git.sur5r.net Git - openldap/blob - servers/slapd/acl.c

   1 /* acl.c - routines to parse and check acl's */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 1998-2005 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
  17  * All rights reserved.
  18  *
  19  * Redistribution and use in source and binary forms are permitted
  20  * provided that this notice is preserved and that due credit is given
  21  * to the University of Michigan at Ann Arbor. The name of the University
  22  * may not be used to endorse or promote products derived from this
  23  * software without specific prior written permission. This software
  24  * is provided ``as is'' without express or implied warranty.
  25  */
  26
  27 #include "portable.h"
  28
  29 #include <stdio.h>
  30
  31 #include <ac/regex.h>
  32 #include <ac/socket.h>
  33 #include <ac/string.h>
  34
  35 #include "slap.h"
  36 #include "sets.h"
  37 #include "lber_pvt.h"
  38 #include "lutil.h"
  39
  40 #ifdef LDAP_SLAPI
  41 #include "slapi/slapi.h"
  42 #endif /* LDAPI_SLAPI */
  43
  44 #define ACL_BUF_SIZE    1024    /* use most appropriate size */
  45
  46 /*
  47  * speed up compares
  48  */
  49 static struct berval
  50         aci_bv_entry            = BER_BVC("entry"),
  51         aci_bv_children         = BER_BVC("children"),
  52         aci_bv_onelevel         = BER_BVC("onelevel"),
  53         aci_bv_subtree          = BER_BVC("subtree"),
  54         aci_bv_br_entry         = BER_BVC("[entry]"),
  55         aci_bv_br_all           = BER_BVC("[all]"),
  56         aci_bv_access_id        = BER_BVC("access-id"),
  57 #if 0
  58         aci_bv_anonymous        = BER_BVC("anonymous"),
  59 #endif
  60         aci_bv_public           = BER_BVC("public"),
  61         aci_bv_users            = BER_BVC("users"),
  62         aci_bv_self             = BER_BVC("self"),
  63         aci_bv_dnattr           = BER_BVC("dnattr"),
  64         aci_bv_group            = BER_BVC("group"),
  65         aci_bv_role             = BER_BVC("role"),
  66         aci_bv_set              = BER_BVC("set"),
  67         aci_bv_set_ref          = BER_BVC("set-ref"),
  68         aci_bv_grant            = BER_BVC("grant"),
  69         aci_bv_deny             = BER_BVC("deny"),
  70
  71         aci_bv_ip_eq            = BER_BVC("IP="),
  72 #ifdef LDAP_PF_LOCAL
  73         aci_bv_path_eq          = BER_BVC("PATH="),
  74 #if 0
  75         aci_bv_dirsep           = BER_BVC(LDAP_DIRSEP),
  76 #endif
  77 #endif /* LDAP_PF_LOCAL */
  78
  79         aci_bv_group_class      = BER_BVC(SLAPD_GROUP_CLASS),
  80         aci_bv_group_attr       = BER_BVC(SLAPD_GROUP_ATTR),
  81         aci_bv_role_class       = BER_BVC(SLAPD_ROLE_CLASS),
  82         aci_bv_role_attr        = BER_BVC(SLAPD_ROLE_ATTR),
  83         aci_bv_set_attr         = BER_BVC(SLAPD_ACI_SET_ATTR);
  84
  85 typedef enum slap_aci_scope_t {
  86         SLAP_ACI_SCOPE_ENTRY            = 0x1,
  87         SLAP_ACI_SCOPE_CHILDREN         = 0x2,
  88         SLAP_ACI_SCOPE_SUBTREE          = ( SLAP_ACI_SCOPE_ENTRY | SLAP_ACI_SCOPE_CHILDREN )
  89 } slap_aci_scope_t;
  90
  91 static AccessControl * acl_get(
  92         AccessControl *ac, int *count,
  93         Operation *op, Entry *e,
  94         AttributeDescription *desc,
  95         struct berval *val,
  96         int nmatch, regmatch_t *matches,
  97         AccessControlState *state );
  98
  99 static slap_control_t acl_mask(
 100         AccessControl *ac, slap_mask_t *mask,
 101         Operation *op, Entry *e,
 102         AttributeDescription *desc,
 103         struct berval *val,
 104         int nmatch,
 105         regmatch_t *matches,
 106         int count,
 107         AccessControlState *state );
 108
 109 #ifdef SLAPD_ACI_ENABLED
 110 static int aci_mask(
 111         Operation *op, Entry *e,
 112         AttributeDescription *desc,
 113         struct berval *val,
 114         struct berval *aci,
 115         int nmatch,
 116         regmatch_t *matches,
 117         slap_access_t *grant,
 118         slap_access_t *deny,
 119         slap_aci_scope_t scope);
 120 #endif /* SLAPD_ACI_ENABLED */
 121
 122 static int      regex_matches(
 123         struct berval *pat, char *str, char *buf,
 124         int nmatch, regmatch_t *matches);
 125 static int      string_expand(
 126         struct berval *newbuf, struct berval *pattern,
 127         char *match, int nmatch, regmatch_t *matches);
 128
 129 typedef struct AciSetCookie {
 130         Operation *op;
 131         Entry *e;
 132 } AciSetCookie;
 133
 134 SLAP_SET_GATHER aci_set_gather;
 135 SLAP_SET_GATHER aci_set_gather2;
 136 static int aci_match_set ( struct berval *subj, Operation *op,
 137     Entry *e, int setref );
 138
 139 /*
 140  * access_allowed - check whether op->o_ndn is allowed the requested access
 141  * to entry e, attribute attr, value val.  if val is null, access to
 142  * the whole attribute is assumed (all values).
 143  *
 144  * This routine loops through all access controls and calls
 145  * acl_mask() on each applicable access control.
 146  * The loop exits when a definitive answer is reached or
 147  * or no more controls remain.
 148  *
 149  * returns:
 150  *              0       access denied
 151  *              1       access granted
 152  *
 153  * Notes:
 154  * - can be legally called with op == NULL
 155  * - can be legally called with op->o_bd == NULL
 156  */
 157
 158 #ifdef SLAP_OVERLAY_ACCESS
 159 int
 160 slap_access_always_allowed(
 161         Operation               *op,
 162         Entry                   *e,
 163         AttributeDescription    *desc,
 164         struct berval           *val,
 165         slap_access_t           access,
 166         AccessControlState      *state,
 167         slap_mask_t             *maskp )
 168 {
 169         assert( maskp );
 170
 171         ACL_PRIV_SET( *maskp, ACL_ACCESS2PRIV( access ) );
 172
 173         return 1;
 174 }
 175
 176 static int
 177 slap_access_allowed(
 178         Operation               *op,
 179         Entry                   *e,
 180         AttributeDescription    *desc,
 181         struct berval           *val,
 182         slap_access_t           access,
 183         AccessControlState      *state,
 184         slap_mask_t             *maskp )
 185 {
 186         int                             ret = 1;
 187         int                             count;
 188         AccessControl                   *a = NULL;
 189
 190 #ifdef LDAP_DEBUG
 191         char                            accessmaskbuf[ACCESSMASK_MAXLEN];
 192 #endif
 193         slap_mask_t                     mask;
 194         slap_control_t                  control;
 195         slap_access_t                   access_level;
 196         const char                      *attr;
 197         regmatch_t                      matches[MAXREMATCHES];
 198         int                             st_same_attr = 0;
 199
 200         assert( op != NULL );
 201         assert( e != NULL );
 202         assert( desc != NULL );
 203         assert( maskp != NULL );
 204
 205         access_level = ACL_LEVEL( access );
 206         attr = desc->ad_cname.bv_val;
 207
 208         assert( attr != NULL );
 209
 210 #ifdef LDAP_SLAPI
 211         if ( op->o_pb != NULL ) {
 212                 ret = slapi_int_access_allowed( op, e, desc, val, access, state );
 213                 if ( ret == 0 ) {
 214                         /* ACL plugin denied access */
 215                         goto done;
 216                 }
 217         }
 218 #endif /* LDAP_SLAPI */
 219
 220         /* grant database root access */
 221         if ( be_isroot( op ) ) {
 222                 Debug( LDAP_DEBUG_ACL, "<= root access granted\n", 0, 0, 0 );
 223                 mask = ACL_LVL_MANAGE;
 224                 goto done;
 225         }
 226
 227         /*
 228          * no-user-modification operational attributes are ignored
 229          * by ACL_WRITE checking as any found here are not provided
 230          * by the user
 231          */
 232         if ( access_level >= ACL_WRITE && is_at_no_user_mod( desc->ad_type )
 233                 && desc != slap_schema.si_ad_entry
 234                 && desc != slap_schema.si_ad_children )
 235         {
 236                 Debug( LDAP_DEBUG_ACL, "NoUserMod Operational attribute:"
 237                         " %s access granted\n",
 238                         attr, 0, 0 );
 239                 goto done;
 240         }
 241
 242         /* use backend default access if no backend acls */
 243         if ( op->o_bd->be_acl == NULL ) {
 244                 int     i;
 245
 246                 Debug( LDAP_DEBUG_ACL,
 247                         "=> slap_access_allowed: backend default %s "
 248                         "access %s to \"%s\"\n",
 249                         access2str( access ),
 250                         op->o_bd->be_dfltaccess >= access_level ? "granted" : "denied",
 251                         op->o_dn.bv_val ? op->o_dn.bv_val : "(anonymous)" );
 252                 ret = op->o_bd->be_dfltaccess >= access_level;
 253
 254                 mask = ACL_PRIV_LEVEL;
 255                 for ( i = ACL_NONE; i <= op->o_bd->be_dfltaccess; i++ ) {
 256                         ACL_PRIV_SET( mask, ACL_ACCESS2PRIV( i ) );
 257                 }
 258
 259                 goto done;
 260         }
 261
 262         ret = 0;
 263         control = ACL_BREAK;
 264
 265         if ( st_same_attr ) {
 266                 assert( state->as_vd_acl != NULL );
 267
 268                 a = state->as_vd_acl;
 269                 count = state->as_vd_acl_count;
 270                 if ( !ACL_IS_INVALID( state->as_vd_acl_mask ) ) {
 271                         mask = state->as_vd_acl_mask;
 272                         AC_MEMCPY( matches, state->as_vd_acl_matches, sizeof(matches) );
 273                         goto vd_access;
 274                 }
 275
 276         } else {
 277                 if ( state ) state->as_vi_acl = NULL;
 278                 a = NULL;
 279                 ACL_PRIV_ASSIGN( mask, *maskp );
 280                 count = 0;
 281                 memset( matches, '\0', sizeof( matches ) );
 282         }
 283
 284         while ( ( a = acl_get( a, &count, op, e, desc, val,
 285                 MAXREMATCHES, matches, state ) ) != NULL )
 286         {
 287                 int i;
 288
 289                 for ( i = 0; i < MAXREMATCHES && matches[i].rm_so > 0; i++ ) {
 290                         Debug( LDAP_DEBUG_ACL, "=> match[%d]: %d %d ", i,
 291                                 (int)matches[i].rm_so, (int)matches[i].rm_eo );
 292                         if ( matches[i].rm_so <= matches[0].rm_eo ) {
 293                                 int n;
 294                                 for ( n = matches[i].rm_so; n < matches[i].rm_eo; n++ ) {
 295                                         Debug( LDAP_DEBUG_ACL, "%c", e->e_ndn[n], 0, 0 );
 296                                 }
 297                         }
 298                         Debug( LDAP_DEBUG_ARGS, "\n", 0, 0, 0 );
 299                 }
 300
 301                 if ( state ) {
 302                         if ( state->as_vi_acl == a &&
 303                                 ( state->as_recorded & ACL_STATE_RECORDED_NV ) )
 304                         {
 305                                 Debug( LDAP_DEBUG_ACL,
 306                                         "slap_access_allowed: result from state (%s)\n",
 307                                         attr, 0, 0 );
 308                                 ret = state->as_result;
 309                                 goto done;
 310                         } else {
 311                                 Debug( LDAP_DEBUG_ACL,
 312                                         "slap_access_allowed: no res from state (%s)\n",
 313                                         attr, 0, 0 );
 314                         }
 315                 }
 316
 317 vd_access:
 318                 control = acl_mask( a, &mask, op,
 319                         e, desc, val, MAXREMATCHES, matches, count, state );
 320
 321                 if ( control != ACL_BREAK ) {
 322                         break;
 323                 }
 324
 325                 memset( matches, '\0', sizeof( matches ) );
 326         }
 327
 328         if ( ACL_IS_INVALID( mask ) ) {
 329                 Debug( LDAP_DEBUG_ACL,
 330                         "=> slap_access_allowed: \"%s\" (%s) invalid!\n",
 331                         e->e_dn, attr, 0 );
 332                 ACL_PRIV_ASSIGN( mask, *maskp );
 333
 334         } else if ( control == ACL_BREAK ) {
 335                 Debug( LDAP_DEBUG_ACL,
 336                         "=> slap_access_allowed: no more rules\n", 0, 0, 0 );
 337
 338                 goto done;
 339         }
 340
 341         ret = ACL_GRANT( mask, access );
 342
 343         Debug( LDAP_DEBUG_ACL,
 344                 "=> slap_access_allowed: %s access %s by %s\n",
 345                 access2str( access ), ret ? "granted" : "denied",
 346                 accessmask2str( mask, accessmaskbuf, 1 ) );
 347
 348 done:
 349         ACL_PRIV_ASSIGN( *maskp, mask );
 350         return ret;
 351 }
 352
 353 int
 354 access_allowed_mask(
 355         Operation               *op,
 356         Entry                   *e,
 357         AttributeDescription    *desc,
 358         struct berval           *val,
 359         slap_access_t           access,
 360         AccessControlState      *state,
 361         slap_mask_t             *maskp )
 362 {
 363         int                             ret = 1;
 364         AccessControl                   *a = NULL;
 365         int                             be_null = 0;
 366
 367 #ifdef LDAP_DEBUG
 368         char                            accessmaskbuf[ACCESSMASK_MAXLEN];
 369 #endif
 370         slap_mask_t                     mask;
 371         slap_control_t                  control;
 372         slap_access_t                   access_level;
 373         const char                      *attr;
 374         int                             st_same_attr = 0;
 375         static AccessControlState       state_init = ACL_STATE_INIT;
 376         BI_access_allowed               *bi_access_allowed = NULL;
 377
 378         assert( e != NULL );
 379         assert( desc != NULL );
 380
 381         access_level = ACL_LEVEL( access );
 382
 383         assert( access_level > ACL_NONE );
 384
 385         ACL_INIT( mask );
 386         if ( maskp ) ACL_INVALIDATE( *maskp );
 387
 388         attr = desc->ad_cname.bv_val;
 389
 390         assert( attr != NULL );
 391
 392         if ( op && op->o_is_auth_check &&
 393                 ( access_level == ACL_SEARCH || access_level == ACL_READ ) )
 394         {
 395                 access = ACL_AUTH;
 396         }
 397
 398         if ( state ) {
 399                 if ( state->as_vd_ad == desc ) {
 400                         if ( state->as_recorded ) {
 401                                 if ( ( state->as_recorded & ACL_STATE_RECORDED_NV ) &&
 402                                         val == NULL )
 403                                 {
 404                                         return state->as_result;
 405
 406                                 } else if ( ( state->as_recorded & ACL_STATE_RECORDED_VD ) &&
 407                                         val != NULL && state->as_vd_acl == NULL )
 408                                 {
 409                                         return state->as_result;
 410                                 }
 411                         }
 412                         st_same_attr = 1;
 413                 } else {
 414                         *state = state_init;
 415                 }
 416
 417                 state->as_vd_ad = desc;
 418         }
 419
 420         Debug( LDAP_DEBUG_ACL,
 421                 "=> access_allowed: %s access to \"%s\" \"%s\" requested\n",
 422                 access2str( access ), e->e_dn, attr );
 423
 424         if ( op == NULL ) {
 425                 /* no-op call */
 426                 goto done;
 427         }
 428
 429         if ( op->o_bd == NULL ) {
 430                 op->o_bd = LDAP_STAILQ_FIRST( &backendDB );
 431                 be_null = 1;
 432
 433 #ifdef LDAP_DEVEL
 434                 /*
 435                  * FIXME: experimental; use first backend rules
 436                  * iff there is no global_acl (ITS#3100) */
 437                 if ( frontendDB->be_acl != NULL ) {
 438                         op->o_bd = frontendDB;
 439                 }
 440 #endif /* LDAP_DEVEL */
 441         }
 442         assert( op->o_bd != NULL );
 443
 444         /* delegate to backend */
 445         if ( op->o_bd->bd_info->bi_access_allowed != NULL ) {
 446                 bi_access_allowed = op->o_bd->bd_info->bi_access_allowed;
 447         } else {
 448                 bi_access_allowed = slap_access_allowed;
 449         }
 450         ret = bi_access_allowed( op, e, desc, val, access, state, &mask );
 451         if ( !ret ) {
 452                 if ( ACL_IS_INVALID( mask ) ) {
 453                         Debug( LDAP_DEBUG_ACL,
 454                                 "=> access_allowed: \"%s\" (%s) invalid!\n",
 455                                 e->e_dn, attr, 0 );
 456                         ACL_INIT( mask );
 457
 458                 } else if ( control == ACL_BREAK ) {
 459                         Debug( LDAP_DEBUG_ACL,
 460                                 "=> access_allowed: no more rules\n", 0, 0, 0 );
 461
 462                         goto done;
 463                 }
 464
 465                 ret = ACL_GRANT( mask, access );
 466         }
 467
 468         Debug( LDAP_DEBUG_ACL,
 469                 "=> access_allowed: %s access %s by %s\n",
 470                 access2str( access ), ret ? "granted" : "denied",
 471                 accessmask2str( mask, accessmaskbuf, 1 ) );
 472
 473 done:
 474         if ( state != NULL ) {
 475                 /* If not value-dependent, save ACL in case of more attrs */
 476                 if ( !( state->as_recorded & ACL_STATE_RECORDED_VD ) ) {
 477                         state->as_vi_acl = a;
 478                         state->as_result = ret;
 479                 }
 480                 state->as_recorded |= ACL_STATE_RECORDED;
 481         }
 482         if ( be_null ) op->o_bd = NULL;
 483         if ( maskp ) ACL_PRIV_ASSIGN( *maskp, mask );
 484         return ret;
 485 }
 486
 487 #else /* !SLAP_OVERLAY_ACCESS */
 488
 489 int
 490 access_allowed_mask(
 491         Operation               *op,
 492         Entry                   *e,
 493         AttributeDescription    *desc,
 494         struct berval           *val,
 495         slap_access_t           access,
 496         AccessControlState      *state,
 497         slap_mask_t             *maskp )
 498 {
 499         int                             ret = 1;
 500         int                             count;
 501         AccessControl                   *a = NULL;
 502         Backend                         *be;
 503         int                             be_null = 0;
 504
 505 #ifdef LDAP_DEBUG
 506         char                            accessmaskbuf[ACCESSMASK_MAXLEN];
 507 #endif
 508         slap_mask_t                     mask;
 509         slap_control_t                  control;
 510         slap_access_t                   access_level;
 511         const char                      *attr;
 512         regmatch_t                      matches[MAXREMATCHES];
 513         int                             st_same_attr = 0;
 514         static AccessControlState       state_init = ACL_STATE_INIT;
 515
 516         assert( e != NULL );
 517         assert( desc != NULL );
 518
 519         access_level = ACL_LEVEL( access );
 520
 521         assert( access_level > ACL_NONE );
 522         if ( maskp ) ACL_INVALIDATE( *maskp );
 523
 524         attr = desc->ad_cname.bv_val;
 525
 526         assert( attr != NULL );
 527
 528         if ( op && op->o_is_auth_check &&
 529                 ( access_level == ACL_SEARCH || access_level == ACL_READ ) )
 530         {
 531                 access = ACL_AUTH;
 532         }
 533
 534         if ( state ) {
 535                 if ( state->as_vd_ad == desc ) {
 536                         if ( state->as_recorded ) {
 537                                 if ( ( state->as_recorded & ACL_STATE_RECORDED_NV ) &&
 538                                         val == NULL )
 539                                 {
 540                                         return state->as_result;
 541
 542                                 } else if ( ( state->as_recorded & ACL_STATE_RECORDED_VD ) &&
 543                                         val != NULL && state->as_vd_acl == NULL )
 544                                 {
 545                                         return state->as_result;
 546                                 }
 547                         }
 548                         st_same_attr = 1;
 549                 } else {
 550                         *state = state_init;
 551                 }
 552
 553                 state->as_vd_ad=desc;
 554         }
 555
 556         Debug( LDAP_DEBUG_ACL,
 557                 "=> access_allowed: %s access to \"%s\" \"%s\" requested\n",
 558                 access2str( access ), e->e_dn, attr );
 559
 560         if ( op == NULL ) {
 561                 /* no-op call */
 562                 goto done;
 563         }
 564
 565         be = op->o_bd;
 566         if ( be == NULL ) {
 567                 be = LDAP_STAILQ_FIRST(&backendDB);
 568                 be_null = 1;
 569 #ifdef LDAP_DEVEL
 570                 /*
 571                  * FIXME: experimental; use first backend rules
 572                  * iff there is no global_acl (ITS#3100) */
 573                 if ( frontendDB->be_acl == NULL )
 574 #endif
 575                 {
 576                         op->o_bd = be;
 577                 }
 578         }
 579         assert( be != NULL );
 580
 581 #ifdef LDAP_SLAPI
 582         if ( op->o_pb != NULL ) {
 583                 ret = slapi_int_access_allowed( op, e, desc, val, access, state );
 584                 if ( ret == 0 ) {
 585                         /* ACL plugin denied access */
 586                         goto done;
 587                 }
 588         }
 589 #endif /* LDAP_SLAPI */
 590
 591         /* grant database root access */
 592         if ( be_isroot( op ) ) {
 593                 Debug( LDAP_DEBUG_ACL, "<= root access granted\n", 0, 0, 0 );
 594                 if ( maskp ) {
 595                         mask = ACL_LVL_MANAGE;
 596                 }
 597
 598                 goto done;
 599         }
 600
 601         /*
 602          * no-user-modification operational attributes are ignored
 603          * by ACL_WRITE checking as any found here are not provided
 604          * by the user
 605          */
 606         if ( access_level >= ACL_WRITE && is_at_no_user_mod( desc->ad_type )
 607                 && desc != slap_schema.si_ad_entry
 608                 && desc != slap_schema.si_ad_children )
 609         {
 610                 Debug( LDAP_DEBUG_ACL, "NoUserMod Operational attribute:"
 611                         " %s access granted\n",
 612                         attr, 0, 0 );
 613                 goto done;
 614         }
 615
 616         /* use backend default access if no backend acls */
 617         if ( be->be_acl == NULL ) {
 618                 Debug( LDAP_DEBUG_ACL,
 619                         "=> access_allowed: backend default %s "
 620                         "access %s to \"%s\"\n",
 621                         access2str( access ),
 622                         be->be_dfltaccess >= access_level ? "granted" : "denied",
 623                         op->o_dn.bv_val ? op->o_dn.bv_val : "(anonymous)" );
 624                 ret = be->be_dfltaccess >= access_level;
 625
 626                 if ( maskp ) {
 627                         int     i;
 628
 629                         mask = ACL_PRIV_LEVEL;
 630                         for ( i = ACL_NONE; i <= be->be_dfltaccess; i++ ) {
 631                                 mask |= ACL_ACCESS2PRIV( i );
 632                         }
 633                 }
 634
 635                 goto done;
 636
 637 #ifdef notdef
 638         /* be is always non-NULL */
 639         /* use global default access if no global acls */
 640         } else if ( be == NULL && frontendDB->be_acl == NULL ) {
 641                 Debug( LDAP_DEBUG_ACL,
 642                         "=> access_allowed: global default %s access %s to \"%s\"\n",
 643                         access2str( access ),
 644                         frontendDB->be_dfltaccess >= access_level ?
 645                                 "granted" : "denied", op->o_dn.bv_val );
 646                 ret = frontendDB->be_dfltaccess >= access_level;
 647
 648                 if ( maskp ) {
 649                         int     i;
 650
 651                         mask = ACL_PRIV_LEVEL;
 652                         for ( i = ACL_NONE; i <= global_default_access; i++ ) {
 653                                 mask |= ACL_ACCESS2PRIV( i );
 654                         }
 655                 }
 656
 657                 goto done;
 658 #endif
 659         }
 660
 661         ret = 0;
 662         control = ACL_BREAK;
 663
 664         if ( st_same_attr ) {
 665                 assert( state->as_vd_acl != NULL );
 666
 667                 a = state->as_vd_acl;
 668                 count = state->as_vd_acl_count;
 669                 if ( !ACL_IS_INVALID( state->as_vd_acl_mask ) ) {
 670                         mask = state->as_vd_acl_mask;
 671                         AC_MEMCPY( matches, state->as_vd_acl_matches, sizeof(matches) );
 672                         goto vd_access;
 673                 }
 674
 675         } else {
 676                 if ( state ) state->as_vi_acl = NULL;
 677                 a = NULL;
 678                 ACL_INIT(mask);
 679                 count = 0;
 680                 memset( matches, '\0', sizeof(matches) );
 681         }
 682
 683         while ( ( a = acl_get( a, &count, op, e, desc, val,
 684                 MAXREMATCHES, matches, state ) ) != NULL )
 685         {
 686                 int i;
 687
 688                 for ( i = 0; i < MAXREMATCHES && matches[i].rm_so > 0; i++ ) {
 689                         Debug( LDAP_DEBUG_ACL, "=> match[%d]: %d %d ", i,
 690                                 (int)matches[i].rm_so, (int)matches[i].rm_eo );
 691                         if ( matches[i].rm_so <= matches[0].rm_eo ) {
 692                                 int n;
 693                                 for ( n = matches[i].rm_so; n < matches[i].rm_eo; n++ ) {
 694                                         Debug( LDAP_DEBUG_ACL, "%c", e->e_ndn[n], 0, 0 );
 695                                 }
 696                         }
 697                         Debug( LDAP_DEBUG_ARGS, "\n", 0, 0, 0 );
 698                 }
 699
 700                 if ( state ) {
 701                         if ( state->as_vi_acl == a &&
 702                                 ( state->as_recorded & ACL_STATE_RECORDED_NV ) )
 703                         {
 704                                 Debug( LDAP_DEBUG_ACL,
 705                                         "access_allowed: result from state (%s)\n",
 706                                         attr, 0, 0 );
 707                                 ret = state->as_result;
 708                                 goto done;
 709                         } else {
 710                                 Debug( LDAP_DEBUG_ACL,
 711                                         "access_allowed: no res from state (%s)\n",
 712                                         attr, 0, 0 );
 713                         }
 714                 }
 715
 716 vd_access:
 717                 control = acl_mask( a, &mask, op,
 718                         e, desc, val, MAXREMATCHES, matches, count, state );
 719
 720                 if ( control != ACL_BREAK ) {
 721                         break;
 722                 }
 723
 724                 memset( matches, '\0', sizeof(matches) );
 725         }
 726
 727         if ( ACL_IS_INVALID( mask ) ) {
 728                 Debug( LDAP_DEBUG_ACL,
 729                         "=> access_allowed: \"%s\" (%s) invalid!\n",
 730                         e->e_dn, attr, 0 );
 731                 ACL_INIT(mask);
 732
 733         } else if ( control == ACL_BREAK ) {
 734                 Debug( LDAP_DEBUG_ACL,
 735                         "=> access_allowed: no more rules\n", 0, 0, 0 );
 736
 737                 goto done;
 738         }
 739
 740         Debug( LDAP_DEBUG_ACL,
 741                 "=> access_allowed: %s access %s by %s\n",
 742                 access2str( access ),
 743                 ACL_GRANT(mask, access) ? "granted" : "denied",
 744                 accessmask2str( mask, accessmaskbuf, 1 ) );
 745
 746         ret = ACL_GRANT(mask, access);
 747
 748 done:
 749         if ( state != NULL ) {
 750                 /* If not value-dependent, save ACL in case of more attrs */
 751                 if ( !( state->as_recorded & ACL_STATE_RECORDED_VD ) ) {
 752                         state->as_vi_acl = a;
 753                         state->as_result = ret;
 754                 }
 755                 state->as_recorded |= ACL_STATE_RECORDED;
 756         }
 757         if ( be_null ) op->o_bd = NULL;
 758         if ( maskp ) *maskp = mask;
 759         return ret;
 760 }
 761
 762 #endif /* SLAP_OVERLAY_ACCESS */
 763
 764 /*
 765  * acl_get - return the acl applicable to entry e, attribute
 766  * attr.  the acl returned is suitable for use in subsequent calls to
 767  * acl_access_allowed().
 768  */
 769
 770 static AccessControl *
 771 acl_get(
 772         AccessControl *a,
 773         int                     *count,
 774         Operation       *op,
 775         Entry           *e,
 776         AttributeDescription *desc,
 777         struct berval   *val,
 778         int                     nmatch,
 779         regmatch_t      *matches,
 780         AccessControlState *state )
 781 {
 782         const char *attr;
 783         int dnlen, patlen;
 784         AccessControl *prev;
 785
 786         assert( e != NULL );
 787         assert( count != NULL );
 788         assert( desc != NULL );
 789
 790         attr = desc->ad_cname.bv_val;
 791
 792         assert( attr != NULL );
 793
 794         if( a == NULL ) {
 795                 if( op->o_bd == NULL ) {
 796                         a = frontendDB->be_acl;
 797                 } else {
 798                         a = op->o_bd->be_acl;
 799                 }
 800                 prev = NULL;
 801
 802                 assert( a != NULL );
 803
 804         } else {
 805                 prev = a;
 806                 a = a->acl_next;
 807         }
 808
 809         dnlen = e->e_nname.bv_len;
 810
 811         for ( ; a != NULL; a = a->acl_next ) {
 812                 (*count) ++;
 813
 814                 if ( a->acl_dn_pat.bv_len || ( a->acl_dn_style != ACL_STYLE_REGEX )) {
 815                         if ( a->acl_dn_style == ACL_STYLE_REGEX ) {
 816                                 Debug( LDAP_DEBUG_ACL, "=> dnpat: [%d] %s nsub: %d\n",
 817                                         *count, a->acl_dn_pat.bv_val, (int) a->acl_dn_re.re_nsub );
 818                                 if (regexec(&a->acl_dn_re, e->e_ndn, nmatch, matches, 0))
 819                                         continue;
 820
 821                         } else {
 822                                 Debug( LDAP_DEBUG_ACL, "=> dn: [%d] %s\n",
 823                                         *count, a->acl_dn_pat.bv_val, 0 );
 824                                 patlen = a->acl_dn_pat.bv_len;
 825                                 if ( dnlen < patlen )
 826                                         continue;
 827
 828                                 if ( a->acl_dn_style == ACL_STYLE_BASE ) {
 829                                         /* base dn -- entire object DN must match */
 830                                         if ( dnlen != patlen )
 831                                                 continue;
 832
 833                                 } else if ( a->acl_dn_style == ACL_STYLE_ONE ) {
 834                                         int     rdnlen = -1, sep = 0;
 835
 836                                         if ( dnlen <= patlen )
 837                                                 continue;
 838
 839                                         if ( patlen > 0 ) {
 840                                                 if ( !DN_SEPARATOR( e->e_ndn[dnlen - patlen - 1] ) )
 841                                                         continue;
 842                                                 sep = 1;
 843                                         }
 844
 845                                         rdnlen = dn_rdnlen( NULL, &e->e_nname );
 846                                         if ( rdnlen != dnlen - patlen - sep )
 847                                                 continue;
 848
 849                                 } else if ( a->acl_dn_style == ACL_STYLE_SUBTREE ) {
 850                                         if ( dnlen > patlen && !DN_SEPARATOR( e->e_ndn[dnlen - patlen - 1] ) )
 851                                                 continue;
 852
 853                                 } else if ( a->acl_dn_style == ACL_STYLE_CHILDREN ) {
 854                                         if ( dnlen <= patlen )
 855                                                 continue;
 856                                         if ( !DN_SEPARATOR( e->e_ndn[dnlen - patlen - 1] ) )
 857                                                 continue;
 858                                 }
 859
 860                                 if ( strcmp( a->acl_dn_pat.bv_val, e->e_ndn + dnlen - patlen ) != 0 )
 861                                         continue;
 862                         }
 863
 864                         Debug( LDAP_DEBUG_ACL, "=> acl_get: [%d] matched\n",
 865                                 *count, 0, 0 );
 866                 }
 867
 868                 if ( a->acl_attrs && !ad_inlist( desc, a->acl_attrs ) ) {
 869                         matches[0].rm_so = matches[0].rm_eo = -1;
 870                         continue;
 871                 }
 872
 873                 /* Is this ACL only for a specific value? */
 874                 if ( a->acl_attrval.bv_len ) {
 875                         if ( val == NULL ) {
 876                                 continue;
 877                         }
 878
 879                         if( state && !( state->as_recorded & ACL_STATE_RECORDED_VD )) {
 880                                 state->as_recorded |= ACL_STATE_RECORDED_VD;
 881                                 state->as_vd_acl = prev;
 882                                 state->as_vd_acl_count = *count;
 883                                 state->as_vd_access = a->acl_access;
 884                                 state->as_vd_access_count = 1;
 885                                 ACL_INVALIDATE( state->as_vd_acl_mask );
 886                         }
 887
 888                         if ( a->acl_attrval_style == ACL_STYLE_REGEX ) {
 889                                 Debug( LDAP_DEBUG_ACL,
 890                                         "acl_get: valpat %s\n",
 891                                         a->acl_attrval.bv_val, 0, 0 );
 892                                 if ( regexec( &a->acl_attrval_re, val->bv_val, 0, NULL, 0 ) )
 893                                 {
 894                                         continue;
 895                                 }
 896
 897                         } else {
 898                                 int match = 0;
 899                                 const char *text;
 900                                 Debug( LDAP_DEBUG_ACL,
 901                                         "acl_get: val %s\n",
 902                                         a->acl_attrval.bv_val, 0, 0 );
 903
 904                                 if ( a->acl_attrs[0].an_desc->ad_type->sat_syntax != slap_schema.si_syn_distinguishedName ) {
 905                                         if (value_match( &match, desc,
 906                                                 desc->ad_type->sat_equality, 0,
 907                                                 val, &a->acl_attrval, &text ) != LDAP_SUCCESS ||
 908                                                         match )
 909                                                 continue;
 910
 911                                 } else {
 912                                         int             patlen, vdnlen;
 913
 914                                         patlen = a->acl_attrval.bv_len;
 915                                         vdnlen = val->bv_len;
 916
 917                                         if ( vdnlen < patlen )
 918                                                 continue;
 919
 920                                         if ( a->acl_dn_style == ACL_STYLE_BASE ) {
 921                                                 if ( vdnlen > patlen )
 922                                                         continue;
 923
 924                                         } else if ( a->acl_dn_style == ACL_STYLE_ONE ) {
 925                                                 int rdnlen = -1;
 926
 927                                                 if ( !DN_SEPARATOR( val->bv_val[vdnlen - patlen - 1] ) )
 928                                                         continue;
 929
 930                                                 rdnlen = dn_rdnlen( NULL, val );
 931                                                 if ( rdnlen != vdnlen - patlen - 1 )
 932                                                         continue;
 933
 934                                         } else if ( a->acl_dn_style == ACL_STYLE_SUBTREE ) {
 935                                                 if ( vdnlen > patlen && !DN_SEPARATOR( val->bv_val[vdnlen - patlen - 1] ) )
 936                                                         continue;
 937
 938                                         } else if ( a->acl_dn_style == ACL_STYLE_CHILDREN ) {
 939                                                 if ( vdnlen <= patlen )
 940                                                         continue;
 941
 942                                                 if ( !DN_SEPARATOR( val->bv_val[vdnlen - patlen - 1] ) )
 943                                                         continue;
 944                                         }
 945
 946                                         if ( strcmp( a->acl_attrval.bv_val, val->bv_val + vdnlen - patlen ))
 947                                                 continue;
 948                                 }
 949                         }
 950                 }
 951
 952                 if ( a->acl_filter != NULL ) {
 953                         ber_int_t rc = test_filter( NULL, e, a->acl_filter );
 954                         if ( rc != LDAP_COMPARE_TRUE ) {
 955                                 continue;
 956                         }
 957                 }
 958
 959                 Debug( LDAP_DEBUG_ACL, "=> acl_get: [%d] attr %s\n",
 960                        *count, attr, 0);
 961                 return a;
 962         }
 963
 964         Debug( LDAP_DEBUG_ACL, "<= acl_get: done.\n", 0, 0, 0 );
 965         return( NULL );
 966 }
 967
 968 static int
 969 acl_mask_dn(
 970         Operation               *op,
 971         Entry                   *e,
 972         AccessControl           *a,
 973         int                     nmatch,
 974         regmatch_t              *matches,
 975         slap_dn_access          *b,
 976         struct berval           *opndn )
 977 {
 978         /*
 979          * if access applies to the entry itself, and the
 980          * user is bound as somebody in the same namespace as
 981          * the entry, OR the given dn matches the dn pattern
 982          */
 983         /*
 984          * NOTE: styles "anonymous", "users" and "self"
 985          * have been moved to enum slap_style_t, whose
 986          * value is set in a_dn_style; however, the string
 987          * is maintaned in a_dn_pat.
 988          */
 989         if ( b->a_style == ACL_STYLE_ANONYMOUS ) {
 990                 if ( !BER_BVISEMPTY( opndn ) ) {
 991                         return 1;
 992                 }
 993
 994         } else if ( b->a_style == ACL_STYLE_USERS ) {
 995                 if ( BER_BVISEMPTY( opndn ) ) {
 996                         return 1;
 997                 }
 998
 999         } else if ( b->a_style == ACL_STYLE_SELF ) {
1000                 struct berval   ndn, selfndn;
1001                 int             level;
1002
1003                 if ( BER_BVISEMPTY( opndn ) || BER_BVISNULL( &e->e_nname ) ) {
1004                         return 1;
1005                 }
1006
1007                 level = b->a_self_level;
1008                 if ( level < 0 ) {
1009                         selfndn = *opndn;
1010                         ndn = e->e_nname;
1011                         level = -level;
1012
1013                 } else {
1014                         ndn = *opndn;
1015                         selfndn = e->e_nname;
1016                 }
1017
1018                 for ( ; level > 0; level-- ) {
1019                         if ( BER_BVISEMPTY( &ndn ) ) {
1020                                 break;
1021                         }
1022                         dnParent( &ndn, &ndn );
1023                 }
1024
1025                 if ( BER_BVISEMPTY( &ndn ) || !dn_match( &ndn, &selfndn ) )
1026                 {
1027                         return 1;
1028                 }
1029
1030         } else if ( b->a_style == ACL_STYLE_REGEX ) {
1031                 if ( !ber_bvccmp( &b->a_pat, '*' ) ) {
1032                         int             tmp_nmatch;
1033                         regmatch_t      tmp_matches[2],
1034                                         *tmp_matchesp = tmp_matches;
1035
1036                         int             rc = 0;
1037
1038                         switch ( a->acl_dn_style ) {
1039                         case ACL_STYLE_REGEX:
1040                                 if ( !BER_BVISNULL( &a->acl_dn_pat ) ) {
1041                                         tmp_matchesp = matches;
1042                                         tmp_nmatch = nmatch;
1043                                         break;
1044                                 }
1045                         /* FALLTHRU: applies also to ACL_STYLE_REGEX when pattern is "*" */
1046
1047                         case ACL_STYLE_BASE:
1048                                 tmp_matches[0].rm_so = 0;
1049                                 tmp_matches[0].rm_eo = e->e_nname.bv_len;
1050                                 tmp_nmatch = 1;
1051                                 break;
1052
1053                         case ACL_STYLE_ONE:
1054                         case ACL_STYLE_SUBTREE:
1055                         case ACL_STYLE_CHILDREN:
1056                                 tmp_matches[0].rm_so = 0;
1057                                 tmp_matches[0].rm_eo = e->e_nname.bv_len;
1058                                 tmp_matches[1].rm_so = e->e_nname.bv_len - a->acl_dn_pat.bv_len;
1059                                 tmp_matches[1].rm_eo = e->e_nname.bv_len;
1060                                 tmp_nmatch = 2;
1061                                 break;
1062
1063                         default:
1064                                 /* error */
1065                                 rc = 1;
1066                                 break;
1067                         }
1068
1069                         if ( rc ) {
1070                                 return 1;
1071                         }
1072
1073                         if ( !regex_matches( &b->a_pat, opndn->bv_val,
1074                                 e->e_ndn, tmp_nmatch, tmp_matchesp ) )
1075                         {
1076                                 return 1;
1077                         }
1078                 }
1079
1080         } else {
1081                 struct berval   pat;
1082                 ber_len_t       patlen, odnlen;
1083                 int             got_match = 0;
1084
1085                 if ( e->e_dn == NULL )
1086                         return 1;
1087
1088                 if ( b->a_expand ) {
1089                         struct berval   bv;
1090                         char            buf[ACL_BUF_SIZE];
1091
1092                         int             tmp_nmatch;
1093                         regmatch_t      tmp_matches[2],
1094                                         *tmp_matchesp = tmp_matches;
1095
1096                         int             rc = 0;
1097
1098                         bv.bv_len = sizeof( buf ) - 1;
1099                         bv.bv_val = buf;
1100
1101                         switch ( a->acl_dn_style ) {
1102                         case ACL_STYLE_REGEX:
1103                                 if ( !BER_BVISNULL( &a->acl_dn_pat ) ) {
1104                                         tmp_matchesp = matches;
1105                                         tmp_nmatch = nmatch;
1106                                         break;
1107                                 }
1108                         /* FALLTHRU: applies also to ACL_STYLE_REGEX when pattern is "*" */
1109
1110                         case ACL_STYLE_BASE:
1111                                 tmp_matches[0].rm_so = 0;
1112                                 tmp_matches[0].rm_eo = e->e_nname.bv_len;
1113                                 tmp_nmatch = 1;
1114                                 break;
1115
1116                         case ACL_STYLE_ONE:
1117                         case ACL_STYLE_SUBTREE:
1118                         case ACL_STYLE_CHILDREN:
1119                                 tmp_matches[0].rm_so = 0;
1120                                 tmp_matches[0].rm_eo = e->e_nname.bv_len;
1121                                 tmp_matches[1].rm_so = e->e_nname.bv_len - a->acl_dn_pat.bv_len;
1122                                 tmp_matches[1].rm_eo = e->e_nname.bv_len;
1123                                 tmp_nmatch = 2;
1124                                 break;
1125
1126                         default:
1127                                 /* error */
1128                                 rc = 1;
1129                                 break;
1130                         }
1131
1132                         if ( rc ) {
1133                                 return 1;
1134                         }
1135
1136                         if ( string_expand( &bv, &b->a_pat,
1137                                         e->e_nname.bv_val,
1138                                         tmp_nmatch, tmp_matchesp ) )
1139                         {
1140                                 return 1;
1141                         }
1142
1143                         if ( dnNormalize(0, NULL, NULL, &bv,
1144                                         &pat, op->o_tmpmemctx )
1145                                         != LDAP_SUCCESS )
1146                         {
1147                                 /* did not expand to a valid dn */
1148                                 return 1;
1149                         }
1150
1151                 } else {
1152                         pat = b->a_pat;
1153                 }
1154
1155                 patlen = pat.bv_len;
1156                 odnlen = opndn->bv_len;
1157                 if ( odnlen < patlen ) {
1158                         goto dn_match_cleanup;
1159
1160                 }
1161
1162                 if ( b->a_style == ACL_STYLE_BASE ) {
1163                         /* base dn -- entire object DN must match */
1164                         if ( odnlen != patlen ) {
1165                                 goto dn_match_cleanup;
1166                         }
1167
1168                 } else if ( b->a_style == ACL_STYLE_ONE ) {
1169                         int rdnlen = -1;
1170
1171                         if ( odnlen <= patlen ) {
1172                                 goto dn_match_cleanup;
1173                         }
1174
1175                         if ( !DN_SEPARATOR( opndn->bv_val[odnlen - patlen - 1] ) ) {
1176                                 goto dn_match_cleanup;
1177                         }
1178
1179                         rdnlen = dn_rdnlen( NULL, opndn );
1180                         if ( rdnlen != odnlen - patlen - 1 ) {
1181                                 goto dn_match_cleanup;
1182                         }
1183
1184                 } else if ( b->a_style == ACL_STYLE_SUBTREE ) {
1185                         if ( odnlen > patlen && !DN_SEPARATOR( opndn->bv_val[odnlen - patlen - 1] ) ) {
1186                                 goto dn_match_cleanup;
1187                         }
1188
1189                 } else if ( b->a_style == ACL_STYLE_CHILDREN ) {
1190                         if ( odnlen <= patlen ) {
1191                                 goto dn_match_cleanup;
1192                         }
1193
1194                         if ( !DN_SEPARATOR( opndn->bv_val[odnlen - patlen - 1] ) ) {
1195                                 goto dn_match_cleanup;
1196                         }
1197
1198                 } else if ( b->a_style == ACL_STYLE_LEVEL ) {
1199                         int level;
1200                         struct berval ndn;
1201
1202                         if ( odnlen <= patlen ) {
1203                                 goto dn_match_cleanup;
1204                         }
1205
1206                         if ( level > 0 && !DN_SEPARATOR( opndn->bv_val[odnlen - patlen - 1] ) )
1207                         {
1208                                 goto dn_match_cleanup;
1209                         }
1210
1211                         level = b->a_level;
1212                         ndn = *opndn;
1213                         for ( ; level > 0; level-- ) {
1214                                 if ( BER_BVISEMPTY( &ndn ) ) {
1215                                         goto dn_match_cleanup;
1216                                 }
1217                                 dnParent( &ndn, &ndn );
1218                                 if ( ndn.bv_len < patlen ) {
1219                                         goto dn_match_cleanup;
1220                                 }
1221                         }
1222
1223                         if ( ndn.bv_len != patlen ) {
1224                                 goto dn_match_cleanup;
1225                         }
1226                 }
1227
1228                 got_match = !strcmp( pat.bv_val, &opndn->bv_val[ odnlen - patlen ] );
1229
1230 dn_match_cleanup:;
1231                 if ( pat.bv_val != b->a_pat.bv_val ) {
1232                         slap_sl_free( pat.bv_val, op->o_tmpmemctx );
1233                 }
1234
1235                 if ( !got_match ) {
1236                         return 1;
1237                 }
1238         }
1239
1240         return 0;
1241 }
1242
1243 /*
1244  * Record value-dependent access control state
1245  */
1246 #define ACL_RECORD_VALUE_STATE do { \
1247                 if( state && !( state->as_recorded & ACL_STATE_RECORDED_VD )) { \
1248                         state->as_recorded |= ACL_STATE_RECORDED_VD; \
1249                         state->as_vd_acl = a; \
1250                         AC_MEMCPY( state->as_vd_acl_matches, matches, \
1251                                 sizeof( state->as_vd_acl_matches )) ; \
1252                         state->as_vd_acl_count = count; \
1253                         state->as_vd_access = b; \
1254                         state->as_vd_access_count = i; \
1255                 } \
1256         } while( 0 )
1257
1258 static int
1259 acl_mask_dnattr(
1260         Operation               *op,
1261         Entry                   *e,
1262         struct berval           *val,
1263         AccessControl           *a,
1264         Access                  *b,
1265         int                     i,
1266         regmatch_t              *matches,
1267         int                     count,
1268         AccessControlState      *state,
1269         slap_dn_access          *bdn,
1270         struct berval           *opndn )
1271 {
1272         Attribute       *at;
1273         struct berval   bv;
1274         int             rc, match = 0;
1275         const char      *text;
1276         const char      *attr = bdn->a_at->ad_cname.bv_val;
1277
1278         assert( attr != NULL );
1279
1280         if ( BER_BVISEMPTY( opndn ) ) {
1281                 return 1;
1282         }
1283
1284         Debug( LDAP_DEBUG_ACL, "<= check a_dn_at: %s\n", attr, 0, 0 );
1285         bv = *opndn;
1286
1287         /* see if asker is listed in dnattr */
1288         for ( at = attrs_find( e->e_attrs, bdn->a_at );
1289                 at != NULL;
1290                 at = attrs_find( at->a_next, bdn->a_at ) )
1291         {
1292                 if ( value_find_ex( bdn->a_at,
1293                         SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH |
1294                                 SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH,
1295                         at->a_nvals,
1296                         &bv, op->o_tmpmemctx ) == 0 )
1297                 {
1298                         /* found it */
1299                         match = 1;
1300                         break;
1301                 }
1302         }
1303
1304         if ( match ) {
1305                 /* have a dnattr match. if this is a self clause then
1306                  * the target must also match the op dn.
1307                  */
1308                 if ( bdn->a_self ) {
1309                         /* check if the target is an attribute. */
1310                         if ( val == NULL ) return 1;
1311
1312                         /* target is attribute, check if the attribute value
1313                          * is the op dn.
1314                          */
1315                         rc = value_match( &match, bdn->a_at,
1316                                 bdn->a_at->ad_type->sat_equality, 0,
1317                                 val, &bv, &text );
1318                         /* on match error or no match, fail the ACL clause */
1319                         if ( rc != LDAP_SUCCESS || match != 0 )
1320                                 return 1;
1321                 }
1322
1323         } else {
1324                 /* no dnattr match, check if this is a self clause */
1325                 if ( ! bdn->a_self )
1326                         return 1;
1327
1328                 ACL_RECORD_VALUE_STATE;
1329
1330                 /* this is a self clause, check if the target is an
1331                  * attribute.
1332                  */
1333                 if ( val == NULL )
1334                         return 1;
1335
1336                 /* target is attribute, check if the attribute value
1337                  * is the op dn.
1338                  */
1339                 rc = value_match( &match, bdn->a_at,
1340                         bdn->a_at->ad_type->sat_equality, 0,
1341                         val, &bv, &text );
1342
1343                 /* on match error or no match, fail the ACL clause */
1344                 if ( rc != LDAP_SUCCESS || match != 0 )
1345                         return 1;
1346         }
1347
1348         return 0;
1349 }
1350
1351
1352 /*
1353  * acl_mask - modifies mask based upon the given acl and the
1354  * requested access to entry e, attribute attr, value val.  if val
1355  * is null, access to the whole attribute is assumed (all values).
1356  *
1357  * returns      0       access NOT allowed
1358  *              1       access allowed
1359  */
1360
1361 static slap_control_t
1362 acl_mask(
1363         AccessControl           *a,
1364         slap_mask_t             *mask,
1365         Operation               *op,
1366         Entry                   *e,
1367         AttributeDescription    *desc,
1368         struct berval           *val,
1369         int                     nmatch,
1370         regmatch_t              *matches,
1371         int                     count,
1372         AccessControlState      *state )
1373 {
1374         int             i;
1375         Access  *b;
1376 #ifdef LDAP_DEBUG
1377         char accessmaskbuf[ACCESSMASK_MAXLEN];
1378 #if !defined( SLAP_DYNACL ) && defined( SLAPD_ACI_ENABLED )
1379         char accessmaskbuf1[ACCESSMASK_MAXLEN];
1380 #endif /* !SLAP_DYNACL && SLAPD_ACI_ENABLED */
1381 #endif /* DEBUG */
1382         const char *attr;
1383
1384         assert( a != NULL );
1385         assert( mask != NULL );
1386         assert( desc != NULL );
1387
1388         attr = desc->ad_cname.bv_val;
1389
1390         assert( attr != NULL );
1391
1392         Debug( LDAP_DEBUG_ACL,
1393                 "=> acl_mask: access to entry \"%s\", attr \"%s\" requested\n",
1394                 e->e_dn, attr, 0 );
1395
1396         Debug( LDAP_DEBUG_ACL,
1397                 "=> acl_mask: to %s by \"%s\", (%s) \n",
1398                 val ? "value" : "all values",
1399                 op->o_ndn.bv_val ?  op->o_ndn.bv_val : "",
1400                 accessmask2str( *mask, accessmaskbuf, 1 ) );
1401
1402
1403         if( state && ( state->as_recorded & ACL_STATE_RECORDED_VD )
1404                 && state->as_vd_acl == a )
1405         {
1406                 b = state->as_vd_access;
1407                 i = state->as_vd_access_count;
1408
1409         } else {
1410                 b = a->acl_access;
1411                 i = 1;
1412         }
1413
1414         for ( ; b != NULL; b = b->a_next, i++ ) {
1415                 slap_mask_t oldmask, modmask;
1416
1417                 ACL_INVALIDATE( modmask );
1418
1419                 /* AND <who> clauses */
1420                 if ( !BER_BVISEMPTY( &b->a_dn_pat ) ) {
1421                         Debug( LDAP_DEBUG_ACL, "<= check a_dn_pat: %s\n",
1422                                 b->a_dn_pat.bv_val, 0, 0);
1423                         /*
1424                          * if access applies to the entry itself, and the
1425                          * user is bound as somebody in the same namespace as
1426                          * the entry, OR the given dn matches the dn pattern
1427                          */
1428                         /*
1429                          * NOTE: styles "anonymous", "users" and "self"
1430                          * have been moved to enum slap_style_t, whose
1431                          * value is set in a_dn_style; however, the string
1432                          * is maintaned in a_dn_pat.
1433                          */
1434
1435                         if ( acl_mask_dn( op, e, a, nmatch, matches,
1436                                 &b->a_dn, &op->o_ndn ) )
1437                         {
1438                                 continue;
1439                         }
1440                 }
1441
1442                 if ( !BER_BVISEMPTY( &b->a_realdn_pat ) ) {
1443                         struct berval   ndn;
1444
1445                         Debug( LDAP_DEBUG_ACL, "<= check a_realdn_pat: %s\n",
1446                                 b->a_realdn_pat.bv_val, 0, 0);
1447                         /*
1448                          * if access applies to the entry itself, and the
1449                          * user is bound as somebody in the same namespace as
1450                          * the entry, OR the given dn matches the dn pattern
1451                          */
1452                         /*
1453                          * NOTE: styles "anonymous", "users" and "self"
1454                          * have been moved to enum slap_style_t, whose
1455                          * value is set in a_dn_style; however, the string
1456                          * is maintaned in a_dn_pat.
1457                          */
1458
1459                         if ( op->o_conn && !BER_BVISNULL( &op->o_conn->c_ndn ) )
1460                         {
1461                                 ndn = op->o_conn->c_ndn;
1462                         } else {
1463                                 ndn = op->o_ndn;
1464                         }
1465
1466                         if ( acl_mask_dn( op, e, a, nmatch, matches,
1467                                 &b->a_realdn, &ndn ) )
1468                         {
1469                                 continue;
1470                         }
1471                 }
1472
1473                 if ( !BER_BVISEMPTY( &b->a_sockurl_pat ) ) {
1474                         if ( ! op->o_conn->c_listener ) {
1475                                 continue;
1476                         }
1477                         Debug( LDAP_DEBUG_ACL, "<= check a_sockurl_pat: %s\n",
1478                                 b->a_sockurl_pat.bv_val, 0, 0 );
1479
1480                         if ( !ber_bvccmp( &b->a_sockurl_pat, '*' ) ) {
1481                                 if ( b->a_sockurl_style == ACL_STYLE_REGEX) {
1482                                         if (!regex_matches( &b->a_sockurl_pat, op->o_conn->c_listener_url.bv_val,
1483                                                         e->e_ndn, nmatch, matches ) )
1484                                         {
1485                                                 continue;
1486                                         }
1487
1488                                 } else if ( b->a_sockurl_style == ACL_STYLE_EXPAND ) {
1489                                         struct berval   bv;
1490                                         char buf[ACL_BUF_SIZE];
1491
1492                                         bv.bv_len = sizeof( buf ) - 1;
1493                                         bv.bv_val = buf;
1494                                         if ( string_expand( &bv, &b->a_sockurl_pat,
1495                                                         e->e_ndn, nmatch, matches ) )
1496                                         {
1497                                                 continue;
1498                                         }
1499
1500                                         if ( ber_bvstrcasecmp( &bv, &op->o_conn->c_listener_url ) != 0 )
1501                                         {
1502                                                 continue;
1503                                         }
1504
1505                                 } else {
1506                                         if ( ber_bvstrcasecmp( &b->a_sockurl_pat, &op->o_conn->c_listener_url ) != 0 )
1507                                         {
1508                                                 continue;
1509                                         }
1510                                 }
1511                         }
1512                 }
1513
1514                 if ( !BER_BVISEMPTY( &b->a_domain_pat ) ) {
1515                         if ( !op->o_conn->c_peer_domain.bv_val ) {
1516                                 continue;
1517                         }
1518                         Debug( LDAP_DEBUG_ACL, "<= check a_domain_pat: %s\n",
1519                                 b->a_domain_pat.bv_val, 0, 0 );
1520                         if ( !ber_bvccmp( &b->a_domain_pat, '*' ) ) {
1521                                 if ( b->a_domain_style == ACL_STYLE_REGEX) {
1522                                         if (!regex_matches( &b->a_domain_pat, op->o_conn->c_peer_domain.bv_val,
1523                                                         e->e_ndn, nmatch, matches ) )
1524                                         {
1525                                                 continue;
1526                                         }
1527                                 } else {
1528                                         char buf[ACL_BUF_SIZE];
1529
1530                                         struct berval   cmp = op->o_conn->c_peer_domain;
1531                                         struct berval   pat = b->a_domain_pat;
1532
1533                                         if ( b->a_domain_expand ) {
1534                                                 struct berval bv;
1535
1536                                                 bv.bv_len = sizeof(buf) - 1;
1537                                                 bv.bv_val = buf;
1538
1539                                                 if ( string_expand(&bv, &b->a_domain_pat,
1540                                                                 e->e_ndn, nmatch, matches) )
1541                                                 {
1542                                                         continue;
1543                                                 }
1544                                                 pat = bv;
1545                                         }
1546
1547                                         if ( b->a_domain_style == ACL_STYLE_SUBTREE ) {
1548                                                 int offset = cmp.bv_len - pat.bv_len;
1549                                                 if ( offset < 0 ) {
1550                                                         continue;
1551                                                 }
1552
1553                                                 if ( offset == 1 || ( offset > 1 && cmp.bv_val[ offset - 1 ] != '.' ) ) {
1554                                                         continue;
1555                                                 }
1556
1557                                                 /* trim the domain */
1558                                                 cmp.bv_val = &cmp.bv_val[ offset ];
1559                                                 cmp.bv_len -= offset;
1560                                         }
1561
1562                                         if ( ber_bvstrcasecmp( &pat, &cmp ) != 0 ) {
1563                                                 continue;
1564                                         }
1565                                 }
1566                         }
1567                 }
1568
1569                 if ( !BER_BVISEMPTY( &b->a_peername_pat ) ) {
1570                         if ( !op->o_conn->c_peer_name.bv_val ) {
1571                                 continue;
1572                         }
1573                         Debug( LDAP_DEBUG_ACL, "<= check a_peername_path: %s\n",
1574                                 b->a_peername_pat.bv_val, 0, 0 );
1575                         if ( !ber_bvccmp( &b->a_peername_pat, '*' ) ) {
1576                                 if ( b->a_peername_style == ACL_STYLE_REGEX ) {
1577                                         if (!regex_matches( &b->a_peername_pat, op->o_conn->c_peer_name.bv_val,
1578                                                         e->e_ndn, nmatch, matches ) )
1579                                         {
1580                                                 continue;
1581                                         }
1582
1583                                 } else {
1584                                         /* try exact match */
1585                                         if ( b->a_peername_style == ACL_STYLE_BASE ) {
1586                                                 if ( ber_bvstrcasecmp( &b->a_peername_pat, &op->o_conn->c_peer_name ) != 0 ) {
1587                                                         continue;
1588                                                 }
1589
1590                                         } else if ( b->a_peername_style == ACL_STYLE_EXPAND ) {
1591                                                 struct berval   bv;
1592                                                 char buf[ACL_BUF_SIZE];
1593
1594                                                 bv.bv_len = sizeof( buf ) - 1;
1595                                                 bv.bv_val = buf;
1596                                                 if ( string_expand( &bv, &b->a_peername_pat,
1597                                                                 e->e_ndn, nmatch, matches ) )
1598                                                 {
1599                                                         continue;
1600                                                 }
1601
1602                                                 if ( ber_bvstrcasecmp( &bv, &op->o_conn->c_peer_name ) != 0 ) {
1603                                                         continue;
1604                                                 }
1605
1606                                         /* extract IP and try exact match */
1607                                         } else if ( b->a_peername_style == ACL_STYLE_IP ) {
1608                                                 char            *port;
1609                                                 char            buf[] = "255.255.255.255";
1610                                                 struct berval   ip;
1611                                                 unsigned long   addr;
1612                                                 int             port_number = -1;
1613
1614                                                 if ( strncasecmp( op->o_conn->c_peer_name.bv_val,
1615                                                                         aci_bv_ip_eq.bv_val, aci_bv_ip_eq.bv_len ) != 0 )
1616                                                         continue;
1617
1618                                                 ip.bv_val = op->o_conn->c_peer_name.bv_val + aci_bv_ip_eq.bv_len;
1619                                                 ip.bv_len = op->o_conn->c_peer_name.bv_len - aci_bv_ip_eq.bv_len;
1620
1621                                                 port = strrchr( ip.bv_val, ':' );
1622                                                 if ( port ) {
1623                                                         char    *next;
1624
1625                                                         ip.bv_len = port - ip.bv_val;
1626                                                         ++port;
1627                                                         port_number = strtol( port, &next, 10 );
1628                                                         if ( next[0] != '\0' )
1629                                                                 continue;
1630                                                 }
1631
1632                                                 /* the port check can be anticipated here */
1633                                                 if ( b->a_peername_port != -1 && port_number != b->a_peername_port )
1634                                                         continue;
1635
1636                                                 /* address longer than expected? */
1637                                                 if ( ip.bv_len >= sizeof(buf) )
1638                                                         continue;
1639
1640                                                 AC_MEMCPY( buf, ip.bv_val, ip.bv_len );
1641                                                 buf[ ip.bv_len ] = '\0';
1642
1643                                                 addr = inet_addr( buf );
1644
1645                                                 /* unable to convert? */
1646                                                 if ( addr == (unsigned long)(-1) )
1647                                                         continue;
1648
1649                                                 if ( (addr & b->a_peername_mask) != b->a_peername_addr )
1650                                                         continue;
1651
1652 #ifdef LDAP_PF_LOCAL
1653                                         /* extract path and try exact match */
1654                                         } else if ( b->a_peername_style == ACL_STYLE_PATH ) {
1655                                                 struct berval path;
1656
1657                                                 if ( strncmp( op->o_conn->c_peer_name.bv_val,
1658                                                                         aci_bv_path_eq.bv_val, aci_bv_path_eq.bv_len ) != 0 )
1659                                                         continue;
1660
1661                                                 path.bv_val = op->o_conn->c_peer_name.bv_val + aci_bv_path_eq.bv_len;
1662                                                 path.bv_len = op->o_conn->c_peer_name.bv_len - aci_bv_path_eq.bv_len;
1663
1664                                                 if ( ber_bvcmp( &b->a_peername_pat, &path ) != 0 )
1665                                                         continue;
1666
1667 #endif /* LDAP_PF_LOCAL */
1668
1669                                         /* exact match (very unlikely...) */
1670                                         } else if ( ber_bvcmp( &op->o_conn->c_peer_name, &b->a_peername_pat ) != 0 ) {
1671                                                         continue;
1672                                         }
1673                                 }
1674                         }
1675                 }
1676
1677                 if ( !BER_BVISEMPTY( &b->a_sockname_pat ) ) {
1678                         if ( BER_BVISNULL( &op->o_conn->c_sock_name ) ) {
1679                                 continue;
1680                         }
1681                         Debug( LDAP_DEBUG_ACL, "<= check a_sockname_path: %s\n",
1682                                 b->a_sockname_pat.bv_val, 0, 0 );
1683                         if ( !ber_bvccmp( &b->a_sockname_pat, '*' ) ) {
1684                                 if ( b->a_sockname_style == ACL_STYLE_REGEX) {
1685                                         if (!regex_matches( &b->a_sockname_pat, op->o_conn->c_sock_name.bv_val,
1686                                                         e->e_ndn, nmatch, matches ) )
1687                                         {
1688                                                 continue;
1689                                         }
1690
1691                                 } else if ( b->a_sockname_style == ACL_STYLE_EXPAND ) {
1692                                         struct berval   bv;
1693                                         char buf[ACL_BUF_SIZE];
1694
1695                                         bv.bv_len = sizeof( buf ) - 1;
1696                                         bv.bv_val = buf;
1697                                         if ( string_expand( &bv, &b->a_sockname_pat,
1698                                                         e->e_ndn, nmatch, matches ) )
1699                                         {
1700                                                 continue;
1701                                         }
1702
1703                                         if ( ber_bvstrcasecmp( &bv, &op->o_conn->c_sock_name ) != 0 ) {
1704                                                 continue;
1705                                         }
1706
1707                                 } else {
1708                                         if ( ber_bvstrcasecmp( &b->a_sockname_pat, &op->o_conn->c_sock_name ) != 0 ) {
1709                                                 continue;
1710                                         }
1711                                 }
1712                         }
1713                 }
1714
1715                 if ( b->a_dn_at != NULL ) {
1716                         if ( acl_mask_dnattr( op, e, val, a, b, i,
1717                                         matches, count, state,
1718                                         &b->a_dn, &op->o_ndn ) )
1719                         {
1720                                 continue;
1721                         }
1722                 }
1723
1724                 if ( b->a_realdn_at != NULL ) {
1725                         struct berval   ndn;
1726
1727                         if ( op->o_conn && !BER_BVISNULL( &op->o_conn->c_ndn ) )
1728                         {
1729                                 ndn = op->o_conn->c_ndn;
1730                         } else {
1731                                 ndn = op->o_ndn;
1732                         }
1733
1734                         if ( acl_mask_dnattr( op, e, val, a, b, i,
1735                                         matches, count, state,
1736                                         &b->a_realdn, &ndn ) )
1737                         {
1738                                 continue;
1739                         }
1740                 }
1741
1742                 if ( !BER_BVISEMPTY( &b->a_group_pat ) ) {
1743                         struct berval bv;
1744                         struct berval ndn = BER_BVNULL;
1745                         int rc;
1746
1747                         if ( op->o_ndn.bv_len == 0 ) {
1748                                 continue;
1749                         }
1750
1751                         /* b->a_group is an unexpanded entry name, expanded it should be an
1752                          * entry with objectclass group* and we test to see if odn is one of
1753                          * the values in the attribute group
1754                          */
1755                         /* see if asker is listed in dnattr */
1756                         if ( b->a_group_style == ACL_STYLE_EXPAND ) {
1757                                 char            buf[ACL_BUF_SIZE];
1758                                 int             tmp_nmatch;
1759                                 regmatch_t      tmp_matches[2],
1760                                                 *tmp_matchesp = tmp_matches;
1761
1762                                 bv.bv_len = sizeof(buf) - 1;
1763                                 bv.bv_val = buf;
1764
1765                                 rc = 0;
1766
1767                                 switch ( a->acl_dn_style ) {
1768                                 case ACL_STYLE_REGEX:
1769                                         if ( !BER_BVISNULL( &a->acl_dn_pat ) ) {
1770                                                 tmp_matchesp = matches;
1771                                                 tmp_nmatch = nmatch;
1772                                                 break;
1773                                         }
1774
1775                                 /* FALLTHRU: applies also to ACL_STYLE_REGEX when pattern is "*" */
1776                                 case ACL_STYLE_BASE:
1777                                         tmp_matches[0].rm_so = 0;
1778                                         tmp_matches[0].rm_eo = e->e_nname.bv_len;
1779                                         tmp_nmatch = 1;
1780                                         break;
1781
1782                                 case ACL_STYLE_ONE:
1783                                 case ACL_STYLE_SUBTREE:
1784                                 case ACL_STYLE_CHILDREN:
1785                                         tmp_matches[0].rm_so = 0;
1786                                         tmp_matches[0].rm_eo = e->e_nname.bv_len;
1787                                         tmp_matches[1].rm_so = e->e_nname.bv_len - a->acl_dn_pat.bv_len;
1788                                         tmp_matches[1].rm_eo = e->e_nname.bv_len;
1789                                         tmp_nmatch = 2;
1790                                         break;
1791
1792                                 default:
1793                                         /* error */
1794                                         rc = 1;
1795                                         break;
1796                                 }
1797
1798                                 if ( rc ) {
1799                                         continue;
1800                                 }
1801
1802                                 if ( string_expand( &bv, &b->a_group_pat,
1803                                                 e->e_nname.bv_val,
1804                                                 tmp_nmatch, tmp_matchesp ) )
1805                                 {
1806                                         continue;
1807                                 }
1808
1809                                 if ( dnNormalize( 0, NULL, NULL, &bv, &ndn,
1810                                                 op->o_tmpmemctx ) != LDAP_SUCCESS )
1811                                 {
1812                                         /* did not expand to a valid dn */
1813                                         continue;
1814                                 }
1815
1816                                 bv = ndn;
1817
1818                         } else {
1819                                 bv = b->a_group_pat;
1820                         }
1821
1822                         rc = backend_group( op, e, &bv, &op->o_ndn,
1823                                 b->a_group_oc, b->a_group_at );
1824
1825                         if ( ndn.bv_val ) {
1826                                 slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
1827                         }
1828
1829                         if ( rc != 0 ) {
1830                                 continue;
1831                         }
1832                 }
1833
1834                 if ( !BER_BVISEMPTY( &b->a_set_pat ) ) {
1835                         struct berval   bv;
1836                         char            buf[ACL_BUF_SIZE];
1837
1838                         if ( b->a_set_style == ACL_STYLE_EXPAND ) {
1839                                 int             tmp_nmatch;
1840                                 regmatch_t      tmp_matches[2],
1841                                                 *tmp_matchesp = tmp_matches;
1842                                 int             rc = 0;
1843
1844                                 bv.bv_len = sizeof( buf ) - 1;
1845                                 bv.bv_val = buf;
1846
1847                                 rc = 0;
1848
1849                                 switch ( a->acl_dn_style ) {
1850                                 case ACL_STYLE_REGEX:
1851                                         if ( !BER_BVISNULL( &a->acl_dn_pat ) ) {
1852                                                 tmp_matchesp = matches;
1853                                                 tmp_nmatch = nmatch;
1854                                                 break;
1855                                         }
1856
1857                                 /* FALLTHRU: applies also to ACL_STYLE_REGEX when pattern is "*" */
1858                                 case ACL_STYLE_BASE:
1859                                         tmp_matches[0].rm_so = 0;
1860                                         tmp_matches[0].rm_eo = e->e_nname.bv_len;
1861                                         tmp_nmatch = 1;
1862                                         break;
1863
1864                                 case ACL_STYLE_ONE:
1865                                 case ACL_STYLE_SUBTREE:
1866                                 case ACL_STYLE_CHILDREN:
1867                                         tmp_matches[0].rm_so = 0;
1868                                         tmp_matches[0].rm_eo = e->e_nname.bv_len;
1869                                         tmp_matches[1].rm_so = e->e_nname.bv_len - a->acl_dn_pat.bv_len;
1870                                         tmp_matches[1].rm_eo = e->e_nname.bv_len;
1871                                         tmp_nmatch = 2;
1872                                         break;
1873
1874                                 default:
1875                                         /* error */
1876                                         rc = 1;
1877                                         break;
1878                                 }
1879
1880                                 if ( rc ) {
1881                                         continue;
1882                                 }
1883
1884                                 if ( string_expand( &bv, &b->a_set_pat,
1885                                                 e->e_nname.bv_val,
1886                                                 tmp_nmatch, tmp_matchesp ) )
1887                                 {
1888                                         continue;
1889                                 }
1890
1891                         } else {
1892                                 bv = b->a_set_pat;
1893                         }
1894
1895                         if ( aci_match_set( &bv, op, e, 0 ) == 0 ) {
1896                                 continue;
1897                         }
1898                 }
1899
1900                 if ( b->a_authz.sai_ssf ) {
1901                         Debug( LDAP_DEBUG_ACL, "<= check a_authz.sai_ssf: ACL %u > OP %u\n",
1902                                 b->a_authz.sai_ssf, op->o_ssf, 0 );
1903                         if ( b->a_authz.sai_ssf >  op->o_ssf ) {
1904                                 continue;
1905                         }
1906                 }
1907
1908                 if ( b->a_authz.sai_transport_ssf ) {
1909                         Debug( LDAP_DEBUG_ACL,
1910                                 "<= check a_authz.sai_transport_ssf: ACL %u > OP %u\n",
1911                                 b->a_authz.sai_transport_ssf, op->o_transport_ssf, 0 );
1912                         if ( b->a_authz.sai_transport_ssf >  op->o_transport_ssf ) {
1913                                 continue;
1914                         }
1915                 }
1916
1917                 if ( b->a_authz.sai_tls_ssf ) {
1918                         Debug( LDAP_DEBUG_ACL,
1919                                 "<= check a_authz.sai_tls_ssf: ACL %u > OP %u\n",
1920                                 b->a_authz.sai_tls_ssf, op->o_tls_ssf, 0 );
1921                         if ( b->a_authz.sai_tls_ssf >  op->o_tls_ssf ) {
1922                                 continue;
1923                         }
1924                 }
1925
1926                 if ( b->a_authz.sai_sasl_ssf ) {
1927                         Debug( LDAP_DEBUG_ACL,
1928                                 "<= check a_authz.sai_sasl_ssf: ACL %u > OP %u\n",
1929                                 b->a_authz.sai_sasl_ssf, op->o_sasl_ssf, 0 );
1930                         if ( b->a_authz.sai_sasl_ssf >  op->o_sasl_ssf ) {
1931                                 continue;
1932                         }
1933                 }
1934
1935 #ifdef SLAP_DYNACL
1936                 if ( b->a_dynacl ) {
1937                         slap_dynacl_t   *da;
1938                         slap_access_t   tgrant, tdeny;
1939
1940                         /* this case works different from the others above.
1941                          * since aci's themselves give permissions, we need
1942                          * to first check b->a_access_mask, the ACL's access level.
1943                          */
1944                         if ( BER_BVISEMPTY( &e->e_nname ) ) {
1945                                 /* no ACIs in the root DSE */
1946                                 continue;
1947                         }
1948
1949                         /* first check if the right being requested
1950                          * is allowed by the ACL clause.
1951                          */
1952                         if ( ! ACL_GRANT( b->a_access_mask, *mask ) ) {
1953                                 continue;
1954                         }
1955
1956                         /* start out with nothing granted, nothing denied */
1957                         ACL_INIT(tgrant);
1958                         ACL_INIT(tdeny);
1959
1960                         for ( da = b->a_dynacl; da; da = da->da_next ) {
1961                                 slap_access_t   grant, deny;
1962
1963                                 (void)( *da->da_mask )( da->da_private, op, e, desc, val, nmatch, matches, &grant, &deny );
1964
1965                                 tgrant |= grant;
1966                                 tdeny |= deny;
1967                         }
1968
1969                         /* remove anything that the ACL clause does not allow */
1970                         tgrant &= b->a_access_mask & ACL_PRIV_MASK;
1971                         tdeny &= ACL_PRIV_MASK;
1972
1973                         /* see if we have anything to contribute */
1974                         if( ACL_IS_INVALID(tgrant) && ACL_IS_INVALID(tdeny) ) {
1975                                 continue;
1976                         }
1977
1978                         /* this could be improved by changing acl_mask so that it can deal with
1979                          * by clauses that return grant/deny pairs.  Right now, it does either
1980                          * additive or subtractive rights, but not both at the same time.  So,
1981                          * we need to combine the grant/deny pair into a single rights mask in
1982                          * a smart way:  if either grant or deny is "empty", then we use the
1983                          * opposite as is, otherwise we remove any denied rights from the grant
1984                          * rights mask and construct an additive mask.
1985                          */
1986                         if (ACL_IS_INVALID(tdeny)) {
1987                                 modmask = tgrant | ACL_PRIV_ADDITIVE;
1988
1989                         } else if (ACL_IS_INVALID(tgrant)) {
1990                                 modmask = tdeny | ACL_PRIV_SUBSTRACTIVE;
1991
1992                         } else {
1993                                 modmask = (tgrant & ~tdeny) | ACL_PRIV_ADDITIVE;
1994                         }
1995
1996                 } else
1997 #else /* !SLAP_DYNACL */
1998
1999 #ifdef SLAPD_ACI_ENABLED
2000                 if ( b->a_aci_at != NULL ) {
2001                         Attribute       *at;
2002                         slap_access_t   grant, deny, tgrant, tdeny;
2003                         struct berval   parent_ndn;
2004                         BerVarray       bvals = NULL;
2005                         int             ret, stop;
2006
2007                         /* this case works different from the others above.
2008                          * since aci's themselves give permissions, we need
2009                          * to first check b->a_access_mask, the ACL's access level.
2010                          */
2011
2012                         if ( BER_BVISEMPTY( &e->e_nname ) ) {
2013                                 /* no ACIs in the root DSE */
2014                                 continue;
2015                         }
2016
2017                         /* first check if the right being requested
2018                          * is allowed by the ACL clause.
2019                          */
2020                         if ( ! ACL_GRANT( b->a_access_mask, *mask ) ) {
2021                                 continue;
2022                         }
2023                         /* start out with nothing granted, nothing denied */
2024                         ACL_INIT(tgrant);
2025                         ACL_INIT(tdeny);
2026
2027                         /* get the aci attribute */
2028                         at = attr_find( e->e_attrs, b->a_aci_at );
2029                         if ( at != NULL ) {
2030 #if 0
2031                                 /* FIXME: this breaks acl caching;
2032                                  * see also ACL_RECORD_VALUE_STATE below */
2033                                 ACL_RECORD_VALUE_STATE;
2034 #endif
2035                                 /* the aci is an multi-valued attribute.  The
2036                                 * rights are determined by OR'ing the individual
2037                                 * rights given by the acis.
2038                                 */
2039                                 for ( i = 0; !BER_BVISNULL( &at->a_nvals[i] ); i++ ) {
2040                                         if (aci_mask( op,
2041                                                 e, desc, val,
2042                                                 &at->a_nvals[i],
2043                                                 nmatch, matches,
2044                                                 &grant, &deny, SLAP_ACI_SCOPE_ENTRY ) != 0)
2045                                         {
2046                                                 tgrant |= grant;
2047                                                 tdeny |= deny;
2048                                         }
2049                                 }
2050                                 Debug(LDAP_DEBUG_ACL, "<= aci_mask grant %s deny %s\n",
2051                                           accessmask2str(tgrant, accessmaskbuf, 1),
2052                                           accessmask2str(tdeny, accessmaskbuf1, 1), 0);
2053
2054                         }
2055                         /* If the entry level aci didn't contain anything valid for the
2056                          * current operation, climb up the tree and evaluate the
2057                          * acis with scope set to subtree
2058                          */
2059                         if ( (tgrant == ACL_PRIV_NONE) && (tdeny == ACL_PRIV_NONE) ) {
2060                                 dnParent( &e->e_nname, &parent_ndn );
2061                                 while ( !BER_BVISEMPTY( &parent_ndn ) ) {
2062                                         Debug(LDAP_DEBUG_ACL, "checking ACI of %s\n", parent_ndn.bv_val, 0, 0);
2063                                         ret = backend_attribute(op, NULL, &parent_ndn, b->a_aci_at, &bvals, ACL_AUTH);
2064                                         switch(ret){
2065                                         case LDAP_SUCCESS :
2066                                                 stop = 0;
2067                                                 if (!bvals){
2068                                                         break;
2069                                                 }
2070
2071                                                 for( i = 0; bvals[i].bv_val != NULL; i++){
2072 #if 0
2073                                                         /* FIXME: this breaks acl caching;
2074                                                          * see also ACL_RECORD_VALUE_STATE above */
2075                                                         ACL_RECORD_VALUE_STATE;
2076 #endif
2077                                                         if (aci_mask(op, e, desc, val, &bvals[i],
2078                                                                         nmatch, matches,
2079                                                                         &grant, &deny, SLAP_ACI_SCOPE_CHILDREN ) != 0 )
2080                                                         {
2081                                                                 tgrant |= grant;
2082                                                                 tdeny |= deny;
2083                                                                 /* evaluation stops as soon as either a "deny" or a
2084                                                                  * "grant" directive matches.
2085                                                                  */
2086                                                                 if( (tgrant != ACL_PRIV_NONE) || (tdeny != ACL_PRIV_NONE) ){
2087                                                                         stop = 1;
2088                                                                 }
2089                                                         }
2090                                                         Debug(LDAP_DEBUG_ACL, "<= aci_mask grant %s deny %s\n",
2091                                                                 accessmask2str(tgrant, accessmaskbuf, 1),
2092                                                                 accessmask2str(tdeny, accessmaskbuf1, 1), 0);
2093                                                 }
2094                                                 break;
2095
2096                                         case LDAP_NO_SUCH_ATTRIBUTE:
2097                                                 /* just go on if the aci-Attribute is not present in
2098                                                  * the current entry
2099                                                  */
2100                                                 Debug(LDAP_DEBUG_ACL, "no such attribute\n", 0, 0, 0);
2101                                                 stop = 0;
2102                                                 break;
2103
2104                                         case LDAP_NO_SUCH_OBJECT:
2105                                                 /* We have reached the base object */
2106                                                 Debug(LDAP_DEBUG_ACL, "no such object\n", 0, 0, 0);
2107                                                 stop = 1;
2108                                                 break;
2109
2110                                         default:
2111                                                 stop = 1;
2112                                                 break;
2113                                         }
2114                                         if (stop){
2115                                                 break;
2116                                         }
2117                                         dnParent( &parent_ndn, &parent_ndn );
2118                                 }
2119                         }
2120
2121
2122                         /* remove anything that the ACL clause does not allow */
2123                         tgrant &= b->a_access_mask & ACL_PRIV_MASK;
2124                         tdeny &= ACL_PRIV_MASK;
2125
2126                         /* see if we have anything to contribute */
2127                         if( ACL_IS_INVALID(tgrant) && ACL_IS_INVALID(tdeny) ) {
2128                                 continue;
2129                         }
2130
2131                         /* this could be improved by changing acl_mask so that it can deal with
2132                          * by clauses that return grant/deny pairs.  Right now, it does either
2133                          * additive or subtractive rights, but not both at the same time.  So,
2134                          * we need to combine the grant/deny pair into a single rights mask in
2135                          * a smart way:  if either grant or deny is "empty", then we use the
2136                          * opposite as is, otherwise we remove any denied rights from the grant
2137                          * rights mask and construct an additive mask.
2138                          */
2139                         if (ACL_IS_INVALID(tdeny)) {
2140                                 modmask = tgrant | ACL_PRIV_ADDITIVE;
2141
2142                         } else if (ACL_IS_INVALID(tgrant)) {
2143                                 modmask = tdeny | ACL_PRIV_SUBSTRACTIVE;
2144
2145                         } else {
2146                                 modmask = (tgrant & ~tdeny) | ACL_PRIV_ADDITIVE;
2147                         }
2148
2149                 } else
2150 #endif /* SLAPD_ACI_ENABLED */
2151 #endif /* !SLAP_DYNACL */
2152                 {
2153                         modmask = b->a_access_mask;
2154                 }
2155
2156                 Debug( LDAP_DEBUG_ACL,
2157                         "<= acl_mask: [%d] applying %s (%s)\n",
2158                         i, accessmask2str( modmask, accessmaskbuf, 1 ),
2159                         b->a_type == ACL_CONTINUE
2160                                 ? "continue"
2161                                 : b->a_type == ACL_BREAK
2162                                         ? "break"
2163                                         : "stop" );
2164                 /* save old mask */
2165                 oldmask = *mask;
2166
2167                 if( ACL_IS_ADDITIVE(modmask) ) {
2168                         /* add privs */
2169                         ACL_PRIV_SET( *mask, modmask );
2170
2171                         /* cleanup */
2172                         ACL_PRIV_CLR( *mask, ~ACL_PRIV_MASK );
2173
2174                 } else if( ACL_IS_SUBTRACTIVE(modmask) ) {
2175                         /* substract privs */
2176                         ACL_PRIV_CLR( *mask, modmask );
2177
2178                         /* cleanup */
2179                         ACL_PRIV_CLR( *mask, ~ACL_PRIV_MASK );
2180
2181                 } else {
2182                         /* assign privs */
2183                         *mask = modmask;
2184                 }
2185
2186                 Debug( LDAP_DEBUG_ACL,
2187                         "<= acl_mask: [%d] mask: %s\n",
2188                         i, accessmask2str(*mask, accessmaskbuf, 1), 0 );
2189
2190                 if( b->a_type == ACL_CONTINUE ) {
2191                         continue;
2192
2193                 } else if ( b->a_type == ACL_BREAK ) {
2194                         return ACL_BREAK;
2195
2196                 } else {
2197                         return ACL_STOP;
2198                 }
2199         }
2200
2201         /* implicit "by * none" clause */
2202         ACL_INIT(*mask);
2203
2204         Debug( LDAP_DEBUG_ACL,
2205                 "<= acl_mask: no more <who> clauses, returning %s (stop)\n",
2206                 accessmask2str(*mask, accessmaskbuf, 1), 0, 0 );
2207         return ACL_STOP;
2208 }
2209
2210 /*
2211  * acl_check_modlist - check access control on the given entry to see if
2212  * it allows the given modifications by the user associated with op.
2213  * returns      1       if mods allowed ok
2214  *              0       mods not allowed
2215  */
2216
2217 int
2218 acl_check_modlist(
2219         Operation       *op,
2220         Entry   *e,
2221         Modifications   *mlist
2222 )
2223 {
2224         struct berval *bv;
2225         AccessControlState state = ACL_STATE_INIT;
2226         Backend *be;
2227         int be_null = 0;
2228         int ret = 1; /* default is access allowed */
2229
2230         be = op->o_bd;
2231         if ( be == NULL ) {
2232                 be = LDAP_STAILQ_FIRST(&backendDB);
2233                 be_null = 1;
2234                 op->o_bd = be;
2235         }
2236         assert( be != NULL );
2237
2238         /* short circuit root database access */
2239         if ( be_isroot( op ) ) {
2240                 Debug( LDAP_DEBUG_ACL,
2241                         "<= acl_access_allowed: granted to database root\n",
2242                     0, 0, 0 );
2243                 goto done;
2244         }
2245
2246         /* use backend default access if no backend acls */
2247         if( op->o_bd != NULL && op->o_bd->be_acl == NULL ) {
2248                 Debug( LDAP_DEBUG_ACL,
2249                         "=> access_allowed: backend default %s access %s to \"%s\"\n",
2250                         access2str( ACL_WRITE ),
2251                         op->o_bd->be_dfltaccess >= ACL_WRITE
2252                                 ? "granted" : "denied",
2253                         op->o_dn.bv_val );
2254                 ret = (op->o_bd->be_dfltaccess >= ACL_WRITE);
2255                 goto done;
2256         }
2257
2258         for ( ; mlist != NULL; mlist = mlist->sml_next ) {
2259                 /*
2260                  * no-user-modification operational attributes are ignored
2261                  * by ACL_WRITE checking as any found here are not provided
2262                  * by the user
2263                  */
2264                 if ( is_at_no_user_mod( mlist->sml_desc->ad_type ) ) {
2265                         Debug( LDAP_DEBUG_ACL, "acl: no-user-mod %s:"
2266                                 " modify access granted\n",
2267                                 mlist->sml_desc->ad_cname.bv_val, 0, 0 );
2268                         continue;
2269                 }
2270
2271                 switch ( mlist->sml_op ) {
2272                 case LDAP_MOD_REPLACE:
2273                         /*
2274                          * We must check both permission to delete the whole
2275                          * attribute and permission to add the specific attributes.
2276                          * This prevents abuse from selfwriters.
2277                          */
2278                         if ( ! access_allowed( op, e,
2279                                 mlist->sml_desc, NULL, ACL_WDEL, &state ) )
2280                         {
2281                                 ret = 0;
2282                                 goto done;
2283                         }
2284
2285                         if ( mlist->sml_values == NULL ) break;
2286
2287                         /* fall thru to check value to add */
2288
2289                 case LDAP_MOD_ADD:
2290                         assert( mlist->sml_values != NULL );
2291
2292                         for ( bv = mlist->sml_nvalues
2293                                         ? mlist->sml_nvalues : mlist->sml_values;
2294                                 bv->bv_val != NULL; bv++ )
2295                         {
2296                                 if ( ! access_allowed( op, e,
2297                                         mlist->sml_desc, bv, ACL_WADD, &state ) )
2298                                 {
2299                                         ret = 0;
2300                                         goto done;
2301                                 }
2302                         }
2303                         break;
2304
2305                 case LDAP_MOD_DELETE:
2306                         if ( mlist->sml_values == NULL ) {
2307                                 if ( ! access_allowed( op, e,
2308                                         mlist->sml_desc, NULL, ACL_WDEL, NULL ) )
2309                                 {
2310                                         ret = 0;
2311                                         goto done;
2312                                 }
2313                                 break;
2314                         }
2315                         for ( bv = mlist->sml_nvalues
2316                                         ? mlist->sml_nvalues : mlist->sml_values;
2317                                 bv->bv_val != NULL; bv++ )
2318                         {
2319                                 if ( ! access_allowed( op, e,
2320                                         mlist->sml_desc, bv, ACL_WDEL, &state ) )
2321                                 {
2322                                         ret = 0;
2323                                         goto done;
2324                                 }
2325                         }
2326                         break;
2327
2328                 case SLAP_MOD_SOFTADD:
2329                         /* allow adding attribute via modrdn thru */
2330                         break;
2331
2332                 default:
2333                         assert( 0 );
2334                         /* not reached */
2335                         ret = 0;
2336                         break;
2337                 }
2338         }
2339
2340 done:
2341         if (be_null) op->o_bd = NULL;
2342         return( ret );
2343 }
2344
2345 static int
2346 aci_get_part(
2347         struct berval   *list,
2348         int             ix,
2349         char            sep,
2350         struct berval   *bv )
2351 {
2352         int     len;
2353         char    *p;
2354
2355         if ( bv ) {
2356                 BER_BVZERO( bv );
2357         }
2358         len = list->bv_len;
2359         p = list->bv_val;
2360         while ( len >= 0 && --ix >= 0 ) {
2361                 while ( --len >= 0 && *p++ != sep )
2362                         ;
2363         }
2364         while ( len >= 0 && *p == ' ' ) {
2365                 len--;
2366                 p++;
2367         }
2368         if ( len < 0 ) {
2369                 return -1;
2370         }
2371
2372         if ( !bv ) {
2373                 return 0;
2374         }
2375
2376         bv->bv_val = p;
2377         while ( --len >= 0 && *p != sep ) {
2378                 bv->bv_len++;
2379                 p++;
2380         }
2381         while ( bv->bv_len > 0 && *--p == ' ' ) {
2382                 bv->bv_len--;
2383         }
2384
2385         return bv->bv_len;
2386 }
2387
2388 typedef struct aci_set_gather_t {
2389         SetCookie               *cookie;
2390         BerVarray               bvals;
2391 } aci_set_gather_t;
2392
2393 static int
2394 aci_set_cb_gather( Operation *op, SlapReply *rs )
2395 {
2396         aci_set_gather_t        *p = (aci_set_gather_t *)op->o_callback->sc_private;
2397
2398         if ( rs->sr_type == REP_SEARCH ) {
2399                 BerValue        bvals[ 2 ];
2400                 BerVarray       bvalsp = NULL;
2401                 int             j;
2402
2403                 for ( j = 0; !BER_BVISNULL( &rs->sr_attrs[ j ].an_name ); j++ ) {
2404                         AttributeDescription    *desc = rs->sr_attrs[ j ].an_desc;
2405
2406                         if ( desc == slap_schema.si_ad_entryDN ) {
2407                                 bvalsp = bvals;
2408                                 bvals[ 0 ] = rs->sr_entry->e_nname;
2409                                 BER_BVZERO( &bvals[ 1 ] );
2410
2411                         } else {
2412                                 Attribute       *a;
2413
2414                                 a = attr_find( rs->sr_entry->e_attrs, desc );
2415                                 if ( a != NULL ) {
2416                                         int     i;
2417
2418                                         for ( i = 0; !BER_BVISNULL( &a->a_nvals[ i ] ); i++ )
2419                                                 ;
2420
2421                                         bvalsp = a->a_nvals;
2422                                 }
2423                         }
2424                 }
2425
2426                 if ( bvals ) {
2427                         p->bvals = slap_set_join( p->cookie, p->bvals,
2428                                         ( '|' | SLAP_SET_RREF ), bvalsp );
2429                 }
2430
2431         } else {
2432                 assert( rs->sr_type == REP_RESULT );
2433         }
2434
2435         return 0;
2436 }
2437
2438 BerVarray
2439 aci_set_gather( SetCookie *cookie, struct berval *name, AttributeDescription *desc )
2440 {
2441         AciSetCookie            *cp = (AciSetCookie *)cookie;
2442         int                     rc = 0;
2443         LDAPURLDesc             *ludp = NULL;
2444         Operation               op2 = { 0 };
2445         SlapReply               rs = {REP_RESULT};
2446         AttributeName           anlist[ 2 ], *anlistp = NULL;
2447         int                     nattrs = 0;
2448         slap_callback           cb = { NULL, aci_set_cb_gather, NULL, NULL };
2449         aci_set_gather_t        p = { 0 };
2450         const char              *text = NULL;
2451         static struct berval    defaultFilter_bv = BER_BVC( "(objectClass=*)" );
2452
2453         /* this routine needs to return the bervals instead of
2454          * plain strings, since syntax is not known.  It should
2455          * also return the syntax or some "comparison cookie".
2456          */
2457         if ( strncasecmp( name->bv_val, "ldap:///", STRLENOF( "ldap:///" ) ) != 0 ) {
2458                 return aci_set_gather2( cookie, name, desc );
2459         }
2460
2461         rc = ldap_url_parse( name->bv_val, &ludp );
2462         if ( rc != LDAP_URL_SUCCESS ) {
2463                 rc = LDAP_PROTOCOL_ERROR;
2464                 goto url_done;
2465         }
2466
2467         if ( ( ludp->lud_host && ludp->lud_host[0] ) || ludp->lud_exts )
2468         {
2469                 /* host part must be empty */
2470                 /* extensions parts must be empty */
2471                 rc = LDAP_PROTOCOL_ERROR;
2472                 goto url_done;
2473         }
2474
2475         /* Grab the searchbase and see if an appropriate database can be found */
2476         ber_str2bv( ludp->lud_dn, 0, 0, &op2.o_req_dn );
2477         rc = dnNormalize( 0, NULL, NULL, &op2.o_req_dn,
2478                         &op2.o_req_ndn, cp->op->o_tmpmemctx );
2479         BER_BVZERO( &op2.o_req_dn );
2480         if ( rc != LDAP_SUCCESS ) {
2481                 goto url_done;
2482         }
2483
2484         op2.o_bd = select_backend( &op2.o_req_ndn, 0, 1 );
2485         if ( ( op2.o_bd == NULL ) || ( op2.o_bd->be_search == NULL ) ) {
2486                 rc = LDAP_NO_SUCH_OBJECT;
2487                 goto url_done;
2488         }
2489
2490         /* Grab the filter */
2491         if ( ludp->lud_filter ) {
2492                 ber_str2bv_x( ludp->lud_filter, 0, 0, &op2.ors_filterstr,
2493                                 cp->op->o_tmpmemctx );
2494
2495         } else {
2496                 op2.ors_filterstr = defaultFilter_bv;
2497         }
2498
2499         op2.ors_filter = str2filter_x( cp->op, op2.ors_filterstr.bv_val );
2500         if ( op2.ors_filter == NULL ) {
2501                 rc = LDAP_PROTOCOL_ERROR;
2502                 goto url_done;
2503         }
2504
2505         /* Grab the scope */
2506         op2.ors_scope = ludp->lud_scope;
2507
2508         /* Grap the attributes */
2509         if ( ludp->lud_attrs ) {
2510                 for ( ; ludp->lud_attrs[ nattrs ]; nattrs++ )
2511                         ;
2512
2513                 anlistp = slap_sl_malloc( sizeof( AttributeName ) * ( nattrs + 2 ),
2514                                 cp->op->o_tmpmemctx );
2515
2516                 for ( ; ludp->lud_attrs[ nattrs ]; nattrs++ ) {
2517                         ber_str2bv( ludp->lud_attrs[ nattrs ], 0, 0, &anlistp[ nattrs ].an_name );
2518                         anlistp[ nattrs ].an_desc = NULL;
2519                         rc = slap_bv2ad( &anlistp[ nattrs ].an_name,
2520                                         &anlistp[ nattrs ].an_desc, &text );
2521                         if ( rc != LDAP_SUCCESS ) {
2522                                 goto url_done;
2523                         }
2524                 }
2525
2526         } else {
2527                 anlistp = anlist;
2528         }
2529
2530         anlistp[ nattrs ].an_name = desc->ad_cname;
2531         anlistp[ nattrs ].an_desc = desc;
2532
2533         BER_BVZERO( &anlistp[ nattrs + 1 ].an_name );
2534
2535         p.cookie = cookie;
2536
2537         op2.o_hdr = cp->op->o_hdr;
2538         op2.o_tag = LDAP_REQ_SEARCH;
2539         op2.o_ndn = op2.o_bd->be_rootndn;
2540         op2.o_callback = &cb;
2541         op2.o_time = slap_get_time();
2542         op2.o_do_not_cache = 1;
2543         op2.o_is_auth_check = 0;
2544         ber_dupbv_x( &op2.o_req_dn, &op2.o_req_ndn, cp->op->o_tmpmemctx );
2545         op2.ors_slimit = SLAP_NO_LIMIT;
2546         op2.ors_tlimit = SLAP_NO_LIMIT;
2547         op2.ors_attrs = anlistp;
2548         op2.ors_attrsonly = 0;
2549         op2.o_private = cp->op->o_private;
2550
2551         cb.sc_private = &p;
2552
2553         rc = op2.o_bd->be_search( &op2, &rs );
2554         if ( rc != 0 ) {
2555                 goto url_done;
2556         }
2557
2558 url_done:;
2559         if ( op2.ors_filter ) {
2560                 filter_free_x( cp->op, op2.ors_filter );
2561         }
2562         if ( !BER_BVISNULL( &op2.o_req_ndn ) ) {
2563                 slap_sl_free( op2.o_req_ndn.bv_val, cp->op->o_tmpmemctx );
2564         }
2565         if ( !BER_BVISNULL( &op2.o_req_dn ) ) {
2566                 slap_sl_free( op2.o_req_dn.bv_val, cp->op->o_tmpmemctx );
2567         }
2568         if ( ludp ) {
2569                 ldap_free_urldesc( ludp );
2570         }
2571         if ( anlistp && anlistp != anlist ) {
2572                 slap_sl_free( anlistp, cp->op->o_tmpmemctx );
2573         }
2574
2575         return p.bvals;
2576 }
2577
2578 BerVarray
2579 aci_set_gather2( SetCookie *cookie, struct berval *name, AttributeDescription *desc )
2580 {
2581         AciSetCookie    *cp = (AciSetCookie *)cookie;
2582         BerVarray       bvals = NULL;
2583         struct berval   ndn;
2584         int             rc = 0;
2585
2586         /* this routine needs to return the bervals instead of
2587          * plain strings, since syntax is not known.  It should
2588          * also return the syntax or some "comparison cookie".
2589          */
2590         rc = dnNormalize( 0, NULL, NULL, name, &ndn, cp->op->o_tmpmemctx );
2591         if ( rc == LDAP_SUCCESS ) {
2592                 if ( desc == slap_schema.si_ad_entryDN ) {
2593                         bvals = (BerVarray)slap_sl_malloc( sizeof( BerValue ) * 2,
2594                                         cp->op->o_tmpmemctx );
2595                         bvals[ 0 ] = ndn;
2596                         BER_BVZERO( &bvals[ 1 ] );
2597                         BER_BVZERO( &ndn );
2598
2599                 } else {
2600                         backend_attribute( cp->op,
2601                                 cp->e, &ndn, desc, &bvals, ACL_NONE );
2602                 }
2603
2604                 if ( !BER_BVISNULL( &ndn ) ) {
2605                         slap_sl_free( ndn.bv_val, cp->op->o_tmpmemctx );
2606                 }
2607         }
2608
2609         return bvals;
2610 }
2611
2612 static int
2613 aci_match_set (
2614         struct berval *subj,
2615         Operation *op,
2616         Entry *e,
2617         int setref
2618 )
2619 {
2620         struct berval   set = BER_BVNULL;
2621         int             rc = 0;
2622         AciSetCookie    cookie;
2623
2624         if ( setref == 0 ) {
2625                 ber_dupbv_x( &set, subj, op->o_tmpmemctx );
2626
2627         } else {
2628                 struct berval           subjdn, ndn = BER_BVNULL;
2629                 struct berval           setat;
2630                 BerVarray               bvals;
2631                 const char              *text;
2632                 AttributeDescription    *desc = NULL;
2633
2634                 /* format of string is "entry/setAttrName" */
2635                 if ( aci_get_part( subj, 0, '/', &subjdn ) < 0 ) {
2636                         return 0;
2637                 }
2638
2639                 if ( aci_get_part( subj, 1, '/', &setat ) < 0 ) {
2640                         setat = aci_bv_set_attr;
2641                 }
2642
2643                 /*
2644                  * NOTE: dnNormalize honors the ber_len field
2645                  * as the length of the dn to be normalized
2646                  */
2647                 if ( slap_bv2ad( &setat, &desc, &text ) == LDAP_SUCCESS ) {
2648                         if ( dnNormalize( 0, NULL, NULL, &subjdn, &ndn, op->o_tmpmemctx ) == LDAP_SUCCESS )
2649                         {
2650                                 backend_attribute( op, e, &ndn, desc, &bvals, ACL_NONE );
2651                                 if ( bvals != NULL && !BER_BVISNULL( &bvals[0] ) ) {
2652                                         int     i;
2653
2654                                         set = bvals[0];
2655                                         BER_BVZERO( &bvals[0] );
2656                                         for ( i = 1; !BER_BVISNULL( &bvals[i] ); i++ )
2657                                                 /* count */ ;
2658                                         bvals[0].bv_val = bvals[i-1].bv_val;
2659                                         BER_BVZERO( &bvals[i-1] );
2660                                 }
2661                                 ber_bvarray_free_x( bvals, op->o_tmpmemctx );
2662                                 slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
2663                         }
2664                 }
2665         }
2666
2667         if ( !BER_BVISNULL( &set ) ) {
2668                 cookie.op = op;
2669                 cookie.e = e;
2670                 rc = ( slap_set_filter( aci_set_gather, (SetCookie *)&cookie, &set,
2671                         &op->o_ndn, &e->e_nname, NULL ) > 0 );
2672                 slap_sl_free( set.bv_val, op->o_tmpmemctx );
2673         }
2674
2675         return(rc);
2676 }
2677
2678 #ifdef SLAPD_ACI_ENABLED
2679 static int
2680 aci_list_map_rights(
2681         struct berval *list )
2682 {
2683         struct berval bv;
2684         slap_access_t mask;
2685         int i;
2686
2687         ACL_INIT(mask);
2688         for (i = 0; aci_get_part(list, i, ',', &bv) >= 0; i++) {
2689                 if (bv.bv_len <= 0)
2690                         continue;
2691                 switch (*bv.bv_val) {
2692                 case 'c':
2693                         ACL_PRIV_SET(mask, ACL_PRIV_COMPARE);
2694                         break;
2695                 case 's':
2696                         /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt defines
2697                          * the right 's' to mean "set", but in the examples states
2698                          * that the right 's' means "search".  The latter definition
2699                          * is used here.
2700                          */
2701                         ACL_PRIV_SET(mask, ACL_PRIV_SEARCH);
2702                         break;
2703                 case 'r':
2704                         ACL_PRIV_SET(mask, ACL_PRIV_READ);
2705                         break;
2706                 case 'w':
2707                         ACL_PRIV_SET(mask, ACL_PRIV_WRITE);
2708                         break;
2709                 case 'x':
2710                         /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt does not
2711                          * define any equivalent to the AUTH right, so I've just used
2712                          * 'x' for now.
2713                          */
2714                         ACL_PRIV_SET(mask, ACL_PRIV_AUTH);
2715                         break;
2716                 default:
2717                         break;
2718                 }
2719
2720         }
2721         return(mask);
2722 }
2723
2724 static int
2725 aci_list_has_attr(
2726         struct berval *list,
2727         const struct berval *attr,
2728         struct berval *val )
2729 {
2730         struct berval bv, left, right;
2731         int i;
2732
2733         for (i = 0; aci_get_part(list, i, ',', &bv) >= 0; i++) {
2734                 if (aci_get_part(&bv, 0, '=', &left) < 0
2735                         || aci_get_part(&bv, 1, '=', &right) < 0)
2736                 {
2737                         if (ber_bvstrcasecmp(attr, &bv) == 0)
2738                                 return(1);
2739                 } else if (val == NULL) {
2740                         if (ber_bvstrcasecmp(attr, &left) == 0)
2741                                 return(1);
2742                 } else {
2743                         if (ber_bvstrcasecmp(attr, &left) == 0) {
2744                                 /* this is experimental code that implements a
2745                                  * simple (prefix) match of the attribute value.
2746                                  * the ACI draft does not provide for aci's that
2747                                  * apply to specific values, but it would be
2748                                  * nice to have.  If the <attr> part of an aci's
2749                                  * rights list is of the form <attr>=<value>,
2750                                  * that means the aci applies only to attrs with
2751                                  * the given value.  Furthermore, if the attr is
2752                                  * of the form <attr>=<value>*, then <value> is
2753                                  * treated as a prefix, and the aci applies to
2754                                  * any value with that prefix.
2755                                  *
2756                                  * Ideally, this would allow r.e. matches.
2757                                  */
2758                                 if (aci_get_part(&right, 0, '*', &left) < 0
2759                                         || right.bv_len <= left.bv_len)
2760                                 {
2761                                         if (ber_bvstrcasecmp(val, &right) == 0)
2762                                                 return(1);
2763                                 } else if (val->bv_len >= left.bv_len) {
2764                                         if (strncasecmp( val->bv_val, left.bv_val, left.bv_len ) == 0)
2765                                                 return(1);
2766                                 }
2767                         }
2768                 }
2769         }
2770         return(0);
2771 }
2772
2773 static slap_access_t
2774 aci_list_get_attr_rights(
2775         struct berval *list,
2776         const struct berval *attr,
2777         struct berval *val )
2778 {
2779     struct berval bv;
2780     slap_access_t mask;
2781     int i;
2782
2783         /* loop through each rights/attr pair, skip first part (action) */
2784         ACL_INIT(mask);
2785         for (i = 1; aci_get_part(list, i + 1, ';', &bv) >= 0; i += 2) {
2786                 if (aci_list_has_attr(&bv, attr, val) == 0)
2787                         continue;
2788                 if (aci_get_part(list, i, ';', &bv) < 0)
2789                         continue;
2790                 mask |= aci_list_map_rights(&bv);
2791         }
2792         return(mask);
2793 }
2794
2795 static int
2796 aci_list_get_rights(
2797         struct berval *list,
2798         const struct berval *attr,
2799         struct berval *val,
2800         slap_access_t *grant,
2801         slap_access_t *deny )
2802 {
2803     struct berval perm, actn;
2804     slap_access_t *mask;
2805     int i, found;
2806
2807         if (attr == NULL || attr->bv_len == 0
2808                         || ber_bvstrcasecmp( attr, &aci_bv_entry ) == 0) {
2809                 attr = &aci_bv_br_entry;
2810         }
2811
2812         found = 0;
2813         ACL_INIT(*grant);
2814         ACL_INIT(*deny);
2815         /* loop through each permissions clause */
2816         for (i = 0; aci_get_part(list, i, '$', &perm) >= 0; i++) {
2817                 if (aci_get_part(&perm, 0, ';', &actn) < 0)
2818                         continue;
2819                 if (ber_bvstrcasecmp( &aci_bv_grant, &actn ) == 0) {
2820                         mask = grant;
2821                 } else if (ber_bvstrcasecmp( &aci_bv_deny, &actn ) == 0) {
2822                         mask = deny;
2823                 } else {
2824                         continue;
2825                 }
2826
2827                 found = 1;
2828                 *mask |= aci_list_get_attr_rights(&perm, attr, val);
2829                 *mask |= aci_list_get_attr_rights(&perm, &aci_bv_br_all, NULL);
2830         }
2831         return(found);
2832 }
2833
2834 static int
2835 aci_group_member (
2836         struct berval   *subj,
2837         struct berval   *defgrpoc,
2838         struct berval   *defgrpat,
2839         Operation       *op,
2840         Entry           *e,
2841         int             nmatch,
2842         regmatch_t      *matches
2843 )
2844 {
2845         struct berval subjdn;
2846         struct berval grpoc;
2847         struct berval grpat;
2848         ObjectClass *grp_oc = NULL;
2849         AttributeDescription *grp_ad = NULL;
2850         const char *text;
2851         int rc;
2852
2853         /* format of string is "group/objectClassValue/groupAttrName" */
2854         if (aci_get_part(subj, 0, '/', &subjdn) < 0) {
2855                 return(0);
2856         }
2857
2858         if (aci_get_part(subj, 1, '/', &grpoc) < 0) {
2859                 grpoc = *defgrpoc;
2860         }
2861
2862         if (aci_get_part(subj, 2, '/', &grpat) < 0) {
2863                 grpat = *defgrpat;
2864         }
2865
2866         rc = slap_bv2ad( &grpat, &grp_ad, &text );
2867         if( rc != LDAP_SUCCESS ) {
2868                 rc = 0;
2869                 goto done;
2870         }
2871         rc = 0;
2872
2873         grp_oc = oc_bvfind( &grpoc );
2874
2875         if (grp_oc != NULL && grp_ad != NULL ) {
2876                 char buf[ACL_BUF_SIZE];
2877                 struct berval bv, ndn;
2878                 bv.bv_len = sizeof( buf ) - 1;
2879                 bv.bv_val = (char *)&buf;
2880                 if ( string_expand(&bv, &subjdn,
2881                                 e->e_ndn, nmatch, matches) )
2882                 {
2883                         rc = LDAP_OTHER;
2884                         goto done;
2885                 }
2886                 if ( dnNormalize( 0, NULL, NULL, &bv, &ndn, op->o_tmpmemctx ) == LDAP_SUCCESS ) {
2887                         rc = ( backend_group( op, e, &ndn, &op->o_ndn,
2888                                 grp_oc, grp_ad ) == 0 );
2889                         slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
2890                 }
2891         }
2892
2893 done:
2894         return(rc);
2895 }
2896
2897 static int
2898 aci_mask(
2899         Operation               *op,
2900         Entry                   *e,
2901         AttributeDescription    *desc,
2902         struct berval           *val,
2903         struct berval           *aci,
2904         int                     nmatch,
2905         regmatch_t              *matches,
2906         slap_access_t           *grant,
2907         slap_access_t           *deny,
2908         slap_aci_scope_t        asserted_scope
2909 )
2910 {
2911         struct berval           bv, scope, perms, type, sdn;
2912         int                     rc;
2913
2914
2915         assert( !BER_BVISNULL( &desc->ad_cname ) );
2916
2917         /* parse an aci of the form:
2918                 oid # scope # action;rights;attr;rights;attr
2919                         $ action;rights;attr;rights;attr # type # subject
2920
2921            [NOTE: the following comment is very outdated,
2922            as the draft version it refers to (Ando, 2004-11-20)].
2923
2924            See draft-ietf-ldapext-aci-model-04.txt section 9.1 for
2925            a full description of the format for this attribute.
2926            Differences: "this" in the draft is "self" here, and
2927            "self" and "public" is in the position of type.
2928
2929            <scope> = {entry|children|subtree}
2930            <type> = {public|users|access-id|subtree|onelevel|children|
2931                      self|dnattr|group|role|set|set-ref}
2932
2933            This routine now supports scope={ENTRY,CHILDREN}
2934            with the semantics:
2935              - ENTRY applies to "entry" and "subtree";
2936              - CHILDREN aplies to "children" and "subtree"
2937          */
2938
2939         /* check that the aci has all 5 components */
2940         if ( aci_get_part( aci, 4, '#', NULL ) < 0 ) {
2941                 return 0;
2942         }
2943
2944         /* check that the aci family is supported */
2945         if ( aci_get_part( aci, 0, '#', &bv ) < 0 ) {
2946                 return 0;
2947         }
2948
2949         /* check that the scope matches */
2950         if ( aci_get_part( aci, 1, '#', &scope ) < 0 ) {
2951                 return 0;
2952         }
2953
2954         /* note: scope can be either ENTRY or CHILDREN;
2955          * they respectively match "entry" and "children" in bv
2956          * both match "subtree" */
2957         switch ( asserted_scope ) {
2958         case SLAP_ACI_SCOPE_ENTRY:
2959                 if ( ber_bvstrcasecmp( &scope, &aci_bv_entry ) != 0
2960                                 && ber_bvstrcasecmp( &scope, &aci_bv_subtree ) != 0 )
2961                 {
2962                         return 0;
2963                 }
2964                 break;
2965
2966         case SLAP_ACI_SCOPE_CHILDREN:
2967                 if ( ber_bvstrcasecmp( &scope, &aci_bv_children ) != 0
2968                                 && ber_bvstrcasecmp( &scope, &aci_bv_subtree ) != 0 )
2969                 {
2970                         return 0;
2971                 }
2972                 break;
2973
2974         default:
2975                 return 0;
2976         }
2977
2978         /* get the list of permissions clauses, bail if empty */
2979         if ( aci_get_part( aci, 2, '#', &perms ) <= 0 ) {
2980                 return 0;
2981         }
2982
2983         /* check if any permissions allow desired access */
2984         if ( aci_list_get_rights( &perms, &desc->ad_cname, val, grant, deny ) == 0 ) {
2985                 return 0;
2986         }
2987
2988         /* see if we have a DN match */
2989         if ( aci_get_part( aci, 3, '#', &type ) < 0 ) {
2990                 return 0;
2991         }
2992
2993         /* see if we have a public (i.e. anonymous) access */
2994         if ( ber_bvstrcasecmp( &aci_bv_public, &type ) == 0 ) {
2995                 return 1;
2996         }
2997
2998         /* otherwise require an identity */
2999         if ( BER_BVISNULL( &op->o_ndn ) || BER_BVISEMPTY( &op->o_ndn ) ) {
3000                 return 0;
3001         }
3002
3003         /* see if we have a users access */
3004         if ( ber_bvstrcasecmp( &aci_bv_users, &type ) == 0 ) {
3005                 return 1;
3006         }
3007
3008         /* NOTE: this may fail if a DN contains a valid '#' (unescaped);
3009          * just grab all the berval up to its end (ITS#3303).
3010          * NOTE: the problem could be solved by providing the DN with
3011          * the embedded '#' encoded as hexpairs: "cn=Foo#Bar" would
3012          * become "cn=Foo\23Bar" and be safely used by aci_mask(). */
3013 #if 0
3014         if ( aci_get_part( aci, 4, '#', &sdn ) < 0 ) {
3015                 return 0;
3016         }
3017 #endif
3018         sdn.bv_val = type.bv_val + type.bv_len + STRLENOF( "#" );
3019         sdn.bv_len = aci->bv_len - ( sdn.bv_val - aci->bv_val );
3020
3021         if ( ber_bvstrcasecmp( &aci_bv_access_id, &type ) == 0 ) {
3022                 struct berval ndn;
3023
3024                 rc = dnNormalize( 0, NULL, NULL, &sdn, &ndn, op->o_tmpmemctx );
3025                 if ( rc != LDAP_SUCCESS ) {
3026                         return 0;
3027                 }
3028
3029                 if ( dn_match( &op->o_ndn, &ndn ) ) {
3030                         rc = 1;
3031                 }
3032                 slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
3033
3034                 return rc;
3035
3036         } else if ( ber_bvstrcasecmp( &aci_bv_subtree, &type ) == 0 ) {
3037                 struct berval ndn;
3038
3039                 rc = dnNormalize( 0, NULL, NULL, &sdn, &ndn, op->o_tmpmemctx );
3040                 if ( rc != LDAP_SUCCESS ) {
3041                         return 0;
3042                 }
3043
3044                 if ( dnIsSuffix( &op->o_ndn, &ndn ) ) {
3045                         rc = 1;
3046                 }
3047                 slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
3048
3049                 return rc;
3050
3051         } else if ( ber_bvstrcasecmp( &aci_bv_onelevel, &type ) == 0 ) {
3052                 struct berval ndn, pndn;
3053
3054                 rc = dnNormalize( 0, NULL, NULL, &sdn, &ndn, op->o_tmpmemctx );
3055                 if ( rc != LDAP_SUCCESS ) {
3056                         return 0;
3057                 }
3058
3059                 dnParent( &ndn, &pndn );
3060
3061                 if ( dn_match( &op->o_ndn, &pndn ) ) {
3062                         rc = 1;
3063                 }
3064                 slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
3065
3066                 return rc;
3067
3068         } else if ( ber_bvstrcasecmp( &aci_bv_children, &type ) == 0 ) {
3069                 struct berval ndn;
3070
3071                 rc = dnNormalize( 0, NULL, NULL, &sdn, &ndn, op->o_tmpmemctx );
3072                 if ( rc != LDAP_SUCCESS ) {
3073                         return 0;
3074                 }
3075
3076                 if ( !dn_match( &op->o_ndn, &ndn )
3077                                 && dnIsSuffix( &op->o_ndn, &ndn ) )
3078                 {
3079                         rc = 1;
3080                 }
3081                 slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
3082
3083                 return rc;
3084
3085         } else if ( ber_bvstrcasecmp( &aci_bv_self, &type ) == 0 ) {
3086                 if ( dn_match( &op->o_ndn, &e->e_nname ) ) {
3087                         return 1;
3088                 }
3089
3090         } else if ( ber_bvstrcasecmp( &aci_bv_dnattr, &type ) == 0 ) {
3091                 Attribute               *at;
3092                 AttributeDescription    *ad = NULL;
3093                 const char              *text;
3094
3095                 rc = slap_bv2ad( &sdn, &ad, &text );
3096
3097                 if( rc != LDAP_SUCCESS ) {
3098                         return 0;
3099                 }
3100
3101                 rc = 0;
3102
3103                 for ( at = attrs_find( e->e_attrs, ad );
3104                                 at != NULL;
3105                                 at = attrs_find( at->a_next, ad ) )
3106                 {
3107                         if ( value_find_ex( ad,
3108                                 SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH |
3109                                         SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH,
3110                                 at->a_nvals,
3111                                 &op->o_ndn, op->o_tmpmemctx ) == 0 )
3112                         {
3113                                 rc = 1;
3114                                 break;
3115                         }
3116                 }
3117
3118                 return rc;
3119
3120         } else if ( ber_bvstrcasecmp( &aci_bv_group, &type ) == 0 ) {
3121                 if ( aci_group_member( &sdn, &aci_bv_group_class,
3122                                 &aci_bv_group_attr, op, e, nmatch, matches ) )
3123                 {
3124                         return 1;
3125                 }
3126
3127         } else if ( ber_bvstrcasecmp( &aci_bv_role, &type ) == 0 ) {
3128                 if ( aci_group_member( &sdn, &aci_bv_role_class,
3129                                 &aci_bv_role_attr, op, e, nmatch, matches ) )
3130                 {
3131                         return 1;
3132                 }
3133
3134         } else if ( ber_bvstrcasecmp( &aci_bv_set, &type ) == 0 ) {
3135                 if ( aci_match_set( &sdn, op, e, 0 ) ) {
3136                         return 1;
3137                 }
3138
3139         } else if ( ber_bvstrcasecmp( &aci_bv_set_ref, &type ) == 0 ) {
3140                 if ( aci_match_set( &sdn, op, e, 1 ) ) {
3141                         return 1;
3142                 }
3143         }
3144
3145         return 0;
3146 }
3147
3148 #ifdef SLAP_DYNACL
3149 /*
3150  * FIXME: there is a silly dependence that makes it difficult
3151  * to move ACIs in a run-time loadable module under the "dynacl"
3152  * umbrella, because sets share some helpers with ACIs.
3153  */
3154 static int
3155 dynacl_aci_parse( const char *fname, int lineno, slap_style_t sty, const char *right, void **privp )
3156 {
3157         AttributeDescription    *ad = NULL;
3158         const char              *text = NULL;
3159
3160         if ( sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE ) {
3161                 fprintf( stderr, "%s: line %d: "
3162                         "inappropriate style \"%s\" in \"aci\" by clause\n",
3163                         fname, lineno, sty );
3164                 return -1;
3165         }
3166
3167         if ( right != NULL && *right != '\0' ) {
3168                 if ( slap_str2ad( right, &ad, &text ) != LDAP_SUCCESS ) {
3169                         fprintf( stderr,
3170                                 "%s: line %d: aci \"%s\": %s\n",
3171                                 fname, lineno, right, text );
3172                         return -1;
3173                 }
3174
3175         } else {
3176                 ad = slap_schema.si_ad_aci;
3177         }
3178
3179         if ( !is_at_syntax( ad->ad_type, SLAPD_ACI_SYNTAX) ) {
3180                 fprintf( stderr, "%s: line %d: "
3181                         "aci \"%s\": inappropriate syntax: %s\n",
3182                         fname, lineno, right,
3183                         ad->ad_type->sat_syntax_oid );
3184                 return -1;
3185         }
3186
3187         *privp = (void *)ad;
3188
3189         return 0;
3190 }
3191
3192 static int
3193 dynacl_aci_unparse( void *priv, struct berval *bv )
3194 {
3195         AttributeDescription    *ad = ( AttributeDescription * )priv;
3196         char *ptr;
3197
3198         assert( ad );
3199
3200         bv->bv_val = ch_malloc( STRLENOF(" aci=") + ad->ad_cname.bv_len + 1 );
3201         ptr = lutil_strcopy( bv->bv_val, " aci=" );
3202         ptr = lutil_strcopy( ptr, ad->ad_cname.bv_val );
3203         bv->bv_len = ptr - bv->bv_val;
3204
3205         return 0;
3206 }
3207
3208
3209 static int
3210 dynacl_aci_mask(
3211                 void                    *priv,
3212                 Operation               *op,
3213                 Entry                   *e,
3214                 AttributeDescription    *desc,
3215                 struct berval           *val,
3216                 int                     nmatch,
3217                 regmatch_t              *matches,
3218                 slap_access_t           *grantp,
3219                 slap_access_t           *denyp )
3220 {
3221         AttributeDescription    *ad = ( AttributeDescription * )priv;
3222         Attribute               *at;
3223         slap_access_t           tgrant, tdeny, grant, deny;
3224 #ifdef LDAP_DEBUG
3225         char                    accessmaskbuf[ACCESSMASK_MAXLEN];
3226         char                    accessmaskbuf1[ACCESSMASK_MAXLEN];
3227 #endif /* LDAP_DEBUG */
3228
3229         /* start out with nothing granted, nothing denied */
3230         ACL_INIT(tgrant);
3231         ACL_INIT(tdeny);
3232
3233         /* get the aci attribute */
3234         at = attr_find( e->e_attrs, ad );
3235         if ( at != NULL ) {
3236                 int             i;
3237
3238                 /* the aci is an multi-valued attribute.  The
3239                  * rights are determined by OR'ing the individual
3240                  * rights given by the acis.
3241                  */
3242                 for ( i = 0; !BER_BVISNULL( &at->a_nvals[i] ); i++ ) {
3243                         if ( aci_mask( op, e, desc, val, &at->a_nvals[i],
3244                                         nmatch, matches, &grant, &deny,
3245                                         SLAP_ACI_SCOPE_ENTRY ) != 0 )
3246                         {
3247                                 tgrant |= grant;
3248                                 tdeny |= deny;
3249                         }
3250                 }
3251
3252                 Debug( LDAP_DEBUG_ACL, "<= aci_mask grant %s deny %s\n",
3253                           accessmask2str( tgrant, accessmaskbuf, 1 ),
3254                           accessmask2str( tdeny, accessmaskbuf1, 1 ), 0 );
3255         }
3256
3257         /* If the entry level aci didn't contain anything valid for the
3258          * current operation, climb up the tree and evaluate the
3259          * acis with scope set to subtree
3260          */
3261         if ( tgrant == ACL_PRIV_NONE && tdeny == ACL_PRIV_NONE ) {
3262                 struct berval   parent_ndn;
3263
3264 #if 1
3265                 /* to solve the chicken'n'egg problem of accessing
3266                  * the OpenLDAPaci attribute, the direct access
3267                  * to the entry's attribute is unchecked; however,
3268                  * further accesses to OpenLDAPaci values in the
3269                  * ancestors occur through backend_attribute(), i.e.
3270                  * with the identity of the operation, requiring
3271                  * further access checking.  For uniformity, this
3272                  * makes further requests occur as the rootdn, if
3273                  * any, i.e. searching for the OpenLDAPaci attribute
3274                  * is considered an internal search.  If this is not
3275                  * acceptable, then the same check needs be performed
3276                  * when accessing the entry's attribute. */
3277                 Operation       op2 = *op;
3278
3279                 if ( !BER_BVISNULL( &op->o_bd->be_rootndn ) ) {
3280                         op2.o_dn = op->o_bd->be_rootdn;
3281                         op2.o_ndn = op->o_bd->be_rootndn;
3282                 }
3283 #endif
3284
3285                 dnParent( &e->e_nname, &parent_ndn );
3286                 while ( !BER_BVISEMPTY( &parent_ndn ) ){
3287                         int             i;
3288                         BerVarray       bvals = NULL;
3289                         int             ret, stop;
3290
3291                         Debug( LDAP_DEBUG_ACL, "checking ACI of \"%s\"\n", parent_ndn.bv_val, 0, 0 );
3292                         ret = backend_attribute( &op2, NULL, &parent_ndn, ad, &bvals, ACL_AUTH );
3293
3294                         switch ( ret ) {
3295                         case LDAP_SUCCESS :
3296                                 stop = 0;
3297                                 if ( !bvals ) {
3298                                         break;
3299                                 }
3300
3301                                 for ( i = 0; !BER_BVISNULL( &bvals[i] ); i++) {
3302                                         if ( aci_mask( op, e, desc, val,
3303                                                         &bvals[i],
3304                                                         nmatch, matches,
3305                                                         &grant, &deny,
3306                                                         SLAP_ACI_SCOPE_CHILDREN ) != 0 )
3307                                         {
3308                                                 tgrant |= grant;
3309                                                 tdeny |= deny;
3310                                                 /* evaluation stops as soon as either a "deny" or a
3311                                                  * "grant" directive matches.
3312                                                  */
3313                                                 if ( tgrant != ACL_PRIV_NONE || tdeny != ACL_PRIV_NONE ) {
3314                                                         stop = 1;
3315                                                 }
3316                                         }
3317                                         Debug( LDAP_DEBUG_ACL, "<= aci_mask grant %s deny %s\n",
3318                                                 accessmask2str( tgrant, accessmaskbuf, 1 ),
3319                                                 accessmask2str( tdeny, accessmaskbuf1, 1 ), 0 );
3320                                 }
3321                                 break;
3322
3323                         case LDAP_NO_SUCH_ATTRIBUTE:
3324                                 /* just go on if the aci-Attribute is not present in
3325                                  * the current entry
3326                                  */
3327                                 Debug( LDAP_DEBUG_ACL, "no such attribute\n", 0, 0, 0 );
3328                                 stop = 0;
3329                                 break;
3330
3331                         case LDAP_NO_SUCH_OBJECT:
3332                                 /* We have reached the base object */
3333                                 Debug( LDAP_DEBUG_ACL, "no such object\n", 0, 0, 0 );
3334                                 stop = 1;
3335                                 break;
3336
3337                         default:
3338                                 stop = 1;
3339                                 break;
3340                         }
3341
3342                         if ( stop ) {
3343                                 break;
3344                         }
3345                         dnParent( &parent_ndn, &parent_ndn );
3346                 }
3347         }
3348
3349         *grantp = tgrant;
3350         *denyp = tdeny;
3351
3352         return 0;
3353 }
3354
3355 /* need to register this at some point */
3356 static slap_dynacl_t    dynacl_aci = {
3357         "aci",
3358         dynacl_aci_parse,
3359         dynacl_aci_unparse,
3360         dynacl_aci_mask,
3361         NULL,
3362         NULL,
3363         NULL
3364 };
3365
3366 #endif /* SLAP_DYNACL */
3367
3368 #endif  /* SLAPD_ACI_ENABLED */
3369
3370 #ifdef SLAP_DYNACL
3371
3372 /*
3373  * dynamic ACL infrastructure
3374  */
3375 static slap_dynacl_t    *da_list = NULL;
3376
3377 int
3378 slap_dynacl_register( slap_dynacl_t *da )
3379 {
3380         slap_dynacl_t   *tmp;
3381
3382         for ( tmp = da_list; tmp; tmp = tmp->da_next ) {
3383                 if ( strcasecmp( da->da_name, tmp->da_name ) == 0 ) {
3384                         break;
3385                 }
3386         }
3387
3388         if ( tmp != NULL ) {
3389                 return -1;
3390         }
3391
3392         if ( da->da_mask == NULL ) {
3393                 return -1;
3394         }
3395
3396         da->da_private = NULL;
3397         da->da_next = da_list;
3398         da_list = da;
3399
3400         return 0;
3401 }
3402
3403 static slap_dynacl_t *
3404 slap_dynacl_next( slap_dynacl_t *da )
3405 {
3406         if ( da ) {
3407                 return da->da_next;
3408         }
3409         return da_list;
3410 }
3411
3412 slap_dynacl_t *
3413 slap_dynacl_get( const char *name )
3414 {
3415         slap_dynacl_t   *da;
3416
3417         for ( da = slap_dynacl_next( NULL ); da; da = slap_dynacl_next( da ) ) {
3418                 if ( strcasecmp( da->da_name, name ) == 0 ) {
3419                         break;
3420                 }
3421         }
3422
3423         return da;
3424 }
3425 #endif /* SLAP_DYNACL */
3426
3427 int
3428 acl_init( void )
3429 {
3430         int             i, rc;
3431 #ifdef SLAP_DYNACL
3432         slap_dynacl_t   *known_dynacl[] = {
3433 #ifdef SLAPD_ACI_ENABLED
3434                 &dynacl_aci,
3435 #endif  /* SLAPD_ACI_ENABLED */
3436                 NULL
3437         };
3438
3439         for ( i = 0; known_dynacl[ i ]; i++ ) {
3440                 rc = slap_dynacl_register( known_dynacl[ i ] );
3441                 if ( rc ) {
3442                         return rc;
3443                 }
3444         }
3445 #endif /* SLAP_DYNACL */
3446
3447         return 0;
3448 }
3449
3450 static int
3451 string_expand(
3452         struct berval   *bv,
3453         struct berval   *pat,
3454         char            *match,
3455         int             nmatch,
3456         regmatch_t      *matches)
3457 {
3458         ber_len_t       size;
3459         char   *sp;
3460         char   *dp;
3461         int     flag;
3462
3463         size = 0;
3464         bv->bv_val[0] = '\0';
3465         bv->bv_len--; /* leave space for lone $ */
3466
3467         flag = 0;
3468         for ( dp = bv->bv_val, sp = pat->bv_val; size < bv->bv_len &&
3469                 sp < pat->bv_val + pat->bv_len ; sp++ )
3470         {
3471                 /* did we previously see a $ */
3472                 if ( flag ) {
3473                         if ( flag == 1 && *sp == '$' ) {
3474                                 *dp++ = '$';
3475                                 size++;
3476                                 flag = 0;
3477
3478                         } else if ( flag == 1 && *sp == '{' /*'}'*/) {
3479                                 flag = 2;
3480
3481                         } else if ( *sp >= '0' && *sp <= '9' ) {
3482                                 int     n;
3483                                 int     i;
3484                                 int     l;
3485
3486                                 n = *sp - '0';
3487
3488                                 if ( flag == 2 ) {
3489                                         for ( sp++; *sp != '\0' && *sp != /*'{'*/ '}'; sp++ ) {
3490                                                 if ( *sp >= '0' && *sp <= '9' ) {
3491                                                         n = 10*n + ( *sp - '0' );
3492                                                 }
3493                                         }
3494
3495                                         if ( *sp != /*'{'*/ '}' ) {
3496                                                 /* FIXME: error */
3497                                                 return 1;
3498                                         }
3499                                 }
3500
3501                                 if ( n >= nmatch ) {
3502                                         /* FIXME: error */
3503                                         return 1;
3504                                 }
3505
3506                                 *dp = '\0';
3507                                 i = matches[n].rm_so;
3508                                 l = matches[n].rm_eo;
3509                                 for ( ; size < bv->bv_len && i < l; size++, i++ ) {
3510                                         *dp++ = match[i];
3511                                 }
3512                                 *dp = '\0';
3513
3514                                 flag = 0;
3515                         }
3516                 } else {
3517                         if (*sp == '$') {
3518                                 flag = 1;
3519                         } else {
3520                                 *dp++ = *sp;
3521                                 size++;
3522                         }
3523                 }
3524         }
3525
3526         if ( flag ) {
3527                 /* must have ended with a single $ */
3528                 *dp++ = '$';
3529                 size++;
3530         }
3531
3532         *dp = '\0';
3533         bv->bv_len = size;
3534
3535         Debug( LDAP_DEBUG_TRACE, "=> string_expand: pattern:  %.*s\n", (int)pat->bv_len, pat->bv_val, 0 );
3536         Debug( LDAP_DEBUG_TRACE, "=> string_expand: expanded: %s\n", bv->bv_val, 0, 0 );
3537
3538         return 0;
3539 }
3540
3541 static int
3542 regex_matches(
3543         struct berval   *pat,           /* pattern to expand and match against */
3544         char            *str,           /* string to match against pattern */
3545         char            *buf,           /* buffer with $N expansion variables */
3546         int             nmatch, /* size of the matches array */
3547         regmatch_t      *matches        /* offsets in buffer for $N expansion variables */
3548 )
3549 {
3550         regex_t re;
3551         char newbuf[ACL_BUF_SIZE];
3552         struct berval bv;
3553         int     rc;
3554
3555         bv.bv_len = sizeof( newbuf ) - 1;
3556         bv.bv_val = newbuf;
3557
3558         if (str == NULL) {
3559                 str = "";
3560         };
3561
3562         string_expand( &bv, pat, buf, nmatch, matches );
3563         rc = regcomp( &re, newbuf, REG_EXTENDED|REG_ICASE );
3564         if ( rc ) {
3565                 char error[ACL_BUF_SIZE];
3566                 regerror( rc, &re, error, sizeof( error ) );
3567
3568                 Debug( LDAP_DEBUG_TRACE,
3569                     "compile( \"%s\", \"%s\") failed %s\n",
3570                         pat->bv_val, str, error );
3571                 return( 0 );
3572         }
3573
3574         rc = regexec( &re, str, 0, NULL, 0 );
3575         regfree( &re );
3576
3577         Debug( LDAP_DEBUG_TRACE,
3578             "=> regex_matches: string:   %s\n", str, 0, 0 );
3579         Debug( LDAP_DEBUG_TRACE,
3580             "=> regex_matches: rc: %d %s\n",
3581                 rc, !rc ? "matches" : "no matches", 0 );
3582         return( !rc );
3583 }
3584