ITS#8637 Reject multiple chain URIs just like slapd.conf

diff --git a/servers/slapd/back-ldap/chain.c b/servers/slapd/back-ldap/chain.c
index e391ad95202c3bb6d17958d8e416e30ab7c5ee4e..b1d01ff8b2ec5cb6c6d4d014cf61e0839347d6be 100644 (file)
--- a/servers/slapd/back-ldap/chain.c
+++ b/servers/slapd/back-ldap/chain.c
@@ -1364,6 +1364,19 @@ fail:
        li = ca->be->be_private;
 
        if ( at ) {
+               char **urls;
+
+               urls = ldap_str2charray( at->a_vals[ 0 ].bv_val, ", \t" );
+               if ( !urls || !urls[0] || urls[1] ) {
+                       ldap_charray_free( urls );
+                       Debug( LDAP_DEBUG_ANY, "slapd-chain: "
+                               "olcDbURI must contain exactly one url, got %s\n",
+                               at->a_vals[ 0 ].bv_val, 0, 0 );
+                       rc = LDAP_CONSTRAINT_VIOLATION;
+                       goto done;
+               }
+               ldap_charray_free( urls );
+
                li->li_uri = ch_strdup( at->a_vals[ 0 ].bv_val );
                value_add_one( &li->li_bvuri, &at->a_vals[ 0 ] );
                if ( avl_insert( &lc->lc_lai.lai_tree, (caddr_t)li,