Don't declare variables as "unsigned char *" that are passed to
functions that take "char *" arguments. Where such chars are
assigned to int or passed to ctype functions, explicitly cast them
to unsigned char.

For OpenBSD's clang, -Wpointer-sign has been disabled by default,
but when the parse.y code was built elsewhere, the compiler would
complain.

With help from millert@
ok benno@ deraadt@

Call normalize_dn() on the newly added namespace so that later compares
with normalized basedns work. Seems all other DN attributes in parse.y
pass through normalize_dn() so this seems to be the last one missing out.
With this configs using capitalized namespace DN like o=OpenBSD,c=CA
will actually work.
OK kn@ gsoares@

Change host() error check to the more simple for of != 1.
Host() return 1 on success and 0 or -1 on failure.
OK kn@ gsoares@

Fix having hostnames in the listen on statement. Regression introduced in
r1.39. Issue originally reported by Anton Kasimov via rob@.

OK claudio@

Remove locally imposed limit on sockets.

Suggested by martijn@, ok claudio@

getifaddrs() can return entries where ifa_addr is NULL. Check for this
before accessing anything in ifa_addr.
ok claudio@

Fix cert and key path inference for absolute paths

ldapd infers certificate and key paths from the configured certificate
string. It appends ".crt" and ".key", respectively, and in the case of
a relative path it also prepends "/etc/ldap/certs/". A logic error
results in prepending "/etc/ldap/certs/" also for absolute paths. Avoid
this by making the whole thing readable at the cost of a bit of verbosity.

Problem reported by Maksim Rodin on misc@, thanks!
Initial fix from me, committing an improved version on behalf of martijn.

ok jmatthew, tb

Using the "ldaps" or "tls" keywords in ldapd.conf currently enables all
protocols and ciphers. So you get a TLS server speaking TLSv1.0 and
supporting cipher suites with RC4 and 3DES encryption, all of which should
be considered broken. There is no way of disabling TLSv1.0 and TLSv1.1 in
ldapd. All this is also not very clearly called out in the documentation.

This commit switches the defaults to using the libtls defaults for both
protocols and ciphers. If compatibility with the insecure legacy protocols
and ciphers is needed, use the "legacy" keyword before "tls" or "ldaps" in
ldapd.conf.

tested by abieber.
inoguchi agrees with the direction.

ok beck

(unsigned) means (unsigned int) which on ptrdiff_t or size_t or other
larger types really is a range reduction...
Almost any cast to (unsigned) is a bug.
ok millert tb benno

- odd condition/test in PF lexer
(and other lexers too)

This commit rectifies earlier change:

in the lex... even inside quotes, a \ followed by space or tab should
expand to space or tab, and a \ followed by newline should be ignored
(as a line continuation). compatible with the needs of hoststated
(which has the most strict quoted string requirements), and ifstated
(where one commonly does line continuations in strings).

OK deraadt@, OK millert@

replace malloc()+strlcpy() with strndup() in cmdline_symset().

"looks good" gilles@ halex@

Do for most running out of memory err() what was done for most running
out of memory log_warn(). i.e. ("%s", __func__) instead of manual
function names and redundant verbiage about which wrapper detected the
out of memory condition.

ok henning@

No need to mention which memory allocation entry point failed (malloc,
calloc or strdup), we just need to log that we ran out of memory in a
particular function.

Recommended by florian@ and deraadt@

ok benno@ henning@ tb@

Be consistent in warn() and log_warn() usage when
running out of memory.

Next step, be correct *and* consistent.

ok dennis@ tb@ benno@ schwarze@

Fix an off-by-one line count when using include statements.

Thanks to otto@ for the initial diff.

OK benno@

Add support for attribute filter rules on search/read operations.

OK jmatthew@

Add support to filter on attributes.

This can be used to allow users to change their password (and a few
other things) but not their entire dn. For example:

allow read access to any by self
allow write access to any attribute userPassword by self

This is currently only supported for "write" (modify, add, delete) and
not "read" (search) filter rules.

OK jmatthew@

Plug leak in error case of the common 'varset' implementations.

ok benno@

65535 is a valid port to listen on.
Off-by-one pointed out by and diff from Kris Katterjohn katterjohn AT
gmail, thanks!
chris@ pointed out that more than httpd(8) is effected.
OK gilles@

use memset() instead of bzero()
OK jmatthew

work on making log.c similar in all daemons:

move daemon-local functions into new logmsg.c, and reduce
the (mostly whitespace) differences so that log.c's can be diffed easily.

ok krw@ jmatthew@

Replace hand-rolled for(;;) emptying of 'symhead' TAILQ with more
modern TAILQ_FOREACH_SAFE().

No intentional functional change.

ok millert@ bluhm@ gilles@

Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQ
with more modern TAILQ_FOREACH(). This what symget() was already
doing.

Add paranoia '{}' around body of symget()'s TAILQ_FOREACH().

No intentional functional change.

ok bluhm@ otto@

Check return value of tls_config_set_protocols(3) and bail out in case of
failure

Feedback and OK jsing@

Adjust existing tls_config_set_cipher() callers for TLS cipher group
changes - map the previous configuration to the equivalent in the new
groups. This will be revisited post release.

Discussed with beck@

do not allow whitespace in macro names, i.e. "this is" = "a variable".
change this in all config parsers in our tree that support macros.
problem reported by sven falempin.

feedback from henning@, stsp@, deraadt@
ok florian@ mikeb@

convert ldapd to use the libtls api, bringing in a copy of the evbuffer_tls
code from syslogd.

ok beck@ benno@

Don't allow embedded nul characters in strings.
Fixes a pfctl crash with an anchor name containing
an embedded nul found with the afl fuzzer.

pfctl parse.y patch from and ok deraadt@

Add gcc printf format attributes to yyerror() in parse.y files.
No yyerror() calls needed to be changed.

ok bluhm@

Convert the logic in yyerror(). Instead of creating a temporary
format string, create a temporary message.
OK claudio@

eliminate the use of a gcc C extension (conditionals with omitted
operands).

ok deraadt@

relax the cfg file secrecy check slightly to allow group readability
default permissions and mtree NOT changed.
prodded by benno, ok phessler benno jmatthew theo pelikan florian

use u_char for buffers in yylex, for ctype calls
found by millert@, ok deraadt@

Missing ; to appease yyextract, ok martinh@

fix linecount bug with comments spanning multiple lines
problem reported with the obvious fix for bgpd by Sebastian Benoit
<benoit-lists at fb12.de>, also PR 6432
applied to all the others by yours truly. ok theo
isn't it amazing how far this parser (and more) spread?

Set a default btree cache size.

Add a global root user that is allowed to read/write entries in all local
namespaces. Useful for dump/restore of all namespaces.

Add support for referrals. Referrals are configured in the config file,
either in the global context or in a namespace. The latter can be used to
delegate requests to different servers for specific parts of the DIT. The
former is a global catch-all referral.

Rewrite the schema parser, as it's not a context-free grammar.
This also brings the config parser more in line with other parse.y in the
tree. The new schema parser also supports symbolic OID names.

You need to update your /etc/ldapd.conf. Schema files are no longer
included with the 'include' keyword, you have to use 'schema' for that.

Moves schema-related structures to a separate include file to ease reuse.

Move around some functions to ease re-use from ldapctl.

remove c++ comments
ok gilles@

Remove trailing whitespace and spaces before tabs.

ok gilles@

Initial import of ldapd, a small LDAP daemon. Work in progress.

ok deraadt@ jacekm@ gilles@ back@ henning@ blambert@

Fix having hostnames in the listen on statement. Regression introduced in
r1.39. Issue originally reported by Anton Kasimov via rob@.

OK claudio@

Remove locally imposed limit on sockets.

Suggested by martijn@, ok claudio@

getifaddrs() can return entries where ifa_addr is NULL. Check for this
before accessing anything in ifa_addr.
ok claudio@

Fix cert and key path inference for absolute paths

ldapd infers certificate and key paths from the configured certificate
string. It appends ".crt" and ".key", respectively, and in the case of
a relative path it also prepends "/etc/ldap/certs/". A logic error
results in prepending "/etc/ldap/certs/" also for absolute paths. Avoid
this by making the whole thing readable at the cost of a bit of verbosity.

Problem reported by Maksim Rodin on misc@, thanks!
Initial fix from me, committing an improved version on behalf of martijn.

ok jmatthew, tb

Using the "ldaps" or "tls" keywords in ldapd.conf currently enables all
protocols and ciphers. So you get a TLS server speaking TLSv1.0 and
supporting cipher suites with RC4 and 3DES encryption, all of which should
be considered broken. There is no way of disabling TLSv1.0 and TLSv1.1 in
ldapd. All this is also not very clearly called out in the documentation.

This commit switches the defaults to using the libtls defaults for both
protocols and ciphers. If compatibility with the insecure legacy protocols
and ciphers is needed, use the "legacy" keyword before "tls" or "ldaps" in
ldapd.conf.

tested by abieber.
inoguchi agrees with the direction.

ok beck

(unsigned) means (unsigned int) which on ptrdiff_t or size_t or other
larger types really is a range reduction...
Almost any cast to (unsigned) is a bug.
ok millert tb benno

- odd condition/test in PF lexer
(and other lexers too)

This commit rectifies earlier change:

in the lex... even inside quotes, a \ followed by space or tab should
expand to space or tab, and a \ followed by newline should be ignored
(as a line continuation). compatible with the needs of hoststated
(which has the most strict quoted string requirements), and ifstated
(where one commonly does line continuations in strings).

OK deraadt@, OK millert@

replace malloc()+strlcpy() with strndup() in cmdline_symset().

"looks good" gilles@ halex@

Do for most running out of memory err() what was done for most running
out of memory log_warn(). i.e. ("%s", __func__) instead of manual
function names and redundant verbiage about which wrapper detected the
out of memory condition.

ok henning@

No need to mention which memory allocation entry point failed (malloc,
calloc or strdup), we just need to log that we ran out of memory in a
particular function.

Recommended by florian@ and deraadt@

ok benno@ henning@ tb@

Be consistent in warn() and log_warn() usage when
running out of memory.

Next step, be correct *and* consistent.

ok dennis@ tb@ benno@ schwarze@

Fix an off-by-one line count when using include statements.

Thanks to otto@ for the initial diff.

OK benno@

Add support for attribute filter rules on search/read operations.

OK jmatthew@

Add support to filter on attributes.

This can be used to allow users to change their password (and a few
other things) but not their entire dn. For example:

allow read access to any by self
allow write access to any attribute userPassword by self

This is currently only supported for "write" (modify, add, delete) and
not "read" (search) filter rules.

OK jmatthew@

Plug leak in error case of the common 'varset' implementations.

ok benno@

65535 is a valid port to listen on.
Off-by-one pointed out by and diff from Kris Katterjohn katterjohn AT
gmail, thanks!
chris@ pointed out that more than httpd(8) is effected.
OK gilles@

use memset() instead of bzero()
OK jmatthew

work on making log.c similar in all daemons:

move daemon-local functions into new logmsg.c, and reduce
the (mostly whitespace) differences so that log.c's can be diffed easily.

ok krw@ jmatthew@

Replace hand-rolled for(;;) emptying of 'symhead' TAILQ with more
modern TAILQ_FOREACH_SAFE().

No intentional functional change.

ok millert@ bluhm@ gilles@

Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQ
with more modern TAILQ_FOREACH(). This what symget() was already
doing.

Add paranoia '{}' around body of symget()'s TAILQ_FOREACH().

No intentional functional change.

ok bluhm@ otto@

Check return value of tls_config_set_protocols(3) and bail out in case of
failure

Feedback and OK jsing@

Adjust existing tls_config_set_cipher() callers for TLS cipher group
changes - map the previous configuration to the equivalent in the new
groups. This will be revisited post release.

Discussed with beck@

do not allow whitespace in macro names, i.e. "this is" = "a variable".
change this in all config parsers in our tree that support macros.
problem reported by sven falempin.

feedback from henning@, stsp@, deraadt@
ok florian@ mikeb@

convert ldapd to use the libtls api, bringing in a copy of the evbuffer_tls
code from syslogd.

ok beck@ benno@

Don't allow embedded nul characters in strings.
Fixes a pfctl crash with an anchor name containing
an embedded nul found with the afl fuzzer.

pfctl parse.y patch from and ok deraadt@

Add gcc printf format attributes to yyerror() in parse.y files.
No yyerror() calls needed to be changed.

ok bluhm@

Convert the logic in yyerror(). Instead of creating a temporary
format string, create a temporary message.
OK claudio@

eliminate the use of a gcc C extension (conditionals with omitted
operands).

ok deraadt@

relax the cfg file secrecy check slightly to allow group readability
default permissions and mtree NOT changed.
prodded by benno, ok phessler benno jmatthew theo pelikan florian

use u_char for buffers in yylex, for ctype calls
found by millert@, ok deraadt@

Missing ; to appease yyextract, ok martinh@

fix linecount bug with comments spanning multiple lines
problem reported with the obvious fix for bgpd by Sebastian Benoit
<benoit-lists at fb12.de>, also PR 6432
applied to all the others by yours truly. ok theo
isn't it amazing how far this parser (and more) spread?

Set a default btree cache size.

Add a global root user that is allowed to read/write entries in all local
namespaces. Useful for dump/restore of all namespaces.

Add support for referrals. Referrals are configured in the config file,
either in the global context or in a namespace. The latter can be used to
delegate requests to different servers for specific parts of the DIT. The
former is a global catch-all referral.

Rewrite the schema parser, as it's not a context-free grammar.
This also brings the config parser more in line with other parse.y in the
tree. The new schema parser also supports symbolic OID names.

You need to update your /etc/ldapd.conf. Schema files are no longer
included with the 'include' keyword, you have to use 'schema' for that.

Moves schema-related structures to a separate include file to ease reuse.

Move around some functions to ease re-use from ldapctl.

remove c++ comments
ok gilles@

Remove trailing whitespace and spaces before tabs.

ok gilles@

Initial import of ldapd, a small LDAP daemon. Work in progress.

ok deraadt@ jacekm@ gilles@ back@ henning@ blambert@

Remove locally imposed limit on sockets.

Suggested by martijn@, ok claudio@

getifaddrs() can return entries where ifa_addr is NULL. Check for this
before accessing anything in ifa_addr.
ok claudio@

Fix cert and key path inference for absolute paths

ldapd infers certificate and key paths from the configured certificate
string. It appends ".crt" and ".key", respectively, and in the case of
a relative path it also prepends "/etc/ldap/certs/". A logic error
results in prepending "/etc/ldap/certs/" also for absolute paths. Avoid
this by making the whole thing readable at the cost of a bit of verbosity.

Problem reported by Maksim Rodin on misc@, thanks!
Initial fix from me, committing an improved version on behalf of martijn.

ok jmatthew, tb

Using the "ldaps" or "tls" keywords in ldapd.conf currently enables all
protocols and ciphers. So you get a TLS server speaking TLSv1.0 and
supporting cipher suites with RC4 and 3DES encryption, all of which should
be considered broken. There is no way of disabling TLSv1.0 and TLSv1.1 in
ldapd. All this is also not very clearly called out in the documentation.

This commit switches the defaults to using the libtls defaults for both
protocols and ciphers. If compatibility with the insecure legacy protocols
and ciphers is needed, use the "legacy" keyword before "tls" or "ldaps" in
ldapd.conf.

tested by abieber.
inoguchi agrees with the direction.

ok beck

(unsigned) means (unsigned int) which on ptrdiff_t or size_t or other
larger types really is a range reduction...
Almost any cast to (unsigned) is a bug.
ok millert tb benno

- odd condition/test in PF lexer
(and other lexers too)

This commit rectifies earlier change:

in the lex... even inside quotes, a \ followed by space or tab should
expand to space or tab, and a \ followed by newline should be ignored
(as a line continuation). compatible with the needs of hoststated
(which has the most strict quoted string requirements), and ifstated
(where one commonly does line continuations in strings).

OK deraadt@, OK millert@

replace malloc()+strlcpy() with strndup() in cmdline_symset().

"looks good" gilles@ halex@

Do for most running out of memory err() what was done for most running
out of memory log_warn(). i.e. ("%s", __func__) instead of manual
function names and redundant verbiage about which wrapper detected the
out of memory condition.

ok henning@

No need to mention which memory allocation entry point failed (malloc,
calloc or strdup), we just need to log that we ran out of memory in a
particular function.

Recommended by florian@ and deraadt@

ok benno@ henning@ tb@

Be consistent in warn() and log_warn() usage when
running out of memory.

Next step, be correct *and* consistent.

ok dennis@ tb@ benno@ schwarze@

Fix an off-by-one line count when using include statements.

Thanks to otto@ for the initial diff.

OK benno@

Add support for attribute filter rules on search/read operations.

OK jmatthew@

Add support to filter on attributes.

This can be used to allow users to change their password (and a few
other things) but not their entire dn. For example:

allow read access to any by self
allow write access to any attribute userPassword by self

This is currently only supported for "write" (modify, add, delete) and
not "read" (search) filter rules.

OK jmatthew@

Plug leak in error case of the common 'varset' implementations.

ok benno@

65535 is a valid port to listen on.
Off-by-one pointed out by and diff from Kris Katterjohn katterjohn AT
gmail, thanks!
chris@ pointed out that more than httpd(8) is effected.
OK gilles@

use memset() instead of bzero()
OK jmatthew

work on making log.c similar in all daemons:

move daemon-local functions into new logmsg.c, and reduce
the (mostly whitespace) differences so that log.c's can be diffed easily.

ok krw@ jmatthew@

Replace hand-rolled for(;;) emptying of 'symhead' TAILQ with more
modern TAILQ_FOREACH_SAFE().

No intentional functional change.

ok millert@ bluhm@ gilles@

Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQ
with more modern TAILQ_FOREACH(). This what symget() was already
doing.

Add paranoia '{}' around body of symget()'s TAILQ_FOREACH().

No intentional functional change.

ok bluhm@ otto@

Check return value of tls_config_set_protocols(3) and bail out in case of
failure

Feedback and OK jsing@

Adjust existing tls_config_set_cipher() callers for TLS cipher group
changes - map the previous configuration to the equivalent in the new
groups. This will be revisited post release.

Discussed with beck@

do not allow whitespace in macro names, i.e. "this is" = "a variable".
change this in all config parsers in our tree that support macros.
problem reported by sven falempin.

feedback from henning@, stsp@, deraadt@
ok florian@ mikeb@

convert ldapd to use the libtls api, bringing in a copy of the evbuffer_tls
code from syslogd.

ok beck@ benno@

Don't allow embedded nul characters in strings.
Fixes a pfctl crash with an anchor name containing
an embedded nul found with the afl fuzzer.

pfctl parse.y patch from and ok deraadt@

Add gcc printf format attributes to yyerror() in parse.y files.
No yyerror() calls needed to be changed.

ok bluhm@

Convert the logic in yyerror(). Instead of creating a temporary
format string, create a temporary message.
OK claudio@

eliminate the use of a gcc C extension (conditionals with omitted
operands).

ok deraadt@

relax the cfg file secrecy check slightly to allow group readability
default permissions and mtree NOT changed.
prodded by benno, ok phessler benno jmatthew theo pelikan florian

use u_char for buffers in yylex, for ctype calls
found by millert@, ok deraadt@

Missing ; to appease yyextract, ok martinh@

fix linecount bug with comments spanning multiple lines
problem reported with the obvious fix for bgpd by Sebastian Benoit
<benoit-lists at fb12.de>, also PR 6432
applied to all the others by yours truly. ok theo
isn't it amazing how far this parser (and more) spread?

Set a default btree cache size.

Add a global root user that is allowed to read/write entries in all local
namespaces. Useful for dump/restore of all namespaces.

Add support for referrals. Referrals are configured in the config file,
either in the global context or in a namespace. The latter can be used to
delegate requests to different servers for specific parts of the DIT. The
former is a global catch-all referral.

Rewrite the schema parser, as it's not a context-free grammar.
This also brings the config parser more in line with other parse.y in the
tree. The new schema parser also supports symbolic OID names.

You need to update your /etc/ldapd.conf. Schema files are no longer
included with the 'include' keyword, you have to use 'schema' for that.

Moves schema-related structures to a separate include file to ease reuse.

Move around some functions to ease re-use from ldapctl.

remove c++ comments
ok gilles@

Remove trailing whitespace and spaces before tabs.

ok gilles@

Initial import of ldapd, a small LDAP daemon. Work in progress.

ok deraadt@ jacekm@ gilles@ back@ henning@ blambert@

getifaddrs() can return entries where ifa_addr is NULL. Check for this
before accessing anything in ifa_addr.
ok claudio@

Fix cert and key path inference for absolute paths

ldapd infers certificate and key paths from the configured certificate
string. It appends ".crt" and ".key", respectively, and in the case of
a relative path it also prepends "/etc/ldap/certs/". A logic error
results in prepending "/etc/ldap/certs/" also for absolute paths. Avoid
this by making the whole thing readable at the cost of a bit of verbosity.

Problem reported by Maksim Rodin on misc@, thanks!
Initial fix from me, committing an improved version on behalf of martijn.

ok jmatthew, tb

Using the "ldaps" or "tls" keywords in ldapd.conf currently enables all
protocols and ciphers. So you get a TLS server speaking TLSv1.0 and
supporting cipher suites with RC4 and 3DES encryption, all of which should
be considered broken. There is no way of disabling TLSv1.0 and TLSv1.1 in
ldapd. All this is also not very clearly called out in the documentation.

This commit switches the defaults to using the libtls defaults for both
protocols and ciphers. If compatibility with the insecure legacy protocols
and ciphers is needed, use the "legacy" keyword before "tls" or "ldaps" in
ldapd.conf.

tested by abieber.
inoguchi agrees with the direction.

ok beck

(unsigned) means (unsigned int) which on ptrdiff_t or size_t or other
larger types really is a range reduction...
Almost any cast to (unsigned) is a bug.
ok millert tb benno

- odd condition/test in PF lexer
(and other lexers too)

This commit rectifies earlier change:

in the lex... even inside quotes, a \ followed by space or tab should
expand to space or tab, and a \ followed by newline should be ignored
(as a line continuation). compatible with the needs of hoststated
(which has the most strict quoted string requirements), and ifstated
(where one commonly does line continuations in strings).

OK deraadt@, OK millert@

replace malloc()+strlcpy() with strndup() in cmdline_symset().

"looks good" gilles@ halex@

Do for most running out of memory err() what was done for most running
out of memory log_warn(). i.e. ("%s", __func__) instead of manual
function names and redundant verbiage about which wrapper detected the
out of memory condition.

ok henning@

No need to mention which memory allocation entry point failed (malloc,
calloc or strdup), we just need to log that we ran out of memory in a
particular function.

Recommended by florian@ and deraadt@

ok benno@ henning@ tb@

Be consistent in warn() and log_warn() usage when
running out of memory.

Next step, be correct *and* consistent.

ok dennis@ tb@ benno@ schwarze@

Fix an off-by-one line count when using include statements.

Thanks to otto@ for the initial diff.

OK benno@

Add support for attribute filter rules on search/read operations.

OK jmatthew@

Add support to filter on attributes.

This can be used to allow users to change their password (and a few
other things) but not their entire dn. For example:

allow read access to any by self
allow write access to any attribute userPassword by self

This is currently only supported for "write" (modify, add, delete) and
not "read" (search) filter rules.

OK jmatthew@

Plug leak in error case of the common 'varset' implementations.

ok benno@

65535 is a valid port to listen on.
Off-by-one pointed out by and diff from Kris Katterjohn katterjohn AT
gmail, thanks!
chris@ pointed out that more than httpd(8) is effected.
OK gilles@

use memset() instead of bzero()
OK jmatthew

work on making log.c similar in all daemons:

move daemon-local functions into new logmsg.c, and reduce
the (mostly whitespace) differences so that log.c's can be diffed easily.

ok krw@ jmatthew@

Replace hand-rolled for(;;) emptying of 'symhead' TAILQ with more
modern TAILQ_FOREACH_SAFE().

No intentional functional change.

ok millert@ bluhm@ gilles@

Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQ
with more modern TAILQ_FOREACH(). This what symget() was already
doing.

Add paranoia '{}' around body of symget()'s TAILQ_FOREACH().

No intentional functional change.

ok bluhm@ otto@

Check return value of tls_config_set_protocols(3) and bail out in case of
failure

Feedback and OK jsing@

Adjust existing tls_config_set_cipher() callers for TLS cipher group
changes - map the previous configuration to the equivalent in the new
groups. This will be revisited post release.

Discussed with beck@

do not allow whitespace in macro names, i.e. "this is" = "a variable".
change this in all config parsers in our tree that support macros.
problem reported by sven falempin.

feedback from henning@, stsp@, deraadt@
ok florian@ mikeb@

convert ldapd to use the libtls api, bringing in a copy of the evbuffer_tls
code from syslogd.

ok beck@ benno@

Don't allow embedded nul characters in strings.
Fixes a pfctl crash with an anchor name containing
an embedded nul found with the afl fuzzer.

pfctl parse.y patch from and ok deraadt@

Add gcc printf format attributes to yyerror() in parse.y files.
No yyerror() calls needed to be changed.

ok bluhm@

Convert the logic in yyerror(). Instead of creating a temporary
format string, create a temporary message.
OK claudio@

eliminate the use of a gcc C extension (conditionals with omitted
operands).

ok deraadt@

relax the cfg file secrecy check slightly to allow group readability
default permissions and mtree NOT changed.
prodded by benno, ok phessler benno jmatthew theo pelikan florian

use u_char for buffers in yylex, for ctype calls
found by millert@, ok deraadt@

Missing ; to appease yyextract, ok martinh@

fix linecount bug with comments spanning multiple lines
problem reported with the obvious fix for bgpd by Sebastian Benoit
<benoit-lists at fb12.de>, also PR 6432
applied to all the others by yours truly. ok theo
isn't it amazing how far this parser (and more) spread?

Set a default btree cache size.

Add a global root user that is allowed to read/write entries in all local
namespaces. Useful for dump/restore of all namespaces.

Add support for referrals. Referrals are configured in the config file,
either in the global context or in a namespace. The latter can be used to
delegate requests to different servers for specific parts of the DIT. The
former is a global catch-all referral.

Rewrite the schema parser, as it's not a context-free grammar.
This also brings the config parser more in line with other parse.y in the
tree. The new schema parser also supports symbolic OID names.

You need to update your /etc/ldapd.conf. Schema files are no longer
included with the 'include' keyword, you have to use 'schema' for that.

Moves schema-related structures to a separate include file to ease reuse.

Move around some functions to ease re-use from ldapctl.

remove c++ comments
ok gilles@

Remove trailing whitespace and spaces before tabs.

ok gilles@

Initial import of ldapd, a small LDAP daemon. Work in progress.

ok deraadt@ jacekm@ gilles@ back@ henning@ blambert@

Fix cert and key path inference for absolute paths

ldapd infers certificate and key paths from the configured certificate
string. It appends ".crt" and ".key", respectively, and in the case of
a relative path it also prepends "/etc/ldap/certs/". A logic error
results in prepending "/etc/ldap/certs/" also for absolute paths. Avoid
this by making the whole thing readable at the cost of a bit of verbosity.

Problem reported by Maksim Rodin on misc@, thanks!
Initial fix from me, committing an improved version on behalf of martijn.

ok jmatthew, tb

Using the "ldaps" or "tls" keywords in ldapd.conf currently enables all
protocols and ciphers. So you get a TLS server speaking TLSv1.0 and
supporting cipher suites with RC4 and 3DES encryption, all of which should
be considered broken. There is no way of disabling TLSv1.0 and TLSv1.1 in
ldapd. All this is also not very clearly called out in the documentation.

This commit switches the defaults to using the libtls defaults for both
protocols and ciphers. If compatibility with the insecure legacy protocols
and ciphers is needed, use the "legacy" keyword before "tls" or "ldaps" in
ldapd.conf.

tested by abieber.
inoguchi agrees with the direction.

ok beck

(unsigned) means (unsigned int) which on ptrdiff_t or size_t or other
larger types really is a range reduction...
Almost any cast to (unsigned) is a bug.
ok millert tb benno

- odd condition/test in PF lexer
(and other lexers too)

This commit rectifies earlier change:

in the lex... even inside quotes, a \ followed by space or tab should
expand to space or tab, and a \ followed by newline should be ignored
(as a line continuation). compatible with the needs of hoststated
(which has the most strict quoted string requirements), and ifstated
(where one commonly does line continuations in strings).

OK deraadt@, OK millert@

replace malloc()+strlcpy() with strndup() in cmdline_symset().

"looks good" gilles@ halex@

Do for most running out of memory err() what was done for most running
out of memory log_warn(). i.e. ("%s", __func__) instead of manual
function names and redundant verbiage about which wrapper detected the
out of memory condition.

ok henning@

No need to mention which memory allocation entry point failed (malloc,
calloc or strdup), we just need to log that we ran out of memory in a
particular function.

Recommended by florian@ and deraadt@

ok benno@ henning@ tb@

Be consistent in warn() and log_warn() usage when
running out of memory.

Next step, be correct *and* consistent.

ok dennis@ tb@ benno@ schwarze@

Fix an off-by-one line count when using include statements.

Thanks to otto@ for the initial diff.

OK benno@

Add support for attribute filter rules on search/read operations.

OK jmatthew@

Add support to filter on attributes.

This can be used to allow users to change their password (and a few
other things) but not their entire dn. For example:

allow read access to any by self
allow write access to any attribute userPassword by self

This is currently only supported for "write" (modify, add, delete) and
not "read" (search) filter rules.

OK jmatthew@

Plug leak in error case of the common 'varset' implementations.

ok benno@

65535 is a valid port to listen on.
Off-by-one pointed out by and diff from Kris Katterjohn katterjohn AT
gmail, thanks!
chris@ pointed out that more than httpd(8) is effected.
OK gilles@

use memset() instead of bzero()
OK jmatthew

work on making log.c similar in all daemons:

move daemon-local functions into new logmsg.c, and reduce
the (mostly whitespace) differences so that log.c's can be diffed easily.

ok krw@ jmatthew@

Replace hand-rolled for(;;) emptying of 'symhead' TAILQ with more
modern TAILQ_FOREACH_SAFE().

No intentional functional change.

ok millert@ bluhm@ gilles@

Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQ
with more modern TAILQ_FOREACH(). This what symget() was already
doing.

Add paranoia '{}' around body of symget()'s TAILQ_FOREACH().

No intentional functional change.

ok bluhm@ otto@

Check return value of tls_config_set_protocols(3) and bail out in case of
failure

Feedback and OK jsing@

Adjust existing tls_config_set_cipher() callers for TLS cipher group
changes - map the previous configuration to the equivalent in the new
groups. This will be revisited post release.

Discussed with beck@

do not allow whitespace in macro names, i.e. "this is" = "a variable".
change this in all config parsers in our tree that support macros.
problem reported by sven falempin.

feedback from henning@, stsp@, deraadt@
ok florian@ mikeb@

convert ldapd to use the libtls api, bringing in a copy of the evbuffer_tls
code from syslogd.

ok beck@ benno@

Don't allow embedded nul characters in strings.
Fixes a pfctl crash with an anchor name containing
an embedded nul found with the afl fuzzer.

pfctl parse.y patch from and ok deraadt@

Add gcc printf format attributes to yyerror() in parse.y files.
No yyerror() calls needed to be changed.

ok bluhm@

Convert the logic in yyerror(). Instead of creating a temporary
format string, create a temporary message.
OK claudio@

eliminate the use of a gcc C extension (conditionals with omitted
operands).

ok deraadt@

relax the cfg file secrecy check slightly to allow group readability
default permissions and mtree NOT changed.
prodded by benno, ok phessler benno jmatthew theo pelikan florian

use u_char for buffers in yylex, for ctype calls
found by millert@, ok deraadt@

Missing ; to appease yyextract, ok martinh@

fix linecount bug with comments spanning multiple lines
problem reported with the obvious fix for bgpd by Sebastian Benoit
<benoit-lists at fb12.de>, also PR 6432
applied to all the others by yours truly. ok theo
isn't it amazing how far this parser (and more) spread?

Set a default btree cache size.

Add a global root user that is allowed to read/write entries in all local
namespaces. Useful for dump/restore of all namespaces.

Add support for referrals. Referrals are configured in the config file,
either in the global context or in a namespace. The latter can be used to
delegate requests to different servers for specific parts of the DIT. The
former is a global catch-all referral.

Rewrite the schema parser, as it's not a context-free grammar.
This also brings the config parser more in line with other parse.y in the
tree. The new schema parser also supports symbolic OID names.

You need to update your /etc/ldapd.conf. Schema files are no longer
included with the 'include' keyword, you have to use 'schema' for that.

Moves schema-related structures to a separate include file to ease reuse.

Move around some functions to ease re-use from ldapctl.

remove c++ comments
ok gilles@

Remove trailing whitespace and spaces before tabs.

ok gilles@

Initial import of ldapd, a small LDAP daemon. Work in progress.

ok deraadt@ jacekm@ gilles@ back@ henning@ blambert@

Using the "ldaps" or "tls" keywords in ldapd.conf currently enables all
protocols and ciphers. So you get a TLS server speaking TLSv1.0 and
supporting cipher suites with RC4 and 3DES encryption, all of which should
be considered broken. There is no way of disabling TLSv1.0 and TLSv1.1 in
ldapd. All this is also not very clearly called out in the documentation.

This commit switches the defaults to using the libtls defaults for both
protocols and ciphers. If compatibility with the insecure legacy protocols
and ciphers is needed, use the "legacy" keyword before "tls" or "ldaps" in
ldapd.conf.

tested by abieber.
inoguchi agrees with the direction.

ok beck

(unsigned) means (unsigned int) which on ptrdiff_t or size_t or other
larger types really is a range reduction...
Almost any cast to (unsigned) is a bug.
ok millert tb benno

- odd condition/test in PF lexer
(and other lexers too)

This commit rectifies earlier change:

in the lex... even inside quotes, a \ followed by space or tab should
expand to space or tab, and a \ followed by newline should be ignored
(as a line continuation). compatible with the needs of hoststated
(which has the most strict quoted string requirements), and ifstated
(where one commonly does line continuations in strings).

OK deraadt@, OK millert@

replace malloc()+strlcpy() with strndup() in cmdline_symset().

"looks good" gilles@ halex@

Do for most running out of memory err() what was done for most running
out of memory log_warn(). i.e. ("%s", __func__) instead of manual
function names and redundant verbiage about which wrapper detected the
out of memory condition.

ok henning@

No need to mention which memory allocation entry point failed (malloc,
calloc or strdup), we just need to log that we ran out of memory in a
particular function.

Recommended by florian@ and deraadt@

ok benno@ henning@ tb@

Be consistent in warn() and log_warn() usage when
running out of memory.

Next step, be correct *and* consistent.

ok dennis@ tb@ benno@ schwarze@

Fix an off-by-one line count when using include statements.

Thanks to otto@ for the initial diff.

OK benno@

Add support for attribute filter rules on search/read operations.

OK jmatthew@

Add support to filter on attributes.

This can be used to allow users to change their password (and a few
other things) but not their entire dn. For example:

allow read access to any by self
allow write access to any attribute userPassword by self

This is currently only supported for "write" (modify, add, delete) and
not "read" (search) filter rules.

OK jmatthew@

Plug leak in error case of the common 'varset' implementations.

ok benno@

65535 is a valid port to listen on.
Off-by-one pointed out by and diff from Kris Katterjohn katterjohn AT
gmail, thanks!
chris@ pointed out that more than httpd(8) is effected.
OK gilles@

use memset() instead of bzero()
OK jmatthew

work on making log.c similar in all daemons:

move daemon-local functions into new logmsg.c, and reduce
the (mostly whitespace) differences so that log.c's can be diffed easily.

ok krw@ jmatthew@

Replace hand-rolled for(;;) emptying of 'symhead' TAILQ with more
modern TAILQ_FOREACH_SAFE().

No intentional functional change.

ok millert@ bluhm@ gilles@

Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQ
with more modern TAILQ_FOREACH(). This what symget() was already
doing.

Add paranoia '{}' around body of symget()'s TAILQ_FOREACH().

No intentional functional change.

ok bluhm@ otto@

Check return value of tls_config_set_protocols(3) and bail out in case of
failure

Feedback and OK jsing@

Adjust existing tls_config_set_cipher() callers for TLS cipher group
changes - map the previous configuration to the equivalent in the new
groups. This will be revisited post release.

Discussed with beck@

do not allow whitespace in macro names, i.e. "this is" = "a variable".
change this in all config parsers in our tree that support macros.
problem reported by sven falempin.

feedback from henning@, stsp@, deraadt@
ok florian@ mikeb@

convert ldapd to use the libtls api, bringing in a copy of the evbuffer_tls
code from syslogd.

ok beck@ benno@

Don't allow embedded nul characters in strings.
Fixes a pfctl crash with an anchor name containing
an embedded nul found with the afl fuzzer.

pfctl parse.y patch from and ok deraadt@

Add gcc printf format attributes to yyerror() in parse.y files.
No yyerror() calls needed to be changed.

ok bluhm@

Convert the logic in yyerror(). Instead of creating a temporary
format string, create a temporary message.
OK claudio@

eliminate the use of a gcc C extension (conditionals with omitted
operands).

ok deraadt@

relax the cfg file secrecy check slightly to allow group readability
default permissions and mtree NOT changed.
prodded by benno, ok phessler benno jmatthew theo pelikan florian

use u_char for buffers in yylex, for ctype calls
found by millert@, ok deraadt@

Missing ; to appease yyextract, ok martinh@

fix linecount bug with comments spanning multiple lines
problem reported with the obvious fix for bgpd by Sebastian Benoit
<benoit-lists at fb12.de>, also PR 6432
applied to all the others by yours truly. ok theo
isn't it amazing how far this parser (and more) spread?

Set a default btree cache size.

Add a global root user that is allowed to read/write entries in all local
namespaces. Useful for dump/restore of all namespaces.

Add support for referrals. Referrals are configured in the config file,
either in the global context or in a namespace. The latter can be used to
delegate requests to different servers for specific parts of the DIT. The
former is a global catch-all referral.

Rewrite the schema parser, as it's not a context-free grammar.
This also brings the config parser more in line with other parse.y in the
tree. The new schema parser also supports symbolic OID names.

You need to update your /etc/ldapd.conf. Schema files are no longer
included with the 'include' keyword, you have to use 'schema' for that.

Moves schema-related structures to a separate include file to ease reuse.

Move around some functions to ease re-use from ldapctl.

remove c++ comments
ok gilles@

Remove trailing whitespace and spaces before tabs.

ok gilles@

Initial import of ldapd, a small LDAP daemon. Work in progress.

ok deraadt@ jacekm@ gilles@ back@ henning@ blambert@

(unsigned) means (unsigned int) which on ptrdiff_t or size_t or other
larger types really is a range reduction...
Almost any cast to (unsigned) is a bug.
ok millert tb benno

- odd condition/test in PF lexer
(and other lexers too)

This commit rectifies earlier change:

in the lex... even inside quotes, a \ followed by space or tab should
expand to space or tab, and a \ followed by newline should be ignored
(as a line continuation). compatible with the needs of hoststated
(which has the most strict quoted string requirements), and ifstated
(where one commonly does line continuations in strings).

OK deraadt@, OK millert@

replace malloc()+strlcpy() with strndup() in cmdline_symset().

"looks good" gilles@ halex@

Do for most running out of memory err() what was done for most running
out of memory log_warn(). i.e. ("%s", __func__) instead of manual
function names and redundant verbiage about which wrapper detected the
out of memory condition.

ok henning@

No need to mention which memory allocation entry point failed (malloc,
calloc or strdup), we just need to log that we ran out of memory in a
particular function.

Recommended by florian@ and deraadt@

ok benno@ henning@ tb@

Be consistent in warn() and log_warn() usage when
running out of memory.

Next step, be correct *and* consistent.

ok dennis@ tb@ benno@ schwarze@

Fix an off-by-one line count when using include statements.

Thanks to otto@ for the initial diff.

OK benno@

Add support for attribute filter rules on search/read operations.

OK jmatthew@

Add support to filter on attributes.

This can be used to allow users to change their password (and a few
other things) but not their entire dn. For example:

allow read access to any by self
allow write access to any attribute userPassword by self

This is currently only supported for "write" (modify, add, delete) and
not "read" (search) filter rules.

OK jmatthew@

Plug leak in error case of the common 'varset' implementations.

ok benno@

65535 is a valid port to listen on.
Off-by-one pointed out by and diff from Kris Katterjohn katterjohn AT
gmail, thanks!
chris@ pointed out that more than httpd(8) is effected.
OK gilles@

use memset() instead of bzero()
OK jmatthew

work on making log.c similar in all daemons:

move daemon-local functions into new logmsg.c, and reduce
the (mostly whitespace) differences so that log.c's can be diffed easily.

ok krw@ jmatthew@

Replace hand-rolled for(;;) emptying of 'symhead' TAILQ with more
modern TAILQ_FOREACH_SAFE().

No intentional functional change.

ok millert@ bluhm@ gilles@

Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQ
with more modern TAILQ_FOREACH(). This what symget() was already
doing.

Add paranoia '{}' around body of symget()'s TAILQ_FOREACH().

No intentional functional change.

ok bluhm@ otto@

Check return value of tls_config_set_protocols(3) and bail out in case of
failure

Feedback and OK jsing@

Adjust existing tls_config_set_cipher() callers for TLS cipher group
changes - map the previous configuration to the equivalent in the new
groups. This will be revisited post release.

Discussed with beck@

do not allow whitespace in macro names, i.e. "this is" = "a variable".
change this in all config parsers in our tree that support macros.
problem reported by sven falempin.

feedback from henning@, stsp@, deraadt@
ok florian@ mikeb@

convert ldapd to use the libtls api, bringing in a copy of the evbuffer_tls
code from syslogd.

ok beck@ benno@

Don't allow embedded nul characters in strings.
Fixes a pfctl crash with an anchor name containing
an embedded nul found with the afl fuzzer.

pfctl parse.y patch from and ok deraadt@

Add gcc printf format attributes to yyerror() in parse.y files.
No yyerror() calls needed to be changed.

ok bluhm@

Convert the logic in yyerror(). Instead of creating a temporary
format string, create a temporary message.
OK claudio@

eliminate the use of a gcc C extension (conditionals with omitted
operands).

ok deraadt@

relax the cfg file secrecy check slightly to allow group readability
default permissions and mtree NOT changed.
prodded by benno, ok phessler benno jmatthew theo pelikan florian

use u_char for buffers in yylex, for ctype calls
found by millert@, ok deraadt@

Missing ; to appease yyextract, ok martinh@

fix linecount bug with comments spanning multiple lines
problem reported with the obvious fix for bgpd by Sebastian Benoit
<benoit-lists at fb12.de>, also PR 6432
applied to all the others by yours truly. ok theo
isn't it amazing how far this parser (and more) spread?

Set a default btree cache size.

Add a global root user that is allowed to read/write entries in all local
namespaces. Useful for dump/restore of all namespaces.

Add support for referrals. Referrals are configured in the config file,
either in the global context or in a namespace. The latter can be used to
delegate requests to different servers for specific parts of the DIT. The
former is a global catch-all referral.

Rewrite the schema parser, as it's not a context-free grammar.
This also brings the config parser more in line with other parse.y in the
tree. The new schema parser also supports symbolic OID names.

You need to update your /etc/ldapd.conf. Schema files are no longer
included with the 'include' keyword, you have to use 'schema' for that.

Moves schema-related structures to a separate include file to ease reuse.

Move around some functions to ease re-use from ldapctl.

remove c++ comments
ok gilles@

Remove trailing whitespace and spaces before tabs.

ok gilles@

Initial import of ldapd, a small LDAP daemon. Work in progress.

ok deraadt@ jacekm@ gilles@ back@ henning@ blambert@

- odd condition/test in PF lexer
(and other lexers too)

This commit rectifies earlier change:

in the lex... even inside quotes, a \ followed by space or tab should
expand to space or tab, and a \ followed by newline should be ignored
(as a line continuation). compatible with the needs of hoststated
(which has the most strict quoted string requirements), and ifstated
(where one commonly does line continuations in strings).

OK deraadt@, OK millert@

replace malloc()+strlcpy() with strndup() in cmdline_symset().

"looks good" gilles@ halex@

Do for most running out of memory err() what was done for most running
out of memory log_warn(). i.e. ("%s", __func__) instead of manual
function names and redundant verbiage about which wrapper detected the
out of memory condition.

ok henning@

No need to mention which memory allocation entry point failed (malloc,
calloc or strdup), we just need to log that we ran out of memory in a
particular function.

Recommended by florian@ and deraadt@

ok benno@ henning@ tb@

Be consistent in warn() and log_warn() usage when
running out of memory.

Next step, be correct *and* consistent.

ok dennis@ tb@ benno@ schwarze@

Fix an off-by-one line count when using include statements.

Thanks to otto@ for the initial diff.

OK benno@

Add support for attribute filter rules on search/read operations.

OK jmatthew@

Add support to filter on attributes.

This can be used to allow users to change their password (and a few
other things) but not their entire dn. For example:

allow read access to any by self
allow write access to any attribute userPassword by self

This is currently only supported for "write" (modify, add, delete) and
not "read" (search) filter rules.

OK jmatthew@

Plug leak in error case of the common 'varset' implementations.

ok benno@

65535 is a valid port to listen on.
Off-by-one pointed out by and diff from Kris Katterjohn katterjohn AT
gmail, thanks!
chris@ pointed out that more than httpd(8) is effected.
OK gilles@

use memset() instead of bzero()
OK jmatthew

work on making log.c similar in all daemons:

move daemon-local functions into new logmsg.c, and reduce
the (mostly whitespace) differences so that log.c's can be diffed easily.

ok krw@ jmatthew@

Replace hand-rolled for(;;) emptying of 'symhead' TAILQ with more
modern TAILQ_FOREACH_SAFE().

No intentional functional change.

ok millert@ bluhm@ gilles@

Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQ
with more modern TAILQ_FOREACH(). This what symget() was already
doing.

Add paranoia '{}' around body of symget()'s TAILQ_FOREACH().

No intentional functional change.

ok bluhm@ otto@

Check return value of tls_config_set_protocols(3) and bail out in case of
failure

Feedback and OK jsing@

Adjust existing tls_config_set_cipher() callers for TLS cipher group
changes - map the previous configuration to the equivalent in the new
groups. This will be revisited post release.

Discussed with beck@

do not allow whitespace in macro names, i.e. "this is" = "a variable".
change this in all config parsers in our tree that support macros.
problem reported by sven falempin.

feedback from henning@, stsp@, deraadt@
ok florian@ mikeb@

convert ldapd to use the libtls api, bringing in a copy of the evbuffer_tls
code from syslogd.

ok beck@ benno@

Don't allow embedded nul characters in strings.
Fixes a pfctl crash with an anchor name containing
an embedded nul found with the afl fuzzer.

pfctl parse.y patch from and ok deraadt@

Add gcc printf format attributes to yyerror() in parse.y files.
No yyerror() calls needed to be changed.

ok bluhm@

Convert the logic in yyerror(). Instead of creating a temporary
format string, create a temporary message.
OK claudio@

eliminate the use of a gcc C extension (conditionals with omitted
operands).

ok deraadt@

relax the cfg file secrecy check slightly to allow group readability
default permissions and mtree NOT changed.
prodded by benno, ok phessler benno jmatthew theo pelikan florian

use u_char for buffers in yylex, for ctype calls
found by millert@, ok deraadt@

Missing ; to appease yyextract, ok martinh@

fix linecount bug with comments spanning multiple lines
problem reported with the obvious fix for bgpd by Sebastian Benoit
<benoit-lists at fb12.de>, also PR 6432
applied to all the others by yours truly. ok theo
isn't it amazing how far this parser (and more) spread?

Set a default btree cache size.

Add a global root user that is allowed to read/write entries in all local
namespaces. Useful for dump/restore of all namespaces.

Add support for referrals. Referrals are configured in the config file,
either in the global context or in a namespace. The latter can be used to
delegate requests to different servers for specific parts of the DIT. The
former is a global catch-all referral.

Rewrite the schema parser, as it's not a context-free grammar.
This also brings the config parser more in line with other parse.y in the
tree. The new schema parser also supports symbolic OID names.

You need to update your /etc/ldapd.conf. Schema files are no longer
included with the 'include' keyword, you have to use 'schema' for that.

Moves schema-related structures to a separate include file to ease reuse.

Move around some functions to ease re-use from ldapctl.

remove c++ comments
ok gilles@

Remove trailing whitespace and spaces before tabs.

ok gilles@

Initial import of ldapd, a small LDAP daemon. Work in progress.

ok deraadt@ jacekm@ gilles@ back@ henning@ blambert@

replace malloc()+strlcpy() with strndup() in cmdline_symset().

"looks good" gilles@ halex@

Do for most running out of memory err() what was done for most running
out of memory log_warn(). i.e. ("%s", __func__) instead of manual
function names and redundant verbiage about which wrapper detected the
out of memory condition.

ok henning@

No need to mention which memory allocation entry point failed (malloc,
calloc or strdup), we just need to log that we ran out of memory in a
particular function.

Recommended by florian@ and deraadt@

ok benno@ henning@ tb@

Be consistent in warn() and log_warn() usage when
running out of memory.

Next step, be correct *and* consistent.

ok dennis@ tb@ benno@ schwarze@

Fix an off-by-one line count when using include statements.

Thanks to otto@ for the initial diff.

OK benno@

Add support for attribute filter rules on search/read operations.

OK jmatthew@

Add support to filter on attributes.

This can be used to allow users to change their password (and a few
other things) but not their entire dn. For example:

allow read access to any by self
allow write access to any attribute userPassword by self

This is currently only supported for "write" (modify, add, delete) and
not "read" (search) filter rules.

OK jmatthew@

Plug leak in error case of the common 'varset' implementations.

ok benno@

65535 is a valid port to listen on.
Off-by-one pointed out by and diff from Kris Katterjohn katterjohn AT
gmail, thanks!
chris@ pointed out that more than httpd(8) is effected.
OK gilles@

use memset() instead of bzero()
OK jmatthew

work on making log.c similar in all daemons:

move daemon-local functions into new logmsg.c, and reduce
the (mostly whitespace) differences so that log.c's can be diffed easily.

ok krw@ jmatthew@

Replace hand-rolled for(;;) emptying of 'symhead' TAILQ with more
modern TAILQ_FOREACH_SAFE().

No intentional functional change.

ok millert@ bluhm@ gilles@

Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQ
with more modern TAILQ_FOREACH(). This what symget() was already
doing.

Add paranoia '{}' around body of symget()'s TAILQ_FOREACH().

No intentional functional change.

ok bluhm@ otto@

Check return value of tls_config_set_protocols(3) and bail out in case of
failure

Feedback and OK jsing@

Adjust existing tls_config_set_cipher() callers for TLS cipher group
changes - map the previous configuration to the equivalent in the new
groups. This will be revisited post release.

Discussed with beck@

do not allow whitespace in macro names, i.e. "this is" = "a variable".
change this in all config parsers in our tree that support macros.
problem reported by sven falempin.

feedback from henning@, stsp@, deraadt@
ok florian@ mikeb@

convert ldapd to use the libtls api, bringing in a copy of the evbuffer_tls
code from syslogd.

ok beck@ benno@

Don't allow embedded nul characters in strings.
Fixes a pfctl crash with an anchor name containing
an embedded nul found with the afl fuzzer.

pfctl parse.y patch from and ok deraadt@

Add gcc printf format attributes to yyerror() in parse.y files.
No yyerror() calls needed to be changed.

ok bluhm@

Convert the logic in yyerror(). Instead of creating a temporary
format string, create a temporary message.
OK claudio@

eliminate the use of a gcc C extension (conditionals with omitted
operands).

ok deraadt@

relax the cfg file secrecy check slightly to allow group readability
default permissions and mtree NOT changed.
prodded by benno, ok phessler benno jmatthew theo pelikan florian

use u_char for buffers in yylex, for ctype calls
found by millert@, ok deraadt@

Missing ; to appease yyextract, ok martinh@

fix linecount bug with comments spanning multiple lines
problem reported with the obvious fix for bgpd by Sebastian Benoit
<benoit-lists at fb12.de>, also PR 6432
applied to all the others by yours truly. ok theo
isn't it amazing how far this parser (and more) spread?

Set a default btree cache size.

Add a global root user that is allowed to read/write entries in all local
namespaces. Useful for dump/restore of all namespaces.

Add support for referrals. Referrals are configured in the config file,
either in the global context or in a namespace. The latter can be used to
delegate requests to different servers for specific parts of the DIT. The
former is a global catch-all referral.

Rewrite the schema parser, as it's not a context-free grammar.
This also brings the config parser more in line with other parse.y in the
tree. The new schema parser also supports symbolic OID names.

You need to update your /etc/ldapd.conf. Schema files are no longer
included with the 'include' keyword, you have to use 'schema' for that.

Moves schema-related structures to a separate include file to ease reuse.

Move around some functions to ease re-use from ldapctl.

remove c++ comments
ok gilles@

Remove trailing whitespace and spaces before tabs.

ok gilles@

Initial import of ldapd, a small LDAP daemon. Work in progress.

ok deraadt@ jacekm@ gilles@ back@ henning@ blambert@

Do for most running out of memory err() what was done for most running
out of memory log_warn(). i.e. ("%s", __func__) instead of manual
function names and redundant verbiage about which wrapper detected the
out of memory condition.

ok henning@

No need to mention which memory allocation entry point failed (malloc,
calloc or strdup), we just need to log that we ran out of memory in a
particular function.

Recommended by florian@ and deraadt@

ok benno@ henning@ tb@

Be consistent in warn() and log_warn() usage when
running out of memory.

Next step, be correct *and* consistent.

ok dennis@ tb@ benno@ schwarze@

Fix an off-by-one line count when using include statements.

Thanks to otto@ for the initial diff.

OK benno@

Add support for attribute filter rules on search/read operations.

OK jmatthew@

Add support to filter on attributes.

This can be used to allow users to change their password (and a few
other things) but not their entire dn. For example:

allow read access to any by self
allow write access to any attribute userPassword by self

This is currently only supported for "write" (modify, add, delete) and
not "read" (search) filter rules.

OK jmatthew@

Plug leak in error case of the common 'varset' implementations.

ok benno@

65535 is a valid port to listen on.
Off-by-one pointed out by and diff from Kris Katterjohn katterjohn AT
gmail, thanks!
chris@ pointed out that more than httpd(8) is effected.
OK gilles@

use memset() instead of bzero()
OK jmatthew

work on making log.c similar in all daemons:

move daemon-local functions into new logmsg.c, and reduce
the (mostly whitespace) differences so that log.c's can be diffed easily.

ok krw@ jmatthew@

Replace hand-rolled for(;;) emptying of 'symhead' TAILQ with more
modern TAILQ_FOREACH_SAFE().

No intentional functional change.

ok millert@ bluhm@ gilles@

Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQ
with more modern TAILQ_FOREACH(). This what symget() was already
doing.

Add paranoia '{}' around body of symget()'s TAILQ_FOREACH().

No intentional functional change.

ok bluhm@ otto@

Check return value of tls_config_set_protocols(3) and bail out in case of
failure

Feedback and OK jsing@

Adjust existing tls_config_set_cipher() callers for TLS cipher group
changes - map the previous configuration to the equivalent in the new
groups. This will be revisited post release.

Discussed with beck@

do not allow whitespace in macro names, i.e. "this is" = "a variable".
change this in all config parsers in our tree that support macros.
problem reported by sven falempin.

feedback from henning@, stsp@, deraadt@
ok florian@ mikeb@

convert ldapd to use the libtls api, bringing in a copy of the evbuffer_tls
code from syslogd.

ok beck@ benno@

Don't allow embedded nul characters in strings.
Fixes a pfctl crash with an anchor name containing
an embedded nul found with the afl fuzzer.

pfctl parse.y patch from and ok deraadt@

Add gcc printf format attributes to yyerror() in parse.y files.
No yyerror() calls needed to be changed.

ok bluhm@

Convert the logic in yyerror(). Instead of creating a temporary
format string, create a temporary message.
OK claudio@

eliminate the use of a gcc C extension (conditionals with omitted
operands).

ok deraadt@

relax the cfg file secrecy check slightly to allow group readability
default permissions and mtree NOT changed.
prodded by benno, ok phessler benno jmatthew theo pelikan florian

use u_char for buffers in yylex, for ctype calls
found by millert@, ok deraadt@

Missing ; to appease yyextract, ok martinh@

fix linecount bug with comments spanning multiple lines
problem reported with the obvious fix for bgpd by Sebastian Benoit
<benoit-lists at fb12.de>, also PR 6432
applied to all the others by yours truly. ok theo
isn't it amazing how far this parser (and more) spread?

Set a default btree cache size.

Add a global root user that is allowed to read/write entries in all local
namespaces. Useful for dump/restore of all namespaces.

Add support for referrals. Referrals are configured in the config file,
either in the global context or in a namespace. The latter can be used to
delegate requests to different servers for specific parts of the DIT. The
former is a global catch-all referral.

Rewrite the schema parser, as it's not a context-free grammar.
This also brings the config parser more in line with other parse.y in the
tree. The new schema parser also supports symbolic OID names.

You need to update your /etc/ldapd.conf. Schema files are no longer
included with the 'include' keyword, you have to use 'schema' for that.

Moves schema-related structures to a separate include file to ease reuse.

Move around some functions to ease re-use from ldapctl.

remove c++ comments
ok gilles@

Remove trailing whitespace and spaces before tabs.

ok gilles@

Initial import of ldapd, a small LDAP daemon. Work in progress.

ok deraadt@ jacekm@ gilles@ back@ henning@ blambert@

Fix an off-by-one line count when using include statements.

Thanks to otto@ for the initial diff.

OK benno@

Add support for attribute filter rules on search/read operations.

OK jmatthew@

Add support to filter on attributes.

This can be used to allow users to change their password (and a few
other things) but not their entire dn. For example:

allow read access to any by self
allow write access to any attribute userPassword by self

This is currently only supported for "write" (modify, add, delete) and
not "read" (search) filter rules.

OK jmatthew@

Plug leak in error case of the common 'varset' implementations.

ok benno@

65535 is a valid port to listen on.
Off-by-one pointed out by and diff from Kris Katterjohn katterjohn AT
gmail, thanks!
chris@ pointed out that more than httpd(8) is effected.
OK gilles@

use memset() instead of bzero()
OK jmatthew

work on making log.c similar in all daemons:

move daemon-local functions into new logmsg.c, and reduce
the (mostly whitespace) differences so that log.c's can be diffed easily.

ok krw@ jmatthew@

Replace hand-rolled for(;;) emptying of 'symhead' TAILQ with more
modern TAILQ_FOREACH_SAFE().

No intentional functional change.

ok millert@ bluhm@ gilles@

Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQ
with more modern TAILQ_FOREACH(). This what symget() was already
doing.

Add paranoia '{}' around body of symget()'s TAILQ_FOREACH().

No intentional functional change.

ok bluhm@ otto@

Check return value of tls_config_set_protocols(3) and bail out in case of
failure

Feedback and OK jsing@

Adjust existing tls_config_set_cipher() callers for TLS cipher group
changes - map the previous configuration to the equivalent in the new
groups. This will be revisited post release.

Discussed with beck@

do not allow whitespace in macro names, i.e. "this is" = "a variable".
change this in all config parsers in our tree that support macros.
problem reported by sven falempin.

feedback from henning@, stsp@, deraadt@
ok florian@ mikeb@

convert ldapd to use the libtls api, bringing in a copy of the evbuffer_tls
code from syslogd.

ok beck@ benno@

Don't allow embedded nul characters in strings.
Fixes a pfctl crash with an anchor name containing
an embedded nul found with the afl fuzzer.

pfctl parse.y patch from and ok deraadt@

Add gcc printf format attributes to yyerror() in parse.y files.
No yyerror() calls needed to be changed.

ok bluhm@

Convert the logic in yyerror(). Instead of creating a temporary
format string, create a temporary message.
OK claudio@

eliminate the use of a gcc C extension (conditionals with omitted
operands).

ok deraadt@

relax the cfg file secrecy check slightly to allow group readability
default permissions and mtree NOT changed.
prodded by benno, ok phessler benno jmatthew theo pelikan florian

use u_char for buffers in yylex, for ctype calls
found by millert@, ok deraadt@

Missing ; to appease yyextract, ok martinh@

fix linecount bug with comments spanning multiple lines
problem reported with the obvious fix for bgpd by Sebastian Benoit
<benoit-lists at fb12.de>, also PR 6432
applied to all the others by yours truly. ok theo
isn't it amazing how far this parser (and more) spread?

Set a default btree cache size.

Add a global root user that is allowed to read/write entries in all local
namespaces. Useful for dump/restore of all namespaces.

Add support for referrals. Referrals are configured in the config file,
either in the global context or in a namespace. The latter can be used to
delegate requests to different servers for specific parts of the DIT. The
former is a global catch-all referral.

Rewrite the schema parser, as it's not a context-free grammar.
This also brings the config parser more in line with other parse.y in the
tree. The new schema parser also supports symbolic OID names.

You need to update your /etc/ldapd.conf. Schema files are no longer
included with the 'include' keyword, you have to use 'schema' for that.

Moves schema-related structures to a separate include file to ease reuse.

Move around some functions to ease re-use from ldapctl.

remove c++ comments
ok gilles@

Remove trailing whitespace and spaces before tabs.

ok gilles@

Initial import of ldapd, a small LDAP daemon. Work in progress.

ok deraadt@ jacekm@ gilles@ back@ henning@ blambert@

Plug leak in error case of the common 'varset' implementations.

ok benno@

65535 is a valid port to listen on.
Off-by-one pointed out by and diff from Kris Katterjohn katterjohn AT
gmail, thanks!
chris@ pointed out that more than httpd(8) is effected.
OK gilles@

use memset() instead of bzero()
OK jmatthew

work on making log.c similar in all daemons:

move daemon-local functions into new logmsg.c, and reduce
the (mostly whitespace) differences so that log.c's can be diffed easily.

ok krw@ jmatthew@

Replace hand-rolled for(;;) emptying of 'symhead' TAILQ with more
modern TAILQ_FOREACH_SAFE().

No intentional functional change.

ok millert@ bluhm@ gilles@

Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQ
with more modern TAILQ_FOREACH(). This what symget() was already
doing.

Add paranoia '{}' around body of symget()'s TAILQ_FOREACH().

No intentional functional change.

ok bluhm@ otto@