Import changes from devel

Fixed clients & -lldap KBIND (ITS#717)
  Fixed clients/tools -R handling
  Fixed slapd IPv6 issues (ITS#716)
  Fixed slapd kpasswd MIT Compatibility (ITS#715)
  Fixed slapd time syntax routines (ITS#713)
  Fixed ldappasswd -A -S crash (ITS#714)
  Fixed ldappasswd user argument usage and man page
  Fixed ldapmodify man page

CHANGES

@@ -1,6 +1,14 @@
 OpenLDAP 2.0 Change Log
 
 OpenLDAP 2.0.X Engineering
+	Fixed clients & -lldap KBIND (ITS#717)
+	Fixed clients/tools -R handling
+	Fixed slapd IPv6 issues (ITS#716)
+	Fixed slapd MIT KPASSWD Compatibility (ITS#715)
+	Fixed slapd time syntax routines (ITS#713)
+	Fixed ldappasswd -A -S crash (ITS#714)
+	Fixed ldappasswd user argument usage and man page
+	Fixed ldapmodify man page
 
 OpenLDAP 2.0.1 Release
 	Fixed StartTLS & ldaps:// client SDK

clients/tools/ldapdelete.c

@@ -102,7 +102,9 @@ main( int argc, char **argv )
 
     prog = (prog = strrchr(argv[0], *LDAP_DIRSEP)) == NULL ? argv[0] : prog + 1;
 
-    while (( i = getopt( argc, argv, "cf:r" "Cd:D:h:H:IkKMnO:p:P:QRU:vw:WxX:Y:Z" )) != EOF ) {
+    while (( i = getopt( argc, argv, "cf:r"
+		"Cd:D:h:H:IkKMnO:p:P:QR:U:vw:WxX:Y:Z" )) != EOF )
+	{
 	switch( i ) {
 	/* Delete Specific Options */
 	case 'c':	/* continuous operation mode */

clients/tools/ldapmodify.c

@@ -159,7 +159,9 @@ main( int argc, char **argv )
     authmethod = -1;
 	version = -1;
 
-    while (( i = getopt( argc, argv, "acrf:F" "Cd:D:h:H:IkKMnO:p:P:QRU:vw:WxX:Y:Z" )) != EOF ) {
+    while (( i = getopt( argc, argv, "acrf:F"
+		"Cd:D:h:H:IkKMnO:p:P:QR:U:vw:WxX:Y:Z" )) != EOF )
+	{
 	switch( i ) {
 	/* Modify Options */
 	case 'a':	/* add */

clients/tools/ldapmodrdn.c

@@ -118,7 +118,9 @@ main(int argc, char **argv)
 
     prog = (prog = strrchr(argv[0], *LDAP_DIRSEP)) == NULL ? argv[0] : prog + 1;
 
-    while (( i = getopt( argc, argv, "cf:rs:" "Cd:D:h:H:IkKMnO:p:P:QRU:vw:WxX:Y:Z" )) != EOF ) {
+    while (( i = getopt( argc, argv, "cf:rs:"
+		"Cd:D:h:H:IkKMnO:p:P:QR:U:vw:WxX:Y:Z" )) != EOF )
+	{
 	switch( i ) {
 	/* Modrdn Options */
 	case 'c':

clients/tools/ldappasswd.c

@@ -29,8 +29,8 @@ usage(const char *s)
 {
 	fprintf(stderr,
 "Change password of an LDAP user\n\n"
-"usage: %s [options] user\n"
-"  user: the identity of the user, normally a DN\n"
+"usage: %s [options] [user]\n"
+"  user: the autentication identity, commonly a DN\n"
 "Password change options:\n"
 "  -a secret  old password\n"
 "  -A         prompt for old password\n"
@@ -70,7 +70,7 @@ main( int argc, char *argv[] )
 	char	*ldaphost = NULL;
 	char	*ldapuri = NULL;
 
-	char	*dn = NULL;
+	char	*user = NULL;
 	char	*binddn = NULL;
 
 	struct berval passwd = { 0, NULL };
@@ -109,11 +109,8 @@ main( int argc, char *argv[] )
 
     prog = (prog = strrchr(argv[0], *LDAP_DIRSEP)) == NULL ? argv[0] : prog + 1;
 
-	if (argc == 1)
-		usage (argv[0]);
-
-	while( (i = getopt( argc, argv,
-		"Aa:Ss:" "Cd:D:h:H:InO:p:QRU:vw:WxX:Y:Z" )) != EOF )
+	while( (i = getopt( argc, argv, "Aa:Ss:"
+		"Cd:D:h:H:InO:p:QR:U:vw:WxX:Y:Z" )) != EOF )
 	{
 		switch (i) {
 		/* Password Options */
@@ -490,10 +487,6 @@ main( int argc, char *argv[] )
 		}
 	}
 
-	if( argc - optind != 1 ) {
-		usage( argv[0] );
-	} 
-
 	if (authmethod == -1) {
 #ifdef HAVE_CYRUS_SASL
 		authmethod = LDAP_AUTH_SASL;
@@ -502,15 +495,21 @@ main( int argc, char *argv[] )
 #endif
 	}
 
-	dn = strdup( argv[optind] );
+	if( argc - optind > 1 ) {
+		usage( argv[0] );
+	} else if ( argc - optind == 1 ) {
+		user = strdup( argv[optind] );
+	} else {
+		user = NULL;
+	}
 
 	if( want_oldpw && oldpw == NULL ) {
 		/* prompt for old password */
 		char *ckoldpw;
-		newpw = strdup(getpassphrase("Old password: "));
+		oldpw = strdup(getpassphrase("Old password: "));
 		ckoldpw = getpassphrase("Re-enter old password: ");
 
-		if( newpw== NULL || ckoldpw == NULL ||
+		if( oldpw== NULL || ckoldpw == NULL ||
 			strncmp( oldpw, ckoldpw, strlen(oldpw) ))
 		{
 			fprintf( stderr, "passwords do not match\n" );
@@ -532,16 +531,6 @@ main( int argc, char *argv[] )
 		}
 	}
 
-	if( binddn == NULL && dn != NULL ) {
-		binddn = dn;
-		dn = NULL;
-
-		if( passwd.bv_val == NULL ) {
-			passwd.bv_val = oldpw;
-			passwd.bv_len = oldpw == NULL ? 0 : strlen( oldpw );
-		}
-	}
-
 	if (want_bindpw && passwd.bv_val == NULL ) {
 		/* handle bind password */
 		fprintf( stderr, "Bind DN: %s\n", binddn );
@@ -656,7 +645,7 @@ main( int argc, char *argv[] )
 		}
 	}
 
-	if( dn != NULL || oldpw != NULL || newpw != NULL ) {
+	if( user != NULL || oldpw != NULL || newpw != NULL ) {
 		/* build change password control */
 		BerElement *ber = ber_alloc_t( LBER_USE_DER );
 
@@ -668,10 +657,10 @@ main( int argc, char *argv[] )
 
 		ber_printf( ber, "{" /*}*/ );
 
-		if( dn != NULL ) {
+		if( user != NULL ) {
 			ber_printf( ber, "ts",
-				LDAP_TAG_EXOP_X_MODIFY_PASSWD_ID, dn );
-			free(dn);
+				LDAP_TAG_EXOP_X_MODIFY_PASSWD_ID, user );
+			free(user);
 		}
 
 		if( oldpw != NULL ) {

clients/tools/ldapsearch.c

@@ -181,8 +181,8 @@ main( int argc, char **argv )
 
     prog = (prog = strrchr(argv[0], *LDAP_DIRSEP)) == NULL ? argv[0] : prog + 1;
 
-	while (( i = getopt( argc, argv,
-		"Aa:b:f:Ll:S:s:T:tuV:z:" "Cd:D:h:H:IkKMnO:p:P:QRU:vw:WxX:Y:Z")) != EOF )
+	while (( i = getopt( argc, argv, "Aa:b:f:Ll:S:s:T:tuV:z:"
+		"Cd:D:h:H:IkKMnO:p:P:QR:U:vw:WxX:Y:Z")) != EOF )
 	{
 	switch( i ) {
 	/* Search Options */

clients/ud/auth.c

@@ -163,7 +163,7 @@ auth( char *who, int implicit )
 
 		/* if we're running as a server (e.g., out of inetd) */
 		if ( ! isatty( 1 ) ) {
-			strcpy( tktpath, LDAP_TMPDIR LDAP_DEFSEP "ud_tktXXXXXX" );
+			strcpy( tktpath, LDAP_TMPDIR LDAP_DIRSEP "ud_tktXXXXXX" );
 			mktemp( tktpath );
 			krb_set_tkt_string( tktpath );
 		}

configure.in

@@ -338,12 +338,12 @@ if test $ol_enable_kbind = yes -o $ol_enable_kpasswd = yes ; then
 	if test $ol_with_kerberos = no ; then
 		AC_MSG_ERROR([options require --with-kerberos])
 	fi
+	ol_with_kerberos=yes
 elif test $ol_enable_kbind = no -o $ol_enable_kpasswd = no ; then
-	if test $ol_with_kerberos != auto ; then
+	if test $ol_with_kerberos != no -a $ol_with_kerberos != no ; then
 		AC_MSG_WARN([Kerberos detection enabled unnecessarily]);
-	else
-		ol_with_kerberos=no
 	fi
+	ol_with_kerberos=no
 fi
 
 if test $ol_enable_spasswd = yes ; then
@@ -756,8 +756,9 @@ ol_link_kpasswd=no
 ol_link_krb5=no
 ol_link_krb4=no
 
-if test $ol_with_kerberos = auto -o $ol_with_kerberos = k5 \
-	-o $ol_with_kerberos = k5only -o $ol_with_kerberos = k425 ; then
+if test $ol_with_kerberos = yes -o $ol_with_kerberos = auto \
+	-o $ol_with_kerberos = k5 -o $ol_with_kerberos = k5only \
+	-o $ol_with_kerberos = k425 ; then
 
 	AC_CHECK_HEADERS(krb5.h)
 
@@ -812,8 +813,8 @@ if test $ol_with_kerberos = auto -o $ol_with_kerberos = k5 \
 	fi
 fi
 
-if test $ol_link_krb5 = yes -a \
-	\( $ol_with_kerberos = auto -o $ol_with_kerberos = k425 \) ; then
+if test $ol_link_krb5 = yes -a \( $ol_with_kerberos = yes -o \
+	$ol_with_kerberos = auto -o $ol_with_kerberos = k425 \) ; then
 
 	AC_CHECK_HEADERS(kerberosIV/krb.h kerberosIV/des.h)
 
@@ -872,8 +873,8 @@ if test $ol_link_krb5 = yes ; then
 	ol_with_kerberos=found
 fi
 
-if test $ol_with_kerberos = auto -o $ol_with_kerberos = k4 \
-	-o $ol_with_kerberos = kth ; then
+if test $ol_with_kerberos = yes -o $ol_with_kerberos = auto \
+	-o $ol_with_kerberos = k4 -o $ol_with_kerberos = kth ; then
 
 	AC_CHECK_HEADERS(krb.h des.h krb-archaeology.h )
 
@@ -898,14 +899,21 @@ if test $ol_with_kerberos = auto -o $ol_with_kerberos = k4 \
 fi
 
 if test $ol_link_krb4 = yes -a $ol_enable_kpasswd != no ; then
-	ol_link_kpasswd=yes;
+	ol_link_kpasswd=yes
+fi
+
+if test $ol_link_krb4 = yes -a $ol_enable_kbind != no ; then
+	ol_link_kbind=yes
+
+elif test $ol_enable_kbind = yes ; then
+	AC_MSG_ERROR([Kerberos IV detection failed])
 fi
 
 if test $ol_link_krb4 = yes -o $ol_link_krb5 = yes ; then
 	AC_DEFINE(HAVE_KERBEROS, 1, [define if you have Kerberos])
 
 elif test $ol_with_kerberos != auto -a $ol_with_kerberos != no ; then
-	AC_MSG_ERROR([Kerberos detection failed.])
+	AC_MSG_ERROR([Kerberos detection failed])
 fi
 
 dnl ----------------------------------------------------------------

doc/man/man1/ldapmodify.1

@@ -253,9 +253,6 @@ the command line) should conform to the format defined in
 .BR slapd.replog (5),
 with the exceptions noted below.
 .LP
-If the first line of a record consists of a decimal number (entry id),
-it is ignored.
-.LP
 Lines that begin with "replica:" are matched against the LDAP server host
 and port in use to decide if a particular replog record should be applied.
 Any other lines that precede the "dn:" line are ignored.
@@ -281,40 +278,6 @@ entries to be used as input to
 .I ldapmodify
 or
 .I ldapadd.
-.SH ALTERNATIVE INPUT FORMAT
-An alternative input format is supported for compatibility with older
-versions of
-.I ldapmodify.
-This format consists of one or more entries separated by blank lines,
-where each entry looks like:
-.LP
-.nf
-    Distinguished Name (DN)
-    attr=value
-    [attr=value ...]
-.fi
-.LP
-where \fIattr\fP is the name of the attribute and \fIvalue\fP is the
-value.
-.LP
-By default, values are added.  If the
-.RI \- r
-command line flag is
-given, the default is to replace existing values with the new one.
-Note that it is permissible for a given attribute to appear more than
-once (for example, to add more than one value for an attribute).  Also
-note that you can use a trailing `\\' to continue values across lines and
-preserve newlines in the value itself (this is useful for modifying
-QUIPU iattr attributes among others).
-.LP
-.I attr
-should be preceded by a \fB-\fP to remove a value.  The `=' and
-value should be omitted to remove an entire attribute.
-.LP
-.I attr
-should be preceded by a \fB+\fP to add a value in the presence of the
-\-r flag.
-.LP
 .SH EXAMPLES
 Assuming that the file
 .B /tmp/entrymods
@@ -352,23 +315,6 @@ as a
 and completely remove the
 .I description
 attribute.
-The same modifications as above can be performed using the older
-.I ldapmodify
-input format:
-.LP
-.nf
-    cn=Modify Me, dc=example, dc=com
-    mail=modme@example.com
-    +title=Grand Poobah
-    +jpegPhoto=/tmp/modme.jpeg
-    -description
-.fi
-.LP
-and the command:
-.LP
-.nf
-    ldapmodify -b -r -f /tmp/entrymods
-.fi
 .LP
 Assuming that the file
 .B /tmp/newentry

doc/man/man1/ldappasswd.1

@@ -50,13 +50,18 @@ ldappasswd \- change the password of an LDAP entry
 .BI \-Y \ mech\fR]
 [\c
 .BR \-Z[Z] ]
+[\c
+.IR user ]
 .SH DESCRIPTION
 .B ldappasswd
 is a tool to set the password of an LDAP user.
 .LP
 .B ldappasswd
-sets the password of associated with the user.  If the new
-password is not specified on the command line or the user
+sets the password of associated with the user [or an optionally
+specified
+.IR user ]. 
+If the new
+password is not specified on the command line and the user
 doesn't enable prompting, the server will be asked to generate
 a password for the user.
 .LP

libraries/libldap/ldap-int.h

@@ -181,7 +181,9 @@ typedef struct ldap_conn {
 #define LDAP_CONNST_CONNECTING		2
 #define LDAP_CONNST_CONNECTED		3
 	LDAPURLDesc		*lconn_server;
+#ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
 	char			*lconn_krbinstance;
+#endif
 	struct ldap_conn	*lconn_next;
 	BerElement		*lconn_ber;/* ber receiving on this conn. */
 } LDAPConn;

libraries/libldap/open.c

@@ -322,8 +322,8 @@ ldap_int_open_connection(
 	}
 #endif
 
-	if ( conn->lconn_krbinstance != NULL ) {
 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
+	if ( conn->lconn_krbinstance == NULL ) {
 		char *c;
 		conn->lconn_krbinstance = ldap_host_connected_to( conn->sb );
 
@@ -331,10 +331,8 @@ ldap_int_open_connection(
 		    ( c = strchr( conn->lconn_krbinstance, '.' )) != NULL ) {
 			*c = '\0';
 		}
-#else /* LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND */
-		conn->lconn_krbinstance = NULL;
-#endif /* LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND */
 	}
+#endif /* LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND */
 
 	return( 0 );
 }

libraries/libldap/request.c

@@ -410,9 +410,11 @@ ldap_free_connection( LDAP *ld, LDAPConn *lc, int force, int unbind )
 			prevlc = tmplc;
 		}
 		ldap_free_urllist( lc->lconn_server );
+#ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
 		if ( lc->lconn_krbinstance != NULL ) {
 			LDAP_FREE( lc->lconn_krbinstance );
 		}
+#endif
 		if ( lc->lconn_sb != ld->ld_sb ) {
 			ber_sockbuf_free( lc->lconn_sb );
 		}

libraries/liblutil/passwd.c

@@ -48,6 +48,8 @@
 
 #include <lber.h>
 
+#include "ldap_pvt.h"
+
 #include "lutil_md5.h"
 #include "lutil_sha1.h"
 #include "lutil.h"
@@ -751,7 +753,7 @@ static int chk_kerberos(
 
 		krb5_free_principal( context, client );
 		krb5_free_principal( context, server );
-		krb5_free_creds_contents( context, &creds );
+		krb5_free_cred_contents( context, &creds );
 		krb5_free_context( context );
 
 		rtn = !!ret;

servers/slapd/daemon.c

@@ -277,6 +277,15 @@ static Listener * open_listener( const char* url )
 	ldap_free_urldesc( lud );
 	sai = res;
 	do {
+		if ( (sai->ai_family != AF_INET)
+#  ifdef LDAP_PF_INET6
+		     && (sai->ai_family != AF_INET6)
+#  endif
+#  ifdef LDAP_PF_LOCAL
+		     && (sai->ai_family != AF_LOCAL)
+#  endif
+		     )
+			continue;
 		l.sl_sd = socket( sai->ai_family, sai->ai_socktype, sai->ai_protocol);
 		if ( l.sl_sd == AC_SOCKET_INVALID ) {
 			int err = sock_errno();
@@ -910,7 +919,7 @@ slapd_daemon_task(
 			case AF_INET6:
 			if ( IN6_IS_ADDR_V4MAPPED(&from.sa_in6_addr.sin6_addr) ) {
 				peeraddr = inet_ntoa( *((struct in_addr *)
-							&from.sa_in6_addr.sin6_addr.s6_addr32[3]) );
+							&from.sa_in6_addr.sin6_addr.s6_addr[12]) );
 				sprintf( peername, "IP=%s:%d",
 					 peeraddr != NULL ? peeraddr : "unknown",
 					 (unsigned) ntohs( from.sa_in6_addr.sin6_port ) );

servers/slapd/schema_init.c

@@ -1930,12 +1930,18 @@ check_time_syntax (struct berval *val,
 	int *parts)
 {
 	static int ceiling[9] = { 99, 99, 11, 30, 23, 59, 59, 12, 59 };
-	static int mdays[12] = { 31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 };
+	static int mdays[2][12] = {
+		/* non-leap years */
+		{ 30, 27, 30, 29, 30, 29, 30, 30, 29, 30, 29, 30 },
+		/* leap years */
+		{ 30, 28, 30, 29, 30, 29, 30, 30, 29, 30, 29, 30 }
+	};
 	char *p, *e;
-	int part, c, neg = 0;
+	int part, c, tzoffset, leapyear = 0 ;
 
-	if( val->bv_len == 0 )
+	if( val->bv_len == 0 ) {
 		return LDAP_INVALID_SYNTAX;
+	}
 
 	p = (char *)val->bv_val;
 	e = p + val->bv_len;
@@ -1945,80 +1951,94 @@ check_time_syntax (struct berval *val,
 		p++;
 	}
 
-	if (e - p < 13 - (2 * start))
+	if (e - p < 13 - (2 * start)) {
 		return LDAP_INVALID_SYNTAX;
+	}
 
-	for (part = 0; part < 9; part++)
+	for (part = 0; part < 9; part++) {
 		parts[part] = 0;
+	}
 
 	for (part = start; part < 7; part++) {
 		c = *p;
-		if ((part == 6)
-			&& (c == 'Z'
-				|| c == '+'
-				|| c == '-'))
-		{
+		if ((part == 6) && (c == 'Z' || c == '+' || c == '-')) {
 			part++;
 			break;
 		}
 		p++;
 		c -= '0';
-		if (p == e)
+		if (p == e) {
 			return LDAP_INVALID_SYNTAX;
-		if (c < 0 || c > 9)
+		}
+		if (c < 0 || c > 9) {
 			return LDAP_INVALID_SYNTAX;
+		}
 		parts[part] = c;
 
 		c = *p++ - '0';
-		if (p == e)
+		if (p == e) {
 			return LDAP_INVALID_SYNTAX;
-		if (c < 0 || c > 9)
+		}
+		if (c < 0 || c > 9) {
 			return LDAP_INVALID_SYNTAX;
+		}
 		parts[part] *= 10;
 		parts[part] += c;
 
-		if (part == 2 || part == 3)
+		if (part == 2 || part == 3) {
 			parts[part]--;
-		if (parts[part] < 0)
+		}
+		if (parts[part] < 0) {
 			return LDAP_INVALID_SYNTAX;
-		if (parts[part] > ceiling[part])
+		}
+		if (parts[part] > ceiling[part]) {
 			return LDAP_INVALID_SYNTAX;
-	}
-	if (parts[2] == 1) {
-		if (parts[3] > mdays[parts[2]])
-			return LDAP_INVALID_SYNTAX;
-		if (parts[1] & 0x03) {
-			/* FIXME:  This is an incomplete leap-year
-			 * check that fails in 2100, 2200, 2300,
-			 * 2500, 2600, 2700, ...
-			 */
-			if (parts[3] > mdays[parts[2]] - 1)
-				return LDAP_INVALID_SYNTAX;
 		}
 	}
+
+	/* leapyear check for the Gregorian calendar (year>1581) */
+	if (((parts[1] % 4 == 0) && (parts[1] != 0)) ||
+		((parts[0] % 4 == 0) && (parts[1] == 0)))
+	{
+		leapyear = 1;
+	}
+
+	if (parts[3] > mdays[leapyear][parts[2]]) {
+		return LDAP_INVALID_SYNTAX;
+	}
+	
 	c = *p++;
 	if (c == 'Z') {
-		/* all done */
+		tzoffset = 0; /* UTC */
 	} else if (c != '+' && c != '-') {
 		return LDAP_INVALID_SYNTAX;
 	} else {
-		if (c == '-')
-			neg = 1;
-		if (p > e - 4)
+		if (c == '-') {
+			tzoffset = -1;
+		} else /* c == '+' */ {
+			tzoffset = 1;
+		}
+
+		if (p > e - 4) {
 			return LDAP_INVALID_SYNTAX;
+		}
+
 		for (part = 7; part < 9; part++) {
 			c = *p++ - '0';
-			if (c < 0 || c > 9)
+			if (c < 0 || c > 9) {
 				return LDAP_INVALID_SYNTAX;
+			}
 			parts[part] = c;
 
 			c = *p++ - '0';
-			if (c < 0 || c > 9)
+			if (c < 0 || c > 9) {
 				return LDAP_INVALID_SYNTAX;
+			}
 			parts[part] *= 10;
 			parts[part] += c;
-			if (parts[part] < 0 || parts[part] > ceiling[part])
+			if (parts[part] < 0 || parts[part] > ceiling[part]) {
 				return LDAP_INVALID_SYNTAX;
+			}
 		}
 	}
 
@@ -2026,49 +2046,44 @@ check_time_syntax (struct berval *val,
 	while ( ( p < e ) && ASCII_SPACE( *p ) ) {
 		p++;
 	}
-	if (p != e)
+	if (p != e) {
 		return LDAP_INVALID_SYNTAX;
+	}
 
-	if (neg == 0) {
+	switch ( tzoffset ) {
+	case -1: /* negativ offset to UTC, ie west of Greenwich  */
 		parts[4] += parts[7];
 		parts[5] += parts[8];
-		for (part = 7; --part > 0; ) {
-			if (part != 3)
+		for (part = 6; --part > 0; ) { /* offset is just hhmm, no seconds */
+			if (part != 3) {
 				c = ceiling[part];
-			else {
-				/* FIXME:  This is an incomplete leap-year
-				 * check that fails in 2100, 2200, 2300,
-				 * 2500, 2600, 2700, ...
-				 */
-				c = mdays[parts[2]];
-				if (parts[2] == 1)
-					c--;
+			} else {
+				c = mdays[leapyear][parts[2]];
 			}
 			if (parts[part] > c) {
 				parts[part] -= c + 1;
 				parts[part - 1]++;
 			}
 		}
-	} else {
+		break;
+	case 1: /* positive offset to UTC, ie east of Greenwich */
 		parts[4] -= parts[7];
 		parts[5] -= parts[8];
-		for (part = 7; --part > 0; ) {
-			if (part != 3)
+		for (part = 6; --part > 0; ) {
+			if (part != 3) {
 				c = ceiling[part];
-			else {
-				/* FIXME:  This is an incomplete leap-year
-				 * check that fails in 2100, 2200, 2300,
-				 * 2500, 2600, 2700, ...
-				 */
-				c = mdays[(parts[2] - 1) % 12];
-				if (parts[2] == 2)
-					c--;
+			} else {
+				/* first arg to % needs to be non negativ */
+				c = mdays[leapyear][(parts[2] - 1 + 12) % 12];
 			}
 			if (parts[part] < 0) {
 				parts[part] += c + 1;
 				parts[part - 1]--;
 			}
 		}
+		break;
+	case 0: /* already UTC */
+		break;
 	}
 
 	return LDAP_SUCCESS;
@@ -2090,8 +2105,9 @@ utcTimeNormalize(
 
 	*normalized = NULL;
 	out = ch_malloc( sizeof(struct berval) );
-	if( out == NULL )
+	if( out == NULL ) {
 		return LBER_ERROR_MEMORY;
+	}
 
 	out->bv_val = ch_malloc( 14 );
 	if ( out->bv_val == NULL ) {
@@ -2100,8 +2116,8 @@ utcTimeNormalize(
 	}
 
 	sprintf( out->bv_val, "%02ld%02ld%02ld%02ld%02ld%02ldZ",
-				parts[1], parts[2] + 1, parts[3] + 1,
-				parts[4], parts[5], parts[6] );
+		parts[1], parts[2] + 1, parts[3] + 1,
+		parts[4], parts[5], parts[6] );
 	out->bv_len = 13;
 	*normalized = out;
 
@@ -2144,8 +2160,9 @@ generalizedTimeNormalize(
 
 	*normalized = NULL;
 	out = ch_malloc( sizeof(struct berval) );
-	if( out == NULL )
+	if( out == NULL ) {
 		return LBER_ERROR_MEMORY;
+	}
 
 	out->bv_val = ch_malloc( 16 );
 	if ( out->bv_val == NULL ) {
@@ -2154,8 +2171,8 @@ generalizedTimeNormalize(
 	}
 
 	sprintf( out->bv_val, "%02ld%02ld%02ld%02ld%02ld%02ld%02ldZ",
-				parts[0], parts[1], parts[2] + 1, parts[3] + 1,
-				parts[4], parts[5], parts[6] );
+		parts[0], parts[1], parts[2] + 1, parts[3] + 1,
+		parts[4], parts[5], parts[6] );
 	out->bv_len = 15;
 	*normalized = out;
 

tests/scripts/test010-passwd

@@ -56,7 +56,7 @@ echo "Using ldappasswd (PASS 1)  ..."
 echo "Pass 1" >> $TESTOUT
 $LDAPPASSWD -h localhost -p $PORT \
 	-w secret -s newsecret \
-	"cn=md5, $BASEDN" >> $TESTOUT 2>&1
+	-D "cn=md5, $BASEDN" >> $TESTOUT 2>&1
 RC=$?
 if test $RC != 0 ; then
 	echo "ldappasswd failed ($RC)!"
@@ -65,7 +65,7 @@ if test $RC != 0 ; then
 fi
 $LDAPPASSWD -h localhost -p $PORT \
 	-w secret -s newsecret \
-	"cn=smd5, $BASEDN" >> $TESTOUT 2>&1
+	-D "cn=smd5, $BASEDN" >> $TESTOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldappasswd failed ($RC)!"
 	kill -HUP $PID
@@ -73,7 +73,7 @@ if test $RC != 0 ; then
 fi
 $LDAPPASSWD -h localhost -p $PORT \
 	-w secret -s newsecret \
-	"cn=sha, $BASEDN" >> $TESTOUT 2>&1
+	-D "cn=sha, $BASEDN" >> $TESTOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldappasswd failed ($RC)!"
 	kill -HUP $PID
@@ -81,7 +81,7 @@ if test $RC != 0 ; then
 fi
 $LDAPPASSWD -h localhost -p $PORT \
 	-w secret -s newsecret \
-	"cn=ssha, $BASEDN" >> $TESTOUT 2>&1
+	-D "cn=ssha, $BASEDN" >> $TESTOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldappasswd failed ($RC)!"
 	kill -HUP $PID
@@ -93,7 +93,7 @@ echo "Pass 2" >> $TESTOUT
 echo "Using ldappasswd (PASS 2)  ..."
 $LDAPPASSWD -h localhost -p $PORT \
 	-w newsecret \
-	"cn=md5, $BASEDN" >> $TESTOUT 2>&1
+	-D "cn=md5, $BASEDN" >> $TESTOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldappasswd failed ($RC)!"
 	kill -HUP $PID
@@ -101,7 +101,7 @@ if test $RC != 0 ; then
 fi
 $LDAPPASSWD -h localhost -p $PORT \
 	-w newsecret \
-	"cn=smd5, $BASEDN" >> $TESTOUT 2>&1
+	-D "cn=smd5, $BASEDN" >> $TESTOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldappasswd failed ($RC)!"
 	kill -HUP $PID
@@ -109,7 +109,7 @@ if test $RC != 0 ; then
 fi
 $LDAPPASSWD -h localhost -p $PORT \
 	-w newsecret \
-	"cn=sha, $BASEDN" >> $TESTOUT 2>&1
+	-D "cn=sha, $BASEDN" >> $TESTOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldappasswd failed ($RC)!"
 	kill -HUP $PID
@@ -117,7 +117,7 @@ if test $RC != 0 ; then
 fi
 $LDAPPASSWD -h localhost -p $PORT \
 	-w newsecret \
-	"cn=ssha, $BASEDN" >> $TESTOUT 2>&1
+	-D "cn=ssha, $BASEDN" >> $TESTOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldappasswd failed ($RC)!"
 	kill -HUP $PID