CVS log for servers/slapd/acl.c

Up to [OpenLDAP] / servers / slapd

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

ITS#6804 fix ACL_RECORD_VALUE_STATE macro, was skipping past the ACL
instead of resuming from the intended one

Happy New Year

ITS#6693 value dependent ACL didn't work when they were the first ACL

add support for ADD_IF_NOT_PRESENT and SOFTDEL internal modification types (ITS#6561)

happy belated New Year

handle valid non-entry internal search responses (ITS#6481)

ITS#6287 Rewritten the ACL state cache

Update copyright notices

more about ITS#5804

fix previous commit (related to ITS#5804)

Silence gcc -Wformat: Put rev 1.343's debugmsg in Debug() so -Wformat can check

silence warnings

Fix warnings an a real bug hidden by the lack of warning...

fix previous commit (related to ITS#5804)

Add ACL <who> regex-substitution from attribute value submatches. Cf ITS#5804

ITS#5572 from Rein

ITS#4556 allow Add content checking to be configured per-DB

don't free and reuse filter structure; don't rewrite undefined filter values (ITS#5731,ITS#5732)

fix log message

don't copy strings if not necessary

fix continuation checking in dynacl (ITS#5637)

fix handling of multiple attrs in URI (ITS#5516)

Propagate o_extra too

allow tracing of set failures

fix optional URI attrs handling in sets (ITS#5384)

Happy New Year (belated)

fix declarations of buffers for numeric strings; other related cleanup

Silence warning

Tweak ACL cache messages

Use attr_valfind instead of value_find_ex to optimize lookups

add helper for internal searchs for objectClass=*

remove unused code

Fallout from ITS#4986 - remove unused param of select_backend()

fix ITS#4874

allow to specify the required access privileges in internal operations (ITS#4806)

happy new year

silence warning

more portable fix to ITS#4756

implement full IPv6 support in ACLs; use URL notation (as suggested by Howard) to disambiguate parsing (ITS#4756)

minor cleanup

s/managedit/relax/
#unifdef -DSLAP_RELAX

Some LDAP_DEVEL cleanup

Minor typo fix (maintaned -> maintained)

RE23 seems to still need these ACL states

Cleanup unused fields from prev commit

ITS#4253 fix value-dependent ACL caching - just record the ACL we'll start
looking for, don't cache anything else.

ITS#4587 fix for uniquemember/NameAndOptionalUID syntax

Do "selfwrite" check independent of other <who> clauses (ITS#4587)

record value-dependent state for acl_mask_dn() (ITS#4587)

test for ITS#4587; another bit of fix for that

ITS#4587, selfwrite should apply to more than just USERS acl's

acl_match_set(): Initialize bvals before backend_attribute(,,,,&bvals,);

Fix dynacl tgrant/tdeny initialization

unifdef -DSLAP_ACL_HONOR_DISCLOSE
unifdef -DSLAP_ACL_HONOR_MANAGE
unifdef -DSLAP_OVERLAY_ACCESS
unifdef -DSLAP_ORDERED_PRETTYNORM
unifdef -DSLAP_AUTHZ_SYNTAX
Move LDAP_COLLECTIVE_ATTRIBUTES, LDAP_COMP_MATCH, and LDAP_SYNC_TIMESTAMP
back behind LDAP_DEVEL (as these either too experimental or not yet
implemented).

factor ACI code out of slapd; now it can only use dynacl layer

fix self<access> for "users" (ITS#4299)

Happy new year!

Handle LDAP_MOD_INCREMENT in acl_check_modlist()

normalize value in "exact" attrval clause (ITS#4255)

ITS#4218 streamline frontend/overlay access_allowed. Probably need to
do the same for acl_group and acl_attribute.

use lutil_ato*() whenever appropriate

further isolation and cleanup of ACI code

Move CSN invocations to backends

silence warnings

fix uninitialized, signedness and other issues (ITS#3854)

further ACI factoring out & confinement

merge sml_managing into sml_flags (SLAP_MOD_MANAGING)

more on manage access level

more on manage

ACIs almost entirely factored out of slapd
Added OpenLDAPaciSyntax based on ITS#3877 by Nikita Shulga
aci_mask() doesn't exploit the normalized value yet (next step)
The case #define SLAPD_ACI_ENABLED / #undef SLAP_DYNACL should
be removed

fix small issues with dynacl and ACI in general

trim use of uninitialized data; please review

ACL logging was incomplete (and misleading)

Silence unused variable warnings

fix previous commit (see NOTE and FIXMEs)

Add fe_access_allowed(), should allow global ACL overlays to work

backout previous commit: frontendDB doesn't have the right rootn, ACLs and so

Support for global ACL overlays, corresponding SLAPI support

Move most of SLAPI frontend into overlay

Delete unused variable.

assert expects int. (int)<nonnull ptr/long> can be 0. Use assert(arg!=0/NULL).

fix further ITS#3830 issues; allow to specify a matching rule for non-DN match

Format fix: Make style_strings[] global for debug output in dynacl_aci_parse()

ITS#3830, fix val-specific ACLs

symbol rename for AIX (ITS#3787)

Add SLAP_MOD_INTERNAL flag to Modifications, allow internal ops to bypass
ACL checks when modifying user-modifiable attributes as non-root user.

More value ACL style tweaks

partially revert previous commit (ITS#3652)

more on ITS#3652

fix slapacl when doing cross-database access checking

cleanup previous commit

hide changes behind specific #ifdef, conditioned by LDAP_DEBUG; always allow access on back-dnssrv

cleanup previous commit

add ACL hook to overlays

cleanup & silence warnings

implement add/delete granularity in write access (ITS#3631)

cleanup previous commits

implement "realdn" by clause in ACLs (ITS#3627; accounting for Howard's remarks)

initial commit of "level" styles for "dn" and "self" by clauses (ITS#3615)

more dnParent() and misc cleanup

minor cleanup

Convert backendInfo/backendDB to STAILQs

In aci_set_gather propagate op->o_private to subordinate search

Added acl_unparse, slap_sasl_getpolicy

cosmetic changes

Add "disclose" and "manage" ACL levels (but no meat).

Disclose permission intended to be used for "disclose on error"
(as in our present "none"), none being "don't disclose on error".

Manage permission is intended to be used to allow DSA IT management
(e.g., changing entryCSNs, structuralObjectClass, etc.).

Happy New Year!

fix dynacl compile

Split Operation into Opheader and op

Disable back-bdb native syncrepl support, enable syncprov overlay,
remove syncrepl stuff from Operation struct

should fix compile when SLAPD_ACI_ENABLED is undefined

allow a "users" type in ACI

more cleanup and ITS number

cleanup fix to ITS#3303

fix ITS#3303

add more semantics to the "type" field; fix a bug in anonymous operations; treat children aci_mask() as internal searches

move ACIs under a dynamic infrastructure that allows run-time loadable custom access control logic (needs work)

partially revert previous commit (the "creator" special DN pattern is redundant as "dnattr" is more expressive

move special dn patterns to style enum; add creator special dn pattern

improve memory allocation in sets

"optimize" sets: since the attr part must be an attribute, use the AttributeDescription

improve previous commit

fix previous commit

improve previous commit; now attrs in URI, if any, are added to that in the [<dn>]/<attr> form

add URI search to sets; documentation to come...

s/free/slap_sl_free/

extend the availability of submatches to non-regex DN patterns

fix string_expand error cases; cleanup

unifdef -UNEW_LOGGING

Reworked fix for ITS#3140 - add access parameter to backend_attribute

cleanup

frontend stuff moved into a database structure, essentially to allow overlays to be processed before database selection; passes all tests (ITS#3080)

quick fix for ITS#3215; needs work to re-enable ACI caching, if possible at all

beautify comment

fix ITS#3140

fix DN_SEPARATOR() and clarify its use

more on fixing escaped semicolon in normalized DN

use fist backend only if there is no global ACL (ITS#3100)

revert prevuos NULL o_bd commit

improve dn.one="" fix

global ACLs were not used because op->o_bd is set to &backends[0] if NULL

fix acl bug when using dn.one=""

ITS#3092: Rename sl_free() and friends to slap_sl_free()

add slapacl tool

bvalue cleanup

use BER_BVNULL

swap be_isroot and be_isroot_dn symbols

exploit new isroot_dn helper

Yet more for ITS#3008. Seems to work properly now.

More for ITS#3008

ITS#3008 fix value-based ACLs

allow "expand" style in peername, sockname, sockurl as well; more sanity checks

use "expand" instead of "regex" for group ACLs that allow substring expansion, preserving backwards compatibility; add sanity checks

apply advanced peername ACL (ITS#2907)

Happy new year

Make defaulted backend available to ACL plugin pblock

Fix ACL plugin bug - return value of ACL plugins was being ignored

Fix assertion failure if acl_check_modlist() called where op->o_bd == NULL.

Behavior now matches access_allowed() - the first backend is used. The
code needs review, I have not tested it.

Don't require slapi to be in the path - always include slapi/slapi.h

cleanup most of the -pedantic warnings (ITS#2884) and other small fixes

First round of SLAPI cleanups - use slapi_int_XXX for internal functions
(slapi_x_XXX is still reserved for exported functions that are not part
of the SLAPI specification)

add to 'val[.<style>=<value>' ACLs special match styles for DN-valued attributes; add negated objectClass to attribute name lists for ACLs and partial replication

Updated notices

SLAPI fix - no-op when slapi_plugins_used == 0

ITS#2497, implement value-level ACLs:
	access to attr=foo val.regex=bar.*

ITS#2679 don't use cached ACL state from different attribute

subtree ACI patch from Ralf

Support for ACL plugins

ITS#2529 null DN in log

cleanup

remove dnNormalize2
replace calls to dnNormalize2 with calls to dnNormalize

Don't pollute op->o_bd in access_allowed()

fix ACI per-thread memory management

Memory context tweaks for Bind

More memory context tweaks

#ifdef -DSLAP_NVALUES

fix new API leftover

Major API change - (SLAP_OP_BLOCKS) All request parameters are
consolidated into the Operation structure. All reply parameters
are consolidated into the new SlapReply structure. Most operations
now have identical call signatures... Changes are not #ifdef'd,
revert to -r NO_SLAP_OP_BLOCKS if necessary to back out.

SLAP_NVALUES tweaks - after input, a_nvals is always populated. If there is
no normalizer, a_nvals = a_vals.

Fix typo

SLAP_NVALUES changes
and misc cleanup

Fix test006-acls

NVALUES: fix a couple of value_find_ex() calls

(ultimately?) fix ITS#2361

ITS#2361, skip sockname, peername, peerdomain, sockurl ACLs if the
corresponding conn->field is NULL. (overwrites previous commit.)

check conn->c_listener before use (hack to fix ITS#2361; need to review this part of slapi)

Added op->o_is_auth_check; use ACL_AUTH instead of ACL_SEARCH/ACL_READ
in access_allowed() if flag is set. Set in sasl/saslauth searches.

SLAP_NVALUES:
	schema engine updated (but not schema routines so things don't run yet)
	nvalues mostly populated, enough for tests 0-2 to pass
	schema routines needs lots of work
	modify/mods codes needs lots of work

blind fix

Change MR flag names and add comments as to what they mean to slap.h

ITS#2285 string_expand for acl set

Happy new year

fix initialization size and silence warning

Fix typo in prev commit value_find/_ex

Added SLAP_MR_VALUE_NORMALIZED_MATCH, avoid redundant normalize when
calling value_find with already-normalized DNs

ITS#1523 enhanced ACL caching

Code cleanup (no functional changes)

use bvmatch() instead of ber_bvcmp() when testing for match without ordering

Pass Operation to backend_attribute - should have been doing this all along.

consistently reduce string_expand bv_len by 1

Forced commit:
The log entries for the previous two commits were swapped by mistake.

Patch: add OpenLDAPaci #public# access  (ITS#2005)

			================
Written by Hallvard B. Furuseth and placed into the public domain.
This software is not subject to any license of the University of Oslo.
			================

I couldn't find a way for an OpenLDAPaci to grant public access to an
entry, so I added a dnType #public# for that.  It is in the position
of subjectDn in the draft, which seems kind of stupid, so I put it
in the position of dnType instead.

Hallvard B. Furuseth <h.b.furuseth@usit.uio.no>, Aug 2002.

Patch: ACL #access-id#<invalid-DN> granted access to everyone  (ITS#2006)

			================
Written by Hallvard B. Furuseth and placed into the public domain.
This software is not subject to any license of the University of Oslo.
			================

There is a bug in OpenLDAPaci's "access-id":  If the specified DN is
invalid so dnNormalize2() fails, everyone gets access.
This means that e.g. "#access-id#[all]" gives public access, so it
might be considered a feature, but I fixed it anyway:-)  I guess that
means the change should be documented in the release notes, though.

See also ITS#2005 (add OpenLDAPaci #public# access).

Hallvard B. Furuseth <h.b.furuseth@usit.uio.no>, Aug 2002.

clean up curly matching

misc cleanup

Coverted LDAP_LOG macro to use subsystem ID int values instead of string values

Fix ACL to dn="" bug

small cleanup

define and normalize static bervals alltogether

Remove lint.

use BVC() macro (changed in BER_BVC) to initialize constant bervals

uniform temporary buf sizes; use automatic buffers instead of heap

various acl improvements/cleanups/speedups (need to be documented, though)

the logic of this check was completely reversed; in case '*' is used, on't test the regula expression

fix counting twice the substitution length (caused berval to have wrong length, rejected by subsequent dnNormalize)

fix ITS#1671 and more

Fix ITS#1607, longstanding bug in group and dnattr acls, gave access
to anonymous connections.

C translator portability changes (ITS#1609)

honor the ber_len field to allow to exploit ldap_bv2[r]dn to handle DNs embedded in longer strings ...

Add ACL state recording to avoid multiple evaluation of
value-independent access controls.

Update comment

fixes ITS#1582 (didn't trap SLAP_MOD_SOFTADD modification type)

Changed Access.a_sockurl_pat, Connection.c_listener_url etc.
to struct bervals

Some more struct berval conversions

check on escaped rdn separator not needed any more

Move {add,replace,delete}_value() routines to frontend and share.
Add error detail reporting.

Don't use BDB group/attribute callbacks as they may cause deadlock.
Add code to bdb_attribute and bdb_group where use TXN id and to
provide error, but need to rework callers (and their callers) to
ensure error is properly bubbled up to the backend operation routine
handling the transaction.  Ugh.

more ber_*cmp optimizations

Fix up last commit

fix ber_*str renaming

Move most of the new ber_*cmp routines to lber_pvt.h to keep them private,
rework them slightly to avoid computations which might result in underflow.
Rename them for consistency with other berval routines.
Remove some utf8 lint.

added ber_[mem|case]cmp() macros for fast berval comparison; extensively used in acl and in dn_match macro at present

Change replace ACL semantics from U-Mich historical behavior.
U-Mich allows someone with selfwrite to use replace all values
of an attribute with a value containing their DN.  Which, of course,
could than be deleted.  This behavior was carried forward in all
versions of OpenLDAP.

The new semantics separate checks for deleting all existing values
and adding new values.  It is more logical and more inline with
the common use of selfwrite.

Add a default case with assert() just in case.

ITS#1530 no value replace ACL fix

Renamed BVarray to BerVarray. Moved slapd:bvarray_{add,free} to
liblber:ber_bvarray_{add,free}.

consistently use dn_match macro throughout slapd

Add ITS#1508 fix to allow ACIs to grant anonymous users access.

Fix ACL logic for non-regex peername, sockname, etc.

Fix some debug statements

fix BVarray

Update copyright statements

Rework filter code
Misc cleanup / lint removal

Change struct berval ** to BVarray

cleanup

Added dnPretty2/dnNormalize2 using preallocated destination berval

fix acl_dn_pat bervalization

Changed dn_rdn/dn_rdnlen to struct berval

Misc cleanup and dn_normalize() zapping
Fix nameAndOptionalIdentifer syntax.

Fix unterminated string in previous commit. dnNormalize ought to use an
ldap_bv2dn function instead of ldap_str2dn and honor the bv_len's...

More struct berval changes, dnNormalize migration...

More struct berval DNs

Use e_nname.bv_len

Changed Access->a_set_pat and acl->acl_dn_pat to struct berval to eliminate
strlen() from acl processing.

op->o_ndn berval fixes for SLAPD_ACI_ENABLED

Changed sai_dn, sai_ndn to struct berval. (Affects op->o_dn,o_ndn,
conn->c_dn,c_ndn, Access->a_dn_pat)

from jon@symas.com - minor cleanup

Remove lint and misc MSVC updates

Added dn_rdnlen. Fixed rdn leak in limits.c.

paranoid check for escaped dn separators when naively checking for rdn boundary

add const

Moved AttributeDescription caching into main code:
   Changed AttributeDescription.{ad_cname,ad_lang} to struct berval everywhere
   Deleted ad_free() everywhere
   Added ad_mutex to init.c

The AttributeDescriptions are in a linked list hanging off of the
corresponding AttributeType.

Fix some NEW_LOGGING errors

Clean up asserts, should assert desc != NULL instead of attr != NULL

Apply ACLs to front end objects (root DSE, subschema) consistently

Default ACL clause should be "by * none stop" not "by * stop".
That is, default rule should set permissions to none.

fix acl log line

fix format

more new logging (finally), behind NEW_LOGGING

Removed testing mods accidentally committed with previous fix.

Added conn and op arguments to backend_group.

Add connection and operation arguments to backend callbacks.
Needed for transactions.

specifically check for NULL return from acl_get()

Fix typo

Fix ACL SSF reporting

restrictops, requires, disallow knobs; ssf acls; and misc other changes
man pages to follow...

Minor typedef and other clean ups

s/SAFEMEMCPY/AC_MEMCPY/
Use AC_FMEMCPY where appropriate (-llber)

Do not log attribute value

Fix entry/children always allowed bug!

Remove lint

Fix aci link error.

Quick fix to aci link error

Add support for Set ACLs and ACIs.  Still need to make this syntax awa
re.

Add attribute type/matching rule support for structuralObjectClass attribute
type.  Add type to core.schema.  Not yet populated on add nor checked on modify.

Fix minor bug in handling group ACLs.

Fixed paren nesting bug, separated convoluted conditionals, added comm
ents about the logic.

Fix uninitialized variable.

Fix ACI group membership test to look up OC.

Fix ACI group membership test to look up OC.

Bug hunting -- hang when checking dnattr in ACL.

Added .regex, .base, .one, .subtree, and .children "style" modifiers.

Misc code cleanup.

Fix up debug statement as suggested by christian.lorenz@suse.de

unifdef -DSLAPD_SCHEMA_NOT_COMPAT -USLAPD_SCHEMA_COMPAT

Rework ACI codes to use OpenLDAPaci.  Add needed schema elements.
Needs work.  Volunteers welcomed.

SLAPD_SCHEMA_NOT_COMPAT: fix typo

SLAPD_SCHEMA_NOT_COMPAT: working ACLs!  (have not tested ACIs)

SLAPD_SCHEMA_NOT_COMPAT: ACL cleanup (not yet working)

SLAPD_SCHEMA_NOT_COMPAT: ACI cleanup

SLAPD_SCHEMA_NOT_COMPAT: Mostly work modify

SLAPD_SCHEMA_NOT_COMPAT: working cn=schema

Y2k copyright update

SCHEMA_NOT_COMPAT changes

Yet another round of SLAPD_SCHEMA_NOT_COMPAT changes, including:
limited subtype support, modlist handling, filter updates,
lastmod attribute handling.

More -DSLAPD_SCHEMA_NOT_COMPAT changes
Not hidden: "<anonymous>" modifiersname

Another round of changes behind -DSLAPD_SCHEMA_NOT_COMPAT
plus these changes unhidden changes:
	remove now meaning --enable-discreteaci configure option
	fix ITS#451, slapd filters
	Add ber_bvecadd() to support above
	constify ldap_pvt_find_wildcard() and misc slapd routines
	renamed some slap.h macros
	likely broken something

Add Modification/Modifications structures for -DSLAPD_SCHEMA_NOT_COMPAT

Yet another round of SLAPD_SCHEMA_NOT_COMPAT changes...
Changes outside of #ifdef include three value filter processing.

ACI attributes should be of ACI syntax.  Need to assign
OID for experimental syntax.

Replace -DSLAPD_SCHEMA_COMPAT with -USLAPD_SCHEMA_NOT_COMPAT

Additional changes to migrate to new schema codes
Still not usable.

Put more old schema code behind SLAPD_SCHEMA_COMPAT (which still
MUST be defined).

Add code to handle operational attributes via new schema codes
behind -USLAPD_SCHEMA_COMPAT.

Don't exclude no-user-modification attributes from ACL checks
unless access requested is WRITE.  This allows you to apply
an ACL to limit search/reading of no-user-modification attributes.
Writes, of course, are always prohibited (by do_add, do_modify).

Add get_supported_acimech() for use by root_dse, check aci OIDs against supported list.

Added a "dnattr" case for ACIs (still need to check the ACI OID).

Updated ACI code to work with new ACL changes.  All changes are within the SLAPD_ACI_ENABLED #ifdef's.

Remove lint

Add support for Root DSE ACLs.
Add "users" shorthand (dn="^.+$")
Add regex short circuiting for common dn regexs.

Make accessmask2str reentrant.

Additional changes to improve logic and logging.  Still buggy.

Initial commit of new ACL engine.  Engine supports descrete access
privs, additive/substractive rules, and rule continuation.  Existing
rules that use 'defaultaccess none' should be 100% compatible.  Rules
that rely other defaultaccess settings will require addition of
explicit clauses granting the access.
Needs additional testing and tuning of logs

In preparation for adding dn_rewrite()...
s/dn_normalize/dn_validate/
s/dn_normalize_case/dn_normalize/

Misc. cleanup

Add OpenLDAP RCSid to *.[ch] in clients, libraries, and servers.
Replace old Id as needed (back-tcl).
Leave updating of contribWare to contributors (for now).

Kill //-style comments

Cleanup:
Fix printf formats, remove unused variables, add missing prototypes in slapd,
add static/const, add some return types or change to void return type.

ACIs from Mark Valence <kurash@sassafras.com> (ITS#261)

Add copyright notices.

Add limited LDAP_INVALID_DN_SYNTAX support.  dn_normalize{,_case}() now returns
NULL does not meet basic syntax rules.

Update ACL field names and usage statement to match -devel post

ACL CHANGES:
  by <who> <access> changed to by <who>+ <access> (joined with AND)
  added peername=<regex> sockname=<regex> url=<regex>
  removed addr=<regex> (use peername instead).
replace dn_upcase with str2upper and str2lower.  Use where needed.

Namespace changes
  added slap_ and ldbm_ to many structures
  added typedefs to many structures
  used typedefs
New main.c argument parsing with ldap url support (replacing -a address).
New sockaddr_in handling and support for multiple listeners.

Add support for unsolicited notifications.

unifdef -DSLAPD_ACLGROUPS -DSLAPD_ACLAUTH

Regarding previous commit:
	Fix broken ACL macros.
	Fix o_dn/o_ndn == NULL vs "".

HEADS UP:  connections are forced to "anonymous" status upon receiving
of a bind request and, upon failure, are left "anonymous."

Rework ACL code to hide access testing within macros to facilate additions
and eventual redesign.

Addition of #ifdef SLAPD_ACLAUTH to conditional include EXPERIMENTAL
"auth" access controls.  Adds ACL_AUTH "auth" access level (above none,
below "compare").  bind requires anonymous access at this level or above access
to "entry"/"userPassword"/"krbName".  This allows administrators to restrict
which entries can be bound to.  (This will likely become default behavior
after testing has completed).

expose oc_check_operational from schema.c
Use everywhere.
Apply search ACLs to operational attributes.
Only provide operational attributes when explicitly requested.

PROTOTYPE: New connection management infrastructure designed to
remove race conditions on connection close.
BROKEN: various counters for dn=monitor.
Initial testing on FreeBSD (with and without pthreads) was successfull.
Have not yet tested preemptive threading environments.
Have not built against backends other than LDBM.

Silence warnings: Remove unused variables. Enclose some initializers in in {}.

New Frontend->Backend Interface
Separates per backend type from per backend database initialization
	and startup.  Also supports per type / per backend shutdown.
New frontend startup/shutdown routines are also provided:
	slap_init() slap_startup() slap_shutdown() slap_destroy()
New frontend->backend startup/shutdown is managed by:
	backend_init() backend_startup() backend_shutdown backend_destroy
backend_init() now calls bi_init() to initial all function pointers
for the backend (excepting bi_init() which is now the only hardcoded
entry point).  New entry points are detailed in slap.h struct
backend_info.  backend_info is a per database type structure.
Besides the new startup/shutdown entry points, the new interface
also supports per backend type configuration options.  One could have:

	backend bdb2	(new Berkeley DB 2 backend)
	bdb2_home	/directory

	database bdb2
	...

	*** This code is fairly experimental ***
	*** Much cleanup and testing is still needed ***

see slap.h for details on struct backend_db and backend_info.

ndn & strcasecmp cleanup

Update slap_conn to maintain client provided dn and bound dn.
Update slap_op to maintain dn and ndn (derived from conn->c_dn).
Update ldbm_back_bind to return actual bound dn (including rootdn)
	for use in slapd_conn.  Other backends use client dn.
Modify other codes to use ndn (normalized uppercase dn) most everywhere.
Aliasing, Suffixing and modrdn could use more work.
Applied suffixing to compare and modrdn.

Preliminary Fixes for ITS#24, ITS#26, and ldbm_back_add race condition.
Resolved deadlock by passing target entry to be_group and using
this if dn same as bdn.  It might actually be safer to check
entry ids instead of dns.
Resolved bogus add to cache after failed acl check by deferring
cache add until after parent/acl checks have successful been
completed.
Eliminated race condition caused by concurrent adds
of same dn by adding 'li_add_mutex' around the critical section
of code (most of ldbm_back_add).
This code is preliminary and still needs significant testing.

LDAP C-API changes
	struct friendly (Friendly) changed to ldap_friendly (LDAPFriendly)
	  ldap_friendly friend prefix changed to 'lf_' from 'f_'
	removed mod_next field from LDAPMod (struct ldapmod)
	modified slapd to use new LDAPModList (struct ldapmodlist) struct.
Added LDAPv3 result codes to ldap.h

Replace strdup() with ch_strdup() such that exit() will be called
if strdup fails.  This is better than not checking, but we should
add orderly shutdown.

string_expand used hardcoded size instead of bufsiz argument.
pointed out by Jorg Pietschmann <pietsch@swissline.ch>.

gcc -Wformat cleanup

Protoized, moved extern definitions to .h files, fixed related bugs.
Most function and variable definitions are now preceded by its extern
definition, for error checking.  Retyped a number of functions, usually
to return void.  Fixed a number of printf format errors.

API changes (in ldap/include):
  Added avl_dup_ok, avl_prefixapply, removed ber_fatten (probably typo
  for ber_flatten), retyped ldap_sort_strcasecmp, grew lutil.h.

A number of `extern' declarations are left (some added by protoize), to
be cleaned away later.  Mostly strdup(), strcasecmp(), mktemp(), optind,
optarg, errno.

1. extend aclgroup's to be able to specify objectClassValue and groupAttrName
2. update print_acl() a bit and call it during aclparse if LDAP_DEBUG_ACL

merged with autoconf branch

Use current schema objectClass 'groupOfNames' instead of 'groupOfUniqueNames'
Will consider moving to groupOfUniqueNames as part of OpenLDAP 2.0.

Merged in per cache entry reader/writer locks from OPENLDAP_DEVEL_THREAD

Directory rule is didn't work... use brute force

Merged files from branch REGEX_REMOVAL.  Despite name, this merge
	adds POSIX RegEx (and removes BSD re_comp/re_exec) support.
* POSIX RegEx is not currently included in the distribution, however
	we will probably add Henry Spencer's REGEX library soon.
* ACL Group functionality is also included in this merge!

Initial revision

Import of FreeBSD LDAP 3.3 Port

Import of Umich LDAP 3.3

Working ACLs!

Initial Merge of REGEX/ACLGROUP code from Allan Stuart

Merged in ACL changes.

Merged in Stuart Lynne's patch set #4 by hand, ugh.

Added thread patches from Stuart Lynne (after some weeding)
Need to merge in rdwr locks from main to build.

Stuart Lynne's UNTESTED thread patch (p1)

512 -> bufsize fix.

Revert to current schema
	"uniqueMember" -> "member"
	"groupOfUniqueNames" uniqueMember" -> "groupOfNames"

merge in log level change from -devel

merge with main branch

SLAPD compiles.  Needs LDBM work to link.

include portable.h

Merge in latest from -current.

Apply fixes for ITS24 & ITS26 from devel.
 * slapd aclgroup deadlock bug fix
 * slapd non-authorized add bug fix

Import strdup() -> ch_strdup() change from -devel.

Suck in latest changes from -devel.  Besides the usually lint removal,
the patch includes slapd malloc/free fixes in the slapd dn2entry code.

Update for Alpha3 from -devel as of OPENLDAP_DEVEL_981116.
Includes everything but ldapext & ldap.conf changes.

Merge in fixes/minor enhancements from from -devel.

Merge in Normalized DN bug fixes and optimizations from devel.

Fix value_normalize bug.  Must uppercase the dn.
Change no search candidates error to success.
'make ldbm' now works again!

Round two of referrals/aliases: WORK IN PROGRESS, may not compile!
Basic support for "named referrals", manageDSAit control.
Disabled alias support for now.  Will implemented "named aliases"
to replace current alias/suffix-alias support.

Fix ITS#1963 buffer size check in string_expand()

ACL fixes from devel

Soft ADD (moddn) fix from HEAD

disallow selfwriters from deleting all values with replace

ITS#1530: fix ACLs on empty replace bug

Import ITS#1515 fix from HEAD
	ACL sockname/peername exact match logic error

Update copyrights for year 2002

Sync assert() checks with HEAD

Import ACL be==NULL changes

Import "by * none stop" fix from HEAD

Import changes from devel including:
+       Fixed -lldap SASL got_max_ssf bug
+       Fixed -lldap TCP_NODELAY bug
+       Fixed -llutil sa_flags never set bug
+       Removed lint
plus
	clients/tools ldap_init() fixes
	-lldap SASL fixes
	binary syntax ";binary" transfer change

Import latest from devel including
	updated connection close deadlock avoidance
	SSF ACL fixes
	updated SQL docs
	updated client tool usage

Import latest from devel

Import typedef and other misc changes

Import latest from devel

Import ACL patch from devel

Latest changes from devel

Import from devel

Additional changes from devel

Update to latest devel codes

Merge latest devel codes into releng 2 branch.
Remove back-perl, back-sql, back-tcl from branch as they have yet
to be updated.
Additional changes are needed prior to release of alpha4.

Merge in all devel changes since 2.0-alpha2.
Move OPENLDAP_REL_ENG_2_MP forward.

Merge in all -devel changes made since branch was created.

Import ITS#2679 fix from HEAD (bad acl caching)

    Fixed liblber ber_get_next trickle bug (ITS#2490)
    Fixed ldapsearch -p without -h bug (ITS#2532)
    Fixed slapd option ordering bug (ITS#2217)
    Removed lint
    Documentation
        Misc man page updates

internal SASL searches need to be checked for "auth" access,
not "search"/"read".

First round of imports from HEAD

value_find_ex() changes

Sync with HEAD

bvmatch

Sync with HEAD, including
	- subclass indexing
	- bdb locker id fixes

string_expand sizeof fix

OpenLDAPaci changes from Hallvard

mostly new logging

Import ACL to dn="" bug fix (ITS#1921)

Suck in changes from HEAD
    Fix slapd schema error alignment bug
    Update slapd SASL proxy policy code
    Update slapd require "strong" check
    Update back-bdb entry locking
    Add slapd disallow bind_simple_unprotected directive
    Add back-monitor added monitorContext support
    Add slapd IPv4/v6 only options
    Ass slapd SASL setpass support
    Remove lint
    Build Environment
        Add monitor backend test
        Update <ac/socket.h> SHUT_RDWR
        Fix SASL-less build issues
        Fix back-perl build issues

Sync with HEAD

Suck in HEAD changes since 2.1alpha

C portability from HEAD