usr/src/lib/libnisdb/ldap_ruleval.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2015 Gary Mills
  23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  24  * Use is subject to license terms.
  25  */
  26
  27
  28 #include <lber.h>
  29 #include <ldap.h>
  30 #include <strings.h>
  31
  32 #include "nisdb_mt.h"
  33
  34 #include "ldap_util.h"
  35 #include "ldap_val.h"
  36 #include "ldap_attr.h"
  37 #include "ldap_ldap.h"
  38 #include "ldap_ruleval.h"
  39
  40
  41 /*
  42  * Free an array of 'count' rule-value elements.
  43  */
  44 void
  45 freeRuleValue(__nis_rule_value_t *rv, int count) {
  46         int     n, i, j;
  47
  48         if (rv == 0)
  49                 return;
  50
  51         for (n = 0; n < count; n++) {
  52
  53                 if (rv[n].colName != 0) {
  54                         for (i = 0; i < rv[n].numColumns; i++) {
  55                                 sfree(rv[n].colName[i]);
  56                         }
  57                         free(rv[n].colName);
  58                 }
  59                 if (rv[n].colVal != 0) {
  60                         for (i = 0; i < rv[n].numColumns; i++) {
  61                                 for (j = 0; j < rv[n].colVal[i].numVals; j++) {
  62                                         sfree(rv[n].colVal[i].val[j].value);
  63                                 }
  64                                 if (rv[n].colVal[i].numVals > 0)
  65                                         sfree(rv[n].colVal[i].val);
  66                         }
  67                         free(rv[n].colVal);
  68                 }
  69
  70                 if (rv[n].attrName != 0) {
  71                         for (i = 0; i < rv[n].numAttrs; i++) {
  72                                 sfree(rv[n].attrName[i]);
  73                         }
  74                         free(rv[n].attrName);
  75                 }
  76                 if (rv[n].attrVal != 0) {
  77                         for (i = 0; i < rv[n].numAttrs; i++) {
  78                                 for (j = 0; j < rv[n].attrVal[i].numVals;
  79                                                 j++) {
  80                                         sfree(rv[n].attrVal[i].val[j].value);
  81                                 }
  82                                 if (rv[n].attrVal[i].numVals > 0)
  83                                         sfree(rv[n].attrVal[i].val);
  84                         }
  85                         free(rv[n].attrVal);
  86                 }
  87
  88         }
  89         sfree(rv);
  90 }
  91
  92 /*
  93  * Return an array of 'count' __nis_rule_value_t elements, initialized
  94  * to be copies of 'rvIn' if supplied; empty otherwise.
  95  */
  96 __nis_rule_value_t *
  97 initRuleValue(int count, __nis_rule_value_t *rvIn) {
  98         return (growRuleValue(0, count, 0, rvIn));
  99 }
 100
 101 static const __nis_rule_value_t rvZero = {0};
 102
 103 /*
 104  * Grow 'old' from 'oldCount' to 'newCount' elements, initialize the
 105  * new portion to 'rvIn' (empty if not supplied), and return a pointer
 106  * to the result. Following a call to this function, the caller must
 107  * refer only to the returned array, not to 'old'.
 108  */
 109 __nis_rule_value_t *
 110 growRuleValue(int oldCount, int newCount, __nis_rule_value_t *old,
 111                 __nis_rule_value_t *rvIn) {
 112         __nis_rule_value_t      *rv;
 113         int                     i;
 114         char                    *myself = "growRuleValue";
 115
 116         if (newCount <= 0 || newCount <= oldCount)
 117                 return (old);
 118
 119         if (oldCount <= 0) {
 120                 oldCount = 0;
 121                 old = 0;
 122         }
 123
 124         if (rvIn == 0)
 125                 rvIn = (__nis_rule_value_t *)&rvZero;
 126
 127         rv = reallocarray(old, newCount, sizeof (rv[0]));
 128         if (rv == 0) {
 129                 logmsg(MSG_NOMEM, LOG_ERR,
 130                         "%s: realloc(%d ((%d+%d)*%d)) => 0",
 131                         myself, (oldCount+newCount) * sizeof (rv[0]),
 132                         oldCount, newCount, sizeof (rv[0]));
 133                 freeRuleValue(old, oldCount);
 134                 return (0);
 135         }
 136
 137         (void) memset(&rv[oldCount], 0, (newCount-oldCount)*sizeof (rv[0]));
 138
 139         for (i = oldCount; i < newCount; i++) {
 140                 rv[i].numColumns = rvIn->numColumns;
 141                 if (rv[i].numColumns > 0) {
 142                         rv[i].colName = cloneName(rvIn->colName,
 143                                         rv[i].numColumns);
 144                         rv[i].colVal = cloneValue(rvIn->colVal,
 145                                         rv[i].numColumns);
 146                 }
 147                 if (rv[i].numColumns > 0 &&
 148                                 (rv[i].colName == 0 || rv[i].colVal == 0)) {
 149                         freeRuleValue(rv, i);
 150                         return (0);
 151                 }
 152                 rv[i].numAttrs = rvIn->numAttrs;
 153                 rv[i].attrName = cloneName(rvIn->attrName, rv[i].numAttrs);
 154                 rv[i].attrVal = cloneValue(rvIn->attrVal, rv[i].numAttrs);
 155                 if (rv[i].numAttrs > 0 &&
 156                         (rv[i].attrName == 0 || rv[i].attrVal == 0)) {
 157                         freeRuleValue(rv, i);
 158                         return (0);
 159                 }
 160         }
 161
 162         return (rv);
 163 }
 164
 165 /*
 166  * Merge the source rule-value 's' into the target rule-value 't'.
 167  * If successful, unless 's' is a sub-set of 't', 't' will be changed
 168  * on exit, and will contain the values from 's' as well.
 169  */
 170 int
 171 mergeRuleValue(__nis_rule_value_t *t, __nis_rule_value_t *s) {
 172         int     i, j;
 173
 174         if (s == 0)
 175                 return (0);
 176         else if (t == 0)
 177                 return (-1);
 178
 179         for (i = 0; i < s->numColumns; i++) {
 180                 for (j = 0; j < s->colVal[i].numVals; j++) {
 181                         if (addCol2RuleValue(s->colVal[i].type, s->colName[i],
 182                                         s->colVal[i].val[j].value,
 183                                         s->colVal[i].val[j].length,
 184                                         t))
 185                                 return (-1);
 186                 }
 187         }
 188
 189         for (i = 0; i < s->numAttrs; i++) {
 190                 for (j = 0; j < s->attrVal[i].numVals; j++) {
 191                         if (addAttr2RuleValue(s->attrVal[i].type,
 192                                         s->attrName[i],
 193                                         s->attrVal[i].val[j].value,
 194                                         s->attrVal[i].val[j].length,
 195                                         t))
 196                                 return (-1);
 197                 }
 198         }
 199
 200         return (0);
 201 }
 202
 203 static int
 204 addVal2RuleValue(char *msg, int caseSens, int snipNul, __nis_value_type_t type,
 205                 char *name, void *value, int valueLen,
 206                 int *numP, char ***inNameP, __nis_value_t **inValP) {
 207         int                     i, j, copyLen = valueLen;
 208         __nis_single_value_t    *v;
 209         char                    **inName = *inNameP;
 210         __nis_value_t           *inVal = *inValP;
 211         int                     num = *numP;
 212         int                     (*comp)(const char *s1, const char *s2);
 213         char                    *myself = "addVal2RuleValue";
 214
 215         /* Internal function, so assume arguments OK */
 216
 217         if (msg == 0)
 218                 msg = myself;
 219
 220         /* Should we match the 'inName' value case sensitive or not ? */
 221         if (caseSens)
 222                 comp = strcmp;
 223         else
 224                 comp = strcasecmp;
 225
 226         /*
 227          * String-valued NIS+ entries count the concluding NUL in the
 228          * length, while LDAP entries don't. In order to support this,
 229          * we implement the following for vt_string value types:
 230          *
 231          * If the last byte of the value isn't a NUL, add one to the
 232          * allocated length, so that there always is a NUL after the
 233          * value, making it safe to pass to strcmp() etc.
 234          *
 235          * If 'snipNul' is set (presumably meaning we're inserting a
 236          * value derived from a NIS+ entry), and the last byte of the
 237          * value already is a NUL, decrement the length to be copied by
 238          * one. This (a) doesn't count the NUL in the value length, but
 239          * (b) still leaves a NUL following the value.
 240          *
 241          * In N2L, for all cases we set 'copyLen' to the number of non-0
 242          * characters in 'value'.
 243          */
 244         if (type == vt_string && valueLen > 0) {
 245                 char    *charval = value;
 246
 247                 if (charval[valueLen-1] != '\0')
 248                         valueLen += 1;
 249                 else if (yp2ldap || snipNul)
 250                         copyLen -= 1;
 251         } else if (valueLen == 0) {
 252                 /*
 253                  * If the 'value' pointer is non-NULL, we create a zero-
 254                  * length value with one byte allocated. This takes care
 255                  * of empty strings.
 256                  */
 257                 valueLen += 1;
 258         }
 259
 260         /* If we already have values for this attribute, add another one */
 261         for (i = 0; i < num; i++) {
 262                 if ((*comp)(inName[i], name) == 0) {
 263
 264                         /*
 265                          * Our caller often doesn't know the type of the
 266                          * value; this happens because the type (vt_string
 267                          * or vt_ber) is determined by the format in the
 268                          * rule sets, and we may be invoked as a preparation
 269                          * for evaluating the rules. Hence, we only use the
 270                          * supplied 'type' if we need to create a value.
 271                          * Otherwise, we accept mixed types.
 272                          *
 273                          * Strings are OK in any case, since we always make
 274                          * sure to have a zero byte at the end of any value,
 275                          * whatever the type.
 276                          */
 277
 278                         if (inVal[i].numVals < 0) {
 279                                 /*
 280                                  * Used to indicate deletion of attribute,
 281                                  * so we honor that and don't add a value.
 282                                  */
 283                                 return (0);
 284                         }
 285
 286                         /*
 287                          * If 'value' is NULL, we should delete, so
 288                          * remove any existing values, and set the
 289                          * 'numVals' field to -1.
 290                          */
 291                         if (value == 0) {
 292                                 for (j = 0; j < inVal[i].numVals; j++) {
 293                                         sfree(inVal[i].val[j].value);
 294                                 }
 295                                 sfree(inVal[i].val);
 296                                 inVal[i].val = 0;
 297                                 inVal[i].numVals = -1;
 298                                 return (0);
 299                         }
 300
 301                         /* Is the value a duplicate ? */
 302                         for (j = 0; j < inVal[i].numVals; j++) {
 303                                 if (copyLen == inVal[i].val[j].length &&
 304                                         memcmp(value, inVal[i].val[j].value,
 305                                                 copyLen) == 0) {
 306                                         break;
 307                                 }
 308                         }
 309                         if (j < inVal[i].numVals)
 310                                 return (0);
 311
 312                         /* Not a duplicate, so add the name/value pair */
 313                         v = reallocarray(inVal[i].val,
 314                                          inVal[i].numVals + 1,
 315                                          sizeof (inVal[i].val[0]));
 316                         if (v == 0)
 317                                 return (-1);
 318                         inVal[i].val = v;
 319                         v[inVal[i].numVals].length = copyLen;
 320                         v[inVal[i].numVals].value = am(msg, valueLen);
 321                         if (v[inVal[i].numVals].value == 0 &&
 322                                         value != 0) {
 323                                 sfree(v);
 324                                 return (-1);
 325                         }
 326                         memcpy(v[inVal[i].numVals].value, value, copyLen);
 327                         inVal[i].numVals++;
 328
 329                         return (0);
 330                 }
 331         }
 332
 333         /* No previous value for this attribute */
 334
 335         /*
 336          * value == 0 means deletion, in which case we create a
 337          * __nis_value_t with the numVals field set to -1.
 338          */
 339         if (value != 0) {
 340                 if ((v = am(msg, sizeof (*v))) == 0)
 341                         return (-1);
 342                 v->length = copyLen;
 343                 v->value = am(msg, valueLen);
 344                 if (v->value == 0 && value != 0) {
 345                         sfree(v);
 346                         return (-1);
 347                 }
 348                 memcpy(v->value, value, copyLen);
 349         }
 350
 351         inVal = reallocarray(inVal, num + 1, sizeof (inVal[0]));
 352         if (inVal == 0) {
 353                 if (value != 0) {
 354                         sfree(v->value);
 355                         sfree(v);
 356                 }
 357                 return (-1);
 358         }
 359         *inValP = inVal;
 360
 361         inName = reallocarray(inName, num + 1, sizeof (inName[0]));
 362         if (inName == 0 || (inName[num] =
 363                         sdup(msg, T, name)) == 0) {
 364                 sfree(v->value);
 365                 sfree(v);
 366                 return (-1);
 367         }
 368         *inNameP = inName;
 369
 370         inVal[num].type = type;
 371         inVal[num].repeat = 0;
 372         if (value != 0) {
 373                 inVal[num].numVals = 1;
 374                 inVal[num].val = v;
 375         } else {
 376                 inVal[num].numVals = -1;
 377                 inVal[num].val = 0;
 378         }
 379
 380         *numP += 1;
 381
 382         return (0);
 383 }
 384
 385 int
 386 addAttr2RuleValue(__nis_value_type_t type, char *name, void *value,
 387                 int valueLen, __nis_rule_value_t *rv) {
 388         char                    *myself = "addAttr2RuleValue";
 389
 390         if (name == 0 || rv == 0)
 391                 return (-1);
 392
 393         return (addVal2RuleValue(myself, 0, 0, type, name, value, valueLen,
 394                                 &rv->numAttrs, &rv->attrName, &rv->attrVal));
 395 }
 396
 397 int
 398 addSAttr2RuleValue(char *name, char *value, __nis_rule_value_t *rv) {
 399         return (addAttr2RuleValue(vt_string, name, value, slen(value), rv));
 400 }
 401
 402 int
 403 addCol2RuleValue(__nis_value_type_t type, char *name, void *value,
 404                 int valueLen, __nis_rule_value_t *rv) {
 405         char *myself = "addCol2RuleValue";
 406
 407         if (name == 0 || rv == 0)
 408                 return (-1);
 409
 410         return (addVal2RuleValue(myself, 1, 1, type, name, value, valueLen,
 411                                 &rv->numColumns, &rv->colName, &rv->colVal));
 412 }
 413
 414 int
 415 addSCol2RuleValue(char *name, char *value, __nis_rule_value_t *rv) {
 416         return (addCol2RuleValue(vt_string, name, value, slen(value), rv));
 417 }
 418
 419 /*
 420  * Given a table mapping, a NIS+ DB query, and (optionally) an existing
 421  * and compatible __nis_rule_value_t, return a new __nis_rule_value_t
 422  * with the values from the query added.
 423  */
 424 __nis_rule_value_t *
 425 buildNisPlusRuleValue(__nis_table_mapping_t *t, db_query *q,
 426                         __nis_rule_value_t *rv) {
 427         int                     i;
 428
 429         if (t == 0 || q == 0)
 430                 return (0);
 431
 432         rv = initRuleValue(1, rv);
 433         if (rv == 0)
 434                 return (0);
 435
 436         for (i = 0; i < q->components.components_len; i++) {
 437
 438                 /* Ignore out-of-range column index */
 439                 if (q->components.components_val[i].which_index >=
 440                                 t->numColumns)
 441                         continue;
 442
 443                 /*
 444                  * Add the query value. A NULL value indicates deletion,
 445                  * but addCol2RuleValue() takes care of that for us.
 446                  */
 447                 if (addCol2RuleValue(vt_string,
 448                                 t->column[q->components.components_val[i].
 449                                                 which_index],
 450                                 q->components.components_val[i].index_value->
 451                                         itemvalue.itemvalue_val,
 452                                 q->components.components_val[i].index_value->
 453                                         itemvalue.itemvalue_len, rv) != 0) {
 454                         freeRuleValue(rv, 1);
 455                         rv = 0;
 456                         break;
 457                 }
 458         }
 459
 460         return (rv);
 461 }
 462
 463
 464 /*
 465  * Given a LHS rule 'rl', return an array containing the item names,
 466  * and the number of elements in the array in '*numItems'.
 467  *
 468  * If there are 'me_match' __nis_mapping_element_t's, we use the
 469  * supplied '*rval' (if any) to derive values for the items in
 470  * the 'me_match', and add the values thus derived to '*rval' (in
 471  * which case the '*rval' pointer will change; the old '*rval'
 472  * is deleted).
 473  */
 474 __nis_mapping_item_t *
 475 buildLvalue(__nis_mapping_rlhs_t *rl, __nis_value_t **rval, int *numItems) {
 476         __nis_value_t           *val, *r;
 477         __nis_mapping_item_t    *item = 0;
 478         int                     i, n, ni = 0, nv = 0;
 479         int                     repeat = 0;
 480
 481         if (rl == 0)
 482                 return (0);
 483
 484         if (rval != 0) {
 485                 r = *rval;
 486                 repeat = r->repeat;
 487         } else
 488                 r = 0;
 489
 490         /* If there is more than one element, we concatenate the items */
 491         for (i = 0; i < rl->numElements; i++) {
 492                 __nis_mapping_element_t *e = &rl->element[i];
 493                 __nis_mapping_item_t    *olditem, *tmpitem = 0;
 494                 __nis_value_t           **tmp;
 495
 496                 switch (e->type) {
 497                 case me_item:
 498                         tmpitem = cloneItem(&e->element.item);
 499                         break;
 500                 case me_match:
 501                         /*
 502                          * Obtain values for the items in the 'me_match'
 503                          * element.
 504                          */
 505                         tmp = matchMappingItem(e->element.match.fmt, r, &nv,
 506                                 0, 0);
 507                         if (tmp != 0) {
 508                                 freeValue(r, 1);
 509                                 val = 0;
 510                                 for (n = 0; n < nv; n++) {
 511                                         r = concatenateValues(val, tmp[n]);
 512                                         freeValue(val, 1);
 513                                         freeValue(tmp[n], 1);
 514                                         val = r;
 515                                         if (val == 0) {
 516                                                 for (n++; n < nv; n++) {
 517                                                         freeValue(tmp[n], 1);
 518                                                 }
 519                                                 break;
 520                                         }
 521                                 }
 522                                 free(tmp);
 523                                 if (rval != 0) {
 524                                         if (repeat && val != 0)
 525                                                 val->repeat = repeat;
 526                                         *rval = val;
 527                                 }
 528                                 for (n = 0; n < e->element.match.numItems;
 529                                                 n++) {
 530                                         olditem = item;
 531                                         item = concatenateMappingItem(item, ni,
 532                                                 &e->element.match.item[n]);
 533                                         freeMappingItem(olditem, ni);
 534                                         if (item == 0) {
 535                                                 ni = 0;
 536                                                 break;
 537                                         }
 538                                         ni++;
 539                                 }
 540                         }
 541                         break;
 542                 case me_print:
 543                 case me_split:
 544                 case me_extract:
 545                 default:
 546                         /* These shouldn't show up on the LHS; ignore */
 547                         break;
 548                 }
 549
 550                 if (tmpitem != 0) {
 551                         olditem = item;
 552                         item = concatenateMappingItem(item, ni, tmpitem);
 553                         freeMappingItem(olditem, ni);
 554                         freeMappingItem(tmpitem, 1);
 555                         ni++;
 556                         if (item == 0) {
 557                                 ni = 0;
 558                                 break;
 559                         }
 560                 }
 561         }
 562
 563         if (numItems != 0)
 564                 *numItems = ni;
 565
 566         return (item);
 567 }
 568
 569 __nis_value_t *
 570 buildRvalue(__nis_mapping_rlhs_t *rl, __nis_mapping_item_type_t native,
 571                 __nis_rule_value_t *rv, int *stat) {
 572         __nis_value_t   *val, *vold = 0, *vnew;
 573         int             i;
 574         char            *myself = "buildRvalue";
 575
 576         if (rl == 0 || rl->numElements <= 0) {
 577                 /*
 578                  * No RHS indicates deletion, as does a __nis_value_t
 579                  * with numVals == -1, so we return such a creature.
 580                  */
 581                 val = am(myself, sizeof (*val));
 582                 if (val != 0) {
 583                         val->type = vt_string;
 584                         val->numVals = -1;
 585                 }
 586                 return (val);
 587         }
 588
 589         /* If there is more than one element, we concatenate the values */
 590         for (i = 0; i < rl->numElements; i++) {
 591                 vnew = getMappingElement(&rl->element[i], native, rv, stat);
 592                 val = concatenateValues(vold, vnew);
 593                 freeValue(vnew, 1);
 594                 freeValue(vold, 1);
 595                 vold = val;
 596         }
 597         return (val);
 598 }
 599
 600 /*
 601  * Derive values for the LDAP attributes specified by the rule 'r',
 602  * and add them to the rule-value 'rv'.
 603  *
 604  * If 'doAssign' is set, out-of-context assignments are performed,
 605  * otherwise not.
 606  */
 607 __nis_rule_value_t *
 608 addLdapRuleValue(__nis_table_mapping_t *t,
 609                         __nis_mapping_rule_t *r,
 610                         __nis_mapping_item_type_t lnative,
 611                         __nis_mapping_item_type_t rnative,
 612                         __nis_rule_value_t *rv,
 613                         int doAssign, int *stat) {
 614         int                     i, j;
 615         __nis_value_t           *rval, *lval;
 616         __nis_mapping_item_t    *litem;
 617         int                     numItems;
 618         char                    **dn = 0;
 619         int                     numDN = 0;
 620         char                    *myself = "addLdapRuleValue";
 621
 622
 623         /* Do we have the required values ? */
 624         if (rv == 0)
 625                 return (0);
 626
 627         /*
 628          * Establish appropriate search base. For rnative == mit_nisplus,
 629          * we're deriving LDAP attribute values from NIS+ columns; in other
 630          * words, we're writing to LDAP, and should use the write.base value.
 631          */
 632         __nisdb_get_tsd()->searchBase = (rnative == mit_nisplus) ?
 633                 t->objectDN->write.base : t->objectDN->read.base;
 634
 635         /* Set escapeFlag if LHS is "dn" to escape special chars */
 636         if (yp2ldap && r->lhs.numElements == 1 &&
 637                 r->lhs.element->type == me_item &&
 638                 r->lhs.element->element.item.type == mit_ldap &&
 639                 strcasecmp(r->lhs.element->element.item.name, "dn") == 0) {
 640                         __nisdb_get_tsd()->escapeFlag = '1';
 641         }
 642
 643         /* Build the RHS value */
 644         rval = buildRvalue(&r->rhs, rnative, rv, stat);
 645
 646         /* Reset escapeFlag */
 647         __nisdb_get_tsd()->escapeFlag = '\0';
 648
 649         if (rval == 0)
 650                 return (rv);
 651
 652         /*
 653          * Special case: If we got no value for the RHS (presumably because
 654          * we're missing one or more item values), we don't produce an lval.
 655          * Note that this isn't the same thing as an empty value, which we
 656          * faithfully try to transmit to LDAP.
 657          */
 658         if (rval->numVals == 1 && rval->val[0].value == 0) {
 659                 freeValue(rval, 1);
 660                 return (rv);
 661         }
 662
 663         /* Obtain the LHS item names */
 664         litem = buildLvalue(&r->lhs, &rval, &numItems);
 665         if (litem == 0) {
 666                 freeValue(rval, 1);
 667                 return (rv);
 668         }
 669
 670         /* Get string representations of the LHS item names */
 671         lval = 0;
 672         for (i = 0; i < numItems; i++) {
 673                 __nis_value_t   *tmpval, *old;
 674
 675                 tmpval = getMappingItem(&litem[i], lnative, 0, 0, NULL);
 676
 677                 /*
 678                  * If the LHS item is out-of-context, we do the
 679                  * assignment right here.
 680                  */
 681                 if (doAssign && litem[i].type == mit_ldap &&
 682                                 litem[i].searchSpec.triple.scope !=
 683                                         LDAP_SCOPE_UNKNOWN &&
 684                                 slen(litem[i].searchSpec.triple.base) > 0 &&
 685                                 (slen(litem[i].searchSpec.triple.attrs) > 0 ||
 686                                 litem[i].searchSpec.triple.element != 0)) {
 687                         int     stat;
 688
 689                         if (dn == 0)
 690                                 dn = findDNs(myself, rv, 1,
 691                                         t->objectDN->write.base,
 692                                         &numDN);
 693
 694                         stat = storeLDAP(&litem[i], i, numItems, rval,
 695                                 t->objectDN, dn, numDN);
 696                         if (stat != LDAP_SUCCESS) {
 697                                 char    *iname = "<unknown>";
 698
 699                                 if (tmpval != 0 &&
 700                                                 tmpval->numVals == 1)
 701                                         iname = tmpval->val[0].value;
 702                                 logmsg(MSG_NOTIMECHECK, LOG_ERR,
 703                                         "%s: LDAP store \"%s\": %s",
 704                                         myself, iname,
 705                                         ldap_err2string(stat));
 706                         }
 707
 708                         freeValue(tmpval, 1);
 709                         continue;
 710                 }
 711
 712                 old = lval;
 713                 lval = concatenateValues(old, tmpval);
 714                 freeValue(tmpval, 1);
 715                 freeValue(old, 1);
 716         }
 717
 718         /* Don't need the LHS items themselves anymore */
 719         freeMappingItem(litem, numItems);
 720
 721         /*
 722          * If we don't have an 'lval' (probably because all litem[i]:s
 723          * were out-of-context assignments), we're done.
 724          */
 725         if (lval == 0 || lval->numVals <= 0) {
 726                 freeValue(lval, 1);
 727                 freeValue(rval, 1);
 728                 return (rv);
 729         }
 730
 731         for (i = 0, j = 0; i < lval->numVals; i++) {
 732                 /* Special case: rval->numVals < 0 means deletion */
 733                 if (rval->numVals < 0) {
 734                         (void) addAttr2RuleValue(rval->type,
 735                                 lval->val[i].value, 0, 0, rv);
 736                         continue;
 737                 }
 738                 /* If we're out of values, repeat the last one */
 739                 if (j >= rval->numVals)
 740                         j = (rval->numVals > 0) ? rval->numVals-1 : 0;
 741                 for (; j < rval->numVals; j++) {
 742                         /*
 743                          * If this is the 'dn', and the value ends in a
 744                          * comma, append the appropriate search base.
 745                          */
 746                         if (strcasecmp("dn", lval->val[i].value) == 0 &&
 747                                         lastChar(&rval->val[j]) == ',' &&
 748                                         t->objectDN->write.scope !=
 749                                                 LDAP_SCOPE_UNKNOWN) {
 750                                 void    *nval;
 751                                 int     nlen = -1;
 752
 753                                 nval = appendString2SingleVal(
 754                                         t->objectDN->write.base, &rval->val[j],
 755                                         &nlen);
 756                                 if (nval != 0 && nlen >= 0) {
 757                                         sfree(rval->val[j].value);
 758                                         rval->val[j].value = nval;
 759                                         rval->val[j].length = nlen;
 760                                 }
 761                         }
 762                         (void) addAttr2RuleValue(rval->type,
 763                                 lval->val[i].value, rval->val[j].value,
 764                                 rval->val[j].length, rv);
 765                         /*
 766                          * If the lval is multi-valued, go on to the
 767                          * other values; otherwise, quit (but increment
 768                          * the 'rval' value index).
 769                          */
 770                         if (!lval->repeat) {
 771                                 j++;
 772                                 break;
 773                         }
 774                 }
 775         }
 776
 777         /* Clean up */
 778         freeValue(lval, 1);
 779         freeValue(rval, 1);
 780
 781         return (rv);
 782 }
 783
 784 /*
 785  * Remove the indicated attribute, and any values for it, from the
 786  * rule-value.
 787  */
 788 void
 789 delAttrFromRuleValue(__nis_rule_value_t *rv, char *attrName) {
 790         int     i;
 791
 792         if (rv == 0 || attrName == 0)
 793                 return;
 794
 795         for (i = 0; i < rv->numAttrs; i++) {
 796                 if (strcasecmp(attrName, rv->attrName[i]) == 0) {
 797                         int     j;
 798
 799                         for (j = 0; j < rv->attrVal[i].numVals; j++)
 800                                 sfree(rv->attrVal[i].val[j].value);
 801                         if (rv->attrVal[i].numVals > 0)
 802                                 sfree(rv->attrVal[i].val);
 803
 804                         sfree(rv->attrName[i]);
 805
 806                         /* Move up the rest of the attribute names/values */
 807                         for (j = i+1; j < rv->numAttrs; j++) {
 808                                 rv->attrName[j-1] = rv->attrName[j];
 809                                 rv->attrVal[j-1] = rv->attrVal[j];
 810                         }
 811
 812                         rv->numAttrs -= 1;
 813
 814                         break;
 815                 }
 816         }
 817 }
 818
 819 /*
 820  * Remove the indicated column, and any values for it, from the
 821  * rule-value.
 822  */
 823 void
 824 delColFromRuleValue(__nis_rule_value_t *rv, char *colName) {
 825         int     i;
 826
 827         if (rv == 0 || colName == 0)
 828                 return;
 829
 830         for (i = 0; i < rv->numColumns; i++) {
 831                 if (strcmp(colName, rv->colName[i]) == 0) {
 832                         int     j;
 833
 834                         for (j = 0; j < rv->colVal[i].numVals; j++)
 835                                 sfree(rv->colVal[i].val[j].value);
 836                         if (rv->colVal[i].numVals > 0)
 837                                 sfree(rv->colVal[i].val);
 838
 839                         sfree(rv->colName[i]);
 840
 841                         /* Move up the rest of the column names/values */
 842                         for (j = i+1; j < rv->numColumns; j++) {
 843                                 rv->colName[j-1] = rv->colName[j];
 844                                 rv->colVal[j-1] = rv->colVal[j];
 845                         }
 846
 847                         rv->numColumns -= 1;
 848
 849                         break;
 850                 }
 851         }
 852 }
 853
 854 /*
 855  * Add the write-mode object classes specified by 'objClassAttrs' to the
 856  * rule-value 'rv'.
 857  * If there's an error, 'rv' is deleted, and NULL returned.
 858  */
 859 __nis_rule_value_t *
 860 addObjectClasses(__nis_rule_value_t *rv, char *objClassAttrs) {
 861         char    *filter = 0, **fc = 0;
 862         int     i, nfc = 0;
 863
 864         /*
 865          * Expect to only use this for existing rule-values, so rv == 0 is
 866          * an error.
 867          */
 868         if (rv == 0)
 869                 return (0);
 870
 871         /*
 872          * If 'objClassAttrs' is NULL, we trivially have nothing to do.
 873          * Assume the caller knows what it's doing, and return success.
 874          */
 875         if (objClassAttrs == 0)
 876                 return (rv);
 877
 878         /*
 879          * Make an AND-filter of the object classes, and split into
 880          * components. (Yes, this is a bit round-about, but leverages
 881          * existing functions.)
 882          */
 883         filter = makeFilter(objClassAttrs);
 884         if (filter == 0) {
 885                 freeRuleValue(rv, 1);
 886                 return (0);
 887         }
 888
 889         fc = makeFilterComp(filter, &nfc);
 890         if (fc == 0 || nfc <= 0) {
 891                 free(filter);
 892                 freeRuleValue(rv, 1);
 893                 return (0);
 894         }
 895
 896         /* Add the objectClass attributes to the rule-value */
 897         for (i = 0; i < nfc; i++) {
 898                 char    *name, *value;
 899
 900                 name = fc[i];
 901                 /* Skip if not of the "name=value" form */
 902                 if ((value = strchr(name, '=')) == 0)
 903                         continue;
 904
 905                 *value = '\0';
 906                 value++;
 907
 908                 /* Skip if the attribute name isn't "objectClass" */
 909                 if (strcasecmp("objectClass", name) != 0)
 910                         continue;
 911
 912                 if (addSAttr2RuleValue(name, value, rv) != 0) {
 913                         free(filter);
 914                         freeFilterComp(fc, nfc);
 915                         freeRuleValue(rv, 1);
 916                         return (0);
 917                 }
 918         }
 919
 920         free(filter);
 921         freeFilterComp(fc, nfc);
 922
 923         return (rv);
 924 }
 925
 926
 927 static char *
 928 valString(__nis_value_t *val) {
 929         int     i;
 930
 931         if (val == 0 || val->type != vt_string)
 932                 return (0);
 933
 934         for (i = 0; i < val->numVals; i++) {
 935                 /* Look for a non-NULL, non-zero length value */
 936                 if (val->val[i].value != 0 && val->val[i].length > 0) {
 937                         char    *v = val->val[i].value;
 938
 939                         /*
 940                          * Check that there's a NUL at the end. True,
 941                          * if there isn't, we may be looking beyond
 942                          * allocated memory. However, we would have done
 943                          * so in any case when the supposed string was
 944                          * traversed (printed, etc.), very possibly by
 945                          * a lot more than one byte. So, it's better to
 946                          * take a small risk here than a large one later.
 947                          */
 948                         if (v[val->val[i].length-1] == '\0' ||
 949                                         v[val->val[i].length] == '\0')
 950                                 return (v);
 951                 }
 952         }
 953
 954         return (0);
 955 }
 956
 957 char *
 958 findVal(char *name, __nis_rule_value_t *rv, __nis_mapping_item_type_t type) {
 959         int     i;
 960
 961         if (type == mit_nisplus) {
 962                 for (i = 0; i < rv->numColumns; i++) {
 963                         if (rv->colName[i] == 0)
 964                                 continue;
 965                         if (strcmp(name, rv->colName[i]) == 0) {
 966                                 return (valString(&rv->colVal[i]));
 967                         }
 968                 }
 969         } else if (type == mit_ldap) {
 970                 for (i = 0; i < rv->numAttrs; i++) {
 971                         if (rv->attrName[i] == 0)
 972                                 continue;
 973                         if (strcasecmp(name, rv->attrName[i]) == 0) {
 974                                 return (valString(&rv->attrVal[i]));
 975                         }
 976                 }
 977         }
 978
 979         return (0);
 980 }
 981
 982 static char     *norv = "<NIL>";
 983 static char     *unknown = "<unknown>";
 984
 985 /*
 986  * Attempt to derive a string identifying the rule-value 'rv'. The
 987  * returned string is a pointer, either into 'rv', or to static
 988  * storage, and must not be freed.
 989  */
 990 char *
 991 rvId(__nis_rule_value_t *rv, __nis_mapping_item_type_t type) {
 992         char    *v;
 993
 994         if (rv == 0)
 995                 return (norv);
 996
 997         if (rv->numColumns > 0 && type == mit_nisplus) {
 998                 /*
 999                  * Look for a column called "cname" or "name".
1000                  * If that fails, try "key" or "alias".
1001                  */
1002                 if ((v = findVal("cname", rv, type)) != 0)
1003                         return (v);
1004                 else if ((v = findVal("name", rv, type)) != 0)
1005                         return (v);
1006                 else if ((v = findVal("key", rv, type)) != 0)
1007                         return (v);
1008                 else if ((v = findVal("alias", rv, type)) != 0)
1009                         return (v);
1010         } else if (rv->numAttrs > 0 && type == mit_ldap) {
1011                 /*
1012                  * Look for "dn", or "cn".
1013                  */
1014                 if ((v = findVal("dn", rv, type)) != 0)
1015                         return (v);
1016                 else if ((v = findVal("cn", rv, type)) != 0)
1017                         return (v);
1018         }
1019
1020         return (unknown);
1021 }
1022
1023 /*
1024  * Merge the rule-values with the same DN into one. Each rule-value
1025  * in the returned array will have unique 'dn'. On entry, *numVals
1026  * contains the number of rule-values in 'rv'. On exit, it contains
1027  * the number of rule-values in the returned array or -1 on error.
1028  */
1029 __nis_rule_value_t *
1030 mergeRuleValueWithSameDN(__nis_rule_value_t *rv, int *numVals) {
1031         __nis_rule_value_t      *rvq = 0;
1032         char                    *dn, *odn;
1033         int                     count = 0;
1034         int                     i, j;
1035
1036         if (numVals == 0)
1037                 return (0);
1038
1039         for (i = 0; i < *numVals; i++) {
1040                 if ((dn = findVal("dn", &rv[i], mit_ldap)) != 0) {
1041                         for (j = 0; j < count; j++) {
1042                                 if ((odn = findVal("dn", &rvq[j],
1043                                                 mit_ldap)) != 0) {
1044                                         /* case sensitive compare */
1045                                         if (strcmp(dn, odn) != 0)
1046                                                 continue;
1047                                         if (mergeRuleValue(&rvq[j],
1048                                                         &rv[i]) == -1) {
1049                                                 freeRuleValue(rvq, count);
1050                                                 *numVals = -1;
1051                                                 return (0);
1052                                         }
1053                                         break;
1054                                 } else {
1055                                         freeRuleValue(rvq, count);
1056                                         *numVals = -1;
1057                                         return (0);
1058                                 }
1059                         }
1060                         /* if no match, then add it to the rulevalue array */
1061                         if (j == count) {
1062                                 rvq = growRuleValue(count, count + 1, rvq,
1063                                                                         &rv[i]);
1064                                 if (rvq == 0) {
1065                                         *numVals = -1;
1066                                         return (0);
1067                                 }
1068                                 count++;
1069                         }
1070                 }
1071         }
1072
1073         *numVals = count;
1074         return (rvq);
1075 }