git.sur5r.net Git - openldap/blob - servers/slapd/acl.c

   1 /* acl.c - routines to parse and check acl's */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 1998-2004 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
  17  * All rights reserved.
  18  *
  19  * Redistribution and use in source and binary forms are permitted
  20  * provided that this notice is preserved and that due credit is given
  21  * to the University of Michigan at Ann Arbor. The name of the University
  22  * may not be used to endorse or promote products derived from this
  23  * software without specific prior written permission. This software
  24  * is provided ``as is'' without express or implied warranty.
  25  */
  26
  27 #include "portable.h"
  28
  29 #include <stdio.h>
  30
  31 #include <ac/regex.h>
  32 #include <ac/socket.h>
  33 #include <ac/string.h>
  34
  35 #include "slap.h"
  36 #include "sets.h"
  37 #include "lber_pvt.h"
  38
  39 #ifdef LDAP_SLAPI
  40 #include "slapi/slapi.h"
  41 #endif /* LDAPI_SLAPI */
  42
  43 #define ACL_BUF_SIZE    1024    /* use most appropriate size */
  44
  45 /*
  46  * speed up compares
  47  */
  48 static struct berval
  49         aci_bv_entry            = BER_BVC("entry"),
  50         aci_bv_children         = BER_BVC("children"),
  51         aci_bv_br_entry         = BER_BVC("[entry]"),
  52         aci_bv_br_all           = BER_BVC("[all]"),
  53         aci_bv_access_id        = BER_BVC("access-id"),
  54         aci_bv_anonymous        = BER_BVC("anonymous"),
  55         aci_bv_public           = BER_BVC("public"),
  56         aci_bv_users            = BER_BVC("users"),
  57         aci_bv_self             = BER_BVC("self"),
  58         aci_bv_dnattr           = BER_BVC("dnattr"),
  59         aci_bv_group            = BER_BVC("group"),
  60         aci_bv_role             = BER_BVC("role"),
  61         aci_bv_set              = BER_BVC("set"),
  62         aci_bv_set_ref          = BER_BVC("set-ref"),
  63         aci_bv_grant            = BER_BVC("grant"),
  64         aci_bv_deny             = BER_BVC("deny"),
  65
  66         aci_bv_ip_eq            = BER_BVC("IP="),
  67 #ifdef LDAP_PF_LOCAL
  68         aci_bv_path_eq          = BER_BVC("PATH="),
  69         aci_bv_dirsep           = BER_BVC(LDAP_DIRSEP),
  70 #endif /* LDAP_PF_LOCAL */
  71
  72         aci_bv_group_class      = BER_BVC(SLAPD_GROUP_CLASS),
  73         aci_bv_group_attr       = BER_BVC(SLAPD_GROUP_ATTR),
  74         aci_bv_role_class       = BER_BVC(SLAPD_ROLE_CLASS),
  75         aci_bv_role_attr        = BER_BVC(SLAPD_ROLE_ATTR);
  76
  77
  78 static AccessControl * acl_get(
  79         AccessControl *ac, int *count,
  80         Operation *op, Entry *e,
  81         AttributeDescription *desc,
  82         struct berval *val,
  83         int nmatches, regmatch_t *matches );
  84
  85 static slap_control_t acl_mask(
  86         AccessControl *ac, slap_mask_t *mask,
  87         Operation *op, Entry *e,
  88         AttributeDescription *desc,
  89         struct berval *val,
  90         regmatch_t *matches,
  91         int count,
  92         AccessControlState *state );
  93
  94 #ifdef SLAPD_ACI_ENABLED
  95 static int aci_mask(
  96         Operation *op, Entry *e,
  97         AttributeDescription *desc,
  98         struct berval *val,
  99         struct berval *aci,
 100         regmatch_t *matches,
 101         slap_access_t *grant,
 102         slap_access_t *deny,
 103         struct berval *scope);
 104 #endif
 105
 106 static int      regex_matches(
 107         struct berval *pat, char *str, char *buf, regmatch_t *matches);
 108 static void     string_expand(
 109         struct berval *newbuf, struct berval *pattern,
 110         char *match, regmatch_t *matches);
 111
 112 typedef struct AciSetCookie {
 113         Operation *op;
 114         Entry *e;
 115 } AciSetCookie;
 116
 117 SLAP_SET_GATHER aci_set_gather;
 118 static int aci_match_set ( struct berval *subj, Operation *op,
 119     Entry *e, int setref );
 120
 121 /*
 122  * access_allowed - check whether op->o_ndn is allowed the requested access
 123  * to entry e, attribute attr, value val.  if val is null, access to
 124  * the whole attribute is assumed (all values).
 125  *
 126  * This routine loops through all access controls and calls
 127  * acl_mask() on each applicable access control.
 128  * The loop exits when a definitive answer is reached or
 129  * or no more controls remain.
 130  *
 131  * returns:
 132  *              0       access denied
 133  *              1       access granted
 134  */
 135
 136 int
 137 access_allowed(
 138         Operation               *op,
 139         Entry           *e,
 140         AttributeDescription    *desc,
 141         struct berval   *val,
 142         slap_access_t   access,
 143         AccessControlState *state )
 144 {
 145         int                             ret = 1;
 146         int                             count;
 147         AccessControl                   *a = NULL;
 148         Backend *be;
 149         int     be_null = 0;
 150
 151 #ifdef LDAP_DEBUG
 152         char accessmaskbuf[ACCESSMASK_MAXLEN];
 153 #endif
 154         slap_mask_t mask;
 155         slap_control_t control;
 156         const char *attr;
 157         regmatch_t matches[MAXREMATCHES];
 158         int        st_same_attr = 0;
 159         int        st_initialized = 0;
 160         static AccessControlState state_init = ACL_STATE_INIT;
 161
 162         assert( e != NULL );
 163         assert( desc != NULL );
 164         assert( access > ACL_NONE );
 165
 166         attr = desc->ad_cname.bv_val;
 167
 168         assert( attr != NULL );
 169
 170         if( op && op->o_is_auth_check &&
 171                 ( access == ACL_SEARCH || access == ACL_READ ))
 172         {
 173                 access = ACL_AUTH;
 174         }
 175
 176         if( state && state->as_recorded && state->as_vd_ad==desc) {
 177                 if( state->as_recorded & ACL_STATE_RECORDED_NV &&
 178                         val == NULL )
 179                 {
 180                         return state->as_result;
 181
 182                 } else if ( state->as_recorded & ACL_STATE_RECORDED_VD &&
 183                         val != NULL && state->as_vd_acl == NULL )
 184                 {
 185                         return state->as_result;
 186                 }
 187                 st_same_attr = 1;
 188         }
 189
 190         if( state ) {
 191                 state->as_vd_ad=desc;
 192         }
 193
 194 #ifdef NEW_LOGGING
 195         LDAP_LOG( ACL, ENTRY,
 196                 "access_allowed: %s access to \"%s\" \"%s\" requested\n",
 197                 access2str( access ), e->e_dn, attr );
 198 #else
 199         Debug( LDAP_DEBUG_ACL,
 200                 "=> access_allowed: %s access to \"%s\" \"%s\" requested\n",
 201             access2str( access ), e->e_dn, attr );
 202 #endif
 203
 204         if ( op == NULL ) {
 205                 /* no-op call */
 206                 goto done;
 207         }
 208
 209         be = op->o_bd;
 210         if ( be == NULL ) {
 211                 be = &backends[0];
 212                 be_null = 1;
 213                 op->o_bd = be;
 214         }
 215         assert( be != NULL );
 216
 217 #ifdef LDAP_SLAPI
 218         if ( op->o_pb != NULL ) {
 219                 ret = slapi_int_access_allowed( op, e, desc, val, access, state );
 220                 if ( ret == 0 ) {
 221                         /* ACL plugin denied access */
 222                         goto done;
 223                 }
 224         }
 225 #endif /* LDAP_SLAPI */
 226
 227         /* grant database root access */
 228         if ( be != NULL && be_isroot( be, &op->o_ndn ) ) {
 229 #ifdef NEW_LOGGING
 230                 LDAP_LOG( ACL, INFO,
 231                         "access_allowed: conn %lu root access granted\n",
 232                         op->o_connid, 0, 0 );
 233 #else
 234                 Debug( LDAP_DEBUG_ACL,
 235                     "<= root access granted\n",
 236                         0, 0, 0 );
 237 #endif
 238                 goto done;
 239         }
 240
 241         /*
 242          * no-user-modification operational attributes are ignored
 243          * by ACL_WRITE checking as any found here are not provided
 244          * by the user
 245          */
 246         if ( access >= ACL_WRITE && is_at_no_user_mod( desc->ad_type )
 247                 && desc != slap_schema.si_ad_entry
 248                 && desc != slap_schema.si_ad_children )
 249         {
 250 #ifdef NEW_LOGGING
 251                 LDAP_LOG( ACL, DETAIL1,
 252                         "access_allowed: conn %lu NoUserMod Operational attribute: %s "
 253                         "access granted\n", op->o_connid, attr , 0 );
 254 #else
 255                 Debug( LDAP_DEBUG_ACL, "NoUserMod Operational attribute:"
 256                         " %s access granted\n",
 257                         attr, 0, 0 );
 258 #endif
 259                 goto done;
 260         }
 261
 262         /* use backend default access if no backend acls */
 263         if( be != NULL && be->be_acl == NULL ) {
 264 #ifdef NEW_LOGGING
 265                 LDAP_LOG( ACL, DETAIL1,
 266                         "access_allowed: backend default %s access %s to \"%s\"\n",
 267                     access2str( access ),
 268                     be->be_dfltaccess >= access ? "granted" : "denied",
 269                         op->o_dn.bv_val ? op->o_dn.bv_val : "(anonymous)" );
 270 #else
 271                 Debug( LDAP_DEBUG_ACL,
 272                         "=> access_allowed: backend default %s access %s to \"%s\"\n",
 273                         access2str( access ),
 274                         be->be_dfltaccess >= access ? "granted" : "denied",
 275                         op->o_dn.bv_val ? op->o_dn.bv_val : "(anonymous)" );
 276 #endif
 277                 ret = be->be_dfltaccess >= access;
 278                 goto done;
 279
 280 #ifdef notdef
 281         /* be is always non-NULL */
 282         /* use global default access if no global acls */
 283         } else if ( be == NULL && global_acl == NULL ) {
 284 #ifdef NEW_LOGGING
 285                 LDAP_LOG( ACL, DETAIL1,
 286                         "access_allowed: global default %s access %s to \"%s\"\n",
 287                     access2str( access ),
 288                     global_default_access >= access ? "granted" : "denied",
 289                         op->o_dn.bv_val );
 290 #else
 291                 Debug( LDAP_DEBUG_ACL,
 292                         "=> access_allowed: global default %s access %s to \"%s\"\n",
 293                         access2str( access ),
 294                         global_default_access >= access ? "granted" : "denied", op->o_dn.bv_val );
 295 #endif
 296                 ret = global_default_access >= access;
 297                 goto done;
 298 #endif
 299         }
 300
 301         ret = 0;
 302         control = ACL_BREAK;
 303
 304         if( st_same_attr ) {
 305                 assert( state->as_vd_acl != NULL );
 306
 307                 a = state->as_vd_acl;
 308                 mask = state->as_vd_acl_mask;
 309                 count = state->as_vd_acl_count;
 310                 AC_MEMCPY( matches, state->as_vd_acl_matches, sizeof(matches) );
 311                 goto vd_access;
 312
 313         } else {
 314                 if ( state ) state->as_vi_acl = NULL;
 315                 a = NULL;
 316                 ACL_INIT(mask);
 317                 count = 0;
 318                 memset(matches, '\0', sizeof(matches));
 319         }
 320
 321         while((a = acl_get( a, &count, op, e, desc, val,
 322                 MAXREMATCHES, matches )) != NULL)
 323         {
 324                 int i;
 325
 326                 for (i = 0; i < MAXREMATCHES && matches[i].rm_so > 0; i++) {
 327 #ifdef NEW_LOGGING
 328                         LDAP_LOG( ACL, DETAIL1,
 329                                 "access_allowed: match[%d]:  %d %d ",
 330                             i, (int)matches[i].rm_so, (int)matches[i].rm_eo );
 331 #else
 332                         Debug( LDAP_DEBUG_ACL, "=> match[%d]: %d %d ", i,
 333                             (int)matches[i].rm_so, (int)matches[i].rm_eo );
 334 #endif
 335                         if( matches[i].rm_so <= matches[0].rm_eo ) {
 336                                 int n;
 337                                 for ( n = matches[i].rm_so; n < matches[i].rm_eo; n++) {
 338                                         Debug( LDAP_DEBUG_ACL, "%c", e->e_ndn[n], 0, 0 );
 339                                 }
 340                         }
 341 #ifdef NEW_LOGGING
 342                         LDAP_LOG( ACL, ARGS, "\n" , 0, 0, 0 );
 343 #else
 344                         Debug( LDAP_DEBUG_ARGS, "\n", 0, 0, 0 );
 345 #endif
 346                 }
 347
 348                 if (state) {
 349                         if (state->as_vi_acl == a && (state->as_recorded & ACL_STATE_RECORDED_NV)) {
 350                                 Debug( LDAP_DEBUG_ACL, "access_allowed: result from state (%s)\n", attr, 0, 0 );
 351                                 ret = state->as_result;
 352                                 goto done;
 353                         } else if (!st_initialized) {
 354                                 Debug( LDAP_DEBUG_ACL, "access_allowed: no res from state (%s)\n", attr, 0, 0);
 355                             *state = state_init;
 356                                 state->as_vd_ad=desc;
 357                                 st_initialized=1;
 358                         }
 359                 }
 360
 361 vd_access:
 362                 control = acl_mask( a, &mask, op,
 363                         e, desc, val, matches, count, state );
 364
 365                 if ( control != ACL_BREAK ) {
 366                         break;
 367                 }
 368
 369                 memset(matches, '\0', sizeof(matches));
 370         }
 371
 372         if ( ACL_IS_INVALID( mask ) ) {
 373 #ifdef NEW_LOGGING
 374                 LDAP_LOG( ACL, DETAIL1,
 375                         "access_allowed: conn %lu \"%s\" (%s) invalid!\n",
 376                     op->o_connid, e->e_dn, attr );
 377 #else
 378                 Debug( LDAP_DEBUG_ACL,
 379                         "=> access_allowed: \"%s\" (%s) invalid!\n",
 380                         e->e_dn, attr, 0 );
 381 #endif
 382                 ACL_INIT(mask);
 383
 384         } else if ( control == ACL_BREAK ) {
 385 #ifdef NEW_LOGGING
 386                 LDAP_LOG( ACL, DETAIL1,
 387                         "access_allowed: conn %lu        no more rules\n", op->o_connid, 0,0 );
 388 #else
 389                 Debug( LDAP_DEBUG_ACL,
 390                         "=> access_allowed: no more rules\n", 0, 0, 0);
 391 #endif
 392
 393                 goto done;
 394         }
 395
 396 #ifdef NEW_LOGGING
 397         LDAP_LOG( ACL, ENTRY,
 398                 "access_allowed: %s access %s by %s\n",
 399                 access2str( access ), ACL_GRANT( mask, access ) ? "granted" : "denied",
 400                 accessmask2str( mask, accessmaskbuf ) );
 401 #else
 402         Debug( LDAP_DEBUG_ACL,
 403                 "=> access_allowed: %s access %s by %s\n",
 404                 access2str( access ),
 405                 ACL_GRANT(mask, access) ? "granted" : "denied",
 406                 accessmask2str( mask, accessmaskbuf ) );
 407 #endif
 408
 409         ret = ACL_GRANT(mask, access);
 410
 411 done:
 412         if( state != NULL ) {
 413                 /* If not value-dependent, save ACL in case of more attrs */
 414                 if ( !(state->as_recorded & ACL_STATE_RECORDED_VD) ) {
 415                         state->as_vi_acl = a;
 416                         state->as_result = ret;
 417                 }
 418                 state->as_recorded |= ACL_STATE_RECORDED;
 419         }
 420         if (be_null) op->o_bd = NULL;
 421         return ret;
 422 }
 423
 424 /*
 425  * acl_get - return the acl applicable to entry e, attribute
 426  * attr.  the acl returned is suitable for use in subsequent calls to
 427  * acl_access_allowed().
 428  */
 429
 430 static AccessControl *
 431 acl_get(
 432         AccessControl *a,
 433         int                     *count,
 434         Operation       *op,
 435         Entry           *e,
 436         AttributeDescription *desc,
 437         struct berval   *val,
 438         int                     nmatch,
 439         regmatch_t      *matches )
 440 {
 441         const char *attr;
 442         int dnlen, patlen;
 443
 444         assert( e != NULL );
 445         assert( count != NULL );
 446         assert( desc != NULL );
 447
 448         attr = desc->ad_cname.bv_val;
 449
 450         assert( attr != NULL );
 451
 452         if( a == NULL ) {
 453                 if( op->o_bd == NULL ) {
 454                         a = global_acl;
 455                 } else {
 456                         a = op->o_bd->be_acl;
 457                 }
 458
 459                 assert( a != NULL );
 460
 461         } else {
 462                 a = a->acl_next;
 463         }
 464
 465         dnlen = e->e_nname.bv_len;
 466
 467         for ( ; a != NULL; a = a->acl_next ) {
 468                 (*count) ++;
 469
 470                 if ( a->acl_dn_pat.bv_len || ( a->acl_dn_style != ACL_STYLE_REGEX )) {
 471                         if ( a->acl_dn_style == ACL_STYLE_REGEX ) {
 472 #ifdef NEW_LOGGING
 473                                 LDAP_LOG( ACL, DETAIL1,
 474                                         "acl_get: dnpat [%d] %s nsub: %d\n",
 475                                         *count, a->acl_dn_pat.bv_val,
 476                                         (int) a->acl_dn_re.re_nsub );
 477 #else
 478                                 Debug( LDAP_DEBUG_ACL, "=> dnpat: [%d] %s nsub: %d\n",
 479                                         *count, a->acl_dn_pat.bv_val, (int) a->acl_dn_re.re_nsub );
 480 #endif
 481                                 if (regexec(&a->acl_dn_re, e->e_ndn, nmatch, matches, 0))
 482                                         continue;
 483
 484                         } else {
 485 #ifdef NEW_LOGGING
 486                                 LDAP_LOG( ACL, DETAIL1, "acl_get: dn [%d] %s\n",
 487                                            *count, a->acl_dn_pat.bv_val, 0 );
 488 #else
 489                                 Debug( LDAP_DEBUG_ACL, "=> dn: [%d] %s\n",
 490                                         *count, a->acl_dn_pat.bv_val, 0 );
 491 #endif
 492                                 patlen = a->acl_dn_pat.bv_len;
 493                                 if ( dnlen < patlen )
 494                                         continue;
 495
 496                                 if ( a->acl_dn_style == ACL_STYLE_BASE ) {
 497                                         /* base dn -- entire object DN must match */
 498                                         if ( dnlen != patlen )
 499                                                 continue;
 500
 501                                 } else if ( a->acl_dn_style == ACL_STYLE_ONE ) {
 502                                         int rdnlen = -1;
 503
 504                                         if ( dnlen <= patlen )
 505                                                 continue;
 506
 507                                         if ( !DN_SEPARATOR( e->e_ndn[dnlen - patlen - 1] ) )
 508                                                 continue;
 509
 510                                         rdnlen = dn_rdnlen( NULL, &e->e_nname );
 511                                         if ( rdnlen != dnlen - patlen - 1 )
 512                                                 continue;
 513
 514                                 } else if ( a->acl_dn_style == ACL_STYLE_SUBTREE ) {
 515                                         if ( dnlen > patlen && !DN_SEPARATOR( e->e_ndn[dnlen - patlen - 1] ) )
 516                                                 continue;
 517
 518                                 } else if ( a->acl_dn_style == ACL_STYLE_CHILDREN ) {
 519                                         if ( dnlen <= patlen )
 520                                                 continue;
 521                                         if ( !DN_SEPARATOR( e->e_ndn[dnlen - patlen - 1] ) )
 522                                                 continue;
 523                                 }
 524
 525                                 if ( strcmp( a->acl_dn_pat.bv_val, e->e_ndn + dnlen - patlen ) != 0 )
 526                                         continue;
 527                         }
 528
 529 #ifdef NEW_LOGGING
 530                         LDAP_LOG( ACL, DETAIL1,
 531                                 "acl_get: [%d] matched\n", *count, 0, 0 );
 532 #else
 533                         Debug( LDAP_DEBUG_ACL, "=> acl_get: [%d] matched\n",
 534                                 *count, 0, 0 );
 535 #endif
 536                 }
 537
 538                 if ( a->acl_filter != NULL ) {
 539                         ber_int_t rc = test_filter( NULL, e, a->acl_filter );
 540                         if ( rc != LDAP_COMPARE_TRUE ) {
 541                                 continue;
 542                         }
 543                 }
 544
 545 #ifdef NEW_LOGGING
 546                 LDAP_LOG( ACL, DETAIL1,
 547                         "acl_get: [%d] check attr %s\n", *count, attr ,0 );
 548 #else
 549                 Debug( LDAP_DEBUG_ACL, "=> acl_get: [%d] check attr %s\n",
 550                        *count, attr, 0);
 551 #endif
 552                 if ( a->acl_attrs == NULL ||
 553                         ad_inlist( desc, a->acl_attrs ) )
 554                 {
 555 #ifdef NEW_LOGGING
 556                         LDAP_LOG( ACL, DETAIL1,
 557                                 "acl_get:  [%d] acl %s attr: %s\n", *count, e->e_dn, attr );
 558 #else
 559                         Debug( LDAP_DEBUG_ACL,
 560                                 "<= acl_get: [%d] acl %s attr: %s\n",
 561                                 *count, e->e_dn, attr );
 562 #endif
 563                         return a;
 564                 }
 565                 matches[0].rm_so = matches[0].rm_eo = -1;
 566         }
 567
 568 #ifdef NEW_LOGGING
 569         LDAP_LOG( ACL, RESULTS, "acl_get: done.\n", 0, 0, 0 );
 570 #else
 571         Debug( LDAP_DEBUG_ACL, "<= acl_get: done.\n", 0, 0, 0 );
 572 #endif
 573         return( NULL );
 574 }
 575
 576 /*
 577  * Record value-dependent access control state
 578  */
 579 #define ACL_RECORD_VALUE_STATE do { \
 580                 if( state && !( state->as_recorded & ACL_STATE_RECORDED_VD )) { \
 581                         state->as_recorded |= ACL_STATE_RECORDED_VD; \
 582                         state->as_vd_acl = a; \
 583                         AC_MEMCPY( state->as_vd_acl_matches, matches, \
 584                                 sizeof( state->as_vd_acl_matches )) ; \
 585                         state->as_vd_acl_count = count; \
 586                         state->as_vd_access = b; \
 587                         state->as_vd_access_count = i; \
 588                 } \
 589         } while( 0 )
 590
 591 /*
 592  * acl_mask - modifies mask based upon the given acl and the
 593  * requested access to entry e, attribute attr, value val.  if val
 594  * is null, access to the whole attribute is assumed (all values).
 595  *
 596  * returns      0       access NOT allowed
 597  *              1       access allowed
 598  */
 599
 600 static slap_control_t
 601 acl_mask(
 602         AccessControl   *a,
 603         slap_mask_t *mask,
 604         Operation       *op,
 605         Entry           *e,
 606         AttributeDescription *desc,
 607         struct berval   *val,
 608         regmatch_t      *matches,
 609         int     count,
 610         AccessControlState *state )
 611 {
 612         int             i, odnlen, patlen;
 613         Access  *b;
 614 #ifdef LDAP_DEBUG
 615         char accessmaskbuf[ACCESSMASK_MAXLEN];
 616         char accessmaskbuf1[ACCESSMASK_MAXLEN];
 617 #endif
 618         const char *attr;
 619
 620         assert( a != NULL );
 621         assert( mask != NULL );
 622         assert( desc != NULL );
 623
 624         attr = desc->ad_cname.bv_val;
 625
 626         assert( attr != NULL );
 627
 628 #ifdef NEW_LOGGING
 629         LDAP_LOG( ACL, ENTRY,
 630                 "acl_mask: conn %lu  access to entry \"%s\", attr \"%s\" requested\n",
 631                 op->o_connid, e->e_dn, attr );
 632
 633         LDAP_LOG( ACL, ARGS,
 634                 " to %s by \"%s\", (%s) \n", val ? "value" : "all values",
 635                 op->o_ndn.bv_val ? op->o_ndn.bv_val : "",
 636                 accessmask2str( *mask, accessmaskbuf ) );
 637 #else
 638         Debug( LDAP_DEBUG_ACL,
 639                 "=> acl_mask: access to entry \"%s\", attr \"%s\" requested\n",
 640                 e->e_dn, attr, 0 );
 641
 642         Debug( LDAP_DEBUG_ACL,
 643                 "=> acl_mask: to %s by \"%s\", (%s) \n",
 644                 val ? "value" : "all values",
 645                 op->o_ndn.bv_val ?  op->o_ndn.bv_val : "",
 646                 accessmask2str( *mask, accessmaskbuf ) );
 647 #endif
 648
 649         /* Is this ACL only for a specific value? */
 650         if ( a->acl_attrval.bv_len ) {
 651                 if ( state && !state->as_vd_acl ) {
 652                         state->as_vd_acl = a;
 653                         state->as_vd_access = a->acl_access;
 654                         state->as_vd_access_count = 1;
 655                 }
 656                 if ( val == NULL ) {
 657                         return ACL_BREAK;
 658                 }
 659                 if ( a->acl_attrval_style == ACL_STYLE_REGEX ) {
 660 #ifdef NEW_LOGGING
 661                         LDAP_LOG( ACL, DETAIL1,
 662                                 "acl_get: valpat %s\n",
 663                                 a->acl_attrval.bv_val, 0, 0 );
 664 #else
 665                         Debug( LDAP_DEBUG_ACL,
 666                                 "acl_get: valpat %s\n",
 667                                 a->acl_attrval.bv_val, 0, 0 );
 668 #endif
 669                         if (regexec(&a->acl_attrval_re, val->bv_val, 0, NULL, 0))
 670                                 return ACL_BREAK;
 671                 } else {
 672                         int match = 0;
 673                         const char *text;
 674 #ifdef NEW_LOGGING
 675                         LDAP_LOG( ACL, DETAIL1,
 676                                 "acl_get: val %s\n",
 677                                 a->acl_attrval.bv_val, 0, 0 );
 678 #else
 679                         Debug( LDAP_DEBUG_ACL,
 680                                 "acl_get: val %s\n",
 681                                 a->acl_attrval.bv_val, 0, 0 );
 682 #endif
 683
 684                         if ( a->acl_attrs[0].an_desc->ad_type->sat_syntax != slap_schema.si_syn_distinguishedName ) {
 685                                 if (value_match( &match, desc,
 686                                         desc->ad_type->sat_equality, 0,
 687                                         val, &a->acl_attrval, &text ) != LDAP_SUCCESS ||
 688                                                 match )
 689                                         return ACL_BREAK;
 690
 691                         } else {
 692                                 int             patlen, vdnlen, rc, got_match = 0;
 693                                 struct berval   vdn = { 0, NULL };
 694
 695                                 /* it is a DN */
 696                                 assert( a->acl_attrs[0].an_desc->ad_type->sat_syntax == slap_schema.si_syn_distinguishedName );
 697
 698                                 rc = dnNormalize( 0, NULL, NULL, val, &vdn,
 699                                                 op->o_tmpmemctx );
 700                                 if ( rc != LDAP_SUCCESS ) {
 701                                         /* error */
 702                                         return ACL_BREAK;
 703                                 }
 704
 705                                 patlen = a->acl_attrval.bv_len;
 706                                 vdnlen = vdn.bv_len;
 707
 708                                 if ( vdnlen < patlen )
 709                                         goto attrval_cleanup;
 710
 711                                 if ( a->acl_dn_style == ACL_STYLE_BASE ) {
 712                                         if ( vdnlen > patlen )
 713                                                 goto attrval_cleanup;
 714
 715                                 } else if ( a->acl_dn_style == ACL_STYLE_ONE ) {
 716                                         int rdnlen = -1;
 717
 718                                         if ( !DN_SEPARATOR( vdn.bv_val[vdnlen - patlen - 1] ) )
 719                                                 goto attrval_cleanup;
 720
 721                                         rdnlen = dn_rdnlen( NULL, &vdn );
 722                                         if ( rdnlen != vdnlen - patlen - 1 )
 723                                                 goto attrval_cleanup;
 724
 725                                 } else if ( a->acl_dn_style == ACL_STYLE_SUBTREE ) {
 726                                         if ( vdnlen > patlen && !DN_SEPARATOR( vdn.bv_val[vdnlen - patlen - 1] ) )
 727                                                 goto attrval_cleanup;
 728
 729                                 } else if ( a->acl_dn_style == ACL_STYLE_CHILDREN ) {
 730                                         if ( vdnlen <= patlen )
 731                                                 goto attrval_cleanup;
 732
 733                                         if ( !DN_SEPARATOR( vdn.bv_val[vdnlen - patlen - 1] ) )
 734                                                 goto attrval_cleanup;
 735                                 }
 736
 737                                 got_match = strcmp( a->acl_attrval.bv_val, vdn.bv_val + vdnlen - patlen );
 738
 739 attrval_cleanup:;
 740                                 if ( vdn.bv_val )
 741                                         free( vdn.bv_val );
 742
 743                                 if ( !got_match )
 744                                         return ACL_BREAK;
 745
 746                         }
 747                 }
 748         }
 749
 750         if( state && ( state->as_recorded & ACL_STATE_RECORDED_VD )
 751                 && state->as_vd_acl == a )
 752         {
 753                 b = state->as_vd_access;
 754                 i = state->as_vd_access_count;
 755
 756         } else {
 757                 b = a->acl_access;
 758                 i = 1;
 759         }
 760
 761         for ( ; b != NULL; b = b->a_next, i++ ) {
 762                 slap_mask_t oldmask, modmask;
 763
 764                 ACL_INVALIDATE( modmask );
 765
 766                 /* AND <who> clauses */
 767                 if ( b->a_dn_pat.bv_len != 0 ) {
 768 #ifdef NEW_LOGGING
 769                         LDAP_LOG( ACL, DETAIL1,
 770                                 "acl_mask: conn %lu  check a_dn_pat: %s\n",
 771                                 op->o_connid, b->a_dn_pat.bv_val ,0 );
 772 #else
 773                         Debug( LDAP_DEBUG_ACL, "<= check a_dn_pat: %s\n",
 774                                 b->a_dn_pat.bv_val, 0, 0);
 775 #endif
 776                         /*
 777                          * if access applies to the entry itself, and the
 778                          * user is bound as somebody in the same namespace as
 779                          * the entry, OR the given dn matches the dn pattern
 780                          */
 781                         if ( bvmatch( &b->a_dn_pat, &aci_bv_anonymous ) ) {
 782                                 if ( op->o_ndn.bv_len != 0 ) {
 783                                         continue;
 784                                 }
 785
 786                         } else if ( bvmatch( &b->a_dn_pat, &aci_bv_users ) ) {
 787                                 if ( op->o_ndn.bv_len == 0 ) {
 788                                         continue;
 789                                 }
 790
 791                         } else if ( bvmatch( &b->a_dn_pat, &aci_bv_self ) ) {
 792                                 if ( op->o_ndn.bv_len == 0 ) {
 793                                         continue;
 794                                 }
 795
 796                                 if ( e->e_dn == NULL || !dn_match( &e->e_nname, &op->o_ndn ) ) {
 797                                         continue;
 798                                 }
 799
 800                         } else if ( b->a_dn_style == ACL_STYLE_REGEX ) {
 801                                 if ( !ber_bvccmp( &b->a_dn_pat, '*' ) ) {
 802                                         int ret = regex_matches( &b->a_dn_pat,
 803                                                 op->o_ndn.bv_val, e->e_ndn, matches );
 804
 805                                         if( ret == 0 ) {
 806                                                 continue;
 807                                         }
 808                                 }
 809
 810                         } else {
 811                                 struct berval pat;
 812                                 int got_match = 0;
 813
 814                                 if ( e->e_dn == NULL )
 815                                         continue;
 816
 817                                 if ( b->a_dn_expand ) {
 818                                         struct berval bv;
 819                                         char buf[ACL_BUF_SIZE];
 820
 821                                         bv.bv_len = sizeof( buf ) - 1;
 822                                         bv.bv_val = buf;
 823
 824                                         string_expand(&bv, &b->a_dn_pat,
 825                                                         e->e_ndn, matches);
 826                                         if ( dnNormalize(0, NULL, NULL, &bv, &pat, op->o_tmpmemctx ) != LDAP_SUCCESS ) {
 827                                                 /* did not expand to a valid dn */
 828                                                 continue;
 829                                         }
 830                                 } else {
 831                                         pat = b->a_dn_pat;
 832                                 }
 833
 834                                 patlen = pat.bv_len;
 835                                 odnlen = op->o_ndn.bv_len;
 836                                 if ( odnlen < patlen ) {
 837                                         goto dn_match_cleanup;
 838
 839                                 }
 840
 841                                 if ( b->a_dn_style == ACL_STYLE_BASE ) {
 842                                         /* base dn -- entire object DN must match */
 843                                         if ( odnlen != patlen ) {
 844                                                 goto dn_match_cleanup;
 845                                         }
 846
 847                                 } else if ( b->a_dn_style == ACL_STYLE_ONE ) {
 848                                         int rdnlen = -1;
 849
 850                                         if ( odnlen <= patlen ) {
 851                                                 goto dn_match_cleanup;
 852                                         }
 853
 854                                         if ( !DN_SEPARATOR( op->o_ndn.bv_val[odnlen - patlen - 1] ) ) {
 855                                                 goto dn_match_cleanup;
 856                                         }
 857
 858                                         rdnlen = dn_rdnlen( NULL, &op->o_ndn );
 859                                         if ( rdnlen != odnlen - patlen - 1 ) {
 860                                                 goto dn_match_cleanup;
 861                                         }
 862
 863                                 } else if ( b->a_dn_style == ACL_STYLE_SUBTREE ) {
 864                                         if ( odnlen > patlen && !DN_SEPARATOR( op->o_ndn.bv_val[odnlen - patlen - 1] ) ) {
 865                                                 goto dn_match_cleanup;
 866                                         }
 867
 868                                 } else if ( b->a_dn_style == ACL_STYLE_CHILDREN ) {
 869                                         if ( odnlen <= patlen ) {
 870                                                 goto dn_match_cleanup;
 871                                         }
 872
 873                                         if ( !DN_SEPARATOR( op->o_ndn.bv_val[odnlen - patlen - 1] ) ) {
 874                                                 goto dn_match_cleanup;
 875                                         }
 876                                 }
 877
 878                                 got_match = !strcmp( pat.bv_val, op->o_ndn.bv_val + odnlen - patlen );
 879
 880 dn_match_cleanup:;
 881                                 if ( pat.bv_val != b->a_dn_pat.bv_val ) {
 882                                         free( pat.bv_val );
 883                                 }
 884
 885                                 if ( !got_match ) {
 886                                         continue;
 887                                 }
 888                         }
 889                 }
 890
 891                 if ( b->a_sockurl_pat.bv_len ) {
 892                         if ( ! op->o_conn->c_listener ) {
 893                                 continue;
 894                         }
 895 #ifdef NEW_LOGGING
 896                         LDAP_LOG( ACL, DETAIL1,
 897                                    "acl_mask: conn %lu  check a_sockurl_pat: %s\n",
 898                                    op->o_connid, b->a_sockurl_pat.bv_val , 0 );
 899 #else
 900                         Debug( LDAP_DEBUG_ACL, "<= check a_sockurl_pat: %s\n",
 901                                 b->a_sockurl_pat.bv_val, 0, 0 );
 902 #endif
 903
 904                         if ( !ber_bvccmp( &b->a_sockurl_pat, '*' ) ) {
 905                                 if ( b->a_sockurl_style == ACL_STYLE_REGEX) {
 906                                         if (!regex_matches( &b->a_sockurl_pat, op->o_conn->c_listener_url.bv_val,
 907                                                         e->e_ndn, matches ) )
 908                                         {
 909                                                 continue;
 910                                         }
 911                                 } else {
 912                                         if ( ber_bvstrcasecmp( &b->a_sockurl_pat, &op->o_conn->c_listener_url ) != 0 )
 913                                                 continue;
 914                                 }
 915                         }
 916                 }
 917
 918                 if ( b->a_domain_pat.bv_len ) {
 919                         if ( !op->o_conn->c_peer_domain.bv_val ) {
 920                                 continue;
 921                         }
 922 #ifdef NEW_LOGGING
 923                         LDAP_LOG( ACL, DETAIL1,
 924                                    "acl_mask: conn %lu  check a_domain_pat: %s\n",
 925                                    op->o_connid, b->a_domain_pat.bv_val , 0 );
 926 #else
 927                         Debug( LDAP_DEBUG_ACL, "<= check a_domain_pat: %s\n",
 928                                 b->a_domain_pat.bv_val, 0, 0 );
 929 #endif
 930                         if ( !ber_bvccmp( &b->a_domain_pat, '*' ) ) {
 931                                 if ( b->a_domain_style == ACL_STYLE_REGEX) {
 932                                         if (!regex_matches( &b->a_domain_pat, op->o_conn->c_peer_domain.bv_val,
 933                                                         e->e_ndn, matches ) )
 934                                         {
 935                                                 continue;
 936                                         }
 937                                 } else {
 938                                         char buf[ACL_BUF_SIZE];
 939
 940                                         struct berval   cmp = op->o_conn->c_peer_domain;
 941                                         struct berval   pat = b->a_domain_pat;
 942
 943                                         if ( b->a_domain_expand ) {
 944                                                 struct berval bv;
 945
 946                                                 bv.bv_len = sizeof(buf) - 1;
 947                                                 bv.bv_val = buf;
 948
 949                                                 string_expand(&bv, &b->a_domain_pat, e->e_ndn, matches);
 950                                                 pat = bv;
 951                                         }
 952
 953                                         if ( b->a_domain_style == ACL_STYLE_SUBTREE ) {
 954                                                 int offset = cmp.bv_len - pat.bv_len;
 955                                                 if ( offset < 0 ) {
 956                                                         continue;
 957                                                 }
 958
 959                                                 if ( offset == 1 || ( offset > 1 && cmp.bv_val[ offset - 1 ] != '.' ) ) {
 960                                                         continue;
 961                                                 }
 962
 963                                                 /* trim the domain */
 964                                                 cmp.bv_val = &cmp.bv_val[ offset ];
 965                                                 cmp.bv_len -= offset;
 966                                         }
 967
 968                                         if ( ber_bvstrcasecmp( &pat, &cmp ) != 0 ) {
 969                                                 continue;
 970                                         }
 971                                 }
 972                         }
 973                 }
 974
 975                 if ( b->a_peername_pat.bv_len ) {
 976                         if ( !op->o_conn->c_peer_name.bv_val ) {
 977                                 continue;
 978                         }
 979 #ifdef NEW_LOGGING
 980                         LDAP_LOG( ACL, DETAIL1,
 981                                    "acl_mask: conn %lu  check a_peername_path: %s\n",
 982                                    op->o_connid, b->a_peername_pat.bv_val , 0 );
 983 #else
 984                         Debug( LDAP_DEBUG_ACL, "<= check a_peername_path: %s\n",
 985                                 b->a_peername_pat.bv_val, 0, 0 );
 986 #endif
 987                         if ( !ber_bvccmp( &b->a_peername_pat, '*' ) ) {
 988                                 if ( b->a_peername_style == ACL_STYLE_REGEX) {
 989                                         if (!regex_matches( &b->a_peername_pat, op->o_conn->c_peer_name.bv_val,
 990                                                         e->e_ndn, matches ) )
 991                                         {
 992                                                 continue;
 993                                         }
 994
 995                                 } else {
 996                                         /* try exact match */
 997                                         if ( b->a_peername_style == ACL_STYLE_BASE ) {
 998                                                 if ( ber_bvstrcasecmp( &b->a_peername_pat, &op->o_conn->c_peer_name ) != 0 )
 999                                                         continue;
1000
1001                                         /* extract IP and try exact match */
1002                                         } else if ( b->a_peername_style == ACL_STYLE_IP ) {
1003                                                 char            *port;
1004                                                 char            buf[] = "255.255.255.255";
1005                                                 struct berval   ip;
1006                                                 unsigned long   addr;
1007                                                 int             port_number = -1;
1008
1009                                                 if ( strncasecmp( op->o_conn->c_peer_name.bv_val,
1010                                                                         aci_bv_ip_eq.bv_val, aci_bv_ip_eq.bv_len ) != 0 )
1011                                                         continue;
1012
1013                                                 ip.bv_val = op->o_conn->c_peer_name.bv_val + aci_bv_ip_eq.bv_len;
1014                                                 ip.bv_len = op->o_conn->c_peer_name.bv_len - aci_bv_ip_eq.bv_len;
1015
1016                                                 port = strrchr( ip.bv_val, ':' );
1017                                                 if ( port ) {
1018                                                         char    *next;
1019
1020                                                         ip.bv_len = port - ip.bv_val;
1021                                                         ++port;
1022                                                         port_number = strtol( port, &next, 10 );
1023                                                         if ( next[0] != '\0' )
1024                                                                 continue;
1025                                                 }
1026
1027                                                 /* the port check can be anticipated here */
1028                                                 if ( b->a_peername_port != -1 && port_number != b->a_peername_port )
1029                                                         continue;
1030
1031                                                 /* address longer than expected? */
1032                                                 if ( ip.bv_len >= sizeof(buf) )
1033                                                         continue;
1034
1035                                                 AC_MEMCPY( buf, ip.bv_val, ip.bv_len );
1036                                                 buf[ ip.bv_len ] = '\0';
1037
1038                                                 addr = inet_addr( buf );
1039
1040                                                 /* unable to convert? */
1041                                                 if ( addr == (unsigned long)(-1) )
1042                                                         continue;
1043
1044                                                 if ( (addr & b->a_peername_mask) != b->a_peername_addr )
1045                                                         continue;
1046
1047 #ifdef LDAP_PF_LOCAL
1048                                         /* extract path and try exact match */
1049                                         } else if ( b->a_peername_style == ACL_STYLE_PATH ) {
1050                                                 struct berval path;
1051
1052                                                 if ( strncmp( op->o_conn->c_peer_name.bv_val,
1053                                                                         aci_bv_path_eq.bv_val, aci_bv_path_eq.bv_len ) != 0 )
1054                                                         continue;
1055
1056                                                 path.bv_val = op->o_conn->c_peer_name.bv_val + aci_bv_path_eq.bv_len;
1057                                                 path.bv_len = op->o_conn->c_peer_name.bv_len - aci_bv_path_eq.bv_len;
1058
1059                                                 if ( ber_bvcmp( &b->a_peername_pat, &path ) != 0 )
1060                                                         continue;
1061
1062 #endif /* LDAP_PF_LOCAL */
1063
1064                                         /* exact match (very unlikely...) */
1065                                         } else if ( ber_bvcmp( &op->o_conn->c_peer_name, &b->a_peername_pat ) != 0 ) {
1066                                                         continue;
1067                                         }
1068                                 }
1069                         }
1070                 }
1071
1072                 if ( b->a_sockname_pat.bv_len ) {
1073                         if ( !op->o_conn->c_sock_name.bv_val ) {
1074                                 continue;
1075                         }
1076 #ifdef NEW_LOGGING
1077                         LDAP_LOG( ACL, DETAIL1,
1078                                    "acl_mask: conn %lu  check a_sockname_path: %s\n",
1079                                    op->o_connid, b->a_sockname_pat.bv_val , 0 );
1080 #else
1081                         Debug( LDAP_DEBUG_ACL, "<= check a_sockname_path: %s\n",
1082                                 b->a_sockname_pat.bv_val, 0, 0 );
1083 #endif
1084                         if ( !ber_bvccmp( &b->a_sockname_pat, '*' ) ) {
1085                                 if ( b->a_sockname_style == ACL_STYLE_REGEX) {
1086                                         if (!regex_matches( &b->a_sockname_pat, op->o_conn->c_sock_name.bv_val,
1087                                                         e->e_ndn, matches ) )
1088                                         {
1089                                                 continue;
1090                                         }
1091                                 } else {
1092                                         if ( ber_bvstrcasecmp( &b->a_sockname_pat, &op->o_conn->c_sock_name ) != 0 )
1093                                                 continue;
1094                                 }
1095                         }
1096                 }
1097
1098                 if ( b->a_dn_at != NULL ) {
1099                         Attribute       *at;
1100                         struct berval   bv;
1101                         int rc, match = 0;
1102                         const char *text;
1103                         const char *attr = b->a_dn_at->ad_cname.bv_val;
1104
1105                         assert( attr != NULL );
1106
1107                         if ( op->o_ndn.bv_len == 0 ) {
1108                                 continue;
1109                         }
1110
1111 #ifdef NEW_LOGGING
1112                         LDAP_LOG( ACL, DETAIL1,
1113                                    "acl_mask: conn %lu  check a_dn_pat: %s\n",
1114                                    op->o_connid, attr , 0 );
1115 #else
1116                         Debug( LDAP_DEBUG_ACL, "<= check a_dn_at: %s\n",
1117                                 attr, 0, 0);
1118 #endif
1119                         bv = op->o_ndn;
1120
1121                         /* see if asker is listed in dnattr */
1122                         for( at = attrs_find( e->e_attrs, b->a_dn_at );
1123                                 at != NULL;
1124                                 at = attrs_find( at->a_next, b->a_dn_at ) )
1125                         {
1126                                 if( value_find_ex( b->a_dn_at,
1127                                         SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH |
1128                                                 SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH,
1129                                         at->a_nvals,
1130                                         &bv, op->o_tmpmemctx ) == 0 )
1131                                 {
1132                                         /* found it */
1133                                         match = 1;
1134                                         break;
1135                                 }
1136                         }
1137
1138                         if( match ) {
1139                                 /* have a dnattr match. if this is a self clause then
1140                                  * the target must also match the op dn.
1141                                  */
1142                                 if ( b->a_dn_self ) {
1143                                         /* check if the target is an attribute. */
1144                                         if ( val == NULL ) continue;
1145
1146                                         /* target is attribute, check if the attribute value
1147                                          * is the op dn.
1148                                          */
1149                                         rc = value_match( &match, b->a_dn_at,
1150                                                 b->a_dn_at->ad_type->sat_equality, 0,
1151                                                 val, &bv, &text );
1152                                         /* on match error or no match, fail the ACL clause */
1153                                         if (rc != LDAP_SUCCESS || match != 0 )
1154                                                 continue;
1155                                 }
1156                         } else {
1157                                 /* no dnattr match, check if this is a self clause */
1158                                 if ( ! b->a_dn_self )
1159                                         continue;
1160
1161                                 ACL_RECORD_VALUE_STATE;
1162
1163                                 /* this is a self clause, check if the target is an
1164                                  * attribute.
1165                                  */
1166                                 if ( val == NULL )
1167                                         continue;
1168
1169                                 /* target is attribute, check if the attribute value
1170                                  * is the op dn.
1171                                  */
1172                                 rc = value_match( &match, b->a_dn_at,
1173                                         b->a_dn_at->ad_type->sat_equality, 0,
1174                                         val, &bv, &text );
1175
1176                                 /* on match error or no match, fail the ACL clause */
1177                                 if (rc != LDAP_SUCCESS || match != 0 )
1178                                         continue;
1179                         }
1180                 }
1181
1182                 if ( b->a_group_pat.bv_len ) {
1183                         struct berval bv;
1184                         struct berval ndn = { 0, NULL };
1185                         int rc;
1186
1187                         if ( op->o_ndn.bv_len == 0 ) {
1188                                 continue;
1189                         }
1190
1191                         /* b->a_group is an unexpanded entry name, expanded it should be an
1192                          * entry with objectclass group* and we test to see if odn is one of
1193                          * the values in the attribute group
1194                          */
1195                         /* see if asker is listed in dnattr */
1196                         if ( b->a_group_style == ACL_STYLE_EXPAND ) {
1197                                 char buf[ACL_BUF_SIZE];
1198                                 bv.bv_len = sizeof(buf) - 1;
1199                                 bv.bv_val = buf;
1200
1201                                 string_expand( &bv, &b->a_group_pat, e->e_ndn, matches );
1202                                 if ( dnNormalize( 0, NULL, NULL, &bv, &ndn, op->o_tmpmemctx ) != LDAP_SUCCESS ) {
1203                                         /* did not expand to a valid dn */
1204                                         continue;
1205                                 }
1206
1207                                 bv = ndn;
1208
1209                         } else {
1210                                 bv = b->a_group_pat;
1211                         }
1212
1213                         rc = backend_group( op, e, &bv, &op->o_ndn,
1214                                 b->a_group_oc, b->a_group_at );
1215
1216                         if ( ndn.bv_val ) free( ndn.bv_val );
1217
1218                         if ( rc != 0 ) {
1219                                 continue;
1220                         }
1221                 }
1222
1223                 if ( b->a_set_pat.bv_len != 0 ) {
1224                         struct berval bv;
1225                         char buf[ACL_BUF_SIZE];
1226                         if( b->a_set_style == ACL_STYLE_REGEX ){
1227                                 bv.bv_len = sizeof(buf) - 1;
1228                                 bv.bv_val = buf;
1229                                 string_expand( &bv, &b->a_set_pat, e->e_ndn, matches );
1230                         }else{
1231                                 bv = b->a_set_pat;
1232                         }
1233                         if (aci_match_set( &bv, op, e, 0 ) == 0) {
1234                                 continue;
1235                         }
1236                 }
1237
1238                 if ( b->a_authz.sai_ssf ) {
1239 #ifdef NEW_LOGGING
1240                         LDAP_LOG( ACL, DETAIL1,
1241                                 "acl_mask: conn %lu  check a_authz.sai_ssf: ACL %u > OP %u\n",
1242                                 op->o_connid, b->a_authz.sai_ssf, op->o_ssf  );
1243 #else
1244                         Debug( LDAP_DEBUG_ACL, "<= check a_authz.sai_ssf: ACL %u > OP %u\n",
1245                                 b->a_authz.sai_ssf, op->o_ssf, 0 );
1246 #endif
1247                         if ( b->a_authz.sai_ssf >  op->o_ssf ) {
1248                                 continue;
1249                         }
1250                 }
1251
1252                 if ( b->a_authz.sai_transport_ssf ) {
1253 #ifdef NEW_LOGGING
1254                         LDAP_LOG( ACL, DETAIL1,
1255                                 "acl_mask: conn %lu  check a_authz.sai_transport_ssf: "
1256                                 "ACL %u > OP %u\n",
1257                                 op->o_connid, b->a_authz.sai_transport_ssf,
1258                                 op->o_transport_ssf  );
1259 #else
1260                         Debug( LDAP_DEBUG_ACL,
1261                                 "<= check a_authz.sai_transport_ssf: ACL %u > OP %u\n",
1262                                 b->a_authz.sai_transport_ssf, op->o_transport_ssf, 0 );
1263 #endif
1264                         if ( b->a_authz.sai_transport_ssf >  op->o_transport_ssf ) {
1265                                 continue;
1266                         }
1267                 }
1268
1269                 if ( b->a_authz.sai_tls_ssf ) {
1270 #ifdef NEW_LOGGING
1271                         LDAP_LOG( ACL, DETAIL1,
1272                                 "acl_mask: conn %lu  check a_authz.sai_tls_ssf: ACL %u > "
1273                                 "OP %u\n",
1274                                 op->o_connid, b->a_authz.sai_tls_ssf, op->o_tls_ssf  );
1275 #else
1276                         Debug( LDAP_DEBUG_ACL,
1277                                 "<= check a_authz.sai_tls_ssf: ACL %u > OP %u\n",
1278                                 b->a_authz.sai_tls_ssf, op->o_tls_ssf, 0 );
1279 #endif
1280                         if ( b->a_authz.sai_tls_ssf >  op->o_tls_ssf ) {
1281                                 continue;
1282                         }
1283                 }
1284
1285                 if ( b->a_authz.sai_sasl_ssf ) {
1286 #ifdef NEW_LOGGING
1287                         LDAP_LOG( ACL, DETAIL1,
1288                            "acl_mask: conn %lu check a_authz.sai_sasl_ssf: "
1289                            "ACL %u > OP %u\n",
1290                                 op->o_connid, b->a_authz.sai_sasl_ssf, op->o_sasl_ssf );
1291 #else
1292                         Debug( LDAP_DEBUG_ACL,
1293                                 "<= check a_authz.sai_sasl_ssf: ACL %u > OP %u\n",
1294                                 b->a_authz.sai_sasl_ssf, op->o_sasl_ssf, 0 );
1295 #endif
1296                         if ( b->a_authz.sai_sasl_ssf >  op->o_sasl_ssf ) {
1297                                 continue;
1298                         }
1299                 }
1300
1301 #ifdef SLAPD_ACI_ENABLED
1302                 if ( b->a_aci_at != NULL ) {
1303                         Attribute       *at;
1304                         slap_access_t grant, deny, tgrant, tdeny;
1305                         struct berval parent_ndn, old_parent_ndn;
1306                         BerVarray bvals = NULL;
1307                         int ret,stop;
1308
1309                         /* this case works different from the others above.
1310                          * since aci's themselves give permissions, we need
1311                          * to first check b->a_access_mask, the ACL's access level.
1312                          */
1313
1314                         if ( e->e_nname.bv_len == 0 ) {
1315                                 /* no ACIs in the root DSE */
1316                                 continue;
1317                         }
1318
1319                         /* first check if the right being requested
1320                          * is allowed by the ACL clause.
1321                          */
1322                         if ( ! ACL_GRANT( b->a_access_mask, *mask ) ) {
1323                                 continue;
1324                         }
1325                         /* start out with nothing granted, nothing denied */
1326                         ACL_INIT(tgrant);
1327                         ACL_INIT(tdeny);
1328
1329                         /* get the aci attribute */
1330                         at = attr_find( e->e_attrs, b->a_aci_at );
1331                         if ( at != NULL ) {
1332                                 ACL_RECORD_VALUE_STATE;
1333                                 /* the aci is an multi-valued attribute.  The
1334                                 * rights are determined by OR'ing the individual
1335                                 * rights given by the acis.
1336                                 */
1337                                 for ( i = 0; at->a_vals[i].bv_val != NULL; i++ ) {
1338                                         if (aci_mask( op,
1339                                                 e, desc, val,
1340                                                 &at->a_nvals[i],
1341                                                 matches, &grant, &deny,  &aci_bv_entry ) != 0)
1342                                         {
1343                                                 tgrant |= grant;
1344                                                 tdeny |= deny;
1345                                         }
1346                                 }
1347                                 Debug(LDAP_DEBUG_ACL, "<= aci_mask grant %s deny %s\n",
1348                                           accessmask2str(tgrant,accessmaskbuf),
1349                                           accessmask2str(tdeny, accessmaskbuf1), 0);
1350
1351                         }
1352                         /* If the entry level aci didn't contain anything valid for the
1353                          * current operation, climb up the tree and evaluate the
1354                          * acis with scope set to subtree
1355                          */
1356                         if( (tgrant == ACL_PRIV_NONE) && (tdeny == ACL_PRIV_NONE) ){
1357                                 dnParent(&(e->e_nname), &parent_ndn);
1358                                 while ( parent_ndn.bv_val != old_parent_ndn.bv_val ){
1359                                         old_parent_ndn = parent_ndn;
1360                                         Debug(LDAP_DEBUG_ACL, "checking ACI of %s\n", parent_ndn.bv_val, 0, 0);
1361                                         ret=backend_attribute(op, NULL, &parent_ndn, b->a_aci_at, &bvals);
1362                                         switch(ret){
1363                                                 case LDAP_SUCCESS :
1364                                                         if(bvals){
1365                                                                 for( i = 0; bvals[i].bv_val != NULL; i++){
1366                                                                         ACL_RECORD_VALUE_STATE;
1367                                                                         if (aci_mask(op, e, desc, val, &bvals[i], matches,
1368                                                                                         &grant, &deny, &aci_bv_children) != 0) {
1369                                                                                 tgrant |= grant;
1370                                                                                 tdeny |= deny;
1371                                                                                 /* evaluation stops as soon as either a "deny" or a
1372                                                                                  * "grant" directive matches.
1373                                                                                  */
1374                                                                                 if( (tgrant != ACL_PRIV_NONE) || (tdeny != ACL_PRIV_NONE) ){
1375                                                                                         stop=1;
1376                                                                                 }
1377                                                                         }
1378                                                                         Debug(LDAP_DEBUG_ACL, "<= aci_mask grant %s deny %s\n",
1379                                                                                 accessmask2str(tgrant,accessmaskbuf),
1380                                                                                 accessmask2str(tdeny, accessmaskbuf1), 0);
1381                                                                 }
1382                                                         }
1383                                                         stop=0;
1384                                                         break;
1385                                                 case LDAP_NO_SUCH_ATTRIBUTE:
1386                                                         /* just go on if the aci-Attribute is not present in
1387                                                          * the current entry
1388                                                          */
1389                                                         Debug(LDAP_DEBUG_ACL, "no such attribute\n", 0, 0, 0);
1390                                                         stop=0;
1391                                                         break;
1392                                                 case LDAP_NO_SUCH_OBJECT:
1393                                                         /* We have reached the base object */
1394                                                         Debug(LDAP_DEBUG_ACL, "no such object\n", 0, 0, 0);
1395                                                         stop=1;
1396                                                         break;
1397                                                 default:
1398                                                         stop=1;
1399                                                         break;
1400                                         }
1401                                         if(stop){
1402                                                 break;
1403                                         }
1404                                         dnParent(&old_parent_ndn, &parent_ndn);
1405                                 }
1406                         }
1407
1408
1409                         /* remove anything that the ACL clause does not allow */
1410                         tgrant &= b->a_access_mask & ACL_PRIV_MASK;
1411                         tdeny &= ACL_PRIV_MASK;
1412
1413                         /* see if we have anything to contribute */
1414                         if( ACL_IS_INVALID(tgrant) && ACL_IS_INVALID(tdeny) ) {
1415                                 continue;
1416                         }
1417
1418                         /* this could be improved by changing acl_mask so that it can deal with
1419                          * by clauses that return grant/deny pairs.  Right now, it does either
1420                          * additive or subtractive rights, but not both at the same time.  So,
1421                          * we need to combine the grant/deny pair into a single rights mask in
1422                          * a smart way:  if either grant or deny is "empty", then we use the
1423                          * opposite as is, otherwise we remove any denied rights from the grant
1424                          * rights mask and construct an additive mask.
1425                          */
1426                         if (ACL_IS_INVALID(tdeny)) {
1427                                 modmask = tgrant | ACL_PRIV_ADDITIVE;
1428
1429                         } else if (ACL_IS_INVALID(tgrant)) {
1430                                 modmask = tdeny | ACL_PRIV_SUBSTRACTIVE;
1431
1432                         } else {
1433                                 modmask = (tgrant & ~tdeny) | ACL_PRIV_ADDITIVE;
1434                         }
1435
1436                 } else
1437 #endif
1438                 {
1439                         modmask = b->a_access_mask;
1440                 }
1441
1442 #ifdef NEW_LOGGING
1443                 LDAP_LOG( ACL, RESULTS,
1444                            "acl_mask: [%d] applying %s (%s)\n",
1445                            i, accessmask2str( modmask, accessmaskbuf),
1446                            b->a_type == ACL_CONTINUE ? "continue" : b->a_type == ACL_BREAK
1447                            ? "break" : "stop"  );
1448 #else
1449                 Debug( LDAP_DEBUG_ACL,
1450                         "<= acl_mask: [%d] applying %s (%s)\n",
1451                         i, accessmask2str( modmask, accessmaskbuf ),
1452                         b->a_type == ACL_CONTINUE
1453                                 ? "continue"
1454                                 : b->a_type == ACL_BREAK
1455                                         ? "break"
1456                                         : "stop" );
1457 #endif
1458                 /* save old mask */
1459                 oldmask = *mask;
1460
1461                 if( ACL_IS_ADDITIVE(modmask) ) {
1462                         /* add privs */
1463                         ACL_PRIV_SET( *mask, modmask );
1464
1465                         /* cleanup */
1466                         ACL_PRIV_CLR( *mask, ~ACL_PRIV_MASK );
1467
1468                 } else if( ACL_IS_SUBTRACTIVE(modmask) ) {
1469                         /* substract privs */
1470                         ACL_PRIV_CLR( *mask, modmask );
1471
1472                         /* cleanup */
1473                         ACL_PRIV_CLR( *mask, ~ACL_PRIV_MASK );
1474
1475                 } else {
1476                         /* assign privs */
1477                         *mask = modmask;
1478                 }
1479
1480 #ifdef NEW_LOGGING
1481                 LDAP_LOG( ACL, DETAIL1,
1482                            "acl_mask: conn %lu  [%d] mask: %s\n",
1483                            op->o_connid, i, accessmask2str( *mask, accessmaskbuf)  );
1484 #else
1485                 Debug( LDAP_DEBUG_ACL,
1486                         "<= acl_mask: [%d] mask: %s\n",
1487                         i, accessmask2str(*mask, accessmaskbuf), 0 );
1488 #endif
1489
1490                 if( b->a_type == ACL_CONTINUE ) {
1491                         continue;
1492
1493                 } else if ( b->a_type == ACL_BREAK ) {
1494                         return ACL_BREAK;
1495
1496                 } else {
1497                         return ACL_STOP;
1498                 }
1499         }
1500
1501         /* implicit "by * none" clause */
1502         ACL_INIT(*mask);
1503
1504 #ifdef NEW_LOGGING
1505         LDAP_LOG( ACL, RESULTS,
1506                    "acl_mask: conn %lu  no more <who> clauses, returning %d (stop)\n",
1507                    op->o_connid, accessmask2str( *mask, accessmaskbuf) , 0 );
1508 #else
1509         Debug( LDAP_DEBUG_ACL,
1510                 "<= acl_mask: no more <who> clauses, returning %s (stop)\n",
1511                 accessmask2str(*mask, accessmaskbuf), 0, 0 );
1512 #endif
1513         return ACL_STOP;
1514 }
1515
1516 /*
1517  * acl_check_modlist - check access control on the given entry to see if
1518  * it allows the given modifications by the user associated with op.
1519  * returns      1       if mods allowed ok
1520  *                      0       mods not allowed
1521  */
1522
1523 int
1524 acl_check_modlist(
1525         Operation       *op,
1526         Entry   *e,
1527         Modifications   *mlist
1528 )
1529 {
1530         struct berval *bv;
1531         AccessControlState state = ACL_STATE_INIT;
1532         Backend *be;
1533         int be_null = 0;
1534         int ret = 1; /* default is access allowed */
1535
1536         be = op->o_bd;
1537         if ( be == NULL ) {
1538                 be = &backends[0];
1539                 be_null = 1;
1540                 op->o_bd = be;
1541         }
1542         assert( be != NULL );
1543
1544         /* short circuit root database access */
1545         if ( be_isroot( op->o_bd, &op->o_ndn ) ) {
1546 #ifdef NEW_LOGGING
1547                 LDAP_LOG( ACL, DETAIL1,
1548                            "acl_check_modlist: conn %lu  access granted to root user\n",
1549                            op->o_connid, 0, 0 );
1550 #else
1551                 Debug( LDAP_DEBUG_ACL,
1552                         "<= acl_access_allowed: granted to database root\n",
1553                     0, 0, 0 );
1554 #endif
1555                 goto done;
1556         }
1557
1558         /* use backend default access if no backend acls */
1559         if( op->o_bd != NULL && op->o_bd->be_acl == NULL ) {
1560 #ifdef NEW_LOGGING
1561                 LDAP_LOG( ACL, DETAIL1,
1562                         "acl_check_modlist: backend default %s access %s to \"%s\"\n",
1563                         access2str( ACL_WRITE ),
1564                         op->o_bd->be_dfltaccess >= ACL_WRITE ? "granted" : "denied",
1565                         op->o_dn.bv_val  );
1566 #else
1567                 Debug( LDAP_DEBUG_ACL,
1568                         "=> access_allowed: backend default %s access %s to \"%s\"\n",
1569                         access2str( ACL_WRITE ),
1570                         op->o_bd->be_dfltaccess >= ACL_WRITE ? "granted" : "denied", op->o_dn.bv_val );
1571 #endif
1572                 ret = (op->o_bd->be_dfltaccess >= ACL_WRITE);
1573                 goto done;
1574         }
1575
1576         for ( ; mlist != NULL; mlist = mlist->sml_next ) {
1577                 /*
1578                  * no-user-modification operational attributes are ignored
1579                  * by ACL_WRITE checking as any found here are not provided
1580                  * by the user
1581                  */
1582                 if ( is_at_no_user_mod( mlist->sml_desc->ad_type ) ) {
1583 #ifdef NEW_LOGGING
1584                         LDAP_LOG( ACL, DETAIL1,
1585                                    "acl_check_modlist: conn %lu  no-user-mod %s: modify access granted\n",
1586                                    op->o_connid, mlist->sml_desc->ad_cname.bv_val , 0 );
1587 #else
1588                         Debug( LDAP_DEBUG_ACL, "acl: no-user-mod %s:"
1589                                 " modify access granted\n",
1590                                 mlist->sml_desc->ad_cname.bv_val, 0, 0 );
1591 #endif
1592                         continue;
1593                 }
1594
1595                 switch ( mlist->sml_op ) {
1596                 case LDAP_MOD_REPLACE:
1597                         /*
1598                          * We must check both permission to delete the whole
1599                          * attribute and permission to add the specific attributes.
1600                          * This prevents abuse from selfwriters.
1601                          */
1602                         if ( ! access_allowed( op, e,
1603                                 mlist->sml_desc, NULL, ACL_WRITE, &state ) )
1604                         {
1605                                 ret = 0;
1606                                 goto done;
1607                         }
1608
1609                         if ( mlist->sml_bvalues == NULL ) break;
1610
1611                         /* fall thru to check value to add */
1612
1613                 case LDAP_MOD_ADD:
1614                         assert( mlist->sml_bvalues != NULL );
1615
1616                         for ( bv = mlist->sml_nvalues
1617                                         ? mlist->sml_nvalues : mlist->sml_values;
1618                                 bv->bv_val != NULL; bv++ )
1619                         {
1620                                 if ( ! access_allowed( op, e,
1621                                         mlist->sml_desc, bv, ACL_WRITE, &state ) )
1622                                 {
1623                                         ret = 0;
1624                                         goto done;
1625                                 }
1626                         }
1627                         break;
1628
1629                 case LDAP_MOD_DELETE:
1630                         if ( mlist->sml_bvalues == NULL ) {
1631                                 if ( ! access_allowed( op, e,
1632                                         mlist->sml_desc, NULL, ACL_WRITE, NULL ) )
1633                                 {
1634                                         ret = 0;
1635                                         goto done;
1636                                 }
1637                                 break;
1638                         }
1639                         for ( bv = mlist->sml_nvalues
1640                                         ? mlist->sml_nvalues : mlist->sml_values;
1641                                 bv->bv_val != NULL; bv++ )
1642                         {
1643                                 if ( ! access_allowed( op, e,
1644                                         mlist->sml_desc, bv, ACL_WRITE, &state ) )
1645                                 {
1646                                         ret = 0;
1647                                         goto done;
1648                                 }
1649                         }
1650                         break;
1651
1652                 case SLAP_MOD_SOFTADD:
1653                         /* allow adding attribute via modrdn thru */
1654                         break;
1655
1656                 default:
1657                         assert( 0 );
1658                         /* not reached */
1659                         ret = 0;
1660                         break;
1661                 }
1662         }
1663
1664 done:
1665         if (be_null) op->o_bd = NULL;
1666         return( ret );
1667 }
1668
1669 static int
1670 aci_get_part(
1671         struct berval *list,
1672         int ix,
1673         char sep,
1674         struct berval *bv )
1675 {
1676         int len;
1677         char *p;
1678
1679         if (bv) {
1680                 bv->bv_len = 0;
1681                 bv->bv_val = NULL;
1682         }
1683         len = list->bv_len;
1684         p = list->bv_val;
1685         while (len >= 0 && --ix >= 0) {
1686                 while (--len >= 0 && *p++ != sep) ;
1687         }
1688         while (len >= 0 && *p == ' ') {
1689                 len--;
1690                 p++;
1691         }
1692         if (len < 0)
1693                 return(-1);
1694
1695         if (!bv)
1696                 return(0);
1697
1698         bv->bv_val = p;
1699         while (--len >= 0 && *p != sep) {
1700                 bv->bv_len++;
1701                 p++;
1702         }
1703         while (bv->bv_len > 0 && *--p == ' ')
1704                 bv->bv_len--;
1705         return(bv->bv_len);
1706 }
1707
1708 BerVarray
1709 aci_set_gather (SetCookie *cookie, struct berval *name, struct berval *attr)
1710 {
1711         AciSetCookie *cp = (AciSetCookie *)cookie;
1712         BerVarray bvals = NULL;
1713         struct berval ndn;
1714
1715         /* this routine needs to return the bervals instead of
1716          * plain strings, since syntax is not known.  It should
1717          * also return the syntax or some "comparison cookie".
1718          */
1719
1720         if (dnNormalize(0, NULL, NULL, name, &ndn, cp->op->o_tmpmemctx) == LDAP_SUCCESS) {
1721                 const char *text;
1722                 AttributeDescription *desc = NULL;
1723                 if (slap_bv2ad(attr, &desc, &text) == LDAP_SUCCESS) {
1724                         backend_attribute(cp->op,
1725                                 cp->e, &ndn, desc, &bvals);
1726                 }
1727                 sl_free(ndn.bv_val, cp->op->o_tmpmemctx);
1728         }
1729         return(bvals);
1730 }
1731
1732 static int
1733 aci_match_set (
1734         struct berval *subj,
1735         Operation *op,
1736         Entry *e,
1737         int setref
1738 )
1739 {
1740         struct berval set = { 0, NULL };
1741         int rc = 0;
1742         AciSetCookie cookie;
1743
1744         if (setref == 0) {
1745                 ber_dupbv_x( &set, subj, op->o_tmpmemctx );
1746         } else {
1747                 struct berval subjdn, ndn = { 0, NULL };
1748                 struct berval setat;
1749                 BerVarray bvals;
1750                 const char *text;
1751                 AttributeDescription *desc = NULL;
1752
1753                 /* format of string is "entry/setAttrName" */
1754                 if (aci_get_part(subj, 0, '/', &subjdn) < 0) {
1755                         return(0);
1756                 }
1757
1758                 if ( aci_get_part(subj, 1, '/', &setat) < 0 ) {
1759                         setat.bv_val = SLAPD_ACI_SET_ATTR;
1760                         setat.bv_len = sizeof(SLAPD_ACI_SET_ATTR)-1;
1761                 }
1762
1763                 if ( setat.bv_val != NULL ) {
1764                         /*
1765                          * NOTE: dnNormalize honors the ber_len field
1766                          * as the length of the dn to be normalized
1767                          */
1768                         if ( dnNormalize(0, NULL, NULL, &subjdn, &ndn, op->o_tmpmemctx) == LDAP_SUCCESS
1769                                 && slap_bv2ad(&setat, &desc, &text) == LDAP_SUCCESS )
1770                         {
1771                                 backend_attribute(op, e,
1772                                         &ndn, desc, &bvals);
1773                                 if ( bvals != NULL ) {
1774                                         if ( bvals[0].bv_val != NULL ) {
1775                                                 int i;
1776                                                 set = bvals[0];
1777                                                 bvals[0].bv_val = NULL;
1778                                                 for (i=1;bvals[i].bv_val;i++);
1779                                                 bvals[0].bv_val = bvals[i-1].bv_val;
1780                                                 bvals[i-1].bv_val = NULL;
1781                                         }
1782                                         ber_bvarray_free_x(bvals, op->o_tmpmemctx);
1783                                 }
1784                         }
1785                         if (ndn.bv_val)
1786                                 free(ndn.bv_val);
1787                 }
1788         }
1789
1790         if (set.bv_val != NULL) {
1791                 cookie.op = op;
1792                 cookie.e = e;
1793                 rc = (slap_set_filter(aci_set_gather, (SetCookie *)&cookie, &set,
1794                         &op->o_ndn, &e->e_nname, NULL) > 0);
1795                 sl_free(set.bv_val, op->o_tmpmemctx);
1796         }
1797         return(rc);
1798 }
1799
1800 #ifdef SLAPD_ACI_ENABLED
1801 static int
1802 aci_list_map_rights(
1803         struct berval *list )
1804 {
1805         struct berval bv;
1806         slap_access_t mask;
1807         int i;
1808
1809         ACL_INIT(mask);
1810         for (i = 0; aci_get_part(list, i, ',', &bv) >= 0; i++) {
1811                 if (bv.bv_len <= 0)
1812                         continue;
1813                 switch (*bv.bv_val) {
1814                 case 'c':
1815                         ACL_PRIV_SET(mask, ACL_PRIV_COMPARE);
1816                         break;
1817                 case 's':
1818                         /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt defines
1819                          * the right 's' to mean "set", but in the examples states
1820                          * that the right 's' means "search".  The latter definition
1821                          * is used here.
1822                          */
1823                         ACL_PRIV_SET(mask, ACL_PRIV_SEARCH);
1824                         break;
1825                 case 'r':
1826                         ACL_PRIV_SET(mask, ACL_PRIV_READ);
1827                         break;
1828                 case 'w':
1829                         ACL_PRIV_SET(mask, ACL_PRIV_WRITE);
1830                         break;
1831                 case 'x':
1832                         /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt does not
1833                          * define any equivalent to the AUTH right, so I've just used
1834                          * 'x' for now.
1835                          */
1836                         ACL_PRIV_SET(mask, ACL_PRIV_AUTH);
1837                         break;
1838                 default:
1839                         break;
1840                 }
1841
1842         }
1843         return(mask);
1844 }
1845
1846 static int
1847 aci_list_has_attr(
1848         struct berval *list,
1849         const struct berval *attr,
1850         struct berval *val )
1851 {
1852         struct berval bv, left, right;
1853         int i;
1854
1855         for (i = 0; aci_get_part(list, i, ',', &bv) >= 0; i++) {
1856                 if (aci_get_part(&bv, 0, '=', &left) < 0
1857                         || aci_get_part(&bv, 1, '=', &right) < 0)
1858                 {
1859                         if (ber_bvstrcasecmp(attr, &bv) == 0)
1860                                 return(1);
1861                 } else if (val == NULL) {
1862                         if (ber_bvstrcasecmp(attr, &left) == 0)
1863                                 return(1);
1864                 } else {
1865                         if (ber_bvstrcasecmp(attr, &left) == 0) {
1866                                 /* this is experimental code that implements a
1867                                  * simple (prefix) match of the attribute value.
1868                                  * the ACI draft does not provide for aci's that
1869                                  * apply to specific values, but it would be
1870                                  * nice to have.  If the <attr> part of an aci's
1871                                  * rights list is of the form <attr>=<value>,
1872                                  * that means the aci applies only to attrs with
1873                                  * the given value.  Furthermore, if the attr is
1874                                  * of the form <attr>=<value>*, then <value> is
1875                                  * treated as a prefix, and the aci applies to
1876                                  * any value with that prefix.
1877                                  *
1878                                  * Ideally, this would allow r.e. matches.
1879                                  */
1880                                 if (aci_get_part(&right, 0, '*', &left) < 0
1881                                         || right.bv_len <= left.bv_len)
1882                                 {
1883                                         if (ber_bvstrcasecmp(val, &right) == 0)
1884                                                 return(1);
1885                                 } else if (val->bv_len >= left.bv_len) {
1886                                         if (strncasecmp( val->bv_val, left.bv_val, left.bv_len ) == 0)
1887                                                 return(1);
1888                                 }
1889                         }
1890                 }
1891         }
1892         return(0);
1893 }
1894
1895 static slap_access_t
1896 aci_list_get_attr_rights(
1897         struct berval *list,
1898         const struct berval *attr,
1899         struct berval *val )
1900 {
1901     struct berval bv;
1902     slap_access_t mask;
1903     int i;
1904
1905         /* loop through each rights/attr pair, skip first part (action) */
1906         ACL_INIT(mask);
1907         for (i = 1; aci_get_part(list, i + 1, ';', &bv) >= 0; i += 2) {
1908                 if (aci_list_has_attr(&bv, attr, val) == 0)
1909                         continue;
1910                 if (aci_get_part(list, i, ';', &bv) < 0)
1911                         continue;
1912                 mask |= aci_list_map_rights(&bv);
1913         }
1914         return(mask);
1915 }
1916
1917 static int
1918 aci_list_get_rights(
1919         struct berval *list,
1920         const struct berval *attr,
1921         struct berval *val,
1922         slap_access_t *grant,
1923         slap_access_t *deny )
1924 {
1925     struct berval perm, actn;
1926     slap_access_t *mask;
1927     int i, found;
1928
1929         if (attr == NULL || attr->bv_len == 0
1930                         || ber_bvstrcasecmp( attr, &aci_bv_entry ) == 0) {
1931                 attr = &aci_bv_br_entry;
1932         }
1933
1934         found = 0;
1935         ACL_INIT(*grant);
1936         ACL_INIT(*deny);
1937         /* loop through each permissions clause */
1938         for (i = 0; aci_get_part(list, i, '$', &perm) >= 0; i++) {
1939                 if (aci_get_part(&perm, 0, ';', &actn) < 0)
1940                         continue;
1941                 if (ber_bvstrcasecmp( &aci_bv_grant, &actn ) == 0) {
1942                         mask = grant;
1943                 } else if (ber_bvstrcasecmp( &aci_bv_deny, &actn ) == 0) {
1944                         mask = deny;
1945                 } else {
1946                         continue;
1947                 }
1948
1949                 found = 1;
1950                 *mask |= aci_list_get_attr_rights(&perm, attr, val);
1951                 *mask |= aci_list_get_attr_rights(&perm, &aci_bv_br_all, NULL);
1952         }
1953         return(found);
1954 }
1955
1956 static int
1957 aci_group_member (
1958         struct berval *subj,
1959         struct berval *defgrpoc,
1960         struct berval *defgrpat,
1961         Operation               *op,
1962         Entry           *e,
1963         regmatch_t      *matches
1964 )
1965 {
1966         struct berval subjdn;
1967         struct berval grpoc;
1968         struct berval grpat;
1969         ObjectClass *grp_oc = NULL;
1970         AttributeDescription *grp_ad = NULL;
1971         const char *text;
1972         int rc;
1973
1974         /* format of string is "group/objectClassValue/groupAttrName" */
1975         if (aci_get_part(subj, 0, '/', &subjdn) < 0) {
1976                 return(0);
1977         }
1978
1979         if (aci_get_part(subj, 1, '/', &grpoc) < 0) {
1980                 grpoc = *defgrpoc;
1981         }
1982
1983         if (aci_get_part(subj, 2, '/', &grpat) < 0) {
1984                 grpat = *defgrpat;
1985         }
1986
1987         rc = slap_bv2ad( &grpat, &grp_ad, &text );
1988         if( rc != LDAP_SUCCESS ) {
1989                 rc = 0;
1990                 goto done;
1991         }
1992         rc = 0;
1993
1994         grp_oc = oc_bvfind( &grpoc );
1995
1996         if (grp_oc != NULL && grp_ad != NULL ) {
1997                 char buf[ACL_BUF_SIZE];
1998                 struct berval bv, ndn;
1999                 bv.bv_len = sizeof( buf ) - 1;
2000                 bv.bv_val = (char *)&buf;
2001                 string_expand(&bv, &subjdn, e->e_ndn, matches);
2002                 if ( dnNormalize(0, NULL, NULL, &bv, &ndn, op->o_tmpmemctx) == LDAP_SUCCESS ) {
2003                         rc = (backend_group(op, e, &ndn, &op->o_ndn,
2004                                 grp_oc, grp_ad) == 0);
2005                         free( ndn.bv_val );
2006                 }
2007         }
2008
2009 done:
2010         return(rc);
2011 }
2012
2013 static int
2014 aci_mask(
2015     Operation           *op,
2016     Entry                       *e,
2017         AttributeDescription *desc,
2018     struct berval       *val,
2019     struct berval       *aci,
2020         regmatch_t              *matches,
2021         slap_access_t   *grant,
2022         slap_access_t   *deny,
2023         struct berval   *scope
2024 )
2025 {
2026     struct berval bv, perms, sdn;
2027         int rc;
2028
2029
2030         assert( desc->ad_cname.bv_val != NULL );
2031
2032         /* parse an aci of the form:
2033                 oid#scope#action;rights;attr;rights;attr$action;rights;attr;rights;attr#dnType#subjectDN
2034
2035            See draft-ietf-ldapext-aci-model-04.txt section 9.1 for
2036            a full description of the format for this attribute.
2037            Differences: "this" in the draft is "self" here, and
2038            "self" and "public" is in the position of dnType.
2039
2040            For now, this routine only supports scope=entry.
2041          */
2042         /* check that the aci has all 5 components */
2043         if (aci_get_part(aci, 4, '#', NULL) < 0)
2044                 return(0);
2045
2046         /* check that the aci family is supported */
2047         if (aci_get_part(aci, 0, '#', &bv) < 0)
2048                 return(0);
2049
2050         /* check that the scope matches */
2051         if (aci_get_part(aci, 1, '#', &bv) < 0
2052                 || ber_bvstrcasecmp( scope, &bv ) != 0)
2053         {
2054                 return(0);
2055         }
2056
2057         /* get the list of permissions clauses, bail if empty */
2058         if (aci_get_part(aci, 2, '#', &perms) <= 0)
2059                 return(0);
2060
2061         /* check if any permissions allow desired access */
2062         if (aci_list_get_rights(&perms, &desc->ad_cname, val, grant, deny) == 0)
2063                 return(0);
2064
2065         /* see if we have a DN match */
2066         if (aci_get_part(aci, 3, '#', &bv) < 0)
2067                 return(0);
2068
2069         if (aci_get_part(aci, 4, '#', &sdn) < 0)
2070                 return(0);
2071
2072         if (ber_bvstrcasecmp( &aci_bv_access_id, &bv ) == 0) {
2073                 struct berval ndn;
2074                 rc = 0;
2075                 if ( dnNormalize(0, NULL, NULL, &sdn, &ndn, op->o_tmpmemctx) == LDAP_SUCCESS ) {
2076                         if (dn_match( &op->o_ndn, &ndn))
2077                                 rc = 1;
2078                         free(ndn.bv_val);
2079                 }
2080                 return (rc);
2081
2082         } else if (ber_bvstrcasecmp( &aci_bv_public, &bv ) == 0) {
2083                 return(1);
2084
2085         } else if (ber_bvstrcasecmp( &aci_bv_self, &bv ) == 0) {
2086                 if (dn_match(&op->o_ndn, &e->e_nname))
2087                         return(1);
2088
2089         } else if (ber_bvstrcasecmp( &aci_bv_dnattr, &bv ) == 0) {
2090                 Attribute *at;
2091                 AttributeDescription *ad = NULL;
2092                 const char *text;
2093
2094                 rc = slap_bv2ad( &sdn, &ad, &text );
2095
2096                 if( rc != LDAP_SUCCESS ) {
2097                         return 0;
2098                 }
2099
2100                 rc = 0;
2101
2102                 bv = op->o_ndn;
2103
2104                 for(at = attrs_find( e->e_attrs, ad );
2105                         at != NULL;
2106                         at = attrs_find( at->a_next, ad ) )
2107                 {
2108                         if (value_find_ex( ad,
2109                                 SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH |
2110                                         SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH,
2111                                 at->a_nvals,
2112                                 &bv, op->o_tmpmemctx) == 0 )
2113                         {
2114                                 rc = 1;
2115                                 break;
2116                         }
2117                 }
2118
2119                 return rc;
2120
2121
2122         } else if (ber_bvstrcasecmp( &aci_bv_group, &bv ) == 0) {
2123                 if (aci_group_member(&sdn, &aci_bv_group_class, &aci_bv_group_attr, op, e, matches))
2124                         return(1);
2125
2126         } else if (ber_bvstrcasecmp( &aci_bv_role, &bv ) == 0) {
2127                 if (aci_group_member(&sdn, &aci_bv_role_class, &aci_bv_role_attr, op, e, matches))
2128                         return(1);
2129
2130         } else if (ber_bvstrcasecmp( &aci_bv_set, &bv ) == 0) {
2131                 if (aci_match_set(&sdn, op, e, 0))
2132                         return(1);
2133
2134         } else if (ber_bvstrcasecmp( &aci_bv_set_ref, &bv ) == 0) {
2135                 if (aci_match_set(&sdn, op, e, 1))
2136                         return(1);
2137
2138         }
2139
2140         return(0);
2141 }
2142
2143 #endif  /* SLAPD_ACI_ENABLED */
2144
2145 static void
2146 string_expand(
2147         struct berval *bv,
2148         struct berval *pat,
2149         char *match,
2150         regmatch_t *matches)
2151 {
2152         ber_len_t       size;
2153         char   *sp;
2154         char   *dp;
2155         int     flag;
2156
2157         size = 0;
2158         bv->bv_val[0] = '\0';
2159         bv->bv_len--; /* leave space for lone $ */
2160
2161         flag = 0;
2162         for ( dp = bv->bv_val, sp = pat->bv_val; size < bv->bv_len &&
2163                 sp < pat->bv_val + pat->bv_len ; sp++ )
2164         {
2165                 /* did we previously see a $ */
2166                 if ( flag ) {
2167                         if ( flag == 1 && *sp == '$' ) {
2168                                 *dp++ = '$';
2169                                 size++;
2170                                 flag = 0;
2171
2172                         } else if ( flag == 1 && *sp == '{' /*'}'*/) {
2173                                 flag = 2;
2174
2175                         } else if ( *sp >= '0' && *sp <= '9' ) {
2176                                 int     n;
2177                                 int     i;
2178                                 int     l;
2179
2180                                 n = *sp - '0';
2181
2182                                 if ( flag == 2 ) {
2183                                         for ( sp++; *sp != '\0' && *sp != /*'{'*/ '}'; sp++ ) {
2184                                                 if ( *sp >= '0' && *sp <= '9' ) {
2185                                                         n = 10*n + ( *sp - '0' );
2186                                                 }
2187                                         }
2188
2189                                         if ( *sp != /*'{'*/ '}' ) {
2190                                                 /* error */
2191                                         }
2192                                 }
2193
2194                                 if ( n >= MAXREMATCHES ) {
2195
2196                                 }
2197
2198                                 *dp = '\0';
2199                                 i = matches[n].rm_so;
2200                                 l = matches[n].rm_eo;
2201                                 for ( ; size < bv->bv_len && i < l; size++, i++ ) {
2202                                         *dp++ = match[i];
2203                                 }
2204                                 *dp = '\0';
2205
2206                                 flag = 0;
2207                         }
2208                 } else {
2209                         if (*sp == '$') {
2210                                 flag = 1;
2211                         } else {
2212                                 *dp++ = *sp;
2213                                 size++;
2214                         }
2215                 }
2216         }
2217
2218         if ( flag ) {
2219                 /* must have ended with a single $ */
2220                 *dp++ = '$';
2221                 size++;
2222         }
2223
2224         *dp = '\0';
2225         bv->bv_len = size;
2226
2227 #ifdef NEW_LOGGING
2228         LDAP_LOG( ACL, DETAIL1,
2229            "string_expand:  pattern = %.*s\n", (int)pat->bv_len, pat->bv_val, 0 );
2230         LDAP_LOG( ACL, DETAIL1, "string_expand:  expanded = %s\n", bv->bv_val, 0, 0 );
2231 #else
2232         Debug( LDAP_DEBUG_TRACE, "=> string_expand: pattern:  %.*s\n", (int)pat->bv_len, pat->bv_val, 0 );
2233         Debug( LDAP_DEBUG_TRACE, "=> string_expand: expanded: %s\n", bv->bv_val, 0, 0 );
2234 #endif
2235 }
2236
2237 static int
2238 regex_matches(
2239         struct berval *pat,                     /* pattern to expand and match against */
2240         char *str,                              /* string to match against pattern */
2241         char *buf,                              /* buffer with $N expansion variables */
2242         regmatch_t *matches             /* offsets in buffer for $N expansion variables */
2243 )
2244 {
2245         regex_t re;
2246         char newbuf[ACL_BUF_SIZE];
2247         struct berval bv;
2248         int     rc;
2249
2250         bv.bv_len = sizeof(newbuf) - 1;
2251         bv.bv_val = newbuf;
2252
2253         if(str == NULL) str = "";
2254
2255         string_expand(&bv, pat, buf, matches);
2256         if (( rc = regcomp(&re, newbuf, REG_EXTENDED|REG_ICASE))) {
2257                 char error[ACL_BUF_SIZE];
2258                 regerror(rc, &re, error, sizeof(error));
2259
2260 #ifdef NEW_LOGGING
2261                 LDAP_LOG( ACL, ERR,
2262                            "regex_matches: compile( \"%s\", \"%s\") failed %s\n",
2263                            pat->bv_val, str, error  );
2264 #else
2265                 Debug( LDAP_DEBUG_TRACE,
2266                     "compile( \"%s\", \"%s\") failed %s\n",
2267                         pat->bv_val, str, error );
2268 #endif
2269                 return( 0 );
2270         }
2271
2272         rc = regexec(&re, str, 0, NULL, 0);
2273         regfree( &re );
2274
2275 #ifdef NEW_LOGGING
2276         LDAP_LOG( ACL, DETAIL2, "regex_matches: string:   %s\n", str, 0, 0 );
2277         LDAP_LOG( ACL, DETAIL2, "regex_matches: rc:     %d  %s\n",
2278                    rc, rc ? "matches" : "no matches", 0  );
2279 #else
2280         Debug( LDAP_DEBUG_TRACE,
2281             "=> regex_matches: string:   %s\n", str, 0, 0 );
2282         Debug( LDAP_DEBUG_TRACE,
2283             "=> regex_matches: rc: %d %s\n",
2284                 rc, !rc ? "matches" : "no matches", 0 );
2285 #endif
2286         return( !rc );
2287 }
2288