config.c

ldap服务器源码

				return 1;
			}

			slap_cf_aux_table_unparse( li->li_timeout, &bv, timeout_table );

			if ( BER_BVISNULL( &bv ) ) {
				return 1;
			}

			for ( i = 0; isspace( (unsigned char) bv.bv_val[ i ] ); i++ )
				/* count spaces */ ;

			if ( i ) {
				bv.bv_len -= i;
				AC_MEMCPY( bv.bv_val, &bv.bv_val[ i ],
					bv.bv_len + 1 );
			}

			ber_bvarray_add( &c->rvalue_vals, &bv );
			break;

		case LDAP_BACK_CFG_IDLE_TIMEOUT: {
			char	buf[ SLAP_TEXT_BUFLEN ];

			if ( li->li_idle_timeout == 0 ) {
				return 1;
			}

			lutil_unparse_time( buf, sizeof( buf ), li->li_idle_timeout );
			ber_str2bv( buf, 0, 0, &bv );
			value_add_one( &c->rvalue_vals, &bv );
			} break;

		case LDAP_BACK_CFG_CONN_TTL: {
			char	buf[ SLAP_TEXT_BUFLEN ];

			if ( li->li_conn_ttl == 0 ) {
				return 1;
			}

			lutil_unparse_time( buf, sizeof( buf ), li->li_conn_ttl );
			ber_str2bv( buf, 0, 0, &bv );
			value_add_one( &c->rvalue_vals, &bv );
			} break;

		case LDAP_BACK_CFG_NETWORK_TIMEOUT: {
			char	buf[ SLAP_TEXT_BUFLEN ];

			if ( li->li_network_timeout == 0 ) {
				return 1;
			}

			snprintf( buf, sizeof( buf ), "%ld",
				(long)li->li_network_timeout );
			ber_str2bv( buf, 0, 0, &bv );
			value_add_one( &c->rvalue_vals, &bv );
			} break;

		case LDAP_BACK_CFG_VERSION:
			if ( li->li_version == 0 ) {
				return 1;
			}

			c->value_int = li->li_version;
			break;

		case LDAP_BACK_CFG_SINGLECONN:
			c->value_int = LDAP_BACK_SINGLECONN( li );
			break;

		case LDAP_BACK_CFG_USETEMP:
			c->value_int = LDAP_BACK_USE_TEMPORARIES( li );
			break;

		case LDAP_BACK_CFG_CONNPOOLMAX:
			c->value_int = li->li_conn_priv_max;
			break;

		case LDAP_BACK_CFG_CANCEL: {
			slap_mask_t	mask = LDAP_BACK_F_CANCEL_MASK2;

			if ( LDAP_BACK_CANCEL_DISCOVER( li ) ) {
				mask &= ~LDAP_BACK_F_CANCEL_EXOP;
			}
			enum_to_verb( cancel_mode, (li->li_flags & mask), &bv );
			if ( BER_BVISNULL( &bv ) ) {
				/* there's something wrong... */
				assert( 0 );
				rc = 1;

			} else {
				value_add_one( &c->rvalue_vals, &bv );
			}
			} break;

		case LDAP_BACK_CFG_QUARANTINE:
			if ( !LDAP_BACK_QUARANTINE( li ) ) {
				rc = 1;
				break;
			}

			rc = slap_retry_info_unparse( &li->li_quarantine, &bv );
			if ( rc == 0 ) {
				ber_bvarray_add( &c->rvalue_vals, &bv );
			}
			break;

		default:
			/* FIXME: we need to handle all... */
			assert( 0 );
			break;
		}
		return rc;

	} else if ( c->op == LDAP_MOD_DELETE ) {
		switch( c->type ) {
		case LDAP_BACK_CFG_URI:
			if ( li->li_uri != NULL ) {
				ch_free( li->li_uri );
				li->li_uri = NULL;

				assert( li->li_bvuri != NULL );
				ber_bvarray_free( li->li_bvuri );
				li->li_bvuri = NULL;
			}

			/* better cleanup the cached connections... */
			/* NOTE: don't worry about locking: if we got here,
			 * other threads are suspended. */
			if ( li->li_conninfo.lai_tree != NULL ) {
				avl_free( li->li_conninfo.lai_tree, ldap_back_conn_free );
				li->li_conninfo.lai_tree = NULL;
			}
			
			break;

		case LDAP_BACK_CFG_TLS:
			rc = 1;
			break;

		case LDAP_BACK_CFG_ACL_AUTHCDN:
		case LDAP_BACK_CFG_ACL_PASSWD:
		case LDAP_BACK_CFG_ACL_METHOD:
			/* handled by LDAP_BACK_CFG_ACL_BIND */
			rc = 1;
			break;

		case LDAP_BACK_CFG_ACL_BIND:
			bindconf_free( &li->li_acl );
			break;

		case LDAP_BACK_CFG_IDASSERT_MODE:
		case LDAP_BACK_CFG_IDASSERT_AUTHCDN:
		case LDAP_BACK_CFG_IDASSERT_PASSWD:
		case LDAP_BACK_CFG_IDASSERT_METHOD:
			/* handled by LDAP_BACK_CFG_IDASSERT_BIND */
			rc = 1;
			break;

		case LDAP_BACK_CFG_IDASSERT_AUTHZFROM:
			if ( li->li_idassert_authz != NULL ) {
				ber_bvarray_free( li->li_idassert_authz );
				li->li_idassert_authz = NULL;
			}
			break;

		case LDAP_BACK_CFG_IDASSERT_BIND:
			bindconf_free( &li->li_idassert.si_bc );
			break;

		case LDAP_BACK_CFG_REBIND:
		case LDAP_BACK_CFG_CHASE:
		case LDAP_BACK_CFG_T_F:
		case LDAP_BACK_CFG_WHOAMI:
		case LDAP_BACK_CFG_CANCEL:
			rc = 1;
			break;

		case LDAP_BACK_CFG_TIMEOUT:
			for ( i = 0; i < SLAP_OP_LAST; i++ ) {
				li->li_timeout[ i ] = 0;
			}
			break;

		case LDAP_BACK_CFG_IDLE_TIMEOUT:
			li->li_idle_timeout = 0;
			break;

		case LDAP_BACK_CFG_CONN_TTL:
			li->li_conn_ttl = 0;
			break;

		case LDAP_BACK_CFG_NETWORK_TIMEOUT:
			li->li_network_timeout = 0;
			break;

		case LDAP_BACK_CFG_VERSION:
			li->li_version = 0;
			break;

		case LDAP_BACK_CFG_SINGLECONN:
			li->li_flags &= ~LDAP_BACK_F_SINGLECONN;
			break;

		case LDAP_BACK_CFG_USETEMP:
			li->li_flags &= ~LDAP_BACK_F_USE_TEMPORARIES;
			break;

		case LDAP_BACK_CFG_CONNPOOLMAX:
			li->li_conn_priv_max = LDAP_BACK_CONN_PRIV_MIN;
			break;

		case LDAP_BACK_CFG_QUARANTINE:
			if ( !LDAP_BACK_QUARANTINE( li ) ) {
				break;
			}

			slap_retry_info_destroy( &li->li_quarantine );
			ldap_pvt_thread_mutex_destroy( &li->li_quarantine_mutex );
			li->li_isquarantined = 0;
			li->li_flags &= ~LDAP_BACK_F_QUARANTINE;
			break;

		default:
			/* FIXME: we need to handle all... */
			assert( 0 );
			break;
		}
		return rc;

	}

	switch( c->type ) {
	case LDAP_BACK_CFG_URI: {
		LDAPURLDesc	*tmpludp, *lud;
		char		**urllist = NULL;
		int		urlrc = LDAP_URL_SUCCESS, i;

		if ( li->li_uri != NULL ) {
			ch_free( li->li_uri );
			li->li_uri = NULL;

			assert( li->li_bvuri != NULL );
			ber_bvarray_free( li->li_bvuri );
			li->li_bvuri = NULL;
		}

		/* PARANOID: DN and more are not required nor allowed */
		urlrc = ldap_url_parselist_ext( &lud, c->argv[ 1 ], ", \t" );
		if ( urlrc != LDAP_URL_SUCCESS ) {
			char	*why;

			switch ( urlrc ) {
			case LDAP_URL_ERR_MEM:
				why = "no memory";
				break;
			case LDAP_URL_ERR_PARAM:
		  		why = "parameter is bad";
				break;
			case LDAP_URL_ERR_BADSCHEME:
				why = "URL doesn't begin with \"[c]ldap[si]://\"";
				break;
			case LDAP_URL_ERR_BADENCLOSURE:
				why = "URL is missing trailing \">\"";
				break;
			case LDAP_URL_ERR_BADURL:
				why = "URL is bad";
				break;
			case LDAP_URL_ERR_BADHOST:
				why = "host/port is bad";
				break;
			case LDAP_URL_ERR_BADATTRS:
				why = "bad (or missing) attributes";
				break;
			case LDAP_URL_ERR_BADSCOPE:
				why = "scope string is invalid (or missing)";
				break;
			case LDAP_URL_ERR_BADFILTER:
				why = "bad or missing filter";
				break;
			case LDAP_URL_ERR_BADEXTS:
				why = "bad or missing extensions";
				break;
			default:
				why = "unknown reason";
				break;
			}
			snprintf( c->msg, sizeof( c->msg),
					"unable to parse uri \"%s\" "
					"in \"uri <uri>\" line: %s",
					c->value_string, why );
			Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
			urlrc = 1;
			goto done_url;
		}

		for ( i = 0, tmpludp = lud;
				tmpludp;
				i++, tmpludp = tmpludp->lud_next )
		{
			if ( ( tmpludp->lud_dn != NULL
						&& tmpludp->lud_dn[0] != '\0' )
					|| tmpludp->lud_attrs != NULL
					/* || tmpludp->lud_scope != LDAP_SCOPE_DEFAULT */
					|| tmpludp->lud_filter != NULL
					|| tmpludp->lud_exts != NULL )
			{
				snprintf( c->msg, sizeof( c->msg ),
						"warning, only protocol, "
						"host and port allowed "
						"in \"uri <uri>\" statement "
						"for uri #%d of \"%s\"",
						i, c->argv[ 1 ] );
				Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
			}
		}

		for ( i = 0, tmpludp = lud;
				tmpludp;
				i++, tmpludp = tmpludp->lud_next )
			/* just count */
			;
		urllist = ch_calloc( sizeof( char * ), i + 1 );

		for ( i = 0, tmpludp = lud;
				tmpludp;
				i++, tmpludp = tmpludp->lud_next )
		{
			LDAPURLDesc	tmplud;

			tmplud = *tmpludp;
			tmplud.lud_dn = "";
			tmplud.lud_attrs = NULL;
			tmplud.lud_filter = NULL;
			if ( !ldap_is_ldapi_url( tmplud.lud_scheme ) ) {
				tmplud.lud_exts = NULL;
				tmplud.lud_crit_exts = 0;
			}

			urllist[ i ]  = ldap_url_desc2str( &tmplud );

			if ( urllist[ i ] == NULL ) {
				snprintf( c->msg, sizeof( c->msg),
					"unable to rebuild uri "
					"in \"uri <uri>\" statement "
					"for \"%s\"",
					c->argv[ 1 ] );
				Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
				urlrc = 1;
				goto done_url;
			}
		}

		li->li_uri = ldap_charray2str( urllist, " " );
		for ( i = 0; urllist[ i ] != NULL; i++ ) {
			struct berval	bv;

			ber_str2bv( urllist[ i ], 0, 0, &bv );
			ber_bvarray_add( &li->li_bvuri, &bv );
			urllist[ i ] = NULL;
		}
		ldap_memfree( urllist );
		urllist = NULL;

done_url:;
		if ( urllist ) {
			ldap_charray_free( urllist );
		}
		if ( lud ) {
			ldap_free_urllist( lud );
		}
		if ( urlrc != LDAP_URL_SUCCESS ) {
			return 1;
		}
		break;
	}

	case LDAP_BACK_CFG_TLS:
		i = verb_to_mask( c->argv[1], tls_mode );
		if ( BER_BVISNULL( &tls_mode[i].word ) ) {
			return 1;
		}
		li->li_flags &= ~LDAP_BACK_F_TLS_MASK;
		li->li_flags |= tls_mode[i].mask;
		break;

	case LDAP_BACK_CFG_ACL_AUTHCDN:
		switch ( li->li_acl_authmethod ) {
		case LDAP_AUTH_NONE:
			li->li_acl_authmethod = LDAP_AUTH_SIMPLE;
			break;

		case LDAP_AUTH_SIMPLE:
			break;

		default:
			snprintf( c->msg, sizeof( c->msg),
				"\"acl-authcDN <DN>\" incompatible "
				"with auth method %d",
				li->li_acl_authmethod );
			Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
			return 1;
		}
		if ( !BER_BVISNULL( &li->li_acl_authcDN ) ) {
			free( li->li_acl_authcDN.bv_val );
		}
		ber_memfree_x( c->value_dn.bv_val, NULL );
		li->li_acl_authcDN = c->value_ndn;
		BER_BVZERO( &c->value_dn );
		BER_BVZERO( &c->value_ndn );
		break;

	case LDAP_BACK_CFG_ACL_PASSWD:
		switch ( li->li_acl_authmethod ) {
		case LDAP_AUTH_NONE:
			li->li_acl_authmethod = LDAP_AUTH_SIMPLE;
			break;

		case LDAP_AUTH_SIMPLE:
			break;

		default:
			snprintf( c->msg, sizeof( c->msg ),
				"\"acl-passwd <cred>\" incompatible "
				"with auth method %d",
				li->li_acl_authmethod );
			Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
			return 1;
		}
		if ( !BER_BVISNULL( &li->li_acl_passwd ) ) {
			free( li->li_acl_passwd.bv_val );
		}
		ber_str2bv( c->argv[ 1 ], 0, 1, &li->li_acl_passwd );
		break;

	case LDAP_BACK_CFG_ACL_METHOD:
	case LDAP_BACK_CFG_ACL_BIND:
		for ( i = 1; i < c->argc; i++ ) {
			if ( bindconf_parse( c->argv[ i ], &li->li_acl ) ) {
				return 1;
			}
		}
		break;

	case LDAP_BACK_CFG_IDASSERT_MODE:
		i = verb_to_mask( c->argv[1], idassert_mode );
		if ( BER_BVISNULL( &idassert_mode[i].word ) ) {
			if ( strncasecmp( c->argv[1], "u:", STRLENOF( "u:" ) ) == 0 ) {
				li->li_idassert_mode = LDAP_BACK_IDASSERT_OTHERID;
				ber_str2bv( c->argv[1], 0, 1, &li->li_idassert_authzID );
				li->li_idassert_authzID.bv_val[ 0 ] = 'u';
				
			} else {
				struct berval	id, ndn;

				ber_str2bv( c->argv[1], 0, 0, &id );

				if ( strncasecmp( c->argv[1], "dn:", STRLENOF( "dn:" ) ) == 0 ) {
					id.bv_val += STRLENOF( "dn:" );
					id.bv_len -= STRLENOF( "dn:" );
				}

				rc = dnNormalize( 0, NULL, NULL, &id, &ndn, NULL );
                                if ( rc != LDAP_SUCCESS ) {
                                        Debug( LDAP_DEBUG_ANY,
                                                "%s: line %d: idassert ID \"%s\" is not a valid DN\n",
                                                c->fname, c->lineno, c->argv[1] );
                                        return 1;
                                }

                                li->li_idassert_authzID.bv_len = STRLENOF( "dn:" ) + ndn.bv_len;
                                li->li_idassert_authzID.bv_val = ch_malloc( li->li_idassert_authzID.bv_len + 1 );
                                AC_MEMCPY( li->li_idassert_authzID.bv_val, "dn:", STRLENOF( "dn:" ) );
                                AC_MEMCPY( &li->li_idassert_authzID.bv_val[ STRLENOF( "dn:" ) ], ndn.bv_val, ndn.bv_len + 1 );
                                ch_free( ndn.bv_val );

                                li->li_idassert_mode = LDAP_BACK_IDASSERT_OTHERDN;
			}

		} else {
			li->li_idassert_mode = idassert_mode[i].mask;
		}

		if ( c->argc > 2 ) {
			int	i;

			for ( i = 2; i < c->argc; i++ ) {
				if ( strcasecmp( c->argv[ i ], "override" ) == 0 ) {
					li->li_idassert_flags |= LDAP_BACK_AUTH_OVERRIDE;

				} else if ( strcasecmp( c->argv[ i ], "prescriptive" ) == 0 ) {
					li->li_idassert_flags |= LDAP_BACK_AUTH_PRESCRIPTIVE;

				} else if ( strcasecmp( c->argv[ i ], "non-prescriptive" ) == 0 ) {
					li->li_idassert_flags &= ( ~LDAP_BACK_AUTH_PRESCRIPTIVE );

				} else if ( strcasecmp( c->argv[ i ], "obsolete-proxy-authz" ) == 0 ) {
					if ( li->li_idassert_flags & LDAP_BACK_AUTH_OBSOLETE_ENCODING_WORKAROUND ) {
						Debug( LDAP_DEBUG_ANY,
                                       	 		"%s: line %d: \"obsolete-proxy-authz\" flag "
                                        		"in \"idassert-mode <args>\" "
                                        		"incompatible with previously issued \"obsolete-encoding-workaround\" flag.\n",