1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  23  */
  24 
  25 /*
  26  * DESCRIPTION: Contains dit_access interface support functions.
  27  */
  28 #include <sys/systeminfo.h>
  29 #include <unistd.h>
  30 #include <stdlib.h>
  31 #include <sys/types.h>
  32 #include <sys/stat.h>
  33 #include <sys/systeminfo.h>
  34 #include <unistd.h>
  35 #include <stdlib.h>
  36 #include <syslog.h>
  37 #include <ndbm.h>
  38 #include <strings.h>
  39 #include <errno.h>
  40 #include "../ldap_util.h"
  41 #include "../ldap_map.h"
  42 #include "../ldap_parse.h"
  43 #include "../ldap_structs.h"
  44 #include "../ldap_val.h"
  45 #include "../ldap_ruleval.h"
  46 #include "../ldap_op.h"
  47 #include "../ldap_attr.h"
  48 #include "../ldap_nisdbquery.h"
  49 #include "../nisdb_mt.h"
  50 #include "shim.h"
  51 #include "yptol.h"
  52 #include "dit_access_utils.h"
  53 
  54 #define YPMULTI         "YP_MULTI_"
  55 #define YPMULTISZ       9               /* == strlen(YPMULTI) */
  56 
  57 /*
  58  * Returns 'map,domain.'
  59  */
  60 char *
  61 getFullMapName(char *map, char *domain) {
  62         char    *myself = "getFullMapName";
  63         char    *objPath;
  64         if (map == 0 || domain == 0) {
  65                 return (0);
  66         }
  67         objPath =  scat(myself, T, scat(myself, F, map, ","),
  68                 scat(myself, F, domain, "."));
  69 
  70         return (objPath);
  71 }
  72 
  73 /*
  74  * Convert string to __nis_value_t
  75  */
  76 __nis_value_t *stringToValue(char *dptr, int dsize) {
  77         char            *myself = "stringToValue";
  78         char            *emptystr = "";
  79         __nis_value_t   *val;
  80 
  81         if ((val = am(myself, sizeof (*val))) == 0) {
  82                 return (0);
  83         }
  84 
  85         val->type = vt_string;
  86         val->repeat = 0;
  87         val->numVals = 1;
  88         if ((val->val = am(myself, sizeof (val->val[0]))) == 0) {
  89                 sfree(val);
  90                 return (0);
  91         }
  92 
  93         /*
  94          * Null strings or strings with length 0 are treated
  95          * as empty strings with length 1
  96          */
  97         if (dptr == 0 || dsize <= 0) {
  98                 dptr = emptystr;
  99                 dsize = 1;
 100         }
 101 
 102         val->val->length = dsize;
 103         if (dptr[dsize - 1] != '\0') {
 104                 val->val->length = dsize + 1;
 105         }
 106 
 107         val->val->value = am(myself, val->val->length);
 108         if (val->val->value == 0) {
 109                 freeValue(val, 1);
 110                 return (0);
 111         }
 112         (void) memcpy(val->val->value, dptr, dsize);
 113 
 114         return (val);
 115 }
 116 
 117 /*
 118  * Returns an array of rule-values corresponding to the
 119  * splitfields.
 120  */
 121 __nis_rule_value_t *
 122 processSplitField(__nis_table_mapping_t *sf, __nis_value_t *inVal,
 123                         int *nv, int *statP) {
 124 
 125         char                    *sepset;
 126         __nis_rule_value_t      *rvq;
 127         __nis_mapping_format_t  *ftmp;
 128         __nis_value_t           **valA, *tempVal;
 129         int                     i, j, res, numVals, oldlen, count;
 130         char                    *str, *oldstr;
 131         char                    *myself = "processSplitField";
 132 
 133         /* sf will be non NULL */
 134 
 135         if (inVal == 0 || inVal->type != vt_string) {
 136                 *statP =  MAP_PARAM_ERROR;
 137                 return (0);
 138         }
 139 
 140         /* Get the separator list */
 141         sepset = sf->separatorStr;
 142 
 143         /* Initialize rule-value */
 144         rvq = 0;
 145         count = 0;
 146 
 147         if ((tempVal = stringToValue(inVal->val->value,
 148                         inVal->val->length)) == 0) {
 149                 *statP = MAP_NO_MEMORY;
 150                 return (0);
 151         }
 152 
 153         str = oldstr = tempVal->val->value;
 154         oldlen = tempVal->val->length;
 155 
 156         while (str) {
 157                 tempVal->val->value = str;
 158                 tempVal->val->length = strlen(str) + 1;
 159 
 160                 /* Loop to check which format matches str */
 161                 for (i = 0; i <= sf->numSplits; i++) {
 162                         valA = matchMappingItem(sf->e[i].element.match.fmt,
 163                                 tempVal, &numVals, sepset, &str);
 164                         if (valA == 0) {
 165                                 /* The format didn't match. Try the next one */
 166                                 continue;
 167                         }
 168 
 169                         /*
 170                          * If we are here means we had a match.
 171                          * Each new set of values obtained from the match is
 172                          * added to a new rule-value. This is to preserve the
 173                          * the distinction between each set.
 174                          */
 175                         rvq = growRuleValue(count, count + 1, rvq, 0);
 176                         if (rvq == 0) {
 177                                 *statP = MAP_INTERNAL_ERROR;
 178                                 for (j = 0; j < numVals; j++)
 179                                         freeValue(valA[j], 1);
 180                                 sfree(valA);
 181                                 tempVal->val->value = oldstr;
 182                                 tempVal->val->length = oldlen;
 183                                 freeValue(tempVal, 1);
 184                                 return (0);
 185                         }
 186                         count++;
 187 
 188                         for (j = 0; j < numVals; j++) {
 189                                 res = addCol2RuleValue(vt_string,
 190                                         sf->e[i].element.match.item[j].name,
 191                                         valA[j]->val->value,
 192                                         valA[j]->val->length,
 193                                         &rvq[count - 1]);
 194                                 if (res == -1) {
 195                                         *statP = MAP_INTERNAL_ERROR;
 196                                         for (; j < numVals; j++)
 197                                                 freeValue(valA[j], 1);
 198                                         sfree(valA);
 199                                         tempVal->val->value = oldstr;
 200                                         tempVal->val->length = oldlen;
 201                                         freeValue(tempVal, 1);
 202                                         freeRuleValue(rvq, count);
 203                                         return (0);
 204                                 }
 205                                 freeValue(valA[j], 1);
 206                         }
 207                         sfree(valA);
 208 
 209                         /*
 210                          * Since we had a match, break out of this loop
 211                          * to parse remainder of str
 212                          */
 213                         break;
 214                 }
 215 
 216                 /* Didn't find any match, so get out of the loop */
 217                 if (i > sf->numSplits) {
 218                         str = 0;
 219                         break;
 220                 }
 221 
 222                 /* Skip the separators before looping back */
 223                 if (str) {
 224                         str = str + strspn(str, sepset);
 225                         if (*str == '\0')
 226                                 break;
 227                 }
 228         }
 229 
 230         tempVal->val->value = oldstr;
 231         tempVal->val->length = oldlen;
 232         freeValue(tempVal, 1);
 233 
 234         if (str == 0) {
 235                 freeRuleValue(rvq, count);
 236                 return (0);
 237         }
 238 
 239         if (nv != 0)
 240                 *nv = count;
 241 
 242         return (rvq);
 243 }
 244 
 245 /*
 246  * Convert the datum to an array of RuleValues
 247  */
 248 __nis_rule_value_t *
 249 datumToRuleValue(datum *key, datum *value, __nis_table_mapping_t *t,
 250                         int *nv, char *domain, bool_t readonly, int *statP) {
 251 
 252         __nis_rule_value_t      *rvq, *subrvq, *newrvq;
 253         __nis_value_t           *val;
 254         __nis_value_t           **valA;
 255         __nis_table_mapping_t   *sf;
 256         int                     valueLen, comLen, numVals, nr, count = 1;
 257         int                     i, j, k, l, af;
 258         char                    *ipaddr, *ipvalue;
 259 
 260         /*  At this point, 't' is always non NULL */
 261 
 262         /* Initialize rule-value */
 263         if ((rvq = initRuleValue(1, 0)) == 0) {
 264                 *statP = MAP_INTERNAL_ERROR;
 265                 return (0);
 266         }
 267 
 268         /* Add domainname to rule-value */
 269         if (addCol2RuleValue(vt_string, N2LDOMAIN, domain, strlen(domain),
 270                                                 rvq)) {
 271                 freeRuleValue(rvq, 1);
 272                 *statP = MAP_INTERNAL_ERROR;
 273                 return (0);
 274         }
 275 
 276         /* Handle key */
 277         if (key != 0) {
 278                 /* Add field=value pair for N2LKEY */
 279                 i = addCol2RuleValue(vt_string, N2LKEY, key->dptr, key->dsize,
 280                                                 rvq);
 281 
 282                 /* For readonly, add field=value pair for N2LSEARCHKEY */
 283                 if (readonly == TRUE && i == 0) {
 284                         i = addCol2RuleValue(vt_string, N2LSEARCHKEY, key->dptr,
 285                                                 key->dsize, rvq);
 286                 }
 287                 if (i) {
 288                         freeRuleValue(rvq, 1);
 289                         *statP = MAP_INTERNAL_ERROR;
 290                         return (0);
 291                 }
 292 
 293                 /* Add field=value pairs for IP addresses */
 294                 if (checkIPaddress(key->dptr, key->dsize, &ipaddr) > 0) {
 295                         /* If key is IPaddress, use preferred format */
 296                         ipvalue = ipaddr;
 297                         valueLen = strlen(ipaddr);
 298                         i = addCol2RuleValue(vt_string, N2LIPKEY, ipvalue,
 299                                                 valueLen, rvq);
 300                 } else {
 301                         /* If not, use original value for N2LSEARCHIPKEY */
 302                         ipaddr = 0;
 303                         ipvalue = key->dptr;
 304                         valueLen = key->dsize;
 305                         i = 0;
 306                 }
 307 
 308                 if (readonly == TRUE && i == 0) {
 309                         i = addCol2RuleValue(vt_string, N2LSEARCHIPKEY, ipvalue,
 310                                                                 valueLen, rvq);
 311                 }
 312                 sfree(ipaddr);
 313                 if (i) {
 314                         freeRuleValue(rvq, 1);
 315                         *statP = MAP_INTERNAL_ERROR;
 316                         return (0);
 317                 }
 318         }
 319 
 320         /* Handle datum value */
 321         if (value != 0 && t->e) {
 322                 valueLen = value->dsize;
 323                 /*
 324                  * Extract the comment, if any, and add it to
 325                  * the rule-value.
 326                  */
 327                 if (t->commentChar != '\0') {
 328                         /*
 329                          * We loop on value->dsize because value->dptr
 330                          * may not be NULL-terminated.
 331                          */
 332                         for (i = 0; i < value->dsize; i++) {
 333                                 if (value->dptr[i] == t->commentChar) {
 334                                         valueLen = i;
 335                                         comLen = value->dsize - i - 1;
 336                                         if (comLen == 0)
 337                                                 break;
 338                                         if (addCol2RuleValue(vt_string,
 339                                                 N2LCOMMENT, value->dptr + i + 1,
 340                                                 comLen, rvq)) {
 341                                                 freeRuleValue(rvq, 1);
 342                                                 *statP = MAP_INTERNAL_ERROR;
 343                                                 return (0);
 344                                         }
 345                                         break;
 346                                 }
 347                         }
 348                 }
 349 
 350                 /* Skip trailing whitespaces */
 351                 for (; valueLen > 0 && (value->dptr[valueLen - 1] == ' ' ||
 352                         value->dptr[valueLen - 1] == '\t'); valueLen--);
 353 
 354                 /*
 355                  * At this point valueLen is the effective length of
 356                  * the data. Convert value into __nis_value_t so that
 357                  * we can use the matchMappingItem function to break it
 358                  * into fields.
 359                  */
 360                 if ((val = stringToValue(value->dptr, valueLen)) == 0) {
 361                         freeRuleValue(rvq, 1);
 362                         *statP = MAP_NO_MEMORY;
 363                         return (0);
 364                 }
 365 
 366                 /* Perform namefield match */
 367                 valA = matchMappingItem(t->e->element.match.fmt, val,
 368                                                         &numVals, 0, 0);
 369                 if (valA == 0) {
 370                         freeValue(val, 1);
 371                         freeRuleValue(rvq, 1);
 372                         *statP = MAP_NAMEFIELD_MATCH_ERROR;
 373                         return (0);
 374                 }
 375 
 376                 /* We don't need val anymore, so free it */
 377                 freeValue(val, 1);
 378 
 379                 /*
 380                  * Since matchMappingItem only returns us an array of
 381                  * __nis_value_t's, we need to associate each value
 382                  * in the array with the corresponding item name.
 383                  * This code assumes that numVals will be less than or
 384                  * equal to the number of item names associated with
 385                  * the format.
 386                  * These name=value pairs are added to rvq.
 387                  */
 388                 for (i = 0, *statP = SUCCESS; i < numVals; i++) {
 389                         for (j = 0; j < count; j++) {
 390                                 if (addCol2RuleValue(vt_string,
 391                                         t->e->element.match.item[i].name,
 392                                         valA[i]->val->value,
 393                                         valA[i]->val->length, &rvq[j])) {
 394                                         *statP = MAP_INTERNAL_ERROR;
 395                                         break;
 396                                 }
 397                         }
 398                         if (*statP == MAP_INTERNAL_ERROR)
 399                                 break;
 400 
 401                         /*
 402                          * Check if splitField exists for the field.
 403                          * Since splitfields are also stored as mapping
 404                          * structures, we need to get the hash table entry
 405                          * corresponding to the splitfield name
 406                          */
 407                         sf = mappingFromMap(t->e->element.match.item[i].name,
 408                                         domain, statP);
 409                         if (*statP == MAP_NO_MEMORY)
 410                                 break;
 411                         *statP = SUCCESS;
 412                         if (sf == 0)
 413                                 continue;
 414 
 415                         /*
 416                          * Process and add splitFields to rule-value rvq
 417                          */
 418                         subrvq = processSplitField(sf, valA[i], &nr, statP);
 419 
 420                         if (subrvq == 0) {
 421                                 /* statP would have been set */
 422                                 break;
 423                         }
 424 
 425                         /*
 426                          * We merge 'count' rule-values in rvq with 'nr'
 427                          * rule-values from subrvq to give us a whopping
 428                          * 'count * nr' rule-values
 429                          */
 430 
 431                         /* Initialize the new rule-value array */
 432                         if ((newrvq = initRuleValue(count * nr, 0)) == 0) {
 433                                 *statP = MAP_INTERNAL_ERROR;
 434                                 freeRuleValue(subrvq, nr);
 435                                 break;
 436                         }
 437 
 438                         for (j = 0, l = 0; j < nr; j++) {
 439                                 for (k = 0; k < count; k++, l++) {
 440                                         if ((mergeRuleValue(&newrvq[l],
 441                                                         &rvq[k]) == -1) ||
 442                                                         (mergeRuleValue(
 443                                                         &newrvq[l],
 444                                                         &subrvq[j]) == -1)) {
 445                                                 *statP = MAP_INTERNAL_ERROR;
 446                                                 for (i = 0; i < numVals; i++)
 447                                                         freeValue(valA[i], 1);
 448                                                 sfree(valA);
 449                                                 freeRuleValue(rvq, count);
 450                                                 freeRuleValue(newrvq,
 451                                                                 count * nr);
 452                                                 freeRuleValue(subrvq, nr);
 453                                                 return (0);
 454                                         }
 455                                 }
 456                         }
 457 
 458                         freeRuleValue(rvq, count);
 459                         rvq = newrvq;
 460                         count = l;
 461                         freeRuleValue(subrvq, nr);
 462 
 463                 }
 464 
 465                 /* We don't need valA anymore, so free it */
 466                 for (i = 0; i < numVals; i++)
 467                         freeValue(valA[i], 1);
 468                 sfree(valA);
 469 
 470                 if (*statP != SUCCESS) {
 471                         freeRuleValue(rvq, count);
 472                         return (0);
 473                 }
 474 
 475         } /* if value */
 476 
 477         if (nv != 0)
 478                 *nv = count;
 479         return (rvq);
 480 
 481 }
 482 
 483 /*
 484  * Generate name=values pairs for splitfield names
 485  *
 486  * Consider Example:
 487  *      nisLDAPnameFields club:
 488  *                      ("%s %s %s", name, code, members)
 489  *      nisLDAPsplitField members:
 490  *                      ("(%s,%s,%s)", host, user, domain),
 491  *                      ("%s", group)
 492  * On entry,
 493  * - rv is an array of numVals rule-values each containing
 494  * name=value pairs for names occuring in nisLDAPsplitField.
 495  * (i.e host, user, domain, group)
 496  * - trv contains name=value pairs for names occuring in
 497  * nisLDAPnameFields. (i.e name, code but not members)
 498  *
 499  * For every name in nisLDAPnamefields that is a splitfield,
 500  * this function applies the data in rv to the corresponding
 501  * splitfield formats (accessed thru t), to generate a single
 502  * string value for the corresponding splitfield (members).
 503  * This new name=value pair is then added to trv.
 504  * Besides, any uninitialized namefield names are set to empty strings.
 505  */
 506 suc_code
 507 addSplitFieldValues(__nis_table_mapping_t *t, __nis_rule_value_t *rv,
 508                         __nis_rule_value_t *trv, int numVals, char *domain) {
 509         __nis_table_mapping_t   *sf;
 510         __nis_value_t           *val;
 511         int                     i, j, k, nitems, res, statP;
 512         char                    *str, *tempstr;
 513         char                    delim[2] = {0, 0};
 514         char                    *emptystr = "";
 515         char                    *myself = "addSplitFieldValues";
 516 
 517         if (trv == 0)
 518                 return (MAP_INTERNAL_ERROR);
 519 
 520         if (t->e == 0)
 521                 return (SUCCESS);
 522 
 523         nitems = t->e->element.match.numItems;
 524 
 525         /*
 526          * Procedure:
 527          * - Check each name in nisLDAPnamefield
 528          * - if it's a splifield, construct its value and add it to trv
 529          * - if not, check if it has a value
 530          * - if not, add empty string
 531          */
 532         for (i = 0, sf = 0; i < nitems; i++) {
 533                 if (rv) {
 534                         /*
 535                          * str will eventually contain the single string
 536                          * value for the corresponding  splitfield.
 537                          * No point initializing str if rv == 0 because
 538                          * splitfield cannot be constructed without rv.
 539                          * So, only initialized here.
 540                          */
 541                         str = 0;
 542 
 543                         /* Check if it's a splitfield name */
 544                         sf = mappingFromMap(t->e->element.match.item[i].name,
 545                                 domain, &statP);
 546 
 547                         /*
 548                          * Return only incase of memory allocation failure.
 549                          * The other error case (MAP_NO_MAPPING_EXISTS),
 550                          * indicates that the item name is not a splitfieldname
 551                          * i.e it's a namefieldname. This case is handled by
 552                          * the following if (sf == 0)
 553                          */
 554                         if (statP == MAP_NO_MEMORY)
 555                                 return (statP);
 556                 }
 557 
 558                 if (sf == 0) {
 559                         /*
 560                          * Not a splitfield name. Verify if it has a value
 561                          */
 562                         if (findVal(t->e->element.match.item[i].name,
 563                                 trv, mit_nisplus) == 0) {
 564                                 /* if not, use empty string */
 565                                 res = addCol2RuleValue(vt_string,
 566                                         t->e->element.match.item[i].name,
 567                                         emptystr, 0, trv);
 568                                 if (res == -1) {
 569                                         return (MAP_INTERNAL_ERROR);
 570                                 }
 571                         }
 572                         /*
 573                          * If rv == 0 then sf == 0 so we will continue here
 574                          * i.e. does not matter that str is not yet set up.
 575                          */
 576                         continue;
 577                 }
 578 
 579                 /* Code to construct a single value */
 580 
 581                 /* Use the first separator character as the delimiter */
 582                 delim[0] = sf->separatorStr[0];
 583 
 584                 for (j = 0; j < numVals; j++) {
 585                         /* sf->numSplits is zero-based */
 586                         for (k = 0; k <= sf->numSplits; k++) {
 587                                 val = getMappingFormatArray(
 588                                         sf->e[k].element.match.fmt, &rv[j],
 589                                         fa_item,
 590                                         sf->e[k].element.match.numItems,
 591                                         sf->e[k].element.match.item);
 592                                 if (val == 0)
 593                                         continue;
 594                                 if (val->numVals > 0) {
 595                                         if (str) {
 596                                                 tempstr = scat(myself,
 597                                                         0, str, delim);
 598                                                 sfree(str);
 599                                                 if (tempstr)
 600                                                         str = tempstr;
 601                                                 else {
 602                                                         freeValue(val, 1);
 603                                                         return (MAP_NO_MEMORY);
 604                                                 }
 605                                         }
 606                                         tempstr = scat(myself, 0, str,
 607                                                 val->val->value);
 608                                         sfree(str);
 609                                         if (tempstr)
 610                                                 str = tempstr;
 611                                         else {
 612                                                 freeValue(val, 1);
 613                                                 return (MAP_NO_MEMORY);
 614                                         }
 615                                 }
 616                                 freeValue(val, 1);
 617                         }
 618                 }
 619                 if (str == 0)
 620                         str = emptystr;
 621 
 622                 res = addCol2RuleValue(vt_string,
 623                                 t->e->element.match.item[i].name,
 624                                 str, strlen(str), trv);
 625 
 626                 if (str != emptystr)
 627                         sfree(str);
 628 
 629                 if (res == -1) {
 630                         return (MAP_INTERNAL_ERROR);
 631                 }
 632         }
 633 
 634         return (SUCCESS);
 635 }
 636 
 637 /*
 638  * Updates 'rv' with NIS name=value pairs suitable to
 639  * construct datum from namefield information.
 640  * Some part based on createNisPlusEntry (from ldap_nisdbquery.c)
 641  * This code assumes that from a given LDAP entry, applying the
 642  * mapping rules, would give us one or more NIS entries, differing
 643  * only in key.
 644  */
 645 suc_code
 646 buildNISRuleValue(__nis_table_mapping_t *t, __nis_rule_value_t *rv,
 647                                         char *domain) {
 648         int                     r, i, j, k, l, index, nrq, res, len;
 649         int                     numItems, splitname, count, statP;
 650         __nis_value_t           *rval;
 651         __nis_mapping_item_t    *litem;
 652         __nis_mapping_rule_t    *rl;
 653         __nis_rule_value_t      *rvq;
 654         char                    *value, *emptystr = "";
 655 
 656         statP = SUCCESS;
 657 
 658         /* Initialize default base */
 659         __nisdb_get_tsd()->searchBase = t->objectDN->read.base;
 660 
 661         /* Initialize rule-value rvq */
 662         rvq = 0;
 663         count = 0;
 664 
 665         /* Add domainname to rule-value */
 666         if (addCol2RuleValue(vt_string, N2LDOMAIN, domain, strlen(domain),
 667                                                 rv)) {
 668                 return (MAP_INTERNAL_ERROR);
 669         }
 670 
 671         for (r = 0; r < t->numRulesFromLDAP; r++) {
 672                 rl = t->ruleFromLDAP[r];
 673 
 674                 /* Set escapeFlag if RHS is "dn" to remove escape chars */
 675                 if (rl->rhs.numElements == 1 &&
 676                         rl->rhs.element->type == me_item &&
 677                         rl->rhs.element->element.item.type == mit_ldap &&
 678                         strcasecmp(rl->rhs.element->element.item.name, "dn")
 679                                                                         == 0) {
 680                                 __nisdb_get_tsd()->escapeFlag = '2';
 681                 }
 682 
 683                 rval = buildRvalue(&rl->rhs, mit_ldap, rv, NULL);
 684 
 685                 /* Reset escapeFlag */
 686                 __nisdb_get_tsd()->escapeFlag = '\0';
 687 
 688                 if (rval == 0) {
 689                         continue;
 690                 }
 691 
 692                 if (rval->numVals <= 0) {
 693                         /* Treat as invalid */
 694                         freeValue(rval, 1);
 695                         continue;
 696                 }
 697 
 698                 litem = buildLvalue(&rl->lhs, &rval, &numItems);
 699                 if (litem == 0) {
 700                         /* This will take care of numItems == 0 */
 701                         freeValue(rval, 1);
 702                         continue;
 703                 }
 704 
 705                 if (rval->numVals > 1) {
 706                         if (numItems == 1 && litem->repeat)
 707                                 nrq = rval->numVals;
 708                         else if (numItems > 1 && rval->repeat)
 709                                 nrq = 1 + ((rval->numVals-1)/numItems);
 710                         else
 711                                 nrq = 1;
 712                 } else
 713                         nrq = 1;
 714 
 715                 /* Set splitname if splitfield names are specified */
 716                 for (i = 0; i < numItems; i++) {
 717                         if (strcasecmp(litem[i].name, N2LKEY) == 0 ||
 718                                 strcasecmp(litem[i].name, N2LIPKEY) == 0 ||
 719                                 strcasecmp(litem[i].name, N2LCOMMENT) == 0)
 720                                 continue;
 721                         for (j = 0; j < t->numColumns; j++) {
 722                                 if (strcmp(litem[i].name, t->column[j]) == 0)
 723                                         break;
 724                         }
 725                         if (j == t->numColumns)
 726                                 break;
 727                 }
 728 
 729                 splitname = (i < numItems)?1:0;
 730 
 731                 for (j = 0; j < nrq; j++) {
 732                         if (splitname == 1) {
 733                                 /*
 734                                  * Put every value of splitfieldname in a new
 735                                  * rule-value. Helps generating splitfields.
 736                                  */
 737                                 rvq = growRuleValue(count, count + 1, rvq, 0);
 738                                 if (rvq == 0) {
 739                                         freeRuleValue(rvq, count);
 740                                         freeValue(rval, 1);
 741                                         freeMappingItem(litem, numItems);
 742                                         return (MAP_INTERNAL_ERROR);
 743                                 }
 744                                 count++;
 745                         }
 746 
 747                         for (k = j % nrq, l = 0; l < numItems; k += nrq, l++) {
 748                                 /* If we run out of values, use empty strings */
 749                                 if (k >= rval->numVals) {
 750                                         value = emptystr;
 751                                         len = 0;
 752                                 } else {
 753                                         value = rval->val[k].value;
 754                                         len = rval->val[k].length;
 755                                 }
 756                                 res = (splitname == 1)?addCol2RuleValue(
 757                                         vt_string, litem[l].name, value,
 758                                         len, &rvq[count - 1]):0;
 759                                 if (res != -1)
 760                                         res = addCol2RuleValue(vt_string,
 761                                                 litem[l].name, value, len, rv);
 762                                 if (res == -1) {
 763                                         freeRuleValue(rvq, count);
 764                                         freeValue(rval, 1);
 765                                         freeMappingItem(litem, numItems);
 766                                         return (MAP_INTERNAL_ERROR);
 767                                 }
 768                         }
 769                 }
 770                 freeValue(rval, 1);
 771                 rval = 0;
 772                 freeMappingItem(litem, numItems);
 773                 litem = 0;
 774                 numItems = 0;
 775         } /* for r < t->numRulesFromLDAP */
 776 
 777         statP = addSplitFieldValues(t, rvq, rv, count, domain);
 778 
 779         if (rvq)
 780                 freeRuleValue(rvq, count);
 781 
 782         if (verifyIndexMatch(t, 0, rv, 0, 0) == 0)
 783                 return (MAP_INDEXLIST_ERROR);
 784         return (statP);
 785 
 786 } /* end of buildNISRuleValue */
 787 
 788 /*
 789  * Convert rule-value to datum using namefield information
 790  */
 791 datum *
 792 ruleValueToDatum(__nis_table_mapping_t *t, __nis_rule_value_t *rv, int *statP) {
 793         __nis_value_t   *val;
 794         datum           *value;
 795         char            *str, *cstr, commentSep[3] = {' ', 0, 0};
 796         char            *myself = "ruleValueToDatum";
 797 
 798         /* No error yet */
 799         *statP = 0;
 800 
 801         /* Return empty datum if no namefield information available */
 802         if (t->e == 0) {
 803                 if ((value = am(myself, sizeof (*value))) == 0)
 804                         *statP = MAP_NO_MEMORY;
 805                 return (value);
 806         }
 807 
 808         val = getMappingFormatArray(t->e->element.match.fmt, rv,
 809                                 fa_item, t->e->element.match.numItems,
 810                                 t->e->element.match.item);
 811 
 812         if (val && val->val && val->val->value) {
 813                 if ((value = am(myself, sizeof (*value))) == 0) {
 814                         *statP = MAP_NO_MEMORY;
 815                         freeValue(val, 1);
 816                         return (0);
 817                 }
 818 
 819                 /* Strip trailing whitespaces */
 820                 cstr = (char *)val->val->value + val->val->length;
 821                 for (; cstr >= (char *)val->val->value &&
 822                         (*cstr == ' ' || *cstr == '\t'); *cstr-- = '\0');
 823 
 824                 if (t->commentChar != '\0' &&
 825                     (str = findVal(N2LCOMMENT, rv, mit_nisplus)) != 0 &&
 826                     *str != '\0') {
 827                         commentSep[1] = t->commentChar;
 828                         cstr = scat(myself, F, commentSep, str);
 829                         if (cstr) {
 830                                 value->dptr = scat(myself, F,
 831                                                 val->val->value, cstr);
 832                                 sfree(cstr);
 833                         }
 834                 } else {
 835                         value->dptr = sdup(myself, T, val->val->value);
 836                 }
 837                 freeValue(val, 1);
 838                 if (value->dptr) {
 839                         value->dsize = strlen(value->dptr);
 840                         return (value);
 841                 } else {
 842                         *statP = MAP_NO_MEMORY;
 843                         sfree(value);
 844                         return (0);
 845                 }
 846         }
 847 
 848         *statP = MAP_NAMEFIELD_MATCH_ERROR;
 849         return (0);
 850 }
 851 
 852 datum *
 853 getKeyFromRuleValue(__nis_table_mapping_t *t, __nis_rule_value_t *rv, int *nv,
 854     int *statP, bool_t xlate_to_lcase)
 855 {
 856         int     i, j, k;
 857         datum   *key = 0;
 858         char    *str;
 859         char    *myself = "getKeyFromRuleValue";
 860 
 861         /* No error yet */
 862         *statP = 0;
 863 
 864         if (rv == 0 || nv == 0)
 865                 return (0);
 866 
 867         for (i = 0; i < rv->numColumns; i++) {
 868                 if (rv->colName[i] == 0)
 869                         continue;
 870                 if (strcasecmp(N2LKEY, rv->colName[i]) == 0 ||
 871                     strcasecmp(N2LIPKEY, rv->colName[i]) == 0) {
 872                         if ((*nv = rv->colVal[i].numVals) == 0)
 873                                 return (0);
 874                         if ((key = am(myself, sizeof (key[0]) * *nv)) == 0) {
 875                                 *statP = MAP_NO_MEMORY;
 876                                 return (0);
 877                         }
 878                         for (j = 0; j < *nv; j++) {
 879                                 if ((str = rv->colVal[i].val[j].value) == 0) {
 880                                         key[j].dsize = 0;
 881                                         key[j].dptr = 0;
 882                                 } else {
 883                                         if (verifyIndexMatch(t, 0, 0,
 884                                             rv->colName[i], str) == 0) {
 885                                                 key[j].dsize = 0;
 886                                                 key[j].dptr = 0;
 887                                                 continue;
 888                                         }
 889 
 890                                         key[j].dsize = strlen(str);
 891                                         key[j].dptr = am(myself,
 892                                             key[j].dsize + 1);
 893                                         if (key[j].dptr == 0) {
 894                                                 *statP = MAP_NO_MEMORY;
 895                                                 for (--j; j >= 0; j--)
 896                                                         sfree(key[j].dptr);
 897                                                 sfree(key);
 898                                                 return (0);
 899                                         }
 900 
 901                                         /* transliterate key to lowercase */
 902                                         if (xlate_to_lcase == TRUE) {
 903 
 904                                                 /*
 905                                                  * For multi-homed
 906                                                  * entries, skip over
 907                                                  * "YP_MULTI_" prefix.
 908                                                  */
 909                                                 k = 0;
 910                                                 if (strncmp(YPMULTI, str,
 911                                                     YPMULTISZ) == 0) {
 912                                                         k = YPMULTISZ;
 913                                                         bcopy(str, key[j].dptr,
 914                                                             YPMULTISZ);
 915                                                 }
 916                                                 while (k < key[j].dsize) {
 917                                                         key[j].dptr[k] =
 918                                                             (char)tolower(
 919                                                             (int)(uchar_t)
 920                                                             str[k]);
 921                                                         k++;
 922                                                 }
 923                                         } else {
 924                                                 bcopy(str, key[j].dptr,
 925                                                     key[j].dsize);
 926                                         }
 927                                 }
 928                         }
 929                         return (key);
 930                 }
 931         }
 932         return (0);
 933 }
 934 
 935 /*
 936  * Get the mapping structure corresponding to `map,domain.'
 937  */
 938 __nis_table_mapping_t *
 939 mappingFromMap(char *map, char *domain, int *statP) {
 940         char                    *mapPath;
 941         __nis_table_mapping_t   *t;
 942 
 943         /* No error yet */
 944         *statP = 0;
 945 
 946         /* Construct map,domain. */
 947         if ((mapPath = getFullMapName(map, domain)) == 0) {
 948                 *statP = MAP_NO_MEMORY;
 949                 return (0);
 950         }
 951 
 952         /* Get the hash table entry for the mapPath */
 953         if ((t = __nis_find_item_mt(mapPath, &ldapMappingList, 1, 0))
 954                         == 0) {
 955                 *statP = MAP_NO_MAPPING_EXISTS;
 956         }
 957         sfree(mapPath);
 958         return (t);
 959 }
 960 
 961 /*
 962  * Verify at least one key value obtained from DIT matches the search key
 963  * RETURNS:      1      MATCH
 964  *               0      NO MATCH
 965  *              -1      NO KEY FOUND
 966  */
 967 static int
 968 verifyKey(char *key, __nis_rule_value_t *rv) {
 969         int     i, j;
 970         char    *sipkey, *str;
 971 
 972         for (i = 0; i < rv->numColumns; i++) {
 973                 if (rv->colName[i] == 0)
 974                         continue;
 975                 if (strcasecmp(N2LKEY, rv->colName[i]) == 0) {
 976                         if (rv->colVal[i].val == 0)
 977                                 return (0);
 978                         for (j = 0; j < rv->colVal[i].numVals; j++) {
 979                                 str = (char *)rv->colVal[i].val[j].value;
 980                                 if (str && strcmp(str, key) == 0)
 981                                         return (1);
 982                         }
 983                         return (0);
 984                 } else if (strcasecmp(N2LIPKEY, rv->colName[i]) == 0) {
 985                         if (checkIPaddress(key, strlen(key), &sipkey) > 0) {
 986                                 if (rv->colVal[i].val == 0)
 987                                         return (0);
 988                                 for (j = 0; j < rv->colVal[i].numVals; j++) {
 989                                         str = rv->colVal[i].val[j].value;
 990                                         if (str && strcmp(str, sipkey) == 0) {
 991                                                 sfree(sipkey);
 992                                                 return (1);
 993                                         }
 994                                 }
 995                                 sfree(sipkey);
 996                         }
 997                         return (0);
 998                 }
 999         }
1000         return (-1);
1001 }
1002 
1003 /*
1004  * Read (i.e get and map) a single NIS entry from the LDAP DIT
1005  */
1006 bool_t
1007 singleReadFromDIT(char *map, char *domain, datum *key, datum *value,
1008                                                         int *statP) {
1009         __nis_table_mapping_t   *t;
1010         __nis_rule_value_t      *rv_request = 0, *rv_result = 0;
1011         __nis_ldap_search_t     *ls;
1012         __nis_object_dn_t       *objectDN = NULL;
1013         int                     i, rc, nr = 0, nv = 0;
1014         datum                   *datval = 0;
1015         char                    *skey, *str, *sipkey;
1016         char                    *myself = "singleReadFromDIT";
1017 
1018         *statP = SUCCESS;
1019 
1020         if (!map || !domain || !key || !value) {
1021                 *statP = MAP_PARAM_ERROR;
1022                 return (FALSE);
1023         }
1024 
1025 
1026         /* Get the mapping information for the map */
1027         if ((t = mappingFromMap(map, domain, statP)) == 0) {
1028                 /*
1029                  * No problem. We don't handle this map and domain. Maybe it's
1030                  * handled by a service other than NIS.
1031                  */
1032                 return (FALSE);
1033         }
1034 
1035         /* NULL-terminated version of datum key for logging */
1036         if ((skey = am(myself, key->dsize + 1)) == 0) {
1037                 *statP = MAP_NO_MEMORY;
1038                 return (FALSE);
1039         }
1040         (void) memcpy(skey, key->dptr, key->dsize);
1041 
1042         if ((str = getFullMapName(map, domain)) == 0) {
1043                 *statP = MAP_NO_MEMORY;
1044                 return (FALSE);
1045         }
1046 
1047         /* For each alternate mapping */
1048         for (; t != 0; t = t->next) {
1049                 /* Verify objName */
1050                 if (strcmp(str, t->objName) != 0) {
1051                         continue;
1052                 }
1053 
1054                 /* Verify if key matches the index */
1055                 if (verifyIndexMatch(t, 0, 0, N2LKEY, skey) == 0 ||
1056                         verifyIndexMatch(t, 0, 0, N2LIPKEY, skey) == 0)
1057                         continue;
1058 
1059                 /* Check if rulesFromLDAP are provided */
1060                 if (t->numRulesFromLDAP == 0) {
1061                         logmsg(MSG_NOTIMECHECK, LOG_INFO,
1062                                 "%s: No rulesFromLDAP information available "
1063                                 "for %s (%s)", myself, t->dbId, map);
1064                         continue;
1065                 }
1066 
1067                 /* Convert key into rule-value */
1068                 if ((rv_request = datumToRuleValue(key, 0, t, 0, domain, TRUE,
1069                                                                 statP)) == 0) {
1070                         logmsg(MSG_NOTIMECHECK, LOG_ERR,
1071                                 "%s: Conversion error %d (NIS to name=value "
1072                                 "pairs) for NIS key (%s) for %s (%s)",
1073                                 myself, *statP, skey, t->dbId, map);
1074                         continue;
1075                 }
1076                 /* Convert rule-value into ldap request */
1077                 for (objectDN = t->objectDN; objectDN &&
1078                                 objectDN->read.base;
1079                                 objectDN = objectDN->next) {
1080                         ls = createLdapRequest(t, rv_request, 0, 1, NULL,
1081                                                                 objectDN);
1082                         if (ls == 0) {
1083                                 *statP = MAP_CREATE_LDAP_REQUEST_ERROR;
1084                                 logmsg(MSG_NOTIMECHECK, LOG_ERR,
1085                                         "%s: Failed to create ldapSearch "
1086                                         "request for "
1087                                         "NIS key (%s) for %s (%s) "
1088                                         "for base %s",
1089                                         myself, skey, t->dbId, map,
1090                                         objectDN->read.base);
1091                                 continue;
1092                         }
1093                         ls->timeout.tv_sec = SINGLE_ACCESS_TIMEOUT_SEC;
1094                         ls->timeout.tv_usec = SINGLE_ACCESS_TIMEOUT_USEC;
1095                         /* Query LDAP */
1096                         nr = (ls->isDN)?0:-1;
1097                         rv_result = ldapSearch(ls, &nr, 0, statP);
1098                         freeLdapSearch(ls);
1099                         if (rv_result == 0) {
1100                                 if (*statP == LDAP_NO_SUCH_OBJECT) {
1101                                         /* Entry does not exist in */
1102                                         /* the ldap server */
1103                                 }
1104                                 continue;
1105                         }
1106                         freeRuleValue(rv_request, 1);
1107                         rv_request = 0;
1108 
1109                         /* if result > 1, first match will be returned */
1110                         if (nr > 1) {
1111                                 logmsg(MSG_NOTIMECHECK, LOG_INFO,
1112                                         "%s: %d ldapSearch results "
1113                                         "for NIS key (%s) "
1114                                         "for %s (%s) for base %s. "
1115                                         "First match will be returned ",
1116                                         myself, nr, skey, t->dbId, map,
1117                                         objectDN->read.base);
1118                         }
1119 
1120                         for (i = 0; i < nr; i++) {
1121                                 /* Convert LDAP data to NIS equivalents */
1122                                 *statP = buildNISRuleValue(t, &rv_result[i],
1123                                                                 domain);
1124                                 if (*statP == MAP_INDEXLIST_ERROR)
1125                                         continue;
1126 
1127                                 if (*statP != SUCCESS) {
1128                                         logmsg(MSG_NOTIMECHECK, LOG_WARNING,
1129                                         "%s: Conversion error %d (LDAP to "
1130                                         "name=value pairs) for NIS key (%s) "
1131                                         "for %s (%s) for base %s", myself,
1132                                         *statP, skey,
1133                                         t->dbId, map, objectDN->read.base);
1134                                         continue;
1135                                 }
1136 
1137                         /*
1138                          * Check if 'key' from the ldap result matches the key
1139                          * provided by our caller
1140                          */
1141                                 if ((rc = verifyKey(skey, &rv_result[i]))
1142                                                 == -1) {
1143                                         logmsg(MSG_NOTIMECHECK, LOG_INFO,
1144                                         "%s: Cannot verify key from ldap "
1145                                         "result for NIS key (%s) for %s (%s) "
1146                                         "for base %s",
1147                                         myself, skey, t->dbId, map,
1148                                         objectDN->read.base);
1149                                         continue;
1150                                 }
1151 
1152                                 if (rc == 1) {
1153                                         datval = ruleValueToDatum(t,
1154                                                         &rv_result[i], statP);
1155                                         if (datval == 0) {
1156                                                 logmsg(MSG_NOTIMECHECK,
1157                                                 LOG_WARNING,
1158                                                 "%s: Conversion error %d "
1159                                                 "(name=value pairs to NIS) "
1160                                                 "for NIS key (%s) for %s (%s)"
1161                                                 " for base %s",
1162                                                 myself,
1163                                                 *statP, skey, t->dbId, map,
1164                                                 objectDN->read.base);
1165                                                 continue;
1166                                         }
1167                                         if (value) {
1168                                                 value->dptr = datval->dptr;
1169                                                 value->dsize = datval->dsize;
1170                                         }
1171                                         sfree(datval);
1172                                         sfree(skey);
1173                                         freeRuleValue(rv_result, nr);
1174                                         rv_result = 0;
1175                                         *statP = SUCCESS;
1176 
1177                                         /* Free full map name */
1178                                         sfree(str);
1179 
1180                                         return (TRUE);
1181                                 }
1182                         }
1183                         freeRuleValue(rv_result, nr);
1184                         rv_result = 0;
1185                 }   /* end of for over objectDN */
1186 
1187                 if (rv_request != 0) {
1188                         freeRuleValue(rv_request, 1);
1189                         rv_request = 0;
1190                 }
1191                 if (rv_result != 0) {
1192                         freeRuleValue(rv_result, nr);
1193                         rv_result = 0;
1194                 }
1195         }
1196         sfree(skey);
1197         *statP = MAP_NO_MATCHING_KEY;
1198 
1199         /* Free full map name */
1200         sfree(str);
1201 
1202         return (FALSE);
1203 }
1204 
1205 
1206 /*
1207  * Maps and writes a single NIS entry to the LDAP DIT
1208  */
1209 int
1210 singleWriteToDIT(char *map, char *domain, datum *key, datum *value,
1211                                                 bool_t replace) {
1212         __nis_table_mapping_t   *t;
1213         __nis_rule_value_t      *rv, *frv;
1214         __nis_ldap_search_t     *ls;
1215         int                     statP = SUCCESS, flag;
1216         int                     nv, nr, i, rc, collapse;
1217         char                    *dn = 0, *skey, *svalue, *str;
1218         char                    *myself = "singleWriteToDIT";
1219 
1220         if (!map || !domain || !key || !value) {
1221                 return (MAP_PARAM_ERROR);
1222         }
1223 
1224         /* Return SUCCESS for empty or whitespace key */
1225         for (i = 0; i < key->dsize && (key->dptr[i] == 0 ||
1226                 key->dptr[i] == ' ' || key->dptr[i] == '\t'); i++);
1227         if (i >= key->dsize)
1228                 return (SUCCESS);
1229 
1230         /* Get the mapping information for the map */
1231         if ((t = mappingFromMap(map, domain, &statP)) == 0) {
1232                 /*
1233                  * No problem. We don't handle this map and domain. Maybe it's
1234                  * handled by a service other than NIS.
1235                  */
1236                 return (statP);
1237         }
1238 
1239         /* NULL-terminated version of key and value for logging */
1240         if ((skey = am(myself, key->dsize + 1)) == 0)
1241                 return (MAP_NO_MEMORY);
1242         (void) memcpy(skey, key->dptr, key->dsize);
1243 
1244         if ((svalue = am(myself, value->dsize + 1)) == 0) {
1245                 sfree(skey);
1246                 return (MAP_NO_MEMORY);
1247         }
1248         (void) memcpy(svalue, value->dptr, value->dsize);
1249 
1250         if ((str = getFullMapName(map, domain)) == 0) {
1251                 sfree(skey);
1252                 sfree(svalue);
1253                 return (MAP_NO_MEMORY);
1254         }
1255 
1256         /* For each alternate mapping */
1257         for (flag = 0; t != 0; t = t->next) {
1258                 /* Verify objName */
1259                 if (strcmp(str, t->objName) != 0) {
1260                         continue;
1261                 }
1262 
1263                 /* Verify if key matches the index */
1264                 if (verifyIndexMatch(t, 0, 0, N2LKEY, skey) == 0 ||
1265                         verifyIndexMatch(t, 0, 0, N2LIPKEY, skey) == 0)
1266                         continue;
1267 
1268                 /* Check the writespecs */
1269                 if (t->objectDN->write.base == 0) {
1270                         logmsg(MSG_NOTIMECHECK, LOG_INFO,
1271                                 "%s: No baseDN in writespec. Write disabled "
1272                                 "for %s (%s)", myself, t->dbId, map);
1273                         continue;
1274                 }
1275 
1276                 /* Check if rulesToLDAP are provided */
1277                 if (t->numRulesToLDAP == 0) {
1278                         logmsg(MSG_NOTIMECHECK, LOG_INFO,
1279                                 "%s: No rulesToLDAP. Write disabled for "
1280                                 "%s (%s)", myself, t->dbId, map);
1281                         continue;
1282                 }
1283 
1284                 /* Set flag to indicate write is enabled */
1285                 flag = 1;
1286 
1287                 /* Convert key  and value into an array of rule-values */
1288                 if ((rv = datumToRuleValue(key, value, t, &nv, domain, FALSE,
1289                                                                 &statP)) == 0) {
1290                         logmsg(MSG_NOTIMECHECK, LOG_ERR,
1291                                 "%s: Conversion error %d (NIS to name=value "
1292                                 "pairs) for NIS data (key=%s, value=%s) "
1293                                 "for %s (%s)",
1294                                 myself, statP, skey, svalue, t->dbId, map);
1295                         sfree(skey);
1296                         sfree(svalue);
1297 
1298                         /* Free full map name */
1299                         sfree(str);
1300 
1301                         return (statP);
1302                 }
1303 
1304                 /* Convert NIS data to LDAP equivalents for each rule-value */
1305                 for (i = 0; i < nv; i++) {
1306                         /* Verify indexlist with name=value pairs */
1307                         if (verifyIndexMatch(t, 0, &rv[i], 0, 0) == 0)
1308                                 break;
1309 
1310                         /* Create LDAP request and LDAP name=value pairs */
1311                         if ((ls = createLdapRequest(t, &rv[i],
1312                             0, 0, NULL, NULL)) == 0) {
1313                                 logmsg(MSG_NOTIMECHECK, LOG_ERR,
1314                                         "%s: Conversion error (name=value pairs"
1315                                         " to LDAP) for NIS data "
1316                                         "(key=%s, value=%s) for %s (%s)",
1317                                         myself, skey, svalue, t->dbId, map);
1318                                 freeRuleValue(rv, nv);
1319                                 sfree(skey);
1320                                 sfree(svalue);
1321 
1322                                 /* Free full map name */
1323                                 sfree(str);
1324 
1325                                 return (MAP_CREATE_LDAP_REQUEST_ERROR);
1326                         }
1327                         freeLdapSearch(ls);
1328                         /* printRuleValue(&rv[i]); */
1329                 }
1330 
1331                 /* If i < nv then this alternate mapping isn't the one */
1332                 if (i < nv)
1333                         continue;
1334 
1335                 /*
1336                  * Merge rule-values with the same DN so that we have
1337                  * one ldap write request for each DN
1338                  */
1339                 nr = nv;
1340                 frv = mergeRuleValueWithSameDN(rv, &nr);
1341                 freeRuleValue(rv, nv);
1342                 if (frv == 0) {
1343                         if (nr == -1) {
1344                                 logmsg(MSG_NOTIMECHECK, LOG_ERR,
1345                                         "%s: Unable to merge LDAP write "
1346                                         "requests to same DN for NIS data "
1347                                         "(key=%s, value=%s) for %s (%s)",
1348                                         myself, skey, svalue, t->dbId, map);
1349                                 statP = MAP_INTERNAL_ERROR;
1350                         } else if (nr == 0) {
1351                                 logmsg(MSG_NOTIMECHECK, LOG_WARNING,
1352                                         "%s: Cannot generate write DN due to "
1353                                         "missing information for NIS data "
1354                                         "(key=%s, value=%s) for %s (%s)",
1355                                         myself, skey, svalue, t->dbId, map);
1356                                 statP = MAP_NO_DN;
1357                         }
1358                         sfree(skey);
1359                         sfree(svalue);
1360 
1361                         /* Free full map name */
1362                         sfree(str);
1363 
1364                         return (statP);
1365                 }
1366 
1367                 /* Write to the LDAP server */
1368                 for (collapse = 0, i = 0; i < nr; i++) {
1369                         if ((dn = findVal("dn", &frv[i], mit_ldap)) != 0) {
1370                                 if (replace == FALSE) {
1371                                         /* ldap add */
1372                                         rc = ldapAdd(dn, &frv[i],
1373                                                 t->objectDN->write.attrs, 0);
1374                                 } else {
1375                                         /* ldap modify with addFirst set */
1376                                         rc = ldapModify(dn, &frv[i],
1377                                                 t->objectDN->write.attrs, 1);
1378                                 }
1379 
1380                                 /* if we get err=20, collapse and try again */
1381                                 if (!collapse &&
1382                                         (rc == LDAP_TYPE_OR_VALUE_EXISTS) &&
1383                                         (collapseRuleValue(&frv[i]) == 1)) {
1384                                         logmsg(MSG_NOTIMECHECK, LOG_WARNING,
1385                                                 "%s: Ignoring values differing "
1386                                                 "in case from NIS data (key=%s,"
1387                                                 " value=%s) for (dn: %s) for "
1388                                                 "%s (%s)", myself, skey,
1389                                                 svalue, dn, t->dbId, map);
1390                                         collapse = 1;
1391                                         i--;
1392                                         continue;
1393                                 }
1394 
1395                                 collapse = 0;
1396                                 if (rc != LDAP_SUCCESS) {
1397                                         /* Log error */
1398                                         logmsg(MSG_NOTIMECHECK, LOG_ERR,
1399                                                 "%s: %s error %d (%s) for "
1400                                                 "(dn: %s) for NIS data "
1401                                                 "(key=%s, value=%s) "
1402                                                 "for %s (%s)",
1403                                                 myself, (replace == TRUE) ?
1404                                                 "ldapModify" : "ldapAdd", rc,
1405                                                 ldap_err2string(rc), dn, skey,
1406                                                 svalue, t->dbId, map);
1407 
1408                                         /* Dumping failed call may be useful */
1409                                         /* printRuleValue(&frv[i]); */
1410 
1411                                         /*
1412                                          * Return the error code and let wrapper
1413                                          * sort out if mapping should continue
1414                                          * or abort.
1415                                          */
1416                                         statP = rc;
1417                                         sfree(skey);
1418                                         sfree(svalue);
1419                                         freeRuleValue(frv, nr);
1420 
1421                                         /* Free full map name */
1422                                         sfree(str);
1423 
1424                                         return (statP);
1425                                 }
1426                         }
1427                 }
1428 
1429                 freeRuleValue(frv, nr);
1430         }
1431 
1432         sfree(skey);
1433         sfree(svalue);
1434 
1435         /* Free full map name */
1436         sfree(str);
1437 
1438         return ((flag)?SUCCESS:MAP_WRITE_DISABLED);
1439 }
1440 
1441 suc_code
1442 collapseRuleValue(__nis_rule_value_t *rv) {
1443         int             i, j, k, flag;
1444 
1445         /* Using 'val' to appease cstyle's 80 chars/line limit */
1446         __nis_value_t   *val;
1447 
1448         for (i = 0, flag = 0; i < rv->numAttrs; i++) {
1449                 val = &rv->attrVal[i];
1450                 for (j = 1; j < val->numVals; j++) {
1451                         for (k = 0; k < j; k++) {
1452                                 if (val->val[j].length != val->val[k].length)
1453                                         continue;
1454                                 if (val->val[k].length == 0)
1455                                         continue;
1456                                 if (strncasecmp(val->val[j].value,
1457                                                 val->val[k].value,
1458                                                 val->val[j].length) != 0)
1459                                         continue;
1460                                 flag = 1;
1461                                 sfree(val->val[j].value);
1462 
1463 #ifdef  ORDER_NOT_IMPORTANT
1464                                 val->val[j--] = val->val[--val->numVals];
1465 #else
1466                                 /* Order needs to be maintained */
1467                                 for (k = j + 1; k < val->numVals; k++)
1468                                         val->val[k - 1] = val->val[k];
1469                                 j--;
1470                                 val->numVals--;
1471 #endif
1472                                 break;
1473                         }
1474                 }
1475         }
1476         return (flag);
1477 }
1478 
1479 /* ObjectClass lookup table */
1480 static struct {
1481         const char *attrType;
1482         const char *objectClass;
1483 } oc_lookup[] = {
1484         { "o",                          "objectclass=organization"},
1485         { "organizationname",           "objectclass=organization"},
1486         { "2.5.4.10",                   "objectclass=organization"},
1487         { "ou",                         "objectclass=organizationalunit"},
1488         { "organizationalunitname",     "objectclass=organizationalunit"},
1489         { "2.5.4.11",                   "objectclass=organizationalunit"},
1490         { "c",                          "objectclass=country"},
1491         { "countryname",                "objectclass=country"},
1492         { "2.5.4.6",                    "objectclass=country"},
1493         { "dc",                         "objectclass=domain"},
1494         { "domaincomponent",            "objectclass=domain"},
1495         { "0.9.2342.19200300.100.1.25", "objectclass=domain"},
1496         { "nismapname",                 "objectclass=nismap"},
1497         { "1.3.6.1.1.1.1.26",           "objectclass=nismap"},
1498         { "automountmapname",           "objectclass=automountmap"},
1499         { "1.3.6.1.1.1.1.31",           "objectclass=automountmap"},
1500         { 0,                            0}
1501 };
1502 
1503 /*
1504  * Returns the name of the objectclass to which the object
1505  * represented by the given 'rdn' will most likely belong to.
1506  * The return value is in static memory so it should not be
1507  * freed
1508  */
1509 const char *
1510 getObjectClass(char *rdn) {
1511 
1512         char *attrtype, *p;
1513         int len, i;
1514 
1515         /* Skip leading whitespaces */
1516         for (p = rdn; *p == ' ' || *p == '\t'; p++);
1517         if (*p == '\0')
1518                 return (0);
1519         attrtype = p;
1520 
1521         /* Find '=' */
1522         if ((p = strchr(attrtype, '=')) == 0 || p == attrtype ||
1523                                                 *(p - 1) == '\\')
1524                 return (0);
1525 
1526         /*
1527          * Skip trailing whitespaces in attrtype
1528          * Don't worry, p won't decrease beyond attrtype
1529          */
1530         for (--p; *p == ' ' || *p == '\t'; p--);
1531         len = p - attrtype + 1;
1532 
1533         for (i = 0; oc_lookup[i].attrType; i++)
1534                 if (!strncasecmp(oc_lookup[i].attrType, attrtype, len))
1535                         /* Check length is right */
1536                         if (len == strlen(oc_lookup[i].attrType))
1537                                 return (oc_lookup[i].objectClass);
1538 
1539         return (0);
1540 }
1541 
1542 /*
1543  * Split 'dn' into rdn and parentdn based on the first
1544  * occurrence of unescaped 'comma' or 'semicolon'. rdn
1545  * lies on the LHS while parentdn lies on the RHS of the
1546  * split. If none found, then an empty string ("") is
1547  * assigned to parentdn
1548  */
1549 int
1550 splitDN(char *dn, char **rdn, char **parentdn) {
1551         char    *value, *name;
1552         char    *myself = "splitDN";
1553 
1554         if ((name = sdup(myself, T, dn)) == 0)
1555                 return (-1);
1556 
1557         for (value = name; *value != '\0'; value++) {
1558                 if (*value == ',' || *value == ';')
1559                         if (value == name || *(value - 1) != '\\')
1560                                 break;
1561         }
1562 
1563         if (*value != '\0') {
1564                 *value = '\0';
1565                 value++;
1566         } else
1567                 value = 0;
1568 
1569         if (parentdn) {
1570                 if ((*parentdn = sdup(myself, T, value)) == 0) {
1571                         sfree(name);
1572                         return (-1);
1573                 }
1574         }
1575         if (rdn)
1576                 *rdn = name;
1577         else
1578                 sfree(name);
1579 
1580         return (1);
1581 }
1582 
1583 /*
1584  * FUNCTION :   makeNISObject()
1585  *
1586  * DESCRIPTION: Sets up a nis Object in the DIT.
1587  *
1588  * GIVEN :
1589  *              Case 1: Both 'domain' and 'dn' are non-NULL
1590  *                      Create nisDomainObject with the given information
1591  *              Case 2: Only 'domain' is  non-NULL
1592  *                      Obtain the 'dn' from the nisLDAPdomainContext list
1593  *                      Create nisDomainObject with the above information
1594  *              Case 3: Only 'dn' is  non-NULL
1595  *                      Create an object with the 'dn'
1596  *                      Here we guess the objectclass attribute, based on
1597  *                      oc_lookup table
1598  *              Case 4: Both 'domain' and 'dn' are NULL
1599  *                      Error
1600  *
1601  * RETURNS :    SUCCESS = It worked
1602  *              FAILURE = There was a problem.
1603  */
1604 suc_code
1605 makeNISObject(char *domain, char *dn) {
1606         __nis_rule_value_t      *rv;
1607         __nis_ldap_search_t     *ls;
1608         int                     i, rc, nr, add_rc;
1609         char                    *val;
1610         char                    *myself = "makeNISObject";
1611 
1612         if (!dn && !domain)
1613                 return (FAILURE);
1614 
1615         /*
1616          * If only 'domain' name is provided, then
1617          * try to find dn from the nisLDAPdomainContext
1618          * list generated by the parser
1619          */
1620         if (!dn) {
1621                 for (i = 0; i < ypDomains.numDomains; i++) {
1622                         if (ypDomains.domainLabels[i] == 0)
1623                                 continue;
1624                         if (strcasecmp(domain, ypDomains.domainLabels[i])
1625                                                                 == 0) {
1626                                 dn = ypDomains.domains[i];
1627                                 break;
1628                         }
1629                 }
1630                 if (!dn)
1631                         return (FAILURE);
1632         }
1633 
1634         /*
1635          * If only 'dn' is given, then it means that the
1636          * caller simply wants to a create an entry for
1637          * that 'dn'.
1638          *
1639          * If 'domain' is given, then check if the 'dn'
1640          * has already been set up as a nis domain object.
1641          * If not, see if we can make it become one.
1642          */
1643         if (domain) {
1644                 /*
1645                  * Check to see if the nis domain object has
1646                  * already been set up
1647                  */
1648                 ls = buildLdapSearch(dn, LDAP_SCOPE_BASE, 0, 0,
1649                         "objectclass=*", 0, 0, 0);
1650                 if (ls == 0) {
1651                         logmsg(MSG_NOTIMECHECK, LOG_ERR,
1652                                 "%s: Unable to create ldapSearch "
1653                                 "request for dn: %s", myself, dn);
1654                         return (FAILURE);
1655                 }
1656                 nr = -1;
1657                 rv = ldapSearch(ls, &nr, 0, &rc);
1658                 freeLdapSearch(ls);
1659                 if (rc == LDAP_SUCCESS) {
1660                         val = findVal("nisDomain", rv, mit_ldap);
1661                         if (val != NULL) {
1662                                 /*
1663                                  * Yes, nis domain object found. Check
1664                                  * to see if the domain names match.
1665                                  * If so, we are done. If not, log
1666                                  * a warning message, and return SUCCESS.
1667                                  */
1668                                 if (strcasecmp(val, domain) == 0) {
1669                                         freeRuleValue(rv, nr);
1670                                         return (SUCCESS);
1671                                 } else {
1672                                         logmsg(MSG_NOTIMECHECK,
1673                                                 LOG_WARNING,
1674                                                 "%s: Entry (dn: %s) already "
1675                                                 "contains a nis domain name "
1676                                                 "(%s). The domain name (%s) "
1677                                                 "is not added.",
1678                                                 myself, dn, val, domain);
1679                                         freeRuleValue(rv, nr);
1680                                         return (SUCCESS);
1681                                 }
1682                         } else {
1683                                 freeRuleValue(rv, nr);
1684                                 /*
1685                                  * Entry for the 'dn' exists, but it
1686                                  * is not a nis domain object yet.
1687                                  * Add the nisDoamin attribute and
1688                                  * the nisDomainObject objectclass to
1689                                  * the entry.
1690                                  */
1691                                 if ((rv = initRuleValue(1, 0)) == 0)
1692                                         return (FAILURE);
1693 
1694                                 if (addSAttr2RuleValue("nisDomain",
1695                                                 domain, rv) == -1) {
1696                                         freeRuleValue(rv, 1);
1697                                         return (FAILURE);
1698                                 }
1699                                 rc = ldapModify(dn, rv,
1700                                         "objectclass=nisDomainObject",
1701                                         0);
1702                                 freeRuleValue(rv, 1);
1703                                 if (rc == LDAP_SUCCESS) {
1704                                         logmsg(MSG_NOTIMECHECK,
1705                                                 LOG_INFO,
1706                                                 "%s: entry (dn: %s) "
1707                                                 "modified to be an "
1708                                                 "nis domain object",
1709                                                 myself, dn);
1710                                         return (SUCCESS);
1711                                 } else {
1712                                         logmsg(MSG_NOTIMECHECK,
1713                                                 LOG_ERR,
1714                                                 "%s: unable to modify "
1715                                                 "entry (dn: %s) to be "
1716                                                 "a nis domain object: "
1717                                                 "ldapModify error %d (%s)",
1718                                                 myself, dn, rc,
1719                                                 ldap_err2string(rc));
1720                                         return (FAILURE);
1721                                 }
1722                         }
1723                 } else { /* search for 'dn' failed */
1724                         freeRuleValue(rv, nr);
1725 
1726                         /*
1727                          * It is OK if no such object, otherwise
1728                          * log an error.
1729                          */
1730                         if (rc != LDAP_NO_SUCH_OBJECT) {
1731                                 logmsg(MSG_NOTIMECHECK, LOG_ERR,
1732                                         "%s: unable to retrieve "
1733                                         "entry (dn: %s): "
1734                                         "ldapSearch error %d (%s)",
1735                                         myself, dn, rc,
1736                                         ldap_err2string(rc));
1737                                 return (FAILURE);
1738                         }
1739                 }
1740 
1741                 /*
1742                  * If the 'dn' is actually the naming context of
1743                  * the DIT, we should be able to make it a nis domain
1744                  * object without worrying about missing parent
1745                  * entries. If unable to add the entry for the 'dn'
1746                  * due to missing parent entries, fall through
1747                  * to create them and then add the nis domain object.
1748                  */
1749                 if (addNISObject(domain, dn, &add_rc) == SUCCESS)
1750                         return (SUCCESS);
1751                 else if (add_rc != LDAP_NO_SUCH_OBJECT)
1752                         return (FAILURE);
1753         }
1754 
1755         /* Create parent */
1756         if (addParent(dn, NULL) == FAILURE)
1757                 return (FAILURE);
1758 
1759         if (addNISObject(domain, dn, NULL) == FAILURE)
1760                 return (FAILURE);
1761 
1762         return (SUCCESS);
1763 }
1764 
1765 suc_code
1766 addParent(char *dn, char **attr) {
1767         __nis_rule_value_t      *rv;
1768         __nis_ldap_search_t     *ls;
1769         int                     rc, nr;
1770         char                    *parentdn = 0, *rdn = 0;
1771         char                    *myself = "addParent";
1772 
1773         /* Obtain parentdn */
1774         if (splitDN(dn, &rdn, &parentdn) == -1)
1775                 return (FAILURE);
1776         if (!parentdn) {
1777                 sfree(rdn);
1778                 return (FAILURE);
1779         }
1780 
1781         /* Check if parentdn exists */
1782         ls = buildLdapSearch(parentdn, LDAP_SCOPE_BASE, 0, 0,
1783                                         "objectclass=*", 0, 0, 0);
1784         if (ls == 0) {
1785                 logmsg(MSG_NOTIMECHECK, LOG_ERR,
1786                         "%s: Unable to create ldapSearch request for "
1787                         "parent (dn: %s) of (dn: %s)",
1788                         myself, parentdn, dn);
1789                 sfree(parentdn);
1790                 sfree(rdn);
1791                 return (FAILURE);
1792         }
1793         nr = -1;
1794         rv = ldapSearch(ls, &nr, 0, &rc);
1795         freeLdapSearch(ls);
1796         freeRuleValue(rv, nr);
1797 
1798         /* Create parent if it doesn't exists */
1799         if (rc == LDAP_NO_SUCH_OBJECT) {
1800                 if (makeNISObject(0, parentdn) == FAILURE) {
1801                         logmsg(MSG_NOTIMECHECK, LOG_ERR,
1802                                 "%s: Unable to create parent (dn: %s) of "
1803                                 "(dn: %s) in the DIT", myself, parentdn, dn);
1804                         sfree(parentdn);
1805                         sfree(rdn);
1806                         return (FAILURE);
1807                 }
1808         }
1809         sfree(parentdn);
1810 
1811         if (attr && rdn)
1812                 *attr = (char *)getObjectClass(rdn);
1813         sfree(rdn);
1814 
1815         return (SUCCESS);
1816 }
1817 
1818 
1819 
1820 /*
1821  * FUNCTION :   is_fatal_error()
1822  *
1823  * DESCRIPTION: Works out if a failed mapping operation should be retried.
1824  *
1825  * INPUTS :     Result code from operation
1826  *
1827  * OUTPUTS :    TRUE = Fatal error, don't retry.
1828  *              FALSE = Temporary error, retry.
1829  */
1830 bool_t
1831 is_fatal_error(int res)
1832 {
1833 
1834         if (0 > res)
1835                 /* An internal mapping error. Not going to go away. */
1836                 return (TRUE);
1837 
1838         switch (res) {
1839                 case (LDAP_PROTOCOL_ERROR):
1840                 case (LDAP_TIMELIMIT_EXCEEDED):
1841                 case (LDAP_PARTIAL_RESULTS):
1842                 case (LDAP_BUSY):
1843                 case (LDAP_UNAVAILABLE):
1844                 case (LDAP_UNWILLING_TO_PERFORM):
1845                 case (LDAP_OTHER):
1846                 case (LDAP_SERVER_DOWN):
1847                 case (LDAP_LOCAL_ERROR):
1848                 case (LDAP_TIMEOUT):
1849                 case (LDAP_NO_MEMORY):
1850                         /* Probably worth a retry */
1851                         return (FALSE);
1852 
1853                 default:
1854                         return (TRUE);
1855         }
1856 }
1857 
1858 /*
1859  * FUNCTION :   addNISObject()
1860  *
1861  * DESCRIPTION: Add a nis Object in the DIT.
1862  *
1863  * GIVEN :
1864  *              Case 1: 'dn' is NULL
1865  *                      Error
1866  *              Case 2: 'domain' is non-NULL
1867  *                      Create nisDomainObject with the given information
1868  *              Case 3: 'domain' is NULL
1869  *                      Create an object with the 'dn'
1870  *                      Here we guess the objectclass attribute, based on
1871  *                      oc_lookup table
1872  *
1873  * RETURNS :    SUCCESS = It worked
1874  *              FAILURE = There was a problem. If the ldap add
1875  *                        operation failed, ldap_rc will be set
1876  *                        to the ldap error code.
1877  */
1878 suc_code
1879 addNISObject(char *domain, char *dn, int *ldap_rc) {
1880         __nis_rule_value_t      *rv;
1881         int                     rc;
1882         char                    *objClassAttrs = NULL, *attrs;
1883         char                    *value, *svalue, *rdn = NULL;
1884         char                    *myself = "addNISObject";
1885 
1886         if (!dn)
1887                 return (FAILURE);
1888 
1889         if ((rv = initRuleValue(1, 0)) == 0)
1890                 return (FAILURE);
1891 
1892         if (ldap_rc)
1893                 *ldap_rc = -1;
1894 
1895         /*
1896          * Add name=value pairs from RDN. Although this is not required
1897          * for SunOne Directory Server, during openldap interoperabilty
1898          * tests, it was found out that openldap server returned object
1899          * class violation errors if MUST attributes were not specified
1900          * explicitly.
1901          */
1902         if (splitDN(dn, &rdn, 0) == -1)
1903                 return (FAILURE);
1904         if (rdn != NULL) {
1905                 objClassAttrs = (char *)getObjectClass(rdn);
1906                 if (objClassAttrs == NULL) {
1907                         sfree(rdn);
1908                         return (FAILURE);
1909                 }
1910 
1911                 /*
1912                  * RDN can be composed of multiple name=value pairs
1913                  * concatenated by '+'. Hence, we need to determine each
1914                  * pair and add it to 'rv'
1915                  */
1916                 for (value = rdn, svalue = NULL; *value != '\0'; value++) {
1917                         if (*value == '+') {
1918                                 /* Make sure it's not escaped */
1919                                 if (value == rdn || *(value - 1) != '\\') {
1920                                         /*
1921                                          * We are at the start of the new
1922                                          * pair. 'svalue' now contains the
1923                                          * value for the previous pair. Add
1924                                          * the previous pair to 'rv'
1925                                          */
1926                                         *value = '\0';
1927                                         if (svalue &&
1928                                         addSAttr2RuleValue(rdn, svalue, rv)
1929                                                                         == -1) {
1930                                                 sfree(rdn);
1931                                                 freeRuleValue(rv, 1);
1932                                                 return (FAILURE);
1933                                         }
1934                                         svalue = NULL;
1935                                         rdn = value + 1;
1936                                         continue;
1937                                 }
1938                         }
1939 
1940                         if (*value == '=') {
1941                                 if (value == rdn || *(value - 1) != '\\') {
1942                                         /*
1943                                          * 'rdn' now contains the name.
1944                                          * Whatever follows till the next
1945                                          * unescaped '+' or '\0' is the
1946                                          * value for this pair.
1947                                          */
1948                                         *value = '\0';
1949                                         svalue = value + 1;
1950                                         continue;
1951                                 }
1952                         }
1953                 }
1954 
1955                 /*
1956                  * End of String. Add the previous name=value pair to 'rv'
1957                  */
1958                 if (svalue && addSAttr2RuleValue(rdn, svalue, rv) == -1) {
1959                         sfree(rdn);
1960                         freeRuleValue(rv, 1);
1961                         return (FAILURE);
1962                 }
1963                 sfree(rdn);
1964         } else /* rdn  == NULL */
1965                 return (FAILURE);
1966 
1967         /* Create the entry */
1968         if (domain) {
1969                 if (addSAttr2RuleValue("nisDomain", domain, rv) == -1) {
1970                         freeRuleValue(rv, 1);
1971                         return (FAILURE);
1972                 }
1973                 attrs = scat(myself, F, "objectclass=nisdomainobject,",
1974                                         objClassAttrs);
1975                 if (!attrs) {
1976                         freeRuleValue(rv, 1);
1977                         return (FAILURE);
1978                 }
1979                 rc = ldapAdd(dn, rv, attrs, 0);
1980                 sfree(attrs);
1981         } else {
1982                 rc = ldapAdd(dn, rv, objClassAttrs, 0);
1983         }
1984 
1985         if (rc == LDAP_SUCCESS)
1986                 logmsg(MSG_NOTIMECHECK, LOG_INFO,
1987                                 "%s: Entry (dn: %s) added to DIT",
1988                                 myself, dn);
1989         else if (rc == LDAP_ALREADY_EXISTS)
1990                 /* Treat this as success */
1991                 rc = LDAP_SUCCESS;
1992         else
1993                 logmsg(MSG_NOTIMECHECK, LOG_ERR,
1994                                 "%s: ldapAdd error %d (%s) for (dn: %s)",
1995                                 myself, rc, ldap_err2string(rc), dn);
1996 
1997         freeRuleValue(rv, 1);
1998         if (ldap_rc)
1999                 *ldap_rc = rc;
2000         return ((rc == LDAP_SUCCESS)?SUCCESS:FAILURE);
2001 }