Merge remote-tracking branch 'origin/master' into OPENLDAP_REL_ENG_2_5

configure

 #! /bin/sh
-# From configure.in Id: 2472f0d67572d1598a1bcf538258060cad2ade54 .
+# From configure.in Id: 23df2db4590e7ba996c9a2724000d32945a26248 .
 # Guess values for system-dependent variables and create Makefiles.
 # Generated by GNU Autoconf 2.69.
 #
@@ -15462,6 +15462,18 @@ _ACEOF
 fi
 done
+for ac_func in fmemopen
+do :
+  as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
+ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
+if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+  cat >>confdefs.h <<_ACEOF
+#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+_ACEOF
+
+fi
+done
+
 if test $ac_cv_func_sigaction = no && test $ac_cv_func_sigaction = no ; then
 	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for sigset in -lV3" >&5

configure.in

@@ -860,6 +860,7 @@ dnl ----------------------------------------------------------------
 dnl Checks for libraries
 
 AC_CHECK_FUNCS( sigaction sigset )
+AC_CHECK_FUNCS( fmemopen )
 
 dnl HP-UX requires -lV3
 dnl this is not needed on newer versions of HP-UX

contrib/slapd-modules/autogroup/autogroup.c

@@ -1713,7 +1713,7 @@ static ConfigDriver	ag_cfgen;
 static ConfigTable agcfg[] = {
 	{ "autogroup-attrset", "group-oc> <URL-ad> <member-ad",
 		4, 4, 0, ARG_MAGIC|AG_ATTRSET, ag_cfgen,
-		"( OLcfgCtAt:2.1 NAME 'olcAGattrSet' "
+		"( OLcfgCtAt:2.1 NAME ( 'olcAutoGroupAttrSet' 'olcAGattrSet' ) "
 			"DESC 'Automatic groups: <group objectClass>, <URL attributeDescription>, <member attributeDescription>' "
 			"EQUALITY caseIgnoreMatch "
 			"SYNTAX OMsDirectoryString "
@@ -1722,7 +1722,7 @@ static ConfigTable agcfg[] = {
 	
 	{ "autogroup-memberof-ad", "memberOf attribute",
 		2, 2, 0, ARG_MAGIC|AG_MEMBER_OF_AD, ag_cfgen,
-		"( OLcfgCtAt:2.2 NAME 'olcAGmemberOfAd' "
+		"( OLcfgCtAt:2.2 NAME ( 'olcAutoGroupMemberOfAd' 'olcAGmemberOfAd' ) "
 			"DESC 'memberOf attribute' "
 			"EQUALITY caseIgnoreMatch "
 			"SYNTAX OMsDirectoryString SINGLE-VALUE )",
@@ -1733,12 +1733,12 @@ static ConfigTable agcfg[] = {
 
 static ConfigOCs agocs[] = {
 	{ "( OLcfgCtOc:2.1 "
-		"NAME 'olcAutomaticGroups' "
+		"NAME 'olcAutoGroupConfig' "
 		"DESC 'Automatic groups configuration' "
 		"SUP olcOverlayConfig "
 		"MAY ( "
-			"olcAGattrSet "
-			"$ olcAGmemberOfAd "
+			"olcAutoGroupAttrSet "
+			"$ olcAutoGroupMemberOfAd "
 		    ")"
 	  ")",
 		Cft_Overlay, agcfg, NULL, NULL },

contrib/slapd-modules/autogroup/slapo-autogroup.5

@@ -39,7 +39,7 @@ here for convenience:
 .TP
 .B \FCautogroup-attrset\FT <group-oc> <URL-ad> <member-ad>
 .TP
-.B \FColcAGattrSet:\FT <group-oc> <URL-ad> <member-ad>
+.B \FColcAutoGroupAttrSet:\FT <group-oc> <URL-ad> <member-ad>
 This defines the objectclass-attribute-URI mappings defining the
 automatically managed groups, and may appear multiple times.
 
@@ -57,7 +57,7 @@ disabled for consistency.
 .TP
 .B \FCautogroup-memberof-ad\FT <memberof-ad>
 .TP
-.B \FColcAGmemberOfAd\FT <memberof-ad>
+.B \FColcAutoGroupMemberOfAd\FT <memberof-ad>
 This defines the attribute that is used by the memberOf overlay to
 store the names of groups that an entry is member of; it must be
 DN-valued. It should be set to the same value as
@@ -88,6 +88,15 @@ cases the overlay will try to detect if groups have been modified and
 then simply refresh them. This can cause performance hits if the
 search specified by the URI deals with a significant number of
 entries.
+.SH BACKWARD COMPATIBILITY
+The autogroup overlay has been reworked with the 2.5 release to use
+a consistent namespace as with other overlays. As a side-effect the
+following cn=config parameters are deprecated and will be removed in
+a future release:
+.B olcAGattrSet
+is replaced with olcAutoGroupAttrSet
+.B olcAGmemberOfAd
+is replaced with olcAutoGroupMemberOfAd
 .SH ACKNOWLEDGEMENTS
 This module was originally written in 2007 by Michał
 Szulczyński.  Further enhancements were contributed by Howard

contrib/slapd-modules/passwd/argon2/Makefile

@@ -31,9 +31,7 @@ PROGRAMS = pw-argon2.la
 MANPAGES = slapd-pw-argon2.5
 LTVER = 0:0:0
 
-#prefix=/usr/local
-prefix=`grep -e "^prefix =" $(LDAP_BUILD)/Makefile | cut -d= -f2`
-
+prefix=/usr/local
 exec_prefix=$(prefix)
 ldap_subdir=/openldap
 

contrib/slapd-modules/passwd/pbkdf2/Makefile

@@ -22,9 +22,7 @@ PROGRAMS = pw-pbkdf2.la
 MANPAGES = slapd-pw-pbkdf2.5
 LTVER = 0:0:0
 
-#prefix=/usr/local
-prefix=`grep -e "^prefix =" $(LDAP_BUILD)/Makefile | cut -d= -f2`
-
+prefix=/usr/local
 exec_prefix=$(prefix)
 ldap_subdir=/openldap
 

doc/devel/todo

@@ -61,12 +61,7 @@ Update manual pages as needed.
 
 
 For additional TODO items, see:
-  http://www.openldap.org/its/index.cgi/Software%20Enhancements
-  http://www.openldap.org/its/index.cgi/Software%20Bugs
-
-
-JLDAP TODO items, see:
-  http://www.openldap.org/devel/gitweb.cgi?p=openldap-jldap.git;a=blob_plain;f=design/todo.txt
+  https://bugs.openldap.org
 
 ---
 $OpenLDAP$

doc/guide/admin/overlays.sdf

@@ -558,9 +558,9 @@ In {{F:slapd.conf}}(5):
 >       ...
 >       overlay dynlist
 >       dynlist-attrset groupOfURLs labeledURI member
-+
-+Note: We must include the {{F:dyngroup.schema}} file that defines the
-+{{F:groupOfURLs}} objectClass used in this example.
+
+Note: We must include the {{F:dyngroup.schema}} file that defines the {{F:groupOfURLs}}
+objectClass used in this example.
 
 Let's apply it to the following entry:
 

doc/man/man3/ldap_parse_result.3

@@ -24,6 +24,11 @@ int ldap_parse_sasl_bind_result( LDAP *ld, LDAPMessage *result,
 .ft B
 int ldap_parse_extended_result( LDAP *ld, LDAPMessage *result,
 	char **retoidp, struct berval **retdatap, int freeit )
+.LP
+.ft B
+int ldap_parse_intermediate( LDAP *ld, LDAPMessage *result,
+	char **retoidp, struct berval **retdatap,
+	LDAPControl ***serverctrlsp, int freeit )
 .SH DESCRIPTION
 .LP
 These routines are used to extract information from a result message.
@@ -41,7 +46,9 @@ the routines
 and
 .B ldap_parse_extended_result()
 are used to get all the result information from SASL bind and extended
-operations.
+operations. To extract information from intermediate responses,
+.B ldap_parse_intermediate()
+can be used.
 .LP
 The \fIerrcodep\fP parameter will be filled in with the result code from
 the result message.
@@ -77,13 +84,13 @@ with an allocated berval structure containing the credentials from the
 server if present. The structure should be freed using
 .BR ber_bvfree (3).
 .LP
-For extended results, the \fIretoidp\fP parameter will be filled in
+For extended results and intermediate responses, the \fIretoidp\fP parameter will be filled in
 with the dotted-OID text representation of the name of the extended
 operation response. The string should be freed using
 .BR ldap_memfree (3).
 If no OID was returned, \fI*retoidp\fP is set to NULL.
 .LP
-For extended results, the \fIretdatap\fP parameter will be filled in
+For extended results and intermediate responses, the \fIretdatap\fP parameter will be filled in
 with a pointer to a berval structure containing the data from the
 extended operation response. The structure should be freed using
 .BR ber_bvfree (3).

doc/man/man3/ldap_parse_result.3.links

 ldap_parse_sasl_bind_result.3
 ldap_parse_extended_result.3
+ldap_parse_intermediate.3

doc/man/man5/slapo-dyngroup.5

@@ -42,6 +42,15 @@ to be evaluated for the result.
 .TP
 ETCDIR/slapd.conf
 default slapd configuration file
+.SH BACKWARD COMPATIBILITY
+The dyngroup overlay has been reworked with the 2.5 release to use
+a consistent namespace as with other overlays. As a side-effect the
+following cn=config parameters are deprecated and will be removed in
+a future release:
+.B olcDGAttrPair
+is replaced with olcDynGroupAttrPair
+.B olcDGConfig
+is replaced with olcDynGroupConfig
 .SH SEE ALSO
 .BR slapd.conf (5),
 .BR slapd\-config (5).

doc/man/man5/slapo-dynlist.5

@@ -197,6 +197,15 @@ entry like
 .TP
 ETCDIR/slapd.conf
 default slapd configuration file
+.SH BACKWARD COMPATIBILITY
+The dyngroup overlay has been reworked with the 2.5 release to use
+a consistent namespace as with other overlays. As a side-effect the
+following cn=config parameters are deprecated and will be removed in
+a future release:
+.B olcDlAttrSet
+is replaced with olcDynListAttrSet
+.B olcDynamicList
+is replaced with olcDynListConfig
 .SH SEE ALSO
 .BR slapd.conf (5),
 .BR slapd\-config (5),

doc/man/man5/slapo-memberof.5

@@ -118,6 +118,13 @@ to emulate slapo-memberOf behavior.
 .TP
 ETCDIR/slapd.conf
 default slapd configuration file
+.SH BACKWARD COMPATIBILITY
+The dyngroup overlay has been reworked with the 2.5 release to use
+a consistent namespace as with other overlays. As a side-effect the
+following cn=config parameters are deprecated and will be removed in
+a future release:
+.B olcMemberOf
+is replaced with olcMemberOfConfig
 .SH SEE ALSO
 .BR slapd.conf (5),
 .BR slapd\-config (5),

include/ldif.h

@@ -99,6 +99,10 @@ typedef struct LDIFFP {
 LDAP_LDIF_F( LDIFFP * )
 ldif_open LDAP_P(( LDAP_CONST char *file, LDAP_CONST char *mode ));
 
+/* ldif_open equivalent that opens ldif stream in memory rather than from file */
+LDAP_LDIF_F( LDIFFP * )
+ldif_open_mem LDAP_P(( char *ldif, size_t size, LDAP_CONST char *mode ));
+
 LDAP_LDIF_F( void )
 ldif_close LDAP_P(( LDIFFP * ));
 

include/portable.hin

@@ -169,6 +169,9 @@
 /* Define to 1 if you have the `flock' function. */
 #undef HAVE_FLOCK
 
+/* Define to 1 if you have the `fmemopen' function. */
+#undef HAVE_FMEMOPEN
+
 /* Define to 1 if you have the `fstat' function. */
 #undef HAVE_FSTAT
 

libraries/libldap/dnssrv.c

@@ -216,36 +216,27 @@ static void srv_shuffle(srv_record *a, int n) {
 	for (i=0; i<n; i++)
 		total += a[i].weight;
 
-	/* all weights are zero, do a straight Fisher-Yates shuffle */
-	if (!total) {
-		while (n) {
-			srv_record t;
-			i = srv_rand() * n--;
-			t = a[n];
-			a[n] = a[i];
-			a[i] = t;
-		}
-		return;
-	}
-
 	/* Do a shuffle per RFC2782 Page 4 */
-	p = n;
-	for (i=0; i<n-1; i++) {
-		r = srv_rand() * total;
-		for (j=0; j<p; j++) {
-			r -= a[j].weight;
-			if (r <= 0) {
-				if (j) {
-					srv_record t = a[0];
-					a[0] = a[j];
-					a[j] = t;
+	for (p=n; p>1; a++, p--) {
+		if (!total) {
+			/* all remaining weights are zero,
+			   do a straight Fisher-Yates shuffle */
+			j = srv_rand() * p;
+		} else {
+			r = srv_rand() * total;
+			for (j=0; j<p; j++) {
+				r -= a[j].weight;
+				if (r < 0) {
+					total -= a[j].weight;
+					break;
 				}
-				total -= a[0].weight;
-				a++;
-				p--;
-				break;
 			}
 		}
+		if (j && j<p) {
+			srv_record t = a[0];
+			a[0] = a[j];
+			a[j] = t;
+		}
 	}
 }
 #endif /* HAVE_RES_QUERY */

libraries/libldap/ldif.c

@@ -740,6 +740,28 @@ ldif_open(
 	return lfp;
 }
 
+LDIFFP *
+ldif_open_mem(
+	char *ldif,
+	size_t size,
+	LDAP_CONST char *mode
+)
+{
+#ifdef HAVE_FMEMOPEN
+	FILE *fp = fmemopen( ldif, size, mode );
+	LDIFFP *lfp = NULL;
+
+	if ( fp ) {
+		lfp = ber_memalloc( sizeof( LDIFFP ));
+		lfp->fp = fp;
+		lfp->prev = NULL;
+	}
+	return lfp;
+#else /* !HAVE_FMEMOPEN */
+	return NULL;
+#endif /* !HAVE_FMEMOPEN */
+}
+
 void
 ldif_close(
 	LDIFFP *lfp

servers/slapd/back-ldap/chain.c

@@ -977,6 +977,9 @@ ldap_chain_response( Operation *op, SlapReply *rs )
 	if ( rs->sr_err != LDAP_REFERRAL && rs->sr_type != REP_SEARCHREF ) {
 		return SLAP_CB_CONTINUE;
 	}
+	if ( !rs->sr_ref ) {
+		return SLAP_CB_CONTINUE;
+	}
 
 #ifdef LDAP_CONTROL_X_CHAINING_BEHAVIOR
 	if ( rs->sr_err == LDAP_REFERRAL && get_chaining( op ) > SLAP_CONTROL_IGNORED ) {

servers/slapd/back-mdb/filterindex.c

@@ -650,7 +650,7 @@ presence_candidates(
 
 	if( rc == LDAP_INAPPROPRIATE_MATCHING ) {
 		/* not indexed */
-		Debug( LDAP_DEBUG_TRACE,
+		Debug( LDAP_DEBUG_FILTER,
 			"<= mdb_presence_candidates: (%s) not indexed\n",
 			desc->ad_cname.bv_val );
 		return 0;
@@ -734,7 +734,7 @@ equality_candidates(
 		&dbi, &mask, &prefix );
 
 	if ( rc == LDAP_INAPPROPRIATE_MATCHING ) {
-		Debug( LDAP_DEBUG_ANY,
+		Debug( LDAP_DEBUG_FILTER,
 			"<= mdb_equality_candidates: (%s) not indexed\n", 
 			ava->aa_desc->ad_cname.bv_val );
 		return 0;
@@ -850,7 +850,7 @@ approx_candidates(
 		&dbi, &mask, &prefix );
 
 	if ( rc == LDAP_INAPPROPRIATE_MATCHING ) {
-		Debug( LDAP_DEBUG_ANY,
+		Debug( LDAP_DEBUG_FILTER,
 			"<= mdb_approx_candidates: (%s) not indexed\n",
 			ava->aa_desc->ad_cname.bv_val );
 		return 0;
@@ -969,7 +969,7 @@ substring_candidates(
 		&dbi, &mask, &prefix );
 
 	if ( rc == LDAP_INAPPROPRIATE_MATCHING ) {
-		Debug( LDAP_DEBUG_ANY,
+		Debug( LDAP_DEBUG_FILTER,
 			"<= mdb_substring_candidates: (%s) not indexed\n",
 			sub->sa_desc->ad_cname.bv_val );
 		return 0;
@@ -1085,7 +1085,7 @@ inequality_candidates(
 		&dbi, &mask, &prefix );
 
 	if ( rc == LDAP_INAPPROPRIATE_MATCHING ) {
-		Debug( LDAP_DEBUG_ANY,
+		Debug( LDAP_DEBUG_FILTER,
 			"<= mdb_inequality_candidates: (%s) not indexed\n", 
 			ava->aa_desc->ad_cname.bv_val );
 		return 0;

servers/slapd/back-wt/filterindex.c

@@ -53,7 +53,7 @@ presence_candidates(
 
 	if( rc == LDAP_INAPPROPRIATE_MATCHING ) {
 		/* not indexed */
-		Debug( LDAP_DEBUG_TRACE,
+		Debug( LDAP_DEBUG_FILTER,
 			   "<= wt_presence_candidates: (%s) not indexed\n",
 			   desc->ad_cname.bv_val );
 		return 0;
@@ -135,7 +135,7 @@ equality_candidates(
 						 &mask, &prefix );
 
 	if ( rc == LDAP_INAPPROPRIATE_MATCHING ) {
-		Debug( LDAP_DEBUG_ANY,
+		Debug( LDAP_DEBUG_FILTER,
 			   "<= wt_equality_candidates: (%s) not indexed\n",
 			   ava->aa_desc->ad_cname.bv_val );
 		return 0;
@@ -254,7 +254,7 @@ approx_candidates(
 						 &mask, &prefix );
 
 	if ( rc == LDAP_INAPPROPRIATE_MATCHING ) {
-		Debug( LDAP_DEBUG_ANY,
+		Debug( LDAP_DEBUG_FILTER,
 			   "<= wt_approx_candidates: (%s) not indexed\n",
 			   ava->aa_desc->ad_cname.bv_val );
 		return 0;
@@ -385,7 +385,7 @@ substring_candidates(
 						 &mask, &prefix );
 
 	if ( rc == LDAP_INAPPROPRIATE_MATCHING ) {
-		Debug( LDAP_DEBUG_ANY,
+		Debug( LDAP_DEBUG_FILTER,
 			   "<= wt_substring_candidates: (%s) not indexed\n",
 			   sub->sa_desc->ad_cname.bv_val );
 		return 0;