:3.110 "
			"NAME 'olcDbNretries' "
			"DESC 'retry handling' "
391
			"EQUALITY caseIgnoreMatch "
392
393
394
395
			"SYNTAX OMsDirectoryString "
			"SINGLE-VALUE )",
		NULL, NULL },
	{ "client-pr", "accept-unsolicited|disable|<size>", 2, 2, 0,
Howard Chu's avatar
Howard Chu committed
396
		ARG_MAGIC|LDAP_BACK_CFG_CLIENT_PR,
397
398
399
		meta_back_cf_gen, "( OLcfgDbAt:3.111 "
			"NAME 'olcDbClientPr' "
			"DESC 'PagedResults handling' "
400
			"EQUALITY caseIgnoreMatch "
401
402
403
			"SYNTAX OMsDirectoryString "
			"SINGLE-VALUE )",
		NULL, NULL },
404
405
406
407

	{ "", "", 0, 0, 0, ARG_IGNORED,
		NULL, "( OLcfgDbAt:3.100 NAME 'olcMetaSub' "
			"DESC 'Placeholder to name a Target entry' "
Howard Chu's avatar
Howard Chu committed
408
			"EQUALITY caseIgnoreMatch "
409
410
411
			"SYNTAX OMsDirectoryString "
			"SINGLE-VALUE X-ORDERED 'SIBLINGS' )", NULL, NULL },

412
413
414
415
416
	{ "keepalive", "keepalive", 2, 2, 0,
		ARG_MAGIC|LDAP_BACK_CFG_KEEPALIVE,
		meta_back_cf_gen, "( OLcfgDbAt:3.29 "
			"NAME 'olcDbKeepalive' "
			"DESC 'TCP keepalive' "
417
			"EQUALITY caseIgnoreMatch "
418
419
420
421
			"SYNTAX OMsDirectoryString "
			"SINGLE-VALUE )",
		NULL, NULL },

422
423
424
425
426
427
428
429
430
	{ "tcp-user-timeout", "milliseconds", 2, 2, 0,
               ARG_MAGIC|ARG_UINT|LDAP_BACK_CFG_TCP_USER_TIMEOUT,
               meta_back_cf_gen, "( OLcfgDbAt:3.30 "
                       "NAME 'olcDbTcpUserTimeout' "
                       "DESC 'TCP User Timeout' "
                       "SYNTAX OMsInteger "
                       "SINGLE-VALUE )",
               NULL, NULL },

431
432
433
434
435
436
437
438
439
	{ "filter", "pattern", 2, 2, 0,
		ARG_MAGIC|LDAP_BACK_CFG_FILTER,
		meta_back_cf_gen, "( OLcfgDbAt:3.112 "
			"NAME 'olcDbFilter' "
			"DESC 'Filter regex pattern to include in target' "
			"EQUALITY caseExactMatch "
			"SYNTAX OMsDirectoryString )",
		NULL, NULL },

440
441
442
443
444
445
446
447
448
449
	{ NULL, NULL, 0, 0, 0, ARG_IGNORED,
		NULL, NULL, NULL, NULL }
};

#ifdef SLAP_CONTROL_X_SESSION_TRACKING
#define	ST_ATTR "$ olcDbSessionTrackingRequest "
#else
#define	ST_ATTR ""
#endif /* SLAP_CONTROL_X_SESSION_TRACKING */

450
451
#define COMMON_ATTRS	\
			"$ olcDbBindTimeout " \
452
453
454
455
456
457
458
459
460
			"$ olcDbCancel " \
			"$ olcDbChaseReferrals " \
			"$ olcDbClientPr " \
			"$ olcDbDefaultTarget " \
			"$ olcDbNetworkTimeout " \
			"$ olcDbNoRefs " \
			"$ olcDbNoUndefFilter " \
			"$ olcDbNretries " \
			"$ olcDbProtocolVersion " \
461
462
			"$ olcDbQuarantine " \
			"$ olcDbRebindAsUser " \
463
			ST_ATTR \
464
			"$ olcDbStartTLS " \
465
466
467
468
469
470
471
472
473
			"$ olcDbTFSupport "

static ConfigOCs metaocs[] = {
	{ "( OLcfgDbOc:3.2 "
		"NAME 'olcMetaConfig' "
		"DESC 'Meta backend configuration' "
		"SUP olcDatabaseConfig "
		"MAY ( olcDbConnTtl "
			"$ olcDbDnCacheTtl "
474
			"$ olcDbIdleTimeout "
475
476
477
478
479
480
481
			"$ olcDbOnErr "
			"$ olcDbPseudoRootBindDefer "
			"$ olcDbSingleConn "
			"$ olcDbUseTemporaryConn "
			"$ olcDbConnectionPoolMax "

			/* defaults, may be overridden per-target */
482
			COMMON_ATTRS
483
		") )",
484
			Cft_Database, metacfg, NULL, meta_cfadd },
485
	{ "( OLcfgDbOc:3.3 "
486
		"NAME 'olcMetaTargetConfig' "
487
		"DESC 'Meta target configuration' "
488
489
		"SUP olcConfig STRUCTURAL "
		"MUST ( olcMetaSub $ olcDbURI ) "
490
		"MAY ( olcDbIDAssertAuthzFrom "
491
492
493
494
495
496
			"$ olcDbIDAssertBind "
			"$ olcDbMap "
			"$ olcDbRewrite "
			"$ olcDbSubtreeExclude "
			"$ olcDbSubtreeInclude "
			"$ olcDbTimeout "
497
			"$ olcDbKeepalive "
498
			"$ olcDbTcpUserTimeout "
499
			"$ olcDbFilter "
500
501

			/* defaults may be inherited */
502
			COMMON_ATTRS
503
		") )",
504
			Cft_Misc, metacfg, meta_ldadd },
505
506
507
	{ NULL, 0, NULL }
};

508
509
510
static int
meta_ldadd( CfEntryInfo *p, Entry *e, ConfigArgs *c )
{
Howard Chu's avatar
Howard Chu committed
511
512
	if ( p->ce_type != Cft_Database || !p->ce_be ||
		p->ce_be->be_cf_ocs != metaocs )
513
514
		return LDAP_CONSTRAINT_VIOLATION;

Howard Chu's avatar
Howard Chu committed
515
	c->be = p->ce_be;
516
517
518
519
520
521
522
523
524
525
	return LDAP_SUCCESS;
}

static int
meta_cfadd( Operation *op, SlapReply *rs, Entry *p, ConfigArgs *c )
{
	metainfo_t	*mi = ( metainfo_t * )c->be->be_private;
	struct berval bv;
	int i;

Howard Chu's avatar
Howard Chu committed
526
	bv.bv_val = c->cr_msg;
527
	for ( i=0; i<mi->mi_ntargets; i++ ) {
Howard Chu's avatar
Howard Chu committed
528
529
530
		bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg),
			"olcMetaSub=" SLAP_X_ORDERED_FMT "uri", i );
		c->ca_private = mi->mi_targets[i];
Howard Chu's avatar
Howard Chu committed
531
		c->valx = i;
Howard Chu's avatar
Howard Chu committed
532
533
		config_build_entry( op, rs, p->e_private, c,
			&bv, &metaocs[1], NULL );
534
535
536
537
538
	}

	return LDAP_SUCCESS;
}

539
static int
Howard Chu's avatar
Howard Chu committed
540
meta_rwi_init( struct rewrite_info **rwm_rw )
Pierangelo Masarati's avatar
Pierangelo Masarati committed
541
{
542
	char			*rargv[ 3 ];
543

Howard Chu's avatar
Howard Chu committed
544
545
	*rwm_rw = rewrite_info_init( REWRITE_MODE_USE_DEFAULT );
	if ( *rwm_rw == NULL ) {
Howard Chu's avatar
Howard Chu committed
546
		return -1;
Pierangelo Masarati's avatar
Pierangelo Masarati committed
547
	}
548
549
550
551
552
553
554
555
	/*
	 * the filter rewrite as a string must be disabled
	 * by default; it can be re-enabled by adding rules;
	 * this creates an empty rewriteContext
	 */
	rargv[ 0 ] = "rewriteContext";
	rargv[ 1 ] = "searchFilter";
	rargv[ 2 ] = NULL;
Howard Chu's avatar
Howard Chu committed
556
	rewrite_parse( *rwm_rw, "<suffix massage>", 1, 2, rargv );
557
558
559
560

	rargv[ 0 ] = "rewriteContext";
	rargv[ 1 ] = "default";
	rargv[ 2 ] = NULL;
Howard Chu's avatar
Howard Chu committed
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
	rewrite_parse( *rwm_rw, "<suffix massage>", 1, 2, rargv );

	return 0;
}

static int
meta_back_new_target(
	metatarget_t	**mtp )
{
	metatarget_t		*mt;

	*mtp = NULL;

	mt = ch_calloc( sizeof( metatarget_t ), 1 );

	if ( meta_rwi_init( &mt->mt_rwmap.rwm_rw )) {
		ch_free( mt );
		return -1;
	}
580

581
582
	ldap_pvt_thread_mutex_init( &mt->mt_uri_mutex );

583
584
585
586
587
588
589
	mt->mt_idassert_mode = LDAP_BACK_IDASSERT_LEGACY;
	mt->mt_idassert_authmethod = LDAP_AUTH_NONE;
	mt->mt_idassert_tls = SB_TLS_DEFAULT;

	/* by default, use proxyAuthz control on each operation */
	mt->mt_idassert_flags = LDAP_BACK_AUTH_PRESCRIPTIVE;

590
591
	*mtp = mt;

592
	return 0;
Pierangelo Masarati's avatar
Pierangelo Masarati committed
593
594
}

Howard Chu's avatar
Howard Chu committed
595
596
597
598
/* Validation for suffixmassage_config */
static int
meta_suffixm_config(
	ConfigArgs *c,
Howard Chu's avatar
Howard Chu committed
599
600
	int argc,
	char **argv,
Howard Chu's avatar
Howard Chu committed
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
	metatarget_t *mt
)
{
	BackendDB 	*tmp_bd;
	struct berval	dn, nvnc, pvnc, nrnc, prnc;
	int j, rc;

	/*
	 * syntax:
	 *
	 * 	suffixmassage <suffix> <massaged suffix>
	 *
	 * the <suffix> field must be defined as a valid suffix
	 * (or suffixAlias?) for the current database;
	 * the <massaged suffix> shouldn't have already been
	 * defined as a valid suffix or suffixAlias for the
	 * current server
	 */

Howard Chu's avatar
Howard Chu committed
620
	ber_str2bv( argv[ 1 ], 0, 0, &dn );
Howard Chu's avatar
Howard Chu committed
621
622
623
	if ( dnPrettyNormal( NULL, &dn, &pvnc, &nvnc, NULL ) != LDAP_SUCCESS ) {
		snprintf( c->cr_msg, sizeof( c->cr_msg ),
			"suffix \"%s\" is invalid",
Howard Chu's avatar
Howard Chu committed
624
			argv[1] );
625
		Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
Howard Chu's avatar
Howard Chu committed
626
627
628
629
630
631
632
633
634
635
636
637
		return 1;
	}

	for ( j = 0; !BER_BVISNULL( &c->be->be_nsuffix[ j ] ); j++ ) {
		if ( dnIsSuffix( &nvnc, &c->be->be_nsuffix[ 0 ] ) ) {
			break;
		}
	}

	if ( BER_BVISNULL( &c->be->be_nsuffix[ j ] ) ) {
		snprintf( c->cr_msg, sizeof( c->cr_msg ),
			"suffix \"%s\" must be within the database naming context",
Howard Chu's avatar
Howard Chu committed
638
			argv[1] );
639
		Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
Howard Chu's avatar
Howard Chu committed
640
641
642
643
644
		free( pvnc.bv_val );
		free( nvnc.bv_val );
		return 1;
	}

Howard Chu's avatar
Howard Chu committed
645
	ber_str2bv( argv[ 2 ], 0, 0, &dn );
Howard Chu's avatar
Howard Chu committed
646
647
648
	if ( dnPrettyNormal( NULL, &dn, &prnc, &nrnc, NULL ) != LDAP_SUCCESS ) {
		snprintf( c->cr_msg, sizeof( c->cr_msg ),
			"massaged suffix \"%s\" is invalid",
Howard Chu's avatar
Howard Chu committed
649
			argv[2] );
650
		Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
Howard Chu's avatar
Howard Chu committed
651
652
653
654
655
656
657
658
659
660
		free( pvnc.bv_val );
		free( nvnc.bv_val );
		return 1;
	}

	tmp_bd = select_backend( &nrnc, 0 );
	if ( tmp_bd != NULL && tmp_bd->be_private == c->be->be_private ) {
		Debug( LDAP_DEBUG_ANY,
	"%s: warning: <massaged suffix> \"%s\" resolves to this database, in "
	"\"suffixMassage <suffix> <massaged suffix>\"\n",
661
			c->log, prnc.bv_val );
Howard Chu's avatar
Howard Chu committed
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
	}

	/*
	 * The suffix massaging is emulated by means of the
	 * rewrite capabilities
	 */
	rc = suffix_massage_config( mt->mt_rwmap.rwm_rw,
			&pvnc, &nvnc, &prnc, &nrnc );

	free( pvnc.bv_val );
	free( nvnc.bv_val );
	free( prnc.bv_val );
	free( nrnc.bv_val );

	return rc;
}

679
int
Howard Chu's avatar
Howard Chu committed
680
meta_subtree_free( metasubtree_t *ms )
681
682
683
684
685
686
687
688
689
{
	switch ( ms->ms_type ) {
	case META_ST_SUBTREE:
	case META_ST_SUBORDINATE:
		ber_memfree( ms->ms_dn.bv_val );
		break;

	case META_ST_REGEX:
		regfree( &ms->ms_regex );
Howard Chu's avatar
Howard Chu committed
690
		ber_memfree( ms->ms_regex_pattern.bv_val );
691
692
693
694
695
696
697
698
699
700
		break;

	default:
		return -1;
	}

	ch_free( ms );
	return 0;
}

Howard Chu's avatar
Howard Chu committed
701
702
703
704
705
706
707
708
709
710
int
meta_subtree_destroy( metasubtree_t *ms )
{
	if ( ms->ms_next ) {
		meta_subtree_destroy( ms->ms_next );
	}

	return meta_subtree_free( ms );
}

711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
static void
meta_filter_free( metafilter_t *mf )
{
	regfree( &mf->mf_regex );
	ber_memfree( mf->mf_regex_pattern.bv_val );
	ch_free( mf );
}

void
meta_filter_destroy( metafilter_t *mf )
{
	if ( mf->mf_next )
		meta_filter_destroy( mf->mf_next );
	meta_filter_free( mf );
}

Howard Chu's avatar
Howard Chu committed
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
static struct berval st_styles[] = {
	BER_BVC("subtree"),
	BER_BVC("children"),
	BER_BVC("regex")
};

static int
meta_subtree_unparse(
	ConfigArgs *c,
	metatarget_t *mt )
{
	metasubtree_t	*ms;
	struct berval bv, *style;

	if ( !mt->mt_subtree )
		return 1;

	/* can only be one of exclude or include */
	if (( c->type == LDAP_BACK_CFG_SUBTREE_EX ) ^ mt->mt_subtree_exclude )
		return 1;

	bv.bv_val = c->cr_msg;
	for ( ms=mt->mt_subtree; ms; ms=ms->ms_next ) {
		if (ms->ms_type == META_ST_SUBTREE)
			style = &st_styles[0];
		else if ( ms->ms_type == META_ST_SUBORDINATE )
			style = &st_styles[1];
		else if ( ms->ms_type == META_ST_REGEX )
			style = &st_styles[2];
		else {
			assert(0);
			continue;
		}
		bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg),
			"dn.%s:%s", style->bv_val, ms->ms_dn.bv_val );
		value_add_one( &c->rvalue_vals, &bv );
	}
	return 0;
}

767
768
769
static int
meta_subtree_config(
	metatarget_t *mt,
770
	ConfigArgs *c )
771
772
773
774
775
776
{
	meta_st_t	type = META_ST_SUBTREE;
	char		*pattern;
	struct berval	ndn = BER_BVNULL;
	metasubtree_t	*ms = NULL;

777
	if ( c->type == LDAP_BACK_CFG_SUBTREE_EX ) {
778
		if ( mt->mt_subtree && !mt->mt_subtree_exclude ) {
779
			snprintf( c->cr_msg, sizeof(c->cr_msg),
780
781
782
783
784
785
786
787
				"\"subtree-exclude\" incompatible with previous \"subtree-include\" directives" );
			return 1;
		}

		mt->mt_subtree_exclude = 1;

	} else {
		if ( mt->mt_subtree && mt->mt_subtree_exclude ) {
788
			snprintf( c->cr_msg, sizeof(c->cr_msg),
789
790
791
792
793
				"\"subtree-include\" incompatible with previous \"subtree-exclude\" directives" );
			return 1;
		}
	}

794
	pattern = c->argv[1];
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
	if ( strncasecmp( pattern, "dn", STRLENOF( "dn" ) ) == 0 ) {
		char *style;

		pattern = &pattern[STRLENOF( "dn")];

		if ( pattern[0] == '.' ) {
			style = &pattern[1];

			if ( strncasecmp( style, "subtree", STRLENOF( "subtree" ) ) == 0 ) {
				type = META_ST_SUBTREE;
				pattern = &style[STRLENOF( "subtree" )];

			} else if ( strncasecmp( style, "children", STRLENOF( "children" ) ) == 0 ) {
				type = META_ST_SUBORDINATE;
				pattern = &style[STRLENOF( "children" )];

			} else if ( strncasecmp( style, "sub", STRLENOF( "sub" ) ) == 0 ) {
				type = META_ST_SUBTREE;
				pattern = &style[STRLENOF( "sub" )];

			} else if ( strncasecmp( style, "regex", STRLENOF( "regex" ) ) == 0 ) {
				type = META_ST_REGEX;
				pattern = &style[STRLENOF( "regex" )];

			} else {
820
				snprintf( c->cr_msg, sizeof(c->cr_msg), "unknown style in \"dn.<style>\"" );
821
822
823
824
825
				return 1;
			}
		}

		if ( pattern[0] != ':' ) {
826
			snprintf( c->cr_msg, sizeof(c->cr_msg), "missing colon after \"dn.<style>\"" );
827
828
829
830
831
832
833
834
835
836
837
838
839
840
			return 1;
		}
		pattern++;
	}

	switch ( type ) {
	case META_ST_SUBTREE:
	case META_ST_SUBORDINATE: {
		struct berval dn;

		ber_str2bv( pattern, 0, 0, &dn );
		if ( dnNormalize( 0, NULL, NULL, &dn, &ndn, NULL )
			!= LDAP_SUCCESS )
		{
841
			snprintf( c->cr_msg, sizeof(c->cr_msg), "DN=\"%s\" is invalid", pattern );
842
843
844
845
			return 1;
		}

		if ( !dnIsSuffix( &ndn, &mt->mt_nsuffix ) ) {
846
			snprintf( c->cr_msg, sizeof(c->cr_msg),
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
				"DN=\"%s\" is not a subtree of target \"%s\"",
				pattern, mt->mt_nsuffix.bv_val );
			ber_memfree( ndn.bv_val );
			return( 1 );
		}
		} break;

	default:
		/* silence warnings */
		break;
	}

	ms = ch_calloc( sizeof( metasubtree_t ), 1 );
	ms->ms_type = type;

	switch ( ms->ms_type ) {
	case META_ST_SUBTREE:
	case META_ST_SUBORDINATE:
		ms->ms_dn = ndn;
		break;

	case META_ST_REGEX: {
		int rc;

		rc = regcomp( &ms->ms_regex, pattern, REG_EXTENDED|REG_ICASE );
		if ( rc != 0 ) {
			char regerr[ SLAP_TEXT_BUFLEN ];

			regerror( rc, &ms->ms_regex, regerr, sizeof(regerr) );

877
			snprintf( c->cr_msg, sizeof( c->cr_msg ),
878
879
880
881
882
				"regular expression \"%s\" bad because of %s",
				pattern, regerr );
			ch_free( ms );
			return 1;
		}
Howard Chu's avatar
Howard Chu committed
883
		ber_str2bv( pattern, 0, 1, &ms->ms_regex_pattern );
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
		} break;
	}

	if ( mt->mt_subtree == NULL ) {
		 mt->mt_subtree = ms;

	} else {
		metasubtree_t **msp;

		for ( msp = &mt->mt_subtree; *msp; ) {
			switch ( ms->ms_type ) {
			case META_ST_SUBTREE:
				switch ( (*msp)->ms_type ) {
				case META_ST_SUBTREE:
					if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
						metasubtree_t *tmp = *msp;
						Debug( LDAP_DEBUG_CONFIG,
							"%s: previous rule \"dn.subtree:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
902
							c->log, pattern, (*msp)->ms_dn.bv_val );
903
904
905
906
907
908
909
910
						*msp = (*msp)->ms_next;
						tmp->ms_next = NULL;
						meta_subtree_destroy( tmp );
						continue;

					} else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) ) {
						Debug( LDAP_DEBUG_CONFIG,
							"%s: previous rule \"dn.subtree:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
911
							c->log, (*msp)->ms_dn.bv_val, pattern );
912
913
914
915
916
917
918
919
920
921
922
						meta_subtree_destroy( ms );
						ms = NULL;
						return( 0 );
					}
					break;

				case META_ST_SUBORDINATE:
					if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
						metasubtree_t *tmp = *msp;
						Debug( LDAP_DEBUG_CONFIG,
							"%s: previous rule \"dn.children:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
923
							c->log, pattern, (*msp)->ms_dn.bv_val );
924
925
926
927
928
929
930
931
						*msp = (*msp)->ms_next;
						tmp->ms_next = NULL;
						meta_subtree_destroy( tmp );
						continue;

					} else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) && ms->ms_dn.bv_len > (*msp)->ms_dn.bv_len ) {
						Debug( LDAP_DEBUG_CONFIG,
							"%s: previous rule \"dn.children:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
932
							c->log, (*msp)->ms_dn.bv_val, pattern );
933
934
935
936
937
938
939
940
941
942
						meta_subtree_destroy( ms );
						ms = NULL;
						return( 0 );
					}
					break;

				case META_ST_REGEX:
					if ( regexec( &(*msp)->ms_regex, ms->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
						Debug( LDAP_DEBUG_CONFIG,
							"%s: previous rule \"dn.regex:%s\" may contain rule \"dn.subtree:%s\"\n",
Howard Chu's avatar
Howard Chu committed
943
							c->log, (*msp)->ms_regex_pattern.bv_val, ms->ms_dn.bv_val );
944
945
946
947
948
949
950
951
952
953
954
955
					}
					break;
				}
				break;

			case META_ST_SUBORDINATE:
				switch ( (*msp)->ms_type ) {
				case META_ST_SUBTREE:
					if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
						metasubtree_t *tmp = *msp;
						Debug( LDAP_DEBUG_CONFIG,
							"%s: previous rule \"dn.children:%s\" is contained in rule \"dn.subtree:%s\" (replaced)\n",
956
							c->log, pattern, (*msp)->ms_dn.bv_val );
957
958
959
960
961
962
963
964
						*msp = (*msp)->ms_next;
						tmp->ms_next = NULL;
						meta_subtree_destroy( tmp );
						continue;

					} else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) && ms->ms_dn.bv_len > (*msp)->ms_dn.bv_len ) {
						Debug( LDAP_DEBUG_CONFIG,
							"%s: previous rule \"dn.children:%s\" contains rule \"dn.subtree:%s\" (ignored)\n",
965
							c->log, (*msp)->ms_dn.bv_val, pattern );
966
967
968
969
970
971
972
973
974
975
976
						meta_subtree_destroy( ms );
						ms = NULL;
						return( 0 );
					}
					break;

				case META_ST_SUBORDINATE:
					if ( dnIsSuffix( &(*msp)->ms_dn, &ms->ms_dn ) ) {
						metasubtree_t *tmp = *msp;
						Debug( LDAP_DEBUG_CONFIG,
							"%s: previous rule \"dn.children:%s\" is contained in rule \"dn.children:%s\" (replaced)\n",
977
							c->log, pattern, (*msp)->ms_dn.bv_val );
978
979
980
981
982
983
984
985
						*msp = (*msp)->ms_next;
						tmp->ms_next = NULL;
						meta_subtree_destroy( tmp );
						continue;

					} else if ( dnIsSuffix( &ms->ms_dn, &(*msp)->ms_dn ) ) {
						Debug( LDAP_DEBUG_CONFIG,
							"%s: previous rule \"dn.children:%s\" contains rule \"dn.children:%s\" (ignored)\n",
986
							c->log, (*msp)->ms_dn.bv_val, pattern );
987
988
989
990
991
992
993
994
995
996
						meta_subtree_destroy( ms );
						ms = NULL;
						return( 0 );
					}
					break;

				case META_ST_REGEX:
					if ( regexec( &(*msp)->ms_regex, ms->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
						Debug( LDAP_DEBUG_CONFIG,
							"%s: previous rule \"dn.regex:%s\" may contain rule \"dn.subtree:%s\"\n",
Howard Chu's avatar
Howard Chu committed
997
							c->log, (*msp)->ms_regex_pattern.bv_val, ms->ms_dn.bv_val );
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
					}
					break;
				}
				break;

			case META_ST_REGEX:
				switch ( (*msp)->ms_type ) {
				case META_ST_SUBTREE:
				case META_ST_SUBORDINATE:
					if ( regexec( &ms->ms_regex, (*msp)->ms_dn.bv_val, 0, NULL, 0 ) == 0 ) {
						Debug( LDAP_DEBUG_CONFIG,
							"%s: previous rule \"dn.subtree:%s\" may be contained in rule \"dn.regex:%s\"\n",
Howard Chu's avatar
Howard Chu committed
1010
							c->log, (*msp)->ms_dn.bv_val, ms->ms_regex_pattern.bv_val );
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
					}
					break;

				case META_ST_REGEX:
					/* no check possible */
					break;
				}
				break;
			}

			msp = &(*msp)->ms_next;
		}

		*msp = ms;
	}

	return 0;
}
1029

1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
static slap_verbmasks idassert_mode[] = {
	{ BER_BVC("self"),		LDAP_BACK_IDASSERT_SELF },
	{ BER_BVC("anonymous"),		LDAP_BACK_IDASSERT_ANONYMOUS },
	{ BER_BVC("none"),		LDAP_BACK_IDASSERT_NOASSERT },
	{ BER_BVC("legacy"),		LDAP_BACK_IDASSERT_LEGACY },
	{ BER_BVNULL,			0 }
};

static slap_verbmasks tls_mode[] = {
	{ BER_BVC( "propagate" ),	LDAP_BACK_F_TLS_PROPAGATE_MASK },
	{ BER_BVC( "try-propagate" ),	LDAP_BACK_F_PROPAGATE_TLS },
	{ BER_BVC( "start" ),		LDAP_BACK_F_TLS_USE_MASK },
	{ BER_BVC( "try-start" ),	LDAP_BACK_F_USE_TLS },
	{ BER_BVC( "ldaps" ),		LDAP_BACK_F_TLS_LDAPS },
	{ BER_BVC( "none" ),		LDAP_BACK_F_NONE },
	{ BER_BVNULL,			0 }
};

static slap_verbmasks t_f_mode[] = {
	{ BER_BVC( "yes" ),		LDAP_BACK_F_T_F },
	{ BER_BVC( "discover" ),	LDAP_BACK_F_T_F_DISCOVER },
	{ BER_BVC( "no" ),		LDAP_BACK_F_NONE },
	{ BER_BVNULL,			0 }
};

static slap_verbmasks cancel_mode[] = {
	{ BER_BVC( "ignore" ),		LDAP_BACK_F_CANCEL_IGNORE },
	{ BER_BVC( "exop" ),		LDAP_BACK_F_CANCEL_EXOP },
	{ BER_BVC( "exop-discover" ),	LDAP_BACK_F_CANCEL_EXOP_DISCOVER },
	{ BER_BVC( "abandon" ),		LDAP_BACK_F_CANCEL_ABANDON },
	{ BER_BVNULL,			0 }
};

static slap_verbmasks onerr_mode[] = {
	{ BER_BVC( "stop" ),		META_BACK_F_ONERR_STOP },
	{ BER_BVC( "report" ),	META_BACK_F_ONERR_REPORT },
	{ BER_BVC( "continue" ),		LDAP_BACK_F_NONE },
	{ BER_BVNULL,			0 }
};

/* see enum in slap.h */
static slap_cf_aux_table timeout_table[] = {
	{ BER_BVC("bind="),	SLAP_OP_BIND * sizeof( time_t ),	'u', 0, NULL },
	/* unbind makes no sense */
	{ BER_BVC("add="),	SLAP_OP_ADD * sizeof( time_t ),		'u', 0, NULL },
	{ BER_BVC("delete="),	SLAP_OP_DELETE * sizeof( time_t ),	'u', 0, NULL },
	{ BER_BVC("modrdn="),	SLAP_OP_MODRDN * sizeof( time_t ),	'u', 0, NULL },
	{ BER_BVC("modify="),	SLAP_OP_MODIFY * sizeof( time_t ),	'u', 0, NULL },
	{ BER_BVC("compare="),	SLAP_OP_COMPARE * sizeof( time_t ),	'u', 0, NULL },
	{ BER_BVC("search="),	SLAP_OP_SEARCH * sizeof( time_t ),	'u', 0, NULL },
	/* abandon makes little sense */
#if 0	/* not implemented yet */
	{ BER_BVC("extended="),	SLAP_OP_EXTENDED * sizeof( time_t ),	'u', 0, NULL },
#endif
	{ BER_BVNULL, 0, 0, 0, NULL }
};

1087
1088
1089
1090
1091
1092
1093
1094
1095
static int
meta_cf_cleanup( ConfigArgs *c )
{
	metainfo_t	*mi = ( metainfo_t * )c->be->be_private;
	metatarget_t	*mt = c->ca_private;

	return meta_target_finish( mi, mt, c->log, c->cr_msg, sizeof( c->cr_msg ));
}

1096
1097
static int
meta_back_cf_gen( ConfigArgs *c )
Pierangelo Masarati's avatar
Pierangelo Masarati committed
1098
{
1099
	metainfo_t	*mi = ( metainfo_t * )c->be->be_private;
1100
1101
1102
	metatarget_t	*mt;
	metacommon_t	*mc;

1103
	int i, rc = 0;
Pierangelo Masarati's avatar
Pierangelo Masarati committed
1104

1105
	assert( mi != NULL );
Pierangelo Masarati's avatar
Pierangelo Masarati committed
1106

1107
	if ( c->op == SLAP_CONFIG_EMIT || c->op == LDAP_MOD_DELETE ) {
Howard Chu's avatar
Howard Chu committed
1108
1109
1110
		if ( !mi )
			return 1;

Howard Chu's avatar
Howard Chu committed
1111
1112
1113
1114
		if ( c->table == Cft_Database ) {
			mt = NULL;
			mc = &mi->mi_mc;
		} else {
Howard Chu's avatar
Howard Chu committed
1115
			mt = c->ca_private;
Howard Chu's avatar
Howard Chu committed
1116
			mc = &mt->mt_mc;
Howard Chu's avatar
Howard Chu committed
1117
		}
1118
1119
1120
1121
	}

	if ( c->op == SLAP_CONFIG_EMIT ) {
		struct berval bv = BER_BVNULL;
Howard Chu's avatar
Howard Chu committed
1122
1123

		switch( c->type ) {
Howard Chu's avatar
Howard Chu committed
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
		/* Base attrs */
		case LDAP_BACK_CFG_CONN_TTL:
			if ( mi->mi_conn_ttl == 0 ) {
				return 1;
			} else {
				char	buf[ SLAP_TEXT_BUFLEN ];

				lutil_unparse_time( buf, sizeof( buf ), mi->mi_conn_ttl );
				ber_str2bv( buf, 0, 0, &bv );
				value_add_one( &c->rvalue_vals, &bv );
			}
			break;

		case LDAP_BACK_CFG_DNCACHE_TTL:
			if ( mi->mi_cache.ttl == META_DNCACHE_DISABLED ) {
				return 1;
			} else if ( mi->mi_cache.ttl == META_DNCACHE_FOREVER ) {
				BER_BVSTR( &bv, "forever" );
			} else {
				char	buf[ SLAP_TEXT_BUFLEN ];

				lutil_unparse_time( buf, sizeof( buf ), mi->mi_cache.ttl );
				ber_str2bv( buf, 0, 0, &bv );
			}
			value_add_one( &c->rvalue_vals, &bv );
			break;

		case LDAP_BACK_CFG_IDLE_TIMEOUT:
			if ( mi->mi_idle_timeout == 0 ) {
				return 1;
			} else {
				char	buf[ SLAP_TEXT_BUFLEN ];

				lutil_unparse_time( buf, sizeof( buf ), mi->mi_idle_timeout );
				ber_str2bv( buf, 0, 0, &bv );
				value_add_one( &c->rvalue_vals, &bv );
			}
			break;

		case LDAP_BACK_CFG_ONERR:
			enum_to_verb( onerr_mode, mi->mi_flags & META_BACK_F_ONERR_MASK, &bv );
			if ( BER_BVISNULL( &bv )) {
				rc = 1;
			} else {
				value_add_one( &c->rvalue_vals, &bv );
			}
			break;

		case LDAP_BACK_CFG_PSEUDOROOT_BIND_DEFER:
			c->value_int = META_BACK_DEFER_ROOTDN_BIND( mi );
			break;

		case LDAP_BACK_CFG_SINGLECONN:
			c->value_int = LDAP_BACK_SINGLECONN( mi );
			break;

		case LDAP_BACK_CFG_USETEMP:
			c->value_int = LDAP_BACK_USE_TEMPORARIES( mi );
			break;

		case LDAP_BACK_CFG_CONNPOOLMAX:
			c->value_int = mi->mi_conn_priv_max;
			break;

		/* common attrs */
		case LDAP_BACK_CFG_BIND_TIMEOUT:
			if ( mc->mc_bind_timeout.tv_sec == 0 &&
				mc->mc_bind_timeout.tv_usec == 0 ) {
				return 1;
			} else {
				c->value_ulong = mc->mc_bind_timeout.tv_sec * 1000000UL +
					mc->mc_bind_timeout.tv_usec;
			}
			break;

		case LDAP_BACK_CFG_CANCEL: {
			slap_mask_t	mask = LDAP_BACK_F_CANCEL_MASK2;

			if ( mt && META_BACK_TGT_CANCEL_DISCOVER( mt ) ) {
				mask &= ~LDAP_BACK_F_CANCEL_EXOP;
			}
			enum_to_verb( cancel_mode, (mc->mc_flags & mask), &bv );
			if ( BER_BVISNULL( &bv ) ) {
				/* there's something wrong... */
				assert( 0 );
				rc = 1;

			} else {
				value_add_one( &c->rvalue_vals, &bv );
			}
			} break;

		case LDAP_BACK_CFG_CHASE:
			c->value_int = META_BACK_CMN_CHASE_REFERRALS(mc);
			break;

#ifdef SLAPD_META_CLIENT_PR
		case LDAP_BACK_CFG_CLIENT_PR:
			if ( mc->mc_ps == META_CLIENT_PR_DISABLE ) {
				return 1;
			} else if ( mc->mc_ps == META_CLIENT_PR_ACCEPT_UNSOLICITED ) {
				BER_BVSTR( &bv, "accept-unsolicited" );
			} else {
				bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d", mc->mc_ps );
				bv.bv_val = c->cr_msg;
			}
			value_add_one( &c->rvalue_vals, &bv );
			break;
#endif /* SLAPD_META_CLIENT_PR */

		case LDAP_BACK_CFG_DEFAULT_T:
			if ( mt || mi->mi_defaulttarget == META_DEFAULT_TARGET_NONE )
				return 1;
			bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d", mi->mi_defaulttarget );
			bv.bv_val = c->cr_msg;
			value_add_one( &c->rvalue_vals, &bv );
			break;

		case LDAP_BACK_CFG_NETWORK_TIMEOUT:
			if ( mc->mc_network_timeout == 0 ) {
				return 1;
1245
1246
1247
1248
1249
			} else {
				char	buf[ SLAP_TEXT_BUFLEN ];
				lutil_unparse_time( buf, sizeof( buf ), mc->mc_network_timeout );
				ber_str2bv( buf, 0, 0, &bv );
				value_add_one( &c->rvalue_vals, &bv );
Howard Chu's avatar
Howard Chu committed
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
			}
			break;

		case LDAP_BACK_CFG_NOREFS:
			c->value_int = META_BACK_CMN_NOREFS(mc);
			break;

		case LDAP_BACK_CFG_NOUNDEFFILTER:
			c->value_int = META_BACK_CMN_NOUNDEFFILTER(mc);
			break;

		case LDAP_BACK_CFG_NRETRIES:
			if ( mc->mc_nretries == META_RETRY_FOREVER ) {
				BER_BVSTR( &bv, "forever" );
			} else if ( mc->mc_nretries == META_RETRY_NEVER ) {
				BER_BVSTR( &bv, "never" );
			} else {
				bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%d",
					mc->mc_nretries );
				bv.bv_val = c->cr_msg;
			}
			value_add_one( &c->rvalue_vals, &bv );
			break;

		case LDAP_BACK_CFG_QUARANTINE:
			if ( !META_BACK_CMN_QUARANTINE( mc )) {
				rc = 1;
				break;
			}
			rc = mi->mi_ldap_extra->retry_info_unparse( &mc->mc_quarantine, &bv );
			if ( rc == 0 ) {
				ber_bvarray_add( &c->rvalue_vals, &bv );
			}
			break;

		case LDAP_BACK_CFG_REBIND:
			c->value_int = META_BACK_CMN_SAVECRED(mc);
			break;

		case LDAP_BACK_CFG_TIMEOUT:
			for ( i = 0; i < SLAP_OP_LAST; i++ ) {
				if ( mc->mc_timeout[ i ] != 0 ) {
					break;
				}
			}

			if ( i == SLAP_OP_LAST ) {
				return 1;
			}

			BER_BVZERO( &bv );
			slap_cf_aux_table_unparse( mc->mc_timeout, &bv, timeout_table );

			if ( BER_BVISNULL( &bv ) ) {
				return 1;
			}

			for ( i = 0; isspace( (unsigned char) bv.bv_val[ i ] ); i++ )
				/* count spaces */ ;

			if ( i ) {
				bv.bv_len -= i;
				AC_MEMCPY( bv.bv_val, &bv.bv_val[ i ],
					bv.bv_len + 1 );
			}

			ber_bvarray_add( &c->rvalue_vals, &bv );
			break;

		case LDAP_BACK_CFG_VERSION:
			if ( mc->mc_version == 0 )
				return 1;
			c->value_int = mc->mc_version;
			break;

#ifdef SLAP_CONTROL_X_SESSION_TRACKING
		case LDAP_BACK_CFG_ST_REQUEST:
			c->value_int = META_BACK_CMN_ST_REQUEST( mc );
			break;
#endif /* SLAP_CONTROL_X_SESSION_TRACKING */

		case LDAP_BACK_CFG_T_F:
			enum_to_verb( t_f_mode, (mc->mc_flags & LDAP_BACK_F_T_F_MASK2), &bv );
			if ( BER_BVISNULL( &bv ) ) {
				/* there's something wrong... */
				assert( 0 );
				rc = 1;

			} else {
				value_add_one( &c->rvalue_vals, &bv );
			}
			break;

		case LDAP_BACK_CFG_TLS: {
			struct berval bc = BER_BVNULL, bv2;

			if (( mc->mc_flags & LDAP_BACK_F_TLS_MASK ) == LDAP_BACK_F_NONE ) {
				rc = 1;
				break;
			}
			enum_to_verb( tls_mode, ( mc->mc_flags & LDAP_BACK_F_TLS_MASK ), &bv );
			assert( !BER_BVISNULL( &bv ) );

			if ( mt ) {
				bindconf_tls_unparse( &mt->mt_tls, &bc );
			}

			if ( !BER_BVISEMPTY( &bc )) {
				bv2.bv_len = bv.bv_len + bc.bv_len + 1;
				bv2.bv_val = ch_malloc( bv2.bv_len + 1 );
				strcpy( bv2.bv_val, bv.bv_val );
				bv2.bv_val[bv.bv_len] = ' ';
				strcpy( &bv2.bv_val[bv.bv_len + 1], bc.bv_val );
				ber_memfree( bc.bv_val );
				ber_bvarray_add( &c->rvalue_vals, &bv2 );
			} else {
				value_add_one( &c->rvalue_vals, &bv );
			}
			} break;

		/* target attrs */
		case LDAP_BACK_CFG_URI: {
			char *p2, *p1 = strchr( mt->mt_uri, ' ' );
1373
			bv.bv_len = strlen( mt->mt_uri ) + 3 + mt->mt_psuffix.bv_len;
Howard Chu's avatar
Howard Chu committed
1374
			bv.bv_val = ch_malloc( bv.bv_len + 1 );
1375
1376
			p2 = bv.bv_val;
			*p2++ = '"';
Howard Chu's avatar
Howard Chu committed
1377
			if ( p1 ) {
1378
				p2 = lutil_strncopy( p2, mt->mt_uri, p1 - mt->mt_uri );
Howard Chu's avatar
Howard Chu committed
1379
			} else {
1380
				p2 = lutil_strcopy( p2, mt->mt_uri );
Howard Chu's avatar
Howard Chu committed
1381
1382
1383
			}
			*p2++ = '/';
			p2 = lutil_strcopy( p2, mt->mt_psuffix.bv_val );
1384
			*p2++ = '"';
Howard Chu's avatar
Howard Chu committed
1385
1386
1387
			if ( p1 ) {
				strcpy( p2, p1 );
			}
Pierangelo Masarati's avatar
Pierangelo Masarati committed
1388
			ber_bvarray_add( &c->rvalue_vals, &bv );
Howard Chu's avatar
Howard Chu committed
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
			} break;

		case LDAP_BACK_CFG_IDASSERT_AUTHZFROM: {
			BerVarray	*bvp;
			int		i;
			struct berval	bv = BER_BVNULL;
			char		buf[SLAP_TEXT_BUFLEN];

			bvp = &mt->mt_idassert_authz;
			if ( *bvp == NULL ) {
				if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_AUTHZ_ALL )
				{
					BER_BVSTR( &bv, "*" );
					value_add_one( &c->rvalue_vals, &bv );

				} else {
					rc = 1;
				}
				break;
			}

			for ( i = 0; !BER_BVISNULL( &((*bvp)[ i ]) ); i++ ) {
				char *ptr;
				int len = snprintf( buf, sizeof( buf ), SLAP_X_ORDERED_FMT, i );
				bv.bv_len = ((*bvp)[ i ]).bv_len + len;
1414
				bv.bv_val = ch_realloc( bv.bv_val, bv.bv_len + 1 );
Howard Chu's avatar
Howard Chu committed
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
				ptr = bv.bv_val;
				ptr = lutil_strcopy( ptr, buf );
				ptr = lutil_strncopy( ptr, ((*bvp)[ i ]).bv_val, ((*bvp)[ i ]).bv_len );
				value_add_one( &c->rvalue_vals, &bv );
			}
			if ( bv.bv_val ) {
				ber_memfree( bv.bv_val );
			}
			break;
		}

		case LDAP_BACK_CFG_IDASSERT_BIND: {
			int		i;
			struct berval	bc = BER_BVNULL;
			char		*ptr;

			if ( mt->mt_idassert_authmethod == LDAP_AUTH_NONE ) {
				return 1;
			} else {
				ber_len_t	len;

				switch ( mt->mt_idassert_mode ) {
				case LDAP_BACK_IDASSERT_OTHERID:
				case LDAP_BACK_IDASSERT_OTHERDN:
					break;

				default: {
					struct berval	mode = BER_BVNULL;

					enum_to_verb( idassert_mode, mt->mt_idassert_mode, &mode );
					if ( BER_BVISNULL( &mode ) ) {
						/* there's something wrong... */
						assert( 0 );
						rc = 1;

					} else {
						bv.bv_len = STRLENOF( "mode=" ) + mode.bv_len;
						bv.bv_val = ch_malloc( bv.bv_len + 1 );

						ptr = lutil_strcopy( bv.bv_val, "mode=" );
						ptr = lutil_strcopy( ptr, mode.bv_val );
					}
					break;
				}
				}

				if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_NATIVE_AUTHZ ) {
					len = bv.bv_len + STRLENOF( "authz=native" );

					if ( !BER_BVISEMPTY( &bv ) ) {
						len += STRLENOF( " " );
					}

					bv.bv_val = ch_realloc( bv.bv_val, len + 1 );

					ptr = &bv.bv_val[ bv.bv_len ];

					if ( !BER_BVISEMPTY( &bv ) ) {
						ptr = lutil_strcopy( ptr, " " );
					}

					(void)lutil_strcopy( ptr, "authz=native" );
				}

				len = bv.bv_len + STRLENOF( "flags=non-prescriptive,override,obsolete-encoding-workaround,proxy-authz-non-critical,dn-authzid" );
				/* flags */
				if ( !BER_BVISEMPTY( &bv ) ) {
					len += STRLENOF( " " );
				}

				bv.bv_val = ch_realloc( bv.bv_val, len + 1 );

				ptr = &bv.bv_val[ bv.bv_len ];

				if ( !BER_BVISEMPTY( &bv ) ) {
					ptr = lutil_strcopy( ptr, " " );
				}

				ptr = lutil_strcopy( ptr, "flags=" );

				if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_PRESCRIPTIVE ) {
					ptr = lutil_strcopy( ptr, "prescriptive" );
				} else {
					ptr = lutil_strcopy( ptr, "non-prescriptive" );
				}

				if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OVERRIDE ) {
					ptr = lutil_strcopy( ptr, ",override" );
				}

				if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_PROXY_AUTHZ ) {
					ptr = lutil_strcopy( ptr, ",obsolete-proxy-authz" );

				} else if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_ENCODING_WORKAROUND ) {
					ptr = lutil_strcopy( ptr, ",obsolete-encoding-workaround" );
				}

				if ( mt->mt_idassert_flags & LDAP_BACK_AUTH_PROXYAUTHZ_CRITICAL ) {
					ptr = lutil_strcopy( ptr, ",proxy-authz-critical" );

				} else {
					ptr = lutil_strcopy( ptr, ",proxy-authz-non-critical" );
				}

1519
#ifdef SLAP_AUTH_DN
Howard Chu's avatar
Howard Chu committed
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
				switch ( mt->mt_idassert_flags & LDAP_BACK_AUTH_DN_MASK ) {
				case LDAP_BACK_AUTH_DN_AUTHZID:
					ptr = lutil_strcopy( ptr, ",dn-authzid" );
					break;

				case LDAP_BACK_AUTH_DN_WHOAMI:
					ptr = lutil_strcopy( ptr, ",dn-whoami" );
					break;

				default:
#if 0 /* implicit */
					ptr = lutil_strcopy( ptr, ",dn-none" );
#endif
					break;
				}
1535
#endif
Howard Chu's avatar
Howard Chu committed
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565

				bv.bv_len = ( ptr - bv.bv_val );
				/* end-of-flags */
			}

			bindconf_unparse( &mt->mt_idassert.si_bc, &bc );

			if ( !BER_BVISNULL( &bv ) ) {
				ber_len_t	len = bv.bv_len + bc.bv_len;

				bv.bv_val = ch_realloc( bv.bv_val, len + 1 );

				assert( bc.bv_val[ 0 ] == ' ' );

				ptr = lutil_strcopy( &bv.bv_val[ bv.bv_len ], bc.bv_val );
				free( bc.bv_val );
				bv.bv_len = ptr - bv.bv_val;

			} else {
				for ( i = 0; isspace( (unsigned char) bc.bv_val[ i ] ); i++ )
					/* count spaces */ ;

				if ( i ) {
					bc.bv_len -= i;
					AC_MEMCPY( bc.bv_val, &bc.bv_val[ i ], bc.bv_len + 1 );
				}

				bv = bc;
			}

Howard Chu's avatar
Howard Chu committed
1566
			ber_bvarray_add( &c->rvalue_vals, &bv );
Howard Chu's avatar
Howard Chu committed
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592

			break;
		}

		case LDAP_BACK_CFG_SUFFIXM:	/* unused */
		case LDAP_BACK_CFG_REWRITE:
			if ( mt->mt_rwmap.rwm_bva_rewrite == NULL ) {
				rc = 1;
			} else {
				rc = slap_bv_x_ordered_unparse( mt->mt_rwmap.rwm_bva_rewrite, &c->rvalue_vals );
			}
			break;

		case LDAP_BACK_CFG_MAP:
			if ( mt->mt_rwmap.rwm_bva_map == NULL ) {
				rc = 1;
			} else {
				rc = slap_bv_x_ordered_unparse( mt->mt_rwmap.rwm_bva_map, &c->rvalue_vals );
			}
			break;

		case LDAP_BACK_CFG_SUBTREE_EX:
		case LDAP_BACK_CFG_SUBTREE_IN:
			rc = meta_subtree_unparse( c, mt );
			break;

1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
		case LDAP_BACK_CFG_FILTER:
			if ( mt->mt_filter == NULL ) {
				rc = 1;
			} else {
				metafilter_t *mf;
				for ( mf = mt->mt_filter; mf; mf = mf->mf_next )
					value_add_one( &c->rvalue_vals, &mf->mf_regex_pattern );
			}
			break;