avoid use after free in error paths
ok miod@ martijn@

The ber_* namespace is used by liblber since time immemorial,
so move our BER API to the unused ober_* prefix to avoid some
breakage in ports.

Problem diagnosed by jmatthew with ber_free() in samba,

The ber_* namespace is used by liblber since time immemorial,
so move our BER API to the unused ober_* prefix to avoid some
breakage in ports.

Problem diagnosed by jmatthew with ber_free() in samba, but
there are many others as pointed out by sthen.

tests & ok rob
ok sthen (who had an almost identical diff for libutil)
"go head hit it" deraadt

show more ...

(unsigned) means (unsigned int) which on ptrdiff_t or size_t or other
larger types really is a range reduction...
Almost any cast to (unsigned) is a bug.
ok millert tb benno

work on making log.c similar in all daemons:

move daemon-local functions into new logmsg.c, and reduce
the (mostly whitespace) differences so that log.c's can be diffed easily.

ok krw@ jmatthew@

Convert the logic in the error function of the ldap schema parser.
Instead of creating a temporary format string, create a temporary
message.
OK doug@

fix a potential memory leak; OK martinh@ sthen@

Publish matching rules in the cn=schema subentry as the matchingRules
attribute. This is an operational attribute and only returned if explicitly
asked for. Required by RFC 4517.

Validate matching rules against attribute syntaxes. All matching rules from
RFC 4517 are recognized, except the optional wordMatch and keywordMatch.

Requires a current core.schema file.

Warn if schema file can't be opened.

Resolve matching rules from superior attribute types at schema load time
instead of when each attribute is validated.

Implement attribute syntaxes from RFC4517. This adds validation to the most
common attribute types. Specialized attribute types like Delivery Method or
Teletex Terminal Identifier are recognized for

Implement attribute syntaxes from RFC4517. This adds validation to the most
common attribute types. Specialized attribute types like Delivery Method or
Teletex Terminal Identifier are recognized for completeness, but not
validated.

show more ...

Add missing leading string quote character in attribute type description.
Caused syntax errors when parsing schema from the subschema.

Dump parsed schema to buffer and send in requests for the cn=schema
subschema namespace. Only do this if 'objectClasses' and 'attributeTypes'
are expicitly requested. This allows clients to for examp

Dump parsed schema to buffer and send in requests for the cn=schema
subschema namespace. Only do this if 'objectClasses' and 'attributeTypes'
are expicitly requested. This allows clients to for example present custom
editing forms.

show more ...

Fix memory leaks in schema parser.

Parse (and ignore) schema extensions with an X- prefix. Bail on unknown keywords.

Give a more descriptive error message when an object class definition
references non-existent attribute types.

from william@

Fix two possible null pointer assignments in the error path.
found by clang static analyzer

remove trailing spaces

Verify that any object class subclassing is allowed.

Rewrite the schema parser, as it's not a context-free grammar.
This also brings the config parser more in line with other parse.y in the
tree. The new schema parser also supports symbolic OID names.

Rewrite the schema parser, as it's not a context-free grammar.
This also brings the config parser more in line with other parse.y in the
tree. The new schema parser also supports symbolic OID names.

You need to update your /etc/ldapd.conf. Schema files are no longer
included with the 'include' keyword, you have to use 'schema' for that.

Moves schema-related structures to a separate include file to ease reuse.

show more ...