1 /* aci.c - routines to parse and check acl's */
3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
5 * Copyright 1998-2008 The OpenLDAP Foundation.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted only as authorized by the OpenLDAP
12 * A copy of this license is available in the file LICENSE in the
13 * top-level directory of the distribution or, alternatively, at
14 * <http://www.OpenLDAP.org/license.html>.
16 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
17 * All rights reserved.
19 * Redistribution and use in source and binary forms are permitted
20 * provided that this notice is preserved and that due credit is given
21 * to the University of Michigan at Ann Arbor. The name of the University
22 * may not be used to endorse or promote products derived from this
23 * software without specific prior written permission. This software
24 * is provided ``as is'' without express or implied warranty.
29 #ifdef SLAPD_ACI_ENABLED
35 #include <ac/socket.h>
36 #include <ac/string.h>
37 #include <ac/unistd.h>
43 /* use most appropriate size */
44 #define ACI_BUF_SIZE 1024
46 /* move to "stable" when no longer experimental */
47 #define SLAPD_ACI_SYNTAX "1.3.6.1.4.1.4203.666.2.1"
49 /* change this to "OpenLDAPset" */
50 #define SLAPD_ACI_SET_ATTR "template"
52 typedef enum slap_aci_scope_t {
53 SLAP_ACI_SCOPE_ENTRY = 0x1,
54 SLAP_ACI_SCOPE_CHILDREN = 0x2,
55 SLAP_ACI_SCOPE_SUBTREE = ( SLAP_ACI_SCOPE_ENTRY | SLAP_ACI_SCOPE_CHILDREN )
91 static const struct berval aci_bv[] = {
100 BER_BVC("[children]"),
104 BER_BVC("access-id"),
119 BER_BVC(SLAPD_GROUP_CLASS),
120 BER_BVC(SLAPD_GROUP_ATTR),
121 BER_BVC(SLAPD_ROLE_CLASS),
122 BER_BVC(SLAPD_ROLE_ATTR),
124 BER_BVC(SLAPD_ACI_SET_ATTR),
129 static AttributeDescription *slap_ad_aci;
134 struct berval *val );
144 OpenLDAPaciNormalize(
152 #define OpenLDAPaciMatch octetStringMatch
156 struct berval *list )
163 for ( i = 0; acl_get_part( list, i, ',', &bv ) >= 0; i++ ) {
164 if ( bv.bv_len <= 0 ) {
168 switch ( *bv.bv_val ) {
170 /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt does not
171 * define any equivalent to the AUTH right, so I've just used
174 ACL_PRIV_SET(mask, ACL_PRIV_AUTH);
177 /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt defines
178 * the right 'd' to mean "delete"; we hijack it to mean
179 * "disclose" for consistency wuith the rest of slapd.
181 ACL_PRIV_SET(mask, ACL_PRIV_DISCLOSE);
184 ACL_PRIV_SET(mask, ACL_PRIV_COMPARE);
187 /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt defines
188 * the right 's' to mean "set", but in the examples states
189 * that the right 's' means "search". The latter definition
192 ACL_PRIV_SET(mask, ACL_PRIV_SEARCH);
195 ACL_PRIV_SET(mask, ACL_PRIV_READ);
198 ACL_PRIV_SET(mask, ACL_PRIV_WRITE);
212 const struct berval *attr,
215 struct berval bv, left, right;
218 for ( i = 0; acl_get_part( list, i, ',', &bv ) >= 0; i++ ) {
219 if ( acl_get_part(&bv, 0, '=', &left ) < 0
220 || acl_get_part( &bv, 1, '=', &right ) < 0 )
222 if ( ber_bvstrcasecmp( attr, &bv ) == 0 ) {
226 } else if ( val == NULL ) {
227 if ( ber_bvstrcasecmp( attr, &left ) == 0 ) {
232 if ( ber_bvstrcasecmp( attr, &left ) == 0 ) {
233 /* FIXME: this is also totally undocumented! */
234 /* this is experimental code that implements a
235 * simple (prefix) match of the attribute value.
236 * the ACI draft does not provide for aci's that
237 * apply to specific values, but it would be
238 * nice to have. If the <attr> part of an aci's
239 * rights list is of the form <attr>=<value>,
240 * that means the aci applies only to attrs with
241 * the given value. Furthermore, if the attr is
242 * of the form <attr>=<value>*, then <value> is
243 * treated as a prefix, and the aci applies to
244 * any value with that prefix.
246 * Ideally, this would allow r.e. matches.
248 if ( acl_get_part( &right, 0, '*', &left ) < 0
249 || right.bv_len <= left.bv_len )
251 if ( ber_bvstrcasecmp( val, &right ) == 0 ) {
255 } else if ( val->bv_len >= left.bv_len ) {
256 if ( strncasecmp( val->bv_val, left.bv_val, left.bv_len ) == 0 ) {
268 aci_list_get_attr_rights(
270 const struct berval *attr,
277 /* loop through each rights/attr pair, skip first part (action) */
279 for ( i = 1; acl_get_part( list, i + 1, ';', &bv ) >= 0; i += 2 ) {
280 if ( aci_list_has_attr( &bv, attr, val ) == 0 ) {
281 Debug( LDAP_DEBUG_ACL,
282 " <= aci_list_get_attr_rights "
283 "test %s for %s -> failed\n",
284 bv.bv_val, attr->bv_val, 0 );
288 Debug( LDAP_DEBUG_ACL,
289 " <= aci_list_get_attr_rights "
290 "test %s for %s -> ok\n",
291 bv.bv_val, attr->bv_val, 0 );
293 if ( acl_get_part( list, i, ';', &bv ) < 0 ) {
294 Debug( LDAP_DEBUG_ACL,
295 " <= aci_list_get_attr_rights "
301 mask |= aci_list_map_rights( &bv );
302 Debug( LDAP_DEBUG_ACL,
303 " <= aci_list_get_attr_rights "
304 "rights %s to mask 0x%x\n",
305 bv.bv_val, mask, 0 );
316 slap_access_t *grant,
317 slap_access_t *deny )
319 struct berval perm, actn, baseattr;
323 if ( attr == NULL || BER_BVISEMPTY( attr ) ) {
324 attr = (struct berval *)&aci_bv[ ACI_BV_ENTRY ];
326 } else if ( acl_get_part( attr, 0, ';', &baseattr ) > 0 ) {
332 /* loop through each permissions clause */
333 for ( i = 0; acl_get_part( list, i, '$', &perm ) >= 0; i++ ) {
334 if ( acl_get_part( &perm, 0, ';', &actn ) < 0 ) {
338 if ( ber_bvstrcasecmp( &aci_bv[ ACI_BV_GRANT ], &actn ) == 0 ) {
341 } else if ( ber_bvstrcasecmp( &aci_bv[ ACI_BV_DENY ], &actn ) == 0 ) {
348 *mask |= aci_list_get_attr_rights( &perm, attr, val );
349 *mask |= aci_list_get_attr_rights( &perm, &aci_bv[ ACI_BV_BR_ALL ], NULL );
351 if ( *mask != ACL_PRIV_NONE ) {
362 const struct berval *defgrpoc,
363 const struct berval *defgrpat,
370 struct berval subjdn;
373 ObjectClass *grp_oc = NULL;
374 AttributeDescription *grp_ad = NULL;
378 /* format of string is "{group|role}/objectClassValue/groupAttrName" */
379 if ( acl_get_part( subj, 0, '/', &subjdn ) < 0 ) {
383 if ( acl_get_part( subj, 1, '/', &grpoc ) < 0 ) {
387 if ( acl_get_part( subj, 2, '/', &grpat ) < 0 ) {
391 rc = slap_bv2ad( &grpat, &grp_ad, &text );
392 if ( rc != LDAP_SUCCESS ) {
398 grp_oc = oc_bvfind( &grpoc );
400 if ( grp_oc != NULL && grp_ad != NULL ) {
401 char buf[ ACI_BUF_SIZE ];
402 struct berval bv, ndn;
404 bv.bv_len = sizeof( buf ) - 1;
405 bv.bv_val = (char *)&buf;
406 if ( acl_string_expand( &bv, &subjdn,
407 e->e_ndn, nmatch, matches ) )
413 if ( dnNormalize( 0, NULL, NULL, &bv, &ndn, op->o_tmpmemctx ) == LDAP_SUCCESS )
415 rc = ( backend_group( op, e, &ndn, &op->o_ndn,
416 grp_oc, grp_ad ) == 0 );
417 slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
429 AttributeDescription *desc,
434 slap_access_t *grant,
436 slap_aci_scope_t asserted_scope )
449 assert( !BER_BVISNULL( &desc->ad_cname ) );
451 /* parse an aci of the form:
452 oid # scope # action;rights;attr;rights;attr
453 $ action;rights;attr;rights;attr # type # subject
455 [NOTE: the following comment is very outdated,
456 as the draft version it refers to (Ando, 2004-11-20)].
458 See draft-ietf-ldapext-aci-model-04.txt section 9.1 for
459 a full description of the format for this attribute.
460 Differences: "this" in the draft is "self" here, and
461 "self" and "public" is in the position of type.
463 <scope> = {entry|children|subtree}
464 <type> = {public|users|access-id|subtree|onelevel|children|
465 self|dnattr|group|role|set|set-ref}
467 This routine now supports scope={ENTRY,CHILDREN}
469 - ENTRY applies to "entry" and "subtree";
470 - CHILDREN applies to "children" and "subtree"
473 /* check that the aci has all 5 components */
474 if ( acl_get_part( aci, 4, '#', NULL ) < 0 ) {
478 /* check that the aci family is supported */
479 /* FIXME: the OID is ignored? */
480 if ( acl_get_part( aci, 0, '#', &bv ) < 0 ) {
484 /* check that the scope matches */
485 if ( acl_get_part( aci, 1, '#', &scope ) < 0 ) {
489 /* note: scope can be either ENTRY or CHILDREN;
490 * they respectively match "entry" and "children" in bv
491 * both match "subtree" */
492 switch ( asserted_scope ) {
493 case SLAP_ACI_SCOPE_ENTRY:
494 if ( ber_bvcmp( &scope, &aci_bv[ ACI_BV_ENTRY ] ) != 0
495 && ber_bvstrcasecmp( &scope, &aci_bv[ ACI_BV_SUBTREE ] ) != 0 )
501 case SLAP_ACI_SCOPE_CHILDREN:
502 if ( ber_bvcmp( &scope, &aci_bv[ ACI_BV_CHILDREN ] ) != 0
503 && ber_bvstrcasecmp( &scope, &aci_bv[ ACI_BV_SUBTREE ] ) != 0 )
509 case SLAP_ACI_SCOPE_SUBTREE:
510 /* TODO: add assertion? */
514 /* get the list of permissions clauses, bail if empty */
515 if ( acl_get_part( aci, 2, '#', &perms ) <= 0 ) {
520 /* check if any permissions allow desired access */
521 if ( aci_list_get_rights( &perms, &desc->ad_cname, val, grant, deny ) == 0 ) {
525 /* see if we have a DN match */
526 if ( acl_get_part( aci, 3, '#', &type ) < 0 ) {
531 /* see if we have a public (i.e. anonymous) access */
532 if ( ber_bvcmp( &aci_bv[ ACI_BV_PUBLIC ], &type ) == 0 ) {
536 /* otherwise require an identity */
537 if ( BER_BVISNULL( &op->o_ndn ) || BER_BVISEMPTY( &op->o_ndn ) ) {
541 /* see if we have a users access */
542 if ( ber_bvcmp( &aci_bv[ ACI_BV_USERS ], &type ) == 0 ) {
546 /* NOTE: this may fail if a DN contains a valid '#' (unescaped);
547 * just grab all the berval up to its end (ITS#3303).
548 * NOTE: the problem could be solved by providing the DN with
549 * the embedded '#' encoded as hexpairs: "cn=Foo#Bar" would
550 * become "cn=Foo\23Bar" and be safely used by aci_mask(). */
552 if ( acl_get_part( aci, 4, '#', &sdn ) < 0 ) {
556 sdn.bv_val = type.bv_val + type.bv_len + STRLENOF( "#" );
557 sdn.bv_len = aci->bv_len - ( sdn.bv_val - aci->bv_val );
559 /* get the type options, if any */
560 if ( acl_get_part( &type, 1, '/', &opts ) > 0 ) {
561 opts.bv_len = type.bv_len - ( opts.bv_val - type.bv_val );
562 type.bv_len = opts.bv_val - type.bv_val - 1;
568 if ( ber_bvcmp( &aci_bv[ ACI_BV_ACCESS_ID ], &type ) == 0 ) {
569 return dn_match( &op->o_ndn, &sdn );
571 } else if ( ber_bvcmp( &aci_bv[ ACI_BV_SUBTREE ], &type ) == 0 ) {
572 return dnIsSuffix( &op->o_ndn, &sdn );
574 } else if ( ber_bvcmp( &aci_bv[ ACI_BV_ONELEVEL ], &type ) == 0 ) {
577 dnParent( &sdn, &pdn );
579 return dn_match( &op->o_ndn, &pdn );
581 } else if ( ber_bvcmp( &aci_bv[ ACI_BV_CHILDREN ], &type ) == 0 ) {
582 return ( !dn_match( &op->o_ndn, &sdn ) && dnIsSuffix( &op->o_ndn, &sdn ) );
584 } else if ( ber_bvcmp( &aci_bv[ ACI_BV_SELF ], &type ) == 0 ) {
585 return dn_match( &op->o_ndn, &e->e_nname );
587 } else if ( ber_bvcmp( &aci_bv[ ACI_BV_DNATTR ], &type ) == 0 ) {
589 AttributeDescription *ad = NULL;
592 rc = slap_bv2ad( &sdn, &ad, &text );
593 assert( rc == LDAP_SUCCESS );
596 for ( at = attrs_find( e->e_attrs, ad );
598 at = attrs_find( at->a_next, ad ) )
600 if ( attr_valfind( at,
601 SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH |
602 SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH,
603 &op->o_ndn, NULL, op->o_tmpmemctx ) == 0 )
612 } else if ( ber_bvcmp( &aci_bv[ ACI_BV_GROUP ], &type ) == 0 ) {
616 if ( BER_BVISNULL( &opts ) ) {
617 oc = aci_bv[ ACI_BV_GROUP_CLASS ];
618 at = aci_bv[ ACI_BV_GROUP_ATTR ];
621 if ( acl_get_part( &opts, 0, '/', &oc ) < 0 ) {
625 if ( acl_get_part( &opts, 1, '/', &at ) < 0 ) {
626 at = aci_bv[ ACI_BV_GROUP_ATTR ];
630 if ( aci_group_member( &sdn, &oc, &at, op, e, nmatch, matches ) )
635 } else if ( ber_bvcmp( &aci_bv[ ACI_BV_ROLE ], &type ) == 0 ) {
639 if ( BER_BVISNULL( &opts ) ) {
640 oc = aci_bv[ ACI_BV_ROLE_CLASS ];
641 at = aci_bv[ ACI_BV_ROLE_ATTR ];
644 if ( acl_get_part( &opts, 0, '/', &oc ) < 0 ) {
648 if ( acl_get_part( &opts, 1, '/', &at ) < 0 ) {
649 at = aci_bv[ ACI_BV_ROLE_ATTR ];
653 if ( aci_group_member( &sdn, &oc, &at, op, e, nmatch, matches ) )
658 } else if ( ber_bvcmp( &aci_bv[ ACI_BV_SET ], &type ) == 0 ) {
659 if ( acl_match_set( &sdn, op, e, NULL ) ) {
663 } else if ( ber_bvcmp( &aci_bv[ ACI_BV_SET_REF ], &type ) == 0 ) {
664 if ( acl_match_set( &sdn, op, e, (struct berval *)&aci_bv[ ACI_BV_SET_ATTR ] ) ) {
669 /* it passed normalization! */
679 /* OpenLDAP eXperimental Syntax */
680 static slap_syntax_defs_rec aci_syntax_def = {
681 "( 1.3.6.1.4.1.4203.666.2.1 DESC 'OpenLDAP Experimental ACI' )",
687 static slap_mrule_defs_rec aci_mr_def = {
688 "( 1.3.6.1.4.1.4203.666.4.2 NAME 'OpenLDAPaciMatch' "
689 "SYNTAX 1.3.6.1.4.1.4203.666.2.1 )",
690 SLAP_MR_HIDE | SLAP_MR_EQUALITY, NULL,
691 NULL, OpenLDAPaciNormalize, OpenLDAPaciMatch,
699 AttributeDescription **ad;
701 "OpenLDAPaci", "( 1.3.6.1.4.1.4203.666.1.5 "
702 "NAME 'OpenLDAPaci' "
703 "DESC 'OpenLDAP access control information (experimental)' "
704 "EQUALITY OpenLDAPaciMatch "
705 "SYNTAX 1.3.6.1.4.1.4203.666.2.1 "
706 "USAGE directoryOperation )",
714 rc = register_syntax( &aci_syntax_def );
719 /* ACI equality rule */
720 rc = register_matching_rule( &aci_mr_def );
726 rc = register_at( aci_at.desc, aci_at.ad, 0 );
727 if ( rc != LDAP_SUCCESS ) {
728 Debug( LDAP_DEBUG_ANY,
729 "aci_init: at_register failed\n", 0, 0, 0 );
734 (*aci_at.ad)->ad_type->sat_flags |= aci_at.flags;
748 AttributeDescription *ad = NULL;
749 const char *text = NULL;
751 if ( sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE ) {
752 fprintf( stderr, "%s: line %d: "
753 "inappropriate style \"%s\" in \"aci\" by clause\n",
754 fname, lineno, style_strings[sty] );
758 if ( right != NULL && *right != '\0' ) {
759 if ( slap_str2ad( right, &ad, &text ) != LDAP_SUCCESS ) {
761 "%s: line %d: aci \"%s\": %s\n",
762 fname, lineno, right, text );
770 if ( !is_at_syntax( ad->ad_type, SLAPD_ACI_SYNTAX) ) {
771 fprintf( stderr, "%s: line %d: "
772 "aci \"%s\": inappropriate syntax: %s\n",
773 fname, lineno, right,
774 ad->ad_type->sat_syntax_oid );
784 dynacl_aci_unparse( void *priv, struct berval *bv )
786 AttributeDescription *ad = ( AttributeDescription * )priv;
789 assert( ad != NULL );
791 bv->bv_val = ch_malloc( STRLENOF(" aci=") + ad->ad_cname.bv_len + 1 );
792 ptr = lutil_strcopy( bv->bv_val, " aci=" );
793 ptr = lutil_strcopy( ptr, ad->ad_cname.bv_val );
794 bv->bv_len = ptr - bv->bv_val;
804 AttributeDescription *desc,
808 slap_access_t *grantp,
809 slap_access_t *denyp )
811 AttributeDescription *ad = ( AttributeDescription * )priv;
813 slap_access_t tgrant, tdeny, grant, deny;
815 char accessmaskbuf[ACCESSMASK_MAXLEN];
816 char accessmaskbuf1[ACCESSMASK_MAXLEN];
817 #endif /* LDAP_DEBUG */
819 if ( BER_BVISEMPTY( &e->e_nname ) ) {
820 /* no ACIs in the root DSE */
824 /* start out with nothing granted, nothing denied */
828 /* get the aci attribute */
829 at = attr_find( e->e_attrs, ad );
833 /* the aci is an multi-valued attribute. The
834 * rights are determined by OR'ing the individual
835 * rights given by the acis.
837 for ( i = 0; !BER_BVISNULL( &at->a_nvals[i] ); i++ ) {
838 if ( aci_mask( op, e, desc, val, &at->a_nvals[i],
839 nmatch, matches, &grant, &deny,
840 SLAP_ACI_SCOPE_ENTRY ) != 0 )
847 Debug( LDAP_DEBUG_ACL, " <= aci_mask grant %s deny %s\n",
848 accessmask2str( tgrant, accessmaskbuf, 1 ),
849 accessmask2str( tdeny, accessmaskbuf1, 1 ), 0 );
852 /* If the entry level aci didn't contain anything valid for the
853 * current operation, climb up the tree and evaluate the
854 * acis with scope set to subtree
856 if ( tgrant == ACL_PRIV_NONE && tdeny == ACL_PRIV_NONE ) {
857 struct berval parent_ndn;
859 dnParent( &e->e_nname, &parent_ndn );
860 while ( !BER_BVISEMPTY( &parent_ndn ) ){
862 BerVarray bvals = NULL;
865 /* to solve the chicken'n'egg problem of accessing
866 * the OpenLDAPaci attribute, the direct access
867 * to the entry's attribute is unchecked; however,
868 * further accesses to OpenLDAPaci values in the
869 * ancestors occur through backend_attribute(), i.e.
870 * with the identity of the operation, requiring
871 * further access checking. For uniformity, this
872 * makes further requests occur as the rootdn, if
873 * any, i.e. searching for the OpenLDAPaci attribute
874 * is considered an internal search. If this is not
875 * acceptable, then the same check needs be performed
876 * when accessing the entry's attribute. */
877 struct berval save_o_dn, save_o_ndn;
879 if ( !BER_BVISNULL( &op->o_bd->be_rootndn ) ) {
880 save_o_dn = op->o_dn;
881 save_o_ndn = op->o_ndn;
883 op->o_dn = op->o_bd->be_rootdn;
884 op->o_ndn = op->o_bd->be_rootndn;
887 Debug( LDAP_DEBUG_ACL, " checking ACI of \"%s\"\n", parent_ndn.bv_val, 0, 0 );
888 ret = backend_attribute( op, NULL, &parent_ndn, ad, &bvals, ACL_AUTH );
890 if ( !BER_BVISNULL( &op->o_bd->be_rootndn ) ) {
891 op->o_dn = save_o_dn;
892 op->o_ndn = save_o_ndn;
902 for ( i = 0; !BER_BVISNULL( &bvals[i] ); i++ ) {
903 if ( aci_mask( op, e, desc, val,
907 SLAP_ACI_SCOPE_CHILDREN ) != 0 )
911 /* evaluation stops as soon as either a "deny" or a
912 * "grant" directive matches.
914 if ( tgrant != ACL_PRIV_NONE || tdeny != ACL_PRIV_NONE ) {
918 Debug( LDAP_DEBUG_ACL, "<= aci_mask grant %s deny %s\n",
919 accessmask2str( tgrant, accessmaskbuf, 1 ),
920 accessmask2str( tdeny, accessmaskbuf1, 1 ), 0 );
924 case LDAP_NO_SUCH_ATTRIBUTE:
925 /* just go on if the aci-Attribute is not present in
928 Debug( LDAP_DEBUG_ACL, "no such attribute\n", 0, 0, 0 );
932 case LDAP_NO_SUCH_OBJECT:
933 /* We have reached the base object */
934 Debug( LDAP_DEBUG_ACL, "no such object\n", 0, 0, 0 );
946 dnParent( &parent_ndn, &parent_ndn );
956 /* need to register this at some point */
957 static slap_dynacl_t dynacl_aci = {
968 dynacl_aci_init( void )
975 rc = slap_dynacl_register( &dynacl_aci );
982 /* ACI syntax validation */
985 * Matches given berval to array of bervals
987 * >=0 if one if the array elements equals to this berval
988 * -1 if string was not found in array
993 const struct berval *arr[] )
997 if ( BER_BVISEMPTY( bv ) ) {
1001 for ( i = 0; arr[ i ] != NULL ; i++ ) {
1002 if ( ber_bvstrcasecmp( bv, arr[ i ] ) == 0 ) {
1011 /* Returns what have left in input berval after current sub */
1016 struct berval *tail )
1020 tail->bv_val = sub->bv_val + sub->bv_len;
1021 head_len = (unsigned long) tail->bv_val - (unsigned long) val->bv_val;
1022 tail->bv_len = val->bv_len - head_len;
1027 * aci is accepted in following form:
1028 * oid#scope#rights#type#subject
1030 * oid := numeric OID (currently ignored)
1031 * scope := entry|children|subtree
1032 * rights := right[[$right]...]
1033 * right := (grant|deny);action
1034 * action := perms;attrs[[;perms;attrs]...]
1035 * perms := perm[[,perm]...]
1037 * attrs := attribute[[,attribute]..]|"[all]"
1038 * attribute := attributeType|attributeType=attributeValue|attributeType=attributeValuePrefix*
1039 * type := public|users|self|dnattr|group|role|set|set-ref|
1040 * access_id|subtree|onelevel|children
1043 OpenLDAPaciValidatePerms(
1044 struct berval *perms )
1048 for ( i = 0; i < perms->bv_len; ) {
1049 switch ( perms->bv_val[ i ] ) {
1059 Debug( LDAP_DEBUG_ACL, "aciValidatePerms: perms needs to be one of x,d,c,s,r,w in '%s'\n", perms->bv_val, 0, 0 );
1060 return LDAP_INVALID_SYNTAX;
1063 if ( ++i == perms->bv_len ) {
1064 return LDAP_SUCCESS;
1067 while ( i < perms->bv_len && perms->bv_val[ i ] == ' ' )
1070 assert( i != perms->bv_len );
1072 if ( perms->bv_val[ i ] != ',' ) {
1073 Debug( LDAP_DEBUG_ACL, "aciValidatePerms: missing comma in '%s'\n", perms->bv_val, 0, 0 );
1074 return LDAP_INVALID_SYNTAX;
1079 } while ( perms->bv_val[ i ] == ' ' );
1082 return LDAP_SUCCESS;
1085 static const struct berval *ACIgrantdeny[] = {
1086 &aci_bv[ ACI_BV_GRANT ],
1087 &aci_bv[ ACI_BV_DENY ],
1092 OpenLDAPaciValidateRight(
1093 struct berval *action )
1095 struct berval bv = BER_BVNULL;
1099 if ( acl_get_part( action, 0, ';', &bv ) < 0 ||
1100 bv_getcaseidx( &bv, ACIgrantdeny ) == -1 )
1102 Debug( LDAP_DEBUG_ACL, "aciValidateRight: '%s' must be either 'grant' or 'deny'\n", bv.bv_val, 0, 0 );
1103 return LDAP_INVALID_SYNTAX;
1106 for ( i = 0; acl_get_part( action, i + 1, ';', &bv ) >= 0; i++ ) {
1109 if ( OpenLDAPaciValidatePerms( &bv ) != LDAP_SUCCESS )
1111 return LDAP_INVALID_SYNTAX;
1116 AttributeDescription *ad;
1118 struct berval attr, left, right;
1121 /* could be "[all]" or an attribute description */
1122 if ( ber_bvstrcasecmp( &bv, &aci_bv[ ACI_BV_BR_ALL ] ) == 0 ) {
1127 for ( j = 0; acl_get_part( &bv, j, ',', &attr ) >= 0; j++ )
1131 if ( acl_get_part( &attr, 0, '=', &left ) < 0
1132 || acl_get_part( &attr, 1, '=', &right ) < 0 )
1134 if ( slap_bv2ad( &attr, &ad, &text ) != LDAP_SUCCESS )
1136 Debug( LDAP_DEBUG_ACL, "aciValidateRight: unknown attribute: '%s'\n", attr.bv_val, 0, 0 );
1137 return LDAP_INVALID_SYNTAX;
1140 if ( slap_bv2ad( &left, &ad, &text ) != LDAP_SUCCESS )
1142 Debug( LDAP_DEBUG_ACL, "aciValidateRight: unknown attribute: '%s'\n", left.bv_val, 0, 0 );
1143 return LDAP_INVALID_SYNTAX;
1150 /* "perms;attr" go in pairs */
1151 if ( i > 0 && ( i & 1 ) == 0 ) {
1152 return LDAP_SUCCESS;
1155 Debug( LDAP_DEBUG_ACL, "aciValidateRight: perms:attr need to be pairs in '%s'\n", action->bv_val, 0, 0 );
1156 return LDAP_INVALID_SYNTAX;
1159 return LDAP_SUCCESS;
1163 OpenLDAPaciNormalizeRight(
1164 struct berval *action,
1165 struct berval *naction,
1168 struct berval grantdeny,
1175 if ( acl_get_part( action, 0, ';', &grantdeny ) < 0 ) {
1176 Debug( LDAP_DEBUG_ACL, "aciNormalizeRight: missing ';' in '%s'\n", action->bv_val, 0, 0 );
1177 return LDAP_INVALID_SYNTAX;
1179 idx = bv_getcaseidx( &grantdeny, ACIgrantdeny );
1181 Debug( LDAP_DEBUG_ACL, "aciNormalizeRight: '%s' must be grant or deny\n", grantdeny.bv_val, 0, 0 );
1182 return LDAP_INVALID_SYNTAX;
1185 ber_dupbv_x( naction, (struct berval *)ACIgrantdeny[ idx ], ctx );
1187 for ( i = 1; acl_get_part( action, i, ';', &bv ) >= 0; i++ ) {
1188 struct berval nattrs = BER_BVNULL;
1192 if ( OpenLDAPaciValidatePerms( &bv ) != LDAP_SUCCESS )
1194 return LDAP_INVALID_SYNTAX;
1202 /* could be "[all]" or an attribute description */
1203 if ( ber_bvstrcasecmp( &bv, &aci_bv[ ACI_BV_BR_ALL ] ) == 0 ) {
1204 nattrs = aci_bv[ ACI_BV_BR_ALL ];
1208 AttributeDescription *ad = NULL;
1209 AttributeDescription adstatic= { 0 };
1210 const char *text = NULL;
1211 struct berval attr, left, right;
1215 for ( j = 0; acl_get_part( &bv, j, ',', &attr ) >= 0; j++ )
1219 /* openldap 2.1 aci compabitibility [entry] -> entry */
1220 if ( ber_bvstrcasecmp( &attr, &aci_bv[ ACI_BV_BR_ENTRY ] ) == 0 ) {
1222 adstatic.ad_cname = aci_bv[ ACI_BV_ENTRY ];
1224 /* openldap 2.1 aci compabitibility [children] -> children */
1225 } else if ( ber_bvstrcasecmp( &attr, &aci_bv[ ACI_BV_BR_CHILDREN ] ) == 0 ) {
1227 adstatic.ad_cname = aci_bv[ ACI_BV_CHILDREN ];
1229 /* openldap 2.1 aci compabitibility [all] -> only [all] */
1230 } else if ( ber_bvstrcasecmp( &attr, &aci_bv[ ACI_BV_BR_ALL ] ) == 0 ) {
1231 ber_memfree_x( nattrs.bv_val, ctx );
1232 nattrs = aci_bv[ ACI_BV_BR_ALL ];
1236 } else if ( acl_get_part( &attr, 0, '=', &left ) < 0
1237 || acl_get_part( &attr, 1, '=', &right ) < 0 )
1239 if ( slap_bv2ad( &attr, &ad, &text ) != LDAP_SUCCESS )
1241 ber_memfree_x( nattrs.bv_val, ctx );
1242 Debug( LDAP_DEBUG_ACL, "aciNormalizeRight: unknown attribute: '%s'\n", attr.bv_val, 0, 0 );
1243 return LDAP_INVALID_SYNTAX;
1247 if ( slap_bv2ad( &left, &ad, &text ) != LDAP_SUCCESS )
1249 ber_memfree_x( nattrs.bv_val, ctx );
1250 Debug( LDAP_DEBUG_ACL, "aciNormalizeRight: unknown attribute: '%s'\n", left.bv_val, 0, 0 );
1251 return LDAP_INVALID_SYNTAX;
1256 len = nattrs.bv_len + ( !BER_BVISEMPTY( &nattrs ) ? STRLENOF( "," ) : 0 )
1257 + ad->ad_cname.bv_len;
1258 nattrs.bv_val = ber_memrealloc_x( nattrs.bv_val, len + 1, ctx );
1259 ptr = &nattrs.bv_val[ nattrs.bv_len ];
1260 if ( !BER_BVISEMPTY( &nattrs ) ) {
1263 ptr = lutil_strncopy( ptr, ad->ad_cname.bv_val, ad->ad_cname.bv_len );
1265 nattrs.bv_len = len;
1270 naction->bv_val = ber_memrealloc_x( naction->bv_val,
1271 naction->bv_len + STRLENOF( ";" )
1272 + perms.bv_len + STRLENOF( ";" )
1273 + nattrs.bv_len + 1,
1276 ptr = &naction->bv_val[ naction->bv_len ];
1279 ptr = lutil_strncopy( ptr, perms.bv_val, perms.bv_len );
1282 ptr = lutil_strncopy( ptr, nattrs.bv_val, nattrs.bv_len );
1284 naction->bv_len += STRLENOF( ";" ) + perms.bv_len
1285 + STRLENOF( ";" ) + nattrs.bv_len;
1287 ber_memfree_x( nattrs.bv_val, ctx );
1292 /* perms;attr go in pairs */
1293 if ( i > 1 && ( i & 1 ) ) {
1294 return LDAP_SUCCESS;
1297 Debug( LDAP_DEBUG_ACL, "aciNormalizeRight: perms:attr need to be pairs in '%s'\n", action->bv_val, 0, 0 );
1298 return LDAP_INVALID_SYNTAX;
1303 OpenLDAPaciValidateRights(
1304 struct berval *actions )
1307 struct berval bv = BER_BVNULL;
1310 for ( i = 0; acl_get_part( actions, i, '$', &bv ) >= 0; i++ ) {
1311 if ( OpenLDAPaciValidateRight( &bv ) != LDAP_SUCCESS ) {
1312 return LDAP_INVALID_SYNTAX;
1316 return LDAP_SUCCESS;
1320 OpenLDAPaciNormalizeRights(
1321 struct berval *actions,
1322 struct berval *nactions,
1326 struct berval bv = BER_BVNULL;
1329 BER_BVZERO( nactions );
1330 for ( i = 0; acl_get_part( actions, i, '$', &bv ) >= 0; i++ ) {
1334 rc = OpenLDAPaciNormalizeRight( &bv, &nbv, ctx );
1335 if ( rc != LDAP_SUCCESS ) {
1336 ber_memfree_x( nactions->bv_val, ctx );
1337 BER_BVZERO( nactions );
1338 return LDAP_INVALID_SYNTAX;
1345 nactions->bv_val = ber_memrealloc_x( nactions->bv_val,
1346 nactions->bv_len + STRLENOF( "$" )
1349 nactions->bv_val[ nactions->bv_len ] = '$';
1350 AC_MEMCPY( &nactions->bv_val[ nactions->bv_len + 1 ],
1351 nbv.bv_val, nbv.bv_len + 1 );
1352 ber_memfree_x( nbv.bv_val, ctx );
1353 nactions->bv_len += STRLENOF( "$" ) + nbv.bv_len;
1358 return LDAP_SUCCESS;
1361 static const struct berval *OpenLDAPaciscopes[] = {
1362 &aci_bv[ ACI_BV_ENTRY ],
1363 &aci_bv[ ACI_BV_CHILDREN ],
1364 &aci_bv[ ACI_BV_SUBTREE ],
1369 static const struct berval *OpenLDAPacitypes[] = {
1371 &aci_bv[ ACI_BV_GROUP ],
1372 &aci_bv[ ACI_BV_ROLE ],
1374 /* set to one past the last DN-valued type with options (/) */
1375 #define LAST_OPTIONAL 2
1377 &aci_bv[ ACI_BV_ACCESS_ID ],
1378 &aci_bv[ ACI_BV_SUBTREE ],
1379 &aci_bv[ ACI_BV_ONELEVEL ],
1380 &aci_bv[ ACI_BV_CHILDREN ],
1382 /* set to one past the last DN-valued type */
1383 #define LAST_DNVALUED 6
1386 &aci_bv[ ACI_BV_DNATTR ],
1387 &aci_bv[ ACI_BV_PUBLIC ],
1388 &aci_bv[ ACI_BV_USERS ],
1389 &aci_bv[ ACI_BV_SELF ],
1390 &aci_bv[ ACI_BV_SET ],
1391 &aci_bv[ ACI_BV_SET_REF ],
1397 OpenLDAPaciValidate(
1399 struct berval *val )
1401 struct berval oid = BER_BVNULL,
1403 rights = BER_BVNULL,
1405 subject = BER_BVNULL;
1409 if ( BER_BVISEMPTY( val ) ) {
1410 Debug( LDAP_DEBUG_ACL, "aciValidatet: value is empty\n", 0, 0, 0 );
1411 return LDAP_INVALID_SYNTAX;
1415 if ( acl_get_part( val, 0, '#', &oid ) < 0 ||
1416 numericoidValidate( NULL, &oid ) != LDAP_SUCCESS )
1418 /* NOTE: the numericoidValidate() is rather pedantic;
1419 * I'd replace it with X-ORDERED VALUES so that
1420 * it's guaranteed values are maintained and used
1421 * in the desired order */
1422 Debug( LDAP_DEBUG_ACL, "aciValidate: invalid oid '%s'\n", oid.bv_val, 0, 0 );
1423 return LDAP_INVALID_SYNTAX;
1427 if ( acl_get_part( val, 1, '#', &scope ) < 0 ||
1428 bv_getcaseidx( &scope, OpenLDAPaciscopes ) == -1 )
1430 Debug( LDAP_DEBUG_ACL, "aciValidate: invalid scope '%s'\n", scope.bv_val, 0, 0 );
1431 return LDAP_INVALID_SYNTAX;
1435 if ( acl_get_part( val, 2, '#', &rights ) < 0 ||
1436 OpenLDAPaciValidateRights( &rights ) != LDAP_SUCCESS )
1438 return LDAP_INVALID_SYNTAX;
1442 if ( acl_get_part( val, 3, '#', &type ) < 0 ) {
1443 Debug( LDAP_DEBUG_ACL, "aciValidate: missing type in '%s'\n", val->bv_val, 0, 0 );
1444 return LDAP_INVALID_SYNTAX;
1446 idx = bv_getcaseidx( &type, OpenLDAPacitypes );
1450 if ( acl_get_part( &type, 0, '/', &isgr ) < 0 ) {
1451 Debug( LDAP_DEBUG_ACL, "aciValidate: invalid type '%s'\n", type.bv_val, 0, 0 );
1452 return LDAP_INVALID_SYNTAX;
1455 idx = bv_getcaseidx( &isgr, OpenLDAPacitypes );
1456 if ( idx == -1 || idx >= LAST_OPTIONAL ) {
1457 Debug( LDAP_DEBUG_ACL, "aciValidate: invalid type '%s'\n", isgr.bv_val, 0, 0 );
1458 return LDAP_INVALID_SYNTAX;
1463 bv_get_tail( val, &type, &subject );
1464 if ( subject.bv_val[ 0 ] != '#' ) {
1465 Debug( LDAP_DEBUG_ACL, "aciValidate: missing subject in '%s'\n", val->bv_val, 0, 0 );
1466 return LDAP_INVALID_SYNTAX;
1469 if ( idx >= LAST_DNVALUED ) {
1470 if ( OpenLDAPacitypes[ idx ] == &aci_bv[ ACI_BV_DNATTR ] ) {
1471 AttributeDescription *ad = NULL;
1472 const char *text = NULL;
1474 rc = slap_bv2ad( &subject, &ad, &text );
1475 if ( rc != LDAP_SUCCESS ) {
1476 Debug( LDAP_DEBUG_ACL, "aciValidate: unknown dn attribute '%s'\n", subject.bv_val, 0, 0 );
1477 return LDAP_INVALID_SYNTAX;
1480 if ( ad->ad_type->sat_syntax != slap_schema.si_syn_distinguishedName ) {
1481 /* FIXME: allow nameAndOptionalUID? */
1482 Debug( LDAP_DEBUG_ACL, "aciValidate: wrong syntax for dn attribute '%s'\n", subject.bv_val, 0, 0 );
1483 return LDAP_INVALID_SYNTAX;
1488 return LDAP_SUCCESS;
1490 } else if ( OpenLDAPacitypes[ idx ] == &aci_bv[ ACI_BV_GROUP ]
1491 || OpenLDAPacitypes[ idx ] == &aci_bv[ ACI_BV_ROLE ] )
1493 /* do {group|role}/oc/at check */
1494 struct berval ocbv = BER_BVNULL,
1497 ocbv.bv_val = ber_bvchr( &type, '/' );
1498 if ( ocbv.bv_val != NULL ) {
1500 ocbv.bv_len = type.bv_len
1501 - ( ocbv.bv_val - type.bv_val );
1503 atbv.bv_val = ber_bvchr( &ocbv, '/' );
1504 if ( atbv.bv_val != NULL ) {
1505 AttributeDescription *ad = NULL;
1506 const char *text = NULL;
1510 atbv.bv_len = type.bv_len
1511 - ( atbv.bv_val - type.bv_val );
1512 ocbv.bv_len = atbv.bv_val - ocbv.bv_val - 1;
1514 rc = slap_bv2ad( &atbv, &ad, &text );
1515 if ( rc != LDAP_SUCCESS ) {
1516 Debug( LDAP_DEBUG_ACL, "aciValidate: unknown group attribute '%s'\n", atbv.bv_val, 0, 0 );
1517 return LDAP_INVALID_SYNTAX;
1521 if ( oc_bvfind( &ocbv ) == NULL ) {
1522 Debug( LDAP_DEBUG_ACL, "aciValidate: unknown group '%s'\n", ocbv.bv_val, 0, 0 );
1523 return LDAP_INVALID_SYNTAX;
1528 if ( BER_BVISEMPTY( &subject ) ) {
1529 /* empty DN invalid */
1530 Debug( LDAP_DEBUG_ACL, "aciValidate: missing dn in '%s'\n", val->bv_val, 0, 0 );
1531 return LDAP_INVALID_SYNTAX;
1537 /* FIXME: pass DN syntax? */
1538 rc = dnValidate( NULL, &subject );
1539 if ( rc != LDAP_SUCCESS ) {
1540 Debug( LDAP_DEBUG_ACL, "aciValidate: invalid dn '%s'\n", subject.bv_val, 0, 0 );
1546 OpenLDAPaciPrettyNormal(
1552 struct berval oid = BER_BVNULL,
1554 rights = BER_BVNULL,
1555 nrights = BER_BVNULL,
1558 subject = BER_BVNULL,
1559 nsubject = BER_BVNULL;
1568 if ( BER_BVISEMPTY( val ) ) {
1569 Debug( LDAP_DEBUG_ACL, "aciPrettyNormal: value is empty\n", 0, 0, 0 );
1570 return LDAP_INVALID_SYNTAX;
1573 /* oid: if valid, it's already normalized */
1574 if ( acl_get_part( val, 0, '#', &oid ) < 0 ||
1575 numericoidValidate( NULL, &oid ) != LDAP_SUCCESS )
1577 Debug( LDAP_DEBUG_ACL, "aciPrettyNormal: invalid oid '%s'\n", oid.bv_val, 0, 0 );
1578 return LDAP_INVALID_SYNTAX;
1581 /* scope: normalize by replacing with OpenLDAPaciscopes */
1582 if ( acl_get_part( val, 1, '#', &scope ) < 0 ) {
1583 Debug( LDAP_DEBUG_ACL, "aciPrettyNormal: missing scope in '%s'\n", val->bv_val, 0, 0 );
1584 return LDAP_INVALID_SYNTAX;
1586 idx = bv_getcaseidx( &scope, OpenLDAPaciscopes );
1588 Debug( LDAP_DEBUG_ACL, "aciPrettyNormal: invalid scope '%s'\n", scope.bv_val, 0, 0 );
1589 return LDAP_INVALID_SYNTAX;
1591 scope = *OpenLDAPaciscopes[ idx ];
1594 if ( acl_get_part( val, 2, '#', &rights ) < 0 ) {
1595 Debug( LDAP_DEBUG_ACL, "aciPrettyNormal: missing rights in '%s'\n", val->bv_val, 0, 0 );
1596 return LDAP_INVALID_SYNTAX;
1598 if ( OpenLDAPaciNormalizeRights( &rights, &nrights, ctx )
1601 return LDAP_INVALID_SYNTAX;
1605 if ( acl_get_part( val, 3, '#', &type ) < 0 ) {
1606 Debug( LDAP_DEBUG_ACL, "aciPrettyNormal: missing type in '%s'\n", val->bv_val, 0, 0 );
1607 rc = LDAP_INVALID_SYNTAX;
1610 idx = bv_getcaseidx( &type, OpenLDAPacitypes );
1614 if ( acl_get_part( &type, 0, '/', &isgr ) < 0 ) {
1615 Debug( LDAP_DEBUG_ACL, "aciPrettyNormal: invalid type '%s'\n", type.bv_val, 0, 0 );
1616 rc = LDAP_INVALID_SYNTAX;
1620 idx = bv_getcaseidx( &isgr, OpenLDAPacitypes );
1621 if ( idx == -1 || idx >= LAST_OPTIONAL ) {
1622 Debug( LDAP_DEBUG_ACL, "aciPrettyNormal: invalid type '%s'\n", isgr.bv_val, 0, 0 );
1623 rc = LDAP_INVALID_SYNTAX;
1627 ntype = *OpenLDAPacitypes[ idx ];
1630 bv_get_tail( val, &type, &subject );
1632 if ( BER_BVISEMPTY( &subject ) || subject.bv_val[ 0 ] != '#' ) {
1633 Debug( LDAP_DEBUG_ACL, "aciPrettyNormal: missing subject in '%s'\n", val->bv_val, 0, 0 );
1634 rc = LDAP_INVALID_SYNTAX;
1641 if ( idx < LAST_DNVALUED ) {
1642 /* FIXME: pass DN syntax? */
1644 rc = dnNormalize( 0, NULL, NULL,
1645 &subject, &nsubject, ctx );
1647 rc = dnPretty( NULL, &subject, &nsubject, ctx );
1650 if ( rc == LDAP_SUCCESS ) {
1654 Debug( LDAP_DEBUG_ACL, "aciPrettyNormal: invalid subject dn '%s'\n", subject.bv_val, 0, 0 );
1658 if ( OpenLDAPacitypes[ idx ] == &aci_bv[ ACI_BV_GROUP ]
1659 || OpenLDAPacitypes[ idx ] == &aci_bv[ ACI_BV_ROLE ] )
1661 /* do {group|role}/oc/at check */
1662 struct berval ocbv = BER_BVNULL,
1665 ocbv.bv_val = ber_bvchr( &type, '/' );
1666 if ( ocbv.bv_val != NULL ) {
1667 ObjectClass *oc = NULL;
1668 AttributeDescription *ad = NULL;
1669 const char *text = NULL;
1673 bv.bv_len = ntype.bv_len;
1676 ocbv.bv_len = type.bv_len - ( ocbv.bv_val - type.bv_val );
1678 atbv.bv_val = ber_bvchr( &ocbv, '/' );
1679 if ( atbv.bv_val != NULL ) {
1681 atbv.bv_len = type.bv_len
1682 - ( atbv.bv_val - type.bv_val );
1683 ocbv.bv_len = atbv.bv_val - ocbv.bv_val - 1;
1685 rc = slap_bv2ad( &atbv, &ad, &text );
1686 if ( rc != LDAP_SUCCESS ) {
1687 Debug( LDAP_DEBUG_ACL, "aciPrettyNormal: unknown group attribute '%s'\n", atbv.bv_val, 0, 0 );
1688 rc = LDAP_INVALID_SYNTAX;
1692 bv.bv_len += STRLENOF( "/" ) + ad->ad_cname.bv_len;
1695 oc = oc_bvfind( &ocbv );
1697 Debug( LDAP_DEBUG_ACL, "aciPrettyNormal: invalid group '%s'\n", ocbv.bv_val, 0, 0 );
1698 rc = LDAP_INVALID_SYNTAX;
1702 bv.bv_len += STRLENOF( "/" ) + oc->soc_cname.bv_len;
1703 bv.bv_val = ber_memalloc_x( bv.bv_len + 1, ctx );
1706 ptr = lutil_strncopy( ptr, ntype.bv_val, ntype.bv_len );
1709 ptr = lutil_strncopy( ptr,
1710 oc->soc_cname.bv_val,
1711 oc->soc_cname.bv_len );
1715 ptr = lutil_strncopy( ptr,
1716 ad->ad_cname.bv_val,
1717 ad->ad_cname.bv_len );
1726 } else if ( OpenLDAPacitypes[ idx ] == &aci_bv[ ACI_BV_DNATTR ] ) {
1727 AttributeDescription *ad = NULL;
1728 const char *text = NULL;
1731 rc = slap_bv2ad( &subject, &ad, &text );
1732 if ( rc != LDAP_SUCCESS ) {
1733 Debug( LDAP_DEBUG_ACL, "aciPrettyNormal: unknown dn attribute '%s'\n", subject.bv_val, 0, 0 );
1734 rc = LDAP_INVALID_SYNTAX;
1738 if ( ad->ad_type->sat_syntax != slap_schema.si_syn_distinguishedName ) {
1739 /* FIXME: allow nameAndOptionalUID? */
1740 Debug( LDAP_DEBUG_ACL, "aciPrettyNormal: wrong syntax for dn attribute '%s'\n", subject.bv_val, 0, 0 );
1741 rc = LDAP_INVALID_SYNTAX;
1745 nsubject = ad->ad_cname;
1747 } else if ( OpenLDAPacitypes[ idx ] == &aci_bv[ ACI_BV_SET ]
1748 || OpenLDAPacitypes[ idx ] == &aci_bv[ ACI_BV_SET_REF ] )
1750 /* NOTE: dunno how to normalize it... */
1756 oid.bv_len + STRLENOF( "#" )
1757 + scope.bv_len + STRLENOF( "#" )
1758 + nrights.bv_len + STRLENOF( "#" )
1759 + ntype.bv_len + STRLENOF( "#" )
1762 out->bv_val = ber_memalloc_x( out->bv_len + 1, ctx );
1763 ptr = lutil_strncopy( out->bv_val, oid.bv_val, oid.bv_len );
1766 ptr = lutil_strncopy( ptr, scope.bv_val, scope.bv_len );
1769 ptr = lutil_strncopy( ptr, nrights.bv_val, nrights.bv_len );
1772 ptr = lutil_strncopy( ptr, ntype.bv_val, ntype.bv_len );
1775 if ( !BER_BVISNULL( &nsubject ) ) {
1776 ptr = lutil_strncopy( ptr, nsubject.bv_val, nsubject.bv_len );
1781 if ( freesubject ) {
1782 ber_memfree_x( nsubject.bv_val, ctx );
1786 ber_memfree_x( ntype.bv_val, ctx );
1789 if ( !BER_BVISNULL( &nrights ) ) {
1790 ber_memfree_x( nrights.bv_val, ctx );
1803 return OpenLDAPaciPrettyNormal( val, out, ctx, 0 );
1807 OpenLDAPaciNormalize(
1815 return OpenLDAPaciPrettyNormal( val, out, ctx, 1 );
1818 #if SLAPD_ACI_ENABLED == SLAPD_MOD_DYNAMIC
1820 * FIXME: need config and Makefile.am code to ease building
1824 init_module( int argc, char *argv[] )
1826 return dynacl_aci_init();
1828 #endif /* SLAPD_ACI_ENABLED == SLAPD_MOD_DYNAMIC */
1830 #endif /* SLAPD_ACI_ENABLED */