1 /* denyop.c - Denies operations */
3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
5 * Copyright 2004-2012 The OpenLDAP Foundation.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted only as authorized by the OpenLDAP
12 * A copy of this license is available in the file LICENSE in the
13 * top-level directory of the distribution or, alternatively, at
14 * <http://www.OpenLDAP.org/license.html>.
17 * This work was initially developed by Pierangelo Masarati for inclusion in
23 #ifdef SLAPD_OVER_DENYOP
27 #include <ac/string.h>
28 #include <ac/socket.h>
32 /* This overlay provides a quick'n'easy way to deny selected operations
33 * for a database whose backend implements the operations. It is intended
34 * to be less expensive than ACLs because its evaluation occurs before
35 * any backend specific operation is actually even initiated.
50 typedef struct denyop_info {
51 int do_op[denyop_unbind + 1];
55 denyop_func( Operation *op, SlapReply *rs )
57 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
58 denyop_info *oi = (denyop_info *)on->on_bi.bi_private;
63 deny = oi->do_op[denyop_bind];
67 deny = oi->do_op[denyop_add];
71 deny = oi->do_op[denyop_delete];
75 deny = oi->do_op[denyop_modrdn];
79 deny = oi->do_op[denyop_modify];
82 case LDAP_REQ_COMPARE:
83 deny = oi->do_op[denyop_compare];
87 deny = oi->do_op[denyop_search];
90 case LDAP_REQ_EXTENDED:
91 deny = oi->do_op[denyop_extended];
95 deny = oi->do_op[denyop_unbind];
100 return SLAP_CB_CONTINUE;
103 op->o_bd->bd_info = (BackendInfo *)on->on_info;
104 send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
105 "operation not allowed within namingContext" );
115 slap_overinst *on = (slap_overinst *) be->bd_info;
118 oi = (denyop_info *)ch_malloc(sizeof(denyop_info));
119 memset(oi, 0, sizeof(denyop_info));
120 on->on_bi.bi_private = oi;
134 slap_overinst *on = (slap_overinst *) be->bd_info;
135 denyop_info *oi = (denyop_info *)on->on_bi.bi_private;
137 if ( strcasecmp( argv[0], "denyop" ) == 0 ) {
141 Debug( LDAP_DEBUG_ANY, "%s: line %d: "
142 "operation list missing in "
143 "\"denyop <op-list>\" line.\n",
148 /* The on->on_bi.bi_private pointer can be used for
149 * anything this instance of the overlay needs.
154 char *next = strchr( op, ',' );
161 if ( strcmp( op, "add" ) == 0 ) {
162 oi->do_op[denyop_add] = 1;
164 } else if ( strcmp( op, "bind" ) == 0 ) {
165 oi->do_op[denyop_bind] = 1;
167 } else if ( strcmp( op, "compare" ) == 0 ) {
168 oi->do_op[denyop_compare] = 1;
170 } else if ( strcmp( op, "delete" ) == 0 ) {
171 oi->do_op[denyop_delete] = 1;
173 } else if ( strcmp( op, "extended" ) == 0 ) {
174 oi->do_op[denyop_extended] = 1;
176 } else if ( strcmp( op, "modify" ) == 0 ) {
177 oi->do_op[denyop_modify] = 1;
179 } else if ( strcmp( op, "modrdn" ) == 0 ) {
180 oi->do_op[denyop_modrdn] = 1;
182 } else if ( strcmp( op, "search" ) == 0 ) {
183 oi->do_op[denyop_search] = 1;
185 } else if ( strcmp( op, "unbind" ) == 0 ) {
186 oi->do_op[denyop_unbind] = 1;
189 Debug( LDAP_DEBUG_ANY, "%s: line %d: "
190 "unknown operation \"%s\" at "
191 "\"denyop <op-list>\" line.\n",
200 return SLAP_CONF_UNKNOWN;
210 slap_overinst *on = (slap_overinst *) be->bd_info;
211 denyop_info *oi = (denyop_info *)on->on_bi.bi_private;
220 /* This overlay is set up for dynamic loading via moduleload. For static
221 * configuration, you'll need to arrange for the slap_overinst to be
222 * initialized and registered by some other function inside slapd.
225 static slap_overinst denyop;
228 denyop_initialize( void )
230 memset( &denyop, 0, sizeof( slap_overinst ) );
231 denyop.on_bi.bi_type = "denyop";
232 denyop.on_bi.bi_db_init = denyop_over_init;
233 denyop.on_bi.bi_db_config = denyop_config;
234 denyop.on_bi.bi_db_destroy = denyop_destroy;
236 denyop.on_bi.bi_op_bind = denyop_func;
237 denyop.on_bi.bi_op_search = denyop_func;
238 denyop.on_bi.bi_op_compare = denyop_func;
239 denyop.on_bi.bi_op_modify = denyop_func;
240 denyop.on_bi.bi_op_modrdn = denyop_func;
241 denyop.on_bi.bi_op_add = denyop_func;
242 denyop.on_bi.bi_op_delete = denyop_func;
243 denyop.on_bi.bi_extended = denyop_func;
244 denyop.on_bi.bi_op_unbind = denyop_func;
246 denyop.on_response = NULL /* denyop_response */ ;
248 return overlay_register( &denyop );
251 #if SLAPD_OVER_DENYOP == SLAPD_MOD_DYNAMIC
253 init_module( int argc, char *argv[] )
255 return denyop_initialize();
257 #endif /* SLAPD_OVER_DENYOP == SLAPD_MOD_DYNAMIC */
259 #endif /* defined(SLAPD_OVER_DENYOP) */