ppolicy.c

/* $OpenLDAP$ */
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
 *
 * Copyright 2004-2021 The OpenLDAP Foundation.
 * Portions Copyright 2004-2005 Howard Chu, Symas Corporation.
 * Portions Copyright 2004 Hewlett-Packard Company.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted only as authorized by the OpenLDAP
 * Public License.
 *
 * A copy of this license is available in the file LICENSE in the
 * top-level directory of the distribution or, alternatively, at
 * <http://www.OpenLDAP.org/license.html>.
 */
/* ACKNOWLEDGEMENTS:
 * This work was developed by Howard Chu for inclusion in
 * OpenLDAP Software, based on prior work by Neil Dunbar (HP).
 * This work was sponsored by the Hewlett-Packard Company.
 */

#include "portable.h"

/* This file implements "Password Policy for LDAP Directories",
 * based on draft behera-ldap-password-policy-09
 */

#ifdef SLAPD_OVER_PPOLICY

#include <ldap.h>
#include "lutil.h"
#include "slap.h"
#ifdef SLAPD_MODULES
#define LIBLTDL_DLL_IMPORT	/* Win32: don't re-export libltdl's symbols */
#include <ltdl.h>
#endif
#include <ac/errno.h>
#include <ac/time.h>
#include <ac/string.h>
#include <ac/ctype.h>
#include "slap-config.h"

#ifndef MODULE_NAME_SZ
#define MODULE_NAME_SZ 256
#endif

#ifndef PPOLICY_DEFAULT_MAXRECORDED_FAILURE
#define PPOLICY_DEFAULT_MAXRECORDED_FAILURE	5
#endif

/* Per-instance configuration information */
typedef struct pp_info {
	struct berval def_policy;	/* DN of default policy subentry */
	int use_lockout;		/* send AccountLocked result? */
	int hash_passwords;		/* transparently hash cleartext pwds */
	int forward_updates;	/* use frontend for policy state updates */
	int disable_write;
	int send_netscape_controls;	/* send netscape password controls */
	ldap_pvt_thread_mutex_t pwdFailureTime_mutex;
} pp_info;

/* Our per-connection info - note, it is not per-instance, it is 
 * used by all instances
 */
typedef struct pw_conn {
	struct berval dn;	/* DN of restricted user */
} pw_conn;

static pw_conn *pwcons;
static int ppolicy_cid;
static int account_usability_cid;
static int ov_count;

typedef struct pass_policy {
	AttributeDescription *ad; /* attribute to which the policy applies */
	int pwdMinAge; /* minimum time (seconds) until passwd can change */
	int pwdMaxAge; /* time in seconds until pwd will expire after change */
	int pwdMaxIdle; /* number of seconds since last successful bind before
					   passwd gets locked out */
	int pwdInHistory; /* number of previous passwords kept */
	int pwdCheckQuality; /* 0 = don't check quality, 1 = check if possible,
						   2 = check mandatory; fail if not possible */
	int pwdMinLength; /* minimum number of chars in password */
	int pwdMaxLength; /* maximum number of chars in password */
	int pwdExpireWarning; /* number of seconds that warning controls are
							sent before a password expires */
	int pwdGraceExpiry; /* number of seconds after expiry grace logins are
						   valid */
	int pwdGraceAuthNLimit; /* number of times you can log in with an
							expired password */
	int pwdLockout; /* 0 = do not lockout passwords, 1 = lock them out */
	int pwdLockoutDuration; /* time in seconds a password is locked out for */
	int pwdMinDelay; /* base bind delay in seconds on failure */
	int pwdMaxDelay; /* maximum bind delay in seconds */
	int pwdMaxFailure; /* number of failed binds allowed before lockout */
	int pwdMaxRecordedFailure;	/* number of failed binds to store */
	int pwdFailureCountInterval; /* number of seconds before failure
									counts are zeroed */
	int pwdMustChange; /* 0 = users can use admin set password
							1 = users must change password after admin set */
	int pwdAllowUserChange; /* 0 = users cannot change their passwords
								1 = users can change them */
	int pwdSafeModify; /* 0 = old password doesn't need to come
								with password change request
							1 = password change must supply existing pwd */
	char pwdCheckModule[MODULE_NAME_SZ]; /* name of module to dynamically
										    load to check password */
	struct berval pwdCheckModuleArg; /* Optional argument to the password check
										module */
} PassPolicy;

typedef struct pw_hist {
	time_t t;	/* timestamp of history entry */
	struct berval pw;	/* old password hash */
	struct berval bv;	/* text of entire entry */
	struct pw_hist *next;
} pw_hist;

/* Operational attributes */
static AttributeDescription *ad_pwdChangedTime, *ad_pwdAccountLockedTime,
	*ad_pwdFailureTime, *ad_pwdHistory, *ad_pwdGraceUseTime, *ad_pwdReset,
	*ad_pwdPolicySubentry, *ad_pwdStartTime, *ad_pwdEndTime,
	*ad_pwdLastSuccess, *ad_pwdAccountTmpLockoutEnd;

/* Policy attributes */
static AttributeDescription *ad_pwdMinAge, *ad_pwdMaxAge, *ad_pwdMaxIdle,
	*ad_pwdInHistory, *ad_pwdCheckQuality, *ad_pwdMinLength, *ad_pwdMaxLength,
	*ad_pwdMaxFailure, *ad_pwdGraceExpiry, *ad_pwdGraceAuthNLimit,
	*ad_pwdExpireWarning, *ad_pwdMinDelay, *ad_pwdMaxDelay,
	*ad_pwdLockoutDuration, *ad_pwdFailureCountInterval,
	*ad_pwdCheckModule, *ad_pwdCheckModuleArg, *ad_pwdLockout,
	*ad_pwdMustChange, *ad_pwdAllowUserChange, *ad_pwdSafeModify,
	*ad_pwdAttribute, *ad_pwdMaxRecordedFailure;

static struct schema_info {
	char *def;
	AttributeDescription **ad;
} pwd_OpSchema[] = {
	{	"( 1.3.6.1.4.1.42.2.27.8.1.16 "
		"NAME ( 'pwdChangedTime' ) "
		"DESC 'The time the password was last changed' "
		"EQUALITY generalizedTimeMatch "
		"ORDERING generalizedTimeOrderingMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 "
		"SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )",
		&ad_pwdChangedTime },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.17 "
		"NAME ( 'pwdAccountLockedTime' ) "
		"DESC 'The time an user account was locked' "
		"EQUALITY generalizedTimeMatch "
		"ORDERING generalizedTimeOrderingMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 "
		"SINGLE-VALUE "
#if 0
		/* Not until Relax control is released */
		"NO-USER-MODIFICATION "
#endif
		"USAGE directoryOperation )",
		&ad_pwdAccountLockedTime },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.19 "
		"NAME ( 'pwdFailureTime' ) "
		"DESC 'The timestamps of the last consecutive authentication failures' "
		"EQUALITY generalizedTimeMatch "
		"ORDERING generalizedTimeOrderingMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 "
		"NO-USER-MODIFICATION USAGE directoryOperation )",
		&ad_pwdFailureTime },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.20 "
		"NAME ( 'pwdHistory' ) "
		"DESC 'The history of users passwords' "
		"EQUALITY octetStringMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 "
		"NO-USER-MODIFICATION USAGE directoryOperation )",
		&ad_pwdHistory },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.21 "
		"NAME ( 'pwdGraceUseTime' ) "
		"DESC 'The timestamps of the grace login once the password has expired' "
		"EQUALITY generalizedTimeMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 "
		"NO-USER-MODIFICATION USAGE directoryOperation )",
		&ad_pwdGraceUseTime }, 
	{	"( 1.3.6.1.4.1.42.2.27.8.1.22 "
		"NAME ( 'pwdReset' ) "
		"DESC 'The indication that the password has been reset' "
		"EQUALITY booleanMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 "
		"SINGLE-VALUE USAGE directoryOperation )",
		&ad_pwdReset },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.23 "
		"NAME ( 'pwdPolicySubentry' ) "
		"DESC 'The pwdPolicy subentry in effect for this object' "
		"EQUALITY distinguishedNameMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 "
		"SINGLE-VALUE "
#if 0
		/* Not until Relax control is released */
		"NO-USER-MODIFICATION "
#endif
		"USAGE directoryOperation )",
		&ad_pwdPolicySubentry },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.27 "
		"NAME ( 'pwdStartTime' ) "
		"DESC 'The time the password becomes enabled' "
		"EQUALITY generalizedTimeMatch "
		"ORDERING generalizedTimeOrderingMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 "
		"SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )",
		&ad_pwdStartTime },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.28 "
		"NAME ( 'pwdEndTime' ) "
		"DESC 'The time the password becomes disabled' "
		"EQUALITY generalizedTimeMatch "
		"ORDERING generalizedTimeOrderingMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 "
		"SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )",
		&ad_pwdEndTime },
	/* Defined in schema_prep.c now
	{	"( 1.3.6.1.4.1.42.2.27.8.1.29 "
		"NAME ( 'pwdLastSuccess' ) "
		"DESC 'The timestamp of the last successful authentication' "
		"EQUALITY generalizedTimeMatch "
		"ORDERING generalizedTimeOrderingMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 "
		"SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )",
		&ad_pwdLastSuccess },
	*/
	{	"( 1.3.6.1.4.1.42.2.27.8.1.33 "
		"NAME ( 'pwdAccountTmpLockoutEnd' ) "
		"DESC 'Temporary lockout end' "
		"EQUALITY generalizedTimeMatch "
		"ORDERING generalizedTimeOrderingMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 "
		"SINGLE-VALUE "
#if 0
		/* Not until Relax control is released */
		"NO-USER-MODIFICATION "
#endif
		"USAGE directoryOperation )",
		&ad_pwdAccountTmpLockoutEnd },

	{	"( 1.3.6.1.4.1.42.2.27.8.1.1 "
		"NAME ( 'pwdAttribute' ) "
		"EQUALITY objectIdentifierMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )",
		&ad_pwdAttribute },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.2 "
		"NAME ( 'pwdMinAge' ) "
		"EQUALITY integerMatch "
		"ORDERING integerOrderingMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 "
		"SINGLE-VALUE )",
		&ad_pwdMinAge },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.3 "
		"NAME ( 'pwdMaxAge' ) "
		"EQUALITY integerMatch "
		"ORDERING integerOrderingMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 "
		"SINGLE-VALUE )",
		&ad_pwdMaxAge },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.4 "
		"NAME ( 'pwdInHistory' ) "
		"EQUALITY integerMatch "
		"ORDERING integerOrderingMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 "
		"SINGLE-VALUE )",
		&ad_pwdInHistory },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.5 "
		"NAME ( 'pwdCheckQuality' ) "
		"EQUALITY integerMatch "
		"ORDERING integerOrderingMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 "
		"SINGLE-VALUE )",
		&ad_pwdCheckQuality },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.6 "
		"NAME ( 'pwdMinLength' ) "
		"EQUALITY integerMatch "
		"ORDERING integerOrderingMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 "
		"SINGLE-VALUE )",
		&ad_pwdMinLength },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.31 "
		"NAME ( 'pwdMaxLength' ) "
		"EQUALITY integerMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 "
		"SINGLE-VALUE )",
		&ad_pwdMaxLength },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.7 "
		"NAME ( 'pwdExpireWarning' ) "
		"EQUALITY integerMatch "
		"ORDERING integerOrderingMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 "
		"SINGLE-VALUE )",
		&ad_pwdExpireWarning },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.8 "
		"NAME ( 'pwdGraceAuthNLimit' ) "
		"EQUALITY integerMatch "
		"ORDERING integerOrderingMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 "
		"SINGLE-VALUE )",
		&ad_pwdGraceAuthNLimit },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.30 "
		"NAME ( 'pwdGraceExpiry' ) "
		"EQUALITY integerMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 "
		"SINGLE-VALUE )",
		&ad_pwdGraceExpiry },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.9 "
		"NAME ( 'pwdLockout' ) "
		"EQUALITY booleanMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 "
		"SINGLE-VALUE )",
		&ad_pwdLockout },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.10 "
		"NAME ( 'pwdLockoutDuration' ) "
		"EQUALITY integerMatch "
		"ORDERING integerOrderingMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 "
		"SINGLE-VALUE )",
		&ad_pwdLockoutDuration },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.11 "
		"NAME ( 'pwdMaxFailure' ) "
		"EQUALITY integerMatch "
		"ORDERING integerOrderingMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 "
		"SINGLE-VALUE )",
		&ad_pwdMaxFailure },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.12 "
		"NAME ( 'pwdFailureCountInterval' ) "
		"EQUALITY integerMatch "
		"ORDERING integerOrderingMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 "
		"SINGLE-VALUE )",
		&ad_pwdFailureCountInterval },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.13 "
		"NAME ( 'pwdMustChange' ) "
		"EQUALITY booleanMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 "
		"SINGLE-VALUE )",
		&ad_pwdMustChange },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.14 "
		"NAME ( 'pwdAllowUserChange' ) "
		"EQUALITY booleanMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 "
		"SINGLE-VALUE )",
		&ad_pwdAllowUserChange },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.15 "
		"NAME ( 'pwdSafeModify' ) "
		"EQUALITY booleanMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 "
		"SINGLE-VALUE )",
		&ad_pwdSafeModify },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.24 "
		"NAME ( 'pwdMinDelay' ) "
		"EQUALITY integerMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 "
		"SINGLE-VALUE )",
		&ad_pwdMinDelay },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.25 "
		"NAME ( 'pwdMaxDelay' ) "
		"EQUALITY integerMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 "
		"SINGLE-VALUE )",
		&ad_pwdMaxDelay },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.26 "
		"NAME ( 'pwdMaxIdle' ) "
		"EQUALITY integerMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 "
		"SINGLE-VALUE )",
		&ad_pwdMaxIdle },
	{	"( 1.3.6.1.4.1.42.2.27.8.1.32 "
		"NAME ( 'pwdMaxRecordedFailure' ) "
		"EQUALITY integerMatch "
		"ORDERING integerOrderingMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 "
		"SINGLE-VALUE )",
		&ad_pwdMaxRecordedFailure },
	{	"( 1.3.6.1.4.1.4754.1.99.1 "
		"NAME ( 'pwdCheckModule' ) "
		"EQUALITY caseExactIA5Match "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 "
		"DESC 'Loadable module that instantiates check_password() function' "
		"SINGLE-VALUE )",
		&ad_pwdCheckModule },
	{	"( 1.3.6.1.4.1.4754.1.99.2 "
		"NAME ( 'pwdCheckModuleArg' ) "
		"EQUALITY octetStringMatch "
		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 "
		"DESC 'Argument to pass to check_password() function' "
		"SINGLE-VALUE )",
		&ad_pwdCheckModuleArg },

	{ NULL, NULL }
};

static char *pwd_ocs[] = {
	"( 1.3.6.1.4.1.4754.2.99.1 "
		"NAME 'pwdPolicyChecker' "
		"SUP top "
		"AUXILIARY "
		"MAY ( pwdCheckModule $ pwdCheckModuleArg ) )" ,
	"( 1.3.6.1.4.1.42.2.27.8.2.1 "
		"NAME 'pwdPolicy' "
		"SUP top "
		"AUXILIARY "
		"MUST ( pwdAttribute ) "
		"MAY ( pwdMinAge $ pwdMaxAge $ pwdInHistory $ pwdCheckQuality $ "
		"pwdMinLength $ pwdMaxLength $ pwdExpireWarning $ "
		"pwdGraceAuthNLimit $ pwdGraceExpiry $ pwdLockout $ "
		"pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountInterval $ "
		"pwdMustChange $ pwdAllowUserChange $ pwdSafeModify $ "
		"pwdMinDelay $ pwdMaxDelay $ pwdMaxIdle $ "
		"pwdMaxRecordedFailure ) )",
	NULL
};

static ldap_pvt_thread_mutex_t chk_syntax_mutex;

enum {
	PPOLICY_DEFAULT = 1,
	PPOLICY_HASH_CLEARTEXT,
	PPOLICY_USE_LOCKOUT,
	PPOLICY_DISABLE_WRITE,
};

static ConfigDriver ppolicy_cf_default;

static ConfigTable ppolicycfg[] = {
	{ "ppolicy_default", "policyDN", 2, 2, 0,
	  ARG_DN|ARG_QUOTE|ARG_MAGIC|PPOLICY_DEFAULT, ppolicy_cf_default,
	  "( OLcfgOvAt:12.1 NAME 'olcPPolicyDefault' "
	  "DESC 'DN of a pwdPolicy object for uncustomized objects' "
	  "EQUALITY distinguishedNameMatch "
	  "SYNTAX OMsDN SINGLE-VALUE )", NULL, NULL },
	{ "ppolicy_hash_cleartext", "on|off", 1, 2, 0,
	  ARG_ON_OFF|ARG_OFFSET|PPOLICY_HASH_CLEARTEXT,
	  (void *)offsetof(pp_info,hash_passwords),
	  "( OLcfgOvAt:12.2 NAME 'olcPPolicyHashCleartext' "
	  "DESC 'Hash passwords on add or modify' "
	  "EQUALITY booleanMatch "
	  "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
	{ "ppolicy_forward_updates", "on|off", 1, 2, 0,
	  ARG_ON_OFF|ARG_OFFSET,
	  (void *)offsetof(pp_info,forward_updates),
	  "( OLcfgOvAt:12.4 NAME 'olcPPolicyForwardUpdates' "
	  "DESC 'Allow policy state updates to be forwarded via updateref' "
	  "EQUALITY booleanMatch "
	  "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
	{ "ppolicy_use_lockout", "on|off", 1, 2, 0,
	  ARG_ON_OFF|ARG_OFFSET|PPOLICY_USE_LOCKOUT,
	  (void *)offsetof(pp_info,use_lockout),
	  "( OLcfgOvAt:12.3 NAME 'olcPPolicyUseLockout' "
	  "DESC 'Warn clients with AccountLocked' "
	  "EQUALITY booleanMatch "
	  "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
	{ "ppolicy_disable_write", "on|off", 1, 2, 0,
	  ARG_ON_OFF|ARG_OFFSET|PPOLICY_DISABLE_WRITE,
	  (void *)offsetof(pp_info,disable_write),
	  "( OLcfgOvAt:12.5 NAME 'olcPPolicyDisableWrite' "
	  "DESC 'Prevent all policy overlay writes' "
	  "EQUALITY booleanMatch "
	  "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
	{ "ppolicy_send_netscape_controls", "on|off", 1, 2, 0,
	  ARG_ON_OFF|ARG_OFFSET,
	  (void *)offsetof(pp_info,send_netscape_controls),
	  "( OLcfgOvAt:12.6 NAME 'olcPPolicySendNetscapeControls' "
	  "DESC 'Send Netscape policy controls' "
	  "EQUALITY booleanMatch "
	  "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
	{ NULL, NULL, 0, 0, 0, ARG_IGNORED }
};

static ConfigOCs ppolicyocs[] = {
	{ "( OLcfgOvOc:12.1 "
	  "NAME 'olcPPolicyConfig' "
	  "DESC 'Password Policy configuration' "
	  "SUP olcOverlayConfig "
	  "MAY ( olcPPolicyDefault $ olcPPolicyHashCleartext $ "
	  "olcPPolicyUseLockout $ olcPPolicyForwardUpdates $ "
	  "olcPPolicyDisableWrite $ olcPPolicySendNetscapeControls ) )",
	  Cft_Overlay, ppolicycfg },
	{ NULL, 0, NULL }
};

static int
ppolicy_cf_default( ConfigArgs *c )
{
	slap_overinst *on = (slap_overinst *)c->bi;
	pp_info *pi = (pp_info *)on->on_bi.bi_private;
	int rc = ARG_BAD_CONF;

	assert ( c->type == PPOLICY_DEFAULT );
	Debug(LDAP_DEBUG_TRACE, "==> ppolicy_cf_default\n" );

	switch ( c->op ) {
	case SLAP_CONFIG_EMIT:
		Debug(LDAP_DEBUG_TRACE, "==> ppolicy_cf_default emit\n" );
		rc = 0;
		if ( !BER_BVISEMPTY( &pi->def_policy )) {
			rc = value_add_one( &c->rvalue_vals,
					    &pi->def_policy );
			if ( rc ) return rc;
			rc = value_add_one( &c->rvalue_nvals,
					    &pi->def_policy );
		}
		break;
	case LDAP_MOD_DELETE:
		Debug(LDAP_DEBUG_TRACE, "==> ppolicy_cf_default delete\n" );
		if ( pi->def_policy.bv_val ) {
			ber_memfree ( pi->def_policy.bv_val );
			pi->def_policy.bv_val = NULL;
		}
		pi->def_policy.bv_len = 0;
		rc = 0;
		break;
	case SLAP_CONFIG_ADD:
		/* fallthru to LDAP_MOD_ADD */
	case LDAP_MOD_ADD:
		Debug(LDAP_DEBUG_TRACE, "==> ppolicy_cf_default add\n" );
		if ( pi->def_policy.bv_val ) {
			ber_memfree ( pi->def_policy.bv_val );
		}
		pi->def_policy = c->value_ndn;
		ber_memfree( c->value_dn.bv_val );
		BER_BVZERO( &c->value_dn );
		BER_BVZERO( &c->value_ndn );
		rc = 0;
		break;
	default:
		abort ();
	}

	return rc;
}

static time_t
parse_time( char *atm )
{
	struct lutil_tm tm;
	struct lutil_timet tt;
	time_t ret = (time_t)-1;

	if ( lutil_parsetime( atm, &tm ) == 0) {
		lutil_tm2time( &tm, &tt );
		ret = tt.tt_sec;
	}
	return ret;
}

static int
account_locked( Operation *op, Entry *e,
		PassPolicy *pp, Modifications **mod ) 
{
	Attribute       *la;

	if ( (la = attr_find( e->e_attrs, ad_pwdStartTime )) != NULL ) {
		BerVarray vals = la->a_nvals;
		time_t then, now = op->o_time;

		/*
		 * Password has a defined start of validity
		 */
		if ( vals[0].bv_val != NULL ) {
			if ( (then = parse_time( vals[0].bv_val )) == (time_t)-1 ) {
				return 1;
			}
			if ( now < then ) {
				return 1;
			}
		}
	}

	if ( (la = attr_find( e->e_attrs, ad_pwdEndTime )) != NULL ) {
		BerVarray vals = la->a_nvals;
		time_t then, now = op->o_time;

		/*
		 * Password has a defined end of validity
		 */
		if ( vals[0].bv_val != NULL ) {
			if ( (then = parse_time( vals[0].bv_val )) == (time_t)-1 ) {
				return 1;
			}
			if ( then <= now ) {
				return 1;
			}
		}
	}

	if ( !pp->pwdLockout )
		return 0;

	if ( (la = attr_find( e->e_attrs, ad_pwdAccountTmpLockoutEnd )) != NULL ) {
		BerVarray vals = la->a_nvals;
		time_t then, now = op->o_time;

		/*
		 * We have temporarily locked the account after a failure
		 */
		if ( vals[0].bv_val != NULL ) {
			if ( (then = parse_time( vals[0].bv_val )) == (time_t)-1 ) {
				return 1;
			}
			if ( now < then ) {
				return 1;
			}
		}
	}

	/* Only check if database maintains lastbind */
	if ( pp->pwdMaxIdle && SLAP_LASTBIND( op->o_bd ) ) {
		time_t lastbindtime = (time_t)-1;

		la = attr_find( e->e_attrs, ad_pwdLastSuccess );
		if ( la == NULL ) {
			la = attr_find( e->e_attrs, ad_pwdChangedTime );
		}
		if ( la != NULL ) {
			lastbindtime = parse_time( la->a_nvals[0].bv_val );
		}

		if ( lastbindtime != (time_t)-1 &&
				op->o_time > lastbindtime + pp->pwdMaxIdle ) {
			return 1;
		}
	}

	if ( (la = attr_find( e->e_attrs, ad_pwdAccountLockedTime )) != NULL ) {
		BerVarray vals = la->a_nvals;

		/*
		 * there is a lockout stamp - we now need to know if it's
		 * a valid one.
		 */
		if (vals[0].bv_val != NULL) {
			time_t then, now;
			Modifications *m;

			if ((then = parse_time( vals[0].bv_val )) == (time_t)0)
				return 1;

			now = slap_get_time();

			/* Still in the future? not yet in effect */
			if (now < then)
				return 0;

			if (!pp->pwdLockoutDuration)
				return 1;

			if (now < then + pp->pwdLockoutDuration)
				return 1;

			if ( mod != NULL ) {
				m = ch_calloc( sizeof(Modifications), 1 );
				m->sml_op = LDAP_MOD_DELETE;
				m->sml_flags = 0;
				m->sml_type = ad_pwdAccountLockedTime->ad_cname;
				m->sml_desc = ad_pwdAccountLockedTime;
				m->sml_next = *mod;
				*mod = m;
			}
		}
	}

	return 0;
}

/* IMPLICIT TAGS, all context-specific */
#define PPOLICY_WARNING 0xa0L	/* constructed + 0 */
#define PPOLICY_ERROR 0x81L		/* primitive + 1 */
 
#define PPOLICY_EXPIRE 0x80L	/* primitive + 0 */
#define PPOLICY_GRACE  0x81L	/* primitive + 1 */

static const char ppolicy_ctrl_oid[] = LDAP_CONTROL_PASSWORDPOLICYRESPONSE;
static const char ppolicy_account_ctrl_oid[] = LDAP_CONTROL_X_ACCOUNT_USABILITY;
static const char ppolicy_pwd_expired_oid[] = LDAP_CONTROL_X_PASSWORD_EXPIRED;
static const char ppolicy_pwd_expiring_oid[] = LDAP_CONTROL_X_PASSWORD_EXPIRING;

static LDAPControl *
create_passcontrol( Operation *op, int exptime, int grace, LDAPPasswordPolicyError err )
{
	BerElementBuffer berbuf, bb2;
	BerElement *ber = (BerElement *) &berbuf, *b2 = (BerElement *) &bb2;
	LDAPControl c = { 0 }, *cp;
	struct berval bv;
	int rc;

	BER_BVZERO( &c.ldctl_value );

	ber_init2( ber, NULL, LBER_USE_DER );
	ber_printf( ber, "{" /*}*/ );

	if ( exptime >= 0 ) {
		ber_init2( b2, NULL, LBER_USE_DER );
		ber_printf( b2, "ti", PPOLICY_EXPIRE, exptime );
		rc = ber_flatten2( b2, &bv, 1 );
		(void)ber_free_buf(b2);
		if (rc == -1) {
			cp = NULL;
			goto fail;
		}
		ber_printf( ber, "tO", PPOLICY_WARNING, &bv );
		ch_free( bv.bv_val );
	} else if ( grace >= 0 ) {
		ber_init2( b2, NULL, LBER_USE_DER );
		ber_printf( b2, "ti", PPOLICY_GRACE, grace );
		rc = ber_flatten2( b2, &bv, 1 );
		(void)ber_free_buf(b2);
		if (rc == -1) {
			cp = NULL;
			goto fail;
		}
		ber_printf( ber, "tO", PPOLICY_WARNING, &bv );
		ch_free( bv.bv_val );
	}

	if (err != PP_noError ) {
		ber_printf( ber, "te", PPOLICY_ERROR, err );
	}
	ber_printf( ber, /*{*/ "N}" );

	if (ber_flatten2( ber, &c.ldctl_value, 0 ) == -1) {
		return NULL;
	}
	cp = op->o_tmpalloc( sizeof( LDAPControl ) + c.ldctl_value.bv_len, op->o_tmpmemctx );
	cp->ldctl_oid = (char *)ppolicy_ctrl_oid;
	cp->ldctl_iscritical = 0;
	cp->ldctl_value.bv_val = (char *)&cp[1];
	cp->ldctl_value.bv_len = c.ldctl_value.bv_len;
	AC_MEMCPY( cp->ldctl_value.bv_val, c.ldctl_value.bv_val, c.ldctl_value.bv_len );
fail:
	(void)ber_free_buf(ber);
	
	return cp;
}

static LDAPControl *
create_passexpiry( Operation *op, int expired, int warn )
{
	LDAPControl *cp;
	char buf[sizeof("-2147483648")];
	struct berval bv = { .bv_val = buf, .bv_len = sizeof(buf) };

	bv.bv_len = snprintf( bv.bv_val, bv.bv_len, "%d", warn );

	cp = op->o_tmpalloc( sizeof( LDAPControl ) + bv.bv_len, op->o_tmpmemctx );
	if ( expired ) {
		cp->ldctl_oid = (char *)ppolicy_pwd_expired_oid;
	} else {
		cp->ldctl_oid = (char *)ppolicy_pwd_expiring_oid;
	}
	cp->ldctl_iscritical = 0;
	cp->ldctl_value.bv_val = (char *)&cp[1];
	cp->ldctl_value.bv_len = bv.bv_len;
	AC_MEMCPY( cp->ldctl_value.bv_val, bv.bv_val, bv.bv_len );
	return cp;
}

static LDAPControl **
add_passcontrol( Operation *op, SlapReply *rs, LDAPControl *ctrl )
{
	LDAPControl **ctrls, **oldctrls = rs->sr_ctrls;
	int n;

	n = 0;
	if ( oldctrls ) {
		for ( ; oldctrls[n]; n++ )
			;
	}
	n += 2;

	ctrls = op->o_tmpcalloc( sizeof( LDAPControl * ), n, op->o_tmpmemctx );

	n = 0;
	if ( oldctrls ) {
		for ( ; oldctrls[n]; n++ ) {
			ctrls[n] = oldctrls[n];
		}
	}
	ctrls[n] = ctrl;
	ctrls[n+1] = NULL;

	rs->sr_ctrls = ctrls;

	return oldctrls;
}

static void
add_account_control(
	Operation *op,
	SlapReply *rs,
	int available,
	int remaining,
	LDAPAccountUsabilityMoreInfo *more_info )
{
	BerElementBuffer berbuf;
	BerElement *ber = (BerElement *) &berbuf;
	LDAPControl c = { 0 }, *cp = NULL, **ctrls;
	int i = 0;

	BER_BVZERO( &c.ldctl_value );

	ber_init2( ber, NULL, LBER_USE_DER );

	if ( available ) {
		ber_put_int( ber, remaining, LDAP_TAG_X_ACCOUNT_USABILITY_AVAILABLE );
	} else {
		assert( more_info != NULL );

		ber_start_seq( ber, LDAP_TAG_X_ACCOUNT_USABILITY_NOT_AVAILABLE );
		ber_put_boolean( ber, more_info->inactive, LDAP_TAG_X_ACCOUNT_USABILITY_INACTIVE );
		ber_put_boolean( ber, more_info->reset, LDAP_TAG_X_ACCOUNT_USABILITY_RESET );
		ber_put_boolean( ber, more_info->expired, LDAP_TAG_X_ACCOUNT_USABILITY_EXPIRED );
		ber_put_int( ber, more_info->remaining_grace, LDAP_TAG_X_ACCOUNT_USABILITY_REMAINING_GRACE );
		ber_put_int( ber, more_info->seconds_before_unlock, LDAP_TAG_X_ACCOUNT_USABILITY_UNTIL_UNLOCK );
		ber_put_seq( ber );
	}

	if (ber_flatten2( ber, &c.ldctl_value, 0 ) == -1) {
		goto fail;
	}

	if ( rs->sr_ctrls != NULL ) {
		for ( ; rs->sr_ctrls[ i ] != NULL; i++ ) /* Count */;
	}

	ctrls = op->o_tmprealloc( rs->sr_ctrls, sizeof(LDAPControl *)*( i + 2 ), op->o_tmpmemctx );
	if ( ctrls == NULL ) {
		goto fail;
	}

	cp = op->o_tmpalloc( sizeof( LDAPControl ) + c.ldctl_value.bv_len, op->o_tmpmemctx );
	cp->ldctl_oid = (char *)ppolicy_account_ctrl_oid;
	cp->ldctl_iscritical = 0;
	cp->ldctl_value.bv_val = (char *)&cp[1];
	cp->ldctl_value.bv_len = c.ldctl_value.bv_len;
	AC_MEMCPY( cp->ldctl_value.bv_val, c.ldctl_value.bv_val, c.ldctl_value.bv_len );

	ctrls[ i ] = cp;
	ctrls[ i + 1 ] = NULL;
	rs->sr_ctrls = ctrls;

fail:
	(void)ber_free_buf(ber);
}

static void
ppolicy_get_default( PassPolicy *pp )
{
	memset( pp, 0, sizeof(PassPolicy) );

	pp->ad = slap_schema.si_ad_userPassword;

	/* Users can change their own password by default */
	pp->pwdAllowUserChange = 1;
}


static int
ppolicy_get( Operation *op, Entry *e, PassPolicy *pp )
{
	slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
	pp_info *pi = on->on_bi.bi_private;
	Attribute *a;
	BerVarray vals;
	int rc = LDAP_SUCCESS;
	Entry *pe = NULL;
#if 0
	const char *text;
#endif

	ppolicy_get_default( pp );

	if ((a = attr_find( e->e_attrs, ad_pwdPolicySubentry )) == NULL) {
		/*
		 * entry has no password policy assigned - use default
		 */
		vals = &pi->def_policy;
		if ( !vals->bv_val )
			goto defaultpol;
	} else {
		vals = a->a_nvals;
		if (vals[0].bv_val == NULL) {
			Debug( LDAP_DEBUG_ANY,
				"ppolicy_get: NULL value for policySubEntry\n" );
			goto defaultpol;
		}
	}

	op->o_bd->bd_info = (BackendInfo *)on->on_info;
	rc = be_entry_get_rw( op, vals, NULL, NULL, 0, &pe );
	op->o_bd->bd_info = (BackendInfo *)on;

	if ( rc ) goto defaultpol;

#if 0	/* Only worry about userPassword for now */
	if ((a = attr_find( pe->e_attrs, ad_pwdAttribute )))
		slap_bv2ad( &a->a_vals[0], &pp->ad, &text );
#endif

	if ( ( a = attr_find( pe->e_attrs, ad_pwdMinAge ) )
			&& lutil_atoi( &pp->pwdMinAge, a->a_vals[0].bv_val ) != 0 ) {
		rc = LDAP_CONSTRAINT_VIOLATION;
		goto defaultpol;
	}
	if ( ( a = attr_find( pe->e_attrs, ad_pwdMaxAge ) )
			&& lutil_atoi( &pp->pwdMaxAge, a->a_vals[0].bv_val ) != 0 ) {
		rc = LDAP_CONSTRAINT_VIOLATION;
		goto defaultpol;
	}
	if ( ( a = attr_find( pe->e_attrs, ad_pwdMaxIdle ) )
			&& lutil_atoi( &pp->pwdMaxIdle, a->a_vals[0].bv_val ) != 0 ) {
		rc = LDAP_CONSTRAINT_VIOLATION;
		goto defaultpol;
	}
	if ( ( a = attr_find( pe->e_attrs, ad_pwdInHistory ) )
			&& lutil_atoi( &pp->pwdInHistory, a->a_vals[0].bv_val ) != 0 ) {
		rc = LDAP_CONSTRAINT_VIOLATION;
		goto defaultpol;
	}
	if ( ( a = attr_find( pe->e_attrs, ad_pwdCheckQuality ) )
			&& lutil_atoi( &pp->pwdCheckQuality, a->a_vals[0].bv_val ) != 0 ) {
		rc = LDAP_CONSTRAINT_VIOLATION;
		goto defaultpol;
	}
	if ( ( a = attr_find( pe->e_attrs, ad_pwdMinLength ) )
			&& lutil_atoi( &pp->pwdMinLength, a->a_vals[0].bv_val ) != 0 ) {
		rc = LDAP_CONSTRAINT_VIOLATION;
		goto defaultpol;
	}
	if ( ( a = attr_find( pe->e_attrs, ad_pwdMaxLength ) )
			&& lutil_atoi( &pp->pwdMaxLength, a->a_vals[0].bv_val ) != 0 ) {
		rc = LDAP_CONSTRAINT_VIOLATION;
		goto defaultpol;
	}
	if ( ( a = attr_find( pe->e_attrs, ad_pwdMaxFailure ) )
			&& lutil_atoi( &pp->pwdMaxFailure, a->a_vals[0].bv_val ) != 0 ) {
		rc = LDAP_CONSTRAINT_VIOLATION;
		goto defaultpol;
	}
	if ( ( a = attr_find( pe->e_attrs, ad_pwdMaxRecordedFailure ) )
			&& lutil_atoi( &pp->pwdMaxRecordedFailure, a->a_vals[0].bv_val ) != 0 ) {
		rc = LDAP_CONSTRAINT_VIOLATION;
		goto defaultpol;
	}
	if ( ( a = attr_find( pe->e_attrs, ad_pwdGraceExpiry ) )
			&& lutil_atoi( &pp->pwdGraceExpiry, a->a_vals[0].bv_val ) != 0 ) {
		rc = LDAP_CONSTRAINT_VIOLATION;
		goto defaultpol;
	}
	if ( ( a = attr_find( pe->e_attrs, ad_pwdGraceAuthNLimit ) )
			&& lutil_atoi( &pp->pwdGraceAuthNLimit, a->a_vals[0].bv_val ) != 0 ) {
		rc = LDAP_CONSTRAINT_VIOLATION;
		goto defaultpol;
	}
	if ( ( a = attr_find( pe->e_attrs, ad_pwdExpireWarning ) )
			&& lutil_atoi( &pp->pwdExpireWarning, a->a_vals[0].bv_val ) != 0 ) {
		rc = LDAP_CONSTRAINT_VIOLATION;
		goto defaultpol;
	}
	if ( ( a = attr_find( pe->e_attrs, ad_pwdFailureCountInterval ) )
			&& lutil_atoi( &pp->pwdFailureCountInterval, a->a_vals[0].bv_val ) != 0 ) {
		rc = LDAP_CONSTRAINT_VIOLATION;
		goto defaultpol;
	}
	if ( ( a = attr_find( pe->e_attrs, ad_pwdLockoutDuration ) )
			&& lutil_atoi( &pp->pwdLockoutDuration, a->a_vals[0].bv_val ) != 0 ) {
		rc = LDAP_CONSTRAINT_VIOLATION;
		goto defaultpol;
	}
	if ( ( a = attr_find( pe->e_attrs, ad_pwdMinDelay ) )
			&& lutil_atoi( &pp->pwdMinDelay, a->a_vals[0].bv_val ) != 0 ) {
		rc = LDAP_CONSTRAINT_VIOLATION;
		goto defaultpol;
	}
	if ( ( a = attr_find( pe->e_attrs, ad_pwdMaxDelay ) )
			&& lutil_atoi( &pp->pwdMaxDelay, a->a_vals[0].bv_val ) != 0 ) {
		rc = LDAP_CONSTRAINT_VIOLATION;
		goto defaultpol;
	}

	if ( ( a = attr_find( pe->e_attrs, ad_pwdCheckModule ) ) ) {
		strncpy( pp->pwdCheckModule, a->a_vals[0].bv_val,
			sizeof(pp->pwdCheckModule) );
		pp->pwdCheckModule[sizeof(pp->pwdCheckModule)-1] = '\0';
	}
	if ( ( a = attr_find( pe->e_attrs, ad_pwdCheckModuleArg ) ) ) {
		ber_dupbv_x( &pp->pwdCheckModuleArg, &a->a_vals[0], op->o_tmpmemctx );
	}

	if ((a = attr_find( pe->e_attrs, ad_pwdLockout )))
		pp->pwdLockout = bvmatch( &a->a_nvals[0], &slap_true_bv );
	if ((a = attr_find( pe->e_attrs, ad_pwdMustChange )))
		pp->pwdMustChange = bvmatch( &a->a_nvals[0], &slap_true_bv );
	if ((a = attr_find( pe->e_attrs, ad_pwdAllowUserChange )))
		pp->pwdAllowUserChange = bvmatch( &a->a_nvals[0], &slap_true_bv );
	if ((a = attr_find( pe->e_attrs, ad_pwdSafeModify )))
		pp->pwdSafeModify = bvmatch( &a->a_nvals[0], &slap_true_bv );

	if ( pp->pwdMaxRecordedFailure < pp->pwdMaxFailure )
		pp->pwdMaxRecordedFailure = pp->pwdMaxFailure;
	if ( !pp->pwdMaxRecordedFailure && pp->pwdMinDelay )
		pp->pwdMaxRecordedFailure = PPOLICY_DEFAULT_MAXRECORDED_FAILURE;

	if ( pp->pwdMinDelay && !pp->pwdMaxDelay ) {
		Debug( LDAP_DEBUG_ANY, "ppolicy_get: pwdMinDelay was set but pwdMaxDelay wasn't, "
				"assuming they are equal\n" );
		pp->pwdMaxDelay = pp->pwdMinDelay;
	}

	op->o_bd->bd_info = (BackendInfo *)on->on_info;
	be_entry_release_r( op, pe );
	op->o_bd->bd_info = (BackendInfo *)on;

	return LDAP_SUCCESS;

defaultpol:
	if ( pe ) {
		op->o_bd->bd_info = (BackendInfo *)on->on_info;
		be_entry_release_r( op, pe );
		op->o_bd->bd_info = (BackendInfo *)on;
	}

	if ( rc && !BER_BVISNULL( vals ) ) {
		Debug( LDAP_DEBUG_ANY,
			"ppolicy_get: policy subentry %s missing or invalid\n",
			vals->bv_val );
	} else {
		Debug( LDAP_DEBUG_TRACE,
			"ppolicy_get: using default policy\n" );
	}

	ppolicy_get_default( pp );

	return -1;
}

static int
password_scheme( struct berval *cred, struct berval *sch )
{
	int e;
    
	assert( cred != NULL );

	if (sch) {
		sch->bv_val = NULL;
		sch->bv_len = 0;
	}
    
	if ((cred->bv_len == 0) || (cred->bv_val == NULL) ||
		(cred->bv_val[0] != '{')) return LDAP_OTHER;

	for(e = 1; cred->bv_val[e] && cred->bv_val[e] != '}'; e++);
	if (cred->bv_val[e]) {
		int rc;
		rc = lutil_passwd_scheme( cred->bv_val );
		if (rc) {
			if (sch) {
				sch->bv_val = cred->bv_val;
				sch->bv_len = e;
			}
			return LDAP_SUCCESS;
		}
	}
	return LDAP_OTHER;
}

static int
check_password_quality( struct berval *cred, PassPolicy *pp, LDAPPasswordPolicyError *err, Entry *e, char **txt )
{
	int rc = LDAP_SUCCESS, ok = LDAP_SUCCESS;
	char *ptr;
	struct berval sch;

	assert( cred != NULL );
	assert( pp != NULL );
	assert( txt != NULL );

	ptr = cred->bv_val;

	*txt = NULL;

	if ((cred->bv_len == 0) || (pp->pwdMinLength > cred->bv_len)) {
		rc = LDAP_CONSTRAINT_VIOLATION;
		if ( err ) *err = PP_passwordTooShort;
		return rc;
	}

	if ( pp->pwdMaxLength && cred->bv_len > pp->pwdMaxLength ) {
		rc = LDAP_CONSTRAINT_VIOLATION;
		if ( err ) *err = PP_passwordTooLong;
		return rc;
	}

        /*
         * We need to know if the password is already hashed - if so
         * what scheme is it. The reason being that the "hash" of
         * {cleartext} still allows us to check the password.
         */
	rc = password_scheme( cred, &sch );
	if (rc == LDAP_SUCCESS) {
		if ((sch.bv_val) && (strncasecmp( sch.bv_val, "{cleartext}",
			sch.bv_len ) == 0)) {
			/*
			 * We can check the cleartext "hash"
			 */
			ptr = cred->bv_val + sch.bv_len;
		} else {
			/* everything else, we can't check */
			if (pp->pwdCheckQuality == 2) {
				rc = LDAP_CONSTRAINT_VIOLATION;
				if (err) *err = PP_insufficientPasswordQuality;
				return rc;
			}
			/*
			 * We can't check the syntax of the password, but it's not
			 * mandatory (according to the policy), so we return success.
			 */
		    
			return LDAP_SUCCESS;
		}
	}

	rc = LDAP_SUCCESS;

	if (pp->pwdCheckModule[0]) {
#ifdef SLAPD_MODULES
		lt_dlhandle mod;
		const char *err;
		
		if ((mod = lt_dlopen( pp->pwdCheckModule )) == NULL) {
			err = lt_dlerror();

			Debug(LDAP_DEBUG_ANY,
			"check_password_quality: lt_dlopen failed: (%s) %s.\n",
				pp->pwdCheckModule, err );
			ok = LDAP_OTHER; /* internal error */
		} else {
			/* FIXME: the error message ought to be passed thru a
			 * struct berval, with preallocated buffer and size
			 * passed in. Module can still allocate a buffer for
			 * it if the provided one is too small.
			 */
			int (*prog)( char *passwd, char **text, Entry *ent, struct berval *arg );

			if ((prog = lt_dlsym( mod, "check_password" )) == NULL) {
				err = lt_dlerror();

				Debug(LDAP_DEBUG_ANY,
					"check_password_quality: lt_dlsym failed: (%s) %s.\n",
					pp->pwdCheckModule, err );
				ok = LDAP_OTHER;
			} else {
				struct berval *arg = NULL;
				if ( !BER_BVISNULL( &pp->pwdCheckModuleArg ) ) {
					arg = &pp->pwdCheckModuleArg;
				}

				ldap_pvt_thread_mutex_lock( &chk_syntax_mutex );
				ok = prog( ptr, txt, e, arg );
				ldap_pvt_thread_mutex_unlock( &chk_syntax_mutex );
				if (ok != LDAP_SUCCESS) {
					Debug(LDAP_DEBUG_ANY,
						"check_password_quality: module error: (%s) %s.[%d]\n",
						pp->pwdCheckModule, *txt ? *txt : "", ok );
				}
			}
			    
			lt_dlclose( mod );
		}
#else
	Debug(LDAP_DEBUG_ANY, "check_password_quality: external modules not "
		"supported. pwdCheckModule ignored.\n" );
#endif /* SLAPD_MODULES */
	}
		
		    
	if (ok != LDAP_SUCCESS) {
		rc = LDAP_CONSTRAINT_VIOLATION;
		if (err) *err = PP_insufficientPasswordQuality;
	}
	
	return rc;
}

static int
parse_pwdhistory( struct berval *bv, char **oid, time_t *oldtime, struct berval *oldpw )
{
	char *ptr;
	struct berval nv, npw;
	ber_len_t i, j;
	
	assert (bv && (bv->bv_len > 0) && (bv->bv_val) && oldtime && oldpw );

	if ( oid ) {
		*oid = 0;
	}
	*oldtime = (time_t)-1;
	BER_BVZERO( oldpw );
	
	ber_dupbv( &nv, bv );

	/* first get the time field */
	for ( i = 0; (i < nv.bv_len) && (nv.bv_val[i] != '#'); i++ )
		;
	if ( i == nv.bv_len ) {
		goto exit_failure; /* couldn't locate the '#' separator */
	}
	nv.bv_val[i++] = '\0'; /* terminate the string & move to next field */
	ptr = nv.bv_val;
	*oldtime = parse_time( ptr );
	if (*oldtime == (time_t)-1) {
		goto exit_failure;
	}

	/* get the OID field */
	for (ptr = &(nv.bv_val[i]); (i < nv.bv_len) && (nv.bv_val[i] != '#'); i++ )
		;
	if ( i == nv.bv_len ) {
		goto exit_failure; /* couldn't locate the '#' separator */
	}
	nv.bv_val[i++] = '\0'; /* terminate the string & move to next field */
	if ( oid ) {
		*oid = ber_strdup( ptr );
	}
	
	/* get the length field */
	for ( ptr = &(nv.bv_val[i]); (i < nv.bv_len) && (nv.bv_val[i] != '#'); i++ )
		;
	if ( i == nv.bv_len ) {
		goto exit_failure; /* couldn't locate the '#' separator */
	}
	nv.bv_val[i++] = '\0'; /* terminate the string & move to next field */
	oldpw->bv_len = strtol( ptr, NULL, 10 );
	if (errno == ERANGE) {
		goto exit_failure;
	}

	/* lastly, get the octets of the string */
	for ( j = i, ptr = &(nv.bv_val[i]); i < nv.bv_len; i++ )
		;
	if ( i - j != oldpw->bv_len) {
		goto exit_failure; /* length is wrong */
	}

	npw.bv_val = ptr;
	npw.bv_len = oldpw->bv_len;
	ber_dupbv( oldpw, &npw );
	ber_memfree( nv.bv_val );
	
	return LDAP_SUCCESS;

exit_failure:;
	if ( oid && *oid ) {
		ber_memfree(*oid);
		*oid = NULL;
	}
	if ( oldpw->bv_val ) {
		ber_memfree( oldpw->bv_val);
		BER_BVZERO( oldpw );
	}
	ber_memfree( nv.bv_val );

	return LDAP_OTHER;
}

static void
add_to_pwd_history( pw_hist **l, time_t t,
                    struct berval *oldpw, struct berval *bv )
{
	pw_hist *p, *p1, *p2;
    
	if (!l) return;

	p = ch_malloc( sizeof( pw_hist ));
	p->pw = *oldpw;
	ber_dupbv( &p->bv, bv );
	p->t = t;
	p->next = NULL;
	
	if (*l == NULL) {
		/* degenerate case */
		*l = p;
		return;
	}
	/*
	 * advance p1 and p2 such that p1 is the node before the
	 * new one, and p2 is the node after it
	 */
	for (p1 = NULL, p2 = *l; p2 && p2->t <= t; p1 = p2, p2=p2->next );
	p->next = p2;
	if (p1 == NULL) { *l = p; return; }
	p1->next = p;
}

#ifndef MAX_PWD_HISTORY_SZ
#define MAX_PWD_HISTORY_SZ 1024
#endif /* MAX_PWD_HISTORY_SZ */

static void
make_pwd_history_value( char *timebuf, struct berval *bv, Attribute *pa )
{
	char str[ MAX_PWD_HISTORY_SZ ];
	int nlen;

	snprintf( str, MAX_PWD_HISTORY_SZ,
		  "%s#%s#%lu#", timebuf,
		  pa->a_desc->ad_type->sat_syntax->ssyn_oid,
		  (unsigned long) pa->a_nvals[0].bv_len );